devopsiq 0.1.0__py3-none-any.whl

devopsiq-0.1.0.dist-info/RECORD

@@ -0,0 +1,30 @@
+main.py,sha256=ElfwUD8_Cfg8Te9izRE9znkL81-BhOuKQXR4_DbJd30,11005
+agent/__init__.py,sha256=uWlx2x4nHSQULNQQOSY9wqlLqzew7jfBJ4960Idkt7A,169
+agent/agent.py,sha256=RX_I5Ddn709umA0uXYm8BtdEi5boPwa2fjSOVxEqtKI,9299
+agent/investigation.py,sha256=M3xZNHik94bAKVa3outHci4pzrZE9N5s8z7SL7gtjnk,12807
+agent/prompts.py,sha256=KsGYBgXCasRDnWJGKXFRtazhE8_LyezY9Z590eiK6t4,7301
+agent/store.py,sha256=H6gGWtPR6EMhUBxMf9iPM6smbOigXY488qeo350Demw,5546
+devopsiq-0.1.0.dist-info/licenses/LICENSE,sha256=gHfBJB-YkdlM5hAqg_hdC_j64O3l3G8WyvrwRU1nzys,1068
+tools/__init__.py,sha256=nhGjvOeA4il34iatfdGy-OO2wgcoMSV3mfCDysTJGHg,214
+tools/ansible.py,sha256=jTUdf-nHF1z9Iuz5NG3DAwODGEnB3-EWqt15etYP4Bc,3886
+tools/argocd.py,sha256=pW9r0E5KtyUAtOBmRNBrDn9wv_k7LOLd8HJ32cIngVs,2917
+tools/base.py,sha256=nWBUmtITDDTWAeiSgsJyyqqK9MIT765miM-l8VPFtjs,3919
+tools/cloud.py,sha256=GNzY1RIEyecyhuuLxADDI73CxWCY9J0Be_TRXPP-6Hg,3709
+tools/docker.py,sha256=Hl668TWTz8qENc5KR0K3-E7GWJlBi9lg5lwZ45sHm9U,9322
+tools/git_ci.py,sha256=u48R7wK9QN8-j4AIabn87bw1OzmTYT6BnNBOuCcNYhU,8306
+tools/helm.py,sha256=gPDnTdGSB9Ic_6GCx7P7roRpvQprrkkF87Lj3y7tDHs,5395
+tools/investigation.py,sha256=zdaY20kGc_6fh47mVk_AdPey8WKNlzmkBTWGfKQZers,12013
+tools/istio.py,sha256=UYWLXkSuaqjSekchm6s5gbmNL6tpMftmoQdHKIC2OSQ,1517
+tools/kubernetes.py,sha256=zFSHMmFL7pZqQwd4ZQeHy3Zlo0eTgg9Ba_zJ29FEy1Y,15689
+tools/monitoring.py,sha256=OPiRyZYlyKkpzXbNkYJuqiD73Df5PmrWG2b-K_-208E,5720
+tools/newrelic.py,sha256=qCXUm7yiS-hbNQ72TavWeL1Y9SNYq__rvhHXCjvafSQ,5721
+tools/preflight.py,sha256=qhfwur8bbMskvr4IZE8rMx86WLuOILyTO-XVTTlIsfY,2079
+tools/registry.py,sha256=MVYnUYRuGZqJ0Hrod2nFnYmI2YBFfjSMclv7jU87JGg,1798
+tools/system.py,sha256=XF6TO08BYC5p818ZAI5LtfqyhaFRu2RArpKksD47S3c,5252
+tools/terraform.py,sha256=kn52U4xiVB7ZbVQtrHCgVwb4SEanUFmgeOZmvsgJC0Q,3244
+tools/trivy.py,sha256=znSzYqey78oWDDHKj0xO4NA_6xUQzq6Je2pu0_lso58,3002
+devopsiq-0.1.0.dist-info/METADATA,sha256=L9HbVeWkRPlEJaxwaqRKR92f3kioFKQ5vI76r2EpboY,38422
+devopsiq-0.1.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+devopsiq-0.1.0.dist-info/entry_points.txt,sha256=71bCZyu1h4f7oK5rvqaW_Ah6uQRceRaGlWphcXNaDZw,39
+devopsiq-0.1.0.dist-info/top_level.txt,sha256=V_H1jV8TvkW5zy_1ZYtspiHgwqRs8shfUc-mMz5Abp0,17
+devopsiq-0.1.0.dist-info/RECORD,,

devopsiq-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

devopsiq-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+devopsiq = main:main

devopsiq-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DevOpsAbhii
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

devopsiq-0.1.0.dist-info/top_level.txt

@@ -0,0 +1,3 @@
+agent
+main
+tools

main.py

@@ -0,0 +1,310 @@
+"""The DevOps investigation agent.
+
+Two modes of use:
+
+REPL (default):
+    python main.py
+
+One-shot (for cron / CI / scripts):
+    python main.py "why is api-5d6f crash-looping?"
+    python main.py --json "why is api-5d6f crash-looping?"   # structured report
+    python main.py --resume --json "any update?"             # continue prior run
+    python main.py --store-dir DIR --out report.json "..."   # pipeline paths
+
+One-shot mode sends the problem once, prints the agent's report, and exits
+with a status code (0 = completed, 1 = setup/API error). With --json the
+output is the tracked investigation as JSON (see agent/investigation.py:
+render_report_json) instead of the markdown report, so a pipeline can act
+on the verdict. --out additionally writes that JSON to an exact path.
+Phase 7: the investigation record is auto-saved on every change
+(~/.devops-ai-agent/investigations/ by default) and survives CLI exits; the
+REPL resumes the newest in-progress record at startup. Slash commands work
+in both modes (/investigate, /investigations, /report, ...). Read-only:
+nothing here ever mutates a real system.
+
+Type `exit` (or `quit`, or Ctrl-D / Ctrl-C) to leave the REPL.
+"""
+
+import json
+import sys
+from pathlib import Path
+from typing import NamedTuple
+
+from dotenv import load_dotenv
+from openai import (
+    APIError,
+    APIConnectionError,
+    APITimeoutError,
+    APIStatusError,
+    AuthenticationError,
+    RateLimitError,
+)
+
+from agent.agent import DevOpsAgent
+
+EXIT_WORDS = {"exit", "quit"}
+
+# Slash commands that operate on the investigation record, plus short aliases.
+COMMAND_ALIASES = {
+    "/investigate": "/investigate",
+    "/inv": "/investigate",
+    "/investigation": "/investigation",
+    "/status": "/investigation",
+    "/investigations": "/investigations",
+    "/history": "/investigations",
+    "/report": "/report",
+    "/endinvestigation": "/endinvestigation",
+    "/end": "/endinvestigation",
+}
+
+
+def handle_command(text: str, agent: DevOpsAgent) -> str | None:
+    """Handle a slash command; return the text to print, or None to continue.
+
+    Command lines are detected by main() and routed here without ever
+    reaching the model. All commands are read-only with respect to real
+    systems: they only inspect or clear the agent's in-memory record (and,
+    for /investigations, list the saved copies on disk).
+    """
+    cmd, _, rest = text.partition(" ")
+    canonical = COMMAND_ALIASES.get(cmd.lower())
+
+    if canonical == "/investigate":
+        problem = rest.strip()
+        if not problem:
+            return "Usage: /investigate <one-line problem statement>"
+        return agent.begin_investigation(problem)
+    if canonical == "/investigation":
+        return agent.investigation_status_text() or "(no active investigation)"
+    if canonical == "/investigations":
+        return agent.list_investigations() or "(no saved investigations yet)"
+    if canonical == "/report":
+        return agent.investigation_report_text() or "(no investigation recorded)"
+    if canonical == "/endinvestigation":
+        return agent.end_investigation()
+    return (f"unknown command: {cmd}. Try /investigate <problem>, "
+            "/investigation, /investigations, /report, /endinvestigation")
+
+
+class OneShotArgs(NamedTuple):
+    """Parsed one-shot CLI arguments (task=None means "run the REPL")."""
+
+    task: str | None
+    as_json: bool
+    store_dir: str | None  # --store-dir PATH (persistence override)
+    resume: bool           # --resume (continue the newest in-progress record)
+    out: str | None        # --out PATH (also write the JSON report there)
+
+
+_VALUE_FLAGS = ("--store-dir", "--out")
+
+
+def _flag_value(argv: list[str], flag: str) -> str | None:
+    """Value of `flag <value>` in argv, or None when absent/missing."""
+    for i, arg in enumerate(argv):
+        if arg == flag and i + 1 < len(argv):
+            return argv[i + 1]
+    return None
+
+
+def parse_args(argv: list[str]) -> OneShotArgs:
+    """Split one-shot CLI args.
+
+    task=None means "run the REPL". A bare task is any positional text;
+    --json switches the one-shot output from markdown to the structured JSON
+    report; --resume continues the newest in-progress record from the store;
+    --store-dir PATH overrides the persistence directory for this run; --out
+    PATH additionally writes the JSON report to an exact path. Example:
+    `python main.py --json --out r.json "why is it down?"` ->
+    ("why is it down?", True, None, False, "r.json").
+    """
+    as_json = "--json" in argv
+    do_resume = "--resume" in argv
+    store_dir = _flag_value(argv, "--store-dir")
+    out = _flag_value(argv, "--out")
+    positionals: list[str] = []
+    skip_next = False
+    for arg in argv:
+        if skip_next:
+            skip_next = False
+            continue
+        if arg in _VALUE_FLAGS:
+            skip_next = True  # its value was captured by _flag_value
+            continue
+        if arg in ("--json", "--resume"):
+            continue
+        positionals.append(arg)
+    text = " ".join(positionals).strip()
+    if not positionals or not text:
+        return OneShotArgs(None, as_json, store_dir, do_resume, out)
+    return OneShotArgs(text, as_json, store_dir, do_resume, out)
+
+
+def run_one_shot(
+    task: str,
+    as_json: bool = False,
+    agent: DevOpsAgent | None = None,
+    store_dir: str | None = None,
+    resume: bool = False,
+    out: str | None = None,
+) -> int:
+    """Non-interactive single run: send `task`, print the result, exit cleanly.
+
+    Exit code 1 on setup/API errors. With as_json (or out), the printed /
+    written output is the tracked investigation as JSON; if the model never
+    opened an investigation this is a hard failure (exit 1) — a caller asked
+    for a report and there is none to give. The record is auto-saved on every
+    mutation regardless; store_dir points persistence somewhere else for this
+    run, resume continues the newest in-progress record before asking, and
+    out additionally writes the JSON report to an exact path. `agent` lets
+    embedders reuse a configured agent (also the test seam); default builds a
+    fresh one from the environment.
+    """
+    if agent is None:
+        try:
+            agent = DevOpsAgent()
+        except ValueError as exc:
+            print(f"[setup] {exc}", file=sys.stderr)
+            return 1
+
+    if store_dir is not None:
+        agent.use_store_dir(store_dir)
+    if resume:
+        agent.resume_investigation()
+
+    if task.startswith("/"):
+        print(handle_command(task, agent))
+        return 0
+
+    try:
+        reply = agent.ask(task)
+    except ValueError as exc:
+        print(f"[input] {exc}", file=sys.stderr)
+        return 1
+    except Exception as exc:  # noqa: BLE001 — same top-level safety net as the REPL
+        print(f"[error] {describe_error(exc)}", file=sys.stderr)
+        return 1
+
+    if as_json or out is not None:
+        report = agent.investigation_report_json()
+        if report is None:
+            print(
+                "[error] --json/--out requested but the run recorded no "
+                "investigation",
+                file=sys.stderr,
+            )
+            return 1
+        rendered = json.dumps(report, indent=2, ensure_ascii=False)
+        if out is not None:
+            try:
+                Path(out).write_text(rendered + "\n", encoding="utf-8")
+            except OSError as exc:
+                print(f"[error] could not write --out {out}: {exc}",
+                      file=sys.stderr)
+                return 1
+        if as_json:
+            print(rendered)
+            return 0
+    print(reply)
+    return 0
+
+
+def describe_error(exc: Exception) -> str:
+    """Map common SDK/API failures to short, safe messages (never leaks keys)."""
+    if isinstance(exc, AuthenticationError):
+        return (
+            "The API key was rejected (HTTP 401). Check that OPENROUTER_API_KEY "
+            "in .env is correct and still valid."
+        )
+    if isinstance(exc, RateLimitError):
+        return "Rate limit hit — OpenRouter is throttling requests. Wait and retry."
+    if isinstance(exc, APITimeoutError):
+        return "The request to OpenRouter timed out. Check your network and retry."
+    if isinstance(exc, APIConnectionError):
+        return (
+            "Could not reach the OpenRouter API. Check your internet connection "
+            "and that the base URL is correct."
+        )
+    if isinstance(exc, APIStatusError):
+        return f"The OpenRouter API returned an error (HTTP {exc.status_code})."
+    if isinstance(exc, APIError):
+        return "The API returned an unexpected error."
+    return f"Unexpected error: {type(exc).__name__}"
+
+
+def main() -> int:
+    # Load .env (never overrides variables already set in the shell).
+    load_dotenv()
+
+    # One-shot mode: `python main.py [flags] <problem or /command>`.
+    args = parse_args(sys.argv[1:])
+    if args.task is not None:
+        return run_one_shot(
+            args.task,
+            as_json=args.as_json,
+            store_dir=args.store_dir,
+            resume=args.resume,
+            out=args.out,
+        )
+
+    try:
+        agent = DevOpsAgent()
+    except ValueError as exc:
+        print(f"[setup] {exc}", file=sys.stderr)
+        return 1
+
+    tool_names = ", ".join(sorted(tool.name for tool in agent.tools)) or "none"
+
+    print("DevOps AI Agent (Phase 9 — 58 read-only tools, persistent investigations)")
+    print(f"Model:   {agent.model}")
+    print(f"Backend: {agent.base_url}")
+    print(f"Store:   {agent.store_dir or '(persistence off)'}")
+    print(f"Tools:   {tool_names}")
+    print("Commands: /investigate <problem>, /investigation, /investigations, "
+          "/report, /endinvestigation")
+    print("One-shot: python main.py [--json] [--resume] [--out report.json] "
+          "[--store-dir DIR] \"<problem>\"")
+    print("Type 'exit' to quit.")
+    print()
+
+    # Phase 7: pick up the newest in-progress record so a previous session's
+    # work is not lost (fresh investigations start with /investigate as usual).
+    resumed = agent.resume_investigation()
+    if resumed:
+        print(resumed)
+        print()
+
+    while True:
+        try:
+            raw = input("You: ")
+        except (EOFError, KeyboardInterrupt):
+            print("\nBye.")
+            return 0
+
+        text = raw.strip()
+        if not text:
+            print("(Enter a message, or type 'exit' to quit.)")
+            continue
+        if text.lower() in EXIT_WORDS:
+            print("Bye.")
+            return 0
+        if text.startswith("/"):
+            print(handle_command(text, agent))
+            print()
+            continue
+
+        try:
+            reply = agent.ask(text)
+        except ValueError as exc:
+            print(f"[input] {exc}")
+            continue
+        except Exception as exc:  # noqa: BLE001 — top-level safety net
+            print(f"[error] {describe_error(exc)}")
+            continue
+
+        print(f"Agent: {reply}")
+        print()
+
+
+if __name__ == "__main__":
+    sys.exit(main())

tools/__init__.py

@@ -0,0 +1,6 @@
+"""Tools package.
+
+Phase 2: each tool module self-registers into tools/registry.py via
+register(Tool). All tools are read-only by construction — they gather
+evidence and return text; nothing may mutate state.
+"""

tools/ansible.py

@@ -0,0 +1,110 @@
+"""Read-only Ansible tools (Phase 8).
+
+Two inventory/playbook inspection tools: `ansible-inventory --list` (see the
+hosts and groups an inventory resolves to) and `ansible-playbook --list-tasks
+--list-hosts` (see what a playbook WOULD do, without doing it). Both are pure
+listing modes — they connect to no managed host and change nothing.
+
+Safety model:
+- Only fixed argv templates with the --list / --list-tasks / --list-hosts
+  modes exist. There is no playbook-execution path: no run, no syntax-check
+  with extra vars, no ad-hoc `ansible` module invocations.
+- Arguments are path-shaped, so they are validated as RELATIVE paths: no
+  leading '/', no leading '-', no '..' segment (no traversal), no '/'. (a
+  slash could smuggle a second path element; inventory/playbook names are
+  meant to resolve against the working directory or ansible.cfg).
+- ansible / ansible-inventory must be installed; if absent, the exact error
+  is returned — nothing is invented.
+"""
+
+import re
+
+from tools.base import Tool, ToolError, read_command_output
+from tools.registry import register
+
+_TIMEOUT_S = 15
+
+# Relative, dash-free, traversal-free path fragment the CLIs receive.
+_SAFE_PATH_RE = re.compile(r"[A-Za-z0-9][A-Za-z0-9._+\-]{0,200}")
+
+
+def _checked_path(value, kind: str) -> str:
+    if (
+        not isinstance(value, str)
+        or not _SAFE_PATH_RE.fullmatch(value)
+        or ".." in value
+    ):
+        raise ToolError(
+            f"invalid {kind} {value!r}: expected a relative path fragment "
+            "(no '/', no leading '-', no '..') resolving in the working "
+            "directory or ansible.cfg"
+        )
+    return value
+
+
+def _ansible_inventory(args: dict) -> str:
+    inventory = args.get("inventory")
+    argv = ["ansible-inventory"]
+    if inventory is not None:
+        argv += ["--inventory", _checked_path(inventory, "inventory")]
+    argv += ["--list"]
+    return read_command_output(tuple(argv), timeout=_TIMEOUT_S)
+
+
+def _ansible_playbook_tasks(args: dict) -> str:
+    playbook = _checked_path(args.get("playbook"), "playbook")
+    return read_command_output(
+        ("ansible-playbook", "--list-tasks", "--list-hosts", playbook),
+        timeout=_TIMEOUT_S,
+    )
+
+
+ANSIBLE_INVENTORY = Tool(
+    name="ansible_inventory",
+    description=(
+        "Dump the resolved Ansible inventory as JSON (ansible-inventory "
+        "--list): groups, hosts, hostvars. Use to answer 'which hosts does "
+        "this inventory actually target' before/during an incident, or to "
+        "find the right host for a hypothesis. Without 'inventory' it uses "
+        "the ansible.cfg / default inventory of the working directory. "
+        "Read-only."
+    ),
+    parameters={
+        "type": "object",
+        "properties": {
+            "inventory": {
+                "type": "string",
+                "description": "Optional inventory source (file or group "
+                "name relative to the working directory).",
+            }
+        },
+        "additionalProperties": False,
+    },
+    executor=_ansible_inventory,
+)
+
+ANSIBLE_PLAYBOOK_TASKS = Tool(
+    name="ansible_playbook_tasks",
+    description=(
+        "List the tasks and target hosts of a playbook (ansible-playbook "
+        "--list-tasks --list-hosts) WITHOUT running it. Use to see what a "
+        "deploy playbook would change, or to map a failing host back to the "
+        "task that touches it. Read-only; connects to no host."
+    ),
+    parameters={
+        "type": "object",
+        "properties": {
+            "playbook": {
+                "type": "string",
+                "description": "Playbook file, relative to the working "
+                "directory (e.g. site.yml).",
+            }
+        },
+        "required": ["playbook"],
+        "additionalProperties": False,
+    },
+    executor=_ansible_playbook_tasks,
+)
+
+register(ANSIBLE_INVENTORY)
+register(ANSIBLE_PLAYBOOK_TASKS)

tools/argocd.py

@@ -0,0 +1,91 @@
+"""Read-only Argo CD tools (Phase 9).
+
+Two tools over the argocd CLI: list Applications (argocd app list) and one
+Application's full status (argocd app get). GitOps health questions — "is
+the cluster in sync with git", "why is my app degraded/out-of-sync" — start
+here.
+
+Safety model:
+- Only fixed argv templates with the list/get verbs exist. There is no app
+  create, sync, rollback, terminate-op, delete, or repo path — argocd's
+  mutating side is unreachable by construction.
+- Application names are validated (DNS-style, like Kubernetes objects)
+  before reaching argocd — blocks flag injection.
+- The CLI must be installed AND logged in (`argocd login`); otherwise the
+  exact CLI error is returned — nothing is invented.
+"""
+
+import re
+
+from tools.base import Tool, ToolError, read_command_output
+from tools.registry import register
+
+_NAME_RE = re.compile(r"[a-z0-9](?:[-a-z0-9.]{0,251}[a-z0-9])?")
+_TIMEOUT_S = 15
+
+
+def _check_name(value, kind: str) -> str:
+    if (
+        not isinstance(value, str)
+        or len(value) > 253
+        or not _NAME_RE.fullmatch(value)
+    ):
+        raise ToolError(
+            f"invalid Argo CD {kind} name {value!r}: expected lowercase "
+            "letters, digits, '-' or '.', max 253 characters"
+        )
+    return value
+
+
+def _argocd_apps(args: dict) -> str:
+    return read_command_output(
+        ("argocd", "app", "list", "--output", "json"),
+        timeout=_TIMEOUT_S,
+    )
+
+
+def _argocd_app_status(args: dict) -> str:
+    app = _check_name(args.get("app"), "application")
+    return read_command_output(
+        ("argocd", "app", "get", app),
+        timeout=_TIMEOUT_S,
+    )
+
+
+ARGOCD_APPS = Tool(
+    name="argocd_apps",
+    description=(
+        "List Argo CD Applications as JSON (argocd app list): name, sync "
+        "status (Synced/OutOfSync), health (Healthy/Degraded/Progressing), "
+        "target/destination, git revision. Use for GitOps questions — 'is "
+        "the cluster in sync with git', 'which apps are degraded'. "
+        "Requires the argocd CLI installed and logged in. Read-only."
+    ),
+    parameters={"type": "object", "properties": {}, "additionalProperties": False},
+    executor=_argocd_apps,
+)
+
+ARGOCD_APP_STATUS = Tool(
+    name="argocd_app_status",
+    description=(
+        "One Argo CD Application's detail (argocd app get): sync and health "
+        "status per resource, the git revision deployed, conditions, and "
+        "recent operations. Use with argocd_apps to explain 'why is this "
+        "app OutOfSync/Degraded'. Read-only."
+    ),
+    parameters={
+        "type": "object",
+        "properties": {
+            "app": {
+                "type": "string",
+                "description": "Application name.",
+            }
+        },
+        "required": ["app"],
+        "additionalProperties": False,
+    },
+    executor=_argocd_app_status,
+)
+
+register(ARGOCD_APPS)
+register(ARGOCD_APP_STATUS)