netconverter-cli 0.4.0__py3-none-any.whl

netconverter_cli/__init__.py

@@ -0,0 +1,3 @@
+"""NetConverter CLI: file transfer and conversation are separate paths."""
+
+__version__ = "0.4.0"

netconverter_cli/activity.py

@@ -0,0 +1,83 @@
+"""What the local MCP bridge did, as metadata the full-screen app can show.
+
+One JSON line per bridge tool call in ``.netconverter/bridge.jsonl``: time,
+AI client name, tool, workspace-relative path, sha256, byte count, job id,
+job type, vendors and status. Configuration text, tool results and
+credentials are never written: only the fields in ``FIELDS`` survive, and
+each must be a short scalar.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import time
+from pathlib import Path
+
+LOG_NAME = "bridge.jsonl"
+FIELDS = ("ts", "client", "tool", "path", "sha256", "bytes", "files", "job_id",
+          "job_type", "source_vendor", "target_vendor", "status", "error")
+MAX_BYTES = 512 * 1024
+KEEP_LINES = 500
+_TEXT = re.compile(r"[\w .:/@+()-]{0,200}\Z")
+
+
+def _clean(entry: dict) -> dict:
+    out = {}
+    for key in FIELDS:
+        value = entry.get(key)
+        if isinstance(value, bool) or value is None:
+            continue
+        if isinstance(value, (int, float)) and abs(value) < 1e13:
+            out[key] = value
+        elif isinstance(value, str) and _TEXT.fullmatch(value):
+            out[key] = value
+    return out
+
+
+def record(state_dir: Path, **entry) -> None:
+    """Append one metadata line; never raises (the bridge must keep serving)."""
+    try:
+        state_dir.mkdir(mode=0o700, exist_ok=True)
+        path = state_dir / LOG_NAME
+        if path.is_symlink():
+            return
+        line = json.dumps(_clean({"ts": round(time.time(), 3), **entry}), sort_keys=True) + "\n"
+        fd = os.open(path, os.O_WRONLY | os.O_APPEND | os.O_CREAT, 0o600)
+        with os.fdopen(fd, "a", encoding="utf-8") as stream:
+            stream.write(line)
+        if path.stat().st_size > MAX_BYTES:
+            kept = path.read_text(encoding="utf-8").splitlines()[-KEEP_LINES:]
+            tmp = path.with_suffix(".tmp")
+            tmp.write_text("\n".join(kept) + "\n", encoding="utf-8")
+            os.replace(tmp, path)
+    except OSError:
+        pass
+
+
+def recent(state_dir: Path, limit: int = 20) -> list[dict]:
+    """Newest-last entries; malformed lines are skipped."""
+    path = state_dir / LOG_NAME
+    try:
+        if path.is_symlink() or not path.is_file():
+            return []
+        lines = path.read_text(encoding="utf-8").splitlines()[-max(limit, 1):]
+    except OSError:
+        return []
+    out = []
+    for line in lines:
+        try:
+            item = json.loads(line)
+        except ValueError:
+            continue
+        if isinstance(item, dict):
+            out.append(_clean(item))
+    return out
+
+
+def mtime(state_dir: Path) -> float:
+    try:
+        return (state_dir / LOG_NAME).stat().st_mtime
+    except OSError:
+        return 0.0

netconverter_cli/api.py

@@ -0,0 +1,257 @@
+"""Direct NetConverter data channel. No model SDK imports belong here."""
+
+from __future__ import annotations
+
+import re
+import uuid
+from urllib.parse import urlsplit
+
+import httpx
+
+DEFAULT_BASE = "https://api.netconverter.ai/external/v1"
+
+
+class APIError(RuntimeError):
+    def __init__(self, status: int, code: str, request_id: str = "", detail=None):
+        super().__init__(
+            f"NetConverter {code} (HTTP {status}, request {request_id or 'unavailable'})"
+        )
+        self.status, self.code, self.request_id, self.detail = (
+            status,
+            code,
+            request_id,
+            detail,
+        )
+
+
+def check_url(base: str) -> str:
+    """HTTPS only (HTTP for explicit loopback testing); no userinfo/query/fragment."""
+    parts = urlsplit(base)
+    if parts.username or parts.password or parts.query or parts.fragment:
+        raise ValueError("Invalid server URL")
+    if parts.scheme != "https" and not (
+        parts.scheme == "http" and parts.hostname in {"127.0.0.1", "localhost", "::1"}
+    ):
+        raise ValueError(
+            "Server connections require HTTPS (HTTP only for explicit loopback testing)"
+        )
+    return base
+
+
+class StaticCredential:
+    """An API key (``nck_*`` or terminal_quick). It cannot be refreshed."""
+
+    kind = "key"
+
+    def __init__(self, key: str):
+        self._key = key
+
+    def token(self) -> str:
+        return self._key
+
+    def refresh(self) -> bool:
+        return False
+
+
+class BearerAuth(httpx.Auth):
+    """Bearer from a credential; one refresh-and-retry on HTTP 401.
+
+    Works for static keys (no retry) and for Clerk OAuth sessions, whose
+    ``token()`` refreshes an expiring access token and whose ``refresh()``
+    forces a refresh after the server rejected the current one.
+    """
+
+    requires_request_body = True
+
+    def __init__(self, credential):
+        self.credential = credential
+
+    def auth_flow(self, request):
+        request.headers["Authorization"] = f"Bearer {self.credential.token()}"
+        response = yield request
+        if response.status_code == 401 and self.credential.refresh():
+            request.headers["Authorization"] = f"Bearer {self.credential.token()}"
+            yield request
+
+
+def as_credential(key):
+    return StaticCredential(key) if isinstance(key, str) else key
+
+
+class Client:
+    # Path allowlist for this client's restricted surface.
+    _ALLOWED = re.compile(r"quick/[A-Za-z0-9_/-]{1,200}\Z")
+
+    def __init__(self, key, base: str = DEFAULT_BASE, *, transport=None):
+        check_url(base)
+        self.credential = as_credential(key)
+        self.http = httpx.Client(
+            base_url=base.rstrip("/") + "/",
+            timeout=60,
+            auth=BearerAuth(self.credential),
+            transport=transport,
+            follow_redirects=False,
+            trust_env=False,
+        )
+
+    def close(self):
+        self.http.close()
+
+    @staticmethod
+    def identifier(value: str) -> str:
+        if not re.fullmatch(r"[A-Za-z0-9_-]{1,80}", value):
+            raise ValueError("Invalid resource identifier")
+        return value
+
+    def _send(self, method, path, idempotency_key=None, **kwargs):
+        if not self._ALLOWED.fullmatch(path) or ".." in path:
+            raise ValueError("Only the restricted NetConverter API may be called")
+        headers = {"X-Request-ID": "req_" + uuid.uuid4().hex}
+        if idempotency_key:
+            headers["Idempotency-Key"] = idempotency_key
+        try:
+            response = self.http.request(method, path, headers=headers, **kwargs)
+        except httpx.HTTPError:
+            raise APIError(0, "connection_failed", headers["X-Request-ID"]) from None
+        return response, headers["X-Request-ID"]
+
+    @staticmethod
+    def _error(response, request_id):
+        try:
+            body = response.json()
+        except ValueError:
+            return APIError(response.status_code, "invalid_response", request_id)
+        error = body.get("error", {}) if isinstance(body, dict) else {}
+        if not isinstance(error, dict):
+            error = {}
+        return APIError(
+            response.status_code,
+            str(error.get("code", "request_failed")),
+            body.get("request_id", request_id) if isinstance(body, dict) else request_id,
+            body.get("detail", error.get("detail")) if isinstance(body, dict) else None,
+        )
+
+    def request(
+        self, method: str, path: str, *, idempotency_key: str | None = None, **kwargs
+    ):
+        response, request_id = self._send(method, path, idempotency_key, **kwargs)
+        try:
+            body = response.json()
+        except ValueError:
+            raise APIError(response.status_code, "invalid_response", request_id) from None
+        if response.is_error or not isinstance(body, dict) or body.get("success") is not True:
+            raise self._error(response, request_id)
+        return body["data"]
+
+    def capabilities(self):
+        return self.request("GET", "quick/capabilities")
+
+    def upload(self, content: bytes, vendor: str):
+        return self.request(
+            "POST", "quick/configurations", content=content, params={"vendor": vendor}
+        )
+
+    def submit(
+        self, configuration_id: str, operation: str, options: dict, idempotency_key: str
+    ):
+        return self.request(
+            "POST",
+            "quick/jobs",
+            idempotency_key=idempotency_key,
+            json={
+                "configuration_id": configuration_id,
+                "operation": operation,
+                "options": options,
+            },
+        )
+
+    def jobs(self):
+        return self.request("GET", "quick/jobs")
+
+    def status(self, job_id: str):
+        return self.request("GET", f"quick/jobs/{self.identifier(job_id)}")
+
+    def query(
+        self,
+        job_id: str,
+        operation: str,
+        arguments: dict,
+        idempotency_key: str,
+        offset: int = 0,
+    ):
+        return self.request(
+            "POST",
+            "quick/queries",
+            idempotency_key=idempotency_key,
+            json={
+                "job_id": job_id,
+                "operation": operation,
+                "arguments": arguments,
+                "offset": offset,
+            },
+        )
+
+    def target(self, job_id: str):
+        return self.request("POST", f"quick/jobs/{self.identifier(job_id)}/target")
+
+    def artifacts(self, job_id: str):
+        return self.request("GET", f"quick/jobs/{self.identifier(job_id)}/artifacts")
+
+    def download(self, job_id: str, artifact_id: str):
+        return self.request(
+            "GET",
+            f"quick/jobs/{self.identifier(job_id)}/artifacts/{self.identifier(artifact_id)}",
+        )
+
+
+class ExternalClient(Client):
+    """Full External API v1 (``/jobs``, ``/me``, ``/capabilities``), same Bearer handling.
+
+    Accepts ``nck_*`` keys and Clerk OAuth access tokens.
+    """
+
+    _ALLOWED = re.compile(
+        r"(?:me|capabilities|jobs|jobs/[A-Za-z0-9_-]{1,80}(?:/translated|/report|/evidence\.xlsx)?)\Z"
+    )
+
+    def me(self):
+        return self.request("GET", "me")
+
+    def capabilities(self):
+        """Vendors, source→target paths, job types and limits POST /jobs accepts."""
+        return self.request("GET", "capabilities")
+
+    def jobs(self, limit: int = 25):
+        data = self.request("GET", "jobs", params={"comparable": "false", "limit": limit})
+        return data.get("jobs", []) if isinstance(data, dict) else []
+
+    def evidence_workbook(self, job_id: str) -> bytes | None:
+        """The customer evidence workbook; None when this job has none."""
+        response, request_id = self._send(
+            "GET", f"jobs/{self.identifier(job_id)}/evidence.xlsx"
+        )
+        if response.status_code in (404, 409, 422):
+            return None
+        if response.is_error:
+            raise self._error(response, request_id)
+        return response.content
+
+    def submit_job(self, body: dict, idempotency_key: str):
+        return self.request("POST", "jobs", idempotency_key=idempotency_key, json=body)
+
+    def job(self, job_id: str):
+        return self.request("GET", f"jobs/{self.identifier(job_id)}")
+
+    def report(self, job_id: str):
+        return self.request("GET", f"jobs/{self.identifier(job_id)}/report")
+
+    def translated(self, job_id: str) -> bytes | None:
+        """Translated configuration bytes; None while absent (queued/blocked)."""
+        response, request_id = self._send(
+            "GET", f"jobs/{self.identifier(job_id)}/translated"
+        )
+        if response.status_code == 404:
+            return None
+        if response.is_error:
+            raise self._error(response, request_id)
+        return response.content

netconverter_cli/backend.py

@@ -0,0 +1,107 @@
+"""Which NetConverter API a credential reaches, and the full-API job path.
+
+Shared by the full-screen app and the local MCP bridge so the two can never
+disagree about what a credential may do. ``external``: an ``nck_*`` key or a
+Clerk sign-in on the full External API (``/jobs``, any supported vendor).
+``quick``: a 0.1.x Terminal Quick pilot key, whose scopes never reach
+``/jobs`` (the server answers 403), limited to ASA → Palo Alto.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+
+from .api import APIError, Client, ExternalClient
+from .catalog import JOB_TYPES, device_type_of
+
+# Full External API inline-submit ceiling (server: 5 MB).
+EXTERNAL_MAX_BYTES = 5 * 1024 * 1024
+QUICK_JOB_TYPES = frozenset({"convert", "optimize"})
+
+
+def detect_profile(credential, server, *, transport=None) -> tuple[str, frozenset]:
+    """('external', job types /me advertises) or ('quick', pilot job types).
+
+    Raises APIError when neither surface accepts the credential.
+    """
+    client = ExternalClient(credential, server, transport=transport)
+    try:
+        try:
+            me = client.me()
+        except APIError as exc:
+            if exc.status != 403 or getattr(credential, "kind", "key") != "key":
+                raise
+            quick = Client(credential, server, transport=transport)
+            try:
+                quick.capabilities()
+            finally:
+                quick.close()
+            return "quick", QUICK_JOB_TYPES
+        advertised = me.get("job_types") if isinstance(me, dict) else None
+        types = frozenset(t for t in advertised or ["convert"] if t in JOB_TYPES)
+        return "external", types or frozenset({"convert"})
+    finally:
+        client.close()
+
+
+def open_client(credential, server, *, transport=None):
+    """(client, profile) for the full-screen app and the plain CLI."""
+    kind, _ = detect_profile(credential, server, transport=transport)
+    cls = ExternalClient if kind == "external" else Client
+    return cls(credential, server, transport=transport), kind
+
+
+def submit_external(client, content: bytes, source_vendor: str, target_vendor, job_type: str,
+                    options: dict, idempotency_key: str):
+    """POST /jobs with inline UTF-8 text. ``technology`` follows the vendor code."""
+    text = content.decode("utf-8")  # callers snapshot UTF-8 text only
+    body = {**options, "source_vendor": source_vendor, "source_config": text}
+    body.setdefault("technology", device_type_of(source_vendor))
+    if target_vendor:
+        body["target_vendor"] = target_vendor
+    if job_type != "convert":
+        body["job_type"] = job_type
+    return client.submit_job(body, idempotency_key)
+
+
+ANALYSIS_RESULTS = {"validate": "validation", "optimize": "optimization"}
+
+
+def _save_json(output, job_id: str, filename: str, value):
+    # Canonical bytes keep a repeat download identical (JSONB key order).
+    content = json.dumps(value, indent=2, sort_keys=True, default=str).encode()
+    return output.save_artifact(job_id, filename, content, hashlib.sha256(content).hexdigest())
+
+
+def download_external(client, job_id: str, output) -> list:
+    """Translated config, the structured report and the evidence workbook, hash-verified.
+
+    A validate or optimize job emits no translation: GET /jobs/{id} carries its
+    result, saved as ``<job>.validation.json`` / ``<job>.optimization.json``.
+    """
+    saved = []
+    job = client.job(job_id)
+    key = ANALYSIS_RESULTS.get(job.get("job_type")) if isinstance(job, dict) else None
+    if key:
+        result = job.get(key)
+        if result is None:
+            raise APIError(409, "job_not_completed", detail={"job_id": job_id, "status": job.get("status")})
+        saved.append(_save_json(output, job_id, f"{key}.json", {
+            "job_id": job_id, "job_type": job["job_type"], "status": job.get("status"),
+            "source_vendor": job.get("source_vendor"), key: result}))
+        workbook = client.evidence_workbook(job_id)
+        if workbook:
+            saved.append(output.save_artifact(job_id, "evidence.xlsx", workbook,
+                                              hashlib.sha256(workbook).hexdigest()))
+        return saved
+    translated = client.translated(job_id)
+    if translated:
+        saved.append(output.save_artifact(job_id, "translated.txt", translated,
+                                          hashlib.sha256(translated).hexdigest()))
+    saved.append(_save_json(output, job_id, "report.json", client.report(job_id)))
+    workbook = client.evidence_workbook(job_id)
+    if workbook:
+        saved.append(output.save_artifact(job_id, "evidence.xlsx", workbook,
+                                          hashlib.sha256(workbook).hexdigest()))
+    return saved

netconverter_cli/branding.py

@@ -0,0 +1,79 @@
+"""NetConverter CLI identity: the setup banner and the app's one-row header."""
+from pathlib import Path
+
+from rich.table import Table
+from rich.text import Text
+
+from . import __version__
+from .palette import ACCENT, DIM, ERROR, FG, MUTED, SUCCESS, WARNING
+
+PRODUCT = 'NetConverter CLI'
+TAGLINE = 'Any-vendor migrations · your AI over MCP · configs never reach the model'
+
+
+def wordmark(version=True):
+    text = Text('◆ ', style=f'bold {ACCENT}')
+    text.append('Net', style=f'bold {FG}')
+    text.append('Converter', style=f'bold {ACCENT}')
+    if version:
+        text.append(f'  v{__version__}', style=MUTED)
+    return text
+
+
+def folder_label(folder):
+    label = str(folder)
+    home = str(Path.home())
+    return '~' + label[len(home):] if label.startswith(home + '/') else label
+
+
+def banner(folder, compact=False, width=120):
+    """Multi-line identity block for `netconverter setup` and plain output."""
+    from .presentation import literal
+    text = wordmark()
+    text.append('  CLI\n', style=f'bold {FG}')
+    text.append(TAGLINE + '\n', style=MUTED)
+    folder_text = literal('Folder  ' + folder_label(folder), DIM)
+    folder_text.truncate(max(16, width - 4), overflow='ellipsis')
+    text.append(folder_text)
+    return text
+
+
+def _pill(dot, label, color, value=None):
+    text = Text(dot + ' ', style=color)
+    text.append(label, style=FG if color != DIM else MUTED)
+    if value:
+        text.append(' ' + value, style=MUTED)
+    return text
+
+
+def header(width, *, server='checking', profile='', bridge=None, model=None, allowance=''):
+    """One row: wordmark left, status pills right; lower-priority pills drop as width shrinks.
+
+    server: connected | checking | offline. bridge: (client, ago) or None.
+    """
+    server_pill = {
+        'connected': _pill('●', 'Server', SUCCESS, profile or None),
+        'offline': _pill('●', 'Server', ERROR, 'offline · /allowance'),
+    }.get(server, _pill('●', 'Server', WARNING, 'checking'))
+    # (priority, pill) in display order; lower priority numbers survive a narrow terminal.
+    pills = [(0, server_pill)]
+    if bridge:
+        pills.append((2, _pill('◆', 'Bridge', ACCENT, f'{bridge[0]} · {bridge[1]}')))
+    else:
+        pills.append((4, _pill('◇', 'Bridge', DIM, 'idle')))
+    pills.append((3, _pill('●', 'Model', SUCCESS, model)) if model else (5, _pill('○', 'Model', DIM, 'none')))
+    if allowance:
+        pills.append((1, Text(allowance, style=MUTED)))
+    left = wordmark()
+    budget = max(0, width - left.cell_len - 4)
+    kept, used = set(), 0
+    for index, (_, pill) in sorted(enumerate(pills), key=lambda item: item[1][0]):
+        if used + pill.cell_len + (3 if kept else 0) <= budget:
+            kept.add(index)
+            used += pill.cell_len + (3 if len(kept) > 1 else 0)
+    right = Text('   ').join(pill for index, (_, pill) in enumerate(pills) if index in kept)
+    grid = Table.grid(expand=True)
+    grid.add_column(no_wrap=True)
+    grid.add_column(justify='right', no_wrap=True)
+    grid.add_row(left, right)
+    return grid