patchwork-conventions 0.1.0__tar.gz → 0.1.2__tar.gz

{patchwork_conventions-0.1.0 → patchwork_conventions-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: patchwork-conventions
-Version: 0.1.0
+Version: 0.1.2
 Summary: Mine your codebase. Generate CONVENTIONS.md. Stop AI agents from making up your style.
 Author: patchwork contributors
 License: MIT
@@ -228,20 +228,46 @@ patchwork scan --claude-md
 
 ### Option 3: MCP server
 
-Add to `~/.claude/settings.json`:
+**Claude Code** — add to `~/.claude.json` (or run `claude mcp add` interactively):
 
 ```json
 {
   "mcpServers": {
     "patchwork": {
       "command": "patchwork",
-      "args": ["serve", "--stdio", "/path/to/your/project"]
+      "args": ["serve", "/path/to/your/project", "--stdio"]
     }
   }
 }
 ```
 
-Then Claude Code can use 8 on-demand tools:
+**Claude Desktop** — add to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\Claude\claude_desktop_config.json` (Windows):
+
+```json
+{
+  "mcpServers": {
+    "patchwork": {
+      "command": "patchwork",
+      "args": ["serve", "/path/to/your/project", "--stdio"]
+    }
+  }
+}
+```
+
+**Cursor** — add to `.cursor/mcp.json` in your project root:
+
+```json
+{
+  "mcpServers": {
+    "patchwork": {
+      "command": "patchwork",
+      "args": ["serve", ".", "--stdio"]
+    }
+  }
+}
+```
+
+Then your AI agent can use 8 on-demand tools:
 
 | Tool | When to use |
 |---|---|

{patchwork_conventions-0.1.0 → patchwork_conventions-0.1.2}/README.md

@@ -183,20 +183,46 @@ patchwork scan --claude-md
 
 ### Option 3: MCP server
 
-Add to `~/.claude/settings.json`:
+**Claude Code** — add to `~/.claude.json` (or run `claude mcp add` interactively):
 
 ```json
 {
   "mcpServers": {
     "patchwork": {
       "command": "patchwork",
-      "args": ["serve", "--stdio", "/path/to/your/project"]
+      "args": ["serve", "/path/to/your/project", "--stdio"]
     }
   }
 }
 ```
 
-Then Claude Code can use 8 on-demand tools:
+**Claude Desktop** — add to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\Claude\claude_desktop_config.json` (Windows):
+
+```json
+{
+  "mcpServers": {
+    "patchwork": {
+      "command": "patchwork",
+      "args": ["serve", "/path/to/your/project", "--stdio"]
+    }
+  }
+}
+```
+
+**Cursor** — add to `.cursor/mcp.json` in your project root:
+
+```json
+{
+  "mcpServers": {
+    "patchwork": {
+      "command": "patchwork",
+      "args": ["serve", ".", "--stdio"]
+    }
+  }
+}
+```
+
+Then your AI agent can use 8 on-demand tools:
 
 | Tool | When to use |
 |---|---|

{patchwork_conventions-0.1.0 → patchwork_conventions-0.1.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "patchwork-conventions"
-version = "0.1.0"
+version = "0.1.2"
 description = "Mine your codebase. Generate CONVENTIONS.md. Stop AI agents from making up your style."
 readme = "README.md"
 license = { text = "MIT" }

{patchwork_conventions-0.1.0 → patchwork_conventions-0.1.2}/src/patchwork/cli.py

@@ -111,7 +111,7 @@ def scan(
 
     if claude_md and out_path.exists():
         # Append patchwork section to existing CLAUDE.md
-        existing = out_path.read_text()
+        existing = out_path.read_text(encoding="utf-8")
         marker = "<!-- patchwork:start -->"
         end_marker = "<!-- patchwork:end -->"
         if marker in existing:
@@ -126,7 +126,7 @@ def scan(
         else:
             text = existing.rstrip() + f"\n\n{marker}\n{text}\n{end_marker}\n"
 
-    out_path.write_text(text)
+    out_path.write_text(text, encoding="utf-8")
 
     if not quiet:
         _print_summary(report, out_path)
@@ -145,7 +145,7 @@ def update(path: str, output: str | None) -> None:
     # Load any existing manual annotations
     manual_sections: dict[str, str] = {}
     if out_path.exists():
-        manual_sections = _extract_manual_sections(out_path.read_text())
+        manual_sections = _extract_manual_sections(out_path.read_text(encoding="utf-8"))
 
     opts = ScanOptions(root=root)
     with Progress(SpinnerColumn(), TextColumn("{task.description}"), transient=True) as p:
@@ -158,7 +158,7 @@ def update(path: str, output: str | None) -> None:
     for heading, content in manual_sections.items():
         text += f"\n\n## {heading} (manual)\n\n{content}"
 
-    out_path.write_text(text)
+    out_path.write_text(text, encoding="utf-8")
     console.print(f"[green]✓[/green] Updated [bold]{out_path}[/bold]")
     if manual_sections:
         console.print(f"  Preserved {len(manual_sections)} manual section(s)")
@@ -182,7 +182,7 @@ def diff(path: str) -> None:
         console.print("[yellow]No existing CONVENTIONS.md — run `patchwork scan` first[/yellow]")
         sys.exit(1)
 
-    old_text = out_path.read_text()
+    old_text = out_path.read_text(encoding="utf-8")
     diffs = list(difflib.unified_diff(
         old_text.splitlines(),
         new_text.splitlines(),
@@ -241,7 +241,7 @@ def watch(path: str, interval: float) -> None:
             if changed:
                 last_mtime = current
                 report = do_scan(opts)
-                out_path.write_text(report.to_markdown())
+                out_path.write_text(report.to_markdown(), encoding="utf-8")
                 console.print(f"[green]↺[/green] CONVENTIONS.md updated")
     except KeyboardInterrupt:
         console.print("\n[dim]Stopped[/dim]")

{patchwork_conventions-0.1.0 → patchwork_conventions-0.1.2}/src/patchwork/mcp/server.py

@@ -189,9 +189,34 @@ async def run_server(root: Path, port: int = 3742, stdio: bool = True) -> None:
             ),
         ]
 
+    def _resolve_scan_root(raw_path: str | None) -> Path:
+        """Resolve and validate the scan path.
+
+        Rejects paths that escape the filesystem root or point to sensitive
+        system directories, and normalises symlinks so containment checks
+        are reliable.  The MCP server is a read-only tool, but we still
+        validate inputs at the boundary to follow least-privilege.
+        """
+        candidate = Path(raw_path).resolve() if raw_path else root.resolve()
+
+        # Reject obviously dangerous system paths
+        _BLOCKED = {"/etc", "/proc", "/sys", "/dev", "/private/etc"}
+        for blocked in _BLOCKED:
+            if str(candidate).startswith(blocked):
+                raise ValueError(f"Scanning system path '{candidate}' is not allowed.")
+
+        # Must be an existing directory (not a file or a socket etc.)
+        if not candidate.is_dir():
+            raise ValueError(f"Path '{candidate}' is not a directory.")
+
+        return candidate
+
     @server.call_tool()
     async def call_tool(name: str, arguments: dict) -> list[types.TextContent]:
-        scan_root = Path(arguments.get("path", str(root))).resolve()
+        try:
+            scan_root = _resolve_scan_root(arguments.get("path"))
+        except ValueError as exc:
+            return [types.TextContent(type="text", text=f"Error: {exc}")]
 
         if arguments.get("refresh"):
             _invalidate(scan_root)
@@ -391,7 +416,7 @@ async def run_server(root: Path, port: int = 3742, stdio: bool = True) -> None:
             Route("/sse", endpoint=handle_sse),
             Mount("/messages", app=sse.handle_post_message),
         ])
-        uvicorn.run(app, host="0.0.0.0", port=port)
+        uvicorn.run(app, host="127.0.0.1", port=port)
 
 
 def _check_convention(name: str, kind: str, lang: str, report: ConventionReport) -> str:

{patchwork_conventions-0.1.0 → patchwork_conventions-0.1.2}/src/patchwork/miners/api_patterns.py

@@ -108,12 +108,14 @@ def _detect_apis(paths: list[Path], lang: str) -> APIResult:
     colon_routes = 0
     brace_routes = 0
     angle_routes = 0
-    orm_counts: Counter[str] = Counter()
-    fw_counts: Counter[str] = Counter()
+    # Track per-file hits (not per-match) to avoid false positives from
+    # code that merely mentions framework names in strings, comments, or docs.
+    orm_files: Counter[str] = Counter()
+    fw_files: Counter[str] = Counter()
     async_counts: Counter[str] = Counter()
     http_client_counts: Counter[str] = Counter()
-    has_graphql = False
-    has_grpc = False
+    gql_files = 0
+    grpc_files = 0
 
     for path in paths[:200]:
         try:
@@ -129,32 +131,40 @@ def _detect_apis(paths: list[Path], lang: str) -> APIResult:
         brace_routes += len(_ROUTE_BRACE.findall(text))
         angle_routes += len(_ROUTE_ANGLE.findall(text))
 
-        for orm, patterns in _ORM_SIGNALS.items():
-            for pat in patterns:
-                if re.search(pat, text):
-                    orm_counts[orm] += 1
-                    break
+        # Skip files that are themselves pattern-definition files (e.g. this miner)
+        # to avoid self-matching on our own regex strings.
+        if "_ORM_SIGNALS" in text or "_FRAMEWORK_SIGNALS" in text:
+            continue
+
+        # Count each ORM/framework once per file (not per pattern match)
+        for orm_name, patterns in _ORM_SIGNALS.items():
+            if any(re.search(pat, text) for pat in patterns):
+                orm_files[orm_name] += 1
 
         for fw, patterns in _FRAMEWORK_SIGNALS.items():
-            for pat in patterns:
-                if re.search(pat, text):
-                    fw_counts[fw] += 1
-                    break
+            if any(re.search(pat, text) for pat in patterns):
+                fw_files[fw] += 1
 
         for style, patterns in _ASYNC_SIGNALS.get(lang, {}).items():
-            for pat in patterns:
-                if re.search(pat, text):
-                    async_counts[style] += 1
-                    break
+            if any(re.search(pat, text) for pat in patterns):
+                async_counts[style] += 1
 
         for client in _HTTP_CLIENTS.get(lang, []):
-            if client in text:
+            # Match actual import/usage, not just the string appearing in comments or dicts
+            if re.search(rf'(?:import\s+{re.escape(client)}|from\s+{re.escape(client)}\s|{re.escape(client)}\.)', text):
                 http_client_counts[client] += 1
 
-        if "graphql" in text.lower() or "GraphQL" in text or "gql`" in text:
-            has_graphql = True
-        if "proto" in text.lower() or "grpc" in text.lower() or "protobuf" in text.lower():
-            has_grpc = True
+        if re.search(r'\bgraphql\b|gql`', text, re.IGNORECASE):
+            gql_files += 1
+        if re.search(r'\bgrpc\b|\bprotobuf\b|\.proto["\']', text, re.IGNORECASE):
+            grpc_files += 1
+
+    # Require signal in ≥3 files to filter out false positives.
+    # Single or double-file mentions are often: config files, the tool's own
+    # pattern dictionaries, test fixtures, or README-like docstrings.
+    min_files = 3
+    orm_files = Counter({k: v for k, v in orm_files.items() if v >= min_files})
+    fw_files = Counter({k: v for k, v in fw_files.items() if v >= min_files})
 
     # Response shape
     response_shape = None
@@ -169,27 +179,23 @@ def _detect_apis(paths: list[Path], lang: str) -> APIResult:
     route_total = colon_routes + brace_routes + angle_routes
     route_style = None
     if route_total > 0:
-        if colon_routes == max(colon_routes, brace_routes, angle_routes):
+        best = max(colon_routes, brace_routes, angle_routes)
+        if colon_routes == best:
             route_style = ":id (Express style)"
-        elif brace_routes == max(colon_routes, brace_routes, angle_routes):
+        elif brace_routes == best:
             route_style = "{id} (FastAPI style)"
         else:
             route_style = "<id> (Flask style)"
 
-    async_pattern = async_counts.most_common(1)[0][0] if async_counts else None
-    orm = orm_counts.most_common(1)[0][0] if orm_counts else None
-    http_client = http_client_counts.most_common(1)[0][0] if http_client_counts else None
-    api_frameworks = [fw for fw, _ in fw_counts.most_common(3)]
-
     return APIResult(
         response_shape=response_shape,
         route_param_style=route_style,
-        async_pattern=async_pattern,
-        orm=orm,
-        has_graphql=has_graphql,
-        has_grpc=has_grpc,
-        api_frameworks=api_frameworks,
-        http_client=http_client,
+        async_pattern=async_counts.most_common(1)[0][0] if async_counts else None,
+        orm=orm_files.most_common(1)[0][0] if orm_files else None,
+        has_graphql=gql_files >= 3,
+        has_grpc=grpc_files >= 3,
+        api_frameworks=[fw for fw, _ in fw_files.most_common(3)],
+        http_client=http_client_counts.most_common(1)[0][0] if http_client_counts else None,
     )
 
 

{patchwork_conventions-0.1.0 → patchwork_conventions-0.1.2}/src/patchwork/miners/config_detector.py

@@ -17,6 +17,19 @@ except ImportError:
     except ImportError:
         tomllib = None  # type: ignore
 
+# Hard limit on config file size to prevent DoS from pathologically large files
+_MAX_CONFIG_BYTES = 1 * 1024 * 1024  # 1 MB
+
+
+def _safe_read(path: Path) -> str | None:
+    """Read a config file, returning None if it exceeds the size limit."""
+    try:
+        if path.stat().st_size > _MAX_CONFIG_BYTES:
+            return None
+        return path.read_text(encoding="utf-8", errors="replace")
+    except OSError:
+        return None
+
 
 @dataclass
 class ProjectConfig:
@@ -129,9 +142,12 @@ class ConfigDetector:
         return cfg
 
     def _read_package_json(self, path: Path, cfg: ProjectConfig) -> None:
+        text = _safe_read(path)
+        if text is None:
+            return
         try:
-            data = json.loads(path.read_text())
-        except (json.JSONDecodeError, OSError):
+            data = json.loads(text)
+        except json.JSONDecodeError:
             return
 
         cfg.language = "javascript/typescript"
@@ -179,8 +195,11 @@ class ConfigDetector:
         cfg.language = "python"
         if tomllib is None:
             return
+        text = _safe_read(path)
+        if text is None:
+            return
         try:
-            data = tomllib.loads(path.read_text())
+            data = tomllib.loads(text)
         except Exception:
             return
 
@@ -225,9 +244,8 @@ class ConfigDetector:
     def _read_go_mod(self, path: Path, cfg: ProjectConfig) -> None:
         cfg.language = "go"
         cfg.package_manager = "go"
-        try:
-            text = path.read_text()
-        except OSError:
+        text = _safe_read(path)
+        if text is None:
             return
         m = re.search(r'^module\s+(\S+)', text, re.MULTILINE)
         if m:
@@ -253,8 +271,11 @@ class ConfigDetector:
         cfg.package_manager = "cargo"
         if tomllib is None:
             return
+        text = _safe_read(path)
+        if text is None:
+            return
         try:
-            data = tomllib.loads(path.read_text())
+            data = tomllib.loads(text)
         except Exception:
             return
         pkg = data.get("package", {})

{patchwork_conventions-0.1.0 → patchwork_conventions-0.1.2}/src/patchwork/miners/git_patterns.py

@@ -9,7 +9,7 @@ GitPatternMiner — Mines git history for workflow conventions:
 from __future__ import annotations
 
 import re
-import subprocess
+import subprocess  # nosec B404 — used only for 'git' with a hardcoded arg list, no shell=True
 from collections import Counter, defaultdict
 from dataclasses import dataclass, field
 from pathlib import Path
@@ -40,7 +40,7 @@ _BRANCH_FIX = re.compile(r'^(fix|hotfix|bugfix)/[\w/-]+$')
 
 def _run_git(args: list[str], cwd: Path, max_bytes: int = 500_000) -> str:
     try:
-        result = subprocess.run(
+        result = subprocess.run(  # nosec B603 — list args, no shell=True, cwd is a validated Path
             ["git"] + args,
             cwd=str(cwd),
             capture_output=True,

