feat(installer): harden package safety

.codexignore

@@ -1,11 +1,22 @@
 .git/
+.github/
 .venv/
+.mypy_cache/
 .pytest_cache/
+.ruff_cache/
 __pycache__/
+build/
+dist/
+examples/
 planning/
 reports/
-dist/
-build/
+secrets/
+tests/
+tools/
+*.log
 *.pyc
 *.pyo
-*.log
+.env
+build-constraints.txt
+toolchain.lock.json
+uv.lock

.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

.github/workflows/validate.yml

@@ -19,7 +19,9 @@ jobs:
           python -m json.tool .codex-plugin/plugin.json >/dev/null
           python -m json.tool .agents/plugins/marketplace.json >/dev/null
       - name: Run tests
-        run: uv run --with pytest python -m pytest
+        run: |
+          uv sync --locked --no-default-groups --group test
+          uv run --locked --no-sync python -m pytest
       - name: Run strict example gates
         run: |
           python scripts/zagrosi_skills.py lint-project-manifest --planning-dir examples/saas --strict

.gitignore

@@ -7,7 +7,6 @@ build/
 planning/
 *.egg-info/
 *.pyc
-uv.lock
 .zagrosi-project/
 .deep-project/
 zagrosi_plan_config.json

NOTICE.md

@@ -37,3 +37,15 @@ Claude-specific workflow assumptions with Codex-native behavior:
 ## License
 
 Zagrosi Forge is distributed under the MIT License. See [LICENSE](LICENSE).
+
+## Vendored dependency
+
+Zagrosi Forge vendors the selected runtime tree from TOML Kit 0.15.0, licensed
+under MIT. The verified upstream source artifact is
+`https://files.pythonhosted.org/packages/51/db/03eaf4331631ef6b27d6e3c9b68c54dc6f0d63d87201fed600cc409307fd/tomlkit-0.15.0.tar.gz`
+with SHA-256
+`7d1a9ecba3086638211b13814ea79c90dd54dd11993564376f3aa92271f5c7a3`.
+Its copied license has SHA-256
+`f2f9b460ba719da6626add264d3782f275a4ff7aab677beda08b330911e23adb`.
+See `src/zagrosi_forge/_vendor/vendor-receipt.json` for the exact selected-file
+hashes and deterministic import transformation.

build-constraints.txt

@@ -0,0 +1,20 @@
+uv_build==0.11.28 \
+    --hash=sha256:fb10719142d431087f5e177d43c83f304391084a28ea52e1588542fe0f113f91 \
+    --hash=sha256:384a352d6b00df4824dcb56baa070498666795c3fd1b6d7377368649b695f864 \
+    --hash=sha256:3ec5e107bb7128cd15c274f9562b966b038f6342cb7c94239c02e4f1809e7690 \
+    --hash=sha256:5fb0d9e5e5b808d9ca3ed15356633b7e3ae00ae43f47e50e75eb72dddf98c6bc \
+    --hash=sha256:7af5f0a4319832aefd4deeff5ef01df2809b71e0bfc897bab42c2670ec2fa21b \
+    --hash=sha256:1a46aace1911c4502acc01c437a47602839b4dff91f58a3388998450f66cb5b1 \
+    --hash=sha256:67b4d61a16886c8f4d91f987ea813630b80d1fb57f1bd5d2466591a72bb2a7af \
+    --hash=sha256:fa4f2807129c852c2472e1fc2e1a2ba28018023a9349950cb19622fbb21156e4 \
+    --hash=sha256:cb5265d4f692e30889d6ef81608041e970763c684919acdb41ed6af5c345296b \
+    --hash=sha256:d99cb38411412134781140cc64dc7d296dbc383fa1e81ddc13ecb6863852ecf5 \
+    --hash=sha256:a3b8bd731e57f1451de4ef15ade18d328a68b6cad173794eda8fafe2e912e997 \
+    --hash=sha256:79091c7ee68a90ff44dd876c6d4b21d3c133015612ddecf9ade931779bfb4d92 \
+    --hash=sha256:6c89dde2c9d3bbfde41fa92bd252a87ab016c7722a85331315151bd39a78a591 \
+    --hash=sha256:2e57f0a02736b0b08f5d40b96be52be235de0898b58d00b0397485dffc55381b \
+    --hash=sha256:75327189c71ad829fb1fb8d1b4be02b6b26aaf98e76c2817a68d16aa15c31a1d \
+    --hash=sha256:75c1b66084502b42adbd1c6076347e2b97866030f81ecda5aac541499e928b6f \
+    --hash=sha256:52ad1a230e2a0e7dfdf1fa6a93e40a94fcf3c390ab2aa44a7bd0d31b780d02ed \
+    --hash=sha256:b5d4a79a0da94de28e2f2890782562e391d9936b686adf1403e671c355ad1370 \
+    --hash=sha256:daba66fd25a9a82caa23949686e967cbb69fd056177e991650643186057adaef

