django-pydantic-agent 0.1.0__tar.gz

django_pydantic_agent-0.1.0/.github/CODEOWNERS

@@ -0,0 +1 @@
+* @Artui

django_pydantic_agent-0.1.0/.github/SECURITY.md

@@ -0,0 +1,9 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please report security issues **privately** via GitHub's
+[Report a vulnerability](../../security/advisories/new) button rather than opening a public issue.
+I aim to acknowledge reports within 72 hours.
+
+Supported: the latest released version on the default branch.

django_pydantic_agent-0.1.0/.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      actions:
+        patterns: ["*"]
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      python:
+        patterns: ["*"]

django_pydantic_agent-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,81 @@
+name: release
+
+# Main-triggered: every merge to `main` runs `release-publish-prepare`, which
+# short-circuits to a no-op unless the version in source has been bumped past
+# the most recent `vX.Y.Z` tag.
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: release-main
+  cancel-in-progress: false
+
+jobs:
+  release:
+    name: release
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/django-pydantic-agent
+    permissions:
+      id-token: write   # PyPI OIDC trusted publishing
+      contents: write   # tag push + gh release create
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+      - name: Install
+        run: uv sync --all-groups
+
+      - name: Prepare release (version check, test, build dist)
+        id: prepare
+        run: make release-publish-prepare
+
+      - name: Publish to PyPI
+        if: steps.prepare.outputs.released == 'true'
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+      - name: Tag + GitHub Release
+        if: steps.prepare.outputs.released == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: make release-publish-finalize
+
+      # Embed a coverage-badge JSON into the docs build so `mkdocs gh-deploy`
+      # carries it to the gh-pages root, where the README's shields.io endpoint
+      # badge reads it. `release-publish-prepare`'s pytest run wrote .coverage
+      # to the workspace root.
+      - name: Render coverage badge for the docs site
+        if: steps.prepare.outputs.released == 'true' && hashFiles('mkdocs.yml') != ''
+        run: |
+          set -euo pipefail
+          uv run coverage xml -o coverage.xml
+          python - <<'PY'
+          import json
+          import xml.etree.ElementTree as ET
+
+          pct = round(float(ET.parse("coverage.xml").getroot().attrib["line-rate"]) * 100, 1)
+          color = (
+              "brightgreen" if pct >= 95
+              else "green" if pct >= 85
+              else "yellow" if pct >= 70
+              else "red"
+          )
+          payload = {"schemaVersion": 1, "label": "coverage", "message": f"{pct}%", "color": color}
+          with open("docs/coverage.json", "w") as fh:
+              json.dump(payload, fh)
+              fh.write("\n")
+          print(json.dumps(payload))
+          PY
+
+      - name: Deploy docs + coverage badge to gh-pages
+        if: steps.prepare.outputs.released == 'true' && hashFiles('mkdocs.yml') != ''
+        run: |
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          DJANGO_SETTINGS_MODULE=tests.conftest_settings \
+            uv run mkdocs gh-deploy --force --clean --config-file mkdocs.yml

django_pydantic_agent-0.1.0/.github/workflows/tests.yml

@@ -0,0 +1,250 @@
+name: tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: tests-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+      - name: Install
+        run: uv sync --all-groups
+      - name: ruff check
+        run: uv run ruff check .
+      - name: ruff format check
+        run: uv run ruff format --check --diff .
+      - name: ty
+        run: uv run ty check django_pydantic_agent
+
+  docs:
+    name: docs build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+      - name: Install with docs group
+        run: uv sync --all-groups
+      - name: mkdocs build --strict
+        run: DJANGO_SETTINGS_MODULE=tests.conftest_settings uv run mkdocs build --strict
+
+  test:
+    name: ${{ matrix.python-version }} / Django ${{ matrix.django-version }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+        django-version: ["4.2", "5.0", "5.1", "5.2", "6.0"]
+        exclude:
+          # Django 4.2 supports Python 3.8–3.12
+          - python-version: "3.13"
+            django-version: "4.2"
+          - python-version: "3.14"
+            django-version: "4.2"
+          # Django 5.0 supports Python 3.10–3.12
+          - python-version: "3.13"
+            django-version: "5.0"
+          - python-version: "3.14"
+            django-version: "5.0"
+          # Django 5.1 supports Python 3.10–3.13
+          - python-version: "3.14"
+            django-version: "5.1"
+          # Django 6.0 requires Python 3.12+
+          - python-version: "3.10"
+            django-version: "6.0"
+          - python-version: "3.11"
+            django-version: "6.0"
+
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+      - name: Install Python ${{ matrix.python-version }}
+        run: uv python install ${{ matrix.python-version }}
+      - name: Sync dev deps
+        run: uv sync --all-groups --python ${{ matrix.python-version }}
+      - name: Pin Django ${{ matrix.django-version }}
+        run: uv pip install --reinstall-package django "django~=${{ matrix.django-version }}.0"
+      - name: pytest
+        run: |
+          uv run --no-sync pytest \
+            --cov-report=xml:coverage.xml \
+            --cov-report=html:htmlcov
+      - name: Upload coverage artifact
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage-py${{ matrix.python-version }}-django${{ matrix.django-version }}
+          path: |
+            coverage.xml
+            htmlcov/
+          if-no-files-found: ignore
+
+  coverage-badge:
+    # Publishes a shields.io-compatible coverage.json to gh-pages so the README
+    # badge reflects reality. Runs only on push to main, after the matrix has
+    # produced an artifact we can read from.
+    name: coverage badge
+    needs: test
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # Need the parent commit so the gate step below can diff
+          # version.py against ${{ github.event.before }}. The default
+          # shallow checkout (depth 1) would make `git show "$before:…"`
+          # fail with exit 128 and turn the whole job red.
+          fetch-depth: 2
+      # release.yml runs in parallel on the same push and owns gh-pages
+      # publishing on release commits (it bundles coverage.json into the
+      # mkdocs gh-deploy). If we also push here we get a second built-in
+      # "pages build and deployment" run that the first one cancels. The
+      # version-diff against ${{ github.event.before }} is the reliable
+      # signal — release.yml's tag isn't pushed until after PyPI publish,
+      # so a tag-existence check would race.
+      - name: Skip when release.yml owns this push
+        id: gate
+        run: |
+          set -euo pipefail
+          before="${{ github.event.before }}"
+          if [[ -z "$before" || "$before" =~ ^0+$ ]]; then
+              # First push to main on a brand-new repo — no prior state to diff.
+              echo "skip=false" >> "$GITHUB_OUTPUT"
+              exit 0
+          fi
+          # `before` may not be in the local object DB if the push
+          # contained more than one commit (fetch-depth: 2 only guarantees
+          # HEAD + 1 parent). Try to fetch just that commit; if it's not
+          # reachable, fall back to "don't skip" — better to double-push
+          # to gh-pages once than to turn the pipeline red.
+          if ! git cat-file -e "$before^{commit}" 2>/dev/null; then
+              git fetch --depth=1 origin "$before" 2>/dev/null || true
+          fi
+          old=""
+          if git cat-file -e "$before:django_pydantic_agent/version.py" 2>/dev/null; then
+              old="$(git show "$before:django_pydantic_agent/version.py" \
+                     | awk -F'"' '/^__version__/ { print $2; exit }')"
+          fi
+          new="$(awk -F'"' '/^__version__/ { print $2; exit }' \
+                 django_pydantic_agent/version.py)"
+          if [[ -n "$old" && "$old" != "$new" ]]; then
+              echo "Version bumped $old → $new; release.yml will deploy gh-pages."
+              echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+              echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Download canonical coverage artifact
+        if: steps.gate.outputs.skip != 'true'
+        uses: actions/download-artifact@v8
+        with:
+          # Pin to one cell of the matrix — coverage is the same shape across
+          # all cells and we only need one number.
+          name: coverage-py3.13-django5.2
+          path: coverage-artifact/
+      - name: Render coverage.json
+        if: steps.gate.outputs.skip != 'true'
+        run: |
+          python - <<'PY'
+          import json
+          import xml.etree.ElementTree as ET
+
+          tree = ET.parse("coverage-artifact/coverage.xml")
+          pct = round(float(tree.getroot().attrib["line-rate"]) * 100, 1)
+          if pct >= 95:
+              color = "brightgreen"
+          elif pct >= 85:
+              color = "green"
+          elif pct >= 70:
+              color = "yellow"
+          else:
+              color = "red"
+          payload = {
+              "schemaVersion": 1,
+              "label": "coverage",
+              "message": f"{pct}%",
+              "color": color,
+          }
+          with open("coverage.json", "w") as fh:
+              json.dump(payload, fh)
+              fh.write("\n")
+          print(json.dumps(payload))
+          PY
+      - name: Publish coverage.json to gh-pages
+        if: steps.gate.outputs.skip != 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+
+          tmp="$(mktemp -d)"
+          cp coverage.json "$tmp/coverage.json"
+
+          git fetch origin gh-pages --depth=1 2>/dev/null || true
+          if git rev-parse --verify origin/gh-pages >/dev/null 2>&1; then
+              git worktree add gh-pages origin/gh-pages
+              cp "$tmp/coverage.json" gh-pages/coverage.json
+              cd gh-pages
+              if [[ -n "$(git status --porcelain coverage.json)" ]]; then
+                  git add coverage.json
+                  git commit -m "coverage badge: update from ${GITHUB_SHA::7}"
+                  git push origin HEAD:gh-pages
+              else
+                  echo "coverage.json unchanged, skipping push"
+              fi
+          else
+              # First run before docs deploy. Lay down an orphan gh-pages with
+              # just the badge file; the docs deploy will overwrite the rest.
+              git worktree add --detach gh-pages
+              cd gh-pages
+              git checkout --orphan gh-pages
+              git rm -rf . >/dev/null 2>&1 || true
+              cp "$tmp/coverage.json" coverage.json
+              git add coverage.json
+              git commit -m "coverage badge: initial publish from ${GITHUB_SHA::7}"
+              git push origin gh-pages
+          fi
+
+  secrets:
+    name: secret scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Install gitleaks
+        run: |
+          curl -sSL https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz | tar -xz gitleaks
+          sudo mv gitleaks /usr/local/bin/
+      - name: Scan repo + history
+        run: gitleaks git --redact --no-banner .
+
+  tests-passed:
+    name: tests
+    if: always()
+    needs: [lint, docs, test]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify required jobs succeeded
+        run: |
+          if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then
+            echo "a required job failed"; exit 1
+          fi

django_pydantic_agent-0.1.0/.gitignore

@@ -0,0 +1,122 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py,cover
+.hypothesis/
+.pytest_cache/
+cover/
+coverage*.json
+coverage*.xml
+
+# release.yml renders this at workflow-time and drops it under docs/ so
+# mkdocs gh-deploy carries it to the gh-pages root.
+docs/coverage.json
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Sphinx documentation
+docs/_build/
+
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Virtualenv-style scripts dirs (we re-include the repo-root scripts/ directory).
+[Ss]cripts
+!/scripts/
+pyvenv.cfg
+.Python
+[Bb]in
+[Ii]nclude
+[Ll]ib
+[Ll]ib64
+[Ll]ocal
+
+# uv
+.uv-cache/
+
+# mkdocs
+/site
+
+# Type checkers
+.mypy_cache/
+.dmypy.json
+dmypy.json
+.pyre/
+.pytype/
+.ruff_cache/
+.ty_cache/
+
+# IDE
+.vscode/
+.idea/
+*.iml
+*.code-workspace
+.history/
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Release metadata (rendered by scripts/release-publish.sh during CI)
+.release-metadata/
+
+# AI-specific items
+.ai/
+.claude/

django_pydantic_agent-0.1.0/.pre-commit-config.yaml

@@ -0,0 +1,50 @@
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.1
+    hooks:
+      - id: gitleaks
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-added-large-files
+        args: ["--maxkb=2000"]
+
+  - repo: local
+    hooks:
+      - id: ruff-check
+        name: "ruff check --fix"
+        entry: make lint-fix
+        pass_filenames: false
+        language: system
+        stages: [pre-commit]
+
+      - id: ruff-format
+        name: "ruff format"
+        entry: make format
+        pass_filenames: false
+        language: system
+        stages: [pre-commit]
+
+      - id: backend-type-check
+        name: "type check (ty)"
+        entry: make type-check
+        pass_filenames: false
+        language: system
+        stages: [pre-commit]
+
+      - id: forbid-local-paths
+        name: "forbid local filesystem paths / personal handles"
+        entry: "/Users/|arturveres"
+        language: pygrep
+        types: [text]
+        exclude: '^\.pre-commit-config\.yaml$'
+
+      - id: forbid-plan-labels
+        name: "forbid internal plan-step labels"
+        entry: '(?<![A-Za-z0-9])(SPEC|SURF|DISP|KEY|FILT|BULK|NEST|NAME|THINK|VOICE|THEME|WELL|PAGE|CARD|REST|I18N|CUST|TOOL|PAI|AUTHZ|CONF|AGH|OAS|WCH|HYG|ADOPT|ANNO|ASYNC|ERR|DUP|PROTO|SEC|VER|GATE|STATE|SESS|CTX|AUDIT|HITL|CODE|STEP|SHARE|SKILL|CAP|MOUNT|SAN|PF|PROV|SCH|LIFE|SUB|CI|DOC|EX)-\d|(?<![A-Za-z0-9])(Phase|Wave)\s\d'
+        language: pygrep
+        types: [text]
+        exclude: '^\.pre-commit-config\.yaml$'

django_pydantic_agent-0.1.0/CHANGELOG.md

@@ -0,0 +1,30 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0] — 2026-07-23
+
+### Added
+
+- **Initial extraction** of the settings-agnostic agent-host substrate from
+  `django-ag-ui`: `AgentConfig` + `build_agent`, the `ToolRegistry` / `@tool`
+  registry and typed schema derivation, toolset & capability composition
+  (including the optional `[drf-mcp]` bridge and `[spec-tools]` capability), the
+  `AuditLogger` protocol and audit capability, the `ToolGuard` policy, the
+  `get_user` / authorization helpers, the `ConversationStore` / `AttachmentStore`
+  / `StepStore` contracts, and the reference `contrib.store` models and stores.
+- **The core reads no Django settings.** Anything that previously resolved from
+  `DJANGO_AG_UI` is now an explicit argument — notably the model stores take
+  `allow_anonymous: bool = False` rather than consulting a settings key.
+- **`Conversation.messages` is transport-owned.** The core persists and returns
+  JSON-serialisable message records verbatim and never interprets them, so it
+  carries no dependency on any wire format; the calling transport validates its
+  own shape (and its message ids survive a round trip untouched).
+
+[Unreleased]: https://github.com/Artui/django-pydantic-agent/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/Artui/django-pydantic-agent/releases/tag/v0.1.0