agenticdome-python-sdk 1.2.24__tar.gz → 1.2.25__tar.gz

{agenticdome_python_sdk-1.2.24 → agenticdome_python_sdk-1.2.25}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agenticdome-python-sdk
-Version: 1.2.24
+Version: 1.2.25
 Summary: Official Python SDK for AgenticDome security guardrails, DLP, tool authorization, and multi-agent delegation enforcement.
 Author: AgenticDome
 License-Expression: Apache-2.0

{agenticdome_python_sdk-1.2.24 → agenticdome_python_sdk-1.2.25}/agenticdome_python_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agenticdome-python-sdk
-Version: 1.2.24
+Version: 1.2.25
 Summary: Official Python SDK for AgenticDome security guardrails, DLP, tool authorization, and multi-agent delegation enforcement.
 Author: AgenticDome
 License-Expression: Apache-2.0

{agenticdome_python_sdk-1.2.24 → agenticdome_python_sdk-1.2.25}/agenticdome_python_sdk.egg-info/SOURCES.txt

@@ -18,6 +18,7 @@ agenticdome_sdk/_mode.py
 agenticdome_sdk/agno.py
 agenticdome_sdk/autogen.py
 agenticdome_sdk/aws_bedrock.py
+agenticdome_sdk/catalog_snapshot.json
 agenticdome_sdk/claude.py
 agenticdome_sdk/client.py
 agenticdome_sdk/copilot_ir.py

agenticdome_python_sdk-1.2.25/agenticdome_sdk/catalog_snapshot.json

@@ -0,0 +1,28 @@
+{
+    "schema": "agenticdome.catalog-snapshot.v1",
+    "catalog_schema": "agenticdome.hook-catalog.v1",
+    "verified_at": "2026-08-23",
+    "python_sdk_version": "1.2.25",
+    "published_packages": {
+        "agenticdome-python-sdk": {
+            "registry": "pypi",
+            "version": "1.2.25",
+            "url": "https://pypi.org/project/agenticdome-python-sdk/1.2.25/"
+        },
+        "agenticdome-sdk": {
+            "registry": "npm",
+            "version": "0.6.3",
+            "url": "https://www.npmjs.com/package/agenticdome-sdk/v/0.6.3"
+        },
+        "agenticdome-openclaw-security": {
+            "registry": "npm",
+            "version": "1.0.2",
+            "url": "https://www.npmjs.com/package/agenticdome-openclaw-security/v/1.0.2"
+        },
+        "openclaw": {
+            "registry": "npm",
+            "version": "2026.7.1-2",
+            "url": "https://www.npmjs.com/package/openclaw/v/2026.7.1-2"
+        }
+    }
+}

{agenticdome_python_sdk-1.2.24 → agenticdome_python_sdk-1.2.25}/agenticdome_sdk/hook_catalog.py

@@ -11,65 +11,42 @@ import copy
 import hashlib
 import json
 import re
-from importlib import metadata as importlib_metadata
 from pathlib import Path
 from typing import Any, Dict, List, Optional
 
 
 CATALOG_SCHEMA = "agenticdome.hook-catalog.v1"
-CATALOG_VERIFIED_AT = "2026-08-23"
-_SDK_ROOT = Path(__file__).resolve().parents[2]
+CATALOG_SNAPSHOT_SCHEMA = "agenticdome.catalog-snapshot.v1"
 
 
-def _json_manifest_version(relative_path: str, fallback: str) -> str:
-    manifest = _SDK_ROOT / relative_path
+def _load_catalog_snapshot() -> Dict[str, Any]:
+    path = Path(__file__).with_name("catalog_snapshot.json")
     try:
-        return str(json.loads(manifest.read_text(encoding="utf-8"))["version"]).strip() or fallback
-    except (OSError, KeyError, TypeError, ValueError, json.JSONDecodeError):
-        return fallback
+        snapshot = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, TypeError, ValueError, json.JSONDecodeError) as exc:
+        raise RuntimeError("The installed SDK is missing its canonical hook-catalog snapshot.") from exc
+    if not isinstance(snapshot, dict) or snapshot.get("schema") != CATALOG_SNAPSHOT_SCHEMA:
+        raise RuntimeError("The installed SDK contains an unsupported hook-catalog snapshot.")
+    if snapshot.get("catalog_schema") != CATALOG_SCHEMA:
+        raise RuntimeError("The installed SDK hook-catalog snapshot uses the wrong catalog schema.")
+    if not isinstance(snapshot.get("published_packages"), dict):
+        raise RuntimeError("The installed SDK hook-catalog snapshot has no published package map.")
+    return snapshot
 
 
-def _python_manifest_version(fallback: str) -> str:
-    manifest = _SDK_ROOT / "python" / "pyproject.toml"
-    try:
-        match = re.search(r"(?m)^version\s*=\s*\"([^\"]+)\"", manifest.read_text(encoding="utf-8"))
-        if match:
-            return match.group(1).strip()
-    except OSError:
-        pass
-    try:
-        return importlib_metadata.version("agenticdome-python-sdk")
-    except importlib_metadata.PackageNotFoundError:
-        return fallback
-
+_CATALOG_SNAPSHOT = _load_catalog_snapshot()
+CATALOG_VERIFIED_AT = str(_CATALOG_SNAPSHOT["verified_at"])
 
-def _published_package(registry: str, package: str, version: str) -> Dict[str, str]:
-    if registry == "pypi":
-        url = f"https://pypi.org/project/{package}/{version}/"
-    else:
-        url = f"https://www.npmjs.com/package/{package}/v/{version}"
-    return {"registry": registry, "version": version, "url": url}
 
-
-_PYTHON_SDK_VERSION = _python_manifest_version("1.2.21")
-_TYPESCRIPT_SDK_VERSION = _json_manifest_version("js/agentguard_sdk/src/package.json", "0.6.2")
-_OPENCLAW_PLUGIN_VERSION = _json_manifest_version(
-    "openclaw/ts/openclaw-agenticdome-security/package.json", "1.0.1"
-)
 _OPENCLAW_RUNTIME_MIN_VERSION = "2026.7.1-2"
 _OPENCLAW_RUNTIME_MAX_VERSION = "2026.7.1-2"
 _OPENCLAW_RUNTIME_VERSION = _OPENCLAW_RUNTIME_MAX_VERSION
 _OPENCLAW_NODE_RANGE = ">=22.22.3 <23 || >=24.15.0 <25 || >=25.9.0"
 
-# The source checkout derives these values from the exact manifests that the
-# release harness publishes. Installed wheels retain the certified fallbacks.
 PUBLISHED_AGENTICDOME_PACKAGES: Dict[str, Dict[str, str]] = {
-    "agenticdome-python-sdk": _published_package("pypi", "agenticdome-python-sdk", _PYTHON_SDK_VERSION),
-    "agenticdome-sdk": _published_package("npm", "agenticdome-sdk", _TYPESCRIPT_SDK_VERSION),
-    "agenticdome-openclaw-security": _published_package(
-        "npm", "agenticdome-openclaw-security", _OPENCLAW_PLUGIN_VERSION
-    ),
-    "openclaw": _published_package("npm", "openclaw", _OPENCLAW_RUNTIME_VERSION),
+    str(package): {str(key): str(value) for key, value in row.items()}
+    for package, row in _CATALOG_SNAPSHOT["published_packages"].items()
+    if isinstance(row, dict)
 }
 
 
@@ -545,11 +522,18 @@ def framework_contract(key: str, language: Optional[str] = None) -> Optional[Dic
 
 
 def catalog_digest() -> str:
+    # Package versions are signed in the binding and excluded from this
+    # semantic Python hook-contract digest. npm/OpenClaw releases therefore
+    # cannot invalidate an already published Python wheel.
+    frameworks = copy.deepcopy(FRAMEWORK_HOOK_CATALOG)
+    for contract in frameworks.values():
+        for package in list((contract.get("packages") or {}).keys()):
+            if package in PUBLISHED_AGENTICDOME_PACKAGES:
+                contract["packages"][package] = {"binding": "signed_catalog"}
     payload = {
         "schema": CATALOG_SCHEMA,
         "verified_at": CATALOG_VERIFIED_AT,
-        "published": PUBLISHED_AGENTICDOME_PACKAGES,
-        "frameworks": FRAMEWORK_HOOK_CATALOG,
+        "frameworks": frameworks,
     }
     encoded = json.dumps(payload, sort_keys=True, separators=(",", ":")).encode("utf-8")
     return "sha256:" + hashlib.sha256(encoded).hexdigest()

{agenticdome_python_sdk-1.2.24 → agenticdome_python_sdk-1.2.25}/agenticdome_sdk/onboarding_cli.py

@@ -567,8 +567,14 @@ def _exact_version_from_spec(spec: str) -> Optional[str]:
     return match.group(1) if match else None
 
 
-def _hook_plans(root: Path, report: Dict[str, Any], frameworks: Sequence[str]) -> List[Dict[str, Any]]:
+def _hook_plans(
+    root: Path,
+    report: Dict[str, Any],
+    frameworks: Sequence[str],
+    catalog_binding: Optional[Dict[str, Any]] = None,
+) -> List[Dict[str, Any]]:
     inventory = _manifest_dependency_specs(root)
+    bound_packages = (catalog_binding or {}).get("published_packages") or {}
     languages = set(report.get("languages", []))
     requested = list(dict.fromkeys(str(item) for item in frameworks))
     if "typescript/javascript" in languages and not any(item in {"openclaw", "mcp", "typescript"} for item in requested):
@@ -597,10 +603,15 @@ def _hook_plans(root: Path, report: Dict[str, Any], frameworks: Sequence[str]) -
             installed = observed.get("installed")
             declared = observed.get("declared")
             declared_exact = _exact_version_from_spec(str(declared or ""))
-            registry_version = PUBLISHED_AGENTICDOME_PACKAGES.get(package, {}).get("version")
+            registry_version = (bound_packages.get(package) or {}).get("version")
+            if not registry_version:
+                registry_version = PUBLISHED_AGENTICDOME_PACKAGES.get(package, {}).get("version")
+            effective_certification = certification
+            if package in PUBLISHED_AGENTICDOME_PACKAGES and registry_version:
+                effective_certification = {"exact": str(registry_version)}
             declared_latest = str(declared or "").strip().lower() in {"latest", "*"}
             comparable = declared_exact or installed or (registry_version if declared_latest else None)
-            compatible = version_satisfies_certification(str(comparable), certification) if comparable else None
+            compatible = version_satisfies_certification(str(comparable), effective_certification) if comparable else None
             environment_conflict = bool(declared_exact and installed and declared_exact != installed)
             # An explicit declared version outside the certified range must
             # fail closed even when this machine happens to have a different,
@@ -622,7 +633,7 @@ def _hook_plans(root: Path, report: Dict[str, Any], frameworks: Sequence[str]) -
                 "package": package,
                 "installed_version": installed,
                 "declared_spec": declared,
-                "certified_versions": certification_label(certification),
+                "certified_versions": certification_label(effective_certification),
                 "published_version": published,
                 "status": status,
                 "evidence": (
@@ -714,7 +725,7 @@ def integration_plan(root: Path) -> Dict[str, Any]:
     required = ["prompt_ingress", "tool_execution", "output_egress"]
     gaps = [boundary for boundary in required if not counts.get(boundary)]
     frameworks = config.get("frameworks", [])
-    hook_plans = _hook_plans(root, report, frameworks)
+    hook_plans = _hook_plans(root, report, frameworks, active_catalog_binding)
     semantic_bypasses = semantic.get("bypass_risks", []) if isinstance(semantic, dict) else []
     semantic_reviews = semantic.get("review_findings", []) if isinstance(semantic, dict) else []
     return {

{agenticdome_python_sdk-1.2.24 → agenticdome_python_sdk-1.2.25}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agenticdome-python-sdk"
-version = "1.2.24"
+version = "1.2.25"
 description = "Official Python SDK for AgenticDome security guardrails, DLP, tool authorization, and multi-agent delegation enforcement."
 readme = "README.md"
 requires-python = ">=3.9"
@@ -170,7 +170,7 @@ include = ["agenticdome_sdk*"]
 exclude = ["tests*", "examples*"]
 
 [tool.setuptools.package-data]
-agenticdome_sdk = ["*.cjs"]
+agenticdome_sdk = ["*.cjs", "catalog_snapshot.json"]
 
 [tool.ruff]
 line-length = 120