@ictechgy/context-guard 0.5.1 → 0.7.0

package/plugins/context-guard/bin/context-guard-setup

@@ -1506,17 +1506,65 @@ def normalize_scope(raw_scope: str | None) -> str:
     return scope
 
 
+def _user_scope_path_issue(
+    path: Path,
+    *,
+    label: str,
+    expected_directory: bool,
+    allow_missing: bool,
+) -> str | None:
+    """Return a fail-closed reason for an existing user-scope path."""
+    try:
+        metadata = os.lstat(path)
+    except FileNotFoundError:
+        return None if allow_missing else f"{label} does not exist: {path}"
+    except OSError as error:
+        return f"could not inspect {label}: {error.__class__.__name__}"
+
+    if metadata.st_uid not in {0, os.geteuid()}:
+        return f"refusing unsafe {label}: it is not owned by root or the effective user"
+    if metadata.st_mode & (stat.S_IWGRP | stat.S_IWOTH):
+        return f"refusing unsafe {label}: group/world write bits are set"
+    if expected_directory:
+        if not stat.S_ISDIR(metadata.st_mode):
+            return f"refusing unsafe {label}: it is not a directory"
+    elif not stat.S_ISREG(metadata.st_mode):
+        return f"refusing unsafe {label}: it is not a regular file"
+    return None
+
+
+def _validate_user_scope_home(home: Path) -> None:
+    issue = _user_scope_path_issue(
+        home,
+        label="resolved HOME",
+        expected_directory=True,
+        allow_missing=False,
+    )
+    if issue:
+        raise SystemExit(issue)
+
+
 def resolve_scope_root(raw_root: str | None, scope: str) -> Path:
     if scope == "project":
         return resolve_setup_root(raw_root)
     home = Path.home().expanduser().resolve()
     if home == Path(home.anchor or "/"):
         raise SystemExit("Refusing user-scope setup because HOME resolves to a filesystem root.")
-    if not home.exists() or not home.is_dir():
-        raise SystemExit(f"Refusing user-scope setup because HOME is not a directory: {home}")
+    _validate_user_scope_home(home)
     return home
 
 
+def effective_scope(raw_root: str | None, raw_scope: str | None, *, allow_home_settings: bool) -> str:
+    scope = normalize_scope(raw_scope)
+    if scope != "project" or not allow_home_settings:
+        return scope
+    project_root = resolve_setup_root(raw_root)
+    home_settings = Path.home().expanduser().resolve() / SETTINGS_REL
+    if (project_root / SETTINGS_REL).expanduser().resolve() == home_settings:
+        return "user"
+    return scope
+
+
 def explicit_agent_selection(args: argparse.Namespace) -> list[str] | None:
     values: list[str] = []
     for attr in ("agent", "only"):
@@ -1549,6 +1597,20 @@ def validate_settings_target(root: Path, settings_path: Path, *, allow_home_sett
             claude_dir.resolve().relative_to(root)
         except ValueError as exc:
             raise SystemExit(f"Claude settings directory resolves outside project root: {claude_dir}") from exc
+    if root == home_settings.parent.parent:
+        for path, label, expected_directory, allow_missing in (
+            (root, "resolved HOME", True, False),
+            (claude_dir, "existing .claude directory", True, True),
+            (settings_path, "existing settings.json", False, True),
+        ):
+            issue = _user_scope_path_issue(
+                path,
+                label=label,
+                expected_directory=expected_directory,
+                allow_missing=allow_missing,
+            )
+            if issue:
+                raise SystemExit(issue)
 
 
 def _base_open_flags() -> int:
@@ -2970,14 +3032,21 @@ def doctor_check(
     return check
 
 
-def _setup_command(args: argparse.Namespace, *, apply: bool, root: Path | None = None) -> str:
-    parts = ["context-guard", "setup", "--scope", normalize_scope(getattr(args, "scope", "project"))]
-    if root is not None and normalize_scope(getattr(args, "scope", "project")) == "project":
+def _setup_command(
+    args: argparse.Namespace,
+    *,
+    apply: bool,
+    root: Path | None = None,
+    scope: str | None = None,
+) -> str:
+    scope = scope or normalize_scope(getattr(args, "scope", "project"))
+    parts = ["context-guard", "setup", "--scope", scope]
+    if root is not None and scope == "project":
         parts.extend(["--root", str(root)])
     selected = explicit_agent_selection(args)
     if selected:
         parts.extend(["--agent", ",".join(selected)])
-    elif normalize_scope(getattr(args, "scope", "project")) == "user":
+    elif scope == "user":
         parts.extend(["--agent", "claude"])
     if getattr(args, "allow_path_helper_fallback", False):
         parts.append("--allow-path-helper-fallback")
@@ -3068,7 +3137,11 @@ def run_doctor(args: argparse.Namespace) -> dict[str, Any]:
     writing settings, writing rule files, or creating rollback records.
     """
     require_no_follow_file_ops_supported()
-    scope = normalize_scope(getattr(args, "scope", "project"))
+    scope = effective_scope(
+        args.root,
+        getattr(args, "scope", "project"),
+        allow_home_settings=bool(getattr(args, "allow_home_settings", False)),
+    )
     root = resolve_scope_root(args.root, scope)
     settings_path = root / SETTINGS_REL
     helper_check = _helper_availability_check(include_diet=not getattr(args, "no_diet_scan", False), allow_path_fallback=bool(getattr(args, "allow_path_helper_fallback", False)))
@@ -3190,7 +3263,7 @@ def run_doctor(args: argparse.Namespace) -> dict[str, Any]:
             "medium",
             "ContextGuard setup is not fully applied for the requested selections.",
             detail={"planned_action_count": len(actions), "planned_actions": actions},
-            next_action=_setup_command(args, apply=False, root=root),
+            next_action=_setup_command(args, apply=False, root=root, scope=scope),
         ))
     else:
         checks.append(doctor_check(
@@ -3225,7 +3298,7 @@ def run_doctor(args: argparse.Namespace) -> dict[str, Any]:
             "medium",
             "Some requested adapters still have planned or unsupported setup actions.",
             detail={"adapters": adapter_warnings},
-            next_action=_setup_command(args, apply=False, root=root),
+            next_action=_setup_command(args, apply=False, root=root, scope=scope),
         ))
     else:
         checks.append(doctor_check(
@@ -3279,9 +3352,9 @@ def run_doctor(args: argparse.Namespace) -> dict[str, Any]:
                     detail=diet_scan,
                 ))
 
-    recommended = [_setup_command(args, apply=False, root=root)]
+    recommended = [_setup_command(args, apply=False, root=root, scope=scope)]
     if changed or adapter_warnings:
-        recommended.append(_setup_command(args, apply=True, root=root))
+        recommended.append(_setup_command(args, apply=True, root=root, scope=scope))
     return {
         "schema_version": "contextguard.doctor.v1",
         "status": _doctor_status(checks),
@@ -4050,7 +4123,11 @@ def render_quiet_narration_text(result: dict[str, Any]) -> str:
 
 def run(args: argparse.Namespace) -> SetupResult:
     require_no_follow_file_ops_supported()
-    scope = normalize_scope(getattr(args, "scope", "project"))
+    scope = effective_scope(
+        args.root,
+        getattr(args, "scope", "project"),
+        allow_home_settings=bool(getattr(args, "allow_home_settings", False)),
+    )
     root = resolve_scope_root(args.root, scope)
     settings_path = root / SETTINGS_REL
     warnings: list[str] = []