alysis-code 0.13.0__py3-none-any.whl

alysis_code/custom_tools/session.py

@@ -0,0 +1,227 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+
+from ..runtime_kind import RuntimeKind, normalize_runtime_kind
+from .discovery import (
+    CustomToolCapabilities,
+    CustomToolDiscoveryResult,
+    CustomToolIssue,
+    CustomToolSpec,
+    discover_custom_tools,
+)
+from .trust import ProjectToolTrustState, is_project_tool_trusted, load_trust_state
+
+_CUSTOM_TOOL_TOP_LEVEL_RUNTIMES = {
+    RuntimeKind.INTERACTIVE_CHAT,
+    RuntimeKind.ONE_SHOT,
+    RuntimeKind.FORGE_EXEC,
+}
+_CUSTOM_TOOL_TOP_LEVEL_RUNTIME_VALUES = frozenset(
+    runtime_kind.value for runtime_kind in _CUSTOM_TOOL_TOP_LEVEL_RUNTIMES
+)
+
+
+@dataclass(frozen=True)
+class CustomToolCatalogEntry:
+    name: str
+    source_scope: str
+    trust: str
+    status: str
+    source_path: Path
+    detail: str = ""
+    manifest_version: int | None = None
+    capabilities: CustomToolCapabilities | None = None
+    spec: CustomToolSpec | None = None
+    issue: CustomToolIssue | None = None
+    exposed: bool = False
+
+    @property
+    def normalized_name(self) -> str:
+        return self.name.casefold()
+
+
+@dataclass(frozen=True)
+class CustomToolSessionState:
+    discovery: CustomToolDiscoveryResult
+    trust_state: ProjectToolTrustState
+    catalog_entries: tuple[CustomToolCatalogEntry, ...]
+    effective_tools_by_name: dict[str, CustomToolSpec]
+    exposed_tools_by_name: dict[str, CustomToolSpec]
+
+
+def build_custom_tool_session_state(
+    *,
+    workspace_root: Path,
+    custom_tools_enabled: bool,
+    mode: str,
+    runtime_kind: RuntimeKind | str,
+    built_in_tool_names: set[str],
+    catalog_view: bool = False,
+    write_scope_restricted: bool = False,
+    user_config_dir: Path | None = None,
+    discovery: CustomToolDiscoveryResult | None = None,
+    trust_state: ProjectToolTrustState | None = None,
+) -> CustomToolSessionState:
+    resolved_runtime_kind = normalize_runtime_kind(
+        runtime_kind, fallback=RuntimeKind.INTERACTIVE_CHAT
+    )
+    active_discovery = discovery or discover_custom_tools(
+        workspace_root=workspace_root,
+        built_in_tool_names=built_in_tool_names,
+        user_config_dir=user_config_dir,
+    )
+    active_trust_state = trust_state
+    if active_trust_state is None:
+        try:
+            active_trust_state = load_trust_state(user_config_dir=user_config_dir)
+        except RuntimeError:
+            active_trust_state = ProjectToolTrustState()
+
+    effective = active_discovery.effective_tools_by_name()
+    exposed: dict[str, CustomToolSpec] = {}
+    entries: list[CustomToolCatalogEntry] = []
+    shadowed_names = {tool.normalized_name for tool in active_discovery.shadowed_tools}
+
+    for tool in active_discovery.effective_tools:
+        status, trust_label, detail = _tool_status(
+            tool=tool,
+            custom_tools_enabled=custom_tools_enabled,
+            mode=mode,
+            runtime_kind=resolved_runtime_kind,
+            catalog_view=catalog_view,
+            write_scope_restricted=write_scope_restricted,
+            trust_state=active_trust_state,
+        )
+        exposed_flag = status == "available" and not catalog_view
+        if exposed_flag:
+            exposed[tool.normalized_name] = tool
+        entries.append(
+            CustomToolCatalogEntry(
+                name=tool.name,
+                source_scope=tool.source_scope,
+                trust=trust_label,
+                status=status,
+                source_path=tool.source_path,
+                detail=detail,
+                manifest_version=tool.manifest_version,
+                capabilities=tool.capabilities,
+                spec=tool,
+                exposed=exposed_flag,
+            )
+        )
+
+    for tool in active_discovery.shadowed_tools:
+        entries.append(
+            CustomToolCatalogEntry(
+                name=tool.name,
+                source_scope=tool.source_scope,
+                trust="global" if tool.source_scope == "global" else "persistent",
+                status="shadowed",
+                source_path=tool.source_path,
+                detail="overridden by a project custom tool with the same name",
+                manifest_version=tool.manifest_version,
+                capabilities=tool.capabilities,
+                spec=tool,
+            )
+        )
+
+    for issue in active_discovery.issues:
+        issue_name = issue.tool_name.strip() or Path(issue.relative_tool_path).stem
+        if issue_name.casefold() in shadowed_names:
+            detail = issue.message
+        else:
+            detail = issue.message
+        entries.append(
+            CustomToolCatalogEntry(
+                name=issue_name,
+                source_scope=issue.source_scope,
+                trust="-",
+                status="invalid",
+                source_path=issue.source_path,
+                detail=detail,
+                issue=issue,
+            )
+        )
+
+    entries_sorted = tuple(
+        sorted(
+            entries,
+            key=lambda entry: (
+                entry.name.casefold(),
+                0 if entry.status == "available" else 1,
+                0 if entry.source_scope == "project" else 1,
+                entry.source_path.as_posix().casefold(),
+            ),
+        )
+    )
+    return CustomToolSessionState(
+        discovery=active_discovery,
+        trust_state=active_trust_state,
+        catalog_entries=entries_sorted,
+        effective_tools_by_name=effective,
+        exposed_tools_by_name=exposed,
+    )
+
+
+def _tool_status(
+    *,
+    tool: CustomToolSpec,
+    custom_tools_enabled: bool,
+    mode: str,
+    runtime_kind: RuntimeKind,
+    catalog_view: bool,
+    write_scope_restricted: bool,
+    trust_state: ProjectToolTrustState,
+) -> tuple[str, str, str]:
+    if tool.source_scope == "global":
+        trust_label = "global"
+        trusted = True
+    else:
+        trusted = is_project_tool_trusted(tool, state=trust_state)
+        trust_label = "persistent" if trusted else "untrusted"
+
+    if not custom_tools_enabled:
+        return "disabled", trust_label, "custom tools are disabled in config"
+    if catalog_view:
+        if not _tool_enabled_in_any_supported_top_level_runtime(tool):
+            return (
+                "disabled",
+                trust_label,
+                "tool manifest does not enable any supported top-level runtime",
+            )
+        if tool.missing_env:
+            missing = ", ".join(tool.missing_env)
+            return "missing-env", trust_label, f"missing required env vars: {missing}"
+        if not trusted:
+            return "untrusted", trust_label, "project tool requires persistent trust"
+        return "available", trust_label, ""
+    if write_scope_restricted:
+        return (
+            "disabled",
+            trust_label,
+            "custom tools are unavailable when write scope is narrowed",
+        )
+    if not _custom_tools_supported_runtime(mode=mode, runtime_kind=runtime_kind):
+        return "disabled", trust_label, "custom tools are unavailable in this runtime or mode"
+    if runtime_kind.value not in set(tool.enabled_in):
+        return "disabled", trust_label, "tool manifest disables this runtime"
+    if tool.missing_env:
+        missing = ", ".join(tool.missing_env)
+        return "missing-env", trust_label, f"missing required env vars: {missing}"
+    if not trusted:
+        return "untrusted", trust_label, "project tool requires persistent trust"
+    return "available", trust_label, ""
+
+
+def _custom_tools_supported_runtime(*, mode: str, runtime_kind: RuntimeKind) -> bool:
+    if str(mode or "").strip().lower() == "readonly":
+        return False
+    return runtime_kind in _CUSTOM_TOOL_TOP_LEVEL_RUNTIMES
+
+
+def _tool_enabled_in_any_supported_top_level_runtime(tool: CustomToolSpec) -> bool:
+    return any(
+        runtime_kind in _CUSTOM_TOOL_TOP_LEVEL_RUNTIME_VALUES for runtime_kind in tool.enabled_in
+    )

alysis_code/custom_tools/trust.py

@@ -0,0 +1,232 @@
+from __future__ import annotations
+
+import json
+import os
+import threading
+from collections.abc import Callable
+from contextlib import contextmanager
+from dataclasses import dataclass
+from io import BufferedRandom
+from pathlib import Path
+
+from ..atomic_io import atomic_write_json
+from ..branding import canonical_user_config_dir, env_get
+from .discovery import CustomToolSpec
+
+_TRUST_SCHEMA_VERSION = 1
+_TRUST_STATE_LOCK = threading.RLock()
+
+if os.name == "nt":  # pragma: no cover - exercised on Windows
+    import msvcrt
+else:  # pragma: no cover - exercised on POSIX
+    import fcntl
+
+
+@dataclass(frozen=True)
+class ProjectToolTrustKey:
+    workspace_root: str
+    relative_tool_path: str
+    file_hash: str
+
+
+@dataclass(frozen=True)
+class ProjectToolTrustState:
+    trusted_tools: tuple[ProjectToolTrustKey, ...] = ()
+
+    def contains(self, key: ProjectToolTrustKey) -> bool:
+        return key in set(self.trusted_tools)
+
+
+def _config_dir() -> Path:
+    override = env_get("ALYSIS_CONFIG_DIR")
+    if override:
+        return Path(override)
+    return canonical_user_config_dir()
+
+
+def trust_state_path(*, user_config_dir: Path | None = None) -> Path:
+    base = user_config_dir.expanduser().resolve() if user_config_dir is not None else _config_dir()
+    return base / "custom_tools_trust.json"
+
+
+def load_trust_state(*, user_config_dir: Path | None = None) -> ProjectToolTrustState:
+    path = trust_state_path(user_config_dir=user_config_dir)
+    return _load_trust_state_from_path(path)
+
+
+def _load_trust_state_from_path(path: Path) -> ProjectToolTrustState:
+    if not path.exists():
+        return ProjectToolTrustState()
+    try:
+        raw = json.loads(path.read_text(encoding="utf-8"))
+    except Exception as exc:  # noqa: BLE001
+        raise RuntimeError(f"Failed to read custom tool trust state: {path}") from exc
+    if not isinstance(raw, dict):
+        raise RuntimeError("Invalid custom tool trust state format.")
+    version = raw.get("schema_version", _TRUST_SCHEMA_VERSION)
+    if version != _TRUST_SCHEMA_VERSION:
+        raise RuntimeError(f"Unsupported custom tool trust schema version: {version}")
+    trusted_raw = raw.get("trusted_tools", [])
+    if not isinstance(trusted_raw, list):
+        raise RuntimeError("Invalid custom tool trust state: trusted_tools must be an array.")
+    trusted: list[ProjectToolTrustKey] = []
+    for item in trusted_raw:
+        if not isinstance(item, dict):
+            continue
+        workspace_root = str(item.get("workspace_root") or "").strip()
+        relative_tool_path = str(item.get("relative_tool_path") or "").strip()
+        file_hash = str(item.get("file_hash") or "").strip()
+        if workspace_root and relative_tool_path and file_hash:
+            trusted.append(
+                ProjectToolTrustKey(
+                    workspace_root=workspace_root,
+                    relative_tool_path=relative_tool_path,
+                    file_hash=file_hash,
+                )
+            )
+    trusted_sorted = tuple(
+        sorted(
+            set(trusted),
+            key=lambda key: (key.workspace_root, key.relative_tool_path, key.file_hash),
+        )
+    )
+    return ProjectToolTrustState(trusted_tools=trusted_sorted)
+
+
+def save_trust_state(
+    state: ProjectToolTrustState,
+    *,
+    user_config_dir: Path | None = None,
+) -> None:
+    path = trust_state_path(user_config_dir=user_config_dir)
+    with _locked_trust_state(path):
+        _save_trust_state_to_path(state, path)
+
+
+def _save_trust_state_to_path(
+    state: ProjectToolTrustState,
+    path: Path,
+) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    payload = {
+        "schema_version": _TRUST_SCHEMA_VERSION,
+        "trusted_tools": [
+            {
+                "workspace_root": key.workspace_root,
+                "relative_tool_path": key.relative_tool_path,
+                "file_hash": key.file_hash,
+            }
+            for key in state.trusted_tools
+        ],
+    }
+    atomic_write_json(path, payload, ensure_ascii=True)
+
+
+def trust_project_tool(
+    spec: CustomToolSpec,
+    *,
+    user_config_dir: Path | None = None,
+) -> ProjectToolTrustState:
+    key = project_tool_trust_key(spec)
+    return _mutate_trust_state(
+        user_config_dir=user_config_dir,
+        mutation=lambda current: ProjectToolTrustState(
+            trusted_tools=tuple(
+                sorted(
+                    {*(current.trusted_tools), key},
+                    key=lambda item: (item.workspace_root, item.relative_tool_path, item.file_hash),
+                )
+            )
+        ),
+    )
+
+
+def untrust_project_tool(
+    spec: CustomToolSpec,
+    *,
+    user_config_dir: Path | None = None,
+) -> ProjectToolTrustState:
+    if spec.source_scope != "project":
+        raise ValueError("Only project custom tools can be untrusted.")
+    workspace_root = os.fspath(spec.source_path.resolve().parents[2])
+    relpath = spec.relative_tool_path
+    return _mutate_trust_state(
+        user_config_dir=user_config_dir,
+        mutation=lambda current: ProjectToolTrustState(
+            trusted_tools=tuple(
+                key
+                for key in current.trusted_tools
+                if not (key.workspace_root == workspace_root and key.relative_tool_path == relpath)
+            )
+        ),
+    )
+
+
+def is_project_tool_trusted(
+    spec: CustomToolSpec,
+    *,
+    state: ProjectToolTrustState | None = None,
+    user_config_dir: Path | None = None,
+) -> bool:
+    if spec.source_scope != "project":
+        return True
+    active_state = state if state is not None else load_trust_state(user_config_dir=user_config_dir)
+    return project_tool_trust_key(spec) in set(active_state.trusted_tools)
+
+
+def project_tool_trust_key(spec: CustomToolSpec) -> ProjectToolTrustKey:
+    if spec.source_scope != "project":
+        raise ValueError("Only project custom tools use explicit trust keys.")
+    workspace_root = os.fspath(spec.source_path.resolve().parents[2])
+    return ProjectToolTrustKey(
+        workspace_root=workspace_root,
+        relative_tool_path=spec.relative_tool_path,
+        file_hash=spec.file_hash,
+    )
+
+
+def _mutate_trust_state(
+    *,
+    user_config_dir: Path | None,
+    mutation: Callable[[ProjectToolTrustState], ProjectToolTrustState],
+) -> ProjectToolTrustState:
+    path = trust_state_path(user_config_dir=user_config_dir)
+    with _locked_trust_state(path):
+        current = _load_trust_state_from_path(path)
+        updated = mutation(current)
+        if updated != current:
+            _save_trust_state_to_path(updated, path)
+        return updated
+
+
+@contextmanager
+def _locked_trust_state(path: Path):
+    path.parent.mkdir(parents=True, exist_ok=True)
+    lock_path = path.with_name(f"{path.name}.lock")
+    with _TRUST_STATE_LOCK:
+        with lock_path.open("a+b") as handle:
+            _acquire_file_lock(handle)
+            try:
+                yield
+            finally:
+                _release_file_lock(handle)
+
+
+def _acquire_file_lock(handle: BufferedRandom) -> None:
+    if os.name == "nt":  # pragma: no cover - exercised on Windows
+        handle.seek(0, os.SEEK_END)
+        if handle.tell() == 0:
+            handle.write(b"\0")
+            handle.flush()
+        handle.seek(0)
+        msvcrt.locking(handle.fileno(), msvcrt.LK_LOCK, 1)
+        return
+    fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
+
+
+def _release_file_lock(handle: BufferedRandom) -> None:
+    if os.name == "nt":  # pragma: no cover - exercised on Windows
+        handle.seek(0)
+        msvcrt.locking(handle.fileno(), msvcrt.LK_UNLCK, 1)
+        return
+    fcntl.flock(handle.fileno(), fcntl.LOCK_UN)

alysis_code/diff_paths.py

@@ -0,0 +1,113 @@
+from __future__ import annotations
+
+import shlex
+
+
+def _unquote_path(value: str) -> str:
+    raw = value.strip()
+    if not raw:
+        return ""
+    if raw[0] == raw[-1] == '"' and len(raw) >= 2:
+        try:
+            parsed = shlex.split(raw)
+            if parsed:
+                return parsed[0]
+        except ValueError:
+            return raw[1:-1]
+        return raw[1:-1]
+    return raw
+
+
+def _normalize_git_path(value: str) -> str:
+    raw = _unquote_path(value.strip())
+    if raw.startswith("a/") or raw.startswith("b/"):
+        return raw[2:]
+    return raw
+
+
+def parse_diff_git_line(line: str) -> tuple[str | None, str | None]:
+    if not line.startswith("diff --git "):
+        return None, None
+    payload = line[len("diff --git ") :].strip()
+
+    if payload.startswith("a/"):
+        split = payload.rsplit(" b/", 1)
+        if len(split) == 2:
+            a_raw = split[0]
+            b_raw = "b/" + split[1]
+            return _normalize_git_path(a_raw), _normalize_git_path(b_raw)
+
+    try:
+        parts = shlex.split(payload)
+    except ValueError:
+        return None, None
+    if len(parts) < 2:
+        return None, None
+    return _normalize_git_path(parts[0]), _normalize_git_path(parts[1])
+
+
+def _parse_patch_header_path(line: str, prefix: str) -> str | None:
+    if not line.startswith(prefix):
+        return None
+    raw = line[len(prefix) :].split("\t", 1)[0].strip()
+    if not raw:
+        return None
+    path = _normalize_git_path(raw)
+    if not path or path == "/dev/null":
+        return None
+    return path
+
+
+def iter_patch_paths(patch_text: str) -> list[str]:
+    paths: list[str] = []
+    seen: set[str] = set()
+    saw_diff_header = False
+
+    for line in patch_text.splitlines():
+        a_path, b_path = parse_diff_git_line(line)
+        if a_path is None and b_path is None:
+            continue
+        saw_diff_header = True
+        for path in (a_path, b_path):
+            if not path or path == "/dev/null" or path in seen:
+                continue
+            seen.add(path)
+            paths.append(path)
+
+    if saw_diff_header:
+        return paths
+
+    for line in patch_text.splitlines():
+        for prefix in ("--- ", "+++ "):
+            path = _parse_patch_header_path(line, prefix)
+            if path is None or path in seen:
+                continue
+            seen.add(path)
+            paths.append(path)
+    return paths
+
+
+def parse_patch_changed_files(patch_text: str) -> list[str]:
+    files: list[str] = []
+    seen: set[str] = set()
+    saw_diff_header = False
+
+    for line in patch_text.splitlines():
+        a_path, b_path = parse_diff_git_line(line)
+        if a_path is None and b_path is None:
+            continue
+        saw_diff_header = True
+        if b_path and b_path != "/dev/null" and b_path not in seen:
+            seen.add(b_path)
+            files.append(b_path)
+
+    if saw_diff_header:
+        return files
+
+    for line in patch_text.splitlines():
+        path = _parse_patch_header_path(line, "+++ ")
+        if path is None or path in seen:
+            continue
+        seen.add(path)
+        files.append(path)
+    return files