@matt82198/aesop 0.1.0-beta.3 → 0.1.0-beta.5

package/ui/config.py

@@ -0,0 +1,123 @@
+#!/usr/bin/env python3
+"""
+Aesop UI Configuration — Path and environment resolution.
+
+This module centralizes all path configuration, environment variable resolution,
+and config file loading for the UI dashboard. It provides a reload() function to
+recompute all paths when environment changes (e.g., between test fixtures).
+
+Config precedence: env vars > aesop.config.json > built-in defaults.
+"""
+import json
+import os
+import sys
+from pathlib import Path
+
+
+# ==============================================================================
+# Path Resolution Functions
+# ==============================================================================
+
+def reload():
+    """Recompute all configuration from current environment.
+
+    Called at module load and whenever environment changes (test fixtures).
+    Mutates module-level globals in place so that importers see the current state.
+    """
+    global PORT, AESOP_ROOT, CONFIG_FILE, STATE_DIR, TRANSCRIPTS_ROOT
+    global WATCHDOG_HEARTBEAT, MONITOR_HEARTBEAT, REPOS_JSON, BACKUP_LOG
+    global ALERTS_LOG, INBOX_FILE, AUDIT_BACKLOG_FILE
+    global UI_SESSION_TOKEN_FILE, TRACKER_FILE, ORCH_STATUS_FILE
+    global WEB_DIST, LEDGER_FILE
+    global COLLECTOR_INTERVAL, SSE_KEEPALIVE_SECONDS, SSE_MAX_CLIENTS, SSE_QUEUE_MAXSIZE, SSE_WRITE_TIMEOUT
+
+    # PORT: env PORT > default 8770
+    PORT = int(os.getenv("PORT", "8770"))
+
+    # Determine AESOP_ROOT: env AESOP_ROOT > default $HOME/aesop
+    AESOP_ROOT = Path(os.getenv("AESOP_ROOT", Path.home() / "aesop"))
+
+    # Try to load config file for additional settings
+    CONFIG_FILE = AESOP_ROOT / "aesop.config.json"
+    config_data = {}
+    if CONFIG_FILE.exists():
+        try:
+            with open(CONFIG_FILE) as f:
+                config_data = json.load(f)
+        except Exception as e:
+            print(f"[config] Failed to load {CONFIG_FILE}: {e}", file=sys.stderr)
+
+    # Derive paths with precedence: env var > config file > built-in default
+    # STATE_DIR: env AESOP_STATE_ROOT > config state_root > AESOP_ROOT/state
+    STATE_DIR = Path(
+        os.getenv(
+            "AESOP_STATE_ROOT",
+            config_data.get("state_root", str(AESOP_ROOT / "state"))
+        )
+    )
+
+    # TRANSCRIPTS_ROOT: env AESOP_TRANSCRIPTS_ROOT > config transcripts_root > ~/.claude/projects
+    TRANSCRIPTS_ROOT = Path(
+        os.getenv(
+            "AESOP_TRANSCRIPTS_ROOT",
+            config_data.get("transcripts_root", "~/.claude/projects")
+        )
+    ).expanduser()
+
+    # Data file paths (all derived from STATE_DIR and AESOP_ROOT)
+    WATCHDOG_HEARTBEAT = STATE_DIR / ".watchdog-heartbeat"
+    MONITOR_HEARTBEAT = STATE_DIR / ".monitor-heartbeat"
+    REPOS_JSON = STATE_DIR / ".watchdog-repos.json"
+    BACKUP_LOG = STATE_DIR / "FLEET-BACKUP.log"
+    ALERTS_LOG = STATE_DIR / "SECURITY-ALERTS.log"
+    INBOX_FILE = STATE_DIR / "ui-inbox.md"
+    AUDIT_BACKLOG_FILE = AESOP_ROOT / "AUDIT-BACKLOG.md"
+    UI_SESSION_TOKEN_FILE = STATE_DIR / ".ui-session-token"
+    TRACKER_FILE = STATE_DIR / "tracker.json"
+    ORCH_STATUS_FILE = STATE_DIR / "orchestrator-status.json"
+
+    # Wave-14 dashboard rewrite (plan D3): built frontend + cost ledger paths.
+    # WEB_DIST: the committed Vite build output served at / and /assets/*.
+    WEB_DIST = AESOP_ROOT / "ui" / "web" / "dist"
+    # LEDGER_FILE: outcomes ledger parsed by ui/cost.py; sse.py mtime-gates on it.
+    LEDGER_FILE = STATE_DIR / "ledger" / "OUTCOMES-LEDGER.md"
+
+    # Collector and SSE configuration
+    COLLECTOR_INTERVAL = float(os.getenv("AESOP_UI_COLLECT_INTERVAL", "1.0"))
+    SSE_KEEPALIVE_SECONDS = 15
+    SSE_MAX_CLIENTS = 100  # Resource cap: reject new connections past this
+    SSE_QUEUE_MAXSIZE = 50  # Per-client bounded queue (drops oldest on overflow)
+    SSE_WRITE_TIMEOUT = 5.0  # Write timeout in seconds to prevent stalled clients
+
+
+# ==============================================================================
+# Module-level initialization
+# ==============================================================================
+
+# Initialize configuration at module load time
+# These globals are recomputed by reload() and accessed by other modules
+PORT = 8770
+AESOP_ROOT = Path.home() / "aesop"
+CONFIG_FILE = AESOP_ROOT / "aesop.config.json"
+STATE_DIR = AESOP_ROOT / "state"
+TRANSCRIPTS_ROOT = Path("~/.claude/projects").expanduser()
+WATCHDOG_HEARTBEAT = STATE_DIR / ".watchdog-heartbeat"
+MONITOR_HEARTBEAT = STATE_DIR / ".monitor-heartbeat"
+REPOS_JSON = STATE_DIR / ".watchdog-repos.json"
+BACKUP_LOG = STATE_DIR / "FLEET-BACKUP.log"
+ALERTS_LOG = STATE_DIR / "SECURITY-ALERTS.log"
+INBOX_FILE = STATE_DIR / "ui-inbox.md"
+AUDIT_BACKLOG_FILE = AESOP_ROOT / "AUDIT-BACKLOG.md"
+UI_SESSION_TOKEN_FILE = STATE_DIR / ".ui-session-token"
+TRACKER_FILE = STATE_DIR / "tracker.json"
+ORCH_STATUS_FILE = STATE_DIR / "orchestrator-status.json"
+WEB_DIST = AESOP_ROOT / "ui" / "web" / "dist"
+LEDGER_FILE = STATE_DIR / "ledger" / "OUTCOMES-LEDGER.md"
+COLLECTOR_INTERVAL = 1.0
+SSE_KEEPALIVE_SECONDS = 15
+SSE_MAX_CLIENTS = 100
+SSE_QUEUE_MAXSIZE = 50
+SSE_WRITE_TIMEOUT = 5.0
+
+# Perform initial load from environment
+reload()

package/ui/cost.py

@@ -0,0 +1,260 @@
+#!/usr/bin/env python3
+"""Cost/scorecard collector — parse ledger and aggregate costs.
+
+This module provides get_cost_summary() which parses the outcomes ledger
+markdown table and returns per-model, per-day, and overall cost/token aggregations
+with optional pricing estimates.
+
+Ledger format (markdown table):
+  | ISO timestamp | agent_type | model | duration | tokens_in | tokens_out | verdict |
+  | 2026-07-11T22:08:17 | Agent | claude-haiku-4-5-20251001 | 0 | 8 | 186 | OK |
+
+CostSummary JSON shape (returned by get_cost_summary()):
+  {
+    "models": {
+      "model-id": {
+        "runs": int,
+        "tokens_in": int,
+        "tokens_out": int,
+        "verdicts": {"OK": int, "FAILED": int, "EMPTY": int, "HUNG": int}
+      },
+      ...
+    },
+    "daily_totals": {
+      "YYYY-MM-DD": {"tokens_in": int, "tokens_out": int},
+      ...
+    },
+    "overall_scorecard": {
+      "total_runs": int,
+      "ok_count": int,
+      "failed_count": int,
+      "empty_count": int,
+      "hung_count": int,
+      "ok_rate": float (0.0-1.0),
+      "failed_rate": float,
+      "empty_rate": float,
+      "hung_rate": float
+    },
+    "skipped_lines": int,
+    "has_pricing": bool,
+    "estimates_by_model": {
+      "model-id": {
+        "input_cost": float (dollars),
+        "output_cost": float (dollars),
+        "total_cost": float (dollars)
+      },
+      ...
+    }
+  }
+
+Key behavior:
+  - Missing ledger file: returns empty summary with documented shape.
+  - Malformed lines: skipped and counted in skipped_lines field.
+  - Config read at CALL time (not import time) for test isolation.
+  - UTF-8 explicit encoding for all file operations.
+  - No external dependencies (pure stdlib).
+  - Pricing estimates ONLY if aesop.config.json has a "pricing" map.
+"""
+import json
+from pathlib import Path
+
+# Note: import config at module level, but read config.X at CALL time
+# (not at import time) to ensure test-fixture isolation works.
+import config
+
+
+def get_cost_summary():
+    """Parse the outcomes ledger and return cost/token/verdict aggregations.
+
+    Reads from the ledger path exposed by config (config.STATE_DIR/ledger/OUTCOMES-LEDGER.md).
+    Returns an empty summary with documented shape if ledger is missing or empty.
+    Malformed lines are skipped and counted in skipped_lines.
+
+    All config paths are read at call time (not import time) to ensure
+    test-fixture isolation via config.reload().
+
+    Returns:
+        dict: CostSummary with models, daily_totals, overall_scorecard,
+              skipped_lines, has_pricing, estimates_by_model.
+    """
+    # Read ledger path at call time
+    ledger_file = config.STATE_DIR / "ledger" / "OUTCOMES-LEDGER.md"
+
+    # Initialize result structure
+    result = {
+        "models": {},
+        "daily_totals": {},
+        "overall_scorecard": {
+            "total_runs": 0,
+            "ok_count": 0,
+            "failed_count": 0,
+            "empty_count": 0,
+            "hung_count": 0,
+            "ok_rate": 0.0,
+            "failed_rate": 0.0,
+            "empty_rate": 0.0,
+            "hung_rate": 0.0,
+        },
+        "skipped_lines": 0,
+        "has_pricing": False,
+        "estimates_by_model": {},
+    }
+
+    # If ledger file doesn't exist, return empty summary
+    if not ledger_file.exists():
+        return result
+
+    # Read and parse ledger with explicit UTF-8 encoding
+    try:
+        content = ledger_file.read_text(encoding='utf-8')
+    except Exception:
+        # Graceful: if read fails, return empty summary
+        return result
+
+    lines = content.strip().split('\n')
+
+    # Parse each line
+    for line in lines:
+        line = line.strip()
+
+        # Skip empty lines
+        if not line:
+            continue
+
+        # Skip header separator lines (all dashes and pipes) — silently, don't count as skipped
+        if all(c in '|-' for c in line):
+            continue
+
+        # Parse pipe-delimited row
+        if not line.startswith('|') or not line.endswith('|'):
+            result["skipped_lines"] += 1
+            continue
+
+        # Split by pipe and strip whitespace
+        parts = [p.strip() for p in line.split('|')]
+
+        # Markdown tables have empty strings at start and end after split
+        # Format: | col1 | col2 | col3 | col4 | col5 | col6 | col7 |
+        # After split: ['', 'col1', 'col2', 'col3', 'col4', 'col5', 'col6', 'col7', '']
+        if len(parts) < 9:  # Need at least 9 parts (empty + 7 columns + empty)
+            result["skipped_lines"] += 1
+            continue
+
+        # Extract columns (skip leading/trailing empty)
+        try:
+            timestamp = parts[1]  # ISO timestamp
+            agent_type = parts[2]  # "Agent"
+            model = parts[3]
+            duration_str = parts[4]
+            tokens_in_str = parts[5]
+            tokens_out_str = parts[6]
+            verdict = parts[7]
+        except IndexError:
+            result["skipped_lines"] += 1
+            continue
+
+        # Parse numeric fields
+        try:
+            tokens_in = int(tokens_in_str)
+            tokens_out = int(tokens_out_str)
+        except ValueError:
+            result["skipped_lines"] += 1
+            continue
+
+        # Validate verdict
+        if verdict not in ("OK", "FAILED", "EMPTY", "HUNG"):
+            result["skipped_lines"] += 1
+            continue
+
+        # Extract date from ISO timestamp (YYYY-MM-DD)
+        try:
+            date_str = timestamp.split('T')[0]
+        except IndexError:
+            result["skipped_lines"] += 1
+            continue
+
+        # Aggregate by model
+        if model not in result["models"]:
+            result["models"][model] = {
+                "runs": 0,
+                "tokens_in": 0,
+                "tokens_out": 0,
+                "verdicts": {"OK": 0, "FAILED": 0, "EMPTY": 0, "HUNG": 0},
+            }
+
+        result["models"][model]["runs"] += 1
+        result["models"][model]["tokens_in"] += tokens_in
+        result["models"][model]["tokens_out"] += tokens_out
+        result["models"][model]["verdicts"][verdict] += 1
+
+        # Aggregate by date
+        if date_str not in result["daily_totals"]:
+            result["daily_totals"][date_str] = {"tokens_in": 0, "tokens_out": 0}
+
+        result["daily_totals"][date_str]["tokens_in"] += tokens_in
+        result["daily_totals"][date_str]["tokens_out"] += tokens_out
+
+        # Count for overall scorecard
+        result["overall_scorecard"]["total_runs"] += 1
+        if verdict == "OK":
+            result["overall_scorecard"]["ok_count"] += 1
+        elif verdict == "FAILED":
+            result["overall_scorecard"]["failed_count"] += 1
+        elif verdict == "EMPTY":
+            result["overall_scorecard"]["empty_count"] += 1
+        elif verdict == "HUNG":
+            result["overall_scorecard"]["hung_count"] += 1
+
+    # Calculate rates
+    total = result["overall_scorecard"]["total_runs"]
+    if total > 0:
+        result["overall_scorecard"]["ok_rate"] = result["overall_scorecard"]["ok_count"] / total
+        result["overall_scorecard"]["failed_rate"] = result["overall_scorecard"]["failed_count"] / total
+        result["overall_scorecard"]["empty_rate"] = result["overall_scorecard"]["empty_count"] / total
+        result["overall_scorecard"]["hung_rate"] = result["overall_scorecard"]["hung_count"] / total
+
+    # Load pricing config at call time and compute estimates
+    pricing_map = _load_pricing_config()
+    if pricing_map:
+        result["has_pricing"] = True
+        for model, stats in result["models"].items():
+            if model in pricing_map:
+                pricing = pricing_map[model]
+                input_price = pricing.get("input_per_mtok", 0.0)
+                output_price = pricing.get("output_per_mtok", 0.0)
+
+                # Calculate costs: (tokens / 1_000_000) * price_per_mtok
+                input_cost = (stats["tokens_in"] * input_price) / 1_000_000
+                output_cost = (stats["tokens_out"] * output_price) / 1_000_000
+                total_cost = input_cost + output_cost
+
+                result["estimates_by_model"][model] = {
+                    "input_cost": input_cost,
+                    "output_cost": output_cost,
+                    "total_cost": total_cost,
+                }
+
+    return result
+
+
+def _load_pricing_config():
+    """Load pricing map from aesop.config.json at call time.
+
+    Returns:
+        dict or None: pricing map {model: {input_per_mtok: float, output_per_mtok: float}}
+                      or None if no pricing config found.
+    """
+    # Read config file at call time (not import time)
+    config_file = config.CONFIG_FILE
+
+    if not config_file.exists():
+        return None
+
+    try:
+        with open(config_file, encoding='utf-8') as f:
+            config_data = json.load(f)
+    except Exception:
+        # Graceful: if config read fails, no pricing
+        return None
+
+    return config_data.get("pricing", None)

package/ui/csrf.py

@@ -0,0 +1,144 @@
+#!/usr/bin/env python3
+"""
+Aesop UI CSRF Protection — Token generation and validation.
+
+Session token is generated once at startup and persisted to state/.ui-session-token (0600).
+Token is used to validate mutations via /submit POST endpoint.
+
+CRITICAL: This module reads config paths LIVE at call time via 'import config',
+never 'from config import <path>'. This ensures paths are recomputed when
+config.reload() is called (e.g., between test fixtures).
+"""
+import os
+import secrets
+import sys
+from pathlib import Path
+
+# Must import config module, never "from config import <paths>"
+import config
+
+
+# Module-level session token (set by init())
+SESSION_TOKEN = None
+
+
+def init():
+    """Initialize CSRF protection: generate or load the per-session token.
+
+    This should be called once at startup (after config.reload()).
+    Token is persisted to state/.ui-session-token (mode 0600) and reused
+    across server restarts.
+
+    SECURITY: File is created atomically with restricted permissions using
+    os.open(O_CREAT|O_EXCL) to avoid TOCTOU window where file exists with
+    world-readable permissions.
+    """
+    global SESSION_TOKEN
+    SESSION_TOKEN = _generate_session_token()
+
+
+def _generate_session_token():
+    """Generate or load the per-session CSRF token.
+
+    Token is generated once at startup and persisted to state/.ui-session-token (mode 0600).
+    Subsequent calls return the same token (in-memory).
+
+    SECURITY: File is created atomically with restricted permissions using os.open(O_CREAT|O_EXCL)
+    to avoid TOCTOU window where file exists with world-readable permissions.
+
+    Returns:
+        str: 43-character base64-like random token (256 bits / 3 bytes per char = ~43 chars)
+    """
+    # LIVE CONFIG READ: access config.UI_SESSION_TOKEN_FILE at call time
+    token_file = config.UI_SESSION_TOKEN_FILE
+
+    # Check if token file exists and is readable
+    if token_file.exists():
+        try:
+            token = token_file.read_text().strip()
+            if token and len(token) >= 32:
+                return token
+        except Exception as e:
+            print(f"[csrf] Failed to read token file: {e}", file=sys.stderr)
+
+    # Generate new token: 32 random bytes → 43-char base64-like string
+    token = secrets.token_urlsafe(32)
+
+    # Persist to file with restricted permissions (0600) using atomic creation
+    try:
+        # LIVE CONFIG READ: access config.STATE_DIR at call time
+        config.STATE_DIR.mkdir(parents=True, exist_ok=True)
+
+        # Atomically create file with 0600 permissions using os.open with O_CREAT|O_EXCL.
+        # This ensures the file is never world-readable (no TOCTOU window).
+        # On Windows, mode bits are largely ignored, which is fine.
+        try:
+            fd = os.open(
+                str(token_file),
+                os.O_CREAT | os.O_EXCL | os.O_WRONLY,
+                0o600
+            )
+            # Write token via the file descriptor (no separate chmod needed)
+            with os.fdopen(fd, 'w') as f:
+                f.write(token)
+        except FileExistsError:
+            # File already exists (race condition or previous run).
+            # Try to read it and use that token instead.
+            try:
+                token = token_file.read_text().strip()
+                if token and len(token) >= 32:
+                    return token
+            except Exception as e:
+                print(f"[csrf] Failed to read existing token file: {e}", file=sys.stderr)
+            # If we can't read the existing file, fall back to in-memory token
+    except Exception:
+        pass  # Fail-open: token exists in memory even if file write fails
+
+    return token
+
+
+def validate_csrf_request(headers):
+    """Validate CSRF protections on /submit POST request.
+
+    Performs two checks:
+    1. Origin/Referer validation: if Origin or Referer header is present, must be local
+       (http[s]://127.0.0.1:<port>, http[s]://localhost:<port>, http[s]://[::1]:<port>)
+    2. X-Aesop-Token validation: must match SESSION_TOKEN
+
+    Args:
+        headers: dict-like object with HTTP headers (case-insensitive)
+
+    Returns:
+        tuple: (is_valid: bool, reason: str or None)
+        - (True, None) if CSRF checks pass
+        - (False, reason) if either check fails
+    """
+    # Check 1: Origin/Referer header validation
+    origin = headers.get("Origin", "").strip()
+    referer = headers.get("Referer", "").strip()
+
+    # If Origin or Referer is present, validate it's local
+    if origin or referer:
+        check_value = origin or referer
+        # Check if it's a local origin: http[s]://127.0.0.1:<PORT>, http[s]://localhost:<PORT>,
+        # or http[s]://[::1]:<PORT> (both http:// and https:// schemes accepted for same hosts)
+        is_local = (
+            check_value.startswith("http://127.0.0.1:") or
+            check_value.startswith("https://127.0.0.1:") or
+            check_value.startswith("http://localhost:") or
+            check_value.startswith("https://localhost:") or
+            check_value.startswith("http://[::1]:") or  # IPv6 localhost
+            check_value.startswith("https://[::1]:")  # IPv6 localhost HTTPS
+        )
+        if not is_local:
+            return (False, "Foreign Origin/Referer rejected")
+
+    # Check 2: X-Aesop-Token validation
+    token = headers.get("X-Aesop-Token", "").strip()
+    if not token:
+        return (False, "Missing X-Aesop-Token header")
+
+    if token != SESSION_TOKEN:
+        return (False, "Invalid X-Aesop-Token")
+
+    return (True, None)