sarj-python-lint 1.63.0__tar.gz → 1.64.0__tar.gz

{sarj_python_lint-1.63.0 → sarj_python_lint-1.64.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sarj-python-lint
-Version: 1.63.0
+Version: 1.64.0
 Summary: Custom Python lint rules — AST-based, pre-commit-friendly, hypermodern defaults
 Project-URL: Homepage, https://code-standards.sarj.ai/rules/python/
 Project-URL: Documentation, https://code-standards.sarj.ai/rules/python/

{sarj_python_lint-1.63.0 → sarj_python_lint-1.64.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sarj-python-lint"
-version = "1.63.0"
+version = "1.64.0"
 description = "Custom Python lint rules — AST-based, pre-commit-friendly, hypermodern defaults"
 readme = "README.md"
 authors = [{ name = "sarj-ai" }]

{sarj_python_lint-1.63.0 → sarj_python_lint-1.64.0}/src/sarj_python_lint/__main__.py

@@ -23,6 +23,7 @@ from sarj_python_lint.rule_base import Diagnostic, ProjectRule, Rule, Severity,
 from sarj_python_lint.rules import REGISTRY
 from sarj_python_lint.rules._paths import clear_path_caches
 from sarj_python_lint.rules._project_index import ProjectIndexSet
+from sarj_python_lint.suppression_policy import PROTECTED_SUPPRESSION_CODES
 
 
 SKIP_DIR_NAMES = frozenset(
@@ -46,11 +47,17 @@ SKIP_DIR_NAMES = frozenset(
     }
 )
 
-# Skip files larger than this — they are almost always generated/vendored, not
-# hand-written source worth linting.
+# Bound resource use, but never turn an unanalyzed selected file into success.
 _MAX_FILE_BYTES = 500_000
 
 
+def _checked_size(path: Path) -> Path:
+    if path.stat().st_size > _MAX_FILE_BYTES:
+        msg = f"selected Python source exceeds {_MAX_FILE_BYTES} bytes: {path}; use an explicit path exclusion for generated source"
+        raise ValueError(msg)
+    return path
+
+
 def expand_paths(paths: list[Path]) -> list[Path]:
     out: list[Path] = []
     for p in paths:
@@ -58,11 +65,7 @@ def expand_paths(paths: list[Path]) -> list[Path]:
             msg = f"input does not exist: {p}"
             raise ValueError(msg)
         if p.is_file():
-            try:
-                if p.stat().st_size <= _MAX_FILE_BYTES:
-                    out.append(p)
-            except OSError:
-                pass
+            out.append(_checked_size(p))
             continue
         out.extend(_python_files(p))
     return out
@@ -78,11 +81,8 @@ def _python_files(p: Path) -> list[Path]:
             if not fnmatch(name, "*.py"):
                 continue
             child = directory / name
-            try:
-                if child.is_file() and child.stat().st_size <= _MAX_FILE_BYTES:
-                    out.append(child)
-            except OSError:
-                continue
+            if child.is_file():
+                out.append(_checked_size(child))
     return sorted(out)
 
 
@@ -109,12 +109,7 @@ def _check(rule_ids: list[str], paths: list[Path]) -> list[Diagnostic]:
         rule.prepare_session(session)
     clear_path_caches()
     expanded = expand_paths(paths)
-    loaded: dict[Path, str] = {}
-    for path in expanded:
-        try:
-            loaded[path] = read_python_source(path)
-        except OSError:
-            continue
+    loaded = {path: read_python_source(path) for path in expanded}
     project_rules = [rule for rule in rules if isinstance(rule, ProjectRule)]
     if project_rules:
         indexes = ProjectIndexSet.build(expanded, loaded, facts=session.first_party)
@@ -131,14 +126,13 @@ def check_source(
     rules: list[Rule], p: Path, source: str, *, session: AnalysisSession | None = None
 ) -> list[Diagnostic]:
     context = PythonFileContext(p, source, session)
+    if rules and context.tree is None:
+        msg = f"selected Python source could not be parsed: {p}"
+        raise ValueError(msg)
     source_lines = context.source_lines
     raw = [diagnostic for rule in rules for diagnostic in rule.check_context(context)]
     return deduplicate_diagnostics(
-        [
-            diagnostic
-            for diagnostic in raw
-            if diagnostic.code == "SARJ419" or not is_suppressed(source_lines, diagnostic.line, diagnostic.code)
-        ],
+        [diagnostic for diagnostic in raw if not is_suppressed(source_lines, diagnostic.line, diagnostic.code)],
         source=source,
         context=context,
     )
@@ -157,6 +151,9 @@ def analyze(
 
