cowork-bot: automated improvements (cowork/improve-configdrift)

.github/workflows/cowork-auto-pr.yml

@@ -0,0 +1,28 @@
+# Seeded by the repo-improver-rotation Cowork job into cowork/improve-* branches.
+# Opens a PR automatically when such a branch is pushed (sandbox cannot reach
+# the GitHub API directly; this runs server-side with the repo's GITHUB_TOKEN).
+name: cowork-auto-pr
+on:
+  push:
+    branches: ['cowork/improve-**']
+permissions:
+  contents: read
+  pull-requests: write
+jobs:
+  ensure-pr:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Open PR for this branch if none exists
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -eu
+          existing=$(gh pr list --repo "$GITHUB_REPOSITORY" --head "$GITHUB_REF_NAME" --state open --json number --jq 'length')
+          if [ "$existing" = "0" ]; then
+            gh pr create --repo "$GITHUB_REPOSITORY" \
+              --head "$GITHUB_REF_NAME" \
+              --title "cowork-bot: automated improvements ($GITHUB_REF_NAME)" \
+              --body "Automated improvement PR from the Cowork repo-improver rotation (one coherent senior-dev improvement per run; see individual commit messages). Subsequent runs push additional commits to this PR rather than opening new ones."
+          else
+            echo "Open PR already exists for $GITHUB_REF_NAME — nothing to do."
+          fi

README.md

@@ -11,7 +11,6 @@ Keep configurations consistent across all environments, automatically. ConfigDri
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://github.com/Coding-Dev-Tools/configdrift/blob/main/LICENSE)
 [![Open Source Alternative](https://img.shields.io/badge/Open_Source_Alternative-%E2%87%92-blue?logo=opensourceinitiative)](https://www.opensourcealternative.to/project/configdrift)
 |[![LibHunt](https://img.shields.io/badge/LibHunt-%E2%87%92-blue?logo=codeigniter)](https://www.libhunt.com/r/Coding-Dev-Tools/configdrift)
-|[![PyPI](https://img.shields.io/pypi/v/configdrift)](https://pypi.org/project/configdrift/)
 
 
 
@@ -23,7 +22,10 @@ Real-world scenarios:
 
 ## Installation
 
+> ConfigDrift is **not published to public PyPI**. Install from the self-hosted index, a direct GitHub install, or via Homebrew/Scoop (below).
+
 ```bash
+# Install directly from GitHub (recommended)
 pip install git+https://github.com/Coding-Dev-Tools/configdrift.git
 ```
 
@@ -97,7 +99,7 @@ configdrift check dev.yaml prod.yaml --output silent || echo "Drift detected!"
 ```yaml
 - name: Detect config drift
   run: |
-    pip install configdrift
+    pip install git+https://github.com/Coding-Dev-Tools/configdrift.git
     configdrift check ./config/staging/app.yaml ./config/prod/app.yaml --output silent
 ```
 

src/configdrift/cli.py

@@ -267,7 +267,7 @@ def scan(
         # Use directory basenames as env names
         dir_mapping = {}
         for d in dirs:
-            env_name = Path(d).stem
+            env_name = Path(d).name
             dir_mapping[env_name] = d
     else:
         console.print(

src/configdrift/diff.py

@@ -1,5 +1,6 @@
 """Diff engine for comparing configuration dictionaries."""
 
+import re
 from dataclasses import dataclass, field
 from enum import Enum
 from typing import Any
@@ -17,6 +18,79 @@ class Severity(Enum):
     BREAKING = "breaking"
 
 
+# Pre-compiled regex for camelCase splitting
+_CAMEL_RE = re.compile(r"(?<=[a-z0-9])(?=[A-Z])")
+
+
+def _split_key_into_words(key: str) -> list[str]:
+    """
+    Split a flattened config key into its component words.
+
+    Handles:
+    - dot notation: services.database.password -> [services, database, password]
+    - snake_case: api_key -> [api, key]
+    - kebab-case: api-key -> [api, key]
+    - camelCase: apiKey -> [api, key]
+    - concatenated: apikey -> [api, key] (via critical prefix matching below)
+
+    Returns list of lowercase words.
+    """
+    # First split on common delimiters
+    parts = re.split(r"[._-]+", key)
+
+    words = []
+    for part in parts:
+        # Split camelCase
+        camel_parts = _CAMEL_RE.split(part)
+        words.extend([p.lower() for p in camel_parts if p])
+
+    return words
+
+
+def _key_contains_critical_term(key: str, critical_terms: tuple[str, ...]) -> bool:
+    """
+    Check if a flattened key contains any critical term as a word-boundary match.
+
+    A match occurs when the critical term's word sequence appears as a contiguous
+    subsequence in the key's word sequence. Also handles concatenated forms
+    for MULTI-WORD terms (e.g., 'apikey' matches 'api_key' -> ['api', 'key']).
+    Single-word terms like 'auth', 'secret', 'token' do NOT get concatenated
+    matching to avoid false positives (e.g., 'author' should not match 'auth').
+
+    Examples:
+    - 'services.database.password' with 'database' -> True (word boundary)
+    - 'services.database.password' with 'api_key' -> False
+    - 'author' with 'auth' -> False (author != auth, word boundary prevents false positive)
+    - 'secretary' with 'secret' -> False (secretary != secret)
+    - 'tokenizer' with 'token' -> False (tokenizer != token)
+    - 'apikey' with 'api_key' -> True (concatenated form handled for multi-word terms)
+    """
+    key_words = _split_key_into_words(key)
+
+    for term in critical_terms:
+        term_words = _split_key_into_words(term)
+        term_len = len(term_words)
+
+        if term_len == 0:
+            continue
+
+        # Check for contiguous subsequence match (word boundary)
+        for i in range(len(key_words) - term_len + 1):
+            if key_words[i:i + term_len] == term_words:
+                return True
+
+        # Also check concatenated form for MULTI-WORD terms only.
+        # Single-word terms (auth, secret, token, database, password, endpoint)
+        # would cause false positives like 'author' -> 'auth'.
+        if term_len > 1:
+            concatenated = "".join(term_words)
+            key_normalized = key.lower().replace(".", "").replace("_", "").replace("-", "")
+            if concatenated in key_normalized:
+                return True
+
+    return False
+
+
 @dataclass
 class Change:
     key: str
@@ -127,23 +201,27 @@ def diff_environments(
     "password",
     "token",
     "endpoint",
+    "auth_token",
+    "secret_key",
+    "password_hash",
+    "database_url",
 )
 
 
 def _infer_severity_added(key: str, value: Any) -> Severity:
-    """Heuristic: critical keys missing from base indicate drift."""
-    if any(key.lower().startswith(p) for p in _CRITICAL_PREFIXES):
+    """Heuristic: classify severity as BREAKING if the key contains a critical term at a word boundary."""
+    if _key_contains_critical_term(key, _CRITICAL_PREFIXES):
         return Severity.BREAKING
     return Severity.WARNING
 
 
 def _infer_severity_removed(key: str, value: Any) -> Severity:
-    if any(key.lower().startswith(p) for p in _CRITICAL_PREFIXES):
+    if _key_contains_critical_term(key, _CRITICAL_PREFIXES):
         return Severity.BREAKING
     return Severity.WARNING
 
 
 def _infer_severity_changed(key: str, old: Any, new: Any) -> Severity:
-    if any(key.lower().startswith(p) for p in _CRITICAL_PREFIXES):
+    if _key_contains_critical_term(key, _CRITICAL_PREFIXES):
         return Severity.BREAKING
     return Severity.INFO

tests/test_cli.py

@@ -405,6 +405,40 @@ def test_scan_env_and_toml_dirs(self):
             data = json.loads(result.stdout)
             assert "prod" in data
 
+    def test_scan_dir_names_with_dots_preserved(self):
+        """Dir names containing dots must not be truncated by Path.stem."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            dev_dir = Path(tmpdir) / "dev"
+            prod_us = Path(tmpdir) / "prod.us"
+            prod_eu = Path(tmpdir) / "prod.eu"
+            dev_dir.mkdir()
+            prod_us.mkdir()
+            prod_eu.mkdir()
+            (dev_dir / "c.yaml").write_text(yaml.dump({"host": "localhost"}))
+            (prod_us / "c.yaml").write_text(yaml.dump({"host": "us.example.com"}))
+            (prod_eu / "c.yaml").write_text(yaml.dump({"host": "eu.example.com"}))
+
+            # Table output: all 3 envs must appear as distinct columns
+            result = runner.invoke(
+                app,
+                ["scan", str(dev_dir), str(prod_us), str(prod_eu)],
+            )
+            assert result.exit_code == 0, f"STDOUT: {result.stdout}"
+            assert "dev →" in result.stdout, "Baseline 'dev' should appear in table"
+            assert "prod.us" in result.stdout, f"Missing prod.us in output:\n{result.stdout}"
+            assert "prod.eu" in result.stdout, f"Missing prod.eu in output:\n{result.stdout}"
+
+            # JSON output: both targets must be separate keys (not collapsed)
+            result2 = runner.invoke(
+                app,
+                ["scan", str(dev_dir), str(prod_us), str(prod_eu), "--output", "json"],
+            )
+            assert result2.exit_code == 0, f"STDOUT: {result2.stdout}"
+            data = json.loads(result2.stdout)
+            assert "prod.us" in data, f"Missing prod.us in {list(data.keys())}"
+            assert "prod.eu" in data, f"Missing prod.eu in {list(data.keys())}"
+            assert len(data) == 2, f"Expected 2 targets, got {len(data)}: {list(data.keys())}"
+
     def test_scan_no_changes_env_skipped_in_table(self):
         """Scan with multiple envs where one has no changes."""
         with tempfile.TemporaryDirectory() as tmpdir:

tests/test_diff.py

@@ -55,9 +55,7 @@ def test_result_with_breaking(self):
                     change_type=ChangeType.CHANGED,
                     severity=Severity.BREAKING,
                 ),
-                Change(
-                    key="port", change_type=ChangeType.CHANGED, severity=Severity.INFO
-                ),
+                Change(key="port", change_type=ChangeType.CHANGED, severity=Severity.INFO),
             ]
         )
         assert r.has_breaking is True
@@ -252,3 +250,127 @@ def test_changed_non_critical(self):
     def test_case_insensitive_prefix(self):
         assert _infer_severity_added("Database_url", "x") == Severity.BREAKING
         assert _infer_severity_added("API_KEY", "x") == Severity.BREAKING
+
+
+class TestSeveritySubstringMatch:
+    """Regression tests: severity must be BREAKING when the critical term appears
+    anywhere in the key name (substring match), not only as a prefix.
+
+    Prior bug: ``key.lower().startswith(p)`` caused keys like ``db_password``
+    and ``jwt_token`` to be classified as WARNING instead of BREAKING.
+    """
+
+    def test_embedded_password(self):
+        assert _infer_severity_added("db_password", "x") == Severity.BREAKING
+
+    def test_embedded_token(self):
+        assert _infer_severity_removed("jwt_token", "x") == Severity.BREAKING
+
+    def test_embedded_secret_changed(self):
+        assert _infer_severity_changed("app_secret_key", "a", "b") == Severity.BREAKING
+
+    def test_embedded_auth(self):
+        assert _infer_severity_added("mysql_auth_url", "x") == Severity.BREAKING
+
+    def test_embedded_endpoint(self):
+        assert _infer_severity_removed("connection_endpoint", "x") == Severity.BREAKING
+
+    def test_embedded_api_key(self):
+        assert _infer_severity_added("main_api_key_id", "x") == Severity.BREAKING
+
+    def test_embedded_oauth_token(self):
+        assert _infer_severity_removed("oauth_token", "x") == Severity.BREAKING
+
+    def test_embedded_database(self):
+        assert _infer_severity_added("mysql_database_name", "x") == Severity.BREAKING
+
+    def test_non_sensitive_still_warning_added(self):
+        assert _infer_severity_added("cache_ttl", "300") == Severity.WARNING
+
+    def test_non_sensitive_still_info_changed(self):
+        assert _infer_severity_changed("log_level", "debug", "info") == Severity.INFO
+
+    def test_diff_configs_detects_embedded_breaking(self):
+        """End-to-end: diff_configs must surface BREAKING for embedded-term keys."""
+        base = {"db_password": "old_secret", "port": "8080"}
+        target = {"db_password": "new_secret", "port": "9090"}
+        result = diff_configs(base, target)
+        assert result.has_breaking, "expected BREAKING for db_password change"
+
+
+class TestSeverityWordBoundaryMatch:
+    """Tests for the word-boundary/segment matching severity inference.
+
+    The new algorithm splits keys into words (dot/snake/kebab/camel) and matches
+    critical terms as contiguous word sequences. This fixes:
+    - Nested flattened keys: services.database.password -> BREAKING (database)
+    - False positives: author, secretary, tokenizer -> NOT BREAKING
+    - Concatenated forms: apikey -> BREAKING (api_key)
+    """
+
+    # True positives: nested/segmented keys that SHOULD be BREAKING
+    def test_nested_database_password(self):
+        assert _infer_severity_added("services.database.password", "x") == Severity.BREAKING
+
+    def test_nested_auth_token(self):
+        assert _infer_severity_added("auth.token.secret", "x") == Severity.BREAKING
+
+    def test_snake_case_api_key(self):
+        assert _infer_severity_added("my_api_key", "x") == Severity.BREAKING
+
+    def test_kebab_case_secret_key(self):
+        assert _infer_severity_added("my-secret-key", "x") == Severity.BREAKING
+
+    def test_camel_case_password_hash(self):
+        assert _infer_severity_added("passwordHash", "x") == Severity.BREAKING
+
+    def test_camel_case_endpoint_url(self):
+        assert _infer_severity_added("endpointUrl", "x") == Severity.BREAKING
+
+    def test_concatenated_api_key(self):
+        assert _infer_severity_added("apikey", "x") == Severity.BREAKING
+
+    def test_concatenated_auth_token(self):
+        assert _infer_severity_added("authtoken", "x") == Severity.BREAKING
+
+    def test_concatenated_secret_key(self):
+        assert _infer_severity_added("secretkey", "x") == Severity.BREAKING
+
+    def test_concatenated_password_hash(self):
+        assert _infer_severity_added("passwordhash", "x") == Severity.BREAKING
+
+    def test_concatenated_database_url(self):
+        assert _infer_severity_added("databaseurl", "x") == Severity.BREAKING
+
+    # False positives fixed: these should NOT be BREAKING
+    def test_author_not_auth(self):
+        assert _infer_severity_added("author", "x") == Severity.WARNING
+
+    def test_secretary_not_secret(self):
+        assert _infer_severity_added("secretary", "x") == Severity.WARNING
+
+    def test_tokenizer_not_token(self):
+        assert _infer_severity_added("tokenizer", "x") == Severity.WARNING
+
+    def test_endpointer_not_endpoint(self):
+        assert _infer_severity_added("endpointer", "x") == Severity.WARNING
+
+    def test_database_not_in_databaseadmin(self):
+        assert _infer_severity_added("databaseadmin", "x") == Severity.WARNING
+
+    # False positives for removed/changed
+    def test_author_removed_not_breaking(self):
+        assert _infer_severity_removed("author", "x") == Severity.WARNING
+
+    def test_secretary_changed_not_breaking(self):
+        assert _infer_severity_changed("secretary", "a", "b") == Severity.INFO
+
+    # Mixed: nested with false positive prefix
+    def test_databaseadmin_not_breaking(self):
+        assert _infer_severity_added("databaseadmin", "x") == Severity.WARNING
+
+    def test_authentication_not_auth(self):
+        assert _infer_severity_added("authentication", "x") == Severity.WARNING
+
+    def test_authz_not_auth(self):
+        assert _infer_severity_added("authz", "x") == Severity.WARNING