coding-os 0.3.3__tar.gz → 0.3.4__tar.gz

{coding_os-0.3.3 → coding_os-0.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-os
-Version: 0.3.3
+Version: 0.3.4
 Summary: The cognitive operating system that gives AI agents memory, structure, and discipline
 Author-email: Kourosh Ebrahimzadeh <info@coding-os.dev>
 License-Expression: Apache-2.0

{coding_os-0.3.3 → coding_os-0.3.4}/coding_os.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-os
-Version: 0.3.3
+Version: 0.3.4
 Summary: The cognitive operating system that gives AI agents memory, structure, and discipline
 Author-email: Kourosh Ebrahimzadeh <info@coding-os.dev>
 License-Expression: Apache-2.0

{coding_os-0.3.3 → coding_os-0.3.4}/coding_os.egg-info/SOURCES.txt

@@ -1325,6 +1325,7 @@ tests/test_scan_rn_perf.py
 tests/test_scan_wp_smells.py
 tests/test_scheduled_route.py
 tests/test_sdk_presence.py
+tests/test_secret_fixture_policy.py
 tests/test_session_context_cadence.py
 tests/test_session_options_parity.py
 tests/test_session_recap.py

{coding_os-0.3.3 → coding_os-0.3.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "coding-os"
-version = "0.3.3"
+version = "0.3.4"
 description = "The cognitive operating system that gives AI agents memory, structure, and discipline"
 readme = "README.md"
 requires-python = ">=3.10"

{coding_os-0.3.3 → coding_os-0.3.4}/src/core/graph_os/toolchain.py

@@ -258,7 +258,7 @@ def _load_ts_base_url(root: Path) -> str:
 # ---------------------------------------------------------------------------
 
 
-_GO_MODULE_RE = re.compile(r"^module\s+(\S+)\s*$", re.MULTILINE)
+_GO_MODULE_RE = re.compile(r"^module\s+\"?([^\"\s]+)\"?\s*$", re.MULTILINE)
 
 
 def _load_go_module(root: Path) -> str:

{coding_os-0.3.3 → coding_os-0.3.4}/src/core/hooks/block-secrets.sh

@@ -106,8 +106,9 @@ if [[ "$TOOL" == "Write" || "$TOOL" == "Edit" ]]; then
     exit 2
   fi
 
-  # Block AWS credentials
-  if echo "$CONTENT" | grep -qE 'AKIA[0-9A-Z]{16}'; then
+  # Block AWS credentials, long-lived (AKIA) and temporary STS (ASIA). Ids ending
+  # in EXAMPLE are AWS's own reserved documentation values and never authenticate.
+  if echo "$CONTENT" | grep -oE '(AKIA|ASIA)[0-9A-Z]{16}' | grep -qvE 'EXAMPLE$'; then
     echo "BLOCKED: AWS access key ID detected. Use environment variables or IAM roles." >&2
     exit 2
   fi

{coding_os-0.3.3 → coding_os-0.3.4}/src/scripts/dev/audit_doc_links.py

@@ -13,18 +13,19 @@ from __future__ import annotations
 import os
 import re
 import sys
+import unicodedata
 from collections import defaultdict
 from pathlib import Path
 from urllib.parse import unquote, urlparse
 
 REPO = Path(__file__).resolve().parent.parent.parent.parent
 DOCS = (REPO / "docs").resolve()
-# code-os-core-docs: external reference material (not project docs).
 # _templates: doc TEMPLATES shipped by `cos init` — their links are
 #   intentionally consumer-relative / placeholder (`relative/path`,
 #   `./<related>.md`), so auditing them as navigable docs is a
-#   category error.
-SKIP_DIRS = {"code-os-core-docs", "_templates"}
+#   category error. Nothing else is exempt: an unwatched subtree is where
+#   link rot and stale identifiers survive a public launch unnoticed.
+SKIP_DIRS = {"_templates"}
 # Repo-root markdown files (agent entrypoints + community files) —
 # scanned for links but exempt from the doc frontmatter contract.
 # Symlinks (CLAUDE.md → AGENTS.md) are skipped to avoid double-scanning.
@@ -105,19 +106,25 @@ _OPENING_NEXT = re.compile(r"^(?:Read next:|>\s*N:)\s*(.+)$", re.M)
 def _slugify(text: str) -> str:
     """Slugify a heading the way GitHub does.
 
-    GitHub's anchor algorithm (github-slugger): lowercase, drop
-    characters that are not word/space/hyphen, then replace each
-    whitespace character with a single hyphen. Crucially it does NOT
-    collapse consecutive hyphens — `## Rule 0 — Docs-first` becomes
-    `rule-0--docs-first` (the em-dash is dropped, the two spaces around
-    it become two hyphens). The previous implementation collapsed `-+`,
-    which produced `rule-0-docs-first` and false-flagged every
-    `Rule N — title` cross-reference as a broken anchor.
+    GitHub's anchor algorithm (github-slugger): lowercase, keep letters,
+    marks, numbers, `_`, `-`, whitespace and the zero-width joiners, drop
+    everything else, then replace each whitespace character with a single
+    hyphen. Crucially it does NOT collapse consecutive hyphens — `## Rule 0
+    — Docs-first` becomes `rule-0--docs-first` (the em-dash is dropped, the
+    two spaces around it become two hyphens).
+
+    Python's `\\w` is narrower than github-slugger's keep-set: it drops
+    combining marks (اصلاً) and format characters (the half-space in
+    سیستم‌ها), so a `\\w`-based strip false-flags every Persian heading.
+    Verified against GitHub's own /markdown renderer over 200 real repo
+    headings — 120 of them non-ASCII — with zero divergence.
     """
-    s = text.lower()
-    s = re.sub(r"[^\w\s-]", "", s)
-    s = re.sub(r"\s", "-", s)
-    return s or "section"
+    kept = [
+        ch
+        for ch in text.lower()
+        if ch.isspace() or ch in "-_‌‍" or unicodedata.category(ch)[0] in "LMN"
+    ]
+    return re.sub(r"\s", "-", "".join(kept)) or "section"
 
 
 def _is_external(url: str) -> bool:

coding_os-0.3.4/src/templates/go/scaffold/src/backend/go.mod

@@ -0,0 +1,3 @@
+module "{{PROJECT_NAME}}"
+
+go 1.25

{coding_os-0.3.3 → coding_os-0.3.4}/src/templates/go-fiber/scaffold/src/backend/go.mod

@@ -1,4 +1,4 @@
-module {{PROJECT_NAME}}
+module "{{PROJECT_NAME}}"
 
 go 1.25.0
 

coding_os-0.3.4/src/templates/go-plain/scaffold/src/backend/go.mod

@@ -0,0 +1,3 @@
+module "{{PROJECT_NAME}}"
+
+go 1.22

{coding_os-0.3.3 → coding_os-0.3.4}/src/templates/laravel/scaffold/src/backend/composer.json

@@ -3,11 +3,11 @@
   "type": "project",
   "require": {
     "php": "^8.2",
-    "laravel/framework": "^11.0"
+    "laravel/framework": "^12.61.1"
   },
   "require-dev": {
     "phpunit/phpunit": "^11.0",
-    "larastan/larastan": "^2.0"
+    "larastan/larastan": "^3.0"
   },
   "scripts": {
     "lint": "phpstan analyse app routes --level=6",

{coding_os-0.3.3 → coding_os-0.3.4}/src/templates/nestjs/scaffold/src/backend/package.json

@@ -10,19 +10,19 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@nestjs/common": "^10.3.0",
-    "@nestjs/core": "^10.3.0",
-    "@nestjs/platform-express": "^10.3.0",
+    "@nestjs/common": "^11.1.18",
+    "@nestjs/core": "^11.1.18",
+    "@nestjs/platform-express": "^11.1.18",
     "class-transformer": "^0.5.1",
     "class-validator": "^0.14.1",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.1"
   },
   "devDependencies": {
-    "@nestjs/cli": "^10.3.0",
-    "@nestjs/testing": "^10.3.0",
+    "@nestjs/cli": "^11.0.24",
+    "@nestjs/testing": "^11.1.18",
     "supertest": "^7.0.0",
     "typescript": "^5.4.0",
-    "vitest": "^2.0.0"
+    "vitest": "^3.2.6"
   }
 }

{coding_os-0.3.3 → coding_os-0.3.4}/src/templates/nextjs/scaffold/src/frontend/package.json

@@ -11,7 +11,7 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "next": ">=14",
+    "next": ">=15.5.21",
     "react": ">=18",
     "react-dom": ">=18"
   },
@@ -23,6 +23,6 @@
     "eslint": ">=9",
     "typescript": ">=5.4",
     "typescript-eslint": ">=8",
-    "vitest": ">=2"
+    "vitest": ">=3.2.6"
   }
 }

{coding_os-0.3.3 → coding_os-0.3.4}/src/templates/rails/scaffold/src/backend/Gemfile

@@ -3,7 +3,7 @@ source "https://rubygems.org"
 ruby "3.3.0"
 
 gem "rails", "~> 7.1"
-gem "puma", "~> 6.4"
+gem "puma", ">= 7.2.1"
 
 group :development, :test do
   gem "rspec-rails", "~> 6.1"

{coding_os-0.3.3 → coding_os-0.3.4}/src/templates/react-native/scaffold/src/mobile/package.json

@@ -18,6 +18,6 @@
     "eslint": ">=9",
     "typescript": ">=5.4",
     "typescript-eslint": ">=8",
-    "vitest": ">=2"
+    "vitest": ">=3.2.6"
   }
 }

coding_os-0.3.4/src/templates/svelte-sveltekit/scaffold/src/frontend/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "{{PROJECT_NAME}}-frontend",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "vite dev",
+    "build": "vite build",
+    "preview": "vite preview",
+    "prepare": "svelte-kit sync || echo ''",
+    "lint": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
+    "test": "svelte-kit sync && vitest run"
+  },
+  "devDependencies": {
+    "@sveltejs/adapter-auto": "^7.0.0",
+    "@sveltejs/kit": "^2.5.0",
+    "@sveltejs/vite-plugin-svelte": "^7.0.0",
+    "@types/node": "^20.0.0",
+    "svelte": "^5.0.0",
+    "svelte-check": "^4.0.0",
+    "typescript": "^5.4.0",
+    "vite": "^8.0.0",
+    "vitest": "^4.0.0"
+  }
+}

{coding_os-0.3.3 → coding_os-0.3.4}/src/templates/vue-nuxt/scaffold/src/frontend/package.json

@@ -14,7 +14,7 @@
     "jsdom": "^24.0.0",
     "nuxt": "^3.11.0",
     "typescript": "^5.4.0",
-    "vitest": "^3.0.0",
+    "vitest": "^3.2.6",
     "vue-tsc": "^2.0.0"
   }
 }

{coding_os-0.3.3 → coding_os-0.3.4}/tests/test_block_secrets.py

@@ -10,6 +10,9 @@ import pytest
 
 HOOK = Path(__file__).resolve().parent.parent / "src" / "core" / "hooks" / "block-secrets.sh"
 
+# Credential SHAPES, not credentials: composed at run time so the literal never
+# exists in the tree for any scanner to match, per SECURITY.md § Test fixtures
+# for secret detection.
 _REAL_ANT = "sk-ant-api03-" + "A1b2C3d4" * 11  # 88-char alnum body
 _REAL_PROJ = "sk-proj-" + "A1b2C3d4" * 6  # 48-char body
 _REAL_CLASSIC = "sk-" + "T3BlbkFJ" * 6  # 48-char alnum

{coding_os-0.3.3 → coding_os-0.3.4}/tests/test_golden_parity.py

@@ -40,6 +40,11 @@ IGNORED_PREFIXES = (
     "node_modules/",
     ".venv/",
     ".build/",
+    # Tool caches a scaffold-time lint/format pass may leave behind; gitignored
+    # in the scaffold, so they never reach the committed golden tree.
+    ".ruff_cache/",
+    ".pytest_cache/",
+    ".mypy_cache/",
     # The whole .coding-os/ project-state dir is gitignored (DBs, session
     # markers, the wall-clock core-version.json, plus deterministic config and
     # the local stack copy under .coding-os/src/). None of it lands in the

{coding_os-0.3.3 → coding_os-0.3.4}/tests/test_hooks.py

@@ -604,6 +604,8 @@ class TestBlockSecrets:
         assert result.returncode == 0
 
     def test_blocks_private_key_in_code(self) -> None:
+        # A bare PEM header with no key material — SECURITY.md § Test fixtures
+        # for secret detection.
         payload = json.dumps(
             {
                 "tool_name": "Edit",

coding_os-0.3.4/tests/test_secret_fixture_policy.py

@@ -0,0 +1,125 @@
+"""Guard the secret-fixture policy in SECURITY.md § Test fixtures for secret detection.
+
+This repository ships a secret detector, so it must keep credential-shaped test
+data around. The policy is that such fixtures are safe *by construction* —
+composed at run time, deliberately sub-threshold, or a vendor-published reserved
+example — never a realistic full-length literal. This test is the enforcement:
+it fails if any tracked file gains a string that a real vendor scanner would
+match, so the rule survives without depending on a reviewer noticing.
+
+The patterns below cannot match themselves: every one has a regex metacharacter
+immediately after its literal prefix, which the following character class
+excludes.
+"""
+
+from __future__ import annotations
+
+import re
+import subprocess
+from pathlib import Path
+
+import pytest
+
+REPO = Path(__file__).resolve().parent.parent
+
+# Full-length vendor formats — the shapes a real scanner alerts on.
+VENDOR_PATTERNS = {
+    "aws-access-key": re.compile(r"(?:AKIA|ASIA)[0-9A-Z]{16}"),
+    "github-token": re.compile(r"gh[pousr]_[A-Za-z0-9]{36}"),
+    "github-pat-fine-grained": re.compile(r"github_pat_[A-Za-z0-9_]{80,}"),
+    "stripe-live-key": re.compile(r"[sr]k_live_[A-Za-z0-9]{24,}"),
+    "slack-token": re.compile(r"xox[abprs]-[A-Za-z0-9-]{20,}"),
+    "google-api-key": re.compile(r"AIza[0-9A-Za-z_\-]{35}"),
+    "openai-project-key": re.compile(r"sk-proj-[A-Za-z0-9_\-]{40,}"),
+    "openai-legacy-key": re.compile(r"sk-[A-Za-z0-9]{40,}"),
+    "anthropic-key": re.compile(r"sk-ant-(?:api|admin)[0-9]{2}-[A-Za-z0-9_\-]{80,}"),
+    "npm-token": re.compile(r"npm_[A-Za-z0-9]{36}"),
+    # A bare BEGIN header is itself a legitimate fixture (block-secrets.sh is
+    # tested with one); only a header followed by base64 key material is a key.
+    "private-key-material": re.compile(
+        r"-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----\s*\n[A-Za-z0-9+/=]{40,}"
+    ),
+}
+
+# Vendor-reserved identifiers that can never authenticate. Composed rather than
+# written literally, so this guard does not itself trip the guards it documents.
+VENDOR_RESERVED = frozenset(
+    {
+        "AKIA" + "IOSFODNN7EXAMPLE",
+        "ASIA" + "IOSFODNN7EXAMPLE",
+    }
+)
+
+# Binary and vendored trees carry no hand-authored fixtures worth policing.
+SKIP_SUFFIXES = frozenset({".png", ".jpg", ".jpeg", ".gif", ".webp", ".ico", ".pdf", ".woff2"})
+SKIP_PREFIXES = ("node_modules/", ".venv/")
+
+
+def _tracked_files() -> list[Path]:
+    out = subprocess.run(
+        ["git", "ls-files", "-z"], cwd=REPO, capture_output=True, text=True, check=True
+    ).stdout
+    paths = []
+    for rel in out.split("\0"):
+        if not rel or rel.startswith(SKIP_PREFIXES) or Path(rel).suffix in SKIP_SUFFIXES:
+            continue
+        paths.append(rel)
+    return [Path(p) for p in paths]
+
+
+def _violations() -> list[tuple[str, str, str]]:
+    found: list[tuple[str, str, str]] = []
+    for rel in _tracked_files():
+        try:
+            text = (REPO / rel).read_text(encoding="utf-8")
+        except (OSError, UnicodeDecodeError):
+            continue
+        for name, pattern in VENDOR_PATTERNS.items():
+            for match in pattern.finditer(text):
+                if match.group(0) in VENDOR_RESERVED:
+                    continue
+                line = text[: match.start()].count("\n") + 1
+                found.append((f"{rel}:{line}", name, match.group(0)[:24] + "…"))
+    return found
+
+
+def test_no_scannable_credential_literals() -> None:
+    violations = _violations()
+    assert not violations, (
+        "Tracked files contain credential-shaped literals at full vendor length.\n"
+        + "\n".join(f"  {loc}  [{kind}]  {sample}" for loc, kind, sample in violations)
+        + "\n\nA fixture must be safe by construction — compose it at run time, keep the"
+        "\nbody sub-threshold, or use a vendor-published reserved example."
+        "\nSee SECURITY.md § Test fixtures for secret detection."
+    )
+
+
+def test_scanner_exclusions_are_declared_and_narrow() -> None:
+    config = REPO / ".github" / "secret_scanning.yml"
+    assert config.exists(), (
+        "The fixture paths must be declared to GitHub in-repo so the reasoning is "
+        "public and reviewable, not buried in an alert dismissal."
+    )
+    listed = [
+        line.split("#", 1)[0].strip().lstrip("-").strip().strip('"').strip("'")
+        for line in config.read_text(encoding="utf-8").splitlines()
+        if line.strip().startswith("- ")
+    ]
+    assert listed, "secret_scanning.yml declares no paths-ignore entries"
+    for entry in listed:
+        assert not entry.rstrip("/*") in {"src", "tests", "docs", ""}, (
+            f"paths-ignore entry {entry!r} suppresses scanning for a whole hand-authored "
+            "tree; keep the list to detector fixtures and generated snapshots."
+        )
+
+
+@pytest.mark.parametrize(
+    "path",
+    [
+        "tests/test_block_secrets.py",
+        "src/core/thinking_os/tests/test_sanitizer.py",
+    ],
+)
+def test_declared_fixture_files_still_exist(path: str) -> None:
+    # A stale paths-ignore entry silently widens the unscanned surface.
+    assert (REPO / path).exists(), f"{path} is declared in secret_scanning.yml but is gone"

{coding_os-0.3.3 → coding_os-0.3.4}/tests/test_template_scaffold.py

@@ -17,7 +17,10 @@ Covers:
 
 from __future__ import annotations
 
+import json
 import re
+import shutil
+import subprocess
 import sys
 from pathlib import Path
 
@@ -1080,3 +1083,36 @@ class TestVueNuxtStack:
         assert "vue-nuxt" in registry_text
         dimensions_text = Path("src/core/rules/dimension-registry.md").read_text(encoding="utf-8")
         assert "Nuxt page / route" in dimensions_text
+
+
+class TestGoModuleDirectiveParses:
+    """Guard TASK-890: `module {{PROJECT_NAME}}` is unparseable by Go's modfile lexer.
+
+    `{` and `}` are token delimiters there, so the unquoted placeholder passes more
+    than one argument to the `module` directive. GitHub's dependency-graph job hit
+    exactly that and put a "Dependency file checks have 1 error" banner on the public
+    security page. Quoting keeps the literal placeholder (which the scaffold-verify
+    "no leftover placeholders" gate requires) while parsing cleanly; Go's own tooling
+    normalises the quotes away on the first `go mod edit -fmt` / `go mod tidy`.
+    """
+
+    GO_STACKS = ("go", "go-plain", "go-fiber")
+
+    @pytest.mark.parametrize("stack", GO_STACKS)
+    def test_module_placeholder_is_quoted(self, stack: str) -> None:
+        go_mod = Path(f"src/templates/{stack}/scaffold/src/backend/go.mod")
+        first = go_mod.read_text(encoding="utf-8").splitlines()[0]
+        assert first == 'module "{{PROJECT_NAME}}"', (
+            f"{go_mod}: expected the module path quoted so Go can parse the template; "
+            f"got {first!r}. See the class docstring before 'tidying' this."
+        )
+
+    @pytest.mark.skipif(shutil.which("go") is None, reason="go toolchain not installed")
+    @pytest.mark.parametrize("stack", GO_STACKS)
+    def test_go_toolchain_parses_the_template(self, stack: str) -> None:
+        mod_dir = Path(f"src/templates/{stack}/scaffold/src/backend").resolve()
+        proc = subprocess.run(
+            ["go", "mod", "edit", "-json"], cwd=mod_dir, capture_output=True, text=True
+        )
+        assert proc.returncode == 0, f"{mod_dir}/go.mod does not parse:\n{proc.stderr}"
+        assert json.loads(proc.stdout)["Module"]["Path"] == "{{PROJECT_NAME}}"

{coding_os-0.3.3 → coding_os-0.3.4}/tests/test_tool_failure_capture.py

@@ -23,9 +23,11 @@ def test_failure_capture_scrubs_username_and_secrets(tmp_path: Path) -> None:
     conn = init_db(db)
     home = str(Path.home())
     user = Path.home().name
+    # Composed, never a literal — SECURITY.md § Test fixtures for secret detection.
+    aws_shaped = "AKIA" + "1234567890ABCDEF"
     payload = {
         "tool_name": "Edit",
-        "error": f"Edit failed at {home}/proj/x.py key=AKIA1234567890ABCDEF mail a@b.com",
+        "error": f"Edit failed at {home}/proj/x.py key={aws_shaped} mail a@b.com",
         "tool_input": {"file_path": f"{home}/proj/x.py"},
     }
 

coding_os-0.3.3/src/templates/go/scaffold/src/backend/go.mod

@@ -1,3 +0,0 @@
-module {{PROJECT_NAME}}
-
-go 1.25

coding_os-0.3.3/src/templates/go-plain/scaffold/src/backend/go.mod

@@ -1,3 +0,0 @@
-module {{PROJECT_NAME}}
-
-go 1.22

coding_os-0.3.3/src/templates/svelte-sveltekit/scaffold/src/frontend/package.json

@@ -1,22 +0,0 @@
-{
-  "name": "{{PROJECT_NAME}}-frontend",
-  "private": true,
-  "type": "module",
-  "scripts": {
-    "dev": "vite dev",
-    "build": "vite build",
-    "preview": "vite preview",
-    "lint": "svelte-check --tsconfig ./tsconfig.json",
-    "test": "vitest run"
-  },
-  "devDependencies": {
-    "@sveltejs/adapter-auto": "^3.2.0",
-    "@sveltejs/kit": "^2.5.0",
-    "@sveltejs/vite-plugin-svelte": "^3.1.0",
-    "svelte": "^5.0.0",
-    "svelte-check": "^3.7.0",
-    "typescript": "^5.4.0",
-    "vite": "^5.2.0",
-    "vitest": "^1.4.0"
-  }
-}