diffly-cli 0.4.0__py3-none-any.whl

diffly_cli/models.py

@@ -0,0 +1,68 @@
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Any
+
+
+@dataclass
+class PRMetadata:
+    owner: str
+    repo: str
+    number: int
+    title: str
+    body: str
+    state: str
+    author: str
+    base_ref: str
+    head_ref: str
+    base_sha: str
+    head_sha: str
+    mergeable_state: str
+    additions: int
+    deletions: int
+    changed_files: int
+    commits: int
+    html_url: str
+
+
+@dataclass
+class Hunk:
+    header: str
+    old_start: int
+    old_count: int
+    new_start: int
+    new_count: int
+    lines: list[str] = field(default_factory=list)
+
+
+@dataclass
+class ChangedFile:
+    path: str
+    status: str
+    additions: int
+    deletions: int
+    changes: int
+    patch: str = ""
+    hunks: list[Hunk] = field(default_factory=list)
+    touched_symbols: list[str] = field(default_factory=list)
+    callers: list[str] = field(default_factory=list)
+    tests_found: list[str] = field(default_factory=list)
+
+
+@dataclass
+class RiskFlag:
+    code: str
+    severity: str
+    message: str
+    evidence: list[str] = field(default_factory=list)
+
+
+@dataclass
+class TriageResult:
+    metadata: PRMetadata
+    files: list[ChangedFile]
+    flags: list[RiskFlag]
+    verdict: str
+    reasoning: list[str]
+    checks: dict[str, Any]
+    source: str

diffly_cli/redact.py

@@ -0,0 +1,59 @@
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True)
+class RedactionResult:
+    text: str
+    count: int
+    labels: tuple[str, ...]
+
+
+_PATTERNS: tuple[tuple[str, re.Pattern[str], str], ...] = (
+    (
+        "private_key",
+        re.compile(r"-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----.*?-----END [A-Z0-9 ]*PRIVATE KEY-----", re.DOTALL),
+        "[REDACTED_PRIVATE_KEY]",
+    ),
+    (
+        "github_token",
+        re.compile(r"\b(?:gh[pousr]_[A-Za-z0-9_\-]{20,}|github_pat_[A-Za-z0-9_\-]{20,})\b"),
+        "[REDACTED_GITHUB_TOKEN]",
+    ),
+    (
+        "aws_access_key",
+        re.compile(r"\bAKIA[0-9A-Z]{16}\b"),
+        "[REDACTED_AWS_ACCESS_KEY]",
+    ),
+    (
+        "bearer_token",
+        re.compile(r"(?i)(\bBearer\s+)[A-Za-z0-9_\-.=+/]{16,}"),
+        r"\1[REDACTED_BEARER_TOKEN]",
+    ),
+    (
+        "secret_assignment",
+        re.compile(
+            r"(?i)(\b(?:api[_-]?key|access[_-]?key|secret|password|passwd|token|auth[_-]?token|client[_-]?secret)\b\s*[:=]\s*)([\"']?)[^\s,;\"'}]+(\2)"
+        ),
+        r"\1\2[REDACTED_SECRET]\3",
+    ),
+    (
+        "connection_string",
+        re.compile(r"(?i)\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis)://[^\s\"']+"),
+        "[REDACTED_CONNECTION_STRING]",
+    ),
+)
+
+
+def redact_secrets(text: str) -> RedactionResult:
+    labels: list[str] = []
+    count = 0
+    redacted = text
+    for label, pattern, replacement in _PATTERNS:
+        redacted, substitutions = pattern.subn(replacement, redacted)
+        if substitutions:
+            count += substitutions
+            labels.extend([label] * substitutions)
+    return RedactionResult(redacted, count, tuple(labels))

diffly_cli/triage.py

@@ -0,0 +1,142 @@
+from __future__ import annotations
+
+import fnmatch
+import re
+from collections import defaultdict
+from typing import Any
+
+from .models import ChangedFile, PRMetadata, RiskFlag
+
+AUTH_PATTERNS = [
+    "*auth*", "*login*", "*oauth*", "*credential*", "*secret*", "*.pem", "*.key",
+    ".env", ".env.*", "*token*", "*password*", "*security*", "*iam*",
+]
+DB_PATTERNS = ["*migration*", "*migrations*", "*schema*", "*alembic*", "*prisma*", "*.sql", "*db*model*"]
+TEST_PATTERNS = ["test*", "tests*", "spec*", "*_test.*", "*.test.*", "*.spec.*"]
+DEPENDENCY_FILES = {
+    "package.json", "package-lock.json", "npm-shrinkwrap.json", "yarn.lock", "pnpm-lock.yaml",
+    "pyproject.toml", "poetry.lock", "requirements.txt", "requirements-dev.txt", "Pipfile", "Pipfile.lock",
+    "go.mod", "go.sum", "Cargo.toml", "Cargo.lock", "Gemfile", "Gemfile.lock", "pom.xml", "build.gradle",
+}
+
+
+def _matches(path: str, patterns: list[str]) -> bool:
+    lowered = path.lower()
+    return any(fnmatch.fnmatch(lowered, pattern.lower()) or fnmatch.fnmatch(lowered.split("/")[-1], pattern.lower()) for pattern in patterns)
+
+
+def _is_production_file(path: str) -> bool:
+    lowered = path.lower()
+    parts = lowered.split("/")
+    if any(part in {"docs", "examples", "fixtures", "generated", "tests", "test"} for part in parts):
+        return False
+    if _matches(path, TEST_PATTERNS):
+        return False
+    return not lowered.endswith((".md", ".txt", ".json")) and lowered != "install.sh"
+
+
+def _added_dependency_names(file: ChangedFile) -> list[str]:
+    if file.path.rsplit("/", 1)[-1] not in DEPENDENCY_FILES:
+        return []
+    values: list[str] = []
+    for line in file.patch.splitlines():
+        if line.startswith("+") and not line.startswith("+++"):
+            match = re.search(r"[\"']([@A-Za-z0-9_./-]+)[\"']\s*[:=]", line)
+            if match:
+                values.append(match.group(1))
+            elif re.search(r"^[+]\s*[A-Za-z0-9_.-]+[=<>~]", line):
+                values.append(line[1:].strip().split()[0])
+    return sorted(dict.fromkeys(values))
+
+
+def _test_files(files: list[ChangedFile]) -> list[str]:
+    return [file.path for file in files if _matches(file.path, TEST_PATTERNS)]
+
+
+def _covered_by_test(file: ChangedFile, test_paths: list[str]) -> list[str]:
+    stem = file.path.rsplit("/", 1)[-1].rsplit(".", 1)[0].lower()
+    matches = []
+    for test_path in test_paths:
+        name = test_path.rsplit("/", 1)[-1].lower()
+        if stem in name or file.path.rsplit("/", 1)[0].lower() in test_path.lower():
+            matches.append(test_path)
+    return matches
+
+
+def compute_flags(metadata: PRMetadata, files: list[ChangedFile], checks: dict[str, Any], repo_paths: list[str] | None = None) -> list[RiskFlag]:
+    flags: list[RiskFlag] = []
+    tree_complete = bool(checks.get("repository_tree_complete", repo_paths is not None))
+    test_paths = [path for path in (repo_paths or []) if _matches(path, TEST_PATTERNS)] if tree_complete else []
+    changed_test_paths = _test_files(files)
+    if not tree_complete:
+        flags.append(RiskFlag("REPOSITORY_TREE_INCOMPLETE", "medium", "Repository file listing was unavailable or truncated; repository-wide test coverage could not be established.", ["repository tree incomplete"]))
+
+    auth_files = [file.path for file in files if _matches(file.path, AUTH_PATTERNS)]
+    if auth_files:
+        flags.append(RiskFlag("AUTH_OR_SECRET", "high", "Touches authentication, credentials, secrets, or security-sensitive files.", auth_files))
+
