devops-copilot 0.1.0__py3-none-any.whl

app/__init__.py

@@ -0,0 +1 @@
+# This makes the app folder a Python package

app/cli/__init__.py

@@ -0,0 +1 @@
+# This makes the app/cli folder a Python package

app/cli/config.py

@@ -0,0 +1,41 @@
+import json
+import os
+from pathlib import Path
+from typing import Dict, Optional
+
+CONFIG_DIR = Path.home() / ".config" / "devops-copilot"
+CONFIG_FILE = CONFIG_DIR / "config.json"
+OLD_CONFIG_DIR = Path.home() / ".config" / "devops-rag"
+OLD_CONFIG_FILE = OLD_CONFIG_DIR / "config.json"
+
+def load_config() -> Optional[Dict[str, str]]:
+    """Loads CLI settings from local configuration file with fallback/migration from old path."""
+    if not CONFIG_FILE.exists():
+        if OLD_CONFIG_FILE.exists():
+            try:
+                # Automatically migrate old config to the new directory
+                with open(OLD_CONFIG_FILE, "r") as f:
+                    old_data = json.load(f)
+                save_config(old_data["server_url"], old_data["token"])
+            except Exception:
+                pass
+        else:
+            return None
+    try:
+        with open(CONFIG_FILE, "r") as f:
+            return json.load(f)
+    except Exception:
+        return None
+
+def save_config(server_url: str, token: str) -> None:
+    """Saves CLI settings to the local config.json file in the user's home config directory."""
+    try:
+        CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+        config_data = {
+            "server_url": server_url.rstrip("/"),
+            "token": token
+        }
+        with open(CONFIG_FILE, "w") as f:
+            json.dump(config_data, f, indent=4)
+    except Exception as e:
+        raise RuntimeError(f"Failed to save local config: {str(e)}")

app/cli/main.py

@@ -0,0 +1,251 @@
+import asyncio
+import sys
+import json
+import httpx
+import websockets
+import typer
+from typing import Optional
+
+from app.cli.config import load_config, save_config
+
+app = typer.Typer(name="devops-copilot", help="AI-driven DevOps Copilot CLI Client")
+
+@app.command("login")
+def login(
+    server_url: Optional[str] = typer.Option(None, help="The base URL of the FastAPI backend server"),
+    username: Optional[str] = typer.Option(None, help="Your administrator username")
+):
+    """
+    Authenticate with the central DevOps-Copilot backend and retrieve an access token.
+    Saves configurations locally in ~/.config/devops-copilot/config.json.
+    """
+    if not server_url:
+        server_url = typer.prompt("Enter DevOps Agent server URL (e.g. http://localhost:8000)")
+    if not username:
+        username = typer.prompt("Enter admin username")
+    password = typer.prompt("Enter password", hide_input=True)
+
+    server_url_clean = server_url.rstrip("/")
+    token_url = f"{server_url_clean}/api/v1/auth/token"
+
+    typer.echo(f"Logging in to {server_url_clean}...")
+    try:
+        response = httpx.post(
+            token_url,
+            data={"username": username, "password": password},
+            timeout=10.0
+        )
+        try:
+            response_json = response.json()
+        except (ValueError, TypeError):
+            response_json = None
+
+        if response.status_code == 200:
+            if response_json:
+                token = response_json.get("access_token")
+                save_config(server_url_clean, token)
+                typer.secho("Success! Authenticated and configured locally.", fg=typer.colors.GREEN, bold=True)
+            else:
+                typer.secho("Authentication Failed: Server returned non-JSON response.", fg=typer.colors.RED, err=True)
+                raise typer.Exit(code=1)
+        else:
+            detail = response_json.get("detail") if response_json else f"HTTP Status {response.status_code}: {response.text[:200]}"
+            typer.secho(f"Authentication Failed: {detail}", fg=typer.colors.RED, err=True)
+            raise typer.Exit(code=1)
+    except typer.Exit:
+        raise
+    except Exception as e:
+        typer.secho(f"Connection Error: {str(e)}", fg=typer.colors.RED, err=True)
+        raise typer.Exit(code=1)
+
+async def run_chat_loop(server_url: str, token: str, session_id: int):
+    """Asynchronous WebSocket loop that handles message passing and streams with auto-reconnect."""
+    ws_proto = "wss" if server_url.startswith("https") else "ws"
+    host_port = server_url.split("://")[-1]
+    ws_url = f"{ws_proto}://{host_port}/api/v1/chat/ws?token={token}"
+
+    reconnect_delay = 1.0
+    max_reconnect_delay = 16.0
+
+    while True:
+        try:
+            async with websockets.connect(ws_url) as ws:
+                reconnect_delay = 1.0  # Reset delay on success
+                typer.secho(f"\nConnected to DevOps AI Agent (Session #{session_id})!", fg=typer.colors.GREEN, bold=True)
+                typer.secho("Type your prompt and press Enter. Type 'exit' to quit.\n", fg=typer.colors.CYAN)
+
+                approval_sent = False
+                while True:
+                    if not approval_sent:
+                        # Read user input from terminal
+                        user_input = typer.prompt("You")
+                        if user_input.lower() in ("exit", "quit"):
+                            typer.secho("Exiting chat session. Goodbye!", fg=typer.colors.YELLOW)
+                            return
+                        
+                        if not user_input.strip():
+                            continue
+
+                        # Send chat message to server using websockets API (send stringified JSON)
+                        await ws.send(json.dumps({
+                            "type": "message",
+                            "session_id": session_id,
+                            "content": user_input
+                        }))
+
+                        # Listen to streamed server events
+                        typer.secho("Agent: ", fg=typer.colors.MAGENTA, nl=False)
+                    
+                    approval_sent = False  # Reset state for this turn
+                    
+                    while True:
+                        event = await ws.recv()
+                        event_data = json.loads(event)
+                        event_type = event_data.get("type")
+
+                        if event_type == "token":
+                            # Print thinking tokens as they arrive
+                            sys.stdout.write(event_data.get("data", ""))
+                            sys.stdout.flush()
+                        
+                        elif event_type == "stdout":
+                            # Stream command output in gray
+                            sys.stdout.write("\n")  # Newline to separate from previous tokens
+                            typer.secho(event_data.get("data", ""), fg=typer.colors.BRIGHT_BLACK, nl=False)
+                            sys.stdout.flush()
+                            
+                        elif event_type == "stderr":
+                            # Stream stderr in red
+                            sys.stdout.write("\n")
+                            typer.secho(event_data.get("data", ""), fg=typer.colors.RED, nl=False)
+                            sys.stdout.flush()
+
+                        elif event_type == "approval_required":
+                            # Handle human-in-the-loop validation request
+                            action_id = event_data.get("action_id")
+                            server_name = event_data.get("server_name")
+                            command = event_data.get("command")
+
+                            typer.secho(f"\n\n[Action Approval Required]", fg=typer.colors.YELLOW, bold=True)
+                            typer.secho(f"Target Server: {server_name}", fg=typer.colors.YELLOW)
+                            typer.secho(f"Command to Run: {command}", fg=typer.colors.YELLOW, bold=True)
+                            
+                            approve = typer.confirm("Approve execution of this command?")
+                            
+                            if approve:
+                                typer.secho("Approving command execution...", fg=typer.colors.GREEN)
+                                await ws.send(json.dumps({
+                                    "type": "approve",
+                                    "action_id": action_id
+                                }))
+                            else:
+                                typer.secho("Rejecting command execution.", fg=typer.colors.RED)
+                                await ws.send(json.dumps({
+                                    "type": "reject",
+                                    "action_id": action_id
+                                }))
+                            approval_sent = True
+
+                        elif event_type == "finished":
+                            # Output generation is completed
+                            # Print newline and final summary response if not fully printed
+                            sys.stdout.write("\n\n")
+                            break
+
+                        elif event_type == "error":
+                            typer.secho(f"\nError: {event_data.get('data')}", fg=typer.colors.RED, err=True)
+                            break
+
+        except (websockets.exceptions.ConnectionClosed, ConnectionRefusedError, OSError) as e:
+            typer.secho(f"\nConnection lost ({str(e)}). Reconnecting in {reconnect_delay}s...", fg=typer.colors.YELLOW)
+            await asyncio.sleep(reconnect_delay)
+            reconnect_delay = min(reconnect_delay * 2, max_reconnect_delay)
+        except Exception as e:
+            typer.secho(f"\nWebSocket Error: {str(e)}", fg=typer.colors.RED, err=True)
+            break
+
+@app.command("chat")
+def chat():
+    """
+    Start an interactive chat session with the AI DevOps agent in the terminal.
+    Allows selecting historical threads or spawning new sessions.
+    """
+    config = load_config()
+    if not config:
+        typer.secho("Error: No configuration found. Please run 'devops-copilot login' first.", fg=typer.colors.RED, err=True)
+        raise typer.Exit(code=1)
+
+    server_url = config["server_url"]
+    token = config["token"]
+    headers = {"Authorization": f"Bearer {token}"}
+
+    # 1. Fetch existing chat sessions
+    typer.echo("Fetching chat sessions from server...")
+    try:
+        response = httpx.get(f"{server_url}/api/v1/chat/sessions", headers=headers, timeout=10.0)
+        if response.status_code == 401:
+            typer.secho("Session expired. Please run 'devops-copilot login' again.", fg=typer.colors.RED, err=True)
+            raise typer.Exit(code=1)
+        response.raise_for_status()
+        try:
+            sessions = response.json()
+        except (ValueError, TypeError):
+            typer.secho(f"Failed to fetch sessions: Server returned non-JSON response (HTTP {response.status_code}).", fg=typer.colors.RED, err=True)
+            raise typer.Exit(code=1)
+    except typer.Exit:
+        raise
+    except Exception as e:
+        typer.secho(f"Failed to fetch sessions: {str(e)}", fg=typer.colors.RED, err=True)
+        raise typer.Exit(code=1)
+
+    # 2. Let the user choose or spawn a new session
+    session_id = None
+    if sessions:
+        typer.echo("\nAvailable chat sessions:")
+        session_ids = []
+        for s in sessions:
+            typer.echo(f"  Session ID: {s['id']} | Title: {s['title']}")
+            session_ids.append(s['id'])
+        
+        choice = typer.prompt("\nSelect Session ID, or type 'new' to start a new chat")
+        
+        if choice.lower() != "new":
+            try:
+                val = int(choice)
+                if val in session_ids:
+                    session_id = val
+                else:
+                    typer.secho("Invalid Session ID.", fg=typer.colors.RED)
+                    raise typer.Exit(code=1)
+            except ValueError:
+                typer.secho("Invalid input format.", fg=typer.colors.RED)
+                raise typer.Exit(code=1)
+
+    if session_id is None:
+        # Create a new session
+        title = typer.prompt("Enter title for the new chat session")
+        try:
+            res = httpx.post(
+                f"{server_url}/api/v1/chat/sessions",
+                headers=headers,
+                json={"title": title},
+                timeout=10.0
+            )
+            res.raise_for_status()
+            try:
+                new_sess = res.json()
+                session_id = new_sess["id"]
+            except (ValueError, TypeError, KeyError):
+                typer.secho(f"Failed to create new session: Server returned invalid format.", fg=typer.colors.RED, err=True)
+                raise typer.Exit(code=1)
+        except typer.Exit:
+            raise
+        except Exception as e:
+            typer.secho(f"Failed to create new session: {str(e)}", fg=typer.colors.RED, err=True)
+            raise typer.Exit(code=1)
+
+    # 3. Enter the async WebSocket execution loop
+    asyncio.run(run_chat_loop(server_url, token, session_id))
+
+if __name__ == "__main__":
+    app()

app/core/config.py

@@ -0,0 +1,19 @@
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+class Settings(BaseSettings):
+    DATABASE_URL: str = "sqlite+aiosqlite:///data/devops_rag.db"
+    
+    JWT_SECRET_KEY: str = "supersecretkey_change_me_in_production"
+    JWT_ALGORITHM: str = "HS256"
+    ACCESS_TOKEN_EXPIRE_MINUTES: int = 30
+    
+    # Key for encrypting target server credentials (SSH passwords/private keys)
+    ENCRYPTION_KEY: str = "h-0rAgfuXQnNinQ9yZevWRvRNv9_nWdixhHG_DZGmoE="
+    
+    # OpenRouter API configurations for AI Agent
+    OPENROUTER_API_KEY: str | None = None
+    OPENROUTER_MODEL: str = "google/gemini-2.5-flash"
+
+    model_config = SettingsConfigDict(env_file=".env", extra="ignore")
+
+settings = Settings()

app/core/database/__init__.py

@@ -0,0 +1,24 @@
+from sqlalchemy.ext.asyncio import create_async_engine
+from sqlmodel.ext.asyncio.session import AsyncSession
+from sqlalchemy.orm import sessionmaker
+from sqlmodel import SQLModel
+from typing import AsyncGenerator
+from app.core.config import settings
+
+# create async engine
+engine = create_async_engine(settings.DATABASE_URL, echo=True)
+
+# create async session maker
+async_session_maker = sessionmaker(
+    engine, class_=AsyncSession, expire_on_commit=False
+)
+
+# create async db and tables
+async def create_db_and_tables():
+    async with engine.begin() as conn:
+        await conn.run_sync(SQLModel.metadata.create_all)
+
+# create async session dependency
+async def get_session() -> AsyncGenerator[AsyncSession, None]:
+    async with async_session_maker() as session:
+        yield session

app/core/security.py

@@ -0,0 +1,18 @@
+from cryptography.fernet import Fernet
+from app.core.config import settings
+
+# Initialize symmetric Fernet encryption with key from config
+fernet = Fernet(settings.ENCRYPTION_KEY.encode())
+
+def encrypt_data(data: str) -> str:
+    """
+    Encrypt sensitive data (e.g. passwords, SSH keys) using AES-128/256.
+    Returns a URL-safe base64-encoded string.
+    """
+    return fernet.encrypt(data.encode()).decode()
+
+def decrypt_data(encrypted_data: str) -> str:
+    """
+    Decrypt base64-encoded cipher text back into plain text.
+    """
+    return fernet.decrypt(encrypted_data.encode()).decode()

app/main.py

@@ -0,0 +1,31 @@
+from fastapi import FastAPI
+from contextlib import asynccontextmanager
+
+from app.core.database import create_db_and_tables
+from app.modules.auth.router import router as auth_router
+from app.modules.servers.router import router as servers_router
+from app.modules.guardrails.service import init_and_seed_db
+from app.modules.chat.router import router as chat_router
+
+@asynccontextmanager
+async def lifespan(app: FastAPI):
+    # Create DB tables on startup
+    await create_db_and_tables()
+    # Initialize and seed ChromaDB local vector store
+    await init_and_seed_db()
+    yield
+
+app = FastAPI(
+    title="DevOps-Copilot API",
+    description="An AI-driven DevOps management copilot for bare-metal servers.",
+    version="0.1.0",
+    lifespan=lifespan
+)
+
+app.include_router(auth_router, prefix="/api/v1/auth", tags=["Authentication"])
+app.include_router(servers_router, prefix="/api/v1/servers", tags=["Servers"])
+app.include_router(chat_router, prefix="/api/v1/chat", tags=["Chat & Agent"])
+
+@app.get("/health", tags=["Health"])
+def health_check():
+    return {"status": "ok"}

app/modules/__init__.py

@@ -0,0 +1 @@
+# This makes modules folder a Python package

app/modules/auth/__init__.py

@@ -0,0 +1,9 @@
+from sqlmodel import SQLModel, Field
+from typing import Optional
+
+# user model
+class User(SQLModel, table=True):
+    id: Optional[int] = Field(default=None, primary_key=True)    
+    username: str = Field(index=True, unique=True, nullable=False)
+    hashed_password: str = Field(nullable=False)
+    is_active: bool = Field(default=True)

app/modules/auth/router.py

@@ -0,0 +1,101 @@
+from fastapi import APIRouter, Depends, HTTPException, status
+from fastapi.security import OAuth2PasswordRequestForm
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlmodel import select
+
+from app.core.database import get_session
+from app.modules.auth import User
+from app.modules.auth.schema import UserRegister, UserResponse, Token
+from app.modules.auth.service import (
+    hash_password,
+    verify_password,
+    create_access_token,
+    get_current_user
+)
+
+router = APIRouter()
+
+# Register API
+@router.post("/register", response_model=UserResponse, status_code=status.HTTP_201_CREATED)
+async def register(
+    user_in: UserRegister,
+    session: AsyncSession = Depends(get_session)
+):
+    """
+    Register the Master Administrator account.
+    
+    This is a personal app, meaning registration is strictly restricted and locked down
+    after the first successful registration has occurred.
+    """
+    # check if any user already exists in the database
+    any_user_statement = select(User)
+    any_user_result = await session.exec(any_user_statement)
+    if any_user_result.first() is not None:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Registration is disabled. Admin user already exists."
+        )
+
+    # checking if username is already taken
+    statement = select(User).where(User.username == user_in.username)
+    result = await session.exec(statement)
+    existing_user = result.first()
+    
+    if existing_user:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Username already registered"
+        )
+    
+    # hashing the password and creating a new user object
+    hashed_pw = hash_password(user_in.password)
+    new_user = User(username=user_in.username, hashed_password=hashed_pw)
+    
+    # saving in database (asynchronously)
+    session.add(new_user)
+    await session.commit()
+    await session.refresh(new_user)
+    
+    return new_user
+
+# Token API
+@router.post("/token", response_model=Token)
+async def login(
+    form_data: OAuth2PasswordRequestForm = Depends(),
+    session: AsyncSession = Depends(get_session)
+):
+    """
+    OAuth2-compatible token exchange endpoint.
+    
+    Accepts form data containing username and password, authenticates credentials,
+    and returns a stateless JWT token.
+    """
+    # finding user in database
+    statement = select(User).where(User.username == form_data.username)
+    result = await session.exec(statement)
+    user = result.first()
+    
+    # checking username and password
+    if not user or not verify_password(form_data.password, user.hashed_password):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Incorrect username or password",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+        
+    # creating token for user
+    access_token = create_access_token(data={"sub": user.username})
+    
+    return {"access_token": access_token, "token_type": "bearer"}
+
+# Get User API
+@router.get("/me", response_model=UserResponse)
+async def read_users_me(
+    current_user: User = Depends(get_current_user)
+):
+    """
+    Retrieve currently logged-in administrator profile details.
+    
+    Requires a valid JWT Bearer token in the Authorization header.
+    """
+    return current_user

app/modules/auth/schema.py

@@ -0,0 +1,34 @@
+from pydantic import BaseModel, Field
+
+class UserRegister(BaseModel):
+    """
+    DTO payload containing registration credentials for the single administrator.
+    Enforces pattern restrictions on username and a minimum length of 8 characters for password.
+    """
+    username: str = Field(..., min_length=3, max_length=50, pattern=r"^[a-zA-Z0-9_]*$")
+    password: str = Field(..., min_length=8)
+
+class UserResponse(BaseModel):
+    """
+    Safe database projection of user information (excludes hashed password details).
+    """
+    id: int
+    username: str
+    is_active: bool
+
+    class Config:
+        # Enable ORM attribute resolution mapping
+        from_attributes = True
+
+class Token(BaseModel):
+    """
+    Authentication token response payload containing the JWT string.
+    """
+    access_token: str
+    token_type: str
+
+class TokenData(BaseModel):
+    """
+    Parsed JWT token container payload containing the username claim.
+    """
+    username: str | None = None

app/modules/auth/service.py

@@ -0,0 +1,91 @@
+import bcrypt
+import jwt
+from datetime import datetime, timedelta, timezone
+from fastapi import Depends, HTTPException, status
+from fastapi.security import OAuth2PasswordBearer
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlmodel import select
+
+from app.core.config import settings
+from app.core.database import get_session
+from app.modules.auth import User
+
+
+# authentication
+# 1. Define OAuth2PasswordBearer
+oauth2_scheme = OAuth2PasswordBearer(tokenUrl="api/v1/auth/token")
+
+# 2. Hash password
+def hash_password(password: str) -> str:
+    salt = bcrypt.gensalt()
+    hashed = bcrypt.hashpw(password.encode("utf-8"), salt)
+    return hashed.decode("utf-8")
+
+# 2.1. Verify password
+def verify_password(plain_password: str, hashed_password: str) -> bool:
+    # compare password with hashed password in database
+    return bcrypt.checkpw(
+        plain_password.encode("utf-8"), 
+        hashed_password.encode("utf-8")
+    )
+
+# 3. Create access token
+def create_access_token(data: dict, expires_delta: timedelta | None = None) -> str:
+    to_encode = data.copy()
+    if expires_delta:
+        expire = datetime.now(timezone.utc) + expires_delta
+    else:
+        expire = datetime.now(timezone.utc) + timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES)
+    
+    # 3.1. add exp to token
+    to_encode.update({"exp": expire})
+    
+    # 3.2. encode token
+    encoded_jwt = jwt.encode(
+        to_encode, 
+        settings.JWT_SECRET_KEY, 
+        algorithm=settings.JWT_ALGORITHM
+    )
+    return encoded_jwt
+
+# 4. Authentication
+# We use Depends to get the token from the request and pass it to the function.
+async def get_current_user(
+    token: str = Depends(oauth2_scheme),
+    session: AsyncSession = Depends(get_session)
+) -> User:
+    credentials_exception = HTTPException(
+        status_code=status.HTTP_401_UNAUTHORIZED,
+        detail="Could not validate credentials",
+        headers={"WWW-Authenticate": "Bearer"},
+    )
+    try:
+        # decode token
+        payload = jwt.decode(
+            token, 
+            settings.JWT_SECRET_KEY, 
+            algorithms=[settings.JWT_ALGORITHM]
+        )
+        # get username from token
+        username: str = payload.get("sub")
+        if username is None:
+            raise credentials_exception
+    except jwt.PyJWTError:
+        raise credentials_exception
+
+    # 4.1. find user in database by username
+    statement = select(User).where(User.username == username)
+    result = await session.exec(statement)
+    user = result.first()
+
+    if user is None:
+        raise credentials_exception
+    
+    # 4.2. check if user is active
+    if not user.is_active:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST, 
+            detail="Inactive user"
+        )
+    # return user
+    return user

app/modules/chat/__init__.py

@@ -0,0 +1 @@
+# This makes the chat folder a Python package