agent-framework-lib 0.8.7.post7__tar.gz → 0.8.8.post2__tar.gz

{agent_framework_lib-0.8.7.post7 → agent_framework_lib-0.8.8.post2}/ARCHITECTURE.md

@@ -286,9 +286,9 @@ sequenceDiagram
     Server->>Proxy: handle_message(input)
     Proxy->>Agent: handle_message(input)
     Agent-->>Proxy: returns response
-    
+
     Note over Proxy, StateManager: Automatic State Persistence
-    
+
     Proxy->>Agent: get_state()
     Agent->>StateManager: compress_state(...)
     Agent-->>Proxy: returns new_state

{agent_framework_lib-0.8.7.post7 → agent_framework_lib-0.8.8.post2}/LICENSE

@@ -18,4 +18,4 @@ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE. 
+SOFTWARE.

{agent_framework_lib-0.8.7.post7 → agent_framework_lib-0.8.8.post2}/MANIFEST.in

@@ -11,9 +11,17 @@ include docs/*.md
 # Include type information
 include agent_framework/py.typed
 
+# Include the strict OpenShell sandbox policy (egress-deny + FS lockdown)
+recursive-include agent_framework/security *.yaml
+
 # Include PowerPoint templates embedded with the powerpoint skill
 recursive-include agent_framework/skills/builtin/skills/powerpoint/templates *.pptx
 
+# Include vendored JS libraries inlined by skills for OFFLINE rendering
+# (chart: vendor_chart.umd.min.js, mermaid: vendor_mermaid.umd.min.js). These
+# ship in the wheel via package-data; this keeps source distributions in parity.
+recursive-include agent_framework/skills/builtin/skills *.js
+
 # Include HTML templates and static files from the main package
 include agent_framework/test_app.html
 include agent_framework/*.html
@@ -72,10 +80,10 @@ recursive-exclude */node_modules *
 
 # Exclude other development directories
 prune .git
-prune .vscode 
+prune .vscode
 prune .cursor
 prune specs
 prune .venv
 prune node_modules
 prune mcp-server
-prune examples/node_modules 
+prune examples/node_modules

{agent_framework_lib-0.8.7.post7/agent_framework_lib.egg-info → agent_framework_lib-0.8.8.post2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-framework-lib
-Version: 0.8.7.post7
+Version: 0.8.8.post2
 Summary: A comprehensive Python framework for building and serving conversational AI agents with FastAPI
 Author-email: Sebastian Pavel <sebastian@cinco.ai>, Elliott Girard <elliott.girard@icloud.com>
 Maintainer-email: Sebastian Pavel <sebastian@cinco.ai>
@@ -74,6 +74,9 @@ Requires-Dist: python-pptx>=1.0.0
 Requires-Dist: python-docx>=1.1.0
 Requires-Dist: jsonschema>=4.20.0
 Requires-Dist: pymupdf>=1.27.2.2
+Requires-Dist: sqlglot>=30.9.0
+Provides-Extra: security
+Requires-Dist: llm-guard>=0.3.0; extra == "security"
 Provides-Extra: llamaindex
 Requires-Dist: llama-index>=0.14.16; extra == "llamaindex"
 Requires-Dist: llama-index-core>=0.14.16; extra == "llamaindex"
@@ -361,25 +364,25 @@ class MyAgent(LlamaIndexAgent):
             name="Calculator Agent",
             description="A helpful calculator assistant that can perform basic math operations."
         )
-    
+
     def get_agent_prompt(self) -> str:
         """Define your agent's behavior and personality."""
         return "You are a helpful calculator assistant."
-  
+
     def get_agent_tools(self) -> List[callable]:
         """Define the tools your agent can use.
-        
+
         Tools are automatically converted to LlamaIndex FunctionTool instances.
         The function name becomes the tool name, and the docstring becomes the description.
         """
         def add(a: float, b: float) -> float:
             """Add two numbers together."""
             return a + b
-        
+
         def multiply(a: float, b: float) -> float:
             """Multiply two numbers together."""
             return a * b
-        
+
         # Just return the functions - automatic conversion to FunctionTool
         return [add, multiply]
 
@@ -461,16 +464,16 @@ class OpsMangedAgent(LlamaIndexAgent):
             name="Ops Managed Agent",
             description="An agent configured via Elasticsearch."
         )
-    
+
     @classmethod
     def get_use_remote_config(cls) -> bool:
         """Enable Elasticsearch-only configuration."""
         return True
-    
+
     def get_agent_prompt(self) -> str:
         # Fallback prompt if ES config not available
         return "You are a helpful assistant."
-    
+
     def get_agent_tools(self) -> list:
         return []
 ```
@@ -592,10 +595,10 @@ Custom tools extend your agent's capabilities. The tool name and docstring are c
 ```python
 def get_weather(city: str) -> str:
     """Get the current weather for a specific city.
-    
+
     Args:
         city: The name of the city to get weather for
-        
+
     Returns:
         A description of the current weather
     """
@@ -632,29 +635,29 @@ class MyAgent(LlamaIndexAgent):
             description="A helpful assistant with custom tools."
         )
         self.file_storage = None
-    
+
     async def _ensure_file_storage(self):
         if self.file_storage is None:
             self.file_storage = await FileStorageFactory.create_storage_manager()
-    
+
     async def configure_session(self, session_configuration):
         await self._ensure_file_storage()
         self._user_id = session_configuration.get('user_id', 'default_user')
         self._session_id = session_configuration.get('session_id')
         await super().configure_session(session_configuration)
-    
+
     def get_agent_tools(self):
         storage = self.file_storage
         user_id = self._user_id
         session_id = self._session_id
-        
+
         async def store_result(param1: str, param2: int) -> str:
             """Process data and store results.
-            
+
             Args:
                 param1: Description of first parameter
                 param2: Description of second parameter
-                
+
             Returns:
                 Result description
             """
@@ -666,7 +669,7 @@ class MyAgent(LlamaIndexAgent):
                 content=result.encode()
             )
             return f"Result stored with ID: {file_id}"
-        
+
         return [store_result]
 ```
 
@@ -710,12 +713,12 @@ class MyAgent(LlamaIndexAgent):
         )
         self.mcp_tools = []
         self._mcp_initialized = False
-    
+
     async def _initialize_mcp_tools(self):
         """Load tools from MCP servers."""
         if self._mcp_initialized:
             return
-        
+
         # Configure your MCP server
         mcp_configs = [
             {
@@ -724,29 +727,29 @@ class MyAgent(LlamaIndexAgent):
                 "env": {"FILESYSTEM_ROOT": "/path/to/workspace"}
             }
         ]
-        
+
         for config in mcp_configs:
             client = BasicMCPClient(
                 config["command"],
                 args=config["args"],
                 env=config.get("env", {})
             )
-            
+
             # Load tools from the MCP server
             mcp_tool_spec = McpToolSpec(client=client)
             tools = await mcp_tool_spec.to_tool_list_async()
             self.mcp_tools.extend(tools)
-        
+
         self._mcp_initialized = True
-    
+
     async def initialize_agent(self, model_name, system_prompt, tools, **kwargs):
         # Load MCP tools before initializing agent
         await self._initialize_mcp_tools()
-        
+
         # Combine with other tools
         all_tools = self.get_agent_tools()
         await super().initialize_agent(model_name, system_prompt, all_tools, **kwargs)
-    
+
     def get_agent_tools(self):
         # Return built-in tools + MCP tools
         return self.mcp_tools
@@ -844,13 +847,13 @@ class MyMemoryAgent(LlamaIndexAgent):
             name="Memory Agent",
             description="An agent with long-term memory."
         )
-    
+
     def get_agent_prompt(self) -> str:
         return "You are a helpful assistant that remembers user preferences."
-    
+
     def get_agent_tools(self) -> list:
         return []
-    
+
     def get_memory_config(self):
         """Enable memory - just override this method!"""
         return MemoryConfig.memori_simple(
@@ -929,11 +932,11 @@ class MySkillsAgent(LlamaIndexAgent):
             description="An agent with on-demand capabilities."
         )
         # Built-in markdown skills are automatically registered by BaseAgent.__init__
-    
+
     def get_agent_prompt(self) -> str:
         # Skills discovery prompt is automatically appended by BaseAgent
         return "You are a helpful assistant."
-    
+
     def get_agent_tools(self) -> list:
         # Skill tools are auto-loaded - no need to add them manually!
         return []  # Only return custom tools specific to your agent

{agent_framework_lib-0.8.7.post7 → agent_framework_lib-0.8.8.post2}/README.md

@@ -208,25 +208,25 @@ class MyAgent(LlamaIndexAgent):
             name="Calculator Agent",
             description="A helpful calculator assistant that can perform basic math operations."
         )
-    
+
     def get_agent_prompt(self) -> str:
         """Define your agent's behavior and personality."""
         return "You are a helpful calculator assistant."
-  
+
     def get_agent_tools(self) -> List[callable]:
         """Define the tools your agent can use.
-        
+
         Tools are automatically converted to LlamaIndex FunctionTool instances.
         The function name becomes the tool name, and the docstring becomes the description.
         """
         def add(a: float, b: float) -> float:
             """Add two numbers together."""
             return a + b
-        
+
         def multiply(a: float, b: float) -> float:
             """Multiply two numbers together."""
             return a * b
-        
+
         # Just return the functions - automatic conversion to FunctionTool
         return [add, multiply]
 
@@ -308,16 +308,16 @@ class OpsMangedAgent(LlamaIndexAgent):
             name="Ops Managed Agent",
             description="An agent configured via Elasticsearch."
         )
-    
+
     @classmethod
     def get_use_remote_config(cls) -> bool:
         """Enable Elasticsearch-only configuration."""
         return True
-    
+
     def get_agent_prompt(self) -> str:
         # Fallback prompt if ES config not available
         return "You are a helpful assistant."
-    
+
     def get_agent_tools(self) -> list:
         return []
 ```
@@ -439,10 +439,10 @@ Custom tools extend your agent's capabilities. The tool name and docstring are c
 ```python
 def get_weather(city: str) -> str:
     """Get the current weather for a specific city.
-    
+
     Args:
         city: The name of the city to get weather for
-        
+
     Returns:
         A description of the current weather
     """
@@ -479,29 +479,29 @@ class MyAgent(LlamaIndexAgent):
             description="A helpful assistant with custom tools."
         )
         self.file_storage = None
-    
+
     async def _ensure_file_storage(self):
         if self.file_storage is None:
             self.file_storage = await FileStorageFactory.create_storage_manager()
-    
+
     async def configure_session(self, session_configuration):
         await self._ensure_file_storage()
         self._user_id = session_configuration.get('user_id', 'default_user')
         self._session_id = session_configuration.get('session_id')
         await super().configure_session(session_configuration)
-    
+
     def get_agent_tools(self):
         storage = self.file_storage
         user_id = self._user_id
         session_id = self._session_id
-        
+
         async def store_result(param1: str, param2: int) -> str:
             """Process data and store results.
-            
+
             Args:
                 param1: Description of first parameter
                 param2: Description of second parameter
-                
+
             Returns:
                 Result description
             """
@@ -513,7 +513,7 @@ class MyAgent(LlamaIndexAgent):
                 content=result.encode()
             )
             return f"Result stored with ID: {file_id}"
-        
+
         return [store_result]
 ```
 
@@ -557,12 +557,12 @@ class MyAgent(LlamaIndexAgent):
         )
         self.mcp_tools = []
         self._mcp_initialized = False
-    
+
     async def _initialize_mcp_tools(self):
         """Load tools from MCP servers."""
         if self._mcp_initialized:
             return
-        
+
         # Configure your MCP server
         mcp_configs = [
             {
@@ -571,29 +571,29 @@ class MyAgent(LlamaIndexAgent):
                 "env": {"FILESYSTEM_ROOT": "/path/to/workspace"}
             }
         ]
-        
+
         for config in mcp_configs:
             client = BasicMCPClient(
                 config["command"],
                 args=config["args"],
                 env=config.get("env", {})
             )
-            
+
             # Load tools from the MCP server
             mcp_tool_spec = McpToolSpec(client=client)
             tools = await mcp_tool_spec.to_tool_list_async()
             self.mcp_tools.extend(tools)
-        
+
         self._mcp_initialized = True
-    
+
     async def initialize_agent(self, model_name, system_prompt, tools, **kwargs):
         # Load MCP tools before initializing agent
         await self._initialize_mcp_tools()
-        
+
         # Combine with other tools
         all_tools = self.get_agent_tools()
         await super().initialize_agent(model_name, system_prompt, all_tools, **kwargs)
-    
+
     def get_agent_tools(self):
         # Return built-in tools + MCP tools
         return self.mcp_tools
@@ -691,13 +691,13 @@ class MyMemoryAgent(LlamaIndexAgent):
             name="Memory Agent",
             description="An agent with long-term memory."
         )
-    
+
     def get_agent_prompt(self) -> str:
         return "You are a helpful assistant that remembers user preferences."
-    
+
     def get_agent_tools(self) -> list:
         return []
-    
+
     def get_memory_config(self):
         """Enable memory - just override this method!"""
         return MemoryConfig.memori_simple(
@@ -776,11 +776,11 @@ class MySkillsAgent(LlamaIndexAgent):
             description="An agent with on-demand capabilities."
         )
         # Built-in markdown skills are automatically registered by BaseAgent.__init__
-    
+
     def get_agent_prompt(self) -> str:
         # Skills discovery prompt is automatically appended by BaseAgent
         return "You are a helpful assistant."
-    
+
     def get_agent_tools(self) -> list:
         # Skill tools are auto-loaded - no need to add them manually!
         return []  # Only return custom tools specific to your agent

{agent_framework_lib-0.8.7.post7 → agent_framework_lib-0.8.8.post2}/agent_framework/__init__.py

@@ -32,7 +32,7 @@ Example Usage:
     create_basic_agent_server(MyAgent, port=8000)
     ```
 
-Version: 0.8.7
+Version: 0.8.8
 Author: Cinco AI Team
 License: MIT
 """
@@ -95,7 +95,11 @@ def _auto_setup_dependencies() -> None:
 def _run_auto_setup() -> None:
     """Perform the actual dependency checks/installs (idempotent, cached)."""
     try:
-        from .utils.post_install import ensure_deno, ensure_playwright_browsers
+        from .utils.post_install import (
+            ensure_deno,
+            ensure_openshell,
+            ensure_playwright_browsers,
+        )
 
         # Check/install Playwright (silent if already installed)
         success, error = ensure_playwright_browsers()
@@ -111,6 +115,20 @@ def _run_auto_setup() -> None:
             logger.info(f"Deno: {message}")
             logger.info(f"Deno will be available via: {deno_path}")
 
+        # Bootstrap the OpenShell per-session shell sandbox (CLI + gateway +
+        # image). Best-effort: on failure the shell degrades to the local path
+        # with a runtime warning. This is what makes the strong sandbox work
+        # from just `pip install` + launching an agent (no manual steps).
+        ok, msg = ensure_openshell()
+        if ok:
+            logger.info("OpenShell per-session sandbox ready")
+        elif msg:
+            logger.warning(
+                "OpenShell sandbox unavailable (%s) — shell_exec will use the "
+                "degraded local path until fixed.",
+                msg,
+            )
+
     except Exception as e:
         # Don't fail the import if setup fails - tools will show errors when used
         logger.debug(f"Auto-setup skipped: {e}")
@@ -220,8 +238,14 @@ except ImportError:
 # Utilities
 from .utils import get_deno_command
 
-# Server application
-from .web.server import app, start_server
+
+# Server application — exposed lazily via module __getattr__ (see below).
+# Importing ``.web.server`` eagerly constructs the FastAPI ``app`` at package
+# import time, which boots the whole server and emits ``[SERVER]`` logs to
+# stdout. Skills run ``python -m agent_framework...`` INSIDE the sandbox, where
+# that stdout pollution corrupts the JSON the skill prints (JSONDecodeError →
+# flaky skills). Deferring the import keeps ``import agent_framework`` cheap and
+# stdout clean; ``app``/``start_server`` still resolve on first access.
 
 
 # Convenience imports for common use cases
@@ -307,6 +331,22 @@ __all__ = [
 ]
 
 
+_LAZY_SERVER_ATTRS = frozenset({"app", "start_server"})
+
+
+def __getattr__(name: str):
+    """Resolve ``app``/``start_server`` lazily from ``.web.server``.
+
+    Deferred so that ``import agent_framework`` does not boot the FastAPI app
+    (and pollute stdout) — critical for skills running inside the sandbox.
+    """
+    if name in _LAZY_SERVER_ATTRS:
+        from .web import server as _server
+
+        return getattr(_server, name)
+    raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
+
+
 # Quick start function for convenience
 def create_basic_agent_server(
     agent_class: type[AgentInterface], host: str = "0.0.0.0", port: int = 8000, reload: bool = False

{agent_framework_lib-0.8.7.post7 → agent_framework_lib-0.8.8.post2}/agent_framework/a2a/base.py

@@ -74,6 +74,7 @@ class A2ATaskProvider(ABC):
         message_id: str,
         agent_id: str,
         metadata: dict | None = None,
+        owner: str | None = None,
     ) -> A2ATask:
         """Create a new task entry.
 
@@ -84,6 +85,7 @@ class A2ATaskProvider(ABC):
             message_id: Framework message ID that triggered this task.
             agent_id: Agent identifier.
             metadata: Optional extra metadata.
+            owner: Optional authenticated principal that owns the task.
 
         Returns:
             The created A2ATask.

{agent_framework_lib-0.8.7.post7 → agent_framework_lib-0.8.8.post2}/agent_framework/a2a/endpoints/a2a_router.py

@@ -57,9 +57,17 @@ def create_a2a_router(app_state: Any, task_provider: Any) -> APIRouter:
     # Mutable container for the injected URL from /a2a/config
     injected_url_store: dict[str, str | None] = {"url": None}
 
+    # Lazy import of auth dependency to avoid circular imports with server.py.
+    # Done inside the factory (called at server startup, after server.py is fully
+    # imported) so there is no import cycle.
+    from agent_framework.web.server import get_current_user
+
     @router.get("/.well-known/agent.json")
     async def get_agent_card() -> dict:
-        """Return the A2A Agent Card."""
+        """Return the A2A Agent Card.
+
+        Public discovery endpoint per the A2A protocol: no authentication.
+        """
         env_url = os.getenv("A2A_PUBLIC_URL")
         return agent_card_builder.build(
             agent_instance,
@@ -68,13 +76,17 @@ def create_a2a_router(app_state: Any, task_provider: Any) -> APIRouter:
         )
 
     @router.post("/a2a")
-    async def handle_jsonrpc(request: Request) -> JSONResponse:
-        """Dispatch incoming JSON-RPC 2.0 requests."""
-        raw_body = await request.body()
-        return await dispatcher.dispatch(raw_body, app_state)
+    async def handle_jsonrpc(
+        request: Request,
+        _user: str = Depends(get_current_user),
+    ) -> JSONResponse:
+        """Dispatch incoming JSON-RPC 2.0 requests.
 
-    # Lazy import of auth dependency to avoid circular imports with server.py
-    from agent_framework.web.server import get_current_user
+        Requires authentication before any JSON-RPC processing when auth is
+        active; in dev-mode the principal resolves to "anonymous".
+        """
+        raw_body = await request.body()
+        return await dispatcher.dispatch(raw_body, app_state, principal=_user)
 
     @router.post("/a2a/config")
     async def update_config(

{agent_framework_lib-0.8.7.post7 → agent_framework_lib-0.8.8.post2}/agent_framework/a2a/endpoints/jsonrpc_dispatcher.py

@@ -35,12 +35,17 @@ class JSONRPCDispatcher:
         """
         self._translation_layer = translation_layer
 
-    async def dispatch(self, raw_body: bytes, app_state: Any) -> JSONResponse | StreamingResponse:
+    async def dispatch(
+        self, raw_body: bytes, app_state: Any, principal: str | None = None
+    ) -> JSONResponse | StreamingResponse:
         """Parse and dispatch a JSON-RPC request.
 
         Args:
             raw_body: Raw HTTP body bytes.
             app_state: FastAPI app.state for context.
+            principal: Authenticated principal that issued the request, used to
+                record task ownership at creation. None when unauthenticated
+                (e.g. dev-mode).
 
         Returns:
             JSONResponse for sync methods, StreamingResponse for message/stream.
@@ -60,13 +65,16 @@ class JSONRPCDispatcher:
 
         request_id = request.id
 
-        return await self._route_method(request)
+        return await self._route_method(request, principal)
 
-    async def _route_method(self, request: JSONRPCRequest) -> JSONResponse | StreamingResponse:
+    async def _route_method(
+        self, request: JSONRPCRequest, principal: str | None = None
+    ) -> JSONResponse | StreamingResponse:
         """Route to the appropriate translation layer method.
 
         Args:
             request: Validated JSON-RPC request.
+            principal: Authenticated principal that issued the request.
 
         Returns:
             Response from the handler.
@@ -83,7 +91,9 @@ class JSONRPCDispatcher:
                     return self._error_response(
                         request_id, INVALID_PARAMS, "Invalid params", {"details": str(e)}
                     )
-                result = await self._translation_layer.handle_message_send(send_params, request_id)
+                result = await self._translation_layer.handle_message_send(
+                    send_params, request_id, principal=principal
+                )
                 return self._success_response(request_id, result)
 
             elif method == "message/stream":
@@ -94,7 +104,7 @@ class JSONRPCDispatcher:
                         request_id, INVALID_PARAMS, "Invalid params", {"details": str(e)}
                     )
                 generator = await self._translation_layer.handle_message_stream(
-                    stream_params, request_id
+                    stream_params, request_id, principal=principal
                 )
                 return StreamingResponse(generator, media_type="text/event-stream")
 
@@ -105,7 +115,9 @@ class JSONRPCDispatcher:
                     return self._error_response(
                         request_id, INVALID_PARAMS, "Invalid params", {"details": str(e)}
                     )
-                result = await self._translation_layer.handle_tasks_get(get_params, request_id)
+                result = await self._translation_layer.handle_tasks_get(
+                    get_params, request_id, principal=principal
+                )
                 return self._success_response(request_id, result)
 
             elif method == "tasks/cancel":