secure-code-agent 0.4.0__tar.gz → 0.5.0__tar.gz

{secure_code_agent-0.4.0/src/secure_code_agent.egg-info → secure_code_agent-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.4.0
+Version: 0.5.0
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -375,6 +375,31 @@ SARIF upload. Pin production usage to a full commit SHA; the version tag above
 is shown for readability. See [`action.yml`](action.yml) and
 [`examples/github-actions/`](examples/github-actions/) for full workflows.
 
+## maintainability-agent integration
+
+`maintainability-agent` declares Security a **delegated** pillar naming this
+tool, and reports it as `NotApplicable` so silence is never read as safety.
+This tool emits the artifact that completes the picture:
+
+```bash
+secure-code-agent . --security-pillar security-pillar.json
+maintainability-agent . --security-pillar security-pillar.json
+```
+
+Standalone use is unaffected — without the flag nothing is written and every
+other output is identical. MA never executes this tool, and this tool never
+imports MA; two independently releasable packages exchanging one document.
+
+The artifact carries **two values that are never averaged**: a practice level
+read from configuration and CI (*is anything preventing the next
+vulnerability?*) and a code condition read from the scanners (*what did they
+find?*). `condition` is `null` whenever scanner coverage is incomplete — this
+tool's score is a rate over findings, so removing scanners makes the raw number
+go **up**, and an unscanned repository must not arrive at MA looking measured.
+
+Full contract, invariants and the practice rubric:
+[`docs/ma-integration.md`](docs/ma-integration.md).
+
 ## What this is NOT
 
 - ❌ **Not a SAST engine.** We delegate to Semgrep / Bandit / CodeQL / etc. — we don't write yet another AST analyzer.
@@ -398,6 +423,8 @@ Full design philosophy in [`docs/design.md`](docs/design.md).
 
 - [`docs/product-intent.md`](docs/product-intent.md) — Why this exists, who it serves, what it refuses to become
 - [`docs/decisions.md`](docs/decisions.md)        — Decision register: rulings the code alone cannot answer
+- [`docs/ma-integration.md`](docs/ma-integration.md) — The `security-pillar.json` contract maintainability-agent reads
+- [`docs/calibration.md`](docs/calibration.md)   — The calibration study, its corpus, and what it found
 - [`docs/design.md`](docs/design.md)              — Architecture + non-goals + scanner protocol
 - [`docs/architecture.md`](docs/architecture.md)  — Audit of the system as built + remediation sequence
 - [`docs/release-blockers.md`](docs/release-blockers.md) — Open v0.3.0 release blockers (do not tag until closed)

{secure_code_agent-0.4.0 → secure_code_agent-0.5.0}/README.md

@@ -329,6 +329,31 @@ SARIF upload. Pin production usage to a full commit SHA; the version tag above
 is shown for readability. See [`action.yml`](action.yml) and
 [`examples/github-actions/`](examples/github-actions/) for full workflows.
 
+## maintainability-agent integration
+
+`maintainability-agent` declares Security a **delegated** pillar naming this
+tool, and reports it as `NotApplicable` so silence is never read as safety.
+This tool emits the artifact that completes the picture:
+
+```bash
+secure-code-agent . --security-pillar security-pillar.json
+maintainability-agent . --security-pillar security-pillar.json
+```
+
+Standalone use is unaffected — without the flag nothing is written and every
+other output is identical. MA never executes this tool, and this tool never
+imports MA; two independently releasable packages exchanging one document.
+
+The artifact carries **two values that are never averaged**: a practice level
+read from configuration and CI (*is anything preventing the next
+vulnerability?*) and a code condition read from the scanners (*what did they
+find?*). `condition` is `null` whenever scanner coverage is incomplete — this
+tool's score is a rate over findings, so removing scanners makes the raw number
+go **up**, and an unscanned repository must not arrive at MA looking measured.
+
+Full contract, invariants and the practice rubric:
+[`docs/ma-integration.md`](docs/ma-integration.md).
+
 ## What this is NOT
 
 - ❌ **Not a SAST engine.** We delegate to Semgrep / Bandit / CodeQL / etc. — we don't write yet another AST analyzer.
@@ -352,6 +377,8 @@ Full design philosophy in [`docs/design.md`](docs/design.md).
 
 - [`docs/product-intent.md`](docs/product-intent.md) — Why this exists, who it serves, what it refuses to become
 - [`docs/decisions.md`](docs/decisions.md)        — Decision register: rulings the code alone cannot answer
+- [`docs/ma-integration.md`](docs/ma-integration.md) — The `security-pillar.json` contract maintainability-agent reads
+- [`docs/calibration.md`](docs/calibration.md)   — The calibration study, its corpus, and what it found
 - [`docs/design.md`](docs/design.md)              — Architecture + non-goals + scanner protocol
 - [`docs/architecture.md`](docs/architecture.md)  — Audit of the system as built + remediation sequence
 - [`docs/release-blockers.md`](docs/release-blockers.md) — Open v0.3.0 release blockers (do not tag until closed)

{secure_code_agent-0.4.0 → secure_code_agent-0.5.0}/pyproject.toml

@@ -4,7 +4,15 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "secure-code-agent"
-version = "0.4.0"
+# Derived from `secure_code_audit.__version__`, which is the only place the
+# number is written. It used to be duplicated here, and the two drifted: this
+# file said 0.4.0 while the package said 0.3.0, so the released v0.4.0 wheel
+# stamped 0.3.0 into every SARIF document, JSON report, Markdown header,
+# `--version` and the pillar artifact handed to maintainability-agent. The
+# release workflow compared the tag against *this* line and never looked at the
+# package, so nothing caught it. A test asserting the two agree would only
+# police the duplication; removing it is the fix.
+dynamic = ["version"]
 description = "Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -86,6 +94,12 @@ Documentation = "https://github.com/marshallguillory86/secure-code-agent/tree/ma
 Issues        = "https://github.com/marshallguillory86/secure-code-agent/issues"
 Changelog     = "https://github.com/marshallguillory86/secure-code-agent/blob/main/CHANGELOG.md"
 
+[tool.setuptools.dynamic]
+# The single source of truth for the version. `src/secure_code_audit/__init__.py`
+# holds the literal; this reads it. The two cannot drift because there is only
+# one of them.
+version = { attr = "secure_code_audit.__version__" }
+
 [tool.setuptools.packages.find]
 where = ["src"]
 

{secure_code_agent-0.4.0 → secure_code_agent-0.5.0/src/secure_code_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.4.0
+Version: 0.5.0
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -375,6 +375,31 @@ SARIF upload. Pin production usage to a full commit SHA; the version tag above
 is shown for readability. See [`action.yml`](action.yml) and
 [`examples/github-actions/`](examples/github-actions/) for full workflows.
 
+## maintainability-agent integration
+
+`maintainability-agent` declares Security a **delegated** pillar naming this
+tool, and reports it as `NotApplicable` so silence is never read as safety.
+This tool emits the artifact that completes the picture:
+
+```bash
+secure-code-agent . --security-pillar security-pillar.json
+maintainability-agent . --security-pillar security-pillar.json
+```
+
+Standalone use is unaffected — without the flag nothing is written and every
+other output is identical. MA never executes this tool, and this tool never
+imports MA; two independently releasable packages exchanging one document.
+
+The artifact carries **two values that are never averaged**: a practice level
+read from configuration and CI (*is anything preventing the next
+vulnerability?*) and a code condition read from the scanners (*what did they
+find?*). `condition` is `null` whenever scanner coverage is incomplete — this
+tool's score is a rate over findings, so removing scanners makes the raw number
+go **up**, and an unscanned repository must not arrive at MA looking measured.
+
+Full contract, invariants and the practice rubric:
+[`docs/ma-integration.md`](docs/ma-integration.md).
+
 ## What this is NOT
 
 - ❌ **Not a SAST engine.** We delegate to Semgrep / Bandit / CodeQL / etc. — we don't write yet another AST analyzer.
@@ -398,6 +423,8 @@ Full design philosophy in [`docs/design.md`](docs/design.md).
 
 - [`docs/product-intent.md`](docs/product-intent.md) — Why this exists, who it serves, what it refuses to become
 - [`docs/decisions.md`](docs/decisions.md)        — Decision register: rulings the code alone cannot answer
+- [`docs/ma-integration.md`](docs/ma-integration.md) — The `security-pillar.json` contract maintainability-agent reads
+- [`docs/calibration.md`](docs/calibration.md)   — The calibration study, its corpus, and what it found
 - [`docs/design.md`](docs/design.md)              — Architecture + non-goals + scanner protocol
 - [`docs/architecture.md`](docs/architecture.md)  — Audit of the system as built + remediation sequence
 - [`docs/release-blockers.md`](docs/release-blockers.md) — Open v0.3.0 release blockers (do not tag until closed)

{secure_code_agent-0.4.0 → secure_code_agent-0.5.0}/src/secure_code_agent.egg-info/SOURCES.txt

@@ -14,6 +14,8 @@ src/secure_code_audit/config.py
 src/secure_code_audit/findings.py
 src/secure_code_audit/git_tools.py
 src/secure_code_audit/instructions.py
+src/secure_code_audit/pillar.py
+src/secure_code_audit/practice.py
 src/secure_code_audit/remediation.py
 src/secure_code_audit/renderers.py
 src/secure_code_audit/ruleset.py

secure_code_agent-0.5.0/src/secure_code_audit/__init__.py

@@ -0,0 +1,15 @@
+"""secure-code-agent — deterministic security gate + bounded AI remediation prompts."""
+
+#: The only place the version is written. `pyproject.toml` derives it via
+#: `[tool.setuptools.dynamic]`, so the two cannot drift.
+#:
+#: They did drift once, and it shipped: pyproject said 0.4.0 while this said
+#: 0.3.0, so the released v0.4.0 wheel stamped 0.3.0 into every SARIF document,
+#: every JSON report, the Markdown header, `--version`, and the
+#: `security-pillar.json` handed to maintainability-agent. The release workflow
+#: compared the tag against pyproject's line and never looked here — it
+#: verified the half that was right and shipped the half that was wrong.
+#:
+#: PyPI is immutable, so 0.4.0 stays wrong. 0.5.0 is the first build whose
+#: artifacts name their own producer correctly.
+__version__ = "0.5.0"

{secure_code_agent-0.4.0 → secure_code_agent-0.5.0}/src/secure_code_audit/cli.py

@@ -24,8 +24,10 @@ from secure_code_audit import (
 )
 from secure_code_audit import baseline as baseline_mod
 from secure_code_audit import config as config_mod
+from secure_code_audit import pillar as pillar_mod
+from secure_code_audit import practice as practice_mod
 from secure_code_audit.findings import Category, Finding, Severity
-from secure_code_audit.git_tools import find_repo_root, is_excluded, loc_under
+from secure_code_audit.git_tools import find_repo_root, is_excluded, is_test_path, loc_under
 from secure_code_audit.scanner_status import (
     ScannerExecution,
     ScannerOutcome,
@@ -33,7 +35,13 @@ from secure_code_audit.scanner_status import (
     execution_from_result,
 )
 from secure_code_audit.scanners import floor
-from secure_code_audit.scoring import active_gates, evaluate_gates
+from secure_code_audit.scoring import (
+    active_gates,
+    evaluate_gates,
+    partition_by_tree,
+    split_side_axes,
+    summarize_axis,
+)
 from secure_code_audit.scoring import score as score_findings
 from secure_code_audit.scoring import verdict as build_verdict
 
@@ -60,6 +68,14 @@ def _parser() -> argparse.ArgumentParser:
     p.add_argument("--sarif-output", help="SARIF 2.1.0 output path.")
     p.add_argument("--comment-output", help="PR-comment markdown output path.")
     p.add_argument("--prompt-output", help="Remediation prompt output path.")
+    p.add_argument(
+        "--security-pillar",
+        help=(
+            "Write security-pillar.json for maintainability-agent to ingest "
+            "via --security-pillar (D3). Carries practice level and code "
+            "condition as two values that are never averaged."
+        ),
+    )
     p.add_argument("--baseline", help="Baseline file path (read).")
     p.add_argument(
         "--bump-baseline", action="store_true", help="Rewrite the baseline from current findings."
@@ -290,11 +306,37 @@ def _do_audit(args: argparse.Namespace) -> int:
     all_findings = baseline_mod.mark_new(all_findings, baseline)
 
     # ----- scoring -----
+    # The test tree is reported, not scored. A project graded on its test
+    # fixtures is graded on the wrong thing: across the calibration corpus,
+    # including test directories moved the median normalized subtotal from
+    # 4.36 to 50.15 and put ten of fourteen well-maintained projects at F.
+    # Secrets are exempt and stay in the score — see ALWAYS_SCORED_CATEGORIES.
+    root_for_tests = target if target.is_dir() else target.parent
+    all_findings, test_findings = partition_by_tree(
+        all_findings,
+        lambda f: is_test_path(f.file_path, root_for_tests, cfg.test_patterns),
+    )
     if cfg.loc_for_scoring:
         loc = int(cfg.loc_for_scoring.get("value", 0))
+        test_loc = 0
     else:
-        loc = loc_under(target, cfg.include_extensions, cfg.exclude_patterns)
-    score = score_findings(all_findings, loc)
+        loc, test_loc = loc_under(
+            target, cfg.include_extensions, cfg.exclude_patterns, cfg.test_patterns
+        )
+    # Dependencies come off the code-condition score and onto their own axis.
+    # A CVE in a pinned dependency is fixed with a version bump; an injection
+    # flaw is fixed with a rewrite. Averaging them produced the largest
+    # remaining distortion in the corpus — median 15.36 against 7.32.
+    #
+    # The split is between *scoring* and *gating*, not between reported and
+    # hidden: `gated_findings` keeps the dependency advisories, so a critical
+    # runtime CVE still fails a build exactly as before.
+    gated_findings = all_findings
+    scored_findings, dependency_findings = split_side_axes(all_findings)
+    score = score_findings(scored_findings, loc)
+    test_tree = summarize_axis("test tree", test_findings, test_loc)
+    dependencies = summarize_axis("dependencies", dependency_findings)
+    axes = (test_tree, dependencies)
     # Naming an import on the command line asserts that it contributes coverage,
     # so a broken one fails the gate even if no config requires that scanner.
     # Requiring a tool that has nothing to look at would make every
@@ -311,23 +353,41 @@ def _do_audit(args: argparse.Namespace) -> int:
         *(execution.name for execution in imported_executions),
     ]
     coverage = evaluate_coverage(executions, required)
-    gate = evaluate_gates(all_findings, score, cfg.gates, coverage)
+    # Gates see the dependency advisories; the score does not.
+    gate = evaluate_gates(gated_findings, score, cfg.gates, coverage)
     verdict = build_verdict(score, cfg.gates, coverage)
 
     # ----- write outputs -----
     paths = _resolve_outputs(args, cfg, root)
-    _write_outputs(paths, all_findings, score, gate, coverage, ran, unavailable, verdict)
+    # The pillar artifact is what maintainability-agent ingests (D3). Built
+    # here rather than inside a renderer because it needs the practice level,
+    # which is read from configuration and CI rather than from findings.
+    security_pillar = pillar_mod.build(score, verdict, coverage, practice_mod.assess(target), axes)
+    _write_outputs(
+        paths,
+        all_findings,
+        score,
+        gate,
+        coverage,
+        ran,
+        unavailable,
+        verdict,
+        axes,
+        security_pillar,
+    )
     if args.bump_baseline:
         baseline_mod.write(baseline_path, all_findings, baseline)
 
     # ----- terminal output -----
     if args.json:
         sys.stdout.write(
-            json.dumps(renderers.to_json(all_findings, score, gate, coverage, verdict), indent=2)
+            json.dumps(
+                renderers.to_json(all_findings, score, gate, coverage, verdict, axes), indent=2
+            )
         )
         sys.stdout.write("\n")
     else:
-        _print_summary(verdict, score, gate, ran, unavailable, coverage, paths)
+        _print_summary(verdict, score, gate, ran, unavailable, coverage, paths, axes)
 
     return _exit_code(args, gate, all_findings)
 
@@ -523,19 +583,25 @@ def _ingest_sarif_imports(specs: list[str]) -> tuple[list[Finding], list[Scanner
     return findings, executions
 
 
-def _write_outputs(paths, findings, score, gate, coverage, ran, unavailable, verdict) -> None:
+def _write_outputs(
+    paths, findings, score, gate, coverage, ran, unavailable, verdict, axes=(), pillar=None
+) -> None:
     if paths.markdown is not None:
         renderers.write_markdown(
-            findings, score, gate, paths.markdown, ran, unavailable, coverage, verdict
+            findings, score, gate, paths.markdown, ran, unavailable, coverage, verdict, axes
         )
     if paths.json_out is not None:
-        renderers.write_json(findings, score, gate, paths.json_out, coverage, verdict)
+        renderers.write_json(findings, score, gate, paths.json_out, coverage, verdict, axes)
     if paths.sarif is not None:
         sarif.write(findings, paths.sarif, coverage)
     if paths.comment is not None:
         renderers.write_pr_comment(findings, score, gate, paths.comment, coverage, verdict)
     if paths.prompt is not None:
         remediation.write(findings, paths.prompt)
+    # The artifact maintainability-agent ingests (D3). Written last because it
+    # is the only output that carries both axes plus the practice level.
+    if paths.security_pillar is not None and pillar is not None:
+        pillar_mod.write(pillar, paths.security_pillar)
 
 
 def _apply_overrides(findings: list[Finding], cfg: config_mod.Config) -> list[Finding]:
@@ -562,6 +628,7 @@ class _OutputPaths:
     sarif: Path | None
     comment: Path | None
     prompt: Path | None
+    security_pillar: Path | None
 
 
 def _resolve_outputs(args: argparse.Namespace, cfg: config_mod.Config, root: Path) -> _OutputPaths:
@@ -580,6 +647,7 @@ def _resolve_outputs(args: argparse.Namespace, cfg: config_mod.Config, root: Pat
         sarif=_p(args.sarif_output),
         comment=_p(args.comment_output),
         prompt=_p(args.prompt_output),
+        security_pillar=_p(args.security_pillar),
     )
 
 
@@ -588,12 +656,15 @@ def _under_root(root: Path, value: str) -> Path:
     return path.resolve() if path.is_absolute() else (root / path).resolve()
 
 
-def _print_summary(verdict, score, gate, ran, unavailable, coverage, paths) -> None:
+def _print_summary(verdict, score, gate, ran, unavailable, coverage, paths, axes=()) -> None:
     status = "PASS" if gate.passed else "FAIL"
     print(f"secure-code-agent  ·  score {verdict.headline()}  ·  gate {status}")
     for reason in verdict.reasons:
         print(f"  ! grade withheld: {reason}")
     print(f"  scanned LOC: {score.loc_scanned:,}")
+    for axis in axes or ():
+        if axis.count or axis.loc:
+            print(f"  {axis.headline()}")
     print(f"  scanners run: {', '.join(ran) if ran else '(none)'}")
     coverage_line = f"  coverage: {coverage.status.value.upper()}"
     if coverage.unverified:
@@ -608,7 +679,14 @@ def _print_summary(verdict, score, gate, ran, unavailable, coverage, paths) -> N
             print(f"  ✗ {reason}")
     written = [
         str(p)
-        for p in (paths.markdown, paths.json_out, paths.sarif, paths.comment, paths.prompt)
+        for p in (
+            paths.markdown,
+            paths.json_out,
+            paths.sarif,
+            paths.comment,
+            paths.prompt,
+            paths.security_pillar,
+        )
         if p is not None
     ]
     if written:

{secure_code_agent-0.4.0 → secure_code_agent-0.5.0}/src/secure_code_audit/config.py

@@ -28,6 +28,33 @@ DEFAULT_EXCLUDES: tuple[str, ...] = (
     "**/*.lock",
 )
 
+#: Conventional test-tree locations across the languages the floor reads.
+#: Deliberately conservative: a false positive here moves real findings out of
+#: the score, so `src/` layouts and single `*_test.go` files are matched by
+#: name rather than by guessing at directory intent.
+DEFAULT_TEST_PATTERNS: tuple[str, ...] = (
+    "test/",
+    "tests/",
+    "spec/",
+    "specs/",
+    "testing/",
+    "__tests__/",
+    "**/test/",
+    "**/tests/",
+    "**/spec/",
+    "**/__tests__/",
+    "**/test_*.py",
+    "**/*_test.py",
+    "**/*_test.go",
+    "**/*_test.rb",
+    "**/*.test.js",
+    "**/*.spec.js",
+    "**/*.test.ts",
+    "**/*.spec.ts",
+    "**/*Test.java",
+    "**/*Tests.java",
+)
+
 DEFAULT_INCLUDE_EXTS: tuple[str, ...] = (
     ".py",
     ".js",
@@ -89,6 +116,13 @@ class Config:
     version: int = 1
     include_extensions: tuple[str, ...] = DEFAULT_INCLUDE_EXTS
     exclude_patterns: tuple[str, ...] = DEFAULT_EXCLUDES
+    #: Paths that are the repository's *own* test tree. Findings there are
+    #: reported separately rather than scored, because a project graded on its
+    #: test fixtures is graded on the wrong thing — measured at 50.15 vs 4.36
+    #: median normalized subtotal, see docs/calibration.md. Not an exclusion:
+    #: the findings are still collected, still reported, and secrets among them
+    #: still score and still gate.
+    test_patterns: tuple[str, ...] = DEFAULT_TEST_PATTERNS
     scanners: dict[str, ScannerConfig] = field(default_factory=dict)
     severity_overrides: dict[str, str] = field(default_factory=dict)
     category_overrides: dict[str, str] = field(default_factory=dict)
@@ -216,6 +250,8 @@ def _from_dict(raw: dict[str, Any]) -> Config:
         cfg.exclude_patterns = tuple(
             _string_list(paths["exclude_patterns"], "paths.exclude_patterns")
         )
+    if "test_patterns" in paths:
+        cfg.test_patterns = tuple(_string_list(paths["test_patterns"], "paths.test_patterns"))
 
     scanners_raw = raw.get("scanners", {})
     if not isinstance(scanners_raw, dict):

{secure_code_agent-0.4.0 → secure_code_agent-0.5.0}/src/secure_code_audit/git_tools.py

@@ -46,10 +46,36 @@ def in_scope(path: Path, include_exts: Iterable[str]) -> bool:
     return False
 
 
-def loc_under(root: Path, include_exts: Iterable[str], excludes: Iterable[str]) -> int:
-    """Best-effort LOC count for the scoring normalizer. Counts non-blank
-    lines across in-scope files; skips binary content."""
-    total = 0
+def is_test_path(path: Path, root: Path, patterns: Iterable[str]) -> bool:
+    """Does this path belong to the repository's own test tree?
+
+    Same matching as `is_excluded`, and deliberately so — an operator who can
+    write an exclude pattern already knows how to write one of these.
+
+    A path outside `root` is not a test path. An imported SARIF can name
+    absolute paths from another machine, and guessing that someone else's
+    `/build/tests/` is our test tree would move real findings out of the score.
+    """
+    return is_excluded(path, root, patterns)
+
+
+def loc_under(
+    root: Path,
+    include_exts: Iterable[str],
+    excludes: Iterable[str],
+    test_patterns: Iterable[str] = (),
+) -> tuple[int, int]:
+    """Non-blank in-scope lines, split into (primary, test).
+
+    The split exists because the score's denominator has to move with its
+    numerator. Scoring primary-tree findings over a LOC count that included the
+    test tree would understate every repository in proportion to how well it is
+    tested — the same numerator/denominator mismatch that `exclude_patterns`
+    already caused once, arriving by a different door.
+    """
+    test_patterns = tuple(test_patterns)
+    primary = 0
+    test = 0
     for path in root.rglob("*"):
         if not path.is_file():
             continue
@@ -61,5 +87,9 @@ def loc_under(root: Path, include_exts: Iterable[str], excludes: Iterable[str])
             text = path.read_text(encoding="utf-8", errors="ignore")
         except OSError:
             continue
-        total += sum(1 for line in text.splitlines() if line.strip())
-    return total
+        lines = sum(1 for line in text.splitlines() if line.strip())
+        if test_patterns and is_test_path(path, root, test_patterns):
+            test += lines
+        else:
+            primary += lines
+    return primary, test