@event4u/agent-config 6.1.0 → 7.0.0

package/src/scripts/ai_council/_default_prices.py

@@ -1,50 +0,0 @@
-"""Shipped baseline prices for the AI Council.
-
-This file is the bootstrap source for `agents/runtime/.agent-prices.md`
-when the runtime file is missing. It is also the network-fallback
-source for `scripts/update_prices.py` when the upstream feed (LiteLLM)
-is unreachable.
-
-Prices are USD per **1 000 000** tokens. Models are identified by the
-exact `model:` string the user puts into `.agent-settings.yml`.
-
-Numbers below are a hand-curated snapshot — they will drift. The
-runtime never reads them directly once `agents/runtime/.agent-prices.md`
-exists; the weekly refresh and user edits are the live source of truth.
-"""
-
-from __future__ import annotations
-
-# YYYY-MM-DD of when this table was last hand-edited. Keep in sync with
-# the test_default_prices freshness assertion if you bump this.
-LAST_UPDATED = "2026-05-14"
-
-# (provider, model)  ->  (input_per_1m_usd, output_per_1m_usd)
-DEFAULT_PRICES: dict[tuple[str, str], tuple[float, float]] = {
-    # ── Anthropic ────────────────────────────────────────────────────
-    ("anthropic", "claude-sonnet-4-5"): (3.00, 15.00),
-    ("anthropic", "claude-opus-4-1"): (15.00, 75.00),
-    ("anthropic", "claude-haiku-4-5"): (1.00, 5.00),
-    # ── OpenAI ───────────────────────────────────────────────────────
-    ("openai", "gpt-4o"): (2.50, 10.00),
-    ("openai", "gpt-4o-mini"): (0.15, 0.60),
-    ("openai", "o1"): (15.00, 60.00),
-    ("openai", "o3-mini"): (1.10, 4.40),
-    # ── Google Gemini ────────────────────────────────────────────────
-    ("gemini", "gemini-2.5-pro"): (1.25, 10.00),
-    ("gemini", "gemini-2.5-flash"): (0.30, 2.50),
-    # ── xAI Grok ─────────────────────────────────────────────────────
-    ("xai", "grok-4"): (3.00, 15.00),
-    ("xai", "grok-3-mini"): (0.30, 0.50),
-    # ── Perplexity ───────────────────────────────────────────────────
-    ("perplexity", "sonar-pro"): (3.00, 15.00),
-    ("perplexity", "sonar"): (1.00, 1.00),
-}
-
-
-def as_rows() -> list[tuple[str, str, float, float]]:
-    """Return the table sorted (provider, model) for stable Markdown output."""
-    return [
-        (provider, model, prices[0], prices[1])
-        for (provider, model), prices in sorted(DEFAULT_PRICES.items())
-    ]

package/src/scripts/ai_council/advisors.py

@@ -1,148 +0,0 @@
-"""Thinking-style advisors — replace-mode call planning (Phase 6).
-
-When `agents/settings/.ai-council.yml` enables an advisor (e.g. `contrarian`
-bound to `member: anthropic`), the orchestrator REPLACES the matching
-plain-member call with an advisor-persona call on the same provider.
-Same total call count as a plain run; bounded extra cost beyond the
-persona-prompt token delta.
-
-This module owns:
-
-- `AdvisorPlan`  — resolved swap for a single provider (persona text,
-  display name, optional model override).
-- `plan_advisor_swap()` — walks the enabled advisors, reads their
-  persona files, and returns the per-provider plan map consumed by
-  `orchestrator.consult()` / `estimate()` and by the CLI.
-- `resolve_persona_text()` — reads a persona file with condensed-tree
-  preference and frontmatter strip.
-
-Cross-validation against the members block already ran at config load
-(`config._build_config`); this module trusts that contract and only
-enforces the **one-advisor-per-provider** rule (replace-mode invariant).
-"""
-
-from __future__ import annotations
-
-import re
-from dataclasses import dataclass
-from pathlib import Path
-
-import yaml
-
-from scripts.ai_council.config import AdvisorConfig, CouncilConfigError
-
-
-@dataclass(frozen=True)
-class AdvisorPlan:
-    """Resolved advisor swap for a single provider."""
-
-    name: str
-    display_name: str
-    member: str
-    persona_text: str
-    model_override: str | None = None
-
-
-_FRONTMATTER_RE = re.compile(r"\A---\n(.*?)\n---\n", re.DOTALL)
-
-
-def _split_frontmatter(raw: str) -> tuple[dict, str]:
-    """Return ``(frontmatter_dict, body)``. Missing frontmatter → ``({}, raw)``."""
-    match = _FRONTMATTER_RE.match(raw)
-    if not match:
-        return {}, raw
-    try:
-        meta = yaml.safe_load(match.group(1)) or {}
-    except yaml.YAMLError:
-        meta = {}
-    if not isinstance(meta, dict):
-        meta = {}
-    body = raw[match.end():]
-    return meta, body
-
-
-def _display_name_from(advisor_name: str, frontmatter: dict) -> str:
-    """Prefer frontmatter ``role``; fall back to titleized advisor key."""
-    role = frontmatter.get("role")
-    if isinstance(role, str) and role.strip():
-        return role.strip()
-    return advisor_name.replace("-", " ").replace("_", " ").title()
-
-
-def resolve_persona_text(
-    persona_path: str,
-    repo_root: Path,
-) -> tuple[str, dict]:
-    """Read a persona file, returning ``(body, frontmatter)``.
-
-    Condensed tree (``dist/agent-src/``) wins so production runs match the
-    same projection the rest of the package consumes. Uncondensed tree
-    (``.agent-src.uncondensed/``) is the fallback for in-repo
-    development before ``task sync`` has projected the file.
-    """
-    candidates = [
-        repo_root / "dist/agent-src" / persona_path,
-        repo_root / ".agent-src.uncondensed" / persona_path,
-    ]
-    for candidate in candidates:
-        if candidate.exists():
-            raw = candidate.read_text(encoding="utf-8")
-            meta, body = _split_frontmatter(raw)
-            return body.strip(), meta
-    searched = "\n  - ".join(str(c) for c in candidates)
-    raise CouncilConfigError(
-        f"Persona file not found for advisor (path={persona_path!r}). "
-        f"Searched:\n  - {searched}"
-    )
-
-
-def plan_advisor_swap(
-    advisors: dict[str, AdvisorConfig],
-    repo_root: Path,
-) -> dict[str, AdvisorPlan]:
-    """Return ``{provider_name: AdvisorPlan}`` for every ENABLED advisor.
-
-    Two enabled advisors targeting the same provider is a
-    ``CouncilConfigError`` — replace-mode runs one advisor per provider
-    so the call plan never doubles up by accident.
-    """
-    plans: dict[str, AdvisorPlan] = {}
-    for adv in advisors.values():
-        if not adv.enabled:
-            continue
-        if adv.member in plans:
-            existing = plans[adv.member].name
-            raise CouncilConfigError(
-                f"advisors.{adv.name} and advisors.{existing} both bind "
-                f"member={adv.member!r}; only one advisor per provider "
-                f"per run (replace-mode invariant)."
-            )
-        body, meta = resolve_persona_text(adv.persona, repo_root)
-        plans[adv.member] = AdvisorPlan(
-            name=adv.name,
-            display_name=_display_name_from(adv.name, meta),
-            member=adv.member,
-            persona_text=body,
-            model_override=adv.model,
-        )
-    return plans
-
-
-def build_persona_labels(
-    plans: dict[str, AdvisorPlan],
-    members: list,
-) -> dict[str, str]:
-    """Build the peer-review ``source → display_name`` map.
-
-    ``source`` is the ``provider:model`` string the peer-review
-    pipeline uses for anonymisation; ``members`` is the post-swap
-    member list (model_override already applied), so the model field
-    matches what the response carries.
-    """
-    labels: dict[str, str] = {}
-    for m in members:
-        plan = plans.get(m.name)
-        if plan is None:
-            continue
-        labels[f"{m.name}:{m.model}"] = plan.display_name
-    return labels

package/src/scripts/ai_council/airgap.py

@@ -1,165 +0,0 @@
-"""Airgap detection for the AI Council installer / first-run (step-9 P11 · U1).
-
-Probes DNS for the three primary council provider hosts with a short
-timeout. If **all** probes fail the environment is treated as airgapped
-and the installer is expected to seed ``defaults.member_mode: api`` (the
-CLI default would otherwise launch ``codex``/``claude``/``gemini``
-binaries that cannot reach their backends).
-
-Why DNS, not HTTP:
-- DNS is cheap (UDP, ~1 packet), HTTP probes are billable surface.
-- A DNS hit is sufficient to disprove airgap; the actual reachability
-  of the host is checked at first use, not here.
-- No auth required, no false negatives from corporate proxies that
-  block HTTPS but allow DNS.
-
-Public surface:
-- ``COUNCIL_PROBE_HOSTS`` — tuple of hosts to probe.
-- ``probe_host(host, timeout)`` — single-host probe, returns bool.
-- ``detect_airgap(*, hosts, timeout, resolver)`` — returns ``True`` iff
-  every host fails. ``resolver`` is injectable for tests.
-- ``airgap_banner()`` — the one-liner the installer prints when airgap
-  is detected.
-"""
-
-from __future__ import annotations
-
-import socket
-from collections.abc import Callable, Iterable
-
-COUNCIL_PROBE_HOSTS: tuple[str, ...] = (
-    "api.anthropic.com",
-    "api.openai.com",
-    "generativelanguage.googleapis.com",
-)
-
-DEFAULT_TIMEOUT_S: float = 1.0
-
-# Banner string the installer prints when airgap is detected. Wording
-# is part of the Phase 11 contract (roadmap step-9 line 147) and is
-# asserted by tests/test_airgap_detection.py.
-AIRGAP_BANNER: str = (
-    "airgapped environment detected — defaulting to mode: api"
-)
-
-
-def airgap_banner() -> str:
-    """Return the canonical airgap banner (step-9 P11)."""
-
-    return AIRGAP_BANNER
-
-
-Resolver = Callable[[str], None]
-
-
-def _default_resolver(host: str) -> None:
-    """Resolve ``host`` via ``socket.getaddrinfo``.
-
-    Raises ``socket.gaierror`` / ``OSError`` on failure. The timeout is
-    enforced by the caller via ``socket.setdefaulttimeout`` because
-    ``getaddrinfo`` itself has no ``timeout=`` kwarg.
-    """
-
-    socket.getaddrinfo(host, None)
-
-
-def probe_host(
-    host: str,
-    *,
-    timeout: float = DEFAULT_TIMEOUT_S,
-    resolver: Resolver | None = None,
-) -> bool:
-    """Return ``True`` iff ``host`` resolves within ``timeout``.
-
-    Any DNS / socket error is treated as unreachable. Test code can
-    inject ``resolver`` to simulate reachability without touching the
-    network.
-    """
-
-    resolver = resolver or _default_resolver
-    previous = socket.getdefaulttimeout()
-    try:
-        socket.setdefaulttimeout(timeout)
-        try:
-            resolver(host)
-        except (socket.gaierror, OSError):
-            return False
-        return True
-    finally:
-        socket.setdefaulttimeout(previous)
-
-
-def detect_airgap(
-    *,
-    hosts: Iterable[str] = COUNCIL_PROBE_HOSTS,
-    timeout: float = DEFAULT_TIMEOUT_S,
-    resolver: Resolver | None = None,
-) -> bool:
-    """Return ``True`` iff **every** host in ``hosts`` is unreachable.
-
-    A single reachable host is enough to disprove airgap — CLI members
-    only need one provider to be usable. Empty ``hosts`` is treated as
-    airgap by definition (no providers to reach).
-    """
-
-    hosts_list = list(hosts)
-    if not hosts_list:
-        return True
-    for host in hosts_list:
-        if probe_host(host, timeout=timeout, resolver=resolver):
-            return False
-    return True
-
-
-def recommended_member_mode(
-    *,
-    hosts: Iterable[str] = COUNCIL_PROBE_HOSTS,
-    timeout: float = DEFAULT_TIMEOUT_S,
-    resolver: Resolver | None = None,
-) -> str:
-    """Return ``"api"`` when airgapped, ``"cli"`` otherwise.
-
-    Convenience wrapper for the installer: matches the Phase 8 default
-    of ``cli`` and the Phase 11 airgap override of ``api``.
-    """
-
-    return "api" if detect_airgap(
-        hosts=hosts, timeout=timeout, resolver=resolver,
-    ) else "cli"
-
-
-def main(argv: list[str] | None = None) -> int:
-    """CLI entry-point: print recommended mode + banner if airgapped.
-
-    Used by the installer / first-run wrappers (step-9 P11): probe
-    the three provider hosts and exit ``0`` with the recommended mode
-    on stdout. When airgapped also emit the banner on stderr so the
-    installer can surface it without parsing stdout.
-    """
-
-    import argparse
-    import sys
-
-    parser = argparse.ArgumentParser(
-        description="Detect airgap state and print recommended member_mode."
-    )
-    parser.add_argument(
-        "--timeout",
-        type=float,
-        default=DEFAULT_TIMEOUT_S,
-        help=f"per-host DNS timeout in seconds (default: {DEFAULT_TIMEOUT_S})",
-    )
-    args = parser.parse_args(argv)
-
-    is_airgapped = detect_airgap(timeout=args.timeout)
-    mode = "api" if is_airgapped else "cli"
-    if is_airgapped:
-        print(AIRGAP_BANNER, file=sys.stderr)
-    print(mode)
-    return 0
-
-
-if __name__ == "__main__":
-    import sys as _sys
-
-    raise SystemExit(main(_sys.argv[1:]))

package/src/scripts/ai_council/budget_guard.py

@@ -1,202 +0,0 @@
-"""Per-day rolling cost-budget guard for the council (D3).
-
-Adds a 24h-rolling-window USD limit on top of the per-session caps in
-`orchestrator.CostBudget`. Persists a small JSONL ledger in
-``~/.event4u/agent-config/council-spend.jsonl`` (mode 0600, same
-permission discipline as the API keys). The legacy
-``~/.config/agent-config/council-spend.jsonl`` is read as a fallback so
-spend history accumulated under a pre-2.4 install is preserved across
-the namespace migration; new entries are always appended to the new
-path.
-
-Contract
-- The ledger is **append-only**. Each line is ``{"ts": ISO-8601 UTC,
-  "usd": float, "provider": str, "model": str}``.
-- ``today_spend_usd()`` sums entries within the last 24h from "now"
-  (true rolling window — not midnight UTC, never resets at boundary
-  surprise).
-- ``would_exceed(limit_usd, next_call_usd)`` returns True iff the next
-  call would push the rolling window past the limit.
-- ``record_spend(usd, provider, model)`` appends a single entry; never
-  raises on disk failure (logs to stderr, returns False).
-
-The guard is **advisory** to the orchestrator: it provides a check
-function the host agent can call before each council member; the
-orchestrator's per-session cost gate stays the primary defence.
-"""
-
-from __future__ import annotations
-
-import datetime as _dt
-import json
-import os
-import stat
-import sys
-from dataclasses import dataclass
-from pathlib import Path
-
-from scripts._lib import user_global_paths
-
-LEDGER_FILENAME = "council-spend.jsonl"
-
-#: Canonical write target under the new namespace. Reads route via
-#: :func:`_resolve_ledger_path` so a ledger still sitting in the legacy
-#: ``~/.config/agent-config/`` tree keeps contributing to the rolling
-#: window until the user migrates.
-LEDGER_PATH = user_global_paths.write_target(LEDGER_FILENAME)
-ROLLING_WINDOW_HOURS = 24
-
-
-def _resolve_ledger_path(path: Path | None) -> Path:
-    """Return the active ledger path, preferring the new namespace.
-
-    A caller-supplied ``path`` always wins (tests pin a tmp file). When
-    no override is given we prefer the new namespace, then fall back to
-    the legacy location if a ledger file already exists there. New
-    writes always target the new namespace via :data:`LEDGER_PATH`.
-    """
-    if path is not None:
-        return path
-    found = user_global_paths.resolve_with_fallback(LEDGER_FILENAME)
-    if found is not None:
-        return found
-    return LEDGER_PATH
-
-
-@dataclass
-class SpendEntry:
-    ts: _dt.datetime  # UTC, tz-aware
-    usd: float
-    provider: str
-    model: str
-
-
-def _now_utc() -> _dt.datetime:
-    return _dt.datetime.now(_dt.timezone.utc)
-
-
-def _ensure_ledger_dir(path: Path) -> bool:
-    """Create the ledger's parent directory mode 0700 if missing."""
-    try:
-        path.parent.mkdir(parents=True, exist_ok=True)
-        if (path.parent.stat().st_mode & 0o777) != 0o700:
-            try:
-                os.chmod(path.parent, 0o700)
-            except OSError:
-                # On macOS ~/.config may inherit umask perms; do not block.
-                pass
-        return True
-    except OSError as exc:  # noqa: BLE001 - never block the orchestrator
-        print(f"[council:budget_guard] mkdir failed: {exc}", file=sys.stderr)
-        return False
-
-
-def _ensure_ledger_file_mode(path: Path) -> None:
-    """Make sure an existing ledger file is mode 0600. Best-effort."""
-    if not path.exists():
-        return
-    current = path.stat().st_mode & 0o777
-    if current != 0o600:
-        try:
-            os.chmod(path, 0o600)
-        except OSError:
-            pass
-
-
-def _parse_iso(ts: str) -> _dt.datetime | None:
-    try:
-        # `fromisoformat` accepts "+00:00"; we always write with "+00:00".
-        return _dt.datetime.fromisoformat(ts)
-    except ValueError:
-        return None
-
-
-def read_entries(path: Path | None = None) -> list[SpendEntry]:
-    """Read every well-formed entry from the ledger.
-
-    Malformed lines are skipped silently. Empty/missing ledger → [].
-    Reads route through :func:`_resolve_ledger_path` so a legacy ledger
-    keeps contributing to the rolling window until the user migrates.
-    """
-    p = _resolve_ledger_path(path)
-    if not p.exists():
-        return []
-    out: list[SpendEntry] = []
-    for line in p.read_text(encoding="utf-8").splitlines():
-        line = line.strip()
-        if not line:
-            continue
-        try:
-            obj = json.loads(line)
-        except json.JSONDecodeError:
-            continue
-        ts = _parse_iso(str(obj.get("ts", "")))
-        if ts is None:
-            continue
-        try:
-            usd = float(obj.get("usd", 0))
-        except (TypeError, ValueError):
-            continue
-        out.append(SpendEntry(
-            ts=ts, usd=usd,
-            provider=str(obj.get("provider", "")),
-            model=str(obj.get("model", "")),
-        ))
-    return out
-
-
-def today_spend_usd(
-    *,
-    path: Path | None = None,
-    now: _dt.datetime | None = None,
-    window_hours: int = ROLLING_WINDOW_HOURS,
-) -> float:
-    """Sum of USD spent in the last `window_hours` (rolling window)."""
-    cutoff = (now or _now_utc()) - _dt.timedelta(hours=window_hours)
-    return sum(e.usd for e in read_entries(path) if e.ts >= cutoff)
-
-
-def would_exceed(
-    limit_usd: float,
-    next_call_usd: float,
-    *,
-    path: Path | None = None,
-    now: _dt.datetime | None = None,
-    window_hours: int = ROLLING_WINDOW_HOURS,
-) -> bool:
-    """True iff appending `next_call_usd` would push the window past `limit_usd`.
-
-    `limit_usd <= 0` disables the guard (returns False). Mirrors the
-    `CostBudget.max_total_usd` convention.
-    """
-    if limit_usd <= 0:
-        return False
-    spent = today_spend_usd(path=path, now=now, window_hours=window_hours)
-    return (spent + next_call_usd) > limit_usd
-
-
-def record_spend(
-    usd: float,
-    provider: str,
-    model: str,
-    *,
-    path: Path | None = None,
-    now: _dt.datetime | None = None,
-) -> bool:
-    """Append one entry to the ledger. Returns True on success."""
-    if usd <= 0:
-        return True  # zero-cost calls (manual mode) skip the ledger
-    p = path or LEDGER_PATH
-    if not _ensure_ledger_dir(p):
-        return False
-    ts = (now or _now_utc()).isoformat()
-    entry = json.dumps({"ts": ts, "usd": round(usd, 6),
-                        "provider": provider, "model": model}) + "\n"
-    try:
-        with p.open("a", encoding="utf-8") as fh:
-            fh.write(entry)
-    except OSError as exc:  # noqa: BLE001 - never block the orchestrator
-        print(f"[council:budget_guard] write failed: {exc}", file=sys.stderr)
-        return False
-    _ensure_ledger_file_mode(p)
-    return True