ai-dev-cli-tools 0.5.0a1__py3-none-any.whl

ai_dev_tools/runtime/supervisor.py

@@ -0,0 +1,145 @@
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import signal
+import subprocess
+import time
+from contextlib import suppress
+from datetime import UTC, datetime
+from pathlib import Path
+from threading import Event, Thread
+from typing import TextIO
+
+from ai_dev_tools.security.secrets import mask_text
+
+_STOP = Event()
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(prog="ai-dev-runtime-supervisor")
+    parser.add_argument("--metadata", type=Path, required=True)
+    parser.add_argument("--request", type=Path, required=True)
+    parser.add_argument("--token", required=True)
+    parser.add_argument("--cwd", type=Path, required=True)
+    parser.add_argument("--log", type=Path, required=True)
+    parser.add_argument("command", nargs=argparse.REMAINDER)
+    args = parser.parse_args(argv)
+    command = args.command[1:] if args.command[:1] == ["--"] else args.command
+    if not command:
+        return 2
+
+    for signal_name in ("SIGINT", "SIGTERM"):
+        value = getattr(signal, signal_name, None)
+        if value is not None:
+            # Embedded callers may run the supervisor in a non-main thread.
+            with suppress(ValueError):
+                signal.signal(value, _request_stop)
+
+    args.log.parent.mkdir(parents=True, exist_ok=True)
+    args.metadata.parent.mkdir(parents=True, exist_ok=True)
+    with args.log.open("a", encoding="utf-8", errors="replace") as log:
+        child = subprocess.Popen(
+            command,
+            cwd=args.cwd,
+            stdin=subprocess.DEVNULL,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.STDOUT,
+            shell=False,
+            env=os.environ.copy(),
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+        )
+        if child.stdout is None:
+            return 2
+        output_thread = Thread(target=_copy_output, args=(child.stdout, log), daemon=True)
+        output_thread.start()
+        state: dict[str, object] = {
+            "schema_version": "1",
+            "status": "running",
+            "supervisor_pid": os.getpid(),
+            "child_pid": child.pid,
+            "command": command,
+            "cwd": str(args.cwd),
+            "log": str(args.log),
+            "token": args.token,
+            "started_at": _now(),
+            "heartbeat_at": _now(),
+        }
+        _write_json(args.metadata, state)
+        try:
+            while child.poll() is None:
+                if _STOP.is_set() or _stop_requested(args.request, args.token):
+                    state["status"] = "stopping"
+                    _write_json(args.metadata, state)
+                    _terminate(child)
+                    break
+                state["heartbeat_at"] = _now()
+                _write_json(args.metadata, state)
+                time.sleep(0.25)
+        finally:
+            exit_code = child.poll()
+            if exit_code is None:
+                _terminate(child)
+                exit_code = child.poll()
+            output_thread.join(timeout=1)
+            state["status"] = "stopped" if _STOP.is_set() or args.request.exists() else "exited"
+            state["exit_code"] = exit_code
+            state["finished_at"] = _now()
+            state["heartbeat_at"] = _now()
+            _write_json(args.metadata, state)
+            if args.request.exists():
+                with suppress(OSError):
+                    args.request.unlink()
+    return 0 if state["status"] == "stopped" else int(exit_code or 0)
+
+
+def _request_stop(signum: int, frame: object) -> None:
+    del signum, frame
+    _STOP.set()
+
+
+def _stop_requested(path: Path, token: str) -> bool:
+    try:
+        return path.read_text(encoding="utf-8").strip() == token
+    except OSError:
+        return False
+
+
+def _terminate(process: subprocess.Popen[str]) -> None:
+    process.terminate()
+    try:
+        process.wait(timeout=5)
+    except subprocess.TimeoutExpired:
+        process.kill()
+        process.wait(timeout=5)
+
+
+def _copy_output(stream: TextIO, log: TextIO) -> None:
+    for line in stream:
+        log.write(mask_text(line))
+        log.flush()
+
+
+def _write_json(path: Path, data: dict[str, object]) -> None:
+    temporary = path.with_suffix(path.suffix + ".tmp")
+    temporary.write_text(json.dumps(data, indent=2, sort_keys=True) + "\n", encoding="utf-8")
+    deadline = time.monotonic() + 1.0
+    while True:
+        try:
+            os.replace(temporary, path)
+            return
+        except PermissionError:
+            if time.monotonic() >= deadline:
+                raise
+            time.sleep(0.01)
+
+
+def _now() -> str:
+    return datetime.now(UTC).isoformat()
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

ai_dev_tools/security/__init__.py

@@ -0,0 +1 @@
+"""Security scanning."""

ai_dev_tools/security/secrets.py

@@ -0,0 +1,58 @@
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from pathlib import Path
+
+SECRET_PATTERNS: tuple[tuple[str, re.Pattern[str]], ...] = (
+    ("github_token", re.compile(r"gh[pousr]_[A-Za-z0-9_]{20,}")),
+    ("openai_key", re.compile(r"sk-[A-Za-z0-9_-]{20,}")),
+    ("openrouter_key", re.compile(r"sk-or-[A-Za-z0-9_-]{20,}")),
+    ("aws_access_key", re.compile(r"AKIA[0-9A-Z]{16}")),
+    ("private_key", re.compile(r"-----BEGIN [A-Z ]*PRIVATE KEY-----")),
+    ("connection_string", re.compile(r"(?i)(postgres|mysql|mongodb|redis)://[^\s]+")),
+    ("password_assignment", re.compile(r"(?i)(password|passwd|pwd)\s*=\s*['\"]?[^'\"\s]{8,}")),
+    ("api_key_assignment", re.compile(r"(?i)(api[_-]?key|token|secret)\s*=\s*['\"]?[^'\"\s]{12,}")),
+)
+
+
+@dataclass(slots=True)
+class SecretFinding:
+    path: str
+    line: int
+    kind: str
+    value: str
+
+    def masked_value(self) -> str:
+        return "***" if len(self.value) <= 8 else f"{self.value[:4]}...{self.value[-4:]}"
+
+    def masked_dict(self) -> dict[str, object]:
+        return {
+            "path": self.path,
+            "line": self.line,
+            "kind": self.kind,
+            "masked_value": self.masked_value(),
+        }
+
+
+def scan_paths_for_secrets(root: Path, paths: list[Path]) -> list[SecretFinding]:
+    findings: list[SecretFinding] = []
+    for path in paths:
+        if not path.exists() or not path.is_file() or path.stat().st_size > 1_000_000:
+            continue
+        rel = str(path.relative_to(root))
+        if path.name == ".env":
+            findings.append(SecretFinding(rel, 1, "env_file", ".env"))
+        text = path.read_text(encoding="utf-8", errors="replace")
+        for line_number, line in enumerate(text.splitlines(), start=1):
+            for kind, pattern in SECRET_PATTERNS:
+                for match in pattern.finditer(line):
+                    findings.append(SecretFinding(rel, line_number, kind, match.group(0)))
+    return findings
+
+
+def mask_text(text: str) -> str:
+    masked = text
+    for kind, pattern in SECRET_PATTERNS:
+        masked = pattern.sub(f"***MASKED_{kind.upper()}***", masked)
+    return masked

ai_dev_tools/utils/__init__.py

@@ -0,0 +1 @@
+"""Utility helpers."""

ai_dev_tools/utils/subprocess.py

@@ -0,0 +1,74 @@
+from __future__ import annotations
+
+import os
+import shlex
+import shutil
+import subprocess
+import time
+from dataclasses import dataclass
+from pathlib import Path
+
+
+@dataclass(slots=True)
+class CommandResult:
+    command: list[str]
+    exit_code: int
+    stdout: str
+    stderr: str
+    duration_seconds: float
+    timed_out: bool = False
+    cached: bool = False
+
+    @property
+    def combined_output(self) -> str:
+        if self.stderr:
+            return f"{self.stdout}\n{self.stderr}".strip()
+        return self.stdout.strip()
+
+
+def split_command(command: str) -> list[str]:
+    return shlex.split(command, posix=os.name != "nt")
+
+
+def run_command(command: list[str], cwd: Path, timeout_seconds: int = 300) -> CommandResult:
+    started = time.monotonic()
+    executable_command = _windows_batch_command(command)
+    try:
+        completed = subprocess.run(
+            executable_command,
+            cwd=cwd,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+            capture_output=True,
+            timeout=timeout_seconds,
+            shell=False,
+            check=False,
+        )
+        return CommandResult(
+            command=command,
+            exit_code=completed.returncode,
+            stdout=completed.stdout,
+            stderr=completed.stderr,
+            duration_seconds=round(time.monotonic() - started, 3),
+        )
+    except FileNotFoundError as exc:
+        return CommandResult(command, 127, "", str(exc), round(time.monotonic() - started, 3))
+    except subprocess.TimeoutExpired as exc:
+        stdout = exc.stdout if isinstance(exc.stdout, str) else ""
+        stderr = exc.stderr if isinstance(exc.stderr, str) else ""
+        return CommandResult(
+            command, 124, stdout, stderr, round(time.monotonic() - started, 3), True
+        )
+
+
+def _windows_batch_command(command: list[str]) -> list[str]:
+    if os.name != "nt" or not command:
+        return command
+    resolved = shutil.which(command[0]) or command[0]
+    executable = resolved.lower()
+    if executable.endswith((".cmd", ".bat")):
+        comspec = os.environ.get("COMSPEC", "cmd.exe")
+        executable_command = [resolved, *command[1:]]
+        return [comspec, "/d", "/c", *executable_command]
+    return command