failproofai 1.0.12-beta.1 → 1.0.12

package/.next/standalone/fp-cloud-cli/fp_cli/client.py

@@ -31,6 +31,7 @@ from .errors import (
     ApiError,
     AuthError,
     ForbiddenError,
+    FpCliError,
     KeyModeUnsupportedError,
     NetworkError,
     NotFoundError,
@@ -134,6 +135,14 @@ _V1_MECHANICAL_FAMILIES = frozenset(
         "alerts",
         "audits",
         "evaluations",
+        "evaluator-definitions",
+        "evaluator-instances",
+        "evaluator-schema-profile",
+        "evaluation-jobs",
+        "dashboards",
+        "otel",
+        "offers",
+        "team-trial",
         "events",
         "issues",
         "keys",
@@ -152,6 +161,7 @@ _V1_MECHANICAL_FAMILIES = frozenset(
 # family rule, which is why this must stay exact-match.
 _V1_RENAMED = {
     "/api/evaluations/score-keys": "/v1/evaluations/score_keys",
+    "/api/evaluations/metric-keys": "/v1/evaluations/metric_keys",
 }
 
 # Families with no `/v1` route, and why — the message a user actually sees.
@@ -173,6 +183,8 @@ _V1_NO_EQUIVALENT = {
         "cloud-managed policies are an operator surface — the fleet routes are "
         "deliberately absent from /v1, which is internet-facing"
     ),
+    "integrations": "dashboard integration routes need a signed-in session",
+    "orgs": "organization creation needs a signed-in user",
 }
 
 
@@ -375,6 +387,40 @@ def _required_permission(response: httpx.Response) -> Optional[str]:
     return None
 
 
+def _unknown_route_response(response: httpx.Response) -> Optional[bool]:
+    """Use explicit 404 details first; an empty/generic reply is ambiguous."""
+    try:
+        data = response.json()
+    except ValueError:
+        return None
+    if not isinstance(data, dict):
+        return None
+    code = data.get("code") or data.get("error_code") or data.get("error") or ""
+    if isinstance(code, dict):
+        code = code.get("code", "")
+    code = str(code).lower()
+    if code in ("unknown_route", "route_not_found", "unknown_endpoint", "endpoint_not_found"):
+        return True
+    if code in ("record_not_found", "resource_not_found", "entity_not_found", "session_not_found", "query_not_found"):
+        return False
+    message = _extract_error(response)
+    if not message:
+        return None
+    lower = message.lower().strip().rstrip(".")
+    if re.search(
+        r"\b(?:unknown|unrecognized|unsupported|missing|no such)\s+(?:api\s+)?(?:route|endpoint)\b"
+        r"|\b(?:route|endpoint)\b.*\b(?:not found|not available|does not exist|absent|unknown)\b"
+        r"|\bcannot (?:get|post|put|patch|delete)\s+/",
+        lower,
+    ):
+        return True
+    if lower in ("not found", "not_found", "404", "404 not found"):
+        return None
+    # A specific response ("session not found", "offer expired", etc.) came
+    # from a handler, rather than the router. Do not replace its useful detail.
+    return False
+
+
 def _raise_for_status(response: httpx.Response, ctx: ClientContext) -> None:
     key_mode = ctx.auth_mode is AuthMode.API_KEY
     if response.status_code < 400:
@@ -474,7 +520,9 @@ def _raise_for_status(response: httpx.Response, ctx: ClientContext) -> None:
                     request_id=request_id,
                     hint="point --base-url at the server itself, e.g. http://localhost:8080",
                 )
-        raise NotFoundError(message or "Not found.", request_id=request_id)
+        error = NotFoundError(message or "Not found.", request_id=request_id)
+        error.route_unknown = _unknown_route_response(response)
+        raise error
     if response.status_code == 429:
         retry_after = response.headers.get("retry-after")
         wait = f" Retry after {retry_after}s." if retry_after else " Please wait a moment and try again."
@@ -606,6 +654,121 @@ def _delete(ctx: ClientContext, path: str) -> Any:
     return _request_json(ctx, "DELETE", path)
 
 
+def cloud_request(
+    ctx: ClientContext, method: str, path: str, *,
+    body: Any = None, params: Optional[Dict[str, Any]] = None,
+) -> Any:
+    """New Cloud capabilities, with a predictable older-deployment failure.
+
+    Existing callers retain their response and error contracts. Paths still pass
+    through the credential and identifier guards; this is not a second transport.
+    """
+    try:
+        if method == "GET":
+            return _get_json(ctx, path, params)
+        return _request_json(ctx, method, path, json_body=body, params=params)
+    except (NotFoundError, ApiError) as exc:
+        if isinstance(exc, ApiError) and exc.status != 404:
+            raise
+        raise _cloud_not_found(exc, path, body=body, params=params) from exc
+
+
+def _cloud_not_found(exc: FpCliError, path: str, *, body=None, params=None) -> NotFoundError:
+    """Classify ambiguous 404s from the request; never claim a record is a route.
+
+    Top-level collections and named capability endpoints have no record segment.
+    Scoped collections (/dashboards/ID/tiles) and actions on records default to a
+    missing record unless the response explicitly says the route is unknown.
+    """
+    route_unknown = getattr(exc, "route_unknown", None)
+    if isinstance(exc, ApiError):
+        # The transport only raises HTTP 404 ApiError for an HTML front door.
+        route_unknown = True
+    if route_unknown is None:
+        segments = path.removeprefix("/api/").split("/")
+        family = segments[0]
+        capability = len(segments) == 1 or (
+            family == "agent" and len(segments) == 2
+            or family == "otel" and segments == ["otel", "status"]
+            or family == "offers" and segments[1:] in (["me"], ["claim"])
+            or family == "team-trial" and segments == ["team-trial", "me"]
+            or family == "integrations" and segments == ["integrations", "slack"]
+            or family == "events" and segments in (
+                ["events", "summary"], ["events", "latency_aggregate"],
+                ["events", "sentiment"], ["events", "sentiment", "messages"],
+                ["events", "sentiment", "sessions"],
+            )
+            or family == "evaluator-definitions" and segments == ["evaluator-definitions", "dry-run"]
+            or family == "evaluations" and segments == ["evaluations", "backfill"]
+            or family == "queries" and segments[1:] in (["run"], ["schema"])
+            or family == "audits" and segments == ["audits", "contracts"]
+            or family == "alerts" and segments == ["alerts", "recipients"]
+            or family == "users" and segments == ["users", "defaults"]
+            or family == "usage" and segments == ["usage", "windows"]
+            or family == "settings" and segments == ["settings", "model-context-windows"]
+            or family == "settings" and len(segments) == 2
+        )
+        # Some collection operations name their target in a query or body.
+        request_body = body if isinstance(body, dict) else {}
+        record_selected = (
+            (params or {}).get("session_id") or (params or {}).get("model")
+            or request_body.get("query_id") or request_body.get("callId")
+            or request_body.get("session_ids") or request_body.get("offer_key")
+            or request_body.get("conversationId")
+        )
+        route_unknown = capability and not record_selected
+    if route_unknown:
+        return NotFoundError(
+            "not available on this FailproofAI Cloud yet",
+            hint="upgrade your Cloud deployment to use this route",
+            request_id=exc.request_id,
+        )
+    message = exc.message
+    if message.lower().strip().rstrip(".") in (
+        "not found", "not_found", "record_not_found", "resource_not_found",
+        "entity_not_found", "session_not_found", "query_not_found",
+    ):
+        message = f"Record not found at {path}"
+    return NotFoundError(message, request_id=exc.request_id)
+
+
+def import_events_file(
+    ctx: ClientContext, data: bytes, params: Dict[str, Any],
+) -> Any:
+    """POST /api/events/import — one file's bytes (gzip accepted), as the dashboard's
+    import dialog sends it. ``params``: format, path, environment, dry_run, existing_before."""
+    clean = {k: v for k, v in params.items() if v is not None} or None
+    url = _path(ctx, "/api/events/import")
+    try:
+        with _client(ctx) as client:
+            response = client.request(
+                "POST", url, content=data, params=clean,
+                headers={"Content-Type": "application/octet-stream"},
+            )
+    except httpx.RequestError as exc:
+        raise NetworkError(
+            f"Cannot reach FailproofAI Cloud at {ctx.base_url}: {exc}",
+            request_id=_sent_request_id(exc),
+        )
+    _raise_for_status(response, ctx)
+    if not response.content:
+        return {}
+    try:
+        return response.json()
+    except ValueError:
+        raise ApiError("The dashboard returned an invalid import response.")
+
+
+def cloud_stream(ctx: ClientContext, path: str, body: Dict[str, Any]) -> Iterator[Dict[str, Any]]:
+    """Dashboard SSE with the same additive-capability 404 contract."""
+    try:
+        yield from _stream_sse(ctx, path, body)
+    except (NotFoundError, ApiError) as exc:
+        if isinstance(exc, ApiError) and exc.status != 404:
+            raise
+        raise _cloud_not_found(exc, path, body=body) from exc
+
+
 # --- Auth / identity --------------------------------------------------------
 
 
@@ -793,6 +956,10 @@ _FACET_PATHS = {
     # Evaluation score keys (a distinct endpoint, not /api/events) — the source for
     # the sessions-page score-filter dropdown; needs `evaluations:read`.
     "score_filters": "/api/evaluations/score-keys",
+    # Evaluation-side facets: environments with evaluation results, and metric
+    # keys (the server returns {name, unit, count}; `list` shows the names).
+    "eval_environments": "/api/evaluations/environments",
+    "metric_keys": "/api/evaluations/metric-keys",
 }
 FACET_KINDS = tuple(_FACET_PATHS.keys())
 
@@ -800,7 +967,9 @@ FACET_KINDS = tuple(_FACET_PATHS.keys())
 def list_facet(ctx: ClientContext, kind: str) -> List[str]:
     """GET /api/events/<kind> — distinct facet values (a bare JSON array)."""
     data = _get_json(ctx, _FACET_PATHS[kind])
-    return [str(x) for x in data] if isinstance(data, list) else []
+    if not isinstance(data, list):
+        return []
+    return [str(x.get("name", "")) if isinstance(x, dict) else str(x) for x in data]
 
 
 def get_usage(ctx: ClientContext) -> Dict[str, Any]:
@@ -1195,20 +1364,28 @@ def list_incidents(
     state: Optional[str] = None,
     alert_id: Optional[str] = None,
     limit: Optional[int] = None,
+    filters: Optional[Dict[str, Any]] = None,
 ) -> List[Incident]:
     """GET /api/issues (or /api/alerts/{id}/issues when alert_id given). The
     alert-scoped path honours ``state``/``limit`` too — pass them so the filters aren't silently
     dropped on that path (``_get_json`` omits None params)."""
-    if alert_id:
+    extra = {k: v for k, v in (filters or {}).items() if v is not None}
+    if alert_id and not extra:
         data = _get_json(ctx, f"/api/alerts/{alert_id}/issues", {"state": state, "limit": limit})
+    elif alert_id:
+        # The board's own filters live on /issues, which takes alert_id as one of them.
+        data = _get_json(ctx, "/api/issues", {"state": state, "limit": limit, "alert_id": alert_id, **extra})
     else:
-        data = _get_json(ctx, "/api/issues", {"state": state, "limit": limit})
+        data = _get_json(ctx, "/api/issues", {"state": state, "limit": limit, **extra})
     return [Incident.from_dict(i) for i in (data if isinstance(data, list) else [])]
 
 
-def count_incidents(ctx: ClientContext, *, state: Optional[str] = None) -> int:
+def count_incidents(
+    ctx: ClientContext, *, state: Optional[str] = None, filters: Optional[Dict[str, Any]] = None,
+) -> int:
     """GET /api/issues/count — {count}."""
-    data = _get_json(ctx, "/api/issues/count", {"state": state})
+    extra = {k: v for k, v in (filters or {}).items() if v is not None}
+    data = _get_json(ctx, "/api/issues/count", {"state": state, **extra})
     if not isinstance(data, dict):
         return 0
     try:
@@ -1532,6 +1709,8 @@ def agent_chat_oneshot(
     conversation_id: Optional[str] = None,
     page_context: Optional[str] = None,
     model: Optional[str] = None,
+    on_ask_user: Optional[Callable[[Dict[str, Any]], None]] = None,
+    on_artifact: Optional[Callable[[Dict[str, Any]], None]] = None,
 ) -> Dict[str, Any]:
     """POST /api/agent/chat — accumulate the streamed answer.
 
@@ -1551,20 +1730,32 @@ def agent_chat_oneshot(
         body["pageContext"] = page_context
     if model:
         body["model"] = model
+    if on_artifact:
+        body["pageActions"] = [{"action": "open_artifact"}, {"action": "home"}]
     parts: List[str] = []
     tools: List[str] = []
     interrupted = False
     error: Optional[str] = None
-    for ev in _stream_sse(ctx, "/api/agent/chat", body):
+    for ev in cloud_stream(ctx, "/api/agent/chat", body):
         kind = ev.get("type")
         if kind == "text-delta":
             parts.append(str(ev.get("text", "")))
         elif kind == "tool-start":
             tools.append(str(ev.get("tool", "")))
         elif kind == "ask-user":
+            if on_ask_user and ev.get("callId"):
+                on_ask_user(ev)
+                continue
             interrupted = True
             error = str(ev.get("question") or "the assistant needs interactive input")
             break
+        elif kind == "ui-action" and on_artifact:
+            if ev.get("action") == "open_artifact" and isinstance(ev.get("artifact"), dict):
+                on_artifact(ev["artifact"])
+            elif ev.get("action") == "home" and isinstance(ev.get("home"), dict):
+                for block in ev["home"].get("blocks", []):
+                    if isinstance(block, dict):
+                        on_artifact(block)
         elif kind == "error":
             error = str(ev.get("message", "assistant error"))
         elif kind == "done":
@@ -1785,42 +1976,16 @@ def deploy_policies(
     ctx: ClientContext,
     machine_id: str,
     policies: Sequence[PolicyRef],
-    jev_mode: Optional[str] = None,
 ) -> Deployment:
     """PUT /api/enforcement/deployments/{id} — REPLACES the machine's whole set.
 
-    ``jev_mode`` (``off|observe|enforce|local``) is sent only when given: the
-    server reads an ABSENT ``jevMode`` as "keep the machine's current one", so a
-    deploy that says nothing about Jev never changes it. ``local`` stops
-    FailproofAI Cloud overriding the machine's own mode.
+    Never carries a Jev mode: FailproofAI Cloud derives it from the set.
     """
     path = f"/api/enforcement/deployments/{machine_id}"
     body: Dict[str, Any] = {"policies": [p.to_dict() for p in policies]}
-    if jev_mode is not None:
-        body["jevMode"] = jev_mode
     return Deployment.from_dict(_request_json(ctx, "PUT", path, json_body=body) or {})
 
 
-def set_jev_mode(ctx: ClientContext, machine_id: str, jev_mode: str) -> Tuple[Deployment, bool]:
-    """PUT /api/enforcement/deployments/{id}/jev-mode — change ONLY the Jev mode.
-
-    ``jev_mode`` is ``off|observe|enforce|local`` (``local`` stops FailproofAI
-    Cloud overriding the machine's own mode). Unlike a deploy, this never
-    touches the machine's policy set: a deploy is a full replace of the set, and
-    the set a client can read leaves out disabled policies' assignments, so a
-    mode change sent as a deploy deleted them — and reverted any edit made since
-    the set was read. It still mints a new generation, which is how the machine
-    picks the mode up.
-
-    Returns the deployment and whether anything changed: setting the mode the
-    machine already has changes nothing and mints nothing (``changed: false``).
-    A machine with no deployment is a 404 — a deploy is how it gets its first.
-    """
-    path = f"/api/enforcement/deployments/{machine_id}/jev-mode"
-    data = _request_json(ctx, "PUT", path, json_body={"jevMode": jev_mode}) or {}
-    return Deployment.from_dict(data), bool(data.get("changed", True))
-
-
 def deployment_history(ctx: ClientContext, machine_id: str) -> List[Dict[str, Any]]:
     """GET /api/enforcement/deployments/{id}/history — every generation, newest first."""
     path = f"/api/enforcement/deployments/{machine_id}/history"