gravity-cli 0.4.3__tar.gz → 0.5.0__tar.gz

gravity_cli-0.4.3/README.md → gravity_cli-0.5.0/PKG-INFO

@@ -1,3 +1,20 @@
+Metadata-Version: 2.5
+Name: gravity-cli
+Version: 0.5.0
+Summary: gravity cli — init, run, and push python agents to the Gravity marketplace
+License-Expression: Apache-2.0
+License-File: LICENSE
+License-File: NOTICE
+Requires-Python: >=3.12
+Requires-Dist: gravity-schema==0.5.0
+Requires-Dist: httpx>=0.27.0
+Requires-Dist: keyring>=25.0.0
+Requires-Dist: python-dotenv>=1.0.0
+Requires-Dist: rich>=13.9.0
+Requires-Dist: typer>=0.15.0
+Requires-Dist: uv>=0.8.0
+Description-Content-Type: text/markdown
+
 <h1 align="center">Gravity CLI</h1>
 
 <p align="center">
@@ -161,8 +178,8 @@ gravity push
 
 | Service | What it does | Used by |
 |---|---|---|
-| **Gateway** | Serves tools over MCP (`/mcp`) and models over an OpenAI-compatible API (`/v1`). Issues run tokens and refuses any tool a run was not granted. | `run`, `schedule`, `adapt`, and your agent |
-| **Control plane** | Accounts, the tool catalog, pushed agents, builds and hosted runs. | `login`, `logout`, `whoami`, `push`, `tools`, `agents`, `runs`, `logs` |
+| **Gateway** | Serves tools over MCP (`/mcp`) and models over an OpenAI-compatible API (`/v1`). Lists its tools at `/tools` and your connected accounts at `/connections`. Issues run tokens and refuses any tool a run was not granted. | `run`, `schedule`, `adapt`, `tools`, `connect`, and your agent |
+| **Control plane** | Accounts, pushed agents, builds and hosted runs. | `login`, `logout`, `whoami`, `push`, `agents`, `runs`, `logs` |
 
 On `gravity run`, the CLI trades your dev token for a run token scoped to the manifest's tools and starts the agent with only that token. Your own tokens are removed from the agent's environment, so agent code can never act as you.
 
@@ -190,6 +207,7 @@ Run `gravity help` for this list in the terminal, and add `-h` to any command fo
 | **Account** | [`gravity login`](#gravity-login) | Sign in to Gravity in your browser |
 | | [`gravity logout`](#gravity-logout) | Sign out |
 | | [`gravity whoami`](#gravity-whoami) | Show who you are signed in as |
+| | [`gravity connect`](#gravity-connect) | Connect an account your agents act on (Gmail, Slack...) |
 | **Help** | [`gravity guide`](#gravity-guide) | Read the builder guide: how to build a good agent |
 | | [`gravity help`](#gravity-help) | Show the list of commands |
 
@@ -238,7 +256,10 @@ What it checks:
 - the entrypoint file exists and defines the object the manifest names
 - `requirements.txt` exists, and compiles into `requirements.lock` for the platform image (ARM64 Linux) and the manifest's Python version
 - every adapter a slot declares has a file, and every adapter file is declared
-- warnings, never failures, for tool names or network libraries in your code that the manifest does not declare
+- every tool in the manifest exists in the catalog, the same list the platform's build uses, so a typo fails here instead of after a push
+- every imported write tool is under `approvals.required_for`
+- your code never names a write tool the manifest does not grant
+- a warning, never a failure, for read tools your code names but the manifest does not declare
 
 ```bash
 gravity validate
@@ -376,7 +397,9 @@ gravity logs <run_id>
 
 ### `gravity tools`
 
-Browse the tool catalog: the names you can put under `permissions.tools`, with a description and the access each one needs.
+Browse the tool catalog: the names you can put under `permissions.tools`, with what each one does. It is the gateway's own list, so it shows exactly what a run can call, and it needs no sign-in.
+
+About 25 tools are curated, such as `gmail.read` and `web.search`. The other ~1,100 are imported from the same apps and unreviewed: any imported tool that changes something must also be under `approvals.required_for`, and `gravity validate` checks that.
 
 ```
 gravity tools [search]
@@ -412,6 +435,23 @@ gravity whoami
 gravity whoami --token    # print the gateway token itself, for CI or a teammate's .env
 ```
 
+### `gravity connect`
+
+Connect an account your agents' tools act on, through the app's own sign-in page in your browser. With no app, list what is connected.
+
+```
+gravity connect [app]
+```
+
+```bash
+gravity connect           # what is connected, and whose accounts runs act on
+gravity connect gmail     # opens the sign-in page, then waits until it is done
+gravity connect sheets    # use the app name from tool names: sheets, calendar, drive, linear, slack, github...
+```
+
+- Uses the gateway token from `gravity login`.
+- `web` tools need no account.
+
 ### `gravity guide`
 
 Read the builder guide, which ships with the CLI: how an agent is put together, the rules your code must follow, formatting results, approvals, adapters, scheduling, memory, and a checklist.
@@ -472,7 +512,8 @@ Never commit a `.env` file. The `.gitignore` in every template keeps `.env` and
 |---|---|---|---|
 | Create, check and package an agent | `init`, `validate`, `build` | nothing | nothing |
 | Run an agent locally | `run`, `schedule`, `adapt` | `gravity login` (or `GRAVITY_DEV_TOKEN`) | nothing |
-| Publish and inspect agents | `push`, `tools`, `agents`, `runs`, `logs`, `whoami` | `gravity login` | nothing |
+| Publish and inspect agents | `push`, `agents`, `runs`, `logs`, `whoami` | `gravity login` | nothing |
+| Browse tools, connect accounts | `tools`, `connect` | nothing for `tools`; `gravity login` for `connect` | nothing |
 
 Set `GRAVITY_API_URL` and `GRAVITY_GATEWAY_URL` only to work against services you run yourself; see [Running a local gateway](#running-a-local-gateway).
 
@@ -714,6 +755,8 @@ Real tools act on a connected account. Connect one with `gravity-gateway connect
 
 ## What's new
 
+- **0.5.0** `gravity connect` links your own accounts. `web.search` and `web.fetch` join the catalog. `gravity validate` now refuses a tool that isn't in the catalog, an imported write tool without an approval, and code that names a write tool the manifest doesn't grant. `gravity tools` reads the gateway's list and needs no sign-in. On Windows the session stays in the keychain instead of a file.
+- **0.4.4** Same code as 0.4.3, released from this repository so the GitHub release, the tag and PyPI line up again. Adds `RELEASING.md`.
 - **0.4.3** Documents the `secret` input type and the `supadata.get_transcript` tool.
 - **0.4.1** New input type `secret` for an API key, password or other confidential value. New built-in tool `supadata.get_transcript` (`gravity tools supadata`).
 
@@ -756,7 +799,7 @@ Every pull request and every push to `main` runs [`ci.yml`](.github/workflows/ci
 - both test suites on Ubuntu and Windows, with Python 3.12 and 3.13
 - a build of both packages, installed into a clean environment and used for real
 
-To release:
+To release, follow [RELEASING.md](RELEASING.md), which has every command and what to do when a step fails. In short:
 
 1. Set the new version in three places: `version` in `pyproject.toml`, `version` in `packages/gravity-schema/pyproject.toml`, and the `gravity-schema==` pin in `pyproject.toml`. Run `uv lock`, then merge to `main`.
 2. Tag the merge commit and push the tag. A tag containing `rc`, such as `v0.2.0rc1`, publishes to TestPyPI. Any other `v*` tag, such as `v0.2.0`, publishes to PyPI and creates a GitHub Release.

gravity_cli-0.4.3/PKG-INFO → gravity_cli-0.5.0/README.md

@@ -1,20 +1,3 @@
-Metadata-Version: 2.5
-Name: gravity-cli
-Version: 0.4.3
-Summary: gravity cli — init, run, and push python agents to the Gravity marketplace
-License-Expression: Apache-2.0
-License-File: LICENSE
-License-File: NOTICE
-Requires-Python: >=3.12
-Requires-Dist: gravity-schema==0.4.3
-Requires-Dist: httpx>=0.27.0
-Requires-Dist: keyring>=25.0.0
-Requires-Dist: python-dotenv>=1.0.0
-Requires-Dist: rich>=13.9.0
-Requires-Dist: typer>=0.15.0
-Requires-Dist: uv>=0.8.0
-Description-Content-Type: text/markdown
-
 <h1 align="center">Gravity CLI</h1>
 
 <p align="center">
@@ -178,8 +161,8 @@ gravity push
 
 | Service | What it does | Used by |
 |---|---|---|
-| **Gateway** | Serves tools over MCP (`/mcp`) and models over an OpenAI-compatible API (`/v1`). Issues run tokens and refuses any tool a run was not granted. | `run`, `schedule`, `adapt`, and your agent |
-| **Control plane** | Accounts, the tool catalog, pushed agents, builds and hosted runs. | `login`, `logout`, `whoami`, `push`, `tools`, `agents`, `runs`, `logs` |
+| **Gateway** | Serves tools over MCP (`/mcp`) and models over an OpenAI-compatible API (`/v1`). Lists its tools at `/tools` and your connected accounts at `/connections`. Issues run tokens and refuses any tool a run was not granted. | `run`, `schedule`, `adapt`, `tools`, `connect`, and your agent |
+| **Control plane** | Accounts, pushed agents, builds and hosted runs. | `login`, `logout`, `whoami`, `push`, `agents`, `runs`, `logs` |
 
 On `gravity run`, the CLI trades your dev token for a run token scoped to the manifest's tools and starts the agent with only that token. Your own tokens are removed from the agent's environment, so agent code can never act as you.
 
@@ -207,6 +190,7 @@ Run `gravity help` for this list in the terminal, and add `-h` to any command fo
 | **Account** | [`gravity login`](#gravity-login) | Sign in to Gravity in your browser |
 | | [`gravity logout`](#gravity-logout) | Sign out |
 | | [`gravity whoami`](#gravity-whoami) | Show who you are signed in as |
+| | [`gravity connect`](#gravity-connect) | Connect an account your agents act on (Gmail, Slack...) |
 | **Help** | [`gravity guide`](#gravity-guide) | Read the builder guide: how to build a good agent |
 | | [`gravity help`](#gravity-help) | Show the list of commands |
 
@@ -255,7 +239,10 @@ What it checks:
 - the entrypoint file exists and defines the object the manifest names
 - `requirements.txt` exists, and compiles into `requirements.lock` for the platform image (ARM64 Linux) and the manifest's Python version
 - every adapter a slot declares has a file, and every adapter file is declared
-- warnings, never failures, for tool names or network libraries in your code that the manifest does not declare
+- every tool in the manifest exists in the catalog, the same list the platform's build uses, so a typo fails here instead of after a push
+- every imported write tool is under `approvals.required_for`
+- your code never names a write tool the manifest does not grant
+- a warning, never a failure, for read tools your code names but the manifest does not declare
 
 ```bash
 gravity validate
@@ -393,7 +380,9 @@ gravity logs <run_id>
 
 ### `gravity tools`
 
-Browse the tool catalog: the names you can put under `permissions.tools`, with a description and the access each one needs.
+Browse the tool catalog: the names you can put under `permissions.tools`, with what each one does. It is the gateway's own list, so it shows exactly what a run can call, and it needs no sign-in.
+
+About 25 tools are curated, such as `gmail.read` and `web.search`. The other ~1,100 are imported from the same apps and unreviewed: any imported tool that changes something must also be under `approvals.required_for`, and `gravity validate` checks that.
 
 ```
 gravity tools [search]
@@ -429,6 +418,23 @@ gravity whoami
 gravity whoami --token    # print the gateway token itself, for CI or a teammate's .env
 ```
 
+### `gravity connect`
+
+Connect an account your agents' tools act on, through the app's own sign-in page in your browser. With no app, list what is connected.
+
+```
+gravity connect [app]
+```
+
+```bash
+gravity connect           # what is connected, and whose accounts runs act on
+gravity connect gmail     # opens the sign-in page, then waits until it is done
+gravity connect sheets    # use the app name from tool names: sheets, calendar, drive, linear, slack, github...
+```
+
+- Uses the gateway token from `gravity login`.
+- `web` tools need no account.
+
 ### `gravity guide`
 
 Read the builder guide, which ships with the CLI: how an agent is put together, the rules your code must follow, formatting results, approvals, adapters, scheduling, memory, and a checklist.
@@ -489,7 +495,8 @@ Never commit a `.env` file. The `.gitignore` in every template keeps `.env` and
 |---|---|---|---|
 | Create, check and package an agent | `init`, `validate`, `build` | nothing | nothing |
 | Run an agent locally | `run`, `schedule`, `adapt` | `gravity login` (or `GRAVITY_DEV_TOKEN`) | nothing |
-| Publish and inspect agents | `push`, `tools`, `agents`, `runs`, `logs`, `whoami` | `gravity login` | nothing |
+| Publish and inspect agents | `push`, `agents`, `runs`, `logs`, `whoami` | `gravity login` | nothing |
+| Browse tools, connect accounts | `tools`, `connect` | nothing for `tools`; `gravity login` for `connect` | nothing |
 
 Set `GRAVITY_API_URL` and `GRAVITY_GATEWAY_URL` only to work against services you run yourself; see [Running a local gateway](#running-a-local-gateway).
 
@@ -731,6 +738,8 @@ Real tools act on a connected account. Connect one with `gravity-gateway connect
 
 ## What's new
 
+- **0.5.0** `gravity connect` links your own accounts. `web.search` and `web.fetch` join the catalog. `gravity validate` now refuses a tool that isn't in the catalog, an imported write tool without an approval, and code that names a write tool the manifest doesn't grant. `gravity tools` reads the gateway's list and needs no sign-in. On Windows the session stays in the keychain instead of a file.
+- **0.4.4** Same code as 0.4.3, released from this repository so the GitHub release, the tag and PyPI line up again. Adds `RELEASING.md`.
 - **0.4.3** Documents the `secret` input type and the `supadata.get_transcript` tool.
 - **0.4.1** New input type `secret` for an API key, password or other confidential value. New built-in tool `supadata.get_transcript` (`gravity tools supadata`).
 
@@ -773,7 +782,7 @@ Every pull request and every push to `main` runs [`ci.yml`](.github/workflows/ci
 - both test suites on Ubuntu and Windows, with Python 3.12 and 3.13
 - a build of both packages, installed into a clean environment and used for real
 
-To release:
+To release, follow [RELEASING.md](RELEASING.md), which has every command and what to do when a step fails. In short:
 
 1. Set the new version in three places: `version` in `pyproject.toml`, `version` in `packages/gravity-schema/pyproject.toml`, and the `gravity-schema==` pin in `pyproject.toml`. Run `uv lock`, then merge to `main`.
 2. Tag the merge commit and push the tag. A tag containing `rc`, such as `v0.2.0rc1`, publishes to TestPyPI. Any other `v*` tag, such as `v0.2.0`, publishes to PyPI and creates a GitHub Release.

gravity_cli-0.5.0/RELEASING.md

@@ -0,0 +1,125 @@
+# Releasing gravity-cli and gravity-schema
+
+Both packages live in this repository and always ship together at the same version. The only way to publish is a tag on `main`. Nothing is uploaded to PyPI by hand.
+
+## 1. Make the change on a branch
+
+```bash
+git checkout main && git pull
+git checkout -b <your-branch>
+```
+
+Edit code, tests and docs. If you touched the manifest model in `packages/gravity-schema`, regenerate the committed JSON schema, or the schema tests fail:
+
+```bash
+cd packages/gravity-schema && uv run python -m gravity_schema && cd ../..
+```
+
+## 2. Check locally before you push
+
+```bash
+uv run ruff check .
+uv run pytest -q
+cd packages/gravity-schema && uv run pytest -q && cd ../..
+```
+
+All green, or it does not go up.
+
+## 3. Bump the version in both packages
+
+Three places must carry the same number:
+
+| File | Line |
+|---|---|
+| `pyproject.toml` | `version = "X.Y.Z"` |
+| `pyproject.toml` | `"gravity-schema==X.Y.Z"` under `dependencies` |
+| `packages/gravity-schema/pyproject.toml` | `version = "X.Y.Z"` |
+
+Then refresh the lockfile:
+
+```bash
+uv lock
+```
+
+Patch for fixes and docs, minor for new commands or manifest fields. Check PyPI first so a number is never reused:
+
+```bash
+curl -s https://pypi.org/pypi/gravity-cli/json | python -c "import sys,json;print(json.load(sys.stdin)['info']['version'])"
+```
+
+## 4. Open a pull request against `main`
+
+```bash
+git push -u origin <your-branch>
+gh pr create --base main
+```
+
+CI runs lint, package and the tests on Ubuntu and Windows with Python 3.12 and 3.13. Merge when green.
+
+## 5. Tag the merge commit on `main`
+
+```bash
+git checkout main && git pull
+git tag vX.Y.Z
+git push origin vX.Y.Z
+```
+
+The release workflow (`.github/workflows/release.yml`) then:
+
+1. checks the tag against both versions and the pin, and stops if any disagree;
+2. reruns the full CI;
+3. builds both wheels and sdists;
+4. publishes to PyPI through trusted publishing, schema first, then CLI;
+5. creates the GitHub release with the four files attached.
+
+Watch it:
+
+```bash
+gh run list --workflow release.yml --limit 1
+gh run watch <run-id>
+```
+
+## 6. Verify from a clean install
+
+```bash
+uv tool install --force --refresh gravity-cli==X.Y.Z
+gravity whoami
+```
+
+## Dry run on TestPyPI
+
+Any tag containing `rc` publishes to TestPyPI instead of PyPI:
+
+```bash
+git tag vX.Y.Zrc1 && git push origin vX.Y.Zrc1
+```
+
+Use this when you change the workflow itself or the packaging.
+
+## If something goes wrong
+
+**The guard fails with "tag says X but version is Y".** You tagged before bumping. Delete the tag, fix the versions, retag.
+
+```bash
+git tag -d vX.Y.Z && git push origin :refs/tags/vX.Y.Z
+```
+
+**A job fails on "other side closed" or a download error.** A GitHub hiccup. Rerun the failed jobs, nothing else is needed.
+
+```bash
+gh run rerun <run-id> --failed
+```
+
+**Publish fails with "file already exists".** That version is already on PyPI and cannot be overwritten. Bump and release again.
+
+**Wrong code shipped.** Do not delete the PyPI release. Ship a fixed version on top, and yank the bad one on PyPI only if it is harmful.
+
+## Rules
+
+- No copies of the source in other repositories. Pin the PyPI version in your requirements instead.
+- No PyPI API tokens. The trusted publisher configured for this repository is the only credential. If you hold a token for either package, say so and it gets revoked.
+- Every change is a pull request, however small. Review turnaround is same day.
+
+## Record
+
+Versions 0.4.1 to 0.4.3 were published to PyPI on 2026-10-08 from a copy of this source kept in the core repository. Their changes were ported back in PR #11. This repository has no tag or GitHub release for them, and the next release from here is 0.4.4.

{gravity_cli-0.4.3 → gravity_cli-0.5.0}/packages/gravity-schema/gravity_schema/__init__.py

@@ -36,7 +36,9 @@ from .manifest import (
     StateSpec,
     TriggersSpec,
 )
+from .source_scan import is_agent_source, undeclared_write_tools
 from .validation import (
+    check_imported_write_approvals,
     check_tool_references,
     load_manifest_file,
     load_manifest_text,
@@ -73,6 +75,10 @@ __all__ = [  # noqa: RUF022 - grouped by concern, not alphabetical
     "load_manifest_text",
     "load_manifest_file",
     "check_tool_references",
+    "check_imported_write_approvals",
+    # source scan
+    "is_agent_source",
+    "undeclared_write_tools",
     # catalog
     "ToolCatalog",
     "StaticToolCatalog",

{gravity_cli-0.4.3 → gravity_cli-0.5.0}/packages/gravity-schema/gravity_schema/catalog.yaml

@@ -27,6 +27,22 @@
   guarantee: certified
   side_effect: read
 
+- name: web.search
+  slug: COMPOSIO_SEARCH_WEB
+  description: search the web; returns results with titles, links and snippets. No account needed
+  scopes: []
+  breadth: generic
+  guarantee: certified
+  side_effect: read
+
+- name: web.fetch
+  slug: COMPOSIO_SEARCH_FETCH_URL_CONTENT
+  description: read the text content of a web page by its URL. No account needed
+  scopes: []
+  breadth: generic
+  guarantee: certified
+  side_effect: read
+
 - name: supadata.get_transcript
   slug: null
   description: fetch the transcript of a YouTube video with the caller's own Supadata API key (api_key argument)

{gravity_cli-0.4.3 → gravity_cli-0.5.0}/packages/gravity-schema/gravity_schema/errors.py

@@ -27,6 +27,8 @@ class ErrorCode(str, Enum):
     INVALID_TOOL_NAME = "INVALID_TOOL_NAME"
     DUPLICATE_TOOL = "DUPLICATE_TOOL"
     TOOL_NOT_FOUND = "TOOL_NOT_FOUND"
+    UNDECLARED_TOOL_CALL = "UNDECLARED_TOOL_CALL"
+    APPROVAL_REQUIRED = "APPROVAL_REQUIRED"
     INVALID_MODEL_TIER = "INVALID_MODEL_TIER"
     INVALID_RESOURCES = "INVALID_RESOURCES"
     INVALID_TRIGGER = "INVALID_TRIGGER"

gravity_cli-0.5.0/packages/gravity-schema/gravity_schema/source_scan.py

@@ -0,0 +1,83 @@
+"""Agent code that calls a write tool its manifest does not grant.
+
+The gateway refuses such a call at run time (TOOL_NOT_DECLARED). This finds it
+before the build, from the source text alone: nothing is imported or run.
+`gravity validate` and the platform's build step share it, so a builder who
+skips the CLI is still stopped.
+"""
+
+from __future__ import annotations
+
+import ast
+from collections.abc import Iterable, Iterator
+from pathlib import PurePath
+
+from .catalog import CATALOG, ToolEntry
+from .errors import ErrorCode, ManifestIssue, Severity
+from .manifest import Manifest
+
+# Not shipped as agent behaviour: tests may name any tool to assert it is refused.
+SKIPPED_DIRS = frozenset({".venv", "venv", "tests", "__pycache__", ".gravity"})
+
+# Manifests say 'gmail.send'; code says 'gmail_send' (some models reject dots in
+# function names). Either spelling is the same tool.
+_BY_SPELLING: dict[str, ToolEntry] = {
+    spelling: e for e in CATALOG for spelling in (e.name, e.name.replace(".", "_"))
+}
+
+
+def is_agent_source(path: PurePath) -> bool:
+    return path.suffix == ".py" and not SKIPPED_DIRS & set(path.parts)
+
+
+def _docstrings(tree: ast.Module) -> set[int]:
+    owners = [tree, *(n for n in ast.walk(tree) if isinstance(n, (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef)))]
+    return {
+        id(owner.body[0].value)
+        for owner in owners
+        if owner.body
+        and isinstance(owner.body[0], ast.Expr)
+        and isinstance(owner.body[0].value, ast.Constant)
+        and isinstance(owner.body[0].value.value, str)
+    }
+
+
+def _string_literals(tree: ast.Module) -> Iterator[str]:
+    """Every string constant except docstrings, which describe rather than call."""
+    skip = _docstrings(tree)
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Constant) and isinstance(node.value, str) and id(node) not in skip:
+            yield node.value
+
+
+def undeclared_write_tools(sources: Iterable[tuple[str, str]], manifest: Manifest) -> list[ManifestIssue]:
+    """One issue per catalog write tool named in `sources` ((path, text) pairs)
+    that no part of the manifest grants. Reads stay the drift scan's warning."""
+    declared = manifest.declared_tools
+    first_seen: dict[str, str] = {}
+    for path, text in sources:
+        try:
+            tree = ast.parse(text, filename=path)
+        except SyntaxError:
+            continue  # the entrypoint check reports a broken entrypoint; this scan has nothing to read
+        for literal in _string_literals(tree):
+            entry = _BY_SPELLING.get(literal)
+            if entry and entry.side_effect == "write" and entry.name not in declared:
+                first_seen.setdefault(entry.name, path)
+
+    return [
+        ManifestIssue(
+            code=ErrorCode.UNDECLARED_TOOL_CALL,
+            location=path,
+            message=f"{path} calls '{tool}', a write tool the manifest does not grant.",
+            remediation=(
+                f"Declare '{tool}' under permissions.tools (and approvals.required_for, so a person "
+                "says yes before it acts), or remove the call. If it only delivers the finished "
+                "result, list it under an output's destinations instead: the platform sends it "
+                "from the user's own connected account after the run."
+            ),
+            value=tool,
+            severity=Severity.HIGH,
+        )
+        for tool, path in sorted(first_seen.items())
+    ]

{gravity_cli-0.4.3 → gravity_cli-0.5.0}/packages/gravity-schema/gravity_schema/validation.py

@@ -9,7 +9,7 @@ import yaml
 from pydantic import ValidationError
 
 from . import contract as C
-from .catalog import ToolCatalog
+from .catalog import CATALOG, ToolCatalog
 from .errors import (
     ErrorCode,
     ManifestIssue,
@@ -56,7 +56,28 @@ def check_tool_references(manifest: Manifest, catalog: ToolCatalog) -> list[Mani
             )
         )
 
-    return issues
+    return issues + check_imported_write_approvals(manifest)
+
+
+# Imported tools (catalog_imported.yaml) are unreviewed. The gateway refuses a run that is
+# granted an imported write tool without a human approval in front of it (APPROVAL_REQUIRED).
+_IMPORTED_WRITES = frozenset(e.name for e in CATALOG if e.guarantee == "experimental" and e.side_effect == "write")
+
+
+def check_imported_write_approvals(manifest: Manifest) -> list[ManifestIssue]:
+    """One issue per imported write tool the agent may call that no approval covers."""
+    gated = set(manifest.approvals.required_for)
+    return [
+        ManifestIssue(
+            code=ErrorCode.APPROVAL_REQUIRED,
+            location="approvals.required_for",
+            message=f"'{name}' is an imported write tool, so a person must approve each call.",
+            remediation=f"Add '{name}' under approvals.required_for, with a fallback for when it isn't approved.",
+            value=name,
+            severity=Severity.HIGH,
+        )
+        for name in sorted(manifest.declared_tools & _IMPORTED_WRITES - gated)
+    ]
 
 
 def validate_manifest(

{gravity_cli-0.4.3 → gravity_cli-0.5.0}/packages/gravity-schema/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "gravity-schema"
-version = "0.4.3"
+version = "0.5.0"
 description = "Gravity agent manifest contract — models, validation, and JSON Schema export"
 readme = "README.md"
 license = "Apache-2.0"

{gravity_cli-0.4.3 → gravity_cli-0.5.0}/packages/gravity-schema/tests/test_manifest.py

@@ -624,3 +624,12 @@ def test_state_size_outside_bounds_rejected(manifest_data, bad):
 def test_runtime_python_defaults_to_313(manifest_data):
     del manifest_data["runtime"]["python"]
     assert validate_manifest(manifest_data).runtime.python == "3.12"
+
+
+def test_a_secret_input_cannot_have_a_default(manifest_data):
+    manifest_data["inputs"] = [{"name": "api_key", "type": "secret", "label": "Key", "default": "sk-x"}]
+    with pytest.raises(ManifestValidationError) as e:
+        validate_manifest(manifest_data)
+    assert "cannot have a default" in str(e.value)
+    del manifest_data["inputs"][0]["default"]
+    assert validate_manifest(manifest_data).inputs[0].type.value == "secret"

gravity_cli-0.5.0/packages/gravity-schema/tests/test_source_scan.py

@@ -0,0 +1,67 @@
+from __future__ import annotations
+
+from pathlib import PurePosixPath
+
+import pytest
+from gravity_schema import Manifest, is_agent_source, undeclared_write_tools
+
+
+def manifest(tools: list[str], adapters: dict[str, list[str]] | None = None) -> Manifest:
+    data = {
+        "name": "scan-agent",
+        "version": "1.0.0",
+        "runtime": {"python": "3.12", "entrypoint": "src/agent.py:graph"},
+        "permissions": {"tools": tools},
+    }
+    if adapters:
+        data["slots"] = {"deliver": {"label": "Deliver to", "default": next(iter(adapters)), "adapters": adapters}}
+    return Manifest.model_validate(data)
+
+
+def found(source: str, m: Manifest) -> list[str]:
+    return [i.value for i in undeclared_write_tools([("src/agent.py", source)], m)]
+
+
+@pytest.mark.parametrize("spelling", ["gmail.send", "gmail_send"])
+def test_an_undeclared_send_is_found_in_either_spelling(spelling):
+    assert found(f'TOOL = "{spelling}"\n', manifest(["gmail.read"])) == ["gmail.send"]
+
+
+def test_a_declared_send_is_not_reported():
+    assert found('TOOL = "gmail_send"\n', manifest(["gmail.send"])) == []
+
+
+def test_a_tool_an_adapter_declares_is_granted():
+    m = manifest([], {"slack": ["slack.send"]})
+    assert found('TOOL = "slack_send"\n', m) == []
+
+
+def test_reads_are_left_to_the_drift_warning():
+    assert found('TOOL = "gmail_read"\n', manifest([])) == []
+
+
+def test_docstrings_describe_rather_than_call():
+    source = '"""Never "gmail.send"."""\n\n\ndef f():\n    """Uses gmail_send? No."""\n    return 1\n'
+    assert found(source, manifest([])) == []
+
+
+def test_each_tool_is_reported_once_with_where_it_was_first_seen():
+    sources = [("src/a.py", 'X = "slack.send"\n'), ("src/b.py", 'Y = "slack_send"\nZ = "gmail.send"\n')]
+    issues = undeclared_write_tools(sources, manifest([]))
+    assert [(i.value, i.location, i.code.value) for i in issues] == [
+        ("gmail.send", "src/b.py", "UNDECLARED_TOOL_CALL"),
+        ("slack.send", "src/a.py", "UNDECLARED_TOOL_CALL"),
+    ]
+
+
+def test_a_file_that_does_not_parse_is_skipped():
+    assert found("def broken(:\n  'gmail.send'\n", manifest([])) == []
+
+
+@pytest.mark.parametrize(
+    ("path", "shipped"),
+    [("src/agent.py", True), ("agent.py", True), ("tests/test_x.py", False),
+     (".venv/lib/x.py", False), ("src/__pycache__/x.py", False), ("README.md", False)],
+)
+def test_only_shipped_python_is_scanned(path, shipped):
+    assert is_agent_source(PurePosixPath(path)) is shipped

{gravity_cli-0.4.3 → gravity_cli-0.5.0}/packages/gravity-schema/tests/test_validation.py

@@ -170,3 +170,28 @@ def test_missing_file_reports_clearly(tmp_path):
 
     assert "gravity init" in (ei.value.issues[0].remediation or "")
 
+
+
+def test_an_imported_write_tool_needs_an_approval(manifest_data, catalog):
+    """The gateway refuses a run granted an unreviewed write tool without a human approval."""
+    manifest_data["permissions"]["tools"] = ["gmail.read", "github.add_assignees_to_an_issue"]
+    with pytest.raises(ManifestValidationError) as e:
+        validate_manifest(manifest_data, catalog=catalog)
+    issues = [i for i in e.value.issues if i.code == ErrorCode.APPROVAL_REQUIRED]
+    assert [i.value for i in issues] == ["github.add_assignees_to_an_issue"]
+
+    manifest_data["approvals"] = {"required_for": ["github.add_assignees_to_an_issue"]}
+    validate_manifest(manifest_data, catalog=catalog)
+
+
+def test_curated_writes_and_imported_reads_need_no_approval(manifest_data, catalog):
+    manifest_data["permissions"]["tools"] = ["gmail.send", "github.get_a_repository", "web.search", "web.fetch"]
+    manifest_data.pop("approvals", None)
+    validate_manifest(manifest_data, catalog=catalog)
+
+
+def test_a_tool_in_no_catalog_is_refused(manifest_data, catalog):
+    manifest_data["permissions"]["tools"] = ["composio_search.web"]
+    with pytest.raises(ManifestValidationError) as e:
+        validate_manifest(manifest_data, catalog=catalog)
+    assert {i.code for i in e.value.issues} == {ErrorCode.TOOL_NOT_FOUND}

{gravity_cli-0.4.3 → gravity_cli-0.5.0}/pyproject.toml

@@ -1,13 +1,13 @@
 [project]
 name = "gravity-cli"
-version = "0.4.3"
+version = "0.5.0"
 description = "gravity cli — init, run, and push python agents to the Gravity marketplace"
 readme = "README.md"
 license = "Apache-2.0"
 license-files = ["LICENSE", "NOTICE"]
 requires-python = ">=3.12"
 dependencies = [
-    "gravity-schema==0.4.3",  # released in lockstep: always the same version as this package
+    "gravity-schema==0.5.0",  # released in lockstep: always the same version as this package
     "typer>=0.15.0",
     "httpx>=0.27.0",
     "rich>=13.9.0",