crabcode 0.1.6__py3-none-win_amd64.whl

crabcode_gateway/acp/session.py

@@ -0,0 +1,114 @@
+"""ACP session manager — tracks ACP-side session state.
+
+Each ACP session wraps an internal CrabCode session (created via the
+Gateway REST API).  The manager holds the mapping between ACP session
+IDs and their associated state (cwd, model, mode, MCP servers).
+"""
+
+from __future__ import annotations
+
+import time
+
+import httpx
+from acp.exceptions import RequestError
+from acp.schema import HttpMcpServer, McpServerStdio, SseMcpServer
+
+from crabcode_core.logging_utils import get_logger
+from crabcode_gateway.acp.types import ACPConfig, ACPSessionState, ModelSelection
+
+logger = get_logger(__name__)
+
+
+class ACPSessionManager:
+    """Manages ACP session lifecycle backed by the Gateway HTTP API."""
+
+    def __init__(self, config: ACPConfig) -> None:
+        self._config = config
+        self._sessions: dict[str, ACPSessionState] = {}
+        self._client = httpx.AsyncClient(base_url=config.base_url, timeout=60.0)
+
+    # ── CRUD ────────────────────────────────────────────────────
+
+    async def create(
+        self,
+        cwd: str,
+        mcp_servers: list[McpServerStdio | HttpMcpServer | SseMcpServer],
+        model: ModelSelection | None = None,
+    ) -> ACPSessionState:
+        """Create a new session via the Gateway API and store ACP state."""
+        resp = await self._client.post("/session/new", json={"cwd": cwd})
+        resp.raise_for_status()
+        data = resp.json()
+        session_id = data["session_id"]
+
+        state = ACPSessionState(
+            id=session_id,
+            cwd=cwd,
+            mcp_servers=mcp_servers,
+            created_at=time.time(),
+            model=model,
+        )
+        self._sessions[session_id] = state
+        logger.info("acp_session_created", extra={"session_id": session_id})
+        return state
+
+    async def load(
+        self,
+        session_id: str,
+        cwd: str,
+        mcp_servers: list[McpServerStdio | HttpMcpServer | SseMcpServer],
+        model: ModelSelection | None = None,
+    ) -> ACPSessionState:
+        """Load an existing session via the Gateway API."""
+        resp = await self._client.post("/session/resume", json={"session_id": session_id})
+        resp.raise_for_status()
+
+        state = ACPSessionState(
+            id=session_id,
+            cwd=cwd,
+            mcp_servers=mcp_servers,
+            created_at=time.time(),
+            model=model,
+        )
+        self._sessions[session_id] = state
+        logger.info("acp_session_loaded", extra={"session_id": session_id})
+        return state
+
+    def try_get(self, session_id: str) -> ACPSessionState | None:
+        """Return session state if it exists, else None."""
+        return self._sessions.get(session_id)
+
+    def get(self, session_id: str) -> ACPSessionState:
+        """Return session state or raise ACP RequestError."""
+        state = self._sessions.get(session_id)
+        if not state:
+            raise RequestError(code=-32602, message=f"Session not found: {session_id}")
+        return state
+
+    def set_model(self, session_id: str, model: ModelSelection) -> None:
+        state = self.get(session_id)
+        state.model = model
+
+    def get_model(self, session_id: str) -> ModelSelection | None:
+        return self.get(session_id).model
+
+    def set_variant(self, session_id: str, variant: str | None) -> None:
+        self.get(session_id).variant = variant
+
+    def get_variant(self, session_id: str) -> str | None:
+        return self.get(session_id).variant
+
+    def set_mode(self, session_id: str, mode_id: str) -> None:
+        self.get(session_id).mode_id = mode_id
+
+    def get_mode(self, session_id: str) -> str | None:
+        return self.get(session_id).mode_id
+
+    # ── HTTP helpers exposed to Agent ───────────────────────────
+
+    @property
+    def client(self) -> httpx.AsyncClient:
+        return self._client
+
+    async def aclose(self) -> None:
+        await self._client.aclose()

crabcode_gateway/acp/transport.py

@@ -0,0 +1,39 @@
+"""ACP stdio transport — wires CrabCodeACPAgent to stdin/stdout via ACP SDK.
+
+Uses the official `acp.run_agent` convenience function which handles:
+  - JSON-RPC framing over ndjson stdio streams
+  - Request/response routing
+  - Agent-side connection lifecycle
+"""
+
+from __future__ import annotations
+
+import acp
+
+from crabcode_core.logging_utils import get_logger
+from crabcode_gateway.acp.agent import CrabCodeACPAgent
+from crabcode_gateway.acp.types import ACPConfig
+
+logger = get_logger(__name__)
+
+
+async def run_acp_server(config: ACPConfig) -> None:
+    """Start the ACP agent server on stdio.
+
+    This function blocks until stdin is closed or a fatal error occurs.
+
+    Usage::
+
+        config = ACPConfig(base_url="http://127.0.0.1:4096")
+        await run_acp_server(config)
+    """
+    agent = CrabCodeACPAgent(config)
+    try:
+        logger.info("acp_server_starting", extra={"base_url": config.base_url})
+        await acp.run_agent(agent)
+    except Exception:
+        logger.exception("acp_server_error")
+        raise
+    finally:
+        await agent.close()
+        logger.info("acp_server_stopped")

crabcode_gateway/acp/types.py

@@ -0,0 +1,90 @@
+"""ACP internal types — session state and configuration.
+
+Maps CrabCode session/model concepts to ACP's expectations.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Any
+
+from acp.schema import McpServerStdio, HttpMcpServer, SseMcpServer
+
+
+@dataclass
+class ACPSessionState:
+    """Tracks ACP-specific state for a single session.
+
+    Stored in ACPSessionManager; not persisted to disk.
+    """
+
+    id: str
+    cwd: str
+    mcp_servers: list[McpServerStdio | HttpMcpServer | SseMcpServer] = field(default_factory=list)
+    created_at: float = 0.0
+    model: ModelSelection | None = None
+    mode_id: str | None = None
+    variant: str | None = None
+
+
+@dataclass
+class ModelSelection:
+    """Identifies a provider + model pair."""
+
+    provider_id: str
+    model_id: str
+
+
+@dataclass
+class ACPConfig:
+    """Top-level configuration passed to the ACP Agent on construction."""
+
+    base_url: str  # e.g. "http://127.0.0.1:4096"
+    default_model: ModelSelection | None = None
+
+
+# ── Tool kind mapping ──────────────────────────────────────────
+
+
+def to_tool_kind(tool_name: str) -> str:
+    """Map CrabCode tool names to ACP ToolKind literals.
+
+    ACP ToolKind: read | edit | delete | move | search | execute |
+                  think | fetch | switch_mode | other
+    """
+    tool = tool_name.lower()
+    if tool == "bash":
+        return "execute"
+    if tool == "web_search":
+        return "fetch"
+    if tool in ("applypatch", "apply_patch", "edit", "patch", "file_edit", "file_write", "write"):
+        return "edit"
+    if tool in ("grep", "glob", "toolsearch"):
+        return "search"
+    if tool == "read" or tool == "file_read":
+        return "read"
+    if tool == "delete":
+        return "delete"
+    if tool == "switch_mode":
+        return "switch_mode"
+    return "other"
+
+
+def to_locations(tool_name: str, tool_input: dict[str, Any]) -> list[dict[str, str]]:
+    """Extract file paths from tool input for ACP ToolCallLocation."""
+    tool = tool_name.lower()
+    if tool in ("read", "file_read", "edit", "file_edit", "write", "file_write"):
+        path = tool_input.get("filePath") or tool_input.get("file_path") or ""
+        return [{"path": path}] if path else []
+    if tool in ("applypatch", "apply_patch", "patch"):
+        try:
+            from crabcode_core.tools.apply_patch import patch_paths
+
+            paths = tool_input.get("affected_paths") or patch_paths(str(tool_input.get("patch") or ""))
+        except (TypeError, ValueError):
+            paths = []
+        return [{"path": path} for path in paths if isinstance(path, str) and path]
+    if tool in ("glob", "grep"):
+        path = tool_input.get("path") or ""
+        return [{"path": path}] if path else []
+    return []

crabcode_gateway/adapter.py

@@ -0,0 +1,30 @@
+"""Protocol adapter abstraction — inspired by OpenCode's adapter.ts.
+
+Each concrete adapter (HTTP, gRPC) implements the ProtocolAdapter ABC,
+allowing the server to start/stop multiple protocols uniformly.
+"""
+
+from __future__ import annotations
+
+from abc import ABC, abstractmethod
+
+
+class ProtocolAdapter(ABC):
+    """Abstract base class for protocol adapters.
+
+    Mirrors OpenCode's Adapter interface which abstracts away the
+    runtime-specific server creation (Bun vs Node).
+    """
+
+    @abstractmethod
+    async def start(self, host: str, port: int) -> None:
+        """Start serving on the given host:port."""
+
+    @abstractmethod
+    async def stop(self) -> None:
+        """Gracefully stop the server."""
+
+    @property
+    @abstractmethod
+    def is_running(self) -> bool:
+        """Whether the server is currently running."""

crabcode_gateway/auth.py

@@ -0,0 +1,139 @@
+"""Gateway authentication: password/public-key login and short-lived JWTs."""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import hmac
+import os
+import secrets
+import time
+from pathlib import Path
+from typing import Any
+
+import jwt
+
+try:
+    from cryptography.hazmat.primitives import hashes, serialization
+    from cryptography.hazmat.primitives.asymmetric import ec, ed25519, padding, rsa
+except ImportError:  # pragma: no cover - dependency is declared by gateway
+    serialization = None  # type: ignore[assignment]
+
+
+def _b64(data: bytes) -> str:
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode("ascii")
+
+
+def _unb64(value: str) -> bytes:
+    return base64.urlsafe_b64decode(value + "=" * (-len(value) % 4))
+
+
+def make_jwt(payload: dict[str, Any], secret: str) -> str:
+    return jwt.encode(payload, secret, algorithm="HS256")
+
+
+def decode_jwt(token: str, secret: str) -> dict[str, Any] | None:
+    try:
+        return jwt.decode(
+            token,
+            secret,
+            algorithms=["HS256"],
+            issuer="crabcode-gateway",
+            audience="crabcode-api",
+            options={"require": ["exp", "iat", "nbf", "iss", "aud", "sub", "jti"]},
+        )
+    except jwt.PyJWTError:
+        return None
+
+
+def hash_password(password: str, *, iterations: int = 310_000) -> str:
+    salt = os.urandom(16)
+    digest = hashlib.pbkdf2_hmac("sha256", password.encode(), salt, iterations)
+    return f"pbkdf2_sha256${iterations}${_b64(salt)}${_b64(digest)}"
+
+
+def verify_password(password: str, encoded: str) -> bool:
+    try:
+        algorithm, raw_iterations, salt, expected = encoded.split("$", 3)
+        if algorithm != "pbkdf2_sha256":
+            return False
+        iterations = int(raw_iterations)
+        if iterations < 100_000 or iterations > 2_000_000:
+            return False
+        actual = hashlib.pbkdf2_hmac("sha256", password.encode(), _unb64(salt), iterations)
+        return hmac.compare_digest(_b64(actual), expected)
+    except (ValueError, TypeError):
+        return False
+
+
+def _authorized_keys(path: str) -> dict[str, Any]:
+    """Read an OpenSSH authorized_keys file and return id -> public key."""
+    keys: dict[str, Any] = {}
+    expanded = Path(path).expanduser()
+    if serialization is None or not expanded.is_file():
+        return keys
+    try:
+        lines = expanded.read_text(encoding="utf-8", errors="replace").splitlines()
+    except OSError:
+        return keys
+    for line in lines:
+        line = line.strip()
+        if not line or line.startswith("#"):
+            continue
+        fields = line.split()
+        try:
+            idx = next(
+                i
+                for i, value in enumerate(fields)
+                if value.startswith(("ssh-", "ecdsa-", "sk-"))
+            )
+            key_type, encoded = fields[idx], fields[idx + 1]
+            raw = base64.b64decode(encoded, validate=True)
+            public_key = serialization.load_ssh_public_key(
+                f"{key_type} {encoded}".encode()
+            )
+            fingerprint = "SHA256:" + _b64(hashlib.sha256(raw).digest())
+            comment = " ".join(fields[idx + 2:]).strip()
+            key_id = comment or fingerprint
+            keys[key_id] = public_key
+            keys.setdefault(fingerprint, public_key)
+        except (StopIteration, ValueError, IndexError, TypeError):
+            continue
+    return keys
+
+
+def verify_public_signature(path: str, key_id: str, message: bytes, signature_b64: str) -> bool:
+    keys = _authorized_keys(path)
+    public_key = keys.get(key_id)
+    if public_key is None:
+        return False
+    try:
+        signature = base64.b64decode(signature_b64, validate=True)
+        if isinstance(public_key, ed25519.Ed25519PublicKey):
+            public_key.verify(signature, message)
+        elif isinstance(public_key, rsa.RSAPublicKey):
+            public_key.verify(signature, message, padding.PKCS1v15(), hashes.SHA256())
+        elif isinstance(public_key, ec.EllipticCurvePublicKey):
+            public_key.verify(signature, message, ec.ECDSA(hashes.SHA256()))
+        else:
+            return False
+        return True
+    except Exception:
+        return False
+
+
+def new_token(*, subject: str, mode: str, secret: str, ttl: int) -> str:
+    now = int(time.time())
+    return make_jwt(
+        {
+            "iss": "crabcode-gateway",
+            "aud": "crabcode-api",
+            "sub": subject,
+            "auth_mode": mode,
+            "iat": now,
+            "nbf": now,
+            "exp": now + ttl,
+            "jti": secrets.token_hex(16),
+        },
+        secret,
+    )