velune-cli 0.9.3.4__tar.gz → 0.9.4__tar.gz

{velune_cli-0.9.3.4 → velune_cli-0.9.4}/.gitignore

@@ -58,6 +58,11 @@ Thumbs.db
 # Velune runtime/cache
 .velune/
 
+# Velune private "house" system prompts — tuned prompts ship with builds but are
+# never committed. The committed _baseline.py guarantees a working fallback, and
+# _premium.example.py documents the contract. (See velune/cognition/prompts/.)
+velune/cognition/prompts/_premium.py
+
 # Dev container
 .devcontainer/
 
@@ -99,6 +104,13 @@ temp/
 RECORD
 installer/
 
+# Native build artifacts
+*.pyd
+ext/go/*.exe
+ext/go/**/*.exe
+ext/go/bin/
+ext/rust/**/target/
+
 # Profiling
 *.prof
 *.lprof

{velune_cli-0.9.3.4 → velune_cli-0.9.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: velune-cli
-Version: 0.9.3.4
+Version: 0.9.4
 Summary: Local-first multi-model AI developer CLI — council-based agents, persistent memory, repository cognition
 Project-URL: Homepage, https://github.com/Surya-Hariharan/Velune-CLI
 Project-URL: Repository, https://github.com/Surya-Hariharan/Velune-CLI
@@ -250,7 +250,6 @@ Requires-Dist: typer>=0.9.0
 Provides-Extra: all
 Requires-Dist: docker>=7.0.0; extra == 'all'
 Requires-Dist: gguf>=0.6.0; extra == 'all'
-Requires-Dist: gitpython>=3.1.40; extra == 'all'
 Requires-Dist: lancedb>=0.5.0; extra == 'all'
 Requires-Dist: opentelemetry-api>=1.22.0; extra == 'all'
 Requires-Dist: opentelemetry-exporter-otlp>=1.22.0; extra == 'all'
@@ -277,7 +276,6 @@ Requires-Dist: docker>=7.0.0; extra == 'docker'
 Provides-Extra: gguf
 Requires-Dist: gguf>=0.6.0; extra == 'gguf'
 Provides-Extra: git
-Requires-Dist: gitpython>=3.1.40; extra == 'git'
 Provides-Extra: parsing
 Requires-Dist: tree-sitter-go>=0.21.0; extra == 'parsing'
 Requires-Dist: tree-sitter-python>=0.21.0; extra == 'parsing'
@@ -363,6 +361,11 @@ pip install velune-cli
 velune --version
 ```
 
+The Python package is the authoritative runtime. Optional Go and Rust native
+components live under `ext/` and are validated in CI; Velune keeps pure-Python
+fallbacks for the Rust-backed repository helpers, so the standard PyPI install
+works without compiling native code.
+
 If your shell reports **`velune: command not found`** (or, on Windows,
 *"'velune' is not recognized…"*), the install succeeded but your Python
 scripts directory is not on `PATH`. Two reliable fixes:
@@ -676,7 +679,7 @@ Velune works as both an MCP **server** and an MCP **client**:
   supported. Servers can also be declared in `.mcp.json` and loaded automatically.
 
 Outbound connections to external MCP servers are trust-gated — see
-[MCP trust gating](docs/SECURITY.md#mcp-trust-gating) in the security policy.
+[MCP trust gating](SECURITY.md#mcp-trust-gating) in the security policy.
 
 ---
 
@@ -690,9 +693,10 @@ Velune runs natively on Windows (supporting native command execution sandboxing,
 
 | Doc | What's inside |
 | --- | --- |
-| [docs/SECURITY.md](docs/SECURITY.md) | Security posture, trust boundaries, reporting |
-| [docs/CONTRIBUTING.md](docs/CONTRIBUTING.md) | Dev setup and contribution workflow |
+| [SECURITY.md](SECURITY.md) | Security posture, trust boundaries, reporting |
+| [CONTRIBUTING.md](CONTRIBUTING.md) | Dev setup and contribution workflow |
 | [docs/CHANGELOG.md](docs/CHANGELOG.md) | Full version history |
+| [docs/RELEASE_NOTES_v0.9.4.md](docs/RELEASE_NOTES_v0.9.4.md) | v0.9.4 release notes |
 
 ---
 

{velune_cli-0.9.3.4 → velune_cli-0.9.4}/README.md

@@ -67,6 +67,11 @@ pip install velune-cli
 velune --version
 ```
 
+The Python package is the authoritative runtime. Optional Go and Rust native
+components live under `ext/` and are validated in CI; Velune keeps pure-Python
+fallbacks for the Rust-backed repository helpers, so the standard PyPI install
+works without compiling native code.
+
 If your shell reports **`velune: command not found`** (or, on Windows,
 *"'velune' is not recognized…"*), the install succeeded but your Python
 scripts directory is not on `PATH`. Two reliable fixes:
@@ -380,7 +385,7 @@ Velune works as both an MCP **server** and an MCP **client**:
   supported. Servers can also be declared in `.mcp.json` and loaded automatically.
 
 Outbound connections to external MCP servers are trust-gated — see
-[MCP trust gating](docs/SECURITY.md#mcp-trust-gating) in the security policy.
+[MCP trust gating](SECURITY.md#mcp-trust-gating) in the security policy.
 
 ---
 
@@ -394,9 +399,10 @@ Velune runs natively on Windows (supporting native command execution sandboxing,
 
 | Doc | What's inside |
 | --- | --- |
-| [docs/SECURITY.md](docs/SECURITY.md) | Security posture, trust boundaries, reporting |
-| [docs/CONTRIBUTING.md](docs/CONTRIBUTING.md) | Dev setup and contribution workflow |
+| [SECURITY.md](SECURITY.md) | Security posture, trust boundaries, reporting |
+| [CONTRIBUTING.md](CONTRIBUTING.md) | Dev setup and contribution workflow |
 | [docs/CHANGELOG.md](docs/CHANGELOG.md) | Full version history |
+| [docs/RELEASE_NOTES_v0.9.4.md](docs/RELEASE_NOTES_v0.9.4.md) | v0.9.4 release notes |
 
 ---
 

{velune_cli-0.9.3.4 → velune_cli-0.9.4}/docs/CHANGELOG.md

@@ -9,6 +9,129 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+## [0.9.4] - 2026-06-28
+
+### New
+
+- Go production launcher improvements for cross-platform startup and health checks.
+- Rust native module foundation for optional hot-path repository operations.
+- Repository Knowledge Graph for structured file, symbol, and relationship context.
+- Repository Intelligence Engine for repository events and incremental graph updates.
+- Native integration layer with pure-Python fallbacks when native wheels are unavailable.
+- Cross-platform CI covering Python, Go, Rust, packaging, install smoke tests, and native benchmarks.
+
+### Improved
+
+- Faster startup paths for lightweight commands and launcher-assisted execution.
+- More reliable native integration across supported operating systems.
+- Stronger security checks, including dependency auditing, Bandit, and Gitleaks coverage.
+- Broader CI/CD validation before release.
+- Expanded tests for knowledge graph, intelligence engine, memory coordination, and native fallbacks.
+- More reproducible build and artifact validation.
+
+### Fixed
+
+- Cross-platform build issues in Go and Rust CI jobs.
+- PyO3 compatibility for Rust unit-test linkage.
+- Native fallback behavior when the Rust extension is not installed.
+- CI failures from synthetic secret-like test fixtures.
+- Release workflow checks for version/tag consistency and artifact validation.
+
+## [0.9.3.5] - 2026-06-27
+
+> Sprint 1 AI Foundation — Repository Knowledge Graph, Intelligence Engine, and
+> Three-Brain Memory Coordinator, plus Go launcher, Rust native extensions,
+> and a fully hardened cross-platform CI/CD pipeline.
+
+### Added — Repository Knowledge Graph (`velune/knowledge/`)
+
+- **SQLite-backed semantic graph** with typed nodes (file, module, class,
+  function, method) and typed edges (imports, contains, inherits, defines).
+  WAL mode + single `asyncio.Lock` write serialization + short-lived read
+  connections keep the store fast and safe under concurrent access.
+- **`KnowledgeGraphBuilder`** — converts a `RepositorySnapshot` into a full
+  graph in a single atomic transaction; partial failures roll back cleanly.
+- **`KnowledgeQuery`** — AI-optimized query layer: `context_for_file`,
+  `find_by_label`, `summary_text`. Output is designed for direct LLM injection
+  without post-processing.
+
+### Added — Repository Intelligence Engine (`velune/intelligence/`)
+
+- **Central coordinator** with event-driven change detection (3 s file-change
+  poll) and git-state tracking (10 s interval). All events ride `CognitiveBus`.
+- **`KnowledgeGraphPatcher`** — surgical incremental node/edge updates via
+  `FK CASCADE`; avoids full graph rebuilds on every file change.
+- **Typed `RepositoryEventType` constants** + factory helpers for subscribers
+  (`repository.files_changed`, `index_updated`, `kg_patched`,
+  `git_state_changed`, `profile_refreshed`, `engine_started/stopped`).
+
+### Added — Three-Brain Memory Coordinator (`velune/memory/three_brain.py`)
+
+- **Brain 1 Hot (Working)** — in-session `MemoryTurn` store.
+- **Brain 2 Warm (Semantic)** — LanceDB ANN search via `SemanticMemory`.
+- **Brain 3 Cold (Episodic)** — SQLite cross-session LIKE search via
+  `EpisodicMemory`.
+- `asyncio.gather` fan-out across all three brains; `KnowledgeQuery` augments
+  warm-brain results with graph context.
+- Subscribes to `repository.files_changed` → annotates `ThreeBrainResult`
+  with `stale_file_count`.
+- `as_context_block()` renders compact, LLM-injectable text; registered as
+  `runtime.three_brain_coordinator`.
+
+### Added — Go Launcher (`ext/go/`)
+
+- Cross-platform Go launcher binary (`velune` executable) that discovers the
+  correct Python interpreter (sibling `.venv` → `VIRTUAL_ENV` → PATH), relays
+  OS signals (SIGINT/SIGTERM) to the child Python process, and manages the
+  Velune daemon lifecycle (`start` / `stop` / `status`).
+- **`velune update`** — queries PyPI (`velune-cli`) for the latest version and
+  upgrades via pip if a newer release exists (`--check` mode for scripts).
+- **`velune --health`** — structured health check: Python binary, Python
+  version, `velune` module importability, launcher version.
+- Full test suite: version parsing, Python discovery, daemon PID file handling,
+  process-alive checks, PyPI mock server tests.
+
+### Added — Rust Native Extensions (`ext/rust/velune-native/`)
+
+- **`sha256_file(path)`** — SHA-256 hex digest of a file; O(1) memory via
+  64 KB streaming buffer; raises `OSError` on unreadable files.
+- **`scan_directory(root, extensions, skip_names)`** — recursive directory
+  walker with extension filtering and directory pruning; returns sorted
+  absolute paths.
+- Pure-Python fallbacks in `velune/repository/_native.py` — all callers use the
+  same API regardless of whether the Rust wheel is installed.
+- Unit tests covering determinism, empty files, missing files, directory
+  skipping, and cross-implementation parity.
+
+### Added — CI/CD
+
+- **Go Launcher** jobs (ubuntu / windows / macos): `go build`, `go test -v`,
+  `go vet` for the full launcher package.
+- **Rust Native** jobs (ubuntu / windows / macos): `cargo fmt --check`,
+  `cargo clippy -D warnings`, `cargo build --lib`, `cargo test --lib`.
+- **Native benchmarks** (`benchmark-native`, `benchmark-scan`): build the
+  Rust wheel via maturin, install it, run sha256 and scan_directory benchmarks,
+  upload JSON results as artifacts (informational — never gates on perf
+  thresholds since CI hardware is shared and variable).
+- **Wheel install + REPL smoke** matrix expanded to 3 OS × 4 Python versions
+  (3.10 – 3.13).
+- **`ci-pass` gate job** — requires all matrix jobs before reporting green.
+
+### Fixed
+
+- Benchmark jobs no longer use `--ci` performance-threshold mode; benchmarks
+  are informational in CI and will never fail due to machine variance.
+- Go setup action no longer references a nonexistent `go.sum` (this project has
+  no external Go dependencies — all imports are stdlib).
+- Rust `crate-type` now includes `rlib` alongside `cdylib` so that
+  `cargo test --lib` can link the Rust test harness without a Python runtime.
+- `velune update` PyPI URL corrected from `/pypi/velune/` to `/pypi/velune-cli/`.
+
+### Tests
+
+- 139 tests passing — 42 new for Three-Brain Memory, 41 for Intelligence Engine,
+  41 for Knowledge Graph, plus cross-platform CI matrix (3 OS × 4 Python).
+
 ## [0.9.3] - 2026-06-24
 
 > Promotes `0.9.3-beta.1` to a stable release and lands a command-architecture
@@ -694,7 +817,8 @@ changes — `pip install --upgrade velune-cli` is a safe, drop-in update.
 - Security sandbox: workspace write guards, network hygiene, secret scrubbing
 - Full pytest suite: unit, integration, async, and benchmark tests
 
-[Unreleased]: https://github.com/Surya-Hariharan/Velune-CLI/compare/v0.9.3-beta.1...HEAD
+[Unreleased]: https://github.com/Surya-Hariharan/Velune-CLI/compare/v0.9.4...HEAD
+[0.9.4]: https://github.com/Surya-Hariharan/Velune-CLI/compare/v0.9.3.5...v0.9.4
 [0.9.3-beta.1]: https://github.com/Surya-Hariharan/Velune-CLI/compare/v0.9.2...v0.9.3-beta.1
 [0.9.2]: https://github.com/Surya-Hariharan/Velune-CLI/compare/v0.9.1...v0.9.2
 [0.9.1]: https://github.com/Surya-Hariharan/Velune-CLI/compare/v0.9.0...v0.9.1

velune_cli-0.9.4/ext/go/cmd/velune/daemon.go

@@ -0,0 +1,190 @@
+package main
+
+// Daemon lifecycle management.
+//
+// Go owns the process lifecycle: starting, stopping, and health-checking the
+// Python daemon process.  Python owns everything inside that process: the IPC
+// protocol, AI orchestration, and business logic.
+//
+// The daemon is identified by a PID file at ~/.velune/daemon.pid.  Go never
+// reads or speaks the IPC wire format — that belongs to Python.
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// runDaemonCommand dispatches daemon sub-commands.
+// velune daemon start [workspace]
+// velune daemon stop
+// velune daemon status
+func runDaemonCommand(action string, rest []string) {
+	switch action {
+	case "start":
+		workspace := "."
+		if len(rest) > 0 {
+			workspace = rest[0]
+		}
+		if err := daemonStart(workspace); err != nil {
+			fmt.Fprintf(os.Stderr, "velune daemon: start failed: %v\n", err)
+			os.Exit(1)
+		}
+
+	case "stop":
+		if err := daemonStop(); err != nil {
+			fmt.Fprintf(os.Stderr, "velune daemon: stop failed: %v\n", err)
+			os.Exit(1)
+		}
+
+	case "status":
+		daemonStatus()
+
+	default:
+		fmt.Fprintf(os.Stderr, "velune daemon: unknown action %q\n", action)
+		fmt.Fprintln(os.Stderr, "usage: velune daemon <start|stop|status> [workspace]")
+		os.Exit(1)
+	}
+}
+
+// ─── Start ────────────────────────────────────────────────────────────────────
+
+func daemonStart(workspace string) error {
+	pidFile := daemonPidFile()
+
+	// If already running, report and exit cleanly.
+	if pid, err := readPid(pidFile); err == nil {
+		if processAlive(pid) {
+			fmt.Printf("velune daemon: already running (pid %d)\n", pid)
+			return nil
+		}
+		// Stale PID — clean it up before starting fresh.
+		_ = os.Remove(pidFile)
+	}
+
+	python := discoverPython()
+
+	// Resolve workspace to an absolute path so the daemon process always has a
+	// stable working path regardless of where the launcher is invoked from.
+	absWorkspace, err := filepath.Abs(workspace)
+	if err != nil {
+		return fmt.Errorf("resolve workspace: %w", err)
+	}
+	if _, err := os.Stat(absWorkspace); err != nil {
+		return fmt.Errorf("workspace %q does not exist", absWorkspace)
+	}
+
+	cmd := exec.Command(python, "-m", "velune.daemon.server", absWorkspace)
+	cmd.Env = os.Environ()
+
+	// Detach from the terminal so the daemon survives after the launcher exits.
+	setProcAttr(cmd)
+
+	if err := cmd.Start(); err != nil {
+		return fmt.Errorf("spawn: %w", err)
+	}
+
+	pid := cmd.Process.Pid
+	fmt.Printf("velune daemon: started (pid %d, workspace %s)\n", pid, absWorkspace)
+
+	// The Python daemon writes its own PID file once it is ready.  Poll for it
+	// so we can confirm a successful start before returning.
+	deadline := time.Now().Add(5 * time.Second)
+	for time.Now().Before(deadline) {
+		if _, err := readPid(pidFile); err == nil {
+			fmt.Println("velune daemon: ready")
+			return nil
+		}
+		time.Sleep(100 * time.Millisecond)
+	}
+
+	// Daemon did not write PID file in time — may still be starting up.
+	fmt.Fprintf(os.Stderr,
+		"velune daemon: warning: PID file not seen after 5s (pid %d may still be starting)\n", pid)
+	return nil
+}
+
+// ─── Stop ─────────────────────────────────────────────────────────────────────
+
+func daemonStop() error {
+	pidFile := daemonPidFile()
+	pid, err := readPid(pidFile)
+	if err != nil {
+		fmt.Println("velune daemon: not running")
+		return nil
+	}
+
+	proc, err := os.FindProcess(pid)
+	if err != nil || !processAlive(pid) {
+		fmt.Println("velune daemon: not running (stale PID file removed)")
+		_ = os.Remove(pidFile)
+		return nil
+	}
+
+	// Graceful shutdown first.
+	if err := gracefulStop(proc); err != nil {
+		return fmt.Errorf("signal: %w", err)
+	}
+
+	// Wait up to 5 s for clean exit.
+	deadline := time.Now().Add(5 * time.Second)
+	for time.Now().Before(deadline) {
+		if !processAlive(pid) {
+			_ = os.Remove(pidFile)
+			fmt.Println("velune daemon: stopped")
+			return nil
+		}
+		time.Sleep(100 * time.Millisecond)
+	}
+
+	// Force-kill if still alive.
+	_ = proc.Kill()
+	_ = os.Remove(pidFile)
+	fmt.Println("velune daemon: killed (did not exit cleanly)")
+	return nil
+}
+
+// ─── Status ───────────────────────────────────────────────────────────────────
+
+func daemonStatus() {
+	pidFile := daemonPidFile()
+	pid, err := readPid(pidFile)
+	if err != nil {
+		fmt.Println("velune daemon: stopped")
+		return
+	}
+
+	if processAlive(pid) {
+		fmt.Printf("velune daemon: running (pid %d)\n", pid)
+	} else {
+		fmt.Println("velune daemon: stopped (stale PID file)")
+		_ = os.Remove(pidFile)
+	}
+}
+
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+
+func daemonPidFile() string {
+	home, err := os.UserHomeDir()
+	if err != nil {
+		home = "."
+	}
+	return filepath.Join(home, ".velune", "daemon.pid")
+}
+
+func readPid(pidFile string) (int, error) {
+	data, err := os.ReadFile(pidFile)
+	if err != nil {
+		return 0, err
+	}
+	pid, err := strconv.Atoi(strings.TrimSpace(string(data)))
+	if err != nil {
+		return 0, errors.New("malformed PID file")
+	}
+	return pid, nil
+}

velune_cli-0.9.4/ext/go/cmd/velune/daemon_test.go

@@ -0,0 +1,85 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strconv"
+	"testing"
+)
+
+func TestReadPid_Valid(t *testing.T) {
+	tmp := t.TempDir()
+	pidFile := filepath.Join(tmp, "daemon.pid")
+	if err := os.WriteFile(pidFile, []byte("12345\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	pid, err := readPid(pidFile)
+	if err != nil {
+		t.Fatalf("readPid returned error: %v", err)
+	}
+	if pid != 12345 {
+		t.Fatalf("expected 12345, got %d", pid)
+	}
+}
+
+func TestReadPid_Missing(t *testing.T) {
+	_, err := readPid("/nonexistent/daemon.pid")
+	if err == nil {
+		t.Fatal("expected error for missing PID file")
+	}
+}
+
+func TestReadPid_Malformed(t *testing.T) {
+	tmp := t.TempDir()
+	pidFile := filepath.Join(tmp, "daemon.pid")
+	if err := os.WriteFile(pidFile, []byte("not-a-number\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	_, err := readPid(pidFile)
+	if err == nil {
+		t.Fatal("expected error for malformed PID file")
+	}
+}
+
+func TestProcessAlive_CurrentProcess(t *testing.T) {
+	// The current process is always alive.
+	if !processAlive(os.Getpid()) {
+		t.Fatal("processAlive returned false for the current process")
+	}
+}
+
+func TestProcessAlive_InvalidPid(t *testing.T) {
+	// PID 0 and negative PIDs are never valid targets.
+	if processAlive(0) {
+		t.Fatal("processAlive returned true for pid 0")
+	}
+	if processAlive(-1) {
+		t.Fatal("processAlive returned true for pid -1")
+	}
+}
+
+func TestDaemonPidFile(t *testing.T) {
+	path := daemonPidFile()
+	if path == "" {
+		t.Fatal("daemonPidFile returned empty string")
+	}
+	// Must end with daemon.pid
+	if filepath.Base(path) != "daemon.pid" {
+		t.Fatalf("expected daemon.pid, got %q", filepath.Base(path))
+	}
+}
+
+func TestDaemonStatus_NotRunning(t *testing.T) {
+	// Override the pid file to a temp location with no running process.
+	tmp := t.TempDir()
+	pidFile := filepath.Join(tmp, "daemon.pid")
+	// Write a PID that is guaranteed not to be a running daemon.
+	// PID 999999999 is astronomically unlikely to exist.
+	if err := os.WriteFile(pidFile, []byte(strconv.Itoa(999999999)), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	// If processAlive returns false for a non-existent PID this is working correctly.
+	if processAlive(999999999) {
+		t.Skip("PID 999999999 unexpectedly exists — skipping")
+	}
+}