core-cli 1.0.0__py3-none-any.whl

core_cli/resources/proposals/manage.py

@@ -0,0 +1,183 @@
+# src/core_cli/resources/proposals/manage.py
+
+from __future__ import annotations
+
+from datetime import datetime
+
+import httpx
+import typer
+from rich.console import Console
+
+from api.cli import CoreApiClient
+from cli.utils import core_command
+
+
+console = Console()
+
+
+def _print_detailed_info(p: dict) -> None:
+    console.print(f"\n[bold cyan]Proposal: {p['proposal_id']}[/bold cyan]\n")
+    console.print(f"[bold]Goal:[/bold] {p.get('goal', '')}")
+    console.print(f"[bold]Status:[/bold] {p['status']}")
+    console.print(f"[bold]Created:[/bold] {p['created_at']}")
+    console.print(f"[bold]Created By:[/bold] {p.get('created_by', '')}\n")
+    risk = p.get("risk")
+    if risk:
+        console.print("[bold]Risk Assessment:[/bold]")
+        console.print(f"  Overall: {risk['overall_risk']}")
+        approval = "Yes" if p.get("approval_required") else "No"
+        console.print(f"  Approval Required: {approval}")
+        for factor in risk.get("risk_factors", []):
+            console.print(f"    - {factor}")
+        console.print("")
+    actions = p.get("actions", [])
+    console.print(f"[bold]Actions ({len(actions)}):[/bold]")
+    for a in sorted(actions, key=lambda x: x.get("order", 0)):
+        ref = a.get("action_id") or a.get("flow_id") or "?"
+        console.print(f"  {a.get('order', 0) + 1}. {ref}")
+        if a.get("parameters"):
+            console.print(f"     Parameters: {a['parameters']}")
+    scope = p.get("scope") or {}
+    files = scope.get("files") or []
+    modules = scope.get("modules") or []
+    if files or modules:
+        console.print("\n[bold]Scope:[/bold]")
+        if files:
+            console.print(f"  Files: {len(files)}")
+        if modules:
+            console.print(f"  Modules: {', '.join(modules)}")
+    started = p.get("execution_started_at")
+    completed = p.get("execution_completed_at")
+    if started:
+        console.print("\n[bold]Execution:[/bold]")
+        console.print(f"  Started: {started}")
+        if completed:
+            dur = (
+                datetime.fromisoformat(completed) - datetime.fromisoformat(started)
+            ).total_seconds()
+            console.print(f"  Completed: {completed}")
+            console.print(f"  Duration: {dur}s")
+    failure_reason = p.get("failure_reason")
+    if failure_reason:
+        console.print(f"\n[red]Failure Reason: {failure_reason}[/red]")
+
+
+def _print_execution_summary(result: dict) -> None:
+    if not result.get("ok") and "actions_executed" not in result:
+        console.print(f"Error: {result.get('error', 'Unknown error')}")
+        return
+    console.print(f"Actions executed: {result.get('actions_executed', 0)}")
+    console.print(f"Succeeded: {result.get('actions_succeeded', 0)}")
+    console.print(f"Failed: {result.get('actions_failed', 0)}")
+    console.print(f"Duration: {result.get('duration_sec', 0)}s\n")
+    console.print("[bold]Action Results:[/bold]")
+    for action_id, res in result.get("action_results", {}).items():
+        mark = "[green]✓[/green]" if res["ok"] else "[red]✗[/red]"
+        console.print(f"  {mark} {action_id}: {res['duration_sec']}s")
+        if not res["ok"]:
+            err = res.get("data", {}).get("error", "Unknown error")
+            console.print(f"      [red]{err}[/red]")
+
+
+@core_command(dangerous=False, requires_context=False)
+# ID: 9bacc55b-be1d-4f71-a27e-6e83ba176e33
+async def show_proposal(proposal_id: str = typer.Argument(...)) -> None:
+    """Show detailed breakdown and risk assessment of a proposal."""
+    client = CoreApiClient()
+    try:
+        proposal = await client.get_proposal(proposal_id)
+    except httpx.HTTPStatusError as exc:
+        if exc.response.status_code == 404:
+            console.print(f"[red]Proposal {proposal_id} not found.[/red]")
+            raise typer.Exit(1) from exc
+        raise
+    _print_detailed_info(proposal)
+
+
+@core_command(dangerous=False, requires_context=False)
+# ID: f2e065f7-c253-4c33-ae0d-5374ffdb8e23
+async def approve_proposal(
+    proposal_id: str = typer.Argument(...),
+    by: str = typer.Option("cli_admin", "--by", help="Approver identity."),
+    authority: str = typer.Option(
+        "principal.governor",
+        "--authority",
+        help="Authority under which approval is granted (URS NFR.5).",
+    ),
+) -> None:
+    """Authorize a pending proposal for execution."""
+    client = CoreApiClient()
+    try:
+        response = await client.approve_proposal(
+            proposal_id, approved_by=by, approval_authority=authority
+        )
+    except httpx.HTTPStatusError as exc:
+        status_code = exc.response.status_code
+        if status_code == 404:
+            console.print(f"[red]Proposal {proposal_id} not found.[/red]")
+            raise typer.Exit(1) from exc
+        if status_code == 400:
+            try:
+                detail = exc.response.json().get("detail", exc.response.text)
+            except ValueError:
+                detail = exc.response.text
+            console.print(f"[red]{detail}[/red]")
+            raise typer.Exit(1) from exc
+        raise
+
+    console.print(
+        f"[green]✅ Proposal {proposal_id} APPROVED by "
+        f"{response['approved_by']} under {response['approval_authority']}.[/green]"
+    )
+
+
+@core_command(dangerous=True, confirmation=True, requires_context=False)
+# ID: f4cdc45a-2f42-4916-b4e3-a305b5357a9d
+async def execute_proposal(
+    proposal_id: str = typer.Argument(...),
+    write: bool = typer.Option(False, "--write", help="Apply changes to the system."),
+) -> None:
+    """Execute an approved proposal.
+
+    Runs the atomic action sequence defined in the proposal.
+    """
+    if not write:
+        console.print("[yellow]💡 Dry-run: simulating execution steps...[/yellow]\n")
+    client = CoreApiClient()
+    result = await client.execute_proposal(proposal_id, write=write)
+    if result.get("ok"):
+        console.print(
+            f"\n[bold green]✅ Execution Successful: {proposal_id}[/bold green]"
+        )
+    else:
+        console.print(f"\n[bold red]❌ Execution Failed: {proposal_id}[/bold red]")
+    _print_execution_summary(result)
+
+
+@core_command(dangerous=False, requires_context=False)
+# ID: 4ac3cfc1-feae-440c-b02f-4c57a6a1147d
+async def reject_proposal(
+    proposal_id: str = typer.Argument(...),
+    reason: str = typer.Option(..., "--reason", "-r"),
+) -> None:
+    """Reject a proposal and prevent its execution.
+
+    Revival of deferred findings (ADR-010 §7a / ADR-045) now happens
+    on the API side; this command only renders the result.
+    """
+    client = CoreApiClient()
+    try:
+        response = await client.reject_proposal(proposal_id, reason=reason)
+    except httpx.HTTPStatusError as exc:
+        if exc.response.status_code == 404:
+            console.print(f"[red]Proposal {proposal_id} not found.[/red]")
+            raise typer.Exit(1) from exc
+        raise
+
+    console.print(f"[yellow]🚫 Proposal {response['proposal_id']} REJECTED.[/yellow]")
+    revived_count = response.get("revived_count", 0)
+    if revived_count > 0:
+        console.print(
+            f"[cyan]   Revived {revived_count} deferred "
+            f"finding(s) to awaiting_reaudit for sensor adjudication.[/cyan]"
+        )

core_cli/resources/secrets/__init__.py

@@ -0,0 +1,10 @@
+# src/cli/resources/secrets/__init__.py
+"""Secrets resource hub."""
+
+from __future__ import annotations
+
+from . import manage  # noqa: F401
+from .hub import app
+
+
+__all__ = ["app"]

core_cli/resources/secrets/hub.py

@@ -0,0 +1,9 @@
+# src/cli/resources/secrets/hub.py
+import typer
+
+
+app = typer.Typer(
+    name="secrets",
+    help="Manage encrypted secrets in the database.",
+    no_args_is_help=True,
+)

core_cli/resources/secrets/manage.py

@@ -0,0 +1,160 @@
+# src/core_cli/resources/secrets/manage.py
+
+"""Encrypted secrets management — consumer CLI over HTTP (ADR-146 D2)."""
+
+from __future__ import annotations
+
+import typer
+from rich.console import Console
+from rich.table import Table
+
+from api.cli import CoreApiClient
+from cli.utils import core_command
+
+from .hub import app
+
+
+console = Console()
+
+
+@app.command("set")
+@core_command(dangerous=True, requires_context=False)
+# ID: 92bcc7e9-189f-45d0-bc18-21512bcba69f
+async def set_secret(
+    ctx: typer.Context,
+    key: str = typer.Argument(..., help="Secret key (e.g., 'anthropic.api_key')"),
+    value: str = typer.Option(
+        ...,
+        "--value",
+        "-v",
+        prompt=True,
+        hide_input=True,
+        help="Secret value (will be encrypted at rest)",
+    ),
+    description: str | None = typer.Option(
+        None, "--description", "-d", help="Optional description"
+    ),
+    force: bool = typer.Option(
+        False, "--force", "-f", help="Overwrite without 409 error if key exists"
+    ),
+) -> None:
+    """Store an encrypted secret in the CORE installation."""
+    if not key.strip():
+        console.print("[red]Secret key cannot be empty.[/red]")
+        raise typer.Exit(code=1)
+    client = CoreApiClient()
+    try:
+        result = await client.secrets.set_secret(
+            key=key, value=value, description=description, force=force
+        )
+    except Exception as exc:
+        import httpx
+
+        if isinstance(exc, httpx.HTTPStatusError) and exc.response.status_code == 409:
+            console.print(
+                f"[red]Secret '{key}' already exists. Use --force to overwrite.[/red]"
+            )
+            raise typer.Exit(code=1) from exc
+        console.print(f"[red]Failed to store secret: {exc}[/red]")
+        raise typer.Exit(code=1) from exc
+    action = result.get("action", "stored")
+    console.print(f"[green]Secret '{key}' {action}.[/green]")
+
+
+@app.command("get")
+@core_command(dangerous=False, requires_context=False)
+# ID: 01608ce2-3fb8-4f0d-ae1a-abaec72369d7
+async def get(
+    ctx: typer.Context,
+    key: str = typer.Argument(..., help="Secret key to retrieve"),
+    show: bool = typer.Option(False, "--show", "-s", help="Display the secret value"),
+) -> None:
+    """Check whether a secret exists (optionally reveal value with --show)."""
+    client = CoreApiClient()
+    try:
+        result = await client.secrets.get_secret(key=key, show=show)
+    except Exception as exc:
+        import httpx
+
+        if isinstance(exc, httpx.HTTPStatusError) and exc.response.status_code == 404:
+            console.print(f"[red]Secret '{key}' not found.[/red]")
+            raise typer.Exit(code=1) from exc
+        raise
+    if show:
+        console.print(f"[bold]Secret '{key}':[/bold]")
+        console.print(result.get("value", ""))
+    else:
+        console.print(f"[green]Secret '{key}' exists.[/green]")
+
+
+@app.command("list")
+@core_command(dangerous=False, requires_context=False)
+# ID: cf23ee88-7f5e-47e9-91de-7414ef0c36ed
+async def list_secrets(ctx: typer.Context) -> None:
+    """List all secret keys in the CORE installation (values not shown)."""
+    client = CoreApiClient()
+    result = await client.secrets.list_secrets()
+    secrets = result.get("secrets") or []
+    if not secrets:
+        console.print("[yellow]No secrets found.[/yellow]")
+        return
+    table = Table(title="Encrypted Secrets")
+    table.add_column("Key", style="cyan", no_wrap=True)
+    table.add_column("Last Rotated", style="dim")
+    table.add_column("Created", style="dim")
+    for s in secrets:
+        table.add_row(
+            s["key"],
+            str(s.get("last_rotated_at") or "never"),
+            str(s.get("created_at") or "unknown"),
+        )
+    console.print(table)
+    console.print(f"[dim]Total: {result.get('count', len(secrets))} secrets[/dim]")
+
+
+@app.command("delete")
+@core_command(dangerous=True, requires_context=False)
+# ID: cc76acdd-0ef9-4602-86b0-09580546dd05
+async def delete(
+    ctx: typer.Context,
+    key: str = typer.Argument(..., help="Secret key to delete"),
+    yes: bool = typer.Option(False, "--yes", "-y", help="Skip confirmation prompt"),
+) -> None:
+    """Permanently delete a secret from the CORE installation."""
+    if not yes:
+        typer.confirm(f"Delete secret '{key}'?", abort=True)
+    client = CoreApiClient()
+    try:
+        await client.secrets.delete_secret(key)
+    except Exception as exc:
+        import httpx
+
+        if isinstance(exc, httpx.HTTPStatusError) and exc.response.status_code == 404:
+            console.print(f"[red]Secret '{key}' not found.[/red]")
+            raise typer.Exit(code=1) from exc
+        raise
+    console.print(f"[green]Secret '{key}' deleted.[/green]")
+
+
+@app.command("rotate")
+@core_command(dangerous=True, requires_context=False)
+# ID: 634e4701-120b-4a5e-88ef-f4cb0db315a9
+async def rotate(
+    ctx: typer.Context,
+    key: str = typer.Argument(..., help="Secret key to rotate"),
+    new_value: str = typer.Option(
+        ..., "--value", "-v", prompt=True, hide_input=True, help="New secret value"
+    ),
+) -> None:
+    """Rotate the value of an existing secret (updates last_rotated_at)."""
+    client = CoreApiClient()
+    try:
+        await client.secrets.rotate_secret(key, new_value)
+    except Exception as exc:
+        import httpx
+
+        if isinstance(exc, httpx.HTTPStatusError) and exc.response.status_code == 404:
+            console.print(f"[red]Secret '{key}' not found.[/red]")
+            raise typer.Exit(code=1) from exc
+        raise
+    console.print(f"[green]Secret '{key}' rotated.[/green]")

core_cli/resources/symbols/__init__.py

@@ -0,0 +1,14 @@
+"""Consumer symbol-registry commands."""
+
+from __future__ import annotations
+
+from . import (  # noqa: F401
+    audit,
+    fix_ids,
+    resolve_duplicates,
+    sync,
+)
+from .hub import app
+
+
+__all__ = ["app"]

core_cli/resources/symbols/audit.py

@@ -0,0 +1,56 @@
+# src/core_cli/resources/symbols/audit.py
+
+"""Symbol audit command — consumer CLI over HTTP (ADR-146 D2)."""
+
+from __future__ import annotations
+
+import typer
+from rich.console import Console
+
+from api.cli import CoreApiClient
+from cli.utils import core_command
+
+from .hub import app
+
+
+console = Console()
+
+
+@app.command("audit")
+@core_command(dangerous=False, requires_context=False)
+# ID: 2c32679a-ad9d-48e3-8cb0-b4cec7adea29
+async def audit_symbols(ctx: typer.Context) -> None:
+    """Audit symbol integrity: drift summary and unassigned ID report."""
+    client = CoreApiClient()
+
+    console.print("[bold cyan]1. Checking for Symbol Drift (Disk vs DB)...[/bold cyan]")
+    drift = await client.symbols.get_drift()
+    if not drift.get("available", True):
+        console.print(f"[yellow]Drift data unavailable: {drift.get('error')}[/yellow]")
+    else:
+        violations = drift.get("anchor_violations", 0)
+        pending = drift.get("pending_symbols", 0)
+        last_sync = drift.get("last_sync_at") or "never"
+        if violations == 0 and pending == 0:
+            console.print("[green]No drift detected.[/green]")
+        else:
+            if violations:
+                console.print(f"[yellow]{violations} open anchor violation(s).[/yellow]")
+            if pending:
+                console.print(f"[yellow]{pending} symbol(s) pending classification.[/yellow]")
+        console.print(f"[dim]Last sync: {last_sync}[/dim]")
+
+    console.print("\n[bold cyan]2. Checking for Unassigned IDs...[/bold cyan]")
+    result = await client.symbols.get_unassigned()
+    unassigned = result.get("unassigned", [])
+    if not unassigned:
+        console.print("[green]All public symbols have assigned IDs.[/green]")
+    else:
+        console.print(f"[yellow]{len(unassigned)} symbol(s) with no ID tag.[/yellow]")
+        for item in unassigned[:10]:
+            console.print(f"   - {item.get('name')} ({item.get('file_path')})")
+        if len(unassigned) > 10:
+            console.print(f"   ... and {len(unassigned) - 10} more.")
+        console.print(
+            "\n[dim]Tip: Run 'core-admin symbols fix-ids --write' to fix this.[/dim]"
+        )

core_cli/resources/symbols/fix_ids.py

@@ -0,0 +1,39 @@
+# src/core_cli/resources/symbols/fix_ids.py
+
+"""Assign stable # ID: anchors to untagged symbols — consumer CLI over HTTP (ADR-146 D2)."""
+
+from __future__ import annotations
+
+import typer
+from rich.console import Console
+
+from api.cli import CoreApiClient
+from cli.utils import core_command
+
+from .hub import app
+
+
+console = Console()
+
+
+@app.command("fix-ids")
+@core_command(dangerous=True, requires_context=False, confirmation=True)
+# ID: 37ac33b4-76d3-40c4-8955-3b81a2a4ccf2
+async def fix_ids_command(
+    ctx: typer.Context,
+    write: bool = typer.Option(
+        False, "--write", help="Inject missing UUIDs into source files."
+    ),
+) -> None:
+    """Assign stable '# ID:' anchors to all untagged public symbols.
+
+    Scans 'src/' and modifies files to ensure knowledge graph stability.
+    Pass --write to apply changes (default is dry-run).
+    """
+    mode = "WRITE" if write else "DRY-RUN"
+    console.print(f"[bold cyan]Fixing symbol IDs ({mode})...[/bold cyan]")
+    client = CoreApiClient()
+    result = await client.fix.run_fix("fix.ids", write=write)
+    run_id = result.get("run_id")
+    console.print(f"[green]Dispatched fix.ids run {run_id}.[/green]")
+    console.print(f"[dim]Poll with: core-admin fix status {run_id}[/dim]")

core_cli/resources/symbols/hub.py

@@ -0,0 +1,11 @@
+# src/cli/resources/symbols/hub.py
+
+import typer
+
+
+# Stable hub for symbols resource commands
+app = typer.Typer(
+    name="symbols",
+    help="Operations for the symbol registry and Knowledge Graph identification.",
+    no_args_is_help=True,
+)

core_cli/resources/symbols/resolve_duplicates.py

@@ -0,0 +1,37 @@
+# src/core_cli/resources/symbols/resolve_duplicates.py
+
+"""Resolve duplicate symbol IDs — consumer CLI over HTTP (ADR-146 D2)."""
+
+from __future__ import annotations
+
+import typer
+from rich.console import Console
+
+from api.cli import CoreApiClient
+from cli.utils import core_command
+
+from .hub import app
+
+
+console = Console()
+
+
+@app.command("resolve-duplicates")
+@core_command(dangerous=True, requires_context=False, confirmation=True)
+# ID: c9ca3aa7-a542-4f3c-bbf3-d8dc97d4400a
+async def resolve_symbol_duplicates(
+    ctx: typer.Context,
+    write: bool = typer.Option(False, "--write", help="Regenerate conflicting UUIDs."),
+) -> None:
+    """Find and resolve duplicate '# ID:' anchors in the codebase.
+
+    The older entry is preserved; colliding symbols receive fresh identifiers.
+    Pass --write to apply changes (default is dry-run).
+    """
+    mode = "RESOLVING" if write else "ANALYZING"
+    console.print(f"[bold cyan]{mode} duplicate ID collisions...[/bold cyan]")
+    client = CoreApiClient()
+    result = await client.fix.run_fix("fix.duplicate_ids", write=write)
+    run_id = result.get("run_id")
+    console.print(f"[green]Dispatched fix.duplicate_ids run {run_id}.[/green]")
+    console.print(f"[dim]Poll with: core-admin fix status {run_id}[/dim]")

core_cli/resources/symbols/sync.py

@@ -0,0 +1,39 @@
+# src/core_cli/resources/symbols/sync.py
+
+"""Synchronize filesystem symbols with the DB — consumer CLI over HTTP (ADR-146 D2)."""
+
+from __future__ import annotations
+
+import typer
+from rich.console import Console
+
+from api.cli import CoreApiClient
+from cli.utils import core_command
+
+from .hub import app
+
+
+console = Console()
+
+
+@app.command("sync")
+@core_command(dangerous=True, requires_context=False)
+# ID: 7de43597-32ac-4e0f-9e55-af90f4c716f6
+async def sync_symbols(
+    ctx: typer.Context,
+    write: bool = typer.Option(
+        False, "--write", help="Apply synchronization to the database."
+    ),
+) -> None:
+    """Synchronize filesystem symbols with the PostgreSQL Knowledge Graph.
+
+    Scans 'src/' and updates the 'core.symbols' table.
+    Pass --write to apply changes (default is dry-run).
+    """
+    mode = "WRITE" if write else "DRY-RUN"
+    console.print(f"[bold cyan]Synchronizing Symbols to DB ({mode})...[/bold cyan]")
+    client = CoreApiClient()
+    result = await client.fix.run_fix("sync.db", write=write)
+    run_id = result.get("run_id")
+    console.print(f"[green]Dispatched sync.db run {run_id}.[/green]")
+    console.print(f"[dim]Poll with: core-admin fix status {run_id}[/dim]")

core_cli/resources/vectors/__init__.py

@@ -0,0 +1,15 @@
+"""Consumer vector-store commands."""
+
+from __future__ import annotations
+
+from . import (  # noqa: F401
+    query,
+    rebuild,
+    status,
+    sync,
+    sync_code,
+)
+from .hub import app
+
+
+__all__ = ["app"]

core_cli/resources/vectors/hub.py

@@ -0,0 +1,9 @@
+# src/cli/resources/vectors/hub.py
+import typer
+
+
+app = typer.Typer(
+    name="vectors",
+    help="Vector store operations (Qdrant).",
+    no_args_is_help=True,
+)

core_cli/resources/vectors/query.py

@@ -0,0 +1,66 @@
+# src/core_cli/resources/vectors/query.py
+
+"""Semantic vector search command — consumer CLI over HTTP (ADR-146 D2)."""
+
+from __future__ import annotations
+
+import typer
+from rich.console import Console
+
+from api.cli import CoreApiClient
+from cli.utils import core_command
+
+from .hub import app
+
+
+console = Console()
+
+
+@app.command("query")
+@core_command(requires_context=False)
+# ID: 44056798-de41-4934-8bba-97e6f88ce1f0
+async def query_vectors(
+    ctx: typer.Context,
+    query: str = typer.Argument(..., help="Natural language query"),
+    collection: str = typer.Option(
+        "policies",
+        "--collection",
+        "-c",
+        help="Collection to query: 'policies', 'patterns', 'specs', or 'code'",
+    ),
+    limit: int = typer.Option(5, "--limit", "-n", help="Max results to return"),
+) -> None:
+    """Semantic search in vector collections.
+
+    Search constitutional documents using natural language queries.
+
+    Examples:
+        core-admin vectors query "file access rules"
+        core-admin vectors query "atomic actions" --collection patterns --limit 3
+    """
+    console.print(f"[bold cyan]Querying {collection}[/bold cyan]")
+    console.print(f"Query: {query}")
+    console.print()
+    client = CoreApiClient()
+    try:
+        result = await client.vectors.query(query, collection=collection, limit=limit)
+    except Exception as exc:
+        console.print(f"[red]Error: {exc}[/red]")
+        raise typer.Exit(1) from exc
+
+    results = result.get("results", [])
+    if not results:
+        console.print("[yellow]No results found[/yellow]")
+        return
+
+    console.print(f"[bold]Top {len(results)} results:[/bold]")
+    console.print("")
+    for i, hit in enumerate(results, 1):
+        score = hit.get("score", 0.0)
+        payload = hit.get("payload") or {}
+        content = payload.get("content") or payload.get("text") or ""
+        doc_id = payload.get("doc_id") or payload.get("chunk_id") or "Unknown"
+        content_preview = content[:200] if content else "[No content available]"
+        console.print(f"[bold cyan]{i}. {doc_id}[/bold cyan] (score: {score:.4f})")
+        console.print(f"   {content_preview}...")
+        console.print("")