superqode 2.4.41__tar.gz → 2.4.43__tar.gz

{superqode-2.4.41 → superqode-2.4.43}/CHANGELOG.md

@@ -7,6 +7,43 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.4.43] - 2026-10-02
+
+### Added
+
+- Share MCP configuration and client controls with hosted PiPy, including
+  deferred discovery, background connections and shared OAuth credentials.
+- Add optional Monty tool programs with bounded native read batches and
+  branch-local values, plus opt-in PiPy coding WorkOrder process recovery.
+- Add offline PiPy SDK examples and repeated, independently graded benchmark
+  comparisons. Live competitor benchmarking remains deferred.
+
+### Changed
+
+- Describe PiPy as a Pi-inspired Pythonic version in the TUI harness pickers.
+
+### Fixed
+
+- Preserve supported PiPy input and tool images through the provider gateway.
+- Validate MCP OAuth identity and callbacks, serialize credential refresh, and
+  check current policy and workspace state before reusing saved outcomes.
+
+## [2.4.42] - 2026-10-02
+
+### Fixed
+
+- Distinguish exhausted API quota from temporary rate limits, skip futile quota
+  retries, and avoid repeating rate-limited streams as non-streaming requests.
+- Route GPT-6.1 Sol and GPT-6 Astra through OpenAI Responses for Core tool calls,
+  preserve native streaming and reasoning effort with older LiteLLM catalogs,
+  omit unsupported sampling controls, and report invalid requests immediately
+  instead of repeating them without streaming.
+- Allow read-only shell commands to discard output through `/dev/null` while
+  continuing to block device writes and require approval for file writes.
+- Keep experimental subscription guidance concise and remove internal adapter
+  and testing details from the connection picker.
+- Explain that a denied tool call does not imply all repository access is blocked.
+
 ## [2.4.41] - 2026-10-01
 
 ### Fixed

{superqode-2.4.41 → superqode-2.4.43}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: superqode
-Version: 2.4.41
+Version: 2.4.43
 Summary: The harness layer for coding agents
 Author-email: Shashi Jagtap <info@super-agentic.ai>
 Maintainer-email: Shashi Jagtap <info@super-agentic.ai>

superqode-2.4.43/examples/pipy/custom_tool.py

@@ -0,0 +1,53 @@
+"""A custom read tool through the public SDK; no provider calls."""
+
+import asyncio
+
+from superqode.pipy import (
+    AgentHarness,
+    AgentTool,
+    AgentToolResult,
+    MemorySessionStorage,
+    Model,
+    ToolCall,
+    create_session,
+)
+from superqode.pipy.ai import FakeStream, text_response, tool_response
+
+
+async def lookup(call_id, args, signal=None, on_update=None):
+    if signal:
+        signal.throw_if_aborted()
+    return AgentToolResult(content=f"Found {args['key']}", details={"key": args["key"]})
+
+
+async def main():
+    tool = AgentTool(
+        name="lookup",
+        label="Lookup",
+        description="Read an example record",
+        parameters={
+            "type": "object",
+            "properties": {"key": {"type": "string"}},
+            "required": ["key"],
+            "additionalProperties": False,
+        },
+        execute_fn=lookup,
+        replay_safe=True,
+    )
+    harness = AgentHarness(
+        session=await create_session(MemorySessionStorage()),
+        model=Model(id="offline", provider="fixture"),
+        tools=[tool],
+        stream_fn=FakeStream(
+            [
+                tool_response(ToolCall(id="lookup-1", name="lookup", arguments={"key": "example"})),
+                text_response("Custom tool completed."),
+            ]
+        ),
+    )
+    result = await harness.prompt("Find the example")
+    print(result.text)
+
+
+if __name__ == "__main__":
+    asyncio.run(main())

superqode-2.4.43/examples/pipy/session.py

@@ -0,0 +1,36 @@
+"""Small public SDK example. Offline unless --provider and --model are supplied."""
+
+import argparse
+import asyncio
+from pathlib import Path
+
+from superqode.pipy import CodingSessionOptions, PiPyCodingSession, Model
+from superqode.pipy.ai import FakeStream, text_response
+
+
+async def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--cwd", type=Path, default=Path.cwd())
+    parser.add_argument("--session-root", type=Path, required=True)
+    parser.add_argument("--provider")
+    parser.add_argument("--model")
+    parser.add_argument("--prompt", default="Summarise this repository.")
+    args = parser.parse_args()
+    if bool(args.provider) != bool(args.model):
+        parser.error("Supply both --provider and --model")
+    options = CodingSessionOptions(
+        cwd=args.cwd,
+        session_root=args.session_root,
+        model=Model(id=args.model or "offline", provider=args.provider or "fixture"),
+        stream_fn=None
+        if args.provider
+        else FakeStream([text_response("Offline SDK example completed.")]),
+    )
+    session = await PiPyCodingSession.create(options)
+    response = await session.prompt(args.prompt)
+    print(response.text)
+    print(f"Session: {session.session_path}")
+
+
+if __name__ == "__main__":
+    asyncio.run(main())

{superqode-2.4.41 → superqode-2.4.43}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "superqode"
-version = "2.4.41"
+version = "2.4.43"
 description = "The harness layer for coding agents"
 readme = "README.md"
 license = "Apache-2.0"
@@ -81,8 +81,8 @@ mlx = [
 ]
 monty = [
     # Monty 1.x is the supported research/eval and python_repl extra.
-    # Dump format is not cross-major compatible (v1 dumps will not load on
-    # older workers), so keep the upper bound under 2.
+    # Saved programs additionally pin API version and actual worker bytes;
+    # the major-version bound alone is not snapshot compatibility evidence.
     "pydantic-monty>=1.0.0,<2",
 ]
 semantic = [

{superqode-2.4.41 → superqode-2.4.43}/src/superqode/__init__.py

@@ -38,7 +38,7 @@ __all__ = [
     "sidebar",
 ]
 
-__version__ = "2.4.41"
+__version__ = "2.4.43"
 
 # Stable, lightweight public extension surface.  Importing this package does
 # not discover or execute third-party extensions; discovery happens only when

{superqode-2.4.41 → superqode-2.4.43}/src/superqode/agent/command_safety.py

@@ -203,7 +203,7 @@ _DESTRUCTIVE_PATTERNS = [
     r"\bmkfs\.",
     r"\bdd\b[^|]*\bof=",
     r":\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:",  # fork bomb
-    r">\s*/dev/(sd|nvme|disk|hd)",
+    r">\s*/dev/(?!null(?:\s|[;&|)]|$))",
     r"\bchmod\s+(-R\s+)?0?777\b",
     r"\bchown\s+-R\b",
     r"\b(shutdown|reboot|halt|poweroff)\b",
@@ -286,8 +286,10 @@ def _classify_segment(segment: str) -> CommandSafety:
     if not cmd:
         return CommandSafety.WRITE
 
-    # Redirection to a file in this segment implies a write at minimum.
-    has_file_redirect = bool(re.search(r">>?\s*[^&\s]", segment))
+    # Discarding output does not modify a file. Other destinations still
+    # require write permission, including lookalikes such as /dev/null.log.
+    targets = re.findall(r">>?\s*([^&\s]+)", segment)
+    has_file_redirect = any(target != "/dev/null" for target in targets)
 
     first_arg = next((a for a in args if not a.startswith("-")), "")
 

{superqode-2.4.41 → superqode-2.4.43}/src/superqode/agent/loop.py

@@ -36,7 +36,15 @@ from typing import Any, AsyncIterator, Awaitable, Callable, Dict, List, Optional
 
 from ..tools.base import Tool, ToolContext, ToolRegistry, ToolResult
 from ..tools.permissions import Permission, PermissionConfig, PermissionManager
-from ..providers.gateway.base import GatewayInterface, Message, ToolDefinition
+from ..providers.gateway.base import (
+    AuthenticationError,
+    GatewayInterface,
+    InvalidRequestError,
+    Message,
+    ModelNotFoundError,
+    RateLimitError,
+    ToolDefinition,
+)
 from .system_prompts import (
     SystemPromptLevel,
     get_system_prompt,
@@ -1409,12 +1417,34 @@ class AgentLoop:
             delegation_depth=self.config.harness_delegation_depth,
             mcp_allowed=self.config.loop_policy.mcp,
             on_discovery=self._record_discovery_event,
+            execute_tool=self._execute_tool,
         )
 
     def _record_discovery_event(self, event: Dict[str, Any]) -> None:
         """Expose the latest sanitized discovery lifecycle to local UX."""
         self.last_discovery_event = dict(event)
 
+    def _record_request_payload(self, messages, tools) -> None:
+        from ..providers.request_metrics import measure_request_payload
+
+        metrics = measure_request_payload(messages, tools)
+        self.last_request_payload = metrics
+        if self.config.harness_store is not None and self.config.harness_run_id:
+            from ..harness.events import HarnessEvent
+
+            self.config.harness_store.append_event(
+                self.config.harness_run_id,
+                HarnessEvent(
+                    type="model.payload",
+                    data={
+                        **metrics,
+                        "provider": self.config.provider,
+                        "model": self.config.model,
+                        "catalog_version": self.tools.version,
+                    },
+                ),
+            )
+
     def _context_status(self) -> Dict[str, Any]:
         """Live context-budget snapshot for the get_context_remaining tool."""
         window = self._effective_context_window()
@@ -1584,7 +1614,10 @@ class AgentLoop:
             return ToolResult(
                 success=False,
                 output="",
-                error=f"Permission denied for tool: {name}",
+                error=(
+                    f"Permission policy blocked this {name} tool call. "
+                    "This does not mean repository access is unavailable; try an allowed read tool or a simpler read-only command."
+                ),
                 metadata={"permission": "deny", "tool": name},
             )
 
@@ -1657,6 +1690,15 @@ class AgentLoop:
         lifecycle_ctx = self._lifecycle_context()
 
         async def _finalize(result: ToolResult) -> ToolResult:
+            import hashlib
+
+            result.metadata = {
+                **(result.metadata or {}),
+                "invocation_id": tool_call_id,
+                "effective_arguments_sha256": hashlib.sha256(
+                    json.dumps(arguments, sort_keys=True, default=str).encode()
+                ).hexdigest(),
+            }
             origin = (
                 self.tools.activation_origin(name)
                 if hasattr(self.tools, "activation_origin")
@@ -1694,6 +1736,16 @@ class AgentLoop:
                 )
             )
 
+        if name.startswith("mcp_") and not self.config.loop_policy.mcp:
+            return await _finalize(
+                ToolResult(
+                    success=False,
+                    output="",
+                    error="This execution profile disables MCP tools",
+                    metadata={"permission": "profile_denied", "tool": name},
+                )
+            )
+
         # Handler hooks can deny a tool call outright or rewrite its arguments
         # before execution. Deny short-circuits; modify swaps in new arguments
         # that the rest of this call (and the after-hook) see.
@@ -1732,7 +1784,21 @@ class AgentLoop:
                     server_id = parts[1]
                     tool_name = parts[2]
                     try:
-                        result = await self.mcp_executor(server_id, tool_name, arguments)
+                        from superqode.execution_recovery import recoverable_call
+
+                        result = await recoverable_call(
+                            identity=tool_call_id or "",
+                            operation=f"mcp.{server_id}.{tool_name}",
+                            inputs=arguments,
+                            execute=lambda: self.mcp_executor(server_id, tool_name, arguments),
+                            encode=lambda r: {
+                                "success": r.success,
+                                "output": r.output,
+                                "error": r.error,
+                                "metadata": r.metadata,
+                            },
+                            decode=lambda r: ToolResult(**r),
+                        )
                         return await _finalize(result)
                     except Exception as e:
                         return await _finalize(
@@ -1742,11 +1808,23 @@ class AgentLoop:
                 ToolResult(success=False, output="", error=f"Unknown tool: {name}")
             )
 
+        try:
+            import jsonschema
+
+            jsonschema.validate(arguments, tool.parameters)
+        except jsonschema.ValidationError as exc:
+            return await _finalize(
+                ToolResult(
+                    success=False, output="", error=f"Invalid arguments for {name}: {exc.message}"
+                )
+            )
+
         denied = await self._check_tool_permission(name, arguments, tool_call_id)
         if denied:
             return await _finalize(denied)
 
         ctx = self._create_tool_context()
+        ctx.invocation_id = tool_call_id or ""
 
         try:
             from ..tools.governed import execute_governed_tool
@@ -2680,6 +2758,7 @@ class AgentLoop:
             lifecycle_ctx = self._lifecycle_context()
             await self.hooks.fire(BEFORE_LLM_CALL, lifecycle_ctx, messages, tools_to_send)
             try:
+                self._record_request_payload(gateway_messages, tools_to_send)
                 response = await self.gateway.chat_completion(
                     messages=gateway_messages,
                     model=self.config.model,
@@ -3196,6 +3275,7 @@ class AgentLoop:
             last_thinking_emit = _time.time()
 
             try:
+                self._record_request_payload(gateway_messages, tools_to_send)
                 async for chunk in self.gateway.stream_completion(
                     messages=gateway_messages,
                     model=self.config.model,
@@ -3268,6 +3348,13 @@ class AgentLoop:
                     thinking_buffer = ""
 
             except Exception as e:
+                if isinstance(
+                    e,
+                    (InvalidRequestError, AuthenticationError, ModelNotFoundError, RateLimitError),
+                ):
+                    self.last_stream_error = str(e)
+                    yield f"\n\n[Error: {type(e).__name__}] {e}"
+                    return
                 # Flush thinking buffer before handling error
                 if thinking_buffer.strip() and self.on_thinking:
                     await self.on_thinking(thinking_buffer.strip())

{superqode-2.4.41 → superqode-2.4.43}/src/superqode/app/constants.py

@@ -980,6 +980,9 @@ COMMANDS = [
     ":mcp connect",
     ":mcp disconnect",
     ":mcp reconnect",
+    ":mcp reload",
+    ":mcp login",
+    ":mcp logout",
     ":mcp add",
     ":mcp doctor",
     ":mcp attach",

{superqode-2.4.41 → superqode-2.4.43}/src/superqode/app/mixins/connect.py

@@ -1898,7 +1898,6 @@ class ConnectMixin:
             self._reset_connect_selection_states()
             self._open_connect_screen(log)
             log.add_info(profile.unavailable_hint)
-            log.add_info("Your current harness and model have been kept.")
             return
         self._connection_retry_target = ("profile", (profile.id,))
         self._connection_attempt_state = "Setup"

{superqode-2.4.41 → superqode-2.4.43}/src/superqode/app/mixins/mcp.py

@@ -24,7 +24,7 @@ class McpMixin:
         try:
             from superqode.mcp.config import load_mcp_config
 
-            servers = load_mcp_config(Path.cwd() / ".superqode" / "mcp.json")
+            servers = load_mcp_config()
         except Exception:
             return []
         candidates = []
@@ -167,6 +167,31 @@ class McpMixin:
 
         manager = await get_mcp_manager()
 
+        if subcommand == "reload":
+            resolution = await manager.reload_config(cwd=Path.cwd())
+            results = await manager.connect_all()
+            log.add_info(
+                f"Reloaded {len(resolution.servers)} MCP servers; {sum(results.values())} connected."
+            )
+            for error in resolution.errors:
+                log.add_error(error)
+            return
+
+        if subcommand in {"login", "logout"}:
+            if subargs not in manager.get_server_configs():
+                log.add_error("Specify a configured MCP server; use :mcp status.")
+                return
+            if subcommand == "login":
+                ok = await manager.authenticate_server(subargs)
+                if ok:
+                    ok = await manager.reconnect(subargs)
+                log.add_info(f"MCP login {subargs}: {'connected' if ok else 'failed'}")
+            else:
+                await manager.disconnect(subargs)
+                await manager.clear_server_credentials(subargs)
+                log.add_info(f"Signed out of MCP server {subargs}.")
+            return
+
         if subcommand in ("", "status"):
             configs = manager.get_server_configs()
             summary = manager.get_status_summary()
@@ -385,5 +410,5 @@ class McpMixin:
             return
 
         log.add_info(
-            "Usage: :mcp status|add|connect|reconnect|disconnect|doctor|tools|resources|attach|prompts"
+            "Usage: :mcp status|add|connect|reconnect|reload|login|logout|disconnect|doctor|tools|resources|attach|prompts"
         )

{superqode-2.4.41 → superqode-2.4.43}/src/superqode/app/mixins/pipy_commands.py

@@ -94,18 +94,32 @@ class PiPyCommandMixin:
                 session_id=session_id,
                 harness_id="pipy",
                 external_session_id=session_id,
-                metadata={"working_directory": str(working_directory)},
+                metadata={
+                    "working_directory": str(working_directory),
+                    "runtime_config": dict(
+                        getattr(
+                            getattr(getattr(pure, "_harness_spec", None), "runtime", None),
+                            "config",
+                            {},
+                        )
+                        or {}
+                    ),
+                },
             )
         )
         return adapter, ref
 
     async def _pipy_run(self, sub: str, rest: str, log) -> None:
+        adapter = ref = None
         try:
             adapter, ref = await self._pipy_open_session()
             session = adapter._sessions[ref.session_id]
             await self._pipy_dispatch(session, sub, rest, log)
         except Exception as error:  # noqa: BLE001 - surfaced to the user
             log.add_error(f":pipy {sub} failed: {error}")
+        finally:
+            if adapter is not None and ref is not None:
+                await adapter.close(ref)
 
     async def _pipy_dispatch(self, session: Any, sub: str, rest: str, log) -> None:
         if sub == "session":