maintainability-agent 4.0.1__tar.gz → 4.2.0__tar.gz

{maintainability_agent-4.0.1/src/maintainability_agent.egg-info → maintainability_agent-4.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 4.0.1
+Version: 4.2.0
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -47,7 +47,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **4.0.1**.
+Version **4.2.0**.
 
 > ## **Calibrated against 201 mature open-source repositories in fifteen languages.**
 >
@@ -56,6 +56,11 @@ Version **4.0.1**.
 > taste, each pinned to the exact commit it was measured at, so anyone can
 > re-run the calibration and get the same numbers. The median of that corpus
 > scores a **B**. [How the corpus is chosen and measured](docs/standard.md#the-reference-corpus).
+>
+> So your grade places your code against those 201: a **B** means you are at
+> the median of mature, widely used open source. The corpus is re-measured
+> whenever the instrument changes — in 4.1.0 every file of even the largest
+> repositories was read, and the scale came back unchanged to four decimals.
 
 **Languages parsed:** Python, Java, Kotlin, C, C++, C#, Go, Rust, PHP, Ruby,
 Swift, Shell, COBOL, Fortran (free-form *and* fixed-form), and the JS/TS/HTML family — each
@@ -93,7 +98,10 @@ you what it could not measure.
 **Install secure-code-agent for the security pillar.** Every audit runs it; it is
 installed alongside rather than as a dependency, so the two tools release
 independently. Without it the report says the security pillar was not measured
-and gives this command. Its scanners decide what it can grade — see
+and gives this command. A full security run can take several minutes on a
+large repository; the audit waits up to 15 minutes for it, and
+`security.timeout_seconds` in `maintainability-agent.json` changes that. Its
+scanners decide what it can grade — see
 [machine setup](docs/machine-setup.md#3-toolchain) for which to install, and
 don't add its `[mcp]` extra to this environment (it pins `mcp<2`).
 
@@ -356,6 +364,11 @@ signals on:
 - an ISO/IEC 25010-inspired 0–5 estimate per category, and a verified grade —
   or a disclosed withholding when the evidence is thin.
 
+**Large repositories are measured whole.** Every file is handed to the
+analyzers, split across as many runs as the command line needs, so a big
+codebase is read rather than sampled — FFmpeg's 4,687 files, not the first
+1,543 that fitted on one command line before 4.1.0.
+
 The analyzer is intentionally conservative and under-reports rather than
 over-reports: an unrecognized declaration costs one missed finding, never a
 cascade of false ones. Pair it with native tools (ESLint, Ruff, Radon, Semgrep,
@@ -496,7 +509,7 @@ instead of an invokable skill:
 This repo ships `action.yml`, usable as a composite action:
 
 ```yaml
-- uses: marshallguillory86/maintainability-agent@v4.0.1
+- uses: marshallguillory86/maintainability-agent@v4.2.0
   with:
     config: maintainability-agent.json
     changed-only: main...HEAD

{maintainability_agent-4.0.1 → maintainability_agent-4.2.0}/README.md

@@ -5,7 +5,7 @@
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **4.0.1**.
+Version **4.2.0**.
 
 > ## **Calibrated against 201 mature open-source repositories in fifteen languages.**
 >
@@ -14,6 +14,11 @@ Version **4.0.1**.
 > taste, each pinned to the exact commit it was measured at, so anyone can
 > re-run the calibration and get the same numbers. The median of that corpus
 > scores a **B**. [How the corpus is chosen and measured](docs/standard.md#the-reference-corpus).
+>
+> So your grade places your code against those 201: a **B** means you are at
+> the median of mature, widely used open source. The corpus is re-measured
+> whenever the instrument changes — in 4.1.0 every file of even the largest
+> repositories was read, and the scale came back unchanged to four decimals.
 
 **Languages parsed:** Python, Java, Kotlin, C, C++, C#, Go, Rust, PHP, Ruby,
 Swift, Shell, COBOL, Fortran (free-form *and* fixed-form), and the JS/TS/HTML family — each
@@ -51,7 +56,10 @@ you what it could not measure.
 **Install secure-code-agent for the security pillar.** Every audit runs it; it is
 installed alongside rather than as a dependency, so the two tools release
 independently. Without it the report says the security pillar was not measured
-and gives this command. Its scanners decide what it can grade — see
+and gives this command. A full security run can take several minutes on a
+large repository; the audit waits up to 15 minutes for it, and
+`security.timeout_seconds` in `maintainability-agent.json` changes that. Its
+scanners decide what it can grade — see
 [machine setup](docs/machine-setup.md#3-toolchain) for which to install, and
 don't add its `[mcp]` extra to this environment (it pins `mcp<2`).
 
@@ -314,6 +322,11 @@ signals on:
 - an ISO/IEC 25010-inspired 0–5 estimate per category, and a verified grade —
   or a disclosed withholding when the evidence is thin.
 
+**Large repositories are measured whole.** Every file is handed to the
+analyzers, split across as many runs as the command line needs, so a big
+codebase is read rather than sampled — FFmpeg's 4,687 files, not the first
+1,543 that fitted on one command line before 4.1.0.
+
 The analyzer is intentionally conservative and under-reports rather than
 over-reports: an unrecognized declaration costs one missed finding, never a
 cascade of false ones. Pair it with native tools (ESLint, Ruff, Radon, Semgrep,
@@ -454,7 +467,7 @@ instead of an invokable skill:
 This repo ships `action.yml`, usable as a composite action:
 
 ```yaml
-- uses: marshallguillory86/maintainability-agent@v4.0.1
+- uses: marshallguillory86/maintainability-agent@v4.2.0
   with:
     config: maintainability-agent.json
     changed-only: main...HEAD

{maintainability_agent-4.0.1 → maintainability_agent-4.2.0/src/maintainability_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 4.0.1
+Version: 4.2.0
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -47,7 +47,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **4.0.1**.
+Version **4.2.0**.
 
 > ## **Calibrated against 201 mature open-source repositories in fifteen languages.**
 >
@@ -56,6 +56,11 @@ Version **4.0.1**.
 > taste, each pinned to the exact commit it was measured at, so anyone can
 > re-run the calibration and get the same numbers. The median of that corpus
 > scores a **B**. [How the corpus is chosen and measured](docs/standard.md#the-reference-corpus).
+>
+> So your grade places your code against those 201: a **B** means you are at
+> the median of mature, widely used open source. The corpus is re-measured
+> whenever the instrument changes — in 4.1.0 every file of even the largest
+> repositories was read, and the scale came back unchanged to four decimals.
 
 **Languages parsed:** Python, Java, Kotlin, C, C++, C#, Go, Rust, PHP, Ruby,
 Swift, Shell, COBOL, Fortran (free-form *and* fixed-form), and the JS/TS/HTML family — each
@@ -93,7 +98,10 @@ you what it could not measure.
 **Install secure-code-agent for the security pillar.** Every audit runs it; it is
 installed alongside rather than as a dependency, so the two tools release
 independently. Without it the report says the security pillar was not measured
-and gives this command. Its scanners decide what it can grade — see
+and gives this command. A full security run can take several minutes on a
+large repository; the audit waits up to 15 minutes for it, and
+`security.timeout_seconds` in `maintainability-agent.json` changes that. Its
+scanners decide what it can grade — see
 [machine setup](docs/machine-setup.md#3-toolchain) for which to install, and
 don't add its `[mcp]` extra to this environment (it pins `mcp<2`).
 
@@ -356,6 +364,11 @@ signals on:
 - an ISO/IEC 25010-inspired 0–5 estimate per category, and a verified grade —
   or a disclosed withholding when the evidence is thin.
 
+**Large repositories are measured whole.** Every file is handed to the
+analyzers, split across as many runs as the command line needs, so a big
+codebase is read rather than sampled — FFmpeg's 4,687 files, not the first
+1,543 that fitted on one command line before 4.1.0.
+
 The analyzer is intentionally conservative and under-reports rather than
 over-reports: an unrecognized declaration costs one missed finding, never a
 cascade of false ones. Pair it with native tools (ESLint, Ruff, Radon, Semgrep,
@@ -496,7 +509,7 @@ instead of an invokable skill:
 This repo ships `action.yml`, usable as a composite action:
 
 ```yaml
-- uses: marshallguillory86/maintainability-agent@v4.0.1
+- uses: marshallguillory86/maintainability-agent@v4.2.0
   with:
     config: maintainability-agent.json
     changed-only: main...HEAD

{maintainability_agent-4.0.1 → maintainability_agent-4.2.0}/src/maintainability_agent.egg-info/SOURCES.txt

@@ -157,6 +157,7 @@ tests/test_a_dangling_source_link_is_named_not_fatal.py
 tests/test_a_format_override_is_disclosed.py
 tests/test_a_matching_format_stays_silent.py
 tests/test_a_published_question_offers_what_it_accepts.py
+tests/test_a_rendered_docs_site_is_not_scored_as_source.py
 tests/test_a_setup_question_keeps_its_contract.py
 tests/test_acquisition_trust.py
 tests/test_adapter_docs.py
@@ -170,6 +171,7 @@ tests/test_analysis_execution.py
 tests/test_analyzer_bridge.py
 tests/test_analyzer_config_isolation.py
 tests/test_analyzer_estimate_claims.py
+tests/test_analyzer_file_lists_are_batched.py
 tests/test_analyzer_pinning.py
 tests/test_analyzer_primary_estimate.py
 tests/test_analyzer_provenance.py
@@ -221,6 +223,7 @@ tests/test_clone_group_class.py
 tests/test_cobol_declarations.py
 tests/test_code_scanning_gets_alerts_not_the_record.py
 tests/test_cognitive_complexity.py
+tests/test_cohesion_with_nothing_to_read_is_not_applicable.py
 tests/test_cohort_statistics.py
 tests/test_concealment_properties.py
 tests/test_config_shape.py
@@ -274,6 +277,7 @@ tests/test_evidence_invariants.py
 tests/test_evidence_normalization.py
 tests/test_evidence_properties.py
 tests/test_example_config_opens_claimed_languages.py
+tests/test_exclude_additional_keeps_the_defaults.py
 tests/test_exclusion_dialects.py
 tests/test_exposure_never_outranks_band.py
 tests/test_falsifier_standard.py
@@ -365,6 +369,7 @@ tests/test_python_declarations.py
 tests/test_read_boundary.py
 tests/test_readme_claims.py
 tests/test_recurrence.py
+tests/test_regular_file_reads_work_without_o_nonblock.py
 tests/test_release_needs_an_empty_ledger.py
 tests/test_release_plan.py
 tests/test_release_plan_status.py
@@ -379,6 +384,7 @@ tests/test_rust_declarations.py
 tests/test_sarif.py
 tests/test_scan_history.py
 tests/test_scan_scope.py
+tests/test_scanner_fingerprint_covers_the_measurement_path.py
 tests/test_scanner_unsafe_direction.py
 tests/test_scanning.py
 tests/test_schema_fidelity.py
@@ -426,6 +432,7 @@ tests/test_the_prompt_keeps_listing_what_it_did_not_withhold.py
 tests/test_the_release_process_describes_itself.py
 tests/test_the_release_record_stays_well_formed.py
 tests/test_the_report_is_saved_not_sent.py
+tests/test_the_security_run_has_a_configurable_limit.py
 tests/test_the_security_work_order_is_drawn.py
 tests/test_the_suite_names_the_program_it_ran.py
 tests/test_the_tree_cannot_redirect_a_read.py

{maintainability_agent-4.0.1 → maintainability_agent-4.2.0}/src/maintainability_audit/__init__.py

@@ -1,3 +1,3 @@
 """Maintainability Audit CI."""
 
-__version__ = "4.0.1"
+__version__ = "4.2.0"

{maintainability_agent-4.0.1 → maintainability_agent-4.2.0}/src/maintainability_audit/_adapters.py

@@ -35,7 +35,7 @@ from pathlib import Path
 from typing import Any, Protocol
 
 from ._metrics_types import Finding, Measurement
-from ._runner import Invocation, ToolResult
+from ._runner import Invocation, ToolResult, batches
 
 
 class Exclusions(tuple):  # noqa: SLOT001 - attribute is set once in __new__
@@ -315,6 +315,22 @@ class BaseAdapter:
             cwd=root if self.exclude_dialect == "rel_regex" else None,
         )
 
+    def target_files(self, root: Path, excludes: Sequence[str] = ()) -> tuple[str, ...] | None:
+        """The explicit files this tool is handed, or None when it walks a directory."""
+        return None
+
+    def invocations(self, root: Path, excludes: Sequence[str] = ()) -> list[Invocation]:
+        """Every run needed to read the whole tree.
+
+        One, for a tool that walks a directory. For a tool handed explicit
+        files, one per batch that fits a command line — the list used to
+        be cut to one argv instead, so the largest trees were read in part.
+        """
+        files = self.target_files(root, excludes)
+        if not files:
+            return [self.invocation(root, excludes=excludes)]
+        return [self.invocation(root, batch, excludes=excludes) for batch in batches(files)]
+
     def parse(self, result: ToolResult) -> Extraction:
         if not result.usable:
             return Extraction(parse_error=result.detail or f"{self.slug} did not run")

{maintainability_agent-4.0.1 → maintainability_agent-4.2.0}/src/maintainability_audit/_analysis.py

@@ -37,7 +37,7 @@ from ._built_ins import BUILT_IN_SOURCES
 from ._catalog import CONCERNS, PolicyError, concepts_for, resolve_pool, settings_from
 from ._discovery import CATALOG_LANGUAGE, discover
 from ._metrics_types import KNOWN_SOURCE_SUFFIXES, Finding, Measurement
-from ._runner import Outcome, Probe, run
+from ._runner import Outcome, Probe, ToolResult, run
 from ._selection import Selected, select_runnable
 from .config import acquisition_permitted
 
@@ -446,12 +446,11 @@ def _attempt(root: Path, adapter: Any, probe: Probe, timeout: int,
             ),
         )
 
-    result = run(adapter.slug, adapter.invocation(root, excludes=excludes),
-                 timeout_seconds=timeout)
+    result, parsed = _run_batches(adapter, root, excludes, timeout)
     # Filtered before the counts are taken, not after. Recording 48
     # measurements and reporting 6 describes an activity rather than a
     # result, which is the defect this project keeps finding.
-    extraction = _ours_only_extraction(adapter.parse(result), root, adapter, excludes, inventory)
+    extraction = _ours_only_extraction(parsed, root, adapter, excludes, inventory)
     # ADR 012: an artifact-read tool states its staleness on the row it
     # ran on, and its findings are labeled when the bytecode is older
     # than the source — the method existing was not the promise
@@ -477,6 +476,49 @@ def _attempt(root: Path, adapter: Any, probe: Probe, timeout: int,
     )
 
 
+def _run_batches(adapter: Any, root: Path, excludes: Sequence[str],
+                 timeout: int) -> tuple[ToolResult, Extraction]:
+    """Every run the adapter needs, each parsed as it finishes, then merged.
+
+    A tool handed explicit files runs once per batch that fits a command
+    line; each is parsed before the next, because some tools rewrite one
+    results file per run. A batch that fails stops the rest and its outcome
+    is the tool's: a partial reading must not pass for a whole one.
+    """
+    planned = getattr(adapter, "invocations", None)
+    invocations = planned(root, excludes) if planned else [adapter.invocation(root, excludes=excludes)]
+    results: list[ToolResult] = []
+    parsed: list[Extraction] = []
+    for invocation in invocations:
+        result = run(adapter.slug, invocation, timeout_seconds=timeout)
+        results.append(result)
+        parsed.append(adapter.parse(result))
+        if not result.usable:
+            break
+    if len(results) == 1:
+        return results[0], parsed[0]
+    return _merged_result(results, len(invocations)), _merged_extraction(parsed)
+
+
+def _merged_result(results: list[ToolResult], planned: int) -> ToolResult:
+    failed = next((r for r in results if not r.usable), None)
+    basis = failed or results[0]
+    detail = (f"batch {len(results)} of {planned} failed: {failed.detail}" if failed
+              else f"read in {planned} batches, one command line each")
+    return replace(basis, detail=detail,
+                   duration_seconds=sum(r.duration_seconds for r in results))
+
+
+def _merged_extraction(parsed: list[Extraction]) -> Extraction:
+    return Extraction(
+        measurements=tuple(m for e in parsed for m in e.measurements),
+        findings=tuple(f for e in parsed for f in e.findings),
+        parse_error=next((e.parse_error for e in parsed if e.parse_error), None),
+        raw="\n".join(e.raw for e in parsed if e.raw),
+        truncated=any(e.truncated for e in parsed),
+    )
+
+
 def _collect(extraction: Extraction, adapter: Any, analysis: Analysis) -> None:
     # `measurements_only` is the enforcement point, not a formality: a
     # verdict emitter that started returning measurements would silently

{maintainability_agent-4.0.1 → maintainability_agent-4.2.0}/src/maintainability_audit/_calibration.py

@@ -219,6 +219,15 @@ CATEGORIES = ["modularity", "reusability", "analyzability", "modifiability", "te
 # moves 52 at the published decimal. Published grades move, so this is a
 # major version, on the same reasoning as 3.0.0. The corpus median still
 # rolls up to exactly 4.0000.
+#
+# **2026-10-03, every file read (4.1.0).** D220: analyzers handed a file
+# list used to be cut to one command line, so the largest repositories were
+# read in part (FFmpeg's multimetric saw 1,543 of 4,687 files). All 201 rows
+# were re-measured with the list split across runs, and with the scanner
+# fingerprint covering the whole measurement path (D221). Ten rows' analyzer
+# readings moved; no built-in reading did. Every reference and CALIBRATION_C
+# re-derived to the same four decimals, and no repository's score moved at
+# the published decimal or changed grade, so the constants stand as shipped.
 DIMENSION_REFERENCES: dict[str, float] = {
     "file_size": 0.0871,
     "declarations": 0.0929,

{maintainability_agent-4.0.1 → maintainability_agent-4.2.0}/src/maintainability_audit/_jvm_adapters.py

@@ -78,14 +78,14 @@ class PmdAdapter(BaseAdapter):
         """
         return bool(expand_files(root, excludes, suffixes=(".java",)))
 
+    def target_files(self, root: Path, excludes: Sequence[str] = ()) -> tuple[str, ...]:
+        return expand_files(root, excludes, suffixes=(".java",))
+
     def invocation(
         self, root: Path, paths: Iterable[str] | None = None,
         excludes: Sequence[str] = (),
     ) -> Invocation:
-        targets = (
-            tuple(paths) if paths
-            else expand_files(root, excludes, suffixes=(".java",))
-        )
+        targets = tuple(paths) if paths else self.target_files(root, excludes)
         dirs: tuple[str, ...] = ()
         for target in targets:
             dirs += ("--dir", target)
@@ -173,14 +173,14 @@ class CheckstyleAdapter(BaseAdapter):
         """Whether any .java file survives the exclusions (never spawn empty)."""
         return bool(expand_files(root, excludes, suffixes=(".java",)))
 
+    def target_files(self, root: Path, excludes: Sequence[str] = ()) -> tuple[str, ...]:
+        return expand_files(root, excludes, suffixes=(".java",))
+
     def invocation(
         self, root: Path, paths: Iterable[str] | None = None,
         excludes: Sequence[str] = (),
     ) -> Invocation:
-        targets = (
-            tuple(paths) if paths
-            else expand_files(root, excludes, suffixes=(".java",))
-        )
+        targets = tuple(paths) if paths else self.target_files(root, excludes)
         return Invocation(
             argv=("checkstyle", "-c", "/google_checks.xml",
                   "-f", "xml", *targets),

{maintainability_agent-4.0.1 → maintainability_agent-4.2.0}/src/maintainability_audit/_metric_adapters.py

@@ -13,8 +13,6 @@ from __future__ import annotations
 import csv
 import io
 import json
-import logging
-import os
 import re
 import tempfile
 from collections.abc import Iterable, Sequence
@@ -31,16 +29,6 @@ def _rows(text: str) -> list[list[str]]:
 
 SOURCE_SUFFIXES = (".py", ".js", ".mjs", ".cjs", ".ts", ".java", ".c", ".cpp",
                    ".h", ".go", ".rb", ".php")
-# A file list has to fit on a command line. The old fixed cap of 400 was
-# arbitrary and silent -- ~20 KB against an ARG_MAX of a megabyte -- so it
-# truncated ordinary trees for no OS reason and said nothing (e88b429 #5).
-# The budget is a quarter of the real ARG_MAX (room left for the exe, flags
-# and env); beyond it a single invocation genuinely cannot name every file,
-# and `expand_files` states the truncation through the logger, not silently.
-_ARG_MAX = os.sysconf("SC_ARG_MAX") if hasattr(os, "sysconf") else 262144
-_ARGV_BYTE_BUDGET = max(_ARG_MAX // 4, 131072)
-
-logger = logging.getLogger(__name__)
 
 
 def expand_files(
@@ -74,22 +62,8 @@ def expand_files(
         and not any(part in skip for part in path.parts)
         and not covers(path.relative_to(root).as_posix())
     ]
-    kept: list[str] = []
-    used = 0
-    for name in eligible:
-        used += len(name.encode("utf-8")) + 1  # +1 for the argv separator
-        if used > _ARGV_BYTE_BUDGET and kept:
-            break
-        kept.append(name)
-    if len(kept) < len(eligible):
-        # Stated, not silent: a shortened file list is a shortened audit,
-        # and the reader has to know the tool saw only part of the tree.
-        logger.warning(
-            "file list for %s truncated to %d of %d files (%d-byte argv budget); "
-            "the remaining %d were not handed to the analyzer",
-            root, len(kept), len(eligible), _ARGV_BYTE_BUDGET, len(eligible) - len(kept),
-        )
-    return tuple(kept)
+    return tuple(eligible)
+
 
 
 
@@ -224,6 +198,9 @@ class ComplexipyAdapter(BaseAdapter):
         )
         self._work = Path(tempfile.mkdtemp(prefix="complexipy-"))
 
+    def target_files(self, root: Path, excludes: Sequence[str] = ()) -> tuple[str, ...]:
+        return expand_files(root.resolve(), excludes)
+
     def invocation(
         self, root: Path, paths: Iterable[str] | None = None,
         excludes: Sequence[str] = (),
@@ -231,7 +208,7 @@ class ComplexipyAdapter(BaseAdapter):
         # complexipy has no exclusion flag, so the filtering is done by
         # naming files rather than handing it a directory. Without this it
         # walks .venv and attributes vendored complexity to the user.
-        targets = tuple(paths) if paths else expand_files(root.resolve(), excludes)
+        targets = tuple(paths) if paths else self.target_files(root, excludes)
         return Invocation(
             argv=(self.executable, *targets, "--output-format", "json", "--quiet"),
             findings_exit_codes=self.findings_exit_codes,
@@ -287,11 +264,14 @@ class MultimetricAdapter(BaseAdapter):
             version_flag="--help", distribution="multimetric",
         )
 
+    def target_files(self, root: Path, excludes: Sequence[str] = ()) -> tuple[str, ...]:
+        return expand_files(root, excludes)
+
     def invocation(
         self, root: Path, paths: Iterable[str] | None = None,
         excludes: Sequence[str] = (),
     ) -> Invocation:
-        targets = tuple(paths) if paths else expand_files(root, excludes)
+        targets = tuple(paths) if paths else self.target_files(root, excludes)
         return Invocation(argv=(self.executable, *targets))
 
     def _read(self, result: ToolResult) -> Extraction:
@@ -347,6 +327,17 @@ class CohesionAdapter(BaseAdapter):
             distribution="cohesion",
         )
 
+    def has_targets(self, root: Path, excludes: Sequence[str] = ()) -> bool:
+        """Whether any .py file survives the exclusions.
+
+        With none, cohesion was spawned with an empty `--files` and exited 2,
+        so every repository without Python recorded it as failed.
+        """
+        return bool(self.target_files(root, excludes))
+
+    def target_files(self, root: Path, excludes: Sequence[str] = ()) -> tuple[str, ...]:
+        return expand_files(root, excludes, suffixes=(".py",))
+
     def invocation(
         self, root: Path, paths: Iterable[str] | None = None,
         excludes: Sequence[str] = (),
@@ -354,7 +345,7 @@ class CohesionAdapter(BaseAdapter):
         # Explicit files: cohesion has no exclude flag, so what it must
         # not read is excluded by never being named — the same rule as
         # complexipy and multimetric.
-        targets = tuple(paths) if paths else expand_files(root, excludes, suffixes=(".py",))
+        targets = tuple(paths) if paths else self.target_files(root, excludes)
         return Invocation(argv=(self.executable, "--files", *targets))
 
     def _read(self, result: ToolResult) -> Extraction:

{maintainability_agent-4.0.1 → maintainability_agent-4.2.0}/src/maintainability_audit/_operator_reads.py

@@ -55,7 +55,9 @@ def open_regular_file(path: Path, why: str) -> int:
     """
     import stat as stat_module
 
-    handle = os.open(path, os.O_RDONLY | os.O_NONBLOCK)
+    # Windows has no `O_NONBLOCK` and no POSIX FIFO in the tree to guard
+    # against; using the flag unconditionally killed every read there.
+    handle = os.open(path, os.O_RDONLY | getattr(os, "O_NONBLOCK", 0))
     if not stat_module.S_ISREG(os.fstat(handle).st_mode):
         os.close(handle)
         raise PathNotAllowed(f"{path} is not a regular file. {why}")

{maintainability_agent-4.0.1 → maintainability_agent-4.2.0}/src/maintainability_audit/_runner.py

@@ -35,6 +35,7 @@ import sys
 import sysconfig
 import tempfile
 import time
+from collections.abc import Sequence
 from contextlib import suppress
 from dataclasses import dataclass, field
 from enum import StrEnum
@@ -63,6 +64,40 @@ class Outcome(StrEnum):
     FAILED = "failed"
 
 
+# A file list has to fit on a command line. The old fixed cap of 400 was
+# arbitrary and silent -- ~20 KB against an ARG_MAX of a megabyte -- so it
+# truncated ordinary trees for no OS reason and said nothing (e88b429 #5).
+# The budget is a quarter of the real ARG_MAX (room left for the exe, flags
+# and env). Beyond it one invocation cannot name every file, so the list is
+# split by `batches` and the tool runs once per batch; nothing is cut. The
+# cut, stated in a log line, left FFmpeg's analyzers reading 1,543 of its
+# 4,687 files in the 4.0.0 corpus run.
+_ARG_MAX = os.sysconf("SC_ARG_MAX") if hasattr(os, "sysconf") else 262144
+_ARGV_BYTE_BUDGET = max(_ARG_MAX // 4, 131072)
+
+
+def batches(files: Sequence[str], budget: int | None = None) -> list[tuple[str, ...]]:
+    """The file list in order, split so each part fits one command line.
+
+    A single name longer than the budget still gets a batch of its own:
+    refusing it would drop a file, which is the defect this replaces.
+    """
+    limit = budget if budget is not None else _ARGV_BYTE_BUDGET
+    out: list[tuple[str, ...]] = []
+    current: list[str] = []
+    used = 0
+    for name in files:
+        size = len(name.encode("utf-8")) + 1  # +1 for the argv separator
+        if current and used + size > limit:
+            out.append(tuple(current))
+            current, used = [], 0
+        current.append(name)
+        used += size
+    if current:
+        out.append(tuple(current))
+    return out
+
+
 @dataclass(frozen=True)
 class Invocation:
     """How to run one tool. Described by adapters, executed only here."""

{maintainability_agent-4.0.1 → maintainability_agent-4.2.0}/src/maintainability_audit/_security_delegate.py

@@ -88,7 +88,29 @@ SUPPORTED_CEILING = (1,)
 REQUIREMENT = "secure-code-agent>=0.12.10,<1"
 
 #: How long the child may run before the pillar is reported as unmeasured.
