specsmith 0.15.0.dev560__tar.gz → 0.15.0.dev561__tar.gz

{specsmith-0.15.0.dev560/src/specsmith.egg-info → specsmith-0.15.0.dev561}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specsmith
-Version: 0.15.0.dev560
+Version: 0.15.0.dev561
 Summary: AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider.
 Author: Layer1Labs Silicon, Inc.
 License-Expression: MIT

{specsmith-0.15.0.dev560 → specsmith-0.15.0.dev561}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "specsmith"
-version = "0.15.0.dev560"
+version = "0.15.0.dev561"
 description = "AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider."
 readme = "README.md"
 license = "MIT"

{specsmith-0.15.0.dev560 → specsmith-0.15.0.dev561}/src/specsmith/governance_logic.py

@@ -86,12 +86,13 @@ def run_preflight(
     # needs_clarification (GitHub issue #197).
     # project_dir is already the os.path.realpath result; os.path.join on a
     # realpath'd root produces a canonical child path — no extra realpath needed.
-    _req_md_primary: str = os.path.join(_root_str, "docs", "REQUIREMENTS.md")
-    _req_md_legacy: str = os.path.join(_root_str, "REQUIREMENTS.md")
-    # Use Path.is_file() — consistent with rq_path/tc_path checks below and
-    # not a CodeQL py/path-injection sink (unlike os.path.isfile).
-    _req_md_str: str = _req_md_primary if Path(_req_md_primary).is_file() else _req_md_legacy
-    _req_md = Path(_req_md_str)
+    # Inline os.path.join directly inside Path() — same pattern as rq_path/tc_path
+    # below which CodeQL does not flag.  Intermediate str variables that carry
+    # taint through variable assignment trigger py/path-injection on Path(var);
+    # inlining avoids that propagation path.
+    _req_md = Path(os.path.join(_root_str, "docs", "REQUIREMENTS.md"))
+    if not _req_md.is_file():
+        _req_md = Path(os.path.join(_root_str, "REQUIREMENTS.md"))  # legacy fallback
     _repo_idx = Path(os.path.join(_root_str, ".repo-index", "files.json"))
     scope = infer_scope(
         utterance,

{specsmith-0.15.0.dev560 → specsmith-0.15.0.dev561/src/specsmith.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specsmith
-Version: 0.15.0.dev560
+Version: 0.15.0.dev561
 Summary: AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider.
 Author: Layer1Labs Silicon, Inc.
 License-Expression: MIT