From 4b924a5c161344eab5634d6219622358832e5ebb Mon Sep 17 00:00:00 2001 From: John Osumi <931193+sumitake@users.noreply.github.com> Date: Sun, 12 Jul 2026 15:18:23 -0700 Subject: [PATCH 1/4] release: prepare unified signed runtime activation --- .github/workflows/release.yml | 14 +- README.md | 40 +- .../2026-07-12-activation-licensing.md | 10 + .../2026-07-12-merge-resolve-rename.md | 3 + docs/migration-from-legacy-packages.md | 8 +- plugins/agent-collab/README.md | 31 +- plugins/agent-collab/THIRD-PARTY-NOTICES.txt | 36 + plugins/agent-collab/runtime_client.py | 218 +++- plugins/agent-collab/runtime_setup.py | 53 + .../SKILL.md | 10 +- .../skills/migration-doctor/SKILL.md | 7 + .../CPython-3.13.14-LICENSE.txt | 277 ++++ .../CPython-3.13.14-NOTICES.txt | 1134 +++++++++++++++++ .../third-party-licenses/Expat-COPYING.txt | 21 + .../third-party-licenses/HACL-LICENSE.txt | 33 + .../third-party-licenses/Hedley-CC0-1.0.txt | 9 + .../Nuitka-4.1.3-LICENSE-RUNTIME.txt | 57 + .../Nuitka-4.1.3-LICENSE.txt | 661 ++++++++++ .../Nuitka-4.1.3-NOTICE.txt | 11 + .../third-party-licenses/libb2-CC0-1.0.txt | 13 + .../third-party-licenses/mimalloc-LICENSE.txt | 21 + .../third-party-licenses/mpdecimal-NOTICE.txt | 22 + scripts/build_plugin_archive.py | 112 +- scripts/build_release_evidence.py | 140 +- scripts/check_release_consistency.py | 36 +- scripts/scaffold-skill-spec.py | 4 +- scripts/skill-build-config.json | 4 +- scripts/test_check_release_consistency.py | 77 +- scripts/test_scaffold_skill_spec.py | 6 +- .../{ai-merge-resolve.md => merge-resolve.md} | 14 +- skill-specs/migration-doctor.md | 7 + tests/test_agent_collab_runtime_client.py | 171 +++ tests/test_merge_resolve_skill_rename.py | 75 ++ tests/test_plugin_archive.py | 115 ++ tests/test_provider_plugin_retirement.py | 10 +- tests/test_release_evidence.py | 175 +++ tests/test_release_runtime_gate.py | 2 + tests/test_runtime_setup.py | 109 ++ 38 files changed, 3614 insertions(+), 132 deletions(-) create mode 100644 changelog.d/2026-07-12-activation-licensing.md create mode 100644 changelog.d/2026-07-12-merge-resolve-rename.md create mode 100644 plugins/agent-collab/THIRD-PARTY-NOTICES.txt create mode 100644 plugins/agent-collab/runtime_setup.py rename plugins/agent-collab/skills/{ai-merge-resolve => merge-resolve}/SKILL.md (93%) create mode 100644 plugins/agent-collab/third-party-licenses/CPython-3.13.14-LICENSE.txt create mode 100644 plugins/agent-collab/third-party-licenses/CPython-3.13.14-NOTICES.txt create mode 100644 plugins/agent-collab/third-party-licenses/Expat-COPYING.txt create mode 100644 plugins/agent-collab/third-party-licenses/HACL-LICENSE.txt create mode 100644 plugins/agent-collab/third-party-licenses/Hedley-CC0-1.0.txt create mode 100644 plugins/agent-collab/third-party-licenses/Nuitka-4.1.3-LICENSE-RUNTIME.txt create mode 100644 plugins/agent-collab/third-party-licenses/Nuitka-4.1.3-LICENSE.txt create mode 100644 plugins/agent-collab/third-party-licenses/Nuitka-4.1.3-NOTICE.txt create mode 100644 plugins/agent-collab/third-party-licenses/libb2-CC0-1.0.txt create mode 100644 plugins/agent-collab/third-party-licenses/mimalloc-LICENSE.txt create mode 100644 plugins/agent-collab/third-party-licenses/mpdecimal-NOTICE.txt rename skill-specs/{ai-merge-resolve.md => merge-resolve.md} (93%) create mode 100644 tests/test_merge_resolve_skill_rename.py create mode 100644 tests/test_runtime_setup.py diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 55e0e63..074a8cd 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -76,7 +76,7 @@ jobs: verify-runtime-macos: needs: [verify-release-ref, classify-release] if: needs.classify-release.outputs.mode == 'activation' - runs-on: macos-14 + runs-on: macos-15 timeout-minutes: 20 steps: - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 @@ -138,18 +138,14 @@ jobs: TAG="${GITHUB_REF#refs/tags/}" # Supported forms are v-agent-collab-X.Y.Z and vX.Y.Z. Both resolve # to the only releaseable package. - if [[ "$TAG" =~ ^v-([a-z0-9-]+)-([0-9]+\.[0-9]+\.[0-9]+)$ ]]; then - PLUGIN="${BASH_REMATCH[1]}" - VER="${BASH_REMATCH[2]}" + if [[ "$TAG" =~ ^v-agent-collab-([0-9]+\.[0-9]+\.[0-9]+)$ ]]; then + PLUGIN="agent-collab" + VER="${BASH_REMATCH[1]}" elif [[ "$TAG" =~ ^v([0-9]+\.[0-9]+\.[0-9]+)$ ]]; then VER="${BASH_REMATCH[1]}" PLUGIN="agent-collab" else - echo "ERROR: tag format must be v-- or v" - exit 1 - fi - if [ "$PLUGIN" != "agent-collab" ]; then - echo "ERROR: agent-collab is the only releaseable package" + echo "ERROR: tag format must be v-agent-collab-X.Y.Z or vX.Y.Z" exit 1 fi { diff --git a/README.md b/README.md index e063e0e..9543688 100644 --- a/README.md +++ b/README.md @@ -81,6 +81,12 @@ approval. See [NOTICE](NOTICE) and [COMMERCIAL-LICENSING.md](COMMERCIAL-LICENSING.md) for the exact ownership and approval boundary. +An activation archive also redistributes CPython 3.13.14, Nuitka 4.1.3 runtime +material, and their incorporated components under their own terms. The exact, +digest-pinned inventory is shipped as `THIRD-PARTY-NOTICES.txt` and +`third-party-licenses/` inside the plugin package. Those files are excluded from +policy-only archives because no native runtime is present. + ## System architecture ```mermaid @@ -138,7 +144,8 @@ until the signed runtime exposes the complete matrix, including Composer. runtime, notarizes it, and records size/hash/team metadata. 4. A policy-only plugin release omits the runtime and keeps every native route typed unavailable. An activation release imports only the final binary and - manifest metadata; no source implementation crosses the boundary. + manifest metadata plus the exact third-party notice/license tree; no private + source implementation crosses the boundary. 5. Plugin CI validates both Claude and Codex manifests/marketplaces, schemas, skills, migration behavior, runtime fixtures, the dependency-free secret scan, CodeQL security analysis, release consistency, and public-export @@ -146,9 +153,13 @@ until the signed runtime exposes the complete matrix, including Composer. 6. A policy-only signed-tag release proves the runtime manifest is empty and the archive contains no runtime. For activation, a macOS verification job binds codesign, notarization, manifest, artifact digest, and commit SHA into - release evidence before the publish job may include the binary. + release evidence before the publish job may include the binary. SPDX 2.3 + evidence distinguishes project-owned PolyForm material from the embedded + CPython, Nuitka, and incorporated third-party components. 7. Hosts update one package, run the migration doctor, restart, and verify the - resolved profile plus eligible routes. + resolved profile plus eligible routes. Activation hosts then run the + co-packaged `runtime_setup.py status` and `prepare` commands; managed Grok + device login is exposed only as `runtime_setup.py login-grok`. Rollback uses policy-only safe mode. Set `AGENT_COLLAB_SAFE_MODE=1` in the active host runtime environment and restart that host; all model-execution @@ -186,6 +197,24 @@ package through their compatible plugin manager; if that host has no native plugin surface, it cannot install this package directly and must remain temporarily unsupported rather than recreating a provider-specific shim. +An activation release adds a closed signed-runtime management surface beside +the coordinator. Resolve the installed plugin root and run only: + +```text +python3 "/runtime_setup.py" status +python3 "/runtime_setup.py" prepare +python3 "/runtime_setup.py" login-grok +``` + +These operations accept no provider, model, path, environment, binary, tool, +or raw-argument overrides. The public client keeps the process environment +scrubbed and sends only `generic` or `codex_desktop` as a closed host-context +observation; the signed runtime derives and validates its own state roots from +the OS login identity. Exact supported Codex, OpenCode, and Grok CLIs remain +external prerequisites and must be installed and authenticated through their +vendor-supported interfaces. No workspace checkout or provider-specific plugin +is required. Policy-only releases report the management surface unavailable. + Remove every old package reported by the doctor, then run the doctor again. The doctor reads filesystem/registry state and Codex `[plugins."name@marketplace"]` entries from `~/.codex/config.toml`, distinguishes @@ -339,6 +368,11 @@ package or an activation package. For an activation candidate, also run on Darwin arm64; that verifier intentionally remains activation-only and fails closed against an empty manifest. +Activation packaging also requires the exact digest-pinned +`THIRD-PARTY-NOTICES.txt` and `third-party-licenses/` tree. Missing, extra, +linked, hardlinked, unsafe, or modified legal members fail before archive or +SBOM publication. Policy-only archives intentionally omit that tree. + `CHANGELOG.md` remains generated at release time from `changelog.d/` fragments. Historical changelog entries may name retired packages only as clearly historical records; they are not active install or rollback instructions. diff --git a/changelog.d/2026-07-12-activation-licensing.md b/changelog.d/2026-07-12-activation-licensing.md new file mode 100644 index 0000000..ef28641 --- /dev/null +++ b/changelog.d/2026-07-12-activation-licensing.md @@ -0,0 +1,10 @@ +### Added + +- Add a digest-pinned activation-only third-party notice/license tree for CPython 3.13.14, Nuitka 4.1.3, Expat, HACL*, libb2, mpdecimal, mimalloc, and Hedley. +- Extend SPDX 2.3 release evidence with component packages, embedded-component relationships, and license conclusions that no longer mislabel the native runtime as wholly PolyForm-licensed. +- Add a closed co-packaged runtime setup client for read-only status, idempotent managed-state preparation, and bounded Grok device login without exposing provider recipes or caller-selected paths. + +### Changed + +- Reject noncanonical package-qualified release tags, move the arm64 activation verifier to `macos-15`, and fail activation archives on missing, extra, linked, hardlinked, unsafe, or content-drifted third-party legal members. +- Keep the native child environment scrubbed while passing only a closed generic/Codex-Desktop host-context observation; the signed runtime derives and validates provider state from the OS login identity. diff --git a/changelog.d/2026-07-12-merge-resolve-rename.md b/changelog.d/2026-07-12-merge-resolve-rename.md new file mode 100644 index 0000000..63d64f1 --- /dev/null +++ b/changelog.d/2026-07-12-merge-resolve-rename.md @@ -0,0 +1,3 @@ +### Breaking + +- Rename the public `ai-merge-resolve` skill to `merge-resolve`, including its generated command and auto-apply policy filename. Existing installations must invoke `/agent-collab:merge-resolve` and rename `.claude/ai-merge-policy.yaml` to `.claude/merge-resolve-policy.yaml` when that opt-in file is used. diff --git a/docs/migration-from-legacy-packages.md b/docs/migration-from-legacy-packages.md index 6c8cb84..90f3cf2 100644 --- a/docs/migration-from-legacy-packages.md +++ b/docs/migration-from-legacy-packages.md @@ -18,7 +18,7 @@ For every row below, all listed old namespaces map to the single new command. |---|---| | `/claude-collab:agent-readiness`, `/codex-collab:agent-readiness`, `/antigravity-collab:agent-readiness` | `/agent-collab:agent-readiness` | | `/claude-collab:agent-runtime-status`, `/codex-collab:agent-runtime-status`, `/antigravity-collab:agent-runtime-status` | `/agent-collab:agent-runtime-status` | -| `/claude-collab:ai-merge-resolve`, `/codex-collab:ai-merge-resolve`, `/antigravity-collab:ai-merge-resolve` | `/agent-collab:ai-merge-resolve` | +| `/agent-collab:ai-merge-resolve`, `/claude-collab:ai-merge-resolve`, `/codex-collab:ai-merge-resolve`, `/antigravity-collab:ai-merge-resolve` | `/agent-collab:merge-resolve` | | `/claude-collab:autonomy-readiness`, `/codex-collab:autonomy-readiness`, `/antigravity-collab:autonomy-readiness` | `/agent-collab:autonomy-readiness` | | `/claude-collab:brainstorm`, `/codex-collab:brainstorm`, `/antigravity-collab:brainstorm` | `/agent-collab:brainstorm` | | `/claude-collab:chain`, `/codex-collab:chain`, `/antigravity-collab:chain` | `/agent-collab:chain` | @@ -87,6 +87,12 @@ route stays typed unavailable. An activation release requires the complete contracts plus commit-bound macOS signing/notarization evidence. No raw launcher is a migration fallback. +Activation also requires the exact digest-pinned third-party notice/license +tree and component-aware SPDX evidence for CPython, Nuitka, and incorporated +runtime components. Missing, unexpected, linked, or modified legal members +block archive publication. Policy-only archives omit those files because they +contain none of the corresponding native components. + The runtime manifest does not control signer trust. The operator-owned Apple Team ID must be pinned independently in `plugins/agent-collab/signing_policy.py`; activation verification rejects an empty anchor, a manifest mismatch, or a diff --git a/plugins/agent-collab/README.md b/plugins/agent-collab/README.md index 73ac47b..620535c 100644 --- a/plugins/agent-collab/README.md +++ b/plugins/agent-collab/README.md @@ -30,6 +30,12 @@ commercial rights. See [NOTICE](NOTICE) and [COMMERCIAL-LICENSING.md](COMMERCIAL-LICENSING.md) for the exact ownership and approval boundary. +When the signed native runtime is activated, the archive also includes +`THIRD-PARTY-NOTICES.txt` and `third-party-licenses/` for CPython 3.13.14, +Nuitka 4.1.3 runtime material, and incorporated dependencies. Those exact files +are digest-pinned by the archive builder and remain outside policy-only +archives, which contain none of the corresponding runtime components. + ## Runtime and safe mode The package may contain a privately built signed native runtime only at the @@ -53,6 +59,8 @@ only rather than a send primitive. This package may still be distributed as a policy-only release: its manifest has no artifact rows, its archive has no runtime executable, and invocation continues to return typed unavailable until an activation release is verified. +An activation archive must add the complete digest-pinned third-party legal +tree and component-aware SPDX evidence alongside the signed runtime. Reinstalling a retired plugin is never a rollback. To enter rollback mode, set `AGENT_COLLAB_SAFE_MODE=1` in the active host @@ -135,7 +143,7 @@ time; a listed skill does not imply that its native route is currently active. | Delegation and implementation | `delegate`, `dev-delegate`, `worker` | | Large-context and knowledge work | `knowledge-compile`, `long-context` | | Reproducible workflows | `chain`, `chain-configurator`, `orchestrate` | -| Integration and conflict handling | `ai-merge-resolve` | +| Integration and conflict handling | `merge-resolve` | | Visual guidance | `ui-to-code`, `visual-review` | `visual-review` and `ui-to-code` currently provide primary-only guidance because @@ -153,6 +161,27 @@ runtime manifest; blocks routing while any retired package remains installed or active; and prints exact manager-specific install, verify, and uninstall actions. +## Signed runtime setup + +After installing an activation release, resolve this installed plugin root and +use the closed management client only: + +```text +python3 "/runtime_setup.py" status +python3 "/runtime_setup.py" prepare +python3 "/runtime_setup.py" login-grok +``` + +`status` is read-only, `prepare` creates only signed-runtime-managed state, and +`login-grok` starts the bounded interactive device flow. The client accepts no +provider, model, path, environment, binary, tool, or arbitrary argument +options. It verifies the same co-packaged signed artifact as normal routing, +keeps the child environment scrubbed, reports only a closed host-context enum, +and never exposes private provider recipes. Codex and OpenCode still require +their exact supported external CLIs and standard authenticated host state; +install and authenticate those through their vendor-supported interfaces. +Policy-only releases return typed `unavailable` for all three commands. + ## Standalone invocation and local threat limit Every routed skill resolves this installed plugin root from its own `SKILL.md` diff --git a/plugins/agent-collab/THIRD-PARTY-NOTICES.txt b/plugins/agent-collab/THIRD-PARTY-NOTICES.txt new file mode 100644 index 0000000..197c6de --- /dev/null +++ b/plugins/agent-collab/THIRD-PARTY-NOTICES.txt @@ -0,0 +1,36 @@ +Agent Collab native runtime third-party notices +=============================================== + +The PolyForm Strict License in LICENSE applies only to John Osumi-authored +portions of the agent-collab package. The activation runtime also contains the +third-party components below under their own terms. The policy-only package +does not contain the native runtime and does not redistribute these components. + +Component inventory +------------------- + +- CPython 3.13.14 (Python-2.0 / PSF terms). The exact license and incorporated + software notices are in third-party-licenses/CPython-3.13.14-LICENSE.txt and + third-party-licenses/CPython-3.13.14-NOTICES.txt. +- Expat 2.8.1 (MIT), incorporated by CPython. The exact notice is in + third-party-licenses/Expat-COPYING.txt. +- HACL* commit bb3d0dc8d9d15a5cd51094d5b69e70aa09005ff0 (MIT and + Apache-2.0), incorporated by CPython hash modules. Notices are in + third-party-licenses/HACL-LICENSE.txt; the complete Apache-2.0 text is also + reproduced in CPython-3.13.14-NOTICES.txt. +- libb2 0.98.1 (CC0-1.0), incorporated by CPython's BLAKE2 module. The source + dedication is in third-party-licenses/libb2-CC0-1.0.txt. +- mpdecimal 2.5.1 (BSD-2-Clause), incorporated by CPython's decimal module. + Its notice is in third-party-licenses/mpdecimal-NOTICE.txt. +- mimalloc 2.1.2 (MIT), incorporated by CPython. Its notice is in + third-party-licenses/mimalloc-LICENSE.txt. +- Nuitka 4.1.3 runtime/onefile bootstrap. Nuitka's AGPL text, runtime exception, + and attribution notice are in the three Nuitka-4.1.3 files under + third-party-licenses/. The runtime exception permits the compiled program to + remain under its chosen license; it is preserved verbatim. +- Hedley v14 (CC0-1.0), incorporated by the Nuitka runtime headers. The source + dedication is in third-party-licenses/Hedley-CC0-1.0.txt. + +Apple system libraries referenced from /usr/lib and /System/Library are not +copied into the package. Build-only tools are recorded by private build +provenance and are not redistributed as runtime components. diff --git a/plugins/agent-collab/runtime_client.py b/plugins/agent-collab/runtime_client.py index a6c3a1e..667e2a9 100644 --- a/plugins/agent-collab/runtime_client.py +++ b/plugins/agent-collab/runtime_client.py @@ -19,6 +19,7 @@ import json import os import platform +import pwd import re import selectors import shutil @@ -51,6 +52,13 @@ _REQUEST_ID_RE = re.compile(r"^[A-Za-z0-9._:-]{1,128}$") EXPECTED_MINIMUM_MACOS = "14.0" ISOLATED_TEMP_ROOT = Path("/tmp") +CODEX_DESKTOP_TUPLE = { + "CODEX_SANDBOX": "seatbelt", + "__CFBundleIdentifier": "com.openai.codex", + "CODEX_INTERNAL_ORIGINATOR_OVERRIDE": "Codex Desktop", + "CODEX_CI": "1", +} +MANAGEMENT_ACTIONS = frozenset({"status", "prepare", "grok_login"}) def _load_signing_policy(): @@ -558,10 +566,32 @@ def runtime_contract_snapshot() -> tuple[frozenset[tuple[str, str]], str]: return resolution.contracts, resolution.manifest_digest +def classify_host_context() -> str: + if all(os.environ.get(key) == value for key, value in CODEX_DESKTOP_TUPLE.items()): + return "codex_desktop" + return "generic" + + +def _operator_home() -> str | None: + try: + value = pwd.getpwuid(os.getuid()).pw_dir + except (KeyError, OSError): + return None + if ( + type(value) is not str + or not value + or "\0" in value + or len(value) > 4096 + or not Path(value).is_absolute() + ): + return None + return value + + def _scrubbed_env(*, tmpdir: Path) -> dict[str, str]: env = {"PATH": "/usr/bin:/bin:/usr/sbin:/sbin", "LANG": "C.UTF-8", "LC_ALL": "C.UTF-8"} - value = os.environ.get("HOME") - if value and "\0" not in value and len(value) <= 4096 and Path(value).is_absolute(): + value = _operator_home() + if value is not None: env["HOME"] = value env["TMPDIR"] = str(tmpdir) return env @@ -640,6 +670,7 @@ def _native_document(envelope: object) -> bytes: "action": envelope.action, "authority": envelope.authority, "timeout_ms": envelope.timeout_ms, + "host_context": classify_host_context(), **validated, } if envelope.artifact_present: @@ -685,6 +716,81 @@ def _native_document(envelope: object) -> bytes: return encoded +def _management_document( + *, action: str, request_id: str, timeout_ms: int +) -> bytes: + if action not in MANAGEMENT_ACTIONS: + raise ValueError("runtime management action is invalid") + if type(request_id) is not str or not _REQUEST_ID_RE.fullmatch(request_id): + raise ValueError("runtime management request identifier is invalid") + if type(timeout_ms) is not int or not 1 <= timeout_ms <= MAX_TIMEOUT_MS: + raise ValueError("runtime management timeout is invalid") + document = { + "protocol_version": PROTOCOL_VERSION, + "request_id": request_id, + "operation": "manage", + "management_action": action, + "host_context": classify_host_context(), + "timeout_ms": timeout_ms, + } + encoded = ( + json.dumps(document, ensure_ascii=False, separators=(",", ":")) + "\n" + ).encode("utf-8") + if len(encoded) > MAX_REQUEST_BYTES: + raise ValueError("runtime management request exceeds the fixed protocol limit") + return encoded + + +def _failure_response_result(response: Mapping[str, Any]) -> RuntimeResult | None: + status = response.get("status") + if status not in KNOWN_NATIVE_FAILURES: + return None + mapping = { + "unavailable": RuntimeStatus.UNAVAILABLE, + "auth_error": RuntimeStatus.AUTH_ERROR, + "quota_error": RuntimeStatus.QUOTA_ERROR, + "containment_error": RuntimeStatus.CONTAINMENT_ERROR, + "timeout": RuntimeStatus.TIMEOUT, + "output_limit": RuntimeStatus.OUTPUT_LIMIT, + "teardown_error": RuntimeStatus.TEARDOWN_ERROR, + "provider_error": RuntimeStatus.PROVIDER_ERROR, + } + return RuntimeResult(mapping[status], error=str(response["error"])) + + +def _parse_management_response( + out: bytes, *, request_id: str, returncode: int +) -> RuntimeResult: + try: + response = json.loads(out.decode("utf-8")) + except (UnicodeError, ValueError, RecursionError): + return RuntimeResult(RuntimeStatus.PROTOCOL_ERROR, error="invalid runtime management response") + if not isinstance(response, dict): + return RuntimeResult(RuntimeStatus.PROTOCOL_ERROR, error="runtime management response contract mismatch") + if response.get("status") in KNOWN_NATIVE_FAILURES: + if ( + set(response) != {"protocol_version", "request_id", "status", "error"} + or not _exact_int(response.get("protocol_version"), PROTOCOL_VERSION) + or response.get("request_id") != request_id + or not isinstance(response.get("error"), str) + or len(response["error"].encode("utf-8")) > 4096 + ): + return RuntimeResult(RuntimeStatus.PROTOCOL_ERROR, error="runtime management failure contract mismatch") + result = _failure_response_result(response) + return result or RuntimeResult(RuntimeStatus.PROTOCOL_ERROR, error="runtime management failure contract mismatch") + if returncode != 0: + return RuntimeResult(RuntimeStatus.PROTOCOL_ERROR, error="native runtime failed without a typed management result") + if ( + set(response) != {"protocol_version", "request_id", "status", "result"} + or not _exact_int(response.get("protocol_version"), PROTOCOL_VERSION) + or response.get("request_id") != request_id + or response.get("status") != "ok" + or not isinstance(response.get("result"), dict) + ): + return