-DEFAULT_TIMEOUT_SECONDS = 300
+#: 300 until a full run on this repository took about 8½ minutes and both
+#: audits of it reported the pillar unmeasured; 900 is about twice that.
+#: Configurable as `security.timeout_seconds`, through `security_timeout`.
+DEFAULT_TIMEOUT_SECONDS = 900
+
+
+def security_timeout(config: dict[str, Any]) -> int:
+    """The configured limit for the security run, held to the analyzer band.
+
+    A repository naming a number is naming how long this host waits, so it
+    gets the clamp `analyzers.timeout_seconds` has (D40's family): 1 second
+    to 1 hour, and the default for anything that is not an integer.
+    """
+    from ._catalog import MAX_TIMEOUT_SECONDS, MIN_TIMEOUT_SECONDS
+
+    configured = (config.get("security") or {}).get("timeout_seconds", DEFAULT_TIMEOUT_SECONDS)
+    if isinstance(configured, bool):
+        return DEFAULT_TIMEOUT_SECONDS
+    try:
+        seconds = int(configured)
+    except (TypeError, ValueError):
+        return DEFAULT_TIMEOUT_SECONDS
+    return max(MIN_TIMEOUT_SECONDS, min(seconds, MAX_TIMEOUT_SECONDS))
 
 _ENTRY = "import sys; from secure_code_audit.cli import main; sys.exit(main())"
 

{maintainability_agent-4.0.1 → maintainability_agent-4.2.0}/src/maintainability_audit/_verdict_adapters.py

@@ -209,6 +209,9 @@ class PydocstyleAdapter(BaseAdapter):
             exclude_flag="--match-dir", exclude_separator="|", exclude_dialect="files",
         )
 
+    def target_files(self, root: Path, excludes: Sequence[str] = ()) -> tuple[str, ...]:
+        return expand_files(root, excludes, suffixes=(".py",))
+
     def invocation(
         self, root: Path, paths: Iterable[str] | None = None,
         excludes: Sequence[str] = (),
@@ -226,7 +229,7 @@ class PydocstyleAdapter(BaseAdapter):
         an include regex sitting beside an explicit file list can only
         narrow it further in ways nobody asked for.
         """
-        targets = tuple(paths) if paths else expand_files(root, excludes, suffixes=(".py",))
+        targets = tuple(paths) if paths else self.target_files(root, excludes)
         return Invocation(
             argv=(self.executable, *self.extra_args, *targets),
             findings_exit_codes=self.findings_exit_codes,

{maintainability_agent-4.0.1 → maintainability_agent-4.2.0}/src/maintainability_audit/config.py

@@ -161,12 +161,29 @@ def load_config(path: str | None) -> dict[str, Any]:
         return config
     config["analyzers"]["run"] = True
     if user_tier is not None:
-        deep_update(config, user_tier)
+        _merge_tier(config, user_tier)
     if path:
-        deep_update(config, _host_authority_stripped(_configured(Path(path))))
+        _merge_tier(config, _host_authority_stripped(_configured(Path(path))))
     return config
 
 
+def _merge_tier(config: dict[str, Any], tier: dict[str, Any]) -> None:
+    """One tier over the ones before it, with `exclude_additional` appended.
+
+    `deep_update` replaces lists, so setting `paths.exclude_patterns` to add
+    one directory discarded every default exclusion and froze a copy that
+    drifts on the next release (#292). `exclude_additional` adds to whatever
+    the earlier tiers produced instead, so a repository can add without
+    restating.
+    """
+    added = list((tier.get("paths") or {}).get("exclude_additional") or [])
+    deep_update(config, tier)
+    paths = config["paths"]
+    paths.pop("exclude_additional", None)
+    paths["exclude_patterns"] = [*paths["exclude_patterns"],
+                                 *(p for p in added if p not in paths["exclude_patterns"])]
+
+
 #: The one key a repository may state and this tool will not act on,
 #: because acting on it runs a program of the tree's choosing on the host.
 #: The whole leaf is dropped, not merged.