alissa-tools-github-revloop 0.28.0__tar.gz → 0.29.0__tar.gz

{alissa_tools_github_revloop-0.28.0/src/main/alissa_tools_github_revloop.egg-info → alissa_tools_github_revloop-0.29.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-revloop
-Version: 0.28.0
+Version: 0.29.0
 Summary: ALISSA-TOOLS-GITHUB-REVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_revloop-0.28.0 → alissa_tools_github_revloop-0.29.0}/src/main/alissa/tools/github/revloop/__main__.py

@@ -3,18 +3,25 @@
 from __future__ import annotations
 
 import argparse
+import dataclasses
 import logging
 import re
 import sys
 from pathlib import Path
 
+from .alissa_client import AlissaClient, AlissaError
 from .config import (
+    BOW_OWNERS_ENV,
+    BOWS_REFRESH_POLLS_ENV,
     HUB_ADD,
     HUB_SKIP,
     LOOP_EVENTS_ENV,
     ON_MISSING_CREATE,
     ON_MISSING_SKIP,
     ON_MISSING_SPAWN,
+    REPOS_BOWS,
+    REPOS_SOURCE_ENV,
+    REPOS_STATIC,
     TASK_LIST_BOW_ENV,
     Config,
     load_config_file,
@@ -82,6 +89,34 @@ def build_parser() -> argparse.ArgumentParser:
         metavar="OWNER/REPO",
         help="only watch this repo; repeatable. Replaces the config list entirely.",
     )
+    over.add_argument(
+        "--repos-source",
+        dest="repos_source",
+        choices=[REPOS_STATIC, REPOS_BOWS],
+        help="where the allowlist comes from: 'static' (the repos list alone, "
+        "the default) or 'bows' (that list unioned with the repos named by the "
+        "operator's active `autodev: <owner>/<repo>` bodies of work, "
+        "re-derived every --bows-refresh-polls passes). Under bows an EMPTY "
+        f"allowlist watches nothing. Overridden by ${REPOS_SOURCE_ENV}",
+    )
+    over.add_argument(
+        "--bows-refresh-polls",
+        dest="bows_refresh_polls",
+        type=int,
+        metavar="N",
+        help="bows mode: re-derive the allowlist every N poll passes (>= 1). "
+        f"Overridden by ${BOWS_REFRESH_POLLS_ENV}",
+    )
+    over.add_argument(
+        "--bow-owner",
+        dest="bow_owners",
+        action="append",
+        metavar="ACTOR_ID",
+        help="bows mode: an Alissa actor id whose bodies of work may enroll a "
+        "repo; repeatable, and one value may carry a `|`/`,`-separated list. "
+        "Replaces the config list entirely. Unset = this token's own actor, "
+        f"resolved at boot via GET /v1/ping. Overridden by ${BOW_OWNERS_ENV}",
+    )
     over.add_argument(
         "--author",
         dest="authors",
@@ -248,6 +283,9 @@ def overrides_from(args: argparse.Namespace) -> dict:
     through. `repos` becomes a tuple so it matches the config-file form."""
     return {
         "repos": tuple(args.repos) if args.repos else None,
+        "repos_source": args.repos_source,
+        "bows_refresh_polls": args.bows_refresh_polls,
+        "bow_owners": tuple(args.bow_owners) if args.bow_owners else None,
         "authors": tuple(args.authors) if args.authors else None,
         "operators": tuple(args.operators) if args.operators else None,
         "poll_interval": args.poll_interval,
@@ -284,6 +322,54 @@ def resolve_config(args: argparse.Namespace) -> Config:
     return Config.build(workspace_root, file_data, overrides_from(args))
 
 
+def resolve_feed_authority(
+    config: Config, client: "AlissaClient | None" = None
+) -> Config:
+    """Decide WHOSE bodies of work may enroll a repo, and say so out loud.
+
+    Two answers, one of them free:
+
+    * `bow_owners` **set** — the operator named the authority explicitly. That
+      is the multi-actor case: the feed containers belong to an actor this
+      token is not. Nothing is resolved, nothing is called.
+    * `bow_owners` **unset** — the authority is **self**. The token already
+      carries an identity, so `GET /v1/ping` answers the question the operator
+      would otherwise have hand-copied out of the API.
+
+    The whoami call is **fatal on failure**, deliberately. Carrying on with an
+    empty authority is technically safe (nothing would be trusted, so nothing
+    would enroll) but it is safe *silently*: the operator would see a daemon
+    that runs and watches only the static list, which is exactly what a
+    correctly configured daemon with no feeds yet looks like. Dying names the
+    reason while someone is watching. The property being protected is not
+    "self is trusted" but "only a KNOWN actor is trusted" — an unanswered
+    whoami leaves that unknown, and no default can fill it in. Never falling
+    back to trusting everything is the other half of the same rule.
+
+    Under `static` this is a no-op: that mode never reads a Body of Work, so
+    it never needs an identity, and a daemon that only watches its static
+    list must not fail to boot because an endpoint it does not use was
+    unreachable.
+    """
+    if config.repos_source != REPOS_BOWS:
+        return config
+
+    if config.bow_owners:
+        log.info("bow feed authority: explicit (%s)", ", ".join(config.bow_owners))
+        return config
+
+    identity = (client or AlissaClient(base=config.alissa_endpoint)).ping()
+    log.info("bow feed authority: self (%s)", identity.actor_id)
+    if identity.display_name:
+        # Logged as context, never compared: a display name is renameable,
+        # which is why `bow_owners` refuses to hold one.
+        log.debug("resolved from this token's identity: %r", identity.display_name)
+    # The id came from the API, so it is the authority on its own shape and is
+    # NOT put back through the config's actor-id check -- that check exists to
+    # catch an operator typing a username, not to second-guess the server.
+    return dataclasses.replace(config, bow_owners=(identity.actor_id,))
+
+
 def main(argv: list[str] | None = None) -> int:
     args = build_parser().parse_args(argv)
 
@@ -306,6 +392,8 @@ def main(argv: list[str] | None = None) -> int:
     try:
         config = resolve_config(args)
         log.info("workspace: %s", config.workspace_root)
+        log.info("repos_source: %s", config.repos_source)
+        config = resolve_feed_authority(config)
 
         watcher = ReviewWatcher(config)
         for warning in watcher.preflight():
@@ -349,6 +437,18 @@ def main(argv: list[str] | None = None) -> int:
     except (FileNotFoundError, ValueError) as exc:
         print(f"config error: {exc}", file=sys.stderr)
         return 2
+    except AlissaError as exc:
+        # Only reachable from resolve_feed_authority: an unanswered whoami
+        # leaves the feed authority unknown, and starting with it unknown is
+        # the one failure this mode must not have (the poll loop's own
+        # feed reads never raise -- see bows.BowRepoSource.refresh).
+        print(
+            f"alissa error: {exc} — repos_source='bows' could not resolve the "
+            f"feed authority (GET /v1/ping). Check ALISSA_API_TOKEN and "
+            f"alissa_endpoint, or set bow_owners explicitly",
+            file=sys.stderr,
+        )
+        return 2
     except CommandError as exc:
         print(f"error: {exc}", file=sys.stderr)
         return 1

{alissa_tools_github_revloop-0.28.0 → alissa_tools_github_revloop-0.29.0}/src/main/alissa/tools/github/revloop/alissa_client.py

@@ -1,4 +1,5 @@
-"""Alissa REST access — the one write loop telemetry needs (issue #112).
+"""Alissa REST access — loop telemetry's one write (issue #112) and the two
+reads `repos_source: bows` needs (issue #119).
 
 This is the SECOND Alissa adapter in the package, and the split is deliberate.
 `alissa.py` shells out to the `alissa` CLI, which is the daemon's established
@@ -20,6 +21,23 @@ The caller here is a BEST-EFFORT emitter (`loop_events`): its answer to every
 bucket is the same — warn once and let the pass complete — so the taxonomy
 exists for the log line, which should say "your token is wrong" (permanent,
 operator-fixable) differently from "the API blinked".
+
+The two READS (issue #119) ride the same transport and the same taxonomy, and
+they are the shape devloop's client already gives them, so the two daemons
+agree about the wire:
+
+``GET /v1/ping``
+    ``{"pong", "timestamp", "userId", "actorId", "displayName"}`` — the
+    identity this token acts as. `actorId` is the same opaque id that appears
+    as `ownerActorId` on a Body of Work, which is what makes "trust my own
+    feeds" resolvable at boot without an operator hand-copying an id.
+
+``GET /v1/bodies-of-work?includeShared=true``
+    ``{"bodiesOfWork": [{"_id", "title", "status", "ownerActorId", ...}]}``.
+    `includeShared=true` is load-bearing: the endpoint defaults to OWNED-only,
+    and a feed container is the operator's with the daemon merely a
+    collaborator. It also widens the listing to whatever anyone shared, which
+    is why `bows.py` gates on the owner and never on the title alone.
 """
 
 from __future__ import annotations
@@ -29,6 +47,7 @@ import logging
 import os
 import urllib.error
 import urllib.request
+from dataclasses import dataclass
 
 log = logging.getLogger(__name__)
 
@@ -89,8 +108,38 @@ class AlissaTransient(AlissaError):
     deterministic dedupe keys are what make it harmless."""
 
 
+@dataclass(frozen=True)
+class Identity:
+    """Who this token acts as (`GET /v1/ping`).
+
+    `actor_id` is the field the feed-authority gate compares against a Body
+    of Work's `ownerActorId`. The other two are context for the log line —
+    a display name is renameable, so nothing is ever compared against it."""
+
+    actor_id: str
+    user_id: str = ""
+    display_name: str = ""
+
+
+@dataclass(frozen=True)
+class BodyOfWork:
+    """A Body of Work as the LIST endpoint reports it — only the four fields
+    the feed reads.
+
+    `owner_id` is the container's provenance and the only field here that is
+    not operator-authored text: the listing includes containers merely SHARED
+    with this actor, so the title alone cannot say whether a feed is one the
+    operator set up. Empty when the payload omits it, which the authority gate
+    treats as untrusted rather than unknown."""
+
+    id: str
+    title: str
+    status: str = ""
+    owner_id: str = ""
+
+
 class AlissaClient:
-    """The one write, with the transport hidden behind the taxonomy.
+    """One write and two reads, with the transport hidden behind the taxonomy.
 
     Reads `ALISSA_API_TOKEN` from the environment; `base` defaults to the
     public API. Both are constructor arguments so a test never needs the
@@ -108,24 +157,31 @@ class AlissaClient:
         self._token = token if token is not None else os.environ.get(ENV_TOKEN)
         self._timeout = timeout
 
-    def _request(self, path: str, payload: dict) -> object:
-        """One POST. Every failure leaves as a taxonomy exception — the caller
-        never sees a raw urllib error or an HTTP status."""
+    def _request(self, path: str, payload: "dict | None" = None) -> object:
+        """One call: a POST when `payload` is given, a GET otherwise. Every
+        failure leaves as a taxonomy exception — the caller never sees a raw
+        urllib error or an HTTP status. Both verbs share the redirect-refusing
+        opener: a 30x on a GET would carry the bearer token across hosts just
+        as it would on the POST."""
         if not self._token:
             # No token at all is an auth condition, not a transport one: the
             # operator must set the env var. Fail the way a 401 would, so the
             # emitter's warning reads as permanent rather than transient.
             raise AlissaAuthError(0, f"{ENV_TOKEN} is not set")
 
+        headers = {
+            "Accept": "application/json",
+            "Authorization": f"Bearer {self._token}",
+        }
+        data = None
+        if payload is not None:
+            headers["Content-Type"] = "application/json"
+            data = json.dumps(payload).encode("utf-8")
         req = urllib.request.Request(
             f"{self.base}{path}",
-            method="POST",
-            data=json.dumps(payload).encode("utf-8"),
-            headers={
-                "Accept": "application/json",
-                "Content-Type": "application/json",
-                "Authorization": f"Bearer {self._token}",
-            },
+            method="POST" if payload is not None else "GET",
+            data=data,
+            headers=headers,
         )
         try:
             with _opener.open(req, timeout=self._timeout) as resp:
@@ -189,3 +245,70 @@ class AlissaClient:
             )
         payload = self._request("/v1/loop-events", {"events": events})
         return payload if isinstance(payload, dict) else {}
+
+    def ping(self) -> Identity:
+        """The identity this token acts as (`GET /v1/ping`).
+
+        On the BOOT path of `repos_source: bows`, and fatal there — see
+        `__main__.resolve_feed_authority` for why an unanswered whoami must
+        stop the daemon rather than soften into an empty authority."""
+        payload = self._request("/v1/ping")
+        row = payload if isinstance(payload, dict) else {}
+        actor_id = row.get("actorId")
+        if not isinstance(actor_id, str) or not actor_id.strip():
+            # A 2xx with no actorId is a contract violation, not a missing
+            # resource: name it as such rather than letting an empty authority
+            # travel onwards looking like a configuration choice.
+            raise AlissaError(
+                200,
+                f"GET /v1/ping returned no actorId (got {payload!r}) — the "
+                f"token's acting identity could not be determined",
+            )
+        return Identity(
+            actor_id=actor_id.strip(),
+            user_id=str(row.get("userId") or ""),
+            display_name=str(row.get("displayName") or ""),
+        )
+
+    def list_bodies_of_work(self) -> "list[BodyOfWork]":
+        """Every Body of Work this actor owns OR collaborates on — ONE call.
+
+        There is no server-side title or status filter, so the caller narrows.
+        Rows without an `_id` are dropped: a container that cannot be
+        addressed cannot be reported on either.
+
+        A payload with no `bodiesOfWork` LIST is a contract violation, not an
+        empty listing, and is raised as such -- `ping`'s missing-`actorId`
+        reasoning applied to the other read. Degrading it to `[]` would report
+        SUCCESS to the refresh, which would then derive nothing and drop every
+        feed-enrolled repo on a routine INFO line: a response-shape change or
+        an `alissa_endpoint` answering 200 with something else would silently
+        un-enroll everything, which is precisely what the never-shrink rule
+        promises cannot happen. Raising routes it to the refresh's failure
+        path instead, which keeps the last good set. `{"bodiesOfWork": []}`
+        is untouched -- present-and-empty is a legitimate empty listing, and
+        the documented way an operator un-enrolls the last repo."""
+        payload = self._request("/v1/bodies-of-work?includeShared=true")
+        rows = payload.get("bodiesOfWork") if isinstance(payload, dict) else None
+        if not isinstance(rows, list):
+            raise AlissaError(
+                200,
+                f"GET /v1/bodies-of-work returned no bodiesOfWork list "
+                f"(got {payload!r})",
+            )
+        out: "list[BodyOfWork]" = []
+        for row in rows:
+            if not isinstance(row, dict):
+                continue
+            bow_id = row.get("_id")
+            if not isinstance(bow_id, str) or not bow_id:
+                continue
+            out.append(
+                BodyOfWork(
+                    id=bow_id,
+                    title=str(row.get("title") or ""),
+                    status=str(row.get("status") or ""),
+                    owner_id=str(row.get("ownerActorId") or ""),
+                )
+            )
+        return out