bantamkit 0.35.7__tar.gz → 0.35.9__tar.gz

{bantamkit-0.35.7 → bantamkit-0.35.9}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: bantamkit
-Version: 0.35.7
+Version: 0.35.9
 Summary: Memory MCP server for Claude Code, Cursor, VS Code Copilot and Claude Desktop, plus a Python library that lifts small-model agents. Install once, run offline.
 Project-URL: Homepage, https://github.com/Ink01101011/bantamkit
 Project-URL: Repository, https://github.com/Ink01101011/bantamkit
@@ -103,9 +103,9 @@ CPU architecture and Python minor version** (some wheels, such as `pydantic_core
 one platform only), copy `wheels/` across, and install from it:
 
 ```bash
-python -m pip download "bantamkit[mcp]==0.35.7" -d wheels
+python -m pip download "bantamkit[mcp]==0.35.9" -d wheels
 python -m venv <env>
-<env>/bin/pip install --no-index --find-links wheels "bantamkit[mcp]==0.35.7"
+<env>/bin/pip install --no-index --find-links wheels "bantamkit[mcp]==0.35.9"
 <env>/bin/bantamkit-mcp --install cursor
 ```
 

{bantamkit-0.35.7 → bantamkit-0.35.9}/README.md

@@ -74,9 +74,9 @@ CPU architecture and Python minor version** (some wheels, such as `pydantic_core
 one platform only), copy `wheels/` across, and install from it:
 
 ```bash
-python -m pip download "bantamkit[mcp]==0.35.7" -d wheels
+python -m pip download "bantamkit[mcp]==0.35.9" -d wheels
 python -m venv <env>
-<env>/bin/pip install --no-index --find-links wheels "bantamkit[mcp]==0.35.7"
+<env>/bin/pip install --no-index --find-links wheels "bantamkit[mcp]==0.35.9"
 <env>/bin/bantamkit-mcp --install cursor
 ```
 

{bantamkit-0.35.7 → bantamkit-0.35.9}/_assets/tools/memory_compact.json

@@ -10,8 +10,7 @@
     "properties": {
       "reserve": {
         "type": "integer",
-        "minimum": 0,
-        "description": "Bytes of index headroom to free below the budget. Omit for the default: the size of the largest index line the store holds, capped at half the budget."
+        "description": "Bytes of index headroom to free below the budget: the target is `budget - reserve`, a negative value counts as 0, any value is capped at half the budget, and 0 compacts to the budget itself. Omit for the default: the room the degraded-index warning demands (the budget minus `(90 * budget - 1) // 100`) plus the size of the largest index line the store holds -- at the default 24000-byte budget with a 39-byte largest line that is 2401 + 39 = 2440, a 21560-byte target."
       }
     }
   },

{bantamkit-0.35.7 → bantamkit-0.35.9}/_assets/tools/memory_recall.json

@@ -17,9 +17,7 @@
       },
       "k": {
         "type": "integer",
-        "minimum": 1,
-        "maximum": 5,
-        "description": "Facts wanted. Raised to the store default of 3 when smaller; never lowered below it."
+        "description": "Facts wanted, clamped to 1..5. Raised to the store default of 3 when smaller; never lowered below it."
       }
     }
   },

bantamkit-0.35.9/_assets/tools/shiftwork_clock_in.json

@@ -0,0 +1,37 @@
+{
+  "name": "shiftwork_clock_in",
+  "description": "Shift-work clock-in: schema-validate the checkpoint file and return the brief for the unit at plan.cursor — {unit, role, invariants, handoff, do_not, files} — to hand to the spawned agent verbatim. The unit briefed is the one at plan.cursor, or, when unit_id is given, that unit — either way it must appear in shiftwork_plan's `ready`, the batch the dependency graph says may run now: the cursor unit is held to the same ready test as unit_id. A unit that is not ready (a done or dropped cursor, a cursor whose dependencies have not run, a unit_id naming no unit) is refused with {\"result\": \"error\", \"reason\": \"unit <id> is not ready; ready is <a, b>\"}, and on both paths the refusals of the batch view itself (cycle, unknown dependency, unreadable checkpoint) pass through verbatim; a cursor naming no unit still escalates. Clock-in still never moves plan.cursor; clock_out does. Structured refusals, never exceptions: result=escalate when handoff.open_questions is non-empty, result=success when every unit is done or dropped, result=error when the checkpoint fails validation. Clock-in also WRITES: on result=brief, and only then, it appends one line {event: brief, ts, unit, role} to <checkpoint>.log.jsonl — best-effort: a log it cannot write costs the brief nothing (the brief still returns, no error, only the record is lost). clock_out reads those lines back to write `briefed` on every accounting line, so the ledger is no longer one line per clock-out; a brief line carries `event` and no `status`. See docs/shiftwork.md.",
+  "surfaces": [
+    "mcp"
+  ],
+  "parameters": {
+    "properties": {
+      "checkpoint": {
+        "title": "Checkpoint",
+        "type": "string"
+      },
+      "unit_id": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "title": "Unit Id"
+      }
+    },
+    "required": [
+      "checkpoint"
+    ],
+    "type": "object",
+    "title": "shiftwork_clock_inArguments"
+  },
+  "output_schema": {
+    "type": "object",
+    "additionalProperties": true,
+    "title": "shiftwork_clock_inDictOutput"
+  }
+}

{bantamkit-0.35.7 → bantamkit-0.35.9}/_assets/tools/shiftwork_clock_out.json

@@ -87,7 +87,7 @@
         "anyOf": [
           {
             "type": "object",
-            "description": "Per-unit cost. Written verbatim, beside ts/unit/role/status, as one line of <checkpoint>.log.jsonl - the ledger the N-sessions experiment reads. The keys named here have fixed meanings so a reader holding only the ledger knows what each number counts, in which unit, and which model produced it; any other key passes through unchanged (a refused key is friction, not safety). Lines written before this schema existed may spell these differently; the schema governs new writes only.",
+            "description": "Per-unit cost. Written verbatim, beside ts/unit/role/status, as one line of <checkpoint>.log.jsonl - the ledger the N-sessions experiment reads. The keys named here have fixed meanings so a reader holding only the ledger knows what each number counts, in which unit, and which model produced it; any other key passes through unchanged, except the five the runtime writes itself — unit, role, status, ts, event — which are refused (result=error) before anything is written; a self-reported briefed is overwritten, not refused. Lines written before this schema existed may spell these differently; the schema governs new writes only.",
             "properties": {
               "tokens": {
                 "type": "integer",

{bantamkit-0.35.7 → bantamkit-0.35.9}/_assets/tools/validate_json.json

@@ -1,6 +1,6 @@
 {
   "name": "validate_json",
-  "description": "Validate candidate output text against a JSON Schema. Returns {valid, feedback}; when invalid, feed the feedback back to the model and retry.",
+  "description": "Validate candidate output text against a JSON Schema. Returns {valid, feedback}; when invalid, feed the feedback back to the model and retry. The output may be any JSON value; otherwise the first fenced block, or the first object or array in the text, is used. $schema selects draft-04, draft-06, draft-07, 2019-09 or 2020-12 (default); $ref resolves only inside the one schema (\"#\", \"#/...\", \"#name\"), so a remote reference or an embedded $id is refused. pattern is Python re syntax, without inline flags, look-behind, backreferences, atomic or possessive groups, conditional groups or \\N{...}; a document's patterns get 500 ms in total.",
   "surfaces": [
     "mcp"
   ],

bantamkit-0.35.9/_assets/tools/work_plan.json

@@ -0,0 +1,55 @@
+{
+  "name": "work_plan",
+  "description": "Work plan: turn a dependency graph into the batches that may run in parallel. Takes `nodes`, each `{id, depends_on, priority}` — `depends_on` absent or null means none, `priority` defaults to 0 — and answers `{\"result\": \"plan\", \"batches\", \"sequence\", \"width\"}`: batch k holds every node whose dependencies all appear in batches below k, `sequence` is those batches flattened in order, and `width` is the largest batch length — the widest fan-out, which is the number an orchestrator needs to decide whether it can afford the batch. Order inside a batch is priority descending, then the order the nodes were given; both halves are contract, because determinism inside a batch is what two implementations are held to. Empty `nodes` is an ANSWER, not a refusal: no batches, no sequence, width 0. Four refusals, checked in this order and one sentence each: `nodes[<i>].<field> must be ...` for a node whose `id` is not a string, whose `depends_on` is not a list of strings or whose `priority` is not an integer (named by position, never coerced), `duplicate node id <id>`, `node <id> depends on <dep>, which no node declares`, and `the graph has a cycle: <a> -> <b> -> <a>`. It reports what the graph permits and decides nothing about what may actually be dispatched together — `depends_on` encodes logical order, not file contention, so a batch this tool calls parallel may still hold work that writes one file. Pure computation over the nodes it was handed: it opens no file and takes no path. Never mutates.",
+  "surfaces": [
+    "mcp"
+  ],
+  "parameters": {
+    "properties": {
+      "nodes": {
+        "title": "Nodes",
+        "type": "array",
+        "items": {
+          "type": "object",
+          "properties": {
+            "id": {
+              "type": "string",
+              "description": "The node's identifier, unique across `nodes`"
+            },
+            "depends_on": {
+              "anyOf": [
+                {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Ids this node waits for; every one of them must be declared by some node. Optional: absent or null means none"
+            },
+            "priority": {
+              "type": "integer",
+              "description": "Tie-break inside a batch, descending. Optional; 0 when absent"
+            }
+          },
+          "required": [
+            "id"
+          ]
+        }
+      }
+    },
+    "required": [
+      "nodes"
+    ],
+    "type": "object",
+    "title": "work_planArguments"
+  },
+  "output_schema": {
+    "type": "object",
+    "additionalProperties": true,
+    "title": "work_planDictOutput"
+  }
+}

{bantamkit-0.35.7 → bantamkit-0.35.9}/src/bantamkit/__init__.py

@@ -29,4 +29,4 @@ from bantamkit.structured import StructuredOutputError, extract_json, structured
 # file as its dynamic version source, so the wheel's metadata and the string the MCP
 # server advertises are the same committed bytes, and neither is a function of when
 # someone last ran `pip`.
-__version__ = "0.35.7"
+__version__ = "0.35.9"

{bantamkit-0.35.7 → bantamkit-0.35.9}/src/bantamkit/assets.py

@@ -26,6 +26,32 @@ def assets_root() -> Path:
     raise AssetNotFound("no assets directory found; set BANTAMKIT_ASSETS")
 
 
+def _asset_path(kind: str, name: str, ext: str) -> Path:
+    """job66/#145: the one path every loader below builds, and the containment check on it.
+
+    `name` is a BARE asset name (`memory`, `shiftwork-checkpoint`, `memory_recall`) and
+    nothing else. Before this, each loader joined `name` under its directory verbatim, so a
+    caller passing user input could read any `.json`/`.md` on disk through `..`. A name
+    holding a path separator (`/` or `\\`, either platform's), `..`, a drive colon or a NUL
+    is refused BEFORE any filesystem access, and the joined path is then checked LEXICALLY
+    (`os.path.abspath`, not `resolve()`: a pack may be a symlink farm, and the check is about
+    the name) to sit directly inside `<root>/<kind>s/`. On Windows `Path("tools") / "C:x"`
+    is drive-relative and leaves the pack, which is what the colon refusal and the lexical
+    check close. The refusal is an `AssetNotFound`, so the MCP resource handler's existing
+    `unknown skill asset: <name>` answer is unchanged. `runtime-ts/src/assets.ts::assetPath`
+    raises the same sentence.
+    """
+    directory = assets_root() / f"{kind}s"
+    path = directory / f"{name}{ext}"
+    if (
+        any(c in name for c in "/\\:\0")
+        or ".." in name
+        or os.path.dirname(os.path.abspath(path)) != os.path.abspath(directory)
+    ):
+        raise AssetNotFound(f"{kind} asset name is not a bare name: {name}")
+    return path
+
+
 def load_tool_asset(name: str) -> dict:
     """Return one tool asset VERBATIM — every key, including the ones no surface uses.
 
@@ -34,7 +60,7 @@ def load_tool_asset(name: str) -> dict:
     register this at all?) and `output_schema` (what do I advertise as the return shape?)
     and neither belongs on the agent-facing `Tool`.
     """
-    path = assets_root() / "tools" / f"{name}.json"
+    path = _asset_path("tool", name, ".json")
     if not path.exists():
         raise AssetNotFound(f"tool asset not found: {path}")
     return json.loads(path.read_text(encoding="utf-8"))
@@ -54,14 +80,14 @@ def load_tool(name: str) -> Tool:
 
 def load_schema(name: str) -> dict:
     """Return a JSON Schema asset (parsed) — e.g. the shift-work checkpoint contract."""
-    path = assets_root() / "schemas" / f"{name}.json"
+    path = _asset_path("schema", name, ".json")
     if not path.exists():
         raise AssetNotFound(f"schema asset not found: {path}")
     return json.loads(path.read_text(encoding="utf-8"))
 
 
 def load_skill(name: str) -> str:
-    path = assets_root() / "skills" / f"{name}.md"
+    path = _asset_path("skill", name, ".md")
     if not path.exists():
         raise AssetNotFound(f"skill asset not found: {path}")
     return path.read_text(encoding="utf-8")