python-code-quality 0.3.0__py3-none-any.whl → 0.4.0__py3-none-any.whl

py_cq/api.py

@@ -148,7 +148,9 @@ class CQ:
         if clear_cache:
             _cache.clear()
 
-    def raw(self, *, early_exit: bool = False, order: str = "severity") -> list[ToolResult]:
+    def raw(
+        self, *, early_exit: bool = False, order: str = "severity"
+    ) -> list[ToolResult]:
         """Run all tools and return parsed results before aggregation."""
         return run_tools(
             self._registry.values(),
@@ -218,7 +220,7 @@ class CQ:
             )
         if fp.tool not in tool_registry:
             raise ValueError(f"Unknown tool: {fp.tool!r}")
-        
+
         if fp.code and fp.path:
             # Specific issue: target only the affected file for a fast re-check
             file_path = Path(fp.path)
@@ -242,7 +244,11 @@ class CQ:
 
         only_registry = {fp.tool: tool_registry[fp.tool]}
         tool_results = run_tools(
-            only_registry.values(), target, max_workers=1, early_exit=False, excludes=[],
+            only_registry.values(),
+            target,
+            max_workers=1,
+            early_exit=False,
+            excludes=[],
             project_root=str(self.path),
         )
 

py_cq/cli.py

@@ -107,7 +107,7 @@ def callback(
         help="Show version and dependencies",
     ),
 ) -> None:
-    """Feed the results from 11+ code quality tools to an LLM. Try: cq check . -o llm"""
+    """Feed the results from 13 code quality tools to an LLM. Try: cq check . -o llm"""
     import sys
 
     if isinstance(sys.stdout, io.TextIOWrapper):
@@ -124,7 +124,7 @@ def check(
         OutputMode.TABLE,
         "--output",
         "-o",
-        help="Output mode: table (default), score, json, llm",
+        help="Output mode: table (default), score, json, raw, llm, llm-json",
     ),
     log_level: str = typer.Option(
         "CRITICAL",
@@ -172,7 +172,7 @@ def check(
         help="Issue selection order for -o llm/llm-json: severity (most severe first) or phase (first non-clean phase, in dependency order)",
     ),
 ):
-    """Feed the results from 11+ code quality tools to an LLM. Try: cq check . -o llm"""  # --help
+    """Feed the results from 13 code quality tools to an LLM. Try: cq check . -o llm"""  # --help
     path_obj = Path(path)
     if not path_obj.exists():
         raise typer.BadParameter(f"Path does not exist: {path}")

py_cq/config/config.toml

@@ -7,8 +7,8 @@ error_threshold = 0.9999
 cache_invariant = "ast"
 
 [python.ruff]
-command = "{python} -m ruff check --output-format concise --no-cache \"{context_path}\" --exclude .claude{exclude}"
-exclude_format = " --exclude {path}"
+command = "{python} -m ruff check --output-format concise --no-cache \"{context_path}\" --extend-exclude .claude{exclude}"
+exclude_format = " --extend-exclude {path}"
 parser = "RuffParser"
 order = 2
 warning_threshold = 0.9999
@@ -33,11 +33,27 @@ order = 4
 warning_threshold = 0.9999
 error_threshold = 0.8
 
+[python.kingfisher]
+command = "kingfisher scan \"{context_path}\" --no-validate --no-update-check --git-history none --no-extract-archives --redact -q -f json --exclude .venv --exclude .git --exclude .hypothesis --exclude dist --exclude \"*_cache\" --exclude __pycache__ --exclude .claude{exclude}"
+exclude_format = " --exclude {path}"
+parser = "KingfisherParser"
+order = 5
+warning_threshold = 0.9999
+error_threshold = 0.9999
+
+[python.uv-audit]
+command = "uv audit --project \"{abs_context_path}\" --frozen --output-format json"
+parser = "UvAuditParser"
+order = 6
+warning_threshold = 0.9999
+error_threshold = 0.8
+skip_for_file = true
+
 [python.pytest]
 command = "{python} -m pytest -vv \"{context_path}\" --ignore .claude{exclude}"
 exclude_format = " --ignore {path}"
 parser = "PytestParser"
-order = 5
+order = 7
 warning_threshold = 1.0
 error_threshold = 1.0
 run_in_target_env = true
@@ -46,10 +62,10 @@ skip_for_file = true
 cache_invariant = "ast"
 
 [python.coverage]
-command = "{python} -m coverage run --omit=*/tests/*,*/test_*.py -m pytest \"{context_path}\" --ignore .claude{exclude} && {python} -m coverage report --show-missing --omit=*/tests/*,*/test_*.py"
+command = "{python} -m coverage run --omit=*/tests/*,*/test_*.py,*/py_cq/runners/* \"{pytest_serial}\" \"{context_path}\" --ignore .claude{exclude} && {python} -m coverage report --show-missing --omit=*/tests/*,*/test_*.py,*/py_cq/runners/*"
 exclude_format = " --ignore {path}"
 parser = "CoverageParser"
-order = 6
+order = 8
 warning_threshold = 0.9
 error_threshold = 0.5
 run_in_target_env = true
@@ -59,19 +75,19 @@ skip_if = "pytest"
 cache_invariant = "ast"
 
 [python.vulture]
-command = "{python} -m vulture \"{context_path}\" --min-confidence 80 --exclude .venv,dist,.*_cache,docs,.git,.claude{exclude}"
+command = "{python} -m vulture \"{context_path}\" --min-confidence 60 --ignore-decorators \"@*.command,@*.callback,@*.route,@*.get,@*.post,@*.put,@*.delete,@*.patch,@*fixture,@*.task,@*hookimpl,@*validator,@*.errorhandler\" --exclude .venv,dist,.*_cache,docs,.git,.claude{exclude}"
 exclude_format = ",{path}"
 parser = "VultureParser"
-order = 7
+order = 9
 warning_threshold = 0.9999
 error_threshold = 0.8
 cache_invariant = "ast"
 
 [python.interrogate]
-command = "{python} -m interrogate \"{context_path}\" -e .claude{exclude} -v --fail-under 0"
+command = "{python} -m interrogate \"{context_path}\" -e .claude -e \"{context_path}/tests\"{exclude} -v --fail-under 0"
 exclude_format = " -e {path}"
 parser = "InterrogateParser"
-order = 8
+order = 10
 warning_threshold = 0.8
 error_threshold = 0.5
 
@@ -81,23 +97,28 @@ skip_empty_init = true
 [python.radon-cc]
 command = "{python} -m radon cc --json --exclude '.claude/**' \"{context_path}\""
 parser = "ComplexityParser"
-order = 9
-gate_strict = false
+order = 11
 warning_threshold = 0.6
 error_threshold = 0.4
 
 [python.radon-mi]
 command = "{python} -m radon mi -s --json --exclude '.claude/**' \"{context_path}\""
 parser = "MaintainabilityParser"
-order = 10
-gate_strict = false
+order = 12
 warning_threshold = 0.6
 error_threshold = 0.4
 
 [python.radon-hal]
 command = "{python} -m radon hal -f --json --exclude '.claude/**' \"{context_path}\""
 parser = "HalsteadParser"
-order = 11
-gate_strict = false
+order = 13
 warning_threshold = 0.35
 error_threshold = 0.3
+
+[python.ruff-format]
+command = "{python} -m ruff format --check --output-format concise --no-cache \"{context_path}\" --extend-exclude .claude --config \"include=['*.py','*.pyi','*.ipynb']\"{exclude}"
+exclude_format = " --extend-exclude {path}"
+parser = "RuffFormatParser"
+order = 14
+warning_threshold = 0.9999
+error_threshold = 0.5

py_cq/execution_engine.py

@@ -38,6 +38,9 @@ _cache = Cache(
     Path.home() / ".cache" / "cq", size_limit=100 * 1024 * 1024, disk=JSONDisk
 )
 
+# Script that runs pytest in one process under coverage; see its docstring.
+_PYTEST_SERIAL = str(Path(__file__).parent / "runners" / "pytest_serial.py")
+
 
 def _find_project_root(path: Path) -> Path | None:
     """Walk up from path to find the nearest directory containing pyproject.toml."""
@@ -271,6 +274,7 @@ def run_tool(
         scan_targets=scan_targets,
         python=python,
         exclude=exclude,
+        pytest_serial=_PYTEST_SERIAL,
     )
     if precomputed_hash is not None:
         context_hash = precomputed_hash
@@ -328,7 +332,13 @@ def run_tool(
         timestamp=timestamp,
         project_path=project_dir,
     )
-    _cache.set(cache_key, raw_result.to_dict(), expire=5 * 24 * 60 * 60, tag=project_tag)
+    if return_code != 0 and not stdout.strip():
+        # Failed without a report: the tool is missing from PATH or offline.
+        # Caching this would hide real results until the files change.
+        return raw_result
+    _cache.set(
+        cache_key, raw_result.to_dict(), expire=5 * 24 * 60 * 60, tag=project_tag
+    )
     return raw_result
 
 
@@ -386,7 +396,9 @@ def run_tools(
     t_hash0 = time.perf_counter()
     root = project_root or str(Path(path).resolve())
     shared_hash = get_context_hash(root)
-    log.debug(f"context_hash: {(time.perf_counter() - t_hash0) * 1000:.1f}ms {shared_hash}")
+    log.debug(
+        f"context_hash: {(time.perf_counter() - t_hash0) * 1000:.1f}ms {shared_hash}"
+    )
 
     # Cache keys are content-based, so a changed project naturally produces new
     # keys; stale entries age out via TTL + size_limit (no blanket eviction).
@@ -398,7 +410,9 @@ def run_tools(
     if any(tc.cache_invariant == "ast" for tc in tool_configs):
         t_norm0 = time.perf_counter()
         norm_hash = get_context_hash(root, normalize=True)
-        log.debug(f"context_hash(ast): {(time.perf_counter() - t_norm0) * 1000:.1f}ms {norm_hash}")
+        log.debug(
+            f"context_hash(ast): {(time.perf_counter() - t_norm0) * 1000:.1f}ms {norm_hash}"
+        )
 
     def _hash_for(tool_config: ToolConfig) -> str:
         return norm_hash if tool_config.cache_invariant == "ast" else shared_hash
@@ -410,7 +424,14 @@ def run_tools(
         # Only pass cancel_event when present so patched run_tool stubs in tests
         # (which don't declare the kwarg) keep working for non-cancellable tools.
         extra = {"cancel_event": cancel_event} if cancel_event is not None else {}
-        raw_result = run_tool(tool_config, path, excludes, precomputed_hash=_hash_for(tool_config), project_tag=root, **extra)
+        raw_result = run_tool(
+            tool_config,
+            path,
+            excludes,
+            precomputed_hash=_hash_for(tool_config),
+            project_tag=root,
+            **extra,
+        )
         tr = tool_config.parser_class(tool_config.parser_config).parse(raw_result)
         tr.duration_s = time.perf_counter() - t0
         return tool_config.order, tr
@@ -423,7 +444,9 @@ def run_tools(
             try:
                 prioritized.append(_run_and_parse(tool_config))
             except Exception as exc:  # noqa: BLE001 - a crashing tool must not abort the run
-                log.error(f"{tool_config.name} generated an exception: {exc} {exc.__traceback__}")
+                log.error(
+                    f"{tool_config.name} generated an exception: {exc} {exc.__traceback__}"
+                )
                 n_skipped = n_total - i - 1
                 if n_skipped:
                     remaining = ", ".join(tc.name for tc in sorted_configs[i + 1 :])
@@ -477,7 +500,10 @@ def run_tools(
                 _, dep_tr = dep_future.result()
             except Exception:  # noqa: BLE001 - a crashed dep cancels nothing
                 return
-            if dep_tr.metrics and min(dep_tr.metrics.values()) < dep_config.error_threshold:
+            if (
+                dep_tr.metrics
+                and min(dep_tr.metrics.values()) < dep_config.error_threshold
+            ):
                 log.debug(f"{name}: cancelling because {dep_config.name} failed")
                 ev.set()
 
