ags-cli 0.1.0__py3-none-any.whl

harness/api/v1/approvals.py

@@ -0,0 +1,173 @@
+from __future__ import annotations
+
+import uuid
+from datetime import UTC, datetime
+
+from fastapi import APIRouter, HTTPException
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from harness.deps import CurrentPrincipal, DbSession
+from harness.models.approval import Approval
+from harness.models.enums import ApprovalStatus, RunStatus, SessionStatus
+from harness.models.run import Run
+from harness.models.session import Session
+from harness.schemas.approval import ApprovalDecideRequest, ApprovalOut
+from harness.services.approvals import decide_approval
+from harness.services.approvals import list_approvals as list_approvals_svc
+
+router = APIRouter(prefix="/approvals", tags=["approvals"])
+
+
+@router.get("", response_model=list[ApprovalOut])
+async def list_approvals(
+    db: DbSession, _: CurrentPrincipal, status: ApprovalStatus | None = ApprovalStatus.pending
+) -> list[ApprovalOut]:
+    approvals = await list_approvals_svc(db, status=status)
+    return [ApprovalOut.model_validate(a) for a in approvals]
+
+
+@router.post("/{approval_id}/decide", response_model=ApprovalOut)
+async def decide(
+    approval_id: uuid.UUID, req: ApprovalDecideRequest, db: DbSession, principal: CurrentPrincipal
+) -> ApprovalOut:
+    try:
+        approval = await decide_approval(
+            db,
+            approval_id=approval_id,
+            decision=req.decision,
+            actor=principal.subject,
+        )
+    except ValueError as exc:
+        raise HTTPException(400, str(exc)) from exc
+
+    if approval.status == ApprovalStatus.approved:
+        await _continue_after_approval(db, approval)
+    elif approval.status == ApprovalStatus.denied:
+        await _fail_run_after_denial(db, approval)
+
+    return ApprovalOut.model_validate(approval)
+
+
+def _dir_exists(path: str) -> bool:
+    """Sync filesystem check kept out of the async helpers (they must not call
+    ``os.path`` directly). A quick stat, so no thread offload needed."""
+    import os
+
+    return os.path.isdir(path)
+
+
+async def _session_host(db: AsyncSession, session_id: uuid.UUID) -> str | None:
+    """The remote ssh host the session's project lives on, or None for a local project.
+    The approval payload doesn't carry the host, so we re-derive it from the workspace
+    the same way the engine does. A private worktree is always local (host None)."""
+    from harness.models.workspace import Workspace
+    from harness.services.workspaces import effective_host
+
+    session = await db.get(Session, session_id)
+    if session is None:
+        return None
+    sess_settings = session.settings or {}
+    if sess_settings.get("workspace_mode") == "worktree":
+        return None  # worktrees are always local, even for a remote base project
+    workspace = await db.get(Workspace, session.workspace_id)
+    if workspace is None:
+        return None
+    return effective_host(workspace.settings or {})
+
+
+async def _run_approved_tool(
+    db: AsyncSession, approval: Approval, tool_name: str, arguments: dict
+) -> str:
+    """Execute the just-approved tool in the session's live environment and return a
+    human-readable result.
+
+    The command runs in ``workspace_dir`` — the exact ``FileTools`` root the agent used
+    (worktree dir for isolated sessions), recorded on the approval payload. We add two
+    reliability guarantees the old path lacked: for a **remote** project we run over SSH
+    in the remote dir (a local ``FileTools`` would silently no-op on a remote path), and
+    for a **local** project we verify the dir still exists first — so a ``rm -f`` against
+    a stale/missing worktree no longer reports a misleading exit-0 success."""
+    payload = approval.payload or {}
+    exec_dir = payload.get("workspace_dir")
+    host = await _session_host(db, approval.session_id)
+    if not exec_dir:
+        return f"(tool {tool_name!r} not re-run: the approval recorded no workspace directory)"
+
+    # Remote project: run over SSH in the remote dir via a login shell (so the remote
+    # PATH resolves anything the command needs). Only shell commands are re-runnable
+    # remotely; other FileTools verbs operate on the local filesystem.
+    if host:
+        if tool_name != "execute_command":
+            return f"(tool {tool_name!r} not re-run: unsupported for remote project on {host!r})"
+        import shlex
+
+        from harness.services.ssh import ssh_run
+        command = (arguments or {}).get("command", "")
+        remote = f"cd {shlex.quote(exec_dir)} && {command}"
+        try:
+            rc, out, err = await ssh_run(host, f"sh -lc {shlex.quote(remote)}", timeout_s=60)
+        except (TimeoutError, OSError) as exc:
+            return f"error running approved command on {host!r}: {exc}"
+        body = "".join(
+            part for part in (f"STDOUT:\n{out.strip()}\n" if out.strip() else "",
+                              f"STDERR:\n{err.strip()}\n" if err.strip() else "")
+        )
+        return body + f"Exit code: {rc}" if body else f"command executed (exit code {rc})"
+
+    # Local project (main dir or private worktree). Verify the dir still exists first.
+    from harness.tools.fs_tools import FileTools
+    if not _dir_exists(exec_dir):
+        return f"(tool {tool_name!r} not re-run: workspace directory no longer exists: {exec_dir})"
+    fs = FileTools(exec_dir, read_only=False)
+    # bypass_gate: this exact call was just approved by a human — re-running it
+    # through the gate would only raise ApprovalRequired a second time.
+    output, _ = fs.execute(tool_name, arguments, bypass_gate=True)
+    return output
+
+
+async def _continue_after_approval(db: AsyncSession, approval: Approval) -> None:
+    """Continuation Run pattern: actually run the gated tool now that a human
+    approved it, then kick off a fresh turn on the same session carrying the
+    result — rather than trying to resume the paused adapter's in-memory
+    state, which no longer exists."""
+    from harness.schemas.run import RunStartRequest
+    from harness.services.runs import start_run
+
+    payload = approval.payload or {}
+    tool_name = payload.get("tool_name")
+    arguments = payload.get("arguments", {})
+    provider = payload.get("provider")
+
+    if tool_name:
+        output = await _run_approved_tool(db, approval, tool_name, arguments)
+    else:
+        output = "(no tool recorded on the approval — nothing to run)"
+
+    # Restate what was approved and its result so the continued run has enough context
+    # to pick up the original task rather than acting as if it forgot.
+    system_message = (
+        f"[system] Your previously-requested action was approved and executed. "
+        f"Tool `{tool_name}` result: {output}. "
+        f"Continue the original task from here; do not repeat the approved action."
+    )
+    req = RunStartRequest(
+        session_id=approval.session_id,
+        policy="single",
+        providers=[provider] if provider else None,
+        additional_objective=system_message,
+    )
+    await start_run(db, req, actor="approval")
+
+
+async def _fail_run_after_denial(db: AsyncSession, approval: Approval) -> None:
+    """A denied action must not silently leave its run parked forever."""
+    if approval.run_id is not None:
+        run = await db.get(Run, approval.run_id)
+        if run is not None and run.status == RunStatus.needs_approval:
+            run.status = RunStatus.failed
+            reason = (approval.payload or {}).get("reason", "action not approved")
+            run.error = f"approval denied: {reason}"
+            run.finished_at = datetime.now(UTC)
+    sess = await db.get(Session, approval.session_id)
+    if sess is not None and sess.status == SessionStatus.running:
+        sess.status = SessionStatus.failed

harness/api/v1/artifacts.py

@@ -0,0 +1,44 @@
+"""Read-only artifacts API: list a session's artifacts and preview their content.
+
+Artifacts are produced by runs (``engine._persist_artifacts``) and stored by reference.
+Content is resolved by :func:`harness.services.artifacts.resolve_content`, which keeps
+file reads scoped to the workspace's active project folder.
+"""
+
+from __future__ import annotations
+
+import uuid
+
+from fastapi import APIRouter, HTTPException
+
+from harness.deps import CurrentPrincipal, DbSession
+from harness.schemas.artifact import ArtifactOut
+from harness.services.artifacts import get_artifact, list_session_artifacts, resolve_content
+from harness.services.workspaces import get_project_settings
+
+router = APIRouter(prefix="/artifacts", tags=["artifacts"])
+
+
+@router.get("", response_model=list[ArtifactOut])
+async def index(
+    session_id: uuid.UUID, db: DbSession, _: CurrentPrincipal
+) -> list[ArtifactOut]:
+    """List a session's artifacts, newest first."""
+    return [ArtifactOut.model_validate(a) for a in await list_session_artifacts(db, session_id)]
+
+
+@router.get("/{artifact_id}/content")
+async def content(
+    artifact_id: uuid.UUID, db: DbSession, _: CurrentPrincipal, workspace: str = "default"
+) -> dict:
+    """Resolve an artifact's previewable content (transcript from the DB, files from the
+    project folder). File paths are validated to stay inside that folder."""
+    artifact = await get_artifact(db, artifact_id)
+    if artifact is None:
+        raise HTTPException(404, "artifact not found")
+    project = await get_project_settings(db, workspace)
+    try:
+        return resolve_content(artifact, project["project_dir"],
+                               project_host=project.get("project_host"))
+    except ValueError as exc:
+        raise HTTPException(403, str(exc)) from exc

harness/api/v1/attachments.py

@@ -0,0 +1,48 @@
+"""Upload + preview endpoints for message attachments (GUI composer)."""
+
+from __future__ import annotations
+
+import uuid
+
+from fastapi import APIRouter, HTTPException, UploadFile
+from fastapi.responses import FileResponse
+from pydantic import BaseModel
+
+from harness.deps import CurrentPrincipal, DbSession
+from harness.services.attachments import get_attachment_file, save_attachment
+
+router = APIRouter(prefix="/attachments", tags=["attachments"])
+
+
+class AttachmentOut(BaseModel):
+    id: str
+    name: str
+    media_type: str
+    size: int
+    image: bool
+
+
+@router.post("", response_model=AttachmentOut, status_code=201)
+async def upload(
+    file: UploadFile, db: DbSession, principal: CurrentPrincipal,
+    workspace: str = "default",
+) -> AttachmentOut:
+    """Accept one multipart file. Size-capped (413); rejected for remote
+    projects (400). Returns the id to include in a subsequent message send."""
+    try:
+        out = await save_attachment(db, workspace, file, actor=principal.subject)
+    except ValueError as exc:
+        raise HTTPException(413 if "too large" in str(exc) else 400, str(exc)) from exc
+    return AttachmentOut(**{k: out[k] for k in ("id", "name", "media_type", "size", "image")})
+
+
+@router.get("/{attachment_id}")
+async def preview(
+    attachment_id: uuid.UUID, db: DbSession, _: CurrentPrincipal,
+) -> FileResponse:
+    """Serve an uploaded attachment's bytes (thumbnails in the transcript)."""
+    try:
+        path, media_type = await get_attachment_file(db, attachment_id)
+    except ValueError as exc:
+        raise HTTPException(404, str(exc)) from exc
+    return FileResponse(path, media_type=media_type)

harness/api/v1/doctor.py

@@ -0,0 +1,22 @@
+"""GET /doctor — end-to-end provider preflight report."""
+
+from __future__ import annotations
+
+from fastapi import APIRouter
+
+from harness.deps import CurrentPrincipal, DbSession
+from harness.services.doctor import doctor_report
+
+router = APIRouter(tags=["doctor"])
+
+
+@router.get("/doctor")
+async def doctor(db: DbSession, _: CurrentPrincipal) -> list[dict]:
+    """Run a preflight health check on all enabled providers.
+
+    Returns one record per enabled provider with binary, version, health,
+    latency, model, MCP flag support, native-session eligibility, and any
+    detected problems.  Clients should treat a non-empty ``problems`` list
+    as actionable — the provider may not work correctly until resolved.
+    """
+    return await doctor_report(db)

