codex-workspace-bootstrap 0.6.0__tar.gz → 0.7.0__tar.gz

{codex_workspace_bootstrap-0.6.0/src/codex_workspace_bootstrap.egg-info → codex_workspace_bootstrap-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codex-workspace-bootstrap
-Version: 0.6.0
+Version: 0.7.0
 Summary: Preflight AI coding repositories before Codex, Copilot, Cline, Claude, Gemini, Continue, or Cursor touches them.
 Author: kohli217
 License: MIT
@@ -123,8 +123,8 @@ The goal is not a vanity score. The result is one of:
 - README
 - license
 - `.gitignore`
-- common project manifests
-- local Git / Python / Node.js / npm / PowerShell / WSL / Codex signals
+- common project manifests, including Python, Node.js, Go, Rust, JVM, and .NET roots
+- local Git / Python / Node.js / repository-selected package manager / PowerShell / WSL / Codex signals
 
 ### AI instruction coverage
 
@@ -153,7 +153,7 @@ The lint is intentionally conservative: different files may contain additional c
 
 ### Risk signals
 
-The audit warns about common secret-bearing filenames without printing their contents. When Git is available, it distinguishes **tracked**, **ignored**, and **untracked/unknown** candidates. Tracked risky filenames can become blocking findings in strict mode.
+The audit warns about common secret-bearing filenames without printing their contents, including environment-specific `.env.*` files while excluding common template names such as `.env.example` and `.env.sample`. When Git is available, it distinguishes **tracked**, **ignored**, and **untracked/unknown** candidates. Tracked risky filenames can become blocking findings in strict mode.
 
 This is intentionally a lightweight preflight check, not a replacement for deep scanners such as Gitleaks or Trivy.
 
@@ -211,6 +211,14 @@ Fail CI on any instruction-integrity finding:
 cwb preflight . --fail-on-integrity
 ```
 
+Require the full preflight state to be `READY`:
+
+```powershell
+cwb preflight . --require-ready
+```
+
+Use `--require-ready` when CI should reject both `NEEDS ATTENTION` and `BLOCKED`, including missing repository-wide AI instructions or essential repository markers.
+
 ### Detailed audit
 
 ```powershell
@@ -248,7 +256,7 @@ cwb doctor .
 cwb init-agents .
 ```
 
-Generation is evidence-based: the tool cross-checks project manifests, package-manager evidence, package scripts, pytest configuration, and README commands. Plausible but unconfirmed commands are separated for maintainer review. Existing `AGENTS.md` files are never overwritten unless `--force` is explicit.
+Generation is evidence-based: the tool identifies common Python, Node.js, Go, Rust, JVM, and .NET project roots, then only emits validation commands that have direct repository evidence. Python/Node-specific validation is cross-checked against package-manager evidence, package scripts, pytest configuration, and README commands. Plausible but unconfirmed commands are separated for maintainer review. Existing `AGENTS.md` files are never overwritten unless `--force` is explicit.
 
 ## GitHub Action
 
@@ -259,11 +267,12 @@ The reusable Action is published on GitHub Marketplace.
 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
   with:
     python-version: "3.13"
-- uses: kohli217/codex-workspace-bootstrap@v0.6.0
+- uses: kohli217/codex-workspace-bootstrap@v0.7.0
   with:
     path: .
     strict: "true"
     fail_on_integrity: "true"
+    require_ready: "true"
 ```
 
 The Action adds the preflight Markdown report to the **GitHub Actions job summary**, so maintainers get a readable readiness snapshot without digging through raw logs. Optional SARIF output contains both repository-audit and instruction-integrity findings and can be uploaded to GitHub Code Scanning.
@@ -291,7 +300,7 @@ The intent is to complement those tools, not replace them.
 - Suspected secret files are not opened or printed by the filename-risk check.
 - Repository contents are not sent to a remote AI service by the core audit.
 - Instruction files are read locally for deterministic linting; extracted commands are never executed by the integrity lint.
-- Repository instruction/configuration inputs are not read through symbolic links.
+- Repository instruction/configuration and project-marker inputs are not trusted through symbolic links.
 - `init-agents` and automatic fixes refuse symlinked `AGENTS.md` targets rather than writing through them.
 - Existing regular `AGENTS.md` files are protected unless overwrite is explicit.
 - A passing preflight is evidence about the checks performed, **not a security guarantee**.
@@ -325,7 +334,7 @@ py -m pip install codex-workspace-bootstrap
 Pinned GitHub release artifact:
 
 ```powershell
-py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.6.0/codex_workspace_bootstrap-0.6.0-py3-none-any.whl"
+py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.7.0/codex_workspace_bootstrap-0.7.0-py3-none-any.whl"
 ```
 
 ## Development

{codex_workspace_bootstrap-0.6.0 → codex_workspace_bootstrap-0.7.0}/README.md

@@ -95,8 +95,8 @@ The goal is not a vanity score. The result is one of:
 - README
 - license
 - `.gitignore`
-- common project manifests
-- local Git / Python / Node.js / npm / PowerShell / WSL / Codex signals
+- common project manifests, including Python, Node.js, Go, Rust, JVM, and .NET roots
+- local Git / Python / Node.js / repository-selected package manager / PowerShell / WSL / Codex signals
 
 ### AI instruction coverage
 
@@ -125,7 +125,7 @@ The lint is intentionally conservative: different files may contain additional c
 
 ### Risk signals
 
-The audit warns about common secret-bearing filenames without printing their contents. When Git is available, it distinguishes **tracked**, **ignored**, and **untracked/unknown** candidates. Tracked risky filenames can become blocking findings in strict mode.
+The audit warns about common secret-bearing filenames without printing their contents, including environment-specific `.env.*` files while excluding common template names such as `.env.example` and `.env.sample`. When Git is available, it distinguishes **tracked**, **ignored**, and **untracked/unknown** candidates. Tracked risky filenames can become blocking findings in strict mode.
 
 This is intentionally a lightweight preflight check, not a replacement for deep scanners such as Gitleaks or Trivy.
 
@@ -183,6 +183,14 @@ Fail CI on any instruction-integrity finding:
 cwb preflight . --fail-on-integrity
 ```
 
+Require the full preflight state to be `READY`:
+
+```powershell
+cwb preflight . --require-ready
+```
+
+Use `--require-ready` when CI should reject both `NEEDS ATTENTION` and `BLOCKED`, including missing repository-wide AI instructions or essential repository markers.
+
 ### Detailed audit
 
 ```powershell
@@ -220,7 +228,7 @@ cwb doctor .
 cwb init-agents .
 ```
 
-Generation is evidence-based: the tool cross-checks project manifests, package-manager evidence, package scripts, pytest configuration, and README commands. Plausible but unconfirmed commands are separated for maintainer review. Existing `AGENTS.md` files are never overwritten unless `--force` is explicit.
+Generation is evidence-based: the tool identifies common Python, Node.js, Go, Rust, JVM, and .NET project roots, then only emits validation commands that have direct repository evidence. Python/Node-specific validation is cross-checked against package-manager evidence, package scripts, pytest configuration, and README commands. Plausible but unconfirmed commands are separated for maintainer review. Existing `AGENTS.md` files are never overwritten unless `--force` is explicit.
 
 ## GitHub Action
 
@@ -231,11 +239,12 @@ The reusable Action is published on GitHub Marketplace.
 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
   with:
     python-version: "3.13"
-- uses: kohli217/codex-workspace-bootstrap@v0.6.0
+- uses: kohli217/codex-workspace-bootstrap@v0.7.0
   with:
     path: .
     strict: "true"
     fail_on_integrity: "true"
+    require_ready: "true"
 ```
 
 The Action adds the preflight Markdown report to the **GitHub Actions job summary**, so maintainers get a readable readiness snapshot without digging through raw logs. Optional SARIF output contains both repository-audit and instruction-integrity findings and can be uploaded to GitHub Code Scanning.
@@ -263,7 +272,7 @@ The intent is to complement those tools, not replace them.
 - Suspected secret files are not opened or printed by the filename-risk check.
 - Repository contents are not sent to a remote AI service by the core audit.
 - Instruction files are read locally for deterministic linting; extracted commands are never executed by the integrity lint.
-- Repository instruction/configuration inputs are not read through symbolic links.
+- Repository instruction/configuration and project-marker inputs are not trusted through symbolic links.
 - `init-agents` and automatic fixes refuse symlinked `AGENTS.md` targets rather than writing through them.
 - Existing regular `AGENTS.md` files are protected unless overwrite is explicit.
 - A passing preflight is evidence about the checks performed, **not a security guarantee**.
@@ -297,7 +306,7 @@ py -m pip install codex-workspace-bootstrap
 Pinned GitHub release artifact:
 
 ```powershell
-py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.6.0/codex_workspace_bootstrap-0.6.0-py3-none-any.whl"
+py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.7.0/codex_workspace_bootstrap-0.7.0-py3-none-any.whl"
 ```
 
 ## Development

{codex_workspace_bootstrap-0.6.0 → codex_workspace_bootstrap-0.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "codex-workspace-bootstrap"
-version = "0.6.0"
+version = "0.7.0"
 description = "Preflight AI coding repositories before Codex, Copilot, Cline, Claude, Gemini, Continue, or Cursor touches them."
 readme = "README.md"
 requires-python = ">=3.10"

{codex_workspace_bootstrap-0.6.0 → codex_workspace_bootstrap-0.7.0}/src/codex_workspace_bootstrap/__init__.py

@@ -1,3 +1,3 @@
 """codex-workspace-bootstrap package."""
 
-__version__ = "0.6.0"
+__version__ = "0.7.0"

{codex_workspace_bootstrap-0.6.0 → codex_workspace_bootstrap-0.7.0}/src/codex_workspace_bootstrap/agents.py

@@ -8,6 +8,16 @@ import re
 
 PYTHON_MARKERS = ("pyproject.toml", "requirements.txt", "setup.py", "setup.cfg")
 NODE_MARKER = "package.json"
+GO_MARKERS = ("go.mod",)
+RUST_MARKERS = ("Cargo.toml",)
+JVM_MARKERS = (
+    "pom.xml",
+    "build.gradle",
+    "build.gradle.kts",
+    "settings.gradle",
+    "settings.gradle.kts",
+)
+DOTNET_SUFFIXES = (".sln", ".csproj", ".fsproj", ".vbproj")
 README_NAMES = ("README.md", "README.rst", "README.txt", "README")
 
 
@@ -18,12 +28,27 @@ class ValidationCommand:
     review_required: bool = False
 
 
+def _regular_file(path: Path) -> bool:
+    return path.is_file() and not path.is_symlink()
+
+
 def detect_project_signals(root: Path) -> list[str]:
     signals: list[str] = []
-    if any((root / marker).exists() for marker in PYTHON_MARKERS):
+    if any(_regular_file(root / marker) for marker in PYTHON_MARKERS):
         signals.append("Python")
-    if (root / NODE_MARKER).exists():
+    if _regular_file(root / NODE_MARKER):
         signals.append("Node.js")
+    if any(_regular_file(root / marker) for marker in GO_MARKERS):
+        signals.append("Go")
+    if any(_regular_file(root / marker) for marker in RUST_MARKERS):
+        signals.append("Rust")
+    if any(_regular_file(root / marker) for marker in JVM_MARKERS):
+        signals.append("JVM")
+    if any(
+        _regular_file(path) and path.suffix.lower() in DOTNET_SUFFIXES
+        for path in root.iterdir()
+    ):
+        signals.append(".NET")
     return signals
 
 
@@ -44,7 +69,7 @@ def _node_script_names(root: Path) -> set[str]:
     return {name for name, value in scripts.items() if isinstance(name, str) and isinstance(value, str)}
 
 
-def _node_package_managers(root: Path) -> set[str]:
+def detect_node_package_managers(root: Path) -> set[str]:
     managers: set[str] = set()
     package_json = root / NODE_MARKER
 
@@ -154,8 +179,8 @@ def validation_plan(root: Path) -> list[ValidationCommand]:
     if "Python" in signals:
         pytest_evidence = (
             _pyproject_has_pytest(root)
-            or (root / "pytest.ini").exists()
-            or (root / "conftest.py").exists()
+            or _regular_file(root / "pytest.ini")
+            or _regular_file(root / "conftest.py")
         )
         if "python -m pytest" in documented or "pytest" in documented:
             plan.append(ValidationCommand("python -m pytest", "documented in README"))
@@ -174,7 +199,7 @@ def validation_plan(root: Path) -> list[ValidationCommand]:
 
     if "Node.js" in signals:
         scripts = _node_script_names(root)
-        managers = _node_package_managers(root)
+        managers = detect_node_package_managers(root)
         manager = next(iter(managers)) if len(managers) == 1 else None
 
         if manager:
@@ -244,7 +269,7 @@ def validation_commands(root: Path) -> list[str]:
 
 def generate_agents(root: Path) -> str:
     signals = detect_project_signals(root)
-    signal_text = ", ".join(signals) if signals else "No common Python or Node.js manifest detected"
+    signal_text = ", ".join(signals) if signals else "No supported project manifest detected"
     plan = validation_plan(root)
 
     confirmed = [item for item in plan if not item.review_required]

codex_workspace_bootstrap-0.7.0/src/codex_workspace_bootstrap/audit.py

@@ -0,0 +1,366 @@
+from __future__ import annotations
+
+from dataclasses import asdict, dataclass
+from pathlib import Path
+import os
+import shutil
+import subprocess
+import sys
+from typing import Iterable
+
+from .agents import detect_node_package_managers
+
+
+@dataclass(frozen=True)
+class Check:
+    name: str
+    status: str
+    message: str
+    blocking: bool = False
+
+    def to_dict(self) -> dict[str, object]:
+        return asdict(self)
+
+
+COMMON_TOOLS: tuple[tuple[str, tuple[str, ...]], ...] = (
+    ("git", ("git", "--version")),
+    ("python", ("python", "--version")),
+    ("node", ("node", "--version")),
+    ("powershell", ("powershell", "-NoProfile", "-Command", "$PSVersionTable.PSVersion.ToString()")),
+    ("wsl", ("wsl", "--status")),
+    ("codex", ("codex", "--version")),
+)
+
+MANIFESTS = (
+    "pyproject.toml",
+    "requirements.txt",
+    "package.json",
+    "go.mod",
+    "Cargo.toml",
+    "pom.xml",
+    "build.gradle",
+    "build.gradle.kts",
+    "settings.gradle",
+    "settings.gradle.kts",
+)
+
+RISK_FILENAMES = {
+    ".env",
+    ".env.local",
+    "credentials.json",
+    "service-account.json",
+    "id_rsa",
+    "id_ed25519",
+}
+
+RISK_SUFFIXES = (".pem", ".p12", ".pfx", ".key")
+SAFE_ENV_TEMPLATE_NAMES = {
+    ".env.example",
+    ".env.sample",
+    ".env.template",
+    ".env.dist",
+    ".env.defaults",
+}
+
+NODE_PACKAGE_MANAGER_COMMANDS: dict[str, tuple[str, ...]] = {
+    "npm": ("npm", "--version"),
+    "pnpm": ("pnpm", "--version"),
+    "yarn": ("yarn", "--version"),
+    "bun": ("bun", "--version"),
+}
+
+
+def _tool_check(label: str, command: tuple[str, ...]) -> Check:
+    executable = shutil.which(command[0])
+    if not executable:
+        return Check(label, "warn", f"{command[0]} command not found")
+
+    try:
+        result = subprocess.run(
+            command,
+            capture_output=True,
+            text=True,
+            timeout=5,
+            check=False,
+        )
+        output = (result.stdout or result.stderr).strip().splitlines()
+        detail = output[0] if output else "available"
+        if result.returncode == 0:
+            return Check(label, "pass", detail)
+        return Check(label, "warn", f"available but returned exit code {result.returncode}")
+    except (OSError, subprocess.SubprocessError) as exc:
+        return Check(label, "warn", f"could not execute: {exc}")
+
+
+def _iter_project_files(root: Path) -> Iterable[Path]:
+    excluded = {
+        ".git",
+        ".venv",
+        "venv",
+        "node_modules",
+        "__pycache__",
+        ".pytest_cache",
+        ".mypy_cache",
+        ".ruff_cache",
+        ".tox",
+        ".nox",
+        "dist",
+        "build",
+    }
+
+    for current, dirnames, filenames in os.walk(root, followlinks=False):
+        current_path = Path(current)
+        dirnames[:] = [
+            name
+            for name in dirnames
+            if name not in excluded and not (current_path / name).is_symlink()
+        ]
+        for filename in filenames:
+            yield current_path / filename
+
+
+def _git_tracked_files(root: Path) -> set[str] | None:
+    if shutil.which("git") is None:
+        return None
+    try:
+        result = subprocess.run(
+            ("git", "-C", str(root), "ls-files", "-z"),
+            capture_output=True,
+            text=False,
+            timeout=10,
+            check=False,
+        )
+        if result.returncode != 0:
+            return None
+        return {
+            item.decode(sys.getfilesystemencoding(), errors="surrogateescape")
+            for item in result.stdout.split(b"\0")
+            if item
+        }
+    except (OSError, subprocess.SubprocessError):
+        return None
+
+
+def _git_matches(root: Path, args: tuple[str, ...]) -> bool:
+    if shutil.which("git") is None:
+        return False
+    try:
+        result = subprocess.run(
+            ("git", "-C", str(root), *args),
+            capture_output=True,
+            text=True,
+            timeout=5,
+            check=False,
+        )
+        return result.returncode == 0
+    except (OSError, subprocess.SubprocessError):
+        return False
+
+
+def _classify_risky_paths(
+    root: Path,
+    risky: list[str],
+    tracked_files: set[str] | None = None,
+) -> tuple[list[str], list[str], list[str]]:
+    tracked: list[str] = []
+    ignored: list[str] = []
+    untracked: list[str] = []
+
+    for relative in risky:
+        if tracked_files is not None and relative in tracked_files:
+            tracked.append(relative)
+        elif tracked_files is None and _git_matches(root, ("ls-files", "--error-unmatch", "--", relative)):
+            tracked.append(relative)
+        elif _git_matches(root, ("check-ignore", "--quiet", "--", relative)):
+            ignored.append(relative)
+        else:
+            untracked.append(relative)
+
+    return tracked, ignored, untracked
+
+
+def _is_risky_filename(name: str) -> bool:
+    lowered = name.lower()
+    if lowered in RISK_FILENAMES or lowered.endswith(RISK_SUFFIXES):
+        return True
+    if lowered.startswith(".env.") and lowered not in SAFE_ENV_TEMPLATE_NAMES:
+        return True
+    return False
+
+
+def _preview(paths: list[str], limit: int = 8) -> str:
+    visible = ", ".join(sorted(paths)[:limit])
+    suffix = "" if len(paths) <= limit else f" (+{len(paths) - limit} more)"
+    return f"{visible}{suffix}"
+
+
+def audit_repository(root: Path) -> list[Check]:
+    root = root.resolve()
+    checks: list[Check] = []
+
+    git_dir = root / ".git"
+    checks.append(
+        Check(
+            "git-repository",
+            "pass" if git_dir.exists() else "warn",
+            "Git repository detected" if git_dir.exists() else ".git directory not found",
+        )
+    )
+
+    readme = next(
+        (
+            p
+            for p in root.iterdir()
+            if p.is_file() and not p.is_symlink() and p.name.lower().startswith("readme")
+        ),
+        None,
+    )
+    checks.append(
+        Check(
+            "readme",
+            "pass" if readme else "warn",
+            f"README detected: {readme.name}" if readme else "README not found",
+        )
+    )
+
+    license_file = next(
+        (
+            p
+            for p in root.iterdir()
+            if p.is_file() and not p.is_symlink() and p.name.lower().startswith("license")
+        ),
+        None,
+    )
+    checks.append(
+        Check(
+            "license",
+            "pass" if license_file else "warn",
+            f"License detected: {license_file.name}" if license_file else "License file not found",
+        )
+    )
+
+    checks.append(
+        Check(
+            "gitignore",
+            "pass"
+            if (root / ".gitignore").is_file() and not (root / ".gitignore").is_symlink()
+            else "warn",
+            ".gitignore detected"
+            if (root / ".gitignore").is_file() and not (root / ".gitignore").is_symlink()
+            else ".gitignore not found",
+        )
+    )
+
+    checks.append(
+        Check(
+            "agents",
+            "pass"
+            if (root / "AGENTS.md").is_file() and not (root / "AGENTS.md").is_symlink()
+            else "warn",
+            "AGENTS.md detected"
+            if (root / "AGENTS.md").is_file() and not (root / "AGENTS.md").is_symlink()
+            else "AGENTS.md not found; run init-agents",
+        )
+    )
+
+    manifests = [
+        name
+        for name in MANIFESTS
+        if (root / name).is_file() and not (root / name).is_symlink()
+    ]
+    manifests.extend(
+        sorted(
+            path.name
+            for path in root.iterdir()
+            if path.is_file()
+            and not path.is_symlink()
+            and path.suffix.lower() in {".sln", ".csproj", ".fsproj", ".vbproj"}
+        )
+    )
+    checks.append(
+        Check(
+            "project-manifest",
+            "pass" if manifests else "warn",
+            f"Detected: {', '.join(manifests)}" if manifests else "No common project manifest detected",
+        )
+    )
+
+    for label, command in COMMON_TOOLS:
+        checks.append(_tool_check(label, command))
+
+    if (root / "package.json").is_file() and not (root / "package.json").is_symlink():
+        managers = detect_node_package_managers(root)
+        if managers:
+            if len(managers) > 1:
+                checks.append(
+                    Check(
+                        "package-manager-evidence",
+                        "warn",
+                        "Conflicting Node.js package-manager evidence detected: "
+                        + ", ".join(sorted(managers)),
+                    )
+                )
+            for manager in sorted(managers):
+                command = NODE_PACKAGE_MANAGER_COMMANDS[manager]
+                checks.append(_tool_check(manager, command))
+        else:
+            checks.append(
+                Check(
+                    "package-manager-evidence",
+                    "warn",
+                    "Node.js project detected, but packageManager/lockfile evidence does not confirm npm, pnpm, yarn, or bun",
+                )
+            )
+
+    tracked_files = _git_tracked_files(root)
+    risky: set[str] = set()
+
+    for path in _iter_project_files(root):
+        if _is_risky_filename(path.name):
+            risky.add(path.relative_to(root).as_posix())
+
+    # Generated/dependency directories are pruned from the filesystem walk to
+    # avoid expensive scans. Tracked files are different: if a risky filename
+    # is committed, it must still be surfaced even inside a pruned directory.
+    if tracked_files is not None:
+        risky.update(
+            relative
+            for relative in tracked_files
+            if _is_risky_filename(Path(relative).name)
+        )
+
+    if risky:
+        tracked, ignored, untracked = _classify_risky_paths(
+            root,
+            sorted(risky),
+            tracked_files,
+        )
+        parts: list[str] = []
+        if tracked:
+            parts.append(f"tracked: {_preview(tracked)}")
+        if ignored:
+            parts.append(f"ignored: {_preview(ignored)}")
+        if untracked:
+            parts.append(f"untracked/unknown: {_preview(untracked)}")
+
+        checks.append(
+            Check(
+                "secret-risk-files",
+                "warn",
+                "Potential secret-bearing filenames detected (" + "; ".join(parts) + "). "
+                "The audit does not read file contents.",
+                blocking=bool(tracked),
+            )
+        )
+    else:
+        checks.append(Check("secret-risk-files", "pass", "No common secret-bearing filenames detected"))
+
+    return checks
+
+
+def summary(checks: list[Check]) -> dict[str, int]:
+    return {
+        "passed": sum(c.status == "pass" for c in checks),
+        "warnings": sum(c.status == "warn" for c in checks),
+        "blocking": sum(c.blocking for c in checks),
+    }

{codex_workspace_bootstrap-0.6.0 → codex_workspace_bootstrap-0.7.0}/src/codex_workspace_bootstrap/cli.py

@@ -41,6 +41,11 @@ def _parser() -> argparse.ArgumentParser:
         action="store_true",
         help="Return a non-zero exit code when AI instruction integrity findings are present",
     )
+    preflight.add_argument(
+        "--require-ready",
+        action="store_true",
+        help="Return a non-zero exit code unless the preflight state is READY",
+    )
 
     fix = sub.add_parser("fix", help="Preview safe repository-readiness fixes")
     fix.add_argument("path", nargs="?", default=".")
@@ -85,6 +90,7 @@ def _run_preflight(
     sarif_path: str | None,
     strict: bool,
     fail_on_integrity: bool,
+    require_ready: bool,
 ) -> int:
     root = Path(path).expanduser().resolve()
     if not root.exists() or not root.is_dir():
@@ -161,6 +167,8 @@ def _run_preflight(
         return 1
     if fail_on_integrity and report["instruction_summary"]["findings"]:
         return 1
+    if require_ready and report["state"] != "READY":
+        return 1
     return 0
 
 
@@ -292,6 +300,7 @@ def main(argv: list[str] | None = None) -> int:
             args.sarif_path,
             args.strict,
             args.fail_on_integrity,
+            args.require_ready,
         )
     if args.command == "fix":
         return _run_fix(args.path, args.apply)

{codex_workspace_bootstrap-0.6.0 → codex_workspace_bootstrap-0.7.0}/src/codex_workspace_bootstrap/doctor.py

@@ -23,7 +23,11 @@ GUIDANCE: dict[str, str] = {
     "git": "Verify Git is installed and available on PATH.",
     "python": "Verify Python or the Windows Python launcher is installed and available on PATH.",
     "node": "Verify Node.js is installed and available on PATH when the project requires it.",
-    "npm": "Verify npm is available with the active Node.js installation.",
+    "npm": "Verify npm is installed and available on PATH for this repository.",
+    "pnpm": "Verify pnpm is installed and available on PATH for this repository.",
+    "yarn": "Verify Yarn is installed and available on PATH for this repository.",
+    "bun": "Verify Bun is installed and available on PATH for this repository.",
+    "package-manager-evidence": "Confirm the intended Node.js package manager in package.json packageManager or with the repository lockfile.",
     "powershell": "Verify Windows PowerShell or PowerShell is available on PATH.",
     "wsl": "Check WSL status only when the repository workflow requires Linux tooling.",
     "codex": "Verify the Codex CLI is installed and available on PATH when local Codex workflows are intended.",