ouro-agent 0.2.0__tar.gz

ouro_agent-0.2.0/.github/workflows/ci.yml

@@ -0,0 +1,81 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  architecture-unit:
+    name: Architecture / core unit gate
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v7
+
+      - name: Install uv and Python
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        with:
+          version: "0.11.28"
+          python-version: "3.14"
+          enable-cache: true
+
+      - name: Sync locked dependencies
+        run: uv sync --frozen --all-groups
+
+      - name: Check architecture and core units
+        run: uv run --frozen pytest -q tests/architecture tests/core
+
+  quality:
+    name: Python 3.14 / ${{ matrix.os }}
+    needs: architecture-unit
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v7
+
+      - name: Install uv and Python
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        with:
+          version: "0.11.28"
+          python-version: "3.14"
+          enable-cache: true
+
+      - name: Sync locked dependencies
+        run: uv sync --frozen --all-groups
+
+      - name: Run tests
+        run: uv run --frozen pytest
+
+      - name: Check lint
+        run: uv run --frozen ruff check ouro tests
+
+      - name: Check formatting
+        run: uv run --frozen ruff format --check ouro tests
+
+      - name: Check types
+        run: uv run --frozen mypy ouro
+
+      - name: Compile package
+        run: uv run --frozen python -m compileall -q ouro
+
+      - name: Build distributions
+        run: uv build
+
+      - name: Enforce coverage floor
+        if: runner.os == 'Linux'
+        run: uv run --frozen pytest --cov=ouro --cov-report=term-missing

ouro_agent-0.2.0/.gitignore

@@ -0,0 +1,35 @@
+# Python
+__pycache__/
+*.py[cod]
+*.pyo
+*.egg-info/
+dist/
+build/
+
+# Virtual environments
+.venv/
+.venv-*/
+venv/
+
+# Testing / coverage
+.coverage
+.pytest_cache/
+htmlcov/
+
+# Tool caches
+.ruff_cache/
+.mypy_cache/
+
+# IDE
+.idea/
+.vscode/
+.claude/
+*.swp
+*.swo
+
+# OS
+.DS_Store
+Thumbs.db
+
+# User
+.ouro

ouro_agent-0.2.0/CHANGELOG.md

@@ -0,0 +1,27 @@
+# Changelog
+
+本文件按版本记录面向使用者和维护者的主要改进，不展开实现细节。当前能力见[项目概述](docs/overview.md)，版本发布遵循[发布流程](RELEASING.md)。
+
+## 0.2.0 — 2026-10-12
+
+- 重构插件平台，支持可替换的智能体循环、模型接入、插件服务协作、代码执行与后台调度。
+- 完善插件启停、升级和卸载，增强能力组合、在途执行及恢复的一致性。
+- 优化插件启动与资源管理，减少重复初始化和无关能力的运行成本。
+- 改善 TUI 会话历史显示、会话切换和连续审批的稳定性。
+- 补充插件示例、开发规范与回归验证，为后续能力演进建立清晰边界。
+- 正式采用 MIT 开源协议，并将协议声明纳入源码与发行包。
+- 完善开源项目首页，提供 TUI 预览与快速上手说明，覆盖安装、模型配置、日常使用、数据位置与升级。
+
+兼容性：插件开发接口统一为 SDK v3；不受支持的旧接口、协议和数据格式会被明确拒绝，不提供自动迁移。插件需声明适用的 OURO 版本范围。
+
+验证：重构全量回归、版本准备定向验证及独立安装检查在 Windows 通过；其他平台与真实模型账户不属于本轮新增验收。设计与详细证据见[重构记录](docs/plans/archive/2026-10-12-plugin-platform-refactoring.md)和[审查修正记录](docs/plans/archive/2026-10-12-plugin-system-review.md)。
+
+## 0.1.0 — 历史开发版本
+
+以下汇总版本升级前的开发基线；此前未登记正式发布日期或 release tag。
+
+- 建立本地个人智能体基础，提供 CLI / TUI、多模型接入、会话管理、工具执行和人工审批。
+- 提供插件、Skills、MCP、子智能体、Goal / Plan 与自动任务能力。
+- 支持文件与 SQLite 存储、会话恢复、数据传输及多模态附件输入。
+- 持续改进终端交互、媒体处理、资源访问与并发存储的稳定性和效率。
+- 补充工程验证与架构规范，整理用户指南、领域规格和开发文档。

