dotagents-cli 0.7.0__tar.gz → 0.7.2__tar.gz

{dotagents_cli-0.7.0 → dotagents_cli-0.7.2}/CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.7.2] - 2026-10-03
+
+### Added
+
+- `git_ssl_revoke` in `<store>/dotagents/config.toml` sets how the git clones and
+  fetches of overlay repos check certificate revocation: `best-effort` (the default)
+  skips a revocation list that is missing or unreachable, `false` skips the check, as
+  git on Linux does, `true` enforces it. It is passed to every git call, so a stricter
+  git configuration elsewhere no longer fails an https clone on Windows, and a clone
+  that still fails on revocation says which setting to change. A git too old to know
+  `best-effort` (it rejects the value) runs the call again without the setting.
+
+## [0.7.1] - 2026-10-01
+
+### Added
+
+- Your own additions to an installed overlay's file live at the same path under the
+  store root (`~/.agents/kb/RUST.md` for the rust overlay's `kb/RUST.md`, or
+  `<project>/.agents/kb/RUST.md`), where `overlays sync` never touches them. The
+  base `AGENTS.md` tells agents to read them alongside the overlay's file, and
+  `dotagents context` lists the ones it finds (JSON: `local_additions`).
+
 ## [0.7.0] - 2026-10-01
 
 ### Changed
@@ -1347,7 +1369,7 @@ Patch release: the PATH/POSIX-conversion fix above (the only change since 0.3.0)
 
 ### Changed
 
-- Migrate the CLI to `duho>=0.3.3` (was `>=0.1.1`). duho's Plan-13 `Args`/`Cmd`
+- Migrate the CLI to `duho>=0.3.3` (was `>=0.1.1`). duho's `Args`/`Cmd`
   split means commands are now `class X(LoggingArgs, Cmd)` with a `__call__` entrypoint
   (was a bare `LoggingArgs` with `__run__`) and the umbrella root is
   `class Dotagents(LoggingArgs, Cli)`. Field declarations (annotation + help string +
@@ -1362,7 +1384,9 @@ Patch release: the PATH/POSIX-conversion fix above (the only change since 0.3.0)
   affected module sources (`dotagents.cli`, `duho.presets`) to extracted temp files
   before dispatch; a no-op for a plain install.
 
-[Unreleased]: https://github.com/jose-pr/dotagents/compare/v0.7.0...HEAD
+[Unreleased]: https://github.com/jose-pr/dotagents/compare/v0.7.2...HEAD
+[0.7.2]: https://github.com/jose-pr/dotagents/compare/v0.7.1...v0.7.2
+[0.7.1]: https://github.com/jose-pr/dotagents/compare/v0.7.0...v0.7.1
 [0.7.0]: https://github.com/jose-pr/dotagents/compare/v0.6.3...v0.7.0
 [0.6.3]: https://github.com/jose-pr/dotagents/compare/v0.6.2...v0.6.3
 [0.6.2]: https://github.com/jose-pr/dotagents/compare/v0.6.1...v0.6.2

{dotagents_cli-0.7.0 → dotagents_cli-0.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: dotagents-cli
-Version: 0.7.0
+Version: 0.7.2
 Summary: The dotagents CLI: install and manage a portable ~/.agents config for AI coding agents
 Project-URL: Homepage, https://github.com/jose-pr/dotagents/
 Project-URL: Repository, https://github.com/jose-pr/dotagents
@@ -270,7 +270,8 @@ config miss is a **finding** — `dotagents findings add -g` for the user store
 triage closes each with its resolution, which is the record. How you keep any
 decisions beyond that is up to you. A store's `dotagents/` directory exists only for
 your own command modules (`dotagents/cmds/`), which you create when you add your first
-one, and for `dotagents/config.toml`, which records an `init --from` base. This
+one, and for `dotagents/config.toml`, which records an `init --from` base and,
+if you set it, `git_ssl_revoke` (how git checks certificate revocation on Windows). This
 repo follows the same rule: its working material lives in an **untracked** `.agents/`,
 never committed — so what's public here is only the CLI, the base overlay, and the
 opt-in overlays. If you fork, keep the tracked surface free of personal paths and

{dotagents_cli-0.7.0 → dotagents_cli-0.7.2}/README.md

@@ -220,7 +220,8 @@ config miss is a **finding** — `dotagents findings add -g` for the user store
 triage closes each with its resolution, which is the record. How you keep any
 decisions beyond that is up to you. A store's `dotagents/` directory exists only for
 your own command modules (`dotagents/cmds/`), which you create when you add your first
-one, and for `dotagents/config.toml`, which records an `init --from` base. This
+one, and for `dotagents/config.toml`, which records an `init --from` base and,
+if you set it, `git_ssl_revoke` (how git checks certificate revocation on Windows). This
 repo follows the same rule: its working material lives in an **untracked** `.agents/`,
 never committed — so what's public here is only the CLI, the base overlay, and the
 opt-in overlays. If you fork, keep the tracked surface free of personal paths and

{dotagents_cli-0.7.0 → dotagents_cli-0.7.2}/docs/guide/commands.md

@@ -216,7 +216,11 @@ Assembles the effective context an agent should load — the overlay `CONTEXT.md
 and the project root's own `AGENTS.md` / `AGENTS.local.md` — minus whatever the harness already loads by itself (for Claude Code, whatever its
 `CLAUDE.md` files really `@`-include) — and prints it to **stdout** by default
 (POSIX convention); pass a path to write a file, or `--write-agent` to merge it into
-each agent's own instruction file.
+each agent's own instruction file. It ends with the skills on offer and, when there are
+any, your **local additions to overlay files** — a store file at the same path as an
+overlay's (`~/.agents/kb/RUST.md` for the rust overlay's `kb/RUST.md`; see
+[Overlays](overlays.md)); `--format json` carries both as their own keys (`skills`,
+`local_additions`).
 
 ```bash
 dotagents context                              # print the active agent's context to stdout

{dotagents_cli-0.7.0 → dotagents_cli-0.7.2}/docs/guide/install.md

@@ -101,7 +101,17 @@ python -m dotagents build-pyz --out dist/dotagents.pyz   # or build it (needs a
   [Authoring → Custom commands](authoring.md#custom-commands)).
 - `dotagents/config.toml` — only after `init --from`: records that base, so a later
   `init` and every `overlays add` / `remove` / `sync` compose over it. Delete its
-  `base` line to return to the bundled base.
+  `base` line to return to the bundled base. You may add one setting by hand:
+  `git_ssl_revoke` — how strictly the git clones of overlay repos check that the
+  server's certificate is not revoked. `best-effort` (the default) skips a
+  revocation list that is missing or unreachable; `false` skips the check, as git
+  on Linux always does; `true` enforces it. It matters on Windows, where git
+  checks revocation and an https clone otherwise fails when the list cannot be
+  fetched; a project store's setting wins over the user store's.
+
+  ```toml
+  git_ssl_revoke = "false"
+  ```
 
 ## What runs, and from where
 

{dotagents_cli-0.7.0 → dotagents_cli-0.7.2}/docs/guide/overlays.md

@@ -79,8 +79,17 @@ up under `<store>/install_backup/` first. What the `.gitignore` / `.ignore` at t
 overlay's root match (an ignore file in a subdirectory is just a file it ships), and
 tool caches, belong to the install (a setup script's output, local
 state) and are left alone; `--prune` clears them too. A `requires` added upstream is
-installed. An installed overlay is upstream's copy, not a place for your edits: keep
-those in your own files (a `kb/` file, `AGENTS.local.md`).
+installed. An installed overlay is upstream's copy, not a place for your edits.
+
+### Your additions to an overlay's files
+
+Put your own text for an overlay file at the **same path under the store root**: an
+addition to the rust overlay's `kb/RUST.md` goes in `~/.agents/kb/RUST.md` (or
+`<project>/.agents/kb/RUST.md` for one project). `sync` never touches it, and agents
+read it alongside the overlay's file, winning on conflict: the base `AGENTS.md` tells
+them to, and `dotagents context` lists every addition it finds (for each `.md` an
+overlay ships in a subdirectory other than `skills/`). Private names, local tool paths
+and links into your own notes belong there, never in the overlay.
 
 Removing an overlay deletes only its directory and unpublishes only the skills **it**
 published (a copy the user edited is left alone). Its lines in `AGENTS.md`'s managed

{dotagents_cli-0.7.0 → dotagents_cli-0.7.2}/src/dotagents/AGENTS.md

@@ -306,7 +306,15 @@ a directory of overlays or a registry file (default: the root); for a **source**
 - `redact(text) -> str` — URL userinfo removed, query values masked.
 - `uri_path_class()` — `pathlib_next.uri.UriPath`, or `None` without the `uri` extra.
 - `url_scheme(location) -> str` — the lower-cased scheme.
-- `class SourceCache(root, logger=None)` — `repo_dir(location, ref=None) -> Path`
+- `GIT_SSL_REVOKE_KEY = "git_ssl_revoke"`, `GIT_SSL_REVOKE_VALUES = ("best-effort",
+  "true", "false")`, `GIT_SSL_REVOKE_DEFAULT = "best-effort"`;
+  `git_ssl_revoke(*stores) -> str` — the first store config (`config.toml`) that sets
+  the key, project store first; another value raises `SourceError` naming the file.
+- `class SourceCache(root, logger=None, ssl_revoke="best-effort")` — every git call
+  runs as `git -c http.schannelCheckRevoke=<ssl_revoke> ...` (Git for Windows'
+  Schannel checks revocation; git with OpenSSL ignores it), and a failure that looks
+  like a revocation check names the key. A git that rejects the value as a bad
+  boolean (older than `best-effort`) is asked again without it. `repo_dir(location, ref=None) -> Path`
   (`<root>/<slug>-<hash>`); `checkout(spec) -> Path` (clone or fetch, once per
   process; a failed fetch of an existing checkout is a warning);
   `materialize(spec) -> Path` (a `url` spec: `file://` in place, anything else
@@ -433,7 +441,8 @@ API:
   `Overlay.sort_key`, then contract-A `AGENTS.md` (every store and the project root)
   and `AGENTS.local.md` (project store and project root), each prefixed
   `<!-- Source: <path> -->`. Then a skills listing (`- **name** (`<SKILL.md>`):
-  description`, from each skill's leading frontmatter; a project skill wins).
+  description`, from each skill's leading frontmatter; a project skill wins), then
+  a "Local additions to overlay files" section when `local_additions` finds any.
   `<PROJECT_ROOT>` and `<NAME_OVERLAY_ROOT>` placeholders expand; with
   `expand_vars` so do `$NAME_OVERLAY_ROOT` / `${NAME_OVERLAY_ROOT}`. `inline`
   appends the on-demand `.md` files the sources reference, each resolved against
@@ -441,7 +450,13 @@ API:
   system source never into the project).
 - `assemble_context_data(agent, scope, *, inline=False, expand_vars=True) -> dict`
   — `{"agent", "harness", "sources", "context", "skills": [{"name",
-  "description", "path"}]}`; `context` without the skills listing.
+  "description", "path"}], "local_additions": [{"overlay_file", "local": [...]}]}`;
+  `context` without the skills and local-additions listings.
+- `local_additions(scope) -> list[tuple[Path, list[Path]]]` — the user's own
+  additions to installed overlay files: for each `.md` an overlay in `scope.overlays`
+  ships in a subdirectory other than `skills/`, every store's file at the same
+  relative path (`<store>/kb/RUST.md` for the overlay's `kb/RUST.md`), in
+  `scope.stores` order. A store's root files never match.
 
 ## `dotagents._agents`
 

{dotagents_cli-0.7.0 → dotagents_cli-0.7.2}/src/dotagents/__init__.py

@@ -1,3 +1,3 @@
 """dotagents: installable CLI for the dotagents agent-config payload."""
 
-__version__ = "0.7.0"
+__version__ = "0.7.2"

{dotagents_cli-0.7.0 → dotagents_cli-0.7.2}/src/dotagents/_context.py

@@ -309,6 +309,44 @@ def _get_skills_listing(scope: _scope.Scope) -> str:
     return "\n\n## Available Skills (Opt-in)\n" + "\n".join(lines) + "\n"
 
 
+def local_additions(scope: _scope.Scope) -> "list[tuple[Path, list[Path]]]":
+    """The user's own additions to installed overlay files: for each ``.md``
+    an overlay ships in a subdirectory (``kb/``, ``flows/``, ``rules/`` ... --
+    not ``skills/``, whose published copies sit at the same path in a store),
+    every store's file at the same relative path (``~/.agents/kb/RUST.md`` for
+    an overlay's ``kb/RUST.md``), in store order. An overlay file is upstream's
+    copy, replaced by ``overlays sync``; the addition is where the user's own
+    text lives. A store's root files (``AGENTS.md``, ``env.py``) never match:
+    only a file in a subdirectory counts."""
+    stores = list(scope.stores)
+    out: "list[tuple[Path, list[Path]]]" = []
+    for overlay in scope.overlays:
+        for path in overlay.files():
+            rel = path.relative_to(overlay.path)
+            if path.suffix.lower() != ".md" or len(rel.parts) < 2 or rel.parts[0] == "skills":
+                continue
+            found = [store / rel for store in stores if (store / rel).is_file()]
+            if found:
+                out.append((path, found))
+    return out
+
+
+def _get_local_additions_listing(scope: _scope.Scope) -> str:
+    """The local additions (:func:`local_additions`) as a markdown section, or ''."""
+    additions = local_additions(scope)
+    if not additions:
+        return ""
+    lines = [
+        "- `%s` -- also read %s" % (path, ", ".join("`%s`" % p for p in found))
+        for path, found in additions
+    ]
+    return (
+        "\n\n## Local additions to overlay files\n"
+        "The user's own additions: read each with the overlay file it extends; it wins on conflict.\n"
+        + "\n".join(lines) + "\n"
+    )
+
+
 def _resolve_and_filter_sources(
     agent: _agents.Agent, scope: _scope.Scope
 ) -> "tuple[list[tuple[str, Path, Path | None]], list[Path]]":
@@ -424,6 +462,7 @@ def assemble_context(
     if not source_paths:
         return ""
     text += _get_skills_listing(scope)
+    text += _get_local_additions_listing(scope)
     return text
 
 
@@ -440,11 +479,12 @@ def assemble_context_data(
           "sources": [<absolute source path>, ...],  # after harness subtraction
           "context": <assembled markdown text, minus the skills listing>,
           "skills": [{"name": ..., "description": ..., "path": <SKILL.md>}, ...],
+          "local_additions": [{"overlay_file": ..., "local": [<path>, ...]}, ...],
         }
     ``context`` is the same assembled(+inlined, with ``inline=True``) text the
-    markdown format emits, but WITHOUT the skills listing appended -- skills are
-    their own structured field so a consumer can render them separately and
-    keep the opt-in distinction."""
+    markdown format emits, but WITHOUT the skills and local-additions listings
+    appended -- both are their own structured fields so a consumer can render
+    them separately."""
     text, source_paths = _assemble(agent, scope, inline, expand_vars)
 
     skills = [
@@ -457,4 +497,8 @@ def assemble_context_data(
         "sources": source_paths,
         "context": text,
         "skills": skills,
+        "local_additions": [
+            {"overlay_file": str(path), "local": [str(p) for p in found]}
+            for path, found in local_additions(scope)
+        ],
     }

{dotagents_cli-0.7.0 → dotagents_cli-0.7.2}/src/dotagents/_overlay/dotagents/templates/AGENTS.md

@@ -16,6 +16,12 @@ Startup: annotate that you read `{{AGENTS_MD}}`.
   config). These files say what lives there and how to work in it, so reading them
   first is cheaper than rediscovering it from the source. How `.agents/` is
   populated — real directory, symlink, committed or not — is yours to decide.
+- **Local additions to overlay files**: an overlay file (`$<NAME>_OVERLAY_ROOT/<path>`)
+  is upstream's copy, and `dotagents overlays sync` replaces it. The user's own
+  additions live at the same `<path>` under this config directory and the project's
+  `.agents/`: when you read an overlay file, read those too — they extend it and win on
+  conflict (`dotagents context` lists the ones it finds). Never write user-specific text
+  into an overlay file; put it there.
 - **Global-config misses**: if these instructions caused a mistake or rework, or you
   have an improvement idea, record it and move on — don't edit the config:
   `dotagents findings add -g "<one line>" -b "<what happened, evidence>"`. Read the

{dotagents_cli-0.7.0 → dotagents_cli-0.7.2}/src/dotagents/_sources.py

@@ -214,6 +214,48 @@ def url_scheme(location: str) -> str:
     return location.split("://", 1)[0].lower()
 
 
+#: The store-config key (``<store>/dotagents/config.toml``) for git's
+#: certificate-revocation check on https clones and fetches, passed to every
+#: git call as ``http.schannelCheckRevoke`` -- Git for Windows' Schannel
+#: backend checks revocation; git elsewhere (OpenSSL) checks no CRLs and
+#: ignores the setting. ``best-effort`` (the default, stated explicitly so a
+#: stricter git config cannot fail dotagents' clones) skips a CRL that is
+#: missing or unreachable; ``false`` skips the check, as on Linux; ``true``
+#: enforces it.
+GIT_SSL_REVOKE_KEY = "git_ssl_revoke"
+GIT_SSL_REVOKE_VALUES = ("best-effort", "true", "false")
+GIT_SSL_REVOKE_DEFAULT = "best-effort"
+
+
+def git_ssl_revoke(*stores: "Optional[Path]") -> str:
+    """The first ``git_ssl_revoke`` set in ``stores``' config (the project
+    store before the user store), else the default. Any other value raises
+    :class:`SourceError` naming the file."""
+    from dotagents.cli._common import STORE_CONFIG, read_store_config
+
+    for store in stores:
+        if store is None:
+            continue
+        value = read_store_config(store).get(GIT_SSL_REVOKE_KEY)
+        if value is None:
+            continue
+        normalized = value.strip().lower()
+        if normalized not in GIT_SSL_REVOKE_VALUES:
+            raise SourceError(
+                "error: %s = %r in %s: expected one of %s"
+                % (GIT_SSL_REVOKE_KEY, value, Path(store) / STORE_CONFIG, ", ".join(GIT_SSL_REVOKE_VALUES))
+            )
+        return normalized
+    return GIT_SSL_REVOKE_DEFAULT
+
+
+#: What a revocation-check failure looks like in git's stderr (Schannel).
+_REVOCATION_FAILURE = re.compile(r"revocation|CRYPT_E_|SEC_E_UNTRUSTED", re.IGNORECASE)
+#: A git too old to know ``best-effort`` reads it as a broken boolean and
+#: fails every https call: the call is made again without the setting.
+_UNKNOWN_REVOKE_VALUE = re.compile(r"bad boolean config value .* for 'http\.schannelcheckrevoke'", re.IGNORECASE)
+
+
 class SourceCache(object):
     """What the commands fetch, under ``root``: git clones, one per repository
     location AND ref (two registry entries naming the same repository at
@@ -223,9 +265,10 @@ class SourceCache(object):
     (a remote directory synced down, a remote file copied), each refreshed
     once per process."""
 
-    def __init__(self, root: Path, logger: Any = None):
+    def __init__(self, root: Path, logger: Any = None, ssl_revoke: str = GIT_SSL_REVOKE_DEFAULT):
         self.root = Path(root)
         self.logger = logger
+        self.ssl_revoke = ssl_revoke  # git's http.schannelCheckRevoke (GIT_SSL_REVOKE_KEY)
         self._fresh: "set[str]" = set()  # locations fetched during this process
 
     # --- pathlib_next paths ----------------------------------------------
@@ -314,17 +357,28 @@ class SourceCache(object):
     def _git(self, args: "list[str]", cwd: "Optional[Path]", *, check: bool = True) -> "subprocess.CompletedProcess":
         env = dict(os.environ)
         env["GIT_TERMINAL_PROMPT"] = "0"  # never hang on a credential prompt
+        setting = ["-c", "http.schannelCheckRevoke=%s" % self.ssl_revoke]
         try:
             proc = subprocess.run(
-                ["git", *args], cwd=str(cwd) if cwd else None,
-                capture_output=True, text=True, env=env,
+                ["git", *setting, *args], cwd=str(cwd) if cwd else None, capture_output=True, text=True, env=env,
             )
+            if proc.returncode != 0 and _UNKNOWN_REVOKE_VALUE.search(proc.stderr or ""):
+                # An older git (no best-effort): its own default applies.
+                proc = subprocess.run(
+                    ["git", *args], cwd=str(cwd) if cwd else None, capture_output=True, text=True, env=env,
+                )
         except OSError as exc:
             raise SourceError("error: git is needed for a git overlay source: %s" % exc)
         if check and proc.returncode != 0:
+            output = proc.stderr.strip() or proc.stdout.strip()
+            hint = ""
+            if _REVOCATION_FAILURE.search(output):
+                hint = (
+                    "\n(the certificate's revocation check failed: set %s = \"false\" in"
+                    " <store>/dotagents/config.toml to skip it, as git does on Linux)" % GIT_SSL_REVOKE_KEY
+                )
             raise SourceError(
-                "error: git %s failed (exit %d): %s"
-                % (args[0], proc.returncode, redact(proc.stderr.strip() or proc.stdout.strip()))
+                "error: git %s failed (exit %d): %s%s" % (args[0], proc.returncode, redact(output), hint)
             )
         return proc
 
@@ -934,4 +988,4 @@ def resolve(
     ordered += [Spec("dir", str(p)) for p in registry_files(*stores)]
     if not ordered and not allow_empty:
         raise SourceError(NO_SOURCE_MESSAGE)
-    return CompositeSource(ordered, SourceCache(cache_root, logger))
+    return CompositeSource(ordered, SourceCache(cache_root, logger, ssl_revoke=git_ssl_revoke(*stores)))

{dotagents_cli-0.7.0 → dotagents_cli-0.7.2}/src/dotagents/cli/_common.py

@@ -324,7 +324,10 @@ def _resolve_from(
     if cache_root is None:
         cache_root = resolve_user_store(None) / ".cache" / "overlays"
     try:
-        target = _sources.locate(spec, _sources.SourceCache(Path(cache_root), logger))
+        cache = _sources.SourceCache(
+            Path(cache_root), logger, ssl_revoke=_sources.git_ssl_revoke(resolve_user_store(None))
+        )
+        target = _sources.locate(spec, cache)
     except SystemExit as exc:
         message = str(exc.code if exc.code is not None else exc)
         if message.startswith("error: "):

{dotagents_cli-0.7.0 → dotagents_cli-0.7.2}/tests/test_cmds_discovery.py

@@ -297,8 +297,8 @@ def test_bad_source_is_skipped_not_fatal(monkeypatch, tmp_path):
     # at import time must not crash: discovery runs before EVERY invocation,
     # including `env`/`context` inside the SessionStart hooks, so one typo in a
     # personal cmds module used to take the whole session's env and context
-    # down (review 2026-09-09). duho propagates SyntaxError on purpose; the
-    # dotagents layer is where it must stop.
