alysis-code 0.13.0__py3-none-any.whl

alysis_code/__init__.py

@@ -0,0 +1,3 @@
+__all__ = ["__version__"]
+
+__version__ = "0.13.0"

alysis_code/__main__.py

@@ -0,0 +1,4 @@
+from .cli import app
+
+if __name__ == "__main__":
+    app()

alysis_code/_build_info.py

@@ -0,0 +1,14 @@
+"""Generated build identity. Do not edit by hand.
+
+Regenerate with ``python3 scripts/generate_build_info.py``. The copy
+committed to the repository is the dev default and deliberately reports an
+unidentifiable build, so that an artifact built without running the
+generator is refused by ``--require-clean-build`` instead of inheriting a
+stale commit hash.
+"""
+
+BUILD_COMMIT = ""
+BUILD_TIMESTAMP = ""
+BUILD_DIRTY = True
+BUILD_SOURCE = "dev-default"
+BUILD_INFO_SCHEMA_VERSION = 1

alysis_code/account_login.py

@@ -0,0 +1,468 @@
+"""Device-flow login for Alysis Code Pro (`alysis login`).
+
+The CLI asks the account backend for a short user code (``ABCD-EFGH``), opens
+the website's /activate page where the signed-in user approves it, and polls
+until approval — then receives the user's long-lived gateway key (``slk_…``),
+stores it locally, and activates the ``alysis`` provider profile pointed at
+the Alysis Code LLM gateway (OpenAI-compatible; credits are metered server-side).
+
+The device_code secret and the gateway key only ever travel in HTTPS request
+and response bodies — never in URLs. The short user_code does appear in the
+opened URL, but it is single-use, expires in minutes, and is worthless without
+the device_code it is paired with.
+
+This flow needs no localhost listener, so it works over SSH and inside WSL the
+same as on a desktop.
+"""
+
+from __future__ import annotations
+
+import json
+import math
+import platform
+import time
+import urllib.error
+import urllib.request
+from collections.abc import Callable
+from dataclasses import dataclass
+from datetime import UTC, datetime
+
+from . import alysis_cloud as cloud
+from .config import (
+    AppConfig,
+    clear_persisted_profile_key,
+    load_persisted_profile_keys,
+    save_config,
+    save_persisted_profile_key,
+)
+from .host_browser import open_url
+from .profile_presets import get_preset, make_profile_from_preset
+from .profiles import ProfileSpec, add_profile, get_profile, set_active_profile
+
+# Matches the server-side device-code expiry (15 min) so we poll until the code
+# itself dies rather than giving up while the user is still signing in.
+_DEFAULT_TIMEOUT_S = 900.0
+_HTTP_TIMEOUT_S = 15.0
+_DEFAULT_POLL_INTERVAL_S = 5.0
+# Kept short: model discovery runs inline while rendering the interactive `/config`
+# model picker, so an offline/slow gateway must not stall the menu for long.
+_MODELS_TIMEOUT_S = 6.0
+
+_FRESH_LOGIN_DEFAULT_MODEL = "deepseek-v4-flash"
+
+
+class AlysisLoginError(Exception):
+    """Raised when the device login handshake fails."""
+
+
+@dataclass(frozen=True)
+class LoginResult:
+    email: str | None
+    profile_name: str
+    base_url: str
+    model: str
+
+
+@dataclass(frozen=True)
+class LoginStatus:
+    logged_in: bool
+    profile_name: str
+    base_url: str
+    active: bool
+    key_preview: str | None
+
+
+@dataclass(frozen=True)
+class TrialStatus:
+    """Account status snapshot (kept name-compatible with the old MiMo trial)."""
+
+    plan: str | None
+    email: str | None
+    trial_ends_at: str | None
+    tokens_total: int | None
+    tokens_used: int | None
+    tokens_remaining: int | None
+
+
+# ---------------------------------------------------------------------------
+# Public API
+# ---------------------------------------------------------------------------
+def login(
+    cfg: AppConfig,
+    *,
+    timeout_s: float = _DEFAULT_TIMEOUT_S,
+    browser_opener: Callable[[str], bool] | None = None,
+    output_write: Callable[[str], None] | None = None,
+) -> LoginResult:
+    """Run the device-flow login and persist the resulting gateway key."""
+    writer = output_write or (lambda _msg: None)
+
+    # Fail fast on an insecure (non-https) cloud URL before starting, so
+    # neither the device_code nor the gateway key could leave over http://.
+    try:
+        cloud.device_code_url()
+        cloud.device_token_url()
+        cloud.gateway_base_url()
+    except cloud.AlysisCloudConfigError as exc:
+        raise AlysisLoginError(str(exc)) from exc
+
+    grant = _request_device_code()
+
+    writer(f"Your one-time code: [bold]{grant.user_code}[/bold]")
+    writer(f"Approve it in your browser:\n  {grant.verification_url}")
+    opener = browser_opener or _open_browser
+    if not _safe_open(opener, grant.verification_url):
+        writer("Could not open a browser automatically. Open the URL above manually.")
+    writer("Waiting for approval…")
+
+    key = _poll_for_key(grant, timeout_s=timeout_s)
+
+    try:
+        # Create + activate the profile first (this saves config); only then
+        # persist the key, so a save failure never leaves a stored key pointing
+        # at an unconfigured profile. resolve_api_key then returns the gateway
+        # key as the Bearer for the `alysis` profile (no other wiring).
+        result = _activate_alysis_profile(cfg, email=None)
+        save_persisted_profile_key(cloud.PROFILE_KEY, key)
+    except OSError as exc:
+        raise AlysisLoginError(f"Logged in, but couldn't save your session locally: {exc}") from exc
+    return result
+
+
+def logout(cfg: AppConfig) -> bool:
+    """Revoke the gateway key server-side and forget it locally.
+
+    The server revocation is what actually ends access: any client still
+    holding the key in memory (including the current chat session) gets a
+    401 on its next request. Best-effort — offline logout still clears the
+    local key, and the orphaned server key can be revoked from the website
+    later. Returns True if a stored key was cleared.
+    """
+    stored = load_persisted_profile_keys().get(cloud.PROFILE_KEY)
+
+    if stored:
+        try:
+            request = urllib.request.Request(
+                f"{cloud.gateway_base_url()}/logout",
+                data=b"{}",
+                headers={
+                    "Authorization": f"Bearer {stored}",
+                    "Content-Type": "application/json",
+                },
+                method="POST",
+            )
+            urllib.request.urlopen(request, timeout=_HTTP_TIMEOUT_S).close()
+        except Exception:  # noqa: BLE001 - revocation is best-effort
+            pass
+
+    return clear_persisted_profile_key(cloud.PROFILE_KEY)
+
+
+def login_status(cfg: AppConfig) -> LoginStatus:
+    """Report whether an Alysis Code Pro session is connected."""
+    stored = load_persisted_profile_keys().get(cloud.PROFILE_KEY)
+    active = str((cfg.extra_fields or {}).get("active_profile") or "").strip()
+    profile = get_profile(cfg, cloud.PROFILE_KEY)
+    base_url = profile.base_url if profile is not None else cloud.gateway_base_url()
+    preview = None
+    if stored:
+        preview = stored[:8] + "…" if len(stored) > 8 else stored
+    return LoginStatus(
+        logged_in=bool(stored),
+        profile_name=cloud.PROFILE_KEY,
+        base_url=base_url,
+        active=active == cloud.PROFILE_KEY,
+        key_preview=preview,
+    )
+
+
+def fetch_trial_status(cfg: AppConfig) -> TrialStatus | None:
+    """Fetch live account status. Currently returns None (no status endpoint).
+
+    Plan status, credit balance, and usage live on the product site's /account
+    page (see ``alysis_cloud.account_url``). A CLI-visible status endpoint is planned;
+    until then this stays best-effort-None so callers degrade exactly like the
+    old offline path — `whoami` still shows local connection state.
+    """
+    return None
+
+
+def list_trial_models(cfg: AppConfig) -> list[str]:
+    """List the model ids the gateway currently serves, via ``/v1/models``.
+
+    The gateway exposes its allowlist as an OpenAI-shaped
+    ``{"data": [{"id": …}]}``. Surfacing it lets `/config` show the live model
+    list instead of pinning static ids. Best-effort: returns ``[]`` on any
+    failure (offline, non-200, malformed) so callers fall back to the static
+    preset models. The stored gateway key is sent when present (the gateway may
+    require it) and never required for the call to be attempted.
+    """
+    try:
+        url = cloud.models_url()
+    except cloud.AlysisCloudConfigError:
+        return []
+    headers = {}
+    access_key = load_persisted_profile_keys().get(cloud.PROFILE_KEY)
+    if access_key:
+        headers["Authorization"] = f"Bearer {access_key}"
+    request = urllib.request.Request(url, headers=headers, method="GET")
+    try:
+        with urllib.request.urlopen(request, timeout=_MODELS_TIMEOUT_S) as response:
+            body = json.loads(response.read().decode("utf-8"))
+    except (urllib.error.URLError, TimeoutError, OSError, ValueError, UnicodeDecodeError):
+        return []
+    data = body.get("data") if isinstance(body, dict) else None
+    if not isinstance(data, list):
+        return []
+    models: list[str] = []
+    for item in data:
+        if not isinstance(item, dict):
+            continue
+        model_id = str(item.get("id") or "").strip()
+        if model_id and model_id not in models:
+            models.append(model_id)
+    return models
+
+
+def format_trial_status_line(status: TrialStatus) -> str | None:
+    """A one-line account summary for `whoami`, or None if there's nothing to show."""
+    parts: list[str] = []
+    days = _days_left(status.trial_ends_at)
+    if days is not None:
+        parts.append("expired" if days <= 0 else f"{days} day{'s' if days != 1 else ''} left")
+    ends = _format_date(status.trial_ends_at)
+    if ends:
+        parts.append(f"ends {ends}")
+    tokens = _format_token_usage(status.tokens_used, status.tokens_total)
+    if tokens:
+        parts.append(tokens)
+    if not parts:
+        return None
+    label = (status.plan or "Account").capitalize()
+    return f"{label}: " + " · ".join(parts)
+
+
+# ---------------------------------------------------------------------------
+# Device flow internals
+# ---------------------------------------------------------------------------
+@dataclass(frozen=True)
+class _DeviceGrant:
+    device_code: str
+    user_code: str
+    verification_url: str
+    interval_s: float
+    expires_in_s: float
+
+
+def _function_headers() -> dict[str, str]:
+    # Supabase routes function calls with the public anon key; the device
+    # endpoints themselves are public by design (verify_jwt off server-side).
+    return {
+        "Content-Type": "application/json",
+        "apikey": cloud.ANON_KEY,
+        "Authorization": f"Bearer {cloud.ANON_KEY}",
+    }
+
+
+def _post_json(url: str, payload: dict) -> dict:
+    request = urllib.request.Request(
+        url,
+        data=json.dumps(payload).encode("utf-8"),
+        headers=_function_headers(),
+        method="POST",
+    )
+    try:
+        with urllib.request.urlopen(request, timeout=_HTTP_TIMEOUT_S) as response:
+            body = json.loads(response.read().decode("utf-8"))
+    except urllib.error.HTTPError as exc:
+        raise AlysisLoginError(_http_error_message(exc)) from exc
+    except urllib.error.URLError as exc:
+        raise AlysisLoginError(
+            f"Could not reach the Alysis Code login service: {exc.reason}"
+        ) from exc
+    except (ValueError, UnicodeDecodeError) as exc:
+        raise AlysisLoginError("Login service returned an invalid response.") from exc
+    except (TimeoutError, OSError) as exc:
+        raise AlysisLoginError(f"Login request failed: {exc}") from exc
+    if not isinstance(body, dict):
+        raise AlysisLoginError("Login service returned an invalid response.")
+    return body
+
+
+def _http_error_message(exc: urllib.error.HTTPError) -> str:
+    try:
+        detail = json.loads(exc.read().decode("utf-8"))
+        message = detail.get("error")
+        if isinstance(message, dict):
+            message = message.get("message")
+        if message:
+            return str(message)
+    except Exception:  # noqa: BLE001 - best-effort error extraction
+        pass
+    return f"Login request failed (HTTP {exc.code})."
+
+
+def _request_device_code() -> _DeviceGrant:
+    client_name = f"alysis-cli @ {platform.node() or 'unknown-host'}"[:80]
+    body = _post_json(cloud.device_code_url(), {"client_name": client_name})
+
+    device_code = str(body.get("device_code") or "").strip()
+    user_code = str(body.get("user_code") or "").strip()
+    if not device_code or not user_code:
+        raise AlysisLoginError("Login service did not return a device code.")
+
+    verification_url = str(
+        body.get("verification_url_complete") or body.get("verification_url") or ""
+    ).strip()
+    if not verification_url:
+        verification_url = f"{cloud.activate_url()}?code={user_code}"
+
+    try:
+        interval_s = max(float(body.get("interval", _DEFAULT_POLL_INTERVAL_S)), 0.0)
+    except (TypeError, ValueError):
+        interval_s = _DEFAULT_POLL_INTERVAL_S
+    try:
+        expires_in_s = max(float(body.get("expires_in", _DEFAULT_TIMEOUT_S)), 1.0)
+    except (TypeError, ValueError):
+        expires_in_s = _DEFAULT_TIMEOUT_S
+
+    return _DeviceGrant(
+        device_code=device_code,
+        user_code=user_code,
+        verification_url=verification_url,
+        interval_s=interval_s,
+        expires_in_s=expires_in_s,
+    )
+
+
+def _poll_for_key(grant: _DeviceGrant, *, timeout_s: float) -> str:
+    deadline = time.monotonic() + max(1.0, min(timeout_s, grant.expires_in_s))
+    while True:
+        body = _post_json(cloud.device_token_url(), {"device_code": grant.device_code})
+        status = str(body.get("status") or "").strip().lower()
+
+        if status == "approved":
+            key = str(body.get("key") or "").strip()
+            if not key:
+                raise AlysisLoginError("Login service did not return a key.")
+            return key
+        if status == "denied":
+            raise AlysisLoginError("Login was rejected on the website.")
+        if status in {"expired", "not_found", "already_claimed"}:
+            raise AlysisLoginError("This login code expired. Run `alysis login` again.")
+        # status == "pending" (or anything unknown): keep waiting.
+
+        remaining = deadline - time.monotonic()
+        if remaining <= 0:
+            raise AlysisLoginError(
+                f"Timed out after {int(timeout_s)}s waiting for approval. Run `alysis login` again."
+            )
+        time.sleep(min(grant.interval_s, max(remaining, 0.0)) if grant.interval_s else 0.0)
+
+
+# ---------------------------------------------------------------------------
+# Profile + formatting internals
+# ---------------------------------------------------------------------------
+def _str_or_none(value: object) -> str | None:
+    text = str(value).strip() if value is not None else ""
+    return text or None
+
+
+def _int_or_none(value: object) -> int | None:
+    try:
+        return int(value)  # type: ignore[arg-type]
+    except (TypeError, ValueError):
+        return None
+
+
+def _parse_iso(value: str | None) -> datetime | None:
+    if not value:
+        return None
+    try:
+        dt = datetime.fromisoformat(str(value).replace("Z", "+00:00"))
+    except ValueError:
+        return None
+    return dt if dt.tzinfo is not None else dt.replace(tzinfo=UTC)
+
+
+def _days_left(ends_at: str | None) -> int | None:
+    ends = _parse_iso(ends_at)
+    if ends is None:
+        return None
+    seconds = (ends - datetime.now(UTC)).total_seconds()
+    return 0 if seconds <= 0 else math.ceil(seconds / 86400)
+
+
+def _format_date(value: str | None) -> str | None:
+    dt = _parse_iso(value)
+    return dt.date().isoformat() if dt is not None else None
+
+
+def _format_token_usage(used: int | None, total: int | None) -> str | None:
+    if used is None and total is None:
+        return None
+    if total:
+        return f"{used or 0:,} / {total:,} tokens used"
+    return f"{used or 0:,} tokens used"
+
+
+def _activate_alysis_profile(cfg: AppConfig, *, email: str | None) -> LoginResult:
+    """Create + activate the `alysis` profile, keeping any model the user chose.
+
+    Fresh logins default to the Pro flagship (``deepseek-v4-flash``) so
+    subscribe → login → chat works with zero extra steps. Re-logins preserve
+    whatever model the user selected since, so logging in again never undoes
+    their choice. Legacy MiMo ids (the retired Xiaomi trial) are remapped to
+    the current default via the preset's model_aliases at config load.
+    """
+    preset = get_preset(cloud.PROFILE_KEY)
+    if preset is not None:
+        profile = make_profile_from_preset(preset, name=cloud.PROFILE_KEY)
+    else:  # pragma: no cover - preset is always present
+        profile = ProfileSpec(name=cloud.PROFILE_KEY, protocol="openai_compat")
+
+    existing = get_profile(cfg, cloud.PROFILE_KEY)
+    existing_model = str(getattr(existing, "default_model", "") or "").strip() if existing else ""
+    chosen_model = existing_model or _FRESH_LOGIN_DEFAULT_MODEL
+
+    # Always pin to the live gateway URL (env-overridable for tests); keep the
+    # user's chosen model.
+    profile = ProfileSpec(
+        name=profile.name,
+        protocol=profile.protocol,
+        base_url=cloud.gateway_base_url(),
+        api_key_env=None,
+        extra_headers=dict(profile.extra_headers),
+        default_model=chosen_model,
+        reasoning_effort=(existing.reasoning_effort if existing is not None else None),
+        reasoning_trace_adapter=(
+            existing.reasoning_trace_adapter
+            if existing is not None
+            else profile.reasoning_trace_adapter
+        ),
+        web_search_adapter=profile.web_search_adapter,
+        web_search_model=profile.web_search_model,
+        notes=profile.notes,
+    )
+
+    add_profile(cfg, profile)
+    set_active_profile(cfg, profile.name)
+    save_config(cfg)
+
+    return LoginResult(
+        email=email,
+        profile_name=profile.name,
+        base_url=profile.base_url,
+        model=profile.default_model,
+    )
+
+
+def _open_browser(url: str) -> bool:
+    return open_url(url)
+
+
+def _safe_open(opener: Callable[[str], bool], url: str) -> bool:
+    try:
+        return bool(opener(url))
+    except Exception:  # noqa: BLE001 - browser launch is best-effort
+        return False

alysis_code/agent/README.md

@@ -0,0 +1,35 @@
+# Agent Runtime
+
+This package contains the core runtime for interactive chat, one-shot runs, and
+managed execution flows.
+
+## Contents
+
+- `session.py` builds session state from configuration, workspace context, and
+  runtime kind.
+- `tools_assembly.py` builds the concrete tool surface for a session.
+- `turn.py` runs the turn loop and tool-call iteration.
+- `routing.py` handles routing and final response shaping.
+- `prompt_context.py` prepares workspace, convention, skill, plugin, and
+  verification context.
+- `verification.py` and `verification_commands.py` support verification flows.
+
+## Scope
+
+Tool exposure is not implied by imports. It depends on runtime kind, execution
+mode, workspace policy, configuration, and readiness checks.
+
+Repository files, web content, MCP output, OCR text, custom tool output, and
+model output should remain treated as untrusted unless a higher layer has
+explicitly established otherwise.
+
+## Development
+
+Prompt shape, tool ordering, and result summaries can affect behavior. Keep
+changes narrow and test the runtime path being changed.
+
+## See Also
+
+- [Architecture](../../../docs/architecture.md)
+- [Security model](../../../docs/security_model.md)
+- [Forge](../../../docs/forge.md)

alysis_code/agent/__init__.py

@@ -0,0 +1,11 @@
+from __future__ import annotations
+
+import sys
+from typing import TypeVar
+
+_T = TypeVar("_T")
+
+
+def _patchable(name: str, default: _T) -> _T:
+    mod = sys.modules.get("alysis_code.agent_loop")
+    return getattr(mod, name, default) if mod is not None else default