regcode 0.10.0__tar.gz → 0.12.0__tar.gz

{regcode-0.10.0 → regcode-0.12.0}/GOALS.md

@@ -581,3 +581,67 @@ mcp_servers:
 2. ✅ **TUI integration** — `_run_agent_sync()` and `_run_agent_multimodal()` now pass `on_message` callback to `agent.chat()`. The callback inserts each assistant text response directly into the chat area via `call_from_thread(self._insert_rich, text)`, so the user sees intermediate thinking ("Let me search the internet...") BEFORE tool execution markers appear. This makes the agent feel alive and responsive instead of silent during multi-tool chains.
 
 3. ✅ **All 193 tests pass, lint clean.**
+
+## Completed (tasks.md — upstream fixes for GitKnecht)
+
+All twelve defects in `tasks.md` are fixed. See the ticked **Task Status** section there
+for the per-task mapping to tests.
+
+1. ✅ **Deleted the two dead tool loops** — the real cause of most of the list was that
+   `Agent` carried three tool loops (`_stream`, `_chat_loop`, and the SDK path) and only
+   the SDK one was reachable from `chat()`. Tasks 1/2/8/9/12 were all symptoms of the same
+   unreachable, never-executed `_stream`. `_stream`, `_chat_loop`,
+   `Agent._execute_tool_calls` and `_convert_registry_tools_to_sdk_tools` are deleted;
+   `test_module_level_helpers_exist` pins their absence.
+
+2. ✅ **One implementation for both modes** — `Agent.chat()` delegates to `_run_sdk()`,
+   which drives the OpenAI Agents SDK `Runner` in either `run()` or `run_streamed()` form.
+   `RegCodeModel` (`regcode/agents_backend.py`) is now a **pure model**: one completion in,
+   output items out, exactly like the SDK's own `LitellmModel`. The Runner owns the tool
+   loop, so `max_tool_calls` (as `max_turns`), `response_format`, the budget and the
+   callbacks behave identically streaming or not.
+
+3. ✅ **Streaming actually works** — `stream_response` uses `await litellm.acompletion(
+   stream=True)` and hands the async iterator to `ChatCmplStreamHandler` with an empty
+   `Response` shell. It previously called the *sync* `completion(stream=True)` and passed
+   the result in twice, so `chat(stream=True)` raised
+   `TypeError: 'async for' requires an object with __aiter__ method, got ModelResponse`.
+
+4. ✅ `status_callback`/`result_callback` **never fired** — the model loop ignored them
+   entirely. They now fire from `_run_tool`, the single place tools execute, with
+   `is_error` read from `ToolResult.error`.
+
+5. ✅ **`FunctionTool` wrapper fixed** — it read `ctx.tool_registry` (a
+   `RunContextWrapper` has no such attribute) and closed over the loop variable, so every
+   tool would have invoked the *last* registered one. The name is now bound via a default
+   argument.
+
+6. ✅ **`directory` is now enforced** — `validate_tool_args` rejects any
+   `path`/`file_path`/`script_path`/`directory` argument resolving outside the root;
+   `shell_command` runs with `cwd=directory` and rejects absolute arguments outside it;
+   the CLI gained `--directory` (previously the agent was constructed with no directory at
+   all, so the default toolset was unconfined). README documents that `directory` is
+   confinement, not a sandbox.
+
+7. ✅ **`AGENTS.md` no longer leaks from the process cwd** — `include_cwd` defaults to
+   `False`, closing a prompt-injection surface where the host project's instructions were
+   injected into answers about an unrelated repository.
+
+8. ✅ **Per-iteration compaction restored** — `call_model_input_filter` on `RunConfig`
+   re-checks the token budget on every Runner iteration, which the SDK had silently
+   dropped along with the old loops.
+
+9. ✅ **`MaxTurnsExceeded` is handled, not fatal** — hitting the turn limit is an
+   expected outcome for long reviews, so the best text produced so far is recovered from
+   `exc.run_data` instead of crashing the caller.
+
+10. ✅ **Test fidelity** — `tests/llm_fakes.py` builds **real** `litellm.types.utils`
+    objects instead of `MagicMock`. The streaming bug survived for releases because a
+    `MagicMock` answered whatever the test asked it to; a response shape the SDK cannot
+    parse now fails the test the way it fails in production. Also fixed
+    `tests/test_dependencies.py`, which deleted `regcode.*` from `sys.modules` without
+    restoring it, so later tests received a second `AgentStatus` class and enum identity
+    comparisons failed purely on execution order.
+
+11. ✅ **270 tests pass** (up from 231), `uv run ruff check` clean.
+

regcode-0.10.0/README.md → regcode-0.12.0/PKG-INFO

@@ -1,3 +1,26 @@
+Metadata-Version: 2.5
+Name: regcode
+Version: 0.12.0
+Summary: Minimalistic coding agent with Python API and CLI
+Requires-Python: >=3.10
+Requires-Dist: boto3>=1.43.40
+Requires-Dist: click>=8.0
+Requires-Dist: crawl4ai>=0.4.0
+Requires-Dist: litellm>=1.83.17
+Requires-Dist: mcp>=1.0.0
+Requires-Dist: mlflow>=3.14.0
+Requires-Dist: openai-agents>=0.18.0
+Requires-Dist: pathspec>=1.1.1
+Requires-Dist: pydantic-monty>=0.0.18
+Requires-Dist: pydantic-settings>=2.14.2
+Requires-Dist: pyperclip>=1.9.0
+Requires-Dist: pytest>=8.0
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: ruff>=0.8
+Requires-Dist: textual>=2.0.0
+Provides-Extra: dev
+Description-Content-Type: text/markdown
+
 # RegCode
 
 A minimalistic coding agent with Python API bindings and CLI interface.
@@ -101,6 +124,24 @@ RegCode includes several built-in tools the agent can use:
 
 All file-writing tools (`write_file`, `patch_file`) include path traversal protection (`..` is blocked). The `patch_file` tool validates line number bounds and type correctness before performing the replacement.
 
+### Working directory and confinement
+
+`Agent(directory=...)` (and the CLI's `--directory`, which defaults to the current
+directory) is the root every tool is confined to:
+
+- Every path-like tool argument (`path`, `file_path`, `script_path`, `directory`) is
+  resolved against it and **rejected** when it resolves outside — absolute paths and
+  `..` escapes alike.
+- `shell_command` runs with `cwd` set to it, and its arguments are checked the same way,
+  so `cat /etc/passwd` is rejected even though `cat` is allowlisted.
+- `python_code` and `run_script` execute inside the Monty sandbox, which has no host
+  filesystem access at all.
+
+> **`directory` is a confinement boundary, not a security sandbox.** `shell_command`
+> still runs a real subprocess as the current user, and the toolset is only as safe as
+> its permission list. Services embedding RegCode behind an authenticated endpoint should
+> restrict `permissions` (or unregister tools) rather than relying on `directory` alone.
+
 ## Project Structure
 
 ```

regcode-0.10.0/PKG-INFO → regcode-0.12.0/README.md

@@ -1,25 +1,3 @@
-Metadata-Version: 2.4
-Name: regcode
-Version: 0.10.0
-Summary: Minimalistic coding agent with Python API and CLI
-Requires-Python: >=3.10
-Requires-Dist: boto3>=1.43.40
-Requires-Dist: click>=8.0
-Requires-Dist: crawl4ai>=0.4.0
-Requires-Dist: litellm>=1.83.17
-Requires-Dist: mcp>=1.0.0
-Requires-Dist: mlflow>=3.14.0
-Requires-Dist: pathspec>=1.1.1
-Requires-Dist: pydantic-monty>=0.0.18
-Requires-Dist: pydantic-settings>=2.14.2
-Requires-Dist: pyperclip>=1.9.0
-Requires-Dist: pytest>=8.0
-Requires-Dist: pyyaml>=6.0
-Requires-Dist: ruff>=0.8
-Requires-Dist: textual>=2.0.0
-Provides-Extra: dev
-Description-Content-Type: text/markdown
-
 # RegCode
 
 A minimalistic coding agent with Python API bindings and CLI interface.
@@ -123,6 +101,24 @@ RegCode includes several built-in tools the agent can use:
 
 All file-writing tools (`write_file`, `patch_file`) include path traversal protection (`..` is blocked). The `patch_file` tool validates line number bounds and type correctness before performing the replacement.
 
+### Working directory and confinement
+
+`Agent(directory=...)` (and the CLI's `--directory`, which defaults to the current
+directory) is the root every tool is confined to:
+
+- Every path-like tool argument (`path`, `file_path`, `script_path`, `directory`) is
+  resolved against it and **rejected** when it resolves outside — absolute paths and
+  `..` escapes alike.
+- `shell_command` runs with `cwd` set to it, and its arguments are checked the same way,
+  so `cat /etc/passwd` is rejected even though `cat` is allowlisted.
+- `python_code` and `run_script` execute inside the Monty sandbox, which has no host
+  filesystem access at all.
+
+> **`directory` is a confinement boundary, not a security sandbox.** `shell_command`
+> still runs a real subprocess as the current user, and the toolset is only as safe as
+> its permission list. Services embedding RegCode behind an authenticated endpoint should
+> restrict `permissions` (or unregister tools) rather than relying on `directory` alone.
+
 ## Project Structure
 
 ```

{regcode-0.10.0 → regcode-0.12.0}/pyproject.toml

@@ -1,12 +1,13 @@
 [project]
 name = "regcode"
-version = "0.10.0"
+version = "0.12.0"
 description = "Minimalistic coding agent with Python API and CLI"
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
     "crawl4ai>=0.4.0",
     "litellm>=1.83.17",
+    "openai-agents>=0.18.0",
     "pydantic-settings>=2.14.2",
     "pyyaml>=6.0",
     "click>=8.0",

{regcode-0.10.0 → regcode-0.12.0}/regcode/__init__.py

@@ -2,4 +2,4 @@ from regcode.config import Config
 from regcode.main import Agent, AgentStatus, ToolCall
 
 __all__ = ["Agent", "Config", "AgentStatus", "ToolCall"]
-__version__ = "0.10.0"
+__version__ = "0.12.0"