sliceagent 0.1.0__py3-none-any.whl

sliceagent/__init__.py

@@ -0,0 +1,3 @@
+"""sliceagent — a memory-native coding agent (deterministic, bounded, reconstructed context)."""
+
+__version__ = "0.1.0"

sliceagent/__main__.py

@@ -0,0 +1,6 @@
+"""Enable `python -m sliceagent`. The console-script (`sliceagent`) regenerates with a stale shebang when the
+venv is moved, so this module path is the reliable way to launch from a source checkout."""
+from .cli import main
+
+if __name__ == "__main__":
+    main()

sliceagent/access.py

@@ -0,0 +1,93 @@
+"""Resource-access model for safe tool parallelism.
+
+Each tool declares what it touches; the scheduler runs non-conflicting tool calls
+concurrently and serializes conflicting ones. Two accesses conflict iff one is
+`AllAccess` (globally exclusive, e.g. a shell), OR one writes AND their paths overlap.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True)
+class FileAccess:
+    operation: str  # "read" | "write" | "readwrite" | "search"
+    path: str
+    recursive: bool = False
+
+
+@dataclass(frozen=True)
+class AllAccess:
+    """An un-representable side effect (shell, network). Globally exclusive."""
+
+
+@dataclass(frozen=True)
+class ReadAllAccess:
+    """A workspace-WIDE READ with no side effect (a read-only explorer subagent: it may read/list/grep/
+    recall anywhere, but cannot write/run). Conflicts with any WRITER (AllAccess or a write FileAccess)
+    but NEVER with another ReadAllAccess or a plain read — so N explorers fan out concurrently while any
+    writing child still serializes. This is what turns the dormant one-at-a-time swarm into a real swarm."""
+
+
+Access = FileAccess | AllAccess | ReadAllAccess
+Accesses = list[Access]
+
+
+# convenience builders
+def none() -> Accesses:
+    return []
+
+
+def all_() -> Accesses:
+    return [AllAccess()]
+
+
+def read_file(path: str) -> Accesses:
+    return [FileAccess("read", path)]
+
+
+def write_file(path: str) -> Accesses:
+    return [FileAccess("readwrite", path)]
+
+
+def search_tree(path: str) -> Accesses:
+    return [FileAccess("search", path, recursive=True)]
+
+
+def _writes(op: str) -> bool:
+    return op in ("write", "readwrite")
+
+
+def _norm(path: str) -> str:
+    p = path.replace("\\", "/")
+    while "//" in p:
+        p = p.replace("//", "/")
+    p = p.lower()
+    return p[:-1] if len(p) > 1 and p.endswith("/") else p
+
+
+def _overlap(left: FileAccess, right: FileAccess) -> bool:
+    lp, rp = _norm(left.path), _norm(right.path)
+    if lp == rp:
+        return True
+    lpre = lp if lp.endswith("/") else lp + "/"
+    rpre = rp if rp.endswith("/") else rp + "/"
+    return (left.recursive and rp.startswith(lpre)) or (right.recursive and lp.startswith(rpre))
+
+
+def _pair_conflict(left: Access, right: Access) -> bool:
+    if isinstance(left, AllAccess) or isinstance(right, AllAccess):
+        return True
+    ra_left, ra_right = isinstance(left, ReadAllAccess), isinstance(right, ReadAllAccess)
+    if ra_left or ra_right:
+        if ra_left and ra_right:
+            return False                                   # two workspace-wide reads never conflict
+        other = right if ra_left else left                 # the other side is a FileAccess (AllAccess handled above)
+        return _writes(other.operation)                    # read-all conflicts ONLY with a write, never with a read
+    if not (_writes(left.operation) or _writes(right.operation)):
+        return False  # read/read, read/search never conflict
+    return _overlap(left, right)
+
+
+def conflict(left: Accesses, right: Accesses) -> bool:
+    return any(_pair_conflict(a, b) for a in left for b in right)

