agent-belt 0.1.0__tar.gz

agent_belt-0.1.0/.frogbot/frogbot-config.yml

@@ -0,0 +1,11 @@
+- params:
+    git:
+      repoName: agent-belt
+      branches:
+        - main
+    scan:
+      projects:
+        - workingDirs:
+            - "."
+      excludePatterns:
+        - "examples/**"

agent_belt-0.1.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,39 @@
+name: Bug Report
+description: Report a bug in agent-belt
+labels: ["bug"]
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: What happened? What did you expect?
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to Reproduce
+      description: Minimal command or code to trigger the bug
+      placeholder: |
+        ```bash
+        belt eval examples/scenarios/ --modes rules
+        ```
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: OS, Python version, belt version, agent
+      placeholder: |
+        - OS: macOS 15
+        - Python: 3.13.0
+        - agent-belt: 0.1.0
+        - Agent: claude-code
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant Output
+      description: Error messages, tracebacks, or score.json content
+      render: shell

agent_belt-0.1.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: false

agent_belt-0.1.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,23 @@
+name: Feature Request
+description: Suggest an enhancement or new capability
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem or Use Case
+      description: What are you trying to do that belt doesn't support?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed Solution
+      description: How would you like this to work?
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives Considered
+      description: Any workarounds you've tried or other approaches you've considered

agent_belt-0.1.0/.github/ISSUE_TEMPLATE/new_agent.yml

@@ -0,0 +1,45 @@
+name: New Agent Request
+description: Request support for a new CLI agent
+labels: ["new feature", "agent"]
+body:
+  - type: input
+    id: agent_name
+    attributes:
+      label: Agent Name
+      description: Name of the CLI agent (e.g., "aider", "continue")
+    validations:
+      required: true
+
+  - type: input
+    id: cli_command
+    attributes:
+      label: CLI Command
+      description: How is the agent invoked? (e.g., "aider --message")
+    validations:
+      required: true
+
+  - type: dropdown
+    id: output_format
+    attributes:
+      label: Output Format
+      options:
+        - Plain text
+        - JSON
+        - NDJSON (streaming)
+        - Other
+
+  - type: checkboxes
+    id: capabilities
+    attributes:
+      label: Capabilities
+      options:
+        - label: Multi-turn sessions (resume/conversation ID)
+        - label: Structured tool call output
+        - label: Streaming events
+        - label: Non-interactive/headless mode
+
+  - type: textarea
+    id: notes
+    attributes:
+      label: Additional Context
+      description: Links to docs, CLI reference, or output examples

agent_belt-0.1.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,22 @@
+## Summary
+
+<!-- What does this PR do? 1-3 sentences. -->
+
+## Changes
+
+<!-- Key changes, one bullet per logical change. -->
+
+-
+
+## Testing
+
+<!-- How was this tested? Include commands run, test output, or scenario results. -->
+
+- [ ] `make check` passes (lint + test)
+- [ ] New/changed code has tests
+- [ ] Scenarios run successfully (if agent/scorer/scenario changes)
+
+## Label
+
+<!-- Every PR needs exactly one release label. Pick one: -->
+<!-- new feature | improvement | bug | breaking change | ignore for release -->

agent_belt-0.1.0/.github/release.yml

@@ -0,0 +1,29 @@
+# GitHub Release notes configuration. Used by ``gh release create
+# --generate-notes`` (see ``.github/workflows/release.yml``) to categorise
+# merged PRs by label.
+#
+# Category titles and labels track the JFrog OSS reference set used by
+# jfrog-cli, frogbot, artifactory-client-java, and jfrog-client-go. Keep
+# the wording and emoji identical so the GitHub Releases page for this
+# project reads in the same voice as the rest of the JFrog OSS family.
+
+changelog:
+  exclude:
+    labels:
+      - "ignore for release"
+  categories:
+    - title: Breaking Changes 🚨
+      labels:
+        - "breaking change"
+    - title: Exciting New Features 🎉
+      labels:
+        - "new feature"
+    - title: Improvements 🌱
+      labels:
+        - "improvement"
+    - title: Bug Fixes 🛠
+      labels:
+        - "bug"
+    - title: Other Changes 📚
+      labels:
+        - "*"

