agentlint 2.3.0__tar.gz → 2.4.0__tar.gz

{agentlint-2.3.0 → agentlint-2.4.0}/.gitignore

@@ -11,9 +11,8 @@ build/
 htmlcov/
 .worktrees/
 
-# Local AgentLint dogfood/setup artifacts. Keep agentlint.yml.example and docs
-# committed; generated hook configs often contain absolute local paths.
-agentlint.yml
+# Local AgentLint hook artifacts. The repo-level agentlint.yml is committed so
+# AgentLint dogfoods the same accepted patterns in local dev and CI.
 .claude/
 .codex/
 .continue/

{agentlint-2.3.0 → agentlint-2.4.0}/CHANGELOG.md

@@ -1,5 +1,79 @@
 # Changelog
 
+## v2.4.0 (2026-05-19) — AgentChute Local-First Onboarding
+
+This release aligns AgentLint with the AgentChute pilot experience: local-first
+policy enforcement, automatic durable event delivery, and one-command setup
+flows that do not require users to understand hook files or queue internals.
+
+### Added
+
+- Added `agentlint onboard` for updating/installing AgentLint, detecting coding
+  agents, installing or repairing hooks, saving AgentChute environment values,
+  validating connectivity, and running a safe verification event.
+- Added `agentlint login` for AgentChute dashboard pairing, plus `agentlint
+  setup-agent` for adding or repairing Codex, Claude Code, Cursor, Gemini,
+  Kimi, Grok, and Continue hook integrations.
+- Added `agentlint status`, `agentlint doctor --fix`, `agentlint test`,
+  `agentlint test-policy`, `agentlint queue ...`, `agentlint env ...`, and
+  `agentlint policy ...` commands for supportable first-run diagnostics.
+- Added declarative AgentChute policy cache support with local-only hook
+  evaluation, strict schema validation, safe predicates, and self-degrading
+  behavior when cloud policy is missing or invalid.
+- Added durable AgentChute event queueing and automatic background flushing so
+  API outages do not block hooks and normal users do not need to run manual
+  sync commands.
+- Added a repo-local dogfood `agentlint.yml` so AgentLint uses its own rules in
+  development without enabling paid AgentChute upload by default.
+
+### Changed
+
+- Changed the default AgentChute API origin to `https://api.agentchute.com/v1`
+  to match the deployed AgentChute product and dashboard docs.
+- Changed Codex setup to write `[features].hooks = true` and remove deprecated
+  or misplaced `codex_hooks` keys from `~/.codex/config.toml`.
+- Kept `agentlint sync` available as a support/debug flush command, while the
+  primary delivery path is now local spool plus automatic background upload.
+
+### Compatibility
+
+- Existing local AgentLint rules and hook integrations remain valid.
+- AgentChute policy and upload behavior remain opt-in through
+  `AGENTCHUTE_ENABLED=true` plus a license key.
+- Cloud policies are declarative JSON only; AgentLint never executes
+  cloud-provided Python or JavaScript.
+
+---
+
+## v2.3.1 (2026-05-15) — AgentChute Onboarding Polish
+
+This release applies first-run AgentChute setup feedback from local Codex
+dogfooding. It makes the install path less ambiguous and keeps diagnostics from
+mutating or crashing on the local sync queue.
+
+### Changed
+
+- `agentlint init --team-key ...` now prints `AGENTCHUTE_API_URL` alongside the
+  license key and enable flag, so local AgentChute tests keep targeting the
+  local API instead of silently falling back to production defaults.
+- `agentlint setup codex` now enables `codex_hooks = true` under `[features]` in
+  `~/.codex/config.toml`, and repairs stale root or nested `codex_hooks` keys
+  that can make Codex fail to load its config.
+- Codex, Claude Code, and Cursor setup docs now include AgentChute local testing
+  env vars and restart/reload guidance.
+- `agentlint sync --dry-run` now counts queued events without acquiring the
+  flush lock or advancing the delivery cursor.
+- AgentChute queue flushing now treats lock acquisition failures as a locked
+  queue instead of crashing.
+
+### Compatibility
+
+- Existing hook files and AgentLint configs remain valid.
+- Codex users must still restart Codex after enabling hooks; Codex loads hooks
+  when the session starts.
+
+---
+
 ## v2.3.0 (2026-05-14) — CI Signal Polish
 
 This release applies real-world Codex and AgentLint dogfooding feedback. It

{agentlint-2.3.0 → agentlint-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentlint
-Version: 2.3.0
+Version: 2.4.0
 Summary: Real-time quality guardrails for AI coding agents
 Project-URL: Homepage, https://github.com/mauhpr/agentlint
 Project-URL: Repository, https://github.com/mauhpr/agentlint
@@ -62,7 +62,7 @@ We don't have a mature answer to that yet. Nobody does. The **autopilot pack** i
 
 AgentLint ships with 76 rules across 8 packs and normalizes tool events across supported AI coding agents. The 23 **universal** rules and 7 **quality** rules work with any tech stack; 4 additional packs auto-activate based on your project files; the **security** pack is opt-in; and the **autopilot** pack is opt-in and experimental.
 
-**v2.3.0 highlights:** Codex dogfooding polish with FastAPI-aware `no-unnecessary-async`, grouped text CI findings, and repo-local accepted patterns through per-rule `ignore_paths`. Previous: Install experience polish, `agentlint --version`, AgentChute sync support from the default `pip install agentlint` package, public documentation cleanup, AgentChute-ready team sync, hybrid cloud feeds, privacy-safe event queueing, multi-platform adapter architecture, unified `AgentEvent` taxonomy, `NormalizedTool` cross-platform mappings, session summary dashboard, MCP server, global config defaults, warning suppression, auto-suppress, `diff_only` mode, and `auto-fix` mode.
+**v2.4.0 highlights:** AgentChute local-first onboarding with `agentlint onboard`, dashboard pairing through `agentlint login`, `doctor --fix`, `status`, `test`, `test-policy`, policy cache diagnostics, durable queue inspection/flush commands, automatic background event upload, and the production `api.agentchute.com` default. Previous: safer Codex hook enablement, sync dry-run diagnostics, FastAPI-aware `no-unnecessary-async`, grouped text CI findings, repo-local accepted patterns through per-rule `ignore_paths`, AgentChute sync support from the default `pip install agentlint` package, hybrid cloud feeds, privacy-safe event queueing, multi-platform adapter architecture, unified `AgentEvent` taxonomy, `NormalizedTool` cross-platform mappings, MCP server, global config defaults, warning suppression, auto-suppress, `diff_only` mode, and `auto-fix` mode.
 
 | Rule | Severity | What it does |
 |------|----------|-------------|

{agentlint-2.3.0 → agentlint-2.4.0}/README.md

@@ -26,7 +26,7 @@ We don't have a mature answer to that yet. Nobody does. The **autopilot pack** i
 
 AgentLint ships with 76 rules across 8 packs and normalizes tool events across supported AI coding agents. The 23 **universal** rules and 7 **quality** rules work with any tech stack; 4 additional packs auto-activate based on your project files; the **security** pack is opt-in; and the **autopilot** pack is opt-in and experimental.
 
-**v2.3.0 highlights:** Codex dogfooding polish with FastAPI-aware `no-unnecessary-async`, grouped text CI findings, and repo-local accepted patterns through per-rule `ignore_paths`. Previous: Install experience polish, `agentlint --version`, AgentChute sync support from the default `pip install agentlint` package, public documentation cleanup, AgentChute-ready team sync, hybrid cloud feeds, privacy-safe event queueing, multi-platform adapter architecture, unified `AgentEvent` taxonomy, `NormalizedTool` cross-platform mappings, session summary dashboard, MCP server, global config defaults, warning suppression, auto-suppress, `diff_only` mode, and `auto-fix` mode.
+**v2.4.0 highlights:** AgentChute local-first onboarding with `agentlint onboard`, dashboard pairing through `agentlint login`, `doctor --fix`, `status`, `test`, `test-policy`, policy cache diagnostics, durable queue inspection/flush commands, automatic background event upload, and the production `api.agentchute.com` default. Previous: safer Codex hook enablement, sync dry-run diagnostics, FastAPI-aware `no-unnecessary-async`, grouped text CI findings, repo-local accepted patterns through per-rule `ignore_paths`, AgentChute sync support from the default `pip install agentlint` package, hybrid cloud feeds, privacy-safe event queueing, multi-platform adapter architecture, unified `AgentEvent` taxonomy, `NormalizedTool` cross-platform mappings, MCP server, global config defaults, warning suppression, auto-suppress, `diff_only` mode, and `auto-fix` mode.
 
 | Rule | Severity | What it does |
 |------|----------|-------------|

agentlint-2.4.0/agentlint.yml

@@ -0,0 +1,74 @@
+# AgentLint dogfood configuration for the AgentLint repo.
+
+stack: auto
+severity: standard
+
+packs:
+  - universal
+  - quality
+  - python
+  - security
+  - autopilot
+
+rules:
+  no-secrets:
+    allow_paths:
+      - "README.md"
+      - "**/README.md"
+      - "CHANGELOG.md"
+      - "**/CHANGELOG.md"
+      - "tests/**"
+      - "**/tests/**"
+      - "src/agentlint/packs/security/no_leaked_secret_pattern.py"
+      - "**/src/agentlint/packs/security/no_leaked_secret_pattern.py"
+  max-file-size:
+    ignore_paths:
+      - "README.md"
+      - "**/README.md"
+      - "CHANGELOG.md"
+      - "**/CHANGELOG.md"
+      - "uv.lock"
+      - "**/uv.lock"
+      - "src/agentlint/cli.py"
+      - "**/src/agentlint/cli.py"
+      - "tests/test_agentchute_policy_queue_sync.py"
+      - "**/tests/test_agentchute_policy_queue_sync.py"
+      - "tests/test_cli.py"
+      - "**/tests/test_cli.py"
+  no-large-diff:
+    ignore_paths:
+      - "src/agentlint/cli.py"
+      - "**/src/agentlint/cli.py"
+      - "src/agentlint/agentchute/client.py"
+      - "**/src/agentlint/agentchute/client.py"
+      - "src/agentlint/agentchute/policy.py"
+      - "**/src/agentlint/agentchute/policy.py"
+  cli-integration:
+    timeout: 20
+    diff_only: true
+    commands:
+      - name: pytest-focused
+        on: ["Write", "Edit"]
+        glob: "src/**/*.py"
+        command: "uv run pytest tests/test_cli.py tests/test_agentchute_client.py -q"
+        timeout: 60
+        severity: warning
+  no-bash-file-write:
+    allow_paths:
+      - "agentlint.yml"
+      - ".claude/settings.json"
+      - ".cursor/hooks.json"
+      - ".codex/hooks.json"
+      - ".kimi/hooks.json"
+      - ".grok/settings.json"
+      - ".gemini/settings.json"
+      - ".continue/settings.json"
+  no-network-exfil:
+    allowed_hosts:
+      - "api.agentchute.com"
+
+agentchute:
+  enabled: false
+  policy:
+    enabled: true
+    missing_required_pack: warn_local_fail_ci

{agentlint-2.3.0 → agentlint-2.4.0}/docs/setup-claude.md

@@ -18,6 +18,17 @@ This creates `.claude/settings.json` in your project root with hooks for:
 - `Notification` — notification-triggered rules
 - `Stop` — session summary report
 
+For AgentChute local testing, set the API URL before starting Claude Code:
+
+```bash
+export AGENTCHUTE_API_URL=http://localhost:8000/v1
+export AGENTCHUTE_LICENSE_KEY=ac_team_...
+export AGENTCHUTE_ENABLED=true
+```
+
+Restart Claude Code in the project after running `agentlint setup claude` so it
+loads the updated hook config.
+
 ## Hook Format
 
 Claude Code uses a JSON-based hook protocol:
@@ -74,6 +85,7 @@ Removes only AgentLint hooks; preserves any other custom hooks you have configur
 **Hooks not firing?**
 - Verify `.claude/settings.json` exists and contains a `"hooks"` key
 - Check that the `agentlint` binary is on PATH or that `agentlint setup` embedded an absolute path
+- Restart Claude Code after installing hooks
 - Run `agentlint doctor` to diagnose installation issues
 
 **Blocking rules not actually blocking?**

{agentlint-2.3.0 → agentlint-2.4.0}/docs/setup-codex.md

@@ -16,6 +16,35 @@ This creates `.codex/hooks.json` in your project root with hooks for:
 - `SessionStart` — session initialization
 - `Stop` — session summary report
 
+Codex also requires native hooks to be enabled globally. `agentlint setup codex`
+updates `~/.codex/config.toml` for you by adding the flag under `[features]`:
+
+```toml
+[features]
+hooks = true
+```
+
+Do not append `hooks = true` to the end of `config.toml` manually. TOML
+assigns bare keys to the most recent table, so appending after a section such as
+`[tui.model_availability_nux]` can make Codex fail to load its config.
+AgentLint also removes legacy or misplaced `codex_hooks` keys when it repairs
+Codex setup.
+
+Restart Codex from the terminal where your AgentLint/AgentChute environment
+variables are set:
+
+```bash
+codex
+```
+
+For AgentChute local testing, set the API URL before starting Codex:
+
+```bash
+export AGENTCHUTE_API_URL=http://localhost:8000/v1
+export AGENTCHUTE_LICENSE_KEY=ac_team_...
+export AGENTCHUTE_ENABLED=true
+```
+
 ## Important: Codex Hook Coverage
 
 Codex's PreToolUse hook currently only reliably intercepts **Bash tool calls**. Coverage for `apply_patch` edits and MCP tool calls is intermittent and depends on the Codex CLI version. This is a known upstream limitation.
@@ -71,6 +100,13 @@ Removes only AgentLint hooks; preserves any other custom hooks you have configur
 - Ensure your Codex CLI is up to date; hook support is evolving rapidly
 - Bash tool calls should always trigger PreToolUse hooks
 
+**No events in AgentChute?**
+- Ensure `hooks = true` is present under `[features]` in `~/.codex/config.toml`
+- Start a fresh Codex session after running `agentlint setup codex`
+- Launch Codex from the same terminal where `AGENTCHUTE_API_URL`, `AGENTCHUTE_LICENSE_KEY`, and `AGENTCHUTE_ENABLED` are exported
+- Run `agentlint agentchute status` from the project root
+- If events are queued, run `agentlint agentchute flush` as a support/debug step
+
 **Need full file-write coverage?**
 - Consider using AgentLint's MCP server alongside hooks for pre-validation
 - Run `agentlint doctor` for alternative integration suggestions

{agentlint-2.3.0 → agentlint-2.4.0}/docs/setup-cursor.md

@@ -17,6 +17,17 @@ This creates `.cursor/hooks.json` in your project root with hooks for:
 - `subagentStart` / `subagentStop` — subagent safety
 - `stop` — session summary report
 
+For AgentChute local testing, set the API URL before launching Cursor:
+
+```bash
+export AGENTCHUTE_API_URL=http://localhost:8000/v1
+export AGENTCHUTE_LICENSE_KEY=ac_team_...
+export AGENTCHUTE_ENABLED=true
+```
+
+Reload the Cursor window after running `agentlint setup cursor` so it loads the
+updated hook config.
+
 ## Hook Format
 
 Cursor hooks use a JSON-based protocol:
@@ -57,3 +68,12 @@ agentlint uninstall cursor
 | `CURSOR_SESSION_ID` | Session ID for state tracking |
 | `AGENTLINT_PROJECT_DIR` | Generic project directory (takes precedence) |
 | `AGENTLINT_SESSION_ID` | Generic session ID (takes precedence) |
+
+## Troubleshooting
+
+**No events in AgentChute?**
+- Verify `.cursor/hooks.json` exists in the project
+- Reload the Cursor window after installing hooks
+- Ensure Cursor inherits `AGENTCHUTE_API_URL`, `AGENTCHUTE_LICENSE_KEY`, and `AGENTCHUTE_ENABLED`
+- Run `agentlint agentchute status` from the project root
+- If events are queued, run `agentlint agentchute flush` as a support/debug step

{agentlint-2.3.0 → agentlint-2.4.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "agentlint"
-version = "2.3.0"
+version = "2.4.0"
 description = "Real-time quality guardrails for AI coding agents"
 readme = "README.md"
 license = "MIT"

{agentlint-2.3.0 → agentlint-2.4.0}/src/agentlint/__init__.py

@@ -1,6 +1,6 @@
 """AgentLint - Real-time quality guardrails for AI coding agents."""
 
-__version__ = "2.3.0"
+__version__ = "2.4.0"
 
 from agentlint.core.models import (
     AgentEvent,

{agentlint-2.3.0 → agentlint-2.4.0}/src/agentlint/adapters/codex.py

@@ -1,7 +1,7 @@
 """Codex CLI adapter for AgentLint.
 
 OpenAI Codex CLI provides a native hooks system with 6 lifecycle events.
-Configuration is done via JSON in ~/.codex/hooks.json (requires codex_hooks = true in config.toml).
+Configuration is done via JSON in ~/.codex/hooks.json (requires hooks = true under [features]).
 
 Reference: https://developers.openai.com/codex/hooks
 """

{agentlint-2.3.0 → agentlint-2.4.0}/src/agentlint/agentchute/client.py

@@ -37,7 +37,7 @@ ENV_AGENTCHUTE_API_URL = "AGENTCHUTE_API_URL"
 
 # Default API URL for the paid AgentChute product. Override per-deployment
 # with AGENTCHUTE_API_URL.
-DEFAULT_API_URL = "https://api.agentchute.io/v1"
+DEFAULT_API_URL = "https://api.agentchute.com/v1"
 
 
 def is_agentchute_enabled(config: Any | None = None) -> bool:

{agentlint-2.3.0 → agentlint-2.4.0}/src/agentlint/agentchute/policy.py

@@ -160,6 +160,8 @@ def validate_policy(policy: Any) -> list[str]:
             continue
         if not isinstance(rule.get("id"), str) or not rule["id"]:
             errors.append(f"{prefix}.id is required")
+        if rule.get("tool") == "Any":
+            errors.append(f"{prefix}.tool must be omitted to match any tool")
         if rule.get("severity", "warning") not in {"error", "warning", "info"}:
             errors.append(f"{prefix}.severity is invalid")
         if rule.get("event") and rule["event"] not in {e.value for e in HookEvent}:
@@ -202,13 +204,17 @@ def required_packs(policy: dict | None = None) -> list[dict]:
     if not policy:
         return []
     packs = policy.get("required_packs") or []
-    return [p for p in packs if isinstance(p, dict) and p.get("name")]
+    return [p for p in packs if isinstance(p, dict) and (p.get("name") or p.get("id"))]
 
 
 def missing_required_packs(policy: dict | None = None) -> list[str]:
     missing: list[str] = []
     for pack in required_packs(policy):
-        name = str(pack["name"])
+        if pack.get("type") == "cloud_feed" or pack.get("managed_by") == "agentchute":
+            continue
+        name = str(pack.get("name") or "")
+        if not name:
+            continue
         try:
             package_version(name)
         except PackageNotFoundError:

{agentlint-2.3.0 → agentlint-2.4.0}/src/agentlint/agentchute/queue.py

@@ -140,10 +140,31 @@ def flush_queue(
     """Flush queued events to AgentChute in bounded batches."""
     result = FlushResult()
     client = AgentChuteClient.from_env()
-    if client is None:
+    if client is None and not dry_run:
         result.aborted_reason = "AGENTCHUTE_LICENSE_KEY not set"
         return result
 
+    if dry_run:
+        cursor = int(_load_json(_cursor_path(), {"offset": 0}).get("offset", 0))
+        lines = _read_lines()
+        if cursor >= len(lines):
+            return result
+        pending = lines[cursor:]
+        if max_events is not None:
+            pending = pending[:max_events]
+        for raw in pending:
+            if not raw.strip():
+                result.skipped += 1
+                continue
+            try:
+                json.loads(raw)
+            except json.JSONDecodeError:
+                result.skipped += 1
+                continue
+            result.attempted += 1
+            result.delivered += 1
+        return result
+
     if not _acquire_lock():
         result.locked = True
         return result
@@ -271,6 +292,9 @@ def _acquire_lock() -> bool:
                 return False
             return _acquire_lock()
         return False
+    except OSError:
+        logger.debug("agentlint.agentchute: could not acquire flush lock", exc_info=True)
+        return False
 
 
 def _release_lock() -> None: