diffly-cli 1.0.0__tar.gz → 1.1.0__tar.gz

{diffly_cli-1.0.0 → diffly_cli-1.1.0}/CHANGELOG.md

@@ -2,7 +2,20 @@
 
 All notable changes to diffly are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [1.1.0] - 2026-08-23
+
+### Fixed
+
+- Fast keystroke bursts in the interactive review menu register every press: escape sequences stop at their terminator instead of swallowing neighboring keys.
+- Diff content lines beginning with `++` or `--` are counted, scanned for credentials, and analyzed instead of being mistaken for the file's header lines.
+- `diffly setup` no longer runs the update check twice in a row (once in `main()` and again inside the wizard it launches).
+- Pressing an arrow key in the interactive review menu no longer crashes with `NameError: name '_read_escape_sequence' is not defined`; the escape-sequence reader is defined again and a lone Escape still exits without blocking.
+
+### Changed
+
+- Verdicts rebalanced around merge-readiness: pending required checks and version-bump-only manifest edits are now review notes instead of quarantine gates, so healthy pull requests pass.
+- `BLOCK` is reserved for major signals only — failed required checks, or credential-like values added to production code. Credential-like values limited to tests, fixtures, or docs quarantine for confirmation instead of blocking.
+- `QUARANTINE` now targets newly added dependencies; lockfile refreshes and version bumps without new packages stay visible as notes.
 
 ## [1.0.0] - 2026-08-22
 

{diffly_cli-1.0.0 → diffly_cli-1.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: diffly-cli
-Version: 1.0.0
+Version: 1.1.0
 Summary: Deterministic triage for large GitHub pull requests
 Author: Vivaan Dhawan
 License: MIT License — diffly
@@ -283,9 +283,9 @@ Default model is `gpt-5-mini`; override with `DIFFLY_LLM_MODEL` or `--llm-model`
 
 | Verdict | Rule |
 | --- | --- |
-| **BLOCK** | A required check failed, or the changed hunk appears to add a credential-like value. |
-| **QUARANTINE** | Security-sensitive code, database schema/migrations, dependency changes, or still-pending checks need focused review. |
-| **PASS** | No blocking or quarantine rule fired. Missing obvious tests and unavailable checks stay visible as review notes, but do not turn an otherwise healthy PR into `QUARANTINE`. `SHIP` remains accepted as a legacy alias. |
+| **BLOCK** | A required check failed, or production code appears to add a credential-like value. |
+| **QUARANTINE** | Security-sensitive code, database schema/migrations, or newly added dependencies need focused review. Credential-like values limited to tests, fixtures, or docs also quarantine rather than block. |
+| **PASS** | Healthy changes, ready to merge. Pending or unavailable checks, version-bump-only manifest edits, and missing obvious tests stay visible as review notes, not gates. `SHIP` remains accepted as a legacy alias. |
 
 `PASS` is the normal healthy outcome. A verdict is a review signal, not a claim that a PR is correct or safe in every context.
 

{diffly_cli-1.0.0 → diffly_cli-1.1.0}/README.md

@@ -154,9 +154,9 @@ Default model is `gpt-5-mini`; override with `DIFFLY_LLM_MODEL` or `--llm-model`
 
 | Verdict | Rule |
 | --- | --- |
-| **BLOCK** | A required check failed, or the changed hunk appears to add a credential-like value. |
-| **QUARANTINE** | Security-sensitive code, database schema/migrations, dependency changes, or still-pending checks need focused review. |
-| **PASS** | No blocking or quarantine rule fired. Missing obvious tests and unavailable checks stay visible as review notes, but do not turn an otherwise healthy PR into `QUARANTINE`. `SHIP` remains accepted as a legacy alias. |
+| **BLOCK** | A required check failed, or production code appears to add a credential-like value. |
+| **QUARANTINE** | Security-sensitive code, database schema/migrations, or newly added dependencies need focused review. Credential-like values limited to tests, fixtures, or docs also quarantine rather than block. |
+| **PASS** | Healthy changes, ready to merge. Pending or unavailable checks, version-bump-only manifest edits, and missing obvious tests stay visible as review notes, not gates. `SHIP` remains accepted as a legacy alias. |
 
 `PASS` is the normal healthy outcome. A verdict is a review signal, not a claim that a PR is correct or safe in every context.
 

{diffly_cli-1.0.0 → diffly_cli-1.1.0}/assets/logo-v2.svg

@@ -12,7 +12,7 @@
       <stop offset="1" stop-color="#0A1114"/>
     </linearGradient>
     <filter id="glow" x="-30%" y="-30%" width="160%" height="160%">
-      <feGaussianBlur stdDeviation="8" result="blur"/>
+      <feGaussianBlur stdDeviation="5" result="blur"/>
       <feMerge>
         <feMergeNode in="blur"/>
         <feMergeNode in="SourceGraphic"/>
@@ -28,7 +28,7 @@
   <g fill="url(#mint)" filter="url(#glow)">
     <rect x="154" y="215" width="82" height="22" rx="11"/>
     <rect x="184" y="185" width="22" height="82" rx="11"/>
-    <rect x="304" y="274" width="72" height="22" rx="11"/>
+    <rect x="286" y="274" width="72" height="22" rx="11"/>
     <path d="M271 177h25l-58 158h-25l58-158Z"/>
   </g>
 

{diffly_cli-1.0.0 → diffly_cli-1.1.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "diffly-cli"
-version = "1.0.0"
+version = "1.1.0"
 description = "Deterministic triage for large GitHub pull requests"
 readme = "README.md"
 requires-python = ">=3.10"

{diffly_cli-1.0.0 → diffly_cli-1.1.0}/src/diffly_cli/__init__.py

@@ -1,3 +1,3 @@
 """Deterministic triage for large GitHub pull requests."""
 
-__version__ = "1.0.0"
+__version__ = "1.1.0"

{diffly_cli-1.0.0 → diffly_cli-1.1.0}/src/diffly_cli/cli.py

@@ -300,7 +300,7 @@ def render_markdown(result: TriageResult, explanation: ExplanationResult | None
     for file in result.files:
         symbols = ", ".join(file.touched_symbols) if file.touched_symbols else "—"
         lines.append(f"| `{file.path}` | {file.status} | {file.additions} | {file.deletions} | {symbols} |")
-    lines += ["", "## Deterministic policy", "", "- `BLOCK`: failed checks or a credential-like value added to a changed hunk.", "- `QUARANTINE`: security-sensitive code, database schema or migration changes, dependency changes, or still-pending checks.", "- `PASS`: no blocking or quarantine signal fired. Missing obvious tests or unavailable checks remain visible as review notes, not verdict gates.", "", "_Generated by diffly. Deterministic triage is authoritative; any literate-diff prose is optional generated explanation._"]
+    lines += ["", "## Deterministic policy", "", "- `BLOCK`: failed required checks, or a credential-like value added to production code.", "- `QUARANTINE`: security-sensitive code, database schema or migration changes, newly added dependencies, or credential-like values limited to tests, fixtures, or docs.", "- `PASS`: healthy changes ready to merge. Pending or unavailable checks, version-bump-only manifest edits, and missing obvious tests remain visible as review notes, not gates.", "", "_Generated by diffly. Deterministic triage is authoritative; any literate-diff prose is optional generated explanation._"]
     return "\n".join(lines) + "\n"
 
 
@@ -360,6 +360,36 @@ def _section_lines(result: TriageResult, section: str, explanation: ExplanationR
     return [f"{item.path}  +{item.additions}/-{item.deletions}" for item in result.files[:80]] or ["No changed files returned."]
 
 
+def _read_escape_sequence(timeout: float = 0.05) -> str:
+    """Collect the bytes that follow an Escape keypress (e.g. ``[A`` for ↑).
+
+    Reads one byte at a time and stops at the CSI final byte (``@``–``~``
+    after the ``[`` and any parameter bytes), so a burst of queued keystrokes
+    is never over-consumed — trailing keys stay available to the menu loop.
+    A lone Escape press sends no further bytes, so the read stops as soon as
+    the input goes quiet instead of blocking.
+    """
+    fd = sys.stdin.fileno()
+    chunks: list[str] = []
+    while True:
+        ready, _, _ = select.select([fd], [], [], timeout)
+        if not ready:
+            break
+        try:
+            data = os.read(fd, 1)
+        except OSError:
+            break
+        if not data:
+            break
+        char = data.decode("utf-8", errors="replace")
+        chunks.append(char)
+        if len(chunks) == 1 and char != "[":
+            break
+        if len(chunks) > 1 and "@" <= char <= "~":
+            break
+    return "".join(chunks)
+
+
 def interactive_view(result: TriageResult, explanation: ExplanationResult | None = None) -> None:
     """Let a reviewer choose the report sections to include with the keyboard."""
     if not sys.stdin.isatty() or not sys.stdout.isatty():
@@ -379,7 +409,9 @@ def interactive_view(result: TriageResult, explanation: ExplanationResult | None
     fd = sys.stdin.fileno()
     old = termios.tcgetattr(fd)
     try:
-        tty.setcbreak(fd)
+        # Pin TCSANOW: newer Pythons default setcbreak to TCSAFLUSH, which
+        # would silently discard any keys typed while the menu was rendering.
+        tty.setcbreak(fd, termios.TCSANOW)
         while True:
             menu = Table(show_header=False, box=None, padding=(0, 1), expand=False)
             menu.add_column("", width=2)
@@ -398,8 +430,18 @@ def interactive_view(result: TriageResult, explanation: ExplanationResult | None
                 padding=(1, 2),
             )
             center_screen(screen, estimated_height=len(labels) + 7)
-            key = sys.stdin.read(1)
-            if key in {"q", "Q"}:
+            # Read every keystroke from the raw descriptor so the escape-sequence
+            # reader sees the same byte stream. Buffered sys.stdin.read(1) pulls a
+            # whole packet (e.g. two fast arrow taps) into its internal buffer,
+            # leaving the fd-level reader with nothing and silently dropping keys.
+            try:
+                raw = os.read(fd, 1)
+            except OSError:
+                return
+            if not raw:
+                return
+            key = raw.decode("utf-8", errors="replace")
+            if key in {"q", "Q", "\x04"}:
                 return
             if key in {"\r", "\n"}:
                 break
@@ -428,7 +470,9 @@ def interactive_view(result: TriageResult, explanation: ExplanationResult | None
         )
         center_screen(screen, estimated_height=min(console.size.height, len(labels) * 5 + 7))
     finally:
-        termios.tcsetattr(fd, termios.TCSADRAIN, old)
+        # TCSANOW, not TCSADRAIN: draining can block forever when the peer
+        # (CI ptys, expect harnesses) is not reading our echoed output.
+        termios.tcsetattr(fd, termios.TCSANOW, old)
 
 
 def build_result(client: GitHubClient, owner: str, repo: str, number: int) -> TriageResult:
@@ -863,7 +907,9 @@ def main(argv: list[str] | None = None) -> int:
     if not effective_argv:
         return run_wizard(parser)
     args = parser.parse_args(effective_argv)
-    if args.command not in ("update", "version", "help", "doctor"):
+    # `setup` ends in the wizard, which runs its own update check; checking
+    # here too would prompt the user twice in a row.
+    if args.command not in ("update", "version", "help", "doctor", "setup"):
         _check_and_prompt_update()
     return args.func(args)
 

{diffly_cli-1.0.0 → diffly_cli-1.1.0}/src/diffly_cli/diffparse.py

@@ -33,6 +33,28 @@ def parse_hunks(patch: str) -> list[Hunk]:
     return hunks
 
 
+def hunk_body_lines(patch: str) -> list[str]:
+    """Return the raw lines inside hunk bodies, excluding the file-header prelude.
+
+    Content lines may themselves begin with ``---`` or ``+++`` (removed CLI
+    flags, added Markdown headings), so header detection must stop at the
+    first ``@@`` marker instead of pattern-matching every line. Patches that
+    carry no ``@@`` marker at all are treated as body-only (bare hunks from
+    the GitHub files endpoint); a full ``diff --git`` block without hunks has
+    its prelude stripped.
+    """
+    lines = patch.splitlines()
+    for index, line in enumerate(lines):
+        if line.startswith("@@"):
+            return lines[index + 1 :]
+    if lines and lines[0].startswith("diff --git"):
+        for index, line in enumerate(lines):
+            if line.startswith("+++ "):
+                return lines[index + 1 :]
+        return []
+    return lines
+
+
 def files_from_unified_diff(diff: str) -> list[ChangedFile]:
     """Build ChangedFile objects from a raw GitHub unified diff."""
     blocks = re.split(r"(?=^diff --git a/)", diff, flags=re.MULTILINE)
@@ -50,8 +72,9 @@ def files_from_unified_diff(diff: str) -> list[ChangedFile]:
             status = "removed"
         elif re.search(r"^rename from ", block, flags=re.MULTILINE):
             status = "renamed"
-        additions = sum(1 for line in block.splitlines() if line.startswith("+") and not line.startswith("+++") )
-        deletions = sum(1 for line in block.splitlines() if line.startswith("-") and not line.startswith("---") )
+        body = hunk_body_lines(block)
+        additions = sum(1 for line in body if line.startswith("+"))
+        deletions = sum(1 for line in body if line.startswith("-"))
         file = ChangedFile(path=path, status=status, additions=additions, deletions=deletions, changes=additions + deletions, patch=block)
         file.hunks = parse_hunks(block)
         files.append(file)
@@ -89,12 +112,8 @@ def language_for_path(path: str) -> str | None:
 
