agentic-dev-loop 0.11.0__tar.gz → 0.12.0__tar.gz

{agentic_dev_loop-0.11.0/src/agentic_dev_loop.egg-info → agentic_dev_loop-0.12.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 0.11.0
+Version: 0.12.0
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -51,13 +51,7 @@ trusted actions - and `agentic-dev-loop` runs it end to end: agent and command s
 kernel-level sandboxing via Docker, verdicts route the graph, every boundary is
 checkpointed, and nothing gets committed until every gate passes.
 
-```mermaid
-flowchart LR
-    dev["agent: dev"] --> test{{"test gate"}} --> review["agent: review"] --> qa["agent: qa"] --> commit["action: commit"]
-    test -- fail --> dev
-    review -- fail --> dev
-    qa -- fail --> dev
-```
+![The live graph view - pipeline graph with fail loopbacks, summary tiles, per-stage consoles, and event log](https://raw.githubusercontent.com/lukedawilson/agentic-dev-loop/main/docs/viz-pipeline.png)
 
 - **A tool, not a wiring project.** One CLI entry point, opinionated defaults,
   fixed safety policies. You write the pipeline and the agent definitions -
@@ -175,7 +169,13 @@ the next startup retries it. Pass
 
 **What a run looks like** (the shipped self-loop example):
 
-![The live graph view - pipeline stages with verdict badges, retry cycles, and per-stage consoles](docs/viz-screenshot.png)
+```mermaid
+flowchart LR
+    dev["agent: dev"] --> test{{"test gate"}} --> review["agent: review"] --> qa["agent: qa"] --> commit["action: commit"]
+    test -- fail --> dev
+    review -- fail --> dev
+    qa -- fail --> dev
+```
 
 1. **dev** - the dev agent works with full context (loaded docs + shared files).
    Its edits are untracked; only declared `produces:` files are hygiene-tracked.
@@ -391,6 +391,12 @@ steps:
   engine-written output - captured step output, retry notes, artifacts, and
   `state_dir` files. (Hygiene: the declaring step's agent has already seen
   the value in its own env.)
+- **File provider and LLM keys.** `from: file` reads a host file (`key` is the
+  path, optional `json_key` selects a JSON field). The `llm:` block accepts
+  exactly one of `api_key_env` or `api_key_secret`; the resolved key joins the
+  redaction set. See [Copilot as an endpoint](docs/setup.md#copilot-subscription-endpoint-058)
+  for the GitHub Copilot subscription profile (`copilot-login` device flow,
+  `copilot-models` probe, and the required endpoint headers).
 
 ### Per-stage networking
 
@@ -462,6 +468,76 @@ lines, the sandbox's new lines are appended in order, both sides converge, and
 the run continues with `[isolation] merged concurrent edits: ...` on the
 console.
 
+### Copilot subscription endpoint
+
+GitHub Copilot subscriptions work as an OpenAI-compatible LLM endpoint: log in
+once, then point an `llm:` block at it. The smoke harness runs the same plan
+against both the Copilot endpoint and a standard OpenAI-compatible endpoint,
+so the provider choice is independent of the pipeline design.
+
+```bash
+agentic-dev-loop copilot-login    # device flow; writes the token (mode 600)
+agentic-dev-loop copilot-models   # the models this token's tier can use
+```
+
+```yaml
+llm:
+  model: openai/gpt-5.6-luna      # pro default; probe-validated (see below)
+  base_url: https://api.githubcopilot.com
+  api_key_secret:
+    from: file
+    key: ~/.agentic-dev-loop/auth/copilot.json
+    json_key: access_token
+  headers:
+    Copilot-Integration-Id: vscode-chat
+    Editor-Version: vscode/1.94.0
+    Openai-Intent: conversation-panel
+llms:
+  flash:
+    model: openai/gpt-4.1         # lite tier; no reasoning_effort (see below)
+    base_url: https://api.githubcopilot.com
+    api_key_secret:
+      from: file
+      key: ~/.agentic-dev-loop/auth/copilot.json
+      json_key: access_token
+    headers:
+      Copilot-Integration-Id: vscode-chat
+      Editor-Version: vscode/1.94.0
+      Openai-Intent: conversation-panel
+```
+
+- The `openai/` prefix on model names is required: litellm otherwise routes a
+  bare `claude-*` name through Anthropic's wire format, which the gateway
+  rejects. The prefix forces the OpenAI-compatible route.
+- The model pins are probe-validated against the live endpoint (2026-11-06).
+  `gpt-5.6-luna` routes through the Responses API (the SDK switches
+  automatically), accepts `xhigh`, and returns real verdicts on the review
+  step. `gpt-4.1` tool-calls cleanly on the chat path but hard-400s on any
+  `reasoning_effort`, so lite-tier steps set none.
+- The brief step runs on the pro model at `medium`: no-effort `gpt-4.1`
+  cannot satisfy the mechanical brief-coverage gate.
+- The engine forces string-encoded message content for Copilot configs: the
+  gateway silently drops ARRAY-encoded tool results, which would leave an
+  agent blind to its own terminal output.
+
+Known limitations (probe-validated, not speculation):
+
+- Anthropic models are unusable for agent steps on this endpoint: the claude
+  pins collapse to tool-less narration on review (planning-docs/059), and
+  claude-opus-4.8 returns two choices on the non-streamed path the engine
+  uses.
+- `gpt-4o-mini` caps chat context at 12288 tokens (it overran on the first
+  smoke run).
+- `gpt-4o` and `gpt-4.1` reject any `reasoning_effort` on the chat path.
+- `gpt-5.x` models are Responses-API-only.
+- kimi-k3 accepts only `low`/`high`/`max` effort, and its tool results were
+  dropped by the gateway until the string-content policy above.
+- `gpt-4.1` carries a gateway "utility model" rate limit that a sustained dev
+  loop can trip; it resets within minutes.
+
+See [docs/setup.md](docs/setup.md#copilot-subscription-endpoint-058) for the
+token lifecycle, the probe-validated headers, and the full details.
+
 
 ## Authoring a loop for your own repo
 

{agentic_dev_loop-0.11.0 → agentic_dev_loop-0.12.0}/README.md

@@ -7,13 +7,7 @@ trusted actions - and `agentic-dev-loop` runs it end to end: agent and command s
 kernel-level sandboxing via Docker, verdicts route the graph, every boundary is
 checkpointed, and nothing gets committed until every gate passes.
 
-```mermaid
-flowchart LR
-    dev["agent: dev"] --> test{{"test gate"}} --> review["agent: review"] --> qa["agent: qa"] --> commit["action: commit"]
-    test -- fail --> dev
-    review -- fail --> dev
-    qa -- fail --> dev
-```
+![The live graph view - pipeline graph with fail loopbacks, summary tiles, per-stage consoles, and event log](https://raw.githubusercontent.com/lukedawilson/agentic-dev-loop/main/docs/viz-pipeline.png)
 
 - **A tool, not a wiring project.** One CLI entry point, opinionated defaults,
   fixed safety policies. You write the pipeline and the agent definitions -
@@ -131,7 +125,13 @@ the next startup retries it. Pass
 
 **What a run looks like** (the shipped self-loop example):
 
-![The live graph view - pipeline stages with verdict badges, retry cycles, and per-stage consoles](docs/viz-screenshot.png)
+```mermaid
+flowchart LR
+    dev["agent: dev"] --> test{{"test gate"}} --> review["agent: review"] --> qa["agent: qa"] --> commit["action: commit"]
+    test -- fail --> dev
+    review -- fail --> dev
+    qa -- fail --> dev
+```
 
 1. **dev** - the dev agent works with full context (loaded docs + shared files).
    Its edits are untracked; only declared `produces:` files are hygiene-tracked.
@@ -347,6 +347,12 @@ steps:
   engine-written output - captured step output, retry notes, artifacts, and
   `state_dir` files. (Hygiene: the declaring step's agent has already seen
   the value in its own env.)
+- **File provider and LLM keys.** `from: file` reads a host file (`key` is the
+  path, optional `json_key` selects a JSON field). The `llm:` block accepts
+  exactly one of `api_key_env` or `api_key_secret`; the resolved key joins the
+  redaction set. See [Copilot as an endpoint](docs/setup.md#copilot-subscription-endpoint-058)
+  for the GitHub Copilot subscription profile (`copilot-login` device flow,
+  `copilot-models` probe, and the required endpoint headers).
 
 ### Per-stage networking
 
@@ -418,6 +424,76 @@ lines, the sandbox's new lines are appended in order, both sides converge, and
 the run continues with `[isolation] merged concurrent edits: ...` on the
 console.
 
+### Copilot subscription endpoint
+
+GitHub Copilot subscriptions work as an OpenAI-compatible LLM endpoint: log in
+once, then point an `llm:` block at it. The smoke harness runs the same plan
+against both the Copilot endpoint and a standard OpenAI-compatible endpoint,
+so the provider choice is independent of the pipeline design.
+
+```bash
+agentic-dev-loop copilot-login    # device flow; writes the token (mode 600)
+agentic-dev-loop copilot-models   # the models this token's tier can use
+```
+
+```yaml
+llm:
+  model: openai/gpt-5.6-luna      # pro default; probe-validated (see below)
+  base_url: https://api.githubcopilot.com
+  api_key_secret:
+    from: file
+    key: ~/.agentic-dev-loop/auth/copilot.json
+    json_key: access_token
+  headers:
+    Copilot-Integration-Id: vscode-chat
+    Editor-Version: vscode/1.94.0
+    Openai-Intent: conversation-panel
+llms:
+  flash:
+    model: openai/gpt-4.1         # lite tier; no reasoning_effort (see below)
+    base_url: https://api.githubcopilot.com
+    api_key_secret:
+      from: file
+      key: ~/.agentic-dev-loop/auth/copilot.json
+      json_key: access_token
+    headers:
+      Copilot-Integration-Id: vscode-chat
+      Editor-Version: vscode/1.94.0
+      Openai-Intent: conversation-panel
+```
+
+- The `openai/` prefix on model names is required: litellm otherwise routes a
+  bare `claude-*` name through Anthropic's wire format, which the gateway
+  rejects. The prefix forces the OpenAI-compatible route.
+- The model pins are probe-validated against the live endpoint (2026-11-06).
+  `gpt-5.6-luna` routes through the Responses API (the SDK switches
+  automatically), accepts `xhigh`, and returns real verdicts on the review
+  step. `gpt-4.1` tool-calls cleanly on the chat path but hard-400s on any
+  `reasoning_effort`, so lite-tier steps set none.
+- The brief step runs on the pro model at `medium`: no-effort `gpt-4.1`
+  cannot satisfy the mechanical brief-coverage gate.
+- The engine forces string-encoded message content for Copilot configs: the
+  gateway silently drops ARRAY-encoded tool results, which would leave an
+  agent blind to its own terminal output.
+
+Known limitations (probe-validated, not speculation):
+
+- Anthropic models are unusable for agent steps on this endpoint: the claude
+  pins collapse to tool-less narration on review (planning-docs/059), and
+  claude-opus-4.8 returns two choices on the non-streamed path the engine
+  uses.
+- `gpt-4o-mini` caps chat context at 12288 tokens (it overran on the first
+  smoke run).
+- `gpt-4o` and `gpt-4.1` reject any `reasoning_effort` on the chat path.
+- `gpt-5.x` models are Responses-API-only.
+- kimi-k3 accepts only `low`/`high`/`max` effort, and its tool results were
+  dropped by the gateway until the string-content policy above.
+- `gpt-4.1` carries a gateway "utility model" rate limit that a sustained dev
+  loop can trip; it resets within minutes.
+
+See [docs/setup.md](docs/setup.md#copilot-subscription-endpoint-058) for the
+token lifecycle, the probe-validated headers, and the full details.
+
 
 ## Authoring a loop for your own repo
 

{agentic_dev_loop-0.11.0 → agentic_dev_loop-0.12.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentic-dev-loop"
-version = "0.11.0"
+version = "0.12.0"
 description = "Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase."
 readme = "README.md"
 requires-python = ">=3.12"

{agentic_dev_loop-0.11.0 → agentic_dev_loop-0.12.0}/src/agentic_dev_loop/core/config.py

@@ -10,12 +10,13 @@ from pathlib import Path
 from typing import Any, Literal
 
 import yaml
-from pydantic import BaseModel, ConfigDict, Field, field_validator, model_validator
+from pydantic import (BaseModel, ConfigDict, Field, field_validator,
+                      model_serializer, model_validator)
 
 from agentic_dev_loop.core.paths import _has_wildcards, path_excluded, relative_parts
 
 TERMINALS = frozenset({"success", "failure"})
-KNOWN_SECRET_PROVIDERS = frozenset({"env"})
+KNOWN_SECRET_PROVIDERS = frozenset({"env", "file"})
 MOUNT_MODES = frozenset({"rw", "ro"})
 # The egress preset names the engine ships (BR-9). Config validates the
 # name here; the target data lives in engine/presets.py (preset data,
@@ -183,14 +184,17 @@ def route_target(route: RouteTarget | None) -> str | None:
 
 class SecretSpec(BaseModel):
     """One ``secrets:`` ref - the locator only, never a value. ``from`` names
-    the provider (``env`` first); ``key`` is that provider's locator (for
+    the provider (``env`` or ``file``); ``key`` is that provider's locator (for
     ``env``, the host environment variable to read and the step env name to
-    inject). Unknown keys fail at load (extra="forbid")."""
+    inject; for ``file``, the JSON file path). ``json_key`` selects a key
+    inside the JSON file and is file-provider-only. Unknown keys fail at load
+    (extra="forbid")."""
 
     model_config = ConfigDict(extra="forbid", populate_by_name=True)
 
     from_: str = Field(alias="from")
     key: str
+    json_key: str | None = None
 
     @field_validator("from_")
     @classmethod
@@ -208,6 +212,28 @@ class SecretSpec(BaseModel):
             raise ValueError("secret key must be a non-empty string")
         return v
 
+    @field_validator("json_key")
+    @classmethod
+    def _nonempty_json_key(cls, v: str | None) -> str | None:
+        if v is not None and not v.strip():
+            raise ValueError("secret json_key must be a non-empty string")
+        return v
+
+    @model_validator(mode="after")
+    def _json_key_only_for_file(self) -> "SecretSpec":
+        if self.json_key is not None and self.from_ != "file":
+            raise ValueError(
+                "secret json_key is only valid with the 'file' provider")
+        return self
+
+    @model_serializer(mode="wrap")
+    def _omit_absent_json_key(self, handler):
+        """Keep the pre-058 env-provider dump shape byte-identical."""
+        data = handler(self)
+        if data.get("json_key") is None:
+            data.pop("json_key", None)
+        return data
+
 
 class IsolationConfig(BaseModel):
     """Optional `isolation:` section - configures the always-on sandbox (BR-2).
@@ -600,13 +626,29 @@ class LlmConfig(BaseModel):
 
     model: str
     base_url: str | None = None
-    api_key_env: str
+    # 058 (D3): exactly one host-side key mechanism - an environment variable
+    # (the existing shape) or a file-backed secret spec.
+    api_key_env: str | None = None
+    api_key_secret: SecretSpec | None = None
+    # 058 (D2): extra HTTP headers forwarded verbatim to the SDK LLM
+    # (``extra_headers``). Empty = no change for every existing pipeline.
+    headers: dict[str, str] = Field(default_factory=dict)
     timeout: float | None = None  # omitted → opinionated no-timeout default
     # 047 (D1) / 054 (D6): opt-in passthrough; unset means reasoning is off
     # (the engine forwards none and strips reasoning passback). The SDK
     # "high" default never engages because build_llm always passes the value.
     reasoning_effort: ReasoningEffort | None = None
 
+    @model_validator(mode="after")
+    def _exactly_one_api_key_mechanism(self) -> "LlmConfig":
+        has_env = self.api_key_env is not None
+        has_secret = self.api_key_secret is not None
+        if has_env == has_secret:
+            raise ValueError(
+                "set exactly one of 'api_key_env' or 'api_key_secret' on the "
+                "llm block (neither or both are invalid)")
+        return self
+
 
 class PipelineConfig(BaseModel):
     model_config = ConfigDict(extra="forbid")

{agentic_dev_loop-0.11.0 → agentic_dev_loop-0.12.0}/src/agentic_dev_loop/engine/cli.py

@@ -10,9 +10,12 @@ import json
 import os
 import signal
 import sys
+import threading
 from pathlib import Path
 
 from agentic_dev_loop.core.config import PipelineConfig, load_config
+from .copilot_auth import (TOKEN_PATH, CopilotAuthError, list_copilot_models,
+                           login, read_token)
 from .containers import containers_report
 from .isolation import isolation_state_dir, reap_orphaned_containers
 from .loaders import mark_plan_completed
@@ -46,6 +49,14 @@ def _restore_sigterm_handler(previous) -> None:
     signal.signal(signal.SIGTERM, previous)
 
 
+def _wait_for_interrupt() -> None:
+    """Block until the user presses ctrl+c; a bounded wait keeps the loop
+    responsive to signals without requiring a tty."""
+    idle = threading.Event()
+    while not idle.wait(1.0):
+        pass
+
+
 def _version() -> str:
     """The installed distribution version - the single source of truth."""
     try:
@@ -149,6 +160,52 @@ def _print_containers_report(report) -> None:
               f"run={run} pid={pid_s}")
 
 
+def _token_path(value: str | None) -> Path:
+    return Path(value).expanduser() if value else TOKEN_PATH.expanduser()
+
+
+def _run_copilot_login(argv: list[str]) -> int:
+    parser = argparse.ArgumentParser(
+        prog="agentic-dev-loop copilot-login",
+        description="Run the GitHub device flow and store the Copilot OAuth "
+                    "token (~/.agentic-dev-loop/auth/copilot.json, mode 600).")
+    parser.add_argument("--token-file", default=None,
+                        help="token path (default: "
+                             "~/.agentic-dev-loop/auth/copilot.json)")
+    args = parser.parse_args(argv)
+    path = _token_path(args.token_file)
+    try:
+        login(token_path=path)
+    except CopilotAuthError as e:
+        print(f"copilot-login: {e}", file=sys.stderr)
+        return 1
+    print(f"Copilot token written to {path}")
+    return 0
+
+
+def _run_copilot_models(argv: list[str]) -> int:
+    parser = argparse.ArgumentParser(
+        prog="agentic-dev-loop copilot-models",
+        description="List the Copilot models available to this token's tier.")
+    parser.add_argument("--token-file", default=None,
+                        help="token path (default: "
+                             "~/.agentic-dev-loop/auth/copilot.json)")
+    parser.add_argument("--json", action="store_true",
+                        help="emit the model list as JSON")
+    args = parser.parse_args(argv)
+    try:
+        models = list_copilot_models(read_token(_token_path(args.token_file)))
+    except CopilotAuthError as e:
+        print(f"copilot-models: {e}", file=sys.stderr)
+        return 1
+    if args.json:
+        print(json.dumps({"models": models}, sort_keys=True))
+    else:
+        for model in models:
+            print(model)
+    return 0
+
+
 def build_parser(cfg_path) -> argparse.ArgumentParser:
     """The full parser for one pipeline: core flags + loader-contributed."""
     registry, _ = _registry_for(cfg_path)
@@ -158,13 +215,17 @@ def build_parser(cfg_path) -> argparse.ArgumentParser:
     return parser
 
 
-def main(argv: list[str] | None = None) -> int:
+def main(argv: list[str] | None = None, *, keep_alive: bool = True) -> int:
     if argv is None:
         argv = sys.argv[1:]
     else:
         argv = list(argv)
     if argv and argv[0] == "containers":
         return _run_containers(argv[1:])
+    if argv and argv[0] == "copilot-login":
+        return _run_copilot_login(argv[1:])
+    if argv and argv[0] == "copilot-models":
+        return _run_copilot_models(argv[1:])
     if argv and argv[0] == "init":
         from .onboarding.init import run_init
         return run_init(argv[1:])
@@ -207,6 +268,12 @@ def main(argv: list[str] | None = None) -> int:
         if not success:
             print("agentic-dev-loop: pipeline failed - exiting with code 1",
                   file=sys.stderr)
+        if keep_alive and not args.no_viz:
+            print("Pipeline finished: press ctrl+c to exit")
+            try:
+                _wait_for_interrupt()
+            except KeyboardInterrupt:
+                pass
         return 0 if success else 1
     finally:
         _restore_sigterm_handler(previous)