create-workframe 0.1.11 → 0.1.13

package/workframe-api/credential_store.py

@@ -0,0 +1,245 @@
+"""WF-032 extract: credential persistence (vault, auth.json, profile .env overlays)."""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import uuid
+from pathlib import Path
+from typing import Any
+
+import credential_vault
+
+
+def _srv():
+    import server as srv
+
+    return srv
+
+
+def _quote_env_value(value: str) -> str:
+    raw = str(value or "")
+    if re.fullmatch(r"[A-Za-z0-9_./:@+-]+", raw):
+        return raw
+    return json.dumps(raw)
+
+
+def _upsert_env_secret(env_path: Path, key: str, value: str) -> None:
+    env_path.parent.mkdir(parents=True, exist_ok=True)
+    lines: list[str] = []
+    found = False
+    if env_path.exists():
+        lines = env_path.read_text(encoding="utf-8").splitlines()
+    updated: list[str] = []
+    for line in lines:
+        stripped = line.strip()
+        if not stripped or stripped.startswith("#") or "=" not in line:
+            updated.append(line)
+            continue
+        current_key, _sep, _rest = line.partition("=")
+        if current_key.strip() == key:
+            updated.append(f"{key}={_quote_env_value(value)}")
+            found = True
+        else:
+            updated.append(line)
+    if not found:
+        if updated and updated[-1].strip():
+            updated.append("")
+        updated.append(f"{key}={_quote_env_value(value)}")
+    env_path.write_text("\n".join(updated).rstrip() + "\n", encoding="utf-8")
+    _publish_profile_gateway_secrets(env_path.parent.name)
+
+
+def _publish_profile_gateway_secrets(profile: str) -> None:
+    """Hermes gateway runs as uid hermes; API container writes bind-mount files as root.
+
+    Runtime profiles only ever get wf_rt_* lease tokens or auth.json pool metadata —
+    never raw upstream keys. chmod so the gateway can read overlays; supervisor still
+    blocks agent shell exec against these paths.
+    """
+    slug = _srv().safe_profile_slug(str(profile or "").strip())
+    if not _srv()._is_runtime_profile_slug(slug):
+        return
+    prof_dir = _srv()._profile_dir(slug)
+    for name in (".env", "auth.json"):
+        path = prof_dir / name
+        if not path.is_file():
+            continue
+        try:
+            os.chmod(path, 0o644)
+        except OSError:
+            pass
+
+
+def _upsert_auth_metadata(auth_path: Path, payload: dict[str, Any]) -> None:
+    auth_path.parent.mkdir(parents=True, exist_ok=True)
+    data: dict[str, Any] = {}
+    if auth_path.exists():
+        try:
+            loaded = json.loads(auth_path.read_text(encoding="utf-8"))
+            if isinstance(loaded, dict):
+                data = loaded
+        except Exception:
+            data = {}
+    bindings = data.get("credentials")
+    if not isinstance(bindings, list):
+        bindings = []
+    credential_ref = str(payload.get("credential_ref") or "")
+    bindings = [row for row in bindings if not isinstance(row, dict) or row.get("credential_ref") != credential_ref]
+    bindings.append({
+        "provider": payload.get("provider"),
+        "credential_type": payload.get("credential_type"),
+        "credential_ref": credential_ref,
+        "env_var": payload.get("env_var"),
+        "label": payload.get("label") or "",
+        "updated_at": payload.get("updated_at"),
+    })
+    data["credentials"] = bindings
+    data["updated_at"] = payload.get("updated_at")
+    auth_path.write_text(json.dumps(data, indent=2, sort_keys=True) + "\n", encoding="utf-8")
+
+
+def _remove_env_secret(env_path: Path, key: str) -> None:
+    if not env_path.is_file():
+        return
+    kept: list[str] = []
+    for line in env_path.read_text(encoding="utf-8").splitlines():
+        stripped = line.strip()
+        if stripped and not stripped.startswith("#") and "=" in line:
+            current_key, _sep, _rest = line.partition("=")
+            if current_key.strip() == key:
+                continue
+        kept.append(line)
+    env_path.write_text("\n".join(kept).rstrip() + ("\n" if kept else ""), encoding="utf-8")
+
+
+def _remove_auth_metadata(auth_path: Path, credential_ref: str) -> None:
+    if not auth_path.is_file():
+        return
+    try:
+        loaded = json.loads(auth_path.read_text(encoding="utf-8"))
+    except Exception:
+        return
+    if not isinstance(loaded, dict):
+        return
+    bindings = loaded.get("credentials")
+    if not isinstance(bindings, list):
+        return
+    loaded["credentials"] = [
+        row for row in bindings
+        if not isinstance(row, dict) or str(row.get("credential_ref") or "") != credential_ref
+    ]
+    loaded["updated_at"] = _srv()._utc_now()
+    auth_path.write_text(json.dumps(loaded, indent=2, sort_keys=True) + "\n", encoding="utf-8")
+
+
+def _store_user_credential(
+    user_id: str,
+    provider: str,
+    credential_type: str,
+    secret: str,
+    env_var: str,
+    label: str,
+) -> dict[str, Any]:
+    user_home = _srv()._user_hermes_home(user_id)
+    auth_path = _srv()._user_hermes_auth_path(user_id)
+    cred_id = str(uuid.uuid4())
+    credential_ref = credential_vault.vault_ref(cred_id)
+    now = _srv()._utc_now()
+    credential_vault.store_secret(
+        cred_id,
+        secret,
+        env_var=env_var,
+        provider=provider,
+        scope="user",
+        user_id=user_id,
+    )
+    _remove_env_secret(_srv()._user_hermes_env_path(user_id), env_var)
+    _upsert_auth_metadata(
+        auth_path,
+        {
+            "provider": provider,
+            "credential_type": credential_type,
+            "credential_ref": credential_ref,
+            "env_var": env_var,
+            "label": label,
+            "updated_at": now,
+        },
+    )
+    return {
+        "profile_home": str(user_home),
+        "credential_id": cred_id,
+        "auth_path": str(auth_path),
+        "credential_ref": credential_ref,
+        "updated_at": now,
+    }
+
+
+def _store_workspace_credential(
+    workspace_id: str,
+    provider: str,
+    credential_type: str,
+    secret: str,
+    env_var: str,
+    label: str,
+    created_by: str,
+) -> dict[str, Any]:
+    """Company-pay keys live on the primary Hermes profile .env (shared stack)."""
+    workspace_id = str(workspace_id or "").strip()
+    provider = str(provider or "").strip().lower()
+    if not workspace_id or not provider or not secret.strip():
+        raise ValueError("workspace_credential_invalid")
+    spec = _srv()._catalog_provider(provider)
+    if spec and spec.get("user_only"):
+        raise ValueError("provider_user_only")
+    primary = _srv()._primary_profile()
+    if not primary:
+        raise ValueError("no_primary_profile")
+    cred_id = str(uuid.uuid4())
+    credential_ref = credential_vault.vault_ref(cred_id)
+    now = _srv()._utc_now()
+    credential_vault.store_secret(
+        cred_id,
+        secret.strip(),
+        env_var=env_var,
+        provider=provider,
+        scope="workspace",
+        workspace_id=workspace_id,
+    )
+    _remove_env_secret(_srv()._profile_dir(primary) / ".env", env_var)
+    conn = _srv()._workframe_db()
+    try:
+        existing = conn.execute(
+            """SELECT id FROM credential_bindings
+               WHERE workspace_id = ? AND provider = ? AND deleted_at IS NULL
+               ORDER BY updated_at DESC LIMIT 1""",
+            (workspace_id, provider),
+        ).fetchone()
+        if existing:
+            cred_id = str(existing[0])
+            conn.execute(
+                """UPDATE credential_bindings
+                   SET credential_ref = ?, label = ?, is_active = 1, updated_at = ?, deleted_at = NULL
+                   WHERE id = ?""",
+                (credential_ref, label, now, cred_id),
+            )
+        else:
+            conn.execute(
+                """INSERT INTO credential_bindings
+                   (id, workspace_id, user_id, agent_profile_id, provider, credential_type,
+                    credential_ref, label, is_active, created_by, created_at, updated_at)
+                   VALUES (?,?,?,?,?,?,?,?,?,?,?,?)""",
+                (
+                    cred_id, workspace_id, None, None, provider, credential_type,
+                    credential_ref, label, 1, created_by, now, now,
+                ),
+            )
+        conn.commit()
+    finally:
+        conn.close()
+    return {
+        "credential_id": cred_id,
+        "credential_ref": credential_ref,
+        "updated_at": now,
+    }

package/workframe-api/crew_registry.py

@@ -0,0 +1,250 @@
+"""WF-032 extract: workspace crew registry and agent identity resolution."""
+
+from __future__ import annotations
+
+import json
+import sqlite3
+from typing import Any
+
+
+CREW_COLORS = [
+    "#A78BFA",
+    "#7DD3FC",
+    "#F472B6",
+    "#FBBF24",
+    "#E879F9",
+    "#5EE2B5",
+    "#F26D6D",
+    "#38BDF8",
+]
+
+
+def _srv():
+    import server as srv
+
+    return srv
+
+
+def load_agent_registry() -> dict[str, dict[str, Any]]:
+    agents_json = _srv().AGENTS_JSON
+    if not agents_json.is_file():
+        return {}
+    try:
+        data = json.loads(agents_json.read_text(encoding="utf-8"))
+        agents = data.get("agents")
+        if isinstance(agents, dict):
+            return {str(k): v for k, v in agents.items() if isinstance(v, dict)}
+    except (OSError, json.JSONDecodeError, TypeError, ValueError):  # noqa: BLE001
+        pass
+    return {}
+
+
+def _agent_registry_row(profile: str) -> dict[str, Any]:
+    slug = _srv().safe_profile_slug(profile)
+    return load_agent_registry().get(slug, {})
+
+
+def _workspace_agent_identities(workspace_id: str | None = None) -> dict[str, dict[str, Any]]:
+    """Slug → display_name/tagline/role/avatar from agent_profiles + registry."""
+    identities: dict[str, dict[str, Any]] = {}
+    try:
+        conn = _srv()._workframe_db()
+        ws_id = str(workspace_id or "").strip()
+        if not ws_id:
+            ws = conn.execute(
+                "SELECT id FROM workspaces WHERE slug = 'default' AND deleted_at IS NULL LIMIT 1",
+            ).fetchone()
+            ws_id = str(ws["id"]) if ws else ""
+        if ws_id:
+            rows = conn.execute(
+                """
+                SELECT slug, display_name, tagline, role, avatar_url
+                FROM agent_profiles
+                WHERE workspace_id = ? AND deleted_at IS NULL
+                """,
+                (ws_id,),
+            ).fetchall()
+            for row in rows:
+                slug = str(row["slug"] or "").strip()
+                if not slug:
+                    continue
+                identities[slug] = {
+                    "display_name": str(row["display_name"] or ""),
+                    "tagline": str(row["tagline"] or ""),
+                    "role": str(row["role"] or ""),
+                    "avatar_url": str(row["avatar_url"] or "").strip() or None,
+                }
+        conn.close()
+    except (sqlite3.Error, OSError):  # noqa: BLE001
+        pass
+    registry = load_agent_registry()
+    for _slug, ident in list(identities.items()):
+        reg = registry.get(_slug) if isinstance(registry.get(_slug), dict) else {}
+        if reg.get("display_name"):
+            ident["display_name"] = str(reg["display_name"])
+        if reg.get("tagline"):
+            ident["tagline"] = str(reg["tagline"])
+        if reg.get("role"):
+            ident["role"] = str(reg["role"])
+        if reg.get("avatar_url"):
+            ident["avatar_url"] = str(reg["avatar_url"])
+        if reg.get("avatar_id"):
+            ident["avatar_id"] = str(reg["avatar_id"])
+    return identities
+
+
+def _agent_identity_fields(profile: str, workspace_id: str | None = None, user_id: str = "") -> dict[str, Any]:
+    slug = _srv().safe_profile_slug(str(profile or "").strip())
+    template = _srv()._runtime_template_slug(slug) if _srv()._is_runtime_profile_slug(slug) else slug
+    reg = _agent_registry_row(slug)
+    if user_id and template:
+        runtime = _srv()._runtime_profile_slug(user_id, template)
+        reg_user = _agent_registry_row(runtime)
+        if reg_user.get("display_name") or reg_user.get("tagline") or reg_user.get("avatar_url"):
+            reg = {**reg, **{k: v for k, v in reg_user.items() if v}}
+    ident = _workspace_agent_identities(workspace_id).get(template, {})
+    reg_template = _agent_registry_row(template)
+    avatar_url: Any = None
+    avatar_id: Any = None
+    for src in (reg, ident, reg_template):
+        u = str(src.get("avatar_url") or "").strip()
+        i = str(src.get("avatar_id") or "").strip()
+        if u or i:
+            avatar_url, avatar_id = u or None, i or None
+            break
+    out: dict[str, Any] = {
+        "display_name": str(
+            reg.get("display_name")
+            or ident.get("display_name")
+            or reg_template.get("display_name")
+            or _srv()._profile_display_name(template)
+        ),
+        "tagline": str(reg.get("tagline") or ident.get("tagline") or reg_template.get("tagline") or ""),
+        "role": str(reg.get("role") or ident.get("role") or reg_template.get("role") or _srv()._profile_role(template)),
+        "avatar_url": avatar_url,
+        "avatar_id": avatar_id,
+    }
+    _srv()._resolve_avatar_fields(out)
+    return out
+
+
+def _gateway_platform(gateway: dict[str, Any], native: bool) -> str:
+    platforms = gateway.get("platforms") or {}
+    if native:
+        for name in ("telegram", "discord", "web", "localhost"):
+            p = platforms.get(name)
+            if isinstance(p, dict) and str(p.get("state") or p.get("status") or "").lower() == "connected":
+                return name.replace("localhost", "Hermes").title()
+        return "Hermes"
+    for name in ("discord", "telegram", "web"):
+        p = platforms.get(name)
+        if isinstance(p, dict) and str(p.get("state") or p.get("status") or "").lower() == "connected":
+            return name.title()
+    return "Hermes"
+
+
+def crew_data(profiles: list[str], primary: str, gateway: dict[str, Any]) -> list[dict[str, Any]]:
+    registry = load_agent_registry()
+    idents = _workspace_agent_identities()
+    ordered: list[str] = []
+    if primary and primary in profiles:
+        ordered.append(primary)
+    for profile in sorted(profiles):
+        if profile not in ordered:
+            ordered.append(profile)
+    crew: list[dict[str, Any]] = []
+    for index, profile in enumerate(ordered):
+        slug = _srv()._profile_slug(profile).lower()
+        display = _srv()._profile_display_name(profile)
+        native = _srv()._is_native_profile(profile)
+        prof_key = _srv().safe_profile_slug(profile)
+        reg = registry.get(prof_key) if isinstance(registry.get(prof_key), dict) else {}
+        if not reg:
+            legacy_row = registry.get(slug)
+            if isinstance(legacy_row, dict):
+                reg = legacy_row
+        if reg.get("display_name"):
+            display = str(reg["display_name"])
+        ident = idents.get(prof_key, {})
+        if ident.get("display_name"):
+            display = str(ident["display_name"])
+        role = str(ident.get("role") or reg.get("role") or _srv()._profile_role(profile))
+        tagline = str(ident.get("tagline") or reg.get("tagline") or "")
+        row: dict[str, Any] = {
+            "profile": profile,
+            "key": slug,
+            "display_name": display,
+            "code": _srv()._profile_code(display, slug),
+            "role": role,
+            "tagline": tagline,
+            "color": CREW_COLORS[index % len(CREW_COLORS)],
+            "is_native": native,
+            "platform": _gateway_platform(gateway, native),
+            "route_status": _srv().route_status_for_profile(profile),
+        }
+        if reg.get("avatar_url"):
+            row["avatar_url"] = str(reg["avatar_url"])
+        if reg.get("avatar_id"):
+            row["avatar_id"] = str(reg["avatar_id"])
+        if ident.get("avatar_url"):
+            row["avatar_url"] = str(ident["avatar_url"])
+        if ident.get("avatar_id"):
+            row["avatar_id"] = str(ident["avatar_id"])
+        _srv()._resolve_avatar_fields(row)
+        crew.append(row)
+    return crew
+
+
+def _workspace_crew_profile_names(workspace_id: str | None = None) -> list[str]:
+    """ponytail: rail shows workspace agents + primary Hermes profile, not every stale on-disk profile."""
+    primary = _srv()._primary_profile()
+    on_disk = set(_srv()._list_profiles())
+    profiles: list[str] = []
+    rows: list[sqlite3.Row] = []
+    try:
+        conn = _srv()._workframe_db()
+        ws_id = str(workspace_id or "").strip()
+        if not ws_id:
+            ws = conn.execute(
+                "SELECT id FROM workspaces WHERE slug = 'default' AND deleted_at IS NULL LIMIT 1",
+            ).fetchone()
+            ws_id = str(ws["id"]) if ws else ""
+        if ws_id:
+            rows = conn.execute(
+                """
+                SELECT slug, is_native
+                FROM agent_profiles
+                WHERE workspace_id = ? AND deleted_at IS NULL
+                ORDER BY created_at ASC
+                """,
+                (ws_id,),
+            ).fetchall()
+        conn.close()
+    except (sqlite3.Error, OSError):  # noqa: BLE001
+        rows = []
+    if primary and primary in on_disk:
+        profiles.append(primary)
+    for row in rows:
+        if int(row["is_native"] or 0):
+            continue
+        slug = str(row["slug"] or "").strip()
+        if slug in on_disk and slug not in profiles:
+            profiles.append(slug)
+    if not profiles:
+        if primary and primary in on_disk:
+            return [primary]
+        return sorted(on_disk)[:1]
+    return profiles
+
+
+def workframe_agents() -> dict[str, Any]:
+    profiles = _workspace_crew_profile_names()
+    primary = _srv()._primary_profile()
+    gateway = _srv().gateway_data(primary) if primary else _srv().gateway_data("")
+    crew = crew_data(profiles, primary, gateway)
+    return {
+        "ok": True,
+        "project_name": _srv().PROJECT_NAME,
+        "native_profile": primary,
+        "crew": crew,
+    }