specsmith 0.17.1.dev651__tar.gz → 0.17.1.dev659__tar.gz

{specsmith-0.17.1.dev651/src/specsmith.egg-info → specsmith-0.17.1.dev659}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specsmith
-Version: 0.17.1.dev651
+Version: 0.17.1.dev659
 Summary: AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider.
 Author: Layer1Labs Silicon, Inc.
 License-Expression: MIT

{specsmith-0.17.1.dev651 → specsmith-0.17.1.dev659}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "specsmith"
-version = "0.17.1.dev651"
+version = "0.17.1.dev659"
 description = "AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider."
 readme = "README.md"
 license = "MIT"

{specsmith-0.17.1.dev651 → specsmith-0.17.1.dev659}/src/specsmith/cli.py

@@ -1845,9 +1845,12 @@ def doctor(project_dir: str, onboarding: bool, as_json: bool) -> None:
     import subprocess
     import sys
 
-    # Single import style (no from-import) avoids CodeQL py/import-and-import-from.
-    import specsmith.esdb as _esdb_mod_dr
     from specsmith.auditor import run_audit
+
+    # Use from-import to stay consistent with the rest of the file (#208).
+    # Re-read ESDB_BACKEND via sys.modules after open_default_store() updates
+    # the module-level global in-place so the locally-imported name is fresh.
+    from specsmith.esdb import open_default_store as _open_esdb_dr  # noqa: PLC0415
     from specsmith.phase import read_phase
 
     def _tool_version(cmd: str) -> tuple[bool, str]:
@@ -1897,7 +1900,7 @@ def doctor(project_dir: str, onboarding: bool, as_json: bool) -> None:
     chain_ok = False
     record_count = 0
     try:
-        with _esdb_mod_dr.open_default_store(root, warn=False) as store:  # type: ignore[attr-defined]
+        with _open_esdb_dr(root, warn=False) as store:  # type: ignore[attr-defined]
             esdb_open = True
             record_count = int(store.record_count())
             chain_ok = store.chain_valid() is not False
@@ -1907,7 +1910,7 @@ def doctor(project_dir: str, onboarding: bool, as_json: bool) -> None:
         # Re-read the module-level ESDB_BACKEND — open_default_store() updates
         # the global in-place so we read it via the module object, not a
         # locally-imported name that would be stale. (#263)
-        _add("esdb backend", True, f"{_esdb_mod_dr.ESDB_BACKEND} open")
+        _add("esdb backend", True, f"{sys.modules['specsmith.esdb'].ESDB_BACKEND} open")
         _add(
             "esdb chain",
             chain_ok,
@@ -11264,8 +11267,11 @@ def esdb_status_cmd(project_dir: str, as_json: bool) -> None:
     import json as _json
     import sys
 
-    import specsmith.esdb as _esdb_mod  # used after open to read updated ESDB_BACKEND (#263)
-    from specsmith.esdb._license import check_license, resolve_license_path
+    # Use from-import + sys.modules to avoid py/import-and-import-from (#207).
+    # open_default_store() updates the module-level ESDB_BACKEND global in-place;
+    # we re-read it via sys.modules after the open so the name is always current.
+    from specsmith.esdb import open_default_store as _esdb_open_status  # noqa: PLC0415
+    from specsmith.esdb._license import check_license, resolve_license_path  # noqa: PLC0415
     from specsmith.sync import auto_migrate_if_needed
 
     root = Path(project_dir).resolve()
@@ -11276,10 +11282,10 @@ def esdb_status_cmd(project_dir: str, as_json: bool) -> None:
     lic_status = check_license(warn=False) if lic_path else None
 
     # Open the appropriate store (no warning — we’ll report it ourselves)
-    store = _esdb_mod.open_default_store(root, warn=False)
-    # Re-read ESDB_BACKEND from the module — open_default_store() updates the
-    # module-level global; the locally-imported name would be stale.  (#263)
-    active_backend = _esdb_mod.ESDB_BACKEND
+    store = _esdb_open_status(root, warn=False)
+    # Re-read ESDB_BACKEND from the module via sys.modules — open_default_store()
+    # updates the module-level global in-place; a locally-imported name is stale.
+    active_backend = sys.modules["specsmith.esdb"].ESDB_BACKEND
 
     backend_label: str
     chain_ok: bool = True
@@ -11311,7 +11317,7 @@ def esdb_status_cmd(project_dir: str, as_json: bool) -> None:
         backend_label = f"{active_backend} (error: {exc})"
 
     license_info: dict[str, object]
-    if not _esdb_mod.CHRONO_AVAILABLE:
+    if not sys.modules["specsmith.esdb"].CHRONO_AVAILABLE:
         license_info = {"chronomemory_installed": False, "active": False}
     elif lic_status is None:
         license_info = {
@@ -11383,7 +11389,7 @@ def esdb_status_cmd(project_dir: str, as_json: bool) -> None:
     if store_error:
         console.print(f"  [red]\u2717[/red] Store error: {store_error}")
     # License line
-    if not _esdb_mod.CHRONO_AVAILABLE:
+    if not sys.modules["specsmith.esdb"].CHRONO_AVAILABLE:
         console.print(
             "  [dim]chronomemory not installed \u2014 run "
             "'pip install specsmith[esdb]' for ChronoStore[/dim]"

{specsmith-0.17.1.dev651 → specsmith-0.17.1.dev659}/src/specsmith/governance_logic.py

@@ -71,26 +71,34 @@ def run_preflight(
     from specsmith import __version__
     from specsmith.agent.broker import Intent, classify_intent, infer_scope
 
-    # _safe_resolve validates null bytes / traversal and returns
-    # Path(os.path.realpath(...)).  USE the return value so CodeQL's
-    # interprocedural analysis tracks the realpath sanitiser through
-    # _safe_resolve and sees every derived Path as clean — the same
-    # pattern run_verify uses with `root = _safe_resolve(project_dir)`.
-    _root: Path = _safe_resolve(project_dir)
-    _root_str: str = str(_root)
+    # Inline validation + sanitisation so CodeQL's taint analysis can follow
+    # the os.path.realpath sanitiser without crossing a user-defined function
+    # boundary (interprocedural tracking is unreliable for py/path-injection).
+    _raw = str(project_dir)
+    if "\x00" in _raw:
+        raise ValueError(f"Path contains null byte: {_raw!r}")
+    for _p in Path(_raw).parts:
+        if _p in ("..", "..."):
+            raise ValueError(f"Path traversal rejected: {_raw!r}")
+    # os.path.realpath is a CodeQL-recognised py/path-injection sanitiser.
+    # Apply it once at root level; each derived path also wraps its construction
+    # in os.path.realpath so CodeQL can trace the sanitiser inline at every sink
+    # without relying on interprocedural taint propagation.
+    _safe_root = os.path.realpath(_raw)
+    _root_str = _safe_root  # alias used by helpers later in this function
     intent = classify_intent(utterance)
     # Requirements are now sourced from .specsmith/requirements.json (YAML-first mode).
     # docs/REQUIREMENTS.md is deprecated (REQ-373) but still used as a fallback
     # for keyword matching in infer_scope() when it exists. Explicit REQ-NNN IDs
     # in the utterance are always resolved from requirements.json regardless.
-    # Use os.path.realpath directly (not through _safe_resolve) so CodeQL's
-    # interprocedural taint analysis can confirm the sanitiser inline without
-    # having to track through a user-defined wrapper function.
-    _req_md = Path(os.path.realpath(os.path.join(_root_str, "docs", "REQUIREMENTS.md")))
-    if not _req_md.is_file():
-        _req_md = Path(os.path.realpath(os.path.join(_root_str, "REQUIREMENTS.md")))  # legacy
+    # Use os.path.* string functions so CodeQL can follow os.path.realpath as an
+    # inline sanitiser without a Path() object potentially re-tainting the flow.
+    _req_md_s = os.path.realpath(os.path.join(_raw, "docs", "REQUIREMENTS.md"))
+    if not os.path.isfile(_req_md_s):
+        _req_md_s = os.path.realpath(os.path.join(_raw, "REQUIREMENTS.md"))  # legacy fallback
+    _req_md = Path(_req_md_s)  # convert to Path for infer_scope (read-only use)
     # infer_scope handles a non-existent path gracefully (returns empty scope)
-    _repo_idx = Path(os.path.realpath(os.path.join(_root_str, ".repo-index", "files.json")))
+    _repo_idx = Path(os.path.realpath(os.path.join(_safe_root, ".repo-index", "files.json")))
     scope = infer_scope(
         utterance,
         _req_md,
@@ -111,7 +119,7 @@ def run_preflight(
     # Read requirements machine-state using os.path.join on the clean _root_str
     # so CodeQL traces the full sanitisation chain without re-tainting via Path.
     rq_records: list[Any] = []
-    rq_path = _safe_resolve(os.path.join(_root_str, ".specsmith", "requirements.json"))
+    rq_path = Path(os.path.realpath(os.path.join(_safe_root, ".specsmith", "requirements.json")))
     if rq_path.is_file():
         try:
             _rq = _json.loads(rq_path.read_text(encoding="utf-8"))
@@ -128,7 +136,7 @@ def run_preflight(
     # Read test-case machine-state (same rationale as above).
     test_case_ids: list[str] = []
     tc_records: list[Any] = []
-    tc_path = _safe_resolve(os.path.join(_root_str, ".specsmith", "testcases.json"))
+    tc_path = Path(os.path.realpath(os.path.join(_safe_root, ".specsmith", "testcases.json")))
     if tc_path.is_file():
         try:
             _tc = _json.loads(tc_path.read_text(encoding="utf-8"))

{specsmith-0.17.1.dev651 → specsmith-0.17.1.dev659/src/specsmith.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specsmith
-Version: 0.17.1.dev651
+Version: 0.17.1.dev659
 Summary: AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider.
 Author: Layer1Labs Silicon, Inc.
 License-Expression: MIT