10xscale-agentflow-cli 0.4.0__tar.gz → 0.5.0__tar.gz

{10xscale_agentflow_cli-0.4.0 → 10xscale_agentflow_cli-0.5.0}/10xscale_agentflow_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: 10xscale-agentflow-cli
-Version: 0.4.0
+Version: 0.5.0
 Summary: CLI and API for 10xscale AgentFlow
 Author-email: 10xscale <contact@10xscale.ai>
 Maintainer-email: Shudipto Trafder <shudiptotrafder@gmail.com>
@@ -22,7 +22,7 @@ Classifier: Topic :: Internet :: WWW/HTTP :: HTTP Servers
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: 10xscale-agentflow>=0.8.0
+Requires-Dist: 10xscale-agentflow>=0.9.0
 Requires-Dist: fastapi
 Requires-Dist: gunicorn
 Requires-Dist: orjson

{10xscale_agentflow_cli-0.4.0 → 10xscale_agentflow_cli-0.5.0}/10xscale_agentflow_cli.egg-info/SOURCES.txt

@@ -1,4 +1,8 @@
+AGENTFLOW_JSON.md
+AUTHORIZATION_PLAN.md
+AUTHORIZATION_PLAN_PHASE2.md
 CLAUDE.md
+CUSTOM_AUTH.md
 LICENSE
 MANIFEST.in
 README.md
@@ -104,7 +108,9 @@ agentflow_cli/src/app/core/auth/auth_backend.py
 agentflow_cli/src/app/core/auth/authorization.py
 agentflow_cli/src/app/core/auth/base_auth.py
 agentflow_cli/src/app/core/auth/jwt_auth.py
+agentflow_cli/src/app/core/auth/ownership_resolver.py
 agentflow_cli/src/app/core/auth/permissions.py
+agentflow_cli/src/app/core/auth/route_guard.py
 agentflow_cli/src/app/core/config/__init__.py
 agentflow_cli/src/app/core/config/graph_config.py
 agentflow_cli/src/app/core/config/media_settings.py
@@ -140,6 +146,10 @@ agentflow_cli/src/app/routers/checkpointer/schemas/__init__.py
 agentflow_cli/src/app/routers/checkpointer/schemas/checkpointer_schemas.py
 agentflow_cli/src/app/routers/checkpointer/services/__init__.py
 agentflow_cli/src/app/routers/checkpointer/services/checkpointer_service.py
+agentflow_cli/src/app/routers/evals/__init__.py
+agentflow_cli/src/app/routers/evals/router.py
+agentflow_cli/src/app/routers/evals/services/__init__.py
+agentflow_cli/src/app/routers/evals/services/eval_report_service.py
 agentflow_cli/src/app/routers/graph/__init__.py
 agentflow_cli/src/app/routers/graph/realtime_guard.py
 agentflow_cli/src/app/routers/graph/router.py
@@ -167,6 +177,7 @@ agentflow_cli/src/app/utils/parse_output.py
 agentflow_cli/src/app/utils/response_helper.py
 agentflow_cli/src/app/utils/snowflake_id_generator.py
 agentflow_cli/src/app/utils/swagger_helper.py
+agentflow_cli/src/app/utils/telemetry_store.py
 agentflow_cli/src/app/utils/thread_name_generator.py
 agentflow_cli/src/app/utils/media/__init__.py
 agentflow_cli/src/app/utils/media/extractor.py
@@ -174,6 +185,12 @@ agentflow_cli/src/app/utils/media/pipeline.py
 agentflow_cli/src/app/utils/schemas/__init__.py
 agentflow_cli/src/app/utils/schemas/output_schemas.py
 agentflow_cli/src/app/utils/schemas/user_schemas.py
+graph/__init__.py
+graph/dummy_store.py
+graph/fake_realtime_client.py
+graph/live.py
+graph/react.py
+graph/thread_name_generator.py
 tests/test_multimodal_sprint2_extraction.py
 tests/test_sprint4_media_api.py
 tests/test_utils_parse_and_callable.py

{10xscale_agentflow_cli-0.4.0 → 10xscale_agentflow_cli-0.5.0}/10xscale_agentflow_cli.egg-info/requires.txt

@@ -1,4 +1,4 @@
-10xscale-agentflow>=0.8.0
+10xscale-agentflow>=0.9.0
 fastapi
 gunicorn
 orjson

10xscale_agentflow_cli-0.5.0/AGENTFLOW_JSON.md

@@ -0,0 +1,273 @@
+# `agentflow.json` — Configuration Reference
+
+This is the only file you write to turn your compiled graph into a running API server.
+`agentflow api` reads it, resolves each key, and boots FastAPI + WebSocket around your graph.
+
+Every key except `agent` is optional. Secrets never live here — they stay in the environment
+(loaded from the file named by `env`).
+
+---
+
+## Minimal (development)
+
+```json
+{
+  "agent": "graph.react:app"
+}
+```
+
+`agent` points at a compiled graph; everything else defaults. No auth, in-memory everything,
+allow-all authorization. Enough to run locally.
+
+---
+
+## Full shape
+
+```json
+{
+  "agent": "graph.react:app",
+  "env": ".env",
+
+  "auth": null,
+  "authorization": null,
+
+  "checkpointer": null,
+  "store": null,
+  "redis": null,
+
+  "injectq": null,
+  "thread_name_generator": null,
+
+  "rate_limit": {},
+  "websocket": {},
+  "observability": null
+}
+```
+
+---
+
+## Keys
+
+### `agent` (required)
+`"module:attribute"` resolving to a `CompiledGraph`. The loader accepts a `CompiledGraph`
+object, or a sync/async factory that returns one.
+
+```json
+"agent": "graph.react:app"
+```
+
+### `env`
+Path to a `.env` file, loaded at config-load time. Put all secrets here (JWT key, DB URLs,
+API keys). Never inline secrets in this JSON.
+
+```json
+"env": ".env"
+```
+
+### `auth` — who is the caller? (authentication)
+Produces a `user` dict with at least `user_id`. Three forms:
+
+| Value | Meaning |
+|---|---|
+| `null` | No authentication. All endpoints run unauthenticated (dev). |
+| `"jwt"` | Built-in JWT bearer auth. Requires `JWT_SECRET_KEY` + `JWT_ALGORITHM` in env (fails at boot if missing). Token must carry `user_id` and `exp`. |
+| `{"method": "custom", "path": "auth.backend:MyAuth"}` | Your own `BaseAuth` subclass (`from agentflow_cli import BaseAuth`). |
+
+```json
+"auth": "jwt"
+```
+
+### `authorization` — what may the caller do? (authorization)
+Separate from `auth`. Controls object-level access (thread ownership), per-endpoint scopes,
+and storage isolation. Four forms:
+
+| Value | Meaning |
+|---|---|
+| `null` | **Mode-based default**: `ownership` in production, `allow_all` in development. |
+| `"ownership"` | Owner-only: a thread is readable/runnable only by the user who created it. Enforced on every thread-touching endpoint (invoke/stream/stop/fix + all checkpointer ops). |
+| `"allow_all"` (aliases `"default"`, `"none"`) | Any authenticated user may do anything. |
+| `"auth.backend:MyBackend"` | Your own `AuthorizationBackend` subclass. |
+| `{...}` (object) | RBAC — see below. |
+
+Plain owner-only:
+```json
+"authorization": "ownership"
+```
+
+RBAC (roles → scopes, on top of owner-only isolation):
+```json
+"authorization": {
+  "backend": "rbac",
+  "roles": {
+    "admin":  ["*"],
+    "member": ["graph:invoke", "graph:stream", "graph:read", "checkpointer:read"]
+  },
+  "default_scopes": ["graph:read"],
+  "isolation": "owner"
+}
+```
+
+- `roles` — map each role (from the user's `roles`/`role` claim) to the scopes it grants.
+  `"*"` grants every scope.
+- `default_scopes` — granted to everyone, even a user with no role.
+- `isolation` — `"owner"` (owner-only storage, default) or `"none"` (any authenticated user
+  sees all rows).
+
+Available scopes (`"<resource>:<action>"`):
+
+| Resource | Scopes |
+|---|---|
+| graph | `graph:invoke`, `graph:stream`, `graph:stop`, `graph:fix`, `graph:setup`, `graph:read` |
+| checkpointer | `checkpointer:read`, `checkpointer:write`, `checkpointer:delete` |
+| memory (store) | `memory:read`, `memory:write`, `memory:delete` |
+| files | `files:read`, `files:upload` |
+| config | `config:read` |
+
+Scopes are only enforced once an identity actually carries scopes (an RBAC role, or a JWT
+`scopes` claim). Without them the server stays permissive — nothing breaks until you issue
+scopes.
+
+### `checkpointer` — durable thread state
+`"module:attr"` resolving to a `BaseCheckpointer`. Omit for in-memory (state lost on restart).
+Ownership-based authorization requires a checkpointer that can resolve thread owners
+(Postgres/SQLite/in-memory all do; a bare base does not).
+
+```json
+"checkpointer": "graph.infra:checkpointer"
+```
+
+### `store` — long-term memory (vector store)
+`"module:attr"` resolving to a `BaseStore` (Qdrant, Mem0, ...). Powers `/v1/store/*`. Scoped
+per-user according to the active authorization isolation policy.
+
+```json
+"store": "graph.infra:store"
+```
+
+### `redis`
+Redis URL. Shared by the rate-limiter (redis backend) and the ownership-cache L2 tier (so
+ownership lookups are shared across workers instead of per-process).
+
+```json
+"redis": "redis://localhost:6379/0"
+```
+
+### `injectq`
+`"module:attr"` resolving to an InjectQ container, if you want to pre-bind dependencies
+(db handles, config, `user_id`) for injection into your tools.
+
+### `thread_name_generator`
+`"module:attr"` resolving to a `ThreadNameGenerator` — auto-names new threads.
+
+### `rate_limit`
+Object. Omit or `{"enabled": false}` to disable.
+
+```json
+"rate_limit": {
+  "enabled": true,
+  "backend": "redis",
+  "requests": 100,
+  "window": 60,
+  "by": "ip",
+  "trusted_proxy_headers": true,
+  "trusted_proxy_hops": 1,
+  "exclude_paths": ["/ping"],
+  "fail_open": true,
+  "redis": { "url": "redis://localhost:6379/0", "prefix": "agentflow:rate-limit" }
+}
+```
+
+| Field | Default | Notes |
+|---|---|---|
+| `enabled` | `true` | |
+| `backend` | `"memory"` | `memory` \| `redis` \| `custom`. **`memory` counts per process — use `redis` for multi-worker.** For `custom`, bind a `BaseRateLimitBackend` in InjectQ. |
+| `requests` | `100` | Allowed requests per window. |
+| `window` | `60` | Window length in seconds. |
+| `by` | `"ip"` | `ip` \| `user` \| `global`. |
+| `trusted_proxy_headers` | `false` | Honour `X-Forwarded-For` only when `true` (i.e. behind a proxy you control). |
+| `trusted_proxy_hops` | `1` | How many proxies you control appended to `X-Forwarded-For`; entries left of these are forgeable. |
+| `exclude_paths` | `[]` | Paths exempt from limiting. |
+| `fail_open` | `true` | On backend error: `true` = allow, `false` = deny. |
+
+### `websocket`
+Per-process cap on concurrent WebSocket connections (`/v1/graph/ws`, `/v1/graph/live`).
+`null`/`0` = unlimited.
+
+```json
+"websocket": { "max_connections": 100 }
+```
+
+### `observability`
+Declarative Logfire / LangSmith wiring. Tokens (`LOGFIRE_TOKEN`, `LANGSMITH_API_KEY`) stay in
+the environment.
+
+```json
+"observability": {
+  "level": "standard",
+  "logfire":   { "enabled": true, "service_name": "my-agent" },
+  "langsmith": { "enabled": true, "project": "my-agent", "endpoint": null }
+}
+```
+
+---
+
+## Production example
+
+```json
+{
+  "agent": "graph.react:app",
+  "env": ".env",
+
+  "auth": "jwt",
+  "authorization": {
+    "backend": "rbac",
+    "roles": {
+      "admin":  ["*"],
+      "member": ["graph:invoke", "graph:stream", "graph:read", "checkpointer:read", "memory:read", "memory:write"]
+    },
+    "default_scopes": [],
+    "isolation": "owner"
+  },
+
+  "checkpointer": "graph.infra:checkpointer",
+  "store": "graph.infra:store",
+  "redis": "redis://redis:6379/0",
+
+  "rate_limit": {
+    "enabled": true,
+    "backend": "redis",
+    "requests": 100,
+    "window": 60,
+    "by": "user",
+    "trusted_proxy_headers": true,
+    "redis": { "url": "redis://redis:6379/0" }
+  },
+
+  "websocket": { "max_connections": 500 }
+}
+```
+
+Required env for this example (in `.env`):
+
+```
+MODE=production
+IS_DEBUG=false
+ORIGINS=https://app.example.com
+JWT_SECRET_KEY=<32+ char secret>
+JWT_ALGORITHM=HS256
+```
+
+---
+
+## Defaults at a glance
+
+| If you omit... | You get |
+|---|---|
+| `auth` | No authentication. |
+| `authorization` | `ownership` in production, `allow_all` in development. |
+| `checkpointer` | In-memory (lost on restart). |
+| `store` | No memory API. |
+| `redis` | Ownership cache is L1-only (per-process); redis rate-limit backend unavailable. |
+| `rate_limit` | No rate limiting. |
+| `websocket` | Unlimited connections. |
+| `observability` | None. |

10xscale_agentflow_cli-0.5.0/AUTHORIZATION_PLAN.md

@@ -0,0 +1,101 @@
+# Scalable Object-Level Authorization — Design & Plan
+
+Status: DONE (all steps implemented, tested, documented)
+Scope: `agentflow-api` (auth layer) + `agentflow` core (`aget_thread_owner` source-of-truth lookup)
+
+## Goal
+
+Owner-only access to threads, enforced on **every** thread-touching step (invoke, stream,
+stop, fix, and all checkpointer read/write/delete), **on by default in production** when the
+developer enables auth, fully overridable, and **scalable** — no database round-trip per
+request.
+
+## Design principles
+
+1. **Ownership is immutable.** A thread's owner is set at creation and never changes; only
+   deletion removes it. Therefore the owner is safe to cache aggressively (cache-forever)
+   and we essentially never re-hit the DB for a known thread.
+2. **Single decision point.** One `AuthorizationBackend`, invoked before every handler. No
+   per-endpoint bespoke checks.
+3. **Secure by construction.** No route can ship unprotected (enforced at boot).
+4. **Graceful degradation.** No checkpointer / a checkpointer that can't resolve ownership →
+   warn + allow (nothing persisted to protect). Redis is optional.
+
+## Components
+
+### 1. Source of truth: `aget_thread_owner` (core) — DONE
+
+`BaseCheckpointer.aget_thread_owner(thread_id) -> user_id | None`:
+- base: raises `NotImplementedError` (so a backend can't silently report "no owner", which
+  would defeat owner-based authorization).
+- `PgCheckpointer`: `SELECT user_id FROM threads WHERE thread_id = $1`.
+- `InMemoryCheckpointer`, `SqliteCheckpointer`: read the stored thread record's `user_id`.
+
+This is the DB-level lookup the cache sits in front of. Already implemented + unit tested.
+
+### 2. `ThreadOwnershipResolver` (the scalable cache) — NEW (`agentflow-api`)
+
+- **L1**: in-process LRU, bounded (default 10_000), immutable owners cached with **no TTL**.
+- **L2**: Redis, reusing the app's existing Redis client when configured; key
+  `af:authz:owner:{thread_id}`. Gracefully L1-only when Redis is absent.
+- `owner_of(thread_id) -> str | None`: L1 → L2 (fill L1) → DB `aget_thread_owner` (fill L2+L1).
+  **Only positive results are cached; `None` is never cached** — a nonexistent thread can
+  become owned by the very next request, so caching `None` would open a TOCTOU hole.
+- `evict(thread_id)`: clears L1+L2. Called when a thread is deleted.
+- Cost: first touch of a thread = 1 lookup; every subsequent request = in-process hit.
+
+### 3. `OwnershipAuthorizationBackend` — rewire to use the resolver
+
+Decision table (cached; no raw DB call):
+- no `user_id` → deny
+- non-thread resource (`store`, `files`) → allow (they self-scope)
+- no `resource_id` → allow (list/create endpoints)
+- `owner = resolver.owner_of(resource_id)`:
+  - `None` → allow (brand-new session / empty read)
+  - `owner == user_id` → allow
+  - `owner != user_id` → **deny, for every action including invoke/stream**
+- resolver reports unsupported backend → warn + allow; resolver error → fail closed (deny).
+
+### 4. Secure-by-construction enforcement (fail-closed at boot)
+
+`assert_all_routes_protected(app)` runs at startup: walk every route; any non-public route
+(allowlist: `/ping`) whose dependency tree lacks `RequirePermission` makes the server
+**refuse to start** with a clear error. Keeps precise per-handler `(resource, action)`, adds
+zero per-request overhead, and turns a forgotten guard into a deploy-time failure instead of
+a silently-open production endpoint. (Delivers the "authorization on every step" guarantee
+more robustly than a literal router dependency, which cannot cleanly derive each route's
+action.)
+
+### 5. Invalidation
+
+`CheckpointerService.delete_thread` (and the `aclean_thread` path) calls
+`resolver.evict(thread_id)`.
+
+### 6. Config surface (unchanged)
+
+`"authorization"`: `"ownership"` | `"allow_all"`/`"default"`/`"none"` | `"module:attr"` |
+unset → `ownership` in production, `allow_all` in development. Developer choice always wins.
+
+## Test plan
+
+- Resolver: L1 hit, L2 promote-to-L1, DB fill, negative-not-cached, evict, LRU bound.
+- Backend: full decision table over the cached path.
+- Startup invariant: a route missing `RequirePermission` → boot raises; allowlist passes.
+- Integration: non-owner invoke/stream/read/delete → 403; owner → ok; second call served from
+  cache (asserted with a call-counting fake checkpointer — no second DB hit).
+- Core: `aget_thread_owner` for in-memory/sqlite (done).
+
+## Docs
+
+Update `docs/how-to/api-cli/add-auth.md` and `agentflow-api/CLAUDE.md`: caching model,
+immutability, Redis opt-in, boot-time guarantee.
+
+## Execution order
+
+1. ThreadOwnershipResolver + unit tests.
+2. Rewire OwnershipAuthorizationBackend onto the resolver + update tests.
+3. Wire resolver into DI (loader) and evict on delete_thread.
+4. Startup invariant `assert_all_routes_protected` + boot wiring + tests.
+5. Integration tests (owner-only + cache-hit assertion).
+6. Docs.
+7. Full suite (api + core) green with coverage.

10xscale_agentflow_cli-0.5.0/AUTHORIZATION_PLAN_PHASE2.md

@@ -0,0 +1,34 @@
+# Phase 2 — Policy-driven isolation (single source of truth, non-hijackable)
+
+Problem: `user_id` scoping in the checkpointer is just data partitioning on a supplied id.
+It's not authorization, and `allow_all` (authz) can contradict the data layer. Fix: one
+**trusted policy**, set only by the server from auth, drives both.
+
+## The idea (short)
+
+1. **Trusted policy in config, server-only.** The API injects `config["policy"] = {"scope": ...}`
+   built from the active authorization backend. It **overwrites/strips** any client-sent
+   `policy` (and already overwrites `user_id`), so the frontend can send whatever it wants —
+   ignored. Not hijackable.
+   - `OwnershipAuthorizationBackend.isolation_scope()` -> `"owner"`
+   - `DefaultAuthorizationBackend` / others -> `"none"`
+
+2. **Checkpointer honors the policy.**
+   - `scope == "owner"` -> filter state/messages/threads by `user_id`.
+   - `scope == "none"` -> no filtering (allow_all genuinely returns everything).
+   - policy absent (direct core-lib call, no API) -> fall back to the checkpointer's own
+     `enforce_user_isolation` default (backward compatible).
+   Applies to pg (already scopes; make it read policy), **InMemory + sqlite (add scoping)**.
+
+3. **Coherent.** allow_all -> no 403 + no data scope. ownership -> 403 + data scope. Same
+   policy drives both decisions. Kills the dev/InMemory leak because scoping no longer depends
+   on which checkpointer happens to filter.
+
+## Steps
+1. `AuthorizationBackend.isolation_scope()` (base `"none"`, ownership `"owner"`).
+2. API config builders set trusted `config["policy"]` (checkpointer_service `_config`;
+   graph_service invoke/stream/stop/fix where `user_id` is set). Strip client `policy`.
+3. Checkpointer scoping reads `config["policy"]["scope"]` (pg/inmemory/sqlite), fallback to
+   `enforce_user_isolation`.
+4. Tests (non-owner blocked on InMemory too; allow_all returns everything; client-sent policy
+   ignored) + docs.

{10xscale_agentflow_cli-0.4.0 → 10xscale_agentflow_cli-0.5.0}/CLAUDE.md

@@ -5,13 +5,16 @@ core framework see `agentflow/CLAUDE.md`; for the TS client, docs, or playground
 for the monorepo overview see the workspace-root `CLAUDE.md`.
 
 - Package name (PyPI): `10xscale-agentflow-cli`
-- Version: `0.3.2.9` (`pyproject.toml`). `CLI_VERSION` and `agentflow_cli.__version__` are
+- Version: `0.4.0` (`pyproject.toml`). `CLI_VERSION` and `agentflow_cli.__version__` are
   single-sourced from the installed distribution metadata (falling back to `pyproject.toml`), so
-  `agentflow version` reports `0.3.2.9` consistently. The previous `1.0.0` hardcode is gone.
+  `agentflow version` reports `0.4.0` consistently. The previous `1.0.0` hardcode is gone.
 - Requires: Python >= 3.12 · Status: `4 - Beta`
 - Console entry point: `agentflow = agentflow_cli.cli.main:main`
 - Depends on the core framework: `10xscale-agentflow>=0.7.0`.
 
+- Depends on the core framework: `10xscale-agentflow>=0.9.0` (0.9.0 is the first release that
+  ships `agentflow.core.authz`, which the RBAC/scope code imports).
+
 ## What this package is
 
 It turns an Agentflow `CompiledGraph` into a production FastAPI service, plus a Typer CLI to
@@ -76,8 +79,25 @@ and for redis backend a `redis` sub-object `{ "url", "prefix" }` (or shorthand U
   load if missing). JWT logic lives in `core/auth/jwt_auth.py`.
 - `"auth": {"method": "custom", "path": "module:attr"}` loads your `BaseAuth` subclass
   (`from agentflow_cli import BaseAuth`).
-- Authorization (RBAC, per-tool) is separate: `core/auth/authorization.py`
-  (`AuthorizationBackend` / `DefaultAuthorizationBackend`), wired via the `authorization` key.
+- Authorization (RBAC / object-level) is separate: `core/auth/authorization.py`
+  (`AuthorizationBackend` / `DefaultAuthorizationBackend` / `OwnershipAuthorizationBackend`),
+  wired via the `authorization` key. That key accepts `"module:attr"` (custom), a built-in
+  name (`"ownership"` = owner-only thread access; `"allow_all"`/`"default"`/`"none"`), or
+  `null`. When unset it defaults **by mode**: `ownership` in production (secure by default),
+  `allow_all` in development. Selection lives in `loader._resolve_authorization_backend`;
+  `RequirePermission` passes `resource_id` (thread_id from path or body) to `authorize`.
+- **Ownership is object-level and enforced on every thread-touching step** (invoke/stream/
+  stop/fix + all checkpointer read/write/delete): a thread is accessible only to its owner;
+  a foreign `invoke`/`stream` is rejected up front (403), never reaching the graph.
+- **Scalable, not a DB call per request.** Ownership is immutable, so it is cached by
+  `core/auth/ownership_resolver.py::ThreadOwnershipResolver`: in-process LRU (L1) + optional
+  shared Redis (L2, reuses `config.redis`/`settings.REDIS_URL`). The backing lookup is
+  `BaseCheckpointer.aget_thread_owner` (implemented in pg/in-memory/sqlite; base raises
+  `NotImplementedError`). Cache is evicted on thread delete (`CheckpointerService.delete_thread`);
+  the L2 client is closed in the lifespan shutdown.
+- **Secure by construction:** `core/auth/route_guard.py::assert_all_routes_protected` runs at
+  boot (`main.py` after `init_routes`) and refuses to start if any non-public route lacks a
+  `RequirePermission` guard (`/ping` is the only public path).
 
 ## HTTP + WebSocket surface (all under `/v1` except ping)
 
@@ -134,7 +154,7 @@ ruff check . && ruff format .
 
 - **Version is now single-sourced.** `CLI_VERSION` (and `agentflow_cli.__version__`, which aliases
   it) resolve from installed distribution metadata, falling back to `pyproject.toml`. `agentflow
-  version` reports `0.3.2.9` for both the CLI and package lines. (The old hardcoded `1.0.0` drift is
+  version` reports `0.4.0` for both the CLI and package lines. (The old hardcoded `1.0.0` drift is
   resolved.)
 - **README shows `agentflow init --prod`** — that flag does not exist. `init` is interactive and
   only accepts `--path` / `--force`.