alysis-code 0.13.0__py3-none-any.whl

alysis_code/server/app.py

@@ -0,0 +1,367 @@
+import inspect
+import sys
+import tempfile
+from pathlib import Path
+from typing import Literal
+
+from pydantic import BaseModel, Field
+
+from .auth import require_token
+from .job_config import resolve_effective_model_base_url
+from .settings import ServerSettings
+from .store import ServerStore, ServerStoreError
+from .worker_runner import JobRunner
+
+_UPLOAD_CHUNK_BYTES = 1024 * 1024
+_AgentMode = Literal["auto", "review", "readonly", "fullaccess"]
+_SwarmMode = Literal["auto"]
+
+
+class RunJobRequest(BaseModel):
+    instruction: str
+    mode: _AgentMode = "auto"
+    yes: bool = True
+    model: str | None = None
+    base_url: str | None = None
+    temperature: float | None = None
+
+
+class ForgeExecRequest(BaseModel):
+    task_id: str = Field(min_length=1)
+    mode: _AgentMode = "auto"
+    yes: bool = True
+    model: str | None = None
+    base_url: str | None = None
+    temperature: float | None = None
+
+
+class ForgeSwarmRequest(BaseModel):
+    # Non-dry-run swarm orchestration is auto-only by runtime invariant.
+    mode: _SwarmMode = "auto"
+    yes: bool = True
+    model: str | None = None
+    base_url: str | None = None
+    temperature: float | None = None
+
+
+async def _close_upload_best_effort(upload: object) -> None:
+    close = getattr(upload, "close", None)
+    if not callable(close):
+        return
+    try:
+        result = close()
+        if inspect.isawaitable(result):
+            await result
+    except Exception:
+        return
+
+
+async def _stage_uploaded_zip(
+    *,
+    upload: object,
+    max_upload_bytes: int,
+    chunk_size: int = _UPLOAD_CHUNK_BYTES,
+) -> Path:
+    if chunk_size <= 0:
+        raise ValueError("chunk_size must be > 0")
+
+    temp_path: Path | None = None
+    total_bytes = 0
+
+    try:
+        with tempfile.NamedTemporaryFile(delete=False, suffix=".zip") as handle:
+            temp_path = Path(handle.name)
+            while True:
+                chunk = await upload.read(chunk_size)  # type: ignore[attr-defined]
+                if not chunk:
+                    break
+                next_total = total_bytes + len(chunk)
+                if next_total > max_upload_bytes:
+                    raise ServerStoreError(
+                        f"Upload too large ({next_total} bytes); max is {max_upload_bytes} bytes."
+                    )
+                handle.write(chunk)
+                total_bytes = next_total
+        return temp_path
+    except Exception:
+        if temp_path is not None:
+            try:
+                temp_path.unlink()
+            except OSError:
+                pass
+        raise
+    finally:
+        await _close_upload_best_effort(upload)
+
+
+async def _create_run_from_upload(
+    *,
+    store: ServerStore,
+    upload: object,
+    max_upload_bytes: int,
+    chunk_size: int = _UPLOAD_CHUNK_BYTES,
+) -> str:
+    # Stage uploads to disk so size enforcement happens during request reads, not after
+    # buffering the full multipart body into memory.
+    staged_path = await _stage_uploaded_zip(
+        upload=upload,
+        max_upload_bytes=max_upload_bytes,
+        chunk_size=chunk_size,
+    )
+    try:
+        return store.create_run_from_zip_path(staged_path)
+    finally:
+        try:
+            staged_path.unlink()
+        except OSError:
+            pass
+
+
+def _append_common_agent_args(
+    command: list[str],
+    *,
+    mode: str,
+    yes: bool,
+    model: str,
+    base_url: str | None,
+    temperature: float | None,
+) -> None:
+    command.extend(["--mode", mode, "--api-key-env", "ALYSIS_API_KEY"])
+    if yes:
+        command.append("--yes")
+    command.extend(["--model", model])
+    if base_url:
+        command.extend(["--base-url", base_url])
+    if temperature is not None:
+        command.extend(["--temperature", str(temperature)])
+
+
+def _agent_entrypoint_prefix(settings: ServerSettings) -> list[str]:
+    if settings.worker_backend == "docker":
+        return ["python", "-m", "alysis_code"]
+    return [sys.executable, "-m", "alysis_code"]
+
+
+def _append_forge_machine_flag(command: list[str], settings: ServerSettings) -> None:
+    """Ask Forge workers for the NDJSON event stream so job status is reported, not guessed."""
+    if settings.worker_machine_events:
+        command.append("--machine")
+
+
+def _validate_forge_exec_task_id(task_id: str) -> None:
+    if task_id.startswith("-"):
+        raise ValueError("Invalid task_id: must not start with '-'")
+    if any(ch.isspace() for ch in task_id):
+        raise ValueError("Invalid task_id: whitespace is not allowed")
+
+
+def _build_run_job_command(
+    *,
+    settings: ServerSettings,
+    req: RunJobRequest,
+    model: str,
+    base_url: str | None,
+) -> list[str]:
+    command = _agent_entrypoint_prefix(settings) + ["run", "--path", "/workspace"]
+    _append_common_agent_args(
+        command,
+        mode=req.mode,
+        yes=req.yes,
+        model=model,
+        base_url=base_url,
+        temperature=req.temperature,
+    )
+    # End-of-options sentinel to prevent instruction option injection.
+    command.extend(["--", req.instruction])
+    return command
+
+
+def _build_forge_exec_job_command(
+    *,
+    settings: ServerSettings,
+    req: ForgeExecRequest,
+    model: str,
+    base_url: str | None,
+) -> list[str]:
+    _validate_forge_exec_task_id(req.task_id)
+    command = _agent_entrypoint_prefix(settings) + [
+        "forge",
+        "exec",
+        req.task_id,
+        "--path",
+        "/workspace",
+    ]
+    _append_forge_machine_flag(command, settings)
+    _append_common_agent_args(
+        command,
+        mode=req.mode,
+        yes=req.yes,
+        model=model,
+        base_url=base_url,
+        temperature=req.temperature,
+    )
+    return command
+
+
+def _build_forge_swarm_job_command(
+    *,
+    settings: ServerSettings,
+    req: ForgeSwarmRequest,
+    model: str,
+    base_url: str | None,
+) -> list[str]:
+    command = _agent_entrypoint_prefix(settings) + [
+        "forge",
+        "swarm",
+        "--path",
+        "/workspace",
+    ]
+    _append_forge_machine_flag(command, settings)
+    _append_common_agent_args(
+        command,
+        mode=req.mode,
+        yes=req.yes,
+        model=model,
+        base_url=base_url,
+        temperature=req.temperature,
+    )
+    return command
+
+
+def create_app(settings: ServerSettings):  # type: ignore[no-untyped-def]
+    from fastapi import Depends, FastAPI, File, HTTPException, UploadFile, status
+    from fastapi.responses import PlainTextResponse
+
+    app = FastAPI(title="alysis-code server", version="1.0")
+    store = ServerStore(settings)
+    runner = JobRunner(settings, store)
+    auth_dep = require_token(settings)
+
+    @app.get("/health")
+    def health() -> dict[str, bool]:
+        return {"ok": True}
+
+    @app.post("/v1/runs", dependencies=[Depends(auth_dep)])
+    async def create_run(file: UploadFile = File(...)) -> dict[str, str]:
+        try:
+            run_id = await _create_run_from_upload(
+                store=store,
+                upload=file,
+                max_upload_bytes=settings.max_upload_bytes,
+            )
+        except ServerStoreError as e:
+            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e)) from e
+        return {"run_id": run_id}
+
+    @app.post("/v1/runs/empty", dependencies=[Depends(auth_dep)])
+    def create_empty_run() -> dict[str, str]:
+        run_id = store.create_empty_run()
+        return {"run_id": run_id}
+
+    @app.post("/v1/runs/{run_id}/jobs/run", dependencies=[Depends(auth_dep)])
+    def start_run_job(run_id: str, req: RunJobRequest) -> dict[str, str]:
+        try:
+            effective_model, effective_base_url = resolve_effective_model_base_url(
+                settings=settings,
+                requested_model=req.model,
+                requested_base_url=req.base_url,
+            )
+            command = _build_run_job_command(
+                settings=settings,
+                req=req,
+                model=effective_model,
+                base_url=effective_base_url,
+            )
+        except ValueError as e:
+            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e)) from e
+
+        try:
+            job_id = runner.start_job(run_id=run_id, command=command)
+        except ServerStoreError as e:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=str(e)) from e
+        return {"job_id": job_id}
+
+    @app.post("/v1/runs/{run_id}/jobs/forge_exec", dependencies=[Depends(auth_dep)])
+    def start_forge_exec_job(run_id: str, req: ForgeExecRequest) -> dict[str, str]:
+        try:
+            effective_model, effective_base_url = resolve_effective_model_base_url(
+                settings=settings,
+                requested_model=req.model,
+                requested_base_url=req.base_url,
+            )
+            command = _build_forge_exec_job_command(
+                settings=settings,
+                req=req,
+                model=effective_model,
+                base_url=effective_base_url,
+            )
+        except ValueError as e:
+            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e)) from e
+
+        try:
+            job_id = runner.start_job(run_id=run_id, command=command)
+        except ServerStoreError as e:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=str(e)) from e
+        return {"job_id": job_id}
+
+    @app.post("/v1/runs/{run_id}/jobs/forge_swarm", dependencies=[Depends(auth_dep)])
+    def start_forge_swarm_job(run_id: str, req: ForgeSwarmRequest) -> dict[str, str]:
+        try:
+            effective_model, effective_base_url = resolve_effective_model_base_url(
+                settings=settings,
+                requested_model=req.model,
+                requested_base_url=req.base_url,
+            )
+            command = _build_forge_swarm_job_command(
+                settings=settings,
+                req=req,
+                model=effective_model,
+                base_url=effective_base_url,
+            )
+        except ValueError as e:
+            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e)) from e
+
+        try:
+            job_id = runner.start_job(run_id=run_id, command=command)
+        except ServerStoreError as e:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=str(e)) from e
+        return {"job_id": job_id}
+
+    @app.get("/v1/jobs/{job_id}", dependencies=[Depends(auth_dep)])
+    def get_job_status(job_id: str) -> dict[str, object]:
+        try:
+            status_obj = runner.get_status(job_id)
+        except ServerStoreError as e:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=str(e)) from e
+        return {
+            "job_id": status_obj.job_id,
+            "run_id": status_obj.run_id,
+            "status": status_obj.status,
+            # How the status was decided: the worker's terminal event, or the exit code.
+            "status_source": status_obj.status_source,
+            "created_at": status_obj.created_at,
+            "started_at": status_obj.started_at,
+            "finished_at": status_obj.finished_at,
+            "exit_code": status_obj.exit_code,
+            "error": status_obj.error,
+            "terminal_event": status_obj.terminal_event,
+        }
+
+    @app.get("/v1/jobs/{job_id}/logs", dependencies=[Depends(auth_dep)])
+    def get_job_logs(job_id: str) -> PlainTextResponse:
+        try:
+            body = runner.read_logs(job_id)
+        except ServerStoreError as e:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=str(e)) from e
+        return PlainTextResponse(body)
+
+    @app.post("/v1/jobs/{job_id}/cancel", dependencies=[Depends(auth_dep)])
+    def cancel_job(job_id: str) -> dict[str, str]:
+        try:
+            runner.cancel_job(job_id)
+            status_obj = runner.get_status(job_id)
+        except ServerStoreError as e:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=str(e)) from e
+        return {"job_id": status_obj.job_id, "status": status_obj.status}
+
+    return app

alysis_code/server/auth.py

@@ -0,0 +1,34 @@
+from collections.abc import Callable
+
+from .settings import ServerSettings
+
+_LOCAL_CLIENTS = {"127.0.0.1", "::1", "localhost"}
+
+
+def require_token(settings: ServerSettings) -> Callable[..., None]:
+    from fastapi import HTTPException, Request, status
+
+    async def _dependency(request: Request) -> None:
+        client_host = (request.client.host if request.client else "") or ""
+        if settings.token:
+            auth_value = request.headers.get("authorization") or ""
+            if not auth_value.lower().startswith("bearer "):
+                raise HTTPException(
+                    status_code=status.HTTP_401_UNAUTHORIZED,
+                    detail="Missing Bearer token.",
+                )
+            token = auth_value[7:].strip()
+            if token != settings.token:
+                raise HTTPException(
+                    status_code=status.HTTP_403_FORBIDDEN,
+                    detail="Invalid token.",
+                )
+            return
+
+        if client_host not in _LOCAL_CLIENTS:
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="Server token is not set; only localhost clients are allowed.",
+            )
+
+    return _dependency

alysis_code/server/job_config.py

@@ -0,0 +1,30 @@
+from __future__ import annotations
+
+from .settings import ServerSettings
+
+
+def resolve_effective_model_base_url(
+    settings: ServerSettings,
+    requested_model: str | None,
+    requested_base_url: str | None,
+) -> tuple[str, str | None]:
+    req_model = (requested_model or "").strip() or None
+    req_base_url = (requested_base_url or "").strip() or None
+
+    if settings.default_model:
+        model = settings.default_model
+    elif settings.allow_client_model and req_model:
+        model = req_model
+    else:
+        raise ValueError("Model is required (set ALYSIS_SERVER_MODEL or provide request.model).")
+
+    if settings.default_base_url:
+        base_url = settings.default_base_url
+    elif settings.allow_client_base_url and req_base_url:
+        if not req_base_url.startswith(("http://", "https://")):
+            raise ValueError("Client base_url must use http:// or https://.")
+        base_url = req_base_url
+    else:
+        base_url = None
+
+    return model, base_url

alysis_code/server/settings.py

@@ -0,0 +1,215 @@
+from __future__ import annotations
+
+import platform
+from dataclasses import dataclass
+from pathlib import Path
+
+from ..branding import canonical_server_data_dir, env_get
+from ..config import ConfigError
+
+_LOCAL_HOSTS = {"127.0.0.1", "::1", "localhost"}
+_WORKER_BACKENDS = {"bwrap", "docker"}
+_SANDBOX_MODES = {"off", "warn", "strict"}
+_NETWORK_MODES = {"off", "on"}
+_DEFAULT_MAX_UPLOAD_BYTES = 50 * 1024 * 1024
+
+
+def _parse_int(raw: object, *, field_name: str, default: int, min_value: int) -> int:
+    if raw is None:
+        return default
+    try:
+        value = int(str(raw).strip())
+    except ValueError as e:
+        raise ConfigError(f"Invalid {field_name}: {raw!r}. Expected integer.") from e
+    if value < min_value:
+        raise ConfigError(f"Invalid {field_name}: {raw!r}. Expected >= {min_value}.")
+    return value
+
+
+def _parse_choice(raw: object, *, field_name: str, default: str, allowed: set[str]) -> str:
+    if raw is None:
+        return default
+    value = str(raw).strip().lower()
+    if value in allowed:
+        return value
+    options = ", ".join(sorted(allowed))
+    raise ConfigError(f"Invalid {field_name}: {raw!r}. Expected one of: {options}")
+
+
+def _parse_bool(raw: object, *, field_name: str, default: bool) -> bool:
+    if raw is None:
+        return default
+    if isinstance(raw, bool):
+        return raw
+    value = str(raw).strip().lower()
+    if value in {"1", "true", "yes", "on"}:
+        return True
+    if value in {"0", "false", "no", "off"}:
+        return False
+    raise ConfigError(f"Invalid {field_name}: {raw!r}. Expected one of: 0, 1")
+
+
+def _parse_optional_string(raw: object) -> str | None:
+    if raw is None:
+        return None
+    value = str(raw).strip()
+    return value or None
+
+
+def _parse_optional_base_url(raw: object, *, field_name: str) -> str | None:
+    value = _parse_optional_string(raw)
+    if value is None:
+        return None
+    if value.startswith(("http://", "https://")):
+        return value
+    raise ConfigError(f"Invalid {field_name}: {value!r}. Expected http:// or https:// URL.")
+
+
+def _default_data_dir() -> Path:
+    return canonical_server_data_dir()
+
+
+def _default_worker_backend() -> str:
+    if platform.system().lower() == "linux":
+        return "bwrap"
+    return "docker"
+
+
+@dataclass(frozen=True)
+class ServerSettings:
+    host: str
+    port: int
+    data_dir: Path
+    token: str | None
+    max_upload_bytes: int
+    max_concurrent_jobs: int
+    worker_backend: str
+    worker_sandbox_mode: str
+    worker_network: str
+    default_model: str | None
+    default_base_url: str | None
+    allow_client_model: bool
+    allow_client_base_url: bool
+    worker_machine_events: bool = True
+
+    @property
+    def allow_unauthenticated_localhost_only(self) -> bool:
+        return self.token is None
+
+    @property
+    def host_is_local(self) -> bool:
+        return self.host.strip().lower() in _LOCAL_HOSTS
+
+    @property
+    def server_model(self) -> str | None:
+        return self.default_model
+
+    @property
+    def server_base_url(self) -> str | None:
+        return self.default_base_url
+
+    @property
+    def allow_client_model_override(self) -> bool:
+        return self.allow_client_model
+
+    @property
+    def allow_client_base_url_override(self) -> bool:
+        return self.allow_client_base_url
+
+
+def resolve_server_settings(
+    *,
+    host: str = "127.0.0.1",
+    port: int = 7070,
+    data_dir: Path | None = None,
+) -> ServerSettings:
+    host_value = host.strip() or "127.0.0.1"
+    port_value = _parse_int(port, field_name="port", default=7070, min_value=1)
+    if port_value > 65535:
+        raise ConfigError(f"Invalid port: {port_value}. Expected <= 65535.")
+
+    env_data_dir = str(env_get("ALYSIS_SERVER_DATA_DIR") or "").strip()
+    if data_dir is not None:
+        data_path = data_dir.expanduser()
+    elif env_data_dir:
+        data_path = Path(env_data_dir).expanduser()
+    else:
+        data_path = _default_data_dir()
+
+    token_raw = str(env_get("ALYSIS_SERVER_TOKEN") or "").strip()
+    token = token_raw or None
+
+    max_upload_bytes = _parse_int(
+        env_get("ALYSIS_SERVER_MAX_UPLOAD_BYTES"),
+        field_name="ALYSIS_SERVER_MAX_UPLOAD_BYTES",
+        default=_DEFAULT_MAX_UPLOAD_BYTES,
+        min_value=1024,
+    )
+    max_concurrent_jobs = _parse_int(
+        env_get("ALYSIS_SERVER_MAX_JOBS"),
+        field_name="ALYSIS_SERVER_MAX_JOBS",
+        default=2,
+        min_value=1,
+    )
+
+    worker_backend = _parse_choice(
+        env_get("ALYSIS_SERVER_WORKER_BACKEND"),
+        field_name="ALYSIS_SERVER_WORKER_BACKEND",
+        default=_default_worker_backend(),
+        allowed=_WORKER_BACKENDS,
+    )
+    if worker_backend == "bwrap" and platform.system().lower() != "linux":
+        raise ConfigError("ALYSIS_SERVER_WORKER_BACKEND=bwrap requires Linux. Use docker instead.")
+
+    worker_sandbox_default = "strict"
+    worker_sandbox_mode = _parse_choice(
+        env_get("ALYSIS_SERVER_WORKER_SANDBOX_MODE"),
+        field_name="ALYSIS_SERVER_WORKER_SANDBOX_MODE",
+        default=worker_sandbox_default,
+        allowed=_SANDBOX_MODES,
+    )
+    worker_network = _parse_choice(
+        env_get("ALYSIS_SERVER_WORKER_NETWORK"),
+        field_name="ALYSIS_SERVER_WORKER_NETWORK",
+        default="on",
+        allowed=_NETWORK_MODES,
+    )
+    default_model = _parse_optional_string(env_get("ALYSIS_SERVER_MODEL"))
+    default_base_url = _parse_optional_base_url(
+        env_get("ALYSIS_SERVER_BASE_URL"),
+        field_name="ALYSIS_SERVER_BASE_URL",
+    )
+    allow_client_base_url = _parse_bool(
+        env_get("ALYSIS_SERVER_ALLOW_CLIENT_BASE_URL"),
+        field_name="ALYSIS_SERVER_ALLOW_CLIENT_BASE_URL",
+        default=False,
+    )
+    allow_client_model = _parse_bool(
+        env_get("ALYSIS_SERVER_ALLOW_CLIENT_MODEL"),
+        field_name="ALYSIS_SERVER_ALLOW_CLIENT_MODEL",
+        default=True,
+    )
+    # Forge worker jobs run with --machine so job status comes from the worker's own
+    # terminal event instead of being inferred from an exit code.
+    worker_machine_events = _parse_bool(
+        env_get("ALYSIS_SERVER_MACHINE_EVENTS"),
+        field_name="ALYSIS_SERVER_MACHINE_EVENTS",
+        default=True,
+    )
+
+    return ServerSettings(
+        host=host_value,
+        port=port_value,
+        data_dir=data_path.resolve(),
+        token=token,
+        max_upload_bytes=max_upload_bytes,
+        max_concurrent_jobs=max_concurrent_jobs,
+        worker_backend=worker_backend,
+        worker_sandbox_mode=worker_sandbox_mode,
+        worker_network=worker_network,
+        default_model=default_model,
+        default_base_url=default_base_url,
+        allow_client_model=allow_client_model,
+        allow_client_base_url=allow_client_base_url,
+        worker_machine_events=worker_machine_events,
+    )