sarj-python-lint 1.63.1__tar.gz → 1.64.0__tar.gz

{sarj_python_lint-1.63.1 → sarj_python_lint-1.64.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sarj-python-lint
-Version: 1.63.1
+Version: 1.64.0
 Summary: Custom Python lint rules — AST-based, pre-commit-friendly, hypermodern defaults
 Project-URL: Homepage, https://code-standards.sarj.ai/rules/python/
 Project-URL: Documentation, https://code-standards.sarj.ai/rules/python/

{sarj_python_lint-1.63.1 → sarj_python_lint-1.64.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sarj-python-lint"
-version = "1.63.1"
+version = "1.64.0"
 description = "Custom Python lint rules — AST-based, pre-commit-friendly, hypermodern defaults"
 readme = "README.md"
 authors = [{ name = "sarj-ai" }]

{sarj_python_lint-1.63.1 → sarj_python_lint-1.64.0}/src/sarj_python_lint/__main__.py

@@ -23,6 +23,7 @@ from sarj_python_lint.rule_base import Diagnostic, ProjectRule, Rule, Severity,
 from sarj_python_lint.rules import REGISTRY
 from sarj_python_lint.rules._paths import clear_path_caches
 from sarj_python_lint.rules._project_index import ProjectIndexSet
+from sarj_python_lint.suppression_policy import PROTECTED_SUPPRESSION_CODES
 
 
 SKIP_DIR_NAMES = frozenset(
@@ -46,11 +47,17 @@ SKIP_DIR_NAMES = frozenset(
     }
 )
 
-# Skip files larger than this — they are almost always generated/vendored, not
-# hand-written source worth linting.
+# Bound resource use, but never turn an unanalyzed selected file into success.
 _MAX_FILE_BYTES = 500_000
 
 
+def _checked_size(path: Path) -> Path:
+    if path.stat().st_size > _MAX_FILE_BYTES:
+        msg = f"selected Python source exceeds {_MAX_FILE_BYTES} bytes: {path}; use an explicit path exclusion for generated source"
+        raise ValueError(msg)
+    return path
+
+
 def expand_paths(paths: list[Path]) -> list[Path]:
     out: list[Path] = []
     for p in paths:
@@ -58,11 +65,7 @@ def expand_paths(paths: list[Path]) -> list[Path]:
             msg = f"input does not exist: {p}"
             raise ValueError(msg)
         if p.is_file():
-            try:
-                if p.stat().st_size <= _MAX_FILE_BYTES:
-                    out.append(p)
-            except OSError:
-                pass
+            out.append(_checked_size(p))
             continue
         out.extend(_python_files(p))
     return out
@@ -78,11 +81,8 @@ def _python_files(p: Path) -> list[Path]:
             if not fnmatch(name, "*.py"):
                 continue
             child = directory / name
-            try:
-                if child.is_file() and child.stat().st_size <= _MAX_FILE_BYTES:
-                    out.append(child)
-            except OSError:
-                continue
+            if child.is_file():
+                out.append(_checked_size(child))
     return sorted(out)
 
 
@@ -109,12 +109,7 @@ def _check(rule_ids: list[str], paths: list[Path]) -> list[Diagnostic]:
         rule.prepare_session(session)
     clear_path_caches()
     expanded = expand_paths(paths)
-    loaded: dict[Path, str] = {}
-    for path in expanded:
-        try:
-            loaded[path] = read_python_source(path)
-        except OSError:
-            continue
+    loaded = {path: read_python_source(path) for path in expanded}
     project_rules = [rule for rule in rules if isinstance(rule, ProjectRule)]
     if project_rules:
         indexes = ProjectIndexSet.build(expanded, loaded, facts=session.first_party)
@@ -131,14 +126,13 @@ def check_source(
     rules: list[Rule], p: Path, source: str, *, session: AnalysisSession | None = None
 ) -> list[Diagnostic]:
     context = PythonFileContext(p, source, session)
+    if rules and context.tree is None:
+        msg = f"selected Python source could not be parsed: {p}"
+        raise ValueError(msg)
     source_lines = context.source_lines
     raw = [diagnostic for rule in rules for diagnostic in rule.check_context(context)]
     return deduplicate_diagnostics(
-        [
-            diagnostic
-            for diagnostic in raw
-            if diagnostic.code == "SARJ419" or not is_suppressed(source_lines, diagnostic.line, diagnostic.code)
-        ],
+        [diagnostic for diagnostic in raw if not is_suppressed(source_lines, diagnostic.line, diagnostic.code)],
         source=source,
         context=context,
     )
@@ -157,6 +151,9 @@ def analyze(
 
 _DIAGNOSTIC_PRECEDENCE = MappingProxyType(
     {
+        "SARJ054": frozenset({"SARJ419"}),
+        "SARJ448": frozenset({"SARJ419"}),
+        "SARJ523": frozenset({"SARJ419"}),
         "SARJ050": frozenset({"SARJ420"}),
         "SARJ084": frozenset({"SARJ050", "SARJ420"}),
         "SARJ085": frozenset({"SARJ420"}),
@@ -417,7 +414,7 @@ def _explain(wanted: str) -> int:
 def _baseline_counts(diags: list[Diagnostic]) -> dict[str, dict[str, int]]:
     counts: dict[str, dict[str, int]] = {}
     for d in diags:
-        if d.severity is Severity.WARNING:
+        if d.severity is Severity.WARNING or d.code in PROTECTED_SUPPRESSION_CODES:
             continue
         key = _baseline_path(d.path)
         counts.setdefault(key, {})
@@ -467,7 +464,7 @@ def _apply_baseline(
     seen: Counter[tuple[str, str]] = Counter()
     out: list[Diagnostic] = []
     for d in diags:
-        if d.severity is Severity.WARNING:
+        if d.severity is Severity.WARNING or d.code in PROTECTED_SUPPRESSION_CODES:
             out.append(d)
             continue
         path_key = _baseline_path(d.path, root=root)

sarj_python_lint-1.64.0/src/sarj_python_lint/cast_access.py

@@ -0,0 +1,251 @@
+from __future__ import annotations
+
+import ast
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, Literal
+
+from sarj_python_lint._file_context import PythonFileContext
+from sarj_python_lint.rules._namespace_access import dynamic_namespace_access
+from sarj_python_lint.rules._resource_provenance import ResourceProvenance
+
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+    from pathlib import Path
+
+
+_TYPING = frozenset({"typing", "typing_extensions"})
+_GETATTR_ARITIES = frozenset({2, 3})
+_MAX_LITERAL_DEPTH = 12
+_CAST_LENGTH = len("cast")
+_COMPREHENSIONS = (ast.ListComp, ast.SetComp, ast.DictComp, ast.GeneratorExp)
+
+
+@dataclass(frozen=True, slots=True)
+class CastAccess:
+    node: ast.Call | ast.Subscript | ast.ImportFrom
+    qualified_api: str
+    kind: Literal["wildcard", "reflection"]
+
+
+def indirect_typing_cast_accesses(path: Path, source: str) -> tuple[CastAccess, ...]:
+    context = PythonFileContext(path, source)
+    if not any(marker in context.symbol_source for marker in ("*", "getattr", "__dict__", "vars", "__getattribute__")):
+        return ()
+    if context.tree is None:
+        return ()
+    accesses = [
+        CastAccess(node, f"{node.module}.cast", "wildcard")
+        for node in context.nodes(ast.ImportFrom)
+        if node.level == 0 and node.module in _TYPING and any(alias.name == "*" for alias in node.names)
+    ]
+    accesses.extend(_reflection_accesses(context))
+    return tuple(sorted(accesses, key=lambda access: (access.node.lineno, access.node.col_offset)))
+
+
+def _reflection_accesses(context: PythonFileContext) -> list[CastAccess]:
+    provenance = ResourceProvenance(context)
+    candidates = [
+        (node, receiver)
+        for node in context.nodes(ast.Call, ast.Subscript)
+        if (receiver := _cast_receiver(node, provenance)) is not None
+    ]
+    if not candidates:
+        return []
+    receivers = {id(receiver) for _, receiver in candidates}
+    proven = [
+        (node, module)
+        for node, receiver in candidates
+        if (module := _typing_receiver(receiver, provenance, receivers)) is not None
+    ]
+    safe_reflection = {id(carrier) for node, _ in proven if (carrier := _reflection_carrier(node)) is not None}
+    namespace_hazard = dynamic_namespace_access(
+        (node for node in context.nodes(ast.AST) if id(node) not in safe_reflection), context.imports, context.parents
+    )
+    if provenance.wildcard or namespace_hazard or not provenance.builtin_namespace_untouched:
+        return []
+    return [CastAccess(node, f"{module}.cast", "reflection") for node, module in proven]
+
+
+def _cast_receiver(node: ast.Call | ast.Subscript, provenance: ResourceProvenance) -> ast.Name | None:
+    if isinstance(node, ast.Call):
+        return _call_receiver(node, provenance)
+    if not isinstance(node.ctx, ast.Load) or _static_text(node.slice) != "cast":
+        return None
+    namespace = node.value
+    if isinstance(namespace, ast.Attribute) and namespace.attr == "__dict__" and isinstance(namespace.value, ast.Name):
+        return namespace.value
+    if isinstance(namespace, ast.Call) and len(namespace.args) == 1 and _builtin_call(namespace, "vars", provenance):
+        return namespace.args[0] if isinstance(namespace.args[0], ast.Name) else None
+    return None
+
+
+def _call_receiver(node: ast.Call, provenance: ResourceProvenance) -> ast.Name | None:
+    if (
+        len(node.args) in _GETATTR_ARITIES
+        and _builtin_call(node, "getattr", provenance)
+        and _static_text(node.args[1]) == "cast"
+    ):
+        return node.args[0] if isinstance(node.args[0], ast.Name) else None
+    if (
+        isinstance(node.func, ast.Attribute)
+        and node.func.attr == "__getattribute__"
+        and len(node.args) == 1
+        and not node.keywords
+        and _static_text(node.args[0]) == "cast"
+    ):
+        return node.func.value if isinstance(node.func.value, ast.Name) else None
+    return None
+
+
+def _builtin_call(call: ast.Call, name: str, provenance: ResourceProvenance) -> bool:
+    if not isinstance(call.func, ast.Name) or call.func.id != name or call.keywords:
+        return False
+    return not _type_parameter_shadowed(name, call.func, provenance) and all(
+        name not in provenance.bindings.get(scope, {}) for scope in _lexical_scopes(call.func, provenance)
+    )
+
+
+def _lexical_scopes(node: ast.AST, provenance: ResourceProvenance) -> Iterator[ast.AST]:
+    scope = _evaluation_scope(node, provenance)
+    immediate = True
+    while scope is not None:
+        # Ordinary nested code blocks do not capture class locals.
+        if immediate or not isinstance(scope, ast.ClassDef):
+            yield scope
+        immediate = False
+        scope = _evaluation_scope(scope, provenance)
+
+
+def _evaluation_scope(node: ast.AST, provenance: ResourceProvenance) -> ast.AST | None:
+    scope = provenance.scope(node)
+    if isinstance(scope, ast.FunctionDef | ast.AsyncFunctionDef | ast.ClassDef) and _owner_annotation(
+        node, scope, provenance
+    ):
+        node, scope = scope, provenance.scope(scope)
+    while isinstance(scope, _COMPREHENSIONS):
+        iterable = scope.generators[0].iter
