icdev 0.0.3__py3-none-any.whl

tools/cloudforge/supply_chain/bridge.py

@@ -0,0 +1,33 @@
+# CUI // SP-CTI
+"""Supply chain bridge — connects to tools/supply_chain/* modules."""
+
+import json
+import logging
+from typing import Any, Dict
+
+logger = logging.getLogger(__name__)
+
+
+def assess_supply_chain(project_id: str = "cloudforge") -> Dict[str, Any]:
+    """Run full supply chain assessment via existing tools."""
+    try:
+        from tools.supply_chain.scrm_assessor import aggregate_assessment
+        return aggregate_assessment(project_id)
+    except ImportError:
+        return {
+            "status": "ok",
+            "project_id": project_id,
+            "message": "Supply chain assessor offline",
+            "classification": "CUI // SP-CTI",
+        }
+
+
+if __name__ == "__main__":
+    import argparse
+    parser = argparse.ArgumentParser(description="CloudForge Supply Chain Bridge")
+    parser.add_argument("--assess", action="store_true")
+    parser.add_argument("--project-id", default="cloudforge")
+    parser.add_argument("--json", action="store_true")
+    args = parser.parse_args()
+    if args.assess:
+        print(json.dumps(assess_supply_chain(args.project_id), indent=2))

tools/cloudforge/supply_chain/iac_dependency_scanner.py

@@ -0,0 +1,36 @@
+# CUI // SP-CTI
+"""IaC dependency scanner — scan Terraform modules for vulnerabilities."""
+
+import json
+import logging
+from typing import Any, Dict, List
+
+logger = logging.getLogger(__name__)
+
+
+def scan_iac_dependencies(iac_path: str = "") -> Dict[str, Any]:
+    """Scan IaC modules for known vulnerabilities.
+
+    Bridges to tools/supply_chain/dependency_graph.py.
+    """
+    try:
+        from tools.supply_chain.dependency_graph import build_graph
+        return build_graph("cloudforge")
+    except ImportError:
+        return {
+            "status": "ok",
+            "iac_path": iac_path,
+            "vulnerabilities": [],
+            "total_modules": 0,
+            "message": "Supply chain scanner offline",
+            "classification": "CUI // SP-CTI",
+        }
+
+
+if __name__ == "__main__":
+    import argparse
+    parser = argparse.ArgumentParser(description="CloudForge IaC Dependency Scanner")
+    parser.add_argument("--path", default="")
+    parser.add_argument("--json", action="store_true")
+    args = parser.parse_args()
+    print(json.dumps(scan_iac_dependencies(args.path), indent=2))

tools/cloudforge/supply_chain/provider_trust_scorer.py

@@ -0,0 +1,54 @@
+# CUI // SP-CTI
+"""Provider trust scorer — score CSP and IaC module trustworthiness."""
+
+import json
+import logging
+from typing import Any, Dict, List
+
+logger = logging.getLogger(__name__)
+
+# Trust factors for CSPs
+_CSP_TRUST_SCORES: Dict[str, Dict[str, Any]] = {
+    "aws_govcloud": {"trust_score": 0.95, "fedramp": "High", "dod_srg": True, "stigs_available": True},
+    "aws_commercial": {"trust_score": 0.85, "fedramp": "High", "dod_srg": False, "stigs_available": True},
+    "aws_secret": {"trust_score": 0.98, "fedramp": "High", "dod_srg": True, "stigs_available": True},
+    "azure_gov": {"trust_score": 0.93, "fedramp": "High", "dod_srg": True, "stigs_available": True},
+    "azure_commercial": {"trust_score": 0.83, "fedramp": "High", "dod_srg": False, "stigs_available": True},
+    "azure_secret": {"trust_score": 0.97, "fedramp": "High", "dod_srg": True, "stigs_available": True},
+    "gcp": {"trust_score": 0.80, "fedramp": "High", "dod_srg": False, "stigs_available": False},
+    "oci": {"trust_score": 0.78, "fedramp": "High", "dod_srg": False, "stigs_available": False},
+}
+
+
+def score_provider(cloud_type: str) -> Dict[str, Any]:
+    """Score a cloud provider's trust level."""
+    scores = _CSP_TRUST_SCORES.get(cloud_type, {"trust_score": 0.5})
+    return {
+        "cloud_type": cloud_type,
+        **scores,
+        "classification": "CUI // SP-CTI",
+    }
+
+
+def compare_providers(cloud_types: List[str] = None) -> List[Dict[str, Any]]:
+    """Compare trust scores across providers."""
+    types = cloud_types or list(_CSP_TRUST_SCORES.keys())
+    results = [score_provider(ct) for ct in types]
+    results.sort(key=lambda x: x["trust_score"], reverse=True)
+    return results
+
+
+if __name__ == "__main__":
+    import argparse
+    parser = argparse.ArgumentParser(description="CloudForge Provider Trust Scorer")
+    parser.add_argument("--score", help="Cloud type to score")
+    parser.add_argument("--compare", action="store_true")
+    parser.add_argument("--json", action="store_true")
+    args = parser.parse_args()
+
+    if args.score:
+        print(json.dumps(score_provider(args.score), indent=2))
+    elif args.compare:
+        print(json.dumps(compare_providers(), indent=2))
+    else:
+        parser.print_help()

tools/compat/__init__.py

@@ -0,0 +1,21 @@
+# [TEMPLATE: CUI // SP-CTI]
+"""ICDEV cross-platform compatibility module.
+
+Centralizes OS detection and platform-specific behavior (D145).
+Uses only Python stdlib — air-gap safe.
+"""
+from tools.compat.platform_utils import (  # noqa: F401
+    IS_WINDOWS,
+    IS_MACOS,
+    IS_LINUX,
+    PLATFORM_NAME,
+    get_temp_dir,
+    get_home_dir,
+    get_npx_cmd,
+    get_python_cmd,
+    get_project_root,
+    get_data_dir,
+    get_config_dir,
+    normalize_path,
+    ensure_utf8_console,
+)

tools/compat/cli_harmonizer.py

@@ -0,0 +1,251 @@
+#!/usr/bin/env python3
+# CUI // SP-CTI
+"""CLI Harmonization Fixer — bulk-apply ICDEV CLI standards.
+
+Applies two mechanical transformations to tools with argparse:
+
+1. --project → --project-id: Renames bare --project flags to --project-id
+   while keeping --project as a deprecated alias (dest="project_id").
+   Also updates args.project → args.project_id references.
+
+2. --json flag: Adds standard --json flag to tools that lack it.
+
+Usage:
+    python tools/compat/cli_harmonizer.py --fix project-naming --dry-run
+    python tools/compat/cli_harmonizer.py --fix project-naming --apply
+    python tools/compat/cli_harmonizer.py --fix json-flag --dry-run
+    python tools/compat/cli_harmonizer.py --fix json-flag --apply
+    python tools/compat/cli_harmonizer.py --fix all --apply
+    python tools/compat/cli_harmonizer.py --fix all --apply --json
+
+This tool uses only Python stdlib (air-gap safe).
+"""
+
+import argparse
+import json
+import re
+import sys
+from pathlib import Path
+from typing import Dict, List, Optional, Tuple
+
+PROJECT_ROOT = Path(__file__).resolve().parent.parent.parent
+TOOLS_DIR = PROJECT_ROOT / "tools"
+
+# Files to skip (not CLI tools, or special cases)
+SKIP_FILES = {
+    "tools/dashboard/app.py",         # Flask web server
+    "tools/saas/api_gateway.py",      # Flask web server
+    "tools/saas/portal/app.py",       # Flask web server
+    "tools/saas/db/pg_schema.py",     # Schema definition module
+    "tools/db/init_icdev_db.py",      # DB init script (has --json already via convention)
+    "tools/compat/cli_harmonizer.py", # This file
+}
+
+
+def find_argparse_tools() -> List[Path]:
+    """Find all Python files under tools/ that use argparse + __main__."""
+    results = []
+    for py_file in sorted(TOOLS_DIR.rglob("*.py")):
+        if py_file.name.startswith("__"):
+            continue
+        rel = str(py_file.relative_to(PROJECT_ROOT)).replace("\\", "/")
+        if rel in SKIP_FILES or "/tests/" in rel:
+            continue
+        try:
+            content = py_file.read_text(encoding="utf-8")
+        except (OSError, UnicodeDecodeError):
+            continue
+        if "ArgumentParser" in content and '__name__' in content and '"__main__"' in content:
+            results.append(py_file)
+    return results
+
+
+def fix_project_naming(py_file: Path, dry_run: bool = True) -> Optional[str]:
+    """Fix bare --project to --project-id with backward-compat alias.
+
+    Returns description of change, or None if no change needed.
+    """
+    content = py_file.read_text(encoding="utf-8")
+
+    # Check if file has bare --project (not --project-id, --project-dir, --project-path)
+    if not re.search(r'''add_argument\(\s*['"]--project['"]''', content):
+        return None
+
+    # Already has --project-id? Skip.
+    if re.search(r'''add_argument\(\s*['"]--project-id['"]''', content):
+        return None
+
+    # Transform: add_argument("--project", ...) → add_argument("--project-id", "--project", dest="project_id", ...)
+    new_content = content
+
+    # Pattern: add_argument("--project", ...) or add_argument('--project', ...)
+    # We need to insert "--project" as alias and dest="project_id"
+    def replace_project_arg(m):
+        full_match = m.group(0)
+        quote = m.group(1)  # " or '
+
+        # Check if dest is already specified
+        if "dest=" in full_match:
+            # Just rename the flag, keep existing dest
+            return full_match.replace(
+                f"add_argument({quote}--project{quote}",
+                f"add_argument({quote}--project-id{quote}, {quote}--project{quote}",
+            )
+
+        # Insert --project as alias and add dest="project_id"
+        # Find the closing paren position is tricky, so let's use a simpler approach:
+        # Replace the flag name and add dest after it
+        result = full_match.replace(
+            f"add_argument({quote}--project{quote}",
+            f"add_argument({quote}--project-id{quote}, {quote}--project{quote}",
+        )
+
+        # Add dest="project_id" before the closing paren
+        # Find last ) and insert before it
+        last_paren = result.rfind(")")
+        if last_paren > 0:
+            before = result[:last_paren].rstrip()
+            if before.endswith(","):
+                result = before + f" dest={quote}project_id{quote})" + result[last_paren + 1:]
+            else:
+                result = before + f", dest={quote}project_id{quote})" + result[last_paren + 1:]
+
+        return result
+
+    # Match the full add_argument("--project", ...) call
+    # This regex captures the full call including multiline
+    pattern = re.compile(
+        r'''add_argument\(\s*(['"])--project\1[^)]*\)''',
+        re.DOTALL,
+    )
+
+    new_content = pattern.sub(replace_project_arg, new_content)
+
+    # Replace args.project with args.project_id (but not args.project_id, args.project_dir, etc.)
+    new_content = re.sub(
+        r'\bargs\.project\b(?!_)',
+        'args.project_id',
+        new_content,
+    )
+
+    if new_content == content:
+        return None
+
+    if not dry_run:
+        py_file.write_text(new_content, encoding="utf-8")
+
+    rel = str(py_file.relative_to(PROJECT_ROOT)).replace("\\", "/")
+    return f"Renamed --project → --project-id in {rel}"
+
+
+def fix_json_flag(py_file: Path, dry_run: bool = True) -> Optional[str]:
+    """Add --json flag to tools that lack it.
+
+    Returns description of change, or None if no change needed.
+    """
+    content = py_file.read_text(encoding="utf-8")
+
+    # Already has --json?
+    if '"--json"' in content or "'--json'" in content:
+        return None
+
+    # Find the last add_argument line to insert after it
+    lines = content.split("\n")
+    last_add_arg_idx = None
+    parser_var = "parser"  # default
+
+    for i, line in enumerate(lines):
+        stripped = line.strip()
+        # Detect parser variable name
+        if "ArgumentParser" in stripped:
+            m = re.match(r'\s*(\w+)\s*=\s*\w*\.?ArgumentParser', stripped)
+            if m:
+                parser_var = m.group(1)
+        # Track last add_argument call
+        if "add_argument" in stripped and not stripped.startswith("#"):
+            last_add_arg_idx = i
+
+    if last_add_arg_idx is None:
+        return None
+
+    # Determine indentation from the last add_argument line
+    indent = ""
+    for ch in lines[last_add_arg_idx]:
+        if ch in " \t":
+            indent += ch
+        else:
+            break
+
+    # Insert --json flag after the last add_argument
+    json_line = f'{indent}{parser_var}.add_argument("--json", action="store_true", dest="json_output", help="JSON output")'
+    lines.insert(last_add_arg_idx + 1, json_line)
+
+    new_content = "\n".join(lines)
+
+    if not dry_run:
+        py_file.write_text(new_content, encoding="utf-8")
+
+    rel = str(py_file.relative_to(PROJECT_ROOT)).replace("\\", "/")
+    return f"Added --json flag to {rel}"
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Bulk-apply ICDEV CLI harmonization standards"
+    )
+    parser.add_argument(
+        "--fix", required=True,
+        choices=["project-naming", "json-flag", "all"],
+        help="Which fix to apply",
+    )
+    parser.add_argument("--dry-run", action="store_true", help="Preview changes without writing")
+    parser.add_argument("--apply", action="store_true", help="Apply changes to files")
+    parser.add_argument("--json", action="store_true", dest="json_output", help="JSON output")
+    args = parser.parse_args()
+
+    if not args.dry_run and not args.apply:
+        print("Error: specify --dry-run or --apply", file=sys.stderr)
+        sys.exit(1)
+
+    dry_run = not args.apply
+    tools = find_argparse_tools()
+    results: Dict[str, List[str]] = {"project_naming": [], "json_flag": []}
+
+    if args.fix in ("project-naming", "all"):
+        for tool in tools:
+            change = fix_project_naming(tool, dry_run=dry_run)
+            if change:
+                results["project_naming"].append(change)
+
+    if args.fix in ("json-flag", "all"):
+        for tool in tools:
+            change = fix_json_flag(tool, dry_run=dry_run)
+            if change:
+                results["json_flag"].append(change)
+
+    if args.json_output:
+        output = {
+            "status": "ok",
+            "dry_run": dry_run,
+            "project_naming_fixes": len(results["project_naming"]),
+            "json_flag_fixes": len(results["json_flag"]),
+            "details": results,
+        }
+        print(json.dumps(output, indent=2))
+    else:
+        mode = "DRY RUN" if dry_run else "APPLIED"
+        print(f"\n=== CLI Harmonizer ({mode}) ===\n")
+        for category, changes in results.items():
+            if changes:
+                print(f"  {category} ({len(changes)} fixes):")
+                for change in changes:
+                    print(f"    {change}")
+                print()
+        total = sum(len(v) for v in results.values())
+        print(f"  Total: {total} changes {'previewed' if dry_run else 'applied'}")
+
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

tools/compat/datetime_utils.py

@@ -0,0 +1,18 @@
+# [TEMPLATE: CUI // SP-CTI]
+"""Timezone-aware datetime utilities for ICDEV.
+
+Replaces deprecated datetime.utcnow() with timezone-aware alternatives.
+ADR D186: Compatible with all installation profiles (CUI and non-CUI).
+"""
+
+from datetime import datetime, timezone
+
+
+def utc_now() -> datetime:
+    """Return current UTC time as timezone-aware datetime."""
+    return datetime.now(timezone.utc)
+
+
+def utc_now_iso() -> str:
+    """Return current UTC time as ISO 8601 string."""
+    return datetime.now(timezone.utc).isoformat()

tools/compat/db_utils.py

@@ -0,0 +1,190 @@
+#!/usr/bin/env python3
+# CUI // SP-CTI
+"""Centralized database path resolution and connection helpers for ICDEV.
+
+Provides functions to resolve database paths and create connections with a
+consistent fallback chain: env var > explicit argument > default.
+
+As of D-DB-20, this module delegates to ``tools.db.storage`` for actual
+connection creation, which supports both SQLite and PostgreSQL backends.
+The path-resolution functions remain here for backward compatibility and
+are used by the storage layer itself.
+
+Usage:
+    from tools.compat.db_utils import get_icdev_db_path, get_db_connection
+
+    db_path = get_icdev_db_path()                    # env var or default
+    db_path = get_icdev_db_path("/custom/path.db")   # explicit override
+
+    conn = get_db_connection()                       # default icdev.db
+    conn = get_db_connection(validate=True)           # raise if DB missing
+    conn = get_db_connection(db_path="/other.db")    # explicit DB
+
+    # New: context manager support (recommended)
+    with get_db_connection() as conn:
+        rows = conn.execute("SELECT 1").fetchall()
+
+Fallback chain:
+    1. Explicit path argument (if provided)
+    2. ICDEV_DB_PATH environment variable
+    3. Default: <project_root>/data/icdev.db
+
+This module uses only Python stdlib (air-gap safe) for path resolution.
+Connection creation delegates to tools.db.storage which may use psycopg2
+when PostgreSQL is configured.
+"""
+
+import os
+import sqlite3
+from pathlib import Path
+from typing import Optional, Union
+
+# Project root: 3 levels up from tools/compat/db_utils.py
+_PROJECT_ROOT = Path(__file__).resolve().parent.parent.parent
+_DEFAULT_DB = _PROJECT_ROOT / "data" / "icdev.db"
+
+
+def get_project_root() -> Path:
+    """Return the ICDEV project root directory."""
+    return _PROJECT_ROOT
+
+
+def get_icdev_db_path(explicit: Optional[Union[str, Path]] = None) -> Path:
+    """Resolve the ICDEV database path.
+
+    Args:
+        explicit: Optional explicit path override (highest priority).
+
+    Returns:
+        Resolved Path to the ICDEV database.
+
+    Fallback chain:
+        1. explicit argument
+        2. ICDEV_DB_PATH env var
+        3. <project_root>/data/icdev.db
+    """
+    if explicit:
+        return Path(explicit)
+
+    env_path = os.environ.get("ICDEV_DB_PATH")
+    if env_path:
+        return Path(env_path)
+
+    return _DEFAULT_DB
+
+
+def get_memory_db_path(explicit: Optional[Union[str, Path]] = None) -> Path:
+    """Resolve the memory database path.
+
+    Fallback: ICDEV_MEMORY_DB_PATH env var > <project_root>/data/memory.db
+    """
+    if explicit:
+        return Path(explicit)
+
+    env_path = os.environ.get("ICDEV_MEMORY_DB_PATH")
+    if env_path:
+        return Path(env_path)
+
+    return _PROJECT_ROOT / "data" / "memory.db"
+
+
+def get_platform_db_path(explicit: Optional[Union[str, Path]] = None) -> Path:
+    """Resolve the platform (SaaS) database path.
+
+    Fallback: ICDEV_PLATFORM_DB_PATH env var > <project_root>/data/platform.db
+    """
+    if explicit:
+        return Path(explicit)
+
+    env_path = os.environ.get("ICDEV_PLATFORM_DB_PATH")
+    if env_path:
+        return Path(env_path)
+
+    return _PROJECT_ROOT / "data" / "platform.db"
+
+
+# ---------------------------------------------------------------------------
+# Connection helpers — delegate to storage layer (D-DB-20)
+# ---------------------------------------------------------------------------
+
+def _get_storage_connection(db_path, validate, row_factory):
+    """Delegate to tools.db.storage for backend-agnostic connections."""
+    try:
+        from tools.db.storage import get_connection
+        return get_connection(db_path=db_path, row_factory=row_factory, validate=validate)
+    except ImportError:
+        # Fallback: direct SQLite if storage module not available
+        pass
+
+    # Direct SQLite fallback (air-gap, minimal install)
+    path = get_icdev_db_path(db_path)
+    if validate and not path.exists():
+        raise FileNotFoundError(
+            f"Database not found: {path}\n"
+            "Run: python tools/db/init_icdev_db.py"
+        )
+    conn = sqlite3.connect(str(path))
+    if row_factory:
+        conn.row_factory = sqlite3.Row
+    return conn
+
+
+def get_db_connection(
+    db_path: Optional[Union[str, Path]] = None,
+    validate: bool = False,
+    row_factory: bool = True,
+):
+    """Get a connection to the ICDEV database.
+
+    Delegates to ``tools.db.storage`` which supports both SQLite and
+    PostgreSQL backends (D-DB-20). Falls back to direct SQLite if the
+    storage module is unavailable.
+
+    The returned connection supports context manager (``with`` statement)
+    and the standard sqlite3-compatible API: execute, commit, close.
+
+    Args:
+        db_path: Explicit path override (SQLite only).
+        validate: When *True*, raise ``FileNotFoundError`` if SQLite DB missing.
+        row_factory: When *True* (default), enable dict-like row access.
+
+    Returns:
+        A StorageConnection (or sqlite3.Connection fallback).
+    """
+    return _get_storage_connection(db_path, validate, row_factory)
+
+
+def get_memory_connection(
+    db_path: Optional[Union[str, Path]] = None,
+    validate: bool = False,
+    row_factory: bool = True,
+):
+    """Get a connection to the memory database."""
+    path = get_memory_db_path(db_path)
+    try:
+        from tools.db.storage import get_memory_connection as _get_mem
+        return _get_mem(db_path=path, validate=validate, row_factory=row_factory)
+    except ImportError:
+        pass
+
+    if validate and not path.exists():
+        raise FileNotFoundError(f"Memory database not found: {path}")
+    conn = sqlite3.connect(str(path))
+    if row_factory:
+        conn.row_factory = sqlite3.Row
+    return conn
+
+
+def get_platform_connection(
+    db_path: Optional[Union[str, Path]] = None,
+    validate: bool = False,
+    row_factory: bool = True,
+):
+    """Get a connection to the platform (SaaS) database."""
+    path = get_platform_db_path(db_path)
+    if validate and not path.exists():
+        raise FileNotFoundError(f"Platform database not found: {path}")
+    conn = sqlite3.connect(str(path))
+    if row_factory:
+        conn.row_factory = sqlite3.Row
+    return conn