nooa 0.0.7__tar.gz

nooa-0.0.7/.dockerignore

@@ -0,0 +1,119 @@
+# .dockerignore - Exclude files not needed in Docker images
+
+# Version control
+.git/
+.gitignore
+.gitattributes
+
+# CI/CD
+.gitlab-ci.yml
+.github/
+
+# Development and IDE
+.vscode/
+.idea/
+.cursor/
+.cursorrules
+.claude/
+*.swp
+*.swo
+CLAUDE.md
+
+# Python cache and build artifacts
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# Testing and coverage
+.pytest_cache/
+.coverage
+.coverage.*
+htmlcov/
+.tox/
+.nox/
+nosetests.xml
+coverage.xml
+*.cover
+.hypothesis/
+tests/
+test_*.py
+*_test.py
+
+# Documentation
+docs/
+*.md
+!README.md
+!**/README.md
+*.pdf
+journal/
+
+# Examples and experiments
+examples/
+experiments/
+scratch/
+
+# Results and traces
+results/
+traces/
+trace/
+tmp/
+*.jsonl
+*.noo-eval.jsonl
+*.006summary.json
+
+# Virtual environments and caches
+.venv/
+venv/
+env/
+ENV/
+.uv-cache/
+.ruff_cache/
+.mypy_cache/
+
+# Environment files (may contain secrets!)
+.env
+.env.*
+!.env.example
+!.env.template
+secrets.env
+local_config.yaml
+*.local.json
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# Logs
+*.log
+
+# Jupyter
+.ipynb_checkpoints
+*.ipynb
+
+# Temporal
+temporal/
+.temporal/
+
+# Specific large/unnecessary directories
+util/prompt-optimization/
+3P/
+3p/
+trash/
+debug_http_logs/
+
+# Keep important files (override any wildcards above)
+!pyproject.toml
+!uv.lock
+!requirements.txt

nooa-0.0.7/.env.example

@@ -0,0 +1,6 @@
+# LLM provider API key (set one or more)
+# OPENAI_API_KEY=<your key>
+# ANTHROPIC_API_KEY=<your key>
+
+# Prevent litellm from fetching model costs from GitHub (uses bundled local data)
+LITELLM_LOCAL_MODEL_COST_MAP=True

nooa-0.0.7/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,24 @@
+---
+name: Bug report
+about: Report a problem to help us improve
+title: "[Bug] "
+labels: bug
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To reproduce**
+Minimal steps or code to reproduce the behavior.
+
+**Expected behavior**
+What you expected to happen.
+
+**Environment**
+- OS:
+- Python version:
+- NOOA version (`nooa --version` or `python -c "import nooa; print(nooa.__version__)"`):
+- Model / provider:
+
+**Additional context**
+Logs, traces, or anything else relevant.

nooa-0.0.7/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,18 @@
+---
+name: Feature request
+about: Suggest an idea or enhancement
+title: "[Feature] "
+labels: enhancement
+---
+
+**What problem are you trying to solve?**
+A clear description of the use case or limitation.
+
+**Proposed solution**
+What you'd like to happen.
+
+**Alternatives considered**
+Other approaches you've thought about.
+
+**Additional context**
+Anything else that helps explain the request.

nooa-0.0.7/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,14 @@
+## What does this PR do?
+
+<!-- A clear, concise description of the change. -->
+
+## Related issues
+
+<!-- e.g. Closes #123 -->
+
+## Checklist
+
+- [ ] Code follows the project style (`uv run ruff check .` and `uv run ruff format --check .` pass)
+- [ ] Tests added/updated and passing (`uv run pytest`)
+- [ ] Docs updated if behavior or public APIs changed
+- [ ] New source files carry an SPDX license header