harness/api/v1/health.py

@@ -0,0 +1,37 @@
+from __future__ import annotations
+
+from fastapi import APIRouter, Response
+from prometheus_client import CONTENT_TYPE_LATEST, generate_latest
+from sqlalchemy import text
+
+from harness.deps import CurrentPrincipal, DbSession
+from harness.observability.audit import verify_chain
+from harness.observability.metrics import memory_hit_rate
+from harness.services.workspaces import get_project_settings
+
+router = APIRouter(tags=["health"])
+
+
+@router.get("/healthz")
+async def healthz(db: DbSession) -> dict:
+    await db.execute(text("SELECT 1"))
+    return {"status": "ok"}
+
+
+@router.get("/status")
+async def status(db: DbSession, workspace: str = "default") -> dict:
+    """What the CLI is pointed at: the project folder the agents operate in and
+    whether they may edit files. Reflects the per-workspace runtime settings
+    (falls back to the process cwd / HARNESS_WRITE default when unset)."""
+    return await get_project_settings(db, workspace)
+
+
+@router.get("/metrics")
+async def metrics() -> Response:
+    return Response(generate_latest(), media_type=CONTENT_TYPE_LATEST)
+
+
+@router.get("/audit/verify")
+async def audit_verify(db: DbSession, _: CurrentPrincipal) -> dict:
+    ok = await verify_chain(db)
+    return {"audit_chain_intact": ok, "memory_hit_rate": round(memory_hit_rate(), 4)}

