omitnix 0.1.0__tar.gz

omitnix-0.1.0/.gitattributes

@@ -0,0 +1,22 @@
+# Line endings.
+#
+# Without this file, a clone on a machine with core.autocrlf=true gets CRLF in the
+# working tree for every text file. Two things here break when that happens, and both
+# break quietly enough to waste an afternoon:
+#
+#   * .githooks/pre-commit is run by sh. A trailing CR turns the last argument of every
+#     line into something ending in \r, and the error names the wrong thing entirely
+#     ("$'\r': command not found").
+#   * .omitnix/ holds documents this tool writes with LF on every platform, on purpose,
+#     so that the machine which generated them does not show up as a diff. Letting the
+#     checkout put CRLF back means the working tree disagrees with what the tool emits.
+#
+# Fixtures are analyzer input rather than prose: their bytes are the test, so they are
+# pinned too.
+
+* text=auto
+
+*.sh text eol=lf
+.githooks/* text eol=lf
+.omitnix/* text eol=lf
+tests/fixtures/** text eol=lf

omitnix-0.1.0/.githooks/pre-commit

@@ -0,0 +1,21 @@
+#!/usr/bin/env sh
+# secrets-scan layer 2 (per-commit) — non-pnpm path via core.hooksPath = .githooks
+# 設計詳細: docs/local/secrets-scan-design/ (gitignored)
+# Activate with: bash scripts/install-hooks.sh  or  pwsh scripts/install-hooks.ps1
+#
+# 検査を足すときは必ず `|| exit 1` を付ける。付けずに 2 本目を並べると hook の
+# 終了コードが「最後のコマンドの結果」になり、前段の BLOCKED が握り潰される。
+node scripts/secrets-scan.mjs --staged --block || exit 1
+node scripts/check-claude-md.mjs || exit 1
+
+# omitnix の新規ファイル gate。lefthook.yml の pre-commit を実行する。
+# lefthook install は使わない（このファイルを上書きして上の 2 本を消すため）。
+# lefthook が無いときは黙って飛ばさず、ここで止める。検査を静かに省略しないのが
+# このリポジトリの主題そのもの。
+if command -v lefthook >/dev/null 2>&1; then
+	lefthook run pre-commit || exit 1
+else
+	echo "BLOCKED: lefthook が見つかりません。scoop install lefthook（または winget install evilmartians.lefthook）で入れてください。" >&2
+	echo "  この 1 本を飛ばすと、新規ファイルの gate が動かないままコミットされます。" >&2
+	exit 1
+fi

omitnix-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,173 @@
+name: ci
+
+# Lint, tests, and the tool run against its own repository.
+#
+# The OS matrix is the point of this file, not a formality. The tool is developed on
+# Windows only, so ubuntu-latest and macos-latest here are the first and only place its
+# behaviour on those platforms is observed at all. `-latest` is deliberate: the question
+# is whether the current runners work, not whether some pinned production image does --
+# nothing here depends on a system library version.
+#
+# No secrets are used, and none should be added. The tool never connects to a database:
+# schema information, where it is used at all, comes from a JSON snapshot committed by
+# the repository being scanned.
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - develop
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.14'
+
+      # Pinned to the version used locally on 2026-09-08. ruff is not a declared
+      # dependency of the project, so without a pin a new release could fail the build
+      # on a rule nobody chose to adopt.
+      - name: Install ruff
+        run: python -m pip install ruff==0.16.2
+
+      - name: ruff check
+        run: python -m ruff check .
+
+  test:
+    name: test ${{ matrix.os }} py${{ matrix.python-version }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        # The declared floor and the version actually developed against.
+        python-version: ['3.11', '3.14']
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      # --only-binary names the two compiled dependencies, so a missing wheel fails here
+      # instead of being papered over by a source build on whichever runners happen to
+      # have a compiler. That is the thing being tested: `pip install omitnix[php]` has
+      # to work on a machine with no toolchain. The local project itself is not in the
+      # list and still builds normally.
+      - name: Install with every parser, wheels only for the compiled ones
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install --only-binary tree-sitter,tree-sitter-php,tree-sitter-python,tree-sitter-go,tree-sitter-typescript,tree-sitter-javascript,tree-sitter-html -e ".[dev]"
+
+      # Recorded so the log says which parser versions a green run actually covered.
+      - name: Report resolved versions
+        run: python -m pip list
+
+      - name: pytest
+        run: python -m pytest -q
+
+  dogfood:
+    name: dogfood ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.14'
+
+      # Every adapter, because this job asks whether the committed inventory matches a
+      # fresh run: with a grammar missing, the files it covers come back as `unknown`
+      # and the comparison fails for a reason that has nothing to do with the inventory.
+      - name: Install with every parser
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[all]"
+
+      # --check writes nothing and compares the committed documents in .omitnix/ against
+      # a fresh run, so this one step covers both questions: was everything discovered
+      # analyzed (exit 1 if not), and is the committed inventory still current (exit 3 if
+      # not). Run on all three platforms because discovery is where the path handling
+      # lives -- the walk, the glob translation, and the exclusions in .omitnix.yaml are
+      # the parts most likely to behave differently off Windows.
+      #
+      # A failure here means one of: a new file type nobody gave an adapter, or someone
+      # changed the code without regenerating. Both are fixed by running `omitnix` and
+      # committing the result.
+      - name: Check the committed inventory against a fresh run
+        run: python -m omitnix --check
+
+  gate:
+    name: gate
+    runs-on: ubuntu-latest
+    steps:
+      # The gate needs the base commit to exist locally, and a shallow clone does not
+      # have it. It refuses rather than reporting that nothing was added, so getting
+      # this wrong is a red run and not a silent pass -- but a red run for the wrong
+      # reason is still a waste of everyone's morning.
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.14'
+
+      - name: Install with every parser
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[all]"
+
+      # Which commit the branch is measured against. On a pull request it is the base
+      # branch; on a push it is where the branch was before the push.
+      #
+      # `github.event.before` is all zeros for the first push of a new branch, and a
+      # merge-base against that does not exist. The default branch is used instead: on a
+      # brand new branch that is the honest baseline anyway, and asking for slightly too
+      # much is the safe direction for a gate.
+      - name: Decide the baseline
+        id: baseline
+        env:
+          BEFORE: ${{ github.event.before }}
+          BASE_REF: ${{ github.base_ref }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: |
+          if [ -n "$BASE_REF" ]; then
+            echo "ref=origin/$BASE_REF" >> "$GITHUB_OUTPUT"
+          elif [ -n "$BEFORE" ] && [ "$BEFORE" != "0000000000000000000000000000000000000000" ]; then
+            echo "ref=$BEFORE" >> "$GITHUB_OUTPUT"
+          else
+            echo "ref=origin/$DEFAULT_BRANCH" >> "$GITHUB_OUTPUT"
+          fi
+
+      # The reason this job exists. The pre-commit hook asks the working tree what is
+      # new, which only has an answer on the machine that is about to make the commit --
+      # so the hook's coverage is however many people happened to install it. This asks
+      # about a range instead, which holds for work anyone committed.
+      - name: Gate the files this branch added
+        run: python -m omitnix --gate --since "${{ steps.baseline.outputs.ref }}"

omitnix-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,123 @@
+name: publish
+
+# Tag-driven publication to PyPI through Trusted Publishing (OIDC).
+#
+# There is no API token anywhere in this file and none should be added. PyPI is told,
+# once, which repository and which workflow file may publish this project; the token the
+# upload uses is minted for that one run and expires with it. Nothing here can be leaked
+# from a log or a fork, because nothing here is a secret.
+#
+# To release: set the version in pyproject.toml and omitnix/__init__.py, push the commit,
+# then push the tag `vX.Y.Z`. The version guard below refuses the run if the three
+# disagree -- a published version number can never be reused, so a mismatched tag has to
+# fail before the upload, not after.
+#
+# The test job is not a formality either. `ci.yml` runs on pushes to main and on pull
+# requests; a tag push triggers neither, so without this the only thing standing between
+# an untested tree and PyPI would be remembering to look.
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    name: verify the tag and the tree
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.14'
+
+      # The tag is the only one of the three that cannot be corrected after the fact.
+      - name: Refuse a tag that disagrees with the package version
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          pyproject="$(python -c "import tomllib,pathlib;print(tomllib.loads(pathlib.Path('pyproject.toml').read_text())['project']['version'])")"
+          package="$(python -c "import pathlib,re;print(re.search(r'__version__ = \"([^\"]+)\"', pathlib.Path('omitnix/__init__.py').read_text()).group(1))")"
+          echo "tag=$tag pyproject=$pyproject package=$package"
+          if [ "$tag" != "$pyproject" ] || [ "$tag" != "$package" ]; then
+            echo "::error::the tag, pyproject.toml and omitnix/__init__.py must name the same version"
+            exit 1
+          fi
+
+      # Every parser, so that the adapters are exercised rather than reporting unknown.
+      - name: Install the package with every extra
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[dev]"
+
+      - name: Tests
+        run: python -m pytest -q
+
+      - name: The tool against its own repository
+        run: python -m omitnix --check
+
+  build:
+    name: build sdist and wheel
+    needs: verify
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.14'
+
+      - name: Install build tooling
+        run: python -m pip install --upgrade build
+
+      - name: Build distributions
+        run: python -m build
+
+      # hatchling selects files by what git tracks, so an untracked query file would be
+      # missing from the wheel while the build stayed green. The adapter that needs it
+      # then raises AdapterContractError on the user's machine and nowhere else.
+      - name: Refuse a wheel that is missing a query file
+        run: |
+          python - <<'PY'
+          import pathlib, zipfile, sys
+
+          wheel = next(pathlib.Path("dist").glob("*.whl"))
+          shipped = {n for n in zipfile.ZipFile(wheel).namelist() if n.endswith(".scm")}
+          expected = {f"omitnix/queries/{p.name}" for p in pathlib.Path("omitnix/queries").glob("*.scm")}
+          missing = sorted(expected - shipped)
+          if missing:
+              sys.exit(f"{wheel.name} is missing: {', '.join(missing)}")
+          print(f"{wheel.name} ships {len(shipped)} query files")
+          PY
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    name: publish to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write # the OIDC token Trusted Publishing exchanges for an upload
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish via Trusted Publishing
+        uses: pypa/gh-action-pypi-publish@release/v1

omitnix-0.1.0/.github/workflows/secrets-scan.yml

@@ -0,0 +1,40 @@
+name: secrets-scan
+
+# Layer 3 of the kb-driven secrets-scan defense (per docs/local/secrets-scan-design/).
+# Re-runs the same scripts/secrets-scan.mjs as the local husky pre-commit hook (layer 2),
+# acting as the server-side backstop if the hook was bypassed or absent.
+#
+# Note: the CI runner does NOT have access to D:/dev/kb, so kb-derived watchlist
+# matches will be skipped. Only the structural regex (Windows/POSIX absolute paths,
+# RFC1918 private IPs) runs on this side. Layer 2 catches kb-derived leaks locally;
+# layer 4 (release skill) runs against the full kb on the release machine.
+
+on:
+  push:
+    branches:
+      - main
+      - develop
+      - 'hotfix/**'
+      - 'release/**'
+  pull_request:
+    branches:
+      - main
+      - develop
+
+jobs:
+  scan:
+    name: scan tracked files
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Run secrets-scan (structural only on CI; kb not available)
+        run: node scripts/secrets-scan.mjs --all-tracked --block

omitnix-0.1.0/.gitignore

@@ -0,0 +1,94 @@
+# === Python ===
+__pycache__/
+*.py[cod]
+*$py.class
+*.egg-info/
+.eggs/
+*.egg
+build/
+dist/
+.venv/
+venv/
+env/
+
+# === Python テスト・型・lint キャッシュ ===
+.pytest_cache/
+.coverage
+.coverage.*
+htmlcov/
+.tox/
+.mypy_cache/
+.ruff_cache/
+# === OS / エディタ ===
+.DS_Store
+Thumbs.db
+desktop.ini
+.idea/
+.vscode/
+*.swp
+*.swo
+# === ログ・一時・スクラッチ ===
+*.log
+*.jsonl
+*.tmp
+*.bak
+*.orig
+*.rej
+# === AI ツールのローカル状態（トークンを含む可能性あり） ===
+.claude/
+# Cursor Agent CLI にはグローバル指示の口が無いため、共通ルールへのポインタを
+# .cursor/rules に置く運用。ローカル環境固有の内容を含むので追跡しない。
+.cursor/
+.codex-tmp/
+# many-ai-cli が opencode セッション中だけ cwd に書く permission 設定と排他ロック。
+# セッションが kill されると置き去りになる（orchestration 子が書くのは "*": "allow"）。
+# tracked file には gitignore が効かないので、opencode 設定を意図して commit する
+# リポジトリがあってもこの行は影響しない。
+opencode.json*
+# === ツール生成キャッシュ（アカウント ID 等の識別子を含み得る・追跡しない） ===
+.wrangler/
+.vercel/
+.netlify/
+.firebase/
+.turbo/
+.parcel-cache/
+.terraform/
+.serverless/
+**/supabase/.temp/
+# docsweep のローカル state / 旧世代 backup（v0.4+ は no-op だが旧版が生成し得るため常に ignore）
+.docsweep/
+# === ローカル/プライベート追記（fresh public clone から除外） ===
+.env
+.env.*
+!.env.example
+*.local
+*.local.*
+*.local.md
+*.local.json
+# docs/local/ は作業ノート（plan / bugfix / pending / recap）の置き場。
+# public リポでは追跡しない。private リポでのみ tracked にしてよい（後日 grep するため）。
+# 判断軸は「秘匿情報を書くか」ではなく「リポが公開されているか」。
+docs/local/
+scripts/local/
+# === 認証情報・secrets・鍵（public へ絶対に出さない） ===
+*.pem
+*.key
+*.p12
+*.pfx
+*.ppk
+id_rsa
+id_dsa
+id_ecdsa
+id_ed25519
+secrets.*
+*.secret.*
+*credential*
+.netrc
+.npmrc
+.pypirc
+
+# === secrets-scan exception ===
+!scripts/secrets-scan.mjs
+# === obsidian-link: managed ===
+/docs/obsidian/
+# === /obsidian-link: managed ===