devops-bot-sdk 1.4.129__tar.gz → 1.4.139__tar.gz

{devops_bot_sdk-1.4.129 → devops_bot_sdk-1.4.139}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.4.129
+Version: 1.4.139
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.4.129 → devops_bot_sdk-1.4.139}/devops_bot_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.4.129
+Version: 1.4.139
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.4.129 → devops_bot_sdk-1.4.139}/devops_bot_sdk.egg-info/SOURCES.txt

@@ -85,4 +85,5 @@ sdk/ui/static/setup.html
 sdk/ui/static/styles.css
 sdk/ui/static/tickets.html
 tests/test_agent_chat_features.py
+tests/test_agent_prompt_models.py
 tests/test_agents_connectors_builder.py

{devops_bot_sdk-1.4.129 → devops_bot_sdk-1.4.139}/sdk/__init__.py

@@ -1,6 +1,6 @@
 """AgentOS Desktop SDK — thin HTTPS/SSE client for the Electron app.
 
-Version: 1.4.129
+Version: 1.4.139
 
 Public surface:
   BackendClient.from_config()        — create client from ~/.agentos/config.toml
@@ -30,7 +30,7 @@ Rules:
   - All data egress through submit_webhook only
 """
 
-__version__ = "1.4.129"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
+__version__ = "1.4.139"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
 __author__  = "AgentOS"   # sdk.client.SDK_VERSION and the UI server version all read this.
 
 from sdk.client import BackendClient

{devops_bot_sdk-1.4.129 → devops_bot_sdk-1.4.139}/sdk/client.py

@@ -20,15 +20,15 @@ from typing import Any, AsyncGenerator
 import httpx
 
 from sdk.exceptions import (
-    BackendAuthFailed, BackendFeatureMissing, BackendUnreachable, BackendVersionTooOld,
-    TokenNotConfigured,
+    BackendAuthFailed, BackendFeatureMissing, BackendPermissionDenied, BackendUnreachable,
+    BackendVersionTooOld, TokenNotConfigured,
 )
 from sdk.models.envelope import Envelope
 from sdk.models.requests import (
     ChatRequest, OrchestrateRequest, OrchestratorRequest, WebhookPayload,
 )
 from sdk.models.responses import (
-    BootstrapData, ChatHistory, OAuthStarted, PipelineResult, PipelineStatus,
+    BootstrapData, ChatHistory, CustomAgent, DepartmentAgent, OAuthStarted, PipelineResult, PipelineStatus,
     ThreadSummary, UserProfile, WebhookAck,
     OrchestrateAutoStatusResponse, OrchestrateAutoStopResponse, OrchestrateAutoResumeResponse,
     OrchestrateAutoStopAllResponse, OrchestrateAutoResumeAllResponse,
@@ -164,6 +164,15 @@ class BackendClient:
         user = data.get("user") or {}
         role = user.get("role") or {}
         dept = user.get("department") or {}
+        # Department head id — the backend gates department-agent writes on
+        # `departments.head_user_id`. Accept the field under any of the shapes the
+        # ML backend might use; empty when it isn't surfaced (then headship falls
+        # back to role tier — see UserProfile.is_department_head).
+        head_id = (
+            dept.get("headUserId") or dept.get("head_user_id")
+            or (dept.get("head") or {}).get("id")
+            or user.get("departmentHeadId") or ""
+        )
         return UserProfile(
             user_id=str(user.get("id") or ""),
             email=str(user.get("email") or ""),
@@ -172,6 +181,7 @@ class BackendClient:
             user_type=str(user.get("userType") or "").lower(),
             department_id=(user.get("departmentId") or dept.get("id") or None),
             department_title=str(dept.get("title") or ""),
+            department_head_id=str(head_id or ""),
         )
 
     # ── Chatbot SSE ────────────────────────────────────────────────────
@@ -1217,6 +1227,19 @@ class BackendClient:
         _check_status(resp.status_code, self._base_url)
         return resp.json().get("agents", [])
 
