pr-analyzer-cli 0.1.0__tar.gz → 0.1.1__tar.gz

{pr_analyzer_cli-0.1.0 → pr_analyzer_cli-0.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pr-analyzer-cli
-Version: 0.1.0
+Version: 0.1.1
 Summary: Score GitHub pull requests with static analysis, security scanning and an optional LLM review
 License-Expression: MIT
 License-File: LICENSE
@@ -43,6 +43,7 @@ Description-Content-Type: text/markdown
 # PR Analyzer
 
 [![CI](https://github.com/Quantumstringfloops/PRanalyzer/actions/workflows/ci.yml/badge.svg)](https://github.com/Quantumstringfloops/PRanalyzer/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/pr-analyzer-cli)](https://pypi.org/project/pr-analyzer-cli/)
 
 An AI-powered pull request analysis tool that combines static analysis, security scanning, and LLM review into a single CLI command. Point it at any GitHub PR URL and it returns a quality score, a letter grade, line-level suggestions, and an optional GitHub review with inline comments.
 
@@ -124,8 +125,6 @@ Or straight from GitHub, for the latest `main`:
 pip install "pr-analyzer-cli[security] @ git+https://github.com/Quantumstringfloops/PRanalyzer.git#subdirectory=pr-analyzer"
 ```
 
-> Until the first release is on PyPI, use the GitHub line.
-
 `[security]` adds Semgrep and pip-audit. Leave it out for a smaller install, or add `openai` or `anthropic` for those LLM providers, for example `[security,openai]`. `pipx install` works too.
 
 ### 2. Analyse a pull request
@@ -227,11 +226,11 @@ The LLM prompt treats the PR the same way: its title, file names and diff sit be
 The pattern rules read one added line at a time and tell code, string literals and comments apart in Python, JavaScript and TypeScript, and in C-family languages such as Java, Go or Rust (`//`, `/* */`, `"..."` and character literals such as `'"'`). In Python a line holding only a docstring is read like a comment, and in C, C++ and C# so is a line starting with `#`, a preprocessor directive such as `#define`, `#pragma` or `#region`. PHP and other languages are matched as before, anywhere in the line, and a line starting with `#`, `//`, `/*` or `*` counts as a comment:
 
 - Rules about calls and settings (`eval(`, `pickle.load`, `yaml.load`, `subprocess … shell=True`, `debug=True`, `print(`, `console.log`) ignore text inside strings and comments. The code in an f-string's `{...}` or a template literal's `${...}` is checked like any other code, though a format spec such as `:>8` is text. The SQL-injection rule still sees a string being formatted into a query.
-- `todo-comment` counts `TODO` and `FIXME` anywhere but inside a string literal: in comments and docstrings, and on the middle lines of a docstring or a `/* */` comment, but not in `status = "TODO"`.
+- `todo-comment` counts `TODO` and `FIXME` anywhere but inside a string literal: in comments and docstrings, and on the middle lines of a docstring or a `/* */` comment, but not in `status = "TODO"`. Outside PHP and the other languages matched as before, it doesn't count a marker that code uses as a name either: one right after `.` or `::` (`Status.TODO`), `case ` (`case TODO:`), or a name and `(` or `[` (`move(TODO)`, `counts[TODO]`); after `=`, `,` or `{` and at most one space (`status == TODO`, `{ TODO: 1 }`); before `=` or `,` (`TODO = "todo"`, `enum Status { TODO, DONE }`); or before `:` and a string, a number, `{` or `[` (`TODO: "todo",` on a line of its own). A marker followed by `(`, such as Kotlin's `TODO()` or a `TODO(name):` note, always counts, as does every marker in a comment.
 - The secret rules read the whole line, strings and comments included, since that is where secrets end up.
-- `magic-number` skips numbers that are already named or explain themselves: a keyword argument or default value (`timeout=30`), an assignment (`retries = 5`), a dict key or object property (`"port": 8080`, `{ port: 8080 }`), a constant definition (`MAX_SIZE = 10`), a slice or index (`line[:72]`), a line about a version (`sys.version_info >= (3, 11)`), and well-known values: 10, 100 and 1000; 24, 60, 3600 and 86400; powers of two from 16 to 65536, 255 and 65535; ports 80 and 443; and the standard HTTP status codes. Test files are skipped.
+- `magic-number` skips numbers that are already named or explain themselves: a keyword argument or default value (`timeout=30`), an assignment (`retries = 5`), a dict key or object property (`"port": 8080`, `{ port: 8080 }`), a constant definition (`MAX_SIZE = 10`), a slice or index within 120 characters of its `[` (`line[:72]`), a line about a version (`sys.version_info >= (3, 11)`), and well-known values: 10, 100 and 1000; 24, 60, 3600 and 86400; powers of two from 16 to 65536, 255 and 65535; ports 80 and 443; and the standard HTTP status codes. Test files are skipped.
 
-Because each line is read on its own, the middle lines of a multi-line string (a docstring, a template literal) or of a `/* */` comment are read as code unless they start like a comment (`*`, `#`, `//`), and JavaScript regex literals aren't recognised.
+Because each line is read on its own, the middle lines of a multi-line string (a docstring, a template literal) or of a `/* */` comment are read as code unless they start like a comment (`*`, `#`, `//`), and JavaScript regex literals aren't recognised. In a line with more than 20 `{...}` or `${...}` fields nested in one another, everything from the 21st field on is read as code, string text included, so nothing there goes unchecked.
 
 ### Project configuration (`.pr-analyzer.toml`)
 
@@ -261,7 +260,7 @@ The values shown are the defaults. Severities can be written in any case.
 
 **Where it is read from.** When a PR is analysed, `.pr-analyzer.toml` is read from the PR's **base branch** through the GitHub API, never from the PR itself, so a PR can't loosen its own checks; a change to the file takes effect once it is merged, and until then the PR's copy is only checked (see below). A file in the current directory is never picked up (in CI that is the PR's own checkout). `--config PATH` uses a local file instead. No file means the defaults.
 
-**Validation.** Unknown keys, unknown rule ids, bad severities, unsupported `ignore_paths` patterns and thresholds that aren't positive whole numbers make the file invalid. Every problem is named, with a suggestion for likely typos, and what happens next depends on where the file came from:
+**Validation.** Unknown keys, unknown rule ids, bad severities, unsupported `ignore_paths` patterns and thresholds that aren't positive whole numbers make the file invalid. Every problem is named, with a suggestion for likely typos. An integer outside TOML's 64-bit range, or tables or arrays nested more than 100 levels deep, make the file invalid as well, and its keys aren't checked then. What happens next depends on where the file came from:
 
 - **A PR that adds or changes `.pr-analyzer.toml`** has its copy checked, though not applied: each problem is a HIGH finding on the file, with the rule id `config`, so with the default `block_on` the PR is blocked until the file is valid. The check runs whatever `ignore_paths` says; `disable = ["config"]` on the base branch turns it off.
 - **An invalid file on the base branch** doesn't stop the run. The file is ignored, the PR is analysed with the default settings, and a warning names the problems in the report, in the review's notes and on stderr:
@@ -287,7 +286,7 @@ The values shown are the defaults. Severities can be written in any case.
 - A trailing `/` matches directories only, and a pattern that matches a directory covers every file in it.
 - Every other character matches itself, case-sensitively, `#` and spaces included (a `.gitignore` would read a leading `#` as a comment and drop trailing spaces).
 
-Negation (a leading `!`), `[` and `]` (character classes), backslashes (escapes) and `**` inside a name before a `/` (like `foo**/bar`, which git itself reads inconsistently) make the file invalid, rather than silently matching something other than what a `.gitignore` would. The report notes which files were skipped.
+Negation (a leading `!`), `[` and `]` (character classes), backslashes (escapes), a doubled slash (`//`) and `**` inside a name before a `/` (like `foo**/bar`, which git itself reads inconsistently) make the file invalid, rather than silently matching something other than what a `.gitignore` would. The report notes which files were skipped.
 
 **Rule ids.** Each finding's id is in the JSON report (`"rule"`), and the review summary shows it next to each counted rule.
 
@@ -375,7 +374,9 @@ No checkout step is needed: the action reads the PR through the GitHub API and i
 - On `pull_request`, PRs from forks get a read-only token and no secrets, so the review can't be posted; skip them with `if: github.event.pull_request.head.repo.full_name == github.repository` on the job, as this repository's own workflow does.
 - With `llm-provider: ollama`, set `OLLAMA_URL` in the step's `env:`.
 - `config` reads a file from the workspace. If the job checks out the PR, that is the PR's own code, which could loosen its own checks, so prefer the base branch's `.pr-analyzer.toml` unless the file comes from somewhere the PR can't change.
-- pr-analyzer is installed and run outside the workspace, with Python isolated (`-I`), so files in a checked-out PR can't stand in for pip or any other module, a `.env` file in the PR can't change its settings, and the log can't be fed workflow commands by text from the PR.
+- pr-analyzer is installed and run from folders outside the workspace, and the action's own `python` commands run isolated (`-I`), so they never look for modules in the current directory. A `pip.py` or other module in a checked-out PR can't stand in for the real one that way, and a `.env` file in the PR can't change pr-analyzer's settings.
+- Before installing pr-analyzer, and again before running it, the action removes every environment variable from the job whose name starts with `PYTHON`, such as `PYTHONPATH` or `PYTHONHOME`, so none of them reaches any process it starts from then on, pip and the processes pip starts, pr-analyzer, Semgrep and pip-audit among them. A `PYTHONPATH` that points at a checked-out PR can't make them load its files. Other variables that the action doesn't set itself, such as `PATH` or pip's `PIP_*` settings, reach those processes as the job sets them, so don't point them at the PR's files.
+- The log can't be fed workflow commands by text from the PR.
 
 ---
 
@@ -458,7 +459,7 @@ Results that can't change are kept on disk, in `CACHE_DIR`:
 
 Failed requests are never cached, and neither is a file or reply that contains your `GITHUB_TOKEN`, `OPENAI_API_KEY` or `ANTHROPIC_API_KEY`, or any of these: a private key block (PEM, OpenSSH or PGP), a PuTTY key file, or a GitHub, OpenAI or Anthropic (`sk-`), AWS access key ID (`AKIA`, `ASIA`), Slack (`xox?-`), Stripe live (`sk_live_`, `rk_live_`), Google API (`AIza`), GitLab (`glpat-`) or Hugging Face (`hf_`) token. Other secrets, such as an AWS secret access key on its own or a password in a database URL, aren't recognised and can be cached. A damaged entry counts as a miss, entries are written atomically, and the size and age limits are applied at most once an hour. `--no-cache` skips the cache for one run (for a fresh LLM review, say); `CACHE_ENABLED=false` turns it off.
 
-Since the cache may hold code from private repositories, pr-analyzer creates its directory private to your user (mode 700). It uses an existing `CACHE_DIR`, and the `v1` folder in it, only if each is a real directory (not a symbolic link) that belongs to you: one that other users can open too is made private, and anything else turns the cache off for the run, with a warning. Entries are read only from your own files, never through a symbolic link, and pruning deletes nothing but the cache's own entry and temporary files. On Windows, which has no POSIX owners or modes, only symbolic links are refused.
+Since the cache may hold code from private repositories, pr-analyzer creates its directory private to your user (mode 700). It uses an existing `CACHE_DIR`, and the `v1` folder in it, only if each is a real directory (not a symbolic link) that belongs to you: one that other users can open too is made private, and anything else turns the cache off for the run, with a warning. Until then, someone else could have planted, linked or swapped entries in it, so once either folder has been made private, the cache's own files already in `v1` (entries, temporary files and `.last-prune`) are deleted before any is used, with a warning if any were. The folders in `v1` that an entry is read from or written to must be real directories that belong to you too, or the cache is off for the run, with a warning. Entries are read only from your own regular files that have no other hard link, never through a symbolic link; pruning deletes nothing but the cache's own entry and temporary files, and replaces `.last-prune` rather than writing through a symbolic link put in its place. On Windows, which has no POSIX owners or modes, owners aren't checked and nothing is made private.
 
 To keep the cache between GitHub Actions runs, restore and save it with `actions/cache`. A saved cache can't be updated, so each run saves a new one and the next run restores the newest:
 

{pr_analyzer_cli-0.1.0 → pr_analyzer_cli-0.1.1}/README.md

@@ -1,6 +1,7 @@
 # PR Analyzer
 
 [![CI](https://github.com/Quantumstringfloops/PRanalyzer/actions/workflows/ci.yml/badge.svg)](https://github.com/Quantumstringfloops/PRanalyzer/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/pr-analyzer-cli)](https://pypi.org/project/pr-analyzer-cli/)
 
 An AI-powered pull request analysis tool that combines static analysis, security scanning, and LLM review into a single CLI command. Point it at any GitHub PR URL and it returns a quality score, a letter grade, line-level suggestions, and an optional GitHub review with inline comments.
 
@@ -82,8 +83,6 @@ Or straight from GitHub, for the latest `main`:
 pip install "pr-analyzer-cli[security] @ git+https://github.com/Quantumstringfloops/PRanalyzer.git#subdirectory=pr-analyzer"
 ```
 
-> Until the first release is on PyPI, use the GitHub line.
-
 `[security]` adds Semgrep and pip-audit. Leave it out for a smaller install, or add `openai` or `anthropic` for those LLM providers, for example `[security,openai]`. `pipx install` works too.
 
 ### 2. Analyse a pull request
@@ -185,11 +184,11 @@ The LLM prompt treats the PR the same way: its title, file names and diff sit be
 The pattern rules read one added line at a time and tell code, string literals and comments apart in Python, JavaScript and TypeScript, and in C-family languages such as Java, Go or Rust (`//`, `/* */`, `"..."` and character literals such as `'"'`). In Python a line holding only a docstring is read like a comment, and in C, C++ and C# so is a line starting with `#`, a preprocessor directive such as `#define`, `#pragma` or `#region`. PHP and other languages are matched as before, anywhere in the line, and a line starting with `#`, `//`, `/*` or `*` counts as a comment:
 
 - Rules about calls and settings (`eval(`, `pickle.load`, `yaml.load`, `subprocess … shell=True`, `debug=True`, `print(`, `console.log`) ignore text inside strings and comments. The code in an f-string's `{...}` or a template literal's `${...}` is checked like any other code, though a format spec such as `:>8` is text. The SQL-injection rule still sees a string being formatted into a query.
-- `todo-comment` counts `TODO` and `FIXME` anywhere but inside a string literal: in comments and docstrings, and on the middle lines of a docstring or a `/* */` comment, but not in `status = "TODO"`.
+- `todo-comment` counts `TODO` and `FIXME` anywhere but inside a string literal: in comments and docstrings, and on the middle lines of a docstring or a `/* */` comment, but not in `status = "TODO"`. Outside PHP and the other languages matched as before, it doesn't count a marker that code uses as a name either: one right after `.` or `::` (`Status.TODO`), `case ` (`case TODO:`), or a name and `(` or `[` (`move(TODO)`, `counts[TODO]`); after `=`, `,` or `{` and at most one space (`status == TODO`, `{ TODO: 1 }`); before `=` or `,` (`TODO = "todo"`, `enum Status { TODO, DONE }`); or before `:` and a string, a number, `{` or `[` (`TODO: "todo",` on a line of its own). A marker followed by `(`, such as Kotlin's `TODO()` or a `TODO(name):` note, always counts, as does every marker in a comment.
 - The secret rules read the whole line, strings and comments included, since that is where secrets end up.
-- `magic-number` skips numbers that are already named or explain themselves: a keyword argument or default value (`timeout=30`), an assignment (`retries = 5`), a dict key or object property (`"port": 8080`, `{ port: 8080 }`), a constant definition (`MAX_SIZE = 10`), a slice or index (`line[:72]`), a line about a version (`sys.version_info >= (3, 11)`), and well-known values: 10, 100 and 1000; 24, 60, 3600 and 86400; powers of two from 16 to 65536, 255 and 65535; ports 80 and 443; and the standard HTTP status codes. Test files are skipped.
+- `magic-number` skips numbers that are already named or explain themselves: a keyword argument or default value (`timeout=30`), an assignment (`retries = 5`), a dict key or object property (`"port": 8080`, `{ port: 8080 }`), a constant definition (`MAX_SIZE = 10`), a slice or index within 120 characters of its `[` (`line[:72]`), a line about a version (`sys.version_info >= (3, 11)`), and well-known values: 10, 100 and 1000; 24, 60, 3600 and 86400; powers of two from 16 to 65536, 255 and 65535; ports 80 and 443; and the standard HTTP status codes. Test files are skipped.
 
-Because each line is read on its own, the middle lines of a multi-line string (a docstring, a template literal) or of a `/* */` comment are read as code unless they start like a comment (`*`, `#`, `//`), and JavaScript regex literals aren't recognised.
+Because each line is read on its own, the middle lines of a multi-line string (a docstring, a template literal) or of a `/* */` comment are read as code unless they start like a comment (`*`, `#`, `//`), and JavaScript regex literals aren't recognised. In a line with more than 20 `{...}` or `${...}` fields nested in one another, everything from the 21st field on is read as code, string text included, so nothing there goes unchecked.
 
 ### Project configuration (`.pr-analyzer.toml`)
 
@@ -219,7 +218,7 @@ The values shown are the defaults. Severities can be written in any case.
 
 **Where it is read from.** When a PR is analysed, `.pr-analyzer.toml` is read from the PR's **base branch** through the GitHub API, never from the PR itself, so a PR can't loosen its own checks; a change to the file takes effect once it is merged, and until then the PR's copy is only checked (see below). A file in the current directory is never picked up (in CI that is the PR's own checkout). `--config PATH` uses a local file instead. No file means the defaults.
 
-**Validation.** Unknown keys, unknown rule ids, bad severities, unsupported `ignore_paths` patterns and thresholds that aren't positive whole numbers make the file invalid. Every problem is named, with a suggestion for likely typos, and what happens next depends on where the file came from:
+**Validation.** Unknown keys, unknown rule ids, bad severities, unsupported `ignore_paths` patterns and thresholds that aren't positive whole numbers make the file invalid. Every problem is named, with a suggestion for likely typos. An integer outside TOML's 64-bit range, or tables or arrays nested more than 100 levels deep, make the file invalid as well, and its keys aren't checked then. What happens next depends on where the file came from:
 
 - **A PR that adds or changes `.pr-analyzer.toml`** has its copy checked, though not applied: each problem is a HIGH finding on the file, with the rule id `config`, so with the default `block_on` the PR is blocked until the file is valid. The check runs whatever `ignore_paths` says; `disable = ["config"]` on the base branch turns it off.
 - **An invalid file on the base branch** doesn't stop the run. The file is ignored, the PR is analysed with the default settings, and a warning names the problems in the report, in the review's notes and on stderr:
@@ -245,7 +244,7 @@ The values shown are the defaults. Severities can be written in any case.
 - A trailing `/` matches directories only, and a pattern that matches a directory covers every file in it.
 - Every other character matches itself, case-sensitively, `#` and spaces included (a `.gitignore` would read a leading `#` as a comment and drop trailing spaces).
 
-Negation (a leading `!`), `[` and `]` (character classes), backslashes (escapes) and `**` inside a name before a `/` (like `foo**/bar`, which git itself reads inconsistently) make the file invalid, rather than silently matching something other than what a `.gitignore` would. The report notes which files were skipped.
+Negation (a leading `!`), `[` and `]` (character classes), backslashes (escapes), a doubled slash (`//`) and `**` inside a name before a `/` (like `foo**/bar`, which git itself reads inconsistently) make the file invalid, rather than silently matching something other than what a `.gitignore` would. The report notes which files were skipped.
 
 **Rule ids.** Each finding's id is in the JSON report (`"rule"`), and the review summary shows it next to each counted rule.
 
@@ -333,7 +332,9 @@ No checkout step is needed: the action reads the PR through the GitHub API and i
 - On `pull_request`, PRs from forks get a read-only token and no secrets, so the review can't be posted; skip them with `if: github.event.pull_request.head.repo.full_name == github.repository` on the job, as this repository's own workflow does.
 - With `llm-provider: ollama`, set `OLLAMA_URL` in the step's `env:`.
 - `config` reads a file from the workspace. If the job checks out the PR, that is the PR's own code, which could loosen its own checks, so prefer the base branch's `.pr-analyzer.toml` unless the file comes from somewhere the PR can't change.
-- pr-analyzer is installed and run outside the workspace, with Python isolated (`-I`), so files in a checked-out PR can't stand in for pip or any other module, a `.env` file in the PR can't change its settings, and the log can't be fed workflow commands by text from the PR.
+- pr-analyzer is installed and run from folders outside the workspace, and the action's own `python` commands run isolated (`-I`), so they never look for modules in the current directory. A `pip.py` or other module in a checked-out PR can't stand in for the real one that way, and a `.env` file in the PR can't change pr-analyzer's settings.
+- Before installing pr-analyzer, and again before running it, the action removes every environment variable from the job whose name starts with `PYTHON`, such as `PYTHONPATH` or `PYTHONHOME`, so none of them reaches any process it starts from then on, pip and the processes pip starts, pr-analyzer, Semgrep and pip-audit among them. A `PYTHONPATH` that points at a checked-out PR can't make them load its files. Other variables that the action doesn't set itself, such as `PATH` or pip's `PIP_*` settings, reach those processes as the job sets them, so don't point them at the PR's files.
+- The log can't be fed workflow commands by text from the PR.
 
 ---
 
@@ -416,7 +417,7 @@ Results that can't change are kept on disk, in `CACHE_DIR`:
 
 Failed requests are never cached, and neither is a file or reply that contains your `GITHUB_TOKEN`, `OPENAI_API_KEY` or `ANTHROPIC_API_KEY`, or any of these: a private key block (PEM, OpenSSH or PGP), a PuTTY key file, or a GitHub, OpenAI or Anthropic (`sk-`), AWS access key ID (`AKIA`, `ASIA`), Slack (`xox?-`), Stripe live (`sk_live_`, `rk_live_`), Google API (`AIza`), GitLab (`glpat-`) or Hugging Face (`hf_`) token. Other secrets, such as an AWS secret access key on its own or a password in a database URL, aren't recognised and can be cached. A damaged entry counts as a miss, entries are written atomically, and the size and age limits are applied at most once an hour. `--no-cache` skips the cache for one run (for a fresh LLM review, say); `CACHE_ENABLED=false` turns it off.
 
-Since the cache may hold code from private repositories, pr-analyzer creates its directory private to your user (mode 700). It uses an existing `CACHE_DIR`, and the `v1` folder in it, only if each is a real directory (not a symbolic link) that belongs to you: one that other users can open too is made private, and anything else turns the cache off for the run, with a warning. Entries are read only from your own files, never through a symbolic link, and pruning deletes nothing but the cache's own entry and temporary files. On Windows, which has no POSIX owners or modes, only symbolic links are refused.
+Since the cache may hold code from private repositories, pr-analyzer creates its directory private to your user (mode 700). It uses an existing `CACHE_DIR`, and the `v1` folder in it, only if each is a real directory (not a symbolic link) that belongs to you: one that other users can open too is made private, and anything else turns the cache off for the run, with a warning. Until then, someone else could have planted, linked or swapped entries in it, so once either folder has been made private, the cache's own files already in `v1` (entries, temporary files and `.last-prune`) are deleted before any is used, with a warning if any were. The folders in `v1` that an entry is read from or written to must be real directories that belong to you too, or the cache is off for the run, with a warning. Entries are read only from your own regular files that have no other hard link, never through a symbolic link; pruning deletes nothing but the cache's own entry and temporary files, and replaces `.last-prune` rather than writing through a symbolic link put in its place. On Windows, which has no POSIX owners or modes, owners aren't checked and nothing is made private.
 
 To keep the cache between GitHub Actions runs, restore and save it with `actions/cache`. A saved cache can't be updated, so each run saves a new one and the next run restores the newest:
 

{pr_analyzer_cli-0.1.0 → pr_analyzer_cli-0.1.1}/pyproject.toml

@@ -3,7 +3,7 @@
 # name that only differs from it in case, punctuation or l/i/o lookalikes (so "pranalyzer" too).
 # The command stays `pr-analyzer` and the import package `pr_analyzer`.
 name = "pr-analyzer-cli"
-version = "0.1.0"
+version = "0.1.1"
 description = "Score GitHub pull requests with static analysis, security scanning and an optional LLM review"
 authors = [{ name = "Neil Mathew" }]
 license = "MIT"

{pr_analyzer_cli-0.1.0 → pr_analyzer_cli-0.1.1}/src/pr_analyzer/analyzer/ast_analyzer.py

@@ -79,20 +79,41 @@ def explained_number(code: str, match: re.Match[str]) -> bool:
     )
 
 
+# A to-do marker in code can be a name, such as a task status, rather than a note. It is one
+# right after "." or "::" (a member), "case " (a case label), or a name and "(" or "[" (an argument
+# or an index); after "=", "," or "{" and at most one space (a value, an item or a key); before
+# "=" or "," (assigned, compared or an item); or before ":" and a string, a number, "{" or "["
+# (a key on a line of its own). NAME_BEFORE is all lookbehinds: no text before a marker is read.
+NAME_BEFORE = re.compile(r"(?<=\.)|(?<=::)|(?<=\bcase\s)|(?<=\w[(\[])|(?<=[=,{])|(?<=[=,{]\s)")
+NAME_AFTER = re.compile(r"\s*(?:[=,]|:\s*[\"'`\d{\[])")
+
+
+def used_as_name(code: str, match: re.Match[str]) -> bool:
+    """A to-do marker that names something in code. One followed by "(" always counts as a
+    marker: it calls Kotlin's function for unfinished code, or starts a note naming its owner."""
+    start, end = match.span()
+    if code.startswith("(", end):
+        return False
+    return NAME_BEFORE.match(code, start) is not None or NAME_AFTER.match(code, end) is not None
+
+
 # Each rule runs on one added line at a time (the text after the leading "+"). Its "id" is the
 # stable name .pr-analyzer.toml uses to switch it off. Its "scope" picks the views of the line it
 # reads (see line_lexer): "code" leaves out comments and the contents of strings, "code+comments"
-# only the contents of strings. An optional "exempt" callable can wave off individual matches.
-# Hardcoded secrets are not checked here: the security scanner owns them, and checking them in
-# both places used to penalise the same line twice.
+# only the contents of strings. An optional "skip_if" regex skips a line and an optional "exempt"
+# callable waves off individual matches; both look at code only, as every match in a comment
+# counts. Hardcoded secrets are not checked here: the security scanner owns them, and checking
+# them in both places used to penalise the same line twice.
 PATTERNS: list[dict[str, Any]] = [
     {
         "id": "todo-comment",
         "regex": re.compile(r"\b(TODO|FIXME)\b"),
         "extensions": CODE_EXTENSIONS,
         # In a string the marker is data, such as a status value, not a note to the team. The
-        # middle lines of a docstring or a /* */ comment read as code, so code counts too.
+        # middle lines of a docstring or a /* */ comment read as code, so code counts too, apart
+        # from a marker that code uses as a name.
         "scope": "code+comments",
+        "exempt": used_as_name,
         "severity": "LOW",
         "category": "style",
         "title": "TODO/FIXME comment added",
@@ -306,8 +327,9 @@ def patterns_for(filename: str, disabled: Collection[str] = ()) -> list[dict[str
 
 
 def line_matches(pattern: dict[str, Any], parts: LineParts) -> bool:
-    views = (parts.code, parts.comments) if pattern["scope"] == "code+comments" else (parts.code,)
-    return any(view_matches(pattern, view) for view in views)
+    if pattern["scope"] == "code+comments" and pattern["regex"].search(parts.comments):
+        return True   # skip_if and exempt are about code: in a comment every match counts
+    return view_matches(pattern, parts.code)
 
 
 def view_matches(pattern: dict[str, Any], text: str) -> bool:

{pr_analyzer_cli-0.1.0 → pr_analyzer_cli-0.1.1}/src/pr_analyzer/analyzer/line_lexer.py

@@ -13,6 +13,7 @@ In the code view a string keeps its quotes and prefix but its contents become sp
 SQL-injection rule, still see it. The replacement fields of an f-string or a template literal are
 code, so they stay; only the text around them, and a format spec, is blanked
 (`f"id {run(x):>8}"` -> `f"   {run(x)    }"`, `` `a ${run(b)}` `` -> `` `  ${run(b)}` ``).
+Past MAX_NESTING fields nested in one another, the rest of the line is kept as code, text and all.
 
 Python, JavaScript/TypeScript and C-family files are lexed; for any other language both views are
 the whole line, which is how every rule matched before. Some lines are comments as a whole: a line
@@ -33,7 +34,8 @@ from dataclasses import dataclass, field, replace
 
 COMMENT_PREFIXES = ("#", "//", "/*", "*")
 # replacement fields nested deeper than this (never seen in real code) end the lexing of a line,
-# so a crafted line can't exhaust the recursion limit
+# so a crafted line can't exhaust the recursion limit. The rest of the line is kept as code, so
+# nothing in it, such as a call after the string, goes unchecked.
 MAX_NESTING = 20
 
 _STRING = r'"(?:\\(?:.|$)|[^"\\])*(?:"|$)'          # an unclosed string runs to the end of the line
@@ -44,7 +46,6 @@ _BLOCK_COMMENT = r"/\*.*?(?:\*/|$)"
 _BRACKETS = r"|(?P<open>[(\[{])|(?P<close>[)\]}])"
 # a format spec is text up to the end of its field, apart from the fields nested in it
 _FORMAT_SPEC = re.compile(r"[^{}]*")
-_REST_OF_LINE = re.compile(r".*")
 
 
 @dataclass(frozen=True)
@@ -227,8 +228,9 @@ class _Lexer:
     def lex_field(self, pos: int) -> int:
         """Lex a replacement field from just after its opener: its code, then in Python its
         format spec, up to and including the closing brace. Returns where the field ends."""
-        if self.nesting == MAX_NESTING:   # the rest of the line counts as text
-            return self.skip_text(_REST_OF_LINE, pos)
+        if self.nesting == MAX_NESTING:   # the rest of the line counts as code, hiding nothing
+            self.keep_code(self.text[pos:])
+            return len(self.text)
         self.nesting += 1
         pos = self.lex_code(pos, in_field=True)
         if self.text.startswith(":", pos):

{pr_analyzer_cli-0.1.0 → pr_analyzer_cli-0.1.1}/src/pr_analyzer/cache.py

@@ -11,13 +11,18 @@ an entry that can't be read or decoded counts as a miss. Entries unused for CACH
 expire, and once the cache outgrows CACHE_MAX_SIZE_MB the least recently used go first.
 
 The cache may hold code from private repositories, and anyone else who could write to it could
-plant entries, or make prune() delete files elsewhere through a symbolic link. So <dir> and
-<dir>/v1 are created private to the user (PRIVATE_MODE), and before either is used it must be a
-real directory (not a symbolic link) that belongs to the user: one of the user's that others can
-use too is made private, and anything else turns the cache off for the run, with a warning.
-Entries are read only from the user's own regular files, never through a symbolic link, and
-prune() deletes nothing but entry and temporary files in <kind>/<2 hex digits>/, following no
-symbolic link.
+plant entries, swap them, or make prune() delete files elsewhere through a symbolic link. So
+<dir> and <dir>/v1 are created private to the user (PRIVATE_MODE), and before either is used it
+must be a real directory (not a symbolic link) that belongs to the user: one of the user's that
+others can use too is made private, and anything else turns the cache off for the run, with a
+warning. Until then others could have planted, linked or swapped entries in it, so once either
+has been made private the cache's own files in <dir>/v1 are deleted before any is used, with a
+warning if there were any (see _clear). The <kind> and <2 hex digits> directories that hold an
+entry must be real directories of the user's too, or the cache is off for the run, with a
+warning. Entries are read only from the user's own regular files with no other hard link,
+never through a symbolic link. prune() deletes nothing but entry and temporary files in
+<kind>/<2 hex digits>/, following no symbolic link, and replaces its stamp file rather than
+writing through a link put in its place.
 
 Callers never cache errors. A value isn't written if it contains one of our own keys (`secrets`:
 open_cache passes GITHUB_TOKEN, OPENAI_API_KEY and ANTHROPIC_API_KEY; values under 8 characters
@@ -111,28 +116,44 @@ def current_uid() -> int | None:
 
 
 def directory_problem(path: Path, uid: int | None) -> str | None:
-    """Why the cache mustn't use the directory at `path`, or None if only the user can use it.
-    A directory of the user's that others can use too is made private first. Raises OSError if
-    there's nothing at `path`, or not a directory."""
+    """Why the cache mustn't use the directory at `path`, or None if it is a real directory that
+    belongs to the user. Raises OSError if there's nothing at `path`, or not a directory."""
     info = os.lstat(path)
     if stat.S_ISLNK(info.st_mode):
         return "it is a symbolic link"
     if not stat.S_ISDIR(info.st_mode):
         raise NotADirectoryError(f"Not a directory: {str(path)!r}")
-    if uid is None:
-        return None
-    if info.st_uid != uid:
+    if uid is not None and info.st_uid != uid:
         return "it belongs to another user"
-    if info.st_mode & 0o077:
-        with contextlib.suppress(OSError):
-            os.chmod(path, PRIVATE_MODE)  # pr-analyzer: ignore - makes the folder private (0700)
-        if os.lstat(path).st_mode & 0o077:
-            return "other users can open it, and it can't be made private"
     return None
 
 
+def others_can_use(path: Path, uid: int | None) -> bool:
+    # where files have no POSIX owner and mode (Windows), nothing is made private
+    return uid is not None and bool(os.lstat(path).st_mode & 0o077)
+
+
+def make_private(path: Path) -> str | None:
+    """Makes the directory at `path` private to the user: why that failed, or None."""
+    with contextlib.suppress(OSError):
+        os.chmod(path, PRIVATE_MODE)  # pr-analyzer: ignore - makes the folder private (0700)
+    if os.lstat(path).st_mode & 0o077:
+        return "other users can open it, and it can't be made private"
+    return None
+
+
+def warn_unsafe(path: Path, problem: str, fix: str) -> None:
+    log.warning("cache_dir_unsafe", path=str(path), problem=problem,
+                hint=f"caching off for this run: {fix}")
+
+
 def own_file(info: os.stat_result, uid: int | None) -> bool:
-    return stat.S_ISREG(info.st_mode) and (uid is None or info.st_uid == uid)
+    # the cache never gives a file a second hard link: a file with one may be any other file
+    # (another entry, say) linked into an entry's place
+    return (
+        stat.S_ISREG(info.st_mode) and info.st_nlink <= 1
+        and (uid is None or info.st_uid == uid)
+    )
 
 
 def subdirectories(path: Path) -> list[Path]:
@@ -177,8 +198,8 @@ class DiskCache:
         self._lock = threading.Lock()
         self.hits = self.misses = self.writes = 0
         self.writable = True   # until a write fails: then the run carries on without writing
-        self._checked = False   # <dir> and <dir>/v1 passed directory_problem
-        self._unsafe = False    # one of them didn't: the cache is off for the run
+        self._checked = False   # <dir> and <dir>/v1 passed their check
+        self._unsafe = False    # a directory of the cache didn't: the cache is off for the run
 
     @classmethod
     def disabled(cls) -> "DiskCache":
@@ -191,7 +212,9 @@ class DiskCache:
     def get(self, kind: str, *parts: str) -> str | None:
         if not self.enabled:
             return None
-        value = self._read(self._path(kind, parts)) if self._usable(create=False) else None
+        path = self._path(kind, parts)
+        usable = self._usable(create=False) and self._entry_dirs_usable(path, create=False)
+        value = self._read(path) if usable else None
         with self._lock:
             if value is None:
                 self.misses += 1
@@ -205,9 +228,8 @@ class DiskCache:
         path = self._path(kind, parts)
         data = zlib.compress(json.dumps({"value": value}).encode("ascii"))
         try:
-            if not self._usable(create=True):
+            if not (self._usable(create=True) and self._entry_dirs_usable(path, create=True)):
                 return
-            path.parent.mkdir(parents=True, exist_ok=True)
             write_atomically(path, data, mtime=self.clock())
         except OSError as e:
             # a cache that can't be written must never fail the analysis, nor log every file
@@ -251,9 +273,11 @@ class DiskCache:
                 break
             discard(path)
             total -= size
+        stamp = self.root / PRUNE_STAMP
         with contextlib.suppress(OSError):
-            stamp = self.root / PRUNE_STAMP
-            stamp.touch()
+            # made anew, not touched: a symbolic link put in its place is removed, not followed
+            discard(stamp)
+            os.close(os.open(stamp, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600))
             os.utime(stamp, (now, now))
 
     def _path(self, kind: str, parts: tuple[str, ...]) -> Path:
@@ -266,7 +290,8 @@ class DiskCache:
         try:
             with open(os.open(path, READ_FLAGS), "rb") as handle:
                 info = os.fstat(handle.fileno())
-                if not own_file(info, current_uid()):
+                # Windows has no O_NOFOLLOW: there, opening a symbolic link opens its target
+                if stat.S_ISLNK(os.lstat(path).st_mode) or not own_file(info, current_uid()):
                     return None   # nobody else's file is ever served as an entry
                 expired = now - info.st_mtime > self.max_age_seconds
                 data = b"" if expired else handle.read()
@@ -304,26 +329,72 @@ class DiskCache:
             return self._checked
 
     def _check_directories(self, create: bool) -> None:
+        """Checks <dir> and <dir>/v1, making either private if others can use it too. If one
+        was, whatever is in <dir>/v1 may have been planted, so the cache's own files there are
+        deleted before any is used."""
         assert self.root is not None
+        uid = current_uid()
+        made_private = False
         for path in (self.root.parent, self.root):
             if create:
                 # private: the cache holds file contents, which may come from private repositories
                 path.mkdir(mode=PRIVATE_MODE, parents=True, exist_ok=True)
-            problem = directory_problem(path, current_uid())
+            problem = directory_problem(path, uid)
+            if problem is None and others_can_use(path, uid):
+                made_private = True
+                problem = make_private(path)
             if problem is not None:
                 self._unsafe = True
-                log.warning("cache_dir_unsafe", path=str(path), problem=problem,
-                            hint="caching off for this run: use a CACHE_DIR of your own")
+                warn_unsafe(path, problem, fix="use a CACHE_DIR of your own")
                 return
+        if made_private:
+            self._clear()
         self._checked = True
 
+    def _entry_dirs_usable(self, path: Path, create: bool) -> bool:
+        """Whether <kind> and <kind>/<2 hex digits>, which hold the entry at `path`, are real
+        directories of the user's, after being made if `create`. Through a symbolic link, or in
+        someone else's directory, others could read entries or swap them, so either turns the
+        cache off for the run. Raises OSError if `create` and they can't be made."""
+        uid = current_uid()
+        for directory in (path.parent.parent, path.parent):
+            try:
+                if create:
+                    with contextlib.suppress(FileExistsError):
+                        directory.mkdir()
+                problem = directory_problem(directory, uid)
+            except OSError:
+                if create:
+                    raise
+                return False   # not made yet, so there's nothing to read
+            if problem is not None:
+                with self._lock:
+                    first, self._unsafe = not self._unsafe, True
+                if first:
+                    warn_unsafe(directory, problem, fix="delete it, or use another CACHE_DIR")
+                return False
+        return True
+
+    def _clear(self) -> None:
+        """Deletes the cache's own files: every entry and temporary file that prune() may delete,
+        whatever its age, and the prune stamp. A warning says how many went, if any did."""
+        assert self.root is not None
+        paths = [path for path, _ in self._entries()] + [self.root / PRUNE_STAMP]
+        deleted = sum(discard(path) for path in paths)
+        if deleted:
+            log.warning("cache_cleared", path=str(self.root), files=deleted,
+                        reason="others could use the cache folder until it was made private")
+
     def _prune_due(self) -> bool:
         assert self.root is not None
         try:
-            last = (self.root / PRUNE_STAMP).stat().st_mtime
+            info = os.lstat(self.root / PRUNE_STAMP)
         except OSError:
             return True
-        return self.clock() - last > PRUNE_INTERVAL_SECONDS
+        # a stamp that isn't the cache's own file, such as a planted link, can't put pruning off
+        if not own_file(info, current_uid()):
+            return True
+        return self.clock() - info.st_mtime > PRUNE_INTERVAL_SECONDS
 
     def _entries(self) -> Iterator[tuple[Path, os.stat_result]]:
         """The entry and temporary files in <kind>/<2 hex digits>/, with their lstat: the only
@@ -355,9 +426,13 @@ def write_atomically(path: Path, data: bytes, mtime: float) -> None:
         raise
 
 
-def discard(path: Path) -> None:
-    with contextlib.suppress(OSError):
+def discard(path: Path) -> bool:
+    """Deletes the file at `path` (a symbolic link itself, not its target): whether it went."""
+    try:
         path.unlink()
+    except OSError:
+        return False
+    return True
 
 
 def open_cache(enabled: bool = True) -> DiskCache:

{pr_analyzer_cli-0.1.0 → pr_analyzer_cli-0.1.1}/src/pr_analyzer/github/client.py

@@ -21,8 +21,9 @@ from pr_analyzer.exceptions import (
     RateLimitError,
     RepositoryNotFoundError,
 )
-from pr_analyzer.github.markdown import neutralise, neutralise_line
+from pr_analyzer.github.markdown import comparable, neutralise, neutralise_line
 from pr_analyzer.github.ratelimit import (
+    WAIT_SLICE_SECONDS,
     RateLimitExceeded,
     RateLimitPause,
     RateLimitRetry,
@@ -210,8 +211,13 @@ class GithubClient:
         )
         try:
             futures = [pool.submit(fetch, file) for file in files]
-            # a failure is raised as soon as it happens, not once the files before it are in
-            wait(futures, return_when=FIRST_EXCEPTION)
+            # a failure is raised as soon as it happens, not once the files before it are in. The
+            # wait is sliced: on Windows one long wait would hold Ctrl-C back until it ended.
+            pending = set(futures)
+            while pending:
+                done, pending = wait(pending, timeout=WAIT_SLICE_SECONDS, return_when=FIRST_EXCEPTION)
+                if any(f.exception() is not None for f in done):
+                    break
             errors = [e for f in futures if f.done() and (e := f.exception()) is not None]
             if errors:
                 raise errors[0]
@@ -315,10 +321,12 @@ class GithubClient:
             # every push re-runs the analysis, and each run used to add a whole new review that
             # repeated every comment. Skip findings already commented on (GitHub clears `line`
             # once the code under a comment changes, so those get a fresh comment) and update the
-            # earlier summary in place.
-            posted = {(c.path, c.line, c.body.strip()) for c in pull.get_review_comments()}
+            # earlier summary in place. Bodies are compared in comparable() form, so a comment
+            # an earlier version posted, with its zero-width spaces elsewhere, still counts.
+            posted = {(c.path, c.line, comparable(c.body)) for c in pull.get_review_comments()}
             review_comments = [
-                c for c in review_comments if (c["path"], c["line"], c["body"].strip()) not in posted
+                c for c in review_comments
+                if (c["path"], c["line"], comparable(c["body"])) not in posted
             ]
             if not self._update_summary(pull, summary):
                 review_comments = self._create_review(pull, commit, summary, review_comments)

{pr_analyzer_cli-0.1.0 → pr_analyzer_cli-0.1.1}/src/pr_analyzer/github/markdown.py

@@ -105,6 +105,16 @@ def code_span(text: str) -> str:
     return f"{fence}{padding}{text}{padding}{fence}"
 
 
+def comparable(text: str) -> str:
+    """The text as the review compares it with comments already posted, whichever version
+    posted them: without zero-width spaces, which versions of neutralise() put in different
+    places, with every line ending as "\\n", and without spaces or tabs at the end of a line or
+    whitespace around the text. Nothing else changes, so text that differs in anything more,
+    such as code and its indentation, still differs."""
+    lines = _LINE_ENDING.split(str(text).replace(ZERO_WIDTH_SPACE, ""))[::2]
+    return "\n".join(line.rstrip(" \t") for line in lines).strip()
+
+
 def _neutralise_inline(line: str, trust_code: bool = True) -> tuple[str, bool]:
     """One line of Markdown neutralised outside its code spans, and whether the later lines of
     its paragraph can no longer trust theirs: a run of backticks left open could pair with one of

{pr_analyzer_cli-0.1.0 → pr_analyzer_cli-0.1.1}/src/pr_analyzer/github/ratelimit.py

@@ -55,6 +55,11 @@ DEFAULT_MAX_WAIT_SECONDS = 60.0
 # transient server errors, retried on idempotent requests only
 SERVER_ERRORS = (500, 502, 503, 504)
 MAX_RETRIES = 3
+# The longest a wait blocks at a time. On Windows, Python 3.11-3.13 can't interrupt an Event wait
+# the way it interrupts time.sleep (bpo-29971): Ctrl-C raises KeyboardInterrupt on the main thread
+# only once the wait returns, which in slices this long is within half a second. Elsewhere Ctrl-C
+# still cuts a slice short at once.
+WAIT_SLICE_SECONDS = 0.5
 
 
 def lowercase(headers: Mapping[str, str]) -> dict[str, str]:
@@ -137,9 +142,10 @@ class RateLimitPause:
     request waits for a limit to reset, the others hold back instead of adding to it.
 
     Waits are on an Event rather than time.sleep, so cancel() ends them at once: Ctrl-C reaches
-    only the main thread, and nothing else could stop a worker thread's wait. Deadlines are on
-    the monotonic clock, which a change to the system time doesn't move; `clock` is the wall
-    clock that GitHub's reset times are read against."""
+    only the main thread, and nothing else could stop a worker thread's wait. They block for at
+    most WAIT_SLICE_SECONDS at a time, so that Ctrl-C on the main thread isn't held back on
+    Windows. Deadlines are on the monotonic clock, which a change to the system time doesn't
+    move; `clock` is the wall clock that GitHub's reset times are read against."""
 
     def __init__(
         self,
@@ -171,7 +177,11 @@ class RateLimitPause:
     def sleep(self, seconds: float) -> None:
         """Wait `seconds` without holding back other requests, unless cancel() comes first."""
         if seconds > 0 and not self.cancelled.is_set():
-            self.cancelled.wait(seconds)
+            until = self.monotonic() + seconds
+            remaining = seconds
+            # a slice at a time, each measured against the deadline, so no lateness adds up
+            while remaining > 0 and not self.cancelled.wait(min(remaining, WAIT_SLICE_SECONDS)):
+                remaining = until - self.monotonic()
         self.raise_if_cancelled()
 
     def wait(self, seconds: float, **context: Any) -> None:

{pr_analyzer_cli-0.1.0 → pr_analyzer_cli-0.1.1}/src/pr_analyzer/llm/review.py

@@ -9,7 +9,7 @@ files weren't AI-reviewed. Ctrl-C stops the review at once: no request still que
 the replies already in are cached before the interrupt goes on.
 """
 from collections.abc import Callable
-from concurrent.futures import Future, ThreadPoolExecutor, as_completed
+from concurrent.futures import FIRST_COMPLETED, Future, ThreadPoolExecutor, wait
 from dataclasses import dataclass, field
 
 import structlog
@@ -21,6 +21,9 @@ from pr_analyzer.llm.prompts import SYSTEM_PROMPT
 
 log = structlog.get_logger(__name__)
 
+# waits for parallel requests come in slices: on Windows one long wait holds Ctrl-C back until it ends
+WAIT_SLICE_SECONDS = 0.5
+
 
 @dataclass
 class ReviewPlan:
@@ -80,15 +83,18 @@ def send(
         futures: dict[Future[str], int] = {
             pool.submit(ask, requests[index].prompt): index for index in indexes
         }
-        for future in as_completed(futures):
-            if future.cancelled():
-                continue
-            try:
-                replies[futures[future]] = future.result()
-            except Exception as e:
-                error = error or e
-                for pending in futures:
-                    pending.cancel()   # only those not started yet; the others finish
+        pending = set(futures)
+        while pending:
+            done, pending = wait(pending, timeout=WAIT_SLICE_SECONDS, return_when=FIRST_COMPLETED)
+            for future in done:
+                if future.cancelled():
+                    continue
+                try:
+                    replies[futures[future]] = future.result()
+                except Exception as e:
+                    error = error or e
+                    for queued in pending:
+                        queued.cancel()   # only those not started yet; the others finish
     except BaseException:
         # Ctrl-C: the requests still queued are dropped rather than sent (each one is paid for),
         # and the ones in flight aren't waited for

{pr_analyzer_cli-0.1.0 → pr_analyzer_cli-0.1.1}/src/pr_analyzer/project_config.py

@@ -46,6 +46,15 @@ RULE_IDS = frozenset(ast_analyzer.RULE_IDS + scanner.RULE_IDS + (LLM_RULE, CONFI
 KEYS = ("disable", "ignore_paths", "block_on", "inline_min_severity", "thresholds")
 THRESHOLD_KEYS = tuple(f.name for f in dataclasses.fields(Thresholds))
 
+# Checked before anything else, since a problem that quoted such a value would fail to print it:
+# Python won't turn an integer of over 4300 digits into text (tomllib reads one written in hex,
+# octal or binary, and raises for a decimal one), nor print a value nested more deeply than the
+# recursion limit. TOML's own integers are 64-bit, and no setting nests deeper than [thresholds].
+_TOML_INTEGERS = range(-2**63, 2**63)
+_MAX_NESTING = 100
+_TOO_BIG = "the file has an integer outside TOML's 64-bit range"
+_TOO_DEEP = f"the file nests tables or arrays more than {_MAX_NESTING} levels deep"
+
 # The part of .gitignore's syntax that ignore_paths supports, matched as git matches it: `*` and
 # `?` stay within one path segment, and `**` as a whole segment crosses directories (`**/` any
 # number of them, a final `/**` everything inside); any other run of asterisks is a `*`, and
@@ -67,6 +76,9 @@ _UNSUPPORTED = (
     (re.compile(r"[^/*]\*{2,}/[^/]"), "has ** inside a name before a /, which isn't supported: "
                                       "write foo*/bar for one directory, or foo*/**/bar for any "
                                       "number"),
+    # glob_regex drops every / at either end, where git drops one and then matches nothing; and
+    # in foo**//bar, which slips past the check above, git's ** crosses directories
+    (re.compile(r"//"), "has //, which isn't supported: write a single /"),
 )
 
 
@@ -129,7 +141,9 @@ def parse_project_config(raw: bytes | str, source: str = CONFIG_FILE) -> Project
 
 def read_project_config(raw: bytes | str) -> tuple[ProjectConfig, list[str]]:
     """The settings in a file and every problem with it. With any problem the settings are the
-    defaults: the valid part of a broken file isn't what the project chose either."""
+    defaults: the valid part of a broken file isn't what the project chose either. A file that
+    can't be parsed, or holds an integer or nesting past the limits above, has only that problem:
+    its keys aren't checked."""
     try:
         text = raw.decode("utf-8") if isinstance(raw, bytes) else raw
         data = tomllib.loads(text)
@@ -137,8 +151,17 @@ def read_project_config(raw: bytes | str) -> tuple[ProjectConfig, list[str]]:
         return ProjectConfig(), ["the file is not UTF-8 text"]
     except tomllib.TOMLDecodeError as e:
         return ProjectConfig(), [f"the file is not valid TOML: {e}"]
-
-    problems: list[str] = []
+    except ValueError:
+        # int() refuses a decimal integer of over 4300 digits, and tomllib lets that through
+        return ProjectConfig(), [_TOO_BIG]
+    except RecursionError:
+        # tomllib reads nested arrays and inline tables recursively, and recent versions refuse
+        # a key with more parts than the recursion limit
+        return ProjectConfig(), [_TOO_DEEP]
+
+    problems = _limit_problems(data)
+    if problems:
+        return ProjectConfig(), problems
     values = _validate(data, problems)
     return (ProjectConfig() if problems else ProjectConfig(**values)), problems
 
@@ -172,6 +195,24 @@ def config_findings(text: str) -> list[Suggestion]:
     ]
 
 
+def _limit_problems(data: dict[str, Any]) -> list[str]:
+    """_TOO_BIG and _TOO_DEEP, if the file has such a value. Walked without recursion, since the
+    nesting isn't known yet; the file itself is level 0, and a table or array in it level 1."""
+    found: set[str] = set()
+    pending: list[tuple[Any, int]] = [(data, 0)]
+    while pending:
+        value, level = pending.pop()
+        if isinstance(value, dict):
+            value = list(value.values())
+        if isinstance(value, list) and level > _MAX_NESTING:
+            found.add(_TOO_DEEP)
+        elif isinstance(value, list):
+            pending += [(item, level + 1) for item in value]
+        elif isinstance(value, int) and value not in _TOML_INTEGERS:
+            found.add(_TOO_BIG)
+    return sorted(found)
+
+
 def _validate(data: dict[str, Any], problems: list[str]) -> dict[str, Any]:
     problems += [unknown("key", key, KEYS) for key in data if key not in KEYS]
     values: dict[str, Any] = {}