codex-workspace-bootstrap 0.6.0__tar.gz → 0.6.1__tar.gz

{codex_workspace_bootstrap-0.6.0/src/codex_workspace_bootstrap.egg-info → codex_workspace_bootstrap-0.6.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codex-workspace-bootstrap
-Version: 0.6.0
+Version: 0.6.1
 Summary: Preflight AI coding repositories before Codex, Copilot, Cline, Claude, Gemini, Continue, or Cursor touches them.
 Author: kohli217
 License: MIT
@@ -124,7 +124,7 @@ The goal is not a vanity score. The result is one of:
 - license
 - `.gitignore`
 - common project manifests
-- local Git / Python / Node.js / npm / PowerShell / WSL / Codex signals
+- local Git / Python / Node.js / repository-selected package manager / PowerShell / WSL / Codex signals
 
 ### AI instruction coverage
 
@@ -259,7 +259,7 @@ The reusable Action is published on GitHub Marketplace.
 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
   with:
     python-version: "3.13"
-- uses: kohli217/codex-workspace-bootstrap@v0.6.0
+- uses: kohli217/codex-workspace-bootstrap@v0.6.1
   with:
     path: .
     strict: "true"
@@ -291,7 +291,7 @@ The intent is to complement those tools, not replace them.
 - Suspected secret files are not opened or printed by the filename-risk check.
 - Repository contents are not sent to a remote AI service by the core audit.
 - Instruction files are read locally for deterministic linting; extracted commands are never executed by the integrity lint.
-- Repository instruction/configuration inputs are not read through symbolic links.
+- Repository instruction/configuration and project-marker inputs are not trusted through symbolic links.
 - `init-agents` and automatic fixes refuse symlinked `AGENTS.md` targets rather than writing through them.
 - Existing regular `AGENTS.md` files are protected unless overwrite is explicit.
 - A passing preflight is evidence about the checks performed, **not a security guarantee**.
@@ -325,7 +325,7 @@ py -m pip install codex-workspace-bootstrap
 Pinned GitHub release artifact:
 
 ```powershell
-py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.6.0/codex_workspace_bootstrap-0.6.0-py3-none-any.whl"
+py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.6.1/codex_workspace_bootstrap-0.6.1-py3-none-any.whl"
 ```
 
 ## Development

{codex_workspace_bootstrap-0.6.0 → codex_workspace_bootstrap-0.6.1}/README.md

@@ -96,7 +96,7 @@ The goal is not a vanity score. The result is one of:
 - license
 - `.gitignore`
 - common project manifests
-- local Git / Python / Node.js / npm / PowerShell / WSL / Codex signals
+- local Git / Python / Node.js / repository-selected package manager / PowerShell / WSL / Codex signals
 
 ### AI instruction coverage
 
@@ -231,7 +231,7 @@ The reusable Action is published on GitHub Marketplace.
 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
   with:
     python-version: "3.13"
-- uses: kohli217/codex-workspace-bootstrap@v0.6.0
+- uses: kohli217/codex-workspace-bootstrap@v0.6.1
   with:
     path: .
     strict: "true"
@@ -263,7 +263,7 @@ The intent is to complement those tools, not replace them.
 - Suspected secret files are not opened or printed by the filename-risk check.
 - Repository contents are not sent to a remote AI service by the core audit.
 - Instruction files are read locally for deterministic linting; extracted commands are never executed by the integrity lint.
-- Repository instruction/configuration inputs are not read through symbolic links.
+- Repository instruction/configuration and project-marker inputs are not trusted through symbolic links.
 - `init-agents` and automatic fixes refuse symlinked `AGENTS.md` targets rather than writing through them.
 - Existing regular `AGENTS.md` files are protected unless overwrite is explicit.
 - A passing preflight is evidence about the checks performed, **not a security guarantee**.
@@ -297,7 +297,7 @@ py -m pip install codex-workspace-bootstrap
 Pinned GitHub release artifact:
 
 ```powershell
-py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.6.0/codex_workspace_bootstrap-0.6.0-py3-none-any.whl"
+py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.6.1/codex_workspace_bootstrap-0.6.1-py3-none-any.whl"
 ```
 
 ## Development

{codex_workspace_bootstrap-0.6.0 → codex_workspace_bootstrap-0.6.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "codex-workspace-bootstrap"
-version = "0.6.0"
+version = "0.6.1"
 description = "Preflight AI coding repositories before Codex, Copilot, Cline, Claude, Gemini, Continue, or Cursor touches them."
 readme = "README.md"
 requires-python = ">=3.10"

{codex_workspace_bootstrap-0.6.0 → codex_workspace_bootstrap-0.6.1}/src/codex_workspace_bootstrap/__init__.py

@@ -1,3 +1,3 @@
 """codex-workspace-bootstrap package."""
 
-__version__ = "0.6.0"
+__version__ = "0.6.1"

{codex_workspace_bootstrap-0.6.0 → codex_workspace_bootstrap-0.6.1}/src/codex_workspace_bootstrap/agents.py

@@ -18,11 +18,15 @@ class ValidationCommand:
     review_required: bool = False
 
 
+def _regular_file(path: Path) -> bool:
+    return path.is_file() and not path.is_symlink()
+
+
 def detect_project_signals(root: Path) -> list[str]:
     signals: list[str] = []
-    if any((root / marker).exists() for marker in PYTHON_MARKERS):
+    if any(_regular_file(root / marker) for marker in PYTHON_MARKERS):
         signals.append("Python")
-    if (root / NODE_MARKER).exists():
+    if _regular_file(root / NODE_MARKER):
         signals.append("Node.js")
     return signals
 
@@ -44,7 +48,7 @@ def _node_script_names(root: Path) -> set[str]:
     return {name for name, value in scripts.items() if isinstance(name, str) and isinstance(value, str)}
 
 
-def _node_package_managers(root: Path) -> set[str]:
+def detect_node_package_managers(root: Path) -> set[str]:
     managers: set[str] = set()
     package_json = root / NODE_MARKER
 
@@ -154,8 +158,8 @@ def validation_plan(root: Path) -> list[ValidationCommand]:
     if "Python" in signals:
         pytest_evidence = (
             _pyproject_has_pytest(root)
-            or (root / "pytest.ini").exists()
-            or (root / "conftest.py").exists()
+            or _regular_file(root / "pytest.ini")
+            or _regular_file(root / "conftest.py")
         )
         if "python -m pytest" in documented or "pytest" in documented:
             plan.append(ValidationCommand("python -m pytest", "documented in README"))
@@ -174,7 +178,7 @@ def validation_plan(root: Path) -> list[ValidationCommand]:
 
     if "Node.js" in signals:
         scripts = _node_script_names(root)
-        managers = _node_package_managers(root)
+        managers = detect_node_package_managers(root)
         manager = next(iter(managers)) if len(managers) == 1 else None
 
         if manager:

{codex_workspace_bootstrap-0.6.0 → codex_workspace_bootstrap-0.6.1}/src/codex_workspace_bootstrap/audit.py

@@ -2,10 +2,13 @@ from __future__ import annotations
 
 from dataclasses import asdict, dataclass
 from pathlib import Path
+import os
 import shutil
 import subprocess
 from typing import Iterable
 
+from .agents import detect_node_package_managers
+
 
 @dataclass(frozen=True)
 class Check:
@@ -22,7 +25,6 @@ COMMON_TOOLS: tuple[tuple[str, tuple[str, ...]], ...] = (
     ("git", ("git", "--version")),
     ("python", ("python", "--version")),
     ("node", ("node", "--version")),
-    ("npm", ("npm", "--version")),
     ("powershell", ("powershell", "-NoProfile", "-Command", "$PSVersionTable.PSVersion.ToString()")),
     ("wsl", ("wsl", "--status")),
     ("codex", ("codex", "--version")),
@@ -49,6 +51,13 @@ RISK_FILENAMES = {
 
 RISK_SUFFIXES = (".pem", ".p12", ".pfx", ".key")
 
+NODE_PACKAGE_MANAGER_COMMANDS: dict[str, tuple[str, ...]] = {
+    "npm": ("npm", "--version"),
+    "pnpm": ("pnpm", "--version"),
+    "yarn": ("yarn", "--version"),
+    "bun": ("bun", "--version"),
+}
+
 
 def _tool_check(label: str, command: tuple[str, ...]) -> Check:
     executable = shutil.which(command[0])
@@ -73,12 +82,30 @@ def _tool_check(label: str, command: tuple[str, ...]) -> Check:
 
 
 def _iter_project_files(root: Path) -> Iterable[Path]:
-    excluded = {".git", ".venv", "venv", "node_modules", "__pycache__"}
-    for path in root.rglob("*"):
-        if any(part in excluded for part in path.parts):
-            continue
-        if path.is_file():
-            yield path
+    excluded = {
+        ".git",
+        ".venv",
+        "venv",
+        "node_modules",
+        "__pycache__",
+        ".pytest_cache",
+        ".mypy_cache",
+        ".ruff_cache",
+        ".tox",
+        ".nox",
+        "dist",
+        "build",
+    }
+
+    for current, dirnames, filenames in os.walk(root, followlinks=False):
+        current_path = Path(current)
+        dirnames[:] = [
+            name
+            for name in dirnames
+            if name not in excluded and not (current_path / name).is_symlink()
+        ]
+        for filename in filenames:
+            yield current_path / filename
 
 
 def _git_matches(root: Path, args: tuple[str, ...]) -> bool:
@@ -132,7 +159,14 @@ def audit_repository(root: Path) -> list[Check]:
         )
     )
 
-    readme = next((p for p in root.iterdir() if p.is_file() and p.name.lower().startswith("readme")), None)
+    readme = next(
+        (
+            p
+            for p in root.iterdir()
+            if p.is_file() and not p.is_symlink() and p.name.lower().startswith("readme")
+        ),
+        None,
+    )
     checks.append(
         Check(
             "readme",
@@ -141,7 +175,14 @@ def audit_repository(root: Path) -> list[Check]:
         )
     )
 
-    license_file = next((p for p in root.iterdir() if p.is_file() and p.name.lower().startswith("license")), None)
+    license_file = next(
+        (
+            p
+            for p in root.iterdir()
+            if p.is_file() and not p.is_symlink() and p.name.lower().startswith("license")
+        ),
+        None,
+    )
     checks.append(
         Check(
             "license",
@@ -153,20 +194,32 @@ def audit_repository(root: Path) -> list[Check]:
     checks.append(
         Check(
             "gitignore",
-            "pass" if (root / ".gitignore").exists() else "warn",
-            ".gitignore detected" if (root / ".gitignore").exists() else ".gitignore not found",
+            "pass"
+            if (root / ".gitignore").is_file() and not (root / ".gitignore").is_symlink()
+            else "warn",
+            ".gitignore detected"
+            if (root / ".gitignore").is_file() and not (root / ".gitignore").is_symlink()
+            else ".gitignore not found",
         )
     )
 
     checks.append(
         Check(
             "agents",
-            "pass" if (root / "AGENTS.md").exists() else "warn",
-            "AGENTS.md detected" if (root / "AGENTS.md").exists() else "AGENTS.md not found; run init-agents",
+            "pass"
+            if (root / "AGENTS.md").is_file() and not (root / "AGENTS.md").is_symlink()
+            else "warn",
+            "AGENTS.md detected"
+            if (root / "AGENTS.md").is_file() and not (root / "AGENTS.md").is_symlink()
+            else "AGENTS.md not found; run init-agents",
         )
     )
 
-    manifests = [name for name in MANIFESTS if (root / name).exists()]
+    manifests = [
+        name
+        for name in MANIFESTS
+        if (root / name).is_file() and not (root / name).is_symlink()
+    ]
     checks.append(
         Check(
             "project-manifest",
@@ -178,6 +231,30 @@ def audit_repository(root: Path) -> list[Check]:
     for label, command in COMMON_TOOLS:
         checks.append(_tool_check(label, command))
 
+    if (root / "package.json").is_file() and not (root / "package.json").is_symlink():
+        managers = detect_node_package_managers(root)
+        if managers:
+            if len(managers) > 1:
+                checks.append(
+                    Check(
+                        "package-manager-evidence",
+                        "warn",
+                        "Conflicting Node.js package-manager evidence detected: "
+                        + ", ".join(sorted(managers)),
+                    )
+                )
+            for manager in sorted(managers):
+                command = NODE_PACKAGE_MANAGER_COMMANDS[manager]
+                checks.append(_tool_check(manager, command))
+        else:
+            checks.append(
+                Check(
+                    "package-manager-evidence",
+                    "warn",
+                    "Node.js project detected, but packageManager/lockfile evidence does not confirm npm, pnpm, yarn, or bun",
+                )
+            )
+
     risky: list[str] = []
     for path in _iter_project_files(root):
         name = path.name.lower()

{codex_workspace_bootstrap-0.6.0 → codex_workspace_bootstrap-0.6.1}/src/codex_workspace_bootstrap/doctor.py

@@ -23,7 +23,11 @@ GUIDANCE: dict[str, str] = {
     "git": "Verify Git is installed and available on PATH.",
     "python": "Verify Python or the Windows Python launcher is installed and available on PATH.",
     "node": "Verify Node.js is installed and available on PATH when the project requires it.",
-    "npm": "Verify npm is available with the active Node.js installation.",
+    "npm": "Verify npm is installed and available on PATH for this repository.",
+    "pnpm": "Verify pnpm is installed and available on PATH for this repository.",
+    "yarn": "Verify Yarn is installed and available on PATH for this repository.",
+    "bun": "Verify Bun is installed and available on PATH for this repository.",
+    "package-manager-evidence": "Confirm the intended Node.js package manager in package.json packageManager or with the repository lockfile.",
     "powershell": "Verify Windows PowerShell or PowerShell is available on PATH.",
     "wsl": "Check WSL status only when the repository workflow requires Linux tooling.",
     "codex": "Verify the Codex CLI is installed and available on PATH when local Codex workflows are intended.",

{codex_workspace_bootstrap-0.6.0 → codex_workspace_bootstrap-0.6.1}/src/codex_workspace_bootstrap/instructions.py

@@ -6,6 +6,7 @@ import os
 from pathlib import Path
 import posixpath
 import re
+import shlex
 
 
 @dataclass(frozen=True)
@@ -93,11 +94,6 @@ _COMMAND_PATTERNS: tuple[re.Pattern[str], ...] = (
 _CODE_FENCE = re.compile(r"```(?:[A-Za-z0-9_+.-]+)?\s*\n(.*?)```", re.S)
 _INLINE_CODE = re.compile(r"`([^`\n]+)`")
 _PACKAGE_COMMAND = re.compile(r"^(npm|pnpm|yarn|bun)\b", re.I)
-_SCRIPT_COMMAND = re.compile(
-    r"^(npm|pnpm|bun)\s+(?:run\s+)?([\w:.-]+)|^yarn\s+(?:run\s+)?([\w:.-]+)",
-    re.I,
-)
-
 
 def _safe_read(path: Path) -> str:
     try:
@@ -608,29 +604,72 @@ def _manager_for_command(command: str) -> str | None:
     return match.group(1).lower() if match else None
 
 
-def _script_for_command(command: str) -> tuple[str, str] | None:
-    match = _SCRIPT_COMMAND.match(command.strip())
-    if not match:
+_PACKAGE_OPTIONS_WITH_VALUE = {
+    "--filter",
+    "-F",
+    "--workspace",
+    "-w",
+    "--prefix",
+    "--dir",
+    "-C",
+    "--cwd",
+}
+
+
+def _package_command_tokens(command: str) -> list[str]:
+    try:
+        return shlex.split(command, posix=True)
+    except ValueError:
+        return command.split()
+
+
+def _script_for_command(command: str) -> tuple[str, str, bool] | None:
+    tokens = _package_command_tokens(command.strip())
+    if not tokens:
         return None
-    manager = (match.group(1) or "yarn").lower()
-    script = match.group(2) or match.group(3)
-    if not script or script in {"install", "ci", "exec", "dlx"}:
+
+    manager = tokens[0].lower()
+    if manager not in {"npm", "pnpm", "yarn", "bun"}:
         return None
 
-    # Be conservative with workspace/filter/prefix style commands. The first
-    # token after the package manager may be an option rather than a script,
-    # for example:
-    #   pnpm --filter web test
-    #   npm --workspace app run test
-    #   pnpm -C apps/web test
-    #
-    # Treating that option as a script creates false missing-script findings.
-    # Until full option parsing is implemented, skip script validation for
-    # commands whose apparent script begins with a dash.
-    if script.startswith("-"):
+    index = 1
+    while index < len(tokens):
+        token = tokens[index]
+        if token in _PACKAGE_OPTIONS_WITH_VALUE:
+            index += 2
+            continue
+        if any(token.startswith(f"{option}=") for option in _PACKAGE_OPTIONS_WITH_VALUE if option.startswith("--")):
+            index += 1
+            continue
+        if token.startswith("-"):
+            index += 1
+            continue
+        break
+
+    if index >= len(tokens):
+        return None
+
+    if manager == "yarn" and tokens[index] == "workspace":
+        index += 2
+        if index >= len(tokens):
+            return None
+
+    explicit_run = tokens[index] in {"run", "run-script"}
+    if explicit_run:
+        index += 1
+        while index < len(tokens) and tokens[index].startswith("-"):
+            if tokens[index] in _PACKAGE_OPTIONS_WITH_VALUE:
+                index += 2
+            else:
+                index += 1
+        if index >= len(tokens):
+            return None
+
+    script = tokens[index]
+    if script in {"install", "ci", "exec", "dlx", "workspace"}:
         return None
 
-    return manager, script
+    return manager, script, explicit_run
 
 
 def _validation_key(command: str) -> str | None:
@@ -660,7 +699,7 @@ def _validation_key(command: str) -> str | None:
     parsed = _script_for_command(lowered)
     if not parsed:
         return None
-    manager, script = parsed
+    manager, script, _explicit_run = parsed
     family = script.split(":", 1)[0]
     if family in {"test", "lint", "check", "build", "typecheck", "validate", "verify"}:
         return f"{family}:{manager}:{script}"
@@ -766,11 +805,8 @@ def lint_instructions(
                 parsed = _script_for_command(command)
                 if not parsed:
                     continue
-                _manager, script = parsed
-                if script not in scripts and (
-                    script == "test"
-                    or command.lower().startswith(("npm run ", "pnpm run ", "bun run ", "yarn run "))
-                ):
+                _manager, script, explicit_run = parsed
+                if script not in scripts and (script == "test" or explicit_run):
                     findings.append(
                         InstructionFinding(
                             "missing-package-script",

{codex_workspace_bootstrap-0.6.0 → codex_workspace_bootstrap-0.6.1}/src/codex_workspace_bootstrap/preflight.py

@@ -130,17 +130,39 @@ def next_actions(
         )
 
     if "Node.js" in project_signals:
-        npm = _check_by_name(checks, "npm")
-        if npm is not None and npm.status != "pass":
+        manager_checks = [
+            check
+            for check in checks
+            if check.name in {"npm", "pnpm", "yarn", "bun"}
+        ]
+        evidence = _check_by_name(checks, "package-manager-evidence")
+        if evidence is not None and evidence.status != "pass":
+            priority = "P1" if len(manager_checks) > 1 else "P2"
+            title = (
+                "Resolve conflicting repository package-manager evidence"
+                if len(manager_checks) > 1
+                else "Confirm the repository package manager"
+            )
             actions.append(
                 NextAction(
-                    "P1",
-                    "Restore the Node.js/npm toolchain required by this repository",
-                    command="npm --version",
-                    reason=npm.message,
+                    priority,
+                    title,
+                    reason=evidence.message,
                 )
             )
 
+        if len(manager_checks) == 1:
+            manager = manager_checks[0]
+            if manager.status != "pass":
+                actions.append(
+                    NextAction(
+                        "P1",
+                        f"Restore the Node.js/{manager.name} toolchain required by this repository",
+                        command=f"{manager.name} --version",
+                        reason=manager.message,
+                    )
+                )
+
     return actions
 
 

{codex_workspace_bootstrap-0.6.0 → codex_workspace_bootstrap-0.6.1}/src/codex_workspace_bootstrap/sarif.py

@@ -17,6 +17,10 @@ RULE_HELP: dict[str, str] = {
     "python": "Install Python or make it available on PATH when the repository requires Python.",
     "node": "Install Node.js or make it available on PATH when the repository requires Node.js.",
     "npm": "Install npm or make it available on PATH when the repository requires npm.",
+    "pnpm": "Install pnpm or make it available on PATH when the repository requires pnpm.",
+    "yarn": "Install Yarn or make it available on PATH when the repository requires Yarn.",
+    "bun": "Install Bun or make it available on PATH when the repository requires Bun.",
+    "package-manager-evidence": "Align packageManager and lockfile evidence so the repository identifies one intended Node.js package manager.",
     "powershell": "Install or expose PowerShell when Windows PowerShell workflows are required.",
     "wsl": "Install or configure WSL only when the repository workflow requires it.",
     "codex": "Install or expose the Codex CLI when local Codex command checks are required.",

{codex_workspace_bootstrap-0.6.0 → codex_workspace_bootstrap-0.6.1/src/codex_workspace_bootstrap.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codex-workspace-bootstrap
-Version: 0.6.0
+Version: 0.6.1
 Summary: Preflight AI coding repositories before Codex, Copilot, Cline, Claude, Gemini, Continue, or Cursor touches them.
 Author: kohli217
 License: MIT
@@ -124,7 +124,7 @@ The goal is not a vanity score. The result is one of:
 - license
 - `.gitignore`
 - common project manifests
-- local Git / Python / Node.js / npm / PowerShell / WSL / Codex signals
+- local Git / Python / Node.js / repository-selected package manager / PowerShell / WSL / Codex signals
 
 ### AI instruction coverage
 
@@ -259,7 +259,7 @@ The reusable Action is published on GitHub Marketplace.
 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
   with:
     python-version: "3.13"
-- uses: kohli217/codex-workspace-bootstrap@v0.6.0
+- uses: kohli217/codex-workspace-bootstrap@v0.6.1
   with:
     path: .
     strict: "true"
@@ -291,7 +291,7 @@ The intent is to complement those tools, not replace them.
 - Suspected secret files are not opened or printed by the filename-risk check.
 - Repository contents are not sent to a remote AI service by the core audit.
 - Instruction files are read locally for deterministic linting; extracted commands are never executed by the integrity lint.
-- Repository instruction/configuration inputs are not read through symbolic links.
+- Repository instruction/configuration and project-marker inputs are not trusted through symbolic links.
 - `init-agents` and automatic fixes refuse symlinked `AGENTS.md` targets rather than writing through them.
 - Existing regular `AGENTS.md` files are protected unless overwrite is explicit.
 - A passing preflight is evidence about the checks performed, **not a security guarantee**.
@@ -325,7 +325,7 @@ py -m pip install codex-workspace-bootstrap
 Pinned GitHub release artifact:
 
 ```powershell
-py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.6.0/codex_workspace_bootstrap-0.6.0-py3-none-any.whl"
+py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.6.1/codex_workspace_bootstrap-0.6.1-py3-none-any.whl"
 ```
 
 ## Development

codex_workspace_bootstrap-0.6.1/tests/test_audit.py

@@ -0,0 +1,208 @@
+from pathlib import Path
+import shutil
+import subprocess
+
+import pytest
+
+from codex_workspace_bootstrap.audit import audit_repository, summary
+
+
+def _git(root: Path, *args: str) -> None:
+    subprocess.run(
+        ("git", "-C", str(root), *args),
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+
+
+def test_audit_detects_basic_repository_files(tmp_path: Path) -> None:
+    (tmp_path / ".git").mkdir()
+    (tmp_path / "README.md").write_text("# demo\n", encoding="utf-8")
+    (tmp_path / "LICENSE").write_text("MIT\n", encoding="utf-8")
+    (tmp_path / ".gitignore").write_text(".env\n", encoding="utf-8")
+    (tmp_path / "AGENTS.md").write_text("# agents\n", encoding="utf-8")
+    (tmp_path / "pyproject.toml").write_text("[project]\nname='demo'\n", encoding="utf-8")
+
+    checks = audit_repository(tmp_path)
+    by_name = {c.name: c for c in checks}
+
+    assert by_name["git-repository"].status == "pass"
+    assert by_name["readme"].status == "pass"
+    assert by_name["license"].status == "pass"
+    assert by_name["gitignore"].status == "pass"
+    assert by_name["agents"].status == "pass"
+    assert by_name["project-manifest"].status == "pass"
+
+
+def test_audit_warns_on_secret_risk_filename(tmp_path: Path) -> None:
+    (tmp_path / ".env").write_text("EXAMPLE=not-a-secret\n", encoding="utf-8")
+    checks = audit_repository(tmp_path)
+    by_name = {c.name: c for c in checks}
+    assert by_name["secret-risk-files"].status == "warn"
+    assert by_name["secret-risk-files"].blocking is False
+
+
+@pytest.mark.skipif(shutil.which("git") is None, reason="git is required")
+def test_tracked_secret_risk_file_is_blocking(tmp_path: Path) -> None:
+    _git(tmp_path, "init")
+    (tmp_path / ".env").write_text("EXAMPLE=not-a-secret\n", encoding="utf-8")
+    _git(tmp_path, "add", "-f", ".env")
+
+    checks = audit_repository(tmp_path)
+    by_name = {c.name: c for c in checks}
+
+    assert by_name["secret-risk-files"].status == "warn"
+    assert by_name["secret-risk-files"].blocking is True
+    assert "tracked:" in by_name["secret-risk-files"].message
+
+
+@pytest.mark.skipif(shutil.which("git") is None, reason="git is required")
+def test_ignored_secret_risk_file_is_not_blocking(tmp_path: Path) -> None:
+    _git(tmp_path, "init")
+    (tmp_path / ".gitignore").write_text(".env\n", encoding="utf-8")
+    (tmp_path / ".env").write_text("EXAMPLE=not-a-secret\n", encoding="utf-8")
+
+    checks = audit_repository(tmp_path)
+    by_name = {c.name: c for c in checks}
+
+    assert by_name["secret-risk-files"].status == "warn"
+    assert by_name["secret-risk-files"].blocking is False
+    assert "ignored:" in by_name["secret-risk-files"].message
+
+
+def test_summary_counts_statuses(tmp_path: Path) -> None:
+    checks = audit_repository(tmp_path)
+    totals = summary(checks)
+    assert totals["passed"] + totals["warnings"] == len(checks)
+    assert totals["blocking"] == 0
+
+
+def test_audit_checks_detected_pnpm_instead_of_assuming_npm(
+    tmp_path: Path,
+    monkeypatch,
+) -> None:
+    (tmp_path / "package.json").write_text(
+        '{"packageManager":"pnpm@10","scripts":{"test":"vitest"}}',
+        encoding="utf-8",
+    )
+    (tmp_path / "pnpm-lock.yaml").write_text("lockfileVersion: '9.0'\n", encoding="utf-8")
+
+    def fake_tool_check(label: str, command: tuple[str, ...]):
+        from codex_workspace_bootstrap.audit import Check
+        return Check(label, "pass", "available")
+
+    monkeypatch.setattr("codex_workspace_bootstrap.audit._tool_check", fake_tool_check)
+
+    checks = audit_repository(tmp_path)
+    names = {check.name for check in checks}
+
+    assert "pnpm" in names
+    assert "npm" not in names
+    assert "package-manager-evidence" not in names
+
+
+def test_audit_reports_unconfirmed_node_package_manager(
+    tmp_path: Path,
+    monkeypatch,
+) -> None:
+    (tmp_path / "package.json").write_text(
+        '{"scripts":{"test":"vitest"}}',
+        encoding="utf-8",
+    )
+
+    def fake_tool_check(label: str, command: tuple[str, ...]):
+        from codex_workspace_bootstrap.audit import Check
+        return Check(label, "pass", "available")
+
+    monkeypatch.setattr("codex_workspace_bootstrap.audit._tool_check", fake_tool_check)
+
+    checks = audit_repository(tmp_path)
+    by_name = {check.name: check for check in checks}
+
+    assert by_name["package-manager-evidence"].status == "warn"
+    assert "does not confirm" in by_name["package-manager-evidence"].message
+
+
+def test_secret_risk_scan_works_when_repository_parent_is_named_build(tmp_path: Path) -> None:
+    root = tmp_path / "build" / "repo"
+    root.mkdir(parents=True)
+    (root / ".env").write_text("EXAMPLE=not-a-secret\n", encoding="utf-8")
+
+    checks = audit_repository(root)
+    by_name = {check.name: check for check in checks}
+
+    assert by_name["secret-risk-files"].status == "warn"
+    assert ".env" in by_name["secret-risk-files"].message
+
+
+def test_secret_risk_scan_prunes_generated_directories(tmp_path: Path) -> None:
+    ignored = tmp_path / "node_modules" / "pkg"
+    ignored.mkdir(parents=True)
+    (ignored / ".env").write_text("EXAMPLE=dependency-file\n", encoding="utf-8")
+
+    cache = tmp_path / ".pytest_cache"
+    cache.mkdir()
+    (cache / "credentials.json").write_text("{}", encoding="utf-8")
+
+    checks = audit_repository(tmp_path)
+    by_name = {check.name: check for check in checks}
+
+    assert by_name["secret-risk-files"].status == "pass"
+
+
+def test_audit_reports_conflicting_node_package_manager_evidence(
+    tmp_path: Path,
+    monkeypatch,
+) -> None:
+    (tmp_path / "package.json").write_text(
+        '{"packageManager":"pnpm@10","scripts":{"test":"vitest"}}',
+        encoding="utf-8",
+    )
+    (tmp_path / "package-lock.json").write_text("{}", encoding="utf-8")
+
+    def fake_tool_check(label: str, command: tuple[str, ...]):
+        from codex_workspace_bootstrap.audit import Check
+        return Check(label, "pass", "available")
+
+    monkeypatch.setattr("codex_workspace_bootstrap.audit._tool_check", fake_tool_check)
+
+    checks = audit_repository(tmp_path)
+    by_name = {check.name: check for check in checks}
+
+    assert by_name["package-manager-evidence"].status == "warn"
+    assert "Conflicting" in by_name["package-manager-evidence"].message
+    assert "npm" in by_name["package-manager-evidence"].message
+    assert "pnpm" in by_name["package-manager-evidence"].message
+
+
+def test_audit_does_not_accept_symlinked_repository_markers(
+    tmp_path: Path,
+    monkeypatch,
+) -> None:
+    readme = tmp_path / "README.md"
+    readme.write_text("# demo\n", encoding="utf-8")
+    gitignore = tmp_path / ".gitignore"
+    gitignore.write_text(".venv/\n", encoding="utf-8")
+    agents = tmp_path / "AGENTS.md"
+    agents.write_text("# agents\n", encoding="utf-8")
+    manifest = tmp_path / "pyproject.toml"
+    manifest.write_text("[project]\nname='demo'\n", encoding="utf-8")
+
+    symlinked = {readme, gitignore, agents, manifest}
+    original_is_symlink = Path.is_symlink
+
+    def fake_is_symlink(path: Path) -> bool:
+        if path in symlinked:
+            return True
+        return original_is_symlink(path)
+
+    monkeypatch.setattr(Path, "is_symlink", fake_is_symlink)
+
+    checks = audit_repository(tmp_path)
+    by_name = {check.name: check for check in checks}
+
+    assert by_name["readme"].status == "warn"
+    assert by_name["gitignore"].status == "warn"
+    assert by_name["agents"].status == "warn"
+    assert by_name["project-manifest"].status == "warn"

{codex_workspace_bootstrap-0.6.0 → codex_workspace_bootstrap-0.6.1}/tests/test_cli.py

@@ -101,7 +101,7 @@ def test_version_flag_reports_package_version(capsys: pytest.CaptureFixture[str]
         main(["--version"])
 
     assert exc_info.value.code == 0
-    assert "codex-workspace-bootstrap 0.6.0" in capsys.readouterr().out
+    assert "codex-workspace-bootstrap 0.6.1" in capsys.readouterr().out
 
 
 def test_audit_writes_sarif(tmp_path: Path) -> None:
@@ -265,3 +265,37 @@ def test_init_agents_refuses_symlink_target_even_with_force(
     assert code == 1
     assert "refusing to write through symlink" in capsys.readouterr().err
     assert not target.exists()
+
+
+def test_init_agents_ignores_symlinked_project_markers(
+    tmp_path: Path,
+    monkeypatch,
+) -> None:
+    pyproject = tmp_path / "pyproject.toml"
+    pyproject.write_text(
+        "[project]\nname='demo'\n[tool.pytest.ini_options]\n",
+        encoding="utf-8",
+    )
+    package = tmp_path / "package.json"
+    package.write_text(
+        '{"packageManager":"pnpm@10","scripts":{"test":"vitest"}}',
+        encoding="utf-8",
+    )
+
+    symlinked = {pyproject, package}
+    original_is_symlink = Path.is_symlink
+
+    def fake_is_symlink(path: Path) -> bool:
+        if path in symlinked:
+            return True
+        return original_is_symlink(path)
+
+    monkeypatch.setattr(Path, "is_symlink", fake_is_symlink)
+
+    code = main(["init-agents", str(tmp_path)])
+
+    assert code == 0
+    content = (tmp_path / "AGENTS.md").read_text(encoding="utf-8")
+    assert "No common Python or Node.js manifest detected" in content
+    assert "python -m pytest" not in content
+    assert "pnpm run test" not in content

{codex_workspace_bootstrap-0.6.0 → codex_workspace_bootstrap-0.6.1}/tests/test_doctor.py

@@ -41,3 +41,20 @@ def test_doctor_has_repository_guidance() -> None:
 
     assert "init-agents" in findings[0].guidance
     assert ".gitignore" in findings[1].guidance
+
+
+def test_doctor_has_detected_package_manager_guidance() -> None:
+    findings = doctor_findings(
+        [
+            Check("pnpm", "warn", "pnpm command not found"),
+            Check(
+                "package-manager-evidence",
+                "warn",
+                "Node.js project detected, but package manager evidence is missing",
+            ),
+        ]
+    )
+
+    assert "pnpm" in findings[0].guidance.lower()
+    assert "packageManager" in findings[1].guidance
+    assert "lockfile" in findings[1].guidance

{codex_workspace_bootstrap-0.6.0 → codex_workspace_bootstrap-0.6.1}/tests/test_instruction_integrity.py

@@ -722,3 +722,92 @@ def test_apply_fix_plan_does_not_write_through_symlink_target(tmp_path: Path, mo
 
     assert applied == []
     assert not target.exists()
+
+
+def test_pnpm_filter_command_validates_real_script_name(tmp_path: Path) -> None:
+    (tmp_path / "package.json").write_text(
+        json.dumps(
+            {
+                "packageManager": "pnpm@10",
+                "scripts": {"test": "vitest"},
+            }
+        ),
+        encoding="utf-8",
+    )
+    (tmp_path / "pnpm-lock.yaml").write_text("lockfileVersion: '9.0'\n", encoding="utf-8")
+    (tmp_path / "AGENTS.md").write_text(
+        "Run §pnpm --filter web run lint§.\n".replace("§", "`"),
+        encoding="utf-8",
+    )
+
+    findings = lint_instructions(tmp_path)
+
+    missing = [item for item in findings if item.kind == "missing-package-script"]
+    assert len(missing) == 1
+    assert "lint" in missing[0].message
+
+
+def test_pnpm_directory_flag_validates_real_script_name(tmp_path: Path) -> None:
+    (tmp_path / "package.json").write_text(
+        json.dumps(
+            {
+                "packageManager": "pnpm@10",
+                "scripts": {"test": "vitest"},
+            }
+        ),
+        encoding="utf-8",
+    )
+    (tmp_path / "pnpm-lock.yaml").write_text("lockfileVersion: '9.0'\n", encoding="utf-8")
+    (tmp_path / "AGENTS.md").write_text(
+        "Run §pnpm -C apps/web test§.\n".replace("§", "`"),
+        encoding="utf-8",
+    )
+
+    findings = lint_instructions(tmp_path)
+
+    assert not any(item.kind == "missing-package-script" for item in findings)
+
+
+def test_npm_workspace_flag_validates_real_script_name(tmp_path: Path) -> None:
+    (tmp_path / "package.json").write_text(
+        json.dumps(
+            {
+                "packageManager": "npm@11",
+                "scripts": {"test": "vitest"},
+            }
+        ),
+        encoding="utf-8",
+    )
+    (tmp_path / "package-lock.json").write_text("{}", encoding="utf-8")
+    (tmp_path / "AGENTS.md").write_text(
+        "Run §npm --workspace app run lint§.\n".replace("§", "`"),
+        encoding="utf-8",
+    )
+
+    findings = lint_instructions(tmp_path)
+
+    missing = [item for item in findings if item.kind == "missing-package-script"]
+    assert len(missing) == 1
+    assert "lint" in missing[0].message
+
+
+def test_yarn_workspace_command_validates_real_script_name(tmp_path: Path) -> None:
+    (tmp_path / "package.json").write_text(
+        json.dumps(
+            {
+                "packageManager": "yarn@4",
+                "scripts": {"test": "vitest"},
+            }
+        ),
+        encoding="utf-8",
+    )
+    (tmp_path / "yarn.lock").write_text("", encoding="utf-8")
+    (tmp_path / "AGENTS.md").write_text(
+        "Run §yarn workspace web test§.\n".replace("§", "`"),
+        encoding="utf-8",
+    )
+
+    findings = lint_instructions(tmp_path)
+
+    assert not any(item.kind == "missing-package-script" for item in findings)
+    assert not any(item.kind == "package-manager-mismatch" for item in findings)

{codex_workspace_bootstrap-0.6.0 → codex_workspace_bootstrap-0.6.1}/tests/test_preflight.py

@@ -9,6 +9,7 @@ from codex_workspace_bootstrap.preflight import (
     build_preflight,
     detect_instruction_signals,
     readiness_state,
+    next_actions,
     render_markdown,
 )
 
@@ -153,3 +154,65 @@ def test_conditional_cursor_rule_is_not_repository_wide_baseline() -> None:
     )
 
     assert readiness_state(checks, [conditional]) == "NEEDS ATTENTION"
+
+
+def test_next_actions_recommends_detected_pnpm_toolchain() -> None:
+    checks = [
+        Check("pnpm", "warn", "pnpm command not found"),
+    ]
+
+    actions = next_actions(
+        checks,
+        [],
+        ["Node.js"],
+    )
+
+    assert any(
+        item.command == "pnpm --version"
+        and "Node.js/pnpm" in item.title
+        for item in actions
+    )
+    assert not any(item.command == "npm --version" for item in actions)
+
+
+def test_next_actions_asks_to_confirm_package_manager_when_unproven() -> None:
+    checks = [
+        Check(
+            "package-manager-evidence",
+            "warn",
+            "Node.js project detected, but package manager evidence is missing",
+        ),
+    ]
+
+    actions = next_actions(
+        checks,
+        [],
+        ["Node.js"],
+    )
+
+    assert any(item.title == "Confirm the repository package manager" for item in actions)
+    assert not any(item.command and item.command.endswith("--version") for item in actions)
+
+
+def test_next_actions_prioritizes_conflicting_package_manager_evidence() -> None:
+    checks = [
+        Check(
+            "package-manager-evidence",
+            "warn",
+            "Conflicting Node.js package-manager evidence detected: npm, pnpm",
+        ),
+        Check("npm", "pass", "available"),
+        Check("pnpm", "pass", "available"),
+    ]
+
+    actions = next_actions(
+        checks,
+        [],
+        ["Node.js"],
+    )
+
+    assert any(
+        item.priority == "P1"
+        and item.title == "Resolve conflicting repository package-manager evidence"
+        for item in actions
+    )

{codex_workspace_bootstrap-0.6.0 → codex_workspace_bootstrap-0.6.1}/tests/test_sarif.py

@@ -94,3 +94,25 @@ def test_preflight_sarif_combines_audit_and_instruction_rules() -> None:
 
     rule_ids = {item["ruleId"] for item in payload["runs"][0]["results"]}
     assert rule_ids == {"agents", "instruction-missing-scope-metadata"}
+
+
+def test_sarif_has_specific_package_manager_help() -> None:
+    payload = checks_to_sarif(
+        [
+            Check("pnpm", "warn", "pnpm command not found"),
+            Check(
+                "package-manager-evidence",
+                "warn",
+                "Conflicting Node.js package-manager evidence detected: npm, pnpm",
+            ),
+        ]
+    )
+
+    rules = {
+        rule["id"]: rule
+        for rule in payload["runs"][0]["tool"]["driver"]["rules"]
+    }
+
+    assert "pnpm" in rules["pnpm"]["help"]["text"].lower()
+    assert "packageManager" in rules["package-manager-evidence"]["help"]["text"]
+    assert "lockfile" in rules["package-manager-evidence"]["help"]["text"]

codex_workspace_bootstrap-0.6.0/tests/test_audit.py

@@ -1,78 +0,0 @@
-from pathlib import Path
-import shutil
-import subprocess
-
-import pytest
-
-from codex_workspace_bootstrap.audit import audit_repository, summary
-
-
-def _git(root: Path, *args: str) -> None:
-    subprocess.run(
-        ("git", "-C", str(root), *args),
-        check=True,
-        capture_output=True,
-        text=True,
-    )
-
-
-def test_audit_detects_basic_repository_files(tmp_path: Path) -> None:
-    (tmp_path / ".git").mkdir()
-    (tmp_path / "README.md").write_text("# demo\n", encoding="utf-8")
-    (tmp_path / "LICENSE").write_text("MIT\n", encoding="utf-8")
-    (tmp_path / ".gitignore").write_text(".env\n", encoding="utf-8")
-    (tmp_path / "AGENTS.md").write_text("# agents\n", encoding="utf-8")
-    (tmp_path / "pyproject.toml").write_text("[project]\nname='demo'\n", encoding="utf-8")
-
-    checks = audit_repository(tmp_path)
-    by_name = {c.name: c for c in checks}
-
-    assert by_name["git-repository"].status == "pass"
-    assert by_name["readme"].status == "pass"
-    assert by_name["license"].status == "pass"
-    assert by_name["gitignore"].status == "pass"
-    assert by_name["agents"].status == "pass"
-    assert by_name["project-manifest"].status == "pass"
-
-
-def test_audit_warns_on_secret_risk_filename(tmp_path: Path) -> None:
-    (tmp_path / ".env").write_text("EXAMPLE=not-a-secret\n", encoding="utf-8")
-    checks = audit_repository(tmp_path)
-    by_name = {c.name: c for c in checks}
-    assert by_name["secret-risk-files"].status == "warn"
-    assert by_name["secret-risk-files"].blocking is False
-
-
-@pytest.mark.skipif(shutil.which("git") is None, reason="git is required")
-def test_tracked_secret_risk_file_is_blocking(tmp_path: Path) -> None:
-    _git(tmp_path, "init")
-    (tmp_path / ".env").write_text("EXAMPLE=not-a-secret\n", encoding="utf-8")
-    _git(tmp_path, "add", "-f", ".env")
-
-    checks = audit_repository(tmp_path)
-    by_name = {c.name: c for c in checks}
-
-    assert by_name["secret-risk-files"].status == "warn"
-    assert by_name["secret-risk-files"].blocking is True
-    assert "tracked:" in by_name["secret-risk-files"].message
-
-
-@pytest.mark.skipif(shutil.which("git") is None, reason="git is required")
-def test_ignored_secret_risk_file_is_not_blocking(tmp_path: Path) -> None:
-    _git(tmp_path, "init")
-    (tmp_path / ".gitignore").write_text(".env\n", encoding="utf-8")
-    (tmp_path / ".env").write_text("EXAMPLE=not-a-secret\n", encoding="utf-8")
-
-    checks = audit_repository(tmp_path)
-    by_name = {c.name: c for c in checks}
-
-    assert by_name["secret-risk-files"].status == "warn"
-    assert by_name["secret-risk-files"].blocking is False
-    assert "ignored:" in by_name["secret-risk-files"].message
-
-
-def test_summary_counts_statuses(tmp_path: Path) -> None:
-    checks = audit_repository(tmp_path)
-    totals = summary(checks)
-    assert totals["passed"] + totals["warnings"] == len(checks)
-    assert totals["blocking"] == 0