openadapt-agent 2.0.0__tar.gz

openadapt_agent-2.0.0/.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Default code owners. Enforced via branch protection (required review).
+* @abrichr

openadapt_agent-2.0.0/.github/dependabot.yml

@@ -0,0 +1,17 @@
+# SOC 2: automated dependency updates (OA-C-23).
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"

openadapt_agent-2.0.0/.github/workflows/ci.yml

@@ -0,0 +1,34 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - name: Install
+        run: pip install -e ".[dev]"
+      - name: Lint
+        run: ruff check src tests scripts
+      - name: Test
+        run: pytest -q
+      - name: Build release artifacts
+        if: matrix.python-version == '3.12'
+        run: python -m build
+      - name: Verify MIT package boundary
+        if: matrix.python-version == '3.12'
+        run: |
+          python scripts/check_release_artifacts.py dist
+          python scripts/check_dist.py dist/*

openadapt_agent-2.0.0/.github/workflows/codeql.yml

@@ -0,0 +1,37 @@
+name: CodeQL
+
+# SOC 2: SAST (OA-C-24). Static analysis on push/PR to main + weekly.
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "23 5 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["python"]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        with:
+          languages: ${{ matrix.language }}
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        with:
+          category: "/language:${{ matrix.language }}"

openadapt_agent-2.0.0/.github/workflows/dependency-review.yml

@@ -0,0 +1,21 @@
+name: Dependency Review
+
+# SOC 2: dependency-review (OA-C-24). Flags vulnerable/denied deps on PRs.
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    name: dependency-review
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Dependency Review
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: high

openadapt_agent-2.0.0/.github/workflows/release.yml

@@ -0,0 +1,206 @@
+name: Release
+
+# Builds the package, gates it on the license/boundary check, and — ONLY on
+# a version tag or a published GitHub Release — publishes to PyPI and to the
+# official MCP registry. A normal push or PR runs the validate job only
+# (dry run, no publish), so the workflow itself is testable without shipping.
+#
+# Auth is OIDC-first and secret-free for the io.github.OpenAdaptAI namespace:
+#   - PyPI: Trusted Publishing (needs a one-time publisher config on PyPI +
+#     a GitHub environment named `pypi`; NO repo secret).
+#   - MCP registry: `mcp-publisher login github-oidc` (NO repo secret).
+# Optional token fallbacks are wired and fail LOUD if selected-but-unset;
+# see docs/DISTRIBUTION.md.
+
+on:
+  push:
+    tags: ["v*"]
+  release:
+    types: [published]
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - "pyproject.toml"
+      - "server.json"
+      - "smithery.yaml"
+      - "scripts/check_release_artifacts.py"
+      - "scripts/check_dist.py"
+      - ".github/workflows/release.yml"
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    name: Build + validate (dry run, no publish)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+      - name: Install tooling
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install --upgrade build "twine>=6.1" "packaging>=24.2" jsonschema
+          python -m pip install -e ".[dev]"
+      - name: Version-consistency guard (server.json / pyproject / __version__)
+        run: python -m pytest tests/test_distribution.py -q
+      - name: Build sdist + wheel
+        run: python -m build
+      - name: License / package-boundary check on built archives
+        run: |
+          python scripts/check_release_artifacts.py dist
+          python scripts/check_dist.py dist/*
+      - name: twine check
+        run: twine check dist/*
+      - name: Validate server.json against the MCP registry schema
+        run: |
+          python - <<'PY'
+          import json, sys, urllib.request
+          from jsonschema import Draft202012Validator
+          doc = json.load(open("server.json"))
+          url = doc["$schema"]
+          try:
+              schema = json.load(urllib.request.urlopen(url, timeout=30))
+          except Exception as exc:  # network hiccup: don't fail the dry run
+              print(f"WARNING: could not fetch {url}: {exc}; skipping live schema check")
+              sys.exit(0)
+          errors = sorted(Draft202012Validator(schema).iter_errors(doc), key=lambda e: list(e.path))
+          for e in errors:
+              print("SCHEMA ERROR:", list(e.path), e.message)
+          sys.exit(1 if errors else 0)
+          PY
+      - name: Upload built distributions
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+
+  pypi-publish:
+    name: Publish to PyPI
+    needs: validate
+    if: ${{ (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) || github.event_name == 'release' }}
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write # OIDC for PyPI Trusted Publishing
+      contents: read
+    steps:
+      - uses: actions/checkout@v5
+      - name: Resolve release version + assert it matches the package
+        id: ver
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [ "${{ github.event_name }}" = "release" ]; then
+            tag="${{ github.event.release.tag_name }}"
+          else
+            tag="${GITHUB_REF#refs/tags/}"
+          fi
+          tag_version="${tag#v}"
+          pkg_version="$(grep -m1 -E '^version = ' pyproject.toml | sed -E 's/version = "(.*)"/\1/')"
+          echo "version=${pkg_version}" >> "$GITHUB_OUTPUT"
+          if [ "${tag_version}" != "${pkg_version}" ]; then
+            echo "::error::Tag version '${tag_version}' != pyproject version '${pkg_version}'." \
+                 "Bump pyproject.toml, __init__.py, and server.json together (the" \
+                 "tests/test_distribution.py guard pins them) and re-tag." >&2
+            exit 1
+          fi
+      - name: Download built distributions
+        uses: actions/download-artifact@v5
+        with:
+          name: dist
+          path: dist/
+      - name: Fail loud if token method selected without a token
+        if: ${{ vars.PYPI_PUBLISH_METHOD == 'token' }}
+        env:
+          TOKEN: ${{ secrets.PYPI_API_TOKEN }}
+        run: |
+          if [ -z "${TOKEN}" ]; then
+            echo "::error::PYPI_PUBLISH_METHOD is 'token' but the repo secret" \
+                 "PYPI_API_TOKEN is not set. Add it, or unset the variable to use" \
+                 "OIDC Trusted Publishing (recommended)." >&2
+            exit 1
+          fi
+      - name: Publish to PyPI (OIDC Trusted Publishing)
+        if: ${{ vars.PYPI_PUBLISH_METHOD != 'token' }}
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          # No password -> the action uses OIDC Trusted Publishing.
+          print-hash: true
+      - name: Publish to PyPI (API token fallback)
+        if: ${{ vars.PYPI_PUBLISH_METHOD == 'token' }}
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          password: ${{ secrets.PYPI_API_TOKEN }}
+          print-hash: true
+
+  mcp-registry-publish:
+    name: Publish server.json to the MCP registry
+    needs: [validate, pypi-publish]
+    if: ${{ (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) || github.event_name == 'release' }}
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write # OIDC for `mcp-publisher login github-oidc`
+      contents: read
+    steps:
+      - uses: actions/checkout@v5
+      - name: Resolve release version
+        id: ver
+        shell: bash
+        run: |
+          set -euo pipefail
+          pkg_version="$(grep -m1 -E '^version = ' pyproject.toml | sed -E 's/version = "(.*)"/\1/')"
+          echo "version=${pkg_version}" >> "$GITHUB_OUTPUT"
+      - name: Wait for the PyPI package to be installable
+        shell: bash
+        run: |
+          set -euo pipefail
+          version="${{ steps.ver.outputs.version }}"
+          url="https://pypi.org/pypi/openadapt-agent/${version}/json"
+          for attempt in $(seq 1 20); do
+            code="$(curl -s -o /dev/null -w '%{http_code}' "$url")"
+            if [ "$code" = "200" ]; then
+              echo "openadapt-agent ${version} is live on PyPI."
+              exit 0
+            fi
+            echo "Attempt ${attempt}: PyPI returned ${code} for ${version}; waiting 15s..."
+            sleep 15
+          done
+          echo "::error::openadapt-agent ${version} did not appear on PyPI in time." \
+               "The MCP registry validates package existence, so it would reject" \
+               "this publish. Check the PyPI publish job." >&2
+          exit 1
+      - name: Install mcp-publisher
+        shell: bash
+        run: |
+          set -euo pipefail
+          os="$(uname -s | tr '[:upper:]' '[:lower:]')"
+          arch="$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')"
+          curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_${os}_${arch}.tar.gz" \
+            | tar xz mcp-publisher
+      - name: Fail loud if token method selected without a token
+        if: ${{ vars.MCP_PUBLISH_METHOD == 'token' }}
+        env:
+          TOKEN: ${{ secrets.MCP_GITHUB_TOKEN }}
+        run: |
+          if [ -z "${TOKEN}" ]; then
+            echo "::error::MCP_PUBLISH_METHOD is 'token' but the repo secret" \
+                 "MCP_GITHUB_TOKEN is not set. Add a PAT with read:org + read:user," \
+                 "or unset the variable to use OIDC (recommended)." >&2
+            exit 1
+          fi
+      - name: Authenticate to the MCP registry (OIDC)
+        if: ${{ vars.MCP_PUBLISH_METHOD != 'token' }}
+        run: ./mcp-publisher login github-oidc
+      - name: Authenticate to the MCP registry (PAT fallback)
+        if: ${{ vars.MCP_PUBLISH_METHOD == 'token' }}
+        run: ./mcp-publisher login github --token "${{ secrets.MCP_GITHUB_TOKEN }}"
+      - name: Publish server.json
+        run: ./mcp-publisher publish

openadapt_agent-2.0.0/.github/workflows/secret-scan.yml

@@ -0,0 +1,32 @@
+name: Secret Scan
+
+# SOC 2: secret scanning (OA-C-24). Uses the free, MIT-licensed gitleaks CLI.
+# NOTE: the gitleaks *Action* now requires a paid GITLEAKS_LICENSE for
+# organization-owned repos (even public ones); the gitleaks CLI does not, so we
+# invoke it directly and pin the version. Scans full git history on PRs + main.
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  gitleaks:
+    name: gitleaks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - name: Install gitleaks
+        env:
+          GITLEAKS_VERSION: 8.30.1
+        run: |
+          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+            | tar -xz -C /usr/local/bin gitleaks
+          gitleaks version
+      - name: Scan git history for secrets
+        run: gitleaks git . --redact --no-banner

openadapt_agent-2.0.0/.gitignore

@@ -0,0 +1,139 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+
+# PyInstaller
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py,cover
+.hypothesis/
+.pytest_cache/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+.python-version
+
+# pipenv
+Pipfile.lock
+
+# PEP 582
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# ruff
+.ruff_cache/
+
+# uv
+uv.lock
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Project specific
+*.session.json
+sessions/

openadapt_agent-2.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 MLDSAI Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.