nasde-toolkit 0.3.2__py3-none-any.whl

nasde_toolkit/_version.py

@@ -0,0 +1,24 @@
+# file generated by vcs-versioning
+# don't change, don't track in version control
+from __future__ import annotations
+
+__all__ = [
+    "__version__",
+    "__version_tuple__",
+    "version",
+    "version_tuple",
+    "__commit_id__",
+    "commit_id",
+]
+
+version: str
+__version__: str
+__version_tuple__: tuple[int | str, ...]
+version_tuple: tuple[int | str, ...]
+commit_id: str | None
+__commit_id__: str | None
+
+__version__ = version = '0.3.2'
+__version_tuple__ = version_tuple = (0, 3, 2)
+
+__commit_id__ = commit_id = None

nasde_toolkit/agents/__init__.py

@@ -0,0 +1 @@
+"""Harbor agent implementations for nasde."""

nasde_toolkit/agents/configurable_claude.py

@@ -0,0 +1,121 @@
+"""Configurable Claude Code agent for Harbor evaluations.
+
+Harbor's built-in ClaudeCode agent handles MCP servers declared in the JSON
+config and reads authentication credentials from the environment natively.
+However, it has no mechanism to inject arbitrary files (e.g. CLAUDE.md) into
+the sandbox before the agent starts.
+
+ConfigurableClaude fills that single gap: it accepts a sandbox_files mapping
+via AgentConfig.kwargs and uploads each file into the container during setup().
+Everything else (auth, MCP servers, model selection) stays in the JSON config.
+
+Usage in harbor_config.json::
+
+    {
+      "agents": [{
+        "import_path": "nasde_toolkit.agents.configurable_claude:ConfigurableClaude",
+        "model_name": "claude-sonnet-4-6",
+        "kwargs": {
+          "sandbox_files": {
+            "/app/CLAUDE.md": "path/to/CLAUDE.md"
+          }
+        }
+      }]
+    }
+"""
+
+from __future__ import annotations
+
+import logging
+from pathlib import Path
+from typing import Any
+
+from harbor.agents.installed.claude_code import ClaudeCode
+from harbor.environments.base import BaseEnvironment
+
+logger = logging.getLogger(__name__)
+
+_DNS_FIX_COMMAND = (
+    "timeout 5 getent hosts claude.ai >/dev/null 2>&1"
+    " || printf 'nameserver 8.8.8.8\\nnameserver 1.1.1.1\\n' > /etc/resolv.conf"
+)
+
+
+class ConfigurableClaude(ClaudeCode):
+    """ClaudeCode with declarative file injection into the sandbox.
+
+    Args:
+        sandbox_files: Mapping of container paths to host-relative file paths.
+            Each entry is uploaded into the sandbox during setup() before
+            the agent starts. Paths are resolved relative to CWD.
+    """
+
+    def __init__(
+        self,
+        sandbox_files: dict[str, str] | None = None,
+        *args: Any,
+        **kwargs: Any,
+    ) -> None:
+        super().__init__(*args, **kwargs)
+        self._sandbox_files = sandbox_files or {}
+
+    @staticmethod
+    def name() -> str:
+        return "configurable-claude-code"
+
+    async def setup(self, environment: BaseEnvironment) -> None:
+        """Fix cloud DNS, upload files, then run base setup.
+
+        Files must be uploaded BEFORE super().setup() because Harbor's
+        ClaudeCode.setup() copies skills from ~/.claude/skills/ into
+        the Claude config directory. Our sandbox_files that target
+        ~/.claude/skills/ need to be in place before that copy happens.
+        """
+        await self._ensure_dns_resolution(environment)
+        await self._upload_sandbox_files(environment)
+        await super().setup(environment)
+
+    async def _ensure_dns_resolution(self, environment: BaseEnvironment) -> None:
+        """Prepend 1.1.1.1 to resolv.conf if missing.
+
+        Daytona cloud sandboxes may land on runners whose DNS resolvers
+        cannot reach whitelisted domains (e.g. claude.ai).  Prepending
+        Cloudflare's public resolver fixes this without affecting local
+        Docker environments (Docker regenerates resolv.conf on start).
+        """
+        result = await environment.exec(command=_DNS_FIX_COMMAND)
+        if result.return_code == 0:
+            logger.debug("DNS resolution fix applied")
+        else:
+            logger.warning("DNS resolution fix failed: %s", result.stderr)
+
+    async def _upload_sandbox_files(self, environment: BaseEnvironment) -> None:
+        for target_path, source_path in self._sandbox_files.items():
+            resolved = Path(source_path).resolve()
+            if not resolved.is_file():
+                raise FileNotFoundError(
+                    f"sandbox_files: source '{source_path}' (resolved to '{resolved}') does not exist"
+                )
+            upload_targets = _expand_skill_targets(target_path)
+            for upload_path in upload_targets:
+                parent_dir = str(Path(upload_path).parent)
+                await environment.exec(command=f"mkdir -p {parent_dir}")
+                await environment.upload_file(
+                    source_path=resolved,
+                    target_path=upload_path,
+                )
+
+
+def _expand_skill_targets(target_path: str) -> list[str]:
+    """Expand a skill target path to include both /app/ and ~/.claude/ locations.
+
+    Harbor's ClaudeCode.setup() copies skills from ~/.claude/skills/ into
+    its internal config directory. Skills placed only under /app/.claude/
+    won't be discovered. This ensures skills are available in both locations.
+    """
+    app_skills_prefix = "/app/.claude/skills/"
+    if target_path.startswith(app_skills_prefix):
+        relative = target_path[len(app_skills_prefix) :]
+        home_path = f"/root/.claude/skills/{relative}"
+        return [target_path, home_path]
+    return [target_path]

nasde_toolkit/agents/configurable_codex.py

@@ -0,0 +1,101 @@
+"""Configurable Codex agent for Harbor evaluations.
+
+Harbor's built-in Codex agent handles CLI installation, command construction,
+token/trajectory parsing, and — since harbor 0.4 — ChatGPT OAuth auth.json
+injection natively (via ``~/.codex/auth.json`` or ``CODEX_AUTH_JSON_PATH``).
+
+``ConfigurableCodex`` fills two remaining gaps:
+
+1. A ``sandbox_files`` mapping (via ``AgentConfig.kwargs``) that uploads
+   arbitrary files (e.g. ``AGENTS.md``) into the container during ``setup()``.
+2. A DNS-resolver fallback for cloud sandboxes whose default resolver cannot
+   reach ``api.openai.com``.
+
+Everything else (auth, model selection, reasoning effort) stays in Harbor.
+
+Usage in harbor_config.json::
+
+    {
+      "agents": [{
+        "import_path": "nasde_toolkit.agents.configurable_codex:ConfigurableCodex",
+        "model_name": "o3",
+        "kwargs": {
+          "sandbox_files": {
+            "/app/AGENTS.md": "path/to/AGENTS.md"
+          }
+        }
+      }]
+    }
+"""
+
+from __future__ import annotations
+
+import logging
+from pathlib import Path
+from typing import Any
+
+from harbor.agents.installed.codex import Codex
+from harbor.environments.base import BaseEnvironment
+
+logger = logging.getLogger(__name__)
+
+_DNS_FIX_COMMAND = (
+    "timeout 5 getent hosts api.openai.com >/dev/null 2>&1"
+    " || printf 'nameserver 8.8.8.8\\nnameserver 1.1.1.1\\n' > /etc/resolv.conf"
+)
+
+
+class ConfigurableCodex(Codex):
+    """Codex with declarative file injection into the sandbox.
+
+    Args:
+        sandbox_files: Mapping of container paths to host-relative file paths.
+            Each entry is uploaded into the sandbox during setup() before
+            the agent starts. Paths are resolved relative to CWD.
+    """
+
+    def __init__(
+        self,
+        sandbox_files: dict[str, str] | None = None,
+        *args: Any,
+        **kwargs: Any,
+    ) -> None:
+        super().__init__(*args, **kwargs)
+        self._sandbox_files = sandbox_files or {}
+
+    @staticmethod
+    def name() -> str:
+        return "configurable-codex"
+
+    async def setup(self, environment: BaseEnvironment) -> None:
+        """Fix cloud DNS, run base setup, then upload configured files."""
+        await self._ensure_dns_resolution(environment)
+        await super().setup(environment)
+        await self._upload_sandbox_files(environment)
+
+    async def _ensure_dns_resolution(self, environment: BaseEnvironment) -> None:
+        """Prepend public DNS resolvers if cloud sandbox cannot reach OpenAI.
+
+        Cloud sandboxes (Daytona, Modal, etc.) may land on runners whose DNS
+        resolvers cannot reach whitelisted domains.  Prepending Google/Cloudflare
+        public resolvers fixes this without affecting local Docker environments.
+        """
+        result = await environment.exec(command=_DNS_FIX_COMMAND)
+        if result.return_code == 0:
+            logger.debug("DNS resolution fix applied")
+        else:
+            logger.warning("DNS resolution fix failed: %s", result.stderr)
+
+    async def _upload_sandbox_files(self, environment: BaseEnvironment) -> None:
+        for target_path, source_path in self._sandbox_files.items():
+            resolved = Path(source_path).resolve()
+            if not resolved.is_file():
+                raise FileNotFoundError(
+                    f"sandbox_files: source '{source_path}' (resolved to '{resolved}') does not exist"
+                )
+            parent_dir = str(Path(target_path).parent)
+            await environment.exec(command=f"mkdir -p {parent_dir}")
+            await environment.upload_file(
+                source_path=resolved,
+                target_path=target_path,
+            )

nasde_toolkit/agents/configurable_gemini.py

@@ -0,0 +1,194 @@
+"""Configurable Gemini CLI agent for Harbor evaluations.
+
+Harbor's built-in GeminiCli agent handles CLI installation, command construction,
+trajectory parsing, and MCP server configuration natively.  However, it has no
+mechanism to inject arbitrary files (e.g. GEMINI.md, skills) into the sandbox
+before the agent starts.
+
+ConfigurableGemini fills that gap: it accepts a sandbox_files mapping via
+AgentConfig.kwargs and uploads each file into the container during setup().
+
+Additionally, when the user has authenticated via ``gemini login`` (Google
+account), ConfigurableGemini auto-detects ``~/.gemini/oauth_creds.json`` and
+injects the credentials into the sandbox — allowing benchmarks to run on a
+Google account instead of requiring a ``GEMINI_API_KEY``.  API key env vars
+always take priority over OAuth.
+
+Usage in harbor_config.json::
+
+    {
+      "agents": [{
+        "import_path": "nasde_toolkit.agents.configurable_gemini:ConfigurableGemini",
+        "model_name": "google/gemini-3-flash-preview",
+        "kwargs": {
+          "sandbox_files": {
+            "/app/GEMINI.md": "path/to/GEMINI.md"
+          }
+        }
+      }]
+    }
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+from pathlib import Path
+from typing import Any
+
+from harbor.agents.installed.gemini_cli import GeminiCli
+from harbor.environments.base import BaseEnvironment
+
+logger = logging.getLogger(__name__)
+
+_DNS_FIX_COMMAND = (
+    "timeout 5 getent hosts generativelanguage.googleapis.com >/dev/null 2>&1"
+    " || printf 'nameserver 8.8.8.8\\nnameserver 1.1.1.1\\n' > /etc/resolv.conf"
+)
+
+_API_KEY_VARS = ("GEMINI_API_KEY", "GOOGLE_API_KEY", "GOOGLE_APPLICATION_CREDENTIALS")
+
+
+def _read_gemini_oauth_creds() -> str | None:
+    """Return serialised ``~/.gemini/oauth_creds.json`` when it holds OAuth tokens."""
+    creds_path = Path.home() / ".gemini" / "oauth_creds.json"
+    if not creds_path.exists():
+        return None
+    try:
+        raw = json.loads(creds_path.read_text())
+    except (json.JSONDecodeError, OSError):
+        return None
+    if not raw:
+        return None
+    return json.dumps(raw)
+
+
+async def _write_oauth_to_sandbox(environment: BaseEnvironment, oauth_creds_json: str) -> None:
+    """Write OAuth credentials and auth settings into the sandbox.
+
+    Gemini CLI requires both:
+    1. ``~/.gemini/oauth_creds.json`` — the actual OAuth tokens
+    2. ``~/.gemini/settings.json`` — with ``security.auth.selectedType`` set
+       to ``"oauth-personal"`` so the CLI knows which auth method to use.
+
+    This runs AFTER Harbor's setup which creates a minimal settings.json.
+    We merge our auth config into it rather than overwriting.
+    """
+    import tempfile
+
+    with tempfile.NamedTemporaryFile(mode="w", suffix=".json", delete=False) as f:
+        f.write(oauth_creds_json)
+        tmp_creds = Path(f.name)
+
+    settings_json = json.dumps(
+        {
+            "experimental": {"skills": True},
+            "security": {"auth": {"selectedType": "oauth-personal"}},
+        },
+        indent=2,
+    )
+    with tempfile.NamedTemporaryFile(mode="w", suffix=".json", delete=False) as f:
+        f.write(settings_json)
+        tmp_settings = Path(f.name)
+
+    try:
+        await environment.exec(command="mkdir -p /root/.gemini")
+        await environment.upload_file(source_path=tmp_creds, target_path="/root/.gemini/oauth_creds.json")
+        await environment.upload_file(source_path=tmp_settings, target_path="/root/.gemini/settings.json")
+    finally:
+        tmp_creds.unlink(missing_ok=True)
+        tmp_settings.unlink(missing_ok=True)
+
+
+class ConfigurableGemini(GeminiCli):
+    """GeminiCli with declarative file injection into the sandbox.
+
+    Args:
+        sandbox_files: Mapping of container paths to host-relative file paths.
+            Each entry is uploaded into the sandbox during setup() before
+            the agent starts. Paths are resolved relative to CWD.
+    """
+
+    def __init__(
+        self,
+        sandbox_files: dict[str, str] | None = None,
+        *args: Any,
+        **kwargs: Any,
+    ) -> None:
+        super().__init__(*args, **kwargs)
+        self._sandbox_files = sandbox_files or {}
+
+    @staticmethod
+    def name() -> str:
+        return "configurable-gemini-cli"
+
+    async def setup(self, environment: BaseEnvironment) -> None:
+        """Fix cloud DNS, upload files, run base setup, then inject OAuth.
+
+        Order matters:
+        1. DNS fix — cloud sandboxes may not resolve Google APIs
+        2. Upload sandbox files — skills must be in place before Harbor
+           discovers them during setup
+        3. super().setup() — Harbor installs Gemini CLI and writes a
+           minimal ~/.gemini/settings.json (with experimental.skills)
+        4. OAuth injection — AFTER super().setup() because Harbor's install
+           script overwrites ~/.gemini/settings.json.  We merge our auth
+           config into the file that Harbor created.
+        """
+        await self._ensure_dns_resolution(environment)
+        await self._upload_sandbox_files(environment)
+        await super().setup(environment)
+        await self._inject_oauth_if_needed(environment)
+
+    async def _inject_oauth_if_needed(self, environment: BaseEnvironment) -> None:
+        """Write OAuth creds and update settings.json in the sandbox after setup."""
+        has_api_key = any(os.environ.get(var) for var in _API_KEY_VARS)
+        if has_api_key:
+            return
+
+        oauth_creds_json = _read_gemini_oauth_creds()
+        if not oauth_creds_json:
+            return
+
+        logger.info("Injecting Gemini OAuth credentials into sandbox")
+        await _write_oauth_to_sandbox(environment, oauth_creds_json)
+        logger.info("Gemini OAuth injection complete")
+
+    async def _ensure_dns_resolution(self, environment: BaseEnvironment) -> None:
+        """Prepend public DNS resolvers if cloud sandbox cannot reach Google APIs."""
+        result = await environment.exec(command=_DNS_FIX_COMMAND)
+        if result.return_code == 0:
+            logger.debug("DNS resolution fix applied")
+        else:
+            logger.warning("DNS resolution fix failed: %s", result.stderr)
+
+    async def _upload_sandbox_files(self, environment: BaseEnvironment) -> None:
+        for target_path, source_path in self._sandbox_files.items():
+            resolved = Path(source_path).resolve()
+            if not resolved.is_file():
+                raise FileNotFoundError(
+                    f"sandbox_files: source '{source_path}' (resolved to '{resolved}') does not exist"
+                )
+            upload_targets = _expand_skill_targets(target_path)
+            for upload_path in upload_targets:
+                parent_dir = str(Path(upload_path).parent)
+                await environment.exec(command=f"mkdir -p {parent_dir}")
+                await environment.upload_file(
+                    source_path=resolved,
+                    target_path=upload_path,
+                )
+
+
+def _expand_skill_targets(target_path: str) -> list[str]:
+    """Expand a skill target path to include both /app/ and ~/.gemini/ locations.
+
+    Gemini CLI discovers skills in both workspace (.gemini/skills/) and user
+    (~/.gemini/skills/) directories.  This ensures skills are available in both.
+    """
+    app_skills_prefix = "/app/.gemini/skills/"
+    if target_path.startswith(app_skills_prefix):
+        relative = target_path[len(app_skills_prefix) :]
+        home_path = f"/root/.gemini/skills/{relative}"
+        return [target_path, home_path]
+    return [target_path]

nasde_toolkit/banner.py

@@ -0,0 +1,82 @@
+"""ASCII art banner for nasde CLI with Noesis brand colors."""
+
+from __future__ import annotations
+
+from rich.console import Console
+from rich.text import Text
+
+from nasde_toolkit import __version__
+
+GREEN = "#1B5E20"
+GREEN_LIGHT = "#2E7D32"
+BLUE = "#1565C0"
+BLUE_LIGHT = "#1E88E5"
+ACCENT = "#4CAF50"
+
+_INDENT = "  "
+_LOGO_LINES = [
+    f"{_INDENT}                         __",
+    f"{_INDENT}   ____  ____ _________ / /__",
+    f"{_INDENT}  / __ \\/ __ `/ ___/ __  / _ \\",
+    f"{_INDENT} / / / / /_/ (__  ) /_/ /  __/",
+    f"{_INDENT}/_/ /_/\\__,_/____/\\__,_/\\___/",
+]
+
+_LINE_STYLES: list[list[tuple[str, str]]] = [
+    [(GREEN, "full")],
+    [(GREEN, "full")],
+    [(GREEN_LIGHT, "full")],
+    [(BLUE, "full")],
+    [(BLUE_LIGHT, "full")],
+]
+
+
+def _render_logo() -> Text:
+    text = Text()
+    for i, line in enumerate(_LOGO_LINES):
+        color = _LINE_STYLES[i][0][0]
+        text.append(line, style=f"bold {color}")
+        if i < len(_LOGO_LINES) - 1:
+            text.append("\n")
+    return text
+
+
+def _render_tagline() -> Text:
+    text = Text()
+    text.append(f"{_INDENT}Noesis ", style=f"bold {GREEN}")
+    text.append("Agentic Software Development Evals", style=f"{BLUE_LIGHT}")
+    return text
+
+
+def _render_version_line() -> Text:
+    text = Text()
+    text.append(f"{_INDENT}v{__version__}", style=f"bold {ACCENT}")
+    return text
+
+
+_banner_suppressed = False
+
+
+def suppress_banner() -> None:
+    global _banner_suppressed  # noqa: PLW0603
+    _banner_suppressed = True
+
+
+def is_banner_suppressed() -> bool:
+    if _banner_suppressed:
+        return True
+    import os
+
+    return os.environ.get("NASDE_NO_BANNER", "").strip() not in ("", "0", "false")
+
+
+def print_banner(console: Console | None = None) -> None:
+    if is_banner_suppressed():
+        return
+    c = console or Console()
+    c.print()
+    c.print(_render_logo())
+    c.print()
+    c.print(_render_tagline())
+    c.print(_render_version_line())
+    c.print()