alissa-tools-github-devloop 0.8.37__tar.gz → 0.8.38__tar.gz

{alissa_tools_github_devloop-0.8.37/src/main/alissa_tools_github_devloop.egg-info → alissa_tools_github_devloop-0.8.38}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-devloop
-Version: 0.8.37
+Version: 0.8.38
 Summary: ALISSA-TOOLS-GITHUB-DEVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_devloop-0.8.37 → alissa_tools_github_devloop-0.8.38}/src/main/alissa/tools/github/devloop/fleet_vitals.py

@@ -45,19 +45,34 @@ answers (`FleetVitalsPusher.push_now`). Until Studio's schema carries the
 block (the design's lane L3), a strict 400 naming `idle` makes the pusher
 resend without it and leave it out for IDLE_REPROBE_S: the vitals the Factory
 already renders never go dark over a field nobody reads yet.
+
+The managed fleet's smoke (issue #155, studio.alissa.app provisioner design
+§2.7, lane L9) adds the `config` block -- what this seat DERIVED, in its own
+words: the feed owner actor id, the effective repository allowlist, the
+reviewer login(s) it requests and its own GitHub login. SM2-SM4 compare it to
+what Studio provisioned. Four fields, every one of them an identity or a
+name, never a credential: the block is built from typed config fields, not
+from the environment, and any value that carries a secret the process holds
+(`SECRET_ENV`) is blanked before it can leave. The daemon's own pass sends
+it; the console's out-of-pass push leaves it out (that process never
+resolves the feed authority nor refreshes the allowlist, so its answer would
+be a different one). A Studio whose strict schema predates the block gets
+the `idle` treatment: resent without it, offered again after BLOCK_REPROBE_S.
 """
 
 from __future__ import annotations
 
 import json
 import logging
+import os
+import re
 import time
 from datetime import datetime, timezone
 from typing import Callable, Mapping, Sequence
 
 from . import parking
 from .alissa_client import AlissaAuthError, AlissaClient, AlissaError
-from .config import Config
+from .config import REPOS_BOWS, Config
 from .version import version as running_version
 from .webui import sources as sources_mod
 from .webui import sysinfo
@@ -84,11 +99,30 @@ PUSHED = "pushed"
 SKIPPED = "skipped"
 FAILED = "failed"
 
-# How long a snapshot leaves the `idle` block out after Studio refused it as
-# an unknown key (a schema that predates seat parking), before it offers the
-# block again. An hour: one extra POST an hour against an old Studio, and a
-# newly deployed one starts receiving the block within the hour.
-IDLE_REPROBE_S = 3600.0
+# The blocks Studio's schema gained after the base contract, each in its own
+# lane: `idle` (seat parking L3) and `config` (provisioner L5). A strict 400
+# naming one of them is an old Studio, not a bad snapshot.
+OPTIONAL_BLOCKS = ("idle", "config")
+
+# How long a snapshot leaves an optional block out after Studio refused it as
+# an unknown key, before it offers the block again. An hour: one extra POST
+# an hour against an old Studio, and a newly deployed one starts receiving
+# the block within the hour.
+BLOCK_REPROBE_S = 3600.0
+IDLE_REPROBE_S = BLOCK_REPROBE_S
+
+# The `config` block's keys (provisioner design §2.7 / lane L9), in order.
+CONFIG_KEYS = ("feedOwnerActorId", "repos", "reviewersRequested", "ghLogin")
+
+# The credentials a devloop container holds (the provisioner's variable
+# collection, design §2.6, plus gh's own fallback name). No `config` value
+# may carry one; a shorter value than SECRET_MIN is not a credential and is
+# not matched (a passcode of "1" must not blank every login holding a 1).
+SECRET_ENV = (
+    "GH_TOKEN", "GITHUB_TOKEN", "ALISSA_API_TOKEN", "ALISSA_UI_PASSCODE",
+    "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "CLAUDE_CODE_OAUTH_TOKEN",
+)
+SECRET_MIN = 8
 
 
 def _session_grammar() -> "Callable[[str], object]":
@@ -207,6 +241,7 @@ def build_snapshot(
     parse_session: "Callable[[str], object] | None" = None,
     queued: "int | None" = None,
     drain: "Mapping | None" = None,
+    config: "Mapping | None" = None,
 ) -> "dict":
     """The contract body for one pass, from the console's builders.
 
