ags-cli 0.1.0__py3-none-any.whl

harness/services/runs.py

@@ -0,0 +1,155 @@
+"""Run-start orchestration entrypoint shared by API and CLI.
+
+Resolves the routing policy, materializes a session + queued runs, and either
+dispatches an in-process asyncio task (async, the default) or executes inline
+(when ``inline=True``, used by tests and ``--inline`` CLI runs)."""
+
+from __future__ import annotations
+
+import uuid
+
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from harness.models.run import Run
+from harness.observability.audit import write_audit
+from harness.orchestrator.engine import create_runs, execute_session
+from harness.orchestrator.policies import compile_policy, load_policy_specs
+from harness.schemas.run import RunStartRequest
+from harness.services.sessions import create_session, get_session, list_session_runs
+from harness.services.tasks import get_task
+from harness.services.workspaces import get_or_create_workspace
+from harness.settings import get_settings
+
+
+async def start_run(
+    db: AsyncSession,
+    req: RunStartRequest,
+    *,
+    inline: bool = False,
+    actor: str = "cli",
+) -> tuple[uuid.UUID, list[Run], bool]:
+    """Returns (session_id, runs, dispatched)."""
+    config = get_settings().config()
+    specs = load_policy_specs(config)
+    policy_spec = specs.get(req.policy, {"name": req.policy, "mode": req.policy})
+    policy = compile_policy(policy_spec, override_providers=req.providers)
+
+    # Resolve session: resume existing, or create from task/objective.
+    if req.session_id is not None:
+        session = await get_session(db, req.session_id)
+        if session is None:
+            raise ValueError(f"session {req.session_id} not found")
+    else:
+        if req.task_id is not None:
+            task = await get_task(db, req.task_id)
+            if task is None:
+                raise ValueError(f"task {req.task_id} not found")
+            workspace_id, objective, constraints, task_id = (
+                task.workspace_id, task.objective, task.constraints, task.id,
+            )
+        else:
+            if not req.objective:
+                raise ValueError("either task_id or objective is required")
+            ws = await get_or_create_workspace(db, req.workspace)
+            workspace_id, objective, constraints, task_id = (ws.id, req.objective, {}, None)
+        # Isolation choice for the NEW session: request → workspace default →
+        # global default (private worktree). The engine may still downgrade to
+        # main at run time (non-git dir, remote host) with a recorded reason.
+        from harness.models.workspace import Workspace
+        from harness.services.workspaces import effective_default_workspace_mode
+
+        ws_obj = await db.get(Workspace, workspace_id)
+        workspace_mode = req.workspace_mode or effective_default_workspace_mode(
+            (ws_obj.settings if ws_obj else None) or {}
+        )
+        # Plan/edit choice for the NEW session: an explicit request write_mode is
+        # stored on the session; omitting it (None) inherits the workspace/env default
+        # (plan unless HARNESS_WRITE is set).
+        session_settings: dict = {"workspace_mode": workspace_mode}
+        if req.write_mode is not None:
+            session_settings["write_mode"] = bool(req.write_mode)
+        session = await create_session(
+            db, workspace_id=workspace_id, objective=objective,
+            constraints=constraints, task_id=task_id,
+            settings=session_settings,
+        )
+
+    # Resolve message attachments (GUI uploads) into descriptors and stamp the
+    # artifact rows with this session. Skipped ids are logged, never fatal.
+    attachment_descriptors: list[dict] | None = None
+    if req.attachments:
+        from harness.models.artifact import Artifact
+        from harness.models.workspace import Workspace
+        from harness.services.attachments import resolve_attachments
+
+        ws_row = await db.get(Workspace, session.workspace_id)
+        attachment_descriptors = await resolve_attachments(
+            db, req.attachments, ws_row.slug if ws_row else "default"
+        )
+        for desc in attachment_descriptors:
+            art = await db.get(Artifact, uuid.UUID(desc["id"]))
+            if art is not None and art.session_id is None:
+                art.session_id = session.id
+        await db.flush()
+
+    provider_configs: dict = {}
+    from sqlalchemy import select
+
+    from harness.models.provider_config import ProviderConfig
+    for pc in (
+        await db.execute(select(ProviderConfig).where(ProviderConfig.enabled.is_(True)))
+    ).scalars():
+        provider_configs[pc.name] = pc
+
+    await create_runs(
+        db, session_id=session.id, policy=policy, provider_configs=provider_configs
+    )
+    await write_audit(
+        db, actor=actor, action="run.start", target_type="session",
+        target_id=str(session.id), after={"policy": req.policy, "providers": req.providers},
+    )
+
+    dispatched = False
+    if inline:
+        from sqlalchemy.ext.asyncio import async_sessionmaker
+        from harness.workers.inprocess import _session_lock, schedule_finalize
+        async with _session_lock(session.id):
+            await execute_session(
+                db, session_id=session.id, policy=policy,
+                message_override=req.additional_objective,
+                model_override=req.model,
+                model_overrides=req.models,
+                attachments=attachment_descriptors,
+            )
+            await db.commit()
+        # schedule_finalize is called OUTSIDE the lock — it acquires _session_lock
+        # itself internally; nesting would deadlock.
+        # Summarize + extract run post-run in the background so the ask response
+        # is returned immediately.  Pass a sessionmaker bound to the caller's
+        # engine so the background task hits the same DB as this request/test
+        # session (the global factory defaults to 127.0.0.1:5432 which may not
+        # be reachable in test environments).
+        schedule_finalize(
+            session.id,
+            sessionmaker=async_sessionmaker(db.bind, expire_on_commit=False),
+        )
+    else:
+        # Commit the session + queued runs BEFORE dispatching so the executor (which
+        # uses its own DB connection — an in-process asyncio task that may run before
+        # the request's own commit) reliably sees them.
+        await db.commit()
+        # Dispatch off the request path as an in-process asyncio task. The executor
+        # re-derives the policy from config + session.
+        from harness.workers.dispatch import dispatch_session
+
+        await dispatch_session(
+            session.id, req.policy, req.providers,
+            additional_objective=req.additional_objective,
+            model_override=req.model,
+            model_overrides=req.models,
+            attachments=attachment_descriptors,
+        )
+        dispatched = True
+
+    runs = await list_session_runs(db, session.id)
+    return session.id, runs, dispatched

harness/services/runs_diff.py

@@ -0,0 +1,201 @@
+"""Service: compute the git diff between a run's pre-run snapshot and the current HEAD.
+
+The snapshot SHA is stored as a ``patch`` artifact with ``uri`` starting with
+``git-snapshot://`` and ``meta.pre_run == True`` (written by Task 21 /
+``harness.orchestrator.engine``).
+
+Resolves the workspace project_dir exactly like the engine's own
+``effective_project``, runs ``git diff <sha>`` (60 s timeout), and caps output
+at 1 MB. Raises an HTTP 404 when the run has no snapshot artifact.
+
+Safety:
+- project_dir comes from workspace settings (same trust as the engine).
+- Path.resolve() + .git existence check before running git.
+- SHA is regex-validated (^[0-9a-f]{40}$) before use in argv.
+"""
+from __future__ import annotations
+
+import asyncio
+import re
+import subprocess
+import uuid
+from pathlib import Path
+
+from fastapi import HTTPException
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from harness.models.artifact import Artifact
+from harness.models.enums import ArtifactKind
+from harness.models.run import Run
+from harness.models.session import Session
+from harness.models.workspace import Workspace
+from harness.services.workspaces import effective_host, effective_project
+
+_SHA_RE = re.compile(r"^[0-9a-f]{40}$")
+_GIT_SNAPSHOT_PREFIX = "git-snapshot://"
+_MAX_DIFF_BYTES = 1_000_000  # 1 MB cap
+
+
+async def run_diff(db: AsyncSession, run_id: uuid.UUID) -> dict:
+    """Compute the git diff for *run_id*.
+
+    Returns ``{"run_id", "snapshot", "diff", "truncated"}``.
+    Raises ``HTTPException(404)`` when no snapshot artifact exists for the run.
+    Raises ``ValueError`` when the stored SHA fails validation.
+    """
+    # 1. Fetch the run.
+    run: Run | None = await db.get(Run, run_id)
+    if run is None:
+        raise HTTPException(status_code=404, detail=f"run {run_id} not found")
+
+    # 2. Find the snapshot artifact (kind=patch, uri starts with git-snapshot://, pre_run=True).
+    snapshot_artifact = await _get_snapshot_artifact(db, run_id)
+    if snapshot_artifact is None:
+        raise HTTPException(status_code=404, detail=f"no snapshot artifact for run {run_id}")
+
+    # 3. Extract and validate the SHA.
+    sha = _extract_sha(snapshot_artifact)
+    if not _SHA_RE.match(sha):
+        raise ValueError(f"invalid snapshot SHA: {sha!r} — expected 40 hex chars")
+
+    # 4. Resolve project_dir via workspace settings (same path as the engine).
+    project_dir, project_host = await _resolve_project_dir(db, run)
+    if project_host:
+        # The project now lives on a remote host: a stale local snapshot must not
+        # be diffed against a same-named LOCAL dir (wrong repo).
+        raise HTTPException(
+            status_code=400,
+            detail=f"diff unavailable for remote project on {project_host!r}",
+        )
+
+    # 5. Safety checks on the resolved directory.
+    root = Path(project_dir).resolve()
+    if not root.is_dir():
+        raise HTTPException(status_code=500, detail=f"project_dir not found: {project_dir}")
+    if not (root / ".git").exists():
+        raise HTTPException(status_code=500, detail=f"project_dir is not a git repo: {project_dir}")
+
+    # 6. Run git diff in a thread (60 s timeout).
+    diff_text, truncated = await asyncio.to_thread(_git_diff, str(root), sha)
+
+    return {
+        "run_id": run_id,
+        "snapshot": sha,
+        "diff": diff_text,
+        "truncated": truncated,
+    }
+
+
+async def latest_run_diff(db: AsyncSession, workspace: str) -> dict:
+    """Find the newest run (in this workspace) that has a snapshot artifact, then
+    delegate to :func:`run_diff`.  Raises ``HTTPException(404)`` when nothing qualifies.
+    """
+    # Join Run → Session → Workspace to filter by workspace slug; fetch candidates
+    # ordered newest-first and apply the pre_run check in Python for JSON portability.
+    stmt = (
+        select(Run, Artifact)
+        .join(Session, Session.id == Run.session_id)
+        .join(Workspace, Workspace.id == Session.workspace_id)
+        .join(
+            Artifact,
+            (Artifact.run_id == Run.id)
+            & (Artifact.kind == ArtifactKind.patch)
+            & Artifact.uri.startswith(_GIT_SNAPSHOT_PREFIX),
+        )
+        .where(Workspace.slug == workspace)
+        .order_by(Run.created_at.desc())
+        .limit(20)
+    )
+    rows = (await db.execute(stmt)).all()
+    qualifying_run = None
+    for run_row, artifact_row in rows:
+        if artifact_row.meta and artifact_row.meta.get("pre_run"):
+            qualifying_run = run_row
+            break
+    if qualifying_run is None:
+        raise HTTPException(
+            status_code=404,
+            detail=f"no run with a snapshot found in workspace {workspace!r}",
+        )
+    return await run_diff(db, qualifying_run.id)
+
+
+# ---------------------------------------------------------------------------
+# Private helpers
+# ---------------------------------------------------------------------------
+
+async def _get_snapshot_artifact(db: AsyncSession, run_id: uuid.UUID) -> Artifact | None:
+    stmt = (
+        select(Artifact)
+        .where(
+            Artifact.run_id == run_id,
+            Artifact.kind == ArtifactKind.patch,
+            Artifact.uri.startswith(_GIT_SNAPSHOT_PREFIX),
+        )
+        .order_by(Artifact.created_at.desc())
+    )
+    candidates = (await db.execute(stmt)).scalars().all()
+    # Prefer artifacts where meta.pre_run is truthy (Python check for JSON portability).
+    for a in candidates:
+        if a.meta and a.meta.get("pre_run"):
+            return a
+    return None
+
+
+def _extract_sha(artifact: Artifact) -> str:
+    """Extract the SHA from the artifact — prefer meta['git_snapshot'], fall back to URI suffix."""
+    if artifact.meta and artifact.meta.get("git_snapshot"):
+        return str(artifact.meta["git_snapshot"])
+    # uri = "git-snapshot://<sha>"
+    return artifact.uri[len(_GIT_SNAPSHOT_PREFIX):]
+
+
+async def _resolve_project_dir(db: AsyncSession, run: Run) -> tuple[str, str | None]:
+    """Resolve the (project_dir, project_host) for a run via run → session →
+    workspace.settings. A non-None host means the project is remote. A session
+    isolated in a private worktree diffs against ITS worktree (always local),
+    not the shared project dir."""
+    session: Session | None = await db.get(Session, run.session_id)
+    if session is None:
+        raise HTTPException(status_code=500, detail="session not found for run")
+    sess_settings = session.settings or {}
+    if sess_settings.get("workspace_mode") == "worktree" and sess_settings.get("worktree_path"):
+        return sess_settings["worktree_path"], None
+    workspace: Workspace | None = await db.get(Workspace, session.workspace_id)
+    if workspace is None:
+        raise HTTPException(status_code=500, detail="workspace not found for session")
+    settings = workspace.settings or {}
+    project_dir, _ = effective_project(settings)
+    return project_dir, effective_host(settings)
+
+
+def _git_diff(project_dir: str, sha: str) -> tuple[str, bool]:
+    """Run ``git diff <sha>`` synchronously (called via asyncio.to_thread).
+
+    Returns ``(diff_text, truncated)``. Never passes user-controlled strings
+    other than the pre-validated SHA into argv.
+    """
+    try:
+        import os
+        result = subprocess.run(["git", "diff", sha],
+            cwd=project_dir,
+            capture_output=True,
+            text=True,
+            timeout=60,
+            shell=(os.name == "nt")
+        )
+        diff = result.stdout
+        if result.returncode != 0 and not diff:
+            # Non-zero exit is normal when there are changes; empty diff on error is not.
+            diff = result.stderr or "(git diff returned no output)"
+    except subprocess.TimeoutExpired:
+        diff = "(git diff timed out after 60 s)"
+        return diff, False
+
+    truncated = False
+    if len(diff.encode()) > _MAX_DIFF_BYTES:
+        diff = diff.encode()[:_MAX_DIFF_BYTES].decode("utf-8", errors="replace")
+        truncated = True
+
+    return diff, truncated

harness/services/sessions.py

@@ -0,0 +1,242 @@
+from __future__ import annotations
+
+import uuid
+from datetime import UTC, datetime, timedelta
+
+from sqlalchemy import delete, select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+import logging
+
+from harness.memory.sqlite_vec_backend import SqliteVecIndex
+from harness.models.enums import SessionStatus
+from harness.models.memory import MemoryItem
+from harness.models.run import Run
+
+_log = logging.getLogger(__name__)
+from harness.models.run_event import RunEvent
+from harness.models.session import Session
+from harness.models.workspace import Workspace
+from harness.observability.audit import write_audit
+
+
+async def create_session(
+    db: AsyncSession,
+    *,
+    workspace_id: uuid.UUID,
+    objective: str,
+    constraints: dict | None = None,
+    task_id: uuid.UUID | None = None,
+    parent_session_id: uuid.UUID | None = None,
+    settings: dict | None = None,
+) -> Session:
+    sess = Session(
+        workspace_id=workspace_id,
+        task_id=task_id,
+        parent_session_id=parent_session_id,
+        canonical_objective=objective,
+        constraints=constraints or {},
+        settings=settings or {},
+    )
+    db.add(sess)
+    await db.flush()
+    return sess
+
+
+async def get_session(db: AsyncSession, session_id: uuid.UUID) -> Session | None:
+    return (
+        await db.execute(select(Session).where(Session.id == session_id))
+    ).scalar_one_or_none()
+
+
+async def set_session_settings(
+    db: AsyncSession, session_id: uuid.UUID, *,
+    write_mode: bool | None, actor: str = "api",
+) -> Session:
+    """Set or clear (``write_mode=None``) a session's plan/write mode override.
+
+    Only ``write_mode`` is writable here — the other ``Session.settings`` keys
+    (worktree bookkeeping) are engine-managed and must not be clobbered from the
+    API. Audited."""
+    sess = await get_session(db, session_id)
+    if sess is None:
+        raise ValueError("session not found")
+    settings = dict(sess.settings or {})
+    before = {"write_mode": settings.get("write_mode")}
+    if write_mode is None:
+        settings.pop("write_mode", None)
+    else:
+        settings["write_mode"] = bool(write_mode)
+    sess.settings = settings  # reassign so SQLAlchemy flags the JSON column dirty
+    await db.flush()
+    await write_audit(
+        db, actor=actor, action="session.set_mode", target_type="session",
+        target_id=str(session_id), before=before,
+        after={"write_mode": settings.get("write_mode")},
+    )
+    return sess
+
+
+async def get_session_mode(db: AsyncSession, sess: Session) -> dict:
+    """Resolve a session's mode: its own override, the workspace default, and the
+    effective value the next run will use."""
+    from harness.services.workspaces import (
+        _mode_label,
+        effective_project,
+        effective_write_mode,
+    )
+
+    workspace = (
+        await db.execute(select(Workspace).where(Workspace.id == sess.workspace_id))
+    ).scalar_one()
+    session_settings = sess.settings or {}
+    workspace_settings = workspace.settings or {}
+    effective = effective_write_mode(session_settings, workspace_settings)
+    return {
+        "write_mode": session_settings.get("write_mode"),
+        "workspace_write_mode": effective_project(workspace_settings)[1],
+        "effective_write_mode": effective,
+        "mode": _mode_label(effective),
+    }
+
+
+async def list_recent_sessions(
+    db: AsyncSession, *, workspace_id: uuid.UUID | None = None, limit: int = 50
+) -> list[Session]:
+    stmt = select(Session).order_by(Session.updated_at.desc()).limit(limit)
+    if workspace_id is not None:
+        stmt = stmt.where(Session.workspace_id == workspace_id)
+    return list((await db.execute(stmt)).scalars())
+
+
+async def branch_session(db: AsyncSession, session_id: uuid.UUID, actor: str = "system") -> Session:
+    """Create a child session seeded from the parent's canonical summary/objective —
+    branching from canonical state, not raw transcript."""
+    parent = (
+        await db.execute(select(Session).where(Session.id == session_id))
+    ).scalar_one()
+    objective = parent.canonical_objective
+    if parent.summary:
+        objective += f"\n\n## Inherited summary\n{parent.summary}"
+    # Inherit the parent's isolation choice and mode override — but never its
+    # worktree bookkeeping: the child gets its own worktree (keyed by its id).
+    inherited = {
+        k: (parent.settings or {})[k]
+        for k in ("workspace_mode", "write_mode")
+        if k in (parent.settings or {})
+    }
+    child = await create_session(
+        db,
+        workspace_id=parent.workspace_id,
+        objective=objective,
+        constraints=parent.constraints,
+        task_id=parent.task_id,
+        parent_session_id=parent.id,
+        settings=inherited,
+    )
+    await write_audit(
+        db, actor=actor, action="session.branch", target_type="session",
+        target_id=str(child.id), after={"parent_session_id": str(parent.id)}
+    )
+    return child
+
+
+async def select_sessions_to_clear(
+    db: AsyncSession,
+    *,
+    all: bool = False,  # noqa: A002 - mirrors the `--all` flag
+    status: SessionStatus | None = None,
+    older_than_days: int | None = None,
+    workspace_slug: str | None = None,
+    ids: list[uuid.UUID] | None = None,
+) -> list[Session]:
+    """Resolve the sessions matched by the clear filters (AND-combined). Returns [] when
+    no filter is given — the caller refuses to clear without an explicit selection."""
+    if not (all or status or older_than_days or workspace_slug or ids):
+        return []
+    stmt = select(Session).order_by(Session.updated_at.desc())
+    if status is not None:
+        stmt = stmt.where(Session.status == status)
+    if older_than_days is not None:
+        cutoff = datetime.now(UTC) - timedelta(days=older_than_days)
+        stmt = stmt.where(Session.updated_at < cutoff)
+    if workspace_slug is not None:
+        stmt = stmt.join(Workspace, Workspace.id == Session.workspace_id).where(
+            Workspace.slug == workspace_slug
+        )
+    if ids:
+        stmt = stmt.where(Session.id.in_(ids))
+    return list((await db.execute(stmt)).scalars())
+
+
+async def delete_sessions(db: AsyncSession, sessions: list[Session]) -> int:
+    """Hard-delete sessions. DB FK cascade drops runs/run_events/approvals/comparisons;
+    session-scoped memory (namespace-keyed, no FK) is cleaned explicitly here."""
+    ids = [s.id for s in sessions]
+    if not ids:
+        return 0
+    # Discard private worktrees first (fail-soft). The session branch is kept
+    # unless the session was merged — an unmerged branch is the safety net.
+    from harness.services.worktrees import remove_worktree
+
+    for s in sessions:
+        if (s.settings or {}).get("worktree_path"):
+            try:
+                await remove_worktree(
+                    db, s.id,
+                    delete_branch=bool((s.settings or {}).get("merge_commit")),
+                    actor="delete",
+                )
+            except Exception:  # noqa: BLE001 - deletion must never fail on cleanup
+                _log.warning("delete_sessions: worktree cleanup failed for %s", s.id,
+                             exc_info=True)
+    # Feature-detect sqlite-vec: only attempt vec cleanup when the extension is loaded.
+    vec_loaded = await SqliteVecIndex.loaded_for_session(db)
+
+    for sid in ids:
+        # Session-scoped memory lives under a `…/session/<id>` namespace (see
+        # harness/memory/namespaces.py) — no FK, so remove it directly.
+        # First, clean up any vec_memory rows for these items so they don't leak.
+        if vec_loaded:
+            try:
+                item_ids_stmt = select(MemoryItem.id).where(
+                    MemoryItem.namespace.like(f"%/session/{sid}%")
+                )
+                item_ids = list(
+                    (await db.execute(item_ids_stmt)).scalars().all()
+                )
+                for iid in item_ids:
+                    await SqliteVecIndex.delete_item(db, str(iid))
+            except Exception:  # noqa: BLE001
+                _log.warning(
+                    "delete_sessions: vec_memory cleanup failed for session %s; "
+                    "continuing with item deletion",
+                    sid,
+                    exc_info=True,
+                )
+        await db.execute(
+            delete(MemoryItem).where(MemoryItem.namespace.like(f"%/session/{sid}%"))
+        )
+    await db.execute(delete(Session).where(Session.id.in_(ids)))
+    await db.commit()
+    return len(ids)
+
+
+async def list_session_runs(db: AsyncSession, session_id: uuid.UUID) -> list[Run]:
+    return list(
+        (
+            await db.execute(
+                select(Run).where(Run.session_id == session_id).order_by(Run.created_at.asc())
+            )
+        ).scalars()
+    )
+
+
+async def list_run_events(db: AsyncSession, run_id: uuid.UUID) -> list[RunEvent]:
+    return list(
+        (
+            await db.execute(
+                select(RunEvent).where(RunEvent.run_id == run_id).order_by(RunEvent.seq.asc())
+            )
+        ).scalars()
+    )