mapify-cli 3.36.0__tar.gz → 3.38.0__tar.gz

{mapify_cli-3.36.0 → mapify_cli-3.38.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mapify-cli
-Version: 3.36.0
+Version: 3.38.0
 Summary: MAP Framework installer - Modular Agentic Planner for Claude Code
 Project-URL: Homepage, https://github.com/azalio/map-framework
 Project-URL: Repository, https://github.com/azalio/map-framework.git

{mapify_cli-3.36.0 → mapify_cli-3.38.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mapify-cli"
-version = "3.36.0"
+version = "3.38.0"
 description = "MAP Framework installer - Modular Agentic Planner for Claude Code"
 authors = [{ name = "MAP Framework Contributors" }]
 readme = "README.md"

{mapify_cli-3.36.0 → mapify_cli-3.38.0}/src/mapify_cli/__init__.py

@@ -23,7 +23,7 @@ Or install globally:
     mapify check
 """
 
-__version__ = "3.36.0"
+__version__ = "3.38.0"
 
 # MUST stay the first import: it turns "this interpreter is older than 3.11" into
 # a message that says so, instead of the ImportError raised by `from datetime

{mapify_cli-3.36.0 → mapify_cli-3.38.0}/src/mapify_cli/auto_update.py

@@ -12,6 +12,7 @@ import httpx
 
 from mapify_cli import create_ssl_context
 from mapify_cli.config import load_map_config
+from mapify_cli.install_manifest import read_manifest
 from mapify_cli.update_install import (
     InstallKind,
     PackageUpdateError,
@@ -175,10 +176,22 @@ def record_declined_major(
     declined = StableVersion.parse(declined_major)
     if current is None:
         raise ValueError("installed MAP version is not a stable version")
-    if declined is None or declined.major <= current.major:
+    if declined is None:
         raise ValueError(
             "declined major must be a stable version above the installed major"
         )
+    if declined.major <= current.major:
+        # Intent: a project a major behind the running CLI is offered the CLI's own
+        # major (#643); that exact offer may be declined too.
+        stale = _stale_project_providers(Path(project_path).resolve(), current)
+        if (
+            declined != current
+            or stale is None
+            or not _major_behind(stale[0], current)
+        ):
+            raise ValueError(
+                "declined major must be a stable version above the installed major"
+            )
 
     project = Path(project_path).resolve()
     with project_update_lock(project, timeout_s=LOCK_TIMEOUT_SECONDS):
@@ -443,6 +456,60 @@ def _metadata_unavailable_result(
     )
 
 
+def _stale_project_providers(
+    project_path: Path, current: StableVersion
+) -> tuple[StableVersion, tuple[str, ...]] | None:
+    """Return (installed version, providers) when project files predate the CLI.
+
+    Intent: PyPI-based discovery only asks whether a newer CLI exists, so a CLI
+    upgraded outside the updater (#643) left project files stale while the result
+    stayed ``current``. The lock's ``mapify_version`` is the project's installed
+    version; an older stable value is local proof a refresh is owed. A newer or
+    unreadable project version never downgrades.
+    """
+    manifest = read_manifest(project_path)
+    if manifest is None:
+        return None
+    installed = StableVersion.parse(manifest.mapify_version)
+    if installed is None or installed >= current:
+        return None
+    providers = installed_providers(project_path)
+    if not providers:
+        return None
+    return installed, providers
+
+
+def _major_behind(installed: StableVersion, current: StableVersion) -> bool:
+    return installed.major < current.major
+
+
+def _stale_project_state(
+    project_path: Path,
+    state: UpdateState,
+    current: StableVersion,
+    mode: UpdateMode,
+) -> UpdateState | None:
+    """Return a pending-refresh state when a stale project may refresh now.
+
+    Same-major staleness refreshes in both modes. A project a MAJOR behind
+    refreshes only in manual mode; automatic mode offers it through the existing
+    major-consent flow instead (see ``_check_locked``).
+    """
+    stale = _stale_project_providers(project_path, current)
+    if stale is None:
+        return None
+    installed, providers = stale
+    if mode is UpdateMode.AUTOMATIC and _major_behind(installed, current):
+        return None
+    return replace(
+        state,
+        last_installed_version=str(current),
+        pending_install_version=None,
+        pending_refresh=True,
+        pending_providers=providers,
+    )
+
+
 def _check_locked(
     project_path: Path,
     current_version: str,
@@ -489,6 +556,14 @@ def _check_locked(
                 write_update_state(project_path, cleared)
                 progress.state = cleared
 
+        if not progress.state.pending_refresh:
+            stale_state = _stale_project_state(
+                project_path, progress.state, current, mode
+            )
+            if stale_state is not None:
+                write_update_state(project_path, stale_state)
+                progress.state = stale_state
+
         if progress.state.pending_refresh:
             if mode is UpdateMode.AUTOMATIC and not refresh_retry_due(
                 progress.state,
@@ -567,6 +642,17 @@ def _check_locked(
                     refresh_complete=True,
                 )
             progress.recovered_refresh = True
+            if approved_major == str(current):
+                # Intent: approving the CLI's own major for a project a major
+                # behind is a refresh only; there is no newer package to install.
+                return UpdateResult(
+                    UpdateStatus.UPDATED,
+                    current_version,
+                    installed_version=progress.installed_version,
+                    refreshed_providers=progress.refreshed_providers,
+                    reload_current_skill=True,
+                    refresh_complete=True,
+                )
 
         if mode is UpdateMode.AUTOMATIC and not automatic_check_due(
             progress.state,
@@ -591,6 +677,38 @@ def _check_locked(
             )
             write_update_state(project_path, progress.state)
 
+        if mode is UpdateMode.AUTOMATIC:
+            stale = _stale_project_providers(project_path, current)
+            if (
+                stale is not None
+                and _major_behind(stale[0], current)
+                and progress.state.declined_major_version != str(current)
+            ):
+                # Intent: a project a major behind the running CLI is stale, not
+                # current (#643). Reuse the major-consent signal: approving
+                # refreshes the project (no package install), declining records
+                # the exact offer so it does not repeat.
+                with httpx.Client(verify=create_ssl_context()) as offer_client:
+                    offer = fetch_release_highlights(current, offer_client)
+                if offer is None:
+                    return _metadata_unavailable_result(
+                        mode,
+                        current_version,
+                        installed_version=progress.installed_version,
+                        refreshed_providers=progress.refreshed_providers,
+                        reload_current_skill=progress.reload_current_skill,
+                        refresh_complete=progress.refresh_complete,
+                    )
+                return UpdateResult(
+                    UpdateStatus.MAJOR_AVAILABLE,
+                    current_version,
+                    installed_version=progress.installed_version,
+                    major=offer,
+                    refreshed_providers=progress.refreshed_providers,
+                    reload_current_skill=progress.reload_current_skill,
+                    refresh_complete=progress.refresh_complete,
+                )
+
         with httpx.Client(verify=create_ssl_context()) as client:
             targets = fetch_version_targets(current, client)
             _validate_targets(targets, current)

{mapify_cli-3.36.0 → mapify_cli-3.38.0}/src/mapify_cli/delivery/file_copier.py

@@ -14,6 +14,7 @@ import secrets
 import shutil
 import stat
 import subprocess
+import sys
 import tempfile
 import time
 from collections.abc import Generator
@@ -1266,6 +1267,31 @@ def _has_gitignore_marker(lines: list[bytes], marker: str) -> bool:
     return any(line == encoded or line.startswith(encoded + b" ") for line in lines)
 
