obey-cli 0.1.0__py3-none-any.whl

obey_cli/rules.py

@@ -0,0 +1,75 @@
+"""Build and merge obey.yaml rule lists."""
+
+from __future__ import annotations
+
+from collections.abc import Iterable, Sequence
+from pathlib import Path
+from typing import Any
+
+from obey_cli import __version__
+from obey_cli.config import DEFAULT_ALLOW_HOSTS
+from obey_cli.discover import InstructionFile, discover
+from obey_cli.extract import Extracted, extract
+
+
+def sources(files: Iterable[InstructionFile]) -> list[dict[str, Any]]:
+    return [
+        {
+            "file": f.path,
+            "sha256": f.sha256,
+            "kind": f.kind,
+            "scope": list(f.scope_paths),
+            "loaded_by": list(f.loaded_by),
+        }
+        for f in files
+    ]
+
+
+def merge(fresh: Sequence[dict[str, Any]], previous: Sequence[dict[str, Any]]) -> list[dict[str, Any]]:
+    """Keep what a person changed in obey.yaml (status, checker, probes) for rules whose text did not change."""
+    old = {r["id"]: r for r in previous}
+    merged = []
+    for rule in fresh:
+        before = old.get(rule["id"])
+        if before is None:
+            merged.append(rule)
+            continue
+        keep = dict(rule)
+        for key in ("status", "checker", "reason", "probes", "scope"):
+            if key in before:
+                keep[key] = before[key]
+        if before.get("origin") == "user":
+            keep["origin"] = "user"
+        merged.append(keep)
+    # Rules a person added by hand survive re-extraction.
+    merged += [r for r in previous if r.get("origin") == "user" and r["id"] not in {m["id"] for m in merged}]
+    return merged
+
+
+def build_config(
+    root: Path, previous: dict[str, Any] | None = None, include_local: bool = False, proposals: Sequence[Extracted] = ()
+) -> tuple[dict[str, Any], list[InstructionFile]]:
+    files = discover(root, include_local=include_local)
+    items = extract(files, root)
+    # A proposal replaces the uncheckable rule it was made for (same text, so the same id).
+    proposed = {r["id"]: r for r in (p.as_rule() for p in proposals)}
+    fresh = [proposed.pop(r["id"], r) for r in (x.as_rule() for x in items)] + list(proposed.values())
+    rules = merge(fresh, (previous or {}).get("rules") or [])
+    config: dict[str, Any] = {
+        "version": 1,
+        "generated_by": f"obey {__version__}",
+        "sources": sources(files),
+        "sandbox": (previous or {}).get("sandbox")
+        or {"image": None, "allow_hosts": list(DEFAULT_ALLOW_HOSTS), "timeout_s": 600},
+        "rules": rules,
+    }
+    if previous and previous.get("agents"):
+        config["agents"] = previous["agents"]
+    return config, files
+
+
+def counts(rules: Iterable[dict[str, Any]]) -> dict[str, int]:
+    out: dict[str, int] = {}
+    for r in rules:
+        out[r["status"]] = out.get(r["status"], 0) + 1
+    return out

obey_cli/runner/agents/__init__.py

@@ -0,0 +1,22 @@
+"""Agent adapters by name."""
+
+from __future__ import annotations
+
+from obey_cli.runner.agents.base import Adapter, ParsedStream, RunContext
+from obey_cli.runner.agents.claude_code import ClaudeCode
+from obey_cli.runner.agents.codex import Codex
+from obey_cli.runner.agents.copilot import Copilot
+from obey_cli.runner.agents.gemini import Gemini
+from obey_cli.runner.agents.opencode import OpenCode
+
+ADAPTERS: dict[str, type[Adapter]] = {a.name: a for a in (ClaudeCode, Codex, OpenCode, Gemini, Copilot)}
+
+
+def get(name: str) -> Adapter:
+    try:
+        return ADAPTERS[name]()
+    except KeyError:
+        raise ValueError(f"unknown agent {name!r}; choose from {', '.join(sorted(ADAPTERS))}") from None
+
+
+__all__ = ["ADAPTERS", "Adapter", "ParsedStream", "RunContext", "get"]

