coding-os 0.3.14__tar.gz → 0.3.16__tar.gz

{coding_os-0.3.14 → coding_os-0.3.16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-os
-Version: 0.3.14
+Version: 0.3.16
 Summary: The cognitive operating system that gives AI agents memory, structure, and discipline
 Author-email: Kourosh Ebrahimzadeh <info@coding-os.dev>
 License-Expression: Apache-2.0
@@ -31,14 +31,14 @@ Requires-Dist: claude-agent-sdk<0.3.0,>=0.2.110
 Requires-Dist: anyio>=4.0.0
 Requires-Dist: networkx>=3.0
 Provides-Extra: rag
-Requires-Dist: sentence-transformers>=2.2.0; extra == "rag"
+Requires-Dist: sentence-transformers>=2.7.0; extra == "rag"
 Requires-Dist: numpy>=1.24.0; extra == "rag"
 Provides-Extra: graph-os
 Requires-Dist: sentence-transformers>=2.7.0; extra == "graph-os"
 Requires-Dist: numpy<3.0.0,>=1.24.0; extra == "graph-os"
 Requires-Dist: usearch>=2.16; extra == "graph-os"
 Requires-Dist: sqlite-vec>=0.1.9; extra == "graph-os"
-Requires-Dist: tree-sitter<0.26.0,>=0.25.0; extra == "graph-os"
+Requires-Dist: tree-sitter<0.27.0,>=0.25.0; extra == "graph-os"
 Requires-Dist: tree-sitter-python<0.26.0,>=0.25.0; extra == "graph-os"
 Requires-Dist: tree-sitter-typescript<0.26.0,>=0.23.0; extra == "graph-os"
 Requires-Dist: tree-sitter-bash<0.26.0,>=0.25.0; extra == "graph-os"
@@ -52,7 +52,7 @@ Requires-Dist: tree-sitter-java<0.26.0,>=0.23.0; extra == "graph-os"
 Requires-Dist: tree-sitter-c<0.26.0,>=0.23.0; extra == "graph-os"
 Requires-Dist: tree-sitter-cpp<0.26.0,>=0.23.0; extra == "graph-os"
 Requires-Dist: tree-sitter-c-sharp<0.26.0,>=0.23.0; extra == "graph-os"
-Requires-Dist: tree-sitter-scala<0.26.0,>=0.23.0; extra == "graph-os"
+Requires-Dist: tree-sitter-scala<0.27.0,>=0.23.0; extra == "graph-os"
 Requires-Dist: tree-sitter-kotlin>=1.0.0; extra == "graph-os"
 Requires-Dist: tree-sitter-lua>=0.4.0; extra == "graph-os"
 Provides-Extra: board-os

{coding_os-0.3.14 → coding_os-0.3.16}/coding_os.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-os
-Version: 0.3.14
+Version: 0.3.16
 Summary: The cognitive operating system that gives AI agents memory, structure, and discipline
 Author-email: Kourosh Ebrahimzadeh <info@coding-os.dev>
 License-Expression: Apache-2.0
@@ -31,14 +31,14 @@ Requires-Dist: claude-agent-sdk<0.3.0,>=0.2.110
 Requires-Dist: anyio>=4.0.0
 Requires-Dist: networkx>=3.0
 Provides-Extra: rag
-Requires-Dist: sentence-transformers>=2.2.0; extra == "rag"
+Requires-Dist: sentence-transformers>=2.7.0; extra == "rag"
 Requires-Dist: numpy>=1.24.0; extra == "rag"
 Provides-Extra: graph-os
 Requires-Dist: sentence-transformers>=2.7.0; extra == "graph-os"
 Requires-Dist: numpy<3.0.0,>=1.24.0; extra == "graph-os"
 Requires-Dist: usearch>=2.16; extra == "graph-os"
 Requires-Dist: sqlite-vec>=0.1.9; extra == "graph-os"
-Requires-Dist: tree-sitter<0.26.0,>=0.25.0; extra == "graph-os"
+Requires-Dist: tree-sitter<0.27.0,>=0.25.0; extra == "graph-os"
 Requires-Dist: tree-sitter-python<0.26.0,>=0.25.0; extra == "graph-os"
 Requires-Dist: tree-sitter-typescript<0.26.0,>=0.23.0; extra == "graph-os"
 Requires-Dist: tree-sitter-bash<0.26.0,>=0.25.0; extra == "graph-os"
@@ -52,7 +52,7 @@ Requires-Dist: tree-sitter-java<0.26.0,>=0.23.0; extra == "graph-os"
 Requires-Dist: tree-sitter-c<0.26.0,>=0.23.0; extra == "graph-os"
 Requires-Dist: tree-sitter-cpp<0.26.0,>=0.23.0; extra == "graph-os"
 Requires-Dist: tree-sitter-c-sharp<0.26.0,>=0.23.0; extra == "graph-os"
-Requires-Dist: tree-sitter-scala<0.26.0,>=0.23.0; extra == "graph-os"
+Requires-Dist: tree-sitter-scala<0.27.0,>=0.23.0; extra == "graph-os"
 Requires-Dist: tree-sitter-kotlin>=1.0.0; extra == "graph-os"
 Requires-Dist: tree-sitter-lua>=0.4.0; extra == "graph-os"
 Provides-Extra: board-os

{coding_os-0.3.14 → coding_os-0.3.16}/coding_os.egg-info/SOURCES.txt

@@ -1151,6 +1151,7 @@ src/templates/go-fiber/scaffold/docs/engineering/fiber-rules.md
 src/templates/go-fiber/scaffold/docs/playbooks/fiber-service.md
 src/templates/go-fiber/scaffold/src/backend/go.mod
 src/templates/go-fiber/scaffold/src/backend/go.sum
+src/templates/go-fiber/scaffold/src/backend/osv-scanner.toml
 src/templates/go-fiber/scaffold/src/backend/cmd/api/main.go
 src/templates/go-fiber/scaffold/src/backend/cmd/api/main_test.go
 src/templates/go-fiber/skills/go-fiber/SKILL.md
@@ -1604,6 +1605,7 @@ tests/test_remove_stack.py
 tests/test_renderer.py
 tests/test_role_registry.py
 tests/test_roles_endpoint.py
+tests/test_route_path_traversal.py
 tests/test_rules_fresh.py
 tests/test_scaffold_module_tags.py
 tests/test_scan_php_smells.py

{coding_os-0.3.14 → coding_os-0.3.16}/coding_os.egg-info/requires.txt

@@ -25,7 +25,7 @@ sentence-transformers>=2.7.0
 numpy<3.0.0,>=1.24.0
 usearch>=2.16
 sqlite-vec>=0.1.9
-tree-sitter<0.26.0,>=0.25.0
+tree-sitter<0.27.0,>=0.25.0
 tree-sitter-python<0.26.0,>=0.25.0
 tree-sitter-typescript<0.26.0,>=0.23.0
 tree-sitter-bash<0.26.0,>=0.25.0
@@ -39,12 +39,12 @@ tree-sitter-java<0.26.0,>=0.23.0
 tree-sitter-c<0.26.0,>=0.23.0
 tree-sitter-cpp<0.26.0,>=0.23.0
 tree-sitter-c-sharp<0.26.0,>=0.23.0
-tree-sitter-scala<0.26.0,>=0.23.0
+tree-sitter-scala<0.27.0,>=0.23.0
 tree-sitter-kotlin>=1.0.0
 tree-sitter-lua>=0.4.0
 
 [rag]
-sentence-transformers>=2.2.0
+sentence-transformers>=2.7.0
 numpy>=1.24.0
 
 [web]

{coding_os-0.3.14 → coding_os-0.3.16}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "coding-os"
-version = "0.3.14"
+version = "0.3.16"
 description = "The cognitive operating system that gives AI agents memory, structure, and discipline"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -56,7 +56,7 @@ classifiers = [
 # RAG (Retrieval-Augmented Generation) — semantic search via local embeddings.
 # Install with: uv sync --extra rag
 rag = [
-    "sentence-transformers>=2.2.0",
+    "sentence-transformers>=2.7.0",
     "numpy>=1.24.0",
 ]
 
@@ -79,7 +79,7 @@ graph_os = [
     # brute-force scan.
     "usearch>=2.16",
     "sqlite-vec>=0.1.9",
-    "tree-sitter>=0.25.0,<0.26.0",
+    "tree-sitter>=0.25.0,<0.27.0",
     "tree-sitter-python>=0.25.0,<0.26.0",
     "tree-sitter-typescript>=0.23.0,<0.26.0",
     "tree-sitter-bash>=0.25.0,<0.26.0",
@@ -106,7 +106,7 @@ graph_os = [
     "tree-sitter-c>=0.23.0,<0.26.0",
     "tree-sitter-cpp>=0.23.0,<0.26.0",
     "tree-sitter-c-sharp>=0.23.0,<0.26.0",
-    "tree-sitter-scala>=0.23.0,<0.26.0",
+    "tree-sitter-scala>=0.23.0,<0.27.0",
     "tree-sitter-kotlin>=1.0.0",
     "tree-sitter-lua>=0.4.0",
 ]
@@ -162,7 +162,7 @@ dev = [
     # Exact pin: uv.lock is gitignored, so CI resolves this fresh — a floating
     # bound let every new ruff release reformat the world and fail the enforced
     # format gate daily. Bump deliberately together with a format sweep.
-    "ruff==0.16.1",
+    "ruff==0.16.2",
     "mypy>=1.10.0",
     "types-pyyaml>=6.0.0",
     "types-jsonschema>=4.0.0",
@@ -352,9 +352,6 @@ ignore = [
     # Burndown (2026-08-07, tracked in the lint-burndown board task):
     # style-only residue accepted to make `ruff check` a hard CI gate.
     # Remove each entry once its count reaches 0 — never add new ones.
-    "SIM105", # try-except-pass vs contextlib.suppress (9 left)
-    "SIM102", # collapsible-if (7 left)
-    "E741",   # ambiguous single-letter names (7 left)
 ]
 unfixable = [
     "F401",   # unused-import — never auto-remove (could hide intent)

{coding_os-0.3.14 → coding_os-0.3.16}/src/cli/_board_cli_lifecycle.py

@@ -72,7 +72,7 @@ def task_create_cmd(
             priority=priority,
             appetite=appetite,
             epic=epic,
-            labels=[l.strip() for l in labels.split(",") if l.strip()],
+            labels=[label.strip() for label in labels.split(",") if label.strip()],
             outcome=outcome,
             acceptance=acceptance,
             read_first=[p.strip() for chunk in read_first for p in chunk.split(",") if p.strip()]

{coding_os-0.3.14 → coding_os-0.3.16}/src/cli/_skill_project.py

@@ -9,7 +9,9 @@ in cli.skill_commands.
 
 from __future__ import annotations
 
+import contextlib
 import os
+import re
 from pathlib import Path
 
 import click
@@ -72,8 +74,16 @@ def _installed_adapter_skills_dirs(project_root: Path) -> list[Path]:
     return dirs
 
 
+_SKILL_NAME_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]*$")
+
+
 def _known_skill_provenance(name: str) -> str | None:
     """'core' | 'stack' | 'community' | None — where this skill name resolves."""
+    # `name` reaches here from `cos init --skills` and from the Hub's
+    # extra_skills body field, which the init validator does NOT check against a
+    # registry — so this is the boundary that has to reject a traversal.
+    if not _SKILL_NAME_RE.match(name or ""):
+        return None
     if (core_dir("skills") / name / "SKILL.md").is_file():
         return "core"
     for stack_dir in templates_dir().iterdir():
@@ -119,10 +129,9 @@ def _relink_core_stack_skill(
             if link_path.is_symlink() or link_path.exists():
                 link_path.unlink()
                 touched += 1
-            try:
+            # dir not empty / absent — leave it
+            with contextlib.suppress(OSError):
                 skill_dir.rmdir()
-            except OSError:
-                pass  # dir not empty / absent — leave it
     return touched
 
 

{coding_os-0.3.14 → coding_os-0.3.16}/src/cli/aggregator.py

@@ -108,13 +108,17 @@ def _merge_substitutions(
     origin: dict[str, str] = dict.fromkeys(base, "base")
     for stack in stacks:
         for key, value in stack.substitutions.items():
-            if key in merged and merged[key] != value and key not in _JOINED_SUBSTITUTION_KEYS:
-                # Only warn on real conflicts, not base-default overrides.
-                if origin.get(key) != "base" or not _is_base_default(merged[key]):
-                    warnings.append(
-                        f"substitution conflict on '{key}': "
-                        f"'{merged[key]}' → '{value}' (stack {stack.id} wins)"
-                    )
+            # Only warn on real conflicts, not base-default overrides.
+            if (
+                key in merged
+                and merged[key] != value
+                and key not in _JOINED_SUBSTITUTION_KEYS
+                and (origin.get(key) != "base" or not _is_base_default(merged[key]))
+            ):
+                warnings.append(
+                    f"substitution conflict on '{key}': "
+                    f"'{merged[key]}' → '{value}' (stack {stack.id} wins)"
+                )
             merged[key] = value
             origin[key] = stack.id
     return merged, warnings

{coding_os-0.3.14 → coding_os-0.3.16}/src/cli/config_composer.py

@@ -9,6 +9,7 @@ from __future__ import annotations
 
 import copy
 import json
+import re
 from pathlib import Path
 from typing import Any
 
@@ -130,10 +131,17 @@ def _merge_value(
     raise ValueError(f"unknown merge strategy: {strategy!r}")
 
 
+# stack_id becomes a path segment; a traversal here would read a scaffold
+# from outside the templates tree.
+_STACK_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]*$")
+
+
 def _stack_scaffold_dir(stack_id: str, templates_dir: Path) -> Path:
     """Resolve a stack's scaffold dir — bundled first, then a community overlay
     ($COS_USER_TEMPLATES_DIR, TASK-479). Bundled stacks resolve byte-identically; a
     nonexistent path is returned unchanged so _load() returns None gracefully."""
+    if not _STACK_ID_RE.match(stack_id or ""):
+        return templates_dir / "__invalid__" / "scaffold"
     bundled = templates_dir / stack_id / "scaffold"
     if bundled.is_dir():
         return bundled

{coding_os-0.3.14 → coding_os-0.3.16}/src/cli/init_command.py

@@ -305,17 +305,16 @@ def init(
     # every missing flag so a bare `cos init` reports the whole gap at once.
     # Sits AFTER existing-install detection so the idempotent sync path keeps
     # working for a bare re-`cos init` inside a project.
-    if not yes and not sys.stdin.isatty():
-        if name is None and project_dir is None and not debug:
-            missing = "--name and/or --project-dir"
-            if agent is None:
-                missing = f"--agent, {missing}"
-            click.echo(
-                f"ERROR: non-interactive shell — pass {missing} "
-                "(or --yes to scaffold into the current directory).",
-                err=True,
-            )
-            sys.exit(2)
+    if not yes and not sys.stdin.isatty() and name is None and project_dir is None and not debug:
+        missing = "--name and/or --project-dir"
+        if agent is None:
+            missing = f"--agent, {missing}"
+        click.echo(
+            f"ERROR: non-interactive shell — pass {missing} "
+            "(or --yes to scaffold into the current directory).",
+            err=True,
+        )
+        sys.exit(2)
 
     # Prompt for missing inputs. --yes disables all prompting. Prompts that
     # hit EOF (closed stdin — CI, scaffold tests) fall back to sensible

{coding_os-0.3.14 → coding_os-0.3.16}/src/core/board_os/_mcp_forge.py

@@ -31,15 +31,27 @@ def _detect_forge(project_root: Path) -> str:
         )
     except (OSError, subprocess.SubprocessError):
         return ""
-    if "github.com" in url:
+    host = _remote_host(url)
+    if host == "github.com" or host.endswith(".github.com"):
         return "github"
-    if "gitlab" in url:
+    # Self-hosted GitLab/Bitbucket carry arbitrary hostnames, so the substring
+    # heuristic stays — but scoped to the host, never the whole URL.
+    if "gitlab" in host:
         return "gitlab"
-    if "bitbucket" in url:
+    if "bitbucket" in host:
         return "bitbucket"
     return ""
 
 
+def _remote_host(url: str) -> str:
+    # Both remote spellings reduce to their host segment: matching the full URL
+    # lets a path like https://evil.example/github.com/x impersonate a forge.
+    authority = url.split("://", 1)[-1].split("/", 1)[0]
+    if "@" in authority:
+        authority = authority.split("@", 1)[1]
+    return authority.split(":", 1)[0]
+
+
 def _normalize_external_ref(raw: str, project_root: Path) -> str | None:
     # Accepts a bare number, '#42', 'github#42', or a full issue/PR URL → returns
     # '<forge>#<n>' ('!' for a merge/pull request). Forge is taken from the ref

