regent-cli 0.5.0__tar.gz → 0.6.0__tar.gz

{regent_cli-0.5.0/src/regent_cli.egg-info → regent_cli-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: regent-cli
-Version: 0.5.0
+Version: 0.6.0
 Summary: Autonomous conduction and mediated adversarial deliberation between AI agents, pluggable into any project.
 Author-email: Flavio Alvim <flavioalvim@gmail.com>
 License: MIT
@@ -53,7 +53,12 @@ phase 1 mechanizes the two most error-prone sub-steps: `regent advisor consult
 --prompt-file … --artifact … --linkage …` (read-only sandboxed consultation with the
 REQ-003 §5 evidence pair generated by the command, fail-closed verdict expectation) and
 `regent gate run --command … --declared-in <plan> --artifact … --linkage …` (verbatim
-provenance check, process-group-killing timeout, integral output preserved).
+provenance check, process-group-killing timeout, integral output preserved). Conduction
+phase 2 adds `regent turn run`: one supervised, CONFINED `claude -p` turn — the agent may
+only write inside a declared envelope (a PreToolUse hook denies the rest), the supervisor
+proves what changed via git (blob shas vs authenticated post events) and commits through a
+private index with a HEAD compare-and-swap. The agent never commits; a violation, a
+tampered log or a red gate never yields a product commit.
 
 Development: `PYTHONPATH=src python3 -m unittest discover -s tests`; packaging gate:
 `bash scripts/gate-package.sh`. Canonical skill content lives in `src/regent/templates/`

{regent_cli-0.5.0 → regent_cli-0.6.0}/README.md

@@ -37,7 +37,12 @@ phase 1 mechanizes the two most error-prone sub-steps: `regent advisor consult
 --prompt-file … --artifact … --linkage …` (read-only sandboxed consultation with the
 REQ-003 §5 evidence pair generated by the command, fail-closed verdict expectation) and
 `regent gate run --command … --declared-in <plan> --artifact … --linkage …` (verbatim
-provenance check, process-group-killing timeout, integral output preserved).
+provenance check, process-group-killing timeout, integral output preserved). Conduction
+phase 2 adds `regent turn run`: one supervised, CONFINED `claude -p` turn — the agent may
+only write inside a declared envelope (a PreToolUse hook denies the rest), the supervisor
+proves what changed via git (blob shas vs authenticated post events) and commits through a
+private index with a HEAD compare-and-swap. The agent never commits; a violation, a
+tampered log or a red gate never yields a product commit.
 
 Development: `PYTHONPATH=src python3 -m unittest discover -s tests`; packaging gate:
 `bash scripts/gate-package.sh`. Canonical skill content lives in `src/regent/templates/`

{regent_cli-0.5.0 → regent_cli-0.6.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "regent-cli"
-version = "0.5.0"
+version = "0.6.0"
 description = "Autonomous conduction and mediated adversarial deliberation between AI agents, pluggable into any project."
 readme = "README.md"
 requires-python = ">=3.10"

{regent_cli-0.5.0 → regent_cli-0.6.0}/src/regent/__init__.py

@@ -1,3 +1,3 @@
 """regent — autonomous conduction and mediated adversarial deliberation between AI agents."""
 
-__version__ = "0.5.0"
+__version__ = "0.6.0"

{regent_cli-0.5.0 → regent_cli-0.6.0}/src/regent/activity_cli.py

@@ -25,6 +25,9 @@ _EXIT_BY_CODE = {
     "TOKEN_MISMATCH": 3, "LOCK_HELD": 3, "LOCK_SUSPECT": 3, "BUSY": 3,
     "CONFLICT": 3, "UNATTRIBUTABLE": 3, "CORRUPT_CONTROL": 4, "IO": 5,
     "ADVISOR_FAILED": 3, "ADVISOR_UNAVAILABLE": 2, "GATE_RED": 3, "PROVENANCE": 3,
+    "TURN_VIOLATION": 3, "TURN_TAMPERED": 3, "TURN_FAILED": 3, "NOT_ACTIVE": 2,
+    "STEP_MISMATCH": 2, "ARTIFACT_OUTSIDE_REGENT": 2, "STEP_ALREADY_DONE": 2,
+    "WORKTREE_DIRTY": 3,
 }
 
 
@@ -102,6 +105,22 @@ def build_parser(sub) -> None:
     p.add_argument("--timeout", type=float, default=600.0)
     p.add_argument("--expect-verdict", default=None, dest="expect_verdict")
 
+    p_turn = sub.add_parser("turn", help="supervised confined production turn")
+    p_turn.add_argument("--project", default=None)
+    turn_sub = p_turn.add_subparsers(dest="turn_command", required=True)
+    p = turn_sub.add_parser("run")
+    p.add_argument("--prompt-file", required=True, dest="prompt_file")
+    p.add_argument("--envelope", action="append", required=True)
+    p.add_argument("--gate-envelope", action="append", default=[],
+                   dest="gate_envelope")
+    p.add_argument("--gate-command", required=True, dest="gate_command")
+    p.add_argument("--declared-in", required=True, dest="declared_in")
+    p.add_argument("--step", required=True)
+    p.add_argument("--artifact-dir", required=True, dest="artifact_dir")
+    p.add_argument("--linkage", required=True)
+    p.add_argument("--timeout", type=float, default=900.0)
+    p.add_argument("--claude-bin", default="claude", dest="claude_bin")
+
     p_gate = sub.add_parser("gate", help="mechanized gate execution")
     p_gate.add_argument("--project", default=None)
     gate_sub = p_gate.add_subparsers(dest="gate_command", required=True)
@@ -160,6 +179,31 @@ def run(args, out=None) -> int:
                               "verdict": result["verdict"],
                               "artifact": result["artifact"]}, out)
             return _emit(result, 0, out)
+        if args.command == "turn":
+            from .conduction.turn import TurnError, run_turn
+            from .conduction.gate import ProvenanceError
+            from .conduction.evidence import EvidenceConflict
+            try:
+                result = run_turn(
+                    root, prompt_file=Path(args.prompt_file),
+                    envelope=args.envelope, gate_envelope=args.gate_envelope,
+                    gate_command=args.gate_command,
+                    declared_in=Path(args.declared_in), step=args.step,
+                    artifact_dir=Path(args.artifact_dir), linkage=args.linkage,
+                    timeout=args.timeout, claude_bin=args.claude_bin)
+            except TurnError as exc:
+                return _fail(exc.code, exc.detail, out)
+            except ProvenanceError as exc:
+                return _fail("PROVENANCE", {"reason": str(exc)}, out)
+            except EvidenceConflict as exc:
+                return _fail("CONFLICT", {"paths": exc.paths}, out)
+            if not result["ok"]:
+                code = ({"TURN_VIOLATION": "TURN_VIOLATION",
+                         "TURN_TAMPERED": "TURN_TAMPERED",
+                         "GATE_RED": "GATE_RED"}.get(result["outcome"], "TURN_FAILED"))
+                return _fail(code, {"outcome": result["outcome"],
+                                    "artifact": result["artifact"]}, out)
+            return _emit(result, 0, out)
         if args.command == "gate":
             from .conduction.gate import ProvenanceError, run_gate
             from .conduction.evidence import EvidenceConflict

regent_cli-0.6.0/src/regent/conduction/confine.py

@@ -0,0 +1,79 @@
+"""Confined-turn composition (PLAN-004 STEP-02).
+
+Builds an immutable per-turn PRIVATE dir (outside the repo) with a generated
+settings.json that wires the Pre/PostToolUse hooks to a private copy of
+hookscript.py, and returns the `claude -p` argv + minimal environment. The
+launch inherits NO config (`--setting-sources ""`), restricts tools, and forces
+acceptEdits (the confinement IS the hook's deny; dontAsk would deny even
+in-envelope writes — empirical IMP-003 lesson).
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import secrets
+import shutil
+import tempfile
+from dataclasses import dataclass
+from pathlib import Path
+
+ALLOWED_TOOLS = "Read,Write,Edit,MultiEdit"
+ENV_ALLOWLIST = ("PATH", "HOME", "LANG", "LC_ALL")
+
+
+@dataclass
+class ConfinedTurn:
+    private_dir: Path
+    settings_path: Path
+    event_log: Path
+    secret: str
+    envelope: list[str]
+
+    def cleanup(self) -> None:
+        shutil.rmtree(self.private_dir, ignore_errors=True)
+
+
+def compose(*, envelope: list[str], claude_bin: str = "claude") -> ConfinedTurn:
+    private_dir = Path(tempfile.mkdtemp(prefix="regent-turn-"))
+    hook_copy = private_dir / "hookscript.py"
+    shutil.copy(Path(__file__).with_name("hookscript.py"), hook_copy)
+    event_log = private_dir / "events.log"
+    secret = secrets.token_hex(32)
+    envelope = [str(Path(p).resolve()) for p in envelope]
+
+    hook_cmd = f"{_python()} {hook_copy}"
+    settings = {
+        "hooks": {
+            "PreToolUse": [{"hooks": [{"type": "command", "command": hook_cmd}]}],
+            "PostToolUse": [{"hooks": [{"type": "command", "command": hook_cmd}]}],
+        }
+    }
+    settings_path = private_dir / "settings.json"
+    settings_path.write_text(json.dumps(settings, indent=2), encoding="utf-8")
+    # Freeze the composition (read-only) so nothing mutates it mid-turn.
+    for path in (hook_copy, settings_path):
+        path.chmod(0o400)
+    return ConfinedTurn(private_dir, settings_path, event_log, secret, envelope)
+
+
+def launch_argv(turn: ConfinedTurn, *, prompt: str,
+                claude_bin: str = "claude") -> list[str]:
+    return [claude_bin, "-p", prompt,
+            "--setting-sources", "",              # inherit NOTHING
+            "--settings", str(turn.settings_path),
+            "--tools", ALLOWED_TOOLS,
+            "--permission-mode", "acceptEdits"]
+
+
+def launch_env(turn: ConfinedTurn) -> dict[str, str]:
+    env = {k: os.environ[k] for k in ENV_ALLOWLIST if k in os.environ}
+    env["REGENT_TURN_SECRET"] = turn.secret
+    env["REGENT_ENVELOPE"] = json.dumps(turn.envelope)
+    env["REGENT_EVENT_LOG"] = str(turn.event_log)
+    return env
+
+
+def _python() -> str:
+    import sys
+    return sys.executable or "python3"

regent_cli-0.6.0/src/regent/conduction/hookscript.py

@@ -0,0 +1,181 @@
+#!/usr/bin/env python3
+"""Standalone Claude Code hook for confined turns (PLAN-004 STEP-01).
+
+Copied into a per-turn PRIVATE dir and referenced by the generated
+settings.json. Reads REGENT_ENVELOPE (JSON list of allowed write roots),
+REGENT_EVENT_LOG (private append log) and REGENT_TURN_SECRET (HMAC key for the
+audit chain — NOT an anti-forgery proof against the agent; see PLAN-004 trust
+model) from its own environment.
+
+Semantics (official Claude Code hooks):
+- PreToolUse decides allow/deny. Write/Edit/MultiEdit are allowed ONLY if the
+  canonical real-path of the target is inside the envelope; every other
+  write/exec tool (Bash included, defense in depth) is denied; read-only tools
+  are allowed. A `pre` event is appended.
+- PostToolUse (only fires after a successful tool) appends a `post` event with
+  the resulting file's content sha256, correlated by tool_use_id.
+Fails CLOSED: any internal error → deny + `hook_error` event.
+"""
+
+from __future__ import annotations
+
+import fcntl
+import hashlib
+import hmac
+import json
+import os
+import sys
+from pathlib import Path
+
+WRITE_TOOLS = {"Write", "Edit", "MultiEdit", "NotebookEdit"}
+READ_ONLY_TOOLS = {"Read", "Glob", "Grep", "NotebookRead", "TodoWrite",
+                   "WebFetch", "WebSearch", "Task"}
+
+
+def _canonical(line: dict) -> str:
+    return json.dumps(line, sort_keys=True, separators=(",", ":"))
+
+
+def _append_event(event: dict) -> None:
+    log_path = os.environ["REGENT_EVENT_LOG"]
+    secret = os.environ["REGENT_TURN_SECRET"].encode()
+    fd = os.open(log_path, os.O_RDWR | os.O_CREAT | os.O_APPEND, 0o600)
+    try:
+        fcntl.flock(fd, fcntl.LOCK_EX)  # serialize concurrent hooks
+        existing = _read_last_line(log_path)
+        prev_hmac = existing.get("hmac", "") if existing else ""
+        seq = (existing.get("seq", -1) + 1) if existing else 0
+        event["seq"] = seq
+        payload = _canonical(event)
+        event["hmac"] = hmac.new(secret, (payload + prev_hmac).encode(),
+                                 hashlib.sha256).hexdigest()
+        os.write(fd, (json.dumps(event, sort_keys=True) + "\n").encode())
+        os.fsync(fd)
+    finally:
+        os.close(fd)
+
+
+def _read_last_line(path: str) -> dict | None:
+    try:
+        lines = [l for l in Path(path).read_text(encoding="utf-8").splitlines()
+                 if l.strip()]
+    except OSError:
+        return None
+    return json.loads(lines[-1]) if lines else None
+
+
+def _target_paths(tool_name: str, tool_input: dict) -> list[str]:
+    if tool_name in ("Write", "Edit", "NotebookEdit"):
+        p = tool_input.get("file_path") or tool_input.get("notebook_path")
+        return [p] if p else []
+    if tool_name == "MultiEdit":
+        p = tool_input.get("file_path")
+        return [p] if p else []
+    return []
+
+
+def _inside_envelope(path: str, envelope: list[str]) -> bool:
+    try:
+        real = Path(path).resolve()
+    except (OSError, RuntimeError):
+        return False
+    for root in envelope:
+        try:
+            root_real = Path(root).resolve()
+        except (OSError, RuntimeError):
+            continue
+        if real == root_real or root_real in real.parents:
+            return True
+    return False
+
+
+def _decide(payload: dict) -> dict:
+    tool_name = payload.get("tool_name", "")
+    tool_input = payload.get("tool_input")
+    tool_use_id = payload.get("tool_use_id", "")
+    envelope = json.loads(os.environ.get("REGENT_ENVELOPE", "[]"))
+
+    # Malformed payload → deny (fail closed), even for an allowlisted tool.
+    if not isinstance(tool_input, dict):
+        _append_event({"kind": "pre", "tool": tool_name or "<unknown>",
+                       "tool_use_id": tool_use_id, "paths": [],
+                       "decision": "deny", "reason": "malformed tool_input"})
+        return {"hookSpecificOutput": {"hookEventName": "PreToolUse",
+                                       "permissionDecision": "deny",
+                                       "permissionDecisionReason":
+                                       "malformed tool_input (fail closed)"}}
+
+    if tool_name in WRITE_TOOLS:
+        targets = _target_paths(tool_name, tool_input)
+        allow = bool(targets) and all(_inside_envelope(p, envelope)
+                                      for p in targets)
+        decision = "allow" if allow else "deny"
+        _append_event({"kind": "pre", "tool": tool_name, "tool_use_id": tool_use_id,
+                       "paths": targets, "decision": decision})
+        if allow:
+            return {}  # allow (no explicit permission decision needed)
+        return {"hookSpecificOutput": {"hookEventName": "PreToolUse",
+                                       "permissionDecision": "deny",
+                                       "permissionDecisionReason":
+                                       "outside the turn envelope"}}
+    # Default-deny: only an ALLOWLIST of known read-only tools passes silently.
+    # Anything else — Bash/exec, an unknown/future tool, a malformed payload —
+    # is denied (a write/exec we do not recognize must never slip through).
+    if tool_name in READ_ONLY_TOOLS:
+        return {}
+    _append_event({"kind": "pre", "tool": tool_name or "<unknown>",
+                   "tool_use_id": tool_use_id, "paths": [], "decision": "deny"})
+    return {"hookSpecificOutput": {"hookEventName": "PreToolUse",
+                                   "permissionDecision": "deny",
+                                   "permissionDecisionReason":
+                                   "tool not in the confined-turn allowlist"}}
+
+
+def _post(payload: dict) -> dict:
+    tool_name = payload.get("tool_name", "")
+    tool_input = payload.get("tool_input")
+    if not isinstance(tool_input, dict):
+        return {}
+    tool_use_id = payload.get("tool_use_id", "")
+    for path in _target_paths(tool_name, tool_input):
+        try:
+            if os.path.islink(path):
+                digest, mode = None, None  # symlink target: not attributable
+            else:
+                digest = hashlib.sha256(Path(path).read_bytes()).hexdigest()
+                mode = oct(os.lstat(path).st_mode & 0o777)
+        except OSError:
+            digest, mode = None, None
+        _append_event({"kind": "post", "tool": tool_name,
+                       "tool_use_id": tool_use_id, "path": path,
+                       "content_sha256": digest, "mode": mode})
+    return {}
+
+
+def main(argv: list[str], stdin_text: str) -> int:
+    try:
+        payload = json.loads(stdin_text or "{}")
+        event_name = payload.get("hook_event_name") \
+            or (argv[1] if len(argv) > 1 else "")
+        if event_name == "PreToolUse":
+            output = _decide(payload)
+        elif event_name == "PostToolUse":
+            output = _post(payload)
+        else:
+            output = {}
+        if output:
+            sys.stdout.write(json.dumps(output))
+        return 0
+    except Exception as exc:  # noqa: BLE001 — fail CLOSED
+        try:
+            _append_event({"kind": "hook_error", "error": repr(exc)})
+        except Exception:  # noqa: BLE001
+            pass
+        sys.stdout.write(json.dumps({"hookSpecificOutput": {
+            "hookEventName": "PreToolUse", "permissionDecision": "deny",
+            "permissionDecisionReason": "hook internal error (fail closed)"}}))
+        return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv, sys.stdin.read()))

{regent_cli-0.5.0 → regent_cli-0.6.0}/src/regent/conduction/process.py

@@ -25,10 +25,11 @@ class RunResult:
 
 
 class SubprocessRunner:
-    def run(self, argv: list[str], *, cwd: str, timeout: float) -> RunResult:
+    def run(self, argv: list[str], *, cwd: str, timeout: float,
+            env: dict | None = None) -> RunResult:
         proc = subprocess.Popen(argv, cwd=cwd, stdin=subprocess.DEVNULL,
                                 stdout=subprocess.PIPE,
-                                stderr=subprocess.STDOUT,
+                                stderr=subprocess.STDOUT, env=env,
                                 start_new_session=True)  # bytes mode + headless: NEVER
         # inherit the parent's stdin — a child waiting for EOF on an
         # inherited pipe hangs forever (caught live by the dogfooded review)