 _DIAGNOSTIC_PRECEDENCE = MappingProxyType(
     {
+        "SARJ054": frozenset({"SARJ419"}),
+        "SARJ448": frozenset({"SARJ419"}),
+        "SARJ523": frozenset({"SARJ419"}),
         "SARJ050": frozenset({"SARJ420"}),
         "SARJ084": frozenset({"SARJ050", "SARJ420"}),
         "SARJ085": frozenset({"SARJ420"}),
@@ -417,7 +414,7 @@ def _explain(wanted: str) -> int:
 def _baseline_counts(diags: list[Diagnostic]) -> dict[str, dict[str, int]]:
     counts: dict[str, dict[str, int]] = {}
     for d in diags:
-        if d.severity is Severity.WARNING:
+        if d.severity is Severity.WARNING or d.code in PROTECTED_SUPPRESSION_CODES:
             continue
         key = _baseline_path(d.path)
         counts.setdefault(key, {})
@@ -467,7 +464,7 @@ def _apply_baseline(
     seen: Counter[tuple[str, str]] = Counter()
     out: list[Diagnostic] = []
     for d in diags:
-        if d.severity is Severity.WARNING:
+        if d.severity is Severity.WARNING or d.code in PROTECTED_SUPPRESSION_CODES:
             out.append(d)
             continue
         path_key = _baseline_path(d.path, root=root)

