exolot 0.1.0__py3-none-any.whl

exolot/__init__.py

@@ -0,0 +1,8 @@
+"""Run SonarQube for IDE's language server from the command line."""
+
+from importlib.metadata import PackageNotFoundError, version
+
+try:
+    __version__ = version("exolot")
+except PackageNotFoundError:
+    __version__ = "0.0.0"

exolot/__main__.py

@@ -0,0 +1,3 @@
+from .cli import main
+
+raise SystemExit(main())

exolot/analyze.py

@@ -0,0 +1,340 @@
+"""Run the language server headlessly over a set of files and collect issues."""
+
+from __future__ import annotations
+
+import logging
+import os
+import shutil
+import subprocess
+import threading
+import time
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any
+
+from . import __version__
+from .lsp import LspClient
+from .server import Server
+
+log = logging.getLogger(__name__)
+
+# VS Code language ids, which is what the server expects in didOpen.
+LANGUAGE_IDS = {
+    ".py": "python",
+    ".pyi": "python",
+    ".js": "javascript",
+    ".mjs": "javascript",
+    ".cjs": "javascript",
+    ".jsx": "javascriptreact",
+    ".ts": "typescript",
+    ".mts": "typescript",
+    ".cts": "typescript",
+    ".tsx": "typescriptreact",
+    ".vue": "vue",
+    ".css": "css",
+    ".scss": "scss",
+    ".less": "less",
+    ".html": "html",
+    ".htm": "html",
+    ".xml": "xml",
+    ".java": "java",
+    ".php": "php",
+    ".go": "go",
+    ".cs": "csharp",
+    ".c": "c",
+    ".h": "c",
+    ".cpp": "cpp",
+    ".cc": "cpp",
+    ".cxx": "cpp",
+    ".hpp": "cpp",
+    ".yaml": "yaml",
+    ".yml": "yaml",
+    ".json": "json",
+    ".tf": "terraform",
+    ".bicep": "bicep",
+    ".sh": "shellscript",
+    ".bash": "shellscript",
+    ".properties": "properties",
+}
+
+SKIP_DIRS = {".git", ".hg", ".svn", "node_modules", "__pycache__", ".venv", "venv", ".tox", ".mypy_cache"}
+MAX_FILE_SIZE = 2 * 1024 * 1024
+SEVERITY_NAMES = {1: "error", 2: "warning", 3: "info", 4: "hint"}
+
+
+@dataclass
+class Issue:
+    path: Path
+    line: int  # 1-based
+    column: int  # 1-based
+    end_line: int
+    end_column: int
+    rule: str
+    message: str
+    severity: str
+    raw: dict[str, Any] = field(repr=False)
+
+
+def language_id(path: Path) -> str:
+    if path.name == "Dockerfile" or path.name.startswith("Dockerfile."):
+        return "dockerfile"
+    return LANGUAGE_IDS.get(path.suffix.lower(), "plaintext")
+
+
+def collect_files(paths: list[Path]) -> list[Path]:
+    """Expand directories into the files under them, skipping ignored and binary files."""
+    result: list[Path] = []
+    seen: set[Path] = set()
+    for path in paths:
+        if not path.exists():
+            raise FileNotFoundError(f"no such file or directory: {path}")
+        candidates = [path] if path.is_file() else _list_dir(path)
+        for f in candidates:
+            f = f.resolve()
+            if f not in seen and _is_analyzable(f):
+                seen.add(f)
+                result.append(f)
+    return result
+
+
+def _list_dir(directory: Path) -> list[Path]:
+    git = shutil.which("git")
+    if git:
+        proc = subprocess.run(
+            [git, "ls-files", "-z", "--cached", "--others", "--exclude-standard"],
+            cwd=directory,
+            capture_output=True,
+        )
+        if proc.returncode == 0:
+            return [directory / name for name in proc.stdout.decode().split("\0") if name]
+    files = []
+    for dirpath, dirnames, filenames in os.walk(directory):
+        dirnames[:] = [d for d in dirnames if d not in SKIP_DIRS and not d.startswith(".")]
+        files.extend(Path(dirpath) / name for name in filenames)
+    return files
+
+
+def _is_analyzable(path: Path) -> bool:
+    try:
+        if not path.is_file() or path.stat().st_size > MAX_FILE_SIZE:
+            return False
+        with open(path, "rb") as f:
+            return b"\0" not in f.read(8192)
+    except OSError:
+        return False
+
+
+class AnalysisSession:
+    """One language server process analyzing one workspace folder."""
+
+    def __init__(
+        self,
+        server: Server,
+        workspace: Path,
+        rules: dict[str, Any] | None = None,
+        node: str | None = None,
+        jvm_args: list[str] | None = None,
+        verbose: bool = False,
+    ):
+        self.server = server
+        self.workspace = workspace.resolve()
+        self.rules = rules or {}
+        self.node = node
+        self.jvm_args = jvm_args
+        self.verbose = verbose
+        self._cond = threading.Condition()
+        self._published: dict[str, list[dict[str, Any]]] = {}
+        self._active_progress: set[Any] = set()
+        self._last_event = time.monotonic()
+        self._folder_configured = threading.Event()
+        self._proc: subprocess.Popen[bytes] | None = None
+        self._client: LspClient | None = None
+
+    def __enter__(self) -> AnalysisSession:
+        try:
+            self._start()
+        except BaseException:
+            self._kill()
+            raise
+        return self
+
+    def __exit__(self, *exc: object) -> None:
+        self.close()
+
+    def _start(self) -> None:
+        cmd = self.server.command(self.jvm_args)
+        log.debug("starting %s", cmd)
+        self._proc = subprocess.Popen(
+            cmd,
+            stdin=subprocess.PIPE,
+            stdout=subprocess.PIPE,
+            stderr=None if self.verbose else subprocess.DEVNULL,
+        )
+        client = self._client = LspClient(self._proc)
+        client.on_notification("textDocument/publishDiagnostics", self._on_diagnostics)
+        client.on_notification("$/progress", self._on_progress)
+        client.on_notification("window/logMessage", self._on_log)
+        client.on_request("workspace/configuration", self._on_configuration)
+        client.on_request("window/workDoneProgress/create", lambda params: None)
+        client.on_request("sonarlint/isOpenInEditor", lambda uri: True)
+        client.on_request("sonarlint/isIgnoredByScm", lambda uri: False)
+        client.on_request("sonarlint/shouldAnalyseFile", lambda params: {"shouldBeAnalysed": True})
+        client.on_request("sonarlint/filterOutExcludedFiles", lambda params: params)
+        client.on_request("sonarlint/listFilesInFolder", lambda params: {"foundFiles": []})
+        client.on_request("sonarlint/canShowMissingRequirementsNotification", lambda params: "error_only")
+        client.on_request("sonarlint/hasJoinedIdeLabs", lambda params: False)
+        client.start()
+
+        root_uri = self.workspace.as_uri()
+        client.request(
+            "initialize",
+            {
+                "processId": os.getpid(),
+                "rootUri": root_uri,
+                "workspaceFolders": [{"uri": root_uri, "name": self.workspace.name}],
+                "capabilities": {
+                    "workspace": {"configuration": True, "workspaceFolders": True},
+                    "window": {"workDoneProgress": True},
+                },
+                "initializationOptions": {
+                    "productKey": "vscode",
+                    "productName": "exolot",
+                    "productVersion": __version__,
+                    "workspaceName": self.workspace.name,
+                    "showVerboseLogs": self.verbose,
+                    "firstSecretDetected": True,
+                    "enableNotebooks": False,
+                    "clientNodePath": self.node,
+                    "connections": {"sonarqube": [], "sonarcloud": []},
+                    "rules": self.rules,
+                    "focusOnNewCode": False,
+                    "automaticAnalysis": True,
+                    "additionalAttributes": {},
+                },
+            },
+        ).result(timeout=300)
+        client.notify("initialized", {})
+        # Files opened before the server has fetched the folder's settings get
+        # analyzed twice, so wait for that first.
+        if not self._folder_configured.wait(timeout=30):
+            log.warning("server did not ask for folder settings; continuing anyway")
+
+    def _settings(self) -> dict[str, Any]:
+        return {
+            "rules": self.rules,
+            "disableTelemetry": True,
+            "pathToNodeExecutable": self.node,
+            "automaticAnalysis": True,
+            "focusOnNewCode": False,
+            "output": {"showVerboseLogs": self.verbose},
+        }
+
+    def _on_configuration(self, params: dict[str, Any]) -> list[Any]:
+        if any(item.get("scopeUri") for item in params["items"]):
+            self._folder_configured.set()
+        return [self._settings() if item.get("section") == "sonarlint" else None for item in params["items"]]
+
+    def _touch(self) -> None:
+        self._last_event = time.monotonic()
+        self._cond.notify_all()
+
+    def _on_diagnostics(self, params: dict[str, Any]) -> None:
+        with self._cond:
+            self._published[params["uri"]] = params["diagnostics"]
+            self._touch()
+
+    def _on_progress(self, params: dict[str, Any]) -> None:
+        kind = params.get("value", {}).get("kind")
+        with self._cond:
+            if kind == "begin":
+                self._active_progress.add(params["token"])
+            elif kind == "end":
+                self._active_progress.discard(params["token"])
+            self._touch()
+
+    def _on_log(self, params: dict[str, Any]) -> None:
+        if self.verbose:
+            log.info("server: %s", params.get("message", "").rstrip())
+
+    def analyze(
+        self,
+        files: list[Path],
+        settle: float = 1.0,
+        stall: float = 30.0,
+        timeout: float | None = None,
+    ) -> list[Issue]:
+        """Open every file, then wait for the server to finish analyzing them.
+
+        The server publishes diagnostics asynchronously and may publish a file
+        more than once (e.g. an empty list before the real results). Analysis
+        runs are bracketed by $/progress begin/end, so we treat the session as
+        done once every file has been published, no progress is active, and
+        nothing has arrived for ``settle`` seconds. If some files are never
+        published after ``stall`` quiet seconds, the analysis is incomplete and
+        we raise rather than report a partial result as clean.
+        """
+        assert self._client is not None
+        deadline = None if timeout is None else time.monotonic() + timeout
+        uris = {f.as_uri(): f for f in files}
+        with self._cond:
+            for uri in uris:
+                self._published.pop(uri, None)
+        for uri, path in uris.items():
+            if deadline is not None and time.monotonic() >= deadline:
+                raise TimeoutError("analysis did not finish in time")
+            text = path.read_text(encoding="utf-8", errors="replace")
+            self._client.notify(
+                "textDocument/didOpen",
+                {"textDocument": {"uri": uri, "languageId": language_id(path), "version": 1, "text": text}},
+            )
+        with self._cond:
+            self._touch()
+            while True:
+                if self._client.closed.is_set():
+                    raise RuntimeError("language server exited unexpectedly")
+                now = time.monotonic()
+                quiet = now - self._last_event
+                missing = [u for u in uris if u not in self._published]
+                if not self._active_progress:
+                    if not missing and quiet >= settle:
+                        break
+                    if missing and quiet >= stall:
+                        names = ", ".join(str(uris[u]) for u in missing[:5])
+                        more = f" and {len(missing) - 5} more" if len(missing) > 5 else ""
+                        raise RuntimeError(f"the server never reported results for {names}{more}")
+                if deadline is not None and now >= deadline:
+                    raise TimeoutError("analysis did not finish in time")
+                self._cond.wait(timeout=0.2)
+            published = {uri: self._published.get(uri, []) for uri in uris}
+        return [_to_issue(uris[uri], d) for uri, diags in published.items() for d in diags]
+
+    def close(self) -> None:
+        if self._client is not None and self._proc is not None and self._proc.poll() is None:
+            try:
+                self._client.request("shutdown").result(timeout=30)
+                self._client.notify("exit")
+                self._proc.wait(timeout=30)
+            except Exception:
+                log.debug("clean shutdown failed; killing server", exc_info=True)
+        self._kill()
+
+    def _kill(self) -> None:
+        if self._proc is not None and self._proc.poll() is None:
+            self._proc.kill()
+            self._proc.wait()
+
+
+def _to_issue(path: Path, diagnostic: dict[str, Any]) -> Issue:
+    start = diagnostic["range"]["start"]
+    end = diagnostic["range"]["end"]
+    return Issue(
+        path=path,
+        line=start["line"] + 1,
+        column=start["character"] + 1,
+        end_line=end["line"] + 1,
+        end_column=end["character"] + 1,
+        rule=str(diagnostic.get("code", "")),
+        message=diagnostic.get("message", ""),
+        severity=SEVERITY_NAMES.get(diagnostic.get("severity", 2), "warning"),
+        raw=diagnostic,
+    )

exolot/cli.py

@@ -0,0 +1,142 @@
+from __future__ import annotations
+
+import argparse
+import json
+import logging
+import os
+import sys
+from pathlib import Path
+
+from . import __version__
+from .analyze import AnalysisSession, Issue, collect_files
+from .server import DEFAULT_SERVER_VERSION, ServerError, cache_dir, detect_platform, ensure_server
+
+COMMANDS = ("analyze", "install", "cache-dir")
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="exolot",
+        description="Analyze code locally with the SonarQube for IDE language server, no account needed.",
+    )
+    parser.add_argument("--version", action="version", version=f"exolot {__version__}")
+    sub = parser.add_subparsers(dest="command")
+
+    server_opts = argparse.ArgumentParser(add_help=False)
+    server_opts.add_argument(
+        "--server-version",
+        default=DEFAULT_SERVER_VERSION,
+        help="sonarlint-vscode release tag to use (default: %(default)s)",
+    )
+    server_opts.add_argument(
+        "--platform",
+        default=None,
+        help="VSIX platform, e.g. linux-x64, or 'universal' (default: detected)",
+    )
+    server_opts.add_argument("--java", help="Java executable to use instead of the bundled one")
+    server_opts.add_argument("-v", "--verbose", action="store_true", help="show server logs")
+
+    analyze = sub.add_parser("analyze", parents=[server_opts], help="analyze files (the default command)")
+    analyze.add_argument("paths", nargs="*", type=Path, default=[Path(".")], help="files or directories")
+    analyze.add_argument("--format", choices=("text", "json"), default="text")
+    analyze.add_argument(
+        "--rules",
+        type=Path,
+        help="JSON file of rule settings, in the same format as VS Code's sonarlint.rules setting",
+    )
+    analyze.add_argument("--node", help="Node.js executable for JavaScript/TypeScript analysis")
+    analyze.add_argument("--workspace", type=Path, help="workspace folder (default: current directory)")
+    analyze.add_argument("--timeout", type=float, default=None, help="give up after this many seconds")
+
+    sub.add_parser("install", parents=[server_opts], help="download and unpack the language server")
+    sub.add_parser("cache-dir", help="print the cache directory")
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    argv = list(sys.argv[1:] if argv is None else argv)
+    if not argv or (argv[0] not in COMMANDS and argv[0] not in ("-h", "--help", "--version")):
+        argv.insert(0, "analyze")
+    args = build_parser().parse_args(argv)
+
+    logging.basicConfig(
+        level=logging.INFO if getattr(args, "verbose", False) else logging.WARNING,
+        format="exolot: %(message)s",
+    )
+
+    if args.command == "cache-dir":
+        print(cache_dir())
+        return 0
+
+    plat = args.platform
+    if plat == "universal":
+        plat = ""
+
+    if args.command == "analyze":
+        # Check the inputs before possibly downloading the server.
+        try:
+            files = collect_files(args.paths)
+            rules = json.loads(args.rules.read_text()) if args.rules else None
+        except (OSError, ValueError) as e:
+            print(f"exolot: {e}", file=sys.stderr)
+            return 2
+        if not files:
+            print("exolot: no files to analyze", file=sys.stderr)
+            return 0
+
+    try:
+        server = ensure_server(args.server_version, plat, args.java)
+    except (ServerError, OSError) as e:
+        print(f"exolot: {e}", file=sys.stderr)
+        return 2
+
+    if args.command == "install":
+        shown = plat if plat is not None else detect_platform()
+        print(f"Language server {args.server_version} ({shown or 'universal'})")
+        print(f"  installed in {server.root}")
+        print(f"  using Java {server.java}")
+        return 0
+
+    workspace = args.workspace or Path.cwd()
+
+    try:
+        with AnalysisSession(server, workspace, rules=rules, node=args.node, verbose=args.verbose) as session:
+            issues = session.analyze(files, timeout=args.timeout)
+            # Report before the server shuts down, which can take a few seconds.
+            _report(issues, len(files), args.format)
+    except (OSError, RuntimeError, TimeoutError) as e:
+        print(f"exolot: {e}", file=sys.stderr)
+        return 2
+    return 1 if issues else 0
+
+
+def _report(issues: list[Issue], file_count: int, fmt: str) -> None:
+    issues = sorted(issues, key=lambda i: (str(i.path), i.line, i.column, i.rule))
+    if fmt == "json":
+        json.dump([_issue_json(i) for i in issues], sys.stdout, indent=2)
+        print()
+    else:
+        for issue in issues:
+            print(f"{_display_path(issue.path)}:{issue.line}:{issue.column}: {issue.severity} [{issue.rule}] {issue.message}")
+        print(f"{len(issues)} issue(s) in {file_count} file(s) analyzed", file=sys.stderr)
+    sys.stdout.flush()
+
+
+def _display_path(path: Path) -> str:
+    try:
+        return os.path.relpath(path)
+    except ValueError:  # different drive on Windows
+        return str(path)
+
+
+def _issue_json(issue: Issue) -> dict[str, object]:
+    return {
+        "path": _display_path(issue.path),
+        "line": issue.line,
+        "column": issue.column,
+        "endLine": issue.end_line,
+        "endColumn": issue.end_column,
+        "rule": issue.rule,
+        "severity": issue.severity,
+        "message": issue.message,
+    }

exolot/lsp.py

@@ -0,0 +1,144 @@
+"""Minimal synchronous JSON-RPC/LSP client over a subprocess's stdio.
+
+A background thread reads messages from the server. Responses resolve the
+matching pending request; server-initiated requests and notifications are
+dispatched to registered handlers. Server requests with no handler are
+answered with ``null`` so the server never blocks waiting on us.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import subprocess
+import threading
+from concurrent.futures import Future
+from typing import IO, Any, Callable
+
+log = logging.getLogger(__name__)
+
+Handler = Callable[[Any], Any]
+
+
+class LspError(Exception):
+    def __init__(self, error: dict[str, Any]):
+        super().__init__(f"{error.get('code')}: {error.get('message')}")
+        self.error = error
+
+
+class LspClient:
+    def __init__(self, proc: subprocess.Popen[bytes]):
+        assert proc.stdin is not None and proc.stdout is not None
+        self._proc = proc
+        self._stdin: IO[bytes] = proc.stdin
+        self._stdout: IO[bytes] = proc.stdout
+        self._write_lock = threading.Lock()
+        self._next_id = 0
+        self._pending: dict[int, Future[Any]] = {}
+        self._pending_lock = threading.Lock()
+        self._request_handlers: dict[str, Handler] = {}
+        self._notification_handlers: dict[str, Handler] = {}
+        self._reader = threading.Thread(target=self._read_loop, name="lsp-reader", daemon=True)
+        self.closed = threading.Event()
+
+    def start(self) -> None:
+        self._reader.start()
+
+    def on_request(self, method: str, handler: Handler) -> None:
+        self._request_handlers[method] = handler
+
+    def on_notification(self, method: str, handler: Handler) -> None:
+        self._notification_handlers[method] = handler
+
+    def request(self, method: str, params: Any = None) -> Future[Any]:
+        with self._pending_lock:
+            self._next_id += 1
+            msg_id = self._next_id
+            future: Future[Any] = Future()
+            self._pending[msg_id] = future
+        self._send({"jsonrpc": "2.0", "id": msg_id, "method": method, "params": params})
+        return future
+
+    def notify(self, method: str, params: Any = None) -> None:
+        self._send({"jsonrpc": "2.0", "method": method, "params": params})
+
+    def _send(self, message: dict[str, Any]) -> None:
+        body = json.dumps(message, separators=(",", ":")).encode("utf-8")
+        header = f"Content-Length: {len(body)}\r\n\r\n".encode("ascii")
+        log.debug("-> %s", body[:2000])
+        with self._write_lock:
+            self._stdin.write(header + body)
+            self._stdin.flush()
+
+    def _read_message(self) -> dict[str, Any] | None:
+        length = None
+        while True:
+            line = self._stdout.readline()
+            if not line:
+                return None
+            line = line.strip()
+            if not line:
+                break
+            name, _, value = line.decode("ascii").partition(":")
+            if name.strip().lower() == "content-length":
+                length = int(value.strip())
+        if length is None:
+            raise ValueError("LSP message without Content-Length header")
+        body = self._stdout.read(length)
+        if len(body) < length:
+            return None
+        log.debug("<- %s", body[:2000])
+        return json.loads(body)
+
+    def _read_loop(self) -> None:
+        try:
+            while (message := self._read_message()) is not None:
+                self._dispatch(message)
+        except Exception:
+            log.exception("LSP reader failed")
+        finally:
+            self.closed.set()
+            with self._pending_lock:
+                pending, self._pending = self._pending, {}
+            for future in pending.values():
+                if future.set_running_or_notify_cancel():
+                    future.set_exception(ConnectionError("language server closed the connection"))
+
+    def _dispatch(self, message: dict[str, Any]) -> None:
+        method = message.get("method")
+        if method is None:
+            with self._pending_lock:
+                future = self._pending.pop(message.get("id"), None)
+            if future is None:
+                log.warning("response for unknown request id %r", message.get("id"))
+            elif not future.set_running_or_notify_cancel():
+                log.debug("dropping response to cancelled request %r", message.get("id"))
+            elif "error" in message:
+                future.set_exception(LspError(message["error"]))
+            else:
+                future.set_result(message.get("result"))
+        elif "id" in message:
+            self._handle_server_request(message["id"], method, message.get("params"))
+        else:
+            handler = self._notification_handlers.get(method)
+            if handler is None:
+                log.debug("unhandled notification %s", method)
+                return
+            try:
+                handler(message.get("params"))
+            except Exception:
+                log.exception("notification handler for %s failed", method)
+
+    def _handle_server_request(self, msg_id: Any, method: str, params: Any) -> None:
+        handler = self._request_handlers.get(method)
+        if handler is None:
+            log.debug("unhandled server request %s, replying null", method)
+            result = None
+        else:
+            try:
+                result = handler(params)
+            except Exception as e:
+                log.exception("request handler for %s failed", method)
+                self._send({"jsonrpc": "2.0", "id": msg_id, "error": {"code": -32603, "message": str(e)}})
+                return
+        self._send({"jsonrpc": "2.0", "id": msg_id, "result": result})

exolot/server.py

@@ -0,0 +1,243 @@
+"""Locate, download, verify and unpack the language server from a VSIX.
+
+The VSIX is the SonarQube for IDE extension for VS Code, published as GitHub
+release assets of SonarSource/sonarlint-vscode. Platform-specific builds bundle
+a JRE; the universal build does not, so on other platforms we fall back to it
+and use a Java found on the system.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import logging
+import os
+import platform
+import shutil
+import sys
+import tempfile
+import urllib.request
+import zipfile
+from dataclasses import dataclass
+from pathlib import Path
+
+log = logging.getLogger(__name__)
+
+DEFAULT_SERVER_VERSION = "6.2.0+91200"
+
+RELEASE_URL = "https://github.com/SonarSource/sonarlint-vscode/releases/download/{tag}/{asset}"
+
+# sha256 of each release asset, keyed by tag then platform ("" = universal).
+# Taken from the GitHub release metadata and checked against the downloads.
+KNOWN_DIGESTS: dict[str, dict[str, str]] = {
+    "6.2.0+91200": {
+        "": "b0c13ecb37b6d2e8e2414f482f62ddd916eec5f3c2db0711e9c0b7bb17823850",
+        "darwin-arm64": "8d59d1101ed9edfb9b7bcb99fd3df8835b779c061bdceec01acf51c7fbc56446",
+        "darwin-x64": "d64a71f0fdcd6597e7b1b7fba22be46f4ea64aae92f428b7149eecfb99626963",
+        "linux-x64": "054f309995789e2cb5e20a1f0e071db7ab817e6dec11ae45bcebb45d69216cac",
+        "win32-x64": "9c9657d007327e0bab923185c08c3c699989af2130e25353bedb2be04910467e",
+    },
+}
+
+# Only these parts of the VSIX are needed to run the server.
+EXTRACT_PREFIXES = ("extension/server/", "extension/analyzers/", "extension/jre/")
+EXTRACT_FILES = ("extension/package.json", "extension/LICENSE.txt", "extension/NOTICE.txt")
+
+# Analyzers passed to the server, in the order the VS Code client passes them.
+# C/C++ and C# analyzers are downloaded by the server itself on demand.
+ANALYZERS = (
+    "sonargo.jar",
+    "sonarjava.jar",
+    "sonarjavasymbolicexecution.jar",
+    "sonarjs.jar",
+    "sonarphp.jar",
+    "sonarpython.jar",
+    "sonarhtml.jar",
+    "sonarxml.jar",
+    "sonartext.jar",
+    "sonariac.jar",
+    "sonarlintomnisharp.jar",
+)
+
+
+class ServerError(Exception):
+    pass
+
+
+def detect_platform() -> str:
+    """Return the VSIX platform suffix for this machine, or "" for universal."""
+    machine = platform.machine().lower()
+    arch = {"x86_64": "x64", "amd64": "x64", "arm64": "arm64", "aarch64": "arm64"}.get(machine)
+    if sys.platform == "darwin":
+        os_name = "darwin"
+    elif sys.platform.startswith("linux"):
+        os_name = "linux"
+    elif sys.platform == "win32":
+        os_name = "win32"
+    else:
+        return ""
+    candidate = f"{os_name}-{arch}"
+    return candidate if candidate in {"darwin-arm64", "darwin-x64", "linux-x64", "win32-x64"} else ""
+
+
+def cache_dir() -> Path:
+    if env := os.environ.get("EXOLOT_CACHE_DIR"):
+        return Path(env)
+    if sys.platform == "win32":
+        base = Path(os.environ.get("LOCALAPPDATA") or Path.home() / "AppData" / "Local")
+        return base / "exolot" / "Cache"
+    if sys.platform == "darwin":
+        return Path.home() / "Library" / "Caches" / "exolot"
+    return Path(os.environ.get("XDG_CACHE_HOME") or Path.home() / ".cache") / "exolot"
+
+
+def asset_name(tag: str, plat: str) -> str:
+    version = tag.split("+", 1)[0]
+    return f"sonarlint-vscode-{plat}-{version}.vsix" if plat else f"sonarlint-vscode-{version}.vsix"
+
+
+@dataclass
+class Server:
+    root: Path  # the extracted "extension" directory
+    java: Path
+
+    @property
+    def jar(self) -> Path:
+        return self.root / "server" / "sonarlint-ls.jar"
+
+    def analyzer_paths(self) -> list[Path]:
+        return [p for p in (self.root / "analyzers" / name for name in ANALYZERS) if p.exists()]
+
+    def command(self, jvm_args: list[str] | None = None) -> list[str]:
+        return [
+            str(self.java),
+            "-Dsonarlint.telemetry.disabled=true",
+            *(jvm_args or []),
+            "-jar",
+            str(self.jar),
+            "-stdio",
+            "-analyzers",
+            *(str(p) for p in self.analyzer_paths()),
+        ]
+
+
+def ensure_server(
+    tag: str = DEFAULT_SERVER_VERSION,
+    plat: str | None = None,
+    java: str | None = None,
+    progress: bool = True,
+) -> Server:
+    """Return a ready-to-run server, downloading and unpacking it if needed."""
+    if plat is None:
+        plat = detect_platform()
+    install_dir = cache_dir() / "servers" / f"{tag}-{plat or 'universal'}"
+    if not (install_dir / ".complete").exists():
+        _install(tag, plat, install_dir, progress)
+    root = install_dir / "extension"
+    return Server(root=root, java=_find_java(root, java))
+
+
+def _install(tag: str, plat: str, install_dir: Path, progress: bool) -> None:
+    asset = asset_name(tag, plat)
+    url = RELEASE_URL.format(tag=tag.replace("+", "%2B"), asset=asset)
+    expected = KNOWN_DIGESTS.get(tag, {}).get(plat)
+    install_dir.parent.mkdir(parents=True, exist_ok=True)
+    with tempfile.TemporaryDirectory(dir=install_dir.parent, prefix=".download-") as tmp:
+        vsix = Path(tmp) / asset
+        _download(url, vsix, progress)
+        digest = _sha256(vsix)
+        if expected is None:
+            log.warning("no known digest for %s; downloaded file has sha256 %s", asset, digest)
+        elif digest != expected:
+            raise ServerError(f"sha256 mismatch for {asset}: expected {expected}, got {digest}")
+        staging = Path(tmp) / "staging"
+        _extract(vsix, staging)
+        vsix.unlink()
+        (staging / ".complete").write_text(f"{tag} {plat or 'universal'} {digest}\n")
+        _publish(staging, install_dir)
+
+
+def _publish(staging: Path, install_dir: Path) -> None:
+    """Move a finished install into place, tolerating concurrent installers.
+
+    The rename is atomic, so another exolot process either sees no install or
+    a complete one. If another process got there first, keep its copy.
+    """
+    try:
+        staging.rename(install_dir)
+    except OSError:
+        if (install_dir / ".complete").exists():
+            log.debug("%s was installed by another process", install_dir)
+            return
+        # A leftover directory without the marker (e.g. from an older layout).
+        shutil.rmtree(install_dir, ignore_errors=True)
+        staging.rename(install_dir)
+
+
+def _download(url: str, dest: Path, progress: bool) -> None:
+    log.info("downloading %s", url)
+    # The timeout applies to each blocking read, not the whole download.
+    with urllib.request.urlopen(url, timeout=60) as response, open(dest, "wb") as out:
+        total = int(response.headers.get("Content-Length") or 0)
+        done = 0
+        last_pct = -1
+        while chunk := response.read(1 << 20):
+            out.write(chunk)
+            done += len(chunk)
+            if progress and total and sys.stderr.isatty():
+                pct = done * 100 // total
+                if pct != last_pct:
+                    print(f"\rDownloading {dest.name}: {pct}%", end="", file=sys.stderr, flush=True)
+                    last_pct = pct
+        if progress and total and sys.stderr.isatty():
+            print(file=sys.stderr)
+
+
+def _sha256(path: Path) -> str:
+    h = hashlib.sha256()
+    with open(path, "rb") as f:
+        while chunk := f.read(1 << 20):
+            h.update(chunk)
+    return h.hexdigest()
+
+
+def _extract(vsix: Path, dest: Path) -> None:
+    """Extract the parts we need, restoring Unix permission bits.
+
+    zipfile drops permission bits, so executables in the bundled JRE (java,
+    and lib/jspawnhelper which Java needs to start subprocesses) would not be
+    runnable without restoring them from each entry's external attributes.
+    """
+    dest_resolved = dest.resolve()
+    with zipfile.ZipFile(vsix) as z:
+        for info in z.infolist():
+            name = info.filename
+            if not (name.startswith(EXTRACT_PREFIXES) or name in EXTRACT_FILES):
+                continue
+            target = (dest / name).resolve()
+            if not target.is_relative_to(dest_resolved):
+                raise ServerError(f"refusing to extract {name!r} outside {dest}")
+            z.extract(info, dest)
+            mode = (info.external_attr >> 16) & 0o777
+            if mode and os.name == "posix":
+                os.chmod(target, mode)
+
+
+def _find_java(root: Path, override: str | None) -> Path:
+    if override:
+        return Path(override)
+    exe = "java.exe" if sys.platform == "win32" else "java"
+    jre = root / "jre"
+    if jre.is_dir():
+        candidates = sorted(jre.rglob(f"bin/{exe}"), key=lambda p: len(p.parts))
+        if candidates:
+            return candidates[0]
+    if java_home := os.environ.get("JAVA_HOME"):
+        candidate = Path(java_home) / "bin" / exe
+        if candidate.exists():
+            return candidate
+    if found := shutil.which("java"):
+        return Path(found)
+    raise ServerError(
+        "this platform has no VSIX with a bundled Java runtime, and no Java was found; "
+        "install Java 17 or later, or pass --java"
+    )

exolot-0.1.0.dist-info/METADATA

@@ -0,0 +1,103 @@
+Metadata-Version: 2.5
+Name: exolot
+Version: 0.1.0
+Summary: Analyze code locally from the command line with the SonarQube for IDE language server
+Project-URL: Repository, https://github.com/skissane/exolot
+License-Expression: MIT
+License-File: LICENSE
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Natural Language :: English
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+
+# exolot
+
+Analyze code locally from the command line with the language server from
+SonarQube for IDE (formerly SonarLint). No SonarQube account or server needed.
+
+> exolot is an independent project. It is not affiliated with or endorsed by
+> SonarSource. "SonarQube" and "SonarLint" are trademarks of SonarSource.
+
+## Why
+
+The old `sonarlint-cli` was discontinued years ago. SonarSource's current
+SonarQube CLI needs a SonarQube Cloud or Server account, and its code analysis
+runs on the server. exolot fills the gap: account-free analysis that runs
+entirely on your own machine. It needs network access only to download the
+language server the first time (and see the note on C/C++ and C# below).
+
+## How it works
+
+exolot downloads the SonarQube for IDE extension for VS Code (a `.vsix` file,
+which is a zip) from the
+[sonarlint-vscode GitHub releases](https://github.com/SonarSource/sonarlint-vscode/releases),
+checks its sha256 digest, and unpacks the language server, the language
+analyzers and the bundled Java runtime into a cache directory. It then runs the
+language server headlessly, opens each file you ask it to analyze, and prints
+the issues the server reports.
+
+The idea comes from [sonarqube.nvim](https://github.com/iamkarasik/sonarqube.nvim),
+which does the same thing for Neovim.
+
+## Usage
+
+```sh
+uvx exolot                     # analyze the current directory
+uvx exolot src/ tests/foo.py   # analyze specific files or directories
+uvx exolot --format json .     # machine-readable output
+uvx exolot install             # just download and unpack the server
+uvx exolot cache-dir           # show where the server is cached
+```
+
+Directories are expanded with `git ls-files` when inside a git repository (so
+`.gitignore` is respected), and by walking the tree otherwise. Binary files and
+files over 2 MiB are skipped.
+
+Exit status is 0 when no issues are found, 1 when issues are found, and 2 on
+errors.
+
+### Options
+
+- `--server-version TAG` picks a sonarlint-vscode release (default: the
+  version exolot was tested with). Unknown versions are downloaded without
+  digest verification, with a warning.
+- `--platform PLATFORM` overrides the detected VSIX platform (`linux-x64`,
+  `darwin-arm64`, `darwin-x64`, `win32-x64`, or `universal`).
+- `--java PATH` uses a different Java executable.
+- `--node PATH` sets the Node.js used for JavaScript/TypeScript analysis
+  (otherwise the server looks for `node` on the `PATH`).
+- `--rules FILE` reads rule settings from a JSON file, in the same format as
+  VS Code's `sonarlint.rules` setting, e.g.
+  `{"python:S1764": {"level": "off"}}`.
+- `-v` / `--verbose` shows the server's logs.
+
+## Platforms
+
+Platform-specific builds with a bundled Java runtime exist for `linux-x64`,
+`darwin-arm64`, `darwin-x64` and `win32-x64`. On other platforms (such as
+Linux on ARM) exolot uses the universal build, which needs Java 17 or later
+from `JAVA_HOME`, the `PATH`, or `--java`.
+
+## Notes
+
+- The language server keeps its own state in `~/.sonarlint`, shared with any
+  SonarQube for IDE installation you have.
+- Telemetry is disabled.
+- C/C++ and C# analyzers are not included in the VSIX; the server tries to
+  download them from `binaries.sonarsource.com` when it starts.
+- Each run starts a fresh JVM and loads every analyzer, so even a single file
+  takes around 15 seconds.
+- The bundled analyzers are licensed by SonarSource under their own terms. exolot
+  downloads them from SonarSource's releases at run time and does not
+  redistribute them.
+
+## Development
+
+```sh
+uv sync
+uv run exolot --help
+uv run pytest
+```

exolot-0.1.0.dist-info/RECORD

@@ -0,0 +1,11 @@
+exolot/__init__.py,sha256=HEpmxJrGLz6sV_xyugVbSj2lp15exvExTfH6Fac425o,228
+exolot/__main__.py,sha256=k1ocEWawweo1qCJWNFAAvyxz3tcY13dzvCenHszij30,48
+exolot/analyze.py,sha256=6YPkLm6cPhJuVKua6280SR5asaaaK_V56Kh18Gt0jVU,12630
+exolot/cli.py,sha256=Rgj43Vowmel2I9WOTy4kunFOJCkvmQefbibpGHsYlAk,5358
+exolot/lsp.py,sha256=ijDsjGoZsc_HgESDA51SeiyNNM2ky9khg87N-CqpiZ0,5685
+exolot/server.py,sha256=au3Gsp2IYbp0z6WiFSlf64skHCSJGXlrI1V6SmTMsEk,8948
+exolot-0.1.0.dist-info/METADATA,sha256=c550UAJeT1vWAlj1VBovwPl65v7U15M21uuR1oHgEcU,4115
+exolot-0.1.0.dist-info/WHEEL,sha256=2iZrJkDIkeDh0k9SikKMqFuRP-ua6mb4Ir1AsER4BEw,87
+exolot-0.1.0.dist-info/entry_points.txt,sha256=ZMr8S_lrBPluaGyjFVrq4T7GcuQzW0TTs8vXhR2EuW4,43
+exolot-0.1.0.dist-info/licenses/LICENSE,sha256=yypQLTZMBkvEPhV87NpYU4480tnMIimc4xbXjnP2gFI,1075
+exolot-0.1.0.dist-info/RECORD,,

exolot-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.33.0
+Root-Is-Purelib: true
+Tag: py3-none-any

exolot-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+exolot = exolot.cli:main

exolot-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 The exolot authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.