pyproject.toml

@@ -2,12 +2,40 @@
 name = "zagrosi-forge"
 version = "0.2.0"
 description = "Zagrosi Forge Codex-native project, planning, and TDD implementation skills"
-requires-python = ">=3.11"
+readme = "README.md"
+requires-python = ">=3.11,<3.15"
 license = "MIT"
+license-files = ["LICENSE", "NOTICE.md"]
 authors = [{ name = "Zagrosi" }]
 
-[project.optional-dependencies]
-dev = ["pytest>=8"]
+[project.scripts]
+zagrosi-forge = "zagrosi_forge.install:main"
+
+[build-system]
+requires = ["uv_build==0.11.28"]
+build-backend = "uv_build"
+
+[dependency-groups]
+test = [
+  "hypothesis>=6,<7",
+  "jsonschema>=4.26,<5",
+  "mypy>=1.15,<2",
+  "pytest>=8,<10",
+  "ruff>=0.14,<1",
+  "uv-build==0.11.28",
+]
+security = ["plugin-scanner==2.0.274"]
+
+[tool.uv.build-backend]
+module-name = "zagrosi_forge"
+module-root = "src"
+source-include = ["component-inventory.json"]
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]
+
+[tool.ruff]
+extend-exclude = ["src/zagrosi_forge/_vendor"]
+
+[tool.mypy]
+exclude = ["^src/zagrosi_forge/_vendor/"]

src/zagrosi_forge/__init__.py

@@ -0,0 +1,3 @@
+"""Trusted Python package for Zagrosi Forge."""
+
+__all__: list[str] = []

src/zagrosi_forge/_vendor/__init__.py

@@ -0,0 +1 @@
+"""Audited third-party runtime sources; do not edit manually."""

src/zagrosi_forge/_vendor/tomlkit-LICENSE

@@ -0,0 +1,20 @@
+Copyright (c) 2018 Sébastien Eustace
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

src/zagrosi_forge/_vendor/tomlkit/__init__.py

@@ -0,0 +1,59 @@
+from zagrosi_forge._vendor.tomlkit.api import TOMLDocument
+from zagrosi_forge._vendor.tomlkit.api import aot
+from zagrosi_forge._vendor.tomlkit.api import array
+from zagrosi_forge._vendor.tomlkit.api import boolean
+from zagrosi_forge._vendor.tomlkit.api import comment
+from zagrosi_forge._vendor.tomlkit.api import date
+from zagrosi_forge._vendor.tomlkit.api import datetime
+from zagrosi_forge._vendor.tomlkit.api import document
+from zagrosi_forge._vendor.tomlkit.api import dump
+from zagrosi_forge._vendor.tomlkit.api import dumps
+from zagrosi_forge._vendor.tomlkit.api import float_
+from zagrosi_forge._vendor.tomlkit.api import inline_table
+from zagrosi_forge._vendor.tomlkit.api import integer
+from zagrosi_forge._vendor.tomlkit.api import item
+from zagrosi_forge._vendor.tomlkit.api import key
+from zagrosi_forge._vendor.tomlkit.api import key_value
+from zagrosi_forge._vendor.tomlkit.api import load
+from zagrosi_forge._vendor.tomlkit.api import loads
+from zagrosi_forge._vendor.tomlkit.api import nl
+from zagrosi_forge._vendor.tomlkit.api import parse
+from zagrosi_forge._vendor.tomlkit.api import register_encoder
+from zagrosi_forge._vendor.tomlkit.api import string
+from zagrosi_forge._vendor.tomlkit.api import table
+from zagrosi_forge._vendor.tomlkit.api import time
+from zagrosi_forge._vendor.tomlkit.api import unregister_encoder
+from zagrosi_forge._vendor.tomlkit.api import value
+from zagrosi_forge._vendor.tomlkit.api import ws
+
+
+__version__ = "0.15.0"
+__all__ = [
+    "TOMLDocument",
+    "aot",
+    "array",
+    "boolean",
+    "comment",
+    "date",
+    "datetime",
+    "document",
+    "dump",
+    "dumps",
+    "float_",
+    "inline_table",
+    "integer",
+    "item",
+    "key",
+    "key_value",
+    "load",
+    "loads",
+    "nl",
+    "parse",
+    "register_encoder",
+    "string",
+    "table",
+    "time",
+    "unregister_encoder",
+    "value",
+    "ws",
+]

src/zagrosi_forge/_vendor/tomlkit/_compat.py

@@ -0,0 +1,20 @@
+from __future__ import annotations
+
+import contextlib
+import sys
+
+
+PY38 = sys.version_info >= (3, 8)
+
+
+def decode(string: str | bytes, encodings: list[str] | None = None) -> str:
+    if not isinstance(string, bytes):
+        return string
+
+    encodings = encodings or ["utf-8", "latin1", "ascii"]
+
+    for encoding in encodings:
+        with contextlib.suppress(UnicodeEncodeError, UnicodeDecodeError):
+            return string.decode(encoding)
+
+    return string.decode(encodings[0], errors="ignore")

src/zagrosi_forge/_vendor/tomlkit/_types.py

@@ -0,0 +1,90 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+from typing import Any
+from typing import TypeVar
+
+
+WT = TypeVar("WT", bound="WrapperType")
+
+__all__ = [
+    "_CustomDict",
+    "_CustomFloat",
+    "_CustomInt",
+    "_CustomList",
+    "wrap_method",
+]
+
+if TYPE_CHECKING:  # pragma: no cover
+    # Define _CustomList and _CustomDict as a workaround for:
+    # https://github.com/python/mypy/issues/11427
+    #
+    # According to this issue, the typeshed contains a "lie"
+    # (it adds MutableSequence to the ancestry of list and MutableMapping to
+    # the ancestry of dict) which completely messes with the type inference for
+    # Table, InlineTable, Array and Container.
+    #
+    # Importing from builtins is preferred over simple assignment, see issues:
+    # https://github.com/python/mypy/issues/8715
+    # https://github.com/python/mypy/issues/10068
+    from builtins import dict as _CustomDict
+    from builtins import float as _CustomFloat
+    from builtins import int as _CustomInt
+    from builtins import list as _CustomList
+    from typing import Callable
+    from typing import Concatenate
+    from typing import ParamSpec
+    from typing import Protocol
+
+    P = ParamSpec("P")
+
+    class WrapperType(Protocol):
+        def _new(self: WT, value: Any) -> WT: ...
+
+else:
+    from collections.abc import MutableMapping
+    from collections.abc import MutableSequence
+    from numbers import Integral
+    from numbers import Real
+
+    class _CustomList(MutableSequence, list):
+        """Adds MutableSequence mixin while pretending to be a builtin list"""
+
+        def __add__(self, other):
+            new_list = self.copy()
+            new_list.extend(other)
+            return new_list
+
+        def __iadd__(self, other):
+            self.extend(other)
+            return self
+
+    class _CustomDict(MutableMapping, dict):
+        """Adds MutableMapping mixin while pretending to be a builtin dict"""
+
+        def __or__(self, other):
+            new_dict = self.copy()
+            new_dict.update(other)
+            return new_dict
+
+        def __ior__(self, other):
+            self.update(other)
+            return self
+
+    class _CustomInt(Integral, int):
+        """Adds Integral mixin while pretending to be a builtin int"""
+
+    class _CustomFloat(Real, float):
+        """Adds Real mixin while pretending to be a builtin float"""
+
+
+def wrap_method(
+    original_method: Callable[Concatenate[WT, P], Any],
+) -> Callable[Concatenate[WT, P], Any]:
+    def wrapper(self: WT, /, *args: P.args, **kwargs: P.kwargs) -> Any:
+        result = original_method(self, *args, **kwargs)
+        if result is NotImplemented:
+            return result
+        return self._new(result)
+
+    return wrapper