papaya-agent-client 0.9.0__tar.gz

papaya_agent_client-0.9.0/.claude-plugin/marketplace.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://anthropic.com/claude-code/marketplace.schema.json",
+  "name": "papaya-agent-client",
+  "description": "Papaya connector plugin: MCP setup, auth, and durable agent context for Claude Code.",
+  "owner": {
+    "name": "Papaya",
+    "email": "team@trypapaya.ai"
+  },
+  "plugins": [
+    {
+      "name": "papaya",
+      "description": "Connect Claude Code to Papaya as one of your workspace agents, with persona, rules, and memories imported at session start.",
+      "author": {
+        "name": "Papaya"
+      },
+      "source": "./papaya_agent_client/plugin",
+      "category": "productivity",
+      "homepage": "https://trypapaya.ai"
+    }
+  ]
+}

papaya_agent_client-0.9.0/.github/workflows/release.yml

@@ -0,0 +1,146 @@
+name: release
+
+# Pushing a tag `v<version>` publishes both halves of the client: the Python
+# package `papaya-agent-client` to PyPI, and the npm shim `papaya-agent` that
+# bootstraps it. They always ship together and always carry the same version.
+#
+# There are NO long-lived registry tokens and no repository secrets. Both
+# registries accept trusted publishing: GitHub mints a short-lived OIDC token
+# for this workflow run, the registry checks that the run really came from
+# this repository, this file and the named environment, and the upload is
+# signed with a provenance attestation the registry publishes alongside it.
+#
+# One-time setup on each registry (an owner does this in a browser, once):
+#
+#   PyPI   https://pypi.org/manage/account/publishing/ -> "Add a new pending
+#          publisher": project `papaya-agent-client`, owner `Papaya-HQ`,
+#          repository `papaya-agent-client`, workflow `release.yml`,
+#          environment `pypi`. A pending publisher lets the FIRST release
+#          create the project; afterwards it lives under the project's own
+#          Publishing settings.
+#
+#   npm    The registry only lets an existing package name a trusted
+#          publisher, so the FIRST `papaya-agent` release is `npm publish`
+#          from a maintainer's own machine (interactive 2FA, no token
+#          stored anywhere). Then, on https://www.npmjs.com/package/papaya-agent
+#          -> Settings -> Trusted Publisher: GitHub Actions, organization
+#          `Papaya-HQ`, repository `papaya-agent-client`, workflow
+#          `release.yml`, environment `npm`. Every later tag publishes from
+#          here with provenance and no token.
+#
+# Layout follows the registries' own guidance: the publish jobs do nothing but
+# publish, hold only the `id-token: write` permission they need, run inside a
+# named GitHub environment (so the registry can pin to it and a reviewer can be
+# required), and consume artifacts built by a separate job that had no
+# publishing rights at all.
+#
+# The version gate runs first and refuses the whole release unless the tag,
+# pyproject.toml and npm/package.json all name the same version.
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions: {}
+
+jobs:
+  verify:
+    name: Version gate and both test suites
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: The tag, pyproject.toml and npm/package.json name one version
+        run: |
+          set -euo pipefail
+          tag_version="${GITHUB_REF_NAME#v}"
+          pyproject_version="$(python3 -c 'import tomllib, pathlib; print(tomllib.loads(pathlib.Path("pyproject.toml").read_text())["project"]["version"])')"
+          npm_version="$(node -p 'require("./npm/package.json").version')"
+          echo "tag=${tag_version} pyproject=${pyproject_version} npm=${npm_version}"
+          if [ "${tag_version}" != "${pyproject_version}" ] || [ "${tag_version}" != "${npm_version}" ]; then
+            echo "::error::version mismatch: tag ${tag_version}, pyproject.toml ${pyproject_version}, npm/package.json ${npm_version}"
+            exit 1
+          fi
+
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.11"
+      - run: uv sync
+      - run: uv run pytest -q
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - run: node --test test/*.test.js
+        working-directory: npm
+
+  build:
+    name: Build the wheel and sdist
+    needs: verify
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.11"
+      - run: uv build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: python-dist
+          path: dist/
+          if-no-files-found: error
+
+  publish-pypi:
+    name: Publish papaya-agent-client to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    # The environment is part of the trusted-publisher identity PyPI checks.
+    environment:
+      name: pypi
+      url: https://pypi.org/project/papaya-agent-client/
+    permissions:
+      # Mint the OIDC token PyPI exchanges for a short-lived upload token.
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: python-dist
+          path: dist/
+      # PyPA's own action: trusted publishing by default, and it generates and
+      # uploads the PEP 740 provenance attestations for every file.
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/
+
+  publish-npm:
+    name: Publish papaya-agent to npm
+    needs: verify
+    runs-on: ubuntu-latest
+    # The environment is part of the trusted-publisher identity npm checks.
+    environment:
+      name: npm
+      url: https://www.npmjs.com/package/papaya-agent
+    permissions:
+      # Read the checkout; mint the OIDC token npm exchanges for a publish.
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          registry-url: "https://registry.npmjs.org"
+      # Trusted publishing needs npm 11.5.1 or later; the npm bundled with a
+      # Node LTS lags, so take the current one.
+      - run: npm install -g npm@latest
+      - run: npm --version
+      # No token anywhere: with a trusted publisher configured, `npm publish`
+      # exchanges the runner's OIDC token itself and attaches provenance
+      # automatically. `--access public` is only needed on the first publish
+      # of an unscoped name, and is harmless afterwards.
+      - run: npm publish --access public
+        working-directory: npm

papaya_agent_client-0.9.0/.github/workflows/test.yml

@@ -0,0 +1,39 @@
+name: test
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  pytest:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: uv sync
+      - run: uv run pytest -q
+
+  # The npm shim has no dependencies and no build step, so `node --test` on a
+  # bare checkout is the whole story.
+  node:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: ["18", "22"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+      # The shell expands the glob, so this is a plain file list on every Node
+      # from 18 on; `node --test` only learned to glob itself much later.
+      - run: node --test test/*.test.js
+        working-directory: npm

papaya_agent_client-0.9.0/.gitignore

@@ -0,0 +1,53 @@
+# Python bytecode and caches
+__pycache__/
+*.py[cod]
+*$py.class
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.pyre/
+.coverage
+.coverage.*
+coverage.xml
+htmlcov/
+
+# Virtual environments
+.venv/
+venv/
+env/
+ENV/
+
+# Build and packaging artifacts
+build/
+dist/
+*.egg-info/
+*.egg
+.eggs/
+
+# Local environment and secrets
+.env
+.env.*
+!.env.example
+.papaya-agent/
+
+# Node (the npm shim under npm/ has no dependencies; these are local artifacts)
+node_modules/
+pnpm-lock.yaml
+package-lock.json
+npm/.uv/
+
+# Tool caches
+.cache/
+.uv-cache/
+
+# Worker evidence, never part of a change
+.mm-evidence/
+
+# Editor, OS, and logs
+.DS_Store
+.idea/
+.vscode/
+*.swp
+*.swo
+*.log
+.gitnexus