@@ -485,8 +511,8 @@ def run_tools(
             if tc.name in cancel_events:
                 dep_config = configs_by_name[tc.skip_if]
                 name_to_future[tc.skip_if].add_done_callback(
-                    lambda fut, ev=cancel_events[tc.name], dc=dep_config, nm=tc.name: _cancel_on_dep_failure(
-                        fut, ev, dc, nm
+                    lambda fut, ev=cancel_events[tc.name], dc=dep_config, nm=tc.name: (
+                        _cancel_on_dep_failure(fut, ev, dc, nm)
                     )
                 )
         for future in as_completed(future_to_tool):

py_cq/localtypes.py

@@ -60,11 +60,8 @@ class ToolConfig:
         default_factory=list
     )  # Top-level dir/file names to omit from {scan_targets}
     skip_for_file: bool = False  # If True, skip when context_path is a single file
-    gate_strict: bool = True  # If False, small regressions above warning_threshold are accepted
     skip_if: str = ""  # Tool name; if that tool's score is below its error_threshold, skip this tool
-    cache_invariant: str = (
-        ""  # "ast": key the cache on the docstring-stripped AST, ignoring docstrings/comments/format
-    )
+    cache_invariant: str = ""  # "ast": key the cache on the docstring-stripped AST, ignoring docstrings/comments/format
 
 
 @dataclass

py_cq/parsers/common.py

@@ -47,9 +47,7 @@ def format_source_context(
     error_offset = line - context_start  # 0-based index of the error line in raw_lines
     collected = []
     for i, rline in enumerate(raw_lines):
-        if i > error_offset and (
-            rline.startswith(("def ", "async def ", "class "))
-        ):
+        if i > error_offset and (rline.startswith(("def ", "async def ", "class "))):
             break
         collected.append(f"{context_start + i}: {rline}")
     src = "\n".join(collected)

py_cq/parsers/interrogateparser.py

@@ -32,7 +32,10 @@ def _format_missing_docstring(file_str: str, line: int, code: str, message: str)
     )
 
     if code == "D100":
-        return base + "\n\nInsert a module-level docstring as the very first statement in the file."
+        return (
+            base
+            + "\n\nInsert a module-level docstring as the very first statement in the file."
+        )
 
     try:
         tree = get_source(file_str).tree
@@ -74,6 +77,7 @@ def _format_missing_docstring(file_str: str, line: int, code: str, message: str)
 
     return base + "\n\nInsert a docstring as the first statement in the body."
 
+
 _ROW_RE = re.compile(
     r"^\|\s+(.+?)\s+\|\s+(\d+)\s+\|\s+(\d+)\s+\|\s+\d+\s+\|\s+(\d+(?:\.\d+)?)%\s*\|"
 )
@@ -85,7 +89,9 @@ def _load_interrogate_cfg(context_path: str) -> dict:
     """Read [tool.interrogate] from the nearest pyproject.toml."""
     p = Path(context_path).resolve()
     for candidate in [p, *p.parents]:
-        pyproject = (candidate if candidate.is_dir() else candidate.parent) / "pyproject.toml"
+        pyproject = (
+            candidate if candidate.is_dir() else candidate.parent
+        ) / "pyproject.toml"
         if pyproject.exists():
             try:
                 data = tomllib.loads(pyproject.read_text(encoding="utf-8"))
@@ -109,7 +115,9 @@ def _skip_node(name: str, cfg: dict) -> bool:
     return bool(is_semiprivate and cfg.get("ignore-semiprivate"))
 
 
-def _missing_docstrings(file_path: Path, cfg: dict | None = None) -> list[tuple[int, str, str]]:
+def _missing_docstrings(
+    file_path: Path, cfg: dict | None = None
+) -> list[tuple[int, str, str]]:
     """Return (line, kind, source_line) for each node missing a docstring.
 
     kind is 'module', 'def', or 'class'. source_line is the verbatim text of

py_cq/parsers/kingfisherparser.py

@@ -0,0 +1,73 @@
+"""Parses output from the Kingfisher secret scanner into a standardized ToolResult.
+
+Kingfisher (``uv tool install kingfisher-bin``) is invoked with ``-f json`` and
+``--redact``, so the report on stdout never contains the secret itself, only a
+hash. ``--no-validate`` keeps it from sending findings to provider APIs.
+
+Each finding is listed against its file. The count becomes a logistic-variant
+score stored under the ``secrets`` metric key.
+
+When no report can be read (``kingfisher`` not on PATH) the tool reports no
+metric instead of a failing one.
+"""
+
+import json
+import logging
+
+from py_cq.localtypes import AbstractParser, RawResult, ToolResult
+from py_cq.parsers.common import extract_first_issue, score_logistic_variant
+
+log = logging.getLogger("cq")
+
+
+class KingfisherParser(AbstractParser):
+    """Parses raw JSON output from ``kingfisher scan -f json`` into a ToolResult."""
+
+    def parse(self, raw_result: RawResult) -> ToolResult:
+        """Parses the raw Kingfisher JSON report into a ToolResult."""
+        try:
+            findings = json.loads(raw_result.stdout)["findings"]
+        except (ValueError, KeyError, TypeError):
+            log.warning(
+                "kingfisher produced no report (return_code=%s), skipping. "
+                "Install it with `uv tool install kingfisher-bin`.",
+                raw_result.return_code,
+            )
+            return ToolResult(raw=raw_result)
+
+        files: dict[str, list] = {}
+        for entry in findings:
+            rule = entry.get("rule") or {}
+            finding = entry.get("finding") or {}
+            path = str(finding.get("path", "")).replace("\\", "/")
+            files.setdefault(path, []).append(
+                {
+                    "line": finding.get("line", 0),
+                    "code": rule.get("id", ""),
+                    "confidence": finding.get("confidence", ""),
+                    "message": rule.get("description", ""),
+                }
+            )
+
+        count = sum(len(issues) for issues in files.values())
+        score = score_logistic_variant(count, scale_factor=5)
+        return ToolResult(raw=raw_result, metrics={"secrets": score}, details=files)
+
+    def format_llm_message(
+        self, tr: ToolResult, *, context_lines: int = 15, limit: int = 1
+    ) -> str:
+        """Formats the first secret finding into an LLM-friendly message."""
+        result = extract_first_issue(tr.details)
+        if result is None:
+            return "kingfisher reported secrets (no details available)"
+        file, issue = result
+        line = issue.get("line", "?")
+        # No source excerpt: it would put the plaintext secret into the LLM prompt.
+        return (
+            f"{file}:{line} - {issue.get('code', '')}: "
+            f"[{issue.get('confidence', '')} confidence] {issue.get('message', '')}\n\n"
+            "Move the secret out of the source (environment variable or an untracked "
+            "file) and rotate it if it was ever committed. Only if it is an intentional "
+            "test fixture or a false positive, add a `kingfisher:ignore` comment on "
+            "that line."
+        )

py_cq/parsers/ruffformatparser.py

@@ -0,0 +1,62 @@
+"""Parses output from ruff format --check into a standardized ToolResult.
+
+The output is one line per unformatted file. ruff >= 0.16 honours
+``--output-format concise``::
+
+    <file>:<line>:<col>: unformatted: File would be reformatted
+
+while older versions ignore it (it needs preview mode) and print::
+
+    Would reformat: <file>
+
+Either is followed by a summary line such as
+``2 files would be reformatted, 30 files already formatted`` or
+``32 files already formatted``.
+
+The score is the fraction of checked files that are already formatted,
+taken from the summary so it stays correct if the per-file format changes."""
+
+import re
+
+from py_cq.localtypes import AbstractParser, RawResult, ToolResult
+from py_cq.parsers.common import extract_first_issue
+
+_FILE_RE = re.compile(r"^(?:Would reformat: (.+)|(.+):\d+:\d+: unformatted: .*)$")
+_FORMATTED_RE = re.compile(r"(\d+) files? already formatted")
+_UNFORMATTED_RE = re.compile(r"(\d+) files? would be reformatted")
+
+
+class RuffFormatParser(AbstractParser):
+    """Parses ``ruff format --check --output-format concise`` output into a ToolResult."""
+
+    def parse(self, raw_result: RawResult) -> ToolResult:
+        """Collect unformatted files and score the fraction already formatted."""
+        stdout = raw_result.stdout or ""
+        # One issue per file, with no line: the line ruff reports is the first
+        # diff hunk, which would make the fingerprint unstable across edits.
+        files: dict[str, list] = {}
+        for line in stdout.splitlines():
+            m = _FILE_RE.match(line)
+            if m:
+                files[(m.group(1) or m.group(2)).replace("\\", "/")] = [{}]
+        m = _FORMATTED_RE.search(stdout)
+        formatted = int(m.group(1)) if m else 0
+        m = _UNFORMATTED_RE.search(stdout)
+        unformatted = max(int(m.group(1)) if m else 0, len(files))
+        total = formatted + unformatted
+        score = formatted / total if total else 1.0
+        return ToolResult(raw=raw_result, metrics={"formatted": score}, details=files)
+
+    def format_llm_message(
+        self, tr: ToolResult, *, context_lines: int = 15, limit: int = 1
+    ) -> str:
+        """Ask for the formatter to be run rather than a hand edit."""
+        result = extract_first_issue(tr.details)
+        if result is None:
+            return "ruff format reported issues (no details available)"
+        file, _ = result
+        return (
+            f"{file} - **not formatted**. Run the formatter, do not edit by hand:\n\n"
+            f"```bash\nruff format {file}\n```\n\n"
+            "Other files may also need formatting; `ruff format .` fixes them all."
+        )

py_cq/parsers/uvauditparser.py

@@ -0,0 +1,88 @@
+"""Parses output from ``uv audit`` into a standardized ToolResult.
+
+``uv audit --output-format json`` checks the packages pinned in ``uv.lock``
+against the OSV advisory database and prints a JSON report on stdout.
+
+Only advisories with a fix version are counted: those are the ones an upgrade
+resolves. The same vulnerability is often listed once per advisory database
+(GHSA, PYSEC), so entries that alias one already seen for a package are
+dropped. The count becomes a logistic-variant score stored under the
+``dependencies`` metric key.
+
+When no report can be read (``uv`` missing, no ``pyproject.toml`` or
+``uv.lock``, no network) the tool reports no metric instead of a failing one.
+"""
+
+import json
+import logging
+
+from py_cq.localtypes import AbstractParser, RawResult, ToolResult
+from py_cq.parsers.common import extract_first_issue, score_logistic_variant
+
+log = logging.getLogger("cq")
+
+_LOCKFILE = "uv.lock"
+
+
+class UvAuditParser(AbstractParser):
+    """Parses raw JSON output from ``uv audit`` into a ToolResult."""
+
+    def parse(self, raw_result: RawResult) -> ToolResult:
+        """Parses the raw ``uv audit`` JSON report into a ToolResult."""
+        try:
+            vulnerabilities = json.loads(raw_result.stdout)["vulnerabilities"]
+        except (ValueError, KeyError, TypeError):
+            reason = (raw_result.stderr or "").strip().splitlines()[-1:]
+            log.warning(
+                "uv audit produced no report (return_code=%s), skipping: %s",
+                raw_result.return_code,
+                reason[0] if reason else "no output",
+            )
+            return ToolResult(raw=raw_result)
+
+        seen: set[tuple[str, str]] = set()
+        issues: list[dict] = []
+        for vuln in vulnerabilities:
+            fix_versions = [str(v) for v in vuln.get("fix_versions") or []]
+            if not fix_versions:
+                continue
+            dependency = vuln.get("dependency") or {}
+            package = dependency.get("name", "")
+            ids = {vuln.get("id", ""), *(vuln.get("aliases") or [])}
+            if any((package, i) in seen for i in ids):
+                continue
+            seen.update((package, i) for i in ids)
+            issues.append(
+                {
+                    "code": vuln.get("id", ""),
+                    "package": package,
+                    "version": dependency.get("version", ""),
+                    "fix_versions": fix_versions,
+                    "message": vuln.get("summary") or "",
+                    "link": vuln.get("link") or "",
+                }
+            )
+
+        score = score_logistic_variant(len(issues), scale_factor=5)
+        details = {_LOCKFILE: issues} if issues else {}
+        return ToolResult(
+            raw=raw_result, metrics={"dependencies": score}, details=details
+        )
+
+    def format_llm_message(
+        self, tr: ToolResult, *, context_lines: int = 15, limit: int = 1
+    ) -> str:
+        """Formats the first vulnerable dependency into an LLM-friendly message."""
+        result = extract_first_issue(tr.details)
+        if result is None:
+            return "uv audit reported issues (no details available)"
+        file, issue = result
+        package = issue.get("package", "")
+        fixed = ", ".join(issue.get("fix_versions", []))
+        message = (
+            f"{file} - {issue.get('code', '')}: **{package} {issue.get('version', '')}** "
+            f"has a known vulnerability: {issue.get('message', '')}\n\n"
+            f"Fixed in {fixed}. Upgrade with `uv lock --upgrade-package {package}`."
+        )
+        link = issue.get("link")
+        return f"{message}\n\n{link}" if link else message

py_cq/parsers/vultureparser.py

@@ -1,9 +1,14 @@
 """Parses output from vulture dead-code detector into a standardized ToolResult.
 
-Vulture is invoked with ``--min-confidence 80``, producing one text line
+Vulture is invoked with ``--min-confidence 60``, producing one text line
 per unused symbol::
 
-    src/foo.py:10: unused function 'bar' (80% confidence)
+    src/foo.py:10: unused function 'bar' (60% confidence)
+
+60% is the confidence vulture gives unused functions, classes, methods and
+variables, so anything higher only reports unused imports and unreachable
+code. At that level vulture cannot see dynamic use, so the LLM message for a
+finding below 80% says how to keep the symbol instead of deleting it.
 
 The parser counts violations and converts the count into a logistic-variant
 score stored under the ``dead_code`` metric key.
@@ -20,6 +25,13 @@ from py_cq.parsers.common import (
 
 _LINE_RE = re.compile(r"^(.+):(\d+): (unused \S+) '(.+)' \((\d+)% confidence\)$")
 
+_CERTAIN = 80
+_KEEP_HINT = (
+    "\n\nRemove it if nothing uses it. If it is public API or is used dynamically,"
+    ' keep it and add `"{name}"` to `ignore_names` under `[tool.vulture]` in'
+    " `pyproject.toml`."
+)
+
 
 class VultureParser(AbstractParser):
     """Parses raw text output from ``vulture`` into a ToolResult."""
@@ -55,4 +67,7 @@ class VultureParser(AbstractParser):
         kind = issue.get("type", "unused")
         name = issue.get("name", "")
         confidence = issue.get("confidence", "?")
-        return f"{file}:{line} - **{kind}** `{name}` ({confidence}% confidence){format_source_context(file, line, count=context_lines)}"
+        message = f"{file}:{line} - **{kind}** `{name}` ({confidence}% confidence){format_source_context(file, line, count=context_lines)}"
+        if isinstance(confidence, int) and confidence < _CERTAIN:
+            message += _KEEP_HINT.format(name=name)
+        return message

py_cq/runners/pytest_serial.py

@@ -0,0 +1,27 @@
+"""Run pytest in a single process, for the coverage tool.
+
+cq runs this script under ``coverage run``. Coverage only measures the process
+it starts, so if the target project enables pytest-xdist through its own
+``addopts``, the tests run in worker processes that coverage never sees and the
+coverage score collapses. Passing ``-n 0`` keeps the tests in this process. It
+is only passed when xdist is installed, because pytest rejects ``-n`` otherwise.
+
+The script runs in the target project's environment, so it imports only the
+standard library and pytest. It lives in its own directory because running a
+script puts that directory first on ``sys.path``; that entry is replaced with
+the working directory so imports behave as they do under ``python -m pytest``.
+"""
+
+import os
+import sys
+from importlib.util import find_spec
+
+if __name__ == "__main__":
+    sys.path[0] = os.getcwd()
+
+    import pytest
+
+    args = sys.argv[1:]
+    if find_spec("xdist") is not None:
+        args += ["-n", "0"]
+    sys.exit(pytest.main(args))

py_cq/tool_registry.py

@@ -32,7 +32,6 @@ def load_tool_configs() -> dict[str, ToolConfig]:
             exclude_format=tool_data.get("exclude_format", ""),
             scan_exclude_names=tool_data.get("scan_exclude_names", []),
             skip_for_file=tool_data.get("skip_for_file", False),
-            gate_strict=tool_data.get("gate_strict", True),
             skip_if=tool_data.get("skip_if", ""),
             cache_invariant=tool_data.get("cache_invariant", ""),
         )

{python_code_quality-0.3.0.dist-info → python_code_quality-0.4.0.dist-info}/METADATA

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: python-code-quality
-Version: 0.3.0
-Summary: Python Code Quality Analysis Tool - feed the results from 11 CQ tools straight into an LLM. Minimal tokens.
+Version: 0.4.0
+Summary: Python Code Quality Analysis Tool - feed the results from 14 CQ tools straight into an LLM. Minimal tokens.
 Author: Chris Kilner
 Author-email: Chris Kilner <chris@rhiza.fr>
 License-Expression: MIT
@@ -35,7 +35,7 @@ Description-Content-Type: text/markdown
 [![Python versions](https://img.shields.io/pypi/pyversions/python-code-quality?)](https://pypi.org/project/python-code-quality/)
 [![License](https://img.shields.io/github/license/rhiza-fr/py-cq)](LICENSE)
 
-Run 11+ code quality tools, aggregate results into one score, and surface the single most critical defect as a focused markdown prompt — ready to pipe to any LLM.
+Run 14 code quality tools, aggregate results into one score, and surface the single most critical defect as a focused markdown prompt — ready to pipe to any LLM.
 
 This can dramatically reduce the amount of noise for LLMs (and humans) and remove the need for them to know about these tools.
 
@@ -74,15 +74,24 @@ When running '-o llm', we run sequentially and exit early at the first error.
 | 2 | ruff | Lint / style |
 | 3 | ty | Type errors |
 | 4 | bandit | Security vulnerabilities |
-| 5 | pytest | Test pass rate |
-| 6 | coverage | Test coverage |
-| 7 | vulture | Dead code |
-| 8 | interrogate | Docstring coverage |
-| 9 | radon cc | Cyclomatic complexity |
-| 10 | radon mi | Maintainability index |
-| 11 | radon hal | Halstead volume / bug estimate |
+| 5 | kingfisher | Hardcoded secrets (API keys, tokens, private keys) |
+| 6 | uv audit | Known vulnerabilities in locked dependencies |
+| 7 | pytest | Test pass rate |
+| 8 | coverage | Test coverage |
+| 9 | vulture | Dead code |
+| 10 | interrogate | Docstring coverage |
+| 11 | radon cc | Cyclomatic complexity |
+| 12 | radon mi | Maintainability index |
+| 13 | radon hal | Halstead volume / bug estimate |
+| 14 | ruff format | Formatting (fraction of files already formatted) |
 