harness/api/v1/mcp.py

@@ -0,0 +1,131 @@
+from __future__ import annotations
+
+from fastapi import APIRouter, HTTPException
+from pydantic import BaseModel
+from sqlalchemy import select
+
+from harness.deps import CurrentPrincipal, DbSession
+from harness.mcp.client import McpClient, McpUnavailable
+from harness.mcp.registry import server_to_dict
+from harness.models.mcp_server_config import McpServerConfig
+from harness.services.mcp_servers import (
+    create_mcp_server,
+    delete_mcp_server,
+    list_mcp_servers,
+    managed_mcp_names,
+    update_mcp_server,
+)
+
+router = APIRouter(prefix="/mcp", tags=["mcp"])
+
+
+class McpServerOut(BaseModel):
+    name: str
+    transport: str
+    enabled: bool
+    read_only: bool
+    command: str | None = None
+    args: list[str] = []
+    url: str | None = None
+    tool_allowlist: list[str] = []
+    bind: dict = {}
+    managed: bool = False  # GUI-added (overlay) ⇒ editable/deletable here
+
+
+class McpTestResult(BaseModel):
+    ok: bool
+    tools: list[str] = []
+    error: str | None = None
+
+
+class CreateMcpRequest(BaseModel):
+    name: str
+    transport: str = "stdio"
+    command: str | None = None
+    args: list[str] = []
+    env: dict = {}
+    url: str | None = None
+    headers: dict = {}
+    token: str | None = None
+    tool_allowlist: list[str] = []
+    read_only: bool = False
+    enabled: bool = True
+
+
+class UpdateMcpRequest(BaseModel):
+    # Only provided fields are changed.
+    transport: str | None = None
+    command: str | None = None
+    args: list[str] | None = None
+    env: dict | None = None
+    url: str | None = None
+    headers: dict | None = None
+    token: str | None = None
+    tool_allowlist: list[str] | None = None
+    read_only: bool | None = None
+    enabled: bool | None = None
+
+
+def _out(r: McpServerConfig, managed: set[str]) -> McpServerOut:
+    return McpServerOut(
+        name=r.name, transport=r.transport.value, enabled=r.enabled,
+        read_only=bool(r.read_only), command=r.command, args=r.args or [],
+        url=r.url, tool_allowlist=r.tool_allowlist or [], bind=r.bind or {},
+        managed=r.name in managed,
+    )
+
+
+@router.get("/servers", response_model=list[McpServerOut])
+async def index(db: DbSession, _: CurrentPrincipal) -> list[McpServerOut]:
+    managed = managed_mcp_names()
+    return [_out(r, managed) for r in await list_mcp_servers(db)]
+
+
+@router.post("/servers", status_code=201)
+async def create(req: CreateMcpRequest, db: DbSession, principal: CurrentPrincipal) -> dict:
+    try:
+        return await create_mcp_server(
+            db, name=req.name, transport=req.transport, command=req.command, args=req.args,
+            env=req.env, url=req.url, headers=req.headers, token=req.token,
+            tool_allowlist=req.tool_allowlist, read_only=req.read_only, enabled=req.enabled,
+            actor=principal.subject,
+        )
+    except ValueError as exc:
+        raise HTTPException(422, str(exc)) from exc
+
+
+@router.put("/servers/{name}")
+async def update(
+    name: str, req: UpdateMcpRequest, db: DbSession, principal: CurrentPrincipal
+) -> dict:
+    fields = req.model_dump(exclude_none=True)
+    try:
+        return await update_mcp_server(db, name, fields=fields, actor=principal.subject)
+    except ValueError as exc:
+        raise HTTPException(422, str(exc)) from exc
+
+
+@router.delete("/servers/{name}")
+async def remove(name: str, db: DbSession, principal: CurrentPrincipal) -> dict:
+    try:
+        return await delete_mcp_server(db, name, actor=principal.subject)
+    except ValueError as exc:
+        raise HTTPException(404, str(exc)) from exc
+
+
+@router.post("/servers/{name}/test", response_model=McpTestResult)
+async def test(name: str, db: DbSession, _: CurrentPrincipal) -> McpTestResult:
+    row = (
+        await db.execute(select(McpServerConfig).where(McpServerConfig.name == name))
+    ).scalar_one_or_none()
+    if row is None:
+        raise HTTPException(404, f"MCP server {name!r} not found")
+    client = McpClient(server_to_dict(row))
+    try:
+        await client.connect()
+        tools = await client.list_tools()
+        return McpTestResult(ok=True, tools=[t.name for t in tools])
+    except McpUnavailable as exc:
+        return McpTestResult(ok=False, error=str(exc))
+    finally:
+        await client.aclose()

harness/api/v1/memory.py

@@ -0,0 +1,80 @@
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter
+from pydantic import BaseModel
+
+log = logging.getLogger(__name__)
+
+from harness.deps import CurrentPrincipal, DbSession
+from harness.memory.ingest import ingest_memory
+from harness.memory.namespaces import session_ns, workspace_ns
+from harness.memory.service import MemoryService, reindex_memory
+from harness.models.enums import MemoryScope
+from harness.schemas.memory import (
+    MemoryHit,
+    MemoryIngestRequest,
+    MemoryItemOut,
+    MemorySearchRequest,
+    MemorySearchResponse,
+)
+
+router = APIRouter(prefix="/memory", tags=["memory"])
+
+
+class MemoryReindexRequest(BaseModel):
+    workspace: str | None = None
+
+
+class MemoryReindexResponse(BaseModel):
+    reindexed: int
+
+
+@router.post("/ingest", response_model=MemoryItemOut, status_code=201)
+async def ingest(req: MemoryIngestRequest, db: DbSession, _: CurrentPrincipal) -> MemoryItemOut:
+    if req.scope == MemoryScope.session and req.session_id:
+        ns = session_ns(req.workspace, req.session_id, project=req.project)
+    else:
+        ns = workspace_ns(req.workspace, project=req.project)
+    item = await ingest_memory(
+        db, namespace=ns, scope=req.scope, mem_type=req.type,
+        content=req.content, tags=req.tags,
+    )
+    return MemoryItemOut.model_validate(item, from_attributes=True)
+
+
+@router.post("/search", response_model=MemorySearchResponse)
+async def search(
+    req: MemorySearchRequest, db: DbSession, _: CurrentPrincipal
+) -> MemorySearchResponse:
+    result = await MemoryService(db).retrieve(
+        workspace_slug=req.workspace, query=req.query,
+        session_id=req.session_id, project=req.project, top_k=req.top_k,
+    )
+    return MemorySearchResponse(
+        query=result.query,
+        hits=[
+            MemoryHit(
+                item_id=i.item_id, namespace=i.namespace, type=i.type,
+                content=i.content, similarity=round(i.similarity, 4), score=round(i.score, 4),
+            )
+            for i in result.items
+        ],
+        context_block=result.as_context_block(),
+    )
+
+
+@router.post("/reindex", response_model=MemoryReindexResponse)
+async def reindex(
+    req: MemoryReindexRequest, db: DbSession, _: CurrentPrincipal
+) -> MemoryReindexResponse:
+    """Re-embed all memory items whose embeddings don't match the active model.
+
+    Use after switching the embedding provider or model to ensure retrieval
+    remains model-consistent. Returns the number of items re-embedded.
+    """
+    n = await reindex_memory(db, workspace_slug=req.workspace)
+    if req.workspace and n == 0:
+        log.warning("reindex: workspace_slug=%r matched 0 items — possible typo", req.workspace)
+    return MemoryReindexResponse(reindexed=n)

harness/api/v1/policies.py

@@ -0,0 +1,49 @@
+from __future__ import annotations
+
+from fastapi import APIRouter
+from sqlalchemy import select
+
+from harness.deps import CurrentPrincipal, DbSession
+from harness.models.policy import Policy
+from harness.observability.audit import write_audit
+from harness.schemas.policy import PolicyOut, PolicySetRequest
+from harness.services.workspaces import get_or_create_workspace
+
+router = APIRouter(tags=["policies"])
+
+
+@router.put("/policies", response_model=PolicyOut)
+async def set_policy(
+    req: PolicySetRequest, db: DbSession, principal: CurrentPrincipal
+) -> PolicyOut:
+    ws = await get_or_create_workspace(db, req.workspace)
+    existing = (
+        await db.execute(
+            select(Policy).where(Policy.workspace_id == ws.id, Policy.name == req.name)
+        )
+    ).scalar_one_or_none()
+    if existing is None:
+        existing = Policy(workspace_id=ws.id, name=req.name, kind=req.kind)
+        db.add(existing)
+    existing.kind = req.kind
+    existing.spec = req.spec
+    existing.priority = req.priority
+    await db.flush()
+    await write_audit(
+        db, actor=principal.subject, action="policy.set", target_type="policy",
+        target_id=str(existing.id), after={"name": req.name, "kind": req.kind.value},
+    )
+    return PolicyOut.model_validate(existing, from_attributes=True)
+
+
+@router.get("/policies", response_model=list[PolicyOut])
+async def list_policies(db: DbSession, _: CurrentPrincipal) -> list[PolicyOut]:
+    rows = (await db.execute(select(Policy).order_by(Policy.priority.desc()))).scalars().all()
+    return [PolicyOut.model_validate(p, from_attributes=True) for p in rows]
+
+
+# NOTE: the `/approvals` and `/approvals/{id}/decide` endpoints live in
+# harness.api.v1.approvals — that router owns the HITL approval lifecycle
+# (Continuation Run on approve, fail-run on deny). They were previously also
+# defined here, which shadowed the dedicated router (this one registers first)
+# and made the GUI/CLI decide calls 422 against the wrong request schema.