codex-workspace-bootstrap 0.6.1__tar.gz → 0.7.0__tar.gz

{codex_workspace_bootstrap-0.6.1/src/codex_workspace_bootstrap.egg-info → codex_workspace_bootstrap-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codex-workspace-bootstrap
-Version: 0.6.1
+Version: 0.7.0
 Summary: Preflight AI coding repositories before Codex, Copilot, Cline, Claude, Gemini, Continue, or Cursor touches them.
 Author: kohli217
 License: MIT
@@ -123,7 +123,7 @@ The goal is not a vanity score. The result is one of:
 - README
 - license
 - `.gitignore`
-- common project manifests
+- common project manifests, including Python, Node.js, Go, Rust, JVM, and .NET roots
 - local Git / Python / Node.js / repository-selected package manager / PowerShell / WSL / Codex signals
 
 ### AI instruction coverage
@@ -153,7 +153,7 @@ The lint is intentionally conservative: different files may contain additional c
 
 ### Risk signals
 
-The audit warns about common secret-bearing filenames without printing their contents. When Git is available, it distinguishes **tracked**, **ignored**, and **untracked/unknown** candidates. Tracked risky filenames can become blocking findings in strict mode.
+The audit warns about common secret-bearing filenames without printing their contents, including environment-specific `.env.*` files while excluding common template names such as `.env.example` and `.env.sample`. When Git is available, it distinguishes **tracked**, **ignored**, and **untracked/unknown** candidates. Tracked risky filenames can become blocking findings in strict mode.
 
 This is intentionally a lightweight preflight check, not a replacement for deep scanners such as Gitleaks or Trivy.
 
@@ -211,6 +211,14 @@ Fail CI on any instruction-integrity finding:
 cwb preflight . --fail-on-integrity
 ```
 
+Require the full preflight state to be `READY`:
+
+```powershell
+cwb preflight . --require-ready
+```
+
+Use `--require-ready` when CI should reject both `NEEDS ATTENTION` and `BLOCKED`, including missing repository-wide AI instructions or essential repository markers.
+
 ### Detailed audit
 
 ```powershell
@@ -248,7 +256,7 @@ cwb doctor .
 cwb init-agents .
 ```
 
-Generation is evidence-based: the tool cross-checks project manifests, package-manager evidence, package scripts, pytest configuration, and README commands. Plausible but unconfirmed commands are separated for maintainer review. Existing `AGENTS.md` files are never overwritten unless `--force` is explicit.
+Generation is evidence-based: the tool identifies common Python, Node.js, Go, Rust, JVM, and .NET project roots, then only emits validation commands that have direct repository evidence. Python/Node-specific validation is cross-checked against package-manager evidence, package scripts, pytest configuration, and README commands. Plausible but unconfirmed commands are separated for maintainer review. Existing `AGENTS.md` files are never overwritten unless `--force` is explicit.
 
 ## GitHub Action
 
@@ -259,11 +267,12 @@ The reusable Action is published on GitHub Marketplace.
 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
   with:
     python-version: "3.13"
-- uses: kohli217/codex-workspace-bootstrap@v0.6.1
+- uses: kohli217/codex-workspace-bootstrap@v0.7.0
   with:
     path: .
     strict: "true"
     fail_on_integrity: "true"
+    require_ready: "true"
 ```
 
 The Action adds the preflight Markdown report to the **GitHub Actions job summary**, so maintainers get a readable readiness snapshot without digging through raw logs. Optional SARIF output contains both repository-audit and instruction-integrity findings and can be uploaded to GitHub Code Scanning.
@@ -325,7 +334,7 @@ py -m pip install codex-workspace-bootstrap
 Pinned GitHub release artifact:
 
 ```powershell
-py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.6.1/codex_workspace_bootstrap-0.6.1-py3-none-any.whl"
+py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.7.0/codex_workspace_bootstrap-0.7.0-py3-none-any.whl"
 ```
 
 ## Development

{codex_workspace_bootstrap-0.6.1 → codex_workspace_bootstrap-0.7.0}/README.md

@@ -95,7 +95,7 @@ The goal is not a vanity score. The result is one of:
 - README
 - license
 - `.gitignore`
-- common project manifests
+- common project manifests, including Python, Node.js, Go, Rust, JVM, and .NET roots
 - local Git / Python / Node.js / repository-selected package manager / PowerShell / WSL / Codex signals
 
 ### AI instruction coverage
@@ -125,7 +125,7 @@ The lint is intentionally conservative: different files may contain additional c
 
 ### Risk signals
 
-The audit warns about common secret-bearing filenames without printing their contents. When Git is available, it distinguishes **tracked**, **ignored**, and **untracked/unknown** candidates. Tracked risky filenames can become blocking findings in strict mode.
+The audit warns about common secret-bearing filenames without printing their contents, including environment-specific `.env.*` files while excluding common template names such as `.env.example` and `.env.sample`. When Git is available, it distinguishes **tracked**, **ignored**, and **untracked/unknown** candidates. Tracked risky filenames can become blocking findings in strict mode.
 
 This is intentionally a lightweight preflight check, not a replacement for deep scanners such as Gitleaks or Trivy.
 
@@ -183,6 +183,14 @@ Fail CI on any instruction-integrity finding:
 cwb preflight . --fail-on-integrity
 ```
 
+Require the full preflight state to be `READY`:
+
+```powershell
+cwb preflight . --require-ready
+```
+
+Use `--require-ready` when CI should reject both `NEEDS ATTENTION` and `BLOCKED`, including missing repository-wide AI instructions or essential repository markers.
+
 ### Detailed audit
 
 ```powershell
@@ -220,7 +228,7 @@ cwb doctor .
 cwb init-agents .
 ```
 
-Generation is evidence-based: the tool cross-checks project manifests, package-manager evidence, package scripts, pytest configuration, and README commands. Plausible but unconfirmed commands are separated for maintainer review. Existing `AGENTS.md` files are never overwritten unless `--force` is explicit.
+Generation is evidence-based: the tool identifies common Python, Node.js, Go, Rust, JVM, and .NET project roots, then only emits validation commands that have direct repository evidence. Python/Node-specific validation is cross-checked against package-manager evidence, package scripts, pytest configuration, and README commands. Plausible but unconfirmed commands are separated for maintainer review. Existing `AGENTS.md` files are never overwritten unless `--force` is explicit.
 
 ## GitHub Action
 
@@ -231,11 +239,12 @@ The reusable Action is published on GitHub Marketplace.
 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
   with:
     python-version: "3.13"
-- uses: kohli217/codex-workspace-bootstrap@v0.6.1
+- uses: kohli217/codex-workspace-bootstrap@v0.7.0
   with:
     path: .
     strict: "true"
     fail_on_integrity: "true"
+    require_ready: "true"
 ```
 
 The Action adds the preflight Markdown report to the **GitHub Actions job summary**, so maintainers get a readable readiness snapshot without digging through raw logs. Optional SARIF output contains both repository-audit and instruction-integrity findings and can be uploaded to GitHub Code Scanning.
@@ -297,7 +306,7 @@ py -m pip install codex-workspace-bootstrap
 Pinned GitHub release artifact:
 
 ```powershell
-py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.6.1/codex_workspace_bootstrap-0.6.1-py3-none-any.whl"
+py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.7.0/codex_workspace_bootstrap-0.7.0-py3-none-any.whl"
 ```
 
 ## Development

{codex_workspace_bootstrap-0.6.1 → codex_workspace_bootstrap-0.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "codex-workspace-bootstrap"
-version = "0.6.1"
+version = "0.7.0"
 description = "Preflight AI coding repositories before Codex, Copilot, Cline, Claude, Gemini, Continue, or Cursor touches them."
 readme = "README.md"
 requires-python = ">=3.10"

{codex_workspace_bootstrap-0.6.1 → codex_workspace_bootstrap-0.7.0}/src/codex_workspace_bootstrap/__init__.py

@@ -1,3 +1,3 @@
 """codex-workspace-bootstrap package."""
 
-__version__ = "0.6.1"
+__version__ = "0.7.0"

{codex_workspace_bootstrap-0.6.1 → codex_workspace_bootstrap-0.7.0}/src/codex_workspace_bootstrap/agents.py

@@ -8,6 +8,16 @@ import re
 
 PYTHON_MARKERS = ("pyproject.toml", "requirements.txt", "setup.py", "setup.cfg")
 NODE_MARKER = "package.json"
+GO_MARKERS = ("go.mod",)
+RUST_MARKERS = ("Cargo.toml",)
+JVM_MARKERS = (
+    "pom.xml",
+    "build.gradle",
+    "build.gradle.kts",
+    "settings.gradle",
+    "settings.gradle.kts",
+)
+DOTNET_SUFFIXES = (".sln", ".csproj", ".fsproj", ".vbproj")
 README_NAMES = ("README.md", "README.rst", "README.txt", "README")
 
 
@@ -28,6 +38,17 @@ def detect_project_signals(root: Path) -> list[str]:
         signals.append("Python")
     if _regular_file(root / NODE_MARKER):
         signals.append("Node.js")
+    if any(_regular_file(root / marker) for marker in GO_MARKERS):
+        signals.append("Go")
+    if any(_regular_file(root / marker) for marker in RUST_MARKERS):
+        signals.append("Rust")
+    if any(_regular_file(root / marker) for marker in JVM_MARKERS):
+        signals.append("JVM")
+    if any(
+        _regular_file(path) and path.suffix.lower() in DOTNET_SUFFIXES
+        for path in root.iterdir()
+    ):
+        signals.append(".NET")
     return signals
 
 
@@ -248,7 +269,7 @@ def validation_commands(root: Path) -> list[str]:
 
 def generate_agents(root: Path) -> str:
     signals = detect_project_signals(root)
-    signal_text = ", ".join(signals) if signals else "No common Python or Node.js manifest detected"
+    signal_text = ", ".join(signals) if signals else "No supported project manifest detected"
     plan = validation_plan(root)
 
     confirmed = [item for item in plan if not item.review_required]

{codex_workspace_bootstrap-0.6.1 → codex_workspace_bootstrap-0.7.0}/src/codex_workspace_bootstrap/audit.py

@@ -5,6 +5,7 @@ from pathlib import Path
 import os
 import shutil
 import subprocess
+import sys
 from typing import Iterable
 
 from .agents import detect_node_package_managers
@@ -38,6 +39,9 @@ MANIFESTS = (
     "Cargo.toml",
     "pom.xml",
     "build.gradle",
+    "build.gradle.kts",
+    "settings.gradle",
+    "settings.gradle.kts",
 )
 
 RISK_FILENAMES = {
@@ -50,6 +54,13 @@ RISK_FILENAMES = {
 }
 
 RISK_SUFFIXES = (".pem", ".p12", ".pfx", ".key")
+SAFE_ENV_TEMPLATE_NAMES = {
+    ".env.example",
+    ".env.sample",
+    ".env.template",
+    ".env.dist",
+    ".env.defaults",
+}
 
 NODE_PACKAGE_MANAGER_COMMANDS: dict[str, tuple[str, ...]] = {
     "npm": ("npm", "--version"),
@@ -108,6 +119,28 @@ def _iter_project_files(root: Path) -> Iterable[Path]:
             yield current_path / filename
 
 
+def _git_tracked_files(root: Path) -> set[str] | None:
+    if shutil.which("git") is None:
+        return None
+    try:
+        result = subprocess.run(
+            ("git", "-C", str(root), "ls-files", "-z"),
+            capture_output=True,
+            text=False,
+            timeout=10,
+            check=False,
+        )
+        if result.returncode != 0:
+            return None
+        return {
+            item.decode(sys.getfilesystemencoding(), errors="surrogateescape")
+            for item in result.stdout.split(b"\0")
+            if item
+        }
+    except (OSError, subprocess.SubprocessError):
+        return None
+
+
 def _git_matches(root: Path, args: tuple[str, ...]) -> bool:
     if shutil.which("git") is None:
         return False
@@ -124,13 +157,19 @@ def _git_matches(root: Path, args: tuple[str, ...]) -> bool:
         return False
 
 
-def _classify_risky_paths(root: Path, risky: list[str]) -> tuple[list[str], list[str], list[str]]:
+def _classify_risky_paths(
+    root: Path,
+    risky: list[str],
+    tracked_files: set[str] | None = None,
+) -> tuple[list[str], list[str], list[str]]:
     tracked: list[str] = []
     ignored: list[str] = []
     untracked: list[str] = []
 
     for relative in risky:
-        if _git_matches(root, ("ls-files", "--error-unmatch", "--", relative)):
+        if tracked_files is not None and relative in tracked_files:
+            tracked.append(relative)
+        elif tracked_files is None and _git_matches(root, ("ls-files", "--error-unmatch", "--", relative)):
             tracked.append(relative)
         elif _git_matches(root, ("check-ignore", "--quiet", "--", relative)):
             ignored.append(relative)
@@ -140,6 +179,15 @@ def _classify_risky_paths(root: Path, risky: list[str]) -> tuple[list[str], list
     return tracked, ignored, untracked
 
 
+def _is_risky_filename(name: str) -> bool:
+    lowered = name.lower()
+    if lowered in RISK_FILENAMES or lowered.endswith(RISK_SUFFIXES):
+        return True
+    if lowered.startswith(".env.") and lowered not in SAFE_ENV_TEMPLATE_NAMES:
+        return True
+    return False
+
+
 def _preview(paths: list[str], limit: int = 8) -> str:
     visible = ", ".join(sorted(paths)[:limit])
     suffix = "" if len(paths) <= limit else f" (+{len(paths) - limit} more)"
@@ -220,6 +268,15 @@ def audit_repository(root: Path) -> list[Check]:
         for name in MANIFESTS
         if (root / name).is_file() and not (root / name).is_symlink()
     ]
+    manifests.extend(
+        sorted(
+            path.name
+            for path in root.iterdir()
+            if path.is_file()
+            and not path.is_symlink()
+            and path.suffix.lower() in {".sln", ".csproj", ".fsproj", ".vbproj"}
+        )
+    )
     checks.append(
         Check(
             "project-manifest",
@@ -255,14 +312,29 @@ def audit_repository(root: Path) -> list[Check]:
                 )
             )
 
-    risky: list[str] = []
+    tracked_files = _git_tracked_files(root)
+    risky: set[str] = set()
+
     for path in _iter_project_files(root):
-        name = path.name.lower()
-        if name in RISK_FILENAMES or name.endswith(RISK_SUFFIXES):
-            risky.append(path.relative_to(root).as_posix())
+        if _is_risky_filename(path.name):
+            risky.add(path.relative_to(root).as_posix())
+
+    # Generated/dependency directories are pruned from the filesystem walk to
+    # avoid expensive scans. Tracked files are different: if a risky filename
+    # is committed, it must still be surfaced even inside a pruned directory.
+    if tracked_files is not None:
+        risky.update(
+            relative
+            for relative in tracked_files
+            if _is_risky_filename(Path(relative).name)
+        )
 
     if risky:
-        tracked, ignored, untracked = _classify_risky_paths(root, risky)
+        tracked, ignored, untracked = _classify_risky_paths(
+            root,
+            sorted(risky),
+            tracked_files,
+        )
         parts: list[str] = []
         if tracked:
             parts.append(f"tracked: {_preview(tracked)}")

{codex_workspace_bootstrap-0.6.1 → codex_workspace_bootstrap-0.7.0}/src/codex_workspace_bootstrap/cli.py

@@ -41,6 +41,11 @@ def _parser() -> argparse.ArgumentParser:
         action="store_true",
         help="Return a non-zero exit code when AI instruction integrity findings are present",
     )
+    preflight.add_argument(
+        "--require-ready",
+        action="store_true",
+        help="Return a non-zero exit code unless the preflight state is READY",
+    )
 
     fix = sub.add_parser("fix", help="Preview safe repository-readiness fixes")
     fix.add_argument("path", nargs="?", default=".")
@@ -85,6 +90,7 @@ def _run_preflight(
     sarif_path: str | None,
     strict: bool,
     fail_on_integrity: bool,
+    require_ready: bool,
 ) -> int:
     root = Path(path).expanduser().resolve()
     if not root.exists() or not root.is_dir():
@@ -161,6 +167,8 @@ def _run_preflight(
         return 1
     if fail_on_integrity and report["instruction_summary"]["findings"]:
         return 1
+    if require_ready and report["state"] != "READY":
+        return 1
     return 0
 
 
@@ -292,6 +300,7 @@ def main(argv: list[str] | None = None) -> int:
             args.sarif_path,
             args.strict,
             args.fail_on_integrity,
+            args.require_ready,
         )
     if args.command == "fix":
         return _run_fix(args.path, args.apply)

{codex_workspace_bootstrap-0.6.1 → codex_workspace_bootstrap-0.7.0}/src/codex_workspace_bootstrap/instructions.py

@@ -148,15 +148,108 @@ def _frontmatter_value(text: str, keys: tuple[str, ...]) -> str | None:
     return None
 
 
+def _split_top_level_commas(value: str) -> list[str]:
+    items: list[str] = []
+    current: list[str] = []
+    quote: str | None = None
+    escaped = False
+    braces = 0
+    brackets = 0
+    parens = 0
+
+    for char in value:
+        if escaped:
+            current.append(char)
+            escaped = False
+            continue
+
+        if char == "\\":
+            current.append(char)
+            escaped = True
+            continue
+
+        if quote:
+            current.append(char)
+            if char == quote:
+                quote = None
+            continue
+
+        if char in {"'", '"'}:
+            quote = char
+            current.append(char)
+            continue
+
+        if char == "{":
+            braces += 1
+        elif char == "}":
+            braces = max(0, braces - 1)
+        elif char == "[":
+            brackets += 1
+        elif char == "]":
+            brackets = max(0, brackets - 1)
+        elif char == "(":
+            parens += 1
+        elif char == ")":
+            parens = max(0, parens - 1)
+
+        if char == "," and braces == 0 and brackets == 0 and parens == 0:
+            item = "".join(current).strip()
+            if item:
+                items.append(item)
+            current = []
+            continue
+
+        current.append(char)
+
+    item = "".join(current).strip()
+    if item:
+        items.append(item)
+    return items
+
+
+def _strip_matching_quotes(value: str) -> str:
+    value = value.strip()
+    if len(value) >= 2 and value[0] == value[-1] and value[0] in {"'", '"'}:
+        return value[1:-1].strip()
+    return value
+
+
 def _split_patterns(value: str) -> list[str]:
-    value = value.strip().strip('"').strip("'")
+    value = value.strip()
+
+    # Inline YAML arrays are common, but a glob character class such as [ab]
+    # is also valid. Only treat brackets as an array when the interior looks
+    # list-like.
     if value.startswith("[") and value.endswith("]"):
-        value = value[1:-1]
-    return [
-        item.strip().strip('"').strip("'")
-        for item in value.split(",")
-        if item.strip().strip('"').strip("'")
-    ]
+        inner = value[1:-1].strip()
+        if "," in inner or inner.startswith(("'", '"')):
+            value = inner
+
+    raw_items = _split_top_level_commas(value)
+    patterns: list[str] = []
+
+    for raw in raw_items:
+        item = _strip_matching_quotes(raw)
+        if not item:
+            continue
+
+        # Copilot commonly wraps alternatives in one quoted brace expression:
+        # "{src/**/test/**,src/**/*.test.ts}". Expand only a brace that wraps
+        # the whole selector; embedded brace expansion stays intact so
+        # apps/web/{src,tests}/** still has static prefix apps/web.
+        if item.startswith("{") and item.endswith("}"):
+            alternatives = [
+                _strip_matching_quotes(part)
+                for part in _split_top_level_commas(item[1:-1])
+            ]
+            alternatives = [part for part in alternatives if part]
+            if len(alternatives) > 1:
+                patterns.extend(alternatives)
+                continue
+
+        patterns.append(item)
+
+    return patterns
 
 
 def _static_prefix(pattern: str) -> str:

{codex_workspace_bootstrap-0.6.1 → codex_workspace_bootstrap-0.7.0}/src/codex_workspace_bootstrap/preflight.py

@@ -171,6 +171,23 @@ def build_preflight(root: Path) -> dict[str, object]:
     checks = audit_repository(root)
     instructions = detect_instruction_signals(root)
     instruction_findings = lint_instructions(root, instructions)
+
+    root_manager_conflict = any(
+        check.name == "package-manager-evidence"
+        and check.status != "pass"
+        and check.message.startswith("Conflicting Node.js package-manager evidence")
+        for check in checks
+    )
+    if root_manager_conflict:
+        instruction_findings = [
+            finding
+            for finding in instruction_findings
+            if not (
+                finding.kind == "package-manager-evidence-conflict"
+                and finding.scope == "."
+            )
+        ]
+
     instruction_totals = finding_summary(instruction_findings)
     projects = detect_project_signals(root)
     totals = summary(checks)

{codex_workspace_bootstrap-0.6.1 → codex_workspace_bootstrap-0.7.0/src/codex_workspace_bootstrap.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codex-workspace-bootstrap
-Version: 0.6.1
+Version: 0.7.0
 Summary: Preflight AI coding repositories before Codex, Copilot, Cline, Claude, Gemini, Continue, or Cursor touches them.
 Author: kohli217
 License: MIT
@@ -123,7 +123,7 @@ The goal is not a vanity score. The result is one of:
 - README
 - license
 - `.gitignore`
-- common project manifests
+- common project manifests, including Python, Node.js, Go, Rust, JVM, and .NET roots
 - local Git / Python / Node.js / repository-selected package manager / PowerShell / WSL / Codex signals
 
 ### AI instruction coverage
@@ -153,7 +153,7 @@ The lint is intentionally conservative: different files may contain additional c
 
 ### Risk signals
 
-The audit warns about common secret-bearing filenames without printing their contents. When Git is available, it distinguishes **tracked**, **ignored**, and **untracked/unknown** candidates. Tracked risky filenames can become blocking findings in strict mode.
+The audit warns about common secret-bearing filenames without printing their contents, including environment-specific `.env.*` files while excluding common template names such as `.env.example` and `.env.sample`. When Git is available, it distinguishes **tracked**, **ignored**, and **untracked/unknown** candidates. Tracked risky filenames can become blocking findings in strict mode.
 
 This is intentionally a lightweight preflight check, not a replacement for deep scanners such as Gitleaks or Trivy.
 
@@ -211,6 +211,14 @@ Fail CI on any instruction-integrity finding:
 cwb preflight . --fail-on-integrity
 ```
 
+Require the full preflight state to be `READY`:
+
+```powershell
+cwb preflight . --require-ready
+```
+
+Use `--require-ready` when CI should reject both `NEEDS ATTENTION` and `BLOCKED`, including missing repository-wide AI instructions or essential repository markers.
+
 ### Detailed audit
 
 ```powershell
@@ -248,7 +256,7 @@ cwb doctor .
 cwb init-agents .
 ```
 
-Generation is evidence-based: the tool cross-checks project manifests, package-manager evidence, package scripts, pytest configuration, and README commands. Plausible but unconfirmed commands are separated for maintainer review. Existing `AGENTS.md` files are never overwritten unless `--force` is explicit.
+Generation is evidence-based: the tool identifies common Python, Node.js, Go, Rust, JVM, and .NET project roots, then only emits validation commands that have direct repository evidence. Python/Node-specific validation is cross-checked against package-manager evidence, package scripts, pytest configuration, and README commands. Plausible but unconfirmed commands are separated for maintainer review. Existing `AGENTS.md` files are never overwritten unless `--force` is explicit.
 
 ## GitHub Action
 
@@ -259,11 +267,12 @@ The reusable Action is published on GitHub Marketplace.
 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
   with:
     python-version: "3.13"
-- uses: kohli217/codex-workspace-bootstrap@v0.6.1
+- uses: kohli217/codex-workspace-bootstrap@v0.7.0
   with:
     path: .
     strict: "true"
     fail_on_integrity: "true"
+    require_ready: "true"
 ```
 
 The Action adds the preflight Markdown report to the **GitHub Actions job summary**, so maintainers get a readable readiness snapshot without digging through raw logs. Optional SARIF output contains both repository-audit and instruction-integrity findings and can be uploaded to GitHub Code Scanning.
@@ -325,7 +334,7 @@ py -m pip install codex-workspace-bootstrap
 Pinned GitHub release artifact:
 
 ```powershell
-py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.6.1/codex_workspace_bootstrap-0.6.1-py3-none-any.whl"
+py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.7.0/codex_workspace_bootstrap-0.7.0-py3-none-any.whl"
 ```
 
 ## Development

{codex_workspace_bootstrap-0.6.1 → codex_workspace_bootstrap-0.7.0}/tests/test_audit.py

@@ -4,7 +4,7 @@ import subprocess
 
 import pytest
 
-from codex_workspace_bootstrap.audit import audit_repository, summary
+from codex_workspace_bootstrap.audit import _git_tracked_files, audit_repository, summary
 
 
 def _git(root: Path, *args: str) -> None:
@@ -206,3 +206,119 @@ def test_audit_does_not_accept_symlinked_repository_markers(
     assert by_name["gitignore"].status == "warn"
     assert by_name["agents"].status == "warn"
     assert by_name["project-manifest"].status == "warn"
+
+
+@pytest.mark.skipif(shutil.which("git") is None, reason="git is required")
+def test_tracked_risky_file_inside_pruned_directory_is_blocking(tmp_path: Path) -> None:
+    _git(tmp_path, "init")
+    nested = tmp_path / "node_modules" / "pkg"
+    nested.mkdir(parents=True)
+    (nested / ".env").write_text("EXAMPLE=tracked\n", encoding="utf-8")
+    _git(tmp_path, "add", "-f", "node_modules/pkg/.env")
+
+    checks = audit_repository(tmp_path)
+    by_name = {check.name: check for check in checks}
+
+    risk = by_name["secret-risk-files"]
+    assert risk.status == "warn"
+    assert risk.blocking is True
+    assert "node_modules/pkg/.env" in risk.message
+    assert "tracked:" in risk.message
+
+
+@pytest.mark.skipif(shutil.which("git") is None, reason="git is required")
+def test_tracked_risky_file_inside_dist_is_blocking(tmp_path: Path) -> None:
+    _git(tmp_path, "init")
+    dist = tmp_path / "dist"
+    dist.mkdir()
+    (dist / "release.key").write_text("not-a-real-key\n", encoding="utf-8")
+    _git(tmp_path, "add", "-f", "dist/release.key")
+
+    checks = audit_repository(tmp_path)
+    by_name = {check.name: check for check in checks}
+
+    risk = by_name["secret-risk-files"]
+    assert risk.blocking is True
+    assert "dist/release.key" in risk.message
+
+
+@pytest.mark.parametrize(
+    "filename",
+    [
+        "build.gradle.kts",
+        "settings.gradle",
+        "settings.gradle.kts",
+        "demo.sln",
+        "demo.csproj",
+        "demo.fsproj",
+        "demo.vbproj",
+    ],
+)
+def test_audit_recognizes_extended_project_manifests(tmp_path: Path, filename: str) -> None:
+    (tmp_path / filename).write_text("marker\n", encoding="utf-8")
+
+    checks = audit_repository(tmp_path)
+    by_name = {check.name: check for check in checks}
+
+    assert by_name["project-manifest"].status == "pass"
+    assert filename in by_name["project-manifest"].message
+
+
+@pytest.mark.parametrize(
+    "filename",
+    [
+        ".env.production",
+        ".env.development.local",
+        ".env.test",
+        ".env.staging",
+    ],
+)
+def test_audit_warns_on_environment_specific_secret_risk_files(
+    tmp_path: Path,
+    filename: str,
+) -> None:
+    (tmp_path / filename).write_text("TOKEN=not-a-real-secret\n", encoding="utf-8")
+
+    checks = audit_repository(tmp_path)
+    by_name = {check.name: check for check in checks}
+
+    risk = by_name["secret-risk-files"]
+    assert risk.status == "warn"
+    assert filename in risk.message
+
+
+@pytest.mark.parametrize(
+    "filename",
+    [
+        ".env.example",
+        ".env.sample",
+        ".env.template",
+        ".env.dist",
+        ".env.defaults",
+    ],
+)
+def test_audit_does_not_flag_common_env_templates(tmp_path: Path, filename: str) -> None:
+    (tmp_path / filename).write_text("TOKEN=replace-me\n", encoding="utf-8")
+
+    checks = audit_repository(tmp_path)
+    by_name = {check.name: check for check in checks}
+
+    assert by_name["secret-risk-files"].status == "pass"
+
+
+def test_git_tracked_files_uses_surrogateescape_for_path_bytes(
+    tmp_path: Path,
+    monkeypatch,
+) -> None:
+    class Result:
+        returncode = 0
+        stdout = b"normal.txt\0invalid-\xff.env\0"
+
+    monkeypatch.setattr(shutil, "which", lambda name: "/usr/bin/git")
+    monkeypatch.setattr(subprocess, "run", lambda *args, **kwargs: Result())
+
+    tracked = _git_tracked_files(tmp_path)
+
+    assert tracked is not None
+    assert "normal.txt" in tracked
+    assert any(name.endswith(".env") for name in tracked)

{codex_workspace_bootstrap-0.6.1 → codex_workspace_bootstrap-0.7.0}/tests/test_cli.py

@@ -11,7 +11,7 @@ def test_init_agents_creates_file(tmp_path: Path) -> None:
     code = main(["init-agents", str(tmp_path)])
     assert code == 0
     content = (tmp_path / "AGENTS.md").read_text(encoding="utf-8")
-    assert "No common Python or Node.js manifest detected" in content
+    assert "No supported project manifest detected" in content
 
 
 def test_init_agents_generates_python_validation(tmp_path: Path) -> None:
@@ -101,7 +101,7 @@ def test_version_flag_reports_package_version(capsys: pytest.CaptureFixture[str]
         main(["--version"])
 
     assert exc_info.value.code == 0
-    assert "codex-workspace-bootstrap 0.6.1" in capsys.readouterr().out
+    assert "codex-workspace-bootstrap 0.7.0" in capsys.readouterr().out
 
 
 def test_audit_writes_sarif(tmp_path: Path) -> None:
@@ -296,6 +296,67 @@ def test_init_agents_ignores_symlinked_project_markers(
 
     assert code == 0
     content = (tmp_path / "AGENTS.md").read_text(encoding="utf-8")
-    assert "No common Python or Node.js manifest detected" in content
+    assert "No supported project manifest detected" in content
     assert "python -m pytest" not in content
     assert "pnpm run test" not in content
+
+
+@pytest.mark.parametrize(
+    ("filename", "expected_signal"),
+    [
+        ("go.mod", "Go"),
+        ("Cargo.toml", "Rust"),
+        ("build.gradle.kts", "JVM"),
+        ("demo.sln", ".NET"),
+    ],
+)
+def test_init_agents_reports_common_project_signal_without_inventing_commands(
+    tmp_path: Path,
+    filename: str,
+    expected_signal: str,
+) -> None:
+    (tmp_path / filename).write_text("marker\n", encoding="utf-8")
+
+    code = main(["init-agents", str(tmp_path)])
+
+    assert code == 0
+    content = (tmp_path / "AGENTS.md").read_text(encoding="utf-8")
+    assert expected_signal in content
+    assert "No supported project manifest detected" not in content
+    for unsupported_guess in ("go test", "cargo test", "gradle test", "dotnet test"):
+        assert unsupported_guess not in content
+
+
+@pytest.mark.skipif(shutil.which("git") is None, reason="git is required")
+def test_preflight_require_ready_fails_for_needs_attention(tmp_path: Path) -> None:
+    subprocess.run(
+        ("git", "-C", str(tmp_path), "init"),
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+    (tmp_path / "README.md").write_text("# demo\n", encoding="utf-8")
+    (tmp_path / ".gitignore").write_text(".venv/\n", encoding="utf-8")
+    (tmp_path / "pyproject.toml").write_text("[project]\nname='demo'\n", encoding="utf-8")
+
+    code = main(["preflight", str(tmp_path), "--require-ready"])
+
+    assert code == 1
+
+
+@pytest.mark.skipif(shutil.which("git") is None, reason="git is required")
+def test_preflight_require_ready_succeeds_for_ready_repository(tmp_path: Path) -> None:
+    subprocess.run(
+        ("git", "-C", str(tmp_path), "init"),
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+    (tmp_path / "README.md").write_text("# demo\n", encoding="utf-8")
+    (tmp_path / ".gitignore").write_text(".venv/\n", encoding="utf-8")
+    (tmp_path / "pyproject.toml").write_text("[project]\nname='demo'\n", encoding="utf-8")
+    (tmp_path / "AGENTS.md").write_text("# agents\n", encoding="utf-8")
+
+    code = main(["preflight", str(tmp_path), "--require-ready"])
+
+    assert code == 0

{codex_workspace_bootstrap-0.6.1 → codex_workspace_bootstrap-0.7.0}/tests/test_instruction_integrity.py

@@ -811,3 +811,25 @@ def test_yarn_workspace_command_validates_real_script_name(tmp_path: Path) -> No
 
     assert not any(item.kind == "missing-package-script" for item in findings)
     assert not any(item.kind == "package-manager-mismatch" for item in findings)
+
+
+def test_embedded_brace_glob_keeps_parent_static_scope(tmp_path: Path) -> None:
+    directory = tmp_path / ".github" / "instructions"
+    directory.mkdir(parents=True)
+    (directory / "web.instructions.md").write_text(
+        "---\n"
+        'applyTo: "apps/web/{src,tests}/**/*.ts"\n'
+        "---\n"
+        "Use web validation.\n",
+        encoding="utf-8",
+    )
+
+    signals = detect_instruction_signals(tmp_path)
+    signal = next(
+        item
+        for item in signals
+        if item.path == ".github/instructions/web.instructions.md"
+    )
+
+    assert signal.kind == "path-specific"
+    assert signal.scope == "apps/web"

{codex_workspace_bootstrap-0.6.1 → codex_workspace_bootstrap-0.7.0}/tests/test_preflight.py

@@ -216,3 +216,82 @@ def test_next_actions_prioritizes_conflicting_package_manager_evidence() -> None
         and item.title == "Resolve conflicting repository package-manager evidence"
         for item in actions
     )
+
+
+def test_build_preflight_deduplicates_root_package_manager_conflict(
+    tmp_path: Path,
+    monkeypatch,
+) -> None:
+    (tmp_path / "package.json").write_text(
+        '{"packageManager":"pnpm@10","scripts":{"test":"vitest"}}',
+        encoding="utf-8",
+    )
+    (tmp_path / "package-lock.json").write_text("{}", encoding="utf-8")
+    (tmp_path / "AGENTS.md").write_text("Run §pnpm test§.\n".replace("§", "`"), encoding="utf-8")
+
+    def fake_tool_check(label: str, command: tuple[str, ...]):
+        return Check(label, "pass", "available")
+
+    monkeypatch.setattr("codex_workspace_bootstrap.audit._tool_check", fake_tool_check)
+
+    report = build_preflight(tmp_path)
+
+    audit_conflicts = [
+        item
+        for item in report["checks"]
+        if item["name"] == "package-manager-evidence"
+        and item["message"].startswith("Conflicting Node.js package-manager evidence")
+    ]
+    instruction_conflicts = [
+        item
+        for item in report["instruction_findings"]
+        if item["kind"] == "package-manager-evidence-conflict"
+        and item["scope"] == "."
+    ]
+    conflict_actions = [
+        item
+        for item in report["next_actions"]
+        if "package-manager" in item["title"].lower()
+        and "conflict" in item["title"].lower()
+    ]
+
+    assert len(audit_conflicts) == 1
+    assert instruction_conflicts == []
+    assert len(conflict_actions) == 1
+
+
+def test_build_preflight_keeps_nested_package_manager_conflict(
+    tmp_path: Path,
+    monkeypatch,
+) -> None:
+    (tmp_path / "package.json").write_text(
+        '{"packageManager":"npm@11","scripts":{"test":"vitest"}}',
+        encoding="utf-8",
+    )
+    (tmp_path / "package-lock.json").write_text("{}", encoding="utf-8")
+    (tmp_path / "AGENTS.md").write_text("Run §npm test§.\n".replace("§", "`"), encoding="utf-8")
+
+    nested = tmp_path / "apps" / "web"
+    nested.mkdir(parents=True)
+    (nested / "package.json").write_text(
+        '{"packageManager":"pnpm@10","scripts":{"test":"vitest"}}',
+        encoding="utf-8",
+    )
+    (nested / "package-lock.json").write_text("{}", encoding="utf-8")
+    (nested / "AGENTS.md").write_text("Run §pnpm test§.\n".replace("§", "`"), encoding="utf-8")
+
+    def fake_tool_check(label: str, command: tuple[str, ...]):
+        return Check(label, "pass", "available")
+
+    monkeypatch.setattr("codex_workspace_bootstrap.audit._tool_check", fake_tool_check)
+
+    report = build_preflight(tmp_path)
+
+    nested_conflicts = [
+        item
+        for item in report["instruction_findings"]
+        if item["kind"] == "package-manager-evidence-conflict"
+        and item["scope"] == "apps/web"
+    ]
+
+    assert len(nested_conflicts) == 1

{codex_workspace_bootstrap-0.6.1 → codex_workspace_bootstrap-0.7.0}/tests/test_public_repo_patterns.py

@@ -1,7 +1,7 @@
 from pathlib import Path
 import json
 
-from codex_workspace_bootstrap.instructions import lint_instructions
+from codex_workspace_bootstrap.instructions import detect_instruction_signals, lint_instructions
 
 
 def test_public_pattern_openai_codex_pnpm_repo_without_js_command_drift(tmp_path: Path) -> None:
@@ -70,3 +70,27 @@ def test_public_pattern_continue_gradle_rule_does_not_conflict_with_root_npm(tmp
     )
 
     assert lint_instructions(tmp_path) == []
+
+
+def test_public_pattern_vscode_brace_wrapped_apply_to_keeps_static_scope(tmp_path: Path) -> None:
+    """Pattern observed in microsoft/vscode: brace-wrapped Copilot applyTo alternatives."""
+    directory = tmp_path / ".github" / "instructions"
+    directory.mkdir(parents=True)
+    (directory / "writing-tests.instructions.md").write_text(
+        "---\n"
+        "description: Test guidance\n"
+        'applyTo: "{src/vs/**/test/**,src/vs/**/*.test.ts,src/vs/**/*.integrationTest.ts}"\n'
+        "---\n"
+        "# Writing Tests\n",
+        encoding="utf-8",
+    )
+
+    signals = detect_instruction_signals(tmp_path)
+    signal = next(
+        item
+        for item in signals
+        if item.path == ".github/instructions/writing-tests.instructions.md"
+    )
+
+    assert signal.kind == "path-specific"
+    assert signal.scope == "src/vs"

{codex_workspace_bootstrap-0.6.1 → codex_workspace_bootstrap-0.7.0}/tests/test_release_consistency.py

@@ -47,3 +47,39 @@ def test_documented_third_party_actions_are_sha_pinned() -> None:
                 f"{relative} documents mutable ref {action}@{ref}; "
                 "pin third-party actions to a full commit SHA"
             )
+
+
+def test_pypi_auto_publish_uses_triggering_release_artifact() -> None:
+    release = (ROOT / ".github" / "workflows" / "release.yml").read_text(encoding="utf-8")
+    publish = (ROOT / ".github" / "workflows" / "pypi-publish.yml").read_text(encoding="utf-8")
+
+    assert "name: python-package-distributions" in release
+    assert "dist/*.whl" in release
+    assert "dist/*.tar.gz" in release
+    assert "python -m twine check dist/*" in release
+
+    assert "github.event.workflow_run.id" in publish
+    assert "github-token: ${{ github.token }}" in publish
+    assert "Download exact distributions from triggering Release run" in publish
+    assert "gh release view" not in publish
+
+
+def test_release_documentation_matches_attestation_permissions() -> None:
+    docs = (ROOT / "docs" / "RELEASING.md").read_text(encoding="utf-8")
+
+    for permission in (
+        "contents: write",
+        "id-token: write",
+        "attestations: write",
+        "artifact-metadata: write",
+    ):
+        assert f"`{permission}`" in docs
+
+
+def test_powershell_installer_default_matches_package_version() -> None:
+    version = _project_version()
+    installer = (ROOT / "scripts" / "install.ps1").read_text(encoding="utf-8")
+
+    assert f'[string]$Version = "{version}"' in installer
+    assert "releases/download/v$Version/codex_workspace_bootstrap-$Version-py3-none-any.whl" in installer
+    assert 'Write-Host "  cwb preflight ."' in installer