@senpi/runtime 3.0.9-dev.20260710204324 → 3.0.9-dev.feat-strategy-compos.20260716233548

package/dist/composer/verbs/_box.py

@@ -0,0 +1,308 @@
+"""_box — the on-box consumer seams shared by ``close`` and ``status`` (slice B1).
+
+Both verbs reach OFF the composer's own artifacts into things the frozen runtime owns:
+the ``openclaw senpi runtime …`` CLI and the Senpi MCP server. Every one of those touch
+points is an INJECTABLE SEAM (mirroring ``install.py``'s ``create_fn``) so the whole slice
+is tested without a box or network — tests fake the seam, production wires the default.
+
+Three seams live here:
+
+    ``ListFn``   — ``() -> list[Runtime]``. Default: parse ``openclaw senpi runtime list``.
+    ``DeleteFn`` — ``(runtime_id, wallet) -> CliResult``. Default: ``openclaw senpi runtime delete``.
+    ``McpFn``    — ``(tool, **args) -> dict``. Default: a tiny stdlib streamable-HTTP client. The
+                   tools asked of it: ``strategy_list`` + ``strategy_close`` (close, B1), plus
+                   ``account_get_portfolio`` (balance preflight) + ``strategy_create_custom_strategy``
+                   (create/fund the wallet) for ``fund`` (B3). Creds from
+                   ``SENPI_AUTH_TOKEN`` / ``SENPI_API_KEY`` / ``SENPI_MCP_URL``; LOUD when absent.
+
+The default impls run ONLY in production (the seam-faking tests never reach them), exactly
+like ``install._default_create``.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import subprocess
+from dataclasses import dataclass
+from typing import Any, Callable, Optional
+
+# Non-terminal strategy statuses — filtered server-side so a strategy_list stays small
+# (never pull a long CLOSED/FAILED history). Mirrors senpi-strategy-ops _cli/close.py.
+LIVE_STATUSES = [
+    "ACTIVE", "PAUSED", "CREATE_WALLET", "FUND_WALLET", "INITIALIZE_POSITIONS",
+    "SUBSCRIBE_TRADER", "CLOSING_POSITIONS",
+]
+# Terminal statuses — a strategy here is already done; never re-submit strategy_close.
+CLOSED_STATUSES = ("CLOSED", "INACTIVE", "CLOSING_DONE", "TERMINATED", "FAILED")
+
+
+# --------------------------------------------------------------------------- CLI seam result
+
+@dataclass
+class CliResult:
+    """What an ``openclaw`` shell-out returned; the seam yields this so callers read exit
+    code + text without knowing HOW it was produced (mirrors install.CreateResult)."""
+
+    returncode: int
+    stdout: str = ""
+    stderr: str = ""
+
+    @property
+    def ok(self) -> bool:
+        return self.returncode == 0
+
+    @property
+    def text(self) -> str:
+        return f"{self.stdout}\n{self.stderr}"
+
+
+# A runtime row as the seam yields it: {"name", "wallet", "status", "source"} (tolerant).
+Runtime = dict
+
+ListFn = Callable[[], list[Runtime]]
+DeleteFn = Callable[[str, str], CliResult]
+McpFn = Callable[..., Any]
+
+
+# --------------------------------------------------------------------------- MCP errors
+
+class McpError(Exception):
+    """A JSON-RPC / tool-level MCP failure — never a silent None (a renamed or failed tool
+    must surface, not masquerade as 'no data'). Mirrors senpi-strategy-ops mcp_client.MCPError."""
+
+
+class McpCredsMissing(McpError):
+    """SENPI_API_KEY / SENPI_MCP_URL not set — raised BEFORE any network so the close verb
+    can map it to a loud, teaching-shaped CMP223 rather than a bare transport error."""
+
+
+# --------------------------------------------------------------------------- wallet matching
+
+def wallet_match(a: Optional[str], b: Optional[str]) -> bool:
+    """Compare two wallet strings, tolerating the truncated ``0xabc…wxyz`` / ``0xabc...wxyz``
+    form ``runtime list`` prints in a TTY (full addresses when piped). Case-insensitive.
+    Ported from senpi-strategy-ops _cli.wallet_match."""
