ace-support-cli 0.6.9 → 0.6.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cbcd26854c1dcfe8c16d4024cd0c2b4c7a16796dce24f1da392495a5dae0b470
-  data.tar.gz: a4928a2682ed05127e9bd463b4c1df18303693e17c650b05ac4a746480b6ba2b
+  metadata.gz: 97fff71bfa5c46c0a82bae86872692ae5488919550b2c0c9afce4e4385a5bc64
+  data.tar.gz: c6e73139b02112a21a917af26942365a1ffcae3687990a643382a335c0b6fcc6
 SHA512:
-  metadata.gz: 1abcf19ddb8f690818a501259094292aa38213e74ab4bda4f22fd42240f9724fd5051e4547c23ee8795bfdeb59b45d44166fdd878ac227c9df61e38af6f2a2f1
-  data.tar.gz: 3554cd2b86ce51600d20b39a1c4164728990ddb9e1e8dcb095d3b00265f46dc346e0440f9ff645eb97168043542f55b097edd937bfb004e2b85f40417c0f525b
+  metadata.gz: 2a8e8bef070892011cd79dbab1b679f6d7362921e294752869d5801c2c7c1e65019897ee5f0f14dbfbbbc3280cf1230a68f82f2d3b3a9b761096b51b7f9893f4
+  data.tar.gz: 79687ddb896af4f69e20a9506c586df519486c632ef3a346aa0c5ae20fdd5d6dc8e3871d46efe4b3d82feb0751ab6a6002de39d487304ce9b9cf89ed3138fc44

data/CHANGELOG.md

@@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## [0.6.10] - 2026-10-20
+
+### Added
+- Explicit installed toolchain policy: installed executable selection, loaded closure verification, child environment and runtime-origin evidence. Default auto preserves source development.
+
 ## [0.6.9] - 2026-09-29
 
 ### Fixed

data/README.md

@@ -45,3 +45,28 @@ Verification commands:
 ---
 
 Part of [ACE](https://github.com/cs3b/ace)
+
+## Installed toolchain
+
+`ACE_TOOLCHAIN=installed` selects installed RubyGems executables and rejects a
+loaded path-gem closure. The default `auto` keeps source development. Shared
+`Ace::Support::Cli::Toolchain` resolves executables, cleans Bundler/Ruby source
+injection from child environments, supplies post-shell startup environment for
+Herdr and reports loaded gem origins. It does not grant permissions or replace
+project domain configuration.
+
+Installed navigation uses packaged protocol definitions and generic document
+sources; Assign excludes `skill_source_paths`, `workflow_source_paths` and
+repository package discovery in this mode. Coworker briefs expose the selected
+mode and document origin. Missing installed dependencies fail rather than using
+project binstubs. The flag is an execution policy, not a sandbox against code
+that deliberately clears it.
+
+For a user-owned installed runtime, start from its Ruby/GEM_HOME/GEM_PATH and run
+`ACE_TOOLCHAIN=installed ace-coworker start --config <project-run-config> --format json`.
+Inspect `toolchain.mode`, loaded gem paths/versions and `instructions_source`;
+`which` alone is not loaded-closure evidence. Commissioned installed runs retain
+`toolchain: installed` in their existing run config; source-mode resume is rejected.
+Herdr installs the selected Ruby/gem environment after shell startup, including
+reused shell panes. Changing an already-running agent's environment is not
+supported: start a fresh executor with the selected toolchain instead.

data/lib/ace/support/cli/runner.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "parser"
+require_relative "toolchain"
 
 module Ace
   module Support
@@ -12,6 +13,7 @@ module Ace
         end
 
         def call(args: ARGV)
+          Toolchain.verify_loaded!
           if root_help_request?(args)
             puts Ace::Support::Cli::Help::Usage.new(@registry, program_name: resolve_program_name).render
             return 0
@@ -20,6 +22,7 @@ module Ace
           command_target, remaining, command_name = resolve_target(args)
           command_class = command_target.is_a?(Class) ? command_target : command_target.class
           parsed = @parser_class.new(command_class, command_name: command_name).parse(remaining)
+          Toolchain.verify_loaded!
           result = if command_target.is_a?(Class)
             command_target.new.call(**parsed)
           else
@@ -33,6 +36,8 @@ module Ace
           raise Ace::Support::Cli::Error.new(e.message)
         rescue Ace::Support::Cli::CommandNotFoundError => e
           raise Ace::Support::Cli::Error.new(e.message)
+        rescue Toolchain::Error => e
+          raise Ace::Support::Cli::Error.new(e.message)
         end
 
         private

data/lib/ace/support/cli/toolchain.rb

@@ -0,0 +1,112 @@
+# frozen_string_literal: true
+
+require "rubygems"
+require "shellwords"
+
+module Ace
+  module Support
+    module Cli
+      # Selection policy, not authority: project data/configuration remain usable.
+      module Toolchain
+        class Error < StandardError; end
+
+        module_function
+
+        def installed?
+          mode = ENV.fetch("ACE_TOOLCHAIN", "auto")
+          raise Error, "unknown ACE_TOOLCHAIN #{mode.inspect}; use auto or installed" unless %w[auto installed].include?(mode)
+
+          mode == "installed"
+        end
+
+        def installed_spec?(spec)
+          return false unless spec.loaded_from && File.file?(spec.loaded_from)
+
+          root = File.realpath(spec.base_dir)
+          gem_path = File.realpath(spec.full_gem_path)
+          specification = File.realpath(spec.loaded_from)
+          gem_path.start_with?("#{root}/gems/") &&
+            specification.start_with?("#{root}/specifications/")
+        rescue Errno::ENOENT
+          false
+        end
+
+        def verify_loaded!
+          return unless installed?
+
+          Gem.loaded_specs.each_value do |spec|
+            next if installed_spec?(spec) || spec.default_gem?
+
+            raise Error, "installed toolchain loaded source dependency #{spec.name}: #{spec.full_gem_path}"
+          end
+          roots = Gem.loaded_specs.values.select { |spec| installed_spec?(spec) }
+            .map { |spec| "#{File.realpath(spec.full_gem_path)}/" }
+          $LOADED_FEATURES.grep(%r{/lib/ace/}).each do |feature|
+            actual = File.realpath(feature)
+            next if roots.any? { |root| actual.start_with?(root) }
+
+            raise Error, "installed toolchain loaded source code outside its gem closure: #{actual}"
+          end
+        end
+
+        def executable(name, project_root: nil, prefer_project: true)
+          unless installed?
+            candidate = File.join(project_root, "bin", name) if project_root && prefer_project
+            return candidate if candidate && File.executable?(candidate)
+
+            return name
+          end
+
+          verify_loaded!
+          spec = Gem::Specification.find_all.select do |entry|
+            entry.executables.include?(name) && installed_spec?(entry)
+          end.max_by(&:version)
+          raise Error, "installed executable #{name} unavailable; install its published gem" unless spec
+
+          path = File.join(spec.full_gem_path, spec.bindir, name)
+          unless File.executable?(path) && File.realpath(path).start_with?("#{File.realpath(spec.full_gem_path)}/")
+            raise Error, "installed executable #{name} missing or outside its gem: #{path}"
+          end
+          path
+        end
+
+        # Bundler/Ruby source injection must not leak into subprocesses. Domain
+        # environment (including credentials) is inherited, never inspected here.
+        def child_environment
+          return {} unless installed?
+
+          ENV.keys.grep(/\ABUNDLER?_/).to_h { |key| [key, nil] }.merge(
+            "RUBYOPT" => nil, "RUBYLIB" => nil, "ACE_TOOLCHAIN" => "installed",
+            "GEM_HOME" => Gem.dir, "GEM_PATH" => Gem.path.join(File::PATH_SEPARATOR),
+            "PATH" => [Gem.bindir, File.dirname(Gem.ruby), ENV.fetch("PATH", "")].join(File::PATH_SEPARATOR)
+          )
+        end
+
+        def shell_setup
+          return "" unless installed?
+
+          names = (ENV.keys.grep(/\ABUNDLER?_/) +
+            %w[BUNDLE_GEMFILE BUNDLE_PATH BUNDLE_BIN_PATH BUNDLER_SETUP RUBYOPT RUBYLIB]).uniq
+          path = [Gem.bindir, File.dirname(Gem.ruby), ENV.fetch("PATH", "")].join(File::PATH_SEPARATOR)
+          values = {"ACE_TOOLCHAIN" => "installed", "GEM_HOME" => Gem.dir,
+                    "GEM_PATH" => Gem.path.join(File::PATH_SEPARATOR), "PATH" => path}
+          "unset #{names.map { |name| Shellwords.escape(name) }.join(" ")}; export " +
+            values.map { |name, value| "#{name}=#{Shellwords.escape(value)}" }.join(" ") + "; "
+        end
+
+        def shell_command(name, *args)
+          shell_setup + Shellwords.join([executable(name), *args])
+        end
+
+        def evidence
+          {"mode" => installed? ? "installed" : "auto",
+           "gems" => Gem.loaded_specs.values.select { |spec| spec.name.start_with?("ace-") }
+             .to_h do |spec|
+               [spec.name, {"version" => spec.version.to_s, "path" => spec.full_gem_path,
+                            "executables" => spec.executables.to_h { |name| [name, File.join(spec.full_gem_path, spec.bindir, name)] }}]
+             end}
+        end
+      end
+    end
+  end
+end

data/lib/ace/support/cli/version.rb

@@ -3,7 +3,7 @@
 module Ace
   module Support
     module Cli
-      VERSION = "0.6.9"
+      VERSION = "0.6.10"
     end
   end
 end

data/lib/ace/support/cli.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "cli/version"
+require_relative "cli/toolchain"
 require_relative "cli/errors"
 require_relative "cli/error"
 require_relative "cli/standard_options"

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-support-cli
 version: !ruby/object:Gem::Version
-  version: 0.6.9
+  version: 0.6.10
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-09-30 00:00:00.000000000 Z
+date: 2026-10-20 00:00:00.000000000 Z
 dependencies: []
 description: Provides command DSL, option parsing, registry routing, and runner primitives
   for ACE CLI tools.
@@ -42,6 +42,7 @@ files:
 - lib/ace/support/cli/registry_dsl.rb
 - lib/ace/support/cli/runner.rb
 - lib/ace/support/cli/standard_options.rb
+- lib/ace/support/cli/toolchain.rb
 - lib/ace/support/cli/version.rb
 homepage: https://github.com/cs3b/ace
 licenses: