dmint-cli 0.1.0__tar.gz → 0.2.0__tar.gz

dmint_cli-0.2.0/MANIFEST.in

@@ -0,0 +1 @@
+recursive-include src/dmint_cli/prompts *.md

dmint_cli-0.2.0/PKG-INFO

@@ -0,0 +1,97 @@
+Metadata-Version: 2.4
+Name: dmint-cli
+Version: 0.2.0
+Summary: CLI tooling for Dmint policy creation, compilation, and management
+License-Expression: Apache-2.0
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: dmint<0.2.0,>=0.1.0
+Dynamic: license-file
+
+# dmint-cli (v0.2.0)
+
+> **Developer tooling for interactive creation, compilation, and validation of Dmint security policies.**
+
+`dmint-cli` provides command-line utilities for discovering tools via static AST analysis, interactive multi-turn policy authoring via LLM model selection and clarification loops, and deterministic schema/semantic policy verification (`policy.json`).
+
+```text
+access.md (Human Security Intent)
+       ↓
+dmint create-policy (Multi-turn Wizard & Model Discovery)
+       ↓
+Self-Correcting LLM Loop (clarification_needed / policy_ready)
+       ↓
+Dmint Core Validation (Policy.from_mapping)
+       ↓
+dmint verify-policy (Pure Deterministic Verification)
+       ↓
+policy.json (Authoritative Policy)
+```
+
+> **Note:** The CLI helps developers *author* and *validate* policies during development. `dmint` core remains the sole trusted runtime authorization engine.
+
+---
+
+## Installation
+
+```bash
+pip install dmint-cli
+```
+
+---
+
+## CLI Commands
+
+### 1. Interactive Policy Wizard (`dmint create-policy`)
+
+Interactive, multi-turn wizard to create and validate a Dmint policy:
+- Interactive provider and model discovery (`list_models`).
+- AST-based static tool discovery via `--tools` parameter.
+- Multi-turn envelope output contract (`clarification_needed` & `policy_ready`).
+- Self-correcting validation retry loop on `PolicyError`.
+- Atomic file write and immediate verification.
+
+```bash
+dmint create-policy -f access.md -o policy.json --tools my_tools.py
+```
+
+### 2. Standalone Policy Verification (`dmint verify-policy`)
+
+Pure, deterministic schema and semantic validation of `policy.json` without LLM involvement. Returns exit code `0` on success or non-zero on validation failure:
+
+```bash
+dmint verify-policy policy.json
+# or
+dmint verify-policy -f policy.json
+```
+
+---
+
+## Environment Configuration
+
+Set API credentials via environment variables for LLM policy compilation:
+
+```bash
+export OPENAI_API_KEY="sk-..."
+# Optional custom providers (openai, gemini, groq, openrouter, ollama)
+export GEMINI_API_KEY="..."
+export GROQ_API_KEY="..."
+```
+
+---
+
+## Testing
+
+Run the CLI test suite:
+
+```bash
+python3 -m unittest discover -s tests -p "test_*.py"
+```
+
+---
+
+## License
+
+Licensed under the [Apache License, Version 2.0](LICENSE).
+See the [`LICENSE`](LICENSE) file for the complete license text.

dmint_cli-0.2.0/README.md

@@ -0,0 +1,86 @@
+# dmint-cli (v0.2.0)
+
+> **Developer tooling for interactive creation, compilation, and validation of Dmint security policies.**
+
+`dmint-cli` provides command-line utilities for discovering tools via static AST analysis, interactive multi-turn policy authoring via LLM model selection and clarification loops, and deterministic schema/semantic policy verification (`policy.json`).
+
+```text
+access.md (Human Security Intent)
+       ↓
+dmint create-policy (Multi-turn Wizard & Model Discovery)
+       ↓
+Self-Correcting LLM Loop (clarification_needed / policy_ready)
+       ↓
+Dmint Core Validation (Policy.from_mapping)
+       ↓
+dmint verify-policy (Pure Deterministic Verification)
+       ↓
+policy.json (Authoritative Policy)
+```
+
+> **Note:** The CLI helps developers *author* and *validate* policies during development. `dmint` core remains the sole trusted runtime authorization engine.
+
+---
+
+## Installation
+
+```bash
+pip install dmint-cli
+```
+
+---
+
+## CLI Commands
+
+### 1. Interactive Policy Wizard (`dmint create-policy`)
+
+Interactive, multi-turn wizard to create and validate a Dmint policy:
+- Interactive provider and model discovery (`list_models`).
+- AST-based static tool discovery via `--tools` parameter.
+- Multi-turn envelope output contract (`clarification_needed` & `policy_ready`).
+- Self-correcting validation retry loop on `PolicyError`.
+- Atomic file write and immediate verification.
+
+```bash
+dmint create-policy -f access.md -o policy.json --tools my_tools.py
+```
+
+### 2. Standalone Policy Verification (`dmint verify-policy`)
+
+Pure, deterministic schema and semantic validation of `policy.json` without LLM involvement. Returns exit code `0` on success or non-zero on validation failure:
+
+```bash
+dmint verify-policy policy.json
+# or
+dmint verify-policy -f policy.json
+```
+
+---
+
+## Environment Configuration
+
+Set API credentials via environment variables for LLM policy compilation:
+
+```bash
+export OPENAI_API_KEY="sk-..."
+# Optional custom providers (openai, gemini, groq, openrouter, ollama)
+export GEMINI_API_KEY="..."
+export GROQ_API_KEY="..."
+```
+
+---
+
+## Testing
+
+Run the CLI test suite:
+
+```bash
+python3 -m unittest discover -s tests -p "test_*.py"
+```
+
+---
+
+## License
+
+Licensed under the [Apache License, Version 2.0](LICENSE).
+See the [`LICENSE`](LICENSE) file for the complete license text.

{dmint_cli-0.1.0 → dmint_cli-0.2.0}/pyproject.toml

@@ -4,16 +4,19 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "dmint-cli"
-version = "0.1.0"
+version = "0.2.0"
 description = "CLI tooling for Dmint policy creation, compilation, and management"
 license = "Apache-2.0"
 requires-python = ">=3.10"
 readme = "README.md"
 dependencies = [
     "dmint>=0.1.0,<0.2.0",
-    "dmint-skills>=0.1.0,<0.2.0",
 ]
 
+[tool.setuptools.package-data]
+"dmint_cli" = ["prompts/*.md"]
+"dmint_cli.prompts" = ["*.md"]
+
 [project.scripts]
 dmint = "dmint_cli.__main__:main"
 

{dmint_cli-0.1.0 → dmint_cli-0.2.0}/src/dmint_cli/__main__.py

@@ -7,13 +7,14 @@ import sys
 
 from dmint_cli.compile_policy import main_compile
 from dmint_cli.create_policy import main_create
+from dmint_cli.verify_policy import main_verify
 
 
 def main(args: list[str] | None = None) -> int:
     if args is None:
         args = sys.argv[1:]
 
-    # Normalize subcommands like "create policy" -> "create-policy" and "compile policy" -> "compile-policy"
+    # Normalize two-word subcommands: "create policy" -> "create-policy", "verify policy" -> "verify-policy", etc.
     normalized_args: list[str] = []
     i = 0
     while i < len(args):
@@ -22,6 +23,10 @@ def main(args: list[str] | None = None) -> int:
             normalized_args.append("create-policy")
             i += 2
             continue
+        if arg == "verify" and i + 1 < len(args) and args[i + 1] == "policy":
+            normalized_args.append("verify-policy")
+            i += 2
+            continue
         if arg == "compile" and i + 1 < len(args) and args[i + 1] == "policy":
             normalized_args.append("compile-policy")
             i += 2
@@ -36,13 +41,18 @@ def main(args: list[str] | None = None) -> int:
     subparsers = parser.add_subparsers(dest="command", help="Command to run")
 
     subparsers.add_parser(
-        "compile-policy",
-        help="Compile natural language policy requirements into a validated policy.json file",
+        "create-policy",
+        help="Interactive wizard to create and validate Dmint policy files",
         add_help=False,
     )
     subparsers.add_parser(
-        "create-policy",
-        help="Interactive wizard to discover tools, ask security questions, and create policy files",
+        "verify-policy",
+        help="Verify a policy.json file against Dmint schema and semantic invariants",
+        add_help=False,
+    )
+    subparsers.add_parser(
+        "compile-policy",
+        help="Compile natural language policy requirements into a validated policy.json file",
         add_help=False,
     )
 
@@ -53,10 +63,12 @@ def main(args: list[str] | None = None) -> int:
     cmd = normalized_args[0]
     cmd_args = normalized_args[1:]
 
-    if cmd == "compile-policy":
-        return main_compile(cmd_args)
-    elif cmd == "create-policy":
+    if cmd == "create-policy":
         return main_create(cmd_args)
+    elif cmd == "verify-policy":
+        return main_verify(cmd_args)
+    elif cmd == "compile-policy":
+        return main_compile(cmd_args)
     else:
         parser.print_help()
         return 2

{dmint_cli-0.1.0 → dmint_cli-0.2.0}/src/dmint_cli/api.py

@@ -154,6 +154,56 @@ class OpenAICompatClient:
 
         return extract_json_text(content)
 
+    def list_models(self) -> list[str]:
+        """Call GET {base_url}/models and return a list of available model IDs."""
+        endpoint = f"{self.base_url}/models"
+        headers = {
+            "User-Agent": "dmint-policy-author/0.1.0",
+        }
+        if self.api_key:
+            headers["Authorization"] = f"Bearer {self.api_key}"
+
+        req = urllib.request.Request(
+            endpoint,
+            headers=headers,
+            method="GET",
+        )
+
+        try:
+            with urllib.request.urlopen(req, timeout=self.timeout) as resp:
+                resp_bytes = resp.read()
+                try:
+                    resp_data = json.loads(resp_bytes.decode("utf-8"))
+                except Exception as exc:
+                    raise RuntimeError("API response is not valid JSON") from exc
+        except urllib.error.HTTPError as exc:
+            try:
+                error_body = exc.read().decode("utf-8", errors="ignore")
+                error_json = json.loads(error_body)
+                msg = error_json.get("error", {}).get("message", error_body)
+            except Exception:
+                msg = f"HTTP Error {exc.code}"
+            masked_key = mask_secret(self.api_key)
+            raise RuntimeError(f"OpenAI-compatible API HTTP {exc.code}: {msg} (key: {masked_key})") from exc
+        except urllib.error.URLError as exc:
+            raise RuntimeError(f"API connection failed ({self.base_url}): {exc.reason}") from exc
+        except Exception as exc:
+            raise RuntimeError(f"API request failed: {exc}") from exc
+
+        data = resp_data.get("data")
+        if not isinstance(data, list):
+            raise RuntimeError("API response missing 'data' array in models response")
+
+        models: list[str] = []
+        for item in data:
+            if isinstance(item, dict) and "id" in item and isinstance(item["id"], str):
+                models.append(item["id"])
+
+        if not models:
+            raise RuntimeError("No model IDs found in /models response")
+
+        return models
+
 
 def extract_json_text(text: str) -> str:
     """Extract clean JSON text, removing markdown code fences if present."""

{dmint_cli-0.1.0 → dmint_cli-0.2.0}/src/dmint_cli/compile_policy.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import argparse
+import importlib.resources
 import json
 import os
 import sys
@@ -11,7 +12,6 @@ from pathlib import Path
 
 from dmint.policy import Policy, PolicyError
 from dmint_cli.api import OpenAICompatClient, mask_secret
-from dmint_skills.skill import DMINT_POLICY_SYSTEM_PROMPT
 
 
 class CLIError(Exception):
@@ -47,6 +47,15 @@ class OutputWriteError(CLIError):
         super().__init__(message, exit_code=7)
 
 
+def load_system_prompt() -> str:
+    """Load system prompt from bundled resource file."""
+    try:
+        return importlib.resources.files("dmint_cli.prompts").joinpath("policy_skill.md").read_text(encoding="utf-8")
+    except Exception:
+        prompt_path = Path(__file__).parent / "prompts" / "policy_skill.md"
+        return prompt_path.read_text(encoding="utf-8")
+
+
 def atomic_write_json(output_path: Path, data: dict) -> None:
     """Atomically write JSON to destination using temp file replace to prevent partial writes."""
     output_path.parent.mkdir(parents=True, exist_ok=True)
@@ -75,7 +84,6 @@ def compile_policy_file(
     model: str | None = None,
     provider: str | None = None,
     timeout: float = 60.0,
-    offline_fallback: bool = True,
 ) -> Policy:
     """Compile a natural language policy requirement file into a verified Dmint policy JSON file."""
     input_path = Path(input_file).resolve()
@@ -105,8 +113,10 @@ def compile_policy_file(
         timeout=timeout,
     )
 
+    system_prompt = load_system_prompt()
+
     messages = [
-        {"role": "system", "content": DMINT_POLICY_SYSTEM_PROMPT},
+        {"role": "system", "content": system_prompt},
         {
             "role": "user",
             "content": f"Convert the following natural language policy requirements into Dmint JSON policy format:\n\n{policy_text}",
@@ -116,34 +126,7 @@ def compile_policy_file(
     try:
         raw_json = client.chat_completion(messages, temperature=0.0)
     except Exception as exc:
-        if offline_fallback:
-            print(f"[!] API unavailable or key unconfigured ({exc}). Using deterministic policy compilation fallback...\n")
-            rules = []
-            seen_rules = set()
-            for line in policy_text.splitlines():
-                l = line.lower()
-                r = None
-                if "list_services" in l or "list services" in l:
-                    r = ("allow", "deployment", "list_services", "*")
-                elif "get_service_status" in l or "read service status" in l:
-                    r = ("allow", "deployment", "get_service_status", "*")
-                elif "deploy_service" in l or "deploy" in l:
-                    eff = "approval_required" if "approval" in l or "production" in l else "allow"
-                    r = (eff, "deployment", "deploy_service", "*")
-                elif "rollback_service" in l or "rollback" in l:
-                    r = ("approval_required", "deployment", "rollback_service", "*")
-                elif "scale_service" in l or "scale" in l:
-                    r = ("approval_required", "deployment", "scale_service", "*")
-                elif "delete_service" in l or "delete" in l:
-                    r = ("deny", "deployment", "delete_service", "*")
-
-                if r and r not in seen_rules:
-                    seen_rules.add(r)
-                    rules.append({"effect": r[0], "tool": r[1], "action": r[2], "resource": r[3]})
-
-            raw_json = json.dumps({"rules": rules})
-        else:
-            raise APIError(str(exc)) from exc
+        raise APIError(str(exc)) from exc
 
     try:
         policy_data = json.loads(raw_json)