brindle 0.3.11__tar.gz → 0.3.12__tar.gz

{brindle-0.3.11 → brindle-0.3.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: brindle
-Version: 0.3.11
+Version: 0.3.12
 Summary: Run coding agents in parallel, each on its own git branch, with a supervisor that delegates, reviews, and merges
 Project-URL: Homepage, https://pawdelta.com/brindle/
 Project-URL: Documentation, https://pawdelta.com/brindle/docs/recommended-use
@@ -94,7 +94,7 @@ uv tool install --editable ~/Projects/brindle   # or from a local checkout
 brindle drives Claude Code, so you need that too (`npm install -g @anthropic-ai/claude-code`).
 
 `brindle --version` prints the installed version; the tmux status bar of every brindle
-session shows it too (`brindle 0.3.11`). A session started before an upgrade keeps
+session shows it too (`brindle 0.3.12`). A session started before an upgrade keeps
 running the old code, and shows the old number, until you restart it.
 
 ## Quick start
@@ -1865,12 +1865,64 @@ documents its own quirks (no prompt caching on most, smaller context windows),
 so prefer the native provider for open-weight models and keep this route for
 Claude itself behind a gateway.
 
+To run workers on your own Bedrock, Vertex, Codex or Antigravity account, see
+[Running workers on your own cloud](#running-workers-on-your-own-cloud) below.
+
 Codex agents report status through Codex's `notify` hook (brindle passes
 `-c notify=[...]` at launch, leaving your own Codex config alone): a completed turn
 marks the agent idle and delivers any queued message. Codex has no Stop hook, so for
 an autopilot supervisor on Codex that turn end is also where brindle tells it to keep
 going, with the same limit on reminders as Claude Code.
 
+### Running workers on your own cloud
+
+Any brindle user, free tier included, can run a worker's model on their own cloud
+account. A profile's `env.NAME: value` lines are set in the agent's environment
+before brindle's own variables, so the profile decides which backend the worker
+uses. Profiles live in `.brindle/agents/` in the repo, or in your user profiles
+folder; `brindle profile new` writes one.
+
+```markdown
+---
+name: developer-bedrock
+provider: claude
+model: us.anthropic.claude-haiku-4-5-20251001-v1:0   # a Bedrock model id your account can use
+env.CLAUDE_CODE_USE_BEDROCK: 1
+env.AWS_REGION: us-east-1
+---
+```
+
+Pass `developer-bedrock` as the worker profile (`agent_profile` in `assign`), or
+list it under `routing` in `.brindle/config.json`.
+
+- **Claude Code on Bedrock.** Set `env.CLAUDE_CODE_USE_BEDROCK: 1` and
+  `env.AWS_REGION`. The worker uses the AWS credentials on this machine (an
+  `AWS_PROFILE` from `~/.aws/config`, SSO or environment keys), so sign in to AWS
+  first. See [Claude Code on Amazon Bedrock](https://code.claude.com/docs/en/amazon-bedrock).
+- **Claude Code on Vertex AI.** Set `env.CLAUDE_CODE_USE_VERTEX: 1`,
+  `env.CLOUD_ML_REGION` and `env.ANTHROPIC_VERTEX_PROJECT_ID`. The worker
+  authenticates with Application Default Credentials, so run
+  `gcloud auth application-default login` once. See
+  [Claude Code on Google Vertex AI](https://code.claude.com/docs/en/google-vertex-ai).
+- **Codex on Bedrock.** Codex picks its provider in `config.toml` in its home
+  folder (`$CODEX_HOME`, default `~/.codex`). Point that file at the
+  `amazon-bedrock` provider, as described in
+  [Codex advanced configuration](https://learn.chatgpt.com/docs/config-file/config-advanced).
+  To give one profile its own Codex home, add `env.CODEX_HOME: /path/to/home`
+  to it. Each Codex home keeps its own sign-in (`auth.json`).
+- **Google Antigravity.** `agy` can run on a Gemini API key: set
+  `"modelProvider": "gemini"` in `~/.gemini/antigravity-cli/settings.json`, and
+  export `GEMINI_API_KEY` in your shell, or put it in a profile in your user
+  profiles folder; never in a profile under `.brindle/agents/`, which is committed. For a
+  Gemini-compatible gateway, set `env.GOOGLE_GEMINI_BASE_URL` to its URL. As of
+  1.3.4, `agy` ignores Vertex AI credentials, so use a Gemini API key or gateway.
+  The full setup is in [Google Antigravity](#google-antigravity) below.
+
+If your org runs brindle for a team, its admins can set a route for everyone in
+the org's Routing settings on the brindle dashboard; an enforced org route replaces
+a profile's `env.` lines, so a profile can't move a worker off the company's route. See
+[Using your company's access](#using-your-companys-access).
+
 ### Using your company's access
 
 Two ways to run brindle's agents on your company's Claude (Bedrock, Vertex,
@@ -1908,8 +1960,8 @@ agy        # sign in with your Google account, then quit
 To run unattended workers without a browser login, `agy` (1.1.13 or newer) can use
 a Gemini API key instead: put `"modelProvider": "gemini"` in
 `~/.gemini/antigravity-cli/settings.json` and set `GEMINI_API_KEY`, in your
-environment or in a profile's `env.GEMINI_API_KEY: ...` line (keep the key out of
-the repo). The key alone does nothing: without `modelProvider`, `agy` still asks
+environment or in a profile's `env.GEMINI_API_KEY: ...` line in your user
+profiles folder (never in `.brindle/agents/`, which is committed). The key alone does nothing: without `modelProvider`, `agy` still asks
 you to sign in. `agy` takes no other key or token from the environment; its
 Google Cloud, Workforce Identity and Application Default Credentials sign-ins are
 chosen on its sign-in screen.

{brindle-0.3.11 → brindle-0.3.12}/README.md

@@ -63,7 +63,7 @@ uv tool install --editable ~/Projects/brindle   # or from a local checkout
 brindle drives Claude Code, so you need that too (`npm install -g @anthropic-ai/claude-code`).
 
 `brindle --version` prints the installed version; the tmux status bar of every brindle
-session shows it too (`brindle 0.3.11`). A session started before an upgrade keeps
+session shows it too (`brindle 0.3.12`). A session started before an upgrade keeps
 running the old code, and shows the old number, until you restart it.
 
 ## Quick start
@@ -1834,12 +1834,64 @@ documents its own quirks (no prompt caching on most, smaller context windows),
 so prefer the native provider for open-weight models and keep this route for
 Claude itself behind a gateway.
 
+To run workers on your own Bedrock, Vertex, Codex or Antigravity account, see
+[Running workers on your own cloud](#running-workers-on-your-own-cloud) below.
+
 Codex agents report status through Codex's `notify` hook (brindle passes
 `-c notify=[...]` at launch, leaving your own Codex config alone): a completed turn
 marks the agent idle and delivers any queued message. Codex has no Stop hook, so for
 an autopilot supervisor on Codex that turn end is also where brindle tells it to keep
 going, with the same limit on reminders as Claude Code.
 
+### Running workers on your own cloud
+
+Any brindle user, free tier included, can run a worker's model on their own cloud
+account. A profile's `env.NAME: value` lines are set in the agent's environment
+before brindle's own variables, so the profile decides which backend the worker
+uses. Profiles live in `.brindle/agents/` in the repo, or in your user profiles
+folder; `brindle profile new` writes one.
+
+```markdown
+---
+name: developer-bedrock
+provider: claude
+model: us.anthropic.claude-haiku-4-5-20251001-v1:0   # a Bedrock model id your account can use
+env.CLAUDE_CODE_USE_BEDROCK: 1
+env.AWS_REGION: us-east-1
+---
+```
+
+Pass `developer-bedrock` as the worker profile (`agent_profile` in `assign`), or
+list it under `routing` in `.brindle/config.json`.
+
+- **Claude Code on Bedrock.** Set `env.CLAUDE_CODE_USE_BEDROCK: 1` and
+  `env.AWS_REGION`. The worker uses the AWS credentials on this machine (an
+  `AWS_PROFILE` from `~/.aws/config`, SSO or environment keys), so sign in to AWS
+  first. See [Claude Code on Amazon Bedrock](https://code.claude.com/docs/en/amazon-bedrock).
+- **Claude Code on Vertex AI.** Set `env.CLAUDE_CODE_USE_VERTEX: 1`,
+  `env.CLOUD_ML_REGION` and `env.ANTHROPIC_VERTEX_PROJECT_ID`. The worker
+  authenticates with Application Default Credentials, so run
+  `gcloud auth application-default login` once. See
+  [Claude Code on Google Vertex AI](https://code.claude.com/docs/en/google-vertex-ai).
+- **Codex on Bedrock.** Codex picks its provider in `config.toml` in its home
+  folder (`$CODEX_HOME`, default `~/.codex`). Point that file at the
+  `amazon-bedrock` provider, as described in
+  [Codex advanced configuration](https://learn.chatgpt.com/docs/config-file/config-advanced).
+  To give one profile its own Codex home, add `env.CODEX_HOME: /path/to/home`
+  to it. Each Codex home keeps its own sign-in (`auth.json`).
+- **Google Antigravity.** `agy` can run on a Gemini API key: set
+  `"modelProvider": "gemini"` in `~/.gemini/antigravity-cli/settings.json`, and
+  export `GEMINI_API_KEY` in your shell, or put it in a profile in your user
+  profiles folder; never in a profile under `.brindle/agents/`, which is committed. For a
+  Gemini-compatible gateway, set `env.GOOGLE_GEMINI_BASE_URL` to its URL. As of
+  1.3.4, `agy` ignores Vertex AI credentials, so use a Gemini API key or gateway.
+  The full setup is in [Google Antigravity](#google-antigravity) below.
+
+If your org runs brindle for a team, its admins can set a route for everyone in
+the org's Routing settings on the brindle dashboard; an enforced org route replaces
+a profile's `env.` lines, so a profile can't move a worker off the company's route. See
+[Using your company's access](#using-your-companys-access).
+
 ### Using your company's access
 
 Two ways to run brindle's agents on your company's Claude (Bedrock, Vertex,
@@ -1877,8 +1929,8 @@ agy        # sign in with your Google account, then quit
 To run unattended workers without a browser login, `agy` (1.1.13 or newer) can use
 a Gemini API key instead: put `"modelProvider": "gemini"` in
 `~/.gemini/antigravity-cli/settings.json` and set `GEMINI_API_KEY`, in your
-environment or in a profile's `env.GEMINI_API_KEY: ...` line (keep the key out of
-the repo). The key alone does nothing: without `modelProvider`, `agy` still asks
+environment or in a profile's `env.GEMINI_API_KEY: ...` line in your user
+profiles folder (never in `.brindle/agents/`, which is committed). The key alone does nothing: without `modelProvider`, `agy` still asks
 you to sign in. `agy` takes no other key or token from the environment; its
 Google Cloud, Workforce Identity and Application Default Credentials sign-ins are
 chosen on its sign-in screen.

{brindle-0.3.11 → brindle-0.3.12}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "brindle"
-version = "0.3.11"
+version = "0.3.12"
 description = "Run coding agents in parallel, each on its own git branch, with a supervisor that delegates, reviews, and merges"
 readme = "README.md"
 requires-python = ">=3.11"

{brindle-0.3.11 → brindle-0.3.12}/src/brindle/agents.py

@@ -148,7 +148,7 @@ def worker_guidance(ws: Workspace) -> str:
         checks = load_repo_config(ws.repo_root).checks
     except ValueError:
         checks = []
-    parts = (codemap.guidance(ws.repo_root), test_guidance(checks),
+    parts = (codemap.guidance(ws), test_guidance(checks),
              PERMISSION_GUIDANCE.format(root=ws.repo_root))
     return "\n".join(p for p in parts if p)
 
@@ -379,6 +379,9 @@ def spawn(
         if plan and not prompt:
             prompt = agent.task = pilot.kickoff(plan)
             db.update_agent(agent_id, task=prompt)
+    if mode == "interactive":
+        from brindle import codemap
+        codemap.seed_session(ws.path, ws.repo_root)
     try:
         _launch(db, agent, ws, prompt=prompt, resume=None, watch_pane=watch_pane,
                 background_setup=background_setup, model_checked=True)
@@ -449,9 +452,12 @@ def _profile_for(db: DB, agent: Agent, ws: Workspace, m=_UNREAD):
     if agent.mode == "interactive":
         from brindle import codemap, repos
 
-        note = codemap.guidance(ws.repo_root)
+        note = codemap.guidance(ws)
         if note:
             profile = replace(profile, prompt=f"{profile.prompt}\n\n{note}".strip())
+        repo_map = codemap.supervisor_map(ws) if autopilot_on or agent.profile == "supervisor" else None
+        if repo_map:
+            profile = replace(profile, prompt=f"{profile.prompt}\n\n{repo_map}".strip())
         attached = repos.guidance(db, agent.id)   # a session root's attached repos
         if attached:
             profile = replace(profile, prompt=f"{profile.prompt}\n\n{attached}".strip())
@@ -831,6 +837,11 @@ def _launch(db: DB, agent: Agent, ws: Workspace, *, prompt: str | None,
         from brindle.providers import trust_folder
 
         trust_folder(ws.path)  # no trust dialog for nobody to answer
+    if provider.name == "antigravity" and m is not None and m.setup is not None and m.setup.antigravity is not None:
+        try:
+            providers.set_agy_gemini()
+        except (OSError, ValueError) as e:
+            raise AgentError(f"couldn't set Antigravity to the company Gemini route in its settings.json: {e}") from e
     argv = provider.command(LaunchContext(agent.id, profile, prompt, resume=resume, cwd=ws.path,
                                           mode=agent.mode, plan_first=bool(agent.plan_first)))
     if prompt or db.pending_count(agent.id):
@@ -1675,6 +1686,7 @@ def report_result(db: DB, agent_id: str, result: str, forward: bool = True,
     else:
         agent = get(db, agent_id)
         ws = db.get_workspace(agent.workspace_id)
+    first = agent.result is None
     db.set_result(agent.id, result)
     # Usage and history are extras: never let them stop the result arriving.
     try:
@@ -1701,6 +1713,8 @@ def report_result(db: DB, agent_id: str, result: str, forward: bool = True,
     else:
         forwarded = result
     if ws and agent.mode in ("handoff", "handoff_detached", "assign"):
+        if first:
+            pipeline.note_reported(db, ws, agent)
         warm_checks(ws)
         if forward and pipeline.on_report(db, agent, ws, forwarded):
             return ("result recorded. brindle is having your branch reviewed; it will merge it, "
@@ -2397,6 +2411,9 @@ def pre_tool_decision(db: DB, agent: Agent, payload: dict) -> dict | None:
         return None
     command = str((payload.get("tool_input") or {}).get("command", ""))
     ws = db.get_workspace(agent.workspace_id)
+    from brindle import codemap
+
+    codemap.record_query(db, agent, ws, command)
     try:
         profile = load_profile(agent.profile, ws.repo_root if ws else None)
     except Exception:

{brindle-0.3.11 → brindle-0.3.12}/src/brindle/cli.py

@@ -458,8 +458,11 @@ def _session_worktree(db: DB, ws: Workspace) -> Workspace:
     n = 2
     while git.ok(["rev-parse", "--verify", "--quiet", f"refs/heads/brindle/session-{n}"], ws.repo_root):
         n += 1
-    return workspaces.create(db, ws.repo_root, f"brindle/session-{n}", base=ws.branch or None,
+    created = workspaces.create(db, ws.repo_root, f"brindle/session-{n}", base=ws.branch or None,
                              start=git.out(["rev-parse", "HEAD"], ws.path), apply_prefix=False).workspace
+    from brindle import codemap
+    codemap.seed_session(created.path, created.repo_root)
+    return created
 
 
 def _pause_running(db: DB, ws: Workspace, stop_procs: bool = True) -> None:

{brindle-0.3.11 → brindle-0.3.12}/src/brindle/cloud_credential.py

@@ -346,7 +346,7 @@ def assume_role(sts: Sts, region: str, role_arn: str, id_token: str, now: float)
     c = claims(id_token)
     status, raw = sts(f"https://sts.{region}.amazonaws.com/", {
         "Action": "AssumeRoleWithWebIdentity", "Version": "2011-06-15", "RoleArn": role_arn,
-        "RoleSessionName": session_name(str(c.get("member") or ""), str(c.get("fid") or "")),
+        "RoleSessionName": session_name(str(c.get("member") or c.get("sub") or ""), str(c.get("fid") or "")),
         "WebIdentityToken": id_token, "DurationSeconds": str(AWS_SESSION_SECONDS)})
     leaves = _xml(raw)
     if status != 200:
@@ -432,13 +432,28 @@ def device_headers() -> dict[str, str]:
     return {"X-Brindle-Version": brindle.__version__}
 
 
+def _personal(store, client, org_id: str) -> bool:
+    """Whether ``org_id`` is the signed-in user's own org (no team org is
+    selected and the stored entitlement is for it)."""
+    from brindle.pro import license
+
+    try:
+        if (store.load() or {}).get("org_id"):
+            return False
+        ent = license.current(store=store, client=client)
+    except Exception:  # noqa: BLE001 - no usable entitlement: treat it as a team org
+        return False
+    return ent.org_id == org_id and "team" not in ent.features and ent.plan not in ("team", "enterprise")
+
+
 def _mint(client, store, org_id: str, cloud: str) -> str:
     """An ID token for ``cloud`` from PawDelta. A revoked or too-old sign-in
     signs the family out on the server, then deletes the stored credentials."""
     from brindle.pro import auth
 
+    path = "/me/federation/token" if _personal(store, client, org_id) else f"/orgs/{org_id}/federation/token"
     try:
-        status, body = auth.authed(client, store, "POST", f"/orgs/{org_id}/federation/token",
+        status, body = auth.authed(client, store, "POST", path,
                                    auth.JSONBody({"cloud": cloud}), headers=device_headers())
     except auth.AuthError as e:
         if isinstance(e, auth.TransportError):
@@ -515,7 +530,7 @@ def credential(cloud: str, org_id: str | None = None, *, client=None, store=None
                sts: Sts | None = None, now: float | None = None) -> str:
     """What ``cloud``'s hook prints (empty for Azure, which reads a file).
     Raises :class:`CredentialError` with the line to show."""
-    from brindle.pro import auth, credentials
+    from brindle.pro import auth, credentials, license
 
     if cloud not in CLOUDS:
         raise CredentialError(f"unknown cloud {cloud}")
@@ -526,11 +541,16 @@ def credential(cloud: str, org_id: str | None = None, *, client=None, store=None
         cur = {}
     if not cur.get("refresh_token"):
         raise CredentialError(LOGIN_LINE)
+    client = client or auth.Client(cur.get("base_url"))
     org_id = org_id or cur.get("org_id")
+    if not org_id:
+        try:  # a personal sign-in stores no org: use the entitlement's own
+            org_id = license.current(store=store, client=client).org_id
+        except Exception:  # noqa: BLE001 - no usable entitlement
+            pass
     if not org_id:
         raise CredentialError("no organization given; pass --org ID")
     d = org_dir(org_id, create=True)
-    client = client or auth.Client(cur.get("base_url"))
     now = time.time() if now is None else now
     with mint_lock(d):
         # Under the lock: the process that held it may have just minted.