booking-agent-cli 0.2.0__tar.gz → 0.3.0__tar.gz

{booking_agent_cli-0.2.0 → booking_agent_cli-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: booking-agent-cli
-Version: 0.2.0
+Version: 0.3.0
 Summary: The Booking Agent CLI: a stateful USP booking flow with hard gates, plus its USP protocol library.
 Project-URL: Homepage, https://github.com/wix/booking-agent
 Project-URL: Documentation, https://github.com/wix/booking-agent/blob/master/booking-agent/README.md
@@ -27,6 +27,7 @@ Requires-Dist: click>=8.2
 Requires-Dist: cryptography>=42.0
 Requires-Dist: httpx>=0.27
 Requires-Dist: pydantic>=2.6
+Requires-Dist: pypi-attestations>=0.0.30
 Requires-Dist: python-dotenv>=1.0
 Requires-Dist: rich>=13.7
 Requires-Dist: starlette>=0.37
@@ -63,6 +64,12 @@ pipx install booking-agent-cli
 booking-agent --help
 ```
 
+Every release carries a PEP 740 attestation from the `wix/booking-agent` release
+workflow. Check a downloaded wheel with
+`uvx pypi-attestations verify pypi --repository https://github.com/wix/booking-agent <wheel>`.
+`booking-agent update` installs only verified wheels, and the CLI checks its own installed
+files against the attested release before it books or pays.
+
 Agents use the CLI through the Booking Agent skill:
 https://raw.githubusercontent.com/wix/booking-agent/master/booking-agent/skills/booking-agent/SKILL.md
 

{booking_agent_cli-0.2.0 → booking_agent_cli-0.3.0}/README.md

@@ -22,6 +22,12 @@ pipx install booking-agent-cli
 booking-agent --help
 ```
 
+Every release carries a PEP 740 attestation from the `wix/booking-agent` release
+workflow. Check a downloaded wheel with
+`uvx pypi-attestations verify pypi --repository https://github.com/wix/booking-agent <wheel>`.
+`booking-agent update` installs only verified wheels, and the CLI checks its own installed
+files against the attested release before it books or pays.
+
 Agents use the CLI through the Booking Agent skill:
 https://raw.githubusercontent.com/wix/booking-agent/master/booking-agent/skills/booking-agent/SKILL.md
 

{booking_agent_cli-0.2.0 → booking_agent_cli-0.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "booking-agent-cli"
-version = "0.2.0"
+version = "0.3.0"
 description = "The Booking Agent CLI: a stateful USP booking flow with hard gates, plus its USP protocol library."
 readme = "README.md"
 license = "Apache-2.0"
@@ -28,6 +28,8 @@ dependencies = [
     "cryptography>=42.0",
     "httpx>=0.27",
     "pydantic>=2.6",
+    # PEP 740 provenance checks before an update installs and on first run (provenance.py).
+    "pypi-attestations>=0.0.30",
     "python-dotenv>=1.0",
     "rich>=13.7",
     "starlette>=0.37",

{booking_agent_cli-0.2.0 → booking_agent_cli-0.3.0}/src/booking_agent/__init__.py

@@ -3,4 +3,4 @@
 Ships in the booking-agent-cli wheel and never imports ``booking_agent_cli``.
 """
 
-__version__ = "0.2.0"
+__version__ = "0.3.0"

{booking_agent_cli-0.2.0 → booking_agent_cli-0.3.0}/src/booking_agent_cli/SKILL.md

@@ -1,5 +1,5 @@
 ---
-version: 0.48.0
+version: 0.49.0
 name: booking-agent
 description: |
   Books time-based services via USP from a Link wallet. Use when the user wants to book, schedule, reserve, or pay for a service from a business (haircut, lesson, repair, class, appointment, consult). The `booking-agent` CLI owns the booking state machine and refuses to proceed when human gates are skipped. Sign the user in to Link on your own, right after install and at the start of every booking (`booking-agent flow link-auth connect`, then start `booking-agent flow link-auth poll` in the background and post the sign-in URL in the same turn, exactly like `pay poll`); never wait for the user to ask to sign in or to say they approved. After `booking-agent flow business use`, follow `next_command` through `use-ucp-checkout-mode`; businesses without native checkout fail closed. Payment uses `booking-agent flow pay request` (default returns immediately with the approval URL), then start `booking-agent flow pay poll` in the background and post the approval URL to the user in the same turn; the poll finishes checkout once they approve. Confirm through `booking-agent flow book poll --wait`; never start an inbound webhook. Surface the approval URL exactly once. Personal identification (name, phone, email, address) must always come from the user's Link account via `link-cli`, never from chat or placeholders. Before any location-based search, the CLI proposes the Link shipping address and the user confirms it or gives another; online services skip this. Talk to the user in plain everyday language only; never expose CLI, UCP, auth, session, or other implementation details unless they explicitly ask.
@@ -18,8 +18,8 @@ metadata:
         - booking-agent
         - link-cli
     install:
-      - kind: python
-        package: booking-agent-cli
+      - kind: uv
+        package: "booking-agent-cli==0.3.0"
         bins: [booking-agent]
 user-invocable: true
 ---
@@ -208,18 +208,27 @@ Only then may you use terms like CLI, UCP, or session. Keep explanations brief.
 
 ## Installing
 
-Install the `booking-agent` CLI from PyPI (package `booking-agent-cli`) with either command:
+Install the `booking-agent` CLI release this skill was written for (package `booking-agent-cli` on
+PyPI). Every release is signed by the official release workflow (PEP 740), so check the signature
+before installing:
 
 ```bash
-uv tool install booking-agent-cli
-# or
-pipx install booking-agent-cli
+dir="$HOME/.booking-agent/verified-wheels"
+uvx pip download "booking-agent-cli==0.3.0" --no-deps --only-binary :all: -d "$dir"
+uvx pypi-attestations==0.0.30 verify pypi --repository https://github.com/wix/booking-agent \
+  "$dir/booking_agent_cli-0.3.0-py3-none-any.whl"
+uv tool install --force "$dir/booking_agent_cli-0.3.0-py3-none-any.whl"
 
 booking-agent --help
 ```
 
+Install only when the verify step passes. If `uvx` is not available, install the same pinned
+release with `uv tool install booking-agent-cli==0.3.0` or `pipx install booking-agent-cli==0.3.0`;
+the CLI checks its own files against the signed release on the first `booking-agent flow init`
+and refuses to book or pay if they do not match.
+
 Harnesses that read the `install` block in this skill's metadata do this for you. If
-`booking-agent --help` still does not run, run one of the commands above yourself; if that is not
+`booking-agent --help` still does not run, run the commands above yourself; if that is not
 possible in this runtime, ask the user to install the skill, then try again. To develop the CLI from
 a checkout instead, see the [Booking Agent README](https://github.com/wix/booking-agent/blob/master/booking-agent/README.md).
 
@@ -252,7 +261,7 @@ command. Do not tell the user about it. If it fails, continue the booking withou
 
 The CLI decides whether a newer version is worth mentioning; you never decide from version
 numbers or release pages. Pass this skill's version on every `flow init` (`--skill-version
-0.48.0`, from the frontmatter above), so the CLI can tell when these instructions and the
+0.49.0`, from the frontmatter above), so the CLI can tell when these instructions and the
 installed CLI no longer match.
 
 - When a command returns `awaiting_user: update_consent`, ask the question in `prompt` in plain
@@ -482,7 +491,7 @@ have it). Do not invent a lookup.
 **Step 1b — Create a new session:**
 
 ```bash
-booking-agent flow init --user-request "<user's exact request>" --skill-version 0.48.0
+booking-agent flow init --user-request "<user's exact request>" --skill-version 0.49.0
 ```
 
 Add `--capability <name>` once for each part of the request that clearly needs it: `calendar`
@@ -1129,7 +1138,7 @@ booking-agent flow calendar create-event
 Once the user has been told they are booked (and after Step 8 when it ran), run:
 
 ```bash
-booking-agent update check --after-booking --skill-version 0.48.0
+booking-agent update check --after-booking --skill-version 0.49.0
 ```
 
 If it returns `awaiting_user: update_consent`, ask once, as in [Updates](#updates-only-with-the-users-yes).
@@ -1247,7 +1256,8 @@ recover.
 | `session_store_too_new` | Saved bookings on this device were written by a newer version of the assistant | Run `next_command` (`booking-agent update check`) and follow it; never delete or edit the saved state |
 | `update_not_confirmed` | `update` ran without `--user-confirmed` | Ask the user first; pass `--user-confirmed` only after they agree |
 | `update_session_in_progress` | `update` ran while a booking is unfinished | Finish or cancel the booking first, then offer the update again |
-| `update_failed` / `update_not_verified` | The update did not install or did not start | Tell the user the update did not take; carry on with the installed version |
+| `update_failed` / `update_not_verified` | The update did not install, did not start, or could not be shown to come from the official release (`data.reason`); nothing unverified is installed | Tell the user the update did not take; carry on with the installed version |
+| `installation_unverified` | The installed CLI files do not match the signed official release, so it will not book or pay | Tell the user in plain words the assistant needs reinstalling; run `data.reinstall_command` only with their yes, then start the booking again. Never book another way |
 | `skill_output_refused` | `skill print --output` named a file that is not the loaded skill | Follow `data.skill_text` from `booking-agent skill print` instead |
 
 ### Notes to the assistant team

{booking_agent_cli-0.2.0 → booking_agent_cli-0.3.0}/src/booking_agent_cli/__init__.py

@@ -1,3 +1,3 @@
 """booking_agent_cli: typer-based stateful CLI for USP booking flows."""
 
-__version__ = "0.2.0"
+__version__ = "0.3.0"

{booking_agent_cli-0.2.0 → booking_agent_cli-0.3.0}/src/booking_agent_cli/commands/flow.py

@@ -137,6 +137,7 @@ from ..runtime import (
     resolve_backend,
     resolve_calendar_service,
 )
+from .. import install_integrity
 from .. import reschedule as reschedule_rules
 from .. import timezone_context as tz_context
 from ..activity_log import record_command
@@ -310,6 +311,19 @@ def _emit_booking_create_error(
     return typer.Exit(code=1)
 
 
+def _require_verified_installation(store: Any, phase: str) -> None:
+    """Refuse to go on when the installed files do not match the attested release."""
+    failure = install_integrity.check(store)
+    if failure is not None:
+        emit_error(
+            phase,
+            code=install_integrity.CODE,
+            message=install_integrity.error_message(),
+            data=install_integrity.error_data(failure),
+        )
+        raise typer.Exit(code=1)
+
+
 # ---------------------------------------------------------------------------
 # init / status
 # ---------------------------------------------------------------------------
@@ -346,6 +360,8 @@ def init(
         )
         raise typer.Exit(code=1)
 
+    _require_verified_installation(store, "INIT")
+
     gate = _update_gate(user_request, skill_version, capability or [], allow_duplicate)
     if gate is not None:
         emit(gate)
@@ -4300,6 +4316,8 @@ def book(
             require_buyer_from_link_cli(session)
     except GateError as e:
         raise _handle_gate(session, e)
+    if not dry_run:
+        _require_verified_installation(load_store(), "BOOKED")
 
     backend = resolve_backend()
 
@@ -4533,6 +4551,11 @@ def book(
 pay_app = typer.Typer(help="Link spend approval and UCP checkout completion.")
 app.add_typer(pay_app, name="pay")
 
+
+@pay_app.callback()
+def _pay_requires_verified_installation() -> None:
+    _require_verified_installation(load_store(), "PAYMENT_PENDING")
+
 _REBOOK_MSG = (
     "Run `booking-agent flow pay rebook --service-id <id>` to create a fresh checkout, "
     "then retry payment."

{booking_agent_cli-0.2.0 → booking_agent_cli-0.3.0}/src/booking_agent_cli/commands/update.py

@@ -6,13 +6,14 @@ import os
 import shutil
 import subprocess
 import sys
+import tempfile
 from pathlib import Path
 from typing import List, Optional, Tuple
 
 import typer
 
 from .. import __version__ as CLI_VERSION
-from .. import updates
+from .. import provenance, updates
 from ..output import AgentOutput, emit, emit_error
 from ..session import (
     TERMINAL_PHASES,
@@ -31,6 +32,7 @@ DECLINE_COMMAND = "booking-agent update decline --prompt-key"
 SKILL_PRINT_COMMAND = "booking-agent skill print"
 INSTALL_TIMEOUT_SECONDS = 600
 VERIFY_TIMEOUT_SECONDS = 60
+VERIFIED_WHEELS_DIR = "verified-wheels"
 _MAX_ANSWERED = 50
 
 
@@ -313,6 +315,22 @@ def update(
         ))
         return
 
+    try:
+        wheel = verified_wheel(target.cli_version)
+    except provenance.ProvenanceError as exc:
+        emit_error(
+            "UPDATE",
+            code="update_not_verified",
+            message=(
+                "The update could not be shown to come from the official Booking Agent "
+                "release, so nothing was installed. Tell the user in plain words that the "
+                "update was not installed, and carry on with the installed version."
+            ),
+            data={"target_version": target.cli_version, "reason": exc.reason, "detail": exc.message},
+        )
+        raise typer.Exit(code=1)
+
+    commands = install_commands(target.cli_version, newest=target.key == newest, wheel=wheel)
     ok, detail = _run(commands[installer], timeout=INSTALL_TIMEOUT_SECONDS)
     if not ok:
         emit_error(
@@ -340,6 +358,7 @@ def update(
         )
         raise typer.Exit(code=1)
 
+    _drop_other_wheels(wheel)
     _remember(store, f"release:{target.cli_version}")
     emit(AgentOutput(
         phase="UPDATE",
@@ -370,19 +389,31 @@ def _remember(store, key: Optional[str]) -> None:
 
 
 def is_editable_install() -> bool:
-    try:
-        from importlib.metadata import distribution
+    return provenance.install_source() == provenance.INSTALL_EDITABLE
 
-        raw = distribution(PACKAGE).read_text("direct_url.json")
-    except Exception:
-        return False
-    if not raw:
-        return False
-    try:
-        info = json.loads(raw)
-    except ValueError:
-        return False
-    return bool((info.get("dir_info") or {}).get("editable"))
+
+def verified_wheel(version: str) -> Path:
+    """The PyPI wheel for ``version``, kept only once its PEP 740 provenance verifies.
+
+    It stays under the booking-agent home because uv and pipx record the file they
+    installed from.
+    """
+    from booking_agent import settings
+    from booking_agent.secure_file import ensure_private_dir
+
+    folder = settings.booking_agent_home() / VERIFIED_WHEELS_DIR
+    ensure_private_dir(folder)
+    with tempfile.TemporaryDirectory(dir=folder) as tmp:
+        downloaded = provenance.download_verified_wheel(version, Path(tmp))
+        wheel = folder / downloaded.name
+        os.replace(downloaded, wheel)
+    return wheel
+
+
+def _drop_other_wheels(keep: Path) -> None:
+    for old in keep.parent.glob("*.whl"):
+        if old != keep:
+            old.unlink(missing_ok=True)
 
 
 def detect_installer() -> Optional[str]:
@@ -397,9 +428,16 @@ def detect_installer() -> Optional[str]:
     return None
 
 
-def install_commands(version: str, *, newest: bool) -> dict:
-    # ">=" leaves later upgrades free; "==" holds back a newer release that is not ready.
-    spec = f"{PACKAGE}>={version}" if newest else f"{PACKAGE}=={version}"
+def install_commands(version: str, *, newest: bool, wheel: Optional[Path] = None) -> dict:
+    """Install the verified ``wheel`` itself, so nothing is resolved from the index again.
+
+    Without a wheel (commands shown to the user to run by hand): ">=" leaves later
+    upgrades free; "==" holds back a newer release that is not ready.
+    """
+    if wheel is not None:
+        spec = str(wheel)
+    else:
+        spec = f"{PACKAGE}>={version}" if newest else f"{PACKAGE}=={version}"
     return {
         "uv": ["uv", "tool", "install", "--force", spec],
         "pipx": ["pipx", "install", "--force", spec],

booking_agent_cli-0.3.0/src/booking_agent_cli/install_integrity.py

@@ -0,0 +1,68 @@
+"""Whether this installation may book and take payments: the first-run provenance check.
+
+The first ``flow init`` after an install or update checks the installed files against
+the attested release (``provenance.verify_installed``) and remembers the outcome for
+that exact installation (its ``RECORD`` fingerprint). A mismatch is remembered too, so
+``flow book`` and every ``flow pay`` command refuse until the CLI is reinstalled. A
+failure to reach PyPI decides nothing and is retried on the next check.
+"""
+from __future__ import annotations
+
+from typing import Any, Dict, Optional
+
+from . import __version__ as CLI_VERSION
+from . import provenance
+
+CODE = "installation_unverified"
+
+
+def _same_install(record: Any, fingerprint: Optional[str]) -> bool:
+    return (
+        isinstance(record, dict)
+        and record.get("version") == CLI_VERSION
+        and record.get("record_sha256") == fingerprint
+    )
+
+
+def check(store: Any) -> Optional[Dict[str, Any]]:
+    """The recorded failure for this installation, or None when it may proceed."""
+    from .session import save_store
+
+    fingerprint = provenance.installed_fingerprint()
+    if _same_install(store.install_integrity_failure, fingerprint):
+        return store.install_integrity_failure
+    if _same_install(store.install_verified, fingerprint):
+        return None
+    result = provenance.verify_installed()
+    if result.skipped is not None or result.transient:
+        return None
+    if result.ok:
+        store.install_verified = {"version": CLI_VERSION, "record_sha256": fingerprint}
+        store.install_integrity_failure = None
+    else:
+        store.install_integrity_failure = {
+            "version": CLI_VERSION,
+            "record_sha256": fingerprint,
+            "reason": result.reason,
+            "detail": result.message,
+        }
+    save_store(store)
+    return store.install_integrity_failure
+
+
+def error_message() -> str:
+    return (
+        "The booking assistant installed on this device does not match the official "
+        "release, so it will not book or take payments. Tell the user in plain words that "
+        "the assistant needs to be reinstalled before it can book, and reinstall it only "
+        "with their yes, by running data.reinstall_command. Do not try to book another way."
+    )
+
+
+def error_data(failure: Dict[str, Any]) -> Dict[str, Any]:
+    return {
+        "reason": failure.get("reason"),
+        "detail": failure.get("detail"),
+        "installed_version": CLI_VERSION,
+        "reinstall_command": provenance.reinstall_command(),
+    }