sarj_python_lint-1.64.0/src/sarj_python_lint/cast_access.py

@@ -0,0 +1,251 @@
+from __future__ import annotations
+
+import ast
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, Literal
+
+from sarj_python_lint._file_context import PythonFileContext
+from sarj_python_lint.rules._namespace_access import dynamic_namespace_access
+from sarj_python_lint.rules._resource_provenance import ResourceProvenance
+
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+    from pathlib import Path
+
+
+_TYPING = frozenset({"typing", "typing_extensions"})
+_GETATTR_ARITIES = frozenset({2, 3})
+_MAX_LITERAL_DEPTH = 12
+_CAST_LENGTH = len("cast")
+_COMPREHENSIONS = (ast.ListComp, ast.SetComp, ast.DictComp, ast.GeneratorExp)
+
+
+@dataclass(frozen=True, slots=True)
+class CastAccess:
+    node: ast.Call | ast.Subscript | ast.ImportFrom
+    qualified_api: str
+    kind: Literal["wildcard", "reflection"]
+
+
+def indirect_typing_cast_accesses(path: Path, source: str) -> tuple[CastAccess, ...]:
+    context = PythonFileContext(path, source)
+    if not any(marker in context.symbol_source for marker in ("*", "getattr", "__dict__", "vars", "__getattribute__")):
+        return ()
+    if context.tree is None:
+        return ()
+    accesses = [
+        CastAccess(node, f"{node.module}.cast", "wildcard")
+        for node in context.nodes(ast.ImportFrom)
+        if node.level == 0 and node.module in _TYPING and any(alias.name == "*" for alias in node.names)
+    ]
+    accesses.extend(_reflection_accesses(context))
+    return tuple(sorted(accesses, key=lambda access: (access.node.lineno, access.node.col_offset)))
+
+
+def _reflection_accesses(context: PythonFileContext) -> list[CastAccess]:
+    provenance = ResourceProvenance(context)
+    candidates = [
+        (node, receiver)
+        for node in context.nodes(ast.Call, ast.Subscript)
+        if (receiver := _cast_receiver(node, provenance)) is not None
+    ]
+    if not candidates:
+        return []
+    receivers = {id(receiver) for _, receiver in candidates}
+    proven = [
+        (node, module)
+        for node, receiver in candidates
+        if (module := _typing_receiver(receiver, provenance, receivers)) is not None
+    ]
+    safe_reflection = {id(carrier) for node, _ in proven if (carrier := _reflection_carrier(node)) is not None}
+    namespace_hazard = dynamic_namespace_access(
+        (node for node in context.nodes(ast.AST) if id(node) not in safe_reflection), context.imports, context.parents
+    )
+    if provenance.wildcard or namespace_hazard or not provenance.builtin_namespace_untouched:
+        return []
+    return [CastAccess(node, f"{module}.cast", "reflection") for node, module in proven]
+
+
+def _cast_receiver(node: ast.Call | ast.Subscript, provenance: ResourceProvenance) -> ast.Name | None:
+    if isinstance(node, ast.Call):
+        return _call_receiver(node, provenance)
+    if not isinstance(node.ctx, ast.Load) or _static_text(node.slice) != "cast":
+        return None
+    namespace = node.value
+    if isinstance(namespace, ast.Attribute) and namespace.attr == "__dict__" and isinstance(namespace.value, ast.Name):
+        return namespace.value
+    if isinstance(namespace, ast.Call) and len(namespace.args) == 1 and _builtin_call(namespace, "vars", provenance):
+        return namespace.args[0] if isinstance(namespace.args[0], ast.Name) else None
+    return None
+
+
+def _call_receiver(node: ast.Call, provenance: ResourceProvenance) -> ast.Name | None:
+    if (
+        len(node.args) in _GETATTR_ARITIES
+        and _builtin_call(node, "getattr", provenance)
+        and _static_text(node.args[1]) == "cast"
+    ):
+        return node.args[0] if isinstance(node.args[0], ast.Name) else None
+    if (
+        isinstance(node.func, ast.Attribute)
+        and node.func.attr == "__getattribute__"
+        and len(node.args) == 1
+        and not node.keywords
+        and _static_text(node.args[0]) == "cast"
+    ):
+        return node.func.value if isinstance(node.func.value, ast.Name) else None
+    return None
+
+
+def _builtin_call(call: ast.Call, name: str, provenance: ResourceProvenance) -> bool:
+    if not isinstance(call.func, ast.Name) or call.func.id != name or call.keywords:
+        return False
+    return not _type_parameter_shadowed(name, call.func, provenance) and all(
+        name not in provenance.bindings.get(scope, {}) for scope in _lexical_scopes(call.func, provenance)
+    )
+
+
+def _lexical_scopes(node: ast.AST, provenance: ResourceProvenance) -> Iterator[ast.AST]:
+    scope = _evaluation_scope(node, provenance)
+    immediate = True
+    while scope is not None:
+        # Ordinary nested code blocks do not capture class locals.
+        if immediate or not isinstance(scope, ast.ClassDef):
+            yield scope
+        immediate = False
+        scope = _evaluation_scope(scope, provenance)
+
+
+def _evaluation_scope(node: ast.AST, provenance: ResourceProvenance) -> ast.AST | None:
+    scope = provenance.scope(node)
+    if isinstance(scope, ast.FunctionDef | ast.AsyncFunctionDef | ast.ClassDef) and _owner_annotation(
+        node, scope, provenance
+    ):
+        node, scope = scope, provenance.scope(scope)
+    while isinstance(scope, _COMPREHENSIONS):
+        iterable = scope.generators[0].iter
