devrites 3.0.7 → 3.2.0

package/scripts/live-hosts/claude.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+# shellcheck disable=SC1091
+source "$DIR/common.sh"
+CONTRACT_HELPER="$DIR/host-transport.py"
+
+case "${1:-}" in
+  version)
+    contract_version claude
+    ;;
+  run)
+    ;;
+  *)
+    contract_die "expected version or run"
+    ;;
+esac
+
+contract_prepare_run
+if [ -n "${DEVRITES_CONTRACT_FAKE_HOST:-}" ]; then
+  contract_run_fake
+fi
+contract_read_auth
+actual_version="$(env -i "PATH=$PATH" "LANG=C" "LC_ALL=C" claude --version 2>/dev/null)" \
+  || contract_die "Claude version preflight failed"
+[ "$actual_version" = "$DEVRITES_CONTRACT_HOST_VERSION_PIN" ] \
+  || contract_die "Claude version pin changed"
+
+simulate="$(python3 "$CONTRACT_HELPER" field simulate)"
+role_class="$(python3 "$CONTRACT_HELPER" field role_class)"
+tools="Agent,Read,Glob,Grep"
+if [ "$role_class" = "wright" ]; then
+  tools="$tools,Edit,Write,Bash"
+fi
+if [ "$simulate" = "inline-fallback" ]; then
+  tools="Read,Glob,Grep"
+fi
+schema="$(cat "$DIR/agent-result.schema.json")"
+mkdir -p "$XDG_CONFIG_HOME/claude"
+
+trap 'contract_interrupt_result; exit 130' INT TERM
+cd "$DEVRITES_ROOT"
+set +e
+env -i \
+  "PATH=$PATH" "LANG=C" "LC_ALL=C" "PYTHONDONTWRITEBYTECODE=1" \
+  "DEVRITES_CONTRACT_PACKET=$DEVRITES_CONTRACT_PACKET" \
+  python3 "$CONTRACT_HELPER" render |
+  env -i \
+    "PATH=$PATH" "LANG=C" "LC_ALL=C" \
+    "HOME=$HOME" "TMPDIR=$TMPDIR" \
+    "XDG_CONFIG_HOME=$XDG_CONFIG_HOME" "XDG_STATE_HOME=$XDG_STATE_HOME" \
+    "CLAUDE_CONFIG_DIR=$XDG_CONFIG_HOME/claude" \
+    "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1" \
+    "ANTHROPIC_API_KEY=$CONTRACT_AUTH_VALUE" \
+    "DEVRITES_ROOT=$DEVRITES_ROOT" \
+    "DEVRITES_AGENT_SCRATCH=$DEVRITES_AGENT_SCRATCH" \
+    "DEVRITES_RUN_ID=$DEVRITES_RUN_ID" \
+    claude -p \
+      --output-format json \
+      --json-schema "$schema" \
+      --model "$DEVRITES_CONTRACT_MODEL" \
+      --max-budget-usd "$DEVRITES_CONTRACT_MAX_COST_USD" \
+      --permission-mode dontAsk \
+      --tools "$tools" \
+      --setting-sources project \
+      --settings '{}' \
+      --strict-mcp-config \
+      --mcp-config '{"mcpServers":{}}' \
+      --no-chrome \
+      --no-session-persistence |
+  env -i \
+    "PATH=$PATH" "LANG=C" "LC_ALL=C" "PYTHONDONTWRITEBYTECODE=1" \
+    "DEVRITES_CONTRACT_PACKET=$DEVRITES_CONTRACT_PACKET" \
+    "DEVRITES_CONTRACT_RESULT=$DEVRITES_CONTRACT_RESULT" \
+    "DEVRITES_CONTRACT_HOST_VERSION_PIN=$DEVRITES_CONTRACT_HOST_VERSION_PIN" \
+    "DEVRITES_CONTRACT_MODEL=$DEVRITES_CONTRACT_MODEL" \
+    python3 "$CONTRACT_HELPER" normalize
+pipeline=("${PIPESTATUS[@]}")
+set -e
+host_rc="${pipeline[1]:-2}"
+normalize_rc="${pipeline[2]:-2}"
+[ "$normalize_rc" -eq 0 ] || exit 2
+if [ "$host_rc" -eq 130 ]; then
+  contract_interrupt_result
+fi
+exit "$host_rc"

package/scripts/live-hosts/codex.sh

@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+# shellcheck disable=SC1091
+source "$DIR/common.sh"
+CONTRACT_HELPER="$DIR/host-transport.py"
+
+case "${1:-}" in
+  version)
+    contract_version codex
+    ;;
+  run)
+    ;;
+  *)
+    contract_die "expected version or run"
+    ;;
+esac
+
+contract_prepare_run
+if [ -n "${DEVRITES_CONTRACT_FAKE_HOST:-}" ]; then
+  contract_run_fake
+fi
+contract_read_auth
+actual_version="$(env -i "PATH=$PATH" "LANG=C" "LC_ALL=C" codex --version 2>/dev/null)" \
+  || contract_die "Codex version preflight failed"
+[ "$actual_version" = "$DEVRITES_CONTRACT_HOST_VERSION_PIN" ] \
+  || contract_die "Codex version pin changed"
+
+role_class="$(python3 "$CONTRACT_HELPER" field role_class)"
+sandbox="read-only"
+if [ "$role_class" = "wright" ]; then
+  sandbox="workspace-write"
+fi
+mkdir -p "$XDG_CONFIG_HOME/codex"
+
+trap 'contract_interrupt_result; exit 130' INT TERM
+cd "$DEVRITES_ROOT"
+set +e
+env -i \
+  "PATH=$PATH" "LANG=C" "LC_ALL=C" "PYTHONDONTWRITEBYTECODE=1" \
+  "DEVRITES_CONTRACT_PACKET=$DEVRITES_CONTRACT_PACKET" \
+  python3 "$CONTRACT_HELPER" render |
+  env -i \
+    "PATH=$PATH" "LANG=C" "LC_ALL=C" \
+    "HOME=$HOME" "TMPDIR=$TMPDIR" \
+    "XDG_CONFIG_HOME=$XDG_CONFIG_HOME" "XDG_STATE_HOME=$XDG_STATE_HOME" \
+    "CODEX_HOME=$XDG_CONFIG_HOME/codex" \
+    "OPENAI_API_KEY=$CONTRACT_AUTH_VALUE" \
+    "DEVRITES_ROOT=$DEVRITES_ROOT" \
+    "DEVRITES_AGENT_SCRATCH=$DEVRITES_AGENT_SCRATCH" \
+    "DEVRITES_RUN_ID=$DEVRITES_RUN_ID" \
+    codex exec \
+      --json \
+      --ephemeral \
+      --strict-config \
+      --ignore-user-config \
+      --skip-git-repo-check \
+      --dangerously-bypass-hook-trust \
+      --sandbox "$sandbox" \
+      --model "$DEVRITES_CONTRACT_MODEL" \
+      --output-schema "$DIR/agent-result.schema.json" \
+      -c shell_environment_policy.inherit=none \
+      -C "$DEVRITES_ROOT" \
+      - |
+  env -i \
+    "PATH=$PATH" "LANG=C" "LC_ALL=C" "PYTHONDONTWRITEBYTECODE=1" \
+    "DEVRITES_CONTRACT_PACKET=$DEVRITES_CONTRACT_PACKET" \
+    "DEVRITES_CONTRACT_RESULT=$DEVRITES_CONTRACT_RESULT" \
+    "DEVRITES_CONTRACT_HOST_VERSION_PIN=$DEVRITES_CONTRACT_HOST_VERSION_PIN" \
+    "DEVRITES_CONTRACT_MODEL=$DEVRITES_CONTRACT_MODEL" \
+    python3 "$CONTRACT_HELPER" normalize
+pipeline=("${PIPESTATUS[@]}")
+set -e
+host_rc="${pipeline[1]:-2}"
+normalize_rc="${pipeline[2]:-2}"
+[ "$normalize_rc" -eq 0 ] || exit 2
+if [ "$host_rc" -eq 130 ]; then
+  contract_interrupt_result
+fi
+exit "$host_rc"

package/scripts/live-hosts/common.sh

@@ -0,0 +1,113 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+contract_die() {
+  printf '%s\n' "agent-contract host wrapper: $1" >&2
+  exit 2
+}
+
+contract_require() {
+  local name="$1"
+  [ -n "${!name:-}" ] || contract_die "missing isolated run input"
+}
+
+contract_path_within() {
+  local child="$1" parent="$2"
+  case "$child/" in
+    "$parent"/*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+contract_prepare_run() {
+  local name
+  for name in \
+    HOME TMPDIR XDG_CONFIG_HOME XDG_STATE_HOME \
+    DEVRITES_ROOT DEVRITES_AGENT_SCRATCH DEVRITES_RUN_ID \
+    DEVRITES_CONTRACT_RUN_ROOT DEVRITES_CONTRACT_PACKET \
+    DEVRITES_CONTRACT_RESULT DEVRITES_CONTRACT_HOST \
+    DEVRITES_CONTRACT_HOST_VERSION_PIN DEVRITES_CONTRACT_MODEL \
+    DEVRITES_CONTRACT_AUTH_FILE DEVRITES_CONTRACT_MAX_COST_USD
+  do
+    contract_require "$name"
+  done
+  for name in \
+    "$HOME" "$TMPDIR" "$XDG_CONFIG_HOME" "$XDG_STATE_HOME" \
+    "$DEVRITES_ROOT" "$DEVRITES_AGENT_SCRATCH"
+  do
+    contract_path_within "$name" "$DEVRITES_CONTRACT_RUN_ROOT" \
+      || contract_die "isolated root escaped the run directory"
+  done
+  contract_path_within "$DEVRITES_CONTRACT_PACKET" "$DEVRITES_AGENT_SCRATCH" \
+    || contract_die "packet escaped the scratch root"
+  contract_path_within "$DEVRITES_CONTRACT_RESULT" "$DEVRITES_AGENT_SCRATCH" \
+    || contract_die "result escaped the scratch root"
+  [ -f "$DEVRITES_CONTRACT_PACKET" ] || contract_die "packet is unavailable"
+  [ -f "$DEVRITES_CONTRACT_AUTH_FILE" ] || contract_die "scoped auth is unavailable"
+}
+
+contract_read_auth() {
+  local mode
+  if mode="$(stat -f '%Lp' "$DEVRITES_CONTRACT_AUTH_FILE" 2>/dev/null)"; then
+    :
+  else
+    mode="$(stat -c '%a' "$DEVRITES_CONTRACT_AUTH_FILE" 2>/dev/null)" \
+      || contract_die "cannot inspect scoped auth"
+  fi
+  [ "$mode" = "600" ] || contract_die "scoped auth must be mode 0600"
+  IFS= read -r CONTRACT_AUTH_VALUE < "$DEVRITES_CONTRACT_AUTH_FILE" \
+    || contract_die "scoped auth is empty"
+  [ -n "$CONTRACT_AUTH_VALUE" ] || contract_die "scoped auth is empty"
+}
+
+contract_run_fake() {
+  local -a env_args=(
+    "PATH=$PATH"
+    "LANG=C"
+    "LC_ALL=C"
+    "HOME=$HOME"
+    "TMPDIR=$TMPDIR"
+    "XDG_CONFIG_HOME=$XDG_CONFIG_HOME"
+    "XDG_STATE_HOME=$XDG_STATE_HOME"
+    "PYTHONDONTWRITEBYTECODE=1"
+    "DEVRITES_ROOT=$DEVRITES_ROOT"
+    "DEVRITES_AGENT_SCRATCH=$DEVRITES_AGENT_SCRATCH"
+    "DEVRITES_RUN_ID=$DEVRITES_RUN_ID"
+    "DEVRITES_CONTRACT_RUN_ROOT=$DEVRITES_CONTRACT_RUN_ROOT"
+    "DEVRITES_CONTRACT_PACKET=$DEVRITES_CONTRACT_PACKET"
+    "DEVRITES_CONTRACT_RESULT=$DEVRITES_CONTRACT_RESULT"
+    "DEVRITES_CONTRACT_HOST=$DEVRITES_CONTRACT_HOST"
+    "DEVRITES_CONTRACT_HOST_VERSION_PIN=$DEVRITES_CONTRACT_HOST_VERSION_PIN"
+    "DEVRITES_CONTRACT_MODEL=$DEVRITES_CONTRACT_MODEL"
+    "DEVRITES_CONTRACT_AUTH_FILE=$DEVRITES_CONTRACT_AUTH_FILE"
+    "DEVRITES_CONTRACT_MAX_COST_USD=$DEVRITES_CONTRACT_MAX_COST_USD"
+    "DEVRITES_CONTRACT_FAKE_VERSION=$DEVRITES_CONTRACT_FAKE_VERSION"
+  )
+  if [ -n "${DEVRITES_CONTRACT_FAKE_FAULT:-}" ]; then
+    env_args+=("DEVRITES_CONTRACT_FAKE_FAULT=$DEVRITES_CONTRACT_FAKE_FAULT")
+  fi
+  exec env -i "${env_args[@]}" python3 "$DEVRITES_CONTRACT_FAKE_HOST" run
+}
+
+contract_version() {
+  local binary="$1"
+  if [ -n "${DEVRITES_CONTRACT_FAKE_HOST:-}" ]; then
+    contract_require DEVRITES_CONTRACT_FAKE_VERSION
+    exec env -i \
+      "PATH=$PATH" "LANG=C" "LC_ALL=C" \
+      "DEVRITES_CONTRACT_FAKE_VERSION=$DEVRITES_CONTRACT_FAKE_VERSION" \
+      python3 "$DEVRITES_CONTRACT_FAKE_HOST" version
+  fi
+  command -v "$binary" >/dev/null 2>&1 || contract_die "host CLI is unavailable"
+  exec env -i "PATH=$PATH" "LANG=C" "LC_ALL=C" "$binary" --version
+}
+
+contract_interrupt_result() {
+  env -i \
+    "PATH=$PATH" "LANG=C" "LC_ALL=C" "PYTHONDONTWRITEBYTECODE=1" \
+    "DEVRITES_CONTRACT_PACKET=$DEVRITES_CONTRACT_PACKET" \
+    "DEVRITES_CONTRACT_RESULT=$DEVRITES_CONTRACT_RESULT" \
+    "DEVRITES_CONTRACT_HOST_VERSION_PIN=$DEVRITES_CONTRACT_HOST_VERSION_PIN" \
+    "DEVRITES_CONTRACT_MODEL=$DEVRITES_CONTRACT_MODEL" \
+    python3 "$CONTRACT_HELPER" interrupted >/dev/null 2>&1 || true
+}

package/scripts/live-hosts/fake-host.py

@@ -0,0 +1,264 @@
+#!/usr/bin/env python3
+"""Provide a deterministic fake for the agent-contract host wrappers."""
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import stat
+import sys
+from pathlib import Path
+from typing import Any
+
+
+MANDATORY_SIGNALS = {
+    "auth_preflight",
+    "budget_bound",
+    "cleanup_ready",
+    "environment_allowlisted",
+    "mcp_absent",
+    "plugins_absent",
+    "roots_isolated",
+    "shell_startup_ignored",
+    "version_pinned",
+}
+ALLOWED_ENV = {
+    "DEVRITES_AGENT_SCRATCH",
+    "DEVRITES_CONTRACT_AUTH_FILE",
+    "DEVRITES_CONTRACT_FAKE_FAULT",
+    "DEVRITES_CONTRACT_FAKE_VERSION",
+    "DEVRITES_CONTRACT_HOST",
+    "DEVRITES_CONTRACT_HOST_VERSION_PIN",
+    "DEVRITES_CONTRACT_MAX_COST_USD",
+    "DEVRITES_CONTRACT_MODEL",
+    "DEVRITES_CONTRACT_PACKET",
+    "DEVRITES_CONTRACT_RESULT",
+    "DEVRITES_CONTRACT_RUN_ROOT",
+    "DEVRITES_ROOT",
+    "DEVRITES_RUN_ID",
+    "HOME",
+    "LANG",
+    "LC_ALL",
+    "PATH",
+    "PYTHONDONTWRITEBYTECODE",
+    "TMPDIR",
+    "XDG_CONFIG_HOME",
+    "XDG_STATE_HOME",
+}
+
+
+def canonical(value: Any) -> bytes:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=True).encode()
+
+
+def digest(value: bytes) -> str:
+    return hashlib.sha256(value).hexdigest()
+
+
+def env_path(name: str) -> Path:
+    value = os.environ.get(name, "")
+    if not value:
+        raise ValueError(f"missing {name}")
+    return Path(value).resolve()
+
+
+def contained(path: Path, root: Path) -> bool:
+    return path == root or root in path.parents
+
+
+def secure_auth(path: Path) -> bool:
+    try:
+        info = path.lstat()
+        return (
+            stat.S_ISREG(info.st_mode)
+            and not stat.S_ISLNK(info.st_mode)
+            and stat.S_IMODE(info.st_mode) == 0o600
+            and 0 < info.st_size <= 64 * 1024
+        )
+    except OSError:
+        return False
+
+
+def hermetic_signals(packet: dict[str, Any]) -> set[str]:
+    run_root = env_path("DEVRITES_CONTRACT_RUN_ROOT")
+    roots = [
+        env_path("DEVRITES_ROOT"),
+        env_path("DEVRITES_AGENT_SCRATCH"),
+        env_path("HOME"),
+        env_path("TMPDIR"),
+        env_path("XDG_CONFIG_HOME"),
+        env_path("XDG_STATE_HOME"),
+    ]
+    signals: set[str] = set()
+    visible_env = set(os.environ) - {"PWD", "OLDPWD", "SHLVL", "_", "__CF_USER_TEXT_ENCODING"}
+    if visible_env <= ALLOWED_ENV:
+        signals.add("environment_allowlisted")
+    if len(set(roots)) == len(roots) and all(contained(path, run_root) for path in roots):
+        signals.add("roots_isolated")
+    if "BASH_ENV" not in os.environ and "ENV" not in os.environ:
+        signals.add("shell_startup_ignored")
+    config_roots = [env_path("HOME"), env_path("XDG_CONFIG_HOME")]
+    names = [path.name.lower() for root in config_roots for path in root.rglob("*")]
+    if not any("plugin" in name for name in names):
+        signals.add("plugins_absent")
+    if not any("mcp" in name for name in names):
+        signals.add("mcp_absent")
+    if secure_auth(env_path("DEVRITES_CONTRACT_AUTH_FILE")):
+        signals.add("auth_preflight")
+    budgets = packet.get("budgets", {})
+    if all(isinstance(budgets.get(key), int) and budgets[key] > 0 for key in (
+        "max_files",
+        "max_loaded_lines",
+        "max_result_lines",
+    )):
+        signals.add("budget_bound")
+    if (
+        os.environ.get("DEVRITES_CONTRACT_HOST_VERSION_PIN")
+        == os.environ.get("DEVRITES_CONTRACT_FAKE_VERSION")
+    ):
+        signals.add("version_pinned")
+    if contained(env_path("DEVRITES_CONTRACT_RESULT"), env_path("DEVRITES_AGENT_SCRATCH")):
+        signals.add("cleanup_ready")
+    return signals
+
+
+def mode_and_reasons(simulate: str) -> tuple[str, str, bool, str, str, str]:
+    mode = "named"
+    guard = "enforced"
+    independence = True
+    dispatch = "DRV-AGENT-NAMED"
+    result = "DRV-AGENT-RESULT-ACCEPTED"
+    outcome = "passed"
+    if simulate == "generic-fallback":
+        mode = "generic"
+        dispatch = "DRV-AGENT-GENERIC-FALLBACK"
+    elif simulate == "inline-fallback":
+        mode = "inline"
+        guard = "observed"
+        independence = False
+        dispatch = "DRV-AGENT-INLINE-FALLBACK"
+    elif simulate in {"reviewer-denied", "wright-denied"}:
+        result = "DRV-AGENT-RESULT-OUT-OF-SCOPE"
+        outcome = "denied"
+    elif simulate == "interrupted":
+        result = "DRV-AGENT-UNAVAILABLE"
+        outcome = "unavailable"
+    return mode, guard, independence, dispatch, result, outcome
+
+
+def run() -> int:
+    packet_path = env_path("DEVRITES_CONTRACT_PACKET")
+    result_path = env_path("DEVRITES_CONTRACT_RESULT")
+    packet = json.loads(packet_path.read_text(encoding="utf-8"))
+    simulate = packet["simulate"]
+    fault = os.environ.get("DEVRITES_CONTRACT_FAKE_FAULT", "")
+    if simulate == "missing":
+        return 0
+    if simulate == "malformed":
+        result_path.write_text("not-json-compatible-yaml\n", encoding="utf-8")
+        return 0
+
+    writes: list[dict[str, str]] = []
+    signals = hermetic_signals(packet)
+    if simulate == "write-allowed":
+        relative = packet["scope"]["allowed_repo_writes"][0]
+        target = env_path("DEVRITES_ROOT") / relative
+        target.parent.mkdir(parents=True, exist_ok=True)
+        content = b"synthetic contract write\n"
+        target.write_bytes(content)
+        writes.append({"path": relative, "kind": "file", "sha256": digest(content)})
+        signals.add("declared_side_effects")
+    elif simulate == "generic-fallback":
+        signals.add("fresh_context")
+    elif simulate == "inline-fallback":
+        signals.add("inline_labelled")
+    elif simulate == "reviewer-denied":
+        signals.add("mutation_denied")
+    elif simulate == "wright-denied":
+        signals.add("scope_denied")
+    elif simulate == "session-start":
+        signals.add("session_start_oriented")
+    elif simulate == "post-compaction":
+        signals.add("resume_cursor_reinjected")
+    elif simulate == "interrupted":
+        signals.update({"progress_recorded", "partial_metadata"})
+
+    mode, guard, independence, dispatch, result_reason, outcome = mode_and_reasons(simulate)
+    status = "blocked" if outcome == "denied" else "complete"
+    sentinel = "complete"
+    if simulate == "interrupted":
+        status = "partial"
+        sentinel = "interrupted"
+    run_id = packet["run_id"]
+    if fault == "identity-mismatch":
+        run_id = "drv-run-v1:" + "0" * 32
+        if run_id == packet["run_id"]:
+            run_id = "drv-run-v1:" + "1" * 32
+    if fault == "escape-write":
+        target = env_path("DEVRITES_ROOT") / "src" / "escape.txt"
+        target.write_text("undeclared fake-host write\n", encoding="utf-8")
+    if fault == "privacy-leak":
+        signals.add("/operator/private/path")
+    baseline_id = packet["baseline"]["id"]
+    if simulate == "stale":
+        baseline_id += ":stale"
+
+    result = {
+        "result_version": packet["result_schema"],
+        "run_id": run_id,
+        "cell_id": packet["cell_id"],
+        "host": packet["host"],
+        "role": packet["role"],
+        "status": status,
+        "baseline_id": baseline_id,
+        "scope_id": packet["scope"]["id"],
+        "budget": {
+            "files_used": 1 if writes else 0,
+            "loaded_lines_used": 1,
+            "result_lines_used": 1,
+        },
+        "side_effects": {
+            "repo_writes": writes,
+            "scratch_write_count": 1,
+        },
+        "payload_type": "wright-report" if packet["role_class"] == "wright" else "review-findings",
+        "execution": {
+            "mode": mode,
+            "guard_strength": guard,
+            "independence": independence,
+        },
+        "signals": sorted(signals),
+        "usage": {
+            "input_tokens": 0,
+            "output_tokens": 0,
+            "cost_usd": "999" if fault == "cost-overrun" else "0",
+        },
+        "dispatch_reason_id": dispatch,
+        "result_reason_id": result_reason,
+        "outcome": outcome,
+        "terminal_sentinel": sentinel,
+        "host_version": os.environ["DEVRITES_CONTRACT_HOST_VERSION_PIN"],
+        "model": os.environ["DEVRITES_CONTRACT_MODEL"],
+    }
+    result_path.write_bytes(canonical(result) + b"\n")
+    result_path.chmod(0o600)
+    return 130 if simulate == "interrupted" else 0
+
+
+def main() -> int:
+    if len(sys.argv) == 2 and sys.argv[1] == "version":
+        version = os.environ.get("DEVRITES_CONTRACT_FAKE_VERSION", "")
+        if not version:
+            return 2
+        print(version)
+        return 0
+    if len(sys.argv) == 2 and sys.argv[1] == "run":
+        try:
+            return run()
+        except (KeyError, OSError, ValueError, json.JSONDecodeError):
+            return 2
+    return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())