RuntimeResult(RuntimeStatus.PROTOCOL_ERROR, error="runtime management response contract mismatch") + return RuntimeResult(RuntimeStatus.OK, result=response["result"]) + + def _parse_response(out: bytes, envelope: object, returncode: int) -> RuntimeResult: try: response = json.loads(out.decode("utf-8")) @@ -799,7 +905,7 @@ def _terminate_and_reap(process: subprocess.Popen[bytes]) -> bool: def _collect_bounded_output( - process: subprocess.Popen[bytes], *, timeout_ms: int + process: subprocess.Popen[bytes], *, timeout_ms: int, relay_stderr: bool = False ) -> tuple[bytes, bytes, RuntimeResult | None]: if process.stdout is None or process.stderr is None: _terminate_and_reap(process) @@ -807,7 +913,9 @@ def _collect_bounded_output( RuntimeStatus.SPAWN_ERROR, error="native runtime pipes are unavailable" ) selector = selectors.DefaultSelector() - streams = {"stdout": process.stdout, "stderr": process.stderr} + streams = {"stdout": process.stdout} + if process.stderr is not None: + streams["stderr"] = process.stderr buffers = {"stdout": bytearray(), "stderr": bytearray()} deadline = time.monotonic() + timeout_ms / 1000 try: @@ -853,6 +961,13 @@ def _collect_bounded_output( else f"native runtime {name} limit exceeded and teardown failed" ) return b"", b"", RuntimeResult(status, error=error) + if name == "stderr" and relay_stderr: + pending = memoryview(chunk) + while pending: + written = os.write(2, pending) + if written <= 0: + raise OSError("runtime management stderr relay made no progress") + pending = pending[written:] remaining = deadline - time.monotonic() try: process.wait(timeout=max(remaining, 0.001)) @@ -888,24 +1003,18 @@ def _collect_bounded_output( stream.close() -def invoke(*, envelope: object) -> RuntimeResult: - try: - payload = _native_document(envelope) - except (AttributeError, RuntimeError, TypeError, ValueError, RecursionError): - return RuntimeResult(RuntimeStatus.CONFIG_ERROR, error="invalid or unsealed policy envelope") - if (envelope.route, envelope.action) in TEMPORARILY_UNAVAILABLE_CONTRACTS: - return RuntimeResult( - RuntimeStatus.UNAVAILABLE, - error=TEMPORARILY_UNAVAILABLE_CONTRACTS[(envelope.route, envelope.action)], - ) - resolution = resolve_runtime() - if resolution.status != RuntimeStatus.OK or resolution.path is None: - return RuntimeResult(resolution.status, error=resolution.error) - if resolution.manifest_digest != envelope.runtime_manifest_digest: - return RuntimeResult(RuntimeStatus.INTEGRITY_ERROR, error="runtime manifest changed after policy selection") - if (envelope.route, envelope.action) not in resolution.contracts: - return RuntimeResult(RuntimeStatus.UNAVAILABLE, error="native runtime does not advertise the sealed route/action") - if resolution.identity is None or _safe_file_identity(resolution.path, executable=True) != resolution.identity: +def _launch_runtime( + *, + resolution: RuntimeResolution, + payload: bytes, + timeout_ms: int, + envelope: object | None = None, + management_request_id: str = "", + relay_stderr: bool = False, +) -> RuntimeResult: + if resolution.path is None or resolution.identity is None: + return RuntimeResult(RuntimeStatus.UNAVAILABLE, error="native runtime is unavailable") + if _safe_file_identity(resolution.path, executable=True) != resolution.identity: return RuntimeResult(RuntimeStatus.INTEGRITY_ERROR, error="runtime identity changed before launch") command = [str(resolution.path), "invoke", "--protocol", str(PROTOCOL_VERSION)] try: @@ -923,13 +1032,21 @@ def invoke(*, envelope: object) -> RuntimeResult: start_new_session=True, close_fds=True, ) - out, err, collection_error = _collect_bounded_output( - process, timeout_ms=envelope.timeout_ms + out, _err, collection_error = _collect_bounded_output( + process, + timeout_ms=timeout_ms, + relay_stderr=relay_stderr, ) if collection_error is not None: - result = collection_error - else: - result = _parse_response(out, envelope, process.returncode) + return collection_error + returncode = process.returncode if process.returncode is not None else -1 + if envelope is not None: + return _parse_response(out, envelope, returncode) + return _parse_management_response( + out, + request_id=management_request_id, + returncode=returncode, + ) except _RuntimeTempCleanupError: return RuntimeResult( RuntimeStatus.TEARDOWN_ERROR, @@ -939,4 +1056,49 @@ def invoke(*, envelope: object) -> RuntimeResult: return RuntimeResult(RuntimeStatus.HOST_BLOCKED, error="host blocked runtime launch") except (OSError, ValueError): return RuntimeResult(RuntimeStatus.SPAWN_ERROR, error="native runtime could not start") - return result + + +def manage_runtime(*, action: str, request_id: str, timeout_ms: int) -> RuntimeResult: + try: + payload = _management_document( + action=action, + request_id=request_id, + timeout_ms=timeout_ms, + ) + except (TypeError, ValueError, RecursionError): + return RuntimeResult(RuntimeStatus.CONFIG_ERROR, error="invalid runtime management request") + resolution = resolve_runtime() + if resolution.status != RuntimeStatus.OK: + return RuntimeResult(resolution.status, error=resolution.error) + return _launch_runtime( + resolution=resolution, + payload=payload, + timeout_ms=timeout_ms, + management_request_id=request_id, + relay_stderr=action == "grok_login", + ) + + +def invoke(*, envelope: object) -> RuntimeResult: + try: + payload = _native_document(envelope) + except (AttributeError, RuntimeError, TypeError, ValueError, RecursionError): + return RuntimeResult(RuntimeStatus.CONFIG_ERROR, error="invalid or unsealed policy envelope") + if (envelope.route, envelope.action) in TEMPORARILY_UNAVAILABLE_CONTRACTS: + return RuntimeResult( + RuntimeStatus.UNAVAILABLE, + error=TEMPORARILY_UNAVAILABLE_CONTRACTS[(envelope.route, envelope.action)], + ) + resolution = resolve_runtime() + if resolution.status != RuntimeStatus.OK or resolution.path is None: + return RuntimeResult(resolution.status, error=resolution.error) + if resolution.manifest_digest != envelope.runtime_manifest_digest: + return RuntimeResult(RuntimeStatus.INTEGRITY_ERROR, error="runtime manifest changed after policy selection") + if (envelope.route, envelope.action) not in resolution.contracts: + return RuntimeResult(RuntimeStatus.UNAVAILABLE, error="native runtime does not advertise the sealed route/action") + return _launch_runtime( + resolution=resolution, + payload=payload, + timeout_ms=envelope.timeout_ms, + envelope=envelope, + ) diff --git a/plugins/agent-collab/runtime_setup.py b/plugins/agent-collab/runtime_setup.py new file mode 100644 index 0000000..47b9d3b --- /dev/null +++ b/plugins/agent-collab/runtime_setup.py @@ -0,0 +1,53 @@ +#!/usr/bin/env python3 +"""Closed operator entrypoint for the signed agent-collab runtime.""" + +from __future__ import annotations + +import json +import sys +import uuid + +import runtime_client + + +_COMMANDS = { + "status": ("status", 60_000), + "prepare": ("prepare", 60_000), + "login-grok": ("grok_login", 600_000), +} + + +def _emit(payload: dict[str, object]) -> None: + sys.stdout.write( + json.dumps(payload, sort_keys=True, separators=(",", ":"), ensure_ascii=True) + + "\n" + ) + + +def main(argv: list[str] | None = None) -> int: + args = list(sys.argv[1:] if argv is None else argv) + if len(args) != 1 or args[0] not in _COMMANDS: + _emit( + { + "status": runtime_client.RuntimeStatus.CONFIG_ERROR.value, + "error": "expected exactly one of: status, prepare, login-grok", + } + ) + return 2 + action, timeout_ms = _COMMANDS[args[0]] + result = runtime_client.manage_runtime( + action=action, + request_id=f"setup-{uuid.uuid4().hex}", + timeout_ms=timeout_ms, + ) + payload: dict[str, object] = {"status": result.status.value} + if result.result is not None: + payload["result"] = dict(result.result) + if result.error: + payload["error"] = result.error + _emit(payload) + return 0 if result.status is runtime_client.RuntimeStatus.OK else 1 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/plugins/agent-collab/skills/ai-merge-resolve/SKILL.md b/plugins/agent-collab/skills/merge-resolve/SKILL.md similarity index 93% rename from plugins/agent-collab/skills/ai-merge-resolve/SKILL.md rename to plugins/agent-collab/skills/merge-resolve/SKILL.md index 1f82f15..223b80a 100644 --- a/plugins/agent-collab/skills/ai-merge-resolve/SKILL.md +++ b/plugins/agent-collab/skills/merge-resolve/SKILL.md @@ -1,14 +1,14 @@ --- -name: ai-merge-resolve +name: merge-resolve version: 3.1.0 defaults: tier: Advanced effort: high -description: Resolve a git merge conflict (or apply a conflicting patch) using a cross-family read on both sides' intent + commit context; propose a unified resolution as a diff; **NEVER auto-apply without operator confirm by default**. Use when the user says "resolve this merge conflict," "ai-merge," "merge with the reviewer," "have the reviewer help merge," "AI-resolve this conflict," "use the reviewer to merge this," or when a `git merge` / `git rebase` exits with conflict markers and the user asks anything about next steps. Also offer this proactively when worktree-fanout flows (parallel-agent parallelism) need to integrate back to a base branch, or when a chain step produces a diff destined for a file the user is currently editing. +description: Use when a user asks to resolve a git merge conflict or conflicting patch, says "ai-merge" or "AI-resolve," when merge or rebase exits with conflict markers and next steps are requested, when parallel worktrees need integration, or when a chain diff targets a file being edited. --- -# AI-merge-resolve — cross-family merge-conflict resolution, operator-gated by default +# Merge resolve — cross-family merge-conflict resolution, operator-gated by default This skill is the inter-branch analogue of `chain`'s semantic gate (`kind: semantic, check: ai_cross_check`): a cross-family read on the two sides' intent + commit context, a proposed unified resolution as a diff, and an **operator-confirm gate** before any change touches the working tree. The cross-check is the engine; the operator-confirm and the validator gates are the safety net. @@ -138,7 +138,7 @@ These are runtime-enforced by the skill. They are not stylistic suggestions; the - **`auto_apply=true` preconditions (ALL four required, no exceptions)**: - 1. **An operator-pre-approved validator-policy file is present** at `.claude/ai-merge-policy.yaml` (project-scoped) OR `~/.claude/ai-merge-policy.yaml` (user-scoped). The policy file's *presence* is the operator's signed acknowledgment of the auto-apply opt-in; the skill refuses auto-apply if the policy file is missing. + 1. **An operator-pre-approved validator-policy file is present** at `.claude/merge-resolve-policy.yaml` (project-scoped) OR `~/.claude/merge-resolve-policy.yaml` (user-scoped). The policy file's *presence* is the operator's signed acknowledgment of the auto-apply opt-in; the skill refuses auto-apply if the policy file is missing. **Caveat — presence-checked, not substance-checked**: the skill verifies the calling chain step's `gates:` block contains each `required_gates:` entry from the policy (by kind + check). It does NOT verify the gate's substance is meaningful — an operator could configure `bash_exit_code: { command: "true" }` to satisfy the letter of the policy while bypassing the actual test suite. Substance is the operator's responsibility. @@ -211,7 +211,7 @@ For the first 10–20 real merges, run with the policy file present but `shadow_ Whether the operator chose `apply`, `reject`, `apply-and-amend`, or `revise`, surface a final summary: ``` -ai-merge-resolve summary: +merge-resolve summary: file: hunks resolved: of verifier CONFIDENCE: H | M | L diff --git a/plugins/agent-collab/skills/migration-doctor/SKILL.md b/plugins/agent-collab/skills/migration-doctor/SKILL.md index 5691fc1..da570f5 100644 --- a/plugins/agent-collab/skills/migration-doctor/SKILL.md +++ b/plugins/agent-collab/skills/migration-doctor/SKILL.md @@ -12,6 +12,13 @@ Resolve the **plugin root** from this loaded file and run For any coordinator readiness request, first read the **Coordinator request schema** in `/README.md`. +For an activation release, use only the co-packaged managed setup surface: +`python3 "/runtime_setup.py" status`, then `prepare`, and use +`login-grok` only when the status result reports that managed Grok +authentication is unavailable. The command accepts no provider, model, path, +environment, binary, tool, or raw argument overrides. Never invoke the native +runtime or a provider CLI directly. + ## Workflow Run the provider-free `migration_doctor.py` beside this skill's plugin root. diff --git a/plugins/agent-collab/third-party-licenses/CPython-3.13.14-LICENSE.txt b/plugins/agent-collab/third-party-licenses/CPython-3.13.14-LICENSE.txt new file mode 100644 index 0000000..14603b9 --- /dev/null +++ b/plugins/agent-collab/third-party-licenses/CPython-3.13.14-LICENSE.txt @@ -0,0 +1,277 @@ +A. HISTORY OF THE SOFTWARE +========================== + +Python was created in the early 1990s by Guido van Rossum at Stichting +Mathematisch Centrum (CWI, see https://www.cwi.nl) in the Netherlands +as a successor of a language called ABC. Guido remains Python's +principal author, although it includes many contributions from others. + +In 1995, Guido continued his work on Python at the Corporation for +National Research Initiatives (CNRI, see https://www.cnri.reston.va.us) +in Reston, Virginia where he released several versions of the +software. + +In May 2000, Guido and the Python core development team moved to +BeOpen.com to form the BeOpen PythonLabs team. In October of the same +year, the PythonLabs team moved to Digital Creations, which became +Zope Corporation. In 2001, the Python Software Foundation (PSF, see +https://www.python.org/psf/) was formed, a non-profit organization +created specifically to own Python-related Intellectual Property. +Zope Corporation was a sponsoring member of the PSF. + +All Python releases are Open Source (see https://opensource.org for +the Open Source Definition). Historically, most, but not all, Python +releases have also been GPL-compatible; the table below summarizes +the various releases. + + Release Derived Year Owner GPL- + from compatible? (1) + + 0.9.0 thru 1.2 1991-1995 CWI yes + 1.3 thru 1.5.2 1.2 1995-1999 CNRI yes + 1.6 1.5.2 2000 CNRI no + 2.0 1.6 2000 BeOpen.com no + 1.6.1 1.6 2001 CNRI yes (2) + 2.1 2.0+1.6.1 2001 PSF no + 2.0.1 2.0+1.6.1 2001 PSF yes + 2.1.1 2.1+2.0.1 2001 PSF yes + 2.1.2 2.1.1 2002 PSF yes + 2.1.3 2.1.2 2002 PSF yes + 2.2 and above 2.1.1 2001-now PSF yes + +Footnotes: + +(1) GPL-compatible doesn't mean that we're distributing Python under + the GPL. All Python licenses, unlike the GPL, let you distribute + a modified version without making your changes open source. The + GPL-compatible licenses make it possible to combine Python with + other software that is released under the GPL; the others don't. + +(2) According to Richard Stallman, 1.6.1 is not GPL-compatible, + because its license has a choice of law clause. According to + CNRI, however, Stallman's lawyer has told CNRI's lawyer that 1.6.1 + is "not incompatible" with the GPL. + +Thanks to the many outside volunteers who have worked under Guido's +direction to make these releases possible. + + +B. TERMS AND CONDITIONS FOR ACCESSING OR OTHERWISE USING PYTHON +=============================================================== + +Python software and documentation are licensed under the +Python Software Foundation License Version 2. + +Starting with Python 3.8.6, examples, recipes, and other code in +the documentation are dual licensed under the PSF License Version 2 +and the Zero-Clause BSD license. + +Some software incorporated into Python is under different licenses. +The licenses are listed with code falling under that license. + + +PYTHON SOFTWARE FOUNDATION LICENSE VERSION 2 +-------------------------------------------- + +1. This LICENSE AGREEMENT is between the Python Software Foundation +("PSF"), and the Individual or Organization ("Licensee") accessing and +otherwise using this software ("Python") in source or binary form and +its associated documentation. + +2. Subject to the terms and conditions of this License Agreement, PSF hereby +grants Licensee a nonexclusive, royalty-free, world-wide license to reproduce, +analyze, test, perform and/or display publicly, prepare derivative works, +distribute, and otherwise use Python alone or in any derivative version, +provided, however, that PSF's License Agreement and PSF's notice of copyright, +i.e., "Copyright (c) 2001-2024 Python Software Foundation; All Rights Reserved" +are retained in Python alone or in any derivative version prepared by Licensee. + +3. In the event Licensee prepares a derivative work that is based on +or incorporates Python or any part thereof, and wants to make +the derivative work available to others as provided herein, then +Licensee hereby agrees to include in any such work a brief summary of +the changes made to Python. + +4. PSF is making Python available to Licensee on an "AS IS" +basis. PSF MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR +IMPLIED. BY WAY OF EXAMPLE, BUT NOT LIMITATION, PSF MAKES NO AND +DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS +FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF PYTHON WILL NOT +INFRINGE ANY THIRD PARTY RIGHTS. + +5. PSF SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF PYTHON +FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS +A RESULT OF MODIFYING, DISTRIBUTING, OR OTHERWISE USING PYTHON, +OR ANY DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF. + +6. This License Agreement will automatically terminate upon a material +breach of its terms and conditions. + +7. Nothing in this License Agreement shall be deemed to create any +relationship of agency, partnership, or joint venture between PSF and +Licensee. This License Agreement does not grant permission to use PSF +trademarks or trade name in a trademark sense to endorse or promote +products or services of Licensee, or any third party. + +8. By copying, installing or otherwise using Python, Licensee +agrees to be bound by the terms and conditions of this License +Agreement. + + +BEOPEN.COM LICENSE AGREEMENT FOR PYTHON 2.0 +------------------------------------------- + +BEOPEN PYTHON OPEN SOURCE LICENSE AGREEMENT VERSION 1 + +1. This LICENSE AGREEMENT is between BeOpen.com ("BeOpen"), having an +office at 160 Saratoga Avenue, Santa Clara, CA 95051, and the +Individual or Organization ("Licensee") accessing and otherwise using +this software in source or binary form and its associated +documentation ("the Software"). + +2. Subject to the terms and conditions of this BeOpen Python License +Agreement, BeOpen hereby grants Licensee a non-exclusive, +royalty-free, world-wide license to reproduce, analyze, test, perform +and/or display publicly, prepare derivative works, distribute, and +otherwise use the Software alone or in any derivative version, +provided, however, that the BeOpen Python License is retained in the +Software, alone or in any derivative version prepared by Licensee. + +3. BeOpen is making the Software available to Licensee on an "AS IS" +basis. BEOPEN MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR +IMPLIED. BY WAY OF EXAMPLE, BUT NOT LIMITATION, BEOPEN MAKES NO AND +DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS +FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF THE SOFTWARE WILL NOT +INFRINGE ANY THIRD PARTY RIGHTS. + +4. BEOPEN SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF THE +SOFTWARE FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS +AS A RESULT OF USING, MODIFYING OR DISTRIBUTING THE SOFTWARE, OR ANY +DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF. + +5. This License Agreement will automatically terminate upon a material +breach of its terms and conditions. + +6. This License Agreement shall be governed by and interpreted in all +respects by the law of the State of California, excluding conflict of +law provisions. Nothing in this License Agreement shall be deemed to +create any relationship of agency, partnership, or joint venture +between BeOpen and Licensee. This License Agreement does not grant +permission to use BeOpen trademarks or trade names in a trademark +sense to endorse or promote products or services of Licensee, or any +third party. As an exception, the "BeOpen Python" logos available at +http://www.pythonlabs.com/logos.html may be used according to the +permissions granted on that web page. + +7. By copying, installing or otherwise using the software, Licensee +agrees to be bound by the terms and conditions of this License +Agreement. + + +CNRI LICENSE AGREEMENT FOR PYTHON 1.6.1 +--------------------------------------- + +1. This LICENSE AGREEMENT is between the Corporation for National +Research Initiatives, having an office at 1895 Preston White Drive, +Reston, VA 20191 ("CNRI"), and the Individual or Organization +("Licensee") accessing and otherwise using Python 1.6.1 software in +source or binary form and its associated documentation. + +2. Subject to the terms and conditions of this License Agreement, CNRI +hereby grants Licensee a nonexclusive, royalty-free, world-wide +license to reproduce, analyze, test, perform and/or display publicly, +prepare derivative works, distribute, and otherwise use Python 1.6.1 +alone or in any derivative version, provided, however, that CNRI's +License Agreement and CNRI's notice of copyright, i.e., "Copyright (c) +1995-2001 Corporation for National Research Initiatives; All Rights +Reserved" are retained in Python 1.6.1 alone or in any derivative +version prepared by Licensee. Alternately, in lieu of CNRI's License +Agreement, Licensee may substitute the following text (omitting the +quotes): "Python 1.6.1 is made available subject to the terms and +conditions in CNRI's License Agreement. This Agreement together with +Python 1.6.1 may be located on the internet using the following +unique, persistent identifier (known as a handle): 1895.22/1013. This +Agreement may also be obtained from a proxy server on the internet +using the following URL: http://hdl.handle.net/1895.22/1013". + +3. In the event Licensee prepares a derivative work that is based on +or incorporates Python 1.6.1 or any part thereof, and wants to make +the derivative work available to others as provided herein, then +Licensee hereby agrees to include in any such work a brief summary of +the changes made to Python 1.6.1. + +4. CNRI is making Python 1.6.1 available to Licensee on an "AS IS" +basis. CNRI MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR +IMPLIED. BY WAY OF EXAMPLE, BUT NOT LIMITATION, CNRI MAKES NO AND +DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS +FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF PYTHON 1.6.1 WILL NOT +INFRINGE ANY THIRD PARTY RIGHTS. + +5. CNRI SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF PYTHON +1.6.1 FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS +A RESULT OF MODIFYING, DISTRIBUTING, OR OTHERWISE USING PYTHON 1.6.1, +OR ANY DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF. + +6. This License Agreement will automatically terminate upon a material +breach of its terms and conditions. + +7. This License Agreement shall be governed by the federal +intellectual property law of the United States, including without +limitation the federal copyright law, and, to the extent such +U.S. federal law does not apply, by the law of the Commonwealth of +Virginia, excluding Virginia's conflict of law provisions. +Notwithstanding the foregoing, with regard to derivative works based +on Python 1.6.1 that incorporate non-separable material that was +previously distributed under the GNU General Public License (GPL), the +law of the Commonwealth of Virginia shall govern this License +Agreement only as to issues arising under or with respect to +Paragraphs 4, 5, and 7 of this License Agreement. Nothing in this +License Agreement shall be deemed to create any relationship of +agency, partnership, or joint venture between CNRI and Licensee. This +License Agreement does not grant permission to use CNRI trademarks or +trade name in a trademark sense to endorse or promote products or +services of Licensee, or any third party. + +8. By clicking on the "ACCEPT" button where indicated, or by copying, +installing or otherwise using Python 1.6.1, Licensee agrees to be +bound by the terms and conditions of this License Agreement. + + ACCEPT + + +CWI LICENSE AGREEMENT FOR PYTHON 0.9.0 THROUGH 1.2 +-------------------------------------------------- + +Copyright (c) 1991 - 1995, Stichting Mathematisch Centrum Amsterdam, +The Netherlands. All rights reserved. + +Permission to use, copy, modify, and distribute this software and its +documentation for any purpose and without fee is hereby granted, +provided that the above copyright notice appear in all copies and that +both that copyright notice and this permission notice appear in +supporting documentation, and that the name of Stichting Mathematisch +Centrum or CWI not be used in advertising or publicity pertaining to +distribution of the software without specific, written prior +permission. + +STICHTING MATHEMATISCH CENTRUM DISCLAIMS ALL WARRANTIES WITH REGARD TO +THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND +FITNESS, IN NO EVENT SHALL STICHTING MATHEMATISCH CENTRUM BE LIABLE +FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT +OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + +ZERO-CLAUSE BSD LICENSE FOR CODE IN THE PYTHON DOCUMENTATION +---------------------------------------------------------------------- + +Permission to use, copy, modify, and/or distribute this software for any +purpose with or without fee is hereby granted. + +THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH +REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, +INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR +OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +PERFORMANCE OF THIS SOFTWARE. diff --git a/plugins/agent-collab/third-party-licenses/CPython-3.13.14-NOTICES.txt b/plugins/agent-collab/third-party-licenses/CPython-3.13.14-NOTICES.txt new file mode 100644 index 0000000..dd27e90 --- /dev/null +++ b/plugins/agent-collab/third-party-licenses/CPython-3.13.14-NOTICES.txt @@ -0,0 +1,1134 @@ +.. highlight:: none + +.. _history-and-license: + +******************* +History and License +******************* + + +History of the software +======================= + +Python was created in the early 1990s by Guido van Rossum at Stichting +Mathematisch Centrum (CWI, see https://www.cwi.nl) in the Netherlands as a +successor of a language called ABC. Guido remains Python's principal author, +although it includes many contributions from others. + +In 1995, Guido continued his work on Python at the Corporation for National +Research Initiatives (CNRI, see https://www.cnri.reston.va.us) in Reston, +Virginia where he released several versions of the software. + +In May 2000, Guido and the Python core development team moved to BeOpen.com to +form the BeOpen PythonLabs team. In October of the same year, the PythonLabs +team moved to Digital Creations, which became +Zope Corporation. In 2001, the Python Software Foundation (PSF, see +https://www.python.org/psf/) was formed, a non-profit organization created +specifically to own Python-related Intellectual Property. Zope Corporation was a +sponsoring member of the PSF. + +All Python releases are Open Source (see https://opensource.org for the Open +Source Definition). Historically, most, but not all, Python releases have also +been GPL-compatible; the table below summarizes the various releases. + ++----------------+--------------+------------+------------+---------------------+ +| Release | Derived from | Year | Owner | GPL-compatible? (1) | ++================+==============+============+============+=====================+ +| 0.9.0 thru 1.2 | n/a | 1991-1995 | CWI | yes | ++----------------+--------------+------------+------------+---------------------+ +| 1.3 thru 1.5.2 | 1.2 | 1995-1999 | CNRI | yes | ++----------------+--------------+------------+------------+---------------------+ +| 1.6 | 1.5.2 | 2000 | CNRI | no | ++----------------+--------------+------------+------------+---------------------+ +| 2.0 | 1.6 | 2000 | BeOpen.com | no | ++----------------+--------------+------------+------------+---------------------+ +| 1.6.1 | 1.6 | 2001 | CNRI | yes (2) | ++----------------+--------------+------------+------------+---------------------+ +| 2.1 | 2.0+1.6.1 | 2001 | PSF | no | ++----------------+--------------+------------+------------+---------------------+ +| 2.0.1 | 2.0+1.6.1 | 2001 | PSF | yes | ++----------------+--------------+------------+------------+---------------------+ +| 2.1.1 | 2.1+2.0.1 | 2001 | PSF | yes | ++----------------+--------------+------------+------------+---------------------+ +| 2.1.2 | 2.1.1 | 2002 | PSF | yes | ++----------------+--------------+------------+------------+---------------------+ +| 2.1.3 | 2.1.2 | 2002 | PSF | yes | ++----------------+--------------+------------+------------+---------------------+ +| 2.2 and above | 2.1.1 | 2001-now | PSF | yes | ++----------------+--------------+------------+------------+---------------------+ + +.. note:: + + (1) GPL-compatible doesn't mean that we're distributing Python under the GPL. + All Python licenses, unlike the GPL, let you distribute a modified version + without making your changes open source. The GPL-compatible licenses make + it possible to combine Python with other software that is released under + the GPL; the others don't. + + (2) According to Richard Stallman, 1.6.1 is not GPL-compatible, because its license + has a choice of law clause. According to CNRI, however, Stallman's lawyer has + told CNRI's lawyer that 1.6.1 is "not incompatible" with the GPL. + +Thanks to the many outside volunteers who have worked under Guido's direction to +make these releases possible. + + +Terms and conditions for accessing or otherwise using Python +============================================================ + +Python software and documentation are licensed under the +Python Software Foundation License Version 2. + +Starting with Python 3.8.6, examples, recipes, and other code in +the documentation are dual licensed under the PSF License Version 2 +and the :ref:`Zero-Clause BSD license `. + +Some software incorporated into Python is under different licenses. +The licenses are listed with code falling under that license. +See :ref:`OtherLicenses` for an incomplete list of these licenses. + + +.. _PSF-license: + +PYTHON SOFTWARE FOUNDATION LICENSE VERSION 2 +-------------------------------------------- + +.. parsed-literal:: + + 1. This LICENSE AGREEMENT is between the Python Software Foundation ("PSF"), and + the Individual or Organization ("Licensee") accessing and otherwise using this + software ("Python") in source or binary form and its associated documentation. + + 2. Subject to the terms and conditions of this License Agreement, PSF hereby + grants Licensee a nonexclusive, royalty-free, world-wide license to reproduce, + analyze, test, perform and/or display publicly, prepare derivative works, + distribute, and otherwise use Python alone or in any derivative + version, provided, however, that PSF's License Agreement and PSF's notice of + copyright, i.e., "Copyright © 2001-2024 Python Software Foundation; All Rights + Reserved" are retained in Python alone or in any derivative version + prepared by Licensee. + + 3. In the event Licensee prepares a derivative work that is based on or + incorporates Python or any part thereof, and wants to make the + derivative work available to others as provided herein, then Licensee hereby + agrees to include in any such work a brief summary of the changes made to Python. + + 4. PSF is making Python available to Licensee on an "AS IS" basis. + PSF MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED. BY WAY OF + EXAMPLE, BUT NOT LIMITATION, PSF MAKES NO AND DISCLAIMS ANY REPRESENTATION OR + WARRANTY OF MERCHANTABILITY OR FITNESS FOR ANY PARTICULAR PURPOSE OR THAT THE + USE OF PYTHON WILL NOT INFRINGE ANY THIRD PARTY RIGHTS. + + 5. PSF SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF PYTHON + FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS A RESULT OF + MODIFYING, DISTRIBUTING, OR OTHERWISE USING PYTHON, OR ANY DERIVATIVE + THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF. + + 6. This License Agreement will automatically terminate upon a material breach of + its terms and conditions. + + 7. Nothing in this License Agreement shall be deemed to create any relationship + of agency, partnership, or joint venture between PSF and Licensee. This License + Agreement does not grant permission to use PSF trademarks or trade name in a + trademark sense to endorse or promote products or services of Licensee, or any + third party. + + 8. By copying, installing or otherwise using Python, Licensee agrees + to be bound by the terms and conditions of this License Agreement. + + +BEOPEN.COM LICENSE AGREEMENT FOR PYTHON 2.0 +------------------------------------------- + +BEOPEN PYTHON OPEN SOURCE LICENSE AGREEMENT VERSION 1 + +.. parsed-literal:: + + 1. This LICENSE AGREEMENT is between BeOpen.com ("BeOpen"), having an office at + 160 Saratoga Avenue, Santa Clara, CA 95051, and the Individual or Organization + ("Licensee") accessing and otherwise using this software in source or binary + form and its associated documentation ("the Software"). + + 2. Subject to the terms and conditions of this BeOpen Python License Agreement, + BeOpen hereby grants Licensee a non-exclusive, royalty-free, world-wide license + to reproduce, analyze, test, perform and/or display publicly, prepare derivative + works, distribute, and otherwise use the Software alone or in any derivative + version, provided, however, that the BeOpen Python License is retained in the + Software, alone or in any derivative version prepared by Licensee. + + 3. BeOpen is making the Software available to Licensee on an "AS IS" basis. + BEOPEN MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED. BY WAY OF + EXAMPLE, BUT NOT LIMITATION, BEOPEN MAKES NO AND DISCLAIMS ANY REPRESENTATION OR + WARRANTY OF MERCHANTABILITY OR FITNESS FOR ANY PARTICULAR PURPOSE OR THAT THE + USE OF THE SOFTWARE WILL NOT INFRINGE ANY THIRD PARTY RIGHTS. + + 4. BEOPEN SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF THE SOFTWARE FOR + ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS A RESULT OF USING, + MODIFYING OR DISTRIBUTING THE SOFTWARE, OR ANY DERIVATIVE THEREOF, EVEN IF + ADVISED OF THE POSSIBILITY THEREOF. + + 5. This License Agreement will automatically terminate upon a material breach of + its terms and conditions. + + 6. This License Agreement shall be governed by and interpreted in all respects + by the law of the State of California, excluding conflict of law provisions. + Nothing in this License Agreement shall be deemed to create any relationship of + agency, partnership, or joint venture between BeOpen and Licensee. This License + Agreement does not grant permission to use BeOpen trademarks or trade names in a + trademark sense to endorse or promote products or services of Licensee, or any + third party. As an exception, the "BeOpen Python" logos available at + http://www.pythonlabs.com/logos.html may be used according to the permissions + granted on that web page. + + 7. By copying, installing or otherwise using the software, Licensee agrees to be + bound by the terms and conditions of this License Agreement. + + +CNRI LICENSE AGREEMENT FOR PYTHON 1.6.1 +--------------------------------------- + +.. parsed-literal:: + + 1. This LICENSE AGREEMENT is between the Corporation for National Research + Initiatives, having an office at 1895 Preston White Drive, Reston, VA 20191 + ("CNRI"), and the Individual or Organization ("Licensee") accessing and + otherwise using Python 1.6.1 software in source or binary form and its + associated documentation. + + 2. Subject to the terms and conditions of this License Agreement, CNRI hereby + grants Licensee a nonexclusive, royalty-free, world-wide license to reproduce, + analyze, test, perform and/or display publicly, prepare derivative works, + distribute, and otherwise use Python 1.6.1 alone or in any derivative version, + provided, however, that CNRI's License Agreement and CNRI's notice of copyright, + i.e., "Copyright © 1995-2001 Corporation for National Research Initiatives; All + Rights Reserved" are retained in Python 1.6.1 alone or in any derivative version + prepared by Licensee. Alternately, in lieu of CNRI's License Agreement, + Licensee may substitute the following text (omitting the quotes): "Python 1.6.1 + is made available subject to the terms and conditions in CNRI's License + Agreement. This Agreement together with Python 1.6.1 may be located on the + internet using the following unique, persistent identifier (known as a handle): + 1895.22/1013. This Agreement may also be obtained from a proxy server on the + internet using the following URL: http://hdl.handle.net/1895.22/1013". + + 3. In the event Licensee prepares a derivative work that is based on or + incorporates Python 1.6.1 or any part thereof, and wants to make the derivative + work available to others as provided herein, then Licensee hereby agrees to + include in any such work a brief summary of the changes made to Python 1.6.1. + + 4. CNRI is making Python 1.6.1 available to Licensee on an "AS IS" basis. CNRI + MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED. BY WAY OF EXAMPLE, + BUT NOT LIMITATION, CNRI MAKES NO AND DISCLAIMS ANY REPRESENTATION OR WARRANTY + OF MERCHANTABILITY OR FITNESS FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF + PYTHON 1.6.1 WILL NOT INFRINGE ANY THIRD PARTY RIGHTS. + + 5. CNRI SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF PYTHON 1.6.1 FOR + ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS A RESULT OF + MODIFYING, DISTRIBUTING, OR OTHERWISE USING PYTHON 1.6.1, OR ANY DERIVATIVE + THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF. + + 6. This License Agreement will automatically terminate upon a material breach of + its terms and conditions. + + 7. This License Agreement shall be governed by the federal intellectual property + law of the United States, including without limitation the federal copyright + law, and, to the extent such U.S. federal law does not apply, by the law of the + Commonwealth of Virginia, excluding Virginia's conflict of law provisions. + Notwithstanding the foregoing, with regard to derivative works based on Python + 1.6.1 that incorporate non-separable material that was previously distributed + under the GNU General Public License (GPL), the law of the Commonwealth of + Virginia shall govern this License Agreement only as to issues arising under or + with respect to Paragraphs 4, 5, and 7 of this License Agreement. Nothing in + this License Agreement shall be deemed to create any relationship of agency, + partnership, or joint venture between CNRI and Licensee. This License Agreement + does not grant permission to use CNRI trademarks or trade name in a trademark + sense to endorse or promote products or services of Licensee, or any third + party. + + 8. By clicking on the "ACCEPT" button where indicated, or by copying, installing + or otherwise using Python 1.6.1, Licensee agrees to be bound by the terms and + conditions of this License Agreement. + + +CWI LICENSE AGREEMENT FOR PYTHON 0.9.0 THROUGH 1.2 +-------------------------------------------------- + +.. parsed-literal:: + + Copyright © 1991 - 1995, Stichting Mathematisch Centrum Amsterdam, The + Netherlands. All rights reserved. + + Permission to use, copy, modify, and distribute this software and its + documentation for any purpose and without fee is hereby granted, provided that + the above copyright notice appear in all copies and that both that copyright + notice and this permission notice appear in supporting documentation, and that + the name of Stichting Mathematisch Centrum or CWI not be used in advertising or + publicity pertaining to distribution of the software without specific, written + prior permission. + + STICHTING MATHEMATISCH CENTRUM DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS + SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO + EVENT SHALL STICHTING MATHEMATISCH CENTRUM BE LIABLE FOR ANY SPECIAL, INDIRECT + OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, + DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS + ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS + SOFTWARE. + + +.. _BSD0: + +ZERO-CLAUSE BSD LICENSE FOR CODE IN THE PYTHON DOCUMENTATION +------------------------------------------------------------ + +.. parsed-literal:: + + Permission to use, copy, modify, and/or distribute this software for any + purpose with or without fee is hereby granted. + + THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH + REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, + INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR + OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + PERFORMANCE OF THIS SOFTWARE. + + +.. _OtherLicenses: + +Licenses and Acknowledgements for Incorporated Software +======================================================= + +This section is an incomplete, but growing list of licenses and acknowledgements +for third-party software incorporated in the Python distribution. + + +Mersenne Twister +---------------- + +The :mod:`!_random` C extension underlying the :mod:`random` module +includes code based on a download from +http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/MT2002/emt19937ar.html. The following are +the verbatim comments from the original code:: + + A C-program for MT19937, with initialization improved 2002/1/26. + Coded by Takuji Nishimura and Makoto Matsumoto. + + Before using, initialize the state by using init_genrand(seed) + or init_by_array(init_key, key_length). + + Copyright (C) 1997 - 2002, Makoto Matsumoto and Takuji Nishimura, + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions + are met: + + 1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. The names of its contributors may not be used to endorse or promote + products derived from this software without specific prior written + permission. + + THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + + Any feedback is very welcome. + http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/emt.html + email: m-mat @ math.sci.hiroshima-u.ac.jp (remove space) + + +Sockets +------- + +The :mod:`socket` module uses the functions, :c:func:`!getaddrinfo`, and +:c:func:`!getnameinfo`, which are coded in separate source files from the WIDE +Project, https://www.wide.ad.jp/. :: + + Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions + are met: + 1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + 3. Neither the name of the project nor the names of its contributors + may be used to endorse or promote products derived from this software + without specific prior written permission. + + THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS "AS IS" AND + ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE + FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + SUCH DAMAGE. + + +Asynchronous socket services +---------------------------- + +The :mod:`!test.support.asynchat` and :mod:`!test.support.asyncore` +modules contain the following notice:: + + Copyright 1996 by Sam Rushing + + All Rights Reserved + + Permission to use, copy, modify, and distribute this software and + its documentation for any purpose and without fee is hereby + granted, provided that the above copyright notice appear in all + copies and that both that copyright notice and this permission + notice appear in supporting documentation, and that the name of Sam + Rushing not be used in advertising or publicity pertaining to + distribution of the software without specific, written prior + permission. + + SAM RUSHING DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, + INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN + NO EVENT SHALL SAM RUSHING BE LIABLE FOR ANY SPECIAL, INDIRECT OR + CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS + OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, + NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN + CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + + +Cookie management +----------------- + +The :mod:`http.cookies` module contains the following notice:: + + Copyright 2000 by Timothy O'Malley + + All Rights Reserved + + Permission to use, copy, modify, and distribute this software + and its documentation for any purpose and without fee is hereby + granted, provided that the above copyright notice appear in all + copies and that both that copyright notice and this permission + notice appear in supporting documentation, and that the name of + Timothy O'Malley not be used in advertising or publicity + pertaining to distribution of the software without specific, written + prior permission. + + Timothy O'Malley DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS + SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS, IN NO EVENT SHALL Timothy O'Malley BE LIABLE FOR + ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, + WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS + ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + PERFORMANCE OF THIS SOFTWARE. + + +Execution tracing +----------------- + +The :mod:`trace` module contains the following notice:: + + portions copyright 2001, Autonomous Zones Industries, Inc., all rights... + err... reserved and offered to the public under the terms of the + Python 2.2 license. + Author: Zooko O'Whielacronx + http://zooko.com/ + mailto:zooko@zooko.com + + Copyright 2000, Mojam Media, Inc., all rights reserved. + Author: Skip Montanaro + + Copyright 1999, Bioreason, Inc., all rights reserved. + Author: Andrew Dalke + + Copyright 1995-1997, Automatrix, Inc., all rights reserved. + Author: Skip Montanaro + + Copyright 1991-1995, Stichting Mathematisch Centrum, all rights reserved. + + + Permission to use, copy, modify, and distribute this Python software and + its associated documentation for any purpose without fee is hereby + granted, provided that the above copyright notice appears in all copies, + and that both that copyright notice and this permission notice appear in + supporting documentation, and that the name of neither Automatrix, + Bioreason or Mojam Media be used in advertising or publicity pertaining to + distribution of the software without specific, written prior permission. + + +UUencode and UUdecode functions +------------------------------- + +The ``uu`` codec contains the following notice:: + + Copyright 1994 by Lance Ellinghouse + Cathedral City, California Republic, United States of America. + All Rights Reserved + Permission to use, copy, modify, and distribute this software and its + documentation for any purpose and without fee is hereby granted, + provided that the above copyright notice appear in all copies and that + both that copyright notice and this permission notice appear in + supporting documentation, and that the name of Lance Ellinghouse + not be used in advertising or publicity pertaining to distribution + of the software without specific, written prior permission. + LANCE ELLINGHOUSE DISCLAIMS ALL WARRANTIES WITH REGARD TO + THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND + FITNESS, IN NO EVENT SHALL LANCE ELLINGHOUSE CENTRUM BE LIABLE + FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT + OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + + Modified by Jack Jansen, CWI, July 1995: + - Use binascii module to do the actual line-by-line conversion + between ascii and binary. This results in a 1000-fold speedup. The C + version is still 5 times faster, though. + - Arguments more compliant with Python standard + + +XML Remote Procedure Calls +-------------------------- + +The :mod:`xmlrpc.client` module contains the following notice:: + + The XML-RPC client interface is + + Copyright (c) 1999-2002 by Secret Labs AB + Copyright (c) 1999-2002 by Fredrik Lundh + + By obtaining, using, and/or copying this software and/or its + associated documentation, you agree that you have read, understood, + and will comply with the following terms and conditions: + + Permission to use, copy, modify, and distribute this software and + its associated documentation for any purpose and without fee is + hereby granted, provided that the above copyright notice appears in + all copies, and that both that copyright notice and this permission + notice appear in supporting documentation, and that the name of + Secret Labs AB or the author not be used in advertising or publicity + pertaining to distribution of the software without specific, written + prior permission. + + SECRET LABS AB AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD + TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANT- + ABILITY AND FITNESS. IN NO EVENT SHALL SECRET LABS AB OR THE AUTHOR + BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY + DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, + WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS + ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE + OF THIS SOFTWARE. + + +test_epoll +---------- + +The :mod:`!test.test_epoll` module contains the following notice:: + + Copyright (c) 2001-2006 Twisted Matrix Laboratories. + + Permission is hereby granted, free of charge, to any person obtaining + a copy of this software and associated documentation files (the + "Software"), to deal in the Software without restriction, including + without limitation the rights to use, copy, modify, merge, publish, + distribute, sublicense, and/or sell copies of the Software, and to + permit persons to whom the Software is furnished to do so, subject to + the following conditions: + + The above copyright notice and this permission notice shall be + included in all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE + LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION + OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION + WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + +Select kqueue +------------- + +The :mod:`select` module contains the following notice for the kqueue +interface:: + + Copyright (c) 2000 Doug White, 2006 James Knight, 2007 Christian Heimes + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions + are met: + 1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS" AND + ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + SUCH DAMAGE. + + +SipHash24 +--------- + +The file :file:`Python/pyhash.c` contains Marek Majkowski' implementation of +Dan Bernstein's SipHash24 algorithm. It contains the following note:: + + + Copyright (c) 2013 Marek Majkowski + + Permission is hereby granted, free of charge, to any person obtaining a copy + of this software and associated documentation files (the "Software"), to deal + in the Software without restriction, including without limitation the rights + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is + furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in + all copies or substantial portions of the Software. + + + Original location: + https://github.com/majek/csiphash/ + + Solution inspired by code from: + Samuel Neves (supercop/crypto_auth/siphash24/little) + djb (supercop/crypto_auth/siphash24/little2) + Jean-Philippe Aumasson (https://131002.net/siphash/siphash24.c) + + +strtod and dtoa +--------------- + +The file :file:`Python/dtoa.c`, which supplies C functions dtoa and +strtod for conversion of C doubles to and from strings, is derived +from the file of the same name by David M. Gay, currently available +from https://web.archive.org/web/20220517033456/http://www.netlib.org/fp/dtoa.c. +The original file, as retrieved on March 16, 2009, contains the following +copyright and licensing notice:: + + /**************************************************************** + * + * The author of this software is David M. Gay. + * + * Copyright (c) 1991, 2000, 2001 by Lucent Technologies. + * + * Permission to use, copy, modify, and distribute this software for any + * purpose without fee is hereby granted, provided that this entire notice + * is included in all copies of any software which is or includes a copy + * or modification of this software and in all copies of the supporting + * documentation for such software. + * + * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED + * WARRANTY. IN PARTICULAR, NEITHER THE AUTHOR NOR LUCENT MAKES ANY + * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY + * OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE. + * + ***************************************************************/ + + +OpenSSL +------- + +The modules :mod:`hashlib`, :mod:`posix` and :mod:`ssl` use +the OpenSSL library for added performance if made available by the +operating system. Additionally, the Windows and macOS installers for +Python may include a copy of the OpenSSL libraries, so we include a copy +of the OpenSSL license here. For the OpenSSL 3.0 release, +and later releases derived from that, the Apache License v2 applies:: + + + Apache License + Version 2.0, January 2004 + https://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + +expat +----- + +The :mod:`pyexpat ` extension is built using an included copy of the expat +sources unless the build is configured ``--with-system-expat``:: + + Copyright (c) 1998, 1999, 2000 Thai Open Source Software Center Ltd + and Clark Cooper + + Permission is hereby granted, free of charge, to any person obtaining + a copy of this software and associated documentation files (the + "Software"), to deal in the Software without restriction, including + without limitation the rights to use, copy, modify, merge, publish, + distribute, sublicense, and/or sell copies of the Software, and to + permit persons to whom the Software is furnished to do so, subject to + the following conditions: + + The above copyright notice and this permission notice shall be included + in all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. + IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY + CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, + TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE + SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + +libffi +------ + +The :mod:`!_ctypes` C extension underlying the :mod:`ctypes` module +is built using an included copy of the libffi +sources unless the build is configured ``--with-system-libffi``:: + + Copyright (c) 1996-2008 Red Hat, Inc and others. + + Permission is hereby granted, free of charge, to any person obtaining + a copy of this software and associated documentation files (the + "Software"), to deal in the Software without restriction, including + without limitation the rights to use, copy, modify, merge, publish, + distribute, sublicense, and/or sell copies of the Software, and to + permit persons to whom the Software is furnished to do so, subject to + the following conditions: + + The above copyright notice and this permission notice shall be included + in all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT + HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, + WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER + DEALINGS IN THE SOFTWARE. + + +zlib +---- + +The :mod:`zlib` extension is built using an included copy of the zlib +sources if the zlib version found on the system is too old to be +used for the build:: + + Copyright (C) 1995-2011 Jean-loup Gailly and Mark Adler + + This software is provided 'as-is', without any express or implied + warranty. In no event will the authors be held liable for any damages + arising from the use of this software. + + Permission is granted to anyone to use this software for any purpose, + including commercial applications, and to alter it and redistribute it + freely, subject to the following restrictions: + + 1. The origin of this software must not be misrepresented; you must not + claim that you wrote the original software. If you use this software + in a product, an acknowledgment in the product documentation would be + appreciated but is not required. + + 2. Altered source versions must be plainly marked as such, and must not be + misrepresented as being the original software. + + 3. This notice may not be removed or altered from any source distribution. + + Jean-loup Gailly Mark Adler + jloup@gzip.org madler@alumni.caltech.edu + + +cfuhash +------- + +The implementation of the hash table used by the :mod:`tracemalloc` is based +on the cfuhash project:: + + Copyright (c) 2005 Don Owens + All rights reserved. + + This code is released under the BSD license: + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions + are met: + + * Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + + * Redistributions in binary form must reproduce the above + copyright notice, this list of conditions and the following + disclaimer in the documentation and/or other materials provided + with the distribution. + + * Neither the name of the author nor the names of its + contributors may be used to endorse or promote products derived + from this software without specific prior written permission. + + THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS + FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + OF THE POSSIBILITY OF SUCH DAMAGE. + + +libmpdec +-------- + +The :mod:`!_decimal` C extension underlying the :mod:`decimal` module +is built using an included copy of the libmpdec +library unless the build is configured ``--with-system-libmpdec``:: + + Copyright (c) 2008-2020 Stefan Krah. All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions + are met: + + 1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS" AND + ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + SUCH DAMAGE. + + +W3C C14N test suite +------------------- + +The C14N 2.0 test suite in the :mod:`test` package +(``Lib/test/xmltestdata/c14n-20/``) was retrieved from the W3C website at +https://www.w3.org/TR/xml-c14n2-testcases/ and is distributed under the +3-clause BSD license:: + + Copyright (c) 2013 W3C(R) (MIT, ERCIM, Keio, Beihang), + All Rights Reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions + are met: + + * Redistributions of works must retain the original copyright notice, + this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the original copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + * Neither the name of the W3C nor the names of its contributors may be + used to endorse or promote products derived from this work without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + +.. _mimalloc-license: + +mimalloc +-------- + +MIT License:: + + Copyright (c) 2018-2021 Microsoft Corporation, Daan Leijen + + Permission is hereby granted, free of charge, to any person obtaining a copy + of this software and associated documentation files (the "Software"), to deal + in the Software without restriction, including without limitation the rights + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is + furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in all + copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE + SOFTWARE. + + +asyncio +---------- + +Parts of the :mod:`asyncio` module are incorporated from +`uvloop 0.16 `_, +which is distributed under the MIT license:: + + Copyright (c) 2015-2021 MagicStack Inc. http://magic.io + + Permission is hereby granted, free of charge, to any person obtaining + a copy of this software and associated documentation files (the + "Software"), to deal in the Software without restriction, including + without limitation the rights to use, copy, modify, merge, publish, + distribute, sublicense, and/or sell copies of the Software, and to + permit persons to whom the Software is furnished to do so, subject to + the following conditions: + + The above copyright notice and this permission notice shall be + included in all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE + LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION + OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION + WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + +Global Unbounded Sequences (GUS) +-------------------------------- + +The file :file:`Python/qsbr.c` is adapted from FreeBSD's "Global Unbounded +Sequences" safe memory reclamation scheme in +`subr_smr.c `_. +The file is distributed under the 2-Clause BSD License:: + + Copyright (c) 2019,2020 Jeffrey Roberson + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions + are met: + 1. Redistributions of source code must retain the above copyright + notice unmodified, this list of conditions, and the following + disclaimer. + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED BY THE AUTHOR "AS IS" AND ANY EXPRESS OR + IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. + IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, + INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF + THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/plugins/agent-collab/third-party-licenses/Expat-COPYING.txt b/plugins/agent-collab/third-party-licenses/Expat-COPYING.txt new file mode 100644 index 0000000..c6d184a --- /dev/null +++ b/plugins/agent-collab/third-party-licenses/Expat-COPYING.txt @@ -0,0 +1,21 @@ +Copyright (c) 1998-2000 Thai Open Source Software Center Ltd and Clark Cooper +Copyright (c) 2001-2025 Expat maintainers + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be included +in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY +CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, +TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE +SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/plugins/agent-collab/third-party-licenses/HACL-LICENSE.txt b/plugins/agent-collab/third-party-licenses/HACL-LICENSE.txt new file mode 100644 index 0000000..4a8ac45 --- /dev/null +++ b/plugins/agent-collab/third-party-licenses/HACL-LICENSE.txt @@ -0,0 +1,33 @@ +HACL* generated hash implementations +------------------------------------ + +MIT License + +Copyright (c) 2016-2022 INRIA, CMU and Microsoft Corporation +Copyright (c) 2022-2023 HACL* Contributors + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + +KaRaMeL support headers incorporated with these sources contain the notice: + +Copyright (c) INRIA and Microsoft Corporation. All rights reserved. +Licensed under the Apache 2.0 License. + +The complete Apache License 2.0 text is reproduced in +CPython-3.13.14-NOTICES.txt under the incorporated-software acknowledgements. diff --git a/plugins/agent-collab/third-party-licenses/Hedley-CC0-1.0.txt b/plugins/agent-collab/third-party-licenses/Hedley-CC0-1.0.txt new file mode 100644 index 0000000..c35cb1b --- /dev/null +++ b/plugins/agent-collab/third-party-licenses/Hedley-CC0-1.0.txt @@ -0,0 +1,9 @@ +Hedley v14 — https://nemequ.github.io/hedley +Created by Evan Nemerson + +To the extent possible under law, the author(s) have dedicated all copyright +and related and neighboring rights to this software to the public domain +worldwide. This software is distributed without any warranty. + +For details, see https://creativecommons.org/publicdomain/zero/1.0/. +SPDX-License-Identifier: CC0-1.0 diff --git a/plugins/agent-collab/third-party-licenses/Nuitka-4.1.3-LICENSE-RUNTIME.txt b/plugins/agent-collab/third-party-licenses/Nuitka-4.1.3-LICENSE-RUNTIME.txt new file mode 100644 index 0000000..a6b4479 --- /dev/null +++ b/plugins/agent-collab/third-party-licenses/Nuitka-4.1.3-LICENSE-RUNTIME.txt @@ -0,0 +1,57 @@ +Nuitka Runtime Library Exception + +Version 1.0 + +This Nuitka Runtime Library Exception ("Exception") is an additional permission +under section 7 of the GNU Affero General Public License, version 3 ("AGPLv3"). +It applies to a given file (the "File") that bears a notice placed by the +copyright holder of the file stating that the file is governed by AGPLv3 along +with this Exception. + +The purpose of this Exception is to allow the compilation of non-AGPL (including +proprietary) Python programs to use, in this way, the header files and runtime +libraries covered by this Exception, without the requirement that the resulting +executable or library be licensed under the AGPLv3. + +0. Definitions + +"Runtime Library" means the Nuitka static C code, header files, and helper +functions that are intended to be linked or included into the code generated by +Nuitka. + +"Independent Module" means a module which is not derived from or based on the +Runtime Library. Usage of the Runtime Library interface (macros, function +signatures, data structures) for the purpose of valid compilation/linking does +not make a module "derived from" the Runtime Library for the purposes of this +definition. + +"Target Code" means an executable or library created by the Compilation Process. + +"Compilation Process" means the process of transforming Python source code (or +other input accepted by Nuitka) into C source code using Nuitka, and +subsequently compiling and linking that C source code with the Runtime Library +to produce Target Code. + +1. Grant of Additional Permission + +You have permission to propagate a work of Target Code formed by combining the +Runtime Library with Independent Modules, even if such propagation would +otherwise violate the terms of AGPLv3, provided that all Independent Modules are +combined with the Runtime Library through the Compilation Process. You may then +convey such a combination under terms of your choice. + +2. No Weakening of Nuitka Copyleft + +The availability of this Exception does not imply any general exception to the +third-party beneficiary rights or other terms of the AGPLv3 for the Nuitka +compiler itself (typically `nuitka` package logic), nor does it apply to the +Compilation Process itself (i.e., you cannot distribute a modified version of +the Nuitka compiler under proprietary terms). This Exception only applies to the +*output* of the Compilation Process (the Target Code) that links against the +Runtime Library. + +3. Intention + +This exception is intended to allow the creation of closed-source Python +applications that use Nuitka, but it does prevent the creation of closed-source +Nuitka itself except by the source code owner. diff --git a/plugins/agent-collab/third-party-licenses/Nuitka-4.1.3-LICENSE.txt b/plugins/agent-collab/third-party-licenses/Nuitka-4.1.3-LICENSE.txt new file mode 100644 index 0000000..be3f7b2 --- /dev/null +++ b/plugins/agent-collab/third-party-licenses/Nuitka-4.1.3-LICENSE.txt @@ -0,0 +1,661 @@ + GNU AFFERO GENERAL PUBLIC LICENSE + Version 3, 19 November 2007 + + Copyright (C) 2007 Free Software Foundation, Inc. + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The GNU Affero General Public License is a free, copyleft license for +software and other kinds of works, specifically designed to ensure +cooperation with the community in the case of network server software. + + The licenses for most software and other practical works are designed +to take away your freedom to share and change the works. By contrast, +our General Public Licenses are intended to guarantee your freedom to +share and change all versions of a program--to make sure it remains free +software for all its users. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +them if you wish), that you receive source code or can get it if you +want it, that you can change the software or use pieces of it in new +free programs, and that you know you can do these things. + + Developers that use our General Public Licenses protect your rights +with two steps: (1) assert copyright on the software, and (2) offer +you this License which gives you legal permission to copy, distribute +and/or modify the software. + + A secondary benefit of defending all users' freedom is that +improvements made in alternate versions of the program, if they +receive widespread use, become available for other developers to +incorporate. Many developers of free software are heartened and +encouraged by the resulting cooperation. However, in the case of +software used on network servers, this result may fail to come about. +The GNU General Public License permits making a modified version and +letting the public access it on a server without ever releasing its +source code to the public. + + The GNU Affero General Public License is designed specifically to +ensure that, in such cases, the modified source code becomes available +to the community. It requires the operator of a network server to +provide the source code of the modified version running there to the +users of that server. Therefore, public use of a modified version, on +a publicly accessible server, gives the public access to the source +code of the modified version. + + An older license, called the Affero General Public License and +published by Affero, was designed to accomplish similar goals. This is +a different license, not a version of the Affero GPL, but Affero has +released a new version of the Affero GPL which permits relicensing under +this license. + + The precise terms and conditions for copying, distribution and +modification follow. + + TERMS AND CONDITIONS + + 0. Definitions. + + "This License" refers to version 3 of the GNU Affero General Public License. + + "Copyright" also means copyright-like laws that apply to other kinds of +works, such as semiconductor masks. + + "The Program" refers to any copyrightable work licensed under this +License. Each licensee is addressed as "you". "Licensees" and +"recipients" may be individuals or organizations. + + To "modify" a work means to copy from or adapt all or part of the work +in a fashion requiring copyright permission, other than the making of an +exact copy. The resulting work is called a "modified version" of the +earlier work or a work "based on" the earlier work. + + A "covered work" means either the unmodified Program or a work based +on the Program. + + To "propagate" a work means to do anything with it that, without +permission, would make you directly or secondarily liable for +infringement under applicable copyright law, except executing it on a +computer or modifying a private copy. Propagation includes copying, +distribution (with or without modification), making available to the +public, and in some countries other activities as well. + + To "convey" a work means any kind of propagation that enables other +parties to make or receive copies. Mere interaction with a user through +a computer network, with no transfer of a copy, is not conveying. + + An interactive user interface displays "Appropriate Legal Notices" +to the extent that it includes a convenient and prominently visible +feature that (1) displays an appropriate copyright notice, and (2) +tells the user that there is no warranty for the work (except to the +extent that warranties are provided), that licensees may convey the +work under this License, and how to view a copy of this License. If +the interface presents a list of user commands or options, such as a +menu, a prominent item in the list meets this criterion. + + 1. Source Code. + + The "source code" for a work means the preferred form of the work +for making modifications to it. "Object code" means any non-source +form of a work. + + A "Standard Interface" means an interface that either is an official +standard defined by a recognized standards body, or, in the case of +interfaces specified for a particular programming language, one that +is widely used among developers working in that language. + + The "System Libraries" of an executable work include anything, other +than the work as a whole, that (a) is included in the normal form of +packaging a Major Component, but which is not part of that Major +Component, and (b) serves only to enable use of the work with that +Major Component, or to implement a Standard Interface for which an +implementation is available to the public in source code form. A +"Major Component", in this context, means a major essential component +(kernel, window system, and so on) of the specific operating system +(if any) on which the executable work runs, or a compiler used to +produce the work, or an object code interpreter used to run it. + + The "Corresponding Source" for a work in object code form means all +the source code needed to generate, install, and (for an executable +work) run the object code and to modify the work, including scripts to +control those activities. However, it does not include the work's +System Libraries, or general-purpose tools or generally available free +programs which are used unmodified in performing those activities but +which are not part of the work. For example, Corresponding Source +includes interface definition files associated with source files for +the work, and the source code for shared libraries and dynamically +linked subprograms that the work is specifically designed to require, +such as by intimate data communication or control flow between those +subprograms and other parts of the work. + + The Corresponding Source need not include anything that users +can regenerate automatically from other parts of the Corresponding +Source. + + The Corresponding Source for a work in source code form is that +same work. + + 2. Basic Permissions. + + All rights granted under this License are granted for the term of +copyright on the Program, and are irrevocable provided the stated +conditions are met. This License explicitly affirms your unlimited +permission to run the unmodified Program. The output from running a +covered work is covered by this License only if the output, given its +content, constitutes a covered work. This License acknowledges your +rights of fair use or other equivalent, as provided by copyright law. + + You may make, run and propagate covered works that you do not +convey, without conditions so long as your license otherwise remains +in force. You may convey covered works to others for the sole purpose +of having them make modifications exclusively for you, or provide you +with facilities for running those works, provided that you comply with +the terms of this License in conveying all material for which you do +not control copyright. Those thus making or running the covered works +for you must do so exclusively on your behalf, under your direction +and control, on terms that prohibit them from making any copies of +your copyrighted material outside their relationship with you. + + Conveying under any other circumstances is permitted solely under +the conditions stated below. Sublicensing is not allowed; section 10 +makes it unnecessary. + + 3. Protecting Users' Legal Rights From Anti-Circumvention Law. + + No covered work shall be deemed part of an effective technological +measure under any applicable law fulfilling obligations under article +11 of the WIPO copyright treaty adopted on 20 December 1996, or +similar laws prohibiting or restricting circumvention of such +measures. + + When you convey a covered work, you waive any legal power to forbid +circumvention of technological measures to the extent such circumvention +is effected by exercising rights under this License with respect to +the covered work, and you disclaim any intention to limit operation or +modification of the work as a means of enforcing, against the work's +users, your or third parties' legal rights to forbid circumvention of +technological measures. + + 4. Conveying Verbatim Copies. + + You may convey verbatim copies of the Program's source code as you +receive it, in any medium, provided that you conspicuously and +appropriately publish on each copy an appropriate copyright notice; +keep intact all notices stating that this License and any +non-permissive terms added in accord with section 7 apply to the code; +keep intact all notices of the absence of any warranty; and give all +recipients a copy of this License along with the Program. + + You may charge any price or no price for each copy that you convey, +and you may offer support or warranty protection for a fee. + + 5. Conveying Modified Source Versions. + + You may convey a work based on the Program, or the modifications to +produce it from the Program, in the form of source code under the +terms of section 4, provided that you also meet all of these conditions: + + a) The work must carry prominent notices stating that you modified + it, and giving a relevant date. + + b) The work must carry prominent notices stating that it is + released under this License and any conditions added under section + 7. This requirement modifies the requirement in section 4 to + "keep intact all notices". + + c) You must license the entire work, as a whole, under this + License to anyone who comes into possession of a copy. This + License will therefore apply, along with any applicable section 7 + additional terms, to the whole of the work, and all its parts, + regardless of how they are packaged. This License gives no + permission to license the work in any other way, but it does not + invalidate such permission if you have separately received it. + + d) If the work has interactive user interfaces, each must display + Appropriate Legal Notices; however, if the Program has interactive + interfaces that do not display Appropriate Legal Notices, your + work need not make them do so. + + A compilation of a covered work with other separate and independent +works, which are not by their nature extensions of the covered work, +and which are not combined with it such as to form a larger program, +in or on a volume of a storage or distribution medium, is called an +"aggregate" if the compilation and its resulting copyright are not +used to limit the access or legal rights of the compilation's users +beyond what the individual works permit. Inclusion of a covered work +in an aggregate does not cause this License to apply to the other +parts of the aggregate. + + 6. Conveying Non-Source Forms. + + You may convey a covered work in object code form under the terms +of sections 4 and 5, provided that you also convey the +machine-readable Corresponding Source under the terms of this License, +in one of these ways: + + a) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by the + Corresponding Source fixed on a durable physical medium + customarily used for software interchange. + + b) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by a + written offer, valid for at least three years and valid for as + long as you offer spare parts or customer support for that product + model, to give anyone who possesses the object code either (1) a + copy of the Corresponding Source for all the software in the + product that is covered by this License, on a durable physical + medium customarily used for software interchange, for a price no + more than your reasonable cost of physically performing this + conveying of source, or (2) access to copy the + Corresponding Source from a network server at no charge. + + c) Convey individual copies of the object code with a copy of the + written offer to provide the Corresponding Source. This + alternative is allowed only occasionally and noncommercially, and + only if you received the object code with such an offer, in accord + with subsection 6b. + + d) Convey the object code by offering access from a designated + place (gratis or for a charge), and offer equivalent access to the + Corresponding Source in the same way through the same place at no + further charge. You need not require recipients to copy the + Corresponding Source along with the object code. If the place to + copy the object code is a network server, the Corresponding Source + may be on a different server (operated by you or a third party) + that supports equivalent copying facilities, provided you maintain + clear directions next to the object code saying where to find the + Corresponding Source. Regardless of what server hosts the + Corresponding Source, you remain obligated to ensure that it is + available for as long as needed to satisfy these requirements. + + e) Convey the object code using peer-to-peer transmission, provided + you inform other peers where the object code and Corresponding + Source of the work are being offered to the general public at no + charge under subsection 6d. + + A separable portion of the object code, whose source code is excluded +from the Corresponding Source as a System Library, need not be +included in conveying the object code work. + + A "User Product" is either (1) a "consumer product", which means any +tangible personal property which is normally used for personal, family, +or household purposes, or (2) anything designed or sold for incorporation +into a dwelling. In determining whether a product is a consumer product, +doubtful cases shall be resolved in favor of coverage. For a particular +product received by a particular user, "normally used" refers to a +typical or common use of that class of product, regardless of the status +of the particular user or of the way in which the particular user +actually uses, or expects or is expected to use, the product. A product +is a consumer product regardless of whether the product has substantial +commercial, industrial or non-consumer uses, unless such uses represent +the only significant mode of use of the product. + + "Installation Information" for a User Product means any methods, +procedures, authorization keys, or other information required to install +and execute modified versions of a covered work in that User Product from +a modified version of its Corresponding Source. The information must +suffice to ensure that the continued functioning of the modified object +code is in no case prevented or interfered with solely because +modification has been made. + + If you convey an object code work under this section in, or with, or +specifically for use in, a User Product, and the conveying occurs as +part of a transaction in which the right of possession and use of the +User Product is transferred to the recipient in perpetuity or for a +fixed term (regardless of how the transaction is characterized), the +Corresponding Source conveyed under this section must be accompanied +by the Installation Information. But this requirement does not apply +if neither you nor any third party retains the ability to install +modified object code on the User Product (for example, the work has +been installed in ROM). + + The requirement to provide Installation Information does not include a +requirement to continue to provide support service, warranty, or updates +for a work that has been modified or installed by the recipient, or for +the User Product in which it has been modified or installed. Access to a +network may be denied when the modification itself materially and +adversely affects the operation of the network or violates the rules and +protocols for communication across the network. + + Corresponding Source conveyed, and Installation Information provided, +in accord with this section must be in a format that is publicly +documented (and with an implementation available to the public in +source code form), and must require no special password or key for +unpacking, reading or copying. + + 7. Additional Terms. + + "Additional permissions" are terms that supplement the terms of this +License by making exceptions from one or more of its conditions. +Additional permissions that are applicable to the entire Program shall +be treated as though they were included in this License, to the extent +that they are valid under applicable law. If additional permissions +apply only to part of the Program, that part may be used separately +under those permissions, but the entire Program remains governed by +this License without regard to the additional permissions. + + When you convey a copy of a covered work, you may at your option +remove any additional permissions from that copy, or from any part of +it. (Additional permissions may be written to require their own +removal in certain cases when you modify the work.) You may place +additional permissions on material, added by you to a covered work, +for which you have or can give appropriate copyright permission. + + Notwithstanding any other provision of this License, for material you +add to a covered work, you may (if authorized by the copyright holders of +that material) supplement the terms of this License with terms: + + a) Disclaiming warranty or limiting liability differently from the + terms of sections 15 and 16 of this License; or + + b) Requiring preservation of specified reasonable legal notices or + author attributions in that material or in the Appropriate Legal + Notices displayed by works containing it; or + + c) Prohibiting misrepresentation of the origin of that material, or + requiring that modified versions of such material be marked in + reasonable ways as different from the original version; or + + d) Limiting the use for publicity purposes of names of licensors or + authors of the material; or + + e) Declining to grant rights under trademark law for use of some + trade names, trademarks, or service marks; or + + f) Requiring indemnification of licensors and authors of that + material by anyone who conveys the material (or modified versions of + it) with contractual assumptions of liability to the recipient, for + any liability that these contractual assumptions directly impose on + those licensors and authors. + + All other non-permissive additional terms are considered "further +restrictions" within the meaning of section 10. If the Program as you +received it, or any part of it, contains a notice stating that it is +governed by this License along with a term that is a further +restriction, you may remove that term. If a license document contains +a further restriction but permits relicensing or conveying under this +License, you may add to a covered work material governed by the terms +of that license document, provided that the further restriction does +not survive such relicensing or conveying. + + If you add terms to a covered work in accord with this section, you +must place, in the relevant source files, a statement of the +additional terms that apply to those files, or a notice indicating +where to find the applicable terms. + + Additional terms, permissive or non-permissive, may be stated in the +form of a separately written license, or stated as exceptions; +the above requirements apply either way. + + 8. Termination. + + You may not propagate or modify a covered work except as expressly +provided under this License. Any attempt otherwise to propagate or +modify it is void, and will automatically terminate your rights under +this License (including any patent licenses granted under the third +paragraph of section 11). + + However, if you cease all violation of this License, then your +license from a particular copyright holder is reinstated (a) +provisionally, unless and until the copyright holder explicitly and +finally terminates your license, and (b) permanently, if the copyright +holder fails to notify you of the violation by some reasonable means +prior to 60 days after the cessation. + + Moreover, your license from a particular copyright holder is +reinstated permanently if the copyright holder notifies you of the +violation by some reasonable means, this is the first time you have +received notice of violation of this License (for any work) from that +copyright holder, and you cure the violation prior to 30 days after +your receipt of the notice. + + Termination of your rights under this section does not terminate the +licenses of parties who have received copies or rights from you under +this License. If your rights have been terminated and not permanently +reinstated, you do not qualify to receive new licenses for the same +material under section 10. + + 9. Acceptance Not Required for Having Copies. + + You are not required to accept this License in order to receive or +run a copy of the Program. Ancillary propagation of a covered work +occurring solely as a consequence of using peer-to-peer transmission +to receive a copy likewise does not require acceptance. However, +nothing other than this License grants you permission to propagate or +modify any covered work. These actions infringe copyright if you do +not accept this License. Therefore, by modifying or propagating a +covered work, you indicate your acceptance of this License to do so. + + 10. Automatic Licensing of Downstream Recipients. + + Each time you convey a covered work, the recipient automatically +receives a license from the original licensors, to run, modify and +propagate that work, subject to this License. You are not responsible +for enforcing compliance by third parties with this License. + + An "entity transaction" is a transaction transferring control of an +organization, or substantially all assets of one, or subdividing an +organization, or merging organizations. If propagation of a covered +work results from an entity transaction, each party to that +transaction who receives a copy of the work also receives whatever +licenses to the work the party's predecessor in interest had or could +give under the previous paragraph, plus a right to possession of the +Corresponding Source of the work from the predecessor in interest, if +the predecessor has it or can get it with reasonable efforts. + + You may not impose any further restrictions on the exercise of the +rights granted or affirmed under this License. For example, you may +not impose a license fee, royalty, or other charge for exercise of +rights granted under this License, and you may not initiate litigation +(including a cross-claim or counterclaim in a lawsuit) alleging that +any patent claim is infringed by making, using, selling, offering for +sale, or importing the Program or any portion of it. + + 11. Patents. + + A "contributor" is a copyright holder who authorizes use under this +License of the Program or a work on which the Program is based. The +work thus licensed is called the contributor's "contributor version". + + A contributor's "essential patent claims" are all patent claims +owned or controlled by the contributor, whether already acquired or +hereafter acquired, that would be infringed by some manner, permitted +by this License, of making, using, or selling its contributor version, +but do not include claims that would be infringed only as a +consequence of further modification of the contributor version. For +purposes of this definition, "control" includes the right to grant +patent sublicenses in a manner consistent with the requirements of +this License. + + Each contributor grants you a non-exclusive, worldwide, royalty-free +patent license under the contributor's essential patent claims, to +make, use, sell, offer for sale, import and otherwise run, modify and +propagate the contents of its contributor version. + + In the following three paragraphs, a "patent license" is any express +agreement or commitment, however denominated, not to enforce a patent +(such as an express permission to practice a patent or covenant not to +sue for patent infringement). To "grant" such a patent license to a +party means to make such an agreement or commitment not to enforce a +patent against the party. + + If you convey a covered work, knowingly relying on a patent license, +and the Corresponding Source of the work is not available for anyone +to copy, free of charge and under the terms of this License, through a +publicly available network server or other readily accessible means, +then you must either (1) cause the Corresponding Source to be so +available, or (2) arrange to deprive yourself of the benefit of the +patent license for this particular work, or (3) arrange, in a manner +consistent with the requirements of this License, to extend the patent +license to downstream recipients. "Knowingly relying" means you have +actual knowledge that, but for the patent license, your conveying the +covered work in a country, or your recipient's use of the covered work +in a country, would infringe one or more identifiable patents in that +country that you have reason to believe are valid. + + If, pursuant to or in connection with a single transaction or +arrangement, you convey, or propagate by procuring conveyance of, a +covered work, and grant a patent license to some of the parties +receiving the covered work authorizing them to use, propagate, modify +or convey a specific copy of the covered work, then the patent license +you grant is automatically extended to all recipients of the covered +work and works based on it. + + A patent license is "discriminatory" if it does not include within +the scope of its coverage, prohibits the exercise of, or is +conditioned on the non-exercise of one or more of the rights that are +specifically granted under this License. You may not convey a covered +work if you are a party to an arrangement with a third party that is +in the business of distributing software, under which you make payment +to the third party based on the extent of your activity of conveying +the work, and under which the third party grants, to any of the +parties who would receive the covered work from you, a discriminatory +patent license (a) in connection with copies of the covered work +conveyed by you (or copies made from those copies), or (b) primarily +for and in connection with specific products or compilations that +contain the covered work, unless you entered into that arrangement, +or that patent license was granted, prior to 28 March 2007. + + Nothing in this License shall be construed as excluding or limiting +any implied license or other defenses to infringement that may +otherwise be available to you under applicable patent law. + + 12. No Surrender of Others' Freedom. + + If conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot convey a +covered work so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you may +not convey it at all. For example, if you agree to terms that obligate you +to collect a royalty for further conveying from those to whom you convey +the Program, the only way you could satisfy both those terms and this +License would be to refrain entirely from conveying the Program. + + 13. Remote Network Interaction; Use with the GNU General Public License. + + Notwithstanding any other provision of this License, if you modify the +Program, your modified version must prominently offer all users +interacting with it remotely through a computer network (if your version +supports such interaction) an opportunity to receive the Corresponding +Source of your version by providing access to the Corresponding Source +from a network server at no charge, through some standard or customary +means of facilitating copying of software. This Corresponding Source +shall include the Corresponding Source for any work covered by version 3 +of the GNU General Public License that is incorporated pursuant to the +following paragraph. + + Notwithstanding any other provision of this License, you have +permission to link or combine any covered work with a work licensed +under version 3 of the GNU General Public License into a single +combined work, and to convey the resulting work. The terms of this +License will continue to apply to the part which is the covered work, +but the work with which it is combined will remain governed by version +3 of the GNU General Public License. + + 14. Revised Versions of this License. + + The Free Software Foundation may publish revised and/or new versions of +the GNU Affero General Public License from time to time. Such new versions +will be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + + Each version is given a distinguishing version number. If the +Program specifies that a certain numbered version of the GNU Affero General +Public License "or any later version" applies to it, you have the +option of following the terms and conditions either of that numbered +version or of any later version published by the Free Software +Foundation. If the Program does not specify a version number of the +GNU Affero General Public License, you may choose any version ever published +by the Free Software Foundation. + + If the Program specifies that a proxy can decide which future +versions of the GNU Affero General Public License can be used, that proxy's +public statement of acceptance of a version permanently authorizes you +to choose that version for the Program. + + Later license versions may give you additional or different +permissions. However, no additional obligations are imposed on any +author or copyright holder as a result of your choosing to follow a +later version. + + 15. Disclaimer of Warranty. + + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY +APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT +HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY +OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, +THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM +IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF +ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. Limitation of Liability. + + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS +THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY +GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE +USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF +DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD +PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), +EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF +SUCH DAMAGES. + + 17. Interpretation of Sections 15 and 16. + + If the disclaimer of warranty and limitation of liability provided +above cannot be given local legal effect according to their terms, +reviewing courts shall apply local law that most closely approximates +an absolute waiver of all civil liability in connection with the +Program, unless a warranty or assumption of liability accompanies a +copy of the Program in return for a fee. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +state the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU Affero General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU Affero General Public License for more details. + + You should have received a copy of the GNU Affero General Public License + along with this program. If not, see . + +Also add information on how to contact you by electronic and paper mail. + + If your software can interact with users remotely through a computer +network, you should also make sure that it provides a way for users to +get its source. For example, if your program is a web application, its +interface could display a "Source" link that leads users to an archive +of the code. There are many ways you could offer source, and different +solutions will be better for different programs; see section 13 for the +specific requirements. + + You should also get your employer (if you work as a programmer) or school, +if any, to sign a "copyright disclaimer" for the program, if necessary. +For more information on this, and how to apply and follow the GNU AGPL, see +. diff --git a/plugins/agent-collab/third-party-licenses/Nuitka-4.1.3-NOTICE.txt b/plugins/agent-collab/third-party-licenses/Nuitka-4.1.3-NOTICE.txt new file mode 100644 index 0000000..e2a3373 --- /dev/null +++ b/plugins/agent-collab/third-party-licenses/Nuitka-4.1.3-NOTICE.txt @@ -0,0 +1,11 @@ +Nuitka +====== + +Nuitka is a Python compiler developed by Kay Hayen. + +Copyright (c) 2008-2026 Kay Hayen +All rights reserved. + +Other individuals contributed to the development of Nuitka under +Apache License 2.0, but this has since been relicensed under +AGPLv3 and proprietary licenses. diff --git a/plugins/agent-collab/third-party-licenses/libb2-CC0-1.0.txt b/plugins/agent-collab/third-party-licenses/libb2-CC0-1.0.txt new file mode 100644 index 0000000..a2224fd --- /dev/null +++ b/plugins/agent-collab/third-party-licenses/libb2-CC0-1.0.txt @@ -0,0 +1,13 @@ +BLAKE2 reference source code package — optimized C implementations + +Written in 2012 by Samuel Neves + +To the extent possible under law, the author(s) have dedicated all copyright +and related and neighboring rights to this software to the public domain +worldwide. This software is distributed without any warranty. + +You should have received a copy of the CC0 Public Domain Dedication along with +this software. If not, see +https://creativecommons.org/publicdomain/zero/1.0/. + +SPDX-License-Identifier: CC0-1.0 diff --git a/plugins/agent-collab/third-party-licenses/mimalloc-LICENSE.txt b/plugins/agent-collab/third-party-licenses/mimalloc-LICENSE.txt new file mode 100644 index 0000000..670b668 --- /dev/null +++ b/plugins/agent-collab/third-party-licenses/mimalloc-LICENSE.txt @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2018-2021 Microsoft Corporation, Daan Leijen + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/plugins/agent-collab/third-party-licenses/mpdecimal-NOTICE.txt b/plugins/agent-collab/third-party-licenses/mpdecimal-NOTICE.txt new file mode 100644 index 0000000..2f5dc7a --- /dev/null +++ b/plugins/agent-collab/third-party-licenses/mpdecimal-NOTICE.txt @@ -0,0 +1,22 @@ +Copyright (c) 2008-2020 Stefan Krah. All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are met: + +1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + +2. Redistributions in binary form must reproduce the above copyright notice, + this list of conditions and the following disclaimer in the documentation + and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS" AND ANY +EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED +WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY +DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES +(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; +LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON +ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS +SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/scripts/build_plugin_archive.py b/scripts/build_plugin_archive.py index 37869bd..5aa1952 100644 --- a/scripts/build_plugin_archive.py +++ b/scripts/build_plugin_archive.py @@ -26,6 +26,65 @@ MAX_ARTIFACT_BYTES = 64 * 1024 * 1024 RUNTIME_REL = Path("runtime/darwin-arm64/agent-collab-runtime") RUNTIME_FILE_MODE = 0o755 +THIRD_PARTY_NOTICE_REL = Path("THIRD-PARTY-NOTICES.txt") +THIRD_PARTY_LICENSE_ROOT_REL = Path("third-party-licenses") +THIRD_PARTY_LICENSE_FILES = ( + "CPython-3.13.14-LICENSE.txt", + "CPython-3.13.14-NOTICES.txt", + "Expat-COPYING.txt", + "HACL-LICENSE.txt", + "Hedley-CC0-1.0.txt", + "libb2-CC0-1.0.txt", + "Nuitka-4.1.3-LICENSE-RUNTIME.txt", + "Nuitka-4.1.3-LICENSE.txt", + "Nuitka-4.1.3-NOTICE.txt", + "mimalloc-LICENSE.txt", + "mpdecimal-NOTICE.txt", +) +ACTIVATION_THIRD_PARTY_MEMBERS = ( + THIRD_PARTY_NOTICE_REL, + THIRD_PARTY_LICENSE_ROOT_REL, + *( + THIRD_PARTY_LICENSE_ROOT_REL / name + for name in THIRD_PARTY_LICENSE_FILES + ), +) +ACTIVATION_THIRD_PARTY_SHA256 = { + THIRD_PARTY_NOTICE_REL: "a80219a110e7e510724e41c781cc6f40c3b36378ff409ef1dc822e70bf38ed45", + THIRD_PARTY_LICENSE_ROOT_REL / "CPython-3.13.14-LICENSE.txt": ( + "78b12c3a81360b357002334f0e70ea0e92eebf7a9b358805c03c48484945f3bb" + ), + THIRD_PARTY_LICENSE_ROOT_REL / "CPython-3.13.14-NOTICES.txt": ( + "62f2c9c2c75d511170eb464ad5f83b78cc1f37eb2eb49c2846c9aa6c4557ee99" + ), + THIRD_PARTY_LICENSE_ROOT_REL / "Expat-COPYING.txt": ( + "31b15de82aa19a845156169a17a5488bf597e561b2c318d159ed583139b25e87" + ), + THIRD_PARTY_LICENSE_ROOT_REL / "HACL-LICENSE.txt": ( + "2e04f9bb6a71ee97c24dba3c1cba0931cdfd4f95805f6c3fdf25ea82cad2c21c" + ), + THIRD_PARTY_LICENSE_ROOT_REL / "Hedley-CC0-1.0.txt": ( + "a77ea9231d94a8c8764ad6f41822f6b40a9c19f96dd7e36cda0c99070f9bd194" + ), + THIRD_PARTY_LICENSE_ROOT_REL / "libb2-CC0-1.0.txt": ( + "8b94ead716c73ba84f9f90cae9a6c8ff0505457a8c5586226947ee4e070df9b4" + ), + THIRD_PARTY_LICENSE_ROOT_REL / "Nuitka-4.1.3-LICENSE-RUNTIME.txt": ( + "20ff0ae581adf436a7b06e50e67a6c8913aec1ea4e60dba138d0a0bee7ee520c" + ), + THIRD_PARTY_LICENSE_ROOT_REL / "Nuitka-4.1.3-LICENSE.txt": ( + "0d96a4ff68ad6d4b6f1f30f713b18d5184912ba8dd389f86aa7710db079abcb0" + ), + THIRD_PARTY_LICENSE_ROOT_REL / "Nuitka-4.1.3-NOTICE.txt": ( + "b6ba5212864ec9f98842220e01b2485a2ebeb8eafa192b016b36032355c8a98d" + ), + THIRD_PARTY_LICENSE_ROOT_REL / "mimalloc-LICENSE.txt": ( + "19c99805e7a44a34b297a75d1edea9985e300066dfc024d5c99d4236d4573b5d" + ), + THIRD_PARTY_LICENSE_ROOT_REL / "mpdecimal-NOTICE.txt": ( + "e0ec71a76cdfcfc6d74f5ec78915a7f932f5c42d9b3b4f3d292b7eda5107edae" + ), +} REQUIRED_ROOTS = ( ".claude-plugin", ".codex-plugin", @@ -227,6 +286,49 @@ def _require_exact_manifest_trees(plugin_path: Path) -> None: raise ValueError("manifest tree is not canonical") +def _require_exact_third_party_notice_tree(plugin_path: Path) -> None: + try: + notice_info = _safe_source(plugin_path / THIRD_PARTY_NOTICE_REL) + root = plugin_path / THIRD_PARTY_LICENSE_ROOT_REL + root_info = _safe_source(root) + except ValueError as exc: + raise ValueError( + "activation third-party notice tree is missing or unsafe" + ) from exc + if ( + not stat.S_ISREG(notice_info.st_mode) + or notice_info.st_nlink != 1 + or not stat.S_ISDIR(root_info.st_mode) + ): + raise ValueError("activation third-party notice tree is not canonical") + if _sha256(plugin_path / THIRD_PARTY_NOTICE_REL) != ACTIVATION_THIRD_PARTY_SHA256[ + THIRD_PARTY_NOTICE_REL + ]: + raise ValueError("activation third-party notice content digest is invalid") + + expected = {Path(name) for name in THIRD_PARTY_LICENSE_FILES} + try: + observed = {path.relative_to(root) for path in root.rglob("*")} + except OSError as exc: + raise ValueError("activation third-party notice tree is unreadable") from exc + if observed != expected: + raise ValueError("activation third-party notice tree is not canonical") + for relative in sorted(expected): + try: + info = _safe_source(root / relative) + except ValueError as exc: + raise ValueError( + "activation third-party notice tree contains an unsafe member" + ) from exc + if not stat.S_ISREG(info.st_mode) or info.st_nlink != 1: + raise ValueError( + "activation third-party notice tree contains an unsafe member" + ) + member = THIRD_PARTY_LICENSE_ROOT_REL / relative + if _sha256(root / relative) != ACTIVATION_THIRD_PARTY_SHA256.get(member): + raise ValueError("activation third-party notice content digest is invalid") + + def _member_paths(plugin_path: Path, *, mode: str) -> list[Path]: if mode not in {"policy-only", "activation"}: raise ValueError("unknown archive mode") @@ -241,7 +343,15 @@ def _member_paths(plugin_path: Path, *, mode: str) -> list[Path]: *(Path("skills") / relative for relative in expected_skill_relpaths(SPECS_DIR)), ] if mode == "activation": - relatives.extend((Path("runtime"), Path("runtime/darwin-arm64"), RUNTIME_REL)) + _require_exact_third_party_notice_tree(plugin_path) + relatives.extend( + ( + Path("runtime"), + Path("runtime/darwin-arm64"), + RUNTIME_REL, + *ACTIVATION_THIRD_PARTY_MEMBERS, + ) + ) members: dict[str, Path] = {} for relative in relatives: source = plugin_path / relative diff --git a/scripts/build_release_evidence.py b/scripts/build_release_evidence.py index ec10bde..27859e2 100644 --- a/scripts/build_release_evidence.py +++ b/scripts/build_release_evidence.py @@ -196,6 +196,128 @@ def _manifest(files: dict[str, bytes], path: str) -> dict[str, object]: return parsed +def _file_license(name: str, *, mode: str) -> str: + if mode == "activation" and ( + name == archive_builder.RUNTIME_REL.as_posix() + or name == archive_builder.THIRD_PARTY_NOTICE_REL.as_posix() + or name.startswith( + archive_builder.THIRD_PARTY_LICENSE_ROOT_REL.as_posix() + "/" + ) + ): + return "NOASSERTION" + return SPDX_LICENSE + + +def _activation_component_packages() -> list[dict[str, object]]: + return [ + { + "SPDXID": "SPDXRef-Package-CPython", + "name": "CPython", + "versionInfo": "3.13.14", + "downloadLocation": ( + "https://www.python.org/ftp/python/3.13.14/Python-3.13.14.tgz" + ), + "filesAnalyzed": False, + "licenseConcluded": "Python-2.0", + "licenseDeclared": "Python-2.0", + "copyrightText": "NOASSERTION", + "supplier": "Organization: Python Software Foundation", + }, + { + "SPDXID": "SPDXRef-Package-Nuitka", + "name": "Nuitka", + "versionInfo": "4.1.3", + "downloadLocation": "https://github.com/Nuitka/Nuitka/tree/4.1.3", + "filesAnalyzed": False, + "licenseConcluded": "NOASSERTION", + "licenseDeclared": "NOASSERTION", + "copyrightText": "NOASSERTION", + "supplier": "Person: Kay Hayen", + }, + { + "SPDXID": "SPDXRef-Package-expat", + "name": "expat", + "versionInfo": "2.8.1", + "downloadLocation": ( + "https://github.com/libexpat/libexpat/releases/download/" + "R_2_8_1/expat-2.8.1.tar.gz" + ), + "filesAnalyzed": False, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "NOASSERTION", + "supplier": "NOASSERTION", + }, + { + "SPDXID": "SPDXRef-Package-hacl-star", + "name": "hacl-star", + "versionInfo": "bb3d0dc8d9d15a5cd51094d5b69e70aa09005ff0", + "downloadLocation": ( + "https://github.com/hacl-star/hacl-star/archive/" + "bb3d0dc8d9d15a5cd51094d5b69e70aa09005ff0.zip" + ), + "filesAnalyzed": False, + "licenseConcluded": "MIT AND Apache-2.0", + "licenseDeclared": "MIT AND Apache-2.0", + "copyrightText": "NOASSERTION", + "supplier": "NOASSERTION", + }, + { + "SPDXID": "SPDXRef-Package-libb2", + "name": "libb2", + "versionInfo": "0.98.1", + "downloadLocation": ( + "https://github.com/BLAKE2/libb2/releases/download/" + "v0.98.1/libb2-0.98.1.tar.gz" + ), + "filesAnalyzed": False, + "licenseConcluded": "CC0-1.0", + "licenseDeclared": "CC0-1.0", + "copyrightText": "NOASSERTION", + "supplier": "NOASSERTION", + }, + { + "SPDXID": "SPDXRef-Package-mpdecimal", + "name": "mpdecimal", + "versionInfo": "2.5.1", + "downloadLocation": ( + "https://www.bytereef.org/software/mpdecimal/releases/" + "mpdecimal-2.5.1.tar.gz" + ), + "filesAnalyzed": False, + "licenseConcluded": "BSD-2-Clause", + "licenseDeclared": "BSD-2-Clause", + "copyrightText": "NOASSERTION", + "supplier": "Person: Stefan Krah", + }, + { + "SPDXID": "SPDXRef-Package-mimalloc", + "name": "mimalloc", + "versionInfo": "2.1.2", + "downloadLocation": ( + "https://github.com/microsoft/mimalloc/archive/refs/tags/" + "v2.1.2.tar.gz" + ), + "filesAnalyzed": False, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "NOASSERTION", + "supplier": "Organization: Microsoft Corporation", + }, + { + "SPDXID": "SPDXRef-Package-Hedley", + "name": "Hedley", + "versionInfo": "14", + "downloadLocation": "https://github.com/nemequ/hedley", + "filesAnalyzed": False, + "licenseConcluded": "CC0-1.0", + "licenseDeclared": "CC0-1.0", + "copyrightText": "NOASSERTION", + "supplier": "Person: Evan Nemerson", + }, + ] + + def build_evidence( archive: Path, *, @@ -274,7 +396,7 @@ def build_evidence( {"algorithm": "SHA1", "checksumValue": file_sha1}, {"algorithm": "SHA256", "checksumValue": _sha256_bytes(data)} ], - "licenseConcluded": SPDX_LICENSE, + "licenseConcluded": _file_license(name, mode=mode), "licenseInfoInFiles": ["NOASSERTION"], "copyrightText": "NOASSERTION", } @@ -286,6 +408,15 @@ def build_evidence( "relatedSpdxElement": spdx_id, } ) + if mode == "activation": + relationships.extend( + { + "spdxElementId": "SPDXRef-Package-agent-collab", + "relationshipType": "CONTAINS", + "relatedSpdxElement": component["SPDXID"], + } + for component in _activation_component_packages() + ) package_verification_code = hashlib.sha1( "".join(sorted(file_sha1s)).encode("ascii"), @@ -320,11 +451,14 @@ def build_evidence( "checksums": [ {"algorithm": "SHA256", "checksumValue": archive_digest} ], - "licenseConcluded": SPDX_LICENSE, + "licenseConcluded": ( + SPDX_LICENSE if mode == "policy-only" else "NOASSERTION" + ), "licenseDeclared": SPDX_LICENSE, "copyrightText": COPYRIGHT_TEXT, "supplier": "Person: John Osumi", - } + }, + *(_activation_component_packages() if mode == "activation" else []), ], "files": spdx_files, "relationships": relationships, diff --git a/scripts/check_release_consistency.py b/scripts/check_release_consistency.py index 6142aa9..b48a78d 100644 --- a/scripts/check_release_consistency.py +++ b/scripts/check_release_consistency.py @@ -254,19 +254,11 @@ def parse_tag_full(tag: str) -> tuple[str | None, str | None]: Accepts: - 'vX.Y.Z' -> (None, 'X.Y.Z') -- canonical default plugin (agent-collab; see PLUGIN constant) - - 'v--X.Y.Z' -> ('', 'X.Y.Z') + - 'v-agent-collab-X.Y.Z' -> ('agent-collab', 'X.Y.Z') - Returns (None, None) if the tag doesn't match either form (or is None / - empty / whitespace). - - The plugin_name slot lets `run_tag_check` validate a release tag against - the correct plugin's plugin.json (e.g., `v-agent-collab-1.0.0` against - plugins/agent-collab/.claude-plugin/plugin.json, not the canonical - agent-collab one). Prior to this split (Phase 1b release-tag follow-up, - 2026-05-25) the script hardcoded agent-collab as the source-of-truth, - which caused per-plugin release builds to FAIL by comparing the plugin's - version against agent-collab's plugin.json. (Historical: first surfaced - in the historical multi-package release flow.) + Returns (None, None) for every other package-qualified tag, including the + retired preset/provider aliases, or if the input is empty. This repository + has one package and no compatibility release surface. Regex robustness: the version sub-pattern is inlined (`(\\d+\\.\\d+\\.\\d+)`) rather than reusing the module-level `_SEMVER` constant. This decouples @@ -279,7 +271,7 @@ def parse_tag_full(tag: str) -> tuple[str | None, str | None]: tag = tag.strip() if not tag: return (None, None) - m = re.fullmatch(r"v-([a-z0-9-]+)-(\d+\.\d+\.\d+)", tag) + m = re.fullmatch(r"v-(agent-collab)-(\d+\.\d+\.\d+)", tag) if m: return (m.group(1), m.group(2)) m = re.fullmatch(r"v(\d+\.\d+\.\d+)", tag) @@ -640,21 +632,14 @@ def run_monotonicity(root: Path, ref: str, plugin: str | None = None) -> tuple[b def run_tag_check(root: Path, tag: str) -> tuple[bool, list[str]]: - """Validate a release tag against the named plugin's plugin.json. + """Validate a canonical release tag against agent-collab's plugin.json. Tag forms (parse_tag_full handles both): - 'vX.Y.Z' -> validates against the canonical plugin (the PLUGIN constant; currently `agent-collab`, the canonical-default for bare-version tags cut via `gh release create vX.Y.Z`). - - 'v--X.Y.Z' -> validates against - plugins//.claude-plugin/plugin.json - (where is any plugin in the marketplace). - - The plugin-name-in-tag dispatch (added 2026-05-25 Phase 1b release-tag - follow-up) is what makes per-plugin release builds work — without it, a - tag like `v-agent-collab-1.0.0` was checked against agent-collab's - plugin.json (currently 2.0.0) and always failed. + - 'v-agent-collab-X.Y.Z' -> validates against the same canonical plugin. Default-dispatch invariant: a bare `vX.Y.Z` tag must always validate against the canonical PLUGIN's plugin.json, preserving the pre-Phase-1b @@ -662,7 +647,10 @@ def run_tag_check(root: Path, tag: str) -> tuple[bool, list[str]]: """ plugin_in_tag, resolved = parse_tag_full(tag) if resolved is None: - return False, [f"FAIL tag '{tag}': not a release-tag form (vX.Y.Z or v--X.Y.Z)"] + return False, [ + f"FAIL tag '{tag}': not a canonical release-tag form " + "(vX.Y.Z or v-agent-collab-X.Y.Z)" + ] target_plugin = plugin_in_tag if plugin_in_tag else PLUGIN target_version = plugin_version(root, target_plugin) if not target_version: @@ -679,7 +667,7 @@ def run_tag_check(root: Path, tag: str) -> tuple[bool, list[str]]: def main(argv: list[str] | None = None) -> int: ap = argparse.ArgumentParser( - description="agent-collab release-version consistency check (canonical + deprecation aliases)") + description="agent-collab canonical release-version consistency check") ap.add_argument("--against-ref", metavar="REF", help="also assert plugin.json version >= REF's version") ap.add_argument("--tag", metavar="TAG", diff --git a/scripts/scaffold-skill-spec.py b/scripts/scaffold-skill-spec.py index c401bca..d1aac5d 100644 --- a/scripts/scaffold-skill-spec.py +++ b/scripts/scaffold-skill-spec.py @@ -35,7 +35,7 @@ - Verifier-independence block included by default for skills in the YES list per `_AUTHORING_BRIEF.md` § 10: second-opinion, debate, code-review, qa-verify, logic-check, - red-team, ai-merge-resolve + red-team, merge-resolve Omitted by default for skills in the explicit NO list: brainstorm, long-context, simulate-user, delegate, dev-delegate, chain, chain-configurator @@ -72,7 +72,7 @@ "qa-verify", "logic-check", "red-team", - "ai-merge-resolve", + "merge-resolve", }) VERIFIER_INDEPENDENCE_NO = frozenset({ "brainstorm", diff --git a/scripts/skill-build-config.json b/scripts/skill-build-config.json index 4b51178..ffd6ff5 100644 --- a/scripts/skill-build-config.json +++ b/scripts/skill-build-config.json @@ -22,8 +22,8 @@ "tier_flash_resolves_to_gemini": "an eligible managed Google-family reviewer at low effort", "skill_version": "3.1.0", "agent_runtime_status_defaults_block": "defaults:\n tier: Fast\n effort: low\n", - "ai_merge_resolve_defaults_block": "defaults:\n tier: Advanced\n effort: high\n", - "ai_merge_resolve_call_params": "`effort='high'` in every eligible advisory row and no `tier` request field", + "merge_resolve_defaults_block": "defaults:\n tier: Advanced\n effort: high\n", + "merge_resolve_call_params": "`effort='high'` in every eligible advisory row and no `tier` request field", "brainstorm_defaults_block": "defaults:\n tier: Fast\n effort: low\n", "brainstorm_call_params": "with `effort='low'` in every eligible advisory row and no `tier` request field", "chain_defaults_block": "defaults:\n tier: Standard\n effort: medium\n", diff --git a/scripts/test_check_release_consistency.py b/scripts/test_check_release_consistency.py index 894d7d1..1387fc1 100644 --- a/scripts/test_check_release_consistency.py +++ b/scripts/test_check_release_consistency.py @@ -284,11 +284,10 @@ def test_plain(self): self.assertEqual(crc.parse_tag("v1.2.3"), "1.2.3") def test_plugin_qualified(self): - # v--X.Y.Z works for any plugin name; canonical agent-collab and - # deprecation aliases agent-collab-plugin / gemini-collab are all valid. + # The unified release accepts only its canonical explicit package tag. self.assertEqual(crc.parse_tag("v-agent-collab-1.2.3"), "1.2.3") - self.assertEqual(crc.parse_tag("v-agent-collab-plugin-1.2.3"), "1.2.3") - self.assertEqual(crc.parse_tag("v-gemini-collab-1.2.3"), "1.2.3") + self.assertIsNone(crc.parse_tag("v-agent-collab-plugin-1.2.3")) + self.assertIsNone(crc.parse_tag("v-gemini-collab-1.2.3")) def test_two_part_rejected(self): self.assertIsNone(crc.parse_tag("v1.2")) @@ -309,15 +308,13 @@ class TestTagParsingWithPlugin(unittest.TestCase): def test_plain_returns_none_plugin(self): self.assertEqual(crc.parse_tag_full("v1.2.3"), (None, "1.2.3")) - def test_named_plugin(self): + def test_noncanonical_named_plugins_are_rejected(self): self.assertEqual( crc.parse_tag_full("v-sample-plugin-1.0.0"), - ("sample-plugin", "1.0.0")) - - def test_other_named_plugin(self): + (None, None)) self.assertEqual( crc.parse_tag_full("v-other-plugin-2.0.0"), - ("other-plugin", "2.0.0")) + (None, None)) def test_canonical_explicit(self): # `v-agent-collab-X.Y.Z` is equivalent to bare `vX.Y.Z` (both validate @@ -327,13 +324,13 @@ def test_canonical_explicit(self): crc.parse_tag_full("v-agent-collab-1.2.3"), ("agent-collab", "1.2.3")) - def test_generic_named_tags(self): + def test_generic_named_tags_are_rejected(self): self.assertEqual( crc.parse_tag_full("v-sample-plugin-1.2.3"), - ("sample-plugin", "1.2.3")) + (None, None)) self.assertEqual( crc.parse_tag_full("v-other-plugin-1.2.3"), - ("other-plugin", "1.2.3")) + (None, None)) def test_garbage_returns_none_pair(self): self.assertEqual(crc.parse_tag_full("garbage"), (None, None)) @@ -360,7 +357,7 @@ def test_none_input_returns_none_pair(self): def test_parse_tag_backcompat_with_full(self): """`parse_tag` is the v-version-only wrapper around parse_tag_full. Both should agree on the version slot for every valid tag form.""" - for tag in ("v1.2.3", "v-agent-collab-1.0.0", "v-sample-plugin-2.0.0"): + for tag in ("v1.2.3", "v-agent-collab-1.0.0"): with self.subTest(tag=tag): _, full_version = crc.parse_tag_full(tag) self.assertEqual(crc.parse_tag(tag), full_version) @@ -377,15 +374,11 @@ def test_canonical(self): crc.plugin_json_path("agent-collab"), "plugins/agent-collab/.claude-plugin/plugin.json") - def test_named_plugin(self): + def test_named_plugin_path_helper_remains_pure(self): self.assertEqual( crc.plugin_json_path("sample-plugin"), - "plugins/sample-plugin/.claude-plugin/plugin.json") - - def test_other_plugin(self): - self.assertEqual( - crc.plugin_json_path("other-plugin"), - "plugins/other-plugin/.claude-plugin/plugin.json") + "plugins/sample-plugin/.claude-plugin/plugin.json", + ) class TestRunTagCheckPerPlugin(unittest.TestCase): @@ -419,40 +412,36 @@ def test_canonical_bare_tag_passes(self): self.assertTrue(ok, msg=f"unexpected failure: {lines}") self.assertTrue(any("agent-collab" in line for line in lines)) - def test_named_plugin_tag_passes(self): - # A named tag looks up that named plugin's plugin.json. - # This was the exact failure mode that motivated Phase 1b's release-tag - # follow-up (pre-fix: compared the version to agent-collab's version -> FAIL). - ok, lines = crc.run_tag_check(self.root, "v-sample-plugin-1.0.0") + def test_canonical_named_tag_passes(self): + ok, lines = crc.run_tag_check(self.root, "v-agent-collab-2.0.0") self.assertTrue(ok, msg=f"unexpected failure: {lines}") - self.assertTrue(any("sample-plugin" in line and "1.0.0" in line for line in lines)) + self.assertTrue(any("agent-collab" in line and "2.0.0" in line for line in lines)) - def test_other_plugin_tag_passes(self): - ok, lines = crc.run_tag_check(self.root, "v-other-plugin-2.0.0") - self.assertTrue(ok, msg=f"unexpected failure: {lines}") - self.assertTrue(any("other-plugin" in line for line in lines)) - - def test_version_mismatch_fails_with_named_plugin(self): - # Tag version doesn't match the named plugin's plugin.json -> FAIL, - # and the failure message names the actual plugin (not the canonical - # default) so the operator can diagnose without re-reading the workflow. - ok, lines = crc.run_tag_check(self.root, "v-sample-plugin-9.9.9") + def test_noncanonical_named_plugin_tags_are_rejected(self): + for tag in ("v-sample-plugin-1.0.0", "v-other-plugin-2.0.0"): + with self.subTest(tag=tag): + ok, lines = crc.run_tag_check(self.root, tag) + self.assertFalse(ok) + self.assertTrue( + any("not a canonical release-tag form" in line for line in lines) + ) + + def test_version_mismatch_fails_with_canonical_plugin(self): + ok, lines = crc.run_tag_check(self.root, "v-agent-collab-9.9.9") self.assertFalse(ok) - self.assertTrue(any("sample-plugin" in line and "9.9.9" in line and "1.0.0" in line - for line in lines), msg=f"expected named-plugin diagnostic, got: {lines}") + self.assertTrue(any("agent-collab" in line and "9.9.9" in line and "2.0.0" in line + for line in lines), msg=f"expected canonical diagnostic, got: {lines}") - def test_unknown_plugin_fails_with_path_diagnostic(self): - # Tag names a plugin that doesn't exist in the repo -> FAIL with a - # diagnostic pointing at the missing plugin.json path. + def test_unknown_plugin_is_rejected_before_path_dispatch(self): ok, lines = crc.run_tag_check(self.root, "v-bogus-plugin-1.0.0") self.assertFalse(ok) - self.assertTrue(any("bogus-plugin" in line and "plugin.json" in line - for line in lines), msg=f"expected path diagnostic, got: {lines}") + self.assertTrue(any("not a canonical release-tag form" in line + for line in lines), msg=f"expected canonical-form diagnostic, got: {lines}") def test_garbage_tag_fails(self): ok, lines = crc.run_tag_check(self.root, "garbage") self.assertFalse(ok) - self.assertTrue(any("not a release-tag form" in line for line in lines)) + self.assertTrue(any("not a canonical release-tag form" in line for line in lines)) class TestPluginVersion(unittest.TestCase): diff --git a/scripts/test_scaffold_skill_spec.py b/scripts/test_scaffold_skill_spec.py index 88a0e2c..bb51c3d 100644 --- a/scripts/test_scaffold_skill_spec.py +++ b/scripts/test_scaffold_skill_spec.py @@ -74,9 +74,13 @@ def test_flash_for_throughput(self): def test_pro_for_reasoning_heavy(self): # Sample reasoning-heavy skills - for name in ("second-opinion", "debate", "code-review", "red-team", "ai-merge-resolve"): + for name in ("second-opinion", "debate", "code-review", "red-team", "merge-resolve"): self.assertEqual(scaffold.classify_default_tier(name), "pro") + def test_merge_resolve_is_the_only_named_merge_skill_classification(self): + self.assertIn("merge-resolve", scaffold.VERIFIER_INDEPENDENCE_YES) + self.assertNotIn("ai-merge-resolve", scaffold.VERIFIER_INDEPENDENCE_YES) + def test_pro_for_unclassified(self): self.assertEqual(scaffold.classify_default_tier("brand-new-skill"), "pro") diff --git a/skill-specs/ai-merge-resolve.md b/skill-specs/merge-resolve.md similarity index 93% rename from skill-specs/ai-merge-resolve.md rename to skill-specs/merge-resolve.md index 9b2f92f..fdc1ade 100644 --- a/skill-specs/ai-merge-resolve.md +++ b/skill-specs/merge-resolve.md @@ -1,11 +1,11 @@ --- -name: ai-merge-resolve +name: merge-resolve version: {{ skill_version }} -{{ ai_merge_resolve_defaults_block }} -description: Resolve a git merge conflict (or apply a conflicting patch) using a cross-family read on both sides' intent + commit context; propose a unified resolution as a diff; **NEVER auto-apply without operator confirm by default**. Use when the user says "resolve this merge conflict," "ai-merge," "merge with {{ verifier_agent }}," "have {{ verifier_agent }} help merge," "AI-resolve this conflict," "use {{ verifier_agent }} to merge this," or when a `git merge` / `git rebase` exits with conflict markers and the user asks anything about next steps. Also offer this proactively when worktree-fanout flows (parallel-agent parallelism) need to integrate back to a base branch, or when a chain step produces a diff destined for a file the user is currently editing. +{{ merge_resolve_defaults_block }} +description: Use when a user asks to resolve a git merge conflict or conflicting patch, says "ai-merge" or "AI-resolve," when merge or rebase exits with conflict markers and next steps are requested, when parallel worktrees need integration, or when a chain diff targets a file being edited. --- -# AI-merge-resolve — cross-family merge-conflict resolution, operator-gated by default +# Merge resolve — cross-family merge-conflict resolution, operator-gated by default This skill is the inter-branch analogue of `chain`'s semantic gate (`kind: semantic, check: ai_cross_check`): a cross-family read on the two sides' intent + commit context, a proposed unified resolution as a diff, and an **operator-confirm gate** before any change touches the working tree. The cross-check is the engine; the operator-confirm and the validator gates are the safety net. @@ -80,7 +80,7 @@ If `intent_a` / `intent_b` were not supplied, derive them from the commit messag ### 4. Cross-check prompt Submit the sealed merge-review role through `{{ mcp_tool_ask }}` with -{{ ai_merge_resolve_call_params }}. Central policy chooses an eligible +{{ merge_resolve_call_params }}. Central policy chooses an eligible independent reviewer. The prompt forces a **disagreement-first** output structure; the six-section schema is a functional contract: @@ -135,7 +135,7 @@ These are runtime-enforced by the skill. They are not stylistic suggestions; the - **`auto_apply=true` preconditions (ALL four required, no exceptions)**: - 1. **An operator-pre-approved validator-policy file is present** at `.claude/ai-merge-policy.yaml` (project-scoped) OR `~/.claude/ai-merge-policy.yaml` (user-scoped). The policy file's *presence* is the operator's signed acknowledgment of the auto-apply opt-in; the skill refuses auto-apply if the policy file is missing. + 1. **An operator-pre-approved validator-policy file is present** at `.claude/merge-resolve-policy.yaml` (project-scoped) OR `~/.claude/merge-resolve-policy.yaml` (user-scoped). The policy file's *presence* is the operator's signed acknowledgment of the auto-apply opt-in; the skill refuses auto-apply if the policy file is missing. **Caveat — presence-checked, not substance-checked**: the skill verifies the calling chain step's `gates:` block contains each `required_gates:` entry from the policy (by kind + check). It does NOT verify the gate's substance is meaningful — an operator could configure `bash_exit_code: { command: "true" }` to satisfy the letter of the policy while bypassing the actual test suite. Substance is the operator's responsibility. @@ -208,7 +208,7 @@ For the first 10–20 real merges, run with the policy file present but `shadow_ Whether the operator chose `apply`, `reject`, `apply-and-amend`, or `revise`, surface a final summary: ``` -ai-merge-resolve summary: +merge-resolve summary: file: hunks resolved: of verifier CONFIDENCE: H | M | L diff --git a/skill-specs/migration-doctor.md b/skill-specs/migration-doctor.md index 7714156..d93cc57 100644 --- a/skill-specs/migration-doctor.md +++ b/skill-specs/migration-doctor.md @@ -12,6 +12,13 @@ Resolve the **plugin root** from this loaded file and run For any coordinator readiness request, first read the **Coordinator request schema** in `/README.md`. +For an activation release, use only the co-packaged managed setup surface: +`python3 "/runtime_setup.py" status`, then `prepare`, and use +`login-grok` only when the status result reports that managed Grok +authentication is unavailable. The command accepts no provider, model, path, +environment, binary, tool, or raw argument overrides. Never invoke the native +runtime or a provider CLI directly. + ## Workflow Run the provider-free `migration_doctor.py` beside this skill's plugin root. diff --git a/tests/test_agent_collab_runtime_client.py b/tests/test_agent_collab_runtime_client.py index fc511fb..326182b 100644 --- a/tests/test_agent_collab_runtime_client.py +++ b/tests/test_agent_collab_runtime_client.py @@ -8,6 +8,7 @@ import importlib.util import json import os +import pwd import signal import stat import subprocess @@ -105,6 +106,8 @@ def _fixture( "secret_present": "LEAK_ME" in os.environ, "tmpdir": os.environ.get("TMPDIR", ""), "tmpdir_mode": oct(os.stat(os.environ["TMPDIR"]).st_mode & 0o777), + "home": os.environ.get("HOME", ""), + "host_context": request.get("host_context", ""), }, "provenance": { "route": request["route"], @@ -155,6 +158,33 @@ def _fixture( ) return binary + def _management_fixture(self) -> None: + tuple_keys = [ + "CODEX_SANDBOX", + "__CFBundleIdentifier", + "CODEX_INTERNAL_ORIGINATOR_OVERRIDE", + "CODEX_CI", + ] + self._fixture( + body=f"""#!/usr/bin/env python3 +import json, os, sys +request = json.loads(sys.stdin.readline()) +print(json.dumps({{ + "protocol_version": 1, + "request_id": request["request_id"], + "status": "ok", + "result": {{ + "argv": sys.argv[1:], + "management_action": request["management_action"], + "host_context": request["host_context"], + "secret_present": "LEAK_ME" in os.environ, + "tuple_present": any(key in os.environ for key in {tuple_keys!r}), + "home": os.environ.get("HOME", ""), + }}, +}})) +""" + ) + def _envelope( self, *, @@ -282,6 +312,8 @@ def test_valid_fixture_launches_fixed_protocol_with_scrubbed_env(self) -> None: self.assertEqual(result.status, self.client.RuntimeStatus.OK) self.assertEqual(result.result["argv"], ["invoke", "--protocol", "1"]) self.assertFalse(result.result["secret_present"]) + self.assertEqual(result.result["home"], pwd.getpwuid(os.getuid()).pw_dir) + self.assertEqual(result.result["host_context"], "generic") self.assertEqual(result.provenance["author_family"], "openai") child_tmpdir = Path(result.result["tmpdir"]) self.assertNotEqual(child_tmpdir, caller_tmpdir) @@ -289,6 +321,144 @@ def test_valid_fixture_launches_fixed_protocol_with_scrubbed_env(self) -> None: self.assertEqual(result.result["tmpdir_mode"], "0o700") self.assertFalse(child_tmpdir.exists()) + def test_host_context_requires_the_exact_complete_codex_desktop_tuple(self) -> None: + keys = self.client.CODEX_DESKTOP_TUPLE + exact = dict(self.client.CODEX_DESKTOP_TUPLE.items()) + cases = ( + ({}, "generic"), + ({next(iter(keys)): next(iter(exact.values()))}, "generic"), + (exact, "codex_desktop"), + ({**exact, "CODEX_CI": "0"}, "generic"), + ) + for environment, expected in cases: + with self.subTest(environment=environment): + with mock.patch.dict(os.environ, environment, clear=True): + self.assertEqual(self.client.classify_host_context(), expected) + + def test_hostile_environment_is_not_forwarded_to_native_runtime(self) -> None: + self._fixture() + envelope = self._envelope(request_id="hostile-environment") + hostile = { + "HOME": str(self.root / "attacker-home"), + "LEAK_ME": "secret", + "AGENT_COLLAB_GROK_RUNTIME_ROOT": str(self.root / "grok-root"), + "AGENT_COLLAB_CODEX_RUNTIME_ROOT": str(self.root / "codex-root"), + "AGENT_COLLAB_OPENCODE_RUNTIME_ROOT": str(self.root / "opencode-root"), + **self.client.CODEX_DESKTOP_TUPLE, + } + with mock.patch.object( + self.client, "_verify_macos_signature", return_value=(True, "") + ), mock.patch.dict(os.environ, hostile, clear=True), mock.patch.object( + self.client, "PLUGIN_ROOT", self.root + ): + result = self.client.invoke(envelope=envelope) + self.assertEqual(result.status, self.client.RuntimeStatus.OK) + self.assertEqual(result.result["home"], pwd.getpwuid(os.getuid()).pw_dir) + self.assertEqual(result.result["host_context"], "codex_desktop") + self.assertFalse(result.result["secret_present"]) + + def test_management_uses_fixed_signed_runtime_argv_and_scrubbed_env(self) -> None: + self._management_fixture() + hostile = { + "HOME": str(self.root / "attacker-home"), + "LEAK_ME": "secret", + **self.client.CODEX_DESKTOP_TUPLE, + } + with mock.patch.object( + self.client, "_verify_macos_signature", return_value=(True, "") + ), mock.patch.dict(os.environ, hostile, clear=True), mock.patch.object( + self.client, "PLUGIN_ROOT", self.root + ): + result = self.client.manage_runtime( + action="status", + request_id="management-status", + timeout_ms=30_000, + ) + self.assertEqual(result.status, self.client.RuntimeStatus.OK) + self.assertEqual(result.result["argv"], ["invoke", "--protocol", "1"]) + self.assertEqual(result.result["management_action"], "status") + self.assertEqual(result.result["host_context"], "codex_desktop") + self.assertFalse(result.result["secret_present"]) + self.assertFalse(result.result["tuple_present"]) + self.assertEqual(result.result["home"], pwd.getpwuid(os.getuid()).pw_dir) + + def test_management_rejects_unknown_action_before_runtime_resolution(self) -> None: + with mock.patch.object(self.client, "resolve_runtime") as resolve: + result = self.client.manage_runtime( + action="execute", + request_id="management-rejected", + timeout_ms=30_000, + ) + self.assertEqual(result.status, self.client.RuntimeStatus.CONFIG_ERROR) + resolve.assert_not_called() + + def test_management_malformed_response_is_protocol_error(self) -> None: + self._fixture( + body="#!/usr/bin/env python3\nimport sys\nsys.stdout.write('not-json\\n')\n" + ) + with mock.patch.object( + self.client, "_verify_macos_signature", return_value=(True, "") + ), mock.patch.object(self.client, "PLUGIN_ROOT", self.root): + result = self.client.manage_runtime( + action="status", + request_id="management-bad-json", + timeout_ms=30_000, + ) + self.assertEqual(result.status, self.client.RuntimeStatus.PROTOCOL_ERROR) + + def test_management_login_inherits_stderr_but_parses_stdout(self) -> None: + self._fixture( + body="""#!/usr/bin/env python3 +import json, sys +request = json.loads(sys.stdin.readline()) +sys.stderr.write("device-login-prompt\\n") +sys.stderr.flush() +print(json.dumps({ + "protocol_version": 1, + "request_id": request["request_id"], + "status": "ok", + "result": {"authenticated": True}, +})) +""" + ) + with mock.patch.object( + self.client, "_verify_macos_signature", return_value=(True, "") + ), mock.patch.object(self.client, "PLUGIN_ROOT", self.root): + result = self.client.manage_runtime( + action="grok_login", + request_id="management-login", + timeout_ms=30_000, + ) + self.assertEqual(result.status, self.client.RuntimeStatus.OK) + self.assertTrue(result.result["authenticated"]) + + def test_management_login_relay_remains_output_bounded(self) -> None: + self._fixture( + body="""#!/usr/bin/env python3 +import json, sys +request = json.loads(sys.stdin.readline()) +sys.stderr.write("x" * 256) +sys.stderr.flush() +print(json.dumps({ + "protocol_version": 1, + "request_id": request["request_id"], + "status": "ok", + "result": {"authenticated": True}, +})) +""" + ) + with mock.patch.object( + self.client, "_verify_macos_signature", return_value=(True, "") + ), mock.patch.object(self.client, "PLUGIN_ROOT", self.root), mock.patch.object( + self.client, "MAX_RESPONSE_BYTES", 64 + ): + result = self.client.manage_runtime( + action="grok_login", + request_id="management-login-limit", + timeout_ms=30_000, + ) + self.assertEqual(result.status, self.client.RuntimeStatus.OUTPUT_LIMIT) + def test_each_invocation_gets_a_fresh_isolated_tmpdir(self) -> None: self._fixture() caller_tmpdir = self.root / "caller-tmp-fresh" @@ -1043,6 +1213,7 @@ def test_native_protocol_uses_exact_route_action_fields(self) -> None: "action", "authority", "timeout_ms", + "host_context", "prompt", } for contract, row_fields in expected_row_fields.items(): diff --git a/tests/test_merge_resolve_skill_rename.py b/tests/test_merge_resolve_skill_rename.py new file mode 100644 index 0000000..e1f7228 --- /dev/null +++ b/tests/test_merge_resolve_skill_rename.py @@ -0,0 +1,75 @@ +"""Public contract for the merge-resolve skill rename.""" + +from __future__ import annotations + +import json +import unittest +from pathlib import Path + + +ROOT = Path(__file__).resolve().parents[1] + + +class MergeResolveSkillRenameTests(unittest.TestCase): + def test_only_merge_resolve_is_a_publishable_skill(self) -> None: + self.assertTrue((ROOT / "skill-specs" / "merge-resolve.md").is_file()) + self.assertFalse((ROOT / "skill-specs" / "ai-merge-resolve.md").exists()) + self.assertTrue( + ( + ROOT + / "plugins" + / "agent-collab" + / "skills" + / "merge-resolve" + / "SKILL.md" + ).is_file() + ) + self.assertFalse( + ( + ROOT + / "plugins" + / "agent-collab" + / "skills" + / "ai-merge-resolve" + ).exists() + ) + + def test_spec_and_generated_frontmatter_use_the_new_name(self) -> None: + for path in ( + ROOT / "skill-specs" / "merge-resolve.md", + ROOT + / "plugins" + / "agent-collab" + / "skills" + / "merge-resolve" + / "SKILL.md", + ): + with self.subTest(path=path.relative_to(ROOT)): + self.assertIn("\nname: merge-resolve\n", path.read_text(encoding="utf-8")) + + def test_generator_configuration_has_no_old_skill_identifier(self) -> None: + config_path = ROOT / "scripts" / "skill-build-config.json" + config = json.loads(config_path.read_text(encoding="utf-8")) + keys = set(config["agent-collab"]) + self.assertIn("merge_resolve_defaults_block", keys) + self.assertIn("merge_resolve_call_params", keys) + self.assertNotIn("ai_merge_resolve_defaults_block", keys) + self.assertNotIn("ai_merge_resolve_call_params", keys) + + def test_retired_namespaces_migrate_to_the_new_command(self) -> None: + migration = ( + ROOT / "docs" / "migration-from-legacy-packages.md" + ).read_text(encoding="utf-8") + self.assertIn( + "`/agent-collab:ai-merge-resolve`, " + "`/claude-collab:ai-merge-resolve`, " + "`/codex-collab:ai-merge-resolve`, " + "`/antigravity-collab:ai-merge-resolve` | " + "`/agent-collab:merge-resolve`", + migration, + ) + self.assertNotIn("| `/agent-collab:ai-merge-resolve` |", migration) + + +if __name__ == "__main__": + unittest.main() diff --git a/tests/test_plugin_archive.py b/tests/test_plugin_archive.py index b4fe2b2..fb9da77 100644 --- a/tests/test_plugin_archive.py +++ b/tests/test_plugin_archive.py @@ -18,6 +18,20 @@ PLUGIN = ROOT / "plugins" / "agent-collab" SCRIPT = ROOT / "scripts" / "build_plugin_archive.py" LEGAL_FILES = ("LICENSE", "NOTICE", "COMMERCIAL-LICENSING.md") +THIRD_PARTY_NOTICE = "THIRD-PARTY-NOTICES.txt" +THIRD_PARTY_LICENSE_FILES = ( + "CPython-3.13.14-LICENSE.txt", + "CPython-3.13.14-NOTICES.txt", + "Expat-COPYING.txt", + "HACL-LICENSE.txt", + "Hedley-CC0-1.0.txt", + "libb2-CC0-1.0.txt", + "Nuitka-4.1.3-LICENSE-RUNTIME.txt", + "Nuitka-4.1.3-LICENSE.txt", + "Nuitka-4.1.3-NOTICE.txt", + "mimalloc-LICENSE.txt", + "mpdecimal-NOTICE.txt", +) def _load(): @@ -48,7 +62,14 @@ def setUp(self) -> None: def tearDown(self) -> None: self.temp.cleanup() + def _install_third_party_notices(self) -> None: + self.assertTrue((self.plugin / THIRD_PARTY_NOTICE).is_file()) + licenses = self.plugin / "third-party-licenses" + for name in THIRD_PARTY_LICENSE_FILES: + self.assertTrue((licenses / name).is_file()) + def _activate(self) -> Path: + self._install_third_party_notices() runtime = ( self.plugin / "runtime" @@ -99,6 +120,7 @@ def _activate(self) -> Path: return runtime def test_policy_only_archive_includes_policy_and_omits_runtime(self) -> None: + self._install_third_party_notices() mode = self.builder.build_archive( self.root, plugin="agent-collab", output=self.archive ) @@ -119,6 +141,14 @@ def test_policy_only_archive_includes_policy_and_omits_runtime(self) -> None: (ROOT / name).read_bytes(), ) self.assertFalse(any(name == "runtime" or name.startswith("runtime/") for name in names)) + self.assertNotIn(THIRD_PARTY_NOTICE, names) + self.assertFalse( + any( + name == "third-party-licenses" + or name.startswith("third-party-licenses/") + for name in names + ) + ) policy = bundle.getmember("signing_policy.py") self.assertEqual( stat.S_IMODE(policy.mode), @@ -170,6 +200,91 @@ def test_activation_archive_has_exactly_one_runtime_with_byte_mode_parity(self) stat.S_IMODE(source.stat().st_mode), ) + def test_activation_archive_includes_canonical_third_party_notice_tree(self) -> None: + self._activate() + mode = self.builder.build_archive( + self.root, plugin="agent-collab", output=self.archive + ) + self.assertEqual(mode, "activation") + + with tarfile.open(self.archive, "r:gz") as bundle: + names = bundle.getnames() + expected = [ + THIRD_PARTY_NOTICE, + "third-party-licenses", + *( + f"third-party-licenses/{name}" + for name in THIRD_PARTY_LICENSE_FILES + ), + ] + self.assertEqual( + [ + name + for name in names + if name == THIRD_PARTY_NOTICE + or name == "third-party-licenses" + or name.startswith("third-party-licenses/") + ], + sorted(expected), + ) + for name in expected: + member = bundle.getmember(name) + source = self.plugin / name + self.assertEqual(member.isfile(), source.is_file()) + self.assertEqual(member.isdir(), source.is_dir()) + if member.isfile(): + self.assertEqual(bundle.extractfile(member).read(), source.read_bytes()) + + def test_activation_rejects_missing_third_party_notice_member(self) -> None: + self._activate() + (self.plugin / "third-party-licenses" / THIRD_PARTY_LICENSE_FILES[0]).unlink() + + with self.assertRaisesRegex(ValueError, "third-party notice tree"): + self.builder.build_archive( + self.root, plugin="agent-collab", output=self.archive + ) + + def test_activation_rejects_missing_top_level_third_party_notice(self) -> None: + self._activate() + (self.plugin / THIRD_PARTY_NOTICE).unlink() + + with self.assertRaisesRegex(ValueError, "third-party notice tree"): + self.builder.build_archive( + self.root, plugin="agent-collab", output=self.archive + ) + + def test_activation_rejects_unexpected_third_party_notice_member(self) -> None: + self._activate() + (self.plugin / "third-party-licenses" / "unexpected.txt").write_text( + "unexpected\n", encoding="utf-8" + ) + + with self.assertRaisesRegex(ValueError, "third-party notice tree"): + self.builder.build_archive( + self.root, plugin="agent-collab", output=self.archive + ) + + def test_activation_rejects_third_party_notice_content_drift(self) -> None: + self._activate() + source = self.plugin / "third-party-licenses" / THIRD_PARTY_LICENSE_FILES[0] + source.write_text("tampered legal text\n", encoding="utf-8") + + with self.assertRaisesRegex(ValueError, "content digest"): + self.builder.build_archive( + self.root, plugin="agent-collab", output=self.archive + ) + + def test_activation_rejects_symlinked_third_party_notice_member(self) -> None: + self._activate() + link = self.plugin / "third-party-licenses" / THIRD_PARTY_LICENSE_FILES[0] + link.unlink() + link.symlink_to(THIRD_PARTY_LICENSE_FILES[1]) + + with self.assertRaisesRegex(ValueError, "unsafe|third-party notice tree"): + self.builder.build_archive( + self.root, plugin="agent-collab", output=self.archive + ) + def test_policy_only_rejects_unadvertised_runtime_and_missing_policy(self) -> None: runtime = ( self.plugin diff --git a/tests/test_provider_plugin_retirement.py b/tests/test_provider_plugin_retirement.py index f2f9564..3abe1dc 100644 --- a/tests/test_provider_plugin_retirement.py +++ b/tests/test_provider_plugin_retirement.py @@ -115,6 +115,7 @@ def test_public_package_has_no_provider_executor_or_compatibility_source(self) - { "coordinator.py", "runtime_client.py", + "runtime_setup.py", "host_policy.py", "migration_doctor.py", "signing_policy.py", @@ -196,7 +197,6 @@ def test_migration_table_covers_every_retired_skill_namespace(self) -> None: shared = { "agent-readiness", "agent-runtime-status", - "ai-merge-resolve", "autonomy-readiness", "brainstorm", "chain", @@ -225,6 +225,14 @@ def test_migration_table_covers_every_retired_skill_namespace(self) -> None: with self.subTest(package=package, skill=skill): self.assertIn(f"/{package}:{skill}", migration) self.assertIn(f"/agent-collab:{skill}", migration) + for package in ( + "agent-collab", + "claude-collab", + "codex-collab", + "antigravity-collab", + ): + self.assertIn(f"/{package}:ai-merge-resolve", migration) + self.assertIn("/agent-collab:merge-resolve", migration) for command in ( "/codex-tools:codex-build-coding", "/codex-tools:codex-high-stakes-advisor", diff --git a/tests/test_release_evidence.py b/tests/test_release_evidence.py index 6ce211d..bc4fb28 100644 --- a/tests/test_release_evidence.py +++ b/tests/test_release_evidence.py @@ -6,6 +6,7 @@ import importlib.util import json import os +import shutil import stat import sys import tarfile @@ -19,6 +20,20 @@ ARCHIVE_SCRIPT = ROOT / "scripts" / "build_plugin_archive.py" EVIDENCE_SCRIPT = ROOT / "scripts" / "build_release_evidence.py" LEGAL_FILES = {"LICENSE", "NOTICE", "COMMERCIAL-LICENSING.md"} +THIRD_PARTY_NOTICE = "THIRD-PARTY-NOTICES.txt" +THIRD_PARTY_LICENSE_FILES = ( + "CPython-3.13.14-LICENSE.txt", + "CPython-3.13.14-NOTICES.txt", + "Expat-COPYING.txt", + "HACL-LICENSE.txt", + "Hedley-CC0-1.0.txt", + "libb2-CC0-1.0.txt", + "Nuitka-4.1.3-LICENSE-RUNTIME.txt", + "Nuitka-4.1.3-LICENSE.txt", + "Nuitka-4.1.3-NOTICE.txt", + "mimalloc-LICENSE.txt", + "mpdecimal-NOTICE.txt", +) def _load(name: str, path: Path): @@ -62,6 +77,78 @@ def _build(self): ) return json.loads(self.sbom.read_text(encoding="utf-8")) + def _build_activation(self): + archive_builder = _load( + "agent_collab_archive_activation_evidence", ARCHIVE_SCRIPT + ) + evidence_builder = _load( + "agent_collab_release_activation_evidence", EVIDENCE_SCRIPT + ) + repo = self.root / "repo" + plugin = repo / "plugins" / "agent-collab" + shutil.copytree( + ROOT / "plugins" / "agent-collab", + plugin, + ignore=shutil.ignore_patterns("__pycache__", "*.pyc", "runtime"), + ) + for name in LEGAL_FILES: + shutil.copy2(ROOT / name, repo / name) + runtime = plugin / "runtime" / "darwin-arm64" / "agent-collab-runtime" + runtime.parent.mkdir(parents=True) + runtime.write_bytes(b"signed-runtime-fixture") + runtime.chmod(0o755) + contracts = ( + ("gemini", "advisory"), + ("gemini", "long_context"), + ("codex", "advisory"), + ("opencode", "plan"), + ("opencode", "build"), + ("grok", "architecture"), + ("grok", "governance"), + ("grok", "huge_context"), + ("composer", "codegen"), + ) + manifest = { + "schema_version": 1, + "protocol_version": 1, + "contract_version": 1, + "artifacts": [ + { + "platform": "darwin", + "arch": "arm64", + "minimum_macos": "14.0", + "path": "runtime/darwin-arm64/agent-collab-runtime", + "size": runtime.stat().st_size, + "sha256": hashlib.sha256(runtime.read_bytes()).hexdigest(), + "signing": { + "team_id": "TESTTEAM01", + "require_notarization": True, + "hardened_runtime": True, + }, + "contracts": [ + {"route": route, "action": action} + for route, action in contracts + ], + } + ], + } + (plugin / "runtime-manifest.json").write_text( + json.dumps(manifest), encoding="utf-8" + ) + mode = archive_builder.build_archive( + repo, plugin="agent-collab", output=self.archive + ) + self.assertEqual(mode, "activation") + evidence_builder.build_evidence( + self.archive, + version="3.1.0", + created="2026-07-12T00:00:00Z", + sbom_output=self.sbom, + checksum_output=self.checksum, + repo_root=repo, + ) + return json.loads(self.sbom.read_text(encoding="utf-8")) + def test_spdx_inventory_contains_exact_legal_files_and_license(self) -> None: sbom = self._build() @@ -85,6 +172,94 @@ def test_spdx_inventory_contains_exact_legal_files_and_license(self) -> None: ) self.assertEqual(extracted[0]["extractedText"], (ROOT / "LICENSE").read_text()) + def test_policy_only_spdx_output_preserves_project_only_license_contract(self) -> None: + sbom = self._build() + + self.assertEqual( + [package["name"] for package in sbom["packages"]], + ["agent-collab"], + ) + self.assertTrue(sbom["files"]) + self.assertTrue( + all( + item["licenseConcluded"] + == "LicenseRef-PolyForm-Strict-1.0.0" + for item in sbom["files"] + ) + ) + + def test_activation_spdx_identifies_runtime_components_and_file_licenses(self) -> None: + sbom = self._build_activation() + + packages = {package["name"]: package for package in sbom["packages"]} + self.assertEqual( + set(packages), + { + "agent-collab", + "CPython", + "Nuitka", + "expat", + "hacl-star", + "libb2", + "mpdecimal", + "mimalloc", + "Hedley", + }, + ) + self.assertEqual(packages["CPython"]["versionInfo"], "3.13.14") + self.assertEqual(packages["CPython"]["licenseDeclared"], "Python-2.0") + self.assertEqual(packages["Nuitka"]["versionInfo"], "4.1.3") + self.assertEqual(packages["Nuitka"]["licenseDeclared"], "NOASSERTION") + self.assertEqual(packages["expat"]["licenseDeclared"], "MIT") + self.assertEqual( + packages["hacl-star"]["licenseDeclared"], "MIT AND Apache-2.0" + ) + self.assertEqual(packages["libb2"]["licenseDeclared"], "CC0-1.0") + self.assertEqual(packages["mpdecimal"]["licenseDeclared"], "BSD-2-Clause") + self.assertEqual(packages["mimalloc"]["licenseDeclared"], "MIT") + self.assertEqual(packages["Hedley"]["licenseDeclared"], "CC0-1.0") + + files = {item["fileName"]: item for item in sbom["files"]} + self.assertEqual( + files["README.md"]["licenseConcluded"], + "LicenseRef-PolyForm-Strict-1.0.0", + ) + self.assertEqual( + files["runtime/darwin-arm64/agent-collab-runtime"]["licenseConcluded"], + "NOASSERTION", + ) + self.assertEqual(files[THIRD_PARTY_NOTICE]["licenseConcluded"], "NOASSERTION") + for name in THIRD_PARTY_LICENSE_FILES: + self.assertEqual( + files[f"third-party-licenses/{name}"]["licenseConcluded"], + "NOASSERTION", + ) + + relationships = { + ( + relationship["spdxElementId"], + relationship["relationshipType"], + relationship["relatedSpdxElement"], + ) + for relationship in sbom["relationships"] + } + self.assertIn( + ( + "SPDXRef-Package-agent-collab", + "CONTAINS", + "SPDXRef-Package-CPython", + ), + relationships, + ) + self.assertIn( + ( + "SPDXRef-Package-agent-collab", + "CONTAINS", + "SPDXRef-Package-Nuitka", + ), + relationships, + ) + def test_every_spdx_file_sha256_checksum_matches_archive_bytes(self) -> None: sbom = self._build() archived = self._archive_bytes() diff --git a/tests/test_release_runtime_gate.py b/tests/test_release_runtime_gate.py index fd52b77..da4c049 100644 --- a/tests/test_release_runtime_gate.py +++ b/tests/test_release_runtime_gate.py @@ -370,6 +370,8 @@ def test_workflow_and_tools_have_no_unsigned_or_ignored_tag_path(self) -> None: self.assertIn("verify-release-ref", workflow) self.assertIn("fetch-depth: 0", workflow) self.assertIn("runtime-verification", workflow) + self.assertIn("runs-on: macos-15", workflow) + self.assertNotIn("runs-on: macos-14", workflow) self.assertIn("build_plugin_archive.py", workflow) self.assertIn("build_release_evidence.py", workflow) self.assertIn(".sha256", workflow) diff --git a/tests/test_runtime_setup.py b/tests/test_runtime_setup.py new file mode 100644 index 0000000..f0e0397 --- /dev/null +++ b/tests/test_runtime_setup.py @@ -0,0 +1,109 @@ +"""Closed public CLI for signed runtime management.""" + +from __future__ import annotations + +import contextlib +import importlib.util +import io +import json +import sys +import unittest +from pathlib import Path +from unittest import mock + + +ROOT = Path(__file__).resolve().parents[1] +PLUGIN = ROOT / "plugins" / "agent-collab" +CLIENT_PATH = PLUGIN / "runtime_client.py" +SETUP_PATH = PLUGIN / "runtime_setup.py" + + +def _load(name: str, path: Path): + spec = importlib.util.spec_from_file_location(name, path) + assert spec is not None and spec.loader is not None + module = importlib.util.module_from_spec(spec) + sys.modules[name] = module + spec.loader.exec_module(module) + return module + + +class RuntimeSetupTests(unittest.TestCase): + @classmethod + def setUpClass(cls) -> None: + cls.client = _load("runtime_client", CLIENT_PATH) + cls.setup = _load("agent_collab_runtime_setup", SETUP_PATH) + + def test_each_public_command_maps_to_one_closed_management_action(self) -> None: + mapping = { + "status": "status", + "prepare": "prepare", + "login-grok": "grok_login", + } + for command, action in mapping.items(): + with self.subTest(command=command): + result = self.client.RuntimeResult( + self.client.RuntimeStatus.OK, + result={"management_action": action}, + ) + output = io.StringIO() + with mock.patch.object( + self.setup.runtime_client, + "manage_runtime", + return_value=result, + ) as managed, contextlib.redirect_stdout(output): + exit_code = self.setup.main([command]) + self.assertEqual(exit_code, 0) + payload = json.loads(output.getvalue()) + self.assertEqual(payload["status"], "ok") + self.assertEqual(payload["result"]["management_action"], action) + self.assertEqual(managed.call_args.kwargs["action"], action) + self.assertRegex( + managed.call_args.kwargs["request_id"], + r"^setup-[0-9a-f]{32}$", + ) + + def test_cli_rejects_raw_provider_model_path_and_option_surfaces(self) -> None: + invalid = ( + [], + ["status", "extra"], + ["--provider", "grok"], + ["--model", "xai/grok-4.5"], + ["--path", "/tmp/runtime"], + ["--env", "KEY=VALUE"], + ["login"], + ) + for argv in invalid: + with self.subTest(argv=argv): + output = io.StringIO() + with mock.patch.object( + self.setup.runtime_client, "manage_runtime" + ) as managed, contextlib.redirect_stdout(output): + exit_code = self.setup.main(list(argv)) + self.assertEqual(exit_code, 2) + self.assertEqual(json.loads(output.getvalue())["status"], "config_error") + managed.assert_not_called() + + def test_typed_management_failure_returns_nonzero_without_extra_fields(self) -> None: + result = self.client.RuntimeResult( + self.client.RuntimeStatus.AUTH_ERROR, + error="managed Grok authentication is unavailable", + ) + output = io.StringIO() + with mock.patch.object( + self.setup.runtime_client, + "manage_runtime", + return_value=result, + ), contextlib.redirect_stdout(output): + exit_code = self.setup.main(["login-grok"]) + self.assertEqual(exit_code, 1) + self.assertEqual( + json.loads(output.getvalue()), + { + "status": "auth_error", + "error": "managed Grok authentication is unavailable", + }, + ) + + +if __name__ == "__main__": + unittest.main() From 7f57fbfb02bf72d5315501b3796151fed5735201 Mon Sep 17 00:00:00 2001 From: John Osumi <931193+sumitake@users.noreply.github.com> Date: Sun, 12 Jul 2026 15:52:15 -0700 Subject: [PATCH 2/4] release: package runtime setup entrypoint --- scripts/build_plugin_archive.py | 1 + tests/test_plugin_archive.py | 11 +++++++++++ 2 files changed, 12 insertions(+) diff --git a/scripts/build_plugin_archive.py b/scripts/build_plugin_archive.py index 5aa1952..2ab0223 100644 --- a/scripts/build_plugin_archive.py +++ b/scripts/build_plugin_archive.py @@ -95,6 +95,7 @@ "skills", "coordinator.py", "runtime_client.py", + "runtime_setup.py", "host_policy.py", "migration_doctor.py", "signing_policy.py", diff --git a/tests/test_plugin_archive.py b/tests/test_plugin_archive.py index fb9da77..748ce2e 100644 --- a/tests/test_plugin_archive.py +++ b/tests/test_plugin_archive.py @@ -131,6 +131,7 @@ def test_policy_only_archive_includes_policy_and_omits_runtime(self) -> None: self.assertIn(".claude-plugin/plugin.json", names) self.assertIn(".codex-plugin/plugin.json", names) self.assertIn("runtime_client.py", names) + self.assertIn("runtime_setup.py", names) self.assertIn("signing_policy.py", names) self.assertIn("runtime-manifest.json", names) for name in LEGAL_FILES: @@ -319,6 +320,16 @@ def test_archive_size_limit_and_required_policy_member_are_canonical(self) -> No self.assertEqual(self.builder.MAX_ARTIFACT_BYTES, 64 * 1024 * 1024) self.assertEqual(self.builder.RUNTIME_FILE_MODE, 0o755) self.assertIn("signing_policy.py", self.builder.REQUIRED_ROOTS) + self.assertIn("runtime_setup.py", self.builder.REQUIRED_ROOTS) + + def test_archive_fails_closed_when_runtime_setup_entrypoint_is_missing(self) -> None: + (self.plugin / "runtime_setup.py").unlink() + with self.assertRaisesRegex( + ValueError, "required archive member is missing: runtime_setup.py" + ): + self.builder.build_archive( + self.root, plugin="agent-collab", output=self.archive + ) def test_archive_rejects_unexpected_manifest_and_skill_members(self) -> None: extra_manifest = self.plugin / ".claude-plugin" / "extra.dat" From 12cbb801df0d4984aa5d18bed72438202c98d0ea Mon Sep 17 00:00:00 2001 From: John Osumi <931193+sumitake@users.noreply.github.com> Date: Sun, 12 Jul 2026 15:59:09 -0700 Subject: [PATCH 3/4] runtime: load safely without POSIX pwd --- plugins/agent-collab/runtime_client.py | 10 +++++++-- tests/test_agent_collab_runtime_client.py | 27 +++++++++++++++++++++++ 2 files changed, 35 insertions(+), 2 deletions(-) diff --git a/plugins/agent-collab/runtime_client.py b/plugins/agent-collab/runtime_client.py index 667e2a9..6909eba 100644 --- a/plugins/agent-collab/runtime_client.py +++ b/plugins/agent-collab/runtime_client.py @@ -19,7 +19,6 @@ import json import os import platform -import pwd import re import selectors import shutil @@ -34,6 +33,11 @@ from pathlib import Path, PurePosixPath from typing import Any, Iterator, Mapping +try: + import pwd as _pwd +except ImportError: # pragma: no cover - exercised by a simulated non-POSIX import + _pwd = None + PLUGIN_ROOT = Path(__file__).resolve().parent MANIFEST_NAME = "runtime-manifest.json" @@ -573,8 +577,10 @@ def classify_host_context() -> str: def _operator_home() -> str | None: + if _pwd is None: + return None try: - value = pwd.getpwuid(os.getuid()).pw_dir + value = _pwd.getpwuid(os.getuid()).pw_dir except (KeyError, OSError): return None if ( diff --git a/tests/test_agent_collab_runtime_client.py b/tests/test_agent_collab_runtime_client.py index 326182b..833625a 100644 --- a/tests/test_agent_collab_runtime_client.py +++ b/tests/test_agent_collab_runtime_client.py @@ -34,6 +34,27 @@ def _load_client(): return module +def _load_client_without_pwd(): + """Load the public client as on a platform without the POSIX pwd module.""" + + spec = importlib.util.spec_from_file_location( + "agent_collab_runtime_client_without_pwd", CLIENT + ) + assert spec is not None and spec.loader is not None + module = importlib.util.module_from_spec(spec) + sys.modules[spec.name] = module + original_import = __import__ + + def blocked_pwd_import(name, *args, **kwargs): + if name == "pwd": + raise ImportError("pwd is unavailable") + return original_import(name, *args, **kwargs) + + with mock.patch("builtins.__import__", side_effect=blocked_pwd_import): + spec.loader.exec_module(module) + return module + + class RuntimeClientTests(unittest.TestCase): @classmethod def setUpClass(cls) -> None: @@ -74,6 +95,12 @@ def test_manifest_team_must_equal_pinned_operator_team(self) -> None: result = self.client.resolve_runtime() self.assertEqual(result.status, self.client.RuntimeStatus.MANIFEST_INVALID) + def test_module_loads_without_posix_pwd_and_omits_home(self) -> None: + client = _load_client_without_pwd() + self.assertIsNone(client._operator_home()) + env = client._scrubbed_env(tmpdir=self.root) + self.assertNotIn("HOME", env) + def _fixture( self, *, From 57adf77e468b555cb514315b96205691d4ebd207 Mon Sep 17 00:00:00 2001 From: John Osumi <931193+sumitake@users.noreply.github.com> Date: Sun, 12 Jul 2026 22:40:26 -0700 Subject: [PATCH 4/4] runtime: guard non-POSIX identity checks --- .../2026-07-12-activation-licensing.md | 1 + plugins/agent-collab/runtime_client.py | 31 +++++++++++++++++-- tests/test_agent_collab_runtime_client.py | 12 +++++++ 3 files changed, 41 insertions(+), 3 deletions(-) diff --git a/changelog.d/2026-07-12-activation-licensing.md b/changelog.d/2026-07-12-activation-licensing.md index ef28641..441a88a 100644 --- a/changelog.d/2026-07-12-activation-licensing.md +++ b/changelog.d/2026-07-12-activation-licensing.md @@ -8,3 +8,4 @@ - Reject noncanonical package-qualified release tags, move the arm64 activation verifier to `macos-15`, and fail activation archives on missing, extra, linked, hardlinked, unsafe, or content-drifted third-party legal members. - Keep the native child environment scrubbed while passing only a closed generic/Codex-Desktop host-context observation; the signed runtime derives and validates provider state from the OS login identity. +- Fail closed with typed `platform_unsupported` when POSIX user identity APIs are unavailable, before manifest or artifact ownership checks can raise on non-POSIX hosts. diff --git a/plugins/agent-collab/runtime_client.py b/plugins/agent-collab/runtime_client.py index 6909eba..6e441e4 100644 --- a/plugins/agent-collab/runtime_client.py +++ b/plugins/agent-collab/runtime_client.py @@ -196,7 +196,21 @@ def _exact_int(value: object, expected: int | None = None) -> bool: return type(value) is int and (expected is None or value == expected) +def _operator_uid() -> int | None: + getuid = getattr(os, "getuid", None) + if not callable(getuid): + return None + try: + value = getuid() + except (OSError, TypeError, ValueError): + return None + return value if _exact_int(value) and value >= 0 else None + + def _safe_file_identity(path: Path, *, executable: bool) -> FileIdentity | None: + operator_uid = _operator_uid() + if operator_uid is None: + return None try: info = path.lstat() except OSError: @@ -205,7 +219,7 @@ def _safe_file_identity(path: Path, *, executable: bool) -> FileIdentity | None: if ( not stat.S_ISREG(mode) or stat.S_ISLNK(mode) - or info.st_uid != os.getuid() + or info.st_uid != operator_uid or info.st_nlink != 1 or mode & (stat.S_IWGRP | stat.S_IWOTH | stat.S_ISUID | stat.S_ISGID) or (executable and not (mode & stat.S_IXUSR)) @@ -501,6 +515,11 @@ def _sha256_regular(path: Path, expected: FileIdentity) -> str | None: def resolve_runtime() -> RuntimeResolution: + if _operator_uid() is None: + return RuntimeResolution( + RuntimeStatus.PLATFORM_UNSUPPORTED, + error="this release requires a POSIX user identity", + ) try: root = PLUGIN_ROOT.resolve(strict=True) except OSError: @@ -579,8 +598,11 @@ def classify_host_context() -> str: def _operator_home() -> str | None: if _pwd is None: return None + operator_uid = _operator_uid() + if operator_uid is None: + return None try: - value = _pwd.getpwuid(os.getuid()).pw_dir + value = _pwd.getpwuid(operator_uid).pw_dir except (KeyError, OSError): return None if ( @@ -611,6 +633,9 @@ class _RuntimeTempCleanupError(RuntimeError): def _isolated_runtime_tmpdir() -> Iterator[Path]: """Create a fresh 0700 temp root without consulting caller-controlled TMPDIR.""" + operator_uid = _operator_uid() + if operator_uid is None: + raise OSError("operator identity is unavailable") path = Path( tempfile.mkdtemp( prefix="agent-collab-runtime-", @@ -623,7 +648,7 @@ def _isolated_runtime_tmpdir() -> Iterator[Path]: if ( not stat.S_ISDIR(info.st_mode) or stat.S_ISLNK(info.st_mode) - or info.st_uid != os.getuid() + or info.st_uid != operator_uid or stat.S_IMODE(info.st_mode) != 0o700 ): raise OSError("isolated runtime temp directory is unsafe") diff --git a/tests/test_agent_collab_runtime_client.py b/tests/test_agent_collab_runtime_client.py index 833625a..bf8bc19 100644 --- a/tests/test_agent_collab_runtime_client.py +++ b/tests/test_agent_collab_runtime_client.py @@ -101,6 +101,18 @@ def test_module_loads_without_posix_pwd_and_omits_home(self) -> None: env = client._scrubbed_env(tmpdir=self.root) self.assertNotIn("HOME", env) + def test_runtime_resolution_without_posix_uid_is_typed_unsupported(self) -> None: + client = _load_client_without_pwd() + with mock.patch.object(client.os, "getuid", None), mock.patch.object( + client, "PLUGIN_ROOT", self.root, + ): + result = client.resolve_runtime() + identity = client._safe_file_identity(CLIENT, executable=False) + + self.assertEqual(result.status, client.RuntimeStatus.PLATFORM_UNSUPPORTED) + self.assertIsNone(identity) + self.assertIsNone(client._operator_home()) + def _fixture( self, *,