ixt-cli 0.8.0__py3-none-any.whl

ixt/cli/cmd_config.py

@@ -0,0 +1,295 @@
+"""``ixt tool config`` subcommand and its action handlers."""
+
+from __future__ import annotations
+
+import argparse
+from collections.abc import Callable
+
+from ixt.cli.render import format_exposed_bins, id_suffix
+from ixt.config.models import ToolRecord
+from ixt.config.settings import get_settings
+from ixt.core.install import display_tool_name
+from ixt.libs.logger import get_logger
+from ixt.libs.style import bold, cyan, dim, green, red, yellow
+
+_ALL_TOOLS_SENTINEL = "__all__"
+
+
+def cmd_config(args: argparse.Namespace) -> int:
+    """Dispatch ``ixt tool config <target> <action>`` to the right handler."""
+    logger = get_logger("config")
+    if args.tool != _ALL_TOOLS_SENTINEL:
+        from ixt.config.settings import get_settings
+        from ixt.core.install import resolve_tool_name
+
+        settings = get_settings()
+        try:
+            args.tool = resolve_tool_name(args.tool, settings=settings)
+        except ValueError as e:
+            logger.error(str(e))
+            return 1
+    return _CONFIG_ACTIONS[args.config_action](args, logger)
+
+
+def _cmd_config_expose(args: argparse.Namespace, logger) -> int:
+    from ixt.core.expose import reexpose_tool
+
+    settings = get_settings()
+    rules = args.rules
+
+    if args.tool == _ALL_TOOLS_SENTINEL:
+        meta_files = settings.iter_installed_metadata()
+        if not meta_files:
+            logger.info("No tools installed")
+            return 0
+        for meta_file in meta_files:
+            record = ToolRecord.load_json(meta_file)
+            result = reexpose_tool(record, rules, settings)
+            logger.info(f"  {bold(display_tool_name(record, settings))} {id_suffix(record.name)}")
+            logger.info(f"    exposed: {format_exposed_bins(result.linked)}")
+        return 0
+
+    meta_file = settings.get_tool_metadata_file(args.tool)
+    if not meta_file.exists():
+        logger.error(f"Tool '{args.tool}' is not installed")
+        return 1
+
+    result = reexpose_tool(ToolRecord.load_json(meta_file), rules, settings)
+
+    logger.info(f"  exposed: {format_exposed_bins(result.linked)}")
+    return 0
+
+
+def _cmd_config_pkg_action(args: argparse.Namespace, logger) -> int:
+    """Shared inject/uninject handler — the action is on ``args.config_action``."""
+    if args.tool == _ALL_TOOLS_SENTINEL:
+        logger.error("'__all__' is only supported with 'expose'")
+        return 1
+
+    from ixt.core.inject import (
+        PackageAlreadyInjectedError,
+        PackageNotInjectedError,
+        inject_packages,
+        uninject_packages,
+    )
+
+    if args.config_action == "inject":
+        op, dup_exc, marker, verb, prep = (
+            inject_packages,
+            PackageAlreadyInjectedError,
+            green("+"),
+            "injected",
+            "into",
+        )
+    else:
+        op, dup_exc, marker, verb, prep = (
+            uninject_packages,
+            PackageNotInjectedError,
+            red("-"),
+            "uninjected",
+            "from",
+        )
+
+    try:
+        op(args.tool, [args.package])
+    except FileNotFoundError:
+        logger.error(f"Tool '{args.tool}' is not installed")
+        return 1
+    except dup_exc as e:
+        logger.error(str(e))
+        return 1
+    except ValueError as e:
+        logger.error(str(e))
+        return 1
+
+    logger.info(f"  {marker} {verb} {cyan(args.package)} {prep} {bold(args.tool)}")
+    return 0
+
+
+def _cmd_config_env(args: argparse.Namespace, logger) -> int:
+    if args.tool == _ALL_TOOLS_SENTINEL:
+        logger.error("'__all__' is not supported with 'env'")
+        return 1
+
+    settings = get_settings()
+    meta_file = settings.get_tool_metadata_file(args.tool)
+    if not meta_file.exists():
+        logger.error(f"Tool '{args.tool}' is not installed")
+        return 1
+
+    record = ToolRecord.load_json(meta_file)
+
+    action = getattr(args, "env_action", None)
+
+    if action is None or action == "list":
+        _print_env_policy(record, logger)
+        return 0
+
+    from ixt.config.env_policy import apply_policy
+
+    if action == "reset":
+        record.env_base = "all"
+        record.env_allow = []
+        record.env_deny = {}
+    elif action == "base":
+        record.env_base = args.value
+    elif action == "allow":
+        for pat in args.patterns:
+            if pat not in record.env_allow:
+                record.env_allow.append(pat)
+    elif action == "deny":
+        exceptions = getattr(args, "exceptions", [])
+        for pat in args.patterns:
+            existing = record.env_deny.get(pat, {})
+            existing_except = existing.get("except", [])
+            record.env_deny[pat] = {"except": sorted(set(existing_except) | set(exceptions))}
+
+    record.save_json(meta_file)
+
+    if record.exposed_bins:
+        apply_policy(record, settings.bin_dir)
+
+    _warn_env_policy_without_bwrap(record, logger)
+    _print_env_policy(record, logger)
+    return 0
+
+
+def _warn_env_policy_without_bwrap(record: ToolRecord, logger) -> None:
+    """Block warning at config-time when env policy is set but bwrap is missing.
+
+    Unconditional (no marker file): the user is configuring the policy
+    *now*, they need to know its effective scope before they trust it.
+    The runtime warning (separate path, marker-throttled) is for
+    repeated invocations afterwards.
+    """
+    from ixt.config.env_policy import DEGRADED_WARNING_LINES, has_env_policy
+    from ixt.libs.shell import command_exists
+
+    if not has_env_policy(record):
+        return
+    if command_exists("bwrap"):
+        return
+    for line in DEGRADED_WARNING_LINES:
+        logger.warn(line)
+
+
+def _print_env_policy(record: ToolRecord, logger) -> None:
+    from ixt.config.env_policy import ENV_MODELS, has_env_policy
+    from ixt.config.fs_policy import has_fs_policy
+
+    logger.info(f"env policy for {bold(record.name)}:")
+    base_label = record.env_base
+    if record.env_base in ENV_MODELS:
+        patterns = " ".join(ENV_MODELS[record.env_base])
+        base_label = f"{record.env_base}  ({dim(patterns)})"
+    logger.info(f"  base : {base_label}")
+    if record.env_allow:
+        logger.info(f"  allow: {' '.join(cyan(p) for p in record.env_allow)}")
+    else:
+        logger.info(f"  allow: {dim('(none)')}")
+    if record.env_deny:
+        for pat, rule in record.env_deny.items():
+            excs = rule.get("except", [])
+            except_str = f"  (except: {', '.join(cyan(e) for e in excs)})" if excs else ""
+            logger.info(f"  deny : {red(pat)}{except_str}")
+    else:
+        logger.info(f"  deny : {dim('(none)')}")
+    if not has_env_policy(record) and not has_fs_policy(record):
+        logger.info(f"  {dim('no policy — tool runs with full environment (symlink)')}")
+
+
+def _auto_promote_fs_base(record: ToolRecord, logger) -> None:
+    """If user adds fs ro/rw/scratch while fs_base is "all", promote to "app-minimal".
+
+    Without this, ``fs ro X`` alone enters bwrap with an empty sandbox
+    (no preset mounted) → ``bwrap: execvp ...: No such file or directory``.
+    Promotion gives a sane default; user can widen later with
+    ``fs base app-common`` or narrow further with ``fs base none``.
+    """
+    if record.fs_base == "all":
+        record.fs_base = "app-minimal"
+        logger.warn('note: fs_base auto-set to "app-minimal" — tool binary + libs only,')
+        logger.warn("      your project files are NOT visible. Add 'fs rw .' or")
+        logger.warn("      'fs base app-common' to widen access.")
+
+
+def _cmd_config_fs(args: argparse.Namespace, logger) -> int:
+    if args.tool == _ALL_TOOLS_SENTINEL:
+        logger.error("'__all__' is not supported with 'fs'")
+        return 1
+
+    settings = get_settings()
+    meta_file = settings.get_tool_metadata_file(args.tool)
+    if not meta_file.exists():
+        logger.error(f"Tool '{args.tool}' is not installed")
+        return 1
+
+    record = ToolRecord.load_json(meta_file)
+    action = getattr(args, "fs_action", None)
+
+    if action is None or action == "list":
+        _print_fs_policy(record, logger)
+        return 0
+
+    from ixt.config.env_policy import apply_policy
+
+    if action in ("ro", "rw", "scratch"):
+        _auto_promote_fs_base(record, logger)
+
+    if action == "reset":
+        record.fs_base = "all"
+        record.fs_ro = []
+        record.fs_rw = []
+        record.fs_scratch = []
+    elif action == "base":
+        record.fs_base = args.value
+    elif action == "ro":
+        for p in args.paths:
+            if p not in record.fs_ro:
+                record.fs_ro.append(p)
+    elif action == "rw":
+        for p in args.paths:
+            if p not in record.fs_rw:
+                record.fs_rw.append(p)
+    elif action == "scratch":
+        for p in args.paths:
+            if p not in record.fs_scratch:
+                record.fs_scratch.append(p)
+
+    record.save_json(meta_file)
+
+    if record.exposed_bins:
+        apply_policy(record, settings.bin_dir)
+
+    _print_fs_policy(record, logger)
+    return 0
+
+
+def _print_fs_policy(record: ToolRecord, logger) -> None:
+    from ixt.config.fs_policy import has_fs_policy
+
+    logger.info(f"fs policy for {bold(record.name)}:")
+    logger.info(f"  base   : {record.fs_base}")
+    if record.fs_ro:
+        logger.info(f"  ro     : {' '.join(cyan(p) for p in record.fs_ro)}")
+    else:
+        logger.info(f"  ro     : {dim('(none)')}")
+    if record.fs_rw:
+        logger.info(f"  rw     : {' '.join(cyan(p) for p in record.fs_rw)}")
+    else:
+        logger.info(f"  rw     : {dim('(none)')}")
+    if record.fs_scratch:
+        logger.info(f"  scratch: {' '.join(yellow(p) for p in record.fs_scratch)}")
+    else:
+        logger.info(f"  scratch: {dim('(none)')}")
+    if not has_fs_policy(record):
+        logger.info(f"  {dim('no fs policy — tool runs without filesystem isolation')}")
+
+
+_CONFIG_ACTIONS: dict[str, Callable] = {
+    "expose": _cmd_config_expose,
+    "inject": _cmd_config_pkg_action,
+    "uninject": _cmd_config_pkg_action,
+    "env": _cmd_config_env,
+    "fs": _cmd_config_fs,
+}

ixt/cli/cmd_info.py

@@ -0,0 +1,116 @@
+"""``ixt tool list`` and ``ixt tool info`` subcommands."""
+
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+
+from ixt.cli.render import format_exposed_bin
+from ixt.config.models import ToolRecord
+from ixt.config.settings import get_settings
+from ixt.core.install import display_tool_name, resolve_tool_arg
+from ixt.libs.logger import get_logger
+from ixt.libs.output import data
+from ixt.libs.style import bold, cyan, dim
+
+
+def _load_binary_metadata(env_dir: Path) -> dict | None:
+    """Load binary backend metadata from env_dir, or None if absent."""
+    path = env_dir / "binary_metadata.json"
+    if not path.exists():
+        return None
+    import json
+
+    with path.open(encoding="utf-8") as f:
+        return json.load(f)
+
+
+def cmd_list(args: argparse.Namespace) -> int:
+    logger = get_logger("list")
+    settings = get_settings()
+    meta_files = settings.iter_installed_metadata()
+
+    if not meta_files:
+        logger.info("No tools installed")
+        return 0
+
+    verbose = bool(getattr(args, "verbose_list", False))
+
+    records = [ToolRecord.load_json(mf) for mf in meta_files]
+    display_counts: dict[str, int] = {}
+    for r in records:
+        display = display_tool_name(r, settings)
+        display_counts[display] = display_counts.get(display, 0) + 1
+
+    for record in records:
+        display = display_tool_name(record, settings)
+        dn = record.name if (verbose or display_counts.get(display, 0) > 1) else display
+
+        version = f" {dim(record.version)}" if record.version else ""
+        backend_tag = dim(f"[{record.backend}]")
+        if record.exposed_bins:
+            bins = ", ".join(
+                format_exposed_bin(n, s) for n, s in sorted(record.exposed_bins.items())
+            )
+        else:
+            bins = dim("none")
+        line = f"  {bold(dn)}{version}  {backend_tag}  {bins}"
+        if record.injected:
+            inj = ", ".join(record.injected)
+            line += f"  {dim(f'+{inj}')}"
+        data(line)
+
+    return 0
+
+
+def cmd_info(args: argparse.Namespace) -> int:
+    logger = get_logger("info")
+    settings = get_settings()
+
+    try:
+        tool_name = resolve_tool_arg(args.tool, settings=settings)
+    except ValueError as e:
+        logger.error(str(e))
+        return 1
+
+    meta_file = settings.get_tool_metadata_file(tool_name)
+
+    if not meta_file.exists():
+        logger.error(f"Tool '{args.tool}' is not installed")
+        logger.error(f"  {dim('Hint: run ixt tool list to see installed tools')}")
+        return 1
+
+    record = ToolRecord.load_json(meta_file)
+
+    data(f"  {bold(display_tool_name(record, settings))}")
+    data(f"  Id:       {record.name}")
+    data(f"  Backend:  {record.backend}")
+    if record.name != record.pkg():
+        data(f"  Package:  {record.pkg()}")
+    data(f"  Spec:     {record.spec}")
+    data(f"  Version:  {record.version or dim('unknown')}")
+    data(f"  Env:      {dim(record.env_dir)}")
+    data(f"  Rules:    {', '.join(record.expose_rules)}")
+
+    if record.backend == "binary":
+        from ixt.net.source import parse_spec as _parse_spec
+
+        repo_spec = _parse_spec(record.spec)
+        if repo_spec:
+            data(f"  Source:   {repo_spec.owner}/{repo_spec.repo}")
+        bmeta = _load_binary_metadata(Path(record.env_dir))
+        if bmeta:
+            data(f"  Release:  {bmeta.get('tag', dim('unknown'))}")
+            data(f"  Asset:    {bmeta.get('asset_name', dim('unknown'))}")
+
+    if record.injected:
+        data(f"  Injected: {', '.join(cyan(p) for p in record.injected)}")
+
+    if record.exposed_bins:
+        data("  Exposed:")
+        for name, source in sorted(record.exposed_bins.items()):
+            data(f"    {cyan(name)} {dim('->')} {dim(source)}")
+    else:
+        data(f"  Exposed:  {dim('none')}")
+
+    return 0