marvisx-cli 0.3.8b7__tar.gz → 0.3.9b2__tar.gz

marvisx_cli-0.3.9b2/MANIFEST.in

@@ -0,0 +1,15 @@
+# Source-distribution manifest.
+#
+# `python -m build --sdist --wheel` builds the wheel FROM the sdist, so any
+# runtime data-file missing from the sdist is also missing from that wheel —
+# even though a DIRECT wheel build (uv build / pip wheel) would include it via
+# [tool.setuptools.package-data]. uv infers sdist contents from the git file
+# list; plain setuptools needs them spelled out here. Keep these globs in sync
+# with [tool.setuptools.package-data] in pyproject.toml (learning 9e527cfa).
+recursive-include migrations *.sql
+recursive-include core/scripts/install_hooks *.sh *.json *.py
+recursive-include core/api/templates *.md *.j2
+recursive-include core/api/mcp/tools/workflow_playbooks *.md
+recursive-include core/cli/guides *.md
+recursive-include core/api/console_dist *
+recursive-include projects/_template *

marvisx_cli-0.3.9b2/PKG-INFO

@@ -0,0 +1,205 @@
+Metadata-Version: 2.4
+Name: marvisx-cli
+Version: 0.3.9b2
+Summary: MarvisX OSS — agent-native company-brain CLI runtime (init, status, brief, triage)
+Author: MarvisX maintainers
+License: BSL-1.1
+Project-URL: Homepage, https://justaskmarvis.com
+Project-URL: Documentation, https://justaskmarvis.com/docs/getting-started
+Project-URL: Source, https://github.com/emiliomartucci/marvisx-oss
+Project-URL: Issues, https://github.com/emiliomartucci/marvisx-oss/issues
+Project-URL: Changelog, https://github.com/emiliomartucci/marvisx-oss/blob/main/CHANGELOG.md
+Keywords: marvisx,cli,bootstrap,wizard,oss,agent,company-brain
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: Other/Proprietary License
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Operating System :: MacOS :: MacOS X
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
+Classifier: Topic :: Utilities
+Requires-Python: <3.14,>=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: typer>=0.12
+Requires-Dist: rich>=13
+Requires-Dist: click>=8
+Requires-Dist: pydantic>=2.5
+Requires-Dist: pydantic-settings>=2.7.0
+Requires-Dist: PyYAML>=6
+Requires-Dist: platformdirs>=4.0
+Requires-Dist: cryptography>=42
+Requires-Dist: fastapi>=0.115.0
+Requires-Dist: slowapi>=0.1.9
+Requires-Dist: cachetools>=5.3.0
+Requires-Dist: uvicorn[standard]>=0.34.0
+Requires-Dist: aiosqlite>=0.20.0
+Requires-Dist: PyJWT>=2.10.0
+Requires-Dist: bcrypt>=4.2.0
+Requires-Dist: email-validator>=2.2.0
+Requires-Dist: defusedxml>=0.7.1
+Requires-Dist: python-magic>=0.4.27
+Requires-Dist: python-multipart>=0.0.18
+Requires-Dist: filelock>=3.16.0
+Requires-Dist: aiofiles>=24.1.0
+Requires-Dist: aiohttp>=3.9.0
+Requires-Dist: itsdangerous>=2.1.0
+Requires-Dist: pywebpush>=2.0.0
+Requires-Dist: py-vapid>=1.9.0
+Requires-Dist: anthropic<1.0.0,>=0.96.0
+Requires-Dist: openai<2.0.0,>=1.50.0
+Requires-Dist: httpx>=0.28.0
+Requires-Dist: tenacity<10,>=9.1
+Requires-Dist: tree-sitter<0.26,>=0.23.0
+Requires-Dist: tree-sitter-python<0.25,>=0.23.0
+Requires-Dist: tree-sitter-typescript~=0.23.2
+Requires-Dist: pygit2>=1.15.0
+Requires-Dist: markdown-it-py>=3.0.0
+Requires-Dist: watchfiles>=1.1.0
+Requires-Dist: Pillow>=10.0.0
+Requires-Dist: openpyxl>=3.1.0
+Requires-Dist: mcp>=1.27.0
+Requires-Dist: fastmcp>=2
+Requires-Dist: onnxruntime>=1.18
+Requires-Dist: tokenizers>=0.20
+Requires-Dist: huggingface-hub>=0.24
+Requires-Dist: numpy>=1.26
+Requires-Dist: psutil>=5.9.0
+Requires-Dist: sqlite-vec>=0.1.6
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: pytest-cov>=5; extra == "dev"
+Provides-Extra: keyring
+Requires-Dist: keyring>=24; extra == "keyring"
+Dynamic: license-file
+
+# marvis init
+
+Interactive bootstrap wizard for MarvisX OSS. Five prompts (license,
+storage, BYOK, first project, recap) reusing the shared `core/wizard/`
+state machine so the CLI and the Console `/welcome` route produce
+byte-identical settings when given the same answers.
+
+## Install
+
+```bash
+pip install marvisx-cli
+marvis init
+```
+
+Pre-install (clone and run) works too:
+
+```bash
+python -m core.cli.marvis_init init
+```
+
+## Quick start (interactive)
+
+```bash
+marvis init
+```
+
+You will be asked:
+
+1. **License** — accept BSL 1.1 (`y`/`n`).
+2. **Storage** — projects root path, database backend (`sqlite` or
+   `postgres`), and either the SQLite file path or the Postgres DSN.
+3. **LLM provider (BYOK)** — `anthropic`, `openai`, `mac_gateway`,
+   `bedrock`, or `skip`. API key prompt is hidden input. Mac gateway
+   asks for the base URL.
+4. **First project** — name, slug, and type (`code`, `work`, `system`).
+5. **Recap** — review choices, confirm.
+
+On confirmation the wizard writes:
+
+- `~/.marvis/settings.yaml` — workspace + storage + llm choice (no
+  secrets), chmod 600.
+- `~/.marvis/master.key` + `~/.marvis/byok.vault` — Fernet-encrypted
+  API key store (only if a provider was chosen).
+- `<projects_root>/<slug>/project.yaml` — first project seed.
+
+## Non-interactive / CI
+
+```bash
+marvis init \
+  --accept-bsl \
+  --no-interactive \
+  --projects-root /var/lib/marvis/projects \
+  --db-backend sqlite \
+  --db-path /var/lib/marvis/console.db \
+  --llm-provider anthropic \
+  --llm-api-key "$ANTHROPIC_API_KEY" \
+  --project-name "Local Workspace" \
+  --project-slug local-workspace \
+  --project-type code
+```
+
+YAML preset (preferred for repeatable provisioning):
+
+```bash
+marvis init --no-interactive --config init.yaml
+```
+
+`init.yaml`:
+
+```yaml
+welcome:
+  bsl_accepted: true
+storage:
+  projects_root: /var/lib/marvis/projects
+  db_backend: sqlite
+  db_path: /var/lib/marvis/console.db
+llm_provider:
+  provider: anthropic
+  api_key: sk-ant-...
+first_project:
+  name: Local Workspace
+  slug: local-workspace
+  type: code
+```
+
+## Dry run
+
+```bash
+marvis init --dry-run --accept-bsl --no-interactive ...
+```
+
+Prints the planned filesystem writes and the rendered `settings.yaml`
+without touching the disk. Exit 0.
+
+## Exit codes
+
+| Code | Meaning |
+| --- | --- |
+| 0 | Success (or dry-run) |
+| 1 | Generic runtime error |
+| 2 | User abort at recap confirmation |
+| 3 | Validation failure (field-level errors printed) |
+
+## Tests
+
+```bash
+python -m pytest tests/test_cli_marvis_init.py
+```
+
+Ten cases cover dry-run, non-interactive flags, YAML preset, BYOK vault
+write, invalid slug rejection, Postgres backend, interactive prompts via
+`CliRunner(input=...)`, BSL gate, and `show-state` JSON dump.
+
+## Relation to `core/scripts/marvis-init.sh`
+
+`marvis-init.sh` (bash) is a deploy bootstrap: copies
+`deploy/_template/`, renders `.env` with secrets, runs
+`setup-server.sh`, and brings up Docker Compose. It targets server
+administrators provisioning a host.
+
+`marvis init` (this Python CLI) is an onboarding wizard: writes
+`settings.yaml` + BYOK vault + first project seed in the user's home.
+It targets OSS users running MarvisX locally.
+
+The two flows are complementary and will converge in a later phase. Until
+then both ship side-by-side.

marvisx_cli-0.3.9b2/README.md

@@ -0,0 +1,138 @@
+# Marvis
+
+[![PyPI](https://img.shields.io/pypi/v/marvisx-cli.svg)](https://pypi.org/project/marvisx-cli/) [![License: BSL 1.1](https://img.shields.io/badge/license-BSL%201.1-blue.svg)](LICENSE) [![Change Date: Apache-2.0 2030](https://img.shields.io/badge/change%20date-Apache--2.0%20(2030)-lightgrey.svg)](LICENSE)
+
+**The Company Brain your agents install.** Use Claude Code, or whatever coding agent you run, to manage projects and coordinate your agents, not just write code. Marvis captures what your agents do as they work, structures it into a cross-project Knowledge Graph, and hands it back to them, so your work stays on track and the system learns from it. Self-hosted, EU-resident, with a tamper-evident audit log.
+
+**Open-core and free to run.** Marvis is the free core: you self-host it, read the source, fork it, audit it, at no cost. MarvisX is the commercial tier on top of the same brain: multi-department teams, data sovereignty and managed hosting, and autonomous, hands-off-the-keyboard operation. Marvis is what you install today; MarvisX is what you reach for when a single self-hosted instance is no longer enough.
+
+## Install
+
+For Claude Code users, install the plugin first. It wires the Marvis MCP server, hooks, and Marvis skills into the agent surface:
+
+```text
+/plugin marketplace add emiliomartucci/marvisx-oss
+/plugin install marvis@marvisx-oss
+```
+
+Then run `/marvis:install` inside Claude Code to install the local runtime when needed. The plugin is the preferred Claude Code route. Do not also run `marvis mcp register` in the same project unless you intentionally want the legacy `.mcp.json` route; mixing both registers the same MCP server twice, and `marvis doctor` reports that as a warning.
+
+For other agents and shells, install the CLI and let the agent drive it:
+
+```bash
+pip install marvisx-cli
+marvis init
+```
+
+`marvis init` scaffolds the project and installs the governance hooks, then exposes the MCP surface to your agent. Python 3.10–3.13. For an isolated tool install, use `uv tool install marvisx-cli`; on Python 3.14, pin the interpreter: `uv tool install --python 3.13 marvisx-cli`. No `uv` yet? `curl -LsSf https://astral.sh/uv/install.sh | sh`.
+
+**Managed Windows (application-control policy)?** If your organization enforces application control — Windows **WDAC** / AppLocker / Managed Installer, common on managed corporate machines — Windows blocks running any binary placed in `%LOCALAPPDATA%`, which is where `uv` installs tools, so `uv tool install` can't execute. Don't bypass it. Install Marvis inside **WSL2** (recommended) or **Docker**, or ask IT to whitelist `uv` (or publish it through your managed channel); the Linux runtime is identical.
+
+To run the full Console + API stack yourself, see [Self-hosting the full stack](#self-hosting-the-full-stack).
+
+## What it does, in plain terms
+
+- **Your agents stop forgetting.** Decisions, specs, playbooks, learnings and mistakes are captured as a side effect of the work your agents already do, not retyped by hand.
+- **Your work stays on track.** A reflective Brain layer compares what agents produce against your intent and surfaces drift early, before it compounds across sessions.
+- **One brain, many projects and teams.** A cross-project Knowledge Graph links decisions, code and documents, so an agent working in one project can see what was decided in another.
+- **Governed by default.** Constitution rules enforced at the hook level, plus a foreign-key-immutable audit log: every action traces back to the human who approved it.
+- **It lives in your terminal, not a dashboard.** An agent-native MCP surface keeps your existing Claude Code / Codex / Cursor as the place you work.
+
+## Under the hood
+
+- **Cross-project Knowledge Graph** with 17 deterministic edge types covering code, work-chain artifacts, knowledge-chain documents, cross-project references, and bridge edges. Canonical IDs follow `{prefix}:{kind}:{slug}`.
+- **Append-only audit log** (foreign-key + trigger enforced) with provenance pinned at the SQLite level. The managed **MarvisX** tier builds on it to cover the logging surface required by EU Regulation 2024/1689 (AI Act) Article 12.
+- **Brain reflection pipeline** in five layers — substrate, digest and journal, drift checker, memory operations, findings — closed by a Direction-Aware loop.
+- **Constitution-enforced safety rules** enforced by deterministic hook gates and an MCP mirror for providers without native hooks.
+- **Agent-native MCP surface** exposing 91 tools, callable identically from Claude Code, Codex, Gemini, OpenCode, and a web console.
+
+## Search and embedding quality
+
+Marvis defaults to **IBM Granite-Embedding-97m-Multilingual-R2** self-hosted via ONNX, blended with SQLite BM25 keyword search through Reciprocal Rank Fusion. Backend is selectable through `EMBEDDING_MODE`.
+
+This is a deliberate tradeoff: EU residency, self-hosting, and zero external embedding cost come at the cost of retrieval quality that is below commercial managed embedding providers. See [`docs/SEARCH-QUALITY.md`](docs/SEARCH-QUALITY.md) for the benchmark numbers, affected workflows, mitigations available today, and the Phase 2 fine-tune roadmap.
+
+## License posture
+
+- **Free to self-host and use internally**, including for commercial purposes. Code is **source-available** under the **Business Source License 1.1**; a paid license is required only to offer Marvis to third parties as a hosted or managed service. The change date automatically converts the code to **Apache License 2.0** four years after release.
+- Documentation and architectural patterns: **CC-BY 4.0**.
+
+This is open-core, not OSI open source: the core is free to run, read and fork, and the BSL holds back only competing commercial-as-a-service use until the change date. GitHub does not recognize the BSL and labels the repo `NOASSERTION`; the authoritative terms are in [`LICENSE`](LICENSE).
+
+## Architecture map
+
+The system groups capabilities into eight functional domains (`M1 Capture`, `M2 Index`, `M3 Retrieve`, `M4 Reflect`, `M5 Act`, `M6 Agent-native I/O`, `M7 Compliance`, `M8 Productization`). The Knowledge Graph stitches them together with canonical IDs and an audit chain.
+
+The full architectural description is the MarvisX preprint on Zenodo: [`10.5281/zenodo.20341860`](https://doi.org/10.5281/zenodo.20341860).
+
+## Repository layout
+
+```
+core/
+├── api/        # FastAPI service: KG, ingest, brain, MCP transport
+├── console/    # Next.js web console
+├── kb/         # Project-local knowledge base templates
+├── mcp-pir/    # MCP server (stdio) exposing the 91-tool surface
+└── scripts/    # Deployment, migration, and operational scripts
+
+deploy/
+└── _template/  # Reference deployment template
+                # (Docker Compose + environment scaffolding)
+```
+
+## Self-hosting the full stack
+
+The CLI above runs Marvis against a local SQLite database. To run the full Console + API stack yourself, use the reference Docker Compose deployment. Clone the repository, copy `deploy/_template/.env.example` to `.env`, populate the required secrets, and bring the stack up:
+
+```bash
+cp deploy/_template/.env.example deploy/_template/.env
+cd deploy/_template/
+docker compose up -d
+```
+
+The Console becomes available on the configured `CONSOLE_PORT` and the API on the configured `API_PORT`. Detailed first-run instructions are inside the deployment template.
+
+## MCP surface
+
+Marvis ships an MCP server exposing 91 tools across 11 categories: project and session context, tasks, handoffs, semantic search, learnings, costs, pull requests, knowledge graph queries, ingest triage, brain reflection layer, and audit-and-monitoring controls.
+
+The same surface is used by autonomous agents and by humans through the web console. The intent is parity: any action a user can take through the console, an agent can also take through MCP, and the reverse.
+
+## Single-user local runtime (`MARVIS_OSS_LOCAL`)
+
+The MCP server runs in-process: it calls the same use_cases the HTTP API calls, against the local SQLite database, with no uvicorn and no Node bridge. In this single-user mode there is no HTTP API in front of the database, so the HTTP audit chokepoint (which in the managed deployment forces every mutation through the API) does not exist.
+
+Audit is still recorded: the extracted use_cases write the audit log themselves (`core/api/use_cases/{tasks,pull_requests,audit}.py`), so a mutation issued through MCP still produces an audit row at the use_case level. What is lost is only the additional HTTP-surface chokepoint.
+
+Setting `MARVIS_OSS_LOCAL=1` (truthy: `1`/`true`/`yes`/`on`) makes the `block-db-direct-write` safety rule **advisory** — direct writes to a Marvis SQLite database are allowed with a warning instead of being blocked. When the variable is unset or falsey the rule is unchanged: direct DB writes are blocked fail-closed, exactly as in the managed deployment. This trade-off is intentional for single-user self-hosting and never weakens the default.
+
+**No-fork guarantee.** The HTTP API and the MCP server are not two implementations: both are thin adapters over the same `core/api/use_cases`, differing only in how they fill the per-call `CallerContext`. The proof is the API test suite staying green after the extraction — the same behaviour, exercised through the HTTP surface, over the identical use_cases the MCP server calls.
+
+## Telemetry
+
+Marvis can send anonymous, opt-in usage telemetry to help improve it: coarse event counts plus version and OS buckets, tied to a random install id (a plain UUID, never derived from your machine, user, or email). It never sends file content, project data, or personal information.
+
+Claude Code plugin installs are counted indirectly: GitHub traffic on the public mirror plus a `plugin_installed` event emitted by `/marvis:install` when telemetry is enabled. This deliberately undercounts because telemetry can be off and marketplace traffic is not a precise per-user install count.
+
+Control it at any time:
+
+```bash
+marvis telemetry on
+marvis telemetry off
+```
+
+Or per environment: `MARVIS_TELEMETRY=0`, the universal `DO_NOT_TRACK=1`, or `telemetry: false` in `~/.marvis/settings.yaml`. With `MARVIS_TELEMETRY=log`, Marvis prints exactly what it would send to stderr and transmits nothing.
+
+## Documentation
+
+- [`docs/SEARCH-QUALITY.md`](docs/SEARCH-QUALITY.md) — search quality expectations, affected workflows, and mitigations
+
+## Contributing
+
+Issues and bug reports are welcome through the repository tracker.
+
+## References
+
+- Preprint (Zenodo): [`10.5281/zenodo.20341860`](https://doi.org/10.5281/zenodo.20341860)
+- License (code): Business Source License 1.1, change date converts to Apache License 2.0 four years after release
+- License (documentation): CC-BY 4.0