gax-cli 0.4.0__py3-none-any.whl

gax/macaroons_cap.py

@@ -0,0 +1,80 @@
+from __future__ import annotations
+
+import base64
+import hashlib
+import hmac
+import json
+import time
+from typing import Any
+
+from gax.caps import jwt_secret
+
+
+def _sign(data: bytes, key: bytes) -> str:
+    return base64.urlsafe_b64encode(hmac.new(key, data, hashlib.sha256).digest()).decode().rstrip("=")
+
+
+def mint_macaroon(
+    *,
+    tenant_id: str,
+    subject: str,
+    commands: list[str],
+    scopes: list[str],
+    ttl_seconds: int = 3600,
+    caveats: list[dict[str, Any]] | None = None,
+) -> str:
+    """HMAC-chained capability (macaroon-style attenuation, MVP)."""
+    root_key = jwt_secret().encode()
+    now = int(time.time())
+    payload: dict[str, Any] = {
+        "v": 1,
+        "tenant_id": tenant_id,
+        "sub": subject,
+        "commands": commands,
+        "scopes": scopes,
+        "iat": now,
+        "exp": now + ttl_seconds,
+        "caveats": caveats or [],
+    }
+    body = json.dumps(payload, sort_keys=True, separators=(",", ":")).encode()
+    sig = _sign(body, root_key)
+    for caveat in caveats or []:
+        sig = _sign(f"{sig}|{json.dumps(caveat, sort_keys=True)}".encode(), root_key)
+    blob = base64.urlsafe_b64encode(json.dumps({"p": payload, "s": sig}).encode()).decode()
+    return f"gaxm_{blob}"
+
+
+def verify_macaroon(token: str) -> dict[str, Any]:
+    if token.startswith("gaxm_"):
+        token = token[5:]
+    try:
+        pad = "=" * (-len(token) % 4)
+        raw = json.loads(base64.urlsafe_b64decode(token + pad))
+    except Exception as e:
+        raise ValueError("invalid macaroon") from e
+    payload = raw.get("p") or {}
+    sig = raw.get("s", "")
+    root_key = jwt_secret().encode()
+    body = json.dumps(payload, sort_keys=True, separators=(",", ":")).encode()
+    expected = _sign(body, root_key)
+    for caveat in payload.get("caveats") or []:
+        expected = _sign(f"{expected}|{json.dumps(caveat, sort_keys=True)}".encode(), root_key)
+    if not hmac.compare_digest(expected, sig):
+        raise ValueError("macaroon signature mismatch")
+    if int(payload.get("exp", 0)) < time.time():
+        raise ValueError("macaroon expired")
+    return payload
+
+
+def macaroon_allows_command(claims: dict[str, Any], command: str) -> bool:
+    allowed = claims.get("commands") or []
+    if "*" in allowed:
+        return True
+    return command in allowed
+
+
+def macaroon_allows_scopes(claims: dict[str, Any], required: list[str]) -> bool:
+    held = set(claims.get("scopes") or [])
+    if "*" in held:
+        return True
+    return set(required).issubset(held)

gax/manifests/aws.s3.list.yaml

@@ -0,0 +1,20 @@
+command: aws.s3.list
+version: "1.0.0"
+description: List S3 buckets (mock MVP)
+category: aws
+adapter: mock
+required_scopes:
+  - aws:s3:read
+side_effects: read
+idempotent: true
+input_schema:
+  type: object
+  properties:
+    prefix:
+      type: string
+      default: ""
+output_schema:
+  type: object
+  properties:
+    buckets:
+      type: array

gax/manifests/demo.echo.yaml

@@ -0,0 +1,20 @@
+command: demo.echo
+version: "1.0.0"
+description: Echo arguments (demo / testing without gh)
+category: demo
+adapter: mock
+required_scopes:
+  - demo:echo
+side_effects: read
+idempotent: true
+input_schema:
+  type: object
+  properties:
+    message:
+      type: string
+      default: hello
+output_schema:
+  type: object
+  properties:
+    echo:
+      type: string

gax/manifests/gh.pr.list.yaml

@@ -0,0 +1,41 @@
+command: gh.pr.list
+version: "1.0.0"
+description: List pull requests for a repository
+category: github
+adapter: exec
+backend:
+  - gh
+  - pr
+  - list
+required_scopes:
+  - github:pull_request:read
+side_effects: read
+idempotent: true
+input_schema:
+  type: object
+  required: [repo]
+  properties:
+    repo:
+      type: string
+      description: "owner/name"
+    limit:
+      type: integer
+      default: 30
+    state:
+      type: string
+      enum: [open, closed, merged, all]
+      default: open
+output_schema:
+  type: object
+  properties:
+    items:
+      type: array
+      items:
+        type: object
+        properties:
+          number: { type: integer }
+          title: { type: string }
+          state: { type: string }
+          url: { type: string }
+          author: { type: string }
+          draft: { type: boolean }

gax/manifests/gh.pr.view.yaml

@@ -0,0 +1,30 @@
+command: gh.pr.view
+version: "1.0.0"
+description: View a single pull request
+category: github
+adapter: exec
+backend:
+  - gh
+  - pr
+  - view
+required_scopes:
+  - github:pull_request:read
+side_effects: read
+idempotent: true
+input_schema:
+  type: object
+  required: [repo, number]
+  properties:
+    repo:
+      type: string
+    number:
+      type: integer
+output_schema:
+  type: object
+  properties:
+    number: { type: integer }
+    title: { type: string }
+    body: { type: string }
+    state: { type: string }
+    url: { type: string }
+    author: { type: string }

gax/manifests/jira.issue.get.yaml

@@ -0,0 +1,18 @@
+command: jira.issue.get
+version: "1.0.0"
+description: Get Jira issue by key (mock MVP)
+category: jira
+adapter: mock
+required_scopes:
+  - jira:issue:read
+side_effects: read
+idempotent: true
+input_schema:
+  type: object
+  required: [issue_key]
+  properties:
+    issue_key:
+      type: string
+      description: e.g. PROJ-123
+output_schema:
+  type: object

gax/manifests/k8s.deployment.scale.yaml

@@ -0,0 +1,35 @@
+command: k8s.deployment.scale
+version: "1.0.0"
+description: Scale a deployment to N replicas. Mutating; scaling to 0 takes a service down.
+category: kubernetes
+adapter: k8s
+required_scopes:
+  - k8s:deployments:write
+side_effects: write
+idempotent: true
+input_schema:
+  type: object
+  properties:
+    namespace:
+      type: string
+      description: Kubernetes namespace (DNS-1123)
+    deployment:
+      type: string
+      description: Deployment name (DNS-1123)
+    replicas:
+      type: integer
+      description: Desired replica count (>= 0)
+    dry_run:
+      type: boolean
+      description: Validate server-side without scaling (kubectl --dry-run=server)
+  required:
+    - deployment
+    - replicas
+output_schema:
+  type: object
+  properties:
+    scaled: { type: boolean }
+    deployment: { type: string }
+    namespace: { type: string }
+    replicas: { type: integer }
+    dry_run: { type: boolean }

gax/manifests/k8s.pod.delete.yaml

@@ -0,0 +1,30 @@
+command: k8s.pod.delete
+version: "1.0.0"
+description: Delete a pod in a namespace. Destructive; requires a capability with a destructive ceiling.
+category: kubernetes
+adapter: k8s
+required_scopes:
+  - k8s:pods:write
+side_effects: destructive
+idempotent: false
+input_schema:
+  type: object
+  properties:
+    namespace:
+      type: string
+      description: Kubernetes namespace (DNS-1123)
+    pod:
+      type: string
+      description: Pod name to delete (DNS-1123)
+    dry_run:
+      type: boolean
+      description: Validate server-side without deleting (kubectl --dry-run=server)
+  required:
+    - pod
+output_schema:
+  type: object
+  properties:
+    deleted: { type: boolean }
+    pod: { type: string }
+    namespace: { type: string }
+    dry_run: { type: boolean }

gax/manifests/kubectl.get.pods.yaml

@@ -0,0 +1,20 @@
+command: kubectl.get.pods
+version: "1.0.0"
+description: List pods in namespace (mock unless kubectl configured)
+category: kubernetes
+adapter: mock
+required_scopes:
+  - k8s:pods:read
+side_effects: read
+idempotent: true
+input_schema:
+  type: object
+  properties:
+    namespace:
+      type: string
+      default: default
+output_schema:
+  type: object
+  properties:
+    items:
+      type: array

gax/manifests/mcp.github.list_pulls.yaml

@@ -0,0 +1,29 @@
+command: mcp.github.list_pulls
+version: "1.0.0"
+description: List pull requests via GitHub MCP server (governed bridge)
+category: mcp
+adapter: mcp
+required_scopes:
+  - github:pull_request:read
+side_effects: read
+idempotent: true
+mcp:
+  server_command: npx
+  server_args:
+    - "-y"
+    - "@modelcontextprotocol/server-github"
+  tool_name: list_pull_requests
+  timeout: 90
+input_schema:
+  type: object
+  required: [repo]
+  properties:
+    repo:
+      type: string
+      description: owner/name
+    state:
+      type: string
+      enum: [open, closed, all]
+      default: open
+output_schema:
+  type: object

gax/manifests/pet_findpetsbystatus.yaml

@@ -0,0 +1,19 @@
+command: pet.findpetsbystatus
+version: 1.0.0
+description: Find pets by status
+category: pet
+adapter: mock
+required_scopes:
+- pet:read
+side_effects: read
+idempotent: true
+input_schema:
+  type: object
+  properties:
+    status:
+      type: string
+      description: ''
+  required:
+  - status
+output_schema:
+  type: object

gax/manifests/pet_getpetbyid.yaml

@@ -0,0 +1,19 @@
+command: pet.getpetbyid
+version: 1.0.0
+description: Get pet by ID
+category: pet
+adapter: mock
+required_scopes:
+- pet:read
+side_effects: read
+idempotent: true
+input_schema:
+  type: object
+  properties:
+    petId:
+      type: string
+      description: ''
+  required:
+  - petId
+output_schema:
+  type: object

gax/mcp_client.py

@@ -0,0 +1,110 @@
+"""MCP JSON-RPC over stdio — shared by gaxd MCP adapter and eval."""
+
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import time
+from typing import Any
+
+
+class McpStdioClient:
+    def __init__(
+        self,
+        server_cmd: list[str],
+        *,
+        env: dict[str, str] | None = None,
+        timeout: float = 60.0,
+    ) -> None:
+        self._timeout = timeout
+        self._id = 0
+        proc_env = {**os.environ, **(env or {})}
+        self._proc = subprocess.Popen(
+            server_cmd,
+            stdin=subprocess.PIPE,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.DEVNULL,
+            text=True,
+            env=proc_env,
+        )
+        assert self._proc.stdin and self._proc.stdout
+        self._initialize()
+
+    def _next_id(self) -> int:
+        self._id += 1
+        return self._id
+
+    def _read_message(self) -> dict[str, Any] | None:
+        line = self._proc.stdout.readline()  # type: ignore[union-attr]
+        if not line:
+            return None
+        line = line.strip()
+        if not line:
+            return self._read_message()
+        return json.loads(line)
+
+    def _request(self, method: str, params: dict[str, Any] | None = None) -> dict[str, Any]:
+        rid = self._next_id()
+        req: dict[str, Any] = {"jsonrpc": "2.0", "id": rid, "method": method}
+        if params is not None:
+            req["params"] = params
+        assert self._proc.stdin
+        self._proc.stdin.write(json.dumps(req) + "\n")
+        self._proc.stdin.flush()
+        deadline = time.time() + self._timeout
+        while time.time() < deadline:
+            msg = self._read_message()
+            if msg is None:
+                break
+            if msg.get("id") == rid:
+                if "error" in msg:
+                    raise RuntimeError(json.dumps(msg["error"]))
+                return msg.get("result") or {}
+        raise TimeoutError(f"MCP request timed out: {method}")
+
+    def _initialize(self) -> None:
+        self._request(
+            "initialize",
+            {
+                "protocolVersion": "2024-11-05",
+                "capabilities": {},
+                "clientInfo": {"name": "gax", "version": "0.4"},
+            },
+        )
+        assert self._proc.stdin
+        self._proc.stdin.write(
+            json.dumps({"jsonrpc": "2.0", "method": "notifications/initialized"}) + "\n"
+        )
+        self._proc.stdin.flush()
+
+    def list_tools(self) -> list[dict[str, Any]]:
+        result = self._request("tools/list", {})
+        return list(result.get("tools") or [])
+
+    def call_tool(self, name: str, arguments: dict[str, Any]) -> Any:
+        result = self._request("tools/call", {"name": name, "arguments": arguments})
+        content = result.get("content") or []
+        texts = [c.get("text", "") for c in content if c.get("type") == "text"]
+        if len(texts) == 1:
+            try:
+                return json.loads(texts[0])
+            except json.JSONDecodeError:
+                return {"text": texts[0]}
+        if texts:
+            return {"texts": texts}
+        return result
+
+    def close(self) -> None:
+        try:
+            self._proc.terminate()
+            self._proc.wait(timeout=5)
+        except Exception:
+            self._proc.kill()
+
+
+def github_mcp_env() -> dict[str, str]:
+    tok = os.environ.get("GITHUB_PERSONAL_ACCESS_TOKEN") or os.environ.get("GITHUB_TOKEN")
+    if not tok:
+        raise ValueError("GITHUB_TOKEN or GITHUB_PERSONAL_ACCESS_TOKEN required for MCP GitHub server")
+    return {"GITHUB_PERSONAL_ACCESS_TOKEN": tok}