getcodexy 1.2.2__tar.gz

getcodexy-1.2.2/PKG-INFO

@@ -0,0 +1,8 @@
+Metadata-Version: 2.4
+Name: getcodexy
+Version: 1.2.2
+Summary: Version-pinned MCP runtime bootstrap tools for Codexy
+Author: Eunsoo Lee
+License-Expression: MIT
+Requires-Python: >=3.10
+Project-URL: Repository, https://github.com/eunsoogi/codexy

getcodexy-1.2.2/pyproject.toml

@@ -0,0 +1,21 @@
+[build-system]
+requires = ["uv_build==0.9.26"]
+build-backend = "uv_build"
+
+[project]
+name = "getcodexy"
+version = "1.2.2"
+description = "Version-pinned MCP runtime bootstrap tools for Codexy"
+requires-python = ">=3.10"
+license = "MIT"
+authors = [{ name = "Eunsoo Lee" }]
+
+[project.urls]
+Repository = "https://github.com/eunsoogi/codexy"
+
+[project.scripts]
+codexy-mcp-runtime = "codexy_runtime_tools.runtime:main"
+
+[tool.uv.build-backend]
+module-name = "codexy_runtime_tools"
+module-root = "src"

getcodexy-1.2.2/src/codexy_runtime_tools/__init__.py

@@ -0,0 +1 @@
+"""Codexy runtime bootstrap package."""

getcodexy-1.2.2/src/codexy_runtime_tools/cache.py

@@ -0,0 +1,46 @@
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+from pathlib import Path
+
+
+SEMVER = re.compile(
+    r"^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)"
+    r"(?:-((?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)"
+    r"(?:\.(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*))?"
+    r"(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$"
+)
+
+
+def plugin_release(manifest_path: Path, package_override: bool = False) -> str:
+    if not manifest_path.is_file():
+        if package_override:
+            return "package-override"
+        raise ValueError("plugin manifest is missing")
+    manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
+    release = manifest.get("version") if isinstance(manifest, dict) else None
+    if not isinstance(release, str) or not SEMVER.fullmatch(release):
+        raise ValueError("plugin manifest version is invalid")
+    return release
+
+
+def releases_match(expected_manifest: Path, observed_manifest: Path) -> tuple[bool, str]:
+    try:
+        expected = plugin_release(expected_manifest)
+    except (OSError, ValueError, json.JSONDecodeError):
+        return False, "runtime package release mismatch: expected valid plugin release, observed missing or invalid"
+    try:
+        observed = plugin_release(observed_manifest)
+    except (OSError, ValueError, json.JSONDecodeError):
+        return False, f"runtime package release mismatch: expected {expected}, observed missing or invalid"
+    if expected != observed:
+        return False, f"runtime package release mismatch: expected {expected}, observed {observed}"
+    return True, ""
+
+
+def runtime_cache_key(*, manifest: Path, package_override: bool, identity: list[str]) -> str:
+    release = plugin_release(manifest, package_override)
+    digest_input = "\0".join(("codexy.runtime-cache/v2", *identity[:-1], release, identity[-1]))
+    return f"v2-{hashlib.sha256(digest_input.encode()).hexdigest()}"

getcodexy-1.2.2/src/codexy_runtime_tools/installer.py

@@ -0,0 +1,107 @@
+from __future__ import annotations
+
+import os
+import shutil
+import stat
+import subprocess
+import tempfile
+from pathlib import Path
+from typing import NoReturn, Protocol
+
+from .cache import releases_match
+from .package import acquire_package, unpack_runtime
+
+
+class InstallConfig(Protocol):
+    server: str
+    manifest: Path
+    runtime_name: str
+    package_path: str
+    package_url: str
+    artifacts_api: str
+    package_override: bool
+    package_sha256: str
+    git_repository: str
+    git_ref: str
+
+
+def executable(path: Path) -> bool:
+    try:
+        metadata = os.lstat(path)
+    except FileNotFoundError:
+        return False
+    reparse = getattr(stat, "FILE_ATTRIBUTE_REPARSE_POINT", 0)
+    return (
+        stat.S_ISREG(metadata.st_mode)
+        and not stat.S_ISLNK(metadata.st_mode)
+        and not bool(getattr(metadata, "st_file_attributes", 0) & reparse)
+        and os.access(path, os.X_OK)
+    )
+
+
+def execute(
+    path: Path | str, arguments: list[str], environment: dict[str, str] | None = None
+) -> NoReturn:
+    command = str(path)
+    runtime_environment = os.environ.copy()
+    runtime_environment.update(environment or {})
+    os.execvpe(command, [command, *arguments], runtime_environment)
+    raise AssertionError("exec returned unexpectedly")
+
+
+def install_package(config: InstallConfig, install_root: Path, installed: Path) -> None:
+    install_root.mkdir(parents=True, exist_ok=True)
+    with tempfile.TemporaryDirectory(prefix="package-", dir=install_root) as temporary:
+        work = Path(temporary)
+        archive = acquire_package(
+            path=config.package_path,
+            url=config.package_url,
+            artifacts_api=config.artifacts_api,
+            expected_sha256=config.package_sha256,
+            work=work,
+        )
+        packaged_runtime, package_manifest = unpack_runtime(
+            archive=archive, work=work, runtime_name=config.runtime_name
+        )
+        if not config.package_override:
+            matches, message = releases_match(config.manifest, package_manifest)
+            if not matches:
+                raise RuntimeError(message)
+        installed.parent.mkdir(parents=True, exist_ok=True)
+        temporary_runtime = installed.with_name(f".{installed.name}.{os.getpid()}.tmp")
+        shutil.copyfile(packaged_runtime, temporary_runtime)
+        temporary_runtime.chmod(
+            temporary_runtime.stat().st_mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH
+        )
+        os.replace(temporary_runtime, installed)
+        if not config.package_override:
+            shutil.copyfile(package_manifest, install_root / "plugin.json")
+
+
+def install_git(config: InstallConfig, install_root: Path, installed: Path) -> None:
+    cargo = shutil.which("cargo")
+    if not cargo:
+        raise RuntimeError("cargo is unavailable for the configured Git runtime source")
+    revision = len(config.git_ref) == 40 and all(
+        character in "0123456789abcdefABCDEF" for character in config.git_ref
+    )
+    if not revision:
+        raise RuntimeError("CODEXY_RUNTIME_GIT_REF must be an exact 40-hex commit")
+    command = [
+        cargo,
+        "install",
+        "--force",
+        "--locked",
+        "--git",
+        config.git_repository,
+        "--rev",
+        config.git_ref,
+        "--root",
+        str(install_root),
+        "--bin",
+        f"codexy-mcp-{config.server}",
+    ]
+    completed = subprocess.run(command, check=False)
+    if completed.returncode or not executable(installed):
+        raise RuntimeError(f"cargo install exited with status {completed.returncode}")
+    shutil.copyfile(config.manifest, install_root / "plugin.json")

getcodexy-1.2.2/src/codexy_runtime_tools/package.py

@@ -0,0 +1,200 @@
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import shutil
+import stat
+import subprocess
+import tarfile
+import urllib.request
+import zipfile
+import zlib
+from pathlib import Path
+from urllib.parse import urlparse
+
+
+MAX_ARCHIVE_FILES = 2_048
+MAX_UNPACKED_BYTES = 512 * 1024 * 1024
+CANONICAL_REPOSITORY_ID = 1_269_350_143
+
+
+class _GithubRedirectHandler(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, request, file_pointer, status, message, headers, new_url):
+        redirected = super().redirect_request(
+            request, file_pointer, status, message, headers, new_url
+        )
+        if redirected and _origin(request.full_url) != _origin(new_url):
+            for redirect_headers in (redirected.headers, redirected.unredirected_hdrs):
+                for name in list(redirect_headers):
+                    if name.lower() == "authorization":
+                        del redirect_headers[name]
+        return redirected
+
+
+def _download(url: str, destination: Path, token: str = "") -> None:
+    headers = {"Accept": "application/vnd.github+json"}
+    if token:
+        headers["Authorization"] = f"Bearer {token}"
+    request = urllib.request.Request(url, headers=headers)
+    open_request = (
+        urllib.request.build_opener(_GithubRedirectHandler()).open if token else urllib.request.urlopen
+    )
+    with open_request(request, timeout=30) as response, destination.open("wb") as output:
+        shutil.copyfileobj(response, output)
+
+
+def _origin(url: str) -> tuple[str, str, int | None]:
+    parsed = urlparse(url)
+    return parsed.scheme, parsed.hostname or "", parsed.port
+
+
+def _trusted_github_api(url: str) -> bool:
+    return _origin(url) == ("https", "api.github.com", None)
+
+
+def _safe_extract_tar(archive: Path, destination: Path) -> None:
+    try:
+        _extract_tar(archive, destination)
+    except (tarfile.TarError, EOFError) as error:
+        raise ValueError(f"invalid runtime package archive: {error}") from error
+
+
+def _extract_tar(archive: Path, destination: Path) -> None:
+    destination_resolved = destination.resolve()
+    with tarfile.open(archive, "r:gz") as package:
+        members = package.getmembers()
+        if len(members) > MAX_ARCHIVE_FILES:
+            raise ValueError("runtime package contains too many members")
+        if sum(member.size for member in members) > MAX_UNPACKED_BYTES:
+            raise ValueError("runtime package exceeds the unpacked size limit")
+        destinations: set[Path] = set()
+        for member in members:
+            if not (member.isdir() or member.isfile()):
+                raise ValueError(f"runtime package contains unsafe link or device: {member.name}")
+            member_path = (destination / member.name).resolve()
+            if destination_resolved not in member_path.parents and member_path != destination_resolved:
+                raise ValueError(f"runtime package contains unsafe path: {member.name}")
+            if member_path in destinations:
+                raise ValueError(f"runtime package contains duplicate path: {member.name}")
+            destinations.add(member_path)
+        package.extractall(destination)
+
+
+def _safe_extract_zip(archive: Path, destination: Path) -> None:
+    try:
+        _extract_zip(archive, destination)
+    except (zipfile.BadZipFile, zlib.error) as error:
+        raise ValueError(f"invalid artifact archive: {error}") from error
+
+
+def _extract_zip(archive: Path, destination: Path) -> None:
+    destination_resolved = destination.resolve()
+    with zipfile.ZipFile(archive) as zipped:
+        members = zipped.infolist()
+        if len(members) > MAX_ARCHIVE_FILES:
+            raise ValueError("artifact archive contains too many members")
+        if sum(member.file_size for member in members) > MAX_UNPACKED_BYTES:
+            raise ValueError("artifact archive exceeds the unpacked size limit")
+        destinations: set[Path] = set()
+        for member in members:
+            member_path = (destination / member.filename).resolve()
+            unix_mode = member.external_attr >> 16
+            if stat.S_ISLNK(unix_mode):
+                raise ValueError(f"artifact archive contains unsafe link: {member.filename}")
+            if destination_resolved not in member_path.parents and member_path != destination_resolved:
+                raise ValueError(f"artifact archive contains unsafe path: {member.filename}")
+            if member_path in destinations:
+                raise ValueError(f"artifact archive contains duplicate path: {member.filename}")
+            destinations.add(member_path)
+        zipped.extractall(destination)
+
+
+def _github_token_for(url: str) -> str:
+    if not _trusted_github_api(url):
+        return ""
+    token = os.environ.get("GH_TOKEN") or os.environ.get("GITHUB_TOKEN")
+    if token:
+        return token
+    try:
+        return subprocess.run(
+            ["gh", "auth", "token"],
+            check=True,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.DEVNULL,
+            text=True,
+        ).stdout.strip()
+    except (OSError, subprocess.CalledProcessError):
+        return ""
+
+
+def _artifact_package(api_url: str, work: Path) -> Path:
+    token = _github_token_for(api_url)
+    metadata = work / "artifacts.json"
+    _download(api_url, metadata, token)
+    payload = json.loads(metadata.read_text(encoding="utf-8"))
+    artifacts = payload.get("artifacts") if isinstance(payload, dict) else None
+    if not isinstance(artifacts, list):
+        raise RuntimeError("artifact source has invalid artifacts listing")
+    selected = next(
+        (
+            item
+            for item in artifacts
+            if isinstance(item, dict)
+            and not item.get("expired", True)
+            and isinstance(item.get("workflow_run"), dict)
+            and item["workflow_run"].get("head_branch") == "main"
+            and item["workflow_run"].get("head_repository_id") == CANONICAL_REPOSITORY_ID
+            and isinstance(item.get("archive_download_url"), str)
+        ),
+        None,
+    )
+    if selected is None:
+        raise RuntimeError("artifact source has no unexpired main-branch package")
+    archive = work / "artifact.zip"
+    download_url = selected["archive_download_url"]
+    if token and not (_trusted_github_api(download_url) or _origin(download_url) == ("https", "github.com", None)):
+        raise RuntimeError("artifact download URL is not a trusted GitHub host")
+    _download(download_url, archive, token)
+    artifact_root = work / "artifact"
+    _safe_extract_zip(archive, artifact_root)
+    matches = list(artifact_root.rglob("codexy-marketplace-plugin.tar.gz"))
+    if len(matches) != 1:
+        raise RuntimeError("artifact must contain exactly one marketplace package")
+    return matches[0]
+
+
+def acquire_package(
+    *, path: str, url: str, artifacts_api: str, expected_sha256: str, work: Path
+) -> Path:
+    work.mkdir(parents=True, exist_ok=True)
+    archive = work / "codexy-marketplace-plugin.tar.gz"
+    if path:
+        source = Path(path)
+        if not source.is_absolute():
+            raise ValueError(f"runtime package path must be absolute: {source}")
+        shutil.copyfile(source, archive)
+    elif url:
+        _download(url, archive)
+    elif artifacts_api:
+        shutil.copyfile(_artifact_package(artifacts_api, work), archive)
+    else:
+        raise RuntimeError("no runtime package source was configured")
+    if expected_sha256:
+        observed = hashlib.sha256(archive.read_bytes()).hexdigest()
+        if observed != expected_sha256.lower():
+            raise ValueError(
+                f"runtime package SHA-256 mismatch: expected {expected_sha256.lower()}, observed {observed}"
+            )
+    return archive
+
+
+def unpack_runtime(*, archive: Path, work: Path, runtime_name: str) -> tuple[Path, Path]:
+    extracted = work / "package"
+    extracted.mkdir()
+    _safe_extract_tar(archive, extracted)
+    runtime = extracted / "plugins" / "codexy" / "runtime" / runtime_name
+    manifest = extracted / "plugins" / "codexy" / ".codex-plugin" / "plugin.json"
+    if not runtime.is_file() or runtime.is_symlink() or not manifest.is_file() or manifest.is_symlink():
+        raise RuntimeError("runtime package is missing its exact runtime binary or plugin manifest")
+    return runtime, manifest

getcodexy-1.2.2/src/codexy_runtime_tools/runtime.py

@@ -0,0 +1,169 @@
+from __future__ import annotations
+
+import argparse
+import os
+import platform as host_platform
+import sys
+from dataclasses import dataclass
+from pathlib import Path
+from typing import NoReturn
+
+from .cache import plugin_release, releases_match, runtime_cache_key
+from .installer import executable, execute, install_git, install_package
+
+
+SUPPORTED_PLATFORMS = ("darwin-arm64", "linux-x86_64")
+PROTOCOL = "stdio-newline-v1"
+REPOSITORY = "https://github.com/eunsoogi/codexy"
+
+
+def _fail(message: str) -> NoReturn:
+    print(message, file=sys.stderr)
+    raise SystemExit(127)
+
+
+def _notice(message: str) -> None:
+    print(f"codexy runtime: {message}", file=sys.stderr)
+
+
+def _host_platform() -> str:
+    override = os.environ.get("CODEXY_RUNTIME_PLATFORM")
+    if override:
+        return override
+    os_name = {"Darwin": "darwin", "Linux": "linux", "Windows": "windows"}.get(
+        host_platform.system(), "unknown"
+    )
+    architecture = {
+        "arm64": "arm64", "aarch64": "arm64", "x86_64": "x86_64",
+        "amd64": "x86_64", "AMD64": "x86_64",
+    }.get(host_platform.machine(), "unknown")
+    return f"{os_name}-{architecture}"
+
+
+def _absolute_env_path(name: str) -> Path | None:
+    value = os.environ.get(name)
+    if not value:
+        return None
+    path = Path(value)
+    if not path.is_absolute():
+        _fail(f"{name} must be absolute: {path}")
+    return path
+
+
+@dataclass(frozen=True)
+class Configuration:
+    server: str
+    plugin_root: Path
+    arguments: list[str]
+    platform: str
+    manifest: Path
+    release: str
+    runtime_name: str
+    package_path: str
+    package_url: str
+    artifacts_api: str
+    package_override: bool
+    package_sha256: str
+    git_repository: str
+    git_ref: str
+    offline: bool
+    git_fallback: bool
+
+    @classmethod
+    def load(cls, server: str, plugin_root: Path, arguments: list[str]) -> "Configuration":
+        manifest = plugin_root / ".codex-plugin/plugin.json"
+        try:
+            release = plugin_release(manifest)
+        except (OSError, ValueError) as error:
+            _fail(f"codexy-mcp-{server} cannot read plugin release: {error}")
+        package_path_was_set = "CODEXY_RUNTIME_PACKAGE_PATH" in os.environ
+        package_path = os.environ.get("CODEXY_RUNTIME_PACKAGE_PATH", "")
+        package_url_was_set = "CODEXY_RUNTIME_PACKAGE_URL" in os.environ
+        artifacts_was_set = "CODEXY_RUNTIME_ARTIFACTS_API_URL" in os.environ
+        package_url = os.environ.get("CODEXY_RUNTIME_PACKAGE_URL", "")
+        artifacts_api = os.environ.get("CODEXY_RUNTIME_ARTIFACTS_API_URL", "")
+        package_override = bool(package_path_was_set or package_url_was_set or artifacts_was_set)
+        package_sha256 = os.environ.get("CODEXY_RUNTIME_PACKAGE_SHA256", "").lower()
+        if package_override and (
+            len(package_sha256) != 64
+            or any(character not in "0123456789abcdefABCDEF" for character in package_sha256)
+        ):
+            _fail("explicit runtime package source requires CODEXY_RUNTIME_PACKAGE_SHA256")
+        if not package_override:
+            package_url = f"{REPOSITORY}/releases/download/v{release}/codexy-marketplace-plugin.tar.gz"
+        return cls(
+            server=server, plugin_root=plugin_root, arguments=arguments,
+            platform=_host_platform(), manifest=manifest, release=release,
+            runtime_name=f"codexy-mcp-{server}-{_host_platform()}.bin",
+            package_path=package_path, package_url=package_url, artifacts_api=artifacts_api,
+            package_override=package_override, package_sha256=package_sha256,
+            git_repository=os.environ.get("CODEXY_RUNTIME_GIT_REPOSITORY", REPOSITORY),
+            git_ref=os.environ.get("CODEXY_RUNTIME_GIT_REF", ""),
+            offline=os.environ.get("UV_OFFLINE", "").lower() in {"1", "true", "yes"},
+            git_fallback=os.environ.get("CODEXY_RUNTIME_GIT_FALLBACK") == "1",
+        )
+
+
+def _cache_root(server: str) -> Path:
+    explicit = _absolute_env_path("CODEXY_RUNTIME_CACHE_DIR")
+    if explicit:
+        return explicit
+    xdg, home = os.environ.get("XDG_CACHE_HOME"), os.environ.get("HOME")
+    if not xdg and not home:
+        _fail(f"codexy-mcp-{server} cannot bootstrap runtime without HOME, XDG_CACHE_HOME, or CODEXY_RUNTIME_CACHE_DIR")
+    root = Path(xdg) if xdg else Path(home or "") / ".cache"
+    if not root.is_absolute():
+        _fail(f"codexy-mcp-{server} runtime cache dir must be absolute: {root}")
+    return root / "codexy" / "runtime"
+
+
+def _execute(config: Configuration, path: Path) -> NoReturn:
+    execute(path, config.arguments, {"CODEXY_PLUGIN_ROOT": str(config.plugin_root)})
+
+
+def run(config: Configuration) -> NoReturn:
+    runtime_dir = _absolute_env_path("CODEXY_RUNTIME_DIR")
+    if runtime_dir:
+        runtime = runtime_dir / config.runtime_name
+        if not executable(runtime):
+            _fail(f"codexy-mcp-{config.server} runtime not found in CODEXY_RUNTIME_DIR: {runtime}")
+        _execute(config, runtime)
+    if config.platform not in SUPPORTED_PLATFORMS:
+        _fail(f"codexy-mcp-{config.server} bundled runtime supports: {' '.join(SUPPORTED_PLATFORMS)}; set CODEXY_RUNTIME_DIR for {config.platform}")
+    bundled = config.plugin_root / "runtime" / config.runtime_name
+    if executable(bundled):
+        _execute(config, bundled)
+    source = "\n".join(("package-override", config.package_path, config.package_url, config.artifacts_api, config.package_sha256)) if config.package_override else "\n".join(("package-default", config.package_sha256))
+    key = runtime_cache_key(manifest=config.manifest, package_override=config.package_override, identity=[config.git_repository, config.git_ref, config.platform, PROTOCOL, source, f"codexy-mcp-{config.server}"])
+    install_root = _cache_root(config.server) / key
+    installed, marker = install_root / "bin" / f"codexy-mcp-{config.server}", install_root / "plugin.json"
+    if executable(installed) and config.package_override:
+        _execute(config, installed)
+    if executable(installed) and marker.is_file() and releases_match(config.manifest, marker)[0]:
+        _execute(config, installed)
+    if config.offline:
+        _fail(f"codexy-mcp-{config.server} offline mode has no cached or bundled runtime for {config.platform}")
+    try:
+        _notice(f"acquiring exact release package v{config.release} for {config.server}")
+        install_package(config, install_root, installed)
+        _execute(config, installed)
+    except (OSError, RuntimeError, ValueError) as package_error:
+        if config.package_override:
+            _fail(f"codexy-mcp-{config.server} explicit package source failed: {package_error}")
+        if not config.git_fallback:
+            _fail(f"codexy-mcp-{config.server} exact release package failed: {package_error}")
+        _notice(f"release package failed ({package_error}); explicit Git fallback uses {config.git_ref}")
+    try:
+        install_git(config, install_root, installed)
+        _execute(config, installed)
+    except (OSError, RuntimeError) as git_error:
+        _fail(f"codexy-mcp-{config.server} pinned Git runtime failed: {git_error}")
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(prog="codexy-mcp-runtime")
+    parser.add_argument("server", choices=("lsp", "codegraph"))
+    parser.add_argument("--plugin-root", type=Path, required=True)
+    parsed, arguments = parser.parse_known_args()
+    arguments = arguments[1:] if arguments[:1] == ["--"] else arguments
+    run(Configuration.load(parsed.server, parsed.plugin_root.resolve(), arguments))