+    if not a or not b:
+        return False
+    a, b = str(a).strip().lower(), str(b).strip().lower()
+    if a == b:
+        return True
+    for x, y in ((a, b), (b, a)):
+        for sep in ("...", "…"):
+            if sep in x:
+                pre, _, suf = x.partition(sep)
+                if pre and suf and y.startswith(pre) and y.endswith(suf):
+                    return True
+    return False
+
+
+# --------------------------------------------------------------------------- runtime-list default
+
+_ANSI = re.compile(r"\x1b\[[0-9;?]*[A-Za-z]")
+
+
+def parse_runtime_list(text: str) -> list[Runtime]:
+    """Parse the ``openclaw senpi runtime list`` text table (id / wallet / source / status).
+
+    ``runtime list`` has no ``--json`` passthrough (senpi-commands.ts prints a tab table), so
+    the text is the interface. Columns are tab- or 2+-space-separated; the header row starts
+    with ``id`` and carries ``wallet`` + ``status``. Tolerant of ANSI + a 'No runtimes' line."""
+    rows: list[Runtime] = []
+    seen_header = False
+    for raw in text.splitlines():
+        line = _ANSI.sub("", raw).strip()
+        if not line:
+            continue
+        low = line.lower()
+        if not seen_header:
+            if low.startswith("id") and "status" in low and "wallet" in low:
+                seen_header = True
+            continue
+        if "no runtimes" in low:
+            break
+        parts = [p for p in re.split(r"\s{2,}|\t+", line) if p]
+        if len(parts) >= 2:
+            rows.append({
+                "name": parts[0],
+                "wallet": parts[1],
+                "source": parts[2] if len(parts) > 2 else None,
+                "status": parts[-1],
+            })
+    return rows
+
+
+def runtime_running(rt: Runtime) -> bool:
+    """True when a runtime row reports a live/running process status."""
+    s = str(rt.get("status") or "").strip().lower()
+    return s in ("running", "active", "live", "ok", "true", "healthy", "degraded")
+
+
+def _run_cli(args: list[str], timeout: int = 60) -> CliResult:
+    """Shell out; SENPI_LOG_LEVEL=error keeps the plugin's stdout info logs from corrupting
+    parseable output (mirrors senpi-strategy-ops _cli.run_cli)."""
+    env = dict(os.environ, SENPI_LOG_LEVEL="error")
+    openclaw = os.environ.get("OPENCLAW_BIN", "openclaw")
+    argv = [openclaw if a == "openclaw" else a for a in args]
+    try:
+        p = subprocess.run(  # noqa: S603 — fixed argv, no shell
+            argv, capture_output=True, text=True, timeout=timeout, env=env,
+        )
+        return CliResult(p.returncode, p.stdout or "", p.stderr or "")
+    except FileNotFoundError:
+        return CliResult(-1, "", f"command not found: {argv[0]}")
+    except subprocess.TimeoutExpired:
+        return CliResult(-1, "", f"timed out after {timeout}s: {' '.join(argv)}")
+
+
+def default_list_runtimes() -> list[Runtime]:
+    """Production ListFn seam: ``openclaw senpi runtime list`` → parsed rows (empty on error —
+    the runtime registry simply isn't visible from a box without openclaw)."""
+    res = _run_cli(["openclaw", "senpi", "runtime", "list"])
+    return parse_runtime_list(res.stdout) if res.ok else []
+
+
+def default_delete_runtime(runtime_id: str, wallet: str) -> CliResult:
+    """Production DeleteFn seam: shell out to the FROZEN ``openclaw senpi runtime delete``
+    consumer (senpi-commands.ts:110). ``--address`` scopes the delete to the bound wallet."""
+    args = ["openclaw", "senpi", "runtime", "delete"]
+    if runtime_id:
+        args += ["--id", runtime_id]
+    if wallet:
+        args += ["--address", wallet]
+    return _run_cli(args, timeout=60)
+
+
+# --------------------------------------------------------------------------- MCP default client
+
+_MCP_PROTOCOL = "2025-03-26"
+_SUBMIT_TIMEOUT = 60
+
+
+def default_mcp_call(tool: str, timeout: int = 30, **arguments: Any) -> Any:
+    """Production McpFn seam: a tiny stdlib streamable-HTTP MCP client (strategy_list +
+    strategy_close for close; account_get_portfolio + strategy_create_custom_strategy for fund).
+    Creds from ``SENPI_AUTH_TOKEN`` / ``SENPI_API_KEY`` (that
+    precedence — the SAME resolution the runtime's scanner-launcher uses,
+    src/runtime-api/intake/scanner-launcher.ts:201-205; real boxes set SENPI_AUTH_TOKEN, which
+    is all the legacy ops mcp_client.py read) plus ``SENPI_MCP_URL``; a missing cred raises
+    :class:`McpCredsMissing` BEFORE any network so ``close`` can teach it as CMP223."""
+    import http.client
+    import itertools
+    import json as _json
+    from urllib.parse import urlsplit
+
+    api_key = (
+        os.environ.get("SENPI_AUTH_TOKEN", "").strip()
+        or os.environ.get("SENPI_API_KEY", "").strip()
+    )
+    url = os.environ.get("SENPI_MCP_URL", "").strip() or "https://mcp.prod.senpi.ai/mcp"
+    if not api_key:
+        raise McpCredsMissing(
+            "Neither SENPI_AUTH_TOKEN nor SENPI_API_KEY is set — cannot reach the Senpi "
+            "MCP server for strategy_list / strategy_close."
+        )
+
+    ids = itertools.count(1)
+
+    def _post(body: dict, sid: Optional[str]) -> tuple[int, bytes, str, Optional[str]]:
+        parts = urlsplit(url)
+        scheme = parts.scheme
+        host = parts.hostname or ""
+        port = parts.port or (443 if scheme == "https" else 80)
+        path = (parts.path or "/") + (("?" + parts.query) if parts.query else "")
+        data = _json.dumps(body).encode("utf-8")
+        hdrs = {
+            "Host": parts.netloc,
+            "Content-Type": "application/json",
+            "Accept": "application/json, text/event-stream",
+            "Content-Length": str(len(data)),
+            "Authorization": f"Bearer {api_key}",
+        }
+        if sid:
+            hdrs["Mcp-Session-Id"] = sid
+        cls = http.client.HTTPSConnection if scheme == "https" else http.client.HTTPConnection
+        conn = cls(host, port, timeout=timeout)
+        try:
+            conn.request("POST", path, body=data, headers=hdrs)
+            resp = conn.getresponse()
+            raw = resp.read()
+            return resp.status, raw, (resp.getheader("Content-Type") or ""), resp.getheader("Mcp-Session-Id")
+        finally:
+            try:
+                conn.close()
+            except Exception:  # noqa: BLE001
+                pass
+
+    def _parse(raw: bytes, content_type: str) -> dict:
+        text = raw.decode("utf-8", errors="replace")
+        if "text/event-stream" in content_type.lower():
+            for line in text.splitlines():
+                line = line.strip()
+                if line.startswith("data:"):
+                    payload = line[5:].strip()
+                    if payload and payload != "[DONE]":
+                        try:
+                            obj = _json.loads(payload)
+                            if isinstance(obj, dict):
+                                return obj
+                        except _json.JSONDecodeError:
+                            continue
+            return {}
+        try:
+            obj = _json.loads(text) if text else {}
+            return obj if isinstance(obj, dict) else {"result": obj}
+        except _json.JSONDecodeError:
+            return {}
+
+    def _unwrap(rpc: dict) -> Any:
+        if rpc.get("error"):
+            err = rpc["error"]
+            raise McpError(
+                f"JSON-RPC error {err.get('code')}: {err.get('message')}"
+                if isinstance(err, dict) else str(err)
+            )
+        result = rpc.get("result")
+        if not isinstance(result, dict):
+            return result
+        content = result.get("content")
+        payload = None
+        if isinstance(content, list) and content:
+            first = content[0]
+            if isinstance(first, dict) and "text" in first:
+                payload = first["text"]
+        if result.get("isError"):
+            raise McpError(f"tool error: {str(payload)[:300]}")
+        if payload is not None:
+            try:
+                doc = _json.loads(payload)
+            except (_json.JSONDecodeError, TypeError):
+                return result
+            if isinstance(doc, dict) and doc.get("success") is False:
+                e = doc.get("error") or {}
+                raise McpError(
+                    f"tool failed: {e.get('code')}: {e.get('message')}"
+                    if isinstance(e, dict) else f"tool failed: {e}"
+                )
+            return doc
+        return result
+
+    # initialize handshake (streamable-http), then tools/call.
+    init = {
+        "jsonrpc": "2.0", "id": next(ids), "method": "initialize",
+        "params": {"protocolVersion": _MCP_PROTOCOL, "capabilities": {},
+                   "clientInfo": {"name": "composer", "version": "1.0.0"}},
+    }
+    status, _raw, _ct, sid = _post(init, None)
+    if status >= 400:
+        raise McpError(f"initialize HTTP {status}")
+    _post({"jsonrpc": "2.0", "method": "notifications/initialized", "params": {}}, sid)
+
+    call = {
+        "jsonrpc": "2.0", "id": next(ids), "method": "tools/call",
+        "params": {"name": tool, "arguments": arguments},
+    }
+    status, raw, ct, _sid = _post(call, sid)
+    if status >= 400:
+        raise McpError(f"{tool} HTTP {status}")
+    return _unwrap(_parse(raw, ct))

package/dist/composer/verbs/check.py

@@ -0,0 +1,254 @@
+"""check — ONE verdict aggregating the whole build gate (D7).
+
+``composer check <graph.yaml>`` collapses everything that must be true before a graph is
+deployable into a single GREEN/RED verdict, run as ordered stages that short-circuit:
+
+    validate         schema + graph-semantic + pure_fn PURITY checks (the teaching validator).
+    pure_fn_tests    the pure_fn inline fixture tests (CMP05x), reported as their own stage.
+    compile          deterministic materialization to scan.py on the external_scanner contract.
+    smoke            import the emitted module + run one scan() tick over a stub ctx (liveness).
+    runtime_validate PROTECTION policy (CMP120) + the REAL Zod+DSL oracle over the emitted
+                     runtime.yaml (CMP1xx). Protection-by-default is enforced HERE: an unmanaged
+                     unit with no explicit opt-out is RED. The Zod oracle needs a built dist/; when
+                     absent (CI without `npm run build`) it is noted SKIPPED, not RED — the policy
+                     layer still gates. Opt-out (`unmanaged=true`) is GREEN with a loud warning.
+
+The validator runs purity AND the inline fixture tests in one pass, so rather than re-run
+them we PARTITION that single run's errors: CMP05x (inline-test) findings become the
+``pure_fn_tests`` stage; everything else is the ``validate`` stage. A stage is SKIPPED once
+an earlier stage is RED (compiling an invalid graph, or smoking a graph that won't compile,
+would only produce noise). The verdict is GREEN iff every stage is GREEN.
+
+The result is both human-rendered and ``--json`` (verdict + per-stage status + located
+errors). ``deploy`` consumes this object directly as its hard gate; the compiled source is
+carried on the result so ``deploy`` need not recompile.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Optional
+
+from composer.compiler import CompileError, compile_text
+from composer.validator import validate_text
+from composer.validator.errors import TeachingError
+from composer.validator.loader import load_graph
+
+from .runtime_validate import check_runtime_unit
+from .smoke import SmokeError, run_smoke
+
+# Inline pure_fn fixture-test error codes (partitioned into their own stage).
+_PURE_FN_TEST_CODES = {"CMP050", "CMP051", "CMP052"}
+
+GREEN = "GREEN"
+RED = "RED"
+SKIPPED = "SKIPPED"
+
+
+@dataclass
+class Stage:
+    name: str
+    status: str = SKIPPED
+    errors: list[TeachingError] = field(default_factory=list)
+    # free-text findings for stages that don't produce TeachingErrors (compile / smoke)
+    messages: list[str] = field(default_factory=list)
+    detail: Optional[dict] = None
+
+    def to_json(self) -> dict:
+        out: dict = {
+            "stage": self.name,
+            "status": self.status,
+            "errors": [e.to_dict() for e in self.errors],
+        }
+        if self.messages:
+            out["messages"] = list(self.messages)
+        if self.detail is not None:
+            out["detail"] = self.detail
+        return out
+
+
+@dataclass
+class CheckResult:
+    source: str
+    stages: list[Stage]
+    scan_source: Optional[str] = None  # the emitted scan.py when compile succeeded
+    runtime_source: Optional[str] = None  # the emitted runtime.yaml when runtime_validate ran
+
+    @property
+    def verdict(self) -> str:
+        return GREEN if all(s.status == GREEN for s in self.stages) else RED
+
+    @property
+    def ok(self) -> bool:
+        return self.verdict == GREEN
+
+    def to_json(self) -> dict:
+        errors = [e.to_dict() for s in self.stages for e in s.errors]
+        return {
+            "verb": "check",
+            "graph": self.source,
+            "verdict": self.verdict,
+            "stages": [s.to_json() for s in self.stages],
+            "error_count": len(errors),
+            "errors": errors,
+        }
+
+    def render(self) -> str:
+        lines = [f"{self.verdict}: {self.source}"]
+        for s in self.stages:
+            mark = {"GREEN": "ok  ", "RED": "FAIL", "SKIPPED": "skip"}[s.status]
+            lines.append(f"  [{mark}] {s.name}")
+            for e in sorted(s.errors, key=lambda e: e.sort_key):
+                lines.append("        " + e.render().replace("\n", "\n        "))
+            for m in s.messages:
+                lines.append(f"        {m}")
+        lines.append("")
+        lines.append(
+            "check GREEN — ready to deploy." if self.ok
+            else "check RED — fix the failing stage(s); deploy is refused until GREEN."
+        )
+        return "\n".join(lines) + "\n"
+
+
+def run_check(source_text: str, source_name: str) -> CheckResult:
+    """Run the whole gate over graph YAML text; return the aggregated verdict."""
+    validate_stage = Stage("validate")
+    pure_fn_stage = Stage("pure_fn_tests")
+    compile_stage = Stage("compile")
+    smoke_stage = Stage("smoke")
+    runtime_stage = Stage("runtime_validate")
+    stages = [validate_stage, pure_fn_stage, compile_stage, smoke_stage, runtime_stage]
+
+    # --- validate (+ partition the pure_fn inline-test findings into their own stage) ---
+    vresult = validate_text(source_text, source=source_name)
+    for err in vresult.errors:
+        (pure_fn_stage if err.code in _PURE_FN_TEST_CODES else validate_stage).errors.append(err)
+    validate_stage.status = RED if validate_stage.errors else GREEN
+    pure_fn_stage.status = RED if pure_fn_stage.errors else GREEN
+
+    if not vresult.ok:
+        # compile/smoke stay SKIPPED — nothing valid to materialize.
+        return CheckResult(source_name, stages)
+
+    # Escape-hatch annotations (non-blocking, greppable): surface every mcp_read/raw use so the
+    # codification feedback loop is visible. Attached to the (GREEN) validate stage as messages,
+    # mirroring how runtime_validate surfaces the wallet-binding acknowledgment.
+    validate_stage.messages.extend(_hatch_annotations(source_text))
+
+    # --- compile ---
+    scan_source: Optional[str] = None
+    try:
+        scan_source = compile_text(source_text, source_name=source_name)
+        compile_stage.status = GREEN
+    except CompileError as exc:
+        compile_stage.status = RED
+        compile_stage.messages.append(str(exc).splitlines()[0])
+        return CheckResult(source_name, stages, scan_source=None)
+
+    # --- smoke (import + one tick over a stub ctx) ---
+    try:
+        detail = run_smoke(scan_source, scanner_name=source_name)
+        smoke_stage.status = GREEN
+        smoke_stage.detail = detail
+    except SmokeError as exc:
+        smoke_stage.status = RED
+        smoke_stage.messages.append(str(exc))
+        return CheckResult(source_name, stages, scan_source=scan_source)
+
+    # --- runtime_validate (protection policy + the real Zod+DSL oracle over runtime.yaml) ---
+    runtime_source = _run_runtime_validate(source_text, runtime_stage)
+
+    return CheckResult(source_name, stages, scan_source=scan_source, runtime_source=runtime_source)
+
+
+def _hatch_annotations(source_text: str) -> list[str]:
+    """The non-blocking escape-hatch annotation block: one line per mcp_read use (tool +
+    consuming pure_fn), plus a 'prefer the first-class node' note when the tool is already
+    wrapped by a curated source. Only called on a graph that already validated GREEN, so every
+    raw consumer is a pure_fn. Empty (and thus silent) for graphs that use no hatch."""
+    from composer.registry import NODES
+
+    try:
+        doc, _ = load_graph(source_text)
+    except Exception:  # noqa: BLE001 — a parse failure here is already reported by validate
+        return []
+    nodes = doc.get("nodes") or []
+    edges = doc.get("edges") or []
+
+    read_tool: dict[str, str] = {}
+    for n in nodes:
+        if isinstance(n, dict) and n.get("node") == "mcp_read" and isinstance(n.get("id"), str):
+            w = n.get("with") if isinstance(n.get("with"), dict) else {}
+            tool = w.get("tool")
+            read_tool[n["id"]] = tool if isinstance(tool, str) and tool.strip() else "?"
+    if not read_tool:
+        return []
+
+    wrapped: dict[str, str] = {}
+    for nd in NODES:
+        if nd.mcp_tool and nd.mcp_tool not in wrapped:
+            wrapped[nd.mcp_tool] = nd.name
+
+    consumers: dict[str, set[str]] = {rid: set() for rid in read_tool}
+    for e in edges:
+        if not isinstance(e, dict):
+            continue
+        frm, to = e.get("from"), e.get("to")
+        if not (isinstance(frm, str) and isinstance(to, str)):
+            continue
+        fid = frm.split(".", 1)[0]
+        if fid in consumers:
+            consumers[fid].add(to.split(".", 1)[0])
+
+    lines = [
+        "escape-hatch usage (non-blocking; prefer a first-class node where one exists):",
+    ]
+    for rid in sorted(read_tool):
+        tool = read_tool[rid]
+        cons = ", ".join(f"`{c}`" for c in sorted(consumers[rid])) or "(none wired)"
+        lines.append(f"  - mcp_read {tool!r} (node {rid}) -> normalized by pure_fn {cons}")
+        if tool in wrapped:
+            lines.append(
+                f"    note: {tool!r} has a first-class node `{wrapped[tool]}` — prefer it "
+                f"unless you need fields it doesn't expose"
+            )
+    return lines
+
+
+def _run_runtime_validate(source_text: str, stage: Stage) -> Optional[str]:
+    """Emit runtime.yaml from the graph's metadata, enforce PROTECTION policy (CMP120), and run
+    the real Zod+DSL oracle. Records status/errors/messages on ``stage``; returns the emitted
+    runtime.yaml text (so deploy can stage it without re-emitting)."""
+    from composer.authoring.runtime_emit import answers_from_metadata, render_runtime_yaml
+
+    try:
+        doc, _ = load_graph(source_text)
+        answers = answers_from_metadata(doc.get("metadata") or {})
+    except Exception as exc:  # noqa: BLE001 — a bad metadata block is a graph defect, reported here
+        stage.status = RED
+        stage.messages.append(f"could not derive runtime answers from metadata: {exc}")
+        return None
+
+    runtime_source = render_runtime_yaml(answers)
+    oracle, policy_errors = check_runtime_unit(answers)
+    stage.errors.extend(policy_errors)
+    stage.errors.extend(oracle.errors)
+
+    if answers.unmanaged:
+        stage.messages.append(
+            "WARNING: unmanaged=true — this unit ships with NO exit protection (no stop-loss, "
+            "no trailing floor, no time-cut). Positions can run to liquidation. Opt-out accepted."
+        )
+    if oracle.skipped and oracle.skip_reason:
+        stage.messages.append(oracle.skip_reason)
+    for info in oracle.info_messages:
+        stage.messages.append(info)
+
+    stage.status = RED if stage.errors else GREEN
+    return runtime_source
+
+
+def check_file(path) -> CheckResult:
+    p = Path(path)
+    return run_check(p.read_text(encoding="utf-8"), p.name)