devops-bot-sdk 1.4.1__tar.gz → 1.4.6__tar.gz

{devops_bot_sdk-1.4.1 → devops_bot_sdk-1.4.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.4.1
+Version: 1.4.6
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.4.1 → devops_bot_sdk-1.4.6}/devops_bot_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.4.1
+Version: 1.4.6
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.4.1 → devops_bot_sdk-1.4.6}/devops_bot_sdk.egg-info/SOURCES.txt

@@ -24,6 +24,8 @@ sdk/collectors/__init__.py
 sdk/collectors/files.py
 sdk/collectors/process.py
 sdk/collectors/screenshot.py
+sdk/hooks/__init__.py
+sdk/hooks/crucial_guard.py
 sdk/ipc/__init__.py
 sdk/ipc/electron_bridge.py
 sdk/ipc/handlers.py

{devops_bot_sdk-1.4.1 → devops_bot_sdk-1.4.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "devops-bot-sdk"
-version = "1.4.1"
+version = "1.4.6"
 description = "DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app"
 readme = "README.md"
 license = "LicenseRef-Proprietary"

{devops_bot_sdk-1.4.1 → devops_bot_sdk-1.4.6}/sdk/__init__.py

@@ -1,6 +1,6 @@
 """AgentOS Desktop SDK — thin HTTPS/SSE client for the Electron app.
 
-Version: 1.4.1
+Version: 1.4.6
 
 Public surface:
   BackendClient.from_config()        — create client from ~/.agentos/config.toml
@@ -30,7 +30,7 @@ Rules:
   - All data egress through submit_webhook only
 """
 
-__version__ = "1.4.1"
+__version__ = "1.4.6"
 __author__  = "AgentOS"
 
 from sdk.client import BackendClient

{devops_bot_sdk-1.4.1 → devops_bot_sdk-1.4.6}/sdk/client.py

@@ -36,7 +36,7 @@ from sdk.sse import _check_status, stream_with_reconnect
 
 logger = logging.getLogger(__name__)
 
-SDK_VERSION    = "1.4.1"
+SDK_VERSION    = "1.4.6"
 _POLL_INTERVAL = 3.0
 _POLL_TIMEOUT  = 600.0
 _ORCHESTRATE_TIMEOUT      = 2700.0  # 45 min — covers approval wait + VPS execution time

devops_bot_sdk-1.4.6/sdk/crucial.py

@@ -0,0 +1,217 @@
+"""Mid-run crucial-decision gate.
+
+When agentMode=true, the agent must PAUSE for human approval before a crucial /
+irreversible action (DB schema changes/migrations, dropping data, destructive
+shell, prod deploy, auth/billing changes, or anything the operator flagged in
+humanInstructions).
+
+Mechanism: the prompt instructs the agent to STOP and emit a one-line marker
+before any such action. The SDK detects the marker, opens an approval gate, and
+resumes the session on approval. (A Claude Code PreToolUse *blocking* hook is a
+planned hardening on top of this — its block protocol needs verifying against
+the installed claude version.)
+"""
+from __future__ import annotations
+
+import json
+import os
+import re
+import shlex
+
+MARKER = "AGENTOS_APPROVAL_REQUIRED:"
+
+# ── Hard-enforcement file protocol (PreToolUse hook ⇄ SDK) ─────────────
+# Both files live inside a per-task approval dir (AGENTOS_APPROVAL_DIR). The
+# hook writes PENDING_FILE when it blocks a destructive call; the SDK writes
+# GRANTED_FILE (one-shot) after a human approves, and the hook consumes it.
+GRANTED_FILE = "granted"
+PENDING_FILE = "pending"
+
+_BUILTIN_CRUCIAL = (
+    "Database schema changes or migrations (CREATE/ALTER/DROP TABLE, "
+    "prisma/alembic/knex/typeorm migrate, etc.)",
+    "Deleting or dropping data (DROP/TRUNCATE/DELETE, dropdb)",
+    "Destructive shell commands (rm -rf, git push --force, terraform destroy, "
+    "kubectl delete, dropping volumes)",
+    "Production deployment or release",
+    "Changes to authentication, secrets/credentials, billing or payment logic",
+)
+
+
+def crucial_prompt(human_instructions: str | None) -> str:
+    """Prompt block telling the agent when and how to pause for approval."""
+    items = "\n".join(f"- {x}" for x in _BUILTIN_CRUCIAL)
+
+    extra = ""
+    hi = human_instructions or ""
+    flagged = [
+        ln.strip() for ln in hi.splitlines()
+        if any(k in ln.lower() for k in ("crucial", "approval", "sensitive", "do not"))
+    ]
+    if flagged:
+        extra = "\nThe operator additionally marked these as crucial:\n" + "\n".join(
+            f"- {ln}" for ln in flagged[:10]
+        )
+
+    return (
+        "\n\n=== CRUCIAL-DECISION GATE (mandatory) ===\n"
+        "Before performing any CRUCIAL or IRREVERSIBLE action you MUST pause for "
+        "human approval. Crucial actions include:\n" + items + extra + "\n"
+        "When you reach such a step, DO NOT perform it. Output EXACTLY one line:\n"
+        f"{MARKER} <one-line description of the action needing approval>\n"
+        "then STOP and end your turn. Do not proceed until you are told it is approved."
+    )
+
+
+def detect_marker(text: str | None) -> str | None:
+    """Return the description after the marker, or None if not present."""
+    if not text:
+        return None
+    for line in text.splitlines():
+        if MARKER in line:
+            return line.split(MARKER, 1)[1].strip() or "crucial action"
+    return None
+
+
+# ── Destructive-action detection (used by the PreToolUse hook) ─────────
+
+# Bash command patterns that are crucial/irreversible. High-precision on
+# purpose: a false positive stalls the run on a WhatsApp approval, so routine
+# commands must NOT match (see _RM_SAFE_TARGET for the rm carve-out).
+_DESTRUCTIVE_BASH = (
+    (re.compile(r"\bgit\s+push\b[^\n]*(--force\b|--force-with-lease\b|(^|\s)-f\b)", re.I), "git force-push"),
+    (re.compile(r"\bgit\s+reset\s+--hard\b", re.I), "git reset --hard"),
+    (re.compile(r"\bgit\s+clean\s+-\w*f", re.I), "git clean -f"),
+    (re.compile(r"\bterraform\s+destroy\b", re.I), "terraform destroy"),
+    (re.compile(r"\bkubectl\s+delete\b", re.I), "kubectl delete"),
+    (re.compile(r"\bdropdb\b", re.I), "dropdb"),
+    (re.compile(r"\bDROP\s+(TABLE|DATABASE|SCHEMA)\b", re.I), "SQL DROP"),
+    (re.compile(r"\bTRUNCATE\b", re.I), "SQL TRUNCATE"),
+    (re.compile(r"\bDELETE\s+FROM\b", re.I), "SQL DELETE"),
+    (re.compile(r"\b(prisma|alembic|knex|sequelize|typeorm|rails|php\s+artisan)\b[^\n]*\bmigrat", re.I), "database migration"),
+    (re.compile(r"\b(mkfs|dd)\s", re.I), "disk format/overwrite"),
+    (re.compile(r"\b(npm|yarn|pnpm)\s+publish\b", re.I), "package publish"),
+    (re.compile(r"\bchmod\s+-R\s+777\b", re.I), "recursive chmod 777"),
+)
+
+# `rm -rf <target>` is routine for build artifacts but catastrophic for source
+# /data/system paths. Allow when EVERY target is a known throwaway dir; block
+# otherwise (incl. /, ~, .., the repo root, src, etc.).
+_RM_RECURSIVE = re.compile(r"\brm\s+-\S*[rf]", re.I)
+_RM_SAFE_TARGET = re.compile(
+    r"^[./]*(node_modules|dist|build|out|coverage|\.next|\.nuxt|\.svelte-kit|\.cache|"
+    r"\.turbo|\.angular|target|__pycache__|\.pytest_cache|\.parcel-cache|\.venv|venv|"
+    r"vendor|tmp|temp)([/\\].*)?$",
+    re.I,
+)
+
+# Files whose modification needs approval (secrets / private keys). Conservative:
+# exact `.env` and key/cert files only — scaffolding `.env.example`/`.env.local`
+# stays unblocked.
+_SENSITIVE_FILE = re.compile(r"(^|/)(\.env|id_rsa|id_ed25519|.*\.pem|.*\.key)$", re.I)
+
+
+def _rm_is_dangerous(cmd: str) -> bool:
+    """True if a recursive rm targets anything outside the safe throwaway set."""
+    if not _RM_RECURSIVE.search(cmd):
+        return False
+    # Targets = non-flag tokens after the first `rm`.
+    toks = cmd.split()
+    try:
+        start = toks.index("rm") + 1
+    except ValueError:
+        return True
+    targets = [t.strip("'\"") for t in toks[start:] if not t.startswith("-")]
+    if not targets:
+        return True
+    return any(not _RM_SAFE_TARGET.match(t) for t in targets)
+
+
+def is_destructive(tool_name: str, tool_input: dict | None) -> str | None:
+    """Return a short description if this tool call is crucial/destructive, else None."""
+    inp = tool_input or {}
+    if tool_name == "Bash":
+        cmd = str(inp.get("command", ""))
+        if _rm_is_dangerous(cmd):
+            return f"recursive delete (rm -rf): {cmd[:120]}"
+        for rx, desc in _DESTRUCTIVE_BASH:
+            if rx.search(cmd):
+                return f"{desc}: {cmd[:120]}"
+        return None
+    if tool_name in ("Write", "Edit", "MultiEdit"):
+        fp = str(inp.get("file_path", ""))
+        if fp and _SENSITIVE_FILE.search(fp):
+            return f"write to sensitive file: {fp}"
+    return None
+
+
+# ── File protocol helpers ──────────────────────────────────────────────
+
+def _granted_path(approval_dir: str) -> str:
+    return os.path.join(approval_dir, GRANTED_FILE)
+
+
+def _pending_path(approval_dir: str) -> str:
+    return os.path.join(approval_dir, PENDING_FILE)
+
+
+def grant(approval_dir: str) -> None:
+    """SDK: authorize the NEXT destructive action (one-shot)."""
+    try:
+        with open(_granted_path(approval_dir), "w") as f:
+            f.write("1")
+    except Exception:  # noqa: BLE001
+        pass
+
+
+def consume_grant(approval_dir: str) -> bool:
+    """Hook: if a one-shot grant exists, consume it and return True."""
+    try:
+        os.remove(_granted_path(approval_dir))
+        return True
+    except OSError:
+        return False
+
+
+def write_pending(approval_dir: str, desc: str) -> None:
+    """Hook: record the blocked action so the SDK can open the gate."""
+    try:
+        with open(_pending_path(approval_dir), "w") as f:
+            json.dump({"desc": desc}, f)
+    except Exception:  # noqa: BLE001
+        pass
+
+
+def read_pending(approval_dir: str) -> str | None:
+    """SDK: read + clear the pending blocked-action description, if any."""
+    try:
+        with open(_pending_path(approval_dir)) as f:
+            data = json.load(f) or {}
+        os.remove(_pending_path(approval_dir))
+        return data.get("desc") or "crucial action"
+    except (OSError, ValueError):
+        return None
+
+
+def hook_settings(python_exe: str, *, timeout: int = 15) -> dict:
+    """A `--settings` block registering this module as a PreToolUse guard.
+
+    Invoked as `<python_exe> -m sdk.hooks.crucial_guard` so it runs in the SDK's
+    own interpreter (where the `sdk` package is importable) regardless of cwd.
+    """
+    return {
+        "hooks": {
+            "PreToolUse": [
+                {
+                    "matcher": "Bash|Edit|Write|MultiEdit",
+                    "hooks": [
+                        {
+                            "type": "command",
+                            "command": f"{shlex.quote(python_exe)} -m sdk.hooks.crucial_guard",
+                            "timeout": timeout,
+                        }
+                    ],
+                }
+            ]
+        }
+    }

devops_bot_sdk-1.4.6/sdk/git_ops.py

@@ -0,0 +1,306 @@
+"""Local git operations — feature branch + PR via the user's GitHub token.
+
+Runs `git`/`gh` as subprocesses on the user's machine, authenticated with the
+token fetched from the backend (`/ml-api/github/token`). The SDK owns branching,
+commit, push and PR for the PRIMARY project so it's deterministic; the agent is
+told not to do git for that repo (it may still clone/PR other repos the ticket
+names). Everything here is best-effort and never raises into the run.
+"""
+from __future__ import annotations
+
+import asyncio
+import logging
+import os
+import re
+import shutil
+from pathlib import Path
+
+logger = logging.getLogger(__name__)
+
+
+def slugify(text: str | None, max_len: int = 40) -> str:
+    s = re.sub(r"[^a-z0-9]+", "-", (text or "").lower()).strip("-")
+    return s[:max_len].strip("-") or "task"
+
+
+def _git_env(github_token: str | None) -> dict:
+    env = dict(os.environ)
+    if github_token:
+        # Token present → authenticate git transport over HTTPS with the token.
+        env["GH_TOKEN"] = github_token
+        env["GITHUB_TOKEN"] = github_token
+        env["GIT_CONFIG_COUNT"] = "1"
+        env["GIT_CONFIG_KEY_0"] = (
+            f"url.https://x-access-token:{github_token}@github.com/.insteadOf"
+        )
+        env["GIT_CONFIG_VALUE_0"] = "https://github.com/"
+    else:
+        # No token → use the box's SSH keys: rewrite GitHub HTTPS URLs to SSH so
+        # clone / fetch / push authenticate via SSH. (PR creation itself still
+        # goes through `gh`, using its own stored auth — SSH can't open a PR.)
+        env.pop("GH_TOKEN", None)
+        env.pop("GITHUB_TOKEN", None)
+        env["GIT_CONFIG_COUNT"] = "1"
+        env["GIT_CONFIG_KEY_0"] = "url.git@github.com:.insteadOf"
+        env["GIT_CONFIG_VALUE_0"] = "https://github.com/"
+    env.setdefault("GIT_AUTHOR_NAME", "AgentOS")
+    env.setdefault("GIT_AUTHOR_EMAIL", "agentos@users.noreply.github.com")
+    env.setdefault("GIT_COMMITTER_NAME", "AgentOS")
+    env.setdefault("GIT_COMMITTER_EMAIL", "agentos@users.noreply.github.com")
+    return env
+
+
+async def _run(cmd: list[str], cwd: str, env: dict, timeout: float = 120.0):
+    """Run a command; return (returncode, stdout, stderr). Never raises."""
+    try:
+        proc = await asyncio.create_subprocess_exec(
+            *cmd, cwd=cwd, env=env,
+            stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.PIPE,
+        )
+        out, err = await asyncio.wait_for(proc.communicate(), timeout=timeout)
+        return (
+            proc.returncode,
+            out.decode("utf-8", "replace").strip(),
+            err.decode("utf-8", "replace").strip(),
+        )
+    except Exception as exc:  # noqa: BLE001
+        return 1, "", str(exc)
+
+
+async def _is_git_repo(path: str, env: dict) -> bool:
+    rc, out, _ = await _run(["git", "rev-parse", "--is-inside-work-tree"], path, env)
+    return rc == 0 and out == "true"
+
+
+async def detect_default_branch(path: str, env: dict) -> str:
+    """Repo default branch — the PR base.
+
+    Must NEVER return a `feature/*` branch: on a re-run the working tree may
+    already be checked out ON the feature branch, and returning that as the base
+    makes base == head (GitHub rejects with "No commits between X and X"). Tries,
+    in order: origin/HEAD → the remote's advertised HEAD → main/master if they
+    exist → the current branch only if it isn't a feature branch → "main".
+    """
+    # 1. Local symbolic ref for origin/HEAD (set by `git clone` / `remote set-head`).
+    rc, out, _ = await _run(
+        ["git", "symbolic-ref", "refs/remotes/origin/HEAD"], path, env,
+    )
+    if rc == 0 and "/" in out:
+        return out.rsplit("/", 1)[-1]
+    # 2. Ask the remote directly — works even when origin/HEAD isn't set locally.
+    rc, out, _ = await _run(["git", "remote", "show", "origin"], path, env, timeout=60.0)
+    if rc == 0:
+        m = re.search(r"HEAD branch:\s*(\S+)", out)
+        if m and m.group(1) not in ("", "(unknown)"):
+            return m.group(1)
+    # 3. Common defaults, if they exist as remote-tracking branches.
+    for cand in ("main", "master"):
+        rc, _, _ = await _run(
+            ["git", "rev-parse", "--verify", "--quiet", f"origin/{cand}"], path, env,
+        )
+        if rc == 0:
+            return cand
+    # 4. Last resort: the current branch, but never a feature branch.
+    rc, out, _ = await _run(["git", "rev-parse", "--abbrev-ref", "HEAD"], path, env)
+    if rc == 0 and out and not out.startswith("feature/"):
+        return out
+    return "main"
+
+
+async def ensure_repo(
+    project_path: str, repo_url: str | None, github_token: str | None,
+) -> bool:
+    """Make sure ``project_path`` is a usable git repo, cloning if needed.
+
+    - Already a populated git repo → True.
+    - Missing or empty dir + a known ``repo_url`` → clone it there, then True.
+    - Non-empty but not a git repo → False (don't clobber the user's files).
+    Best-effort; never raises.
+    """
+    path = Path(project_path).expanduser()
+    env = _git_env(github_token)
+
+    has_content = path.is_dir() and any(path.iterdir())
+    if has_content:
+        if await _is_git_repo(str(path), env):
+            return True
+        logger.warning("git_ops.path_not_repo path=%s (non-empty, not cloning)", path)
+        return False
+
+    if not repo_url:
+        logger.warning("git_ops.no_repo_url path=%s (empty/missing, nothing to clone)", path)
+        return False
+
+    path.parent.mkdir(parents=True, exist_ok=True)
+    rc, _, err = await _run(
+        ["git", "clone", repo_url, str(path)], str(path.parent), env, timeout=600.0,
+    )
+    if rc != 0:
+        logger.warning("git_ops.clone_failed url=%s path=%s err=%s", repo_url, path, err[:300])
+        return False
+    logger.info("git_ops.cloned url=%s path=%s", repo_url, path)
+    return await _is_git_repo(str(path), env)
+
+
+async def start_branch(
+    project_path: str, jira_key: str | None, summary: str | None, github_token: str | None,
+) -> dict | None:
+    """Create + check out `feature/<jira_key>-<slug>` off the default branch.
+
+    Returns {"branch", "base"} or None when the path isn't a git repo (e.g. a
+    fresh scratch dir) or the checkout failed.
+    """
+    path = str(Path(project_path).expanduser())
+    env = _git_env(github_token)
+    if not await _is_git_repo(path, env):
+        return None
+    # Fetch first so origin/HEAD and origin/main refs are present/fresh before we
+    # detect the base (avoids resolving the base to the current feature branch).
+    await _run(["git", "fetch", "origin"], path, env, timeout=180.0)
+    base = await detect_default_branch(path, env)
+    key = slugify(jira_key or "task", max_len=24)
+    branch = f"feature/{key}-{slugify(summary)}"
+    if base == branch:
+        # Defensive: never base a PR on the branch we're about to create.
+        base = "main"
+    # Cut the feature branch from the FRESH remote base so it never chains off a
+    # previous ticket's feature branch left checked out in a shared working tree.
+    rc, _, _ = await _run(["git", "checkout", "-B", branch, f"origin/{base}"], path, env)
+    if rc != 0:
+        rc, _, _ = await _run(["git", "checkout", "-B", branch], path, env)
+    if rc != 0:
+        return None
+    return {"branch": branch, "base": base}
+
+
+async def _remote_owner_repo(path: str, env: dict) -> tuple[str, str] | None:
+    """Parse origin's URL into (owner, repo). Handles https and ssh forms."""
+    rc, out, _ = await _run(["git", "remote", "get-url", "origin"], path, env)
+    if rc != 0 or not out:
+        return None
+    m = re.search(r"github\.com[:/]+([^/]+)/(.+?)(?:\.git)?/?$", out.strip())
+    if not m:
+        return None
+    return m.group(1), m.group(2)
+
+
+async def _create_pr_via_api(
+    owner: str, repo: str, base: str, head: str, title: str, body: str, token: str,
+) -> str | None:
+    """Open a PR through the GitHub REST API (no `gh` CLI needed).
+
+    The token from /ml-api/github/token carries `repo` scope, so it can both push
+    and open PRs. Returns the PR html_url, or the existing open PR's url when one
+    already exists for this head (422). Returns None (and logs) on any other error.
+    """
+    import httpx
+
+    api = f"https://api.github.com/repos/{owner}/{repo}/pulls"
+    headers = {
+        "Authorization": f"token {token}",
+        "Accept": "application/vnd.github+json",
+        "X-GitHub-Api-Version": "2022-11-28",
+    }
+    try:
+        async with httpx.AsyncClient(timeout=30.0) as c:
+            resp = await c.post(
+                api, headers=headers,
+                json={"title": title, "head": head, "base": base, "body": body},
+            )
+        if resp.status_code == 201:
+            return resp.json().get("html_url")
+        # 422 = a PR already exists for this head (or validation issue). Try to
+        # surface the existing open PR rather than reporting "no PR".
+        if resp.status_code == 422:
+            async with httpx.AsyncClient(timeout=30.0) as c:
+                r2 = await c.get(
+                    api, headers=headers,
+                    params={"head": f"{owner}:{head}", "state": "open"},
+                )
+            if r2.status_code == 200 and r2.json():
+                return r2.json()[0].get("html_url")
+        logger.warning(
+            "git_ops.pr_api_failed owner=%s repo=%s head=%s status=%s body=%s",
+            owner, repo, head, resp.status_code, resp.text[:300],
+        )
+    except Exception as exc:  # noqa: BLE001
+        logger.warning("git_ops.pr_api_error head=%s error=%s", head, exc)
+    return None
+
+
+async def finish_pr(
+    project_path: str, branch: str, base: str, title: str, body: str,
+    github_token: str | None,
+) -> dict:
+    """Stage all, commit, push the branch, open a PR. Best-effort.
+
+    Auth modes (decided by whether a token is available, see _git_env):
+      - token present → push over HTTPS+token; PR via REST API (no `gh` needed),
+        falling back to `gh`.
+      - no token      → push over SSH (the box's keys); PR via `gh pr create`
+        (GitHub has no SSH path for opening a PR, so `gh` must be authenticated:
+        `gh auth login`). SSH alone covers git transport, not the PR.
+
+    Every failure path is logged so a missing PR is diagnosable instead of silent.
+    Returns {"pushed": bool, "pr_url": str | None, "pr_error": str | None}.
+    """
+    path = str(Path(project_path).expanduser())
+    env = _git_env(github_token)
+
+    await _run(["git", "add", "-A"], path, env)
+    # commit — no-op (non-zero) when there's nothing staged; ignore that case.
+    await _run(["git", "commit", "-m", title], path, env)
+
+    rc, _, push_err = await _run(
+        ["git", "push", "-u", "origin", branch, "--force-with-lease"],
+        path, env, timeout=300.0,
+    )
+    pushed = rc == 0
+    if not pushed:
+        logger.warning("git_ops.push_failed branch=%s error=%s", branch, push_err[:300])
+        return {"pushed": False, "pr_url": None, "pr_error": f"push failed: {push_err[:200]}"}
+
+    pr_url: str | None = None
+    pr_error: str | None = None
+
+    # Never open a PR with base == head (GitHub: "No commits between X and X").
+    if base == branch:
+        base = await detect_default_branch(path, env)
+        if base == branch:
+            base = "main"
+        logger.warning("git_ops.base_equals_head_fixed branch=%s base=%s", branch, base)
+
+    # 1. Preferred: REST API (no `gh` dependency).
+    owner_repo = await _remote_owner_repo(path, env)
+    if github_token and owner_repo:
+        owner, repo = owner_repo
+        pr_url = await _create_pr_via_api(owner, repo, base, branch, title, body, github_token)
+
+    # 2. Fallback: gh CLI, if installed.
+    if not pr_url and shutil.which("gh"):
+        rc, out, gh_err = await _run(
+            ["gh", "pr", "create", "--base", base, "--head", branch,
+             "--title", title, "--body", body],
+            path, env, timeout=120.0,
+        )
+        if rc == 0 and out:
+            pr_url = out.strip().splitlines()[-1]
+        else:
+            pr_error = f"gh pr create failed: {gh_err[:200]}"
+            logger.warning("git_ops.gh_pr_failed branch=%s error=%s", branch, gh_err[:300])
+
+    if not pr_url and pr_error is None:
+        # Pushed, but no PR and no specific error captured above.
+        if github_token and owner_repo:
+            pr_error = "no PR created — REST API returned no URL"
+        elif not github_token and not shutil.which("gh"):
+            pr_error = ("no PR created — no token and `gh` not installed; SSH "
+                        "transport can't open a PR. Install gh + `gh auth login`, "
+                        "or provide a GitHub token.")
+        elif not shutil.which("gh"):
+            pr_error = "no PR created — missing GitHub token or unrecognized origin remote"
+        else:
+            pr_error = "no PR created"
+        logger.warning("git_ops.no_pr branch=%s reason=%s", branch, pr_error)
+
+    return {"pushed": pushed, "pr_url": pr_url, "pr_error": pr_error}

devops_bot_sdk-1.4.6/sdk/hooks/__init__.py

@@ -0,0 +1 @@
+"""Claude Code hooks shipped with the SDK (run in the SDK interpreter)."""

devops_bot_sdk-1.4.6/sdk/hooks/crucial_guard.py

@@ -0,0 +1,77 @@
+"""PreToolUse guard — HARD-blocks destructive tool calls pending human approval.
+
+Registered by ``local_exec`` via ``claude --settings`` and run as
+``python -m sdk.hooks.crucial_guard`` in the SDK's own interpreter. Protocol
+(Claude Code PreToolUse hook, exit 0 + JSON decision):
+
+  - reads the PreToolUse event JSON on stdin
+  - AGENTOS_APPROVAL_DIR unset                  → no opinion (normal permissions)
+  - non-destructive tool call                   → no opinion (normal permissions)
+  - destructive call WITH a one-shot grant      → consume grant, ALLOW
+  - destructive call WITHOUT a grant            → write a `pending` record (so the
+        SDK opens the WhatsApp gate even if the model never emits the marker) and
+        DENY, telling the model to STOP and emit the approval marker.
+
+This is the hard-enforcement layer under the soft, prompt-based marker gate: the
+destructive command cannot execute until a human approves, regardless of whether
+the model obeys the prompt.
+"""
+from __future__ import annotations
+
+import json
+import os
+import sys
+
+
+def _emit(decision: str, reason: str = "") -> None:
+    payload: dict = {
+        "hookSpecificOutput": {
+            "hookEventName": "PreToolUse",
+            "permissionDecision": decision,
+        }
+    }
+    if reason:
+        payload["hookSpecificOutput"]["permissionDecisionReason"] = reason
+    sys.stdout.write(json.dumps(payload))
+
+
+def main() -> None:
+    try:
+        event = json.load(sys.stdin)
+    except Exception:  # noqa: BLE001 — malformed input: stay out of the way
+        return
+
+    approval_dir = os.environ.get("AGENTOS_APPROVAL_DIR")
+    if not approval_dir:
+        return  # guard inactive for this run
+
+    try:
+        from sdk import crucial
+    except Exception:  # noqa: BLE001 — can't load guard logic: never block
+        return
+
+    desc = crucial.is_destructive(
+        event.get("tool_name", ""), event.get("tool_input") or {}
+    )
+    if not desc:
+        return  # not destructive → defer to normal permission flow
+
+    # A human already approved this step → let exactly one destructive call run.
+    if crucial.consume_grant(approval_dir):
+        _emit("allow", "Human-approved crucial action — proceeding.")
+        return
+
+    # Block, and record it so the SDK can gate even without the model's marker.
+    crucial.write_pending(approval_dir, desc)
+    _emit(
+        "deny",
+        "This is a CRUCIAL / IRREVERSIBLE action and is BLOCKED pending human "
+        "approval. Do NOT attempt a workaround or an alternative command. Output "
+        "EXACTLY one line:\n"
+        f"{crucial.MARKER} {desc}\n"
+        "then STOP and end your turn. Wait until you are told it is approved.",
+    )
+
+
+if __name__ == "__main__":
+    main()