{patchwork_conventions-0.1.0 → patchwork_conventions-0.1.2}/src/patchwork/miners/imports.py

@@ -29,7 +29,7 @@ class ImportResult:
 
 _PY_RELATIVE = re.compile(r'^\s*from\s+\.', re.MULTILINE)
 _PY_ABSOLUTE = re.compile(r'^\s*(?:import|from)\s+(?!\.)', re.MULTILINE)
-_PY_IMPORT = re.compile(r'^\s*(?:from\s+([\w.]+)\s+import|import\s+([\w.,\s]+))', re.MULTILINE)
+_PY_IMPORT = re.compile(r'^\s*(?:from\s+([\w.]+)\s+import|import\s+([\w]+(?:\s*,\s*[\w]+)*))', re.MULTILINE)
 
 _JS_RELATIVE = re.compile(r"""(?:import|require)\s*\(?['"](\./|\.\./)""", re.MULTILINE)
 _JS_ABSOLUTE_ALIAS = re.compile(r"""(?:import|require)\s*\(?['"](@\w+/|~/)""", re.MULTILINE)
@@ -60,9 +60,12 @@ def _detect_py_imports(paths: list[Path]) -> ImportResult:
         relative_count += len(_PY_RELATIVE.findall(text))
         absolute_count += len(_PY_ABSOLUTE.findall(text))
         for m in _PY_IMPORT.finditer(text):
-            mod = (m.group(1) or m.group(2) or "").strip().split(".")[0]
-            if mod:
-                all_modules.append(mod)
+            raw = (m.group(1) or m.group(2) or "").strip()
+            # group(1) is a dotted module path; group(2) may be 'os, sys, re'
+            for part in raw.split(","):
+                mod = part.strip().split(".")[0]
+                if mod and mod.isidentifier():
+                    all_modules.append(mod)
         # Detect src/ or similar path aliases in pyproject/setup.cfg
         if "@" in text or "from src." in text:
             aliases.add("src/")

{patchwork_conventions-0.1.0 → patchwork_conventions-0.1.2}/src/patchwork/output/report.py

@@ -50,7 +50,7 @@ class ConventionReport:
 
         lines += [
             f"# {filename}",
-            f"> Auto-generated by [patchwork](https://github.com/yourusername/patchwork) on {ts}  ",
+            f"> Auto-generated by [patchwork](https://github.com/SaiNarayana-B/patchwork) on {ts}  ",
             f"> Scanned {self.file_count} files in {self.elapsed:.1f}s",
             f"> **Do not edit manually** — run `patchwork update` to refresh",
             "",

{patchwork_conventions-0.1.0 → patchwork_conventions-0.1.2}/src/patchwork_conventions.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: patchwork-conventions
-Version: 0.1.0
+Version: 0.1.2
 Summary: Mine your codebase. Generate CONVENTIONS.md. Stop AI agents from making up your style.
 Author: patchwork contributors
 License: MIT
@@ -228,20 +228,46 @@ patchwork scan --claude-md
 
 ### Option 3: MCP server
 
-Add to `~/.claude/settings.json`:
+**Claude Code** — add to `~/.claude.json` (or run `claude mcp add` interactively):
 
 ```json
 {
   "mcpServers": {
     "patchwork": {
       "command": "patchwork",
-      "args": ["serve", "--stdio", "/path/to/your/project"]
+      "args": ["serve", "/path/to/your/project", "--stdio"]
     }
   }
 }
 ```
 
-Then Claude Code can use 8 on-demand tools:
+**Claude Desktop** — add to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\Claude\claude_desktop_config.json` (Windows):
+
+```json
+{
+  "mcpServers": {
+    "patchwork": {
+      "command": "patchwork",
+      "args": ["serve", "/path/to/your/project", "--stdio"]
+    }
+  }
+}
+```
+
+**Cursor** — add to `.cursor/mcp.json` in your project root:
+
+```json
+{
+  "mcpServers": {
+    "patchwork": {
+      "command": "patchwork",
+      "args": ["serve", ".", "--stdio"]
+    }
+  }
+}
+```
+
+Then your AI agent can use 8 on-demand tools:
 
 | Tool | When to use |
 |---|---|