fixfirst 0.1.0__py3-none-any.whl

fixfirst/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.0"

fixfirst/__main__.py

@@ -0,0 +1,3 @@
+from fixfirst.cli import main
+
+main()

fixfirst/cli.py

@@ -0,0 +1,777 @@
+"""fixfirst — makes coding agents fix their code instead of cheating around your checks.
+
+  fixfirst install             once per machine: git shim + hooks for Claude Code / Codex
+  fixfirst verify [--ci REF]   full check (the git shim runs it on `git commit`; CI: --ci <target>)
+  fixfirst hook post|stop      called by harness hooks after a tool call / when the agent stops
+  fixfirst env                 PATH line for harness launchers, never for your own shell
+  fixfirst doctor              wiring, base, trust
+
+Checks: ruff always. ty, coverage, Hypothesis evidence and bandit switch on through your
+committed config. Config is read from git (HEAD; --ci: the target), never from disk.
+Suppressions count only if present at the base. One line per problem, nothing on success.
+-v shows raw tool output.
+"""
+
+from __future__ import annotations
+
+import fnmatch
+import io
+import json
+import os
+import re
+import secrets
+import shutil
+import subprocess
+import sys
+import sysconfig
+import tempfile
+import time
+import tokenize
+import tomllib
+import urllib.parse
+import xml.etree.ElementTree as ET
+from importlib import resources
+from pathlib import Path
+
+_SEP = sys.argv.index("--", 1) if "--" in sys.argv[1:] else len(sys.argv)
+OWN_ARGS, PASSED_ARGS = sys.argv[1:_SEP], sys.argv[_SEP + 1 :]  # after `--`: the agent's `git commit` args
+VERBOSE = "-v" in OWN_ARGS
+CFG_FILES = (".ruff.toml", "ruff.toml", "ty.toml", "pytest.ini", ".coveragerc")
+CFG_TABLES = ("ruff", "ty", "pytest", "coverage")
+DIAG = re.compile(r"^\S+?:\d+(:\d+)?: ")
+SHIM_DIR = Path.home() / ".local/share/fixfirst/shim"
+CLEAN_ENV = {
+    "PYTEST_ADDOPTS",
+    "PYTEST_PLUGINS",
+    "PYTEST_DISABLE_PLUGIN_AUTOLOAD",
+    "COVERAGE_RCFILE",
+    "COVERAGE_PROCESS_START",
+    "HYPOTHESIS_PROFILE",
+}
+NOT_NUMERICAL = frozenset({"tests", "test", "docs", "scripts", "notebooks", "migrations"})
+TID_CODES = frozenset({"TID251", "TID", "ALL"})
+STOP_MAX_IN_A_ROW = 2
+NOTICE_INTERVAL = 86400
+# ADR-0007 covered forms. ruff honours every `ruff:` form below and `flake8: noqa` (tested, ruff 0.17.5).
+SUPPRESSION = re.compile(
+    r"\b(noqa|ruff\s*:\s*(?:ignore|file-ignore|disable)|(?:type|ty|pyright)\s*:\s*ignore|nosec"
+    r"|pragma\s*:\s*no\s*cover|fmt\s*:\s*(?:off|skip))\b",
+    re.IGNORECASE,
+)
+PY = ("*.py", "*.pyi")
+
+
+class ConfigError(Exception):
+    """Committed config unusable: fail closed (ADR-0011)."""
+
+
+# ------------------------------------------------------------------- helpers
+def run(*cmd: str, **kw) -> subprocess.CompletedProcess[str]:
+    r = subprocess.run(cmd, text=True, capture_output=True, check=False, **kw)
+    if VERBOSE:
+        sys.stderr.write(f"$ {' '.join(cmd)}\n{r.stdout}{r.stderr}")
+    return r
+
+
+def git(*args: str, **kw) -> str | None:
+    r = run("git", *args, **kw)
+    return r.stdout if r.returncode == 0 else None
+
+
+def git_list(*args: str) -> list[str]:
+    return [f for f in (git(*args) or "").split("\0") if f]
+
+
+def data(name: str) -> str:
+    return resources.files("fixfirst").joinpath("data", name).read_text(encoding="utf-8")
+
+
+def tool_bin(name: str) -> str:
+    """ruff/ty from the CLI's own environment: no uvx, no network (ADR-0014)."""
+    for d in (Path(sys.executable).parent, Path(sysconfig.get_path("scripts"))):
+        if (d / name).is_file():
+            return str(d / name)
+    if found := shutil.which(name):
+        return found
+    raise RuntimeError(f"{name} not found next to {sys.executable}")
+
+
+def chdir_root() -> Path | None:
+    out = git("rev-parse", "--show-toplevel")
+    if out is None:
+        return None
+    root = Path(out.strip())
+    os.chdir(root)
+    return root
+
+
+def state_dir() -> Path:
+    d = Path((git("rev-parse", "--git-path", "fixfirst") or ".git/fixfirst").strip())
+    d.mkdir(parents=True, exist_ok=True)
+    return d
+
+
+def head() -> str | None:
+    out = git("rev-parse", "--verify", "-q", "HEAD^{commit}")
+    return out.strip() if out else None
+
+
+def empty_tree() -> str:
+    return run("git", "hash-object", "-t", "tree", "--stdin", input="").stdout.strip()
+
+
+def resolve_base() -> tuple[str, str]:
+    """Suppression/changed-files base, fixed order (ADR-0007). Never fetches."""
+    if head() is None:
+        return empty_tree(), "empty tree (no commits)"
+    for ref in ("@{upstream}", "origin/HEAD"):
+        if out := git("merge-base", "HEAD", ref):
+            return out.strip(), f"merge-base with {ref}"
+    return head() or "HEAD", "HEAD (no upstream, no origin/HEAD)"
+
+
+def changed_files(base: str) -> list[str]:
+    tracked = git_list("diff", "-z", "--name-only", "--no-renames", "--diff-filter=d", base, "--", *PY)
+    untracked = git_list("ls-files", "-z", "--others", "--exclude-standard", "--", *PY)
+    return sorted({f for f in tracked + untracked if Path(f).is_file()})
+
+
+def diag_lines(text: str) -> list[str]:
+    return [line for line in text.splitlines() if DIAG.match(line)]
+
+
+# ------------------------------------------------------------------- committed config
+def toml(text: str | None, name: str) -> dict:
+    try:
+        return tomllib.loads(text or "")
+    except tomllib.TOMLDecodeError as e:
+        raise ConfigError(f"{name}:1: fixfirst committed {name} is not valid TOML ({e}); fix it in a commit") from e
+
+
+class Config:
+    """Committed configuration of one ref (HEAD locally, the target in CI), written to a temp dir."""
+
+    def __init__(self, ref: str | None, tmp: Path) -> None:
+        self.ref, self.tmp = ref, tmp
+        self.pyproject_text = self.show("pyproject.toml")
+        self.pyproject = toml(self.pyproject_text, "pyproject.toml")
+        tool = self.pyproject.get("tool", {})
+
+        self.ruff_args, lint = ["--isolated"], {}
+        for name in (".ruff.toml", "ruff.toml"):
+            if (text := self.show(name)) is not None:
+                self.ruff_args = ["--config", str(self.write(name, text))]
+                parsed = toml(text, name)
+                lint = parsed.get("lint", parsed)
+                break
+        else:
+            if "ruff" in tool:
+                self.ruff_args = ["--config", str(self.write("ruff/pyproject.toml", self.pyproject_text))]
+                lint = tool["ruff"].get("lint", tool["ruff"])
+        self.numerical = numerical_paths(lint)
+
+        self.ty_cfg = self.write("ty.toml", text) if (text := self.show("ty.toml")) is not None else None
+
+        self.cov_cfg, self.cov_min = None, None
+        if (text := self.show(".coveragerc")) is not None:
+            self.cov_cfg = self.write("cov/.coveragerc", text)
+            m = re.search(r"^\s*fail_under\s*=\s*([\d.]+)", text, re.MULTILINE)
+            self.cov_min = m and m.group(1)
+        elif "coverage" in tool:
+            self.cov_cfg = self.write("cov/pyproject.toml", self.pyproject_text)
+            fu = tool["coverage"].get("report", {}).get("fail_under")
+            self.cov_min = None if fu is None else str(fu)
+
+        if (text := self.show("pytest.ini")) is not None:
+            self.pytest_cfg, self.has_pytest_cfg = self.write("pytest/pytest.ini", text), True
+        elif "pytest" in tool:
+            self.pytest_cfg, self.has_pytest_cfg = self.write("pytest/pyproject.toml", self.pyproject_text), True
+        else:  # explicit empty config: pytest must not discover one the agent wrote
+            self.pytest_cfg, self.has_pytest_cfg = self.write("pytest/pytest.ini", "[pytest]\n"), False
+        self.testpaths = bool(tool.get("pytest", {}).get("ini_options", {}).get("testpaths"))
+        self.has_tests_dir = self.ref is not None and git("cat-file", "-e", f"{self.ref}:tests") is not None
+
+    def show(self, path: str) -> str | None:
+        return None if self.ref is None else git("show", f"{self.ref}:{path}")
+
+    def write(self, name: str, text: str | None) -> Path:
+        p = self.tmp / name
+        p.parent.mkdir(parents=True, exist_ok=True)
+        p.write_text(text or "", encoding="utf-8")
+        return p
+
+
+def numerical_paths(lint: dict) -> tuple[str, ...]:
+    """The numerical boundary: TID251 per-file-ignores, minus non-production paths."""
+    pfi = {**(lint.get("per-file-ignores") or {}), **(lint.get("extend-per-file-ignores") or {})}
+    paths = []
+    for pattern, codes in pfi.items():
+        if not isinstance(codes, (list, tuple)) or not TID_CODES & {str(c) for c in codes}:
+            continue
+        if pattern.startswith("**"):
+            continue
+        cleaned = pattern.lstrip("./")
+        if cleaned.split("/")[0] in NOT_NUMERICAL:
+            continue
+        for suffix in ("/**/*.py", "/**", "/*.py", "/*"):
+            if cleaned.endswith(suffix):
+                cleaned = cleaned[: -len(suffix)]
+                break
+        paths.append(cleaned.rstrip("/"))
+    return tuple(paths)
+
+
+# ------------------------------------------------------------------- checks
+def config_changes(cfg: Config) -> list[str]:
+    """Config is read from git; any change on disk or in the index is reported (ADR-0003)."""
+    msg = "fixfirst config is read from git; your change has no effect and blocks the commit"
+    out = []
+    for name in CFG_FILES:
+        committed = cfg.show(name)
+        disk = Path(name).read_text(encoding="utf-8", errors="replace") if Path(name).is_file() else None
+        if disk != committed or git("show", f":{name}") != committed:
+            out.append(f"{name}:1: {msg}")
+    committed_tool = cfg.pyproject.get("tool", {})
+    versions = []
+    if Path("pyproject.toml").is_file():
+        versions.append(Path("pyproject.toml").read_text(encoding="utf-8", errors="replace"))
+    if (staged := git("show", ":pyproject.toml")) is not None:
+        versions.append(staged)
+    for text in versions:
+        try:
+            tool = tomllib.loads(text).get("tool", {})
+        except tomllib.TOMLDecodeError:
+            out.append("pyproject.toml:1: fixfirst pyproject.toml is not valid TOML")
+            continue
+        out += [
+            f"pyproject.toml:1: fixfirst [tool.{t}] {msg[9:]}"
+            for t in CFG_TABLES
+            if tool.get(t) != committed_tool.get(t)
+        ]
+    return out
+
+
+def lint(cfg: Config, files: list[str], fix: bool) -> list[str]:
+    if not files:
+        return []
+    ruff = tool_bin("ruff")
+    common = [*cfg.ruff_args, "--force-exclude"]
+    if fix:  # agent-changed files only (ADR-0008)
+        run(ruff, "check", "--fix", "-q", *common, *files)
+        run(ruff, "format", "-q", *common, *files)
+    out = diag_lines(run(ruff, "check", "--output-format", "concise", *common, *files).stdout)
+    out += diag_lines(run(ruff, "format", "--check", "--output-format", "concise", *common, *files).stdout)
+    if cfg.ty_cfg:
+        venv = ["--python", ".venv"] if Path(".venv").is_dir() else []
+        r = run(
+            tool_bin("ty"),
+            "check",
+            "--config-file",
+            str(cfg.ty_cfg),
+            "--output-format",
+            "concise",
+            "--force-exclude",
+            *venv,
+            *files,
+        )
+        out += [line for line in diag_lines(r.stdout) if re.search(r": (error|fatal)\b", line)]
+    return out
+
+
+def comments(text: str) -> dict[int, str]:
+    """Comment text per line; falls back to a rough split for files that do not tokenize."""
+    found: dict[int, str] = {}
+    try:
+        for tok in tokenize.generate_tokens(io.StringIO(text).readline):
+            if tok.type == tokenize.COMMENT:
+                found[tok.start[0]] = found.get(tok.start[0], "") + tok.string
+    except (tokenize.TokenError, SyntaxError):
+        found = {n: line[line.index("#") :] for n, line in enumerate(text.splitlines(), 1) if "#" in line}
+    return found
+
+
+def added_lines(base: str, path: str) -> set[int] | None:
+    """Line numbers added vs base; None = the whole file is new."""
+    if git("cat-file", "-e", f"{base}:{path}") is None:
+        return None
+    diff = git("diff", "-U0", "--no-color", "--no-ext-diff", "--no-textconv", base, "--", path) or ""
+    lines: set[int] = set()
+    for start, count in re.findall(r"^@@ -\S+ \+(\d+)(?:,(\d+))? @@", diff, re.MULTILINE):
+        n = 1 if count == "" else int(count)
+        lines.update(range(int(start), int(start) + n))
+    return lines
+
+
+def suppressions(base: str, files: list[str]) -> list[str]:
+    """Every suppression comment not present at the base (ADR-0007). The single judge: no --ignore-noqa."""
+    out = []
+    for f in files:
+        text = Path(f).read_text(encoding="utf-8", errors="replace")
+        added = added_lines(base, f)
+        for n, comment in sorted(comments(text).items()):
+            if (added is None or n in added) and (m := SUPPRESSION.search(comment)):
+                out.append(f"{f}:{n}: fixfirst suppression added (# {m.group(0)}), fix the code instead")
+    return out
+
+
+def normalize_remote(url: str) -> str:
+    """`host/path` for any remote form: https/ssh/git URLs, scp-style `user@host:path`.
+
+    Drops scheme, user, port, trailing `/` and `.git`; lowercases the host. Patterns get the same
+    treatment, so `https://github.com/org/*` and `github.com/org/*` mean the same.
+    """
+    url = url.strip()
+    if "://" in url:
+        parts = urllib.parse.urlsplit(url)
+        host, path = (parts.hostname or "").lower(), parts.path
+    elif m := re.match(r"^(?:[^@/]+@)?([^:/]+):(.*)$", url):  # scp-style
+        host, path = m.group(1).lower(), m.group(2)
+    else:
+        host, _, path = url.partition("/")
+        host = host.lower()
+    path = path.strip("/").removesuffix(".git").rstrip("/")
+    return f"{host}/{path}" if host else path
+
+
+def trusted() -> bool:
+    """FIXFIRST_TRUST: whitespace-separated fnmatch patterns on the normalized origin URL (ADR-0013)."""
+    url = (git("remote", "get-url", "origin") or "").strip()
+    patterns = [normalize_remote(p) for p in os.environ.get("FIXFIRST_TRUST", "").split()]
+    return bool(url) and any(fnmatch.fnmatchcase(normalize_remote(url), p) for p in patterns)
+
+
+def due(stamp: str) -> bool:
+    p = state_dir() / stamp
+    return not p.exists() or time.time() - p.stat().st_mtime > NOTICE_INTERVAL
+
+
+def python_cmd() -> list[str] | None:
+    """The project's own `.venv` interpreter; never creates or syncs one (ADR-0014)."""
+    venv = Path(".venv/bin/python")
+    if venv.is_file() and run(str(venv), "-c", "pass").returncode == 0:
+        return [str(venv)]
+    return None
+
+
+def tests(cfg: Config, base: str, ci: bool, notices: list[tuple[str, str]]) -> list[str]:
+    if not (cfg.has_tests_dir or cfg.has_pytest_cfg):
+        return []
+    if not ci and not trusted():
+        if due("notice-untrusted"):
+            notices.append(("notice-untrusted", "fixfirst: tests skipped, repo not trusted (FIXFIRST_TRUST)"))
+        return []
+    py = python_cmd()
+    if py is None:
+        return ["pyproject.toml:1: fixfirst project venv missing, run uv sync"]
+    use_cov = cfg.cov_min is not None or bool(cfg.numerical)
+    need = {"pytest": "tests"}
+    if use_cov:
+        need["pytest_cov"] = "coverage policy" if cfg.cov_min is not None else "Hypothesis policy"
+    if cfg.numerical:
+        need["hypothesis"] = "Hypothesis policy"
+    probe = "import importlib.util as u, sys; print(' '.join(m for m in sys.argv[1:] if u.find_spec(m) is None))"
+    missing = run(*py, "-c", probe, *need).stdout.split()
+    if missing:
+        return [
+            f"pyproject.toml:1: fixfirst {m.replace('_', '-')} is not installed in the project venv "
+            f"({need[m]} is on); add it to the dev dependencies"
+            for m in missing
+        ]
+
+    t = cfg.tmp
+    (t / "plugin").mkdir(exist_ok=True)
+    (t / "plugin/fixfirst_gate.py").write_text(resources.files("fixfirst").joinpath("policy.py").read_text())
+    report, receipt, junit, nonce = t / "report", t / "receipt", t / "junit.xml", secrets.token_hex(16)
+    env = {k: v for k, v in os.environ.items() if k not in CLEAN_ENV and not k.startswith("FIXFIRST_")}
+    env |= {
+        "PYTHONPATH": os.pathsep.join(filter(None, [str(t / "plugin"), env.get("PYTHONPATH")])),
+        "FIXFIRST_BASE": base,
+        "FIXFIRST_REPORT": str(report),
+        "FIXFIRST_RECEIPT": str(receipt),
+        "FIXFIRST_NONCE": nonce,
+        "FIXFIRST_COVERAGE_MIN": cfg.cov_min or "",
+        "FIXFIRST_NUMERICAL": "\n".join(cfg.numerical),
+        "FIXFIRST_HYPOTHESIS_PROFILE": "ci" if ci else "dev",
+    }
+    cmd = [
+        *py,
+        "-m",
+        "pytest",
+        "-c",
+        str(cfg.pytest_cfg),
+        "--rootdir",
+        str(Path.cwd()),
+        "-p",
+        "fixfirst_gate",
+        "-p",
+        "no:fixfirst",
+        "-p",
+        "no:cacheprovider",
+        "-q",
+        "--tb=short",
+        f"--junitxml={junit}",
+        "-o",
+        "junit_family=xunit1",
+    ]
+    if use_cov:
+        cmd += ["--cov", "--cov-report=", "--cov-fail-under=0"]
+        if cfg.cov_cfg:
+            cmd.append(f"--cov-config={cfg.cov_cfg}")
+    if not cfg.testpaths and Path("tests").is_dir():
+        cmd.append("tests")
+    r = run(*cmd, env=env)
+
+    out = [line for line in (report.read_text().splitlines() if report.exists() else []) if line]
+    if junit.exists():
+        for case in ET.parse(junit).getroot().iter("testcase"):
+            for kind in ("failure", "error"):
+                el = case.find(kind)
+                if el is None:
+                    continue
+                msg = ((el.get("message") or kind).strip().splitlines() or [kind])[0][:200]
+                path = case.get("file") or case.get("classname", "").replace(".", "/") + ".py"
+                hits = [
+                    (f, n)
+                    for f, n in re.findall(r"([\w./-]+\.py):(\d+)", el.text or "")
+                    if not f.startswith("/") and Path(f).is_file()
+                ]
+                f, n = hits[-1] if hits else (path, str(int(case.get("line", "0")) + 1))
+                out.append(f"{f}:{n}: test {case.get('name')}: {msg}")
+    if r.returncode == 5 and cfg.cov_min is not None:
+        out.append("tests:1: fixfirst no tests collected")
+    if not out and (not receipt.exists() or receipt.read_text() != nonce):
+        tail = (r.stdout + r.stderr).strip().splitlines()[-1:] or ["pytest did not finish"]
+        out.append(f"tests:1: fixfirst test run failed: {tail[0][:200]}")
+    return out
+
+
+COMMIT_VALUE_SHORT = set("mFCct")
+COMMIT_VALUE_LONG = {
+    "--message",
+    "--file",
+    "--reuse-message",
+    "--reedit-message",
+    "--template",
+    "--author",
+    "--date",
+    "--cleanup",
+    "--fixup",
+    "--squash",
+    "--trailer",
+}
+
+
+def parse_commit(args: list[str]) -> dict:
+    """What a `git commit` takes from where: -a, -i, -o, interactive, pathspecs."""
+    flags = {"all": False, "include": False, "interactive": False, "pathspecs": []}
+    long_flags = {
