comodor 0.10.2__tar.gz → 0.11.0__tar.gz

{comodor-0.10.2 → comodor-0.11.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: comodor
-Version: 0.10.2
+Version: 0.11.0
 Summary: Comodor — a self-improving terminal coding agent with a Rich TUI
 Project-URL: Homepage, https://comodor.ai
 Project-URL: Repository, https://github.com/ifekri/Comodor

{comodor-0.10.2 → comodor-0.11.0}/src/comodor/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.10.2'
-__version_tuple__ = version_tuple = (0, 10, 2)
+__version__ = version = '0.11.0'
+__version_tuple__ = version_tuple = (0, 11, 0)
 
 __commit_id__ = commit_id = None

comodor-0.11.0/src/comodor/providers/discover.py

@@ -0,0 +1,240 @@
+"""Credentials and models this machine already has.
+
+Setting up an agent means finding an API key, which means a billing page, a
+new secret to keep, and a decision about which provider to pay. That is the
+tedious part, and for a lot of people it is unnecessary: the machine already
+has what is needed and nobody asked it.
+
+Two kinds of "already", and they are found differently.
+
+**Something running here.** Ollama and LM Studio serve an OpenAI-compatible
+endpoint on a known port and need no key at all. If one is running, the
+correct first offer is not a list of billing pages — it is "this is here, and
+it has these three models". Found by asking the port, because a binary on disk
+is not a server that is up, and the question `/v1/models` answers is exactly
+"are you there, and what can you do".
+
+**A key already in the environment.** `OPENROUTER_API_KEY` and its siblings
+are read and applied by the configuration layer already; what was missing was
+saying so. Somebody who exported a key an hour ago should be told it was
+found, not asked to paste it again.
+
+Three rules, because this runs on the first-run path and a first run must not
+hang or lie:
+
+* **Fast or absent.** A probe that takes two seconds is a setup wizard that
+  pauses for no reason on every machine without a local model. The timeout is
+  short, the probes run together, and a slow answer is the same as no answer.
+* **Never fatal.** Every failure here is a thing not offered, never an error.
+* **Nothing is claimed that was not seen.** A runtime is reported only if it
+  answered, and its models are the ones it listed rather than the ones the
+  catalogue guesses.
+"""
+
+from __future__ import annotations
+
+import os
+import threading
+from dataclasses import dataclass, field
+from typing import Iterable
+
+from .. import catalogue
+
+#: Long enough for a server on this machine, short enough that two of them not
+#: being there is not a pause anybody notices. Local means local: a runtime
+#: that needs more than this to say hello is not one to put in front of
+#: somebody on their first run.
+PROBE_TIMEOUT = (0.35, 1.5)
+
+#: How many models to name. The rest are still there; this is a first
+#: impression, not a catalogue.
+SHOW_MODELS = 8
+
+
+@dataclass
+class Running:
+    """A model server answering on this machine."""
+
+    provider: str
+    label: str
+    base_url: str
+    models: list[str] = field(default_factory=list)
+
+    @property
+    def usable(self) -> bool:
+        """Answering is not enough — it has to have something loaded.
+
+        Ollama with no models pulled answers `/v1/models` with an empty list.
+        Offering it would be offering a provider that fails on the first
+        request, which is worse than not offering it.
+        """
+        return bool(self.models)
+
+    @property
+    def summary(self) -> str:
+        if not self.models:
+            return "running, but no models are installed yet"
+        shown = ", ".join(self.models[:3])
+        more = len(self.models) - 3
+        return f"{shown}{f', and {more} more' if more > 0 else ''}"
+
+
+@dataclass
+class Held:
+    """A provider whose key is already in the environment."""
+
+    provider: str
+    label: str
+    variable: str
+
+
+def local_specs() -> list[catalogue.ProviderSpec]:
+    """The catalogue entries that describe something running on this machine."""
+    return [spec for spec in catalogue.CATALOGUE
+            if not spec.needs_key and spec.base_url
+            and ("localhost" in spec.base_url or "127.0.0.1" in spec.base_url)]
+
+
+def running_here(specs: Iterable[catalogue.ProviderSpec] | None = None,
+                 timeout: tuple[float, float] = PROBE_TIMEOUT) -> list[Running]:
+    """Ask each local port whether anything is listening, all at once.
+
+    Together rather than one after another: two runtimes that are both absent
+    would otherwise cost two timeouts, and the whole point is that somebody
+    with no local model never notices this ran.
+    """
+    found: list[Running] = []
+    lock = threading.Lock()
+
+    def ask(spec: catalogue.ProviderSpec) -> None:
+        models = _models_at(spec.base_url, timeout)
+        if models is None:
+            return
+        with lock:
+            found.append(Running(provider=spec.id, label=spec.label,
+                                 base_url=spec.base_url,
+                                 models=models[:SHOW_MODELS]))
+
+    threads = [threading.Thread(target=ask, args=(spec,), daemon=True)
+               for spec in (specs if specs is not None else local_specs())]
+    for thread in threads:
+        thread.start()
+    # Joined with a ceiling of their own, so a socket that neither answers nor
+    # refuses cannot hold up a first run.
+    deadline = sum(timeout) + 0.5
+    for thread in threads:
+        thread.join(timeout=deadline)
+
+    found.sort(key=lambda item: (not item.usable, item.provider))
+    return found
+
+
+def _port_is_open(base_url: str, deadline: float) -> bool:
+    """Is anything accepting connections there, on either address family?
+
+    Asked with a socket before the HTTP client is built, because this is the
+    expensive half. `localhost` resolves to both `::1` and `127.0.0.1`, and a
+    closed port on Windows drops the connection attempt rather than refusing
+    it — so a sequential probe pays the timeout twice for a machine that has
+    no local model, which is most machines.
+
+    Both families are tried at once. Assuming IPv4 would be faster and would
+    miss a runtime bound only to `::1`, and something running that does not
+    get found is the one outcome this whole module exists to avoid.
+    """
+    import socket
+    from urllib.parse import urlsplit
+
+    parts = urlsplit(base_url)
+    host, port = parts.hostname or "localhost", parts.port
+    if not port:
+        port = 443 if parts.scheme == "https" else 80
+
+    try:
+        addresses = socket.getaddrinfo(host, port, type=socket.SOCK_STREAM)
+    except OSError:
+        return False
+
+    open_ports: list[bool] = []
+    lock = threading.Lock()
+
+    def knock(family: int, address: tuple) -> None:
+        try:
+            with socket.socket(family, socket.SOCK_STREAM) as sock:
+                sock.settimeout(deadline)
+                sock.connect(address)
+        except OSError:
+            return
+        with lock:
+            open_ports.append(True)
+
+    knocks = [threading.Thread(target=knock, args=(family, address), daemon=True)
+              for family, _, _, _, address in addresses]
+    for thread in knocks:
+        thread.start()
+    for thread in knocks:
+        thread.join(timeout=deadline + 0.2)
+    return bool(open_ports)
+
+
+def _models_at(base_url: str, timeout: tuple[float, float]) -> list[str] | None:
+    """What this endpoint says it can run, or None if nothing answered."""
+    from ..net import http
+
+    if not _port_is_open(base_url, deadline=timeout[0]):
+        return None
+
+    # No retries. A refused connection to a port on this machine is a complete
+    # answer the first time, and the default policy turns "nothing is running"
+    # into three attempts and two backoffs — which is the whole cost of this,
+    # paid by everybody who has no local model.
+    session = http.Session(retry=http.Retry(total=0, retry_on_connection_error=False))
+    try:
+        response = session.get(f"{base_url.rstrip('/')}/models", timeout=timeout)
+        if response.status_code >= 400:
+            return None
+        payload = response.json()
+    except Exception:
+        # Refused, timed out, answered with something that is not JSON: all of
+        # them mean the same thing here, which is that there is nothing to
+        # offer.
+        return None
+    finally:
+        try:
+            session.close()
+        except Exception:
+            pass
+
+    entries = payload.get("data", payload) if isinstance(payload, dict) else payload
+    models: list[str] = []
+    for entry in entries or []:
+        if isinstance(entry, dict) and entry.get("id"):
+            models.append(str(entry["id"]))
+        elif isinstance(entry, str):
+            models.append(entry)
+    return sorted(models)
+
+
+def keys_in_the_environment() -> list[Held]:
+    """Providers whose key is already exported.
+
+    The configuration layer reads and applies these on its own; this is only
+    so the wizard can say which ones it found. Somebody who exported a key an
+    hour ago should be told, not asked to paste it again.
+
+    The value is never returned — only which variable held it. A first-run
+    screen has no business quoting a secret back at the room.
+    """
+    held: list[Held] = []
+    for spec in catalogue.CATALOGUE:
+        if not spec.env_key:
+            continue
+        if os.environ.get(spec.env_key, "").strip():
+            held.append(Held(provider=spec.id, label=spec.label,
+                             variable=spec.env_key))
+    return held
+
+
+def anything_ready() -> tuple[list[Running], list[Held]]:
+    """Both kinds, for a caller that wants to open with what is already here."""
+    return running_here(), keys_in_the_environment()

{comodor-0.10.2 → comodor-0.11.0}/src/comodor/setup.py

@@ -95,6 +95,7 @@ class SetupWizard:
         """
         if self._keys:
             self.console.clear()
+            self._crown()
             self._recap()
         self.console.print()
         self.console.print(
@@ -104,6 +105,29 @@ class SetupWizard:
             )
         )
 
+    def _crown(self) -> None:
+        """The wordmark, at the top of whatever is about to be drawn.
+
+        Every question clears the screen, so this is a header rather than a
+        repetition — without it each step arrives on a blank terminal with
+        nothing on it naming the program doing the asking.
+
+        It shrinks on a short terminal as well as on a narrow one. Five rows
+        of logo on a twenty-row screen is five rows the questions do not get,
+        which is the same trade the width rule already makes.
+        """
+        from .ui.banner import TAGLINE, wordmark
+
+        size = self.console.size
+        if size.height < 22 or size.width < 51:
+            self.console.print(Text.assemble(
+                ("Comodor", self.theme.style("accent", bold=True)),
+                (f"  {TAGLINE}", self.theme.style("dim")),
+            ))
+            return
+        self.console.print(wordmark(self.theme, size.width))
+        self.console.print(Text(f"  {TAGLINE}", style=self.theme.style("dim")))
+
     def _recap(self) -> None:
         """The questions already answered, one quiet line each."""
         if not self._done:
@@ -368,6 +392,38 @@ class SetupWizard:
             self.console.print(Text(f"  not imported: {note}",
                                     style=self.theme.style("dim")))
 
+    def _already_here(self) -> dict[str, str]:
+        """What this machine can already do, said before anything is asked.
+
+        A local runtime that is up needs no key and no account, and an
+        exported key is one somebody found an hour ago. Opening with eighteen
+        billing pages when the answer is a port that is already open is asking
+        a question that has been answered.
+
+        Returns a note per provider, for the list to show beside it. Never
+        raises: this is on the path that draws the first screen anybody sees.
+        """
+        try:
+            from .providers import discover
+
+            running = discover.running_here()
+            exported = discover.keys_in_the_environment()
+        except Exception:
+            return {}
+
+        notes: dict[str, str] = {}
+        for item in running:
+            notes[item.provider] = (f"running here — {item.summary}"
+                                    if item.usable else
+                                    "running here, but no models installed yet")
+        for item in exported:
+            notes.setdefault(item.provider, f"key already in ${item.variable}")
+
+        # Returned rather than announced. The list leads with these and names
+        # their models, so a sentence above it saying the same thing is the
+        # same fact twice — and the second telling is the one nobody reads.
+        return notes
+
     def _ask_skills(self, step: int, total: int) -> list[str]:
         """Offer the library, once, at the only moment it is not an interruption.
 
@@ -419,9 +475,10 @@ class SetupWizard:
         return chosen
 
     def _banner(self) -> None:
+
+        self.console.print()
+        self._crown()
         body = Text.assemble(
-            ("Comodor", self.theme.style("accent", bold=True)),
-            (" — it learns the way you correct it.\n\n", self.theme.style("text")),
             ("A few questions, once. The answers are saved to\n",
              self.theme.style("dim")),
             (str(self.config.paths.config_file), self.theme.style("value")),
@@ -430,7 +487,6 @@ class SetupWizard:
             ("/settings", self.theme.style("accent")),
             (".", self.theme.style("dim")),
         )
-        self.console.print()
         self.console.print(Panel(body, box=self.theme.box,
                                  border_style=self.theme.style("border"),
                                  padding=(1, 2)))
@@ -440,6 +496,7 @@ class SetupWizard:
         self.console.print(
             Text("  You can add more later; this is just the one to start with.\n",
                  style=self.theme.style("dim")))
+        here = self._already_here()
         # A provider that already has a key — imported a moment ago, or found
         # in the environment — leads. The key is the expensive part of setting
         # this up, and offering a default that needs a new one, immediately
@@ -449,11 +506,24 @@ class SetupWizard:
             entry = self.config.providers.get(spec.id)
             return bool(entry is not None and entry.api_key)
 
+        def usable_now(spec: catalogue.ProviderSpec) -> bool:
+            """Nothing left to find before this one can answer.
+
+            A runtime already up on this machine is the same argument as a key
+            already set, taken further: it needs no key at all.
+            """
+            return keyed(spec) or spec.id in here
+
         offered = list(catalogue.offered())
-        ready = [spec for spec in offered if keyed(spec)]
-        rest = [spec for spec in offered if not keyed(spec)]
+        ready = [spec for spec in offered if usable_now(spec)]
+        rest = [spec for spec in offered if not usable_now(spec)]
 
         def blurb(spec: catalogue.ProviderSpec) -> str:
+            # What was found about this one outranks what the catalogue says
+            # about it: "running here, three models" is the answer, and the
+            # sales line is what you read when there is no answer yet.
+            if spec.id in here:
+                return here[spec.id]
             if not keyed(spec):
                 return spec.blurb
             why = "key imported" if spec.label in self.imported.keys \
@@ -669,6 +739,9 @@ class SetupWizard:
         return done
 
     def finish(self, config: Config) -> None:
+        if self._keys:
+            self.console.clear()
+            self._crown()
         entry = config.active()
         body = Text.assemble(
             ("Ready.\n\n", self.theme.style("good", bold=True)),

{comodor-0.10.2 → comodor-0.11.0}/src/comodor/web/commands.py

@@ -66,12 +66,17 @@ def run(config: Config, args: argparse.Namespace) -> int:
 
 
 def _configured_or_explain(config: Config) -> Config | None:
-    """A usable configuration, or None having said what is missing.
+    """A usable configuration, or one the page will finish setting up.
 
-    The browser interface can switch between providers that are already set
-    up, but it has nowhere to type a key into and would be a poor place for
-    one anyway. Starting with none configured produces a URL, a browser
-    window, and a failure on the first task with nothing on screen to act on.
+    This used to refuse to start. That was right while the page had nowhere to
+    type a key, and it made the browser interface unreachable for the person
+    most likely to want it - somebody whose Comodor is on a server or in a
+    container, with no terminal in front of them.
+
+    So the terminal is still offered the wizard, because it is a nicer place
+    to answer questions, and declining it no longer stops anything: the page
+    asks instead. What decides whether a key may be typed there is where the
+    request comes from, which the server checks per request.
     """
     if not config.needs_setup:
         return config
@@ -89,25 +94,26 @@ def _configured_or_explain(config: Config) -> Config | None:
         try:
             config = run_setup(config)
         except (KeyboardInterrupt, EOFError):
-            print("\nSetup cancelled. Run `comodor setup` when you are ready.",
+            # Cancelled, not refused. The page can finish the job, and
+            # stopping here would leave somebody with nothing at all.
+            print("\nSetup cancelled — you can finish it in the browser.",
                   file=sys.stderr)
-            return None
-        return None if config.needs_setup else config
+        return config
 
-    # Nobody to ask: a container, a service unit, a pipeline. This message is
-    # the only thing that person will see, so it has to carry the answer.
-    print("Comodor has no provider configured, and the browser interface has "
-          "no way to add one.", file=sys.stderr)
+    # Nobody at a terminal: a container, a service unit, a pipeline. It starts
+    # anyway and the page asks. Said out loud, because a URL that opens onto a
+    # form is a surprise worth warning about.
+    print("No provider is configured yet — the page will ask when you open it.",
+          file=sys.stderr)
     print(file=sys.stderr)
-    print("  In Docker, pass a key in as an environment variable:",
+    print("  To skip that, pass a key in as an environment variable:",
           file=sys.stderr)
     print("    -e ANTHROPIC_API_KEY=...    -e OPENAI_API_KEY=...",
           file=sys.stderr)
-    print("  or mount a config file at "
-          f"{config.paths.config_file}.", file=sys.stderr)
-    print("  Anywhere with a terminal, `comodor setup` asks a few questions.",
+    print(f"  or mount a config file at {config.paths.config_file}.",
           file=sys.stderr)
-    return None
+    print(file=sys.stderr)
+    return config
 
 
 def banner_shown(server: Server) -> bool:

{comodor-0.10.2 → comodor-0.11.0}/src/comodor/web/index.html

@@ -35,6 +35,28 @@
             stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round">
       <path d="M10 4.5v11M4.5 10h11"/>
     </symbol>
+    <symbol id="i-rule" viewBox="0 0 20 20" fill="none" stroke="currentColor"
+            stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round">
+      <path d="M4.5 3.5h11v13h-11z"/><path d="M7 7h6M7 10h6M7 13h3.5"/>
+    </symbol>
+    <symbol id="i-off" viewBox="0 0 20 20" fill="none" stroke="currentColor"
+            stroke-width="1.6" stroke-linecap="round">
+      <circle cx="10" cy="10" r="6.6"/><path d="m5.6 5.6 8.8 8.8"/>
+    </symbol>
+    <symbol id="i-on" viewBox="0 0 20 20" fill="none" stroke="currentColor"
+            stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round">
+      <path d="m4.5 10.4 3.4 3.4 7.6-7.6"/>
+    </symbol>
+    <symbol id="i-pin" viewBox="0 0 20 20" fill="none" stroke="currentColor"
+            stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round">
+      <path d="M12.4 2.6 17.4 7.6l-2.5 1.2-1.6 4.4-5.5-5.5 4.4-1.6z"/>
+      <path d="M7.8 12.2 3.4 16.6"/>
+    </symbol>
+    <symbol id="i-export" viewBox="0 0 20 20" fill="none" stroke="currentColor"
+            stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round">
+      <path d="M10 13V3.5M6.5 7 10 3.5 13.5 7"/>
+      <path d="M3.5 12.5v3a1 1 0 0 0 1 1h11a1 1 0 0 0 1-1v-3"/>
+    </symbol>
     <symbol id="i-close" viewBox="0 0 20 20" fill="none" stroke="currentColor"
             stroke-width="1.8" stroke-linecap="round">
       <path d="m5.5 5.5 9 9M14.5 5.5l-9 9"/>
@@ -143,6 +165,8 @@
       <div class="tabs" role="tablist" aria-label="Sidebar">
         <button role="tab" id="tab-chat" aria-selected="true"
                 aria-controls="panel-chat">Chat</button>
+        <button role="tab" id="tab-rules" aria-selected="false"
+                aria-controls="panel-rules">Rules</button>
         <button role="tab" id="tab-admin" aria-selected="false"
                 aria-controls="panel-admin">Admin</button>
       </div>
@@ -164,6 +188,20 @@
       <div id="chats" role="list"></div>
     </div>
 
+    <div class="panel" id="panel-rules" role="tabpanel" aria-labelledby="tab-rules">
+      <form class="finder" id="rule-form">
+        <label class="field">
+          <svg aria-hidden="true"><use href="#i-rule"/></svg>
+          <input id="rule-text" type="text" maxlength="300"
+                 placeholder="Always run the tests before saying done"
+                 autocomplete="off" aria-label="Write a rule">
+        </label>
+        <button class="ghost-btn" type="submit" id="rule-add" title="Add this rule"
+                aria-label="Add this rule"><svg><use href="#i-new"/></svg></button>
+      </form>
+      <div id="rules-body"></div>
+    </div>
+
     <div class="panel" id="panel-admin" role="tabpanel" aria-labelledby="tab-admin">
       <div id="admin-body"></div>
     </div>
@@ -181,6 +219,8 @@
     <div id="log" tabindex="0" aria-label="Conversation">
       <div class="stream" id="stream" aria-live="polite"></div>
     </div>
+
+    <section id="setup" hidden aria-label="Set Comodor up"></section>
   </main>
 
   <!-- --------------------------------------------------------------- foot -->

{comodor-0.10.2 → comodor-0.11.0}/src/comodor/web/server.py

@@ -45,6 +45,8 @@ from .session import Session
 
 #: Loopback names, for deciding whether a warning is owed.
 LOCAL = ("127.0.0.1", "::1", "localhost")
+#: Addresses a request can arrive *from* and still be on this machine.
+LOOPBACK = ("127.0.0.1", "::1", "::ffff:127.0.0.1")
 COOKIE = "comodor_token"
 #: A header no cross-origin form or image can set, so its presence proves the
 #: request came from our own page rather than from somebody else's.
@@ -180,6 +182,25 @@ def _handler_for(server: Server) -> type[BaseHTTPRequestHandler]:
         def _json(self, status: int, payload: Any) -> None:
             self._send(status, json.dumps(payload).encode("utf-8"))
 
+        def _from_this_machine(self) -> bool:
+            """Whether this request never crossed a network.
+
+            Asked of the request, not of the bind: a server listening on every
+            address still answers loopback, and a rule about the bind would
+            have refused that. What it decides is whether an API key may be
+            typed into the page - there is no TLS here, and a key is a
+            credential with a bill attached.
+
+            A container is allowed as well. Its loopback is not the operator's
+            machine, but the operator chose how to publish the port and was
+            told at startup what that choice means.
+            """
+            try:
+                where = self.client_address[0]
+            except (AttributeError, IndexError):
+                return False
+            return where in LOOPBACK or server.contained
+
         def _token(self) -> str:
             cookies = self.headers.get("Cookie") or ""
             for part in cookies.split(";"):
@@ -280,6 +301,17 @@ def _handler_for(server: Server) -> type[BaseHTTPRequestHandler]:
                 self._json(200, server.session.admin())
                 return
 
+            if route == "/api/rules":
+                self._json(200, server.session.rules())
+                return
+
+            if route == "/api/setup":
+                offer = server.session.offer()
+                offer["may_enter_a_key"] = self._from_this_machine()
+                offer["port"] = server.port
+                self._json(200, offer)
+                return
+
             if route == "/api/events":
                 try:
                     cursor = int((query.get("cursor") or ["0"])[0])
@@ -366,6 +398,40 @@ def _handler_for(server: Server) -> type[BaseHTTPRequestHandler]:
                 server.stop()
                 return
 
+            if route == "/api/setup":
+                if not self._from_this_machine():
+                    self._json(403, {
+                        "ok": False,
+                        "error": "There is no TLS here, so a key typed into "
+                                 "this page would cross the network in the "
+                                 "clear. Set it up on the machine Comodor is "
+                                 "running on, or reach this page through an "
+                                 "SSH tunnel."})
+                    return
+                done, why = server.session.set_up(
+                    str(body.get("provider") or ""),
+                    api_key=str(body.get("api_key") or ""),
+                    model=str(body.get("model") or ""),
+                    base_url=str(body.get("base_url") or ""))
+                self._json(200 if done else 400,
+                           {"ok": done, "error": why,
+                            "state": server.session.state()})
+                return
+
+            if route == "/api/rules":
+                action = str(body.get("action") or "")
+                if action == "export":
+                    done, why, where = server.session.export_rules()
+                    self._json(200 if done else 500,
+                               {"ok": done, "error": why, "path": where})
+                    return
+                done, why, extra = server.session.rule(
+                    action, id=body.get("id"),
+                    statement=body.get("statement"))
+                self._json(200 if done else 400,
+                           {"ok": done, "error": why, "rule": extra})
+                return
+
             if route == "/api/setting":
                 done, why = server.session.setting(str(body.get("key") or ""),
                                                    body.get("value"))