 def added_source(patch: str) -> str:
     lines = []
-    for line in patch.splitlines():
-        if line.startswith("+++") or line.startswith("---"):
-            continue
-        if line.startswith("+"):
-            lines.append(line[1:])
-        elif line.startswith(" "):
+    for line in hunk_body_lines(patch):
+        if line.startswith("+") or line.startswith(" "):
             lines.append(line[1:])
     return "\n".join(lines)
 

{diffly_cli-1.0.0 → diffly_cli-1.1.0}/src/diffly_cli/triage.py

@@ -5,6 +5,7 @@ import re
 from collections import defaultdict
 from typing import Any
 
+from .diffparse import hunk_body_lines
 from .models import ChangedFile, PRMetadata, RiskFlag
 from .redact import redact_secrets
 
@@ -37,8 +38,8 @@ def _added_dependency_names(file: ChangedFile) -> list[str]:
     if file.path.rsplit("/", 1)[-1] not in DEPENDENCY_FILES:
         return []
     values: list[str] = []
-    for line in file.patch.splitlines():
-        if line.startswith("+") and not line.startswith("+++"):
+    for line in hunk_body_lines(file.patch):
+        if line.startswith("+"):
             match = re.search(r"[\"']([@A-Za-z0-9_./-]+)[\"']\s*[:=]", line)
             if match:
                 values.append(match.group(1))
@@ -47,6 +48,25 @@ def _added_dependency_names(file: ChangedFile) -> list[str]:
     return sorted(dict.fromkeys(values))
 
 
+def _removed_dependency_names(file: ChangedFile) -> list[str]:
+    if file.path.rsplit("/", 1)[-1] not in DEPENDENCY_FILES:
+        return []
+    values: list[str] = []
+    for line in hunk_body_lines(file.patch):
+        if line.startswith("-"):
+            match = re.search(r"[\"']([@A-Za-z0-9_./-]+)[\"']\s*[:=]", line)
+            if match:
+                values.append(match.group(1))
+            elif re.search(r"^[-]\s*[A-Za-z0-9_.-]+[=<>~]", line):
+                values.append(line[1:].strip().split()[0])
+    return sorted(dict.fromkeys(values))
+
+
+def _dependency_base_name(name: str) -> str:
+    """Strip version constraints so a bumped pin matches its original install."""
+    return re.split(r"[=<>~!;\s@\[]", name, maxsplit=1)[0].lower()
+
+
 def _test_files(files: list[ChangedFile]) -> list[str]:
     return [file.path for file in files if _matches(file.path, TEST_PATTERNS)]
 
@@ -63,7 +83,7 @@ def _covered_by_test(file: ChangedFile, test_paths: list[str]) -> list[str]:
 
 def _has_exposed_secret(file: ChangedFile) -> bool:
     """Detect a credential-like value added in the changed hunk, not just its path."""
-    added_lines = "\n".join(line[1:] for line in file.patch.splitlines() if line.startswith("+") and not line.startswith("+++"))
+    added_lines = "\n".join(line[1:] for line in hunk_body_lines(file.patch) if line.startswith("+"))
     # A generic ``token = os.getenv(...)`` assignment is common application
     # code, not evidence of an exposed credential. Block only on high-confidence
     # credential formats (keys, bearer tokens, private keys, connection URLs).
@@ -93,9 +113,11 @@ def compute_flags(metadata: PRMetadata, files: list[ChangedFile], checks: dict[s
 