 
+def _negation_defeats_exclude_entry(negation: bytes, required: bytes) -> bool:
+    """Return whether a ``.gitignore`` negation really overrides an exclude entry.
+
+    Literal entries keep ``_negation_targets_path`` semantics.  For wildcard
+    entries (``**/__pycache__/``, ``.map/**/sessions/``) a negation counts only
+    when it names the entry's basename (``!src/__pycache__/``) or is scoped in a
+    MAP-owned root the runtime block covers (``!.map/scripts/**``).  A blanket
+    re-include under an unrelated directory (``!trivy/bdu-db/data/**``) only
+    re-includes that user subtree and must not push the whole runtime block
+    into the tracked ``.gitignore`` (#649).
+    """
+    if not _negation_targets_path(negation, required):
+        return False
+    base = required.rstrip(b"/")
+    if b"*" not in base:
+        return True
+    pattern = _canonical_gitignore_line(negation[1:]).strip(b"/")
+    return base.rsplit(b"/", 1)[-1] in pattern or pattern.split(b"/", 1)[0] in (
+        b".map",
+        b".claude",
+        b".codex",
+        b".agents",
+    )
+
+
 def _merge_runtime_exclude(
     exclude: Path,
     gitignore_lines: list[bytes],
@@ -1291,7 +1317,7 @@ def _merge_runtime_exclude(
     if not missing:
         return False
     if any(
-        line.startswith(b"!") and _negation_targets_path(line, path.encode())
+        line.startswith(b"!") and _negation_defeats_exclude_entry(line, path.encode())
         for path in missing
         for line in gitignore_lines
     ):
@@ -1355,6 +1381,13 @@ def _merge_project_gitignore_locked(
             if outcome is not None:
                 exclude_changed = outcome
                 missing_runtime_paths = []
+            else:
+                print(
+                    "[mapify: a .gitignore negation overrides info/exclude for "
+                    "a runtime path; writing the runtime block to the tracked "
+                    ".gitignore instead]",
+                    file=sys.stderr,
+                )
         if missing_runtime_paths:
             runtime_lines: list[bytes] = []
             marker = _UPDATE_RUNTIME_GITIGNORE_MARKER.encode()
@@ -1430,6 +1463,13 @@ def _merge_project_gitignore(
         if include_runtime and runtime_to_git_exclude
         else None
     )
+    if include_runtime and runtime_to_git_exclude and runtime_exclude is None:
+        print(
+            "[mapify: info/exclude is unavailable for this project (not a "
+            "repository root, or the repository query failed); writing the "
+            "runtime block to .gitignore]",
+            file=sys.stderr,
+        )
     with _project_gitignore_lock(project_root) as (directory_fd, project_original):
         return _merge_project_gitignore_locked(
             project_root,

{mapify_cli-3.36.0 → mapify_cli-3.38.0}/src/mapify_cli/templates/agents/review-reader.md

@@ -29,18 +29,33 @@ not prove a behavioral defect is pre-existing; require supporting context or mar
 attribution unknown. Request missing bundle content from the parent, never shell.
 
 When the prompt provides parent-served context, return its exact context_request
-JSON and consume context_chunk continuations in this same session. Follow
-next_offset through eof and check offsets, total size and hash metadata against the manifest before using it. Request
-permitted resources from the parent, never read context object paths directly.
+JSON and consume the parent's continuations in this same session. A context_file
+reply names one served file: Read exactly that `path` sequentially from the
+first line to the end (page with offset/limit; do not skip ranges), collect every
+proof fragment the file carries (line 2 states how many there are and how to
+recognise one; they are scattered through the body), then return ONLY a
+context_ack JSON echoing its session_id, context_id, resource_id and sha256 plus
+`nonce` set to all fragments concatenated in file order, or put that object as
+`ack` inside your next context_request. A context_file whose resource_id is `*required`
+holds every listed required resource in one file; one ack covers all of them. A context_chunk reply carries bytes: follow
+next_offset through eof and check offsets, total size and hash metadata against
+the manifest before using it. Read no other context store, object or ledger path;
+request permitted resources from the parent instead.
 These intermediate responses are not findings or final review envelopes.
 Wait for the parent's post-delivery finalization request before returning a final
 review. In structured final envelopes, echo its session_id and finalization_token
 in a context_receipt object.
+Order is fixed: ack, then finalization token, then final. Never return the final
+review before the parent sent its finalization request, and never skip the ack. A
+subagent's handback (the message you end your turn with) contains ONLY the JSON
+envelope the protocol asks for: no prose, no preamble, no code fence, so the parent
+can pipe it verbatim.
 Delivery is parent_acknowledged; it does not prove inspection or capability.
 After receiving needed evidence, return the role's envelope with an additional receipt object:
 `receipt={covered_files:[],skipped_files:[],denied_access:[],check_evidence:[check_id]}`.
 List only paths actually inspected in covered_files; report skipped scope and denied
-required access honestly. Reading claims are self_reported, not tool_witnessed.
+required access honestly. denied_access names only required review scope the parent
+refused to serve; an unread role rubric file is neither skipped nor denied scope. Reading claims are self_reported, not tool_witnessed.
 check_evidence contains only current runner-issued check IDs present in the prompt;
 never claim you ran tests, treat a proposed command as a result, or invent an ID.
 Keep findings even when collection is incomplete. Return output to the parent;

{mapify_cli-3.36.0 → mapify_cli-3.38.0}/src/mapify_cli/templates/codex/agents/review-reader.toml

@@ -27,6 +27,11 @@ These are intermediate responses, not findings or final review envelopes.
 Wait for the parent's post-delivery finalization request before returning a final
 review. In structured final envelopes, echo its session_id and finalization_token
 in a context_receipt object.
+Order is fixed: ack, then finalization token, then final. Never return the final
+review before the parent sent its finalization request, and never skip the ack. A
+subagent's handback (the message you end your turn with) contains ONLY the JSON
+envelope the protocol asks for: no prose, no preamble, no code fence, so the parent
+can pipe it verbatim.
 Delivery is parent_acknowledged; it does not prove inspection or capability.
 After receiving needed evidence, return the role envelope plus
 receipt={covered_files:[],skipped_files:[],denied_access:[],check_evidence:[check_id]}.

{mapify_cli-3.36.0 → mapify_cli-3.38.0}/src/mapify_cli/templates/codex/skills/map-release/SKILL.md

@@ -11,7 +11,7 @@ For `updated`, re-read this invoked skill's installed `SKILL.md`, skip its alrea
 
 # MAP Framework Release Workflow
 
-**CRITICAL INSTRUCTION:** This is an **automated sequential workflow with IRREVERSIBLE operations**. You MUST execute ALL validation gates and get explicit user confirmation before pushing tags.
+**CRITICAL INSTRUCTION:** This is an **automated sequential workflow with IRREVERSIBLE operations**. You MUST execute ALL validation gates; any failing gate aborts the release. Invoking this skill is the operator's authorization to publish the version Phase 2 computes — never ask the operator questions.
 
 **🚨 ABSOLUTELY FORBIDDEN 🚨**
 
@@ -20,7 +20,7 @@ You are **STRICTLY PROHIBITED** from:
 ❌ Skipping validation gates to save time — every gate exists for a reason
 ❌ Pushing tags without CI confirmation — tag push triggers release workflow immediately
 ❌ Assuming tests passed without checking — always verify CI status explicitly
-❌ Proceeding without user confirmation on IRREVERSIBLE steps — tag push cannot be undone easily
+❌ Pushing a tag when any gate or the Phase 4.1 re-verification did not pass in this run — tag push cannot be undone easily
 ❌ Creating releases without updating CHANGELOG.md — users need to know what changed
 ❌ Pushing tag without verifying `__version__` in `__init__.py` — CRITICAL: bump-version.sh has known bug
 ❌ Any variation of "I'll optimize the release process" — follow the workflow exactly
@@ -38,7 +38,7 @@ parallel_tool_policy: validation_gates_only
 
 - Use deeper reasoning for version selection, release safety, CI interpretation, and rollback decisions.
 - Parallelize only independent pre-release validation gates when their outputs do not depend on one another.
-- Keep version bumping, commits, tags, pushes, PyPI verification, and any irreversible or state-mutating operation sequential with the required user confirmation gates.
+- Keep version bumping, commits, tags, pushes, PyPI verification, and any irreversible or state-mutating operation sequential, each gated by the preceding verification block.
 
 ## Workflow Overview
 
@@ -47,7 +47,7 @@ This workflow orchestrates a complete package release through 7 sequential phase
 ```
 Phase 1: Pre-Release Validation (12 gates)
    ↓
-Phase 2: Version Determination (user decision)
+Phase 2: Version Determination (recommended bump, no prompt)
    ↓
 Phase 3: Execute Version Bump Script (updates code + git commit + tag)
    ↓
@@ -80,19 +80,18 @@ Execute all 12 gates. Read the full gate scripts in [release-reference.md § Pha
 
 ## Phase 2: Version Determination
 
-Read CHANGELOG.md `[Unreleased]` section to determine bump type (MAJOR/MINOR/PATCH/EXPLICIT).
-Get current version from `pyproject.toml`.
+Run the Phase 2 reference block with `RELEASE_REQUEST` set to the release argument
+(empty when none). It never asks: an explicit `X.Y.Z` or `patch`/`minor`/`major`
+argument wins, otherwise the recommended bump is chosen from `[Unreleased]`
+(an entry starting with `BREAKING` or a `### Removed`/`### Breaking` section → MAJOR,
+`### Added`/`### Changed` → MINOR, else PATCH) and a version that does not move forward aborts. Carry exactly the printed
+`BUMP_TYPE` and `NEW_VERSION` into Phase 3 and 4; each command runs in a fresh shell.
 
-Ask the user directly for PATCH / MINOR / MAJOR / EXPLICIT, and wait for their answer.
-
-For EXPLICIT, ask separately for the exact version. Carry only the user's approved
-`BUMP_TYPE` and exact `NEW_VERSION` into Phase 3; each command runs in a fresh shell.
-
-See [release-reference.md § Phase 2](release-reference.md#phase-2-version-determination) for the full question/option block.
+See [release-reference.md § Phase 2](release-reference.md#phase-2-version-determination).
 
 ## Phase 3: Execute Version Bump Script
 
-Show the exact approved version and bump type, then execute the Phase 3 reference
+Show the exact Phase 2 version and bump type, then execute the Phase 3 reference
 blocks with those values explicitly supplied in each invocation. Never rely on
 variables left by a previous shell. Verify the version-derived `vX.Y.Z` tag points
 to HEAD and both version fields match it using the Phase 3.3 reference block.
@@ -105,16 +104,13 @@ If `__version__` mismatches, follow the fix procedure in [release-reference.md
 
 Re-verify: on main branch, exact merge-base CI completed successfully with matching
 `headSha`, only the three allowed metadata files changed, version-derived tag
-points to HEAD and does not already exist on remote. Then request **explicit user
-confirmation** (YES / NO / REVIEW options).
-
-Ask the user directly and wait; only an unambiguous YES authorizes pushing.
+points to HEAD and does not already exist on remote. Then push without asking —
+invoking the release is the authorization. If the version, commit or tag changed
+since Phase 2, stop and re-run Phases 2–4.1 instead of pushing.
 
 Read [release-reference.md § Phase 4](release-reference.md#phase-4-push-commit-and-tag-irreversible)
-for the confirmation and push blocks. Recompute the tag in the push invocation;
-consent for an earlier version or commit does not authorize a changed release.
-
-If user aborts: stop workflow, exit gracefully. Tag remains local only.
+for the verification and push blocks. Recompute the tag in the push invocation and
+pass `NEW_VERSION` so a changed release aborts.
 
 ## Phase 5: CI/CD Monitoring
 
@@ -136,7 +132,7 @@ Print release statistics (version, tag, PyPI URL, GitHub Release URL, CI run). O
 
 - **NEVER skip validation gates** — all 12 gates must pass before Phase 4
 - **NEVER push tag without CI confirmation** — verify CI passed on main before Phase 4
-- **NEVER proceed without user confirmation on IRREVERSIBLE operations**
+- **NEVER push unless Phase 4.1 passed in this run for the Phase 2 version** — no operator prompt replaces a gate
 - **ALWAYS monitor CI/CD pipeline** — don't assume success
 - **ALWAYS verify PyPI availability** before declaring success
 
@@ -147,10 +143,10 @@ Print release statistics (version, tag, PyPI URL, GitHub Release URL, CI run). O
 | 1 | Pytest tests | ❌ NO |
 | 2 | Pyright + hook lint | ❌ NO |
 | 3 | Ruff lint | ❌ NO |
-| 4 | Mypy types | ⚠️ Review |
+| 4 | Mypy types | ❌ NO |
 | 5 | Package build | ❌ NO |
 | 6 | Twine check | ❌ NO |
-| 7 | Security audit | ⚠️ Review |
+| 7 | Security audit | ❌ NO (update the vulnerable pin first) |
 | 8 | Git branch | ❌ NO |
 | 9 | Git clean | ❌ NO |
 | 10 | Git sync | ❌ NO |
@@ -162,8 +158,8 @@ Begin now with the release request above. Read the relevant [release-reference.m
 ## Examples
 
 ```
-$map-release                            # full release workflow; bump type chosen at the confirmation gate
-$map-release patch                      # hint to the version-determination phase
+$map-release                            # full release; recommended bump chosen from [Unreleased]
+$map-release patch                      # force a bump type (patch|minor|major)
 ```
 
 ## Troubleshooting