leangate 0.1.0__py3-none-any.whl

leangate/__init__.py

@@ -0,0 +1,17 @@
+"""LeanGate: keeps AI-written code lean in production codebases."""
+
+import re
+
+__version__ = "0.1.0"
+
+# What ast.parse raises on hostile or broken input: null bytes (ValueError before 3.12), deep nesting.
+PARSE_ERRORS = (SyntaxError, ValueError, RecursionError, MemoryError)
+
+_LINE = re.compile(r"[^\r\n]*(?:\r\n|\r|\n)|[^\r\n]+\Z")
+
+
+def split_lines(text: str, keepends: bool = False) -> list[str]:
+    """str.splitlines, but only at \\n, \\r\\n and \\r: where ast, git and LSP clients count lines. splitlines also
+    breaks at form feeds and \\u2028, which shifts every line number after one."""
+    lines = _LINE.findall(text)
+    return lines if keepends else [line.rstrip("\r\n") for line in lines]

leangate/__main__.py

@@ -0,0 +1,192 @@
+"""CLI: `leangate verify`, `leangate reuse "<intent>"`, `leangate dep <name>`, `leangate waive <signature>`,
+`leangate providers`, `leangate dashboard` (local live report on 127.0.0.1), `leangate lsp` (language server over
+stdio).
+
+Handy for demos, pre-commit hooks, and CI. Exit codes: 0 pass, 1 `verify` blocked, 2 usage or environment error.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import subprocess
+import sys
+
+
+def main(argv: list[str] | None = None) -> None:
+    parser = argparse.ArgumentParser(prog="leangate")
+    parser.add_argument("--repo", default=".")
+    parser.add_argument("--json", action="store_true", help="print the full JSON report")
+    sub = parser.add_subparsers(dest="cmd", required=True)
+    v = sub.add_parser("verify", help="check the working tree (or a diff) for bloat, missing error handling and security problems")
+    source = v.add_mutually_exclusive_group()
+    source.add_argument("--diff", help="path to a unified diff; default: working tree vs HEAD")
+    source.add_argument("--base", help="check the changes since the merge-base with this ref (CI on a PR)")
+    source.add_argument("--staged", action="store_true", help="check only staged changes (pre-commit)")
+    v.add_argument("--fast", action="store_true", help="Jev only, no Nemotron or web grounding")
+    r = sub.add_parser("reuse", help="find existing code before writing new code")
+    r.add_argument("intent")
+    d = sub.add_parser("dep", help="check a dependency before adding it")
+    d.add_argument("name")
+    d.add_argument("--purpose", default="")
+    w = sub.add_parser("waive", help="dismiss a finding as a person (the only way to waive a security finding)")
+    w.add_argument("signature", nargs="?", help="the finding's signature; omit to list what agents asked to waive")
+    w.add_argument("--note", default="", help="why it's wrong; committed with the waiver")
+    w.add_argument("--local", action="store_true", help="only on this machine; don't write .leangate/waivers.json")
+    sub.add_parser("providers", help="show which providers are live")
+    dash = sub.add_parser("dashboard", help="serve the live report on 127.0.0.1")
+    dash.add_argument("--port", type=int, default=None)
+    sub.add_parser("lsp", help="run the language server over stdio (editors launch this)")
+    hk = sub.add_parser("hooks", help="show the Claude Code hooks for --repo (per-edit feedback + the Stop gate)")
+    hk.add_argument("--write", action="store_true", help="merge them into <repo>/.claude/settings.local.json")
+    lg = sub.add_parser("login", help="push this machine's runs (reports, no code) to your LeanGate Cloud dashboard")
+    lg.add_argument("--url", required=True, help="the site, e.g. https://leangate.example")
+    lg.add_argument("--key", help="an API key from the site's account page; omit to type it in")
+    sub.add_parser("logout", help="stop pushing runs from this machine and forget its key")
+    args = parser.parse_args(argv)
+    try:
+        _run(args)
+    except Exception as exc:  # exit 1 means "blocked"; a crash must not read as a verdict on the code
+        _fail(f"{type(exc).__name__}: {exc}")
+
+
+def _run(args: argparse.Namespace) -> None:
+    if args.cmd == "hooks":
+        from leangate.hooks.install import install
+
+        try:
+            print(install(args.repo, args.write))
+        except ValueError as e:
+            _fail(str(e))
+        return
+    if args.cmd == "dashboard":
+        from leangate.live import serve
+
+        serve(port=args.port)
+        return
+    if args.cmd == "lsp":
+        from leangate.lsp import serve
+
+        serve()
+        return
+    if args.cmd == "waive":
+        print(_waive(args.repo, args.signature, args.note, args.local))
+        return
+    if args.cmd in ("login", "logout"):
+        print(_login(args.url, args.key) if args.cmd == "login" else _logout())
+        return
+
+    from leangate.pipeline import LeanGate
+
+    if args.cmd == "providers":
+        from leangate.backend import get_backend
+
+        print(json.dumps(get_backend().providers(), indent=2))
+        return
+    gate = LeanGate(args.repo, escalate=not getattr(args, "fast", False), source="cli")
+    if args.cmd == "verify":
+        diff = open(args.diff, encoding="utf-8").read() if args.diff else None
+        if diff is None and not _is_git_repo(args.repo):
+            # A gate that silently passes outside a repo is worse than one that fails loudly.
+            _fail(f"{args.repo} is not a git repository")
+        try:
+            report = gate.verify_lean(diff, base=args.base, staged=args.staged)
+        except ValueError as e:
+            _fail(str(e))
+        print(report.model_dump_json(indent=2) if args.json else report.summary)
+        sys.exit(1 if report.gate == "block" else 0)
+    if args.cmd == "reuse":
+        report = gate.check_reuse(args.intent)
+        if args.json:
+            print(report.model_dump_json(indent=2))
+        else:
+            print(f"Recommendation: {report.recommendation}")
+            for c in report.candidates:
+                print(f"  {c.decision.choice if c.decision else '?':9} {c.similarity:.2f}  {c.symbol}  ({c.path}:{c.line})")
+        return
+    if args.cmd == "dep":
+        print(gate.check_dependency(args.name, args.purpose).model_dump_json(indent=2))
+
+
+def _login(url: str, key: str | None) -> str:
+    """Check the key against the site, then save it: from now on each run's report (no code) is pushed there."""
+    import getpass
+
+    import httpx
+
+    from leangate.cloud.client import save_config
+
+    key = (key or getpass.getpass("API key: ")).strip()
+    url = url.rstrip("/")
+    try:
+        res = httpx.get(f"{url}/v1/whoami", headers={"Authorization": f"Bearer {key}"}, timeout=15)
+    except httpx.HTTPError as exc:
+        _fail(f"couldn't reach {url}: {exc}")
+    if res.status_code != 200:
+        _fail(f"{url} refused the key ({res.status_code}): make a new one on the account page")
+    path = save_config(url, key)
+    who = res.json().get("login") or "your account"
+    return (f"Signed in as {who}. Runs in repos with a git remote will show up at {url}/app/ "
+            f"(reports only, no code). Key saved in {path}; `leangate logout` removes it.")
+
+
+def _logout() -> str:
+    from leangate.cloud.client import save_config
+
+    save_config("", None)
+    return "Signed out: this machine no longer pushes runs. Its runs already on the site stay until you delete them there."
+
+
+def _waive(repo: str, signature: str | None, note: str, local: bool) -> str:
+    """A person's waiver: suppressed here, and (unless --local) written to .leangate/waivers.json to commit, so CI
+    and teammates honor it too. Refused inside a Claude Code session: an agent with a shell could otherwise waive
+    its own security findings, which is what this command exists to prevent."""
+    import datetime
+    import os
+    from pathlib import Path
+
+    from leangate.memory import Memory
+    from leangate.memory.store import WAIVERS
+
+    root = Path(subprocess.run(["git", "-C", repo, "rev-parse", "--show-toplevel"], capture_output=True, text=True,
+                               stdin=subprocess.DEVNULL, timeout=10).stdout.strip() or repo)
+    memory = Memory(root, remote=False)
+    if signature is None:
+        requests = memory.waiver_requests
+        if not requests:
+            return "No waiver requests from agents."
+        return "\n".join(["Agents asked to waive these (run `leangate waive <signature> --note ...` to agree):"]
+                         + [f"- {sig}: {why or '(no reason given)'}" for sig, why in requests.items()])
+    if os.environ.get("CLAUDECODE") or os.environ.get("CLAUDE_CODE_ENTRYPOINT"):
+        _fail("waivers must come from a person: run this in your own terminal, not through the agent")
+    memory.reject(signature, note)
+    if local:
+        return f"Waived {signature} on this machine."
+    target = root / WAIVERS
+    try:
+        data = json.loads(target.read_text(encoding="utf-8")) if target.is_file() else {}
+    except ValueError:
+        _fail(f"{target} isn't valid JSON; fix it first (the local waiver was saved)")
+    author = subprocess.run(["git", "-C", str(root), "config", "user.name"], capture_output=True, text=True,
+                            stdin=subprocess.DEVNULL, timeout=10).stdout.strip()
+    data.setdefault("waivers", {})[signature] = {"note": note, "by": author, "date": datetime.date.today().isoformat()}
+    target.parent.mkdir(parents=True, exist_ok=True)
+    target.write_text(json.dumps(data, indent=2, sort_keys=True) + "\n", encoding="utf-8")
+    return f"Waived {signature}. Commit {WAIVERS} so CI and teammates honor it too."
+
+
+def _is_git_repo(repo: str) -> bool:
+    try:
+        return subprocess.run(["git", "-C", repo, "rev-parse", "--git-dir"], capture_output=True,
+                              stdin=subprocess.DEVNULL, timeout=10).returncode == 0
+    except (OSError, subprocess.TimeoutExpired):
+        return False
+
+
+def _fail(message: str) -> None:
+    print(f"leangate: {message}", file=sys.stderr)
+    sys.exit(2)
+
+
+if __name__ == "__main__":
+    main()

leangate/analysis/__init__.py

@@ -0,0 +1,4 @@
+from leangate.analysis.bloat import analyze_file, static_minimize
+from leangate.analysis.deps import added_dependencies
+
+__all__ = ["added_dependencies", "analyze_file", "static_minimize"]