hackagent 0.15.0__tar.gz → 0.16.0__tar.gz

{hackagent-0.15.0 → hackagent-0.16.0}/.gitignore

@@ -72,6 +72,7 @@ htmlcov/
 .cache
 nosetests.xml
 coverage.xml
+coverage.json
 *.cover
 .hypothesis/
 .pytest_cache/
@@ -150,3 +151,7 @@ snapshot_report.html
 # Web UI bundle (built by scripts/build_webui.sh)
 hackagent/interfaces/web/static/*
 !hackagent/interfaces/web/static/.gitignore
+
+# Results exported from the TUI (hackagent/interfaces/tui/views/results/export.py)
+hackagent_results_*.csv
+hackagent_results_*.json

hackagent-0.16.0/PKG-INFO

@@ -0,0 +1,121 @@
+Metadata-Version: 2.5
+Name: hackagent
+Version: 0.16.0
+Summary: HackAgent is an open-source security toolkit to detect vulnerabilities of your AI Agents.
+Author-email: AI Security Lab <ais@ai4i.it>
+License: Apache-2.0
+License-File: LICENSE
+Keywords: agents,ai,security,testing,vulnerabilities
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Requires-Python: >=3.10
+Requires-Dist: click>=8.1.0
+Requires-Dist: httpx>=0.27.0
+Requires-Dist: litellm>=1.69.2
+Requires-Dist: openai>=1.0.0
+Requires-Dist: pydantic[email]>=2.0
+Requires-Dist: python-dateutil>=2.8.0
+Requires-Dist: pyyaml>=6.0.0
+Requires-Dist: rich>=14.0.0
+Provides-Extra: browser
+Requires-Dist: playwright>=1.40; extra == 'browser'
+Provides-Extra: hf
+Requires-Dist: datasets>=2.14.0; extra == 'hf'
+Provides-Extra: rag
+Requires-Dist: faiss-cpu>=1.13.2; extra == 'rag'
+Requires-Dist: numpy>=1.26; extra == 'rag'
+Provides-Extra: tui
+Requires-Dist: textual>=1.0.0; extra == 'tui'
+Provides-Extra: vision
+Requires-Dist: pillow>=10.0.0; extra == 'vision'
+Provides-Extra: web
+Requires-Dist: flask>=3.1.3; extra == 'web'
+Requires-Dist: hackagent-webui<1.0,>=0.2; extra == 'web'
+Description-Content-Type: text/markdown
+
+<div align="center">
+
+<img src="https://docs.hackagent.dev/img/banner.svg" alt="HackAgent" width="800">
+
+**The open-source red-team toolkit for AI models and agents**
+
+[Docs](https://docs.hackagent.dev/) · [App](https://app.hackagent.dev/) · [API](https://api.hackagent.dev/schema/redoc)
+
+[![PyPI](https://img.shields.io/pypi/v/hackagent)](https://pypi.org/project/hackagent/)
+![Python](https://img.shields.io/badge/python-3.10%2B-blue)
+![License](https://img.shields.io/badge/license-Apache%202.0-green)
+![CI](https://img.shields.io/github/actions/workflow/status/AISecurityLab/hackagent/ci.yml)
+![Coverage](https://img.shields.io/codecov/c/github/AISecurityLab/hackagent)
+
+</div>
+
+HackAgent attacks your AI model or agent with research-backed techniques —
+jailbreaks, prompt injection, tool misuse — and has judge models score every
+reply. You get a measured success rate per attack, so you can see how exposed a
+target is and whether a fix helped.
+
+## See it run
+
+**Terminal UI.** Start from an example, change what you need, run it.
+
+<img src="https://raw.githubusercontent.com/AISecurityLab/hackagent/main/docs/static/gifs/hackagent-tui.gif" alt="Building and running a campaign in the HackAgent terminal UI" width="100%">
+
+**Command line.** The same campaign is one YAML file you can edit, check and run, in a shell or in CI.
+
+<img src="https://raw.githubusercontent.com/AISecurityLab/hackagent/main/docs/static/gifs/hackagent-cli.gif" alt="Copying, editing, validating and running a campaign from the command line" width="100%">
+
+**Dashboard.** Browse runs, results and traces with `hackagent web`, or on [app.hackagent.dev](https://app.hackagent.dev/).
+
+<img src="https://raw.githubusercontent.com/AISecurityLab/hackagent/main/docs/static/gifs/hackagent-dashboard.gif" alt="Browsing campaign results in the HackAgent dashboard" width="100%">
+
+## Quick start
+
+```bash
+pip install 'hackagent[tui]'
+hackagent                # opens the terminal UI
+```
+
+Or run an example end to end, fully local, with [Ollama](https://ollama.com):
+
+```bash
+ollama pull gemma3:4b
+hackagent examples copy h4rm3l-demo
+hackagent campaign run h4rm3l-demo.yaml
+```
+
+No API key needed: results go to a local database unless a campaign says
+otherwise.
+
+## Learn more
+
+- [Installation](https://docs.hackagent.dev/getting-started/installation) — extras, and standalone binaries that need no Python
+- [Your first campaign](https://docs.hackagent.dev/getting-started/first-campaign) — write, check and run one
+- [Concepts](https://docs.hackagent.dev/concepts) — attacks, judges and how a run works
+- [Attacks](https://docs.hackagent.dev/reference/attacks) and the [campaign file reference](https://docs.hackagent.dev/reference/campaign)
+- [Dashboard](https://docs.hackagent.dev/getting-started/dashboard) — `hackagent web`, locally or against your account
+
+Questions? Join the [discussions](https://github.com/AISecurityLab/hackagent/discussions) or email ais@ai4i.it.
+
+## Responsible use
+
+HackAgent is for authorized security testing only. Test systems you own or
+have written permission to test, and report what you find through coordinated
+disclosure. Read the [responsible disclosure guidelines](https://docs.hackagent.dev/security/responsible-disclosure)
+and our [security policy](SECURITY.md).
+
+## Contributing
+
+Contributions are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) and
+[CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md).
+
+## License
+
+Licensed under Apache-2.0. See [LICENSE](LICENSE). HackAgent is intended for
+security research and AI safety improvement; the authors are not responsible
+for misuse.

hackagent-0.16.0/README.md

@@ -0,0 +1,80 @@
+<div align="center">
+
+<img src="https://docs.hackagent.dev/img/banner.svg" alt="HackAgent" width="800">
+
+**The open-source red-team toolkit for AI models and agents**
+
+[Docs](https://docs.hackagent.dev/) · [App](https://app.hackagent.dev/) · [API](https://api.hackagent.dev/schema/redoc)
+
+[![PyPI](https://img.shields.io/pypi/v/hackagent)](https://pypi.org/project/hackagent/)
+![Python](https://img.shields.io/badge/python-3.10%2B-blue)
+![License](https://img.shields.io/badge/license-Apache%202.0-green)
+![CI](https://img.shields.io/github/actions/workflow/status/AISecurityLab/hackagent/ci.yml)
+![Coverage](https://img.shields.io/codecov/c/github/AISecurityLab/hackagent)
+
+</div>
+
+HackAgent attacks your AI model or agent with research-backed techniques —
+jailbreaks, prompt injection, tool misuse — and has judge models score every
+reply. You get a measured success rate per attack, so you can see how exposed a
+target is and whether a fix helped.
+
+## See it run
+
+**Terminal UI.** Start from an example, change what you need, run it.
+
+<img src="https://raw.githubusercontent.com/AISecurityLab/hackagent/main/docs/static/gifs/hackagent-tui.gif" alt="Building and running a campaign in the HackAgent terminal UI" width="100%">
+
+**Command line.** The same campaign is one YAML file you can edit, check and run, in a shell or in CI.
+
+<img src="https://raw.githubusercontent.com/AISecurityLab/hackagent/main/docs/static/gifs/hackagent-cli.gif" alt="Copying, editing, validating and running a campaign from the command line" width="100%">
+
+**Dashboard.** Browse runs, results and traces with `hackagent web`, or on [app.hackagent.dev](https://app.hackagent.dev/).
+
+<img src="https://raw.githubusercontent.com/AISecurityLab/hackagent/main/docs/static/gifs/hackagent-dashboard.gif" alt="Browsing campaign results in the HackAgent dashboard" width="100%">
+
+## Quick start
+
+```bash
+pip install 'hackagent[tui]'
+hackagent                # opens the terminal UI
+```
+
+Or run an example end to end, fully local, with [Ollama](https://ollama.com):
+
+```bash
+ollama pull gemma3:4b
+hackagent examples copy h4rm3l-demo
+hackagent campaign run h4rm3l-demo.yaml
+```
+
+No API key needed: results go to a local database unless a campaign says
+otherwise.
+
+## Learn more
+
+- [Installation](https://docs.hackagent.dev/getting-started/installation) — extras, and standalone binaries that need no Python
+- [Your first campaign](https://docs.hackagent.dev/getting-started/first-campaign) — write, check and run one
+- [Concepts](https://docs.hackagent.dev/concepts) — attacks, judges and how a run works
+- [Attacks](https://docs.hackagent.dev/reference/attacks) and the [campaign file reference](https://docs.hackagent.dev/reference/campaign)
+- [Dashboard](https://docs.hackagent.dev/getting-started/dashboard) — `hackagent web`, locally or against your account
+
+Questions? Join the [discussions](https://github.com/AISecurityLab/hackagent/discussions) or email ais@ai4i.it.
+
+## Responsible use
+
+HackAgent is for authorized security testing only. Test systems you own or
+have written permission to test, and report what you find through coordinated
+disclosure. Read the [responsible disclosure guidelines](https://docs.hackagent.dev/security/responsible-disclosure)
+and our [security policy](SECURITY.md).
+
+## Contributing
+
+Contributions are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) and
+[CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md).
+
+## License
+
+Licensed under Apache-2.0. See [LICENSE](LICENSE). HackAgent is intended for
+security research and AI safety improvement; the authors are not responsible
+for misuse.

{hackagent-0.15.0 → hackagent-0.16.0}/hackagent/attacks/techniques/static/h4rm3l/decorators/base.py

@@ -9,13 +9,27 @@ import inspect
 from collections.abc import Awaitable
 from typing import TypeAlias
 
-from numpy.random import RandomState
-
 from ...base import Completion
 
 DecorationResult: TypeAlias = str | Awaitable[str]
 
 
+def _random_state(seed: int):
+    """A seeded numpy RandomState, imported when the first decorator is built.
+
+    Not at module level, so the attack's settings can be read without numpy,
+    as the TUI and campaign validation do for every attack.
+    """
+    try:
+        from numpy.random import RandomState
+    except ImportError as exc:
+        raise ImportError(
+            "numpy is required for the h4rm3l attack. "
+            "Install with: pip install 'hackagent[rag]'"
+        ) from exc
+    return RandomState(seed=seed)
+
+
 class PromptDecorator:
     """Base class for all h4rm3l decorators.
 
@@ -24,7 +38,7 @@ class PromptDecorator:
     """
 
     def __init__(self, seed: int = 42) -> None:
-        self._random_state = RandomState(seed=seed)
+        self._random_state = _random_state(seed)
         self._chain: list[PromptDecorator] = [self]
 
     def decorate(self, prompt: str) -> DecorationResult:

{hackagent-0.15.0 → hackagent-0.16.0}/hackagent/attacks/techniques/static/mml/image_encoder.py

@@ -15,35 +15,52 @@ All images are returned as base64-encoded data URLs suitable for inclusion
 in multimodal LLM API requests.
 """
 
+from __future__ import annotations
+
 import base64
 import io
 import random
 import textwrap
-from typing import Any, Dict, List
-
-try:
-    from PIL import Image, ImageDraw, ImageFont
-except ImportError:
-    raise ImportError(
-        "Pillow is required for the MML attack. "
-        "Install with: pip install 'hackagent[vision]'"
-    )
+from types import ModuleType
+from typing import TYPE_CHECKING, Any, Dict, List
+
+if TYPE_CHECKING:
+    from PIL import Image, ImageFont
+
+
+def _pil() -> ModuleType:
+    """Pillow, imported when the first image is drawn.
+
+    Not at module level, so the attack's settings can be read without the
+    vision extra, as the TUI and campaign validation do for every attack.
+    """
+    try:
+        import PIL.Image
+        import PIL.ImageDraw
+        import PIL.ImageFont
+    except ImportError as exc:
+        raise ImportError(
+            "Pillow is required for the MML attack. "
+            "Install with: pip install 'hackagent[vision]'"
+        ) from exc
+    return PIL
 
 
 def _get_font(font_size: int) -> ImageFont.FreeTypeFont:
     """Load a monospace font, falling back to the default if unavailable."""
+    fonts = _pil().ImageFont
     try:
-        return ImageFont.truetype("DejaVuSansMono.ttf", font_size)
+        return fonts.truetype("DejaVuSansMono.ttf", font_size)
     except (OSError, IOError):
         try:
-            return ImageFont.truetype("DejaVuSans.ttf", font_size)
+            return fonts.truetype("DejaVuSans.ttf", font_size)
         except (OSError, IOError):
             try:
-                return ImageFont.truetype(
+                return fonts.truetype(
                     "/usr/share/fonts/truetype/dejavu/DejaVuSans.ttf", font_size
                 )
             except (OSError, IOError):
-                return ImageFont.load_default()
+                return fonts.load_default()
 
 
 def _render_text_to_image(
@@ -67,8 +84,9 @@ def _render_text_to_image(
     Returns:
         A PIL Image with the text rendered on it.
     """
-    img = Image.new("RGB", (width, height), color=background_color)
-    draw = ImageDraw.Draw(img)
+    pil = _pil()
+    img = pil.Image.new("RGB", (width, height), color=background_color)
+    draw = pil.ImageDraw.Draw(img)
     font = _get_font(font_size)
 
     # Wrap text to fit within the image width
@@ -255,7 +273,7 @@ def encode_mirror(
         prompt, image_width, image_height, font_size, background_color, text_color
     )
     # Mirror horizontally
-    img = img.transpose(Image.FLIP_LEFT_RIGHT)
+    img = img.transpose(_pil().Image.FLIP_LEFT_RIGHT)
 
     words = prompt.split()
     scrambled_words = words.copy()
@@ -407,7 +425,7 @@ def encode_mixed(
     )
 
     # Apply mirror and rotation
-    img = img.transpose(Image.FLIP_LEFT_RIGHT)
+    img = img.transpose(_pil().Image.FLIP_LEFT_RIGHT)
     img = img.rotate(180)
 
     # Scramble original words

{hackagent-0.15.0 → hackagent-0.16.0}/hackagent/examples/hermes/README.md

@@ -53,13 +53,13 @@ Then run:
 | Config key | Maps to | Default |
 |---|---|---|
 | `name` (required) | `-m <model>` | — |
-| `binary` | argv[0], checked with `shutil.which` at construction | `hermes` |
+| `binary` | argv[0], checked with `shutil.which` at construction. `ollama` starts Hermes with `ollama launch hermes --model <name>` | `hermes` |
 | `provider` | `--provider <provider>` | unset |
 | `cwd` | working directory Hermes operates in | unset |
 | `timeout` | `subprocess.run(..., timeout=)` seconds | `600` |
-| `ignore_user_config` | `--ignore-user-config` | `True` |
+| `ignore_user_config` | `--ignore-user-config` | `True`, or `False` when `binary` is `ollama` |
 | `safe_mode` | `--safe-mode` | `False` |
-| `source` | `--source <source>` | `hackagent` |
+| `source` | `--source <source>` | unset |
 | `extra_args` | appended raw flags | `[]` |
 
 ---
@@ -71,9 +71,10 @@ Unlike Claude Code, Hermes is stateful: it keeps long-term memory in `~/.hermes/
 The adapter therefore defaults to isolation:
 
 - `--ignore-user-config` is always passed unless you explicitly set `"ignore_user_config": False`, so the target uses defaults plus `.env` credentials only and never reads `~/.hermes/config.yaml`.
+- Through Ollama (`binary: ollama`) `--ignore-user-config` is off by default: `ollama launch hermes` writes the model into `~/.hermes/config.yaml`, so Hermes has to read it. Isolate the run with a dedicated `hermes profile` instead.
 - `-r`/`--resume` and `-c`/`--continue` are never passed, so every attack turn is a fresh session.
 - `"safe_mode": True` opts into `--safe-mode` for maximum isolation (all customizations disabled).
-- `--source hackagent` is passed so Hermes-side logs are attributable to HackAgent runs.
+- `--source` is not passed by default: recent Hermes versions accept it only under `hermes chat`, not with `-z`. Set `source` if your version takes it.
 
 For stronger separation still, point `cwd` at a scratch directory and/or run the target under a dedicated `hermes profile` so the operator's real profile, memory and skills are never touched.
 
@@ -82,7 +83,8 @@ For stronger separation still, point `cwd` at a scratch directory and/or run the
 ### Notes
 
 - `hermes -z` returns bare text with no structured metadata (no session id, cost or exit reason), so the adapter relies on exit codes: `0` success, `1` delivery/backend failure, `2` usage error. A non-zero exit with usable stdout is captured as the target's response (a refusal is a legitimate response to judge); exit `2` always fails loudly.
-- The prompt is fed via **stdin**, never argv, so adversarial payloads starting with `-` are not parsed as CLI flags.
+- The prompt is passed as `--oneshot=<prompt>`, the value of `-z`. Joined to the option with `=`, an adversarial payload starting with `-` is not parsed as a CLI flag.
+- As one argument, the prompt is limited by the OS: about 127 KiB on Linux and macOS, 30,000 bytes on Windows. A longer prompt fails that turn with an error instead of reaching Hermes.
 - The `endpoint` field is present for HackAgent compatibility but is ignored for this local setup.
 - If the configured binary is not on `PATH`, the setup fails before the attack runs.
 - `hermes serve` (a headless backend over JSON-RPC/WebSocket) is out of scope here; this example covers the local CLI-driven path only.

{hackagent-0.15.0 → hackagent-0.16.0}/hackagent/interfaces/cli/commands/examples.py

@@ -8,6 +8,7 @@ Launch ready-to-run example scenarios from the CLI.
 """
 
 import importlib
+import re
 import os
 import socket
 import shutil
@@ -17,6 +18,7 @@ import time
 from dataclasses import dataclass
 from pathlib import Path
 from types import ModuleType
+from typing import Optional
 from urllib.error import URLError
 from urllib.parse import urljoin
 from urllib.request import urlopen
@@ -513,10 +515,56 @@ def list_examples():
             console.print(f"  [dim]{line}[/dim]")
     console.print(
         "\n[dim]Run one with:[/dim] hackagent examples run <name>\n"
+        "[dim]Or copy it here to edit:[/dim] hackagent examples copy <name>\n"
         "[dim]A name's last part is enough when it is unique.[/dim]"
     )
 
 
+#: Where the docs site serves the campaign JSON Schema.
+CAMPAIGN_SCHEMA_URL = "https://docs.hackagent.dev/schema/campaign.schema.json"
+
+#: An editor schema hint pointing at a relative path, as the examples have.
+_SCHEMA_HINT = re.compile(r"^(# yaml-language-server: \$schema=)(?!https?://)\S+", re.M)
+
+
+@examples.command(name="copy")
+@click.argument("name")
+@click.argument("destination", required=False, type=click.Path(path_type=Path))
+@click.option("--force", is_flag=True, help="Overwrite a file that is already there.")
+@handle_errors
+def copy_example(name: str, destination: Optional[Path], force: bool):
+    """📄 Copy an example campaign here, to edit and run as your own.
+
+    DESTINATION is a file or a folder, the current folder by default.
+    """
+    key, source = _resolve_example_name(name)
+    target = destination or Path(".")
+    if target.is_dir():
+        target = target / source.name
+    if target.exists() and not force:
+        raise click.ClickException(
+            f"{target} already exists; use --force to replace it."
+        )
+    # Copied as it is, comments included: they explain the example. Only the
+    # editor's schema hint changes, from a path inside this repository to the
+    # schema the docs site publishes.
+    text = source.read_text(encoding="utf-8")
+    text = _SCHEMA_HINT.sub(rf"\g<1>{CAMPAIGN_SCHEMA_URL}", text, count=1)
+    target.write_text(text, encoding="utf-8")
+
+    console.print(f"[green]Copied[/green] {key} → {target}")
+    folder = key.rsplit("/", 1)[0] if "/" in key else ""
+    if folder in _TARGETS or folder in _MANUAL_TARGETS:
+        console.print(
+            "[yellow]Its agent is not copied: start it the way "
+            f"`hackagent examples run {key}` does, or point the target elsewhere.[/yellow]"
+        )
+    console.print(
+        f"[dim]Edit it, then run it with:[/dim] hackagent campaign run {target}",
+        soft_wrap=True,
+    )
+
+
 @examples.command(name="run")
 @click.argument("name")
 @handle_errors

{hackagent-0.15.0 → hackagent-0.16.0}/hackagent/interfaces/tui/app.py

@@ -13,6 +13,7 @@ app of its own, opened by starting ``HackAgentTUI`` on it, which is how the
 welcome screen reaches past results.
 """
 
+import os
 from pathlib import Path
 from typing import Any
 
@@ -28,6 +29,27 @@ from hackagent.interfaces.tui.views.config import ConfigTab
 from hackagent.interfaces.tui.views.results import ResultsTab
 
 
+def _start_multiprocessing_tracker() -> None:
+    """Start multiprocessing's resource tracker while stderr is still a file.
+
+    Textual replaces ``sys.stderr`` with an object that has no file
+    descriptor. The first multiprocessing lock made after that starts the
+    tracker, which hands its child stderr's descriptor and fails with
+    "bad value(s) in fds_to_keep". tqdm makes such a lock whenever
+    ``datasets`` loads a Hugging Face dataset, so a campaign whose goals come
+    from a preset could not run in the TUI. Started here, the tracker is
+    already running when that lock is made.
+    """
+    if os.name != "posix":  # Windows has no resource tracker.
+        return
+    from multiprocessing import resource_tracker
+
+    try:
+        resource_tracker.ensure_running()
+    except Exception:  # noqa: BLE001 - never stop the TUI from opening over it
+        pass
+
+
 class HackAgentTUI(App):
     """HackAgent Terminal User Interface Application"""
 
@@ -204,6 +226,10 @@ class HackAgentTUI(App):
         """Expose the HackAgent brand palette as CSS variables."""
         return {**super().get_css_variables(), **css_variables()}
 
+    def run(self, *args: Any, **kwargs: Any) -> Any:
+        _start_multiprocessing_tracker()
+        return super().run(*args, **kwargs)
+
     def compose(self) -> ComposeResult:
         """One view and a footer.
 

{hackagent-0.15.0 → hackagent-0.16.0}/hackagent/interfaces/tui/views/campaign/form.py

@@ -62,6 +62,9 @@ class FieldRow(Horizontal):
         self.draft = draft
         self.box = box
         self.issue: Optional[str] = None
+        # Kept rather than queried: Textual can remove the row's children
+        # before a pending mount refreshes it, as when the app closes at once.
+        self._state = Static("", classes="state")
 
     @property
     def path(self) -> Path:
@@ -70,7 +73,7 @@ class FieldRow(Horizontal):
     def compose(self) -> ComposeResult:
         yield Static(_label_markup(self.field.label_in(self.box)), classes="label")
         yield self._editor()
-        yield Static("", classes="state")
+        yield self._state
 
     def on_mount(self) -> None:
         self.refresh_state()
@@ -159,7 +162,8 @@ class FieldRow(Horizontal):
         elif self.field.kind == "tristate":
             self._commit(event.value == "true")
         else:
-            self._commit(event.value)
+            # The widget holds text; the campaign needs the schema's type.
+            self._commit(self.field.choice_value(str(event.value)))
 
     def on_text_area_changed(self, event: TextArea.Changed) -> None:
         event.stop()
@@ -203,7 +207,7 @@ class FieldRow(Horizontal):
             # No default and not required: leaving it out sends nothing, and
             # whatever is on the other end picks.
             text = "[dim]not sent[/dim]"
-        self.query_one(".state", Static).update(text)
+        self._state.update(text)
 
 
 def _label_markup(label: str) -> str:

{hackagent-0.15.0 → hackagent-0.16.0}/hackagent/interfaces/tui/views/campaign/schema.py

@@ -80,6 +80,9 @@ class FieldDef:
     default: Any
     description: str
     choices: tuple[str, ...] = ()
+    #: What each choice stands for, in the same order: ``2`` for the choice
+    #: ``"2"`` of ``Literal[1, 2]``. Empty when the choices are the values.
+    choice_values: tuple[Any, ...] = ()
     advanced: bool = False
     #: The model this field belongs to. Two models can share a field name, so
     #: anything keyed on fields must key on this too.
@@ -123,6 +126,13 @@ class FieldDef:
             return ", ".join(str(item) for item in self.default)
         return str(self.default)
 
+    def choice_value(self, choice: str) -> Any:
+        """The value a choice stands for, with the type the schema expects."""
+        for text, value in zip(self.choices, self.choice_values):
+            if text == choice:
+                return value
+        return choice
+
     def is_default(self, value: Any) -> bool:
         """Whether ``value`` is what the schema would use anyway."""
         if self.default is MISSING:
@@ -185,6 +195,15 @@ def _kind(annotation: Any) -> tuple[Optional[str], tuple[str, ...]]:
     return None, ()
 
 
+def _choice_values(annotation: Any) -> tuple[Any, ...]:
+    """The values behind a choice field's labels, as :func:`_kind` lists them."""
+    if get_origin(annotation) is Literal:
+        return get_args(annotation)
+    if isinstance(annotation, type) and issubclass(annotation, enum.Enum):
+        return tuple(member.value for member in annotation)
+    return ()
+
+
 def discriminated_variants(
     info: FieldInfo,
 ) -> tuple[Optional[str], dict[str, type[BaseModel]]]:
@@ -279,6 +298,7 @@ def model_fields(
                 default=default,
                 description=info.description or "",
                 choices=choices,
+                choice_values=_choice_values(annotation) if kind == "choice" else (),
                 advanced=bool(_advanced_flag(info)),
                 owner=model,
             )

{hackagent-0.15.0 → hackagent-0.16.0}/hackagent/models/completions/cli.py

@@ -16,6 +16,7 @@ Subclasses set the class attributes, read their own options in
 from __future__ import annotations
 
 import asyncio
+import os
 import shutil
 from abc import abstractmethod
 from typing import Any, ClassVar, Dict, List, Mapping, Optional, Sequence
@@ -62,6 +63,16 @@ def last_user_text(messages: List[Dict[str, Any]]) -> Optional[str]:
     return None
 
 
+def is_ollama_launcher(binary: str) -> bool:
+    """Whether ``binary`` is Ollama, which starts an agent with ``ollama launch``.
+
+    Only the executable's name counts, so an agent installed under a folder
+    called ``ollama`` still runs natively.
+    """
+    name = os.path.basename(binary).lower()
+    return name in ("ollama", "ollama.exe")
+
+
 class SubprocessCLIModel(Model):
     """A :class:`Model` that answers each turn by running a local CLI."""
 
@@ -192,5 +203,6 @@ __all__ = [
     "CLIConfigurationError",
     "CLIInteractionError",
     "SubprocessCLIModel",
+    "is_ollama_launcher",
     "last_user_text",
 ]

{hackagent-0.15.0 → hackagent-0.16.0}/hackagent/models/completions/codex.py

@@ -26,6 +26,7 @@ from hackagent.models.completions.cli import (
     CLIConfigurationError,
     CLIInteractionError,
     SubprocessCLIModel,
+    is_ollama_launcher,
     last_user_text,
 )
 
@@ -194,9 +195,7 @@ def _get_codex_custom_llm_class():
         def _build_argv(self) -> List[str]:
             """Assemble the CLI argv based on whether we use codex natively or via ollama."""
             argv = [self.binary]
-            is_ollama = "ollama" in self.binary.lower()
-
-            if is_ollama:
+            if is_ollama_launcher(self.binary):
                 # ollama arguments
                 argv.extend(["launch", "codex"])
                 if self.model:
@@ -213,6 +212,10 @@ def _get_codex_custom_llm_class():
                 if self.model:
                     argv.extend(["-m", self.model])
 
+            # Attacks run in throwaway folders, and codex exec refuses to start
+            # outside a Git repository without this.
+            argv.append("--skip-git-repo-check")
+
             # Codex does not need an HTTP endpoint here. Prompt text is passed
             # through stdin by _run, matching the Claude Code backend style.