agentbundle 0.47.1__tar.gz → 0.52.0__tar.gz

{agentbundle-0.47.1/agentbundle.egg-info → agentbundle-0.52.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentbundle
-Version: 0.47.1
+Version: 0.52.0
 Summary: npm for your coding agent. Install packs of skills, subagents, and hooks into any repo, for every major agent.
 Author-email: eugenelim <eugenelim@users.noreply.github.com>
 License-Expression: Apache-2.0 OR MIT
@@ -15,6 +15,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
+Requires-Dist: credbroker<0.8,>=0.7
 Provides-Extra: lint
 Requires-Dist: pyyaml>=6.0; extra == "lint"
 
@@ -34,6 +35,92 @@ python -m pip install agentbundle
 
 Requires Python 3.11+. Runs on macOS, Linux, and Windows.
 
+## What's new in 0.52.0
+
+The workspace-status MCP tool now surfaces a former legacy entry (a bare
+`spec/<slug>` string or other accepted legacy shape) as an `unsupported_legacy`
+finding. The entry is absent from `ready` and `blocked`; ordinary
+reconciliation no longer accepts legacy shapes as lifecycle members. A
+canonical entry with a surviving historical alias appears in `blocked` with a
+`duplicate_membership` finding and does not appear in `ready`. Delete the alias
+and the canonical entry dispatches normally.
+
+The `capture-work` alias for `work-intake` is removed as part of Core 3.0.0.
+All intake requests should go to `work-intake`.
+
+## What's new in 0.51.0
+
+HTTPS catalogue acquisition now selects credentials automatically. Set
+`AGENTBUNDLE_HTTP_BEARER_TOKEN` for a bearer token, configure a JFrog CLI 2.105.0+
+profile with `jf login` or `jf config add` (and optionally name it with
+`JFROG_CLI_SERVER_ID`), or provide an exact-machine `.netrc` record for the
+catalogue host. Public catalogues still work with no credential setup. AgentBundle
+picks the first available source and stops — no fallback across credential types.
+
+On a corporate network, set `AGENTBUNDLE_CA_BUNDLE` for bearer, `.netrc`, and
+public catalogues. For the JFrog CLI path on Linux, set `SSL_CERT_FILE` or
+`SSL_CERT_DIR` instead; `AGENTBUNDLE_CA_BUNDLE` does not reach the `jf`
+subprocess. On macOS, add the corporate CA to the system keychain for the JFrog
+CLI path.
+
+## What's new in 0.50.0
+
+`agentbundle catalogue sync --package <name>` writes now instead of refusing.
+`credbroker` syncs `packages/credbroker/`; `agentbundle` syncs the whole
+vendored tooling root under `--tooling vendored`. Packages are written last,
+and a failed package write rolls the run back.
+
+A vendored sync refuses when the target supplies the `agentbundle` you are
+running — replacing your own engine mid-run means what executes afterwards is
+not what you reviewed.
+
+## What's new in 0.49.0
+
+`agentbundle catalogue sync` can now write. Run it with neither `--dry-run`
+nor `--check` and it asks for confirmation, then applies the same plan
+`--dry-run` would have printed — updating unedited files, keeping your edits
+behind a `.upstream.<ext>` companion, and removing paths the source stopped
+shipping. Pass `--yes` to skip the prompt in a script or CI job. Four flags
+scope a run to part of the catalogue: `--pack` (repeatable), `--profile`,
+`--guides`, and `--package` (reserved; refuses for now — package sync is not
+shipped yet). A source affording a resolved ref or a verified digest now has
+that value recorded, so a later `--check` compares against it.
+
+**Breaking:** the `sync` subcommand no longer resolves abbreviated flag
+names. `--guides` is now a real flag — the scoping flag above — so a command
+that relied on `--guides selected` resolving to `--guides-mode` now errors;
+spell `--guides-mode selected` in full.
+
+## What's new in 0.48.0
+
+`agentbundle catalogue sync` is a new command. It checks a derived catalogue
+against its source without changing any file. `--dry-run` prints what would
+update, what would keep your edits behind a `.upstream.<ext>` companion file,
+and what the source no longer has. `--check` answers whether your catalogue
+still matches its source.
+
+Sync accepts every source form `catalogue init` does — a local path, a
+`git+https://` URL, or a `catalogue+https://` descriptor — and reports which
+of those affords a verified digest. It also warns, without ever blocking the
+run, when a selected pack's version has moved in the source.
+
+## What's new in 0.47.3
+
+**Fixed:** `git_commit` no longer stages files outside the item it was
+dispatched for. If the `output_dir` you configure contains `*`, `?`, `[`, `{`
+or `}`, that value cannot describe a commit scope, so `git_commit` now refuses
+it with an error naming the section instead of committing from a wider
+directory. A base containing `*` was the one that widened the scope; the others
+matched nothing and now say so. `git_status`, `git_branch` and `git_push` keep
+working. Rename the directory to one without those characters to commit again.
+
+## What's new in 0.47.2
+
+**Fixed:** `workspace_status` now applies the same character rules to your
+configured `output_dir` that it applies to every other path it reports. A value
+using anything outside letters, digits and `. _ - /` is reported as no pattern,
+with a warning naming the section, instead of being passed through.
+
 ## What's new in 0.47.1
 
 **Fixed:** `workspace_status` now reports the output path your
@@ -486,9 +573,21 @@ agentbundle install --pack core
 ```
 
 The channel descriptor points to an immutable versioned archive; agentbundle
-fetches, verifies its SHA-256 digest, and installs. Pass a bearer token via
-`AGENTBUNDLE_HTTP_BEARER_TOKEN` — it is never stored in state, never printed, and
-never forwarded to a different host.
+fetches, verifies its SHA-256 digest, and installs.
+
+AgentBundle picks credentials automatically: set `AGENTBUNDLE_HTTP_BEARER_TOKEN`
+for a bearer token, configure a JFrog CLI 2.105.0+ profile with `jf login` or
+`jf config add` (optionally name it with `JFROG_CLI_SERVER_ID`), or provide an
+exact-machine `.netrc` record. Public catalogues need no credential setup.
+AgentBundle picks the first available source and does not fall back across types.
+AgentBundle never stores or prints the catalogue credential, and never forwards
+it to another origin — redirects that leave the origin are rejected.
+
+For bearer, `.netrc`, and public catalogues, set `AGENTBUNDLE_CA_BUNDLE` for a
+private CA. For the JFrog CLI path on Linux, use `SSL_CERT_FILE` or
+`SSL_CERT_DIR`; `AGENTBUNDLE_CA_BUNDLE` does not reach the `jf` subprocess. On
+macOS, add the corporate CA to the system keychain for the JFrog CLI path — `jf
+api` reads only the system keychain there and ignores `~/.jfrog/security/certs/`.
 
 **JSON output for CI pipelines:**
 
@@ -867,7 +966,7 @@ not the environment — compare them with
 
 ## Credentials
 
-`agentbundle` doesn't resolve secrets. Credentialed skills use [`credbroker`](https://pypi.org/project/credbroker/), a standalone resolver that keeps cleartext out of the model's reach.
+Skills resolve their own credentials through [`credbroker`](https://pypi.org/project/credbroker/), a standalone resolver that keeps cleartext out of the model's reach. AgentBundle uses `credbroker` only to read protected catalogues.
 
 ## Learn more
 

{agentbundle-0.47.1 → agentbundle-0.52.0}/README-pypi.md

@@ -14,6 +14,92 @@ python -m pip install agentbundle
 
 Requires Python 3.11+. Runs on macOS, Linux, and Windows.
 
+## What's new in 0.52.0
+
+The workspace-status MCP tool now surfaces a former legacy entry (a bare
+`spec/<slug>` string or other accepted legacy shape) as an `unsupported_legacy`
+finding. The entry is absent from `ready` and `blocked`; ordinary
+reconciliation no longer accepts legacy shapes as lifecycle members. A
+canonical entry with a surviving historical alias appears in `blocked` with a
+`duplicate_membership` finding and does not appear in `ready`. Delete the alias
+and the canonical entry dispatches normally.
+
+The `capture-work` alias for `work-intake` is removed as part of Core 3.0.0.
+All intake requests should go to `work-intake`.
+
+## What's new in 0.51.0
+
+HTTPS catalogue acquisition now selects credentials automatically. Set
+`AGENTBUNDLE_HTTP_BEARER_TOKEN` for a bearer token, configure a JFrog CLI 2.105.0+
+profile with `jf login` or `jf config add` (and optionally name it with
+`JFROG_CLI_SERVER_ID`), or provide an exact-machine `.netrc` record for the
+catalogue host. Public catalogues still work with no credential setup. AgentBundle
+picks the first available source and stops — no fallback across credential types.
+
+On a corporate network, set `AGENTBUNDLE_CA_BUNDLE` for bearer, `.netrc`, and
+public catalogues. For the JFrog CLI path on Linux, set `SSL_CERT_FILE` or
+`SSL_CERT_DIR` instead; `AGENTBUNDLE_CA_BUNDLE` does not reach the `jf`
+subprocess. On macOS, add the corporate CA to the system keychain for the JFrog
+CLI path.
+
+## What's new in 0.50.0
+
+`agentbundle catalogue sync --package <name>` writes now instead of refusing.
+`credbroker` syncs `packages/credbroker/`; `agentbundle` syncs the whole
+vendored tooling root under `--tooling vendored`. Packages are written last,
+and a failed package write rolls the run back.
+
+A vendored sync refuses when the target supplies the `agentbundle` you are
+running — replacing your own engine mid-run means what executes afterwards is
+not what you reviewed.
+
+## What's new in 0.49.0
+
+`agentbundle catalogue sync` can now write. Run it with neither `--dry-run`
+nor `--check` and it asks for confirmation, then applies the same plan
+`--dry-run` would have printed — updating unedited files, keeping your edits
+behind a `.upstream.<ext>` companion, and removing paths the source stopped
+shipping. Pass `--yes` to skip the prompt in a script or CI job. Four flags
+scope a run to part of the catalogue: `--pack` (repeatable), `--profile`,
+`--guides`, and `--package` (reserved; refuses for now — package sync is not
+shipped yet). A source affording a resolved ref or a verified digest now has
+that value recorded, so a later `--check` compares against it.
+
+**Breaking:** the `sync` subcommand no longer resolves abbreviated flag
+names. `--guides` is now a real flag — the scoping flag above — so a command
+that relied on `--guides selected` resolving to `--guides-mode` now errors;
+spell `--guides-mode selected` in full.
+
+## What's new in 0.48.0
+
+`agentbundle catalogue sync` is a new command. It checks a derived catalogue
+against its source without changing any file. `--dry-run` prints what would
+update, what would keep your edits behind a `.upstream.<ext>` companion file,
+and what the source no longer has. `--check` answers whether your catalogue
+still matches its source.
+
+Sync accepts every source form `catalogue init` does — a local path, a
+`git+https://` URL, or a `catalogue+https://` descriptor — and reports which
+of those affords a verified digest. It also warns, without ever blocking the
+run, when a selected pack's version has moved in the source.
+
+## What's new in 0.47.3
+
+**Fixed:** `git_commit` no longer stages files outside the item it was
+dispatched for. If the `output_dir` you configure contains `*`, `?`, `[`, `{`
+or `}`, that value cannot describe a commit scope, so `git_commit` now refuses
+it with an error naming the section instead of committing from a wider
+directory. A base containing `*` was the one that widened the scope; the others
+matched nothing and now say so. `git_status`, `git_branch` and `git_push` keep
+working. Rename the directory to one without those characters to commit again.
+
+## What's new in 0.47.2
+
+**Fixed:** `workspace_status` now applies the same character rules to your
+configured `output_dir` that it applies to every other path it reports. A value
+using anything outside letters, digits and `. _ - /` is reported as no pattern,
+with a warning naming the section, instead of being passed through.
+
 ## What's new in 0.47.1
 
 **Fixed:** `workspace_status` now reports the output path your
@@ -466,9 +552,21 @@ agentbundle install --pack core
 ```
 
 The channel descriptor points to an immutable versioned archive; agentbundle
-fetches, verifies its SHA-256 digest, and installs. Pass a bearer token via
-`AGENTBUNDLE_HTTP_BEARER_TOKEN` — it is never stored in state, never printed, and
-never forwarded to a different host.
+fetches, verifies its SHA-256 digest, and installs.
+
+AgentBundle picks credentials automatically: set `AGENTBUNDLE_HTTP_BEARER_TOKEN`
+for a bearer token, configure a JFrog CLI 2.105.0+ profile with `jf login` or
+`jf config add` (optionally name it with `JFROG_CLI_SERVER_ID`), or provide an
+exact-machine `.netrc` record. Public catalogues need no credential setup.
+AgentBundle picks the first available source and does not fall back across types.
+AgentBundle never stores or prints the catalogue credential, and never forwards
+it to another origin — redirects that leave the origin are rejected.
+
+For bearer, `.netrc`, and public catalogues, set `AGENTBUNDLE_CA_BUNDLE` for a
+private CA. For the JFrog CLI path on Linux, use `SSL_CERT_FILE` or
+`SSL_CERT_DIR`; `AGENTBUNDLE_CA_BUNDLE` does not reach the `jf` subprocess. On
+macOS, add the corporate CA to the system keychain for the JFrog CLI path — `jf
+api` reads only the system keychain there and ignores `~/.jfrog/security/certs/`.
 
