dev-autopilot 0.4.0__py3-none-any.whl

autopilot/commands/preflight.py

@@ -0,0 +1,131 @@
+"""`ap preflight`: phase 0 check. Every credential the plan needs is present and works (read-only calls), or
+the run does not start. Missing items come out as ONE batch for the owner."""
+from __future__ import annotations
+
+import os
+import subprocess
+import urllib.error
+import urllib.request
+
+from ..log_scrub import scrub_secrets
+
+# type -> env var that must be set; the check is read-only
+CRED = {"deploy": "DEPLOY_SSH_KEY", "cloudflare": "CLOUDFLARE_TOKEN", "email": "EMAIL_API_TOKEN"}
+CF_VERIFY = "https://api.cloudflare.com/client/v4/user/tokens/verify"
+
+
+def http_get(url: str, token: str) -> int:  # the one network call; tests replace it
+    req = urllib.request.Request(url, headers={"Authorization": f"Bearer {token}"})
+    try:
+        with urllib.request.urlopen(req, timeout=15) as r:
+            return r.status
+    except urllib.error.HTTPError as e:
+        return e.code
+
+
+def run_cmd(cmd: list[str] | str, shell: bool = False) -> tuple[int, str]:  # tests replace it too
+    try:
+        p = subprocess.run(cmd, shell=shell, capture_output=True, text=True, timeout=30)
+        return p.returncode, (p.stderr or p.stdout).strip()[:200]
+    except (OSError, subprocess.TimeoutExpired) as e:
+        return 1, str(e)[:200]
+
+
+def _check(step: dict, val: str, secrets: dict[str, str]) -> tuple[str, str]:
+    """-> (ok|error, detail) for one present credential. Text from a command is scrubbed: it can hold a token or host."""
+    st, detail = _probe(step, val)
+    return st, scrub_secrets(detail, secrets) if st == "error" else detail
+
+
+def _probe(step: dict, val: str) -> tuple[str, str]:
+    t = step["type"]
+    if t == "cloudflare":
+        code = http_get(CF_VERIFY, val)
+        return ("ok", "token valid") if code == 200 else ("error", f"Cloudflare answered HTTP {code}")
+    if t == "deploy":
+        if not os.path.isfile(val):
+            return "error", "DEPLOY_SSH_KEY must be the path of a key file"
+        if step["host"]:  # read-only: log in and run `true`
+            rc, out = run_cmd(["ssh", "-i", val, "-o", "BatchMode=yes", "-o", "ConnectTimeout=10", step["host"], "true"])
+            return ("ok", "ssh login works") if rc == 0 else ("error", f"ssh failed: {out}")
+        return "ok", "key file found (no `host:` set, login not tested)"
+    if step["verify"]:  # email / custom: the plan's own read-only verify command
+        rc, out = run_cmd(step["verify"], shell=True)
+        return ("ok", "verify command passed") if rc == 0 else ("error", f"verify failed: {out}")
+    return "ok", "set (no verify command, not tested)"  # ponytail: email has no default provider endpoint
+
+
+def check_steps(steps: list[dict], env) -> tuple[list[dict], set]:
+    """The credential rows of these infra steps, and the env names they use. Used at the run start and again before
+    each deploy (a token can expire during a long run)."""
+    rows, seen = [], set()
+    secrets = {n: env[n] for s in steps for n in [*CRED.values(), *s["env"]] if env.get(n)}
+    secrets.update({f"host:{s['id']}": s["host"] for s in steps if s["host"]})
+    for s in steps:
+        for name in ([CRED[s["type"]]] if s["type"] in CRED else []) + s["env"]:
+            if name not in env or not env[name]:
+                rows.append({"item": f"{name} ({s['id']})", "status": "missing",
+                             "detail": s["description"] or f"needed by {s['type']} step {s['id']}"})
+            elif name == CRED.get(s["type"]) or s["verify"]:
+                st, d = _check(s, env[name], secrets)
+                rows.append({"item": f"{name} ({s['id']})", "status": st, "detail": d})
+            seen.add(name)
+    return rows, seen
+
+
+def recheck(phase, env=None) -> str:
+    """'' when the credentials of this phase still work; else one plain line that names them (never a value)."""
+    rows, _ = check_steps(phase.infra.get("steps", []), os.environ if env is None else env)
+    bad = [f"{r['item']} is {r['status']}" for r in rows if r["status"] != "ok"]
+    return f"credential check failed before the deploy: {'; '.join(bad)}" if bad else ""
+
+
+def run_preflight(plan, cfg, env=None) -> list[dict]:
+    """Report rows {item, status: ok|missing|error, detail}. Any row that is not ok blocks the run."""
+    env = os.environ if env is None else env
+    rows, seen = check_steps([s for ph in plan.phases for s in ph.infra.get("steps", [])], env)
+    for name in cfg.get("agent.env_passthrough", []) or []:
+        if name not in seen:
+            rows.append({"item": name, "status": "ok" if env.get(name) else "missing",
+                         "detail": "agent.env_passthrough" if env.get(name) else "listed in agent.env_passthrough"})
+    for t in plan.all_tasks():
+        if t.owner_only:  # the loop skips owner tasks (plan.py), so they inform, they do not block (RCA 2026-10-11)
+            rows.append({"item": f"{t.id} {t.title}", "status": "ok", "detail": "owner_only: left for you; the run skips it"})
+    return rows
+
+
+def report_text(rows: list[dict]) -> str:
+    bad = [r for r in rows if r["status"] != "ok"]
+    lines = [f"{r['status'].upper():8}{r['item']}  {r['detail']}" for r in rows]
+    if bad:
+        lines += ["", f"NEEDS YOU: {len(bad)} item(s) block the run. Fix them in one go, then run `ap preflight` again."]
+    else:
+        lines.append("preflight OK" if rows else "preflight OK (nothing to check)")
+    return "\n".join(lines)
+
+
+def approval_setup() -> list[str]:
+    """Advice for manual setup to bypass interactive prompts. Does NOT modify global config (owner's standing rule).
+    Returns a list of recommendations only (no automatic actions)."""
+    actions = []
+
+    # 1. SSH agent (info only)
+    ssh_key = os.environ.get("DEPLOY_SSH_KEY")
+    if ssh_key and os.path.isfile(ssh_key):
+        rc, _ = run_cmd(["ssh-add", "-l"])
+        if rc == 0:
+            actions.append("SSH agent running; load key with: ssh-add " + ssh_key)
+        else:
+            actions.append("SSH agent not running; start with: eval $(ssh-agent -s)")
+
+    # 2. GitHub gh CLI (info only)
+    rc, _ = run_cmd(["gh", "auth", "status"])
+    if rc != 0:
+        actions.append("GitHub CLI not authenticated; run: gh auth login")
+
+    # 3. Info for other setup (owner does manually)
+    import platform
+    if platform.system() == "Windows":
+        actions.append("PowerShell: run as Administrator to avoid execution policy prompts")
+
+    return actions

autopilot/config.py

@@ -0,0 +1,155 @@
+"""Project contract loading. Defaults come from the shipped template, so there's one source of truth."""
+from __future__ import annotations
+
+import copy
+import os
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+from . import AGENT_DIR
+
+TEMPLATES = Path(__file__).parent / "templates"
+RISKS = ["low", "medium", "high", "critical"]
+NATIVE_WINDOWS = os.name == "nt"
+# CLI flags that could replace or widen the sandbox settings Autopilot passes (P5 egress allowlist)
+SANDBOX_UNSAFE_ARGS = ("--settings", "--setting-sources", "--mcp-config", "--dangerously-skip-permissions",
+                       "--allowedTools", "--allowed-tools")
+
+
+def deep_merge(base: dict, override: dict) -> dict:
+    out = copy.deepcopy(base)
+    for k, v in (override or {}).items():
+        if isinstance(v, dict) and isinstance(out.get(k), dict):
+            out[k] = deep_merge(out[k], v)
+        else:
+            out[k] = copy.deepcopy(v)
+    return out
+
+
+def load_yaml(path: Path) -> dict:
+    with open(path, encoding="utf-8") as fh:
+        return yaml.safe_load(fh) or {}
+
+
+def defaults() -> dict:
+    d = load_yaml(TEMPLATES / "agent" / "project.yaml")
+    d.setdefault("agent", {}).setdefault("backend", "claude_cli")  # N3: the template leaves it unset (preflight detects)
+    d["profile"] = "full"  # O10: an old project.yaml without the key stays full; the template gives new projects lean
+    # (clean measure 2026-10-12: -39.5 percent tokens per task, 11 of 11 done; the owner accepted it as the 40 percent rule)
+    d.setdefault("gate", {})["new_file_reasons"] = False  # N7: on in the template (new projects) only; a missing key = off
+    d["gate"]["file_growth"] = False  # O2: same rule: the template turns it on, an old project.yaml keeps it off
+    return d
+
+
+class Config:
+    """Wraps the merged project.yaml with dotted-path access."""
+
+    def __init__(self, root: Path, data: dict):
+        self.root = Path(root).resolve()
+        self.data = data
+
+    @classmethod
+    def load(cls, root: Path | str) -> "Config":
+        root = Path(root).resolve()
+        path = root / AGENT_DIR / "project.yaml"
+        user = load_yaml(path) if path.exists() else {}
+        cfg = cls(root, deep_merge(defaults(), user))
+        if cfg.lean and "max_attempts_per_task" not in (user.get("retries") or {}):
+            cfg.data["retries"]["max_attempts_per_task"] = 2  # O10: one retry under lean, unless the project sets it
+        return cfg
+
+    @property
+    def lean(self) -> bool:
+        return self.get("profile", "full") == "lean"
+
+    def get(self, dotted: str, default: Any = None) -> Any:
+        cur: Any = self.data
+        for part in dotted.split("."):
+            if not isinstance(cur, dict) or part not in cur:
+                return default
+            cur = cur[part]
+        return default if cur is None else cur
+
+    def commands(self, *groups: str) -> list[str]:
+        out: list[str] = []
+        for g in groups:
+            val = self.get(f"commands.{g}", []) or []
+            out.extend([val] if isinstance(val, str) else list(val))
+        return [c for c in out if c and str(c).strip()]
+
+    def parallel_size(self) -> int:
+        """N12: `scheduling.parallel`; unset = 3 with a test command in direct git mode, else 1."""
+        v = self.get("scheduling.parallel")
+        if v is None:
+            return 3 if self.commands("test") and self.get("git.mode", "direct") == "direct" else 1
+        return max(1, int(v or 1))
+
+    @property
+    def agent_dir(self) -> Path:
+        return self.root / AGENT_DIR
+
+    @property
+    def main_branch(self) -> str:
+        return self.get("main_branch", "main")
+
+    def validate(self) -> list[str]:
+        errs = []
+        ladder = self.get("models.ladder", {})
+        for r in RISKS:
+            if not ladder.get(r):
+                errs.append(f"models.ladder.{r} is empty")
+        backend = self.get("agent.backend")
+        if backend not in ("claude_cli", "command"):
+            errs.append(f"agent.backend must be claude_cli or command, got {backend!r}")
+        if backend == "command":
+            from .backends.command import PRESETS, SAFE_MODEL
+            preset = self.get("agent.preset")
+            names = [str(v) for v in (self.get("agent.model_map", {}) or {}).values()]
+            if preset and any(not SAFE_MODEL.fullmatch(n) for n in names):
+                errs.append("agent.model_map names may use only letters, digits and . _ : / @ -")
+            if preset and preset not in PRESETS:
+                errs.append(f"agent.preset must be one of {', '.join(PRESETS)}, got {preset!r}")
+            elif not (self.get("agent.command") or preset):
+                errs.append(f"agent.backend=command needs agent.command or agent.preset ({', '.join(PRESETS)})")  # P08-T02
+        for env in ("staging", "prod"):
+            if self.get(f"deploy.{env}.enabled") and not self.get(f"deploy.{env}.cmd"):
+                errs.append(f"deploy.{env}.enabled but deploy.{env}.cmd is empty")
+        if self.get("deploy.prod.max_auto_risk") not in RISKS:
+            errs.append("deploy.prod.max_auto_risk must be one of " + ", ".join(RISKS))
+        if not self.commands("build", "lint", "typecheck", "test"):
+            errs.append("no verify commands (build/lint/typecheck/test) — the gate would pass anything")
+        if self.get("usage.billing", "subscription") not in ("subscription", "api"):
+            errs.append("usage.billing must be subscription or api")
+        return errs + self._git_errors() + self._sandbox_errors()
+
+    def _sandbox_errors(self) -> list[str]:
+        if not self.get("sandbox.enabled"):
+            return []
+        if self.get("agent.backend") != "claude_cli":
+            return ["sandbox.enabled needs agent.backend: claude_cli (it is Claude Code's own sandbox)"]
+        if NATIVE_WINDOWS:  # Claude Code's sandbox runs on Linux, WSL2 and macOS only
+            return ["sandbox.enabled is not supported on native Windows: run Autopilot in WSL2 or the Docker image"]
+        if not isinstance(self.get("sandbox.allowed_domains", []), list):
+            return ["sandbox.allowed_domains must be a list of host names"]
+        unsafe = [a for a in self.get("agent.extra_args", []) if str(a).split("=")[0] in SANDBOX_UNSAFE_ARGS]
+        if unsafe:
+            return [f"agent.extra_args {unsafe} would override the sandbox; remove them or set sandbox.enabled: false"]
+        return []
+
+    def _git_errors(self) -> list[str]:
+        mode = self.get("git.mode", "direct")
+        if mode not in ("direct", "pr"):
+            return [f"git.mode must be direct or pr, got {mode!r}"]
+        if mode == "pr" and not self.get("git.push"):  # else local bookkeeping commits make main diverge from GitHub
+            return ["git.mode: pr needs git.push: true (Autopilot's own plan and docs commits go straight to main)"]
+        return []
+
+    def blocking_errors(self) -> list[str]:
+        """The subset of validate() that must stop a run."""
+        errs = [f"deploy.{e}.enabled but deploy.{e}.cmd is empty" for e in ("staging", "prod")
+                if self.get(f"deploy.{e}.enabled") and not self.get(f"deploy.{e}.cmd")]
+        if not self.get("gate.allow_no_checks") and not self.commands("build", "lint", "typecheck", "test"):
+            errs.append("no verify commands (build/lint/typecheck/test) — the gate would pass anything")
+        return errs + self._git_errors() + self._sandbox_errors()