code-mower 1.0.12__tar.gz → 1.0.13__tar.gz

{code_mower-1.0.12 → code_mower-1.0.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-mower
-Version: 1.0.12
+Version: 1.0.13
 Summary: Multi-reviewer AI code audit orchestration
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/codemower-ai/code-mower
@@ -241,7 +241,7 @@ agent report its actual host posture, exact installed version, doctor result,
 Board URL, and any owner-only click-list before it mutates the repo.
 
 The current package-index announcement entry point is the tagged
-[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.0.12/docs/try-in-10-minutes.md)
+[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.0.13/docs/try-in-10-minutes.md)
 guide. The v1.0 supervised-pilot release includes the native Board, the
 controller dry-run and policy contract, adoption and upgrade hardening from
 recent install rehearsals, package-index release checks, provider-diversity
@@ -294,6 +294,12 @@ provider qualification prompt no longer tells the agent to create its own
 temporary directory, so it stays in the disposable workspace Code Mower
 already created, and it states the existing contract that a result's total
 `elapsed_seconds` is the sum of its step values.
+The v1.0.13 patch makes automatic campaign runtime selection sandbox-safe:
+when `CODE_MOWER_PYTHON` is not set, Code Mower now prefers a supported
+versioned Python on `PATH` outside the user home before falling back to its
+own running interpreter, so a pipx- or uv-installed CLI stops handing Claude's
+strict macOS sandbox an interpreter under the denied home tree. An explicit
+`CODE_MOWER_PYTHON` remains authoritative.
 Package-only users can start from the public package rather than a source
 checkout.
 
@@ -326,7 +332,7 @@ Provider-contract baseline for the next release train:
 
 For release verification,
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the package-index procedure for `v1.0.12` / `code-mower==1.0.12`. The
+the package-index procedure for `v1.0.13` / `code-mower==1.0.13`. The
 GitHub release records the workflow and rehearsal evidence for the exact tag.
 After publication, [Release Qualification](docs/release-qualification.md)
 coordinates provider-specific install and operational checks without treating
@@ -520,8 +526,8 @@ measurement work.
 
 ## Installation Status
 
-The current package-index release baseline is `v1.0.12`, with pinned package
-install spec `code-mower==1.0.12`. Release evidence is recorded on the GitHub
+The current package-index release baseline is `v1.0.13`, with pinned package
+install spec `code-mower==1.0.13`. Release evidence is recorded on the GitHub
 release and in the first-user install rehearsal. The public repository is
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), and
 GitHub releases remain the auditable source for tags, build artifacts, and
@@ -602,6 +608,7 @@ first so local work exercises the same package entrypoint users install.
 - [v1.0.10 Release Notes](docs/v1010-release-notes.md)
 - [v1.0.11 Release Notes](docs/v1011-release-notes.md)
 - [v1.0.12 Release Notes](docs/v1012-release-notes.md)
+- [v1.0.13 Release Notes](docs/v1013-release-notes.md)
 - [Post-v0.8 Effectiveness Assessment](docs/post-v08-effectiveness-assessment.md)
 - [v1.0.1 Effectiveness Assessment](docs/v101-effectiveness-assessment.md)
 - [Demo Calibration Example](examples/demo-calibration/README.md)

{code_mower-1.0.12 → code_mower-1.0.13}/README.md

@@ -211,7 +211,7 @@ agent report its actual host posture, exact installed version, doctor result,
 Board URL, and any owner-only click-list before it mutates the repo.
 
 The current package-index announcement entry point is the tagged
-[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.0.12/docs/try-in-10-minutes.md)
+[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.0.13/docs/try-in-10-minutes.md)
 guide. The v1.0 supervised-pilot release includes the native Board, the
 controller dry-run and policy contract, adoption and upgrade hardening from
 recent install rehearsals, package-index release checks, provider-diversity
@@ -264,6 +264,12 @@ provider qualification prompt no longer tells the agent to create its own
 temporary directory, so it stays in the disposable workspace Code Mower
 already created, and it states the existing contract that a result's total
 `elapsed_seconds` is the sum of its step values.
+The v1.0.13 patch makes automatic campaign runtime selection sandbox-safe:
+when `CODE_MOWER_PYTHON` is not set, Code Mower now prefers a supported
+versioned Python on `PATH` outside the user home before falling back to its
+own running interpreter, so a pipx- or uv-installed CLI stops handing Claude's
+strict macOS sandbox an interpreter under the denied home tree. An explicit
+`CODE_MOWER_PYTHON` remains authoritative.
 Package-only users can start from the public package rather than a source
 checkout.
 
@@ -296,7 +302,7 @@ Provider-contract baseline for the next release train:
 
 For release verification,
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the package-index procedure for `v1.0.12` / `code-mower==1.0.12`. The
+the package-index procedure for `v1.0.13` / `code-mower==1.0.13`. The
 GitHub release records the workflow and rehearsal evidence for the exact tag.
 After publication, [Release Qualification](docs/release-qualification.md)
 coordinates provider-specific install and operational checks without treating
@@ -490,8 +496,8 @@ measurement work.
 
 ## Installation Status
 
-The current package-index release baseline is `v1.0.12`, with pinned package
-install spec `code-mower==1.0.12`. Release evidence is recorded on the GitHub
+The current package-index release baseline is `v1.0.13`, with pinned package
+install spec `code-mower==1.0.13`. Release evidence is recorded on the GitHub
 release and in the first-user install rehearsal. The public repository is
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), and
 GitHub releases remain the auditable source for tags, build artifacts, and
@@ -572,6 +578,7 @@ first so local work exercises the same package entrypoint users install.
 - [v1.0.10 Release Notes](docs/v1010-release-notes.md)
 - [v1.0.11 Release Notes](docs/v1011-release-notes.md)
 - [v1.0.12 Release Notes](docs/v1012-release-notes.md)
+- [v1.0.13 Release Notes](docs/v1013-release-notes.md)
 - [Post-v0.8 Effectiveness Assessment](docs/post-v08-effectiveness-assessment.md)
 - [v1.0.1 Effectiveness Assessment](docs/v101-effectiveness-assessment.md)
 - [Demo Calibration Example](examples/demo-calibration/README.md)

{code_mower-1.0.12 → code_mower-1.0.13}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-mower"
-version = "1.0.12"
+version = "1.0.13"
 description = "Multi-reviewer AI code audit orchestration"
 requires-python = ">=3.12"
 readme = "README.md"

{code_mower-1.0.12 → code_mower-1.0.13}/src/code_mower/__init__.py

@@ -1,3 +1,3 @@
 """Code Mower package."""
 
-__version__ = "1.0.12"
+__version__ = "1.0.13"

{code_mower-1.0.12 → code_mower-1.0.13}/src/code_mower/release_campaigns.py

@@ -2348,6 +2348,30 @@ def _versioned_python_candidates(path_value: str) -> tuple[str, ...]:
     return tuple(f"python3.{minor}" for minor in sorted(minors, reverse=True))
 
 
+def _resolve_python_candidate(
+    candidate: str,
+    *,
+    explicit: str,
+    which_fn: Callable[[str], str | None],
+) -> str | None:
+    candidate_path = Path(candidate).expanduser()
+    is_path = bool(
+        os.sep in candidate
+        or (os.altsep and os.altsep in candidate)
+        or candidate == sys.executable
+        or (candidate == explicit and candidate_path.exists())
+    )
+    if is_path:
+        if not candidate_path.exists():
+            return None
+        return str(candidate_path if candidate_path.is_absolute() else candidate_path.resolve())
+    resolved = which_fn(candidate)
+    if not resolved:
+        return None
+    resolved_path = Path(resolved).expanduser()
+    return str(resolved_path if resolved_path.is_absolute() else resolved_path.resolve())
+
+
 def resolve_supported_runtime(
     *,
     environ: Mapping[str, str] | None = None,
@@ -2361,43 +2385,42 @@ def resolve_supported_runtime(
     """
     env = os.environ if environ is None else environ
     explicit = env.get("CODE_MOWER_PYTHON", "").strip()
+    which = shutil.which if which_fn is None else which_fn
     if explicit:
-        candidates = (explicit,)
+        resolved = _resolve_python_candidate(explicit, explicit=explicit, which_fn=which)
+        candidates = (resolved,) if resolved else ()
     else:
         discovered = _versioned_python_candidates(str(env.get("PATH", "")))
-        candidates = (
-            sys.executable,
+        raw_candidates = (
             *discovered,
-            "python3.12",
-            "python3.13",
             "python3.14",
+            "python3.13",
+            "python3.12",
             "python3",
+            sys.executable,
         )
-    which = shutil.which if which_fn is None else which_fn
+        resolved_candidates: list[str] = []
+        seen: set[str] = set()
+        for candidate in raw_candidates:
+            resolved = _resolve_python_candidate(candidate, explicit="", which_fn=which)
+            if resolved and resolved not in seen:
+                seen.add(resolved)
+                resolved_candidates.append(resolved)
+
+        home = Path(str(env.get("HOME") or Path.home())).expanduser().resolve()
+        outside_home = [
+            candidate for candidate in resolved_candidates if not Path(candidate).resolve().is_relative_to(home)
+        ]
+        inside_home = [candidate for candidate in resolved_candidates if Path(candidate).resolve().is_relative_to(home)]
+        candidates = (*outside_home, *inside_home)
+
     run = subprocess.run if runner is None else runner
     for cand in candidates:
         if not cand:
             continue
-        cand_path = Path(cand).expanduser()
-        if (
-            os.sep in cand
-            or (os.altsep and os.altsep in cand)
-            or cand == sys.executable
-            or (cand == explicit and cand_path.exists())
-        ):
-            if cand_path.exists():
-                resolved = str(cand_path.resolve()) if not cand_path.is_absolute() else cand
-            else:
-                resolved = None
-        else:
-            resolved = which(cand)
-            if resolved and not Path(resolved).is_absolute():
-                resolved = str(Path(resolved).resolve())
-        if not resolved:
-            continue
         try:
             completed = run(
-                [resolved, "-c", "import sys; print(f'{sys.version_info[0]}.{sys.version_info[1]}')"],
+                [cand, "-c", "import sys; print(f'{sys.version_info[0]}.{sys.version_info[1]}')"],
                 text=True,
                 capture_output=True,
                 check=False,
@@ -2414,7 +2437,7 @@ def resolve_supported_runtime(
         except (IndexError, ValueError):
             continue
         if (major, minor) >= (3, 12):
-            return resolved, f"python_{major}.{minor}"
+            return cand, f"python_{major}.{minor}"
     return None
 
 

{code_mower-1.0.12 → code_mower-1.0.13}/src/code_mower/templates/workflows/builder-provenance.yml.j2

@@ -8,7 +8,7 @@ permissions:
   contents: read
 
 env:
-  CODE_MOWER_PACKAGE_SPEC: code-mower==1.0.12
+  CODE_MOWER_PACKAGE_SPEC: code-mower==1.0.13
 
 jobs:
   auto-record:

{code_mower-1.0.12 → code_mower-1.0.13}/src/code_mower.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-mower
-Version: 1.0.12
+Version: 1.0.13
 Summary: Multi-reviewer AI code audit orchestration
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/codemower-ai/code-mower
@@ -241,7 +241,7 @@ agent report its actual host posture, exact installed version, doctor result,
 Board URL, and any owner-only click-list before it mutates the repo.
 
 The current package-index announcement entry point is the tagged
-[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.0.12/docs/try-in-10-minutes.md)
+[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.0.13/docs/try-in-10-minutes.md)
 guide. The v1.0 supervised-pilot release includes the native Board, the
 controller dry-run and policy contract, adoption and upgrade hardening from
 recent install rehearsals, package-index release checks, provider-diversity
@@ -294,6 +294,12 @@ provider qualification prompt no longer tells the agent to create its own
 temporary directory, so it stays in the disposable workspace Code Mower
 already created, and it states the existing contract that a result's total
 `elapsed_seconds` is the sum of its step values.
+The v1.0.13 patch makes automatic campaign runtime selection sandbox-safe:
+when `CODE_MOWER_PYTHON` is not set, Code Mower now prefers a supported
+versioned Python on `PATH` outside the user home before falling back to its
+own running interpreter, so a pipx- or uv-installed CLI stops handing Claude's
+strict macOS sandbox an interpreter under the denied home tree. An explicit
+`CODE_MOWER_PYTHON` remains authoritative.
 Package-only users can start from the public package rather than a source
 checkout.
 
@@ -326,7 +332,7 @@ Provider-contract baseline for the next release train:
 
 For release verification,
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the package-index procedure for `v1.0.12` / `code-mower==1.0.12`. The
+the package-index procedure for `v1.0.13` / `code-mower==1.0.13`. The
 GitHub release records the workflow and rehearsal evidence for the exact tag.
 After publication, [Release Qualification](docs/release-qualification.md)
 coordinates provider-specific install and operational checks without treating
@@ -520,8 +526,8 @@ measurement work.
 
