specsmith 0.14.0.dev540__tar.gz → 0.14.0.dev543__tar.gz

{specsmith-0.14.0.dev540/src/specsmith.egg-info → specsmith-0.14.0.dev543}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specsmith
-Version: 0.14.0.dev540
+Version: 0.14.0.dev543
 Summary: AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider.
 Author: Layer1Labs Silicon, Inc.
 License-Expression: MIT
@@ -40,7 +40,7 @@ Requires-Dist: pre-commit>=3.0; extra == "dev"
 Requires-Dist: types-pyyaml>=6.0; extra == "dev"
 Requires-Dist: cryptography>=42.0; extra == "dev"
 Provides-Extra: esdb
-Requires-Dist: chronomemory>=0.1.6; extra == "esdb"
+Requires-Dist: chronomemory>=0.1.7; extra == "esdb"
 Requires-Dist: cryptography>=42.0; extra == "esdb"
 Provides-Extra: docs
 Requires-Dist: mkdocs>=1.6; extra == "docs"
@@ -239,7 +239,7 @@ If you hold a chronomemory ESDB license, activate the commercial backend:
 # Step 1 — install the chronomemory package
 pip install "specsmith[esdb]"                 # installs chronomemory from PyPI
 # or if using pipx:
-pipx inject specsmith "chronomemory>=0.1.6"  # inject into the specsmith pipx venv
+pipx inject specsmith "chronomemory>=0.1.7"  # inject into the specsmith pipx venv
 
 # Step 2 — activate your license key
 specsmith esdb enable --key-file /path/to/your.esdb.key

{specsmith-0.14.0.dev540 → specsmith-0.14.0.dev543}/README.md

@@ -161,7 +161,7 @@ If you hold a chronomemory ESDB license, activate the commercial backend:
 # Step 1 — install the chronomemory package
 pip install "specsmith[esdb]"                 # installs chronomemory from PyPI
 # or if using pipx:
-pipx inject specsmith "chronomemory>=0.1.6"  # inject into the specsmith pipx venv
+pipx inject specsmith "chronomemory>=0.1.7"  # inject into the specsmith pipx venv
 
 # Step 2 — activate your license key
 specsmith esdb enable --key-file /path/to/your.esdb.key

{specsmith-0.14.0.dev540 → specsmith-0.14.0.dev543}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "specsmith"
-version = "0.14.0.dev540"
+version = "0.14.0.dev543"
 description = "AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider."
 readme = "README.md"
 license = "MIT"
@@ -60,7 +60,7 @@ dev = [
 # Install: pip install specsmith[esdb]
 # Activate: specsmith esdb enable --key-file /path/to/your.esdb.key
 esdb = [
-    "chronomemory>=0.1.6",   # proprietary commercial — see chronomemory LICENSE
+    "chronomemory>=0.1.7",   # proprietary commercial — see chronomemory LICENSE
     "cryptography>=42.0",
 ]
 docs = [

{specsmith-0.14.0.dev540 → specsmith-0.14.0.dev543}/src/specsmith/governance_logic.py

@@ -72,30 +72,29 @@ def run_preflight(
     from specsmith.agent.broker import Intent, classify_intent, infer_scope
 
     _safe_resolve(project_dir)  # validate: reject null bytes and traversal sequences
-    # Assign os.path.realpath to a plain str first so CodeQL's py/path-injection
-    # taint tracker sees the sanitiser directly on the assignment (not nested
-    # inside Path()). Path() wrapping is done in a separate step.
+    # os.path.realpath breaks the taint chain and returns a clean plain str.
+    # ALL subsequent path construction uses os.path.join on _root_str — never
+    # the Path / operator on root — so CodeQL never re-acquires the taint from
+    # project_dir through a Path object.
     _root_str: str = os.path.realpath(str(project_dir))
-    root = Path(_root_str)
     intent = classify_intent(utterance)
     # Requirements live at docs/REQUIREMENTS.md, not at the project root.
     # Falling back to root/REQUIREMENTS.md would always yield an empty list
     # on standard projects, causing preflight to always return
     # needs_clarification (GitHub issue #197).
-    # Apply os.path.realpath on the child path so CodeQL sees the sanitiser
-    # at the point of the file-system call (.exists()), not just at root.
-    _req_md = Path(os.path.realpath(str(root / "docs" / "REQUIREMENTS.md")))
+    _req_md = Path(os.path.realpath(os.path.join(_root_str, "docs", "REQUIREMENTS.md")))
     if not _req_md.exists():
-        _req_md = Path(os.path.realpath(str(root / "REQUIREMENTS.md")))  # legacy fallback
+        _req_md = Path(os.path.realpath(os.path.join(_root_str, "REQUIREMENTS.md")))  # legacy
+    _repo_idx = Path(os.path.realpath(os.path.join(_root_str, ".repo-index", "files.json")))
     scope = infer_scope(
         utterance,
         _req_md,
-        repo_index_path=root / ".repo-index" / "files.json",
+        repo_index_path=_repo_idx,
     )
 
     requirement_ids = [r.req_id for r in scope.matched_requirements]
 
-    # ── Direct ID extraction (fix #166) ──────────────────────────────────────
+    # ── Direct ID extraction (fix #166) ───────────────────────────────────────────
     # If the utterance contains explicit REQ-*/TEST-* IDs, look them up in the
     # JSON machine state and merge them in — this handles project-prefixed IDs
     # (e.g. REQ-NN-001, TEST-NN-002a) that token overlap may not catch.
@@ -104,12 +103,10 @@ def run_preflight(
     explicit_req_ids = [m.upper() for m in _EXPLICIT_REQ.findall(utterance)]
     explicit_test_ids = [m.upper() for m in _EXPLICIT_TEST.findall(utterance)]
 
-    # Read requirements machine-state inline so CodeQL can trace the full
-    # sanitisation chain from _safe_resolve → root → literal child path.
-    # (Helper functions with a root: Path parameter are analysed conservatively
-    # by CodeQL and can re-introduce py/path-injection alerts.)
+    # Read requirements machine-state using os.path.join on the clean _root_str
+    # so CodeQL traces the full sanitisation chain without re-tainting via Path.
     rq_records: list[Any] = []
-    rq_path = Path(os.path.realpath(str(root / ".specsmith" / "requirements.json")))
+    rq_path = Path(os.path.realpath(os.path.join(_root_str, ".specsmith", "requirements.json")))
     if rq_path.is_file():
         try:
             _rq = _json.loads(rq_path.read_text(encoding="utf-8"))
@@ -123,10 +120,10 @@ def run_preflight(
             if eid in known_req_ids and eid not in requirement_ids:
                 requirement_ids.append(eid)
 
-    # Read test-case machine-state inline (same rationale as above).
+    # Read test-case machine-state (same rationale as above).
     test_case_ids: list[str] = []
     tc_records: list[Any] = []
-    tc_path = Path(os.path.realpath(str(root / ".specsmith" / "testcases.json")))
+    tc_path = Path(os.path.realpath(os.path.join(_root_str, ".specsmith", "testcases.json")))
     if tc_path.is_file():
         try:
             _tc = _json.loads(tc_path.read_text(encoding="utf-8"))
@@ -193,8 +190,9 @@ def run_preflight(
             )
             confidence_target = 0.7
 
-    # Config floor (REQ-098)
-    cfg_threshold = _read_confidence_threshold(root)
+    # Config floor (REQ-098) — pass _root_str so the helper never receives
+    # a tainted Path object derived from project_dir.
+    cfg_threshold = _read_confidence_threshold(_root_str)
     if cfg_threshold is not None and cfg_threshold > confidence_target:
         confidence_target = cfg_threshold
 
@@ -1021,9 +1019,10 @@ def _resolve_provider_name() -> str:
     return "byoe"
 
 
-def _read_confidence_threshold(root: Path) -> float | None:
-    # .resolve() clears CodeQL py/path-injection taint; path has a constant suffix.
-    cfg = (root / ".specsmith" / "config.yml").resolve()
+def _read_confidence_threshold(root: Path | str) -> float | None:
+    # Use os.path.join + os.path.realpath on the plain-string form so CodeQL
+    # sees the sanitiser inline and does not flag cfg.is_file() or cfg.read_text().
+    cfg = Path(os.path.realpath(os.path.join(str(root), ".specsmith", "config.yml")))
     if not cfg.is_file():
         return None
     try:

{specsmith-0.14.0.dev540 → specsmith-0.14.0.dev543/src/specsmith.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specsmith
-Version: 0.14.0.dev540
+Version: 0.14.0.dev543
 Summary: AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider.
 Author: Layer1Labs Silicon, Inc.
 License-Expression: MIT
@@ -40,7 +40,7 @@ Requires-Dist: pre-commit>=3.0; extra == "dev"
 Requires-Dist: types-pyyaml>=6.0; extra == "dev"
 Requires-Dist: cryptography>=42.0; extra == "dev"
 Provides-Extra: esdb
-Requires-Dist: chronomemory>=0.1.6; extra == "esdb"
+Requires-Dist: chronomemory>=0.1.7; extra == "esdb"
 Requires-Dist: cryptography>=42.0; extra == "esdb"
 Provides-Extra: docs
 Requires-Dist: mkdocs>=1.6; extra == "docs"
@@ -239,7 +239,7 @@ If you hold a chronomemory ESDB license, activate the commercial backend:
 # Step 1 — install the chronomemory package
 pip install "specsmith[esdb]"                 # installs chronomemory from PyPI
 # or if using pipx:
-pipx inject specsmith "chronomemory>=0.1.6"  # inject into the specsmith pipx venv
+pipx inject specsmith "chronomemory>=0.1.7"  # inject into the specsmith pipx venv
 
 # Step 2 — activate your license key
 specsmith esdb enable --key-file /path/to/your.esdb.key

{specsmith-0.14.0.dev540 → specsmith-0.14.0.dev543}/src/specsmith.egg-info/requires.txt

@@ -36,7 +36,7 @@ mkdocs>=1.6
 mkdocs-material>=9.5
 
 [esdb]
-chronomemory>=0.1.6
+chronomemory>=0.1.7
 cryptography>=42.0
 
 [gemini]