agent-xplat v1.0.3

agent-xplat v1.0.3

Cross-OS runtime portability checker for AI agent workflows — patch release that scopes shell/quoting detectors to real execution contexts, removing three observed false-positive families without disabling any rule.

Changes

• Python source: only string literals passed to explicit shell-execution calls (subprocess.run/call/Popen/check_*, os.system, os.popen) are shell corpus now. Keyword arguments (detail="...", tempfile(..., dir=path)), assignments, X | Y type annotations, docstrings and ordinary strings no longer produce shell findings. Import aliases (import subprocess as sp, from subprocess import run as x, from os import ...) are resolved structurally.
• GitHub Actions workflows: run: blocks are scoped to the executor chosen by runs-on and the shell chain (step shell: > defaults.run.shell > runner default), including matrix os lists and include-only matrices. Explicit bash steps on Linux/macOS runners no longer receive CMD/PowerShell-lens findings; Windows legs keep their findings; unprovable runners (self-hosted, expressions, os-bearing include over a top-level os product) keep the historical conservative behavior.
• PowerShell/CMD files: .ps1 is PowerShell source, .cmd/.bat is CMD source — legal native syntax ($var, $env:, set, %VAR%, where) is not reported through another shell's lens. Explicit cross-interpreter text (cmd /c inside .ps1, $VAR inside .cmd) stays detected.

Evidence

• Same-commit comparison on two consumer repositories (fixed commits, both tool versions, identical config; per-finding removed lists archived): photo-abstract-editorial 80a83a02 203 → 86 findings (117 removed, 0 added; all 102 AX-SHELL-003 previously reported there confirmed one-by-one as Python-argument false positives); presentation-studio 6c037896 8634 → 5205 (3429 removed, 0 added; workflow 1399 / Python 1697 / .ps1 333, Markdown unchanged).
• Positive controls preserved and newly tested: subprocess/os literal commands, aliases, multi-line and non-ASCII strings, .cmd $VAR, .ps1 cmd /c, workflow Windows legs, matrix and self-hosted conservatism (see docs/audit/fix-execution-context-false-positives.md).
• Tests: 119 collected, 118 passed, 1 skipped (Ubuntu/bash-only CI-adoption test); three-system workflow green on the released commit.

Limitations

• Shell commands built dynamically or passed through variables are not detected in Python (static literal strings only); docstring text is intentionally not shell corpus; workflow executor inference is an approximation of hosted runners. No zero-false-positive or universal-compatibility claim is made.

agent-xplat v1.0.2

Improvements

• Consumer CI with an isolated, pinned scanner.
• New-only baseline gating with moved-line and duplicate handling.
• Reduced Markdown false positives.
• Source identity in reports and stronger runtime evidence checks.
• Three-language documentation and a ten-repository study.

Validation

Windows, macOS and Linux CI passed:
https://github.com/kwhi6693-web/agent-xplat/actions/runs/34009253771

Limitations

Static findings remain inferred. The selected manual review covered 30 findings: 22 of 25 false positives were removed; 3 remain. Review findings before enabling mandatory gates.

Install

python -m pip install --upgrade agent-xplat==1.0.2

agent-xplat v1.0.1

agent-xplat v1.0.1

Packaging release for the first PyPI Trusted Publishing trigger.

Highlights

• Updated distribution and runtime version identifiers to 1.0.1.
• Updated the direct GitHub Release wheel-install example and release audit records.
• No core analyzer functionality or portability rules changed.

Verification

• Full local regression: 88 passed.
• Wheel and source distribution built and passed twine check.
• Fresh wheel and source-distribution installs reported 1.0.1 and passed a clean self-scan.
• Project dependency and toolchain security audits reported no known vulnerabilities.

Installation

python -m pip install agent-xplat
agent-xplat scan .

agent-xplat v1.0.0

agent-xplat v1.0.0

Find the OS assumptions that break AI-agent workflows.

Highlights

• Deterministic portability analysis across the OS × Shell × Runtime matrix for Windows, macOS, and Linux.
• Structured JavaScript, JSX, TypeScript, and TSX analysis backed by Tree-sitter, plus Python, shell, package, filesystem, path, runtime, and agent-configuration rules.
• Stable terminal, JSON 1.0, SARIF 2.1.0, Markdown, baseline, diff, contract, fix, doctor, CI, and badge workflows.
• Read-only static scanning with explicit, bounded runtime verification and a strict INFERRED versus VERIFIED evidence boundary.

Verification

• Public workflow run: https://github.com/kwhi6693-web/agent-xplat/actions/runs/33520727803
• Verified commit: 3ae71ec54a5ba433a50d8ff5de49bd892006d67d
• GitHub-hosted jobs: windows-latest, macos-latest, and ubuntu-latest
• Project test command: 88 passed on all three jobs
• JSON, SARIF, Markdown, and runtime evidence artifacts were downloaded and validated from the workflow run.

Static scan results remain INFERRED. Runtime evidence is VERIFIED only for the recorded runner target: Windows PowerShell, macOS zsh, and Linux bash.

Installation

python -m pip install https://github.com/kwhi6693-web/agent-xplat/releases/download/v1.0.0/agent_xplat-1.0.0-py3-none-any.whl
agent-xplat scan .

The source distribution is also attached for source-based installation.

Known limitations

Static analysis cannot prove every dynamic/generated command, shell version, installed external tool, native dependency, filesystem policy, or runtime behavior. Use agent-xplat test . and the generated CI workflow for runtime evidence.