create-workframe 0.1.12 → 0.1.14

package/workframe-api/docker_gateway.py

@@ -0,0 +1,166 @@
+"""WF-032 extract: Docker socket and gateway container exec helpers."""
+
+from __future__ import annotations
+
+import http.client
+import json
+import shlex
+import socket
+import urllib.parse
+from typing import Any
+
+import updates as stack_updates
+
+
+def _srv():
+    import server as srv
+
+    return srv
+
+
+class _UnixHTTPConnection(http.client.HTTPConnection):
+    def __init__(self, unix_path: str):
+        super().__init__("localhost")
+        self.unix_path = unix_path
+
+    def connect(self) -> None:
+        sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+        sock.connect(self.unix_path)
+        self.sock = sock
+
+
+def _docker_request(method: str, path: str, body: dict[str, Any] | None = None) -> tuple[int, Any]:
+    if _srv().SECURE_MODE:
+        raise RuntimeError("Docker socket access is disabled in SECURE_MODE")
+    conn = _UnixHTTPConnection(_srv().DOCKER_SOCK)
+    payload = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Content-Type": "application/json"} if payload is not None else {}
+    conn.request(method, f"/v1.41{path}", body=payload, headers=headers)
+    resp = conn.getresponse()
+    raw = resp.read()
+    conn.close()
+    if not raw:
+        return resp.status, None
+    try:
+        return resp.status, json.loads(raw.decode("utf-8", errors="replace"))
+    except json.JSONDecodeError:
+        return resp.status, raw.decode("utf-8", errors="replace")
+
+
+def _docker_exec_detached(container: str, cmd: list[str], acting_profile: str = "") -> tuple[int, str]:
+    if _srv()._exec_targets_runtime_profile_secrets(cmd, acting_profile):
+        return 1, "blocked: runtime profile credential paths are not readable via gateway exec"
+    create_status, create_data = _docker_request(
+        "POST",
+        f"/containers/{urllib.parse.quote(container, safe='')}/exec",
+        {
+            "AttachStdout": True,
+            "AttachStderr": True,
+            "Tty": False,
+            "Cmd": cmd,
+        },
+    )
+    if create_status >= 300 or not isinstance(create_data, dict) or not create_data.get("Id"):
+        return create_status, f"exec create failed: {create_data}"
+    exec_id = str(create_data["Id"])
+    start_status, _start_data = _docker_request(
+        "POST",
+        f"/exec/{urllib.parse.quote(exec_id, safe='')}/start",
+        {"Detach": True, "Tty": False},
+    )
+    if start_status >= 300:
+        return start_status, "exec start failed"
+    return 0, ""
+
+
+def _docker_exec(container: str, cmd: list[str], acting_profile: str = "") -> tuple[int, str]:
+    if _srv()._exec_targets_runtime_profile_secrets(cmd, acting_profile):
+        return 1, "blocked: runtime profile credential paths are not readable via gateway exec"
+    create_status, create_data = _docker_request(
+        "POST",
+        f"/containers/{urllib.parse.quote(container, safe='')}/exec",
+        {
+            "AttachStdout": True,
+            "AttachStderr": True,
+            "Tty": False,
+            "Cmd": cmd,
+        },
+    )
+    if create_status >= 300 or not isinstance(create_data, dict) or not create_data.get("Id"):
+        return create_status, f"exec create failed: {create_data}"
+    exec_id = str(create_data["Id"])
+    start_status, start_data = _docker_request(
+        "POST",
+        f"/exec/{urllib.parse.quote(exec_id, safe='')}/start",
+        {"Detach": False, "Tty": False},
+    )
+    out = start_data if isinstance(start_data, str) else json.dumps(start_data or {})
+    if isinstance(out, str) and out:
+        try:
+            raw = out.encode("latin-1", errors="ignore")
+            buf = bytearray()
+            i = 0
+            # Docker non-TTY exec streams are 8-byte header framed.
+            while i + 8 <= len(raw):
+                size = int.from_bytes(raw[i + 4 : i + 8], "big")
+                i += 8
+                if size < 0 or i + size > len(raw):
+                    break
+                buf.extend(raw[i : i + size])
+                i += size
+            if buf:
+                out = buf.decode("utf-8", errors="replace")
+        except Exception:
+            pass
+    inspect_status, inspect_data = _docker_request("GET", f"/exec/{urllib.parse.quote(exec_id, safe='')}/json")
+    if inspect_status >= 300 or not isinstance(inspect_data, dict):
+        return start_status, out
+    exit_raw = inspect_data.get("ExitCode")
+    exit_code = 0 if exit_raw in (0, "0") else int(exit_raw or 1)
+    return exit_code, out
+
+
+def _gateway_container_exec(cmd: list[str]) -> tuple[int, str]:
+    """Run a command in the gateway container — via supervisor in SECURE_MODE."""
+    if _srv().SECURE_MODE:
+        return _srv()._supervisor_container_exec(cmd)
+    return _docker_exec(_srv().GATEWAY_CONTAINER_NAME, cmd)
+
+
+def _gateway_container_exec_detached(cmd: list[str]) -> tuple[int, str]:
+    """Detached gateway exec — long-running jobs survive after exec returns."""
+    if _srv().SECURE_MODE:
+        return _srv()._supervisor_container_exec(cmd, detach=True)
+    return _docker_exec_detached(_srv().GATEWAY_CONTAINER_NAME, cmd)
+
+
+def _profile_home_container(profile: str) -> str:
+    return f"/opt/data/profiles/{_srv().resolve_hermes_profile(profile)}"
+
+
+def _gateway_exec(profile: str, args: list[str]) -> tuple[int, str]:
+    """Run hermes CLI in the gateway container with specialist profile home."""
+    prof = _srv().resolve_hermes_profile(profile)
+    if _srv().SECURE_MODE:
+        return _srv()._supervisor_gateway_exec(prof, args)
+    cli = ["/opt/hermes/bin/hermes", "-p", prof, *args]
+    if prof == _srv()._primary_profile():
+        return _docker_exec(_srv().GATEWAY_CONTAINER_NAME, cli, acting_profile=prof)
+    home = _profile_home_container(prof)
+    inner = " ".join(shlex.quote(part) for part in cli)
+    shell = (
+        f"export HERMES_HOME={shlex.quote(home)} HOME={shlex.quote(home)}; "
+        f"cd {shlex.quote(home)}; {inner}"
+    )
+    return _docker_exec(_srv().GATEWAY_CONTAINER_NAME, ["sh", "-lc", shell], acting_profile=prof)
+
+
+def _hermes_agent_version() -> str:
+    """Native Hermes semver from `hermes --version` inside the gateway container."""
+    try:
+        code, out = _gateway_exec(_srv()._primary_profile(), ["--version"])
+        if code != 0:
+            return ""
+        return stack_updates.parse_hermes_version_output(out)
+    except Exception:  # noqa: BLE001
+        return ""

package/workframe-api/doctor_runtime.py

@@ -0,0 +1,109 @@
+"""WF-032 extract: doctor audit/repair for agent DM runtime profiles."""
+
+from __future__ import annotations
+
+import sqlite3
+from typing import Any
+
+
+def _srv():
+    import server as srv
+
+    return srv
+
+
+def iter_agent_dm_runtime_slots(conn: sqlite3.Connection) -> list[dict[str, str]]:
+    """All (workspace, agent, user) slots that need a u-* runtime for agent DM bind."""
+    rows = conn.execute(
+        """
+        SELECT r.workspace_id, r.agent_profile_id, rm.user_id
+        FROM rooms r
+        JOIN room_memberships rm ON rm.room_id = r.id AND rm.deleted_at IS NULL
+        WHERE r.deleted_at IS NULL
+          AND r.room_type = 'direct'
+          AND r.agent_profile_id IS NOT NULL
+          AND TRIM(r.agent_profile_id) != ''
+        """,
+    ).fetchall()
+    seen: set[tuple[str, str, str]] = set()
+    slots: list[dict[str, str]] = []
+    for row in rows:
+        workspace_id = str(row["workspace_id"] or "").strip()
+        agent_ref = str(row["agent_profile_id"] or "").strip()
+        user_id = str(row["user_id"] or "").strip()
+        if not workspace_id or not agent_ref or not user_id:
+            continue
+        key = (workspace_id, agent_ref, user_id)
+        if key in seen:
+            continue
+        seen.add(key)
+        agent_row = _srv()._lookup_agent_profile(conn, workspace_id, agent_ref)
+        if not agent_row:
+            continue
+        template = str(agent_row["slug"] or "").strip()
+        if not template:
+            continue
+        runtime = _srv()._runtime_profile_slug(user_id, template)
+        slots.append({
+            "workspace_id": workspace_id,
+            "agent_profile_id": str(agent_row["id"]),
+            "user_id": user_id,
+            "template": template,
+            "runtime": runtime,
+            "on_disk": _srv()._runtime_profile_on_disk(runtime),
+        })
+    return slots
+
+
+def doctor_audit_agent_dm_runtimes() -> dict[str, Any]:
+    """Report missing u-* runtimes for agent DM rooms — no mutations."""
+    conn = _srv()._workframe_db()
+    try:
+        slots = iter_agent_dm_runtime_slots(conn)
+    finally:
+        conn.close()
+    missing = [s for s in slots if not s["on_disk"]]
+    return {
+        "ok": True,
+        "total": len(slots),
+        "present": len(slots) - len(missing),
+        "missing": missing,
+    }
+
+
+def doctor_repair_agent_dm_runtimes(*, repair: bool = True) -> dict[str, Any]:
+    """Explicit repair — provision missing u-* runtimes for agent DM rooms."""
+    conn = _srv()._workframe_db()
+    try:
+        slots = iter_agent_dm_runtime_slots(conn)
+    finally:
+        conn.close()
+    missing = [s for s in slots if not s["on_disk"]]
+    if not repair:
+        return doctor_audit_agent_dm_runtimes()
+    repaired: list[dict[str, str]] = []
+    failed: list[dict[str, str]] = []
+    for slot in missing:
+        runtime = slot["runtime"]
+        try:
+            _srv().ensure_runtime_profile(
+                runtime,
+                slot["template"],
+                slot["user_id"],
+                slot["workspace_id"],
+            )
+            if _srv()._runtime_profile_on_disk(runtime):
+                repaired.append(slot)
+            else:
+                failed.append({**slot, "error": "runtime_still_missing"})
+        except Exception as exc:  # noqa: BLE001
+            failed.append({**slot, "error": str(exc)})
+    still_missing = [s for s in missing if not _srv()._runtime_profile_on_disk(s["runtime"])]
+    return {
+        "ok": not failed and not still_missing,
+        "total": len(slots),
+        "missing_before": len(missing),
+        "repaired": repaired,
+        "failed": failed,
+        "still_missing": still_missing,
+    }

package/workframe-api/domain/__init__.py

@@ -0,0 +1,47 @@
+"""Workframe domain model (WF-039)."""
+
+from domain.entities import (
+    ActorType,
+    AgentIdentity,
+    Cell,
+    CredentialPolicy,
+    CredentialRef,
+    DeploymentMode,
+    FundingSource,
+    Grant,
+    GrantCapability,
+    Lease,
+    LeaseStatus,
+    Run,
+    RunEvent,
+    RunStatus,
+    RunSurface,
+    RuntimeBinding,
+    RuntimeBindingStatus,
+    RuntimeKind,
+    User,
+    Workspace,
+)
+
+__all__ = [
+    "ActorType",
+    "AgentIdentity",
+    "Cell",
+    "CredentialPolicy",
+    "CredentialRef",
+    "DeploymentMode",
+    "FundingSource",
+    "Grant",
+    "GrantCapability",
+    "Lease",
+    "LeaseStatus",
+    "Run",
+    "RunEvent",
+    "RunStatus",
+    "RunSurface",
+    "RuntimeBinding",
+    "RuntimeBindingStatus",
+    "RuntimeKind",
+    "User",
+    "Workspace",
+]

package/workframe-api/domain/entities.py

@@ -0,0 +1,252 @@
+"""Workframe domain entities — stable vocabulary for authority, runs, and credentials.
+
+Referenced by WF-009 RunAuthorityGate, WF-NS-P2 runs tables, and public glossary (WF-NS-P0).
+Implementation in server.py still uses legacy shapes; migrate incrementally (WF-032).
+"""
+
+from __future__ import annotations
+
+from dataclasses import asdict, dataclass, field
+from datetime import datetime
+from enum import Enum
+from typing import Any, Literal, Mapping, TypeVar
+
+T = TypeVar("T", bound="DomainEntity")
+
+
+class DomainEntity:
+    """Minimal JSON round-trip for dataclass entities."""
+
+    def to_dict(self) -> dict[str, Any]:
+        return _encode_value(asdict(self))
+
+    @classmethod
+    def from_dict(cls: type[T], data: Mapping[str, Any]) -> T:
+        return cls(**dict(data))
+
+
+def _encode_value(value: Any) -> Any:
+    if isinstance(value, datetime):
+        return value.isoformat()
+    if isinstance(value, Enum):
+        return value.value
+    if isinstance(value, dict):
+        return {k: _encode_value(v) for k, v in value.items()}
+    if isinstance(value, list):
+        return [_encode_value(v) for v in value]
+    return value
+
+
+class DeploymentMode(str, Enum):
+    SINGLE_USER_LOCAL = "single_user_local"
+    TRUSTED_TEAM = "trusted_team"
+    PUBLIC_MULTI_USER = "public_multi_user"
+
+
+class ActorType(str, Enum):
+    USER = "user"
+    AGENT = "agent"
+    SYSTEM = "system"
+    WEBHOOK = "webhook"
+
+
+class RunStatus(str, Enum):
+    PENDING = "pending"
+    AUTHORIZED = "authorized"
+    RUNNING = "running"
+    COMPLETED = "completed"
+    FAILED = "failed"
+    CANCELLED = "cancelled"
+    DENIED = "denied"
+
+
+class RunSurface(str, Enum):
+    AGENT_RAIL = "agent_rail"
+    CHAT = "chat"
+    FILES = "files"
+    BROWSER = "browser"
+    ACTIVITY = "activity"
+    KANBAN = "kanban"
+    CRON = "cron"
+    SLASH = "slash"
+    WEBHOOK = "webhook"
+    MENTION = "mention"
+
+
+class RuntimeKind(str, Enum):
+    HERMES_MANAGED = "hermes_managed"
+    CANDIDATE = "candidate"
+    ADAPTER = "adapter"
+
+
+class RuntimeBindingStatus(str, Enum):
+    ACTIVE = "active"
+    DETACHED = "detached"
+    CANDIDATE = "candidate"
+
+
+class FundingSource(str, Enum):
+    BYOK = "byok"
+    COMPANY = "company"
+    HYBRID = "hybrid"
+
+
+class CredentialPolicy(str, Enum):
+    BYOK = "byok"
+    COMPANY = "company"
+    USER_ONLY = "user_only"
+
+
+class LeaseStatus(str, Enum):
+    ACTIVE = "active"
+    EXPIRED = "expired"
+    REVOKED = "revoked"
+
+
+class GrantCapability(str, Enum):
+    LLM_TURN = "llm_turn"
+    TOOL_CALL = "tool_call"
+    FILE_READ = "file_read"
+    FILE_WRITE = "file_write"
+    FILE_DELETE = "file_delete"
+    RUNTIME_EXEC = "runtime_exec"
+    BROKER_EGRESS = "broker_egress"
+
+
+@dataclass(frozen=True)
+class Cell(DomainEntity):
+    """One Workframe install/deployment unit (generated project root)."""
+
+    cell_id: str
+    install_root: str
+    manifest_path: str
+    package_name: str
+    package_version: str
+    deployment_mode: DeploymentMode
+    created_at: datetime
+    git_ref: str | None = None
+    packed_artifact_digest: str | None = None
+
+
+@dataclass(frozen=True)
+class User(DomainEntity):
+    user_id: str
+    workspace_id: str
+    email: str
+    display_name: str
+    role: Literal["owner", "admin", "member", "guest"] = "member"
+    created_at: datetime | None = None
+
+
+@dataclass(frozen=True)
+class Workspace(DomainEntity):
+    workspace_id: str
+    cell_id: str
+    slug: str
+    name: str
+    created_at: datetime | None = None
+
+
+@dataclass(frozen=True)
+class AgentIdentity(DomainEntity):
+    """Persistent Workframe agent — distinct from Hermes profile (WF-013 seam)."""
+
+    agent_id: str
+    workspace_id: str
+    template_slug: str
+    display_name: str
+    is_native: bool = False
+    created_at: datetime | None = None
+
+
+@dataclass(frozen=True)
+class RuntimeBinding(DomainEntity):
+    """Links AgentIdentity to a concrete runtime (Hermes profile today)."""
+
+    binding_id: str
+    agent_id: str
+    runtime_kind: RuntimeKind
+    profile_slug: str
+    status: RuntimeBindingStatus = RuntimeBindingStatus.ACTIVE
+    detected_at: datetime | None = None
+
+
+@dataclass(frozen=True)
+class Run(DomainEntity):
+    """Unit of authority, execution, and economics (WF-009, WF-NS-P2)."""
+
+    run_id: str
+    workspace_id: str
+    surface: RunSurface
+    actor_type: ActorType
+    actor_id: str
+    triggering_user_id: str
+    agent_id: str
+    runtime_binding_id: str
+    status: RunStatus
+    payer_user_id: str
+    funding_source: FundingSource
+    room_id: str | None = None
+    card_id: str | None = None
+    engine: str = "hermes"
+    runtime: str = "hermes_managed"
+    risk_tier: Literal["low", "medium", "high"] = "low"
+    budget_usd: float | None = None
+    deny_reason: str | None = None
+    created_at: datetime | None = None
+    started_at: datetime | None = None
+    ended_at: datetime | None = None
+
+
+@dataclass(frozen=True)
+class RunEvent(DomainEntity):
+    event_id: str
+    run_id: str
+    event_type: str
+    payload: dict[str, Any] = field(default_factory=dict)
+    created_at: datetime | None = None
+
+
+@dataclass(frozen=True)
+class CredentialRef(DomainEntity):
+    """Vault pointer — never holds raw secret material."""
+
+    ref_id: str
+    workspace_id: str
+    provider: str
+    policy: CredentialPolicy
+    user_id: str | None = None
+    binding_id: str | None = None
+    label_redacted: str | None = None
+
+
+@dataclass(frozen=True)
+class Lease(DomainEntity):
+    """Scoped credential lease for one run (maps to turn_credential_leases / wf_rt_*)."""
+
+    lease_id: str
+    run_id: str
+    workspace_id: str
+    payer_user_id: str
+    provider: str
+    profile_slug: str
+    credential_ref_id: str | None
+    status: LeaseStatus
+    expires_at: datetime
+    revoked_at: datetime | None = None
+    created_at: datetime | None = None
+
+
+@dataclass(frozen=True)
+class Grant(DomainEntity):
+    """Capability granted to a run before execution (RunAuthorityGate output)."""
+
+    grant_id: str
+    run_id: str
+    capability: GrantCapability
+    scope: dict[str, Any] = field(default_factory=dict)
+    granted_by: Literal["run_authority_gate", "cell_authority_gate", "policy"] = (
+        "run_authority_gate"
+    )
+    expires_at: datetime | None = None
+    created_at: datetime | None = None