python-code-quality 0.3.1__tar.gz → 0.4.0__tar.gz

{python_code_quality-0.3.1 → python_code_quality-0.4.0}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: python-code-quality
-Version: 0.3.1
-Summary: Python Code Quality Analysis Tool - feed the results from 12 CQ tools straight into an LLM. Minimal tokens.
+Version: 0.4.0
+Summary: Python Code Quality Analysis Tool - feed the results from 14 CQ tools straight into an LLM. Minimal tokens.
 Author: Chris Kilner
 Author-email: Chris Kilner <chris@rhiza.fr>
 License-Expression: MIT
@@ -35,7 +35,7 @@ Description-Content-Type: text/markdown
 [![Python versions](https://img.shields.io/pypi/pyversions/python-code-quality?)](https://pypi.org/project/python-code-quality/)
 [![License](https://img.shields.io/github/license/rhiza-fr/py-cq)](LICENSE)
 
-Run 12 code quality tools, aggregate results into one score, and surface the single most critical defect as a focused markdown prompt — ready to pipe to any LLM.
+Run 14 code quality tools, aggregate results into one score, and surface the single most critical defect as a focused markdown prompt — ready to pipe to any LLM.
 
 This can dramatically reduce the amount of noise for LLMs (and humans) and remove the need for them to know about these tools.
 
@@ -74,16 +74,24 @@ When running '-o llm', we run sequentially and exit early at the first error.
 | 2 | ruff | Lint / style |
 | 3 | ty | Type errors |
 | 4 | bandit | Security vulnerabilities |
-| 5 | pytest | Test pass rate |
-| 6 | coverage | Test coverage |
-| 7 | vulture | Dead code |
-| 8 | interrogate | Docstring coverage |
-| 9 | radon cc | Cyclomatic complexity |
-| 10 | radon mi | Maintainability index |
-| 11 | radon hal | Halstead volume / bug estimate |
-| 12 | ruff format | Formatting (fraction of files already formatted) |
+| 5 | kingfisher | Hardcoded secrets (API keys, tokens, private keys) |
+| 6 | uv audit | Known vulnerabilities in locked dependencies |
+| 7 | pytest | Test pass rate |
+| 8 | coverage | Test coverage |
+| 9 | vulture | Dead code |
+| 10 | interrogate | Docstring coverage |
+| 11 | radon cc | Cyclomatic complexity |
+| 12 | radon mi | Maintainability index |
+| 13 | radon hal | Halstead volume / bug estimate |
+| 14 | ruff format | Formatting (fraction of files already formatted) |
 
-Diskcache is used to cache tool output for lightning fast re-runs. Sane defaults: <100 Mb, <5 days, No pickle risk.
+`kingfisher` scans the working tree for hardcoded secrets with [Kingfisher](https://github.com/mongodb/kingfisher) (502 rules, Rust). It is not a Python dependency of cq: install it once with `uv tool install kingfisher-bin` (about 41 MB). When it is not on the `PATH` the tool is skipped with a warning. cq runs it offline (`--no-validate --no-update-check`) and with `--redact`, so secrets are never sent to provider APIs and never stored in the cache; the LLM message gives the file, line and rule but no source excerpt. Silence a test fixture or false positive with a `kingfisher:ignore` comment on that line.
+
+`uv audit` checks the versions pinned in `uv.lock` against the OSV advisory database. It needs `uv` on the `PATH`, a `uv.lock` and network access; when any is missing the tool is skipped with a warning instead of failing. Only advisories that have a fix version are reported, since those are the ones an upgrade resolves. Results are cached like every other tool, so an advisory published after a run shows up when the project changes or the cache entry expires.
+
+`vulture` runs at `--min-confidence 60`, the level at which it reports unused functions, classes, methods and variables. It cannot see dynamic use, so common framework decorators (`@app.command`, `@app.route`, `@pytest.fixture`, validators and similar) are ignored. For anything else that is used but never referenced by name, such as public API, add it to `ignore_names` under `[tool.vulture]` in your `pyproject.toml`.
+
+Diskcache is used to cache tool output for lightning fast re-runs. Sane defaults: <100 Mb, <5 days, stored as JSON (cq never writes pickles).
 
 
 ## Usage
@@ -249,6 +257,7 @@ Then invoke it with `/cq-fix` in Claude Code. The `$(...)` embeds the live `cq`
 │ ruff             │    0.17s │                      lint │ 1.000   │ OK       │
 │ ty               │    0.33s │                type_check │ 1.000   │ OK       │
 │ bandit           │    0.56s │                  security │ 1.000   │ OK       │
+│ uv-audit         │    0.41s │              dependencies │ 1.000   │ OK       │
 │ pytest           │    0.91s │                     tests │ 1.000   │ OK       │
 │ coverage         │    1.26s │                  coverage │ 0.910   │ OK       │
 │ vulture          │    0.32s │                 dead_code │ 1.000   │ OK       │
@@ -341,7 +350,7 @@ warning = 0.9
 error = 0.7
 ```
 
-Tool IDs match the keys in `src/py_cq/config/config.toml`: `compile`, `ruff`, `ty`, `bandit`, `pytest`, `coverage`, `radon-cc`, `radon-mi`, `radon-hal`, `vulture`, `interrogate`, `ruff-format`.
+Tool IDs match the keys in `src/py_cq/config/config.toml`: `compile`, `ruff`, `ty`, `bandit`, `kingfisher`, `uv-audit`, `pytest`, `coverage`, `radon-cc`, `radon-mi`, `radon-hal`, `vulture`, `interrogate`, `ruff-format`.
 
 
 ### Default config
@@ -358,8 +367,8 @@ error_threshold = 0.9999
 cache_invariant = "ast"
 
 [python.ruff]
-command = "{python} -m ruff check --output-format concise --no-cache \"{context_path}\" --exclude .claude{exclude}"
-exclude_format = " --exclude {path}"
+command = "{python} -m ruff check --output-format concise --no-cache \"{context_path}\" --extend-exclude .claude{exclude}"
+exclude_format = " --extend-exclude {path}"
 parser = "RuffParser"
 order = 2
 warning_threshold = 0.9999
@@ -384,11 +393,27 @@ order = 4
 warning_threshold = 0.9999
 error_threshold = 0.8
 
+[python.kingfisher]
+command = "kingfisher scan \"{context_path}\" --no-validate --no-update-check --git-history none --no-extract-archives --redact -q -f json --exclude .venv --exclude .git --exclude .hypothesis --exclude dist --exclude \"*_cache\" --exclude __pycache__ --exclude .claude{exclude}"
+exclude_format = " --exclude {path}"
+parser = "KingfisherParser"
+order = 5
+warning_threshold = 0.9999
+error_threshold = 0.9999
+
+[python.uv-audit]
+command = "uv audit --project \"{abs_context_path}\" --frozen --output-format json"
+parser = "UvAuditParser"
+order = 6
+warning_threshold = 0.9999
+error_threshold = 0.8
+skip_for_file = true
+
 [python.pytest]
 command = "{python} -m pytest -vv \"{context_path}\" --ignore .claude{exclude}"
 exclude_format = " --ignore {path}"
 parser = "PytestParser"
-order = 5
+order = 7
 warning_threshold = 1.0
 error_threshold = 1.0
 run_in_target_env = true
@@ -397,10 +422,10 @@ skip_for_file = true
 cache_invariant = "ast"
 
 [python.coverage]
-command = "{python} -m coverage run --omit=*/tests/*,*/test_*.py -m pytest \"{context_path}\" --ignore .claude{exclude} && {python} -m coverage report --show-missing --omit=*/tests/*,*/test_*.py"
+command = "{python} -m coverage run --omit=*/tests/*,*/test_*.py,*/py_cq/runners/* \"{pytest_serial}\" \"{context_path}\" --ignore .claude{exclude} && {python} -m coverage report --show-missing --omit=*/tests/*,*/test_*.py,*/py_cq/runners/*"
 exclude_format = " --ignore {path}"
 parser = "CoverageParser"
-order = 6
+order = 8
 warning_threshold = 0.9
 error_threshold = 0.5
 run_in_target_env = true
@@ -410,19 +435,19 @@ skip_if = "pytest"
 cache_invariant = "ast"
 
 [python.vulture]
-command = "{python} -m vulture \"{context_path}\" --min-confidence 80 --exclude .venv,dist,.*_cache,docs,.git,.claude{exclude}"
+command = "{python} -m vulture \"{context_path}\" --min-confidence 60 --ignore-decorators \"@*.command,@*.callback,@*.route,@*.get,@*.post,@*.put,@*.delete,@*.patch,@*fixture,@*.task,@*hookimpl,@*validator,@*.errorhandler\" --exclude .venv,dist,.*_cache,docs,.git,.claude{exclude}"
 exclude_format = ",{path}"
 parser = "VultureParser"
-order = 7
+order = 9
 warning_threshold = 0.9999
 error_threshold = 0.8
 cache_invariant = "ast"
 
 [python.interrogate]
-command = "{python} -m interrogate \"{context_path}\" -e .claude{exclude} -v --fail-under 0"
+command = "{python} -m interrogate \"{context_path}\" -e .claude -e \"{context_path}/tests\"{exclude} -v --fail-under 0"
 exclude_format = " -e {path}"
 parser = "InterrogateParser"
-order = 8
+order = 10
 warning_threshold = 0.8
 error_threshold = 0.5
 
@@ -432,33 +457,29 @@ skip_empty_init = true
 [python.radon-cc]
 command = "{python} -m radon cc --json --exclude '.claude/**' \"{context_path}\""
 parser = "ComplexityParser"
-order = 9
-gate_strict = false
+order = 11
 warning_threshold = 0.6
 error_threshold = 0.4
 
 [python.radon-mi]
 command = "{python} -m radon mi -s --json --exclude '.claude/**' \"{context_path}\""
 parser = "MaintainabilityParser"
-order = 10
-gate_strict = false
+order = 12
 warning_threshold = 0.6
 error_threshold = 0.4
 
 [python.radon-hal]
 command = "{python} -m radon hal -f --json --exclude '.claude/**' \"{context_path}\""
 parser = "HalsteadParser"
-order = 11
-gate_strict = false
+order = 13
 warning_threshold = 0.35
 error_threshold = 0.3
 
 [python.ruff-format]
-command = "{python} -m ruff format --check --output-format concise --no-cache \"{context_path}\" --exclude .claude --config \"include=['*.py','*.pyi','*.ipynb']\"{exclude}"
-exclude_format = " --exclude {path}"
+command = "{python} -m ruff format --check --output-format concise --no-cache \"{context_path}\" --extend-exclude .claude --config \"include=['*.py','*.pyi','*.ipynb']\"{exclude}"
+exclude_format = " --extend-exclude {path}"
 parser = "RuffFormatParser"
-order = 12
-gate_strict = false
+order = 14
 warning_threshold = 0.9999
 error_threshold = 0.5
 ```

{python_code_quality-0.3.1 → python_code_quality-0.4.0}/README.md

@@ -6,7 +6,7 @@
 [![Python versions](https://img.shields.io/pypi/pyversions/python-code-quality?)](https://pypi.org/project/python-code-quality/)
 [![License](https://img.shields.io/github/license/rhiza-fr/py-cq)](LICENSE)
 
-Run 12 code quality tools, aggregate results into one score, and surface the single most critical defect as a focused markdown prompt — ready to pipe to any LLM.
+Run 14 code quality tools, aggregate results into one score, and surface the single most critical defect as a focused markdown prompt — ready to pipe to any LLM.
 
 This can dramatically reduce the amount of noise for LLMs (and humans) and remove the need for them to know about these tools.
 
@@ -45,16 +45,24 @@ When running '-o llm', we run sequentially and exit early at the first error.
 | 2 | ruff | Lint / style |
 | 3 | ty | Type errors |
 | 4 | bandit | Security vulnerabilities |
-| 5 | pytest | Test pass rate |
-| 6 | coverage | Test coverage |
-| 7 | vulture | Dead code |
-| 8 | interrogate | Docstring coverage |
-| 9 | radon cc | Cyclomatic complexity |
-| 10 | radon mi | Maintainability index |
-| 11 | radon hal | Halstead volume / bug estimate |
-| 12 | ruff format | Formatting (fraction of files already formatted) |
+| 5 | kingfisher | Hardcoded secrets (API keys, tokens, private keys) |
+| 6 | uv audit | Known vulnerabilities in locked dependencies |
+| 7 | pytest | Test pass rate |
+| 8 | coverage | Test coverage |
+| 9 | vulture | Dead code |
+| 10 | interrogate | Docstring coverage |
+| 11 | radon cc | Cyclomatic complexity |
+| 12 | radon mi | Maintainability index |
+| 13 | radon hal | Halstead volume / bug estimate |
+| 14 | ruff format | Formatting (fraction of files already formatted) |
 
-Diskcache is used to cache tool output for lightning fast re-runs. Sane defaults: <100 Mb, <5 days, No pickle risk.
+`kingfisher` scans the working tree for hardcoded secrets with [Kingfisher](https://github.com/mongodb/kingfisher) (502 rules, Rust). It is not a Python dependency of cq: install it once with `uv tool install kingfisher-bin` (about 41 MB). When it is not on the `PATH` the tool is skipped with a warning. cq runs it offline (`--no-validate --no-update-check`) and with `--redact`, so secrets are never sent to provider APIs and never stored in the cache; the LLM message gives the file, line and rule but no source excerpt. Silence a test fixture or false positive with a `kingfisher:ignore` comment on that line.
+
+`uv audit` checks the versions pinned in `uv.lock` against the OSV advisory database. It needs `uv` on the `PATH`, a `uv.lock` and network access; when any is missing the tool is skipped with a warning instead of failing. Only advisories that have a fix version are reported, since those are the ones an upgrade resolves. Results are cached like every other tool, so an advisory published after a run shows up when the project changes or the cache entry expires.
+
+`vulture` runs at `--min-confidence 60`, the level at which it reports unused functions, classes, methods and variables. It cannot see dynamic use, so common framework decorators (`@app.command`, `@app.route`, `@pytest.fixture`, validators and similar) are ignored. For anything else that is used but never referenced by name, such as public API, add it to `ignore_names` under `[tool.vulture]` in your `pyproject.toml`.
+
+Diskcache is used to cache tool output for lightning fast re-runs. Sane defaults: <100 Mb, <5 days, stored as JSON (cq never writes pickles).
 
 
 ## Usage
@@ -220,6 +228,7 @@ Then invoke it with `/cq-fix` in Claude Code. The `$(...)` embeds the live `cq`
 │ ruff             │    0.17s │                      lint │ 1.000   │ OK       │
 │ ty               │    0.33s │                type_check │ 1.000   │ OK       │
 │ bandit           │    0.56s │                  security │ 1.000   │ OK       │
+│ uv-audit         │    0.41s │              dependencies │ 1.000   │ OK       │
 │ pytest           │    0.91s │                     tests │ 1.000   │ OK       │
 │ coverage         │    1.26s │                  coverage │ 0.910   │ OK       │
 │ vulture          │    0.32s │                 dead_code │ 1.000   │ OK       │
@@ -312,7 +321,7 @@ warning = 0.9
 error = 0.7
 ```
 
-Tool IDs match the keys in `src/py_cq/config/config.toml`: `compile`, `ruff`, `ty`, `bandit`, `pytest`, `coverage`, `radon-cc`, `radon-mi`, `radon-hal`, `vulture`, `interrogate`, `ruff-format`.
+Tool IDs match the keys in `src/py_cq/config/config.toml`: `compile`, `ruff`, `ty`, `bandit`, `kingfisher`, `uv-audit`, `pytest`, `coverage`, `radon-cc`, `radon-mi`, `radon-hal`, `vulture`, `interrogate`, `ruff-format`.
 
 
 ### Default config
@@ -329,8 +338,8 @@ error_threshold = 0.9999
 cache_invariant = "ast"
 
 [python.ruff]
-command = "{python} -m ruff check --output-format concise --no-cache \"{context_path}\" --exclude .claude{exclude}"
-exclude_format = " --exclude {path}"
+command = "{python} -m ruff check --output-format concise --no-cache \"{context_path}\" --extend-exclude .claude{exclude}"
+exclude_format = " --extend-exclude {path}"
 parser = "RuffParser"
 order = 2
 warning_threshold = 0.9999
@@ -355,11 +364,27 @@ order = 4
 warning_threshold = 0.9999
 error_threshold = 0.8
 
+[python.kingfisher]
+command = "kingfisher scan \"{context_path}\" --no-validate --no-update-check --git-history none --no-extract-archives --redact -q -f json --exclude .venv --exclude .git --exclude .hypothesis --exclude dist --exclude \"*_cache\" --exclude __pycache__ --exclude .claude{exclude}"
+exclude_format = " --exclude {path}"
+parser = "KingfisherParser"
+order = 5
+warning_threshold = 0.9999
+error_threshold = 0.9999
+
+[python.uv-audit]
+command = "uv audit --project \"{abs_context_path}\" --frozen --output-format json"
+parser = "UvAuditParser"
+order = 6
+warning_threshold = 0.9999
+error_threshold = 0.8
+skip_for_file = true
+
 [python.pytest]
 command = "{python} -m pytest -vv \"{context_path}\" --ignore .claude{exclude}"
 exclude_format = " --ignore {path}"
 parser = "PytestParser"
-order = 5
+order = 7
 warning_threshold = 1.0
 error_threshold = 1.0
 run_in_target_env = true
@@ -368,10 +393,10 @@ skip_for_file = true
 cache_invariant = "ast"
 
 [python.coverage]
-command = "{python} -m coverage run --omit=*/tests/*,*/test_*.py -m pytest \"{context_path}\" --ignore .claude{exclude} && {python} -m coverage report --show-missing --omit=*/tests/*,*/test_*.py"
+command = "{python} -m coverage run --omit=*/tests/*,*/test_*.py,*/py_cq/runners/* \"{pytest_serial}\" \"{context_path}\" --ignore .claude{exclude} && {python} -m coverage report --show-missing --omit=*/tests/*,*/test_*.py,*/py_cq/runners/*"
 exclude_format = " --ignore {path}"
 parser = "CoverageParser"
-order = 6
+order = 8
 warning_threshold = 0.9
 error_threshold = 0.5
 run_in_target_env = true
@@ -381,19 +406,19 @@ skip_if = "pytest"
 cache_invariant = "ast"
 
 [python.vulture]
-command = "{python} -m vulture \"{context_path}\" --min-confidence 80 --exclude .venv,dist,.*_cache,docs,.git,.claude{exclude}"
+command = "{python} -m vulture \"{context_path}\" --min-confidence 60 --ignore-decorators \"@*.command,@*.callback,@*.route,@*.get,@*.post,@*.put,@*.delete,@*.patch,@*fixture,@*.task,@*hookimpl,@*validator,@*.errorhandler\" --exclude .venv,dist,.*_cache,docs,.git,.claude{exclude}"
 exclude_format = ",{path}"
 parser = "VultureParser"
-order = 7
+order = 9
 warning_threshold = 0.9999
 error_threshold = 0.8
 cache_invariant = "ast"
 
 [python.interrogate]
-command = "{python} -m interrogate \"{context_path}\" -e .claude{exclude} -v --fail-under 0"
+command = "{python} -m interrogate \"{context_path}\" -e .claude -e \"{context_path}/tests\"{exclude} -v --fail-under 0"
 exclude_format = " -e {path}"
 parser = "InterrogateParser"
-order = 8
+order = 10
 warning_threshold = 0.8
 error_threshold = 0.5
 
@@ -403,33 +428,29 @@ skip_empty_init = true
 [python.radon-cc]
 command = "{python} -m radon cc --json --exclude '.claude/**' \"{context_path}\""
 parser = "ComplexityParser"
-order = 9
-gate_strict = false
+order = 11
 warning_threshold = 0.6
 error_threshold = 0.4
 
 [python.radon-mi]
 command = "{python} -m radon mi -s --json --exclude '.claude/**' \"{context_path}\""
 parser = "MaintainabilityParser"
-order = 10
-gate_strict = false
+order = 12
 warning_threshold = 0.6
 error_threshold = 0.4
 
 [python.radon-hal]
 command = "{python} -m radon hal -f --json --exclude '.claude/**' \"{context_path}\""
 parser = "HalsteadParser"
-order = 11
-gate_strict = false
+order = 13
 warning_threshold = 0.35
 error_threshold = 0.3
 
 [python.ruff-format]
-command = "{python} -m ruff format --check --output-format concise --no-cache \"{context_path}\" --exclude .claude --config \"include=['*.py','*.pyi','*.ipynb']\"{exclude}"
-exclude_format = " --exclude {path}"
+command = "{python} -m ruff format --check --output-format concise --no-cache \"{context_path}\" --extend-exclude .claude --config \"include=['*.py','*.pyi','*.ipynb']\"{exclude}"
+exclude_format = " --extend-exclude {path}"
 parser = "RuffFormatParser"
-order = 12
-gate_strict = false
+order = 14
 warning_threshold = 0.9999
 error_threshold = 0.5
 ```

{python_code_quality-0.3.1 → python_code_quality-0.4.0}/pyproject.toml

@@ -1,7 +1,7 @@
 [project]
 name = "python-code-quality"
-version = "0.3.1"
-description = "Python Code Quality Analysis Tool - feed the results from 12 CQ tools straight into an LLM. Minimal tokens."
+version = "0.4.0"
+description = "Python Code Quality Analysis Tool - feed the results from 14 CQ tools straight into an LLM. Minimal tokens."
 readme = "README.md"
 requires-python = ">=3.12"
 license = "MIT"
@@ -63,5 +63,13 @@ unresolved-import = "ignore"
 [tool.cq]
 exclude = ["demo"]
 
+[tool.vulture]
+ignore_names = [
+    "check",
+    "check_llm_json",
+    "PHASE",
+    "COL_*",
+]
+
 [dependency-groups]
 dev = ["hypothesis>=6.151.10"]

{python_code_quality-0.3.1 → python_code_quality-0.4.0}/pyproject.toml.orig

@@ -1,7 +1,7 @@
 [project]
 name = "python-code-quality"
-version = "0.3.1"
-description = "Python Code Quality Analysis Tool - feed the results from 12 CQ tools straight into an LLM. Minimal tokens."
+version = "0.4.0"
+description = "Python Code Quality Analysis Tool - feed the results from 14 CQ tools straight into an LLM. Minimal tokens."
 readme = "README.md"
 requires-python = ">=3.12"
 license = "MIT"
@@ -65,6 +65,10 @@ rules = {unresolved-import = "ignore"}
 [tool.cq]
 exclude = ["demo"]
 
+[tool.vulture]
+# Public API, enum members and positional test constants that nothing references by name.
+ignore_names = ["check", "check_llm_json", "PHASE", "COL_*"]
+
 [dependency-groups]
 dev = [
     "hypothesis>=6.151.10",

{python_code_quality-0.3.1 → python_code_quality-0.4.0}/src/py_cq/cli.py

@@ -107,7 +107,7 @@ def callback(
         help="Show version and dependencies",
     ),
 ) -> None:
-    """Feed the results from 12 code quality tools to an LLM. Try: cq check . -o llm"""
+    """Feed the results from 13 code quality tools to an LLM. Try: cq check . -o llm"""
     import sys
 
     if isinstance(sys.stdout, io.TextIOWrapper):
@@ -172,7 +172,7 @@ def check(
         help="Issue selection order for -o llm/llm-json: severity (most severe first) or phase (first non-clean phase, in dependency order)",
     ),
 ):
-    """Feed the results from 12 code quality tools to an LLM. Try: cq check . -o llm"""  # --help
+    """Feed the results from 13 code quality tools to an LLM. Try: cq check . -o llm"""  # --help
     path_obj = Path(path)
     if not path_obj.exists():
         raise typer.BadParameter(f"Path does not exist: {path}")

{python_code_quality-0.3.1 → python_code_quality-0.4.0}/src/py_cq/config/config.toml

@@ -7,8 +7,8 @@ error_threshold = 0.9999
 cache_invariant = "ast"
 
 [python.ruff]
-command = "{python} -m ruff check --output-format concise --no-cache \"{context_path}\" --exclude .claude{exclude}"
-exclude_format = " --exclude {path}"
+command = "{python} -m ruff check --output-format concise --no-cache \"{context_path}\" --extend-exclude .claude{exclude}"
+exclude_format = " --extend-exclude {path}"
 parser = "RuffParser"
 order = 2
 warning_threshold = 0.9999
@@ -33,11 +33,27 @@ order = 4
 warning_threshold = 0.9999
 error_threshold = 0.8
 
+[python.kingfisher]
+command = "kingfisher scan \"{context_path}\" --no-validate --no-update-check --git-history none --no-extract-archives --redact -q -f json --exclude .venv --exclude .git --exclude .hypothesis --exclude dist --exclude \"*_cache\" --exclude __pycache__ --exclude .claude{exclude}"
+exclude_format = " --exclude {path}"
+parser = "KingfisherParser"
+order = 5
+warning_threshold = 0.9999
+error_threshold = 0.9999
+
+[python.uv-audit]
+command = "uv audit --project \"{abs_context_path}\" --frozen --output-format json"
+parser = "UvAuditParser"
+order = 6
+warning_threshold = 0.9999
+error_threshold = 0.8
+skip_for_file = true
+
 [python.pytest]
 command = "{python} -m pytest -vv \"{context_path}\" --ignore .claude{exclude}"
 exclude_format = " --ignore {path}"
 parser = "PytestParser"
-order = 5
+order = 7
 warning_threshold = 1.0
 error_threshold = 1.0
 run_in_target_env = true
@@ -46,10 +62,10 @@ skip_for_file = true
 cache_invariant = "ast"
 
 [python.coverage]
-command = "{python} -m coverage run --omit=*/tests/*,*/test_*.py -m pytest \"{context_path}\" --ignore .claude{exclude} && {python} -m coverage report --show-missing --omit=*/tests/*,*/test_*.py"
+command = "{python} -m coverage run --omit=*/tests/*,*/test_*.py,*/py_cq/runners/* \"{pytest_serial}\" \"{context_path}\" --ignore .claude{exclude} && {python} -m coverage report --show-missing --omit=*/tests/*,*/test_*.py,*/py_cq/runners/*"
 exclude_format = " --ignore {path}"
 parser = "CoverageParser"
-order = 6
+order = 8
 warning_threshold = 0.9
 error_threshold = 0.5
 run_in_target_env = true
@@ -59,19 +75,19 @@ skip_if = "pytest"
 cache_invariant = "ast"
 
 [python.vulture]
-command = "{python} -m vulture \"{context_path}\" --min-confidence 80 --exclude .venv,dist,.*_cache,docs,.git,.claude{exclude}"
+command = "{python} -m vulture \"{context_path}\" --min-confidence 60 --ignore-decorators \"@*.command,@*.callback,@*.route,@*.get,@*.post,@*.put,@*.delete,@*.patch,@*fixture,@*.task,@*hookimpl,@*validator,@*.errorhandler\" --exclude .venv,dist,.*_cache,docs,.git,.claude{exclude}"
 exclude_format = ",{path}"
 parser = "VultureParser"
-order = 7
+order = 9
 warning_threshold = 0.9999
 error_threshold = 0.8
 cache_invariant = "ast"
 
 [python.interrogate]
-command = "{python} -m interrogate \"{context_path}\" -e .claude{exclude} -v --fail-under 0"
+command = "{python} -m interrogate \"{context_path}\" -e .claude -e \"{context_path}/tests\"{exclude} -v --fail-under 0"
 exclude_format = " -e {path}"
 parser = "InterrogateParser"
-order = 8
+order = 10
 warning_threshold = 0.8
 error_threshold = 0.5
 
@@ -81,32 +97,28 @@ skip_empty_init = true
 [python.radon-cc]
 command = "{python} -m radon cc --json --exclude '.claude/**' \"{context_path}\""
 parser = "ComplexityParser"
-order = 9
-gate_strict = false
+order = 11
 warning_threshold = 0.6
 error_threshold = 0.4
 
 [python.radon-mi]
 command = "{python} -m radon mi -s --json --exclude '.claude/**' \"{context_path}\""
 parser = "MaintainabilityParser"
-order = 10
-gate_strict = false
+order = 12
 warning_threshold = 0.6
 error_threshold = 0.4
 
 [python.radon-hal]
 command = "{python} -m radon hal -f --json --exclude '.claude/**' \"{context_path}\""
 parser = "HalsteadParser"
-order = 11
-gate_strict = false
+order = 13
 warning_threshold = 0.35
 error_threshold = 0.3
 
 [python.ruff-format]
-command = "{python} -m ruff format --check --output-format concise --no-cache \"{context_path}\" --exclude .claude --config \"include=['*.py','*.pyi','*.ipynb']\"{exclude}"
-exclude_format = " --exclude {path}"
+command = "{python} -m ruff format --check --output-format concise --no-cache \"{context_path}\" --extend-exclude .claude --config \"include=['*.py','*.pyi','*.ipynb']\"{exclude}"
+exclude_format = " --extend-exclude {path}"
 parser = "RuffFormatParser"
-order = 12
-gate_strict = false
+order = 14
 warning_threshold = 0.9999
 error_threshold = 0.5

{python_code_quality-0.3.1 → python_code_quality-0.4.0}/src/py_cq/execution_engine.py

@@ -38,6 +38,9 @@ _cache = Cache(
     Path.home() / ".cache" / "cq", size_limit=100 * 1024 * 1024, disk=JSONDisk
 )
 
+# Script that runs pytest in one process under coverage; see its docstring.
+_PYTEST_SERIAL = str(Path(__file__).parent / "runners" / "pytest_serial.py")
+
 
 def _find_project_root(path: Path) -> Path | None:
     """Walk up from path to find the nearest directory containing pyproject.toml."""
@@ -271,6 +274,7 @@ def run_tool(
         scan_targets=scan_targets,
         python=python,
         exclude=exclude,
+        pytest_serial=_PYTEST_SERIAL,
     )
     if precomputed_hash is not None:
         context_hash = precomputed_hash
@@ -328,6 +332,10 @@ def run_tool(
         timestamp=timestamp,
         project_path=project_dir,
     )
+    if return_code != 0 and not stdout.strip():
+        # Failed without a report: the tool is missing from PATH or offline.
+        # Caching this would hide real results until the files change.
+        return raw_result
     _cache.set(
         cache_key, raw_result.to_dict(), expire=5 * 24 * 60 * 60, tag=project_tag
     )

{python_code_quality-0.3.1 → python_code_quality-0.4.0}/src/py_cq/localtypes.py

@@ -60,9 +60,6 @@ class ToolConfig:
         default_factory=list
     )  # Top-level dir/file names to omit from {scan_targets}
     skip_for_file: bool = False  # If True, skip when context_path is a single file
-    gate_strict: bool = (
-        True  # If False, small regressions above warning_threshold are accepted
-    )
     skip_if: str = ""  # Tool name; if that tool's score is below its error_threshold, skip this tool
     cache_invariant: str = ""  # "ast": key the cache on the docstring-stripped AST, ignoring docstrings/comments/format
 

python_code_quality-0.4.0/src/py_cq/parsers/kingfisherparser.py

@@ -0,0 +1,73 @@
+"""Parses output from the Kingfisher secret scanner into a standardized ToolResult.
+
+Kingfisher (``uv tool install kingfisher-bin``) is invoked with ``-f json`` and
+``--redact``, so the report on stdout never contains the secret itself, only a
+hash. ``--no-validate`` keeps it from sending findings to provider APIs.
+
+Each finding is listed against its file. The count becomes a logistic-variant
+score stored under the ``secrets`` metric key.
+
+When no report can be read (``kingfisher`` not on PATH) the tool reports no
+metric instead of a failing one.
+"""
+
+import json
+import logging
+
+from py_cq.localtypes import AbstractParser, RawResult, ToolResult
+from py_cq.parsers.common import extract_first_issue, score_logistic_variant
+
+log = logging.getLogger("cq")
+
+
+class KingfisherParser(AbstractParser):
+    """Parses raw JSON output from ``kingfisher scan -f json`` into a ToolResult."""
+
+    def parse(self, raw_result: RawResult) -> ToolResult:
+        """Parses the raw Kingfisher JSON report into a ToolResult."""
+        try:
+            findings = json.loads(raw_result.stdout)["findings"]
+        except (ValueError, KeyError, TypeError):
+            log.warning(
+                "kingfisher produced no report (return_code=%s), skipping. "
+                "Install it with `uv tool install kingfisher-bin`.",
+                raw_result.return_code,
+            )
+            return ToolResult(raw=raw_result)
+
+        files: dict[str, list] = {}
+        for entry in findings:
+            rule = entry.get("rule") or {}
+            finding = entry.get("finding") or {}
+            path = str(finding.get("path", "")).replace("\\", "/")
+            files.setdefault(path, []).append(
+                {
+                    "line": finding.get("line", 0),
+                    "code": rule.get("id", ""),
+                    "confidence": finding.get("confidence", ""),
+                    "message": rule.get("description", ""),
+                }
+            )
+
+        count = sum(len(issues) for issues in files.values())
+        score = score_logistic_variant(count, scale_factor=5)
+        return ToolResult(raw=raw_result, metrics={"secrets": score}, details=files)
+
+    def format_llm_message(
+        self, tr: ToolResult, *, context_lines: int = 15, limit: int = 1
+    ) -> str:
+        """Formats the first secret finding into an LLM-friendly message."""
+        result = extract_first_issue(tr.details)
+        if result is None:
+            return "kingfisher reported secrets (no details available)"
+        file, issue = result
+        line = issue.get("line", "?")
+        # No source excerpt: it would put the plaintext secret into the LLM prompt.
+        return (
+            f"{file}:{line} - {issue.get('code', '')}: "
+            f"[{issue.get('confidence', '')} confidence] {issue.get('message', '')}\n\n"
+            "Move the secret out of the source (environment variable or an untracked "
+            "file) and rotate it if it was ever committed. Only if it is an intentional "
+            "test fixture or a false positive, add a `kingfisher:ignore` comment on "
+            "that line."
+        )

python_code_quality-0.4.0/src/py_cq/parsers/uvauditparser.py

@@ -0,0 +1,88 @@
+"""Parses output from ``uv audit`` into a standardized ToolResult.
+
+``uv audit --output-format json`` checks the packages pinned in ``uv.lock``
+against the OSV advisory database and prints a JSON report on stdout.
+
+Only advisories with a fix version are counted: those are the ones an upgrade
+resolves. The same vulnerability is often listed once per advisory database
+(GHSA, PYSEC), so entries that alias one already seen for a package are
+dropped. The count becomes a logistic-variant score stored under the
+``dependencies`` metric key.
+
+When no report can be read (``uv`` missing, no ``pyproject.toml`` or
+``uv.lock``, no network) the tool reports no metric instead of a failing one.
+"""
+
+import json
+import logging
+
+from py_cq.localtypes import AbstractParser, RawResult, ToolResult
+from py_cq.parsers.common import extract_first_issue, score_logistic_variant
+
+log = logging.getLogger("cq")
+
+_LOCKFILE = "uv.lock"
+
+
+class UvAuditParser(AbstractParser):
+    """Parses raw JSON output from ``uv audit`` into a ToolResult."""
+
+    def parse(self, raw_result: RawResult) -> ToolResult:
+        """Parses the raw ``uv audit`` JSON report into a ToolResult."""
+        try:
+            vulnerabilities = json.loads(raw_result.stdout)["vulnerabilities"]
+        except (ValueError, KeyError, TypeError):
+            reason = (raw_result.stderr or "").strip().splitlines()[-1:]
+            log.warning(
+                "uv audit produced no report (return_code=%s), skipping: %s",
+                raw_result.return_code,
+                reason[0] if reason else "no output",
+            )
+            return ToolResult(raw=raw_result)
+
+        seen: set[tuple[str, str]] = set()
+        issues: list[dict] = []
+        for vuln in vulnerabilities:
+            fix_versions = [str(v) for v in vuln.get("fix_versions") or []]
+            if not fix_versions:
+                continue
+            dependency = vuln.get("dependency") or {}
+            package = dependency.get("name", "")
+            ids = {vuln.get("id", ""), *(vuln.get("aliases") or [])}
+            if any((package, i) in seen for i in ids):
+                continue
+            seen.update((package, i) for i in ids)
+            issues.append(
+                {
+                    "code": vuln.get("id", ""),
+                    "package": package,
+                    "version": dependency.get("version", ""),
+                    "fix_versions": fix_versions,
+                    "message": vuln.get("summary") or "",
+                    "link": vuln.get("link") or "",
+                }
+            )
+
+        score = score_logistic_variant(len(issues), scale_factor=5)
+        details = {_LOCKFILE: issues} if issues else {}
+        return ToolResult(
+            raw=raw_result, metrics={"dependencies": score}, details=details
+        )
+
+    def format_llm_message(
+        self, tr: ToolResult, *, context_lines: int = 15, limit: int = 1
+    ) -> str:
+        """Formats the first vulnerable dependency into an LLM-friendly message."""
+        result = extract_first_issue(tr.details)
+        if result is None:
+            return "uv audit reported issues (no details available)"
+        file, issue = result
+        package = issue.get("package", "")
+        fixed = ", ".join(issue.get("fix_versions", []))
+        message = (
+            f"{file} - {issue.get('code', '')}: **{package} {issue.get('version', '')}** "
+            f"has a known vulnerability: {issue.get('message', '')}\n\n"
+            f"Fixed in {fixed}. Upgrade with `uv lock --upgrade-package {package}`."
+        )
+        link = issue.get("link")
+        return f"{message}\n\n{link}" if link else message

{python_code_quality-0.3.1 → python_code_quality-0.4.0}/src/py_cq/parsers/vultureparser.py

@@ -1,9 +1,14 @@
 """Parses output from vulture dead-code detector into a standardized ToolResult.
 
-Vulture is invoked with ``--min-confidence 80``, producing one text line
+Vulture is invoked with ``--min-confidence 60``, producing one text line
 per unused symbol::
 
-    src/foo.py:10: unused function 'bar' (80% confidence)
+    src/foo.py:10: unused function 'bar' (60% confidence)
+
+60% is the confidence vulture gives unused functions, classes, methods and
+variables, so anything higher only reports unused imports and unreachable
+code. At that level vulture cannot see dynamic use, so the LLM message for a
+finding below 80% says how to keep the symbol instead of deleting it.
 
 The parser counts violations and converts the count into a logistic-variant
 score stored under the ``dead_code`` metric key.
@@ -20,6 +25,13 @@ from py_cq.parsers.common import (
 
 _LINE_RE = re.compile(r"^(.+):(\d+): (unused \S+) '(.+)' \((\d+)% confidence\)$")
 
+_CERTAIN = 80
+_KEEP_HINT = (
+    "\n\nRemove it if nothing uses it. If it is public API or is used dynamically,"
+    ' keep it and add `"{name}"` to `ignore_names` under `[tool.vulture]` in'
+    " `pyproject.toml`."
+)
+
 
 class VultureParser(AbstractParser):
     """Parses raw text output from ``vulture`` into a ToolResult."""
@@ -55,4 +67,7 @@ class VultureParser(AbstractParser):
         kind = issue.get("type", "unused")
         name = issue.get("name", "")
         confidence = issue.get("confidence", "?")
-        return f"{file}:{line} - **{kind}** `{name}` ({confidence}% confidence){format_source_context(file, line, count=context_lines)}"
+        message = f"{file}:{line} - **{kind}** `{name}` ({confidence}% confidence){format_source_context(file, line, count=context_lines)}"
+        if isinstance(confidence, int) and confidence < _CERTAIN:
+            message += _KEEP_HINT.format(name=name)
+        return message

python_code_quality-0.4.0/src/py_cq/runners/pytest_serial.py

@@ -0,0 +1,27 @@
+"""Run pytest in a single process, for the coverage tool.
+
+cq runs this script under ``coverage run``. Coverage only measures the process
+it starts, so if the target project enables pytest-xdist through its own
+``addopts``, the tests run in worker processes that coverage never sees and the
+coverage score collapses. Passing ``-n 0`` keeps the tests in this process. It
+is only passed when xdist is installed, because pytest rejects ``-n`` otherwise.
+
+The script runs in the target project's environment, so it imports only the
+standard library and pytest. It lives in its own directory because running a
+script puts that directory first on ``sys.path``; that entry is replaced with
+the working directory so imports behave as they do under ``python -m pytest``.
+"""
+
+import os
+import sys
+from importlib.util import find_spec
+
+if __name__ == "__main__":
+    sys.path[0] = os.getcwd()
+
+    import pytest
+
+    args = sys.argv[1:]
+    if find_spec("xdist") is not None:
+        args += ["-n", "0"]
+    sys.exit(pytest.main(args))

{python_code_quality-0.3.1 → python_code_quality-0.4.0}/src/py_cq/tool_registry.py

@@ -32,7 +32,6 @@ def load_tool_configs() -> dict[str, ToolConfig]:
             exclude_format=tool_data.get("exclude_format", ""),
             scan_exclude_names=tool_data.get("scan_exclude_names", []),
             skip_for_file=tool_data.get("skip_for_file", False),
-            gate_strict=tool_data.get("gate_strict", True),
             skip_if=tool_data.get("skip_if", ""),
             cache_invariant=tool_data.get("cache_invariant", ""),
         )