+        if iterable is not node and not provenance.contains(iterable, node):
+            break
+        # A comprehension's first iterable is evaluated in the enclosing scope.
+        node, scope = scope, provenance.scope(scope)
+    return scope
+
+
+def _owner_annotation(
+    node: ast.AST, owner: ast.FunctionDef | ast.AsyncFunctionDef | ast.ClassDef, provenance: ResourceProvenance
+) -> bool:
+    if any(parameter is node or provenance.contains(parameter, node) for parameter in owner.type_params):
+        return True
+    return isinstance(owner, ast.FunctionDef | ast.AsyncFunctionDef) and _function_annotation(node, owner, provenance)
+
+
+def _function_annotation(
+    node: ast.AST, function: ast.FunctionDef | ast.AsyncFunctionDef, provenance: ResourceProvenance
+) -> bool:
+    current = node
+    while (parent := provenance.context.parents.get(current)) is not None:
+        if (parent is function and current is function.returns) or (
+            isinstance(parent, ast.arg) and current is parent.annotation
+        ):
+            return True
+        if parent is function:
+            break
+        current = parent
+    return False
+
+
+def _type_parameter_shadowed(name: str, node: ast.AST, provenance: ResourceProvenance) -> bool:
+    current: ast.AST | None = node
+    while current is not None:
+        if (
+            isinstance(current, ast.FunctionDef | ast.AsyncFunctionDef | ast.ClassDef | ast.TypeAlias)
+            and any(
+                isinstance(parameter, ast.TypeVar | ast.TypeVarTuple | ast.ParamSpec) and parameter.name == name
+                for parameter in current.type_params
+            )
+            and not _outside_parameter_scope(node, current, provenance)
+            and not _local_binding_overrides(name, node, current, provenance)
+        ):
+            return True
+        current = provenance.context.parents.get(current)
+    return False
+
+
+def _outside_parameter_scope(
+    node: ast.AST,
+    owner: ast.FunctionDef | ast.AsyncFunctionDef | ast.ClassDef | ast.TypeAlias,
+    provenance: ResourceProvenance,
+) -> bool:
+    outside = [] if isinstance(owner, ast.TypeAlias) else list(owner.decorator_list)
+    if isinstance(owner, ast.FunctionDef | ast.AsyncFunctionDef):
+        outside.extend(owner.args.defaults)
+        outside.extend(value for value in owner.args.kw_defaults if value is not None)
+    # Defaults and decorators evaluate in the enclosing scope.
+    return any(value is node or provenance.contains(value, node) for value in outside)
+
+
+def _local_binding_overrides(name: str, node: ast.AST, owner: ast.AST, provenance: ResourceProvenance) -> bool:
+    for scope in _lexical_scopes(node, provenance):
+        if scope is not owner and not provenance.contains(owner, scope):
+            return False
+        if name in provenance.bindings.get(scope, {}):
+            return True
+    return False
+
+
+def _static_text(node: ast.expr, depth: int = 0) -> str | None:
+    # Evaluate only bounded, side-effect-free string syntax, never runtime code.
+    if depth > _MAX_LITERAL_DEPTH:
+        return None
+    if isinstance(node, ast.Constant) and isinstance(node.value, str):
+        return node.value if len(node.value) <= _CAST_LENGTH else None
+    if isinstance(node, ast.JoinedStr):
+        # Parsing adjacent static f-strings folds them into one Constant.
+        return _static_text(node.values[0], depth + 1) if len(node.values) == 1 else None
+    if not isinstance(node, ast.BinOp) or not isinstance(node.op, ast.Add):
+        return None
+    left, right = _static_text(node.left, depth + 1), _static_text(node.right, depth + 1)
+    if left is None or right is None:
+        return None
+    text = left + right
+    return text if len(text) <= _CAST_LENGTH else None
+
+
+def _reflection_carrier(node: ast.Call | ast.Subscript) -> ast.AST | None:
+    if isinstance(node, ast.Call) and isinstance(node.func, ast.Attribute):
+        return node.func
+    if isinstance(node, ast.Subscript):
+        return node.value.func if isinstance(node.value, ast.Call) else node.value
+    return None
+
+
+def _typing_receiver(node: ast.Name, provenance: ResourceProvenance, receivers: set[int]) -> str | None:
+    if node.id in provenance.mutated | provenance.external_bindings:
+        return None
+    binding = _name_binding(node, provenance)
+    if not (
+        isinstance(binding, ast.alias)
+        and isinstance(provenance.context.parents.get(binding), ast.Import)
+        and binding.name in _TYPING
+    ):
+        return None
+    for read in provenance.reads.get(node.id, ()):
+        if _name_binding(read, provenance) is not binding:
+            continue
+        parent = provenance.context.parents.get(read)
+        if isinstance(parent, ast.Attribute) and parent.value is read:
+            continue
+        if id(read) in receivers:
+            continue
+        return None
+    return binding.name
+
+
+def _name_binding(node: ast.Name, provenance: ResourceProvenance) -> ast.AST | None:
+    if _type_parameter_shadowed(node.id, node, provenance):
+        return None
+    for scope in _lexical_scopes(node, provenance):
+        if bindings := provenance.bindings.get(scope, {}).get(node.id):
+            return provenance.binding(node.id, bindings[0])
+    return None

{sarj_python_lint-1.63.0 → sarj_python_lint-1.64.0}/src/sarj_python_lint/rule_base.py

@@ -20,6 +20,7 @@ from sarj_rule_contracts import (
 )
 
 from sarj_python_lint._python_target import PythonTargetFacts
+from sarj_python_lint.suppression_policy import PROTECTED_SUPPRESSION_CODES
 
 
 if TYPE_CHECKING:
@@ -43,7 +44,7 @@ _SARJ_NOQA_RE = re.compile(
 
 
 def is_suppressed(source_lines: Sequence[str], line: int, code: str) -> bool:
-    if line < 1 or line > len(source_lines):
+    if code.upper() in PROTECTED_SUPPRESSION_CODES or line < 1 or line > len(source_lines):
         return False
     text = source_lines[line - 1]
     m = _SARJ_NOQA_RE.search(text)
@@ -58,8 +59,7 @@ def is_suppressed(source_lines: Sequence[str], line: int, code: str) -> bool:
     codes_str = m.group(1)
     trailing = comment[m.end() :]
     if codes_str is None:
-        # A complete bare marker preserves the existing all-codes waiver contract.
-        return not (trailing and (not trailing[0].isspace() or trailing.lstrip().startswith(":")))
+        return False
     reason = trailing.lstrip()
     single_dash_reason = reason.startswith("-") and (codes_str[-1:].isspace() or trailing[:1].isspace())
     if reason and not reason.startswith(("--", "—", "–")) and not single_dash_reason:

{sarj_python_lint-1.63.0 → sarj_python_lint-1.64.0}/src/sarj_python_lint/rules/_registry.py

@@ -34,6 +34,7 @@ from sarj_python_lint.rules.no_analytical_aggregation_in_postgres_store import (
 from sarj_python_lint.rules.no_any_mapping_types import NoAnyMappingTypes
 from sarj_python_lint.rules.no_async_function_cache import NoAsyncFunctionCache
 from sarj_python_lint.rules.no_before_validator_input_mutation import NoBeforeValidatorInputMutation
+from sarj_python_lint.rules.no_blanket_suppression import NoBlanketSuppression
 from sarj_python_lint.rules.no_broad_keyword_capture import NoBroadKeywordCapture
 from sarj_python_lint.rules.no_comment_cruft import NoCommentCruft
 from sarj_python_lint.rules.no_conftest_test_module_import import NoConftestTestModuleImport
@@ -329,6 +330,7 @@ REGISTRY: Mapping[str, type[Rule]] = MappingProxyType(
         RequirePydanticForExternalJson.id: RequirePydanticForExternalJson,
         RequirePydanticForMappingShape.id: RequirePydanticForMappingShape,
         NoDualShapeModelFieldReader.id: NoDualShapeModelFieldReader,
+        NoBlanketSuppression.id: NoBlanketSuppression,
         PreferModuleLevelConstant.id: PreferModuleLevelConstant,
         PreferImmutableModuleConstant.id: PreferImmutableModuleConstant,
         PreferInjectedDependencyOverMonkeypatch.id: PreferInjectedDependencyOverMonkeypatch,

sarj_python_lint-1.64.0/src/sarj_python_lint/rules/no_blanket_suppression.py

@@ -0,0 +1,134 @@
+from __future__ import annotations
+
+from pathlib import PurePosixPath
+import re
+from typing import TYPE_CHECKING, ClassVar, final, override
+
+from sarj_python_lint.rule_base import (
+    AutofixPolicy,
+    ColumnEncoding,
+    Diagnostic,
+    ExampleFile,
+    ExampleOutcome,
+    Rule,
+    RuleCategory,
+    RuleDocumentation,
+    RuleExample,
+)
+from sarj_python_lint.rules._suppression_comments import scan_comments_or_none
+
+
+if TYPE_CHECKING:
+    from sarj_python_lint._file_context import PythonFileContext
+
+
+_SARJ = re.compile(r"(?:^|#\s*)sarj-noqa\b(?P<tail>[^#]*)", re.IGNORECASE)
+_SARJ_CODES = re.compile(r"^:\s*SARJ\d+\b", re.IGNORECASE)
+_PYRIGHT = re.compile(r"(?:^|#\s*)pyright:\s*(?P<tail>[^#]*)")
+_SCOPED_IGNORE = re.compile(r"^ignore\s*\[\s*report[A-Za-z]+(?:\s*,\s*report[A-Za-z]+)*\s*,?\s*\]")
+_DIAGNOSTIC = re.compile(r"^report[A-Z][A-Za-z]+$")
+_WEAKENED = frozenset({"false", "none", "warning", "information", "hint"})
+_WEAKER_MODES = frozenset({"basic", "standard"})
+_DISABLED_CHECKS = frozenset({"analyzeUnannotatedFunctions", "disableBytesTypePromotions", "strictParameterNoneValue"})
+_RUFF_BROAD = re.compile(
+    r"^ruff:\s*(?:file-ignore\s*\[(?P<file>[^\]]+)\]|noqa\s*:\s*(?P<codes>[A-Za-z0-9_, ]+)|disable\s*\[[^\]]+\])",
+    re.IGNORECASE,
+)
+_FLAKE8_BROAD = re.compile(r"^flake8:\s*noqa\s*:\s*[A-Za-z][A-Za-z0-9]*", re.IGNORECASE)
+_BAD = "def value() -> str:\n    return 1 # pyright: ignore\n"
+_GOOD = "value = vendor.value # pyright: ignore[reportPrivateUsage] -- the dependency exposes this API only privately\n"
+
+
+@final
+class NoBlanketSuppression(Rule):
+    id = "no-blanket-suppression"
+    code = "SARJ523"
+    documentation: ClassVar[RuleDocumentation | None] = RuleDocumentation(
+        summary="Use named, line-local suppressions instead of blanket, file or range disables.",
+        rationale=(
+            "A blanket suppression hides unrelated errors on its line. A file-level diagnostic downgrade also "
+            "authorizes future defects outside the reviewed exception. Suppression checks cannot waive themselves."
+        ),
+        remediation="Fix the diagnostic or use an exact, line-local rule code with a concrete boundary reason.",
+        category=RuleCategory.CORRECTNESS,
+        autofix=AutofixPolicy.NONE,
+        limitations=(
+            "Checks actual Python comment tokens for bare or empty sarj-noqa, unscoped pyright: ignore, basic/standard Pyright modes, report* downgrades below error, analyzeUnannotatedFunctions/disableBytesTypePromotions/strictParameterNoneValue=false and scoped Ruff/Flake8 file or Ruff range disables. SARJ054 retains precedence for Ruff banned-api file directives.",
+            "Ruff owns blanket noqa and type: ignore through PGH004 and PGH003. Exact local exceptions remain available; this rule does not judge whether their explanations justify the exception.",
+            "Directive examples inside strings and unrelated Pyright feature flags are excluded. Source-generated markers cannot waive accountability; use explicit whole-path exclusions for generated/vendor code. Consumer type-checker configuration remains outside this source rule.",
+            "The full Standards gate protects this rule and the existing suppression-accountability checks from inline waivers, rule exclusions and diagnostic baselines. Explicitly selected partial checks remain scoped.",
+        ),
+        examples=(
+            RuleExample(
+                example_id="blanket-type-ignore",
+                title="An unscoped ignore hides every diagnostic on the line",
+                outcome=ExampleOutcome.MATCH,
+                files=(ExampleFile.python("app/adapter.py", _BAD),),
+                focus_path=PurePosixPath("app/adapter.py"),
+                expected_count=1,
+                public=True,
+            ),
+            RuleExample(
+                example_id="exact-local-exception",
+                title="A named diagnostic retains the dependency boundary explanation",
+                outcome=ExampleOutcome.NO_MATCH,
+                files=(ExampleFile.python("app/adapter.py", _GOOD),),
+                focus_path=PurePosixPath("app/adapter.py"),
+                expected_count=0,
+                public=True,
+            ),
+        ),
+    )
+    description = documentation.summary
+
+    @override
+    def check_context(self, context: PythonFileContext) -> list[Diagnostic]:
+        findings: list[Diagnostic] = []
+        for comment in scan_comments_or_none(context.source) or ():
+            bare_sarj = any(_SARJ_CODES.match(match["tail"]) is None for match in _SARJ.finditer(comment.body))
+            broad_pyright = any(
+                _broad_pyright(match["tail"].strip(), configuration=match.start() == 0)
+                for match in _PYRIGHT.finditer(comment.body)
+            )
+            broad_ruff = _broad_ruff(comment.body) if comment.standalone else False
+            if bare_sarj or broad_pyright or broad_ruff:
+                findings.append(
+                    Diagnostic(
+                        context.path,
+                        comment.line,
+                        comment.col,
+                        self.code,
+                        "Use a named, line-local suppression with a concrete reason; blanket ignores and "
+                        "file/range disables hide unrelated diagnostics.",
+                        column_encoding=ColumnEncoding.CODEPOINTS,
+                    )
+                )
+        return findings
+
+
+def _broad_ruff(body: str) -> bool:
+    if _FLAKE8_BROAD.match(body) is not None:
+        return True
+    match = _RUFF_BROAD.match(body)
+    if match is None:
+        return False
+    selectors = (match["file"] or match["codes"] or "").upper()
+    return not {"TID251", "BANNED-API"}.intersection(part.strip() for part in selectors.split(","))
+
+
+def _broad_pyright(tail: str, *, configuration: bool) -> bool:
+    if re.match(r"ignore(?=$|\s|\[)", tail) is not None:
+        return _SCOPED_IGNORE.match(tail) is None
+    if not configuration:
+        return False
+    options = tail.split("--", 1)[0].split("—", 1)[0].split(",")
+    for raw in options:
+        option = raw.strip()
+        if option in _WEAKER_MODES:
+            return True
+        name, separator, value = option.partition("=")
+        if separator and name.strip() in _DISABLED_CHECKS and value.strip() == "false":
+            return True
+        if separator and _DIAGNOSTIC.fullmatch(name.strip()) and value.strip() in _WEAKENED:
+            return True
+    return False

{sarj_python_lint-1.63.0 → sarj_python_lint-1.64.0}/src/sarj_python_lint/rules/no_fixed_sleep_in_loop.py

@@ -235,7 +235,12 @@ def _folded_seconds(node: ast.expr | None, constants: Mapping[str, float]) -> fl
             return None if value is None else -value
         case ast.BinOp(left=left, op=op, right=right):
             lhs, rhs = _folded_seconds(left, constants), _folded_seconds(right, constants)
-            return None if lhs is None or rhs is None else _arithmetic(op, lhs, rhs)
+            if lhs is None or rhs is None:
+                return None
+            try:
+                return _arithmetic(op, lhs, rhs)
+            except OverflowError:
+                return None
         case _:
             return None
 

{sarj_python_lint-1.63.0 → sarj_python_lint-1.64.0}/src/sarj_python_lint/rules/no_offset_pagination.py

@@ -60,7 +60,7 @@ class NoOffsetPagination(Rule):
         category=RuleCategory.PERFORMANCE,
         autofix=AutofixPolicy.NONE,
         limitations=(
-            "Only SQL string literals in recognized store modules are analyzed.",
+            "Only SQL string literals, f-strings, and their static concatenations in recognized store modules are analyzed.",
             "Only dynamic OFFSET values in credible SELECT queries are reported; fixed ordinal offsets are excluded.",
             "Parenthesized arithmetic and common numeric wrappers such as GREATEST, LEAST, and COALESCE preserve the dynamic driver marker. Arbitrary SQL functions and procedural values remain opaque.",
             "Generated files, migrations, docstrings, comments, quoted identifiers, and BigQuery `WITH OFFSET AS` array indexing are excluded.",
@@ -95,6 +95,36 @@ class NoOffsetPagination(Rule):
                 expected_count=0,
                 public=True,
             ),
+            RuleExample(
+                example_id="concatenated-dynamic-offset",
+                title="Concatenation retains a dynamic offset",
+                outcome=ExampleOutcome.MATCH,
+                files=(
+                    ExampleFile.python(
+                        "app/task_store.py",
+                        "QUERY = 'SELECT id FROM task ORDER BY id ' + f'LIMIT 10 OFFSET {offset}'\n",
+                    ),
+                ),
+                focus_path=PurePosixPath("app/task_store.py"),
+                expected_count=1,
+                scenario="concatenated-sql",
+                public=True,
+            ),
+            RuleExample(
+                example_id="concatenated-static-offset",
+                title="A dynamic limit does not make the offset dynamic",
+                outcome=ExampleOutcome.NO_MATCH,
+                files=(
+                    ExampleFile.python(
+                        "app/task_store.py",
+                        "QUERY = f'SELECT id FROM task LIMIT {limit} ' + 'OFFSET 2'\n",
+                    ),
+                ),
+                focus_path=PurePosixPath("app/task_store.py"),
+                expected_count=0,
+                scenario="concatenated-sql",
+                public=True,
+            ),
         ),
     )
     description = documentation.summary
@@ -168,15 +198,7 @@ def _has_dynamic_numeric_offset(sql: str) -> bool:
 
 
 def _sql_value(node: ast.expr) -> str | None:
-    if isinstance(node, ast.JoinedStr):
-        pieces: list[str] = []
-        for value in node.values:
-            if isinstance(value, ast.Constant) and isinstance(value.value, str):
-                pieces.append(value.value)
-            elif isinstance(value, ast.FormattedValue):
-                pieces.append(":__sarj_dynamic__")
-        return "".join(pieces)
-    return sql_string_value(node)
+    return sql_string_value(node, interpolation_placeholder=":__sarj_dynamic__")
 
 
 def _mask_dialect_noise(sql: str) -> str: