M22C: Agentic Coding Quality Gates & Rich Output

# Install once (all free, all local):
pip install ruff bandit
#   ast-grep:  brew install ast-grep   |   cargo install ast-grep   |   npm i -g @ast-grep/cli

ruff check db.py
#   db.py:3:1: F401 [*] `os` imported but unused

bandit -q db.py
#   >> Issue: [B105:hardcoded_password_string] Possible hardcoded password: 'hunter2'
#      Severity: Low   Confidence: Medium   Location: db.py:7

ast-grep scan -r rules/no-swallowed-except.yml db.py
#   error[no-swallowed-except]: Swallowed exception: handle the error or re-raise.
#     --> db.py:12:5

# Any non-zero exit = the gate fails. Chain them:
ruff check db.py && bandit -q db.py && ast-grep scan -r rules/ db.py

pip install pre-commit
pre-commit install            # hooks now fire on every `git commit`

# A blocked commit (agent committed a hardcoded password):
$ git commit -m "add db client"
ruff................................................................Passed
bandit..............................................................Failed
- hook id: bandit
- exit code: 1
  >> Issue: [B105:hardcoded_password_string] Possible hardcoded password: 'hunter2'
     Location: db.py:7
#   --> the commit did NOT happen. Nothing entered history.

pre-commit run --all-files ; echo "gate exit=$?"   # run the gate by hand anytime

// commit_with_fixups.js — let the gate teach Claude until the commit is clean
// WHAT: Try to commit; if the gate blocks it, send the error to Claude, fix, retry
// WHY:  Turns "write good code" into a concrete loop graded by deterministic hooks
// GOTCHA: Bound the retries; a gate Claude can't satisfy must fail loudly, not spin
import fs from "node:fs";
import { execFileSync } from "node:child_process";
import Anthropic from "@anthropic-ai/sdk";

const client = new Anthropic();                    // reads ANTHROPIC_API_KEY from env
const MODEL = "claude-sonnet-4-6";
const TARGET = "db.py";

function runGate() {
  try {
    execFileSync("pre-commit", ["run", "--files", TARGET], { stdio: "pipe", timeout: 120000 });
    return { passed: true, output: "" };
  } catch (e) {
    return { passed: false, output: (e.stdout || "") + (e.stderr || "") };
  }
}

async function askFix(code, gateOutput) {
  const resp = await client.messages.create({
    model: MODEL, max_tokens: 2000,
    system: "You are a Python engineer. Return ONLY the corrected file, no prose, no fences.",
    messages: [{ role: "user", content:
      `This file was rejected by our commit gate.\n\nFILE (${TARGET}):\n${code}\n\n` +
      `GATE OUTPUT:\n${gateOutput}\n\nReturn the full corrected file.` }],
  });
  return resp.content[0].text.trim();              // first text block = the fixed file
}

async function commitClean(maxFixups = 3) {
  for (let attempt = 0; attempt <= maxFixups; attempt++) {
    execFileSync("git", ["add", TARGET]);
    const { passed, output } = runGate();
    if (passed) {
      execFileSync("git", ["commit", "-m", "agent change (gate-clean)"]);
      console.error(`[gate] passed on attempt ${attempt}; commit landed`);
      return 0;
    }
    console.error(`[gate] blocked on attempt ${attempt}:\n${output}`);
    if (attempt === maxFixups) break;
    fs.writeFileSync(TARGET, await askFix(fs.readFileSync(TARGET, "utf8"), output));
  }
  console.error("[gate] still failing after retries — escalate to a human");
  return 2;                                         // bad output: do not auto-merge
}

process.exit(await commitClean());

# .claude/gate_hook.py — block an unsafe Write/Edit before it touches disk
# WHAT: Read the proposed tool input, lint the new content, exit 2 to block
# WHY:  Catches the problem at WRITE time and tells Claude the reason to self-correct
# GOTCHA: Claude Code passes the tool input as JSON on stdin; exit 2 = block + show stderr
import sys, json, subprocess, tempfile, os

data = json.load(sys.stdin)                        # the PreToolUse payload
tool_input = data.get("tool_input", {})
# Write provides 'content'; Edit provides 'new_string'
content = tool_input.get("content") or tool_input.get("new_string") or ""
path = tool_input.get("file_path", "")
if not path.endswith(".py") or not content.strip():
    sys.exit(0)                                    # not Python / nothing to check: allow

# Lint the PROPOSED content via a temp file
with tempfile.NamedTemporaryFile("w", suffix=".py", delete=False) as f:
    f.write(content); tmp = f.name
try:
    bandit = subprocess.run(["bandit", "-q", tmp], capture_output=True, text=True)
    astg   = subprocess.run(["ast-grep", "scan", "-r", "rules/", tmp],
                            capture_output=True, text=True)
finally:
    os.unlink(tmp)

problems = ""
if bandit.returncode != 0: problems += bandit.stdout + bandit.stderr
if astg.returncode   != 0: problems += astg.stdout + astg.stderr

if problems:
    # stderr is shown to Claude; exit 2 BLOCKS the Write/Edit so Claude reconsiders
    print(f"Blocked: the edit to {path} fails the quality gate.\n{problems}", file=sys.stderr)
    sys.exit(2)
sys.exit(0)                                        # clean: allow the write

// chart_agent.js — Claude calls a render_chart tool that returns an IMAGE.
//   npm i @anthropic-ai/sdk chartjs-node-canvas chart.js
import fs from "node:fs";
import Anthropic from "@anthropic-ai/sdk";
import { ChartJSNodeCanvas } from "chartjs-node-canvas";

const client = new Anthropic();
const MODEL = "claude-sonnet-4-6";
const canvas = new ChartJSNodeCanvas({ width: 600, height: 350 });

const TOOLS = [{
  name: "render_chart",
  description: "Render a bar chart from labels and values; returns a PNG image.",
  input_schema: {
    type: "object",
    properties: {
      labels: { type: "array", items: { type: "string" } },
      values: { type: "array", items: { type: "number" } },
      title:  { type: "string" },
    },
    required: ["labels", "values"],
  },
}];

async function renderChart({ labels, values, title = "" }) {
  const png = await canvas.renderToBuffer({
    type: "bar",
    data: { labels, datasets: [{ data: values, backgroundColor: "#3B82F6" }] },
    options: { plugins: { title: { display: !!title, text: title } } },
  });
  return png.toString("base64");
}

async function run(prompt) {
  const messages = [{ role: "user", content: prompt }];
  for (let i = 0; i < 6; i++) {                     // bounded tool loop
    const resp = await client.messages.create({ model: MODEL, max_tokens: 1024,
                                                 tools: TOOLS, messages });
    messages.push({ role: "assistant", content: resp.content });
    if (resp.stop_reason !== "tool_use")
      return resp.content.find((b) => b.type === "text")?.text ?? "";
    const toolResults = [];
    for (const block of resp.content) {
      if (block.type === "tool_use" && block.name === "render_chart") {
        const pngB64 = await renderChart(block.input);
        fs.writeFileSync("chart.png", Buffer.from(pngB64, "base64"));   // save artifact
        toolResults.push({ type: "tool_result", tool_use_id: block.id,
          content: [{ type: "image", source: {
            type: "base64", media_type: "image/png", data: pngB64 } }] });
      }
    }
    messages.push({ role: "user", content: toolResults });
  }
}

console.log(await run("Chart these monthly filing counts: Jan 12, Feb 19, Mar 27. Title it Q1 Filings."));