     dependency_evidence: list[str] = []
     for file in files:
-        names = _added_dependency_names(file)
-        if names:
-            dependency_evidence.append(f"{file.path}: {', '.join(names)}")
+        file_added = _added_dependency_names(file)
+        removed_bases = {_dependency_base_name(name) for name in _removed_dependency_names(file)}
+        new_here = [name for name in file_added if _dependency_base_name(name) not in removed_bases]
+        if new_here:
+            dependency_evidence.append(f"{file.path}: {', '.join(new_here)}")
         elif file.path.rsplit("/", 1)[-1] in DEPENDENCY_FILES and file.additions > 0:
             dependency_evidence.append(file.path)
     if dependency_evidence:
@@ -132,20 +154,28 @@ def verdict_for(flags: list[RiskFlag], checks: dict[str, Any]) -> tuple[str, lis
     if "CHECKS_FAILED" in codes:
         reasoning.append("BLOCK because at least one status check failed.")
         return "BLOCK", reasoning
-    if "EXPOSED_SECRET" in codes:
-        reasoning.append("BLOCK because the pull request appears to add a credential-like value.")
+    secret_flag = next((flag for flag in flags if flag.code == "EXPOSED_SECRET"), None)
+    production_hits = [path for path in (secret_flag.evidence if secret_flag else []) if _is_production_file(path)]
+    if production_hits:
+        reasoning.append("BLOCK because a credential-like value was added to production code: " + ", ".join(f"`{path}`" for path in production_hits[:5]) + ".")
         return "BLOCK", reasoning
     if "AUTH_OR_SECRET" in codes:
         reasoning.append("QUARANTINE because authentication or security-sensitive code changed and needs focused review.")
     if "DATABASE_CHANGE" in codes:
         reasoning.append("QUARANTINE because database schema or migration changes require an explicit review gate.")
-    if "NEW_DEPENDENCY" in codes:
-        reasoning.append("QUARANTINE because dependency changes expand the supply-chain and runtime surface.")
-    if "CHECKS_PENDING" in codes:
-        reasoning.append("QUARANTINE because required checks are still running.")
+    dependency_flag = next((flag for flag in flags if flag.code == "NEW_DEPENDENCY"), None)
+    named_new = [evidence for evidence in (dependency_flag.evidence if dependency_flag else []) if ": " in evidence]
+    if named_new:
+        reasoning.append("QUARANTINE because newly added dependencies expand the supply-chain and runtime surface.")
+    if secret_flag is not None:
+        reasoning.append("QUARANTINE because a credential-like value appears only outside production code (tests, fixtures, or docs); confirm it is intentionally fake.")
     if reasoning:
         return "QUARANTINE", reasoning
     observations: list[str] = []
+    if "CHECKS_PENDING" in codes:
+        observations.append("required checks were still running")
+    if "NEW_DEPENDENCY" in codes and not named_new:
+        observations.append("dependency manifests changed without newly added packages")
     if "NO_TEST_COVERAGE" in codes:
         observations.append("no obvious test coverage was found for one or more production files")
     if "CHECKS_UNKNOWN" in codes:

{diffly_cli-1.0.0 → diffly_cli-1.1.0}/tests/test_regressions.py

@@ -275,3 +275,237 @@ def test_zero_argument_invocation_uses_wizard(monkeypatch):
     monkeypatch.setattr(cli, "run_wizard", fake_wizard)
     assert cli.main([]) == 0
     assert "parser" in called
+
+
+def _triage_result():
+    from diffly_cli.models import TriageResult
+
+    return TriageResult(metadata=metadata(), files=[], flags=[], verdict="PASS", reasoning=["ok"], checks={}, source="github")
+
+
+def test_escape_sequence_reader_returns_arrow_codes(monkeypatch):
+    import os
+
+    import diffly_cli.cli as cli
+
+    read_fd, write_fd = os.pipe()
+    monkeypatch.setattr(cli.sys.stdin, "fileno", lambda: read_fd)
+    try:
+        os.write(write_fd, b"[A")
+        assert cli._read_escape_sequence(0.5) == "[A"
+    finally:
+        os.close(read_fd)
+        os.close(write_fd)
+
+
+def test_escape_sequence_reader_treats_a_lone_escape_as_empty(monkeypatch):
+    import os
+
+    import diffly_cli.cli as cli
+
+    read_fd, write_fd = os.pipe()
+    monkeypatch.setattr(cli.sys.stdin, "fileno", lambda: read_fd)
+    try:
+        assert cli._read_escape_sequence(0.01) == ""
+    finally:
+        os.close(read_fd)
+        os.close(write_fd)
+
+
+def test_interactive_menu_handles_arrow_keys_without_crashing(monkeypatch):
+    """Regression: pressing an arrow key used to raise NameError (_read_escape_sequence missing)."""
+    import io
+    import os
+    import pty
+
+    import diffly_cli.cli as cli
+
+    master_fd, slave_fd = pty.openpty()
+    stream = io.TextIOWrapper(os.fdopen(slave_fd, "rb", buffering=0))
+    monkeypatch.setattr(cli.sys, "stdin", stream)
+    monkeypatch.setattr(cli.sys.stdout, "isatty", lambda: True)
+    try:
+        # Down, up, then Enter: exercises both arrow branches plus the final render.
+        os.write(master_fd, "\x1b[B\x1b[A\r".encode())
+        cli.interactive_view(_triage_result())
+    finally:
+        stream.close()
+        os.close(master_fd)
+
+
+def test_interactive_menu_keeps_up_with_rapid_arrow_taps(monkeypatch):
+    """Regression: keystrokes arriving in one packet were swallowed by the
+    buffered reader, so fast arrow taps did nothing (and Enter could be eaten,
+    leaving the menu stuck)."""
+    import io
+    import os
+    import pty
+    import signal
+
+    import diffly_cli.cli as cli
+
+    master_fd, slave_fd = pty.openpty()
+    stream = io.TextIOWrapper(os.fdopen(slave_fd, "rb", buffering=0))
+    monkeypatch.setattr(cli.sys.stdout, "isatty", lambda: True)
+    monkeypatch.setattr(cli.sys, "stdin", stream)
+    old_alarm = signal.alarm(10)
+    try:
+        # Down, down, up in one burst, then Enter to leave the menu.
+        os.write(master_fd, "\x1b[B\x1b[B\x1b[A\r".encode())
+        cli.interactive_view(_triage_result())
+    finally:
+        signal.alarm(0)
+        stream.close()
+        os.close(master_fd)
+
+
+def test_menu_exits_when_stdin_reaches_eof(monkeypatch):
+    """Regression: a closed input stream used to spin the redraw loop forever."""
+    import io
+    import os
+    import pty
+    import signal
+
+    import diffly_cli.cli as cli
+
+    master_fd, slave_fd = pty.openpty()
+    stream = io.TextIOWrapper(os.fdopen(slave_fd, "rb", buffering=0))
+    monkeypatch.setattr(cli.sys.stdout, "isatty", lambda: True)
+    monkeypatch.setattr(cli.sys, "stdin", stream)
+    old_alarm = signal.alarm(10)
+    try:
+        os.close(master_fd)
+        cli.interactive_view(_triage_result())
+    finally:
+        signal.alarm(0)
+        stream.close()
+
+
+def test_escape_sequence_reader_consumes_exactly_one_sequence(monkeypatch):
+    """Regression: the reader used to drain up to 16 bytes, so a burst like
+    '↓ space ↓' lost its Space/Enter to the escape reader and the menu hung."""
+    import os
+
+    import diffly_cli.cli as cli
+
+    read_fd, write_fd = os.pipe()
+    monkeypatch.setattr(cli.sys.stdin, "fileno", lambda: read_fd)
+    try:
+        os.write(write_fd, b"[A\x1b[B")
+        assert cli._read_escape_sequence(0.5) == "[A"
+        assert os.read(read_fd, 1) == b"\x1b"  # next keystroke must be untouched
+        assert cli._read_escape_sequence(0.5) == "[B"
+    finally:
+        os.close(read_fd)
+        os.close(write_fd)
+
+
+def test_setup_delegates_the_update_check_to_the_wizard(monkeypatch):
+    """Regression: `diffly setup` used to run the update check twice — once in
+    main() and again inside the wizard it launches — prompting back to back."""
+    import diffly_cli.cli as cli
+
+    calls: list[str] = []
+    monkeypatch.setattr(cli, "_check_and_prompt_update", lambda: calls.append("check"))
+    monkeypatch.setattr(cli, "run_setup", lambda args: 0)
+    assert cli.main(["setup"]) == 0
+    assert calls == []
+
+    calls.clear()
+    monkeypatch.setattr(cli, "run_pr", lambda args: 0)
+    assert cli.main(["pr", "acme/demo", "1"]) == 0
+    assert calls == ["check"]
+
+
+def test_content_lines_looking_like_headers_are_still_counted():
+    """Regression: added/deleted lines whose content begins with ++/-- were
+    mistaken for the file's ---/+++ header lines and dropped from counts and
+    scans."""
+    from diffly_cli.diffparse import files_from_unified_diff
+
+    diff = (
+        "diff --git a/notes.md b/notes.md\n"
+        "index 0000001..0000002 100644\n"
+        "--- a/notes.md\n"
+        "+++ b/notes.md\n"
+        "@@ -1,3 +1,3 @@\n"
+        " intro\n"
+        "--- old banner\n"
+        "+++ new banner\n"
+        " tail\n"
+    )
+    file = files_from_unified_diff(diff)[0]
+    assert file.additions == 1
+    assert file.deletions == 1
+
+
+def test_github_json_patch_without_prelude_is_counted():
+    """Bare hunk bodies (GitHub files-endpoint patches) carry no @@ prelude and
+    must scan unchanged."""
+    from diffly_cli.diffparse import hunk_body_lines
+
+    body = hunk_body_lines("@@ -1,2 +1,2 @@\n-context\n+replacement\n")
+    assert sum(1 for line in body if line.startswith("+")) == 1
+    assert sum(1 for line in body if line.startswith("-")) == 1
+
+    bare = hunk_body_lines("+API_KEY = 'x'\n-context\n")
+    assert bare[0] == "+API_KEY = 'x'"
+    assert "-context" in bare
+
+
+def test_truncated_diff_block_with_prelude_but_no_hunks_counts_nothing():
+    from diffly_cli.diffparse import files_from_unified_diff
+
+    diff = (
+        "diff --git a/big.bin b/big.bin\n"
+        "index 0000001..0000002 100644\n"
+        "Binary files a/big.bin and b/big.bin differ\n"
+        "--- a/big.bin\n"
+        "+++ b/big.bin\n"
+    )
+    file = files_from_unified_diff(diff)[0]
+    assert file.additions == 0
+    assert file.deletions == 0
+
+
+def test_secret_on_plus_prefixed_content_line_is_detected():
+    """Regression: content beginning with ++ made the whole diff line look like
+    the file's +++ header, hiding it from counting and the secret scan. The
+    credential must be flagged; production paths block, tests/docs quarantine."""
+    from diffly_cli.models import ChangedFile
+    from diffly_cli.triage import compute_flags, verdict_for
+
+    patch = (
+        "diff --git a/deploy/config.py b/deploy/config.py\n"
+        "--- a/deploy/config.py\n"
+        "+++ b/deploy/config.py\n"
+        "@@ -1,2 +1,3 @@\n"
+        " intro\n"
+        "+++ postgresql://admin:hunter2@db.internal.example/prod\n"
+    )
+    files = [ChangedFile(path="deploy/config.py", status="modified", additions=1, deletions=0, changes=1, patch=patch)]
+    checks = {"state": "success", "count": 1, "repository_tree_complete": True}
+    flags = compute_flags(metadata(), files, checks, ["deploy/config.py"])
+    codes = {flag.code for flag in flags}
+    assert "EXPOSED_SECRET" in codes
+    assert files[0].additions == 1
+    assert verdict_for(flags, checks)[0] == "BLOCK"
+
+
+def test_dependency_detection_survives_plus_prefixed_lines():
+    from diffly_cli.models import ChangedFile
+    from diffly_cli.triage import _added_dependency_names
+
+    patch = (
+        "diff --git a/package.json b/package.json\n"
+        "--- a/package.json\n"
+        "+++ b/package.json\n"
+        "@@ -1,3 +1,4 @@\n"
+        " {\n"
+        '+  "left-pad": "^1.3.0",\n'
+        "+  // +++ see docs\n"
+        '   "name": "x"\n'
+        " }\n"
+    )
+    names = _added_dependency_names(ChangedFile(path="package.json", status="modified", additions=2, deletions=0, changes=2, patch=patch))
+    assert names == ["left-pad"]

