cipher-security 0.2.0__py3-none-any.whl

gateway/cli.py

@@ -0,0 +1,273 @@
+# Copyright (c) 2026 defconxt. All rights reserved.
+# Licensed under AGPL-3.0 — see LICENSE file for details.
+"""CIPHER gateway CLI entrypoint — cipher-gw.
+
+Usage:
+    cipher-gw "how to exploit SQLi"
+    echo "what is zero trust" | cipher-gw
+    cipher-gw --backend claude "design a zero trust network"
+    cipher-gw --smart "analyze this CVE"
+    cipher-gw setup-signal [--signal-api http://localhost:8080]
+"""
+from __future__ import annotations
+
+import argparse
+import sys
+
+# ---------------------------------------------------------------------------
+# Smart routing
+# ---------------------------------------------------------------------------
+
+COMPLEXITY_KEYWORDS = {
+    "design", "architecture", "threat model", "analyze", "analyse",
+    "compare", "explain", "model", "dpia", "risk assessment",
+    "implement", "system", "strategy",
+}
+
+
+def _select_backend_smart(message: str) -> str:
+    """Select backend based on query complexity heuristic.
+
+    Routes to "claude" if the message is long (> 200 chars) or contains
+    a complexity keyword. Routes to "ollama" otherwise.
+
+    Args:
+        message: The user query string.
+
+    Returns:
+        "claude" for complex queries, "ollama" for simple lookups.
+    """
+    if len(message) > 200:
+        return "claude"
+    lower = message.lower()
+    if any(keyword in lower for keyword in COMPLEXITY_KEYWORDS):
+        return "claude"
+    return "ollama"
+
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+def _strip_captcha_token(raw: str) -> str:
+    """Strip the 'signalcaptcha://' scheme prefix if present.
+
+    Signal's captcha page produces URLs like:
+        signalcaptcha://signal-hcaptcha.xxx.registration.token
+    The API only wants the token portion after the prefix.
+    """
+    prefix = "signalcaptcha://"
+    if raw.startswith(prefix):
+        return raw[len(prefix):]
+    return raw
+
+
+# ---------------------------------------------------------------------------
+# Subcommand handlers
+# ---------------------------------------------------------------------------
+
+def _setup_signal(args: argparse.Namespace) -> None:
+    """Interactive Signal registration flow using signal-cli-rest-api REST API."""
+    import httpx  # deferred import — only needed for this subcommand
+
+    base = args.signal_api.rstrip("/")
+
+    print("CIPHER Signal Bot Registration")
+    print("=" * 40)
+    print("Prerequisites: signal-cli-rest-api must be running")
+    print("  docker compose up -d signal-api")
+    print()
+
+    # Step 1: verify signal-cli-rest-api is reachable
+    with httpx.Client(timeout=10) as client:
+        try:
+            about_url = f"{base}/v1/about"
+            client.get(about_url).raise_for_status()
+            print("signal-cli-rest-api is reachable.")
+        except (httpx.ConnectError, httpx.TimeoutException) as exc:
+            print(f"Error: Could not connect to signal-cli-rest-api at {base}")
+            print(f"  {exc}")
+            print("Make sure the container is running: docker compose up -d signal-api")
+            sys.exit(1)
+        except httpx.HTTPStatusError as exc:
+            print(f"Error: signal-cli-rest-api returned an error: {exc}")
+            sys.exit(1)
+
+        # Step 2: prompt for number + captcha, then register
+        number = input("Phone number (E.164 format, e.g. +15551234567): ").strip()
+        print()
+        print("Captcha steps:")
+        print("  1. Open https://signalcaptchas.org/registration/generate.html")
+        print("  2. Solve the captcha")
+        print("  3. Right-click 'Open Signal' link -> Copy link address")
+        print("  4. Paste the full URL below")
+        raw_captcha = input("Captcha URL or token: ").strip()
+        captcha_token = _strip_captcha_token(raw_captcha)
+
+        try:
+            register_url = f"{base}/v1/register/{number}"
+            client.post(
+                register_url,
+                json={"captcha": captcha_token, "use_voice": False},
+            ).raise_for_status()
+        except httpx.HTTPStatusError as exc:
+            print(f"Error: Registration request failed: {exc}")
+            print("Hint: The captcha must be solved from the same IP as signal-cli-rest-api.")
+            print("      If using Docker, the captcha page must be opened from the host running the container.")
+            sys.exit(1)
+        except (httpx.ConnectError, httpx.TimeoutException) as exc:
+            print(f"Error: Lost connection during registration: {exc}")
+            sys.exit(1)
+
+        # Step 3: verify with the code received by call/SMS
+        print("Verification call/SMS initiated. Enter the code when received.")
+        code = input("Verification code: ").strip()
+
+        try:
+            verify_url = f"{base}/v1/register/{number}/verify/{code}"
+            client.post(verify_url).raise_for_status()
+        except httpx.HTTPStatusError as exc:
+            print(f"Error: Verification failed: {exc}")
+            sys.exit(1)
+        except (httpx.ConnectError, httpx.TimeoutException) as exc:
+            print(f"Error: Lost connection during verification: {exc}")
+            sys.exit(1)
+
+    print(f"Registration complete! Your bot number {number} is ready.")
+    print("Next steps:")
+    print(f"  1. Set signal.phone_number: {number} in config.yaml")
+    print("  2. Set signal.whitelist: [your-personal-number] in config.yaml")
+    print("  3. Run: docker compose up cipher-bot")
+
+
+def _ingest(args: argparse.Namespace) -> None:
+    """Ingest knowledge/ docs into the RAG vector store."""
+    from gateway.retriever import Retriever
+
+    print("CIPHER RAG Ingestion")
+    print("=" * 40)
+
+    retriever = Retriever()
+    count = retriever.ingest()
+
+    print(f"Indexed {count} chunks from knowledge/ into ChromaDB.")
+    print("RAG retrieval is now active for cipher-gw queries.")
+
+
+def _send_message(args: argparse.Namespace) -> None:
+    """Send a single message through the Gateway."""
+    message: str | None = getattr(args, "message", None)
+    if message is None:
+        if not sys.stdin.isatty():
+            message = sys.stdin.read().strip()
+        else:
+            # parser.error not accessible here; print and exit manually
+            print(
+                "cipher-gw: error: No message provided. "
+                "Pass a message argument or pipe via stdin.",
+                file=sys.stderr,
+            )
+            sys.exit(2)
+
+    if not message:
+        print("cipher-gw: error: Message is empty.", file=sys.stderr)
+        sys.exit(2)
+
+    from gateway.gateway import Gateway
+
+    # Smart routing: auto-select backend if --smart is set and no explicit --backend
+    if getattr(args, "smart", False) and not getattr(args, "backend", None):
+        backend = _select_backend_smart(message)
+        print(f"[CIPHER] smart routing -> {backend}", file=sys.stderr)
+        args.backend = backend
+
+    gw = Gateway(backend_override=getattr(args, "backend", None))
+    result = gw.send(message)
+    print(result)
+
+
+# ---------------------------------------------------------------------------
+# Argument parser
+# ---------------------------------------------------------------------------
+
+def _build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="cipher-gw",
+        description="CIPHER gateway — send a message or manage Signal registration",
+    )
+
+    subparsers = parser.add_subparsers(dest="subcommand")
+
+    # ----- send subcommand (default) -----
+    send_parser = subparsers.add_parser(
+        "send",
+        help="Send a message and get a CIPHER-mode response (default)",
+    )
+    send_parser.add_argument(
+        "message",
+        nargs="?",
+        help="Message to send. Reads from stdin if omitted.",
+    )
+    send_parser.add_argument(
+        "--backend",
+        choices=["ollama", "claude"],
+        default=None,
+        help="Override LLM backend (default: from config.yaml).",
+    )
+    send_parser.add_argument(
+        "--smart",
+        action="store_true",
+        default=False,
+        help="Auto-select backend based on query complexity (logs routing decision).",
+    )
+    send_parser.set_defaults(func=_send_message)
+
+    # ----- ingest subcommand -----
+    ingest_parser = subparsers.add_parser(
+        "ingest",
+        help="Ingest knowledge/ docs into the RAG vector store",
+    )
+    ingest_parser.set_defaults(func=_ingest)
+
+    # ----- setup-signal subcommand -----
+    signal_parser = subparsers.add_parser(
+        "setup-signal",
+        help="Interactively register a Signal phone number with signal-cli-rest-api",
+    )
+    signal_parser.add_argument(
+        "--signal-api",
+        default="http://localhost:8080",
+        dest="signal_api",
+        help="Base URL for signal-cli-rest-api (default: http://localhost:8080)",
+    )
+    signal_parser.set_defaults(func=_setup_signal)
+
+    return parser, send_parser
+
+
+def main() -> None:
+    """CLI entrypoint for cipher-gw."""
+    parser, send_parser = _build_parser()
+
+    # Backward compatibility: detect whether first argument is a known subcommand.
+    # If not, prepend "send" so the existing cipher-gw "message" usage keeps working.
+    raw_args = sys.argv[1:]
+    known_subcommands = {"send", "setup-signal", "ingest"}
+    first = raw_args[0] if raw_args else None
+    if first not in known_subcommands and first not in ("-h", "--help"):
+        # Treat as a send invocation — prepend the "send" subcommand only if
+        # the first arg does not start with "--" (which would be a flag for the
+        # top-level parser). Flags like --backend are passed through.
+        raw_args = ["send"] + raw_args
+
+    args = parser.parse_args(raw_args)
+
+    if hasattr(args, "func"):
+        args.func(args)
+    else:
+        parser.print_help()
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()

gateway/client.py

@@ -0,0 +1,57 @@
+# Copyright (c) 2026 defconxt. All rights reserved.
+# Licensed under AGPL-3.0 — see LICENSE file for details.
+"""CIPHER gateway LLM client factory.
+
+Returns a configured anthropic.Anthropic client for the active backend.
+Both Ollama and Claude API use the same SDK — Ollama's Anthropic-compat
+layer (v0.14.0+) handles the translation transparently.
+
+Usage:
+    client, model = make_client(cfg)
+    response = client.messages.create(
+        model=model,
+        max_tokens=4096,
+        system=system_prompt,
+        messages=[{"role": "user", "content": message}],
+    )
+"""
+from __future__ import annotations
+
+import anthropic
+import httpx
+
+from gateway.config import GatewayConfig
+
+
+def make_client(cfg: GatewayConfig) -> tuple[anthropic.Anthropic, str]:
+    """Build an anthropic.Anthropic client for the configured backend.
+
+    Args:
+        cfg: Validated gateway configuration. GatewayConfig.__post_init__
+             ensures the backend and active model are set.
+
+    Returns:
+        (client, model_name) — the client is ready to call .messages.create().
+
+    Notes:
+        - Ollama: base_url points to localhost:11434, api_key="ollama" (SDK
+          requires a key; Ollama ignores its value).
+        - Claude: standard Anthropic API with configured api_key and default
+          base_url (api.anthropic.com).
+        - Timeouts come from GatewayConfig — 300s for Ollama (local inference
+          can be slow), 60s for Claude API.
+    """
+    if cfg.backend == "ollama":
+        client = anthropic.Anthropic(
+            base_url=cfg.ollama_base_url,
+            api_key="ollama",  # Ollama ignores the key; SDK constructor requires it
+            timeout=httpx.Timeout(float(cfg.ollama_timeout)),
+        )
+        return client, cfg.ollama_model
+
+    # backend == "claude"
+    client = anthropic.Anthropic(
+        api_key=cfg.claude_api_key,
+        timeout=httpx.Timeout(float(cfg.claude_timeout)),
+    )
+    return client, cfg.claude_model

gateway/config.py

@@ -0,0 +1,213 @@
+# Copyright (c) 2026 defconxt. All rights reserved.
+# Licensed under AGPL-3.0 — see LICENSE file for details.
+"""CIPHER gateway configuration — YAML loading with env var substitution.
+
+Precedence (highest to lowest):
+  1. Environment variables (LLM_BACKEND, ANTHROPIC_API_KEY)
+  2. Project-root config.yaml  (where pyproject.toml lives)
+  3. ~/.config/cipher/config.yaml
+
+Supports ${VAR} and ${VAR:-default} syntax in YAML values.
+"""
+from __future__ import annotations
+
+import os
+import re
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+
+# ---------------------------------------------------------------------------
+# Environment variable substitution
+# ---------------------------------------------------------------------------
+
+# Matches ${VAR} or ${VAR:-default}
+_ENV_RE = re.compile(r"\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-(.*?))?\}")
+
+
+def _substitute_env(value: Any) -> Any:
+    """Recursively substitute ${VAR} and ${VAR:-default} in config values."""
+    if isinstance(value, str):
+        def _replace(m: re.Match) -> str:
+            var = m.group(1)
+            default = m.group(2)
+            env_val = os.environ.get(var)
+            if env_val is not None:
+                return env_val
+            if default is not None:
+                return default
+            return m.group(0)  # Leave unresolved if no default
+        return _ENV_RE.sub(_replace, value)
+    if isinstance(value, dict):
+        return {k: _substitute_env(v) for k, v in value.items()}
+    if isinstance(value, list):
+        return [_substitute_env(v) for v in value]
+    return value
+
+
+# ---------------------------------------------------------------------------
+# Secret redaction
+# ---------------------------------------------------------------------------
+
+_SECRET_KEYS = {"api_key", "apikey", "api-key", "token", "secret", "password"}
+
+
+def redact_config(config: dict) -> dict:
+    """Return a copy of config with secret values replaced by '***'."""
+    def _redact(obj: Any, key: str = "") -> Any:
+        if isinstance(obj, dict):
+            return {k: _redact(v, k) for k, v in obj.items()}
+        if isinstance(obj, list):
+            return [_redact(v) for v in obj]
+        if isinstance(obj, str) and key.lower().replace("-", "_") in _SECRET_KEYS and obj:
+            return "***"
+        return obj
+    return _redact(config)
+
+
+# ---------------------------------------------------------------------------
+# Config dataclass
+# ---------------------------------------------------------------------------
+
+@dataclass
+class GatewayConfig:
+    """Validated, fully-resolved gateway configuration."""
+
+    backend: str          # "ollama" | "claude"
+    ollama_base_url: str
+    ollama_model: str
+    ollama_timeout: int
+    claude_api_key: str
+    claude_model: str
+    claude_timeout: int
+
+    def __post_init__(self) -> None:
+        if self.backend not in ("ollama", "claude"):
+            raise ValueError(
+                f"Invalid backend {self.backend!r}. Must be 'ollama' or 'claude'.\n"
+                "Set 'llm_backend' in config.yaml or run: cipher setup"
+            )
+        if self.backend == "ollama" and not self.ollama_model:
+            raise ValueError(
+                "ollama_model must be set when backend is 'ollama'.\n"
+                "Set 'ollama.model' in config.yaml or run: cipher setup"
+            )
+        if self.backend == "claude" and not self.claude_model:
+            raise ValueError(
+                "claude_model must be set when backend is 'claude'.\n"
+                "Set 'claude.model' in config.yaml or run: cipher setup"
+            )
+
+
+# ---------------------------------------------------------------------------
+# Config loader
+# ---------------------------------------------------------------------------
+
+def _find_project_root(start: Path) -> Path | None:
+    """Walk up from `start` until pyproject.toml is found. Returns the dir or None."""
+    current = start.resolve()
+    for _ in range(20):
+        if (current / "pyproject.toml").exists():
+            return current
+        parent = current.parent
+        if parent == current:
+            break
+        current = parent
+    return None
+
+
+def _load_yaml_file(path: Path) -> dict[str, Any]:
+    """Load a YAML file safely. Returns empty dict if file missing or empty."""
+    if not path.exists():
+        return {}
+    with path.open("r") as f:
+        data = yaml.safe_load(f)
+    return data if isinstance(data, dict) else {}
+
+
+def load_config(project_root: Path | None = None) -> GatewayConfig:
+    """Load configuration from YAML files and env var overrides.
+
+    Supports ${VAR} and ${VAR:-default} syntax in YAML values.
+
+    Args:
+        project_root: Directory to look for project-root config.yaml.
+                      If None, resolved by walking up from this file's location.
+
+    Returns:
+        Validated GatewayConfig.
+
+    Raises:
+        ValueError: If required fields are missing or invalid.
+    """
+    if project_root is None:
+        found = _find_project_root(Path(__file__).parent)
+        project_root = found if found is not None else Path.cwd()
+
+    home_config = Path.home() / ".config" / "cipher" / "config.yaml"
+    project_config = Path(project_root) / "config.yaml"
+
+    merged: dict[str, Any] = {}
+    merged.update(_load_yaml_file(home_config))
+    merged.update(_load_yaml_file(project_config))
+
+    # Substitute ${VAR} patterns in all values
+    merged = _substitute_env(merged)
+
+    # Apply explicit env var overrides (highest priority)
+    if backend := os.environ.get("LLM_BACKEND"):
+        merged["llm_backend"] = backend
+    if api_key := os.environ.get("ANTHROPIC_API_KEY"):
+        merged.setdefault("claude", {})
+        if not isinstance(merged.get("claude"), dict):
+            merged["claude"] = {}
+        merged["claude"]["api_key"] = api_key
+
+    ollama_section: dict[str, Any] = merged.get("ollama") or {}
+    claude_section: dict[str, Any] = merged.get("claude") or {}
+
+    return GatewayConfig(
+        backend=merged.get("llm_backend", ""),
+        ollama_base_url=ollama_section.get("base_url", "http://127.0.0.1:11434"),
+        ollama_model=ollama_section.get("model", ""),
+        ollama_timeout=int(ollama_section.get("timeout", 300)),
+        claude_api_key=claude_section.get("api_key", ""),
+        claude_model=claude_section.get("model", ""),
+        claude_timeout=int(claude_section.get("timeout", 60)),
+    )
+
+
+def load_signal_config(project_root: Path | None = None) -> dict[str, Any]:
+    """Load the 'signal:' section from config.yaml with env var overrides."""
+    if project_root is None:
+        found = _find_project_root(Path(__file__).parent)
+        project_root = found if found is not None else Path.cwd()
+
+    home_config = Path.home() / ".config" / "cipher" / "config.yaml"
+    project_config = Path(project_root) / "config.yaml"
+
+    merged: dict[str, Any] = {}
+    merged.update(_load_yaml_file(home_config))
+    merged.update(_load_yaml_file(project_config))
+    merged = _substitute_env(merged)
+
+    signal_section: dict[str, Any] = merged.get("signal") or {}
+
+    result: dict[str, Any] = {
+        "signal_service": signal_section.get("signal_service", "signal-api:8080"),
+        "phone_number": signal_section.get("phone_number", ""),
+        "whitelist": signal_section.get("whitelist") or [],
+        "session_timeout": int(signal_section.get("session_timeout", 3600)),
+    }
+
+    if sv := os.environ.get("SIGNAL_SERVICE"):
+        result["signal_service"] = sv
+    if spn := os.environ.get("SIGNAL_PHONE_NUMBER"):
+        result["phone_number"] = spn
+    if swl := os.environ.get("SIGNAL_WHITELIST"):
+        result["whitelist"] = [n.strip() for n in swl.split(",") if n.strip()]
+
+    return result