ixt-cli 0.8.0__tar.gz → 0.9.0__tar.gz

{ixt_cli-0.8.0 → ixt_cli-0.9.0}/.gitignore

@@ -150,3 +150,4 @@ ixt.egg-info
 
 .memsearch/
 .pyscn/
+.pi/

ixt_cli-0.9.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Gaëtan Montury
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

{ixt_cli-0.8.0 → ixt_cli-0.9.0}/PKG-INFO

@@ -1,13 +1,14 @@
 Metadata-Version: 2.4
 Name: ixt-cli
-Version: 0.8.0
+Version: 0.9.0
 Summary: Universal CLI tool isolator - manage Python, Node, and binary tools with per-tool isolation
 Project-URL: Homepage, https://gitlab.com/pytgaen-group/ixt
 Project-URL: Repository, https://gitlab.com/pytgaen-group/ixt.git
 Project-URL: Issues, https://gitlab.com/pytgaen-group/ixt/-/issues
-Project-URL: Documentation, https://gitlab.com/pytgaen-group/ixt#readme
+Project-URL: Documentation, https://ixt-39f604.gitlab.io
 Author-email: Gaëtan Montury <10528250-pytgaen@users.noreply.gitlab.com>
 License: MIT
+License-File: LICENSE
 Keywords: cli,github,isolation,npm,package-manager,pypi,tool
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
@@ -27,30 +28,37 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 
 <p align="center">
-  <img src="assets/ixt.jpg" alt="ixt" width="600">
+  <img src="https://ixt-39f604.gitlab.io/assets/ixt.jpg" alt="ixt" width="600">
 </p>
 
 <h1 align="center">ixt — Universal CLI Tool Isolator</h1>
 
 <p align="center">
-  <a href="https://gitlab.com/pytgaen-group/ixt/-/releases"><img src="https://img.shields.io/gitlab/v/release/pytgaen-group/ixt?label=release" alt="Release"></a>
-  <a href="https://gitlab.com/pytgaen-group/ixt/-/pipelines"><img src="https://img.shields.io/gitlab/pipeline-status/pytgaen-group/ixt?branch=main" alt="Pipeline"></a>
+  <a href="https://gitlab.com/pytgaen-group/ixt/-/tags"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fgitlab.com%2Fapi%2Fv4%2Fprojects%2F81169049%2Frepository%2Ftags%3Fper_page%3D1&amp;query=%24%5B0%5D.name&amp;label=release" alt="Release"></a>
+  <a href="https://gitlab.com/pytgaen-group/ixt/-/blob/main/.gitlab-ci.yml"><img src="https://img.shields.io/badge/build-GitLab%20CI-blue?logo=gitlab" alt="Build: GitLab CI"></a>
+  <a href="https://pypi.org/project/ixt-cli/"><img src="https://img.shields.io/pypi/v/ixt-cli?label=pypi" alt="PyPI"></a>
+  <a href="https://pepy.tech/projects/ixt-cli"><img src="https://static.pepy.tech/badge/ixt-cli/month" alt="PyPI Downloads"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="License: MIT"></a>
   <img src="https://img.shields.io/badge/python-3.10%2B-blue.svg" alt="Python 3.10+">
 </p>
 
 <p align="center">
-  <img src="assets/wip.jpg" alt="Work in Progress" width="300">
+  <img src="https://ixt-39f604.gitlab.io/assets/wip.jpg" alt="Work in Progress" width="300">
 </p>
 
 **One CLI for Python, Node, and binary tools — each in its own isolated env.**
-**Optional Linux runtime policy can restrict env vars and filesystem access per tool.**
 
 *Zero third-party deps. Zero system pollution. One command, any ecosystem.*
 
+- **Day-one GitHub releases** — install a tool the day it ships, without
+  waiting for a formula, registry entry, or plugin.
+- **No system runtime needed** — ixt is pure Python stdlib; `uv` and `bun` are
+  bootstrapped on first use, so the host does not need Node, npm, or a package
+  manager pre-installed.
+
 ```bash
 ixt tool install ruff                      # Python (PyPI)
-ixt tool install @anthropic-ai/claude-code # Node (npm)
+ixt tool install @anthropic-ai/claude-code # npm package via bun
 ixt tool install ripgrep                   # Binary (GitHub — via built-in registry)
 ```
 
@@ -62,10 +70,10 @@ From PyPI. The published package is `ixt-cli`; it installs the `ixt` command.
 
 ```bash
 # One-shot via uvx (requires uv)
-uvx --from ixt-cli==0.7.0 ixt --help
+uvx --from ixt-cli ixt --help
 
 # Persistent install via uv tool
-uv tool install ixt-cli==0.7.0
+uv tool install ixt-cli
 ```
 
 Or from source:
@@ -83,16 +91,16 @@ ixt setup path
 
 ### Integrity verification
 
-Release tags are SSH-signed. Installing from PyPI pins the published package
-version but does not verify the Git tag signature locally. Use the clone flow
-when you want to verify the signed release before installing:
+Release tags are SSH-signed. Installing from PyPI does not verify the Git tag
+signature locally. Use the clone flow when you want to verify a signed release
+before installing:
 
 ```bash
 # Verify the signed tag (requires the maintainer's SSH public key in git's allowed_signers)
 git clone https://gitlab.com/pytgaen-group/ixt.git && cd ixt
 git fetch --tags
-git verify-tag v0.7.0
-git checkout --detach v0.7.0
+git verify-tag vX.Y.Z
+git checkout --detach vX.Y.Z
 uv tool install .
 ```
 
@@ -144,30 +152,6 @@ ixt tool install @npm:prettier
 ixt tool install @gh:BurntSushi/ripgrep
 ```
 
-## 🛡️ Runtime policy
-
-Dependency isolation is the baseline — but ixt also lets you control **what each tool can see at runtime**: which environment variables it receives, which filesystem paths it can read or write. This is a runtime policy for commands launched through ixt shims, not a sandbox for install-time package-manager scripts. If the install step itself is untrusted, use a disposable VM/container/user.
-
-```bash
-# Avoid passing secrets in the runtime environment
-ixt tool config some-cli env base os-common
-ixt tool config some-cli env allow '*RUFF*'
-
-# Restrict filesystem at runtime: read-only host, hide ~/.aws and ~/.ssh
-ixt tool config some-cli fs base app-common
-ixt tool config some-cli fs scratch ~/.aws ~/.ssh
-```
-
-When a policy is active, the PATH shim becomes a small Python wrapper that — when [bubblewrap](https://github.com/containers/bubblewrap) is installed — runs the tool with PID isolation and a private `/proc`. The filtered env reaches the tool, and `/proc/$PPID/environ` reads from inside cannot recover the host secrets. Filesystem policy also requires bwrap. Without bwrap, env policy still cleans the env reaching the tool but `/proc` reads remain exfiltrable — the shim warns once per session in this **degraded "hygiene-only" mode**. Reset the policy and you're back to a direct symlink with zero overhead.
-
-The policy is replayable: declare `env_base`, `env_allow`, `fs_scratch`, etc. inside `ixt.toml` and `ixt tool apply` reproduces it on any machine. Use `IXT_SHIM_DEBUG=1` to dump the effective env, `IXT_POLICY_QUIET=1` to silence the degraded-mode warning, `IXT_DISABLE_BWRAP=1` to force degraded mode for debugging.
-
-> ⚠️ **Linux only for now.** Enforcement relies on POSIX `execve` and Linux namespaces. On macOS/Windows the policy is saved to `ixt.json` but **not enforced at runtime** — the tool runs with the full environment.
-> Install [bubblewrap](https://github.com/containers/bubblewrap) for **effective env/fs enforcement**: `sudo apt install bubblewrap` / `sudo dnf install bubblewrap` / `sudo pacman -S bubblewrap` / `sudo apk add bubblewrap`. The env axis runs without it but only as a hygiene measure (cleans logs/traces); the fs axis requires it and errors out otherwise. Network isolation is not implemented yet.
-> This is not a general malware sandbox.
-
-[Full policy reference →](https://gitlab.com/pytgaen-group/ixt/-/blob/main/docs/policy/index.md)
-
 ## 📚 Built-in Registry
 
 ixt ships with a built-in registry that maps common tool names to their source. No need to remember the GitHub path:
@@ -202,6 +186,24 @@ ixt tool install sharkdp/fd@10              # latest 10.x.x
 ixt tool install ruff>=0.5.0                # PEP 508 (Python)
 ```
 
+## 🔒 Declarative locks
+
+`ixt.toml` is the human-edited intent: which tools you want, with optional
+version bounds, exposure rules, and injections. `ixt.lock` is generated from
+that intent and records the exact resolved versions and binary release assets.
+
+For teams and CI, commit both files:
+
+```bash
+ixt lock write
+ixt lock check
+ixt tool apply --locked --strict
+```
+
+`--locked` replays the exact lock instead of resolving newer versions.
+`--strict` fails before changing the machine if `ixt.toml` and `ixt.lock`
+diverge.
+
 ## 🧰 Commands
 
 | Command                                        | Description                                                           |
@@ -215,7 +217,11 @@ ixt tool install ruff>=0.5.0                # PEP 508 (Python)
 | `ixt tool upgrade <pkg>`                            | Upgrade a tool                                                        |
 | `ixt tool upgrade --all`                            | Upgrade all tools                                                     |
 | `ixt tool apply`                                    | Sync tools from declarative config                                    |
+| `ixt tool apply --locked --strict`                   | Sync using exact versions and assets from ixt.lock                    |
 | `ixt tool export`                             | Export installed tools as ixt.toml (stdout), preserves install intent |
+| `ixt lock write`                              | Resolve ixt.toml and write ixt.lock                                   |
+| `ixt lock check`                              | Fail if ixt.lock is missing or stale                                  |
+| `ixt lock diff`                               | Show semantic differences between ixt.toml and ixt.lock               |
 | `ixt asset-index export`                       | Export portable binary-resolution metadata as JSON                    |
 | `ixt tool config <pkg> expose <rules...>`           | Change exposed binaries                                               |
 | `ixt tool config <pkg> inject <dep>`                | Inject a package into the tool's env                                  |
@@ -238,7 +244,8 @@ ixt tool install ruff>=0.5.0                # PEP 508 (Python)
 ```
 $IXT_HOME/                # default ~/.local/share/ixt (respects $XDG_DATA_HOME)
 ├── config/
-│   ├── ixt.toml
+│   ├── ixt.toml          # global declarative manifest fallback
+│   ├── ixt.lock          # global lock when using the global ixt.toml
 │   ├── registry.toml
 │   └── heuristics.toml
 └── installed/
@@ -262,12 +269,12 @@ $IXT_CACHE_HOME/          # default ~/.cache/ixt (respects $XDG_CACHE_HOME)
 |                          | uv tool | pipx | npm -g | aqua | mise      | proto | **ixt** |
 | ------------------------ | ------- | ---- | ------ | ---- | --------- | ----- | ------- |
 | Python tools (PyPI)      | ✅      | ✅   | —      | —    | ✅ (pipx) | —     | ✅      |
-| Node tools (npm)         | —       | —    | ✅     | —    | ✅ (npm)  | —     | ✅      |
+| npm packages             | —       | —    | ✅     | —    | ✅ (npm)  | —     | ✅      |
 | GitHub Releases binaries | —       | —    | —      | ✅   | ✅ (ubi)  | ~     | ✅      |
+| Day-one GitHub releases  | —       | —    | —      | ❌   | ❌        | ~     | ✅      |
 | Dependency isolation     | ✅      | ✅   | ❌     | —    | partial   | —     | ✅      |
 | Fine-grained exposure    | —       | —    | —      | —    | —         | —     | ✅      |
-| Runtime policy (env+fs)  | —       | —    | —      | —    | —         | —     | ✅      |
-| Bootstrap from scratch   | —       | —    | —      | —    | curl      | curl  | ✅      |
+| No system runtime needed | —       | —    | ❌     | ❌   | ❌        | ❌    | ✅      |
 | Declarative config       | —       | —    | —      | YAML | TOML      | TOML  | TOML    |
 
 ixt is **not** a runtime version manager (mise, proto, asdf cover that). It manages the **last mile**: install, isolate, expose and group CLI tools across three ecosystems.
@@ -285,10 +292,10 @@ uv run ruff format src/ tests/ # format
 
 ## 🤝 Contributing
 
-Development happens on **GitLab**: <https://gitlab.com/pytgaen-group/ixt>. The GitHub repository (if present) is a **read-only mirror** — please open issues and merge requests on GitLab.
+Development happens on **GitLab**: <https://gitlab.com/pytgaen-group/ixt>. Any GitHub repository for this project is a **read-only mirror** of GitLab; it is not the review or issue tracker. Please open issues and merge requests on GitLab.
 
 Bug reports and reproduction recipes are welcome. See [`CONTRIBUTING.md`](CONTRIBUTING.md) for details, or open an issue to start a discussion.
 
 ## 📄 License
 
-MIT
+MIT. See [`LICENSE`](LICENSE).

{ixt_cli-0.8.0 → ixt_cli-0.9.0}/README.md

@@ -1,28 +1,35 @@
 <p align="center">
-  <img src="assets/ixt.jpg" alt="ixt" width="600">
+  <img src="https://ixt-39f604.gitlab.io/assets/ixt.jpg" alt="ixt" width="600">
 </p>
 
 <h1 align="center">ixt — Universal CLI Tool Isolator</h1>
 
 <p align="center">
-  <a href="https://gitlab.com/pytgaen-group/ixt/-/releases"><img src="https://img.shields.io/gitlab/v/release/pytgaen-group/ixt?label=release" alt="Release"></a>
-  <a href="https://gitlab.com/pytgaen-group/ixt/-/pipelines"><img src="https://img.shields.io/gitlab/pipeline-status/pytgaen-group/ixt?branch=main" alt="Pipeline"></a>
+  <a href="https://gitlab.com/pytgaen-group/ixt/-/tags"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fgitlab.com%2Fapi%2Fv4%2Fprojects%2F81169049%2Frepository%2Ftags%3Fper_page%3D1&amp;query=%24%5B0%5D.name&amp;label=release" alt="Release"></a>
+  <a href="https://gitlab.com/pytgaen-group/ixt/-/blob/main/.gitlab-ci.yml"><img src="https://img.shields.io/badge/build-GitLab%20CI-blue?logo=gitlab" alt="Build: GitLab CI"></a>
+  <a href="https://pypi.org/project/ixt-cli/"><img src="https://img.shields.io/pypi/v/ixt-cli?label=pypi" alt="PyPI"></a>
+  <a href="https://pepy.tech/projects/ixt-cli"><img src="https://static.pepy.tech/badge/ixt-cli/month" alt="PyPI Downloads"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="License: MIT"></a>
   <img src="https://img.shields.io/badge/python-3.10%2B-blue.svg" alt="Python 3.10+">
 </p>
 
 <p align="center">
-  <img src="assets/wip.jpg" alt="Work in Progress" width="300">
+  <img src="https://ixt-39f604.gitlab.io/assets/wip.jpg" alt="Work in Progress" width="300">
 </p>
 
 **One CLI for Python, Node, and binary tools — each in its own isolated env.**
-**Optional Linux runtime policy can restrict env vars and filesystem access per tool.**
 
 *Zero third-party deps. Zero system pollution. One command, any ecosystem.*
 
+- **Day-one GitHub releases** — install a tool the day it ships, without
+  waiting for a formula, registry entry, or plugin.
+- **No system runtime needed** — ixt is pure Python stdlib; `uv` and `bun` are
+  bootstrapped on first use, so the host does not need Node, npm, or a package
+  manager pre-installed.
+
 ```bash
 ixt tool install ruff                      # Python (PyPI)
-ixt tool install @anthropic-ai/claude-code # Node (npm)
+ixt tool install @anthropic-ai/claude-code # npm package via bun
 ixt tool install ripgrep                   # Binary (GitHub — via built-in registry)
 ```
 
@@ -34,10 +41,10 @@ From PyPI. The published package is `ixt-cli`; it installs the `ixt` command.
 
 ```bash
 # One-shot via uvx (requires uv)
-uvx --from ixt-cli==0.7.0 ixt --help
+uvx --from ixt-cli ixt --help
 
 # Persistent install via uv tool
-uv tool install ixt-cli==0.7.0
+uv tool install ixt-cli
 ```
 
 Or from source:
@@ -55,16 +62,16 @@ ixt setup path
 
 ### Integrity verification
 
-Release tags are SSH-signed. Installing from PyPI pins the published package
-version but does not verify the Git tag signature locally. Use the clone flow
-when you want to verify the signed release before installing:
+Release tags are SSH-signed. Installing from PyPI does not verify the Git tag
+signature locally. Use the clone flow when you want to verify a signed release
+before installing:
 
 ```bash
 # Verify the signed tag (requires the maintainer's SSH public key in git's allowed_signers)
 git clone https://gitlab.com/pytgaen-group/ixt.git && cd ixt
 git fetch --tags
-git verify-tag v0.7.0
-git checkout --detach v0.7.0
+git verify-tag vX.Y.Z
+git checkout --detach vX.Y.Z
 uv tool install .
 ```
 
@@ -116,30 +123,6 @@ ixt tool install @npm:prettier
 ixt tool install @gh:BurntSushi/ripgrep
 ```
 
-## 🛡️ Runtime policy
-
-Dependency isolation is the baseline — but ixt also lets you control **what each tool can see at runtime**: which environment variables it receives, which filesystem paths it can read or write. This is a runtime policy for commands launched through ixt shims, not a sandbox for install-time package-manager scripts. If the install step itself is untrusted, use a disposable VM/container/user.
-
-```bash
-# Avoid passing secrets in the runtime environment
-ixt tool config some-cli env base os-common
-ixt tool config some-cli env allow '*RUFF*'
-
-# Restrict filesystem at runtime: read-only host, hide ~/.aws and ~/.ssh
-ixt tool config some-cli fs base app-common
-ixt tool config some-cli fs scratch ~/.aws ~/.ssh
-```
-
-When a policy is active, the PATH shim becomes a small Python wrapper that — when [bubblewrap](https://github.com/containers/bubblewrap) is installed — runs the tool with PID isolation and a private `/proc`. The filtered env reaches the tool, and `/proc/$PPID/environ` reads from inside cannot recover the host secrets. Filesystem policy also requires bwrap. Without bwrap, env policy still cleans the env reaching the tool but `/proc` reads remain exfiltrable — the shim warns once per session in this **degraded "hygiene-only" mode**. Reset the policy and you're back to a direct symlink with zero overhead.
-
-The policy is replayable: declare `env_base`, `env_allow`, `fs_scratch`, etc. inside `ixt.toml` and `ixt tool apply` reproduces it on any machine. Use `IXT_SHIM_DEBUG=1` to dump the effective env, `IXT_POLICY_QUIET=1` to silence the degraded-mode warning, `IXT_DISABLE_BWRAP=1` to force degraded mode for debugging.
-
-> ⚠️ **Linux only for now.** Enforcement relies on POSIX `execve` and Linux namespaces. On macOS/Windows the policy is saved to `ixt.json` but **not enforced at runtime** — the tool runs with the full environment.
-> Install [bubblewrap](https://github.com/containers/bubblewrap) for **effective env/fs enforcement**: `sudo apt install bubblewrap` / `sudo dnf install bubblewrap` / `sudo pacman -S bubblewrap` / `sudo apk add bubblewrap`. The env axis runs without it but only as a hygiene measure (cleans logs/traces); the fs axis requires it and errors out otherwise. Network isolation is not implemented yet.
-> This is not a general malware sandbox.
-
-[Full policy reference →](https://gitlab.com/pytgaen-group/ixt/-/blob/main/docs/policy/index.md)
-
 ## 📚 Built-in Registry
 
 ixt ships with a built-in registry that maps common tool names to their source. No need to remember the GitHub path:
@@ -174,6 +157,24 @@ ixt tool install sharkdp/fd@10              # latest 10.x.x
 ixt tool install ruff>=0.5.0                # PEP 508 (Python)
 ```
 
+## 🔒 Declarative locks
+
+`ixt.toml` is the human-edited intent: which tools you want, with optional
+version bounds, exposure rules, and injections. `ixt.lock` is generated from
+that intent and records the exact resolved versions and binary release assets.
+
+For teams and CI, commit both files:
+
+```bash
+ixt lock write
+ixt lock check
+ixt tool apply --locked --strict
+```
+
+`--locked` replays the exact lock instead of resolving newer versions.
+`--strict` fails before changing the machine if `ixt.toml` and `ixt.lock`
+diverge.
+
 ## 🧰 Commands
 
 | Command                                        | Description                                                           |
@@ -187,7 +188,11 @@ ixt tool install ruff>=0.5.0                # PEP 508 (Python)
 | `ixt tool upgrade <pkg>`                            | Upgrade a tool                                                        |
 | `ixt tool upgrade --all`                            | Upgrade all tools                                                     |
 | `ixt tool apply`                                    | Sync tools from declarative config                                    |
+| `ixt tool apply --locked --strict`                   | Sync using exact versions and assets from ixt.lock                    |
 | `ixt tool export`                             | Export installed tools as ixt.toml (stdout), preserves install intent |
+| `ixt lock write`                              | Resolve ixt.toml and write ixt.lock                                   |
+| `ixt lock check`                              | Fail if ixt.lock is missing or stale                                  |
+| `ixt lock diff`                               | Show semantic differences between ixt.toml and ixt.lock               |
 | `ixt asset-index export`                       | Export portable binary-resolution metadata as JSON                    |
 | `ixt tool config <pkg> expose <rules...>`           | Change exposed binaries                                               |
 | `ixt tool config <pkg> inject <dep>`                | Inject a package into the tool's env                                  |
@@ -210,7 +215,8 @@ ixt tool install ruff>=0.5.0                # PEP 508 (Python)
 ```
 $IXT_HOME/                # default ~/.local/share/ixt (respects $XDG_DATA_HOME)
 ├── config/
-│   ├── ixt.toml
+│   ├── ixt.toml          # global declarative manifest fallback
+│   ├── ixt.lock          # global lock when using the global ixt.toml
 │   ├── registry.toml
 │   └── heuristics.toml
 └── installed/
@@ -234,12 +240,12 @@ $IXT_CACHE_HOME/          # default ~/.cache/ixt (respects $XDG_CACHE_HOME)
 |                          | uv tool | pipx | npm -g | aqua | mise      | proto | **ixt** |
 | ------------------------ | ------- | ---- | ------ | ---- | --------- | ----- | ------- |
 | Python tools (PyPI)      | ✅      | ✅   | —      | —    | ✅ (pipx) | —     | ✅      |
-| Node tools (npm)         | —       | —    | ✅     | —    | ✅ (npm)  | —     | ✅      |
+| npm packages             | —       | —    | ✅     | —    | ✅ (npm)  | —     | ✅      |
 | GitHub Releases binaries | —       | —    | —      | ✅   | ✅ (ubi)  | ~     | ✅      |
+| Day-one GitHub releases  | —       | —    | —      | ❌   | ❌        | ~     | ✅      |
 | Dependency isolation     | ✅      | ✅   | ❌     | —    | partial   | —     | ✅      |
 | Fine-grained exposure    | —       | —    | —      | —    | —         | —     | ✅      |
-| Runtime policy (env+fs)  | —       | —    | —      | —    | —         | —     | ✅      |
-| Bootstrap from scratch   | —       | —    | —      | —    | curl      | curl  | ✅      |
+| No system runtime needed | —       | —    | ❌     | ❌   | ❌        | ❌    | ✅      |
 | Declarative config       | —       | —    | —      | YAML | TOML      | TOML  | TOML    |
 
 ixt is **not** a runtime version manager (mise, proto, asdf cover that). It manages the **last mile**: install, isolate, expose and group CLI tools across three ecosystems.
@@ -257,10 +263,10 @@ uv run ruff format src/ tests/ # format
 
 ## 🤝 Contributing
 
-Development happens on **GitLab**: <https://gitlab.com/pytgaen-group/ixt>. The GitHub repository (if present) is a **read-only mirror** — please open issues and merge requests on GitLab.
+Development happens on **GitLab**: <https://gitlab.com/pytgaen-group/ixt>. Any GitHub repository for this project is a **read-only mirror** of GitLab; it is not the review or issue tracker. Please open issues and merge requests on GitLab.
 
 Bug reports and reproduction recipes are welcome. See [`CONTRIBUTING.md`](CONTRIBUTING.md) for details, or open an issue to start a discussion.
 
 ## 📄 License
 
-MIT
+MIT. See [`LICENSE`](LICENSE).

{ixt_cli-0.8.0 → ixt_cli-0.9.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ixt-cli"
-version = "0.8.0" # to bump
+version = "0.9.0" # to bump
 description = "Universal CLI tool isolator - manage Python, Node, and binary tools with per-tool isolation"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -37,10 +37,6 @@ dev = [
     "pytest-cov>=4.1",
     "pyright>=1.1",
 ]
-# Standalone binary build (Nuitka). Not a runtime dependency — install with
-# `uv sync --group build`. [onefile] pulls zstandard for payload compression.
-# See notes/standalone-build.md.
-build = ["nuitka[onefile]>=2.5"]
 
 [project.scripts]
 ixt = "ixt.cli:main"
@@ -49,7 +45,7 @@ ixt = "ixt.cli:main"
 Homepage = "https://gitlab.com/pytgaen-group/ixt"
 Repository = "https://gitlab.com/pytgaen-group/ixt.git"
 Issues = "https://gitlab.com/pytgaen-group/ixt/-/issues"
-Documentation = "https://gitlab.com/pytgaen-group/ixt#readme"
+Documentation = "https://ixt-39f604.gitlab.io"
 
 [tool.hatch.build.targets.wheel]
 packages = ["src/ixt"]

{ixt_cli-0.8.0 → ixt_cli-0.9.0}/src/ixt/backends/binary.py

@@ -23,6 +23,7 @@ from ixt.config.heuristics import (
 )
 
 if TYPE_CHECKING:
+    from ixt.config.lockfile import BinaryLockMetadata
     from ixt.config.setup_toml import SetupConfig
 from ixt.config.settings import Settings, get_settings
 from ixt.core.backend import BackendType
@@ -30,10 +31,12 @@ from ixt.core.discover import find_executables
 from ixt.core.extract import extract, is_archive
 from ixt.libs.logger import get_logger, get_verbosity
 from ixt.net.source import Asset, Release, ReleaseSource, RepoSpec, parse_spec
+from ixt.platform import get_arch, get_os
 
 __all__ = [
     "AssetSelectionError",
     "BinaryBackend",
+    "BinaryPlatformError",
     "BinarySpecError",
     "HookEntry",
     "SetupMetadata",
@@ -89,6 +92,31 @@ class AssetSelectionError(RuntimeError):
         )
 
 
+class BinaryPlatformError(RuntimeError):
+    """Raised when extracted executables are incompatible with the current platform."""
+
+    def __init__(
+        self,
+        spec: str,
+        release_tag: str,
+        asset_name: str,
+        rejected: list[tuple[Path, str]],
+    ):
+        self.spec = spec
+        self.release_tag = release_tag
+        self.asset_name = asset_name
+        self.rejected = rejected
+        platform = f"{get_os().value}/{get_arch().value}"
+        details = ", ".join(
+            f"{path.name} ({format_label})"
+            for path, format_label in sorted(rejected, key=lambda item: str(item[0]))
+        )
+        super().__init__(
+            f"No executable compatible with {platform} found for '{spec}' "
+            f"(release {release_tag}, asset {asset_name}). Rejected: {details}"
+        )
+
+
 class BinarySpecError(ValueError):
     """Raised when a spec cannot be parsed as a binary backend spec."""
 
@@ -396,6 +424,7 @@ class BinaryBackend:
         setup_path: Path | None = None,
         asset_pattern: str | None = None,
         known_tag: str | None = None,
+        locked_binary: BinaryLockMetadata | None = None,
         use_cache: bool = True,
     ) -> dict | None:
         """Compatibility adapter for the shared backend protocol."""
@@ -410,6 +439,7 @@ class BinaryBackend:
             setup_path=setup_path,
             asset_pattern=asset_pattern,
             known_tag=known_tag,
+            locked_binary=locked_binary,
             use_cache=use_cache,
         )
 
@@ -422,6 +452,7 @@ class BinaryBackend:
         setup_path: Path | None = None,
         asset_pattern: str | None = None,
         known_tag: str | None = None,
+        locked_binary: BinaryLockMetadata | None = None,
         use_cache: bool = True,
     ) -> dict | None:
         """Resolve, download, extract, and discover one atomic binary tool.
@@ -460,24 +491,34 @@ class BinaryBackend:
         )
         release_pattern_name = setup.name if setup and setup.name else None
 
-        # Reuse the release already fetched during version resolution (e.g. an
-        # upgrade or a dry-run within the TTL window). This skips a second API
-        # call — the only option for GitLab, whose asset URLs can't be rebuilt
-        # from a pattern like GitHub's.
-        release = self._cached_release(spec) if use_cache and not repo_spec.version else None
-        if release is not None:
-            log.debug(f"release (resolve cache): {release.tag} ({len(release.assets)} assets)")
-        else:
-            release = self._fetch_release(
-                source,
-                repo_spec,
-                env_dir=env_dir,
-                upgrade=upgrade,
-                known_tag=known_tag,
-                asset_pattern=release_pattern,
-                pattern_name=release_pattern_name,
+        if locked_binary is not None:
+            if not repo_spec.version:
+                raise BinarySpecError("locked binary install requires a pinned release tag")
+            release = Release(
+                tag=repo_spec.version,
+                assets=[Asset(name=locked_binary.asset, url=locked_binary.url)],
+                resolution_source="lockfile",
             )
-            log.debug(f"release: {release.tag} ({len(release.assets)} assets)")
+            log.debug(f"release (lockfile): {release.tag} ({locked_binary.asset})")
+        else:
+            # Reuse the release already fetched during version resolution (e.g. an
+            # upgrade or a dry-run within the TTL window). This skips a second API
+            # call — the only option for GitLab, whose asset URLs can't be rebuilt
+            # from a pattern like GitHub's.
+            release = self._cached_release(spec) if use_cache and not repo_spec.version else None
+            if release is not None:
+                log.debug(f"release (resolve cache): {release.tag} ({len(release.assets)} assets)")
+            else:
+                release = self._fetch_release(
+                    source,
+                    repo_spec,
+                    env_dir=env_dir,
+                    upgrade=upgrade,
+                    known_tag=known_tag,
+                    asset_pattern=release_pattern,
+                    pattern_name=release_pattern_name,
+                )
+                log.debug(f"release: {release.tag} ({len(release.assets)} assets)")
 
         if setup is None and not setup_resolved:
             setup = self._resolve_setup(
@@ -491,7 +532,10 @@ class BinaryBackend:
         if asset_pattern:
             log.debug(f"user-forced asset_pattern: {asset_pattern!r}")
         selection_pattern = _selection_pattern(effective_pattern, release.tag)
-        asset = self._select_asset(release, selection_pattern, tool_name, spec)
+        if locked_binary is None:
+            asset = self._select_asset(release, selection_pattern, tool_name, spec)
+        else:
+            asset = release.assets[0]
         log.debug(f"selected asset: {asset.name}")
 
         archive_path = self._download_asset(
@@ -512,8 +556,16 @@ class BinaryBackend:
         log.debug(f"extracted to: {result.root}")
 
         heuristics = load_heuristics()
-        executables = find_executables(result.root, expose=heuristics.expose, log=log)
+        rejected_executables: list[tuple[Path, str]] = []
+        executables = find_executables(
+            result.root,
+            expose=heuristics.expose,
+            log=log,
+            rejected=rejected_executables,
+        )
         log.debug(f"executables: {[e.name for e in executables]}")
+        if not executables and rejected_executables:
+            raise BinaryPlatformError(spec, release.tag, asset.name, rejected_executables)
 
         binaries = {exe.name: str(exe) for exe in executables}