lazycoder 0.1.0__py3-none-any.whl

argus/llm/client.py

@@ -0,0 +1,26 @@
+from __future__ import annotations
+
+from collections import deque
+from collections.abc import Sequence
+from typing import Protocol
+
+
+class LLMClient(Protocol):
+    """Minimal contract for components that produce raw model output."""
+
+    def generate(self, prompt: str) -> str: ...
+
+
+class FakeLLMClient:
+    """Deterministic LLM test double with queued raw responses."""
+
+    def __init__(self, responses: Sequence[str]) -> None:
+        self._responses = deque(responses)
+        self.prompts: list[str] = []
+
+    def generate(self, prompt: str) -> str:
+        self.prompts.append(prompt)
+        if not self._responses:
+            msg = "FakeLLMClient has no queued responses"
+            raise ValueError(msg)
+        return self._responses.popleft()

argus/orchestrator.py

@@ -0,0 +1,68 @@
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+
+from argus.config.models import ReviewRulesConfig
+from argus.domain import ReviewReport
+from argus.reviewers import SingleRuleReviewer
+
+# Matches a unified-diff hunk header, capturing the new-file start line:
+#   @@ -12,3 +45,6 @@  ->  45
+_HUNK = re.compile(r"^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@")
+
+
+@dataclass(frozen=True)
+class CodeBlock:
+    """One reviewable chunk of a diff: a single hunk's post-change content."""
+
+    file: str
+    start_line: int
+    code: str
+
+
+def parse_diff(diff_text: str) -> list[CodeBlock]:
+    """Split a unified diff into per-hunk code blocks (added + context lines).
+
+    ponytail: naive line scanner, no renames/binaries/mode changes. Add when a
+    real diff needs them.
+    """
+    blocks: list[CodeBlock] = []
+    current_file: str | None = None
+    start_line = 1
+    lines: list[str] = []
+
+    def flush() -> None:
+        if current_file and current_file != "/dev/null" and lines:
+            blocks.append(CodeBlock(current_file, start_line, "\n".join(lines)))
+
+    for raw in diff_text.splitlines():
+        if raw.startswith("+++ "):
+            flush()
+            lines = []
+            path = raw[4:].strip()
+            current_file = path[2:] if path.startswith("b/") else path
+        elif match := _HUNK.match(raw):
+            flush()
+            lines = []
+            start_line = int(match.group(1))
+        elif raw.startswith("+") and not raw.startswith("+++"):
+            lines.append(raw[1:])
+        elif raw.startswith(" "):
+            lines.append(raw[1:])
+        # '-' removals, '\', and file headers are ignored.
+
+    flush()
+    return blocks
+
+
+def review_diff(
+    reviewer: SingleRuleReviewer, diff_text: str, rubric: ReviewRulesConfig
+) -> ReviewReport:
+    """Review every hunk of a diff against the full rubric, one global report."""
+    results = [
+        result
+        for block in parse_diff(diff_text)
+        for result in reviewer.review_rubric(block.code, rubric).rule_results
+    ]
+    return ReviewReport.from_rule_results(results)

argus/reviewers/__init__.py

@@ -0,0 +1,5 @@
+"""Reviewer agents and parsing helpers."""
+
+from argus.reviewers.single_rule import LLMReviewerParseError, SingleRuleReviewer
+
+__all__ = ["LLMReviewerParseError", "SingleRuleReviewer"]

argus/reviewers/single_rule.py

@@ -0,0 +1,126 @@
+from __future__ import annotations
+
+import json
+
+from pydantic import BaseModel, ConfigDict, ValidationError, model_validator
+
+from argus.config.models import ReviewRule, ReviewRulesConfig
+from argus.domain import Finding, ReviewReport, RuleResult
+from argus.llm import LLMClient
+
+
+class LLMReviewerParseError(Exception):
+    """Raised when a reviewer response is invalid or does not match the schema."""
+
+
+def _normalize_severity(payload: dict[str, object]) -> None:
+    """Lowercase severity at the parse boundary so the domain enum stays strict."""
+    finding = payload.get("finding")
+    if isinstance(finding, dict):
+        severity = finding.get("severity")
+        if isinstance(severity, str):
+            finding["severity"] = severity.strip().lower()
+
+
+class _ReviewerResponse(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    passed: bool
+    finding: Finding | None = None
+
+    @model_validator(mode="after")
+    def finding_matches_passed(self) -> _ReviewerResponse:
+        if self.passed and self.finding is not None:
+            msg = "passed response must not include a finding"
+            raise ValueError(msg)
+        if not self.passed and self.finding is None:
+            msg = "failed response must include a finding"
+            raise ValueError(msg)
+        return self
+
+
+class SingleRuleReviewer:
+    """Minimal reviewer that evaluates one rule on one code block."""
+
+    def __init__(self, client: LLMClient) -> None:
+        self._client = client
+
+    def review(self, code_block: str, rule: ReviewRule) -> RuleResult:
+        prompt = self._build_prompt(code_block=code_block, rule=rule)
+        raw_response = self._client.generate(prompt)
+        parsed = self._parse_response(raw_response)
+        finding = parsed.finding
+        if finding is not None and finding.rule_id != rule.id:
+            msg = "Invalid reviewer response: finding.rule_id must match requested rule"
+            raise LLMReviewerParseError(msg)
+        return RuleResult(rule_id=rule.id, passed=parsed.passed, finding=finding)
+
+    def review_all(self, code_block: str, rules: list[ReviewRule]) -> ReviewReport:
+        """Evaluate every rule on one block and aggregate into a report."""
+        results = [self.review(code_block, rule) for rule in rules]
+        return ReviewReport.from_rule_results(results)
+
+    def review_rubric(self, code_block: str, rubric: ReviewRulesConfig) -> ReviewReport:
+        """Evaluate one block against every rule in the configured rubric."""
+        return self.review_all(code_block, rubric.rules)
+
+    def _build_prompt(self, code_block: str, rule: ReviewRule) -> str:
+        rule_id = rule.id.value
+        return (
+            "You are reviewing one code block against one rule.\n"
+            f"Rule ID: {rule_id}\n"