nooa-0.0.7/.github/workflows/ci.yml

@@ -0,0 +1,117 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+      - name: Sync
+        run: uv sync --all-extras --no-extra sandbox
+      - name: Ruff lint
+        run: uv run ruff check .
+      - name: Ruff format check
+        run: uv run ruff format --check .
+      - name: SPDX license headers
+        run: uv run python scripts/check_license_headers.py
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+      - name: Sync
+        run: uv sync --all-extras --no-extra sandbox
+      - name: Unit tests (no live API calls)
+        run: uv run pytest -q -m "not integration and not stress"
+
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # tags needed for uv-dynamic-versioning
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+      # Mirrors the publish workflow's build exactly (--no-sources included) so
+      # this job stays a real canary for release-build breakage.
+      - name: Build all packages
+        run: |
+          rm -rf dist
+          for pkg in nooa nooa-cli nooa-memory nooa-bench; do
+            uv build --no-sources --package "$pkg" --out-dir dist
+          done
+      - name: Upload wheels
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+          retention-days: 7
+
+  frontend-build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+      - name: Build the trace viewer
+        working-directory: src/nooa/viewer/frontend-react
+        run: |
+          npm ci --ignore-scripts
+          npm run build
+      - name: Fail if dist/ is stale
+        run: |
+          if ! git diff --quiet src/nooa/viewer/frontend-react/dist/; then
+            echo "ERROR: frontend-react/dist/ is stale. Run 'npm run build' and commit dist/."
+            git diff --stat src/nooa/viewer/frontend-react/dist/
+            exit 1
+          fi
+
+  secret-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # full history so the scan covers all commits
+      # Invokes the gitleaks binary directly rather than gitleaks/gitleaks-action.
+      # That action is not on this org's GitHub Actions allowlist, and a
+      # disallowed action fails the *entire workflow* at startup — which is why
+      # every CI run since 2026-07-21 was a 0-second `startup_failure` and no
+      # lint, test, or build job ran at all.
+      #
+      # Pinned to an exact version and checksum-verified: the binary is fetched
+      # at runtime, so an unpinned tag would be an unreviewed remote dependency.
+      - name: Gitleaks
+        env:
+          GITLEAKS_VERSION: 8.30.1
+          GITLEAKS_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
+        run: |
+          set -euo pipefail
+          curl -sSLo gitleaks.tar.gz \
+            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          echo "${GITLEAKS_SHA256}  gitleaks.tar.gz" | sha256sum -c -
+          tar xzf gitleaks.tar.gz gitleaks
+          # `gitleaks git` exits 0 with "no leaks found" when it has no history
+          # to read — a shallow clone scans 1 commit and passes vacuously, and a
+          # non-repo scans 0. Fail loudly instead of reporting a clean scan.
+          test "$(git rev-parse --is-inside-work-tree 2>/dev/null)" = "true" \
+            || { echo "::error::not a git checkout — gitleaks would pass vacuously"; exit 1; }
+          test "$(git rev-parse --is-shallow-repository)" = "false" \
+            || { echo "::error::shallow clone — gitleaks would miss history (need fetch-depth: 0)"; exit 1; }
+          ./gitleaks git --config .gitleaks.toml --redact --no-banner .

nooa-0.0.7/.github/workflows/publish.yml

@@ -0,0 +1,224 @@
+# Publishes the four workspace packages to PyPI.
+#
+# Trigger: a GitHub Release is *published* (the release's tag `vX.Y.Z` is what
+# uv-dynamic-versioning turns into the package version — see RELEASING.md).
+# Auth: PyPI Trusted Publishing (OIDC). No API tokens, no repo secrets.
+#
+# `workflow_dispatch` runs the same build against TestPyPI for a dry run.
+#
+# Every `uses:` here is an `actions/*` action, i.e. GitHub-created. That is
+# deliberate: this org enforces an Actions allowlist, and a disallowed action
+# fails the *entire workflow* at startup (see PR #50 — one blocked action left
+# CI dead for 8 days). A publish workflow that cannot start is a publish
+# workflow that silently never ships. uv is installed from a pinned, versioned
+# install script and does the upload itself via `uv publish`.
+name: Publish
+
+on:
+  release:
+    types: [published]
+  # Manual runs are ALWAYS a TestPyPI dry run. There is deliberately no input
+  # to select the index: real PyPI is reachable only by publishing a GitHub
+  # Release, so a mis-click here cannot burn a version number on PyPI.
+  workflow_dispatch:
+
+permissions: {}
+
+env:
+  # Pinned: the install script is fetched at runtime, so an unversioned URL
+  # would make every run depend on whatever uv ships that day.
+  UV_VERSION: "0.11.4"
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # tags needed for uv-dynamic-versioning
+
+      - name: Install uv
+        run: |
+          set -euo pipefail
+          curl -LsSf "https://astral.sh/uv/${UV_VERSION}/install.sh" | sh
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
+      # --no-sources: build with `tool.uv.sources` disabled, so the build is
+      # exercised the way a non-uv consumer's build backend would see it. Without
+      # it, a workspace source could paper over a dependency that is unresolvable
+      # off this machine. Recommended by
+      # https://docs.astral.sh/uv/guides/package/
+      - name: Build all packages
+        run: |
+          rm -rf dist
+          for pkg in nooa nooa-cli nooa-memory nooa-bench; do
+            uv build --no-sources --package "$pkg" --out-dir dist
+          done
+          ls -l dist
+
+      # Guards the two ways a release can silently ship the wrong version:
+      # a shallow checkout (no tag reachable -> `.devN`), or a Release created
+      # from a commit that is not the tagged one.
+      - name: Check built version matches the release tag
+        if: github.event_name == 'release'
+        env:
+          TAG: ${{ github.event.release.tag_name }}
+        run: |
+          uv run --no-project --with packaging python - <<'PY'
+          import os, pathlib, sys
+          from packaging.utils import parse_wheel_filename
+          from packaging.version import Version
+
+          expected = Version(os.environ["TAG"].removeprefix("v"))
+          wheels = sorted(pathlib.Path("dist").glob("*.whl"))
+          assert len(wheels) == 4, f"expected 4 wheels, got {[w.name for w in wheels]}"
+          for whl in wheels:
+              _, version, _, _ = parse_wheel_filename(whl.name)
+              if version.is_devrelease:
+                  sys.exit(f"{whl.name}: dev version — the tag is not reachable from HEAD")
+              if version != expected:
+                  sys.exit(f"{whl.name}: built {version}, but the tag says {expected}")
+          print(f"OK — all four packages built as {expected}")
+          PY
+
+      # Catches a broken wheel before it is on PyPI forever.
+      - name: Smoke-test the wheels in a clean environment
+        run: |
+          uv venv /tmp/smoke --python 3.12
+          VIRTUAL_ENV=/tmp/smoke uv pip install \
+            dist/nooa-*.whl dist/nooa_cli-*.whl dist/nooa_memory-*.whl dist/nooa_bench-*.whl
+          /tmp/smoke/bin/python -c "import nooa, nooa_cli, nooa_memory, nooa_bench; print(nooa.__version__)"
+          /tmp/smoke/bin/nooa --version
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  # One job per package, each in its OWN environment (`pypi-<package>`).
+  #
+  # PyPI keys a *pending* trusted publisher on
+  # (owner, repo, workflow filename, environment). Four packages sharing one
+  # environment collide: PyPI rejects the 2nd registration with "a pending
+  # trusted publisher matching this configuration has already been registered
+  # for a different project name", because it cannot tell which project to
+  # create on first upload. A distinct environment per package makes each
+  # tuple unique. (The constraint applies only while a publisher is pending —
+  # but a distinct environment is also what gives per-package approval gates.)
+  publish-testpypi:
+    needs: build
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false  # a partial publish is recoverable; a cancelled one is messier
+      matrix:
+        package: [nooa, nooa-cli, nooa-memory, nooa-bench]
+    environment:
+      name: testpypi-${{ matrix.package }}
+      url: https://test.pypi.org/p/${{ matrix.package }}
+    permissions:
+      id-token: write  # required for Trusted Publishing
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      # Upload only this package's files. Distribution filenames normalise `-`
+      # to `_`, and the glob anchors on the `-` before the version, so
+      # `nooa-*` matches nooa's own files and never `nooa_cli-*`.
+      - name: Isolate this package's artifacts
+        env:
+          PKG: ${{ matrix.package }}
+        run: |
+          set -euo pipefail
+          mkdir upload
+          cp dist/"${PKG//-/_}"-* upload/
+          test "$(ls upload | wc -l)" -eq 2  # exactly one wheel + one sdist
+          ls -l upload
+      - name: Install uv
+        run: |
+          set -euo pipefail
+          curl -LsSf "https://astral.sh/uv/${UV_VERSION}/install.sh" | sh
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+      # --trusted-publishing always: never silently fall back to looking for a
+      # token if the OIDC exchange fails. Fail instead, so a broken publisher
+      # config surfaces as an error rather than an auth prompt.
+      - name: Publish to TestPyPI
+        run: |
+          uv publish --trusted-publishing always \
+            --publish-url https://test.pypi.org/legacy/ \
+            --check-url https://test.pypi.org/simple/ \
+            upload/*
+
+  publish-pypi:
+    needs: build
+    # Real PyPI is reachable ONLY from a published GitHub Release.
+    if: github.event_name == 'release'
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        package: [nooa, nooa-cli, nooa-memory, nooa-bench]
+    environment:
+      name: pypi-${{ matrix.package }}
+      url: https://pypi.org/p/${{ matrix.package }}
+    permissions:
+      id-token: write  # required for Trusted Publishing
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      # Upload only this package's files. Distribution filenames normalise `-`
+      # to `_`, and the glob anchors on the `-` before the version, so
+      # `nooa-*` matches nooa's own files and never `nooa_cli-*`.
+      - name: Isolate this package's artifacts
+        env:
+          PKG: ${{ matrix.package }}
+        run: |
+          set -euo pipefail
+          mkdir upload
+          cp dist/"${PKG//-/_}"-* upload/
+          test "$(ls upload | wc -l)" -eq 2  # exactly one wheel + one sdist
+          ls -l upload
+      - name: Install uv
+        run: |
+          set -euo pipefail
+          curl -LsSf "https://astral.sh/uv/${UV_VERSION}/install.sh" | sh
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+      # --trusted-publishing always: never silently fall back to looking for a
+      # token if the OIDC exchange fails. Fail instead, so a broken publisher
+      # config surfaces as an error rather than an auth prompt.
+      #
+      # --check-url makes a re-run idempotent: already-uploaded files are
+      # skipped rather than erroring. Matters because `fail-fast: false` means
+      # a partial publish is a state you can land in and need to resume from.
+      - name: Publish to PyPI
+        run: |
+          uv publish --trusted-publishing always \
+            --check-url https://pypi.org/simple/ \
+            upload/*
+
+  # Attach the built wheels to the GitHub Release so `pip install <url>` and
+  # air-gapped consumers get the exact artifacts that went to PyPI.
+  attach-to-release:
+    needs: publish-pypi
+    if: github.event_name == 'release'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      # The tag name goes through `env:`, not `${{ }}` inside the script.
+      # GitHub expands `${{ }}` textually *before* bash parses the line, so a
+      # tag containing `$(...)` or backticks would execute — double quotes do
+      # not help, because the substitution happens before quoting is applied.
+      # This job holds `contents: write`. Via env, bash sees the value as data.
+      - name: Attach artifacts to the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: gh release upload "$RELEASE_TAG" dist/* --repo "$GITHUB_REPOSITORY"