aes-cli 0.4.0__tar.gz → 0.4.2__tar.gz

{aes_cli-0.4.0 → aes_cli-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aes-cli
-Version: 0.4.0
+Version: 0.4.2
 Summary: CLI tool for the Agentic Engineering Standard
 Author: Hiro
 License: Apache-2.0
@@ -40,6 +40,9 @@ AES treats agent instructions, skills, permissions, and memory as **first-class
 ## Installation
 
 ```bash
+pipx install aes-cli
+
+# Or inside a virtual environment
 pip install aes-cli
 ```
 

{aes_cli-0.4.0 → aes_cli-0.4.2}/README.md

@@ -7,6 +7,9 @@ AES treats agent instructions, skills, permissions, and memory as **first-class
 ## Installation
 
 ```bash
+pipx install aes-cli
+
+# Or inside a virtual environment
 pip install aes-cli
 ```
 

{aes_cli-0.4.0 → aes_cli-0.4.2}/aes/__init__.py

@@ -2,4 +2,4 @@
 
 from __future__ import annotations
 
-__version__ = "0.4.0"
+__version__ = "0.4.2"

{aes_cli-0.4.0 → aes_cli-0.4.2}/aes/commands/sync.py

@@ -30,6 +30,19 @@ console = Console()
 SYNC_MANIFEST = ".aes-sync.json"
 
 
+def _validate_subpath(base: Path, child: Path) -> None:
+    """Ensure *child* resolves to a location under *base*.
+
+    Raises click.ClickException on path traversal attempts.
+    """
+    try:
+        child.resolve().relative_to(base.resolve())
+    except ValueError:
+        raise click.ClickException(
+            f"Path traversal blocked: {child} escapes {base}"
+        )
+
+
 def run_sync(
     project_root: Path,
     target_names: Optional[List[str]] = None,
@@ -60,6 +73,7 @@ def run_sync(
         for gf in sync_plan.files:
             if gf.action in ("create", "update"):
                 full_path = project_root / gf.relative_path
+                _validate_subpath(project_root, full_path)
                 full_path.parent.mkdir(parents=True, exist_ok=True)
                 full_path.write_text(gf.content)
                 sync_manifest["files"][gf.relative_path] = {
@@ -106,6 +120,7 @@ def _load_agent_context(project_root: Path) -> AgentContext:
     instructions: Optional[str] = None
     instructions_rel = agent_section.get("instructions", "instructions.md")
     instructions_path = agent_dir / instructions_rel
+    _validate_subpath(agent_dir, instructions_path)
     if instructions_path.exists():
         instructions = instructions_path.read_text()
 
@@ -114,6 +129,7 @@ def _load_agent_context(project_root: Path) -> AgentContext:
     orchestrator_rel = agent_section.get("orchestrator")
     if orchestrator_rel:
         orchestrator_path = agent_dir / orchestrator_rel
+        _validate_subpath(agent_dir, orchestrator_path)
         if orchestrator_path.exists():
             orchestrator = orchestrator_path.read_text()
 
@@ -125,12 +141,14 @@ def _load_agent_context(project_root: Path) -> AgentContext:
         runbook_rel = skill_ref.get("runbook")
         if runbook_rel:
             runbook_path = agent_dir / runbook_rel
+            _validate_subpath(agent_dir, runbook_path)
             if runbook_path.exists():
                 skill_runbooks[skill_id] = runbook_path.read_text()
         # Load skill manifest for name/description/activation metadata
         manifest_rel = skill_ref.get("manifest")
         if manifest_rel:
             skill_manifest_path = agent_dir / manifest_rel
+            _validate_subpath(agent_dir, skill_manifest_path)
             if skill_manifest_path.exists():
                 with open(skill_manifest_path) as f:
                     skill_data = yaml.safe_load(f) or {}
@@ -154,6 +172,7 @@ def _load_agent_context(project_root: Path) -> AgentContext:
     permissions: Optional[dict] = None
     permissions_rel = agent_section.get("permissions", PERMISSIONS_FILE)
     permissions_path = agent_dir / permissions_rel
+    _validate_subpath(agent_dir, permissions_path)
     if permissions_path.exists():
         with open(permissions_path) as f:
             permissions = yaml.safe_load(f) or {}
@@ -163,6 +182,7 @@ def _load_agent_context(project_root: Path) -> AgentContext:
     for cmd_ref in manifest.get("commands", []):
         cmd_data = dict(cmd_ref)
         cmd_path = agent_dir / cmd_ref["path"]
+        _validate_subpath(agent_dir, cmd_path)
         if cmd_path.exists():
             cmd_data["content"] = cmd_path.read_text()
         else:
@@ -320,6 +340,7 @@ def sync_cmd(
 
             if gf.action in ("create", "update") and not dry_run:
                 full_path = project_root / gf.relative_path
+                _validate_subpath(project_root, full_path)
                 full_path.parent.mkdir(parents=True, exist_ok=True)
                 full_path.write_text(gf.content)
                 sync_manifest["files"][gf.relative_path] = {

{aes_cli-0.4.0 → aes_cli-0.4.2}/aes/i18n/_messages.py

@@ -190,7 +190,7 @@ MESSAGES: dict = {
     "init.specific_label": "{type}-specific",
     "init.synced_to": "Synced to {count} tool config(s):",
     "init.mcp_configured": "MCP: {file} configured (AES registry tools)",
-    "init.mcp_install_hint": "Install MCP server: pip install aes-cli[mcp]",
+    "init.mcp_install_hint": "Install MCP server: pipx install aes-cli[mcp]",
     "init.next_steps": "Next: Start a new agent session, then type /setup to fine-tune{hint}.",
     "init.or_begin": ", or {trigger} to begin",
     "init.from_template": "Initialized from template:",

{aes_cli-0.4.0 → aes_cli-0.4.2}/aes/i18n/ja.py

@@ -190,7 +190,7 @@ MESSAGES: dict = {
     "init.specific_label": "{type}向け",
     "init.synced_to": "{count} 件のツール設定に同期しました:",
     "init.mcp_configured": "MCP: {file} を設定しました（AESレジストリツール）",
-    "init.mcp_install_hint": "MCPサーバーのインストール: pip install aes-cli[mcp]",
+    "init.mcp_install_hint": "MCPサーバーのインストール: pipx install aes-cli[mcp]",
     "init.next_steps": "次のステップ: 新しいエージェントセッションを開始し、/setup で調整{hint}。",
     "init.or_begin": "、または {trigger} で開始",
     "init.from_template": "テンプレートから初期化しました:",

{aes_cli-0.4.0 → aes_cli-0.4.2}/aes/registry.py

@@ -203,11 +203,16 @@ def upload_package(
     tarball_data = tarball_path.read_bytes()
     sha = hashlib.sha256(tarball_data).hexdigest()
 
-    # Upload tarball
+    # Upload tarball — server auto-updates index from X-AES-* headers
     upload_url = f"{base.rstrip('/')}/{PACKAGES_PATH}/{name}/{version}.tar.gz"
     req = urllib.request.Request(upload_url, data=tarball_data, method="PUT")
     req.add_header("Authorization", f"Bearer {token}")
     req.add_header("Content-Type", "application/gzip")
+    req.add_header("X-AES-Description", description)
+    req.add_header("X-AES-Type", pkg_type)
+    req.add_header("X-AES-Visibility", visibility)
+    if tags:
+        req.add_header("X-AES-Tags", ",".join(tags))
     try:
         urllib.request.urlopen(req, timeout=120)
     except urllib.error.HTTPError as exc:
@@ -216,51 +221,28 @@ def upload_package(
                 f"Version {version} of '{name}' already exists in the registry. "
                 "Bump the version in your skill manifest and try again."
             ) from None
-        raise
+        # Wrap to avoid leaking auth headers in tracebacks
+        raise RuntimeError(
+            f"Registry upload failed (HTTP {exc.code}): {exc.reason}"
+        ) from None
 
-    # Fetch current index
-    try:
-        index = fetch_index(registry_url)
-    except (urllib.error.URLError, urllib.error.HTTPError):
-        index = {"packages": {}}
+    from datetime import datetime, timezone
 
-    # Update index
-    packages = index.setdefault("packages", {})
-    pkg = packages.setdefault(name, {
+    return {
         "description": description,
+        "type": pkg_type,
+        "visibility": visibility,
+        "tags": tags or [],
         "latest": version,
-        "versions": {},
-    })
-    pkg["description"] = description
-    pkg["type"] = pkg_type
-    pkg["visibility"] = visibility
-    if tags:
-        pkg["tags"] = tags
-
-    from datetime import datetime, timezone
-    pkg["versions"][version] = {
-        "url": f"{PACKAGES_PATH}/{name}/{version}.tar.gz",
-        "sha256": sha,
-        "published_at": datetime.now(timezone.utc).isoformat(),
+        "versions": {
+            version: {
+                "url": f"{PACKAGES_PATH}/{name}/{version}.tar.gz",
+                "sha256": sha,
+                "published_at": datetime.now(timezone.utc).isoformat(),
+            }
+        },
     }
 
-    # Update "latest" if this version is higher
-    try:
-        if _parse_version(version) >= _parse_version(pkg.get("latest", "0.0.0")):
-            pkg["latest"] = version
-    except ValueError:
-        pkg["latest"] = version
-
-    # Upload updated index
-    index_data = json.dumps(index, indent=2).encode()
-    index_url = f"{base.rstrip('/')}/{INDEX_PATH}"
-    req = urllib.request.Request(index_url, data=index_data, method="PUT")
-    req.add_header("Authorization", f"Bearer {token}")
-    req.add_header("Content-Type", "application/json")
-    urllib.request.urlopen(req, timeout=30)
-
-    return pkg
-
 
 def search_packages(
     query: str = "",

{aes_cli-0.4.0 → aes_cli-0.4.2}/aes/targets/claude.py

@@ -77,7 +77,8 @@ class ClaudeTarget(SyncTarget):
 
         # 3. .claude/commands/*.md (user-defined commands)
         for cmd in ctx.commands:
-            rel_path = f".claude/commands/{cmd['id']}.md"
+            cmd_id = cmd['id'].replace("/", "-").replace("\\", "-")
+            rel_path = f".claude/commands/{cmd_id}.md"
             cmd_content = AES_SENTINEL_MD + "\n" + cmd.get("content", "")
             action = self._check_conflict(ctx.project_root, rel_path, force)
             plan.files.append(GeneratedFile(
@@ -89,7 +90,8 @@ class ClaudeTarget(SyncTarget):
 
         # 4. .claude/commands/skills/<id>.md (skill runbooks as slash commands)
         for skill_id, runbook in ctx.skill_runbooks.items():
-            rel_path = f".claude/commands/skills/{skill_id}.md"
+            safe_id = skill_id.replace("/", "-").replace("\\", "-")
+            rel_path = f".claude/commands/skills/{safe_id}.md"
             skill_content = AES_SENTINEL_MD + "\n" + runbook
 
             # Append per-skill metadata (negative triggers, permissions)

{aes_cli-0.4.0 → aes_cli-0.4.2}/aes_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aes-cli
-Version: 0.4.0
+Version: 0.4.2
 Summary: CLI tool for the Agentic Engineering Standard
 Author: Hiro
 License: Apache-2.0
@@ -40,6 +40,9 @@ AES treats agent instructions, skills, permissions, and memory as **first-class
 ## Installation
 
 ```bash
+pipx install aes-cli
+
+# Or inside a virtual environment
 pip install aes-cli
 ```
 

{aes_cli-0.4.0 → aes_cli-0.4.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "aes-cli"
-version = "0.4.0"
+version = "0.4.2"
 description = "CLI tool for the Agentic Engineering Standard"
 readme = "README.md"
 license = {text = "Apache-2.0"}

{aes_cli-0.4.0 → aes_cli-0.4.2}/tests/test_registry.py

@@ -331,7 +331,7 @@ class TestUploadPackage:
 
         assert result["visibility"] == "public"
 
-    def test_500_still_raises_httperror(self, tmp_path):
+    def test_500_still_raises_error(self, tmp_path):
         tarball = tmp_path / "deploy-1.0.0.tar.gz"
         tarball.write_bytes(b"fake tarball content")
 
@@ -345,7 +345,7 @@ class TestUploadPackage:
 
         with patch.dict(os.environ, {"AES_REGISTRY_KEY": "test-token"}):
             with patch("aes.registry.urllib.request.urlopen", side_effect=err_500):
-                with pytest.raises(urllib.error.HTTPError):
+                with pytest.raises(RuntimeError, match="HTTP 500"):
                     upload_package(
                         tarball_path=tarball,
                         name="deploy",