lastorders 0.4.0__tar.gz

lastorders-0.4.0/CHANGELOG.md

@@ -0,0 +1,50 @@
+# Changelog
+
+## 0.4.0 (unreleased)
+- **Renamed to Last Orders.** Package, CLI and PyPI name `lastorders`; env vars `LASTORDERS_*` (was the placeholder
+  `modelmigrate` / `MODELMIGRATE_*`); output marker `.lastorders-output`; Action `burntandtoast/lastorders@v0`;
+  Worker `lastorders-licence`, D1 database `lastorders-licences`, Stripe metadata product `lastorders-repo`.
+- **Licence server** (`server/`). This is a Cloudflare Worker with D1:
+  - Stripe Checkout at £149 per repo (configurable);
+  - a signed webhook that issues `BTM-XXXX-XXXX-XXXX` keys, stores them with the buyer's email, and emails them through Resend (the email provider is pluggable);
+  - the repo is bound on first activation;
+  - full refunds revoke the licence;
+  - a success page and admin rebind/revoke tools;
+  - it also serves the pack site.
+
+  Not deployed. See docs/LICENCE-SERVER.md.
+- **Real licence check in the CLI**, replacing the format-only placeholder:
+  - an online verify sends only the key and repo;
+  - a 7-day Ed25519-signed token is cached locally;
+  - a 14-day grace period applies if the server is unreachable;
+  - `--offline` uses the cached token only;
+  - the free `scan` is unaffected.
+- New `licence status|buy|forget` command and the `LASTORDERS_REPO` fallback. New dependency: `cryptography`.
+
+## 0.3.0 (unreleased)
+- `fix`: automatic code fixes driven entirely by pack rules. It renames `max_tokens` per endpoint, adds
+  `reasoning_effort`/`reasoning.effort` "none" where the new model needs it, and flags legacy functions,
+  Assistants, legacy Completions, fine-tunes, fine-tuning jobs, LangChain, `**kwargs`/spread and unknown models
+  for a manual decision. Python uses libcst (lossless); JS/TS use a built-in lexer. Outputs `fix.diff`, `fix-plan.md` and `fix-plan.json`.
+- `fix --verify`: applies the patch to a scratch copy, checks syntax and idempotence, and replays every fixed call
+  old vs new. With `--live` it also runs a control (unpatched arguments on the new model). `--evals` reruns the customer suite.
+- `fix --apply` is gated behind the licence and refuses files with uncommitted changes unless `--force` is passed.
+- Pack format: `signals[].call` (call-level detection) and structured `rules[].fix`
+  (`per_endpoint`, `requires_new_model`, `keep_model`). OpenAI pack 2026.10.15.4, Anthropic 2026.10.15.2.
+- Live finding (15 Oct 2026): GPT-4o and GPT-4.1 reject `reasoning_effort`, so that fix must ship with the model switch.
+- Client report: an "Automatic fixes" section with the verification results.
+
+## 0.2.0 (unreleased)
+- Free `scan` packaged for `pip`/`pipx` (entry point then called `modelmigrate`, a placeholder name); no licence or API key needed.
+- Provider-neutral **migration packs** (JSON + JSON Schema): OpenAI (full), Anthropic (stub). Fetched from a
+  hosted URL at runtime with sha256 check, 24h cache and bundled offline fallback.
+- Scanner, swap and report are generic engines driven by pack data (model IDs, aliases, families, shutdown dates,
+  replacements, SDK/call-site signals, parameter/endpoint/tool-calling rules).
+- GitHub Action (`action.yml`, composite): job summary, PR annotations, artifact upload, optional fail on high risk.
+- Placeholder licence gate for `swap --apply`, `eval` and `report` (`LASTORDERS_LICENCE` / `--licence`). One licence = one GitHub repo (monorepos included).
+- `init-evals`: generate a starter regression suite from the scan's call sites (prompts, schemas, tools read statically).
+- Network policy: only the pack fetch (and, later, the licence check) contacts us; no telemetry. `--offline` / `LASTORDERS_OFFLINE=1`.
+- `packs list|validate|build-site`; deployable static pack site for Vercel / Cloudflare Pages.
+
+## 0.1.0
+- Internal migration kit: scan, swap, eval (mock + live), client report.

lastorders-0.4.0/MANIFEST.in

@@ -0,0 +1,6 @@
+include README.md CHANGELOG.md
+recursive-include migration_kit/pack_data *.json
+prune examples
+prune probes
+prune site
+prune tests

lastorders-0.4.0/PKG-INFO

@@ -0,0 +1,212 @@
+Metadata-Version: 2.4
+Name: lastorders
+Version: 0.4.0
+Summary: Free scanner for retiring AI model IDs (OpenAI, Anthropic, ...) in your code, with CI support.
+Author: Burnt & Toast Studios
+Project-URL: Homepage, https://burntandtoast.com
+Keywords: openai,anthropic,llm,deprecation,migration,gpt-4o,scanner,github-action
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: pyyaml>=6
+Requires-Dist: jsonschema>=4
+Requires-Dist: libcst>=1.1
+Requires-Dist: cryptography>=41
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: build>=1; extra == "dev"
+
+# Last Orders (working name)
+
+**Find retiring AI model IDs in your code before they break.** One command scans your repo for OpenAI
+(and, as a preview, Anthropic) model IDs that are being shut down. For each one it tells you the
+shutdown date, the replacement the provider recommends, and the code changes the new model needs.
+
+> **Heads-up:** OpenAI removes **GPT-4o, GPT-4o mini, GPT-4.1 and GPT-4.1 mini** from the API on
+> **14 January 2027** and recommends `gpt-6-luna`. In our tests, `gpt-6-luna` rejects `max_tokens`, and it
+> rejects tool calls on Chat Completions unless `reasoning_effort` is `"none"`. So changing the model name
+> isn't enough. The scan flags both.
+
+The scan is free. You don't need an account, a licence or an API key, and your code never leaves your machine.
+
+## Install
+
+```bash
+pipx install lastorders        # or: pip install lastorders
+```
+
+You need Python 3.10 or later.
+
+## Scan
+
+```bash
+lastorders scan .              # scan the current repo
+lastorders scan path/to/repo --out scan-results
+lastorders scan . --offline    # no network at all (uses the bundled migration pack)
+```
+
+You get `scan.md`, a readable report, and `scan.json`, the same data for tools. They go in `lastorders-out/`, or wherever `--out` points. Each finding includes:
+
+- **File, line and model ID**, from code (Python, JS, TS), `.env` files, YAML, JSON, TOML and docs
+- **Shutdown date and recommended replacement**, from the provider's published deprecations
+- **Risk level**. High means the date is close or has passed, or the new model needs a code change your
+  code doesn't have yet, such as `max_tokens` becoming `max_completion_tokens`, `reasoning_effort` for tools
+  and `temperature`, or an unsupported endpoint
+- **Fine-tuned models** (`ft:...`), listed separately. They shut down with their base model and can't be
+  swapped automatically.
+- **Models chosen by environment variable** (`os.getenv("OPENAI_MODEL")`), so you can check the
+  values you have deployed
+- **SDKs detected**: the official `openai` and `anthropic` clients, LangChain and plain HTTP
+
+Useful flags:
+
+| Flag | What it does |
+|---|---|
+| `--fail-on-high` | exit code 2 if anything is high risk (for CI) |
+| `--no-docs` | skip `.md` / `.txt` files |
+| `--pack openai` | only use some providers' packs (default: all) |
+| `--offline` | use the bundled pack only; makes no network calls |
+| `--format json` | print the summary as JSON |
+| `--summary-file F` / `--annotations` | CI outputs (used by the GitHub Action) |
+
+## Fix (patch preview)
+
+```bash
+lastorders fix .                 # writes lastorders-out/fix.diff + fix-plan.md; changes nothing on disk
+lastorders fix . --verify        # also checks the patch on a scratch copy (see below)
+git apply lastorders-out/fix.diff
+```
+
+`fix` swaps the retiring model IDs and then makes the code changes the new model needs at each API call:
+
+- **Renames `max_tokens`**, to `max_completion_tokens` on Chat Completions or `max_output_tokens` on Responses.
+- **Adds `reasoning_effort: "none"`** where gpt-6-luna needs it: Chat Completions calls with tools, and
+  calls that set `temperature`, `top_p` or `logprobs`. On Responses it adds `reasoning.effort`.
+- **Flags anything it can't decide safely** in `fix-plan.md`: legacy `functions` calls, Assistants and legacy
+  Completions calls (these stay on their current model in the patch), fine-tunes and fine-tuning jobs,
+  LangChain wrappers, calls that pass `**kwargs` or a spread object, conflicting values, and calls whose model
+  isn't visible in the code (use `--assume-model`).
