epsiloneridani 0.1.0__tar.gz

epsiloneridani-0.1.0/.dockerignore

@@ -0,0 +1,14 @@
+.git
+.github
+.env
+.venv
+.ruff_cache
+__pycache__
+*.pyc
+*.egg-info
+checkouts
+dist
+logs
+state
+tests
+uv.lock

epsiloneridani-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,189 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    # Rebuild against moving base images and agent/install endpoints even when this repo is quiet.
+    - cron: "17 4 * * 1"
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    env:
+      # The worker is stdlib-only (bar the TUI's rich/textual), so test on one interpreter — the
+      # latest uv ships — rather than a per-version matrix. requires-python >=3.11 is a declaration.
+      UV_PYTHON: "3.14"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          enable-cache: true
+          cache-suffix: test
+      - name: Run the test suite
+        run: ./tests/run-all
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          enable-cache: true
+          cache-suffix: lint
+      # Pin ruff so a new release's rules/formatter can't turn CI red without a code change here.
+      - name: ruff check
+        run: uvx ruff@0.15.18 check .
+      - name: ruff format --check
+        run: uvx ruff@0.15.18 format --check .
+      - name: Install ShellCheck
+        run: sudo apt-get update && sudo apt-get install -y shellcheck
+      # --severity=warning: skip the info/style notes on the deliberate `A && B || C` test idiom
+      # (where B, an echo, always succeeds), while still failing on real warnings and errors.
+      - name: ShellCheck
+        run: shellcheck --severity=warning scripts/claim.sh scripts/git-safe-push scripts/gh-safe-pr-create scripts/docker-entrypoint tests/*.sh tests/run-all
+
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          enable-cache: true
+          cache-suffix: build
+      - name: Build the wheel
+        run: uv build
+      # uv build proves the artifact builds; this proves the force-include mapping (prompts/ and
+      # scripts/ into the epsiloneridani_worker package) works once installed, and that the console script
+      # runs. Run the import check from /tmp with -P so the source-tree epsiloneridani_worker/ on the
+      # checkout root can't shadow the installed package (whose prompts/scripts sit beside it).
+      - name: Install smoke test
+        run: |
+          uv venv /tmp/smoke
+          uv pip install --python /tmp/smoke/bin/python dist/*.whl
+          /tmp/smoke/bin/epsiloneridani --help
+          cd /tmp && /tmp/smoke/bin/python -P - <<'PY'
+          import pathlib
+          import epsiloneridani_worker.__main__ as m
+          base = pathlib.Path(m.__file__).parent
+          assert (base / "prompts").is_dir(), "prompts/ missing from the installed wheel"
+          assert (base / "scripts").is_dir(), "scripts/ missing from the installed wheel"
+          print("bundled prompts/ and scripts/ present")
+          PY
+
+  docker:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Validate the Compose model
+        run: docker compose config --quiet
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - name: Build the worker image from this revision
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          load: true
+          tags: |
+            epsiloneridani-worker:ci
+            epsiloneridani-worker:local
+          pull: true
+          no-cache: ${{ github.event_name == 'schedule' }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=min
+      - name: Smoke-test the image and Compose service
+        run: |
+          docker compose run --rm --no-deps \
+            -e HOME=/tmp/isolated-home \
+            epsiloneridani bash -euo pipefail -c '
+            mkdir -p "$HOME"
+            for tool in gh git uvx jq lake codex claude epsiloneridani-oauth-refresh; do
+              command -v "$tool" >/dev/null
+            done
+            lake --version
+            ./epsiloneridani --help >/dev/null
+            claude auth login --help >/dev/null
