agentwire-dev 1.77.3__tar.gz → 1.77.5__tar.gz

{agentwire_dev-1.77.3 → agentwire_dev-1.77.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentwire-dev
-Version: 1.77.3
+Version: 1.77.5
 Summary: Multi-session voice web interface for AI coding agents
 Project-URL: Homepage, https://agentwire.dev
 Project-URL: Repository, https://github.com/dotdevdotdev/agentwire-dev
@@ -228,7 +228,7 @@ Requires-Dist: aiohttp-jinja2>=1.6
 Requires-Dist: aiohttp>=3.13.4
 Requires-Dist: av>=12.0.0
 Requires-Dist: certifi>=2026.10.23
-Requires-Dist: damage-control-dev<0.2,>=0.1.4
+Requires-Dist: damage-control-dev<0.2,>=0.1.6
 Requires-Dist: fastapi>=0.104.0
 Requires-Dist: jinja2>=3.1.0
 Requires-Dist: kokoro-onnx>=0.4.9; python_version < '3.14'

{agentwire_dev-1.77.3 → agentwire_dev-1.77.5}/RELEASING.md

@@ -6,7 +6,7 @@ Every release does **both** a PyPI publish and a GitHub release. The **GitHub re
 
 ## The engine is a separate project (single source)
 
-The damage-control engine has exactly one source: the `damage-control-dev` repo (<https://github.com/dotdevdotdev/damage-control-dev>), published on PyPI. `agentwire-dev` only *consumes* it through the range in `pyproject.toml` (currently `damage-control-dev>=0.1.4,<0.2`); a checkout and a PyPI install both resolve it from PyPI. There is no copy of the engine in this repo and nothing to release from here. `tests/unit/test_damage_control_pin.py` checks that the declared floor/ceiling parse and that the installed engine satisfies them.
+The damage-control engine has exactly one source: the `damage-control-dev` repo (<https://github.com/dotdevdotdev/damage-control-dev>), published on PyPI. `agentwire-dev` only *consumes* it through the range in `pyproject.toml` (currently `damage-control-dev>=0.1.6,<0.2`); a checkout and a PyPI install both resolve it from PyPI. There is no copy of the engine in this repo and nothing to release from here. `tests/unit/test_damage_control_pin.py` checks that the declared floor/ceiling parse and that the installed engine satisfies them.
 
 To ship an engine change:
 

{agentwire_dev-1.77.3 → agentwire_dev-1.77.5}/agentwire/__init__.py

@@ -1,3 +1,3 @@
 """AgentWire - Multi-session voice web interface for AI coding agents."""
 
-__version__ = "1.77.3"
+__version__ = "1.77.5"

{agentwire_dev-1.77.3 → agentwire_dev-1.77.5}/agentwire/safety/rule_baselines.json

@@ -54,7 +54,8 @@
       "c10d81a50fe5bf2b4d83a37bc9e58f22d2a8ea5265cd0757d6bceb38702481dd",
       "d49e33dfeb72a8257e1853bdb4e11719610b41fb739979f439c4e08b53648705",
       "d7323ac7f5a4f23d1b6a7455c8666a26abca2cfe248e0b9161f93346abdce82a",
-      "f399f899aac4bf0008d81c9c9b7f3a6f12927aec5a31f4d1d0b135bec4d71f67"
+      "f399f899aac4bf0008d81c9c9b7f3a6f12927aec5a31f4d1d0b135bec4d71f67",
+      "06f414695b411058d9c2c675c43d2707ddcffa970ae62506083feb1dd56802fc"
     ],
     "databases.yaml": [
       "0547cffb489a750505941ba773a4be03dccc8217bb358aee12cf2cff663190d3",

{agentwire_dev-1.77.3 → agentwire_dev-1.77.5}/corpus/golden/effective_rules.json

@@ -333,9 +333,6 @@
   "\"*.min.js\"",
   "\".git/config\"",
   "\".git/hooks/\"",
-  "\".next/\"",
-  "\".nuxt/\"",
-  "\".output/\"",
   "\".venv/\"",
   "\"/bin/\"",
   "\"/boot/\"",
@@ -347,15 +344,12 @@
   "\"Gemfile.lock\"",
   "\"Pipfile.lock\"",
   "\"__pycache__/\"",
-  "\"build/\"",
   "\"bun.lockb\"",
   "\"composer.lock\"",
-  "\"dist/\"",
   "\"flake.lock\"",
   "\"go.sum\"",
   "\"node_modules/\"",
   "\"npm-shrinkwrap.json\"",
-  "\"out/\"",
   "\"package-lock.json\"",
   "\"pnpm-lock.yaml\"",
   "\"poetry.lock\"",

{agentwire_dev-1.77.3 → agentwire_dev-1.77.5}/corpus/golden/snapshot.json

@@ -134,7 +134,7 @@
   "audit": 8,
   "engine": 1828,
   "engine_by_platform": 8,
-  "hooks": 1014,
+  "hooks": 1016,
   "hooks_by_platform": 6
  },
  "engine": {
@@ -2755,9 +2755,9 @@
    "unverifiable": false
   },
   "[\"Bash\", \"cat a.txt | sed 's|x|y|' | tee dist/o.js\", \"/golden/home\", \"default\"]": {
-   "decision": "block",
+   "decision": "allow",
    "protected": false,
-   "rule_id": "core.read-only-path",
+   "rule_id": null,
    "unverifiable": false
   },
   "[\"Bash\", \"cat a.txt | sed 's|x|y|' | tee dist/o.js\", \"/golden/home\", \"kill-switch-off\"]": {
@@ -6715,9 +6715,9 @@
    "unverifiable": false
   },
   "[\"Bash\", \"echo x > dist/app.js\", \"/golden/home\", \"default\"]": {
-   "decision": "block",
+   "decision": "allow",
    "protected": false,
-   "rule_id": "core.read-only-path",
+   "rule_id": null,
    "unverifiable": false
   },
   "[\"Bash\", \"echo x > dist/app.js\", \"/golden/home\", \"kill-switch-off\"]": {
@@ -9499,9 +9499,9 @@
    "unverifiable": false
   },
   "[\"Bash\", \"sed 's|x|y|' notes.txt > dist/out.js\", \"/golden/home\", \"default\"]": {
-   "decision": "block",
+   "decision": "allow",
    "protected": false,
-   "rule_id": "core.read-only-path",
+   "rule_id": null,
    "unverifiable": false
   },
   "[\"Bash\", \"sed 's|x|y|' notes.txt > dist/out.js\", \"/golden/home\", \"kill-switch-off\"]": {
@@ -9511,9 +9511,9 @@
    "unverifiable": false
   },
   "[\"Bash\", \"sed -i '' 's/a/b/' dist/app.js\", \"/golden/home\", \"default\"]": {
-   "decision": "block",
+   "decision": "allow",
    "protected": false,
-   "rule_id": "core.read-only-path",
+   "rule_id": null,
    "unverifiable": false
   },
   "[\"Bash\", \"sed -i '' 's/a/b/' dist/app.js\", \"/golden/home\", \"kill-switch-off\"]": {
@@ -9525,7 +9525,7 @@
   "[\"Bash\", \"sed -i '1e rm -rf dist/' notes.txt\", \"/golden/home\", \"default\"]": {
    "decision": "block",
    "protected": false,
-   "rule_id": "core.read-only-path",
+   "rule_id": "core.rm-with-recursive-or-force-flags",
    "unverifiable": false
   },
   "[\"Bash\", \"sed -i '1e rm -rf dist/' notes.txt\", \"/golden/home\", \"kill-switch-off\"]": {
@@ -9559,9 +9559,9 @@
    "unverifiable": false
   },
   "[\"Bash\", \"sed -i 's/a/b/e' dist/x.js\", \"/golden/home\", \"default\"]": {
-   "decision": "block",
+   "decision": "allow",
    "protected": false,
-   "rule_id": "core.read-only-path",
+   "rule_id": null,
    "unverifiable": false
   },
   "[\"Bash\", \"sed -i 's/a/b/e' dist/x.js\", \"/golden/home\", \"kill-switch-off\"]": {
@@ -9571,9 +9571,9 @@
    "unverifiable": false
   },
   "[\"Bash\", \"sed -i 's/a/b/w dist/out.js' notes.txt\", \"/golden/home\", \"default\"]": {
-   "decision": "block",
+   "decision": "allow",
    "protected": false,
-   "rule_id": "core.read-only-path",
+   "rule_id": null,
    "unverifiable": false
   },
   "[\"Bash\", \"sed -i 's/a/b/w dist/out.js' notes.txt\", \"/golden/home\", \"kill-switch-off\"]": {
@@ -9607,9 +9607,9 @@
    "unverifiable": false
   },
   "[\"Bash\", \"sed -i \\\"s|a|$(echo dist/x)|\\\" notes.txt\", \"/golden/home\", \"default\"]": {
-   "decision": "block",
+   "decision": "ask",
    "protected": false,
-   "rule_id": "core.read-only-path",
+   "rule_id": "core.ambiguous-command",
    "unverifiable": false
   },
   "[\"Bash\", \"sed -i \\\"s|a|$(echo dist/x)|\\\" notes.txt\", \"/golden/home\", \"kill-switch-off\"]": {
@@ -12411,10 +12411,10 @@
    "rule_id": null
   },
   "[\"Bash\", \"cat a.txt | sed 's|x|y|' | tee dist/o.js\", \"/golden/home\", \"interactive\"]": {
-   "audit": "blocked",
-   "decision": "block",
-   "exit": 2,
-   "rule_id": "core.read-only-path"
+   "audit": "allowed",
+   "decision": "allow",
+   "exit": 0,
+   "rule_id": null
   },
   "[\"Bash\", \"cat config\", \"/golden/home\", \"interactive\", \"/golden/home/.config/git\"]": {
    "audit": "allowed",
@@ -14427,10 +14427,10 @@
    "rule_id": "core.protected-control-plane"
   },
   "[\"Bash\", \"echo x > dist/app.js\", \"/golden/home\", \"interactive\"]": {
-   "audit": "blocked",
-   "decision": "block",
-   "exit": 2,
-   "rule_id": "core.read-only-path"
+   "audit": "allowed",
+   "decision": "allow",
+   "exit": 0,
+   "rule_id": null
   },
   "[\"Bash\", \"echo x > hosts.yml\", \"/golden/home\", \"interactive\", \"/golden/home/.config/gh\"]": {
    "audit": "blocked",
@@ -16251,22 +16251,22 @@
    "rule_id": "core.protected-control-plane"
   },
   "[\"Bash\", \"sed 's|x|y|' notes.txt > dist/out.js\", \"/golden/home\", \"interactive\"]": {
-   "audit": "blocked",
-   "decision": "block",
-   "exit": 2,
-   "rule_id": "core.read-only-path"
+   "audit": "allowed",
+   "decision": "allow",
+   "exit": 0,
+   "rule_id": null
   },
   "[\"Bash\", \"sed -i '' 's/a/b/' dist/app.js\", \"/golden/home\", \"interactive\"]": {
-   "audit": "blocked",
-   "decision": "block",
-   "exit": 2,
-   "rule_id": "core.read-only-path"
+   "audit": "allowed",
+   "decision": "allow",
+   "exit": 0,
+   "rule_id": null
   },
   "[\"Bash\", \"sed -i '1e rm -rf dist/' notes.txt\", \"/golden/home\", \"interactive\"]": {
    "audit": "blocked",
    "decision": "block",
    "exit": 2,
-   "rule_id": "core.read-only-path"
+   "rule_id": "core.rm-with-recursive-or-force-flags"
   },
   "[\"Bash\", \"sed -i 's/a/b/' node_modules/pkg/index.js\", \"/golden/home\", \"interactive\"]": {
    "audit": "blocked",
@@ -16281,16 +16281,16 @@
    "rule_id": "core.protected-control-plane"
   },
   "[\"Bash\", \"sed -i 's/a/b/e' dist/x.js\", \"/golden/home\", \"interactive\"]": {
-   "audit": "blocked",
-   "decision": "block",
-   "exit": 2,
-   "rule_id": "core.read-only-path"
+   "audit": "allowed",
+   "decision": "allow",
+   "exit": 0,
+   "rule_id": null
   },
   "[\"Bash\", \"sed -i 's/a/b/w dist/out.js' notes.txt\", \"/golden/home\", \"interactive\"]": {
-   "audit": "blocked",
-   "decision": "block",
-   "exit": 2,
-   "rule_id": "core.read-only-path"
+   "audit": "allowed",
+   "decision": "allow",
+   "exit": 0,
+   "rule_id": null
   },
   "[\"Bash\", \"sed -i 's/x/y/' ~/.agentwire/hooks/damage-control/bash-tool-damage-control.py  # allow: I really want to\", \"/golden/home\", \"interactive\"]": {
    "audit": "blocked",
@@ -16304,11 +16304,23 @@
    "exit": 2,
    "rule_id": "core.protected-control-plane"
   },
+  "[\"Bash\", \"sed -i \\\"s|a|$(echo dist/x)|\\\" notes.txt\", \"/golden/home\", \"bypass\"]": {
+   "audit": "allowed",
+   "decision": "allow",
+   "exit": 0,
+   "rule_id": null
+  },
   "[\"Bash\", \"sed -i \\\"s|a|$(echo dist/x)|\\\" notes.txt\", \"/golden/home\", \"interactive\"]": {
-   "audit": "blocked",
-   "decision": "block",
-   "exit": 2,
-   "rule_id": "core.read-only-path"
+   "audit": "asked",
+   "decision": "ask",
+   "exit": 0,
+   "rule_id": null
+  },
+  "[\"Bash\", \"sed -i \\\"s|a|$(echo dist/x)|\\\" notes.txt\", \"/golden/home\", \"unattended\"]": {
+   "audit": "allowed",
+   "decision": "allow",
+   "exit": 0,
+   "rule_id": null
   },
   "[\"Bash\", \"sed -i s/a/b/ .agentwire/config.yaml\", \"/golden/home\", \"interactive\", \"/golden/home\"]": {
    "audit": "blocked",

{agentwire_dev-1.77.3 → agentwire_dev-1.77.5}/pyproject.toml

@@ -29,7 +29,7 @@ dependencies = [
     # PyPI. Engine changes land there, release there, then raise this floor.
     # tests/unit/test_damage_control_pin.py checks the range and the installed engine.
     # Hooks run `python -I -m damage_control.hook`.
-    "damage-control-dev>=0.1.4,<0.2",
+    "damage-control-dev>=0.1.6,<0.2",
     "aiohttp>=3.13.4",  # >=3.13.4 clears CVE-2026-34515 + CVE-2026-34513 (portal-facing)
     "aiohttp-jinja2>=1.6",
     "jinja2>=3.1.0",

{agentwire_dev-1.77.3 → agentwire_dev-1.77.5}/tests/unit/test_block_rows_carry_an_id.py

@@ -15,7 +15,7 @@ pytestmark = pytest.mark.real_agentwire_home
 BLOCKS = {
     "zero-access": "cat server.key",
     "zero-access-env": "grep -c TOKEN .env",
-    "read-only": "echo x > dist/app.js",
+    "read-only": "echo x > node_modules/app.js",
     "control-plane": "echo x > ~/.agentwire/damagecontrol.yml",
     "protected-command": "agentwire tasks promote x",
     "no-delete": "truncate -s0 CLAUDE.md",

{agentwire_dev-1.77.3 → agentwire_dev-1.77.5}/tests/unit/test_sed_script_is_data.py

@@ -25,14 +25,14 @@ def cfg():
 
 
 REAL_TARGETS = {
-    "file-operand-dist": "sed -i '' 's/a/b/' dist/app.js",
+    "file-operand-deps": "sed -i '' 's/a/b/' node_modules/app.js",
     "file-operand-modules": "sed -i 's/a/b/' node_modules/pkg/index.js",
-    "write-flag": "sed -i 's/a/b/w dist/out.js' notes.txt",
-    "execute-flag": "sed -i 's/a/b/e' dist/x.js",
-    "redirect": "sed 's|x|y|' notes.txt > dist/out.js",
-    "tee": "cat a.txt | sed 's|x|y|' | tee dist/o.js",
-    "script-with-command": "sed -i '1e rm -rf dist/' notes.txt",
-    "substitution-in-script": 'sed -i "s|a|$(echo dist/x)|" notes.txt',
+    "write-flag": "sed -i 's/a/b/w node_modules/out.js' notes.txt",
+    "execute-flag": "sed -i 's/a/b/e' node_modules/x.js",
+    "redirect": "sed 's|x|y|' notes.txt > node_modules/out.js",
+    "tee": "cat a.txt | sed 's|x|y|' | tee node_modules/o.js",
+    "script-with-command": "sed -i '1e rm -rf node_modules/' notes.txt",
+    "substitution-in-script": 'sed -i "s|a|$(echo node_modules/x)|" notes.txt',
 }
 
 

{agentwire_dev-1.77.3 → agentwire_dev-1.77.5}/tests/unit/test_unattended_scoped_allow.py

@@ -18,7 +18,9 @@ from damage_control.engine import (
     bundled_rule_sources,
     bundled_tooldefs_dir,
     check_command,
+    encode_unattended_allow,
     load_config,
+    parse_unattended_allow,
     resolve_unattended_grants,
     unattended_grant_allows,
 )
@@ -136,3 +138,75 @@ def test_a_grant_never_downgrades_a_hard_block(bundled_config):
     weak = [c for c in ("git -C /repo push --force origin main", "git reset --hard origin/main")
             if check_command(c, granted)["decision"] != "block"]
     assert not weak, weak
+
+
+def test_a_cd_not_joined_by_and_is_unresolvable(bundled_config, store):
+    """`cd X ; cmd` runs cmd even if the cd failed, so it cannot be pinned to X —
+    even when X is in scope."""
+    s, _other, scope = store
+    ok, why = _grant(f"cd {s} ; git commit -m x", s, {"git.commit": [[scope]]}, bundled_config)
+    assert not ok and "not statically knowable" in why
+    ok, why = _grant(f"cd {s} && git commit -m x", s, {"git.commit": [[scope]]}, bundled_config)
+    assert ok, why
+
+
+def test_scoped_entries_survive_the_env_wire_format():
+    """A spawned child inherits the SCOPE through AGENTWIRE_UNATTENDED_ALLOW,
+    not a bare grant."""
+    entries = [{"id": "git.commit", "paths": ["/x/*/memory/"]}]
+    grants, errors = parse_unattended_allow(json.loads(encode_unattended_allow(entries)))
+    assert not errors and grants == {"git.commit": [["/x/*/memory/"]]}
+
+
+def test_a_scope_rooted_behind_a_symlink_admits_its_contents(bundled_config, tmp_path):
+    """The candidate is realpath'd, so the scope's literal prefix must be too, or
+    a scope under a symlinked directory rejects its own legitimate contents."""
+    real = tmp_path.resolve() / "real"
+    mem = real / "projects" / "proj-a" / "memory"
+    mem.mkdir(parents=True)
+    (tmp_path.resolve() / "link").symlink_to(real)
+    scope = f"{tmp_path.resolve()}/link/projects/*/memory/"
+    ok, why = _grant("git commit -m x", mem, {"git.commit": [[scope]]}, bundled_config)
+    assert ok, why
+
+
+def test_the_dash_c_chain_and_git_dir_resolve_against_the_previous_hop(bundled_config, store):
+    """Real git: each `-C` is relative to the previous one, and `--git-dir` is
+    relative to the `-C` result — never to the session cwd."""
+    s, _other, scope = store
+    grants = {"git.commit": [[scope]]}
+    spellings = [
+        "git -C sub1 -C ../sub2 commit -m x",
+        "git -C sub1 --git-dir=../.git commit -m x",
+        "git -C sub1 --work-tree=../sub2 commit -m x",
+    ]
+    refused = {c: why for c in spellings
+               for ok, why in [_grant(c, s, grants, bundled_config)] if not ok}
+    assert not refused, refused
+
+
+def test_substitution_is_judged_by_position_not_presence(bundled_config, store):
+    """#942/#943: a substitution in the message does not decide a directory
+    (granted); one that decides the `-C` target does (refused)."""
+    s, _other, scope = store
+    grants = {"git.commit": [[scope]]}
+    ok, why = _grant('git commit -m "$(date +%F)"', s, grants, bundled_config)
+    assert ok, why
+    ok, why = _grant('git -C "$(pwd)" commit -m x', s, grants, bundled_config)
+    assert not ok and "command substitution" in why
+
+
+def test_inline_git_config_cannot_redirect_the_worktree(bundled_config, store):
+    """#927: `-c core.worktree=<elsewhere>` redirects like the config two-step."""
+    s, other, scope = store
+    ok, why = _grant(f"git -c core.worktree={other} commit -m x", s, {"git.commit": [[scope]]}, bundled_config)
+    assert not ok and "core.worktree" in why
+
+
+def test_a_scoped_grant_refuses_an_action_with_no_filesystem_target():
+    """An MCP-synthesized command touches no directory; measuring the scope
+    against the session cwd would be meaningless, so it refuses."""
+    ok, why = unattended_grant_allows(
+        "git.commit", "agentwire email --to x", {"git.commit": [["/x/"]]}, "/x", scopeable=False
+    )
+    assert not ok and "no filesystem target" in why