agentic-devtools 0.2.15__tar.gz → 0.2.17__tar.gz

{agentic_devtools-0.2.15 → agentic_devtools-0.2.17}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-devtools
-Version: 0.2.15
+Version: 0.2.17
 Summary: AI assistant helper commands for the Dragonfly platform
 Author: Dragonfly Team
 License-Expression: MIT

{agentic_devtools-0.2.15 → agentic_devtools-0.2.17}/agentic_devtools/_version.py

@@ -28,7 +28,7 @@ version_tuple: VERSION_TUPLE
 commit_id: COMMIT_ID
 __commit_id__: COMMIT_ID
 
-__version__ = version = '0.2.15'
-__version_tuple__ = version_tuple = (0, 2, 15)
+__version__ = version = '0.2.17'
+__version_tuple__ = version_tuple = (0, 2, 17)
 
 __commit_id__ = commit_id = None

agentic_devtools-0.2.17/agentic_devtools/cli/cert_utils.py

@@ -0,0 +1,194 @@
+"""
+Shared SSL certificate utilities for agentic-devtools.
+
+Fetches and caches corporate CA certificate chains so that ``requests``
+calls succeed on corporate networks where a proxy re-signs TLS connections
+with a custom CA certificate.
+
+Certificates are cached in ``~/.agdt/certs/<hostname>.pem`` and only
+re-fetched when the cached file is missing or empty.
+"""
+
+import os
+import re
+import socket
+import ssl
+import subprocess
+from pathlib import Path
+from typing import Optional, Union
+
+from agentic_devtools.cli.subprocess_utils import run_safe
+
+# Default directory for cached CA bundles
+_CERTS_DIR = Path.home() / ".agdt" / "certs"
+
+
+def fetch_certificate_chain_openssl(hostname: str, port: int = 443) -> Optional[str]:
+    """Fetch the SSL certificate chain from *hostname* using ``openssl s_client``.
+
+    Returns the full chain (all certificates) as a PEM string, or ``None``
+    if ``openssl`` is unavailable or the connection fails.
+
+    Args:
+        hostname: The server hostname.
+        port: The server port (default 443).
+
+    Returns:
+        PEM-encoded certificate chain string, or ``None`` on failure.
+    """
+    try:
+        result = run_safe(
+            [
+                "openssl",
+                "s_client",
+                "-showcerts",
+                "-servername",
+                hostname,
+                "-connect",
+                f"{hostname}:{port}",
+            ],
+            input=b"",
+            capture_output=True,
+            timeout=10,
+            shell=False,
+        )
+        output = result.stdout.decode("utf-8", errors="ignore")
+        cert_pattern = r"-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----"
+        certs = re.findall(cert_pattern, output, re.DOTALL)
+        if certs:
+            return "\n".join(certs)
+    except (subprocess.TimeoutExpired, FileNotFoundError, OSError, subprocess.SubprocessError):
+        pass
+    except Exception:  # noqa: BLE001 — cert fetch must not crash setup
+        pass
+    return None
+
+
+def fetch_certificate_chain_ssl(hostname: str, port: int = 443) -> Optional[str]:
+    """Fetch the SSL certificate from *hostname* using Python's :mod:`ssl` module.
+
+    This is a fallback for when ``openssl`` is not available.  Note that the
+    :mod:`ssl` module can only retrieve the server certificate, **not** the
+    full chain.
+
+    Args:
+        hostname: The server hostname.
+        port: The server port (default 443).
+
+    Returns:
+        PEM-encoded certificate string, or ``None`` on failure.
+    """
+    try:
+        # Intentionally disable SSL verification here: we must fetch the certificate
+        # chain *before* we can trust it.  The chain is only used as a CA bundle for
+        # subsequent requests — never to authenticate the connection where it was fetched.
+        context = ssl.create_default_context()
+        context.check_hostname = False
+        context.verify_mode = ssl.CERT_NONE  # noqa: S501
+
+        with socket.create_connection((hostname, port), timeout=10) as sock:
+            with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+                cert_der = ssock.getpeercert(binary_form=True)
+                if cert_der:
+                    return ssl.DER_cert_to_PEM_cert(cert_der)
+    except Exception:  # pragma: no cover
+        pass
+
+    return None  # pragma: no cover
+
+
+def count_certificates_in_pem(pem_content: str) -> int:
+    """Return the number of ``BEGIN CERTIFICATE`` blocks in *pem_content*."""
+    return pem_content.count("-----BEGIN CERTIFICATE-----")
+
+
+def ensure_ca_bundle(
+    hostname: str,
+    cache_file: Optional[Path] = None,
+) -> Optional[str]:
+    """Ensure a CA bundle PEM file exists for *hostname* and return its path.
+
+    The certificate chain is fetched exactly once and cached.  Subsequent
+    calls return the cached path immediately when the cache contains at
+    least one certificate — even if only the server cert was available.
+
+    On the *first* fetch the function prefers ``openssl`` (which usually
+    retrieves the full chain including the root CA).  If ``openssl``
+    fails to return any certificates, the :mod:`ssl` module is used as a
+    fallback to obtain at least the server certificate.
+
+    All certificate fetching targets port 443 (standard HTTPS).  For
+    non-standard ports, use :func:`fetch_certificate_chain_openssl` or
+    :func:`fetch_certificate_chain_ssl` directly.
+
+    Args:
+        hostname: Server hostname to fetch certificates from.
+        cache_file: Explicit path to store the PEM file.  Defaults to
+            ``~/.agdt/certs/<hostname>.pem``.
+
+    Returns:
+        Absolute path to the cached PEM file, or ``None`` if fetching failed.
+    """
+    if cache_file is None:
+        # Sanitize hostname to prevent path traversal (e.g. "../" in hostname).
+        safe_name = re.sub(r"[^\w.\-]", "_", hostname)
+        cache_file = _CERTS_DIR / f"{safe_name}.pem"
+    cache_file = cache_file.expanduser().resolve()
+
+    # Return cached file when it already contains at least one certificate.
+    # We accept single-cert caches to avoid re-fetching on every call for
+    # hosts that only ever yield one cert (e.g. ssl-module fallback).
+    if cache_file.exists():
+        try:
+            existing = cache_file.read_text(encoding="utf-8")
+        except (OSError, UnicodeDecodeError):
+            # Treat unreadable or undecodable cache as missing and refetch.
+            existing = ""
+        if count_certificates_in_pem(existing) >= 1:
+            return str(cache_file)
+
+    # Prefer openssl — it retrieves the full chain including the root CA
+    cert_chain = fetch_certificate_chain_openssl(hostname)
+    if cert_chain and count_certificates_in_pem(cert_chain) >= 2:
+        cache_file.parent.mkdir(parents=True, exist_ok=True)
+        cache_file.write_text(cert_chain, encoding="utf-8")
+        return str(cache_file)
+
+    # Fallback: ssl module (server cert only — may not work as a CA bundle)
+    if not cert_chain:
+        cert_chain = fetch_certificate_chain_ssl(hostname)
+
+    if cert_chain:
+        cache_file.parent.mkdir(parents=True, exist_ok=True)
+        cache_file.write_text(cert_chain, encoding="utf-8")
+        return str(cache_file)
+
+    return None
+
+
+def get_ssl_verify(hostname: str) -> Union[bool, str]:
+    """Return the ``verify`` argument for :func:`requests.get` when connecting to *hostname*.
+
+    Priority:
+    1. ``REQUESTS_CA_BUNDLE`` environment variable (if set and file exists).
+    2. Cached CA bundle at ``~/.agdt/certs/<hostname>.pem``, fetched on
+       demand if not present.
+    3. ``True`` — fall back to the system default CA bundle.
+
+    Args:
+        hostname: The target server hostname.
+
+    Returns:
+        Path to a CA bundle file, or ``True`` to use the system CA bundle.
+    """
+    ca_bundle = os.environ.get("REQUESTS_CA_BUNDLE")
+    if ca_bundle:
+        normalized = os.path.abspath(os.path.expanduser(os.path.expandvars(ca_bundle)))
+        if os.path.exists(normalized):
+            return normalized
+
+    pem_path = ensure_ca_bundle(hostname)
+    if pem_path:
+        return pem_path
+
+    return True

{agentic_devtools-0.2.15 → agentic_devtools-0.2.17}/agentic_devtools/cli/copilot/session.py

@@ -186,33 +186,35 @@ def _get_log_file_path(session_id: str, start_time: str) -> Path:
     return state_dir / _LOG_DIR_NAME / filename
 
 
-def _build_copilot_args(prompt: str, prompt_file: str) -> Optional[list[str]]:
+def _build_copilot_args(prompt: str, *, interactive: bool = True) -> Optional[list[str]]:
     """Build the copilot argument list.
 
     Uses the standalone ``copilot`` binary when available (preferred), falling
     back to the ``gh copilot`` extension for backward compatibility.
 
-    The standalone binary receives the prompt via ``--file`` to avoid shell
-    argument-length limits.  The ``gh copilot`` extension does **not** support
-    ``--file``; the prompt text is passed as the positional ``[subject]``
-    argument instead.  When the prompt exceeds
-    :data:`_MAX_GH_COPILOT_ARGV_LENGTH` on the extension path, ``None`` is
-    returned so the caller can use a fallback.
+    Neither the standalone binary nor the ``gh copilot`` extension supports
+    ``--file``.  The standalone binary accepts the prompt via ``-p``/``--prompt``
+    for non-interactive use and ``-i`` for interactive use, while the
+    ``gh copilot`` extension accepts the prompt as a positional ``[subject]``
+    argument.  When the prompt exceeds :data:`_MAX_GH_COPILOT_ARGV_LENGTH`,
+    ``None`` is returned so the caller can use a fallback.
 
     Args:
-        prompt: The full prompt text (used as subject for ``gh copilot``).
-        prompt_file: Absolute path to the file containing the prompt (used
-            with the standalone binary).
+        prompt: The full prompt text to pass to the copilot command.
+        interactive: When ``True`` (default) the standalone binary receives
+            ``-i``; when ``False`` it receives ``-p``.  Ignored for the
+            ``gh copilot`` extension path which always uses a positional arg.
 
     Returns:
         List of strings suitable for :func:`subprocess.Popen`, or ``None``
-        when the prompt is too large for the ``gh copilot`` argv path.
+        when the prompt is too large for the argv path.
     """
-    standalone = _get_copilot_binary()
-    if standalone:
-        return [standalone, "suggest", "--file", prompt_file]
     if len(prompt) > _MAX_GH_COPILOT_ARGV_LENGTH:
         return None
+    standalone = _get_copilot_binary()
+    if standalone:
+        flag = "-i" if interactive else "-p"
+        return [standalone, "suggest", flag, prompt]
     return ["gh", "copilot", "suggest", prompt]
 
 
@@ -264,11 +266,19 @@ def start_copilot_session(
 
     Behaviour:
     - Generates (or reuses) a unique session ID.
-    - Writes *prompt* to a temporary file so that large prompts do not
-      exceed CLI argument-length limits.
-    - Starts ``copilot suggest --file <prompt_file>`` (standalone binary) or
-      ``gh copilot suggest <prompt>`` (extension fallback, which does not
-      support ``--file``).
+    - Writes *prompt* to a temporary file for persistence and manual
+      reuse.  The prompt is passed directly as a CLI argument to the
+      Copilot process; when it exceeds safe argv-length limits it is
+      printed to stdout instead.
+    - Starts ``copilot suggest <prompt>`` (standalone binary) or
+      ``gh copilot suggest <prompt>`` (extension fallback).
+
+      .. note::
+
+         The prompt text is visible in the child-process command line
+         (e.g. Task Manager / ``ps`` output).  Neither the standalone
+         binary nor the ``gh copilot`` extension currently supports
+         receiving the prompt via stdin or a file flag.
     - In **interactive** mode the child process inherits the current
       terminal (stdin / stdout / stderr), so the user can interact with
       it directly.  This call blocks until the interactive session ends.
@@ -328,13 +338,13 @@ def start_copilot_session(
         return result
 
     # --- Build command -------------------------------------------------------
-    args = _build_copilot_args(prompt, prompt_file)
+    args = _build_copilot_args(prompt, interactive=interactive)
 
-    # When the prompt is too large for the gh copilot argv path (no
-    # standalone binary available), fall back to printing the prompt.
+    # When the prompt is too large for safe argv passing, fall back to
+    # printing the prompt.  This applies regardless of binary variant.
     if args is None:
         warnings.warn(
-            "Prompt too large for gh copilot argv; printing prompt to stdout as fallback.",
+            "Prompt too large for copilot argv; printing prompt to stdout as fallback.",
             stacklevel=2,
         )
         _print_fallback_prompt(prompt)

{agentic_devtools-0.2.15 → agentic_devtools-0.2.17}/agentic_devtools/cli/jira/helpers.py

@@ -3,15 +3,19 @@ Jira utility helpers: request handling, SSL, parsing.
 """
 
 import os
-import re
-import socket
-import ssl
-import subprocess
 import warnings
 from pathlib import Path
 from typing import Any, List, Optional, Union
 
-from agentic_devtools.cli.subprocess_utils import run_safe
+from agentic_devtools.cli.cert_utils import (
+    count_certificates_in_pem as _count_certificates_in_pem,
+)
+from agentic_devtools.cli.cert_utils import (
+    fetch_certificate_chain_openssl as _fetch_certificate_chain_openssl,
+)
+from agentic_devtools.cli.cert_utils import (
+    fetch_certificate_chain_ssl as _fetch_certificate_chain_ssl,
+)
 from agentic_devtools.state import get_state_dir
 
 
@@ -69,84 +73,6 @@ def _get_temp_jira_pem_path() -> Path:
     return state_dir / "jira_ca_bundle.pem"
 
 
-def _fetch_certificate_chain_openssl(hostname: str, port: int = 443) -> Optional[str]:
-    """
-    Fetch the SSL certificate chain from a server using openssl command.
-
-    Args:
-        hostname: The server hostname
-        port: The server port (default 443)
-
-    Returns:
-        PEM-encoded certificate chain string, or None if failed
-    """
-    try:
-        # Use openssl s_client to get the full certificate chain
-        result = run_safe(
-            [
-                "openssl",
-                "s_client",
-                "-showcerts",
-                "-servername",
-                hostname,
-                "-connect",
-                f"{hostname}:{port}",
-            ],
-            input=b"",
-            capture_output=True,
-            timeout=10,
-        )
-
-        output = result.stdout.decode("utf-8", errors="ignore")
-
-        # Extract all certificates from the output
-        cert_pattern = r"-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----"
-        certs = re.findall(cert_pattern, output, re.DOTALL)
-
-        if certs:
-            return "\n".join(certs)
-
-    except (subprocess.TimeoutExpired, FileNotFoundError, Exception):
-        pass
-
-    return None
-
-
-def _fetch_certificate_chain_ssl(hostname: str, port: int = 443) -> Optional[str]:
-    """
-    Fetch SSL certificate using Python's ssl module (fallback if openssl not available).
-
-    Note: This only gets the server certificate, not the full chain.
-
-    Args:
-        hostname: The server hostname
-        port: The server port (default 443)
-
-    Returns:
-        PEM-encoded certificate string, or None if failed
-    """
-    try:
-        context = ssl.create_default_context()
-        context.check_hostname = False
-        context.verify_mode = ssl.CERT_NONE
-
-        with socket.create_connection((hostname, port), timeout=10) as sock:
-            with context.wrap_socket(sock, server_hostname=hostname) as ssock:
-                cert_der = ssock.getpeercert(binary_form=True)
-                if cert_der:
-                    cert_pem = ssl.DER_cert_to_PEM_cert(cert_der)
-                    return cert_pem
-    except Exception:  # pragma: no cover
-        pass
-
-    return None  # pragma: no cover
-
-
-def _count_certificates_in_pem(pem_content: str) -> int:
-    """Count the number of certificates in a PEM file content."""
-    return pem_content.count("-----BEGIN CERTIFICATE-----")
-
-
 def _ensure_jira_pem(hostname: str = "jira.swica.ch") -> Optional[str]:
     """
     Ensure the Jira CA bundle PEM file exists with a complete certificate chain.

{agentic_devtools-0.2.15 → agentic_devtools-0.2.17}/agentic_devtools/cli/setup/commands.py

@@ -11,6 +11,8 @@ Entry points:
 import sys
 from pathlib import Path
 
+from agentic_devtools.cli.cert_utils import ensure_ca_bundle as _ensure_ca_bundle
+
 from .copilot_cli_installer import install_copilot_cli
 from .dependency_checker import check_all_dependencies, print_dependency_report
 from .gh_cli_installer import install_gh_cli
@@ -33,6 +35,55 @@ _PATH_INSTRUCTIONS = (
 )
 
 
+def _prefetch_certs() -> None:
+    """Pre-fetch and cache corporate CA certificates for common setup hosts.
+
+    Fetches the certificate chain for external hosts used during setup and
+    stores the PEM bundles in ``~/.agdt/certs/``.  Also writes an
+    ``~/.agdt/npmrc`` file that configures npm to use the cached CA bundle
+    for ``registry.npmjs.org``, enabling npm installs on corporate networks.
+
+    The cert cache only needs to be refreshed infrequently (e.g. yearly).
+    To force a refresh, delete ``~/.agdt/certs/``.
+    """
+    print("Fetching CA certificates for external hosts...")
+
+    # Hosts used by the CLI installers — store api.github.com result for pip hint below
+    gh_pem = None
+    for hostname in ("api.github.com", "github.com"):
+        pem = _ensure_ca_bundle(hostname)
+        if hostname == "api.github.com":
+            gh_pem = pem
+        if pem:
+            print(f"  ✓ CA bundle cached for {hostname}")
+        else:
+            print(f"  ⚠ Could not cache CA bundle for {hostname}; will try system CA")
+
+    # npm registry — write cafile to ~/.agdt/npmrc so npm works on corporate networks
+    npm_pem = _ensure_ca_bundle("registry.npmjs.org")
+    if npm_pem:
+        npmrc_path = Path.home() / ".agdt" / "npmrc"
+        npmrc_path.parent.mkdir(parents=True, exist_ok=True)
+        npmrc_path.write_text(f"cafile={npm_pem}\n", encoding="utf-8")
+        print("  ✓ CA bundle cached for registry.npmjs.org")
+        print("  ✓ npm CA config written to ~/.agdt/npmrc")
+        print("  ℹ To apply:")
+        print("    # bash/zsh:")
+        print('    export NPM_CONFIG_USERCONFIG="$HOME/.agdt/npmrc"')
+        print("    # PowerShell:")
+        print('    $env:NPM_CONFIG_USERCONFIG = "$env:USERPROFILE\\.agdt\\npmrc"')
+    else:
+        print("  ⚠ Could not cache CA bundle for registry.npmjs.org; will try system CA")
+
+    # Print pip CA instructions (pip respects REQUESTS_CA_BUNDLE or PIP_CERT)
+    if gh_pem:
+        print("  ℹ For pip/requests:")
+        print("    # bash/zsh:")
+        print(f'    export REQUESTS_CA_BUNDLE="{gh_pem}"')
+        print("    # PowerShell:")
+        print(f'    $env:REQUESTS_CA_BUNDLE = "{gh_pem}"')
+
+
 def _print_path_instructions_if_needed() -> None:
     """Print PATH setup instructions when ``~/.agdt/bin`` is not on the PATH."""
     import os
@@ -54,6 +105,9 @@ def setup_cmd() -> None:
     print(_BANNER)
     print()
 
+    _prefetch_certs()
+    print()
+
     copilot_ok = install_copilot_cli()
     print()
     gh_ok = install_gh_cli()

{agentic_devtools-0.2.15 → agentic_devtools-0.2.17}/agentic_devtools/cli/setup/copilot_cli_installer.py

@@ -20,6 +20,8 @@ from urllib.parse import urlparse
 
 import requests
 
+from agentic_devtools.cli.cert_utils import get_ssl_verify as _get_ssl_verify
+
 # ---------------------------------------------------------------------------
 # Constants
 # ---------------------------------------------------------------------------
@@ -77,7 +79,7 @@ def get_latest_release_info() -> Dict[str, Any]:
     Raises:
         requests.RequestException: On network or HTTP errors.
     """
-    response = requests.get(_RELEASES_URL, timeout=30)
+    response = requests.get(_RELEASES_URL, timeout=30, verify=_get_ssl_verify("api.github.com"))
     response.raise_for_status()
     result: Dict[str, Any] = response.json()
     return result
@@ -164,7 +166,7 @@ def download_and_install(version: str, asset_url: str, asset_name: str) -> bool:
     dest = _INSTALL_DIR / _BINARY_NAME
 
     try:
-        response = requests.get(asset_url, timeout=120, stream=True)
+        response = requests.get(asset_url, timeout=120, stream=True, verify=_get_ssl_verify("github.com"))
         response.raise_for_status()
         asset_bytes = b"".join(response.iter_content(chunk_size=65536))
     except requests.RequestException as exc:

{agentic_devtools-0.2.15 → agentic_devtools-0.2.17}/agentic_devtools/cli/setup/gh_cli_installer.py

@@ -18,6 +18,8 @@ from urllib.parse import urlparse
 
 import requests
 
+from agentic_devtools.cli.cert_utils import get_ssl_verify as _get_ssl_verify
+
 # ---------------------------------------------------------------------------
 # Constants
 # ---------------------------------------------------------------------------
@@ -75,7 +77,7 @@ def get_latest_release_info() -> Dict[str, Any]:
     Raises:
         requests.RequestException: On network or HTTP errors.
     """
-    response = requests.get(_RELEASES_URL, timeout=30)
+    response = requests.get(_RELEASES_URL, timeout=30, verify=_get_ssl_verify("api.github.com"))
     response.raise_for_status()
     result: Dict[str, Any] = response.json()
     return result
@@ -172,7 +174,7 @@ def download_and_install(version: str, asset_url: str, asset_name: str) -> bool:
     import zipfile
 
     try:
-        response = requests.get(asset_url, timeout=120, stream=True)
+        response = requests.get(asset_url, timeout=120, stream=True, verify=_get_ssl_verify("github.com"))
         response.raise_for_status()
 
         with tempfile.TemporaryDirectory() as tmp_dir:
@@ -209,7 +211,11 @@ def download_and_install(version: str, asset_url: str, asset_name: str) -> bool:
                     extracted = False
                     for name in zf.namelist():
                         normalized = name.replace("\\", "/")
-                        if normalized.endswith("/bin/gh") or normalized.endswith("/bin/gh.exe") or normalized in ("gh", "gh.exe"):
+                        if (
+                            normalized.endswith("/bin/gh")
+                            or normalized.endswith("/bin/gh.exe")
+                            or normalized in ("gh", "gh.exe")
+                        ):
                             data = zf.read(name)
                             dest.write_bytes(data)
                             extracted = True

agentic_devtools-0.2.17/tests/unit/cli/cert_utils/test_count_certificates_in_pem.py

@@ -0,0 +1,29 @@
+"""Tests for count_certificates_in_pem."""
+
+from agentic_devtools.cli import cert_utils
+
+
+class TestCountCertificatesInPem:
+    """Tests for count_certificates_in_pem."""
+
+    def test_returns_zero_for_empty_string(self):
+        """Returns 0 for an empty string."""
+        assert cert_utils.count_certificates_in_pem("") == 0
+
+    def test_returns_one_for_single_cert(self):
+        """Returns 1 when there is one certificate block."""
+        pem = "-----BEGIN CERTIFICATE-----\ndata\n-----END CERTIFICATE-----"
+        assert cert_utils.count_certificates_in_pem(pem) == 1
+
+    def test_returns_two_for_full_chain(self):
+        """Returns 2 for a two-certificate chain."""
+        pem = (
+            "-----BEGIN CERTIFICATE-----\nserver\n-----END CERTIFICATE-----\n"
+            "-----BEGIN CERTIFICATE-----\nca\n-----END CERTIFICATE-----"
+        )
+        assert cert_utils.count_certificates_in_pem(pem) == 2
+
+    def test_returns_three_for_three_certs(self):
+        """Returns 3 for a three-certificate chain."""
+        block = "-----BEGIN CERTIFICATE-----\ndata\n-----END CERTIFICATE-----\n"
+        assert cert_utils.count_certificates_in_pem(block * 3) == 3