iac-code 0.2.2__tar.gz → 0.3.0__tar.gz

{iac_code-0.2.2 → iac_code-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: iac_code
-Version: 0.2.2
+Version: 0.3.0
 Summary: Your AI-powered Infrastructure as Code assistant
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.10
@@ -34,8 +34,16 @@ License-File: LICENSE
 
 > **Documentation**: [https://aliyun.github.io/iac-code/](https://aliyun.github.io/iac-code/)
 
+<p align="center">
+  <img src="website/static/img/demo_en.gif" alt="iac-code demo" width="100%">
+</p>
+
 ## Installation
 
+IaC Code requires Python 3.10 or later. It supports macOS, Linux, and Windows.
+
+> **Windows note**: On Windows, [Git for Windows](https://gitforwindows.org/) must be installed to provide the bash shell used by the tool execution environment. If Git Bash is installed but not on PATH, set the `IAC_CODE_GIT_BASH_PATH` environment variable.
+
 ```bash
 pip install iac-code
 ```

{iac_code-0.2.2 → iac_code-0.3.0}/README.md

@@ -15,8 +15,16 @@
 
 > **Documentation**: [https://aliyun.github.io/iac-code/](https://aliyun.github.io/iac-code/)
 
+<p align="center">
+  <img src="website/static/img/demo_en.gif" alt="iac-code demo" width="100%">
+</p>
+
 ## Installation
 
+IaC Code requires Python 3.10 or later. It supports macOS, Linux, and Windows.
+
+> **Windows note**: On Windows, [Git for Windows](https://gitforwindows.org/) must be installed to provide the bash shell used by the tool execution environment. If Git Bash is installed but not on PATH, set the `IAC_CODE_GIT_BASH_PATH` environment variable.
+
 ```bash
 pip install iac-code
 ```

{iac_code-0.2.2 → iac_code-0.3.0}/pyproject.toml

@@ -68,6 +68,7 @@ dev = [
     "pre-commit>=4.0",
     "pytest-xdist>=3.0",
     "pytest-cov>=5.0",
+    "pytest-timeout>=2.3.1",
     "setuptools>=68.0",
     "wheel",
     "tomli>=2.0; python_version<\"3.11\"",
@@ -111,6 +112,9 @@ index-url = "https://mirrors.aliyun.com/pypi/simple/"
 url = "https://mirrors.aliyun.com/pypi/simple/"
 default = true
 
+[tool.pytest.ini_options]
+timeout = 30
+
 [tool.coverage.run]
 source_pkgs = ["iac_code"]
 branch = true

{iac_code-0.2.2 → iac_code-0.3.0}/setup.py

@@ -1,11 +1,11 @@
 """Custom build hook to inject __release_date__ at build time."""
 
+import platform
 import re
 import subprocess
 import sys
 from datetime import date
 from pathlib import Path
-import platform
 
 from setuptools import setup
 from setuptools.command.build_py import build_py
@@ -57,15 +57,16 @@ def _ensure_babel():
     except Exception as exc:
         attempts.append("ensurepip + pip -> %s" % exc)
 
-    # 3) apt-get install python3-babel (Debian/Ubuntu container with root)
-    try:
-        _run(["apt-get", "update", "-qq"])
-        _run(["apt-get", "install", "-y", "-qq", "python3-babel"])
-        result = _try_import_babel()
-        if result:
-            return result
-    except Exception as exc:
-        attempts.append("apt-get install python3-babel -> %s" % exc)
+    # 3) apt-get install python3-babel (Debian/Ubuntu container with root) — Linux only
+    if sys.platform == "linux":
+        try:
+            _run(["apt-get", "update", "-qq"])
+            _run(["apt-get", "install", "-y", "-qq", "python3-babel"])
+            result = _try_import_babel()
+            if result:
+                return result
+        except Exception as exc:
+            attempts.append("apt-get install python3-babel -> %s" % exc)
 
     # 4) download get-pip.py via urllib, bootstrap pip, then pip install babel
     try:

iac_code-0.3.0/src/iac_code/__init__.py

@@ -0,0 +1,2 @@
+__version__ = "0.3.0"
+__release_date__ = "2026-05-29"

{iac_code-0.2.2 → iac_code-0.3.0}/src/iac_code/a2a/agent_card.py

@@ -18,10 +18,12 @@ from a2a.types import (
 from google.protobuf.json_format import ParseDict
 
 from iac_code import __version__
+from iac_code.a2a.exposure import format_a2a_exposure_types
 from iac_code.a2a.parts import supported_input_mime_types
 from iac_code.a2a.signing import sign_agent_card_dict
 
 IAC_CODE_ARTIFACT_METADATA_EXTENSION_URI = "urn:iac-code:a2a:artifact-metadata:v1"
+IAC_CODE_THINKING_EXPOSURE_EXTENSION_URI = "urn:iac-code:a2a:thinking-exposure:v1"
 
 
 def _base_url(host: str, port: int) -> str:
@@ -66,6 +68,7 @@ def build_agent_card(
     push_notifications: bool = False,
     supported_interfaces: list[dict[str, str]] | None = None,
     agent_extensions: Any = None,
+    thinking_exposure_types: Any = None,
 ) -> AgentCard:
     url = _base_url(host, port)
     description = "AI-powered Infrastructure as Code assistant for Alibaba Cloud ROS and Terraform workflows."
@@ -152,6 +155,19 @@ def build_agent_card(
             required=False,
         )
     )
+    if thinking_exposure_types is not None:
+        enabled_types = format_a2a_exposure_types(thinking_exposure_types)
+        if enabled_types:
+            extension = AgentExtension(
+                uri=IAC_CODE_THINKING_EXPOSURE_EXTENSION_URI,
+                description=(
+                    "Optional iac-code metadata namespace for selected thinking exposure signals. "
+                    "Raw thinking is emitted only when raw_thinking is enabled."
+                ),
+                required=False,
+            )
+            ParseDict({"enabledTypes": enabled_types}, extension.params)
+            card.capabilities.extensions.append(extension)
     for item in _iter_agent_extensions(agent_extensions):
         card.capabilities.extensions.append(_agent_extension_from_dict(item))
 

{iac_code-0.2.2 → iac_code-0.3.0}/src/iac_code/a2a/app.py

@@ -166,6 +166,7 @@ def create_app(
     supported_interfaces: list[dict[str, str]] | None = None,
     agent_extensions: object | None = None,
     auto_approve_permissions: bool = False,
+    thinking_exposure: object | None = None,
 ) -> Starlette:
     from iac_code.a2a.transports.dispatcher import create_runtime_components
 
@@ -194,6 +195,7 @@ def create_app(
         supported_interfaces=supported_interfaces,
         agent_extensions=agent_extensions,
         auto_approve_permissions=auto_approve_permissions,
+        thinking_exposure=thinking_exposure,
     )
 
     @asynccontextmanager
@@ -287,8 +289,9 @@ def run_server(
     push_consumer_name: str | None = None,
     push_lease_timeout_ms: int = 300_000,
     auto_approve_permissions: bool = False,
+    thinking_exposure: object | None = None,
 ) -> None:
-    from iac_code.a2a.transports.base import normalize_transport_name
+    from iac_code.a2a.transports.base import normalize_transport_name, validate_transport_for_platform
 
     normalized_transport = normalize_transport_name(transport)
     if persistence_dir is None:
@@ -305,6 +308,8 @@ def run_server(
     if push_queue == "redis-streams" and not push_redis_url:
         raise RuntimeError("--push-redis-url is required for --push-queue redis-streams.")
 
+    validate_transport_for_platform(normalized_transport)
+
     supported_interfaces = _supported_interfaces(
         transport=normalized_transport,
         host=host,
@@ -345,6 +350,7 @@ def run_server(
         "push_lease_timeout_ms": push_lease_timeout_ms,
         "supported_interfaces": supported_interfaces,
         "auto_approve_permissions": auto_approve_permissions,
+        "thinking_exposure": thinking_exposure,
     }
 
     if normalized_transport == "stdio":
@@ -442,6 +448,7 @@ def run_server(
             push_lease_timeout_ms=push_lease_timeout_ms,
             supported_interfaces=supported_interfaces,
             auto_approve_permissions=auto_approve_permissions,
+            thinking_exposure=thinking_exposure,
         )
 
     try:

{iac_code-0.2.2 → iac_code-0.3.0}/src/iac_code/a2a/client.py

@@ -302,7 +302,7 @@ class A2AClient:
         message: dict[str, Any] = {
             "messageId": str(uuid.uuid4()),
             "role": "ROLE_USER",
-            "parts": [{"kind": "text", "text": prompt}],
+            "parts": [{"text": prompt}],
             "metadata": {"iac_code": {"cwd": cwd}},
         }
         if context_id:

{iac_code-0.2.2 → iac_code-0.3.0}/src/iac_code/a2a/events.py

@@ -18,6 +18,7 @@ from a2a.types import (
 )
 from google.protobuf.json_format import ParseDict
 
+from iac_code.a2a.exposure import A2AExposureType, normalize_a2a_exposure_types
 from iac_code.types.stream_events import (
     ErrorEvent,
     MessageEndEvent,
@@ -31,6 +32,7 @@ from iac_code.types.stream_events import (
 )
 
 _METADATA_MAX_CHARS = 4000
+_ERROR_TEXT_MAX_CHARS = 1000
 _METADATA_MAX_DEPTH = 32
 logger = logging.getLogger(__name__)
 A2APermissionResolver: TypeAlias = Callable[[PermissionRequestEvent], "bool | Awaitable[bool]"]
@@ -169,7 +171,10 @@ async def publish_stream_event(
     artifact_store: Any | None = None,
     permission_resolver: A2APermissionResolver | None = None,
     auto_approve_permissions: bool = False,
+    exposure_types: Any = None,
 ) -> str | None:
+    enabled_exposure_types = normalize_a2a_exposure_types(exposure_types)
+
     if isinstance(event, TextDeltaEvent):
         if not event.text:
             return None
@@ -183,9 +188,20 @@ async def publish_stream_event(
         return event.text
 
     if isinstance(event, ThinkingDeltaEvent):
+        if A2AExposureType.RAW_THINKING not in enabled_exposure_types:
+            return None
+        await _enqueue_status(
+            event_queue,
+            task_id=task_id,
+            context_id=context_id,
+            state=TaskState.TASK_STATE_WORKING,
+            metadata={"iac_code": {"thinking": {"type": "raw_thinking", "text": _truncate(event.text)}}},
+        )
         return None
 
     if isinstance(event, ToolUseStartEvent):
+        if A2AExposureType.TOOL_TRACE not in enabled_exposure_types:
+            return None
         await _enqueue_status(
             event_queue,
             task_id=task_id,
@@ -196,6 +212,8 @@ async def publish_stream_event(
         return None
 
     if isinstance(event, ToolInputDeltaEvent):
+        if A2AExposureType.TOOL_TRACE not in enabled_exposure_types:
+            return None
         await _enqueue_status(
             event_queue,
             task_id=task_id,
@@ -214,6 +232,8 @@ async def publish_stream_event(
         return None
 
     if isinstance(event, ToolUseEndEvent):
+        if A2AExposureType.TOOL_TRACE not in enabled_exposure_types:
+            return None
         await _enqueue_status(
             event_queue,
             task_id=task_id,
@@ -234,6 +254,12 @@ async def publish_stream_event(
 
     if isinstance(event, ToolResultEvent):
         artifact_metadata = _extract_artifact_metadata(event.result, artifact_store)
+        if A2AExposureType.TOOL_TRACE not in enabled_exposure_types:
+            if artifact_metadata is not None:
+                await event_queue.enqueue_event(
+                    _artifact_update_event(task_id=task_id, context_id=context_id, metadata=artifact_metadata)
+                )
+            return None
         tool_metadata = {
             "status": "failed" if event.is_error else "completed",
             "toolUseId": event.tool_use_id,
@@ -261,6 +287,8 @@ async def publish_stream_event(
             approved = bool(await decision) if inspect.isawaitable(decision) else bool(decision)
         if event.response_future is not None and not event.response_future.done():
             event.response_future.set_result(approved)
+        if A2AExposureType.TOOL_TRACE not in enabled_exposure_types:
+            return None
         await _enqueue_status(
             event_queue,
             task_id=task_id,
@@ -298,18 +326,19 @@ async def publish_stream_event(
         return None
 
     if isinstance(event, ErrorEvent):
+        if event.is_retryable:
+            text = "A temporary error occurred. Please retry."
+            state = TaskState.TASK_STATE_INPUT_REQUIRED
+        else:
+            raw = event.error or "Unknown error"
+            text = raw[:_ERROR_TEXT_MAX_CHARS]
+            state = TaskState.TASK_STATE_FAILED
         await _enqueue_status(
             event_queue,
             task_id=task_id,
             context_id=context_id,
-            state=TaskState.TASK_STATE_INPUT_REQUIRED if event.is_retryable else TaskState.TASK_STATE_FAILED,
-            message=_agent_text_message(
-                task_id=task_id,
-                context_id=context_id,
-                text="A temporary error occurred. Please retry."
-                if event.is_retryable
-                else "An internal error occurred.",
-            ),
+            state=state,
+            message=_agent_text_message(task_id=task_id, context_id=context_id, text=text),
         )
         return None
 

{iac_code-0.2.2 → iac_code-0.3.0}/src/iac_code/a2a/executor.py

@@ -15,6 +15,7 @@ from a2a.types import Message, Role, Task, TaskState, TaskStatus, TaskStatusUpda
 from google.protobuf.json_format import MessageToDict
 
 from iac_code.a2a.events import make_text_part, publish_stream_event
+from iac_code.a2a.exposure import normalize_a2a_exposure_types
 from iac_code.a2a.metrics import A2AMetrics, NoOpA2AMetrics
 from iac_code.a2a.parts import allowed_cwd_roots, is_relative_to, parts_to_prompt
 from iac_code.a2a.task_store import A2ATaskStore
@@ -26,9 +27,20 @@ from iac_code.a2a.types import (
 )
 from iac_code.services.agent_factory import AgentFactoryOptions, create_agent_runtime
 from iac_code.services.session_storage import SessionStorage
+from iac_code.services.telemetry import use_session_id
 
 logger = logging.getLogger(__name__)
 _CONTEXT_LOCK_ACQUIRE_TIMEOUT_SECONDS = 1
+_ERROR_TEXT_MAX_CHARS = 1000
+
+
+def _format_exception(exc: BaseException) -> str:
+    message = str(exc)
+    if not message:
+        return type(exc).__name__
+    return f"{type(exc).__name__}: {message[:_ERROR_TEXT_MAX_CHARS]}"
+
+
 A2APermissionResolver: TypeAlias = Callable[[Any], "bool | Awaitable[bool]"]
 
 
@@ -51,6 +63,7 @@ class IacCodeA2AExecutor(AgentExecutor):
         push_notifier: Any | None = None,
         permission_resolver: A2APermissionResolver | None = None,
         auto_approve_permissions: bool = False,
+        thinking_exposure_types: Any = None,
     ) -> None:
         self._task_store = task_store
         self._model = model
@@ -59,6 +72,7 @@ class IacCodeA2AExecutor(AgentExecutor):
         self._push_notifier = push_notifier
         self._permission_resolver = permission_resolver
         self._auto_approve_permissions = auto_approve_permissions
+        self._thinking_exposure_types = normalize_a2a_exposure_types(thinking_exposure_types)
 
     async def execute(self, context: RequestContext, event_queue: EventQueue) -> None:
         task_id = context.task_id or "task-" + uuid.uuid4().hex[:12]
@@ -208,18 +222,20 @@ class IacCodeA2AExecutor(AgentExecutor):
                     context_id=context_id,
                     state=TaskState.TASK_STATE_WORKING,
                 )
-                async for event in runtime.agent_loop.run_streaming(prompt):
-                    text_chunk = await publish_stream_event(
-                        event_queue,
-                        task_id=task_id,
-                        context_id=context_id,
-                        event=event,
-                        artifact_store=self._artifact_store,
-                        permission_resolver=self._permission_resolver,
-                        auto_approve_permissions=self._auto_approve_permissions,
-                    )
-                    if text_chunk:
-                        task.output_text.append(text_chunk)
+                with use_session_id(ctx.session_id):
+                    async for event in runtime.agent_loop.run_streaming(prompt):
+                        text_chunk = await publish_stream_event(
+                            event_queue,
+                            task_id=task_id,
+                            context_id=context_id,
+                            event=event,
+                            artifact_store=self._artifact_store,
+                            permission_resolver=self._permission_resolver,
+                            auto_approve_permissions=self._auto_approve_permissions,
+                            exposure_types=self._thinking_exposure_types,
+                        )
+                        if text_chunk:
+                            task.output_text.append(text_chunk)
                 task.state = TASK_STATE_INPUT_REQUIRED
                 await self._publish_status(
                     event_queue,
@@ -274,6 +290,17 @@ class IacCodeA2AExecutor(AgentExecutor):
                 ctx.touch()
                 task.touch()
                 self._task_store.mirror_context(ctx)
+                # Force-flush telemetry between tasks. The a2a server may run in
+                # an ephemeral sandbox that's destroyed immediately after the
+                # response is delivered, before the natural batch interval or
+                # process-exit graceful_shutdown can run. Synchronous flush is
+                # offloaded to a worker thread so the event loop is not blocked.
+                from iac_code.services.telemetry import flush_telemetry
+
+                try:
+                    await asyncio.to_thread(flush_telemetry)
+                except Exception:
+                    logger.debug("flush_telemetry after task failed", exc_info=True)
         finally:
             lock.release()
 
@@ -338,7 +365,7 @@ class IacCodeA2AExecutor(AgentExecutor):
         if status == 401:
             return "Authentication required. Please configure your API credentials."
         logger.exception("Unhandled A2A executor error")
-        return "An internal error occurred."
+        return _format_exception(exc)
 
     async def _publish_status(
         self,

iac_code-0.3.0/src/iac_code/a2a/exposure.py

@@ -0,0 +1,66 @@
+from __future__ import annotations
+
+from collections.abc import Iterable
+from enum import Enum
+from typing import Any
+
+
+class A2AExposureType(str, Enum):
+    RAW_THINKING = "raw_thinking"
+    TOOL_TRACE = "tool_trace"
+
+
+_EXPOSURE_TYPE_ORDER = (
+    A2AExposureType.RAW_THINKING,
+    A2AExposureType.TOOL_TRACE,
+)
+_SUPPORTED_TYPE_NAMES = ", ".join(item.value.replace("_", "-") for item in _EXPOSURE_TYPE_ORDER)
+_DISABLED_ALIASES = frozenset({"", "none", "off", "false", "0"})
+_ALL_ALIASES = frozenset({"all", "*"})
+DEFAULT_A2A_EXPOSURE_TYPES = frozenset({A2AExposureType.TOOL_TRACE})
+
+
+def normalize_a2a_exposure_types(value: Any) -> frozenset[A2AExposureType]:
+    if value is None:
+        return DEFAULT_A2A_EXPOSURE_TYPES
+
+    tokens = list(_iter_exposure_tokens(value))
+    if not tokens:
+        return frozenset()
+    if any(token in _ALL_ALIASES for token in tokens):
+        return frozenset(_EXPOSURE_TYPE_ORDER)
+    tokens = [token for token in tokens if token not in _DISABLED_ALIASES]
+    return frozenset(_exposure_type_from_token(token) for token in tokens)
+
+
+def format_a2a_exposure_types(value: Any) -> list[str]:
+    enabled = normalize_a2a_exposure_types(value)
+    return [item.value for item in _EXPOSURE_TYPE_ORDER if item in enabled]
+
+
+def _iter_exposure_tokens(value: Any) -> Iterable[str]:
+    if isinstance(value, A2AExposureType):
+        yield value.value
+        return
+    if isinstance(value, str):
+        for item in value.replace(";", ",").split(","):
+            token = item.strip().lower().replace("-", "_")
+            if token:
+                yield token
+        return
+    if isinstance(value, Iterable) and not isinstance(value, dict):
+        for item in value:
+            yield from _iter_exposure_tokens(item)
+        return
+    raise ValueError(
+        f"A2A thinking exposure must be a string or list of strings. Supported values: {_SUPPORTED_TYPE_NAMES}."
+    )
+
+
+def _exposure_type_from_token(token: str) -> A2AExposureType:
+    try:
+        return A2AExposureType(token)
+    except ValueError as exc:
+        raise ValueError(
+            f"Unsupported A2A thinking exposure type {token!r}. Supported values: {_SUPPORTED_TYPE_NAMES}."
+        ) from exc

{iac_code-0.2.2 → iac_code-0.3.0}/src/iac_code/a2a/parts.py

@@ -9,6 +9,7 @@ from collections.abc import Iterable
 from pathlib import Path
 from typing import Any
 from urllib.parse import unquote, urlparse
+from urllib.request import url2pathname
 
 from google.protobuf.json_format import MessageToDict
 
@@ -129,7 +130,7 @@ def _read_file_url_part(url: str, *, cwd: Path) -> str:
         raise ValueError("A2A file URL parts must use local file:// URLs.")
 
     cwd_path = cwd.resolve()
-    path = Path(unquote(parsed.path)).resolve()
+    path = Path(url2pathname(unquote(parsed.path))).resolve()
     if not is_relative_to(path, cwd_path) or not any(is_relative_to(path, root) for root in allowed_cwd_roots()):
         raise ValueError("A2A file URL part is outside the allowed workspace.")
     if not path.is_file():
@@ -199,7 +200,7 @@ def _safe_file_url_path(url: str, *, cwd: Path) -> Path:
         raise ValueError("A2A file URL parts must use local file:// URLs.")
 
     cwd_path = cwd.resolve()
-    path = Path(unquote(parsed.path)).resolve()
+    path = Path(url2pathname(unquote(parsed.path))).resolve()
     if not is_relative_to(path, cwd_path) or not any(is_relative_to(path, root) for root in allowed_cwd_roots()):
         raise ValueError("A2A file URL part is outside the allowed workspace.")
     if not path.is_file():

{iac_code-0.2.2 → iac_code-0.3.0}/src/iac_code/a2a/push.py

@@ -4,7 +4,6 @@ import asyncio
 import base64
 import hashlib
 import json
-import os
 import uuid
 from dataclasses import asdict, dataclass
 from ipaddress import ip_address
@@ -26,6 +25,7 @@ from iac_code.a2a.persistence import A2APersistenceStore
 from iac_code.a2a.push_queue import A2APushJob, A2APushQueue, LocalFileA2APushQueue
 from iac_code.a2a.push_secrets import A2APushSecretKeyring
 from iac_code.a2a.types import validate_protocol_id
+from iac_code.utils.file_security import restrict_file_permissions, safe_replace
 
 
 class InvalidPushNotificationConfigError(ValueError):
@@ -74,7 +74,7 @@ class A2APushConfigStore(PushNotificationConfigStore):
         self._root = Path(persistence.root) / "push_configs"
         self._secret_keyring = secret_keyring or A2APushSecretKeyring(Path(persistence.root) / "push_keys.json")
         self._root.mkdir(parents=True, exist_ok=True)
-        _chmod_private(self._root, directory=True)
+        restrict_file_permissions(self._root, directory=True)
 
     async def set_info(
         self,
@@ -95,7 +95,7 @@ class A2APushConfigStore(PushNotificationConfigStore):
 
         path = self._config_path(_owner(context), task_id, config.id)
         path.parent.mkdir(parents=True, exist_ok=True)
-        _chmod_private(path.parent, directory=True)
+        restrict_file_permissions(path.parent, directory=True)
         data = self._config_to_storage(config)
         _write_json_atomic(path, data)
 
@@ -304,19 +304,12 @@ def _owner(context: ServerCallContext) -> str:
     return resolve_user_scope(context)
 
 
-def _chmod_private(path: Path, *, directory: bool) -> None:
-    try:
-        os.chmod(path, 0o700 if directory else 0o600)
-    except OSError:
-        return
-
-
 def _write_json_atomic(path: Path, data: dict[str, Any]) -> None:
     tmp_path = path.with_name(f".{path.name}.{uuid.uuid4().hex}.tmp")
     try:
         tmp_path.write_text(json.dumps(data, ensure_ascii=False, sort_keys=True), encoding="utf-8")
-        _chmod_private(tmp_path, directory=False)
-        os.replace(tmp_path, path)
-        _chmod_private(path, directory=False)
+        restrict_file_permissions(tmp_path, directory=False)
+        safe_replace(str(tmp_path), str(path))
+        restrict_file_permissions(path, directory=False)
     finally:
         tmp_path.unlink(missing_ok=True)

{iac_code-0.2.2 → iac_code-0.3.0}/src/iac_code/a2a/push_queue.py

@@ -13,6 +13,7 @@ from pathlib import Path
 from typing import Any, Protocol
 
 from iac_code.a2a.push_secrets import A2APushSecretKeyring
+from iac_code.utils.file_security import restrict_file_permissions
 
 _REDACTED_HEADERS = {"authorization", "x-a2a-notification-token", "x-api-key", "api-key"}
 _ENCRYPTED_JOB_FIELD = "iacCodeEncryptedPushJob"
@@ -127,7 +128,7 @@ class LocalFileA2APushQueue:
         self.dead_dir = self.root / "dead"
         for path in (self.pending_dir, self.inflight_dir, self.dead_dir):
             path.mkdir(parents=True, exist_ok=True)
-            self._chmod_private(path, directory=True)
+            restrict_file_permissions(path, directory=True)
 
     async def enqueue(self, job: A2APushJob) -> None:
         self._write(self.pending_dir / f"{job.job_id}.json", job)
@@ -163,7 +164,7 @@ class LocalFileA2APushQueue:
 
     def _write(self, path: Path, job: A2APushJob) -> None:
         path.write_text(_serialize_push_job(job, secret_keyring=self._secret_keyring), encoding="utf-8")
-        self._chmod_private(path, directory=False)
+        restrict_file_permissions(path, directory=False)
 
     def _read(self, path: Path) -> A2APushJob:
         return _deserialize_push_job(path.read_text(encoding="utf-8"), secret_keyring=self._secret_keyring)
@@ -180,12 +181,6 @@ class LocalFileA2APushQueue:
                 job.with_attempt(attempt=job.attempt, next_attempt_at=now, last_error="Delivery lease expired."),
             )
 
-    def _chmod_private(self, path: Path, *, directory: bool) -> None:
-        try:
-            os.chmod(path, 0o700 if directory else 0o600)
-        except OSError:
-            return
-
 
 class RedisStreamsA2APushQueue:
     def __init__(

{iac_code-0.2.2 → iac_code-0.3.0}/src/iac_code/a2a/push_secrets.py

@@ -9,6 +9,8 @@ from typing import Any
 
 from cryptography.fernet import Fernet, InvalidToken
 
+from iac_code.utils.file_security import restrict_file_permissions
+
 
 class A2APushSecretError(ValueError):
     pass
@@ -90,7 +92,7 @@ class A2APushSecretKeyring:
 
     def _write(self) -> None:
         self._path.parent.mkdir(parents=True, exist_ok=True)
-        _chmod_private(self._path.parent, directory=True)
+        restrict_file_permissions(self._path.parent, directory=True)
         data = {
             "activeKeyId": self._active_key_id,
             "keys": [
@@ -99,15 +101,8 @@ class A2APushSecretKeyring:
             ],
         }
         self._path.write_text(json.dumps(data, sort_keys=True), encoding="utf-8")
-        _chmod_private(self._path, directory=False)
+        restrict_file_permissions(self._path, directory=False)
 
 
 def _new_key_id() -> str:
     return f"push-{int(time.time())}-{uuid.uuid4().hex[:12]}"
-
-
-def _chmod_private(path: Path, *, directory: bool) -> None:
-    try:
-        os.chmod(path, 0o700 if directory else 0o600)
-    except OSError:
-        return