devops-bot-sdk 1.4.119__tar.gz → 1.4.124__tar.gz

{devops_bot_sdk-1.4.119 → devops_bot_sdk-1.4.124}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.4.119
+Version: 1.4.124
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.4.119 → devops_bot_sdk-1.4.124}/devops_bot_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.4.119
+Version: 1.4.124
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.4.119 → devops_bot_sdk-1.4.124}/sdk/__init__.py

@@ -1,6 +1,6 @@
 """AgentOS Desktop SDK — thin HTTPS/SSE client for the Electron app.
 
-Version: 1.4.119
+Version: 1.4.124
 
 Public surface:
   BackendClient.from_config()        — create client from ~/.agentos/config.toml
@@ -30,7 +30,7 @@ Rules:
   - All data egress through submit_webhook only
 """
 
-__version__ = "1.4.119"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
+__version__ = "1.4.124"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
 __author__  = "AgentOS"   # sdk.client.SDK_VERSION and the UI server version all read this.
 
 from sdk.client import BackendClient

{devops_bot_sdk-1.4.119 → devops_bot_sdk-1.4.124}/sdk/agents/inventory.py

@@ -16,22 +16,39 @@ import subprocess
 from pathlib import Path
 
 from sdk.agents import usage as usage_mod
-from sdk.agents.manifest import load_agents, load_skills
-from sdk.agents.prompt_vars import extract_variables
+from sdk.agents.manifest import load_skills
 
 logger = logging.getLogger("sdk.agents.inventory")
 
 
-def _custom_agents() -> list[dict]:
-    out: list[dict] = []
-    for m in load_agents():
-        out.append({
-            "name": m.name, "engine": m.engine, "trigger": m.trigger.type,
-            "description": m.description, "integrations": list(m.integrations),
-            "skills": list(m.skills), "variables": extract_variables(m.prompt),
-            "source": "custom",
-        })
-    return out
+def _map_backend_agent(row: dict, source: str) -> dict:
+    """Project a backend prompt-based ``agents`` row into the inventory shape."""
+    prompt = row.get("prompt") or {}
+    sys_prompt = prompt.get("system_prompt", "") if isinstance(prompt, dict) else ""
+    pvars = prompt.get("variables", []) if isinstance(prompt, dict) else []
+    return {
+        "name": row.get("name"),
+        "description": sys_prompt[:200],
+        "variables": [v.get("name") for v in pvars if isinstance(v, dict) and v.get("name")],
+        "skills": row.get("skills", []),
+        "status": row.get("status", "active"),
+        "source": source,
+    }
+
+
+async def _custom_agents() -> list[dict]:
+    """The caller's custom agents (``relation_type=person``) from the backend.
+
+    Backend is the source of truth — agents are authored in the web app and read
+    via GET /api/v1/agents. Best-effort: degrades to empty on any error.
+    """
+    try:
+        from sdk.client import BackendClient
+        rows = await BackendClient.from_config().list_custom_agents()
+        return [_map_backend_agent(r, "custom") for r in rows]
+    except Exception as exc:  # noqa: BLE001
+        logger.debug("custom-agent inventory failed: %s", exc)
+        return []
 
 
 def _skills() -> list[dict]:
@@ -101,31 +118,26 @@ def _claude_subagents() -> list[dict]:
 
 
 async def _default_agents() -> list[dict]:
-    """Department default agents from the bundled SDK library (best-effort).
+    """Department default agents (``relation_type=department`` + org-wide common)
+    from the backend (best-effort).
 
-    Resolves the caller's department by *name* (the ``title`` on the backend
-    profile, e.g. "Machine Learning") to a library slug and loads that
-    department's templates locally — no AI-backend ``/departments/{id}/
-    default-agents`` call.
+    Reads the live rows via GET /api/v1/department-agents — the source of truth —
+    rather than the bundled SDK library. Degrades to empty on any error.
     """
     try:
         from sdk.client import BackendClient
-        from sdk.agents.library import (
-            load_common_templates, load_department, resolve_department_slug,
-        )
-
         client = BackendClient.from_config()
-        profile = await client.profile()
-        title = profile.department_title or ""
-        slug = resolve_department_slug(title)
-        # A resolved department already includes the common agents; a department
-        # with no library entry still surfaces the common defaults.
-        templates = load_department(slug) if slug else load_common_templates(title=title)
-        return [{"name": t.manifest.name, "engine": t.manifest.engine,
-                 "description": t.manifest.description, "source": "default",
-                 "department": title,
-                 "department_id": profile.department_id,
-                 "min_role_tier": t.min_role_tier} for t in templates]
+        try:
+            title = (await client.profile()).department_title or ""
+        except Exception:  # noqa: BLE001 — department label is cosmetic
+            title = ""
+        rows = await client.list_department_agents()
+        out = []
+        for r in rows:
+            entry = _map_backend_agent(r, "default")
+            entry["department"] = title
+            out.append(entry)
+        return out
     except Exception as exc:  # noqa: BLE001
         logger.debug("default-agent inventory failed: %s", exc)
         return []
@@ -133,7 +145,7 @@ async def _default_agents() -> list[dict]:
 
 async def build_inventory() -> dict:
     """The full snapshot: agents, subagents, tools, plugins + per-agent usage."""
-    customs = _custom_agents()
+    customs = await _custom_agents()
     usage = usage_mod.summary()
     # Attach utilisation to each custom agent.
     for a in customs:

{devops_bot_sdk-1.4.119 → devops_bot_sdk-1.4.124}/sdk/config.py

@@ -190,6 +190,75 @@ def get_allowed_ips() -> list[str]:
     return out
 
 
+class PermanentAllowlistEntry(ValueError):
+    """Raised when trying to disable an IP that is permanently whitelisted via ``.env``."""
+
+
+def permanent_allowed_ips() -> list[str]:
+    """IPs/CIDRs whitelisted **permanently** — from ``.env`` (``~/.agentos/.env`` or
+    CWD) or the ``AGENTOS_UI_ALLOWED_IPS`` process env var.
+
+    These are the fixed baseline: they are ALWAYS allowed and **cannot be disabled**
+    through the API — change them by editing ``.env`` and restarting.
+    """
+    out: list[str] = []
+    for src in (_dotenv_value("AGENTOS_UI_ALLOWED_IPS"),
+                os.environ.get("AGENTOS_UI_ALLOWED_IPS", "")):
+        for ip in _parse_ip_list(src):
+            if ip not in out:
+                out.append(ip)
+    return out
+
+
+def runtime_allowed_ips() -> list[str]:
+    """IPs/CIDRs whitelisted **at runtime** (config.toml ``allowed_ips``) — added by
+    the whitelist endpoint and removable by the disable endpoint. They stay in the
+    allowlist until disabled."""
+    return _parse_ip_list(_load_raw().get("allowed_ips", ""))
+
+
+def add_allowed_ip(ip: str) -> list[str]:
+    """Whitelist an IP/CIDR at RUNTIME (persisted to config.toml ``allowed_ips``).
+
+    Idempotent. The middleware re-reads the allowlist per request, so the IP is
+    honoured immediately (no restart) and stays until disabled. An IP already
+    permanently whitelisted via ``.env`` is left as-is (no runtime duplicate).
+    Returns the merged allowlist.
+    """
+    ip = (ip or "").strip()
+    if not ip:
+        raise ValueError("ip is required")
+    if ip in permanent_allowed_ips():                   # already permanent — nothing to add
+        return get_allowed_ips()
+    raw = _load_raw()                                   # preserves token_enc / base_url / etc.
+    entries = _parse_ip_list(raw.get("allowed_ips", ""))
+    if ip not in entries:
+        entries.append(ip)
+    raw["allowed_ips"] = ", ".join(entries)
+    _save_raw(raw)
+    return get_allowed_ips()
+
+
+def remove_allowed_ip(ip: str) -> list[str]:
+    """Disable a RUNTIME-whitelisted IP/CIDR (remove from config.toml ``allowed_ips``).
+
+    Raises :class:`PermanentAllowlistEntry` if the IP is permanently whitelisted via
+    ``.env`` — those are never removable through the API (edit ``.env`` instead).
+    Returns the merged allowlist.
+    """
+    ip = (ip or "").strip()
+    if ip in permanent_allowed_ips():
+        raise PermanentAllowlistEntry(
+            f"{ip} is permanently whitelisted via .env (AGENTOS_UI_ALLOWED_IPS) — "
+            "it cannot be disabled through the API; edit .env and restart to change it."
+        )
+    raw = _load_raw()
+    entries = [x for x in _parse_ip_list(raw.get("allowed_ips", "")) if x != ip]
+    raw["allowed_ips"] = ", ".join(entries)
+    _save_raw(raw)
+    return get_allowed_ips()
+
+
 def get_branch_name_template() -> str | None:
     """Org-wide branch-naming convention, if configured in config.toml.
 

{devops_bot_sdk-1.4.119 → devops_bot_sdk-1.4.124}/sdk/ui/api.py

@@ -59,6 +59,67 @@ async def status() -> dict:
     }
 
 
+# ── IP allowlist management ─────────────────────────────────────────────────
+# Whitelist a client IP for THIS SDK. A whitelisted IP passes the IP gate for
+# EVERY path (all /api/ui/* endpoints + the UI + /docs); data endpoints still
+# additionally require the co_ token. Persisted to config.toml `allowed_ips`; the
+# middleware re-reads it per request so a new IP works immediately (no restart).
+# The backend proxies here (POST /api/v1/sdk/whitelist-ip) to open access for an IP.
+
+def _valid_ip_or_cidr(value: str) -> bool:
+    import ipaddress
+    try:
+        ipaddress.ip_network(value, strict=False)
+        return True
+    except ValueError:
+        return False
+
+
+@router.get("/allowlist", dependencies=[_auth])
+async def get_allowlist() -> dict:
+    """This SDK's allowlist, split into permanent vs runtime.
+
+    - ``permanent`` — from ``.env`` (AGENTOS_UI_ALLOWED_IPS); always allowed, not
+      disableable via the API.
+    - ``runtime`` — whitelisted on request; stay until disabled.
+    (loopback + this host's own IPs are always allowed, implicitly.)
+    """
+    from sdk.config import get_allowed_ips, permanent_allowed_ips, runtime_allowed_ips
+    return {
+        "allowed_ips": get_allowed_ips(),
+        "permanent": permanent_allowed_ips(),
+        "runtime": runtime_allowed_ips(),
+    }
+
+
+@router.post("/allowlist", dependencies=[_auth])
+async def add_to_allowlist(body: dict) -> dict:
+    """Whitelist an IP/CIDR for this SDK at runtime. Body: ``{ip}``. Idempotent.
+
+    Opens the IP gate for that client across every path (all endpoints + UI + docs)
+    until it's disabled. Effective immediately (the middleware re-reads per request).
+    """
+    from sdk.config import add_allowed_ip
+
+    ip = str(body.get("ip", "")).strip()
+    if not ip:
+        raise HTTPException(status_code=400, detail="ip is required.")
+    if not _valid_ip_or_cidr(ip):
+        raise HTTPException(status_code=400, detail=f"invalid IP or CIDR: {ip!r}")
+    return {"added": ip, "allowed_ips": add_allowed_ip(ip)}
+
+
+@router.delete("/allowlist", dependencies=[_auth])
+async def remove_from_allowlist(ip: str = Query(...)) -> dict:
+    """Disable a runtime-whitelisted IP/CIDR. Permanent (``.env``) entries → 400."""
+    from sdk.config import remove_allowed_ip, PermanentAllowlistEntry
+
+    try:
+        return {"removed": ip, "allowed_ips": remove_allowed_ip(ip)}
+    except PermanentAllowlistEntry as exc:
+        raise HTTPException(status_code=400, detail=str(exc))
+
+
 @router.post("/configure", dependencies=[_auth])
 async def configure(body: dict) -> dict:
     from sdk import config as sdk_config
@@ -204,75 +265,95 @@ async def connectors() -> dict:
 
 @router.get("/agents", dependencies=[_auth])
 async def agents() -> dict:
-    """Locally-installed agents (name, engine, trigger, integrations, variables)."""
-    from sdk.agents.manifest import load_agents
-    from sdk.agents.prompt_vars import extract_variables
+    """The caller's custom agents (``relation_type=person``) from the backend.
 
-    return {
-        "agents": [
-            {"name": m.name, "engine": m.engine, "trigger": m.trigger.type,
-             "integrations": m.integrations, "description": m.description,
-             "variables": extract_variables(m.prompt)}
-            for m in load_agents()
-        ]
+    Backend is the source of truth — agents are authored in the web app and read
+    here via GET /api/v1/agents (prompt-based shape: prompt = {system_prompt,
+    variables:[…]}; skills = [{name,…}]). Best-effort: on backend error the list
+    is empty with an ``error`` string the UI can surface.
+    """
+    from sdk.client import BackendClient
+    from sdk.exceptions import BackendFeatureMissing
+
+    try:
+        rows = await BackendClient.from_config().list_custom_agents()
+    except BackendFeatureMissing:
+        return {"agents": [], "error": ("Custom agents aren't available on this "
+                                        "backend — it may be running an older version.")}
+    except Exception as exc:  # noqa: BLE001 — degrade to empty, surface the reason
+        return {"agents": [], "error": str(exc)}
+    return {"agents": rows, "error": ""}
+
+
+def _flat_agent(row: dict, source: str, *, chattable: bool, department_id: str = "") -> dict:
+    """Flatten a backend prompt-based ``agents`` row into the picker shape the UI
+    expects (``name``/``description``/``variables``/``skills``/``source``)."""
+    prompt = row.get("prompt") or {}
+    sys_prompt = prompt.get("system_prompt", "") if isinstance(prompt, dict) else ""
+    pvars = prompt.get("variables", []) if isinstance(prompt, dict) else []
+    entry = {
+        "name": row.get("name"),
+        "description": sys_prompt[:200],
+        "variables": [v.get("name") for v in pvars if isinstance(v, dict) and v.get("name")],
+        "skills": row.get("skills", []),
+        "status": row.get("status", "active"),
+        "source": source,
+        "chattable": chattable,
     }
+    if department_id:
+        entry["department_id"] = department_id
+    return entry
 
 
 @router.get("/agents/all", dependencies=[_auth])
 async def agents_all(department_id: str = Query("")) -> dict:
-    """Every agent a person can pick to chat: local custom + department defaults.
-
-    Custom agents are chattable immediately; a default must be activated (cloned
-    locally) first — surfaced via ``chattable`` and ``source``. Each entry carries
-    its detected ``{{variables}}`` so the UI can render input fields. Defaults are
-    best-effort (empty if the backend is unreachable).
+    """Every agent a person can pick to chat: their custom agents + department
+    defaults, both read from the backend (source of truth).
+
+    Custom agents (``relation_type=person``) come from GET /api/v1/agents; defaults
+    (``relation_type=department`` + org-wide common) from GET /api/v1/department-agents.
+    Custom wins on a name collision. Each entry carries its detected variables so
+    the UI can render input fields. Both are best-effort — an unreachable backend
+    yields an empty list plus an error string rather than a hard failure.
     """
-    from sdk.agents.manifest import load_agents
-    from sdk.agents.prompt_vars import extract_variables
-
-    locals_ = load_agents()
-    local_names = {m.name for m in locals_}
-    out = [
-        {"name": m.name, "engine": m.engine, "description": m.description,
-         "variables": extract_variables(m.prompt), "source": "custom",
-         "chattable": True}
-        for m in locals_
-    ]
+    from sdk.client import BackendClient
+    from sdk.exceptions import BackendFeatureMissing
 
+    out: list[dict] = []
+    seen: set[str] = set()
     dept = department_id
     defaults_error = ""
+
     try:
-        from sdk.client import BackendClient
-        from sdk.exceptions import BackendFeatureMissing
         client = BackendClient.from_config()
         if not dept:
             profile = await client.bootstrap()
             dept = getattr(profile, "department_id", None) or ""
-        if dept:
-            try:
-                # Department defaults are now plain `agents` rows (relation_type=
-                # department), read from /department-agents in the new prompt-based
-                # schema: prompt = {system_prompt, variables:[{name,...}]}.
-                rows = await client.list_department_agents()
-            except BackendFeatureMissing:
-                rows = []
-                defaults_error = ("Department default agents aren't available on this "
-                                  "backend — it may be running an older version.")
-            for r in rows:
+
+        # Custom agents first so they win any name collision with a default.
+        try:
+            for r in await client.list_custom_agents():
+                nm = r.get("name")
+                if not nm or nm in seen:
+                    continue
+                seen.add(nm)
+                out.append(_flat_agent(r, "custom", chattable=True))
+        except BackendFeatureMissing:
+            defaults_error = ("Custom agents aren't available on this backend — "
+                              "it may be running an older version.")
+
+        # Department defaults (a default must be activated/cloned before it runs).
+        try:
+            for r in await client.list_department_agents():
                 nm = r.get("name")
-                if not nm or nm in local_names:
+                if not nm or nm in seen:
                     continue
-                prompt = r.get("prompt") or {}
-                sys_prompt = prompt.get("system_prompt", "") if isinstance(prompt, dict) else ""
-                pvars = prompt.get("variables", []) if isinstance(prompt, dict) else []
-                out.append({
-                    "name": nm,
-                    "description": sys_prompt[:200],
-                    "variables": [v.get("name") for v in pvars if isinstance(v, dict) and v.get("name")],
-                    "skills": r.get("skills", []),
-                    "source": "default", "department_id": dept, "chattable": False,
-                })
-    except Exception:  # noqa: BLE001 — defaults are best-effort
+                seen.add(nm)
+                out.append(_flat_agent(r, "default", chattable=False, department_id=dept))
+        except BackendFeatureMissing:
+            defaults_error = ("Department default agents aren't available on this "
+                              "backend — it may be running an older version.")
+    except Exception:  # noqa: BLE001 — best-effort; return whatever we gathered
         pass
 
     return {"agents": out, "department_id": dept, "defaults_error": defaults_error}

{devops_bot_sdk-1.4.119 → devops_bot_sdk-1.4.124}/sdk/ui/ip_allowlist.py

@@ -71,18 +71,24 @@ class IPAllowlistMiddleware(BaseHTTPMiddleware):
 
     def __init__(self, app, allowed: list[str] | None = None) -> None:
         super().__init__(app)
-        # Resolve the allowlist once at startup. Callers can pass an explicit list
-        # (tests); otherwise we read env + config.toml.
-        if allowed is None:
+        # `allowed` set explicitly (tests) → fixed list. Otherwise the configured
+        # allowlist is read FRESH per request (see `_configured_nets`) so an IP
+        # whitelisted at runtime via /api/ui/allowlist takes effect immediately —
+        # no restart. This host's own IPs are static, so compute them once.
+        self._explicit = allowed
+        self._local_nets = [n for n in (_parse(a) for a in _local_ips()) if n is not None]
+        self._trust_xff = os.environ.get("AGENTOS_UI_TRUST_FORWARDED_FOR", "") in ("1", "true", "TRUE", "yes")
+
+    def _configured_nets(self) -> list:
+        if self._explicit is not None:
+            entries = self._explicit
+        else:
             try:
                 from sdk.config import get_allowed_ips
-                allowed = get_allowed_ips()
+                entries = get_allowed_ips()
             except Exception:  # noqa: BLE001 — never let config break the server
-                allowed = []
-        # Configured allowlist + this host's own IPs, all as networks.
-        entries = list(allowed) + list(_local_ips())
-        self._networks = [n for n in (_parse(a) for a in entries) if n is not None]
-        self._trust_xff = os.environ.get("AGENTOS_UI_TRUST_FORWARDED_FOR", "") in ("1", "true", "TRUE", "yes")
+                entries = []
+        return [n for n in (_parse(a) for a in entries) if n is not None]
 
     def _client_ip(self, request: Request) -> str:
         if self._trust_xff:
@@ -98,7 +104,7 @@ class IPAllowlistMiddleware(BaseHTTPMiddleware):
             return False
         if _loopback(ip):
             return True
-        return any(ip in net for net in self._networks)
+        return any(ip in net for net in (self._local_nets + self._configured_nets()))
 
     async def dispatch(self, request: Request, call_next):
         # Guard EVERY path — nothing on this server is public.

{devops_bot_sdk-1.4.119 → devops_bot_sdk-1.4.124}/sdk/ui/static/app.js

@@ -650,26 +650,40 @@
       try {
         const d = await api("/api/ui/agents");
         const rows = d.agents || [];
+        if (!rows.length && d.error) {
+          $("local-agents").innerHTML = `<div class="empty">${esc(d.error)}</div>`;
+          const kaSel0 = $("key-agent");
+          if (kaSel0) { kaSel0.innerHTML = `<option value="">(no agents yet)</option>`; onAgentSelect(); }
+          return;
+        }
         caMeta = {}; rows.forEach(a => { caMeta[a.name] = a; });
         const kaSel = $("key-agent");
         if (kaSel) {
           kaSel.innerHTML = rows.length
-            ? rows.map(a => `<option value="${esc(a.name)}">${esc(a.name)} (${esc(a.engine)})</option>`).join("")
+            ? rows.map(a => `<option value="${esc(a.name)}">${esc(a.name)}</option>`).join("")
             : `<option value="">(no agents yet)</option>`;
           onAgentSelect();
         }
-        $("local-agents").innerHTML = rows.length ? rows.map(a =>
-          `<div class="agent-card">
-             <div class="agent-head"><span class="agent-name">${esc(a.name)}</span><span class="pill on">${esc(a.engine)}</span></div>
-             <div class="agent-meta">${esc(a.trigger)}${a.integrations.length ? " · " + a.integrations.map(esc).join(", ") : ""}${a.variables && a.variables.length ? " · " + a.variables.length + " input(s)" : ""}</div>
-             <div class="agent-desc">${esc(a.description || "")}</div>
+        $("local-agents").innerHTML = rows.length ? rows.map(a => {
+          const prompt = a.prompt || {};
+          const summary = (prompt.system_prompt || "").trim().slice(0, 200);
+          const nvars = (prompt.variables || []).length;
+          const nskills = (a.skills || []).length;
+          return `<div class="agent-card">
+             <div class="agent-head">
+               <span class="agent-name">${esc(a.name)}</span>
+               <span class="pill ${a.status === "disabled" ? "off" : "on"}">${esc(a.status || "active")}</span>
+             </div>
+             <div class="agent-meta">${nvars} variable(s) · ${nskills} skill(s)</div>
+             <div class="agent-desc">${esc(summary)}</div>
              <div class="agent-actions">
                <a class="btn primary" href="/agents.html?agent=${encodeURIComponent(a.name)}">Run</a>
                <button class="btn" data-enable="${esc(a.name)}">Enable</button>
                <button class="btn" data-disable="${esc(a.name)}">Disable</button>
                <button class="btn danger" data-del="${esc(a.name)}">Delete</button>
              </div>
-           </div>`).join("")
+           </div>`;
+        }).join("")
           : "<div class='empty'>No custom agents assigned to you yet. Agents are created in the web app.</div>";
 
         $("local-agents").querySelectorAll("[data-enable]").forEach(b => b.onclick = () => setStatus(b.dataset.enable, "active"));