{diffly_cli-1.0.0 → diffly_cli-1.1.0}/tests/test_triage.py

@@ -36,16 +36,41 @@ def test_exposed_credential_blocks():
     assert "credential-like value" in reasoning[0]
 
 
-def test_dependency_and_missing_tests_quarantines():
+def test_manifest_touch_without_new_packages_is_a_review_note():
+    """Regression: any manifest edit used to quarantine; version bumps are routine."""
     files = [
         ChangedFile("pyproject.toml", "modified", 1, 0, 1, '+dependencies = ["new-lib"]\n'),
         ChangedFile("src/new_module.py", "added", 3, 0, 3, "+def run():\n+    return 1\n"),
     ]
     flags = compute_flags(metadata(), files, {"state": "success", "count": 1}, ["pyproject.toml", "src/new_module.py"])
-    verdict, _ = verdict_for(flags, {"state": "success"})
+    verdict, reasoning = verdict_for(flags, {"state": "success"})
     assert "NEW_DEPENDENCY" in {flag.code for flag in flags}
     assert "NO_TEST_COVERAGE" in {flag.code for flag in flags}
+    assert verdict == "PASS"
+    assert any("dependency manifests changed" in item for item in reasoning)
+
+
+def test_truly_new_dependency_quarantines():
+    files = [
+        ChangedFile("requirements.txt", "modified", 1, 0, 2, "-flask==3.0.0\n+flask==3.1.0\n+left-pad==1.0.0\n"),
+    ]
+    flags = compute_flags(metadata(), files, {"state": "success", "count": 1}, ["requirements.txt"])
+    verdict, reasoning = verdict_for(flags, {"state": "success"})
     assert verdict == "QUARANTINE"
+    assert any("newly added dependencies" in item for item in reasoning)
+    named = next(flag for flag in flags if flag.code == "NEW_DEPENDENCY")
+    assert any("left-pad" in ev for ev in named.evidence)
+
+
+def test_version_bump_only_passes_with_a_note():
+    files = [
+        ChangedFile("requirements.txt", "modified", 1, 1, 2, "-requests==2.31.0\n+requests==2.32.0\n"),
+    ]
+    flags = compute_flags(metadata(), files, {"state": "success", "count": 1}, ["requirements.txt"])
+    verdict, reasoning = verdict_for(flags, {"state": "success"})
+    assert "NEW_DEPENDENCY" in {flag.code for flag in flags}
+    assert verdict == "PASS"
+    assert any("dependency manifests changed" in item for item in reasoning)
 
 
 def test_all_clear_ships():
@@ -74,11 +99,13 @@ def test_unknown_checks_do_not_downgrade_an_otherwise_healthy_pr():
     assert "status checks were unavailable" in reasoning[0]
 
 
-def test_pending_checks_quarantine():
-    flags = compute_flags(metadata(), [], {"state": "pending", "count": 1}, [])
+def test_pending_checks_are_a_review_note_not_a_gate():
+    """Regression: pending checks used to quarantine every PR analyzed before CI finished."""
+    file = ChangedFile("src/app.py", "modified", 1, 0, 1, "+value = compute()\n")
+    flags = compute_flags(metadata(), [file], {"state": "pending", "count": 1, "pending": ["ci/build"]}, ["tests/test_app.py"])
     verdict, reasoning = verdict_for(flags, {"state": "pending"})
     assert "CHECKS_PENDING" in {flag.code for flag in flags}
-    assert verdict == "QUARANTINE"
+    assert verdict == "PASS"
     assert any("still running" in item for item in reasoning)
 
 
@@ -99,3 +126,35 @@ def test_changed_line_numbers_ignore_no_newline_markers():
     )
     file.hunks = parse_hunks(file.patch)
     assert changed_line_numbers(file) == [1, 2]
+
+
+def test_credential_in_tests_quarantines_instead_of_blocking():
+    """Regression: fake credentials inside test fixtures used to hard-block PRs."""
+    file = ChangedFile(
+        "tests/fixtures/deploy.py",
+        "modified",
+        1,
+        0,
+        1,
+        '+DB_URL = "postgresql://admin:hunter2@db.internal.example/prod"\n',
+    )
+    flags = compute_flags(metadata(), [file], {"state": "success", "count": 1}, [])
+    verdict, reasoning = verdict_for(flags, {"state": "success"})
+    assert "EXPOSED_SECRET" in {flag.code for flag in flags}
+    assert verdict == "QUARANTINE"
+    assert any("outside production code" in item for item in reasoning)
+
+
+def test_credential_in_production_still_blocks():
+    file = ChangedFile(
+        "deploy/config.py",
+        "modified",
+        1,
+        0,
+        1,
+        '+DB_URL = "postgresql://admin:hunter2@db.internal.example/prod"\n',
+    )
+    flags = compute_flags(metadata(), [file], {"state": "success", "count": 1}, [])
+    verdict, reasoning = verdict_for(flags, {"state": "success"})
+    assert verdict == "BLOCK"
+    assert "production code" in reasoning[0]