codex-workspace-bootstrap 0.5.2__tar.gz → 0.6.1__tar.gz

{codex_workspace_bootstrap-0.5.2/src/codex_workspace_bootstrap.egg-info → codex_workspace_bootstrap-0.6.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codex-workspace-bootstrap
-Version: 0.5.2
+Version: 0.6.1
 Summary: Preflight AI coding repositories before Codex, Copilot, Cline, Claude, Gemini, Continue, or Cursor touches them.
 Author: kohli217
 License: MIT
@@ -124,7 +124,7 @@ The goal is not a vanity score. The result is one of:
 - license
 - `.gitignore`
 - common project manifests
-- local Git / Python / Node.js / npm / PowerShell / WSL / Codex signals
+- local Git / Python / Node.js / repository-selected package manager / PowerShell / WSL / Codex signals
 
 ### AI instruction coverage
 
@@ -142,7 +142,7 @@ It does not claim these files are correct merely because they exist. It tells yo
 
 ### Cross-agent instruction integrity
 
-When multiple AI instruction files exist, `cwb` reads executable-looking commands and checks them against repository evidence. It understands nested `AGENTS.md` / `AGENTS.override.md`, nested Cursor `.cursor/rules`, and common path-specific frontmatter such as Copilot `applyTo` and rule `globs`. It can flag:
+When multiple AI instruction files exist, `cwb` reads executable-looking commands and checks them against repository evidence. It understands nested `AGENTS.md` / `AGENTS.override.md`, nested `CLAUDE.md`, Gemini CLI hierarchical context files (including project `context.fileName` overrides), nested Cursor `.cursor/rules`, and common path-specific frontmatter such as Copilot `applyTo` and rule `globs`. It can flag:
 
 - package-manager mismatches against `packageManager` and lockfiles;
 - cross-agent package-manager drift;
@@ -248,18 +248,18 @@ cwb doctor .
 cwb init-agents .
 ```
 
-Generation is evidence-based: the tool cross-checks project manifests, package scripts, pytest configuration, and README commands. Plausible but unconfirmed commands are separated for maintainer review. Existing `AGENTS.md` files are never overwritten unless `--force` is explicit.
+Generation is evidence-based: the tool cross-checks project manifests, package-manager evidence, package scripts, pytest configuration, and README commands. Plausible but unconfirmed commands are separated for maintainer review. Existing `AGENTS.md` files are never overwritten unless `--force` is explicit.
 
 ## GitHub Action
 
 The reusable Action is published on GitHub Marketplace.
 
 ```yaml
-- uses: actions/checkout@v7
-- uses: actions/setup-python@v7
+- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
   with:
     python-version: "3.13"
-- uses: kohli217/codex-workspace-bootstrap@v0.5.2
+- uses: kohli217/codex-workspace-bootstrap@v0.6.1
   with:
     path: .
     strict: "true"
@@ -291,7 +291,9 @@ The intent is to complement those tools, not replace them.
 - Suspected secret files are not opened or printed by the filename-risk check.
 - Repository contents are not sent to a remote AI service by the core audit.
 - Instruction files are read locally for deterministic linting; extracted commands are never executed by the integrity lint.
-- Existing `AGENTS.md` files are protected unless overwrite is explicit.
+- Repository instruction/configuration and project-marker inputs are not trusted through symbolic links.
+- `init-agents` and automatic fixes refuse symlinked `AGENTS.md` targets rather than writing through them.
+- Existing regular `AGENTS.md` files are protected unless overwrite is explicit.
 - A passing preflight is evidence about the checks performed, **not a security guarantee**.
 
 See [SECURITY.md](SECURITY.md).
@@ -323,7 +325,7 @@ py -m pip install codex-workspace-bootstrap
 Pinned GitHub release artifact:
 
 ```powershell
-py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.5.2/codex_workspace_bootstrap-0.5.2-py3-none-any.whl"
+py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.6.1/codex_workspace_bootstrap-0.6.1-py3-none-any.whl"
 ```
 
 ## Development

{codex_workspace_bootstrap-0.5.2 → codex_workspace_bootstrap-0.6.1}/README.md

@@ -96,7 +96,7 @@ The goal is not a vanity score. The result is one of:
 - license
 - `.gitignore`
 - common project manifests
-- local Git / Python / Node.js / npm / PowerShell / WSL / Codex signals
+- local Git / Python / Node.js / repository-selected package manager / PowerShell / WSL / Codex signals
 
 ### AI instruction coverage
 
@@ -114,7 +114,7 @@ It does not claim these files are correct merely because they exist. It tells yo
 
 ### Cross-agent instruction integrity
 
-When multiple AI instruction files exist, `cwb` reads executable-looking commands and checks them against repository evidence. It understands nested `AGENTS.md` / `AGENTS.override.md`, nested Cursor `.cursor/rules`, and common path-specific frontmatter such as Copilot `applyTo` and rule `globs`. It can flag:
+When multiple AI instruction files exist, `cwb` reads executable-looking commands and checks them against repository evidence. It understands nested `AGENTS.md` / `AGENTS.override.md`, nested `CLAUDE.md`, Gemini CLI hierarchical context files (including project `context.fileName` overrides), nested Cursor `.cursor/rules`, and common path-specific frontmatter such as Copilot `applyTo` and rule `globs`. It can flag:
 
 - package-manager mismatches against `packageManager` and lockfiles;
 - cross-agent package-manager drift;
@@ -220,18 +220,18 @@ cwb doctor .
 cwb init-agents .
 ```
 
-Generation is evidence-based: the tool cross-checks project manifests, package scripts, pytest configuration, and README commands. Plausible but unconfirmed commands are separated for maintainer review. Existing `AGENTS.md` files are never overwritten unless `--force` is explicit.
+Generation is evidence-based: the tool cross-checks project manifests, package-manager evidence, package scripts, pytest configuration, and README commands. Plausible but unconfirmed commands are separated for maintainer review. Existing `AGENTS.md` files are never overwritten unless `--force` is explicit.
 
 ## GitHub Action
 
 The reusable Action is published on GitHub Marketplace.
 
 ```yaml
-- uses: actions/checkout@v7
-- uses: actions/setup-python@v7
+- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
   with:
     python-version: "3.13"
-- uses: kohli217/codex-workspace-bootstrap@v0.5.2
+- uses: kohli217/codex-workspace-bootstrap@v0.6.1
   with:
     path: .
     strict: "true"
@@ -263,7 +263,9 @@ The intent is to complement those tools, not replace them.
 - Suspected secret files are not opened or printed by the filename-risk check.
 - Repository contents are not sent to a remote AI service by the core audit.
 - Instruction files are read locally for deterministic linting; extracted commands are never executed by the integrity lint.
-- Existing `AGENTS.md` files are protected unless overwrite is explicit.
+- Repository instruction/configuration and project-marker inputs are not trusted through symbolic links.
+- `init-agents` and automatic fixes refuse symlinked `AGENTS.md` targets rather than writing through them.
+- Existing regular `AGENTS.md` files are protected unless overwrite is explicit.
 - A passing preflight is evidence about the checks performed, **not a security guarantee**.
 
 See [SECURITY.md](SECURITY.md).
@@ -295,7 +297,7 @@ py -m pip install codex-workspace-bootstrap
 Pinned GitHub release artifact:
 
 ```powershell
-py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.5.2/codex_workspace_bootstrap-0.5.2-py3-none-any.whl"
+py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.6.1/codex_workspace_bootstrap-0.6.1-py3-none-any.whl"
 ```
 
 ## Development

{codex_workspace_bootstrap-0.5.2 → codex_workspace_bootstrap-0.6.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "codex-workspace-bootstrap"
-version = "0.5.2"
+version = "0.6.1"
 description = "Preflight AI coding repositories before Codex, Copilot, Cline, Claude, Gemini, Continue, or Cursor touches them."
 readme = "README.md"
 requires-python = ">=3.10"

{codex_workspace_bootstrap-0.5.2 → codex_workspace_bootstrap-0.6.1}/src/codex_workspace_bootstrap/__init__.py

@@ -1,3 +1,3 @@
 """codex-workspace-bootstrap package."""
 
-__version__ = "0.5.2"
+__version__ = "0.6.1"

{codex_workspace_bootstrap-0.5.2 → codex_workspace_bootstrap-0.6.1}/src/codex_workspace_bootstrap/agents.py

@@ -18,18 +18,22 @@ class ValidationCommand:
     review_required: bool = False
 
 
+def _regular_file(path: Path) -> bool:
+    return path.is_file() and not path.is_symlink()
+
+
 def detect_project_signals(root: Path) -> list[str]:
     signals: list[str] = []
-    if any((root / marker).exists() for marker in PYTHON_MARKERS):
+    if any(_regular_file(root / marker) for marker in PYTHON_MARKERS):
         signals.append("Python")
-    if (root / NODE_MARKER).exists():
+    if _regular_file(root / NODE_MARKER):
         signals.append("Node.js")
     return signals
 
 
 def _node_script_names(root: Path) -> set[str]:
     package_json = root / NODE_MARKER
-    if not package_json.exists():
+    if not package_json.is_file() or package_json.is_symlink():
         return set()
 
     try:
@@ -44,10 +48,48 @@ def _node_script_names(root: Path) -> set[str]:
     return {name for name, value in scripts.items() if isinstance(name, str) and isinstance(value, str)}
 
 
+def detect_node_package_managers(root: Path) -> set[str]:
+    managers: set[str] = set()
+    package_json = root / NODE_MARKER
+
+    if package_json.is_file() and not package_json.is_symlink():
+        try:
+            data = json.loads(package_json.read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError, UnicodeDecodeError):
+            data = {}
+        if isinstance(data, dict):
+            declared = data.get("packageManager")
+            if isinstance(declared, str) and declared:
+                manager = declared.split("@", 1)[0].strip().lower()
+                if manager in {"npm", "pnpm", "yarn", "bun"}:
+                    managers.add(manager)
+
+    lockfiles = {
+        "package-lock.json": "npm",
+        "npm-shrinkwrap.json": "npm",
+        "pnpm-lock.yaml": "pnpm",
+        "yarn.lock": "yarn",
+        "bun.lock": "bun",
+        "bun.lockb": "bun",
+    }
+    for filename, manager in lockfiles.items():
+        candidate = root / filename
+        if candidate.is_file() and not candidate.is_symlink():
+            managers.add(manager)
+
+    return managers
+
+
+def _package_script_command(manager: str, script: str) -> str:
+    if manager == "npm" and script == "test":
+        return "npm test"
+    return f"{manager} run {script}"
+
+
 def _readme_text(root: Path) -> str:
     for name in README_NAMES:
         path = root / name
-        if path.is_file():
+        if path.is_file() and not path.is_symlink():
             try:
                 return path.read_text(encoding="utf-8")
             except (OSError, UnicodeDecodeError):
@@ -64,10 +106,10 @@ def _documented_commands(root: Path) -> set[str]:
         "python -m pytest",
         "pytest",
         "python -m unittest",
-        "npm test",
-        "npm run lint",
-        "npm run build",
     }
+    for manager in ("npm", "pnpm", "yarn", "bun"):
+        for script in ("test", "lint", "build"):
+            candidates.add(_package_script_command(manager, script))
     found: set[str] = set()
     for command in candidates:
         pattern = rf"(?m)(^|[\s$>]){re.escape(command)}(?=$|\s)"
@@ -78,7 +120,7 @@ def _documented_commands(root: Path) -> set[str]:
 
 def _pyproject_has_pytest(root: Path) -> bool:
     path = root / "pyproject.toml"
-    if not path.is_file():
+    if not path.is_file() or path.is_symlink():
         return False
 
     try:
@@ -116,8 +158,8 @@ def validation_plan(root: Path) -> list[ValidationCommand]:
     if "Python" in signals:
         pytest_evidence = (
             _pyproject_has_pytest(root)
-            or (root / "pytest.ini").exists()
-            or (root / "conftest.py").exists()
+            or _regular_file(root / "pytest.ini")
+            or _regular_file(root / "conftest.py")
         )
         if "python -m pytest" in documented or "pytest" in documented:
             plan.append(ValidationCommand("python -m pytest", "documented in README"))
@@ -136,19 +178,56 @@ def validation_plan(root: Path) -> list[ValidationCommand]:
 
     if "Node.js" in signals:
         scripts = _node_script_names(root)
-        if "test" in scripts:
-            plan.append(ValidationCommand("npm test", "package.json defines scripts.test"))
-        if "lint" in scripts:
-            plan.append(ValidationCommand("npm run lint", "package.json defines scripts.lint"))
-        if "build" in scripts and "npm run build" in documented:
-            plan.append(ValidationCommand("npm run build", "package.json defines scripts.build and README documents it"))
-        if not {"test", "lint"} & scripts:
-            plan.append(
-                ValidationCommand(
-                    "npm install --ignore-scripts --package-lock-only --dry-run",
-                    "Node.js project detected; no test or lint script confirmed",
+        managers = detect_node_package_managers(root)
+        manager = next(iter(managers)) if len(managers) == 1 else None
+
+        if manager:
+            if "test" in scripts:
+                plan.append(
+                    ValidationCommand(
+                        _package_script_command(manager, "test"),
+                        f"package.json defines scripts.test and repository evidence selects {manager}",
+                    )
+                )
+            if "lint" in scripts:
+                plan.append(
+                    ValidationCommand(
+                        _package_script_command(manager, "lint"),
+                        f"package.json defines scripts.lint and repository evidence selects {manager}",
+                    )
+                )
+            build_command = _package_script_command(manager, "build")
+            if "build" in scripts and build_command in documented:
+                plan.append(
+                    ValidationCommand(
+                        build_command,
+                        f"package.json defines scripts.build, repository evidence selects {manager}, and README documents it",
+                    )
+                )
+        elif len(managers) > 1:
+            # Conflicting package-manager evidence is handled by preflight.
+            # Do not manufacture a manager-specific validation command here.
+            pass
+        else:
+            # package.json alone does not prove npm. Preserve the historical
+            # npm suggestions only as review-required hints until the project
+            # supplies a lockfile, packageManager field, or documented command.
+            if "test" in scripts:
+                plan.append(
+                    ValidationCommand(
+                        "npm test",
+                        "package.json defines scripts.test, but the package manager is not confirmed",
+                        review_required=True,
+                    )
+                )
+            if "lint" in scripts:
+                plan.append(
+                    ValidationCommand(
+                        "npm run lint",
+                        "package.json defines scripts.lint, but the package manager is not confirmed",
+                        review_required=True,
+                    )
                 )
-            )
 
     plan.extend(
         [

{codex_workspace_bootstrap-0.5.2 → codex_workspace_bootstrap-0.6.1}/src/codex_workspace_bootstrap/audit.py

@@ -2,10 +2,13 @@ from __future__ import annotations
 
 from dataclasses import asdict, dataclass
 from pathlib import Path
+import os
 import shutil
 import subprocess
 from typing import Iterable
 
+from .agents import detect_node_package_managers
+
 
 @dataclass(frozen=True)
 class Check:
@@ -22,7 +25,6 @@ COMMON_TOOLS: tuple[tuple[str, tuple[str, ...]], ...] = (
     ("git", ("git", "--version")),
     ("python", ("python", "--version")),
     ("node", ("node", "--version")),
-    ("npm", ("npm", "--version")),
     ("powershell", ("powershell", "-NoProfile", "-Command", "$PSVersionTable.PSVersion.ToString()")),
     ("wsl", ("wsl", "--status")),
     ("codex", ("codex", "--version")),
@@ -49,6 +51,13 @@ RISK_FILENAMES = {
 
 RISK_SUFFIXES = (".pem", ".p12", ".pfx", ".key")
 
+NODE_PACKAGE_MANAGER_COMMANDS: dict[str, tuple[str, ...]] = {
+    "npm": ("npm", "--version"),
+    "pnpm": ("pnpm", "--version"),
+    "yarn": ("yarn", "--version"),
+    "bun": ("bun", "--version"),
+}
+
 
 def _tool_check(label: str, command: tuple[str, ...]) -> Check:
     executable = shutil.which(command[0])
@@ -73,12 +82,30 @@ def _tool_check(label: str, command: tuple[str, ...]) -> Check:
 
 
 def _iter_project_files(root: Path) -> Iterable[Path]:
-    excluded = {".git", ".venv", "venv", "node_modules", "__pycache__"}
-    for path in root.rglob("*"):
-        if any(part in excluded for part in path.parts):
-            continue
-        if path.is_file():
-            yield path
+    excluded = {
+        ".git",
+        ".venv",
+        "venv",
+        "node_modules",
+        "__pycache__",
+        ".pytest_cache",
+        ".mypy_cache",
+        ".ruff_cache",
+        ".tox",
+        ".nox",
+        "dist",
+        "build",
+    }
+
+    for current, dirnames, filenames in os.walk(root, followlinks=False):
+        current_path = Path(current)
+        dirnames[:] = [
+            name
+            for name in dirnames
+            if name not in excluded and not (current_path / name).is_symlink()
+        ]
+        for filename in filenames:
+            yield current_path / filename
 
 
 def _git_matches(root: Path, args: tuple[str, ...]) -> bool:
@@ -132,7 +159,14 @@ def audit_repository(root: Path) -> list[Check]:
         )
     )
 
-    readme = next((p for p in root.iterdir() if p.is_file() and p.name.lower().startswith("readme")), None)
+    readme = next(
+        (
+            p
+            for p in root.iterdir()
+            if p.is_file() and not p.is_symlink() and p.name.lower().startswith("readme")
+        ),
+        None,
+    )
     checks.append(
         Check(
             "readme",
@@ -141,7 +175,14 @@ def audit_repository(root: Path) -> list[Check]:
         )
     )
 
-    license_file = next((p for p in root.iterdir() if p.is_file() and p.name.lower().startswith("license")), None)
+    license_file = next(
+        (
+            p
+            for p in root.iterdir()
+            if p.is_file() and not p.is_symlink() and p.name.lower().startswith("license")
+        ),
+        None,
+    )
     checks.append(
         Check(
             "license",
@@ -153,20 +194,32 @@ def audit_repository(root: Path) -> list[Check]:
     checks.append(
         Check(
             "gitignore",
-            "pass" if (root / ".gitignore").exists() else "warn",
-            ".gitignore detected" if (root / ".gitignore").exists() else ".gitignore not found",
+            "pass"
+            if (root / ".gitignore").is_file() and not (root / ".gitignore").is_symlink()
+            else "warn",
+            ".gitignore detected"
+            if (root / ".gitignore").is_file() and not (root / ".gitignore").is_symlink()
+            else ".gitignore not found",
         )
     )
 
     checks.append(
         Check(
             "agents",
-            "pass" if (root / "AGENTS.md").exists() else "warn",
-            "AGENTS.md detected" if (root / "AGENTS.md").exists() else "AGENTS.md not found; run init-agents",
+            "pass"
+            if (root / "AGENTS.md").is_file() and not (root / "AGENTS.md").is_symlink()
+            else "warn",
+            "AGENTS.md detected"
+            if (root / "AGENTS.md").is_file() and not (root / "AGENTS.md").is_symlink()
+            else "AGENTS.md not found; run init-agents",
         )
     )
 
-    manifests = [name for name in MANIFESTS if (root / name).exists()]
+    manifests = [
+        name
+        for name in MANIFESTS
+        if (root / name).is_file() and not (root / name).is_symlink()
+    ]
     checks.append(
         Check(
             "project-manifest",
@@ -178,6 +231,30 @@ def audit_repository(root: Path) -> list[Check]:
     for label, command in COMMON_TOOLS:
         checks.append(_tool_check(label, command))
 
+    if (root / "package.json").is_file() and not (root / "package.json").is_symlink():
+        managers = detect_node_package_managers(root)
+        if managers:
+            if len(managers) > 1:
+                checks.append(
+                    Check(
+                        "package-manager-evidence",
+                        "warn",
+                        "Conflicting Node.js package-manager evidence detected: "
+                        + ", ".join(sorted(managers)),
+                    )
+                )
+            for manager in sorted(managers):
+                command = NODE_PACKAGE_MANAGER_COMMANDS[manager]
+                checks.append(_tool_check(manager, command))
+        else:
+            checks.append(
+                Check(
+                    "package-manager-evidence",
+                    "warn",
+                    "Node.js project detected, but packageManager/lockfile evidence does not confirm npm, pnpm, yarn, or bun",
+                )
+            )
+
     risky: list[str] = []
     for path in _iter_project_files(root):
         name = path.name.lower()

{codex_workspace_bootstrap-0.5.2 → codex_workspace_bootstrap-0.6.1}/src/codex_workspace_bootstrap/cli.py

@@ -270,6 +270,9 @@ def _run_init_agents(path: str, force: bool) -> int:
         return 2
 
     target = root / "AGENTS.md"
+    if target.is_symlink():
+        print(f"error: refusing to write through symlink: {target}", file=sys.stderr)
+        return 1
     if target.exists() and not force:
         print(f"error: {target} already exists; use --force to overwrite", file=sys.stderr)
         return 1

{codex_workspace_bootstrap-0.5.2 → codex_workspace_bootstrap-0.6.1}/src/codex_workspace_bootstrap/doctor.py

@@ -23,7 +23,11 @@ GUIDANCE: dict[str, str] = {
     "git": "Verify Git is installed and available on PATH.",
     "python": "Verify Python or the Windows Python launcher is installed and available on PATH.",
     "node": "Verify Node.js is installed and available on PATH when the project requires it.",
-    "npm": "Verify npm is available with the active Node.js installation.",
+    "npm": "Verify npm is installed and available on PATH for this repository.",
+    "pnpm": "Verify pnpm is installed and available on PATH for this repository.",
+    "yarn": "Verify Yarn is installed and available on PATH for this repository.",
+    "bun": "Verify Bun is installed and available on PATH for this repository.",
+    "package-manager-evidence": "Confirm the intended Node.js package manager in package.json packageManager or with the repository lockfile.",
     "powershell": "Verify Windows PowerShell or PowerShell is available on PATH.",
     "wsl": "Check WSL status only when the repository workflow requires Linux tooling.",
     "codex": "Verify the Codex CLI is installed and available on PATH when local Codex workflows are intended.",

{codex_workspace_bootstrap-0.5.2 → codex_workspace_bootstrap-0.6.1}/src/codex_workspace_bootstrap/fixes.py

@@ -64,7 +64,7 @@ def apply_fix_plan(root: Path, plan: list[FixPlanItem]) -> list[str]:
             continue
         if item.kind == "create-agents":
             target = root / "AGENTS.md"
-            if target.exists():
+            if target.exists() or target.is_symlink():
                 continue
             target.write_text(generate_agents(root), encoding="utf-8")
             applied.append(str(target))