 ## Installation Status
 
-The current package-index release baseline is `v1.0.12`, with pinned package
-install spec `code-mower==1.0.12`. Release evidence is recorded on the GitHub
+The current package-index release baseline is `v1.0.13`, with pinned package
+install spec `code-mower==1.0.13`. Release evidence is recorded on the GitHub
 release and in the first-user install rehearsal. The public repository is
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), and
 GitHub releases remain the auditable source for tags, build artifacts, and
@@ -602,6 +608,7 @@ first so local work exercises the same package entrypoint users install.
 - [v1.0.10 Release Notes](docs/v1010-release-notes.md)
 - [v1.0.11 Release Notes](docs/v1011-release-notes.md)
 - [v1.0.12 Release Notes](docs/v1012-release-notes.md)
+- [v1.0.13 Release Notes](docs/v1013-release-notes.md)
 - [Post-v0.8 Effectiveness Assessment](docs/post-v08-effectiveness-assessment.md)
 - [v1.0.1 Effectiveness Assessment](docs/v101-effectiveness-assessment.md)
 - [Demo Calibration Example](examples/demo-calibration/README.md)

{code_mower-1.0.12 → code_mower-1.0.13}/templates/workflows/builder-provenance.yml.j2

@@ -8,7 +8,7 @@ permissions:
   contents: read
 
 env:
-  CODE_MOWER_PACKAGE_SPEC: code-mower==1.0.12
+  CODE_MOWER_PACKAGE_SPEC: code-mower==1.0.13
 
 jobs:
   auto-record:

{code_mower-1.0.12 → code_mower-1.0.13}/tests/test_release_campaigns.py

@@ -12756,6 +12756,78 @@ class RuntimeReadinessCampaignTests(unittest.TestCase):
 
         self.assertEqual(res, (str(python315), "python_3.15"))
 
+    def test_resolve_supported_runtime_prefers_path_runtime_outside_home(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            home = root / "home"
+            home_python = home / "pipx" / "python3.14"
+            external_bin = root / "toolchain" / "bin"
+            external_python = external_bin / "python3.12"
+            home_python.parent.mkdir(parents=True)
+            external_bin.mkdir(parents=True)
+            home_python.touch()
+            external_python.touch()
+
+            def fake_which(command: str) -> str | None:
+                return str(external_python) if command == "python3.12" else None
+
+            def fake_runner(command: list[str], **kwargs: Any) -> subprocess.CompletedProcess[str]:
+                version = "3.12.9\n" if command[0] == str(external_python) else "3.14.1\n"
+                return subprocess.CompletedProcess(command, 0, stdout=version, stderr="")
+
+            with mock.patch.object(release_campaigns.sys, "executable", str(home_python)):
+                result = release_campaigns.resolve_supported_runtime(
+                    environ={"HOME": str(home), "PATH": str(external_bin)},
+                    which_fn=fake_which,
+                    runner=fake_runner,
+                )
+
+        self.assertEqual(result, (str(external_python), "python_3.12"))
+
+    def test_resolve_supported_runtime_falls_back_to_running_interpreter_in_home(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            home = Path(tmp) / "home"
+            home_python = home / "pipx" / "python3.14"
+            home_python.parent.mkdir(parents=True)
+            home_python.touch()
+
+            def fake_runner(command: list[str], **kwargs: Any) -> subprocess.CompletedProcess[str]:
+                return subprocess.CompletedProcess(command, 0, stdout="3.14.1\n", stderr="")
+
+            with mock.patch.object(release_campaigns.sys, "executable", str(home_python)):
+                result = release_campaigns.resolve_supported_runtime(
+                    environ={"HOME": str(home), "PATH": ""},
+                    which_fn=lambda _: None,
+                    runner=fake_runner,
+                )
+
+        self.assertEqual(result, (str(home_python), "python_3.14"))
+
+    def test_resolve_supported_runtime_keeps_explicit_home_override_authoritative(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            home = Path(tmp) / "home"
+            explicit_python = home / "python3.12"
+            external_python = Path(tmp) / "external" / "python3.14"
+            explicit_python.parent.mkdir(parents=True)
+            external_python.parent.mkdir(parents=True)
+            explicit_python.touch()
+            external_python.touch()
+
+            def fake_runner(command: list[str], **kwargs: Any) -> subprocess.CompletedProcess[str]:
+                return subprocess.CompletedProcess(command, 0, stdout="3.12.9\n", stderr="")
+
+            result = release_campaigns.resolve_supported_runtime(
+                environ={
+                    "CODE_MOWER_PYTHON": str(explicit_python),
+                    "HOME": str(home),
+                    "PATH": str(external_python.parent),
+                },
+                which_fn=lambda _: str(external_python),
+                runner=fake_runner,
+            )
+
+        self.assertEqual(result, (str(explicit_python), "python_3.12"))
+
     def test_invoke_local_adapter_fails_closed_when_runtime_unavailable(self) -> None:
         invoked: list[str] = []