+        if iterable is not node and not provenance.contains(iterable, node):
+            break
+        # A comprehension's first iterable is evaluated in the enclosing scope.
+        node, scope = scope, provenance.scope(scope)
+    return scope
+
+
+def _owner_annotation(
+    node: ast.AST, owner: ast.FunctionDef | ast.AsyncFunctionDef | ast.ClassDef, provenance: ResourceProvenance
+) -> bool:
+    if any(parameter is node or provenance.contains(parameter, node) for parameter in owner.type_params):
+        return True
+    return isinstance(owner, ast.FunctionDef | ast.AsyncFunctionDef) and _function_annotation(node, owner, provenance)
+
+
+def _function_annotation(
+    node: ast.AST, function: ast.FunctionDef | ast.AsyncFunctionDef, provenance: ResourceProvenance
+) -> bool:
+    current = node
+    while (parent := provenance.context.parents.get(current)) is not None:
+        if (parent is function and current is function.returns) or (
+            isinstance(parent, ast.arg) and current is parent.annotation
+        ):
+            return True
+        if parent is function:
+            break
+        current = parent
+    return False
+
+
+def _type_parameter_shadowed(name: str, node: ast.AST, provenance: ResourceProvenance) -> bool:
+    current: ast.AST | None = node
+    while current is not None:
+        if (
+            isinstance(current, ast.FunctionDef | ast.AsyncFunctionDef | ast.ClassDef | ast.TypeAlias)
+            and any(
+                isinstance(parameter, ast.TypeVar | ast.TypeVarTuple | ast.ParamSpec) and parameter.name == name
+                for parameter in current.type_params
+            )
+            and not _outside_parameter_scope(node, current, provenance)
+            and not _local_binding_overrides(name, node, current, provenance)
+        ):
+            return True
+        current = provenance.context.parents.get(current)
+    return False
+
+
+def _outside_parameter_scope(
+    node: ast.AST,
+    owner: ast.FunctionDef | ast.AsyncFunctionDef | ast.ClassDef | ast.TypeAlias,
+    provenance: ResourceProvenance,
+) -> bool:
+    outside = [] if isinstance(owner, ast.TypeAlias) else list(owner.decorator_list)
+    if isinstance(owner, ast.FunctionDef | ast.AsyncFunctionDef):
+        outside.extend(owner.args.defaults)
+        outside.extend(value for value in owner.args.kw_defaults if value is not None)
+    # Defaults and decorators evaluate in the enclosing scope.
+    return any(value is node or provenance.contains(value, node) for value in outside)
+
+
+def _local_binding_overrides(name: str, node: ast.AST, owner: ast.AST, provenance: ResourceProvenance) -> bool:
+    for scope in _lexical_scopes(node, provenance):
+        if scope is not owner and not provenance.contains(owner, scope):
+            return False
+        if name in provenance.bindings.get(scope, {}):
+            return True
+    return False
+
+
+def _static_text(node: ast.expr, depth: int = 0) -> str | None:
+    # Evaluate only bounded, side-effect-free string syntax, never runtime code.
+    if depth > _MAX_LITERAL_DEPTH:
+        return None
+    if isinstance(node, ast.Constant) and isinstance(node.value, str):
+        return node.value if len(node.value) <= _CAST_LENGTH else None
+    if isinstance(node, ast.JoinedStr):
+        # Parsing adjacent static f-strings folds them into one Constant.
+        return _static_text(node.values[0], depth + 1) if len(node.values) == 1 else None
+    if not isinstance(node, ast.BinOp) or not isinstance(node.op, ast.Add):
+        return None
+    left, right = _static_text(node.left, depth + 1), _static_text(node.right, depth + 1)
+    if left is None or right is None:
+        return None
+    text = left + right
+    return text if len(text) <= _CAST_LENGTH else None
+
+
+def _reflection_carrier(node: ast.Call | ast.Subscript) -> ast.AST | None:
+    if isinstance(node, ast.Call) and isinstance(node.func, ast.Attribute):
+        return node.func
+    if isinstance(node, ast.Subscript):
+        return node.value.func if isinstance(node.value, ast.Call) else node.value
+    return None
+
+
+def _typing_receiver(node: ast.Name, provenance: ResourceProvenance, receivers: set[int]) -> str | None:
+    if node.id in provenance.mutated | provenance.external_bindings:
+        return None
+    binding = _name_binding(node, provenance)
+    if not (
+        isinstance(binding, ast.alias)
+        and isinstance(provenance.context.parents.get(binding), ast.Import)
+        and binding.name in _TYPING
+    ):
+        return None
+    for read in provenance.reads.get(node.id, ()):
+        if _name_binding(read, provenance) is not binding:
+            continue
+        parent = provenance.context.parents.get(read)
+        if isinstance(parent, ast.Attribute) and parent.value is read:
+            continue
+        if id(read) in receivers:
+            continue
+        return None
+    return binding.name
+
+
+def _name_binding(node: ast.Name, provenance: ResourceProvenance) -> ast.AST | None:
+    if _type_parameter_shadowed(node.id, node, provenance):
+        return None
+    for scope in _lexical_scopes(node, provenance):
+        if bindings := provenance.bindings.get(scope, {}).get(node.id):
+            return provenance.binding(node.id, bindings[0])
+    return None

