dotagents-cli 0.7.1__tar.gz → 0.7.3__tar.gz

{dotagents_cli-0.7.1 → dotagents_cli-0.7.3}/CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.7.3] - 2026-10-04
+
+### Changed
+
+- The command guide and the shipped API header now say that every command except
+  `env`, built-in or discovered, is served as an MCP tool when `dotagents` starts with
+  `DOTAGENTS_MCP=stdio`, and that `AGENT_HELP=1` turns `--help` into a JSON document.
+  The authoring guide asks overlays to ship command modules rather than loose
+  scripts, and skills to name the tools they use.
+
+## [0.7.2] - 2026-10-03
+
+### Added
+
+- `git_ssl_revoke` in `<store>/dotagents/config.toml` sets how the git clones and
+  fetches of overlay repos check certificate revocation: `best-effort` (the default)
+  skips a revocation list that is missing or unreachable, `false` skips the check, as
+  git on Linux does, `true` enforces it. It is passed to every git call, so a stricter
+  git configuration elsewhere no longer fails an https clone on Windows, and a clone
+  that still fails on revocation says which setting to change. A git too old to know
+  `best-effort` (it rejects the value) runs the call again without the setting.
+
 ## [0.7.1] - 2026-10-01
 
 ### Added
@@ -1357,7 +1379,7 @@ Patch release: the PATH/POSIX-conversion fix above (the only change since 0.3.0)
 
 ### Changed
 
-- Migrate the CLI to `duho>=0.3.3` (was `>=0.1.1`). duho's Plan-13 `Args`/`Cmd`
+- Migrate the CLI to `duho>=0.3.3` (was `>=0.1.1`). duho's `Args`/`Cmd`
   split means commands are now `class X(LoggingArgs, Cmd)` with a `__call__` entrypoint
   (was a bare `LoggingArgs` with `__run__`) and the umbrella root is
   `class Dotagents(LoggingArgs, Cli)`. Field declarations (annotation + help string +
@@ -1372,7 +1394,9 @@ Patch release: the PATH/POSIX-conversion fix above (the only change since 0.3.0)
   affected module sources (`dotagents.cli`, `duho.presets`) to extracted temp files
   before dispatch; a no-op for a plain install.
 
-[Unreleased]: https://github.com/jose-pr/dotagents/compare/v0.7.1...HEAD
+[Unreleased]: https://github.com/jose-pr/dotagents/compare/v0.7.3...HEAD
+[0.7.3]: https://github.com/jose-pr/dotagents/compare/v0.7.2...v0.7.3
+[0.7.2]: https://github.com/jose-pr/dotagents/compare/v0.7.1...v0.7.2
 [0.7.1]: https://github.com/jose-pr/dotagents/compare/v0.7.0...v0.7.1
 [0.7.0]: https://github.com/jose-pr/dotagents/compare/v0.6.3...v0.7.0
 [0.6.3]: https://github.com/jose-pr/dotagents/compare/v0.6.2...v0.6.3

{dotagents_cli-0.7.1 → dotagents_cli-0.7.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: dotagents-cli
-Version: 0.7.1
+Version: 0.7.3
 Summary: The dotagents CLI: install and manage a portable ~/.agents config for AI coding agents
 Project-URL: Homepage, https://github.com/jose-pr/dotagents/
 Project-URL: Repository, https://github.com/jose-pr/dotagents
@@ -270,7 +270,8 @@ config miss is a **finding** — `dotagents findings add -g` for the user store
 triage closes each with its resolution, which is the record. How you keep any
 decisions beyond that is up to you. A store's `dotagents/` directory exists only for
 your own command modules (`dotagents/cmds/`), which you create when you add your first
-one, and for `dotagents/config.toml`, which records an `init --from` base. This
+one, and for `dotagents/config.toml`, which records an `init --from` base and,
+if you set it, `git_ssl_revoke` (how git checks certificate revocation on Windows). This
 repo follows the same rule: its working material lives in an **untracked** `.agents/`,
 never committed — so what's public here is only the CLI, the base overlay, and the
 opt-in overlays. If you fork, keep the tracked surface free of personal paths and

{dotagents_cli-0.7.1 → dotagents_cli-0.7.3}/README.md

@@ -220,7 +220,8 @@ config miss is a **finding** — `dotagents findings add -g` for the user store
 triage closes each with its resolution, which is the record. How you keep any
 decisions beyond that is up to you. A store's `dotagents/` directory exists only for
 your own command modules (`dotagents/cmds/`), which you create when you add your first
-one, and for `dotagents/config.toml`, which records an `init --from` base. This
+one, and for `dotagents/config.toml`, which records an `init --from` base and,
+if you set it, `git_ssl_revoke` (how git checks certificate revocation on Windows). This
 repo follows the same rule: its working material lives in an **untracked** `.agents/`,
 never committed — so what's public here is only the CLI, the base overlay, and the
 opt-in overlays. If you fork, keep the tracked surface free of personal paths and

{dotagents_cli-0.7.1 → dotagents_cli-0.7.3}/docs/guide/authoring.md

@@ -149,7 +149,26 @@ parser cannot be built. The bundled `findings` and `launch` are ordinary command
 modules discovered from the package, and the private-sync overlay ships
 `link-project` / `sync-project` from its own `cmds/` the same way.
 
+**Prefer a command module to a loose script.** A script under `tools/` is something
+an agent has to find, quote and spawn. A command module is discovered, shows up in
+`dotagents --help`, and is served as an MCP tool with a typed schema when `dotagents`
+runs with `DOTAGENTS_MCP=stdio` (see
+[Commands → As tools for an agent](commands.md#as-tools-for-an-agent)). Write it to be
+a good tool:
+
+- the logic lives in the command class — `__call__` and its methods — not in one
+  function that `__call__` forwards every field to;
+- each field's help says what the value is, since it becomes the schema's description;
+- the output is short: one line for a change, the smallest useful part for a read,
+  `--json` for a program;
+- it never prompts, and a command that deletes or publishes needs an explicit flag.
+
 ## Skills
 
 Put `skills/<skill-name>/` directories in your overlay to publish shared skills into
 the scope on install. See [Overlays → Skills](overlays.md#skills).
+
+A skill that relies on commands says so, in its own text: which `dotagents` commands
+it uses, that they are available as MCP tools (`dotagents.<command>`) when the
+server is registered, and the command-line form to fall back to when it is not. An
+agent reading the skill should not have to discover either.

{dotagents_cli-0.7.1 → dotagents_cli-0.7.3}/docs/guide/commands.md

@@ -59,6 +59,38 @@ into `<store>/dotagents/cmds/` (create the dir — `init` does not) and it becom
 subcommand, no registration needed; see
 [Authoring → Custom commands](authoring.md#custom-commands).
 
+## As tools for an agent
+
+Every command above except `env`, and every discovered one, is also an **MCP tool**.
+Start `dotagents` with `DOTAGENTS_MCP=stdio` in its environment and it serves that
+command set over stdio instead of running a command:
+
+```sh
+DOTAGENTS_MCP=stdio dotagents        # register this as a stdio MCP server in your agent
+```
+
+- One tool per leaf command, named with dots: `dotagents.findings.add`,
+  `dotagents.overlays.list`, and for an overlay's commands `dotagents.<command>`.
+- A tool's input schema is generated from the command's fields; its result is what
+  the command prints.
+- The command set is discovered once, when the server starts, for the directory it
+  starts in. Restart it after installing an overlay or changing project.
+
+Use it for a command an agent calls many times in a session — a findings queue, a
+plan's progress, a lookup. A tool call skips the interpreter start-up and the
+command discovery that every `dotagents <command>` process pays, and its arguments
+are typed values, not strings quoted through a shell.
+
+`env` is not served: it prints resolved values, which can be secrets. Everything
+else is, including the commands that change the store (`init`, `overlays add`,
+`overlays remove`). Register the server only where the agent is meant to be able to
+run them.
+
+For a machine-readable description without a server, set `AGENT_HELP=1` and ask for
+`--help`: `dotagents findings --help` then prints one JSON document for that command
+tree. It is complete and long; a single subcommand's plain `--help` is shorter when
+that is all that is needed.
+
 ## init
 
 See [Install](install.md) for the full walkthrough. In brief:
@@ -501,13 +533,13 @@ There is no `dotagents audit`. The dotagents source repo has its own
 it is not a validator for an installed `~/.agents` and is deliberately not shipped
 in the package or the `.pyz`.
 
-### Personal pre-push scanning (not in this repo)
+### Pre-push scanning (an overlay's command)
 
-Scanning a repo for personal leaks before publishing it — machine paths, private
-plan names, `.agents/` refs, agent-session trailers in commit messages — enforces
-personal conventions rather than dotagents' own mechanism, so no such tool is
-shipped here. Keep one as a discovered command module in your own private
-`<scope>/dotagents/cmds/` and run it locally before a push.
+Scanning a repo for leaks before publishing it — machine paths, private plan names,
+`.agents/` refs, agent-session trailers in commit messages — enforces a convention
+rather than dotagents' own mechanism, so the package ships no such command. The
+opt-in `engineering` overlay does: `dotagents leak-check <repo>`. Its patterns for
+what is personal to you stay in a machine-local file, never in a repository.
 
 ## link-project / sync-project
 

{dotagents_cli-0.7.1 → dotagents_cli-0.7.3}/docs/guide/install.md

@@ -101,7 +101,17 @@ python -m dotagents build-pyz --out dist/dotagents.pyz   # or build it (needs a
   [Authoring → Custom commands](authoring.md#custom-commands)).
 - `dotagents/config.toml` — only after `init --from`: records that base, so a later
   `init` and every `overlays add` / `remove` / `sync` compose over it. Delete its
-  `base` line to return to the bundled base.
+  `base` line to return to the bundled base. You may add one setting by hand:
+  `git_ssl_revoke` — how strictly the git clones of overlay repos check that the
+  server's certificate is not revoked. `best-effort` (the default) skips a
+  revocation list that is missing or unreachable; `false` skips the check, as git
+  on Linux always does; `true` enforces it. It matters on Windows, where git
+  checks revocation and an https clone otherwise fails when the list cannot be
+  fetched; a project store's setting wins over the user store's.
+
+  ```toml
+  git_ssl_revoke = "false"
+  ```
 
 ## What runs, and from where
 

{dotagents_cli-0.7.1 → dotagents_cli-0.7.3}/docs/guide/overlays.md

@@ -44,7 +44,7 @@ or `--repo <checkout>/overlays` for a local checkout of the branch.
 
 | Overlay | What it carries |
 | --- | --- |
-| `engineering` | One opinionated engineering process. `rules/ENGINEERING.md` — always-on discipline merged into `AGENTS.md` (commit shape, release-tag consent, benchmark-as-evidence, token discipline, draft follow-ups). `flows/` — `PLAN.md` (a strong model writes precise, autonomous plans), `EXEC.md` (a cheaper model executes them without re-deriving context), `REVIEW.md` (file-threaded multi-agent plan review), `REPO.md` (the repo standard); `kb/MODELS.md` (executor/model selection). `references/` — language-neutral repo-file templates (README, CHANGELOG, LICENSE, `.gitignore`, docs-index, the plan template). `tools/` — `summarize_run` (command → verdict) and `compare_bench` (diff benchmark JSONs). The language overlays require it. |
+| `engineering` | One opinionated engineering process. `rules/ENGINEERING.md` — always-on discipline merged into `AGENTS.md` (commit shape, release-tag consent, benchmark-as-evidence, token discipline, draft follow-ups). `flows/` — `PLAN.md` (a strong model writes precise, autonomous plans), `EXEC.md` (a cheaper model executes them without re-deriving context), `REVIEW.md` (file-threaded multi-agent plan review), `REPO.md` (the repo standard); `kb/MODELS.md` (executor/model selection). `references/` — language-neutral repo-file templates (README, CHANGELOG, LICENSE, `.gitignore`, docs-index, the plan template). `cmds/` — `plans`, `leak-check`, `eol`, `summarize-run` (command → verdict) and `compare-bench` (diff benchmark JSONs), each a `dotagents` command. The language overlays require it. |
 | `python`, `node`, `rust` | Per-language `kb/` conventions + manifest templates + CI workflow templates. |
 | `release` | A host-agnostic release helper: an agent-driven commit-plan loop plus tag/CI monitoring across GitHub (`gh`) and GitLab. |
 | `private-sync` | The one-private-repo, per-project `.agents` model (`kb/PRIVATE_SYNC.md` + cloud hooks) — see [Private sync](private-sync.md). |

{dotagents_cli-0.7.1 → dotagents_cli-0.7.3}/src/dotagents/AGENTS.md

@@ -44,6 +44,16 @@ and an error saying a command is required, and exits 2.
 | `about [--json]` | `dotagents-cli <version>`, then `<distribution> <version>` per bundled (`.pyz`) or installed package. |
 | `build-pyz [--out P] [--python SHEBANG] [--duho-version V] [--pathlib-next-version V] [--extras a,b]` | Build a zipapp from a source checkout; errors elsewhere. |
 
+**Every command but `env` is also an MCP tool.** With `DOTAGENTS_MCP=stdio` in its
+environment, `dotagents` serves the command set — built-in, bundled and discovered —
+over stdio instead of running one: a tool per leaf command, named with dots
+(`dotagents.findings.add`, `dotagents.overlays.list`), its input schema generated from
+the command's fields, its result the command's output. `env` is not served: it prints
+resolved, possibly secret values. The set is fixed when the server starts, for the
+scope it starts in. With `AGENT_HELP=1`, `--help` prints one
+JSON document (`duho/agent-help@1`) for the command tree it is asked about, in place
+of the human text.
+
 Scope flags: `-g` / `--global` selects the user store; `--agents-dir D` overrides the
 store the command resolves to (the project store for `init` / `overlays` / `findings`
 without `-g`, the user store otherwise). For `env`, `context` and `launch`, `-g` means
@@ -306,7 +316,15 @@ a directory of overlays or a registry file (default: the root); for a **source**
 - `redact(text) -> str` — URL userinfo removed, query values masked.
 - `uri_path_class()` — `pathlib_next.uri.UriPath`, or `None` without the `uri` extra.
 - `url_scheme(location) -> str` — the lower-cased scheme.
-- `class SourceCache(root, logger=None)` — `repo_dir(location, ref=None) -> Path`
+- `GIT_SSL_REVOKE_KEY = "git_ssl_revoke"`, `GIT_SSL_REVOKE_VALUES = ("best-effort",
+  "true", "false")`, `GIT_SSL_REVOKE_DEFAULT = "best-effort"`;
+  `git_ssl_revoke(*stores) -> str` — the first store config (`config.toml`) that sets
+  the key, project store first; another value raises `SourceError` naming the file.
+- `class SourceCache(root, logger=None, ssl_revoke="best-effort")` — every git call
+  runs as `git -c http.schannelCheckRevoke=<ssl_revoke> ...` (Git for Windows'
+  Schannel checks revocation; git with OpenSSL ignores it), and a failure that looks
+  like a revocation check names the key. A git that rejects the value as a bad
+  boolean (older than `best-effort`) is asked again without it. `repo_dir(location, ref=None) -> Path`
   (`<root>/<slug>-<hash>`); `checkout(spec) -> Path` (clone or fetch, once per
   process; a failed fetch of an existing checkout is a warning);
   `materialize(spec) -> Path` (a `url` spec: `file://` in place, anything else

{dotagents_cli-0.7.1 → dotagents_cli-0.7.3}/src/dotagents/__init__.py

@@ -1,3 +1,3 @@
 """dotagents: installable CLI for the dotagents agent-config payload."""
 
-__version__ = "0.7.1"
+__version__ = "0.7.3"

{dotagents_cli-0.7.1 → dotagents_cli-0.7.3}/src/dotagents/_sources.py

@@ -214,6 +214,48 @@ def url_scheme(location: str) -> str:
     return location.split("://", 1)[0].lower()
 
 
+#: The store-config key (``<store>/dotagents/config.toml``) for git's
+#: certificate-revocation check on https clones and fetches, passed to every
+#: git call as ``http.schannelCheckRevoke`` -- Git for Windows' Schannel
+#: backend checks revocation; git elsewhere (OpenSSL) checks no CRLs and
+#: ignores the setting. ``best-effort`` (the default, stated explicitly so a
+#: stricter git config cannot fail dotagents' clones) skips a CRL that is
+#: missing or unreachable; ``false`` skips the check, as on Linux; ``true``
+#: enforces it.
+GIT_SSL_REVOKE_KEY = "git_ssl_revoke"
+GIT_SSL_REVOKE_VALUES = ("best-effort", "true", "false")
+GIT_SSL_REVOKE_DEFAULT = "best-effort"
+
+
+def git_ssl_revoke(*stores: "Optional[Path]") -> str:
+    """The first ``git_ssl_revoke`` set in ``stores``' config (the project
+    store before the user store), else the default. Any other value raises
+    :class:`SourceError` naming the file."""
+    from dotagents.cli._common import STORE_CONFIG, read_store_config
+
+    for store in stores:
+        if store is None:
+            continue
+        value = read_store_config(store).get(GIT_SSL_REVOKE_KEY)
+        if value is None:
+            continue
+        normalized = value.strip().lower()
+        if normalized not in GIT_SSL_REVOKE_VALUES:
+            raise SourceError(
+                "error: %s = %r in %s: expected one of %s"
+                % (GIT_SSL_REVOKE_KEY, value, Path(store) / STORE_CONFIG, ", ".join(GIT_SSL_REVOKE_VALUES))
+            )
+        return normalized
+    return GIT_SSL_REVOKE_DEFAULT
+
+
+#: What a revocation-check failure looks like in git's stderr (Schannel).
+_REVOCATION_FAILURE = re.compile(r"revocation|CRYPT_E_|SEC_E_UNTRUSTED", re.IGNORECASE)
+#: A git too old to know ``best-effort`` reads it as a broken boolean and
+#: fails every https call: the call is made again without the setting.
+_UNKNOWN_REVOKE_VALUE = re.compile(r"bad boolean config value .* for 'http\.schannelcheckrevoke'", re.IGNORECASE)
+
+
 class SourceCache(object):
     """What the commands fetch, under ``root``: git clones, one per repository
     location AND ref (two registry entries naming the same repository at
@@ -223,9 +265,10 @@ class SourceCache(object):
     (a remote directory synced down, a remote file copied), each refreshed
     once per process."""
 
-    def __init__(self, root: Path, logger: Any = None):
+    def __init__(self, root: Path, logger: Any = None, ssl_revoke: str = GIT_SSL_REVOKE_DEFAULT):
         self.root = Path(root)
         self.logger = logger
+        self.ssl_revoke = ssl_revoke  # git's http.schannelCheckRevoke (GIT_SSL_REVOKE_KEY)
         self._fresh: "set[str]" = set()  # locations fetched during this process
 
     # --- pathlib_next paths ----------------------------------------------
@@ -314,17 +357,28 @@ class SourceCache(object):
     def _git(self, args: "list[str]", cwd: "Optional[Path]", *, check: bool = True) -> "subprocess.CompletedProcess":
         env = dict(os.environ)
         env["GIT_TERMINAL_PROMPT"] = "0"  # never hang on a credential prompt
+        setting = ["-c", "http.schannelCheckRevoke=%s" % self.ssl_revoke]
         try:
             proc = subprocess.run(
-                ["git", *args], cwd=str(cwd) if cwd else None,
-                capture_output=True, text=True, env=env,
+                ["git", *setting, *args], cwd=str(cwd) if cwd else None, capture_output=True, text=True, env=env,
             )
+            if proc.returncode != 0 and _UNKNOWN_REVOKE_VALUE.search(proc.stderr or ""):
+                # An older git (no best-effort): its own default applies.
+                proc = subprocess.run(
+                    ["git", *args], cwd=str(cwd) if cwd else None, capture_output=True, text=True, env=env,
+                )
         except OSError as exc:
             raise SourceError("error: git is needed for a git overlay source: %s" % exc)
         if check and proc.returncode != 0:
+            output = proc.stderr.strip() or proc.stdout.strip()
+            hint = ""
+            if _REVOCATION_FAILURE.search(output):
+                hint = (
+                    "\n(the certificate's revocation check failed: set %s = \"false\" in"
+                    " <store>/dotagents/config.toml to skip it, as git does on Linux)" % GIT_SSL_REVOKE_KEY
+                )
             raise SourceError(
-                "error: git %s failed (exit %d): %s"
-                % (args[0], proc.returncode, redact(proc.stderr.strip() or proc.stdout.strip()))
+                "error: git %s failed (exit %d): %s%s" % (args[0], proc.returncode, redact(output), hint)
             )
         return proc
 
@@ -934,4 +988,4 @@ def resolve(
     ordered += [Spec("dir", str(p)) for p in registry_files(*stores)]
     if not ordered and not allow_empty:
         raise SourceError(NO_SOURCE_MESSAGE)
-    return CompositeSource(ordered, SourceCache(cache_root, logger))
+    return CompositeSource(ordered, SourceCache(cache_root, logger, ssl_revoke=git_ssl_revoke(*stores)))

{dotagents_cli-0.7.1 → dotagents_cli-0.7.3}/src/dotagents/cli/_common.py

@@ -324,7 +324,10 @@ def _resolve_from(
     if cache_root is None:
         cache_root = resolve_user_store(None) / ".cache" / "overlays"
     try:
-        target = _sources.locate(spec, _sources.SourceCache(Path(cache_root), logger))
+        cache = _sources.SourceCache(
+            Path(cache_root), logger, ssl_revoke=_sources.git_ssl_revoke(resolve_user_store(None))
+        )
+        target = _sources.locate(spec, cache)
     except SystemExit as exc:
         message = str(exc.code if exc.code is not None else exc)
         if message.startswith("error: "):

{dotagents_cli-0.7.1 → dotagents_cli-0.7.3}/tests/test_cmds_discovery.py

@@ -297,8 +297,8 @@ def test_bad_source_is_skipped_not_fatal(monkeypatch, tmp_path):
     # at import time must not crash: discovery runs before EVERY invocation,
     # including `env`/`context` inside the SessionStart hooks, so one typo in a
     # personal cmds module used to take the whole session's env and context
-    # down (review 2026-09-09). duho propagates SyntaxError on purpose; the
-    # dotagents layer is where it must stop.
+    # down. duho propagates SyntaxError on purpose; the dotagents layer is
+    # where it must stop.
     good = tmp_path / "good"
     _write(good / "toy.py", TOY)
     broken = tmp_path / "broken"

{dotagents_cli-0.7.1 → dotagents_cli-0.7.3}/tests/test_context.py

@@ -116,7 +116,7 @@ def test_harness_loads_subtracts_user_agents_md(layout, monkeypatch):
 
     # Fresh install, no include yet: NOTHING loads the store's AGENTS.md, so
     # `context` must emit it (the old static assumption dropped it here, and
-    # the base rules never reached a session -- review 2026-09-09, 1.5).
+    # the base rules never reached a session at all).
     text = _context.assemble_context(claude, S(dotagents_dir, project_root, True))
     assert "# User rules" in text
 

{dotagents_cli-0.7.1 → dotagents_cli-0.7.3}/tests/test_env_regressions.py

@@ -1,9 +1,9 @@
-"""Env-assembly regressions from the 2026-09-23 review, each a repro turned
-into a test: malformed env.py output, relative PATH entries, a session whose
-project root is the home directory, and the PowerShell rendering of
-typographic quotes and non-ASCII values through the real loader pipe.
+"""Env-assembly regressions, each a repro turned into a test: malformed
+env.py output, relative PATH entries, a session whose project root is the
+home directory, and the PowerShell rendering of typographic quotes and
+non-ASCII values through the real loader pipe.
 
-A case the product still gets wrong is a strict xfail naming the review
+A case the product still gets wrong is a strict xfail naming the known
 issue, so fixing it turns the test into an XPASS failure until the marker
 goes. tmp dirs only, no network.
 """
@@ -22,7 +22,7 @@ from dotagents._scope import Scope
 
 def _open(issue, why, condition=True):
     return pytest.mark.xfail(
-        condition, strict=True, reason="open (review 2026-09-23 %s): %s" % (issue, why)
+        condition, strict=True, reason="open (%s): %s" % (issue, why)
     )
 
 

{dotagents_cli-0.7.1 → dotagents_cli-0.7.3}/tests/test_env_safety.py

@@ -1,6 +1,5 @@
 """Env-chain safety: which files run, how a failed source is reported, and what
-bash itself adds to a sourced file's output (review 2026-09-09, findings 1.6 and
-the env/scope items).
+bash itself adds to a sourced file's output.
 
 tmp dirs only, no network. Run from repo root: ``python -m pytest tests/``.
 """

{dotagents_cli-0.7.1 → dotagents_cli-0.7.3}/tests/test_findings_cmd.py

@@ -284,13 +284,13 @@ def test_subcommands_are_nested_not_module_level(findings_mod):
 
 
 # --------------------------------------------------------------------------- #
-# Encodings and reserved names (review 2026-09-23). Cases the module still
-# gets wrong are strict xfails naming the issue: a fix flips them to XPASS
-# failures until the marker goes.
+# Encodings and reserved names. Cases the module still gets wrong are strict
+# xfails naming the issue: a fix flips them to XPASS failures until the
+# marker goes.
 # --------------------------------------------------------------------------- #
 
 def _open(issue, why):
-    return pytest.mark.xfail(strict=True, reason="open (review 2026-09-23 %s): %s" % (issue, why))
+    return pytest.mark.xfail(strict=True, reason="open (%s): %s" % (issue, why))
 
 
 def test_cmd_body_from_stdin_is_read_as_utf8_bytes(findings_mod, tmp_path, monkeypatch, capsys):

{dotagents_cli-0.7.1 → dotagents_cli-0.7.3}/tests/test_fix_adapters.py

@@ -1,4 +1,4 @@
-"""Adapter fixes from the 2026-09-23 review: adapters are told the scope,
+"""Adapter fixes: adapters are told the scope,
 Claude honours CLAUDE_CONFIG_DIR, `init` writes the store's AGENTS.md itself,
 global harness configs are left alone by a project init, Cursor's rule file,
 Claude's import parsing, identity from runtime signals only, include dedupe.

{dotagents_cli-0.7.1 → dotagents_cli-0.7.3}/tests/test_fix_cli.py

@@ -1,4 +1,4 @@
-"""Regression tests for the CLI review fixes: command discovery that survives a
+"""Regression tests for CLI fixes: command discovery that survives a
 command whose parser cannot be built, the `findings` queue's encoding, naming
 and move-never-delete rules, and `launch`'s exit code, context file and
 cmd.exe argument handling.

{dotagents_cli-0.7.1 → dotagents_cli-0.7.3}/tests/test_fix_env.py

@@ -1,5 +1,4 @@
-"""Regression tests for the env assembly and rendering review fixes
-(review 2026-09-23, "Env assembly and rendering").
+"""Regression tests for env assembly and rendering fixes.
 
 tmp dirs only, no network. Run from repo root: ``python -m pytest tests/``.
 """

{dotagents_cli-0.7.1 → dotagents_cli-0.7.3}/tests/test_fix_hooks.py

@@ -1,4 +1,4 @@
-"""Hook fixes from the 2026-09-23 review: the PowerShell handlers' Git Bash
+"""Hook fixes: the PowerShell handlers' Git Bash
 gate, UTF-8 through the PowerShell pipe, the PreToolUse matcher, merging that
 keeps the user's keys, symlink-safe and non-ASCII-safe wrappers.
 

{dotagents_cli-0.7.1 → dotagents_cli-0.7.3}/tests/test_fix_init.py

@@ -1,4 +1,4 @@
-"""Regression tests for the 2026-09-23 review's `init` / `launch` fixes:
+"""Regression tests for `init` / `launch` fixes:
 
 - `init --from` takes the documented URI, git and checkout forms (it crashed
   on every remote scheme and on a checkout root);

{dotagents_cli-0.7.1 → dotagents_cli-0.7.3}/tests/test_fix_overlays.py

@@ -1,5 +1,5 @@
-"""Regression tests for the 2026-09-23 review's "Overlays, sources and skills"
-findings: typed source errors, registry parsing, credential handling, the spec
+"""Regression tests for "Overlays, sources and skills" fixes: typed source
+errors, registry parsing, credential handling, the spec
 grammar, manifest validation, overlay names, install records, and the
 add/remove/sync lifecycle.
 

{dotagents_cli-0.7.1 → dotagents_cli-0.7.3}/tests/test_fix_scope_context.py

@@ -1,5 +1,4 @@
-"""Regressions for the scope-resolution and context-assembly review fixes
-(2026-09-23 review, "Scope resolution and context assembly").
+"""Regressions for the scope-resolution and context-assembly fixes.
 
 tmp dirs only. The user store is redirected with `$AGENTS_HOME`, the system
 store with `$AGENTS_SYSTEM_ROOT` (a path that does not exist), and the project

{dotagents_cli-0.7.1 → dotagents_cli-0.7.3}/tests/test_fix_skills_adapters.py

@@ -1,5 +1,5 @@
-"""Regression tests for the 2026-09-23 review's skills, adapter and hook-cost
-findings: Claude's per-skill links are refreshed and pruned, `overlays
+"""Regression tests for skills, adapter and hook-cost fixes: Claude's
+per-skill links are refreshed and pruned, `overlays
 add/sync/remove` keep a wired Claude skills dir current, project-scope skill
 links warn when git would commit them, pi gets a pointer to a project store,
 and the env loaders reuse a cached diff while the inputs are unchanged.

dotagents_cli-0.7.3/tests/test_git_ssl_revoke.py

@@ -0,0 +1,102 @@
+"""`git_ssl_revoke` in `<store>/dotagents/config.toml`: git's
+certificate-revocation check for overlay clones and fetches. Git for Windows'
+Schannel backend fails an https clone whose CRL cannot be fetched; git with
+OpenSSL (Linux) checks no CRLs. dotagents passes the setting to every git call
+as `http.schannelCheckRevoke`, `best-effort` unless the store says otherwise."""
+import subprocess
+
+import pytest
+
+from dotagents import _sources
+from dotagents.cli._common import STORE_CONFIG
+
+
+def _config(store, text):
+    path = store / STORE_CONFIG
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(text, encoding="utf-8")
+
+
+@pytest.fixture()
+def argv(monkeypatch):
+    seen = []
+
+    def run(cmd, **kwargs):
+        seen.append(cmd)
+        return subprocess.CompletedProcess(cmd, 0, "", "")
+
+    monkeypatch.setattr(_sources.subprocess, "run", run)
+    return seen
+
+
+def test_every_git_call_carries_the_setting_best_effort_by_default(tmp_path, argv):
+    cache = _sources.SourceCache(tmp_path / "cache")
+    cache._git(["ls-remote", "https://example.invalid/r.git"], None)
+    assert argv[-1][:3] == ["git", "-c", "http.schannelCheckRevoke=best-effort"]
+    _sources.SourceCache(tmp_path / "cache", ssl_revoke="false")._git(["fetch"], None)
+    assert argv[-1][:3] == ["git", "-c", "http.schannelCheckRevoke=false"]
+
+
+def test_the_store_config_chooses_project_before_user(tmp_path):
+    user, project = tmp_path / "user", tmp_path / "project"
+    assert _sources.git_ssl_revoke(project, user) == "best-effort"
+    _config(user, 'git_ssl_revoke = "false"\n')
+    assert _sources.git_ssl_revoke(None, user) == "false"
+    _config(project, 'git_ssl_revoke = "TRUE"\n')
+    assert _sources.git_ssl_revoke(project, user) == "true"
+
+
+def test_an_unknown_value_names_the_file(tmp_path):
+    _config(tmp_path, 'git_ssl_revoke = "maybe"\n')
+    with pytest.raises(_sources.SourceError, match="git_ssl_revoke = 'maybe'.*best-effort, true, false"):
+        _sources.git_ssl_revoke(tmp_path)
+
+
+def test_a_revocation_failure_names_the_setting(tmp_path, monkeypatch):
+    stderr = ("fatal: unable to access 'https://example.invalid/r.git/': schannel: next InitializeSecurityContext "
+              "failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012) - The revocation function was unable to check "
+              "revocation for the certificate.")
+    monkeypatch.setattr(_sources.subprocess, "run",
+                        lambda cmd, **kw: subprocess.CompletedProcess(cmd, 128, "", stderr))
+    with pytest.raises(_sources.SourceError) as caught:
+        _sources.SourceCache(tmp_path)._git(["clone", "https://example.invalid/r.git"], None)
+    message = str(caught.value)
+    assert "CRYPT_E_NO_REVOCATION_CHECK" in message and 'git_ssl_revoke = "false"' in message
+
+
+def test_a_git_without_best_effort_runs_again_without_it(tmp_path, monkeypatch):
+    seen = []
+
+    def run(cmd, **kwargs):
+        seen.append(cmd)
+        if "http.schannelCheckRevoke=best-effort" in cmd:
+            return subprocess.CompletedProcess(cmd, 128, "", "fatal: bad boolean config value 'best-effort' for "
+                                                              "'http.schannelcheckrevoke'\n")
+        return subprocess.CompletedProcess(cmd, 0, "ok", "")
+
+    monkeypatch.setattr(_sources.subprocess, "run", run)
+    proc = _sources.SourceCache(tmp_path)._git(["ls-remote", "https://example.invalid/r.git"], None)
+    assert proc.returncode == 0 and len(seen) == 2
+    assert seen[1] == ["git", "ls-remote", "https://example.invalid/r.git"]
+
+
+def test_any_other_failure_has_no_hint(tmp_path, monkeypatch):
+    monkeypatch.setattr(_sources.subprocess, "run",
+                        lambda cmd, **kw: subprocess.CompletedProcess(cmd, 128, "", "fatal: repository not found"))
+    with pytest.raises(_sources.SourceError) as caught:
+        _sources.SourceCache(tmp_path)._git(["clone", "https://example.invalid/r.git"], None)
+    assert "git_ssl_revoke" not in str(caught.value)
+
+
+@pytest.mark.skipif(not __import__("shutil").which("git"), reason="needs git on PATH")
+def test_git_accepts_the_option_on_a_local_clone(tmp_path):
+    """The option reaches a real git without breaking a clone (git ignores
+    it off Schannel; on Windows it is honoured)."""
+    work = tmp_path / "work"
+    work.mkdir()
+    for args in (["init", "-q", "-b", "main"], ["-c", "user.email=t@example.invalid", "-c", "user.name=t",
+                                                 "commit", "-q", "--allow-empty", "-m", "x"]):
+        subprocess.run(["git", *args], cwd=str(work), check=True, capture_output=True)
+    cache = _sources.SourceCache(tmp_path / "cache", ssl_revoke="false")
+    cache._git(["clone", "-q", str(work), str(tmp_path / "copy")], None)
+    assert (tmp_path / "copy" / ".git").is_dir()

{dotagents_cli-0.7.1 → dotagents_cli-0.7.3}/tests/test_last_mile.py

@@ -1,8 +1,8 @@
 """The last mile: does the config `init` writes actually reach a harness?
 
-Review 2026-09-09 (finding 1.5): `init` wrote `<store>/CLAUDE.md`, which Claude
-Code never reads, and `context` subtracted the store's AGENTS.md as "already
-loaded" on a static assumption. These tests pin the fix -- the include `init`
+`init` wrote `<store>/CLAUDE.md`, which Claude Code never reads, and
+`context` subtracted the store's AGENTS.md as "already loaded" on a static
+assumption. These tests pin the fix -- the include `init`
 writes where Claude reads it, the live include-based subtraction, and
 `--write-agent` landing in the harness's real file as a managed block -- plus
 the managed-block merge rules it relies on.