iac-code 0.8.0__tar.gz → 0.9.1__tar.gz

{iac_code-0.8.0 → iac_code-0.9.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: iac_code
-Version: 0.8.0
+Version: 0.9.1
 Summary: Your AI-powered Infrastructure as Code assistant
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.10

{iac_code-0.8.0 → iac_code-0.9.1}/setup.py

@@ -15,7 +15,7 @@ from setuptools.command.sdist import sdist
 INIT_PATH = Path("src/iac_code/__init__.py")
 LOCALES_DIR = Path("src/iac_code/i18n/locales")
 PROJECT_ROOT = Path(__file__).resolve().parent
-IAC_ALIYUN_REFERENCES_DIR = PROJECT_ROOT / "src/iac_code/skills/bundled/iac_aliyun/references"
+SELLING_REFERENCES_DIR = PROJECT_ROOT / "src/iac_code/pipeline/selling/references"
 SELLING_IAC_ALIYUN_SKILLS = (
     "iac-aliyun-template-generating",
     "iac-aliyun-cost",
@@ -207,10 +207,54 @@ def _replace_release_date():
     INIT_PATH.write_text(content, encoding="utf-8")
 
 
+def _git_symlink_placeholder_target(path: Path) -> Path | None:
+    """Return the target for a Windows core.symlinks=false placeholder file."""
+    if path.is_symlink() or not path.is_file():
+        return None
+    try:
+        if path.stat().st_size > 4096:
+            return None
+        raw_target = path.read_text(encoding="utf-8")
+    except (OSError, UnicodeDecodeError):
+        return None
+    if not raw_target or "\n" in raw_target or "\r" in raw_target:
+        return None
+    target = Path(raw_target)
+    if not target.is_absolute():
+        target = path.parent / target
+    try:
+        return target.resolve(strict=True)
+    except OSError:
+        return None
+
+
+def _copy_reference_entry(source: Path, target: Path) -> None:
+    placeholder_target = _git_symlink_placeholder_target(source)
+    if placeholder_target is not None:
+        source = placeholder_target
+    elif source.is_symlink():
+        source = source.resolve(strict=True)
+
+    if source.is_dir():
+        target.mkdir(parents=True, exist_ok=True)
+        for child in source.iterdir():
+            _copy_reference_entry(child, target / child.name)
+        return
+
+    target.parent.mkdir(parents=True, exist_ok=True)
+    shutil.copy2(source, target)
+
+
+def _copy_reference_tree(source: Path, target: Path) -> None:
+    target.mkdir(parents=True, exist_ok=True)
+    for child in source.iterdir():
+        _copy_reference_entry(child, target / child.name)
+
+
 def _copy_selling_skill_references_to_package_root(package_root) -> None:
     """Expand selling-skill reference symlinks into real dirs under an iac_code package root."""
-    if not IAC_ALIYUN_REFERENCES_DIR.is_dir():
-        raise RuntimeError("references directory not found: %s" % IAC_ALIYUN_REFERENCES_DIR)
+    if not SELLING_REFERENCES_DIR.is_dir():
+        raise RuntimeError("references directory not found: %s" % SELLING_REFERENCES_DIR)
 
     package_root = Path(package_root)
     for skill_name in SELLING_IAC_ALIYUN_SKILLS:
@@ -220,7 +264,7 @@ def _copy_selling_skill_references_to_package_root(package_root) -> None:
         elif target.exists():
             shutil.rmtree(target)
         target.parent.mkdir(parents=True, exist_ok=True)
-        shutil.copytree(IAC_ALIYUN_REFERENCES_DIR, target)
+        _copy_reference_tree(SELLING_REFERENCES_DIR, target)
 
 
 def _copy_selling_skill_references(build_lib: str) -> None:

iac_code-0.9.1/src/iac_code/__init__.py

@@ -0,0 +1,2 @@
+__version__ = "0.9.1"
+__release_date__ = "2026-07-10"

{iac_code-0.8.0 → iac_code-0.9.1}/src/iac_code/a2a/artifacts.py

@@ -6,13 +6,28 @@ import ntpath
 import os
 import re
 import uuid
+from collections.abc import Iterable, Mapping
 from dataclasses import asdict, dataclass
 from pathlib import Path
 from typing import Any
 from urllib.parse import quote, unquote, urlsplit
 
 from iac_code.i18n import _
+from iac_code.services.session_layout import (
+    SESSION_LAYOUT_VERSION_V2,
+    SessionPaths,
+    UnsupportedSessionLayoutError,
+    ensure_session_owned_dir,
+    require_supported_session_layout,
+)
 from iac_code.utils.public_errors import sanitize_public_text
+from iac_code.utils.public_paths import relativize_public_file_uri
+from iac_code.utils.state_io import atomic_write_bytes
+from iac_code.utils.tool_result_redaction import (
+    REDACTED_TOOL_RESULT_VALUE,
+    is_file_content_key,
+    redact_file_content_from_json_string,
+)
 
 PUBLIC_ARTIFACT_URI_PREFIX = "iac-code-artifact://"
 _PUBLIC_ARTIFACT_URI_SCHEME = "iac-code-artifact"
@@ -104,64 +119,107 @@ def _windows_safe_filename(filename: str) -> str:
     return sanitized
 
 
-def sanitize_public_artifact_data(value: Any) -> Any:
+def sanitize_public_artifact_data(
+    value: Any,
+    *,
+    public_path_roots: Iterable[Mapping[str, str]] | None = None,
+) -> Any:
     if isinstance(value, list):
-        return [sanitize_public_artifact_data(item) for item in value]
+        return [sanitize_public_artifact_data(item, public_path_roots=public_path_roots) for item in value]
     if isinstance(value, tuple):
-        return [sanitize_public_artifact_data(item) for item in value]
+        return [sanitize_public_artifact_data(item, public_path_roots=public_path_roots) for item in value]
     if isinstance(value, str):
-        return _sanitize_artifact_scalar_string(value)
+        return _sanitize_artifact_scalar_string(value, public_path_roots=public_path_roots)
     if not isinstance(value, dict):
         return value
 
     sanitized: dict[Any, Any] = {}
     for key, raw_value in value.items():
         key_name = str(key)
+        output_key, key_is_public_path = _sanitize_public_mapping_key(key, public_path_roots=public_path_roots)
         if key_name.lower() in _ARTIFACT_PAYLOAD_KEYS:
             continue
-        if _is_sensitive_output_key(key_name):
-            sanitized[key] = "[REDACTED]"
+        if not key_is_public_path and _is_sensitive_output_key(key_name):
+            sanitized[output_key] = "[REDACTED]"
+            continue
+        if not key_is_public_path and is_file_content_key(key_name):
+            sanitized[output_key] = REDACTED_TOOL_RESULT_VALUE
             continue
         if _is_artifact_uri_key(key_name):
             if isinstance(raw_value, str):
-                sanitized_value = _sanitize_artifact_string(key_name, raw_value)
+                sanitized_value = _sanitize_artifact_string(key_name, raw_value, public_path_roots=public_path_roots)
                 if sanitized_value is not None:
-                    sanitized[key] = sanitized_value
+                    sanitized[output_key] = sanitized_value
             continue
         if isinstance(raw_value, str):
-            sanitized_value = _sanitize_artifact_string(key_name, raw_value)
+            sanitized_value = _sanitize_artifact_string(key_name, raw_value, public_path_roots=public_path_roots)
             if sanitized_value is None:
                 continue
-            sanitized[key] = sanitized_value
+            sanitized[output_key] = sanitized_value
             continue
-        sanitized[key] = sanitize_public_artifact_data(raw_value)
+        sanitized[output_key] = sanitize_public_artifact_data(raw_value, public_path_roots=public_path_roots)
     return sanitized
 
 
-def sanitize_public_tool_output_data(value: Any) -> Any:
+def sanitize_public_tool_output_data(
+    value: Any,
+    *,
+    public_path_roots: Iterable[Mapping[str, str]] | None = None,
+) -> Any:
     if isinstance(value, str):
-        return sanitize_public_artifact_text(value, fallback_summary="")
+        value = redact_file_content_from_json_string(value)
+        return sanitize_public_artifact_text(value, fallback_summary="", public_path_roots=public_path_roots)
     if isinstance(value, list):
-        return [sanitize_public_tool_output_data(item) for item in value]
+        return [sanitize_public_tool_output_data(item, public_path_roots=public_path_roots) for item in value]
     if isinstance(value, tuple):
-        return [sanitize_public_tool_output_data(item) for item in value]
+        return [sanitize_public_tool_output_data(item, public_path_roots=public_path_roots) for item in value]
     if not isinstance(value, dict):
         return value
     if _looks_like_artifact_payload_dict(value):
-        return sanitize_public_artifact_data(value)
+        return sanitize_public_artifact_data(value, public_path_roots=public_path_roots)
 
     sanitized: dict[Any, Any] = {}
     for key, raw_value in value.items():
-        if str(key).lower() in _ARTIFACT_CONTAINER_KEYS:
-            sanitized[key] = sanitize_public_artifact_data(raw_value)
-        elif _is_sensitive_output_key(key):
-            sanitized[key] = "[REDACTED]"
+        key_name = str(key)
+        output_key, key_is_public_path = _sanitize_public_mapping_key(key, public_path_roots=public_path_roots)
+        if key_name.lower() in _ARTIFACT_CONTAINER_KEYS:
+            sanitized[output_key] = sanitize_public_artifact_data(raw_value, public_path_roots=public_path_roots)
+        elif not key_is_public_path and _is_sensitive_output_key(key_name):
+            sanitized[output_key] = "[REDACTED]"
+        elif not key_is_public_path and is_file_content_key(key_name):
+            sanitized[output_key] = REDACTED_TOOL_RESULT_VALUE
         else:
-            sanitized[key] = sanitize_public_tool_output_data(raw_value)
+            sanitized[output_key] = sanitize_public_tool_output_data(raw_value, public_path_roots=public_path_roots)
     return sanitized
 
 
-def _sanitize_artifact_string(key: str, value: str) -> str | None:
+def _sanitize_public_mapping_key(
+    key: Any,
+    *,
+    public_path_roots: Iterable[Mapping[str, str]] | None = None,
+) -> tuple[Any, bool]:
+    if not isinstance(key, str):
+        return key, False
+    sanitized_key = _sanitize_artifact_scalar_string(key, public_path_roots=public_path_roots)
+    return sanitized_key, sanitized_key != key and _is_path_like_mapping_key(key)
+
+
+def _is_path_like_mapping_key(key: str) -> bool:
+    stripped = key.strip()
+    if not stripped or re.search(r"\s", stripped):
+        return False
+    if stripped.lower().startswith("file://"):
+        parsed = urlsplit(stripped)
+        return parsed.scheme.lower() == "file" and bool(parsed.path or parsed.netloc)
+    return bool(stripped.startswith("/") or stripped.startswith("\\\\") or ntpath.splitdrive(stripped)[0])
+
+
+def _sanitize_artifact_string(
+    key: str,
+    value: str,
+    *,
+    public_path_roots: Iterable[Mapping[str, str]] | None = None,
+) -> str | None:
     if _is_artifact_uri_key(key):
         return value if is_valid_public_artifact_uri(value) else None
     if key.lower() in {"filename", "name"}:
@@ -171,34 +229,51 @@ def _sanitize_artifact_string(key: str, value: str) -> str | None:
             except UnsafeArtifactNameError:
                 pass
     if value.lower().startswith("file://"):
-        return "[PATH]"
-    return _sanitize_artifact_scalar_string(value)
+        return relativize_public_file_uri(value, public_path_roots) or "[PATH]"
+    return _sanitize_artifact_scalar_string(value, public_path_roots=public_path_roots)
 
 
-def _sanitize_artifact_scalar_string(value: str) -> str:
+def _sanitize_artifact_scalar_string(
+    value: str,
+    *,
+    public_path_roots: Iterable[Mapping[str, str]] | None = None,
+) -> str:
     if value.lower().startswith("file://"):
-        return "[PATH]"
+        return relativize_public_file_uri(value, public_path_roots) or "[PATH]"
     decoded = unquote(value)
     if decoded != value:
         if decoded.lower().startswith("file://"):
-            return "[PATH]"
-        decoded_sanitized = sanitize_public_artifact_text(decoded, fallback_summary="")
+            return relativize_public_file_uri(decoded, public_path_roots) or "[PATH]"
+        decoded_sanitized = sanitize_public_artifact_text(
+            decoded,
+            fallback_summary="",
+            public_path_roots=public_path_roots,
+        )
         if decoded_sanitized != decoded:
             return decoded_sanitized
-    return sanitize_public_artifact_text(value, fallback_summary="")
+    return sanitize_public_artifact_text(value, fallback_summary="", public_path_roots=public_path_roots)
 
 
-def sanitize_public_artifact_text(value: str, *, fallback_summary: str | None = None) -> str:
+def sanitize_public_artifact_text(
+    value: str,
+    *,
+    fallback_summary: str | None = None,
+    public_path_roots: Iterable[Mapping[str, str]] | None = None,
+) -> str:
     if fallback_summary is None:
         fallback_summary = _("Unknown error")
     protected, placeholders = _replace_public_artifact_uri_tokens(value)
-    protected = _replace_file_uri_tokens(protected)
-    sanitized = sanitize_public_text(protected, fallback_summary=fallback_summary)
+    protected = _replace_file_uri_tokens(protected, public_path_roots=public_path_roots)
+    sanitized = sanitize_public_text(
+        protected,
+        fallback_summary=fallback_summary,
+        public_path_roots=public_path_roots,
+    )
     decoded_raw = unquote(protected)
     decoded, decoded_placeholders = _replace_public_artifact_uri_tokens(decoded_raw, prefix="__IAC_CODE_DECODED_URI_")
-    decoded = _replace_file_uri_tokens(decoded)
+    decoded = _replace_file_uri_tokens(decoded, public_path_roots=public_path_roots)
     if decoded_raw != protected:
-        decoded_sanitized = sanitize_public_text(decoded, fallback_summary="")
+        decoded_sanitized = sanitize_public_text(decoded, fallback_summary="", public_path_roots=public_path_roots)
         if decoded != decoded_raw or decoded_sanitized != decoded:
             sanitized = decoded_sanitized
             placeholders.update(decoded_placeholders)
@@ -207,13 +282,20 @@ def sanitize_public_artifact_text(value: str, *, fallback_summary: str | None =
     return sanitized
 
 
-def _replace_file_uri_tokens(value: str) -> str:
+def _replace_file_uri_tokens(
+    value: str,
+    *,
+    public_path_roots: Iterable[Mapping[str, str]] | None = None,
+) -> str:
     def replace_file_uri(match: re.Match[str]) -> str:
         uri = match.group(0)
         trailing = ""
         while uri and uri[-1] in ".,:!?":
             trailing = uri[-1] + trailing
             uri = uri[:-1]
+        public_path = relativize_public_file_uri(uri, public_path_roots)
+        if public_path is not None:
+            return f"{public_path}{trailing}"
         return f"[PATH]{trailing}"
 
     return _FILE_URI_TEXT_PATTERN.sub(replace_file_uri, value)
@@ -333,8 +415,9 @@ class A2AArtifactMetadata:
 
 
 class A2AArtifactStore:
-    def __init__(self, root: str | Path) -> None:
+    def __init__(self, root: str | Path, *, session_dir: str | Path | None = None) -> None:
         self.root = Path(root)
+        self._session_dir = Path(session_dir) if session_dir is not None else None
 
     def save_text(self, *, filename: str, content: str, media_type: str) -> A2AArtifactMetadata:
         encoded = content.encode("utf-8")
@@ -348,9 +431,12 @@ class A2AArtifactStore:
         safe_name = self._safe_filename(filename)
         artifact_id = str(uuid.uuid4())
         artifact_dir = self.root / artifact_id
-        artifact_dir.mkdir(parents=True, exist_ok=False)
+        if self._session_dir is not None:
+            ensure_session_owned_dir(self._session_dir, artifact_dir)
+        else:
+            artifact_dir.mkdir(parents=True, exist_ok=False)
         path = artifact_dir / safe_name
-        path.write_bytes(content)
+        atomic_write_bytes(path, content)
         return A2AArtifactMetadata(
             artifact_id=artifact_id,
             filename=safe_name,
@@ -373,3 +459,13 @@ class A2AArtifactStore:
     @staticmethod
     def _safe_filename(filename: str) -> str:
         return safe_artifact_filename(filename)
+
+
+def artifact_store_for_session(session_dir: str | Path) -> A2AArtifactStore:
+    session_path = Path(session_dir)
+    version = require_supported_session_layout(session_path)
+    if version != SESSION_LAYOUT_VERSION_V2:
+        raise UnsupportedSessionLayoutError(_("Unsupported session layout version: {version}").format(version="legacy"))
+    session_paths = SessionPaths.from_session_dir(session_path)
+    root = ensure_session_owned_dir(session_path, session_paths.a2a_artifacts_dir)
+    return A2AArtifactStore(root, session_dir=session_path)

iac_code-0.9.1/src/iac_code/a2a/backup.py

@@ -0,0 +1,91 @@
+from __future__ import annotations
+
+import asyncio
+import logging
+from typing import Any
+
+from iac_code.i18n import _
+from iac_code.services.session_backup import BackupReason, SessionBackupBlocked
+
+logger = logging.getLogger(__name__)
+
+
+async def backup_session_async(
+    backup_service: Any,
+    cwd: str,
+    session_id: str,
+    *,
+    reason: BackupReason,
+    critical: bool,
+    metrics: Any | None = None,
+) -> Any | None:
+    failed_recorded = False
+    try:
+        result = await asyncio.to_thread(
+            backup_service.backup_session,
+            cwd,
+            session_id,
+            reason=reason,
+            critical=critical,
+        )
+        retry_count = _retry_count(result)
+        if getattr(result, "enabled", False) and not getattr(result, "succeeded", True):
+            message = str(
+                getattr(result, "error", None) or _("Session backup failed. Retry after the backup path is available.")
+            )
+            _record_backup_failed(metrics, reason=reason, critical=critical, retry_count=retry_count)
+            failed_recorded = True
+            if critical:
+                raise SessionBackupBlocked(message, retry_count=retry_count, result=result)
+            logger.warning(
+                "A2A session backup failed reason=%s critical=%s retry_count=%s: %s",
+                reason.value,
+                critical,
+                retry_count,
+                message,
+            )
+        elif getattr(result, "enabled", False):
+            _record_backup_succeeded(metrics, reason=reason, critical=critical, retry_count=retry_count)
+        return result
+    except Exception as exc:
+        retry_count = _retry_count_from_exception(exc)
+        if not failed_recorded:
+            _record_backup_failed(metrics, reason=reason, critical=critical, retry_count=retry_count)
+        if critical:
+            raise
+        logger.warning(
+            "A2A session backup failed reason=%s critical=%s retry_count=%s error_type=%s",
+            reason.value,
+            critical,
+            retry_count,
+            type(exc).__name__,
+        )
+        return None
+
+
+def _retry_count(result: Any) -> int:
+    value = getattr(result, "retry_count", 0)
+    return value if isinstance(value, int) and value >= 0 else 0
+
+
+def _retry_count_from_exception(exc: BaseException) -> int:
+    value = getattr(exc, "retry_count", 0)
+    return value if isinstance(value, int) and value >= 0 else 0
+
+
+def _record_backup_succeeded(metrics: Any | None, *, reason: BackupReason, critical: bool, retry_count: int) -> None:
+    record = getattr(metrics, "record_backup_succeeded", None)
+    if callable(record):
+        try:
+            record(reason=reason.value, critical=critical, retry_count=retry_count)
+        except Exception as exc:
+            logger.debug("Failed to record A2A backup_succeeded metric: %s", type(exc).__name__)
+
+
+def _record_backup_failed(metrics: Any | None, *, reason: BackupReason, critical: bool, retry_count: int) -> None:
+    record = getattr(metrics, "record_backup_failed", None)
+    if callable(record):
+        try:
+            record(reason=reason.value, critical=critical, retry_count=retry_count)
+        except Exception as exc:
+            logger.debug("Failed to record A2A backup_failed metric: %s", type(exc).__name__)

{iac_code-0.8.0 → iac_code-0.9.1}/src/iac_code/a2a/events.py

@@ -176,10 +176,15 @@ def _extract_artifact_metadata(result: Any, artifact_store: Any | None) -> dict[
     return None
 
 
-def _tool_result_metadata(result: Any, *, is_error: bool = False) -> Any:
-    sanitized = sanitize_public_tool_output_data(result)
+def _tool_result_metadata(
+    result: Any,
+    *,
+    is_error: bool = False,
+    public_path_roots: list[dict[str, str]] | None = None,
+) -> Any:
+    sanitized = sanitize_public_tool_output_data(result, public_path_roots=public_path_roots)
     if is_error and isinstance(sanitized, str):
-        return sanitize_public_artifact_text(sanitized)
+        return sanitize_public_artifact_text(sanitized, public_path_roots=public_path_roots)
     return _truncate(sanitized)
 
 
@@ -351,7 +356,11 @@ async def publish_stream_event(
             "status": "failed" if event.is_error else "completed",
             "toolUseId": event.tool_use_id,
             "name": event.tool_name,
-            "result": _tool_result_metadata(event.result, is_error=event.is_error),
+            "result": _tool_result_metadata(
+                event.result,
+                is_error=event.is_error,
+                public_path_roots=event.public_path_roots,
+            ),
         }
         if artifact_metadata is not None:
             tool_metadata["artifact"] = artifact_metadata
@@ -455,7 +464,7 @@ async def publish_stream_event(
         if event.error_id:
             error_metadata["errorId"] = event.error_id
         if event.is_retryable:
-            text = "A temporary error occurred. Please retry."
+            text = _("A temporary error occurred. Please retry.")
             state = TaskState.TASK_STATE_INPUT_REQUIRED
         else:
             raw = event.error or "Unknown error"