maintainability-agent 4.4.0__tar.gz → 4.4.2__tar.gz

{maintainability_agent-4.4.0/src/maintainability_agent.egg-info → maintainability_agent-4.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 4.4.0
+Version: 4.4.2
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -37,7 +37,7 @@ Requires-Dist: mcp<3,>=2; extra == "dev"
 Requires-Dist: PyYAML>=6; extra == "dev"
 Requires-Dist: setuptools>=70; extra == "dev"
 Requires-Dist: lizard>=1.17; extra == "dev"
-Requires-Dist: markdown>=3.5; extra == "dev"
+Requires-Dist: markdown==3.11.1; extra == "dev"
 Dynamic: license-file
 
 # Maintainability Agent
@@ -47,7 +47,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **4.4.0**.
+Version **4.4.2**.
 
 > ## **Calibrated against 201 mature open-source repositories in fifteen languages.**
 >
@@ -488,7 +488,8 @@ and is now the dominant failure in the probe, which is why the count moved. The
 bounded, symlink-refusing write works through a *file descriptor*, so a validated
 path cannot be swapped for a symlink before the write lands — Windows has no
 equivalent and the portable rewrite is the hole. **An unsupported platform never
-buys green by weakening the supported ones.**
+buys green by weakening the supported ones.** Windows is not run in CI at all
+(Decision 18); a Windows user who hits a problem can open an issue or a pull request.
 
 ## Invokable skill / slash command
 
@@ -501,7 +502,11 @@ Copilot Chat:
 maintainability-agent --install-skill        # writes ~/.claude/skills
 ```
 
-Re-run it after every upgrade — a drifted skill teaches agents a dead workflow,
+`maintainability-agent --update` upgrades the install to the newest release —
+never a downgrade — re-syncs the skill, and says when the MCP server needs a
+restart; `maintainability-agent --install-updater` runs it hourly (macOS launch
+agent). Run `--install-skill` by hand after any other upgrade — a drifted skill
+teaches agents a dead workflow,
 so a differing installed copy is refused with the list of differences. Per-host
 install destinations, and `--init-agent-standards` for always-on guidance
 instead of an invokable skill:
@@ -512,7 +517,7 @@ instead of an invokable skill:
 This repo ships `action.yml`, usable as a composite action:
 
 ```yaml
-- uses: marshallguillory86/maintainability-agent@v4.4.0
+- uses: marshallguillory86/maintainability-agent@v4.4.2
   with:
     config: maintainability-agent.json
     changed-only: main...HEAD

{maintainability_agent-4.4.0 → maintainability_agent-4.4.2}/README.md

@@ -5,7 +5,7 @@
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **4.4.0**.
+Version **4.4.2**.
 
 > ## **Calibrated against 201 mature open-source repositories in fifteen languages.**
 >
@@ -446,7 +446,8 @@ and is now the dominant failure in the probe, which is why the count moved. The
 bounded, symlink-refusing write works through a *file descriptor*, so a validated
 path cannot be swapped for a symlink before the write lands — Windows has no
 equivalent and the portable rewrite is the hole. **An unsupported platform never
-buys green by weakening the supported ones.**
+buys green by weakening the supported ones.** Windows is not run in CI at all
+(Decision 18); a Windows user who hits a problem can open an issue or a pull request.
 
 ## Invokable skill / slash command
 
@@ -459,7 +460,11 @@ Copilot Chat:
 maintainability-agent --install-skill        # writes ~/.claude/skills
 ```
 
-Re-run it after every upgrade — a drifted skill teaches agents a dead workflow,
+`maintainability-agent --update` upgrades the install to the newest release —
+never a downgrade — re-syncs the skill, and says when the MCP server needs a
+restart; `maintainability-agent --install-updater` runs it hourly (macOS launch
+agent). Run `--install-skill` by hand after any other upgrade — a drifted skill
+teaches agents a dead workflow,
 so a differing installed copy is refused with the list of differences. Per-host
 install destinations, and `--init-agent-standards` for always-on guidance
 instead of an invokable skill:
@@ -470,7 +475,7 @@ instead of an invokable skill:
 This repo ships `action.yml`, usable as a composite action:
 
 ```yaml
-- uses: marshallguillory86/maintainability-agent@v4.4.0
+- uses: marshallguillory86/maintainability-agent@v4.4.2
   with:
     config: maintainability-agent.json
     changed-only: main...HEAD

{maintainability_agent-4.4.0 → maintainability_agent-4.4.2}/pyproject.toml

@@ -63,7 +63,10 @@ mcp = ["mcp>=2,<3"]
 # ships imports it, and the oracle exists so a measurement can be
 # checked against something other than its author. `markdown` renders the
 # docs/html reading copy (`tools/render_docs.py`); the product never does.
-dev = ["pytest>=8", "pytest-cov>=5", "pytest-xdist>=3.6", "jsonschema>=4", "ruff>=0.5", "pip-audit>=2.7", "mcp>=2,<3", "PyYAML>=6", "setuptools>=70", "lizard>=1.17", "markdown>=3.5"]
+# It is pinned exactly: the committed copy is checked against a fresh render,
+# and markdown 3.11 rendered two pages differently from 3.10, so an unpinned
+# release failed CI on files nobody had touched (2026-10-14).
+dev = ["pytest>=8", "pytest-cov>=5", "pytest-xdist>=3.6", "jsonschema>=4", "ruff>=0.5", "pip-audit>=2.7", "mcp>=2,<3", "PyYAML>=6", "setuptools>=70", "lizard>=1.17", "markdown==3.11.1"]
 
 [tool.pydocstyle]
 # D401 ("First line should be in imperative mood") is switched off, and the

{maintainability_agent-4.4.0 → maintainability_agent-4.4.2/src/maintainability_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 4.4.0
+Version: 4.4.2
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -37,7 +37,7 @@ Requires-Dist: mcp<3,>=2; extra == "dev"
 Requires-Dist: PyYAML>=6; extra == "dev"
 Requires-Dist: setuptools>=70; extra == "dev"
 Requires-Dist: lizard>=1.17; extra == "dev"
-Requires-Dist: markdown>=3.5; extra == "dev"
+Requires-Dist: markdown==3.11.1; extra == "dev"
 Dynamic: license-file
 
 # Maintainability Agent
@@ -47,7 +47,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **4.4.0**.
+Version **4.4.2**.
 
 > ## **Calibrated against 201 mature open-source repositories in fifteen languages.**
 >
@@ -488,7 +488,8 @@ and is now the dominant failure in the probe, which is why the count moved. The
 bounded, symlink-refusing write works through a *file descriptor*, so a validated
 path cannot be swapped for a symlink before the write lands — Windows has no
 equivalent and the portable rewrite is the hole. **An unsupported platform never
-buys green by weakening the supported ones.**
+buys green by weakening the supported ones.** Windows is not run in CI at all
+(Decision 18); a Windows user who hits a problem can open an issue or a pull request.
 
 ## Invokable skill / slash command
 
@@ -501,7 +502,11 @@ Copilot Chat:
 maintainability-agent --install-skill        # writes ~/.claude/skills
 ```
 
-Re-run it after every upgrade — a drifted skill teaches agents a dead workflow,
+`maintainability-agent --update` upgrades the install to the newest release —
+never a downgrade — re-syncs the skill, and says when the MCP server needs a
+restart; `maintainability-agent --install-updater` runs it hourly (macOS launch
+agent). Run `--install-skill` by hand after any other upgrade — a drifted skill
+teaches agents a dead workflow,
 so a differing installed copy is refused with the list of differences. Per-host
 install destinations, and `--init-agent-standards` for always-on guidance
 instead of an invokable skill:
@@ -512,7 +517,7 @@ instead of an invokable skill:
 This repo ships `action.yml`, usable as a composite action:
 
 ```yaml
-- uses: marshallguillory86/maintainability-agent@v4.4.0
+- uses: marshallguillory86/maintainability-agent@v4.4.2
   with:
     config: maintainability-agent.json
     changed-only: main...HEAD

{maintainability_agent-4.4.0 → maintainability_agent-4.4.2}/src/maintainability_agent.egg-info/SOURCES.txt

@@ -104,6 +104,7 @@ src/maintainability_audit/_second_source.py
 src/maintainability_audit/_security_delegate.py
 src/maintainability_audit/_security_work_order.py
 src/maintainability_audit/_selection.py
+src/maintainability_audit/_self_update.py
 src/maintainability_audit/_semantic.py
 src/maintainability_audit/_semantic_policy.py
 src/maintainability_audit/_semantic_ts.py
@@ -182,6 +183,7 @@ tests/test_analyzer_scoring_path.py
 tests/test_analyzer_spread_range.py
 tests/test_analyzer_xml_bounds.py
 tests/test_analyzers_against_the_real_tools.py
+tests/test_analyzers_never_write.py
 tests/test_analyzers_report_what_actually_failed.py
 tests/test_anchor_and_mode.py
 tests/test_anchor_caveat_and_counts_follow_the_run.py
@@ -221,6 +223,7 @@ tests/test_checkstyle_catalog.py
 tests/test_child_sandbox.py
 tests/test_ci_history_recipe.py
 tests/test_ci_installs_the_analyzer_pool.py
+tests/test_ci_runs_once.py
 tests/test_claimed_languages.py
 tests/test_clean_sees_the_weakened_oracle.py
 tests/test_cli.py
@@ -333,6 +336,7 @@ tests/test_kotlin_metrics.py
 tests/test_language_coverage.py
 tests/test_language_support_honesty.py
 tests/test_list_tools_publishes_the_answer_path.py
+tests/test_local_gate.py
 tests/test_maintenance_signals.py
 tests/test_mcp_baseline_payload.py
 tests/test_mcp_format_contract.py
@@ -404,6 +408,7 @@ tests/test_security_findings_keep_their_handoff.py
 tests/test_security_pillar_asserts_a_scanner_set.py
 tests/test_security_pillar_runs_and_shows.py
 tests/test_selection_covers_every_parsed_language.py
+tests/test_self_update.py
 tests/test_semantic_findings_stay_inside_the_audited_files.py
 tests/test_semantic_policy.py
 tests/test_setup_answers_are_the_same_setup.py

{maintainability_agent-4.4.0 → maintainability_agent-4.4.2}/src/maintainability_agent.egg-info/requires.txt

@@ -10,7 +10,7 @@ mcp<3,>=2
 PyYAML>=6
 setuptools>=70
 lizard>=1.17
-markdown>=3.5
+markdown==3.11.1
 
 [mcp]
 mcp<3,>=2

{maintainability_agent-4.4.0 → maintainability_agent-4.4.2}/src/maintainability_audit/__init__.py

@@ -1,3 +1,3 @@
 """Maintainability Audit CI."""
 
-__version__ = "4.4.0"
+__version__ = "4.4.2"

{maintainability_agent-4.4.0 → maintainability_agent-4.4.2}/src/maintainability_audit/_analysis.py

@@ -19,6 +19,7 @@ clean result.
 
 from __future__ import annotations
 
+import hashlib
 from collections.abc import Sequence
 from dataclasses import dataclass, field, replace
 from pathlib import Path
@@ -40,6 +41,7 @@ from ._metrics_types import KNOWN_SOURCE_SUFFIXES, Finding, Measurement
 from ._runner import Outcome, Probe, ToolResult, run
 from ._selection import Selected, select_runnable
 from .config import acquisition_permitted
+from .git_tools import GitCommandFailed, probe_git, run_git
 
 #: Sources outside this package: an analyzer it ran, or a file the
 #: developer's own pipeline wrote (Decision 17). Built-ins are not here.
@@ -356,6 +358,43 @@ def analyze(root: Path, config: dict[str, Any], probe: Probe | None = None) -> A
     return analysis
 
 
+class RepositoryModifiedError(Exception):
+    """An analyzer changed the repository it was auditing.
+
+    The audit never edits source. A tool that writes to the audited tree
+    (ruff honouring a repository's `fix = true` rewrote 102 files of
+    an audited repository on 2026-10-14) fails the audit loudly rather than handing back
+    a grade for code that is no longer what was audited.
+    """
+
+
+def _tracked_state(root: Path) -> dict[str, str] | None:
+    """Each tracked file that differs from HEAD, by a hash of its diff.
+
+    None when `root` is not a git work tree: there is nothing to compare
+    against, so nothing is claimed.
+    """
+    if not probe_git(["rev-parse", "--is-inside-work-tree"], root):
+        return None
+    try:
+        diff = run_git(["diff", "HEAD", "--no-ext-diff", "--binary"], root, strip=False)
+    except GitCommandFailed:
+        return None
+    state: dict[str, str] = {}
+    for block in diff.split("\ndiff --git "):
+        if not block.strip():
+            continue
+        header = block.split("\n", 1)[0].removeprefix("diff --git ")
+        name = header.split(" b/", 1)[-1]
+        state[name] = hashlib.sha256(block.encode("utf-8", "replace")).hexdigest()
+    return state
+
+
+def _changed_paths(before: dict[str, str], after: dict[str, str]) -> list[str]:
+    return sorted(path for path in set(before) | set(after)
+                  if before.get(path) != after.get(path))
+
+
 def _run_one(root: Path, adapter: Any, probe: Probe, timeout: int,
              analysis: Analysis, excludes: Sequence[str] = (),
              inventory: Any = None) -> ToolCoverage:
@@ -371,6 +410,9 @@ def _run_one(root: Path, adapter: Any, probe: Probe, timeout: int,
     """
     try:
         return _attempt(root, adapter, probe, timeout, analysis, excludes, inventory)
+    except RepositoryModifiedError:
+        # Not an adapter defect to record quietly: the audited tree changed.
+        raise
     except Exception as error:  # noqa: BLE001 - the backstop is the point
         return ToolCoverage(
             slug=adapter.slug, outcome="failed", concepts=tuple(adapter.concepts),
@@ -494,12 +536,19 @@ def _run_batches(adapter: Any, root: Path, excludes: Sequence[str],
     invocations = planned(root, excludes) if planned else [adapter.invocation(root, excludes=excludes)]
     results: list[ToolResult] = []
     parsed: list[Extraction] = []
+    before = _tracked_state(root)
     for invocation in invocations:
         result = run(adapter.slug, invocation, timeout_seconds=timeout)
         results.append(result)
         parsed.append(adapter.parse(result))
         if not result.usable:
             break
+    after = _tracked_state(root) if before is not None else None
+    if before is not None and after is not None and after != before:
+        changed = _changed_paths(before, after)
+        raise RepositoryModifiedError(
+            f"{adapter.slug} modified the audited repository: {', '.join(changed)}. "
+            "The audit never edits source; restore these files and report the adapter.")
     if len(results) == 1:
         return results[0], parsed[0]
     return _merged_result(results, len(invocations)), _merged_extraction(parsed)

{maintainability_agent-4.4.0 → maintainability_agent-4.4.2}/src/maintainability_audit/_arguments.py

@@ -212,6 +212,24 @@ def _add_setup_actions(parser: argparse.ArgumentParser) -> None:
              "own without asking, because that is an upgrade. Honours "
              "core.hooksPath.",
     )
+    parser.add_argument(
+        "--update", action="store_true",
+        help="Upgrade this install to the newest release (never a downgrade), "
+             "re-sync the skill, and say when the MCP server needs a restart.",
+    )
+    parser.add_argument(
+        "--install-updater", action="store_true",
+        help="Write the hourly launch agent that runs --update (macOS), "
+             "replacing the legacy one.",
+    )
+    parser.add_argument(
+        "--home", default=None, metavar="DIR",
+        help="With --install-updater: the home directory to write into (default: ~).",
+    )
+    parser.add_argument(
+        "--no-launchctl", action="store_true",
+        help="With --install-updater: write the agent without loading it.",
+    )
     parser.add_argument(
         "--skills-dir", default=None, metavar="DIR",
         help="Where --install-skill writes (default: ~/.claude/skills).",

{maintainability_agent-4.4.0 → maintainability_agent-4.4.2}/src/maintainability_audit/_mcp_refusals.py

@@ -18,6 +18,7 @@ D48.
 
 from __future__ import annotations
 
+from ._analysis import RepositoryModifiedError
 from ._catalog import PolicyError
 from ._mcp_audit import InvalidAuditArgument, PathNotAllowed
 from ._mcp_setup import SetupRequired
@@ -37,6 +38,11 @@ ANTICIPATED_REFUSALS = (
     # type and `PathNotAllowed` both derive from it alongside the
     # internal ones that must stay crashes.
     ConfigUnreadable,
+    # An analyzer changed the audited repository. The message names the
+    # changed files and says to report the adapter: actionable, and a
+    # grade must never be returned for code that is no longer what was
+    # audited.
+    RepositoryModifiedError,
 )
 
 __all__ = ["ANTICIPATED_REFUSALS"]

maintainability_agent-4.4.2/src/maintainability_audit/_self_update.py

@@ -0,0 +1,126 @@
+"""Keep the local install current: ``--update`` and ``--install-updater``.
+
+The updater used to be an untracked script beside the venv, run by a launch
+agent. It trusted PyPI's ``info.version``, which lags a release, and on
+2026-09-22 it *downgraded* 3.7.29 to 3.7.19; it never re-synced the skill the
+README says to sync after every upgrade; and nothing tested it (D230).
+
+Now it is a product command. The installer resolves the version — ``pip
+install --upgrade`` picks the highest release the index lists and never moves
+backwards — so this module holds no HTTP client and reads no release feed
+(P1: analysis touches no network; updating is an operator action, like tool
+acquisition). Every child process goes through ``_runner.run`` (rule 7). A
+version that comes back lower than before is reported, never accepted
+silently; a higher one re-syncs the skill and records that the MCP server,
+which holds the code it loaded at spawn, needs a restart.
+"""
+
+from __future__ import annotations
+
+import plistlib
+import re
+import sys
+from dataclasses import dataclass
+from pathlib import Path
+
+from . import _runner
+
+PACKAGE = "maintainability-agent"
+#: The launch agent, named for the product and the component (reverse DNS of
+#: the project's home), replacing the personal-prefix label it had before.
+LABEL = "io.github.marshallguillory86.maintainability-agent.update"
+LEGACY_LABEL = "com.marshallguillory.maintainability-agent-update"
+_VERSION_CODE = f"import importlib.metadata as m; print(m.version({PACKAGE!r}))"
+
+
+@dataclass(frozen=True)
+class UpdateResult:
+    before: str
+    after: str
+    skill_synced: bool
+    restart_needed: bool
+    error: str | None
+    message: str
+
+
+def _key(version: str) -> tuple:
+    """Release ordering for plain ``N.N.N`` versions; a suffix sorts before
+    the release it precedes (``4.4.1rc1`` < ``4.4.1``)."""
+    parts = []
+    for piece in version.strip().split("."):
+        number = re.match(r"\d+", piece)
+        parts.append((int(number.group()) if number else 0, 1 if number and number.end() == len(piece) else 0))
+    return tuple(parts)
+
+
+def _state_dir(home: Path) -> Path:
+    return home / ".local" / "share" / "maintainability-agent"
+
+
+def _run(argv: list[str]) -> _runner.ToolResult:
+    return _runner.run("self-update", _runner.Invocation(argv=tuple(argv)), timeout_seconds=600)
+
+
+def _installed(python: str) -> str:
+    return (_run([python, "-c", _VERSION_CODE]).stdout or "").strip()
+
+
+def update(python: str, uv: str | None, home: Path) -> UpdateResult:
+    before = _installed(python)
+    if uv:
+        argv = [uv, "pip", "install", "--python", python, "--upgrade", PACKAGE]
+    else:
+        argv = [python, "-m", "pip", "install", "--upgrade", PACKAGE]
+    installed = _run(argv)
+    after = _installed(python)
+    if not installed.usable:
+        return UpdateResult(before, after, False, False, f"install failed: {installed.detail}",
+                            f"Update failed; still on {before}.")
+    if _key(after) < _key(before):
+        return UpdateResult(before, after, False, False,
+                            f"version went down from {before} to {after}",
+                            f"Refused: the install moved {before} to {after}, a downgrade.")
+    if _key(after) == _key(before):
+        return UpdateResult(before, after, False, False, None, f"Already up to date ({after}).")
+    _run([python, "-m", "maintainability_audit", "--install-skill"])
+    state = _state_dir(home)
+    state.mkdir(parents=True, exist_ok=True)
+    (state / ".pending-restart").write_text(after + "\n", encoding="utf-8")
+    return UpdateResult(before, after, True, True, None,
+                        f"Updated {before} -> {after}; skill re-synced. "
+                        "Restart the MCP server to use it (/mcp in Claude Code).")
+
+
+def update_action() -> int:
+    result = update(sys.executable, _runner.locate("uv"), Path.home())
+    print(result.message, file=sys.stderr if result.error else sys.stdout)
+    return 1 if result.error else 0
+
+
+def install_updater(home: Path, *, launchctl: bool = True) -> int:
+    """Write the hourly launch agent that runs ``--update``; remove the
+    legacy one so two updaters never run."""
+    agents = home / "Library" / "LaunchAgents"
+    agents.mkdir(parents=True, exist_ok=True)
+    legacy = agents / f"{LEGACY_LABEL}.plist"
+    if legacy.exists():
+        if launchctl:
+            _run(["launchctl", "unload", str(legacy)])
+        legacy.unlink()
+    state = _state_dir(home)
+    state.mkdir(parents=True, exist_ok=True)
+    plist = agents / f"{LABEL}.plist"
+    plist.write_bytes(plistlib.dumps({
+        "Label": LABEL,
+        "ProgramArguments": [sys.executable, "-m", "maintainability_audit", "--update"],
+        "StartInterval": 3600,
+        "RunAtLoad": True,
+        "ProcessType": "Background",
+        "LowPriorityIO": True,
+        "StandardOutPath": str(state / "update.out.log"),
+        "StandardErrorPath": str(state / "update.err.log"),
+    }))
+    if launchctl:
+        _run(["launchctl", "load", str(plist)])
+    print(f"installed {plist}")
+    return 0

{maintainability_agent-4.4.0 → maintainability_agent-4.4.2}/src/maintainability_audit/_verdict_adapters.py

@@ -117,7 +117,9 @@ class RuffAdapter(BaseAdapter):
             concepts=("style", "complexity", "dead-code"),
             findings_exit_codes=(0, 1), exclude_flag="--exclude",
             exclude_dialect="gitignore",
-            extra_args=("check", "--output-format", "json", "--no-cache"),
+            # --no-fix: a repository's `fix = true` must never turn an audit
+            # into a rewrite (it rewrote 102 files of an audited repository, 2026-10-14).
+            extra_args=("check", "--no-fix", "--output-format", "json", "--no-cache"),
         )
 
     def _read(self, result: ToolResult) -> Extraction:
@@ -169,7 +171,7 @@ class FortitudeAdapter(BaseAdapter):
             concepts=("style", "dead-code"),
             findings_exit_codes=(0, 1), exclude_flag="--exclude",
             exclude_dialect="fnmatch",
-            extra_args=("check", "--output-format", "json"),
+            extra_args=("check", "--no-fix", "--output-format", "json"),
         )
 
     def _read(self, result: ToolResult) -> Extraction:

{maintainability_agent-4.4.0 → maintainability_agent-4.4.2}/src/maintainability_audit/cli.py

@@ -393,6 +393,15 @@ def _action_before_config(
     """
     if args.install_skill:
         return _install_skill_action(args)
+    if args.update:
+        from ._self_update import update_action
+
+        return update_action()
+    if args.install_updater:
+        from ._self_update import install_updater
+
+        home = Path(args.home).expanduser() if args.home else Path.home()
+        return install_updater(home, launchctl=not args.no_launchctl)
     if args.install_precommit_hook:
         from ._precommit_install import install_precommit_hook
 

{maintainability_agent-4.4.0 → maintainability_agent-4.4.2}/tests/test_adapters.py

@@ -17,10 +17,12 @@ A+ one more time.
 from __future__ import annotations
 
 import json
+import subprocess
 from pathlib import Path
 
 import pytest
 
+from maintainability_audit import _analysis
 from maintainability_audit._adapters import BaseAdapter, Extraction, measurements_only
 from maintainability_audit._metrics_types import Measurement
 from maintainability_audit._runner import Outcome, ToolResult
@@ -489,3 +491,55 @@ def test_jscpd_paths_drop_the_embedded_format_tag() -> None:
 
     paths = [f.path for f in adapter.parse(result).findings]
     assert paths == ["docs/api/formik.md", "src/a.ts", "pkgs/v1.2/b.js"]
+
+
+# --- Guards for D229 (an analyzer can never rewrite the audited repository) --
+# Regression guards, not falsifiers: they pass on the code before the fix too,
+# so they live here rather than in the falsifier file D229 cites.
+
+_WRITE_TOKENS = ("--fix", "--write", "--in-place", "-i", "--apply", "--fix-only", "--unsafe-fixes")
+
+
+def _write_guard_argvs(slug, root):
+    names = ("mod.py", "Main.java", "main.f90", "app.js", "lib.c", "x.go", "y.rs", "z.ts")
+    for name in names:
+        (root / name).write_text("x\n", encoding="utf-8")
+    adapter = ADAPTERS[slug]()
+    runs = list(adapter.invocations(root, ()))
+    runs.append(adapter.invocation(root, [str(root / name) for name in names]))
+    return [tuple(run.argv) for run in runs]
+
+
+@pytest.mark.parametrize("slug", sorted(ADAPTERS))
+def test_no_adapter_is_built_to_write(slug, tmp_path):
+    """Covers existing behaviour: no adapter has ever passed a write-enabling flag; D229's
+    rewrite came from repository config, and this keeps a future adapter from adding one."""
+    adapter = ADAPTERS[slug]()
+    for argv in _write_guard_argvs(slug, tmp_path):
+        found = [token for token in argv if token in _WRITE_TOKENS]
+        assert not found, f"{slug} argv carries write-enabling {found}: {argv}"
+    assert not adapter.extra_args or adapter.extra_args[0] != "format", (
+        f"{slug} runs a formatter, which rewrites files")
+
+
+class _QuietProbe(BaseAdapter):
+    def __init__(self):
+        super().__init__(slug="fake", emits="verdict", executable="fake", concepts=("style",))
+
+    def _read(self, result):  # pragma: no cover - parse is not the subject
+        return Extraction()
+
+
+def test_an_analyzer_that_changes_nothing_reports_no_integrity_failure(tmp_path, monkeypatch):
+    """Covers existing behaviour: a clean run raised nothing before D229 either; this holds
+    that the integrity check never turns an unchanged tree into a failure."""
+    for args in (("init", "-q"), ("config", "user.email", "t@example.com"), ("config", "user.name", "t")):
+        subprocess.run(["git", *args], cwd=tmp_path, check=True, capture_output=True)
+    (tmp_path / "mod.py").write_text("import os\n", encoding="utf-8")
+    subprocess.run(["git", "add", "."], cwd=tmp_path, check=True, capture_output=True)
+    subprocess.run(["git", "commit", "-q", "-m", "init"], cwd=tmp_path, check=True, capture_output=True)
+    monkeypatch.setattr(_analysis, "run",
+                        lambda slug, invocation, **kw: ToolResult(slug=slug, outcome=Outcome.RAN,
+                                                                   stdout="[]", exit_code=0))
+    result, _parsed = _analysis._run_batches(_QuietProbe(), tmp_path, (), 60)
+    assert result.outcome == Outcome.RAN