lemming-cli 0.1.0__py3-none-any.whl

lemming/api/directories_test.py

@@ -0,0 +1,94 @@
+import pathlib
+import shutil
+import tempfile
+
+from lemming import api
+
+
+def test_list_directories(client, test_tasks):
+    """GET /api/directories lists subdirectories under the server root."""
+    root = api.app.state.root
+    (root / "subproject_a").mkdir(exist_ok=True)
+    (root / "subproject_b").mkdir(exist_ok=True)
+    (root / ".hidden").mkdir(exist_ok=True)
+
+    response = client.get("/api/directories")
+    assert response.status_code == 200
+    data = response.json()
+    names = [d["name"] for d in data["directories"]]
+    assert "subproject_a" in names
+    assert "subproject_b" in names
+    assert ".hidden" not in names  # hidden dirs excluded
+
+
+def test_create_directory(client, test_tasks):
+    """POST /api/directories creates a new directory."""
+    root = api.app.state.root
+    response = client.post("/api/directories", json={"name": "new_dir"})
+    assert response.status_code == 200
+    data = response.json()
+    assert data["name"] == "new_dir"
+    assert data["path"] == "new_dir"
+    assert (root / "new_dir").is_dir()
+
+    # Test creating in a subdirectory
+    (root / "parent").mkdir()
+    response = client.post(
+        "/api/directories", json={"path": "parent", "name": "child"}
+    )
+    assert response.status_code == 200
+    assert (root / "parent" / "child").is_dir()
+
+
+def test_create_directory_exists(client, test_tasks):
+    """POST /api/directories fails if directory already exists."""
+    root = api.app.state.root
+    (root / "existing").mkdir()
+    response = client.post("/api/directories", json={"name": "existing"})
+    assert response.status_code == 400
+    assert "already exists" in response.json()["detail"]
+
+
+def test_create_directory_traversal(client, test_tasks):
+    """POST /api/directories rejects path traversal."""
+    response = client.post(
+        "/api/directories", json={"path": "../../etc", "name": "foo"}
+    )
+    assert response.status_code == 403
+
+    response = client.post("/api/directories", json={"name": "../outside"})
+    assert response.status_code == 403
+
+
+def test_list_directories_traversal(client, test_tasks):
+    """GET /api/directories rejects path traversal."""
+    response = client.get("/api/directories", params={"path": "../../etc"})
+    assert response.status_code == 403
+
+
+def test_project_param_traversal_rejected(client, test_tasks):
+    """project param rejects path traversal attempts."""
+    response = client.get("/api/data", params={"project": "../../etc"})
+    assert response.status_code == 403
+
+
+def test_symlink_traversal_rejected(client, test_tasks):
+    """Symlinks pointing outside the root are rejected."""
+    root = api.app.state.root
+    external_dir = pathlib.Path(tempfile.mkdtemp())
+    try:
+        symlink = root / "sneaky_link"
+        symlink.symlink_to(external_dir)
+
+        # /api/directories should not list it (hidden by . filter won't help,
+        # but resolve_tasks_file and list_directories should reject traversal)
+        response = client.get("/api/data", params={"project": "sneaky_link"})
+        assert response.status_code == 403
+
+        response = client.get(
+            "/api/directories", params={"path": "sneaky_link"}
+        )
+        assert response.status_code == 403
+    finally:
+        symlink.unlink(missing_ok=True)
+        shutil.rmtree(external_dir)

lemming/api/files.py

@@ -0,0 +1,116 @@
+"""API routes for the file browser and raw file serving."""
+
+import importlib.resources
+import mimetypes
+import pathlib
+
+import fastapi
+import fastapi.responses
+
+from .. import paths
+
+router = fastapi.APIRouter()
+
+# Get the web directory for serving HTML templates
+web_dir = pathlib.Path(
+    str(importlib.resources.files("lemming").joinpath("web"))
+)
+
+
+@router.get("/api/files/{path:path}")
+def get_files_api(request: fastapi.Request, path: str):
+    """List the contents of a directory under the server root."""
+    base_path = request.app.state.root
+    target_path = (base_path / path).resolve()
+
+    if not target_path.is_relative_to(base_path) or paths.is_ignored(
+        target_path
+    ):
+        raise fastapi.HTTPException(403, "Forbidden")
+
+    if not target_path.is_dir():
+        raise fastapi.HTTPException(400, "Not a directory")
+
+    contents = []
+    for item in target_path.iterdir():
+        if paths.is_ignored(item):
+            continue
+        try:
+            stats = item.stat()
+        except OSError:
+            continue
+        rel_path = item.relative_to(base_path)
+        is_dir = item.is_dir()
+        contents.append(
+            {
+                "name": item.name + ("/" if is_dir else ""),
+                "path": str(rel_path),
+                "is_dir": is_dir,
+                "size": None if is_dir else stats.st_size,
+                "modified": stats.st_mtime,
+            }
+        )
+    return {
+        "path": path,
+        "contents": sorted(
+            contents, key=lambda x: (not x["is_dir"], x["name"].lower())
+        ),
+    }
+
+
+@router.get("/tasks/{task_id}/log")
+def serve_task_log(task_id: str):
+    """Serve the log viewer page for a task."""
+    return fastapi.responses.FileResponse(web_dir / "logs.html")
+
+
+@router.get("/files/{path:path}")
+def serve_files(request: fastapi.Request, path: str):
+    """Serve a file's contents, or the file browser page for directories."""
+    base_path = request.app.state.root
+    target_path = (base_path / path).resolve()
+
+    if not target_path.is_relative_to(base_path) or paths.is_ignored(
+        target_path
+    ):
+        raise fastapi.HTTPException(403, "Forbidden")
+
+    if target_path.is_dir():
+        return fastapi.responses.FileResponse(web_dir / "files.html")
+    if target_path.is_file():
+        # Guess the MIME type to identify binary formats.
+        guess, _ = mimetypes.guess_type(target_path)
+
+        # Consider images, video, audio, PDFs, and common archives as
+        # "binary" to be served as-is.
+        is_binary = guess and (
+            guess.startswith(("image/", "video/", "audio/"))
+            or guess
+            in (
+                "application/pdf",
+                "application/wasm",
+                "application/zip",
+                "application/x-zip-compressed",
+            )
+        )
+
+        # Special case: .ts files are frequently misidentified as video/mp2t.
+        if is_binary and target_path.suffix.lower() == ".ts":
+            is_binary = False
+
+        if is_binary:
+            return fastapi.responses.FileResponse(target_path)
+
+        # For everything else, force text/plain to ensure browser views
+        # source code.
+        return fastapi.responses.FileResponse(
+            target_path, media_type="text/plain"
+        )
+
+    raise fastapi.HTTPException(404, "Not found")
+
+
+@router.get("/files")
+def redirect_files():
+    """Redirect /files to the file browser at the root directory."""
+    return fastapi.responses.RedirectResponse("/files/")

lemming/api/files_test.py

@@ -0,0 +1,163 @@
+def test_root_redirect(client, git_repo):
+    response = client.get("/files", follow_redirects=False)
+    assert response.status_code in [302, 307, 301]
+    assert response.headers["location"].endswith("/files/")
+
+
+def test_list_root(client, git_repo):
+    # Test template response
+    response = client.get("/files/")
+    assert response.status_code == 200
+    assert "Lemming" in response.text
+
+    # Test API response
+    response = client.get("/api/files/")
+    assert response.status_code == 200
+    data = response.json()
+    names = [item["name"] for item in data["contents"]]
+    assert "file1.txt" in names
+    assert "dir1/" in names
+    assert "ignored.txt" not in names
+    assert "node_modules/" not in names
+
+    # Check metadata
+    file1 = next(
+        item for item in data["contents"] if item["name"] == "file1.txt"
+    )
+    assert file1["size"] == 8  # "content1"
+    assert "modified" in file1
+
+
+def test_list_subdir(client, git_repo):
+    # Test template response
+    response = client.get("/files/dir1")
+    assert response.status_code == 200
+    assert "Lemming" in response.text
+
+    # Test API response
+    response = client.get("/api/files/dir1")
+    assert response.status_code == 200
+    data = response.json()
+    names = [item["name"] for item in data["contents"]]
+    assert "file2.txt" in names
+
+
+def test_serve_file(client, git_repo):
+    response = client.get("/files/file1.txt")
+    assert response.status_code == 200
+    assert response.text == "content1"
+    assert "text/plain" in response.headers["content-type"]
+
+
+def test_serve_html_as_text(client, git_repo):
+    html_file = git_repo / "test.html"
+    html_file.write_text("<html><body>hello</body></html>")
+    response = client.get("/files/test.html")
+    assert response.status_code == 200
+    assert "text/plain" in response.headers["content-type"]
+    assert response.text == "<html><body>hello</body></html>"
+
+
+def test_serve_js_as_text(client, git_repo):
+    js_file = git_repo / "test.js"
+    js_file.write_text("console.log('hello');")
+    response = client.get("/files/test.js")
+    assert response.status_code == 200
+    assert "text/plain" in response.headers["content-type"]
+    assert response.text == "console.log('hello');"
+
+
+def test_serve_ignored_file(client, git_repo):
+    response = client.get("/files/ignored.txt")
+    assert response.status_code == 403
+    assert "Forbidden" in response.text
+
+
+def test_serve_nonexistent_file(client, git_repo):
+    response = client.get("/files/nonexistent.txt")
+    assert response.status_code == 404
+
+
+def test_list_non_git_dir(client, non_git_dir):
+    """Files should be listed without errors when not in a git repo."""
+    response = client.get("/api/files/")
+    assert response.status_code == 200
+    data = response.json()
+    names = [item["name"] for item in data["contents"]]
+
+    # All files should be visible since there's no git to check ignore rules
+    assert "file1.txt" in names
+    assert "ignored.txt" in names
+
+
+def test_serve_images_as_images(client, temp_repo):
+    png_file = temp_repo / "test.png"
+    png_file.write_bytes(b"fake png content")
+
+    response = client.get("/files/test.png")
+    assert response.status_code == 200
+    assert "image/png" in response.headers["content-type"]
+
+
+def test_serve_pdf_as_pdf(client, temp_repo):
+    pdf_file = temp_repo / "test.pdf"
+    pdf_file.write_bytes(b"%PDF-1.4 fake pdf")
+
+    response = client.get("/files/test.pdf")
+    assert response.status_code == 200
+    assert "application/pdf" in response.headers["content-type"]
+
+
+def test_serve_ts_as_text(client, temp_repo):
+    # .ts is often misidentified as video/mp2t
+    ts_file = temp_repo / "test.ts"
+    ts_file.write_text("export const a = 1;")
+
+    response = client.get("/files/test.ts")
+    assert response.status_code == 200
+    assert "text/plain" in response.headers["content-type"]
+
+
+def test_serve_json_as_text(client, temp_repo):
+    json_file = temp_repo / "test.json"
+    json_file.write_text('{"a": 1}')
+
+    response = client.get("/files/test.json")
+    assert response.status_code == 200
+    assert "text/plain" in response.headers["content-type"]
+
+
+def test_serve_unknown_extension_as_text(client, temp_repo):
+    unknown_file = temp_repo / "test.unknown_extension_xyz"
+    unknown_file.write_text("some content")
+
+    # In some environments, unknown extension might return octet-stream or None.
+    # Our API forces text/plain for anything not explicitly binary.
+    response = client.get("/files/test.unknown_extension_xyz")
+    assert response.status_code == 200
+    assert "text/plain" in response.headers["content-type"]
+
+
+def test_serve_no_extension_as_text(client, temp_repo):
+    no_ext_file = temp_repo / "Dockerfile"
+    no_ext_file.write_text("FROM alpine")
+
+    response = client.get("/files/Dockerfile")
+    assert response.status_code == 200
+    assert "text/plain" in response.headers["content-type"]
+
+
+def test_serve_zip_as_zip(client, temp_repo):
+    zip_file = temp_repo / "test.zip"
+    zip_file.write_bytes(b"fake zip content")
+
+    response = client.get("/files/test.zip")
+    assert response.status_code == 200
+    assert "zip" in response.headers["content-type"]
+
+
+def test_serve_log_page(client, test_tasks):
+    # Try to access the log page for task1
+    resp = client.get("/tasks/task1/log")
+    assert resp.status_code == 200
+    assert "text/html" in resp.headers["content-type"]

lemming/api/hooks.py

@@ -0,0 +1,15 @@
+"""API routes for listing orchestrator hooks."""
+
+import fastapi
+
+from .. import prompts
+from . import context
+
+router = fastapi.APIRouter()
+
+
+@router.get("/api/hooks")
+def list_hooks(request: fastapi.Request, project: str | None = None):
+    """List all available orchestrator hooks (built-in and project-specific)."""
+    tasks_file = context.resolve_tasks_file(request.app.state, project)
+    return prompts.list_hooks(tasks_file)

lemming/api/hooks_test.py

@@ -0,0 +1,33 @@
+from unittest.mock import patch
+
+import lemming.api
+
+
+def test_list_hooks(client, test_tasks):
+    """Test that the /api/hooks endpoint returns a list of available hooks."""
+    with patch("lemming.prompts.list_hooks") as mock_list_hooks:
+        mock_list_hooks.return_value = ["roadmap", "readability", "testing"]
+
+        response = client.get("/api/hooks")
+
+        assert response.status_code == 200
+        assert response.json() == ["roadmap", "readability", "testing"]
+        mock_list_hooks.assert_called_once()
+
+
+def test_list_hooks_with_project(client, test_tasks):
+    """Test that the /api/hooks endpoint works with a specified project."""
+    root = lemming.api.app.state.root
+    project_dir = root / "project1"
+    project_dir.mkdir()
+    tasks_file = project_dir / "tasks.yml"
+    tasks_file.touch()
+
+    with patch("lemming.prompts.list_hooks") as mock_list_hooks:
+        mock_list_hooks.return_value = ["roadmap"]
+
+        response = client.get("/api/hooks", params={"project": "project1"})
+
+        assert response.status_code == 200
+        assert response.json() == ["roadmap"]
+        assert mock_list_hooks.called

lemming/api/logging.py

@@ -0,0 +1,16 @@
+"""Logging filters for the API server."""
+
+import logging
+
+# Paths that should not appear in the uvicorn access log
+# (e.g. polling endpoints).
+QUIET_PATHS = {"/api/data", "GET /api/tasks/", "/api/files"}
+
+
+class QuietPollFilter(logging.Filter):
+    """Suppress access-log lines for high-frequency polling endpoints."""
+
+    def filter(self, record: logging.LogRecord) -> bool:
+        """Return False for log records that match a quiet path."""
+        msg = record.getMessage()
+        return not any(path in msg for path in QUIET_PATHS)

lemming/api/logging_test.py

@@ -0,0 +1,59 @@
+import logging
+
+from lemming import api
+
+
+def test_quiet_poll_filter():
+    """QuietPollFilter suppresses access-log lines for polling endpoints."""
+    filt = api.QuietPollFilter()
+
+    # Simulate a uvicorn access-log record for the polling endpoints.
+    for path in ("/api/data", "/api/files/burger", "/api/files"):
+        record = logging.LogRecord(
+            name="uvicorn.access",
+            level=logging.INFO,
+            pathname="",
+            lineno=0,
+            msg='%s - "%s %s HTTP/%s" %d',
+            args=("127.0.0.1:55964", "GET", path, "1.1", 200),
+            exc_info=None,
+        )
+        assert filt.filter(record) is False
+
+    # GET /api/tasks/{task_id} and GET /api/tasks/{task_id}/log should be
+    # quieted.
+    for path in ("/api/tasks/abc-123", "/api/tasks/xyz-789/log"):
+        record = logging.LogRecord(
+            name="uvicorn.access",
+            level=logging.INFO,
+            pathname="",
+            lineno=0,
+            msg='%s - "%s %s HTTP/%s" %d',
+            args=("127.0.0.1:55964", "GET", path, "1.1", 200),
+            exc_info=None,
+        )
+        assert filt.filter(record) is False
+
+    # Non-polling endpoints should still be logged.
+    record_other = logging.LogRecord(
+        name="uvicorn.access",
+        level=logging.INFO,
+        pathname="",
+        lineno=0,
+        msg='%s - "%s %s HTTP/%s" %d',
+        args=("127.0.0.1:55964", "GET", "/api/runners", "1.1", 200),
+        exc_info=None,
+    )
+    assert filt.filter(record_other) is True
+
+    # Important: POST /api/tasks should NOT be quieted.
+    record_post = logging.LogRecord(
+        name="uvicorn.access",
+        level=logging.INFO,
+        pathname="",
+        lineno=0,
+        msg='%s - "%s %s HTTP/%s" %d',
+        args=("127.0.0.1:55964", "POST", "/api/tasks/abc-123", "1.1", 200),
+        exc_info=None,
+    )
+    assert filt.filter(record_post) is True

lemming/api/loop.py

@@ -0,0 +1,45 @@
+"""Helpers to auto-start the orchestrator loop from API requests."""
+
+import os
+import pathlib
+import subprocess
+import sys
+
+import fastapi
+
+from .. import tasks
+
+
+def start_loop_if_needed(
+    app_state: fastapi.datastructures.State,
+    tasks_file: pathlib.Path,
+    cwd: pathlib.Path | None = None,
+):
+    """Start the orchestrator loop unless disabled or already running."""
+    if getattr(app_state, "disable_auto_start", False):
+        return
+
+    if tasks.is_loop_running(tasks_file):
+        return
+
+    # Use sys.executable -m lemming.main to ensure we use the same environment
+    # and pass the explicit tasks file.
+    cmd = [
+        sys.executable,
+        "-m",
+        "lemming.main",
+    ]
+    if getattr(app_state, "verbose", False):
+        cmd.append("--verbose")
+    cmd.extend(
+        [
+            "--tasks-file",
+            str(tasks_file),
+            "run",
+        ]
+    )
+
+    # Start the loop in a new session so it outlives the request.
+    subprocess.Popen(
+        cmd, start_new_session=True, env=os.environ.copy(), cwd=cwd
+    )

lemming/api/loop_test.py

@@ -0,0 +1,58 @@
+import pathlib
+import sys
+from unittest import mock
+
+from lemming import models, persistence
+from lemming.api import loop
+
+
+def test_start_loop_if_needed_already_running():
+    app_state = mock.Mock()
+    app_state.disable_auto_start = False
+    tasks_file = pathlib.Path("/tmp/tasks.yml")
+
+    with mock.patch("lemming.tasks.is_loop_running", return_value=True):
+        with mock.patch("subprocess.Popen") as mock_popen:
+            loop.start_loop_if_needed(app_state, tasks_file)
+            mock_popen.assert_not_called()
+
+
+def test_start_loop_if_needed_disabled():
+    app_state = mock.Mock()
+    app_state.disable_auto_start = True
+    tasks_file = pathlib.Path("/tmp/tasks.yml")
+
+    with mock.patch("lemming.tasks.is_loop_running", return_value=False):
+        with mock.patch("subprocess.Popen") as mock_popen:
+            loop.start_loop_if_needed(app_state, tasks_file)
+            mock_popen.assert_not_called()
+
+
+def test_start_loop_if_needed_starts_process(tmp_path):
+    app_state = mock.Mock()
+    app_state.disable_auto_start = False
+    app_state.verbose = True
+    tasks_file = tmp_path / "tasks.yml"
+    # Scaffold tasks file
+    persistence.save_tasks(tasks_file, models.Roadmap())
+    cwd = pathlib.Path("/tmp/cwd")
+
+    with mock.patch("lemming.tasks.is_loop_running", return_value=False):
+        with mock.patch("subprocess.Popen") as mock_popen:
+            loop.start_loop_if_needed(app_state, tasks_file, cwd=cwd)
+
+            expected_cmd = [
+                sys.executable,
+                "-m",
+                "lemming.main",
+                "--verbose",
+                "--tasks-file",
+                str(tasks_file),
+                "run",
+            ]
+            mock_popen.assert_called_once()
+            args, kwargs = mock_popen.call_args
+            assert args[0] == expected_cmd
+            assert kwargs["start_new_session"] is True
+            assert kwargs["cwd"] == cwd
+            assert "PATH" in kwargs["env"]

lemming/api/main.py

@@ -0,0 +1,53 @@
+"""FastAPI application setup: middleware, routers, and static files."""
+
+import importlib.resources
+import pathlib
+
+import fastapi
+import fastapi.responses
+import fastapi.staticfiles
+
+from .. import paths
+from . import auth, config, directories, files, hooks, tasks
+from . import logging as lemming_logging
+
+# Re-export for backward compatibility and tests
+QuietPollFilter = lemming_logging.QuietPollFilter
+
+
+class FilteredStaticFiles(fastapi.staticfiles.StaticFiles):
+    """Subclass of StaticFiles that filters out web test files."""
+
+    def lookup_path(self, path: str):
+        """Hide .spec.js and .test.js files from static file lookups."""
+        if path.endswith(".spec.js") or path.endswith(".test.js"):
+            return "", None
+        return super().lookup_path(path)
+
+
+app = fastapi.FastAPI()
+app.state.tasks_file = paths.get_default_tasks_file()
+app.state.root = pathlib.Path.cwd().resolve()
+app.state.disable_auto_start = False
+
+# Middleware
+app.middleware("http")(auth.share_token_middleware)
+
+# Include Routers
+app.include_router(tasks.router)
+app.include_router(files.router)
+app.include_router(directories.router)
+app.include_router(hooks.router)
+app.include_router(config.router)
+
+# Static files and root routes
+web_dir = pathlib.Path(
+    str(importlib.resources.files("lemming").joinpath("web"))
+)
+app.mount("/static", FilteredStaticFiles(directory=web_dir), name="static")
+
+
+@app.get("/")
+def read_index():
+    """Serve the main web UI page."""
+    return fastapi.responses.FileResponse(web_dir / "index.html")