autodev-ai 0.1.0a2__tar.gz

autodev_ai-0.1.0a2/.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

autodev_ai-0.1.0a2/.github/workflows/docker-publish.yml

@@ -0,0 +1,109 @@
+name: Docker — Build & Publish to GHCR
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository_owner }}/autodev-ai
+
+jobs:
+  # ── Job 1: smoke-test locally before pushing ───────────────────────────────
+  test:
+    name: Local smoke test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Build wheel + sdist
+        run: |
+          python -m pip install --upgrade pip build
+          python -m build
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build test image (amd64 only, no push)
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: packaging/docker/Dockerfile
+          platforms: linux/amd64
+          load: true
+          tags: autodev-ai:test
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Smoke test — autodev --help
+        run: docker run --rm autodev-ai:test --help
+
+      - name: Smoke test — autodev --version
+        run: docker run --rm autodev-ai:test --version
+
+  # ── Job 2: multi-arch build + push to GHCR ─────────────────────────────────
+  publish:
+    name: Build & push multi-arch image
+    needs: test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Build wheel + sdist
+        run: |
+          python -m pip install --upgrade pip build
+          python -m build
+
+      - name: Set up QEMU (for cross-compilation)
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract Docker metadata (tags + labels)
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=ref,event=tag
+
+      - name: Build and push multi-arch image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: packaging/docker/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

autodev_ai-0.1.0a2/.github/workflows/lint.yml

@@ -0,0 +1,28 @@
+name: Lint
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+    branches: ["**"]
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+
+      - name: Install dev dependencies
+        run: pip install -e ".[dev]" mypy
+
+      - name: ruff check
+        run: ruff check src tests scripts
+
+      - name: mypy
+        run: mypy src/autodev --ignore-missing-imports --no-strict-optional

autodev_ai-0.1.0a2/.github/workflows/release.yml

@@ -0,0 +1,75 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions:
+  contents: write
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+
+      - name: Install package with dev extras
+        run: pip install -e .[dev]
+
+      - name: Lint with ruff
+        run: ruff check .
+
+      - name: Type-check with mypy
+        run: mypy src/autodev
+
+      - name: Run pytest suite
+        run: python -m pytest tests/ -q
+
+  publish:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+
+      - name: Install build tools
+        run: pip install --upgrade build twine
+
+      - name: Build wheel and sdist
+        run: python -m build
+
+      - name: Check distribution artifacts
+        run: python -m twine check dist/*
+
+      - name: Attach to GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: dist/*
+          generate_release_notes: true
+
+      # NOTE: secrets context cannot be used in step-level `if:` (GitHub Actions
+      # rejects the workflow file). Pass through env-level boolean instead.
+      - name: Detect PyPI token presence
+        id: pypi_token_check
+        env:
+          HAS_PYPI_TOKEN: ${{ secrets.PYPI_API_TOKEN != '' }}
+        run: echo "has_token=$HAS_PYPI_TOKEN" >> "$GITHUB_OUTPUT"
+
+      - name: Publish to PyPI
+        if: steps.pypi_token_check.outputs.has_token == 'true'
+        env:
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+        run: python -m twine upload dist/*

autodev_ai-0.1.0a2/.github/workflows/test.yml

@@ -0,0 +1,37 @@
+name: Test
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+    branches: ["**"]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+
+      - name: Run pytest
+        run: pytest -q --cov=autodev --cov-report=xml --cov-report=term-missing
+
+      - name: Upload coverage
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-${{ matrix.python-version }}
+          path: coverage.xml
+          retention-days: 7

autodev_ai-0.1.0a2/.gitignore

@@ -0,0 +1,25 @@
+.venv/
+__pycache__/
+*.pyc
+*.pyo
+.pytest_cache/
+.dev-factory/
+build/
+dist/
+*.egg-info/
+.ruff_cache/
+.mypy_cache/
+node_modules/
+target/
+.autodev/
+_autodev/
+.coverage
+# Secret files (defense in depth — should never be in repo)
+.env
+.env.*
+!.env.example
+credentials.json
+secrets.toml
+*.pem
+*.key
+coverage.json

autodev_ai-0.1.0a2/.pre-commit-config.yaml

@@ -0,0 +1,25 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-toml
+      - id: check-yaml
+        args: [--allow-multiple-documents]
+
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.4.10
+    hooks:
+      - id: ruff
+        args: [--fix]
+        types_or: [python, pyi]
+
+  - repo: local
+    hooks:
+      - id: pytest-collected-count
+        name: pytest collected count (>= 1)
+        language: system
+        entry: bash -c 'pytest --collect-only -q 2>&1 | grep -E "^[0-9]+ test" | awk "{if (\$1 < 1) {print \"No tests collected\"; exit 1}}"'
+        pass_filenames: false
+        stages: [pre-push]

autodev_ai-0.1.0a2/CHANGELOG.md

@@ -0,0 +1,147 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+
+## [Unreleased]
+
+---
+
+## [0.1.0a2] — 2026-05-14 (Pre-Release)
+
+### Fixed
+- 5 pre-publish CI blockers discovered and fixed during v0.1.0a1 tag push:
+  1. `release.yml` step-level `secrets.if` rejected by GitHub Actions schema
+     (split into detector step writing `$GITHUB_OUTPUT` + upload gating on output)
+  2. `tomllib` import broke py3.10 collection in R2-AB tests
+     (added `sys.version_info` check + `tomli` fallback + `tomli` dev dep)
+  3. `test_wheel_cli_version_smoke.py` required pre-built `dist/`
+     (added `skip_if_no_dist` marker to all 6 tests)
+  4. `mypy` missing from `[project.optional-dependencies].dev`
+     (added `mypy>=1.5` to dev extras)
+  5. `Dockerfile` hardcoded old version `dist/autodev_ai-0.1.0-*.whl`
+     (changed to glob `dist/autodev_ai-*.whl`)
+
+### Added
+- Security R4: `secret_redaction.py` masks pypi/anthropic/openai/github/slack
+  tokens + PEM blocks in executor stdout/stderr/logs (idempotent, preserves
+  first 4 chars for debuggability)
+- Security R4: MCP `path_safety.py` preflight validator rejects `.env`,
+  `credentials.json`, `*.pem`, `*.key`, secret-in-basename, path traversal
+  in 6 MCP handlers (scan / deliver_project / run_issue / report /
+  release_check / list_runs)
+- Security R4: branch-name injection rejection (11 patterns: `$()`, backtick,
+  `;`, `&&`, `||`, `|`, `>`, `<`, newline, leading `-`, whitespace) in
+  `worker_isolator` + propagated to `git_adapter` push/checkout/create_branch
+- Security R4: MCP `_validate_required_params` pre-dispatch JSON-Schema check
+  (returns `-32602 Invalid params` if required field missing)
+- R3: `AUTODEV_MCP_ALLOW_APPLY` and `AUTODEV_MCP_AUDIT_LOG` env vars
+- `docs/configuration.md` — environment + TOML reference
+- `docs/troubleshooting.md` — 12-scenario guide
+- `CHANGELOG.md` — this file
+- `scripts/coverage_gate.py` — 3-threshold coverage gate (overall 80 /
+  release 85 / security 90)
+
+### Removed
+- All 10 `pytest.mark.xfail(strict=True)` markers — each closed by a real
+  code fix (not annotation-only). See
+  `docs/validation/autodev_r4_xfail_ledger.{md,json}`.
+
+### Internal
+- Tests: 1062 → 1308 (+246 over 4 hardening rounds)
+- Coverage: 79% → 80.5% line+branch
+- 5 release-readiness rounds documented:
+  R1 release hardening · R2 PyPI blocker closure · R3 PyPI RC final
+  hardening · RC publish prep · R4 security xfail closure
+
+---
+
+## [0.1.0a1] — 2026-05-14 (Pre-Release, superseded by 0.1.0a2)
+
+### Added
+
+#### Core agent pipeline
+- CrewAI multi-agent base: 12-agent graph from `InputClassifier` through
+  `ReleaseManager` covering PRD, architecture, milestones, tasks, quality gates,
+  security review, verification, and doc writing.
+- Full audit-trail artifact tree written under
+  `<repo>/.dev-factory/runs/<run_id>/` (input / product / architecture /
+  planning / execution / quality / verification / delivery).
+- Run state machine: `draft → running → paused → done | failed`; runs are
+  resumable (`continue-run`) and replayable (`replay`).
+
+#### Multi-CLI executor router
+- `ExecutorRouter` — the single entry point for all CLI traffic; routes tasks
+  to Codex CLI, Claude Code CLI, or mock executor based on task type, risk
+  level, and file count.
+- `CodexCliExecutor` — wraps `codex` binary, passes SAFETY BOUNDARY prompt,
+  parses JSONL `--json` output into `CodexInnerStep` records.
+- `ClaudeCodeExecutor` — wraps `claude` binary for architecture, security,
+  long-context refactors, release roll-ups.
+- `MockExecutor` / `MockCodexExecutor` — deterministic stand-ins that produce
+  realistic artifacts without API keys; engaged automatically when both CLIs are
+  absent or via `--allow-mock-executor true`.
+- Executor selection: `--executor codex|claude|auto|mock`; `auto` (default)
+  picks the best CLI per task type.
+
+#### A2A protocol and roundtable
+- A2A HTTP transport with SSRF guard: blocks RFC-1918 / loopback addresses by
+  default; override with `AUTODEV_A2A_ALLOW_PRIVATE_NETWORKS=1` (test-only).
+- Bearer-auth via `AUTODEV_A2A_TOKEN` environment variable.
+- `AgentRoster` with persistent JSON file at `~/.autodev/a2a-roster.json`.
+- `autodev a2a-serve` — JSON-RPC 2.0 HTTP server accepting tasks from external
+  agents on a configurable port.
+- `autodev a2a-register` / `autodev a2a-call` — register a remote card and
+  dispatch tasks.
+- `autodev roundtable` (party mode) — recruit N specialist agents by skill,
+  collect independent analyses, synthesize into a consensus report.
+
+#### MCP server (9 tools)
+- `autodev mcp-serve` — JSON-RPC 2.0 MCP server over stdio; compatible with
+  Claude Desktop and Claude Code.
+- Tools: `scan`, `classify_input`, `create_prd`, `deliver_project`,
+  `run_issue`, `report`, `roundtable`, `release_check`, `list_runs`.
+- Apply-mode gate: `mode=apply` requires both `allow_apply=true` in the request
+  **and** `AUTODEV_MCP_ALLOW_APPLY=1` in the server environment.
+- Audit log: every tool invocation appended to `AUTODEV_MCP_AUDIT_LOG` file
+  when the env var is set.
+
+#### BMAD sprint mode
+- `autodev sprint-start` / `sprint-status` / `sprint-retro` / `sprint-correct`
+  — open, monitor, close, and course-correct multi-week sprints.
+- BMAD-Sally UX workflow via `autodev design-ux`.
+
+#### Configuration
+- `ConfigStack` — 4-layer TOML deep-merge: user-global →
+  project-team → project-user → runtime; array-of-tables merging by `code/id`
+  key.
+- `FACTORY_FORCE_MOCK=1` — forces deterministic mock across all executors and
+  agents.
+- `FACTORY_LOG` — sets log level (default `INFO`).
+
+#### CLI surface
+- 35 CLI subcommands via Typer; every command is fully documented with
+  `--help`.
+- Shell safety: blocks `rm -rf`, `sudo`, `cat .env`, `curl | bash`, etc. in all
+  executor modes.
+
+#### R1 audit + R2 P0 hardening
+- R1 documentation audit: identified CHANGELOG, configuration, and
+  troubleshooting as missing docs; recorded in
+  `docs/validation/autodev_documentation_onboarding_audit.md`.
+- R2 P0 closure: SSRF guard on A2A HTTP transport; HMAC-signed MCP audit log
+  entries; `AUTODEV_A2A_ALLOW_PRIVATE_NETWORKS` env var; recorded in
+  `docs/validation/autodev_r2_*`.
+
+### Notes
+- PyPI not yet published; install from the GitHub Release wheel or source.
+  See [README § Install](README.md#install).
+- `pip install --upgrade autodev-ai==0.1.0a1` requires the `--pre` flag
+  because `0.1.0a1` is a pre-release version marker.
+- Homebrew tap formula is blocked until the PyPI `0.1.0a1` sha256 is available
+  after the first `twine upload`.
+- Docker image `ghcr.io/merchloubna70-dot/autodev-ai:0.1.0-alpha` ships Codex
+  CLI and Claude Code CLI pre-installed; ~2 GB compressed.
+
+[Unreleased]: https://github.com/merchloubna70-dot/autodev-ai/compare/v0.1.0-alpha...HEAD
+[0.1.0a1]: https://github.com/merchloubna70-dot/autodev-ai/releases/tag/v0.1.0-alpha

autodev_ai-0.1.0a2/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 autodev-ai contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.