{sarj_python_lint-1.63.1 → sarj_python_lint-1.64.0}/src/sarj_python_lint/rule_base.py

@@ -20,6 +20,7 @@ from sarj_rule_contracts import (
 )
 
 from sarj_python_lint._python_target import PythonTargetFacts
+from sarj_python_lint.suppression_policy import PROTECTED_SUPPRESSION_CODES
 
 
 if TYPE_CHECKING:
@@ -43,7 +44,7 @@ _SARJ_NOQA_RE = re.compile(
 
 
 def is_suppressed(source_lines: Sequence[str], line: int, code: str) -> bool:
-    if line < 1 or line > len(source_lines):
+    if code.upper() in PROTECTED_SUPPRESSION_CODES or line < 1 or line > len(source_lines):
         return False
     text = source_lines[line - 1]
     m = _SARJ_NOQA_RE.search(text)
@@ -58,8 +59,7 @@ def is_suppressed(source_lines: Sequence[str], line: int, code: str) -> bool:
     codes_str = m.group(1)
     trailing = comment[m.end() :]
     if codes_str is None:
-        # A complete bare marker preserves the existing all-codes waiver contract.
-        return not (trailing and (not trailing[0].isspace() or trailing.lstrip().startswith(":")))
+        return False
     reason = trailing.lstrip()
     single_dash_reason = reason.startswith("-") and (codes_str[-1:].isspace() or trailing[:1].isspace())
     if reason and not reason.startswith(("--", "—", "–")) and not single_dash_reason:

{sarj_python_lint-1.63.1 → sarj_python_lint-1.64.0}/src/sarj_python_lint/rules/_registry.py

@@ -34,6 +34,7 @@ from sarj_python_lint.rules.no_analytical_aggregation_in_postgres_store import (
 from sarj_python_lint.rules.no_any_mapping_types import NoAnyMappingTypes
 from sarj_python_lint.rules.no_async_function_cache import NoAsyncFunctionCache
 from sarj_python_lint.rules.no_before_validator_input_mutation import NoBeforeValidatorInputMutation
+from sarj_python_lint.rules.no_blanket_suppression import NoBlanketSuppression
 from sarj_python_lint.rules.no_broad_keyword_capture import NoBroadKeywordCapture
 from sarj_python_lint.rules.no_comment_cruft import NoCommentCruft
 from sarj_python_lint.rules.no_conftest_test_module_import import NoConftestTestModuleImport
@@ -329,6 +330,7 @@ REGISTRY: Mapping[str, type[Rule]] = MappingProxyType(
         RequirePydanticForExternalJson.id: RequirePydanticForExternalJson,
         RequirePydanticForMappingShape.id: RequirePydanticForMappingShape,
         NoDualShapeModelFieldReader.id: NoDualShapeModelFieldReader,
+        NoBlanketSuppression.id: NoBlanketSuppression,
         PreferModuleLevelConstant.id: PreferModuleLevelConstant,
         PreferImmutableModuleConstant.id: PreferImmutableModuleConstant,
         PreferInjectedDependencyOverMonkeypatch.id: PreferInjectedDependencyOverMonkeypatch,