{coding_os-0.3.14 → coding_os-0.3.16}/src/core/graph_os/communities.py

@@ -381,7 +381,7 @@ def _community_id(members: list[GraphNode]) -> str:
     if not members:
         return "community:empty"
     sorted_uids = sorted(m.uid for m in members)
-    digest = hashlib.sha1("|".join(sorted_uids).encode("utf-8")).hexdigest()[:12]
+    digest = hashlib.sha256("|".join(sorted_uids).encode("utf-8")).hexdigest()[:12]
     return f"community:{digest}"
 
 
@@ -396,9 +396,9 @@ def _community_name(anchor: GraphNode) -> str:
 def _community_summary(members: list[GraphNode]) -> str:
     labels = []
     for m in members[:3]:
-        l = (m.label or m.uid.split("::")[-1] or m.uid).strip()
-        if l:
-            labels.append(l)
+        label = (m.label or m.uid.split("::")[-1] or m.uid).strip()
+        if label:
+            labels.append(label)
     return " → ".join(labels) if labels else ""
 
 

{coding_os-0.3.14 → coding_os-0.3.16}/src/core/graph_os/extractors/_contracts_js.py

@@ -160,9 +160,14 @@ def _scan_ts_emitter(content: str) -> list[ContractMatch]:
         event_name = match.group("path")
         tail = emitter.split(".")[-1].lower()
         # `addEventListener` always passes through; for `on` we gate on tail.
-        if "addEventListener" not in match.group(0):
-            if tail not in {"bus", "events", "emitter", "pubsub", "channel"}:
-                continue
+        if "addEventListener" not in match.group(0) and tail not in {
+            "bus",
+            "events",
+            "emitter",
+            "pubsub",
+            "channel",
+        }:
+            continue
         hits.append(
             ContractMatch(
                 kind="event",

{coding_os-0.3.14 → coding_os-0.3.16}/src/core/graph_os/extractors/_python_decls.py

@@ -91,7 +91,7 @@ def _module_docstring(content: str) -> str | None:
 
 def _hash_decl(decl: _SymbolDecl) -> str:
     key = f"{decl.kind}|{decl.uid}|{decl.signature}|{decl.decorators}"
-    return hashlib.sha1(key.encode("utf-8")).hexdigest()[:12]
+    return hashlib.sha256(key.encode("utf-8")).hexdigest()[:12]
 
 
 def _class_signature(node: ast.ClassDef) -> str:

{coding_os-0.3.14 → coding_os-0.3.16}/src/core/graph_os/extractors/code_shell.py

@@ -173,9 +173,9 @@ def _walk_ts(
                         _emit_log_hook_edge(hook, line, normalised, result, mod_uid)
             elif cmd_name in ("bash", "sh"):
                 # `bash script.sh` invocation pattern.
-                for txt, l in args:
+                for txt, lineno in args:
                     if txt.endswith(".sh"):
-                        _emit_call_edge(txt, l, path, normalised, result, mod_uid)
+                        _emit_call_edge(txt, lineno, path, normalised, result, mod_uid)
                         break
             elif cmd_name.endswith(".sh"):
                 # Direct `./script.sh` or `script.sh` invocation.

{coding_os-0.3.14 → coding_os-0.3.16}/src/core/graph_os/ingest/base.py

@@ -240,10 +240,13 @@ def walk_local(
         # Relative-path pruning — drop subtrees whose rel-path contains
         # any configured segment sequence (e.g. tests/golden mirrors). The
         # "/" suffix avoids matching "tests/golden_clone" by accident.
-        if exclude_paths_set and rel_dir:
-            if any(rel_dir == p or rel_dir.startswith(p + "/") for p in exclude_paths_set):
-                dirnames.clear()
-                continue
+        if (
+            exclude_paths_set
+            and rel_dir
+            and any(rel_dir == p or rel_dir.startswith(p + "/") for p in exclude_paths_set)
+        ):
+            dirnames.clear()
+            continue
         for name in filenames:
             if not any(fnmatch.fnmatchcase(name, pat) for pat in include_set):
                 continue

{coding_os-0.3.14 → coding_os-0.3.16}/src/core/graph_os/tools/_graph_export.py

@@ -444,12 +444,12 @@ def _safe_id(uid: str) -> str:
     # F5 / Audit #14: previous impl `re.sub(..., "_", uid)[:60]` made
     # every method of one class collapse to identical mermaid/dot node
     # IDs (uid prefix is the same — class+method suffix got chopped).
-    # Suffix an 8-char sha1 so IDs are collision-proof regardless of uid
+    # Suffix an 8-char digest so IDs are collision-proof regardless of uid
     # length, and keep a readable 40-char prefix for diagram legibility.
     sanitised = re.sub(r"[^A-Za-z0-9_]", "_", uid)
     if len(sanitised) <= 48:
         return sanitised
-    digest = hashlib.sha1(uid.encode("utf-8")).hexdigest()[:8]
+    digest = hashlib.sha256(uid.encode("utf-8")).hexdigest()[:8]
     return f"{sanitised[:40]}_{digest}"
 
