ai-dev-cli-tools 1.2.1__tar.gz → 1.3.0__tar.gz

ai_dev_cli_tools-1.3.0/.dockerignore

@@ -0,0 +1,26 @@
+.git
+.gitignore
+.venv
+venv
+env
+__pycache__
+*.pyc
+*.pyo
+*.pyd
+.mypy_cache
+.pytest_cache
+.ruff_cache
+.coverage
+.coverage.*
+build
+dist
+*.egg-info
+.tmp-*
+.ai
+*.db
+*.sqlite
+*.sqlite3
+collector/tests
+tests
+docs
+examples

ai_dev_cli_tools-1.3.0/.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

{ai_dev_cli_tools-1.2.1 → ai_dev_cli_tools-1.3.0}/.github/workflows/ci.yml

@@ -8,8 +8,8 @@ jobs:
   launcher-smoke:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
       - run: python scripts/dev.py --diagnose
@@ -21,11 +21,11 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
-        python-version: ["3.11", "3.12", "3.13"]
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
       - run: python -m pip install --upgrade pip
@@ -55,14 +55,14 @@ jobs:
   toolchain-e2e:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
-      - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: temurin
           java-version: "17"
@@ -84,10 +84,10 @@ jobs:
   agent-corpus:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
       - run: python -m pip install -c requirements-dev.lock -e ".[dev]"
@@ -110,11 +110,11 @@ jobs:
       contents: read
       security-events: write
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
       - run: python -m pip install -c requirements-dev.lock -e ".[dev]"
@@ -126,6 +126,53 @@ jobs:
         run: cat .ai/reports/agent-plan.md >> "$GITHUB_STEP_SUMMARY"
       - name: Upload SARIF to GitHub code scanning
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
         with:
           sarif_file: .ai/reports/ai-dev.sarif
+
+  collector-postgres-e2e:
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_DB: telemetry
+          POSTGRES_USER: telemetry_user
+          POSTGRES_PASSWORD: test_ci_password_123
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+      - run: python -m pip install --upgrade pip
+      - run: python -m pip install -r collector/requirements.txt -e .
+      - name: Test Alembic migration against PostgreSQL
+        env:
+          DATABASE_URL: postgresql+psycopg://telemetry_user:test_ci_password_123@localhost:5432/telemetry
+        run: |
+          python -m alembic -c collector/alembic.ini upgrade head
+          python -m alembic -c collector/alembic.ini current
+      - name: Build Docker collector image
+        run: docker build -f collector/Dockerfile -t ai-dev-collector:test .
+      - name: Run Docker collector container E2E ingestion test
+        env:
+          DATABASE_URL: postgresql+psycopg://telemetry_user:test_ci_password_123@localhost:5432/telemetry
+          COLLECTOR_URL: http://127.0.0.1:8000
+          PYTHONPATH: .
+        run: |
+          docker run -d --name test-collector --network host \
+            -e DATABASE_URL=postgresql+psycopg://telemetry_user:test_ci_password_123@localhost:5432/telemetry \
+            -e ENVIRONMENT=production \
+            ai-dev-collector:test
+          sleep 3
+          docker logs test-collector
+          python scripts/test_collector_postgres_e2e.py
+          docker stop test-collector
+          docker rm test-collector

ai_dev_cli_tools-1.3.0/.github/workflows/codeql.yml

@@ -0,0 +1,28 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "17 4 * * 1"
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze Python
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
+        with:
+          languages: python
+          build-mode: none
+          queries: security-extended
+      - uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4

{ai_dev_cli_tools-1.2.1 → ai_dev_cli_tools-1.3.0}/.github/workflows/docs.yml

@@ -8,8 +8,8 @@ jobs:
   docs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
       - run: python -m pip install -c requirements-dev.lock -e ".[dev]"

{ai_dev_cli_tools-1.2.1 → ai_dev_cli_tools-1.3.0}/.github/workflows/publish-pypi.yml

@@ -14,11 +14,11 @@ jobs:
     name: Validate manually promoted release artifacts
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           ref: ${{ github.event.release.tag_name }}
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
       - name: Download artifacts attached by the TestPyPI workflow
@@ -71,11 +71,11 @@ jobs:
     needs: publish-pypi
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           ref: ${{ github.event.release.tag_name }}
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
       - name: Install and smoke test from PyPI through pipx

