core-runtime 0.1.1__py3-none-any.whl

cli/resources/secrets/__init__.py

@@ -0,0 +1,10 @@
+# src/cli/resources/secrets/__init__.py
+"""Secrets resource hub."""
+
+from __future__ import annotations
+
+from . import manage
+from .hub import app
+
+
+__all__ = ["app"]

cli/resources/secrets/hub.py

@@ -0,0 +1,9 @@
+# src/cli/resources/secrets/hub.py
+import typer
+
+
+app = typer.Typer(
+    name="secrets",
+    help="Manage encrypted secrets in the database.",
+    no_args_is_help=True,
+)

cli/resources/secrets/manage.py

@@ -0,0 +1,309 @@
+# src/cli/resources/secrets/manage.py
+"""
+CLI commands for encrypted secrets management.
+Constitutional compliance: agent_governance, data_governance, operations.
+"""
+
+from __future__ import annotations
+
+import time
+
+import typer
+from rich.console import Console
+from rich.table import Table
+
+from cli.utils import (
+    confirm_action,
+    core_command,
+    display_error,
+    display_info,
+    display_success,
+    display_warning,
+)
+from shared.action_types import ActionImpact, ActionResult
+from shared.exceptions import SecretNotFoundError, SecretsError
+from shared.infrastructure.database.session_manager import get_session
+from shared.infrastructure.secrets_service import get_secrets_service
+
+from .hub import app
+
+
+console = Console()
+
+
+AUDIT_CONTEXT_SET = "cli:set"
+AUDIT_CONTEXT_SET_CHECK = "cli:set:check"
+AUDIT_CONTEXT_GET = "cli:get"
+AUDIT_CONTEXT_LIST = "cli:list"
+AUDIT_CONTEXT_DELETE = "cli:delete"
+
+
+async def _set_secret_internal(
+    key: str, value: str, description: str | None, force: bool
+) -> ActionResult:
+    """Store an encrypted secret in the database."""
+    start_time = time.time()
+    async with get_session() as db:
+        secrets_service = await get_secrets_service(db)
+        try:
+            overwrite_confirmed = False
+            if not force:
+                try:
+                    await secrets_service.get_secret(
+                        db, key, audit_context=AUDIT_CONTEXT_SET_CHECK
+                    )
+                    if not confirm_action(
+                        f"Secret '{key}' already exists. Overwrite?",
+                        abort_message="Overwrite cancelled",
+                    ):
+                        return ActionResult(
+                            action_id="secrets.set",
+                            ok=False,
+                            data={"key": key, "action": "cancelled"},
+                            duration_sec=time.time() - start_time,
+                            impact=ActionImpact.READ_ONLY,
+                            warnings=["User cancelled overwrite"],
+                        )
+                    overwrite_confirmed = True
+                except SecretNotFoundError:
+                    pass
+            await secrets_service.set_secret(
+                db,
+                key=key,
+                value=value,
+                description=description,
+                audit_context=AUDIT_CONTEXT_SET,
+            )
+            display_success(f"Secret '{key}' stored successfully")
+            return ActionResult(
+                action_id="secrets.set",
+                ok=True,
+                data={
+                    "key": key,
+                    "action": "overwritten" if overwrite_confirmed else "created",
+                    "has_description": description is not None,
+                },
+                duration_sec=time.time() - start_time,
+                impact=ActionImpact.WRITE_DATA,
+            )
+        except SecretsError as exc:
+            display_error(f"Failed to store secret: {exc.message}")
+            return ActionResult(
+                action_id="secrets.set",
+                ok=False,
+                data={"key": key, "error": exc.message},
+                duration_sec=time.time() - start_time,
+                impact=ActionImpact.READ_ONLY,
+                warnings=[str(exc)],
+            )
+
+
+async def _get_internal(key: str, show: bool) -> ActionResult:
+    """Retrieve and decrypt a secret from the database."""
+    start_time = time.time()
+    async with get_session() as db:
+        secrets_service = await get_secrets_service(db)
+        try:
+            value = await secrets_service.get_secret(
+                db, key, audit_context=AUDIT_CONTEXT_GET
+            )
+            if show:
+                display_info(f"Secret '{key}':")
+                console.print(value)
+            else:
+                display_success(f"Secret '{key}' exists (use --show to display)")
+            return ActionResult(
+                action_id="secrets.get",
+                ok=True,
+                data={"key": key, "exists": True, "displayed": show},
+                duration_sec=time.time() - start_time,
+                impact=ActionImpact.READ_ONLY,
+            )
+        except SecretNotFoundError:
+            display_error(f"Secret '{key}' not found")
+            return ActionResult(
+                action_id="secrets.get",
+                ok=False,
+                data={"key": key, "exists": False},
+                duration_sec=time.time() - start_time,
+                impact=ActionImpact.READ_ONLY,
+                warnings=[f"Secret '{key}' not found"],
+            )
+        except SecretsError as exc:
+            display_error(f"Failed to retrieve secret: {exc.message}")
+            return ActionResult(
+                action_id="secrets.get",
+                ok=False,
+                data={"key": key, "error": exc.message},
+                duration_sec=time.time() - start_time,
+                impact=ActionImpact.READ_ONLY,
+                warnings=[str(exc)],
+            )
+
+
+async def _list_secrets_internal() -> ActionResult:
+    """List all secret keys (not values) in the database."""
+    start_time = time.time()
+    async with get_session() as db:
+        secrets_service = await get_secrets_service(db)
+        try:
+            secrets_list = await secrets_service.list_secrets(db)
+            if not secrets_list:
+                display_warning("No secrets found in database")
+                return ActionResult(
+                    action_id="secrets.list",
+                    ok=True,
+                    data={"count": 0, "secrets": []},
+                    duration_sec=time.time() - start_time,
+                    impact=ActionImpact.READ_ONLY,
+                )
+            table = Table(title="Encrypted Secrets")
+            table.add_column("Key", style="cyan", no_wrap=True)
+            table.add_column("Description", style="white")
+            table.add_column("Last Updated", style="dim")
+            for secret in secrets_list:
+                table.add_row(
+                    secret["key"],
+                    secret.get("description") or "",
+                    (
+                        str(secret.get("last_updated"))
+                        if secret.get("last_updated")
+                        else "none"
+                    ),
+                )
+            console.print(table)
+            display_info(f"Total: {len(secrets_list)} secrets")
+            return ActionResult(
+                action_id="secrets.list",
+                ok=True,
+                data={
+                    "count": len(secrets_list),
+                    "secrets": [s["key"] for s in secrets_list],
+                },
+                duration_sec=time.time() - start_time,
+                impact=ActionImpact.READ_ONLY,
+            )
+        except SecretsError as exc:
+            display_error(f"Failed to list secrets: {exc.message}")
+            return ActionResult(
+                action_id="secrets.list",
+                ok=False,
+                data={"error": exc.message},
+                duration_sec=time.time() - start_time,
+                impact=ActionImpact.READ_ONLY,
+                warnings=[str(exc)],
+            )
+
+
+async def _delete_internal(key: str) -> ActionResult:
+    """Delete a secret from the database."""
+    start_time = time.time()
+    async with get_session() as db:
+        secrets_service = await get_secrets_service(db)
+        try:
+            await secrets_service.delete_secret(db, key)
+            display_success(f"Secret '{key}' deleted")
+            return ActionResult(
+                action_id="secrets.delete",
+                ok=True,
+                data={"key": key, "action": "deleted"},
+                duration_sec=time.time() - start_time,
+                impact=ActionImpact.WRITE_DATA,
+            )
+        except SecretNotFoundError:
+            display_error(f"Secret '{key}' not found")
+            return ActionResult(
+                action_id="secrets.delete",
+                ok=False,
+                data={"key": key, "exists": False},
+                duration_sec=time.time() - start_time,
+                impact=ActionImpact.READ_ONLY,
+                warnings=[f"Secret '{key}' not found"],
+            )
+        except SecretsError as exc:
+            display_error(f"Failed to delete secret: {exc.message}")
+            return ActionResult(
+                action_id="secrets.delete",
+                ok=False,
+                data={"key": key, "error": exc.message},
+                duration_sec=time.time() - start_time,
+                impact=ActionImpact.READ_ONLY,
+                warnings=[str(exc)],
+            )
+
+
+@app.command("set")
+@core_command(dangerous=True, requires_context=False)
+# ID: 92bcc7e9-189f-45d0-bc18-21512bcba69f
+async def set_secret(
+    ctx: typer.Context,
+    key: str = typer.Argument(..., help="Secret key (e.g., 'anthropic.api_key')"),
+    value: str = typer.Option(
+        ...,
+        "--value",
+        "-v",
+        prompt=True,
+        hide_input=True,
+        help="Secret value (will be encrypted)",
+    ),
+    description: str | None = typer.Option(
+        None, "--description", "-d", help="Optional description"
+    ),
+    force: bool = typer.Option(
+        False, "--force", "-f", help="Overwrite without confirmation"
+    ),
+) -> None:
+    """Store an encrypted secret in the database."""
+    if not key.strip():
+        display_error("Secret key cannot be empty")
+        raise typer.Exit(code=1)
+    result = await _set_secret_internal(
+        key=key, value=value, description=description, force=force
+    )
+    if not result.ok:
+        raise typer.Exit(code=1)
+
+
+@app.command("get")
+@core_command(dangerous=False, requires_context=False)
+# ID: 01608ce2-3fb8-4f0d-ae1a-abaec72369d7
+async def get(
+    ctx: typer.Context,
+    key: str = typer.Argument(..., help="Secret key to retrieve"),
+    show: bool = typer.Option(False, "--show", "-s", help="Display the secret value"),
+) -> None:
+    """Retrieve an encrypted secret from the database."""
+    result = await _get_internal(key=key, show=show)
+    if not result.ok:
+        raise typer.Exit(code=1)
+
+
+@app.command("list")
+@core_command(dangerous=False, requires_context=False)
+# ID: cf23ee88-7f5e-47e9-91de-7414ef0c36ed
+async def list_secrets(ctx: typer.Context) -> None:
+    """List all secret keys in the database (does not show values)."""
+    result = await _list_secrets_internal()
+    if not result.ok:
+        raise typer.Exit(code=1)
+
+
+@app.command("delete")
+@core_command(dangerous=True, requires_context=False)
+# ID: cc76acdd-0ef9-4602-86b0-09580546dd05
+async def delete(
+    ctx: typer.Context,
+    key: str = typer.Argument(..., help="Secret key to delete"),
+    yes: bool = typer.Option(False, "--yes", "-y", help="Skip confirmation prompt"),
+) -> None:
+    """Delete a secret from the database."""
+    if not yes and (
+        not confirm_action(
+            f"Are you sure you want to delete secret '{key}'?",
+            abort_message="Deletion cancelled",
+        )
+    ):
+        return
+    result = await _delete_internal(key=key)
+    if not result.ok:
+        raise typer.Exit(code=1)

cli/resources/symbols/__init__.py

@@ -0,0 +1,13 @@
+# src/cli/resources/symbols/__init__.py
+"""Symbol registry and Knowledge Graph operations."""
+
+from __future__ import annotations
+
+# 2. Register all symbol neurons
+from . import audit, fix_ids, resolve_duplicates, sync, tag
+
+# 1. Import the stable app from the hub
+from .hub import app
+
+
+__all__ = ["app"]

cli/resources/symbols/audit.py

@@ -0,0 +1,46 @@
+# src/cli/resources/symbols/audit.py
+import typer
+from rich.console import Console
+
+from cli.logic.diagnostics import get_unassigned_symbols_logic
+from cli.logic.symbol_drift import inspect_symbol_drift
+from cli.utils import core_command
+
+from .hub import app
+
+
+console = Console()
+
+
+@app.command("audit")
+@core_command(dangerous=False, requires_context=True)
+# ID: 2c32679a-ad9d-48e3-8cb0-b4cec7adea29
+async def audit_symbols(ctx: typer.Context) -> None:
+    """
+    Audit symbol integrity and detect registry drift.
+
+    Checks for:
+    1. Symbols missing IDs (Anchors).
+    2. Symbols in DB that no longer exist on disk (Ghosts).
+    3. Symbols on disk not yet in DB (Drift).
+    """
+    core_context = ctx.obj
+    console.print(
+        "[bold cyan]🔍 1. Checking for Symbol Drift (Disk vs DB)...[/bold cyan]"
+    )
+    await inspect_symbol_drift()
+    console.print("\n[bold cyan]🔍 2. Checking for Unassigned IDs...[/bold cyan]")
+    unassigned = await get_unassigned_symbols_logic(core_context)
+    if not unassigned:
+        console.print("[green]✅ All public symbols have assigned IDs.[/green]")
+    else:
+        console.print(
+            f"[yellow]⚠️  Found {len(unassigned)} symbols with no ID tag.[/yellow]"
+        )
+        for item in unassigned[:10]:
+            console.print(f"   - {item.get('name')} ({item.get('file_path')})")
+        if len(unassigned) > 10:
+            console.print(f"   ... and {len(unassigned) - 10} more.")
+        console.print(
+            "\n[dim]Tip: Run 'core-admin symbols fix-ids --write' to fix this.[/dim]"
+        )

cli/resources/symbols/fix_ids.py

@@ -0,0 +1,43 @@
+# src/cli/resources/symbols/fix_ids.py
+import typer
+from rich.console import Console
+
+from cli.utils import core_command
+from shared.cli.command_meta import CommandBehavior, CommandLayer, command_meta
+from shared.context import CoreContext
+
+from .hub import app
+
+
+console = Console()
+
+
+@app.command("fix-ids")
+@command_meta(
+    canonical_name="symbols.fix-ids",
+    behavior=CommandBehavior.MUTATE,
+    layer=CommandLayer.BODY,
+    summary="Assign stable # ID: anchors to untagged symbols.",
+    dangerous=True,
+)
+@core_command(dangerous=True, requires_context=True, confirmation=True)
+# ID: 37ac33b4-76d3-40c4-8955-3b81a2a4ccf2
+async def fix_ids_command(
+    ctx: typer.Context,
+    write: bool = typer.Option(
+        False, "--write", help="Inject missing UUIDs into source files."
+    ),
+) -> None:
+    """
+    Assign stable '# ID:' anchors to all untagged public symbols.
+
+    Scans 'src/' and modifies files to ensure knowledge graph stability.
+    """
+    core_context: CoreContext = ctx.obj
+    if not write:
+        console.print("[yellow]📋 Analysis mode: Scanning for missing IDs...[/yellow]")
+    else:
+        console.print(
+            "[bold red]🧪 Applying missing ID anchors to source code...[/bold red]"
+        )
+    await core_context.action_executor.execute("fix.ids", write=write)

cli/resources/symbols/hub.py

@@ -0,0 +1,11 @@
+# src/cli/resources/symbols/hub.py
+
+import typer
+
+
+# Stable hub for symbols resource commands
+app = typer.Typer(
+    name="symbols",
+    help="Operations for the symbol registry and Knowledge Graph identification.",
+    no_args_is_help=True,
+)

cli/resources/symbols/resolve_duplicates.py

@@ -0,0 +1,30 @@
+# src/cli/resources/symbols/resolve_duplicates.py
+import typer
+from rich.console import Console
+
+from cli.utils import core_command
+from shared.context import CoreContext
+
+from .hub import app
+
+
+console = Console()
+
+
+@app.command("resolve-duplicates")
+@core_command(dangerous=True, requires_context=True, confirmation=True)
+# ID: c9ca3aa7-a542-4f3c-bbf3-d8dc97d4400a
+async def resolve_symbol_duplicates(
+    ctx: typer.Context,
+    write: bool = typer.Option(False, "--write", help="Regenerate conflicting UUIDs."),
+):
+    """
+    Find and resolve duplicate '# ID:' anchors in the codebase.
+
+    If multiple symbols share the same UUID, the older entry is preserved
+    and colliding symbols are assigned fresh, unique identifiers.
+    """
+    core_context: CoreContext = ctx.obj
+    mode = "RESOLVING" if write else "ANALYZING"
+    console.print(f"[bold cyan]👯 {mode} duplicate ID collisions...[/bold cyan]")
+    await core_context.action_executor.execute("fix.duplicate_ids", write=write)

cli/resources/symbols/sync.py

@@ -0,0 +1,39 @@
+# src/cli/resources/symbols/sync.py
+import typer
+from rich.console import Console
+
+from cli.utils import core_command
+from shared.cli.command_meta import CommandBehavior, CommandLayer, command_meta
+from shared.context import CoreContext
+
+from .hub import app
+
+
+console = Console()
+
+
+@app.command("sync")
+@command_meta(
+    canonical_name="symbols.sync",
+    behavior=CommandBehavior.MUTATE,
+    layer=CommandLayer.BODY,
+    summary="Synchronize database with codebase symbols.",
+    dangerous=True,
+)
+@core_command(dangerous=True, requires_context=True)
+# ID: 7de43597-32ac-4e0f-9e55-af90f4c716f6
+async def sync_symbols(
+    ctx: typer.Context,
+    write: bool = typer.Option(
+        False, "--write", help="Apply synchronization to the database."
+    ),
+) -> None:
+    """
+    Synchronize filesystem symbols with the PostgreSQL Knowledge Graph.
+
+    Scans 'src/' and updates the 'core.symbols' table.
+    """
+    core_context: CoreContext = ctx.obj
+    mode = "WRITE" if write else "DRY-RUN"
+    console.print(f"[bold cyan]🔄 Synchronizing Symbols to DB ({mode})...[/bold cyan]")
+    await core_context.action_executor.execute("sync.db", write=write)

cli/resources/symbols/tag.py

@@ -0,0 +1,47 @@
+# src/cli/resources/symbols/tag.py
+from __future__ import annotations
+
+import typer
+from rich.console import Console
+
+from cli.utils import core_command
+from shared.context import CoreContext
+from shared.infrastructure.database.session_manager import get_session
+
+from .hub import app
+
+
+console = Console()
+
+
+@app.command("tag")
+@core_command(dangerous=True, requires_context=True, confirmation=True)
+# ID: 7c191977-2cdb-4639-bf03-797ae163b7c5
+async def tag_symbols_command(
+    ctx: typer.Context,
+    write: bool = typer.Option(
+        False, "--write", help="Write suggested tags to the database."
+    ),
+    limit: int = typer.Option(
+        0, "--limit", help="Limit number of symbols to process (0 = all)."
+    ),
+) -> None:
+    """
+    Automatically tag untagged capabilities using AI reasoning.
+
+    Consults the TaggerAgent to suggest 'domain.capability' names for
+    symbols that currently have 'unassigned' status in the registry.
+    """
+    from will.self_healing.capability_tagging_service import main_async
+
+    core_context: CoreContext = ctx.obj
+    mode = "APPLYING" if write else "PREVIEWING"
+    console.print(f"[bold cyan]🧠 {mode} AI capability tagging...[/bold cyan]")
+    await main_async(
+        session_factory=get_session,
+        cognitive_service=core_context.cognitive_service,
+        knowledge_service=core_context.knowledge_service,
+        write=write,
+        dry_run=not write,
+        limit=limit,
+    )

cli/resources/vectors/__init__.py

@@ -0,0 +1,11 @@
+# src/cli/resources/vectors/__init__.py
+"""Vector resource hub."""
+
+from __future__ import annotations
+
+# Register all neurons
+from . import cleanup, query, status, sync, sync_code
+from .hub import app
+
+
+__all__ = ["app"]

cli/resources/vectors/cleanup.py

@@ -0,0 +1,95 @@
+# src/cli/resources/vectors/cleanup.py
+"""
+Vector cleanup command.
+
+Removes orphaned vectors and synchronizes with PostgreSQL.
+"""
+
+from __future__ import annotations
+
+import logging
+
+import typer
+from rich.console import Console
+
+from cli.utils import core_command
+from shared.infrastructure.database.session_manager import get_session
+
+from .hub import app
+
+
+logger = logging.getLogger(__name__)
+console = Console()
+
+
+@app.command("cleanup")
+@core_command(dangerous=True, requires_context=False)
+# ID: a644bc31-42c8-4d69-bb4b-f8f481ec2cb6
+async def cleanup_vectors(
+    ctx: typer.Context,
+    target: str = typer.Option(
+        "all", "--target", "-t", help="Cleanup target: 'orphans', 'dangling', 'all'"
+    ),
+    write: bool = typer.Option(
+        False, "--write", help="Apply cleanup (default: dry-run)"
+    ),
+) -> None:
+    """
+    Clean up orphaned and inconsistent vector data.
+
+    Cleanup targets:
+    - orphans: Vectors in Qdrant without PostgreSQL links
+    - dangling: PostgreSQL links to non-existent vectors
+    - all: Both orphans and dangling links
+
+    This performs bidirectional synchronization between Qdrant and PostgreSQL.
+
+    Constitutional Compliance:
+    - Enforces 'vectors.bidirectional_sync'
+    - All changes logged to audit trail
+    - Atomic operation with proper ordering
+
+    Examples:
+        # Dry-run (show what would be cleaned)
+        core-admin vectors cleanup
+
+        # Clean orphaned vectors only
+        core-admin vectors cleanup --target orphans --write
+
+        # Full cleanup
+        core-admin vectors cleanup --target all --write
+    """
+    console.print("[bold cyan]🧹 Vector Cleanup[/bold cyan]")
+    console.print(f"Target: {target}")
+    console.print(f"Mode: {'WRITE' if write else 'DRY-RUN'}")
+    console.print()
+    if not write:
+        console.print("[yellow]DRY-RUN: Use --write to apply changes[/yellow]")
+    try:
+        from body.maintenance.sync_vectors import (
+            _async_sync_vectors as sync_vectors_internal,
+        )
+
+        async with get_session() as session:
+            orphans_pruned, dangling_pruned = await sync_vectors_internal(
+                session=session, dry_run=not write, qdrant_service=None
+            )
+            if write:
+                await session.commit()
+        console.print()
+        console.print("[bold]Results:[/bold]")
+        if target in ["orphans", "all"]:
+            status = "Would prune" if not write else "Pruned"
+            console.print(f"  Orphaned vectors: {status} {orphans_pruned}")
+        if target in ["dangling", "all"]:
+            status = "Would prune" if not write else "Pruned"
+            console.print(f"  Dangling links: {status} {dangling_pruned}")
+        console.print()
+        if write:
+            console.print("[green]✅ Cleanup completed successfully[/green]")
+        else:
+            console.print("[yellow]DRY-RUN completed - no changes made[/yellow]")
+    except Exception as e:
+        logger.error("Vector cleanup failed", exc_info=True)
+        console.print(f"[red]❌ Error: {e}[/red]")
+        raise typer.Exit(1)

cli/resources/vectors/hub.py

@@ -0,0 +1,9 @@
+# src/cli/resources/vectors/hub.py
+import typer
+
+
+app = typer.Typer(
+    name="vectors",
+    help="Vector store operations (Qdrant).",
+    no_args_is_help=True,
+)