+
+Every change comes from the migration pack's rules. Python is edited with
+[libcst](https://github.com/Instagram/LibCST), so your formatting and comments are kept. JS and TS are edited
+with a built-in parser. Rules the pack marks `inferred` are only suggested unless you pass `--include-inferred`.
+
+**Old models reject `reasoning_effort`.** We tested gpt-4o and gpt-4.1 against the live API, and both return
+HTTP 400. Any fix that adds it has to ship together with the model switch. When the model comes from an
+environment variable, the plan marks the fix "ship with the model switch". `--no-model-swap` applies only
+the changes that are safe on the old model.
+
+`--verify` applies the patch to a temporary copy of your repo, then:
+
+1. checks the changed files still parse;
+2. re-runs the fixer and checks it changes nothing more;
+3. replays each fixed call twice: once as it was (old model, old arguments) and once as patched (new model,
+   new arguments).
+
+Without `--live`, the replay uses simulated responses. With `--live` and your own `OPENAI_API_KEY` (licence),
+the calls go straight to OpenAI. A control run also sends the unpatched arguments to the new model, to show
+each fix was needed. `--evals evals/regression.yaml` reruns your own suite with the fixed arguments.
+
+## GitHub Action
+
+Add `.github/workflows/model-scan.yml`:
+
+```yaml
+name: Model retirement scan
+on:
+  pull_request:
+  schedule: [{ cron: "0 7 * * 1" }]   # weekly, so new deprecations show up without code changes
+permissions:
+  contents: read
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: burntandtoast/lastorders@v0     # available once the repo is published
+        with:
+          fail-on-high: "true"
+```
+
+The Action posts a summary table to the job page, marks findings inline on the PR and uploads `scan.json`
+as an artifact. Inputs:
+
+| Input | Default | |
+|---|---|---|
+| `path` | `.` | folder to scan |
+| `fail-on-high` | `false` | fail the job on high-risk findings |
+| `include-docs` | `true` | scan `.md`/`.txt` |
+| `annotations` | `true` | inline PR annotations |
+| `packs` | all | e.g. `openai,anthropic` |
+| `offline` | `false` | bundled pack only, no network |
+| `packs-url` | built-in | override the pack URL |
+| `version` | action source | install this version from PyPI instead |
+| `python-version` | `3.12` | |
+| `fix-preview` | `false` | also attach the automatic-fix patch + plan (simulated verify, no key) |
+| `artifact-name` | `lastorders-scan` | |
+
+Outputs: `total`, `high` and `report-dir`.
+
+## Migration packs: where the data comes from
+
+What the scanner knows lives in **migration packs**, versioned JSON files with one pack per provider. Each pack
+holds the model IDs and aliases, shutdown dates, replacements, call-site patterns, and parameter and endpoint
+rules. Every fact links to the provider's documentation and the date we checked it. Rules we confirmed
+against the live API are marked `live-tested`, and anything we assumed is marked `inferred`.
+
+- **OpenAI**: full pack
+- **Anthropic**: preview (stub). It covers Claude API retirement dates from Anthropic's deprecations page.
+  Amazon Bedrock and Google Cloud dates are not covered yet.
+- Gemini, Azure OpenAI and Bedrock: planned
+
+The tool checks for a newer pack once a day and falls back to the copy bundled with the package.
+`lastorders packs list` shows which version and source you're using. The format is documented in
+[docs/PACKS.md](docs/PACKS.md), with a JSON Schema in `migration_kit/pack_data/pack.schema.json`.
+
+## Privacy and network use
+
+- The scan runs **entirely on your machine**. Your code and prompts are never uploaded.
+- **The tool has no telemetry, analytics or tracking.** (Our website counts visits anonymously with Cloudflare Web Analytics: no cookies, no ads, no tracking across sites.)
+- The tool only ever contacts us to **download the latest migration pack** (a plain GET of a static JSON file,
+  with no identifiers) and, for paid features, to **check a licence key**. That check sends only the key and the
+  repo name (`github.com/owner/repo`), and the signed answer is cached for a week, with a 14-day offline grace period after that.
+- `--offline` (or `LASTORDERS_OFFLINE=1`) turns off all network access and uses the bundled pack.
+- The paid `eval` command calls the AI provider directly **with your own API key**. Nothing goes through us.
+
+## Paid features
+
+| | Free | Licence (per repo) | Done for you |
+|---|---|---|---|
+| `scan`, GitHub Action, patch preview (`fix` / `swap` write a `.diff`), `fix --verify` (simulated replay) | ✓ | ✓ | ✓ |
+| `fix --apply` / `swap --apply`, `fix --verify --live`, `init-evals` + `eval` regression testing, client-ready `report` | | ✓ | ✓ |
+| We do the migration, evals and handoff | | | ✓ |
+
+One licence covers **one GitHub repository, monorepos included**. It's bound to the repo the first time
+you use it. Buy one with `lastorders licence buy` (it prints a Stripe Checkout link for this repo), then pass the key
+with `LASTORDERS_LICENCE` (a repository secret in Actions) or `--licence`. `lastorders licence status` shows
+whether it's verified. Paid commands work `--offline` from the cached check. Repos without an `origin` remote
+can set `LASTORDERS_REPO=github.com/owner/repo`. The licence server lives in `server/`; see
+[docs/LICENCE-SERVER.md](docs/LICENCE-SERVER.md).
+
+`init-evals` reads the call sites the scan found, including prompts, JSON schemas and tool definitions where
+they can be read from the code, and writes a starter `evals/regression.yaml`. You then edit it into 10 to 20
+real examples. `eval` runs them against the old and new model with your own key.
+
+## Limitations
+
+- Detection uses pattern matching. Model names built at runtime or stored in a database won't be found;
+  env-var lookups are listed so you can check them.
+- A pack is only as current as its `updated` date. Always check the provider's documentation before acting.
+- The scan suggests changes; it doesn't decide them for you. Review every patch.
+
+---
+
+Made by [Burnt & Toast Studios](https://burntandtoast.com). Not affiliated with OpenAI or Anthropic.

lastorders-0.4.0/README.md

@@ -0,0 +1,186 @@
+# Last Orders (working name)
+
+**Find retiring AI model IDs in your code before they break.** One command scans your repo for OpenAI
+(and, as a preview, Anthropic) model IDs that are being shut down. For each one it tells you the
+shutdown date, the replacement the provider recommends, and the code changes the new model needs.
+
+> **Heads-up:** OpenAI removes **GPT-4o, GPT-4o mini, GPT-4.1 and GPT-4.1 mini** from the API on
+> **14 January 2027** and recommends `gpt-6-luna`. In our tests, `gpt-6-luna` rejects `max_tokens`, and it
+> rejects tool calls on Chat Completions unless `reasoning_effort` is `"none"`. So changing the model name
+> isn't enough. The scan flags both.
+
+The scan is free. You don't need an account, a licence or an API key, and your code never leaves your machine.
+
+## Install
+
+```bash
+pipx install lastorders        # or: pip install lastorders
+```
+
+You need Python 3.10 or later.
+
+## Scan
+
+```bash
+lastorders scan .              # scan the current repo
+lastorders scan path/to/repo --out scan-results
+lastorders scan . --offline    # no network at all (uses the bundled migration pack)
+```
+
+You get `scan.md`, a readable report, and `scan.json`, the same data for tools. They go in `lastorders-out/`, or wherever `--out` points. Each finding includes:
+
+- **File, line and model ID**, from code (Python, JS, TS), `.env` files, YAML, JSON, TOML and docs
+- **Shutdown date and recommended replacement**, from the provider's published deprecations
+- **Risk level**. High means the date is close or has passed, or the new model needs a code change your
+  code doesn't have yet, such as `max_tokens` becoming `max_completion_tokens`, `reasoning_effort` for tools
+  and `temperature`, or an unsupported endpoint
+- **Fine-tuned models** (`ft:...`), listed separately. They shut down with their base model and can't be
+  swapped automatically.
+- **Models chosen by environment variable** (`os.getenv("OPENAI_MODEL")`), so you can check the
+  values you have deployed
+- **SDKs detected**: the official `openai` and `anthropic` clients, LangChain and plain HTTP
+
+Useful flags:
+
+| Flag | What it does |
+|---|---|
+| `--fail-on-high` | exit code 2 if anything is high risk (for CI) |
+| `--no-docs` | skip `.md` / `.txt` files |
+| `--pack openai` | only use some providers' packs (default: all) |
+| `--offline` | use the bundled pack only; makes no network calls |
+| `--format json` | print the summary as JSON |
+| `--summary-file F` / `--annotations` | CI outputs (used by the GitHub Action) |
+
+## Fix (patch preview)
+
+```bash
+lastorders fix .                 # writes lastorders-out/fix.diff + fix-plan.md; changes nothing on disk
+lastorders fix . --verify        # also checks the patch on a scratch copy (see below)
+git apply lastorders-out/fix.diff
+```
+
+`fix` swaps the retiring model IDs and then makes the code changes the new model needs at each API call:
+
+- **Renames `max_tokens`**, to `max_completion_tokens` on Chat Completions or `max_output_tokens` on Responses.
+- **Adds `reasoning_effort: "none"`** where gpt-6-luna needs it: Chat Completions calls with tools, and
+  calls that set `temperature`, `top_p` or `logprobs`. On Responses it adds `reasoning.effort`.
+- **Flags anything it can't decide safely** in `fix-plan.md`: legacy `functions` calls, Assistants and legacy
+  Completions calls (these stay on their current model in the patch), fine-tunes and fine-tuning jobs,
+  LangChain wrappers, calls that pass `**kwargs` or a spread object, conflicting values, and calls whose model
+  isn't visible in the code (use `--assume-model`).
+
+Every change comes from the migration pack's rules. Python is edited with
+[libcst](https://github.com/Instagram/LibCST), so your formatting and comments are kept. JS and TS are edited
+with a built-in parser. Rules the pack marks `inferred` are only suggested unless you pass `--include-inferred`.
+
+**Old models reject `reasoning_effort`.** We tested gpt-4o and gpt-4.1 against the live API, and both return
+HTTP 400. Any fix that adds it has to ship together with the model switch. When the model comes from an
+environment variable, the plan marks the fix "ship with the model switch". `--no-model-swap` applies only
+the changes that are safe on the old model.
+
+`--verify` applies the patch to a temporary copy of your repo, then:
+
+1. checks the changed files still parse;
+2. re-runs the fixer and checks it changes nothing more;
+3. replays each fixed call twice: once as it was (old model, old arguments) and once as patched (new model,
+   new arguments).
+
+Without `--live`, the replay uses simulated responses. With `--live` and your own `OPENAI_API_KEY` (licence),
+the calls go straight to OpenAI. A control run also sends the unpatched arguments to the new model, to show
+each fix was needed. `--evals evals/regression.yaml` reruns your own suite with the fixed arguments.
+
+## GitHub Action
+
+Add `.github/workflows/model-scan.yml`:
+
+```yaml
+name: Model retirement scan
+on:
+  pull_request:
+  schedule: [{ cron: "0 7 * * 1" }]   # weekly, so new deprecations show up without code changes
+permissions:
+  contents: read
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: burntandtoast/lastorders@v0     # available once the repo is published
+        with:
+          fail-on-high: "true"
+```
+
+The Action posts a summary table to the job page, marks findings inline on the PR and uploads `scan.json`
+as an artifact. Inputs:
+
+| Input | Default | |
+|---|---|---|
+| `path` | `.` | folder to scan |
+| `fail-on-high` | `false` | fail the job on high-risk findings |
+| `include-docs` | `true` | scan `.md`/`.txt` |
+| `annotations` | `true` | inline PR annotations |
+| `packs` | all | e.g. `openai,anthropic` |
+| `offline` | `false` | bundled pack only, no network |
+| `packs-url` | built-in | override the pack URL |
+| `version` | action source | install this version from PyPI instead |
+| `python-version` | `3.12` | |
+| `fix-preview` | `false` | also attach the automatic-fix patch + plan (simulated verify, no key) |
+| `artifact-name` | `lastorders-scan` | |
+
+Outputs: `total`, `high` and `report-dir`.
+
+## Migration packs: where the data comes from
+
+What the scanner knows lives in **migration packs**, versioned JSON files with one pack per provider. Each pack
+holds the model IDs and aliases, shutdown dates, replacements, call-site patterns, and parameter and endpoint
+rules. Every fact links to the provider's documentation and the date we checked it. Rules we confirmed
+against the live API are marked `live-tested`, and anything we assumed is marked `inferred`.
+
+- **OpenAI**: full pack
+- **Anthropic**: preview (stub). It covers Claude API retirement dates from Anthropic's deprecations page.
+  Amazon Bedrock and Google Cloud dates are not covered yet.
+- Gemini, Azure OpenAI and Bedrock: planned
+
+The tool checks for a newer pack once a day and falls back to the copy bundled with the package.
+`lastorders packs list` shows which version and source you're using. The format is documented in
+[docs/PACKS.md](docs/PACKS.md), with a JSON Schema in `migration_kit/pack_data/pack.schema.json`.
+
+## Privacy and network use
+
+- The scan runs **entirely on your machine**. Your code and prompts are never uploaded.
+- **The tool has no telemetry, analytics or tracking.** (Our website counts visits anonymously with Cloudflare Web Analytics: no cookies, no ads, no tracking across sites.)
+- The tool only ever contacts us to **download the latest migration pack** (a plain GET of a static JSON file,
+  with no identifiers) and, for paid features, to **check a licence key**. That check sends only the key and the
+  repo name (`github.com/owner/repo`), and the signed answer is cached for a week, with a 14-day offline grace period after that.
+- `--offline` (or `LASTORDERS_OFFLINE=1`) turns off all network access and uses the bundled pack.
+- The paid `eval` command calls the AI provider directly **with your own API key**. Nothing goes through us.
+
+## Paid features
+
+| | Free | Licence (per repo) | Done for you |
+|---|---|---|---|
+| `scan`, GitHub Action, patch preview (`fix` / `swap` write a `.diff`), `fix --verify` (simulated replay) | ✓ | ✓ | ✓ |
+| `fix --apply` / `swap --apply`, `fix --verify --live`, `init-evals` + `eval` regression testing, client-ready `report` | | ✓ | ✓ |
+| We do the migration, evals and handoff | | | ✓ |
+
+One licence covers **one GitHub repository, monorepos included**. It's bound to the repo the first time
+you use it. Buy one with `lastorders licence buy` (it prints a Stripe Checkout link for this repo), then pass the key
+with `LASTORDERS_LICENCE` (a repository secret in Actions) or `--licence`. `lastorders licence status` shows
+whether it's verified. Paid commands work `--offline` from the cached check. Repos without an `origin` remote
+can set `LASTORDERS_REPO=github.com/owner/repo`. The licence server lives in `server/`; see
+[docs/LICENCE-SERVER.md](docs/LICENCE-SERVER.md).
+
+`init-evals` reads the call sites the scan found, including prompts, JSON schemas and tool definitions where
+they can be read from the code, and writes a starter `evals/regression.yaml`. You then edit it into 10 to 20
+real examples. `eval` runs them against the old and new model with your own key.
+
+## Limitations
+
+- Detection uses pattern matching. Model names built at runtime or stored in a database won't be found;
+  env-var lookups are listed so you can check them.
+- A pack is only as current as its `updated` date. Always check the provider's documentation before acting.
+- The scan suggests changes; it doesn't decide them for you. Review every patch.
+
+---
+
+Made by [Burnt & Toast Studios](https://burntandtoast.com). Not affiliated with OpenAI or Anthropic.

lastorders-0.4.0/lastorders.egg-info/PKG-INFO

@@ -0,0 +1,212 @@
+Metadata-Version: 2.4
+Name: lastorders
+Version: 0.4.0
+Summary: Free scanner for retiring AI model IDs (OpenAI, Anthropic, ...) in your code, with CI support.
+Author: Burnt & Toast Studios
+Project-URL: Homepage, https://burntandtoast.com
+Keywords: openai,anthropic,llm,deprecation,migration,gpt-4o,scanner,github-action
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: pyyaml>=6
+Requires-Dist: jsonschema>=4
+Requires-Dist: libcst>=1.1
+Requires-Dist: cryptography>=41
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: build>=1; extra == "dev"
+
+# Last Orders (working name)
+
+**Find retiring AI model IDs in your code before they break.** One command scans your repo for OpenAI
+(and, as a preview, Anthropic) model IDs that are being shut down. For each one it tells you the
+shutdown date, the replacement the provider recommends, and the code changes the new model needs.
+
+> **Heads-up:** OpenAI removes **GPT-4o, GPT-4o mini, GPT-4.1 and GPT-4.1 mini** from the API on
+> **14 January 2027** and recommends `gpt-6-luna`. In our tests, `gpt-6-luna` rejects `max_tokens`, and it
+> rejects tool calls on Chat Completions unless `reasoning_effort` is `"none"`. So changing the model name
+> isn't enough. The scan flags both.
+
+The scan is free. You don't need an account, a licence or an API key, and your code never leaves your machine.
+
+## Install
+
+```bash
+pipx install lastorders        # or: pip install lastorders
+```
+
+You need Python 3.10 or later.
+
+## Scan
+
+```bash
+lastorders scan .              # scan the current repo
+lastorders scan path/to/repo --out scan-results
+lastorders scan . --offline    # no network at all (uses the bundled migration pack)
+```
+
+You get `scan.md`, a readable report, and `scan.json`, the same data for tools. They go in `lastorders-out/`, or wherever `--out` points. Each finding includes:
+
+- **File, line and model ID**, from code (Python, JS, TS), `.env` files, YAML, JSON, TOML and docs
+- **Shutdown date and recommended replacement**, from the provider's published deprecations
+- **Risk level**. High means the date is close or has passed, or the new model needs a code change your
+  code doesn't have yet, such as `max_tokens` becoming `max_completion_tokens`, `reasoning_effort` for tools
+  and `temperature`, or an unsupported endpoint
+- **Fine-tuned models** (`ft:...`), listed separately. They shut down with their base model and can't be
+  swapped automatically.
+- **Models chosen by environment variable** (`os.getenv("OPENAI_MODEL")`), so you can check the
+  values you have deployed
+- **SDKs detected**: the official `openai` and `anthropic` clients, LangChain and plain HTTP
+
+Useful flags:
+
+| Flag | What it does |
+|---|---|
+| `--fail-on-high` | exit code 2 if anything is high risk (for CI) |
+| `--no-docs` | skip `.md` / `.txt` files |
+| `--pack openai` | only use some providers' packs (default: all) |
+| `--offline` | use the bundled pack only; makes no network calls |
+| `--format json` | print the summary as JSON |
+| `--summary-file F` / `--annotations` | CI outputs (used by the GitHub Action) |
+
+## Fix (patch preview)
+
+```bash
+lastorders fix .                 # writes lastorders-out/fix.diff + fix-plan.md; changes nothing on disk
+lastorders fix . --verify        # also checks the patch on a scratch copy (see below)
+git apply lastorders-out/fix.diff
+```
+
+`fix` swaps the retiring model IDs and then makes the code changes the new model needs at each API call:
+
+- **Renames `max_tokens`**, to `max_completion_tokens` on Chat Completions or `max_output_tokens` on Responses.
+- **Adds `reasoning_effort: "none"`** where gpt-6-luna needs it: Chat Completions calls with tools, and
+  calls that set `temperature`, `top_p` or `logprobs`. On Responses it adds `reasoning.effort`.
+- **Flags anything it can't decide safely** in `fix-plan.md`: legacy `functions` calls, Assistants and legacy
+  Completions calls (these stay on their current model in the patch), fine-tunes and fine-tuning jobs,
+  LangChain wrappers, calls that pass `**kwargs` or a spread object, conflicting values, and calls whose model
+  isn't visible in the code (use `--assume-model`).
+
+Every change comes from the migration pack's rules. Python is edited with
+[libcst](https://github.com/Instagram/LibCST), so your formatting and comments are kept. JS and TS are edited
+with a built-in parser. Rules the pack marks `inferred` are only suggested unless you pass `--include-inferred`.
+
+**Old models reject `reasoning_effort`.** We tested gpt-4o and gpt-4.1 against the live API, and both return
+HTTP 400. Any fix that adds it has to ship together with the model switch. When the model comes from an
+environment variable, the plan marks the fix "ship with the model switch". `--no-model-swap` applies only
+the changes that are safe on the old model.
+
+`--verify` applies the patch to a temporary copy of your repo, then:
+
+1. checks the changed files still parse;
+2. re-runs the fixer and checks it changes nothing more;
+3. replays each fixed call twice: once as it was (old model, old arguments) and once as patched (new model,
+   new arguments).
+
+Without `--live`, the replay uses simulated responses. With `--live` and your own `OPENAI_API_KEY` (licence),
+the calls go straight to OpenAI. A control run also sends the unpatched arguments to the new model, to show
+each fix was needed. `--evals evals/regression.yaml` reruns your own suite with the fixed arguments.
+
+## GitHub Action
+
+Add `.github/workflows/model-scan.yml`:
+
+```yaml
+name: Model retirement scan
+on:
+  pull_request:
+  schedule: [{ cron: "0 7 * * 1" }]   # weekly, so new deprecations show up without code changes
+permissions:
+  contents: read
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: burntandtoast/lastorders@v0     # available once the repo is published
+        with:
+          fail-on-high: "true"
+```
+
+The Action posts a summary table to the job page, marks findings inline on the PR and uploads `scan.json`
+as an artifact. Inputs:
+
+| Input | Default | |
+|---|---|---|
+| `path` | `.` | folder to scan |
+| `fail-on-high` | `false` | fail the job on high-risk findings |
+| `include-docs` | `true` | scan `.md`/`.txt` |
+| `annotations` | `true` | inline PR annotations |
+| `packs` | all | e.g. `openai,anthropic` |
+| `offline` | `false` | bundled pack only, no network |
+| `packs-url` | built-in | override the pack URL |
+| `version` | action source | install this version from PyPI instead |
+| `python-version` | `3.12` | |
+| `fix-preview` | `false` | also attach the automatic-fix patch + plan (simulated verify, no key) |
+| `artifact-name` | `lastorders-scan` | |
+
+Outputs: `total`, `high` and `report-dir`.
+
+## Migration packs: where the data comes from
+
+What the scanner knows lives in **migration packs**, versioned JSON files with one pack per provider. Each pack
+holds the model IDs and aliases, shutdown dates, replacements, call-site patterns, and parameter and endpoint
+rules. Every fact links to the provider's documentation and the date we checked it. Rules we confirmed
+against the live API are marked `live-tested`, and anything we assumed is marked `inferred`.
+
+- **OpenAI**: full pack
+- **Anthropic**: preview (stub). It covers Claude API retirement dates from Anthropic's deprecations page.
+  Amazon Bedrock and Google Cloud dates are not covered yet.
+- Gemini, Azure OpenAI and Bedrock: planned
+
+The tool checks for a newer pack once a day and falls back to the copy bundled with the package.
+`lastorders packs list` shows which version and source you're using. The format is documented in
+[docs/PACKS.md](docs/PACKS.md), with a JSON Schema in `migration_kit/pack_data/pack.schema.json`.
+
+## Privacy and network use
+
+- The scan runs **entirely on your machine**. Your code and prompts are never uploaded.
+- **The tool has no telemetry, analytics or tracking.** (Our website counts visits anonymously with Cloudflare Web Analytics: no cookies, no ads, no tracking across sites.)
+- The tool only ever contacts us to **download the latest migration pack** (a plain GET of a static JSON file,
+  with no identifiers) and, for paid features, to **check a licence key**. That check sends only the key and the
+  repo name (`github.com/owner/repo`), and the signed answer is cached for a week, with a 14-day offline grace period after that.
+- `--offline` (or `LASTORDERS_OFFLINE=1`) turns off all network access and uses the bundled pack.
+- The paid `eval` command calls the AI provider directly **with your own API key**. Nothing goes through us.
+
+## Paid features
+
+| | Free | Licence (per repo) | Done for you |
+|---|---|---|---|
+| `scan`, GitHub Action, patch preview (`fix` / `swap` write a `.diff`), `fix --verify` (simulated replay) | ✓ | ✓ | ✓ |
+| `fix --apply` / `swap --apply`, `fix --verify --live`, `init-evals` + `eval` regression testing, client-ready `report` | | ✓ | ✓ |
+| We do the migration, evals and handoff | | | ✓ |
+
+One licence covers **one GitHub repository, monorepos included**. It's bound to the repo the first time
+you use it. Buy one with `lastorders licence buy` (it prints a Stripe Checkout link for this repo), then pass the key
+with `LASTORDERS_LICENCE` (a repository secret in Actions) or `--licence`. `lastorders licence status` shows
+whether it's verified. Paid commands work `--offline` from the cached check. Repos without an `origin` remote
+can set `LASTORDERS_REPO=github.com/owner/repo`. The licence server lives in `server/`; see
+[docs/LICENCE-SERVER.md](docs/LICENCE-SERVER.md).
+
+`init-evals` reads the call sites the scan found, including prompts, JSON schemas and tool definitions where
+they can be read from the code, and writes a starter `evals/regression.yaml`. You then edit it into 10 to 20
+real examples. `eval` runs them against the old and new model with your own key.
+
+## Limitations
+
+- Detection uses pattern matching. Model names built at runtime or stored in a database won't be found;
+  env-var lookups are listed so you can check them.
+- A pack is only as current as its `updated` date. Always check the provider's documentation before acting.
+- The scan suggests changes; it doesn't decide them for you. Review every patch.
+
+---
+
+Made by [Burnt & Toast Studios](https://burntandtoast.com). Not affiliated with OpenAI or Anthropic.