aidevops 3.32.287 → 3.32.288

package/README.md

@@ -60,7 +60,7 @@ The result: an AI operations platform that manages projects across every busines
 [![Copyright](https://img.shields.io/badge/Copyright-Marcus%20Quinn%202025--2026-blue.svg)](https://github.com/marcusquinn)
 
 <!-- Release & Version Info -->
-[![Version](https://img.shields.io/badge/Version-3.32.287-blue.svg)](https://github.com/marcusquinn/aidevops/releases)
+[![Version](https://img.shields.io/badge/Version-3.32.288-blue.svg)](https://github.com/marcusquinn/aidevops/releases)
 [![npm version](https://img.shields.io/npm/v/aidevops)](https://www.npmjs.com/package/aidevops)
 [![Homebrew](https://img.shields.io/badge/homebrew-marcusquinn%2Ftap-orange)](https://github.com/marcusquinn/homebrew-tap)
 [![GitHub repository](https://img.shields.io/badge/github-repository-181717.svg?logo=github)](https://github.com/marcusquinn/aidevops)
@@ -219,9 +219,9 @@ sudo -k /usr/bin/python3 -I -B /etc/aidevops/source-access/source-access-helper.
 
 Running `aidevops security` with no arguments is the single command that covers everything — user security posture, plaintext secret detection, supply chain IoC scanning, and active advisories.
 
-When a read guard identifies only a low-confidence source-code basename match, it emits a scoped request. A maintainer can run the displayed root-broker approval command. Approvals are bound to the exact runtime session, user, Git-tracked regular source path, approved content digest, and guard reason; they expire within 12 hours and never override private-key, environment-file, credential-store, hard-link, symlink, changed-content, or untracked-file denials. The plugin redirects the approved read to a root-controlled immutable snapshot of those bytes so the live path cannot be rebound after verification; revocation removes both receipt and snapshot.
+When a read guard identifies only a low-confidence source-code basename match, it emits a scoped request. A maintainer can run the displayed root-broker approval command. Approvals are bound to the exact runtime session, user, Git-tracked regular source path, approved content digest, and guard reason; they expire within 12 hours and never override private-key, environment-file, credential-store, hard-link, symlink, changed-content, cross-worktree, or untracked-file denials. Repeating `--path` while creating a request produces one exact, repository-bound manifest that a human can approve once. The plugin redirects each approved read to its root-controlled immutable snapshot; revocation removes the receipt and every snapshot.
 
-`setup.sh` and interactive `aidevops update` provision this capability automatically. Setup verifies the published signed tag, asks for one sudo confirmation, has root fetch the exact reviewed broker bytes directly over TLS, compares those downloads byte-for-byte with the signed Git objects, and then creates a dedicated root-only signing key under `/etc/aidevops/source-access`. It never executes or copies the user-writable aidevops deployment as root. The plugin also rejects approvals whenever the installed broker bytes differ from the active release. Headless updates cannot request sudo, so they leave the capability fail-closed; the next terminal `aidevops update` completes provisioning without a separate bootstrap procedure.
+Routine `aidevops update` never requests sudo or launches an editor. When the root-owned broker differs from the active release, update prints a machine-readable deferred action; a human runs `aidevops setup --scope source-access` in an attached terminal. Scoped setup verifies the published signed tag, invalidates inherited sudo, asks for one confirmation, has root fetch the exact reviewed broker bytes directly over TLS, compares those downloads byte-for-byte with the signed Git objects, creates a dedicated root-only signing key under `/etc/aidevops/source-access`, and invalidates sudo again. It never executes or copies the user-writable aidevops deployment as root. The plugin rejects approvals whenever installed broker bytes differ from the active release.
 
 **Security advisories** are delivered via `aidevops update` and shown in the session greeting until dismissed. The scanner never exposes secret values — only file locations and key names. All remediation commands should be run in a separate terminal, not inside AI chat sessions.
 

package/VERSION

@@ -1 +1 @@
-3.32.287
+3.32.288

package/aidevops.sh

@@ -5,7 +5,7 @@
 # AI DevOps Framework CLI
 # Usage: aidevops <command> [options]
 #
-# Version: 3.32.287
+# Version: 3.32.288
 
 set -euo pipefail
 
@@ -286,14 +286,28 @@ _run_update_setup_transaction() {
 }
 
 _run_update_source_access_reconciliation() {
-	local setup_script="${INSTALL_DIR}/setup.sh"
-
-	[[ -t 0 ]] || return 0
-	[[ -z "${AIDEVOPS_AUTO_UPDATE:-}" ]] || return 0
-	[[ "${AIDEVOPS_NON_INTERACTIVE:-false}" != "true" ]] || return 0
-	if ! AIDEVOPS_SOURCE_ACCESS_INTERACTIVE=true bash "$setup_script" --stage source-access; then
-		print_warning "Source-access broker provisioning remains deferred and fail-closed"
+	local broker_dir="/etc/aidevops/source-access"
+	local deployed_scripts="${_AIDEVOPS_REAL_HOME}/.aidevops/agents/scripts"
+	local broker_current=true
+
+	[[ -f "$deployed_scripts/source_access_core.py" ]] || return 0
+	[[ -f "$deployed_scripts/source-access-helper.py" ]] || return 0
+	[[ -f "$broker_dir/source_access_core.py" && ! -L "$broker_dir/source_access_core.py" ]] || broker_current=false
+	[[ -f "$broker_dir/source-access-helper.py" && ! -L "$broker_dir/source-access-helper.py" ]] || broker_current=false
+	[[ -f "$broker_dir/source-access.pub" && ! -L "$broker_dir/source-access.pub" ]] || broker_current=false
+	[[ -f "$broker_dir/source-access.trust" && ! -L "$broker_dir/source-access.trust" ]] || broker_current=false
+	[[ ! -w "$broker_dir" ]] || broker_current=false
+	[[ ! -w "$broker_dir/source_access_core.py" ]] || broker_current=false
+	[[ ! -w "$broker_dir/source-access-helper.py" ]] || broker_current=false
+	[[ ! -w "$broker_dir/source-access.pub" ]] || broker_current=false
+	[[ ! -w "$broker_dir/source-access.trust" ]] || broker_current=false
+	if [[ "$broker_current" == "true" ]] &&
+		/usr/bin/cmp -s "$deployed_scripts/source_access_core.py" "$broker_dir/source_access_core.py" &&
+		/usr/bin/cmp -s "$deployed_scripts/source-access-helper.py" "$broker_dir/source-access-helper.py"; then
+		return 0
 	fi
+
+	print_warning "AIDEVOPS_DEFERRED_ACTION action=source-access-reconcile command='aidevops setup --scope source-access'"
 	return 0
 }
 
@@ -308,7 +322,7 @@ _update_render_changelog() {
 	fi
 	echo ""
 	print_info "Changes since $current_version ($total_commits commits):"
-	git -C "$INSTALL_DIR" log --oneline --max-count=20 "$old_hash..$new_hash" || true
+	git -C "$INSTALL_DIR" --no-pager log --oneline --max-count=20 "$old_hash..$new_hash" || true
 	if [[ "$total_commits" -gt 20 ]]; then
 		echo "  ... and more (run 'git log --oneline' in $INSTALL_DIR for full list)"
 	fi
@@ -330,6 +344,17 @@ cmd_update_help() {
 }
 
 cmd_update() {
+	# Update is operational, not compositional. Do not let any reachable Git,
+	# package-manager, migration, or setup subprocess inherit an editor or pager.
+	# Local declarations restore the caller's environment when this function exits.
+	local EDITOR=/usr/bin/false
+	local VISUAL=/usr/bin/false
+	local GIT_EDITOR=/usr/bin/false
+	local GIT_SEQUENCE_EDITOR=/usr/bin/false
+	local GIT_PAGER=cat
+	local PAGER=cat
+	local GIT_TERMINAL_PROMPT=0
+	export EDITOR VISUAL GIT_EDITOR GIT_SEQUENCE_EDITOR GIT_PAGER PAGER GIT_TERMINAL_PROMPT
 	local skip_project_sync=false
 	local reconcile_repo_verify=false
 	local update_output_mode="${AIDEVOPS_OUTPUT_MODE:-auto}"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aidevops",
-  "version": "3.32.287",
+  "version": "3.32.288",
   "description": "AI DevOps Framework - AI-assisted development workflows, code quality, and deployment automation",
   "type": "module",
   "packageManager": "bun@1.3.11",

package/setup.sh

@@ -17,7 +17,7 @@ fi
 # AI Assistant Server Access Framework Setup Script
 # Helps developers set up the framework for their infrastructure
 #
-# Version: 3.32.287
+# Version: 3.32.288
 #
 # Quick Install:
 #   npm install -g aidevops && aidevops update          (recommended)