dreadnode 2.0.45__py3-none-any.whl → 2.0.46__py3-none-any.whl

dreadnode/agents/agent.py

@@ -838,7 +838,10 @@ class Agent(Executor[AgentEvent, Trajectory]):
                 raise
 
     async def _stream(
-        self, trajectory: Trajectory | None = None
+        self,
+        trajectory: Trajectory | None = None,
+        *,
+        message_metadata: dict[str, t.Any] | None = None,
     ) -> t.AsyncGenerator[AgentEvent, None]:
         """Drive the loop through the resolved :class:`AgentEngine`.
 
@@ -855,6 +858,7 @@ class Agent(Executor[AgentEvent, Trajectory]):
             goal=self._current_input,
             dispatch=self._dispatch,
             permission=self._permission_bridge,
+            message_metadata=message_metadata,
         )
         async for event in engine.run_loop(ctx):
             yield event
@@ -864,7 +868,10 @@ class Agent(Executor[AgentEvent, Trajectory]):
         return resolve_engine(self.engine)
 
     async def _native_run_loop(
-        self, trajectory: Trajectory | None = None
+        self,
+        trajectory: Trajectory | None = None,
+        *,
+        message_metadata: dict[str, t.Any] | None = None,
     ) -> t.AsyncGenerator[AgentEvent, None]:
         """
         Core agent execution loop with inline tracing.
@@ -882,7 +889,7 @@ class Agent(Executor[AgentEvent, Trajectory]):
             Message(
                 "user",
                 str(self._current_input),
-                metadata={"agent": self.name, "model": self.model_name},
+                metadata={**(message_metadata or {}), "agent": self.name, "model": self.model_name},
             ),
         ]
         messages = inject_system_content(messages, self.instructions)
@@ -1316,12 +1323,14 @@ class Agent(Executor[AgentEvent, Trajectory]):
         *,
         reset: bool = True,
         trajectory: Trajectory | None = None,
+        message_metadata: dict[str, t.Any] | None = None,
     ) -> t.AsyncIterator[t.AsyncGenerator[AgentEvent, None]]:
         """
         Stream agent execution.
 
         Args:
             goal: Input message for the agent.
+            message_metadata: Informational metadata attached to this turn's user message.
             reset: If True, start new conversation. If False, continue existing.
                    Ignored when *trajectory* is provided.
             trajectory: External trajectory to operate on.  When provided the
@@ -1369,7 +1378,9 @@ class Agent(Executor[AgentEvent, Trajectory]):
             with ctx as parent_span:
 
                 async def _events() -> t.AsyncGenerator[AgentEvent, None]:
-                    async for event in self._stream(active_trajectory):
+                    async for event in self._stream(
+                        active_trajectory, message_metadata=message_metadata
+                    ):
                         # Emit agent-level events to parent span
                         if parent_span and isinstance(
                             event, (AgentStart, AgentEnd, AgentStalled, AgentError)

dreadnode/agents/engines/base.py

@@ -104,8 +104,8 @@ class PermissionBridge(t.Protocol):
 class EngineContext:
     """Everything an engine needs to run one turn.
 
-    The native engine uses only ``agent`` + ``trajectory`` (it reaches the rest
-    through ``agent``). Foreign engines additionally use ``goal``, ``dispatch``
+    The native engine uses ``agent``, ``trajectory``, and ``message_metadata``.
+    Foreign engines additionally use ``goal``, ``dispatch``
     (to run observational hooks on translated events), and ``permission``.
     """
 
@@ -116,6 +116,8 @@ class EngineContext:
     """Run an event through the agent's hooks (metrics + reactions). Foreign
     engines call this per translated event; the native engine dispatches inline."""
     permission: "PermissionBridge | None" = None
+    message_metadata: dict[str, t.Any] | None = None
+    """Informational metadata for the initiating user message, never authorization."""
 