-Diskcache is used to cache tool output for lightning fast re-runs. Sane defaults: <100 Mb, <5 days, No pickle risk.
+`kingfisher` scans the working tree for hardcoded secrets with [Kingfisher](https://github.com/mongodb/kingfisher) (502 rules, Rust). It is not a Python dependency of cq: install it once with `uv tool install kingfisher-bin` (about 41 MB). When it is not on the `PATH` the tool is skipped with a warning. cq runs it offline (`--no-validate --no-update-check`) and with `--redact`, so secrets are never sent to provider APIs and never stored in the cache; the LLM message gives the file, line and rule but no source excerpt. Silence a test fixture or false positive with a `kingfisher:ignore` comment on that line.
+
+`uv audit` checks the versions pinned in `uv.lock` against the OSV advisory database. It needs `uv` on the `PATH`, a `uv.lock` and network access; when any is missing the tool is skipped with a warning instead of failing. Only advisories that have a fix version are reported, since those are the ones an upgrade resolves. Results are cached like every other tool, so an advisory published after a run shows up when the project changes or the cache entry expires.
+
+`vulture` runs at `--min-confidence 60`, the level at which it reports unused functions, classes, methods and variables. It cannot see dynamic use, so common framework decorators (`@app.command`, `@app.route`, `@pytest.fixture`, validators and similar) are ignored. For anything else that is used but never referenced by name, such as public API, add it to `ignore_names` under `[tool.vulture]` in your `pyproject.toml`.
+
+Diskcache is used to cache tool output for lightning fast re-runs. Sane defaults: <100 Mb, <5 days, stored as JSON (cq never writes pickles).
 
 
 ## Usage
@@ -101,7 +110,7 @@ cq check . --exclude demo  # Exclude paths from all tools
 cq check . --workers 1     # Run sequentially if you like things slow
 cq check . --clear-cache   # Clear cached results before running (rarely needed)
 cq check . -o llm --hint   # Append "run cq again to verify" (for human workflows)
-cq config path/to/project/ # Show effective tool configuration
+cq config --path path/to/project/ # Show effective tool configuration
 cq is-fixed <fingerprint>  # Check whether a specific issue has been resolved
 ```
 
@@ -248,16 +257,18 @@ Then invoke it with `/cq-fix` in Claude Code. The `$(...)` embeds the live `cq`
 │ ruff             │    0.17s │                      lint │ 1.000   │ OK       │
 │ ty               │    0.33s │                type_check │ 1.000   │ OK       │
 │ bandit           │    0.56s │                  security │ 1.000   │ OK       │
+│ uv-audit         │    0.41s │              dependencies │ 1.000   │ OK       │
 │ pytest           │    0.91s │                     tests │ 1.000   │ OK       │
 │ coverage         │    1.26s │                  coverage │ 0.910   │ OK       │
-│ radon cc         │    0.32s │                simplicity │ 0.982   │ OK       │
-│ radon mi         │    0.38s │           maintainability │ 0.869   │ OK       │
-│ radon hal        │    0.30s │             file_bug_free │ 0.928   │ OK       │
-│ radon hal        │          │            file_smallness │ 0.851   │ OK       │
-│ radon hal        │          │        functions_bug_free │ 0.913   │ OK       │
-│ radon hal        │          │       functions_smallness │ 0.724   │ OK       │
 │ vulture          │    0.32s │                 dead_code │ 1.000   │ OK       │
 │ interrogate      │    0.36s │              doc_coverage │ 1.000   │ OK       │
+│ radon-cc         │    0.32s │                simplicity │ 0.982   │ OK       │
+│ radon-mi         │    0.38s │           maintainability │ 0.869   │ OK       │
+│ radon-hal        │    0.30s │             file_bug_free │ 0.928   │ OK       │
+│ radon-hal        │          │            file_smallness │ 0.851   │ OK       │
+│ radon-hal        │          │        functions_bug_free │ 0.913   │ OK       │
+│ radon-hal        │          │       functions_smallness │ 0.724   │ OK       │
+│ ruff-format      │    0.12s │                 formatted │ 1.000   │ OK       │
 │                  │          │                     Score │ 0.965   │          │
 └──────────────────┴──────────┴───────────────────────────┴─────────┴──────────┘
 ```
@@ -339,7 +350,7 @@ warning = 0.9
 error = 0.7
 ```
 
-Tool IDs match the keys in `src/py_cq/config/config.toml`: `compile`, `ruff`, `ty`, `bandit`, `pytest`, `coverage`, `radon-cc`, `radon-mi`, `radon-hal`, `vulture`, `interrogate`.
+Tool IDs match the keys in `src/py_cq/config/config.toml`: `compile`, `ruff`, `ty`, `bandit`, `kingfisher`, `uv-audit`, `pytest`, `coverage`, `radon-cc`, `radon-mi`, `radon-hal`, `vulture`, `interrogate`, `ruff-format`.
 
 
 ### Default config
@@ -356,8 +367,8 @@ error_threshold = 0.9999
 cache_invariant = "ast"
 
 [python.ruff]
-command = "{python} -m ruff check --output-format concise --no-cache \"{context_path}\" --exclude .claude{exclude}"
-exclude_format = " --exclude {path}"
+command = "{python} -m ruff check --output-format concise --no-cache \"{context_path}\" --extend-exclude .claude{exclude}"
+exclude_format = " --extend-exclude {path}"
 parser = "RuffParser"
 order = 2
 warning_threshold = 0.9999
@@ -382,11 +393,27 @@ order = 4
 warning_threshold = 0.9999
 error_threshold = 0.8
 
+[python.kingfisher]
+command = "kingfisher scan \"{context_path}\" --no-validate --no-update-check --git-history none --no-extract-archives --redact -q -f json --exclude .venv --exclude .git --exclude .hypothesis --exclude dist --exclude \"*_cache\" --exclude __pycache__ --exclude .claude{exclude}"
+exclude_format = " --exclude {path}"
+parser = "KingfisherParser"
+order = 5
+warning_threshold = 0.9999
+error_threshold = 0.9999
+
+[python.uv-audit]
+command = "uv audit --project \"{abs_context_path}\" --frozen --output-format json"
+parser = "UvAuditParser"
+order = 6
+warning_threshold = 0.9999
+error_threshold = 0.8
+skip_for_file = true
+
 [python.pytest]
 command = "{python} -m pytest -vv \"{context_path}\" --ignore .claude{exclude}"
 exclude_format = " --ignore {path}"
 parser = "PytestParser"
-order = 5
+order = 7
 warning_threshold = 1.0
 error_threshold = 1.0
 run_in_target_env = true
@@ -395,10 +422,10 @@ skip_for_file = true
 cache_invariant = "ast"
 
 [python.coverage]
-command = "{python} -m coverage run --omit=*/tests/*,*/test_*.py -m pytest \"{context_path}\" --ignore .claude{exclude} && {python} -m coverage report --show-missing --omit=*/tests/*,*/test_*.py"
+command = "{python} -m coverage run --omit=*/tests/*,*/test_*.py,*/py_cq/runners/* \"{pytest_serial}\" \"{context_path}\" --ignore .claude{exclude} && {python} -m coverage report --show-missing --omit=*/tests/*,*/test_*.py,*/py_cq/runners/*"
 exclude_format = " --ignore {path}"
 parser = "CoverageParser"
-order = 6
+order = 8
 warning_threshold = 0.9
 error_threshold = 0.5
 run_in_target_env = true
@@ -408,19 +435,19 @@ skip_if = "pytest"
 cache_invariant = "ast"
 
 [python.vulture]
-command = "{python} -m vulture \"{context_path}\" --min-confidence 80 --exclude .venv,dist,.*_cache,docs,.git,.claude{exclude}"
+command = "{python} -m vulture \"{context_path}\" --min-confidence 60 --ignore-decorators \"@*.command,@*.callback,@*.route,@*.get,@*.post,@*.put,@*.delete,@*.patch,@*fixture,@*.task,@*hookimpl,@*validator,@*.errorhandler\" --exclude .venv,dist,.*_cache,docs,.git,.claude{exclude}"
 exclude_format = ",{path}"
 parser = "VultureParser"
-order = 7
+order = 9
 warning_threshold = 0.9999
 error_threshold = 0.8
 cache_invariant = "ast"
 
 [python.interrogate]
-command = "{python} -m interrogate \"{context_path}\" -e .claude{exclude} -v --fail-under 0"
+command = "{python} -m interrogate \"{context_path}\" -e .claude -e \"{context_path}/tests\"{exclude} -v --fail-under 0"
 exclude_format = " -e {path}"
 parser = "InterrogateParser"
-order = 8
+order = 10
 warning_threshold = 0.8
 error_threshold = 0.5
 
@@ -430,26 +457,31 @@ skip_empty_init = true
 [python.radon-cc]
 command = "{python} -m radon cc --json --exclude '.claude/**' \"{context_path}\""
 parser = "ComplexityParser"
-order = 9
-gate_strict = false
+order = 11
 warning_threshold = 0.6
 error_threshold = 0.4
 
 [python.radon-mi]
 command = "{python} -m radon mi -s --json --exclude '.claude/**' \"{context_path}\""
 parser = "MaintainabilityParser"
-order = 10
-gate_strict = false
+order = 12
 warning_threshold = 0.6
 error_threshold = 0.4
 
 [python.radon-hal]
 command = "{python} -m radon hal -f --json --exclude '.claude/**' \"{context_path}\""
 parser = "HalsteadParser"
-order = 11
-gate_strict = false
+order = 13
 warning_threshold = 0.35
 error_threshold = 0.3
+
+[python.ruff-format]
+command = "{python} -m ruff format --check --output-format concise --no-cache \"{context_path}\" --extend-exclude .claude --config \"include=['*.py','*.pyi','*.ipynb']\"{exclude}"
+exclude_format = " --extend-exclude {path}"
+parser = "RuffFormatParser"
+order = 14
+warning_threshold = 0.9999
+error_threshold = 0.5
 ```
 
 ## Respect

{python_code_quality-0.3.0.dist-info → python_code_quality-0.4.0.dist-info}/RECORD

@@ -1,36 +1,40 @@
 py_cq/__init__.py,sha256=-C6_QzQeydxft3ndlExTgWnvlqH8fJNPJxfySXULQmU,56
-py_cq/api.py,sha256=AxhTQVX4ACZmgCpdfJgB2_1VXtClxc531NkRoLK1vA0,10118
-py_cq/cli.py,sha256=aaLnBXF81fkUtCvO7DGzmogcq50X5bF5dC4XFC4sbqY,13814
+py_cq/api.py,sha256=u0ajk6ZYWFGjSsLYkRfUBBtL_Vw0HHZbWpa1AM79y8Y,10172
+py_cq/cli.py,sha256=i_-VCXVzrj2kpzbx8lEJxWmQNFyiFa37nsCMMkxqvas,13827
 py_cq/config/__init__.py,sha256=f0wc51O_3kGDTZUnCbGv8_zWnC5yYGl4NWcf2buSImQ,670
-py_cq/config/config.toml,sha256=fco0qKWfIg84e3ex2pmAcSPYBmcHdbiqL-Geo__EIkM,3017
+py_cq/config/config.toml,sha256=iV0kUp6ifZvHu_3fyNyC6C3Ggv7ts1zhopU0-3LH1U4,4170
 py_cq/context_hash.py,sha256=uKMkN394v6QYMukZj9usbxnq8px3i1khyIRPKwe09DE,5614
-py_cq/execution_engine.py,sha256=vAbNDCHP5c-2ADWs9SM0eCEpZBiabhpl-WZp6Er3qb4,20644
+py_cq/execution_engine.py,sha256=1-AM1PbIAdizj-PGf3cmePMKGmsV4pk6K2YgDHyerdA,21279
 py_cq/language_detector.py,sha256=rh5bAA3LyCQR3RODmx_EalqRNYvSYK2SJzh2hIkxOUo,1139
 py_cq/llm_formatter.py,sha256=nCV3nFdxJAi2CnH9FKb5tB-0w-yjLWmjywQI5GJ2cSU,8412
-py_cq/localtypes.py,sha256=mt4sqUg1bz2BenirGA18X4CdtyZahTAuKyOfwFnwfSE,7907
+py_cq/localtypes.py,sha256=-XxoasKVOQ6hLzNX2KdpTxxHu3F2c_9RV3DCLPPj0D0,7794
 py_cq/main.py,sha256=5dgr8Zk1LNK5M-0wncYVksBp0qE-jWZYqmOXfb1eOhk,400
 py_cq/metric_aggregator.py,sha256=M2ymo62S7p7qPUqjjoiPg4IVyXQhLMuTr9-jxLiFjCY,853
 py_cq/parsers/__init__.py,sha256=uCy7R0cnvDPNvB5aWMLgM3FB9nDcu1jwUmznFMRROSY,28
 py_cq/parsers/banditparser.py,sha256=YqpWljU5D4IhLdtzat7XVGBm9NXrbOQbr9LI9NKybK8,3298
-py_cq/parsers/common.py,sha256=r8UD7pch-txlJSTsJrOff2o3_0WHRlZhgKbJ-C58L7g,13818
+py_cq/parsers/common.py,sha256=ViYneYOG4RTlbHbSU4GN9kB_M1gikukiwQ81CTajAqA,13796
 py_cq/parsers/compileparser.py,sha256=jl0DloyXTKqVHRIUft-t5lvJOndY-PdLPrXB38v9zuA,6927
 py_cq/parsers/complexityparser.py,sha256=mX1WHPRgBBc6kOqHfubowRbYXY0E1k4JVwr908Cj10U,5582
 py_cq/parsers/coverageparser.py,sha256=QGjZ8JJF0G-0uiZ07BzxSnblGiysHtOwq0SYvWrtOhA,7441
 py_cq/parsers/exitcodeparser.py,sha256=b4LWIwwklPwCX3MnqNsGQC1slQU56DKE05vJ0OdWVoA,957
 py_cq/parsers/halsteadparser.py,sha256=789c_WWfomskM4i7SUEbKvB67-F2y5nfqt48aFXOusY,10192
-py_cq/parsers/interrogateparser.py,sha256=55HZ2j1Rz34eremwGx-W9oIMI21DIqwxEG524UgsAhk,11249
+py_cq/parsers/interrogateparser.py,sha256=KDqXTdnJ5JzWhN4ziRda90nZCQOJaKn3CCiq4Rh0IRw,11314
+py_cq/parsers/kingfisherparser.py,sha256=-UbtZ4d_SAPoohgz9FwcVE4u33VB_8FtE1_dhAwJ1VM,3129
 py_cq/parsers/linecountparser.py,sha256=-hqebwG4j7_QugzGLUUQRcPukGHicV2nbIp1pR8ZcAw,1310
 py_cq/parsers/maintainabilityparser.py,sha256=3a4m93XNtUurw3IxEI1Iae9idgJY6qiEt7HMYl1wTu0,4793
 py_cq/parsers/pytestparser.py,sha256=cIaTs2XxgeJlVragLEVTZcrbB-bzfNYYMdUrakRa-rQ,11545
 py_cq/parsers/regexcountparser.py,sha256=zGzHEYDIori6aiWnVkRFixdE7fWt66npAAWjzvpoBF4,1592
+py_cq/parsers/ruffformatparser.py,sha256=UXff5Qwh9i0goiSTJ_AaaIsmMSssUjNY2O_dERXjsFw,2636
 py_cq/parsers/ruffparser.py,sha256=uE0QEaZ4Ch7IsWY_2ZkfHXPU0TYPGsGPfv66hGe5G34,7634
 py_cq/parsers/typarser.py,sha256=x835OrapG1aUteW2NhC5U0bhj1w1pMtbfmbvb74-1AI,8077
-py_cq/parsers/vultureparser.py,sha256=-yGAXzRY4_fzLRTk7dfwDrrRZ-n97j1Ph5_xo3c6TfU,2229
+py_cq/parsers/uvauditparser.py,sha256=rnNLp4UD48utALr-ut1fCt3CKIu5Q80x75ws5s6ArqI,3652
+py_cq/parsers/vultureparser.py,sha256=C3teaMYtROHqFrXHBvTvLMK9jbDK5Q8X4gAq5ruNTGM,2889
 py_cq/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+py_cq/runners/pytest_serial.py,sha256=lhhkaKdwrgPzP3uKnHAfNgEE0iETjbvVh9xc23pbkXo,1026
 py_cq/source_file.py,sha256=Uyv-CSVeliFnE6TpRB4Y15ykFQs4n0r9-amzxXXlqN0,7562
 py_cq/table_formatter.py,sha256=-22nzVIOaDe3QOBmZ2iBPH7ewIEIPEn5WYSjCoB4Hj4,1608
-py_cq/tool_registry.py,sha256=0s0sD9_iQW-HU0SIKSS8CFDlrzW0c-vlYrAFODEHiSc,1894
-python_code_quality-0.3.0.dist-info/WHEEL,sha256=ZFFp7t7R4RYQ5KYZkmiFWoQvHay7SrTmn-6ZYfoFZ3U,80
-python_code_quality-0.3.0.dist-info/entry_points.txt,sha256=cfWbTw7eYO6Trv1-Z_odL6Zta9CqYU6Vk9lAHdfB60Q,40
-python_code_quality-0.3.0.dist-info/METADATA,sha256=hQBSoblR8TKmTPRriXRt5Ed-uO9jexstNj0nPU4Li4A,16213
-python_code_quality-0.3.0.dist-info/RECORD,,
+py_cq/tool_registry.py,sha256=1LkaBzWu5NzbaEZdZp1JLGFXZpEyke4pHHe01UvcfPo,1834
+python_code_quality-0.4.0.dist-info/WHEEL,sha256=3OmCxFA0ffBIsX4x0o8CdfSvZAOvO3mzEG8U_z5TvV4,80
+python_code_quality-0.4.0.dist-info/entry_points.txt,sha256=cfWbTw7eYO6Trv1-Z_odL6Zta9CqYU6Vk9lAHdfB60Q,40
+python_code_quality-0.4.0.dist-info/METADATA,sha256=nHEPvS1bYCSgE-ev1QYGHOfdUehL8cEqv8CMCtVr89Y,19336
+python_code_quality-0.4.0.dist-info/RECORD,,

{python_code_quality-0.3.0.dist-info → python_code_quality-0.4.0.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: uv 0.12.7
+Generator: uv 0.13.8
 Root-Is-Purelib: true
 Tag: py3-none-any