codeframe-ai 0.9.2__tar.gz → 0.9.3__tar.gz

{codeframe_ai-0.9.2/codeframe_ai.egg-info → codeframe_ai-0.9.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codeframe-ai
-Version: 0.9.2
+Version: 0.9.3
 Summary: A project delivery system that orchestrates frontier coding agents: Think, Build, Prove, Ship.
 Author-email: Frank Bria <hello@codeframe.sh>
 License: AGPL-3.0-or-later
@@ -17,7 +17,7 @@ Classifier: Programming Language :: Python :: 3.13
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: anthropic>=0.18.0
+Requires-Dist: anthropic<1.0,>=0.18.0
 Requires-Dist: bandit>=1.8.6
 Requires-Dist: tenacity>=8.2.0
 Requires-Dist: openai>=1.12.0
@@ -50,8 +50,7 @@ Requires-Dist: pytest-json-report>=1.5.0
 Requires-Dist: hypothesis>=6.148.0
 Requires-Dist: fastapi-users[sqlalchemy]>=15.0.2
 Requires-Dist: filelock>=3.0
-Requires-Dist: python-jose[cryptography]>=3.4.0
-Requires-Dist: passlib[argon2]>=1.7.4
+Requires-Dist: bcrypt>=4.2.0
 Requires-Dist: keyring>=24.0.0
 Requires-Dist: jinja2>=3.1.6
 Requires-Dist: slowapi>=0.1.9
@@ -61,7 +60,6 @@ Requires-Dist: python-multipart>=0.0.27
 Requires-Dist: pyjwt>=2.12.0
 Requires-Dist: cryptography>=46.0.7
 Requires-Dist: urllib3>=2.7.0
-Requires-Dist: pyasn1>=0.6.3
 Requires-Dist: mcp>=1.23.0
 Requires-Dist: idna>=3.15
 Provides-Extra: cloud
@@ -157,7 +155,7 @@ THE CLOSED LOOP
 ---
 
 > [!NOTE]
-> **CodeFRAME is in public beta (`0.9.2`).** The vision and the Golden Path CLI
+> **CodeFRAME is in public beta (`0.9.3`).** The vision and the Golden Path CLI
 > (`cf init/prd/tasks/work/proof/pr`) and v2 API are stable enough to build on;
 > the web UI and anything marked "in progress" in
 > [`docs/PRODUCT_ROADMAP.md`](docs/PRODUCT_ROADMAP.md) are still moving, and

{codeframe_ai-0.9.2 → codeframe_ai-0.9.3}/README.md

@@ -74,7 +74,7 @@ THE CLOSED LOOP
 ---
 
 > [!NOTE]
-> **CodeFRAME is in public beta (`0.9.2`).** The vision and the Golden Path CLI
+> **CodeFRAME is in public beta (`0.9.3`).** The vision and the Golden Path CLI
 > (`cf init/prd/tasks/work/proof/pr`) and v2 API are stable enough to build on;
 > the web UI and anything marked "in progress" in
 > [`docs/PRODUCT_ROADMAP.md`](docs/PRODUCT_ROADMAP.md) are still moving, and

{codeframe_ai-0.9.2 → codeframe_ai-0.9.3}/codeframe/__init__.py

@@ -5,7 +5,13 @@ An autonomous AI development system where multiple specialized agents
 collaborate to build software projects from requirements to deployment.
 """
 
-__version__ = "0.1.0"
+from importlib.metadata import PackageNotFoundError, version
+
+try:
+    __version__ = version("codeframe-ai")
+except PackageNotFoundError:  # source checkout, never installed
+    __version__ = "0.0.0+unknown"
+
 __author__ = "Frank Bria"
 
 __all__ = ["__version__", "__author__"]

{codeframe_ai-0.9.2 → codeframe_ai-0.9.3}/codeframe/adapters/llm/mock.py

@@ -18,11 +18,55 @@ from codeframe.adapters.llm.base import (
 )
 
 
+#: The task-decomposition prompt asks for this exact shape (core/tasks.py).
+#: Matched on a full sentence, not a keyword: a substring like "json" would
+#: reshape unrelated calls, which is the classifier mistake #1113/#1116/#1064
+#: each made in turn.
+_TASK_DECOMPOSITION_MARKER = "Return ONLY a JSON array of objects with these fields."
+
+#: What the mock answers that prompt with. Two tasks with a real dependency
+#: edge, because a decomposition with an empty graph is one the prompt itself
+#: calls wrong — and a lifecycle test that never exercises depends_on is not
+#: exercising the decomposer.
+_MOCK_DECOMPOSITION = """[
+  {
+    "title": "Implement the core function",
+    "description": "Add the function described by the PRD, with input validation.",
+    "depends_on_titles": [],
+    "complexity": 2,
+    "estimated_hours": 1.5,
+    "uncertainty": "low",
+    "files_to_modify": ["stats.py"]
+  },
+  {
+    "title": "Add a test for the core function",
+    "description": "Cover the happy path and one edge case.",
+    "depends_on_titles": ["Implement the core function"],
+    "complexity": 1,
+    "estimated_hours": 0.5,
+    "uncertainty": "low",
+    "files_to_modify": ["tests/test_stats.py"]
+  }
+]"""
+
+
 class MockProvider(LLMProvider):
     """Mock LLM provider for testing.
 
     Tracks all calls and returns configurable responses.
     Useful for unit tests and development without API costs.
+
+    The default response is the literal string ``"Mock response"``, which no
+    real caller can parse. That is fine for a provider nobody parses, but task
+    generation asks for a JSON array and #1115 correctly turned an unparseable
+    answer into a hard error — so `CODEFRAME_LLM_PROVIDER=mock` could not drive
+    the Golden Path's THINK step at all, and the lifecycle tests had to skip the
+    LLM branch entirely (#1068).
+
+    So the default is now shape-aware for exactly one prompt: the task
+    decomposition. Everything else is unchanged, and an explicitly queued
+    response or handler still wins — those are what a test uses to say what it
+    means.
     """
 
     def __init__(
@@ -140,12 +184,20 @@ class MockProvider(LLMProvider):
             self.response_index += 1
             return response
 
-        # Default response
+        # Shape-aware default: answer the task-decomposition prompt with
+        # something its parser can actually read. Only when the caller left the
+        # default in place — a test that set default_response meant it.
+        content = self.default_response
+        if content == "Mock response" and any(
+            _TASK_DECOMPOSITION_MARKER in str(m.get("content", "")) for m in messages
+        ):
+            content = _MOCK_DECOMPOSITION
+
         return LLMResponse(
-            content=self.default_response,
+            content=content,
             model=model,
             input_tokens=len(str(messages)),
-            output_tokens=len(self.default_response),
+            output_tokens=len(content),
         )
 
     def stream(

{codeframe_ai-0.9.2 → codeframe_ai-0.9.3}/codeframe/auth/manager.py

@@ -362,7 +362,8 @@ def get_jwt_strategy() -> JWTStrategy:
     **Known limitation — logout does not revoke.** ``POST /auth/jwt/logout``
     only tells the client to drop its copy; the token itself stays valid until
     it expires, because verification is stateless signature-checking with no
-    server-side denylist (the ``sessions`` table is unused). A leaked token is
+    server-side denylist (there is no session store at all — the vestigial
+    ``sessions`` table was dropped in #968). A leaked token is
     therefore usable for up to JWT_LIFETIME_SECONDS. The mitigating control is
     that lifetime — default 24h (#657), and now actually configurable — plus
     the web UI's CSP against XSS exfiltration. Real revocation needs a

{codeframe_ai-0.9.2 → codeframe_ai-0.9.3}/codeframe/cli/proof_commands.py

@@ -160,8 +160,8 @@ def run(
         codeframe proof run --gate unit
     """
     from codeframe.core.workspace import get_workspace
-    from codeframe.core.proof.models import Gate, GateOutcome
-    from codeframe.core.proof.runner import run_proof
+    from codeframe.core.proof.models import PROOF_CONFIG_FILENAME, Gate, GateOutcome
+    from codeframe.core.proof.runner import EmptyReason, run_proof_with_diagnostics
 
     workspace_path = repo_path or Path.cwd()
     try:
@@ -182,115 +182,76 @@ def run(
     mode = "full" if full else "scope-filtered"
     console.print(f"[dim]Running proof obligations ({mode})...[/dim]")
 
-    results = run_proof(workspace, full=full, gate_filter=gate_filter)
+    results, diagnostics = run_proof_with_diagnostics(
+        workspace, full=full, gate_filter=gate_filter
+    )
 
     if not results:
-        # `run_proof` returning {} has three causes and they need different
-        # answers. Two review rounds went by patching one branch at a time and
-        # getting the reason wrong each time, so this asks the runner's own
-        # selector instead of inferring it from the mode:
-        #
-        #   ledger empty        -> nothing to verify at all (the #1118 case)
-        #   nothing runnable    -> requirements exist but all SATISFIED/WAIVED
-        #                          for this mode; scope was never consulted,
-        #                          because run_proof short-circuits first
-        #   nothing in scope    -> runnable requirements existed and the scope
-        #                          filter excluded every one
-        from codeframe.core.proof import ledger as _ledger
-        from codeframe.core.proof.models import ReqStatus
-        from codeframe.core.proof.runner import _requirements_for_run
-
-        try:
-            all_reqs = _ledger.list_requirements(workspace)
-            # Same selector the runner uses, so this cannot drift from it.
-            runnable = _requirements_for_run(workspace, full=full)
-        except Exception:
-            # A ledger we cannot read is not evidence of an empty one; fall
-            # through to the unverified case rather than inventing a reason.
-            all_reqs, runnable = [], []
-
-        if runnable:
-            # Four review rounds went by asserting a specific reason here and
-            # being wrong each time. The CLI genuinely cannot tell them apart:
-            # run_proof returns only results, and discards the scope_skipped
-            # list it computes internally (runner.py:334/435). With a non-empty
-            # runnable set an empty result can mean the scope filter excluded
-            # everything, --gate excluded every obligation, enabled_gates config
-            # did, or a requirement simply has none.
+        # The runner now reports WHY (#1138). Before that, this block inferred
+        # the cause from the mode and the ledger, and four consecutive review
+        # rounds on #1137 caught it asserting a reason that was wrong — each
+        # time about a different one of the six causes. It ended up listing
+        # candidates instead, which was honest but useless. The runner is the
+        # only thing that knows, so ask it.
+        reason = diagnostics.reason
+
+        if reason is EmptyReason.NO_REQUIREMENTS:
+            # An empty ledger is not a pass (#1118). Exiting 0 here is what let
+            # the quickstart's PROVE step read as "PROOF9 gates passed" when
+            # nothing had been checked — and every new workspace is in exactly
+            # this state.
             #
-            # So state what is known and list the candidates, rather than
-            # asserting one and sending the user somewhere useless. #1138 tracks
-            # having the runner report the reason so this can be precise.
-            console.print(
-                f"[yellow]Nothing was verified.[/yellow] "
-                f"{len(runnable)} requirement(s) were eligible for this run, "
-                f"but no obligations ran."
-            )
-            reasons = []
-            if not full:
-                # --full provably ignores scope (runner.py:339), so listing it
-                # there would put an impossible cause in the candidate list.
-                reasons.append("none of them cover the changed files")
-            if gate_filter is not None:
-                reasons.append(f"--gate {gate_filter.value} excluded their obligations")
-            reasons.append("their obligations are disabled in proof_config.json")
-            reasons.append("they have no obligations defined")
-            console.print("Possible reasons: " + "; ".join(reasons) + ".")
-            if not full:
-                console.print(
-                    "Try [bold]cf proof run --full[/bold] to ignore scope, or "
-                    "[bold]cf proof status[/bold] for the ledger."
-                )
-            else:
-                console.print("See [bold]cf proof status[/bold] for the ledger.")
-            return
-
-        if all_reqs:
-            # This one IS knowable: the runnable set is empty while the ledger
-            # is not, so every requirement was excluded by its status. WAIVED is
-            # excluded from both modes; SATISFIED only from a scoped run.
-            satisfied = sum(1 for r in all_reqs if r.status == ReqStatus.SATISFIED)
-            waived = sum(1 for r in all_reqs if r.status == ReqStatus.WAIVED)
-            detail = ", ".join(
-                part
-                for part in (
-                    f"{satisfied} satisfied" if satisfied else "",
-                    f"{waived} waived" if waived else "",
-                )
-                if part
-            )
+            # Exit 2 rather than 1: this is not a failure either, and a script
+            # needs to tell "the gate failed" from "the gate had nothing to
+            # check". CI treats any non-zero as a stop, which is the point.
+            console.print("[yellow]Nothing was verified.[/yellow]")
             console.print(
-                f"[yellow]Nothing was verified.[/yellow] "
-                f"{len(all_reqs)} requirement(s) exist, but none are runnable"
-                + (f" ({detail})." if detail else ".")
+                "There are no proof obligations in this workspace, so this run "
+                "checked nothing — it is not a pass."
             )
             console.print(
-                "A waiver is an accepted risk that no run re-checks; "
-                "[bold]cf proof run --full[/bold] also re-verifies satisfied "
-                "ones. See [bold]cf proof status[/bold] for the ledger."
+                "\nCapture your first requirement with:\n"
+                "  [bold]cf proof capture[/bold]"
             )
-            return
-
-        # An empty ledger is not a pass (#1118). Exiting 0 here is what let the
-        # quickstart's PROVE step read as "PROOF9 gates passed" when nothing had
-        # been checked — and every new workspace is in exactly this state.
-        #
-        # Exit 2 rather than 1: this is not a failure either, and a script needs
-        # to tell "the gate failed" from "the gate had nothing to check". CI
-        # treats any non-zero as a stop, which is the point.
-        console.print("[yellow]Nothing was verified.[/yellow]")
-        console.print(
-            "There are no proof obligations in this workspace, so this run "
-            "checked nothing — it is not a pass."
-        )
+            if allow_empty:
+                console.print("\n[dim]--allow-empty: exiting 0 anyway.[/dim]")
+                return
+            raise typer.Exit(2)
+
         console.print(
-            "\nCapture your first requirement with:\n"
-            "  [bold]cf proof capture[/bold]"
+            f"[yellow]Nothing was verified.[/yellow] {diagnostics.describe()}."
         )
-        if allow_empty:
-            console.print("\n[dim]--allow-empty: exiting 0 anyway.[/dim]")
-            return
-        raise typer.Exit(2)
+
+        hints = {
+            EmptyReason.EXCLUDED_BY_STATUS: (
+                "A waiver is an accepted risk that no run re-checks; "
+                "[bold]cf proof run --full[/bold] also re-verifies satisfied ones."
+            ),
+            EmptyReason.EXCLUDED_BY_SCOPE: (
+                "[bold]cf proof run --full[/bold] ignores scope entirely."
+            ),
+            EmptyReason.EXCLUDED_BY_GATE_FILTER: (
+                "Drop [bold]--gate[/bold] to run every obligation."
+            ),
+            EmptyReason.EXCLUDED_BY_CONFIG: (
+                "Check [bold]enabled_gates[/bold] in "
+                f"[bold].codeframe/{PROOF_CONFIG_FILENAME}[/bold]."
+            ),
+            EmptyReason.EXCLUDED_BY_FILTER_COMBINATION: (
+                "Drop [bold]--gate[/bold], or add that gate to "
+                f"[bold]enabled_gates[/bold] in [bold].codeframe/{PROOF_CONFIG_FILENAME}"
+                "[/bold] — each filter alone leaves work to do, but they do not "
+                "overlap."
+            ),
+            EmptyReason.NO_OBLIGATIONS: (
+                "Add obligations to those requirements, or they can never be "
+                "satisfied."
+            ),
+        }
+        if reason in hints:
+            console.print(hints[reason])
+        console.print("See [bold]cf proof status[/bold] for the ledger.")
+        return
 
     # Display results
     table = Table(title="Proof Results")

{codeframe_ai-0.9.2 → codeframe_ai-0.9.3}/codeframe/config/rate_limits.py

@@ -9,7 +9,6 @@ Environment Variables (via GlobalConfig):
     RATE_LIMIT_AUTH: Rate limit for authentication endpoints (default: 10/minute)
     RATE_LIMIT_STANDARD: Rate limit for standard API endpoints (default: 100/minute)
     RATE_LIMIT_AI: Rate limit for AI/expensive operations (default: 20/minute)
-    RATE_LIMIT_WEBSOCKET: Rate limit for WebSocket connections (default: 30/minute)
     RATE_LIMIT_STORAGE: Storage backend - memory or redis (default: memory)
     RATE_LIMIT_TRUSTED_PROXIES: Comma-separated trusted proxy IPs/CIDRs
     REDIS_URL: Redis connection URL for distributed rate limiting (optional)
@@ -32,7 +31,6 @@ class RateLimitConfig:
         auth_limit: Rate limit for authentication endpoints
         standard_limit: Rate limit for standard API endpoints
         ai_limit: Rate limit for AI/expensive operations
-        websocket_limit: Rate limit for WebSocket connections
         enabled: Whether rate limiting is enabled
         storage: Storage backend ('memory' or 'redis')
         redis_url: Redis connection URL for distributed rate limiting
@@ -42,7 +40,6 @@ class RateLimitConfig:
     auth_limit: str = "10/minute"
     standard_limit: str = "100/minute"
     ai_limit: str = "20/minute"
-    websocket_limit: str = "30/minute"
     enabled: bool = True
     storage: str = "memory"
     redis_url: Optional[str] = None
@@ -128,7 +125,6 @@ class RateLimitConfig:
             auth_limit=global_config.rate_limit_auth,
             standard_limit=global_config.rate_limit_standard,
             ai_limit=global_config.rate_limit_ai,
-            websocket_limit=global_config.rate_limit_websocket,
             enabled=enabled,
             storage=storage,
             redis_url=redis_url,

{codeframe_ai-0.9.2 → codeframe_ai-0.9.3}/codeframe/core/__init__.py

@@ -1,11 +1,9 @@
 """Core components for CodeFRAME orchestration."""
 
-from codeframe.core.config import Config
 from codeframe.core.models import Task, TaskStatus, AgentMaturity
 from codeframe.core.stall_detector import StallAction, StallDetectedError, StallDetector
 
 __all__ = [
-    "Config",
     "Task",
     "TaskStatus",
     "AgentMaturity",