ags-cli 0.1.0__py3-none-any.whl

harness/services/adapters_health.py

@@ -0,0 +1,212 @@
+from __future__ import annotations
+
+import re
+
+import yaml
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from harness.adapters.registry import build_adapter
+from harness.models.adapter_health import AdapterHealth
+from harness.models.enums import adapter_kind_from_config
+from harness.models.provider_config import ProviderConfig
+from harness.observability.audit import write_audit
+from harness.schemas.adapter import AdapterTestResult
+from harness.security.secrets import delete_secret_file, write_secret_file
+from harness.settings import PROVIDERS_DIR, get_settings
+
+_NAME_RE = re.compile(r"[a-z0-9][a-z0-9_-]{0,63}")
+
+
+def resolve_model_alias(config: dict, provider: str, name: str) -> str:
+    """Resolve a model alias for a given provider.
+
+    If `name` is an alias defined in config["model_aliases"], return the mapped model
+    for the provider. If the alias exists but not for this provider, raise ValueError
+    listing which providers the alias covers. If `name` is not an alias, return it unchanged.
+    Aliases cannot reference other aliases; the resolved value must be a real model id.
+
+    Args:
+        config: The parsed config.yaml dictionary
+        provider: Provider name (e.g., 'claude', 'local', 'antigravity')
+        name: Model name or alias name
+
+    Returns:
+        The resolved model name, or the input `name` if it's not an alias.
+
+    Raises:
+        ValueError: If the alias exists but has no entry for this provider.
+    """
+    aliases = config.get("model_aliases", {})
+
+    # If name is not in aliases, it's a regular model name — pass through
+    if name not in aliases:
+        return name
+
+    # name is an alias; look it up for this provider
+    alias_def = aliases[name]
+    if provider in alias_def:
+        return alias_def[provider]
+
+    # Alias exists but not for this provider
+    providers = ", ".join(sorted(alias_def.keys()))
+    raise ValueError(
+        f"alias '{name}' is not defined for provider '{provider}' (defined for: {providers})"
+    )
+
+
+def _provider_file(name: str):
+    return PROVIDERS_DIR / f"{name}.yaml"
+
+
+def managed_provider_names() -> set[str]:
+    """Names of GUI-added (overlay) providers — the ones deletable from the GUI."""
+    if not PROVIDERS_DIR.is_dir():
+        return set()
+    return {f.stem for f in PROVIDERS_DIR.glob("*.yaml")}
+
+
+async def list_provider_configs(db: AsyncSession) -> list[ProviderConfig]:
+    return list(
+        (await db.execute(select(ProviderConfig).order_by(ProviderConfig.name))).scalars()
+    )
+
+
+async def create_provider(
+    db: AsyncSession, *, name: str, base_url: str, model: str | None = None,
+    api_key: str | None = None, tool_calling: bool = False,
+    params: dict | None = None, actor: str = "gui",
+    update: bool = False,
+) -> dict:
+    """Add or update an OpenAI-compatible provider from the GUI. Persists durably as a
+    ``~/.ags/providers.d/<name>.yaml`` overlay (so ``ags init`` keeps it) plus a
+    ``0600`` file secret for the key — never stored in the DB. Also upserts the DB
+    row so it's usable immediately."""
+    from sqlalchemy import select
+    name = (name or "").strip().lower()
+    if not _NAME_RE.fullmatch(name):
+        raise ValueError("name must be lowercase letters/digits/-/_ (e.g. 'groq')")
+    existing = await _configs_named(db, name)
+    if existing and not update:
+        raise ValueError(f"provider '{name}' already exists")
+    if not existing and update:
+        raise ValueError(f"provider '{name}' not found for update")
+
+    # If updating but api_key was empty, preserve the existing secret_ref
+    secret_ref = None
+    if api_key and api_key.strip():
+        secret_ref = write_secret_file(name, api_key.strip())
+    elif update and existing:
+        secret_ref = existing[0].secret_ref
+    capabilities = {"streaming": True, "tool_calling": bool(tool_calling)}
+    entry = {
+        "name": name, "kind": "openai", "enabled": True, "base_url": base_url,
+        "model": model, "secret_ref": secret_ref, "capabilities": capabilities,
+        "params": params or {},
+    }
+    PROVIDERS_DIR.mkdir(parents=True, exist_ok=True)
+    _provider_file(name).write_text(yaml.safe_dump(entry, sort_keys=False))
+    get_settings().reset_config_cache()
+
+    if update and existing:
+        pc = existing[0]
+        pc.base_url = base_url
+        pc.model = model
+        pc.secret_ref = secret_ref
+        pc.capabilities = capabilities
+        pc.params = params or {}
+    else:
+        db.add(ProviderConfig(
+            name=name, kind=adapter_kind_from_config("openai"), base_url=base_url,
+            model=model, secret_ref=secret_ref, params=params or {}, capabilities=capabilities,
+            enabled=True,
+        ))
+    await db.flush()
+    await write_audit(
+        db, actor=actor, action="update_provider" if update else "create_provider", target_type="provider", target_id=name,
+        before=None, after={"base_url": base_url, "model": model, "has_key": bool(secret_ref)},
+    )
+    await db.commit()  # durable before we respond, so an immediate GET /adapters sees it
+    return {"name": name, "kind": "openai_local", "base_url": base_url, "model": model,
+            "enabled": True, "capabilities": capabilities}
+
+
+async def delete_provider(db: AsyncSession, name: str, *, actor: str = "gui") -> dict:
+    """Remove a GUI-added provider (overlay file + file secret + DB row). Refuses for
+    providers declared in config.yaml — edit that file to change those."""
+    if not _provider_file(name).exists():
+        raise ValueError(f"'{name}' is not a GUI-managed provider (edit config.yaml instead)")
+    _provider_file(name).unlink()
+    delete_secret_file(name)
+    get_settings().reset_config_cache()
+    for pc in await _configs_named(db, name):
+        await db.delete(pc)
+    await db.flush()
+    await write_audit(
+        db, actor=actor, action="delete_provider", target_type="provider", target_id=name,
+        before={"name": name}, after=None,
+    )
+    await db.commit()
+    return {"deleted": name}
+
+
+async def _configs_named(db: AsyncSession, name: str) -> list[ProviderConfig]:
+    return list((
+        await db.execute(select(ProviderConfig).where(ProviderConfig.name == name))
+    ).scalars())
+
+
+async def list_models(db: AsyncSession, name: str) -> dict:
+    """Available models for a provider + the currently-selected one."""
+    configs = await _configs_named(db, name)
+    if not configs:
+        raise ValueError(f"provider '{name}' not found")
+    pc = configs[0]
+    models = await build_adapter(pc).list_models()
+    return {"provider": pc.name, "kind": pc.kind.value, "current": pc.model, "models": models}
+
+
+async def set_model(db: AsyncSession, name: str, model: str, *, actor: str = "cli") -> dict:
+    """Select the active model for a provider (validated against its catalogue when
+    that catalogue is enumerable). Persists onto the provider config(s)."""
+    # Resolve model aliases first
+    resolved_model = resolve_model_alias(get_settings().config(), name, model)
+
+    configs = await _configs_named(db, name)
+    if not configs:
+        raise ValueError(f"provider '{name}' not found")
+    available = await build_adapter(configs[0]).list_models()
+    if available and resolved_model not in available:
+        raise ValueError(
+            f"model '{resolved_model}' is not offered by '{name}'. Available: {', '.join(available)}"
+        )
+    before = configs[0].model
+    for pc in configs:
+        pc.model = resolved_model
+    await db.flush()
+    await write_audit(
+        db, actor=actor, action="set_model", target_type="provider", target_id=name,
+        before={"model": before}, after={"model": resolved_model},
+    )
+    return {"provider": name, "current": resolved_model}
+
+
+async def test_adapter(db: AsyncSession, name: str) -> AdapterTestResult:
+    pc = (
+        await db.execute(select(ProviderConfig).where(ProviderConfig.name == name))
+    ).scalar_one_or_none()
+    if pc is None:
+        raise ValueError(f"provider '{name}' not found")
+    adapter = build_adapter(pc)
+    health = await adapter.health_check()
+    db.add(
+        AdapterHealth(
+            provider_config_id=pc.id, ok=health.ok,
+            latency_ms=health.latency_ms, detail=health.detail,
+        )
+    )
+    await db.flush()
+    return AdapterTestResult(
+        name=pc.name, kind=pc.kind, ok=health.ok,
+        latency_ms=health.latency_ms, detail=health.detail,
+    )

harness/services/approvals.py

@@ -0,0 +1,84 @@
+from __future__ import annotations
+
+import uuid
+from datetime import UTC, datetime
+
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from harness.models.approval import Approval
+from harness.models.enums import ApprovalActionClass, ApprovalStatus
+from harness.observability.audit import write_audit
+
+
+async def create_approval(
+    db: AsyncSession,
+    *,
+    session_id: uuid.UUID,
+    action_class: ApprovalActionClass,
+    payload: dict,
+    run_id: uuid.UUID | None = None,
+) -> Approval:
+    approval = Approval(
+        session_id=session_id,
+        run_id=run_id,
+        action_class=action_class,
+        payload=payload,
+        status=ApprovalStatus.pending,
+    )
+    db.add(approval)
+    await db.flush()
+    return approval
+
+
+async def decide_approval(
+    db: AsyncSession,
+    *,
+    approval_id: uuid.UUID,
+    decision: str,  # "approved" or "denied"
+    actor: str,
+) -> Approval:
+    approval = (
+        await db.execute(select(Approval).where(Approval.id == approval_id))
+    ).scalar_one_or_none()
+    if not approval:
+        raise ValueError("approval not found")
+    if approval.status != ApprovalStatus.pending:
+        raise ValueError(f"approval is already {approval.status.value}")
+
+    new_status = ApprovalStatus.approved if decision == "approved" else ApprovalStatus.denied
+    
+    old_status = approval.status.value
+    
+    approval.status = new_status
+    approval.decided_by = actor
+    approval.decided_at = datetime.now(UTC)
+    
+    await db.flush()
+
+    await write_audit(
+        db,
+        actor=actor,
+        action="decide_approval",
+        target_type="approval",
+        target_id=str(approval.id),
+        before={"status": old_status},
+        after={"status": new_status.value}
+    )
+
+    return approval
+
+
+async def list_approvals(
+    db: AsyncSession, *, status: ApprovalStatus | None = ApprovalStatus.pending
+) -> list[Approval]:
+    """List approvals, newest first. Defaults to pending only (what the GUI and
+    CLI poll for); pass ``status=None`` for all, or a specific status to filter."""
+    stmt = select(Approval).order_by(Approval.created_at.desc())
+    if status is not None:
+        stmt = stmt.where(Approval.status == status)
+    return list((await db.execute(stmt)).scalars().all())
+
+
+async def list_pending_approvals(db: AsyncSession) -> list[Approval]:
+    return await list_approvals(db, status=ApprovalStatus.pending)

harness/services/artifacts.py

@@ -0,0 +1,78 @@
+"""Read-only access to agent-produced artifacts for the GUI.
+
+Content resolution is union-typed by the artifact ``uri``:
+
+- ``harness://transcript/{run_id}`` — content lives on the row (``meta["content"]``),
+  written by ``engine._persist_artifacts``; served from the DB, never the disk.
+- a ``file://`` URI or filesystem path — validated against the workspace ``project_dir``
+  via :mod:`harness.services.files`, then read from disk.
+- an inline ``plan``/``doc``/``patch`` carrying ``meta["content"]`` — served as-is.
+- anything else — metadata only, with a reason (no content).
+"""
+
+from __future__ import annotations
+
+import uuid
+
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from harness.models.artifact import Artifact
+from harness.services.files import read_file
+
+TRANSCRIPT_PREFIX = "harness://transcript/"
+
+
+async def list_session_artifacts(db: AsyncSession, session_id: uuid.UUID) -> list[Artifact]:
+    rows = await db.execute(
+        select(Artifact)
+        .where(Artifact.session_id == session_id)
+        .order_by(Artifact.created_at.desc())
+    )
+    return list(rows.scalars().all())
+
+
+async def get_artifact(db: AsyncSession, artifact_id: uuid.UUID) -> Artifact | None:
+    return await db.get(Artifact, artifact_id)
+
+
+def resolve_content(artifact: Artifact, project_dir: str, *,
+                    project_host: str | None = None) -> dict:
+    """Resolve an artifact's previewable content. Returns the same shape as
+    ``files.read_file`` plus a ``content`` text field, or ``content: None`` with a
+    ``reason`` when nothing is previewable. Raises ``ValueError`` if a file URI escapes
+    the project folder. ``project_host`` marks a remote project: file-backed artifacts
+    live on that host and degrade to a reason; DB-backed content still resolves."""
+    uri = artifact.uri or ""
+    name = uri.rsplit("/", 1)[-1] or "artifact"
+
+    if uri.startswith(TRANSCRIPT_PREFIX):
+        text = artifact.meta.get("content") if artifact.meta else None
+        return {"name": "transcript", "content": text, "truncated": False, "binary": False,
+                "reason": None if text else "transcript content unavailable"}
+
+    if uri.startswith("file://") or uri.startswith("/") or uri.startswith("./"):
+        if project_host:
+            return {"name": name, "content": None, "truncated": False, "binary": False,
+                    "reason": f"file lives on remote host {project_host!r}"}
+        path = uri[len("file://"):] if uri.startswith("file://") else uri
+        result = read_file(project_dir, path)
+        return {"name": result["name"], "content": result["text"],
+                "truncated": result["truncated"], "binary": result["binary"],
+                "reason": _file_reason(result)}
+
+    inline = artifact.meta.get("content") if artifact.meta else None
+    if inline:
+        return {"name": name, "content": inline, "truncated": False, "binary": False,
+                "reason": None}
+
+    return {"name": name, "content": None, "truncated": False, "binary": False,
+            "reason": "no previewable content for this artifact"}
+
+
+def _file_reason(result: dict) -> str | None:
+    if result["binary"]:
+        return "binary file"
+    if result["truncated"]:
+        return "file too large to preview"
+    return None

harness/services/attachments.py

@@ -0,0 +1,228 @@
+"""GUI attachments: uploaded documents/images that ride along with a message.
+
+Files are streamed to ``<project_dir>/.attachments/<artifact-id>/<safe-name>``
+(size-capped, never buffered unbounded) and persisted as ``Artifact`` rows
+(``kind=file``, ``meta.attachment=true``). Images are detected by magic bytes —
+the client's content-type is never trusted. A generated ``.gitignore`` keeps
+uploads out of pre-run git snapshots. At send time ``resolve_attachments``
+re-validates each id (same workspace, path still inside the project dir, file
+still present) and returns descriptors the engine threads to the adapter:
+images become native content blocks, documents are referenced by path."""
+
+from __future__ import annotations
+
+import hashlib
+import re
+import uuid
+from pathlib import Path
+
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from harness.models.artifact import Artifact
+from harness.models.enums import ArtifactKind
+from harness.observability.audit import write_audit
+from harness.observability.logging import get_logger
+from harness.services.workspaces import (
+    effective_host,
+    effective_project,
+    get_workspace_by_slug,
+)
+
+log = get_logger("attachments")
+
+ATTACHMENTS_DIR = ".attachments"
+# Raw-byte ceiling for images kept under the API's ~5 MB post-base64 limit.
+MAX_IMAGE_BYTES = 3_750_000
+MAX_FILE_BYTES = 25_000_000
+MAX_PER_MESSAGE = 10
+_CHUNK = 1 << 16
+
+# Magic-byte signatures for the image types Claude accepts natively.
+_IMAGE_MAGIC: list[tuple[bytes, str]] = [
+    (b"\x89PNG\r\n\x1a\n", "image/png"),
+    (b"\xff\xd8\xff", "image/jpeg"),
+    (b"GIF87a", "image/gif"),
+    (b"GIF89a", "image/gif"),
+]
+
+
+def _sniff_image(head: bytes) -> str | None:
+    for magic, mt in _IMAGE_MAGIC:
+        if head.startswith(magic):
+            return mt
+    # WEBP: RIFF....WEBP
+    if head[:4] == b"RIFF" and head[8:12] == b"WEBP":
+        return "image/webp"
+    return None
+
+
+def safe_filename(name: str) -> str:
+    """Basename only, conservative charset, never empty, capped length."""
+    base = Path(name or "").name
+    cleaned = re.sub(r"[^-._a-zA-Z0-9]+", "_", base)
+    cleaned = re.sub(r"_*\._*", ".", cleaned).strip("._ ") or "file"
+    if cleaned in {"file", ""} and base not in {"", ".", ".."}:
+        cleaned = "file"
+    if len(cleaned) > 128:
+        stem, dot, ext = cleaned.rpartition(".")
+        cleaned = (stem[: 128 - len(ext) - 1] + dot + ext) if dot else cleaned[:128]
+    return cleaned or "file"
+
+
+async def _workspace_and_dir(db: AsyncSession, workspace_slug: str):
+    """(workspace, local project dir) for a slug — one DB lookup for both."""
+    ws = await get_workspace_by_slug(db, workspace_slug)
+    if ws is None:
+        raise ValueError(f"unknown workspace: {workspace_slug}")
+    settings = ws.settings or {}
+    if effective_host(settings):
+        raise ValueError("attachments are unsupported for remote projects")
+    project_dir, _ = effective_project(settings)
+    return ws, Path(project_dir)
+
+
+def _descriptor(artifact: Artifact, path: str) -> dict:
+    meta = artifact.meta or {}
+    return {
+        "id": str(artifact.id),
+        "name": meta.get("original_name") or Path(path).name,
+        "path": path,
+        "media_type": meta.get("media_type") or "application/octet-stream",
+        "size": artifact.size,
+        "image": bool(meta.get("image")),
+    }
+
+
+async def save_attachment(
+    db: AsyncSession, workspace_slug: str, upload, actor: str = "api",
+) -> dict:
+    """Stream one uploaded file to disk and persist its Artifact row.
+
+    Raises ValueError for user-fixable rejections (remote project, oversize)."""
+    ws, project_dir = await _workspace_and_dir(db, workspace_slug)
+
+    attachment_id = uuid.uuid4()
+    name = safe_filename(getattr(upload, "filename", "") or "file")
+    root = project_dir / ATTACHMENTS_DIR
+    dest_dir = root / str(attachment_id)
+    dest_dir.mkdir(parents=True, exist_ok=True)
+    gitignore = root / ".gitignore"
+    if not gitignore.exists():
+        gitignore.write_text("*\n")  # keep uploads out of git snapshots
+
+    dest = dest_dir / name
+    sha = hashlib.sha256()
+    size = 0
+    head = b""
+    try:
+        with dest.open("wb") as f:
+            while chunk := await upload.read(_CHUNK):
+                if not head:
+                    head = chunk[:16]
+                size += len(chunk)
+                if size > MAX_FILE_BYTES:
+                    raise ValueError(
+                        f"file too large (> {MAX_FILE_BYTES // 1_000_000} MB)"
+                    )
+                sha.update(chunk)
+                f.write(chunk)
+    except ValueError:
+        dest.unlink(missing_ok=True)
+        dest_dir.rmdir()
+        raise
+
+    image_type = _sniff_image(head)
+    if image_type and size > MAX_IMAGE_BYTES:
+        # Too big to embed as a content block — treat as a document (path reference).
+        image_type = None
+    media_type = image_type or (getattr(upload, "content_type", None)
+                                or "application/octet-stream")
+
+    artifact = Artifact(
+        id=attachment_id,
+        workspace_id=ws.id,
+        kind=ArtifactKind.file,
+        uri=str(dest),
+        sha256=sha.hexdigest(),
+        size=size,
+        meta={
+            "attachment": True,
+            "original_name": name,
+            "media_type": media_type,
+            "image": image_type is not None,
+        },
+    )
+    db.add(artifact)
+    await db.flush()
+    await write_audit(
+        db, actor=actor, action="attachment.upload", target_type="artifact",
+        target_id=str(attachment_id),
+        after={"name": name, "size": size, "media_type": media_type},
+    )
+    return _descriptor(artifact, str(dest))
+
+
+async def resolve_attachments(
+    db: AsyncSession, ids: list[uuid.UUID], workspace_slug: str,
+) -> list[dict]:
+    """Load + re-validate attachment ids for a message send. Silently skips
+    (with a warning) anything missing, foreign, or escaped — a stale chip in
+    the GUI must not sink the run."""
+    if not ids:
+        return []
+    if len(ids) > MAX_PER_MESSAGE:
+        raise ValueError(f"too many attachments (max {MAX_PER_MESSAGE})")
+    ws, project_dir = await _workspace_and_dir(db, workspace_slug)
+    project_dir = project_dir.resolve()
+    rows = {
+        a.id: a
+        for a in (
+            await db.execute(select(Artifact).where(Artifact.id.in_(ids)))
+        ).scalars()
+    }
+    out: list[dict] = []
+    for aid in ids:
+        a = rows.get(aid)
+        if a is None or not (a.meta or {}).get("attachment"):
+            log.warning("attachment_skipped_unknown", attachment_id=str(aid))
+            continue
+        if a.workspace_id != ws.id:
+            log.warning("attachment_skipped_foreign", attachment_id=str(aid))
+            continue
+        try:
+            path = Path(a.uri).resolve()
+            path.relative_to(project_dir)  # traversal guard
+        except (ValueError, OSError):
+            log.warning("attachment_skipped_escaped", attachment_id=str(aid), uri=a.uri)
+            continue
+        if not path.is_file():
+            log.warning("attachment_skipped_missing", attachment_id=str(aid), uri=a.uri)
+            continue
+        out.append(_descriptor(a, str(path)))
+    return out
+
+
+async def get_attachment_file(
+    db: AsyncSession, attachment_id: uuid.UUID,
+) -> tuple[Path, str]:
+    """Path + media type for the preview endpoint. Raises ValueError when the
+    attachment is unknown, escaped, or gone. Same containment invariant as
+    ``resolve_attachments``: the file must live under the owning workspace's
+    ``<project_dir>/.attachments``."""
+    from harness.models.workspace import Workspace
+
+    a = await db.get(Artifact, attachment_id)
+    if a is None or not (a.meta or {}).get("attachment"):
+        raise ValueError("attachment not found")
+    ws = await db.get(Workspace, a.workspace_id)
+    settings = (ws.settings if ws else None) or {}
+    root = (Path(effective_project(settings)[0]) / ATTACHMENTS_DIR).resolve()
+    path = Path(a.uri).resolve()
+    try:
+        path.relative_to(root)  # traversal guard
+    except ValueError as exc:
+        raise ValueError("attachment not found") from exc
+    if not path.is_file():
+        raise ValueError("attachment file is gone")
+    return path, (a.meta or {}).get("media_type") or "application/octet-stream"