specsmith 0.13.1.dev536__tar.gz → 0.14.0.dev538__tar.gz

{specsmith-0.13.1.dev536/src/specsmith.egg-info → specsmith-0.14.0.dev538}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specsmith
-Version: 0.13.1.dev536
+Version: 0.14.0.dev538
 Summary: AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider.
 Author: Layer1Labs Silicon, Inc.
 License-Expression: MIT
@@ -93,7 +93,7 @@ specsmith treats belief systems like code: codable, testable, and deployable. It
 epistemically-governed projects, stress-tests requirements as BeliefArtifacts, runs
 cryptographically-sealed trace vaults, and orchestrates AI agents under formal AEE governance.
 
-**v0.13.0 — 16 new project types (LLM apps, MCP servers, Kubernetes operators, game dev, Web3, desktop, JVM and more), 131 built-in skills across 16 domains, EU AI Act / NIST AI RMF compliance, native Warp/Oz MCP governance server, multi-agent DAG dispatch, and context window management.**
+**v0.14.0 — two-tier ESDB (free SQLite built-in + commercial ChronoStore via `specsmith[esdb]`), ESDB license gate, full ESDB CLI group, 10 CodeQL security fixes, chronomemory v0.1.6 support, and comprehensive ESDB documentation.**
 specsmith ships a full compliance and auditability layer aligned to the EU AI Act (2024/1689)
 and the NIST AI Risk Management Framework 1.0. Every agent action is cryptographically sealed,
 every AI-generated output is disclosed, context windows are GPU-aware and protected against
@@ -226,7 +226,7 @@ If you hold a chronomemory ESDB license, activate the commercial backend:
 # Step 1 — install the chronomemory package
 pip install "specsmith[esdb]"                 # installs chronomemory from PyPI
 # or if using pipx:
-pipx inject specsmith "chronomemory>=0.1.4"  # inject into the specsmith pipx venv
+pipx inject specsmith "chronomemory>=0.1.6"  # inject into the specsmith pipx venv
 
 # Step 2 — activate your license key
 specsmith esdb enable --key-file /path/to/your.esdb.key

{specsmith-0.13.1.dev536 → specsmith-0.14.0.dev538}/README.md

@@ -15,7 +15,7 @@ specsmith treats belief systems like code: codable, testable, and deployable. It
 epistemically-governed projects, stress-tests requirements as BeliefArtifacts, runs
 cryptographically-sealed trace vaults, and orchestrates AI agents under formal AEE governance.
 
-**v0.13.0 — 16 new project types (LLM apps, MCP servers, Kubernetes operators, game dev, Web3, desktop, JVM and more), 131 built-in skills across 16 domains, EU AI Act / NIST AI RMF compliance, native Warp/Oz MCP governance server, multi-agent DAG dispatch, and context window management.**
+**v0.14.0 — two-tier ESDB (free SQLite built-in + commercial ChronoStore via `specsmith[esdb]`), ESDB license gate, full ESDB CLI group, 10 CodeQL security fixes, chronomemory v0.1.6 support, and comprehensive ESDB documentation.**
 specsmith ships a full compliance and auditability layer aligned to the EU AI Act (2024/1689)
 and the NIST AI Risk Management Framework 1.0. Every agent action is cryptographically sealed,
 every AI-generated output is disclosed, context windows are GPU-aware and protected against
@@ -148,7 +148,7 @@ If you hold a chronomemory ESDB license, activate the commercial backend:
 # Step 1 — install the chronomemory package
 pip install "specsmith[esdb]"                 # installs chronomemory from PyPI
 # or if using pipx:
-pipx inject specsmith "chronomemory>=0.1.4"  # inject into the specsmith pipx venv
+pipx inject specsmith "chronomemory>=0.1.6"  # inject into the specsmith pipx venv
 
 # Step 2 — activate your license key
 specsmith esdb enable --key-file /path/to/your.esdb.key

{specsmith-0.13.1.dev536 → specsmith-0.14.0.dev538}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "specsmith"
-version = "0.13.1.dev536"
+version = "0.14.0.dev538"
 description = "AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider."
 readme = "README.md"
 license = "MIT"

{specsmith-0.13.1.dev536 → specsmith-0.14.0.dev538}/src/specsmith/__init__.py

@@ -8,4 +8,4 @@ from importlib.metadata import version as _pkg_version
 try:
     __version__: str = _pkg_version("specsmith")
 except PackageNotFoundError:  # running from source without install
-    __version__ = "0.13.1"  # fallback: keep in sync with pyproject.toml
+    __version__ = "0.14.0"  # fallback: keep in sync with pyproject.toml

{specsmith-0.13.1.dev536 → specsmith-0.14.0.dev538}/src/specsmith/governance_logic.py

@@ -72,15 +72,21 @@ def run_preflight(
     from specsmith.agent.broker import Intent, classify_intent, infer_scope
 
     _safe_resolve(project_dir)  # validate: reject null bytes and traversal sequences
-    root = Path(os.path.realpath(str(project_dir)))  # CodeQL-visible sanitiser (py/path-injection)
+    # Assign os.path.realpath to a plain str first so CodeQL's py/path-injection
+    # taint tracker sees the sanitiser directly on the assignment (not nested
+    # inside Path()). Path() wrapping is done in a separate step.
+    _root_str: str = os.path.realpath(str(project_dir))
+    root = Path(_root_str)
     intent = classify_intent(utterance)
     # Requirements live at docs/REQUIREMENTS.md, not at the project root.
     # Falling back to root/REQUIREMENTS.md would always yield an empty list
     # on standard projects, causing preflight to always return
     # needs_clarification (GitHub issue #197).
-    _req_md = root / "docs" / "REQUIREMENTS.md"
+    # Apply os.path.realpath on the child path so CodeQL sees the sanitiser
+    # at the point of the file-system call (.exists()), not just at root.
+    _req_md = Path(os.path.realpath(str(root / "docs" / "REQUIREMENTS.md")))
     if not _req_md.exists():
-        _req_md = root / "REQUIREMENTS.md"  # legacy fallback
+        _req_md = Path(os.path.realpath(str(root / "REQUIREMENTS.md")))  # legacy fallback
     scope = infer_scope(
         utterance,
         _req_md,
@@ -103,7 +109,7 @@ def run_preflight(
     # (Helper functions with a root: Path parameter are analysed conservatively
     # by CodeQL and can re-introduce py/path-injection alerts.)
     rq_records: list[Any] = []
-    rq_path = (root / ".specsmith" / "requirements.json").resolve()
+    rq_path = Path(os.path.realpath(str(root / ".specsmith" / "requirements.json")))
     if rq_path.is_file():
         try:
             _rq = _json.loads(rq_path.read_text(encoding="utf-8"))
@@ -120,7 +126,7 @@ def run_preflight(
     # Read test-case machine-state inline (same rationale as above).
     test_case_ids: list[str] = []
     tc_records: list[Any] = []
-    tc_path = (root / ".specsmith" / "testcases.json").resolve()
+    tc_path = Path(os.path.realpath(str(root / ".specsmith" / "testcases.json")))
     if tc_path.is_file():
         try:
             _tc = _json.loads(tc_path.read_text(encoding="utf-8"))

{specsmith-0.13.1.dev536 → specsmith-0.14.0.dev538/src/specsmith.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specsmith
-Version: 0.13.1.dev536
+Version: 0.14.0.dev538
 Summary: AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider.
 Author: Layer1Labs Silicon, Inc.
 License-Expression: MIT
@@ -93,7 +93,7 @@ specsmith treats belief systems like code: codable, testable, and deployable. It
 epistemically-governed projects, stress-tests requirements as BeliefArtifacts, runs
 cryptographically-sealed trace vaults, and orchestrates AI agents under formal AEE governance.
 
-**v0.13.0 — 16 new project types (LLM apps, MCP servers, Kubernetes operators, game dev, Web3, desktop, JVM and more), 131 built-in skills across 16 domains, EU AI Act / NIST AI RMF compliance, native Warp/Oz MCP governance server, multi-agent DAG dispatch, and context window management.**
+**v0.14.0 — two-tier ESDB (free SQLite built-in + commercial ChronoStore via `specsmith[esdb]`), ESDB license gate, full ESDB CLI group, 10 CodeQL security fixes, chronomemory v0.1.6 support, and comprehensive ESDB documentation.**
 specsmith ships a full compliance and auditability layer aligned to the EU AI Act (2024/1689)
 and the NIST AI Risk Management Framework 1.0. Every agent action is cryptographically sealed,
 every AI-generated output is disclosed, context windows are GPU-aware and protected against
@@ -226,7 +226,7 @@ If you hold a chronomemory ESDB license, activate the commercial backend:
 # Step 1 — install the chronomemory package
 pip install "specsmith[esdb]"                 # installs chronomemory from PyPI
 # or if using pipx:
-pipx inject specsmith "chronomemory>=0.1.4"  # inject into the specsmith pipx venv
+pipx inject specsmith "chronomemory>=0.1.6"  # inject into the specsmith pipx venv
 
 # Step 2 — activate your license key
 specsmith esdb enable --key-file /path/to/your.esdb.key