maintainability-agent 3.3.0__tar.gz → 3.4.0__tar.gz

{maintainability_agent-3.3.0/src/maintainability_agent.egg-info → maintainability_agent-3.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 3.3.0
+Version: 3.4.0
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -45,7 +45,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **3.3.0**.
+Version **3.4.0**.
 
 **Planned, not shipped:** the audit tool will become `maintainability-audit`;
 a new `maintainability-agent` companion will run it and automate human-selected

{maintainability_agent-3.3.0 → maintainability_agent-3.4.0}/README.md

@@ -5,7 +5,7 @@
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **3.3.0**.
+Version **3.4.0**.
 
 **Planned, not shipped:** the audit tool will become `maintainability-audit`;
 a new `maintainability-agent` companion will run it and automate human-selected

{maintainability_agent-3.3.0 → maintainability_agent-3.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "maintainability-agent"
-version = "3.3.0"
+version = "3.4.0"
 description = "Maintainability gate and AI remediation prompt generator for CI."
 readme = "README.md"
 # 3.11, not 3.10. `_discovery`, `_pillars` and `_runner` all import

{maintainability_agent-3.3.0 → maintainability_agent-3.4.0/src/maintainability_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 3.3.0
+Version: 3.4.0
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -45,7 +45,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **3.3.0**.
+Version **3.4.0**.
 
 **Planned, not shipped:** the audit tool will become `maintainability-audit`;
 a new `maintainability-agent` companion will run it and automate human-selected

{maintainability_agent-3.3.0 → maintainability_agent-3.4.0}/src/maintainability_audit/__init__.py

@@ -1,3 +1,3 @@
 """Maintainability Audit CI."""
 
-__version__ = "3.3.0"
+__version__ = "3.4.0"

{maintainability_agent-3.3.0 → maintainability_agent-3.4.0}/src/maintainability_audit/config.py

@@ -20,7 +20,7 @@ from ._operator_reads import (
 # still the door every caller comes through.
 __all__ = ["DEFAULT_CONFIG", "DEFAULT_IDIOM_GROUPS", "PROJECT_URL", "VERSION"]
 
-VERSION = "3.3.0"
+VERSION = "3.4.0"
 
 PROJECT_URL = "https://github.com/marshallguillory86/maintainability-agent"
 

{maintainability_agent-3.3.0 → maintainability_agent-3.4.0}/src/maintainability_audit/metrics.py

@@ -27,12 +27,70 @@ from .declarations import DECLARATION_SUFFIXES, detect_functions
 from .source import SourceIndex, index_or_new
 
 
+def _directory_matches(normalized: str, bare: str) -> bool:
+    """Whether a trailing-slash pattern names a directory on this path.
+
+    Matched against each **directory** component and each rooted prefix
+    of them, so `build/` catches `a/b/build/x.o` and
+    `tools/validation/reports/` catches its own file. The final
+    component is excluded: the trailing slash says directory, and
+    `*.egg-info/` must not match a *file* called `notes.egg-info`.
+
+    Globbed through `fnmatch` rather than compared as text, which is the
+    half D156's first fix left undone. `**/dir/` was one spelling of a
+    wider defect: **any** directory pattern holding a glob matched
+    nothing. The literal branch cannot see `*.egg-info/`, `fnmatch` on
+    the whole path needs a trailing slash no path has, and the
+    containment branch is skipped for patterns with glob characters.
+
+    Found by turning the producer's own lesson on this repository. They
+    reported a liveness test that iterated only half its population and
+    called it structural; sweeping MA's 35 configured patterns the same
+    way found `*.egg-info/` matching nothing while
+    `src/maintainability_agent.egg-info/` sat in the tree being scanned.
+    """
+    directories = normalized.split("/")[:-1]
+    for index, component in enumerate(directories):
+        if fnmatch.fnmatch(component, bare):
+            return True
+        if fnmatch.fnmatch("/".join(directories[:index + 1]), bare):
+            return True
+    return normalized == bare
+
+
 def is_excluded(rel: str, patterns: list[str]) -> bool:
     normalized = rel.replace("\\", "/").replace(os.sep, "/")
     for raw_pattern in patterns:
         pattern = raw_pattern.replace("\\", "/")
-        if pattern.endswith("/") and (normalized == pattern[:-1] or normalized.startswith(pattern)):
-            return True
+        # `**/dir/` is the gitignore spelling for "this directory at any
+        # depth", and it matched **nothing** — at any depth, including
+        # the one it names. The directory branch below compares against
+        # the literal prefix, `fnmatch` needs a trailing slash the path
+        # never has, and the containment branch is skipped because the
+        # pattern holds glob characters. So it read as intent, never
+        # errored, and silently scanned what it was written to exclude.
+        #
+        # The bare `dir/` spelling has always matched at any depth via
+        # the containment branch, so the two spellings of one intent
+        # differed by everything. Stripping the prefix makes them agree;
+        # a file pattern like `**/*.min.js` already worked and is
+        # unaffected, because `*` matches a separator here.
+        #
+        # Only the **directory** form. A file pattern like
+        # `**/generated/*.py` already matches through `fnmatch`, where
+        # `*` crosses separators, and stripping its prefix would anchor
+        # it to the root — which this project's own exclude test caught
+        # within a minute of the first attempt.
+        #
+        # Reported by the `secure-code-agent` session, which found the
+        # identical defect in its own matcher — `.pyc` files had been
+        # scanned as source for its entire life (D156).
+        if pattern.startswith("**/") and pattern.endswith("/"):
+            pattern = pattern[3:]
+        if pattern.endswith("/"):
+            if _directory_matches(normalized, pattern[:-1]):
+                return True
+            continue
         if fnmatch.fnmatch(normalized, pattern) or fnmatch.fnmatch(Path(normalized).name, pattern):
             return True
         if not any(char in pattern for char in "*?[]") and f"/{pattern.rstrip('/')}/" in f"/{normalized}/":

{maintainability_agent-3.3.0 → maintainability_agent-3.4.0}/tests/test_operator_named_reads.py

@@ -468,3 +468,131 @@ def test_what_is_validated_is_what_is_read(tmp_path: Path) -> None:
             read_operator_file(target)
     finally:
         target.unlink()
+
+
+def test_both_spellings_of_a_directory_exclude_agree_at_every_depth() -> None:
+    """`**/dir/` and `dir/` are one intent, so they must be one behaviour.
+
+    `**/dir/` matched **nothing** — at any depth, including the one it
+    names. The directory branch compares against the literal prefix,
+    `fnmatch` needs a trailing slash the path never has, and the
+    containment branch is skipped because the pattern holds glob
+    characters. It read as intent, never errored, and silently scanned
+    what it was written to exclude.
+
+    An inert exclude has no symptom of its own. The only sign is
+    findings you believed you had excluded, which is why this is asserted
+    over depths rather than on one example: the bug was uniform, so a
+    single case could have passed against a matcher that only handled
+    the depth it was written at.
+
+    Reported by the `secure-code-agent` session, which found the
+    identical defect in its own matcher (D156).
+    """
+    from maintainability_audit.metrics import is_excluded
+
+    for depth in range(4):
+        prefix = "/".join(f"d{n}" for n in range(depth))
+        path = f"{prefix}/__pycache__/x.pyc" if prefix else "__pycache__/x.pyc"
+        assert is_excluded(path, ["__pycache__/"]), f"bare spelling missed {path}"
+        assert is_excluded(path, ["**/__pycache__/"]), f"**/ spelling missed {path}"
+
+
+def test_the_file_form_of_a_double_star_pattern_still_matches() -> None:
+    """Only the directory form is rewritten; file patterns are untouched.
+
+    The first fix stripped `**/` from every pattern, which anchored
+    `**/generated/*.py` to the repository root and stopped it matching
+    `src/generated/client.py`. `test_exclude_patterns_use_glob_and_normalized_separators`
+    caught it — a file pattern already works through `fnmatch`, where
+    `*` crosses separators, so it needed no help and resented the help
+    it got.
+
+    Covers existing behaviour: this passed at the base, because file
+    patterns were never broken. It guards the fix's blast radius rather
+    than the defect, which is why it is not cited as D156's falsifier.
+    """
+    from maintainability_audit.metrics import is_excluded
+
+    assert is_excluded("src/generated/client.py", ["**/generated/*.py"])
+    assert is_excluded("a/b.min.js", ["**/*.min.js"])
+    assert not is_excluded("src/app.py", ["**/generated/*.py"])
+
+
+def test_a_directory_exclude_does_not_swallow_a_similar_name() -> None:
+    """Widening the matcher must not turn an exclude into a prefix match.
+
+    Covers existing behaviour: the matcher never swallowed a similar
+    name, so this passes at the base. It bounds the fix — a wider
+    matcher could have started excluding `pycache_notes.py` — and bounds
+    are not falsifiers.
+    """
+    from maintainability_audit.metrics import is_excluded
+
+    for pattern in ("__pycache__/", "**/__pycache__/"):
+        assert not is_excluded("src/pycache_notes.py", [pattern])
+        assert not is_excluded("src/my__pycache__helper.py", [pattern])
+        assert not is_excluded("src/app.py", [pattern])
+
+
+def test_a_globbed_directory_pattern_is_not_inert() -> None:
+    """`*.egg-info/` is a directory pattern holding a glob, and it matched
+    nothing.
+
+    D156's first fix handled one spelling — `**/dir/` — and left the
+    class. Any directory pattern with a glob in it fell through all
+    three branches: the literal branch cannot see a `*`, `fnmatch` on
+    the whole path needs a trailing slash no path has, and the
+    containment branch is skipped precisely because the pattern holds
+    glob characters.
+
+    This repository's own config carried `*.egg-info/` while
+    `src/maintainability_agent.egg-info/` sat in the tree being scanned.
+    """
+    from maintainability_audit.metrics import is_excluded
+
+    assert is_excluded("src/maintainability_agent.egg-info/PKG-INFO", ["*.egg-info/"])
+    assert is_excluded("pkg.egg-info/SOURCES.txt", ["*.egg-info/"])
+    # The trailing slash says directory, so a *file* with that suffix stays.
+    assert not is_excluded("src/notes.egg-info", ["*.egg-info/"])
+
+
+def test_every_configured_exclude_pattern_matches_something() -> None:
+    """A liveness sweep over this repository's whole exclude set.
+
+    The `secure-code-agent` session reported a liveness test of its own
+    that iterated only the directory half of its patterns — "half a
+    structural rule, which is the kind that reads as covered". Turning
+    that lesson on MA's config is what found `*.egg-info/` dead.
+
+    Asserted over every pattern rather than a sample, because an inert
+    exclude has no symptom of its own: it never errors, and the only
+    evidence is findings in files the operator believed were excluded.
+
+    Patterns are checked against paths constructed *from the pattern
+    itself*, so this stays true as the config changes and does not
+    depend on which generated artifacts happen to exist today.
+    """
+    import json
+
+    from maintainability_audit.metrics import is_excluded
+
+    patterns = json.loads(
+        (ROOT / "maintainability-agent.json").read_text(encoding="utf-8")
+    )["paths"]["exclude_patterns"]
+    assert patterns, "no exclude patterns configured; this sweep would be vacuous"
+
+    dead = []
+    for pattern in patterns:
+        bare = pattern.replace("**/", "").rstrip("/")
+        if pattern.endswith("/"):
+            probes = [f"{bare}/f.py".replace("*", "x"), f"deep/{bare}/f.py".replace("*", "x")]
+        else:
+            probes = [bare.replace("*", "x"), f"deep/{bare.replace('*', 'x')}"]
+        if not any(is_excluded(probe, [pattern]) for probe in probes):
+            dead.append(pattern)
+
+    assert not dead, (
+        "these configured exclude patterns match nothing and silently scan "
+        f"what they name: {dead}"
+    )