specsmith 0.14.0.dev537__tar.gz → 0.14.0.dev539__tar.gz

{specsmith-0.14.0.dev537/src/specsmith.egg-info → specsmith-0.14.0.dev539}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specsmith
-Version: 0.14.0.dev537
+Version: 0.14.0.dev539
 Summary: AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider.
 Author: Layer1Labs Silicon, Inc.
 License-Expression: MIT
@@ -188,9 +188,10 @@ of file/command criteria, recommended commands, and a readiness percentage.
 
 ```bash
 pipx install specsmith                    # core CLI + epistemic library
-pipx inject specsmith anthropic           # + Claude support
-pipx inject specsmith openai              # + GPT / O-series support
-pipx inject specsmith google-generativeai # + Gemini support
+pipx inject specsmith anthropic    # + Claude support
+pipx inject specsmith openai       # + GPT / O-series support
+pipx inject specsmith google-genai # + Gemini (google-genai SDK, GA May 2025)
+# Ollama: install locally at https://ollama.ai — no extra package needed
 ```
 
 **Library-only use (venv / conda / any Python environment):**

{specsmith-0.14.0.dev537 → specsmith-0.14.0.dev539}/README.md

@@ -110,9 +110,10 @@ of file/command criteria, recommended commands, and a readiness percentage.
 
 ```bash
 pipx install specsmith                    # core CLI + epistemic library
-pipx inject specsmith anthropic           # + Claude support
-pipx inject specsmith openai              # + GPT / O-series support
-pipx inject specsmith google-generativeai # + Gemini support
+pipx inject specsmith anthropic    # + Claude support
+pipx inject specsmith openai       # + GPT / O-series support
+pipx inject specsmith google-genai # + Gemini (google-genai SDK, GA May 2025)
+# Ollama: install locally at https://ollama.ai — no extra package needed
 ```
 
 **Library-only use (venv / conda / any Python environment):**

{specsmith-0.14.0.dev537 → specsmith-0.14.0.dev539}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "specsmith"
-version = "0.14.0.dev537"
+version = "0.14.0.dev539"
 description = "AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider."
 readme = "README.md"
 license = "MIT"

{specsmith-0.14.0.dev537 → specsmith-0.14.0.dev539}/src/specsmith/governance_logic.py

@@ -72,15 +72,21 @@ def run_preflight(
     from specsmith.agent.broker import Intent, classify_intent, infer_scope
 
     _safe_resolve(project_dir)  # validate: reject null bytes and traversal sequences
-    root = Path(os.path.realpath(str(project_dir)))  # CodeQL-visible sanitiser (py/path-injection)
+    # Assign os.path.realpath to a plain str first so CodeQL's py/path-injection
+    # taint tracker sees the sanitiser directly on the assignment (not nested
+    # inside Path()). Path() wrapping is done in a separate step.
+    _root_str: str = os.path.realpath(str(project_dir))
+    root = Path(_root_str)
     intent = classify_intent(utterance)
     # Requirements live at docs/REQUIREMENTS.md, not at the project root.
     # Falling back to root/REQUIREMENTS.md would always yield an empty list
     # on standard projects, causing preflight to always return
     # needs_clarification (GitHub issue #197).
-    _req_md = root / "docs" / "REQUIREMENTS.md"
+    # Apply os.path.realpath on the child path so CodeQL sees the sanitiser
+    # at the point of the file-system call (.exists()), not just at root.
+    _req_md = Path(os.path.realpath(str(root / "docs" / "REQUIREMENTS.md")))
     if not _req_md.exists():
-        _req_md = root / "REQUIREMENTS.md"  # legacy fallback
+        _req_md = Path(os.path.realpath(str(root / "REQUIREMENTS.md")))  # legacy fallback
     scope = infer_scope(
         utterance,
         _req_md,
@@ -103,7 +109,7 @@ def run_preflight(
     # (Helper functions with a root: Path parameter are analysed conservatively
     # by CodeQL and can re-introduce py/path-injection alerts.)
     rq_records: list[Any] = []
-    rq_path = (root / ".specsmith" / "requirements.json").resolve()
+    rq_path = Path(os.path.realpath(str(root / ".specsmith" / "requirements.json")))
     if rq_path.is_file():
         try:
             _rq = _json.loads(rq_path.read_text(encoding="utf-8"))
@@ -120,7 +126,7 @@ def run_preflight(
     # Read test-case machine-state inline (same rationale as above).
     test_case_ids: list[str] = []
     tc_records: list[Any] = []
-    tc_path = (root / ".specsmith" / "testcases.json").resolve()
+    tc_path = Path(os.path.realpath(str(root / ".specsmith" / "testcases.json")))
     if tc_path.is_file():
         try:
             _tc = _json.loads(tc_path.read_text(encoding="utf-8"))

{specsmith-0.14.0.dev537 → specsmith-0.14.0.dev539/src/specsmith.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specsmith
-Version: 0.14.0.dev537
+Version: 0.14.0.dev539
 Summary: AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider.
 Author: Layer1Labs Silicon, Inc.
 License-Expression: MIT
@@ -188,9 +188,10 @@ of file/command criteria, recommended commands, and a readiness percentage.
 
 ```bash
 pipx install specsmith                    # core CLI + epistemic library
-pipx inject specsmith anthropic           # + Claude support
-pipx inject specsmith openai              # + GPT / O-series support
-pipx inject specsmith google-generativeai # + Gemini support
+pipx inject specsmith anthropic    # + Claude support
+pipx inject specsmith openai       # + GPT / O-series support
+pipx inject specsmith google-genai # + Gemini (google-genai SDK, GA May 2025)
+# Ollama: install locally at https://ollama.ai — no extra package needed
 ```
 
 **Library-only use (venv / conda / any Python environment):**