specsmith 0.17.1.dev657__tar.gz → 0.17.1.dev659__tar.gz

{specsmith-0.17.1.dev657/src/specsmith.egg-info → specsmith-0.17.1.dev659}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specsmith
-Version: 0.17.1.dev657
+Version: 0.17.1.dev659
 Summary: AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider.
 Author: Layer1Labs Silicon, Inc.
 License-Expression: MIT

{specsmith-0.17.1.dev657 → specsmith-0.17.1.dev659}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "specsmith"
-version = "0.17.1.dev657"
+version = "0.17.1.dev659"
 description = "AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider."
 readme = "README.md"
 license = "MIT"

{specsmith-0.17.1.dev657 → specsmith-0.17.1.dev659}/src/specsmith/governance_logic.py

@@ -81,20 +81,24 @@ def run_preflight(
         if _p in ("..", "..."):
             raise ValueError(f"Path traversal rejected: {_raw!r}")
     # os.path.realpath is a CodeQL-recognised py/path-injection sanitiser.
-    # Assign once at root level; all derived paths inherit the sanitisation.
+    # Apply it once at root level; each derived path also wraps its construction
+    # in os.path.realpath so CodeQL can trace the sanitiser inline at every sink
+    # without relying on interprocedural taint propagation.
     _safe_root = os.path.realpath(_raw)
-    _root = Path(_safe_root)
     _root_str = _safe_root  # alias used by helpers later in this function
     intent = classify_intent(utterance)
     # Requirements are now sourced from .specsmith/requirements.json (YAML-first mode).
     # docs/REQUIREMENTS.md is deprecated (REQ-373) but still used as a fallback
     # for keyword matching in infer_scope() when it exists. Explicit REQ-NNN IDs
     # in the utterance are always resolved from requirements.json regardless.
-    _req_md = Path(os.path.join(_safe_root, "docs", "REQUIREMENTS.md"))
-    if not _req_md.is_file():
-        _req_md = Path(os.path.join(_safe_root, "REQUIREMENTS.md"))  # legacy
+    # Use os.path.* string functions so CodeQL can follow os.path.realpath as an
+    # inline sanitiser without a Path() object potentially re-tainting the flow.
+    _req_md_s = os.path.realpath(os.path.join(_raw, "docs", "REQUIREMENTS.md"))
+    if not os.path.isfile(_req_md_s):
+        _req_md_s = os.path.realpath(os.path.join(_raw, "REQUIREMENTS.md"))  # legacy fallback
+    _req_md = Path(_req_md_s)  # convert to Path for infer_scope (read-only use)
     # infer_scope handles a non-existent path gracefully (returns empty scope)
-    _repo_idx = Path(os.path.join(_safe_root, ".repo-index", "files.json"))
+    _repo_idx = Path(os.path.realpath(os.path.join(_safe_root, ".repo-index", "files.json")))
     scope = infer_scope(
         utterance,
         _req_md,
@@ -115,7 +119,7 @@ def run_preflight(
     # Read requirements machine-state using os.path.join on the clean _root_str
     # so CodeQL traces the full sanitisation chain without re-tainting via Path.
     rq_records: list[Any] = []
-    rq_path = Path(os.path.join(_safe_root, ".specsmith", "requirements.json"))
+    rq_path = Path(os.path.realpath(os.path.join(_safe_root, ".specsmith", "requirements.json")))
     if rq_path.is_file():
         try:
             _rq = _json.loads(rq_path.read_text(encoding="utf-8"))
@@ -132,7 +136,7 @@ def run_preflight(
     # Read test-case machine-state (same rationale as above).
     test_case_ids: list[str] = []
     tc_records: list[Any] = []
-    tc_path = Path(os.path.join(_safe_root, ".specsmith", "testcases.json"))
+    tc_path = Path(os.path.realpath(os.path.join(_safe_root, ".specsmith", "testcases.json")))
     if tc_path.is_file():
         try:
             _tc = _json.loads(tc_path.read_text(encoding="utf-8"))

{specsmith-0.17.1.dev657 → specsmith-0.17.1.dev659/src/specsmith.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specsmith
-Version: 0.17.1.dev657
+Version: 0.17.1.dev659
 Summary: AEE governance toolkit for AI-assisted development — session preflight gates, multi-agent dispatch, requirements↔test traceability, ESDB persistence, MCP server, and skills for Warp, Cursor, Claude Code, Copilot, Windsurf, and Aider.
 Author: Layer1Labs Silicon, Inc.
 License-Expression: MIT