devtorch-cli 3.0.1__py3-none-any.whl

devtorch_cli/__init__.py

@@ -0,0 +1 @@
+

devtorch_cli/__main__.py

@@ -0,0 +1,6 @@
+"""Make `python -m devtorch_cli` equivalent to the `devtorch` entry point."""
+
+from devtorch_cli.main import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())

devtorch_cli/audit_cmds.py

@@ -0,0 +1,221 @@
+"""CLI commands for Sprint 30: trust, compliance, and security audit."""
+
+from __future__ import annotations
+
+import argparse
+import datetime
+import json
+import sys
+from pathlib import Path
+
+from devtorch_core.audit import (
+    AuditFilters,
+    AuditService,
+    PrivacyConfig,
+    ExportSigner,
+)
+
+
+def _gcc_dir_from_args(args: argparse.Namespace) -> Path:
+    return Path(args.path).resolve() / ".GCC"
+
+
+def _parse_iso(value: str | None) -> datetime.datetime | None:
+    if not value:
+        return None
+    try:
+        return datetime.datetime.fromisoformat(value)
+    except ValueError:
+        # Allow bare dates (YYYY-MM-DD).
+        try:
+            return datetime.datetime.strptime(value, "%Y-%m-%d")
+        except ValueError:
+            return None
+
+
+def cmd_audit_export(args: argparse.Namespace) -> int:
+    gcc_dir = _gcc_dir_from_args(args)
+    if not gcc_dir.exists():
+        print(f"error: {gcc_dir} not found. Run `devtorch init` first.", file=sys.stderr)
+        return 1
+
+    service = AuditService(gcc_dir)
+    privacy = service.get_privacy_config()
+
+    if args.no_redaction:
+        privacy.redaction_enabled = False
+
+    filters = AuditFilters(
+        since=_parse_iso(args.since),
+        until=_parse_iso(args.until),
+        project=args.project,
+        workspace=args.workspace,
+        user=args.user,
+        event_type=args.event_type,
+        actor=args.actor,
+        limit=args.limit,
+    )
+
+    output_path = Path(args.output).resolve()
+    output_path.parent.mkdir(parents=True, exist_ok=True)
+
+    service = AuditService(gcc_dir)
+    result = service.export(
+        output_path,
+        fmt=args.format,
+        filters=filters,
+        privacy_config=privacy,
+    )
+
+    print(f"Exported {result['event_count']} event(s) to {result['output_path']} ({result['format']}).")
+    return 0
+
+
+def cmd_audit_sign(args: argparse.Namespace) -> int:
+    input_path = Path(args.input).resolve()
+    output_path = Path(args.output).resolve()
+    key_path = Path(args.key).resolve()
+
+    if not input_path.exists():
+        print(f"error: input file not found: {input_path}", file=sys.stderr)
+        return 1
+    if not key_path.exists():
+        print(f"error: private key not found: {key_path}", file=sys.stderr)
+        return 1
+
+    signer = ExportSigner()
+    signer.sign_file(input_path, output_path, key_path)
+    print(f"Signed envelope written to {output_path}")
+    return 0
+
+
+def cmd_audit_verify(args: argparse.Namespace) -> int:
+    envelope_path = Path(args.input).resolve()
+    key_path = Path(args.key).resolve()
+
+    if not envelope_path.exists():
+        print(f"error: envelope file not found: {envelope_path}", file=sys.stderr)
+        return 1
+    if not key_path.exists():
+        print(f"error: public key not found: {key_path}", file=sys.stderr)
+        return 1
+
+    signer = ExportSigner()
+    if signer.verify_file(envelope_path, key_path):
+        print("Signature verification: OK")
+        return 0
+    print("Signature verification: FAILED")
+    return 1
+
+
+def _coerce_bool(value):
+    if isinstance(value, bool):
+        return value
+    if isinstance(value, str):
+        return value.lower() in ("true", "1", "yes", "on")
+    return bool(value)
+
+
+def cmd_audit_privacy(args: argparse.Namespace) -> int:
+    gcc_dir = _gcc_dir_from_args(args)
+    if not gcc_dir.exists():
+        print(f"error: {gcc_dir} not found. Run `devtorch init` first.", file=sys.stderr)
+        return 1
+
+    service = AuditService(gcc_dir)
+    config = service.get_privacy_config()
+
+    updated = False
+    if args.telemetry is not None:
+        config.telemetry_enabled = _coerce_bool(args.telemetry)
+        updated = True
+    if args.prompt_telemetry is not None:
+        config.prompt_telemetry_enabled = _coerce_bool(args.prompt_telemetry)
+        updated = True
+    if args.redaction is not None:
+        config.redaction_enabled = _coerce_bool(args.redaction)
+        updated = True
+    if args.remote_endpoints is not None:
+        config.allow_remote_endpoints = _coerce_bool(args.remote_endpoints)
+        updated = True
+    if args.retention_days is not None:
+        config.retention_days = int(args.retention_days)
+        updated = True
+
+    if updated:
+        from devtorch_core.audit import save_privacy_config
+        save_privacy_config(gcc_dir, config)
+        print("Privacy settings updated.")
+
+    print(json.dumps(config.to_dict(), indent=2))
+    return 0
+
+
+def cmd_audit_keygen(args: argparse.Namespace) -> int:
+    """Generate an Ed25519 key pair for signing audit exports."""
+    output_dir = Path(args.output_dir).resolve()
+    output_dir.mkdir(parents=True, exist_ok=True)
+    private_path = output_dir / args.private_key
+    public_path = output_dir / args.public_key
+
+    signer = ExportSigner()
+    private_pem, public_pem = signer.generate_keypair()
+    signer.save_key(private_path, private_pem)
+    signer.save_key(public_path, public_pem)
+
+    print(f"Generated signing key pair:")
+    print(f"  Private key: {private_path}")
+    print(f"  Public key:  {public_path}")
+    return 0
+
+
+def build_audit_parser(subparsers):
+    audit_parser = subparsers.add_parser("audit", help="Trust, compliance, and security audit tools.")
+    audit_sub = audit_parser.add_subparsers(dest="audit_command", required=True)
+
+    p_export = audit_sub.add_parser("export", help="Export audit events to JSON or PDF.")
+    p_export.add_argument("--format", choices=["json", "pdf"], required=True, help="Export format.")
+    p_export.add_argument("--output", required=True, help="Output file path.")
+    p_export.add_argument("--since", default=None, help="Include events at or after this ISO timestamp.")
+    p_export.add_argument("--until", default=None, help="Include events before this ISO timestamp.")
+    p_export.add_argument("--project", default=None, help="Filter by payload.project.")
+    p_export.add_argument("--workspace", default=None, help="Filter by payload.workspace.")
+    p_export.add_argument("--user", default=None, help="Filter by payload.user.")
+    p_export.add_argument("--event-type", default=None, help="Filter by event_type.")
+    p_export.add_argument("--actor", default=None, help="Filter by actor.")
+    p_export.add_argument("--limit", type=int, default=None, help="Maximum number of events to include.")
+    p_export.add_argument("--no-redaction", action="store_true", help="Disable PII redaction for this export.")
+    p_export.set_defaults(func=cmd_audit_export)
+
+    p_sign = audit_sub.add_parser("sign", help="Sign an exported JSON audit report.")
+    p_sign.add_argument("input", help="Path to exported JSON file.")
+    p_sign.add_argument("--output", required=True, help="Path to write signed envelope.")
+    p_sign.add_argument("--key", required=True, help="Path to Ed25519 private key (PEM).")
+    p_sign.set_defaults(func=cmd_audit_sign)
+
+    p_verify = audit_sub.add_parser("verify", help="Verify a signed audit report envelope.")
+    p_verify.add_argument("input", help="Path to signed envelope.")
+    p_verify.add_argument("--key", required=True, help="Path to Ed25519 public key (PEM).")
+    p_verify.set_defaults(func=cmd_audit_verify)
+
+    p_privacy = audit_sub.add_parser("privacy", help="Show or update privacy policy settings.")
+    p_privacy.add_argument("--telemetry", type=_str_to_bool, default=None, help="Enable/disable telemetry.")
+    p_privacy.add_argument("--prompt-telemetry", type=_str_to_bool, default=None, dest="prompt_telemetry", help="Enable/disable prompt telemetry.")
+    p_privacy.add_argument("--redaction", type=_str_to_bool, default=None, help="Enable/disable PII redaction.")
+    p_privacy.add_argument("--remote-endpoints", type=_str_to_bool, default=None, dest="remote_endpoints", help="Allow remote endpoints.")
+    p_privacy.add_argument("--retention-days", type=int, default=None, dest="retention_days", help="Data retention period in days.")
+    p_privacy.set_defaults(func=cmd_audit_privacy)
+
+    p_keygen = audit_sub.add_parser("keygen", help="Generate an Ed25519 key pair for signing exports.")
+    p_keygen.add_argument("--output-dir", default=".", dest="output_dir", help="Directory for key files.")
+    p_keygen.add_argument("--private-key", default="audit_private.pem", dest="private_key", help="Private key filename.")
+    p_keygen.add_argument("--public-key", default="audit_public.pem", dest="public_key", help="Public key filename.")
+    p_keygen.set_defaults(func=cmd_audit_keygen)
+
+    return audit_parser
+
+
+def _str_to_bool(value: str | None) -> bool | None:
+    if value is None:
+        return None
+    return value.lower() in ("true", "1", "yes", "on")

devtorch_cli/capability_role_cmds.py

@@ -0,0 +1,94 @@
+"""S28 CLI handlers for `devtorch capability role`."""
+
+from __future__ import annotations
+
+import argparse
+import sys
+from pathlib import Path
+from typing import List
+
+from devtorch_core.capability import (
+    AgentRole,
+    CapabilityStore,
+    apply_default_policy,
+)
+
+
+def _store(args: argparse.Namespace) -> CapabilityStore:
+    gcc_dir = Path(args.path).resolve() / ".GCC"
+    return CapabilityStore(gcc_dir / "capabilities")
+
+
+def _split_csv(value: str | None) -> List[str]:
+    if not value:
+        return []
+    return [p.strip() for p in value.split(",") if p.strip()]
+
+
+def cmd_capability_role_list(args: argparse.Namespace) -> int:
+    store = _store(args)
+    role_ids = store.list_roles()
+    if not role_ids:
+        print("No roles defined.")
+        return 0
+    roles = [r for r in (store.load_role(rid) for rid in role_ids) if r is not None]
+    print(f"{'ID':<16} {'Name':<20} {'Allowed':<30} {'Disallowed'}")
+    print("-" * 80)
+    for r in roles:
+        allowed = ", ".join(r.allowed_concepts) or "(any)"
+        disallowed = ", ".join(r.disallowed_concepts) or "(none)"
+        print(f"{r.role_id:<16} {r.name:<20} {allowed:<30} {disallowed}")
+    return 0
+
+
+def cmd_capability_role_show(args: argparse.Namespace) -> int:
+    store = _store(args)
+    role = store.load_role(args.role_id)
+    if role is None:
+        print(f"error: role '{args.role_id}' not found", file=sys.stderr)
+        return 1
+    print(f"Role {role.role_id}: {role.name}")
+    print(f"  allowed_concepts: {role.allowed_concepts or '(any)'}")
+    print(f"  disallowed_concepts: {role.disallowed_concepts or '(none)'}")
+    print(f"  required_capabilities: {role.required_capabilities}")
+    print(f"  max_temperature: {role.max_temperature}")
+    return 0
+
+
+def cmd_capability_role_set(args: argparse.Namespace) -> int:
+    store = _store(args)
+    role = AgentRole(
+        role_id=args.role_id,
+        name=args.name or args.role_id,
+        allowed_concepts=_split_csv(args.allowed),
+        disallowed_concepts=_split_csv(args.disallowed),
+        required_capabilities=_split_csv(args.required),
+        max_temperature=args.max_temperature,
+    )
+    store.save_role(role)
+    print(f"Saved role {role.role_id}: {role.name}")
+    return 0
+
+
+def cmd_capability_role_policy(args: argparse.Namespace) -> int:
+    store = _store(args)
+    policy = store.load_policy()
+    if policy is None:
+        print("No role policy defined.")
+        return 0
+    print(f"Default role: {policy.default_role}")
+    print("Roles:")
+    for r in policy.roles:
+        print(f"  - {r.role_id}: {r.name}")
+    return 0
+
+
+def cmd_capability_role_apply_default_policy(args: argparse.Namespace) -> int:
+    store = _store(args)
+    apply_default_policy(store)
+    policy = store.load_policy()
+    print("Applied default role policy.")
+    if policy:
+        print(f"  default_role: {policy.default_role}")
+        print(f"  roles: {', '.join(r.role_id for r in policy.roles)}")
+    return 0