+    # down. duho propagates SyntaxError on purpose; the dotagents layer is
+    # where it must stop.
     good = tmp_path / "good"
     _write(good / "toy.py", TOY)
     broken = tmp_path / "broken"

{dotagents_cli-0.7.0 → dotagents_cli-0.7.2}/tests/test_context.py

@@ -116,7 +116,7 @@ def test_harness_loads_subtracts_user_agents_md(layout, monkeypatch):
 
     # Fresh install, no include yet: NOTHING loads the store's AGENTS.md, so
     # `context` must emit it (the old static assumption dropped it here, and
-    # the base rules never reached a session -- review 2026-09-09, 1.5).
+    # the base rules never reached a session at all).
     text = _context.assemble_context(claude, S(dotagents_dir, project_root, True))
     assert "# User rules" in text
 

{dotagents_cli-0.7.0 → dotagents_cli-0.7.2}/tests/test_env_regressions.py

@@ -1,9 +1,9 @@
-"""Env-assembly regressions from the 2026-09-23 review, each a repro turned
-into a test: malformed env.py output, relative PATH entries, a session whose
-project root is the home directory, and the PowerShell rendering of
-typographic quotes and non-ASCII values through the real loader pipe.
+"""Env-assembly regressions, each a repro turned into a test: malformed
+env.py output, relative PATH entries, a session whose project root is the
+home directory, and the PowerShell rendering of typographic quotes and
+non-ASCII values through the real loader pipe.
 
-A case the product still gets wrong is a strict xfail naming the review
+A case the product still gets wrong is a strict xfail naming the known
 issue, so fixing it turns the test into an XPASS failure until the marker
 goes. tmp dirs only, no network.
 """
@@ -22,7 +22,7 @@ from dotagents._scope import Scope
 
 def _open(issue, why, condition=True):
     return pytest.mark.xfail(
-        condition, strict=True, reason="open (review 2026-09-23 %s): %s" % (issue, why)
+        condition, strict=True, reason="open (%s): %s" % (issue, why)
     )
 
 

{dotagents_cli-0.7.0 → dotagents_cli-0.7.2}/tests/test_env_safety.py

@@ -1,6 +1,5 @@
 """Env-chain safety: which files run, how a failed source is reported, and what
-bash itself adds to a sourced file's output (review 2026-09-09, findings 1.6 and
-the env/scope items).
+bash itself adds to a sourced file's output.
 
 tmp dirs only, no network. Run from repo root: ``python -m pytest tests/``.
 """

{dotagents_cli-0.7.0 → dotagents_cli-0.7.2}/tests/test_findings_cmd.py

@@ -284,13 +284,13 @@ def test_subcommands_are_nested_not_module_level(findings_mod):
 
 
 # --------------------------------------------------------------------------- #
-# Encodings and reserved names (review 2026-09-23). Cases the module still
-# gets wrong are strict xfails naming the issue: a fix flips them to XPASS
-# failures until the marker goes.
+# Encodings and reserved names. Cases the module still gets wrong are strict
+# xfails naming the issue: a fix flips them to XPASS failures until the
+# marker goes.
 # --------------------------------------------------------------------------- #
 
 def _open(issue, why):
-    return pytest.mark.xfail(strict=True, reason="open (review 2026-09-23 %s): %s" % (issue, why))
+    return pytest.mark.xfail(strict=True, reason="open (%s): %s" % (issue, why))
 
 
 def test_cmd_body_from_stdin_is_read_as_utf8_bytes(findings_mod, tmp_path, monkeypatch, capsys):

{dotagents_cli-0.7.0 → dotagents_cli-0.7.2}/tests/test_fix_adapters.py

@@ -1,4 +1,4 @@
-"""Adapter fixes from the 2026-09-23 review: adapters are told the scope,
+"""Adapter fixes: adapters are told the scope,
 Claude honours CLAUDE_CONFIG_DIR, `init` writes the store's AGENTS.md itself,
 global harness configs are left alone by a project init, Cursor's rule file,
 Claude's import parsing, identity from runtime signals only, include dedupe.

{dotagents_cli-0.7.0 → dotagents_cli-0.7.2}/tests/test_fix_cli.py

@@ -1,4 +1,4 @@
-"""Regression tests for the CLI review fixes: command discovery that survives a
+"""Regression tests for CLI fixes: command discovery that survives a
 command whose parser cannot be built, the `findings` queue's encoding, naming
 and move-never-delete rules, and `launch`'s exit code, context file and
 cmd.exe argument handling.

{dotagents_cli-0.7.0 → dotagents_cli-0.7.2}/tests/test_fix_env.py

@@ -1,5 +1,4 @@
-"""Regression tests for the env assembly and rendering review fixes
-(review 2026-09-23, "Env assembly and rendering").
+"""Regression tests for env assembly and rendering fixes.
 
 tmp dirs only, no network. Run from repo root: ``python -m pytest tests/``.
 """

{dotagents_cli-0.7.0 → dotagents_cli-0.7.2}/tests/test_fix_hooks.py

@@ -1,4 +1,4 @@
-"""Hook fixes from the 2026-09-23 review: the PowerShell handlers' Git Bash
+"""Hook fixes: the PowerShell handlers' Git Bash
 gate, UTF-8 through the PowerShell pipe, the PreToolUse matcher, merging that
 keeps the user's keys, symlink-safe and non-ASCII-safe wrappers.
 

{dotagents_cli-0.7.0 → dotagents_cli-0.7.2}/tests/test_fix_init.py

@@ -1,4 +1,4 @@
-"""Regression tests for the 2026-09-23 review's `init` / `launch` fixes:
+"""Regression tests for `init` / `launch` fixes:
 
 - `init --from` takes the documented URI, git and checkout forms (it crashed
   on every remote scheme and on a checkout root);

{dotagents_cli-0.7.0 → dotagents_cli-0.7.2}/tests/test_fix_overlays.py

@@ -1,5 +1,5 @@
-"""Regression tests for the 2026-09-23 review's "Overlays, sources and skills"
-findings: typed source errors, registry parsing, credential handling, the spec
+"""Regression tests for "Overlays, sources and skills" fixes: typed source
+errors, registry parsing, credential handling, the spec
 grammar, manifest validation, overlay names, install records, and the
 add/remove/sync lifecycle.
 

{dotagents_cli-0.7.0 → dotagents_cli-0.7.2}/tests/test_fix_scope_context.py

@@ -1,5 +1,4 @@
-"""Regressions for the scope-resolution and context-assembly review fixes
-(2026-09-23 review, "Scope resolution and context assembly").
+"""Regressions for the scope-resolution and context-assembly fixes.
 
 tmp dirs only. The user store is redirected with `$AGENTS_HOME`, the system
 store with `$AGENTS_SYSTEM_ROOT` (a path that does not exist), and the project

{dotagents_cli-0.7.0 → dotagents_cli-0.7.2}/tests/test_fix_skills_adapters.py

@@ -1,5 +1,5 @@
-"""Regression tests for the 2026-09-23 review's skills, adapter and hook-cost
-findings: Claude's per-skill links are refreshed and pruned, `overlays
+"""Regression tests for skills, adapter and hook-cost fixes: Claude's
+per-skill links are refreshed and pruned, `overlays
 add/sync/remove` keep a wired Claude skills dir current, project-scope skill
 links warn when git would commit them, pi gets a pointer to a project store,
 and the env loaders reuse a cached diff while the inputs are unchanged.

dotagents_cli-0.7.2/tests/test_git_ssl_revoke.py

@@ -0,0 +1,102 @@
+"""`git_ssl_revoke` in `<store>/dotagents/config.toml`: git's
+certificate-revocation check for overlay clones and fetches. Git for Windows'
+Schannel backend fails an https clone whose CRL cannot be fetched; git with
+OpenSSL (Linux) checks no CRLs. dotagents passes the setting to every git call
+as `http.schannelCheckRevoke`, `best-effort` unless the store says otherwise."""
+import subprocess
+
+import pytest
+
+from dotagents import _sources
+from dotagents.cli._common import STORE_CONFIG
+
+
+def _config(store, text):
+    path = store / STORE_CONFIG
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(text, encoding="utf-8")
+
+
+@pytest.fixture()
+def argv(monkeypatch):
+    seen = []
+
+    def run(cmd, **kwargs):
+        seen.append(cmd)
+        return subprocess.CompletedProcess(cmd, 0, "", "")
+
+    monkeypatch.setattr(_sources.subprocess, "run", run)
+    return seen
+
+
+def test_every_git_call_carries_the_setting_best_effort_by_default(tmp_path, argv):
+    cache = _sources.SourceCache(tmp_path / "cache")
+    cache._git(["ls-remote", "https://example.invalid/r.git"], None)
+    assert argv[-1][:3] == ["git", "-c", "http.schannelCheckRevoke=best-effort"]
+    _sources.SourceCache(tmp_path / "cache", ssl_revoke="false")._git(["fetch"], None)
+    assert argv[-1][:3] == ["git", "-c", "http.schannelCheckRevoke=false"]
+
+
+def test_the_store_config_chooses_project_before_user(tmp_path):
+    user, project = tmp_path / "user", tmp_path / "project"
+    assert _sources.git_ssl_revoke(project, user) == "best-effort"
+    _config(user, 'git_ssl_revoke = "false"\n')
+    assert _sources.git_ssl_revoke(None, user) == "false"
+    _config(project, 'git_ssl_revoke = "TRUE"\n')
+    assert _sources.git_ssl_revoke(project, user) == "true"
+
+
+def test_an_unknown_value_names_the_file(tmp_path):
+    _config(tmp_path, 'git_ssl_revoke = "maybe"\n')
+    with pytest.raises(_sources.SourceError, match="git_ssl_revoke = 'maybe'.*best-effort, true, false"):
+        _sources.git_ssl_revoke(tmp_path)
+
+
+def test_a_revocation_failure_names_the_setting(tmp_path, monkeypatch):
+    stderr = ("fatal: unable to access 'https://example.invalid/r.git/': schannel: next InitializeSecurityContext "
+              "failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012) - The revocation function was unable to check "
+              "revocation for the certificate.")
+    monkeypatch.setattr(_sources.subprocess, "run",
+                        lambda cmd, **kw: subprocess.CompletedProcess(cmd, 128, "", stderr))
+    with pytest.raises(_sources.SourceError) as caught:
+        _sources.SourceCache(tmp_path)._git(["clone", "https://example.invalid/r.git"], None)
+    message = str(caught.value)
+    assert "CRYPT_E_NO_REVOCATION_CHECK" in message and 'git_ssl_revoke = "false"' in message
+
+
+def test_a_git_without_best_effort_runs_again_without_it(tmp_path, monkeypatch):
+    seen = []
+
+    def run(cmd, **kwargs):
+        seen.append(cmd)
+        if "http.schannelCheckRevoke=best-effort" in cmd:
+            return subprocess.CompletedProcess(cmd, 128, "", "fatal: bad boolean config value 'best-effort' for "
+                                                              "'http.schannelcheckrevoke'\n")
+        return subprocess.CompletedProcess(cmd, 0, "ok", "")
+
+    monkeypatch.setattr(_sources.subprocess, "run", run)
+    proc = _sources.SourceCache(tmp_path)._git(["ls-remote", "https://example.invalid/r.git"], None)
+    assert proc.returncode == 0 and len(seen) == 2
+    assert seen[1] == ["git", "ls-remote", "https://example.invalid/r.git"]
+
+
+def test_any_other_failure_has_no_hint(tmp_path, monkeypatch):
+    monkeypatch.setattr(_sources.subprocess, "run",
+                        lambda cmd, **kw: subprocess.CompletedProcess(cmd, 128, "", "fatal: repository not found"))
+    with pytest.raises(_sources.SourceError) as caught:
+        _sources.SourceCache(tmp_path)._git(["clone", "https://example.invalid/r.git"], None)
+    assert "git_ssl_revoke" not in str(caught.value)
+
+
+@pytest.mark.skipif(not __import__("shutil").which("git"), reason="needs git on PATH")
+def test_git_accepts_the_option_on_a_local_clone(tmp_path):
+    """The option reaches a real git without breaking a clone (git ignores
+    it off Schannel; on Windows it is honoured)."""
+    work = tmp_path / "work"
+    work.mkdir()
+    for args in (["init", "-q", "-b", "main"], ["-c", "user.email=t@example.invalid", "-c", "user.name=t",
+                                                 "commit", "-q", "--allow-empty", "-m", "x"]):
+        subprocess.run(["git", *args], cwd=str(work), check=True, capture_output=True)
+    cache = _sources.SourceCache(tmp_path / "cache", ssl_revoke="false")
+    cache._git(["clone", "-q", str(work), str(tmp_path / "copy")], None)
+    assert (tmp_path / "copy" / ".git").is_dir()