codex-workspace-bootstrap 0.5.2__tar.gz → 0.6.0__tar.gz

{codex_workspace_bootstrap-0.5.2/src/codex_workspace_bootstrap.egg-info → codex_workspace_bootstrap-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codex-workspace-bootstrap
-Version: 0.5.2
+Version: 0.6.0
 Summary: Preflight AI coding repositories before Codex, Copilot, Cline, Claude, Gemini, Continue, or Cursor touches them.
 Author: kohli217
 License: MIT
@@ -142,7 +142,7 @@ It does not claim these files are correct merely because they exist. It tells yo
 
 ### Cross-agent instruction integrity
 
-When multiple AI instruction files exist, `cwb` reads executable-looking commands and checks them against repository evidence. It understands nested `AGENTS.md` / `AGENTS.override.md`, nested Cursor `.cursor/rules`, and common path-specific frontmatter such as Copilot `applyTo` and rule `globs`. It can flag:
+When multiple AI instruction files exist, `cwb` reads executable-looking commands and checks them against repository evidence. It understands nested `AGENTS.md` / `AGENTS.override.md`, nested `CLAUDE.md`, Gemini CLI hierarchical context files (including project `context.fileName` overrides), nested Cursor `.cursor/rules`, and common path-specific frontmatter such as Copilot `applyTo` and rule `globs`. It can flag:
 
 - package-manager mismatches against `packageManager` and lockfiles;
 - cross-agent package-manager drift;
@@ -248,18 +248,18 @@ cwb doctor .
 cwb init-agents .
 ```
 
-Generation is evidence-based: the tool cross-checks project manifests, package scripts, pytest configuration, and README commands. Plausible but unconfirmed commands are separated for maintainer review. Existing `AGENTS.md` files are never overwritten unless `--force` is explicit.
+Generation is evidence-based: the tool cross-checks project manifests, package-manager evidence, package scripts, pytest configuration, and README commands. Plausible but unconfirmed commands are separated for maintainer review. Existing `AGENTS.md` files are never overwritten unless `--force` is explicit.
 
 ## GitHub Action
 
 The reusable Action is published on GitHub Marketplace.
 
 ```yaml
-- uses: actions/checkout@v7
-- uses: actions/setup-python@v7
+- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
   with:
     python-version: "3.13"
-- uses: kohli217/codex-workspace-bootstrap@v0.5.2
+- uses: kohli217/codex-workspace-bootstrap@v0.6.0
   with:
     path: .
     strict: "true"
@@ -291,7 +291,9 @@ The intent is to complement those tools, not replace them.
 - Suspected secret files are not opened or printed by the filename-risk check.
 - Repository contents are not sent to a remote AI service by the core audit.
 - Instruction files are read locally for deterministic linting; extracted commands are never executed by the integrity lint.
-- Existing `AGENTS.md` files are protected unless overwrite is explicit.
+- Repository instruction/configuration inputs are not read through symbolic links.
+- `init-agents` and automatic fixes refuse symlinked `AGENTS.md` targets rather than writing through them.
+- Existing regular `AGENTS.md` files are protected unless overwrite is explicit.
 - A passing preflight is evidence about the checks performed, **not a security guarantee**.
 
 See [SECURITY.md](SECURITY.md).
@@ -323,7 +325,7 @@ py -m pip install codex-workspace-bootstrap
 Pinned GitHub release artifact:
 
 ```powershell
-py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.5.2/codex_workspace_bootstrap-0.5.2-py3-none-any.whl"
+py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.6.0/codex_workspace_bootstrap-0.6.0-py3-none-any.whl"
 ```
 
 ## Development

{codex_workspace_bootstrap-0.5.2 → codex_workspace_bootstrap-0.6.0}/README.md

@@ -114,7 +114,7 @@ It does not claim these files are correct merely because they exist. It tells yo
 
 ### Cross-agent instruction integrity
 
-When multiple AI instruction files exist, `cwb` reads executable-looking commands and checks them against repository evidence. It understands nested `AGENTS.md` / `AGENTS.override.md`, nested Cursor `.cursor/rules`, and common path-specific frontmatter such as Copilot `applyTo` and rule `globs`. It can flag:
+When multiple AI instruction files exist, `cwb` reads executable-looking commands and checks them against repository evidence. It understands nested `AGENTS.md` / `AGENTS.override.md`, nested `CLAUDE.md`, Gemini CLI hierarchical context files (including project `context.fileName` overrides), nested Cursor `.cursor/rules`, and common path-specific frontmatter such as Copilot `applyTo` and rule `globs`. It can flag:
 
 - package-manager mismatches against `packageManager` and lockfiles;
 - cross-agent package-manager drift;
@@ -220,18 +220,18 @@ cwb doctor .
 cwb init-agents .
 ```
 
-Generation is evidence-based: the tool cross-checks project manifests, package scripts, pytest configuration, and README commands. Plausible but unconfirmed commands are separated for maintainer review. Existing `AGENTS.md` files are never overwritten unless `--force` is explicit.
+Generation is evidence-based: the tool cross-checks project manifests, package-manager evidence, package scripts, pytest configuration, and README commands. Plausible but unconfirmed commands are separated for maintainer review. Existing `AGENTS.md` files are never overwritten unless `--force` is explicit.
 
 ## GitHub Action
 
 The reusable Action is published on GitHub Marketplace.
 
 ```yaml
-- uses: actions/checkout@v7
-- uses: actions/setup-python@v7
+- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
   with:
     python-version: "3.13"
-- uses: kohli217/codex-workspace-bootstrap@v0.5.2
+- uses: kohli217/codex-workspace-bootstrap@v0.6.0
   with:
     path: .
     strict: "true"
@@ -263,7 +263,9 @@ The intent is to complement those tools, not replace them.
 - Suspected secret files are not opened or printed by the filename-risk check.
 - Repository contents are not sent to a remote AI service by the core audit.
 - Instruction files are read locally for deterministic linting; extracted commands are never executed by the integrity lint.
-- Existing `AGENTS.md` files are protected unless overwrite is explicit.
+- Repository instruction/configuration inputs are not read through symbolic links.
+- `init-agents` and automatic fixes refuse symlinked `AGENTS.md` targets rather than writing through them.
+- Existing regular `AGENTS.md` files are protected unless overwrite is explicit.
 - A passing preflight is evidence about the checks performed, **not a security guarantee**.
 
 See [SECURITY.md](SECURITY.md).
@@ -295,7 +297,7 @@ py -m pip install codex-workspace-bootstrap
 Pinned GitHub release artifact:
 
 ```powershell
-py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.5.2/codex_workspace_bootstrap-0.5.2-py3-none-any.whl"
+py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.6.0/codex_workspace_bootstrap-0.6.0-py3-none-any.whl"
 ```
 
 ## Development

{codex_workspace_bootstrap-0.5.2 → codex_workspace_bootstrap-0.6.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "codex-workspace-bootstrap"
-version = "0.5.2"
+version = "0.6.0"
 description = "Preflight AI coding repositories before Codex, Copilot, Cline, Claude, Gemini, Continue, or Cursor touches them."
 readme = "README.md"
 requires-python = ">=3.10"

{codex_workspace_bootstrap-0.5.2 → codex_workspace_bootstrap-0.6.0}/src/codex_workspace_bootstrap/__init__.py

@@ -1,3 +1,3 @@
 """codex-workspace-bootstrap package."""
 
-__version__ = "0.5.2"
+__version__ = "0.6.0"

{codex_workspace_bootstrap-0.5.2 → codex_workspace_bootstrap-0.6.0}/src/codex_workspace_bootstrap/agents.py

@@ -29,7 +29,7 @@ def detect_project_signals(root: Path) -> list[str]:
 
 def _node_script_names(root: Path) -> set[str]:
     package_json = root / NODE_MARKER
-    if not package_json.exists():
+    if not package_json.is_file() or package_json.is_symlink():
         return set()
 
     try:
@@ -44,10 +44,48 @@ def _node_script_names(root: Path) -> set[str]:
     return {name for name, value in scripts.items() if isinstance(name, str) and isinstance(value, str)}
 
 
+def _node_package_managers(root: Path) -> set[str]:
+    managers: set[str] = set()
+    package_json = root / NODE_MARKER
+
+    if package_json.is_file() and not package_json.is_symlink():
+        try:
+            data = json.loads(package_json.read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError, UnicodeDecodeError):
+            data = {}
+        if isinstance(data, dict):
+            declared = data.get("packageManager")
+            if isinstance(declared, str) and declared:
+                manager = declared.split("@", 1)[0].strip().lower()
+                if manager in {"npm", "pnpm", "yarn", "bun"}:
+                    managers.add(manager)
+
+    lockfiles = {
+        "package-lock.json": "npm",
+        "npm-shrinkwrap.json": "npm",
+        "pnpm-lock.yaml": "pnpm",
+        "yarn.lock": "yarn",
+        "bun.lock": "bun",
+        "bun.lockb": "bun",
+    }
+    for filename, manager in lockfiles.items():
+        candidate = root / filename
+        if candidate.is_file() and not candidate.is_symlink():
+            managers.add(manager)
+
+    return managers
+
+
+def _package_script_command(manager: str, script: str) -> str:
+    if manager == "npm" and script == "test":
+        return "npm test"
+    return f"{manager} run {script}"
+
+
 def _readme_text(root: Path) -> str:
     for name in README_NAMES:
         path = root / name
-        if path.is_file():
+        if path.is_file() and not path.is_symlink():
             try:
                 return path.read_text(encoding="utf-8")
             except (OSError, UnicodeDecodeError):
@@ -64,10 +102,10 @@ def _documented_commands(root: Path) -> set[str]:
         "python -m pytest",
         "pytest",
         "python -m unittest",
-        "npm test",
-        "npm run lint",
-        "npm run build",
     }
+    for manager in ("npm", "pnpm", "yarn", "bun"):
+        for script in ("test", "lint", "build"):
+            candidates.add(_package_script_command(manager, script))
     found: set[str] = set()
     for command in candidates:
         pattern = rf"(?m)(^|[\s$>]){re.escape(command)}(?=$|\s)"
@@ -78,7 +116,7 @@ def _documented_commands(root: Path) -> set[str]:
 
 def _pyproject_has_pytest(root: Path) -> bool:
     path = root / "pyproject.toml"
-    if not path.is_file():
+    if not path.is_file() or path.is_symlink():
         return False
 
     try:
@@ -136,19 +174,56 @@ def validation_plan(root: Path) -> list[ValidationCommand]:
 
     if "Node.js" in signals:
         scripts = _node_script_names(root)
-        if "test" in scripts:
-            plan.append(ValidationCommand("npm test", "package.json defines scripts.test"))
-        if "lint" in scripts:
-            plan.append(ValidationCommand("npm run lint", "package.json defines scripts.lint"))
-        if "build" in scripts and "npm run build" in documented:
-            plan.append(ValidationCommand("npm run build", "package.json defines scripts.build and README documents it"))
-        if not {"test", "lint"} & scripts:
-            plan.append(
-                ValidationCommand(
-                    "npm install --ignore-scripts --package-lock-only --dry-run",
-                    "Node.js project detected; no test or lint script confirmed",
+        managers = _node_package_managers(root)
+        manager = next(iter(managers)) if len(managers) == 1 else None
+
+        if manager:
+            if "test" in scripts:
+                plan.append(
+                    ValidationCommand(
+                        _package_script_command(manager, "test"),
+                        f"package.json defines scripts.test and repository evidence selects {manager}",
+                    )
+                )
+            if "lint" in scripts:
+                plan.append(
+                    ValidationCommand(
+                        _package_script_command(manager, "lint"),
+                        f"package.json defines scripts.lint and repository evidence selects {manager}",
+                    )
+                )
+            build_command = _package_script_command(manager, "build")
+            if "build" in scripts and build_command in documented:
+                plan.append(
+                    ValidationCommand(
+                        build_command,
+                        f"package.json defines scripts.build, repository evidence selects {manager}, and README documents it",
+                    )
+                )
+        elif len(managers) > 1:
+            # Conflicting package-manager evidence is handled by preflight.
+            # Do not manufacture a manager-specific validation command here.
+            pass
+        else:
+            # package.json alone does not prove npm. Preserve the historical
+            # npm suggestions only as review-required hints until the project
+            # supplies a lockfile, packageManager field, or documented command.
+            if "test" in scripts:
+                plan.append(
+                    ValidationCommand(
+                        "npm test",
+                        "package.json defines scripts.test, but the package manager is not confirmed",
+                        review_required=True,
+                    )
+                )
+            if "lint" in scripts:
+                plan.append(
+                    ValidationCommand(
+                        "npm run lint",
+                        "package.json defines scripts.lint, but the package manager is not confirmed",
+                        review_required=True,
+                    )
                 )
-            )
 
     plan.extend(
         [

{codex_workspace_bootstrap-0.5.2 → codex_workspace_bootstrap-0.6.0}/src/codex_workspace_bootstrap/cli.py

@@ -270,6 +270,9 @@ def _run_init_agents(path: str, force: bool) -> int:
         return 2
 
     target = root / "AGENTS.md"
+    if target.is_symlink():
+        print(f"error: refusing to write through symlink: {target}", file=sys.stderr)
+        return 1
     if target.exists() and not force:
         print(f"error: {target} already exists; use --force to overwrite", file=sys.stderr)
         return 1

{codex_workspace_bootstrap-0.5.2 → codex_workspace_bootstrap-0.6.0}/src/codex_workspace_bootstrap/fixes.py

@@ -64,7 +64,7 @@ def apply_fix_plan(root: Path, plan: list[FixPlanItem]) -> list[str]:
             continue
         if item.kind == "create-agents":
             target = root / "AGENTS.md"
-            if target.exists():
+            if target.exists() or target.is_symlink():
                 continue
             target.write_text(generate_agents(root), encoding="utf-8")
             applied.append(str(target))