getstack 0.11.0__tar.gz → 0.13.0__tar.gz

{getstack-0.11.0 → getstack-0.13.0}/.gitignore

@@ -18,10 +18,8 @@ scripts/.env.cto
 .npmrc.local
 ~/.npmrc
 
-# Strategy docs (not sensitive, but private)
-stack-claude-code-spec-v3.md
-stack-gtm-distribution.md
-stack-platform-spec-v2.md
+# Strategy docs: now tracked in this private repo so they survive a laptop
+# wipe (were gitignored + local-only, a backup gap). Not sensitive.
 
 # IDE
 .vscode/settings.json
@@ -42,6 +40,7 @@ mcp-publisher.exe
 # Fly.io deployment config (contains app names, regions)
 **/fly.toml
 !apps/*/fly.toml
+!infra/**/fly.toml
 !**/fly.toml.example
 
 # Logs
@@ -54,6 +53,11 @@ npm-debug.log*
 # Claude Code per-machine state (background scheduler)
 .claude/scheduled_tasks.lock
 
+# spec-judge per-session state (active plan pointer + judge verdict; never committed)
+.claude/active-plan.json
+.claude/judge-verdict.json
+.claude/.verify*
+
 # OpenAPI spec cache (regenerated by scripts/verify-intents-openapi.ts)
 scripts/.openapi-cache/
 

{getstack-0.11.0 → getstack-0.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: getstack
-Version: 0.11.0
+Version: 0.13.0
 Summary: Python SDK for STACK — trust infrastructure for AI agents
 Project-URL: Homepage, https://getstack.run
 Project-URL: Documentation, https://getstack.run/docs/sdk

{getstack-0.11.0 → getstack-0.13.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "getstack"
-version = "0.11.0"
+version = "0.13.0"
 description = "Python SDK for STACK — trust infrastructure for AI agents"
 readme = "README.md"
 license = "MIT"

{getstack-0.11.0 → getstack-0.13.0}/src/getstack/_async/identity.py

@@ -90,3 +90,6 @@ class AsyncIdentityService:
 
     async def set_service_requirement(self, service_id: str, **kwargs: Any) -> dict[str, Any]:
         return await self._client.post(f"/v1/services/{service_id}/requirements", json=kwargs)
+
+    async def delete_service_requirement(self, service_id: str, requirement_id: str) -> None:
+        await self._client.delete(f"/v1/services/{service_id}/requirements/{requirement_id}")

{getstack-0.11.0 → getstack-0.13.0}/src/getstack/agents.py

@@ -15,7 +15,10 @@ def _to_agent(data: dict[str, Any]) -> Agent:
         name=data["name"],
         description=data.get("description"),
         status=data["status"],
-        accountability_mode=data.get("accountability_mode", "standard"),
+        # DB default for new agents is "enforced" (matches the API), not
+        # "standard" — the old fallback misreported the mode when the
+        # field was absent from a response.
+        accountability_mode=data.get("accountability_mode", "enforced"),
         on_warning=data.get("on_warning", "notify"),
         on_critical=data.get("on_critical", "notify"),
         passport_blocked=data.get("passport_blocked", False),
@@ -23,6 +26,7 @@ def _to_agent(data: dict[str, Any]) -> Agent:
         passport_blocked_at=data.get("passport_blocked_at"),
         created_at=data["created_at"],
         updated_at=data["updated_at"],
+        credential_access=data.get("credential_access", "direct"),
     )
 
 
@@ -34,13 +38,35 @@ class AgentService:
         self,
         name: str,
         description: str | None = None,
-        accountability_mode: str = "enforced",
+        profile: str | None = None,
+        accountability_mode: str | None = None,
+        credential_access: str | None = None,
         on_warning: str = "notify",
         on_critical: str = "notify",
     ) -> Agent:
-        body: dict[str, Any] = {"name": name, "accountability_mode": accountability_mode}
+        """Register an agent.
+
+        For a bot that just runs (calls an LLM through STACK, no provider
+        key on its box), pass ``profile="proxied-llm-bot"`` — it expands
+        server-side to ``credential_access="proxy_only"`` +
+        ``accountability_mode="logged"`` + ``key_mode="stack_managed"`` so
+        the first call works with no approval-header dance. Any field you
+        also pass explicitly overrides the preset.
+
+        Omitting ``accountability_mode``/``credential_access`` leaves the
+        server default (``enforced`` + ``direct``) OR the profile value —
+        they are only sent when provided, so an unset value never clobbers
+        a preset.
+        """
+        body: dict[str, Any] = {"name": name}
         if description:
             body["description"] = description
+        if profile is not None:
+            body["profile"] = profile
+        if accountability_mode is not None:
+            body["accountability_mode"] = accountability_mode
+        if credential_access is not None:
+            body["credential_access"] = credential_access
         if on_warning != "notify":
             body["on_warning"] = on_warning
         if on_critical != "notify":

{getstack-0.11.0 → getstack-0.13.0}/src/getstack/identity.py

@@ -117,3 +117,6 @@ class IdentityService:
 
     def set_service_requirement(self, service_id: str, **kwargs: Any) -> dict[str, Any]:
         return self._client.post(f"/v1/services/{service_id}/requirements", json=kwargs)
+
+    def delete_service_requirement(self, service_id: str, requirement_id: str) -> None:
+        self._client.delete(f"/v1/services/{service_id}/requirements/{requirement_id}")

{getstack-0.11.0 → getstack-0.13.0}/src/getstack/types.py

@@ -20,6 +20,9 @@ class Agent:
     passport_blocked_at: str | None
     created_at: str
     updated_at: str
+    # Raw-secret access policy: "direct" | "proxy_preferred" | "proxy_only".
+    # Defaulted for backward compatibility with older API responses.
+    credential_access: str = "direct"
 
 
 @dataclass