guile-agent 0.1.0a4__tar.gz

guile_agent-0.1.0a4/.cursor/rules/guile-project.mdc

@@ -0,0 +1,45 @@
+---
+description: Guile Project Rules and Agent Guidelines
+globs: **/*
+alwaysApply: true
+---
+
+# Guile — Agent Rules & Guidelines
+
+1. **Project Identity**: This project is **Guile**, an independent commercial hard fork of the Strix autonomous security-testing engine.
+
+2. **Mandatory Context Reading**:
+   Before performing meaningful work, agents MUST read:
+   - `docs/context/PROJECT_CONTEXT.md`
+   - `docs/context/CURRENT_STATE.md`
+   - `docs/context/DECISIONS.md`
+
+3. **Architecture & Security Context**:
+   For architecture, runtime, or security-related tasks, additionally read:
+   - `docs/context/ARCHITECTURE.md`
+   - `docs/context/SECURITY_MODEL.md`
+   - `docs/context/EXECUTION_FLOW.md`
+
+4. **Execution Path Awareness**:
+   Before modifying inherited engine behavior, trace and understand the full execution path across the CLI, runner, agent coordinator, and Docker sandbox.
+
+5. **Preserve Legal Attribution**:
+   Never remove the Apache-2.0 `LICENSE`, copyright notices, or third-party attributions merely for rebranding.
+
+6. **No Blind String Replacement**:
+   Never perform broad, global `strix -> guile` replacements without deep dependency and AST analysis. Internal technical schemas and tool protocols must remain intact.
+
+7. **Security & Sandbox Discipline**:
+   Never weaken sandbox, network, or capability controls without documenting the rationale and logging an architectural decision.
+
+8. **Context Synchronization**:
+   Update context documents in `docs/context/` whenever meaningful changes occur:
+   - Product/priority changes -> `CURRENT_STATE.md` / `ROADMAP.md`
+   - Architecture changes -> `ARCHITECTURE.md` / `DECISIONS.md`
+   - Security changes -> `SECURITY_MODEL.md` / `KNOWN_RISKS.md`
+   - Dependency changes -> `DEPENDENCIES.md`
+   - Branding changes -> `BRANDING_AUDIT.md`
+
+9. **State Integrity**:
+   - `CURRENT_STATE.md` represents current operational truth and must not become a chronological history log.
+   - `DECISIONS.md` records durable, non-speculative decisions.

guile_agent-0.1.0a4/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,33 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: "[BUG]"
+labels: bug
+assignees: ''
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1.
+2.
+3.
+4.
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**System Information:**
+- OS: [e.g. Ubuntu 22.04]
+- Guile Version or Commit: [e.g. 0.1.0]
+- Python Version: [e.g. 3.12]
+- LLM Used: [e.g. GPT-5, Claude Sonnet 4.6]
+
+**Additional context**
+Add any other context about the problem here.

guile_agent-0.1.0a4/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: "[FEATURE]"
+labels: enhancement
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

guile_agent-0.1.0a4/.github/workflows/build-release.yml

@@ -0,0 +1,146 @@
+name: Build & Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-latest
+            target: macos-arm64
+            wheel-platform: macosx_11_0_arm64
+          - os: macos-15-intel
+            target: macos-x86_64
+            wheel-platform: macosx_11_0_x86_64
+          - os: ubuntu-22.04
+            target: linux-x86_64
+            wheel-platform: manylinux_2_17_x86_64
+          - os: ubuntu-22.04-arm
+            target: linux-arm64
+            wheel-platform: manylinux_2_17_aarch64
+          - os: windows-latest
+            target: windows-x86_64
+            wheel-platform: win_amd64
+
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
+        with:
+          python-version: '3.12'
+
+      - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86  # v5.4.2
+
+      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00  # v6.0.0
+        with:
+          go-version: '1.24.x'
+          check-latest: true
+          cache-dependency-path: guile/interface/tui/go.sum
+
+      - name: Verify Release Contract
+        run: |
+          uv run python scripts/verify_release_contract.py
+
+      - name: Build
+        shell: bash
+        env:
+          GUILE_WHEEL_PLATFORM_TAG: ${{ matrix.wheel-platform }}
+        run: |
+          uv sync --frozen
+          uv build --wheel
+          uv run python -c 'import glob, os, sys, zipfile; wheels = glob.glob("dist/*.whl"); assert len(wheels) == 1, wheels; archive = zipfile.ZipFile(wheels[0]); tui = "guile/bin/guile-tui.exe" if sys.platform == "win32" else "guile/bin/guile-tui"; assert tui in archive.namelist(); metadata = archive.read(next(name for name in archive.namelist() if name.endswith(".dist-info/WHEEL"))).decode(); assert "Root-Is-Purelib: false" in metadata; assert "Tag: py3-none-" + os.environ["GUILE_WHEEL_PLATFORM_TAG"] in metadata'
+
+          uv run pyinstaller guile.spec --noconfirm
+
+          if [[ "${{ runner.os }}" == "Windows" ]]; then
+            PYI_BINARY="dist/guile.exe"
+            TUI_NAME="guile-tui.exe"
+            dist/guile.exe --version
+          else
+            PYI_BINARY="dist/guile"
+            TUI_NAME="guile-tui"
+            dist/guile --version
+          fi
+          uv run pyi-archive_viewer -l "$PYI_BINARY" | grep -E "guile[/\\]+bin[/\\]+$TUI_NAME" >/dev/null
+
+          if [[ "${{ matrix.target }}" == "linux-arm64" ]]; then
+            file dist/guile
+            file dist/guile | grep -q "ARM aarch64" || {
+              echo "::error::linux-arm64 artifact is not an ARM aarch64 binary"
+              exit 1
+            }
+          fi
+
+          VERSION=$(python3 -c "import tomllib, pathlib; print(tomllib.loads(pathlib.Path('pyproject.toml').read_text(encoding='utf-8'))['project']['version'])")
+          mkdir -p dist/release
+
+          if [[ "${{ runner.os }}" == "Windows" ]]; then
+            cp dist/guile.exe "dist/release/guile-${VERSION}-${{ matrix.target }}.exe"
+            (cd dist/release && 7z a "guile-${VERSION}-${{ matrix.target }}.zip" "guile-${VERSION}-${{ matrix.target }}.exe")
+          else
+            cp dist/guile "dist/release/guile-${VERSION}-${{ matrix.target }}"
+            chmod +x "dist/release/guile-${VERSION}-${{ matrix.target }}"
+            tar -C dist/release -czvf "dist/release/guile-${VERSION}-${{ matrix.target }}.tar.gz" "guile-${VERSION}-${{ matrix.target }}"
+          fi
+
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        with:
+          name: guile-${{ matrix.target }}
+          path: |
+            dist/release/*.tar.gz
+            dist/release/*.zip
+            dist/*.whl
+          if-no-files-found: error
+
+  release:
+    needs: build
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
+        with:
+          path: release
+          merge-multiple: true
+
+      - name: Create Release
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65  # v2.6.2
+        with:
+          prerelease: true
+          generate_release_notes: true
+          files: release/**
+
+  publish-pypi:
+    needs: build
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
+        with:
+          path: dist
+          merge-multiple: true
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/
+          print-hash: true

guile_agent-0.1.0a4/.github/workflows/docker-sandbox.yml

@@ -0,0 +1,74 @@
+name: Docker Sandbox CI
+
+on:
+  push:
+    branches:
+      - main
+      - 'security/*'
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  validate-and-build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      version: ${{ steps.meta.outputs.version }}
+      short_sha: ${{ steps.meta.outputs.short_sha }}
+      is_release_tag: ${{ steps.meta.outputs.is_release_tag }}
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          persist-credentials: false
+
+      - name: Setup Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
+        with:
+          python-version: '3.12'
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86  # v5.4.2
+
+      - name: Validate Sandbox Supply-Chain Lock
+        run: |
+          uv sync --frozen
+          uv run python scripts/verify-sandbox-lock.py
+
+      - name: Run Focused Release & Version Tests
+        run: |
+          uv run pytest tests/test_version_contract.py tests/test_proxy_bypass.py
+
+      - name: Verify Release Tag & Version Contract
+        id: meta
+        run: |
+          uv run python scripts/verify_release_contract.py
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349  # v3.7.1
+
+      - name: Build Docker Image (Validation)
+        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75  # v6.9.0
+        with:
+          context: .
+          file: containers/Dockerfile
+          push: false
+          build-args: |
+            BUILD_VERSION=${{ steps.meta.outputs.version }}
+            BUILD_REVISION=${{ github.sha }}
+          tags: |
+            ghcr.io/guile-security/guile-sandbox:${{ steps.meta.outputs.version }}
+            ghcr.io/guile-security/guile-sandbox:${{ steps.meta.outputs.short_sha }}
+          labels: |
+            org.opencontainers.image.title=Guile Sandbox
+            org.opencontainers.image.version=${{ steps.meta.outputs.version }}
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.source=https://github.com/guile-security/guile
+

guile_agent-0.1.0a4/.github/workflows/publish.yml

@@ -0,0 +1,194 @@
+name: Publish Release (PyPI & GHCR)
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: "Existing release tag to publish (e.g. v0.1.0a2)"
+        required: true
+        type: string
+      publish_target:
+        description: "Release destination to publish"
+        required: true
+        type: choice
+        default: "pypi"
+        options:
+          - "pypi"
+          - "ghcr"
+          - "both"
+
+permissions:
+  contents: read
+
+jobs:
+  release-preflight:
+    name: Release Preflight & Version Verification
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      version: ${{ steps.meta.outputs.version }}
+      commit_sha: ${{ steps.meta.outputs.commit_sha }}
+      short_sha: ${{ steps.meta.outputs.short_sha }}
+      ref: ${{ steps.meta.outputs.ref }}
+      is_release_tag: ${{ steps.meta.outputs.is_release_tag }}
+      publish_pypi: ${{ steps.meta.outputs.publish_pypi }}
+      publish_ghcr: ${{ steps.meta.outputs.publish_ghcr }}
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
+        with:
+          python-version: '3.12'
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86  # v5.4.2
+
+      - name: Verify Release Tag & Version Contract
+        id: meta
+        env:
+          INPUT_RELEASE_TAG: ${{ inputs.release_tag }}
+          INPUT_PUBLISH_TARGET: ${{ inputs.publish_target }}
+        run: |
+          uv sync --frozen
+          uv run python scripts/verify_release_contract.py
+
+      - name: Switch to Exact Tag Checkout
+        run: |
+          git checkout "${{ steps.meta.outputs.ref }}"
+          uv sync --frozen
+
+      - name: Validate Rebrand Integrity
+        run: |
+          uv run python scripts/verify_rebrand.py
+
+      - name: Validate Sandbox Supply-Chain Lock
+        run: |
+          uv run python scripts/verify-sandbox-lock.py
+
+      - name: Run Focused Release Tests
+        run: |
+          uv run pytest tests/test_version_contract.py tests/test_bedrock_model_compat.py tests/test_proxy_bypass.py -q
+
+  build-python-dist:
+    name: Build Python Distribution (sdist & wheel)
+    needs: release-preflight
+    if: needs.release-preflight.outputs.is_release_tag == 'true' && needs.release-preflight.outputs.publish_pypi == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout Exact Tag
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          ref: ${{ needs.release-preflight.outputs.ref }}
+          persist-credentials: false
+
+      - name: Setup Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
+        with:
+          python-version: '3.12'
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86  # v5.4.2
+
+      - name: Setup Go Toolchain
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00  # v6.0.0
+        with:
+          go-version: '1.24.x'
+          check-latest: true
+          cache-dependency-path: guile/interface/tui/go.sum
+
+      - name: Build sdist and wheel
+        env:
+          GUILE_WHEEL_PLATFORM_TAG: manylinux_2_17_x86_64
+        run: |
+          uv sync --frozen
+          rm -rf dist
+          uv build
+          uv run python -c 'import glob, zipfile; wheels = glob.glob("dist/*.whl"); assert len(wheels) == 1, wheels; archive = zipfile.ZipFile(wheels[0]); assert "guile/bin/guile-tui" in archive.namelist(); metadata = archive.read(next(name for name in archive.namelist() if name.endswith(".dist-info/WHEEL"))).decode(); assert "Root-Is-Purelib: false" in metadata'
+
+      - name: Upload Python Distributions
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        with:
+          name: python-dist
+          path: dist/*
+          if-no-files-found: error
+
+  publish-pypi:
+    name: Publish to PyPI (OIDC Trusted Publisher)
+    needs: [release-preflight, build-python-dist]
+    if: needs.release-preflight.outputs.is_release_tag == 'true' && needs.release-preflight.outputs.publish_pypi == 'true'
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/guile-agent
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Download Python Distributions
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
+        with:
+          name: python-dist
+          path: dist/
+
+      - name: Publish Package to PyPI
+        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc  # v1.12.4
+        with:
+          packages-dir: dist/
+          skip-existing: false
+
+  publish-ghcr:
+    name: Build & Publish Sandbox Image to GHCR
+    needs: release-preflight
+    if: needs.release-preflight.outputs.is_release_tag == 'true' && needs.release-preflight.outputs.publish_ghcr == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout Exact Tag
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          ref: ${{ needs.release-preflight.outputs.ref }}
+          persist-credentials: false
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349  # v3.7.1
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567  # v3.3.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and Push Docker Image
+        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75  # v6.9.0
+        with:
+          context: .
+          file: containers/Dockerfile
+          push: true
+          build-args: |
+            BUILD_VERSION=${{ needs.release-preflight.outputs.version }}
+            BUILD_REVISION=${{ needs.release-preflight.outputs.commit_sha }}
+          tags: |
+            ghcr.io/guile-security/guile-sandbox:${{ needs.release-preflight.outputs.version }}
+            ghcr.io/guile-security/guile-sandbox:${{ needs.release-preflight.outputs.short_sha }}
+          labels: |
+            org.opencontainers.image.title=Guile Sandbox
+            org.opencontainers.image.version=${{ needs.release-preflight.outputs.version }}
+            org.opencontainers.image.revision=${{ needs.release-preflight.outputs.commit_sha }}
+            org.opencontainers.image.source=https://github.com/guile-security/guile

guile_agent-0.1.0a4/.gitignore

@@ -0,0 +1,100 @@
+# Node / local-viewer SPA source (the built bundle in
+# guile/interface/viewer/static/ is committed and shipped; do not ignore it)
+node_modules/
+guile/interface/viewer/frontend/node_modules/
+guile/interface/viewer/frontend/.vite/
+
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+# Anchored to the repo root: these are Python build-artifact dir names, but
+# unanchored they also match nested source dirs (e.g. the viewer's src/lib).
+/build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+/lib/
+/lib64/
+parts/
+sdist/
+var/
+wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+
+# Virtual Environment
+venv/
+env/
+ENV/
+.env
+.venv
+pip-log.txt
+pip-delete-this-directory.txt
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+.DS_Store
+.project
+.pydevproject
+.settings/
+
+# FastAPI
+.env.local
+.env.development.local
+.env.test.local
+.env.production.local
+
+# MongoDB
+/data/
+mongod.log
+*.mongodb
+*.mongorc.js
+
+# LLM and ML related
+*.bin
+*.pt
+*.pth
+*.onnx
+*.h5
+*.hdf5
+*.pkl
+*.joblib
+wandb/
+runs/
+checkpoints/
+logs/
+tensorboard/
+
+# Agent execution traces
+guile_runs/
+agent_runs/
+
+# Misc
+*.log
+*.sqlite
+*.db
+.directory
+*.bak
+*.tmp
+*.temp
+.DS_Store
+Thumbs.db
+
+*.schema.graphql
+schema.graphql
+
+.opencode/
+
+# Root-only local data and reference checkouts
+/.benchmarks/
+/references/
+/guile_runs_main/

guile_agent-0.1.0a4/.pre-commit-config.yaml

@@ -0,0 +1,67 @@
+# Built viewer bundles are generated output, not hand-edited source.
+exclude: ^guile/interface/viewer/static/assets/
+
+repos:
+  # Ruff for fast linting and formatting
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.11.13
+    hooks:
+      - id: ruff
+        args: [--fix, --exit-non-zero-on-fix]
+        name: ruff-lint
+      - id: ruff-format
+        name: ruff-format
+
+  # MyPy for static type checking. Runs the project's own mypy from the uv
+  # environment (`make dev-install`) so it sees the same dependencies and
+  # stubs as `make check-all`.
+  - repo: local
+    hooks:
+      - id: mypy
+        name: mypy
+        entry: uv run mypy
+        language: system
+        types_or: [python, pyi]
+        files: ^(guile|tests)/
+        require_serial: true
+
+  # Built-in hooks for basic file checks
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-toml
+      - id: check-merge-conflict
+      - id: check-added-large-files
+        args: ['--maxkb=1024']
+      - id: debug-statements
+      - id: check-case-conflict
+      - id: check-docstring-first
+
+  # Security checks with bandit
+  - repo: https://github.com/PyCQA/bandit
+    rev: 1.8.3
+    hooks:
+      - id: bandit
+        args: [-c, pyproject.toml]
+
+  # Additional Python code quality checks
+  - repo: https://github.com/asottile/pyupgrade
+    rev: v3.21.2
+    hooks:
+      - id: pyupgrade
+        args: [--py312-plus]
+
+ci:
+  autofix_commit_msg: |
+    [pre-commit.ci] auto fixes from pre-commit.com hooks
+
+    for more information, see https://pre-commit.ci
+  autofix_prs: true
+  autoupdate_branch: ""
+  autoupdate_commit_msg: "[pre-commit.ci] pre-commit autoupdate"
+  autoupdate_schedule: weekly
+  # pre-commit.ci cannot run `language: system` hooks; mypy runs via `make check-all`.
+  skip: [mypy]
+  submodules: false