regcode 0.11.0__tar.gz → 0.12.1__tar.gz

{regcode-0.11.0 → regcode-0.12.1}/GOALS.md

@@ -581,3 +581,117 @@ mcp_servers:
 2. ✅ **TUI integration** — `_run_agent_sync()` and `_run_agent_multimodal()` now pass `on_message` callback to `agent.chat()`. The callback inserts each assistant text response directly into the chat area via `call_from_thread(self._insert_rich, text)`, so the user sees intermediate thinking ("Let me search the internet...") BEFORE tool execution markers appear. This makes the agent feel alive and responsive instead of silent during multi-tool chains.
 
 3. ✅ **All 193 tests pass, lint clean.**
+
+## Completed (tasks.md — upstream fixes for GitKnecht)
+
+All twelve defects in `tasks.md` are fixed. See the ticked **Task Status** section there
+for the per-task mapping to tests.
+
+1. ✅ **Deleted the two dead tool loops** — the real cause of most of the list was that
+   `Agent` carried three tool loops (`_stream`, `_chat_loop`, and the SDK path) and only
+   the SDK one was reachable from `chat()`. Tasks 1/2/8/9/12 were all symptoms of the same
+   unreachable, never-executed `_stream`. `_stream`, `_chat_loop`,
+   `Agent._execute_tool_calls` and `_convert_registry_tools_to_sdk_tools` are deleted;
+   `test_module_level_helpers_exist` pins their absence.
+
+2. ✅ **One implementation for both modes** — `Agent.chat()` delegates to `_run_sdk()`,
+   which drives the OpenAI Agents SDK `Runner` in either `run()` or `run_streamed()` form.
+   `RegCodeModel` (`regcode/agents_backend.py`) is now a **pure model**: one completion in,
+   output items out, exactly like the SDK's own `LitellmModel`. The Runner owns the tool
+   loop, so `max_tool_calls` (as `max_turns`), `response_format`, the budget and the
+   callbacks behave identically streaming or not.
+
+3. ✅ **Streaming actually works** — `stream_response` uses `await litellm.acompletion(
+   stream=True)` and hands the async iterator to `ChatCmplStreamHandler` with an empty
+   `Response` shell. It previously called the *sync* `completion(stream=True)` and passed
+   the result in twice, so `chat(stream=True)` raised
+   `TypeError: 'async for' requires an object with __aiter__ method, got ModelResponse`.
+
+4. ✅ `status_callback`/`result_callback` **never fired** — the model loop ignored them
+   entirely. They now fire from `_run_tool`, the single place tools execute, with
+   `is_error` read from `ToolResult.error`.
+
+5. ✅ **`FunctionTool` wrapper fixed** — it read `ctx.tool_registry` (a
+   `RunContextWrapper` has no such attribute) and closed over the loop variable, so every
+   tool would have invoked the *last* registered one. The name is now bound via a default
+   argument.
+
+6. ✅ **`directory` is now enforced** — `validate_tool_args` rejects any
+   `path`/`file_path`/`script_path`/`directory` argument resolving outside the root;
+   `shell_command` runs with `cwd=directory` and rejects absolute arguments outside it;
+   the CLI gained `--directory` (previously the agent was constructed with no directory at
+   all, so the default toolset was unconfined). README documents that `directory` is
+   confinement, not a sandbox.
+
+7. ✅ **`AGENTS.md` no longer leaks from the process cwd** — `include_cwd` defaults to
+   `False`, closing a prompt-injection surface where the host project's instructions were
+   injected into answers about an unrelated repository.
+
+8. ✅ **Per-iteration compaction restored** — `call_model_input_filter` on `RunConfig`
+   re-checks the token budget on every Runner iteration, which the SDK had silently
+   dropped along with the old loops.
+
+9. ✅ **`MaxTurnsExceeded` is handled, not fatal** — hitting the turn limit is an
+   expected outcome for long reviews, so the best text produced so far is recovered from
+   `exc.run_data` instead of crashing the caller.
+
+10. ✅ **Test fidelity** — `tests/llm_fakes.py` builds **real** `litellm.types.utils`
+    objects instead of `MagicMock`. The streaming bug survived for releases because a
+    `MagicMock` answered whatever the test asked it to; a response shape the SDK cannot
+    parse now fails the test the way it fails in production. Also fixed
+    `tests/test_dependencies.py`, which deleted `regcode.*` from `sys.modules` without
+    restoring it, so later tests received a second `AgentStatus` class and enum identity
+    comparisons failed purely on execution order.
+
+11. ✅ **285 tests pass** (up from 231), `uv run ruff check` clean.
+
+## Fixed (2026-10-31 — CLI broke on the first real conversation)
+
+The rewrite passed every test but broke `regcode chat` as soon as the model said
+anything before calling a tool:
+
+```
+[ERROR] Agent error! litellm.BadRequestError: Hosted_vllmException - {"error":{"message":
+"3 validation errors for ValidatorIterator\n0.ChatCompletionContentPartTextParam.type\n
+Input should be 'text' [type=literal_error, input_value='output_text'...
+```
+
+Three separate regressions, all invisible to the existing suite because **every test
+made the model return *either* text *or* a tool call** — so the second turn, the one
+where the Runner replays the assistant's own output, never executed.
+
+1. ✅ **Responses-API items were leaking into chat-completions requests** — the Runner
+   hands the assistant's output back as `{"type": "message", "content": [{"type":
+   "output_text", ...}]}`, `function_call` and `function_call_output`. `_prepare_messages`
+   copied those dicts straight into `litellm.completion(messages=...)`, which the provider
+   rejects. It now runs them through `Converter.items_to_messages(items, model=...)`, the
+   same translation the SDK's own `LitellmModel` uses — which also merges an assistant's
+   text with the tool calls it asked for into a single turn.
+
+2. ✅ **Replayed history was structurally invalid** — `_update_history_from_sdk_result`
+   stored a `"Tool call: x"` label next to a `role: "tool"` result. A tool result is only
+   legal when an assistant turn carrying the matching `tool_calls` precedes it, so the
+   second `chat()` call would have been rejected by strict providers (vLLM among them).
+   History now stores the real `tool_calls` array (id, name, arguments). `ToolCallItem.raw_item`
+   is a `ResponseFunctionToolCall` **object** when the Runner builds it and a dict elsewhere;
+   reading it only as a dict silently produced `arguments: "{}"`, so a replayed turn claimed
+   the model had called a tool with no arguments. `_item_field()` handles both.
+
+3. ✅ **`python_code`, `run_script` and `web_crawl` were dead** — moving tool execution
+   under the Runner put them *inside* an event loop, where `asyncio.run()` raises
+   `cannot be called from a running event loop`. Every `python_code` call returned
+   `SANDBOX_ERROR: ...` and the model just got an error string back. Added
+   `regcode/async_utils.py::run_coroutine_blocking()`, which runs the coroutine on a
+   dedicated thread when a loop is already active.
+
+Also: `chat(messages=...)` is public API (`code_review`, GitKnecht, saved transcripts)
+and accepts plain chat-shaped dicts, which `Converter.items_to_messages` rejects outright.
+`_expand_input_items()` normalises `role: "tool"` and assistant `tool_calls` into Responses
+items before conversion.
+
+**Process lesson**: the new tests were written against the shapes the *tests* invented.
+`tests/test_task_regression.py` now pins the message shape of every turn handed to litellm
+(`_assert_chat_completions_shape`), covers text-plus-tool-call turns, a second `chat()`
+call, and tool execution under a running loop. Each was mutation-checked — revert the fix,
+watch it go red.
+

regcode-0.11.0/README.md → regcode-0.12.1/PKG-INFO

@@ -1,3 +1,26 @@
+Metadata-Version: 2.5
+Name: regcode
+Version: 0.12.1
+Summary: Minimalistic coding agent with Python API and CLI
+Requires-Python: >=3.10
+Requires-Dist: boto3>=1.43.40
+Requires-Dist: click>=8.0
+Requires-Dist: crawl4ai>=0.4.0
+Requires-Dist: litellm>=1.83.17
+Requires-Dist: mcp>=1.0.0
+Requires-Dist: mlflow>=3.14.0
+Requires-Dist: openai-agents>=0.18.0
+Requires-Dist: pathspec>=1.1.1
+Requires-Dist: pydantic-monty>=0.0.18
+Requires-Dist: pydantic-settings>=2.14.2
+Requires-Dist: pyperclip>=1.9.0
+Requires-Dist: pytest>=8.0
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: ruff>=0.8
+Requires-Dist: textual>=2.0.0
+Provides-Extra: dev
+Description-Content-Type: text/markdown
+
 # RegCode
 
 A minimalistic coding agent with Python API bindings and CLI interface.
@@ -101,6 +124,24 @@ RegCode includes several built-in tools the agent can use:
 
 All file-writing tools (`write_file`, `patch_file`) include path traversal protection (`..` is blocked). The `patch_file` tool validates line number bounds and type correctness before performing the replacement.
 
+### Working directory and confinement
+
+`Agent(directory=...)` (and the CLI's `--directory`, which defaults to the current
+directory) is the root every tool is confined to:
+
+- Every path-like tool argument (`path`, `file_path`, `script_path`, `directory`) is
+  resolved against it and **rejected** when it resolves outside — absolute paths and
+  `..` escapes alike.
+- `shell_command` runs with `cwd` set to it, and its arguments are checked the same way,
+  so `cat /etc/passwd` is rejected even though `cat` is allowlisted.
+- `python_code` and `run_script` execute inside the Monty sandbox, which has no host
+  filesystem access at all.
+
+> **`directory` is a confinement boundary, not a security sandbox.** `shell_command`
+> still runs a real subprocess as the current user, and the toolset is only as safe as
+> its permission list. Services embedding RegCode behind an authenticated endpoint should
+> restrict `permissions` (or unregister tools) rather than relying on `directory` alone.
+
 ## Project Structure
 
 ```

regcode-0.11.0/PKG-INFO → regcode-0.12.1/README.md

@@ -1,25 +1,3 @@
-Metadata-Version: 2.4
-Name: regcode
-Version: 0.11.0
-Summary: Minimalistic coding agent with Python API and CLI
-Requires-Python: >=3.10
-Requires-Dist: boto3>=1.43.40
-Requires-Dist: click>=8.0
-Requires-Dist: crawl4ai>=0.4.0
-Requires-Dist: litellm>=1.83.17
-Requires-Dist: mcp>=1.0.0
-Requires-Dist: mlflow>=3.14.0
-Requires-Dist: pathspec>=1.1.1
-Requires-Dist: pydantic-monty>=0.0.18
-Requires-Dist: pydantic-settings>=2.14.2
-Requires-Dist: pyperclip>=1.9.0
-Requires-Dist: pytest>=8.0
-Requires-Dist: pyyaml>=6.0
-Requires-Dist: ruff>=0.8
-Requires-Dist: textual>=2.0.0
-Provides-Extra: dev
-Description-Content-Type: text/markdown
-
 # RegCode
 
 A minimalistic coding agent with Python API bindings and CLI interface.
@@ -123,6 +101,24 @@ RegCode includes several built-in tools the agent can use:
 
 All file-writing tools (`write_file`, `patch_file`) include path traversal protection (`..` is blocked). The `patch_file` tool validates line number bounds and type correctness before performing the replacement.
 
+### Working directory and confinement
+
+`Agent(directory=...)` (and the CLI's `--directory`, which defaults to the current
+directory) is the root every tool is confined to:
+
+- Every path-like tool argument (`path`, `file_path`, `script_path`, `directory`) is
+  resolved against it and **rejected** when it resolves outside — absolute paths and
+  `..` escapes alike.
+- `shell_command` runs with `cwd` set to it, and its arguments are checked the same way,
+  so `cat /etc/passwd` is rejected even though `cat` is allowlisted.
+- `python_code` and `run_script` execute inside the Monty sandbox, which has no host
+  filesystem access at all.
+
+> **`directory` is a confinement boundary, not a security sandbox.** `shell_command`
+> still runs a real subprocess as the current user, and the toolset is only as safe as
+> its permission list. Services embedding RegCode behind an authenticated endpoint should
+> restrict `permissions` (or unregister tools) rather than relying on `directory` alone.
+
 ## Project Structure
 
 ```

{regcode-0.11.0 → regcode-0.12.1}/pyproject.toml

@@ -1,12 +1,13 @@
 [project]
 name = "regcode"
-version = "0.11.0"
+version = "0.12.1"
 description = "Minimalistic coding agent with Python API and CLI"
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
     "crawl4ai>=0.4.0",
     "litellm>=1.83.17",
+    "openai-agents>=0.18.0",
     "pydantic-settings>=2.14.2",
     "pyyaml>=6.0",
     "click>=8.0",

{regcode-0.11.0 → regcode-0.12.1}/regcode/__init__.py

@@ -2,4 +2,4 @@ from regcode.config import Config
 from regcode.main import Agent, AgentStatus, ToolCall
 
 __all__ = ["Agent", "Config", "AgentStatus", "ToolCall"]
-__version__ = "0.10.0"
+__version__ = "0.12.1"