sarj_python_lint-1.64.0/src/sarj_python_lint/rules/no_blanket_suppression.py

@@ -0,0 +1,134 @@
+from __future__ import annotations
+
+from pathlib import PurePosixPath
+import re
+from typing import TYPE_CHECKING, ClassVar, final, override
+
+from sarj_python_lint.rule_base import (
+    AutofixPolicy,
+    ColumnEncoding,
+    Diagnostic,
+    ExampleFile,
+    ExampleOutcome,
+    Rule,
+    RuleCategory,
+    RuleDocumentation,
+    RuleExample,
+)
+from sarj_python_lint.rules._suppression_comments import scan_comments_or_none
+
+
+if TYPE_CHECKING:
+    from sarj_python_lint._file_context import PythonFileContext
+
+
+_SARJ = re.compile(r"(?:^|#\s*)sarj-noqa\b(?P<tail>[^#]*)", re.IGNORECASE)
+_SARJ_CODES = re.compile(r"^:\s*SARJ\d+\b", re.IGNORECASE)
+_PYRIGHT = re.compile(r"(?:^|#\s*)pyright:\s*(?P<tail>[^#]*)")
+_SCOPED_IGNORE = re.compile(r"^ignore\s*\[\s*report[A-Za-z]+(?:\s*,\s*report[A-Za-z]+)*\s*,?\s*\]")
+_DIAGNOSTIC = re.compile(r"^report[A-Z][A-Za-z]+$")
+_WEAKENED = frozenset({"false", "none", "warning", "information", "hint"})
+_WEAKER_MODES = frozenset({"basic", "standard"})
+_DISABLED_CHECKS = frozenset({"analyzeUnannotatedFunctions", "disableBytesTypePromotions", "strictParameterNoneValue"})
+_RUFF_BROAD = re.compile(
+    r"^ruff:\s*(?:file-ignore\s*\[(?P<file>[^\]]+)\]|noqa\s*:\s*(?P<codes>[A-Za-z0-9_, ]+)|disable\s*\[[^\]]+\])",
+    re.IGNORECASE,
+)
+_FLAKE8_BROAD = re.compile(r"^flake8:\s*noqa\s*:\s*[A-Za-z][A-Za-z0-9]*", re.IGNORECASE)
+_BAD = "def value() -> str:\n    return 1 # pyright: ignore\n"
+_GOOD = "value = vendor.value # pyright: ignore[reportPrivateUsage] -- the dependency exposes this API only privately\n"
+
+
+@final
+class NoBlanketSuppression(Rule):
+    id = "no-blanket-suppression"
+    code = "SARJ523"
+    documentation: ClassVar[RuleDocumentation | None] = RuleDocumentation(
+        summary="Use named, line-local suppressions instead of blanket, file or range disables.",
+        rationale=(
+            "A blanket suppression hides unrelated errors on its line. A file-level diagnostic downgrade also "
+            "authorizes future defects outside the reviewed exception. Suppression checks cannot waive themselves."
+        ),
+        remediation="Fix the diagnostic or use an exact, line-local rule code with a concrete boundary reason.",
+        category=RuleCategory.CORRECTNESS,
+        autofix=AutofixPolicy.NONE,
+        limitations=(
+            "Checks actual Python comment tokens for bare or empty sarj-noqa, unscoped pyright: ignore, basic/standard Pyright modes, report* downgrades below error, analyzeUnannotatedFunctions/disableBytesTypePromotions/strictParameterNoneValue=false and scoped Ruff/Flake8 file or Ruff range disables. SARJ054 retains precedence for Ruff banned-api file directives.",
+            "Ruff owns blanket noqa and type: ignore through PGH004 and PGH003. Exact local exceptions remain available; this rule does not judge whether their explanations justify the exception.",
+            "Directive examples inside strings and unrelated Pyright feature flags are excluded. Source-generated markers cannot waive accountability; use explicit whole-path exclusions for generated/vendor code. Consumer type-checker configuration remains outside this source rule.",
+            "The full Standards gate protects this rule and the existing suppression-accountability checks from inline waivers, rule exclusions and diagnostic baselines. Explicitly selected partial checks remain scoped.",
+        ),
+        examples=(
+            RuleExample(
+                example_id="blanket-type-ignore",
+                title="An unscoped ignore hides every diagnostic on the line",
+                outcome=ExampleOutcome.MATCH,
+                files=(ExampleFile.python("app/adapter.py", _BAD),),
+                focus_path=PurePosixPath("app/adapter.py"),
+                expected_count=1,
+                public=True,
+            ),
+            RuleExample(
+                example_id="exact-local-exception",
+                title="A named diagnostic retains the dependency boundary explanation",
+                outcome=ExampleOutcome.NO_MATCH,
+                files=(ExampleFile.python("app/adapter.py", _GOOD),),
+                focus_path=PurePosixPath("app/adapter.py"),
+                expected_count=0,
+                public=True,
+            ),
+        ),
+    )
+    description = documentation.summary
+
+    @override
+    def check_context(self, context: PythonFileContext) -> list[Diagnostic]:
+        findings: list[Diagnostic] = []
+        for comment in scan_comments_or_none(context.source) or ():
+            bare_sarj = any(_SARJ_CODES.match(match["tail"]) is None for match in _SARJ.finditer(comment.body))
+            broad_pyright = any(
+                _broad_pyright(match["tail"].strip(), configuration=match.start() == 0)
+                for match in _PYRIGHT.finditer(comment.body)
+            )
+            broad_ruff = _broad_ruff(comment.body) if comment.standalone else False
+            if bare_sarj or broad_pyright or broad_ruff:
+                findings.append(
+                    Diagnostic(
+                        context.path,
+                        comment.line,
+                        comment.col,
+                        self.code,
+                        "Use a named, line-local suppression with a concrete reason; blanket ignores and "
+                        "file/range disables hide unrelated diagnostics.",
+                        column_encoding=ColumnEncoding.CODEPOINTS,
+                    )
+                )
+        return findings
+
+
+def _broad_ruff(body: str) -> bool:
+    if _FLAKE8_BROAD.match(body) is not None:
+        return True
+    match = _RUFF_BROAD.match(body)
+    if match is None:
+        return False
+    selectors = (match["file"] or match["codes"] or "").upper()
+    return not {"TID251", "BANNED-API"}.intersection(part.strip() for part in selectors.split(","))
+
+
+def _broad_pyright(tail: str, *, configuration: bool) -> bool:
+    if re.match(r"ignore(?=$|\s|\[)", tail) is not None:
+        return _SCOPED_IGNORE.match(tail) is None
+    if not configuration:
+        return False
+    options = tail.split("--", 1)[0].split("—", 1)[0].split(",")
+    for raw in options:
+        option = raw.strip()
+        if option in _WEAKER_MODES:
+            return True
+        name, separator, value = option.partition("=")
+        if separator and name.strip() in _DISABLED_CHECKS and value.strip() == "false":
+            return True
+        if separator and _DIAGNOSTIC.fullmatch(name.strip()) and value.strip() in _WEAKENED:
+            return True
+    return False