corgea-cli 1.8.7__tar.gz → 1.9.0__tar.gz

corgea_cli-1.9.0/.codex/hooks.json

@@ -0,0 +1,14 @@
+{
+  "hooks": {
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "./harness post-edit codex"
+          }
+        ]
+      }
+    ]
+  }
+}

{corgea_cli-1.8.7 → corgea_cli-1.9.0}/.github/workflows/release.yml

@@ -22,6 +22,7 @@ jobs:
   linux-x86:
     runs-on: ${{ matrix.platform.runner }}
     strategy:
+      fail-fast: false
       matrix:
         platform:
           - runner: ubuntu-latest
@@ -31,12 +32,26 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+      - name: Prepare resilient maturin download for manylinux Docker
+        run: |
+          bin_dir="${RUNNER_TEMP}/maturin-docker-bin"
+          mkdir -p "$bin_dir"
+          cat > "$bin_dir/curl" <<'EOF'
+          #!/bin/bash
+          set -euo pipefail
+          if [[ " $* " == *" PyO3/maturin/releases "* ]]; then
+            exec /usr/bin/curl --fail --retry 5 --retry-delay 3 --retry-all-errors "$@"
+          fi
+          exec /usr/bin/curl "$@"
+          EOF
+          chmod +x "$bin_dir/curl"
       - name: Build wheels
         uses: PyO3/maturin-action@v1
         with:
           target: ${{ matrix.platform.target }}
           args: --release --out dist
           manylinux: auto
+          docker-options: -v ${{ runner.temp }}/maturin-docker-bin/curl:/usr/local/bin/curl:ro
           before-script-linux: |
             # If we're running on rhel centos, install needed packages.
             if command -v yum &> /dev/null; then
@@ -45,6 +60,26 @@ jobs:
                 # If we're running on debian-based system.
                 apt update -y && apt-get install -y libssl-dev openssl pkg-config musl-tools
             fi
+      - name: Assert manylinux wheel compatibility tags
+        run: |
+          shopt -s nullglob
+          wheels=(dist/*.whl)
+          if ((${#wheels[@]} == 0)); then
+            echo "No wheels found in dist/"
+            exit 1
+          fi
+          for wheel in "${wheels[@]}"; do
+            base=$(basename "$wheel")
+            if [[ "$base" == *manylinux_2_3[0-9]* ]]; then
+              echo "Wheel tag too new for broad Linux support: $base"
+              exit 1
+            fi
+            if [[ ! "$base" =~ manylinux2014 ]]; then
+              echo "Expected manylinux2014 compatibility tag, got: $base"
+              exit 1
+            fi
+            echo "OK: $base"
+          done
       - name: Upload wheels
         uses: actions/upload-artifact@v4
         with:

{corgea_cli-1.8.7 → corgea_cli-1.9.0}/.github/workflows/test.yml

@@ -17,10 +17,17 @@ jobs:
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
+        with:
+          components: llvm-tools-preview
+
+      - name: Install cargo-llvm-cov
+        uses: taiki-e/install-action@cargo-llvm-cov
+
+      - name: Install cargo-audit
+        uses: taiki-e/install-action@cargo-audit
 
       - name: Cache cargo
         uses: Swatinem/rust-cache@v2
 
-
-      - name: Run unit tests
-        run: cargo test
+      - name: CI gate
+        run: ./harness ci

{corgea_cli-1.8.7 → corgea_cli-1.9.0}/.gitignore

@@ -3,5 +3,9 @@
 .DS_Store
 .dccache
 *.zip
+*.profraw
 node_modules/
 /packages/*/vendor/
+
+.claude/
+CLAUDE.md

corgea_cli-1.9.0/AGENTS.md

@@ -0,0 +1,24 @@
+# AGENTS.md
+
+This subproject is the Corgea developer CLI (Rust → npm + pip via maturin).
+
+## Commands
+
+- After edits: `./harness check` — clippy fix, format, tests, suppression report
+- Pre-commit: `./harness pre-commit` — staged Rust files only (auto via git hook)
+- CI: `./harness ci` — strict clippy (`-D warnings`), format check, dep audit, tests + coverage gate (min 13%)
+- Audit: `./harness audit` — `cargo audit` for known dep vulnerabilities
+- Coverage: `./harness coverage [--min=N]` — cargo-llvm-cov; HTML report under `target/llvm-cov/`; fails if line coverage < N (default 13)
+- Lint: `./harness lint` — clippy + format check, no fixes
+- Test: `./harness test` — `cargo test`
+- Fix: `./harness fix` — clippy fix + format
+- Setup: `./harness setup-hooks` — install `.git/hooks/pre-commit`
+- Auto-format: `./harness post-edit` — runs `cargo fmt` on changed Rust files (wire into your editor/agent's post-edit hook)
+
+Add `--verbose` to stream raw command output instead of the quiet summary.
+
+Coverage needs LLVM's `llvm-cov`/`llvm-profdata`. On a rustup toolchain, run
+`rustup component add llvm-tools-preview`. On a non-rustup toolchain (e.g.
+Homebrew Rust) those are missing, so point cargo-llvm-cov at a system LLVM:
+`LLVM_COV="$(brew --prefix llvm)/bin/llvm-cov" LLVM_PROFDATA="$(brew --prefix llvm)/bin/llvm-profdata" ./harness coverage`.
+CI uses its own toolchain and is unaffected.

{corgea_cli-1.8.7 → corgea_cli-1.9.0}/Cargo.lock

@@ -340,11 +340,12 @@ checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
 name = "corgea"
-version = "1.8.7"
+version = "1.9.0"
 dependencies = [
  "chrono",
  "clap",
  "dirs",
+ "env_logger",
  "git2",
  "globset",
  "http",
@@ -352,6 +353,7 @@ dependencies = [
  "hyper",
  "hyper-util",
  "ignore",
+ "log",
  "open",
  "openssl",
  "quick-xml",
@@ -360,6 +362,7 @@ dependencies = [
  "serde",
  "serde_derive",
  "serde_json",
+ "serde_yaml_ng",
  "tempfile",
  "termcolor",
  "tokio",
@@ -523,6 +526,29 @@ version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
 
+[[package]]
+name = "env_filter"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a1c3cc8e57274ec99de65301228b537f1e4eedc1b8e0f9411c6caac8ae7308f"
+dependencies = [
+ "log",
+ "regex",
+]
+
+[[package]]
+name = "env_logger"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2daee4ea451f429a58296525ddf28b45a3b64f1acf6587e2067437bb11e218d"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "env_filter",
+ "jiff",
+ "log",
+]
+
 [[package]]
 name = "equivalent"
 version = "1.0.2"
@@ -1092,6 +1118,30 @@ version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
 
+[[package]]
+name = "jiff"
+version = "0.2.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4603d3033e49e2b0e31229fcab20a5d40089c607d975cd9c80551dc69eed9102"
+dependencies = [
+ "jiff-static",
+ "log",
+ "portable-atomic",
+ "portable-atomic-util",
+ "serde_core",
+]
+
+[[package]]
+name = "jiff-static"
+version = "0.2.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "782d32378dddf207193ac91cefb848ad41abb58195c95168e1291227a0832b47"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "jobserver"
 version = "0.1.34"
@@ -1321,15 +1371,14 @@ dependencies = [
 
 [[package]]
 name = "openssl"
-version = "0.10.73"
+version = "0.10.80"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8505734d46c8ab1e19a1dce3aef597ad87dcb4c37e7188231769bd6bd51cebf8"
+checksum = "a45fa2aa886c42762255da344f0a0d313e254066c46aad76f300c3d3da62d967"
 dependencies = [
  "bitflags",
  "cfg-if",
  "foreign-types",
  "libc",
- "once_cell",
  "openssl-macros",
  "openssl-sys",
 ]
@@ -1362,9 +1411,9 @@ dependencies = [
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.109"
+version = "0.9.116"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90096e2e47630d78b7d1c20952dc621f957103f8bc2c8359ec81290d75238571"
+checksum = "f28a22dc7140cda5f096e5e7724a6962ca81a7f8bfd2979f9b18c11af56318c4"
 dependencies = [
  "cc",
  "libc",
@@ -1442,6 +1491,21 @@ version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
 
+[[package]]
+name = "portable-atomic"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a106d1259c23fac8e543272398ae0e3c0b8d33c88ed73d0cc71b0f1d902618"
+dependencies = [
+ "portable-atomic",
+]
+
 [[package]]
 name = "potential_utf"
 version = "0.1.3"
@@ -1760,6 +1824,19 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "serde_yaml_ng"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b4db627b98b36d4203a7b458cf3573730f2bb591b28871d916dfa9efabfd41f"
+dependencies = [
+ "indexmap",
+ "itoa",
+ "ryu",
+ "serde",
+ "unsafe-libyaml",
+]
+
 [[package]]
 name = "sha1"
 version = "0.10.6"
@@ -2170,6 +2247,12 @@ version = "1.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f63a545481291138910575129486daeaf8ac54aee4387fe7906919f7830c7d9d"
 
+[[package]]
+name = "unsafe-libyaml"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
+
 [[package]]
 name = "url"
 version = "2.5.7"

{corgea_cli-1.8.7 → corgea_cli-1.9.0}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "corgea"
-version = "1.8.7"
+version = "1.9.0"
 edition = "2021"
 readme = "README.md"
 
@@ -18,6 +18,8 @@ reqwest = { version = "0.12.23", default-features = false, features = [
     "system-proxy",
 ] }
 toml = "0.8.8"
+log = "0.4"
+env_logger = "0.11"
 serde = { version = "1.0.195", features = ["derive"] }
 serde_json = "1.0.111"
 serde_derive = "1.0.195"
@@ -40,6 +42,7 @@ http-body-util = "0.1"
 url = "2.5"
 open = "5.0"
 urlencoding = "2.1"
+serde_yaml_ng = "0.10"
 
 [target.'cfg(not(target_os = "windows"))'.dependencies]
 openssl = { version = "0.10", features = ["vendored"] }

{corgea_cli-1.8.7 → corgea_cli-1.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: corgea-cli
-Version: 1.8.7
+Version: 1.9.0
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers

{corgea_cli-1.8.7 → corgea_cli-1.9.0}/README.md

@@ -26,6 +26,29 @@ Once the binary is installed, login with your token from the Corgea app.
 corgea login <token>
 ```
 
+## Dependency Inventory (offline)
+
+`corgea deps` builds a dependency inventory from npm, Python, and Java manifests
+and lockfiles, then evaluates a pinning policy (DEP rules). Runs fully offline —
+no token or network required.
+
+```bash
+corgea deps scan                       # table report for the current directory
+corgea deps scan --format agent        # compact TSV for coding agents
+corgea deps scan --format json         # JSON inventory on stdout
+corgea deps scan --format quiet        # no stdout; exit code still applies
+corgea deps scan --fail-on high        # exit 1 if any finding is >= high
+corgea deps scan --out-format json     # machine-readable (json or sarif)
+corgea deps graph --format json        # print the resolved dependency graph
+corgea deps explain <package> --format agent  # show why a package is present
+corgea deps diff --base origin/main --format json
+corgea deps sbom --format cyclonedx    # emit a CycloneDX SBOM
+corgea deps policy init --exist-ok     # write starter policy, or keep existing file
+```
+
+`corgea deps` defaults to `--format agent` when an agent environment is detected (`AI_AGENT`, `CODEX_SANDBOX`, `CLAUDECODE`, and related agent variables). Use `--format human` to force the normal terminal output.
+
+See [Dependency Scanning (CLI)](https://docs.corgea.app/cli/deps) for the full flag and exit-code reference.
 
 ## Development Setup
 

corgea_cli-1.9.0/examples/deps_skill.rs

@@ -0,0 +1,31 @@
+use std::path::Path;
+use std::process::ExitCode;
+
+use corgea::deps::skill::{check_skill_file, generated_marked_section, update_skill_file};
+
+const SKILL_PATH: &str = "skills/corgea/SKILL.md";
+
+fn main() -> ExitCode {
+    let mode = std::env::args()
+        .nth(1)
+        .unwrap_or_else(|| "print".to_string());
+    let skill_path = Path::new(SKILL_PATH);
+
+    let result = match mode.as_str() {
+        "print" => {
+            println!("{}", generated_marked_section());
+            Ok(())
+        }
+        "check" => check_skill_file(skill_path),
+        "update" => update_skill_file(skill_path),
+        _ => Err("usage: cargo run --example deps_skill -- [print|check|update]".to_string()),
+    };
+
+    match result {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(message) => {
+            eprintln!("{message}");
+            ExitCode::FAILURE
+        }
+    }
+}