agent-wire-cli 0.2.2__tar.gz → 0.2.4__tar.gz

{agent_wire_cli-0.2.2 → agent_wire_cli-0.2.4}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-wire",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Live web and 31-platform access for agents: token-compressed, privacy-firewalled, injection-shielded. Auto-triggers on links and live questions.",
   "author": {
     "name": "uncoalesced"

agent_wire_cli-0.2.4/.github/dependabot.yml

@@ -0,0 +1,31 @@
+version: 2
+updates:
+  # Python dependencies in uv.lock. Security fixes come as separate PRs straight away
+  # (Dependabot security updates); this keeps routine upgrades to one weekly batch. Routine
+  # upgrades wait 7 days after a release, so a hijacked version is usually pulled before we take it.
+  - package-ecosystem: uv
+    directory: /
+    target-branch: dev
+    schedule:
+      interval: weekly
+      day: monday
+    groups:
+      python:
+        patterns: ["*"]
+        update-types: [minor, patch]
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
+
+  # Actions are pinned to commit SHAs; this bumps the SHA and the version comment together.
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: dev
+    schedule:
+      interval: weekly
+      day: monday
+    groups:
+      actions:
+        patterns: ["*"]
+    cooldown:
+      default-days: 7

agent_wire_cli-0.2.4/.github/scripts/mcp_smoke.py

@@ -0,0 +1,36 @@
+"""CI smoke test for an installed agent-wire: start the real stdio MCP server and talk to it.
+
+No network: lists tools in both modes, runs a Code Mode script that makes no wire calls, and checks
+that a runaway script comes back as an error instead of hanging the server.
+"""
+
+import asyncio
+import sys
+
+from fastmcp import Client
+from fastmcp.client.transports import StdioTransport
+
+FULL = {"wire_read", "wire_search", "wire_feed", "wire_me", "wire_research", "wire_cite",
+        "wire_run", "wire_status"}  # fmt: skip
+
+
+async def check(args: list[str], expect: set[str]) -> None:
+    transport = StdioTransport(sys.executable, ["-m", "agent_wire", *args])
+    async with Client(transport) as c:
+        names = {t.name for t in await c.list_tools()}
+        assert names == expect, f"{args}: tools {sorted(names)}"
+        out = await c.call_tool("wire_run", {"code": "return [1 + 1, typeof wire.read]"})
+        text = out.content[0].text
+        assert text.startswith("[WIRE | code | 0 calls") and '[2,"function"]' in text, text
+        hang = (await c.call_tool("wire_run", {"code": "for (;;) await 0"})).content[0].text
+        assert hang.startswith("[WIRE | error | code") and "CPU time limit" in hang, hang
+    print(f"ok: wire {' '.join(args)} -> {len(names)} tools")
+
+
+async def main() -> None:
+    await asyncio.wait_for(check(["serve"], FULL), 120)
+    await asyncio.wait_for(check(["serve", "--code-mode"], {"wire_run", "wire_status"}), 120)
+
+
+if __name__ == "__main__":
+    asyncio.run(main())

agent_wire_cli-0.2.4/.github/workflows/ci.yml

@@ -0,0 +1,116 @@
+name: ci
+
+on:
+  push:
+    branches: [main, dev]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+      - name: Lockfile matches pyproject.toml
+        run: uv lock --check
+      - name: Install
+        run: uv sync --extra dev --locked
+      - name: Ruff lint
+        run: uv run ruff check src tests .github/scripts
+      - name: Ruff format
+        run: uv run ruff format --check .
+      - name: No temp-dir writes in the package
+        run: "! grep -rnE 'tempfile|/tmp' src/"
+
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        python: ["3.11", "3.14"]
+        include:
+          - {os: ubuntu-latest, python: "3.12"}
+          - {os: ubuntu-latest, python: "3.13"}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+        with:
+          python-version: ${{ matrix.python }}
+      - name: Install
+        run: uv sync --extra dev --locked
+      - name: Test (offline; network calls are faked)
+        run: uv run pytest -q
+
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+      - name: Build sdist and wheel
+        run: uv build
+      - name: Package metadata renders on PyPI
+        run: uvx twine check --strict dist/*
+      - name: Wheel bundles the skill, rules and sandbox, at the pyproject version
+        run: |
+          python - <<'EOF'
+          import glob, re, zipfile
+          version = re.search(r'^version = "(.+)"', open("pyproject.toml").read(), re.M)[1]
+          whl = glob.glob("dist/*.whl")[0]
+          assert f"-{version}-" in whl, (whl, version)
+          names = zipfile.ZipFile(whl).namelist()
+          for need in ("agent_wire/assets/SKILL.md", "agent_wire/assets/wire-worker.md",
+                       "agent_wire/research/engine.py", "agent_wire/codemode/sandbox.py",
+                       "agent_wire/codemode/api.py"):
+              assert need in names, need
+          print("ok", whl, len(names), "files")
+          EOF
+
+  # Install the built wheel the way users do (no repo, no dev deps) and drive the real MCP server.
+  smoke:
+    needs: build
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        python: ["3.11", "3.14"]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+        with:
+          python-version: ${{ matrix.python }}
+      - name: Build wheel
+        run: uv build --wheel
+      - name: CLI runs from the wheel
+        shell: bash
+        run: |
+          whl=$(ls dist/*.whl)
+          uvx --python ${{ matrix.python }} --from "$whl" agent-wire version
+          out=$(uvx --python ${{ matrix.python }} --from "$whl" wire run -e "return 6 * 7")
+          echo "$out"
+          grep -q '^42$' <<<"$out"
+      - name: MCP server over stdio (both modes)
+        shell: bash
+        run: >-
+          uv run --isolated --no-project --python ${{ matrix.python }}
+          --with "$(ls dist/*.whl)" python .github/scripts/mcp_smoke.py

agent_wire_cli-0.2.4/.github/workflows/codeql.yml

@@ -0,0 +1,40 @@
+name: codeql
+
+on:
+  push:
+    branches: [main, dev]
+  pull_request:
+  schedule:
+    - cron: "41 5 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  analyze:
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python, actions]
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      security-events: write # upload results to the Security tab
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          queries: security-extended
+      - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        with:
+          category: /language:${{ matrix.language }}

{agent_wire_cli-0.2.2 → agent_wire_cli-0.2.4}/.github/workflows/release.yml

@@ -13,9 +13,14 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+        with:
+          enable-cache: false # never build a release from a cache another run could have written
       - name: Tag matches the package version
         run: |
           v=$(grep -m1 '^version' pyproject.toml | cut -d'"' -f2)
@@ -23,7 +28,8 @@ jobs:
       - run: uv sync --extra dev --locked
       - run: uv run pytest -q
       - run: uv build
-      - uses: actions/upload-artifact@v4
+      - run: uvx twine check --strict dist/*
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: dist
           path: dist/
@@ -31,12 +37,13 @@ jobs:
   publish:
     needs: build
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     environment: pypi
     permissions:
-      id-token: write  # PyPI trusted publishing
+      id-token: write # PyPI trusted publishing
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: dist
           path: dist/
-      - uses: pypa/gh-action-pypi-publish@release/v1
+      - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3

agent_wire_cli-0.2.4/.github/workflows/security.yml

@@ -0,0 +1,70 @@
+name: security
+
+on:
+  push:
+    branches: [main, dev]
+  pull_request:
+  schedule:
+    - cron: "17 6 * * 1" # Mondays: new advisories land against an unchanged lockfile
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: security-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  # Known CVEs in every locked dependency, including the optional extras.
+  pip-audit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+      - name: Export the lockfile
+        run: uv export --frozen --no-hashes --all-extras --no-emit-project -o requirements-audit.txt
+      - name: pip-audit
+        run: uvx pip-audit==2.10.1 -r requirements-audit.txt --progress-spinner off --desc
+
+  # Python security lint: medium severity and up fails the job.
+  bandit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+      - name: bandit
+        run: uvx bandit==1.9.4 -r src -ll
+
+  # The workflows themselves: unpinned actions, credential leaks, template injection.
+  zizmor:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+      - name: zizmor
+        run: uvx zizmor==1.31.1 --format plain .github/workflows
+        env:
+          GH_TOKEN: ${{ github.token }}
+
+  # Dependencies a pull request adds or upgrades, checked against GitHub's advisory database.
+  dependency-review:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: moderate