openadapt-agent 2.0.1__tar.gz → 2.2.0__tar.gz

openadapt_agent-2.2.0/.github/dependabot.yml

@@ -0,0 +1,25 @@
+# SOC 2: automated dependency updates (OA-C-23).
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+    # github/codeql-action/init and .../analyze must run at the SAME version;
+    # a run with mismatched versions aborts with "Loaded a configuration file
+    # for version X, but running version Y". Ungrouped, Dependabot opens one
+    # PR per sub-action, so each one is red on its own and neither can merge.
+    groups:
+      codeql-action:
+        patterns:
+          - "github/codeql-action*"

openadapt_agent-2.2.0/.github/workflows/ci.yml

@@ -0,0 +1,102 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Cover SDK 1, SDK 2's floor, and current dependencies in three jobs.
+          - python-version: "3.10"
+            dependency-set: floor
+          - python-version: "3.11"
+            dependency-set: mcp2-floor
+          - python-version: "3.12"
+            dependency-set: current
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        if: matrix.dependency-set == 'floor'
+      - name: Verify lock consistency
+        if: matrix.dependency-set == 'floor'
+        run: uv lock --locked
+      - name: Install dependency floors
+        if: matrix.dependency-set == 'floor'
+        run: >-
+          pip install -e ".[dev]"
+          "openadapt-flow==2.1.0"
+          "mcp==1.28.0"
+      - name: Install MCP 2 floor
+        if: matrix.dependency-set == 'mcp2-floor'
+        run: pip install -e ".[dev]" "mcp==2.0.0"
+      - name: Install current allowed dependencies
+        if: matrix.dependency-set == 'current'
+        run: pip install -e ".[dev]"
+      - name: Lint
+        run: ruff check src tests scripts
+      - name: Test
+        run: pytest -q
+      - name: Build release artifacts
+        if: matrix.python-version == '3.12'
+        run: python -m build
+      - name: Verify MIT package boundary
+        if: matrix.python-version == '3.12'
+        run: |
+          python scripts/check_release_artifacts.py dist
+          python scripts/check_dist.py dist/*
+          python scripts/check_source_boundary.py --require-dist
+
+  sandbox-e2e:
+    # The zero-flag sandbox with real openadapt-flow, a real browser, and the
+    # synthetic MockMed app: no fakes. Unit jobs above stub Flow's CLI.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Install with the browser extra
+        run: pip install -e ".[dev,tutorial]"
+      - name: Install Chromium
+        run: python -m playwright install --with-deps chromium
+      # test_approval_flow.py skips until the installed openadapt-flow has
+      # approval modes.
+      - name: Run every sandbox case through openadapt-flow
+        env:
+          OPENADAPT_AGENT_E2E: "1"
+          DO_NOT_TRACK: "1"
+          OPENADAPT_TELEMETRY: "0"
+        run: pytest -q tests/test_sandbox_flow.py tests/test_approval_flow.py
+
+  repair-e2e:
+    # halt -> needs_repair -> teach_repair -> approval -> replay, on Flow's
+    # rendered dialog fixture with its real replayer, OCR, and campaigns.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Install with the released Flow (ships openadapt_flow.repair.dialog_fixture)
+        run: |
+          pip install -e ".[dev]" "openadapt-flow>=2.1.0,<3"
+          pip install opencv-python-headless rapidocr-onnxruntime
+      - name: Run the repair end-to-end test
+        env:
+          DO_NOT_TRACK: "1"
+          OPENADAPT_TELEMETRY: "0"
+        run: |
+          python -c "import openadapt_flow.repair.dialog_fixture"
+          pytest -q -rs tests/test_repair_e2e.py tests/test_repair_hold.py

{openadapt_agent-2.0.1 → openadapt_agent-2.2.0}/.github/workflows/codeql.yml

@@ -28,10 +28,10 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           languages: ${{ matrix.language }}
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           category: "/language:${{ matrix.language }}"

{openadapt_agent-2.0.1 → openadapt_agent-2.2.0}/.github/workflows/release.yml

@@ -22,9 +22,14 @@ on:
     paths:
       - "pyproject.toml"
       - "server.json"
-      - "smithery.yaml"
+      - "manifest.json"
+      - ".mcpbignore"
+      - "src/openadapt_agent/mcpb_entry.py"
+      - "scripts/check_mcpb.py"
       - "scripts/check_release_artifacts.py"
       - "scripts/check_dist.py"
+      - "scripts/check_source_boundary.py"
+      - "source-policy.public.json"
       - ".github/workflows/release.yml"
 
 concurrency:
@@ -39,25 +44,38 @@ jobs:
     name: Build + validate (dry run, no publish)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: "20"
       - name: Install tooling
         run: |
           python -m pip install --upgrade pip
           python -m pip install --upgrade build "twine>=6.1" "packaging>=24.2" jsonschema
           python -m pip install -e ".[dev]"
-      - name: Version-consistency guard (server.json / pyproject / __version__)
+      - name: Version-consistency guard (registry / MCPB / package / runtime)
         run: python -m pytest tests/test_distribution.py -q
       - name: Build sdist + wheel
         run: python -m build
-      - name: License / package-boundary check on built archives
+      - name: License and source-policy checks on built archives
         run: |
           python scripts/check_release_artifacts.py dist
           python scripts/check_dist.py dist/*
+          python scripts/check_source_boundary.py --require-dist
       - name: twine check
         run: twine check dist/*
+      - name: Validate and pack the local MCPB
+        shell: bash
+        run: |
+          set -euo pipefail
+          version="$(grep -m1 -E '^version = ' pyproject.toml | sed -E 's/version = "(.*)"/\1/')"
+          mkdir -p mcpb-dist
+          npx -y @anthropic-ai/mcpb@2.1.2 validate manifest.json
+          npx -y @anthropic-ai/mcpb@2.1.2 pack . "mcpb-dist/openadapt-agent-${version}.mcpb"
+          python scripts/check_mcpb.py mcpb-dist/*.mcpb
       - name: Validate server.json against the MCP registry schema
         run: |
           python - <<'PY'
@@ -76,11 +94,17 @@ jobs:
           sys.exit(1 if errors else 0)
           PY
       - name: Upload built distributions
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: dist
           path: dist/
           if-no-files-found: error
+      - name: Upload local MCPB
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: mcpb
+          path: mcpb-dist/
+          if-no-files-found: error
 
   pypi-publish:
     name: Publish to PyPI
@@ -92,7 +116,7 @@ jobs:
       id-token: write # OIDC for PyPI Trusted Publishing
       contents: read
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Resolve release version + assert it matches the package
         id: ver
         shell: bash
@@ -113,7 +137,7 @@ jobs:
             exit 1
           fi
       - name: Download built distributions
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: dist
           path: dist/
@@ -130,13 +154,13 @@ jobs:
           fi
       - name: Publish to PyPI (OIDC Trusted Publishing)
         if: ${{ vars.PYPI_PUBLISH_METHOD != 'token' }}
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           # No password -> the action uses OIDC Trusted Publishing.
           print-hash: true
       - name: Publish to PyPI (API token fallback)
         if: ${{ vars.PYPI_PUBLISH_METHOD == 'token' }}
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           password: ${{ secrets.PYPI_API_TOKEN }}
           print-hash: true
@@ -150,7 +174,7 @@ jobs:
       id-token: write # OIDC for `mcp-publisher login github-oidc`
       contents: read
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Resolve release version
         id: ver
         shell: bash

{openadapt_agent-2.0.1 → openadapt_agent-2.2.0}/.gitignore

@@ -11,6 +11,7 @@ __pycache__/
 build/
 develop-eggs/
 dist/
+mcpb-dist/
 downloads/
 eggs/
 .eggs/
@@ -121,7 +122,9 @@ dmypy.json
 .ruff_cache/
 
 # uv
-uv.lock
+# The MCPB is a local application bundle, so keep its dependency lock for a
+# repeatable one-click install.
+!uv.lock
 
 # IDE
 .idea/
@@ -137,3 +140,12 @@ Thumbs.db
 # Project specific
 *.session.json
 sessions/
+
+# Never-publish workspace material (strategy, prospect research, counsel packs,
+# personal contact details). Created ad hoc; must never reach a remote.
+.private/
+
+# Cover every .env variant, not one at a time. Negate the committed
+# template so it stays tracked.
+.env.*
+!.env.example

openadapt_agent-2.2.0/.gitleaks.toml

@@ -0,0 +1,10 @@
+# Extends the default gitleaks rules. Each allowlist entry names one
+# synthetic test value, so a real key in the same file is still caught.
+[extend]
+useDefault = true
+
+[[allowlists]]
+description = "Synthetic bundle key in the approval end-to-end test, not a credential"
+paths = ['''^tests/test_approval_flow\.py$''']
+regexes = ['''approval-e2e-synthetic-key''']
+condition = "AND"

openadapt_agent-2.2.0/.mcpbignore

@@ -0,0 +1,18 @@
+.github/
+.pytest_cache/
+.ruff_cache/
+.venv/
+build/
+dist/
+docs/
+scripts/
+tests/
+*.egg-info/
+**/__pycache__/
+*.pyc
+CLAUDE.md
+SECURITY.md
+llms.txt
+server.json
+source-policy.public.json
+.gitleaks.toml