agent-crossbar 0.2.0__tar.gz

agent_crossbar-0.2.0/.github/allowed_signers

@@ -0,0 +1 @@
+zombopanda@gmail.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBiH4qgbw/sizT5SxcfqYr8BS4T77G2sR/ph85Hwpgpw

agent_crossbar-0.2.0/.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3

agent_crossbar-0.2.0/.github/workflows/ci.yml

@@ -0,0 +1,186 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  # ── Python test matrix (Ubuntu) ──────────────────────────────────────────
+  test-ubuntu:
+    name: "py${{ matrix.python }} on ubuntu"
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: ${{ matrix.python }}
+
+      - name: Create isolated venv
+        run: uv venv --python ${{ matrix.python }} /tmp/ci-venv
+
+      - name: Install package + test deps
+        run: |
+          uv pip install --python /tmp/ci-venv/bin/python \
+            -e ".[test]"
+
+      - name: Run tests
+        run: |
+          /tmp/ci-venv/bin/python -m pytest tests/ -q \
+            --ignore=tests/test_claude_agent_integration.py \
+            --ignore=tests/test_acp_agent.py \
+            --ignore=tests/test_tmux_output.py \
+            --ignore=tests/test_local_e2e_dev_start.py
+
+  # ── Python test matrix (macOS primary version) ───────────────────────────
+  test-macos:
+    name: "py${{ matrix.python }} on macos"
+    runs-on: macos-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.13"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: ${{ matrix.python }}
+
+      - name: Create isolated venv
+        run: uv venv --python ${{ matrix.python }} /tmp/ci-venv
+
+      - name: Install package + test deps
+        run: |
+          uv pip install --python /tmp/ci-venv/bin/python \
+            -e ".[test]"
+
+      - name: Run tests
+        run: |
+          /tmp/ci-venv/bin/python -m pytest tests/ -q \
+            --ignore=tests/test_claude_agent_integration.py \
+            --ignore=tests/test_acp_agent.py \
+            --ignore=tests/test_tmux_output.py \
+            --ignore=tests/test_local_e2e_dev_start.py
+
+  # ── Lint & type checks ──────────────────────────────────────────────────
+  lint:
+    name: "lint + format check"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.13"
+
+      - name: Create isolated venv
+        run: uv venv --python 3.13 /tmp/ci-venv
+
+      - name: Install package + test deps
+        run: |
+          uv pip install --python /tmp/ci-venv/bin/python \
+            -e ".[test]"
+
+      - name: Ruff lint
+        run: |
+          /tmp/ci-venv/bin/ruff check \
+            src/agent_crossbar/ \
+            scripts/provider_surface_gate.py \
+            tests/test_minimal_public_contract.py \
+            tests/test_claude_adapter.py \
+            tests/test_provider_surface_gate.py
+
+      - name: Ruff format check
+        run: |
+          /tmp/ci-venv/bin/ruff format --check \
+            src/agent_crossbar/ \
+            scripts/provider_surface_gate.py \
+            tests/test_minimal_public_contract.py \
+            tests/test_claude_adapter.py \
+            tests/test_provider_surface_gate.py
+
+  # ── Build wheel + sdist ─────────────────────────────────────────────────
+  build:
+    name: "build wheel + sdist"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.13"
+
+      - name: Build
+        run: uv build --out-dir dist
+
+      - name: Archive artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  # ── Install smoke ───────────────────────────────────────────────────────
+  install-smoke:
+    name: "install smoke"
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.13"
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Install from wheel
+        run: |
+          uv venv --python 3.13 /tmp/smoke-venv
+          uv pip install --python /tmp/smoke-venv/bin/python dist/*.whl
+
+      - name: "Smoke: CLI help"
+        run: /tmp/smoke-venv/bin/agent-crossbar doctor
+
+      - name: "Smoke: import"
+        run: |
+          /tmp/smoke-venv/bin/python -c \
+            "import agent_crossbar; print(agent_crossbar.__version__)"
+
+  # ── npm pack + launcher smoke ───────────────────────────────────────────
+  npm-smoke:
+    name: "npm pack + launcher smoke"
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: .
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: npm pack
+        run: npm pack
+
+      - name: Verify tarball contents
+        run: |
+          tar -tzf agent-crossbar-*.tgz | sort
+          # Must NOT contain Python source, pyproject, tests, or internal paths
+          ! tar -tzf agent-crossbar-*.tgz | grep -qE '\.py|pyproject\.toml|\.reasonix|\.memsearch|results/|\.pytest_cache|__pycache__|test'
+
+      - name: Launcher syntax check
+        run: node --check bin/agent-crossbar.mjs

agent_crossbar-0.2.0/.github/workflows/live-gate.yml

@@ -0,0 +1,93 @@
+name: Live Provider Gate
+
+on:
+  workflow_dispatch:
+    inputs:
+      profile:
+        description: "Provider profile to test"
+        required: true
+        type: choice
+        options:
+          - codex
+          - claude
+          - opencode
+          - reasonix
+      model:
+        description: "Model ID (leave empty for profile default)"
+        required: false
+        type: string
+      effort:
+        description: "Effort level (supported by any provider that accepts effort)"
+        required: false
+        type: string
+      task:
+        description: "Task to test"
+        required: true
+        type: choice
+        options:
+          - ask
+          - review
+          - dev
+      interactive:
+        description: "Test interactive mode"
+        required: false
+        type: boolean
+        default: false
+      max_runtime_sec:
+        description: "Max runtime seconds"
+        required: false
+        type: string
+        default: "600"
+
+permissions:
+  contents: read
+
+jobs:
+  live-gate:
+    name: "live gate: ${{ inputs.profile }} ${{ inputs.task }}"
+    runs-on: ubuntu-latest
+    environment: live-gates
+    timeout-minutes: 30
+
+    # Never run on forks — requires maintainer credentials
+    if: github.repository == 'zombopanda/agent-crossbar'
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.13"
+
+      - name: Create isolated venv
+        run: uv venv --python 3.13 /tmp/ci-venv
+
+      - name: Install package + test deps
+        run: |
+          uv pip install --python /tmp/ci-venv/bin/python \
+            -e ".[test]"
+
+      - name: Provider surface gate
+        env:
+          PROFILE: ${{ inputs.profile }}
+          TASK: ${{ inputs.task }}
+          INTERACTIVE: ${{ inputs.interactive }}
+          MODEL: ${{ inputs.model }}
+          EFFORT: ${{ inputs.effort }}
+          MAX_RUNTIME_SEC: ${{ inputs.max_runtime_sec }}
+        run: |
+          MODEL_ARG=""
+          if [ -n "${MODEL}" ]; then
+            MODEL_ARG="--model ${MODEL}"
+          fi
+          EFFORT_ARG=""
+          if [ -n "${EFFORT}" ]; then
+            EFFORT_ARG="--effort ${EFFORT}"
+          fi
+          /tmp/ci-venv/bin/python scripts/provider_surface_gate.py \
+            --profile "${PROFILE}" \
+            ${MODEL_ARG} \
+            ${EFFORT_ARG} \
+            --task "${TASK}" \
+            --interactive "${INTERACTIVE}" \
+            --max-runtime-sec "${MAX_RUNTIME_SEC:-600}"

agent_crossbar-0.2.0/.github/workflows/release.yml

@@ -0,0 +1,200 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+  id-token: write
+  attestations: write
+
+jobs:
+  # ── Build & audit ───────────────────────────────────────────────────────
+  build:
+    name: "build + audit"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Verify signed release tag
+        run: |
+          git fetch --force origin \
+            "refs/tags/${GITHUB_REF_NAME}:refs/tags/${GITHUB_REF_NAME}"
+          git config gpg.format ssh
+          git config gpg.ssh.allowedSignersFile \
+            "${GITHUB_WORKSPACE}/.github/allowed_signers"
+          git verify-tag "${GITHUB_REF_NAME}"
+
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.13"
+
+      - name: Verify tag matches package versions
+        shell: bash
+        run: |
+          release_version="${GITHUB_REF_NAME#v}"
+          python - "${release_version}" <<'PY'
+          import json
+          import sys
+          import tomllib
+          from pathlib import Path
+
+          package_root = Path(".")
+          tag_version = sys.argv[1]
+          python_version = tomllib.loads(
+              (package_root / "pyproject.toml").read_text()
+          )["project"]["version"]
+          npm_version = json.loads(
+              (package_root / "package.json").read_text()
+          )["version"]
+          if not tag_version == python_version == npm_version:
+              raise SystemExit(
+                  "tag version does not match package versions: "
+                  f"tag={tag_version}, python={python_version}, npm={npm_version}"
+              )
+          PY
+
+      - name: Build
+        run: uv build --out-dir dist
+
+      - name: Audit wheel
+        run: |
+          ! unzip -l dist/*.whl | grep -qE '\.reasonix|\.memsearch|results/|benchmark|handoff'
+
+      - name: Audit sdist
+        run: |
+          ! tar -tzf dist/*.tar.gz | grep -qE '\.reasonix|\.memsearch|results/|benchmark|handoff'
+
+      - name: Install smoke
+        run: |
+          uv venv --python 3.13 /tmp/smoke-venv
+          uv pip install --python /tmp/smoke-venv/bin/python dist/*.whl
+          /tmp/smoke-venv/bin/agent-crossbar doctor
+          /tmp/smoke-venv/bin/python -c \
+            "import agent_crossbar; print(agent_crossbar.__version__)"
+
+      - name: Attest distributions
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-path: dist/*
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  # ── PyPI trusted publishing ─────────────────────────────────────────────
+  pypi-publish:
+    name: "publish to PyPI"
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/agent-crossbar
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          attestations: true
+
+  # ── Smoke the artifact PyPI actually serves ────────────────────────────
+  pypi-smoke:
+    name: "smoke published PyPI artifact"
+    needs: pypi-publish
+    runs-on: ubuntu-latest
+    steps:
+      - uses: astral-sh/setup-uv@v5
+
+      - name: Install and start published version
+        shell: bash
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          for attempt in {1..12}; do
+            if uvx --refresh --from "agent-crossbar==${version}" agent-crossbar doctor; then
+              exit 0
+            fi
+            if [[ "${attempt}" -eq 12 ]]; then
+              echo "PyPI artifact was not installable after propagation window" >&2
+              exit 1
+            fi
+            sleep 10
+          done
+
+  # ── npm publish (post-PyPI) ─────────────────────────────────────────────
+  npm-publish:
+    name: "publish to npm"
+    needs: pypi-smoke
+    runs-on: ubuntu-latest
+    environment:
+      name: npm
+      url: https://www.npmjs.com/package/agent-crossbar
+    permissions:
+      contents: read
+      id-token: write
+    defaults:
+      run:
+        working-directory: .
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Update npm for trusted publishing
+        run: npm install --global npm@latest
+
+      - name: npm pack + verify
+        run: |
+          npm pack
+          ! tar -tzf agent-crossbar-*.tgz | grep -qE '\.reasonix|\.memsearch|results/|__pycache__'
+
+      - name: npm publish
+        shell: bash
+        run: |
+          version="$(node -p 'require("./package.json").version')"
+          if npm view "agent-crossbar@${version}" version >/dev/null 2>&1; then
+            echo "agent-crossbar@${version} is already published; skipping"
+            exit 0
+          fi
+          npm publish --access public
+
+  # ── GitHub release (only after both registries are healthy) ────────────
+  github-release:
+    name: "create GitHub release"
+    needs: npm-publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Create release with verified artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "${GITHUB_REF_NAME}" \
+            --verify-tag \
+            --title "Agent Crossbar ${GITHUB_REF_NAME}" \
+            --notes-file "docs/releases/v0.2.0.md" \
+            dist/*

agent_crossbar-0.2.0/.github/workflows/security.yml

@@ -0,0 +1,89 @@
+name: Security
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "0 8 * * 1"  # every Monday
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  # ── Secret scanning ─────────────────────────────────────────────────────
+  secret-scan:
+    name: "secret scan"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: gitleaks/gitleaks-action@v2
+
+  # ── Dependency audit ────────────────────────────────────────────────────
+  dependency-audit:
+    name: "dependency audit"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.13"
+
+      - name: Create isolated venv
+        run: uv venv --python 3.13 /tmp/ci-venv
+
+      - name: Install package + test deps
+        run: |
+          uv pip install --python /tmp/ci-venv/bin/python \
+            -e ".[test]"
+
+      - name: pip-audit
+        run: /tmp/ci-venv/bin/pip-audit
+
+  # ── CodeQL ──────────────────────────────────────────────────────────────
+  codeql:
+    name: "CodeQL"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: python, javascript
+
+      - uses: github/codeql-action/analyze@v3
+
+  # ── Artifact allowlist check ────────────────────────────────────────────
+  artifact-audit:
+    name: "artifact audit"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.13"
+
+      - name: Build artifacts
+        run: uv build --out-dir dist
+
+      - name: Audit wheel contents
+        run: |
+          echo "=== Wheel contents ==="
+          unzip -l dist/*.whl | grep -vE '\.pyc$|__pycache__'
+          echo ""
+          echo "=== Checking for prohibited paths ==="
+          ! unzip -l dist/*.whl | grep -qE '\.reasonix|\.memsearch|results/|benchmark|handoff|\.pytest_cache|\.DS_Store'
+
+      - name: Audit sdist contents
+        run: |
+          echo "=== Sdist contents ==="
+          tar -tzf dist/*.tar.gz | grep -vE '\.pyc$|__pycache__'
+          echo ""
+          echo "=== Checking for prohibited paths ==="
+          ! tar -tzf dist/*.tar.gz | grep -qE '\.reasonix|\.memsearch|results/|benchmark|handoff|\.pytest_cache|\.DS_Store'

agent_crossbar-0.2.0/.gitignore

@@ -0,0 +1,12 @@
+.DS_Store
+.agent-crossbar/
+.memsearch/
+.reasonix/
+.pytest_cache/
+.ruff_cache/
+.venv/
+__pycache__/
+*.py[cod]
+*.tgz
+dist/
+uv.lock

agent_crossbar-0.2.0/.gitleaks.toml

@@ -0,0 +1,11 @@
+# Gitleaks configuration for Agent Crossbar
+# Excludes known non-secret patterns and false positives from the codebase.
+
+title = "Agent Crossbar gitleaks config"
+
+[allowlist]
+  description = "Global allowlist"
+  paths = [
+    '''uv\.lock''',
+    '''\.gitleaks\.toml''',
+  ]

agent_crossbar-0.2.0/AGENTS.md

@@ -0,0 +1,43 @@
+# Agent Crossbar — Contributor Code Rules
+
+These rules apply to code contributions. They are intentionally concise and focused on the public contract.
+
+## Public Contract (Provider-Neutral)
+
+1. **No top-level provider-specific fields.** The public API (`agent_start`, `job_result`, tool schemas) MUST NOT expose fields that only apply to a single provider. Provider-specific metadata lives in per-profile capability entries.
+
+2. **The 8-tool MCP surface is locked.** Adding or removing a tool requires a design discussion and version bump. No hidden tools. No deprecated aliases.
+
+3. **Stable error codes.** Error codes documented in the README troubleshooting table MUST NOT change semantics in a patch version. New codes may be added in minor versions.
+
+4. **`agent_start` schema is provider-neutral and minimal.** The only public fields are: `profile`, `prompt`, `task`, `interactive`, `model`, `effort`, `cwd`, `scope`, `max_runtime_sec`, plus standard client metadata (`client`, `client_name`, `client_version`, `client_session_id`). No transport enum, no provider-specific routing hints.
+
+5. **`interactive` is a boolean.** The public schema exposes `interactive` as a single boolean. No transport enum, no public transport field. Transport selection is an internal adapter concern.
+
+6. **Forbidden (dead) public fields.** The following fields MUST NOT appear in the `agent_start` signature or any shipped schema: `external_context`, `budget_usd`, `text_subtype`, `review_target`, `context_target`, `full_local`. No compatibility shims, no deprecated aliases for these.
+
+## Architecture
+
+7. **Per-profile adapter modules.** Each provider gets one bounded module under `agent_crossbar/adapters/` implementing `ProviderAdapter` from `base.py`. Adapter modules MUST NOT import from each other.
+
+8. **Core modules are provider-agnostic.** `server.py`, `jobs.py`, `validation.py`, `envelope.py`, `readiness.py` MUST NOT contain provider-specific branching. Provider behavior is injected through adapter lookups.
+
+9. **Per-profile capabilities/models live in separate profile modules.** Each profile under `agent_crossbar/profiles/` owns its capabilities, models, and default configuration. Model lists MUST come from CLI discovery (`discovery.py`), not hardcoded. Profile modules MUST NOT import from each other.
+
+10. **No compatibility aliases for removed fields.** Removed fields (`transport`, `autonomy`, `sensitivity`, `sanitized_context_only`, `timeout_sec`, etc.) MUST NOT have runtime compatibility shims, aliases, or warning-based remapping. They are simply absent.
+
+11. **Readiness probes are non-mutating and cached.** Probes inspect state, never change it. Results cache for 60 seconds. Registration alone never produces `ready`.
+
+## Testing
+
+12. **TDD for provider changes.** Any new provider adapter, capability, or transport MUST include:
+    - Unit tests proving validation, schema conformance, and error paths (no live provider).
+    - A passing live provider gate (maintainer-only workflow) on every claimed operation/transport combination.
+
+13. **No fake capabilities or models.** Model lists and capability declarations MUST come from live provider discovery or documentation references. Do not invent capabilities.
+
+14. **Deterministic CI.** All tests in public PR CI MUST pass without provider credentials. Provider-dependent tests use `pytest.skip` when credentials are absent.
+
+## Package Hygiene
+
+15. **Public artifacts exclude internal content.** Benchmark results, `.reasonix/`, `.memsearch/`, personal paths, private URLs, and handoff files MUST NOT appear in wheel/sdist/npm tarball.