ixt-cli 0.9.0__tar.gz → 0.9.1__tar.gz

{ixt_cli-0.9.0 → ixt_cli-0.9.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ixt-cli
-Version: 0.9.0
+Version: 0.9.1
 Summary: Universal CLI tool isolator - manage Python, Node, and binary tools with per-tool isolation
 Project-URL: Homepage, https://gitlab.com/pytgaen-group/ixt
 Project-URL: Repository, https://gitlab.com/pytgaen-group/ixt.git
@@ -51,10 +51,10 @@ Description-Content-Type: text/markdown
 *Zero third-party deps. Zero system pollution. One command, any ecosystem.*
 
 - **Day-one GitHub releases** — install a tool the day it ships, without
-  waiting for a formula, registry entry, or plugin.
+    waiting for a formula, registry entry, or plugin.
 - **No system runtime needed** — ixt is pure Python stdlib; `uv` and `bun` are
-  bootstrapped on first use, so the host does not need Node, npm, or a package
-  manager pre-installed.
+    bootstrapped on first use, so the host does not need Node, npm, or a package
+    manager pre-installed.
 
 ```bash
 ixt tool install ruff                      # Python (PyPI)
@@ -202,40 +202,43 @@ ixt tool apply --locked --strict
 
 `--locked` replays the exact lock instead of resolving newer versions.
 `--strict` fails before changing the machine if `ixt.toml` and `ixt.lock`
-diverge.
+diverge. The strict preflight is local: it checks the manifest fingerprint,
+declared policy, version constraints, and locked binary metadata without
+contacting PyPI, npm, GitHub, or GitLab. Run `ixt lock write` when you want to
+resolve upstream again and refresh the lock.
 
 ## 🧰 Commands
 
 | Command                                        | Description                                                           |
 | ---------------------------------------------- | --------------------------------------------------------------------- |
-| `ixt tool add <pkg>`                                | Add a tool to ixt.toml without installing                             |
-| `ixt tool install <pkg>`                            | Install a tool in isolation                                           |
-| `ixt tool install <pkg> --bare`                     | Install the env without exposing any binary                           |
-| `ixt tool uninstall <pkg>`                          | Remove a tool                                                         |
-| `ixt tool list`                                     | List installed tools                                                  |
-| `ixt tool info <pkg>`                               | Show tool details                                                     |
-| `ixt tool upgrade <pkg>`                            | Upgrade a tool                                                        |
-| `ixt tool upgrade --all`                            | Upgrade all tools                                                     |
-| `ixt tool apply`                                    | Sync tools from declarative config                                    |
-| `ixt tool apply --locked --strict`                   | Sync using exact versions and assets from ixt.lock                    |
-| `ixt tool export`                             | Export installed tools as ixt.toml (stdout), preserves install intent |
-| `ixt lock write`                              | Resolve ixt.toml and write ixt.lock                                   |
-| `ixt lock check`                              | Fail if ixt.lock is missing or stale                                  |
-| `ixt lock diff`                               | Show semantic differences between ixt.toml and ixt.lock               |
+| `ixt tool add <pkg>`                           | Add a tool to ixt.toml without installing                             |
+| `ixt tool install <pkg>`                       | Install a tool in isolation                                           |
+| `ixt tool install <pkg> --bare`                | Install the env without exposing any binary                           |
+| `ixt tool uninstall <pkg>`                     | Remove a tool                                                         |
+| `ixt tool list`                                | List installed tools                                                  |
+| `ixt tool info <pkg>`                          | Show tool details                                                     |
+| `ixt tool upgrade <pkg>`                       | Upgrade a tool                                                        |
+| `ixt tool upgrade --all`                       | Upgrade all tools                                                     |
+| `ixt tool apply`                               | Sync tools from declarative config                                    |
+| `ixt tool apply --locked --strict`             | Sync using exact versions and assets from ixt.lock                    |
+| `ixt tool export`                              | Export installed tools as ixt.toml (stdout), preserves install intent |
+| `ixt lock write`                               | Resolve ixt.toml and write ixt.lock                                   |
+| `ixt lock check`                               | Validate ixt.lock against ixt.toml locally                             |
+| `ixt lock diff`                                | Show semantic differences between ixt.toml and ixt.lock               |
 | `ixt asset-index export`                       | Export portable binary-resolution metadata as JSON                    |
-| `ixt tool config <pkg> expose <rules...>`           | Change exposed binaries                                               |
-| `ixt tool config <pkg> inject <dep>`                | Inject a package into the tool's env                                  |
-| `ixt tool config <pkg> uninject <dep>`              | Remove an injected package                                            |
-| `ixt tool config __all__ expose <rules...>`         | Re-expose every installed tool                                        |
-| `ixt tool shell <pkg>`                              | Open a subshell in tool's env                                         |
-| `ixt tool where <pkg>`                              | Print the tool env path                                               |
+| `ixt tool config <pkg> expose <rules...>`      | Change exposed binaries                                               |
+| `ixt tool config <pkg> inject <dep>`           | Inject a package into the tool's env                                  |
+| `ixt tool config <pkg> uninject <dep>`         | Remove an injected package                                            |
+| `ixt tool config __all__ expose <rules...>`    | Re-expose every installed tool                                        |
+| `ixt tool shell <pkg>`                         | Open a subshell in tool's env                                         |
+| `ixt tool where <pkg>`                         | Print the tool env path                                               |
 | `ixt environment [--sizes]`                    | Show ixt configuration, paths, and optional storage sizes             |
 | `ixt doctor`                                   | Check ixt health (runtimes, PATH, caches)                             |
 | `ixt cache info`                               | Show cache paths and sizes                                            |
 | `ixt cache prune`                              | Keep current + previous indexed download artifacts per repository     |
 | `ixt cache clear {downloads,metadata,tmp,all}` | Wipe cache(s); never touches installed tools                          |
-| `ixt runtime info`                            | Show ixt-managed runtime state                                        |
-| `ixt runtime prune [--all]`                   | Remove unused or all ixt-managed runtimes                             |
+| `ixt runtime info`                             | Show ixt-managed runtime state                                        |
+| `ixt runtime prune [--all]`                    | Remove unused or all ixt-managed runtimes                             |
 | `ixt setup path`                               | Add `$IXT_HOME/installed/bin` to PATH                                 |
 | `ixt setup completions --shell zsh`            | Print shell completion code for ixt                                   |
 
@@ -285,7 +288,7 @@ ixt is **not** a runtime version manager (mise, proto, asdf cover that). It mana
 git clone https://gitlab.com/pytgaen-group/ixt.git && cd ixt
 uv sync --group dev
 
-uv run pytest                 # test suite
+uv run pytest                 # hermetic unit suite
 uv run ruff check src/ tests/ # lint
 uv run ruff format src/ tests/ # format
 ```

{ixt_cli-0.9.0 → ixt_cli-0.9.1}/README.md

@@ -22,10 +22,10 @@
 *Zero third-party deps. Zero system pollution. One command, any ecosystem.*
 
 - **Day-one GitHub releases** — install a tool the day it ships, without
-  waiting for a formula, registry entry, or plugin.
+    waiting for a formula, registry entry, or plugin.
 - **No system runtime needed** — ixt is pure Python stdlib; `uv` and `bun` are
-  bootstrapped on first use, so the host does not need Node, npm, or a package
-  manager pre-installed.
+    bootstrapped on first use, so the host does not need Node, npm, or a package
+    manager pre-installed.
 
 ```bash
 ixt tool install ruff                      # Python (PyPI)
@@ -173,40 +173,43 @@ ixt tool apply --locked --strict
 
 `--locked` replays the exact lock instead of resolving newer versions.
 `--strict` fails before changing the machine if `ixt.toml` and `ixt.lock`
-diverge.
+diverge. The strict preflight is local: it checks the manifest fingerprint,
+declared policy, version constraints, and locked binary metadata without
+contacting PyPI, npm, GitHub, or GitLab. Run `ixt lock write` when you want to
+resolve upstream again and refresh the lock.
 
 ## 🧰 Commands
 
 | Command                                        | Description                                                           |
 | ---------------------------------------------- | --------------------------------------------------------------------- |
-| `ixt tool add <pkg>`                                | Add a tool to ixt.toml without installing                             |
-| `ixt tool install <pkg>`                            | Install a tool in isolation                                           |
-| `ixt tool install <pkg> --bare`                     | Install the env without exposing any binary                           |
-| `ixt tool uninstall <pkg>`                          | Remove a tool                                                         |
-| `ixt tool list`                                     | List installed tools                                                  |
-| `ixt tool info <pkg>`                               | Show tool details                                                     |
-| `ixt tool upgrade <pkg>`                            | Upgrade a tool                                                        |
-| `ixt tool upgrade --all`                            | Upgrade all tools                                                     |
-| `ixt tool apply`                                    | Sync tools from declarative config                                    |
-| `ixt tool apply --locked --strict`                   | Sync using exact versions and assets from ixt.lock                    |
-| `ixt tool export`                             | Export installed tools as ixt.toml (stdout), preserves install intent |
-| `ixt lock write`                              | Resolve ixt.toml and write ixt.lock                                   |
-| `ixt lock check`                              | Fail if ixt.lock is missing or stale                                  |
-| `ixt lock diff`                               | Show semantic differences between ixt.toml and ixt.lock               |
+| `ixt tool add <pkg>`                           | Add a tool to ixt.toml without installing                             |
+| `ixt tool install <pkg>`                       | Install a tool in isolation                                           |
+| `ixt tool install <pkg> --bare`                | Install the env without exposing any binary                           |
+| `ixt tool uninstall <pkg>`                     | Remove a tool                                                         |
+| `ixt tool list`                                | List installed tools                                                  |
+| `ixt tool info <pkg>`                          | Show tool details                                                     |
+| `ixt tool upgrade <pkg>`                       | Upgrade a tool                                                        |
+| `ixt tool upgrade --all`                       | Upgrade all tools                                                     |
+| `ixt tool apply`                               | Sync tools from declarative config                                    |
+| `ixt tool apply --locked --strict`             | Sync using exact versions and assets from ixt.lock                    |
+| `ixt tool export`                              | Export installed tools as ixt.toml (stdout), preserves install intent |
+| `ixt lock write`                               | Resolve ixt.toml and write ixt.lock                                   |
+| `ixt lock check`                               | Validate ixt.lock against ixt.toml locally                             |
+| `ixt lock diff`                                | Show semantic differences between ixt.toml and ixt.lock               |
 | `ixt asset-index export`                       | Export portable binary-resolution metadata as JSON                    |
-| `ixt tool config <pkg> expose <rules...>`           | Change exposed binaries                                               |
-| `ixt tool config <pkg> inject <dep>`                | Inject a package into the tool's env                                  |
-| `ixt tool config <pkg> uninject <dep>`              | Remove an injected package                                            |
-| `ixt tool config __all__ expose <rules...>`         | Re-expose every installed tool                                        |
-| `ixt tool shell <pkg>`                              | Open a subshell in tool's env                                         |
-| `ixt tool where <pkg>`                              | Print the tool env path                                               |
+| `ixt tool config <pkg> expose <rules...>`      | Change exposed binaries                                               |
+| `ixt tool config <pkg> inject <dep>`           | Inject a package into the tool's env                                  |
+| `ixt tool config <pkg> uninject <dep>`         | Remove an injected package                                            |
+| `ixt tool config __all__ expose <rules...>`    | Re-expose every installed tool                                        |
+| `ixt tool shell <pkg>`                         | Open a subshell in tool's env                                         |
+| `ixt tool where <pkg>`                         | Print the tool env path                                               |
 | `ixt environment [--sizes]`                    | Show ixt configuration, paths, and optional storage sizes             |
 | `ixt doctor`                                   | Check ixt health (runtimes, PATH, caches)                             |
 | `ixt cache info`                               | Show cache paths and sizes                                            |
 | `ixt cache prune`                              | Keep current + previous indexed download artifacts per repository     |
 | `ixt cache clear {downloads,metadata,tmp,all}` | Wipe cache(s); never touches installed tools                          |
-| `ixt runtime info`                            | Show ixt-managed runtime state                                        |
-| `ixt runtime prune [--all]`                   | Remove unused or all ixt-managed runtimes                             |
+| `ixt runtime info`                             | Show ixt-managed runtime state                                        |
+| `ixt runtime prune [--all]`                    | Remove unused or all ixt-managed runtimes                             |
 | `ixt setup path`                               | Add `$IXT_HOME/installed/bin` to PATH                                 |
 | `ixt setup completions --shell zsh`            | Print shell completion code for ixt                                   |
 
@@ -256,7 +259,7 @@ ixt is **not** a runtime version manager (mise, proto, asdf cover that). It mana
 git clone https://gitlab.com/pytgaen-group/ixt.git && cd ixt
 uv sync --group dev
 
-uv run pytest                 # test suite
+uv run pytest                 # hermetic unit suite
 uv run ruff check src/ tests/ # lint
 uv run ruff format src/ tests/ # format
 ```

{ixt_cli-0.9.0 → ixt_cli-0.9.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ixt-cli"
-version = "0.9.0" # to bump
+version = "0.9.1" # to bump
 description = "Universal CLI tool isolator - manage Python, Node, and binary tools with per-tool isolation"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -61,14 +61,15 @@ include = [
 # Testing
 [tool.pytest.ini_options]
 minversion = "7.0"
-testpaths = ["tests"]
+testpaths = ["tests/unit"]
 python_files = ["test_*.py"]
 python_classes = ["Test*"]
 python_functions = ["test_*"]
-addopts = "-ra --strict-markers"
+addopts = '-ra --strict-markers -m "not slow and not network"'
 markers = [
     "unit: unit tests",
     "integration: integration tests",
+    "e2e: end-to-end tests against an installed ixt CLI",
     "platform: platform-specific tests (linux, macos, windows)",
     "slow: tests that bootstrap external runtimes (uv, bun) — skip by default with -m 'not slow'",
     "network: tests that hit the public internet (e.g. real GitHub releases) — opt in with -m 'network'",

{ixt_cli-0.9.0 → ixt_cli-0.9.1}/src/ixt/backends/binary.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import hashlib
 import json
 import re
 from dataclasses import dataclass, field
@@ -18,6 +19,7 @@ from ixt.config.flags import is_setup_toml_enabled
 from ixt.config.heuristics import (
     get_name_suffix_tokens,
     get_platform_aliases,
+    is_asset_arch_compatible,
     load_heuristics,
     select_asset,
 )
@@ -30,6 +32,7 @@ from ixt.core.backend import BackendType
 from ixt.core.discover import find_executables
 from ixt.core.extract import extract, is_archive
 from ixt.libs.logger import get_logger, get_verbosity
+from ixt.net.http import MAX_DOWNLOAD_SIZE, DownloadTooLargeError
 from ixt.net.source import Asset, Release, ReleaseSource, RepoSpec, parse_spec
 from ixt.platform import get_arch, get_os
 
@@ -45,6 +48,9 @@ __all__ = [
     "make_source",
 ]
 
+BINARY_ASSET_CACHE_SCHEMA = 2
+_CACHE_ARCHIVE_SUFFIXES = (".tar.bz2", ".tar.gz", ".tar.xz", ".tgz", ".txz", ".zip")
+
 
 # 3.10 lacks typing.NotRequired (added in 3.11) and the project bans
 # third-party deps (typing_extensions). The required-base + total=False
@@ -267,10 +273,51 @@ def _cache_dir_for(settings: Settings, repo_spec: RepoSpec) -> Path:
     return settings.cache_dir / host / f"{repo_spec.owner}-{repo_spec.repo}"
 
 
-def _cached_asset(cache_dir: Path, asset_name: str) -> Path | None:
-    """Return the cached asset path if it exists."""
-    path = cache_dir / asset_name
-    if path.exists() and path.stat().st_size > 0:
+def _asset_cache_key(repo_spec: RepoSpec, asset: Asset, *, tag: str) -> str:
+    """Return the stable cache identity for one exact release asset."""
+    identity = json.dumps(
+        {
+            "schema": BINARY_ASSET_CACHE_SCHEMA,
+            "platform": repo_spec.platform,
+            "host": repo_spec.host,
+            "owner": repo_spec.owner,
+            "repo": repo_spec.repo,
+            "tag": tag,
+            "asset": asset.name,
+            "url": asset.url,
+        },
+        sort_keys=True,
+        separators=(",", ":"),
+    )
+    return hashlib.sha256(identity.encode()).hexdigest()
+
+
+def _asset_cache_path(
+    downloads_dir: Path,
+    repo_spec: RepoSpec,
+    asset: Asset,
+    *,
+    tag: str,
+) -> Path:
+    """Return a portable path for one exact release asset."""
+    lower_name = asset.name.lower()
+    suffix = next((item for item in _CACHE_ARCHIVE_SUFFIXES if lower_name.endswith(item)), "")
+    if not suffix:
+        match = re.search(r"\.[A-Za-z0-9]{1,10}$", asset.name)
+        suffix = match.group(0) if match is not None else ""
+    key = _asset_cache_key(repo_spec, asset, tag=tag)
+    return downloads_dir / f"assets-v{BINARY_ASSET_CACHE_SCHEMA}" / key / f"asset{suffix}"
+
+
+def _cached_asset(path: Path, expected_size: int = 0) -> Path | None:
+    """Return *path* when it is a non-empty cache entry of the expected size."""
+    try:
+        if not path.is_file():
+            return None
+        size = path.stat().st_size
+    except OSError:
+        return None
+    if 0 < size <= MAX_DOWNLOAD_SIZE and (expected_size <= 0 or size == expected_size):
         return path
     return None
 
@@ -536,6 +583,12 @@ class BinaryBackend:
             asset = self._select_asset(release, selection_pattern, tool_name, spec)
         else:
             asset = release.assets[0]
+            if not is_asset_arch_compatible(
+                asset.name,
+                heuristics=load_heuristics(),
+                declared_platform=locked_binary.platform,
+            ):
+                raise AssetSelectionError(spec, release.tag, [asset.name])
         log.debug(f"selected asset: {asset.name}")
 
         archive_path = self._download_asset(
@@ -950,15 +1003,28 @@ class BinaryBackend:
         upgrade: bool = False,
     ) -> Path:
         """Download an asset, using cache when available."""
-        cached = _cached_asset(cache_dir, asset.name)
+        if asset.size > MAX_DOWNLOAD_SIZE:
+            raise DownloadTooLargeError(asset.url, MAX_DOWNLOAD_SIZE, asset.size)
+
+        cache_key = _asset_cache_key(repo_spec, asset, tag=tag)
+        dest = _asset_cache_path(self.settings.downloads_dir, repo_spec, asset, tag=tag)
+        cached = _cached_asset(dest, asset.size)
         if cached is not None and not upgrade:
-            self._record_download(repo_spec, asset, cached, tag=tag)
+            self._record_download(repo_spec, asset, cached, tag=tag, cache_key=cache_key)
             return cached
 
-        cache_dir.mkdir(parents=True, exist_ok=True)
-        dest = cache_dir / asset.name
+        dest.parent.mkdir(parents=True, exist_ok=True)
+        dest.unlink(missing_ok=True)
         source.download_asset(asset.url, dest)
-        self._record_download(repo_spec, asset, dest, tag=tag)
+        if dest.is_file() and dest.stat().st_size > MAX_DOWNLOAD_SIZE:
+            actual_size = dest.stat().st_size
+            dest.unlink(missing_ok=True)
+            raise DownloadTooLargeError(asset.url, MAX_DOWNLOAD_SIZE, actual_size)
+        if _cached_asset(dest, asset.size) is None:
+            dest.unlink(missing_ok=True)
+            expected = f"{asset.size} bytes" if asset.size > 0 else "a non-empty file"
+            raise RuntimeError(f"Downloaded asset {asset.name!r} does not match {expected}")
+        self._record_download(repo_spec, asset, dest, tag=tag, cache_key=cache_key)
         return dest
 
     def _record_download(
@@ -968,6 +1034,7 @@ class BinaryBackend:
         path: Path,
         *,
         tag: str,
+        cache_key: str,
     ) -> None:
         """Index the downloaded binary asset for later cache pruning."""
         from ixt.core.cache import record_download
@@ -984,4 +1051,5 @@ class BinaryBackend:
             asset_url=asset.url,
             asset_size=asset.size,
             path=path,
+            cache_key=cache_key,
         )

{ixt_cli-0.9.0 → ixt_cli-0.9.1}/src/ixt/backends/node.py

@@ -114,8 +114,7 @@ def _write_metadata(
         "package_name": package_name,
         "version": version,
         "binaries": {
-            name: _encode_path_under_env(path, env_dir)
-            for name, path in binaries.items()
+            name: _encode_path_under_env(path, env_dir) for name, path in binaries.items()
         },
         "used_npm_fallback": used_npm_fallback,
         "runtime": runtime,
@@ -136,8 +135,7 @@ def read_metadata(env_dir: Path) -> dict | None:
     binaries = data.get("binaries")
     if isinstance(binaries, dict):
         data["binaries"] = {
-            name: _decode_path_from_env(path, env_dir)
-            for name, path in binaries.items()
+            name: _decode_path_from_env(path, env_dir) for name, path in binaries.items()
         }
     return data
 

{ixt_cli-0.9.0 → ixt_cli-0.9.1}/src/ixt/cli/cmd_config.py

@@ -18,6 +18,7 @@ _ALL_TOOLS_SENTINEL = "__all__"
 def cmd_config(args: argparse.Namespace) -> int:
     """Dispatch ``ixt tool config <target> <action>`` to the right handler."""
     logger = get_logger("config")
+    settings = None
     if args.tool != _ALL_TOOLS_SENTINEL:
         from ixt.config.settings import get_settings
         from ixt.core.install import resolve_tool_name
@@ -28,7 +29,16 @@ def cmd_config(args: argparse.Namespace) -> int:
         except ValueError as e:
             logger.error(str(e))
             return 1
-    return _CONFIG_ACTIONS[args.config_action](args, logger)
+    try:
+        if settings is not None:
+            from ixt.core.locks import tool_lock
+
+            with tool_lock(args.tool, settings=settings):
+                return _CONFIG_ACTIONS[args.config_action](args, logger)
+        return _CONFIG_ACTIONS[args.config_action](args, logger)
+    except ValueError as e:
+        logger.error(str(e))
+        return 1
 
 
 def _cmd_config_expose(args: argparse.Namespace, logger) -> int:
@@ -126,28 +136,32 @@ def _cmd_config_env(args: argparse.Namespace, logger) -> int:
         return 0
 
     from ixt.config.env_policy import apply_policy
-
-    if action == "reset":
-        record.env_base = "all"
-        record.env_allow = []
-        record.env_deny = {}
-    elif action == "base":
-        record.env_base = args.value
-    elif action == "allow":
-        for pat in args.patterns:
-            if pat not in record.env_allow:
-                record.env_allow.append(pat)
-    elif action == "deny":
-        exceptions = getattr(args, "exceptions", [])
-        for pat in args.patterns:
-            existing = record.env_deny.get(pat, {})
-            existing_except = existing.get("except", [])
-            record.env_deny[pat] = {"except": sorted(set(existing_except) | set(exceptions))}
-
-    record.save_json(meta_file)
-
-    if record.exposed_bins:
-        apply_policy(record, settings.bin_dir)
+    from ixt.core.locks import bin_lock, tool_lock
+
+    with tool_lock(args.tool, settings=settings):
+        record = ToolRecord.load_json(meta_file)
+        if action == "reset":
+            record.env_base = "all"
+            record.env_allow = []
+            record.env_deny = {}
+        elif action == "base":
+            record.env_base = args.value
+        elif action == "allow":
+            for pat in args.patterns:
+                if pat not in record.env_allow:
+                    record.env_allow.append(pat)
+        elif action == "deny":
+            exceptions = getattr(args, "exceptions", [])
+            for pat in args.patterns:
+                existing = record.env_deny.get(pat, {})
+                existing_except = existing.get("except", [])
+                record.env_deny[pat] = {"except": sorted(set(existing_except) | set(exceptions))}
+
+        record.save_json(meta_file)
+
+        if record.exposed_bins:
+            with bin_lock(settings=settings):
+                apply_policy(record, settings.bin_dir)
 
     _warn_env_policy_without_bwrap(record, logger)
     _print_env_policy(record, logger)
@@ -232,34 +246,38 @@ def _cmd_config_fs(args: argparse.Namespace, logger) -> int:
         return 0
 
     from ixt.config.env_policy import apply_policy
-
-    if action in ("ro", "rw", "scratch"):
-        _auto_promote_fs_base(record, logger)
-
-    if action == "reset":
-        record.fs_base = "all"
-        record.fs_ro = []
-        record.fs_rw = []
-        record.fs_scratch = []
-    elif action == "base":
-        record.fs_base = args.value
-    elif action == "ro":
-        for p in args.paths:
-            if p not in record.fs_ro:
-                record.fs_ro.append(p)
-    elif action == "rw":
-        for p in args.paths:
-            if p not in record.fs_rw:
-                record.fs_rw.append(p)
-    elif action == "scratch":
-        for p in args.paths:
-            if p not in record.fs_scratch:
-                record.fs_scratch.append(p)
-
-    record.save_json(meta_file)
-
-    if record.exposed_bins:
-        apply_policy(record, settings.bin_dir)
+    from ixt.core.locks import bin_lock, tool_lock
+
+    with tool_lock(args.tool, settings=settings):
+        record = ToolRecord.load_json(meta_file)
+        if action in ("ro", "rw", "scratch"):
+            _auto_promote_fs_base(record, logger)
+
+        if action == "reset":
+            record.fs_base = "all"
+            record.fs_ro = []
+            record.fs_rw = []
+            record.fs_scratch = []
+        elif action == "base":
+            record.fs_base = args.value
+        elif action == "ro":
+            for p in args.paths:
+                if p not in record.fs_ro:
+                    record.fs_ro.append(p)
+        elif action == "rw":
+            for p in args.paths:
+                if p not in record.fs_rw:
+                    record.fs_rw.append(p)
+        elif action == "scratch":
+            for p in args.paths:
+                if p not in record.fs_scratch:
+                    record.fs_scratch.append(p)
+
+        record.save_json(meta_file)
+
+        if record.exposed_bins:
+            with bin_lock(settings=settings):
+                apply_policy(record, settings.bin_dir)
 
     _print_fs_policy(record, logger)
     return 0

{ixt_cli-0.9.0 → ixt_cli-0.9.1}/src/ixt/cli/cmd_install.py

@@ -238,14 +238,14 @@ def _resolve_runtime(choice: str | None) -> tuple[str | None, bool | None]:
 
 
 def _check_setup_file_gate(args: argparse.Namespace, logger) -> int | None:
-    """Guard: --setup-file is gated behind IXT_ENABLE_SETUP_TOML (A/B test v0.1.0)."""
+    """Guard the experimental author contract behind IXT_ENABLE_SETUP_TOML."""
     if not getattr(args, "setup", None):
         return None
     from ixt.config.flags import SETUP_TOML_ENV, is_setup_toml_enabled
 
     if is_setup_toml_enabled():
         return None
-    logger.error("ixt.setup.toml support is disabled in v0.1.0 (A/B test).")
+    logger.error("ixt.setup.toml support is disabled by default while experimental.")
     logger.error(f"  {dim(f'Set {SETUP_TOML_ENV}=1 to enable --setup-file and remote fetch.')}")
     return 1
 
@@ -497,6 +497,9 @@ def _cmd_uninstall_one(args: argparse.Namespace, logger, settings, *, dry_run: b
         logger.error(f"Tool '{args.target}' is not installed")
         logger.error(f"  {dim('Hint: run ixt tool list to see installed tools')}")
         return 1
+    except ValueError as exc:
+        logger.error(str(exc))
+        return 1
 
     logger.info(f"  {red('-')} {bold(display)}")
 

{ixt_cli-0.9.0 → ixt_cli-0.9.1}/src/ixt/cli/cmd_lock.py

@@ -51,7 +51,7 @@ def _cmd_lock_check() -> int:
         return _log_lock_check_error(exc)
 
     if result.ok:
-        logger.info(f"{result.path} is up to date")
+        logger.info(f"{result.path} matches ixt.toml")
         return 0
 
     logger.error(f"{result.path} is out of date")
@@ -69,7 +69,7 @@ def _cmd_lock_diff() -> int:
         return _log_lock_check_error(exc)
 
     if result.ok:
-        data("ixt.lock is up to date")
+        data("ixt.lock matches ixt.toml")
         return 0
 
     data("ixt.lock differs from ixt.toml:")

{ixt_cli-0.9.0 → ixt_cli-0.9.1}/src/ixt/config/asset_pattern_cache.py

@@ -19,11 +19,10 @@ fresh release API call.
 from __future__ import annotations
 
 import json
-import os
-import tempfile
 from pathlib import Path
 
 from ixt.config.settings import get_ixt_metadata_dir
+from ixt.libs.atomic import atomic_write_text
 
 CACHE_FILENAME = "asset_patterns.json"
 
@@ -52,16 +51,7 @@ def _load() -> dict[str, str]:
 
 def _atomic_write(data: dict[str, str]) -> None:
     path = _cache_path()
-    path.parent.mkdir(parents=True, exist_ok=True)
-    fd, tmp = tempfile.mkstemp(prefix=path.name + ".", suffix=".tmp", dir=str(path.parent))
-    try:
-        with os.fdopen(fd, "w", encoding="utf-8") as f:
-            json.dump(data, f, indent=2, sort_keys=True)
-            f.write("\n")
-        os.replace(tmp, path)
-    except Exception:
-        Path(tmp).unlink(missing_ok=True)
-        raise
+    atomic_write_text(path, json.dumps(data, indent=2, sort_keys=True) + "\n")
 
 
 def get(owner: str, repo: str) -> str | None:

{ixt_cli-0.9.0 → ixt_cli-0.9.1}/src/ixt/config/env_policy.py

@@ -8,6 +8,8 @@ import stat
 from pathlib import Path
 from typing import TYPE_CHECKING
 
+from ixt.core.pathlink import exposed_target_path
+
 if TYPE_CHECKING:
     from ixt.config.models import ToolRecord
 
@@ -322,8 +324,11 @@ def _needs_wrapper(record: ToolRecord) -> bool:
 def apply_policy(record: ToolRecord, bin_dir: Path) -> None:
     """Replace symlinks with wrappers (or back) for all exposed bins of *record*."""
     use_wrapper = _needs_wrapper(record)
-    for exposed_name, real_path in record.exposed_bins.items():
-        target = bin_dir / exposed_name
+    targets = [
+        (exposed_name, real_path, exposed_target_path(bin_dir, exposed_name))
+        for exposed_name, real_path in record.exposed_bins.items()
+    ]
+    for exposed_name, real_path, target in targets:
         if target.exists() or target.is_symlink():
             target.unlink()
         if use_wrapper: