iac-code 0.2.3__tar.gz → 0.3.1__tar.gz

{iac_code-0.2.3 → iac_code-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: iac_code
-Version: 0.2.3
+Version: 0.3.1
 Summary: Your AI-powered Infrastructure as Code assistant
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.10
@@ -34,8 +34,16 @@ License-File: LICENSE
 
 > **Documentation**: [https://aliyun.github.io/iac-code/](https://aliyun.github.io/iac-code/)
 
+<p align="center">
+  <img src="website/static/img/demo_en.gif" alt="iac-code demo" width="100%">
+</p>
+
 ## Installation
 
+IaC Code requires Python 3.10 or later. It supports macOS, Linux, and Windows.
+
+> **Windows note**: On Windows, [Git for Windows](https://gitforwindows.org/) must be installed to provide the bash shell used by the tool execution environment. If Git Bash is installed but not on PATH, set the `IAC_CODE_GIT_BASH_PATH` environment variable.
+
 ```bash
 pip install iac-code
 ```
@@ -66,6 +74,20 @@ Reading from stdin is also supported:
 echo "Create an OSS Bucket" | iac-code --prompt -
 ```
 
+## Contributing
+
+Install [uv](https://docs.astral.sh/uv/getting-started/installation/), then:
+
+```bash
+make install   # install dependencies and pre-commit hooks
+make dev       # run in debug mode
+make test      # run tests
+make lint      # run linters
+make format    # format code
+```
+
+See the [Contributing Guide](https://aliyun.github.io/iac-code/getting-started/contributing) for details.
+
 ## Contact Us
 
 | [DingTalk](https://qr.dingtalk.com/action/joingroup?code=v1,k1,ubm/77U7qRh/STFZUNBP26X4PNg2z6+uhiPcLGtDNfU=&_dt_no_comment=1&origin=11) | [Discord](https://discord.gg/qECFuFBwF) |

{iac_code-0.2.3 → iac_code-0.3.1}/README.md

@@ -15,8 +15,16 @@
 
 > **Documentation**: [https://aliyun.github.io/iac-code/](https://aliyun.github.io/iac-code/)
 
+<p align="center">
+  <img src="website/static/img/demo_en.gif" alt="iac-code demo" width="100%">
+</p>
+
 ## Installation
 
+IaC Code requires Python 3.10 or later. It supports macOS, Linux, and Windows.
+
+> **Windows note**: On Windows, [Git for Windows](https://gitforwindows.org/) must be installed to provide the bash shell used by the tool execution environment. If Git Bash is installed but not on PATH, set the `IAC_CODE_GIT_BASH_PATH` environment variable.
+
 ```bash
 pip install iac-code
 ```
@@ -47,6 +55,20 @@ Reading from stdin is also supported:
 echo "Create an OSS Bucket" | iac-code --prompt -
 ```
 
+## Contributing
+
+Install [uv](https://docs.astral.sh/uv/getting-started/installation/), then:
+
+```bash
+make install   # install dependencies and pre-commit hooks
+make dev       # run in debug mode
+make test      # run tests
+make lint      # run linters
+make format    # format code
+```
+
+See the [Contributing Guide](https://aliyun.github.io/iac-code/getting-started/contributing) for details.
+
 ## Contact Us
 
 | [DingTalk](https://qr.dingtalk.com/action/joingroup?code=v1,k1,ubm/77U7qRh/STFZUNBP26X4PNg2z6+uhiPcLGtDNfU=&_dt_no_comment=1&origin=11) | [Discord](https://discord.gg/qECFuFBwF) |

{iac_code-0.2.3 → iac_code-0.3.1}/pyproject.toml

@@ -21,6 +21,7 @@ dependencies = [
     "pyperclip>=1.8.0",
     "openai>=1.50",
     "httpx>=0.27.0",
+    "packaging>=24.0",
     "tiktoken>=0.7.0",
     "jsonschema>=4.20",
     "alibabacloud-ros20190910>=3.0.0",
@@ -32,8 +33,8 @@ dependencies = [
     "pillow==12.2.0",
     "cryptography>=42.0",
     "keyring>=25.0",
-    "tree-sitter>=0.23",
-    "tree-sitter-bash>=0.23",
+    "tree-sitter>=0.25,<0.26",
+    "tree-sitter-bash>=0.25,<0.26",
 ]
 
 [project.optional-dependencies]
@@ -68,6 +69,7 @@ dev = [
     "pre-commit>=4.0",
     "pytest-xdist>=3.0",
     "pytest-cov>=5.0",
+    "pytest-timeout>=2.3.1",
     "setuptools>=68.0",
     "wheel",
     "tomli>=2.0; python_version<\"3.11\"",
@@ -111,6 +113,9 @@ index-url = "https://mirrors.aliyun.com/pypi/simple/"
 url = "https://mirrors.aliyun.com/pypi/simple/"
 default = true
 
+[tool.pytest.ini_options]
+timeout = 30
+
 [tool.coverage.run]
 source_pkgs = ["iac_code"]
 branch = true

{iac_code-0.2.3 → iac_code-0.3.1}/setup.py

@@ -1,11 +1,11 @@
 """Custom build hook to inject __release_date__ at build time."""
 
+import platform
 import re
 import subprocess
 import sys
 from datetime import date
 from pathlib import Path
-import platform
 
 from setuptools import setup
 from setuptools.command.build_py import build_py
@@ -57,15 +57,16 @@ def _ensure_babel():
     except Exception as exc:
         attempts.append("ensurepip + pip -> %s" % exc)
 
-    # 3) apt-get install python3-babel (Debian/Ubuntu container with root)
-    try:
-        _run(["apt-get", "update", "-qq"])
-        _run(["apt-get", "install", "-y", "-qq", "python3-babel"])
-        result = _try_import_babel()
-        if result:
-            return result
-    except Exception as exc:
-        attempts.append("apt-get install python3-babel -> %s" % exc)
+    # 3) apt-get install python3-babel (Debian/Ubuntu container with root) — Linux only
+    if sys.platform == "linux":
+        try:
+            _run(["apt-get", "update", "-qq"])
+            _run(["apt-get", "install", "-y", "-qq", "python3-babel"])
+            result = _try_import_babel()
+            if result:
+                return result
+        except Exception as exc:
+            attempts.append("apt-get install python3-babel -> %s" % exc)
 
     # 4) download get-pip.py via urllib, bootstrap pip, then pip install babel
     try:

iac_code-0.3.1/src/iac_code/__init__.py

@@ -0,0 +1,2 @@
+__version__ = "0.3.1"
+__release_date__ = "2026-06-02"

{iac_code-0.2.3 → iac_code-0.3.1}/src/iac_code/a2a/agent_card.py

@@ -18,10 +18,12 @@ from a2a.types import (
 from google.protobuf.json_format import ParseDict
 
 from iac_code import __version__
+from iac_code.a2a.exposure import format_a2a_exposure_types
 from iac_code.a2a.parts import supported_input_mime_types
 from iac_code.a2a.signing import sign_agent_card_dict
 
 IAC_CODE_ARTIFACT_METADATA_EXTENSION_URI = "urn:iac-code:a2a:artifact-metadata:v1"
+IAC_CODE_THINKING_EXPOSURE_EXTENSION_URI = "urn:iac-code:a2a:thinking-exposure:v1"
 
 
 def _base_url(host: str, port: int) -> str:
@@ -66,6 +68,7 @@ def build_agent_card(
     push_notifications: bool = False,
     supported_interfaces: list[dict[str, str]] | None = None,
     agent_extensions: Any = None,
+    thinking_exposure_types: Any = None,
 ) -> AgentCard:
     url = _base_url(host, port)
     description = "AI-powered Infrastructure as Code assistant for Alibaba Cloud ROS and Terraform workflows."
@@ -152,6 +155,19 @@ def build_agent_card(
             required=False,
         )
     )
+    if thinking_exposure_types is not None:
+        enabled_types = format_a2a_exposure_types(thinking_exposure_types)
+        if enabled_types:
+            extension = AgentExtension(
+                uri=IAC_CODE_THINKING_EXPOSURE_EXTENSION_URI,
+                description=(
+                    "Optional iac-code metadata namespace for selected thinking exposure signals. "
+                    "Raw thinking is emitted only when raw_thinking is enabled."
+                ),
+                required=False,
+            )
+            ParseDict({"enabledTypes": enabled_types}, extension.params)
+            card.capabilities.extensions.append(extension)
     for item in _iter_agent_extensions(agent_extensions):
         card.capabilities.extensions.append(_agent_extension_from_dict(item))
 

{iac_code-0.2.3 → iac_code-0.3.1}/src/iac_code/a2a/app.py

@@ -166,6 +166,7 @@ def create_app(
     supported_interfaces: list[dict[str, str]] | None = None,
     agent_extensions: object | None = None,
     auto_approve_permissions: bool = False,
+    thinking_exposure: object | None = None,
 ) -> Starlette:
     from iac_code.a2a.transports.dispatcher import create_runtime_components
 
@@ -194,6 +195,7 @@ def create_app(
         supported_interfaces=supported_interfaces,
         agent_extensions=agent_extensions,
         auto_approve_permissions=auto_approve_permissions,
+        thinking_exposure=thinking_exposure,
     )
 
     @asynccontextmanager
@@ -287,8 +289,9 @@ def run_server(
     push_consumer_name: str | None = None,
     push_lease_timeout_ms: int = 300_000,
     auto_approve_permissions: bool = False,
+    thinking_exposure: object | None = None,
 ) -> None:
-    from iac_code.a2a.transports.base import normalize_transport_name
+    from iac_code.a2a.transports.base import normalize_transport_name, validate_transport_for_platform
 
     normalized_transport = normalize_transport_name(transport)
     if persistence_dir is None:
@@ -305,6 +308,8 @@ def run_server(
     if push_queue == "redis-streams" and not push_redis_url:
         raise RuntimeError("--push-redis-url is required for --push-queue redis-streams.")
 
+    validate_transport_for_platform(normalized_transport)
+
     supported_interfaces = _supported_interfaces(
         transport=normalized_transport,
         host=host,
@@ -345,6 +350,7 @@ def run_server(
         "push_lease_timeout_ms": push_lease_timeout_ms,
         "supported_interfaces": supported_interfaces,
         "auto_approve_permissions": auto_approve_permissions,
+        "thinking_exposure": thinking_exposure,
     }
 
     if normalized_transport == "stdio":
@@ -442,6 +448,7 @@ def run_server(
             push_lease_timeout_ms=push_lease_timeout_ms,
             supported_interfaces=supported_interfaces,
             auto_approve_permissions=auto_approve_permissions,
+            thinking_exposure=thinking_exposure,
         )
 
     try:

{iac_code-0.2.3 → iac_code-0.3.1}/src/iac_code/a2a/client.py

@@ -7,6 +7,7 @@ from time import monotonic
 from typing import Any, AsyncIterator
 
 import httpx
+from a2a.types import Role
 
 from iac_code.a2a.signing import AgentCardSignature, agent_card_signature_jwks_url, verify_agent_card_dict
 from iac_code.a2a.transport import A2AAuthConfig, A2ATransportBinding, UnsupportedA2ATransportError, headers_for_auth
@@ -31,19 +32,52 @@ class A2AClientResponse:
         if not isinstance(result, dict):
             return ""
         text = result.get("text")
-        if isinstance(text, str):
+        if isinstance(text, str) and text:
             return text
         status = result.get("status")
-        if not isinstance(status, dict):
-            return ""
-        message = status.get("message")
-        if not isinstance(message, dict):
-            return ""
-        parts = message.get("parts")
-        if not isinstance(parts, list) or not parts or not isinstance(parts[0], dict):
-            return ""
-        value = parts[0].get("text")
-        return value if isinstance(value, str) else ""
+        if isinstance(status, dict):
+            extracted = _extract_parts_text(status.get("message"))
+            if extracted:
+                return extracted
+        task = result.get("task")
+        if isinstance(task, dict):
+            task_status = task.get("status")
+            if isinstance(task_status, dict):
+                extracted = _extract_parts_text(task_status.get("message"))
+                if extracted:
+                    return extracted
+            history = task.get("history")
+            if isinstance(history, list):
+                for entry in reversed(history):
+                    extracted = _extract_agent_entry_text(entry)
+                    if extracted:
+                        return extracted
+        return ""
+
+
+_AGENT_ROLE_NAME = Role.Name(Role.ROLE_AGENT)
+
+
+def _extract_agent_entry_text(entry: Any) -> str:
+    if not isinstance(entry, dict) or entry.get("role") != _AGENT_ROLE_NAME:
+        return ""
+    return _extract_parts_text(entry)
+
+
+def _extract_parts_text(message: Any) -> str:
+    if not isinstance(message, dict):
+        return ""
+    parts = message.get("parts")
+    if not isinstance(parts, list):
+        return ""
+    pieces: list[str] = []
+    for part in parts:
+        if not isinstance(part, dict):
+            continue
+        value = part.get("text")
+        if isinstance(value, str):
+            pieces.append(value)
+    return "".join(pieces)
 
 
 class A2AClient:
@@ -302,7 +336,7 @@ class A2AClient:
         message: dict[str, Any] = {
             "messageId": str(uuid.uuid4()),
             "role": "ROLE_USER",
-            "parts": [{"kind": "text", "text": prompt}],
+            "parts": [{"text": prompt}],
             "metadata": {"iac_code": {"cwd": cwd}},
         }
         if context_id:

{iac_code-0.2.3 → iac_code-0.3.1}/src/iac_code/a2a/events.py

@@ -18,6 +18,7 @@ from a2a.types import (
 )
 from google.protobuf.json_format import ParseDict
 
+from iac_code.a2a.exposure import A2AExposureType, normalize_a2a_exposure_types
 from iac_code.types.stream_events import (
     ErrorEvent,
     MessageEndEvent,
@@ -170,7 +171,10 @@ async def publish_stream_event(
     artifact_store: Any | None = None,
     permission_resolver: A2APermissionResolver | None = None,
     auto_approve_permissions: bool = False,
+    exposure_types: Any = None,
 ) -> str | None:
+    enabled_exposure_types = normalize_a2a_exposure_types(exposure_types)
+
     if isinstance(event, TextDeltaEvent):
         if not event.text:
             return None
@@ -184,9 +188,20 @@ async def publish_stream_event(
         return event.text
 
     if isinstance(event, ThinkingDeltaEvent):
+        if A2AExposureType.RAW_THINKING not in enabled_exposure_types:
+            return None
+        await _enqueue_status(
+            event_queue,
+            task_id=task_id,
+            context_id=context_id,
+            state=TaskState.TASK_STATE_WORKING,
+            metadata={"iac_code": {"thinking": {"type": "raw_thinking", "text": _truncate(event.text)}}},
+        )
         return None
 
     if isinstance(event, ToolUseStartEvent):
+        if A2AExposureType.TOOL_TRACE not in enabled_exposure_types:
+            return None
         await _enqueue_status(
             event_queue,
             task_id=task_id,
@@ -197,6 +212,8 @@ async def publish_stream_event(
         return None
 
     if isinstance(event, ToolInputDeltaEvent):
+        if A2AExposureType.TOOL_TRACE not in enabled_exposure_types:
+            return None
         await _enqueue_status(
             event_queue,
             task_id=task_id,
@@ -215,6 +232,8 @@ async def publish_stream_event(
         return None
 
     if isinstance(event, ToolUseEndEvent):
+        if A2AExposureType.TOOL_TRACE not in enabled_exposure_types:
+            return None
         await _enqueue_status(
             event_queue,
             task_id=task_id,
@@ -235,6 +254,12 @@ async def publish_stream_event(
 
     if isinstance(event, ToolResultEvent):
         artifact_metadata = _extract_artifact_metadata(event.result, artifact_store)
+        if A2AExposureType.TOOL_TRACE not in enabled_exposure_types:
+            if artifact_metadata is not None:
+                await event_queue.enqueue_event(
+                    _artifact_update_event(task_id=task_id, context_id=context_id, metadata=artifact_metadata)
+                )
+            return None
         tool_metadata = {
             "status": "failed" if event.is_error else "completed",
             "toolUseId": event.tool_use_id,
@@ -262,6 +287,8 @@ async def publish_stream_event(
             approved = bool(await decision) if inspect.isawaitable(decision) else bool(decision)
         if event.response_future is not None and not event.response_future.done():
             event.response_future.set_result(approved)
+        if A2AExposureType.TOOL_TRACE not in enabled_exposure_types:
+            return None
         await _enqueue_status(
             event_queue,
             task_id=task_id,

{iac_code-0.2.3 → iac_code-0.3.1}/src/iac_code/a2a/executor.py

@@ -15,6 +15,7 @@ from a2a.types import Message, Role, Task, TaskState, TaskStatus, TaskStatusUpda
 from google.protobuf.json_format import MessageToDict
 
 from iac_code.a2a.events import make_text_part, publish_stream_event
+from iac_code.a2a.exposure import normalize_a2a_exposure_types
 from iac_code.a2a.metrics import A2AMetrics, NoOpA2AMetrics
 from iac_code.a2a.parts import allowed_cwd_roots, is_relative_to, parts_to_prompt
 from iac_code.a2a.task_store import A2ATaskStore
@@ -26,6 +27,7 @@ from iac_code.a2a.types import (
 )
 from iac_code.services.agent_factory import AgentFactoryOptions, create_agent_runtime
 from iac_code.services.session_storage import SessionStorage
+from iac_code.services.telemetry import use_session_id
 
 logger = logging.getLogger(__name__)
 _CONTEXT_LOCK_ACQUIRE_TIMEOUT_SECONDS = 1
@@ -61,6 +63,7 @@ class IacCodeA2AExecutor(AgentExecutor):
         push_notifier: Any | None = None,
         permission_resolver: A2APermissionResolver | None = None,
         auto_approve_permissions: bool = False,
+        thinking_exposure_types: Any = None,
     ) -> None:
         self._task_store = task_store
         self._model = model
@@ -69,6 +72,7 @@ class IacCodeA2AExecutor(AgentExecutor):
         self._push_notifier = push_notifier
         self._permission_resolver = permission_resolver
         self._auto_approve_permissions = auto_approve_permissions
+        self._thinking_exposure_types = normalize_a2a_exposure_types(thinking_exposure_types)
 
     async def execute(self, context: RequestContext, event_queue: EventQueue) -> None:
         task_id = context.task_id or "task-" + uuid.uuid4().hex[:12]
@@ -218,18 +222,20 @@ class IacCodeA2AExecutor(AgentExecutor):
                     context_id=context_id,
                     state=TaskState.TASK_STATE_WORKING,
                 )
-                async for event in runtime.agent_loop.run_streaming(prompt):
-                    text_chunk = await publish_stream_event(
-                        event_queue,
-                        task_id=task_id,
-                        context_id=context_id,
-                        event=event,
-                        artifact_store=self._artifact_store,
-                        permission_resolver=self._permission_resolver,
-                        auto_approve_permissions=self._auto_approve_permissions,
-                    )
-                    if text_chunk:
-                        task.output_text.append(text_chunk)
+                with use_session_id(ctx.session_id):
+                    async for event in runtime.agent_loop.run_streaming(prompt):
+                        text_chunk = await publish_stream_event(
+                            event_queue,
+                            task_id=task_id,
+                            context_id=context_id,
+                            event=event,
+                            artifact_store=self._artifact_store,
+                            permission_resolver=self._permission_resolver,
+                            auto_approve_permissions=self._auto_approve_permissions,
+                            exposure_types=self._thinking_exposure_types,
+                        )
+                        if text_chunk:
+                            task.output_text.append(text_chunk)
                 task.state = TASK_STATE_INPUT_REQUIRED
                 await self._publish_status(
                     event_queue,

iac_code-0.3.1/src/iac_code/a2a/exposure.py

@@ -0,0 +1,66 @@
+from __future__ import annotations
+
+from collections.abc import Iterable
+from enum import Enum
+from typing import Any
+
+
+class A2AExposureType(str, Enum):
+    RAW_THINKING = "raw_thinking"
+    TOOL_TRACE = "tool_trace"
+
+
+_EXPOSURE_TYPE_ORDER = (
+    A2AExposureType.RAW_THINKING,
+    A2AExposureType.TOOL_TRACE,
+)
+_SUPPORTED_TYPE_NAMES = ", ".join(item.value.replace("_", "-") for item in _EXPOSURE_TYPE_ORDER)
+_DISABLED_ALIASES = frozenset({"", "none", "off", "false", "0"})
+_ALL_ALIASES = frozenset({"all", "*"})
+DEFAULT_A2A_EXPOSURE_TYPES = frozenset({A2AExposureType.TOOL_TRACE})
+
+
+def normalize_a2a_exposure_types(value: Any) -> frozenset[A2AExposureType]:
+    if value is None:
+        return DEFAULT_A2A_EXPOSURE_TYPES
+
+    tokens = list(_iter_exposure_tokens(value))
+    if not tokens:
+        return frozenset()
+    if any(token in _ALL_ALIASES for token in tokens):
+        return frozenset(_EXPOSURE_TYPE_ORDER)
+    tokens = [token for token in tokens if token not in _DISABLED_ALIASES]
+    return frozenset(_exposure_type_from_token(token) for token in tokens)
+
+
+def format_a2a_exposure_types(value: Any) -> list[str]:
+    enabled = normalize_a2a_exposure_types(value)
+    return [item.value for item in _EXPOSURE_TYPE_ORDER if item in enabled]
+
+
+def _iter_exposure_tokens(value: Any) -> Iterable[str]:
+    if isinstance(value, A2AExposureType):
+        yield value.value
+        return
+    if isinstance(value, str):
+        for item in value.replace(";", ",").split(","):
+            token = item.strip().lower().replace("-", "_")
+            if token:
+                yield token
+        return
+    if isinstance(value, Iterable) and not isinstance(value, dict):
+        for item in value:
+            yield from _iter_exposure_tokens(item)
+        return
+    raise ValueError(
+        f"A2A thinking exposure must be a string or list of strings. Supported values: {_SUPPORTED_TYPE_NAMES}."
+    )
+
+
+def _exposure_type_from_token(token: str) -> A2AExposureType:
+    try:
+        return A2AExposureType(token)
+    except ValueError as exc:
+        raise ValueError(
+            f"Unsupported A2A thinking exposure type {token!r}. Supported values: {_SUPPORTED_TYPE_NAMES}."
+        ) from exc

{iac_code-0.2.3 → iac_code-0.3.1}/src/iac_code/a2a/parts.py

@@ -9,6 +9,7 @@ from collections.abc import Iterable
 from pathlib import Path
 from typing import Any
 from urllib.parse import unquote, urlparse
+from urllib.request import url2pathname
 
 from google.protobuf.json_format import MessageToDict
 
@@ -129,7 +130,7 @@ def _read_file_url_part(url: str, *, cwd: Path) -> str:
         raise ValueError("A2A file URL parts must use local file:// URLs.")
 
     cwd_path = cwd.resolve()
-    path = Path(unquote(parsed.path)).resolve()
+    path = Path(url2pathname(unquote(parsed.path))).resolve()
     if not is_relative_to(path, cwd_path) or not any(is_relative_to(path, root) for root in allowed_cwd_roots()):
         raise ValueError("A2A file URL part is outside the allowed workspace.")
     if not path.is_file():
@@ -199,7 +200,7 @@ def _safe_file_url_path(url: str, *, cwd: Path) -> Path:
         raise ValueError("A2A file URL parts must use local file:// URLs.")
 
     cwd_path = cwd.resolve()
-    path = Path(unquote(parsed.path)).resolve()
+    path = Path(url2pathname(unquote(parsed.path))).resolve()
     if not is_relative_to(path, cwd_path) or not any(is_relative_to(path, root) for root in allowed_cwd_roots()):
         raise ValueError("A2A file URL part is outside the allowed workspace.")
     if not path.is_file():

{iac_code-0.2.3 → iac_code-0.3.1}/src/iac_code/a2a/push.py

@@ -4,7 +4,6 @@ import asyncio
 import base64
 import hashlib
 import json
-import os
 import uuid
 from dataclasses import asdict, dataclass
 from ipaddress import ip_address
@@ -26,6 +25,7 @@ from iac_code.a2a.persistence import A2APersistenceStore
 from iac_code.a2a.push_queue import A2APushJob, A2APushQueue, LocalFileA2APushQueue
 from iac_code.a2a.push_secrets import A2APushSecretKeyring
 from iac_code.a2a.types import validate_protocol_id
+from iac_code.utils.file_security import restrict_file_permissions, safe_replace
 
 
 class InvalidPushNotificationConfigError(ValueError):
@@ -74,7 +74,7 @@ class A2APushConfigStore(PushNotificationConfigStore):
         self._root = Path(persistence.root) / "push_configs"
         self._secret_keyring = secret_keyring or A2APushSecretKeyring(Path(persistence.root) / "push_keys.json")
         self._root.mkdir(parents=True, exist_ok=True)
-        _chmod_private(self._root, directory=True)
+        restrict_file_permissions(self._root, directory=True)
 
     async def set_info(
         self,
@@ -95,7 +95,7 @@ class A2APushConfigStore(PushNotificationConfigStore):
 
         path = self._config_path(_owner(context), task_id, config.id)
         path.parent.mkdir(parents=True, exist_ok=True)
-        _chmod_private(path.parent, directory=True)
+        restrict_file_permissions(path.parent, directory=True)
         data = self._config_to_storage(config)
         _write_json_atomic(path, data)
 
@@ -304,19 +304,12 @@ def _owner(context: ServerCallContext) -> str:
     return resolve_user_scope(context)
 
 
-def _chmod_private(path: Path, *, directory: bool) -> None:
-    try:
-        os.chmod(path, 0o700 if directory else 0o600)
-    except OSError:
-        return
-
-
 def _write_json_atomic(path: Path, data: dict[str, Any]) -> None:
     tmp_path = path.with_name(f".{path.name}.{uuid.uuid4().hex}.tmp")
     try:
         tmp_path.write_text(json.dumps(data, ensure_ascii=False, sort_keys=True), encoding="utf-8")
-        _chmod_private(tmp_path, directory=False)
-        os.replace(tmp_path, path)
-        _chmod_private(path, directory=False)
+        restrict_file_permissions(tmp_path, directory=False)
+        safe_replace(str(tmp_path), str(path))
+        restrict_file_permissions(path, directory=False)
     finally:
         tmp_path.unlink(missing_ok=True)

{iac_code-0.2.3 → iac_code-0.3.1}/src/iac_code/a2a/push_queue.py

@@ -13,6 +13,7 @@ from pathlib import Path
 from typing import Any, Protocol
 
 from iac_code.a2a.push_secrets import A2APushSecretKeyring
+from iac_code.utils.file_security import restrict_file_permissions
 
 _REDACTED_HEADERS = {"authorization", "x-a2a-notification-token", "x-api-key", "api-key"}
 _ENCRYPTED_JOB_FIELD = "iacCodeEncryptedPushJob"
@@ -127,7 +128,7 @@ class LocalFileA2APushQueue:
         self.dead_dir = self.root / "dead"
         for path in (self.pending_dir, self.inflight_dir, self.dead_dir):
             path.mkdir(parents=True, exist_ok=True)
-            self._chmod_private(path, directory=True)
+            restrict_file_permissions(path, directory=True)
 
     async def enqueue(self, job: A2APushJob) -> None:
         self._write(self.pending_dir / f"{job.job_id}.json", job)
@@ -163,7 +164,7 @@ class LocalFileA2APushQueue:
 
     def _write(self, path: Path, job: A2APushJob) -> None:
         path.write_text(_serialize_push_job(job, secret_keyring=self._secret_keyring), encoding="utf-8")
-        self._chmod_private(path, directory=False)
+        restrict_file_permissions(path, directory=False)
 
     def _read(self, path: Path) -> A2APushJob:
         return _deserialize_push_job(path.read_text(encoding="utf-8"), secret_keyring=self._secret_keyring)
@@ -180,12 +181,6 @@ class LocalFileA2APushQueue:
                 job.with_attempt(attempt=job.attempt, next_attempt_at=now, last_error="Delivery lease expired."),
             )
 
-    def _chmod_private(self, path: Path, *, directory: bool) -> None:
-        try:
-            os.chmod(path, 0o700 if directory else 0o600)
-        except OSError:
-            return
-
 
 class RedisStreamsA2APushQueue:
     def __init__(