gobby 0.2.6__py3-none-any.whl → 0.2.7__py3-none-any.whl

gobby/agents/spawners/headless.py

@@ -9,6 +9,7 @@ from pathlib import Path
 from typing import TYPE_CHECKING
 
 from gobby.agents.constants import get_terminal_env_vars
+from gobby.agents.sandbox import SandboxConfig, compute_sandbox_paths, get_sandbox_resolver
 from gobby.agents.spawners.base import HeadlessResult
 
 if TYPE_CHECKING:
@@ -26,11 +27,11 @@ def _get_spawn_utils() -> tuple[
     """Lazy import to avoid circular dependencies."""
     from gobby.agents.spawn import (
         MAX_ENV_PROMPT_LENGTH,
-        _create_prompt_file,
         build_cli_command,
+        create_prompt_file,
     )
 
-    return build_cli_command, _create_prompt_file, MAX_ENV_PROMPT_LENGTH
+    return build_cli_command, create_prompt_file, MAX_ENV_PROMPT_LENGTH
 
 
 class HeadlessSpawner:
@@ -169,6 +170,7 @@ class HeadlessSpawner:
         agent_depth: int = 1,
         max_agent_depth: int = 3,
         prompt: str | None = None,
+        sandbox_config: SandboxConfig | None = None,
     ) -> HeadlessResult:
         """
         Spawn a CLI agent in headless mode.
@@ -184,12 +186,24 @@ class HeadlessSpawner:
             agent_depth: Current nesting depth
             max_agent_depth: Maximum allowed depth
             prompt: Optional initial prompt
+            sandbox_config: Optional sandbox configuration
 
         Returns:
             HeadlessResult with process handle
         """
         build_cli_command, _create_prompt_file, max_env_prompt_length = _get_spawn_utils()
 
+        # Resolve sandbox configuration if enabled
+        sandbox_args: list[str] | None = None
+        sandbox_env: dict[str, str] = {}
+
+        if sandbox_config and sandbox_config.enabled:
+            # Compute sandbox paths based on cwd (workspace)
+            resolved_paths = compute_sandbox_paths(sandbox_config, str(cwd))
+            # Get CLI-specific resolver and generate args/env
+            resolver = get_sandbox_resolver(cli)
+            sandbox_args, sandbox_env = resolver.resolve(sandbox_config, resolved_paths)
+
         # Build command with prompt as CLI argument and auto-approve for autonomous work
         command = build_cli_command(
             cli,
@@ -198,6 +212,7 @@ class HeadlessSpawner:
             auto_approve=True,  # Subagents need to work autonomously
             working_directory=str(cwd) if cli == "codex" else None,
             mode="headless",  # Non-interactive headless mode
+            sandbox_args=sandbox_args,
         )
 
         # Handle prompt for environment variables (backup for hooks/context)
@@ -223,4 +238,8 @@ class HeadlessSpawner:
             prompt_file=prompt_file,
         )
 
+        # Merge sandbox environment variables if present
+        if sandbox_env:
+            env.update(sandbox_env)
+
         return self.spawn(command, cwd, env)

gobby/agents/spawners/prompt_manager.py

@@ -0,0 +1,125 @@
+"""Prompt file management for agent spawning.
+
+Handles creation, cleanup, and tracking of temporary prompt files
+used to pass long prompts to spawned CLI agents.
+"""
+
+from __future__ import annotations
+
+import atexit
+import logging
+import os
+import re
+import tempfile
+import threading
+import uuid
+from pathlib import Path
+
+logger = logging.getLogger(__name__)
+
+# Maximum prompt length to pass via environment variable
+# Longer prompts will be written to a temp file
+MAX_ENV_PROMPT_LENGTH = 4096
+
+# Module-level set for tracking prompt files to clean up on exit
+# This avoids registering a new atexit handler for each prompt file
+_prompt_files_to_cleanup: set[Path] = set()
+_atexit_registered = False
+_atexit_lock = threading.Lock()
+
+
+def cleanup_all_prompt_files() -> None:
+    """Clean up all tracked prompt files on process exit."""
+    with _atexit_lock:
+        files_to_cleanup = list(_prompt_files_to_cleanup)
+        _prompt_files_to_cleanup.clear()
+        for prompt_path in files_to_cleanup:
+            try:
+                if prompt_path.exists():
+                    prompt_path.unlink()
+            except OSError:
+                pass
+
+
+def create_prompt_file(prompt: str, session_id: str) -> str:
+    """
+    Create a prompt file with secure permissions.
+
+    The file is created in the system temp directory with restrictive
+    permissions (owner read/write only) and tracked for cleanup on exit.
+
+    Args:
+        prompt: The prompt content to write
+        session_id: Session ID for naming the file
+
+    Returns:
+        Path to the created temp file
+    """
+    global _atexit_registered
+
+    # Create temp directory with restrictive permissions
+    temp_dir = Path(tempfile.gettempdir()) / "gobby-prompts"
+    temp_dir.mkdir(parents=True, exist_ok=True, mode=0o700)
+
+    # Sanitize session_id to prevent path traversal attacks
+    # Strip path separators and limit to alphanumeric, hyphens, underscores
+    safe_session_id = re.sub(r"[^a-zA-Z0-9_-]", "", session_id)
+    if not safe_session_id or len(safe_session_id) > 128:
+        safe_session_id = str(uuid.uuid4())
+
+    # Create the prompt file path
+    prompt_path = temp_dir / f"prompt-{safe_session_id}.txt"
+
+    # Write with secure permissions atomically - create with mode 0o600 from the start
+    # This avoids the TOCTOU window between write_text and chmod
+    fd = os.open(str(prompt_path), os.O_CREAT | os.O_WRONLY | os.O_TRUNC, 0o600)
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as f:
+            f.write(prompt)
+            f.flush()
+            os.fsync(f.fileno())
+    except Exception:
+        # fd is closed by fdopen, but if fdopen fails we need to close it
+        try:
+            os.close(fd)
+        except OSError:
+            pass
+        raise
+
+    # Track for cleanup and register handler (thread-safe)
+    with _atexit_lock:
+        _prompt_files_to_cleanup.add(prompt_path)
+        if not _atexit_registered:
+            atexit.register(cleanup_all_prompt_files)
+            _atexit_registered = True
+
+    logger.debug(f"Created secure prompt file: {prompt_path}")
+    return str(prompt_path)
+
+
+def read_prompt_from_env() -> str | None:
+    """
+    Read initial prompt from environment variables.
+
+    Checks GOBBY_PROMPT_FILE first (for long prompts),
+    then falls back to GOBBY_PROMPT (for short prompts).
+
+    Returns:
+        Prompt string or None if not set
+    """
+    from gobby.agents.constants import GOBBY_PROMPT, GOBBY_PROMPT_FILE
+
+    # Check for prompt file first
+    prompt_file = os.environ.get(GOBBY_PROMPT_FILE)
+    if prompt_file:
+        try:
+            prompt_path = Path(prompt_file)
+            if prompt_path.exists():
+                return prompt_path.read_text(encoding="utf-8")
+            else:
+                logger.warning(f"Prompt file not found: {prompt_file}")
+        except Exception as e:
+            logger.error(f"Error reading prompt file: {e}")
+
+    # Fall back to inline prompt
+    return os.environ.get(GOBBY_PROMPT)

gobby/cli/install.py

@@ -250,7 +250,7 @@ def install(
                     click.echo(f"  - {cmd}")
             if result.get("plugins_installed"):
                 click.echo(
-                    f"Installed {len(result['plugins_installed'])} plugins to ~/.gobby/plugins/"
+                    f"Installed {len(result['plugins_installed'])} plugins to .gobby/plugins/"
                 )
                 for plugin in result["plugins_installed"]:
                     click.echo(f"  - {plugin}")
@@ -287,7 +287,7 @@ def install(
                     click.echo(f"  - {cmd}")
             if result.get("plugins_installed"):
                 click.echo(
-                    f"Installed {len(result['plugins_installed'])} plugins to ~/.gobby/plugins/"
+                    f"Installed {len(result['plugins_installed'])} plugins to .gobby/plugins/"
                 )
                 for plugin in result["plugins_installed"]:
                     click.echo(f"  - {plugin}")
@@ -334,7 +334,7 @@ def install(
                         click.echo(f"  - {cmd}")
                 if result.get("plugins_installed"):
                     click.echo(
-                        f"Installed {len(result['plugins_installed'])} plugins to ~/.gobby/plugins/"
+                        f"Installed {len(result['plugins_installed'])} plugins to .gobby/plugins/"
                     )
                     for plugin in result["plugins_installed"]:
                         click.echo(f"  - {plugin}")
@@ -395,7 +395,7 @@ def install(
                     click.echo(f"  - {cmd}")
             if result.get("plugins_installed"):
                 click.echo(
-                    f"Installed {len(result['plugins_installed'])} plugins to ~/.gobby/plugins/"
+                    f"Installed {len(result['plugins_installed'])} plugins to .gobby/plugins/"
                 )
                 for plugin in result["plugins_installed"]:
                     click.echo(f"  - {plugin}")

gobby/cli/installers/claude.py

@@ -20,6 +20,7 @@ from .shared import (
     backup_gobby_skills,
     configure_mcp_server_json,
     install_cli_content,
+    install_router_skills_as_commands,
     install_shared_content,
     remove_mcp_server_json,
 )
@@ -125,6 +126,11 @@ def install_claude(project_path: Path) -> dict[str, Any]:
     result["commands_installed"] = cli.get("commands", [])
     result["plugins_installed"] = shared.get("plugins", [])
 
+    # Install router skills (gobby, g) as flattened commands
+    commands_dir = claude_path / "commands"
+    router_commands = install_router_skills_as_commands(commands_dir)
+    result["commands_installed"].extend(router_commands)
+
     # Skills are now auto-synced to database on daemon startup (sync_bundled_skills)
     # No longer need to copy to .claude/skills/
 

gobby/cli/installers/gemini.py

@@ -17,6 +17,7 @@ from gobby.cli.utils import get_install_dir
 from .shared import (
     configure_mcp_server_json,
     install_cli_content,
+    install_router_skills_as_gemini_skills,
     install_shared_content,
     remove_mcp_server_json,
 )
@@ -87,6 +88,11 @@ def install_gemini(project_path: Path) -> dict[str, Any]:
     result["commands_installed"] = cli.get("commands", [])
     result["plugins_installed"] = shared.get("plugins", [])
 
+    # Install router skills (gobby, g) as Gemini skills
+    skills_dir = gemini_path / "skills"
+    router_skills = install_router_skills_as_gemini_skills(skills_dir)
+    result["commands_installed"].extend(router_skills)
+
     # Backup existing settings.json if it exists
     if settings_file.exists():
         timestamp = int(time.time())

gobby/cli/installers/shared.py

@@ -23,7 +23,8 @@ def install_shared_content(cli_path: Path, project_path: Path) -> dict[str, list
     """Install shared content from src/install/shared/.
 
     Workflows are cross-CLI and go to {project_path}/.gobby/workflows/.
-    Plugins are global and go to ~/.gobby/plugins/.
+    Plugins are project-scoped and go to {project_path}/.gobby/plugins/.
+    Prompts are project-scoped and go to {project_path}/.gobby/prompts/.
     Docs are project-local and go to {project_path}/.gobby/docs/.
 
     Args:
@@ -34,7 +35,7 @@ def install_shared_content(cli_path: Path, project_path: Path) -> dict[str, list
         Dict with lists of installed items by type
     """
     shared_dir = get_install_dir() / "shared"
-    installed: dict[str, list[str]] = {"workflows": [], "plugins": [], "docs": []}
+    installed: dict[str, list[str]] = {"workflows": [], "plugins": [], "prompts": [], "docs": []}
 
     # Install shared workflows to .gobby/workflows/ (cross-CLI)
     shared_workflows = shared_dir / "workflows"
@@ -53,16 +54,33 @@ def install_shared_content(cli_path: Path, project_path: Path) -> dict[str, list
                 copytree(item, target_subdir)
                 installed["workflows"].append(f"{item.name}/")
 
-    # Install shared plugins to ~/.gobby/plugins/ (global)
+    # Install shared plugins to .gobby/plugins/ (project-scoped)
     shared_plugins = shared_dir / "plugins"
     if shared_plugins.exists():
-        target_plugins = Path("~/.gobby/plugins").expanduser()
+        target_plugins = project_path / ".gobby" / "plugins"
         target_plugins.mkdir(parents=True, exist_ok=True)
         for plugin_file in shared_plugins.iterdir():
             if plugin_file.is_file() and plugin_file.suffix == ".py":
                 copy2(plugin_file, target_plugins / plugin_file.name)
                 installed["plugins"].append(plugin_file.name)
 
+    # Install shared prompts to .gobby/prompts/ (project-scoped)
+    shared_prompts = shared_dir / "prompts"
+    if shared_prompts.exists():
+        target_prompts = project_path / ".gobby" / "prompts"
+        target_prompts.mkdir(parents=True, exist_ok=True)
+        for item in shared_prompts.iterdir():
+            if item.is_file():
+                copy2(item, target_prompts / item.name)
+                installed["prompts"].append(item.name)
+            elif item.is_dir():
+                # Copy subdirectories (e.g., expansion/, validation/)
+                target_subdir = target_prompts / item.name
+                if target_subdir.exists():
+                    shutil.rmtree(target_subdir)
+                copytree(item, target_subdir)
+                installed["prompts"].append(f"{item.name}/")
+
     # Install shared docs to .gobby/docs/ (project-local)
     shared_docs = shared_dir / "docs"
     if shared_docs.exists():
@@ -185,6 +203,87 @@ def install_shared_skills(target_dir: Path) -> list[str]:
     return installed
 
 
+def install_router_skills_as_commands(target_commands_dir: Path) -> list[str]:
+    """Install router skills (gobby, g) as flattened Claude commands.
+
+    Claude Code uses .claude/commands/name.md format for slash commands.
+    This function copies the gobby router skills from shared/skills/ to
+    commands/ as flattened .md files.
+
+    Args:
+        target_commands_dir: Path to commands directory (e.g., .claude/commands)
+
+    Returns:
+        List of installed command names
+    """
+    shared_skills_dir = get_install_dir() / "shared" / "skills"
+    installed: list[str] = []
+
+    # Router skills to install as commands
+    router_skills = ["gobby", "g"]
+
+    target_commands_dir.mkdir(parents=True, exist_ok=True)
+
+    for skill_name in router_skills:
+        source_skill_md = shared_skills_dir / skill_name / "SKILL.md"
+        if not source_skill_md.exists():
+            logger.warning(f"Router skill not found: {source_skill_md}")
+            continue
+
+        # Flatten: copy SKILL.md to commands/name.md
+        target_cmd = target_commands_dir / f"{skill_name}.md"
+
+        try:
+            copy2(source_skill_md, target_cmd)
+            installed.append(f"{skill_name}.md")
+        except OSError as e:
+            logger.error(f"Failed to copy router skill {skill_name}: {e}")
+
+    return installed
+
+
+def install_router_skills_as_gemini_skills(target_skills_dir: Path) -> list[str]:
+    """Install router skills (gobby, g) as Gemini skills (directory structure).
+
+    Gemini CLI uses .gemini/skills/name/SKILL.md format for skills.
+    This function copies the gobby router skills from shared/skills/ to
+    the target skills directory preserving the directory structure.
+
+    Args:
+        target_skills_dir: Path to skills directory (e.g., .gemini/skills)
+
+    Returns:
+        List of installed skill names
+    """
+    shared_skills_dir = get_install_dir() / "shared" / "skills"
+    installed: list[str] = []
+
+    # Router skills to install
+    router_skills = ["gobby", "g"]
+
+    target_skills_dir.mkdir(parents=True, exist_ok=True)
+
+    for skill_name in router_skills:
+        source_skill_dir = shared_skills_dir / skill_name
+        source_skill_md = source_skill_dir / "SKILL.md"
+        if not source_skill_md.exists():
+            logger.warning(f"Router skill not found: {source_skill_md}")
+            continue
+
+        # Create skill directory and copy SKILL.md
+        target_skill_dir = target_skills_dir / skill_name
+        target_skill_dir.mkdir(parents=True, exist_ok=True)
+        target_skill_md = target_skill_dir / "SKILL.md"
+
+        try:
+            copy2(source_skill_md, target_skill_md)
+            installed.append(f"{skill_name}/")
+        except OSError as e:
+            logger.error(f"Failed to copy router skill {skill_name}: {e}")
+
+    return installed
+
+
 def install_cli_content(cli_name: str, target_path: Path) -> dict[str, list[str]]:
     """Install CLI-specific workflows/commands (layered on top of shared).
 

gobby/cli/sessions.py

@@ -387,7 +387,7 @@ def create_handoff(
     import time
     from pathlib import Path
 
-    from gobby.mcp_proxy.tools.session_messages import _format_handoff_markdown
+    from gobby.mcp_proxy.tools.sessions._handoff import _format_handoff_markdown
     from gobby.sessions.analyzer import TranscriptAnalyzer
 
     manager = get_session_manager()

gobby/cli/utils.py

@@ -118,7 +118,7 @@ def get_active_session_id(db: LocalDatabase | None = None) -> str | None:
             db.close()
 
 
-def resolve_session_id(session_ref: str | None) -> str:
+def resolve_session_id(session_ref: str | None, project_id: str | None = None) -> str:
     """
     Resolve session reference to UUID.
 
@@ -126,6 +126,8 @@ def resolve_session_id(session_ref: str | None) -> str:
 
     Args:
         session_ref: User input string (UUID, #N, N, prefix) or None
+        project_id: Project ID for project-scoped #N lookup.
+            If not provided, auto-detected from current project context.
 
     Returns:
         Resolved UUID string
@@ -142,10 +144,15 @@ def resolve_session_id(session_ref: str | None) -> str:
                 raise click.ClickException("No active session found. Specify --session.")
             return active_id
 
+        # Get project_id from context if not provided
+        if not project_id:
+            ctx = get_project_context()
+            project_id = ctx.get("id") if ctx else None
+
         # Use SessionManager for resolution logic
         manager = LocalSessionManager(db)
         try:
-            return manager.resolve_session_reference(session_ref)
+            return manager.resolve_session_reference(session_ref, project_id)
         except ValueError as e:
             raise click.ClickException(str(e)) from None
     finally:

gobby/config/__init__.py

@@ -14,116 +14,31 @@ Module structure:
 - extensions.py: Hook extension configs (webhooks, plugins)
 - sessions.py: Session lifecycle and tracking configs
 - features.py: MCP proxy feature configs (code execution, tool recommendation)
+
+Import from submodules directly for specific configs:
+    from gobby.config.tasks import TaskValidationConfig
+    from gobby.config.extensions import WebhooksConfig
+
+Import from this package for app-level items:
+    from gobby.config import DaemonConfig, load_config
 """
 
 # Core configuration and utilities from app.py
 from gobby.config.app import (
     DaemonConfig,
     expand_env_vars,
+    generate_default_config,
     load_config,
+    load_yaml,
     save_config,
 )
 
-# Extension configs
-from gobby.config.extensions import (
-    HookExtensionsConfig,
-    PluginItemConfig,
-    PluginsConfig,
-    WebhookEndpointConfig,
-    WebhooksConfig,
-    WebSocketBroadcastConfig,
-)
-
-# Feature configs
-from gobby.config.features import (
-    ImportMCPServerConfig,
-    MetricsConfig,
-    ProjectVerificationConfig,
-    RecommendToolsConfig,
-    ToolSummarizerConfig,
-)
-
-# LLM provider configs
-from gobby.config.llm_providers import (
-    LLMProviderConfig,
-    LLMProvidersConfig,
-)
-
-# Logging configs
-from gobby.config.logging import LoggingSettings
-
-# Persistence configs
-from gobby.config.persistence import (
-    MemoryConfig,
-    MemorySyncConfig,
-)
-
-# Server configs
-from gobby.config.servers import (
-    MCPClientProxyConfig,
-    WebSocketSettings,
-)
-
-# Session configs
-from gobby.config.sessions import (
-    ContextInjectionConfig,
-    MessageTrackingConfig,
-    SessionLifecycleConfig,
-    SessionSummaryConfig,
-    TitleSynthesisConfig,
-)
-
-# Task configs
-from gobby.config.tasks import (
-    CompactHandoffConfig,
-    GobbyTasksConfig,
-    PatternCriteriaConfig,
-    TaskExpansionConfig,
-    TaskValidationConfig,
-    WorkflowConfig,
-)
-
 __all__ = [
-    # Core
+    # Core app-level exports only
     "DaemonConfig",
     "expand_env_vars",
+    "generate_default_config",
     "load_config",
+    "load_yaml",
     "save_config",
-    # Extension configs
-    "HookExtensionsConfig",
-    "PluginItemConfig",
-    "PluginsConfig",
-    "WebhookEndpointConfig",
-    "WebhooksConfig",
-    "WebSocketBroadcastConfig",
-    # Feature configs
-    "ImportMCPServerConfig",
-    "MetricsConfig",
-    "ProjectVerificationConfig",
-    "RecommendToolsConfig",
-    "ToolSummarizerConfig",
-    # LLM provider configs
-    "LLMProviderConfig",
-    "LLMProvidersConfig",
-    # Logging configs
-    "LoggingSettings",
-    # Persistence configs
-    "MemoryConfig",
-    "MemorySyncConfig",
-    # Server configs
-    "MCPClientProxyConfig",
-    "WebSocketSettings",
-    # Session configs
-    "ContextInjectionConfig",
-    "MessageTrackingConfig",
-    "SessionLifecycleConfig",
-    "SessionSummaryConfig",
-    "TitleSynthesisConfig",
-    # Task configs
-    "CompactHandoffConfig",
-    "GobbyTasksConfig",
-    "PatternCriteriaConfig",
-    "TaskExpansionConfig",
-    "TaskValidationConfig",
-    "WorkflowConfig",
 ]