synapse-orch-ai 0.1.0

package/backend/core/routes/vault.py

@@ -0,0 +1,254 @@
+"""
+Vault management REST API.
+
+Handles CRUD operations on the user-managed vault directory (data/vault/ minus the
+auto-generated tool_outputs/ subfolder).  Only .json and .md files may be created.
+"""
+import json
+import os
+import shutil
+from pathlib import Path
+from typing import Optional
+
+from fastapi import APIRouter, HTTPException, Query
+from pydantic import BaseModel
+
+from core.config import DATA_DIR
+
+router = APIRouter()
+
+# Root directory exposed to the frontend
+VAULT_USER_DIR = Path(DATA_DIR) / "vault"
+_EXCLUDED = set()
+_ALLOWED_EXTENSIONS = {".json", ".md", ".txt"}
+
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+def _vault_root() -> Path:
+    VAULT_USER_DIR.mkdir(parents=True, exist_ok=True)
+    return VAULT_USER_DIR
+
+
+def _resolve(rel: str) -> Path:
+    """Resolve a relative vault path to an absolute path, preventing traversal."""
+    root = _vault_root()
+    # Strip leading slashes/dots from the client-supplied path
+    clean = rel.lstrip("/").lstrip("./")
+    resolved = (root / clean).resolve()
+    # Ensure it stays inside the vault root
+    if not str(resolved).startswith(str(root.resolve())):
+        raise HTTPException(status_code=403, detail="Path traversal denied")
+    return resolved
+
+
+def _is_excluded(path: Path) -> bool:
+    """Return True if the path is inside an excluded subfolder."""
+    root = _vault_root().resolve()
+    rel = path.resolve().relative_to(root)
+    parts = rel.parts
+    return len(parts) > 0 and parts[0] in _EXCLUDED
+
+
+def _build_tree(directory: Path, root: Path) -> list[dict]:
+    """Recursively build a file/folder tree, excluding _EXCLUDED dirs."""
+    items: list[dict] = []
+    try:
+        entries = sorted(directory.iterdir(), key=lambda p: (p.is_file(), p.name.lower()))
+    except PermissionError:
+        return items
+
+    for entry in entries:
+        if entry.name.startswith("."):
+            continue
+        rel_path = str(entry.resolve().relative_to(root.resolve()))
+        if entry.is_dir():
+            if entry.name in _EXCLUDED:
+                continue
+            items.append({
+                "name": entry.name,
+                "path": rel_path,
+                "type": "folder",
+                "children": _build_tree(entry, root),
+            })
+        elif entry.is_file():
+            items.append({
+                "name": entry.name,
+                "path": rel_path,
+                "type": "file",
+                "ext": entry.suffix.lower(),
+            })
+    return items
+
+
+# ---------------------------------------------------------------------------
+# Endpoints
+# ---------------------------------------------------------------------------
+
+@router.get("/api/vault/tree")
+async def get_vault_tree():
+    """Return the full directory tree beneath the user vault root."""
+    root = _vault_root()
+    return {"tree": _build_tree(root, root)}
+
+
+@router.get("/api/vault/search")
+async def search_vault_files(q: str = Query(default="", description="Search query")):
+    """Search vault files by name (for @ mention autocomplete)."""
+    root = _vault_root()
+    results: list[dict] = []
+    q_lower = q.strip().lower()
+
+    for p in root.rglob("*"):
+        if p.is_file() and not _is_excluded(p):
+            if not q_lower or q_lower in p.name.lower():
+                rel = str(p.resolve().relative_to(root.resolve()))
+                results.append({
+                    "name": p.name,
+                    "path": rel,
+                    "ext": p.suffix.lower(),
+                })
+            if len(results) >= 20:
+                break
+
+    return {"files": results}
+
+
+@router.get("/api/vault/file")
+async def get_vault_file(path: str = Query(..., description="Relative path to vault file")):
+    """Return the content of a vault file."""
+    p = _resolve(path)
+    if not p.exists() or not p.is_file():
+        raise HTTPException(status_code=404, detail="File not found")
+    if _is_excluded(p):
+        raise HTTPException(status_code=403, detail="Access denied")
+    try:
+        content = p.read_text(encoding="utf-8")
+        return {"path": path, "name": p.name, "ext": p.suffix.lower(), "content": content}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+class CreateFileRequest(BaseModel):
+    path: str          # relative parent folder path (empty = vault root)
+    name: str          # filename including extension (.json or .md)
+    content: Optional[str] = ""
+
+
+@router.post("/api/vault/file")
+async def create_vault_file(req: CreateFileRequest):
+    """Create a new .json or .md file in the vault."""
+    suffix = Path(req.name).suffix.lower()
+    if suffix not in _ALLOWED_EXTENSIONS:
+        raise HTTPException(status_code=400, detail=f"Only {', '.join(_ALLOWED_EXTENSIONS)} files are allowed")
+
+    parent = _resolve(req.path) if req.path.strip() else _vault_root()
+    if not parent.is_dir():
+        raise HTTPException(status_code=400, detail="Parent path is not a directory")
+    if _is_excluded(parent):
+        raise HTTPException(status_code=403, detail="Cannot create files in excluded directories")
+
+    target = parent / req.name
+    if target.exists():
+        raise HTTPException(status_code=409, detail="File already exists")
+
+    # Provide sensible default content
+    initial_content = req.content or ""
+    if not initial_content:
+        if suffix == ".json":
+            initial_content = "{}\n"
+        elif suffix == ".txt":
+            initial_content = ""
+        else:
+            initial_content = f"# {Path(req.name).stem}\n\n"
+
+    try:
+        target.write_text(initial_content, encoding="utf-8")
+        root = _vault_root()
+        rel = str(target.resolve().relative_to(root.resolve()))
+        return {"path": rel, "name": target.name, "ext": suffix, "content": initial_content}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+class UpdateFileRequest(BaseModel):
+    path: str
+    content: str
+
+
+@router.put("/api/vault/file")
+async def update_vault_file(req: UpdateFileRequest):
+    """Update the content of an existing vault file."""
+    p = _resolve(req.path)
+    if not p.exists() or not p.is_file():
+        raise HTTPException(status_code=404, detail="File not found")
+    if _is_excluded(p):
+        raise HTTPException(status_code=403, detail="Access denied")
+    if p.suffix.lower() not in _ALLOWED_EXTENSIONS:
+        raise HTTPException(status_code=400, detail="Cannot edit this file type")
+    try:
+        p.write_text(req.content, encoding="utf-8")
+        return {"status": "ok", "path": req.path}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+class CreateFolderRequest(BaseModel):
+    path: str    # relative parent path (empty = vault root)
+    name: str    # new folder name
+
+
+@router.post("/api/vault/folder")
+async def create_vault_folder(req: CreateFolderRequest):
+    """Create a new folder inside the vault."""
+    if req.name in _EXCLUDED:
+        raise HTTPException(status_code=400, detail="Reserved folder name")
+
+    parent = _resolve(req.path) if req.path.strip() else _vault_root()
+    if not parent.is_dir():
+        raise HTTPException(status_code=400, detail="Parent path is not a directory")
+    if _is_excluded(parent):
+        raise HTTPException(status_code=403, detail="Cannot create folders in excluded directories")
+
+    target = parent / req.name
+    if target.exists():
+        raise HTTPException(status_code=409, detail="Folder already exists")
+
+    try:
+        target.mkdir(parents=True)
+        root = _vault_root()
+        rel = str(target.resolve().relative_to(root.resolve()))
+        return {"path": rel, "name": req.name, "type": "folder"}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+class DeleteItemRequest(BaseModel):
+    path: str
+
+
+@router.delete("/api/vault/item")
+async def delete_vault_item(req: DeleteItemRequest):
+    """Delete a file or folder (recursive) from the vault."""
+    p = _resolve(req.path)
+    if not p.exists():
+        raise HTTPException(status_code=404, detail="Path not found")
+    if _is_excluded(p):
+        raise HTTPException(status_code=403, detail="Cannot delete system directories")
+
+    # Prevent deleting a direct child that matches an excluded name
+    root = _vault_root().resolve()
+    rel_parts = p.resolve().relative_to(root).parts
+    if len(rel_parts) == 1 and rel_parts[0] in _EXCLUDED:
+        raise HTTPException(status_code=403, detail="Cannot delete system directories")
+
+    try:
+        if p.is_dir():
+            shutil.rmtree(p)
+        else:
+            p.unlink()
+        return {"status": "ok", "path": req.path}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))

package/backend/core/schedule_logger.py

@@ -0,0 +1,226 @@
+"""
+Plain-text debug logging for individual schedule runs.
+Mirrors the design of agent_logger.py exactly.
+"""
+import asyncio
+import json
+import os
+import re
+import time
+from pathlib import Path
+
+LOGS_DIR = Path(__file__).parent.parent / "logs" / "schedule_logs"
+
+
+def _ensure_logs_dir():
+    LOGS_DIR.mkdir(parents=True, exist_ok=True)
+
+
+def _ts() -> str:
+    return time.strftime("%Y-%m-%d %H:%M:%S", time.gmtime())
+
+
+def _fmt_args(args) -> str:
+    try:
+        return json.dumps(args, indent=2, default=str)
+    except Exception:
+        return str(args)
+
+
+class ScheduleLogger:
+    """Appends debug lines to logs/schedule_logs/<run_id>.log for a single schedule execution."""
+
+    def __init__(
+        self,
+        schedule_id: str,
+        schedule_name: str,
+        target_type: str,
+        target_id: str,
+        prompt: str,
+    ):
+        _ensure_logs_dir()
+
+        # Sanitize schedule_id to prevent taint in self.path
+        clean_sched_id = re.sub(r"[^a-zA-Z0-9_\-]", "", schedule_id)
+        short_id = clean_sched_id.replace("sched_", "") if clean_sched_id.startswith("sched_") else clean_sched_id
+        self.run_id = f"schedulerun_{short_id}_{int(time.time() * 1000)}"
+        self.path = LOGS_DIR / f"{self.run_id}.log"
+        self._start_time = time.time()
+
+        prompt_preview = prompt[:300] + "..." if len(prompt) > 300 else prompt
+        self._write(f"""
+{'='*80}
+  SCHEDULE RUN LOG
+{'='*80}
+  Run ID          : {self.run_id}
+  Schedule ID     : {schedule_id}
+  Schedule Name   : {schedule_name}
+  Target Type     : {target_type}
+  Target ID       : {target_id}
+  Started at      : {_ts()}
+  Prompt          : {prompt_preview}
+{'='*80}
+""")
+
+    # -- Core write -----------------------------------------------------
+
+    def _write(self, text: str):
+        """Sync write -- only call from a thread (via _write_bg) or startup."""
+        with open(self.path, "a", encoding="utf-8") as f:
+            f.write(text)
+
+    def _write_bg(self, text: str):
+        """Fire-and-forget write that offloads to a thread so the event loop isn't blocked."""
+        try:
+            loop = asyncio.get_running_loop()
+            loop.run_in_executor(None, self._write, text)
+        except RuntimeError:
+            self._write(text)
+
+    # -- Run lifecycle ---------------------------------------------------
+
+    def run_end(self, status: str):
+        elapsed = round(time.time() - self._start_time, 2)
+        self._write_bg(f"""
+{'='*80}
+  SCHEDULE RUN FINISHED
+  Status   : {status}
+  Ended at : {_ts()}
+  Duration : {elapsed}s
+{'='*80}
+""")
+
+    # -- Event logging ---------------------------------------------------
+
+    def log_event(self, event: dict):
+        """Process an SSE event and write relevant info to the log."""
+        etype = event.get("type", "")
+
+        if etype == "_log_prompt":
+            prompt = event.get("prompt", "")
+            self._write_bg(f"""
+{'-'*80}
+  INPUT PROMPT:
+{self._indent(prompt)}
+{'-'*80}
+""")
+
+        elif etype == "tool_execution":
+            tool_name = event.get("tool_name", "")
+            args = event.get("args", {})
+            self._write_bg(f"""
+  TOOL CALL: {tool_name}
+     Arguments:
+{self._indent(_fmt_args(args), 6)}
+""")
+
+        elif etype == "tool_result":
+            tool_name = event.get("tool_name", "")
+            preview = event.get("preview", "")
+            self._write_bg(f"""
+  TOOL RESULT: {tool_name}
+     Preview: {preview[:500]}
+""")
+
+        elif etype in ("step_start", "step_complete", "orchestration_start", "orchestration_complete"):
+            name = event.get("step_name") or event.get("orchestration_name") or etype
+            self._write_bg(f"\n  [{etype.upper()}] {name}\n")
+
+        elif etype == "final":
+            response = event.get("response", "")
+            self._write_bg(f"""
+  AGENT RESPONSE:
+{self._indent(response[:3000])}
+""")
+
+        elif etype == "error":
+            self._write_bg(f"\n  ERROR: {event.get('message', '')}\n")
+
+        elif etype == "thinking":
+            pass  # skip noise
+
+    # -- Helpers ---------------------------------------------------------
+
+    @staticmethod
+    def _indent(text: str, spaces: int = 4) -> str:
+        prefix = " " * spaces
+        return "\n".join(f"{prefix}{line}" for line in text.split("\n"))
+
+    @staticmethod
+    def _safe_log_path(run_id: str) -> Path | None:
+        """
+        Safely locates a log file by matching run_id against actual file system entries.
+        This severs the taint chain for security scanners as the returned Path 
+        originates from the OS (iterdir), not user input.
+        """
+        if not run_id or not isinstance(run_id, str):
+            return None
+
+        # 1. Strict regex validation as a first pass
+        if not re.match(r"^[a-zA-Z0-9_\-\.]+$", run_id):
+            return None
+
+        # 2. Iterate and match (Taint-severing strategy)
+        try:
+            target_filename = f"{run_id}.log"
+            for entry in LOGS_DIR.iterdir():
+                if entry.is_file() and entry.name == target_filename:
+                    return entry
+        except Exception:
+            pass
+        return None
+
+    # -- Query helpers (for API endpoints) -------------------------------
+
+    @staticmethod
+    def get_log(run_id: str) -> str | None:
+        # Sanitize input immediately to satisfy scanner trace
+        if not run_id or not re.match(r"^[a-zA-Z0-9_\-\.]+$", str(run_id)):
+            return None
+
+        path = ScheduleLogger._safe_log_path(run_id)
+        if not path or not path.exists():
+            return None
+        return path.read_text(encoding="utf-8")
+
+    @staticmethod
+    def list_logs(limit: int = 100, offset: int = 0) -> list[dict]:
+        _ensure_logs_dir()
+        logs = []
+        files = sorted(LOGS_DIR.glob("*.log"), key=lambda p: p.stat().st_mtime, reverse=True)
+        for f in files[offset: offset + limit]:
+            run_id = f.stem
+            try:
+                head = f.read_text(encoding="utf-8", errors="replace")[:1000]
+
+                def _extract(label: str) -> str:
+                    for line in head.split("\n"):
+                        if label in line:
+                            return line.split(":", 1)[1].strip()
+                    return ""
+
+                logs.append({
+                    "run_id": run_id,
+                    "schedule_name": _extract("Schedule Name   :"),
+                    "schedule_id": _extract("Schedule ID     :"),
+                    "target_type": _extract("Target Type     :"),
+                    "target_id": _extract("Target ID       :"),
+                    "started_at": _extract("Started at      :"),
+                    "prompt": _extract("Prompt          :")[:200],
+                    "file_size_kb": round(f.stat().st_size / 1024, 1),
+                })
+            except Exception:
+                logs.append({"run_id": run_id})
+        return logs
+
+    @staticmethod
+    def delete_log(run_id: str) -> bool:
+        # Sanitize input immediately to satisfy scanner trace
+        if not run_id or not re.match(r"^[a-zA-Z0-9_\-\.]+$", str(run_id)):
+            return False
+
+        path = ScheduleLogger._safe_log_path(run_id)
+        if path and path.exists():
+            path.unlink()
+            return True
+        return False