+            codex login --help 2>&1 | grep -F -- --device-auth >/dev/null
+            doctor_output="$(./epsiloneridani doctor || true)"
+            printf "%s\n" "$doctor_output"
+            printf "%s\n" "$doctor_output" | grep -F "[ok     ] lake"
+            git init -q /tmp/git-smoke
+            git -C /tmp/git-smoke commit --allow-empty -m smoke >/dev/null
+            test "$(git -C /tmp/git-smoke log -1 --format=%ae)" = "epsiloneridani-worker@users.noreply.github.com"
+            set +e
+            claude_output="$(timeout 15 claude -p "Reply with ok" --model opus --dangerously-skip-permissions 2>&1)"
+            set -e
+            ! printf "%s\n" "$claude_output" | grep -F "cannot be used with root/sudo privileges"
+          '
+      - name: Smoke-test configurable worker options
+        run: |
+          TAUCETI_WORKER_ARGS=--help docker compose run --rm --no-deps epsiloneridani 2>&1 |
+            grep -F "usage: epsiloneridani work"
+          test ! -e .env
+          trap 'rm -f .env' EXIT
+          printf '%s\n' 'TAUCETI_WORKER_ARGS=--help' >.env
+          docker compose config --format json | python3 -c \
+            'import json, sys; assert json.load(sys.stdin)["services"]["epsiloneridani"]["environment"]["TAUCETI_WORKER_ARGS"] == "--help"'
+      # Exercise the actual tini -> uv -> Python process tree used by Compose. The
+      # unit test invokes Python directly and cannot prove that SIGTERM crosses uv.
+      - name: Graceful stop reaches the worker loop
+        run: |
+          docker compose up -d epsiloneridani
+          for attempt in $(seq 1 30); do
+            docker compose logs --no-color epsiloneridani | grep -F "loop start:" && break
+            test "$attempt" -lt 30
+            sleep 1
+          done
+          docker compose stop -t 60 epsiloneridani
+          worker_log="$(docker compose logs --no-color epsiloneridani)"
+          printf "%s\n" "$worker_log"
+          printf "%s\n" "$worker_log" | grep -F "loop terminated — stopping"
+          container_id="$(docker compose ps -aq epsiloneridani)"
+          test "$(docker inspect --format '{{.State.ExitCode}}' "$container_id")" = 143
+      - name: Smoke-test both credential refresher services
+        run: |
+          for provider in claude codex; do
+            log="$(mktemp)"
+            docker run --rm --entrypoint /usr/local/bin/epsiloneridani-oauth-refresh \
+              -e TAUCETI_REFRESH_ONCE=1 \
+              epsiloneridani-worker:ci "$provider" >"$log" 2>&1
+            grep -F "$provider-refresh: waiting for" "$log"
+          done
+      - name: Probe the live OAuth contracts
+        if: github.event_name == 'schedule'
+        run: |
+          docker run --rm -i --entrypoint python3 epsiloneridani-worker:ci <<'PY'
+          import requests
+
+          probes = [
+              (
+                  "claude",
+                  "https://platform.claude.com/v1/oauth/token",
+                  {
+                      "grant_type": "refresh_token",
+                      "refresh_token": "invalid-ci-probe",
+                      "client_id": "9d1c250a-e61b-44d9-88ed-5944d1962f5e",
+                      "scope": "user:profile user:inference user:sessions:claude_code user:mcp_servers",
+                  },
+              ),
+              (
+                  "codex",
+                  "https://auth.openai.com/oauth/token",
+                  {
+                      "grant_type": "refresh_token",
+                      "refresh_token": "invalid-ci-probe",
+                      "client_id": "app_EMoamEEZ73f0CkXaXp7hrann",
+                  },
+              ),
+          ]
+          for name, url, payload in probes:
+              response = requests.post(url, json=payload, timeout=30)
+              assert 400 <= response.status_code < 500, (name, response.status_code)
+              assert isinstance(response.json(), dict), name
+              print(f"{name}: reachable OAuth endpoint rejected the invalid probe as expected")
+          PY

epsiloneridani-0.1.0/.gitignore

@@ -0,0 +1,22 @@
+# Runtime state — not part of the worker's source.
+# (Host authoring uses checkouts/; --bubble rounds run inside a container.)
+/checkouts/
+/state/
+/logs/
+
+# Local Docker Compose options (may contain operator-specific configuration).
+/.env
+
+# Legacy local Screen assignments; `epsiloneridani workers import workers.conf` migrates these.
+/workers.conf
+
+# Python bytecode (epsiloneridani is a single-file script; tests import it).
+__pycache__/
+*.pyc
+
+# Build artifacts
+/dist/
+*.egg-info/
+
+# uv lockfile — generated for the single-file script, not source.
+/uv.lock

epsiloneridani-0.1.0/Dockerfile

@@ -0,0 +1,94 @@
+# A disposable Linux host for the Tau Ceti worker. The agent runs in host mode inside this
+# container; it does not use the more restrictive Bubble sandbox.
+FROM node:22-bookworm
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+ARG TAUCETI_LEAN_TOOLCHAIN=leanprover/lean4:v4.32.0
+
+# Runtime tools for epsiloneridani and its agents, plus a native toolchain for Lean builds. Debian
+# package revisions deliberately track Bookworm's security repository instead of being frozen.
+# hadolint ignore=DL3008
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+        build-essential \
+        ca-certificates \
+        curl \
+        git \
+        jq \
+        python3 \
+        python3-requests \
+        ripgrep \
+        xz-utils \
+    && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
+        -o /usr/share/keyrings/githubcli-archive-keyring.gpg \
+    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
+        > /etc/apt/sources.list.d/github-cli.list \
+    && apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends gh \
+    && rm -rf /var/lib/apt/lists/*
+
+# Lean (elan/lake) and uv/uvx. Both installers select binaries for the build architecture.
+RUN curl -fsSL https://elan.lean-lang.org/elan-init.sh | sh -s -- -y \
+    && /root/.elan/bin/elan toolchain install "$TAUCETI_LEAN_TOOLCHAIN" \
+    && /root/.elan/bin/elan default "$TAUCETI_LEAN_TOOLCHAIN" \
+    && curl -LsSf https://astral.sh/uv/install.sh | sh
+
+# Subscription authentication is performed at runtime and persisted by compose.yaml. Pin the
+# clients so rebuilding a deployment uses known client versions; the scheduled image build detects
+# when a pinned client or its service contract stops working. Keep this after Lean so a client-version
+# bump does not invalidate the much larger toolchain layer.
+ARG CLAUDE_CODE_VERSION=2.1.220
+ARG CODEX_VERSION=0.145.0
+RUN npm install -g \
+    "@anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}" \
+    "@openai/codex@${CODEX_VERSION}"
+
+# Kiro publishes native, architecture-specific bundles rather than an npm package. Pin both
+# supported checksums and select the archive from Debian's build architecture. The arm64 musl
+# bundle avoids the newer glibc required by Kiro's GNU arm64 build.
+ARG KIRO_CLI_VERSION=2.16.1
+ARG KIRO_CLI_SHA256_X64=6aeb89363c2c0b999cd1ad54449d632fa054ecce1dbba5ce175961877b3e0166
+ARG KIRO_CLI_SHA256_ARM64=ad7c7e0c769bf89ae56d424811c83917a1130aa7f6559a133c5cdfc30c2f7c21
+RUN case "$(dpkg --print-architecture)" in \
+        amd64) archive=kirocli-x86_64-linux.tar.xz; sha="$KIRO_CLI_SHA256_X64" ;; \
+        arm64) archive=kirocli-aarch64-linux-musl.tar.xz; sha="$KIRO_CLI_SHA256_ARM64" ;; \
+        *) echo "unsupported Kiro CLI architecture: $(dpkg --print-architecture)" >&2; exit 1 ;; \
+    esac \
+    && curl -fsSL "https://prod.download.cli.kiro.dev/stable/${KIRO_CLI_VERSION}/${archive}" \
+        -o /tmp/kiro-cli.tar.xz \
+    && echo "${sha}  /tmp/kiro-cli.tar.xz" | sha256sum -c - \
+    && tar -xJf /tmp/kiro-cli.tar.xz -C /tmp \
+    && install -m 0755 /tmp/kirocli/bin/kiro-cli /usr/local/bin/kiro-cli \
+    && install -m 0755 /tmp/kirocli/bin/kiro-cli-chat /usr/local/bin/kiro-cli-chat \
+    && install -m 0755 /tmp/kirocli/bin/kiro-cli-term /usr/local/bin/kiro-cli-term \
+    && rm -rf /tmp/kirocli /tmp/kiro-cli.tar.xz
+
+ENV PATH="/root/.elan/bin:/root/.local/bin:${PATH}" \
+    ELAN_HOME=/root/.elan \
+    UV_CACHE_DIR=/root/.cache/uv \
+    DISABLE_AUTOUPDATER=1 \
+    IS_SANDBOX=1 \
+    PYTHONUNBUFFERED=1
+
+# Keep the toolchain layers reusable while making every image contain the exact checked-out
+# worker revision under test (including pull-request changes).
+WORKDIR /opt/epsiloneridani
+COPY epsiloneridani pyproject.toml ./
+COPY prompts ./prompts
+COPY scripts ./scripts
+COPY epsiloneridani_worker ./epsiloneridani_worker
+
+# The refresher is a symlink, not a copy: it imports the rotation core from epsiloneridani_worker, and
+# resolving its own path back to /opt/epsiloneridani is how it finds the package in an image that runs the
+# worker from a checkout rather than an installed wheel.
+RUN ln -s /opt/epsiloneridani/scripts/oauth_refresh_loop.py /usr/local/bin/epsiloneridani-oauth-refresh \
+    && install -m 0755 scripts/docker-entrypoint /usr/local/bin/epsiloneridani-entrypoint \
+    && chmod 0755 epsiloneridani scripts/oauth_refresh_loop.py scripts/claim.sh scripts/gh-safe-pr-create scripts/git-safe-push \
+    && ./epsiloneridani --help >/dev/null \
+    && git config --system user.name "EpsilonEridani Worker" \
+    && git config --system user.email "epsiloneridani-worker@users.noreply.github.com" \
+    && git config --system credential.https://github.com.helper "" \
+    && git config --system --add credential.https://github.com.helper "!gh auth git-credential"
+
+ENTRYPOINT ["/usr/local/bin/epsiloneridani-entrypoint"]
+CMD ["./epsiloneridani", "work", "--loop"]

epsiloneridani-0.1.0/PKG-INFO

@@ -0,0 +1,7 @@
+Metadata-Version: 2.4
+Name: epsiloneridani
+Version: 0.1.0
+Summary: Autonomous worker for the eic/EpsilonEridani Lean library
+Requires-Python: >=3.11
+Requires-Dist: rich>=13
+Requires-Dist: textual<9,>=8