devops-bot-sdk 1.6.6__tar.gz → 1.6.8__tar.gz

{devops_bot_sdk-1.6.6 → devops_bot_sdk-1.6.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.6.6
+Version: 1.6.8
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.6.6 → devops_bot_sdk-1.6.8}/devops_bot_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.6.6
+Version: 1.6.8
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.6.6 → devops_bot_sdk-1.6.8}/devops_bot_sdk.egg-info/SOURCES.txt

@@ -97,7 +97,9 @@ tests/test_agent_listing.py
 tests/test_agent_prompt_async.py
 tests/test_agent_prompt_models.py
 tests/test_agent_run_ticket.py
+tests/test_agent_workspace_settings.py
 tests/test_agents_connectors_builder.py
+tests/test_allowed_tools_config.py
 tests/test_git_action.py
 tests/test_github_ingest.py
 tests/test_health.py

{devops_bot_sdk-1.6.6 → devops_bot_sdk-1.6.8}/sdk/__init__.py

@@ -1,6 +1,6 @@
 """AgentOS Desktop SDK — thin HTTPS/SSE client for the Electron app.
 
-Version: 1.6.6
+Version: 1.6.8
 
 Public surface:
   BackendClient.from_config()        — create client from ~/.agentos/config.toml
@@ -30,7 +30,7 @@ Rules:
   - All data egress through submit_webhook only
 """
 
-__version__ = "1.6.6"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
+__version__ = "1.6.8"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
 __author__  = "AgentOS"   # sdk.client.SDK_VERSION and the UI server version all read this.
 
 from sdk.client import BackendClient

devops_bot_sdk-1.6.8/sdk/agents/engines/claude_code.py

@@ -0,0 +1,122 @@
+"""claude_code engine -- a thin adapter from an agent manifest onto ``sdk.local_exec.run_claude_local``."""
+from __future__ import annotations
+
+import json
+import logging
+from pathlib import Path
+from typing import TYPE_CHECKING, Any, Awaitable, Callable
+
+from sdk import config
+from sdk.local_exec import run_claude_local
+
+if TYPE_CHECKING:
+    from sdk.agents.manifest import AgentManifest
+
+logger = logging.getLogger("sdk.agents.engines.claude_code")
+
+# Same shape as sdk.local_exec.EventHandler -- kept local so this module doesn't
+# need to reach into local_exec for a type alias.
+EventHandler = Callable[[dict], Awaitable[None]]
+
+# Directory every agent without a real code workspace runs in.
+AGENT_RUNS_DIR = Path.home() / ".agentos" / "runs"
+
+
+def ensure_agent_workspace(agent_name: str) -> Path:
+    """The working directory for ``agent_name``, with its Claude settings in place.
+
+    Returns ``~/.agentos/runs/<agent>`` and makes sure
+    ``<that>/.claude/settings.json`` grants the configured tools
+    (``config.get_allowed_tools()``) under ``permissions.allow``.
+
+    Why write it at all when ``run_claude_local`` already passes
+    ``--allowedTools``: that flag covers the headless run, but the run directory IS
+    a Claude Code project, so anything reading project settings — a resumed
+    session, a nested/interactive invocation, a hook — sees the same grants instead
+    of falling back to prompting in a place where nobody can answer.
+
+    MERGES rather than overwrites: existing keys and any extra entries already in
+    ``permissions.allow`` are preserved, so a hand-added rule survives, and a tool
+    added to the configured list later shows up on the next run. Best-effort — a
+    write failure is logged and the run proceeds on ``--allowedTools`` alone.
+
+    Applies to CUSTOM and DEPARTMENT agents alike: both arrive as prompt-based
+    backend rows and both run through here.
+    """
+    workspace = AGENT_RUNS_DIR / agent_name
+    workspace.mkdir(parents=True, exist_ok=True)
+
+    settings_path = workspace / ".claude" / "settings.json"
+    try:
+        settings: dict = {}
+        if settings_path.exists():
+            try:
+                loaded = json.loads(settings_path.read_text(encoding="utf-8"))
+                if isinstance(loaded, dict):
+                    settings = loaded
+            except (OSError, json.JSONDecodeError) as exc:
+                # A corrupt file silently disables ALL settings from it, so replace
+                # it rather than leave the agent running with none.
+                logger.warning("rewriting unparseable %s: %s", settings_path, exc)
+
+        permissions = settings.get("permissions")
+        if not isinstance(permissions, dict):
+            permissions = {}
+        allow = [t for t in (permissions.get("allow") or []) if isinstance(t, str)]
+        for tool in config.get_allowed_tools():
+            if tool not in allow:
+                allow.append(tool)
+        permissions["allow"] = allow
+        settings["permissions"] = permissions
+
+        settings_path.parent.mkdir(parents=True, exist_ok=True)
+        settings_path.write_text(json.dumps(settings, indent=2) + "\n", encoding="utf-8")
+    except OSError as exc:
+        logger.warning("could not write %s: %s", settings_path, exc)
+
+    return workspace
+
+
+async def run(
+    manifest: "AgentManifest",
+    skill_text: str,
+    mcp_config: dict[str, Any] | None,
+    project_path: str | None = None,
+    on_event: EventHandler | None = None,
+    extra_env: dict[str, str] | None = None,
+) -> dict[str, Any]:
+    """Run a custom agent's manifest through the local ``claude`` CLI.
+
+    This does not reimplement any of ``run_claude_local``'s subprocess handling,
+    stream-json parsing, or crucial-hook logic -- it only assembles the prompt
+    and a working directory, then delegates.
+
+    ``skill_text`` is expected to already be the resolved skill body (see
+    ``sdk.agents.manifest.resolve_skill_text``), concatenated by the caller
+    where needed. To be safe, the final prompt is (re-)assembled here from
+    ``manifest.prompt`` plus, when ``skill_text`` is truthy, two newlines and
+    the skill body.
+    """
+    full_prompt = manifest.prompt
+    if skill_text:
+        full_prompt = f"{full_prompt}\n\n{skill_text}"
+
+    if project_path is None:
+        # Most custom agents (e.g. "summarise my PRs daily") have no real code
+        # workspace -- Claude Code still needs a valid current-working-directory
+        # to run in, so fall back to a per-agent scratch directory.
+        project_path = str(ensure_agent_workspace(manifest.name))
+
+    # mcp_config: accepted here for forward compatibility only. Wiring an
+    # --mcp-config flag into run_claude_local's subprocess command is a later
+    # follow-up, once run_claude_local itself grows an mcp_config parameter --
+    # this module does not attempt to work around that in the meantime, so the
+    # argument is currently unused.
+
+    return await run_claude_local(
+        prompt=full_prompt,
+        project_path=project_path,
+        allowed_tools=manifest.allowed_tools or None,
+        on_event=on_event,
+        extra_env=extra_env,
+    )

{devops_bot_sdk-1.6.6 → devops_bot_sdk-1.6.8}/sdk/config.py

@@ -156,20 +156,29 @@ def _dotenv_value(key: str) -> str:
 _DEFAULT_ALLOWED_IPS: list[str] = ["20.12.201.148"]
 
 
-def _parse_ip_list(raw: str) -> list[str]:
-    """Split an IP allowlist string, tolerant of JSON-ish list syntax.
+def _parse_token_list(raw: str) -> list[str]:
+    """Split a comma/space-separated list, tolerant of JSON-ish syntax.
 
-    Accepts ``"1.2.3.4, 5.6.7.8"``, ``1.2.3.4 5.6.7.8``, or ``["1.2.3.4","5.6.7.8"]``.
+    Accepts ``"a, b"``, ``a b``, or ``["a","b"]``. De-duplicates, order-preserving.
+    Used for every list-shaped setting (IP allowlist, tool allowlist).
     """
     raw = (raw or "").strip().strip("[]")
     out: list[str] = []
     for token in re.split(r"[,\s]+", raw):
-        ip = token.strip().strip('"').strip("'")
-        if ip and ip not in out:
-            out.append(ip)
+        item = token.strip().strip('"').strip("'")
+        if item and item not in out:
+            out.append(item)
     return out
 
 
+def _parse_ip_list(raw: str) -> list[str]:
+    """Split an IP allowlist string, tolerant of JSON-ish list syntax.
+
+    Accepts ``"1.2.3.4, 5.6.7.8"``, ``1.2.3.4 5.6.7.8``, or ``["1.2.3.4","5.6.7.8"]``.
+    """
+    return _parse_token_list(raw)
+
+
 def get_allowed_ips() -> list[str]:
     """Client IPs permitted to reach the ``agentos-ui`` API (``/api/ui/*``).
 
@@ -201,6 +210,55 @@ def get_allowed_ips() -> list[str]:
     return out
 
 
+# Built-in baseline of tools a headless agent run may use. Kept here (not in
+# local_exec) so it is one configurable setting rather than a literal buried in the
+# spawn code: the set WILL grow, and a new tool must be addable without editing
+# and re-releasing the SDK — see get_allowed_tools().
+_DEFAULT_ALLOWED_TOOLS: list[str] = [
+    "Read", "Write", "Edit", "Glob", "Grep", "Bash", "Skill", "WebSearch", "WebFetch",
+]
+
+
+def get_allowed_tools() -> list[str]:
+    """Tools a headless ``claude -p`` agent run is allowed to use.
+
+    A headless run cannot answer a permission prompt, so anything missing from
+    this list is silently UNAVAILABLE to the agent — which is how a research agent
+    ended up reporting it could not search the web. The baseline therefore covers
+    the file, shell, skill, and web tools, and everything else is configuration.
+
+    Sources, merged additively (all optional), each accepting a comma/space-separated
+    or bracketed list:
+      - the built-in baseline ``_DEFAULT_ALLOWED_TOOLS``
+      - ``.env`` key ``AGENTOS_ALLOWED_TOOLS`` (``~/.agentos/.env`` or CWD ``.env``)
+      - process env ``AGENTOS_ALLOWED_TOOLS``
+      - config.toml key ``allowed_tools``
+
+    Additive, like ``get_allowed_ips``: naming a tool ANYWHERE adds it, so granting
+    a newly-shipped Claude Code tool is a config line on the box, not a code change
+    and a release. Read at spawn time, so an edit applies to the next run without
+    restarting the daemon or the UI server. MCP/plugin tools are NOT listed here —
+    they are discovered per-machine at spawn time (see
+    ``local_exec._discover_mcp_allow_entries``).
+
+    To run with a REDUCED set, pass ``allowed_tools`` explicitly to
+    ``local_exec.run_claude_local`` (an agent manifest's ``allowed_tools`` does
+    exactly that) — that overrides this list rather than extending it.
+    """
+    sources = [
+        ",".join(_DEFAULT_ALLOWED_TOOLS),
+        _dotenv_value("AGENTOS_ALLOWED_TOOLS"),
+        os.environ.get("AGENTOS_ALLOWED_TOOLS", ""),
+        _load_raw().get("allowed_tools", ""),
+    ]
+    out: list[str] = []
+    for src in sources:
+        for tool in _parse_token_list(src):
+            if tool not in out:
+                out.append(tool)
+    return out
+
+
 class PermanentAllowlistEntry(ValueError):
     """Raised when trying to disable an IP that is permanently whitelisted via ``.env``."""
 

{devops_bot_sdk-1.6.6 → devops_bot_sdk-1.6.8}/sdk/design_verify/loop.py

@@ -24,7 +24,7 @@ from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Awaitable, Callable
 
-from sdk.local_exec import DEFAULT_ALLOWED_TOOLS, run_claude_local
+from sdk.local_exec import run_claude_local
 
 from .bootstrap import ensure_agent_browser
 from .browser import BrowserError, diff_baseline, render_screenshot
@@ -67,9 +67,10 @@ async def _default_coder(project_path: str, correction_prompt: str) -> None:
         "unrelated code.\n\n"
         f"{correction_prompt}"
     )
-    result = await run_claude_local(
-        prompt, project_path, allowed_tools=DEFAULT_ALLOWED_TOOLS
-    )
+    # allowed_tools omitted on purpose: run_claude_local then uses the configured
+    # allowlist (config.get_allowed_tools), so this run picks up any tool the box
+    # grants instead of a snapshot taken at import.
+    result = await run_claude_local(prompt, project_path)
     if not result.get("ok"):
         raise RuntimeError(f"correction run failed: {result.get('error')}")
 

{devops_bot_sdk-1.6.6 → devops_bot_sdk-1.6.8}/sdk/local_exec.py

@@ -28,15 +28,22 @@ from datetime import datetime, timedelta
 from pathlib import Path
 from typing import Any, Awaitable, Callable
 
-# Default tool allowlist. Bash is included so the agent runs ALL its commands
-# locally — git clone, install, build, test, and `gh pr create` for PRs — on the
-# user's machine, not the server. ``Skill`` lets the agent invoke installed
-# plugin/user Skills (e.g. the Figma skills), which DO load in headless ``-p`` runs
-# even when a plugin's MCP server can't authenticate there. MCP/plugin *tools* are
-# NOT hard-coded here — they are discovered per-machine and appended at spawn time;
-# see ``_discover_mcp_allow_entries`` / ``_local_mcp_servers`` and their use in
-# ``run_claude_local``.
-DEFAULT_ALLOWED_TOOLS = ["Read", "Write", "Edit", "Glob", "Grep", "Bash", "Skill"]
+from sdk import config   # tool allowlist lives there (config.get_allowed_tools)
+
+# The tool allowlist is a SETTING, not a literal here: see
+# ``sdk.config.get_allowed_tools`` for the baseline and the ways to extend it
+# (.env / process env ``AGENTOS_ALLOWED_TOOLS`` / config.toml ``allowed_tools``).
+# It is read at spawn time inside ``run_claude_local`` so a change applies to the
+# next run without a restart, and so granting a newly-shipped Claude Code tool
+# never needs an SDK edit and release.
+#
+# Bash is in the baseline so the agent runs ALL its commands locally — git clone,
+# install, build, test, and `gh pr create` for PRs — on the user's machine, not the
+# server. ``Skill`` lets it invoke installed plugin/user Skills (e.g. the Figma
+# skills), which DO load in headless ``-p`` runs even when a plugin's MCP server
+# can't authenticate there. MCP/plugin *tools* are not configured there either —
+# they are discovered per-machine and appended at spawn time; see
+# ``_discover_mcp_allow_entries`` / ``_local_mcp_servers`` below.
 
 # Run limits. The OLD design capped TOTAL runtime at 30 min, which killed long
 # but healthy runs (big builds, many steps) mid-work. Instead we use an IDLE
@@ -445,7 +452,8 @@ async def run_claude_local(
     Spawns ``claude -p <prompt> --output-format stream-json …`` with the working
     directory set to the project so all edits land on the real local files.
     ``--permission-mode acceptEdits`` lets file edits apply unattended (no
-    interactive prompt); read/write/edit are the only tools enabled by default.
+    interactive prompt). The tools enabled come from ``config.get_allowed_tools()``
+    unless ``allowed_tools`` is given, which replaces that list.
 
     ``on_event`` (optional, async) is called for each streamed JSON event — used
     by the sidecar to forward live progress (tool calls, assistant text) to the
@@ -477,7 +485,11 @@ async def run_claude_local(
     path = Path(project_path).expanduser()
     path.mkdir(parents=True, exist_ok=True)
 
-    tools = list(allowed_tools or DEFAULT_ALLOWED_TOOLS)
+    # Read the allowlist per spawn (not at import) so a config/.env change takes
+    # effect on the next run — the UI server and agentd are long-lived processes.
+    # An explicit `allowed_tools` (e.g. a manifest's) REPLACES it, so an agent can
+    # still be restricted to fewer tools than the configured set.
+    tools = list(allowed_tools or config.get_allowed_tools())
     # Append per-server MCP allow-entries so installed+authenticated plugins/MCP
     # servers are usable in this headless run. Discovered once and cached; no-ops
     # (adds nothing) when no servers are configured or discovery fails, so a machine

devops_bot_sdk-1.6.8/tests/test_agent_workspace_settings.py

@@ -0,0 +1,140 @@
+"""Every agent's run directory carries its own ``.claude/settings.json``.
+
+``~/.agentos/runs/<agent>`` IS a Claude Code project, so anything that reads
+project settings there — a resumed session, a nested invocation, a hook — must see
+the same tool grants the headless ``--allowedTools`` flag provides. Otherwise it
+falls back to prompting in a place where nobody can answer, which is how a
+research agent came to report that web access was "not granted".
+
+Applies to custom and department agents alike: both are prompt-based backend rows
+that run through the same engine.
+"""
+from __future__ import annotations
+
+import json
+
+import pytest
+
+from sdk import config
+from sdk.agents.engines import claude_code
+
+
+@pytest.fixture
+def runs_dir(tmp_path, monkeypatch):
+    """Point AGENT_RUNS_DIR at a temp dir — never touch the real ~/.agentos."""
+    d = tmp_path / "runs"
+    monkeypatch.setattr(claude_code, "AGENT_RUNS_DIR", d)
+    return d
+
+
+def _allow(path) -> list[str]:
+    return json.loads(path.read_text())["permissions"]["allow"]
+
+
+class TestEnsureAgentWorkspace:
+    def test_creates_the_workspace_and_grants_configured_tools(self, runs_dir):
+        ws = claude_code.ensure_agent_workspace("AI Research Agent")
+        assert ws.is_dir()
+        settings = ws / ".claude" / "settings.json"
+        assert settings.exists()
+        allow = _allow(settings)
+        for tool in config.get_allowed_tools():
+            assert tool in allow
+        # The pair whose absence made research agents report "permission not granted".
+        assert "WebSearch" in allow and "WebFetch" in allow
+
+    def test_free_text_agent_names_are_handled(self, runs_dir):
+        """Web-app names carry spaces and '&' — the dir is named after the agent."""
+        ws = claude_code.ensure_agent_workspace("Jira & Confluence Project Management Agent")
+        assert (ws / ".claude" / "settings.json").exists()
+
+    def test_department_agent_gets_the_same_treatment(self, runs_dir):
+        ws = claude_code.ensure_agent_workspace("Model QA Specialist")
+        assert "WebSearch" in _allow(ws / ".claude" / "settings.json")
+
+    def test_rerun_preserves_hand_added_rules_and_other_keys(self, runs_dir):
+        ws = claude_code.ensure_agent_workspace("Agent One")
+        settings = ws / ".claude" / "settings.json"
+
+        data = json.loads(settings.read_text())
+        data["permissions"]["allow"].append("Bash(git *)")
+        data["env"] = {"MY_FLAG": "1"}
+        settings.write_text(json.dumps(data))
+
+        claude_code.ensure_agent_workspace("Agent One")
+        after = json.loads(settings.read_text())
+        assert "Bash(git *)" in after["permissions"]["allow"], "hand-added rule dropped"
+        assert after["env"] == {"MY_FLAG": "1"}, "unrelated key dropped"
+
+    def test_a_newly_configured_tool_appears_on_the_next_run(self, runs_dir, monkeypatch):
+        ws = claude_code.ensure_agent_workspace("Agent Two")
+        settings = ws / ".claude" / "settings.json"
+        assert "BrandNewTool" not in _allow(settings)
+
+        monkeypatch.setenv("AGENTOS_ALLOWED_TOOLS", "BrandNewTool")
+        claude_code.ensure_agent_workspace("Agent Two")
+        assert "BrandNewTool" in _allow(settings), "config change must reach the workspace"
+
+    def test_no_duplicate_entries_across_runs(self, runs_dir):
+        claude_code.ensure_agent_workspace("Agent Three")
+        ws = claude_code.ensure_agent_workspace("Agent Three")
+        allow = _allow(ws / ".claude" / "settings.json")
+        assert len(allow) == len(set(allow))
+
+    def test_corrupt_settings_file_is_replaced_not_inherited(self, runs_dir):
+        """Invalid JSON silently disables every setting in the file — rewrite it."""
+        ws = claude_code.ensure_agent_workspace("Agent Four")
+        settings = ws / ".claude" / "settings.json"
+        settings.write_text("{ not json at all")
+
+        claude_code.ensure_agent_workspace("Agent Four")
+        assert "WebSearch" in _allow(settings)
+
+    def test_unwritable_workspace_does_not_break_the_run(self, runs_dir, monkeypatch):
+        """The flag still grants the tools, so a settings write failure is survivable."""
+        def boom(*a, **kw):
+            raise OSError("read-only file system")
+
+        ws = claude_code.ensure_agent_workspace("Agent Five")
+        monkeypatch.setattr("pathlib.Path.write_text", boom)
+        assert claude_code.ensure_agent_workspace("Agent Five") == ws
+
+
+class TestEngineUsesTheWorkspace:
+    @pytest.mark.asyncio
+    async def test_run_without_project_path_runs_in_the_prepared_workspace(
+        self, runs_dir, monkeypatch
+    ):
+        from types import SimpleNamespace
+
+        captured: dict = {}
+
+        async def fake_run(**kwargs):
+            captured.update(kwargs)
+            return {"ok": True}
+
+        monkeypatch.setattr(claude_code, "run_claude_local", fake_run)
+        manifest = SimpleNamespace(
+            name="AI Research Agent", prompt="do the thing", allowed_tools=[],
+        )
+        await claude_code.run(manifest, "", None)
+
+        assert captured["project_path"] == str(runs_dir / "AI Research Agent")
+        settings = runs_dir / "AI Research Agent" / ".claude" / "settings.json"
+        assert settings.exists(), "the engine must prepare the workspace before running"
+
+    @pytest.mark.asyncio
+    async def test_an_explicit_project_path_is_left_alone(self, runs_dir, monkeypatch, tmp_path):
+        """A real code checkout must NOT have a .claude/settings.json written into it."""
+        from types import SimpleNamespace
+
+        async def fake_run(**kwargs):
+            return {"ok": True}
+
+        monkeypatch.setattr(claude_code, "run_claude_local", fake_run)
+        repo = tmp_path / "some-repo"
+        repo.mkdir()
+        manifest = SimpleNamespace(name="Coder", prompt="fix it", allowed_tools=[])
+        await claude_code.run(manifest, "", None, project_path=str(repo))
+
+        assert not (repo / ".claude").exists(), "must not write into the user's repo"

devops_bot_sdk-1.6.8/tests/test_allowed_tools_config.py

@@ -0,0 +1,102 @@
+"""The headless-run tool allowlist is CONFIGURATION, not a literal in the spawn code.
+
+A headless ``claude -p`` run cannot answer a permission prompt, so a tool absent
+from ``--allowedTools`` is silently unavailable to the agent — that is how a
+research agent came to report it could not search the web. The set will keep
+growing as Claude Code ships tools, so granting one must be a config line on the
+box, never an SDK edit and release.
+
+Covers ``config.get_allowed_tools`` (baseline + the three additive sources) and
+that ``local_exec.run_claude_local`` reads it AT SPAWN TIME, while an explicit
+``allowed_tools`` still narrows a single run.
+"""
+from __future__ import annotations
+
+from unittest.mock import AsyncMock, patch
+
+import pytest
+
+from sdk import config
+
+
+class TestGetAllowedTools:
+    def test_baseline_covers_file_shell_skill_and_web_tools(self, monkeypatch):
+        monkeypatch.delenv("AGENTOS_ALLOWED_TOOLS", raising=False)
+        with patch.object(config, "_dotenv_value", return_value=""), \
+             patch.object(config, "_load_raw", return_value={}):
+            tools = config.get_allowed_tools()
+        for expected in ("Read", "Write", "Edit", "Glob", "Grep", "Bash", "Skill"):
+            assert expected in tools
+        # The pair whose absence broke every research-shaped agent.
+        assert "WebSearch" in tools and "WebFetch" in tools
+
+    def test_process_env_adds_without_restating_the_baseline(self, monkeypatch):
+        monkeypatch.setenv("AGENTOS_ALLOWED_TOOLS", "FutureTool, OtherTool")
+        with patch.object(config, "_dotenv_value", return_value=""), \
+             patch.object(config, "_load_raw", return_value={}):
+            tools = config.get_allowed_tools()
+        assert "FutureTool" in tools and "OtherTool" in tools
+        assert "Read" in tools, "extending must not drop the baseline"
+
+    def test_dotenv_and_config_toml_are_also_sources(self, monkeypatch):
+        monkeypatch.delenv("AGENTOS_ALLOWED_TOOLS", raising=False)
+        with patch.object(config, "_dotenv_value", return_value="DotEnvTool"), \
+             patch.object(config, "_load_raw", return_value={"allowed_tools": "TomlTool"}):
+            tools = config.get_allowed_tools()
+        assert "DotEnvTool" in tools and "TomlTool" in tools
+
+    def test_json_ish_and_space_separated_forms_parse(self, monkeypatch):
+        monkeypatch.setenv("AGENTOS_ALLOWED_TOOLS", '["A", "B"]')
+        with patch.object(config, "_dotenv_value", return_value="C D"), \
+             patch.object(config, "_load_raw", return_value={}):
+            tools = config.get_allowed_tools()
+        for t in ("A", "B", "C", "D"):
+            assert t in tools
+
+    def test_no_duplicates_when_a_source_repeats_the_baseline(self, monkeypatch):
+        monkeypatch.setenv("AGENTOS_ALLOWED_TOOLS", "Bash, Read")
+        with patch.object(config, "_dotenv_value", return_value=""), \
+             patch.object(config, "_load_raw", return_value={}):
+            tools = config.get_allowed_tools()
+        assert len(tools) == len(set(tools))
+
+
+class TestRunClaudeLocalUsesTheSetting:
+    """The flags handed to the CLI must come from the setting, read per spawn."""
+
+    async def _spawned_cmd(self, **kwargs) -> list[str]:
+        from sdk import local_exec
+
+        proc = AsyncMock()
+        proc.returncode = 0
+        proc.stdout = None
+        proc.stderr = None
+        captured: dict = {}
+
+        async def fake_exec(*cmd, **kw):
+            captured["cmd"] = list(cmd)
+            raise RuntimeError("stop after spawn")
+
+        with patch.object(local_exec, "claude_cli_path", return_value="/usr/bin/claude"), \
+             patch("asyncio.create_subprocess_exec", new=fake_exec):
+            try:
+                await local_exec.run_claude_local(
+                    prompt="hi", project_path="/tmp/agentos-test-run", **kwargs)
+            except Exception:
+                pass
+        return captured.get("cmd", [])
+
+    @pytest.mark.asyncio
+    async def test_configured_tools_reach_the_cli(self, monkeypatch):
+        monkeypatch.setenv("AGENTOS_ALLOWED_TOOLS", "BrandNewTool")
+        cmd = await self._spawned_cmd()
+        assert "--allowedTools" in cmd
+        assert "BrandNewTool" in cmd, "a configured tool must be granted with no code change"
+        assert "WebSearch" in cmd
+
+    @pytest.mark.asyncio
+    async def test_explicit_allowed_tools_narrows_a_single_run(self, monkeypatch):
+        monkeypatch.delenv("AGENTOS_ALLOWED_TOOLS", raising=False)
+        cmd = await self._spawned_cmd(allowed_tools=["Read"])
+        assert "Read" in cmd
+        assert "Bash" not in cmd, "an explicit list replaces the setting, not extends it"

devops_bot_sdk-1.6.6/sdk/agents/engines/claude_code.py

@@ -1,61 +0,0 @@
-"""claude_code engine -- a thin adapter from an agent manifest onto ``sdk.local_exec.run_claude_local``."""
-from __future__ import annotations
-
-from pathlib import Path
-from typing import TYPE_CHECKING, Any, Awaitable, Callable
-
-from sdk.local_exec import run_claude_local
-
-if TYPE_CHECKING:
-    from sdk.agents.manifest import AgentManifest
-
-# Same shape as sdk.local_exec.EventHandler -- kept local so this module doesn't
-# need to reach into local_exec for a type alias.
-EventHandler = Callable[[dict], Awaitable[None]]
-
-
-async def run(
-    manifest: "AgentManifest",
-    skill_text: str,
-    mcp_config: dict[str, Any] | None,
-    project_path: str | None = None,
-    on_event: EventHandler | None = None,
-    extra_env: dict[str, str] | None = None,
-) -> dict[str, Any]:
-    """Run a custom agent's manifest through the local ``claude`` CLI.
-
-    This does not reimplement any of ``run_claude_local``'s subprocess handling,
-    stream-json parsing, or crucial-hook logic -- it only assembles the prompt
-    and a working directory, then delegates.
-
-    ``skill_text`` is expected to already be the resolved skill body (see
-    ``sdk.agents.manifest.resolve_skill_text``), concatenated by the caller
-    where needed. To be safe, the final prompt is (re-)assembled here from
-    ``manifest.prompt`` plus, when ``skill_text`` is truthy, two newlines and
-    the skill body.
-    """
-    full_prompt = manifest.prompt
-    if skill_text:
-        full_prompt = f"{full_prompt}\n\n{skill_text}"
-
-    if project_path is None:
-        # Most custom agents (e.g. "summarise my PRs daily") have no real code
-        # workspace -- Claude Code still needs a valid current-working-directory
-        # to run in, so fall back to a per-agent scratch directory.
-        scratch = Path.home() / ".agentos" / "runs" / manifest.name
-        scratch.mkdir(parents=True, exist_ok=True)
-        project_path = str(scratch)
-
-    # mcp_config: accepted here for forward compatibility only. Wiring an
-    # --mcp-config flag into run_claude_local's subprocess command is a later
-    # follow-up, once run_claude_local itself grows an mcp_config parameter --
-    # this module does not attempt to work around that in the meantime, so the
-    # argument is currently unused.
-
-    return await run_claude_local(
-        prompt=full_prompt,
-        project_path=project_path,
-        allowed_tools=manifest.allowed_tools or None,
-        on_event=on_event,
-        extra_env=extra_env,
-    )