+        "--all": "all",
+        "--include": "include",
+        "--patch": "interactive",
+        "--interactive": "interactive",
+        "--pathspec-from-file": "interactive",
+    }  # pathspec files cannot be predicted: like -p
+    i = 0
+    while i < len(args):
+        a = args[i]
+        if a == "--":
+            flags["pathspecs"] += args[i + 1 :]
+            break
+        if a.startswith("--"):
+            name = a.split("=", 1)[0]
+            if name in long_flags:
+                flags[long_flags[name]] = True
+            i += 2 if name in COMMIT_VALUE_LONG and "=" not in a else 1
+            continue
+        if a.startswith("-") and len(a) > 1:
+            step = 1
+            for j, c in enumerate(a[1:], 2):
+                if c in "aip":
+                    flags[{"a": "all", "i": "include", "p": "interactive"}[c]] = True
+                if c in COMMIT_VALUE_SHORT:
+                    step = 1 if j < len(a) else 2  # value attached (-mmsg) or the next arg
+                    break
+            i += step
+            continue
+        flags["pathspecs"].append(a)
+        i += 1
+    return flags
+
+
+def outside_commit(args: list[str], cwd: Path) -> list[str]:
+    """`.py` changes this commit would leave out. verify checked the whole working tree, so the commit must
+    contain all of it: checked tree == committed tree (ADR-0002)."""
+    c = parse_commit(args)
+    if c["interactive"]:
+        return [".:1: fixfirst interactive or pathspec-file commits cannot be checked; git add, then git commit"]
+    ref = head() or empty_tree()
+    untracked = set(git_list("ls-files", "-z", "--others", "--exclude-standard", "--", *PY))
+    unstaged = set(git_list("diff", "-z", "--name-only", "--", *PY))
+    if c["all"]:
+        outside = untracked
+    elif c["pathspecs"]:  # pathspecs are relative to where `git commit` ran; git output is root-relative
+        named = set(git_list("-C", str(cwd), "diff", "-z", "--name-only", ref, "--", *c["pathspecs"]))
+        if c["include"]:
+            outside = (unstaged - named) | untracked
+        else:  # --only (default with pathspecs): staged changes of other paths are not committed either
+            staged = set(git_list("diff", "-z", "--cached", "--name-only", "--", *PY))
+            outside = ((unstaged | staged) - named) | untracked
+    else:
+        outside = unstaged | untracked
+    return [f"{f}:1: fixfirst changed but not in this commit: git add it or commit -a" for f in sorted(outside)]
+
+
+# ------------------------------------------------------------------- entry points
+def verify(ci: str | None = None, notices: list | None = None, commit_args: list[str] | None = None) -> list[str]:
+    """Full check. Locally: configs from HEAD, files and suppressions vs the base. --ci: vs the target."""
+    notices = [] if notices is None else notices
+    cwd = Path.cwd()
+    if chdir_root() is None:
+        return []
+    if ci:
+        cfg_ref = ci
+        base = (git("merge-base", "HEAD", ci) or ci).strip()
+    else:
+        cfg_ref, (base, _) = head(), resolve_base()
+    files = changed_files(base)
+    with tempfile.TemporaryDirectory() as t:
+        try:
+            cfg = Config(cfg_ref, Path(t))
+        except ConfigError as e:
+            return [str(e)]
+        out = [] if ci else config_changes(cfg)
+        out += lint(cfg, files, fix=not ci)
+        out += suppressions(base, files)
+        out += tests(cfg, base, bool(ci), notices)
+    if commit_args is not None:
+        out += outside_commit(commit_args, cwd)  # after autofix, so autofixed-but-unstaged files count
+    if not out and not ci:
+        save_stop_state({"hashes": [], "in_a_row": 0})  # verify passed (also: commit via shim)
+    return out
+
+
+def check_changed() -> list[str]:
+    """Per-edit hook: files changed since the last call; report only, no rewrites (ADR-0008)."""
+    if chdir_root() is None:
+        return []
+    stamp = state_dir() / "post-stamp"
+    since = stamp.stat().st_mtime if stamp.exists() else 0
+    now = time.time()
+    base, _ = resolve_base()
+    files = [f for f in changed_files(base) if Path(f).stat().st_mtime > since]
+    out: list[str] = []
+    if files:
+        with tempfile.TemporaryDirectory() as t:
+            try:
+                cfg = Config(head(), Path(t))
+            except ConfigError as e:
+                return [str(e)]
+            out = config_changes(cfg) + lint(cfg, files, fix=False) + suppressions(base, files)
+    stamp.touch()
+    os.utime(stamp, (now, now))  # edits during this run are picked up next time
+    return out
+
+
+def load_stop_state() -> dict:
+    try:
+        return json.loads((state_dir() / "stop.json").read_text())
+    except (OSError, ValueError):
+        return {"hashes": [], "in_a_row": 0}
+
+
+def save_stop_state(state: dict) -> None:
+    (state_dir() / "stop.json").write_text(json.dumps(state))
+
+
+def tree_hash() -> str:
+    """Hash of working tree incl. untracked files, via a throwaway index."""
+    with tempfile.TemporaryDirectory() as t:
+        idx = Path(t) / "index"
+        src = Path((git("rev-parse", "--git-path", "index") or "").strip())
+        if src.is_file():
+            shutil.copy(src, idx)
+        env = os.environ | {"GIT_INDEX_FILE": str(idx)}
+        run("git", "add", "-A", env=env)
+        return run("git", "write-tree", env=env).stdout.strip()
+
+
+def stop(notices: list[tuple[str, str]]) -> list[str]:
+    """Stop gate with skip and cap (ADR-0011): never block one tree twice, never more than 2 in a row."""
+    if chdir_root() is None:
+        return []
+    untracked = git_list("ls-files", "-z", "--others", "--exclude-standard", "--", *PY)
+    if head() and run("git", "diff", "--quiet", "HEAD").returncode == 0 and not untracked:
+        return []
+    state = load_stop_state()
+    before = tree_hash()
+    if before in state["hashes"] or state["in_a_row"] >= STOP_MAX_IN_A_ROW:
+        why = "this state was blocked before" if before in state["hashes"] else "blocked twice in a row"
+        state["in_a_row"] = 0
+        save_stop_state(state)
+        notices.append(
+            (
+                "",
+                f"fixfirst: let the agent stop with problems left ({why}); the commit gate still holds, "
+                + "run `fixfirst verify`",
+            )
+        )
+        return []
+    lines = verify(notices=notices)
+    if lines:
+        state = load_stop_state()
+        state["hashes"] = [*state["hashes"], tree_hash()][-50:]
+        state["in_a_row"] += 1
+        save_stop_state(state)
+    return lines
+
+
+# ------------------------------------------------------------------- install / env / doctor
+def hooks_file_targets() -> list[tuple[str, Path]]:
+    home = Path.home()
+    return [("Claude Code", home / ".claude/settings.json"), ("Codex", home / ".codex/hooks.json")]
+
+
+def merge_json_hooks(path: Path) -> None:
+    cur = json.loads(path.read_text()) if path.exists() else {}
+    hooks = cur.setdefault("hooks", {})
+    for event, entries in json.loads(data("hooks.json"))["hooks"].items():
+        lst = hooks.setdefault(event, [])
+        lst.extend(e for e in entries if e not in lst)
+    path.write_text(json.dumps(cur, indent=2) + "\n")
+
+
+def install() -> None:
+    SHIM_DIR.mkdir(parents=True, exist_ok=True)
+    (SHIM_DIR / "git").write_text(data("git-shim.sh"))
+    (SHIM_DIR / "git").chmod(0o755)
+    done = [f"git shim     {SHIM_DIR / 'git'}"]
+    for name, path in hooks_file_targets():
+        if path.parent.is_dir():
+            merge_json_hooks(path)
+            done.append(f"{name:<12} {path}")
+    print("\n".join(done))
+    print('\nIn every harness launcher / systemd unit (NOT your own shell):  eval "$(fixfirst env)"')
+    print(
+        'Trust for running tests (fnmatch on host/path of origin):  export FIXFIRST_TRUST="gitlab.example.com/group/*"'
+    )
+    print("OpenCode: wire the same hooks via opencode-cc-hooks (unverified, see ROADMAP).")
+
+
+def doctor() -> None:
+    from fixfirst import __version__
+
+    rows = [("fixfirst", __version__)]
+    for name in ("ruff", "ty"):
+        try:
+            b = tool_bin(name)
+            rows.append((name, f"{run(b, '--version').stdout.strip()}  {b}"))
+        except RuntimeError as e:
+            rows.append((name, f"MISSING: {e}"))
+    shim = SHIM_DIR / "git"
+    first = (shutil.which("git") or "").startswith(str(SHIM_DIR))
+    rows.append(("git shim", f"{'installed' if shim.is_file() else 'MISSING'}; {'first' if first else 'not'} on PATH"))
+    for name, path in hooks_file_targets():
+        wired = path.is_file() and "fixfirst hook stop" in path.read_text()
+        rows.append((name, f"{'wired' if wired else 'not wired'}  {path}"))
+    if chdir_root() is not None:
+        base, how = resolve_base()
+        rows.append(("base", f"{base[:12]}  {how}"))
+        url = (git("remote", "get-url", "origin") or "").strip() or "(no origin)"
+        rows.append(("tests", f"{'run' if trusted() else 'SKIPPED, not trusted'}  origin={url}"))
+        rows.append(("FIXFIRST_TRUST", os.environ.get("FIXFIRST_TRUST", "(unset)")))
+    print("\n".join(f"{k:<15} {v}" for k, v in rows))
+
+
+# ------------------------------------------------------------------- main
+def show_notices(notices: list[tuple[str, str]], as_json: bool) -> None:
+    """Notices are for the human, never for the model."""
+    if not notices:
+        return
+    text = "\n".join(n for _, n in notices)
+    if as_json:
+        print(json.dumps({"systemMessage": text}))
+    else:
+        sys.stderr.write(text + "\n")
+    for stamp, _ in notices:
+        if stamp:
+            (state_dir() / stamp).touch()
+
+
+def emit(lines: list[str], stream) -> bool:
+    if lines:
+        stream.write("\n".join(dict.fromkeys(lines)) + "\n")
+    return bool(lines)
+
+
+def log_error(exc_type, exc, tb) -> str:
+    """Traceback to .git/fixfirst/error.log, never to the model; returns where it went."""
+    import traceback
+
+    text = f"--- {time.strftime('%Y-%m-%d %H:%M:%S')} fixfirst {' '.join(sys.argv[1:])}\n"
+    text += "".join(traceback.format_exception(exc_type, exc, tb))
+    try:
+        log = state_dir() / "error.log"
+        with log.open("a", encoding="utf-8") as f:
+            f.write(text)
+        return str(log)
+    except OSError:  # .git/fixfirst unusable: still never to the model
+        log = Path(tempfile.gettempdir()) / "fixfirst-error.log"
+        with log.open("a", encoding="utf-8") as f:
+            f.write(text)
+        return str(log)
+
+
+def fail_closed(exc_type, exc, tb) -> None:
+    """verify (shim, CLI, CI): any crash refuses — a crash must not be a cheap off-switch (ADR-0011)."""
+    if issubclass(exc_type, KeyboardInterrupt):
+        sys.__excepthook__(exc_type, exc, tb)
+        return
+    log_error(exc_type, exc, tb)
+    if "--commit" in OWN_ARGS:
+        print("fixfirst internal error, commit refused; a human can commit, report the bug")
+    else:
+        print("fixfirst internal error, verify failed; traceback in .git/fixfirst/error.log")
+    sys.stdout.flush()
+    os._exit(1)
+
+
+def fail_open_hook(exc_type, exc, tb) -> None:
+    """Hooks: a crash must not brick the agent; non-2 exits are non-blocking in the harnesses (ADR-0011)."""
+    where = log_error(exc_type, exc, tb)
+    print(json.dumps({"systemMessage": f"fixfirst internal error, check skipped: {exc_type.__name__} ({where})"}))
+    sys.stdout.flush()
+    os._exit(0)
+
+
+def main() -> None:
+    args = [a for a in OWN_ARGS if a != "-v"]
+    cmd = args[0] if args else ""
+    notices: list[tuple[str, str]] = []
+    sys.excepthook = fail_closed if cmd == "verify" else fail_open_hook if cmd == "hook" else sys.excepthook
+    if cmd == "verify":
+        ci = args[args.index("--ci") + 1] if "--ci" in args[:-1] else None
+        commit_args = PASSED_ARGS if "--commit" in args else None
+        failed = emit(verify(ci, notices, commit_args), sys.stdout)
+        show_notices(notices, as_json=False)
+        sys.exit(1 if failed else 0)
+    if cmd == "hook" and len(args) > 1 and args[1] in ("post", "stop"):
+        if sys.stdin is not None and not sys.stdin.isatty():
+            sys.stdin.read()  # payload not needed
+        lines = check_changed() if args[1] == "post" else stop(notices)
+        if emit(lines, sys.stderr):
+            sys.exit(2)  # exit 2: stderr is fed to the model; notices wait for a quiet run
+        show_notices(notices, as_json=True)
+        sys.exit(0)
+    if cmd == "install":
+        install()
+    elif cmd == "env":
+        print(f'export PATH="{SHIM_DIR}:$PATH"')
+    elif cmd == "doctor":
+        doctor()
+    else:
+        print(__doc__)
+        sys.exit(2)
+
+
+if __name__ == "__main__":
+    main()

fixfirst/data/git-shim.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# fixfirst git shim: first on PATH for agent harnesses only. `git commit` runs `fixfirst verify`.
+self=$(dirname "$(readlink -f "$0")")
+PATH=$(tr ':' '\n' <<<"$PATH" | grep -vxF "$self" | paste -sd:)
+real=$(command -v git) || { echo "fixfirst shim: git not found" >&2; exit 127; }
+i=1; sub=""
+while [ $i -le $# ]; do
+  a=${!i}
+  case $a in
+    -C|-c|--git-dir|--work-tree|--namespace) i=$((i+2)) ;;
+    -*) i=$((i+1)) ;;
+    *) sub=$a; break ;;
+  esac
+done
+if [[ $sub == commit || $sub == commit-tree ]]; then
+  mode=()
+  [[ $sub == commit ]] && mode=(--commit -- "${@:$((i+1))}")  # verify needs to know what git will stage
+  if out=$(fixfirst verify "${mode[@]}" 2>&1); then
+    [ -n "$out" ] && printf '%s\n' "$out" >&2
+  else
+    case $out in
+      "fixfirst internal error"*) printf '%s\n' "$out" >&2 ;;  # exactly one line, no "fix the lines above"
+      *) printf '%s\ncommit refused: fix the lines above, then commit again.\n' "$out" >&2 ;;
+    esac
+    exit 1
+  fi
+fi
+exec "$real" "$@"

fixfirst/data/hooks.json

@@ -0,0 +1,6 @@
+{
+  "hooks": {
+    "PostToolUse": [{ "matcher": ".*", "hooks": [{ "type": "command", "command": "fixfirst hook post", "timeout": 120 }] }],
+    "Stop": [{ "hooks": [{ "type": "command", "command": "fixfirst hook stop", "timeout": 600 }] }]
+  }
+}

fixfirst/policy.py

@@ -0,0 +1,217 @@
+"""fixfirst test policy. Never imported by the CLI: the gate copies this file as `fixfirst_gate.py`
+onto PYTHONPATH and starts pytest with `-p fixfirst_gate -p no:fixfirst` (ADR-0020).
+
+Opt-in parts (decided by the gate from the committed config, passed via environment):
+
+  coverage    FIXFIRST_COVERAGE_MIN: per-file minimum for every touched/changed file
+  hypothesis  FIXFIRST_NUMERICAL: lines reached under these paths must be reached by a
+              Hypothesis test (paths = TID251 per-file-ignores of the committed ruff config)
+
+Always: conftest.py may hold fixtures, never pytest hooks; no code in .tmp/.
+Findings go to $FIXFIRST_REPORT, one line each. Nothing is printed.
+"""
+
+from __future__ import annotations
+
+import ast
+import os
+import subprocess
+from pathlib import Path
+
+import pytest
+
+REPORT = Path(os.environ.get("FIXFIRST_REPORT", os.devnull))
+COVERAGE_MIN = float(os.environ["FIXFIRST_COVERAGE_MIN"]) if os.environ.get("FIXFIRST_COVERAGE_MIN") else None
+NUMERICAL = tuple(p for p in os.environ.get("FIXFIRST_NUMERICAL", "").split("\n") if p)
+NOT_JUDGED = frozenset({"tests", "test", "docs", "scripts", "notebooks", "migrations"})
+_PREFIX = "hypothesis::"
+_findings: list[str] = []
+
+try:
+    from hypothesis import HealthCheck, is_hypothesis_test, settings
+except ImportError:  # the gate reports a missing hypothesis before pytest starts
+    is_hypothesis_test = None
+else:
+    settings.register_profile("dev", max_examples=25, deadline=None)
+    settings.register_profile(
+        "ci", max_examples=500, deadline=None, print_blob=True, suppress_health_check=[HealthCheck.too_slow]
+    )
+    settings.load_profile(os.environ.get("FIXFIRST_HYPOTHESIS_PROFILE", "dev"))
+
+
+def _fail(line: str) -> None:
+    _findings.append(line)
+
+
+def _abort(lines: list[str]) -> None:
+    REPORT.write_text("\n".join(lines) + "\n", encoding="utf-8")
+    pytest.exit("fixfirst policy violation", returncode=3)
+
+
+def _check_conftests(config) -> None:
+    bad = []
+    for plugin in config.pluginmanager.get_plugins():
+        path = getattr(plugin, "__file__", "") or ""
+        if Path(path).name != "conftest.py":
+            continue
+        names = sorted(n for n, v in vars(plugin).items() if n.startswith("pytest_") and callable(v))
+        if hasattr(plugin, "pytest_plugins"):
+            names.append("pytest_plugins")
+        if names:
+            rel = os.path.relpath(path, config.rootpath)
+            bad.append(f"{rel}:1: fixfirst conftest.py may define fixtures, not hooks/plugins ({', '.join(names)})")
+    if bad:
+        _abort(bad)
+
+
+def _check_scratch(rootdir: Path) -> None:
+    scratch = rootdir / ".tmp"
+    if scratch.is_dir():
+        bad = [
+            f"{p.relative_to(rootdir)}:1: fixfirst no Python code in .tmp/, move it to src/, tests/ or scripts/"
+            for p in sorted(scratch.rglob("*.py"))
+        ]
+        if bad:
+            _abort(bad)
+
+
+def pytest_sessionstart(session):
+    _check_conftests(session.config)
+    _check_scratch(Path(str(session.config.rootpath)).resolve())
+
+
+def pytest_collection_finish(session):
+    _check_conftests(session.config)  # nested conftest.py files load during collection
+
+
+def _cov(config):
+    plugin = config.pluginmanager.get_plugin("_cov")
+    ctrl = getattr(plugin, "cov_controller", None) if plugin else None
+    return getattr(ctrl, "cov", None) if ctrl else None
+
+
+def _body_lines(path: Path) -> set[int]:
+    """Lines inside function bodies; imports and def headers run at import time, outside any test."""
+    try:
+        tree = ast.parse(path.read_text(encoding="utf-8"), filename=str(path))
+    except (OSError, SyntaxError):
+        return set()
+    lines: set[int] = set()
+    for node in ast.walk(tree):
+        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+            for stmt in node.body:
+                lines.update(range(stmt.lineno, (stmt.end_lineno or stmt.lineno) + 1))
+    return lines
+
+
+def _ranges(nums: list[int]) -> str:
+    out: list[str] = []
+    start = prev = None
+    for n in [*nums, None]:
+        if start is not None and n == prev + 1:
+            prev = n
+            continue
+        if start is not None:
+            out.append(f"{start}" if start == prev else f"{start}-{prev}")
+        start = prev = n
+    return ",".join(out[:8]) + (" ..." if len(out) > 8 else "")
+
+
+@pytest.fixture(autouse=True)
+def _fixfirst_hypothesis_context(request):
+    """Evidence comes from Hypothesis itself, never from a marker."""
+    func = getattr(request.node, "function", None)
+    cov = _cov(request.config)
+    if not NUMERICAL or is_hypothesis_test is None or cov is None or func is None or not is_hypothesis_test(func):
+        yield
+        return
+    cov.switch_context(f"{_PREFIX}{request.node.nodeid}")
+    try:
+        yield
+    finally:
+        cov.switch_context("")
+
+
+def _changed_files(rootdir: Path) -> set[str]:
+    base = os.environ.get("FIXFIRST_BASE", "HEAD")
+    git = ["git", "-C", str(rootdir)]
+    diff = subprocess.run(
+        [*git, "diff", "-z", "--name-only", "--diff-filter=d", base, "--", "*.py"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    new = subprocess.run(
+        [*git, "ls-files", "-z", "--others", "--exclude-standard", "--", "*.py"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    return {f for f in (diff.stdout + new.stdout).split("\0") if f}
+
+
+@pytest.hookimpl(trylast=True)
+def pytest_sessionfinish(session, exitstatus):
+    if getattr(session.config, "workerinput", None) is not None:
+        return  # xdist worker; the controller judges
+    rootdir = Path(str(session.config.rootpath)).resolve()
+    if COVERAGE_MIN is not None or NUMERICAL:
+        cov = _cov(session.config)
+        if cov is None:
+            _fail("pyproject.toml:1: fixfirst pytest-cov did not run, coverage/Hypothesis policy unverifiable")
+        else:
+            _coverage_policy(cov, rootdir)
+    REPORT.write_text("".join(f"{f}\n" for f in _findings), encoding="utf-8")
+    if _findings:
+        session.exitstatus = 3
+    receipt, nonce = os.environ.get("FIXFIRST_RECEIPT"), os.environ.get("FIXFIRST_NONCE")
+    if receipt and nonce and session.exitstatus == 0:
+        Path(receipt).write_text(nonce, encoding="utf-8")
+
+
+def _coverage_policy(cov, rootdir: Path) -> None:
+    from coverage.exceptions import NoSource, NotPython  # coverage exists whenever pytest-cov ran
+
+    data = cov.get_data()
+    measured: dict[str, str] = {}
+    for fname in data.measured_files():
+        p = Path(fname).resolve()
+        if p.is_relative_to(rootdir):
+            measured[p.relative_to(rootdir).as_posix()] = fname
+
+    if COVERAGE_MIN is not None:
+        executed = {rel for rel, f in measured.items() if data.lines(f)}
+        for rel in sorted(_changed_files(rootdir)):
+            if rel.split("/")[0] in NOT_JUDGED or Path(rel).name in ("__init__.py", "conftest.py"):
+                continue
+            if (rootdir / rel).is_file() and rel not in executed:
+                _fail(f"{rel}:1: fixfirst no test executes this changed file")
+        for rel, fname in sorted(measured.items()):
+            if not data.lines(fname):
+                continue
+            try:
+                _, stmts, _, missing, _ = cov.analysis2(fname)
+            except (NoSource, NotPython):  # file gone or not parsable: nothing to measure
+                continue
+            if stmts:
+                pct = 100.0 * (len(stmts) - len(missing)) / len(stmts)
+                if pct < COVERAGE_MIN:
+                    _fail(
+                        f"{rel}:{missing[0]}: fixfirst coverage {pct:.0f}% < {COVERAGE_MIN:.0f}%, "
+                        f"untested lines {_ranges(sorted(missing))}"
+                    )
+
+    for rel, fname in sorted(measured.items()):
+        if not any(rel == p or rel.startswith(p + "/") for p in NUMERICAL):
+            continue
+        covered = set(data.lines(fname) or []) & _body_lines(Path(fname))
+        if not covered:
+            continue
+        contexts = data.contexts_by_lineno(fname)
+        proven = {n for n, labels in contexts.items() if any(c and c.startswith(_PREFIX) for c in labels)}
+        missing = sorted(covered - proven)
+        if missing:
+            _fail(
+                f"{rel}:{missing[0]}: fixfirst numerical code without a Hypothesis (@given) test, "
+                f"lines {_ranges(missing)}"
+            )

fixfirst-0.1.0.dist-info/METADATA

@@ -0,0 +1,63 @@
+Metadata-Version: 2.5
+Name: fixfirst
+Version: 0.1.0
+Summary: Makes coding agents fix their code instead of cheating around ruff, ty and your tests
+Author: fixfirst contributors
+License-Expression: Apache-2.0
+License-File: LICENSE
+Classifier: Development Status :: 3 - Alpha
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.11
+Requires-Dist: ruff==0.17.5
+Requires-Dist: ty==0.0.104
+Description-Content-Type: text/markdown
+
+# fixfirst
+
+Makes coding agents fix their code instead of cheating around ruff, ty and your tests.
+One gate that only the agent hits, configured only by your committed rules, one line per problem,
+silent on success. Status: alpha (0.1.0). Design: `IDEA.md`, `docs/adr/`.
+
+## Setup (once per machine)
+
+```bash
+uv tool install fixfirst
+fixfirst install                 # git shim + hooks for Claude Code (~/.claude) and Codex (~/.codex)
+```
+
+In each harness launcher or systemd unit — **not** in your own shell:
+
+```bash
+eval "$(fixfirst env)"                                    # git shim first on the agent's PATH
+export FIXFIRST_TRUST="gitlab.example.com/mygroup/*"      # repos whose tests may run (host/path)
+```
+
+Per repo: nothing. The project needs a `.venv` (`uv sync`) with pytest, plus pytest-cov / hypothesis
+if you switch those policies on. `fixfirst doctor` shows the wiring, the base and the trust status.
+
+## What runs
+
+| check | on when (committed config) |
+|---|---|
+| ruff | always; `.ruff.toml` / `ruff.toml` / `[tool.ruff]`, else ruff defaults |
+| bandit | ruff `S` rules selected |
+| ty | `ty.toml` exists |
+| coverage | coverage `fail_under` set; per touched/changed file |
+| Hypothesis evidence | TID251 per-file-ignores in the ruff config (numerical boundary) |
+| tests | `tests/` or a pytest config exists, and the origin matches `FIXFIRST_TRUST` |
+| suppressions | always: any `noqa`, `type/ty/pyright: ignore`, `nosec`, `pragma: no cover`, `fmt: off/skip` … not present at the base |
+
+Config is read from git (`HEAD`), never from disk: agent edits to config have no effect and block
+its commit. Only changed files are checked, so old problems in untouched files never block.
+
+When: after every agent tool call (changed files, report only), when the agent stops, and on every
+`git commit` through the shim (autofix of changed files, then everything). CI:
+`fixfirst verify --ci origin/<target>`.
+
+Limits: stops lazy agents, not hostile ones — root agents, `/usr/bin/git` and sabotage from test
+code are out of scope (ADR-0012). Protect `main` with CI and CODEOWNERS.
+
+## Source and contributions
+Apache-2.0. The source ships in the package on PyPI; development happens in a private repository,
+so there is no public issue tracker and no pull requests.

fixfirst-0.1.0.dist-info/RECORD

@@ -0,0 +1,11 @@
+fixfirst/__init__.py,sha256=kUR5RAFc7HCeiqdlX36dZOHkUI5wI6V_43RpEcD8b-0,22
+fixfirst/__main__.py,sha256=Xip5ii4o5COB5aeUr3UTnSG2Jn_RD5SVF0FAMnxJaFk,38
+fixfirst/cli.py,sha256=vDXQe5FzBYVqsJ3Qy26B6VyJPAAlicFO8nvnBtIpOss,31200
+fixfirst/policy.py,sha256=oCWxkAF8ccCHjKFCxZ692LG3ok_yfhofz9qdPa5_gbU,8383
+fixfirst/data/git-shim.sh,sha256=3lC5iLp2ccqGQ4ezTcDiK14TJpZYoI5VMh1nidF9WvM,1015
+fixfirst/data/hooks.json,sha256=0tJH5tPeMaqOH3IDViwRhUjTcJO2wKLDjJuvly4ZLbk,246
+fixfirst-0.1.0.dist-info/METADATA,sha256=BCoa7P7aaGWFarpJq7P1DmRfoS3vXnTWZYkspGxZB-A,2786
+fixfirst-0.1.0.dist-info/WHEEL,sha256=2iZrJkDIkeDh0k9SikKMqFuRP-ua6mb4Ir1AsER4BEw,87
+fixfirst-0.1.0.dist-info/entry_points.txt,sha256=S0684h-wAcIbQE5Lvh3L_LeZDd20AeEecS8CHkMw9bU,47
+fixfirst-0.1.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+fixfirst-0.1.0.dist-info/RECORD,,

fixfirst-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.33.0
+Root-Is-Purelib: true
+Tag: py3-none-any

fixfirst-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+fixfirst = fixfirst.cli:main

fixfirst-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.