 **JSON output for CI pipelines:**
 
@@ -847,7 +945,7 @@ not the environment — compare them with
 
 ## Credentials
 
-`agentbundle` doesn't resolve secrets. Credentialed skills use [`credbroker`](https://pypi.org/project/credbroker/), a standalone resolver that keeps cleartext out of the model's reach.
+Skills resolve their own credentials through [`credbroker`](https://pypi.org/project/credbroker/), a standalone resolver that keeps cleartext out of the model's reach. AgentBundle uses `credbroker` only to read protected catalogues.
 
 ## Learn more
 

{agentbundle-0.47.1 → agentbundle-0.52.0}/README.md

@@ -106,9 +106,21 @@ agentbundle install --pack core
 ```
 
 The channel descriptor points to an immutable versioned archive; agentbundle
-fetches, verifies its SHA-256 digest, and installs. Pass a bearer token via
-`AGENTBUNDLE_HTTP_BEARER_TOKEN` — it is never stored in state, never printed, and
-never forwarded to a different host.
+fetches, verifies its SHA-256 digest, and installs.
+
+AgentBundle picks credentials automatically: set `AGENTBUNDLE_HTTP_BEARER_TOKEN`
+for a bearer token, configure a JFrog CLI 2.105.0+ profile with `jf login` or
+`jf config add` (optionally name it with `JFROG_CLI_SERVER_ID`), or provide an
+exact-machine `.netrc` record. Public catalogues need no credential setup.
+AgentBundle picks the first available source and does not fall back across types.
+AgentBundle never stores or prints the catalogue credential, and never forwards
+it to another origin — redirects that leave the origin are rejected.
+
+For bearer, `.netrc`, and public catalogues, set `AGENTBUNDLE_CA_BUNDLE` for a
+private CA. For the JFrog CLI path on Linux, use `SSL_CERT_FILE` or
+`SSL_CERT_DIR`; `AGENTBUNDLE_CA_BUNDLE` does not reach the `jf` subprocess. On
+macOS, add the corporate CA to the system keychain for the JFrog CLI path — `jf
+api` reads only the system keychain there and ignores `~/.jfrog/security/certs/`.
 
 **JSON output for CI pipelines:**
 
@@ -298,7 +310,7 @@ The session instruction template (injected by the control plane at session start
 
 ## Credentials
 
-`agentbundle` doesn't resolve secrets. Credentialed skills use [`credbroker`](../credbroker/README.md), a standalone resolver that keeps cleartext out of the model's reach.
+Skills resolve their own credentials through [`credbroker`](../credbroker/README.md), a standalone resolver that keeps cleartext out of the model's reach. AgentBundle uses `credbroker` only to read protected catalogues.
 
 ## Learn more
 

{agentbundle-0.47.1 → agentbundle-0.52.0}/agentbundle/_data/catalogue-scaffold/guides/_shared/reference/catalogue-ci-contract.md

@@ -13,6 +13,11 @@ package, and publish an AgentBundle catalogue. It names the commands, outputs,
 exit codes, publication ordering, and responsibility boundaries — without
 prescribing a CI provider or a specific workflow shape.
 
+Use it to implement the same release flow in GitHub Actions, GitLab CI, Jenkins,
+or another runner: build without publication secrets, inject a restricted
+publisher identity only into the upload job, serialize releases, verify with a
+read identity, and retain a credential-free receipt.
+
 ## Responsibility boundary
 
 Three parties share responsibility for a catalogue CI pipeline. No party may
@@ -21,7 +26,7 @@ silently assume another's obligations.
 | Party | Owns | Never does |
 |---|---|---|
 | **AgentBundle CLI** | Correct catalogue validation; deterministic archive + SHA256 sidecar; stable JSON output shapes; stable exit-code contract | Read secrets; issue network calls; control upload order; manage retention |
-| **Organization CI** | Secrets and credential injection; HTTPS upload; publication serialization (ensuring one release lands at a time); rollback policy; artifact retention | Implement validation logic; bypass exit-code signals; skip the admission command |
+| **Organization CI** | Protected secret storage; publisher and read identities; HTTPS upload; publication serialization (ensuring one release lands at a time); rollback policy; artifact retention | Implement validation logic; expose credentials to build jobs; bypass exit-code signals; skip the admission command |
 | **Host Repository** | CI workflow files and trigger config; internal governance gates; tests proving the portable commands work in this repository | Alter the portable command signatures; branch AgentBundle's output format |
 
 ## CI lifecycle phases
@@ -43,6 +48,11 @@ Pin the version for reproducibility:
 pip install 'agentbundle==<version>'
 ```
 
+If the wheel is in an internal Artifactory PyPI repository, the selected Python
+package client owns authentication. Its credentials are separate from the
+identity that uploads a catalogue and from the identity that later reads a
+protected Generic repository.
+
 **Vendored.** The organization pre-installs agentbundle into a shared CI image or
 tool layer. The CI step runs catalogue commands without an explicit install.
 
@@ -108,6 +118,22 @@ confirm the archive is valid before uploading it.
 
 ### Phase 4 — Publication
 
+Run this phase in a protected upload job. Inject a restricted service identity
+or an organization-configured CI OIDC exchange only after the source and
+package checks pass. Use a username only when the selected upload client
+requires one.
+
+The portable controls map to common CI systems as follows:
+
+| Control | GitHub Actions example | GitLab CI example | Jenkins or another runner |
+| --- | --- | --- | --- |
+| Publisher secret | Environment or organization Actions secret | Protected, masked, and hidden CI/CD variable | Credential binding or external secret store |
+| Release gate | Protected environment and release tag | Protected release tag | Restricted release job |
+| Serialization | `concurrency` group | `resource_group` | Deployment lock or equivalent |
+
+These are mappings, not required products or variable names. The host
+repository owns its workflow syntax.
+
 Upload artifacts in this exact order:
 
 1. The archive (`.tar.gz`)
@@ -121,12 +147,13 @@ channel pointer and fails cleanly; a consumer that resolves after step 3 finds t
 archive already present.
 
 Publication serialization — preventing two concurrent releases from interleaving
-their uploads — is the CI system's responsibility.
+their uploads — is the CI system's responsibility. Configure release objects as
+immutable and allow controlled replacement only for channel descriptors.
 
 ### Phase 5 — Post-publication verification
 
-After the channel descriptor is published, download the archive and sidecar from
-the publication store and verify them locally:
+After the channel descriptor is published, use a read-only identity to download
+the archive and sidecar from the publication store and verify them locally:
 
 ```bash
 # Download from the store first (provider-specific step)
@@ -141,7 +168,9 @@ archive. This confirms the archive round-trips through the publication store
 without corruption.
 
 Optionally, smoke-test pack installation from the published catalogue to confirm
-consumer-side resolution.
+consumer-side resolution. A smoke test against a protected catalogue needs the
+same reader authentication that end users need; it must not silently reuse the
+publisher identity.
 
 ### Phase 6 — Evidence retention
 
@@ -152,6 +181,11 @@ audit, and incident response. Minimum retention artifacts:
 - The JSON output of `catalogue verify --format json` from Phase 2
 - The JSON output of `catalogue verify --archive ...` from Phase 5
 
+Also record a credential-free publication receipt: source revision, release and
+channel names, artifact paths, archive digest, CI run reference, and remote
+verification result. Never include a token, password, username, authenticated
+URL, or secret-store location.
+
 Retention period and storage location are Organization CI policy, not
 AgentBundle's.
 
@@ -168,18 +202,29 @@ All `agentbundle catalogue` commands follow the same convention:
 These codes are stable. A CI step that treats any non-zero exit as a failure
 gets the correct behaviour.
 
-## Secrets and network calls
+## Credential and network boundaries
 
 `agentbundle catalogue lint`, `agentbundle catalogue verify`, and
 `agentbundle catalogue package` do not read secrets and do not issue network
 calls. They operate entirely on the local filesystem.
 
-TLS certificate verification, bearer-token injection, proxy configuration, and
-upload credentials are exclusively Organization CI responsibilities. The
-`AGENTBUNDLE_HTTP_BEARER_TOKEN`, `AGENTBUNDLE_CA_BUNDLE`, and `HTTPS_PROXY`
-environment variables control AgentBundle's behaviour when resolving a remote
-catalogue source (used by install and upgrade verbs, not by the catalogue
-pipeline commands above).
+The three credential paths are independent:
+
+1. The Python package client authenticates to the repository that serves the
+   `agentbundle` wheel.
+2. The protected upload job authenticates its upload client with a restricted
+   publisher identity.
+3. AgentBundle's HTTPS client resolves a protected catalogue read through a
+   four-provider chain: bearer token (`AGENTBUNDLE_HTTP_BEARER_TOKEN`), JFrog
+   CLI 2.105.0+ profile, exact-machine `.netrc` record, then anonymous. The
+   chain stops at the first available provider; there is no fallback once a
+   provider is chosen. See the AgentBundle reference's Protected catalogue
+   authentication section for provider details and failure codes.
+
+`AGENTBUNDLE_CA_BUNDLE`, `HTTPS_PROXY`, and `NO_PROXY` control TLS trust and
+network routing when install or upgrade resolves a remote catalogue. They are
+not publication credentials. Keep same-origin redirects, HTTPS-only access,
+digest verification, and archive extraction confinement enabled.
 
 ## Command reference
 

{agentbundle-0.47.1 → agentbundle-0.52.0}/agentbundle/_data/catalogue-scaffold/manifest.json

@@ -1,7 +1,7 @@
 {
   "files": {
     "guides/_shared/reference/catalogue-authoring-standards.md": "72771324354ff29a4bf9072f48236e537bc680421785d700d2a3308d562777cc",
-    "guides/_shared/reference/catalogue-ci-contract.md": "fae793ab47989b6dd3c731afcb0b4cda21c7d08bbe7fa40fca6d3abb3d158141",
+    "guides/_shared/reference/catalogue-ci-contract.md": "78994d30da2b0eb9ea9347f397791fafa99ebc92f80410f26b9af93788a6e188",
     "packs/AGENTS.md": "c20af03f72b4c25c032ba5c15299eadaa0b41442c92d1cf621dde042cf9ff8db",
     "packs/CLAUDE.md": "336cc4fbf19beaada7ccf9986414fa91851a8d7a07dfb3ccbe800a69eed0ab49",
     "packs/README.md": "d2de5f9556f4c8e521103474bde74636e02cc805f9bf5312a3a61a1f3eb45d8f",

{agentbundle-0.47.1/agentbundle/catalogue_tooling → agentbundle-0.52.0/agentbundle/_data}/file_safety.py

@@ -7,7 +7,7 @@ import stat
 from contextlib import contextmanager
 from hashlib import sha256
 from pathlib import Path
-from typing import BinaryIO, Iterator, Literal, NamedTuple, overload
+from typing import BinaryIO, Generator, Literal, NamedTuple, overload
 
 
 class UnsafeContentError(ValueError):
@@ -282,7 +282,7 @@ def _supports_descriptor_walk() -> bool:
 @contextmanager
 def _open_confined_parent(
     root: Path, path: Path, *, relative: str
-) -> Iterator[tuple[int | None, str]]:
+) -> Generator[tuple[int | None, str], None, None]:
     """Hold the target's parent open without following path components."""
     try:
         relative_path = path.relative_to(root)
@@ -352,7 +352,7 @@ def _open_confined_regular_file(
     path: Path,
     *,
     max_bytes: int | None = None,
-) -> Iterator[BinaryIO]:
+) -> Generator[BinaryIO, None, None]:
     """Open *path* only when it is a bounded, confined regular file.
 
     The link count is checked both before and after opening so a hard-linked