aegis-gateway-core 2.0.0a0__tar.gz

aegis_gateway_core-2.0.0a0/.gitignore

@@ -0,0 +1,100 @@
+# Node/npm local installs
+node_modules/
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+.pnpm-store/
+
+# Local environment files
+.env
+.env.*
+!.env.example
+
+## jj
+.jj
+
+# Codex local configuration
+.codex/
+AGENTS.md
+
+# Claude Flow runtime data
+.claude-flow/data/
+.claude-flow/logs/
+CLAUDE.md
+.claude
+.claude-flow
+
+# MCP
+.mcp.json
+ruvector.db
+
+# ruflo agents
+.agents
+.swarm
+.agentdb
+agentdb.db
+
+# Environment variables
+.env
+.env.local
+.env.*.local
+
+# Created by https://www.toptal.com/developers/gitignore/api/visualstudiocode
+# Edit at https://www.toptal.com/developers/gitignore?templates=visualstudiocode
+
+### VisualStudioCode ###
+.vscode/*
+!.vscode/settings.json
+!.vscode/tasks.json
+!.vscode/launch.json
+!.vscode/extensions.json
+!.vscode/*.code-snippets
+.vscode
+
+# Local History for Visual Studio Code
+.history/
+
+# Built Visual Studio Code Extensions
+*.vsix
+
+### VisualStudioCode Patch ###
+# Ignore all local history of files
+.history
+.ionide
+
+### Misc files
+gemma4
+.postman/
+.openclaude/
+postman/
+
+### OpenClaude
+.openclaude-profile.json
+
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.pytest_cache/
+dist/
+build/
+*.egg
+.venv/
+.uv-cache/
+.tmp/
+.ruff_cache/
+
+# Docker
+.docker/
+
+### Build plans
+BUILD_PLAN.md
+CLAUDE.md
+PROJECT_SPEC.md
+AMEND_PLAN.md
+SOURCE_OF_TRUTH.md
+repo-seed/
+.import_linter_cache/
+site/
+
+# End of https://www.toptal.com/developers/gitignore/api/visualstudiocode

aegis_gateway_core-2.0.0a0/PKG-INFO

@@ -0,0 +1,26 @@
+Metadata-Version: 2.4
+Name: aegis-gateway-core
+Version: 2.0.0a0
+Summary: Aegis v2 — core kernel: plugin registry, typed config, pipeline contracts.
+Project-URL: Homepage, https://github.com/e-choness/aegis
+Project-URL: Repository, https://github.com/e-choness/aegis
+Project-URL: Issues, https://github.com/e-choness/aegis/issues
+License: MIT
+Requires-Python: >=3.12
+Requires-Dist: keyring>=25.0
+Requires-Dist: langchain-core>=0.3
+Requires-Dist: langchain-mcp-adapters>=0.1.0
+Requires-Dist: langgraph-checkpoint-postgres>=3.1.0
+Requires-Dist: langgraph-checkpoint-sqlite>=3.1.0
+Requires-Dist: langgraph>=0.2
+Requires-Dist: litellm>=1.0
+Requires-Dist: mcp>=1.0
+Requires-Dist: pluggy>=1.4
+Requires-Dist: pydantic-settings>=2.0
+Requires-Dist: pydantic>=2.0
+Requires-Dist: pyyaml>=6.0
+Provides-Extra: rag
+Requires-Dist: chromadb>=0.5; extra == 'rag'
+Requires-Dist: langchain-chroma>=0.1; extra == 'rag'
+Requires-Dist: langchain-postgres>=0.0.12; extra == 'rag'
+Requires-Dist: langchain-text-splitters>=0.3; extra == 'rag'

aegis_gateway_core-2.0.0a0/pyproject.toml

@@ -0,0 +1,41 @@
+[project]
+name = "aegis-gateway-core"
+version = "2.0.0a0"
+description = "Aegis v2 — core kernel: plugin registry, typed config, pipeline contracts."
+license = { text = "MIT" }
+requires-python = ">=3.12"
+
+dependencies = [
+    "pydantic>=2.0",
+    "pydantic-settings>=2.0",
+    "pluggy>=1.4",
+    "pyyaml>=6.0",
+    "keyring>=25.0",
+    "litellm>=1.0",
+    "langgraph>=0.2",
+    "langchain-core>=0.3",
+    "langgraph-checkpoint-sqlite>=3.1.0",
+    "langgraph-checkpoint-postgres>=3.1.0",
+    "mcp>=1.0",
+    "langchain-mcp-adapters>=0.1.0",
+]
+
+[project.urls]
+Homepage = "https://github.com/e-choness/aegis"
+Repository = "https://github.com/e-choness/aegis"
+Issues = "https://github.com/e-choness/aegis/issues"
+
+[project.optional-dependencies]
+rag = [
+    "chromadb>=0.5",
+    "langchain-chroma>=0.1",
+    "langchain-postgres>=0.0.12",
+    "langchain-text-splitters>=0.3",
+]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/aegis_core"]

aegis_gateway_core-2.0.0a0/src/aegis_core/__init__.py

@@ -0,0 +1,5 @@
+"""Aegis v2 — core kernel."""
+
+from __future__ import annotations
+
+__version__ = "2.0.0a0"

aegis_gateway_core-2.0.0a0/src/aegis_core/config/__init__.py

@@ -0,0 +1,25 @@
+"""Aegis config subsystem — typed pydantic models and YAML loader."""
+
+from __future__ import annotations
+
+from aegis_core.config.loader import load_config
+from aegis_core.config.models import (
+    AegisConfig,
+    AuthConfig,
+    GuardrailConfig,
+    PipelineConfig,
+    ProviderConfig,
+    ResidencyConfig,
+    RouteConfig,
+)
+
+__all__ = [
+    "AegisConfig",
+    "AuthConfig",
+    "GuardrailConfig",
+    "PipelineConfig",
+    "ProviderConfig",
+    "ResidencyConfig",
+    "RouteConfig",
+    "load_config",
+]

aegis_gateway_core-2.0.0a0/src/aegis_core/config/loader.py

@@ -0,0 +1,122 @@
+"""Config loader — reads aegis.yaml and applies env overrides.
+
+Loading sequence:
+1. Parse the YAML file into a raw dict.
+2. Walk the raw dict with ``SecretResolver`` to replace ``secret://`` URIs.
+3. Apply pydantic-settings env overrides (``AEGIS__<SECTION>__<KEY>=...``).
+4. Validate with ``AegisConfig``.
+"""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+from typing import Any
+
+from aegis_core.config.models import AegisConfig
+from aegis_core.errors import AegisConfigNotFoundError, AegisConfigValidationError
+from aegis_core.secrets.backends.env import EnvSecretProvider
+from aegis_core.secrets.resolver import SecretResolver
+
+try:
+    import yaml  # type: ignore[import-untyped]
+except ModuleNotFoundError as exc:  # pragma: no cover
+    raise ImportError(
+        "PyYAML is required to load aegis.yaml. "
+        "Install it with: uv add pyyaml"
+    ) from exc
+
+
+def _build_default_resolver() -> SecretResolver:
+    resolver = SecretResolver()
+    resolver.register(EnvSecretProvider())
+    return resolver
+
+
+def load_config(
+    path: str | Path,
+    *,
+    resolver: SecretResolver | None = None,
+    env_prefix: str = "AEGIS",
+) -> AegisConfig:
+    """Load and validate an ``aegis.yaml`` file.
+
+    Args:
+        path: Path to ``aegis.yaml``.
+        resolver: Optional :class:`~aegis_core.secrets.SecretResolver`.  If not
+            supplied a default one (env-only) is constructed.
+        env_prefix: Prefix for environment-variable overrides.  Variables of the
+            form ``AEGIS__ROUTES__DEFAULT__MODEL`` override nested config keys
+            (double-underscore as separator).
+
+    Returns:
+        Validated :class:`~aegis_core.config.models.AegisConfig` instance.
+
+    Raises:
+        AegisConfigNotFoundError: if *path* does not exist.
+        AegisConfigValidationError: if the YAML is structurally valid but fails
+            Pydantic validation.
+    """
+    p = Path(path)
+    if not p.exists():
+        raise AegisConfigNotFoundError(
+            f"Configuration file not found: {p}",
+            path=str(p),
+        )
+
+    with p.open("rb") as fh:
+        raw: Any = yaml.safe_load(fh)
+
+    if raw is None:
+        raw = {}
+
+    if not isinstance(raw, dict):
+        raise AegisConfigValidationError(
+            "aegis.yaml must be a YAML mapping at the top level.",
+            path=str(p),
+        )
+
+    # Resolve secret:// URIs
+    if resolver is None:
+        resolver = _build_default_resolver()
+    raw = resolver.resolve_dict(raw)
+
+    # Apply env overrides (double-underscore path separator)
+    raw = _apply_env_overrides(raw, prefix=env_prefix)
+
+    # Validate
+    from pydantic import ValidationError
+
+    try:
+        return AegisConfig.model_validate(raw)
+    except ValidationError as exc:
+        raise AegisConfigValidationError(
+            f"Configuration validation failed:\n{exc}",
+            path=str(p),
+        ) from exc
+
+
+def _apply_env_overrides(data: dict[str, Any], prefix: str) -> dict[str, Any]:
+    """Overlay ``<PREFIX>__KEY1__KEY2=value`` env vars onto *data*.
+
+    Only variables that start with ``<prefix>__`` (case-insensitive) are
+    considered.  Double-underscore is the nesting separator.
+    """
+    prefix_upper = prefix.upper() + "__"
+    for key, value in os.environ.items():
+        if not key.upper().startswith(prefix_upper):
+            continue
+        remainder = key[len(prefix_upper):]
+        parts = [p.lower() for p in remainder.split("__")]
+        _set_nested(data, parts, value)
+    return data
+
+
+def _set_nested(data: dict[str, Any], keys: list[str], value: str) -> None:
+    """Set *data*[keys[0]][keys[1]]… = *value*, creating dicts as needed."""
+    node = data
+    for k in keys[:-1]:
+        if k not in node or not isinstance(node[k], dict):
+            node[k] = {}
+        node = node[k]
+    node[keys[-1]] = value

aegis_gateway_core-2.0.0a0/src/aegis_core/config/models.py

@@ -0,0 +1,163 @@
+"""Pydantic v2 models for aegis.yaml configuration.
+
+All credentials are stored as ``pydantic.SecretStr`` so that they are
+automatically redacted in ``repr``, logs, and serialized output.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Literal
+
+from pydantic import BaseModel, ConfigDict, Field, SecretStr, field_validator, model_validator
+
+
+class _StrictModel(BaseModel):
+    """Shared base — forbids extra fields so typos surface as errors."""
+
+    model_config = ConfigDict(extra="forbid", populate_by_name=True)
+
+
+# ── Residency ────────────────────────────────────────────────────────────────
+
+
+class ResidencyConfig(_StrictModel):
+    region: str
+    jurisdiction: str | None = None
+    source_url: str | None = None
+
+
+# ── Providers ────────────────────────────────────────────────────────────────
+
+
+class ProviderConfig(_StrictModel):
+    """A single LLM provider profile."""
+
+    type: str  # e.g. "anthropic", "openai_compatible"
+    api_key: SecretStr | None = None
+    base_url: str | None = None
+    model: str | None = None
+    residency: ResidencyConfig | None = None
+    # Allow extra provider-specific fields without failing validation
+    model_config = ConfigDict(extra="allow", populate_by_name=True)
+
+    @field_validator("api_key", mode="before")
+    @classmethod
+    def _coerce_secret(cls, v: Any) -> Any:
+        # secret:// URIs are resolved later by SecretResolver; pass through.
+        return v
+
+
+# ── Guardrails ────────────────────────────────────────────────────────────────
+
+
+class GuardrailConfig(_StrictModel):
+    pack: str
+    mode: str | None = None
+    scanners: list[str] | None = None
+    threshold: float | None = None
+    model_config = ConfigDict(extra="allow", populate_by_name=True)
+
+
+# ── Pipeline ──────────────────────────────────────────────────────────────────
+
+
+class PipelineConfig(_StrictModel):
+    ingress: list[str] = Field(default_factory=list)
+    tool_call: list[str] = Field(default_factory=list)
+    tool_result: list[str] = Field(default_factory=list)
+    egress: list[str] = Field(default_factory=list)
+
+
+# ── Routes ────────────────────────────────────────────────────────────────────
+
+
+class RouteConfig(_StrictModel):
+    provider: str
+    model: str | None = None
+    pipeline: PipelineConfig | None = None
+    model_config = ConfigDict(extra="allow", populate_by_name=True)
+
+
+# ── Auth ──────────────────────────────────────────────────────────────────────
+
+
+class AuthConfig(_StrictModel):
+    type: Literal["none", "api_key"] = "none"
+    model_config = ConfigDict(extra="allow", populate_by_name=True)
+
+
+# ── Top-level AegisConfig ─────────────────────────────────────────────────────
+
+
+class AegisConfig(_StrictModel):
+    """Root configuration object for an Aegis gateway instance."""
+
+    providers: dict[str, ProviderConfig] = Field(default_factory=dict)
+    guardrails: dict[str, GuardrailConfig] = Field(default_factory=dict)
+    pipeline: PipelineConfig = Field(default_factory=PipelineConfig)
+    routes: dict[str, RouteConfig] = Field(default_factory=dict)
+    auth: AuthConfig = Field(default_factory=AuthConfig)
+
+    @model_validator(mode="after")
+    def _validate_route_providers(self) -> AegisConfig:
+        """All routes must reference a declared provider."""
+        from aegis_core.errors import AegisConfigValidationError
+
+        for route_name, route in self.routes.items():
+            if route.provider not in self.providers:
+                raise AegisConfigValidationError(
+                    f"Route {route_name!r} references unknown provider "
+                    f"{route.provider!r}. "
+                    f"Declared providers: {list(self.providers)}",
+                    route=route_name,
+                    provider=route.provider,
+                )
+        return self
+
+    @model_validator(mode="after")
+    def _validate_pipeline_guardrails(self) -> AegisConfig:
+        """Pipeline node references must be declared guardrails or qualified names."""
+        from aegis_core.errors import AegisConfigValidationError
+
+        all_refs: list[str] = (
+            self.pipeline.ingress
+            + self.pipeline.tool_call
+            + self.pipeline.tool_result
+            + self.pipeline.egress
+        )
+        for ref in all_refs:
+            # Strip any ".unmask" or similar suffixes for lookup
+            base = ref.split(".")[0]
+            if base not in self.guardrails:
+                raise AegisConfigValidationError(
+                    f"Pipeline references unknown guardrail {ref!r}. "
+                    f"Declared guardrails: {list(self.guardrails)}",
+                    guardrail_ref=ref,
+                )
+        return self
+
+    def safe_dict(self) -> dict[str, Any]:
+        """Return a JSON-serialisable dict with all secrets redacted.
+
+        ``SecretStr`` fields are replaced with ``"**REDACTED**"`` so the
+        output is safe to display in CLI output or logs.
+        """
+        raw = self.model_dump(mode="python")
+        return _redact(raw)
+
+
+# ── Helpers ───────────────────────────────────────────────────────────────────
+
+_REDACTED = "**REDACTED**"
+
+
+def _redact(node: Any) -> Any:
+    if isinstance(node, SecretStr):
+        return _REDACTED
+    if isinstance(node, dict):
+        return {k: _redact(v) for k, v in node.items()}
+    if isinstance(node, list):
+        return [_redact(item) for item in node]
+    return node
+
+