aru-code 0.56.0__tar.gz → 0.58.0__tar.gz

{aru_code-0.56.0/aru_code.egg-info → aru_code-0.58.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aru-code
-Version: 0.56.0
+Version: 0.58.0
 Summary: A Claude Code clone built with Agno agents
 Author-email: Estevao <estevaofon@gmail.com>
 License-Expression: MIT

aru_code-0.58.0/aru/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.58.0"

aru_code-0.58.0/aru/auth.py

@@ -0,0 +1,93 @@
+"""Credential store for provider API keys (OpenCode-parity ``auth.json``).
+
+``/connect`` writes here so users no longer have to hand-edit ``aru.json``
+to wire up a provider. Mirrors OpenCode's ``auth.json``: a flat
+``{ "<provider>": <info> }`` map persisted under the user's home, written
+with ``0600`` permissions so the key isn't world-readable.
+
+Schema (``info``) — a tagged union on ``type`` so future auth methods
+(OAuth, well-known) can slot in beside the current API-key path:
+
+    {"type": "api",   "key": "sk-...",            # built-in provider
+     "base_url": "...", "name": "...",            # extra fields for a
+     "provider_type": "openai", "default_model": "...",  # custom provider
+     "context_limit": 128000}
+    {"type": "local", "base_url": "http://..."}   # keyless (e.g. Ollama)
+
+Consumption lives in :func:`aru.providers.apply_stored_credentials`, which
+layers these onto the in-memory provider registry at startup (and again
+right after ``/connect``) so a stored key takes precedence over the
+provider's ``api_key_env``.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+from pathlib import Path
+from typing import Any
+
+logger = logging.getLogger("aru.auth")
+
+
+def auth_path() -> Path:
+    """Absolute path to the credential file (``~/.aru/auth.json``)."""
+    return Path.home() / ".aru" / "auth.json"
+
+
+def load_auth() -> dict[str, dict[str, Any]]:
+    """Return the full credential map, or ``{}`` when missing/unreadable."""
+    path = auth_path()
+    if not path.is_file():
+        return {}
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, UnicodeDecodeError, json.JSONDecodeError) as exc:
+        logger.warning("Failed to read %s: %s", path, exc)
+        return {}
+    if not isinstance(data, dict):
+        return {}
+    # Drop any malformed (non-dict) entries defensively.
+    return {k: v for k, v in data.items() if isinstance(v, dict)}
+
+
+def get_credential(provider_key: str) -> dict[str, Any] | None:
+    """Return the stored credential for ``provider_key`` or ``None``."""
+    return load_auth().get(provider_key)
+
+
+def _write_auth(data: dict[str, dict[str, Any]]) -> None:
+    """Write the credential map atomically-ish with ``0600`` perms."""
+    path = auth_path()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    tmp = path.with_suffix(".json.tmp")
+    tmp.write_text(json.dumps(data, indent=2), encoding="utf-8")
+    # Lock down before the rename so the secret is never briefly group/other
+    # readable. chmod is a partial no-op on Windows but harmless.
+    try:
+        os.chmod(tmp, 0o600)
+    except OSError:
+        pass
+    os.replace(tmp, path)
+    try:
+        os.chmod(path, 0o600)
+    except OSError:
+        pass
+
+
+def set_credential(provider_key: str, info: dict[str, Any]) -> None:
+    """Store (or replace) the credential for ``provider_key``."""
+    data = load_auth()
+    data[provider_key] = info
+    _write_auth(data)
+
+
+def remove_credential(provider_key: str) -> bool:
+    """Delete the credential for ``provider_key``. Returns ``True`` if removed."""
+    data = load_auth()
+    if provider_key not in data:
+        return False
+    del data[provider_key]
+    _write_auth(data)
+    return True

{aru_code-0.56.0 → aru_code-0.58.0}/aru/commands.py

@@ -15,6 +15,7 @@ from aru.display import console
 SLASH_COMMANDS = [
     ("/help", "Show help and available commands", "/help"),
     ("/plan", "Create an implementation plan", "/plan <task>"),
+    ("/connect", "Connect a provider — store an API key", "/connect [provider|list|logout]"),
     ("/model", "Switch model/provider", "/model [provider/model]"),
     ("/reasoning", "Set reasoning effort for this session", "/reasoning [low|medium|high|max|off|clear]"),
     ("/sessions", "List recent sessions", "/sessions"),
@@ -79,6 +80,389 @@ def ask_yes_no(prompt: str) -> bool:
         return False
 
 
+# ---------------------------------------------------------------------------
+# /connect — interactive provider connection (OpenCode `auth login` parity)
+# ---------------------------------------------------------------------------
+
+# Where to grab an API key, shown as a hint before the key prompt. Keyed by
+# built-in provider id. Providers absent here just skip the hint.
+_PROVIDER_KEY_HINTS: dict[str, str] = {
+    "anthropic": "Create a key at https://console.anthropic.com/settings/keys",
+    "openai": "Create a key at https://platform.openai.com/api-keys",
+    "openrouter": "Create a key at https://openrouter.ai/keys",
+    "groq": "Create a key at https://console.groq.com/keys",
+    "deepseek": "Create a key at https://platform.deepseek.com/api_keys",
+    "ollama": "Local provider — no API key needed.",
+}
+
+# Display order for the provider menu (most common first); anything not
+# listed is appended afterwards in registry order.
+_PROVIDER_MENU_ORDER = ["anthropic", "openai", "openrouter", "groq", "deepseek", "ollama"]
+
+_OTHER_SENTINEL = "__other__"
+
+
+def _resolve_connect_ui():
+    """Return the active ``ctx.ui`` adapter, falling back to a REPL one."""
+    from aru.runtime import get_ctx
+    try:
+        ctx = get_ctx()
+    except LookupError:
+        ctx = None
+    if ctx is not None:
+        from aru.permissions import _resolve_ui
+        return _resolve_ui(ctx)
+    from aru.ui import ReplUI
+    return ReplUI()
+
+
+def _mask_key(key: str) -> str:
+    """Mask an API key for display: keep a short head/tail, hide the middle."""
+    if not key:
+        return "(empty)"
+    if len(key) <= 8:
+        return "****"
+    return f"{key[:4]}…{key[-4:]}"
+
+
+def handle_connect_command(args: str, session=None):
+    """``/connect`` — connect to an LLM provider by storing an API key.
+
+    OpenCode-parity ``auth login`` flow: pick a provider, paste a key, then
+    pick a model — all in one go. The credential is persisted to
+    ``~/.aru/auth.json`` and live immediately (no ``aru.json`` editing) and
+    the chosen model becomes the session model. All interaction goes through
+    ``ctx.ui`` so the same handler drives both the TUI (modals) and the REPL.
+
+    Subcommands:
+        ``/connect``              Interactive: select a provider, enter a key.
+        ``/connect <provider>``   Skip selection; connect that provider.
+        ``/connect list``         Show stored credentials + active env vars.
+        ``/connect logout [p]``   Remove a stored credential.
+
+    Returns the new ``model_ref`` string when the user opts to switch models
+    after connecting (so the caller can sync the UI), else ``None``.
+    """
+    ui = _resolve_connect_ui()
+    arg = (args or "").strip()
+    parts = arg.split(None, 1)
+    sub = parts[0].lower() if parts else ""
+    rest = parts[1].strip() if len(parts) > 1 else ""
+
+    if sub == "list":
+        _connect_list(ui)
+        return None
+    if sub in ("logout", "disconnect", "remove"):
+        _connect_logout(ui, rest)
+        return None
+    return _connect_login(ui, arg, session)
+
+
+def _provider_menu() -> list[tuple[str, str]]:
+    """Build ``(key, label)`` provider menu entries in display order."""
+    from aru.providers import list_providers
+
+    providers = list_providers()
+    ordered_keys = [k for k in _PROVIDER_MENU_ORDER if k in providers]
+    ordered_keys += [k for k in providers if k not in ordered_keys]
+    entries: list[tuple[str, str]] = []
+    for k in ordered_keys:
+        p = providers[k]
+        entries.append((k, f"{p.name}  ({k})"))
+    return entries
+
+
+def _connect_login(ui, preselect: str, session):
+    """Provider selection → key entry → store → optional model switch."""
+    from aru import auth
+    from aru.providers import apply_stored_credentials, get_provider, list_providers
+
+    entries = _provider_menu()
+
+    # ── 1. Resolve which provider to connect ─────────────────────────────
+    provider_key: str | None = None
+    if preselect:
+        low = preselect.lower()
+        if low in ("other", "custom"):
+            provider_key = _OTHER_SENTINEL
+        else:
+            providers = list_providers()
+            if low in providers:
+                provider_key = low
+            else:
+                # Match by display name (case-insensitive).
+                for k, p in providers.items():
+                    if p.name.lower() == low:
+                        provider_key = k
+                        break
+            if provider_key is None:
+                ui.notify(
+                    f"Unknown provider '{preselect}'. Run /connect with no "
+                    "argument to pick from the list.",
+                    "warn",
+                )
+                return None
+    else:
+        labels = [label for _, label in entries]
+        labels.append("Other (custom OpenAI-compatible endpoint)")
+        idx = ui.ask_choice(
+            labels,
+            title="Connect a provider — select one",
+            cancel_value=None,
+        )
+        if idx is None:
+            ui.notify("Connect cancelled.", "warn")
+            return None
+        provider_key = _OTHER_SENTINEL if idx == len(entries) else entries[idx][0]
+
+    # ── 2. Gather provider details + the credential ──────────────────────
+    if provider_key == _OTHER_SENTINEL:
+        return _connect_custom(ui, session)
+
+    provider = get_provider(provider_key)
+    display_name = provider.name if provider else provider_key
+    hint = _PROVIDER_KEY_HINTS.get(provider_key)
+    if hint:
+        ui.print(hint)
+
+    # Keyless local providers (Ollama) — store a base URL instead of a key.
+    if provider is not None and not provider.api_key_env:
+        default_url = provider.base_url or "http://localhost:11434"
+        base_url = ui.ask_text(
+            f"Base URL for {display_name}:", default=default_url
+        ).strip()
+        if not base_url:
+            base_url = default_url
+        auth.set_credential(provider_key, {"type": "local", "base_url": base_url})
+        apply_stored_credentials()
+        ui.print(f"Connected {display_name} at {base_url}.")
+    else:
+        key = ui.ask_text(
+            f"Enter your API key for {display_name}:", password=True
+        ).strip()
+        if not key:
+            ui.notify("Connect cancelled — no key entered.", "warn")
+            return None
+        auth.set_credential(provider_key, {"type": "api", "key": key})
+        apply_stored_credentials()
+        ui.print(f"Connected {display_name} — key stored in {auth.auth_path()}.")
+
+    return _select_model(ui, provider_key, session)
+
+
+def _connect_custom(ui, session):
+    """Connect a custom OpenAI-compatible provider (the 'Other' path)."""
+    import re
+
+    from aru import auth
+    from aru.providers import apply_stored_credentials
+
+    pid = ui.ask_text(
+        "Provider id (lowercase letters, digits, hyphens):"
+    ).strip().lower()
+    if not pid:
+        ui.notify("Connect cancelled.", "warn")
+        return None
+    if not re.fullmatch(r"[a-z0-9-]+", pid):
+        ui.notify("Invalid id — use only a-z, 0-9 and hyphens.", "error")
+        return None
+
+    base_url = ui.ask_text(
+        "Base URL (OpenAI-compatible, e.g. https://api.example.com/v1):"
+    ).strip()
+    if not base_url:
+        ui.notify("Connect cancelled — a base URL is required.", "warn")
+        return None
+
+    name = ui.ask_text("Display name (optional):", default=pid).strip() or pid
+    default_model = ui.ask_text("Default model id (optional):").strip()
+    key = ui.ask_text(f"Enter your API key for {name}:", password=True).strip()
+    if not key:
+        ui.notify("Connect cancelled — no key entered.", "warn")
+        return None
+
+    info = {
+        "type": "api",
+        "key": key,
+        "base_url": base_url,
+        "name": name,
+        "provider_type": "openai",
+    }
+    if default_model:
+        info["default_model"] = default_model
+    auth.set_credential(pid, info)
+    apply_stored_credentials()
+    ui.print(f"Connected {name} ({pid}) — key stored in {auth.auth_path()}.")
+    # The custom setup already asked for a model id — honour it directly
+    # instead of re-prompting. Otherwise offer the (free-text) selector.
+    if default_model and session is not None:
+        session.model_ref = f"{pid}/{default_model}"
+        ui.print(f"Model set to {pid}/{default_model}.")
+        return f"{pid}/{default_model}"
+    return _select_model(ui, pid, session)
+
+
+_CUSTOM_MODEL_LABEL = "Enter a model id manually…"
+
+
+def _list_provider_models(provider) -> list[str]:
+    """Return the provider's model names, deduped by underlying API id.
+
+    The registry carries both clean aliases and dated ids that map to the
+    same model (e.g. ``claude-sonnet-4-5`` and ``claude-sonnet-4-5-20250929``).
+    Keep the first occurrence — the clean alias — so the picker stays tidy.
+    """
+    seen_ids: set[str] = set()
+    out: list[str] = []
+    for name, cfg in provider.models.items():
+        mid = cfg.get("id", name) if isinstance(cfg, dict) else name
+        if mid in seen_ids:
+            continue
+        seen_ids.add(mid)
+        out.append(name)
+    return out
+
+
+def _model_id_for(provider, name: str) -> str:
+    cfg = provider.models.get(name)
+    return cfg.get("id", name) if isinstance(cfg, dict) else name
+
+
+def _select_model(ui, provider_key: str, session):
+    """Pick a model for the just-connected provider (OpenCode-style).
+
+    Shows a menu of the provider's models with its default pre-highlighted,
+    plus an escape hatch for a model id not in the registry. Providers
+    without a static model list (Ollama, OpenRouter, custom) fall back to a
+    free-text id prompt. Esc keeps the current model. Returns the new
+    ``model_ref`` when changed, else ``None``.
+    """
+    if session is None:
+        return None
+    from aru.providers import get_provider
+
+    provider = get_provider(provider_key)
+    if provider is None:
+        return None
+
+    model_names = _list_provider_models(provider)
+    chosen: str | None = None
+
+    if model_names:
+        # Pre-highlight whichever name resolves to the provider's default id.
+        default_idx = 0
+        if provider.default_model:
+            default_id = _model_id_for(provider, provider.default_model)
+            for i, n in enumerate(model_names):
+                if _model_id_for(provider, n) == default_id:
+                    default_idx = i
+                    break
+        labels = [*model_names, _CUSTOM_MODEL_LABEL]
+        idx = ui.ask_choice(
+            labels,
+            title=f"Select a model for {provider.name}",
+            default=default_idx,
+            cancel_value=None,
+        )
+        if idx is None:
+            return None  # keep current model
+        if idx == len(model_names):
+            chosen = ui.ask_text(
+                "Model id:", default=provider.default_model or ""
+            ).strip()
+        else:
+            chosen = model_names[idx]
+    else:
+        chosen = ui.ask_text(
+            f"Model id for {provider.name}:",
+            default=provider.default_model or "",
+        ).strip()
+
+    if not chosen:
+        return None
+    new_ref = f"{provider_key}/{chosen}"
+    session.model_ref = new_ref
+    ui.print(f"Model set to {new_ref}.")
+    return new_ref
+
+
+def _connect_list(ui) -> None:
+    """Show stored credentials and any active provider env vars."""
+    import os as _os
+
+    from aru import auth
+    from aru.providers import get_provider, list_providers
+
+    lines: list[str] = []
+    stored = auth.load_auth()
+    lines.append(f"Stored credentials ({auth.auth_path()}):")
+    if stored:
+        for key, info in sorted(stored.items()):
+            provider = get_provider(key)
+            name = provider.name if provider else key
+            itype = info.get("type", "api")
+            if itype == "local":
+                detail = info.get("base_url", "")
+            else:
+                detail = _mask_key(info.get("key", ""))
+            lines.append(f"  • {name} ({key})  [{itype}]  {detail}")
+    else:
+        lines.append("  (none — run /connect to add one)")
+
+    # Active env vars that back a provider (these still work as a fallback).
+    active: list[str] = []
+    for key, provider in list_providers().items():
+        env = provider.api_key_env
+        if env and _os.environ.get(env):
+            active.append(f"  • {provider.name} ({key})  {env}")
+    if active:
+        lines.append("")
+        lines.append("Active environment variables:")
+        lines.extend(active)
+
+    ui.print("\n".join(lines))
+
+
+def _connect_logout(ui, arg: str) -> None:
+    """Remove a stored credential (interactive picker when no arg given)."""
+    from aru import auth
+    from aru.providers import forget_credential, get_provider
+
+    stored = auth.load_auth()
+    if not stored:
+        ui.notify("No stored credentials to remove.", "warn")
+        return
+
+    keys = sorted(stored.keys())
+    if arg:
+        target = arg.lower()
+        if target not in stored:
+            ui.notify(f"No stored credential for '{arg}'.", "warn")
+            return
+    else:
+        labels = []
+        for k in keys:
+            provider = get_provider(k)
+            name = provider.name if provider else k
+            labels.append(f"{name} ({k})  [{stored[k].get('type', 'api')}]")
+        idx = ui.ask_choice(
+            labels, title="Remove which credential?", cancel_value=None
+        )
+        if idx is None:
+            ui.notify("Logout cancelled.", "warn")
+            return
+        target = keys[idx]
+
+    auth.remove_credential(target)
+    forget_credential(target)
+    provider = get_provider(target)
+    name = provider.name if provider else target
+    note = ""
+    if provider and provider.api_key_env:
+        note = f" Falls back to ${provider.api_key_env} if set."
+    ui.print(f"Disconnected {name}.{note}")
+
+
 def handle_subagents_command(session) -> None:
     """Render the session's sub-agent trace tree (`/subagents`).
 
@@ -685,6 +1069,7 @@ def _show_help(config) -> None:
     table.add_column("Description", style="dim")
 
     table.add_row("/plan <task>", "Create detailed implementation plan")
+    table.add_row("/connect [provider]", "Connect a provider — store API key (list/logout)")
     table.add_row("/model [provider/model]", "Switch models (e.g., ollama/llama3.1, openai/gpt-4o)")
     table.add_row("/sessions", "List recent sessions")
     table.add_row("/commands", "List custom commands")

{aru_code-0.56.0 → aru_code-0.58.0}/aru/providers.py

@@ -41,6 +41,11 @@ class ProviderConfig:
     models: dict[str, dict[str, Any]] = field(default_factory=dict)
     options: dict[str, Any] = field(default_factory=dict)
     reasoning_effort: str | None = None  # provider-level default effort
+    # Resolved API key injected by `/connect` (via apply_stored_credentials).
+    # Takes precedence over `api_key_env` so a credential the user stored
+    # interactively wins over a stale shell env var. Left None for providers
+    # configured only through env vars (the legacy path).
+    api_key: str | None = None
 
 
 # Built-in providers with sensible defaults
@@ -857,12 +862,90 @@ def _create_provider_model(
 
 
 def _resolve_api_key(provider: ProviderConfig) -> str | None:
-    """Resolve API key from environment variable."""
+    """Resolve the API key for a provider.
+
+    Priority: a key stored via ``/connect`` (``provider.api_key``, populated
+    by :func:`apply_stored_credentials`) wins over the provider's
+    ``api_key_env`` environment variable. Existing env-only setups are
+    unaffected — ``api_key`` stays ``None`` until the user connects.
+    """
+    if provider.api_key:
+        return provider.api_key
     if provider.api_key_env:
         return os.environ.get(provider.api_key_env)
     return None
 
 
+def apply_stored_credentials() -> None:
+    """Layer credentials from ``~/.aru/auth.json`` onto the provider registry.
+
+    Called at startup (after config load) and again right after ``/connect``
+    so the in-memory registry reflects stored keys without a restart. For a
+    built-in provider this sets ``api_key`` (and any ``base_url`` override);
+    for an unknown provider id it registers a fresh OpenAI-compatible
+    ``ProviderConfig`` so custom endpoints connected via ``/connect`` work
+    with no ``aru.json`` editing. Best-effort: a missing/garbled file is a
+    no-op.
+    """
+    try:
+        from aru import auth
+        data = auth.load_auth()
+    except Exception as exc:  # pragma: no cover — never fail startup over auth
+        logger.warning("apply_stored_credentials: %s", exc)
+        return
+    if not data:
+        return
+
+    from aru.context import MODEL_CONTEXT_LIMITS
+
+    for key, info in data.items():
+        if not isinstance(info, dict):
+            continue
+        api_key = info.get("key")
+        base_url = info.get("base_url")
+        default_model = info.get("default_model") or None
+
+        existing = _providers.get(key)
+        if existing is not None:
+            if api_key:
+                existing.api_key = api_key
+                # Populate the env var too (without clobbering an explicit
+                # one) so any code path that reads it directly still works.
+                if existing.api_key_env:
+                    os.environ.setdefault(existing.api_key_env, api_key)
+            if base_url:
+                existing.base_url = base_url
+            if default_model:
+                existing.default_model = default_model
+        else:
+            provider_type = info.get("provider_type", "openai")
+            _providers[key] = ProviderConfig(
+                name=info.get("name", key),
+                api_key_env=info.get("api_key_env"),
+                base_url=base_url,
+                default_model=default_model,
+                models={},
+                options={"_provider_type": provider_type},
+                api_key=api_key,
+            )
+
+        # Honour an explicit context window for the default model.
+        cl = info.get("context_limit")
+        if isinstance(cl, int) and cl > 0 and default_model:
+            MODEL_CONTEXT_LIMITS.setdefault(default_model, cl)
+
+
+def forget_credential(provider_key: str) -> None:
+    """Clear an in-memory stored key so the provider falls back to its env var.
+
+    Paired with ``auth.remove_credential`` on ``/connect logout`` — the file
+    write removes persistence, this drops the live override.
+    """
+    provider = _providers.get(provider_key)
+    if provider is not None:
+        provider.api_key = None
+
+
 # ---------------------------------------------------------------------------
 # Convenience: list available models for display
 # ---------------------------------------------------------------------------

{aru_code-0.56.0 → aru_code-0.58.0}/aru/tools/plan_mode.py

@@ -24,6 +24,7 @@ specialized read-only tool set and instructions.
 
 from __future__ import annotations
 
+import asyncio
 import sys
 
 from rich.panel import Panel
@@ -197,7 +198,18 @@ async def exit_plan_mode(plan: str) -> str:
     session.set_plan(task=task_label, plan_content=plan_text)
     n_steps = len(session.plan_steps)
 
-    approved, feedback = _prompt_plan_approval(session.plan_steps, n_steps)
+    # ``exit_plan_mode`` is an async tool, so ``agent_factory`` awaits it
+    # directly on the event-loop thread (no ``_thread_tool`` worker hop like
+    # sync tools get). ``_prompt_plan_approval`` is synchronous and in TUI
+    # mode invokes ``TuiUI.ask_choice`` → ``App.call_from_thread``, which
+    # raises "must run in a different thread from the app" when called from
+    # the loop thread it targets. Hop to a worker thread first so the modal
+    # dispatch path matches the sync-tool and runner-auto-exit paths
+    # (``runner.py`` does the same). ``asyncio.to_thread`` copies the
+    # contextvars snapshot, so ``get_ctx()`` inside still resolves.
+    approved, feedback = await asyncio.to_thread(
+        _prompt_plan_approval, session.plan_steps, n_steps
+    )
 
     # The approval prompt already rendered the plan panel inline, so suppress
     # the runner's coalesced end-of-batch render to avoid a duplicate.