Skip to content

Commit c31996c

Browse files
chiruu12chiruu12
committed
Release 0.5.1: sync main to dev tip
Prefer origin/dev for conflicted paths left by the 0.5.0 rebase onto main.
2 parents ba73a5e + 87ad25e commit c31996c

62 files changed

Lines changed: 1918 additions & 194 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/actions/unplug-scan/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ jobs:
2727
with:
2828
base-ref: main
2929
install-mode: pypi
30-
unplug-version: ">=0.4.0,<0.5"
30+
unplug-version: ">=0.5.0,<0.6"
3131
```
3232
3333
## Inputs
@@ -38,7 +38,7 @@ jobs:
3838
| `python-version` | `3.12` | Python version |
3939
| `working-directory` | `sdk` | Path to SDK tree when `install-mode: local` |
4040
| `install-mode` | `local` | `local` (uv sync) or `pypi` (install from PyPI) |
41-
| `unplug-version` | `>=0.4.0,<0.5` | Version constraint for PyPI install |
41+
| `unplug-version` | `>=0.5.0,<0.6` | Version constraint for PyPI install |
4242

4343
## What gets scanned
4444

‎.github/workflows/ci.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,14 +21,14 @@ jobs:
2121
run:
2222
working-directory: sdk
2323
steps:
24-
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
24+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
2525

2626
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
2727
with:
2828
enable-cache: true
2929
version: "0.6.14"
3030

31-
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
31+
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
3232
with:
3333
python-version: ${{ matrix.python-version }}
3434

‎.github/workflows/integrations-live.yml‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -74,26 +74,32 @@ jobs:
7474
enable-cache: true
7575
version: "0.6.14"
7676

77-
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
77+
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
7878
with:
7979
python-version: "3.12"
8080

81-
- name: Install (one framework extra in isolation)
82-
run: uv sync --extra dev --extra ${{ matrix.extra }}
81+
- name: Install (fresh per-framework resolution — matches `pip install "unplug-ai[extra]"`)
82+
# Deliberately NOT `uv sync` from the unified lock: that lock co-resolves
83+
# every extra together and pins some frameworks down to old, broken
84+
# releases (e.g. semantic-kernel 1.15, which imports `Url` from
85+
# `pydantic.networks` — gone in Pydantic v2). A user never installs all
86+
# frameworks at once; they run `pip install "unplug-ai[langgraph]"`, which
87+
# resolves that one framework freshly. We mirror that here.
88+
run: |
89+
uv venv
90+
uv pip install -e ".[dev,${{ matrix.extra }}]"
8391
8492
- name: Live integration test
8593
run: |
8694
set +e
87-
uv run pytest -q -m requires_integrations ${{ matrix.test }}
95+
.venv/bin/python -m pytest -q -m requires_integrations ${{ matrix.test }}
8896
rc=$?
8997
set -e
90-
# Exit 5 = pytest collected nothing because the module self-skipped:
91-
# the framework installed but is unimportable under our pinned deps
92-
# (e.g. an upstream release incompatible with our Pydantic v2). That is
93-
# an upstream conflict, not an Unplug regression — surface it loudly but
94-
# don't block. Real test failures (exit 1) still fail the job.
98+
# Exit 5 = the module self-skipped: the framework is unimportable even
99+
# under a fresh resolution (a genuine upstream break). Surface it loudly
100+
# but don't block the release. Real test failures (exit 1) still fail.
95101
if [ "$rc" -eq 5 ]; then
96-
echo "::warning title=Live integration skipped::${{ matrix.extra }} installed but its live tests were skipped (framework unimportable under current deps). Tolerated; not blocking."
102+
echo "::warning title=Live integration skipped::${{ matrix.extra }} installed but its live tests were skipped (framework unimportable under a fresh resolution). Tolerated; not blocking."
97103
exit 0
98104
fi
99105
exit $rc

‎.github/workflows/pr-scan.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
scan:
1818
runs-on: ubuntu-latest
1919
steps:
20-
- uses: actions/checkout@v6
20+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
2121
with:
2222
fetch-depth: 0
2323

‎.github/workflows/publish-pypi.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,14 +20,14 @@ jobs:
2020
run:
2121
working-directory: sdk
2222
steps:
23-
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
23+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
2424

2525
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
2626
with:
2727
enable-cache: true
2828
version: "0.6.14"
2929

30-
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
30+
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
3131
with:
3232
python-version: "3.12"
3333

‎.github/workflows/reusable-agent-scan.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626
scan:
2727
runs-on: ubuntu-latest
2828
steps:
29-
- uses: actions/checkout@v6
29+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
3030
with:
3131
fetch-depth: 0
3232

‎CHANGELOG.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,34 @@
22

33
All notable changes to the `unplug-ai` SDK.
44

5+
## [0.5.1] — 2026-07-20
6+
7+
### Fixed
8+
9+
- Python 3.13: `unplug-ai[ml]` / `[all]` install without a Rust toolchain — widen `transformers` constraint to `>=4.44,<5.13` so `tokenizers` resolves to a cp313 wheel (was pinned via `transformers>=4.44,<4.45` → `tokenizers==0.19.1`)
10+
11+
### Security
12+
13+
- Pin bundled model catalog to immutable Hugging Face commit SHAs under `Unplug-AI/`; drop unpublished medium/large tiers that pointed at a non-existent org
14+
15+
### Added
16+
17+
- Beginner onboarding: [`sdk/docs/GETTING_STARTED.md`](sdk/docs/GETTING_STARTED.md) (5-minute path)
18+
- Agent-host guide: [`sdk/docs/AGENT_ACTIONS.md`](sdk/docs/AGENT_ACTIONS.md) (ALLOW / REVIEW / BLOCK + `ApprovalProvider`)
19+
- `HookDecision.needs_review` and `HookDecision.is_block` helpers for integration adapters
20+
- Stable public API facades under `unplug.api.*` for policy, privacy, cache,
21+
boundaries, normalization, encoding, and ML runtime imports used by server/MCP
22+
dependents ([`sdk/docs/PUBLIC_API.md`](sdk/docs/PUBLIC_API.md))
23+
24+
### Changed
25+
26+
- Integrations hub: pick-your-path table, PyPI doc links, REVIEW vs BLOCK section
27+
- `unplug-audit --probes` skips FP/encoding batteries when ML is inactive (boundary probes still run); clearer CLI hints
28+
- `unplug.example.toml`: ML settings commented by default (regex-only copy-paste safe)
29+
- PyPI `Documentation` URL points to Getting Started; `scan_context_file` tuple examples fixed in READMEs
30+
- `unplug-scan-action` default version pin bumped to `>=0.5.0,<0.6`
31+
- `CONTRIBUTING.md`: full framework extras table
32+
533
## [0.5.0] — 2026-06-27
634

735
### Added

‎CONTRIBUTING.md‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ uv sync --all-extras --dev # everything, including optional extras
1414
uv sync --dev
1515
```
1616

17-
3. Optional extras map to scanner features — install only what you touch:
17+
3. Optional extras map to scanner features and integrations — install only what you touch:
1818

1919
| Extra | Enables |
2020
|-------|---------|
@@ -24,6 +24,28 @@ uv sync --dev
2424
| `litellm` | LLM judge for borderline cases |
2525
| `haystack` | Haystack RAG integration |
2626
| `scrape` | Firecrawl content provider |
27+
| `langgraph` | LangGraph node hooks |
28+
| `langchain` | LangChain Runnable + callback hooks |
29+
| `openai-agents` | OpenAI Agents SDK guardrails |
30+
| `google-adk` | Google ADK before-model / before-tool callbacks |
31+
| `smolagents` | smolagents task + final-answer checks |
32+
| `crewai` | CrewAI task/output guards |
33+
| `autogen` | Microsoft AutoGen AgentChat hooks |
34+
| `ag2` | AG2 (community AutoGen fork) hooks |
35+
| `agno` | Agno pre/post run hooks |
36+
| `dspy` | DSPy module guards |
37+
| `strands` | Strands Agents hook provider |
38+
| `letta` | Letta message guards |
39+
| `griptape` | Griptape before/after run hooks |
40+
| `atomic-agents` | Atomic Agents schema guards (Python ≥3.12) |
41+
| `llama-index` | LlamaIndex node postprocessor |
42+
| `pydantic-ai` | Pydantic AI validators |
43+
| `semantic-kernel` | Semantic Kernel filters |
44+
| `mcp` | MCP client-side tooling tests |
45+
| `integrations` | **Meta-extra:** all framework extras above |
46+
| `all` | ML + presidio + yara + scrape + haystack + litellm |
47+
48+
Integration guides: [`sdk/integrations/README.md`](sdk/integrations/README.md). New contributor docs: [`sdk/docs/GETTING_STARTED.md`](sdk/docs/GETTING_STARTED.md), [`sdk/docs/AGENT_ACTIONS.md`](sdk/docs/AGENT_ACTIONS.md).
2749

2850
4. Verify your environment: `make check` (lint + format + tests).
2951

@@ -52,6 +74,7 @@ GitHub Actions runs on every PR to `dev` ([`.github/workflows/ci.yml`](.github/w
5274
2. **Tests** — full pytest suite (`pytest -q`)
5375
3. **Exfil demo gate** — `test_exfil_demo_integration.py` + `sdk/examples/agent_exfil_demo.py`
5476
4. **Security regression** — explicit subset (adversarial, encodings, secrets, agent hardening, etc.)
77+
5. **Coverage** — SDK coverage report with an 80% minimum gate (`make test-cov`)
5578

5679
## Local checks (SDK)
5780

@@ -65,6 +88,9 @@ make check
6588
# Exact CI parity before PR (includes exfil demo + security subset)
6689
make check-ci
6790

91+
# Coverage report and 80% minimum gate
92+
make test-cov
93+
6894
# Auto-fix formatting and safe lint fixes
6995
make fix
7096

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,8 @@ On the neuralchemy prompt-injection set, regex-only detection reaches **F1 0.56
8383

8484
See [sdk/README.md](sdk/README.md) for config (`unplug.toml`), `unplug-audit`, and dev gates (`make check`, `make check-ci`).
8585

86+
**New to Unplug?** [`sdk/docs/GETTING_STARTED.md`](sdk/docs/GETTING_STARTED.md) · **Agent hosts:** [`sdk/docs/AGENT_ACTIONS.md`](sdk/docs/AGENT_ACTIONS.md)
87+
8688
## Development
8789

8890
```bash

‎sdk/Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ test:
5656
uv run pytest -v
5757

5858
test-cov:
59-
uv run pytest -q -m "not requires_docker and not slow" --cov=unplug --cov-report=xml:coverage.xml --cov-report=term --cov-fail-under=75 --junitxml=pytest.xml
59+
uv run pytest -q -m "not requires_docker and not slow" --cov=unplug --cov-report=xml:coverage.xml --cov-report=term --cov-fail-under=80 --junitxml=pytest.xml
6060

6161
test-security:
6262
uv run pytest tests/security tests/unit/core/agent/test_agent_hardening.py -v

0 commit comments

Comments
 (0)