agent_belt-0.1.0/.github/workflows/cla.yml

@@ -0,0 +1,29 @@
+name: "CLA Assistant"
+
+on:
+  # issue_comment triggers this action on each comment on issues and pull requests
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened, synchronize]
+    branches:
+      - main
+
+# explicitly configure permissions, in case your GITHUB_TOKEN workflow permissions are set to read-only in repository settings
+permissions:
+  actions: write
+  contents: write # this can be 'read' if the signatures are in remote repository
+  pull-requests: write
+  statuses: write
+
+jobs:
+  CLAssistant:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run CLA Check
+        uses: jfrog/.github/actions/cla@main
+        with:
+          event_comment_body: ${{ github.event.comment.body }}
+          event_name: ${{ github.event_name }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CLA_SIGN_TOKEN: ${{ secrets.CLA_SIGN_TOKEN }}

agent_belt-0.1.0/.github/workflows/frogbot-scan-pull-request.yml

@@ -0,0 +1,35 @@
+name: "Frogbot Scan Pull Request"
+
+on:
+  pull_request_target:
+    types: [opened, synchronize]
+    branches:
+      - "main"
+
+permissions:
+  pull-requests: write
+  contents: read
+
+jobs:
+  scan-pull-request:
+    if: ${{ github.actor != 'dependabot[bot]' }}
+    runs-on: ubuntu-latest
+    environment: frogbot
+    steps:
+      - name: Checkout the repository
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.ref }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+
+      - uses: jfrog/frogbot@v2
+        env:
+          JF_URL: ${{ secrets.FROGBOT_URL }}
+          JF_ACCESS_TOKEN: ${{ secrets.FROGBOT_ACCESS_TOKEN }}
+          JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          JF_FAIL: "TRUE"
+          JF_MIN_SEVERITY: "High"

agent_belt-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,258 @@
+name: Release
+
+# Triggered ONLY on annotated/lightweight tags matching ``v*``. Manual,
+# deliberate, never auto-publish-on-merge.
+#
+# Tag conventions:
+#   v0.1.0           -> production PyPI + GitHub Release
+#   v0.1.0-rc1       -> TestPyPI only (rehearsal)
+#   v0.1.0-alpha.1   -> TestPyPI only (rehearsal)
+#
+# The build job runs first with NO secrets, produces the wheel + sdist as a
+# GitHub artifact. Each publish job downloads the artifact - they never see
+# the source.
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+
+jobs:
+  classify-tag:
+    name: Classify tag (rehearsal vs. real release)
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.parse.outputs.version }}
+      is_prerelease: ${{ steps.parse.outputs.is_prerelease }}
+    steps:
+      - name: Parse the tag
+        id: parse
+        run: |
+          TAG="${GITHUB_REF#refs/tags/}"
+          VERSION="${TAG#v}"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          # PEP 440 pre-release / dev-release markers - any of these ship to
+          # TestPyPI only. We accept both spellings:
+          #   dash-separated:  v0.1.0-rc1, v0.1.0-alpha.1, v0.1.0-beta1, v0.1.0-dev0
+          #   PEP 440 canonical: v0.1.0rc1, v0.1.0a1, v0.1.0b1, v0.1.0.dev0
+          # A naive ``*-*`` check would accept the dash-form only and silently
+          # publish ``v0.1.0rc1`` to production PyPI - real foot-gun.
+          if [[ "$TAG" =~ -|[0-9](rc|a|b|alpha|beta)[0-9]|\.dev[0-9] ]]; then
+            echo "is_prerelease=true" >> "$GITHUB_OUTPUT"
+            echo "Pre-release tag - rehearsal flow (TestPyPI only)"
+          else
+            echo "is_prerelease=false" >> "$GITHUB_OUTPUT"
+            echo "Release tag - full publish flow"
+          fi
+
+  build:
+    name: Build wheel + sdist (no secrets)
+    needs: classify-tag
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      # Required for ``actions/attest-build-provenance`` below.
+      id-token: write
+      attestations: write
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # ``hatch-vcs`` derives the package version from git metadata.
+          fetch-depth: 0
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          # Pinned for release reproducibility - the build that produces the
+          # wheel must not move underneath us between runs. Bump deliberately
+          # in a separate PR after verifying the new uv minor on a rehearsal.
+          version: "0.11"
+          enable-cache: true
+
+      - name: Set up Python
+        run: uv python install
+
+      - name: Sanity check - tag matches ``hatch-vcs`` resolution
+        # Catches the rare case where a tag was created on a non-main commit
+        # by hand and ``hatch-vcs`` resolves to something else (e.g. a stale
+        # cached version). Hard-fail before we publish anything.
+        env:
+          # Override hatch-vcs's ``git describe`` resolution with the version
+          # parsed from the tag that actually triggered this workflow. When
+          # multiple ``v*`` tags point at the same commit (typical: an rc tag
+          # rehearsed in §2.8 followed by a strict tag cut from the same SHA),
+          # ``git describe`` resolution is non-deterministic across git and
+          # hatch-vcs versions, and the build can pick the rc, producing a
+          # wheel whose version fails the assertion below.
+          #
+          # The global ``SETUPTOOLS_SCM_PRETEND_VERSION`` is used rather than
+          # the per-project ``SETUPTOOLS_SCM_PRETEND_VERSION_FOR_AGENT_BELT``
+          # because hatch-vcs invokes ``setuptools_scm.get_version()`` without
+          # passing ``dist_name``, so the per-project env-var lookup never
+          # fires. The global form is the canonical CI escape hatch documented
+          # by setuptools-scm and used by ruff, uv, and hatch's own release
+          # workflows.
+          #
+          # The wheel-version assertion below stays as defense in depth: it
+          # now validates the build did what we told it to, rather than
+          # arbitrating between competing tag resolutions.
+          SETUPTOOLS_SCM_PRETEND_VERSION: ${{ needs.classify-tag.outputs.version }}
+        run: |
+          uv sync --locked
+          uv build
+          # Parse wheel filename via ``packaging.utils`` rather than ``ls | sed``:
+          # robust to multiple wheels, locale-dependent ``ls`` ordering, and PEP
+          # 425 build tags. Asserts exactly one wheel landed in ``dist/``.
+          WHEEL_VERSION=$(uv run python -c "
+          from packaging.utils import parse_wheel_filename
+          from pathlib import Path
+          wheels = list(Path('dist').glob('*.whl'))
+          assert len(wheels) == 1, f'expected exactly one wheel, found: {wheels}'
+          print(parse_wheel_filename(wheels[0].name)[1])
+          ")
+          echo "Tag version  : ${{ needs.classify-tag.outputs.version }}"
+          echo "Wheel version: $WHEEL_VERSION"
+          # Allow PEP 440 normalisation (e.g. tag ``v0.1.0-rc1`` -> wheel
+          # ``0.1.0rc1``) but block silent mismatches.
+          if [[ "$WHEEL_VERSION" != "${{ needs.classify-tag.outputs.version }}" \
+             && "$WHEEL_VERSION" != "$(echo '${{ needs.classify-tag.outputs.version }}' | tr -d '-')" ]]; then
+            echo "::error::Wheel version $WHEEL_VERSION does not match tag ${{ needs.classify-tag.outputs.version }}"
+            exit 1
+          fi
+
+      - name: Verify wheel installs and smoke-tests pass
+        run: make verify-wheel
+
+      - name: Generate build provenance attestation
+        # Sigstore-signed SLSA L3 attestation tying the wheel hash to this
+        # workflow run, source SHA, and runner identity. Uploaded to the
+        # GitHub Release alongside the artifact.
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: dist/*
+
+      - name: Upload built distributions
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+          retention-days: 14
+          if-no-files-found: error
+
+  publish-testpypi:
+    name: Publish to TestPyPI (rehearsal)
+    needs: [classify-tag, build]
+    # Mirrors the repo guard on ``publish-pypi``: a fork that pushes a
+    # pre-release tag should not even attempt to upload (the Trusted Publisher
+    # binding would reject it, but defense-in-depth lives in the workflow too).
+    # Pre-release (rc / alpha / beta / dev) tags from ``jfrog/agent-belt``
+    # publish to TestPyPI for rehearsal before a strict tag goes to PyPI.
+    if: needs.classify-tag.outputs.is_prerelease == 'true' && github.repository == 'jfrog/agent-belt'
+    runs-on: ubuntu-latest
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/p/agent-belt
+    permissions:
+      # OIDC token for Trusted Publisher - no PyPI API token required.
+      id-token: write
+
+    steps:
+      - name: Download built distributions
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to TestPyPI
+        # v1.12+ ships a twine that understands Metadata-Version 2.4, which is
+        # what current ``hatchling`` emits (PEP 639 license metadata). v1.11
+        # rejects the wheel before upload with "Metadata is missing required
+        # fields: Name, Version" - misleading symptom, real cause is the
+        # metadata version. v1.12+ also keeps PEP 740 attestation support.
+        uses: pypa/gh-action-pypi-publish@v1.14.0
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          # TestPyPI rejects identical version overwrites; ``skip-existing``
+          # makes a re-run of the same rc tag idempotent (e.g. after a manual
+          # workflow restart) instead of failing the whole release flow.
+          skip-existing: true
+
+  publish-pypi:
+    name: Publish to PyPI (Trusted Publisher)
+    needs: [classify-tag, build]
+    # Pinned to this repo so a fork running release.yml cannot publish under
+    # our PyPI name. The PyPI Trusted Publisher binding is the second layer.
+    if: needs.classify-tag.outputs.is_prerelease == 'false' && github.repository == 'jfrog/agent-belt'
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/agent-belt
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Download built distributions
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@v1.14.0
+
+  github-release:
+    name: GitHub Release (notes + provenance)
+    needs: [classify-tag, build, publish-pypi]
+    if: needs.classify-tag.outputs.is_prerelease == 'false' && github.repository == 'jfrog/agent-belt'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download built distributions
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Create GitHub Release with auto-generated notes
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "v${{ needs.classify-tag.outputs.version }}" \
+            --title "v${{ needs.classify-tag.outputs.version }}" \
+            --generate-notes \
+            dist/*
+
+      - name: Summary
+        if: always()
+        run: |
+          {
+            echo "## Release Summary"
+            echo "- **Version:** ${{ needs.classify-tag.outputs.version }}"
+            echo "- **Tag:** v${{ needs.classify-tag.outputs.version }}"
+            echo "- **PyPI:** https://pypi.org/project/agent-belt/${{ needs.classify-tag.outputs.version }}/"
+            echo "- **GitHub Release:** https://github.com/jfrog/agent-belt/releases/tag/v${{ needs.classify-tag.outputs.version }}"
+            echo "- **Provenance:** Sigstore-signed SLSA build provenance attached to the wheel"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  notice-build-only:
+    # Surfaces the situation when ``classify-tag`` + ``build`` succeed but
+    # every publish job is skipped by a repo guard. Without this notice the
+    # run shows as a green success with no surfaced explanation -
+    # operationally confusing. Triggers on any tag (strict or pre-release)
+    # pushed from a repo other than ``jfrog/agent-belt`` (typically a fork).
+    name: Notice (build-only on this repo)
+    needs: [classify-tag, build]
+    if: github.repository != 'jfrog/agent-belt'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Print notice
+        run: |
+          echo "::notice::Tag v${{ needs.classify-tag.outputs.version }} built on ${{ github.repository }}, but this repo has no publish path configured. Strict release tags publish from jfrog/agent-belt to PyPI; pre-release tags (rc, alpha, beta, dev) publish from jfrog/agent-belt to TestPyPI."

agent_belt-0.1.0/.github/workflows/removeLabel.yml

@@ -0,0 +1,33 @@
+# Strip the ``safe to test`` label as soon as it is applied. Pairs with any
+# integration / live-credential workflow that gates on
+# ``contains(...labels...'safe to test')`` - the next push will then need a
+# fresh maintainer approval, so the label is single-use per review action.
+# Reference impl: jfrog/jfrog-cli ``.github/workflows/removeLabel.yml``.
+name: Remove Label
+
+on:
+  pull_request_target:
+    types: [labeled]
+
+# Cancel superseded runs (e.g., maintainer toggling the label twice quickly)
+# so we never end up with two concurrent strip attempts.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  pull-requests: write
+
+jobs:
+  Remove-Label:
+    if: contains(github.event.pull_request.labels.*.name, 'safe to test')
+    name: Remove 'safe to test'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Remove 'safe to test'
+        # Pinned to the commit SHA of v1.3.0 (mutable tags are a known supply-chain
+        # risk on ``pull_request_target``, which runs in the base-repo context with
+        # write permissions). Update by re-resolving the desired tag to its commit.
+        uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0  # v1.3.0
+        with:
+          labels: "safe to test"