rote-cli 0.1.0__tar.gz → 0.4.0__tar.gz

{rote_cli-0.1.0 → rote_cli-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rote-cli
-Version: 0.1.0
+Version: 0.4.0
 Summary: Graduate fuzzy AI skills into deterministic, reliable workflows
 Project-URL: Homepage, https://github.com/trevhud/rote
 Project-URL: Repository, https://github.com/trevhud/rote
@@ -59,8 +59,13 @@ applies a structured graduation rubric, and emits:
 - and runtime code for your durable execution engine of choice.
 
 ```sh
-# Two runtimes shipped today — emit Python for Temporal, or TypeScript
-# for Cloudflare Workflows:
+pip install rote-cli    # or zero-install: uvx --from rote-cli rote ...
+
+# Default target is DBOS — durable execution as a plain Python library,
+# no orchestrator to run, SQLite for dev / Postgres for prod:
+rote graduate ./examples/bdr-outreach/skill --out ./graduated/
+
+# Or target Temporal (Python) or Cloudflare Workflows (TypeScript):
 rote graduate ./examples/bdr-outreach/skill --runtime temporal   --out ./graduated/
 rote graduate ./examples/bdr-outreach/skill --runtime cloudflare --out ./graduated/
 ```
@@ -140,6 +145,10 @@ The graduator independently:
 After the agent finishes, a runtime adapter consumes the IR and emits
 the target runtime's native code shape:
 
+- The **DBOS** adapter (the default) emits a single `main.py` — one
+  `@DBOS.workflow` DAG plus a `@DBOS.step` per node, checkpointing to
+  SQLite or Postgres. `python main.py` *is* the runtime; there is no
+  orchestrator to deploy.
 - The **Temporal** adapter emits `workflow.py` (the orchestration
   class with `@workflow.defn` and signal handlers for the HITL gates)
   and `activities.py` (one `@activity.defn` per node, lazy-importing
@@ -150,6 +159,14 @@ the target runtime's native code shape:
   `signatures/*.ts` (Zod schemas + Anthropic SDK calls) and the
   supporting `wrangler.jsonc` / `package.json` / `tsconfig.json`. The
   output is `wrangler deploy`-ready.
+- The **DBOS (TypeScript)** adapter (`--runtime dbos-ts`) emits a
+  Node.js app for DBOS Transact: `src/main.ts` registers one durable
+  workflow (`DBOS.registerWorkflow`) running the DAG waves and one
+  `DBOS.registerStep` per node, with `DBOS.recv(...)` parking each
+  HITL gate durably in Postgres until `DBOS.send(...)` resumes it.
+  Zero-orchestrator like the Python DBOS target — `node dist/main.js`
+  *is* the runtime — but note the TS SDK is Postgres-only (no SQLite
+  mode; `npx dbos postgres start` covers local dev).
 
 None of the emitted code references an MCP runtime, in either
 language — the agent's crystallization step replaces tool calls with
@@ -242,9 +259,43 @@ agent-driven — so the same IR always produces byte-identical output.
 
 ## Quickstart
 
-### Install
+### Use from Claude Code (recommended)
+
+`rote` ships as a Claude Code plugin, so you can graduate a skill
+without leaving Claude or touching Python tooling:
+
+```
+/plugin marketplace add trevhud/rote
+/plugin install rote@rote
+```
 
-`rote` is not on PyPI yet. Clone and install in editable mode:
+Then say "graduate this skill" (or run `/rote:graduate` directly).
+The plugin confirms the source skill directory, asks which runtime you
+want (Temporal, Cloudflare Workflows, or DBOS), runs the CLI via
+[uv](https://docs.astral.sh/uv/) in the background, and reports the
+emitted pipeline. A second skill, `/rote:serve`, wires graduated
+pipelines up as MCP tools so Claude can trigger the deployed workflows.
+
+Prefer a terminal? The same thing is one `uvx` command:
+
+```sh
+uvx --from rote-cli rote graduate ./my-skill --runtime dbos --out ./graduated
+
+# or straight from GitHub for unreleased changes:
+uvx --from git+https://github.com/trevhud/rote rote graduate \
+  ./my-skill --runtime dbos --out ./graduated
+```
+
+> **Naming note:** the `rote` package on PyPI is an unrelated
+> memoization library that also installs `import rote`, so the two
+> can't share an environment. This project's distribution is
+> `rote-cli` while the CLI command and import name stay `rote` —
+> hence `uvx --from rote-cli rote ...`. See
+> [docs/releasing.md](docs/releasing.md).
+
+### Install from source (development)
+
+Clone and install in editable mode:
 
 ```sh
 git clone https://github.com/trevhud/rote.git
@@ -263,11 +314,12 @@ The repository includes a real BDR outreach skill in
 `examples/bdr-outreach/skill/`. Graduate it:
 
 ```sh
-rote graduate examples/bdr-outreach/skill \
-  --runtime temporal \
-  --out /tmp/bdr-graduated
+rote graduate examples/bdr-outreach/skill --out /tmp/bdr-graduated
 ```
 
+This targets DBOS by default; pass `--runtime temporal` or
+`--runtime cloudflare` for the other adapters.
+
 By default `rote` auto-detects an available agent driver in this
 order: `claude` (Claude Code CLI) → `codex` (Codex CLI) → `api`
 (Anthropic SDK with `ANTHROPIC_API_KEY`). Override with `--agent`:
@@ -286,10 +338,12 @@ The output directory is structured as:
 │   ├── signatures/*.py          # typed LLM-judge signatures
 │   ├── evals/*.jsonl            # seed eval examples
 │   └── graduation-report.md     # human-readable summary
-└── runtime/temporal/            # produced by the adapter
-    ├── workflow.py
-    ├── activities.py
-    └── __init__.py
+└── runtime/dbos/                # produced by the adapter
+    ├── main.py                  # @DBOS.workflow + one @DBOS.step per node
+    ├── extracted/*.py           # copied deterministic functions
+    ├── signatures/*.py          # generated Pydantic + vendor-SDK judges
+    ├── dbos-config.yaml
+    └── README.md                # how to run, signal HITL gates, deploy
 ```
 
 ### Render an IR without re-running the agent
@@ -298,6 +352,7 @@ If you already have a `pipeline.yaml` (hand-written or from a previous
 graduation), `rote emit` runs just the adapter step:
 
 ```sh
+rote emit /path/to/pipeline.yaml --out /tmp/emitted/            # dbos (default)
 rote emit /path/to/pipeline.yaml --runtime temporal --out /tmp/emitted/
 ```
 
@@ -359,10 +414,12 @@ Opus's extra reasoning earns its cost.
 ## Status
 
 `rote` is **pre-1.0**. The end-to-end flow works on the BDR example
-and the test suite covers each layer (133 tests in the fast suite,
-plus 3 slow tests that compile the emitted Cloudflare TypeScript
-against the real `@cloudflare/workers-types` definitions and drive a
-real workflow instance through both HITL gates via `wrangler dev`).
+and the test suite covers each layer (231 tests in the fast suite,
+plus 5 slow tests that run the emitted code against real runtimes:
+a DBOS runtime over SQLite, Temporal's time-skipping test server, the
+emitted Cloudflare TypeScript compiled against real
+`@cloudflare/workers-types` and driven through both HITL gates via
+`wrangler dev`, and the MCP server over a real stdio transport).
 Run `pytest tests/` for the fast suite; `pytest tests/ -m slow` for
 the toolchain-dependent integration tests.
 
@@ -372,6 +429,7 @@ the toolchain-dependent integration tests.
 | Temporal adapter | working (validated with mocked-activities e2e test) |
 | Cloudflare Workflows adapter | working (validated with `tsc --noEmit` over the real emitted output) |
 | DBOS adapter | working (validated against a real DBOS runtime over SQLite in the e2e test) |
+| DBOS TypeScript adapter (`dbos-ts`) | working (validated with `tsc --noEmit` over the real emitted output and a live run on the DBOS TS runtime against Docker Postgres) |
 | Graduator orchestrator | working |
 | `rote graduate` / `rote emit` CLI commands | working |
 | `claude` driver | working |
@@ -379,8 +437,8 @@ the toolchain-dependent integration tests.
 | `codex` driver | stub (`is_available` works; `run` not implemented) |
 | Inngest / Restate adapters | planned |
 | Real implementations of the extracted modules | the agent produces stubs that raise `NotImplementedError`; humans fill them in with real API client code |
-| Workflow data flow between activities | working — nodes declare `inputs:` bindings and all three adapters (Temporal, Cloudflare, DBOS) thread real payloads through the DAG, validated in the runtime e2e tests |
-| Distribution via PyPI | not yet published — install from source. The release pipeline (tag-driven, Trusted Publishing) is in place; see [docs/releasing.md](docs/releasing.md) |
+| Workflow data flow between activities | working — nodes declare `inputs:` bindings and all four adapters (Temporal, Cloudflare, DBOS, DBOS-TS) thread real payloads through the DAG, validated in the runtime e2e tests |
+| Distribution via PyPI | published as [`rote-cli`](https://pypi.org/project/rote-cli/) (`pip install rote-cli`); tag-driven Trusted Publishing releases — see [docs/releasing.md](docs/releasing.md) |
 
 The project explicitly **does not** depend on `claude-agent-sdk`.
 Anthropic's terms of service forbid third-party agents built on the

{rote_cli-0.1.0 → rote_cli-0.4.0}/README.md

@@ -13,8 +13,13 @@ applies a structured graduation rubric, and emits:
 - and runtime code for your durable execution engine of choice.
 
 ```sh
-# Two runtimes shipped today — emit Python for Temporal, or TypeScript
-# for Cloudflare Workflows:
+pip install rote-cli    # or zero-install: uvx --from rote-cli rote ...
+
+# Default target is DBOS — durable execution as a plain Python library,
+# no orchestrator to run, SQLite for dev / Postgres for prod:
+rote graduate ./examples/bdr-outreach/skill --out ./graduated/
+
+# Or target Temporal (Python) or Cloudflare Workflows (TypeScript):
 rote graduate ./examples/bdr-outreach/skill --runtime temporal   --out ./graduated/
 rote graduate ./examples/bdr-outreach/skill --runtime cloudflare --out ./graduated/
 ```
@@ -94,6 +99,10 @@ The graduator independently:
 After the agent finishes, a runtime adapter consumes the IR and emits
 the target runtime's native code shape:
 
+- The **DBOS** adapter (the default) emits a single `main.py` — one
+  `@DBOS.workflow` DAG plus a `@DBOS.step` per node, checkpointing to
+  SQLite or Postgres. `python main.py` *is* the runtime; there is no
+  orchestrator to deploy.
 - The **Temporal** adapter emits `workflow.py` (the orchestration
   class with `@workflow.defn` and signal handlers for the HITL gates)
   and `activities.py` (one `@activity.defn` per node, lazy-importing
@@ -104,6 +113,14 @@ the target runtime's native code shape:
   `signatures/*.ts` (Zod schemas + Anthropic SDK calls) and the
   supporting `wrangler.jsonc` / `package.json` / `tsconfig.json`. The
   output is `wrangler deploy`-ready.
+- The **DBOS (TypeScript)** adapter (`--runtime dbos-ts`) emits a
+  Node.js app for DBOS Transact: `src/main.ts` registers one durable
+  workflow (`DBOS.registerWorkflow`) running the DAG waves and one
+  `DBOS.registerStep` per node, with `DBOS.recv(...)` parking each
+  HITL gate durably in Postgres until `DBOS.send(...)` resumes it.
+  Zero-orchestrator like the Python DBOS target — `node dist/main.js`
+  *is* the runtime — but note the TS SDK is Postgres-only (no SQLite
+  mode; `npx dbos postgres start` covers local dev).
 
 None of the emitted code references an MCP runtime, in either
 language — the agent's crystallization step replaces tool calls with
@@ -196,9 +213,43 @@ agent-driven — so the same IR always produces byte-identical output.
 
 ## Quickstart
 
-### Install
+### Use from Claude Code (recommended)
+
+`rote` ships as a Claude Code plugin, so you can graduate a skill
+without leaving Claude or touching Python tooling:
+
+```
+/plugin marketplace add trevhud/rote
+/plugin install rote@rote
+```
 
-`rote` is not on PyPI yet. Clone and install in editable mode:
+Then say "graduate this skill" (or run `/rote:graduate` directly).
+The plugin confirms the source skill directory, asks which runtime you
+want (Temporal, Cloudflare Workflows, or DBOS), runs the CLI via
+[uv](https://docs.astral.sh/uv/) in the background, and reports the
+emitted pipeline. A second skill, `/rote:serve`, wires graduated
+pipelines up as MCP tools so Claude can trigger the deployed workflows.
+
+Prefer a terminal? The same thing is one `uvx` command:
+
+```sh
+uvx --from rote-cli rote graduate ./my-skill --runtime dbos --out ./graduated
+
+# or straight from GitHub for unreleased changes:
+uvx --from git+https://github.com/trevhud/rote rote graduate \
+  ./my-skill --runtime dbos --out ./graduated
+```
+
+> **Naming note:** the `rote` package on PyPI is an unrelated
+> memoization library that also installs `import rote`, so the two
+> can't share an environment. This project's distribution is
+> `rote-cli` while the CLI command and import name stay `rote` —
+> hence `uvx --from rote-cli rote ...`. See
+> [docs/releasing.md](docs/releasing.md).
+
+### Install from source (development)
+
+Clone and install in editable mode:
 
 ```sh
 git clone https://github.com/trevhud/rote.git
@@ -217,11 +268,12 @@ The repository includes a real BDR outreach skill in
 `examples/bdr-outreach/skill/`. Graduate it:
 
 ```sh
-rote graduate examples/bdr-outreach/skill \
-  --runtime temporal \
-  --out /tmp/bdr-graduated
+rote graduate examples/bdr-outreach/skill --out /tmp/bdr-graduated
 ```
 
+This targets DBOS by default; pass `--runtime temporal` or
+`--runtime cloudflare` for the other adapters.
+
 By default `rote` auto-detects an available agent driver in this
 order: `claude` (Claude Code CLI) → `codex` (Codex CLI) → `api`
 (Anthropic SDK with `ANTHROPIC_API_KEY`). Override with `--agent`:
@@ -240,10 +292,12 @@ The output directory is structured as:
 │   ├── signatures/*.py          # typed LLM-judge signatures
 │   ├── evals/*.jsonl            # seed eval examples
 │   └── graduation-report.md     # human-readable summary
-└── runtime/temporal/            # produced by the adapter
-    ├── workflow.py
-    ├── activities.py
-    └── __init__.py
+└── runtime/dbos/                # produced by the adapter
+    ├── main.py                  # @DBOS.workflow + one @DBOS.step per node
+    ├── extracted/*.py           # copied deterministic functions
+    ├── signatures/*.py          # generated Pydantic + vendor-SDK judges
+    ├── dbos-config.yaml
+    └── README.md                # how to run, signal HITL gates, deploy
 ```
 
 ### Render an IR without re-running the agent
@@ -252,6 +306,7 @@ If you already have a `pipeline.yaml` (hand-written or from a previous
 graduation), `rote emit` runs just the adapter step:
 
 ```sh
+rote emit /path/to/pipeline.yaml --out /tmp/emitted/            # dbos (default)
 rote emit /path/to/pipeline.yaml --runtime temporal --out /tmp/emitted/
 ```
 
@@ -313,10 +368,12 @@ Opus's extra reasoning earns its cost.
 ## Status
 
 `rote` is **pre-1.0**. The end-to-end flow works on the BDR example
-and the test suite covers each layer (133 tests in the fast suite,
-plus 3 slow tests that compile the emitted Cloudflare TypeScript
-against the real `@cloudflare/workers-types` definitions and drive a
-real workflow instance through both HITL gates via `wrangler dev`).
+and the test suite covers each layer (231 tests in the fast suite,
+plus 5 slow tests that run the emitted code against real runtimes:
+a DBOS runtime over SQLite, Temporal's time-skipping test server, the
+emitted Cloudflare TypeScript compiled against real
+`@cloudflare/workers-types` and driven through both HITL gates via
+`wrangler dev`, and the MCP server over a real stdio transport).
 Run `pytest tests/` for the fast suite; `pytest tests/ -m slow` for
 the toolchain-dependent integration tests.
 
@@ -326,6 +383,7 @@ the toolchain-dependent integration tests.
 | Temporal adapter | working (validated with mocked-activities e2e test) |
 | Cloudflare Workflows adapter | working (validated with `tsc --noEmit` over the real emitted output) |
 | DBOS adapter | working (validated against a real DBOS runtime over SQLite in the e2e test) |
+| DBOS TypeScript adapter (`dbos-ts`) | working (validated with `tsc --noEmit` over the real emitted output and a live run on the DBOS TS runtime against Docker Postgres) |
 | Graduator orchestrator | working |
 | `rote graduate` / `rote emit` CLI commands | working |
 | `claude` driver | working |
@@ -333,8 +391,8 @@ the toolchain-dependent integration tests.
 | `codex` driver | stub (`is_available` works; `run` not implemented) |
 | Inngest / Restate adapters | planned |
 | Real implementations of the extracted modules | the agent produces stubs that raise `NotImplementedError`; humans fill them in with real API client code |
-| Workflow data flow between activities | working — nodes declare `inputs:` bindings and all three adapters (Temporal, Cloudflare, DBOS) thread real payloads through the DAG, validated in the runtime e2e tests |
-| Distribution via PyPI | not yet published — install from source. The release pipeline (tag-driven, Trusted Publishing) is in place; see [docs/releasing.md](docs/releasing.md) |
+| Workflow data flow between activities | working — nodes declare `inputs:` bindings and all four adapters (Temporal, Cloudflare, DBOS, DBOS-TS) thread real payloads through the DAG, validated in the runtime e2e tests |
+| Distribution via PyPI | published as [`rote-cli`](https://pypi.org/project/rote-cli/) (`pip install rote-cli`); tag-driven Trusted Publishing releases — see [docs/releasing.md](docs/releasing.md) |
 
 The project explicitly **does not** depend on `claude-agent-sdk`.
 Anthropic's terms of service forbid third-party agents built on the

{rote_cli-0.1.0 → rote_cli-0.4.0}/src/rote/__init__.py

@@ -1,3 +1,3 @@
 """rote — graduate fuzzy AI skills into deterministic workflows."""
 
-__version__ = "0.1.0"
+__version__ = "0.4.0"

{rote_cli-0.1.0 → rote_cli-0.4.0}/src/rote/adapters/__init__.py

@@ -48,12 +48,19 @@ def _dbos_adapter_factory() -> Adapter:
     return DbosAdapter()
 
 
+def _dbos_ts_adapter_factory() -> Adapter:
+    from rote.adapters.dbos_ts import DbosTsAdapter
+
+    return DbosTsAdapter()
+
+
 #: Name → factory. Keep the values as zero-arg callables so adapters can
 #: lazy-import their heavy dependencies.
 ADAPTERS: dict[str, Callable[[], Adapter]] = {
     "temporal": _temporal_adapter_factory,
     "cloudflare": _cloudflare_adapter_factory,
     "dbos": _dbos_adapter_factory,
+    "dbos-ts": _dbos_ts_adapter_factory,
 }
 
 

{rote_cli-0.1.0 → rote_cli-0.4.0}/src/rote/adapters/_common.py

@@ -13,9 +13,63 @@ from __future__ import annotations
 
 import hashlib
 import re
+from pathlib import Path
 
 from rote.ir import Node, Pipeline, parse_input_ref
 
+# ───────── Prose → safe code comment/docstring ─────────
+
+
+def safe_docstring_line(text: str, fallback: str = "") -> str:
+    """First line of ``text``, escaped so it cannot break out of a docstring.
+
+    Node ``description`` is prose (it legitimately contains quotes and
+    backslashes), yet adapters splice its first line straight into a
+    ``\"\"\"…\"\"\"`` Python docstring / block comment. An unescaped
+    ``\"\"\"`` — or a trailing backslash that escapes the closing quote —
+    lets a crafted pipeline.yaml close the docstring early and inject
+    code. Escaping backslashes and double-quotes neutralizes both without
+    charset-restricting prose at the IR layer.
+    """
+    stripped = text.strip() if text else ""
+    first = stripped.splitlines()[0] if stripped else fallback
+    return first.replace("\\", "\\\\").replace('"', '\\"')
+
+
+def safe_block_comment_line(text: str, fallback: str = "") -> str:
+    """First line of ``text``, safe to splice into a ``/* … */`` block comment.
+
+    The TypeScript adapter emits ``description`` first-lines into JSDoc
+    comments. An unescaped ``*/`` would close the comment early and let a
+    crafted pipeline.yaml inject code after it; neutralize the sequence by
+    inserting a space (``*/`` → ``* /``). Newlines are already dropped by
+    taking the first line.
+    """
+    stripped = text.strip() if text else ""
+    first = stripped.splitlines()[0] if stripped else fallback
+    return first.replace("*/", "* /")
+
+
+# ───────── Output-path containment ─────────
+
+
+def resolve_within(base: Path, *parts: str) -> Path:
+    """Join ``parts`` onto ``base`` and assert the result stays inside it.
+
+    Defense-in-depth for emitted-file paths. IR validation already pins
+    ``node.id`` to an identifier, but this guard means any future field
+    that reaches a filename cannot escape the output directory via an
+    absolute segment or ``..`` traversal — it fails loudly at emit time.
+    """
+    base_resolved = base.resolve()
+    target = base_resolved.joinpath(*parts).resolve()
+    if target != base_resolved and base_resolved not in target.parents:
+        raise ValueError(
+            f"Refusing to write outside output directory: {target} is not within {base_resolved}"
+        )
+    return target
+
+
 # ───────── Case conversion ─────────
 
 
@@ -42,7 +96,10 @@ def _pipeline_hash(pipeline: Pipeline) -> str:
     name) so a regenerated pipeline becomes a new type. Old in-flight
     workflows continue on the old code; new workflows use the new code.
     """
-    payload = f"{pipeline.name}|{pipeline.version}|{len(pipeline.nodes)}|{len(pipeline.edges)}"
+    # Hash the full validated contents: node wiring, inputs, retries, and
+    # edges all participate, so any regeneration that changes behavior gets
+    # a new workflow type — name/version/counts alone miss rewires.
+    payload = pipeline.model_dump_json(by_alias=True, exclude_none=True)
     return hashlib.sha256(payload.encode()).hexdigest()[:8]