+    db_files = [file.path for file in files if _matches(file.path, DB_PATTERNS)]
+    if db_files:
+        flags.append(RiskFlag("DATABASE_CHANGE", "high", "Touches database schema, models, migrations, or SQL.", db_files))
+
+    dependency_evidence: list[str] = []
+    for file in files:
+        names = _added_dependency_names(file)
+        if names:
+            dependency_evidence.append(f"{file.path}: {', '.join(names)}")
+        elif file.path.rsplit("/", 1)[-1] in DEPENDENCY_FILES and file.additions > 0:
+            dependency_evidence.append(file.path)
+    if dependency_evidence:
+        flags.append(RiskFlag("NEW_DEPENDENCY", "medium", "Adds or changes a dependency manifest or lockfile.", dependency_evidence))
+
+    untested: list[str] = []
+    for file in files:
+        if _matches(file.path, TEST_PATTERNS):
+            continue
+        coverage = _covered_by_test(file, test_paths + changed_test_paths)
+        file.tests_found = coverage
+        if _is_production_file(file.path) and not coverage:
+            untested.append(file.path)
+    if untested and tree_complete:
+        flags.append(RiskFlag("NO_TEST_COVERAGE", "medium", "Changed production files have no obvious neighboring or repository test coverage.", untested[:50]))
+
+    check_state = str(checks.get("state", "unknown"))
+    if check_state == "not_applicable":
+        # Local mode has no CI; skip check-derived flags entirely.
+        return flags
+    if check_state == "failure":
+        flags.append(RiskFlag("CHECKS_FAILED", "critical", "One or more required status checks failed.", list(checks.get("failed", []))))
+    elif check_state == "pending":
+        flags.append(RiskFlag("CHECKS_PENDING", "low", "Required status checks are still pending.", list(checks.get("pending", [])) or [check_state]))
+    elif check_state != "success":
+        flags.append(RiskFlag("CHECKS_UNKNOWN", "medium", "Required status checks are missing, pending, or unavailable.", [check_state]))
+
+    return flags
+
+
+def verdict_for(flags: list[RiskFlag], checks: dict[str, Any]) -> tuple[str, list[str]]:
+    codes = {flag.code for flag in flags}
+    reasoning: list[str] = []
+    if "CHECKS_FAILED" in codes:
+        reasoning.append("BLOCK because at least one status check failed.")
+        return "BLOCK", reasoning
+    if "AUTH_OR_SECRET" in codes:
+        reasoning.append("BLOCK because the pull request touches authentication, credentials, secrets, or security-sensitive files.")
+        return "BLOCK", reasoning
+    if "DATABASE_CHANGE" in codes:
+        reasoning.append("QUARANTINE because database schema or migration changes require an explicit review gate.")
+    if "NEW_DEPENDENCY" in codes:
+        reasoning.append("QUARANTINE because dependency changes expand the supply-chain and runtime surface.")
+    if "NO_TEST_COVERAGE" in codes:
+        reasoning.append("QUARANTINE because at least one changed production file lacks obvious test coverage.")
+    if "CHECKS_UNKNOWN" in codes:
+        reasoning.append("QUARANTINE because the pull request does not have a confirmed passing check result.")
+    if "CHECKS_PENDING" in codes:
+        reasoning.append("QUARANTINE because required checks are still running.")
+    if reasoning:
+        return "QUARANTINE", reasoning
+    if str(checks.get("state")) == "not_applicable":
+        reasoning.append("PASS because no blocking or quarantine rule fired (local analysis has no CI checks).")
+    else:
+        reasoning.append("PASS because no blocking or quarantine rule fired and all observed checks passed.")
+    return "PASS", reasoning

diffly_cli/update.py

@@ -0,0 +1,161 @@
+"""Check for and install updates to diffly-cli.
+
+Version checks use the PyPI JSON API so the lookup is fast and does not
+require git or GitHub API authentication.  The actual upgrade command is
+chosen based on how diffly was originally installed:
+
+- ``curl | install.sh``  → re-runs the install script
+- ``brew install``       → runs ``brew upgrade diffly-cli``
+- ``pip install``        → runs ``pip install --upgrade diffly-cli``
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+from typing import Any
+
+from . import __version__
+
+CONFIG_DIR = Path.home() / ".diffly"
+CONFIG_FILE = CONFIG_DIR / "config.json"
+PYPI_URL = "https://pypi.org/pypi/diffly-cli/json"
+INSTALL_SCRIPT_URL = (
+    "https://raw.githubusercontent.com/VIVAAN-DHAWAN/diffly-cli/main/install.sh"
+)
+INSTALLER_VENV = Path.home() / ".local" / "share" / "diffly-cli"
+
+
+# ---------------------------------------------------------------------------
+# Version helpers
+# ---------------------------------------------------------------------------
+
+def _parse_version(version_str: str) -> tuple[int, ...]:
+    """Parse a version string like '0.3.0' into a comparable tuple."""
+    return tuple(int(part) for part in version_str.split(".") if part.isdigit())
+
+
+# ---------------------------------------------------------------------------
+# Config persistence  (~/.diffly/config.json)
+# ---------------------------------------------------------------------------
+
+def _load_config() -> dict[str, Any]:
+    """Load the diffly user configuration, returning defaults when absent."""
+    if not CONFIG_FILE.exists():
+        return {}
+    try:
+        return json.loads(CONFIG_FILE.read_text(encoding="utf-8"))
+    except (json.JSONDecodeError, OSError):
+        return {}
+
+
+def _save_config(config: dict[str, Any]) -> None:
+    """Persist diffly user configuration to disk."""
+    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+    CONFIG_FILE.write_text(json.dumps(config, indent=2), encoding="utf-8")
+
+
+def get_update_preference() -> str | None:
+    """Return the stored update preference: 'auto', 'manual', or None if never set."""
+    return _load_config().get("update_preference")
+
+
+def set_update_preference(preference: str) -> None:
+    """Persist the user's update preference ('auto' or 'manual')."""
+    config = _load_config()
+    config["update_preference"] = preference
+    _save_config(config)
+
+
+# ---------------------------------------------------------------------------
+# PyPI lookup
+# ---------------------------------------------------------------------------
+
+def _fetch_pypi_info() -> dict[str, Any] | None:
+    """Fetch the latest release metadata from PyPI."""
+    import urllib.request
+    import urllib.error
+
+    try:
+        req = urllib.request.Request(PYPI_URL, headers={"Accept": "application/json"})
+        with urllib.request.urlopen(req, timeout=5) as resp:
+            return json.loads(resp.read().decode("utf-8"))
+    except (urllib.error.URLError, OSError, json.JSONDecodeError):
+        return None
+
+
+def check_for_update() -> str | None:
+    """Return the latest version string if a newer release exists on PyPI.
+
+    Returns ``None`` when the installed version is current or when the PyPI
+    lookup cannot be completed (network error, timeout, etc.).
+    """
+    info = _fetch_pypi_info()
+    if info is None:
+        return None
+    try:
+        latest = info["info"]["version"]
+    except (KeyError, TypeError):
+        return None
+    if _parse_version(latest) > _parse_version(__version__):
+        return latest
+    return None
+
+
+# ---------------------------------------------------------------------------
+# Installation detection
+# ---------------------------------------------------------------------------
+
+def _detect_install_method() -> str:
+    """Return 'installer', 'brew', or 'pip' based on how diffly was installed."""
+    if INSTALLER_VENV.is_dir():
+        return "installer"
+    if shutil.which("brew") is not None:
+        try:
+            result = subprocess.run(
+                ["brew", "list", "diffly-cli"],
+                capture_output=True,
+                text=True,
+                timeout=10,
+            )
+            if result.returncode == 0:
+                return "brew"
+        except (subprocess.TimeoutExpired, OSError):
+            pass
+    return "pip"
+
+
+# ---------------------------------------------------------------------------
+# Update installation
+# ---------------------------------------------------------------------------
+
+def install_update() -> bool:
+    """Upgrade diffly using the same method it was originally installed with.
+
+    Detects whether diffly was installed via the curl installer script,
+    Homebrew, or pip, and runs the matching upgrade command.
+    """
+    method = _detect_install_method()
+
+    if method == "installer":
+        cmd = f"curl -fsSL {INSTALL_SCRIPT_URL} | sh"
+        args = ["sh", "-c", cmd]
+    elif method == "brew":
+        args = ["brew", "upgrade", "diffly-cli"]
+    else:
+        args = [sys.executable, "-m", "pip", "install", "--upgrade", "diffly-cli"]
+
+    try:
+        result = subprocess.run(
+            args,
+            capture_output=True,
+            text=True,
+            timeout=120,
+        )
+        return result.returncode == 0
+    except (subprocess.TimeoutExpired, OSError):
+        return False