productteam 2.3.0__tar.gz

productteam-2.3.0/.github/workflows/publish.yml

@@ -0,0 +1,23 @@
+name: Publish to PyPI
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - run: pip install -e ".[dev]"
+      - run: pytest -m "not live"
+      - run: pip install build
+      - run: python -m build
+      - uses: pypa/gh-action-pypi-publish@release/v1

productteam-2.3.0/.github/workflows/test.yml

@@ -0,0 +1,18 @@
+name: Tests
+
+on: [push, pull_request]
+
+jobs:
+  test:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: pip install -e ".[dev]"
+      - run: pytest -m "not live" --cov=productteam --cov-report=term-missing --cov-fail-under=80

productteam-2.3.0/.gitignore

@@ -0,0 +1,38 @@
+# Environment and secrets
+.env
+.env.local
+.env.*.local
+secrets/
+*.key
+*.pem
+
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+*.egg-info/
+dist/
+build/
+.eggs/
+
+# Node
+node_modules/
+
+# ProductTeam runtime artifacts
+.productteam/
+
+# OS files
+.DS_Store
+Thumbs.db
+Desktop.ini
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# Temporary commit files
+.commit_msg.txt

productteam-2.3.0/CHANGELOG.md

@@ -0,0 +1,152 @@
+# Changelog
+
+## [2.3.0] - 2026-03-26
+
+### Added
+- **Forge daemon stage visibility** — `Supervisor.run()` accepts a `stage_callback` parameter. The Forge daemon passes a callback that updates `current_stage` in the queue at the start of each stage, so the dashboard shows real-time pipeline progress instead of `"-"` throughout the run.
+- **Configurable skills directory** — `skills_dir` field in `[pipeline]` config (default: `.claude/skills`). Users who move their skills directory or use non-standard layouts can set this in `productteam.toml`. Error messages now suggest checking `skills_dir` when a skill is not found.
+- **Design evaluator verdict disk fallback** — when the design evaluator's text response has no parseable verdict, the supervisor checks `eval-*-design.yaml` files on disk. Same pattern as the build evaluator fallback added in v2.2.0. Fixes pipelines reporting "stuck" when the design evaluation actually passed.
+
+### Fixed
+- **`run_bash` WinError production handling** — `_execute_tool` now catches `OSError` separately from generic exceptions, returning a structured JSON error with a descriptive message instead of an opaque crash on Windows when subprocess handles are invalid.
+- **Windows credential filter gaps** — `_validate_command` now blocks PowerShell (`$env:`, `Get-ChildItem Env:`) and .NET (`[System.Environment]::GetEnvironmentVariable`) environment access patterns, matching the existing Unix credential filters.
+- **`run_bash` tests on Windows** — `test_execute_run_bash` and `test_execute_run_bash_timeout` now use `python -c` on Windows instead of `echo`/`sleep` which depend on Unix shell builtins. Tests pass on all platforms.
+- **Doc Writer termination validated** — the prompt-based termination instruction ("stop after writing all files") was confirmed working under live conditions. The Doc Writer exits naturally within the stage timeout. No `max_tool_calls` cap was needed.
+
+### Infrastructure
+- 270 unit tests passing on Windows and Linux (up from 239)
+- Coverage restored to 80% (was 75.8%): mocked provider `complete_with_tools` tests for Gemini/Ollama/OpenAI, supervisor error path and artifact tests, credential filter tests
+- CI matrix expanded: Windows (`windows-latest`) added alongside Ubuntu for all Python versions
+- Windows credential filter tests added for PowerShell and .NET environment access patterns
+- Full pipeline validated end-to-end with fresh `productteam init` + `productteam run` on the bmark reference project
+
+## [2.2.0] - 2026-03-26
+
+### Added
+- **`productteam recover` command** — reads state.json, identifies stuck/running stages, resets them to pending, re-enters pipeline at the stuck stage. Supports `--yes` for non-interactive use. Replaces manual state.json editing after timeouts.
+- **Planner sprint sizing examples** — SKILL.md now includes 2 concrete examples of correctly-sized sprints (small + medium) and an anti-pattern example. Establishes 5-8 deliverable floor/ceiling per sprint.
+- **Verdict parsing disk fallback** — when the Evaluator's text response has no parseable verdict, the supervisor checks `.productteam/evaluations/*.yaml` files written by the Evaluator via write_file. Prevents every sprint returning needs_work when the Evaluator writes structured YAML to disk but its text summary lacks the verdict key. **Note:** This bug existed since the Evaluator became a doer stage in v2.1.0. Any evaluation verdicts from live runs prior to this fix are unreliable — the Evaluator may have written PASS to disk while the supervisor recorded needs_work.
+- **Builder tool budget guidance** — SKILL.md now includes explicit budget: write all files first, test once, then fix. Prevents the Builder from spending all tool calls on exploration.
+
+### Changed
+- `builder_max_tool_calls` default raised from 50 to 75 — 50 was too tight for real sprints with test-fix cycles
+- Planner YAML size limit tightened from 10KB to 6KB
+- Planner deliverable definition tightened: "one file with one purpose" — not a subsystem or feature area
+- `run_bash` tool description updated: tells the model Python/pip are available on PATH
+
+### Fixed
+- **`run_bash` Python PATH injection** — Python executable directory and project `.venv/Scripts` (or `bin` on Linux/macOS) added to subprocess PATH. Fixes Windows environments where bash shells (MSYS2/Git Bash) can't find Python. Cross-platform safe.
+- Inline `import sys` in tool_loop.py moved to module level
+
+### Infrastructure
+- 231 unit tests + 6 live integration tests passing
+- Verdict disk fallback covered by `test_build_evaluate_disk_fallback_finds_pass`
+- Recover command covered by 5 tests (no state, no concept, no stuck, identifies stuck, resets with --yes)
+
+## [2.1.0] - 2026-03-26
+
+### Changed
+- **Planner reclassified as doer** — now uses the tool loop to write sprint YAML files directly to `.productteam/sprints/` via `write_file`. Previously a thinker that produced correct YAML as text but couldn't write to disk, causing the build loop to silently skip.
+- **PRD Writer runs headlessly** — detects automated context and skips clarifying questions and review phases. Applies sensible defaults instead of asking 7 questions nobody will answer.
+- **Planner runs headlessly** — proceeds without asking for human confirmation in auto-approve mode.
+- **Sprint scoping tightened** — "large" scope banned, only small (1-3 files) and medium (4-8 files) allowed. Sprints must be completable in 30-40 tool calls. 6KB YAML size limit.
+- **Design Evaluator** — single-pass evaluation with clear escalation instead of fake retry loop that couldn't route back to Doc Writer.
+- Timeout defaults bumped: stage 120→300s, builder 300→600s, new `planner_timeout_seconds` (600s)
+- `_run_tool_loop_stage` accepts optional `timeout_seconds` override
+- Thinker/doer classification updated across README, landing page, and architecture SVG
+
+### Added
+- `max_sprints` config field (default 8) — bounds the number of sprint contracts the Planner produces, making timeout predictable
+- `planner_timeout_seconds` config field (default 600) — separate timeout for the Planner's multi-file tool loop
+- Loud failure when no sprint YAML files found after plan completes (was a silent skip)
+- Doc Writer guard — skips when no sprints have passed evaluation
+- `require_evaluator` config field now wired — when false, build loop auto-passes without evaluation
+- GatesConfig fields wired — `prd_approval`, `sprint_approval`, `ship_approval` individually control their respective gates
+- `_read_artifact` warns on missing artifact path or file
+- Schema version validated on `state.json` load
+- `handoffs/` directory created by `init_project`
+- PRD Writer Rule 10: no invented product names — uses placeholder `[PRODUCT NAME]` when concept doesn't specify one
+
+### Fixed
+- `os.system()` replaced with `asyncio.create_subprocess_exec` in `_gate`
+- `run_bash` credential filtering hardened — blocks `env | grep`, `/proc/environ`, `echo $SECRET`; fixes `poetry env use` false positive; constants moved to module level
+- `read_file` 100KB size cap with truncation notice
+- Doer stages now use `builder_timeout_seconds` (was incorrectly using `stage_timeout_seconds`)
+- Doc Writer stuck status was silently ignored — now gates pipeline
+- Context summarizer includes MEDIUM findings (was CRITICAL/HIGH only)
+- Evaluator SKILL.md paths fixed: `.claude/` → `.productteam/`
+
+### Infrastructure
+- Publish workflow runs tests before build (pytest gate)
+- Test workflow adds `--cov --cov-fail-under=80` and Python 3.13
+- 231 unit tests + 6 live integration tests passing
+
+### Known Issues
+- Planner sprint sizing needs calibration — produces 9-15KB sprints with 20-31 deliverables; target is 5-8 deliverables under 6KB. Tracked for next session.
+
+## [2.0.2] - 2026-03-26
+
+### Changed
+- **Evaluator reclassified as doer** — now runs via tool loop with file access and test execution, instead of receiving only the Builder's text summary
+- **Doc Writer reclassified as doer** — now reads actual source files before writing documentation, instead of hallucinating from the concept string alone
+- Thinker/doer table updated in README, landing page, and architecture SVG to reflect new classifications
+- Architecture SVG reorganized: thinker section (3 agents), doer section (4 agents) with shared tool sandbox
+
+### Added
+- `productteam test` command — runs offline unit tests by default
+- `productteam test --live` — runs live integration tests against real APIs with safety warnings (masked API key display, cost warning panel, cheapest-model default)
+- `_run_tool_loop_stage()` method in Supervisor for dispatching doer stages
+- 6 live integration tests (provider smoke, thinker stage, tool loop read/write, build-evaluate round-trip)
+- 19 dashboard endpoint tests (`/api/submit` happy path, empty concept, oversized body, malformed header, approve/reject, job listing)
+- 5 full pipeline integration tests (multi-sprint end-to-end, fail-stops-pipeline, resume-skips-completed, sprint sequencing)
+- `tests/conftest.py` with shared `live_provider` and `live_project` fixtures
+- `live` pytest marker for API-calling tests
+
+### Fixed
+- XSS vulnerability in dashboard — all user-supplied values now escaped via `escapeHtml()` before innerHTML insertion
+- Content-Length cap (4KB) and validation on `/api/submit` — malformed headers return 400, oversized bodies return 413
+- Missing `import os` in supervisor.py — `_gate()` edit mode no longer crashes with NameError
+- Operator precedence bug in `_run_single_step` — `sprint` arg no longer silently ignored when sprint list is empty
+- Sprint path mismatch — Builder skill now uses `.productteam/sprints/` matching the Supervisor
+- `builder_timeout_seconds` now wired into `run_tool_loop()` via `stage_timeout_seconds`
+- Design evaluation stage now invoked in `Supervisor.run()` when `require_design_review` is enabled
+- LAN IP detection uses UDP socket method instead of unreliable `socket.gethostbyname()`
+- Removed unused `import time` from supervisor.py
+
+### Meta
+- Test count: 207 unit tests + 6 live integration tests (up from ~150)
+- Version synced across pyproject.toml, `__init__.py`, docs/index.html, docs/architecture.svg
+
+## [2.0.1] - 2026-03-26
+
+### Added
+- Dashboard submit form — submit Forge ideas from any device on your LAN via `http://<your-ip>:7654`
+- Dashboard binds to `0.0.0.0` by default (configurable via `[forge] status_host`)
+- `/api/submit` endpoint on Forge dashboard
+- Technical architecture requirement added to doc-writer skill — all products now produce an architecture SVG and component descriptions
+
+### Changed
+- Version bumped to 2.0.1 across all files
+
+## [2.0.0] - 2026-03-26
+
+### Added
+- Multi-provider LLM abstraction layer (Anthropic, OpenAI, Ollama, Gemini)
+- Supervisor agent — real pipeline orchestration with `productteam run`
+- Thinker/doer architecture — single API calls for planning stages, tool-use loop for builder stages
+- Tool-use loop (`tool_loop.py`) — 4 tools (read_file, write_file, run_bash, list_dir) with security constraints
+- Forge — phone-to-product pipeline with file queue, daemon, dashboard, and notifications
+- `productteam doctor` — 11-check diagnostic command with `--json` and `--no-network` flags
+- Incremental rebuilds — skip passed sprints, `--rebuild` flag for force rebuild
+- State persistence via `state.json` with resume capability
+- Stuck detection — timeout, loop detection, max tool call limits
+- Approval gates with interactive y/N/edit prompt
+- Architecture SVG diagram (`docs/architecture.svg`)
+- Landing page with CLI commands, Forge section, Design Evaluator panel, provider badges
+- GitHub Actions workflows for testing and PyPI publishing
+- Comprehensive test suite (10 test files)
+
+### Changed
+- `productteam run` now executes the full pipeline (previously printed manual instructions)
+- README rewritten with full CLI reference, thinker/doer documentation, and architecture section
+- Doc-writer skill updated to require technical architecture section for all products

productteam-2.3.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Scott Converse
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

productteam-2.3.0/Makefile

@@ -0,0 +1,16 @@
+.PHONY: build publish-test publish lint test
+
+test:
+	pytest tests/ -v
+
+lint:
+	ruff check src/ tests/
+
+build:
+	python -m build
+
+publish-test:
+	python -m twine upload --repository testpypi dist/*
+
+publish:
+	python -m twine upload dist/*