ouroboros-ai 0.26.2.dev35__tar.gz → 0.26.2.dev37__tar.gz

{ouroboros_ai-0.26.2.dev35 → ouroboros_ai-0.26.2.dev37}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ouroboros-ai
-Version: 0.26.2.dev35
+Version: 0.26.2.dev37
 Summary: Specification-first workflow engine for AI coding agents. Works with Claude Code and Codex CLI.
 Author-email: Q00 <jqyu.lee@gmail.com>
 License-File: LICENSE
@@ -78,26 +78,12 @@ Description-Content-Type: text/markdown
 
 ---
 
-> **Security Notice (2026-03-24): LiteLLM PyPI Supply Chain Attack**
+> **New: PM Mode** — `ooo pm` generates a PRD through a guided PM-focused interview.
+> Ouroboros now supports product management workflows: stakeholder alignment, user story mapping, and structured PRD generation — all driven by the same Socratic engine.
 >
-> LiteLLM versions **1.82.7** and **1.82.8** on PyPI contained a malicious `.pth` file that auto-executes on every Python startup, exfiltrating environment variables, API keys, and credentials to an external server.
->
-> **What we did:** Ouroboros now pins LiteLLM to **`<=1.82.6`** (safe versions only) as an optional dependency. LiteLLM is no longer a core dependency — it is only installed when you explicitly opt in via `pip install ouroboros-ai[litellm]`.
->
-> **If you previously installed litellm 1.82.7 or 1.82.8**, the malicious `.pth` file may still be on your system even after upgrading. Clean up manually:
->
-> ```bash
-> # 1. Find and delete the malicious file
-> find / -name "litellm_init.pth" 2>/dev/null
->
-> # 2. Clean package manager caches
-> uv cache clean litellm    # if using uv
-> pip cache purge            # if using pip
->
-> # 3. Rotate ALL credentials that were on your system during the exposure window
 > ```
->
-> References: [LiteLLM #24512](https://github.com/BerriAI/litellm/issues/24512) · [Ouroboros #195](https://github.com/Q00/ouroboros/issues/195) · [DSPy mitigation](https://github.com/stanfordnlp/dspy/commit/66e33399bf29)
+> > ooo pm "I want to build a notification system"
+> ```
 
 ---
 
@@ -148,6 +134,7 @@ Then run `ooo setup` inside a Claude Code session.
 ```bash
 pip install ouroboros-ai                # base
 pip install ouroboros-ai[claude]        # + Claude Code deps
+pip install ouroboros-ai[litellm]       # + LiteLLM multi-provider
 pip install ouroboros-ai[all]           # everything
 ouroboros setup                         # configure runtime
 ```
@@ -259,6 +246,10 @@ Inside AI coding agent sessions, use `ooo <cmd>` skills. From the terminal, use
 | `ooo ralph` | *(via MCP)* | Persistent loop until verified |
 | `ooo tutorial` | *(interactive)* | Interactive hands-on learning |
 | `ooo help` | `ouroboros --help` | Full reference |
+| `ooo pm` | *(via MCP)* | PM-focused interview + PRD generation |
+| `ooo qa` | *(via skill)* | General-purpose QA verdict for any artifact |
+| `ooo update` | `ouroboros update` | Check for updates + upgrade to latest |
+| `ooo brownfield` | *(via skill)* | Scan and manage brownfield repo defaults |
 
 > Not all skills have direct CLI equivalents. Some (`evaluate`, `evolve`, `unstuck`, `ralph`) are available through agent skills or MCP tools only.
 

{ouroboros_ai-0.26.2.dev35 → ouroboros_ai-0.26.2.dev37}/README.ko.md

@@ -37,30 +37,12 @@
 
 ---
 
-> **보안 공지 (2026-03-24): LiteLLM PyPI 공급망 공격**
+> **New: PM 모드** — `ooo pm`으로 소크라테스식 PM 인터뷰를 통해 PRD를 자동 생성할 수 있습니다.
+> 이해관계자 정렬, 유저 스토리 매핑, 구조화된 PRD 생성까지 — 같은 소크라테스 엔진이 제품 관리 워크플로우도 지원합니다.
 >
-> LiteLLM 1.82.7 / 1.82.8 버전에 악성 `.pth` 파일이 포함되어 배포되었습니다. 이 파일은 `import` 없이도 **Python 시작 시 자동 실행**되며, 환경변수, API 키, SSH 키, 클라우드 크레덴셜을 외부 서버로 전송합니다.
->
-> **영향 범위:** 2026년 3월 23일 이후에 아래 중 하나라도 해당되면 감염 가능성이 있습니다:
-> - Ouroboros를 신규 설치 (`pip install ouroboros-ai`, `uv tool install ouroboros-ai`)
-> - 기존 설치를 업그레이드 (`pip install --upgrade ouroboros-ai`)
->
-> 두 경우 모두 `litellm>=1.80.0` 의존성이 악성 버전 1.82.7/1.82.8로 resolve됩니다. 그 이전에 설치하고 재설치/업그레이드하지 않았다면 안전합니다.
->
-> **Ouroboros는 litellm 의존성을 완전 제거했습니다** (v0.25.2 stable / v0.26.0b7 beta). 단, **Ouroboros를 업데이트하면 의존성 목록에서 litellm이 빠질 뿐, 이미 설치된 litellm 패키지와 악성 `.pth` 파일은 그대로 남아있습니다.** 수동 정리가 필요합니다:
->
-> ```bash
-> # 1. 악성 파일 찾기 — 결과가 나오면 즉시 삭제
-> find / -name "litellm_init.pth" 2>/dev/null
->
-> # 2. 패키지 매니저 캐시 정리
-> uv cache clean litellm    # uv 사용자
-> pip cache purge            # pip 사용자
->
-> # 3. 노출 기간 동안 시스템에 있던 모든 크레덴셜 로테이션
 > ```
->
-> 참고: [LiteLLM #24512](https://github.com/BerriAI/litellm/issues/24512) · [Ouroboros #195](https://github.com/Q00/ouroboros/issues/195) · [분석 보고서](https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/)
+> > ooo pm "알림 시스템을 만들고 싶어"
+> ```
 
 ---
 
@@ -136,6 +118,7 @@ Claude Code 세션 안에서 `ooo setup` 실행.
 ```bash
 pip install ouroboros-ai                # 기본
 pip install ouroboros-ai[claude]        # + Claude Code 의존성
+pip install ouroboros-ai[litellm]       # + LiteLLM 멀티 프로바이더
 pip install ouroboros-ai[all]           # 전부
 ouroboros setup                         # 런타임 설정
 ```
@@ -283,6 +266,11 @@ Gen 3: {Task, Priority, Status, DueDate}     → similarity 1.00 → CONVERGED
 | `ooo ralph` | 검증될 때까지 계속 도는 루프 |
 | `ooo tutorial` | 대화형 실습 |
 | `ooo help` | 전체 참조 |
+| `ooo pm` | PM 인터뷰 + PRD 생성 |
+| `ooo qa` | 범용 QA 판정 |
+| `ooo cancel` | 멈춘 실행 취소 |
+| `ooo update` | 최신 버전 확인 + 업그레이드 |
+| `ooo brownfield` | 기존 저장소 스캔 + 기본값 관리 |
 
 ---
 

{ouroboros_ai-0.26.2.dev35 → ouroboros_ai-0.26.2.dev37}/README.md

@@ -38,26 +38,12 @@
 
 ---
 
-> **Security Notice (2026-03-24): LiteLLM PyPI Supply Chain Attack**
+> **New: PM Mode** — `ooo pm` generates a PRD through a guided PM-focused interview.
+> Ouroboros now supports product management workflows: stakeholder alignment, user story mapping, and structured PRD generation — all driven by the same Socratic engine.
 >
-> LiteLLM versions **1.82.7** and **1.82.8** on PyPI contained a malicious `.pth` file that auto-executes on every Python startup, exfiltrating environment variables, API keys, and credentials to an external server.
->
-> **What we did:** Ouroboros now pins LiteLLM to **`<=1.82.6`** (safe versions only) as an optional dependency. LiteLLM is no longer a core dependency — it is only installed when you explicitly opt in via `pip install ouroboros-ai[litellm]`.
->
-> **If you previously installed litellm 1.82.7 or 1.82.8**, the malicious `.pth` file may still be on your system even after upgrading. Clean up manually:
->
-> ```bash
-> # 1. Find and delete the malicious file
-> find / -name "litellm_init.pth" 2>/dev/null
->
-> # 2. Clean package manager caches
-> uv cache clean litellm    # if using uv
-> pip cache purge            # if using pip
->
-> # 3. Rotate ALL credentials that were on your system during the exposure window
 > ```
->
-> References: [LiteLLM #24512](https://github.com/BerriAI/litellm/issues/24512) · [Ouroboros #195](https://github.com/Q00/ouroboros/issues/195) · [DSPy mitigation](https://github.com/stanfordnlp/dspy/commit/66e33399bf29)
+> > ooo pm "I want to build a notification system"
+> ```
 
 ---
 
@@ -108,6 +94,7 @@ Then run `ooo setup` inside a Claude Code session.
 ```bash
 pip install ouroboros-ai                # base
 pip install ouroboros-ai[claude]        # + Claude Code deps
+pip install ouroboros-ai[litellm]       # + LiteLLM multi-provider
 pip install ouroboros-ai[all]           # everything
 ouroboros setup                         # configure runtime
 ```
@@ -219,6 +206,10 @@ Inside AI coding agent sessions, use `ooo <cmd>` skills. From the terminal, use
 | `ooo ralph` | *(via MCP)* | Persistent loop until verified |
 | `ooo tutorial` | *(interactive)* | Interactive hands-on learning |
 | `ooo help` | `ouroboros --help` | Full reference |
+| `ooo pm` | *(via MCP)* | PM-focused interview + PRD generation |
+| `ooo qa` | *(via skill)* | General-purpose QA verdict for any artifact |
+| `ooo update` | `ouroboros update` | Check for updates + upgrade to latest |
+| `ooo brownfield` | *(via skill)* | Scan and manage brownfield repo defaults |
 
 > Not all skills have direct CLI equivalents. Some (`evaluate`, `evolve`, `unstuck`, `ralph`) are available through agent skills or MCP tools only.
 

{ouroboros_ai-0.26.2.dev35 → ouroboros_ai-0.26.2.dev37}/scripts/keyword-detector.py

@@ -19,7 +19,11 @@ import sys
 
 # Skills that work without MCP setup (bypass the setup gate)
 # qa has a built-in fallback that adopts the qa-judge agent directly
-SETUP_BYPASS_SKILLS = ["/ouroboros:setup", "/ouroboros:help", "/ouroboros:qa"]
+SETUP_BYPASS_SKILLS = [
+    "/ouroboros:setup",
+    "/ouroboros:help",
+    "/ouroboros:qa",
+]
 
 # Keyword → skill mapping
 # "ooo <cmd>" prefix always works; natural language keywords also supported
@@ -37,9 +41,22 @@ KEYWORD_MAP = [
     {"patterns": ["ooo welcome"], "skill": "/ouroboros:welcome"},
     {"patterns": ["ooo setup"], "skill": "/ouroboros:setup"},
     {"patterns": ["ooo help"], "skill": "/ouroboros:help"},
+    {"patterns": ["ooo pm", "ooo prd"], "skill": "/ouroboros:pm"},
     {"patterns": ["ooo qa", "qa check", "quality check"], "skill": "/ouroboros:qa"},
+    {"patterns": ["ooo cancel", "ooo abort"], "skill": "/ouroboros:cancel"},
     {"patterns": ["ooo update", "ooo upgrade"], "skill": "/ouroboros:update"},
+    {"patterns": ["ooo brownfield"], "skill": "/ouroboros:brownfield"},
     # Natural language triggers
+    # PM triggers must precede generic interview to avoid "pm interview" being shadowed
+    {
+        "patterns": [
+            "write prd",
+            "pm interview",
+            "product requirements",
+            "create prd",
+        ],
+        "skill": "/ouroboros:pm",
+    },
     {
         "patterns": [
             "interview me",
@@ -97,6 +114,22 @@ KEYWORD_MAP = [
         "patterns": ["update ouroboros", "upgrade ouroboros"],
         "skill": "/ouroboros:update",
     },
+    {
+        "patterns": [
+            "cancel execution",
+            "stop job",
+            "kill stuck",
+            "abort execution",
+        ],
+        "skill": "/ouroboros:cancel",
+    },
+    {
+        "patterns": [
+            "brownfield defaults",
+            "brownfield scan",
+        ],
+        "skill": "/ouroboros:brownfield",
+    },
 ]
 
 

{ouroboros_ai-0.26.2.dev35 → ouroboros_ai-0.26.2.dev37}/skills/help/SKILL.md

@@ -41,6 +41,11 @@ Ouroboros is a **requirement crystallization engine** for AI workflows. It trans
 | `ooo welcome` | First-touch welcome guide | Plugin |
 | `ooo tutorial` | Interactive hands-on learning | Plugin |
 | `ooo help` | This reference guide | Plugin |
+| `ooo pm` | PM-focused interview + PRD generation | MCP |
+| `ooo qa` | General-purpose QA verdict for any artifact | Plugin |
+| `ooo cancel` | Cancel stuck or orphaned executions | CLI |
+| `ooo update` | Check for updates + upgrade to latest | Plugin |
+| `ooo brownfield` | Scan and manage brownfield repo defaults | MCP |
 
 ### Evolutionary Loop
 
@@ -63,6 +68,16 @@ Ouroboros is a **requirement crystallization engine** for AI workflows. It trans
 | "think sideways", "i'm stuck", "break through", "lateral thinking" | `ooo unstuck` |
 | "am I drifting?", "drift check", "session status" | `ooo status` |
 
+### Utility Triggers
+
+| Phrase | Triggers |
+|--------|----------|
+| "write prd", "pm interview", "product requirements", "create prd" | `ooo pm` |
+| "qa check", "quality check" | `ooo qa` |
+| "cancel execution", "stop job", "kill stuck", "abort execution" | `ooo cancel` |
+| "update ouroboros", "upgrade ouroboros" | `ooo update` |
+| "brownfield defaults", "brownfield scan" | `ooo brownfield` |
+
 ### Loop Triggers
 
 | Phrase | Triggers |
@@ -86,6 +101,11 @@ Ouroboros is a **requirement crystallization engine** for AI workflows. It trans
 | `/ouroboros:setup` | Installation wizard | Plugin |
 | `/ouroboros:tutorial` | Interactive hands-on learning | Plugin |
 | `/ouroboros:help` | This guide | Plugin |
+| `/ouroboros:pm` | PM-focused interview + PRD generation | MCP |
+| `/ouroboros:qa` | General-purpose QA verdict for any artifact | Plugin |
+| `/ouroboros:cancel` | Cancel stuck or orphaned executions | CLI |
+| `/ouroboros:update` | Check for updates + upgrade to latest | Plugin |
+| `/ouroboros:brownfield` | Scan and manage brownfield repo defaults | MCP |
 
 ### Loop Skills
 

{ouroboros_ai-0.26.2.dev35 → ouroboros_ai-0.26.2.dev37}/src/ouroboros/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.26.2.dev35'
-__version_tuple__ = version_tuple = (0, 26, 2, 'dev35')
+__version__ = version = '0.26.2.dev37'
+__version_tuple__ = version_tuple = (0, 26, 2, 'dev37')
 
 __commit_id__ = commit_id = None

{ouroboros_ai-0.26.2.dev35 → ouroboros_ai-0.26.2.dev37}/src/ouroboros/cli/commands/run.py

@@ -20,6 +20,7 @@ if TYPE_CHECKING:
 
 from ouroboros.cli.formatters import console
 from ouroboros.cli.formatters.panels import print_error, print_info, print_success, print_warning
+from ouroboros.core.project_paths import resolve_seed_project_path
 from ouroboros.core.security import InputValidator
 from ouroboros.core.worktree import (
     TaskWorkspace,
@@ -27,6 +28,7 @@ from ouroboros.core.worktree import (
     maybe_prepare_task_workspace,
     maybe_restore_task_workspace,
 )
+from ouroboros.evaluation.verification_artifacts import build_verification_artifacts
 
 
 class _DefaultWorkflowGroup(typer.core.TyperGroup):
@@ -101,6 +103,12 @@ def _load_seed_from_yaml(seed_file: Path) -> dict[str, Any]:
         raise typer.Exit(1) from e
 
 
+def _resolve_cli_project_dir(seed: "Seed", seed_file: Path) -> Path:
+    """Resolve the project directory for CLI execution and verification."""
+    stable_base = seed_file.parent.resolve()
+    return resolve_seed_project_path(seed, stable_base=stable_base) or stable_base
+
+
 async def _initialize_mcp_manager(
     config_path: Path,
     tool_prefix: str,  # noqa: ARG001
@@ -218,6 +226,7 @@ async def _run_orchestrator(
     event_store = EventStore(f"sqlite+aiosqlite:///{db_path}")
     await event_store.initialize()
 