+            f"Question: {rule.question}\n"
+            f"Checks: {rule.checks}\n"
+            f"Flag when: {rule.flag_when}\n"
+            f"Expected severity if unjustified: {rule.severity_if_unjustified.value}\n"
+            "Respond with a single JSON object and nothing else"
+            " - no prose, no code fences.\n"
+            "Fields:\n"
+            "- passed (bool): true if the rule is satisfied,"
+            " false if it is violated.\n"
+            "- finding (object|null): null when passed is true;"
+            " required when passed is false, with fields:\n"
+            f'  - rule_id (string): must be exactly "{rule_id}".\n'
+            "  - location (object): file (string, non-empty),"
+            " line (int, 1-based), optional end_line (int >= line).\n"
+            '  - severity (string): one of "low", "medium", "high".\n'
+            "  - reason (string, non-empty): why the code violates the rule.\n"
+            "Example output when the rule passes:\n"
+            '{"passed": true, "finding": null}\n'
+            "Example output when the rule is violated:\n"
+            f'{{"passed": false, "finding": {{"rule_id": "{rule_id}",'
+            ' "location": {"file": "diff.py", "line": 3}, "severity": "high",'
+            ' "reason": "unvalidated input reaches the query"}}\n'
+            "Code block:\n"
+            f"{code_block}\n"
+        )
+
+    def _parse_response(self, raw_response: str) -> _ReviewerResponse:
+        payload = self._extract_json_object(raw_response)
+        _normalize_severity(payload)
+        try:
+            return _ReviewerResponse.model_validate(payload)
+        except ValidationError as exc:
+            msg = f"Invalid reviewer response: {exc}"
+            raise LLMReviewerParseError(msg) from exc
+
+    @staticmethod
+    def _extract_json_object(raw_response: str) -> dict[str, object]:
+        # Slice from the first '{' to the last '}' so code fences (```json)
+        # and surrounding prose are dropped in one move.
+        # ponytail: naive brace slice; over-captures if prose after the object
+        # also contains a '}'. Switch to a bracket-matching scan if that shows up.
+        start = raw_response.find("{")
+        end = raw_response.rfind("}")
+        if start == -1 or end < start:
+            msg = "Invalid reviewer response: no JSON object found"
+            raise LLMReviewerParseError(msg)
+        try:
+            payload = json.loads(raw_response[start : end + 1])
+        except json.JSONDecodeError as exc:
+            msg = f"Invalid reviewer response: invalid JSON at line {exc.lineno}"
+            raise LLMReviewerParseError(msg) from exc
+        if not isinstance(payload, dict):
+            msg = "Invalid reviewer response: expected a JSON object"
+            raise LLMReviewerParseError(msg)
+        return payload

lazycoder-0.1.0.dist-info/METADATA

@@ -0,0 +1,193 @@
+Metadata-Version: 2.4
+Name: lazycoder
+Version: 0.1.0
+Summary: Code review agent with senior-level judgement: interrogates every diff hunk against a fixed rubric and returns APPROVE / REQUEST_CHANGES / BLOCK
+Project-URL: Repository, https://github.com/aisona-lab/lazycoder
+License-Expression: MIT
+License-File: LICENSE
+Requires-Python: >=3.12
+Requires-Dist: anthropic>=0.40
+Requires-Dist: pydantic>=2.10
+Provides-Extra: dev
+Requires-Dist: black>=24.0; extra == 'dev'
+Requires-Dist: mypy>=1.13; extra == 'dev'
+Requires-Dist: pre-commit>=4.0; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff>=0.8; extra == 'dev'
+Description-Content-Type: text/markdown
+
+<h1><img src="assets/logo.png" alt="" height="40" valign="middle">&nbsp;lazycoder</h1>
+
+A code review agent with senior-level judgement. It interrogates every changed
+block against a fixed rubric, runs the real checks, and returns a defensible
+verdict — **APPROVE / REQUEST_CHANGES / BLOCK** — before code is trusted or merged.
+
+Code gets written fast. The bottleneck is trusting it. lazycoder is the reviewer
+that never gets tired, never skips a rule, and never self-reports green without
+running the checks.
+
+## Manual review vs lazycoder
+
+| | Manual review | lazycoder |
+|---|---|---|
+| **Coverage** | Whatever the reviewer remembers to look at | Every rule (R1–R17) evaluated, every time |
+| **Consistency** | Varies by reviewer, mood, time of day | Same rubric, same policy, deterministic |
+| **Verdict** | "LGTM" / gut feel | APPROVE / REQUEST_CHANGES / BLOCK from a severity policy |
+| **Evidence** | Comments, sometimes | Every finding cites `rule_id` + exact file:line |
+| **Green claims** | "tests pass" (trust me) | Real linter/typecheck/test output in a sandbox |
+| **Untrusted code** | Reviewer may run it locally | Reviewed code is data, never executed outside the sandbox |
+| **Speed at scale** | Slows down as diffs grow | Loops the rubric per block, unattended |
+| **Auditability** | Lives in someone's head | Append-only decision log; any verdict is replayable |
+
+lazycoder does not replace the human — a person still confirms consequential
+decisions. It removes the parts humans are bad at: remembering all 17 rules,
+staying consistent across 200 files, and proving the checks actually ran.
+
+Two structural facts, at a glance. These are not benchmarks — they are
+properties enforced by the schema, so they hold on every single review:
+
+```mermaid
+xychart-beta
+    title "Rubric rules guaranteed evaluated per code block"
+    x-axis ["manual review", "lazycoder"]
+    y-axis "rules (of 17)" 0 --> 17
+    bar [0, 17]
+```
+
+Manual review *may* cover all 17 — nothing guarantees it. lazycoder cannot emit
+a verdict until every rule has a recorded pass/fail (`APPROVE` is refused
+otherwise).
+
+```mermaid
+xychart-beta
+    title "Findings that cite rule_id + exact file:line (%)"
+    x-axis ["manual review", "lazycoder"]
+    y-axis "% enforced" 0 --> 100
+    bar [0, 100]
+```
+
+A human reviewer *can* cite evidence; the lazycoder domain model makes an
+uncited finding unrepresentable — pydantic rejects it before it exists.
+
+## Status
+
+The **full pipeline is live end to end** — deterministic core plus the real
+model. A unified diff flows all the way to an aggregated verdict:
+
+```
+diff → parse_diff → CodeBlock[]
+         └─ review_rubric(block, rubric)  # every rule, every block
+              └─ RuleResult[] → from_rule_results → aggregate → verdict
+```
+
+The same flow runs in two modes, sharing every line of plumbing:
+
+- **Fake client** (default, CI): deterministic, network-free. `pytest -q` proves
+  the parser, aggregator, and verdict policy on every run.
+- **Real client** (opt-in): `AnthropicClient` hits the live API. The first live
+  run of eval E3 already passed — the model caught the SQL injection, flagged
+  R7, and the pipeline derived `BLOCK` with zero parse failures.
+
+Because the model was the *last* thing plugged in, any failure isolates to the
+prompt or the model — never to the plumbing, which is already proven. The
+response parser is hardened against real LLM output (code fences, surrounding
+prose, severity casing), and the reviewer prompt teaches the model the exact
+`Finding` schema with a literal example, so form errors die at the source.
+
+## Config-driven policy
+
+Policy is declarative and lives in `config/`, not buried in code. Each file is
+one part of the setup — reviewable, diffable, swappable:
+
+```
+lazycoder/
+├── config/
+│   ├── harness.json              # project context, stack, hard rules, definition of done
+│   ├── guardrails.json           # what the agent may / may not do; injection defense; limits
+│   ├── setup.json                # runtime, deps + rationale, env vars, bootstrap
+│   ├── working_loop.json         # specify → plan → execute → verify → decide
+│   ├── task_loop.json            # orchestrator + review subagents, isolation, aggregation
+│   ├── review_rules.json         # R1..R17 — the interrogation rubric (the core)
+│   ├── production_readiness.json # the release gate
+│   ├── evals.json                # known-flawed/clean cases that test the reviewer
+│   └── observability.json        # append-only decision log, tracing, redaction
+├── src/argus/                    # domain, config loader, reviewers, llm client
+└── tests/                        # unit + integration + eval coverage
+```
+
+## The rubric (R1..R17)
+
+Code-level: data structure (R1), control flow (R2), inputs/outputs (R3), failure
+modes (R4), side effects (R5), dependencies (R6). Security: validation, secrets,
+injection (R7). Simplicity: simplest form (R8). System-level: state (R9), sync vs
+async (R10), monolith vs services (R11), invariant (R12). Plus maintainability,
+tests, and compatibility rules through R17.
+
+## Design decisions — the *why*
+
+The interesting part of this project is not the review logic; it's the choices
+that make the review logic trustworthy.
+
+- **Deterministic core, model last.** Everything that can be pure logic *is* pure
+  logic, and the non-deterministic LLM is bolted on at the very end. This is a
+  deliberate failure-isolation strategy: when a review goes wrong, the bug is in
+  the prompt or the model, because the plumbing has tests proving it isn't there.
+
+- **Contracts make invalid state unrepresentable.** The domain types are strict
+  pydantic models with validators, not bags of fields. A *passed* rule cannot
+  carry a finding; a *failed* one must. Every finding must cite its `rule_id` and
+  an exact `file:line`. The verdict is a *computed* field over findings, never a
+  value someone can set by hand. You cannot construct a lying `ReviewReport`.
+
+- **Normalize at the boundary, keep the core strict.** Untrusted LLM text is
+  cleaned up where it enters (`"HIGH"` → `"high"`), but the domain enum stays the
+  single source of truth and never loosens. Leniency lives at the edge; the core
+  does not bend.
+
+- **Debt is executable, not documented.** The one known parser limitation is
+  pinned by a `strict` xfail test, not a comment someone can ignore. The day the
+  fix lands, that test flips to green and the suite *tells you* the debt is
+  closed. Notes rot; tests don't.
+
+- **TDD throughout.** Every behavior went RED before GREEN — including the
+  garbage-input fixtures that hardened the parser.
+
+- **The eval is the product.** `config/evals.json` is a set of known-flawed and
+  known-clean cases whose job is to measure *the reviewer itself*. Wired as a CI
+  gate, it closes the loop: a code reviewer that has its own reviewer, and knows
+  whether it's still good every time it changes.
+
+## Develop
+
+```bash
+uv sync --extra dev
+pre-commit install
+
+pytest -q                       # deterministic suite — no network, no key
+ruff check . && black --check .
+mypy src
+```
+
+To run the live-API suite (opt-in, never part of `pytest -q`):
+
+```bash
+cp .env.example .env            # fill in ANTHROPIC_API_KEY — .env is gitignored
+set -a; source .env; set +a
+pytest -m integration
+```
+
+## Roadmap
+
+1. ~~Multi-file / diff orchestration on top of `review_rubric`.~~ ✓
+2. ~~Harden the response parser against real LLM output (fixtures).~~ ✓
+3. ~~Wire `config/evals.json` as a regression gate on the fake client — a missed
+   rule fails the gate.~~ ✓
+4. ~~Wire the real Anthropic client behind the same `LLMClient` protocol, with an
+   opt-in integration suite (`pytest -m integration`). First live run: the model
+   caught eval E3's SQL injection (R7 → BLOCK).~~ ✓
+5. **Run the full evals.json set against the live model** and track the score
+   over time — the eval stops measuring the plumbing and starts measuring the
+   reviewer: does this prompt, on this model, still catch what it must?
+6. **Distribution:** package for PyPI with a `lazycoder` console entry point, so
+   users install with `uvx lazycoder` / `pipx install lazycoder` and review a
+   diff with one command. A GitHub Action wrapping the same CLI comes after.

lazycoder-0.1.0.dist-info/RECORD

@@ -0,0 +1,31 @@
+argus/__init__.py,sha256=VmlqakiJiEqOnq4w47hWCNjALYKqAwG7j8UFdCfGqTI,65
+argus/cli.py,sha256=lLiPLGoE345JuFSFWpH2Nyld_Pr8fdoIlX--Z9QalsA,3161
+argus/evals.py,sha256=6ez6o1nUHEKg4b90cBtLBhswE4dtkAX6g_bjkBWZLxs,1614
+argus/orchestrator.py,sha256=wVSyN81Ud0V5pN5I8Uo_39iKSS8FILUvCmKAlQ4WBzQ,2099
+argus/config/__init__.py,sha256=LxnIdC58AercgJnzeuhydRpYVHH8y7DWad_MbrLEW_k,211
+argus/config/exceptions.py,sha256=hdHszYmKubDVRq3W4TrTvvRNCYb_l0-CdzljifJPb8Q,369
+argus/config/loader.py,sha256=ofJT-66fWjlqsuKUe5cvDyTZKJnQel-bryFwXn2kKYM,3166
+argus/config/models.py,sha256=5y8vTrhNWmLxfqFvqoTMX7RVsuWBwtjp5LVSvZWe8LM,6586
+argus/domain/__init__.py,sha256=S7Ygw73IKx-fQyL9hru8zhZ44Q7nDrzVY7HMv_Ieohg,403
+argus/domain/aggregator.py,sha256=otrCfhPUp6OSsytgx8L7ra__4N55RItcsXCyDgZhV3Y,443
+argus/domain/enums.py,sha256=XriyNUm7JiBZaFmVf8aiGyk7TZdBwtpq2pQG3MCq_Z0,676
+argus/domain/models.py,sha256=bh-y_Hlfklf_qxIMftEIdqCqEKFSZ3BrW5hxByhibD8,3409
+argus/llm/__init__.py,sha256=KEJZFLctsqs_YbszXe5oJNElDa-k1iaf-z4dfpMJnBM,142
+argus/llm/anthropic_client.py,sha256=5AlSVplZecrM1x6Ut2fnQgLY5sMsoLh04j1sIfOJTME,955
+argus/llm/client.py,sha256=EmMUEe9bbObpsbfHAtOOquoG97iK9CuOoZVWAnY0Bsw,757
+argus/reviewers/__init__.py,sha256=1Y5ZLS8gRlngnGewRvEcGziJuvpEojHPtxzQRVs4d48,185
+argus/reviewers/single_rule.py,sha256=l17RlgB_SQ31ejN5V6MXIpNkfJCjaGs6qXrzu9Djx0o,5599
+argus/config_defaults/evals.json,sha256=qfpjx3HlH9z7Xo1Zv1sxtd5BjiHm50cmi9Qc8fu95AE,4604
+argus/config_defaults/guardrails.json,sha256=UROE8B-QhNaMzxm4x97UahEHo4KyF7f29DEAXz13bBk,1623
+argus/config_defaults/harness.json,sha256=g7-uo0rhk87C3_Gc_TZYCNPwG7i8-F6J1y9snaPmPaw,2406
+argus/config_defaults/observability.json,sha256=tSUkls1Nyz7l9e2RjyG1SbAdnK4YKLQ0OtZoNjwwwkM,887
+argus/config_defaults/production_readiness.json,sha256=4jQxh5Xtq6MU0dCxHyFA_LIOda62HCrfRBFyhgRWuuE,1463
+argus/config_defaults/review_rules.json,sha256=mG7-qBiAlARDzSf2J1I__JopuWlSTBTByqHfFgKsz4k,9413
+argus/config_defaults/setup.json,sha256=t46yW3kzOEynWUHdDSBhaquZ0Q1McZUm6d_-eoPbxTM,1027
+argus/config_defaults/task_loop.json,sha256=zgeK0viq5tKmqy1ARCk2c9Kgli5LnQT-JeSGdYcOS-A,2012
+argus/config_defaults/working_loop.json,sha256=OrFrKLG-qpCiU0RgUWO1JHYEYrodRpQNkpI3jyarYGg,1748
+lazycoder-0.1.0.dist-info/METADATA,sha256=Q7l4TpXjVALzMlgqew3iSCXOF01cy4mr29rIYtXSGUw,9062
+lazycoder-0.1.0.dist-info/WHEEL,sha256=mffPy8wBnZQn2VnJUU5jE99KsxaSfiyMHV9Yt0aLVxs,87
+lazycoder-0.1.0.dist-info/entry_points.txt,sha256=69ECUFp2kX5K9K9V0ReQiZvRZ4cWzd4rDQtMI93JZU0,45
+lazycoder-0.1.0.dist-info/licenses/LICENSE,sha256=J_Cg8cr_G5WnKPWYa3bKL9629162E_JMZS8rpte4aHU,1067
+lazycoder-0.1.0.dist-info/RECORD,,

lazycoder-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.30.1
+Root-Is-Purelib: true
+Tag: py3-none-any

lazycoder-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+lazycoder = argus.cli:main

lazycoder-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 aisona-lab
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.