ciris-agent 1.7.7__py3-none-any.whl

ciris_engine/logic/utils/path_resolution.py

@@ -0,0 +1,281 @@
+"""
+CIRIS Path Resolution Utility.
+
+Resolves paths for data, logs, templates, and configuration files.
+Supports development mode, installed mode, and CIRIS Manager mode.
+
+Path Resolution Strategy:
+1. CIRIS Manager Mode (managed deployment):
+   - Detected via CIRIS_MANAGED=true or volume mounts at /app/data
+   - Use /app/ for all paths
+   - Templates: /app/ciris_templates/
+   - Data: /app/data/
+   - Logs: /app/logs/
+
+2. Development Mode (git repo detected):
+   - Use current working directory for everything
+   - Templates: ./ciris_templates/
+   - Data: ./data/
+   - Logs: ./logs/
+
+3. Installed Mode (pip install):
+   - Use CIRIS_HOME env var if set, otherwise ~/ciris/
+   - Templates: Check multiple locations (user overrides, then bundled)
+   - Data: CIRIS_HOME/data/ or ~/ciris/data/
+   - Logs: CIRIS_HOME/logs/ or ~/ciris/logs/
+
+4. Template Search Order:
+   a. Current working directory (if in git repo)
+   b. CIRIS_HOME/ciris_templates/ (if CIRIS_HOME set)
+   c. ~/ciris/ciris_templates/ (user custom templates)
+   d. <package_root>/ciris_templates/ (bundled templates)
+"""
+
+import os
+import sys
+from pathlib import Path
+from typing import Optional
+
+
+def is_android() -> bool:
+    """Detect if running on Android platform.
+
+    Checks multiple indicators:
+    - 'ANDROID_ROOT' environment variable (set by Android system)
+    - 'ANDROID_DATA' environment variable
+    - sys.platform contains 'linux' and /data/data exists
+    - Running under Chaquopy (Python on Android)
+
+    Returns:
+        True if running on Android
+    """
+    # Check for Android-specific environment variables
+    if os.getenv("ANDROID_ROOT") or os.getenv("ANDROID_DATA"):
+        return True
+
+    # Check for Chaquopy marker (Python on Android)
+    if hasattr(sys, "getandroidapilevel"):
+        return True
+
+    # Check for Android data directory structure
+    if sys.platform == "linux" and Path("/data/data").exists():
+        return True
+
+    return False
+
+
+def is_managed() -> bool:
+    """Detect if running under CIRIS Manager using multiple signals.
+
+    Returns True if majority of indicators suggest managed environment.
+
+    Checks:
+    - CIRIS_MANAGED environment variable
+    - Volume mounts at /app/data and /app/logs
+    - Service token presence
+    - Docker environment with /app structure
+    """
+    indicators = []
+
+    # 1. Check for explicit manager flag
+    indicators.append(os.getenv("CIRIS_MANAGED", "").lower() == "true")
+
+    # 2. Check for volume mounts (most reliable for Docker deployments)
+    indicators.append(os.path.ismount("/app/data"))
+    indicators.append(os.path.ismount("/app/logs"))
+
+    # 3. Check for service token (only set by manager)
+    indicators.append(bool(os.getenv("CIRIS_SERVICE_TOKEN")))
+
+    # 4. Check for Docker environment with /app structure
+    indicators.append(Path("/.dockerenv").exists() and Path("/app/data").exists() and Path("/app/logs").exists())
+
+    # Return True if majority indicate managed (at least 2 out of 5)
+    return sum(indicators) >= 2
+
+
+def is_development_mode() -> bool:
+    """Check if running in development mode (git repository).
+
+    Returns:
+        True if current directory is a git repository AND not on Android.
+        On Android, .git may exist in the bundled code but we're not in dev mode.
+    """
+    # Never dev mode on Android - even if .git exists in bundled code
+    if is_android():
+        return False
+
+    return (Path.cwd() / ".git").exists()
+
+
+def get_ciris_home() -> Path:
+    """Get the CIRIS home directory.
+
+    Returns:
+        Path to CIRIS home directory:
+        - /app/ if managed by CIRIS Manager (highest priority)
+        - Android app files/ciris/ if on Android
+        - Current directory if in git repo (development)
+        - CIRIS_HOME env var if set
+        - ~/ciris/ otherwise (installed mode)
+    """
+    # Priority 1: CIRIS Manager mode - use /app/
+    if is_managed():
+        return Path("/app")
+
+    # Priority 2: Android mode - use app's files directory
+    # On Android, Path.home() returns /data/user/0/ai.ciris.mobile
+    # but the writable files dir is /data/user/0/ai.ciris.mobile/files/
+    if is_android():
+        # CIRIS_HOME env var is set by mobile_main.py to the app's files dir
+        env_home = os.getenv("CIRIS_HOME")
+        if env_home:
+            return Path(env_home)
+        # Fallback: use Path.home()/files/ciris (Android app files structure)
+        return Path.home() / "files" / "ciris"
+
+    # Priority 3: Development mode - use current directory
+    if is_development_mode():
+        return Path.cwd()
+
+    # Priority 4: CIRIS_HOME environment variable
+    env_home = os.getenv("CIRIS_HOME")
+    if env_home:
+        return Path(env_home).expanduser().resolve()
+
+    # Priority 5: Default installed mode - ~/ciris/
+    return Path.home() / "ciris"
+
+
+def get_data_dir() -> Path:
+    """Get the data directory path.
+
+    Returns:
+        Path to data directory (CIRIS_HOME/data/)
+    """
+    return get_ciris_home() / "data"
+
+
+def get_logs_dir() -> Path:
+    """Get the logs directory path.
+
+    Returns:
+        Path to logs directory (CIRIS_HOME/logs/)
+    """
+    return get_ciris_home() / "logs"
+
+
+def get_config_dir() -> Path:
+    """Get the config directory path.
+
+    Returns:
+        Path to config directory (CIRIS_HOME/config/)
+    """
+    return get_ciris_home() / "config"
+
+
+def get_package_root() -> Path:
+    """Get the installed package root directory.
+
+    Returns:
+        Path to ciris_engine package directory
+    """
+    import ciris_engine
+
+    return Path(ciris_engine.__file__).parent
+
+
+def find_template_file(template_name: str) -> Optional[Path]:
+    """Find a template file by searching multiple locations.
+
+    Search order:
+    1. /app/ciris_templates/ (managed mode only)
+    2. CWD/ciris_templates/ (development mode only)
+    3. CIRIS_HOME/ciris_templates/ (if CIRIS_HOME is set)
+    4. ~/ciris/ciris_templates/ (user custom templates)
+    5. <package_root>/ciris_templates/ (bundled templates)
+
+    Args:
+        template_name: Name of template (with or without .yaml extension)
+
+    Returns:
+        Path to template file if found, None otherwise
+    """
+    # Ensure .yaml extension
+    if not template_name.endswith(".yaml"):
+        template_name = f"{template_name}.yaml"
+
+    search_paths = []
+
+    # 1. Managed mode: check /app/ciris_templates/ first
+    if is_managed():
+        search_paths.append(Path("/app") / "ciris_templates" / template_name)
+
+    # 2. Development mode: check CWD and ciris_engine subdirectory
+    if is_development_mode():
+        search_paths.append(Path.cwd() / "ciris_templates" / template_name)
+        search_paths.append(Path.cwd() / "ciris_engine" / "ciris_templates" / template_name)
+
+    # 3. CIRIS_HOME if set (custom location)
+    env_home = os.getenv("CIRIS_HOME")
+    if env_home:
+        search_paths.append(Path(env_home).expanduser() / "ciris_templates" / template_name)
+
+    # 4. User home directory (~/ciris/ciris_templates/)
+    search_paths.append(Path.home() / "ciris" / "ciris_templates" / template_name)
+
+    # 5. Installed package location (bundled)
+    search_paths.append(get_package_root() / "ciris_templates" / template_name)
+
+    # Return first existing path
+    for path in search_paths:
+        if path.exists() and path.is_file():
+            return path
+
+    return None
+
+
+def get_template_directory() -> Path:
+    """Get the template directory path.
+
+    Returns the first existing template directory from:
+    1. /app/ciris_templates/ (managed mode)
+    2. CWD/ciris_templates/ (development)
+    3. CIRIS_HOME/ciris_templates/ (if set)
+    4. ~/ciris/ciris_templates/ (user)
+    5. <package_root>/ciris_templates/ (bundled)
+
+    Returns:
+        Path to template directory
+    """
+    # Managed mode
+    if is_managed():
+        managed_templates = Path("/app") / "ciris_templates"
+        if managed_templates.exists():
+            return managed_templates
+
+    # Development mode - check both repo root and ciris_engine subdirectory
+    if is_development_mode():
+        # First check repo root (for backwards compatibility)
+        dev_templates = Path.cwd() / "ciris_templates"
+        if dev_templates.exists():
+            return dev_templates
+        # Also check ciris_engine subdirectory (actual location in source tree)
+        dev_engine_templates = Path.cwd() / "ciris_engine" / "ciris_templates"
+        if dev_engine_templates.exists():
+            return dev_engine_templates
+
+    # CIRIS_HOME
+    env_home = os.getenv("CIRIS_HOME")
+    if env_home:
+        env_templates = Path(env_home).expanduser() / "ciris_templates"
+        if env_templates.exists():
+            return env_templates
+
+    # User home
+    user_templates = Path.home() / "ciris" / "ciris_templates"
+    if user_templates.exists():
+        return user_templates
+
+    # Package bundled templates
+    return get_package_root() / "ciris_templates"

ciris_engine/logic/utils/platform_detection.py

@@ -0,0 +1,286 @@
+"""
+CIRIS Platform Detection Utility.
+
+Centralized platform detection that determines:
+1. What platform we're running on (android, ios, linux, windows, macos)
+2. What security capabilities are available (Play Integrity, TPM, etc.)
+3. What authentication methods are available (native Google/Apple Sign-In)
+
+This module populates a PlatformCapabilities object that can be used
+to check if platform requirements for tools/adapters are satisfied.
+
+NOTE: Basic platform detection (is_android, is_managed, is_development_mode)
+is in path_resolution.py to avoid circular imports. This module re-exports
+those functions and adds security capability detection on top.
+"""
+
+import logging
+import os
+import sys
+from functools import lru_cache
+from pathlib import Path
+from typing import Optional
+
+# Import basic platform detection from path_resolution to avoid duplication
+from ciris_engine.logic.utils.path_resolution import is_android
+from ciris_engine.schemas.platform import PlatformCapabilities, PlatformRequirement
+
+logger = logging.getLogger(__name__)
+
+
+def is_ios() -> bool:
+    """Detect if running on iOS platform.
+
+    Currently iOS is not supported for Python execution,
+    but this is here for future compatibility.
+
+    Returns:
+        True if running on iOS (currently always False)
+    """
+    # iOS detection would go here when/if we support it
+    # Could check for specific environment variables or paths
+    return False
+
+
+def get_platform_name() -> str:
+    """Get the current platform name.
+
+    Returns:
+        Platform name: 'android', 'ios', 'linux', 'windows', 'macos', or 'unknown'
+    """
+    if is_android():
+        return "android"
+
+    if is_ios():
+        return "ios"
+
+    if sys.platform == "darwin":
+        return "macos"
+
+    if sys.platform == "win32":
+        return "windows"
+
+    if sys.platform.startswith("linux"):
+        return "linux"
+
+    return "unknown"
+
+
+# ============================================================================
+# Security Capability Detection
+# ============================================================================
+
+
+def _detect_android_capabilities() -> set[PlatformRequirement]:
+    """Detect security capabilities available on Android.
+
+    Returns:
+        Set of PlatformRequirement that are available
+    """
+    capabilities: set[PlatformRequirement] = set()
+
+    # Android Keystore is always available on Android 4.3+
+    # We're targeting Android 7+ (API 24) so this is safe
+    capabilities.add(PlatformRequirement.ANDROID_KEYSTORE)
+
+    # Google Play Integrity requires Google Play Services
+    # Check if we have the marker that Play Services is available
+    if os.getenv("GOOGLE_PLAY_SERVICES_AVAILABLE", "").lower() == "true":
+        capabilities.add(PlatformRequirement.ANDROID_PLAY_INTEGRITY)
+
+    # Native Google auth is available if Play Services is available
+    # AND we have a valid Google ID token
+    google_token = os.getenv("CIRIS_BILLING_GOOGLE_ID_TOKEN") or os.getenv("GOOGLE_ID_TOKEN")
+    if google_token:
+        capabilities.add(PlatformRequirement.GOOGLE_NATIVE_AUTH)
+
+    # CIRIS proxy is available if we're configured to use it
+    llm_base_url = os.getenv("LLM_BASE_URL", "")
+    if "ciris" in llm_base_url.lower():
+        capabilities.add(PlatformRequirement.CIRIS_PROXY)
+
+    return capabilities
+
+
+def _detect_ios_capabilities() -> set[PlatformRequirement]:
+    """Detect security capabilities available on iOS.
+
+    Returns:
+        Set of PlatformRequirement that are available
+    """
+    capabilities: set[PlatformRequirement] = set()
+
+    # iOS always has Secure Enclave on A7+ chips (iPhone 5s and later)
+    capabilities.add(PlatformRequirement.SECURE_ENCLAVE)
+
+    # App Attest is available on iOS 14+
+    # This would need to be signaled by the native app
+    if os.getenv("IOS_APP_ATTEST_AVAILABLE", "").lower() == "true":
+        capabilities.add(PlatformRequirement.IOS_APP_ATTEST)
+
+    # DeviceCheck is available on iOS 11+
+    if os.getenv("IOS_DEVICE_CHECK_AVAILABLE", "").lower() == "true":
+        capabilities.add(PlatformRequirement.IOS_DEVICE_CHECK)
+
+    # Native Apple auth
+    if os.getenv("APPLE_ID_TOKEN"):
+        capabilities.add(PlatformRequirement.APPLE_NATIVE_AUTH)
+
+    return capabilities
+
+
+def _detect_desktop_capabilities() -> set[PlatformRequirement]:
+    """Detect security capabilities available on desktop platforms.
+
+    Returns:
+        Set of PlatformRequirement that are available
+    """
+    capabilities: set[PlatformRequirement] = set()
+
+    # Check for TPM (Trusted Platform Module)
+    # On Linux, check for /dev/tpm0
+    # On Windows, would check via WMI
+    if sys.platform.startswith("linux"):
+        if Path("/dev/tpm0").exists() or Path("/dev/tpmrm0").exists():
+            capabilities.add(PlatformRequirement.TPM)
+
+    # Check for HSM (Hardware Security Module)
+    # This would typically be configured via environment variable
+    if os.getenv("HSM_AVAILABLE", "").lower() == "true":
+        capabilities.add(PlatformRequirement.HSM)
+
+    # DPoP support - available if the client supports it
+    # This is a protocol capability, not hardware
+    if os.getenv("DPOP_ENABLED", "").lower() == "true":
+        capabilities.add(PlatformRequirement.DPOP)
+
+    # mTLS support
+    if os.getenv("MTLS_CERT_PATH") and os.getenv("MTLS_KEY_PATH"):
+        capabilities.add(PlatformRequirement.MTLS)
+
+    return capabilities
+
+
+# ============================================================================
+# Main Detection Function
+# ============================================================================
+
+
+@lru_cache(maxsize=1)
+def detect_platform_capabilities() -> PlatformCapabilities:
+    """Detect current platform and its security capabilities.
+
+    This function is cached since platform capabilities don't change
+    during runtime (except for authentication state, which is handled
+    separately via refresh_auth_state()).
+
+    Returns:
+        PlatformCapabilities object with detected platform and capabilities
+    """
+    platform = get_platform_name()
+
+    # Detect platform-specific capabilities
+    if platform == "android":
+        capabilities = _detect_android_capabilities()
+    elif platform == "ios":
+        capabilities = _detect_ios_capabilities()
+    else:
+        capabilities = _detect_desktop_capabilities()
+
+    # Build the capabilities object
+    platform_caps = PlatformCapabilities(
+        platform=platform,
+        capabilities=capabilities,
+        # Android-specific
+        play_integrity_available=PlatformRequirement.ANDROID_PLAY_INTEGRITY in capabilities,
+        hardware_keystore_available=PlatformRequirement.ANDROID_KEYSTORE in capabilities,
+        google_native_auth_available=PlatformRequirement.GOOGLE_NATIVE_AUTH in capabilities,
+        # iOS-specific
+        app_attest_available=PlatformRequirement.IOS_APP_ATTEST in capabilities,
+        apple_native_auth_available=PlatformRequirement.APPLE_NATIVE_AUTH in capabilities,
+        # Desktop-specific
+        tpm_available=PlatformRequirement.TPM in capabilities,
+        # Token state
+        has_valid_device_token=bool(
+            os.getenv("CIRIS_BILLING_GOOGLE_ID_TOKEN") or os.getenv("GOOGLE_ID_TOKEN") or os.getenv("APPLE_ID_TOKEN")
+        ),
+        token_binding_method=_get_token_binding_method(capabilities),
+    )
+
+    logger.info(
+        "[PLATFORM] Detected platform: %s, capabilities: %s",
+        platform,
+        [c.value for c in capabilities],
+    )
+
+    return platform_caps
+
+
+def _get_token_binding_method(capabilities: set[PlatformRequirement]) -> Optional[str]:
+    """Determine the token binding method based on capabilities.
+
+    Args:
+        capabilities: Set of available platform requirements
+
+    Returns:
+        Token binding method name or None
+    """
+    if PlatformRequirement.ANDROID_PLAY_INTEGRITY in capabilities:
+        return "play_integrity"
+    if PlatformRequirement.IOS_APP_ATTEST in capabilities:
+        return "app_attest"
+    if PlatformRequirement.DPOP in capabilities:
+        return "dpop"
+    if PlatformRequirement.MTLS in capabilities:
+        return "mtls"
+    return None
+
+
+def refresh_auth_state() -> PlatformCapabilities:
+    """Refresh authentication-related capabilities.
+
+    Call this after authentication state changes (login, logout, token refresh)
+    to update the cached platform capabilities.
+
+    Returns:
+        Updated PlatformCapabilities
+    """
+    # Clear the cache
+    detect_platform_capabilities.cache_clear()
+    # Re-detect
+    return detect_platform_capabilities()
+
+
+def check_requirements(requirements: list[PlatformRequirement]) -> tuple[bool, list[PlatformRequirement]]:
+    """Check if platform requirements are satisfied.
+
+    Args:
+        requirements: List of requirements to check
+
+    Returns:
+        Tuple of (all_satisfied, missing_requirements)
+    """
+    capabilities = detect_platform_capabilities()
+    missing = capabilities.missing_requirements(requirements)
+    return len(missing) == 0, missing
+
+
+# ============================================================================
+# Re-exports (for convenience - use this module as single import point)
+# ============================================================================
+
+# Import from path_resolution to provide a single import point for platform detection
+from ciris_engine.logic.utils.path_resolution import is_development_mode, is_managed
+
+__all__ = [
+    # Core detection (is_android imported from path_resolution)
+    "is_android",
+    "is_ios",
+    "get_platform_name",
+    "detect_platform_capabilities",
+    "refresh_auth_state",
+    "check_requirements",
+    # Re-exported from path_resolution for convenience
+    "is_managed",
+    "is_development_mode",
+]