mvgeos-gui 0.6.14__tar.gz

mvgeos_gui-0.6.14/PKG-INFO

@@ -0,0 +1,15 @@
+Metadata-Version: 2.4
+Name: mvgeos-gui
+Version: 0.6.14
+Summary: Desktop GUI for MvgeOS powered by NiceGUI
+License-Expression: MIT
+Requires-Dist: keyring>=24.0
+Requires-Dist: mvgeos-agent>=0.6.14
+Requires-Dist: mvgeos-core>=0.6.14
+Requires-Dist: mvgeos-provider>=0.6.14
+Requires-Dist: mvgeos-runes>=0.6.14
+Requires-Dist: mvgeos-tome>=0.6.14
+Requires-Dist: nicegui>=2.10.0
+Requires-Dist: pathspec>=0.12.0
+Requires-Dist: pywebview>=6.2.1
+Requires-Python: >=3.13

mvgeos_gui-0.6.14/pyproject.toml

@@ -0,0 +1,42 @@
+[project]
+name = "mvgeos-gui"
+version = "0.6.14"
+description = "Desktop GUI for MvgeOS powered by NiceGUI"
+requires-python = ">=3.13"
+license = "MIT"
+dependencies = [
+    "keyring>=24.0",
+    "mvgeos-agent>=0.6.14",
+    "mvgeos-core>=0.6.14",
+    "mvgeos-provider>=0.6.14",
+    "mvgeos-runes>=0.6.14",
+    "mvgeos-tome>=0.6.14",
+    "nicegui>=2.10.0",
+    "pathspec>=0.12.0",
+    "pywebview>=6.2.1",
+]
+
+[project.scripts]
+mvgeos-gui = "mvgeos_gui.main:main"
+
+[tool.uv.sources.mvgeos-agent]
+workspace = true
+
+[tool.uv.sources.mvgeos-core]
+workspace = true
+
+[tool.uv.sources.mvgeos-provider]
+workspace = true
+
+[tool.uv.sources.mvgeos-runes]
+workspace = true
+
+[tool.uv.sources.mvgeos-tome]
+workspace = true
+
+[tool.ruff]
+extend = "../pyproject.toml"
+
+[build-system]
+requires = ["uv_build>=0.11.2,<0.13"]
+build-backend = "uv_build"

mvgeos_gui-0.6.14/pyproject.toml.orig

@@ -0,0 +1,36 @@
+[project]
+name = "mvgeos-gui"
+version = "0.6.14"
+description = "Desktop GUI for MvgeOS powered by NiceGUI"
+requires-python = ">=3.13"
+license = "MIT"
+dependencies = [
+    # Explicit floors: uv_build does not substitute the workspace version, so
+    # bare names ship as unbounded Requires-Dist. Bumped in lockstep by ci.yml.
+    "keyring>=24.0",
+    "mvgeos-agent>=0.6.14",
+    "mvgeos-core>=0.6.14",
+    "mvgeos-provider>=0.6.14",
+    "mvgeos-runes>=0.6.14",
+    "mvgeos-tome>=0.6.14",
+    "nicegui>=2.10.0",
+    "pathspec>=0.12.0",
+    "pywebview>=6.2.1",
+]
+
+[project.scripts]
+mvgeos-gui = "mvgeos_gui.main:main"
+
+[tool.uv.sources]
+mvgeos-agent = { workspace = true }
+mvgeos-core = { workspace = true }
+mvgeos-provider = { workspace = true }
+mvgeos-runes = { workspace = true }
+mvgeos-tome = { workspace = true }
+
+[build-system]
+requires = ["uv_build>=0.11.2,<0.13"]
+build-backend = "uv_build"
+
+[tool.ruff]
+extend = "../pyproject.toml"

mvgeos_gui-0.6.14/src/mvgeos_gui/__init__.py

@@ -0,0 +1,16 @@
+"""MvgeOS Desktop GUI package powered by NiceGUI."""
+
+from __future__ import annotations
+
+import importlib.metadata
+
+
+def _installed_version() -> str:
+    """Return the installed distribution version ("unknown" if absent)."""
+    try:
+        return importlib.metadata.version("mvgeos-gui")
+    except importlib.metadata.PackageNotFoundError:
+        return "unknown"
+
+
+__version__ = _installed_version()

mvgeos_gui-0.6.14/src/mvgeos_gui/__main__.py

@@ -0,0 +1,6 @@
+"""Entrypoint for python -m mvgeos_gui."""
+
+from mvgeos_gui.main import main
+
+if __name__ == "__main__":
+    main()

mvgeos_gui-0.6.14/src/mvgeos_gui/app.py

@@ -0,0 +1,106 @@
+"""Application setup and page route definitions for mvgeos-gui."""
+
+import asyncio
+import contextlib
+
+from nicegui import app, ui
+
+from mvgeos_gui.components.keyboard import register_global_keyboard
+from mvgeos_gui.components.shell import render_shell
+from mvgeos_gui.core.database import init_db
+from mvgeos_gui.state import AppState, ServerState
+from mvgeos_gui.styles import inject_theme
+
+
+def build_page(state: AppState | None = None) -> None:
+    """Construct the MvgeOS GUI layout on the current page."""
+    current_state = state or AppState()
+    current_state.load_tomes()
+    # A fresh page load re-selects the session the browser was in (when it
+    # still exists); otherwise the user starts with no active session.
+    current_state.restore_active_tome()
+
+    saved_theme = current_state._config_service.load_app_settings().theme
+    theme = saved_theme if saved_theme in ("dark", "light") else "dark"
+    current_state._dark_mode = inject_theme(theme)
+
+    ui.add_head_html("""
+        <script>
+            document.addEventListener('keydown', function(e) {
+                var isP = (e.key === 'p' || e.key === 'P');
+                var isK = (e.key === 'k' || e.key === 'K');
+                var mod = (e.metaKey || e.ctrlKey) && !e.altKey;
+                if (mod && e.shiftKey && isP) {
+                    e.preventDefault();
+                }
+                if (mod && !e.shiftKey && isK) {
+                    e.preventDefault();
+                }
+            });
+        </script>
+    """)
+
+    render_shell(current_state)
+    # Global chords (Ctrl/Cmd+K or Ctrl/Cmd+Shift+P palette, Esc priority
+    # chain). The head script above only preventDefaults the browser's own
+    # handling of the chords; this bridge is what actually responds to
+    # them. Registered exactly once with ignore=[] so the chords work
+    # while typing in the composer or any other input: a second
+    # registration would dispatch every chord twice and toggle the
+    # palette open then immediately closed again.
+    register_global_keyboard(current_state)
+
+    # Web mode: a disconnect/refresh must fail closed — pending approval
+    # casts are denied because their decision surface is gone. The
+    # presenter is resolved lazily: binding happens when the agent is
+    # created, which may be after this page is constructed. NiceGUI may
+    # also fire this on reconnect, where denial is still the safe answer.
+    def _on_client_disconnect() -> None:
+        presenter = current_state._approval_presenter
+        if presenter is not None:
+            presenter.on_client_disconnect()
+
+    ui.context.client.on_disconnect(_on_client_disconnect)
+
+
+def _prewarm_client(client_state: AppState) -> None:
+    """Warm the per-client agent on page load (best effort, non-blocking)."""
+    service = client_state.get_agent_service()
+
+    async def _warm() -> None:
+        with contextlib.suppress(Exception):
+            await service.prewarm(client_state)
+
+    try:
+        loop = asyncio.get_running_loop()
+    except RuntimeError:
+        return
+    loop.create_task(_warm())
+
+
+def init_app(server: ServerState | None = None) -> ServerState:
+    """Initialize application routes and return the ServerState instance.
+
+    Every browser session gets its own per-client AppState minted from the
+    server, so no UI state (dialogs, current view, sidebar, transcript,
+    plan mode, auth) leaks across sessions. Disconnecting clients are
+    dropped fail-closed.
+    """
+    init_db()
+    server_state = server or ServerState()
+
+    @ui.page("/")
+    def index_page() -> None:
+        client_state = server_state.new_client_state()
+        # A returning browser keeps its sidebar preference: seed the fresh
+        # per-client flag from the per-browser cookie.
+        with contextlib.suppress(Exception):
+            if app.storage.user.get("sidebar-collapsed", False):
+                client_state.sidebar_open = False
+        ui.context.client.on_disconnect(
+            lambda: server_state.drop_client_state(client_state)
+        )
+        build_page(client_state)
+        _prewarm_client(client_state)
+
+    return server_state

mvgeos_gui-0.6.14/src/mvgeos_gui/approval/__init__.py

@@ -0,0 +1,47 @@
+"""Approval Rune GUI presenter package."""
+
+from mvgeos_gui.approval.presenter import (
+    ApprovalPresenter,
+    bind_approval_presenter,
+    unbind_approval_presenter,
+)
+from mvgeos_gui.approval.types import (
+    APPROVAL_RUNE_NAME,
+    ActivityRecord,
+    ApprovalDecision,
+    ApprovalOutcome,
+    ApprovalReasonCode,
+    ApprovalRequest,
+    ApprovalScope,
+    PermissionsView,
+    SourceIdentity,
+    SpellGrant,
+    SpellIdentity,
+    TrustedProject,
+    describe_operation,
+    is_approval_rune_name,
+    is_mutating_request,
+    spell_source_label,
+)
+
+__all__ = [
+    "APPROVAL_RUNE_NAME",
+    "ActivityRecord",
+    "ApprovalDecision",
+    "ApprovalOutcome",
+    "ApprovalPresenter",
+    "ApprovalReasonCode",
+    "ApprovalRequest",
+    "ApprovalScope",
+    "PermissionsView",
+    "SourceIdentity",
+    "SpellGrant",
+    "SpellIdentity",
+    "TrustedProject",
+    "bind_approval_presenter",
+    "describe_operation",
+    "is_approval_rune_name",
+    "is_mutating_request",
+    "spell_source_label",
+    "unbind_approval_presenter",
+]

mvgeos_gui-0.6.14/src/mvgeos_gui/approval/presenter.py

@@ -0,0 +1,227 @@
+"""GUI presenter for the Approval Rune's spell-cast gate.
+
+The host binds one ``ApprovalPresenter`` to the engine-owned runner's
+presenter slot at startup (see :func:`bind_approval_presenter`) and unbinds
+it on shutdown. The engine invokes the presenter as
+``await presenter(request)`` with the canonical ``ApprovalRequest``; the
+presenter drives the AppState-owned approval queue and returns the
+Summoner's canonical ``ApprovalDecision``. With no presenter bound, the
+engine denies (fail closed); every presenter-side failure also denies.
+
+The rune owns policy matching, persistence, and audit; this module only
+presents the request and returns the Summoner's decision.
+
+Permissions data (the settings-cog screen) comes from the Approval Rune's
+frozen ``get_permissions_view()`` / ``revoke_grant(kind, id)`` interface.
+Resolution order: the bound runner's host-privileged ``get_rune`` accessor
+(duck-typed; the engine owns that accessor), then an explicitly wired
+source (:meth:`set_permissions_source`). Nothing presenter-related lives
+on RuneAPI.
+"""
+
+from __future__ import annotations
+
+import contextlib
+import inspect
+import logging
+from typing import TYPE_CHECKING, Any
+
+from mvgeos_core.approval import (
+    ApprovalDecision,
+    ApprovalOutcome,
+    ApprovalReasonCode,
+    ApprovalRequest,
+    ApprovalScope,
+    deny,
+)
+
+from mvgeos_gui.approval.types import APPROVAL_RUNE_NAME, PermissionsView
+
+if TYPE_CHECKING:
+    from mvgeos_gui.state import AppState
+
+logger = logging.getLogger(__name__)
+
+
+def _deny_unbound(request: Any) -> ApprovalDecision:
+    """Fail-closed denial when the request itself is unusable."""
+    try:
+        return deny(request, ApprovalReasonCode.FAILURE)
+    except Exception:
+        return ApprovalDecision(
+            outcome=ApprovalOutcome.DENY,
+            scope=ApprovalScope.ONCE,
+            reason_code=ApprovalReasonCode.FAILURE,
+            request_digest="",
+        )
+
+
+class ApprovalPresenter:
+    """Host-side presenter: queues modal prompts, returns decisions.
+
+    Implements the engine's ``ApprovalPresenter`` contract
+    (``mvgeos_core.approval``): the engine invokes the presenter as
+    ``await presenter(request)``.
+    """
+
+    def __init__(self, state: AppState) -> None:
+        self._state = state
+        self._bound_runner: Any = None
+        self._permissions_source: Any = None
+
+    async def __call__(self, request: ApprovalRequest) -> ApprovalDecision:
+        """The engine's presenter contract: ``await presenter(request)``."""
+        return await self.request_approval(request)
+
+    async def request_approval(self, request: ApprovalRequest) -> ApprovalDecision:
+        """Await the Summoner's decision for one spell cast.
+
+        Never raises: any failure denies.
+        """
+        try:
+            future = self._state.enqueue_approval(request)
+            decision = await future
+        except Exception:
+            logger.exception("Approval presenter failed; denying")
+            decision = _deny_unbound(request)
+        if (
+            decision.outcome is ApprovalOutcome.ALLOW
+            and decision.scope is ApprovalScope.SESSION
+        ):
+            self._state.set_approval_session_badge(True)
+        return decision
+
+    def bind(self, runner: Any) -> bool:
+        """Install this presenter on the engine runner's presenter slot.
+
+        Returns True when the engine exposes the slot; False when the
+        engine contract has not landed yet (the gate then denies, per the
+        spec's fail-closed rule). Moving the presenter to a different
+        runner clears the old runner's slot first so a dead runner can
+        never receive Summoner decisions.
+        """
+        setter = getattr(runner, "set_approval_presenter", None)
+        if not callable(setter):
+            logger.warning(
+                "Engine runner has no approval presenter slot; "
+                "approval prompts will deny until the engine contract lands."
+            )
+            return False
+        old_runner = self._bound_runner
+        if old_runner is not None and old_runner is not runner:
+            old_clearer = getattr(old_runner, "clear_approval_presenter", None)
+            if callable(old_clearer):
+                with contextlib.suppress(Exception):
+                    old_clearer()
+        setter(self)
+        self._bound_runner = runner
+        self._state._approval_presenter = self
+        return True
+
+    def unbind(self) -> None:
+        """Remove the presenter and deny every outstanding request."""
+        runner = self._bound_runner
+        self._bound_runner = None
+        if runner is not None:
+            clearer = getattr(runner, "clear_approval_presenter", None)
+            if callable(clearer):
+                with contextlib.suppress(Exception):
+                    clearer()
+        self._state.cancel_pending_approvals()
+        self._state.set_approval_session_badge(False)
+        self._state._approval_presenter = None
+
+    def on_client_disconnect(self) -> None:
+        """Web mode: disconnect/refresh/lost client denies pending casts."""
+        self._state.cancel_pending_approvals()
+
+    def set_permissions_source(self, source: Any) -> None:
+        """Wire the Approval Rune's permissions interface explicitly."""
+        self._permissions_source = source
+
+    def _resolve_permissions_source(self) -> Any:
+        """Find the Approval Rune's permissions interface, if reachable.
+
+        Order: the bound runner's host-privileged ``get_rune`` accessor
+        (duck-typed; the engine owns that accessor), then the explicitly
+        wired source. Nothing presenter-related lives on RuneAPI.
+        """
+        runner = self._bound_runner
+        getter = getattr(runner, "get_rune", None)
+        if callable(getter):
+            try:
+                rune = getter(APPROVAL_RUNE_NAME)
+            except Exception:
+                logger.warning("Runner get_rune failed", exc_info=True)
+                rune = None
+            if rune is not None:
+                return rune
+        return self._permissions_source
+
+    async def get_permissions_view(self) -> PermissionsView | None:
+        """Return the parsed permissions view, or None when unavailable."""
+        source = self._resolve_permissions_source()
+        if source is None:
+            return None
+        getter = getattr(source, "get_permissions_view", None)
+        if not callable(getter):
+            return None
+        try:
+            result = getter()
+            if inspect.isawaitable(result):
+                result = await result
+        except Exception:
+            logger.warning("Approval Rune get_permissions_view failed", exc_info=True)
+            return None
+        return PermissionsView.from_dict(result)
+
+    async def revoke_grant(self, grant_kind: str, grant_id: str) -> bool:
+        """Revoke one grant through the Approval Rune; True when confirmed.
+
+        Uses the frozen ``revoke_grant(kind, id)`` action (kinds
+        "allow_rule", "deny_rule", "project", "session"). Revocation
+        persists immediately and takes effect before the next cast.
+        """
+        source = self._resolve_permissions_source()
+        if source is None:
+            return False
+        action = getattr(source, "revoke_grant", None)
+        if not callable(action):
+            return False
+        try:
+            result = action(grant_kind, grant_id)
+            if inspect.isawaitable(result):
+                result = await result
+            return bool(result)
+        except Exception:
+            logger.warning("Approval Rune revoke failed", exc_info=True)
+            return False
+
+
+def bind_approval_presenter(state: AppState, agent: Any) -> ApprovalPresenter | None:
+    """Bind the GUI presenter to an agent's engine runner slot.
+
+    Reuses the state's presenter across agent recreations (the agent is
+    rebuilt on project/tome changes). Returns the presenter when bound,
+    None when the agent exposes no runner or the engine slot is missing.
+    """
+    presenter: ApprovalPresenter | None = state._approval_presenter
+    if presenter is None:
+        presenter = ApprovalPresenter(state)
+    runner = getattr(agent, "_runner", None)
+    if runner is None:
+        logger.debug("Agent exposes no engine runner; presenter not bound")
+        return None
+    if presenter.bind(runner):
+        return presenter
+    return None
+
+
+def unbind_approval_presenter(state: AppState) -> None:
+    """Unbind the GUI presenter (shutdown): pending casts deny."""
+    presenter = state._approval_presenter
+    if presenter is not None:
+        presenter.unbind()
+    else:
+        state.cancel_pending_approvals()
+        state.set_approval_session_badge(False)

mvgeos_gui-0.6.14/src/mvgeos_gui/approval/queue.py

@@ -0,0 +1,187 @@
+"""AppState-owned approval queue: one modal, one cast.
+
+Parallel spell-cast batches queue here and are presented strictly one at a
+time: the active request holds the single future the presenter awaits, and
+only when it resolves does the next queued request become active. Every
+lost decision surface (dialog close, Escape, disconnect, shutdown, context
+change) resolves outstanding futures as denied.
+
+The queue stores the canonical ``mvgeos_core.approval`` types: the engine
+isinstance-checks the returned ``ApprovalDecision``, and every decision is
+bound to the active request's ``argument_digest``.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import logging
+import os
+from collections import deque
+from dataclasses import dataclass
+
+from mvgeos_core.approval import (
+    ApprovalDecision,
+    ApprovalOutcome,
+    ApprovalReasonCode,
+    ApprovalRequest,
+    ApprovalScope,
+)
+
+logger = logging.getLogger(__name__)
+
+
+def _normalize_project_root(value: str) -> str:
+    """Platform-normalized form of a project root for comparison.
+
+    The engine hands ``project_root`` over as a raw string while the GUI
+    passes ``str(Path)``; on Windows those spell the same directory with
+    different separators (``/`` vs ``\\``), which a naive string compare
+    reads as a context change and force-denies the decision. Normalizing
+    both sides keeps the stale check fail-closed on genuinely different
+    directories while accepting identical ones.
+    """
+    return os.path.normcase(os.path.normpath(value))
+
+
+def is_request_stale(
+    request: ApprovalRequest,
+    *,
+    project_root: str | None,
+    tome_id: str | None,
+) -> bool:
+    """Check whether a response arrived for a moved-on context.
+
+    The stale-response rule: if the active tome or project no longer
+    matches the frozen request, the response is discarded and the cast
+    denied. Cast identity and the argument digest are structural: the
+    queue always binds the decision to the active request, so they need
+    no separate check. An empty tome id counts as "no active tome".
+    """
+    if project_root is not None and _normalize_project_root(
+        request.project_root
+    ) != _normalize_project_root(project_root):
+        return True
+    live_tome = tome_id or None
+    request_tome = request.tome_id or None
+    if live_tome is None and request_tome is None:
+        return False
+    return request_tome != live_tome
+
+
+def deny_request(
+    request: ApprovalRequest,
+    reason_code: ApprovalReasonCode = ApprovalReasonCode.FAILURE,
+) -> ApprovalDecision:
+    """Build a denial decision bound to one request's argument digest."""
+    return ApprovalDecision(
+        outcome=ApprovalOutcome.DENY,
+        scope=ApprovalScope.ONCE,
+        reason_code=reason_code,
+        request_digest=request.argument_digest,
+    )
+
+
+@dataclass
+class _ActiveApproval:
+    request: ApprovalRequest
+    future: asyncio.Future[ApprovalDecision]
+
+
+class ApprovalQueue:
+    """FIFO queue of pending approval requests with a single active slot."""
+
+    def __init__(self) -> None:
+        self._pending: deque[_ActiveApproval] = deque()
+        self._active: _ActiveApproval | None = None
+
+    @property
+    def pending_count(self) -> int:
+        """Number of requests waiting behind the active one."""
+        return len(self._pending)
+
+    @property
+    def active_request(self) -> ApprovalRequest | None:
+        """The request currently shown in the modal, if any."""
+        return self._active.request if self._active is not None else None
+
+    def enqueue(self, request: ApprovalRequest) -> asyncio.Future[ApprovalDecision]:
+        """Queue a request; returns the future the presenter awaits."""
+        future: asyncio.Future[ApprovalDecision] = (
+            asyncio.get_running_loop().create_future()
+        )
+        self._pending.append(_ActiveApproval(request=request, future=future))
+        return future
+
+    def activate_next(self) -> ApprovalRequest | None:
+        """Move the queue head into the active slot (one modal at a time)."""
+        if self._active is not None or not self._pending:
+            return self.active_request
+        self._active = self._pending.popleft()
+        return self._active.request
+
+    def resolve_active(
+        self,
+        outcome: ApprovalOutcome,
+        scope: ApprovalScope = ApprovalScope.ONCE,
+        reason_code: ApprovalReasonCode = ApprovalReasonCode.USER,
+        *,
+        project_root: str | None = None,
+        tome_id: str | None = None,
+    ) -> ApprovalDecision | None:
+        """Resolve the active request, applying the stale-response rule.
+
+        Builds the decision bound to the active request's argument digest.
+        Returns the effective decision (forced deny when stale), or None
+        when no request is active.
+        """
+        active = self._active
+        if active is None:
+            return None
+        if is_request_stale(active.request, project_root=project_root, tome_id=tome_id):
+            logger.warning(
+                "Approval decision for cast %s arrived stale; denying",
+                active.request.cast_id,
+            )
+            outcome = ApprovalOutcome.DENY
+            scope = ApprovalScope.ONCE
+            reason_code = ApprovalReasonCode.FAILURE
+        effective = ApprovalDecision(
+            outcome=outcome,
+            scope=scope,
+            reason_code=reason_code,
+            request_digest=active.request.argument_digest,
+        )
+        self._active = None
+        if not active.future.done():
+            active.future.set_result(effective)
+        return effective
+
+    def deny_active(
+        self, reason_code: ApprovalReasonCode = ApprovalReasonCode.FAILURE
+    ) -> ApprovalDecision | None:
+        """Deny the active request (dialog closed, Escape, disconnect)."""
+        active = self._active
+        if active is None:
+            return None
+        return self.resolve_active(
+            ApprovalOutcome.DENY,
+            ApprovalScope.ONCE,
+            reason_code,
+            project_root=active.request.project_root,
+            tome_id=active.request.tome_id,
+        )
+
+    def cancel_all(self) -> list[ApprovalRequest]:
+        """Deny every outstanding request; returns the denied requests."""
+        denied: list[ApprovalRequest] = []
+        if self._active is not None:
+            denied.append(self._active.request)
+            if not self._active.future.done():
+                self._active.future.set_result(deny_request(self._active.request))
+            self._active = None
+        while self._pending:
+            item = self._pending.popleft()
+            denied.append(item.request)
+            if not item.future.done():
+                item.future.set_result(deny_request(item.request))
+        return denied