ccproxy-api 0.1.6__py3-none-any.whl → 0.2.0__py3-none-any.whl

ccproxy/{api/routes → plugins/permissions}/mcp.py

@@ -5,22 +5,23 @@ Provides MCP server functionality including permission checking tools.
 
 from typing import Annotated
 
-from fastapi import FastAPI
-from fastapi_mcp import FastApiMCP  # type: ignore[import-untyped]
+from fastapi import APIRouter, FastAPI
+from fastapi_mcp import FastApiMCP
 from pydantic import BaseModel, ConfigDict, Field
-from structlog import get_logger
 
 from ccproxy.api.dependencies import SettingsDep
-from ccproxy.api.services.permission_service import get_permission_service
-from ccproxy.models.permissions import PermissionStatus
-from ccproxy.models.responses import (
+from ccproxy.core.logging import get_plugin_logger
+
+from .models import (
+    PermissionStatus,
     PermissionToolAllowResponse,
     PermissionToolDenyResponse,
     PermissionToolPendingResponse,
 )
+from .service import get_permission_service
 
 
-logger = get_logger(__name__)
+logger = get_plugin_logger()
 
 
 class PermissionCheckRequest(BaseModel):
@@ -125,6 +126,32 @@ async def check_permission(
         return PermissionToolDenyResponse(message="Permission request timed out")
 
 
+# Create a router for the plugin system
+
+mcp_router = APIRouter()
+
+
+@mcp_router.post(
+    "/permission/check",
+    operation_id="check_permission",
+    summary="Check permissions for a tool call",
+    description="Validates whether a tool call should be allowed based on security rules",
+    response_model=PermissionToolAllowResponse
+    | PermissionToolDenyResponse
+    | PermissionToolPendingResponse,
+)
+async def permission_endpoint(
+    request: PermissionCheckRequest,
+    settings: SettingsDep,
+) -> (
+    PermissionToolAllowResponse
+    | PermissionToolDenyResponse
+    | PermissionToolPendingResponse
+):
+    """Check permissions for a tool call."""
+    return await check_permission(request, settings)
+
+
 def setup_mcp(app: FastAPI) -> None:
     """Set up MCP server on the given FastAPI app.
 

ccproxy/{models/permissions.py → plugins/permissions/models.py}

@@ -4,8 +4,9 @@ import asyncio
 import uuid
 from datetime import UTC, datetime
 from enum import Enum
+from typing import Annotated, Any, Literal
 
-from pydantic import BaseModel, Field, PrivateAttr
+from pydantic import BaseModel, ConfigDict, Field, PrivateAttr
 
 
 class PermissionStatus(Enum):
@@ -113,3 +114,66 @@ class PermissionEvent(BaseModel):
     resolved_at: str | None = None
     expired_at: str | None = None
     message: str | None = None
+
+
+class PermissionToolAllowResponse(BaseModel):
+    """Response model for allowed permission tool requests."""
+
+    behavior: Annotated[Literal["allow"], Field(description="Permission behavior")] = (
+        "allow"
+    )
+    updated_input: Annotated[
+        dict[str, Any],
+        Field(
+            description="Updated input parameters for the tool, or original input if unchanged",
+            alias="updatedInput",
+        ),
+    ]
+
+    model_config = ConfigDict(extra="forbid", populate_by_name=True)
+
+
+class PermissionToolDenyResponse(BaseModel):
+    """Response model for denied permission tool requests."""
+
+    behavior: Annotated[Literal["deny"], Field(description="Permission behavior")] = (
+        "deny"
+    )
+    message: Annotated[
+        str,
+        Field(
+            description="Human-readable explanation of why the permission was denied"
+        ),
+    ]
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class PermissionToolPendingResponse(BaseModel):
+    """Response model for pending permission tool requests requiring user confirmation."""
+
+    behavior: Annotated[
+        Literal["pending"], Field(description="Permission behavior")
+    ] = "pending"
+    confirmation_id: Annotated[
+        str,
+        Field(
+            description="Unique identifier for the confirmation request",
+            alias="confirmationId",
+        ),
+    ]
+    message: Annotated[
+        str,
+        Field(
+            description="Instructions for retrying the request after user confirmation"
+        ),
+    ] = "User confirmation required. Please retry with the same confirmation_id."
+
+    model_config = ConfigDict(extra="forbid", populate_by_name=True)
+
+
+PermissionToolResponse = (
+    PermissionToolAllowResponse
+    | PermissionToolDenyResponse
+    | PermissionToolPendingResponse
+)

ccproxy/plugins/permissions/plugin.py

@@ -0,0 +1,153 @@
+"""Permissions plugin v2 implementation."""
+
+from typing import Any
+
+from ccproxy.core.logging import get_plugin_logger
+from ccproxy.core.plugins import (
+    PluginContext,
+    PluginManifest,
+    RouteSpec,
+    SystemPluginFactory,
+    SystemPluginRuntime,
+)
+
+from .config import PermissionsConfig
+from .mcp import mcp_router
+from .routes import router
+from .service import get_permission_service
+
+
+logger = get_plugin_logger()
+
+
+class PermissionsRuntime(SystemPluginRuntime):
+    """Runtime for permissions plugin."""
+
+    def __init__(self, manifest: PluginManifest):
+        """Initialize runtime."""
+        super().__init__(manifest)
+        self.config: PermissionsConfig | None = None
+        self.service = get_permission_service()
+
+    async def _on_initialize(self) -> None:
+        """Initialize the permissions plugin."""
+        if not self.context:
+            raise RuntimeError("Context not set")
+
+        # Get configuration
+        config = self.context.get("config")
+        if not isinstance(config, PermissionsConfig):
+            logger.debug("plugin_no_config")
+            # Use default config if none provided
+            self.config = PermissionsConfig()
+        else:
+            self.config = config
+
+        logger.debug("initializing_permissions_plugin")
+
+        # Start the permission service if enabled
+        if self.config.enabled:
+            # Update service timeout from config
+            self.service._timeout_seconds = self.config.timeout_seconds
+            await self.service.start()
+            logger.debug(
+                "permission_service_started",
+                timeout_seconds=self.config.timeout_seconds,
+                terminal_ui=self.config.enable_terminal_ui,
+                sse_stream=self.config.enable_sse_stream,
+            )
+        else:
+            logger.debug("permission_service_disabled")
+
+    async def _on_shutdown(self) -> None:
+        """Shutdown the plugin and cleanup resources."""
+        logger.debug("shutting_down_permissions_plugin")
+
+        # Stop the permission service
+        await self.service.stop()
+
+        logger.debug("permissions_plugin_shutdown_complete")
+
+    async def _get_health_details(self) -> dict[str, Any]:
+        """Get health check details."""
+        try:
+            # Check if service is running
+            pending_count = len(await self.service.get_pending_requests())
+            return {
+                "type": "system",
+                "initialized": self.initialized,
+                "pending_requests": pending_count,
+                "enabled": self.config.enabled if self.config else False,
+                "service_running": self.service is not None,
+            }
+        except Exception as e:
+            logger.error("health_check_failed", error=str(e))
+            return {
+                "type": "system",
+                "initialized": self.initialized,
+                "enabled": self.config.enabled if self.config else False,
+                "error": str(e),
+            }
+
+
+class PermissionsFactory(SystemPluginFactory):
+    """Factory for permissions plugin."""
+
+    def __init__(self) -> None:
+        """Initialize factory with manifest."""
+        # Create manifest with static declarations
+        manifest = PluginManifest(
+            name="permissions",
+            version="0.1.0",
+            description="Permissions plugin providing authorization services for tool calls",
+            is_provider=False,
+            config_class=PermissionsConfig,
+        )
+
+        # Initialize with manifest
+        super().__init__(manifest)
+
+    def create_runtime(self) -> PermissionsRuntime:
+        """Create runtime instance."""
+        return PermissionsRuntime(self.manifest)
+
+    def create_context(self, core_services: Any) -> PluginContext:
+        """Create context and update manifest with routes if enabled."""
+        # Get base context
+        context = super().create_context(core_services)
+
+        # Check if plugin is enabled
+        config = context.get("config")
+        if isinstance(config, PermissionsConfig) and config.enabled:
+            # Add routes to manifest
+            # This is safe because it happens during app creation phase
+            if not self.manifest.routes:
+                self.manifest.routes = []
+
+            # Always add MCP routes at /mcp root (they're essential for Claude Code)
+            mcp_route_spec = RouteSpec(
+                router=mcp_router,
+                prefix="/mcp",
+                tags=["mcp"],
+            )
+            self.manifest.routes.append(mcp_route_spec)
+
+            # Add SSE streaming routes at /permissions if enabled
+            if config.enable_sse_stream:
+                permissions_route_spec = RouteSpec(
+                    router=router,
+                    prefix="/permissions",
+                    tags=["permissions"],
+                )
+                self.manifest.routes.append(permissions_route_spec)
+
+            logger.debug(
+                "permissions_routes_added_to_manifest",
+                sse_enabled=config.enable_sse_stream,
+            )
+
+        return context
+
+
+# Export the factory instance
+factory = PermissionsFactory()

ccproxy/{api/routes/permissions.py → plugins/permissions/routes.py}

@@ -3,26 +3,31 @@
 import asyncio
 import json
 from collections.abc import AsyncGenerator
+from typing import TYPE_CHECKING, Any
 
 from fastapi import APIRouter, HTTPException, Request
 from pydantic import BaseModel
-from sse_starlette.sse import EventSourceResponse
-from structlog import get_logger
 
-from ccproxy.api.dependencies import SettingsDep
-from ccproxy.api.services.permission_service import get_permission_service
-from ccproxy.auth.conditional import ConditionalAuthDep
+
+if TYPE_CHECKING:
+    pass
+
+from ccproxy.api.dependencies import OptionalSettingsDep
+from ccproxy.auth.dependencies import ConditionalAuthDep
 from ccproxy.core.errors import (
     PermissionAlreadyResolvedError,
     PermissionNotFoundError,
 )
-from ccproxy.models.permissions import EventType, PermissionEvent, PermissionStatus
+from ccproxy.core.logging import get_plugin_logger
 
+from .models import EventType, PermissionEvent, PermissionStatus
+from .service import get_permission_service
 
-logger = get_logger(__name__)
 
+logger = get_plugin_logger()
 
-router = APIRouter(tags=["permissions"])
+
+router = APIRouter()
 
 
 class PermissionResponse(BaseModel):
@@ -106,9 +111,9 @@ async def event_generator(
 @router.get("/stream")
 async def stream_permissions(
     request: Request,
-    settings: SettingsDep,
+    settings: OptionalSettingsDep,
     auth: ConditionalAuthDep,
-) -> EventSourceResponse:
+) -> Any:
     """Stream permission requests via Server-Sent Events.
 
     This endpoint streams new permission requests as they are created,
@@ -117,19 +122,18 @@ async def stream_permissions(
     Returns:
         EventSourceResponse streaming permission events
     """
+    # Import at runtime to avoid type-checker import requirement
+    from sse_starlette.sse import EventSourceResponse
+
     return EventSourceResponse(
         event_generator(request),
-        headers={
-            "Cache-Control": "no-cache",
-            "X-Accel-Buffering": "no",  # Disable nginx buffering
-        },
     )
 
 
 @router.get("/{permission_id}")
 async def get_permission(
     permission_id: str,
-    settings: SettingsDep,
+    settings: OptionalSettingsDep,
     auth: ConditionalAuthDep,
 ) -> PermissionRequestInfo:
     """Get information about a specific permission request.
@@ -168,7 +172,7 @@ async def get_permission(
 async def respond_to_permission(
     permission_id: str,
     response: PermissionResponse,
-    settings: SettingsDep,
+    settings: OptionalSettingsDep,
     auth: ConditionalAuthDep,
 ) -> dict[str, str | bool]:
     """Submit a response to a permission request.

ccproxy/{api/services/permission_service.py → plugins/permissions/service.py}

@@ -3,14 +3,15 @@
 import asyncio
 import contextlib
 from datetime import UTC, datetime, timedelta
-from typing import Any
-
-from structlog import get_logger
+from typing import TYPE_CHECKING, Any
 
+from ccproxy.core.async_task_manager import AsyncTaskManager, create_managed_task
 from ccproxy.core.errors import (
     PermissionNotFoundError,
 )
-from ccproxy.models.permissions import (
+from ccproxy.core.logging import get_plugin_logger
+
+from .models import (
     EventType,
     PermissionEvent,
     PermissionRequest,
@@ -18,7 +19,11 @@ from ccproxy.models.permissions import (
 )
 
 
-logger = get_logger(__name__)
+if TYPE_CHECKING:
+    from ccproxy.services.container import ServiceContainer
+
+
+logger = get_plugin_logger()
 
 
 class PermissionService:
@@ -32,10 +37,38 @@ class PermissionService:
         self._event_queues: list[asyncio.Queue[dict[str, Any]]] = []
         self._lock = asyncio.Lock()
 
-    async def start(self) -> None:
-        if self._expiry_task is None:
-            self._expiry_task = asyncio.create_task(self._expiry_checker())
-            logger.debug("permission_service_started")
+    async def start(
+        self,
+        *,
+        container: "ServiceContainer | None" = None,
+        task_manager: AsyncTaskManager | None = None,
+    ) -> None:
+        if self._expiry_task is not None:
+            return
+
+        self._shutdown = False
+
+        try:
+            self._expiry_task = await create_managed_task(
+                self._expiry_checker(),
+                name="permission_expiry_checker",
+                creator="PermissionService",
+                container=container,
+                task_manager=task_manager,
+            )
+        except RuntimeError as exc:
+            if not self._should_fallback_to_unmanaged_task(exc):
+                raise
+
+            logger.warning(
+                "permission_service_task_manager_unavailable",
+                error=str(exc),
+            )
+            self._expiry_task = asyncio.create_task(
+                self._expiry_checker(), name="permission_expiry_checker"
+            )
+
+        logger.debug("permission_service_started")
 
     async def stop(self) -> None:
         self._shutdown = True
@@ -179,7 +212,7 @@ class PermissionService:
     async def _expiry_checker(self) -> None:
         while not self._shutdown:
             try:
-                await asyncio.sleep(5)
+                await asyncio.sleep(self._get_expiry_poll_interval())
 
                 now = datetime.now(UTC)
                 expired_ids = []
@@ -220,7 +253,7 @@ class PermissionService:
                 logger.error(
                     "expiry_checker_error",
                     error=str(e),
-                    exc_info=True,
+                    exc_info=e,
                 )
 
     def _should_cleanup_request(
@@ -240,6 +273,27 @@ class PermissionService:
 
         return False
 
+    def _get_expiry_poll_interval(self) -> float:
+        """Determine how frequently to poll for expired requests."""
+
+        timeout = max(self._timeout_seconds, 0)
+        if timeout == 0:
+            return 0.5
+
+        return max(0.5, min(5.0, timeout / 2))
+
+    @staticmethod
+    def _should_fallback_to_unmanaged_task(exc: RuntimeError) -> bool:
+        message = str(exc)
+        return any(
+            hint in message
+            for hint in (
+                "Task manager is not started",
+                "ServiceContainer is not available",
+                "AsyncTaskManager is not registered",
+            )
+        )
+
     async def subscribe_to_events(self) -> asyncio.Queue[dict[str, Any]]:
         """Subscribe to permission events.
 

ccproxy/{api → plugins/permissions}/ui/permission_handler_protocol.py

@@ -2,7 +2,7 @@
 
 from typing import Protocol
 
-from ccproxy.api.services.permission_service import PermissionRequest
+from .. import PermissionRequest
 
 
 class ConfirmationHandlerProtocol(Protocol):

ccproxy/{api → plugins/permissions}/ui/terminal_permission_handler.py

@@ -1,23 +1,71 @@
 """Terminal UI handler for confirmation requests using Textual with request stacking support."""
 
+from __future__ import annotations
+
 import asyncio
 import contextlib
 import time
 from dataclasses import dataclass
+from typing import TYPE_CHECKING
+
+from ccproxy.core.logging import get_plugin_logger
+
+from .. import PermissionRequest
+
+
+# During type checking, import real Textual types; at runtime, provide fallbacks if absent.
+TEXTUAL_AVAILABLE: bool
+if TYPE_CHECKING:
+    from textual.app import App, ComposeResult
+    from textual.containers import Container, Vertical
+    from textual.events import Key
+    from textual.reactive import reactive
+    from textual.screen import ModalScreen
+    from textual.timer import Timer
+    from textual.widgets import Label, Static
+
+    TEXTUAL_AVAILABLE = True
+else:  # pragma: no cover - optional dependency
+    try:
+        from textual.app import App, ComposeResult
+        from textual.containers import Container, Vertical
+        from textual.events import Key
+        from textual.reactive import reactive
+        from textual.screen import ModalScreen
+        from textual.timer import Timer
+        from textual.widgets import Label, Static
+
+        TEXTUAL_AVAILABLE = True
+    except ImportError:
+        TEXTUAL_AVAILABLE = False
+
+        # Minimal runtime stubs to avoid crashes when Textual is not installed
+        class App:  # type: ignore[no-redef]
+            pass
+
+        class Container:  # type: ignore[no-redef]
+            pass
 
-from structlog import get_logger
-from textual.app import App, ComposeResult
-from textual.containers import Container, Vertical
-from textual.events import Key
-from textual.reactive import reactive
-from textual.screen import ModalScreen
-from textual.timer import Timer
-from textual.widgets import Label, Static
+        class Vertical:  # type: ignore[no-redef]
+            pass
 
-from ccproxy.api.services.permission_service import PermissionRequest
+        class ModalScreen:  # type: ignore[no-redef]
+            pass
 
+        class Label:  # type: ignore[no-redef]
+            pass
 
-logger = get_logger(__name__)
+        class Static:  # type: ignore[no-redef]
+            pass
+
+        def reactive(x: float) -> float:  # type: ignore[no-redef]
+            return x
+
+        class Timer:  # type: ignore[no-redef]
+            pass
+
+
+logger = get_plugin_logger(__name__)
 
 
 @dataclass
@@ -501,6 +549,14 @@ class TerminalPermissionHandler:
         Returns:
             bool: True if the user confirmed, False otherwise
         """
+        if not TEXTUAL_AVAILABLE:
+            logger.warning(
+                "textual_not_available_denying_request",
+                request_id=request.id,
+                tool_name=request.tool_name,
+            )
+            return False
+
         try:
             logger.info(
                 "handling_confirmation_request",

ccproxy/plugins/pricing/README.md

@@ -0,0 +1,34 @@
+# Pricing Plugin
+
+Caches model pricing data and exposes it to other plugins for cost awareness.
+
+## Highlights
+- Loads pricing catalogs and keeps them fresh via the update task
+- Publishes a `pricing` service in the plugin registry for dependents
+- Tracks cache health, age, and failures for health reporting
+
+## Configuration
+- `PricingConfig` toggles enablement, refresh cadence, and startup behavior
+- Auto-update schedules can force refresh on launch or run periodically
+- Generate defaults with `python3 scripts/generate_config_from_model.py \
+  --format toml --plugin pricing --config-class PricingConfig`
+
+```toml
+[plugins.pricing]
+# enabled = true
+# cache_dir = "~/.cache/ccproxy"
+# cache_ttl_hours = 24
+# source_url = "https://raw.githubusercontent.com/BerriAI/litellm/main/model_prices_and_context_window.json"
+# download_timeout = 30
+# auto_update = true
+# memory_cache_ttl = 300
+# update_interval_hours = 6.0
+# force_refresh_on_startup = false
+# fallback_to_embedded = false
+# pricing_provider = "all"
+```
+
+## Related Components
+- `service.py`: pricing lookup and cache management
+- `tasks.py`: asynchronous cache refresh task
+- `plugin.py`: runtime lifecycle and service registration

ccproxy/plugins/pricing/__init__.py

@@ -0,0 +1,6 @@
+"""Pricing plugin for dynamic model pricing."""
+
+from .plugin import factory
+
+
+__all__ = ["factory"]

ccproxy/{pricing → plugins/pricing}/cache.py

@@ -5,18 +5,19 @@ import time
 from typing import Any
 
 import httpx
-from structlog import get_logger
 
-from ccproxy.config.pricing import PricingSettings
+from ccproxy.core.logging import get_plugin_logger
 
+from .config import PricingConfig
 
-logger = get_logger(__name__)
+
+logger = get_plugin_logger(__name__)
 
 
 class PricingCache:
     """Manages caching of model pricing data from external sources."""
 
-    def __init__(self, settings: PricingSettings) -> None:
+    def __init__(self, settings: PricingConfig) -> None:
         """Initialize pricing cache.
 
         Args:
@@ -84,14 +85,14 @@ class PricingCache:
             timeout = self.settings.download_timeout
 
         try:
-            logger.info("pricing_download_start", url=self.settings.source_url)
+            logger.debug("pricing_download_start", url=self.settings.source_url)
 
             async with httpx.AsyncClient(timeout=timeout) as client:
                 response = await client.get(self.settings.source_url)
                 response.raise_for_status()
 
                 data = response.json()
-                logger.info("pricing_download_completed", model_count=len(data))
+                logger.debug("pricing_download_completed", model_count=len(data))
                 return data  # type: ignore[no-any-return]
 
         except (httpx.HTTPError, json.JSONDecodeError) as e: