aisoc-cli 0.1.0__tar.gz

aisoc_cli-0.1.0/.gitignore

@@ -0,0 +1,162 @@
+# Environment
+.env
+.env.local
+.env.*.local
+
+# Dependencies
+node_modules/
+.pnpm-store/
+
+# Build outputs
+dist/
+build/
+.next/
+out/
+.turbo/
+# T3.8 — generated Storybook static bundle. The source lives in
+# apps/web/.storybook + apps/web/stories; the built bundle is uploaded
+# as a CI artifact rather than committed.
+apps/web/storybook-static/
+*.egg-info/
+__pycache__/
+*.pyc
+*.pyo
+
+# Go
+*.exe
+*.test
+vendor/
+bin/
+
+# Terraform
+.terraform/
+*.tfstate
+*.tfstate.backup
+.terraform.lock.hcl
+*.tfvars
+!terraform.tfvars.example
+
+# Python
+.venv/
+venv/
+.eval-test-venv/
+.mypy_cache/
+.pytest_cache/
+htmlcov/
+.coverage
+.coverage.*
+coverage.xml
+# Phase 2.2 — vitest v8 coverage outputs (apps/web/coverage/) and
+# any other per-service coverage dump. Generated on every CI run,
+# uploaded as artefacts — never committed.
+coverage/
+**/coverage/
+# BUT keep app-source directories literally named `coverage` (the
+# /tools/coverage route, and `components/coverage/` behind /coverage-advisor).
+# The rules above are for generated test-coverage output; without these
+# negations the coverage tool page silently drops from the build.
+#
+# `components/` was missing here, which is worse than it sounds: the component
+# was tracked because it predates the rule, so nothing looked wrong, but every
+# *new* file beside it — a test especially — was ignored on `git add -A` and
+# never reached CI. A test that cannot be committed is indistinguishable from
+# a test that passes.
+!apps/web/src/app/**/coverage/
+!apps/web/src/app/**/coverage/**
+!apps/web/src/components/coverage/
+!apps/web/src/components/coverage/**
+*.lcov
+
+# IDE
+.idea/
+.vscode/
+.cursor/
+.claude/
+*.swp
+*.swo
+
+# Go test/build binaries inside plugins
+plugins/**/*-build-test
+plugins/**/*-build
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Logs
+logs/
+*.log
+# But: the AIT-LDS fidelity-benchmark fixture ships an Apache CLF
+# access.log on purpose (T5.3 in v8.0). It is committed test data,
+# not a runtime log, so unblock it explicitly.
+!services/agents/tests/eval_data/**/*.log
+
+# Docker
+.docker/
+
+# Secrets
+*.pem
+*.key
+*.crt
+secrets/
+.gstack/
+
+# Local eval / build artifacts
+eval_report.json
+eval_mitre_accuracy_report.json
+.gocache/
+*.tsbuildinfo
+
+# PR body scratch files (local working copy, never committed)
+.pr-body-*.md
+
+# Local progress tracking (per AGENTS.md preference, not committed)
+PROGRESS.md
+PR_TRIAGE.md
+
+# Acceptance harness ledger (.aisoc/acceptance-history.jsonl is per-machine and
+# accumulates across runs — useful for "is this getting slower?" but not for
+# version control. Same applies to any other harness state we drop in here.)
+.aisoc/
+
+# Detection-import upstream clones (populated by tools.detection_import)
+.import-cache/
+
+# Docusaurus generated cache (apps/docs)
+apps/docs/.docusaurus/
+apps/docs/build/
+
+# Local QA artifacts (screenshots from manual UI checks)
+apps/web/.qa-screenshots/
+
+# Runtime playbook store. `PlaybookStore` keeps the bundled corpus read-only and
+# writes every mutation to `index.json` in the same directory, so anything that
+# exercises `POST /api/v1/playbooks` — a test, a local run, a reproduction of a
+# bug — leaves a several-thousand-line file behind. Committing it ships whatever
+# the last run happened to hold as if it were curated content, and the playbook
+# schema lint counts it as a 65th file.
+services/agents/data/playbooks/index.json
+
+# Marketplace index staged into the API service build context at deploy time
+# (see infra/fly/fly-demo-deploy.sh). The canonical source is marketplace/index.json
+# at the repo root; the API Dockerfile only sees its own dir as build context, so
+# the deploy script copies the index in just-in-time. We never commit the copy.
+services/api/marketplace/
+
+# Live-dumped graph schema produced by `scripts/export_graph_schema.py`
+# (default mode). The source of truth is `schemas/graph-schema.yaml`; the
+# `-current.yaml` file is a runtime artefact that varies by environment.
+schemas/graph-schema-current.yaml
+
+
+# Compiled Go binaries. `services/demo-producer/demo-producer` was committed as
+# a 6.9 MB macOS arm64 executable in a repository whose Dockerfile builds a
+# GOOS=linux one — nothing consumed it, nothing rebuilt it, and running the
+# documented `go build ./...` silently overwrote it and dirtied the tree.
+/services/demo-producer/demo-producer
+/services/enrichment/enrichment
+/services/ingest/ingest
+
+# Generated by scripts/resolve_port_conflicts.py when a host port AiSOC
+# publishes is already in use. Machine-specific by definition.
+docker-compose.ports.yml

aisoc_cli-0.1.0/PKG-INFO

@@ -0,0 +1,90 @@
+Metadata-Version: 2.5
+Name: aisoc-cli
+Version: 0.1.0
+Summary: AiSOC Developer CLI — scaffold, validate, and publish plugins and detections
+Project-URL: Homepage, https://github.com/beenuar/AiSOC
+Project-URL: Documentation, https://github.com/beenuar/AiSOC#readme
+Project-URL: Repository, https://github.com/beenuar/AiSOC
+Author-email: Beenu Arora <beenu@cyble.com>
+License: MIT
+Keywords: aisoc,cli,plugin,security,soc
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Requires-Python: >=3.11
+Requires-Dist: click>=8.1
+Requires-Dist: cryptography<51,>=46
+Requires-Dist: httpx>=0.27
+Requires-Dist: jsonschema>=4.21
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: rich>=13.7
+Requires-Dist: structlog>=24.1
+Provides-Extra: dev
+Requires-Dist: mypy<3,>=2.3.1; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff<0.17,>=0.16.8; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# aisoc-cli
+
+Developer CLI for building, validating, and publishing AiSOC plugins and detection rules.
+
+> **Status — monorepo today, not yet on PyPI.** The CLI ships from this monorepo and is fully functional today. `pip install aisoc-cli` does not resolve: the upload is blocked on registry credentials, which is an account action rather than a code change. The CLI name (`aisoc`) and command surface stay identical once it ships.
+
+## Installation
+
+```bash
+# Today (from this monorepo):
+git clone https://github.com/beenuar/AiSOC.git
+cd AiSOC && pip install -e packages/aisoc-cli
+
+# Not yet on PyPI — the upload is blocked on registry credentials,
+# which is an account action rather than a code change. Until then, install
+# from source with the command above.
+#   pipx install aisoc-cli     # recommended (isolated venv)
+#   pip install aisoc-cli
+```
+
+## Commands
+
+### Plugin Scaffold
+```bash
+aisoc plugin scaffold my-enricher
+aisoc plugin scaffold my-connector --type connector
+```
+
+### Plugin Validate
+```bash
+aisoc plugin validate ./my-enricher
+aisoc plugin validate ./my-enricher/plugin.yaml
+```
+
+### Plugin Publish
+```bash
+export AISOC_API_URL=https://api.example.com
+export AISOC_API_KEY=sk-...
+aisoc plugin publish ./my-enricher
+```
+
+### Detection Validate
+```bash
+aisoc detection validate ./detections/brute-force.yaml
+```
+
+### Key Generation
+```bash
+aisoc keygen              # generates ~/.aisoc/signing.key + signing.pub
+```
+
+## Environment Variables
+
+| Variable | Description |
+|---|---|
+| `AISOC_API_URL` | AiSOC API base URL (default: `http://localhost:8000`) |
+| `AISOC_API_KEY` | API key for authentication |
+| `AISOC_SIGNING_KEY` | Path to Ed25519 private key (default: `~/.aisoc/signing.key`) |

aisoc_cli-0.1.0/README.md

@@ -0,0 +1,58 @@
+# aisoc-cli
+
+Developer CLI for building, validating, and publishing AiSOC plugins and detection rules.
+
+> **Status — monorepo today, not yet on PyPI.** The CLI ships from this monorepo and is fully functional today. `pip install aisoc-cli` does not resolve: the upload is blocked on registry credentials, which is an account action rather than a code change. The CLI name (`aisoc`) and command surface stay identical once it ships.
+
+## Installation
+
+```bash
+# Today (from this monorepo):
+git clone https://github.com/beenuar/AiSOC.git
+cd AiSOC && pip install -e packages/aisoc-cli
+
+# Not yet on PyPI — the upload is blocked on registry credentials,
+# which is an account action rather than a code change. Until then, install
+# from source with the command above.
+#   pipx install aisoc-cli     # recommended (isolated venv)
+#   pip install aisoc-cli
+```
+
+## Commands
+
+### Plugin Scaffold
+```bash
+aisoc plugin scaffold my-enricher
+aisoc plugin scaffold my-connector --type connector
+```
+
+### Plugin Validate
+```bash
+aisoc plugin validate ./my-enricher
+aisoc plugin validate ./my-enricher/plugin.yaml
+```
+
+### Plugin Publish
+```bash
+export AISOC_API_URL=https://api.example.com
+export AISOC_API_KEY=sk-...
+aisoc plugin publish ./my-enricher
+```
+
+### Detection Validate
+```bash
+aisoc detection validate ./detections/brute-force.yaml
+```
+
+### Key Generation
+```bash
+aisoc keygen              # generates ~/.aisoc/signing.key + signing.pub
+```
+
+## Environment Variables
+
+| Variable | Description |
+|---|---|
+| `AISOC_API_URL` | AiSOC API base URL (default: `http://localhost:8000`) |
+| `AISOC_API_KEY` | API key for authentication |
+| `AISOC_SIGNING_KEY` | Path to Ed25519 private key (default: `~/.aisoc/signing.key`) |

aisoc_cli-0.1.0/pyproject.toml

@@ -0,0 +1,88 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "aisoc-cli"
+version = "0.1.0"
+description = "AiSOC Developer CLI — scaffold, validate, and publish plugins and detections"
+readme = "README.md"
+license = { text = "MIT" }
+authors = [
+  { name = "Beenu Arora", email = "beenu@cyble.com" },
+]
+keywords = ["aisoc", "soc", "security", "cli", "plugin"]
+classifiers = [
+  "Development Status :: 3 - Alpha",
+  "Intended Audience :: Developers",
+  "License :: OSI Approved :: MIT License",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Topic :: Security",
+]
+requires-python = ">=3.11"
+dependencies = [
+  "click>=8.1",
+  "httpx>=0.27",
+  "pyyaml>=6.0",
+  "jsonschema>=4.21",
+  # Ed25519 publisher signing. The verifier is services/api, so this is one
+  # half of a contract and carries the same range as every other install
+  # path — see scripts/check_dependency_pins.py.
+  "cryptography>=46,<51",
+  "rich>=13.7",
+  "structlog>=24.1",
+]
+
+[project.scripts]
+aisoc = "aisoc_cli.main:cli"
+
+[project.optional-dependencies]
+dev = [
+  "pytest>=8.0",
+  "pytest-asyncio>=0.23",
+  "mypy>=2.3.1,<3",
+  "ruff>=0.16.8,<0.17",
+]
+
+[project.urls]
+Homepage = "https://github.com/beenuar/AiSOC"
+Documentation = "https://github.com/beenuar/AiSOC#readme"
+Repository = "https://github.com/beenuar/AiSOC"
+
+[tool.hatch.build.targets.wheel]
+# `packages` already carries everything under src/aisoc_cli, templates
+# included, so they reach the wheel at aisoc_cli/templates/... where
+# `importlib.resources` expects them.
+#
+# There used to be a `force-include` mapping that same directory to that same
+# destination. Hatchling then tried to add each template twice and refused:
+#   ValueError: A second file is being added to the wheel archive at the same
+#   path: aisoc_cli/templates/connector/README.md.tmpl
+# Nothing built this wheel except a tag, so the failure was invisible until
+# the release ran — and it would have blocked the first real publish.
+# `test_templates_reach_the_wheel` in tests/ now asserts the templates are
+# present, so removing the redundant mapping cannot quietly drop them.
+packages = ["src/aisoc_cli"]
+
+[tool.hatch.build.targets.sdist]
+include = [
+  "src/aisoc_cli",
+  "tests",
+  "README.md",
+  "LICENSE",
+  "pyproject.toml",
+]
+
+[tool.ruff]
+line-length = 100
+target-version = "py311"
+
+[tool.mypy]
+strict = true
+python_version = "3.11"
+
+[tool.pytest.ini_options]
+asyncio_mode = "auto"
+testpaths = ["tests"]

aisoc_cli-0.1.0/src/aisoc_cli/__init__.py

@@ -0,0 +1,3 @@
+"""AiSOC CLI — developer tooling for plugins and detections."""
+
+__version__ = "0.1.0"