 
 class AgentEngine(ABC):

dreadnode/agents/engines/claude_code.py

@@ -393,7 +393,11 @@ class ClaudeCodeEngine(AgentEngine):
                 Message(
                     "user",
                     str(ctx.goal or ""),
-                    metadata={"agent": agent.name, "model": agent.model_name},
+                    metadata={
+                        **(ctx.message_metadata or {}),
+                        "agent": agent.name,
+                        "model": agent.model_name,
+                    },
                 )
             )
         step_messages.append(assistant_msg)

dreadnode/agents/engines/native.py

@@ -22,5 +22,7 @@ class NativeEngine(AgentEngine):
     dispatches_internally = True
 
     async def run_loop(self, ctx: EngineContext) -> "t.AsyncIterator[AgentEvent]":
-        async for event in ctx.agent._native_run_loop(ctx.trajectory):
+        async for event in ctx.agent._native_run_loop(
+            ctx.trajectory, message_metadata=ctx.message_metadata
+        ):
             yield event

dreadnode/app/api/client.py

@@ -3325,10 +3325,12 @@ class ApiClient:
         """Find a session's workspace and project by searching across all org workspaces.
 
         Returns the full API response payload (normally containing a
-        ``session`` dict with ``workspace`` and ``project_name`` keys) from the
-        first workspace where the session is found, or ``None`` if not found in
-        any workspace. Used by ``--resume`` to locate sessions that belong to a
-        different workspace than the current profile default.
+        ``session`` dict with ``workspace``, ``project_key`` and
+        ``project_name`` keys) from the first workspace where the session is
+        found, or ``None`` if not found in any workspace. Used by ``--resume``
+        to locate sessions that belong to a different workspace than the
+        current profile default — which scopes off ``project_key``, the
+        addressable slug, not the ``project_name`` display label.
 
         Raises :class:`AuthenticationError` on 401 so callers can surface
         the auth failure rather than silently returning "not found".
@@ -4274,6 +4276,211 @@ class ApiClient:
         )
         return t.cast("dict[str, t.Any]", response.json())
 
+    # ------------------------------------------------------------------
+    # Workflows - authored graphs, runs, and approvals
+    # ------------------------------------------------------------------
+
+    def list_workflow_definitions(
+        self,
+        org: str,
+        workspace: str,
+        *,
+        capability: str | None = None,
+        name: str | None = None,
+        agent: str | None = None,
+        limit: int = 100,
+    ) -> list[dict[str, t.Any]]:
+        """GET workspace workflow definitions."""
+        params: dict[str, t.Any] = {"limit": limit}
+        params.update(
+            {
+                key: value
+                for key, value in (
+                    ("capability", capability),
+                    ("name", name),
+                    ("agent", agent),
+                )
+                if value is not None
+            }
+        )
+        response = self.request(
+            "GET",
+            f"/org/{org}/ws/{workspace}/workflows/definitions",
+            params=params,
+        )
+        return t.cast("list[dict[str, t.Any]]", response.json())
+
+    def get_workflow_definition(
+        self, org: str, workspace: str, definition_id: str
+    ) -> dict[str, t.Any]:
+        """Get a workspace-visible definition with its full topology."""
+        response = self.request(
+            "GET",
+            f"/org/{org}/ws/{workspace}/workflows/definitions/{definition_id}",
+        )
+        return t.cast("dict[str, t.Any]", response.json())
+
+    def create_workflow_run(
+        self,
+        org: str,
+        workspace: str,
+        *,
+        definition_id: str,
+        project_id: str,
+        input_data: dict[str, t.Any] | None = None,
+        host_kind: str = "runtime",
+        runtime_id: str | None = None,
+    ) -> dict[str, t.Any]:
+        """Start a workflow run in a workspace project."""
+        if host_kind == "runtime" and runtime_id is None:
+            raise ValueError("runtime_id is required for runtime-hosted workflows")
+        if host_kind == "local" and runtime_id is not None:
+            raise ValueError("runtime_id is not allowed for local workflows")
+        payload: dict[str, t.Any] = {
+            "definition_id": definition_id,
+            "project_id": project_id,
+            "input": input_data or {},
+            "host_kind": host_kind,
+        }
+        if runtime_id is not None:
+            payload["runtime_id"] = runtime_id
+        response = self.request(
+            "POST",
+            f"/org/{org}/ws/{workspace}/workflows/runs",
+            json_data=payload,
+        )
+        return t.cast("dict[str, t.Any]", response.json())
+
+    def list_workflow_runs(
+        self,
+        org: str,
+        workspace: str,
+        *,
+        project_id: str | None = None,
+        runtime_id: str | None = None,
+        definition_id: str | None = None,
+        status: str | None = None,
+        limit: int = 100,
+    ) -> list[dict[str, t.Any]]:
+        """List workflow runs in a workspace project."""
+        if project_id is None and runtime_id is None:
+            raise ValueError("project_id is required unless polling by runtime_id")
+        params: dict[str, t.Any] = {"limit": limit}
+        if project_id is not None:
+            params["project_id"] = project_id
+        if runtime_id is not None:
+            params["runtime_id"] = runtime_id
+        if definition_id is not None:
+            params["definition_id"] = definition_id
+        if status is not None:
+            params["status"] = status
+        response = self.request(
+            "GET",
+            f"/org/{org}/ws/{workspace}/workflows/runs",
+            params=params,
+        )
+        return t.cast("list[dict[str, t.Any]]", response.json())
+
+    def claim_workflow_run(
+        self,
+        org: str,
+        workspace: str,
+        run_id: str,
+        *,
+        execution_id: str,
+        runtime_id: str | None = None,
+    ) -> dict[str, t.Any]:
+        """Atomically claim one pending workflow run for this host."""
+        payload: dict[str, t.Any] = {"execution_id": execution_id}
+        if runtime_id is not None:
+            payload["runtime_id"] = runtime_id
+        response = self.request(
+            "POST",
+            f"/org/{org}/ws/{workspace}/workflows/runs/{run_id}/claim",
+            json_data=payload,
+        )
+        return t.cast("dict[str, t.Any]", response.json())
+
+    def get_workflow_run(self, org: str, workspace: str, run_id: str) -> dict[str, t.Any]:
+        """Get a workflow run with nodes and pinned topology."""
+        response = self.request("GET", f"/org/{org}/ws/{workspace}/workflows/runs/{run_id}")
+        return t.cast("dict[str, t.Any]", response.json())
+
+    def append_workflow_facts(
+        self,
+        org: str,
+        workspace: str,
+        run_id: str,
+        facts: list[dict[str, t.Any]],
+        *,
+        execution_id: str,
+    ) -> dict[str, t.Any]:
+        """Append host-sequenced facts to a workspace workflow run."""
+        response = self.request(
+            "POST",
+            f"/org/{org}/ws/{workspace}/workflows/runs/{run_id}/facts",
+            json_data={"execution_id": execution_id, "facts": facts},
+        )
+        return t.cast("dict[str, t.Any]", response.json())
+
+    def heartbeat_workflow_run(
+        self,
+        org: str,
+        workspace: str,
+        run_id: str,
+        *,
+        execution_id: str,
+    ) -> dict[str, t.Any]:
+        """Report workflow-run liveness."""
+        response = self.request(
+            "POST",
+            f"/org/{org}/ws/{workspace}/workflows/runs/{run_id}/heartbeat",
+            json_data={"execution_id": execution_id},
+        )
+        return t.cast("dict[str, t.Any]", response.json())
+
+    def cancel_workflow_run(
+        self, org: str, workspace: str, run_id: str, *, project_id: str
+    ) -> dict[str, t.Any]:
+        """Cancel a workflow run in one project."""
+        response = self.request(
+            "POST",
+            f"/org/{org}/ws/{workspace}/workflows/runs/{run_id}/cancel",
+            params={"project_id": project_id},
+        )
+        return t.cast("dict[str, t.Any]", response.json())
+
+    def list_workflow_approvals(
+        self, org: str, workspace: str, *, project_id: str, limit: int = 100
+    ) -> list[dict[str, t.Any]]:
+        """List pending workflow approvals in a workspace project."""
+        response = self.request(
+            "GET",
+            f"/org/{org}/ws/{workspace}/workflows/approvals",
+            params={"project_id": project_id, "limit": limit},
+        )
+        return t.cast("list[dict[str, t.Any]]", response.json())
+
+    def decide_workflow_approval(
+        self,
+        org: str,
+        workspace: str,
+        approval_id: str,
+        *,
+        outcome: str,
+        note: str | None = None,
+    ) -> dict[str, t.Any]:
+        """Decide a workspace workflow approval."""
+        payload: dict[str, t.Any] = {"outcome": outcome}
+        if note is not None:
+            payload["note"] = note
+        response = self.request(
+            "POST",
+            f"/org/{org}/ws/{workspace}/workflows/approvals/{approval_id}/decision",
+            json_data=payload,
+        )
+        return t.cast("dict[str, t.Any]", response.json())
+
 
 def create_api_client(*, profile: str | None = None) -> ApiClient:
     """Create an authenticated API client using stored API key configuration data."""

dreadnode/app/api/models.py

@@ -95,11 +95,18 @@ class PlatformConfig(BaseModel):
     # web UI defaults it the other way and fails closed, but nothing in the SDK
     # gates on it today — it is mirrored so the drift check stays meaningful.
     airgapped: bool = False
+    email_configured: bool = False
     recaptcha_enabled: bool = False
     recaptcha_site_key: str | None = None
+    account_defender_enabled: bool = False
+    account_defender_site_key: str | None = None
     credits_enabled: bool = True
     feedback_enabled: bool = False
     integrations_enabled: bool = True
+    # Whether the operator has enabled the Slack integration for this
+    # deployment. Absent (False) on older platforms, which have no Slack routes
+    # at all, so a client that does not receive it shows nothing (SLK-GATE-003).
+    slack_enabled: bool = False
     # False on older platforms whose /feedback rejects diagnostic-report fields.
     feedback_diagnostics: bool = False
     website_url: str
@@ -299,6 +306,14 @@ class Organization(BaseModel):
     """URL-friendly identifier for the organization."""
     description: str | None = None
     """Description of the organization."""
+    avatar_preset: t.Literal["slate", "blue", "violet", "green", "amber"] | None = None
+    """Selected avatar color preset."""
+    avatar_source: t.Literal["image", "preset"] | None = None
+    """Which avatar is active; None renders the organization name initial."""
+    avatar_image_available: bool = False
+    """Whether the organization has an uploaded avatar image."""
+    avatar_image_revision: str | None = None
+    """Revision of the uploaded avatar image."""
     is_active: bool = True
     """Is the organization active?"""
     allow_external_invites: bool = False

dreadnode/app/cli/capability.py

@@ -350,7 +350,22 @@ def _summarize_capability(p: dict[str, t.Any]) -> str:
     visibility = "public" if p.get("is_public") else "private"
     description = p.get("description")
     suffix = f" [dim]-[/dim] {description}" if description else ""
-    return f"[cyan]{name}[/cyan]@[dim]{version}[/dim] {_visibility_markup(visibility)}{suffix}"
+    secrets = p.get("secrets")
+    required_secrets = (
+        [
+            secret.get("name")
+            for secret in secrets
+            if isinstance(secret, dict) and secret.get("required", True)
+        ]
+        if isinstance(secrets, list)
+        else []
+    )
+    credential_notice = (
+        f" [yellow]requires credentials: {', '.join(str(secret) for secret in required_secrets)}[/yellow]"
+        if required_secrets
+        else ""
+    )
+    return f"[cyan]{name}[/cyan]@[dim]{version}[/dim] {_visibility_markup(visibility)}{suffix}{credential_notice}"
 
 
 _CAPABILITY_LIST_ROW_FIELDS: tuple[str, ...] = (
@@ -360,6 +375,7 @@ _CAPABILITY_LIST_ROW_FIELDS: tuple[str, ...] = (
     "author_name",
     "license",
     "component_counts",
+    "secrets",
     "version_count",
     "versions",
     "created_at",

dreadnode/app/cli/environment.py

@@ -11,6 +11,7 @@ import typing as t
 
 import cyclopts
 
+from dreadnode.app.api.client import NotFoundError
 from dreadnode.app.cli.args import PlatformScopeArgs
 from dreadnode.app.cli.shared import (
     _FLAG_STATE,
@@ -137,7 +138,33 @@ def _print_environment_detail(payload: dict[str, t.Any]) -> None:
 # ---------------------------------------------------------------------------
 
 
-@cli.command()
+def _create_env_with_hint(
+    api: t.Any, org: str, workspace: str, body: dict[str, t.Any], task_ref: str
+) -> dict[str, t.Any]:
+    """Create the environment, adding a resolution hint to a task-not-found 404.
+
+    A bare name resolves to a task in the caller's org or any public task; a task
+    owned by another org resolves only when it is public or owned by the caller
+    (server-side visibility rule). We do not retry client-side - a public task
+    already resolves by bare name, and a private cross-org task 404s the same way
+    whether or not it is qualified. Only a task-not-found 404 gets the hint; any
+    other 404 (e.g. a bad ``--project-id``) keeps the server's own detail message.
+    """
+    try:
+        return api.create_environment(org, workspace, body)
+    except NotFoundError as exc:
+        # provision() can 404 on the project lookup (bad --project-id) before it
+        # ever resolves the task, so only rewrite genuine task-not-found errors.
+        if "task not found" not in str(exc).lower():
+            raise
+        raise NotFoundError(
+            f"Task '{task_ref}' not found. A bare name resolves to a task in your org or "
+            f"any public task; a task owned by another org must be public or owned by you. "
+            f"Check the name and version, or qualify it as <org>/<name>."
+        ) from exc
+
+
+@cli.command(alias="provision")
 def create(
     task_ref: str,
     *,
@@ -207,14 +234,19 @@ def create(
     as_json: t.Annotated[bool, cyclopts.Parameter(name="--json", negative=())] = False,
     platform: PlatformScopeArgs = PlatformScopeArgs(),
 ) -> None:
-    """Provision a task environment.
+    """Provision a task environment. (Alias: ``dreadnode env provision``.)
 
     ``task_ref`` follows the canonical ``[org/]name[@version]`` format:
 
-    - ``my-task``              — latest visible version
-    - ``my-task@1.0.0``        — exact version
-    - ``acme/my-task``         — cross-org (must be public or owned by you)
-    - ``acme/my-task@1.0.0``   — cross-org exact version
+    - ``my-task``              : latest version visible to you
+    - ``my-task@1.0.0``        : exact version
+    - ``acme/my-task``         : cross-org (must be public or owned by you)
+    - ``acme/my-task@1.0.0``   : cross-org exact version
+
+    A bare name resolves to a task in your org or any public task, so bundled
+    public targets (e.g. ``ml-extraction-fraud-tabular``, ``finops-mesh``) work by
+    bare name. A task owned by another org resolves only when it is public or
+    owned by you; otherwise qualify it as ``<org>/<name>``.
 
     Use ``--input name=value`` repeatedly to bind template variables (values
     are JSON-decoded when possible, falling back to plain strings).
@@ -245,7 +277,7 @@ def create(
     if env_models is not None:
         body["model_overrides"] = env_models
 
-    payload = api.create_environment(profile.org_key, profile.workspace_key, body)
+    payload = _create_env_with_hint(api, profile.org_key, profile.workspace_key, body, task_ref)
     env_id = str(payload.get("id", ""))
 
     if wait and env_id:

dreadnode/app/cli/main.py

@@ -149,6 +149,7 @@ _LAZY_COMMANDS: dict[str, tuple[str, str | None]] = {
     "task": ("dreadnode.app.cli.task", None),
     "task-set": ("dreadnode.app.cli.task_set", None),
     "train": ("dreadnode.app.cli.train", None),
+    "workflow": ("dreadnode.app.cli.workflow", None),
     "worlds": ("dreadnode.app.cli.worlds", None),
 }
 
@@ -336,9 +337,22 @@ def _run_print(tui_args: TuiArgs) -> None:
     if not tui_args.prompt:
         raise ValueError("--print requires --prompt")
 
+    # Resolve the same way the TUI does, so ``--profile`` and the scope
+    # flags reach the headless runtime instead of being re-derived from
+    # whichever profile happens to be active on disk.
+    from dreadnode.app.config import ProfileError
+
+    try:
+        profile = tui_args.resolve()
+    except ProfileError as exc:
+        raise ValueError(str(exc)) from exc
+    except Exception:
+        profile = None
+
     asyncio.run(
         run_print_mode(
             prompt=tui_args.prompt,
+            profile=profile,
             model=resolve_model(tui_args.model) if tui_args.model else None,
             agent=tui_args.agent,
             capabilities_dirs=tui_args.capabilities_dirs,