execweave 0.7.0__tar.gz → 0.7.1__tar.gz

execweave-0.7.1/.github/workflows/cleanup-workflow-history.yml

@@ -0,0 +1,98 @@
+name: Cleanup workflow history
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - .github/workflows/cleanup-workflow-history.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  actions: write
+
+jobs:
+  cleanup:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Delete superseded completed workflow runs
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ github.repository }}
+          CURRENT_RUN_ID: ${{ github.run_id }}
+          V070_PUBLISH_RUN_ID: "33179361863"
+        run: |
+          python - <<'PY'
+          import json
+          import os
+          import urllib.error
+          import urllib.request
+
+          repo = os.environ["REPOSITORY"]
+          token = os.environ["GH_TOKEN"]
+          current_run_id = int(os.environ["CURRENT_RUN_ID"])
+          protected_publish_run_id = int(os.environ["V070_PUBLISH_RUN_ID"])
+          api = f"https://api.github.com/repos/{repo}"
+          headers = {
+              "Accept": "application/vnd.github+json",
+              "Authorization": f"Bearer {token}",
+              "X-GitHub-Api-Version": "2022-11-28",
+              "User-Agent": "execweave-workflow-history-cleanup",
+          }
+
+          def request_json(url):
+              req = urllib.request.Request(url, headers=headers)
+              with urllib.request.urlopen(req) as response:
+                  return json.load(response)
+
+          runs = []
+          page = 1
+          while True:
+              payload = request_json(f"{api}/actions/runs?per_page=100&page={page}")
+              batch = payload.get("workflow_runs", [])
+              runs.extend(batch)
+              if len(batch) < 100:
+                  break
+              page += 1
+
+          completed = [run for run in runs if run.get("status") == "completed"]
+          completed.sort(key=lambda run: run.get("created_at", ""), reverse=True)
+
+          keep = {current_run_id, protected_publish_run_id}
+          seen_success = set()
+          seen_failure = set()
+
+          for run in completed:
+              workflow_id = run.get("workflow_id")
+              conclusion = run.get("conclusion")
+              if conclusion == "success" and workflow_id not in seen_success:
+                  keep.add(run["id"])
+                  seen_success.add(workflow_id)
+              elif conclusion != "success" and workflow_id not in seen_failure:
+                  keep.add(run["id"])
+                  seen_failure.add(workflow_id)
+
+          delete_ids = [run["id"] for run in completed if run["id"] not in keep]
+          deleted = 0
+          failed = []
+          for run_id in delete_ids:
+              req = urllib.request.Request(
+                  f"{api}/actions/runs/{run_id}",
+                  headers=headers,
+                  method="DELETE",
+              )
+              try:
+                  with urllib.request.urlopen(req) as response:
+                      if response.status == 204:
+                          deleted += 1
+              except urllib.error.HTTPError as exc:
+                  failed.append((run_id, exc.code))
+
+          print(f"workflow runs discovered: {len(runs)}")
+          print(f"completed runs considered: {len(completed)}")
+          print(f"protected runs: {len(keep)}")
+          print(f"deleted runs: {deleted}")
+          if failed:
+              print(f"failed deletions: {failed}")
+              raise SystemExit(1)
+          PY

{execweave-0.7.0 → execweave-0.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: execweave
-Version: 0.7.0
+Version: 0.7.1
 Summary: Turn AI-agent runtime behavior into a local interactive execution graph.
 Project-URL: Homepage, https://github.com/Irish-kw/ExecWeave
 Project-URL: Repository, https://github.com/Irish-kw/ExecWeave
@@ -82,7 +82,7 @@ Install the latest published wheel/sdist from PyPI:
 python -m pip install -U execweave
 ```
 
-The current release is **v0.7.0**.
+The current release is **v0.7.1**.
 
 For development:
 
@@ -327,7 +327,7 @@ Do not assume content has been secret-redacted. Commands, paths, endpoint metada
 
 ## Current status
 
-v0.7.0 combines cross-platform runtime collection, materialized execution graphs, standalone/live viewing, conservative provider↔runtime correlation, full-fidelity content-addressed provider evidence, attributable multi-agent execution traces, direct run-local conversation access, evidence grades, bounded rule packs, an explicit runtime threat/fidelity contract, and honest local run-integrity sealing. Observed evidence and inference remain separate by design.
+v0.7.1 combines cross-platform runtime collection, materialized execution graphs, standalone/live viewing, conservative provider↔runtime correlation, full-fidelity content-addressed provider evidence, attributable multi-agent execution traces, direct run-local conversation access, evidence grades, bounded rule packs, an explicit runtime threat/fidelity contract, and honest local run-integrity sealing. Observed evidence and inference remain separate by design.
 
 ## Documentation
 

{execweave-0.7.0 → execweave-0.7.1}/README.md

@@ -31,7 +31,7 @@ Install the latest published wheel/sdist from PyPI:
 python -m pip install -U execweave
 ```
 
-The current release is **v0.7.0**.
+The current release is **v0.7.1**.
 
 For development:
 
@@ -276,7 +276,7 @@ Do not assume content has been secret-redacted. Commands, paths, endpoint metada
 
 ## Current status
 
-v0.7.0 combines cross-platform runtime collection, materialized execution graphs, standalone/live viewing, conservative provider↔runtime correlation, full-fidelity content-addressed provider evidence, attributable multi-agent execution traces, direct run-local conversation access, evidence grades, bounded rule packs, an explicit runtime threat/fidelity contract, and honest local run-integrity sealing. Observed evidence and inference remain separate by design.
+v0.7.1 combines cross-platform runtime collection, materialized execution graphs, standalone/live viewing, conservative provider↔runtime correlation, full-fidelity content-addressed provider evidence, attributable multi-agent execution traces, direct run-local conversation access, evidence grades, bounded rule packs, an explicit runtime threat/fidelity contract, and honest local run-integrity sealing. Observed evidence and inference remain separate by design.
 
 ## Documentation
 

{execweave-0.7.0 → execweave-0.7.1}/pyproject.toml

@@ -4,8 +4,8 @@ build-backend = "hatchling.build"
 
 [project]
 name = "execweave"
-# ExecWeave v0.7.0 release metadata
-version = "0.7.0"
+# ExecWeave v0.7.1 release metadata
+version = "0.7.1"
 description = "Turn AI-agent runtime behavior into a local interactive execution graph."
 readme = "README.md"
 requires-python = ">=3.10"

{execweave-0.7.0 → execweave-0.7.1}/scripts/audit_i18n_parity.py

@@ -33,8 +33,7 @@ DOCS = [
 ]
 
 README_REQUIRED_SNIPPETS = [
-    "v0.6.3",
-    "v0.6.4",
+    "v0.6.9",
     "execweave live --open -- cursor",
     "execweave live --open -- opencode",
     "execweave live --open -- ollama serve",

{execweave-0.7.0 → execweave-0.7.1}/src/execweave/__init__.py

@@ -1,3 +1,3 @@
 """ExecWeave runtime graph package."""
 
-__version__ = "0.7.0"
+__version__ = "0.7.1"

