spawnio 1.1.0__tar.gz → 1.1.1__tar.gz

{spawnio-1.1.0 → spawnio-1.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: spawnio
-Version: 1.1.0
+Version: 1.1.1
 Summary: Spawn a ready-to-use Python project in seconds
 License-File: LICENSE
 Requires-Python: >=3.12
@@ -145,7 +145,7 @@ Running `spawn` with no arguments shows the banner, the installed version, and t
 
 ```
 SPAWN — scaffold your next project
-v1.1.0
+v1.1.1
 
 Commands
   create    Scaffold a new project
@@ -793,10 +793,10 @@ spawn doctor --fix --license mit
 
 ```bash
 spawn version
-# → Spawn v1.1.0
+# → Spawn v1.1.1
 
 spawn --version
-# → Spawn v1.1.0
+# → Spawn v1.1.1
 ```
 
 ### `spawn inspect`
@@ -826,7 +826,7 @@ PROJECT OVERVIEW
 
 **Scope.** 25 languages by extension and manifest; React, Next.js, Vue, Nuxt, Angular, Svelte, Express, FastAPI, Flask, Django, Starlette, Pydantic and Laravel; dependencies from `pyproject.toml`, `requirements*.txt` and `package.json`; package managers (uv, poetry, pipenv, pip, npm, yarn, pnpm, bun); tooling (ruff, black, flake8, mypy, pyright, pytest, eslint, prettier, jest, vitest, pre-commit, git), CI, containers and databases. Full matrix: [supported technologies](docs/inspection/supported-technologies.md).
 
-**Limitations.** Detection is static and evidence-based: a finding means an indicator exists, not that the project builds or runs. Frameworks seen only in a dependency declaration are marked *inferred*; imports are matched by regex, so import-like text in comments or strings can false-positive. CI, container and pre-commit detection is presence-only. Databases are inferred from driver packages. Manifests such as `Pipfile`, `setup.py`, `Cargo.toml`, `go.mod`, `Gemfile` and `pom.xml` give no dependency findings. Directories named `build`, `dist`, `env`, `target`, `vendor` and the like are skipped at any depth.
+**Limitations.** Detection is static and evidence-based: a finding means an indicator exists, not that the project builds or runs. Frameworks seen only in a dependency declaration are marked *inferred*; Python imports are read from the AST, so strings and comments never match, while JS/TS imports are matched by regex and can false-positive on import-like text in comments or template literals. CI, container and pre-commit detection is presence-only. Databases are inferred from driver packages. Manifests such as `Pipfile`, `setup.py`, `Cargo.toml`, `go.mod`, `Gemfile` and `pom.xml` give no dependency findings. Directories named `build`, `dist`, `env`, `target`, `vendor` and the like are skipped at any depth.
 
 **Safety.** `spawn inspect` is read-only: it never runs repository code, installs anything, uses the network or writes to the repository, and it does not follow symbolic links. It exits 0 for complete and partial reports and 7 for an invalid path or failed inspection. See the [command reference](docs/commands.md#spawn-inspect).
 
@@ -861,6 +861,7 @@ All tests should pass. If they don't, please [open an issue](https://github.com/
 
 | Version | Highlight |
 |---|---|
+| **v1.1.1** | Framework detection fix: Python imports read from the AST, so framework code inside strings, docstrings and comments no longer produces findings |
 | **v1.1.0** | `spawn inspect`: static, read-only repository inspection (languages, frameworks, dependencies, package managers, tooling, layout) with human and `--json` output; `spawn --version` |
 | **v1.0.9** | Core hardening: documented exit-code contract (generation, toolchain and publish failures exit non-zero), `--no-uv` honored for templates (file-only extras still written), path-traversal protection for custom structures, `read_project_metadata` extension boundary |
 | **v1.0.8** | `spawn doctor --fix` (`--dry-run`, `--yes`, `--license`), `--license` flag and prompt on `create`, `CHANGELOG.md` generated for every project, `pre-commit` and `mypy` extras across all templates, Custom Structure Mypy option |

{spawnio-1.1.0 → spawnio-1.1.1}/README.md

@@ -134,7 +134,7 @@ Running `spawn` with no arguments shows the banner, the installed version, and t
 
 ```
 SPAWN — scaffold your next project
-v1.1.0
+v1.1.1
 
 Commands
   create    Scaffold a new project
@@ -782,10 +782,10 @@ spawn doctor --fix --license mit
 
 ```bash
 spawn version
-# → Spawn v1.1.0
+# → Spawn v1.1.1
 
 spawn --version
-# → Spawn v1.1.0
+# → Spawn v1.1.1
 ```
 
 ### `spawn inspect`
@@ -815,7 +815,7 @@ PROJECT OVERVIEW
 
 **Scope.** 25 languages by extension and manifest; React, Next.js, Vue, Nuxt, Angular, Svelte, Express, FastAPI, Flask, Django, Starlette, Pydantic and Laravel; dependencies from `pyproject.toml`, `requirements*.txt` and `package.json`; package managers (uv, poetry, pipenv, pip, npm, yarn, pnpm, bun); tooling (ruff, black, flake8, mypy, pyright, pytest, eslint, prettier, jest, vitest, pre-commit, git), CI, containers and databases. Full matrix: [supported technologies](docs/inspection/supported-technologies.md).
 
-**Limitations.** Detection is static and evidence-based: a finding means an indicator exists, not that the project builds or runs. Frameworks seen only in a dependency declaration are marked *inferred*; imports are matched by regex, so import-like text in comments or strings can false-positive. CI, container and pre-commit detection is presence-only. Databases are inferred from driver packages. Manifests such as `Pipfile`, `setup.py`, `Cargo.toml`, `go.mod`, `Gemfile` and `pom.xml` give no dependency findings. Directories named `build`, `dist`, `env`, `target`, `vendor` and the like are skipped at any depth.
+**Limitations.** Detection is static and evidence-based: a finding means an indicator exists, not that the project builds or runs. Frameworks seen only in a dependency declaration are marked *inferred*; Python imports are read from the AST, so strings and comments never match, while JS/TS imports are matched by regex and can false-positive on import-like text in comments or template literals. CI, container and pre-commit detection is presence-only. Databases are inferred from driver packages. Manifests such as `Pipfile`, `setup.py`, `Cargo.toml`, `go.mod`, `Gemfile` and `pom.xml` give no dependency findings. Directories named `build`, `dist`, `env`, `target`, `vendor` and the like are skipped at any depth.
 
 **Safety.** `spawn inspect` is read-only: it never runs repository code, installs anything, uses the network or writes to the repository, and it does not follow symbolic links. It exits 0 for complete and partial reports and 7 for an invalid path or failed inspection. See the [command reference](docs/commands.md#spawn-inspect).
 
@@ -850,6 +850,7 @@ All tests should pass. If they don't, please [open an issue](https://github.com/
 
 | Version | Highlight |
 |---|---|
+| **v1.1.1** | Framework detection fix: Python imports read from the AST, so framework code inside strings, docstrings and comments no longer produces findings |
 | **v1.1.0** | `spawn inspect`: static, read-only repository inspection (languages, frameworks, dependencies, package managers, tooling, layout) with human and `--json` output; `spawn --version` |
 | **v1.0.9** | Core hardening: documented exit-code contract (generation, toolchain and publish failures exit non-zero), `--no-uv` honored for templates (file-only extras still written), path-traversal protection for custom structures, `read_project_metadata` extension boundary |
 | **v1.0.8** | `spawn doctor --fix` (`--dry-run`, `--yes`, `--license`), `--license` flag and prompt on `create`, `CHANGELOG.md` generated for every project, `pre-commit` and `mypy` extras across all templates, Custom Structure Mypy option |

{spawnio-1.1.0 → spawnio-1.1.1}/docs/architecture.md

@@ -23,7 +23,7 @@ Entry point: `spawn.cli.app:main` (defined in `pyproject.toml` as `[project.scri
 
 ```
 src/spawn/
-├── __init__.py         # __version__ via importlib.metadata, fallback "1.1.0" (keep in sync with pyproject.toml)
+├── __init__.py         # __version__ via importlib.metadata, fallback "1.1.1" (keep in sync with pyproject.toml)
 ├── cli/
 │   ├── app.py          # Typer app: create, version (and --version), doctor, inspect commands
 │   ├── inspect_render.py # Rich rendering of an InspectionReport for `spawn inspect`

{spawnio-1.1.0 → spawnio-1.1.1}/docs/changelog.md

@@ -3,6 +3,26 @@
 All notable changes to Spawn are documented here.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## v1.1.1 — 2026
+
+### Fixed
+
+- **False-positive frameworks in `spawn inspect`** — Python framework detection (django, fastapi, flask, pydantic, starlette) now reads imports from the AST of `.py` files. Import-like text in string literals, docstrings and comments no longer produces findings; inspecting Spawn itself no longer reports django, fastapi or flask.
+- Python imports are only matched in `.py` files and JS/TS imports only in JS/TS files (previously every pattern ran on every source file).
+- Now detected: `from fastapi.responses import X`, `import os, flask`, and imports nested in functions or `try` blocks.
+- **Filesystem destination safety** — pre-existing symlinks and Windows junctions are rejected; rollback removes only directories created by the current generation run.
+- **Custom structure directories** — trailing-slash directory semantics are preserved across all supported structure formats.
+- **CLI and inspection hardening** — untrusted Rich error text is escaped, inspection regex work is bounded, and URL credentials are redacted from uv error output.
+- **Generated project quality** — Ruff and formatting issues are fixed across supported variants, the RAG fixture uses the response-aware OpenAI status exception, and generated Django CI uses Django's native test runner.
+
+### Changed
+
+- A `.py` file that cannot be parsed (syntax error, null bytes) produces a `framework.unparseable_source` warning and the report status becomes `partial`.
+
+### Known limitations
+
+- JavaScript/TypeScript framework imports are still regex-matched; import-like text in comments or template literals can false-positive, and multi-line or destructured imports are missed.
+
 ## v1.1.0 — 2026
 
 ### Added

{spawnio-1.1.0 → spawnio-1.1.1}/docs/commands.md

@@ -19,7 +19,7 @@ Running `spawn` with no arguments prints the ASCII banner, the installed version
 ```
 <ASCII SPAWN banner — "scaffold your next project">
 
-v1.1.0
+v1.1.1
 
 Commands
   create    Scaffold a new project
@@ -400,7 +400,7 @@ If `--claude-md` was passed (or `"claude_md": true` in the config file), a `CLAU
   "intent": "backend-api",
   "framework": "fastapi",
   "provider": null,
-  "spawn_version": "1.1.0",
+  "spawn_version": "1.1.1",
   "created_at": "2026-01-01T00:00:00+00:00",
   "generator": "blueprint",
   "git": true,
@@ -582,9 +582,9 @@ Prints the installed version. `spawn --version` prints the same line. No other a
 
 ```bash
 spawn version
-# Spawn v1.1.0
+# Spawn v1.1.1
 spawn --version
-# Spawn v1.1.0
+# Spawn v1.1.1
 ```
 
 ---

{spawnio-1.1.0 → spawnio-1.1.1}/docs/getting-started.md

@@ -49,14 +49,14 @@ After installation, `spawn` is available anywhere on your machine.
 
 ```bash
 spawn version
-# Spawn v1.1.0
+# Spawn v1.1.1
 ```
 
 Or just run `spawn` with no arguments to see the command overview:
 
 ```
 SPAWN — scaffold your next project
-v1.1.0
+v1.1.1
 
 Commands
   create    Scaffold a new project

{spawnio-1.1.0 → spawnio-1.1.1}/docs/inspection/supported-technologies.md

@@ -82,16 +82,19 @@ markers, dynamic metadata, lockfiles and build scripts are not resolved.
 `Gemfile`, `pom.xml` and `build.gradle*` are not parsed for frameworks, so
 Rails and JVM frameworks are not detected.
 
-Known false negatives: imports split across several lines
+Known false negatives (JS/TS): imports split across several lines
 (`import {
  a,
  b } from 'react'`), destructured `require()` calls
 (`const { Router } = require('express')`), and non-`import` forms such as
 dynamic `import()`.
 
-Known false positives: import-like text inside comments, string literals and
-template literals (for example code samples embedded in generator templates) is
-matched, because detection is regex-based and does not parse source.
+Python imports (`django`, `fastapi`, `flask`, `pydantic`, `starlette`) are read
+from the AST of `.py` files, so strings, docstrings and comments never match
+and relative imports are ignored. A `.py` file that cannot be parsed yields the
+`framework.unparseable_source` warning and the report status is `partial`.
+JS/TS imports are still regex-matched and can false-positive on import-like
+text in comments or template literals.
 
 `pydantic` and `starlette` are emitted as `framework` findings, like the others, so they can become `primary_framework` when they have the most evidence.
 
@@ -172,7 +175,7 @@ A tool config makes the tool `detected`. A tool declared as a dependency without
 
 - Directory exclusions match basenames at any depth, case-insensitively: `build`, `dist`, `env`, `venv`, `target`, `vendor`, `coverage`, `htmlcov`, `node_modules`, `__pycache__`, `.git` and similar are skipped wherever they occur, even when they hold real source.
 - `.git` is detected only because discovery lists it as skipped; an export without `.git` reports git as `inferred` at best.
-- Framework imports are regex-based: import-like text in comments or strings is a false positive (inspecting Spawn itself reports `django` because template sources contain it); multi-line and destructured imports are missed.
+- Python framework imports are read from the AST (no false positives from strings or comments; unparseable files are skipped with a warning). JS/TS framework imports are regex-based, so import-like text in comments or template literals is a false positive; multi-line and destructured JS/TS imports are missed.
 - A framework found only through a dependency declaration is `inferred`, and `summary.primary_framework` may be such an inferred framework. It is picked by evidence count, which reflects representation, not importance.
 - CI, container and pre-commit detection is presence-only: no YAML is parsed.
 - Databases are inferred from driver packages only; READMEs, `.env`, data files and compose images are not evidence.

{spawnio-1.1.0 → spawnio-1.1.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "spawnio"
-version = "1.1.0"
+version = "1.1.1"
 description = "Spawn a ready-to-use Python project in seconds"
 readme = "README.md"
 requires-python = ">=3.12"

{spawnio-1.1.0 → spawnio-1.1.1}/src/spawn/__init__.py

@@ -3,4 +3,4 @@ from importlib.metadata import PackageNotFoundError, version
 try:
     __version__ = version("spawnio")
 except PackageNotFoundError:
-    __version__ = "1.1.0"
+    __version__ = "1.1.1"

{spawnio-1.1.0 → spawnio-1.1.1}/src/spawn/cli/app.py

@@ -3,6 +3,7 @@ import sys
 from pathlib import Path
 
 import typer
+from rich.markup import escape
 from rich.prompt import Confirm, Prompt
 
 from spawn import __version__
@@ -288,10 +289,14 @@ def doctor(
 
         project_path = Path(path).resolve()
         if not project_path.exists():
-            console.print(f"[red]❌ Path does not exist: {project_path}[/red]")
+            console.print(
+                f"[red]❌ Path does not exist: {escape(str(project_path))}[/red]"
+            )
             raise typer.Exit(1)
         if not project_path.is_dir():
-            console.print(f"[red]❌ Path is not a directory: {project_path}[/red]")
+            console.print(
+                f"[red]❌ Path is not a directory: {escape(str(project_path))}[/red]"
+            )
             raise typer.Exit(1)
 
         from spawn.utils.doctor import ProjectHealthChecker, run_health_check

{spawnio-1.1.0 → spawnio-1.1.1}/src/spawn/cli/errors.py

@@ -2,6 +2,7 @@ import os
 from typing import NoReturn
 
 import typer
+from rich.markup import escape
 
 from spawn.core.exceptions import SpawnError
 from spawn.utils.console import console
@@ -11,7 +12,7 @@ UNEXPECTED_EXIT_CODE = 10
 
 def fail(e: SpawnError) -> NoReturn:
     """Print an expected error and exit with its category's exit code."""
-    console.print(f"[red]❌ {e}[/red]")
+    console.print(f"[red]❌ {escape(str(e))}[/red]")
     raise typer.Exit(e.exit_code)
 
 
@@ -24,6 +25,8 @@ def report_unexpected(e: BaseException) -> NoReturn:
         "no",
     ):
         raise e
-    console.print(f"[red]❌ Unexpected error ({type(e).__name__}): {e}[/red]")
+    console.print(
+        f"[red]❌ Unexpected error ({escape(type(e).__name__)}): {escape(str(e))}[/red]"
+    )
     console.print("[dim]Re-run with SPAWN_DEBUG=1 for a traceback.[/dim]")
     raise typer.Exit(UNEXPECTED_EXIT_CODE)

{spawnio-1.1.0 → spawnio-1.1.1}/src/spawn/generators/custom_structure.py

@@ -18,6 +18,7 @@ from spawn.core.exceptions import FilesystemError, StructureParseError
 from spawn.generators.destination import (
     assert_available,
     cleanup_created,
+    record_ownership,
     resolve_destination,
     safe_join,
 )
@@ -77,10 +78,16 @@ def _is_file_entry(name: str) -> bool:
     return segment.lower() in _KNOWN_EXTENSIONLESS_FILES
 
 
-def _strip_name(name: str) -> str:
-    """Remove trailing slash and inline comments."""
+def _strip_name(name: str) -> tuple[str, bool]:
+    """Remove trailing slash and inline comments.
+
+    Returns (stripped_name, had_trailing_slash).  The trailing-slash flag
+    should be forwarded to _build_entries so that explicit directory markers
+    are honoured even for names that look like files (e.g. ``config.d/``).
+    """
     name = re.sub(r"\s*#.*$", "", name).strip()
-    return name.rstrip("/")
+    had_slash = name.endswith("/")
+    return name.rstrip("/"), had_slash
 
 
 # ─── Format detection ─────────────────────────────────────────────────────
@@ -100,64 +107,67 @@ def detect_format(raw: str) -> str:
 # ─── Per-format depth extraction ──────────────────────────────────────────
 
 
-def _tree_depth_and_name(line: str) -> tuple[int, str] | None:
+def _tree_depth_and_name(line: str) -> tuple[int, str, bool] | None:
     stripped = line.rstrip()
     if not stripped:
         return None
 
     # Root line: no tree characters
     if not any(c in stripped for c in _TREE_CHARS):
-        name = _strip_name(stripped.lstrip())
+        name, had_slash = _strip_name(stripped.lstrip())
         if not name:
             return None
-        return (0, name)
+        return (0, name, had_slash)
 
     match = re.match(r"^([\s│]*)[├└]──\s*(.+)$", stripped)
     if not match:
         return None
-    prefix, name = match.group(1), match.group(2).rstrip()
-    name = _strip_name(name)
+    prefix, raw_name = match.group(1), match.group(2).rstrip()
+    name, had_slash = _strip_name(raw_name)
     if not name:
         return None
     depth = len(prefix) // 4 + 1
-    return (depth, name)
+    return (depth, name, had_slash)
 
 
-def _markdown_depth_and_name(line: str, indent_unit: int) -> tuple[int, str] | None:
+def _markdown_depth_and_name(
+    line: str, indent_unit: int
+) -> tuple[int, str, bool] | None:
     match = _MARKDOWN_LINE_RE.match(line)
     if not match:
         stripped = line.strip()
         if not stripped:
             return None
-        return (0, _strip_name(stripped))
+        name, had_slash = _strip_name(stripped)
+        return (0, name, had_slash)
     spaces = len(match.group(1))
-    name = _strip_name(line[match.end() :].strip())
+    name, had_slash = _strip_name(line[match.end() :].strip())
     if not name:
         return None
     depth = (spaces // indent_unit + 1) if indent_unit > 0 else 1
-    return (depth, name)
+    return (depth, name, had_slash)
 
 
 def _indented_depth_and_name(
     line: str, indent_unit: int | None
-) -> tuple[int, str, int | None]:
+) -> tuple[int, str, bool, int | None]:
     stripped = line.rstrip()
     if not stripped or not stripped.strip():
-        return (-1, "", indent_unit)
+        return (-1, "", False, indent_unit)
 
     leading = len(stripped) - len(stripped.lstrip())
-    name = _strip_name(stripped.strip())
+    name, had_slash = _strip_name(stripped.strip())
     if not name:
-        return (-1, "", indent_unit)
+        return (-1, "", False, indent_unit)
 
     if leading == 0:
-        return (0, name, indent_unit)
+        return (0, name, had_slash, indent_unit)
 
     if indent_unit is None:
         indent_unit = leading
 
     depth = leading // indent_unit
-    return (depth, name, indent_unit)
+    return (depth, name, had_slash, indent_unit)
 
 
 # ─── Main parser ──────────────────────────────────────────────────────────
@@ -187,7 +197,7 @@ def parse_structure(raw: str) -> list[ParsedEntry]:
     return _build_entries(depth_name_pairs)
 
 
-def _parse_tree_lines(lines: list[str]) -> list[tuple[int, str]]:
+def _parse_tree_lines(lines: list[str]) -> list[tuple[int, str, bool]]:
     result = []
     for line in lines:
         parsed = _tree_depth_and_name(line)
@@ -197,7 +207,7 @@ def _parse_tree_lines(lines: list[str]) -> list[tuple[int, str]]:
     return result
 
 
-def _parse_markdown_lines(lines: list[str]) -> list[tuple[int, str]]:
+def _parse_markdown_lines(lines: list[str]) -> list[tuple[int, str, bool]]:
     indent_unit = 2
     space_counts = []
     for line in lines:
@@ -218,14 +228,16 @@ def _parse_markdown_lines(lines: list[str]) -> list[tuple[int, str]]:
     return result
 
 
-def _parse_indented_lines(lines: list[str]) -> list[tuple[int, str]]:
+def _parse_indented_lines(lines: list[str]) -> list[tuple[int, str, bool]]:
     indent_unit: int | None = None
     result = []
     for line in lines:
-        depth, name, indent_unit = _indented_depth_and_name(line, indent_unit)
+        depth, name, had_slash, indent_unit = _indented_depth_and_name(
+            line, indent_unit
+        )
         if depth < 0 or not name:
             continue
-        result.append((depth, name))
+        result.append((depth, name, had_slash))
     return result
 
 
@@ -244,22 +256,22 @@ def _check_entry_safe(name: str, full_path: str) -> None:
 
 
 def _build_entries(
-    depth_name_pairs: list[tuple[int, str]],
+    depth_name_pairs: list[tuple[int, str, bool]],
 ) -> list[ParsedEntry]:
     if not depth_name_pairs:
         raise StructureParseError("No parseable entries found in input.")
 
     # Normalise so the shallowest entry is always at depth 0
-    min_depth = min(d for d, _ in depth_name_pairs)
+    min_depth = min(d for d, _, _ in depth_name_pairs)
     if min_depth != 0:
-        depth_name_pairs = [(d - min_depth, n) for d, n in depth_name_pairs]
+        depth_name_pairs = [(d - min_depth, n, s) for d, n, s in depth_name_pairs]
 
     entries: list[ParsedEntry] = []
     seen: set[str] = set()
     stack: list[str] = [""]
     prev_depth = -1
 
-    for depth, name in depth_name_pairs:
+    for depth, name, had_slash in depth_name_pairs:
         if depth > prev_depth + 1:
             raise StructureParseError(
                 f"Entry '{name}' is indented {depth} level(s) deep but the "
@@ -272,7 +284,8 @@ def _build_entries(
         full_path = f"{parent}/{name}".lstrip("/") if parent else name
         _check_entry_safe(name, full_path)
 
-        is_file = _is_file_entry(name)
+        # Explicit trailing slash always wins; fall back to heuristic rules.
+        is_file = False if had_slash else _is_file_entry(name)
 
         if full_path in seen:
             raise StructureParseError(
@@ -386,9 +399,12 @@ class CustomStructureGenerator:
         assert_available(project_path, f"Directory '{project_name}' already exists.")
 
         created = False
+        token = None
         try:
             project_path.mkdir()
             created = True
+            token = record_ownership(project_path)
+            self._last_ownership_token = token
 
             for entry in entries:
                 if entry.path == "pyproject.toml" and use_uv:
@@ -472,12 +488,12 @@ class CustomStructureGenerator:
 
         except OSError as e:
             if created:
-                cleanup_created(project_path)
+                cleanup_created(project_path, token=token)
             raise FilesystemError(str(e)) from e
 
         except BaseException:
             if created:
-                cleanup_created(project_path)
+                cleanup_created(project_path, token=token)
             raise
 
         return project_path

{spawnio-1.1.0 → spawnio-1.1.1}/src/spawn/generators/destination.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import os
 import re
 import shutil
+from dataclasses import dataclass
 from pathlib import Path
 
 from spawn.core.exceptions import FilesystemError, InvalidInputError
@@ -19,7 +20,9 @@ def resolve_destination(name: str, destination: Path | None = None) -> Path:
             f"Invalid project name '{name}': must be a single directory name."
         )
     base = Path.cwd() / name if destination is None else Path(destination)
-    return base.resolve()
+    if not base.name:
+        return base.resolve()
+    return base.parent.resolve() / base.name
 
 
 def assert_available(path: Path, message: str) -> None:
@@ -46,21 +49,57 @@ def safe_join(root: Path, relative: str) -> Path:
     return root / relative
 
 
-def cleanup_created(path: Path, root_guard: Path | None = None) -> None:
-    """Remove *path* only if it is a real directory that is safe to delete.
+@dataclass(frozen=True)
+class OwnershipToken:
+    path: Path
+    dev: int
+    ino: int
+
+
+def record_ownership(path: Path) -> OwnershipToken:
+    """Capture filesystem identity immediately after creating *path*."""
+    stat = os.lstat(path)
+    return OwnershipToken(path=path, dev=stat.st_dev, ino=stat.st_ino)
+
+
+def cleanup_created(
+    path: Path,
+    root_guard: Path | None = None,
+    token: OwnershipToken | None = None,
+) -> None:
+    """Remove *path* only if it is the exact real directory created by this run.
 
     Callers must only invoke this for directories created by the current run.
     """
-    if path.is_symlink() or not path.is_dir():
-        return
-    resolved = path.resolve()
-    cwd = Path.cwd().resolve()
-    if (
-        resolved == resolved.parent  # filesystem root
-        or resolved == Path.home().resolve()
-        or resolved == cwd
-        or resolved in cwd.parents
-        or (root_guard is not None and resolved == root_guard.resolve())
-    ):
+    try:
+        if os.path.islink(path) or path.is_symlink():
+            return
+        if getattr(path, "is_junction", lambda: False)():
+            return
+        if not path.is_dir():
+            return
+
+        stat = os.lstat(path)
+        if token is not None:
+            if stat.st_dev != token.dev or stat.st_ino != token.ino:
+                return
+
+        cwd = Path.cwd().resolve()
+        path_parent = path.parent.resolve()
+        path_cmp = path_parent / path.name
+        home = Path.home().resolve()
+        if (
+            path_cmp == path_parent  # filesystem root
+            or path_cmp == home
+            or path_cmp == cwd
+            or path_cmp in cwd.parents
+            or (
+                root_guard is not None
+                and path_cmp == (root_guard.parent.resolve() / root_guard.name)
+            )
+        ):
+            return
+
+        shutil.rmtree(path, ignore_errors=True)
+    except OSError:
         return
-    shutil.rmtree(resolved, ignore_errors=True)

{spawnio-1.1.0 → spawnio-1.1.1}/src/spawn/generators/pipeline.py

@@ -11,7 +11,8 @@ from spawn.generators.project_generator import ProjectGenerator
 def generate_project(config: ProjectConfig) -> Path:
     """Single entry point: generate a project (custom or template) from config."""
     if config.template == "custom":
-        project_path = CustomStructureGenerator().generate(
+        generator = CustomStructureGenerator()
+        project_path = generator.generate(
             project_name=config.name,
             entries=config.custom_entries or [],
             use_git=config.use_git,
@@ -25,7 +26,9 @@ def generate_project(config: ProjectConfig) -> Path:
         try:
             write_project_meta(project_path, config, generator="custom")
         except OSError as e:
-            cleanup_created(project_path)
+            cleanup_created(
+                project_path, token=getattr(generator, "_last_ownership_token", None)
+            )
             raise FilesystemError(str(e)) from e
         return project_path
 

{spawnio-1.1.0 → spawnio-1.1.1}/src/spawn/generators/project_generator.py

@@ -6,6 +6,7 @@ from spawn.core.registry import instantiate_template
 from spawn.generators.destination import (
     assert_available,
     cleanup_created,
+    record_ownership,
     resolve_destination,
 )
 from spawn.generators.metadata import write_project_meta
@@ -60,9 +61,11 @@ class ProjectGenerator:
         assert_available(project_path, f"Directory '{config.name}' already exists.")
 
         created = False
+        token = None
         try:
             project_path.mkdir()
             created = True
+            token = record_ownership(project_path)
 
             context = {"project_name": config.name}
             template.generate(project_path, context)
@@ -121,12 +124,12 @@ class ProjectGenerator:
 
         except OSError as e:
             if created:
-                cleanup_created(project_path)
+                cleanup_created(project_path, token=token)
             raise FilesystemError(str(e)) from e
 
         except BaseException:
             if created:
-                cleanup_created(project_path)
+                cleanup_created(project_path, token=token)
             raise
 
         return project_path

{spawnio-1.1.0 → spawnio-1.1.1}/src/spawn/inspection/dependencies.py

@@ -107,6 +107,8 @@ def _py_name(name: str) -> str:
 def _clean(spec: object) -> str | None:
     if not isinstance(spec, str) or not spec.strip():
         return None
+    # Sanitize before applying the detail cap so truncation cannot leave a
+    # credential-bearing URL's userinfo in the displayed prefix.
     return redact_url(spec.strip())[:_MAX_DETAIL]