sliceagent/agents.py

@@ -0,0 +1,173 @@
+"""Named-agent registry — file-defined subagent KINDS.
+
+sliceagent's subagents were two HARDCODED kinds (read-only explorer + writable). The kinds are now a
+pluggable REGISTRY: each agent is a {name, description, tools-allowlist, reasoning, system-prompt}
+definition, discovered from `<root>/agents/*.md` (markdown + frontmatter — sliceagent's own SKILL.md idiom),
+and the model spawns one BY NAME via the generic `spawn_agent` tool. Built-ins (explorer, general) ship
+in-tree; user files add or override by name.
+
+Periphery, NOT the moat: a spawned agent still runs the bounded slice loop and returns only a summary.
+"""
+from __future__ import annotations
+
+import glob
+import os
+from dataclasses import dataclass
+
+# An EXPLORER's read-only surface — the single source of truth (subagent.py imports this).
+# `grep` (find by CONTENT) + `glob` (find by NAME) are the two discovery tools; both read-only.
+READ_ONLY_TOOLS = ("read_file", "list_files", "grep", "glob", "skill", "recall_history", "code_review")
+_READ_ONLY_SET = frozenset(READ_ONLY_TOOLS)   # mutability is decided against this KNOWN-safe set (pessimistic)
+
+# Tools NO subagent may use, regardless of its allowlist. A
+# subagent must not stop to ask the END-USER — ambiguity is the parent's job; a child that blocks on input
+# is a stall (and racy/meaningless when several run in parallel). It returns its summary instead.
+SUBAGENT_EXCLUDED_TOOLS = frozenset({"ask_user"})
+
+# Mutating tools — an agent whose allowlist includes ANY of these is "writable" (globally serialized vs
+# other writers); an allowlist with none of them is read-only (parallelizes as a swarm).
+WRITE_TOOLS = frozenset({
+    "edit_file", "append_to_file", "str_replace", "run_command", "execute_code",
+    "world_set", "world_clear", "require", "drop_requirement", "requirement_done", "update_plan",
+    "set_mission", "mission_done",
+    "terminal_open", "terminal_send", "terminal_read", "terminal_wait", "terminal_close",
+    "proc_start", "proc_poll", "proc_tail", "proc_wait", "proc_kill",
+    "spawn_subagent", "spawn_explore", "spawn_agent",
+})
+
+
+@dataclass(frozen=True)
+class AgentSpec:
+    """One subagent KIND. `tools=None` → inherit the parent's FULL tool surface (a 'general' agent)."""
+    name: str
+    description: str = ""
+    tools: tuple[str, ...] | None = None   # allowlist of tool names the child may use (None = all)
+    reasoning: str | None = None           # "fast" | "full" | None (inherit the parent's)
+    system_prompt: str = ""                # extra system-prompt layer prepended for the child
+    summary_is_deliverable: bool = False   # the child's SUMMARY is the product (a trailing failing check is
+    #                                        intentional, not a crash) — like a verifier that ends on a FAIL.
+
+    @property
+    def read_only(self) -> bool:
+        """A child is read-only iff EVERY tool in its allowlist is a KNOWN read-only tool. Pessimistic by
+        design: an unknown / plugin / MCP tool is NOT assumed safe (the old check only excluded the static
+        WRITE_TOOLS names, so a side-effecting plugin tool was mis-classified read-only and could be
+        scheduled as a parallel non-writer). None (full surface) is writable."""
+        return self.tools is not None and set(self.tools).issubset(_READ_ONLY_SET)
+
+
+BUILTIN_AGENTS: dict[str, AgentSpec] = {
+    "explorer": AgentSpec(
+        name="explorer",
+        description="Read-only investigation — find files, trace usages, understand code; returns a summary. "
+                    "Fan out several in one turn for breadth.",
+        tools=READ_ONLY_TOOLS, reasoning="fast",
+        system_prompt="You are a read-only EXPLORER subagent: investigate the task by reading/grepping and "
+                      "return a concise summary of what you found (files, locations, conclusions). You cannot "
+                      "modify anything — do not attempt edits or commands.",
+    ),
+    "general": AgentSpec(
+        name="general",
+        description="A full sub-agent for ONE self-contained sub-task (can read AND edit/run); returns a summary.",
+        tools=None, reasoning=None,
+        system_prompt="You are a SUBAGENT handling one self-contained sub-task in the shared workspace. Do the "
+                      "work, then return a concise summary of what you changed and verified. Do NOT ask the "
+                      "user; if the task is ambiguous, make the best reasonable choice and note it in the summary.",
+    ),
+    # An independent ADVERSARIAL verifier. Runs in a FRESH
+    # slice and returns only a VERDICT + evidence — so it complements the parent's structural done-gates
+    # (OracleHook/SelfCheckHook) with a second, skeptical opinion WITHOUT any context crossing the seal.
+    # Read-only EXCEPT running checks: read/grep + run_command/execute_code (to build/test/probe), no edit
+    # tools (the allowlist is enforced at runtime in subagent.py). It is "writable" by classification (shell
+    # is in WRITE_TOOLS) so it serializes vs other writers — correct for a verifier that runs tests.
+    "verification": AgentSpec(
+        name="verification",
+        description="Independent adversarial VERIFIER — given a change/claim, TRY TO BREAK IT (reproduce, run "
