aria-code 0.167.0__py3-none-win_amd64.whl

aria_code/apps/cli/google_login.py

@@ -0,0 +1,239 @@
+"""Google sign-in for the CLI, following RFC 8252's native-app flow.
+
+The desktop app receives its OAuth callback through the arthera:// URL scheme it
+registers with the OS. A CLI cannot own a scheme, so it does what RFC 8252
+prescribes instead: bind an ephemeral port on loopback, hand that port to the
+gateway, and let the browser deliver the callback there.
+
+Three properties are worth keeping in mind when editing this:
+
+* Only a port number is sent to the gateway, never a redirect URL. The callback
+  builds the loopback address itself, so a caller cannot point the credential
+  delivery anywhere else.
+* What arrives on loopback is a single-use handoff code, not a token. The code is
+  redeemed over POST, so the browser history never holds a credential.
+* The gateway returns a *Google* ID token. The Arthera API authenticates with
+  *Firebase* ID tokens, so the credential is exchanged with Identity Toolkit
+  before it is stored — the same exchange the desktop app performs through the
+  Firebase SDK.
+"""
+
+from __future__ import annotations
+
+import http.server
+import json
+import secrets
+import socket
+import threading
+import urllib.parse
+import urllib.request
+import webbrowser
+from typing import Any, Dict, Optional
+
+# The Firebase Web API key is public by design — it identifies the project and
+# authorises nothing on its own. It is the same value the web and desktop
+# clients ship in their bundles.
+FIREBASE_WEB_API_KEY = "AIzaSyC9iYiroXgxTu2ANUPIjeGbITVzWEUjXAI"
+IDENTITY_TOOLKIT_SIGN_IN_WITH_IDP = (
+    "https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp"
+)
+
+_LOGIN_TIMEOUT_SECONDS = 300
+
+
+class _CallbackResult:
+    def __init__(self) -> None:
+        self.params: Dict[str, str] = {}
+        self.received = threading.Event()
+
+
+def _make_handler(result: _CallbackResult, expected_path: str):
+    class Handler(http.server.BaseHTTPRequestHandler):
+        def do_GET(self):  # noqa: N802 - name fixed by BaseHTTPRequestHandler
+            parsed = urllib.parse.urlparse(self.path)
+            if parsed.path != expected_path:
+                self.send_response(404)
+                self.end_headers()
+                return
+
+            result.params = {
+                k: v[0] for k, v in urllib.parse.parse_qs(parsed.query).items()
+            }
+            ok = "handoff_code" in result.params
+            body = (
+                "<html><body style='font-family:system-ui;padding:3rem'>"
+                f"<h2>{'Signed in.' if ok else 'Sign-in failed.'}</h2>"
+                "<p>You can close this tab and return to the terminal.</p>"
+                "</body></html>"
+            ).encode("utf-8")
+
+            self.send_response(200 if ok else 400)
+            self.send_header("Content-Type", "text/html; charset=utf-8")
+            self.send_header("Content-Length", str(len(body)))
+            self.end_headers()
+            self.wfile.write(body)
+            result.received.set()
+
+        def log_message(self, *args):  # keep the terminal clean
+            return
+
+    return Handler
+
+
+def _free_port() -> int:
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+        sock.bind(("127.0.0.1", 0))
+        return int(sock.getsockname()[1])
+
+
+def _post_json(url: str, payload: Dict[str, Any], timeout: int = 20) -> Dict[str, Any]:
+    request = urllib.request.Request(
+        url,
+        data=json.dumps(payload).encode("utf-8"),
+        headers={"Content-Type": "application/json"},
+        method="POST",
+    )
+    with urllib.request.urlopen(request, timeout=timeout) as response:
+        return json.loads(response.read().decode("utf-8"))
+
+
+def exchange_google_token_for_firebase(google_id_token: str) -> Dict[str, Any]:
+    """Trade a verified Google ID token for a Firebase session.
+
+    requestUri is required by the endpoint but only has to be a well-formed URL
+    the project would accept; nothing is fetched from it.
+    """
+    body = {
+        "postBody": urllib.parse.urlencode(
+            {"id_token": google_id_token, "providerId": "google.com"}
+        ),
+        "requestUri": "http://127.0.0.1",
+        "returnIdpCredential": True,
+        "returnSecureToken": True,
+    }
+    return _post_json(
+        f"{IDENTITY_TOOLKIT_SIGN_IN_WITH_IDP}?key={FIREBASE_WEB_API_KEY}", body
+    )
+
+
+def login_api_url(configured: str) -> str:
+    """Which server serves Google sign-in for this install.
+
+    Sign-in is a route of the Arthera gateway, and the credential it returns is
+    used against that gateway. The saved ``api_url`` is something else: a
+    fresh install writes ``http://localhost:8000`` there, a developer backend
+    that has no such route, so /login opened a browser on a page reading
+    ``{"detail":"Not Found"}`` (or on a refused connection when nothing listens).
+
+    ``ARIA_API_URL`` wins, as it does for the gateway provider. Otherwise a
+    loopback ``api_url`` means "no real server was ever configured" and the
+    production gateway is used. Any other configured server is respected.
+    """
+    import os
+
+    from ...providers.llm.arthera_gateway import DEFAULT_API_URL
+
+    from aria_code.service_endpoints import current_url
+    configured = current_url(configured)
+    override = current_url(os.getenv("ARIA_API_URL", "").strip())
+    if override:
+        return override.rstrip("/")
+    host = (urllib.parse.urlparse(configured or "").hostname or "").lower()
+    if not configured or host in {"localhost", "127.0.0.1", "::1", "0.0.0.0"}:
+        return DEFAULT_API_URL
+    return configured.rstrip("/")
+
+
+def login_page_origin(api_url: str) -> str:
+    """Where the browser is sent to sign in.
+
+    The same Arthera login route is also served on the brand's auth host
+    (auth.arthera.xyz), so the address bar can read like the product, the
+    way Claude Code and Codex open their own accounts site, rather than an API
+    hostname. Opt-in with ARIA_AUTH_URL until that path has been exercised end
+    to end; the handoff exchange below always goes to the API origin.
+    """
+    import os
+
+    override = os.getenv("ARIA_AUTH_URL", "").strip()
+    return (override or api_url).rstrip("/")
+
+
+def run_google_login(api_url: str, region: str = "GLOBAL") -> Dict[str, Any]:
+    """Drive the whole flow and return the stored-credential fields.
+
+    Raises RuntimeError with a message suitable for display on any failure.
+    """
+    api_url = api_url.rstrip("/")
+    port = _free_port()
+    callback_path = "/callback"
+    result = _CallbackResult()
+
+    server = http.server.HTTPServer(
+        ("127.0.0.1", port), _make_handler(result, callback_path)
+    )
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+
+    try:
+        login_url = (
+            f"{login_page_origin(api_url)}/api/v2/auth/google/login?"
+            + urllib.parse.urlencode(
+                {"platform": "cli", "region": region, "port": port}
+            )
+        )
+        opened = webbrowser.open(login_url)
+        if not opened:
+            raise RuntimeError(
+                "Could not open a browser. Visit this URL manually:\n  " + login_url
+            )
+
+        if not result.received.wait(timeout=_LOGIN_TIMEOUT_SECONDS):
+            raise RuntimeError(
+                f"Timed out after {_LOGIN_TIMEOUT_SECONDS}s waiting for the browser."
+            )
+    finally:
+        server.shutdown()
+        server.server_close()
+
+    if "message" in result.params and "handoff_code" not in result.params:
+        raise RuntimeError(result.params["message"])
+
+    handoff_code = result.params.get("handoff_code")
+    if not handoff_code:
+        raise RuntimeError("The sign-in callback did not carry a handoff code.")
+
+    try:
+        exchanged = _post_json(
+            f"{api_url}/api/v2/auth/handoff/exchange", {"code": handoff_code}
+        )
+    except Exception as exc:
+        raise RuntimeError(f"Could not redeem the sign-in handoff: {exc}") from exc
+
+    payload = exchanged.get("data") or {}
+    google_id_token = payload.get("token")
+    if not google_id_token:
+        raise RuntimeError("The sign-in handoff did not contain a credential.")
+
+    try:
+        session = exchange_google_token_for_firebase(google_id_token)
+    except Exception as exc:
+        raise RuntimeError(f"Firebase rejected the Google credential: {exc}") from exc
+
+    id_token = session.get("idToken")
+    if not id_token:
+        raise RuntimeError("Firebase did not return a session token.")
+
+    return {
+        "auth_token": id_token,
+        "refresh_token": session.get("refreshToken"),
+        # expiresIn is seconds-as-string; the caller decides how to persist it.
+        "expires_in": session.get("expiresIn"),
+        "user_id": session.get("localId") or payload.get("uid"),
+        "email": session.get("email") or payload.get("email"),
+        "display_name": session.get("displayName") or payload.get("display_name"),
+        "provider": "google.com",
+    }
+
+
+__all__ = ["run_google_login", "exchange_google_token_for_firebase", "login_api_url", "login_page_origin"]

aria_code/apps/cli/handlers/__init__.py

@@ -0,0 +1,11 @@
+"""apps/cli/handlers — deterministic pre-LLM response handlers extracted from aria_cli.py."""
+from .broker_handlers import handle_broker_query
+from .realty_handlers import handle_realty_query
+from .chart_handlers import handle_stock_chart_analysis_direct, handle_stock_chart_analysis
+
+__all__ = [
+    "handle_broker_query",
+    "handle_realty_query",
+    "handle_stock_chart_analysis_direct",
+    "handle_stock_chart_analysis",
+]

aria_code/apps/cli/handlers/broker_handlers.py

@@ -0,0 +1,122 @@
+"""Deterministic broker data handler extracted from aria_cli.py."""
+from __future__ import annotations
+
+from typing import Callable
+
+
+def handle_broker_query(
+    message: str,
+    *,
+    has_brokers: bool,
+    is_broker_intent: Callable[[str], bool],
+    get_broker_registry: Callable,
+) -> dict:
+    """Deterministic broker data path for models without reliable tool_calls.
+
+    When the user asks about their portfolio/account and no tool-call model is
+    available, fetch the data directly and return a pre-formatted markdown
+    response — same data the LLM tool would have provided.
+    """
+    if not has_brokers:
+        return {"success": False, "error": "brokers_not_available"}
+    if not is_broker_intent(message):
+        return {"success": False, "error": "not_broker_query"}
+
+    try:
+        _reg = get_broker_registry()
+        broker = _reg.active()
+        if not broker or not broker.is_connected:
+            return {
+                "success": True,
+                "response": (
+                    "## 账户未连接\n\n"
+                    "当前没有已连接的券商账户。\n\n"
+                    "请运行 `/broker connect <id>` 或 `/broker list` 查看可用账户。"
+                ),
+                "tools_used": ["broker_query"],
+            }
+
+        _msg_lower = message.lower()
+        lines = [f"## {broker.label} 账户信息\n"]
+
+        _want_positions = any(k in _msg_lower for k in (
+            "持仓", "position", "portfolio", "仓位", "我的股票", "持有",
+        ))
+        _want_orders = any(k in _msg_lower for k in (
+            "订单", "order", "委托", "成交", "交易记录",
+        ))
+        _want_account = any(k in _msg_lower for k in (
+            "余额", "balance", "账户", "account", "资金", "cash", "净值",
+        ))
+        if not (_want_positions or _want_orders or _want_account):
+            _want_account = True
+            _want_positions = True
+
+        if _want_account:
+            try:
+                acct = broker.account_info()
+                lines.append("### 资金概况")
+                lines.append(f"- **总资产**: {acct.currency} {acct.total_assets:,.2f}")
+                lines.append(f"- **可用资金**: {acct.currency} {acct.available_cash:,.2f}")
+                if acct.market_value is not None:
+                    lines.append(f"- **持仓市值**: {acct.currency} {acct.market_value:,.2f}")
+                if acct.unrealized_pnl is not None:
+                    _pnl_sign = "+" if acct.unrealized_pnl >= 0 else ""
+                    lines.append(f"- **浮动盈亏**: {_pnl_sign}{acct.unrealized_pnl:,.2f}")
+                lines.append("")
+            except Exception as _ae:
+                lines.append(f"*获取账户信息失败: {_ae}*\n")
+
+        if _want_positions:
+            try:
+                positions = broker.positions()
+                if positions:
+                    lines.append("### 当前持仓")
+                    lines.append("| 代码 | 名称 | 数量 | 成本 | 现价 | 盈亏% |")
+                    lines.append("|------|------|------|------|------|-------|")
+                    for p in positions[:15]:
+                        _pct = (
+                            f"{p.unrealized_pnl_pct:+.2f}%"
+                            if p.unrealized_pnl_pct is not None else "N/A"
+                        )
+                        _cost = f"{p.avg_cost:.2f}" if p.avg_cost is not None else "N/A"
+                        _price = f"{p.current_price:.2f}" if p.current_price is not None else "N/A"
+                        lines.append(
+                            f"| {p.symbol} | {p.name or '-'} | {p.qty:,} "
+                            f"| {_cost} | {_price} | {_pct} |"
+                        )
+                    if len(positions) > 15:
+                        lines.append(f"\n*共 {len(positions)} 只持仓，仅显示前 15 只*")
+                else:
+                    lines.append("*当前无持仓*")
+                lines.append("")
+            except Exception as _pe:
+                lines.append(f"*获取持仓失败: {_pe}*\n")
+
+        if _want_orders:
+            try:
+                orders = broker.orders()
+                if orders:
+                    lines.append("### 最近委托")
+                    lines.append("| 代码 | 方向 | 数量 | 价格 | 状态 |")
+                    lines.append("|------|------|------|------|------|")
+                    for o in orders[:10]:
+                        _price_str = f"{o.price:.2f}" if o.price else "市价"
+                        lines.append(
+                            f"| {o.symbol} | {'买入' if o.side=='buy' else '卖出'} "
+                            f"| {o.qty:,} | {_price_str} | {o.status} |"
+                        )
+                else:
+                    lines.append("*暂无委托记录*")
+                lines.append("")
+            except Exception as _oe:
+                lines.append(f"*获取委托记录失败: {_oe}*\n")
+
+        lines.append("*以上数据来自券商 API，不构成投资建议*")
+        return {
+            "success": True,
+            "response": "\n".join(lines),
+            "tools_used": ["broker_query"],
+        }
+    except Exception as exc:
+        return {"success": False, "error": str(exc)}