dotagents-cli 0.6.0__tar.gz → 0.6.2__tar.gz

{dotagents_cli-0.6.0 → dotagents_cli-0.6.2}/CHANGELOG.md

@@ -7,6 +7,34 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.6.2] - 2026-09-28
+
+### Added
+
+- With the `duho` floor bump, every `dotagents` invocation now checks
+  `DOTAGENTS_MCP=stdio` and serves its full command tree as an MCP server
+  over stdio when set. `env` opts itself out of that tool surface
+  (`_mcp_ = False`): its whole point is printing resolved, possibly secret
+  values, which should never be a callable MCP tool. Every other command is
+  unaffected, and `env` still works normally on the CLI.
+
+### Changed
+
+- The `duho` floor moves to `>=0.6.0,<0.7` (from `>=0.5.0,<0.6`); the vendored
+  `.pyz` pin (`build-pyz --duho-version`) moves with it, per the repo's own
+  rule that the two must always agree. No other source change was needed.
+
+## [0.6.1] - 2026-09-27
+
+### Fixed
+
+- Re-running `init` after an upgrade from 0.5.x replaces the `CwdChanged` hooks
+  and Codex's `PreToolUse` hook that release wrote, instead of adding the new
+  ones beside them (every `cd` ran both, and the old one still wrote the
+  unquoted project path). A hook an earlier release wrote is recognised by its
+  label and a command that runs dotagents, reads `AGENTS.md` or
+  `AGENTS_PROJECT_ROOT`, or runs one of dotagents' hook scripts.
+
 ## [0.6.0] - 2026-09-25
 
 ### Added
@@ -1280,7 +1308,9 @@ Patch release: the PATH/POSIX-conversion fix above (the only change since 0.3.0)
   affected module sources (`dotagents.cli`, `duho.presets`) to extracted temp files
   before dispatch; a no-op for a plain install.
 
-[Unreleased]: https://github.com/jose-pr/dotagents/compare/v0.6.0...HEAD
+[Unreleased]: https://github.com/jose-pr/dotagents/compare/v0.6.2...HEAD
+[0.6.2]: https://github.com/jose-pr/dotagents/compare/v0.6.1...v0.6.2
+[0.6.1]: https://github.com/jose-pr/dotagents/compare/v0.6.0...v0.6.1
 [0.6.0]: https://github.com/jose-pr/dotagents/compare/v0.5.1...v0.6.0
 [0.5.1]: https://github.com/jose-pr/dotagents/compare/v0.5.0...v0.5.1
 [0.5.0]: https://github.com/jose-pr/dotagents/compare/v0.4.0...v0.5.0

{dotagents_cli-0.6.0 → dotagents_cli-0.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: dotagents-cli
-Version: 0.6.0
+Version: 0.6.2
 Summary: The dotagents CLI: install and manage a portable ~/.agents config for AI coding agents
 Project-URL: Homepage, https://github.com/jose-pr/dotagents/
 Project-URL: Repository, https://github.com/jose-pr/dotagents
@@ -23,7 +23,7 @@ Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Typing :: Typed
 Requires-Python: >=3.9
-Requires-Dist: duho<0.6,>=0.5.0
+Requires-Dist: duho<0.7,>=0.6.0
 Requires-Dist: pathlib-next<0.10,>=0.9.0
 Requires-Dist: tomli>=1.1.0; python_version < '3.11'
 Provides-Extra: dev

{dotagents_cli-0.6.0 → dotagents_cli-0.6.2}/pyproject.toml

@@ -35,7 +35,7 @@ classifiers = [
 # `build-pyz` vendors the floor of each of these (src/dotagents/cli/build_pyz.py);
 # raise a floor and move its pin there in the same change.
 dependencies = [
-    "duho>=0.5.0,<0.6",
+    "duho>=0.6.0,<0.7",
     "pathlib_next>=0.9.0,<0.10",
     # overlay.toml manifests and TOML registries; tomllib is stdlib from 3.11.
     'tomli>=1.1.0; python_version < "3.11"',

{dotagents_cli-0.6.0 → dotagents_cli-0.6.2}/src/dotagents/__init__.py

@@ -1,3 +1,3 @@
 """dotagents: installable CLI for the dotagents agent-config payload."""
 
-__version__ = "0.6.0"
+__version__ = "0.6.2"

{dotagents_cli-0.6.0 → dotagents_cli-0.6.2}/src/dotagents/_hooks.py

@@ -25,6 +25,7 @@ the ``.pyz``.
 from __future__ import annotations
 
 import json
+import re
 from pathlib import Path
 from typing import Any, Optional
 
@@ -32,9 +33,19 @@ from typing import Any, Optional
 #: Our hooks' statusMessage is `STATUS_PREFIX + label`, so a foreign hook that
 #: happens to use the same generic label ("Loading agent context") is never
 #: taken for ours. The bare label an earlier release wrote is still ours when
-#: the hook's command runs dotagents, so those hooks converge to the new one.
+#: the hook's command is recognisably dotagents' (:data:`_LEGACY_COMMAND`), so
+#: those hooks converge to the new one instead of running beside it.
 STATUS_PREFIX = "dotagents: "
 
+#: What every command an earlier release wrote contains: `dotagents` itself
+#: (SessionStart, the PowerShell loader), the project pin or `AGENTS.md`
+#: (CwdChanged, which never names dotagents), or one of the deployed hook
+#: scripts (Codex, Antigravity: `python3 ".../pretooluse_codex_env.py"`).
+_LEGACY_COMMAND = re.compile(
+    r"dotagents|AGENTS_PROJECT_ROOT|AGENTS\.md"
+    r"|(?:sessionstart_codex_context|pretooluse_codex_env|preinvocation_antigravity_context)\.py"
+)
+
 #: The hook keys dotagents manages; any other key a user added (a `timeout`,
 #: say) survives a refresh.
 _MANAGED_KEYS = frozenset({"type", "command", "shell", "commandWindows", "statusMessage"})
@@ -56,7 +67,7 @@ def _labelled_ours(hook: Any, status_message: "Optional[str]") -> bool:
     status = hook.get("statusMessage")
     if status == labels[0]:
         return True
-    return status == labels[1] and "dotagents" in str(hook.get("command", ""))
+    return status == labels[1] and bool(_LEGACY_COMMAND.search(str(hook.get("command", ""))))
 
 
 def build_hook_entry(

{dotagents_cli-0.6.0 → dotagents_cli-0.6.2}/src/dotagents/cli/__init__.py

@@ -217,9 +217,15 @@ def _discover_modules(directory: Path) -> "list":
     not an Exception. A command that imports but cannot build its parser is
     skipped the same way (`_buildable`). Falls back to duho's own
     per-directory unit, with a warning, if a duho release moves these
-    helpers."""
+    helpers.
+
+    Uses duho's PUBLIC `import_from_path` (duho >= 0.6.0) for the file
+    import; `_commands_in_module` has no public counterpart yet, so it stays
+    a private import (see `duho.discovery.import_from_path`'s own docstring:
+    it is the public counterpart of the `_unique_module_name` +
+    `_import_from_path` pair this module used to call directly)."""
     try:
-        from duho.discovery import _commands_in_module, _import_from_path, _unique_module_name
+        from duho.discovery import _commands_in_module, import_from_path
     except ImportError:  # pragma: no cover -- a later duho without these internals
         from duho.discovery import discover_commands
 
@@ -234,7 +240,7 @@ def _discover_modules(directory: Path) -> "list":
         if file.name.startswith("_"):
             continue
         try:
-            module = _import_from_path(_unique_module_name("duho._discovered." + file.stem), file)
+            module = import_from_path("duho._discovered." + file.stem, file)
             found = _commands_in_module(module, stem=file.stem)
         except (Exception, SystemExit) as exc:  # noqa: BLE001 -- see docstring
             _LOGGER.warning("skipping command module %s: %s", file, _describe(exc))

{dotagents_cli-0.6.0 → dotagents_cli-0.6.2}/src/dotagents/cli/build_pyz.py

@@ -73,7 +73,7 @@ class BuildPyz(LoggingArgs, Cmd):
     # stale pin here ships an artifact `pip install dotagents-cli` would refuse.
     # Pin the FLOOR of each declared range, not the latest patch -- the .pyz then
     # exercises the minimum the metadata promises.
-    duho_version: str = "0.5.0"
+    duho_version: str = "0.6.0"
     "Pinned duho version to vendor."
     ("--duho-version",)
 

{dotagents_cli-0.6.0 → dotagents_cli-0.6.2}/src/dotagents/cli/env.py

@@ -539,6 +539,15 @@ class Env(DotAgentsArgs):
 
     _parsername_ = "env"
 
+    # Opt out of the MCP tool surface (duho >= 0.6.0): this command's whole
+    # point is to print resolved, possibly secret values (see the class
+    # docstring's "Output is sensitive" note) -- exactly what an MCP client
+    # should never be handed as a callable tool. `_mcp_ = False` on a
+    # non-root command class hides it (and any subtree) from `tools/list`
+    # and refuses `tools/call` the same way an unknown name would; the CLI
+    # itself is unaffected.
+    _mcp_ = False
+
     format: str = "auto"
     (
         "Output format. Default 'auto' detects the calling shell. Shell forms: "

{dotagents_cli-0.6.0 → dotagents_cli-0.6.2}/tests/test_fix_cli.py

@@ -220,10 +220,13 @@ def test_moved_duho_internals_are_reported_not_silent(monkeypatch, tmp_path, cap
     real_import = builtins.__import__
 
     def renamed(name, globals=None, locals=None, fromlist=(), level=0):
-        # What a duho release that renamed its private helpers looks like to
-        # `from duho.discovery import _import_from_path, ...` -- and only to it.
-        if name == "duho.discovery" and "_import_from_path" in (fromlist or ()):
-            raise ImportError("cannot import name '_import_from_path'")
+        # What a duho release that renamed its remaining private helper looks
+        # like to `from duho.discovery import _commands_in_module, ...` --
+        # and only to it. `import_from_path` is duho's public counterpart
+        # (duho >= 0.6.0) and stays importable; `_commands_in_module` has no
+        # public counterpart yet, so it is the one still exposed to this risk.
+        if name == "duho.discovery" and "_commands_in_module" in (fromlist or ()):
+            raise ImportError("cannot import name '_commands_in_module'")
         return real_import(name, globals, locals, fromlist, level)
 
     monkeypatch.setattr(builtins, "__import__", renamed)

{dotagents_cli-0.6.0 → dotagents_cli-0.6.2}/tests/test_hooks.py

@@ -191,3 +191,38 @@ def test_status_match_does_not_touch_a_foreign_hook():
     commands = [h["command"] for e in merged for h in e["hooks"]]
     assert "mine" in commands
     assert CMD in commands
+
+
+# The exact commands 0.5.x wrote. CwdChanged never named dotagents, and the
+# Codex loader names only its script, so recognising a legacy hook by
+# "dotagents" in its command left them in place beside the new ones.
+_CWD_051 = (
+    'if [ -n "$CLAUDE_ENV_FILE" ] && [ -d .agents ]; then printf "export '
+    "AGENTS_PROJECT_ROOT='%s'\\n\" \"$(pwd -W 2>/dev/null || pwd)\" >> \"$CLAUDE_ENV_FILE\"; "
+    'fi; [ -f AGENTS.md ] && cat AGENTS.md || true'
+)
+_CWD_051_PS = (
+    "if (-not (Get-Command bash -ErrorAction SilentlyContinue)) { if (Test-Path AGENTS.md) "
+    "{ Get-Content AGENTS.md -Raw } }"
+)
+_CODEX_051 = 'python3 "/home/u/.codex/hooks/pretooluse_codex_env.py"'
+
+
+@pytest.mark.parametrize("old, label", [
+    (_CWD_051, "Checking for AGENTS.md"),
+    (_CWD_051_PS, "Checking for AGENTS.md (PowerShell)"),
+    (_CODEX_051, "Loading agent env"),
+])
+def test_every_hook_an_earlier_release_wrote_converges(old, label):
+    legacy = {"hooks": [{"type": "command", "command": old, "statusMessage": label}]}
+    merged, changed = _hooks.merge_hook([legacy], "NEW", status_message=label)
+    assert changed and len(merged) == 1, merged
+    assert merged[0]["hooks"][0]["command"] == "NEW"
+    assert merged[0]["hooks"][0]["statusMessage"] == "dotagents: " + label
+
+
+def test_a_foreign_hook_with_our_bare_label_and_unrelated_command_stays():
+    foreign = {"hooks": [{"type": "command", "command": "notify-send hi",
+                          "statusMessage": "Checking for AGENTS.md"}]}
+    merged, _ = _hooks.merge_hook([foreign], "NEW", status_message="Checking for AGENTS.md")
+    assert merged[0] == foreign and len(merged) == 2

dotagents_cli-0.6.2/tests/test_mcp.py

@@ -0,0 +1,60 @@
+"""`env`'s MCP opt-out (duho >= 0.6.0).
+
+`env` prints resolved, possibly secret values (its own docstring's "Output is
+sensitive" note) -- exactly what an MCP client should never be handed as a
+callable tool. It is a compiled, module-level command CLASS (`Env`, one of
+`dotagents.cli._BUILTIN_COMMANDS`, dispatched via `duho.app`'s `commands=`),
+not a discovered `.py` module command, so the opt-out is the class-attribute
+form: `_mcp_ = False` set directly on `Env` (`dotagents/cli/env.py`) -- NOT a
+module-level `_mcp_ = False` in a `cmds/` file, which is the form for a
+discovered module command instead.
+
+`test_env_command_is_hidden_from_mcp_tools` drives a REAL
+`DOTAGENTS_MCP=stdio` session (the env-var trigger duho.app checks before
+parsing argv) in a subprocess, under the suite's autouse isolated
+HOME/AGENTS_* (tests/conftest.py) -- never the real `~/.agents`. It asserts
+`dotagents.env` is absent from `tools/list` while `dotagents.about` (an
+ordinary built-in) is still present, then that `env` still works as a normal
+CLI command -- the opt-out only removes it from the MCP surface.
+"""
+
+import json
+import os
+import subprocess
+import sys
+
+from dotagents.cli.env import Env
+
+
+def test_env_command_is_hidden_from_mcp_tools():
+    request = json.dumps({"jsonrpc": "2.0", "id": 1, "method": "tools/list"})
+    env = dict(os.environ)
+    env["DOTAGENTS_MCP"] = "stdio"
+
+    proc = subprocess.run(
+        [sys.executable, "-m", "dotagents"],
+        input=request + "\n",
+        capture_output=True,
+        text=True,
+        env=env,
+        timeout=30,
+    )
+    assert proc.returncode == 0, proc.stderr
+
+    lines = [line for line in proc.stdout.splitlines() if line.strip()]
+    assert len(lines) == 1, proc.stdout
+    response = json.loads(lines[0])
+    names = {tool["name"] for tool in response["result"]["tools"]}
+
+    assert "dotagents.about" in names, names
+    assert "dotagents.env" not in names, names
+    assert not any(name.startswith("dotagents.env.") for name in names), names
+
+
+def test_env_still_works_on_the_cli(capsys):
+    """The MCP opt-out is MCP-only: `env` dispatches normally on the CLI."""
+    command = Env()
+    command.format = "json"
+
+    assert command() == 0
+    assert isinstance(json.loads(capsys.readouterr().out), dict)

{dotagents_cli-0.6.0 → dotagents_cli-0.6.2}/tools/pyz_smoke.sh

@@ -76,7 +76,7 @@ has_re "$h" "$(flag --agents)"
 # modules, findings and launch. Matched on the command-list line, since
 # `overlays`' own description mentions its `sync` subcommand.
 h=$(pyz --help)
-has "$h" "{init,build-pyz,context,env,path,overlays,about,findings,launch}"
+has "$h" "{about,build-pyz,context,env,findings,init,launch,overlays,path}"
 lacks "$h" "link-project"
 lacks "$h" "sync-project"
 lacks "$h" "audit"