alissa-tools-github-revloop 0.27.0__tar.gz → 0.29.0__tar.gz

{alissa_tools_github_revloop-0.27.0/src/main/alissa_tools_github_revloop.egg-info → alissa_tools_github_revloop-0.29.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-revloop
-Version: 0.27.0
+Version: 0.29.0
 Summary: ALISSA-TOOLS-GITHUB-REVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_revloop-0.27.0 → alissa_tools_github_revloop-0.29.0}/src/main/alissa/tools/github/revloop/__main__.py

@@ -3,17 +3,25 @@
 from __future__ import annotations
 
 import argparse
+import dataclasses
 import logging
 import re
 import sys
 from pathlib import Path
 
+from .alissa_client import AlissaClient, AlissaError
 from .config import (
+    BOW_OWNERS_ENV,
+    BOWS_REFRESH_POLLS_ENV,
     HUB_ADD,
     HUB_SKIP,
+    LOOP_EVENTS_ENV,
     ON_MISSING_CREATE,
     ON_MISSING_SKIP,
     ON_MISSING_SPAWN,
+    REPOS_BOWS,
+    REPOS_SOURCE_ENV,
+    REPOS_STATIC,
     TASK_LIST_BOW_ENV,
     Config,
     load_config_file,
@@ -81,6 +89,34 @@ def build_parser() -> argparse.ArgumentParser:
         metavar="OWNER/REPO",
         help="only watch this repo; repeatable. Replaces the config list entirely.",
     )
+    over.add_argument(
+        "--repos-source",
+        dest="repos_source",
+        choices=[REPOS_STATIC, REPOS_BOWS],
+        help="where the allowlist comes from: 'static' (the repos list alone, "
+        "the default) or 'bows' (that list unioned with the repos named by the "
+        "operator's active `autodev: <owner>/<repo>` bodies of work, "
+        "re-derived every --bows-refresh-polls passes). Under bows an EMPTY "
+        f"allowlist watches nothing. Overridden by ${REPOS_SOURCE_ENV}",
+    )
+    over.add_argument(
+        "--bows-refresh-polls",
+        dest="bows_refresh_polls",
+        type=int,
+        metavar="N",
+        help="bows mode: re-derive the allowlist every N poll passes (>= 1). "
+        f"Overridden by ${BOWS_REFRESH_POLLS_ENV}",
+    )
+    over.add_argument(
+        "--bow-owner",
+        dest="bow_owners",
+        action="append",
+        metavar="ACTOR_ID",
+        help="bows mode: an Alissa actor id whose bodies of work may enroll a "
+        "repo; repeatable, and one value may carry a `|`/`,`-separated list. "
+        "Replaces the config list entirely. Unset = this token's own actor, "
+        f"resolved at boot via GET /v1/ping. Overridden by ${BOW_OWNERS_ENV}",
+    )
     over.add_argument(
         "--author",
         dest="authors",
@@ -200,6 +236,31 @@ def build_parser() -> argparse.ArgumentParser:
         f"invisible to this daemon. Overridden by ${TASK_LIST_BOW_ENV}",
     )
 
+    events = over.add_mutually_exclusive_group()
+    events.add_argument(
+        "--loop-events",
+        dest="loop_events_enabled",
+        action="store_true",
+        default=None,
+        help="push loop telemetry (rounds spawned, verdicts, cap-outs, "
+        "stability holds, stalls, checks holds) to Studio's POST "
+        "/v1/loop-events once per poll pass — best-effort, never fatal. "
+        f"Overridden by ${LOOP_EVENTS_ENV}",
+    )
+    events.add_argument(
+        "--no-loop-events",
+        dest="loop_events_enabled",
+        action="store_false",
+        help="do not push loop telemetry even if the config enables it",
+    )
+    over.add_argument(
+        "--alissa-endpoint",
+        dest="alissa_endpoint",
+        metavar="URL",
+        help="the Alissa API base the loop-events client posts to "
+        "(default: https://api.alissa.app)",
+    )
+
     dry = over.add_mutually_exclusive_group()
     dry.add_argument(
         "--dry-run",
@@ -222,6 +283,9 @@ def overrides_from(args: argparse.Namespace) -> dict:
     through. `repos` becomes a tuple so it matches the config-file form."""
     return {
         "repos": tuple(args.repos) if args.repos else None,
+        "repos_source": args.repos_source,
+        "bows_refresh_polls": args.bows_refresh_polls,
+        "bow_owners": tuple(args.bow_owners) if args.bow_owners else None,
         "authors": tuple(args.authors) if args.authors else None,
         "operators": tuple(args.operators) if args.operators else None,
         "poll_interval": args.poll_interval,
@@ -242,6 +306,8 @@ def overrides_from(args: argparse.Namespace) -> dict:
         "review_task_miss_ttl_polls": args.review_task_miss_ttl_polls,
         "task_list_self_scope": args.task_list_self_scope,
         "task_list_bow_id": args.task_list_bow_id,
+        "loop_events_enabled": args.loop_events_enabled,
+        "alissa_endpoint": args.alissa_endpoint,
         "dry_run": args.dry_run,
     }
 
@@ -256,6 +322,54 @@ def resolve_config(args: argparse.Namespace) -> Config:
     return Config.build(workspace_root, file_data, overrides_from(args))
 
 
+def resolve_feed_authority(
+    config: Config, client: "AlissaClient | None" = None
+) -> Config:
+    """Decide WHOSE bodies of work may enroll a repo, and say so out loud.
+
+    Two answers, one of them free:
+
+    * `bow_owners` **set** — the operator named the authority explicitly. That
+      is the multi-actor case: the feed containers belong to an actor this
+      token is not. Nothing is resolved, nothing is called.
+    * `bow_owners` **unset** — the authority is **self**. The token already
+      carries an identity, so `GET /v1/ping` answers the question the operator
+      would otherwise have hand-copied out of the API.
+
+    The whoami call is **fatal on failure**, deliberately. Carrying on with an
+    empty authority is technically safe (nothing would be trusted, so nothing
+    would enroll) but it is safe *silently*: the operator would see a daemon
+    that runs and watches only the static list, which is exactly what a
+    correctly configured daemon with no feeds yet looks like. Dying names the
+    reason while someone is watching. The property being protected is not
+    "self is trusted" but "only a KNOWN actor is trusted" — an unanswered
+    whoami leaves that unknown, and no default can fill it in. Never falling
+    back to trusting everything is the other half of the same rule.
+
+    Under `static` this is a no-op: that mode never reads a Body of Work, so
+    it never needs an identity, and a daemon that only watches its static
+    list must not fail to boot because an endpoint it does not use was
+    unreachable.
+    """
+    if config.repos_source != REPOS_BOWS:
+        return config
+
+    if config.bow_owners:
+        log.info("bow feed authority: explicit (%s)", ", ".join(config.bow_owners))
+        return config
+
+    identity = (client or AlissaClient(base=config.alissa_endpoint)).ping()
+    log.info("bow feed authority: self (%s)", identity.actor_id)
+    if identity.display_name:
+        # Logged as context, never compared: a display name is renameable,
+        # which is why `bow_owners` refuses to hold one.
+        log.debug("resolved from this token's identity: %r", identity.display_name)
+    # The id came from the API, so it is the authority on its own shape and is
+    # NOT put back through the config's actor-id check -- that check exists to
+    # catch an operator typing a username, not to second-guess the server.
+    return dataclasses.replace(config, bow_owners=(identity.actor_id,))
+
+
 def main(argv: list[str] | None = None) -> int:
     args = build_parser().parse_args(argv)
 
@@ -278,6 +392,8 @@ def main(argv: list[str] | None = None) -> int:
     try:
         config = resolve_config(args)
         log.info("workspace: %s", config.workspace_root)
+        log.info("repos_source: %s", config.repos_source)
+        config = resolve_feed_authority(config)
 
         watcher = ReviewWatcher(config)
         for warning in watcher.preflight():
@@ -321,6 +437,18 @@ def main(argv: list[str] | None = None) -> int:
     except (FileNotFoundError, ValueError) as exc:
         print(f"config error: {exc}", file=sys.stderr)
         return 2
+    except AlissaError as exc:
+        # Only reachable from resolve_feed_authority: an unanswered whoami
+        # leaves the feed authority unknown, and starting with it unknown is
+        # the one failure this mode must not have (the poll loop's own
+        # feed reads never raise -- see bows.BowRepoSource.refresh).
+        print(
+            f"alissa error: {exc} — repos_source='bows' could not resolve the "
+            f"feed authority (GET /v1/ping). Check ALISSA_API_TOKEN and "
+            f"alissa_endpoint, or set bow_owners explicitly",
+            file=sys.stderr,
+        )
+        return 2
     except CommandError as exc:
         print(f"error: {exc}", file=sys.stderr)
         return 1

alissa_tools_github_revloop-0.29.0/src/main/alissa/tools/github/revloop/alissa_client.py

@@ -0,0 +1,314 @@
+"""Alissa REST access — loop telemetry's one write (issue #112) and the two
+reads `repos_source: bows` needs (issue #119).
+
+This is the SECOND Alissa adapter in the package, and the split is deliberate.
+`alissa.py` shells out to the `alissa` CLI, which is the daemon's established
+Alissa idiom for everything it does today (the review-task search, the tmux
+queue, the CR6 envelope reads). Loop telemetry needs a thing that idiom cannot
+supply: the CLI has no loop-events command, and it cannot attach the actor
+identity `POST /v1/loop-events` keys its rows by — the API stores events under
+the token's principal user, which is exactly the credential this daemon's
+`ALISSA_API_TOKEN` already carries.
+
+So the one write goes over the REST API directly, in the shape devloop's
+`alissa_client.py` adopted (PR #91 there): stdlib `urllib` only — the
+distribution ships no third-party runtime dependency and this must not be the
+change that adds one — a bearer token from the environment, bounded timeouts,
+and errors classified into a small taxonomy instead of leaking raw urllib
+exceptions. The CLI adapter stays untouched for everything else.
+
+The caller here is a BEST-EFFORT emitter (`loop_events`): its answer to every
+bucket is the same — warn once and let the pass complete — so the taxonomy
+exists for the log line, which should say "your token is wrong" (permanent,
+operator-fixable) differently from "the API blinked".
+
+The two READS (issue #119) ride the same transport and the same taxonomy, and
+they are the shape devloop's client already gives them, so the two daemons
+agree about the wire:
+
+``GET /v1/ping``
+    ``{"pong", "timestamp", "userId", "actorId", "displayName"}`` — the
+    identity this token acts as. `actorId` is the same opaque id that appears
+    as `ownerActorId` on a Body of Work, which is what makes "trust my own
+    feeds" resolvable at boot without an operator hand-copying an id.
+
+``GET /v1/bodies-of-work?includeShared=true``
+    ``{"bodiesOfWork": [{"_id", "title", "status", "ownerActorId", ...}]}``.
+    `includeShared=true` is load-bearing: the endpoint defaults to OWNED-only,
+    and a feed container is the operator's with the daemon merely a
+    collaborator. It also widens the listing to whatever anyone shared, which
+    is why `bows.py` gates on the owner and never on the title alone.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+import urllib.error
+import urllib.request
+from dataclasses import dataclass
+
+log = logging.getLogger(__name__)
+
+DEFAULT_ENDPOINT = "https://api.alissa.app"
+
+# The env var the `alissa` CLI itself reads, so a daemon whose CLI is already
+# authenticated needs no second secret.
+ENV_TOKEN = "ALISSA_API_TOKEN"
+
+# The ingest cap: POST /v1/loop-events takes 1-200 events per call. The
+# EMITTER splits batches at this bound; the client refuses an oversized one
+# rather than silently posting a request the API will 400.
+MAX_EVENTS_PER_POST = 200
+
+
+class _RefuseRedirects(urllib.request.HTTPRedirectHandler):
+    """Refuse every redirect instead of following it (PR #113 round 1).
+
+    The default handler copies the request's headers — `Authorization`
+    included — onto the redirected request, ACROSS HOSTS, so a 30x from
+    whatever `alissa_endpoint` names would hand the bearer token to the
+    redirect target (and 301/302/303 would downgrade the POST to a GET that
+    ingests nothing while reading as success). A redirected ingest cannot
+    succeed anyway, so refusal beats strip-and-follow: returning None makes
+    urllib raise the 30x as an HTTPError, which the taxonomy reports like any
+    other unexpected status.
+    """
+
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        return None
+
+
+# One opener for the module: default handlers with only the redirect
+# behaviour replaced, built once because handler construction is not free
+# and every client shares the same policy.
+_opener = urllib.request.build_opener(_RefuseRedirects())
+
+
+class AlissaError(Exception):
+    """Base of the taxonomy. `status` is 0 for a transport failure (there was
+    no HTTP response to carry one)."""
+
+    def __init__(self, status: int, detail: object, code: "str | None" = None):
+        super().__init__(f"HTTP {status}: {detail}" if status else str(detail))
+        self.status = status
+        self.detail = detail
+        self.code = code
+
+
+class AlissaAuthError(AlissaError):
+    """401/403, or no token at all. Permanent and operator-fixable — retrying
+    it every pass only writes the same warning again."""
+
+
+class AlissaTransient(AlissaError):
+    """408/429/5xx and every transport failure (DNS, refused, timeout). The
+    'the API blinked' bucket — re-emission next pass is the retry, and the
+    deterministic dedupe keys are what make it harmless."""
+
+
+@dataclass(frozen=True)
+class Identity:
+    """Who this token acts as (`GET /v1/ping`).
+
+    `actor_id` is the field the feed-authority gate compares against a Body
+    of Work's `ownerActorId`. The other two are context for the log line —
+    a display name is renameable, so nothing is ever compared against it."""
+
+    actor_id: str
+    user_id: str = ""
+    display_name: str = ""
+
+
+@dataclass(frozen=True)
+class BodyOfWork:
+    """A Body of Work as the LIST endpoint reports it — only the four fields
+    the feed reads.
+
+    `owner_id` is the container's provenance and the only field here that is
+    not operator-authored text: the listing includes containers merely SHARED
+    with this actor, so the title alone cannot say whether a feed is one the
+    operator set up. Empty when the payload omits it, which the authority gate
+    treats as untrusted rather than unknown."""
+
+    id: str
+    title: str
+    status: str = ""
+    owner_id: str = ""
+
+
+class AlissaClient:
+    """One write and two reads, with the transport hidden behind the taxonomy.
+
+    Reads `ALISSA_API_TOKEN` from the environment; `base` defaults to the
+    public API. Both are constructor arguments so a test never needs the
+    network and an operator can point a daemon at another deployment
+    (`alissa_endpoint` in the config)."""
+
+    def __init__(
+        self,
+        token: "str | None" = None,
+        base: "str | None" = None,
+        *,
+        timeout: int = 30,
+    ):
+        self.base = (base or DEFAULT_ENDPOINT).rstrip("/")
+        self._token = token if token is not None else os.environ.get(ENV_TOKEN)
+        self._timeout = timeout
+
+    def _request(self, path: str, payload: "dict | None" = None) -> object:
+        """One call: a POST when `payload` is given, a GET otherwise. Every
+        failure leaves as a taxonomy exception — the caller never sees a raw
+        urllib error or an HTTP status. Both verbs share the redirect-refusing
+        opener: a 30x on a GET would carry the bearer token across hosts just
+        as it would on the POST."""
+        if not self._token:
+            # No token at all is an auth condition, not a transport one: the
+            # operator must set the env var. Fail the way a 401 would, so the
+            # emitter's warning reads as permanent rather than transient.
+            raise AlissaAuthError(0, f"{ENV_TOKEN} is not set")
+
+        headers = {
+            "Accept": "application/json",
+            "Authorization": f"Bearer {self._token}",
+        }
+        data = None
+        if payload is not None:
+            headers["Content-Type"] = "application/json"
+            data = json.dumps(payload).encode("utf-8")
+        req = urllib.request.Request(
+            f"{self.base}{path}",
+            method="POST" if payload is not None else "GET",
+            data=data,
+            headers=headers,
+        )
+        try:
+            with _opener.open(req, timeout=self._timeout) as resp:
+                raw = resp.read().decode("utf-8")
+        except urllib.error.HTTPError as exc:
+            raise self._classify(exc) from None
+        except urllib.error.URLError as exc:
+            raise AlissaTransient(0, str(exc.reason)) from None
+        except (TimeoutError, OSError) as exc:  # pragma: no cover - defence
+            # A socket timeout on the READ does not arrive as URLError.
+            raise AlissaTransient(0, str(exc)) from None
+        try:
+            return json.loads(raw) if raw.strip() else {}
+        except json.JSONDecodeError as exc:
+            # A 2xx that is not JSON is a contract violation, not a retry
+            # signal -- but it must not escape as a bare ValueError either,
+            # because the emitter catches AlissaError and nothing else.
+            raise AlissaError(200, f"response was not JSON ({exc})") from None
+
+    @staticmethod
+    def _classify(exc: "urllib.error.HTTPError") -> AlissaError:
+        """Map an HTTP error onto the taxonomy. The API sends JSON error
+        bodies (`{"error": CODE, "message": ...}`); the code rides along when
+        present, but classification keys on the STATUS — codes are advisory,
+        statuses are the contract."""
+        detail: object = exc.read().decode("utf-8", "replace")
+        code: "str | None" = None
+        try:
+            parsed = json.loads(detail)  # type: ignore[arg-type]
+        except (json.JSONDecodeError, TypeError):
+            parsed = None
+        if isinstance(parsed, dict):
+            detail = parsed
+            raw_code = parsed.get("error")
+            code = raw_code if isinstance(raw_code, str) else None
+
+        status = exc.code
+        if status in (401, 403):
+            return AlissaAuthError(status, detail, code)
+        if status in (408, 429) or 500 <= status <= 599:
+            return AlissaTransient(status, detail, code)
+        return AlissaError(status, detail, code)
+
+    def post_loop_events(self, events: "list[dict]") -> dict:
+        """Ingest one batch of loop events (`POST /v1/loop-events`).
+
+        The API is idempotent on `(user, dedupeKey)`, so re-posting a batch —
+        which is exactly what the emitter does after a failed pass — lands as
+        silent duplicates, never as errors or overwrites. Returns the API's
+        `{"accepted": N, "duplicates": M}` payload (empty dict when the body
+        was empty), for the caller's debug line.
+
+        An oversized batch is refused HERE, loudly: the API fails the whole
+        call at >200 events, and the emitter owns the splitting, so reaching
+        this guard is a code defect rather than an operational condition.
+        """
+        if len(events) > MAX_EVENTS_PER_POST:
+            raise ValueError(
+                f"post_loop_events takes at most {MAX_EVENTS_PER_POST} events "
+                f"per call, got {len(events)} — the emitter must split"
+            )
+        payload = self._request("/v1/loop-events", {"events": events})
+        return payload if isinstance(payload, dict) else {}
+
+    def ping(self) -> Identity:
+        """The identity this token acts as (`GET /v1/ping`).
+
+        On the BOOT path of `repos_source: bows`, and fatal there — see
+        `__main__.resolve_feed_authority` for why an unanswered whoami must
+        stop the daemon rather than soften into an empty authority."""
+        payload = self._request("/v1/ping")
+        row = payload if isinstance(payload, dict) else {}
+        actor_id = row.get("actorId")
+        if not isinstance(actor_id, str) or not actor_id.strip():
+            # A 2xx with no actorId is a contract violation, not a missing
+            # resource: name it as such rather than letting an empty authority
+            # travel onwards looking like a configuration choice.
+            raise AlissaError(
+                200,
+                f"GET /v1/ping returned no actorId (got {payload!r}) — the "
+                f"token's acting identity could not be determined",
+            )
+        return Identity(
+            actor_id=actor_id.strip(),
+            user_id=str(row.get("userId") or ""),
+            display_name=str(row.get("displayName") or ""),
+        )
+
+    def list_bodies_of_work(self) -> "list[BodyOfWork]":
+        """Every Body of Work this actor owns OR collaborates on — ONE call.
+
+        There is no server-side title or status filter, so the caller narrows.
+        Rows without an `_id` are dropped: a container that cannot be
+        addressed cannot be reported on either.
+
+        A payload with no `bodiesOfWork` LIST is a contract violation, not an
+        empty listing, and is raised as such -- `ping`'s missing-`actorId`
+        reasoning applied to the other read. Degrading it to `[]` would report
+        SUCCESS to the refresh, which would then derive nothing and drop every
+        feed-enrolled repo on a routine INFO line: a response-shape change or
+        an `alissa_endpoint` answering 200 with something else would silently
+        un-enroll everything, which is precisely what the never-shrink rule
+        promises cannot happen. Raising routes it to the refresh's failure
+        path instead, which keeps the last good set. `{"bodiesOfWork": []}`
+        is untouched -- present-and-empty is a legitimate empty listing, and
+        the documented way an operator un-enrolls the last repo."""
+        payload = self._request("/v1/bodies-of-work?includeShared=true")
+        rows = payload.get("bodiesOfWork") if isinstance(payload, dict) else None
+        if not isinstance(rows, list):
+            raise AlissaError(
+                200,
+                f"GET /v1/bodies-of-work returned no bodiesOfWork list "
+                f"(got {payload!r})",
+            )
+        out: "list[BodyOfWork]" = []
+        for row in rows:
+            if not isinstance(row, dict):
+                continue
+            bow_id = row.get("_id")
+            if not isinstance(bow_id, str) or not bow_id:
+                continue
+            out.append(
+                BodyOfWork(
+                    id=bow_id,
+                    title=str(row.get("title") or ""),
+                    status=str(row.get("status") or ""),
+                    owner_id=str(row.get("ownerActorId") or ""),
+                )
+            )
+        return out