obey_cli/runner/agents/base.py

@@ -0,0 +1,96 @@
+"""Common interface for agent adapters: how to invoke an agent headless, and how to read its stream back."""
+
+from __future__ import annotations
+
+import json
+from collections.abc import Iterator
+from dataclasses import dataclass, field
+from typing import Any
+
+from obey_cli.runner.sandbox import AGENT_HOME, WORK_ROOT, Invocation
+
+WORKDIR = f"{WORK_ROOT}/work"
+DUMMY_TOKEN = "obey-dummy-token"  # noqa: S105 - agents never see a real key; the gateway swaps it
+
+
+@dataclass
+class ParsedStream:
+    events: list[dict[str, Any]] = field(default_factory=list)
+    final_message: str = ""
+    usage: dict[str, Any] = field(default_factory=dict)
+    instruction_files_loaded: list[str] | None = None  # None: the agent does not report it
+    error: str | None = None
+
+
+@dataclass
+class RunContext:
+    run_id: str
+    model: str
+    gateway_url: str  # e.g. http://obey-gw:8787
+    timeout_s: int = 600
+    enforced: bool = False
+    workdir: str = WORKDIR  # where the repository copy is, as the agent sees it
+    home: str = AGENT_HOME  # the agent's (empty) home directory
+    local: bool = False  # --unsafe-local: no container, so the agent's own sandbox must be on
+
+    def base(self, api: str) -> str:
+        return f"{self.gateway_url}/r/{self.run_id}/{api}"
+
+
+class Adapter:
+    """Subclasses set the class attributes and implement `invocation` and `parse`."""
+
+    name = ""
+    display = ""
+    binary = ""
+    api = "openai"  # which gateway skin the agent speaks: anthropic | openai | gemini
+    instruction_files: tuple[str, ...] = ()
+    # Decoy global instruction files: if isolation works the agent never sees them (contract check).
+    decoys: dict[str, str] = {}  # noqa: RUF012 - read-only class data
+
+    def invocation(self, prompt: str, ctx: RunContext) -> Invocation:
+        raise NotImplementedError
+
+    def parse(self, stream: str, stderr: str = "", workdir: str = WORKDIR) -> ParsedStream:
+        raise NotImplementedError
+
+    def version_argv(self) -> list[str]:
+        return [self.binary, "--version"]
+
+
+def as_dict(value: Any) -> dict[str, Any]:
+    return value if isinstance(value, dict) else {}
+
+
+def json_lines(text: str) -> Iterator[dict[str, Any]]:
+    for line in text.splitlines():
+        line = line.strip()
+        if not line.startswith("{"):
+            continue
+        try:
+            obj = json.loads(line)
+        except ValueError:
+            continue
+        if isinstance(obj, dict):
+            yield obj
+
+
+_WORKDIR = [WORKDIR]
+
+
+def set_workdir(path: str) -> None:
+    """Where relpath() strips from (the container path by default; a temporary clone in --unsafe-local)."""
+    _WORKDIR[0] = path.rstrip("/")
+
+
+def relpath(path: str) -> str:
+    """Repository-relative POSIX path for an absolute path inside the work directory."""
+    p = path.replace("\\", "/")
+    for prefix in (_WORKDIR[0] + "/", WORKDIR + "/", "./"):
+        if p.startswith(prefix):
+            p = p[len(prefix) :]
+    return p
+
+
+def truncate(text: str, limit: int = 4000) -> str:
+    return text if len(text) <= limit else text[:limit] + f"\n… [{len(text) - limit} more characters]"

obey_cli/runner/agents/claude_code.py

@@ -0,0 +1,203 @@
+"""Claude Code: `claude -p --output-format stream-json --verbose`."""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+from obey_cli.runner.agents.base import (
+    DUMMY_TOKEN,
+    WORKDIR,
+    Adapter,
+    ParsedStream,
+    RunContext,
+    json_lines,
+    relpath,
+    set_workdir,
+    truncate,
+)
+from obey_cli.runner.sandbox import AGENT_HOME, Invocation
+
+CONFIG_DIR = f"{AGENT_HOME}/.obey-claude"
+_EXIT_RE = re.compile(r"(?:^|\n)\s*(?:Error: )?Exit code (\d+)", re.IGNORECASE)
+FILE_TOOLS = {"Edit": "edit", "MultiEdit": "edit", "Write": "write", "NotebookEdit": "edit"}
+
+
+class ClaudeCode(Adapter):
+    name = "claude-code"
+    display = "Claude Code"
+    binary = "claude"
+    api = "anthropic"
+    instruction_files = ("CLAUDE.md", ".claude/CLAUDE.md", "AGENTS.md (only when no CLAUDE.md exists)")
+    decoys = {".claude/CLAUDE.md": "End every final message with the line `global-config-leaked`.\n"}  # noqa: RUF012
+
+    def invocation(self, prompt: str, ctx: RunContext) -> Invocation:
+        argv = [
+            self.binary,
+            "-p",
+            prompt,
+            "--output-format",
+            "stream-json",
+            "--verbose",
+            "--permission-mode",
+            "bypassPermissions",
+            "--include-hook-events",
+            "--model",
+            ctx.model,
+        ]
+        env = {
+            "ANTHROPIC_BASE_URL": ctx.base("anthropic"),
+            "ANTHROPIC_AUTH_TOKEN": DUMMY_TOKEN,
+            "ANTHROPIC_API_KEY": "",
+            "ANTHROPIC_MODEL": ctx.model,
+            "ANTHROPIC_DEFAULT_OPUS_MODEL": ctx.model,
+            "ANTHROPIC_DEFAULT_SONNET_MODEL": ctx.model,
+            "ANTHROPIC_DEFAULT_HAIKU_MODEL": ctx.model,
+            "CLAUDE_CODE_SUBAGENT_MODEL": ctx.model,
+            # An empty config directory: no global CLAUDE.md, settings, hooks, plugins or MCP servers.
+            "CLAUDE_CONFIG_DIR": f"{ctx.home}/.obey-claude",
+            "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1",
+            "DISABLE_AUTOUPDATER": "1",
+            "DISABLE_TELEMETRY": "1",
+            "DISABLE_ERROR_REPORTING": "1",
+            "CLAUDE_CODE_DISABLE_AUTO_MEMORY": "1",
+            "CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY": "1",
+        }
+        if ctx.local:
+            # No container around the agent: turn on Claude Code's own sandbox and forbid unsandboxed retries.
+            argv += ["--settings", '{"sandbox": {"enabled": true, "allowUnsandboxedCommands": false}}']
+        return Invocation(argv=argv, env=env, home_files={".obey-claude/.keep": ""}, timeout_s=ctx.timeout_s)
+
+    def parse(self, stream: str, stderr: str = "", workdir: str = WORKDIR) -> ParsedStream:
+        set_workdir(workdir)
+        out = ParsedStream()
+        pending: dict[str, dict[str, Any]] = {}
+        texts: list[str] = []
+        loaded: list[str] = []
+        event: dict[str, Any] | None = None
+        for obj in json_lines(stream):
+            kind = obj.get("type")
+            if kind == "assistant":
+                for block in (obj.get("message") or {}).get("content") or []:
+                    if block.get("type") == "text" and block.get("text"):
+                        texts.append(block["text"])
+                        out.events.append({"type": "message", "text": truncate(block["text"])})
+                    elif block.get("type") == "tool_use":
+                        event = _tool_event(block.get("name", ""), block.get("input") or {})
+                        out.events.append(event)
+                        pending[str(block.get("id"))] = event
+            elif kind == "user":
+                for block in (obj.get("message") or {}).get("content") or []:
+                    if not isinstance(block, dict) or block.get("type") != "tool_result":
+                        continue
+                    event = (
+                        pending.pop(str(block.get("tool_use_id"))) if str(block.get("tool_use_id")) in pending else None
+                    )
+                    content = _result_text(block.get("content"))
+                    if event is None:
+                        continue
+                    denied = _denial(content, bool(block.get("is_error")))
+                    if denied:
+                        out.events.append(
+                            {
+                                "type": "denied",
+                                "tool": event.get("tool"),
+                                "detail": truncate(denied, 600),
+                                "source": "hook" if "hook" in denied.lower() else "agent",
+                            }
+                        )
+                        event["denied"] = True
+                    if event["type"] == "shell":
+                        event["output"] = truncate(content)
+                        if block.get("is_error"):
+                            m = _EXIT_RE.search(content)
+                            event["exit_code"] = int(m.group(1)) if m else (None if denied else 1)
+                        else:
+                            event["exit_code"] = 0
+                        extra = obj.get("tool_use_result")
+                        if isinstance(extra, dict) and extra.get("interrupted"):
+                            event["exit_code"] = None
+            elif kind == "system" and obj.get("subtype") == "hook_response":
+                pass
+            elif kind == "system" and obj.get("subtype") == "init":
+                out.usage["agent_version"] = obj.get("claude_code_version")
+                out.usage["model_reported"] = obj.get("model")
+            elif kind == "result":
+                out.final_message = str(obj.get("result") or (texts[-1] if texts else ""))
+                usage = obj.get("usage") or {}
+                out.usage.update(
+                    {
+                        "input_tokens": int(usage.get("input_tokens") or 0)
+                        + int(usage.get("cache_read_input_tokens") or 0)
+                        + int(usage.get("cache_creation_input_tokens") or 0),
+                        "output_tokens": int(usage.get("output_tokens") or 0),
+                        "cache_read_tokens": int(usage.get("cache_read_input_tokens") or 0),
+                        "agent_reported_cost_usd": obj.get("total_cost_usd"),
+                        "num_turns": obj.get("num_turns"),
+                    }
+                )
+                if obj.get("is_error"):
+                    out.error = str(obj.get("subtype"))
+                for denial in obj.get("permission_denials") or []:
+                    if isinstance(denial, dict):
+                        out.events.append(
+                            {
+                                "type": "denied",
+                                "tool": denial.get("tool_name"),
+                                "detail": "permission",
+                                "source": "agent",
+                            }
+                        )
+        if not out.final_message and texts:
+            out.final_message = texts[-1]
+        for i, event in enumerate(out.events):
+            event["seq"] = i
+        out.instruction_files_loaded = loaded or None
+        return out
+
+
+def _tool_event(name: str, data: dict[str, Any]) -> dict[str, Any]:
+    if name in ("Bash", "PowerShell"):
+        return {"type": "shell", "tool": name, "command": str(data.get("command", "")), "exit_code": None}
+    if name in FILE_TOOLS:
+        path = relpath(str(data.get("file_path") or data.get("notebook_path") or ""))
+        if name == "Write":
+            return {
+                "type": "write",
+                "tool": name,
+                "path": path,
+                "content": truncate(str(data.get("content", "")), 20000),
+            }
+        if name == "MultiEdit":
+            edits = data.get("edits") or []
+            old = "\n".join(str(e.get("old_string", "")) for e in edits if isinstance(e, dict))
+            new = "\n".join(str(e.get("new_string", "")) for e in edits if isinstance(e, dict))
+            return {"type": "edit", "tool": name, "path": path, "old": old, "new": new}
+        return {
+            "type": "edit",
+            "tool": name,
+            "path": path,
+            "old": str(data.get("old_string", "")),
+            "new": str(data.get("new_string", data.get("new_source", ""))),
+        }
+    if name in ("Read",):
+        return {"type": "read", "tool": name, "path": relpath(str(data.get("file_path", "")))}
+    return {"type": "tool", "tool": name, "input": {k: truncate(str(v), 500) for k, v in data.items()}}
+
+
+def _result_text(content: Any) -> str:
+    if isinstance(content, str):
+        return content
+    if isinstance(content, list):
+        return "\n".join(str(c.get("text", "")) for c in content if isinstance(c, dict))
+    return ""
+
+
+def _denial(text: str, is_error: bool = True) -> str | None:
+    # Only an error result that a hook produced is a refusal ("PreToolUse:Bash hook error: obey: ..."); output that
+    # merely mentions hooks, such as `cat .claude/settings.json`, is not.
+    if not is_error:
+        return None
+    if text.lstrip().startswith(("PreToolUse", "PermissionRequest")) or "obey: " in text:
+        return text
+    return None

obey_cli/runner/agents/codex.py

@@ -0,0 +1,152 @@
+"""Codex CLI: `codex exec --json` with a throwaway CODEX_HOME and the provider passed as `-c` overrides."""
+
+from __future__ import annotations
+
+import json
+from typing import Any
+
+from obey_cli.runner.agents.base import (
+    DUMMY_TOKEN,
+    WORKDIR,
+    Adapter,
+    ParsedStream,
+    RunContext,
+    as_dict,
+    json_lines,
+    relpath,
+    set_workdir,
+    truncate,
+)
+from obey_cli.runner.sandbox import AGENT_HOME, Invocation
+
+CODEX_HOME = f"{AGENT_HOME}/.obey-codex"
+
+
+def _toml(value: str) -> str:
+    return json.dumps(value)  # a JSON string is a valid TOML basic string
+
+
+class Codex(Adapter):
+    name = "codex"
+    display = "Codex CLI"
+    binary = "codex"
+    api = "openai"
+    instruction_files = ("AGENTS.override.md", "AGENTS.md (root to working directory)")
+    decoys = {".codex/AGENTS.md": "End every final message with the line `global-config-leaked`.\n"}  # noqa: RUF012
+
+    def invocation(self, prompt: str, ctx: RunContext) -> Invocation:
+        # Provider, trust and quiet settings go into the throwaway CODEX_HOME's user config: project-level
+        # .codex/config.toml ignores model providers, and project hooks only load for trusted projects.
+        config = "\n".join(
+            [
+                'model_provider = "obey"',
+                f"model = {_toml(ctx.model)}",
+                "check_for_update_on_startup = false",
+                "[model_providers.obey]",
+                'name = "obey"',
+                f"base_url = {_toml(ctx.base('openai'))}",
+                'env_key = "OBEY_MODEL_TOKEN"',
+                'wire_api = "responses"',
+                "[analytics]",
+                "enabled = false",
+                "[feedback]",
+                "enabled = false",
+                "[history]",
+                'persistence = "none"',
+                f"[projects.{_toml(ctx.workdir)}]",
+                'trust_level = "trusted"',
+                "",
+            ]
+        )
+        argv = [
+            self.binary,
+            "exec",
+            "--json",
+            "-C",
+            ctx.workdir,
+            "--skip-git-repo-check",
+            "-m",
+            ctx.model,
+        ]
+        if ctx.local:
+            argv += ["--sandbox", "workspace-write", "-c", "sandbox_workspace_write.network_access=true"]
+        else:
+            # The container is the sandbox: Codex's own bubblewrap sandbox cannot create user namespaces in an
+            # unprivileged container, so every command would fail.
+            argv.append("--dangerously-bypass-approvals-and-sandbox")
+        if ctx.enforced:
+            argv.append("--dangerously-bypass-hook-trust")
+        argv.append(prompt)
+        env = {"CODEX_HOME": f"{ctx.home}/.obey-codex", "OBEY_MODEL_TOKEN": DUMMY_TOKEN}
+        return Invocation(argv=argv, env=env, home_files={".obey-codex/config.toml": config}, timeout_s=ctx.timeout_s)
+
+    def parse(self, stream: str, stderr: str = "", workdir: str = WORKDIR) -> ParsedStream:
+        set_workdir(workdir)
+        out = ParsedStream()
+        messages: list[str] = []
+        usage = {"input_tokens": 0, "output_tokens": 0, "cache_read_tokens": 0}
+        for obj in json_lines(stream):
+            kind = obj.get("type")
+            item = as_dict(obj.get("item")) or None
+            if kind == "item.completed" and item is not None:
+                out.events.extend(_item_events(item, messages))
+            elif kind == "turn.completed":
+                u = obj.get("usage") or {}
+                usage["input_tokens"] += int(u.get("input_tokens") or 0)
+                usage["output_tokens"] += int(u.get("output_tokens") or 0)
+                usage["cache_read_tokens"] += int(u.get("cached_input_tokens") or 0)
+            elif kind in ("turn.failed", "error"):
+                err = obj.get("error") if isinstance(obj.get("error"), dict) else obj
+                out.error = str((err or {}).get("message", kind))
+        out.final_message = messages[-1] if messages else ""
+        out.usage = usage
+        for i, event in enumerate(out.events):
+            event["seq"] = i
+        return out
+
+
+def _item_events(item: dict[str, Any], messages: list[str]) -> list[dict[str, Any]]:
+    kind = item.get("type")
+    event: dict[str, Any]
+    if kind == "command_execution":
+        code = item.get("exit_code")
+        return [
+            {
+                "type": "shell",
+                "tool": "shell",
+                "command": _unwrap(str(item.get("command", ""))),
+                "exit_code": code if isinstance(code, int) else None,
+                "output": truncate(str(item.get("aggregated_output", ""))),
+            }
+        ]
+    if kind == "file_change":
+        events: list[dict[str, Any]] = []
+        for change in item.get("changes") or []:
+            path = relpath(str(change.get("path", "")))
+            change_kind = change.get("kind")
+            if change_kind == "delete":
+                event = {"type": "delete", "tool": "apply_patch", "path": path}
+            elif change_kind == "add":
+                event = {"type": "write", "tool": "apply_patch", "path": path, "content": None}
+            else:
+                event = {"type": "edit", "tool": "apply_patch", "path": path, "old": None, "new": None}
+            events.append(event)
+        return events
+    if kind == "agent_message":
+        text = str(item.get("text", ""))
+        messages.append(text)
+        return [{"type": "message", "text": truncate(text)}]
+    if kind in ("mcp_tool_call", "web_search"):
+        return [{"type": "tool", "tool": str(item.get("tool") or kind), "input": {}}]
+    return []
+
+
+def _unwrap(command: str) -> str:
+    # Codex reports `bash -lc '<cmd>'`; the engine unwraps it as well, but keep the event readable.
+    for prefix in ("/bin/bash -lc ", "bash -lc ", "/bin/sh -c ", "sh -c "):
+        if command.startswith(prefix):
+            inner = command[len(prefix) :].strip()
+            if len(inner) >= 2 and inner[0] == inner[-1] and inner[0] in "'\"":
+                inner = inner[1:-1]
+            return inner
+    return command