+                    "build/tests, probe edges) and return VERDICT: PASS/FAIL/PARTIAL with command evidence. "
+                    "Read-only except running checks. Spawn after a non-trivial change, before reporting done.",
+        tools=READ_ONLY_TOOLS + ("run_command", "execute_code"),
+        reasoning="full",
+        summary_is_deliverable=True,   # a FAIL verdict normally ends on a failing check — that's the product,
+        #                                not a crash; don't reclassify it as "did not finish cleanly".
+        system_prompt=(
+            "You are an independent VERIFICATION subagent. Your job is NOT to confirm the work is done — it is "
+            "to TRY TO BREAK IT. You are given a task/claim and the change that was made; verify it "
+            "INDEPENDENTLY and decide.\n"
+            "Avoid two failure modes: (1) verification AVOIDANCE — reading code and narrating what you WOULD "
+            "test, then writing PASS. Reading is NOT verification; RUN it. (2) being seduced by the first 80% "
+            "— a passing test suite or the happy path is not proof; your value is the last 20%.\n"
+            "DO NOT MODIFY THE PROJECT: no editing/creating/deleting project files, no installing deps, no git "
+            "writes. You MAY write EPHEMERAL probe scripts to a temp dir WHERE THE SANDBOX ALLOWS (e.g. $TMPDIR "
+            "or /tmp, via run_command/execute_code) and clean up after yourself.\n"
+            "Method: REPRODUCE the original issue/scenario; run the cheapest sufficient build/test; then RUN at "
+            "least ONE adversarial probe — a boundary/empty/large input, idempotency, the EXACT property the "
+            "task names, or a related path that could regress. The implementer is also an LLM, so its tests may "
+            "be happy-path — verify end-to-end yourself.\n"
+            "Before PASS: you must have RUN at least one adversarial probe and observed its real output. Before "
+            "FAIL: check the issue isn't already handled elsewhere or intentional.\n"
+            "Format every check as — Check: <what> / Command: <exact> / Output: <actual observed, not "
+            "paraphrased> / PASS or FAIL. A check with no command output is a SKIP, not a PASS. END your "
+            "summary with EXACTLY one line: 'VERDICT: PASS' or 'VERDICT: FAIL' or 'VERDICT: PARTIAL' (PARTIAL "
+            "only for environment limits — missing tool/deps/can't run — never for 'unsure'). Do NOT ask the user."
+        ),
+    ),
+}
+
+
+def _parse_agent_md(path: str) -> AgentSpec | None:
+    """Parse an agent file: optional `---` frontmatter (name/description/tools/reasoning) + body = system
+    prompt. Never raises — a malformed/unreadable file is skipped (returns None)."""
+    try:
+        with open(path, encoding="utf-8") as f:
+            text = f.read()
+    except OSError:
+        return None
+    meta: dict[str, str] = {}
+    body = text
+    if text.startswith("---"):
+        end = text.find("\n---", 3)
+        if end == -1:
+            # opening fence but no closing one (authoring typo). FAIL CLOSED: don't fall through to the
+            # no-frontmatter path, which would leave tools=None (= full writable surface) for a file that
+            # was trying to declare a restrictive tool list. Skip it, per the "malformed → skipped" contract.
+            return None
+        if end != -1:
+            for line in text[3:end].splitlines():
+                line = line.strip()
+                if ":" in line and not line.startswith("#"):
+                    k, v = line.split(":", 1)
+                    meta[k.strip().lower()] = v.strip()
+            body = text[end + 4:].lstrip("\n")
+    name = meta.get("name") or os.path.splitext(os.path.basename(path))[0]
+    if not name:
+        return None
+    tools_raw = meta.get("tools")
+    # #58: accept both the scalar list `tools: a, b` AND inline YAML `tools: [a, b]` — strip brackets/quotes
+    # before splitting so a bracketed value doesn't become tool names like "[a".
+    # A PRESENT-but-blank `tools:` means restrict to ZERO tools (read-only, matching `tools: []`); only an
+    # ABSENT key grants the full writable surface (None).
+    if "tools" in meta and not str(tools_raw or "").strip():
+        tools = ()
+    elif tools_raw:
+        tools = tuple(t for t in tools_raw.replace(",", " ").replace("[", " ").replace("]", " ")
+                      .replace("'", " ").replace('"', " ").split() if t)
+    else:
+        tools = None
+    reasoning = (meta.get("reasoning") or "").lower() or None
+    return AgentSpec(name=name, description=meta.get("description", ""),
+                     tools=tools, reasoning=reasoning, system_prompt=body.strip())
+
+
+def load_agents(roots) -> dict[str, AgentSpec]:
+    """Built-in agents overlaid with user-defined `<root>/agents/*.md` (later roots / user files win by
+    name). `roots` are dirs that MAY contain an `agents/` subdir."""
+    out = dict(BUILTIN_AGENTS)
+    for root in roots or []:
+        adir = os.path.join(root, "agents")
+        if not os.path.isdir(adir):
+            continue
+        for path in sorted(glob.glob(os.path.join(adir, "*.md"))):
+            spec = _parse_agent_md(path)
+            if spec:
+                out[spec.name] = spec
+    return out

sliceagent/background_review.py

@@ -0,0 +1,146 @@
+"""Async background-review fork (item 16) — OPT-IN, OFF by default, behind an env flag.
+
+After a turn, fork a daemon thread that critiques the just-finished episode and writes lessons
+to the memory store. sliceagent has NO transcript to replay, so
+the fork instead re-runs the EXISTING consolidation code (consolidate.promote_episodes /
+promote_procedures) over the durable episodic JSONL — same write surface as session-end
+consolidate, just incremental and off the critical path.
+
+WHY THIS CAN'T DESTABILIZE THE DEFAULT PATH (the hard requirement):
+  - OFF by default. Only runs when AGENT_BACKGROUND_REVIEW is truthy.
+  - The fork reads ONLY the durable episodic cache (already flushed to disk by hippocampus.py's EpisodeSink)
+    and writes ONLY to durable stores (memem remember / SKILL.md / FTS5 index). It NEVER
+    touches the Slice, the Session, the loop, the dispatcher, or the prompt cache.
+  - It is a daemon thread: it can't block process exit and an exception in it is swallowed.
+  - Re-entrancy guard: at most one review in flight; a new turn while one runs is skipped.
+  - The main turn has already returned before this is even spawned (cli wires it AFTER
+    run_turn), so latency is never on the user's critical path.
+
+NO-TRANSCRIPT INVARIANT: upheld structurally — the worker's only inputs are durable records
+and its only outputs are durable stores. Nothing it does can enter a slice tier directly; a
+lesson it writes is recalled later through the SAME relevance-gated memory tier as any other.
+
+PUBLIC SIGNATURES (pinned):
+    background_review_enabled() -> bool
+    class BackgroundReviewer:
+        def __init__(self, memory, *, scope: str, on_log=None) -> None
+        def review(self, session_id: str) -> None        # spawns the daemon (no-op if disabled/busy)
+        def join(self, timeout: float | None = None) -> None   # tests/shutdown: wait for the worker
+    make_background_reviewer(memory, *, scope: str, on_log=None) -> BackgroundReviewer | None
+"""
+from __future__ import annotations
+
+import os
+import threading
+
+_ENV_FLAG = "AGENT_BACKGROUND_REVIEW"
+
+
+def background_review_enabled() -> bool:
+    """True iff AGENT_BACKGROUND_REVIEW is set truthy. OFF by default — the whole feature is
+    inert unless explicitly opted in, so the synchronous default path is byte-for-byte unchanged."""
+    return str(os.environ.get(_ENV_FLAG, "")).strip().lower() in ("1", "true", "yes", "on")
+
+
+class BackgroundReviewer:
+    """Forks a daemon thread per review that consolidates the latest episode incrementally.
+
+    Reuses consolidate.promote_episodes / promote_procedures verbatim (the moat's existing
+    write logic) — this module adds ONLY the fork + safety scaffolding, no new mining logic.
+    """
+
+    def __init__(self, memory, *, scope: str, on_log=None) -> None:
+        self.memory = memory
+        self.scope = scope
+        self._on_log = on_log
+        self._lock = threading.Lock()
+        self._busy = False
+        self._thread: threading.Thread | None = None
+
+    def review(self, session_id: str) -> None:
+        """Spawn the review daemon for `session_id`. No-op when disabled, when memory isn't
+        durable, or when a prior review is still running (re-entrancy guard). Returns
+        immediately — the work happens off-thread."""
+        if not background_review_enabled():
+            return
+        if not getattr(self.memory, "is_durable", False):
+            return
+        with self._lock:
+            if self._busy:
+                return                      # at most one review in flight
+            self._busy = True
+        t = threading.Thread(
+            target=self._run, args=(session_id,),
+            name="sliceagent-bg-review", daemon=True)
+        # publish self._thread only AFTER a successful start: otherwise a start() failure both latches
+        # _busy=True forever (no more reviews) AND leaves join() calling .join() on a never-started thread.
+        try:
+            t.start()
+        except Exception:  # noqa: BLE001 — a thread-spawn failure must not escape into the foreground caller
+            with self._lock:
+                self._busy = False
+            self._log("background review: thread start failed")
+            return
+        self._thread = t
+
+    def join(self, timeout: float | None = None) -> None:
+        """Wait for the in-flight review (for deterministic tests / clean shutdown)."""
+        t = self._thread
+        if t is not None:
+            t.join(timeout)
+
+    def _log(self, msg: str) -> None:
+        if self._on_log is not None:
+            try:
+                self._on_log(msg)
+            except Exception:
+                pass
+
+    def _run(self, session_id: str) -> None:
+        """Worker body — durable-in, durable-out. Every failure is swallowed: a background
+        critique must NEVER affect the foreground session."""
+        try:
+            from .neocortex import promote_episodes, promote_procedures, render_skill
+            records = self.memory.read_episodes(session_id)
+            if not records:
+                return
+            # critique the LATEST turn in the context of the session: promote_* are pure and
+            # frequency-weight across the whole session, so passing all records gives the newest
+            # corrective/procedural signal its proper recurrence count. Dedup against what's
+            # already stored is memem's job (remember is idempotent-ish on identical content).
+            lessons = promote_episodes(records)
+            for lesson in lessons:
+                try:
+                    self.memory.remember(lesson["content"], title=lesson["title"], scope=self.scope,
+                                         tags=lesson["tags"], paths=lesson.get("files"))  # file-context parity
+                except Exception:
+                    pass
+            procs = promote_procedures(records)
+            if procs:
+                from .memory import _skills_dir, write_skill_file   # SAME guarded writer as session-end
+                from .skill_provenance import AUTO, reset_authoring_origin, set_authoring_origin
+                skills_dir = _skills_dir()
+                token = set_authoring_origin(AUTO)   # mark fork-authored skills curator-prunable
+                try:
+                    for proc in procs:
+                        # guarded writer: validate frontmatter + strict threat-scan + redact + ATOMIC replace
+                        # (parity with memory.consolidate; closes the bypass + non-atomic-write bugs)
+                        write_skill_file(proc["name"], render_skill(proc), skills_dir=skills_dir)
+                finally:
+                    reset_authoring_origin(token)
+            self._log(f"background review: {len(lessons)} lesson(s), {len(procs)} skill(s)")
+        except Exception:
+            pass
+        finally:
+            with self._lock:
+                self._busy = False
+
+
+def make_background_reviewer(memory, *, scope: str, on_log=None) -> BackgroundReviewer | None:
+    """Factory. Returns None when the feature is disabled OR memory isn't durable — so the
+    host can skip wiring entirely and the default path adds zero objects."""
+    if not background_review_enabled():
+        return None
+    if not getattr(memory, "is_durable", False):
+        return None
+    return BackgroundReviewer(memory, scope=scope, on_log=on_log)

sliceagent/binsniff.py

@@ -0,0 +1,89 @@
+"""Binary-file sniffing (build task: binsniff) — keep text-only tools from choking on binaries.
+
+A read_file / str_replace / fuzzy edit only makes sense on TEXT. Feeding a .png, a .so, or a
+mojibake blob through those paths corrupts the slice (garbage in OPEN FILES) and wastes tokens.
+This module is the single cheap gate the file tools call BEFORE treating bytes as text.
+
+Two independent signals, in cost order:
+    1. Extension  — a pure string check, no I/O (`has_binary_extension`). Catches the common case
+       (.png/.so/.zip/...) without ever reading the file.
+    2. Content    — a NUL byte, or >30% non-printable control chars (excluding \\n \\r \\t) in a
+       head sample, marks bytes that decoded to text but clearly are not text.
+
+NO-TRANSCRIPT INVARIANT: pure functions over a path string + a head sample; no state, no growing
+context, no I/O of their own. The caller supplies the sample (already bounded to a file head).
+
+PUBLIC SIGNATURES (pinned):
+    BINARY_EXTENSIONS: frozenset[str]
+    has_binary_extension(path: str) -> bool
+    looks_binary(path: str, sample: str) -> bool
+"""
+
+# Extensions whose contents can't be meaningfully treated as text.
+BINARY_EXTENSIONS = frozenset({
+    # Images
+    ".png", ".jpg", ".jpeg", ".gif", ".bmp", ".ico", ".webp", ".tiff", ".tif",
+    # Videos
+    ".mp4", ".mov", ".avi", ".mkv", ".webm", ".wmv", ".flv", ".m4v", ".mpeg", ".mpg",
+    # Audio
+    ".mp3", ".wav", ".ogg", ".flac", ".aac", ".m4a", ".wma", ".aiff", ".opus",
+    # Archives
+    ".zip", ".tar", ".gz", ".bz2", ".7z", ".rar", ".xz", ".z", ".tgz", ".iso",
+    # Executables/binaries
+    ".exe", ".dll", ".so", ".dylib", ".bin", ".o", ".a", ".obj", ".lib",
+    ".app", ".msi", ".deb", ".rpm",
+    # Documents (exclude .pdf — text-based, agents may want to inspect)
+    ".doc", ".docx", ".xls", ".xlsx", ".ppt", ".pptx",
+    ".odt", ".ods", ".odp",
+    # Fonts
+    ".ttf", ".otf", ".woff", ".woff2", ".eot",
+    # Bytecode / VM artifacts
+    ".pyc", ".pyo", ".class", ".jar", ".war", ".ear", ".node", ".wasm", ".rlib",
+    # Database files
+    ".sqlite", ".sqlite3", ".db", ".mdb", ".idx",
+    # Design / 3D
+    ".psd", ".ai", ".eps", ".sketch", ".fig", ".xd", ".blend", ".3ds", ".max",
+    # Flash
+    ".swf", ".fla",
+    # Lock/profiling data
+    ".lockb", ".dat", ".data",
+})
+
+# How many leading chars of the sample to inspect, and the non-printable fraction that
+# tips a decoded-but-not-text blob over into "binary".
+_HEAD = 1000
+_NON_PRINTABLE_RATIO = 0.30
+
+
+def has_binary_extension(path: str) -> bool:
+    """True if `path` has a known binary extension. Pure string check, no I/O."""
+    dot = path.rfind(".")
+    if dot == -1:
+        return False
+    return path[dot:].lower() in BINARY_EXTENSIONS
+
+
+def looks_binary(path: str, sample: str) -> bool:
+    """True if `path` is binary by extension, or `sample` looks binary by content.
+
+    Content is binary when it contains a NUL byte, or when more than 30% of the first
+    1000 chars are non-printable control chars (ord < 32, excluding \\n \\r \\t).
+
+    `sample == ''` means we have no content signal -> non-binary unless the extension says so.
+    O(head sample) only; never reads the file itself.
+    """
+    if has_binary_extension(path):
+        return True
+    if not sample:
+        return False
+    head = sample[:_HEAD]
+    if "\x00" in head:  # a single NUL is a definitive binary marker
+        return True
+    non_printable = sum(1 for c in head if ord(c) < 32 and c not in "\n\r\t")
+    return non_printable / len(head) > _NON_PRINTABLE_RATIO
+
+
+if __name__ == "__main__":  # smoke: a .png ext and a NUL sample are binary; plain text is not
+    assert looks_binary("logo.png", "") and looks_binary("x.txt", "a\x00b")
+    assert not looks_binary("notes.txt", "plain readable text\nwith newlines\n")
+    print("binsniff smoke OK")