alissa-tools-github-devloop 0.8.36__py3-none-any.whl → 0.8.38__py3-none-any.whl

alissa/tools/github/devloop/fleet_vitals.py

@@ -36,18 +36,43 @@ The roster rule the contract cares most about: `sessions` and `sessionList`
 are `null` — not `{live: 0, managed: 0}` — when the listing could not be
 read. A machine whose tmux blinked is not an idle machine, and the Factory
 must be able to tell the two apart.
+
+Seat parking (issue #153, studio.alissa.app seat-parking design §2.2/§2.4)
+adds the `idle` block — the seat's own idle verdict (`parking.idle_block`),
+with `drainedAt` while a drain holds — so Studio can re-check a park against
+the seat's OWN snapshot. The console's drain pushes one snapshot before it
+answers (`FleetVitalsPusher.push_now`). Until Studio's schema carries the
+block (the design's lane L3), a strict 400 naming `idle` makes the pusher
+resend without it and leave it out for IDLE_REPROBE_S: the vitals the Factory
+already renders never go dark over a field nobody reads yet.
+
+The managed fleet's smoke (issue #155, studio.alissa.app provisioner design
+§2.7, lane L9) adds the `config` block -- what this seat DERIVED, in its own
+words: the feed owner actor id, the effective repository allowlist, the
+reviewer login(s) it requests and its own GitHub login. SM2-SM4 compare it to
+what Studio provisioned. Four fields, every one of them an identity or a
+name, never a credential: the block is built from typed config fields, not
+from the environment, and any value that carries a secret the process holds
+(`SECRET_ENV`) is blanked before it can leave. The daemon's own pass sends
+it; the console's out-of-pass push leaves it out (that process never
+resolves the feed authority nor refreshes the allowlist, so its answer would
+be a different one). A Studio whose strict schema predates the block gets
+the `idle` treatment: resent without it, offered again after BLOCK_REPROBE_S.
 """
 
 from __future__ import annotations
 
 import json
 import logging
+import os
+import re
 import time
 from datetime import datetime, timezone
 from typing import Callable, Mapping, Sequence
 
+from . import parking
 from .alissa_client import AlissaAuthError, AlissaClient, AlissaError
-from .config import Config
+from .config import REPOS_BOWS, Config
 from .version import version as running_version
 from .webui import sources as sources_mod
 from .webui import sysinfo
@@ -74,6 +99,31 @@ PUSHED = "pushed"
 SKIPPED = "skipped"
 FAILED = "failed"
 
+# The blocks Studio's schema gained after the base contract, each in its own
+# lane: `idle` (seat parking L3) and `config` (provisioner L5). A strict 400
+# naming one of them is an old Studio, not a bad snapshot.
+OPTIONAL_BLOCKS = ("idle", "config")
+
+# How long a snapshot leaves an optional block out after Studio refused it as
+# an unknown key, before it offers the block again. An hour: one extra POST
+# an hour against an old Studio, and a newly deployed one starts receiving
+# the block within the hour.
+BLOCK_REPROBE_S = 3600.0
+IDLE_REPROBE_S = BLOCK_REPROBE_S
+
+# The `config` block's keys (provisioner design §2.7 / lane L9), in order.
+CONFIG_KEYS = ("feedOwnerActorId", "repos", "reviewersRequested", "ghLogin")
+
+# The credentials a devloop container holds (the provisioner's variable
+# collection, design §2.6, plus gh's own fallback name). No `config` value
+# may carry one; a shorter value than SECRET_MIN is not a credential and is
+# not matched (a passcode of "1" must not blank every login holding a 1).
+SECRET_ENV = (
+    "GH_TOKEN", "GITHUB_TOKEN", "ALISSA_API_TOKEN", "ALISSA_UI_PASSCODE",
+    "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "CLAUDE_CODE_OAUTH_TOKEN",
+)
+SECRET_MIN = 8
+
 
 def _session_grammar() -> "Callable[[str], object]":
     """The daemon's own session-name parser, resolved late.
@@ -189,6 +239,9 @@ def build_snapshot(
     now: "float | int | None" = None,
     memory: "Mapping | None" = None,
     parse_session: "Callable[[str], object] | None" = None,
+    queued: "int | None" = None,
+    drain: "Mapping | None" = None,
+    config: "Mapping | None" = None,
 ) -> "dict":
     """The contract body for one pass, from the console's builders.
 
@@ -199,7 +252,15 @@ def build_snapshot(
     the `sysinfo.memory_usage` reading, taken by the caller so a test can
     hand in a fixture. Pure assembly over the sources: the only IO is what
     `Sources` does (state.db, `tmux list-panes` + `/proc` per live session,
-    the cached rate and PyPI reads)."""
+    the cached rate and PyPI reads).
+
+    `queued` (the undispatched alissa queue items, None when unread) and
+    `drain` (the holding drain row, or None) feed the `idle` block, whose
+    owed / timers come from the latest poll snapshot and whose live /
+    managed come from `roster` -- the same reading as `sessions`.
+
+    `config` is the seat's `config_block`, or None to leave the key out
+    (the console's push, which has no derived answer to give)."""
     parse = parse_session or _session_grammar()
     now_ts = heartbeat_at if now is None else now
 
@@ -246,8 +307,14 @@ def build_snapshot(
             + int(latest.get("revert_candidates") or 0)
         )
 
+    roster_live, roster_managed = parking.roster_counts(roster)
+    idle = parking.idle_block(
+        latest, live=roster_live, managed=roster_managed, queued=queued,
+        drain=drain, now=now_ts,
+    )
+
     drift = sources.drift()
-    return {
+    snapshot = {
         "schemaVersion": SCHEMA_VERSION,
         "seat": SEAT,
         "asOf": iso(now_ts),
@@ -263,7 +330,67 @@ def build_snapshot(
         "queueDepth": queue_depth,
         "kpis": None,
         "inbox": inbox,
+        "idle": idle,
     }
+    if config is not None:
+        snapshot["config"] = dict(config)
+    return snapshot
+
+
+def _carries_secret(value: str, secrets: "Sequence[str]") -> bool:
+    return any(secret in value for secret in secrets)
+
+
+def config_block(
+    config: Config,
+    *,
+    gh_login: "str | None",
+    environ: "Mapping[str, str] | None" = None,
+) -> "dict":
+    """The seat's own word on what it derived (issue #155): four fields,
+    each from the config the daemon is RUNNING on, never from the raw env.
+
+    * `feedOwnerActorId` -- the bodies-of-work authority under
+      `repos_source: bows` (the token's own actor unless `bow_owners` names
+      one). Null in static mode (no feed is read) and when several owners
+      are trusted (there is no single answer to quote).
+    * `repos` -- the effective allowlist, sorted: under bows the derived
+      union the last refresh bound, in static mode the configured list.
+    * `reviewersRequested` -- the login(s) the handoff requests
+      (`ALISSA_DEV_REVIEWERS` and its fallbacks).
+    * `ghLogin` -- the account the gh token belongs to; null when unknown.
+
+    `environ` (default: the process env) supplies the secrets to scan for:
+    a value carrying one is blanked -- a list entry dropped, a scalar
+    nulled -- and named in a WARNING by field only."""
+    env = os.environ if environ is None else environ
+    secrets = [
+        v for k in SECRET_ENV if len(v := (env.get(k) or "").strip()) >= SECRET_MIN
+    ]
+    owners = config.bow_owners if config.repos_source == REPOS_BOWS else ()
+    block: "dict" = {
+        "feedOwnerActorId": owners[0] if len(owners) == 1 else None,
+        "repos": sorted(config.repos, key=str.casefold),
+        "reviewersRequested": list(config.reviewers),
+        "ghLogin": gh_login or None,
+    }
+    for key in CONFIG_KEYS:
+        value = block[key]
+        if isinstance(value, list):
+            kept = [v for v in value if not _carries_secret(v, secrets)]
+            blanked = len(kept) != len(value)
+            block[key] = kept
+        else:
+            blanked = value is not None and _carries_secret(value, secrets)
+            if blanked:
+                block[key] = None
+        if blanked:
+            log.warning(
+                "fleet vitals: the config block's %s carried a credential "
+                "this process holds -- blanked before sending; check the "
+                "variable it is derived from", key,
+            )
+    return block
 
 
 def encoded_size(snapshot: "Mapping") -> int:
@@ -312,6 +439,7 @@ class FleetVitalsPusher:
         sources: "Sources | None" = None,
         memory_reader: "Callable[[], Mapping | None]" = sysinfo.memory_usage,
         clock: "Callable[[], float]" = time.time,
+        config_reader: "Callable[[], Mapping | None] | None" = None,
     ):
         self.config = config
         self.client = client
@@ -320,7 +448,13 @@ class FleetVitalsPusher:
         )
         self._memory = memory_reader
         self._clock = clock
+        # The `config` block's source (the daemon's `_vitals_config`), or
+        # None -- the console's pusher -- to leave the block out.
+        self._config_reader = config_reader
         self._not_activated_warned = False
+        # Per optional block: until when it is left out (Studio refused it
+        # as an unknown key). Absent = offer it.
+        self._refused_until: "dict[str, float]" = {}
         self.last: "dict | None" = None
 
     def push_pass(self, roster: "Sequence[Mapping] | None") -> str:
@@ -328,10 +462,41 @@ class FleetVitalsPusher:
         FAILED (the caller quotes it in the poll summary). A snapshot that
         cannot be BUILT is a failure too — one WARNING, nothing sent."""
         heartbeat = self._clock()
+        return self._push(roster, heartbeat, heartbeat)
+
+    def push_now(self, roster: "Sequence[Mapping] | None") -> str:
+        """The console's out-of-pass push (the drain handshake, issue #153):
+        the same snapshot, its `heartbeatAt` the daemon's LAST completed pass
+        (the console completes none of its own -- stamping now would read as
+        a heartbeat the loop never gave), `asOf` now. PUSHED or FAILED."""
+        snaps = self.sources.snapshots(1)
+        now = self._clock()
+        heartbeat = snaps[0]["ts"] if snaps else now
+        return self._push(roster, heartbeat, now)
+
+    def _config(self) -> "Mapping | None":
+        """The `config` block, or None. A reader that fails costs the block,
+        never the snapshot: the rest of the vitals still go out."""
+        if self._config_reader is None:
+            return None
+        try:
+            return self._config_reader()
+        except Exception as exc:
+            log.warning(
+                "fleet vitals: could not derive the config block (%s) — "
+                "pushing the snapshot without it", exc,
+            )
+            return None
+
+    def _push(
+        self, roster: "Sequence[Mapping] | None", heartbeat: float, now: float,
+    ) -> str:
         try:
             snapshot = fit_to_body_cap(build_snapshot(
                 self.sources, roster=roster, heartbeat_at=heartbeat,
-                memory=self._memory(),
+                now=now, memory=self._memory(),
+                queued=self.sources.queued(), drain=self.sources.drain(),
+                config=self._config(),
             ))
         except Exception as exc:
             log.warning(
@@ -339,9 +504,26 @@ class FleetVitalsPusher:
                 "pushed this pass; the next pass builds a fresh one", exc,
             )
             return FAILED
+        for key, until in self._refused_until.items():
+            if now < until:
+                snapshot.pop(key, None)
         self.last = snapshot
         return self._post(snapshot)
 
+    @staticmethod
+    def _refused_blocks(exc: AlissaError, snapshot: "Mapping") -> "list[str]":
+        """The optional blocks of `snapshot` a 400 names: a Studio whose
+        strict schema predates them (seat parking's lane L3 adds `idle`, the
+        provisioner's lane L5 adds `config`). A word match, so `config`
+        is not read into an unrelated message that merely contains it."""
+        if exc.status != 400:
+            return []
+        detail = str(exc.detail)
+        return [
+            key for key in OPTIONAL_BLOCKS
+            if key in snapshot and re.search(rf"\b{key}\b", detail)
+        ]
+
     def _post(self, snapshot: "dict") -> str:
         try:
             self.client.post_fleet_vitals(snapshot)
@@ -352,6 +534,21 @@ class FleetVitalsPusher:
             self._warn_failed(exc)
             return FAILED
         except AlissaError as exc:
+            refused = self._refused_blocks(exc, snapshot)
+            if refused:
+                until = self._clock() + BLOCK_REPROBE_S
+                for key in refused:
+                    self._refused_until[key] = until
+                log.warning(
+                    "fleet vitals: Studio refused the %s block(s) (status "
+                    "%s: %s) — its schema predates them; resending without "
+                    "them, and leaving them out for %d min",
+                    ", ".join(f"`{k}`" for k in refused), exc.status,
+                    exc.detail, int(BLOCK_REPROBE_S // 60),
+                )
+                trimmed = {k: v for k, v in snapshot.items() if k not in refused}
+                self.last = trimmed
+                return self._post(trimmed)
             self._warn_failed(exc)
             return FAILED
         sessions = snapshot.get("sessions") or {}