flexgate 0.1.0__py3-none-any.whl

flexgate/settings.py

@@ -0,0 +1,193 @@
+from __future__ import annotations
+
+import glob
+import json
+import os
+import re
+import shutil
+from datetime import datetime
+
+from flexgate.config import (
+    ClaudeSettings,
+    GatewayConfig,
+    ProviderConfig,
+    RouteConfig,
+    load_config,
+    save_config,
+)
+
+CLAUDE_DIR = os.path.expanduser("~/.claude")
+SETTINGS_GLOB = os.path.join(CLAUDE_DIR, "settings.json*")
+
+
+def _scan_settings_files() -> list[tuple[str, str]]:
+    """Return [(filepath, suffix), ...] for all ~/.claude/settings.json* files."""
+    results = []
+    for path in sorted(glob.glob(SETTINGS_GLOB)):
+        basename = os.path.basename(path)
+        # settings.json → suffix "default", settings.json.zai → "zai"
+        if basename == "settings.json":
+            suffix = "default"
+        else:
+            suffix = basename.replace("settings.json.", "", 1)
+            # Skip backup files from our own apply command
+            if suffix.startswith("bak"):
+                continue
+        results.append((path, suffix))
+    return results
+
+
+def _extract_provider(filepath: str) -> dict | None:
+    """Extract base_url and api_key from a settings.json file."""
+    try:
+        with open(filepath) as f:
+            data = json.load(f)
+    except (json.JSONDecodeError, OSError):
+        return None
+
+    env = data.get("env", {})
+    base_url = env.get("ANTHROPIC_BASE_URL", "")
+    api_key = env.get("ANTHROPIC_AUTH_TOKEN", "")
+
+    if not base_url or not api_key:
+        return None
+
+    return {"base_url": base_url.rstrip("/"), "api_key": api_key}
+
+
+def settings_import(config_path: str) -> None:
+    """Read ~/.claude/settings.json* files and populate config.yaml providers."""
+    files = _scan_settings_files()
+    if not files:
+        print("No settings files found in ~/.claude/")
+        return
+
+    # Try to load existing config, or start fresh
+    try:
+        cfg = load_config(config_path)
+    except (FileNotFoundError, ValueError):
+        cfg = GatewayConfig()
+
+    print("Found settings files:")
+    for filepath, suffix in files:
+        provider = _extract_provider(filepath)
+        status = "OK" if provider else "SKIPPED (no credentials)"
+        print(f"  {filepath} [{suffix}] — {status}")
+
+    print()
+
+    # Map suffixes to provider names
+    provider_map: dict[str, dict] = {}
+    for filepath, suffix in files:
+        provider = _extract_provider(filepath)
+        if not provider:
+            continue
+
+        if suffix == "default":
+            # Try to infer provider name from base_url
+            name = _infer_provider_name(provider["base_url"])
+        else:
+            name = suffix
+
+        provider_map[name] = provider
+
+    if not provider_map:
+        print("No valid provider credentials found in settings files.")
+        return
+
+    # Merge into config
+    for name, prov in provider_map.items():
+        if name in cfg.providers:
+            cfg.providers[name].base_url = prov["base_url"]
+            cfg.providers[name].api_key = prov["api_key"]
+            print(f"  Updated provider: {name}")
+        else:
+            cfg.providers[name] = ProviderConfig(
+                name=name,
+                base_url=prov["base_url"],
+                api_key=prov["api_key"],
+            )
+            print(f"  Added provider: {name}")
+
+    save_config(cfg, config_path)
+    print(f"\nConfig saved to {config_path}")
+
+
+def _infer_provider_name(base_url: str) -> str:
+    """Guess provider name from the base_url."""
+    url_lower = base_url.lower()
+    if "z.ai" in url_lower:
+        return "zai"
+    if "minimax" in url_lower:
+        return "minimax"
+    if "openai" in url_lower:
+        return "openai"
+    if "anthropic" in url_lower:
+        return "anthropic"
+    # Fallback: use hostname
+    from urllib.parse import urlparse
+    parsed = urlparse(base_url)
+    return parsed.hostname or "unknown"
+
+
+def _build_new_settings(cfg: GatewayConfig, existing: dict, auth_token: str) -> dict:
+    """Return the new settings dict: preserved non-env fields + gateway env block."""
+    new_settings: dict = {}
+
+    for key in ("permissions", "skipDangerousModePermissionPrompt", "skipAutoPermissionPrompt"):
+        if key in existing:
+            new_settings[key] = existing[key]
+
+    cs = cfg.claude_settings
+    new_settings["env"] = {
+        "ANTHROPIC_BASE_URL": f"http://{cfg.server.host}:{cfg.server.port}",
+        "ANTHROPIC_AUTH_TOKEN": auth_token,
+        "API_TIMEOUT_MS": str(cs.api_timeout_ms),
+        "ANTHROPIC_DEFAULT_OPUS_MODEL": cs.default_opus_model,
+        "ANTHROPIC_DEFAULT_SONNET_MODEL": cs.default_sonnet_model,
+        "ANTHROPIC_DEFAULT_HAIKU_MODEL": cs.default_haiku_model,
+    }
+    return new_settings
+
+
+def settings_apply(config_path: str, *, auth_token: str | None = None) -> None:
+    """Apply config.yaml to ~/.claude/settings.json (with backup).
+
+    auth_token: value to write as ANTHROPIC_AUTH_TOKEN. If None, defaults to "gateway"
+    (preserves legacy behavior of this command for callers that do not pass a token).
+    """
+    cfg = load_config(config_path)
+    effective_token = "gateway" if auth_token is None else auth_token
+
+    settings_file = os.path.join(CLAUDE_DIR, "settings.json")
+    if not os.path.exists(settings_file):
+        print(f"Warning: {settings_file} does not exist, creating new file.")
+
+    # Backup existing settings.json
+    if os.path.exists(settings_file):
+        timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
+        backup_path = os.path.join(CLAUDE_DIR, f"settings.json.bak.{timestamp}")
+        shutil.copy2(settings_file, backup_path)
+        print(f"Backup: {backup_path}")
+
+    # Read existing file (for field preservation)
+    existing: dict = {}
+    if os.path.exists(settings_file):
+        try:
+            with open(settings_file) as f:
+                existing = json.load(f)
+        except (json.JSONDecodeError, OSError):
+            pass
+
+    new_settings = _build_new_settings(cfg, existing, effective_token)
+
+    with open(settings_file, "w") as f:
+        json.dump(new_settings, f, indent=2)
+        f.write("\n")
+
+    cs = cfg.claude_settings
+    print(f"Applied: {settings_file}")
+    print(f"  ANTHROPIC_BASE_URL = http://{cfg.server.host}:{cfg.server.port}")
+    print(f"  OPUS_MODEL  = {cs.default_opus_model}")
+    print(f"  SONNET_MODEL = {cs.default_sonnet_model}")
+    print(f"  HAIKU_MODEL  = {cs.default_haiku_model}")

flexgate/sync.py

@@ -0,0 +1,203 @@
+from __future__ import annotations
+
+import json
+import shutil
+import subprocess
+import sys
+
+from flexgate.config import ProviderConfig, load_config, save_config
+from flexgate.registry import KNOWN_BASE_URLS
+
+# Each provider is a folder under this path, named exactly after the provider,
+# containing an API_KEY secret:
+#   /providers/minimax-tmy/API_KEY
+PROVIDERS_FOLDER = "/providers"
+
+
+def _match_base_url(name: str, table: dict[str, str]) -> str | None:
+    """Longest known prefix of `name` (dash boundary) → its base_url."""
+    for prefix in sorted(table, key=len, reverse=True):
+        if name == prefix or name.startswith(prefix + "-"):
+            return table[prefix]
+    return None
+
+
+def _mask_key(key: str) -> str:
+    if len(key) <= 8:
+        return "***"
+    return key[:4] + "***" + key[-4:]
+
+
+def _run_infisical(args: list[str]) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(
+        ["infisical", *args],
+        capture_output=True,
+        text=True,
+        timeout=60,
+    )
+
+
+def _check_prerequisites() -> None:
+    if shutil.which("infisical") is None:
+        print("infisical CLI not found in PATH.")
+        print("Install it first: https://infisical.com/docs/cli/overview")
+        sys.exit(1)
+
+    proc = _run_infisical(["login", "status"])
+    if proc.returncode != 0:
+        print("infisical CLI is not authenticated.")
+        print("Run 'infisical login' first.")
+        sys.exit(1)
+
+
+def _parse_json(proc: subprocess.CompletedProcess[str], what: str) -> list:
+    try:
+        data = json.loads(proc.stdout)
+    except json.JSONDecodeError as e:
+        print(f"Could not parse infisical {what} output: {e}")
+        sys.exit(1)
+    return data if isinstance(data, list) else []
+
+
+def _list_provider_folders(project_id: str, env: str) -> list[str]:
+    """List folder names under PROVIDERS_FOLDER; each name is a provider."""
+    proc = _run_infisical([
+        "secrets", "folders", "get",
+        "--path", PROVIDERS_FOLDER,
+        "-o", "json",
+        f"--projectId={project_id}",
+        f"--env={env}",
+        "--silent",
+    ])
+    if proc.returncode != 0:
+        print(f"Could not list folders under {PROVIDERS_FOLDER}:")
+        print((proc.stderr or proc.stdout).strip())
+        sys.exit(1)
+    return [str(f["folderName"]) for f in _parse_json(proc, "folders") if "folderName" in f]
+
+
+def _fetch_folder_secrets(project_id: str, env: str, folder: str) -> dict[str, str]:
+    proc = _run_infisical([
+        "export",
+        "--format=json",
+        f"--env={env}",
+        f"--projectId={project_id}",
+        f"--path={PROVIDERS_FOLDER}/{folder}",
+        "--expand=false",
+        "--silent",
+    ])
+    if proc.returncode != 0:
+        print(f"Failed to fetch secrets from {PROVIDERS_FOLDER}/{folder}:")
+        print((proc.stderr or proc.stdout).strip())
+        sys.exit(1)
+
+    secrets: dict[str, str] = {}
+    for entry in _parse_json(proc, "export"):
+        if isinstance(entry, dict) and "key" in entry:
+            secrets[str(entry["key"])] = str(entry.get("value", ""))
+    return secrets
+
+
+def sync_pull(config_path: str, dry_run: bool = False) -> None:
+    """Pull provider api_keys from Infisical into the flexgate config.
+
+    Provider mapping is derived from the Infisical layout: a folder named
+    after the provider under /providers, holding an API_KEY secret (an
+    optional MODELS secret lists comma-separated model names). Folders with
+    no matching provider in the config are auto-imported when their name
+    starts with a known prefix (see KNOWN_BASE_URLS in registry.py);
+    otherwise a warning is printed.
+    """
+    _check_prerequisites()
+
+    config = load_config(config_path)
+    inf = config.infisical
+    if not inf.project_id:
+        print("No Infisical project configured.")
+        print(f"Add an 'infisical' section to {config_path}:")
+        print()
+        print("  infisical:")
+        print("    project_id: \"<your-project-id>\"")
+        print("    env: \"dev\"")
+        sys.exit(1)
+
+    if not config.providers:
+        print("No providers configured; nothing to sync.")
+        return
+
+    print(f"Fetching secrets from Infisical (project {inf.project_id}, env {inf.env})...")
+    folders = _list_provider_folders(inf.project_id, inf.env)
+
+    updated: list[str] = []
+    unchanged: list[str] = []
+    missing: list[str] = []
+
+    for name, prov in config.providers.items():
+        if name not in folders:
+            missing.append(name)
+            continue
+        new_key = _fetch_folder_secrets(inf.project_id, inf.env, name).get("API_KEY", "")
+        if new_key and new_key != prov.api_key:
+            prov.api_key = new_key
+            updated.append(name)
+        else:
+            unchanged.append(name)
+
+    # Providers that exist in Infisical but not in the local config: try to
+    # auto-import them by matching the folder name against known prefixes.
+    base_url_table = dict(KNOWN_BASE_URLS)
+    base_url_table.update({n: p.base_url for n, p in config.providers.items()})
+
+    imported: list[str] = []
+    unknown: list[str] = []
+
+    for name in [f for f in folders if f not in config.providers]:
+        base_url = _match_base_url(name, base_url_table)
+        if base_url is None:
+            unknown.append(name)
+            continue
+        secrets = _fetch_folder_secrets(inf.project_id, inf.env, name)
+        api_key = secrets.get("API_KEY", "")
+        if not api_key:
+            unknown.append(name)
+            continue
+        models = [m.strip() for m in secrets.get("MODELS", "").split(",") if m.strip()]
+        config.providers[name] = ProviderConfig(
+            name=name,
+            base_url=base_url,
+            api_key=api_key,
+            available_models=models,
+        )
+        imported.append(name)
+
+    for name in updated:
+        print(f"  {name:16s} updated  (key: {_mask_key(config.providers[name].api_key)})")
+    for name in imported:
+        print(f"  {name:16s} imported (new provider, base_url: {config.providers[name].base_url})")
+    for name in unchanged:
+        print(f"  {name:16s} unchanged")
+    for name in missing:
+        print(f"  {name:16s} no folder {PROVIDERS_FOLDER}/{name} in Infisical")
+    for name in unknown:
+        print(f"  WARNING: {name} has no known prefix and was skipped.")
+        print(f"           Add it to the config manually, or register its prefix in flexgate/registry.py.")
+
+    changed = updated or imported
+    if not changed:
+        print("\nAll keys are up to date.")
+        return
+
+    if dry_run:
+        n = len(updated) + len(imported)
+        print(f"\nDry run: {n} provider(s) would be updated/imported. No changes written.")
+        return
+
+    save_config(config, config_path)
+    print(f"\nUpdated {len(updated)} key(s), imported {len(imported)} provider(s). Saved: {config_path}")
+
+    # Hot-reload the authoritative systemd service, if it is active.
+    from flexgate.service import reload_service_if_active
+
+    msg = reload_service_if_active(config_path)
+    if msg:
+        print(msg)

flexgate/update.py

@@ -0,0 +1,188 @@
+"""Package self-update via pip/pipx/uv and config migration.
+
+``flexgate update`` handles both halves of an upgrade:
+
+1. package — detect how flexgate was installed (pipx / uv tool / pip) and
+   upgrade to the latest release published on PyPI;
+2. config — apply pending config.yaml schema migrations (with backup).
+
+Use ``--check`` to only report what would change.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import shutil
+import subprocess
+import sys
+import urllib.request
+
+from flexgate import __version__
+from flexgate.migrate import CURRENT_CONFIG_VERSION, migrate_config_file, read_raw_config, detect_config_version, pending_steps
+
+PYPI_JSON_URL = "https://pypi.org/pypi/flexgate/json"
+
+
+def parse_version(text: str) -> tuple[int, ...]:
+    """Parse '1.2.3' into (1, 2, 3); pre-release suffixes are ignored."""
+    parts = re.findall(r"\d+", text)
+    return tuple(int(p) for p in parts) if parts else (0,)
+
+
+def fetch_latest_version(timeout: float = 5.0) -> str | None:
+    """Latest released version on PyPI, or None when unreachable/offline."""
+    try:
+        req = urllib.request.Request(PYPI_JSON_URL, headers={"Accept": "application/json"})
+        with urllib.request.urlopen(req, timeout=timeout) as resp:
+            data = json.loads(resp.read())
+        return str(data["info"]["version"])
+    except Exception:
+        return None
+
+
+def detect_installer() -> tuple[str, list[str]] | None:
+    """Return (label, upgrade command) for the tool that installed flexgate."""
+    if shutil.which("pipx"):
+        out = subprocess.run(["pipx", "list", "--short"], capture_output=True, text=True).stdout
+        if any(line.split()[0] == "flexgate" for line in out.splitlines() if line.strip()):
+            return ("pipx", ["pipx", "upgrade", "flexgate"])
+    if shutil.which("uv"):
+        out = subprocess.run(["uv", "tool", "list"], capture_output=True, text=True).stdout
+        if any(line.split()[0] == "flexgate" for line in out.splitlines() if line.strip()):
+            return ("uv tool", ["uv", "tool", "upgrade", "flexgate"])
+    return ("pip", [sys.executable, "-m", "pip", "install", "--upgrade", "flexgate"])
+
+
+# ── cached background version check ───────────────────────────────
+#
+# Interactive commands (bare `flexgate`, `service status`) show a one-line
+# upgrade hint when PyPI carries a newer release. The PyPI lookup is cached
+# on disk so it hits the network at most once per UPDATE_CHECK_INTERVAL and
+# never slows down or breaks the CLI (every failure is silent).
+
+UPDATE_CHECK_INTERVAL = 24 * 3600  # seconds between PyPI lookups
+
+
+def _update_check_cache_path() -> str:
+    import os
+
+    from flexgate.config import FLEXGATE_HOME
+    return os.path.join(FLEXGATE_HOME, "update-check.json")
+
+
+def latest_version_cached(interval: float = UPDATE_CHECK_INTERVAL) -> str | None:
+    """Latest PyPI version, cached on disk; None on any failure."""
+    import os
+    import time
+
+    path = _update_check_cache_path()
+    try:
+        with open(path) as f:
+            cache = json.load(f)
+        if time.time() - float(cache.get("checked_at", 0)) < interval:
+            return cache.get("latest") or None
+    except Exception:
+        pass
+
+    latest = fetch_latest_version(timeout=1.5)
+    try:
+        tmp = path + ".tmp"
+        with open(tmp, "w") as f:
+            json.dump({"checked_at": time.time(), "latest": latest}, f)
+        os.replace(tmp, path)
+    except Exception:
+        pass
+    return latest
+
+
+def update_notice() -> str | None:
+    """One-line upgrade hint when PyPI has a newer release, else None."""
+    try:
+        latest = latest_version_cached()
+    except Exception:
+        return None
+    if latest and parse_version(latest) > parse_version(__version__):
+        return (f"A newer flexgate {latest} is available "
+                f"(installed {__version__}) — run: flexgate update")
+    return None
+
+
+def _config_status(config_path: str) -> tuple[int, list[int]] | None:
+    """(current_version, pending steps), or None if the config cannot be read."""
+    try:
+        data = read_raw_config(config_path)
+    except Exception:
+        return None
+    version = detect_config_version(data)
+    return version, pending_steps(version)
+
+
+def run_update(config_path: str, *, check: bool = False, config_only: bool = False) -> int:
+    import os
+
+    print(f"flexgate {__version__} (config schema v{CURRENT_CONFIG_VERSION})")
+    failures = 0
+
+    # ── package update ────────────────────────────────────────────
+    latest = fetch_latest_version()
+    if latest is None:
+        print("\nPackage: could not reach PyPI — skipping package update check.")
+    else:
+        newer = parse_version(latest) > parse_version(__version__)
+        print(f"\nPackage: installed {__version__}, latest {latest}"
+              + (" — update available" if newer else " — up to date"))
+        if newer and not config_only:
+            installer = detect_installer()
+            if installer is None:
+                print("  Could not detect how flexgate was installed; upgrade manually.")
+                failures += 1
+            else:
+                label, cmd = installer
+                if check:
+                    print(f"  Would run: {' '.join(cmd)}")
+                else:
+                    print(f"  Upgrading via {label}: {' '.join(cmd)}")
+                    proc = subprocess.run(cmd)
+                    if proc.returncode != 0:
+                        print(f"  Package upgrade failed (exit {proc.returncode}).")
+                        failures += 1
+                    else:
+                        print(f"  Upgraded to {latest}. Restart the service to use it:")
+                        print("    flexgate service restart")
+
+    # ── config migration ──────────────────────────────────────────
+    print()
+    if not os.path.exists(config_path):
+        print(f"Config: {config_path} not found — nothing to migrate.")
+        return 1 if failures else 0
+
+    status = _config_status(config_path)
+    if status is None:
+        print(f"Config: could not parse {config_path} — run 'flexgate doctor' for details.")
+        return 1
+
+    version, steps = status
+    if not steps:
+        print(f"Config: schema v{version} is current — nothing to migrate.")
+    else:
+        print(f"Config: schema v{version} → v{CURRENT_CONFIG_VERSION}, {len(steps)} migration(s) pending.")
+        if check:
+            for step in steps:
+                print(f"  Would apply v{step} → v{step + 1}")
+        else:
+            result = migrate_config_file(config_path)
+            for line in result.applied:
+                print(f"  Applied {line}")
+            if result.backup_path:
+                print(f"  Backup: {result.backup_path}")
+            print(f"  Migrated: {config_path}")
+
+    # ── reload the running service with the migrated config ──────
+    if not check:
+        from flexgate.service import reload_service_if_active
+        msg = reload_service_if_active(config_path)
+        if msg:
+            print(f"\n{msg}")
+
+    return 1 if failures else 0