agentic-dev-loop 0.11.1__tar.gz → 0.12.1__tar.gz

{agentic_dev_loop-0.11.1/src/agentic_dev_loop.egg-info → agentic_dev_loop-0.12.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 0.11.1
+Version: 0.12.1
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -60,6 +60,10 @@ checkpointed, and nothing gets committed until every gate passes.
   parsed from files, retries are bounded, nothing is best-effort.
 - **Sandboxed by default.** The agent's shell and every command step run inside
   an always-on Docker sandbox. There is no opt-out.
+- **Any OpenAI-compatible model, or your Copilot subscription.** Point
+  `llm.base_url` at any OpenAI-compatible endpoint with an API key, or log in
+  with `agentic-dev-loop copilot-login` and run on Copilot models. See
+  [LLM providers](#llm-providers).
 
 ---
 
@@ -94,6 +98,40 @@ Docker engine does:
 Native Windows (outside WSL2) is not supported: every Windows-specific code
 path and test was removed, and CI runs on Ubuntu only.
 
+## LLM providers
+
+Two ways to run the same pipeline. The engine speaks OpenAI-compatible wire
+format throughout, so every step, profile, and gate works identically on
+either provider style:
+
+| Provider | Setup |
+| --- | --- |
+| **Any OpenAI-compatible endpoint** | API key via `api_key_env` + `base_url` in the `llm:` block: DeepSeek, OpenAI, or any OpenAI-compatible API. Full reference: [pipeline.yaml reference](#pipelineyaml-reference). |
+| **GitHub Copilot subscription** | `agentic-dev-loop copilot-login` once, then point the `llm:` block at `https://api.githubcopilot.com` with the file-backed token. Probe-validated pins: `openai/gpt-5.6-luna` (pro) and `openai/gpt-4.1` (lite). Full config and known limitations: [Copilot subscription endpoint](#copilot-subscription-endpoint). |
+
+```yaml
+# OpenAI-compatible endpoint (any provider)
+llm:
+  model: openai/deepseek-v4-pro
+  base_url: https://api.deepseek.com
+  api_key_env: OPENAI_API_KEY
+```
+
+```yaml
+# GitHub Copilot subscription
+llm:
+  model: openai/gpt-5.6-luna        # pro; probe-validated pin
+  base_url: https://api.githubcopilot.com
+  api_key_secret:
+    from: file
+    key: ~/.agentic-dev-loop/auth/copilot.json
+    json_key: access_token
+  headers:
+    Copilot-Integration-Id: vscode-chat
+    Editor-Version: vscode/1.94.0
+    Openai-Intent: conversation-panel
+```
+
 ## Installation
 
 **Prerequisites**
@@ -102,7 +140,7 @@ path and test was removed, and CI runs on Ubuntu only.
 | --- | --- |
 | Python | ≥ 3.12 |
 | Docker engine | Engine API ≥ 1.43 (Engine 24). Any compliant engine works - Docker Desktop, OrbStack, Colima, Rancher Desktop, podman docker-compat. On Windows, run under WSL2: the repo must live on the WSL filesystem, not /mnt/c. |
-| LLM API key | The env var named by your pipeline's `api_key_env` (e.g. `OPENAI_API_KEY`) must be set - a missing key fails fast, naming it. |
+| LLM API key | The env var named by your pipeline's `api_key_env` (e.g. `OPENAI_API_KEY`) must be set - a missing key fails fast, naming it. Alternatively, `agentic-dev-loop copilot-login` authenticates a Copilot subscription (see [LLM providers](#llm-providers)). |
 
 ```bash
 pip install "agentic-dev-loop==1.0.0a17"
@@ -391,6 +429,12 @@ steps:
   engine-written output - captured step output, retry notes, artifacts, and
   `state_dir` files. (Hygiene: the declaring step's agent has already seen
   the value in its own env.)
+- **File provider and LLM keys.** `from: file` reads a host file (`key` is the
+  path, optional `json_key` selects a JSON field). The `llm:` block accepts
+  exactly one of `api_key_env` or `api_key_secret`; the resolved key joins the
+  redaction set. See [Copilot as an endpoint](docs/setup.md#copilot-subscription-endpoint-058)
+  for the GitHub Copilot subscription profile (`copilot-login` device flow,
+  `copilot-models` probe, and the required endpoint headers).
 
 ### Per-stage networking
 
@@ -462,6 +506,76 @@ lines, the sandbox's new lines are appended in order, both sides converge, and
 the run continues with `[isolation] merged concurrent edits: ...` on the
 console.
 
+### Copilot subscription endpoint
+
+GitHub Copilot subscriptions work as an OpenAI-compatible LLM endpoint: log in
+once, then point an `llm:` block at it. The smoke harness runs the same plan
+against both the Copilot endpoint and a standard OpenAI-compatible endpoint,
+so the provider choice is independent of the pipeline design.
+
+```bash
+agentic-dev-loop copilot-login    # device flow; writes the token (mode 600)
+agentic-dev-loop copilot-models   # the models this token's tier can use
+```
+
+```yaml
+llm:
+  model: openai/gpt-5.6-luna      # pro default; probe-validated (see below)
+  base_url: https://api.githubcopilot.com
+  api_key_secret:
+    from: file
+    key: ~/.agentic-dev-loop/auth/copilot.json
+    json_key: access_token
+  headers:
+    Copilot-Integration-Id: vscode-chat
+    Editor-Version: vscode/1.94.0
+    Openai-Intent: conversation-panel
+llms:
+  flash:
+    model: openai/gpt-4.1         # lite tier; no reasoning_effort (see below)
+    base_url: https://api.githubcopilot.com
+    api_key_secret:
+      from: file
+      key: ~/.agentic-dev-loop/auth/copilot.json
+      json_key: access_token
+    headers:
+      Copilot-Integration-Id: vscode-chat
+      Editor-Version: vscode/1.94.0
+      Openai-Intent: conversation-panel
+```
+
+- The `openai/` prefix on model names is required: litellm otherwise routes a
+  bare `claude-*` name through Anthropic's wire format, which the gateway
+  rejects. The prefix forces the OpenAI-compatible route.
+- The model pins are probe-validated against the live endpoint (2026-11-06).
+  `gpt-5.6-luna` routes through the Responses API (the SDK switches
+  automatically), accepts `xhigh`, and returns real verdicts on the review
+  step. `gpt-4.1` tool-calls cleanly on the chat path but hard-400s on any
+  `reasoning_effort`, so lite-tier steps set none.
+- The brief step runs on the pro model at `medium`: no-effort `gpt-4.1`
+  cannot satisfy the mechanical brief-coverage gate.
+- The engine forces string-encoded message content for Copilot configs: the
+  gateway silently drops ARRAY-encoded tool results, which would leave an
+  agent blind to its own terminal output.
+
+Known limitations (probe-validated, not speculation):
+
+- Anthropic models are unusable for agent steps on this endpoint: the claude
+  pins collapse to tool-less narration on review (planning-docs/059), and
+  claude-opus-4.8 returns two choices on the non-streamed path the engine
+  uses.
+- `gpt-4o-mini` caps chat context at 12288 tokens (it overran on the first
+  smoke run).
+- `gpt-4o` and `gpt-4.1` reject any `reasoning_effort` on the chat path.
+- `gpt-5.x` models are Responses-API-only.
+- kimi-k3 accepts only `low`/`high`/`max` effort, and its tool results were
+  dropped by the gateway until the string-content policy above.
+- `gpt-4.1` carries a gateway "utility model" rate limit that a sustained dev
+  loop can trip; it resets within minutes.
+
+See [docs/setup.md](docs/setup.md#copilot-subscription-endpoint-058) for the
+token lifecycle, the probe-validated headers, and the full details.
+
 
 ## Authoring a loop for your own repo
 

{agentic_dev_loop-0.11.1 → agentic_dev_loop-0.12.1}/README.md

@@ -16,6 +16,10 @@ checkpointed, and nothing gets committed until every gate passes.
   parsed from files, retries are bounded, nothing is best-effort.
 - **Sandboxed by default.** The agent's shell and every command step run inside
   an always-on Docker sandbox. There is no opt-out.
+- **Any OpenAI-compatible model, or your Copilot subscription.** Point
+  `llm.base_url` at any OpenAI-compatible endpoint with an API key, or log in
+  with `agentic-dev-loop copilot-login` and run on Copilot models. See
+  [LLM providers](#llm-providers).
 
 ---
 
@@ -50,6 +54,40 @@ Docker engine does:
 Native Windows (outside WSL2) is not supported: every Windows-specific code
 path and test was removed, and CI runs on Ubuntu only.
 
+## LLM providers
+
+Two ways to run the same pipeline. The engine speaks OpenAI-compatible wire
+format throughout, so every step, profile, and gate works identically on
+either provider style:
+
+| Provider | Setup |
+| --- | --- |
+| **Any OpenAI-compatible endpoint** | API key via `api_key_env` + `base_url` in the `llm:` block: DeepSeek, OpenAI, or any OpenAI-compatible API. Full reference: [pipeline.yaml reference](#pipelineyaml-reference). |
+| **GitHub Copilot subscription** | `agentic-dev-loop copilot-login` once, then point the `llm:` block at `https://api.githubcopilot.com` with the file-backed token. Probe-validated pins: `openai/gpt-5.6-luna` (pro) and `openai/gpt-4.1` (lite). Full config and known limitations: [Copilot subscription endpoint](#copilot-subscription-endpoint). |
+
+```yaml
+# OpenAI-compatible endpoint (any provider)
+llm:
+  model: openai/deepseek-v4-pro
+  base_url: https://api.deepseek.com
+  api_key_env: OPENAI_API_KEY
+```
+
+```yaml
+# GitHub Copilot subscription
+llm:
+  model: openai/gpt-5.6-luna        # pro; probe-validated pin
+  base_url: https://api.githubcopilot.com
+  api_key_secret:
+    from: file
+    key: ~/.agentic-dev-loop/auth/copilot.json
+    json_key: access_token
+  headers:
+    Copilot-Integration-Id: vscode-chat
+    Editor-Version: vscode/1.94.0
+    Openai-Intent: conversation-panel
+```
+
 ## Installation
 
 **Prerequisites**
@@ -58,7 +96,7 @@ path and test was removed, and CI runs on Ubuntu only.
 | --- | --- |
 | Python | ≥ 3.12 |
 | Docker engine | Engine API ≥ 1.43 (Engine 24). Any compliant engine works - Docker Desktop, OrbStack, Colima, Rancher Desktop, podman docker-compat. On Windows, run under WSL2: the repo must live on the WSL filesystem, not /mnt/c. |
-| LLM API key | The env var named by your pipeline's `api_key_env` (e.g. `OPENAI_API_KEY`) must be set - a missing key fails fast, naming it. |
+| LLM API key | The env var named by your pipeline's `api_key_env` (e.g. `OPENAI_API_KEY`) must be set - a missing key fails fast, naming it. Alternatively, `agentic-dev-loop copilot-login` authenticates a Copilot subscription (see [LLM providers](#llm-providers)). |
 
 ```bash
 pip install "agentic-dev-loop==1.0.0a17"
@@ -347,6 +385,12 @@ steps:
   engine-written output - captured step output, retry notes, artifacts, and
   `state_dir` files. (Hygiene: the declaring step's agent has already seen
   the value in its own env.)
+- **File provider and LLM keys.** `from: file` reads a host file (`key` is the
+  path, optional `json_key` selects a JSON field). The `llm:` block accepts
+  exactly one of `api_key_env` or `api_key_secret`; the resolved key joins the
+  redaction set. See [Copilot as an endpoint](docs/setup.md#copilot-subscription-endpoint-058)
+  for the GitHub Copilot subscription profile (`copilot-login` device flow,
+  `copilot-models` probe, and the required endpoint headers).
 
 ### Per-stage networking
 
@@ -418,6 +462,76 @@ lines, the sandbox's new lines are appended in order, both sides converge, and
 the run continues with `[isolation] merged concurrent edits: ...` on the
 console.
 
+### Copilot subscription endpoint
+
+GitHub Copilot subscriptions work as an OpenAI-compatible LLM endpoint: log in
+once, then point an `llm:` block at it. The smoke harness runs the same plan
+against both the Copilot endpoint and a standard OpenAI-compatible endpoint,
+so the provider choice is independent of the pipeline design.
+
+```bash
+agentic-dev-loop copilot-login    # device flow; writes the token (mode 600)
+agentic-dev-loop copilot-models   # the models this token's tier can use
+```
+
+```yaml
+llm:
+  model: openai/gpt-5.6-luna      # pro default; probe-validated (see below)
+  base_url: https://api.githubcopilot.com
+  api_key_secret:
+    from: file
+    key: ~/.agentic-dev-loop/auth/copilot.json
+    json_key: access_token
+  headers:
+    Copilot-Integration-Id: vscode-chat
+    Editor-Version: vscode/1.94.0
+    Openai-Intent: conversation-panel
+llms:
+  flash:
+    model: openai/gpt-4.1         # lite tier; no reasoning_effort (see below)
+    base_url: https://api.githubcopilot.com
+    api_key_secret:
+      from: file
+      key: ~/.agentic-dev-loop/auth/copilot.json
+      json_key: access_token
+    headers:
+      Copilot-Integration-Id: vscode-chat
+      Editor-Version: vscode/1.94.0
+      Openai-Intent: conversation-panel
+```
+
+- The `openai/` prefix on model names is required: litellm otherwise routes a
+  bare `claude-*` name through Anthropic's wire format, which the gateway
+  rejects. The prefix forces the OpenAI-compatible route.
+- The model pins are probe-validated against the live endpoint (2026-11-06).
+  `gpt-5.6-luna` routes through the Responses API (the SDK switches
+  automatically), accepts `xhigh`, and returns real verdicts on the review
+  step. `gpt-4.1` tool-calls cleanly on the chat path but hard-400s on any
+  `reasoning_effort`, so lite-tier steps set none.
+- The brief step runs on the pro model at `medium`: no-effort `gpt-4.1`
+  cannot satisfy the mechanical brief-coverage gate.
+- The engine forces string-encoded message content for Copilot configs: the
+  gateway silently drops ARRAY-encoded tool results, which would leave an
+  agent blind to its own terminal output.
+
+Known limitations (probe-validated, not speculation):
+
+- Anthropic models are unusable for agent steps on this endpoint: the claude
+  pins collapse to tool-less narration on review (planning-docs/059), and
+  claude-opus-4.8 returns two choices on the non-streamed path the engine
+  uses.
+- `gpt-4o-mini` caps chat context at 12288 tokens (it overran on the first
+  smoke run).
+- `gpt-4o` and `gpt-4.1` reject any `reasoning_effort` on the chat path.
+- `gpt-5.x` models are Responses-API-only.
+- kimi-k3 accepts only `low`/`high`/`max` effort, and its tool results were
+  dropped by the gateway until the string-content policy above.
+- `gpt-4.1` carries a gateway "utility model" rate limit that a sustained dev
+  loop can trip; it resets within minutes.
+
+See [docs/setup.md](docs/setup.md#copilot-subscription-endpoint-058) for the
+token lifecycle, the probe-validated headers, and the full details.
+
 
 ## Authoring a loop for your own repo
 

{agentic_dev_loop-0.11.1 → agentic_dev_loop-0.12.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentic-dev-loop"
-version = "0.11.1"
+version = "0.12.1"
 description = "Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase."
 readme = "README.md"
 requires-python = ">=3.12"

{agentic_dev_loop-0.11.1 → agentic_dev_loop-0.12.1}/src/agentic_dev_loop/core/config.py

@@ -10,12 +10,13 @@ from pathlib import Path
 from typing import Any, Literal
 
 import yaml
-from pydantic import BaseModel, ConfigDict, Field, field_validator, model_validator
+from pydantic import (BaseModel, ConfigDict, Field, field_validator,
+                      model_serializer, model_validator)
 
 from agentic_dev_loop.core.paths import _has_wildcards, path_excluded, relative_parts
 
 TERMINALS = frozenset({"success", "failure"})
-KNOWN_SECRET_PROVIDERS = frozenset({"env"})
+KNOWN_SECRET_PROVIDERS = frozenset({"env", "file"})
 MOUNT_MODES = frozenset({"rw", "ro"})
 # The egress preset names the engine ships (BR-9). Config validates the
 # name here; the target data lives in engine/presets.py (preset data,
@@ -183,14 +184,17 @@ def route_target(route: RouteTarget | None) -> str | None:
 
 class SecretSpec(BaseModel):
     """One ``secrets:`` ref - the locator only, never a value. ``from`` names
-    the provider (``env`` first); ``key`` is that provider's locator (for
+    the provider (``env`` or ``file``); ``key`` is that provider's locator (for
     ``env``, the host environment variable to read and the step env name to
-    inject). Unknown keys fail at load (extra="forbid")."""
+    inject; for ``file``, the JSON file path). ``json_key`` selects a key
+    inside the JSON file and is file-provider-only. Unknown keys fail at load
+    (extra="forbid")."""
 
     model_config = ConfigDict(extra="forbid", populate_by_name=True)
 
     from_: str = Field(alias="from")
     key: str
+    json_key: str | None = None
 
     @field_validator("from_")
     @classmethod
@@ -208,6 +212,28 @@ class SecretSpec(BaseModel):
             raise ValueError("secret key must be a non-empty string")
         return v
 
+    @field_validator("json_key")
+    @classmethod
+    def _nonempty_json_key(cls, v: str | None) -> str | None:
+        if v is not None and not v.strip():
+            raise ValueError("secret json_key must be a non-empty string")
+        return v
+
+    @model_validator(mode="after")
+    def _json_key_only_for_file(self) -> "SecretSpec":
+        if self.json_key is not None and self.from_ != "file":
+            raise ValueError(
+                "secret json_key is only valid with the 'file' provider")
+        return self
+
+    @model_serializer(mode="wrap")
+    def _omit_absent_json_key(self, handler):
+        """Keep the pre-058 env-provider dump shape byte-identical."""
+        data = handler(self)
+        if data.get("json_key") is None:
+            data.pop("json_key", None)
+        return data
+
 
 class IsolationConfig(BaseModel):
     """Optional `isolation:` section - configures the always-on sandbox (BR-2).
@@ -600,13 +626,29 @@ class LlmConfig(BaseModel):
 
     model: str
     base_url: str | None = None
-    api_key_env: str
+    # 058 (D3): exactly one host-side key mechanism - an environment variable
+    # (the existing shape) or a file-backed secret spec.
+    api_key_env: str | None = None
+    api_key_secret: SecretSpec | None = None
+    # 058 (D2): extra HTTP headers forwarded verbatim to the SDK LLM
+    # (``extra_headers``). Empty = no change for every existing pipeline.
+    headers: dict[str, str] = Field(default_factory=dict)
     timeout: float | None = None  # omitted → opinionated no-timeout default
     # 047 (D1) / 054 (D6): opt-in passthrough; unset means reasoning is off
     # (the engine forwards none and strips reasoning passback). The SDK
     # "high" default never engages because build_llm always passes the value.
     reasoning_effort: ReasoningEffort | None = None
 
+    @model_validator(mode="after")
+    def _exactly_one_api_key_mechanism(self) -> "LlmConfig":
+        has_env = self.api_key_env is not None
+        has_secret = self.api_key_secret is not None
+        if has_env == has_secret:
+            raise ValueError(
+                "set exactly one of 'api_key_env' or 'api_key_secret' on the "
+                "llm block (neither or both are invalid)")
+        return self
+
 
 class PipelineConfig(BaseModel):
     model_config = ConfigDict(extra="forbid")

{agentic_dev_loop-0.11.1 → agentic_dev_loop-0.12.1}/src/agentic_dev_loop/engine/cli.py

@@ -10,9 +10,12 @@ import json
 import os
 import signal
 import sys
+import threading
 from pathlib import Path
 
 from agentic_dev_loop.core.config import PipelineConfig, load_config
+from .copilot_auth import (TOKEN_PATH, CopilotAuthError, list_copilot_models,
+                           login, read_token)
 from .containers import containers_report
 from .isolation import isolation_state_dir, reap_orphaned_containers
 from .loaders import mark_plan_completed
@@ -46,6 +49,14 @@ def _restore_sigterm_handler(previous) -> None:
     signal.signal(signal.SIGTERM, previous)
 
 
+def _wait_for_interrupt() -> None:
+    """Block until the user presses ctrl+c; a bounded wait keeps the loop
+    responsive to signals without requiring a tty."""
+    idle = threading.Event()
+    while not idle.wait(1.0):
+        pass
+
+
 def _version() -> str:
     """The installed distribution version - the single source of truth."""
     try:
@@ -149,6 +160,52 @@ def _print_containers_report(report) -> None:
               f"run={run} pid={pid_s}")
 
 
+def _token_path(value: str | None) -> Path:
+    return Path(value).expanduser() if value else TOKEN_PATH.expanduser()
+
+
+def _run_copilot_login(argv: list[str]) -> int:
+    parser = argparse.ArgumentParser(
+        prog="agentic-dev-loop copilot-login",
+        description="Run the GitHub device flow and store the Copilot OAuth "
+                    "token (~/.agentic-dev-loop/auth/copilot.json, mode 600).")
+    parser.add_argument("--token-file", default=None,
+                        help="token path (default: "
+                             "~/.agentic-dev-loop/auth/copilot.json)")
+    args = parser.parse_args(argv)
+    path = _token_path(args.token_file)
+    try:
+        login(token_path=path)
+    except CopilotAuthError as e:
+        print(f"copilot-login: {e}", file=sys.stderr)
+        return 1
+    print(f"Copilot token written to {path}")
+    return 0
+
+
+def _run_copilot_models(argv: list[str]) -> int:
+    parser = argparse.ArgumentParser(
+        prog="agentic-dev-loop copilot-models",
+        description="List the Copilot models available to this token's tier.")
+    parser.add_argument("--token-file", default=None,
+                        help="token path (default: "
+                             "~/.agentic-dev-loop/auth/copilot.json)")
+    parser.add_argument("--json", action="store_true",
+                        help="emit the model list as JSON")
+    args = parser.parse_args(argv)
+    try:
+        models = list_copilot_models(read_token(_token_path(args.token_file)))
+    except CopilotAuthError as e:
+        print(f"copilot-models: {e}", file=sys.stderr)
+        return 1
+    if args.json:
+        print(json.dumps({"models": models}, sort_keys=True))
+    else:
+        for model in models:
+            print(model)
+    return 0
+
+
 def build_parser(cfg_path) -> argparse.ArgumentParser:
     """The full parser for one pipeline: core flags + loader-contributed."""
     registry, _ = _registry_for(cfg_path)
@@ -158,13 +215,17 @@ def build_parser(cfg_path) -> argparse.ArgumentParser:
     return parser
 
 
-def main(argv: list[str] | None = None) -> int:
+def main(argv: list[str] | None = None, *, keep_alive: bool = True) -> int:
     if argv is None:
         argv = sys.argv[1:]
     else:
         argv = list(argv)
     if argv and argv[0] == "containers":
         return _run_containers(argv[1:])
+    if argv and argv[0] == "copilot-login":
+        return _run_copilot_login(argv[1:])
+    if argv and argv[0] == "copilot-models":
+        return _run_copilot_models(argv[1:])
     if argv and argv[0] == "init":
         from .onboarding.init import run_init
         return run_init(argv[1:])
@@ -207,6 +268,12 @@ def main(argv: list[str] | None = None) -> int:
         if not success:
             print("agentic-dev-loop: pipeline failed - exiting with code 1",
                   file=sys.stderr)
+        if keep_alive and not args.no_viz:
+            print("Pipeline finished: press ctrl+c to exit")
+            try:
+                _wait_for_interrupt()
+            except KeyboardInterrupt:
+                pass
         return 0 if success else 1
     finally:
         _restore_sigterm_handler(previous)