@@ -222,7 +257,10 @@ def build_snapshot(
     `queued` (the undispatched alissa queue items, None when unread) and
     `drain` (the holding drain row, or None) feed the `idle` block, whose
     owed / timers come from the latest poll snapshot and whose live /
-    managed come from `roster` -- the same reading as `sessions`."""
+    managed come from `roster` -- the same reading as `sessions`.
+
+    `config` is the seat's `config_block`, or None to leave the key out
+    (the console's push, which has no derived answer to give)."""
     parse = parse_session or _session_grammar()
     now_ts = heartbeat_at if now is None else now
 
@@ -276,7 +314,7 @@ def build_snapshot(
     )
 
     drift = sources.drift()
-    return {
+    snapshot = {
         "schemaVersion": SCHEMA_VERSION,
         "seat": SEAT,
         "asOf": iso(now_ts),
@@ -294,6 +332,65 @@ def build_snapshot(
         "inbox": inbox,
         "idle": idle,
     }
+    if config is not None:
+        snapshot["config"] = dict(config)
+    return snapshot
+
+
+def _carries_secret(value: str, secrets: "Sequence[str]") -> bool:
+    return any(secret in value for secret in secrets)
+
+
+def config_block(
+    config: Config,
+    *,
+    gh_login: "str | None",
+    environ: "Mapping[str, str] | None" = None,
+) -> "dict":
+    """The seat's own word on what it derived (issue #155): four fields,
+    each from the config the daemon is RUNNING on, never from the raw env.
+
+    * `feedOwnerActorId` -- the bodies-of-work authority under
+      `repos_source: bows` (the token's own actor unless `bow_owners` names
+      one). Null in static mode (no feed is read) and when several owners
+      are trusted (there is no single answer to quote).
+    * `repos` -- the effective allowlist, sorted: under bows the derived
+      union the last refresh bound, in static mode the configured list.
+    * `reviewersRequested` -- the login(s) the handoff requests
+      (`ALISSA_DEV_REVIEWERS` and its fallbacks).
+    * `ghLogin` -- the account the gh token belongs to; null when unknown.
+
+    `environ` (default: the process env) supplies the secrets to scan for:
+    a value carrying one is blanked -- a list entry dropped, a scalar
+    nulled -- and named in a WARNING by field only."""
+    env = os.environ if environ is None else environ
+    secrets = [
+        v for k in SECRET_ENV if len(v := (env.get(k) or "").strip()) >= SECRET_MIN
+    ]
+    owners = config.bow_owners if config.repos_source == REPOS_BOWS else ()
+    block: "dict" = {
+        "feedOwnerActorId": owners[0] if len(owners) == 1 else None,
+        "repos": sorted(config.repos, key=str.casefold),
+        "reviewersRequested": list(config.reviewers),
+        "ghLogin": gh_login or None,
+    }
+    for key in CONFIG_KEYS:
+        value = block[key]
+        if isinstance(value, list):
+            kept = [v for v in value if not _carries_secret(v, secrets)]
+            blanked = len(kept) != len(value)
+            block[key] = kept
+        else:
+            blanked = value is not None and _carries_secret(value, secrets)
+            if blanked:
+                block[key] = None
+        if blanked:
+            log.warning(
+                "fleet vitals: the config block's %s carried a credential "
+                "this process holds -- blanked before sending; check the "
+                "variable it is derived from", key,
+            )
+    return block
 
 
 def encoded_size(snapshot: "Mapping") -> int:
@@ -342,6 +439,7 @@ class FleetVitalsPusher:
         sources: "Sources | None" = None,
         memory_reader: "Callable[[], Mapping | None]" = sysinfo.memory_usage,
         clock: "Callable[[], float]" = time.time,
+        config_reader: "Callable[[], Mapping | None] | None" = None,
     ):
         self.config = config
         self.client = client
@@ -350,10 +448,13 @@ class FleetVitalsPusher:
         )
         self._memory = memory_reader
         self._clock = clock
+        # The `config` block's source (the daemon's `_vitals_config`), or
+        # None -- the console's pusher -- to leave the block out.
+        self._config_reader = config_reader
         self._not_activated_warned = False
-        # Until when the `idle` block is left out (Studio refused it as an
-        # unknown key); 0 = offer it.
-        self._idle_refused_until = 0.0
+        # Per optional block: until when it is left out (Studio refused it
+        # as an unknown key). Absent = offer it.
+        self._refused_until: "dict[str, float]" = {}
         self.last: "dict | None" = None
 
     def push_pass(self, roster: "Sequence[Mapping] | None") -> str:
@@ -373,6 +474,20 @@ class FleetVitalsPusher:
         heartbeat = snaps[0]["ts"] if snaps else now
         return self._push(roster, heartbeat, now)
 
+    def _config(self) -> "Mapping | None":
+        """The `config` block, or None. A reader that fails costs the block,
+        never the snapshot: the rest of the vitals still go out."""
+        if self._config_reader is None:
+            return None
+        try:
+            return self._config_reader()
+        except Exception as exc:
+            log.warning(
+                "fleet vitals: could not derive the config block (%s) — "
+                "pushing the snapshot without it", exc,
+            )
+            return None
+
     def _push(
         self, roster: "Sequence[Mapping] | None", heartbeat: float, now: float,
     ) -> str:
@@ -381,6 +496,7 @@ class FleetVitalsPusher:
                 self.sources, roster=roster, heartbeat_at=heartbeat,
                 now=now, memory=self._memory(),
                 queued=self.sources.queued(), drain=self.sources.drain(),
+                config=self._config(),
             ))
         except Exception as exc:
             log.warning(
@@ -388,16 +504,25 @@ class FleetVitalsPusher:
                 "pushed this pass; the next pass builds a fresh one", exc,
             )
             return FAILED
-        if now < self._idle_refused_until:
-            snapshot.pop("idle", None)
+        for key, until in self._refused_until.items():
+            if now < until:
+                snapshot.pop(key, None)
         self.last = snapshot
         return self._post(snapshot)
 
     @staticmethod
-    def _refuses_idle(exc: AlissaError) -> bool:
-        """A 400 that names the `idle` key: a Studio whose strict schema
-        predates seat parking (the design's lane L3 adds the field)."""
-        return exc.status == 400 and "idle" in str(exc.detail)
+    def _refused_blocks(exc: AlissaError, snapshot: "Mapping") -> "list[str]":
+        """The optional blocks of `snapshot` a 400 names: a Studio whose
+        strict schema predates them (seat parking's lane L3 adds `idle`, the
+        provisioner's lane L5 adds `config`). A word match, so `config`
+        is not read into an unrelated message that merely contains it."""
+        if exc.status != 400:
+            return []
+        detail = str(exc.detail)
+        return [
+            key for key in OPTIONAL_BLOCKS
+            if key in snapshot and re.search(rf"\b{key}\b", detail)
+        ]
 
     def _post(self, snapshot: "dict") -> str:
         try:
@@ -409,16 +534,19 @@ class FleetVitalsPusher:
             self._warn_failed(exc)
             return FAILED
         except AlissaError as exc:
-            if "idle" in snapshot and self._refuses_idle(exc):
-                self._idle_refused_until = self._clock() + IDLE_REPROBE_S
+            refused = self._refused_blocks(exc, snapshot)
+            if refused:
+                until = self._clock() + BLOCK_REPROBE_S
+                for key in refused:
+                    self._refused_until[key] = until
                 log.warning(
-                    "fleet vitals: Studio refused the seat-parking `idle` "
-                    "block (status %s: %s) — its schema predates it; "
-                    "resending without it, and leaving it out for %d min",
-                    exc.status, exc.detail, int(IDLE_REPROBE_S // 60),
+                    "fleet vitals: Studio refused the %s block(s) (status "
+                    "%s: %s) — its schema predates them; resending without "
+                    "them, and leaving them out for %d min",
+                    ", ".join(f"`{k}`" for k in refused), exc.status,
+                    exc.detail, int(BLOCK_REPROBE_S // 60),
                 )
-                trimmed = dict(snapshot)
-                trimmed.pop("idle")
+                trimmed = {k: v for k, v in snapshot.items() if k not in refused}
                 self.last = trimmed
                 return self._post(trimmed)
             self._warn_failed(exc)

{alissa_tools_github_devloop-0.8.37 → alissa_tools_github_devloop-0.8.38}/src/main/alissa/tools/github/devloop/loop.py

@@ -3432,7 +3432,8 @@ class DevWatcher:
         # injectable so a test never opens a socket.
         self.fleet_vitals = fleet_vitals or (
             fleet_vitals_mod.FleetVitalsPusher(
-                config, AlissaClient(base=config.alissa_endpoint)
+                config, AlissaClient(base=config.alissa_endpoint),
+                config_reader=self._vitals_config,
             )
             if config.fleet_vitals_enabled
             else None
@@ -11296,6 +11297,17 @@ class DevWatcher:
             return fleet_vitals_mod.SKIPPED
         return self.fleet_vitals.push_pass(roster.entries)
 
+    def _vitals_config(self) -> dict:
+        """The snapshot's `config` block (issue #155), read off what this
+        watcher RUNS on: `self.config` is re-bound by every allowlist
+        refresh and carries the feed authority `resolve_feed_authority`
+        settled at boot, so the block reports the derived answer, not the
+        configured one. The login is the gh token's (memoised after the
+        first read; a failed read fails the block, never the push)."""
+        return fleet_vitals_mod.config_block(
+            self.config, gh_login=self.github.login
+        )
+
     def _emit_loop_events(
         self,
         issue_results: "list[tuple[str, Decision]]",

alissa_tools_github_devloop-0.8.38/src/main/alissa/tools/github/devloop/version

@@ -0,0 +1 @@
+0.8.38

{alissa_tools_github_devloop-0.8.37 → alissa_tools_github_devloop-0.8.38/src/main/alissa_tools_github_devloop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-devloop
-Version: 0.8.37
+Version: 0.8.38
 Summary: ALISSA-TOOLS-GITHUB-DEVLOOP
 Home-page: https://alissa.app
 Author: Fahera

alissa_tools_github_devloop-0.8.37/src/main/alissa/tools/github/devloop/version

@@ -1 +0,0 @@
-0.8.37