delos-cli 2.0.2__tar.gz → 2.1.0__tar.gz

delos_cli-2.1.0/.claude/settings.local.json

@@ -0,0 +1,8 @@
+{
+  "disabledMcpjsonServers": [
+    "sentry",
+    "agent-analysis-localhost",
+    "agent-analysis-staging",
+    "agent-analysis-prod"
+  ]
+}

{delos_cli-2.0.2 → delos_cli-2.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: delos-cli
-Version: 2.0.2
+Version: 2.1.0
 Summary: Terminal REPL for the Delos agent — the Claude-Code-style CLI for Delos.
 Project-URL: Homepage, https://delos.so
 Project-URL: Repository, https://github.com/Delos-Intelligence/cosmos-saas
@@ -26,6 +26,7 @@ Requires-Dist: questionary>=2.0.1
 Requires-Dist: rich>=13.8.0
 Requires-Dist: ripgrep<15,>=14; sys_platform == 'darwin' and platform_machine == 'arm64'
 Requires-Dist: ripgrep<15,>=14; sys_platform == 'linux' and platform_machine == 'x86_64'
+Requires-Dist: sentry-sdk<3,>=2.44.0
 Requires-Dist: typer>=0.12.5
 Description-Content-Type: text/markdown
 

delos_cli-2.1.0/delos_cli/_build.json

@@ -0,0 +1 @@
+{}

{delos_cli-2.0.2 → delos_cli-2.1.0}/delos_cli/agent/session.py

@@ -56,8 +56,9 @@ class AgentSession:
         terminates with unresolved tool calls, treats them as client-side,
         invokes the registered handler, posts the result via
         ``/tool-result``, and re-streams a continuation request with
-        ``tool_continuation=true`` and ``messages=[]``.  Loops until no
-        pending calls remain or the user explicitly stopped.
+        ``tool_continuation=true``, ``messages=[]`` and no ``git_context``
+        (the backend replays the snapshot it froze on the user message).
+        Loops until no pending calls remain or the user explicitly stopped.
 
         The backend never emits ``tool-output-available`` for client-side
         tools — with ``emit_tool_output=True``, a synthetic one is yielded
@@ -128,7 +129,16 @@ class AgentSession:
                         "output": result,
                     }
 
-            current_body = {**body, "messages": [], "tool_continuation": True}
+            # ``git_context`` is dropped: the backend froze the turn's snapshot
+            # onto the user message on the first request and replays it from
+            # there, so re-sending a fresh one would be ignored at best.
+            # ``custom_instructions`` stays — the system prompt is re-rendered
+            # on every request and reads it.
+            current_body = {
+                **{k: v for k, v in body.items() if k != "git_context"},
+                "messages": [],
+                "tool_continuation": True,
+            }
 
     async def stop(self) -> None:
         """Set the backend stop signal.  Idempotent."""

{delos_cli-2.0.2 → delos_cli-2.1.0}/delos_cli/apps/chat/render.py

@@ -109,6 +109,12 @@ class V6Renderer:
         # inline between literal tag deltas. Reasoning is swallowed (the
         # spinner keeps running) so it never lands in scrollback.
         self._in_think = False
+        # Prompt-token totals across every LLM call of this user turn (one
+        # renderer per turn, N HTTP requests inside it). Summed rather than
+        # rendered per call: the interesting number is what the whole turn
+        # paid, and a line per continuation would drown the transcript.
+        self._input_tokens = 0
+        self._cached_tokens = 0
 
     def apply(self, event: dict[str, Any]) -> None:
         """Apply a single v6 event to the output buffer."""
@@ -194,6 +200,12 @@ class V6Renderer:
                 ),
             )
 
+        elif etype == "data-usage":
+            # Accumulated, not drawn: ``close()`` renders the turn total.
+            payload = event.get("data") or {}
+            self._input_tokens += int(payload.get("inputTokens") or 0)
+            self._cached_tokens += int(payload.get("cachedTokens") or 0)
+
         elif etype == "data-compaction-skipped":
             # Backend tried to compact but couldn't (LLM failure, etc.).
             # Surface it so the user understands why the agent may still
@@ -235,6 +247,16 @@ class V6Renderer:
             self._output.commit_live()
         else:
             self._output.discard_live()
+        self._render_usage()
+
+    def _render_usage(self) -> None:
+        """One dim line with the turn's prompt tokens and how many were cached."""
+        if self._input_tokens <= 0:
+            return
+        hit = round(100 * self._cached_tokens / self._input_tokens)
+        self._output.append_block(
+            Text(f"⚡ cache {hit}% · {_fmt_tokens(self._input_tokens)} in", style="dim"),
+        )
 
     @property
     def assistant_text(self) -> str:

{delos_cli-2.0.2 → delos_cli-2.1.0}/delos_cli/auth/config.py

@@ -25,6 +25,8 @@ from pathlib import Path
 from typing import IO, TYPE_CHECKING, Any, TypedDict
 
 from delos_cli import _editable_source_dir
+from delos_cli.public_key import is_public_key, resolve_public_key
+from delos_cli.telemetry import applied_config
 
 if TYPE_CHECKING:
     from collections.abc import Iterator
@@ -187,8 +189,16 @@ class Config:
 
     @property
     def supabase_anon_key(self) -> str:
-        """Public Supabase anon key for this region."""
-        return (PUBLIC_REGIONS | INTERNAL_REGIONS)[self.region]["supabase_anon_key"]
+        """Public key for this database; discovery never changes session tokens."""
+        if override := os.environ.get("DELOS_SUPABASE_PUBLISHABLE_KEY"):
+            if not is_public_key(override):
+                message = "DELOS_SUPABASE_PUBLISHABLE_KEY must be a public Supabase key"
+                raise ValueError(message)
+            return override
+        bundled = (PUBLIC_REGIONS | INTERNAL_REGIONS)[self.region]["supabase_anon_key"]
+        if self.region == "dev" and self.supabase_url == INTERNAL_REGIONS["dev"]["supabase_url"]:
+            return bundled
+        return resolve_public_key(self.web_url, self.supabase_url, bundled, CONFIG_DIR / "public-keys")
 
     @property
     def is_signed_in(self) -> bool:
@@ -232,6 +242,7 @@ def set_region(cfg: Config, region: str) -> None:
     cfg.user_id = adopted.user_id
     cfg.client_id = adopted.client_id
     cfg.tokens = adopted.tokens
+    applied_config(cfg)
 
 
 def load() -> Config:
@@ -268,6 +279,7 @@ def load() -> Config:
     if cfg.region not in available_regions():
         set_region(cfg, DEFAULT_REGION)
 
+    applied_config(cfg)
     return cfg
 
 

delos_cli-2.1.0/delos_cli/public_key.py

@@ -0,0 +1,116 @@
+"""Public key discovery; keep in sync with cvn/backend/cvn/public_key.py.
+
+Only public API keys are cached. Database URLs, user JWTs and refresh tokens
+are never changed. A process uses one snapshot until it restarts.
+"""
+
+from __future__ import annotations
+
+import base64
+import contextlib
+import hashlib
+import json
+import re
+import tempfile
+from functools import lru_cache
+from pathlib import Path
+from urllib.parse import urlsplit
+
+import httpx
+
+MAX_PUBLIC_KEY_LENGTH = 8192
+JWT_PARTS = 3
+
+
+def is_public_key(value: object) -> bool:
+    """A disclosure guard, not JWT signature verification."""
+    if not isinstance(value, str) or len(value) > MAX_PUBLIC_KEY_LENGTH:
+        return False
+    if re.fullmatch(r"sb_publishable_[A-Za-z0-9_-]+", value):
+        return True
+    parts = value.split(".")
+    if len(parts) != JWT_PARTS or any(not re.fullmatch(r"[A-Za-z0-9_-]+", part) for part in parts):
+        return False
+    try:
+        payload = json.loads(base64.urlsafe_b64decode(parts[1] + "=" * (-len(parts[1]) % 4)))
+        return isinstance(payload, dict) and payload.get("role") == "anon"
+    except ValueError, UnicodeError:
+        return False
+
+
+def public_url(value: str) -> str:
+    """Reject credentials, fragments and non-HTTPS remote discovery."""
+    url = urlsplit(value)
+    local = url.hostname in {"localhost", "127.0.0.1", "::1"}
+    if (url.scheme != "https" and not (local and url.scheme == "http")) or not url.hostname:
+        message = "Invalid public configuration URL"
+        raise ValueError(message)
+    if url.username or url.password or url.query or url.fragment:
+        message = "Invalid public configuration URL"
+        raise ValueError(message)
+    return url.geturl().rstrip("/")
+
+
+@lru_cache(maxsize=32)
+def resolve_public_key(web_url: str, supabase_url: str, bundled_key: str, cache_dir: Path) -> str:
+    """Resolve once per configured target/process; fall back on discovery failure.
+
+    No request contains a Supabase API key or a user/session credential.
+    The response must name the exact configured database before its key is used.
+    """
+    key = bundled_key if is_public_key(bundled_key) else ""
+    try:
+        web = urlsplit(public_url(web_url))
+        origin = f"{web.scheme}://{web.netloc}"
+        database = public_url(supabase_url)
+    except ValueError:
+        return key
+    cache_id = hashlib.sha256(f"{origin}|{database}".encode()).hexdigest()
+    cache_path = cache_dir / f"{cache_id}.json"
+    try:
+        cached = json.loads(cache_path.read_text())
+        if is_public_key(cached):
+            key = cached
+    except OSError, ValueError:
+        pass
+    try:
+        # No redirects: the configured origin owns key discovery.
+        response = httpx.get(f"{origin}/api/addin-config", timeout=3.0, follow_redirects=False)
+        response.raise_for_status()
+        data = response.json()
+        if not isinstance(data, dict) or not isinstance(data.get("supabaseUrl"), str):
+            return key
+        candidate = data.get("anonKey")
+        if public_url(data["supabaseUrl"]) != database or not is_public_key(candidate):
+            return key
+        key = str(candidate)
+    except httpx.HTTPError, ValueError:
+        return key
+    # Atomic persistence is best-effort and separate from applied memory.
+    temporary: Path | None = None
+    try:
+        cache_dir.mkdir(parents=True, exist_ok=True)
+        with tempfile.NamedTemporaryFile(mode="w", encoding="utf-8", dir=cache_dir, delete=False) as output:
+            temporary = Path(output.name)
+            json.dump(key, output)
+        temporary.replace(cache_path)
+    except OSError:
+        pass
+    finally:
+        if temporary:
+            with contextlib.suppress(OSError):
+                temporary.unlink(missing_ok=True)
+    return key
+
+
+def public_key_tags(key: str) -> dict[str, str]:
+    """Match @kit/supabase/public-key; no user JWT or secret is fingerprinted."""
+    if not is_public_key(key):
+        return {"supabase.key_kind": "unknown", "supabase.key_revision": "unknown"}
+    fingerprint = 5381
+    for char in key:
+        fingerprint = ((fingerprint * 33) ^ ord(char)) & 0xFFFFFFFF
+    return {
+        "supabase.key_kind": "publishable" if key.startswith("sb_publishable_") else "legacy",
+        "supabase.key_revision": f"djb2:{fingerprint:x}",
+    }

delos_cli-2.1.0/delos_cli/sentry_identity.py

@@ -0,0 +1,31 @@
+"""Public deployment identity for a separately distributed client."""
+
+from urllib.parse import urlsplit
+
+# Keep aligned with packages/monitoring/core/src/identity.ts (parity tested).
+_HOSTS = {
+    "app.delos.so": "eu-prod",
+    "db.app.delos.so": "eu-prod",
+    "us.delos.so": "us-prod",
+    "db.app.us.delos.so": "us-prod",
+    "ae.delos.so": "uae-prod",
+    "db.ae.delos.so": "uae-prod",
+    "bouygues.delos.so": "bouygues-prod",
+    "db.bouygues.delos.so": "bouygues-prod",
+    "beta.delos.so": "eu-staging",
+    "db.beta.delos.so": "eu-staging",
+    "localhost": "local",
+    "127.0.0.1": "local",
+    "::1": "local",
+}
+
+
+def endpoint_identity(endpoint: str) -> str:
+    """Never transmit custom URLs, credentials or configuration payloads."""
+    try:
+        parsed = urlsplit(endpoint)
+        if parsed.scheme in {"http", "https"} and parsed.hostname:
+            return _HOSTS.get(parsed.hostname, "custom")
+    except ValueError:
+        pass
+    return "unknown"

{delos_cli-2.0.2 → delos_cli-2.1.0}/delos_cli/serve/server.py

@@ -201,6 +201,7 @@ class StdioServer:
             has_project_instructions=bool(self.custom_instructions),
         )
         model = message.get("model")
+        reasoning_effort = message.get("reasoningEffort")
         # Uploaded-document refs (Import from Computer / Drive) attached by the
         # frontend; forwarded to the backend so the agent can read_document them.
         raw_files = message.get("messageFiles")
@@ -244,6 +245,7 @@ class StdioServer:
                 mode,
                 model if isinstance(model, str) else None,
                 message_files,
+                reasoning_effort=reasoning_effort if isinstance(reasoning_effort, str) and reasoning_effort else None,
                 interrupted_content=interrupted_content,
                 edit_turn=edit_turn,
             ),
@@ -258,6 +260,7 @@ class StdioServer:
         mode: str,
         model: str | None,
         message_files: list[dict[str, Any]],
+        reasoning_effort: str | None = None,
         interrupted_content: str | None = None,
         edit_turn: int | None = None,
     ) -> None:
@@ -305,8 +308,12 @@ class StdioServer:
             # the agent doesn't burn its first tool call on `git status`.
             if (git_ctx := await collect_git_context(self.workspace)) is not None:
                 body["git_context"] = git_ctx
+            if self.custom_instructions:
+                body["custom_instructions"] = self.custom_instructions
             if model:
                 body["options"] = {"model": model}
+            if reasoning_effort:
+                body.setdefault("options", {})["reasoning_effort"] = reasoning_effort
             if edit_turn is not None:
                 body["edit_turn"] = edit_turn
             if message_files:

delos_cli-2.1.0/delos_cli/telemetry.py

@@ -0,0 +1,75 @@
+"""Telemetry entrypoint; captures unexpected failures and flushes before exit."""
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+import sentry_sdk
+
+from delos_cli import __version__, _editable_source_dir
+from delos_cli.public_key import public_key_tags
+from delos_cli.sentry_identity import endpoint_identity
+
+if TYPE_CHECKING:
+    from sentry_sdk.client import BaseClient
+
+    from delos_cli.auth.config import Config
+
+_cli_client: BaseClient | None = None
+
+
+def build_identity() -> dict[str, str]:
+    """Read metadata shipped with the wheel, never the caller shell environment."""
+    metadata = json.loads(Path(__file__).with_name("_build.json").read_text())
+    if metadata.get("version") == __version__ and _editable_source_dir() is None:
+        return metadata
+    return {"release": f"cosmos-cli@{__version__}"}
+
+
+def applied_config(cfg: Config) -> None:
+    """Reads only the endpoints the active config object will use."""
+    if _cli_client is None or sentry_sdk.get_client() is not _cli_client:
+        return
+    sentry_sdk.set_tags(public_key_tags(cfg.supabase_anon_key))
+    sentry_sdk.set_tag("backend.deployment", endpoint_identity(cfg.api_url))
+    sentry_sdk.set_tag("database.deployment", endpoint_identity(cfg.supabase_url))
+
+
+def main() -> None:
+    """Keep CLI exit codes and exceptions intact; never collect CLI arguments."""
+    global _cli_client  # noqa: PLW0603 -- identify our client in a shared process
+    build = build_identity()
+    editable = _editable_source_dir() is not None
+    disabled = editable or os.environ.get("DELOS_TELEMETRY_DISABLED") == "1"
+    sentry_sdk.init(
+        dsn=""
+        if disabled
+        else "https://03a98437d8f510283186ce47f55866d7@o4507940398825472.ingest.de.sentry.io/4512067093463120",
+        release=build["release"],
+        environment="development" if editable else "production",
+        default_integrations=False,
+        auto_enabling_integrations=False,
+        send_default_pii=False,
+        include_local_variables=False,
+        max_request_body_size="never",
+    )
+    _cli_client = sentry_sdk.get_client()
+    sentry_sdk.set_tag("service", "cli")
+    sentry_sdk.set_tag("delos.release", build["release"])
+    sentry_sdk.set_tag("app.version", __version__)
+    if sha := build.get("sha"):
+        sentry_sdk.set_tag("build.sha", sha)
+    sentry_sdk.start_session(session_mode="application")
+    try:
+        from delos_cli.main import app  # noqa: PLC0415
+
+        app()
+    except Exception as exc:
+        sentry_sdk.capture_exception(exc)
+        raise
+    finally:
+        sentry_sdk.end_session()
+        sentry_sdk.flush(timeout=2)

{delos_cli-2.0.2 → delos_cli-2.1.0}/delos_cli/tools/glob_tool.py

@@ -51,6 +51,7 @@ async def handle_glob(tool_input: dict[str, Any], ctx: Ctx) -> str:  # noqa: RUF
         return "Error: 'pattern' is required and must be a non-empty string."
 
     raw_path = (tool_input.get("path") or ".").strip() or "."
+    include_ignored = bool(tool_input.get("include_ignored"))
     base = Path(raw_path).expanduser()  # noqa: ASYNC240 — one-shot stat is fine
     if not base.is_absolute():
         base = Path.cwd() / base
@@ -62,12 +63,29 @@ async def handle_glob(tool_input: dict[str, Any], ctx: Ctx) -> str:  # noqa: RUF
 
     # ``Path.glob`` handles ``**`` recursive segments natively.
     try:
-        candidates = [p for p in base.glob(pattern) if not _IGNORED_DIR_SEGMENTS.intersection(p.parts) and p.is_file()]
+        matches = (
+            base.glob(pattern, recurse_symlinks=True)
+            if include_ignored
+            else base.glob(pattern)
+        )
+        candidates = [
+            p
+            for p in matches
+            if (include_ignored or not _IGNORED_DIR_SEGMENTS.intersection(p.parts)) and p.is_file()
+        ]
     except (OSError, ValueError) as e:
         return f"Error walking {base} with pattern {pattern!r}: {e}"
 
     if not candidates:
-        return f"No files matching {pattern!r} in {base} (dependency/build trees like node_modules are excluded)."
+        suffix = (
+            ""
+            if include_ignored
+            else (
+                " (dependency/build trees like node_modules are excluded — "
+                "pass include_ignored=true to search them)"
+            )
+        )
+        return f"No files matching {pattern!r} in {base}{suffix}."
 
     # Sort by mtime desc; fall back to path on stat errors so a single
     # vanished file doesn't poison the whole result.
@@ -101,4 +119,7 @@ def render_glob(event: dict[str, Any]) -> RenderableType | None:
     if not pattern:
         return None
     path = inputs.get("path") or "."
-    return tool_line("→", "List files", f'"{pattern}"', color="cyan", suffix=f"({path})")
+    suffix = f"({path})"
+    if inputs.get("include_ignored"):
+        suffix += "  incl. ignored"
+    return tool_line("→", "List files", f'"{pattern}"', color="cyan", suffix=suffix)

{delos_cli-2.0.2 → delos_cli-2.1.0}/delos_cli/tools/grep.py

@@ -93,6 +93,7 @@ async def handle_grep(tool_input: dict[str, Any], ctx: Ctx) -> str:
     type_ = tool_input.get("type")
     output_mode = (tool_input.get("output_mode") or "content").strip()
     case_insensitive = bool(tool_input.get("case_insensitive"))
+    include_ignored = bool(tool_input.get("include_ignored"))
     head_limit = _coerce_int(
         tool_input.get("head_limit"),
         default=_DEFAULT_HEAD_LIMIT,
@@ -114,6 +115,7 @@ async def handle_grep(tool_input: dict[str, Any], ctx: Ctx) -> str:
             output_mode=output_mode,
             case_insensitive=case_insensitive,
             context_lines=context_lines,
+            include_ignored=include_ignored,
         )
     else:
         argv = _build_grep_argv(
@@ -123,6 +125,7 @@ async def handle_grep(tool_input: dict[str, Any], ctx: Ctx) -> str:
             output_mode=output_mode,
             case_insensitive=case_insensitive,
             context_lines=context_lines,
+            include_ignored=include_ignored,
         )
 
     try:
@@ -176,6 +179,8 @@ def render_grep(event: dict[str, Any]) -> RenderableType | None:
     path = inputs.get("path") or "."
     glob = inputs.get("glob")
     suffix = f"({path})"
+    if inputs.get("include_ignored"):
+        suffix += "  incl. ignored"
     if glob:
         suffix += f"  glob: {glob}"
     return tool_line("→", "Search in files", f'"{pattern}"', color="cyan", suffix=suffix)
@@ -191,9 +196,20 @@ def _build_rg_argv(
     output_mode: str,
     case_insensitive: bool,
     context_lines: int,
+    include_ignored: bool,
 ) -> list[str]:
     """Compose a ripgrep argv reflecting the tool inputs."""
-    argv: list[str] = [rg, "--color=never", "--no-heading", "--line-number"]
+    argv: list[str] = [
+        rg,
+        "--color=never",
+        "--no-heading",
+        "--line-number",
+        "--max-columns",
+        "500",
+        "--max-columns-preview",
+    ]
+    if include_ignored:
+        argv.append("--no-ignore")
     if case_insensitive:
         argv.append("-i")
     if isinstance(glob, str) and glob:
@@ -220,10 +236,12 @@ def _build_grep_argv(
     output_mode: str,
     case_insensitive: bool,
     context_lines: int,
+    include_ignored: bool,
 ) -> list[str]:
     """Compose a POSIX-grep argv as a fallback when ripgrep isn't installed."""
     argv: list[str] = ["grep", "-r", "-n", "-I"]
-    argv.extend(f"--exclude-dir={d}" for d in _EXCLUDED_DIRS)
+    excluded_dirs = (".git",) if include_ignored else _EXCLUDED_DIRS
+    argv.extend(f"--exclude-dir={d}" for d in excluded_dirs)
     if case_insensitive:
         argv.append("-i")
     if isinstance(glob, str) and glob:

{delos_cli-2.0.2 → delos_cli-2.1.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "delos-cli"
-version = "2.0.2"
+version = "2.1.0"
 description = "Terminal REPL for the Delos agent — the Claude-Code-style CLI for Delos."
 readme = "README.md"
 license = { text = "MIT" }
@@ -21,6 +21,7 @@ classifiers = [
   "Topic :: Utilities",
 ]
 dependencies = [
+  "sentry-sdk>=2.44.0,<3",
   "typer>=0.12.5",
   "rich>=13.8.0",
   "prompt_toolkit>=3.0.47",
@@ -39,7 +40,7 @@ dependencies = [
 ]
 
 [project.scripts]
-delos = "delos_cli.main:app"
+delos = "delos_cli.telemetry:main"
 
 [project.urls]
 Homepage = "https://delos.so"
@@ -50,11 +51,11 @@ Issues = "https://github.com/Delos-Intelligence/cosmos-saas/issues"
 requires = ["hatchling"]
 build-backend = "hatchling.build"
 
+[tool.hatch.build]
+exclude = [
+  "/bench/.toolchain",
+  "/bench/fixture/.ruff_cache",
+]
+
 [tool.hatch.build.targets.wheel]
 packages = ["delos_cli"]
-
-[tool.hatch.build.targets.sdist]
-# hatchling only reads the .gitignore next to this pyproject, not the repo
-# root's — so bench/.toolchain (a venv with absolute symlinks) would end up in
-# the sdist and break `uv build`. List what ships instead.
-include = ["delos_cli", "README.md", "pyproject.toml"]