 

{coding_os-0.3.14 → coding_os-0.3.16}/src/core/hooks/_helpers/check_commit_message.py

@@ -43,8 +43,8 @@ AUTO_COMMIT_RE = re.compile(r"^(?:Merge |Revert |fixup! |squash! )")
 def check_message(text: str) -> list[str]:
     errors: list[str] = []
     raw_lines = text.split("\n")
-    lines = [l for l in raw_lines if not l.startswith("#")]
-    title_idx = next((i for i, l in enumerate(lines) if l.strip()), None)
+    lines = [line for line in raw_lines if not line.startswith("#")]
+    title_idx = next((i for i, line in enumerate(lines) if line.strip()), None)
     if title_idx is None:
         return ["commit message is empty"]
     title = lines[title_idx].rstrip()
@@ -60,7 +60,7 @@ def check_message(text: str) -> list[str]:
             f"(type one of: {', '.join(CONVENTIONAL_TYPES)}) — release-please cannot parse it"
         )
 
-    body_nonempty = [l for l in body_lines if l.strip()]
+    body_nonempty = [line for line in body_lines if line.strip()]
     if len(body_nonempty) > MAX_BODY_LINES:
         errors.append(f"body has {len(body_nonempty)} non-empty lines; max {MAX_BODY_LINES}")
 

{coding_os-0.3.14 → coding_os-0.3.16}/src/core/hooks/_helpers/doc_sync_check.py

@@ -209,14 +209,15 @@ def _check_doc(
         old_count, _old_sig = old_syms[sym]
         if old_count == -1 or new_count == -1:
             continue  # class symbol — skip
-        if old_count != new_count:
-            if re.search(rf"(?<![A-Za-z0-9_]){re.escape(sym)}(?![A-Za-z0-9_])", text):
-                findings.append(
-                    f"`{sym}` signature changed ({old_count}→{new_count} params); "
-                    f"verify doc still describes the right shape"
-                )
-                if len(findings) >= 2:
-                    break
+        if old_count != new_count and re.search(
+            rf"(?<![A-Za-z0-9_]){re.escape(sym)}(?![A-Za-z0-9_])", text
+        ):
+            findings.append(
+                f"`{sym}` signature changed ({old_count}→{new_count} params); "
+                f"verify doc still describes the right shape"
+            )
+            if len(findings) >= 2:
+                break
 
     if findings:
         return "; ".join(findings[:2])
@@ -373,10 +374,6 @@ def main(argv: list[str]) -> int:
             enrichment = f"`{sym}` {hint}"
             break
 
-    try:
-        code_file.resolve().relative_to(project_root.resolve())
-    except ValueError:
-        pass
     for doc, reason in findings[:3]:
         try:
             rel_doc = doc.resolve().relative_to(project_root.resolve())

{coding_os-0.3.14 → coding_os-0.3.16}/src/core/hooks/_helpers/extract_commit_msg_arg.py

@@ -49,11 +49,18 @@ def _messages(args: list[str]) -> list[str]:
             out.append(a[len("--message=") :])
         elif a.startswith("-m") and len(a) > 2 and not a.startswith("--"):
             out.append(a[2:])  # `-mfoo` attached value
-        elif len(a) >= 2 and a[0] == "-" and a[1] != "-" and a[1:].isalpha() and a.endswith("m"):
-            if i + 1 < len(args):  # short cluster ending in m (`-am`, `-sm`)
-                out.append(args[i + 1])
-                i += 2
-                continue
+        # short cluster ending in m (`-am`, `-sm`)
+        elif (
+            len(a) >= 2
+            and a[0] == "-"
+            and a[1] != "-"
+            and a[1:].isalpha()
+            and a.endswith("m")
+            and i + 1 < len(args)
+        ):
+            out.append(args[i + 1])
+            i += 2
+            continue
         i += 1
     if any(_looks_unexpanded(v) for v in out):
         return []  # can't cleanly resolve this invocation — defer, don't mis-validate

{coding_os-0.3.14 → coding_os-0.3.16}/src/core/hooks/_helpers/routing_evolution.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import contextlib
 import sqlite3
 import sys
 
@@ -40,13 +41,12 @@ def _recalculate(conn: sqlite3.Connection) -> int:
         count += 1
 
     total_outcomes = conn.execute("SELECT COUNT(*) FROM task_outcomes").fetchone()[0]
-    try:
+    # v26 columns not yet applied; recalc still succeeds without them
+    with contextlib.suppress(sqlite3.OperationalError):
         conn.execute(
             "UPDATE routing_weights SET last_recalc_at = CURRENT_TIMESTAMP, outcomes_at_recalc = ?",
             (total_outcomes,),
         )
-    except sqlite3.OperationalError:
-        pass  # v26 columns not yet applied; recalc still succeeds
 
     conn.commit()
     return count

{coding_os-0.3.14 → coding_os-0.3.16}/src/core/scaffold_manifest.json

@@ -2585,9 +2585,10 @@
         "src/backend/cmd/api/main_test.go",
         "src/backend/go.mod",
         "src/backend/go.sum",
+        "src/backend/osv-scanner.toml",
         "src/shared/README.md"
       ],
-      "count": 251
+      "count": 252
     },
     "claude_go-plain": {
       "agent": "claude",
@@ -9903,9 +9904,10 @@
         "src/backend/cmd/api/main_test.go",
         "src/backend/go.mod",
         "src/backend/go.sum",
+        "src/backend/osv-scanner.toml",
         "src/shared/README.md"
       ],
-      "count": 256
+      "count": 257
     },
     "codex_go-plain": {
       "agent": "codex",

{coding_os-0.3.14 → coding_os-0.3.16}/src/core/skills/clean-code/scripts/audit-fail-closed.py

@@ -44,11 +44,16 @@ def _is_log_call(node: ast.AST) -> bool:
     if not isinstance(call, ast.Call):
         return False
     func = call.func
-    if isinstance(func, ast.Attribute):
-        # Match: logger.info / log.warning / logging.error / etc.
-        if func.attr in {"debug", "info", "warning", "warn", "error", "exception", "critical"}:
-            return True
-    return False
+    # Match: logger.info / log.warning / logging.error / etc.
+    return isinstance(func, ast.Attribute) and func.attr in {
+        "debug",
+        "info",
+        "warning",
+        "warn",
+        "error",
+        "exception",
+        "critical",
+    }
 
 
 def _is_silent_return(node: ast.AST) -> bool:
@@ -104,10 +109,9 @@ def audit_file(path: Path) -> list[Finding]:
             continue
 
         # Pattern 2: log-only (allows execution past block, no raise)
-        if all(_is_log_call(stmt) or _is_pass(stmt) for stmt in body):
-            if _exception_is_broad(node):
-                findings.append(Finding(str(path), line, "log_and_allow", snippet))
-                continue
+        if all(_is_log_call(stmt) or _is_pass(stmt) for stmt in body) and _exception_is_broad(node):
+            findings.append(Finding(str(path), line, "log_and_allow", snippet))
+            continue
 
         # Pattern 3: silent return None / {} / []
         for stmt in body:

{coding_os-0.3.14 → coding_os-0.3.16}/src/core/thinking_os/database.py

@@ -9,6 +9,7 @@ Agent-agnostic: DB path is configurable via COS_DB_PATH env var.
 
 from __future__ import annotations
 
+import contextlib
 import logging
 import os
 import sqlite3
@@ -252,14 +253,11 @@ def run_migrations(conn: sqlite3.Connection) -> list[int]:
     _ensure_version_table(conn)
     applied: list[int] = []
 
-    try:
+    # Another writer holding the lock is the common case under concurrent
+    # dispatcher workers: fall through, re-read the version below, and return
+    # without doing anything if we are already at the target.
+    with contextlib.suppress(sqlite3.OperationalError):
         conn.execute("BEGIN IMMEDIATE")
-    except sqlite3.OperationalError:
-        # Another writer holds the lock — wait briefly and re-read; if
-        # we're already at the target version, return without doing
-        # anything. This is the common case under concurrent dispatcher
-        # workers.
-        pass
     try:
         current = get_schema_version(conn)
         for version, description, action in MIGRATIONS: