greft 0.1.4__py3-none-any.whl

adapters/reference/dynamic_remote_server.py

@@ -0,0 +1,243 @@
+"""Dynamic remote HTTP MCP server for Greft demo identities.
+
+One deployed service can expose many prototype identities:
+
+    /@alice-demo/mcp -> @alice-demo
+    /@bob-demo/mcp   -> @bob-demo
+
+The identity is selected from the URL path. For this pre-demo, identities are
+created automatically. If ``GREFT_DYNAMIC_IDENTITY_BUCKET`` is configured, this
+legacy prototype can persist identity files to Google Cloud Storage. The current
+Supabase-first direction should replace that with database-backed identity
+ownership before any public production use.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import threading
+from contextvars import ContextVar
+from pathlib import Path
+from urllib.parse import quote, unquote
+
+import httpx
+from starlette.responses import JSONResponse, PlainTextResponse
+from starlette.types import ASGIApp, Receive, Scope, Send
+
+from adapters.reference.server import create_server
+from sdk.python.client import GreftClient
+
+API_URL = os.environ.get("GREFT_API_URL", "http://localhost:8000")
+IDENTITY_ROOT = Path(os.environ.get("GREFT_DYNAMIC_IDENTITY_ROOT", "/tmp/greft-dynamic-mcp"))  # noqa: S108
+GCS_BUCKET = os.environ.get("GREFT_DYNAMIC_IDENTITY_BUCKET", "")
+GCS_PREFIX = os.environ.get("GREFT_DYNAMIC_IDENTITY_PREFIX", "identities").strip("/")
+ADDRESS_RE = re.compile(r"^@[A-Za-z0-9][A-Za-z0-9._-]{1,62}$")
+
+_current_address: ContextVar[str | None] = ContextVar("greft_current_address", default=None)
+_locks: dict[str, threading.Lock] = {}
+_locks_guard = threading.Lock()
+
+
+def _address_slug(address: str) -> str:
+    return address.removeprefix("@")
+
+
+def _validate_address(address: str) -> str:
+    address = address.strip()
+    if not ADDRESS_RE.fullmatch(address):
+        msg = (
+            "Invalid Greft address. Use a path like /@alice-demo1/mcp. "
+            "Allowed: @ plus letters, numbers, dot, underscore, or dash; 3-64 chars total."
+        )
+        raise ValueError(msg)
+    return address
+
+
+def _home_for_address(address: str) -> Path:
+    return IDENTITY_ROOT / _address_slug(address)
+
+
+def _lock_for(address: str) -> threading.Lock:
+    with _locks_guard:
+        lock = _locks.get(address)
+        if lock is None:
+            lock = threading.Lock()
+            _locks[address] = lock
+        return lock
+
+
+def _metadata_token() -> str:
+    url = (
+        "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token"
+    )
+    with httpx.Client(timeout=10.0) as client:
+        resp = client.get(url, headers={"Metadata-Flavor": "Google"})
+        resp.raise_for_status()
+        return str(resp.json()["access_token"])
+
+
+def _gcs_object_name(address: str, filename: str) -> str:
+    return f"{GCS_PREFIX}/{_address_slug(address)}/{filename}"
+
+
+def _gcs_download(address: str, filename: str) -> bytes | None:
+    if not GCS_BUCKET:
+        return None
+    token = _metadata_token()
+    name = quote(_gcs_object_name(address, filename), safe="")
+    url = f"https://storage.googleapis.com/storage/v1/b/{GCS_BUCKET}/o/{name}?alt=media"
+    with httpx.Client(timeout=30.0) as client:
+        resp = client.get(url, headers={"Authorization": f"Bearer {token}"})
+        if resp.status_code == 404:
+            return None
+        resp.raise_for_status()
+        return resp.content
+
+
+def _gcs_upload(address: str, filename: str, content: bytes) -> None:
+    if not GCS_BUCKET:
+        return
+    token = _metadata_token()
+    name = quote(_gcs_object_name(address, filename), safe="")
+    url = f"https://storage.googleapis.com/upload/storage/v1/b/{GCS_BUCKET}/o"
+    with httpx.Client(timeout=30.0) as client:
+        resp = client.post(
+            url,
+            params={"uploadType": "media", "name": name},
+            content=content,
+            headers={
+                "Authorization": f"Bearer {token}",
+                "Content-Type": "application/octet-stream",
+            },
+        )
+        resp.raise_for_status()
+
+
+def _restore_identity(address: str, home: Path) -> None:
+    config = _gcs_download(address, "config.json")
+    key = _gcs_download(address, "private.key")
+    if config is None or key is None:
+        return
+    data = json.loads(config.decode())
+    agent_id = data["agent_id"]
+    home.mkdir(parents=True, exist_ok=True)
+    (home / "config.json").write_bytes(config)
+    keys_dir = home / "keys"
+    keys_dir.mkdir(parents=True, exist_ok=True)
+    key_path = keys_dir / f"{agent_id}.key"
+    key_path.write_bytes(key)
+    key_path.chmod(0o600)
+
+
+def _persist_identity(address: str, home: Path, client: GreftClient) -> None:
+    if client.agent_id is None:
+        return
+    config_path = home / "config.json"
+    key_path = home / "keys" / f"{client.agent_id}.key"
+    if config_path.exists():
+        _gcs_upload(address, "config.json", config_path.read_bytes())
+    if key_path.exists():
+        _gcs_upload(address, "private.key", key_path.read_bytes())
+
+
+def _ensure_identity(address: str) -> Path:
+    address = _validate_address(address)
+    home = _home_for_address(address)
+    with _lock_for(address):
+        if not (home / "config.json").exists():
+            _restore_identity(address, home)
+
+        with GreftClient(api_url=API_URL, home=home) as client:
+            if client.agent_id is None:
+                try:
+                    client.init(address)
+                except httpx.HTTPStatusError as exc:
+                    if exc.response.status_code == 409:
+                        msg = (
+                            f"{address} is already registered but this dynamic MCP service "
+                            "does not have its private key. Choose a new demo address."
+                        )
+                        raise RuntimeError(msg) from exc
+                    raise
+            elif client.address != address:
+                msg = f"{home} belongs to {client.address}, not {address}"
+                raise RuntimeError(msg)
+            client.ensure_session()
+            _persist_identity(address, home, client)
+    return home
+
+
+def _get_dynamic_client() -> GreftClient:
+    address = _current_address.get()
+    if address is None:
+        msg = "No Greft address selected. Use /@address/mcp."
+        raise RuntimeError(msg)
+    home = _ensure_identity(address)
+    client = GreftClient(api_url=API_URL, home=home)
+    try:
+        client.ensure_session()
+    except Exception:
+        client.close()
+        raise
+    return client
+
+
+async def _ready(scope: Scope, receive: Receive, send: Send) -> None:
+    response = JSONResponse(
+        {
+            "status": "ok",
+            "relay": API_URL,
+            "mode": "dynamic-url-identity",
+            "mcp_url_pattern": "/@address/mcp",
+            "identity_store": f"gs://{GCS_BUCKET}/{GCS_PREFIX}" if GCS_BUCKET else "local-only",
+        }
+    )
+    await response(scope, receive, send)
+
+
+class DynamicIdentityMCPApp:
+    """ASGI dispatcher that maps /@address/mcp to the shared MCP app."""
+
+    def __init__(self, mcp_app: ASGIApp) -> None:
+        self._mcp_app = mcp_app
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope["type"] != "http":
+            await self._mcp_app(scope, receive, send)
+            return
+
+        path = str(scope.get("path", ""))
+        if path in {"", "/", "/readyz"}:
+            await _ready(scope, receive, send)
+            return
+
+        parts = path.split("/")
+        if len(parts) >= 3 and parts[1].startswith("@") and parts[2] == "mcp":
+            address = _validate_address(unquote(parts[1]))
+            _ensure_identity(address)
+            token = _current_address.set(address)
+            try:
+                rewritten_scope = dict(scope)
+                rewritten_scope["path"] = "/" + "/".join(parts[2:])
+                rewritten_scope["raw_path"] = rewritten_scope["path"].encode()
+                await self._mcp_app(rewritten_scope, receive, send)
+            finally:
+                _current_address.reset(token)
+            return
+
+        response = PlainTextResponse(
+            "Use /@address/mcp, for example /@alice-demo1/mcp\n",
+            status_code=404,
+        )
+        await response(scope, receive, send)
+
+
+server = create_server(client_factory=_get_dynamic_client)
+_mcp_app = server.streamable_http_app(
+    streamable_http_path="/mcp",
+    stateless_http=True,
+    host="0.0.0.0",  # noqa: S104
+)
+app = DynamicIdentityMCPApp(_mcp_app)

adapters/reference/remote_server.py

@@ -0,0 +1,108 @@
+"""Remote HTTP MCP server for one demo Greft identity.
+
+Deploy one hosted service per demo profile:
+
+    greft-mcp-planner    -> /mcp -> @planner-cloud-demo1
+    greft-mcp-developer  -> /mcp -> @developer-cloud-demo1
+
+This keeps the prototype simple while letting the MCP Streamable HTTP app own
+its ASGI lifespan correctly.
+"""
+
+from __future__ import annotations
+
+import base64
+import json
+import os
+from pathlib import Path
+from typing import Any
+
+from starlette.responses import JSONResponse
+from starlette.routing import Route
+
+from adapters.reference.server import create_server
+from sdk.python.client import GreftClient
+
+API_URL = os.environ.get("GREFT_API_URL", "http://localhost:8000")
+PROFILE = os.environ.get("GREFT_REMOTE_MCP_PROFILE", "planner").strip().lower()
+
+
+def _env_name(suffix: str) -> str:
+    return f"GREFT_{PROFILE.upper()}_{suffix}"
+
+
+def _profile_address() -> str:
+    return os.environ.get(_env_name("ADDRESS"), f"@{PROFILE}-cloud-demo")
+
+
+def _profile_home() -> Path:
+    return Path(os.environ.get(_env_name("HOME"), f"/tmp/greft-remote-mcp/{PROFILE}"))  # noqa: S108
+
+
+def _restore_profile_home(home: Path) -> None:
+    config_b64 = os.environ.get(_env_name("CONFIG_B64"))
+    key_b64 = os.environ.get(_env_name("KEY_B64"))
+    if not config_b64 or not key_b64:
+        return
+
+    config = json.loads(base64.b64decode(config_b64).decode())
+    agent_id = config["agent_id"]
+    home.mkdir(parents=True, exist_ok=True)
+    (home / "config.json").write_text(json.dumps(config, indent=2))
+    keys_dir = home / "keys"
+    keys_dir.mkdir(parents=True, exist_ok=True)
+    key_path = keys_dir / f"{agent_id}.key"
+    key_path.write_bytes(base64.b64decode(key_b64))
+    key_path.chmod(0o600)
+
+
+def _ensure_profile() -> dict[str, Any]:
+    address = _profile_address()
+    home = _profile_home()
+    _restore_profile_home(home)
+
+    with GreftClient(api_url=API_URL, home=home) as client:
+        if client.agent_id is None:
+            client.init(address)
+        elif client.address != address:
+            msg = f"{home} belongs to {client.address}, not {address}"
+            raise RuntimeError(msg)
+        client.ensure_session()
+        return {
+            "profile": PROFILE,
+            "address": client.address,
+            "agent_id": client.agent_id,
+            "home": str(home),
+            "mcp_path": "/mcp",
+        }
+
+
+PROFILE_INFO = _ensure_profile()
+
+
+async def readyz(_request: Any) -> JSONResponse:
+    return JSONResponse(
+        {
+            "status": "ok",
+            "relay": API_URL,
+            "profile": PROFILE_INFO["profile"],
+            "address": PROFILE_INFO["address"],
+            "mcp_path": PROFILE_INFO["mcp_path"],
+        }
+    )
+
+
+async def index(_request: Any) -> JSONResponse:
+    return await readyz(_request)
+
+
+server = create_server(home=PROFILE_INFO["home"])
+app = server.streamable_http_app(
+    streamable_http_path="/mcp",
+    stateless_http=True,
+    host="0.0.0.0",  # noqa: S104
+    custom_starlette_routes=[
+        Route("/", index, methods=["GET"]),
+        Route("/readyz", readyz, methods=["GET"]),
+    ],
+)