ouro_agent-0.2.0/CONTRIBUTING.md

@@ -0,0 +1,50 @@
+# Contributing to OURO
+
+OURO targets Python 3.14 or newer and uses `uv` for its locked development environment.
+
+Use the fast architecture/core gate while iterating:
+
+```bash
+uv run --frozen pytest -q tests/architecture tests/core
+```
+
+Before handoff, run the complete local quality gate:
+
+```bash
+uv sync --frozen --all-groups
+uv run --frozen pytest --cov=ouro --cov-report=term-missing
+uv run --frozen ruff check ouro tests
+uv run --frozen ruff format --check ouro tests
+uv run --frozen mypy ouro
+uv run --frozen python -m compileall -q ouro
+uv build
+```
+
+Run platform-specific checks on their actual target systems and report skipped or unverified
+platforms separately; a passing local gate is not cross-platform evidence.
+
+Implementation and review must follow the
+[Chinese coding guidelines](docs/development/coding-guidelines.zh-CN.md) or the
+[English coding guidelines](docs/development/coding-guidelines.en.md). Keep domain contracts in `core`,
+orchestration in `application`, adapters in infrastructure packages, and presentation behavior in
+hosts such as `cli`. Do not make a Host depend directly on persistence files or configuration
+managers when an application boundary exists.
+
+Documentation follows the [documentation standard](docs/development/documentation.md). Keep user
+guides, formal specifications (`docs/specs/`), future plans, and completed reviews in their respective locations;
+update relative links and command examples when moving or changing them.
+
+Changes should include focused success and failure tests. Concurrency, cancellation, recovery,
+credential redaction, path handling, and durable-state changes require explicit regression
+coverage. Keep generated caches, local OURO homes, credentials, and build artifacts out of commits.
+
+Before requesting review:
+
+- explain the behavior and compatibility impact;
+- keep specs and the capability summary self-contained descriptions of current contracts;
+- run the complete quality gate above;
+- identify supported data formats, security assumptions, and intentionally deferred work;
+- avoid bundling unrelated refactors into the same change.
+
+OURO is distributed under the [MIT License](LICENSE). Contributions to this repository are
+provided under the same license. Preserve applicable copyright and license notices.

ouro_agent-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 OURO contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

ouro_agent-0.2.0/PKG-INFO

@@ -0,0 +1,198 @@
+Metadata-Version: 2.5
+Name: ouro-agent
+Version: 0.2.0
+Summary: Local-first personal agent runtime.
+Project-URL: Homepage, https://github.com/djsaber/OURO
+Project-URL: Documentation, https://github.com/djsaber/OURO/blob/main/docs/README.md
+Project-URL: Repository, https://github.com/djsaber/OURO
+Project-URL: Issues, https://github.com/djsaber/OURO/issues
+Project-URL: Changelog, https://github.com/djsaber/OURO/blob/main/CHANGELOG.md
+License-Expression: MIT
+License-File: LICENSE
+Requires-Python: >=3.14
+Requires-Dist: arrayfunc<9,>=8.5.7
+Requires-Dist: httpx-sse>=0.4.3
+Requires-Dist: httpx>=0.28
+Requires-Dist: jsonschema>=4.25
+Requires-Dist: mcp<2,>=1.28
+Requires-Dist: pathspec>=1.1.1
+Requires-Dist: pillow<13,>=12.3
+Requires-Dist: pydantic>=2.13
+Requires-Dist: pyperclip<2,>=1.11
+Requires-Dist: pyyaml>=6.0.2
+Requires-Dist: rich<16,>=15
+Requires-Dist: textual<9,>=8.2
+Requires-Dist: tzdata>=2025.2
+Requires-Dist: tzlocal>=5.4.4
+Requires-Dist: unicode-segmentation-rs<0.4,>=0.3.3
+Requires-Dist: wcmatch>=11.0
+Description-Content-Type: text/markdown
+
+# OURO
+
+[![PyPI](https://img.shields.io/pypi/v/ouro-agent?color=2563eb)](https://pypi.org/project/ouro-agent/)
+[![Python 3.14+](https://img.shields.io/badge/Python-3.14%2B-3776ab)](https://www.python.org/downloads/)
+[![MIT License](https://img.shields.io/badge/License-MIT-16a34a)](https://github.com/djsaber/OURO/blob/main/LICENSE)
+
+**本地优先、可灵活拓展的个人智能体。**
+
+OURO 让你在终端中与模型协作，处理文件、调用工具、管理会话和执行持续任务。它提供全屏交互界面，也可以通过命令行完成单次任务或输出 JSON。会话与配置保存在本地，模型服务由你选择。
+
+插件是 OURO 的核心拓展机制：除了工具、Skills 和 MCP，还可以拓展模型接入、智能体运行方式、后台任务及插件间协作，按需安装、启用和停用。
+
+![OURO v0.2.0 的终端交互界面](https://raw.githubusercontent.com/djsaber/OURO/v0.2.0/docs/assets/tui-welcome.png)
+
+*OURO v0.2.0 实际界面 · Horizon 欢迎页 · 尚未配置模型的初始状态*
+
+[使用文档](https://github.com/djsaber/OURO/blob/main/docs/README.md) · [版本记录](https://github.com/djsaber/OURO/blob/main/CHANGELOG.md) · [源码](https://github.com/djsaber/OURO) · [问题反馈](https://github.com/djsaber/OURO/issues)
+
+## 为你的工作方式而拓展
+
+| 能力 | 你可以做什么 |
+| --- | --- |
+| 终端协作 | 在全屏 TUI 中交互，或通过 CLI 完成单次任务、输出 JSON。 |
+| 本地资料 | 读取、编辑和搜索文件，使用附件及模型支持的图片、音频或视频输入。 |
+| 持续任务 | 保存和恢复会话，通过子智能体、Goal / Plan 拆分任务、管理目标与计划。 |
+| 模型与工具 | 配置多家模型供应商、兼容接口和 MCP 服务，为任务选择合适能力。 |
+| 可组合插件 | 按需拓展工具、Skills、模型接入、智能体循环、插件协作与后台调度。 |
+| 执行控制 | 通过权限、人工审批、取消操作和运行预算控制执行，查看用量与历史。 |
+
+## 安装
+
+OURO 需要 **Python 3.14 或更高版本**。建议使用支持 Unicode 的现代终端。
+
+### 使用 uv 安装（推荐）
+
+安装 [uv](https://docs.astral.sh/uv/getting-started/installation/) 后执行：
+
+```bash
+uv tool install --python 3.14 ouro-agent
+ouro --version
+```
+
+uv 会为 OURO 创建独立环境，并按需安装所需 Python。若终端提示找不到 `ouro`，执行 `uv tool update-shell` 后重新打开终端。
+
+### 使用 pip 安装
+
+如果已经有 Python 3.14+ 环境，也可以安装到自己的虚拟环境中：
+
+```bash
+python -m pip install ouro-agent
+ouro --version
+```
+
+PyPI 包名是 `ouro-agent`，安装后的命令是 `ouro`。
+
+## 第一次使用
+
+### 1. 配置模型
+
+使用真实模型需要对应供应商的账户与凭据。OURO 不附带模型权重或 API 额度；尚未配置供应商时，内置 Faux 仅提供离线演示，不是真实模型。
+
+下面以 OpenAI API 为例。先在当前终端设置自己的 API Key：
+
+**Windows PowerShell：**
+
+```powershell
+$env:OPENAI_API_KEY = "替换为你的 API Key"
+```
+
+**macOS / Linux（bash 或 zsh）：**
+
+```bash
+export OPENAI_API_KEY="替换为你的 API Key"
+```
+
+再添加供应商并设为默认：
+
+```bash
+ouro provider add "OpenAI" --type openai --api-key-env OPENAI_API_KEY --default
+```
+
+以上环境变量设置只对当前终端及其子进程生效。重新打开终端后，需要重新设置，或通过系统环境变量管理保存。OURO 配置中记录的是变量名。
+
+你也可以通过 `ouro provider templates` 查看其他内置供应商模板，或在交互界面按 `Ctrl+P`，进入 `Manage providers` 管理供应商。模型是否可用取决于你的账户权限和供应商支持范围。
+
+### 2. 启动交互界面
+
+在想要处理的工作目录中执行：
+
+```bash
+ouro
+```
+
+输入任务即可开始。`Ctrl+P` 打开操作菜单，`/help` 查看快捷键与命令帮助。
+
+### 3. 尝试命令行任务
+
+```bash
+# 文本输出
+ouro run --print "说明当前目录的用途，并给出整理建议"
+
+# JSON 输出，便于脚本集成
+ouro run --json "总结本次任务"
+
+# 查看帮助
+ouro --help
+```
+
+只想先检查安装是否正常，可以在独立数据目录运行离线演示，无需 API Key：
+
+```bash
+ouro run --print --home ./.ouro-demo "hello"
+```
+
+## 按需增加能力
+
+OURO 提供稳定的运行框架，插件作为独立拓展包接入。你可以从工具和 Skills 开始，也可以通过插件定制智能体的执行方式、模型接入、服务协作和后台任务。
+
+插件管理入口可通过 `ouro plugin --help` 查看。请只安装并启用你信任的插件；插件和工具可能读写文件、执行程序或连接外部服务。
+
+## 数据保存在哪里
+
+默认数据目录为用户主目录下的 `.ouro`，用于保存配置、会话及运行记录。可以用 `--home` 为不同用途选择独立目录：
+
+```bash
+ouro --home ./.ouro-work
+ouro session list --home ./.ouro-work
+```
+
+目录选择顺序为：`--home`、环境变量 `OURO_HOME`、默认的 `~/.ouro`。本地保存不代表所有处理都离线；模型请求会发送到你配置的服务。
+
+升级前建议备份数据。当前版本会明确拒绝不受支持的旧数据格式，不会自动迁移或清空原数据；需要隔离体验时可使用新的 `--home` 目录。
+
+## 升级
+
+使用 uv 安装：
+
+```bash
+uv tool upgrade ouro-agent
+```
+
+使用 pip 安装：
+
+```bash
+python -m pip install --upgrade ouro-agent
+```
+
+## 文档与源码
+
+完整源码位于 [GitHub](https://github.com/djsaber/OURO)，安装包和源码包发布在 [PyPI](https://pypi.org/project/ouro-agent/)。
+
+- [文档入口](https://github.com/djsaber/OURO/blob/main/docs/README.md)：使用指南、插件开发、配置说明与运行契约。
+- [更新记录](https://github.com/djsaber/OURO/blob/main/CHANGELOG.md)：各版本的主要改进与兼容性说明。
+- [贡献指南](https://github.com/djsaber/OURO/blob/main/CONTRIBUTING.md)：开发流程与验证要求。
+- [问题反馈](https://github.com/djsaber/OURO/issues)：报告问题或提出改进建议。
+
+参与开发：
+
+```bash
+git clone https://github.com/djsaber/OURO.git
+cd OURO
+uv sync --frozen --all-groups
+uv run --frozen ouro
+```
+
+## 开源协议
+
+OURO 是完全开源的项目，采用 [MIT License](https://github.com/djsaber/OURO/blob/main/LICENSE)，允许使用、修改与分发。欢迎参与改进，也欢迎构建适合自己的插件。

ouro_agent-0.2.0/README.md

@@ -0,0 +1,168 @@
+# OURO
+
+[![PyPI](https://img.shields.io/pypi/v/ouro-agent?color=2563eb)](https://pypi.org/project/ouro-agent/)
+[![Python 3.14+](https://img.shields.io/badge/Python-3.14%2B-3776ab)](https://www.python.org/downloads/)
+[![MIT License](https://img.shields.io/badge/License-MIT-16a34a)](https://github.com/djsaber/OURO/blob/main/LICENSE)
+
+**本地优先、可灵活拓展的个人智能体。**
+
+OURO 让你在终端中与模型协作，处理文件、调用工具、管理会话和执行持续任务。它提供全屏交互界面，也可以通过命令行完成单次任务或输出 JSON。会话与配置保存在本地，模型服务由你选择。
+
+插件是 OURO 的核心拓展机制：除了工具、Skills 和 MCP，还可以拓展模型接入、智能体运行方式、后台任务及插件间协作，按需安装、启用和停用。
+
+![OURO v0.2.0 的终端交互界面](https://raw.githubusercontent.com/djsaber/OURO/v0.2.0/docs/assets/tui-welcome.png)
+
+*OURO v0.2.0 实际界面 · Horizon 欢迎页 · 尚未配置模型的初始状态*
+
+[使用文档](https://github.com/djsaber/OURO/blob/main/docs/README.md) · [版本记录](https://github.com/djsaber/OURO/blob/main/CHANGELOG.md) · [源码](https://github.com/djsaber/OURO) · [问题反馈](https://github.com/djsaber/OURO/issues)
+
+## 为你的工作方式而拓展
+
+| 能力 | 你可以做什么 |
+| --- | --- |
+| 终端协作 | 在全屏 TUI 中交互，或通过 CLI 完成单次任务、输出 JSON。 |
+| 本地资料 | 读取、编辑和搜索文件，使用附件及模型支持的图片、音频或视频输入。 |
+| 持续任务 | 保存和恢复会话，通过子智能体、Goal / Plan 拆分任务、管理目标与计划。 |
+| 模型与工具 | 配置多家模型供应商、兼容接口和 MCP 服务，为任务选择合适能力。 |
+| 可组合插件 | 按需拓展工具、Skills、模型接入、智能体循环、插件协作与后台调度。 |
+| 执行控制 | 通过权限、人工审批、取消操作和运行预算控制执行，查看用量与历史。 |
+
+## 安装
+
+OURO 需要 **Python 3.14 或更高版本**。建议使用支持 Unicode 的现代终端。
+
+### 使用 uv 安装（推荐）
+
+安装 [uv](https://docs.astral.sh/uv/getting-started/installation/) 后执行：
+
+```bash
+uv tool install --python 3.14 ouro-agent
+ouro --version
+```
+
+uv 会为 OURO 创建独立环境，并按需安装所需 Python。若终端提示找不到 `ouro`，执行 `uv tool update-shell` 后重新打开终端。
+
+### 使用 pip 安装
+
+如果已经有 Python 3.14+ 环境，也可以安装到自己的虚拟环境中：
+
+```bash
+python -m pip install ouro-agent
+ouro --version
+```
+
+PyPI 包名是 `ouro-agent`，安装后的命令是 `ouro`。
+
+## 第一次使用
+
+### 1. 配置模型
+
+使用真实模型需要对应供应商的账户与凭据。OURO 不附带模型权重或 API 额度；尚未配置供应商时，内置 Faux 仅提供离线演示，不是真实模型。
+
+下面以 OpenAI API 为例。先在当前终端设置自己的 API Key：
+
+**Windows PowerShell：**
+
+```powershell
+$env:OPENAI_API_KEY = "替换为你的 API Key"
+```
+
+**macOS / Linux（bash 或 zsh）：**
+
+```bash
+export OPENAI_API_KEY="替换为你的 API Key"
+```
+
+再添加供应商并设为默认：
+
+```bash
+ouro provider add "OpenAI" --type openai --api-key-env OPENAI_API_KEY --default
+```
+
+以上环境变量设置只对当前终端及其子进程生效。重新打开终端后，需要重新设置，或通过系统环境变量管理保存。OURO 配置中记录的是变量名。
+
+你也可以通过 `ouro provider templates` 查看其他内置供应商模板，或在交互界面按 `Ctrl+P`，进入 `Manage providers` 管理供应商。模型是否可用取决于你的账户权限和供应商支持范围。
+
+### 2. 启动交互界面
+
+在想要处理的工作目录中执行：
+
+```bash
+ouro
+```
+
+输入任务即可开始。`Ctrl+P` 打开操作菜单，`/help` 查看快捷键与命令帮助。
+
+### 3. 尝试命令行任务
+
+```bash
+# 文本输出
+ouro run --print "说明当前目录的用途，并给出整理建议"
+
+# JSON 输出，便于脚本集成
+ouro run --json "总结本次任务"
+
+# 查看帮助
+ouro --help
+```
+
+只想先检查安装是否正常，可以在独立数据目录运行离线演示，无需 API Key：
+
+```bash
+ouro run --print --home ./.ouro-demo "hello"
+```
+
+## 按需增加能力
+
+OURO 提供稳定的运行框架，插件作为独立拓展包接入。你可以从工具和 Skills 开始，也可以通过插件定制智能体的执行方式、模型接入、服务协作和后台任务。
+
+插件管理入口可通过 `ouro plugin --help` 查看。请只安装并启用你信任的插件；插件和工具可能读写文件、执行程序或连接外部服务。
+
+## 数据保存在哪里
+
+默认数据目录为用户主目录下的 `.ouro`，用于保存配置、会话及运行记录。可以用 `--home` 为不同用途选择独立目录：
+
+```bash
+ouro --home ./.ouro-work
+ouro session list --home ./.ouro-work
+```
+
+目录选择顺序为：`--home`、环境变量 `OURO_HOME`、默认的 `~/.ouro`。本地保存不代表所有处理都离线；模型请求会发送到你配置的服务。
+
+升级前建议备份数据。当前版本会明确拒绝不受支持的旧数据格式，不会自动迁移或清空原数据；需要隔离体验时可使用新的 `--home` 目录。
+
+## 升级
+
+使用 uv 安装：
+
+```bash
+uv tool upgrade ouro-agent
+```
+
+使用 pip 安装：
+
+```bash
+python -m pip install --upgrade ouro-agent
+```
+
+## 文档与源码
+
+完整源码位于 [GitHub](https://github.com/djsaber/OURO)，安装包和源码包发布在 [PyPI](https://pypi.org/project/ouro-agent/)。
+
+- [文档入口](https://github.com/djsaber/OURO/blob/main/docs/README.md)：使用指南、插件开发、配置说明与运行契约。
+- [更新记录](https://github.com/djsaber/OURO/blob/main/CHANGELOG.md)：各版本的主要改进与兼容性说明。
+- [贡献指南](https://github.com/djsaber/OURO/blob/main/CONTRIBUTING.md)：开发流程与验证要求。
+- [问题反馈](https://github.com/djsaber/OURO/issues)：报告问题或提出改进建议。
+
+参与开发：
+
+```bash
+git clone https://github.com/djsaber/OURO.git
+cd OURO
+uv sync --frozen --all-groups
+uv run --frozen ouro
+```
+
+## 开源协议
+
+OURO 是完全开源的项目，采用 [MIT License](https://github.com/djsaber/OURO/blob/main/LICENSE)，允许使用、修改与分发。欢迎参与改进，也欢迎构建适合自己的插件。

ouro_agent-0.2.0/RELEASING.md

@@ -0,0 +1,49 @@
+# Release Process
+
+Release versions are owned by `pyproject.toml`, `ouro.__version__`, the lockfile, and release tags.
+Completion of a feature milestone does not change those metadata automatically. Supported interfaces
+and persistence formats are defined in the [current specs](docs/specs/README.md).
+Unsupported stored formats fail explicitly; the current implementation does not provide historical
+format adapters or migration commands.
+
+OURO uses the [MIT License](LICENSE). Release metadata must declare MIT, and both wheel and source
+archives must include the license text. Dependencies retain their own licenses.
+
+For a release:
+
+1. Update [CHANGELOG.md](CHANGELOG.md) for every version iteration. Keep entries in reverse
+   chronological order with a version, release date and concise user-facing improvements. Summarize
+   material compatibility impact, validation scope and known limitations; link to detailed records
+   instead of including implementation details, test logs or a commit-by-commit history. Preserve
+   earlier entries and label historical development versions without inventing release dates.
+   Verify the [capability overview](docs/overview.md) and affected specs against the release candidate.
+2. Update `pyproject.toml` and `ouro.__version__`, align plugin host-version ranges, and regenerate `uv.lock`.
+3. Run the full commands from `CONTRIBUTING.md`, including the coverage floor.
+4. Build with `uv build` and inspect both wheel and source archive for secrets and unintended files.
+5. Test installation and `ouro --help` from a clean environment.
+6. Commit the release metadata, create an annotated `vX.Y.Z` tag, and publish release notes from
+   the reviewed changelog entry. Keep guides and specs focused on current behavior; release history
+   belongs in the changelog.
+
+The public package index is PyPI, under the distribution name `ouro-agent`. Local publication uses
+an API token supplied through `UV_PUBLISH_TOKEN`; do not place credentials in source files, command
+arguments or release notes. CI publication and signing are not automated; configure Trusted Publishing
+before adding unattended CI uploads.
+
+Before uploading, validate the user-facing README with `twine check --strict`, verify that its examples
+work from an installed distribution, and use absolute links that also work on PyPI. Keep screenshots
+in `docs/assets/`, capture real application state without private data, and link the published image
+through an immutable release tag. Verify that all public links resolve before uploading. Keep the exact
+version's wheel and source archive aligned with its release commit and tag. Pass those two filenames
+explicitly to `uv publish` so older files in `dist/` are not uploaded. After uploading, verify PyPI's
+version metadata, description and file hashes, and check installation from the published index.
+
+During `0.x` development, use a new minor version for a capability milestone or incompatible public
+contract change, and a patch version for compatible fixes. Plugin API, worker protocol, package and
+stored-data versions remain separate contracts; changing the product version does not migrate them.
+Keep plugin host-version ranges in builtins, scaffolds, examples and fixtures aligned with the release.
+Runtime version reporting and installation provenance use `ouro.__version__`.
+
+A release commit records the reviewed changes; an annotated `vX.Y.Z` tag identifies that exact
+snapshot. A separate release branch is only needed when maintaining parallel release lines. Local
+commits and tags do not push to a remote or publish a package.

ouro_agent-0.2.0/SECURITY.md

@@ -0,0 +1,32 @@
+# Security Policy
+
+## Supported code
+
+Security fixes target the current default branch. Any maintained release branches must be
+explicitly identified in their release notes; this policy does not infer support from the package
+version or a completed feature milestone. Older snapshots are not maintained as separate security branches.
+
+## Reporting a vulnerability
+
+Do not open a public issue for a suspected vulnerability. Prefer the repository's private
+GitHub Security Advisory flow. If that facility is unavailable, contact a maintainer through a
+private channel and include the affected revision, impact, reproduction steps, and any proposed
+mitigation. Avoid including real credentials or private user data in the report.
+
+Maintainers should acknowledge the report, reproduce and classify it, prepare a regression test
+and fix, and coordinate disclosure after supported users have an upgrade path. Exact response
+times depend on maintainer availability and are not guaranteed.
+
+## Security boundaries
+
+- `deny` is the hard tool-disable policy; `approval` is a human authorization boundary.
+- Workspace-only mode constrains built-in file paths and detected-shell working directories. It is not an
+  operating-system sandbox: an approved shell command can still access resources allowed to the
+  OURO process.
+- Prefer environment-backed credential references. Inline credentials are stored as local plain
+  text even though public DTO and CLI output redact them.
+- MCP servers, plugins, Skills, imported resources, and model-produced tool arguments are
+  untrusted input. Review their provenance and permissions before enabling them.
+
+Reports involving credential disclosure, path escape, command execution without authorization,
+resource integrity bypass, or cross-Session state corruption should be treated as high priority.

ouro_agent-0.2.0/dev/README.md

@@ -0,0 +1,10 @@
+# 开发工具
+
+本目录保存开发和验证工具；产品说明、领域规格和规划统一从[文档中心](../docs/README.md)进入。
+
+| 目录 | 用途 | 使用前提 |
+|---|---|---|
+| [benchmarks](benchmarks/README.md) | 本地性能测量、存储同步和响应性采样 | 使用临时数据，记录平台、规模和样本数 |
+| [probes](probes/README.md) | 显式授权的订阅协议与真实服务验证 | 人工参与授权，避免保存或输出秘密 |
+
+基准结果不等于真实终端或外部服务的性能保证。联网探针与普通离线测试分开运行；开发门禁见[贡献指南](../CONTRIBUTING.md)。