Open-source the Cloud CLI as fp-cloud-cli and the telemetry SDK as failproofai-sdk

.github/dependabot.yml

@@ -39,3 +39,35 @@ updates:
       rust-dependencies:
         patterns:
           - "*"
+
+  # The `fp` CLI (PyPI: fp-cloud-cli) — the only Python in the repo. Its lockfile is
+  # `fp-cloud-cli/uv.lock`, so the ecosystem is `uv`, and the directory is the package
+  # root rather than `/`. Grouped for the same reason as the Rust tree: the whole
+  # dependency set is verified together by one pytest run, and separate PRs each
+  # rebuild the lockfile the others just changed.
+  - package-ecosystem: uv
+    directory: /fp-cloud-cli
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    groups:
+      python-dependencies:
+        patterns:
+          - "*"
+
+  # The telemetry SDK (PyPI: failproofai-sdk). Its own lockfile and its own uv
+  # ecosystem entry — dependabot resolves per directory, so fp-cloud-cli's entry above
+  # does not see this tree at all. The only things in the lockfile are the test
+  # runner and its transitive deps: the package itself declares NO runtime
+  # dependencies, and `tests/test_zero_dependencies.py` fails if that changes.
+  - package-ecosystem: uv
+    directory: /sdk/python
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    groups:
+      python-dependencies:
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -3,8 +3,14 @@ name: CI
 on:
   push:
     branches: [main]
+  # `main` AND the long-lived branches other PRs stack onto. A pull request is
+  # tested against the branch it will actually merge into, and a stacked PR
+  # targeting anything but `main` matched nothing here — so #730, thirty commits
+  # of SDK work, ran no unit tests, no build and no lint at all. The only signal
+  # it produced was the daemon cross-compile, and only because it touched
+  # `crates/`. A PR that cannot go red is not a reviewed PR.
   pull_request:
-    branches: [main]
+    branches: [main, feat/fp-cli]
 
 concurrency:
   group: ci-${{ github.ref }}
@@ -257,6 +263,227 @@ jobs:
         if: steps.crates.outputs.present == 'true'
         run: cargo test --workspace
 
+  # The `fp` CLI (PyPI: fp-cloud-cli). The only Python in this repo, and the only job that
+  # tests it — none of the bun/cargo jobs above look at fp-cloud-cli/ at all. It is matrixed
+  # across the Python versions pyproject.toml's requires-python advertises, because
+  # claiming >=3.10 and testing only one of them is how a 3.10 user finds the break.
+  #
+  # That comment was true of the SDK's matrix and not of this one, which ran 3.10
+  # and 3.13 only while the classifiers claimed 3.10–3.13 — so a resolver picking
+  # a different transitive set on 3.11 or 3.12 broke those users with fully green
+  # CI and a wheel whose own metadata said they were supported. All four now, and
+  # `__tests__/ci/fp-cloud-cli-workflows.test.ts` pins the list against the classifiers
+  # so the two cannot drift apart again.
+  fp-cloud-cli:
+    runs-on: ubuntu-latest
+    # a uv sync plus pytest across four interpreters; the bound exists so a stalled
+    # package mirror cannot hold a release for six hours (#726).
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: fp-cloud-cli
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v7.0.1
+
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          cache-dependency-glob: fp-cloud-cli/uv.lock
+
+      - name: Install dependencies
+        run: uv sync --locked --extra dev --python ${{ matrix.python-version }}
+
+      # FP_CLI_REQUIRE_CONTRACT makes test_fp_home_contract.py FAIL rather than skip
+      # when it cannot read src/hooks/fp-home.ts. That file is the register for a
+      # home this CLI writes a credential into, and the assertions against it are
+      # the only thing keeping the two sides from drifting — before they existed, a
+      # rename on either side left both suites green. A guard that can quietly
+      # degrade to a skip is the same guard the SDK's spool contract used to be.
+      - name: Test
+        env:
+          FP_CLI_REQUIRE_CONTRACT: "1"
+        run: uv run pytest tests/ -q
+
+      - name: Build the distribution
+        run: uv build
+
+      # A stale `include = [...]` in [tool.setuptools.packages.find] builds a
+      # SUCCESSFUL but EMPTY wheel — pip installs it and the console script then
+      # ImportErrors. Nothing else in this job would notice, so assert the payload.
+      - name: Verify the wheel actually contains the package
+        run: |
+          python3 - <<'PY'
+          import glob, sys, zipfile
+          wheel = glob.glob("dist/*.whl")[0]
+          names = zipfile.ZipFile(wheel).namelist()
+          modules = [n for n in names if n.startswith("fp_cli/") and n.endswith(".py")]
+          print(f"{wheel}: {len(modules)} modules")
+          if len(modules) < 20:
+              sys.exit(f"wheel looks empty — only {len(modules)} modules under fp_cli/")
+          PY
+
+      # `fp` is the contract users type. Prove the entry point resolves from a clean
+      # install of the built artifact, not from the source tree.
+      - name: Smoke-test the installed console script
+        run: |
+          uv venv /tmp/fp-smoke
+          VIRTUAL_ENV=/tmp/fp-smoke uv pip install dist/*.whl
+          /tmp/fp-smoke/bin/fp --version
+          /tmp/fp-smoke/bin/fp help > /tmp/fp-help.txt
+          if grep -qi agenteye /tmp/fp-help.txt; then
+            echo '::error::retired product name present in the fp help output'
+            exit 1
+          fi
+
+  # The telemetry SDK (PyPI: failproofai-sdk, import failproofai_sdk). Second Python
+  # component, sibling of fp-cloud-cli above, and deliberately its own job: it shares no
+  # lockfile, no dependencies and no release cadence with the CLI.
+  #
+  # The matrix is wider than fp-cloud-cli's two versions on purpose. This package declares
+  # no dependencies at all, so it has no third-party floor quietly constraining which
+  # interpreters it is really exercised on — and it is installed into other people's
+  # agent processes, whose Python version we do not choose. Every version
+  # requires-python advertises is tested.
+  failproofai-sdk:
+    runs-on: ubuntu-latest
+    # the same, across five — every version requires-python advertises; the bound exists so a stalled
+    # package mirror cannot hold a release for six hours (#726).
+    timeout-minutes: 10
+    defaults:
+      run:
+        working-directory: sdk/python
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@v7.0.1
+
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          cache-dependency-glob: sdk/python/uv.lock
+
+      - name: Install dependencies
+        run: uv sync --locked --extra dev --python ${{ matrix.python-version }}
+
+      # FAILPROOFAI_SDK_REQUIRE_CONTRACT makes test_spool_contract.py FAIL rather than
+      # skip when it cannot find crates/fpai-collect or src/hooks/fp-home.ts. Those
+      # assertions are the only check that this SDK writes where the daemon reads, and
+      # a guard that can silently degrade to a skip is not a guard — its predecessor in
+      # the agenteye repo skipped in every CI run for exactly this reason.
+      - name: Test
+        env:
+          FAILPROOFAI_SDK_REQUIRE_CONTRACT: "1"
+        run: uv run pytest tests/ -q
+
+      - name: Build the distribution
+        run: uv build
+
+      # A stale `include = [...]` in [tool.setuptools.packages.find] builds a
+      # SUCCESSFUL but EMPTY wheel — pip installs it and the import then fails.
+      # py.typed goes the same way if package-data stops naming it, and nothing
+      # else in this job would notice either. Assert the payload.
+      - name: Verify the wheel actually contains the package
+        run: |
+          python3 - <<'PY'
+          import glob, sys, zipfile
+          wheel = glob.glob("dist/*.whl")[0]
+          names = zipfile.ZipFile(wheel).namelist()
+          modules = [n for n in names if n.startswith("failproofai_sdk/") and n.endswith(".py")]
+          print(f"{wheel}: {len(modules)} modules")
+          if len(modules) < 7:
+              sys.exit(f"wheel looks empty — only {len(modules)} modules under failproofai_sdk/")
+          if not any(n.endswith("py.typed") for n in names):
+              sys.exit("py.typed is missing from the wheel — the type hints do not count without it")
+          if not any(n.endswith("LICENSE") for n in names):
+              sys.exit("LICENSE is missing from the wheel")
+          PY
+
+      # `--no-deps` is the assertion, not an optimisation. "Zero dependencies" is the
+      # reason this package is safe to drop into someone else's agent, so prove it
+      # against the built artifact rather than the source tree: install it with nothing
+      # else present, emit real events, and read them back off disk.
+      - name: Smoke-test the installed package with no dependencies
+        run: |
+          uv venv /tmp/sdk-smoke
+          VIRTUAL_ENV=/tmp/sdk-smoke uv pip install --no-deps dist/*.whl
+          FAILPROOFAI_HOME=/tmp/sdk-spool /tmp/sdk-smoke/bin/python -c "
+          import failproofai_sdk as s
+          print(s.__version__)
+          s.event.agent_start(session_id='smoke', agent_id='a', goal='ci')
+          s.event.tool_use(session_id='smoke', agent_id='a', tool_name='t', tool_call_id='c')
+          s.event.tool_result(session_id='smoke', agent_id='a', tool_name='t', tool_call_id='c', output='ok')
+          "
+          python3 - <<'PY'
+          import glob, json, sys
+          # $FAILPROOFAI_HOME/custom-agents/events — the `custom-agents` segment
+          # is appended unconditionally by the resolver, which is what makes the
+          # spool impossible to place outside the umbrella.
+          batches = glob.glob("/tmp/sdk-spool/custom-agents/events/*.jsonl")
+          if not batches:
+              sys.exit("the installed wheel wrote no event batch")
+          events = [json.loads(line) for p in batches for line in open(p) if line.strip()]
+          types = {e["type"] for e in events}
+          if types != {"agent_start", "tool_use", "tool_result"}:
+              sys.exit(f"unexpected events from the installed wheel: {sorted(types)}")
+          # Emitted by the artifact, so this also proves the wire format survived
+          # packaging rather than only surviving an in-tree import.
+          if not all("environment" in e for e in events):
+              sys.exit("an event reached disk without the `environment` field")
+          print(f"{len(events)} events written by the installed artifact")
+          PY
+
+  # The adapters' ONLY automated evidence. It is a separate job, not a leg of the
+  # matrix above, because installing five agent frameworks costs minutes and gains
+  # nothing from being repeated across five interpreters — the adapters bind to
+  # framework APIs, not to interpreter version.
+  #
+  # WHY THIS EXISTS: tests/integrations/* already honour
+  # AGENTEYE_TESTS_REQUIRE_FRAMEWORKS, and their comments say "CI leg sets
+  # AGENTEYE_TESTS_REQUIRE_FRAMEWORKS=1". No such leg was ever added, and the
+  # frameworks live in extras that `--extra dev` does not pull, so all four
+  # modules skipped at import in every run: 168 test functions across 6,071 lines,
+  # green, never executed. An adapter could break against a new framework release
+  # and nothing here would say so. That is the same "a guard that can silently
+  # degrade to a skip is not a guard" this file already hardened
+  # test_spool_contract.py against — the integration suites were simply missed.
+  failproofai-sdk-integrations:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    defaults:
+      run:
+        working-directory: sdk/python
+    steps:
+      - uses: actions/checkout@v7.0.1
+
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          cache-dependency-glob: sdk/python/uv.lock
+
+      # Every framework extra. `--locked` keeps this honest: the lockfile already
+      # resolves all five, so a drift here fails rather than silently re-resolving.
+      - name: Install dependencies (all framework extras)
+        run: >-
+          uv sync --locked --extra dev
+          --extra langchain --extra langgraph --extra crewai
+          --extra llamaindex --extra pydantic-ai
+          --python 3.12
+
+      # AGENTEYE_TESTS_REQUIRE_FRAMEWORKS turns each module's import skip into a
+      # hard failure. Without it a botched install above would read as "4 skipped"
+      # and the job would pass having tested nothing — which is exactly the state
+      # this job was added to end.
+      - name: Test the framework adapters
+        env:
+          AGENTEYE_TESTS_REQUIRE_FRAMEWORKS: "1"
+        run: uv run pytest tests/integrations -q
+
   test:
     runs-on: ubuntu-latest
     # The retry above nominally allows 3 attempts x 10 minutes. Capping the job

.github/workflows/osv-scanner.yml

@@ -66,9 +66,19 @@ jobs:
         id: scan
         uses: google/osv-scanner-action/osv-scanner-action@f4cfcc01edc9c8b756a9b873b7a623ca674da51e # v2.3.8
         with:
+          # `--config` is load-bearing, not tidiness. Without it the scanner
+          # resolves a config PER SCANNED FILE, relative to that file — so the
+          # root `osv-scanner.toml` governed `bun.lock` and `Cargo.lock` and
+          # reached neither `uv.lock`. An ignore written for a finding in
+          # `sdk/python/uv.lock` loaded, filtered nothing, and was reported as
+          # an "unused ignore" while the gate stayed red. Naming it once makes
+          # one allow-list authoritative for every lockfile below.
           scan-args: |-
+            --config=osv-scanner.toml
             --lockfile=bun.lock
             --lockfile=Cargo.lock
+            --lockfile=fp-cloud-cli/uv.lock
+            --lockfile=sdk/python/uv.lock
       # Only the schedule run notifies — nothing on main touched the lockfile,
       # so nobody is watching it the way a PR author watches their own checks
       # or a push failure shows up against the commit they just merged. Same