computer-agent-py 0.2.2__tar.gz → 0.3.0__tar.gz

{computer_agent_py-0.2.2 → computer_agent_py-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: computer-agent-py
-Version: 0.2.2
+Version: 0.3.0
 Summary: Drop-in replacement for claude-agent-sdk that adds a proxied telemetry pipeline (PII redaction + guardrails) with OpenTelemetry and AgentOS sinks.
 Keywords: computeragent,claude-agent-sdk,claude,agent,telemetry,otel,opentelemetry,agentos,pii
 Author: Abhi Bhat
@@ -509,7 +509,7 @@ configure(
         PiiRedactor(strategy="hash", extra_patterns=[r"BADGE-\d{6}"]),
         GuardrailFilter(
             max_attribute_length=4096,
-            tool_name_allowlist={"Read", "Glob", "Grep", "mcp__nordassist-tools__*"},
+            tool_name_allowlist={"Read", "Glob", "Grep", "mcp__acme-assist-tools__*"},
             cost_ceiling_usd=1.50,
         ),
     ],
@@ -551,7 +551,7 @@ opa = OpaPolicyEngine(
 authorizer = PolicyToolAuthorizer(
     engine=opa,
     principal_resolver=lambda ctx: PolicyPrincipal(id="alice", groups=["engineer"]),
-    resource_resolver=lambda ctx: PolicyResource(agent_name="nordassist", model="claude-sonnet-4-5"),
+    resource_resolver=lambda ctx: PolicyResource(agent_name="acme-assist", model="claude-sonnet-4-5"),
     context_resolver=lambda ctx: {"env": "prod"},
 )
 
@@ -650,7 +650,7 @@ The proxy is a pure tap — messages are never modified or reordered. Sinks run
 
 | File | Demonstrates |
 |---|---|
-| [`examples/pdf_drop_in.py`](examples/pdf_drop_in.py) | The minimum drop-in change |
+| [`examples/drop_in.py`](examples/drop_in.py) | The minimum drop-in change |
 | [`examples/with_otel.py`](examples/with_otel.py) | OTel pointed at a local collector |
 | [`examples/with_new_relic.py`](examples/with_new_relic.py) | OTel pointed at New Relic (just env vars) |
 | [`examples/with_datadog.py`](examples/with_datadog.py) | OTel pointed at Datadog |

{computer_agent_py-0.2.2 → computer_agent_py-0.3.0}/README.md

@@ -452,7 +452,7 @@ configure(
         PiiRedactor(strategy="hash", extra_patterns=[r"BADGE-\d{6}"]),
         GuardrailFilter(
             max_attribute_length=4096,
-            tool_name_allowlist={"Read", "Glob", "Grep", "mcp__nordassist-tools__*"},
+            tool_name_allowlist={"Read", "Glob", "Grep", "mcp__acme-assist-tools__*"},
             cost_ceiling_usd=1.50,
         ),
     ],
@@ -494,7 +494,7 @@ opa = OpaPolicyEngine(
 authorizer = PolicyToolAuthorizer(
     engine=opa,
     principal_resolver=lambda ctx: PolicyPrincipal(id="alice", groups=["engineer"]),
-    resource_resolver=lambda ctx: PolicyResource(agent_name="nordassist", model="claude-sonnet-4-5"),
+    resource_resolver=lambda ctx: PolicyResource(agent_name="acme-assist", model="claude-sonnet-4-5"),
     context_resolver=lambda ctx: {"env": "prod"},
 )
 
@@ -593,7 +593,7 @@ The proxy is a pure tap — messages are never modified or reordered. Sinks run
 
 | File | Demonstrates |
 |---|---|
-| [`examples/pdf_drop_in.py`](examples/pdf_drop_in.py) | The minimum drop-in change |
+| [`examples/drop_in.py`](examples/drop_in.py) | The minimum drop-in change |
 | [`examples/with_otel.py`](examples/with_otel.py) | OTel pointed at a local collector |
 | [`examples/with_new_relic.py`](examples/with_new_relic.py) | OTel pointed at New Relic (just env vars) |
 | [`examples/with_datadog.py`](examples/with_datadog.py) | OTel pointed at Datadog |

computer_agent_py-0.3.0/pyproject.toml

@@ -0,0 +1,177 @@
+[project]
+name = "computer-agent-py"
+version = "0.3.0"
+description = "Drop-in replacement for claude-agent-sdk that adds a proxied telemetry pipeline (PII redaction + guardrails) with OpenTelemetry and AgentOS sinks."
+readme = "README.md"
+requires-python = ">=3.10"
+keywords = [
+    "computeragent",
+    "claude-agent-sdk",
+    "claude",
+    "agent",
+    "telemetry",
+    "otel",
+    "opentelemetry",
+    "agentos",
+    "pii",
+]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+    "Typing :: Typed",
+]
+dependencies = [
+    "claude-agent-sdk>=0.2,<0.3",
+    "typing-extensions>=4.12",
+]
+
+[[project.authors]]
+name = "Abhi Bhat"
+email = "abhishek.bhat@lyzr.ai"
+
+[project.license]
+text = "MIT"
+
+[project.optional-dependencies]
+otel = [
+    "opentelemetry-api>=1.27",
+    "opentelemetry-sdk>=1.27",
+    "opentelemetry-exporter-otlp>=1.27",
+    "opentelemetry-semantic-conventions>=0.48b0",
+]
+agentos = ["httpx>=0.27"]
+remote = ["httpx>=0.27"]
+cedar = ["cedarpy>=4,<5"]
+gitagent = [
+    "openai>=1,<2",
+    "anthropic>=0.40,<1",
+    "pyyaml>=6,<7",
+]
+gap = ["pyyaml>=6,<7"]
+sqlite = ["aiosqlite>=0.20,<1"]
+all = [
+    "opentelemetry-api>=1.27",
+    "opentelemetry-sdk>=1.27",
+    "opentelemetry-exporter-otlp>=1.27",
+    "opentelemetry-semantic-conventions>=0.48b0",
+    "httpx>=0.27",
+    "cedarpy>=4,<5",
+    "openai>=1,<2",
+    "anthropic>=0.40,<1",
+    "pyyaml>=6,<7",
+    "aiosqlite>=0.20,<1",
+]
+
+[project.urls]
+Homepage = "https://github.com/open-gitagent/computer-agent-py"
+Issues = "https://github.com/open-gitagent/computer-agent-py/issues"
+Changelog = "https://github.com/open-gitagent/computer-agent-py/blob/main/CHANGELOG.md"
+
+[build-system]
+requires = ["uv_build>=0.9.24,<0.10.0"]
+build-backend = "uv_build"
+
+[tool.uv.build-backend]
+module-name = "computeragent"
+
+[tool.ruff]
+line-length = 100
+target-version = "py310"
+src = [
+    "src",
+    "tests",
+]
+
+[tool.ruff.lint]
+select = [
+    "E",
+    "F",
+    "W",
+    "I",
+    "UP",
+    "B",
+    "ASYNC",
+    "RET",
+    "SIM",
+    "TCH",
+]
+ignore = ["E501"]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/**" = [
+    "E501",
+    "ASYNC",
+    "TC001",
+    "TC003",
+]
+"examples/**" = ["E501"]
+"src/computeragent/__init__.py" = [
+    "F401",
+    "F403",
+]
+"src/computeragent/types.py" = [
+    "F401",
+    "F403",
+]
+"src/computeragent/harness/**" = [
+    "TC001",
+    "TC003",
+    "SIM101",
+]
+"src/computeragent/engines/**" = [
+    "TC001",
+    "TC003",
+]
+"src/computeragent/substrates/**" = ["TC003"]
+"src/computeragent/identity/**" = ["TC003"]
+"src/computeragent/session_stores/**" = ["TC001"]
+"src/computeragent/protocol_types/**" = ["TC003"]
+
+[tool.mypy]
+strict = true
+python_version = "3.10"
+files = ["src"]
+ignore_missing_imports = true
+
+[[tool.mypy.overrides]]
+module = "tests.*"
+disallow_untyped_defs = false
+disallow_incomplete_defs = false
+
+[tool.pytest.ini_options]
+asyncio_mode = "auto"
+testpaths = ["tests"]
+addopts = [
+    "-ra",
+    "--strict-markers",
+    "--strict-config",
+]
+markers = ["integration: requires real Claude CLI and credentials"]
+
+[dependency-groups]
+dev = [
+    "pytest>=8",
+    "pytest-asyncio>=0.23",
+    "pytest-cov>=5",
+    "respx>=0.21",
+    "ruff>=0.6",
+    "mypy>=1.11",
+    "httpx>=0.27",
+    "opentelemetry-api>=1.27",
+    "opentelemetry-sdk>=1.27",
+    "opentelemetry-exporter-otlp>=1.27",
+    "opentelemetry-semantic-conventions>=0.48b0",
+    "cedarpy>=4,<5",
+    "openai>=1,<2",
+    "anthropic>=0.40,<1",
+    "pyyaml>=6,<7",
+    "aiosqlite>=0.20,<1",
+]

computer_agent_py-0.2.2/pyproject.toml → computer_agent_py-0.3.0/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "computer-agent-py"
-version = "0.2.2"
+version = "0.3.0"
 description = "Drop-in replacement for claude-agent-sdk that adds a proxied telemetry pipeline (PII redaction + guardrails) with OpenTelemetry and AgentOS sinks."
 authors = [
     { name = "Abhi Bhat", email = "abhishek.bhat@lyzr.ai" },

{computer_agent_py-0.2.2 → computer_agent_py-0.3.0}/src/computeragent/__init__.py

@@ -42,7 +42,7 @@ _upstream_all = [n for n in getattr(_cas, "__all__", []) if n != "__version__"]
 for _name in _upstream_all:
     globals()[_name] = getattr(_cas, _name)
 
-__version__ = "0.2.1"
+__version__ = "0.3.0"
 upstream_version = getattr(_cas, "__version__", "unknown")
 
 # Override the two entry points with the proxied versions. Same signatures,
@@ -60,6 +60,7 @@ from .harness import (  # noqa: E402
     ChatInput,
     ChatResult,
     ComputerAgent,
+    ForkConfig,
     HarnessError,
     HarnessProtocolError,
     UnknownEngineError,
@@ -127,6 +128,7 @@ __all__ = sorted({*_upstream_all, "__version__"}) + [
     "PolicyResource",
     "PolicyResult",
     "PolicyToolAuthorizer",
+    "ForkConfig",
     "TelemetryEvent",
     "TelemetryMiddleware",
     "TelemetrySink",

{computer_agent_py-0.2.2 → computer_agent_py-0.3.0}/src/computeragent/_proxy/query.py

@@ -169,8 +169,8 @@ def _derive_agent_name(options: Any) -> str | None:
     Strategy:
       1. Explicit ``agent_name`` attribute (not in upstream today but cheap to
          honour if a fork adds it).
-      2. First non-empty line of ``system_prompt`` (NordAssist's prod prompt
-         starts with "You are NordAssist..." — that line is the natural label).
+      2. First non-empty line of ``system_prompt`` (prod prompts typically
+         start with "You are <Name>..." — that line is the natural label).
       3. ``None`` — the sinks fall back to an anonymous hash.
     """
     if options is None:

{computer_agent_py-0.2.2 → computer_agent_py-0.3.0}/src/computeragent/engines/claude_agent.py

@@ -105,7 +105,29 @@ def _build_options(ctx: EngineContext) -> Any:
     # carry one) so the resulting policy_decision telemetry correlates with
     # this session's open OTel spans instead of landing on "unknown".
     if ctx.policy_decider is not None:
-        payload["can_use_tool"] = _bind_session_id(ctx.policy_decider, ctx.session_id)
+        bound = _bind_session_id(ctx.policy_decider, ctx.session_id)
+        payload["can_use_tool"] = bound
+        # Policy enforcement that survives prompt-skipping permission modes.
+        # ``can_use_tool`` only fires when the CLI's permission rules evaluate
+        # to "ask" — under bypassPermissions / dontAsk / auto (and for edits
+        # under acceptEdits) it is skipped entirely, which would leave a
+        # console-bound policy unenforced. A PreToolUse hook fires for EVERY
+        # tool call regardless of permission mode (SDK-documented), so route
+        # the same bound decider through one and translate a deny into the
+        # hook's deny decision — mirroring the TS engine. Registered only for
+        # the skipping modes so default-mode behavior (and telemetry volume)
+        # is unchanged. MERGED with GAP/caller-supplied hooks, never replacing.
+        if payload.get("permission_mode") in (
+            "bypassPermissions",
+            "dontAsk",
+            "auto",
+            "acceptEdits",
+        ):
+            hooks = dict(payload.get("hooks") or {})
+            pre = list(hooks.get("PreToolUse") or [])
+            pre.append(_policy_pretooluse_matcher(bound))
+            hooks["PreToolUse"] = pre
+            payload["hooks"] = hooks
 
     options = ClaudeAgentOptions(**payload)
     # Surface harness-supplied agent identity to the proxy's
@@ -119,6 +141,68 @@ def _build_options(ctx: EngineContext) -> Any:
     return options
 
 
+def _policy_pretooluse_matcher(decider: Any) -> Any:
+    """Wrap the bound ``can_use_tool`` decider as a PreToolUse ``HookMatcher``.
+
+    The hook receives the SDK's PreToolUse input (``tool_name`` /
+    ``tool_input`` / ``tool_use_id``), runs the SAME decider that backs
+    ``can_use_tool``, and maps a deny onto the hook's
+    ``permissionDecision: "deny"`` — the only gate that fires under
+    prompt-skipping permission modes. An allow returns ``{}`` (no opinion).
+    An unexpected decider exception fails CLOSED (the authorizer's own
+    fail-open handling lives inside it; anything escaping is a bug).
+    """
+    from claude_agent_sdk.types import HookMatcher
+
+    async def _hook(hook_input: Any, _tool_use_id: str | None, _context: Any) -> dict[str, Any]:
+        data = hook_input if isinstance(hook_input, dict) else {}
+        tool_name = str(data.get("tool_name") or "")
+        tool_input = data.get("tool_input") or {}
+        try:
+            result = await decider(tool_name, tool_input, _permission_context())
+        except Exception as exc:  # noqa: BLE001 — fail closed on decider bugs
+            logger.exception("policy PreToolUse hook: decider raised")
+            return _hook_deny(f"policy evaluation failed: {exc}")
+        behavior = getattr(result, "behavior", None)
+        if behavior is None and isinstance(result, dict):
+            behavior = result.get("behavior")
+        if behavior == "deny":
+            message = getattr(result, "message", None)
+            if message is None and isinstance(result, dict):
+                message = result.get("message")
+            return _hook_deny(str(message or "blocked by policy"))
+        return {}
+
+    return HookMatcher(hooks=[_hook])
+
+
+def _permission_context() -> Any:
+    """A best-effort ``ToolPermissionContext`` for hook-originated decisions.
+
+    The hook path has no real permission context (the CLI never built one —
+    the call skipped the prompt), so hand the decider an empty one; the
+    ``_bind_session_id`` wrapper still stamps the session id onto it.
+    """
+    try:
+        from claude_agent_sdk.types import ToolPermissionContext
+
+        return ToolPermissionContext()
+    except Exception:  # noqa: BLE001 — required fields / import drift
+        from types import SimpleNamespace
+
+        return SimpleNamespace()
+
+
+def _hook_deny(reason: str) -> dict[str, Any]:
+    return {
+        "hookSpecificOutput": {
+            "hookEventName": "PreToolUse",
+            "permissionDecision": "deny",
+            "permissionDecisionReason": reason,
+        }
+    }
+
+
 def _bind_session_id(decider: Any, session_id: str) -> Any:
     """Wrap a ``can_use_tool`` decider so the permission context carries the
     harness session id. ``ToolPermissionContext`` is a plain dataclass, so the

{computer_agent_py-0.2.2 → computer_agent_py-0.3.0}/src/computeragent/harness/__init__.py

@@ -204,6 +204,18 @@ class ComputerAgent:
         # id from the UI and paste it here. When omitted, the policy bound to
         # `agent_name` in AgentOS (the UI's Policy tab) is fetched and used.
         policy_id: str | None = None,
+        # ── process-fork (opt-in; OFF by default) ───────────────────────────
+        # ``fork_mode="manual"`` exposes the ``mcp__fork__spawn`` tool so the
+        # agent can spawn SEPARATE child ComputerAgent processes (each its own
+        # session/agent id). ``"auto"`` additionally disables the native
+        # in-process Task sub-agent and steers all delegation to the fork tool.
+        # ``"off"`` (default) = today's behavior, untouched.
+        fork_mode: str = "off",
+        fork_config: Any = None,
+        # Internal — set by the fork tool when THIS agent is itself a child.
+        parent_session_id: str | None = None,
+        parent_agent_id: str | None = None,
+        _fork_depth: int = 0,
     ) -> None:
         from .. import agentos as _agentos
 
@@ -366,6 +378,12 @@ class ComputerAgent:
 
             policy_decider = srs_authorizer_from_env(agent_name or "")
 
+        # Fork config: default one in when a mode is on but none supplied.
+        if fork_mode != "off" and fork_config is None:
+            from .fork import ForkConfig
+
+            fork_config = ForkConfig()
+
         self._coordinator = HarnessCoordinator(
             engine=resolved_engine,
             substrate=resolved_substrate,
@@ -386,6 +404,12 @@ class ComputerAgent:
             # layers these on top of whatever the identity loader resolves
             # so explicit caller kwargs always win.
             options_overlay=merged_options,
+            # Process-fork wiring (opt-in).
+            parent_session_id=parent_session_id,
+            parent_agent_id=parent_agent_id,
+            fork_mode=fork_mode,
+            fork_config=fork_config,
+            fork_depth=_fork_depth,
         )
 
     async def __aenter__(self) -> ComputerAgent:
@@ -517,11 +541,14 @@ async def run_task(
         return await agent.chat(message)
 
 
+from .fork import ForkConfig  # noqa: E402  (re-exported for callers)
+
 __all__ = [
     "ChatHandle",
     "ChatInput",
     "ChatResult",
     "ComputerAgent",
+    "ForkConfig",
     "HarnessError",
     "HarnessProtocolError",
     "UnknownEngineError",

{computer_agent_py-0.2.2 → computer_agent_py-0.3.0}/src/computeragent/harness/coordinator.py

@@ -92,6 +92,12 @@ class HarnessCoordinator:
         telemetry_pipeline: Pipeline | None = None,
         project_key: str = "default",
         options_overlay: dict[str, Any] | None = None,
+        # ── process-fork (opt-in; see harness/fork.py) ──────────────────────
+        parent_session_id: str | None = None,
+        parent_agent_id: str | None = None,
+        fork_mode: str = "off",
+        fork_config: Any = None,
+        fork_depth: int = 0,
     ) -> None:
         self._engine = engine
         self._substrate = substrate
@@ -105,6 +111,16 @@ class HarnessCoordinator:
         # Stable agent identifier (telemetry/registry only — never affects
         # execution). Stamped onto every emitted event via ``_emit``.
         self._agent_id = agent_id
+        # Process-fork linkage + config. ``parent_*`` are stamped onto every
+        # emitted event (like ``agent_id``) so a forked child links to its
+        # parent. The fork server (mcp__fork__spawn) is injected into the run
+        # options in ``_ensure_booted`` when ``fork_mode != "off"``.
+        self._parent_session_id = parent_session_id
+        self._parent_agent_id = parent_agent_id
+        self._fork_mode = fork_mode
+        self._fork_config = fork_config
+        self._fork_depth = fork_depth
+        self._fork_context: Any = None
         self._policy_decider = policy_decider
         self._on_permission_request_user = on_permission_request
         self._budget_max_usd = budget_max_usd
@@ -174,6 +190,54 @@ class HarnessCoordinator:
             from dataclasses import replace
 
             loaded = replace(loaded, options=merged_options)
+        # Loader-declared compliance hardening (e.g. GAP human-in-the-loop →
+        # permission mode) runs AFTER the caller overlay, so strictest-wins
+        # constraints hold even against caller-supplied options.
+        harden = getattr(loaded, "harden", None)
+        if callable(harden):
+            from dataclasses import replace
+
+            with suppress(Exception):
+                hardened = harden(dict(loaded.options or {}))
+                if isinstance(hardened, dict):
+                    loaded = replace(loaded, options=hardened)
+        # ── process-fork tool injection (opt-in) ─────────────────────────────
+        # Injected HERE (loader-agnostic, after overlay+harden) rather than via
+        # the caller overlay — the overlay is a shallow ``dict.update`` and would
+        # CLOBBER the loader's ``mcp_servers`` (e.g. gap_tools). We deep-merge so
+        # the fork server coexists with gap_tools + agents. A child only gets the
+        # tool while under the depth cap.
+        if (
+            self._fork_mode != "off"
+            and self._fork_config is not None
+            and self._fork_depth < getattr(self._fork_config, "max_depth", 0)
+        ):
+            from dataclasses import replace
+
+            from .fork import ForkContext, append_steer, build_fork_mcp_server
+
+            self._fork_context = ForkContext(
+                self, self._fork_config, self._fork_depth, self._fork_mode
+            )
+            server, tool_names = build_fork_mcp_server(self._fork_context)
+            opts = dict(loaded.options or {})
+            mcp = dict(opts.get("mcp_servers") or {})
+            mcp["fork"] = server
+            opts["mcp_servers"] = mcp
+            # Only extend an EXISTING allowlist — introducing one where there was
+            # none would restrict the agent to just the fork tool. When no
+            # allowlist is set, all tools (incl. the fork MCP tool) are available.
+            if opts.get("allowed_tools"):
+                opts["allowed_tools"] = list(opts["allowed_tools"]) + list(tool_names)
+            if self._fork_mode == "auto":
+                # Disable native in-process sub-agents; steer delegation to fork.
+                opts["agents"] = {}
+                dis = list(opts.get("disallowed_tools") or [])
+                if "Task" not in dis:
+                    dis.append("Task")
+                opts["disallowed_tools"] = dis
+                opts["system_prompt"] = append_steer(opts.get("system_prompt"))
+            loaded = replace(loaded, options=opts)
         self._manifest = loaded
 
     async def dispose(self) -> None:
@@ -186,6 +250,12 @@ class HarnessCoordinator:
         if self._lifecycle_started and self._lifecycle_session_id:
             with suppress(Exception):
                 await self._emit_lifecycle_session_ended()
+        # Tear down any still-running forked children first — the SDK's atexit
+        # net kills orphaned CLI processes but NOT the children's temp
+        # workspaces, so an explicit dispose here prevents leaks.
+        if self._fork_context is not None:
+            with suppress(Exception):
+                await self._fork_context.teardown()
         if self._substrate_handle is not None:
             with suppress(Exception):
                 await self._substrate_handle.close()
@@ -521,6 +591,12 @@ class HarnessCoordinator:
         hands off to the pipeline. ``TelemetryEvent`` is mutable by design."""
         if self._agent_id is not None:
             ev.agent_id = self._agent_id
+        # Fork linkage — stamp the parent ids so a child's events nest under
+        # the parent (None for a top-level agent → field stays None).
+        if self._parent_session_id is not None:
+            ev.parent_session_id = self._parent_session_id
+        if self._parent_agent_id is not None:
+            ev.parent_agent_id = self._parent_agent_id
         await self._pipeline.emit(ev)
 
     def _build_permission_resolver(