delimit-ai/delimit

Second release shipped through the dogfood chain. Clears the known-debt tail from v4.3.3.

Dogfood evidence chain

| Gate | Result |
|---|---|
| delimit_repo_diagnose | ✓ |
| delimit_security_audit (direct-python, bypassing MCP cache) | ✓ 22 findings → 1 (upstream npm-audit moderate; 21 pattern false positives suppressed by new nosec-aware scanner) |
| delimit_test_smoke | ✓ 165/165 |
| delimit_changelog | ✓ |
| delimit_deploy_plan | ✓ |
| CI (Node 18 / 20 / 22 + CodeQL + API Check) | ✓ 9/9 green on PR #61 |
| delimit wrap — live verify | ✓ att_a05050eb8e13277e — signed attestation of npm view [email protected] version → 4.3.4 |

Fixes

• Nosec-aware anti-pattern scanner (gateway/ai/backends/tools_infra.py). The scanner now honors industry-standard suppression markers: # nosec, // nosec, # delimit:nosec, // delimit:nosec. Matches bandit's convention. Strictly more permissive than before — never adds findings, only suppresses matched ones. Direct-python verification: 22 findings → 1 (the remaining is an upstream npm-audit moderate, not a pattern hit).
• delimit wrap pytest-detection (lib/wrap-engine.js). The bundled test-smoke gate no longer runs pytest against Node-only repos. Previously any tests/ directory would trigger pytest. Now requires a Python-specific signal: pytest.ini, setup.py, pyproject.toml mentioning pytest, or setup.cfg with [pytest] / [tool:pytest]. Fixes the ✗ test_smoke:pytest line that appeared in the v4.3.3 verification attestation.
• 18 inline # nosec / // nosec annotations on legitimate eval / exec / yaml.load / subprocess_shell usages in MCP dynamic dispatch, regex pattern definitions (scanner scanning itself), and user-local config parsing. Each annotation includes the reason inline:
  • gateway/ai/swarm.py:849 — MCP tool dispatch eval/exec
  • gateway/ai/mcp_bridge.py:31 — shell=True for user-configured CLI
  • gateway/ai/backends/tools_infra.py:78-81 — self-scanner pattern defs
  • gateway/ai/workers/executor.py:514 — approved-script spawn
  • gateway/core/zero_spec/express_extractor.py:70 — sandboxed AST exec
  • bin/delimit-cli.js:381, 3833, 4196, 4311 — user-local YAML parse
  • lib/agent.js:127, 142, 320 — agent config YAML parse
  • lib/cross-model-hooks.js:157 — hook YAML parse
  • adapters/codex-security.js:13, 14, 16 — scanner pattern defs

Compatibility

Not a behavior change for users. The nosec-aware scanner is strictly more permissive than before (never adds findings, only suppresses matched ones), and the pytest-detection fix only prevents incorrect pytest invocations.

Known state

• delimit_security_audit via MCP still shows the pre-fix findings because the MCP server process caches Python modules on startup. Source truth is correct and was verified via direct-python subprocess. Fix activates on next MCP restart.

Full context: LED-1075 (regression tests), LED-1076 (false-positive fix), LED-1077 (test-smoke fix), LED-1079 (dogfood milestone), LED-1080 (nosec-aware scanner).