algo-cli-runtime 0.19.2__tar.gz → 0.20.0__tar.gz

{algo_cli_runtime-0.19.2 → algo_cli_runtime-0.20.0}/CHANGELOG.md

@@ -4,6 +4,96 @@ All notable changes to Algo CLI are documented here. The format follows [Keep a
 
 ## [Unreleased]
 
+## [0.20.0] - 2026-09-20
+
+### Added
+
+- Add explicit, session-only `/mode yolo` activation with an owner, process,
+  and workspace binding. YOLO is never saved, inherited by child agents, or
+  enabled by a prompt, copied configuration, or harness refresh.
+- Route memory through native Continuum when it is explicitly selected, with
+  fail-closed scoped context, revision-bound writes, and no fallback backend.
+  `algo-cli config memory repair` removes retired memory selectors from an
+  existing configuration while preserving every other setting.
+- Add the optional Jev kernel: `jev_question_contract` sends bounded,
+  advisory question contracts to the separately installed `jev-workflows`
+  companion. Lint runs locally; inference requires `algo-cli config jev enable`
+  and session approval, and validated answers never authorize actions.
+- Keep the normal model, context, tool, reflection, and safety status visible
+  during generation and tool execution on supported interactive terminals.
+
+### Changed
+
+- Let user-activated YOLO preapprove registered in-scope actions while retaining
+  safe-mode denials, credential and direct-send restrictions, protected memory
+  boundaries, target checks, child isolation, and post-mutation verification.
+- Allow curated owner-bound read-only observation outside the active workspace
+  in YOLO without extending cross-workspace mutation authority.
+- Normalize an empty typed-program output list to the final step and ignore only
+  redundant active-workspace `cwd` fields owned by the runtime. Conflicting
+  workspaces and invalid plans remain rejected.
+- Remove the ordinary tool-round and verification-recovery ceilings while YOLO
+  is active; saved `/toolmax` behavior is unchanged after leaving YOLO.
+- Preserve live YOLO activation through `/reload` without persisting it, and use
+  native cloud-model context limits instead of stale catalog stamps.
+- Show a short `/` menu of common commands, group `/help` by category, and
+  reveal subcommands after their parent command. Existing command names and
+  aliases still work.
+- Render the in-progress footer with the same content, colors, and spacing as
+  the prompt footer, so submitting a question no longer restyles it.
+
+### Removed
+
+- Ship `docs/ALGO.md` as an empty template instead of a populated pattern
+  catalog. Each user keeps their own catalog at `~/.algo_cli/ALGO.md`, which
+  Algo indexes in place of the template; `/intelligence init` creates it.
+- Remove the Acrobat, finance, and construction kernels and their modules from
+  the package. Personal kernels are declared in
+  `~/.algo_cli/kernels/kernels.json` and load on that machine only; `/kernel`
+  lists them separately from built-in kernels.
+
+### Fixed
+
+- Stop a startup crash when Continuum's required shared context exceeds the
+  default packet size: Algo retries once with the backend-reported size, up to
+  a hard cap, without dropping required records.
+- Check protected-memory Git paths with their exact bytes, so a hard link with a
+  non-UTF-8 name cannot bypass the link check, and never launch a
+  `continuum-memory` command found inside the current repository.
+- Stream Continuum replies under a fixed size limit, keep `/memory help`
+  available when the backend is down, and bound the personal kernel file.
+- Keep a context window set with `/ctx` even when it equals a common model
+  default; only unrecorded automatic values are promoted to the native window.
+- Refresh the Boron managed-browser pin to Chrome `153.0.8010.52` with its
+  Debian package checksum, release timestamp, regenerated dpkg lock, and
+  coupled fixtures, so hosted browser qualification is within the 72-hour
+  security-update limit.
+- Distinguish compiler-format failures from missing runtime authority so valid
+  YOLO programs are not reported as approval failures.
+- Classify slash-command inspection by each handler's real argument contract.
+  Mutating `/host`, `/model`, `/system`, `/goal`, `/google`, and related forms
+  no longer inherit read-only output capture or inspection treatment.
+- Preserve `/memories` output capture and keep mutating command output on the
+  normal non-captured policy path.
+- Restore terminal scroll margins on normal completion, resize, suspension,
+  termination, and hangup; suppress terminal controls for JSON output and
+  terminals without VT support.
+- Accept both current owned Swift test-bundle identities without weakening path
+  or process-ancestry checks, and update the dependency lock past known `anyio`
+  advisories.
+- Pin release upgrade qualification to the actual published `0.19.2`
+  predecessor and its exact public wheel bytes instead of the obsolete
+  `0.18.0` baseline, including the real published updater for pipless
+  `uv-pip` installations instead of a manual bootstrap bypass.
+
+### Release Limits
+
+- Retired memory backends (Echo Veil and D-57) are removed, not supported as
+  options or fallbacks. Their historical records are left unchanged.
+- M8 retains five blocked external-browser metrics and M9 retains thirteen
+  blocked requirements. This release does not claim external-browser or model-
+  quality qualification from local deterministic evidence.
+
 ## [0.19.2] - 2026-09-13
 
 ### Fixed

{algo_cli_runtime-0.19.2 → algo_cli_runtime-0.20.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: algo-cli-runtime
-Version: 0.19.2
+Version: 0.20.0
 Summary: Agent runtime for tools, durable context, and verified work
 Project-URL: Homepage, https://algo-cli.com
 Project-URL: Documentation, https://algo-cli.com/docs
@@ -119,7 +119,7 @@ inside the running launcher does not release that Windows file lock.
 To install a reviewed source checkout instead, clone the repository and run
 `pipx install .` from its root.
 
-Optional extras are available for PDF rendering (`algo-cli-runtime[pdf]`) and experimental vector quantization (`algo-cli-runtime[quantization]`). Echo Veil is not a public package extra because its qualified 0.8 revision is not published on PyPI. Source development uses the exact commit-pinned `echo-veil` dependency group; operators who require Echo must install that same reviewed source revision into Algo's Python environment. The distribution installs the `algo-cli` command. Run `algo-cli doctor` for a side-effect-free readiness report.
+Optional extras are available for PDF rendering (`algo-cli-runtime[pdf]`) and experimental vector quantization (`algo-cli-runtime[quantization]`). Governed memory uses the separately installed native Continuum service; see [Continuum Memory](docs/continuum-memory.md) for configuration and recovery. The distribution installs the `algo-cli` command. Run `algo-cli doctor` for a side-effect-free readiness report.
 
 ## Quick Start
 
@@ -311,6 +311,8 @@ The model can call these tools during a conversation:
 
 **Programmatic actions:** `action_search` retrieves a small set of exact deferred action schemas; discovery does not bypass the active capability ceiling, runtime policy, or approval. `action_program` compiles a bounded typed dataflow plan—never arbitrary Python or JavaScript—and routes every nested action through its existing ActionSpec policy, guardrails, approval, attempt ledger, and telemetry. Its wall-clock budget is cooperative: the remaining budget is propagated into timeout-aware actions and checked around every step, while actions without a timeout contract can only be marked over-budget after they return. Large intermediate values are content-addressed in the private runtime store; compact results retain hash-chained mutation and verification receipts. Successful program verifiers reconcile into the outer completion ledger, so the latest passing post-mutation check supersedes earlier failures without relying on model phrasing.
 
+**Jev (optional):** `jev_question_contract` asks Jev, a small TypeSafe decision model, bounded advisory questions (classification, review, routing, claim checks) and `jev_kernel_status` checks readiness. It needs the separately installed `jev-workflows` companion: run `algo-cli config jev enable --cli /absolute/path/to/jev-workflows`. The companion holds its own credentials. `lint` mode is local; `review`, `run`, and `followup` send only the supplied question packet to TypeSafe and require session approval. Answers are advisory and never authorize or execute actions. `algo-cli config jev disable` turns inference off again.
+
 **Models:** `model_show`, `model_pull`, `model_copy`, `model_create`, `model_delete`
 
 **Files and Git:** `read_file`, `read_pdf`, `render_pdf_pages`, `edit_file`, `write_file`, `list_directory`, `search_files`, `find_unique_anchor`, `batch_edit`, `git_status`, `git_diff`

{algo_cli_runtime-0.19.2 → algo_cli_runtime-0.20.0}/README.md

@@ -51,7 +51,7 @@ inside the running launcher does not release that Windows file lock.
 To install a reviewed source checkout instead, clone the repository and run
 `pipx install .` from its root.
 
-Optional extras are available for PDF rendering (`algo-cli-runtime[pdf]`) and experimental vector quantization (`algo-cli-runtime[quantization]`). Echo Veil is not a public package extra because its qualified 0.8 revision is not published on PyPI. Source development uses the exact commit-pinned `echo-veil` dependency group; operators who require Echo must install that same reviewed source revision into Algo's Python environment. The distribution installs the `algo-cli` command. Run `algo-cli doctor` for a side-effect-free readiness report.
+Optional extras are available for PDF rendering (`algo-cli-runtime[pdf]`) and experimental vector quantization (`algo-cli-runtime[quantization]`). Governed memory uses the separately installed native Continuum service; see [Continuum Memory](docs/continuum-memory.md) for configuration and recovery. The distribution installs the `algo-cli` command. Run `algo-cli doctor` for a side-effect-free readiness report.
 
 ## Quick Start
 
@@ -243,6 +243,8 @@ The model can call these tools during a conversation:
 
 **Programmatic actions:** `action_search` retrieves a small set of exact deferred action schemas; discovery does not bypass the active capability ceiling, runtime policy, or approval. `action_program` compiles a bounded typed dataflow plan—never arbitrary Python or JavaScript—and routes every nested action through its existing ActionSpec policy, guardrails, approval, attempt ledger, and telemetry. Its wall-clock budget is cooperative: the remaining budget is propagated into timeout-aware actions and checked around every step, while actions without a timeout contract can only be marked over-budget after they return. Large intermediate values are content-addressed in the private runtime store; compact results retain hash-chained mutation and verification receipts. Successful program verifiers reconcile into the outer completion ledger, so the latest passing post-mutation check supersedes earlier failures without relying on model phrasing.
 
+**Jev (optional):** `jev_question_contract` asks Jev, a small TypeSafe decision model, bounded advisory questions (classification, review, routing, claim checks) and `jev_kernel_status` checks readiness. It needs the separately installed `jev-workflows` companion: run `algo-cli config jev enable --cli /absolute/path/to/jev-workflows`. The companion holds its own credentials. `lint` mode is local; `review`, `run`, and `followup` send only the supplied question packet to TypeSafe and require session approval. Answers are advisory and never authorize or execute actions. `algo-cli config jev disable` turns inference off again.
+
 **Models:** `model_show`, `model_pull`, `model_copy`, `model_create`, `model_delete`
 
 **Files and Git:** `read_file`, `read_pdf`, `render_pdf_pages`, `edit_file`, `write_file`, `list_directory`, `search_files`, `find_unique_anchor`, `batch_edit`, `git_status`, `git_diff`

{algo_cli_runtime-0.19.2 → algo_cli_runtime-0.20.0}/algo_cli/__init__.py

@@ -5,13 +5,12 @@ from __future__ import annotations
 from importlib import import_module
 from types import ModuleType
 
-__version__ = "0.19.2"
+__version__ = "0.20.0"
 
 _RENAMED_INTERNAL_MODULES = {
     "elsie_memory_path_policy": "irene_memory_path_policy",
     "elsie_memory_receipts": "grace_memory_receipts",
     "memory_candidates": "julia_memory_candidates",
-    "memory_echo_veil": "ada_memory_echo_veil",
     "oneshot": "oliver_oneshot",
     "program_runtime": "nathan_program_runtime",
     "tool_policy": "samuel_policy",

{algo_cli_runtime-0.19.2 → algo_cli_runtime-0.20.0}/algo_cli/action_registry.py

@@ -190,6 +190,18 @@ def _spec(
 
 
 ACTION_SPECS: tuple[ActionSpec, ...] = (
+    _spec(
+        "jev.status", "kernel", "Inspect Jev question-contract companion readiness.",
+        "kernel", ("jev", "read-only", "local"), "Checks compatibility without contacting TypeSafe.",
+        "low", False, False, True,
+        known_limitations=("Execute through jev_kernel_status; readiness does not verify provider connectivity.",),
+    ),
+    _spec(
+        "jev.question_contract", "kernel", "Lint or submit a bounded advisory Jev question contract.",
+        "kernel", ("jev", "advisory", "network"), "Typed judgments never authorize or execute actions.",
+        "medium", False, True, False, requires_network=True,
+        known_limitations=("Execute through jev_question_contract; lint is local, inference requires explicit setup.",),
+    ),
     _spec(
         "read_file",
         "tool",
@@ -860,10 +872,10 @@ ACTION_SPECS: tuple[ActionSpec, ...] = (
     _spec(
         "capability.tier",
         "kernel",
-        "Assign the least-privileged runtime capability tier.",
+        "Describe the compatibility capability tier; runtime authority uses scoped grants.",
         "kernel",
         ("policy", "capability", "tier", "least-privilege"),
-        "Ensures each tool's capability mask fits its structural permission tier.",
+        "Capability tiers describe masks but cannot authorize actions or expand scoped grants.",
         "low",
         False,
         False,
@@ -1390,6 +1402,7 @@ def _first_doc_line(obj: Any, fallback: str) -> str:
 
 def _generated_tool_spec(name: str, fn: Any) -> ActionSpec:
     policy = policy_for_action(name)
+    memory_tool = name.startswith("memory_")
     network = (
         name.startswith("web_")
         or name.startswith("x_")
@@ -1412,17 +1425,23 @@ def _generated_tool_spec(name: str, fn: Any) -> ActionSpec:
         name,
         "tool",
         _first_doc_line(fn, f"Runtime callable tool: {name}."),
-        "runtime",
-        (("curated-runtime", "runtime", "tool") if policy.curated else ("unclassified", "runtime", "tool")),
+        "memory" if memory_tool else "runtime",
+        (
+            ("continuum", "memory", "curated-runtime", "tool")
+            if memory_tool
+            else ("curated-runtime", "runtime", "tool")
+            if policy.curated
+            else ("unclassified", "runtime", "tool")
+        ),
         (
             "Curated runtime policy covers this callable even though it has no long-form registry entry."
             if policy.curated
             else "Unclassified runtime callable is denied until an explicit authority policy is added."
         ),
-        "high",
-        True,
-        True,
-        False,
+        cast(RiskLevel, policy.maximum_risk),
+        policy.mutates_state,
+        policy.requires_approval,
+        policy.safe_retry,
         requires_network=network,
         requires_provider=provider,
     )

{algo_cli_runtime-0.19.2 → algo_cli_runtime-0.20.0}/algo_cli/ada_task_ledger.py

@@ -13,8 +13,9 @@ Writes are atomic (tmp + os.replace) via config._atomic_write_text.
 
 from __future__ import annotations
 
-import json
+import hashlib
 import hmac
+import json
 import os
 import stat
 import time
@@ -46,6 +47,7 @@ LEGACY_PROTECTED_LEDGER_SCHEMA_VERSION = 2
 PROTECTED_LEDGER_SCHEMA_VERSION = 3
 MAX_LEDGER_BYTES = 1_048_576
 _LEDGER_MISSING = object()
+GOAL_STORE_CONFLICT_REASON = "goal_store_conflict_requires_repair"
 
 STATUS_RUNNING = "running"
 STATUS_COMPLETE = "complete"
@@ -57,7 +59,7 @@ STATUS_STOPPED = "stopped"  # user-interrupted or round cap reached
 class GoalRecord:
     # The goal is explicit user-authored operational state and intentionally
     # remains readable. Model-derived reasons/history are projected below when
-    # Echo is the selected memory authority.
+    # Continuum is the selected memory authority.
     goal: str
     status: str = STATUS_RUNNING
     rounds_done: int = 0
@@ -408,7 +410,7 @@ def prepare_protected_goal_store(
                 anchor_store=anchor_store,
             )
             if existing_head is not None:
-                raise ElsieReceiptError("legacy goal ledger conflicts with protected anchor")
+                raise ElsieReceiptError(GOAL_STORE_CONFLICT_REASON)
             payload = _protected_ledger_payload(
                 _protected_goal_payload(legacy, authority),
                 authority,
@@ -429,6 +431,93 @@ def prepare_protected_goal_store(
         return recovered
 
 
+def repair_protected_goal_store_conflict(
+    *,
+    receipt_authority: ElsieReceiptAuthority | None = None,
+    anchor_store: Any | None = None,
+) -> dict[str, object]:
+    """Archive a conflicting legacy ledger and publish a blocked successor.
+
+    The existing external anchor is retained and advanced. Legacy progress is
+    never made resumable: only the user-authored goal and cwd survive, in a
+    blocked record that requires an explicit fresh goal before more work.
+    """
+
+    authority = receipt_authority or ElsieReceiptAuthority.from_existing_key_store()
+    with _exclusive_state_lock(LEDGER_PATH):
+        if _pending_goal_exists():
+            raise ElsieReceiptError("protected goal recovery is pending")
+        try:
+            raw = _state_descriptor_payload(LEDGER_PATH, max_bytes=MAX_LEDGER_BYTES)
+        except FileNotFoundError as exc:
+            raise ElsieReceiptError("protected goal ledger is missing") from exc
+        except OSError as exc:
+            raise ElsieReceiptError("protected goal ledger path is unsafe") from exc
+        try:
+            current = json.loads(raw.decode("utf-8", errors="strict"))
+        except (json.JSONDecodeError, UnicodeDecodeError) as exc:
+            raise ElsieReceiptError("protected goal ledger is malformed") from exc
+        if not isinstance(current, dict):
+            raise ElsieReceiptError("protected goal ledger is malformed")
+        if current.get("schema_version") == PROTECTED_LEDGER_SCHEMA_VERSION:
+            _validate_protected_ledger(
+                current,
+                authority,
+                anchor_store=anchor_store,
+            )
+            return {"changed": False, "backup_path": None, "source_sha256": ""}
+
+        legacy = _legacy_goal_for_protected_migration(current, authority)
+        head = load_elsie_store_anchor(
+            authority,
+            ReceiptNamespace.GOAL_STORE,
+            subject=_ledger_subject(),
+            anchor_store=anchor_store,
+        )
+        if head is None:
+            raise ElsieReceiptError("protected goal conflict is absent")
+
+        digest = hashlib.sha256(raw).hexdigest()
+        backup_path = (
+            CONFIG_DIR
+            / "recovery-backups"
+            / f"goal-ledger-conflict-{digest[:16]}"
+            / LEDGER_PATH.name
+        )
+        try:
+            backup = _state_descriptor_payload(backup_path, max_bytes=MAX_LEDGER_BYTES)
+        except FileNotFoundError:
+            _atomic_write_text(backup_path, raw.decode("utf-8", errors="strict"))
+        else:
+            if backup != raw:
+                raise ElsieReceiptError("protected goal recovery backup is inconsistent")
+
+        try:
+            pinned = _state_descriptor_payload(LEDGER_PATH, max_bytes=MAX_LEDGER_BYTES)
+        except OSError as exc:
+            raise ElsieReceiptError("protected goal ledger changed during repair") from exc
+        if not hmac.compare_digest(pinned, raw):
+            raise ElsieReceiptError("protected goal ledger changed during repair")
+
+        previous = "hmac-sha256:" + head.head_digest
+        payload = _protected_ledger_payload(
+            _protected_goal_payload(legacy, authority),
+            authority,
+            sequence=head.sequence + 1,
+            previous_store_receipt=previous,
+        )
+        _publish_protected_goal_payload_unlocked(
+            payload,
+            authority,
+            anchor_store=anchor_store,
+        )
+        return {
+            "changed": True,
+            "backup_path": backup_path,
+            "source_sha256": digest,
+        }
+
+
 def _publish_protected_goal_payload_unlocked(
     payload: dict[str, Any],
     authority: ElsieReceiptAuthority,
@@ -522,7 +611,7 @@ def save_goal(
                         )
                         is not None
                     ):
-                        raise ElsieReceiptError("legacy goal ledger conflicts with protected anchor")
+                        raise ElsieReceiptError(GOAL_STORE_CONFLICT_REASON)
                 else:
                     raise ElsieReceiptError("unsupported protected goal ledger schema")
             else:
@@ -709,7 +798,7 @@ def load_goal(
         LEGACY_PROTECTED_LEDGER_SCHEMA_VERSION,
         PROTECTED_LEDGER_SCHEMA_VERSION,
     }:
-        # Protected records are safe to inspect structurally even after Echo is
+        # Protected records are safe to inspect structurally after Continuum is
         # disabled, but their content receipts are deliberately not reversed.
         if goal_data is None:
             return None

{algo_cli_runtime-0.19.2 → algo_cli_runtime-0.20.0}/algo_cli/agent_blocks.py

@@ -13,7 +13,7 @@ try:
     import tomllib  # type: ignore[import-not-found]
 except ImportError:  # Python 3.10: fall back to the tomli backport.
     try:
-        import tomli as tomllib  # type: ignore[no-redef]
+        import tomli as tomllib
     except ImportError:  # pragma: no cover - tomli is a declared 3.10 dependency.
         tomllib = None  # type: ignore[assignment]