fix(prog-python): keep the pyright guard authoritative for LSP attach

lsp-pyright's :hook lambda called require and lsp-deferred unguarded on every python-ts buffer, so a machine without pyright still got the LSP attach prompt that cj/python-setup's guard exists to prevent. The guarded branch now owns the require and the attach, and the hook is gone.

Classic python-mode now runs the same setup hooks as python-ts-mode, so treesit-auto's grammar-unavailable fallback keeps indentation, keys, and LSP. Four tests cover the guard branches and pin that every python hook entry stays a named function.

2 files changed, 78 insertions, 5 deletions

diff --git a/modules/prog-python.el b/modules/prog-python.el
index 6354bd90..91670ec0 100644
--- a/modules/prog-python.el
+++ b/modules/prog-python.el
@@ -69,9 +69,12 @@ Install with: pip install mypy")
   (setq-local indent-tabs-mode nil)   ;; disable tab characters
   (electric-pair-local-mode t)        ;; match delimiters automatically (buffer-local)
 
-  ;; Enable LSP if available
+  ;; Enable LSP if available.  lsp-pyright is required here, inside the
+  ;; guard, so a pyright-less machine never loads it and never sees the
+  ;; LSP attach prompt the guard exists to prevent.
   (when (and (fboundp 'lsp-deferred)
              (executable-find pyright-path))
+    (require 'lsp-pyright nil t)
     (lsp-deferred)))
 
 (defun cj/--python-mypy-command (target)
@@ -111,8 +114,12 @@ Overrides default prog-mode keybindings with Python-specific commands."
 (use-package python
   :ensure nil ;; built-in
   :hook
+  ;; Both variants: treesit-auto falls back to classic python-mode when the
+  ;; grammar is unavailable, and that fallback should keep the same setup.
   ((python-ts-mode . cj/python-setup)
-   (python-ts-mode . cj/python-mode-keybindings))
+   (python-ts-mode . cj/python-mode-keybindings)
+   (python-mode . cj/python-setup)
+   (python-mode . cj/python-mode-keybindings))
   :custom
   (python-shell-interpreter "python3")
   :config
@@ -126,10 +133,12 @@ Overrides default prog-mode keybindings with Python-specific commands."
 ;; Python-specific LSP configuration via pyright
 ;; Core LSP setup is in prog-general.el
 
+;; No :hook here: the old unguarded (require 'lsp-pyright) + (lsp-deferred)
+;; lambda ran on every python-ts buffer, so pyright-less machines got the
+;; LSP attach prompt cj/python-setup's guard exists to prevent.  The guarded
+;; branch in cj/python-setup owns the require and the attach.
 (use-package lsp-pyright
-  :hook (python-ts-mode . (lambda ()
-                            (require 'lsp-pyright)
-                            (lsp-deferred))))
+  :defer t)
 
 ;; ----------------------------------- Poetry ----------------------------------
 ;; virtual environments and dependencies
diff --git a/tests/test-prog-python--lsp-guard.el b/tests/test-prog-python--lsp-guard.el
new file mode 100644
index 00000000..071e1ca9
--- /dev/null
+++ b/tests/test-prog-python--lsp-guard.el
@@ -0,0 +1,64 @@
+;;; test-prog-python--lsp-guard.el --- Python LSP guard tests -*- lexical-binding: t; -*-
+
+;;; Commentary:
+;; The config audit found lsp-pyright's unguarded :hook lambda calling
+;; (require 'lsp-pyright) + (lsp-deferred) on every python-ts buffer, so
+;; pyright-less machines got the LSP attach prompt that cj/python-setup's
+;; guard exists to prevent.  The guarded branch now owns the require and
+;; the attach, and both classic and treesit modes run the same setup.
+
+;;; Code:
+
+(require 'ert)
+(require 'cl-lib)
+
+(add-to-list 'load-path (expand-file-name "modules" user-emacs-directory))
+(require 'prog-python)
+
+(defmacro test-python-guard--setup (pyright-found &rest body)
+  "Run `cj/python-setup' with pyright presence set to PYRIGHT-FOUND.
+Records requires into `required' and lsp attaches into `attached';
+BODY sees both.  Package minor modes are stubbed at their boundary."
+  (declare (indent 1))
+  `(let ((required '()) (attached nil))
+     (cl-letf (((symbol-function 'company-mode) #'ignore)
+               ((symbol-function 'flyspell-prog-mode) #'ignore)
+               ((symbol-function 'superword-mode) #'ignore)
+               ((symbol-function 'executable-find)
+                (lambda (&rest _) ,pyright-found))
+               ((symbol-function 'require)
+                (lambda (feature &rest _) (push feature required) feature))
+               ((symbol-function 'lsp-deferred)
+                (lambda () (setq attached t))))
+       (with-temp-buffer
+         (cj/python-setup))
+       ,@body)))
+
+(ert-deftest test-prog-python-setup-pyright-absent-no-lsp ()
+  "Error: without pyright, setup neither loads lsp-pyright nor attaches."
+  (test-python-guard--setup nil
+    (should-not (memq 'lsp-pyright required))
+    (should-not attached)))
+
+(ert-deftest test-prog-python-setup-pyright-present-attaches ()
+  "Normal: with pyright on PATH, setup loads lsp-pyright then attaches."
+  (test-python-guard--setup "/usr/bin/pyright"
+    (should (memq 'lsp-pyright required))
+    (should attached)))
+
+(ert-deftest test-prog-python-hooks-cover-both-mode-variants ()
+  "Normal: classic and treesit python modes both run the same setup."
+  (dolist (hook '(python-mode-hook python-ts-mode-hook))
+    (should (memq #'cj/python-setup (symbol-value hook)))
+    (should (memq #'cj/python-mode-keybindings (symbol-value hook)))))
+
+(ert-deftest test-prog-python-no-anonymous-hook-lambdas ()
+  "Boundary: no anonymous lambda remains on the python hooks.
+The audit's unguarded lsp-pyright lambda was anonymous; symbols only
+means every hook entry is a named, greppable function."
+  (dolist (hook '(python-mode-hook python-ts-mode-hook))
+    (dolist (fn (symbol-value hook))
+      (should (symbolp fn)))))
+
+(provide 'test-prog-python--lsp-guard)
+;;; test-prog-python--lsp-guard.el ends here