getstack 0.8.0__tar.gz → 0.9.0__tar.gz

{getstack-0.8.0 → getstack-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: getstack
-Version: 0.8.0
+Version: 0.9.0
 Summary: Python SDK for STACK — trust infrastructure for AI agents
 Project-URL: Homepage, https://getstack.run
 Project-URL: Documentation, https://getstack.run/docs/sdk

{getstack-0.8.0 → getstack-0.9.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "getstack"
-version = "0.8.0"
+version = "0.9.0"
 description = "Python SDK for STACK — trust infrastructure for AI agents"
 readme = "README.md"
 license = "MIT"

{getstack-0.8.0 → getstack-0.9.0}/src/getstack/__init__.py

@@ -52,8 +52,10 @@ from .scan import ScanService
 from .security_events import SecurityEventService as SecurityEventSvc
 from .skills import SkillService
 from .identity import IdentityService
+from .inbound_webhooks import InboundWebhookService
 from .intents import IntentsService
 from .missions import MissionsService
+from .evidence_packs import EvidencePacksService
 from .llm import LlmService
 from .passport_session import PassportSession
 from .types import (
@@ -221,7 +223,9 @@ class Stack:
         self.identity = IdentityService(self._client)
         self.intents = IntentsService(self._client)
         self.missions = MissionsService(self._client)
+        self.evidence_packs = EvidencePacksService(self._client)
         self.llm = LlmService(self._client)
+        self.inbound_webhooks = InboundWebhookService(self._client)
 
     def issue_passport(
         self,
@@ -361,6 +365,7 @@ class AsyncStack:
         from ._async.intents import AsyncIntentsService
         from ._async.missions import AsyncMissionsService
         from ._async.llm import AsyncLlmService
+        from ._async.inbound_webhooks import AsyncInboundWebhookService
         from ._async.passport_session import AsyncPassportSession
 
         self.agents = AsyncAgentService(self._client)
@@ -379,6 +384,7 @@ class AsyncStack:
         self.intents = AsyncIntentsService(self._client)
         self.missions = AsyncMissionsService(self._client)
         self.llm = AsyncLlmService(self._client)
+        self.inbound_webhooks = AsyncInboundWebhookService(self._client)
         # Stash for issue_passport() — Python doesn't easily expose the
         # class binding without re-importing inside the method body.
         self._AsyncPassportSession = AsyncPassportSession

getstack-0.9.0/src/getstack/_async/inbound_webhooks.py

@@ -0,0 +1,39 @@
+"""Async mirror of InboundWebhookService (Phase 5.5)."""
+
+from __future__ import annotations
+
+from typing import Any, Literal, Optional
+
+from ..client import AsyncHttpClient
+
+
+Provider = Literal["agentmail", "generic"]
+
+
+class AsyncInboundWebhookService:
+    def __init__(self, client: AsyncHttpClient):
+        self._client = client
+
+    async def create(
+        self,
+        provider: Provider,
+        agent_id: str,
+        forward_url: Optional[str] = None,
+        generic_config: Optional[dict[str, Any]] = None,
+    ) -> dict[str, Any]:
+        body: dict[str, Any] = {"provider": provider, "agent_id": agent_id}
+        if forward_url is not None:
+            body["forward_url"] = forward_url
+        if generic_config is not None:
+            body["generic_config"] = generic_config
+        return await self._client.post("/v1/operator/inbound-webhooks", json=body)
+
+    async def list(self) -> list[dict[str, Any]]:
+        res = await self._client.get("/v1/operator/inbound-webhooks")
+        return list(res.get("webhooks", []))
+
+    async def get(self, webhook_id: str) -> dict[str, Any]:
+        return await self._client.get(f"/v1/operator/inbound-webhooks/{webhook_id}")
+
+    async def revoke(self, webhook_id: str) -> dict[str, Any]:
+        return await self._client.delete(f"/v1/operator/inbound-webhooks/{webhook_id}")

getstack-0.9.0/src/getstack/evidence_packs.py

@@ -0,0 +1,78 @@
+"""Evidence packs — export, get, list.
+
+Portable cryptographic bundles. Verifiable offline by any third party
+via the open-source `@getstackrun/verify` package.
+
+  export()  Export a pack for a mission / session / incident / period
+            scope. Returns the pack_id + the full canonical manifest
+            JSON inline. Persist the manifest to disk and hand it to
+            an auditor / insurer / regulator.
+  get()     Fetch one pack by id. Returns the signed claim envelope
+            bytes alongside the parsed pack_claim.
+  list()    List packs for the calling operator. Filter by scope.
+
+Enterprise-tier only at the API layer.
+
+Phase 5.4.7.
+"""
+
+from __future__ import annotations
+
+import json
+from typing import Any
+
+from .client import HttpClient
+
+
+class EvidencePacksService:
+    def __init__(self, client: HttpClient):
+        self._client = client
+
+    def export(
+        self,
+        *,
+        scope_kind: str,
+        scope_ref: str,
+        supersedes: str | None = None,
+        air_gap: bool | None = None,
+        output_path: str | None = None,
+    ) -> dict[str, Any]:
+        """Export an evidence pack.
+
+        `scope_kind` is one of `mission` | `session` | `incident` | `period`.
+        `scope_ref` is the matching reference (ms_* / ses_* / period:YYYY-Qn /
+        incident:<id>). The pack manifest is returned inline; pass
+        `output_path` to also write it to disk in one step.
+
+        Returns a dict with `pack_id`, `claim_id`, `pack_claim`, `manifest`.
+        """
+        body: dict[str, Any] = {
+            "scope": {"kind": scope_kind, "ref": scope_ref},
+        }
+        if supersedes is not None:
+            body["supersedes"] = supersedes
+        if air_gap is not None:
+            body["air_gap"] = air_gap
+        result = self._client.request("POST", "/v1/evidence-packs", json=body)
+        if output_path is not None and "manifest" in result:
+            with open(output_path, "w", encoding="utf-8") as f:
+                json.dump(result["manifest"], f, indent=2)
+        return result
+
+    def get(self, pack_id: str) -> dict[str, Any]:
+        """Fetch one pack by id. Returns the signed envelope_cose bytes and
+        the parsed `pack_claim` for convenient introspection."""
+        return self._client.request("GET", f"/v1/evidence-packs/{pack_id}")
+
+    def list(self, *, scope: str | None = None) -> dict[str, Any]:
+        """List packs for the calling operator.
+
+        `scope` filter is `<kind>:<ref>` (e.g. `mission:ms_abc`,
+        `period:2026-Q1`). Omit to list every pack. Newest first.
+        """
+        path = "/v1/evidence-packs"
+        if scope is not None:
+            from urllib.parse import urlencode
+
+            path = f"{path}?{urlencode({'scope': scope})}"
+        return self._client.request("GET", path)

getstack-0.9.0/src/getstack/inbound_webhooks.py

@@ -0,0 +1,56 @@
+"""Hosted inbound webhook surface (Phase 5.5).
+
+Operator creates a webhook row + receives a STACK-hosted URL + HMAC
+secret. Paste both into a provider's (AgentMail / generic) webhook
+config; STACK runs the prompt-injection detector on inbound content
+before forwarding to a downstream URL.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Literal, Optional
+
+from .client import HttpClient
+
+
+Provider = Literal["agentmail", "generic"]
+SignatureAlgorithm = Literal["hmac-sha256", "hmac-sha1"]
+
+
+class InboundWebhookService:
+    def __init__(self, client: HttpClient):
+        self._client = client
+
+    def create(
+        self,
+        provider: Provider,
+        agent_id: str,
+        forward_url: Optional[str] = None,
+        generic_config: Optional[dict[str, Any]] = None,
+    ) -> dict[str, Any]:
+        """Create a hosted inbound webhook.
+
+        Returns a dict with keys: id, provider, slug, webhook_url,
+        webhook_secret (plaintext, returned ONLY at create), agent_id,
+        forward_url, created_at. Capture webhook_secret immediately —
+        STACK never returns it again. If lost, revoke + recreate.
+        """
+        body: dict[str, Any] = {"provider": provider, "agent_id": agent_id}
+        if forward_url is not None:
+            body["forward_url"] = forward_url
+        if generic_config is not None:
+            body["generic_config"] = generic_config
+        return self._client.post("/v1/operator/inbound-webhooks", json=body)
+
+    def list(self) -> list[dict[str, Any]]:
+        """List all inbound webhooks for the operator (active + revoked)."""
+        res = self._client.get("/v1/operator/inbound-webhooks")
+        return list(res.get("webhooks", []))
+
+    def get(self, webhook_id: str) -> dict[str, Any]:
+        """Get a single inbound webhook by id. Never returns the plaintext secret."""
+        return self._client.get(f"/v1/operator/inbound-webhooks/{webhook_id}")
+
+    def revoke(self, webhook_id: str) -> dict[str, Any]:
+        """Soft-delete an inbound webhook. Idempotent on repeat calls."""
+        return self._client.delete(f"/v1/operator/inbound-webhooks/{webhook_id}")

{getstack-0.8.0 → getstack-0.9.0}/src/getstack/missions.py

@@ -128,3 +128,65 @@ class MissionsService:
 
             path = f"{path}?{urlencode(params)}"
         return self._client.request("GET", path)
+
+    # ─── Phase 5.4 — replay + dossier ────────────────────────────────
+
+    def replay(self, mission_id: str) -> dict[str, Any]:
+        """Reconstruct the forensic timeline for a mission.
+
+        Returns a dict matching the @stack/shared `ReplayedTimeline` shape:
+        events ordered chronologically, behavioral_diff (close vs baseline
+        genome), cap_usage, dossiers chain, twin_divergence. Same shape the
+        open-source verifier produces from an exported pack.
+
+        Phase 5.4.5 / 5.4.7.
+        """
+        return self._client.request(
+            "GET", f"/v1/missions/{mission_id}/replay"
+        )
+
+    def list_dossiers(self, mission_id: str) -> dict[str, Any]:
+        """List every dossier authored for a mission, ordered chronologically
+        by `authored_at_ms`. Returns dict with `items` (each carrying
+        `body.narrative`, `body.lessons_learned`, etc.). Empty list when no
+        dossier exists.
+
+        Phase 5.4.2 / 5.4.7.
+        """
+        return self._client.request(
+            "GET", f"/v1/missions/{mission_id}/dossiers"
+        )
+
+    def create_dossier(
+        self,
+        mission_id: str,
+        *,
+        narrative: str,
+        lessons_learned: str,
+        incident_classification: str,
+        decision_tree: list[dict[str, Any]] | None = None,
+        alerts_walkthrough: list[dict[str, Any]] | None = None,
+    ) -> dict[str, Any]:
+        """Author a fresh dossier for a mission. The mission must be in a
+        terminal state (completed_* or revoked_*) — 409 surfaces otherwise.
+        `authored_by_member_id` is derived from the calling auth context
+        server-side (not passed here). Enterprise-tier only.
+
+        `incident_classification` is one of:
+        `false_positive` | `true_positive_handled`
+        | `true_positive_escalated` | `inconclusive`.
+
+        Phase 5.4.2 / 5.4.7.
+        """
+        body: dict[str, Any] = {
+            "narrative": narrative,
+            "lessons_learned": lessons_learned,
+            "incident_classification": incident_classification,
+        }
+        if decision_tree is not None:
+            body["decision_tree"] = decision_tree
+        if alerts_walkthrough is not None:
+            body["alerts_walkthrough"] = alerts_walkthrough
+        return self._client.request(
+            "POST", f"/v1/missions/{mission_id}/dossier", json=body
+        )