+    async def get_custom_agents(self) -> list[CustomAgent]:
+        """GET /api/v1/agents → parsed :class:`CustomAgent` rows.
+
+        The typed counterpart to :meth:`list_custom_agents` (which returns raw
+        dicts for existing dict-based consumers). Each row is validated into a
+        ``CustomAgent`` — including the nested ``prompt`` (source / content /
+        specialty) — so callers get attribute access and IDE completion instead of
+        untyped dict lookups. The models are lenient (``extra=allow``), so unknown
+        backend fields pass through rather than failing validation.
+        """
+        rows = await self.list_custom_agents()
+        return [CustomAgent(**row) for row in rows]
+
     async def update_custom_agent(self, name: str, **fields) -> dict:
         """PATCH /api/v1/agents/{name} — update fields on a custom agent."""
         async with httpx.AsyncClient(timeout=15.0) as client:
@@ -1261,6 +1284,54 @@ class BackendClient:
         _check_status(resp.status_code, self._base_url)
         return resp.json().get("agents", [])
 
+    async def get_department_agents(self) -> list[DepartmentAgent]:
+        """GET /api/v1/department-agents → parsed :class:`DepartmentAgent` rows.
+
+        The typed counterpart to :meth:`list_department_agents` (which returns raw
+        dicts for agentd's manifest path). Each row is validated into a
+        ``DepartmentAgent`` — including the nested ``prompt`` (source / content /
+        specialty) — so callers get attribute access and IDE completion instead of
+        untyped dict lookups. The models are lenient (``extra=allow``), so unknown
+        backend fields pass through rather than failing validation.
+        """
+        rows = await self.list_department_agents()
+        return [DepartmentAgent(**row) for row in rows]
+
+    async def delete_department_agent(self, name: str) -> None:
+        """DELETE /api/v1/department-agents/{name} — remove a department default agent.
+
+        HEAD-GATED server-side: the backend authorises this only for the caller's
+        department head (or ``master``) via ``rbac.scopes.is_department_head`` and
+        returns **403** otherwise — this client does not (and cannot) re-check that
+        locally, so a non-head caller reaching here still fails at the backend. The
+        control panel hides Delete for non-heads (see UserProfile.is_department_head)
+        so a 403 is the exception, not the norm. Status changes (enable/disable) are
+        likewise head-only but not exposed here — agentd reads department agents
+        read-only and re-derives status on restart.
+        """
+        async with httpx.AsyncClient(timeout=15.0) as client:
+            resp = await client.delete(
+                self._url(f"/api/v1/department-agents/{name}"),
+                headers=self._headers,
+            )
+        if resp.status_code == 404:
+            raise BackendFeatureMissing(
+                "Department agents", self._url(f"/api/v1/department-agents/{name}"),
+            )
+        if resp.status_code == 403:
+            # _check_status lets 403 through; surface it as a permission error so
+            # the UI can say "head/manager only" rather than silently "succeeding".
+            detail = ""
+            try:
+                detail = (resp.json() or {}).get("detail") or ""
+            except Exception:  # noqa: BLE001 — non-JSON body
+                pass
+            raise BackendPermissionDenied(
+                detail or "Only the department head can delete a department agent.",
+                self._url(f"/api/v1/department-agents/{name}"),
+            )
+        _check_status(resp.status_code, self._base_url)
+
     # NOTE: the legacy per-department "default agents" endpoints
     # (/departments/{id}/default-agents[/seed|/activate|...]) were retired — that
     # table never existed. Department defaults are now plain rows in the `agents`

{devops_bot_sdk-1.4.129 → devops_bot_sdk-1.4.139}/sdk/exceptions.py

@@ -69,6 +69,21 @@ class BackendFeatureMissing(Exception):
         self.url = url
 
 
+class BackendPermissionDenied(Exception):
+    """Raised when the backend returns HTTP 403 — the caller is authenticated but
+    not authorised for this action (e.g. a non-head deleting a department agent,
+    gated by ``rbac.scopes.is_department_head``).
+
+    Distinct from BackendAuthFailed (401, bad/absent token): here the token is
+    valid, the action isn't permitted. The UI maps this to a "you don't have
+    permission" message rather than re-prompting for a token.
+    """
+    def __init__(self, detail: str = "", url: str = "") -> None:
+        super().__init__(detail or f"Permission denied (HTTP 403 at {url}).")
+        self.detail = detail
+        self.url = url
+
+
 class CollectorError(Exception):
     """Raised by collectors when a payload fails size or type validation."""
     def __init__(self, message: str, path: str = "") -> None:

{devops_bot_sdk-1.4.129 → devops_bot_sdk-1.4.139}/sdk/models/responses.py

@@ -43,17 +43,45 @@ class UserProfile(BaseModel):
     an employee may view/activate department agents but not create/edit/delete
     them; custom agents are unrestricted for everyone.
     """
-    user_id:          str = ""
-    email:            str = ""
-    role_slug:        str = ""
-    role_name:        str = ""
-    user_type:        str = ""
-    department_id:    str | None = None
-    department_title: str = ""
+    user_id:            str = ""
+    email:              str = ""
+    role_slug:          str = ""
+    role_name:          str = ""
+    user_type:          str = ""
+    department_id:      str | None = None
+    department_title:   str = ""
+    # `departments.head_user_id` when the profile exposes it (see
+    # `is_department_head`). Empty when the backend hasn't migrated / surfaced it.
+    department_head_id: str = ""
+
+    def _role(self) -> str:
+        """Normalised role token: lower-case, separators stripped
+        (so "team_lead"/"team-lead"/"teamlead" and "super-admin"/"superadmin"
+        all collapse to one form)."""
+        raw = (self.role_slug or self.user_type or "").lower()
+        return raw.replace("-", "").replace("_", "").replace(" ", "")
 
     @property
     def is_employee(self) -> bool:
-        return (self.role_slug or self.user_type or "").lower() == "employee"
+        return self._role() == "employee"
+
+    @property
+    def is_department_head(self) -> bool:
+        """True if the caller may perform head-gated department-agent writes
+        (delete). Mirrors the backend's ``rbac.scopes.is_department_head``:
+
+        - ``master`` / ``superadmin`` / ``executive`` tiers act as managers, OR
+        - the caller's id matches the department's ``head_user_id`` (when the
+          profile provides it).
+
+        Default-deny: an unknown role with no head match resolves to False, so a
+        non-head team-lead never sees Delete (the backend also enforces this — the
+        SDK gate only hides an action that would 403 anyway). The head-id path
+        activates automatically once the backend surfaces ``head_user_id``.
+        """
+        if self._role() in {"master", "superadmin", "executive"}:
+            return True
+        return bool(self.department_head_id) and self.department_head_id == self.user_id
 
 
 class PipelineStatus(BaseModel):
@@ -184,3 +212,59 @@ class OrchestrateAutoStatusResponse(BaseModel):
     auto_status: str = ""   # discovering | running | completed | failed | no_tasks | paused
     task_count:  int = 0
     tasks:       list[OrchestrateAutoTaskItem] = []
+
+
+# ── Custom / department agents ─────────────────────────────────────────
+# Both GET /api/v1/agents (custom) and GET /api/v1/department-agents share the
+# same backend row shape (`agents` table, projected by `_row_to_dict`); they
+# differ only in `relation_type` ("User"/"person" vs "Department"). The two
+# public models below extend one base so callers get a distinct, self-documenting
+# type per endpoint without duplicating the field list.
+
+class AgentPrompt(BaseModel):
+    """The `prompt` object on a custom / department agent row.
+
+    Lenient (extra=allow) so any backend-side additions (e.g. new prompt
+    metadata) survive parsing without an SDK bump.
+    """
+    model_config = {"extra": "allow"}
+
+    source:    str = ""   # e.g. "specialized/specialized-model-qa.md"
+    content:   str = ""   # the full system-prompt markdown
+    specialty: str = ""   # one-line description of what the agent does
+
+
+class _AgentRow(BaseModel):
+    """Shared shape of one `agents`-table row as the backend serialises it.
+
+    Lenient (extra=allow) so fields not modelled here (and any future ones)
+    pass through untouched. Only `status == "active"` rows are scheduled by
+    agentd; the model keeps whatever the backend sent.
+    """
+    model_config = {"extra": "allow"}
+
+    id:            str = ""
+    name:          str = ""
+    media:         str | None = None
+    relation_type: str = ""      # "User" / "person" (custom) | "Department"
+    relation_id:   str = ""      # the owner id (user or department)
+    created_at:    str = ""
+    updated_at:    str = ""
+    status:        str = ""      # "active" | "inactive"
+    prompt:        AgentPrompt | None = None
+    secrets:       list[Any] = []
+    skills:        list[Any] = []
+
+    @property
+    def is_active(self) -> bool:
+        return (self.status or "").lower() == "active"
+
+
+class CustomAgent(_AgentRow):
+    """One row from GET /api/v1/agents — a personal custom agent visible to the
+    caller under RBAC (`relation_type` is "User"/"person")."""
+
+
+class DepartmentAgent(_AgentRow):
+    """One row from GET /api/v1/department-agents — a department's default agent
+    (`relation_type` is "Department")."""

{devops_bot_sdk-1.4.129 → devops_bot_sdk-1.4.139}/sdk/ui/api.py

@@ -384,11 +384,17 @@ async def ui_profile() -> dict:
         return {
             "role_slug": p.role_slug, "role_name": p.role_name,
             "department_id": p.department_id or "", "department_title": p.department_title,
+            # is_manager (team_lead+) gates the Prompt Studio save-as-department
+            # choice AND the department-agent Edit affordance. is_department_head
+            # (manager/head — or master/executive) additionally gates Delete on a
+            # department agent, mirroring the backend's head-only write check.
             "is_manager": not p.is_employee,
+            "is_department_head": p.is_department_head,
         }
     except Exception as exc:  # noqa: BLE001
         return {"role_slug": "", "role_name": "", "department_id": "",
-                "department_title": "", "is_manager": False, "error": str(exc)}
+                "department_title": "", "is_manager": False,
+                "is_department_head": False, "error": str(exc)}
 
 
 @router.get("/agents/vars", dependencies=[_auth])
@@ -975,6 +981,32 @@ async def default_agents(department_id: str = Query("")) -> dict:
     return {"department_id": dept, "agents": agents, "defaults_error": ""}
 
 
+@router.delete("/default-agents", dependencies=[_auth])
+async def delete_default_agent(name: str = Query(...)) -> dict:
+    """Delete a department default agent by name — HEAD/MANAGER ONLY.
+
+    Proxies DELETE /api/v1/department-agents/{name}, which the AI backend gates
+    to the department head (or master). The control panel already hides Delete for
+    non-heads (see /profile's ``is_department_head``); this maps a backend 403 to
+    HTTP 403 so a non-head who reaches here anyway gets a clear permission error
+    rather than a silent success.
+    """
+    from sdk.client import BackendClient
+    from sdk.exceptions import BackendFeatureMissing, BackendPermissionDenied
+
+    try:
+        await BackendClient.from_config().delete_department_agent(name)
+    except BackendPermissionDenied as exc:
+        raise HTTPException(status_code=403, detail=str(exc))
+    except BackendFeatureMissing:
+        raise HTTPException(
+            status_code=404,
+            detail=("Department agent management isn't available on this backend — "
+                    "it may be running an older version."),
+        )
+    return {"name": name, "deleted": True}
+
+
 # ── Dashboard reads ────────────────────────────────────────────────────────
 
 @router.get("/dashboard", dependencies=[_auth])

{devops_bot_sdk-1.4.129 → devops_bot_sdk-1.4.139}/sdk/ui/static/app.js

@@ -80,6 +80,66 @@
 
   window.AgentOS = { api, toast, esc };
 
+  // ── Role gates: cached profile (fetched once per page load) ────────────────
+  // is_manager: team_lead+ (may Edit a department agent). is_department_head:
+  // manager/head or master/executive (may additionally Delete one). Default-deny
+  // on error so a failed lookup hides privileged actions rather than exposing them.
+  let _profileCache = null;
+  async function getProfile() {
+    if (_profileCache) return _profileCache;
+    try { _profileCache = await api("/api/ui/profile"); }
+    catch (e) { _profileCache = { is_manager: false, is_department_head: false }; }
+    return _profileCache;
+  }
+
+  // ── Agent prompt-shape readers ─────────────────────────────────────────────
+  // Prompt shapes differ by origin: department agents carry {content, specialty,
+  // source}; custom agents may carry {system_prompt, variables}. These read either
+  // so a card never shows blank content or a wrong variable count.
+  function agentPrompt(a) { return (a && a.prompt) || {}; }
+  function agentContent(a) { const p = agentPrompt(a); return String(p.content || p.system_prompt || "").trim(); }
+  function agentSpecialty(a) { const p = agentPrompt(a); return String(p.specialty || p.description || "").trim(); }
+  function agentVarNames(a) {
+    const vs = agentPrompt(a).variables || [];
+    return vs.map(v => (typeof v === "string" ? v : (v && v.name))).filter(Boolean);
+  }
+  function agentSummary(a) { return agentSpecialty(a) || agentContent(a).slice(0, 200); }
+
+  // One agent card: clickable name toggles an inline panel with the full prompt
+  // content. `actionsHTML` is the role-gated button row the caller supplies.
+  function agentCardHTML(a, actionsHTML) {
+    const content = agentContent(a);
+    const summary = agentSummary(a);
+    const src = agentPrompt(a).source || "";
+    const nvars = agentVarNames(a).length;
+    const nskills = (a.skills || []).length;
+    const on = a.status === "disabled" ? "off" : "on";
+    return `<div class="agent-card">
+       <div class="agent-head">
+         <button type="button" class="agent-name linklike" data-toggle-content title="Show / hide the full prompt">${esc(a.name)}</button>
+         <span class="pill ${on}">${esc(a.status || "active")}</span>
+       </div>
+       <div class="agent-meta">${nvars} variable(s) · ${nskills} skill(s)${src ? " · <span class='muted'>" + esc(src) + "</span>" : ""}</div>
+       <div class="agent-desc">${summary ? esc(summary) : "<span class='muted'>No description provided.</span>"}</div>
+       <div class="agent-content" hidden>${content ? "<pre>" + esc(content) + "</pre>" : "<div class='muted'>No prompt content available for this agent.</div>"}</div>
+       <div class="agent-actions">${actionsHTML}</div>
+     </div>`;
+  }
+
+  // Wire clickable names (toggle) + Edit buttons (reveal) to their card's content
+  // panel. Call after rendering a list of agentCardHTML() cards into `container`.
+  function wireContentToggles(container) {
+    const panelOf = (el) => { const c = el.closest(".agent-card"); return c && c.querySelector(".agent-content"); };
+    container.querySelectorAll("[data-toggle-content]").forEach(b => b.onclick = () => {
+      const p = panelOf(b); if (p) p.hidden = !p.hidden;
+    });
+    // Edit = open the content view (read-only): reveal the panel and scroll to it.
+    container.querySelectorAll("[data-edit]").forEach(b => b.onclick = () => {
+      const p = panelOf(b);
+      if (p) { p.hidden = false; p.scrollIntoView({ block: "nearest" }); }
+    });
+  }
+
   // ── Unlock gate ──────────────────────────────────────────────────────────
   function setGateMsg(m) { const el = document.getElementById("gate-msg"); if (el) el.textContent = m || ""; }
   function showGate(message) {
@@ -169,31 +229,38 @@
 
     async function loadDefaults() {
       try {
-        const d = await api("/api/ui/default-agents");
+        const [d, me] = [await api("/api/ui/default-agents"), await getProfile()];
         const rows = d.agents || [];
         if (!rows.length && d.defaults_error) {
           $("default-list").innerHTML =
             `<div class="empty">${esc(d.defaults_error)} Ask an admin to update the AI backend.</div>`;
           return;
         }
+        // Role gates (department agents): everyone Runs + views the content;
+        // team_lead+ also sees Edit (read view); only a department head/manager
+        // sees Delete (the backend enforces head-only regardless).
         $("default-list").innerHTML = rows.length ? rows.map(a => {
-          const prompt = a.prompt || {};
-          const summary = (prompt.system_prompt || "").trim().slice(0, 200);
-          const nvars = (prompt.variables || []).length;
-          const nskills = (a.skills || []).length;
-          return `<div class="agent-card">
-             <div class="agent-head">
-               <span class="agent-name">${esc(a.name)}</span>
-               <span class="pill ${a.status === "disabled" ? "off" : "on"}">${esc(a.status || "active")}</span>
-             </div>
-             <div class="agent-meta">${nvars} variable(s) · ${nskills} skill(s)</div>
-             <div class="agent-desc">${esc(summary)}</div>
-             <div class="agent-actions">
-               <a class="btn primary" href="/agents.html?agent=${encodeURIComponent(a.name)}">Run</a>
-             </div>
-           </div>`;
+          const enc = encodeURIComponent(a.name);
+          const actions = [
+            `<a class="btn primary" href="/agents.html?agent=${enc}">Run</a>`,
+            me.is_manager ? `<button class="btn" data-edit="${esc(a.name)}">Edit</button>` : "",
+            me.is_department_head ? `<button class="btn danger" data-del-dept="${esc(a.name)}">Delete</button>` : "",
+          ].filter(Boolean).join("");
+          return agentCardHTML(a, actions);
         }).join("")
           : "<div class='empty'>No default agents for your department yet. They're created in the web app.</div>";
+
+        const list = $("default-list");
+        wireContentToggles(list);
+        list.querySelectorAll("[data-del-dept]").forEach(b => b.onclick = async () => {
+          const name = b.dataset.delDept;
+          if (!confirm("Delete department agent '" + name + "'? This removes it for the whole department.")) return;
+          try {
+            await api("/api/ui/default-agents?name=" + encodeURIComponent(name), { method: "DELETE" });
+            toast("Deleted " + name, "ok");
+            loadDefaults();
+          } catch (e) { toast("Delete failed: " + (e.message || ""), "err"); }
+        });
       } catch (e) { toast("Could not load default agents", "err"); }
     }
 
@@ -664,28 +731,22 @@
             : `<option value="">(no agents yet)</option>`;
           onAgentSelect();
         }
+        // Custom agents: full control for everyone (view / Edit-content / enable /
+        // disable / delete) — RBAC applies only to department agents.
         $("local-agents").innerHTML = rows.length ? rows.map(a => {
-          const prompt = a.prompt || {};
-          const summary = (prompt.system_prompt || "").trim().slice(0, 200);
-          const nvars = (prompt.variables || []).length;
-          const nskills = (a.skills || []).length;
-          return `<div class="agent-card">
-             <div class="agent-head">
-               <span class="agent-name">${esc(a.name)}</span>
-               <span class="pill ${a.status === "disabled" ? "off" : "on"}">${esc(a.status || "active")}</span>
-             </div>
-             <div class="agent-meta">${nvars} variable(s) · ${nskills} skill(s)</div>
-             <div class="agent-desc">${esc(summary)}</div>
-             <div class="agent-actions">
-               <a class="btn primary" href="/agents.html?agent=${encodeURIComponent(a.name)}">Run</a>
-               <button class="btn" data-enable="${esc(a.name)}">Enable</button>
-               <button class="btn" data-disable="${esc(a.name)}">Disable</button>
-               <button class="btn danger" data-del="${esc(a.name)}">Delete</button>
-             </div>
-           </div>`;
+          const enc = encodeURIComponent(a.name);
+          const actions = [
+            `<a class="btn primary" href="/agents.html?agent=${enc}">Run</a>`,
+            `<button class="btn" data-edit="${esc(a.name)}">Edit</button>`,
+            `<button class="btn" data-enable="${esc(a.name)}">Enable</button>`,
+            `<button class="btn" data-disable="${esc(a.name)}">Disable</button>`,
+            `<button class="btn danger" data-del="${esc(a.name)}">Delete</button>`,
+          ].join("");
+          return agentCardHTML(a, actions);
         }).join("")
           : "<div class='empty'>No custom agents assigned to you yet. Agents are created in the web app.</div>";
 
+        wireContentToggles($("local-agents"));
         $("local-agents").querySelectorAll("[data-enable]").forEach(b => b.onclick = () => setStatus(b.dataset.enable, "active"));
         $("local-agents").querySelectorAll("[data-disable]").forEach(b => b.onclick = () => setStatus(b.dataset.disable, "disabled"));
         $("local-agents").querySelectorAll("[data-del]").forEach(b => b.onclick = async () => {

{devops_bot_sdk-1.4.129 → devops_bot_sdk-1.4.139}/sdk/ui/static/styles.css

@@ -233,8 +233,23 @@ tr:last-child td { border-bottom: none; }
 }
 .agent-card .agent-head { display: flex; align-items: center; justify-content: space-between; gap: 8px; }
 .agent-name { font-weight: 700; font-size: 14px; }
+/* Clickable agent name — reveals the full prompt below. Looks like a link, keeps
+   the bold agent-name weight; no default button chrome. */
+.agent-name.linklike {
+  background: none; border: 0; padding: 0; margin: 0; cursor: pointer;
+  color: var(--text); text-align: left; font: inherit; font-weight: 700;
+}
+.agent-name.linklike:hover { color: var(--accent, #4c8bf5); text-decoration: underline; }
 .agent-meta { font-size: 12px; color: var(--muted); }
 .agent-desc { font-size: 13px; color: var(--text); opacity: .85; min-height: 18px; }
+.agent-content {
+  border-top: 1px dashed var(--border); margin-top: 4px; padding-top: 8px;
+}
+.agent-content pre {
+  margin: 0; max-height: 340px; overflow: auto; white-space: pre-wrap;
+  word-break: break-word; font-size: 12px; line-height: 1.45;
+  color: var(--text); opacity: .92;
+}
 .agent-actions { display: flex; gap: 6px; margin-top: 6px; flex-wrap: wrap; }
 
 .pill { font-size: 11px; padding: 2px 8px; border-radius: 999px; font-weight: 600; white-space: nowrap; }

devops_bot_sdk-1.4.139/tests/test_agent_prompt_models.py

@@ -0,0 +1,165 @@
+"""Lock-in tests for the agent-prompt request models and their Swagger shape.
+
+These models (``sdk/ui/models.py``) intentionally MIRROR the AI backend's
+``routes/agent_prompt.py`` request schemas field-for-field, so one JSON body
+works against both ``/api/v1/agent-prompt/*`` (backend) and
+``/api/ui/agent-prompt/*`` (this SDK). DBAI-101 hardens that contract: ``verify``
+enforces a stripped ``len >= 10`` rule, ``generate``/``regenerate`` reject empty
+required fields (all as HTTP 422), and neither the body nor any ``X-SDK-URL``
+header may steer the SDK target.
+
+This module pins that behaviour so it cannot silently drift out of alignment
+with the backend. The validation tests need only ``pydantic`` (a core dep); the
+OpenAPI/Swagger test needs the ``[ui]`` extra (``fastapi``) and is skipped when
+it is absent.
+"""
+from __future__ import annotations
+
+import pytest
+from pydantic import ValidationError
+
+from sdk.ui.models import (
+    AgentPromptGenerateRequest,
+    PromptRegenerateRequest,
+    PromptVerifyRequest,
+)
+
+# The exact messages the backend's VerifyPrompt/Generate/Regenerate validators
+# must also surface — a caller can rely on one message across both repos.
+_VERIFY_MSG = "Write a system prompt first (a bit longer)."
+_GENERATE_MSG = "agent_name, agent_type, and job are required."
+_REGENERATE_MSG = "system_prompt is required."
+
+
+def _first_error(exc: ValidationError) -> tuple[tuple, str]:
+    err = exc.errors()[0]
+    return tuple(err["loc"]), err["msg"]
+
+
+# ── verify: stripped, non-empty, len >= 10 ───────────────────────────────────
+
+def test_verify_rejects_empty():
+    with pytest.raises(ValidationError) as ei:
+        PromptVerifyRequest(system_prompt="")
+    loc, msg = _first_error(ei.value)
+    assert loc == ("system_prompt",)
+    assert _VERIFY_MSG in msg
+
+
+def test_verify_rejects_short_after_strip():
+    # 9 visible chars once stripped → below the len >= 10 floor.
+    with pytest.raises(ValidationError) as ei:
+        PromptVerifyRequest(system_prompt="   shortpro   ")
+    loc, msg = _first_error(ei.value)
+    assert loc == ("system_prompt",)
+    assert _VERIFY_MSG in msg
+
+
+def test_verify_accepts_valid_and_strips():
+    body = PromptVerifyRequest(system_prompt="  You are a helpful agent.  ")
+    assert body.system_prompt == "You are a helpful agent."
+    assert body.engine == "claude_code"  # shared default with the backend
+
+
+def test_verify_engine_is_passthrough():
+    # ``engine`` is part of the shared contract; the field is accepted verbatim.
+    assert PromptVerifyRequest(system_prompt="x" * 10, engine="server").engine == "server"
+
+
+# ── generate: agent_name / agent_type / job all required ──────────────────────
+
+@pytest.mark.parametrize("field", ["agent_name", "agent_type", "job"])
+def test_generate_rejects_empty_required_field(field):
+    kwargs = {"agent_name": "Notes", "agent_type": "docs", "job": "write notes"}
+    kwargs[field] = "   "  # whitespace-only → empty after strip
+    with pytest.raises(ValidationError) as ei:
+        AgentPromptGenerateRequest(**kwargs)
+    loc, msg = _first_error(ei.value)
+    assert loc == (field,)
+    assert _GENERATE_MSG in msg
+
+
+def test_generate_accepts_valid():
+    body = AgentPromptGenerateRequest(
+        agent_name=" Release Notes ", agent_type=" documentation ", job=" summarise diffs "
+    )
+    assert body.agent_name == "Release Notes"
+    assert body.agent_type == "documentation"
+    assert body.job == "summarise diffs"
+    assert body.context == ""
+    assert body.engine == "claude_code"
+
+
+# ── regenerate: system_prompt required, context fields optional ───────────────
+
+def test_regenerate_rejects_empty_system_prompt():
+    with pytest.raises(ValidationError) as ei:
+        PromptRegenerateRequest(system_prompt="   ")
+    loc, msg = _first_error(ei.value)
+    assert loc == ("system_prompt",)
+    assert _REGENERATE_MSG in msg
+
+
+def test_regenerate_accepts_valid_with_optional_defaults():
+    body = PromptRegenerateRequest(system_prompt="Existing prompt to improve")
+    assert body.system_prompt == "Existing prompt to improve"
+    assert body.feedback == ""
+    assert body.agent_name == body.agent_type == body.job == ""
+    assert body.engine == "claude_code"
+
+
+# ── field-for-field alignment guard (mirror, don't diverge) ───────────────────
+
+def test_shared_engine_default_is_claude_code():
+    # All three shared models default engine to claude_code — the SDK always runs
+    # locally, so it accepts the field for parity and never 400s on other values.
+    assert PromptVerifyRequest.model_fields["engine"].default == "claude_code"
+    assert AgentPromptGenerateRequest.model_fields["engine"].default == "claude_code"
+    assert PromptRegenerateRequest.model_fields["engine"].default == "claude_code"
+
+
+def test_model_fields_match_backend_contract():
+    # If the backend adds/removes a field, this catches the drift so the two
+    # repos are updated together (DBAI-101 full-stack coordination rule).
+    assert set(PromptVerifyRequest.model_fields) == {"system_prompt", "engine"}
+    assert set(AgentPromptGenerateRequest.model_fields) == {
+        "agent_name", "agent_type", "job", "context", "engine",
+    }
+    assert set(PromptRegenerateRequest.model_fields) == {
+        "system_prompt", "feedback", "agent_name", "agent_type", "job", "engine",
+    }
+
+
+# ── Swagger / OpenAPI: no X-SDK-URL, final body shape (needs the [ui] extra) ──
+
+def test_openapi_agent_prompt_shape_has_no_sdk_url_header():
+    pytest.importorskip("fastapi")
+    import json
+
+    from sdk.ui.server import create_app
+
+    spec = create_app().openapi()
+
+    # G-1/G-4: the target is never caller-steerable — no header anywhere.
+    blob = json.dumps(spec)
+    assert "X-SDK-URL" not in blob
+    assert "x_sdk_url" not in blob
+
+    paths = {
+        "/api/ui/agent-prompt/generate",
+        "/api/ui/agent-prompt/regenerate",
+        "/api/ui/agent-prompt/verify",
+    }
+    assert paths <= set(spec["paths"])
+
+    # None of the three routes expose a header parameter.
+    for p in paths:
+        params = spec["paths"][p]["post"].get("parameters", [])
+        assert [pr for pr in params if pr.get("in") == "header"] == []
+
+    # verify body is PromptVerifyRequest → {system_prompt, engine}.
+    verify = spec["paths"]["/api/ui/agent-prompt/verify"]["post"]
+    ref = verify["requestBody"]["content"]["application/json"]["schema"]["$ref"]
+    model = ref.rsplit("/", 1)[-1]
+    props = spec["components"]["schemas"][model]["properties"]
+    assert set(props) == {"system_prompt", "engine"}