{ai_dev_cli_tools-1.2.1 → ai_dev_cli_tools-1.3.0}/.github/workflows/release.yml

@@ -13,10 +13,10 @@ jobs:
     name: Build and validate distribution
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
       - name: Validate tag and source version
@@ -65,10 +65,10 @@ jobs:
     needs: publish-testpypi
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
       - name: Install and smoke test from TestPyPI
@@ -84,7 +84,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Download TestPyPI-verified distribution artifact

{ai_dev_cli_tools-1.2.1 → ai_dev_cli_tools-1.3.0}/.gitignore

@@ -18,3 +18,6 @@ dist/
 *.egg-info/
 __pycache__/
 *.py[cod]
+*.db
+*.sqlite
+*.sqlite3

{ai_dev_cli_tools-1.2.1 → ai_dev_cli_tools-1.3.0}/CHANGELOG.md

@@ -1,6 +1,41 @@
 # Changelog
 
-## Unreleased
+## 1.3.0 - 2026-09-15
+
+- **Community Telemetry**: Add privacy-preserving, voluntary, opt-in telemetry (`OFF`, `BASIC`, `RESEARCH`).
+  - Strict client allowlist schema; source code, prompts, model responses, repository names, file paths, user identifiers, and credentials are never collected.
+  - Transparent user control via `ai-dev telemetry sharing` commands (`status`, `enable basic`, `enable research`, `disable`, `preview`, `flush`).
+  - Bounded local disk queue with automatic retention pruning (max 1,000 events, max 7 days, max 32 KB per event).
+  - Single-flight non-blocking background transport worker.
+  - Support for research-level provider usage metrics collected via MCP tool (`record_usage`) and CLI usage imports.
+- **Production Telemetry Collector**: Introduce the self-contained production backend collector (`collector/`):
+  - Fast, auditable FastAPI ingestion endpoint (`POST /v1/events`) with liveness (`/health`) and readiness (`/ready`) probes.
+  - Fail-closed payload validation and streaming body size enforcement (32 KB limit).
+  - In-memory bounded sliding-window rate limiter with single-IP trusted reverse proxy sanitization.
+  - Idempotent deduplication on primary key `event_id`.
+  - PostgreSQL 16 storage backed by versioned Alembic migrations.
+  - Automated 90-day retention cleanup.
+  - Privacy-safe logging with zero client input, path, or credential leakage.
+  - Configured default HTTPS production endpoint (`https://35.209.177.185.sslip.io/v1/events`).
+- **Validation & Runner Hardening**:
+  - Fix #78: Recognize Node spec/TAP summaries without matching `recoverable` as coverage.
+  - Fix #79: Execute selected `.mjs`/`.cjs` tests, retain broad fallback commands, and fail explicitly when selected tests have no runnable validation plan.
+  - Fix #80: Preserve source prefixes under small content budgets, document content-only `max_chars`, measure actual artifact sizes, and distinguish receipt/content truncation.
+  - Preserve numeric parser error counts and restrict pytest arguments to Python selections.
+  - Prevent `finish` from approving incomplete, blocked, or invalid validation.
+  - Drain cancellable subprocess pipes while waiting and preserve output captured before timeout.
+
+## 1.2.2 - 2026-09-08
+
+- Add a native Gemini CLI MCP integration, reference-first client profile, provider-reported
+  `usageMetadata` import, and Gemini pricing snapshot support.
+- Add Python 3.14 to the supported classifiers and cross-platform CI matrix.
+- Ignore named virtual environments and bytecode during changed-check selection, prefer the
+  project virtual-environment interpreter, and keep Ruff failures out of pytest-focused reruns.
+- Add CodeQL analysis, Dependabot update configuration, and a complete security reporting and
+  supported-version policy.
+- Make managed-process stop observe in-flight atomic supervisor state, closing a rare start/stop
+  race exposed by the expanded Python CI matrix.
 
 ## 1.2.1 - 2026-09-01
 

ai_dev_cli_tools-1.2.1/README.md → ai_dev_cli_tools-1.3.0/PKG-INFO

@@ -1,3 +1,51 @@
+Metadata-Version: 2.5
+Name: ai-dev-cli-tools
+Version: 1.3.0
+Summary: Cross-platform CLI helpers that give AI coding agents concise, deterministic development reports.
+Project-URL: Homepage, https://github.com/MatthiasLew/ai-dev-cli-tools
+Project-URL: Repository, https://github.com/MatthiasLew/ai-dev-cli-tools
+Project-URL: Issues, https://github.com/MatthiasLew/ai-dev-cli-tools/issues
+Project-URL: Changelog, https://github.com/MatthiasLew/ai-dev-cli-tools/blob/main/CHANGELOG.md
+Author: Mateusz Lewandowski
+License: MIT
+License-File: LICENSE
+Keywords: agents,ai,automation,cli,developer-tools
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Environment :: Console
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.11
+Requires-Dist: watchdog<7,>=4
+Provides-Extra: collector
+Requires-Dist: alembic>=1.13; extra == 'collector'
+Requires-Dist: fastapi>=0.115; extra == 'collector'
+Requires-Dist: httpx>=0.27; extra == 'collector'
+Requires-Dist: pydantic>=2.8; extra == 'collector'
+Requires-Dist: sqlalchemy>=2.0; extra == 'collector'
+Requires-Dist: uvicorn>=0.30; extra == 'collector'
+Provides-Extra: dev
+Requires-Dist: alembic>=1.13; extra == 'dev'
+Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: coverage[toml]>=7.6; extra == 'dev'
+Requires-Dist: fastapi>=0.115; extra == 'dev'
+Requires-Dist: httpx>=0.27; extra == 'dev'
+Requires-Dist: mypy>=1.11; extra == 'dev'
+Requires-Dist: pydantic>=2.8; extra == 'dev'
+Requires-Dist: pytest>=8.3; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Requires-Dist: sqlalchemy>=2.0; extra == 'dev'
+Requires-Dist: uvicorn>=0.30; extra == 'dev'
+Provides-Extra: semantic
+Requires-Dist: tree-sitter-language-pack>=0.9; extra == 'semantic'
+Provides-Extra: tokenizers
+Requires-Dist: tiktoken>=0.7; extra == 'tokenizers'
+Description-Content-Type: text/markdown
+
 # AI Dev CLI Tools
 
 Cross-platform Python CLI helpers for AI coding agents and humans who want concise, deterministic development reports instead of huge logs.
@@ -19,11 +67,59 @@ artifacts may be removed when no longer needed; cache, runtime, and temporary st
 be safe for `ai-dev` to recreate.
 ```
 
+## Help improve ai-dev
+
+`ai-dev` is being evaluated on real-world coding-agent workflows.
+
+If you want to support development, you can optionally enable privacy-preserving opt-in telemetry without persistent user identifiers.
+
+Community Telemetry is **OFF by default**. Installation never automatically activates it.
+
+### Commands
+
+```bash
+ai-dev telemetry sharing status
+ai-dev telemetry sharing enable basic
+ai-dev telemetry sharing enable research
+ai-dev telemetry sharing disable
+ai-dev telemetry sharing preview
+ai-dev telemetry sharing flush
+```
+
+- **OFF**: Nothing is collected or sent.
+- **BASIC**: Minimal operational metrics (command name, category, outcome, duration bucket, OS family, Python version).
+- **RESEARCH**: BASIC metrics plus model provider usage (model name, token counts, task outcome, repo size bucket).
+
+Default production endpoint: `https://35.209.177.185.sslip.io/v1/events` (can be overridden with `AI_DEV_COMMUNITY_TELEMETRY_ENDPOINT`).
+
+Never shared:
+- source code
+- prompts
+- model responses
+- repository names
+- file names or paths
+- usernames/emails
+- secrets/API keys
+
+Preview what data fields would be shared from your repository:
+
+```bash
+ai-dev telemetry sharing preview --level research
+```
+
+Or view a synthetic example payload:
+
+```bash
+ai-dev telemetry sharing preview --level research --sample
+```
+
+For complete details on data handling, allowed scalar metrics, and local queueing, see [docs/community-telemetry.md](docs/community-telemetry.md).
+
 ## Install
 
 ```bash
 python -m pip install --upgrade pipx
-pipx install ai-dev-cli-tools==1.2.1
+pipx install ai-dev-cli-tools==1.3.0
 ai-dev --help
 ```
 
@@ -84,8 +180,10 @@ ai-dev baseline compare main
 ai-dev benchmark run --suite examples/benchmarks/output-budget-smoke.json --variant baseline
 ai-dev benchmark corpus --manifest examples/benchmarks/agent-corpus.json --trials 3
 ai-dev integrations install all
+ai-dev integrations install gemini
 ai-dev dashboard serve --port 8765
 ai-dev telemetry import response.json --client codex --format openai
+ai-dev telemetry import gemini-response.json --client gemini --format gemini
 ai-dev telemetry status --json
 ai-dev telemetry optimize --min-sessions 5 --json
 ai-dev telemetry export --format csv --output .ai/telemetry-exports/usage.csv --json
@@ -119,7 +217,7 @@ All commands support `--project`, `--json`, `--quiet`, `--help`, and `--version`
 ## Local MCP server
 
 `ai-dev mcp serve` exposes project status, implementation planning, compact feedback, bounded context, validation,
-and progressive evidence as local structured tools for Codex-compatible MCP clients. The STDIO
+and progressive evidence as local structured tools for clients including Gemini CLI. The STDIO
 server is dependency-free, has no network listener, fixes all calls to one project root, and
 defaults validation to preview-only. After consuming a successful `build_context` response, a
 client can return its `summary.delta.state_fingerprint` as `acknowledged_state`; an identical safe
@@ -179,14 +277,14 @@ Artifacts are written to `.ai/context/context-latest.md` and `.ai/context/contex
 
 Selective retrieval defaults to `auto`: focused includes or changed files can abstain from broad cross-file retrieval, while missing focus, broad configuration changes, and broad task scopes fall back to the full candidate set. Use `--retrieval always` to expand or `--retrieval never` to keep only focused roots and inferred related tests. The JSON and Markdown reports explain the decision and expose a related-test false-negative proxy.
 
-Install `ai-dev-cli-tools[tokenizers]` to enable exact local `cl100k_base` or `o200k_base` counting. Without that optional extra, accounting uses the explicit UTF-8-bytes/4 estimate and reports a fallback if an exact tokenizer was requested. Repeated `--token-budget category=N` limits source, diffs, tests, logs, maps, history, cached input, or output independently. `--provider-usage <json>` normalizes OpenAI or Anthropic usage fields from a project-local file without network access.
+Install `ai-dev-cli-tools[tokenizers]` to enable exact local `cl100k_base` or `o200k_base` counting. Without that optional extra, accounting uses the explicit UTF-8-bytes/4 estimate and reports a fallback if an exact tokenizer was requested. Repeated `--token-budget category=N` limits source, diffs, tests, logs, maps, history, cached input, or output independently. `--provider-usage <json>` normalizes OpenAI, Anthropic, or Gemini usage fields from a project-local file without network access.
 
 `ai-dev task` is the default one-shot handoff for an AI client. It combines the bounded plan,
 selected context, and check preview while delivering file references instead of full content.
 Use `--include-content` only when the consumer truly needs the bodies. The response includes a
 state fingerprint and a token savings receipt; return that fingerprint with `--ack-state` only
 after consuming the response. Explicit acknowledgements are stored per client under
-`.ai/cache/client-state/`, so Codex, Claude Code, Cursor, and generic consumers never inherit one
+`.ai/cache/client-state/`, so Codex, Claude Code, Cursor, Gemini CLI, and generic consumers never inherit one
 another's assumed context. Receipts remain local under `.ai/token-efficiency/`.
 
 Provider-reported usage can be recorded through MCP `record_usage` or imported from a bounded,
@@ -314,7 +412,7 @@ git diff --check
 | mcp serve | implemented |
 | watch | implemented |
 | benchmark run/compare/gate/corpus | implemented |
-| integrations install | implemented for Codex, Claude Code, Cursor, and generic MCP |
+| integrations install | implemented for Codex, Claude Code, Cursor, Gemini CLI, and generic MCP |
 | dashboard status/serve | implemented, loopback-only |
 | telemetry import/status and MCP record_usage | implemented, provider-reported usage only |
 | telemetry gate/pricing snapshots and MCP usage_status | implemented, local and fail-closed |

ai_dev_cli_tools-1.2.1/PKG-INFO → ai_dev_cli_tools-1.3.0/README.md

@@ -1,37 +1,3 @@
-Metadata-Version: 2.5
-Name: ai-dev-cli-tools
-Version: 1.2.1
-Summary: Cross-platform CLI helpers that give AI coding agents concise, deterministic development reports.
-Project-URL: Homepage, https://github.com/MatthiasLew/ai-dev-cli-tools
-Project-URL: Repository, https://github.com/MatthiasLew/ai-dev-cli-tools
-Project-URL: Issues, https://github.com/MatthiasLew/ai-dev-cli-tools/issues
-Project-URL: Changelog, https://github.com/MatthiasLew/ai-dev-cli-tools/blob/main/CHANGELOG.md
-Author: Mateusz Lewandowski
-License: MIT
-License-File: LICENSE
-Keywords: agents,ai,automation,cli,developer-tools
-Classifier: Development Status :: 5 - Production/Stable
-Classifier: Environment :: Console
-Classifier: License :: OSI Approved :: MIT License
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
-Classifier: Programming Language :: Python :: 3.13
-Classifier: Topic :: Software Development :: Quality Assurance
-Requires-Python: >=3.11
-Requires-Dist: watchdog<7,>=4
-Provides-Extra: dev
-Requires-Dist: build>=1.2; extra == 'dev'
-Requires-Dist: coverage[toml]>=7.6; extra == 'dev'
-Requires-Dist: mypy>=1.11; extra == 'dev'
-Requires-Dist: pytest>=8.3; extra == 'dev'
-Requires-Dist: ruff>=0.6; extra == 'dev'
-Provides-Extra: semantic
-Requires-Dist: tree-sitter-language-pack>=0.9; extra == 'semantic'
-Provides-Extra: tokenizers
-Requires-Dist: tiktoken>=0.7; extra == 'tokenizers'
-Description-Content-Type: text/markdown
-
 # AI Dev CLI Tools
 
 Cross-platform Python CLI helpers for AI coding agents and humans who want concise, deterministic development reports instead of huge logs.
@@ -53,11 +19,59 @@ artifacts may be removed when no longer needed; cache, runtime, and temporary st
 be safe for `ai-dev` to recreate.
 ```
 
+## Help improve ai-dev
+
+`ai-dev` is being evaluated on real-world coding-agent workflows.
+
+If you want to support development, you can optionally enable privacy-preserving opt-in telemetry without persistent user identifiers.
+
+Community Telemetry is **OFF by default**. Installation never automatically activates it.
+
+### Commands
+
+```bash
+ai-dev telemetry sharing status
+ai-dev telemetry sharing enable basic
+ai-dev telemetry sharing enable research
+ai-dev telemetry sharing disable
+ai-dev telemetry sharing preview
+ai-dev telemetry sharing flush
+```
+
+- **OFF**: Nothing is collected or sent.
+- **BASIC**: Minimal operational metrics (command name, category, outcome, duration bucket, OS family, Python version).
+- **RESEARCH**: BASIC metrics plus model provider usage (model name, token counts, task outcome, repo size bucket).
+
+Default production endpoint: `https://35.209.177.185.sslip.io/v1/events` (can be overridden with `AI_DEV_COMMUNITY_TELEMETRY_ENDPOINT`).
+
+Never shared:
+- source code
+- prompts
+- model responses
+- repository names
+- file names or paths
+- usernames/emails
+- secrets/API keys
+
+Preview what data fields would be shared from your repository:
+
+```bash
+ai-dev telemetry sharing preview --level research
+```
+
+Or view a synthetic example payload:
+
+```bash
+ai-dev telemetry sharing preview --level research --sample
+```
+
+For complete details on data handling, allowed scalar metrics, and local queueing, see [docs/community-telemetry.md](docs/community-telemetry.md).
+
 ## Install
 
 ```bash
 python -m pip install --upgrade pipx
-pipx install ai-dev-cli-tools==1.2.1
+pipx install ai-dev-cli-tools==1.3.0
 ai-dev --help
 ```
 
@@ -118,8 +132,10 @@ ai-dev baseline compare main
 ai-dev benchmark run --suite examples/benchmarks/output-budget-smoke.json --variant baseline
 ai-dev benchmark corpus --manifest examples/benchmarks/agent-corpus.json --trials 3
 ai-dev integrations install all
+ai-dev integrations install gemini
 ai-dev dashboard serve --port 8765
 ai-dev telemetry import response.json --client codex --format openai
+ai-dev telemetry import gemini-response.json --client gemini --format gemini
 ai-dev telemetry status --json
 ai-dev telemetry optimize --min-sessions 5 --json
 ai-dev telemetry export --format csv --output .ai/telemetry-exports/usage.csv --json
@@ -153,7 +169,7 @@ All commands support `--project`, `--json`, `--quiet`, `--help`, and `--version`
 ## Local MCP server
 
 `ai-dev mcp serve` exposes project status, implementation planning, compact feedback, bounded context, validation,
-and progressive evidence as local structured tools for Codex-compatible MCP clients. The STDIO
+and progressive evidence as local structured tools for clients including Gemini CLI. The STDIO
 server is dependency-free, has no network listener, fixes all calls to one project root, and
 defaults validation to preview-only. After consuming a successful `build_context` response, a
 client can return its `summary.delta.state_fingerprint` as `acknowledged_state`; an identical safe
@@ -213,14 +229,14 @@ Artifacts are written to `.ai/context/context-latest.md` and `.ai/context/contex
 
 Selective retrieval defaults to `auto`: focused includes or changed files can abstain from broad cross-file retrieval, while missing focus, broad configuration changes, and broad task scopes fall back to the full candidate set. Use `--retrieval always` to expand or `--retrieval never` to keep only focused roots and inferred related tests. The JSON and Markdown reports explain the decision and expose a related-test false-negative proxy.
 
-Install `ai-dev-cli-tools[tokenizers]` to enable exact local `cl100k_base` or `o200k_base` counting. Without that optional extra, accounting uses the explicit UTF-8-bytes/4 estimate and reports a fallback if an exact tokenizer was requested. Repeated `--token-budget category=N` limits source, diffs, tests, logs, maps, history, cached input, or output independently. `--provider-usage <json>` normalizes OpenAI or Anthropic usage fields from a project-local file without network access.
+Install `ai-dev-cli-tools[tokenizers]` to enable exact local `cl100k_base` or `o200k_base` counting. Without that optional extra, accounting uses the explicit UTF-8-bytes/4 estimate and reports a fallback if an exact tokenizer was requested. Repeated `--token-budget category=N` limits source, diffs, tests, logs, maps, history, cached input, or output independently. `--provider-usage <json>` normalizes OpenAI, Anthropic, or Gemini usage fields from a project-local file without network access.
 
 `ai-dev task` is the default one-shot handoff for an AI client. It combines the bounded plan,
 selected context, and check preview while delivering file references instead of full content.
 Use `--include-content` only when the consumer truly needs the bodies. The response includes a
 state fingerprint and a token savings receipt; return that fingerprint with `--ack-state` only
 after consuming the response. Explicit acknowledgements are stored per client under
-`.ai/cache/client-state/`, so Codex, Claude Code, Cursor, and generic consumers never inherit one
+`.ai/cache/client-state/`, so Codex, Claude Code, Cursor, Gemini CLI, and generic consumers never inherit one
 another's assumed context. Receipts remain local under `.ai/token-efficiency/`.
 
 Provider-reported usage can be recorded through MCP `record_usage` or imported from a bounded,
@@ -348,7 +364,7 @@ git diff --check
 | mcp serve | implemented |
 | watch | implemented |
 | benchmark run/compare/gate/corpus | implemented |
-| integrations install | implemented for Codex, Claude Code, Cursor, and generic MCP |
+| integrations install | implemented for Codex, Claude Code, Cursor, Gemini CLI, and generic MCP |
 | dashboard status/serve | implemented, loopback-only |
 | telemetry import/status and MCP record_usage | implemented, provider-reported usage only |
 | telemetry gate/pricing snapshots and MCP usage_status | implemented, local and fail-closed |

ai_dev_cli_tools-1.3.0/SECURITY.md

@@ -0,0 +1,36 @@
+# Security Policy
+
+## Supported versions
+
+Security fixes are provided for the latest stable release only. Users should upgrade to the
+latest patch version before reporting an issue that may already be fixed. Pre-releases and source
+checkouts are supported only for reproducing a report against the current `main` branch.
+
+| Version | Supported |
+| --- | --- |
+| 1.2.x latest patch | Yes |
+| Earlier releases | No |
+
+## Reporting a vulnerability
+
+Do not open a public issue for a suspected vulnerability. Use GitHub's private vulnerability
+reporting form in the repository Security tab when available, or contact the repository owner
+privately through the address associated with the published package.
+
+Include the affected version or commit, operating system, minimal reproduction, expected security
+property, observed impact, and whether the report contains secrets. Do not include real
+credentials, private source code, or customer data. Use synthetic evidence wherever possible.
+
+The maintainer aims to acknowledge a report within 7 days and provide an initial assessment within
+14 days. Timelines for a fix and coordinated disclosure depend on severity and reproducibility.
+
+## Security boundaries
+
+`ai-dev` analyzes repositories and runs explicitly selected local development commands. Reports,
+caches, telemetry, and MCP communication remain local by default. The project intentionally does
+not commit, push, merge, deploy, transmit source to a remote model, install global tools, or kill
+unrelated processes.
+
+Secret masking is a defense-in-depth control, not permission to process arbitrary secrets. Review
+generated reports before sharing them, keep `.ai/` state private, and use least-privilege execution
+policies for MCP clients and CI.