ixt-cli 0.8.0__tar.gz → 0.8.1__tar.gz

{ixt_cli-0.8.0 → ixt_cli-0.8.1}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.4
 Name: ixt-cli
-Version: 0.8.0
+Version: 0.8.1
 Summary: Universal CLI tool isolator - manage Python, Node, and binary tools with per-tool isolation
 Project-URL: Homepage, https://gitlab.com/pytgaen-group/ixt
 Project-URL: Repository, https://gitlab.com/pytgaen-group/ixt.git
 Project-URL: Issues, https://gitlab.com/pytgaen-group/ixt/-/issues
-Project-URL: Documentation, https://gitlab.com/pytgaen-group/ixt#readme
+Project-URL: Documentation, https://ixt-39f604.gitlab.io
 Author-email: Gaëtan Montury <10528250-pytgaen@users.noreply.gitlab.com>
 License: MIT
 Keywords: cli,github,isolation,npm,package-manager,pypi,tool
@@ -27,7 +27,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 
 <p align="center">
-  <img src="assets/ixt.jpg" alt="ixt" width="600">
+  <img src="https://ixt-39f604.gitlab.io/assets/ixt.jpg" alt="ixt" width="600">
 </p>
 
 <h1 align="center">ixt — Universal CLI Tool Isolator</h1>
@@ -40,17 +40,22 @@ Description-Content-Type: text/markdown
 </p>
 
 <p align="center">
-  <img src="assets/wip.jpg" alt="Work in Progress" width="300">
+  <img src="https://ixt-39f604.gitlab.io/assets/wip.jpg" alt="Work in Progress" width="300">
 </p>
 
 **One CLI for Python, Node, and binary tools — each in its own isolated env.**
-**Optional Linux runtime policy can restrict env vars and filesystem access per tool.**
 
 *Zero third-party deps. Zero system pollution. One command, any ecosystem.*
 
+- **Day-one GitHub releases** — install a tool the day it ships, without
+  waiting for a formula, registry entry, or plugin.
+- **No system runtime needed** — ixt is pure Python stdlib; `uv` and `bun` are
+  bootstrapped on first use, so the host does not need Node, npm, or a package
+  manager pre-installed.
+
 ```bash
 ixt tool install ruff                      # Python (PyPI)
-ixt tool install @anthropic-ai/claude-code # Node (npm)
+ixt tool install @anthropic-ai/claude-code # npm package via bun
 ixt tool install ripgrep                   # Binary (GitHub — via built-in registry)
 ```
 
@@ -62,10 +67,10 @@ From PyPI. The published package is `ixt-cli`; it installs the `ixt` command.
 
 ```bash
 # One-shot via uvx (requires uv)
-uvx --from ixt-cli==0.7.0 ixt --help
+uvx --from ixt-cli ixt --help
 
 # Persistent install via uv tool
-uv tool install ixt-cli==0.7.0
+uv tool install ixt-cli
 ```
 
 Or from source:
@@ -83,16 +88,16 @@ ixt setup path
 
 ### Integrity verification
 
-Release tags are SSH-signed. Installing from PyPI pins the published package
-version but does not verify the Git tag signature locally. Use the clone flow
-when you want to verify the signed release before installing:
+Release tags are SSH-signed. Installing from PyPI does not verify the Git tag
+signature locally. Use the clone flow when you want to verify a signed release
+before installing:
 
 ```bash
 # Verify the signed tag (requires the maintainer's SSH public key in git's allowed_signers)
 git clone https://gitlab.com/pytgaen-group/ixt.git && cd ixt
 git fetch --tags
-git verify-tag v0.7.0
-git checkout --detach v0.7.0
+git verify-tag vX.Y.Z
+git checkout --detach vX.Y.Z
 uv tool install .
 ```
 
@@ -144,30 +149,6 @@ ixt tool install @npm:prettier
 ixt tool install @gh:BurntSushi/ripgrep
 ```
 
-## 🛡️ Runtime policy
-
-Dependency isolation is the baseline — but ixt also lets you control **what each tool can see at runtime**: which environment variables it receives, which filesystem paths it can read or write. This is a runtime policy for commands launched through ixt shims, not a sandbox for install-time package-manager scripts. If the install step itself is untrusted, use a disposable VM/container/user.
-
-```bash
-# Avoid passing secrets in the runtime environment
-ixt tool config some-cli env base os-common
-ixt tool config some-cli env allow '*RUFF*'
-
-# Restrict filesystem at runtime: read-only host, hide ~/.aws and ~/.ssh
-ixt tool config some-cli fs base app-common
-ixt tool config some-cli fs scratch ~/.aws ~/.ssh
-```
-
-When a policy is active, the PATH shim becomes a small Python wrapper that — when [bubblewrap](https://github.com/containers/bubblewrap) is installed — runs the tool with PID isolation and a private `/proc`. The filtered env reaches the tool, and `/proc/$PPID/environ` reads from inside cannot recover the host secrets. Filesystem policy also requires bwrap. Without bwrap, env policy still cleans the env reaching the tool but `/proc` reads remain exfiltrable — the shim warns once per session in this **degraded "hygiene-only" mode**. Reset the policy and you're back to a direct symlink with zero overhead.
-
-The policy is replayable: declare `env_base`, `env_allow`, `fs_scratch`, etc. inside `ixt.toml` and `ixt tool apply` reproduces it on any machine. Use `IXT_SHIM_DEBUG=1` to dump the effective env, `IXT_POLICY_QUIET=1` to silence the degraded-mode warning, `IXT_DISABLE_BWRAP=1` to force degraded mode for debugging.
-
-> ⚠️ **Linux only for now.** Enforcement relies on POSIX `execve` and Linux namespaces. On macOS/Windows the policy is saved to `ixt.json` but **not enforced at runtime** — the tool runs with the full environment.
-> Install [bubblewrap](https://github.com/containers/bubblewrap) for **effective env/fs enforcement**: `sudo apt install bubblewrap` / `sudo dnf install bubblewrap` / `sudo pacman -S bubblewrap` / `sudo apk add bubblewrap`. The env axis runs without it but only as a hygiene measure (cleans logs/traces); the fs axis requires it and errors out otherwise. Network isolation is not implemented yet.
-> This is not a general malware sandbox.
-
-[Full policy reference →](https://gitlab.com/pytgaen-group/ixt/-/blob/main/docs/policy/index.md)
-
 ## 📚 Built-in Registry
 
 ixt ships with a built-in registry that maps common tool names to their source. No need to remember the GitHub path:
@@ -262,12 +243,12 @@ $IXT_CACHE_HOME/          # default ~/.cache/ixt (respects $XDG_CACHE_HOME)
 |                          | uv tool | pipx | npm -g | aqua | mise      | proto | **ixt** |
 | ------------------------ | ------- | ---- | ------ | ---- | --------- | ----- | ------- |
 | Python tools (PyPI)      | ✅      | ✅   | —      | —    | ✅ (pipx) | —     | ✅      |
-| Node tools (npm)         | —       | —    | ✅     | —    | ✅ (npm)  | —     | ✅      |
+| npm packages             | —       | —    | ✅     | —    | ✅ (npm)  | —     | ✅      |
 | GitHub Releases binaries | —       | —    | —      | ✅   | ✅ (ubi)  | ~     | ✅      |
+| Day-one GitHub releases  | —       | —    | —      | ❌   | ❌        | ~     | ✅      |
 | Dependency isolation     | ✅      | ✅   | ❌     | —    | partial   | —     | ✅      |
 | Fine-grained exposure    | —       | —    | —      | —    | —         | —     | ✅      |
-| Runtime policy (env+fs)  | —       | —    | —      | —    | —         | —     | ✅      |
-| Bootstrap from scratch   | —       | —    | —      | —    | curl      | curl  | ✅      |
+| No system runtime needed | —       | —    | ❌     | ❌   | ❌        | ❌    | ✅      |
 | Declarative config       | —       | —    | —      | YAML | TOML      | TOML  | TOML    |
 
 ixt is **not** a runtime version manager (mise, proto, asdf cover that). It manages the **last mile**: install, isolate, expose and group CLI tools across three ecosystems.

{ixt_cli-0.8.0 → ixt_cli-0.8.1}/README.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="assets/ixt.jpg" alt="ixt" width="600">
+  <img src="https://ixt-39f604.gitlab.io/assets/ixt.jpg" alt="ixt" width="600">
 </p>
 
 <h1 align="center">ixt — Universal CLI Tool Isolator</h1>
@@ -12,17 +12,22 @@
 </p>
 
 <p align="center">
-  <img src="assets/wip.jpg" alt="Work in Progress" width="300">
+  <img src="https://ixt-39f604.gitlab.io/assets/wip.jpg" alt="Work in Progress" width="300">
 </p>
 
 **One CLI for Python, Node, and binary tools — each in its own isolated env.**
-**Optional Linux runtime policy can restrict env vars and filesystem access per tool.**
 
 *Zero third-party deps. Zero system pollution. One command, any ecosystem.*
 
+- **Day-one GitHub releases** — install a tool the day it ships, without
+  waiting for a formula, registry entry, or plugin.
+- **No system runtime needed** — ixt is pure Python stdlib; `uv` and `bun` are
+  bootstrapped on first use, so the host does not need Node, npm, or a package
+  manager pre-installed.
+
 ```bash
 ixt tool install ruff                      # Python (PyPI)
-ixt tool install @anthropic-ai/claude-code # Node (npm)
+ixt tool install @anthropic-ai/claude-code # npm package via bun
 ixt tool install ripgrep                   # Binary (GitHub — via built-in registry)
 ```
 
@@ -34,10 +39,10 @@ From PyPI. The published package is `ixt-cli`; it installs the `ixt` command.
 
 ```bash
 # One-shot via uvx (requires uv)
-uvx --from ixt-cli==0.7.0 ixt --help
+uvx --from ixt-cli ixt --help
 
 # Persistent install via uv tool
-uv tool install ixt-cli==0.7.0
+uv tool install ixt-cli
 ```
 
 Or from source:
@@ -55,16 +60,16 @@ ixt setup path
 
 ### Integrity verification
 
-Release tags are SSH-signed. Installing from PyPI pins the published package
-version but does not verify the Git tag signature locally. Use the clone flow
-when you want to verify the signed release before installing:
+Release tags are SSH-signed. Installing from PyPI does not verify the Git tag
+signature locally. Use the clone flow when you want to verify a signed release
+before installing:
 
 ```bash
 # Verify the signed tag (requires the maintainer's SSH public key in git's allowed_signers)
 git clone https://gitlab.com/pytgaen-group/ixt.git && cd ixt
 git fetch --tags
-git verify-tag v0.7.0
-git checkout --detach v0.7.0
+git verify-tag vX.Y.Z
+git checkout --detach vX.Y.Z
 uv tool install .
 ```
 
@@ -116,30 +121,6 @@ ixt tool install @npm:prettier
 ixt tool install @gh:BurntSushi/ripgrep
 ```
 
-## 🛡️ Runtime policy
-
-Dependency isolation is the baseline — but ixt also lets you control **what each tool can see at runtime**: which environment variables it receives, which filesystem paths it can read or write. This is a runtime policy for commands launched through ixt shims, not a sandbox for install-time package-manager scripts. If the install step itself is untrusted, use a disposable VM/container/user.
-
-```bash
-# Avoid passing secrets in the runtime environment
-ixt tool config some-cli env base os-common
-ixt tool config some-cli env allow '*RUFF*'
-
-# Restrict filesystem at runtime: read-only host, hide ~/.aws and ~/.ssh
-ixt tool config some-cli fs base app-common
-ixt tool config some-cli fs scratch ~/.aws ~/.ssh
-```
-
-When a policy is active, the PATH shim becomes a small Python wrapper that — when [bubblewrap](https://github.com/containers/bubblewrap) is installed — runs the tool with PID isolation and a private `/proc`. The filtered env reaches the tool, and `/proc/$PPID/environ` reads from inside cannot recover the host secrets. Filesystem policy also requires bwrap. Without bwrap, env policy still cleans the env reaching the tool but `/proc` reads remain exfiltrable — the shim warns once per session in this **degraded "hygiene-only" mode**. Reset the policy and you're back to a direct symlink with zero overhead.
-
-The policy is replayable: declare `env_base`, `env_allow`, `fs_scratch`, etc. inside `ixt.toml` and `ixt tool apply` reproduces it on any machine. Use `IXT_SHIM_DEBUG=1` to dump the effective env, `IXT_POLICY_QUIET=1` to silence the degraded-mode warning, `IXT_DISABLE_BWRAP=1` to force degraded mode for debugging.
-
-> ⚠️ **Linux only for now.** Enforcement relies on POSIX `execve` and Linux namespaces. On macOS/Windows the policy is saved to `ixt.json` but **not enforced at runtime** — the tool runs with the full environment.
-> Install [bubblewrap](https://github.com/containers/bubblewrap) for **effective env/fs enforcement**: `sudo apt install bubblewrap` / `sudo dnf install bubblewrap` / `sudo pacman -S bubblewrap` / `sudo apk add bubblewrap`. The env axis runs without it but only as a hygiene measure (cleans logs/traces); the fs axis requires it and errors out otherwise. Network isolation is not implemented yet.
-> This is not a general malware sandbox.
-
-[Full policy reference →](https://gitlab.com/pytgaen-group/ixt/-/blob/main/docs/policy/index.md)
-
 ## 📚 Built-in Registry
 
 ixt ships with a built-in registry that maps common tool names to their source. No need to remember the GitHub path:
@@ -234,12 +215,12 @@ $IXT_CACHE_HOME/          # default ~/.cache/ixt (respects $XDG_CACHE_HOME)
 |                          | uv tool | pipx | npm -g | aqua | mise      | proto | **ixt** |
 | ------------------------ | ------- | ---- | ------ | ---- | --------- | ----- | ------- |
 | Python tools (PyPI)      | ✅      | ✅   | —      | —    | ✅ (pipx) | —     | ✅      |
-| Node tools (npm)         | —       | —    | ✅     | —    | ✅ (npm)  | —     | ✅      |
+| npm packages             | —       | —    | ✅     | —    | ✅ (npm)  | —     | ✅      |
 | GitHub Releases binaries | —       | —    | —      | ✅   | ✅ (ubi)  | ~     | ✅      |
+| Day-one GitHub releases  | —       | —    | —      | ❌   | ❌        | ~     | ✅      |
 | Dependency isolation     | ✅      | ✅   | ❌     | —    | partial   | —     | ✅      |
 | Fine-grained exposure    | —       | —    | —      | —    | —         | —     | ✅      |
-| Runtime policy (env+fs)  | —       | —    | —      | —    | —         | —     | ✅      |
-| Bootstrap from scratch   | —       | —    | —      | —    | curl      | curl  | ✅      |
+| No system runtime needed | —       | —    | ❌     | ❌   | ❌        | ❌    | ✅      |
 | Declarative config       | —       | —    | —      | YAML | TOML      | TOML  | TOML    |
 
 ixt is **not** a runtime version manager (mise, proto, asdf cover that). It manages the **last mile**: install, isolate, expose and group CLI tools across three ecosystems.

{ixt_cli-0.8.0 → ixt_cli-0.8.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ixt-cli"
-version = "0.8.0" # to bump
+version = "0.8.1" # to bump
 description = "Universal CLI tool isolator - manage Python, Node, and binary tools with per-tool isolation"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -49,7 +49,7 @@ ixt = "ixt.cli:main"
 Homepage = "https://gitlab.com/pytgaen-group/ixt"
 Repository = "https://gitlab.com/pytgaen-group/ixt.git"
 Issues = "https://gitlab.com/pytgaen-group/ixt/-/issues"
-Documentation = "https://gitlab.com/pytgaen-group/ixt#readme"
+Documentation = "https://ixt-39f604.gitlab.io"
 
 [tool.hatch.build.targets.wheel]
 packages = ["src/ixt"]