execweave-0.7.1/src/execweave/codex_conversation.py

@@ -0,0 +1,289 @@
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+from typing import Any
+
+_MAX_IDENTITY_SCAN_LINES = 64
+_MAX_PREVIEW_MESSAGES = 80
+_MAX_PREVIEW_TEXT_CHARS = 6000
+
+
+def _canonical_absolute_path(value: object) -> Path | None:
+    if not isinstance(value, str) or not value:
+        return None
+    try:
+        path = Path(value).expanduser()
+        if not path.is_absolute():
+            return None
+        return path.resolve(strict=False)
+    except (OSError, RuntimeError, ValueError):
+        return None
+
+
+def _codex_sessions_root() -> Path:
+    configured = os.environ.get("CODEX_HOME")
+    home = Path(configured).expanduser() if configured else Path.home() / ".codex"
+    return (home / "sessions").resolve(strict=False)
+
+
+def _inside_codex_sessions(path: Path) -> bool:
+    try:
+        path.relative_to(_codex_sessions_root())
+    except ValueError:
+        return False
+    return True
+
+
+def _session_meta_identity(payload: dict[str, Any]) -> dict[str, Any] | None:
+    thread_id = payload.get("id") or payload.get("session_id")
+    if not isinstance(thread_id, str) or not thread_id:
+        return None
+    source = payload.get("source")
+    spawn: dict[str, Any] = {}
+    if isinstance(source, dict):
+        subagent = source.get("subagent")
+        if isinstance(subagent, dict):
+            candidate = subagent.get("thread_spawn")
+            if isinstance(candidate, dict):
+                spawn = candidate
+    agent_path = payload.get("agent_path") or spawn.get("agent_path")
+    nickname = payload.get("agent_nickname") or spawn.get("agent_nickname")
+    parent_thread_id = payload.get("parent_thread_id") or spawn.get("parent_thread_id")
+    history_start = payload.get("subagent_history_start_ordinal")
+    return {
+        "thread_id": thread_id,
+        "parent_thread_id": parent_thread_id if isinstance(parent_thread_id, str) else None,
+        "agent_path": agent_path if isinstance(agent_path, str) else None,
+        "agent_nickname": nickname if isinstance(nickname, str) else None,
+        "subagent_history_start_ordinal": (
+            history_start
+            if isinstance(history_start, int) and not isinstance(history_start, bool) and history_start >= 0
+            else None
+        ),
+    }
+
+
+def codex_rollout_identity(path: str | Path) -> dict[str, Any] | None:
+    """Read only leading Codex session metadata needed for exact thread identity."""
+    source = Path(path).expanduser().resolve(strict=False)
+    try:
+        with source.open("r", encoding="utf-8") as handle:
+            for index, line in enumerate(handle):
+                if index >= _MAX_IDENTITY_SCAN_LINES:
+                    break
+                if not line.strip():
+                    continue
+                try:
+                    record = json.loads(line)
+                except json.JSONDecodeError:
+                    return None
+                if record.get("type") != "session_meta":
+                    continue
+                payload = record.get("payload")
+                return _session_meta_identity(payload) if isinstance(payload, dict) else None
+    except (OSError, RuntimeError, UnicodeError):
+        return None
+    return None
+
+
+def validated_codex_transcript(payload: dict[str, Any]) -> tuple[Path, dict[str, Any]] | None:
+    """Validate a hook-supplied rollout path before ExecWeave reads or copies it."""
+    path = _canonical_absolute_path(payload.get("transcript_path"))
+    if path is None or path.suffix.lower() != ".jsonl" or not path.name.startswith("rollout-"):
+        return None
+    if not _inside_codex_sessions(path) or not path.is_file():
+        return None
+    agent_id = payload.get("agent_id")
+    session_id = payload.get("session_id")
+    expected = agent_id if isinstance(agent_id, str) and agent_id else session_id
+    if not isinstance(expected, str) or not expected or not path.stem.endswith(f"-{expected}"):
+        return None
+    identity = codex_rollout_identity(path)
+    if identity is None or identity.get("thread_id") != expected:
+        return None
+    if isinstance(agent_id, str) and agent_id and isinstance(session_id, str) and session_id:
+        parent = identity.get("parent_thread_id")
+        if isinstance(parent, str) and parent and parent != session_id:
+            return None
+    return path, identity
+
+
+def codex_rollout_identity_from_payload(payload: dict[str, Any]) -> dict[str, Any] | None:
+    validated = validated_codex_transcript(payload)
+    return validated[1] if validated is not None else None
+
+
+def _content_text(content: object) -> str:
+    if not isinstance(content, list):
+        return ""
+    parts: list[str] = []
+    for part in content:
+        if not isinstance(part, dict) or part.get("type") not in {"input_text", "output_text", "Text"}:
+            continue
+        text = part.get("text")
+        if isinstance(text, str) and text:
+            parts.append(text)
+    return "\n".join(parts).strip()
+
+
+def _trim_text(value: str) -> str:
+    if len(value) <= _MAX_PREVIEW_TEXT_CHARS:
+        return value
+    return value[: _MAX_PREVIEW_TEXT_CHARS - 1] + "…"
+
+
+def _agent_message_header(text: str) -> dict[str, str]:
+    result: dict[str, str] = {}
+    before_payload, marker, after_payload = text.partition("Payload:")
+    for line in before_payload.splitlines():
+        key, separator, value = line.partition(":")
+        if not separator:
+            continue
+        normalized = key.strip().lower().replace(" ", "_")
+        if normalized in {"message_type", "task_name", "sender"} and value.strip():
+            result[normalized] = value.strip()
+    if marker and after_payload.strip():
+        result["payload_text"] = after_payload.strip()
+    return result
+
+
+def _message(timestamp: object, ordinal: object, **fields: Any) -> dict[str, Any]:
+    return {
+        "timestamp": timestamp if isinstance(timestamp, str) else None,
+        "ordinal": ordinal if isinstance(ordinal, int) and not isinstance(ordinal, bool) else None,
+        **fields,
+    }
+
+
+def codex_rollout_preview(path: str | Path) -> dict[str, Any] | None:
+    """Extract visible conversation items without exposing hidden/system context."""
+    source = Path(path).expanduser().resolve(strict=False)
+    identity = codex_rollout_identity(source)
+    if identity is None:
+        return None
+    cutoff = identity.get("subagent_history_start_ordinal")
+    min_ordinal = cutoff if isinstance(cutoff, int) else 0
+    agent_path = identity.get("agent_path")
+    if not isinstance(agent_path, str) or not agent_path:
+        agent_path = "/root" if identity.get("parent_thread_id") is None else None
+    messages: list[dict[str, Any]] = []
+    try:
+        with source.open("r", encoding="utf-8") as handle:
+            for line in handle:
+                if not line.strip():
+                    continue
+                try:
+                    record = json.loads(line)
+                except json.JSONDecodeError:
+                    continue
+                ordinal = record.get("ordinal")
+                if isinstance(ordinal, int) and ordinal < min_ordinal:
+                    continue
+                if record.get("type") != "response_item":
+                    continue
+                payload = record.get("payload")
+                if not isinstance(payload, dict):
+                    continue
+                payload_type = payload.get("type")
+                if payload_type == "agent_message":
+                    content = payload.get("content")
+                    header = _agent_message_header(_content_text(content))
+                    encrypted = isinstance(content, list) and any(
+                        isinstance(part, dict) and part.get("type") == "encrypted_content"
+                        for part in content
+                    )
+                    messages.append(
+                        _message(
+                            record.get("timestamp"),
+                            ordinal,
+                            kind=header.get("message_type", "agent_message").lower(),
+                            sender=payload.get("author") or header.get("sender"),
+                            recipient=payload.get("recipient"),
+                            text=None if encrypted else header.get("payload_text"),
+                            content_state="provider_encrypted" if encrypted else "plaintext",
+                            phase=None,
+                            task_name=header.get("task_name"),
+                        )
+                    )
+                elif payload_type == "message":
+                    role = payload.get("role")
+                    phase = payload.get("phase")
+                    text = _content_text(payload.get("content"))
+                    if role == "assistant" and text and phase in {"commentary", "final_answer"}:
+                        messages.append(
+                            _message(
+                                record.get("timestamp"),
+                                ordinal,
+                                kind="assistant_message",
+                                sender=agent_path,
+                                recipient=None,
+                                text=_trim_text(text),
+                                content_state="plaintext",
+                                phase=phase,
+                                task_name=None,
+                            )
+                        )
+                    elif role == "user" and text:
+                        metadata = payload.get("internal_chat_message_metadata_passthrough")
+                        kinds = metadata.get("content_item_kinds") if isinstance(metadata, dict) else None
+                        if isinstance(kinds, list) and "user.text" in kinds:
+                            messages.append(
+                                _message(
+                                    record.get("timestamp"),
+                                    ordinal,
+                                    kind="user_message",
+                                    sender="user",
+                                    recipient=agent_path,
+                                    text=_trim_text(text),
+                                    content_state="plaintext",
+                                    phase=None,
+                                    task_name=None,
+                                )
+                            )
+                elif (
+                    payload_type == "function_call"
+                    and payload.get("namespace") == "collaboration"
+                    and payload.get("name") == "send_message"
+                ):
+                    arguments = payload.get("arguments")
+                    try:
+                        parsed = json.loads(arguments) if isinstance(arguments, str) else arguments
+                    except json.JSONDecodeError:
+                        parsed = None
+                    if isinstance(parsed, dict):
+                        target = parsed.get("target")
+                        value = parsed.get("message")
+                        encrypted = isinstance(value, str) and value.startswith("gAAAAA")
+                        messages.append(
+                            _message(
+                                record.get("timestamp"),
+                                ordinal,
+                                kind="send_message",
+                                sender=agent_path,
+                                recipient=target if isinstance(target, str) else None,
+                                text=(
+                                    _trim_text(value)
+                                    if isinstance(value, str) and value and not encrypted
+                                    else None
+                                ),
+                                content_state="provider_encrypted" if encrypted else "plaintext",
+                                phase=None,
+                                task_name=None,
+                            )
+                        )
+    except (OSError, RuntimeError, UnicodeError):
+        return None
+    truncated = len(messages) > _MAX_PREVIEW_MESSAGES
+    if truncated:
+        messages = messages[:10] + messages[-(_MAX_PREVIEW_MESSAGES - 10) :]
+    return {
+        "thread_id": identity.get("thread_id"),
+        "parent_thread_id": identity.get("parent_thread_id"),
+        "agent_path": agent_path,
+        "agent_nickname": identity.get("agent_nickname"),
+        "message_count": len(messages),
+        "messages_truncated": truncated,
+        "messages": messages,
+    }

{execweave-0.7.0 → execweave-0.7.1}/src/execweave/codex_hook_cli.py

@@ -20,6 +20,7 @@ from .codex_hook_lifecycle import (
     codex_official_hook_lifecycle_events,
 )
 from .content_store import FullFidelityContentStore
+from .conversation_archive import codex_conversation_archive_events
 
 
 def _hook_handler(command: str) -> dict[str, str]:
@@ -30,6 +31,21 @@ def _now() -> str:
     return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
 
 
+def _codex_trace_visibility_event(timestamp: str) -> dict[str, Any]:
+    return provider_agent_trace_visibility_event(
+        "codex",
+        timestamp=timestamp,
+        source={
+            "type": "agent",
+            "id": "agent:OpenAI Codex",
+            "name": "OpenAI Codex",
+            "attributes": {"provider": "codex"},
+        },
+        attribution="codex_hook",
+        evidence_source="provider_hook",
+    )
+
+
 def codex_hook_config(command: str = "execweave-codex-hook") -> dict[str, Any]:
     handler = _hook_handler(command)
     tool_group = {"matcher": "*", "hooks": [handler]}
@@ -126,14 +142,7 @@ def main(argv: list[str] | None = None) -> int:
             codex_official_hook_lifecycle_events(payload, timestamp=observed_at)
         )
         if payload.get("hook_event_name") == "SessionStart":
-            summary_records.append(
-                provider_agent_trace_visibility_event(
-                    "codex",
-                    timestamp=observed_at,
-                    attribution="codex_hook",
-                    evidence_source="provider_hook",
-                )
-            )
+            summary_records.append(_codex_trace_visibility_event(observed_at))
         append_semantic_records(sidecar, summary_records)
 
         content_store = FullFidelityContentStore(sidecar.parent)
@@ -143,6 +152,12 @@ def main(argv: list[str] | None = None) -> int:
             timestamp=observed_at,
         )
         append_semantic_records(sidecar, content_records)
+        archive_records = codex_conversation_archive_events(
+            payload,
+            store=content_store,
+            timestamp=observed_at,
+        )
+        append_semantic_records(sidecar, archive_records)
     except (OSError, RuntimeError, TimeoutError, TypeError, ValueError) as exc:
         print(f"ExecWeave Codex hook warning: {exc}", file=sys.stderr)
         return 1 if args.strict else 0

{execweave-0.7.0 → execweave-0.7.1}/src/execweave/conversation_archive.py

@@ -4,6 +4,7 @@ from pathlib import Path
 from typing import Any
 
 from .antigravity_subagent_linkage import validated_transcript_path as _antigravity_transcript_path
+from .codex_conversation import validated_codex_transcript
 from .content_evidence import content_observation_event
 from .content_store import FullFidelityContentStore
 
@@ -182,6 +183,102 @@ def claude_conversation_archive_events(
     return []
 
 
+def codex_conversation_archive_events(
+    payload: dict[str, Any],
+    *,
+    store: FullFidelityContentStore,
+    timestamp: str,
+) -> list[dict[str, Any]]:
+    """Snapshot validated Codex rollout JSONL so later inspection never needs ~/.codex."""
+    hook = payload.get("hook_event_name")
+    if hook not in {"SubagentStop", "Stop", "SessionEnd"}:
+        return []
+    session_id = payload.get("session_id")
+    if not isinstance(session_id, str) or not session_id:
+        return []
+    validated = validated_codex_transcript(payload)
+    if validated is None:
+        return []
+    path, identity = validated
+    agent_id = payload.get("agent_id")
+    if hook == "SubagentStop" and isinstance(agent_id, str) and agent_id:
+        agent_path = identity.get("agent_path")
+        nickname = identity.get("agent_nickname")
+        agent_type = payload.get("agent_type")
+        name = next(
+            (
+                value
+                for value in (agent_path, nickname, agent_type, "Codex subagent")
+                if isinstance(value, str) and value
+            ),
+            "Codex subagent",
+        )
+        source = _entity(
+            "agent",
+            f"agent:codex:{session_id}:subagent:{agent_id}",
+            name=name,
+            attributes={
+                "provider": "codex",
+                "session_id": session_id,
+                "agent_id": agent_id,
+                "agent_type": agent_type,
+                "agent_path": agent_path,
+                "agent_nickname": nickname,
+                "parent_thread_id": identity.get("parent_thread_id"),
+                "identity_semantics": "provider_rollout_session_meta",
+            },
+        )
+        return _archive(
+            path=path,
+            store=store,
+            timestamp=timestamp,
+            provider="codex",
+            source=source,
+            content_kind="codex.conversation_transcript.subagent",
+            observed_field="transcript_path",
+            attribution="codex_hook_plus_rollout",
+            evidence_source="provider_hook_plus_validated_transcript",
+            attributes={
+                "codex_hook_event_name": hook,
+                "provider_subagent_id_exact": True,
+                "provider_rollout_thread_id_exact": True,
+                "transcript_scope": "subagent",
+            },
+        )
+
+    if isinstance(agent_id, str) and agent_id:
+        return []
+    source = _entity(
+        "agent",
+        "agent:OpenAI Codex",
+        name="OpenAI Codex",
+        attributes={
+            "provider": "codex",
+            "session_id": session_id,
+            "thread_id": identity.get("thread_id"),
+            "agent_path": "/root",
+            "identity_semantics": "provider_rollout_session_meta",
+        },
+    )
+    return _archive(
+        path=path,
+        store=store,
+        timestamp=timestamp,
+        provider="codex",
+        source=source,
+        content_kind="codex.conversation_transcript.main",
+        observed_field="transcript_path",
+        attribution="codex_hook_plus_rollout",
+        evidence_source="provider_hook_plus_validated_transcript",
+        attributes={
+            "codex_hook_event_name": hook,
+            "provider_session_id_exact": True,
+            "provider_rollout_thread_id_exact": True,
+            "transcript_scope": "main_session",
+        },
+    )
+
+
 def antigravity_conversation_archive_events(
     payload: dict[str, Any],
     *,