+    project_dir = _resolve_cli_project_dir(seed, seed_file)
     session_repo = SessionRepository(event_store)
     workspace: TaskWorkspace | None = None
     execution_id: str | None = None
@@ -235,14 +244,14 @@ async def _run_orchestrator(
             workspace = maybe_restore_task_workspace(
                 resume_session,
                 persisted,
-                fallback_source_cwd=Path.cwd(),
+                fallback_source_cwd=project_dir,
             )
             session_id_for_run = resume_session
             execution_id = reconstructed.value.execution_id
         else:
             session_id_for_run = f"orch_{uuid4().hex[:12]}"
             execution_id = f"exec_{uuid4().hex[:12]}"
-            workspace = maybe_prepare_task_workspace(Path.cwd(), session_id_for_run)
+            workspace = maybe_prepare_task_workspace(project_dir, session_id_for_run)
     except WorktreeError as e:
         print_error(f"Task workspace error: {e.message}")
         raise typer.Exit(1) from e
@@ -253,7 +262,7 @@ async def _run_orchestrator(
 
     adapter = create_agent_runtime(
         backend=runtime_backend,
-        cwd=Path(workspace.effective_cwd) if workspace else Path.cwd(),
+        cwd=Path(workspace.effective_cwd) if workspace else project_dir,
     )
     runner = OrchestratorRunner(
         adapter,
@@ -301,12 +310,28 @@ async def _run_orchestrator(
                     print_info("Running post-execution QA...")
                     qa_handler = QAHandler()
                     quality_bar = _derive_quality_bar(seed)
+                    execution_artifact = _get_verification_artifact(res.summary, res.final_message)
+                    verification_working_dir = (
+                        Path(workspace.effective_cwd) if workspace is not None else project_dir
+                    )
+                    try:
+                        verification = await build_verification_artifacts(
+                            res.execution_id,
+                            execution_artifact,
+                            verification_working_dir,
+                        )
+                        artifact = verification.artifact
+                        reference = verification.reference
+                    except Exception as e:
+                        artifact = execution_artifact
+                        reference = f"Verification artifact generation failed: {e}"
 
                     qa_result = await qa_handler.handle(
                         {
-                            "artifact": _get_verification_artifact(res.summary, res.final_message),
+                            "artifact": artifact,
                             "artifact_type": "test_output",
                             "quality_bar": quality_bar,
+                            "reference": reference,
                             "seed_content": yaml.dump(seed_data, default_flow_style=False),
                             "pass_threshold": 0.80,
                         }

ouroboros_ai-0.26.2.dev37/src/ouroboros/core/project_paths.py

@@ -0,0 +1,59 @@
+"""Helpers for resolving project directories from seed and runtime context."""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any
+
+
+def resolve_path_against_base(raw_path: str | Path | None, *, stable_base: Path) -> Path | None:
+    """Resolve a path against a stable base directory."""
+    if raw_path is None:
+        return None
+
+    candidate = Path(raw_path).expanduser()
+    if candidate.is_absolute():
+        return candidate.resolve()
+    return (stable_base / candidate).resolve()
+
+
+def project_path_candidates_from_seed(seed: Any) -> tuple[str, ...]:
+    """Extract likely project directories from seed metadata and brownfield refs."""
+    if seed is None:
+        return ()
+
+    candidates: list[str] = []
+    seed_meta = getattr(seed, "metadata", None)
+    if seed_meta is not None:
+        project_dir = getattr(seed_meta, "project_dir", None) or getattr(
+            seed_meta,
+            "working_directory",
+            None,
+        )
+        if isinstance(project_dir, str) and project_dir:
+            candidates.append(project_dir)
+
+    brownfield_context = getattr(seed, "brownfield_context", None)
+    context_references = getattr(brownfield_context, "context_references", ()) or ()
+
+    for reference in context_references:
+        path = getattr(reference, "path", None)
+        role = getattr(reference, "role", None)
+        if isinstance(path, str) and path and role == "primary":
+            candidates.append(path)
+
+    for reference in context_references:
+        path = getattr(reference, "path", None)
+        if isinstance(path, str) and path and path not in candidates:
+            candidates.append(path)
+
+    return tuple(candidates)
+
+
+def resolve_seed_project_path(seed: Any, *, stable_base: Path) -> Path | None:
+    """Resolve the highest-priority project path encoded in a seed."""
+    for candidate in project_path_candidates_from_seed(seed):
+        resolved = resolve_path_against_base(candidate, stable_base=stable_base)
+        if resolved is not None:
+            return resolved
+    return None