seclab-taskflow-agent 0.0.7__tar.gz

seclab_taskflow_agent-0.0.7/.devcontainer/Dockerfile

@@ -0,0 +1,22 @@
+# Use Ubuntu 24.04 as base image to match the current environment
+FROM mcr.microsoft.com/devcontainers/base:ubuntu-24.04
+
+# Install system dependencies
+# Note: Python and Git are installed via devcontainer features
+RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
+    && apt-get -y install --no-install-recommends \
+    build-essential \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install CodeQL CLI
+RUN curl -Ls -o /tmp/codeql.zip https://github.com/github/codeql-cli-binaries/releases/latest/download/codeql-linux64.zip \
+    && unzip /tmp/codeql.zip -d /opt \
+    && mv /opt/codeql /opt/codeql-cli \
+    && ln -s /opt/codeql-cli/codeql /usr/local/bin/codeql \
+    && rm /tmp/codeql.zip
+
+# Set working directory
+WORKDIR /workspaces/seclab-taskflow-agent
+
+# The rest of the setup will be done in post-create script

seclab_taskflow_agent-0.0.7/.devcontainer/devcontainer.json

@@ -0,0 +1,56 @@
+{
+  "name": "Seclab Taskflow Agent",
+  "build": {
+    "dockerfile": "Dockerfile",
+    "context": ".."
+  },
+  // Features to add to the dev container
+  "features": {
+    "ghcr.io/devcontainers/features/python:1": {
+      "version": "3.11",
+      "installTools": true
+    },
+    "ghcr.io/devcontainers/features/git:1": {
+      "version": "latest"
+    },
+    "ghcr.io/devcontainers/features/github-cli:1": {
+      "version": "latest"
+    },
+    "ghcr.io/devcontainers/features/docker-in-docker:2": {
+      "version": "latest"
+    }
+  },
+  // Configure tool-specific properties
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "ms-python.python",
+        "ms-python.vscode-pylance",
+        "ms-python.vscode-python-envs",
+        "redhat.vscode-yaml",
+        "GitHub.copilot",
+        "GitHub.copilot-chat",
+        "ms-azuretools.vscode-docker"
+      ],
+      "settings": {
+        "python.useEnvironmentsExtension": true
+      }
+    }
+  },
+  // Use 'forwardPorts' to make a list of ports inside the container available locally
+  "forwardPorts": [],
+  // Use 'postCreateCommand' to run commands after the container is created
+  "postCreateCommand": "bash .devcontainer/post-create.sh",
+  // Use 'postStartCommand' to run commands when the container starts
+  "postAttachCommand": "bash .devcontainer/post-attach.sh",
+  // Environment variables
+  "containerEnv": {
+    "PYTHONUNBUFFERED": "1"
+  },
+  // Set the user to use in the container (non-root)
+  "remoteUser": "vscode",
+  // Grant the container access to the host's Docker daemon
+  "runArgs": [
+    "--init"
+  ]
+}

seclab_taskflow_agent-0.0.7/.devcontainer/post-attach.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+set -e
+
+# If running in Codespaces, check for necessary secrets and print error if missing
+if [ -v CODESPACES ]; then
+    echo "🔐 Running in Codespaces - injecting secrets from Codespaces settings..."
+    if [ ! -v AI_API_TOKEN ]; then
+        echo "⚠️ Running in Codespaces - please add AI_API_TOKEN to your Codespaces secrets"
+    fi
+    if [ ! -v GITHUB_PERSONAL_ACCESS_TOKEN ]; then
+        echo "⚠️ Running in Codespaces - please add GITHUB_PERSONAL_ACCESS_TOKEN to your Codespaces secrets"
+    fi
+fi
+
+echo "💡 Remember to activate the virtual environment: source .venv/bin/activate"

seclab_taskflow_agent-0.0.7/.devcontainer/post-create.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+set -e
+
+echo "🚀 Setting up Seclab Taskflow Agent development environment..."
+
+# Create Python virtual environment
+echo "📦 Creating Python virtual environment..."
+python3 -m venv .venv
+
+# Activate virtual environment and install dependencies
+echo "📥 Installing Python dependencies..."
+source .venv/bin/activate
+python -m pip install --upgrade pip
+python -m pip install hatch
+hatch build
+
+# Install this package from local directory.
+pip install -e .
+
+# Create .env file if it doesn't exist
+if [ ! -f .env ]; then
+    echo "📝 Creating .env template..."
+    echo "# Optional: CodeQL database base path" >> .env
+    echo "⚠️  Please configure the environment or your .env file with required tokens!"
+fi
+
+echo "✅ Development environment setup complete!"

seclab_taskflow_agent-0.0.7/.dockerignore

@@ -0,0 +1,8 @@
+__pycache__
+docker/
+.env
+.venv
+.direnv
+.envrc
+.devcontainer
+.git

seclab_taskflow_agent-0.0.7/.github/workflows/ci.yml

@@ -0,0 +1,42 @@
+name: Python CI
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Run Tests ${{ matrix.python-version }} on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        python-version: ['3.11', '3.13'] # the one we have in the Codespace + the latest supported one by PyO3.
+      fail-fast: false  # Continue testing other version(s) if one fails
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v5
+
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v6
+      with:
+        python-version: ${{ matrix.python-version }}
+        cache: 'pip'
+
+
+    - name: Install Hatch
+      run: pip install --upgrade hatch
+
+    - name: Run static analysis
+      run: |
+        # hatch fmt --check
+        echo linter errors will be fixed in a separate PR
+
+    - name: Run tests
+      run: hatch test --python ${{ matrix.python-version }} --cover --randomize --parallel --retries 2 --retry-delay 1

seclab_taskflow_agent-0.0.7/.github/workflows/codeql.yml

@@ -0,0 +1,44 @@
+name: "CodeQL Advanced"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '29 20 * * 0'
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    permissions:
+      # required for all workflows
+      security-events: write
+
+      # required to fetch internal or private CodeQL packs
+      packages: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build-mode: none
+          - language: python
+            build-mode: none
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v4
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+        queries: security-extended,security-and-quality
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v4
+      with:
+        category: "/language:${{matrix.language}}"

seclab_taskflow_agent-0.0.7/.github/workflows/publish-to-pypi.yaml

@@ -0,0 +1,64 @@
+name: Publish to PyPI
+
+on:
+  push:
+    tags:
+      - v[0-9]+.[0-9]+.[0-9]+
+
+jobs:
+  publish:
+    name: Build
+    runs-on: ubuntu-latest
+
+    # This environment is required as an input to pypa/gh-action-pypi-publish
+    environment:
+      name: pypi
+      url: https://pypi.org/p/seclab-taskflow-agent
+
+    env:
+      GITHUB_REPO: ${{ github.repository }}
+
+    permissions:
+      contents: write
+      id-token: write  # For trusted publishing
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        persist-credentials: false
+
+    - name: Set up Python
+      uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+      with:
+        python-version: "3.13"
+
+    - name: Install Hatch
+      run: pip install --upgrade hatch
+
+    - name: Build the wheel
+      run: python3 -m hatch build
+
+    - name: Upload artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+      with:
+        name: python-package-distributions
+        path: dist/
+
+    - name: Publish to PyPI
+      uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+      with:
+        verbose: true
+
+    - name: Sign with sigstore
+      uses: sigstore/gh-action-sigstore-python@f832326173235dcb00dd5d92cd3f353de3188e6c # v3.1.0
+      with:
+        inputs: >-
+          ./dist/*.tar.gz
+          ./dist/*.whl
+
+    - name: Create GitHub Release
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        RELEASE_NAME: ${{ github.ref_name }}
+      run: gh release create $RELEASE_NAME dist/* --repo $GITHUB_REPO --generate-notes

seclab_taskflow_agent-0.0.7/.github/workflows/publish-to-testpypi.yaml

@@ -0,0 +1,77 @@
+name: Publish Pre-Release to TestPyPI
+
+on: workflow_dispatch
+
+jobs:
+  publish:
+    name: Build
+    runs-on: ubuntu-latest
+
+    # This environment is required as an input to pypa/gh-action-pypi-publish
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/p/seclab-taskflow-agent
+
+    env:
+      GITHUB_REPO: ${{ github.repository }}
+
+    permissions:
+      contents: write
+      id-token: write  # For trusted publishing
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        persist-credentials: false
+
+    - name: Set up Python
+      uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+      with:
+        python-version: "3.13"
+
+    - name: Install Hatch
+      run: pip install --upgrade hatch
+
+    - name: Generate new pre-release version number
+      id: create_version_number
+      run: |
+        # Convert current version number to an alpha release of the next version.
+        # For example, 1.0.2 becomes 1.0.3a0
+        hatch version micro,a
+        # Get latest version number from test.pypi.org
+        CURRENT_VERSION_NUMBER=$(pip index versions --pre --index-url https://test.pypi.org/simple seclab-taskflow-agent | sed 's/[^(]*[(]\([^)]*\)[)].*/\1/' | head -n 1)
+        # Set version number to match test.pypi.org
+        hatch version "$CURRENT_VERSION_NUMBER" || echo TestPyPI is behind current version
+        # Bump version number
+        hatch version a
+        # Create a name for the release
+        echo "RELEASE_NAME=test-release-v`hatch version`" >> $GITHUB_OUTPUT
+
+    - name: Build the wheel
+      run: python3 -m hatch build
+
+    - name: Upload artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+      with:
+        name: python-package-distributions
+        path: dist/
+
+    - name: Publish to TestPyPI
+      uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+      with:
+        repository-url: https://test.pypi.org/legacy/
+        verbose: true
+
+    - name: Sign with sigstore
+      uses: sigstore/gh-action-sigstore-python@f832326173235dcb00dd5d92cd3f353de3188e6c # v3.1.0
+      with:
+        inputs: >-
+          ./dist/*.tar.gz
+          ./dist/*.whl
+
+    - name: Create GitHub Release
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        RELEASE_NAME: ${{ steps.create_version_number.outputs.RELEASE_NAME }}
+      run: gh release create $RELEASE_NAME dist/* --repo $GITHUB_REPO --prerelease --generate-notes

seclab_taskflow_agent-0.0.7/.github/workflows/release.yml

@@ -0,0 +1,53 @@
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: 'Release tag (e.g. v1.0.0)'
+        required: false
+        default: 'latest'
+
+permissions:
+  id-token: write
+  contents: read
+  attestations: write
+  packages: write
+
+env:
+  REGISTRY: ghcr.io
+  USER: githubsecuritylab
+  IMAGE_NAME: seclab-taskflow-agent
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Create release
+        id: docker_build
+        run: |
+          echo ${{ secrets.GHCR_TOKEN }} | docker login ghcr.io -u GitHubSecurityLab --password-stdin
+          python release_tools/publish_docker.py ${{ env.REGISTRY }}/${{ env.USER }}/${{ env.IMAGE_NAME }} ${{ github.event.inputs.release_tag }}
+          DIGEST=$(cat /tmp/digest.txt)
+          echo "digest=$DIGEST" >> $GITHUB_OUTPUT
+
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.USER }}/${{ env.IMAGE_NAME }}
+          subject-digest: '${{ steps.docker_build.outputs.digest }}'
+          push-to-registry: true
+
+      - name: Verify
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh attestation verify oci://ghcr.io/${{ env.USER }}/${{ env.IMAGE_NAME }}:${{ github.event.inputs.release_tag }} -R ${{ github.repository }}

seclab_taskflow_agent-0.0.7/.github/workflows/smoketest.yaml

@@ -0,0 +1,76 @@
+name: Smoke test - run the examples to check for errors
+
+on:
+  issue_comment:
+    types: [created] # Add "smoke test" as a PR comment to trigger this workflow.
+
+# Permissions needed for reacting and adding comments for IssueOps commands
+# See: https://github.com/github/branch-deploy/blob/48285b12b35e47e2dde0c27d2abb33daa846d98b/README.md?plain=1#L189-L197
+permissions:
+  pull-requests: write # Required for commenting on PRs
+  deployments: write # Required for updating deployment statuses
+  contents: write # Required for reading/writing the lock file
+  checks: read # Required for checking if the CI checks have passed in order to deploy the PR
+  statuses: read # Required for checking if all commit statuses are "success" in order to deploy the PR
+
+jobs:
+  Linux:
+    runs-on: ubuntu-latest
+    environment: smoketest
+    if: github.event.issue.pull_request  # Make sure the comment is on a PR
+    steps:
+      - name: branch-deploy
+        id: branch-deploy
+        uses: github/branch-deploy@48285b12b35e47e2dde0c27d2abb33daa846d98b # v11.0.0
+        with:
+          trigger: "smoke test"
+          reaction: "eyes"
+          environment: "smoketest"
+          stable_branch: "main"
+          update_branch: "disabled"
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Checkout the repo
+        uses: actions/checkout@v5
+
+      - name: Checkout the PR
+        env:
+          PR_NUMBER: ${{ github.event.issue.number }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh pr checkout $PR_NUMBER
+
+      - name: Setup Python venv
+        run: |
+          python -m venv .venv
+          source .venv/bin/activate
+          python -m pip install hatch
+
+      - name: Run tests
+        env:
+          AI_API_TOKEN: ${{ secrets.AI_API_TOKEN }}
+          GITHUB_AUTH_HEADER: "Bearer ${{ secrets.GITHUB_TOKEN }}"
+
+        run: |
+          source .venv/bin/activate
+          hatch build
+          hatch run main -p seclab_taskflow_agent.personalities.assistant 'explain modems to me please'
+          hatch run main -p seclab_taskflow_agent.personalities.c_auditer 'explain modems to me please'
+          hatch run main -p examples.personalities.echo 'explain modems to me please'
+          hatch run main -t examples.taskflows.CVE-2023-2283
+          hatch run main -t examples.taskflows.echo
+          hatch run main -t examples.taskflows.example
+          hatch run main -t examples.taskflows.example_globals
+          hatch run main -t examples.taskflows.example_inputs
+          hatch run main -t examples.taskflows.example_large_list_result_iter
+          hatch run main -t examples.taskflows.example_repeat_prompt
+          hatch run main -t examples.taskflows.example_repeat_prompt_async
+          hatch run main -t examples.taskflows.example_repeat_prompt_dictionary
+          hatch run main -t examples.taskflows.example_reusable_prompt
+          hatch run main -t examples.taskflows.example_reusable_taskflows
+          hatch run main -t examples.taskflows.example_triage_taskflow
+          hatch run main -t examples.taskflows.single_step_taskflow

seclab_taskflow_agent-0.0.7/.gitignore

@@ -0,0 +1,185 @@
+.direnv
+.envrc
+
+# https://github.com/github/gitignore/blob/main/Python.gitignore
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# emacs backup files
+*~
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py,cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+#Pipfile.lock
+
+# UV
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+#poetry.lock
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#pdm.lock
+#   pdm stores project-wide configurations in .pdm.toml, but it is recommended to not include it
+#   in version control.
+#   https://pdm.fming.dev/latest/usage/project/#working-with-version-control
+.pdm.toml
+.pdm-python
+.pdm-build/
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#  JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#  and can be added to the global gitignore or merged into this file.  For a more nuclear
+#  option (not recommended) you can uncomment the following to ignore the entire idea folder.
+#.idea/
+
+# Ruff stuff:
+.ruff_cache/
+
+# PyPI configuration file
+.pypirc
+
+#config.yaml
+config.yaml
+
+#database
+*.db

seclab_taskflow_agent-0.0.7/CODEOWNERS

@@ -0,0 +1,2 @@
+# This repository is maintained by: 
+* @m-y-mo @p- @jarlob @kevinbackhouse @sylwia-budzynska @kwstubbs