codex-workspace-bootstrap 0.8.0__tar.gz → 0.9.0__tar.gz

{codex_workspace_bootstrap-0.8.0/src/codex_workspace_bootstrap.egg-info → codex_workspace_bootstrap-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codex-workspace-bootstrap
-Version: 0.8.0
+Version: 0.9.0
 Summary: Preflight AI coding repositories before Codex, Copilot, Cline, Claude, Gemini, Continue, or Cursor touches them.
 Author: kohli217
 License: MIT
@@ -288,7 +288,7 @@ The reusable Action is published on GitHub Marketplace.
 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
   with:
     python-version: "3.13"
-- uses: kohli217/codex-workspace-bootstrap@v0.8.0
+- uses: kohli217/codex-workspace-bootstrap@v0.9.0
   with:
     path: .
     strict: "true"
@@ -304,9 +304,11 @@ Read-only evaluations against real public repositories are documented in [docs/P
 
 ## GitHub App
 
+**Public App:** [CWB Preflight](https://github.com/apps/cwb-preflight) · [Install](https://github.com/apps/cwb-preflight/installations/new)
+
 For public OSS repositories, CWB can also run as a self-hosted GitHub App. A verified `push` or `pull_request` event triggers repository-only preflight against the exact event revision and publishes a **CWB Preflight** Check Run on that commit.
 
-The preferred zero-cost development deployment uses:
+The verified zero-cost public-OSS deployment uses:
 
 ```text
 GitHub App
@@ -320,7 +322,9 @@ This path does not require a Google Cloud billing account. It is intentionally *
 
 The App keeps the minimum repository permissions documented by the project: Checks read/write, Contents read-only, and Pull requests read-only.
 
-See [docs/GITHUB_APP.md](docs/GITHUB_APP.md) for the integration contract and [deploy/cloudflare/README.md](deploy/cloudflare/README.md) for the completely free development deployment.
+The current public App has been revalidated after promotion: the renamed `CWB Preflight` App produced a successful `READY` Check Run through the full Cloudflare → Queue → GitHub Actions → installation-token → exact-revision checkout path.
+
+See [docs/GITHUB_APP.md](docs/GITHUB_APP.md) for the integration contract and [deploy/cloudflare/README.md](deploy/cloudflare/README.md) for the completely free deployment.
 
 ## Integration boundary
 
@@ -347,7 +351,7 @@ The intent is to complement those tools, not replace them.
 - Suspected secret files are not opened or printed by the filename-risk check.
 - Repository contents are not sent to a remote AI service by the core audit.
 - Instruction files are read locally for deterministic linting; extracted commands are never executed by the integrity lint.
-- Repository instruction/configuration and project-marker inputs are not trusted through symbolic links.
+- Repository instruction/configuration and project-marker contents are not trusted through symbolic links. CWB may recognize the exact lexical aliases `CLAUDE.md -> AGENTS.md` and `GEMINI.md -> AGENTS.md` (or `./AGENTS.md`) only when the sibling `AGENTS.md` is a regular file; linting reads that regular file directly rather than following either link. Gemini aliases are recognized only when `GEMINI.md` is an effective Gemini context filename.
 - `init-agents` and automatic fixes refuse symlinked `AGENTS.md` targets rather than writing through them.
 - Existing regular `AGENTS.md` files are protected unless overwrite is explicit.
 - A passing preflight is evidence about the checks performed, **not a security guarantee**.
@@ -381,7 +385,7 @@ py -m pip install codex-workspace-bootstrap
 Pinned GitHub release artifact:
 
 ```powershell
-py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.8.0/codex_workspace_bootstrap-0.8.0-py3-none-any.whl"
+py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.9.0/codex_workspace_bootstrap-0.9.0-py3-none-any.whl"
 ```
 
 ## Development

{codex_workspace_bootstrap-0.8.0 → codex_workspace_bootstrap-0.9.0}/README.md

@@ -260,7 +260,7 @@ The reusable Action is published on GitHub Marketplace.
 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
   with:
     python-version: "3.13"
-- uses: kohli217/codex-workspace-bootstrap@v0.8.0
+- uses: kohli217/codex-workspace-bootstrap@v0.9.0
   with:
     path: .
     strict: "true"
@@ -276,9 +276,11 @@ Read-only evaluations against real public repositories are documented in [docs/P
 
 ## GitHub App
 
+**Public App:** [CWB Preflight](https://github.com/apps/cwb-preflight) · [Install](https://github.com/apps/cwb-preflight/installations/new)
+
 For public OSS repositories, CWB can also run as a self-hosted GitHub App. A verified `push` or `pull_request` event triggers repository-only preflight against the exact event revision and publishes a **CWB Preflight** Check Run on that commit.
 
-The preferred zero-cost development deployment uses:
+The verified zero-cost public-OSS deployment uses:
 
 ```text
 GitHub App
@@ -292,7 +294,9 @@ This path does not require a Google Cloud billing account. It is intentionally *
 
 The App keeps the minimum repository permissions documented by the project: Checks read/write, Contents read-only, and Pull requests read-only.
 
-See [docs/GITHUB_APP.md](docs/GITHUB_APP.md) for the integration contract and [deploy/cloudflare/README.md](deploy/cloudflare/README.md) for the completely free development deployment.
+The current public App has been revalidated after promotion: the renamed `CWB Preflight` App produced a successful `READY` Check Run through the full Cloudflare → Queue → GitHub Actions → installation-token → exact-revision checkout path.
+
+See [docs/GITHUB_APP.md](docs/GITHUB_APP.md) for the integration contract and [deploy/cloudflare/README.md](deploy/cloudflare/README.md) for the completely free deployment.
 
 ## Integration boundary
 
@@ -319,7 +323,7 @@ The intent is to complement those tools, not replace them.
 - Suspected secret files are not opened or printed by the filename-risk check.
 - Repository contents are not sent to a remote AI service by the core audit.
 - Instruction files are read locally for deterministic linting; extracted commands are never executed by the integrity lint.
-- Repository instruction/configuration and project-marker inputs are not trusted through symbolic links.
+- Repository instruction/configuration and project-marker contents are not trusted through symbolic links. CWB may recognize the exact lexical aliases `CLAUDE.md -> AGENTS.md` and `GEMINI.md -> AGENTS.md` (or `./AGENTS.md`) only when the sibling `AGENTS.md` is a regular file; linting reads that regular file directly rather than following either link. Gemini aliases are recognized only when `GEMINI.md` is an effective Gemini context filename.
 - `init-agents` and automatic fixes refuse symlinked `AGENTS.md` targets rather than writing through them.
 - Existing regular `AGENTS.md` files are protected unless overwrite is explicit.
 - A passing preflight is evidence about the checks performed, **not a security guarantee**.
@@ -353,7 +357,7 @@ py -m pip install codex-workspace-bootstrap
 Pinned GitHub release artifact:
 
 ```powershell
-py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.8.0/codex_workspace_bootstrap-0.8.0-py3-none-any.whl"
+py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.9.0/codex_workspace_bootstrap-0.9.0-py3-none-any.whl"
 ```
 
 ## Development

{codex_workspace_bootstrap-0.8.0 → codex_workspace_bootstrap-0.9.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "codex-workspace-bootstrap"
-version = "0.8.0"
+version = "0.9.0"
 description = "Preflight AI coding repositories before Codex, Copilot, Cline, Claude, Gemini, Continue, or Cursor touches them."
 readme = "README.md"
 requires-python = ">=3.10"

{codex_workspace_bootstrap-0.8.0 → codex_workspace_bootstrap-0.9.0}/src/codex_workspace_bootstrap/__init__.py

@@ -1,3 +1,3 @@
 """codex-workspace-bootstrap package."""
 
-__version__ = "0.8.0"
+__version__ = "0.9.0"

{codex_workspace_bootstrap-0.8.0 → codex_workspace_bootstrap-0.9.0}/src/codex_workspace_bootstrap/instructions.py

@@ -81,8 +81,8 @@ _COMMAND_PATTERNS: tuple[re.Pattern[str], ...] = (
     re.compile(r"\bpython\s+-m\s+pytest(?:\s+[^\n`]+)?", re.I),
     re.compile(r"(?<![\w.-])pytest(?:\s+[^\n`]+)?", re.I),
     re.compile(r"\bpython\s+-m\s+unittest(?:\s+[^\n`]+)?", re.I),
-    re.compile(r"\b(?:npm|pnpm|bun)\s+(?:run\s+)?[\w:.-]+(?:\s+[^\n`]+)?", re.I),
-    re.compile(r"\byarn\s+(?:run\s+)?[\w:.-]+(?:\s+[^\n`]+)?", re.I),
+    re.compile(r"\b(?:npm|pnpm|bun)\s+(?:run\s+)?[\w:./=@-]+(?:\s+[^\n`]+)?", re.I),
+    re.compile(r"\byarn\s+(?:run\s+)?[\w:./=@-]+(?:\s+[^\n`]+)?", re.I),
     re.compile(r"\bgo\s+test(?:\s+[^\n`]+)?", re.I),
     re.compile(r"\bcargo\s+test(?:\s+[^\n`]+)?", re.I),
     re.compile(r"(?<![\w.-])(?:make|just)\s+[\w:.-]+(?:\s+[^\n`]+)?", re.I),
@@ -308,6 +308,23 @@ def _agent_signals(root: Path) -> list[InstructionSignal]:
     return found
 
 
+def _safe_sibling_instruction_alias(path: Path, target_name: str) -> Path | None:
+    if not path.is_symlink():
+        return None
+    try:
+        lexical_target = path.readlink().as_posix()
+    except OSError:
+        return None
+
+    if lexical_target not in {target_name, f"./{target_name}"}:
+        return None
+
+    target = path.parent / target_name
+    if target.is_symlink() or not target.is_file():
+        return None
+    return target
+
+
 def _hierarchical_named_signals(
     root: Path,
     filename: str,
@@ -327,8 +344,38 @@ def _hierarchical_named_signals(
     return found
 
 
+def _safe_alias_signals(
+    root: Path,
+    alias_name: str,
+    target_name: str,
+    tool: str,
+) -> list[InstructionSignal]:
+    found: list[InstructionSignal] = []
+    for directory, _dirnames, filenames in _walk_repository(root):
+        if alias_name not in filenames:
+            continue
+        alias = directory / alias_name
+        if _safe_sibling_instruction_alias(alias, target_name) is None:
+            continue
+
+        rel = alias.relative_to(root).as_posix()
+        scope_path = directory.relative_to(root).as_posix()
+        scope = "." if scope_path == "." else scope_path
+        found.append(InstructionSignal(tool, rel, scope, "alias"))
+    return found
+
+
 def _claude_signals(root: Path) -> list[InstructionSignal]:
-    return _hierarchical_named_signals(root, "CLAUDE.md", "Claude Code")
+    found = _hierarchical_named_signals(root, "CLAUDE.md", "Claude Code")
+    found.extend(
+        _safe_alias_signals(
+            root,
+            "CLAUDE.md",
+            "AGENTS.md",
+            "Claude Code",
+        )
+    )
+    return found
 
 
 def _gemini_context_filenames(root: Path) -> tuple[str, ...]:
@@ -375,8 +422,19 @@ def _gemini_context_filenames(root: Path) -> tuple[str, ...]:
 
 def _gemini_signals(root: Path) -> list[InstructionSignal]:
     found: list[InstructionSignal] = []
-    for filename in _gemini_context_filenames(root):
+    filenames = _gemini_context_filenames(root)
+    for filename in filenames:
         found.extend(_hierarchical_named_signals(root, filename, "Gemini CLI"))
+
+    if "GEMINI.md" in filenames:
+        found.extend(
+            _safe_alias_signals(
+                root,
+                "GEMINI.md",
+                "AGENTS.md",
+                "Gemini CLI",
+            )
+        )
     return found
 
 
@@ -512,7 +570,20 @@ def detect_instruction_signals(root: Path) -> list[InstructionSignal]:
 
 
 def _read_instruction(root: Path, signal: InstructionSignal) -> str:
-    return _safe_read(root / signal.path)
+    path = root / signal.path
+    if signal.kind == "alias":
+        alias_targets = {
+            ("Claude Code", "CLAUDE.md"): "AGENTS.md",
+            ("Gemini CLI", "GEMINI.md"): "AGENTS.md",
+        }
+        target_name = alias_targets.get((signal.tool, path.name))
+        if target_name is None:
+            return ""
+        target = _safe_sibling_instruction_alias(path, target_name)
+        if target is None:
+            return ""
+        return _safe_read(target)
+    return _safe_read(path)
 
 
 def _command_regions(text: str) -> list[str]:
@@ -684,12 +755,249 @@ def _repo_package_managers(root: Path, scope: str) -> set[str]:
     return set()
 
 
-def _script_names(root: Path, scope: str) -> set[str]:
+def _script_names(root: Path, scope: str) -> set[str] | None:
     for directory in _directory_chain_to_root(root, scope):
-        _managers, scripts = _package_evidence_at(directory)
-        if scripts or (directory / "package.json").is_file():
+        package_path = directory / "package.json"
+        if package_path.is_file() and not package_path.is_symlink():
+            _managers, scripts = _package_evidence_at(directory)
             return scripts
-    return set()
+    return None
+
+
+def _workspace_target_for_command(command: str) -> tuple[bool, str | None]:
+    tokens = _package_command_tokens(command.strip())
+    if not tokens:
+        return False, None
+
+    manager = tokens[0].lower()
+    if manager not in {"npm", "pnpm", "yarn", "bun"}:
+        return False, None
+
+    if manager == "yarn" and len(tokens) >= 3 and tokens[1] == "workspace":
+        return True, tokens[2]
+
+    if manager == "npm":
+        targets: list[str] = []
+        index = 1
+        while index < len(tokens):
+            token = tokens[index]
+            if token == "--":
+                break
+            if token in {"--workspace", "-w"}:
+                if index + 1 < len(tokens):
+                    targets.append(tokens[index + 1])
+                else:
+                    targets.append("")
+                index += 2
+                continue
+            if token.startswith("--workspace="):
+                targets.append(token[len("--workspace="):])
+                index += 1
+                continue
+            if token.startswith("-w="):
+                targets.append(token[len("-w="):])
+                index += 1
+                continue
+            index += 1
+
+        if not targets:
+            return False, None
+        nonempty = [target for target in targets if target]
+        if len(nonempty) != 1 or len(targets) != 1:
+            return True, None
+        return True, nonempty[0]
+
+    target_options = {"--filter", "-F", "--workspace", "-w"}
+    target_long_options = {"--filter", "--workspace"}
+    directory_options = {"--dir", "-C", "--prefix", "--cwd"}
+    directory_long_options = {"--dir", "--prefix", "--cwd"}
+    targets: list[str] = []
+
+    index = 1
+    while index < len(tokens):
+        token = tokens[index]
+        if token in target_options:
+            if index + 1 < len(tokens):
+                targets.append(tokens[index + 1])
+            else:
+                targets.append("")
+            index += 2
+            continue
+
+        matched_inline = False
+        for option in target_long_options:
+            prefix = f"{option}="
+            if token.startswith(prefix):
+                targets.append(token[len(prefix):])
+                matched_inline = True
+                break
+        if matched_inline:
+            index += 1
+            continue
+
+        if token in directory_options:
+            index += 2
+            continue
+        if any(token.startswith(f"{option}=") for option in directory_long_options):
+            index += 1
+            continue
+
+        if not token.startswith("-"):
+            break
+        index += 1
+
+    if not targets:
+        return False, None
+
+    nonempty = [target for target in targets if target]
+    if len(nonempty) != 1 or len(targets) != 1:
+        return True, None
+    return True, nonempty[0]
+
+
+def _directory_target_for_command(command: str) -> tuple[bool, str | None]:
+    tokens = _package_command_tokens(command.strip())
+    if not tokens:
+        return False, None
+
+    manager = tokens[0].lower()
+    if manager not in {"npm", "pnpm", "yarn", "bun"}:
+        return False, None
+
+    supported_options: set[str]
+    supported_long_options: set[str]
+    if manager == "pnpm":
+        supported_options = {"--dir", "-C"}
+        supported_long_options = {"--dir"}
+    elif manager == "npm":
+        supported_options = {"--prefix"}
+        supported_long_options = {"--prefix"}
+    elif manager in {"yarn", "bun"}:
+        supported_options = {"--cwd"}
+        supported_long_options = {"--cwd"}
+    else:
+        return False, None
+
+    targets: list[str] = []
+    index = 1
+    while index < len(tokens):
+        token = tokens[index]
+        if token in supported_options:
+            if index + 1 < len(tokens):
+                targets.append(tokens[index + 1])
+            else:
+                targets.append("")
+            index += 2
+            continue
+
+        matched_inline = False
+        for option in supported_long_options:
+            prefix = f"{option}="
+            if token.startswith(prefix):
+                targets.append(token[len(prefix):])
+                matched_inline = True
+                break
+        if matched_inline:
+            index += 1
+            continue
+
+        if token in {"--filter", "-F", "--workspace", "-w"}:
+            index += 2
+            continue
+        if token.startswith(("--filter=", "--workspace=")):
+            index += 1
+            continue
+
+        if manager == "yarn" and token == "workspace":
+            break
+        if not token.startswith("-"):
+            break
+        index += 1
+
+    if not targets:
+        return False, None
+    nonempty = [target for target in targets if target]
+    if len(nonempty) != 1 or len(targets) != 1:
+        return True, None
+    return True, nonempty[0]
+
+
+def _safe_repository_directory(root: Path, target: str) -> Path | None:
+    value = target.strip().replace("\\", "/")
+    if not value or value.startswith("/") or re.match(r"^[A-Za-z]:/", value):
+        return None
+
+    parts = [part for part in value.split("/") if part not in {"", "."}]
+    if any(part == ".." for part in parts):
+        return None
+
+    candidate = root.joinpath(*parts) if parts else root
+    try:
+        candidate.resolve().relative_to(root.resolve())
+    except (OSError, ValueError):
+        return None
+    return candidate
+
+
+def _directory_script_names(root: Path, target: str) -> set[str] | None:
+    directory = _safe_repository_directory(root, target)
+    if directory is None:
+        return None
+
+    package_path = directory / "package.json"
+    if not package_path.is_file() or package_path.is_symlink():
+        return None
+
+    package = _package_json(package_path)
+    raw_scripts = package.get("scripts")
+    if not isinstance(raw_scripts, dict):
+        return set()
+    return {
+        str(name)
+        for name, value in raw_scripts.items()
+        if isinstance(name, str) and isinstance(value, str)
+    }
+
+
+def _workspace_script_names(root: Path, target: str) -> set[str] | None:
+    matches: list[set[str]] = []
+    for directory, _dirnames, filenames in _walk_repository(root):
+        if "package.json" not in filenames:
+            continue
+        package_path = directory / "package.json"
+        package = _package_json(package_path)
+        if package.get("name") != target:
+            continue
+        raw_scripts = package.get("scripts")
+        if isinstance(raw_scripts, dict):
+            scripts = {
+                str(name)
+                for name, value in raw_scripts.items()
+                if isinstance(name, str) and isinstance(value, str)
+            }
+        else:
+            scripts = set()
+        matches.append(scripts)
+
+    if len(matches) != 1:
+        return None
+    return matches[0]
+
+
+def _script_names_for_command(root: Path, scope: str, command: str) -> set[str] | None:
+    has_workspace_target, workspace_target = _workspace_target_for_command(command)
+    if has_workspace_target:
+        if workspace_target is None:
+            return None
+        return _workspace_script_names(root, workspace_target)
+
+    has_directory_target, directory_target = _directory_target_for_command(command)
+    if has_directory_target:
+        if directory_target is None:
+            return None
+        return _directory_script_names(root, directory_target)
+
+    return _script_names(root, scope)
 
 
 def _manager_for_command(command: str) -> str | None:
@@ -876,7 +1184,6 @@ def lint_instructions(
             instruction_managers[path] = managers
 
         repo_managers = _repo_package_managers(root, signal.scope)
-        scripts = _script_names(root, signal.scope)
 
         if len(repo_managers) == 1:
             expected = next(iter(repo_managers))
@@ -893,23 +1200,25 @@ def lint_instructions(
                     )
                 )
 
-        if scripts:
-            for command in commands:
-                parsed = _script_for_command(command)
-                if not parsed:
-                    continue
-                _manager, script, explicit_run = parsed
-                if script not in scripts and (script == "test" or explicit_run):
-                    findings.append(
-                        InstructionFinding(
-                            "missing-package-script",
-                            "warning",
-                            f"{path} references '{command}', but the nearest package.json for scope '{signal.scope}' has no '{script}' script.",
-                            (path,),
-                            (command,),
-                            signal.scope,
-                        )
+        for command in commands:
+            parsed = _script_for_command(command)
+            if not parsed:
+                continue
+            scripts = _script_names_for_command(root, signal.scope, command)
+            if scripts is None:
+                continue
+            _manager, script, explicit_run = parsed
+            if script not in scripts and (script == "test" or explicit_run):
+                findings.append(
+                    InstructionFinding(
+                        "missing-package-script",
+                        "warning",
+                        f"{path} references '{command}', but the targeted or nearest package.json for scope '{signal.scope}' has no '{script}' script.",
+                        (path,),
+                        (command,),
+                        signal.scope,
                     )
+                )
 
     for scope, per_file in _same_scope_groups(signals, instruction_managers).items():
         manager_sets = {manager for managers in per_file.values() for manager in managers}

{codex_workspace_bootstrap-0.8.0 → codex_workspace_bootstrap-0.9.0/src/codex_workspace_bootstrap.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codex-workspace-bootstrap
-Version: 0.8.0
+Version: 0.9.0
 Summary: Preflight AI coding repositories before Codex, Copilot, Cline, Claude, Gemini, Continue, or Cursor touches them.
 Author: kohli217
 License: MIT
@@ -288,7 +288,7 @@ The reusable Action is published on GitHub Marketplace.
 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
   with:
     python-version: "3.13"
-- uses: kohli217/codex-workspace-bootstrap@v0.8.0
+- uses: kohli217/codex-workspace-bootstrap@v0.9.0
   with:
     path: .
     strict: "true"
@@ -304,9 +304,11 @@ Read-only evaluations against real public repositories are documented in [docs/P
 
 ## GitHub App
 
+**Public App:** [CWB Preflight](https://github.com/apps/cwb-preflight) · [Install](https://github.com/apps/cwb-preflight/installations/new)
+
 For public OSS repositories, CWB can also run as a self-hosted GitHub App. A verified `push` or `pull_request` event triggers repository-only preflight against the exact event revision and publishes a **CWB Preflight** Check Run on that commit.
 
-The preferred zero-cost development deployment uses:
+The verified zero-cost public-OSS deployment uses:
 
 ```text
 GitHub App
@@ -320,7 +322,9 @@ This path does not require a Google Cloud billing account. It is intentionally *
 
 The App keeps the minimum repository permissions documented by the project: Checks read/write, Contents read-only, and Pull requests read-only.
 
-See [docs/GITHUB_APP.md](docs/GITHUB_APP.md) for the integration contract and [deploy/cloudflare/README.md](deploy/cloudflare/README.md) for the completely free development deployment.
+The current public App has been revalidated after promotion: the renamed `CWB Preflight` App produced a successful `READY` Check Run through the full Cloudflare → Queue → GitHub Actions → installation-token → exact-revision checkout path.
+
+See [docs/GITHUB_APP.md](docs/GITHUB_APP.md) for the integration contract and [deploy/cloudflare/README.md](deploy/cloudflare/README.md) for the completely free deployment.
 
 ## Integration boundary
 
@@ -347,7 +351,7 @@ The intent is to complement those tools, not replace them.
 - Suspected secret files are not opened or printed by the filename-risk check.
 - Repository contents are not sent to a remote AI service by the core audit.
 - Instruction files are read locally for deterministic linting; extracted commands are never executed by the integrity lint.
-- Repository instruction/configuration and project-marker inputs are not trusted through symbolic links.
+- Repository instruction/configuration and project-marker contents are not trusted through symbolic links. CWB may recognize the exact lexical aliases `CLAUDE.md -> AGENTS.md` and `GEMINI.md -> AGENTS.md` (or `./AGENTS.md`) only when the sibling `AGENTS.md` is a regular file; linting reads that regular file directly rather than following either link. Gemini aliases are recognized only when `GEMINI.md` is an effective Gemini context filename.
 - `init-agents` and automatic fixes refuse symlinked `AGENTS.md` targets rather than writing through them.
 - Existing regular `AGENTS.md` files are protected unless overwrite is explicit.
 - A passing preflight is evidence about the checks performed, **not a security guarantee**.
@@ -381,7 +385,7 @@ py -m pip install codex-workspace-bootstrap
 Pinned GitHub release artifact:
 
 ```powershell
-py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.8.0/codex_workspace_bootstrap-0.8.0-py3-none-any.whl"
+py -m pip install "https://github.com/kohli217/codex-workspace-bootstrap/releases/download/v0.9.0/codex_workspace_bootstrap-0.9.0-py3-none-any.whl"
 ```
 
 ## Development

{codex_workspace_bootstrap-0.8.0 → codex_workspace_bootstrap-0.9.0}/tests/test_cli.py

@@ -101,7 +101,7 @@ def test_version_flag_reports_package_version(capsys: pytest.CaptureFixture[str]
         main(["--version"])
 
     assert exc_info.value.code == 0
-    assert "codex-workspace-bootstrap 0.8.0" in capsys.readouterr().out
+    assert "codex-workspace-bootstrap 0.9.0" in capsys.readouterr().out
 
 
 def test_audit_writes_sarif(tmp_path: Path) -> None: