devops-bot-sdk 1.4.119__tar.gz → 1.4.120__tar.gz

{devops_bot_sdk-1.4.119 → devops_bot_sdk-1.4.120}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.4.119
+Version: 1.4.120
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.4.119 → devops_bot_sdk-1.4.120}/devops_bot_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.4.119
+Version: 1.4.120
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.4.119 → devops_bot_sdk-1.4.120}/sdk/__init__.py

@@ -1,6 +1,6 @@
 """AgentOS Desktop SDK — thin HTTPS/SSE client for the Electron app.
 
-Version: 1.4.119
+Version: 1.4.120
 
 Public surface:
   BackendClient.from_config()        — create client from ~/.agentos/config.toml
@@ -30,7 +30,7 @@ Rules:
   - All data egress through submit_webhook only
 """
 
-__version__ = "1.4.119"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
+__version__ = "1.4.120"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
 __author__  = "AgentOS"   # sdk.client.SDK_VERSION and the UI server version all read this.
 
 from sdk.client import BackendClient

{devops_bot_sdk-1.4.119 → devops_bot_sdk-1.4.120}/sdk/config.py

@@ -190,6 +190,75 @@ def get_allowed_ips() -> list[str]:
     return out
 
 
+class PermanentAllowlistEntry(ValueError):
+    """Raised when trying to disable an IP that is permanently whitelisted via ``.env``."""
+
+
+def permanent_allowed_ips() -> list[str]:
+    """IPs/CIDRs whitelisted **permanently** — from ``.env`` (``~/.agentos/.env`` or
+    CWD) or the ``AGENTOS_UI_ALLOWED_IPS`` process env var.
+
+    These are the fixed baseline: they are ALWAYS allowed and **cannot be disabled**
+    through the API — change them by editing ``.env`` and restarting.
+    """
+    out: list[str] = []
+    for src in (_dotenv_value("AGENTOS_UI_ALLOWED_IPS"),
+                os.environ.get("AGENTOS_UI_ALLOWED_IPS", "")):
+        for ip in _parse_ip_list(src):
+            if ip not in out:
+                out.append(ip)
+    return out
+
+
+def runtime_allowed_ips() -> list[str]:
+    """IPs/CIDRs whitelisted **at runtime** (config.toml ``allowed_ips``) — added by
+    the whitelist endpoint and removable by the disable endpoint. They stay in the
+    allowlist until disabled."""
+    return _parse_ip_list(_load_raw().get("allowed_ips", ""))
+
+
+def add_allowed_ip(ip: str) -> list[str]:
+    """Whitelist an IP/CIDR at RUNTIME (persisted to config.toml ``allowed_ips``).
+
+    Idempotent. The middleware re-reads the allowlist per request, so the IP is
+    honoured immediately (no restart) and stays until disabled. An IP already
+    permanently whitelisted via ``.env`` is left as-is (no runtime duplicate).
+    Returns the merged allowlist.
+    """
+    ip = (ip or "").strip()
+    if not ip:
+        raise ValueError("ip is required")
+    if ip in permanent_allowed_ips():                   # already permanent — nothing to add
+        return get_allowed_ips()
+    raw = _load_raw()                                   # preserves token_enc / base_url / etc.
+    entries = _parse_ip_list(raw.get("allowed_ips", ""))
+    if ip not in entries:
+        entries.append(ip)
+    raw["allowed_ips"] = ", ".join(entries)
+    _save_raw(raw)
+    return get_allowed_ips()
+
+
+def remove_allowed_ip(ip: str) -> list[str]:
+    """Disable a RUNTIME-whitelisted IP/CIDR (remove from config.toml ``allowed_ips``).
+
+    Raises :class:`PermanentAllowlistEntry` if the IP is permanently whitelisted via
+    ``.env`` — those are never removable through the API (edit ``.env`` instead).
+    Returns the merged allowlist.
+    """
+    ip = (ip or "").strip()
+    if ip in permanent_allowed_ips():
+        raise PermanentAllowlistEntry(
+            f"{ip} is permanently whitelisted via .env (AGENTOS_UI_ALLOWED_IPS) — "
+            "it cannot be disabled through the API; edit .env and restart to change it."
+        )
+    raw = _load_raw()
+    entries = [x for x in _parse_ip_list(raw.get("allowed_ips", "")) if x != ip]
+    raw["allowed_ips"] = ", ".join(entries)
+    _save_raw(raw)
+    return get_allowed_ips()
+
+
 def get_branch_name_template() -> str | None:
     """Org-wide branch-naming convention, if configured in config.toml.
 

{devops_bot_sdk-1.4.119 → devops_bot_sdk-1.4.120}/sdk/ui/api.py

@@ -59,6 +59,67 @@ async def status() -> dict:
     }
 
 
+# ── IP allowlist management ─────────────────────────────────────────────────
+# Whitelist a client IP for THIS SDK. A whitelisted IP passes the IP gate for
+# EVERY path (all /api/ui/* endpoints + the UI + /docs); data endpoints still
+# additionally require the co_ token. Persisted to config.toml `allowed_ips`; the
+# middleware re-reads it per request so a new IP works immediately (no restart).
+# The backend proxies here (POST /api/v1/sdk/whitelist-ip) to open access for an IP.
+
+def _valid_ip_or_cidr(value: str) -> bool:
+    import ipaddress
+    try:
+        ipaddress.ip_network(value, strict=False)
+        return True
+    except ValueError:
+        return False
+
+
+@router.get("/allowlist", dependencies=[_auth])
+async def get_allowlist() -> dict:
+    """This SDK's allowlist, split into permanent vs runtime.
+
+    - ``permanent`` — from ``.env`` (AGENTOS_UI_ALLOWED_IPS); always allowed, not
+      disableable via the API.
+    - ``runtime`` — whitelisted on request; stay until disabled.
+    (loopback + this host's own IPs are always allowed, implicitly.)
+    """
+    from sdk.config import get_allowed_ips, permanent_allowed_ips, runtime_allowed_ips
+    return {
+        "allowed_ips": get_allowed_ips(),
+        "permanent": permanent_allowed_ips(),
+        "runtime": runtime_allowed_ips(),
+    }
+
+
+@router.post("/allowlist", dependencies=[_auth])
+async def add_to_allowlist(body: dict) -> dict:
+    """Whitelist an IP/CIDR for this SDK at runtime. Body: ``{ip}``. Idempotent.
+
+    Opens the IP gate for that client across every path (all endpoints + UI + docs)
+    until it's disabled. Effective immediately (the middleware re-reads per request).
+    """
+    from sdk.config import add_allowed_ip
+
+    ip = str(body.get("ip", "")).strip()
+    if not ip:
+        raise HTTPException(status_code=400, detail="ip is required.")
+    if not _valid_ip_or_cidr(ip):
+        raise HTTPException(status_code=400, detail=f"invalid IP or CIDR: {ip!r}")
+    return {"added": ip, "allowed_ips": add_allowed_ip(ip)}
+
+
+@router.delete("/allowlist", dependencies=[_auth])
+async def remove_from_allowlist(ip: str = Query(...)) -> dict:
+    """Disable a runtime-whitelisted IP/CIDR. Permanent (``.env``) entries → 400."""
+    from sdk.config import remove_allowed_ip, PermanentAllowlistEntry
+
+    try:
+        return {"removed": ip, "allowed_ips": remove_allowed_ip(ip)}
+    except PermanentAllowlistEntry as exc:
+        raise HTTPException(status_code=400, detail=str(exc))
+
+
 @router.post("/configure", dependencies=[_auth])
 async def configure(body: dict) -> dict:
     from sdk import config as sdk_config

{devops_bot_sdk-1.4.119 → devops_bot_sdk-1.4.120}/sdk/ui/ip_allowlist.py

@@ -71,18 +71,24 @@ class IPAllowlistMiddleware(BaseHTTPMiddleware):
 
     def __init__(self, app, allowed: list[str] | None = None) -> None:
         super().__init__(app)
-        # Resolve the allowlist once at startup. Callers can pass an explicit list
-        # (tests); otherwise we read env + config.toml.
-        if allowed is None:
+        # `allowed` set explicitly (tests) → fixed list. Otherwise the configured
+        # allowlist is read FRESH per request (see `_configured_nets`) so an IP
+        # whitelisted at runtime via /api/ui/allowlist takes effect immediately —
+        # no restart. This host's own IPs are static, so compute them once.
+        self._explicit = allowed
+        self._local_nets = [n for n in (_parse(a) for a in _local_ips()) if n is not None]
+        self._trust_xff = os.environ.get("AGENTOS_UI_TRUST_FORWARDED_FOR", "") in ("1", "true", "TRUE", "yes")
+
+    def _configured_nets(self) -> list:
+        if self._explicit is not None:
+            entries = self._explicit
+        else:
             try:
                 from sdk.config import get_allowed_ips
-                allowed = get_allowed_ips()
+                entries = get_allowed_ips()
             except Exception:  # noqa: BLE001 — never let config break the server
-                allowed = []
-        # Configured allowlist + this host's own IPs, all as networks.
-        entries = list(allowed) + list(_local_ips())
-        self._networks = [n for n in (_parse(a) for a in entries) if n is not None]
-        self._trust_xff = os.environ.get("AGENTOS_UI_TRUST_FORWARDED_FOR", "") in ("1", "true", "TRUE", "yes")
+                entries = []
+        return [n for n in (_parse(a) for a in entries) if n is not None]
 
     def _client_ip(self, request: Request) -> str:
         if self._trust_xff:
@@ -98,7 +104,7 @@ class IPAllowlistMiddleware(BaseHTTPMiddleware):
             return False
         if _loopback(ip):
             return True
-        return any(ip in net for net in self._networks)
+        return any(ip in net for net in (self._local_nets + self._configured_nets()))
 
     async def dispatch(self, request: Request, call_next):
         # Guard EVERY path — nothing on this server is public.