pycoati 0.1.0__tar.gz

pycoati-0.1.0/.claude/settings.json

@@ -0,0 +1,2 @@
+{
+}

pycoati-0.1.0/.claude/skills/rust-review/SKILL.md

@@ -0,0 +1,88 @@
+---
+name: rust-review
+context: fork
+description: Deep Rust code quality review. Auto-invoke when finishing a task, before marking work complete, when the user asks to review code, or when preparing a PR. Covers error handling, async correctness, duplicated logic, test quality, performance patterns, idiomatic Rust, docs-code alignment, and API design beyond what clippy catches.
+---
+
+# Deep Code Review for pycoati
+
+Perform a thorough code quality review of the changes in this project. Go beyond what clippy and rustfmt catch. Focus on the areas below and report findings grouped by severity: Must Fix, Should Fix, Suggestion.
+
+First, run `cargo fmt --all -- --check` and `cargo clippy --all-targets --all-features -- -D warnings` to confirm the automated checks pass. If they don't, fix those first before proceeding with the deep review.
+
+## 1. Error Handling Quality
+
+- `.unwrap()` outside tests is forbidden. Flag any instance.
+- Check that `.context("message")` is used when propagating errors from external crates with `?` — bare `?` loses context about what operation failed.
+- Flag `Result` return types where the function never actually returns `Err` (remove the wrapper — clippy catches this as `unnecessary_wraps` but double-check).
+- Flag `.map_err(|_| ...)` that silently discards error information.
+- Verify error types are specific enough — no `String` as error type, no `anyhow::Error` leaking into library-style modules.
+- Check that `thiserror` error variants have `#[from]` or manual `From` impls for their sources.
+
+## 2. Async / Tokio Correctness
+
+- Flag any `MutexGuard` or `RwLockGuard` held across an `.await` point — this can deadlock or prevent `Send` futures.
+- Flag blocking operations (std::fs, std::process::Command, heavy computation) running directly in async context without `spawn_blocking`.
+- Check that spawned tasks (`tokio::spawn`) have their `JoinHandle` either awaited or explicitly dropped with a comment explaining why.
+- Verify `tokio::select!` branches handle cancellation correctly (partially completed work).
+- Check for unbounded channels or queues that could cause memory issues under load.
+
+## 3. Duplicated Logic
+
+- Search for functions or code blocks that do substantially the same thing with minor variations. Flag them and suggest extraction into a shared function, trait, or generic.
+- Pay special attention to:
+  - Error handling boilerplate that could be a helper
+  - Serialization/deserialization patterns
+  - Similar match arms across different functions
+- Suggest concrete refactoring: which function to extract, what parameters it should take.
+
+## 4. Test Quality
+
+- **Tests that don't assert**: Flag any test that just calls code without asserting on the result. Running without panicking is not a test.
+- **Tests that assert too little**: `assert!(result.is_ok())` without checking the value inside is weak. Suggest asserting on the actual content.
+- **Overly verbose tests**: Tests with excessive setup that obscure what's actually being tested. Suggest extracting test helpers or fixtures.
+- **Missing edge cases**: For each public function, check if tests cover: empty input, error paths, boundary conditions.
+- **Test naming**: Test names should describe the behavior being tested, not the implementation (`test_returns_error_on_missing_file` not `test_function_xyz`).
+- **Integration vs unit**: Verify that unit tests (in `#[cfg(test)] mod tests`) test internal logic, while `tests/` tests exercise the public CLI interface.
+- Suggest adding `proptest` for any function that transforms data (roundtrip properties).
+
+## 5. Performance Patterns
+
+- Flag unnecessary `.clone()` — suggest borrowing or restructuring ownership.
+- Flag `.collect::<Vec<_>>()` immediately followed by `.iter()` — the intermediate collection is usually unnecessary.
+- Prefer `&str` over `String`, `&[T]` over `Vec<T>`, `&Path` over `PathBuf` in function parameters when ownership isn't needed.
+- Flag large structs being passed by value instead of reference.
+- Check for `Arc::clone(&x)` vs `x.clone()` — the former is required by our lint config for clarity.
+- In async code, flag futures that capture large amounts of data across await points.
+
+## 6. Idiomatic Rust
+
+- Prefer iterator chains over manual `for` loops with `push`.
+- Use `if let` / `let else` instead of `match` with a single interesting arm and a wildcard.
+- Suggest `impl From<X> for Y` instead of standalone conversion functions.
+- Suggest `Display` implementations instead of `to_string()` methods.
+- Flag `&String`, `&Vec<T>`, `&Box<T>` in function signatures — use `&str`, `&[T]`, `&T` instead.
+- Check doc comments on all public types and functions.
+
+## 7. Documentation ↔ Code Alignment
+
+- **Check that `README.md` and any `docs/` content still match the current CLI and behavior.** Compare documented flags and subcommands against the `clap` definitions in `src/`.
+- Flag any mismatch as Must Fix — stale docs are worse than no docs.
+
+## 8. API and Module Design
+
+- Is `main.rs` thin? It should just parse args and call into library code.
+- Are module boundaries clean? Each module should have a clear responsibility.
+- Check for any `pub` items that don't need to be public.
+- Flag circular dependencies between modules.
+
+## Output Format
+
+Group all findings by severity, then by area. For each finding:
+- State **what** the issue is and **where** (file:line or function name)
+- Explain **why** it matters
+- Suggest a **concrete fix** (not just "improve this")
+
+End with a summary: X must-fix, Y should-fix, Z suggestions.
+
+$ARGUMENTS

pycoati-0.1.0/.github/workflows/audit.yml

@@ -0,0 +1,29 @@
+name: "Cargo Audit"
+
+on:
+  push:
+    paths:
+      - "Cargo.toml"
+      - "Cargo.lock"
+  pull_request:
+    paths:
+      - "Cargo.toml"
+      - "Cargo.lock"
+  schedule:
+    - cron: "0 0 * * *" # Daily at midnight UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  audit:
+    name: Security Audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Run cargo-audit
+        uses: actions-rust-lang/audit@v1

pycoati-0.1.0/.github/workflows/cargo-deny.yml

@@ -0,0 +1,35 @@
+name: "Cargo Deny"
+
+on:
+  push:
+    branches: ["main"]
+    paths:
+      - "Cargo.lock"
+      - "Cargo.toml"
+      - "deny.toml"
+  pull_request:
+    paths:
+      - "Cargo.lock"
+      - "Cargo.toml"
+      - "deny.toml"
+
+permissions:
+  contents: read
+
+jobs:
+  deny:
+    name: ${{ matrix.check }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        check: [bans, licenses, sources]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Run cargo-deny (${{ matrix.check }})
+        uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          command: check ${{ matrix.check }}
+          arguments: --all-features

pycoati-0.1.0/.github/workflows/codeql.yml

@@ -0,0 +1,42 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: ["main"]
+    paths:
+      - "src/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+  pull_request:
+    branches: ["main"]
+    paths:
+      - "src/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+  schedule:
+    - cron: "0 6 * * 1" # Weekly on Monday at 06:00 UTC
+
+permissions:
+  security-events: write
+  packages: read
+  actions: read
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze Rust
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: rust
+          build-mode: none
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:rust"

pycoati-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,114 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  build-wheels:
+    name: Build wheels on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-14, windows-latest]
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Build wheels
+        uses: PyO3/maturin-action@v1
+        with:
+          args: --release --strip
+          manylinux: 2_28
+
+      - name: Upload wheels
+        uses: actions/upload-artifact@v7
+        with:
+          name: wheels-${{ matrix.os }}
+          path: target/wheels/*.whl
+
+  build-sdist:
+    name: Build source distribution
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.11'
+
+      - name: Install maturin
+        run: pip install maturin
+
+      - name: Build sdist
+        run: maturin sdist
+
+      - name: Upload sdist
+        uses: actions/upload-artifact@v7
+        with:
+          name: sdist
+          path: target/wheels/*.tar.gz
+
+  create-release:
+    name: Create GitHub Release
+    needs: [build-wheels, build-sdist]
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/')
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@v8
+        with:
+          path: dist
+
+      - name: Flatten artifacts
+        run: |
+          mkdir -p wheels
+          find dist -name '*.whl' -exec cp {} wheels/ \;
+          find dist -name '*.tar.gz' -exec cp {} wheels/ \;
+
+      - name: Create Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: wheels/*
+          generate_release_notes: true
+          draft: false
+          prerelease: false
+
+  publish-to-pypi:
+    name: Publish to PyPI
+    needs: [build-wheels, build-sdist, create-release]
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/') && github.event_name == 'push'
+    environment:
+      name: pypi
+      url: https://pypi.org/p/pycoati
+    permissions:
+      id-token: write
+    steps:
+      - name: Download all artifacts
+        uses: actions/download-artifact@v8
+        with:
+          path: dist
+
+      - name: Flatten artifacts
+        run: |
+          mkdir -p wheels
+          find dist -name '*.whl' -exec cp {} wheels/ \;
+          find dist -name '*.tar.gz' -exec cp {} wheels/ \;
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: wheels/
+          skip-existing: true

pycoati-0.1.0/.github/workflows/review.yml

@@ -0,0 +1,66 @@
+name: Code Review
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "src/**"
+      - "tests/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - "rust-toolchain.toml"
+      - "clippy.toml"
+      - "rustfmt.toml"
+  pull_request:
+    paths:
+      - "src/**"
+      - "tests/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - "rust-toolchain.toml"
+      - "clippy.toml"
+      - "rustfmt.toml"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  fmt:
+    name: Formatting
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+      - run: cargo fmt --all --check
+
+  clippy:
+    name: Clippy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo clippy --all-targets --all-features -- -D warnings
+
+  test:
+    name: Tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+      - name: Install pytest
+        run: pip install pytest
+      - run: cargo test --all-features

pycoati-0.1.0/.gitignore

@@ -0,0 +1,74 @@
+# Rust
+/target/
+**/*.rs.bk
+
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+pip-wheel-metadata/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# Virtual environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Claude Code
+.claude/worktrees/
+cf/
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# OS
+.DS_Store
+.DS_Store?
+._*
+.Spotlight-V100
+.Trashes
+ehthumbs.db
+Thumbs.db
+
+# Logs
+*.log
+
+# Temporary files
+*.tmp
+*.temp
+.cache/
+
+# maturin / PyO3
+*.so
+*.pyd
+
+# Testing
+.pytest_cache/
+.coverage
+htmlcov/

pycoati-0.1.0/CLAUDE.md

@@ -0,0 +1,84 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+pycoati audits Python test suites for mock smells and suspicious tests. Hybrid Rust/Python project: builds a Rust binary (`pycoati`) and packages it as a Python package via maturin for distribution through pip/uv.
+
+## Common Commands
+
+```bash
+# Pre-commit checks (always run before committing)
+cargo fmt --check && cargo clippy --all-targets --all-features -- -D warnings && cargo test --all-features
+
+# Run tests
+cargo test
+
+# Build and install locally for testing (puts `pycoati` on PATH at ~/.cargo/bin)
+cargo install --path . --force
+
+# Build a Python wheel (only needed when packaging for pip/uv distribution)
+maturin develop
+
+# Full review (fmt, clippy, tests, audit, deny)
+make review
+```
+
+## Development Workflow
+
+All features and bug fixes follow TDD (red-green-refactor). No implementation code without a failing test first. Bug fixes must include a regression test that fails without the fix.
+
+## Test Changes Require Deliberation
+
+When a test fails during implementation:
+
+1. **Stop and diagnose.** Understand WHY it fails before changing anything.
+2. **Default assumption: the test is right.** Fix the implementation first.
+3. **If the test genuinely needs updating** (requirements changed, API evolved), explain what changed and why the old assertion is no longer correct before modifying it.
+4. **Never weaken an assertion just to make it pass.**
+5. **If uncertain, ask.**
+
+## Branch Hygiene
+
+**Always merge `main` into your feature branch before creating a PR.** Run:
+
+```bash
+git fetch origin main && git merge origin/main
+```
+
+Then re-run the full check suite to verify the merge didn't introduce breakage.
+
+## When Stuck
+
+If hitting a wall:
+1. Do not silently work around it — state the problem explicitly.
+2. Do not attempt more than 3 approaches without reporting what was tried and why each failed.
+3. Do not modify unrelated code hoping it fixes the issue.
+4. Revert to last known good state if changes made things worse.
+5. When in doubt, ask.
+
+## Review Before Completing Work
+
+Before marking any task as complete:
+
+1. **Automated checks** (run automatically via prek pre-commit hook on `git commit`):
+   - `cargo fmt --all -- --check`
+   - `cargo clippy --all-targets --all-features -- -D warnings`
+   - `cargo test --all-features --bins`
+
+2. **Deep review** (REQUIRED for all significant changes):
+   - Run the `rust-review` skill (`/rust-review`) before marking work as complete
+   - Address all Must Fix items before completing
+   - Address Should Fix items unless there's a documented reason not to
+
+3. **Full review** (run before pushing):
+   - `make review`
+
+### Code Rules
+- No `.unwrap()` outside tests — use `.context()` when propagating errors with `?`
+- No `MutexGuard` held across `.await`
+- Prefer `&str`/`&[T]`/`&Path` over owned types in function parameters when ownership isn't needed
+- Tests must assert on values, not just "runs without panic"
+- Flaky tests need root-cause analysis, not looser assertions
+- No new dependencies without surfacing the choice