claude-smart 0.2.42 → 0.2.44

package/plugin/vendor/reflexio/reflexio/server/services/braintrust/_cron.py

@@ -0,0 +1,196 @@
+"""Recurring 15-minute sync scheduler for the Braintrust connector.
+
+Unlike `GroupEvaluationScheduler` (which is event-driven — fires once per
+session after a delay), `BraintrustSyncScheduler` is a fixed-interval
+daemon: every N seconds, walk every connected org and call
+`BraintrustConnectorService.sync_once`.
+
+Singleton per process. Started on first call to `get_instance()`. Idempotent
+construction guarded by a class-level lock; the worker thread is a daemon
+so it doesn't block process shutdown.
+
+The scheduler discovers connected orgs by asking storage — `BaseStorage`'s
+default no-op returns []; concrete backends override (currently SQLite
+returns the single org it belongs to, via `org_id` attribute).
+
+`BRAINTRUST_BASE_URL` env override is honored via the `BraintrustClient`
+factory: when set, all sync calls hit that URL instead of api.braintrust.dev.
+Useful for mocking in dev / staging.
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+import threading
+import time
+from collections.abc import Callable
+from dataclasses import dataclass, field
+
+from reflexio.server.services.braintrust.client import (
+    DEFAULT_BASE_URL,
+    BraintrustClient,
+)
+
+logger = logging.getLogger(__name__)
+
+
+_DEFAULT_INTERVAL_SECONDS = 15 * 60  # 15 min
+_TEST_INTERVAL_SECONDS = 5  # IS_TEST_ENV shortcut for fast tests
+
+
+def _interval_seconds() -> int:
+    """Pick the recurring interval based on `IS_TEST_ENV`."""
+    if os.environ.get("IS_TEST_ENV", "").strip().lower() == "true":
+        return _TEST_INTERVAL_SECONDS
+    return _DEFAULT_INTERVAL_SECONDS
+
+
+def _resolve_base_url() -> str:
+    """Honor the `BRAINTRUST_BASE_URL` env override (used in dev/staging)."""
+    raw = os.environ.get("BRAINTRUST_BASE_URL", "").strip()
+    return raw or DEFAULT_BASE_URL
+
+
+def make_client_factory_with_base_url() -> Callable[[str], BraintrustClient]:
+    """Return a client factory that honors `BRAINTRUST_BASE_URL`.
+
+    Use this anywhere a `client_factory` is needed so the env override
+    flows through uniformly (sync scheduler, manual /sync endpoint).
+    """
+    base_url = _resolve_base_url()
+
+    def factory(api_key: str) -> BraintrustClient:
+        return BraintrustClient(api_key, base_url=base_url)
+
+    return factory
+
+
+@dataclass
+class BraintrustSyncScheduler:
+    """Singleton recurring scheduler for Braintrust sync_once.
+
+    Args:
+        interval_seconds (int): How often to poll. Defaults to 15 min
+            (5s under IS_TEST_ENV).
+        list_connected_orgs (Callable[[], list[str]]): Discovery hook.
+        run_sync_for_org (Callable[[str], None]): Per-org sync action.
+            Provided by the caller so the scheduler stays decoupled from
+            BraintrustConnectorService construction.
+    """
+
+    interval_seconds: int = field(default_factory=_interval_seconds)
+    list_connected_orgs: Callable[[], list[str]] = field(default=lambda: [])
+    run_sync_for_org: Callable[[str], None] = field(default=lambda _org: None)
+
+    _instance: BraintrustSyncScheduler | None = field(
+        default=None, init=False, repr=False
+    )
+    _lock: threading.Lock = field(
+        default_factory=threading.Lock, init=False, repr=False
+    )
+    _stop: threading.Event = field(
+        default_factory=threading.Event, init=False, repr=False
+    )
+    _thread: threading.Thread | None = field(default=None, init=False, repr=False)
+
+    def start(self) -> None:
+        """Spawn the daemon thread (idempotent)."""
+        with self._lock:
+            if self._thread is not None and self._thread.is_alive():
+                return
+            self._stop.clear()
+            self._thread = threading.Thread(
+                target=self._loop, daemon=True, name="braintrust-sync-scheduler"
+            )
+            self._thread.start()
+            logger.info(
+                "BraintrustSyncScheduler started (interval=%ss)",
+                self.interval_seconds,
+            )
+
+    def stop(self) -> None:
+        """Signal the daemon to exit. Returns immediately; thread joins lazily."""
+        self._stop.set()
+
+    def _loop(self) -> None:
+        """Main loop: every `interval_seconds`, sync every connected org."""
+        while not self._stop.is_set():
+            try:
+                org_ids = self.list_connected_orgs()
+            except Exception:  # noqa: BLE001
+                logger.exception("BraintrustSyncScheduler: org discovery failed")
+                org_ids = []
+            for org_id in org_ids:
+                if self._stop.is_set():
+                    break
+                try:
+                    self.run_sync_for_org(org_id)
+                except Exception:  # noqa: BLE001
+                    logger.exception(
+                        "BraintrustSyncScheduler: sync failed for org=%s", org_id
+                    )
+            # Sleep interruptibly so stop() takes effect promptly.
+            self._stop.wait(timeout=self.interval_seconds)
+
+
+# Module-level singleton accessor. Tests reset via `_reset_for_test`.
+_INSTANCE: BraintrustSyncScheduler | None = None
+_GET_LOCK = threading.Lock()
+
+
+def get_instance(
+    *,
+    list_connected_orgs: Callable[[], list[str]] | None = None,
+    run_sync_for_org: Callable[[str], None] | None = None,
+) -> BraintrustSyncScheduler:
+    """Get or create the process-wide singleton.
+
+    Args:
+        list_connected_orgs (Callable[[], list[str]] | None): Override
+            org discovery (defaults to no-op returning []).
+        run_sync_for_org (Callable[[str], None] | None): Override the
+            per-org sync action (defaults to no-op).
+
+    Returns:
+        BraintrustSyncScheduler: The shared instance.
+    """
+    global _INSTANCE
+    with _GET_LOCK:
+        if _INSTANCE is None:
+            _INSTANCE = BraintrustSyncScheduler(
+                list_connected_orgs=list_connected_orgs or (lambda: []),
+                run_sync_for_org=run_sync_for_org or (lambda _org: None),
+            )
+            _INSTANCE.start()
+        return _INSTANCE
+
+
+def _reset_for_test() -> None:
+    """Reset the singleton — for tests only."""
+    global _INSTANCE
+    with _GET_LOCK:
+        if _INSTANCE is not None:
+            _INSTANCE.stop()
+            if _INSTANCE._thread is not None:
+                _INSTANCE._thread.join(timeout=2.0)
+        _INSTANCE = None
+
+
+def trigger_tick_now(scheduler: BraintrustSyncScheduler) -> None:
+    """Force one immediate sync tick — for tests.
+
+    Tests that don't want to wait for the interval call this to run one
+    pass of the loop body synchronously. Mirrors the loop's per-org
+    exception handling so a single failing org doesn't abort the tick.
+    """
+    org_ids = scheduler.list_connected_orgs()
+    for org_id in org_ids:
+        try:
+            scheduler.run_sync_for_org(org_id)
+        except Exception:  # noqa: BLE001
+            logger.exception("trigger_tick_now: sync failed for org=%s", org_id)
+
+
+# Tiny no-op `_` reference so unused-import lint doesn't trip on `time`.
+_ = time

package/plugin/vendor/reflexio/reflexio/server/services/braintrust/_encryption.py

@@ -0,0 +1,101 @@
+"""Minimal Fernet encryption helper for the Braintrust connector.
+
+Reads `REFLEXIO_FERNET_KEYS` (comma-separated) from the environment. When
+the env var is unset, both `encrypt` and `decrypt` return the value
+unchanged — matching the existing `EncryptManager` behavior in
+`reflexio_ext.utils` and keeping OS dev mode workable without rotation
+infrastructure.
+
+In enterprise deployments, the env var IS set and the API key is stored
+ciphertext-only.
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+
+from cryptography import fernet
+from cryptography.fernet import Fernet, MultiFernet
+
+logger = logging.getLogger(__name__)
+
+
+_ENV_KEY = "REFLEXIO_FERNET_KEYS"
+_MULTI: MultiFernet | None = None
+_LOADED = False
+
+
+def _load() -> MultiFernet | None:
+    """Lazy-load the MultiFernet from env on first use."""
+    global _MULTI, _LOADED
+    if _LOADED:
+        return _MULTI
+    raw = os.environ.get(_ENV_KEY, "").strip()
+    if not raw:
+        logger.info(
+            "%s is unset — Braintrust connector storing API keys in plaintext "
+            "(suitable only for local development).",
+            _ENV_KEY,
+        )
+        _LOADED = True
+        return None
+    fernets = []
+    for k in raw.split(","):
+        k = k.strip()
+        if not k:
+            continue
+        try:
+            fernets.append(Fernet(k.encode("utf-8")))
+        except Exception:  # noqa: BLE001
+            logger.warning("Discarding invalid Fernet key in %s", _ENV_KEY)
+    if not fernets:
+        raise RuntimeError(f"{_ENV_KEY} is set but contains no valid Fernet keys")
+    _MULTI = MultiFernet(fernets)
+    _LOADED = True
+    return _MULTI
+
+
+def encrypt(value: str) -> str:
+    """Encrypt `value` if Fernet keys are configured; otherwise return as-is.
+
+    Args:
+        value (str): The plaintext (e.g., a Braintrust API key).
+
+    Returns:
+        str: Ciphertext, or `value` unchanged when no keys are configured.
+    """
+    m = _load()
+    if m is None:
+        return value
+    return m.encrypt(value.encode("utf-8")).decode("utf-8")
+
+
+def decrypt(value: str) -> str:
+    """Decrypt `value` if Fernet keys are configured; otherwise return as-is.
+
+    Args:
+        value (str): The (possibly ciphertext) value from storage.
+
+    Returns:
+        str: Plaintext.
+
+    Raises:
+        InvalidToken: When the token cannot be decoded by any registered key.
+    """
+    m = _load()
+    if m is None:
+        return value
+    try:
+        return m.decrypt(value.encode("utf-8")).decode("utf-8")
+    except fernet.InvalidToken:
+        # Storage may contain plaintext from a pre-encryption deployment.
+        # Caller decides whether to surface the issue.
+        raise
+
+
+def _reset_for_test() -> None:
+    """Reset the cached MultiFernet — for tests only."""
+    global _MULTI, _LOADED
+    _MULTI = None
+    _LOADED = False

package/plugin/vendor/reflexio/reflexio/server/services/braintrust/client.py

@@ -0,0 +1,167 @@
+"""HTTP client for the Braintrust REST API.
+
+Pure HTTP wrapper — no storage, no encryption, no orchestration. The
+service layer composes this with storage to build the connector.
+
+The exact endpoint paths (`/v1/api_key`, `/v1/organization`, etc.) follow
+the spec §5.1; if Braintrust evolves the API, only this file needs to
+change — call sites use the typed methods.
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Any
+
+import httpx
+
+logger = logging.getLogger(__name__)
+
+
+DEFAULT_BASE_URL = "https://api.braintrust.dev"
+DEFAULT_TIMEOUT_SECONDS = 30.0
+
+
+class BraintrustAuthError(RuntimeError):
+    """Raised when the Braintrust API rejects the key (401 / 403)."""
+
+
+class BraintrustHTTPError(RuntimeError):
+    """Raised on non-2xx, non-auth-error responses from Braintrust."""
+
+    def __init__(self, status_code: int, body: str) -> None:
+        super().__init__(f"Braintrust HTTP {status_code}: {body[:200]}")
+        self.status_code = status_code
+        self.body = body
+
+
+class BraintrustClient:
+    """Thin wrapper around the Braintrust REST API.
+
+    All methods are synchronous; they use a per-client `httpx.Client`
+    with a fixed timeout so tests can monkey-patch the client.
+
+    Args:
+        api_key (str): Customer-supplied Braintrust API key.
+        base_url (str): Override for testing.
+        timeout (float): Per-request timeout in seconds.
+    """
+
+    def __init__(
+        self,
+        api_key: str,
+        *,
+        base_url: str = DEFAULT_BASE_URL,
+        timeout: float = DEFAULT_TIMEOUT_SECONDS,
+    ) -> None:
+        self.api_key = api_key
+        self.base_url = base_url.rstrip("/")
+        self._client = httpx.Client(
+            timeout=timeout,
+            headers={
+                "Authorization": f"Bearer {api_key}",
+                "Accept": "application/json",
+                "User-Agent": "reflexio-braintrust-connector/1.0",
+            },
+        )
+
+    def close(self) -> None:
+        self._client.close()
+
+    # ------------------------------------------------------------------
+    # API methods
+    # ------------------------------------------------------------------
+
+    def validate_key(self) -> bool:
+        """Return True iff the API key is valid.
+
+        Returns:
+            bool: True on 2xx, False on 401/403. Other errors raise.
+        """
+        try:
+            self._get("/v1/api_key")
+        except BraintrustAuthError:
+            return False
+        return True
+
+    def list_organizations(self) -> list[dict[str, Any]]:
+        """List workspaces (Braintrust calls these "organizations").
+
+        Returns:
+            list[dict]: Each item has at least `id` and `name`.
+        """
+        return self._unwrap(self._get("/v1/organization"))
+
+    def list_projects(self, workspace_id: str) -> list[dict[str, Any]]:
+        """List projects in a workspace.
+
+        Args:
+            workspace_id (str): Braintrust organization id.
+
+        Returns:
+            list[dict]: Each item has at least `id` and `name`.
+        """
+        return self._unwrap(self._get("/v1/project", params={"org_id": workspace_id}))
+
+    def list_experiments(
+        self, project_id: str, since_ts: int | None = None
+    ) -> list[dict[str, Any]]:
+        """List experiments in a project.
+
+        Args:
+            project_id (str): Braintrust project id.
+            since_ts (int | None): Optional unix-epoch lower bound on
+                `experiment.created_at`.
+
+        Returns:
+            list[dict]: Each item has at least `id`, `name`, `created_at`.
+        """
+        params: dict[str, Any] = {"project_id": project_id}
+        if since_ts is not None:
+            params["since"] = since_ts
+        return self._unwrap(self._get("/v1/experiment", params=params))
+
+    def list_spans(self, experiment_id: str) -> list[dict[str, Any]]:
+        """List spans for an experiment.
+
+        Returns:
+            list[dict]: Each item has at least `id`, `metadata`, `scores`,
+                `created_at`. Other fields are ignored by the caller.
+        """
+        return self._unwrap(
+            self._get("/v1/span", params={"experiment_id": experiment_id})
+        )
+
+    # ------------------------------------------------------------------
+    # internals
+    # ------------------------------------------------------------------
+
+    def _get(
+        self, path: str, *, params: dict[str, Any] | None = None
+    ) -> httpx.Response:
+        url = f"{self.base_url}{path}"
+        try:
+            response = self._client.get(url, params=params)
+        except httpx.RequestError as e:
+            raise BraintrustHTTPError(503, str(e)) from e
+        if response.status_code in (401, 403):
+            raise BraintrustAuthError(
+                f"Braintrust rejected the API key (HTTP {response.status_code})"
+            )
+        if not (200 <= response.status_code < 300):
+            raise BraintrustHTTPError(response.status_code, response.text)
+        return response
+
+    @staticmethod
+    def _unwrap(response: httpx.Response) -> list[dict[str, Any]]:
+        """Pull the list payload from Braintrust's standard envelope.
+
+        Braintrust wraps list responses in `{"objects": [...]}`. We
+        accept either the wrapped form or a bare list (some endpoints).
+        """
+        data = response.json()
+        if isinstance(data, dict) and "objects" in data:
+            return data["objects"]
+        if isinstance(data, list):
+            return data
+        return []