netconverter-cli 0.4.0__py3-none-any.whl

netconverter_cli/remote_mcp.py

@@ -0,0 +1,175 @@
+"""Minimal MCP Streamable HTTP client for NetConverter's remote read tools.
+
+Only the configured NetConverter MCP endpoint is ever contacted (no URL comes
+from a model or a tool result). Requests carry the same Bearer credential as
+the REST client, with one refresh-and-retry on 401.
+"""
+
+from __future__ import annotations
+
+import json
+
+import httpx
+
+from .api import BearerAuth, as_credential, check_url
+from .clerk import ClerkError
+
+DEFAULT_MCP_URL = "https://api.netconverter.ai/mcp/v1/"
+CLIENT_PROTOCOL = "2025-06-18"
+MAX_RESPONSE_BYTES = 8 * 1024 * 1024
+
+
+class RemoteError(RuntimeError):
+    def __init__(self, code: str, message: str):
+        super().__init__(message)
+        self.code = code
+
+
+def _short(value, limit=300) -> str:
+    return "".join(ch for ch in str(value or "") if ch.isprintable())[:limit]
+
+
+class RemoteMCP:
+    def __init__(self, url: str, credential, *, transport=None, client_version="0"):
+        self.url = check_url(url)
+        self.http = httpx.Client(
+            timeout=90,
+            auth=BearerAuth(as_credential(credential)),
+            transport=transport,
+            follow_redirects=False,
+            trust_env=False,
+        )
+        self.client_version = client_version
+        self.session_id: str | None = None
+        self.protocol: str | None = None
+        self._initialized = False
+        self._next_id = 0
+
+    def close(self):
+        self.http.close()
+
+    # -- transport ---------------------------------------------------------
+
+    def _headers(self) -> dict:
+        headers = {
+            "Accept": "application/json, text/event-stream",
+            "Content-Type": "application/json",
+        }
+        if self.session_id:
+            headers["Mcp-Session-Id"] = self.session_id
+        if self.protocol:
+            headers["MCP-Protocol-Version"] = self.protocol
+        return headers
+
+    def _post(self, payload: dict):
+        try:
+            response = self.http.post(self.url, json=payload, headers=self._headers())
+        except httpx.HTTPError:
+            raise RemoteError("connection_failed", "Could not reach the NetConverter MCP server") from None
+        except ClerkError as exc:
+            raise RemoteError("unauthorized", str(exc)) from None
+        if response.status_code == 401:
+            raise RemoteError(
+                "unauthorized",
+                "NetConverter MCP refused the credential; run `netconverter login --clerk` "
+                "or store a key with `netconverter login`",
+            )
+        if response.status_code == 404 and self.session_id:
+            raise RemoteError("session_expired", "Remote MCP session expired")
+        if response.status_code == 202:
+            return None
+        if response.is_error:
+            raise RemoteError(f"http_{response.status_code}", f"NetConverter MCP returned HTTP {response.status_code}")
+        if len(response.content) > MAX_RESPONSE_BYTES:
+            raise RemoteError("response_too_large", "Remote MCP response exceeded its limit")
+        session = response.headers.get("mcp-session-id")
+        if session:
+            self.session_id = session
+        content_type = response.headers.get("content-type", "")
+        if "text/event-stream" in content_type:
+            return self._from_sse(response.text, payload.get("id"))
+        try:
+            return response.json()
+        except ValueError:
+            raise RemoteError("invalid_response", "Remote MCP returned invalid JSON") from None
+
+    @staticmethod
+    def _from_sse(text: str, request_id):
+        data: list[str] = []
+        events = []
+        for line in text.splitlines() + [""]:
+            if line.startswith("data:"):
+                data.append(line[5:].lstrip(" "))
+            elif line == "" and data:
+                events.append("\n".join(data))
+                data = []
+        for event in events:
+            try:
+                message = json.loads(event)
+            except ValueError:
+                continue
+            if isinstance(message, dict) and message.get("id") == request_id and (
+                "result" in message or "error" in message
+            ):
+                return message
+        raise RemoteError("invalid_response", "Remote MCP stream contained no response")
+
+    # -- protocol ----------------------------------------------------------
+
+    def _request(self, method: str, params: dict | None = None) -> dict:
+        self._next_id += 1
+        payload = {"jsonrpc": "2.0", "id": self._next_id, "method": method}
+        if params is not None:
+            payload["params"] = params
+        message = self._post(payload)
+        if not isinstance(message, dict):
+            raise RemoteError("invalid_response", "Remote MCP returned no response")
+        if "error" in message:
+            error = message["error"] if isinstance(message["error"], dict) else {}
+            raise RemoteError(
+                str(error.get("code", "error")), _short(error.get("message", "Remote MCP error"))
+            )
+        result = message.get("result")
+        if not isinstance(result, dict):
+            raise RemoteError("invalid_response", "Remote MCP returned an invalid result")
+        return result
+
+    def _initialize(self):
+        result = self._request(
+            "initialize",
+            {
+                "protocolVersion": CLIENT_PROTOCOL,
+                "capabilities": {},
+                "clientInfo": {"name": "netconverter-local", "version": self.client_version},
+            },
+        )
+        version = result.get("protocolVersion")
+        self.protocol = version if isinstance(version, str) and len(version) <= 20 else CLIENT_PROTOCOL
+        self._post({"jsonrpc": "2.0", "method": "notifications/initialized"})
+        self._initialized = True
+
+    def rpc(self, method: str, params: dict | None = None) -> dict:
+        if not self._initialized:
+            self._initialize()
+        try:
+            return self._request(method, params)
+        except RemoteError as exc:
+            if exc.code != "session_expired":
+                raise
+            self.session_id, self.protocol, self._initialized = None, None, False
+            self._initialize()
+            return self._request(method, params)
+
+    def list_tools(self) -> list[dict]:
+        tools: list[dict] = []
+        cursor = None
+        for _ in range(20):  # bounded pagination
+            result = self.rpc("tools/list", {"cursor": cursor} if cursor else {})
+            tools.extend(t for t in result.get("tools", []) if isinstance(t, dict) and isinstance(t.get("name"), str))
+            cursor = result.get("nextCursor")
+            if not cursor:
+                break
+        return tools
+
+    def call_tool(self, name: str, arguments: dict) -> dict:
+        return self.rpc("tools/call", {"name": name, "arguments": arguments})

netconverter_cli/setup.py

@@ -0,0 +1,179 @@
+"""Connection setup; credentials never enter workspace preferences."""
+import hashlib
+import json
+from pathlib import Path
+from .api import Client, DEFAULT_BASE
+from .backend import open_client
+from .credentials import get_secret, save_secret
+from .providers import Provider, ProviderError
+from .workspace import Workspace, WorkspaceError
+
+
+def account(server):
+    return 'server:' + hashlib.sha256(server.rstrip('/').encode()).hexdigest()[:24]
+
+
+def load_settings(root):
+    w = Workspace(root)
+    p = w._inside(w.state_dir / 'connection.json')
+    if not p.exists():
+        return {}
+    data = json.loads(p.read_text())
+    if set(data) - {'server', 'provider', 'model', 'auth'} or data.get('auth') not in (None, 'key', 'clerk'):
+        raise WorkspaceError('Invalid connection settings')
+    return data
+
+
+def store_settings(root, settings):
+    w = Workspace(root)
+    w._inside(w.state_dir).mkdir(mode=0o700, exist_ok=True)
+    w._atomic_replace(w.state_dir / 'connection.json', json.dumps(settings, indent=2).encode())
+
+
+def connect_model(name, model, key=''):
+    """Probe only synthetic intent; failure closes the candidate, not the old model."""
+    if name == 'none':
+        return None
+    if name not in {'openai','anthropic','gemini','ollama'} or not model:
+        raise ProviderError('configuration')
+    if name != 'ollama':
+        key = key.strip() or get_secret(name, prompt=False)
+        if not key:
+            raise ProviderError('missing_key')
+    try:
+        provider = Provider(name, (model or '').strip(), key)
+    except ValueError:
+        raise ProviderError('configuration') from None
+    try:
+        if provider.select('Find unused objects') != 'unused_objects':
+            raise ProviderError('protocol')
+    except BaseException:
+        provider.close()
+        raise
+    return provider
+
+
+def save_model(root, provider):
+    settings = load_settings(root)
+    settings.update(provider=provider.name if provider else None, model=provider.model if provider else None)
+    store_settings(root, settings)
+    if provider and provider.name != 'ollama':
+        return save_secret(provider.name, provider.key)
+    return True
+
+
+class AccountSignIn:
+    """The NetConverter account sign-in as first-run setup sees it (the cli's trust rules)."""
+
+    def allowed(self, server):
+        from . import cli
+        return cli.clerk_allowed(server)
+
+    def session(self):
+        from . import cli
+        return cli._clerk_session()
+
+    def login(self):
+        from .clerk import ClerkError, login
+        try:
+            login(notify=print)
+        except ClerkError as exc:
+            print(str(exc))
+            return None
+        return self.session()
+
+
+def connect_credential(server, signin, ask, secret):
+    """A stored key, the existing sign-in, or the user's choice of signing in or pasting a key."""
+    saved = get_secret(account(server), prompt=False)
+    if not saved and signin.allowed(server):
+        session = signin.session()
+        if session is not None:
+            print('Using your NetConverter sign-in.')
+            return session
+        while True:
+            choice = ask('Connect with 1 = your NetConverter account (browser sign-in), 2 = an API key [1]: ').strip() or '1'
+            if choice in ('1', '2'):
+                break
+            print('Enter 1 or 2.')
+        if choice == '1':
+            session = signin.login()
+            if session is None:
+                raise ValueError('Sign-in did not complete; run `netconverter login --clerk` and try again')
+            return session
+    key = secret('NetConverter API key (hidden; paste here, then Enter; blank uses saved key): ').strip()
+    key = key or saved
+    if not key:
+        raise ValueError('A server API key is required')
+    return key
+
+
+def configure(root, defaults=None, *, ask=None, secret=None, signin=None):
+    import getpass
+    from rich.console import Console
+    from .branding import banner
+    ask = ask or input
+    secret = secret or getpass.getpass
+    signin = signin or AccountSignIn()
+    settings = {**load_settings(root), **(defaults or {})}
+    Console().print(banner(Path(root).resolve()))
+    print('\n1 / 2  Connect to NetConverter')
+    print('Press Enter for the production URL. A key, if you use one, goes only in the hidden prompt.')
+    while True:
+        server = ask(f"Server URL [{settings.get('server') or DEFAULT_BASE}]: ").strip() or settings.get('server') or DEFAULT_BASE
+        if server.startswith(('nck_', 'sk-')):
+            print('That looks like an API key, not a URL. It was entered in a visible field; replace it if exposed. Press Enter below for the server address.')
+            continue
+        try:
+            Client('', server).close()
+            break
+        except ValueError:
+            print('Enter an HTTPS server URL, or press Enter to accept the displayed address.')
+    credential = connect_credential(server, signin, ask, secret)
+    client, kind = open_client(credential, server)
+    print('Connected: ' + ('full API — every supported vendor' if kind == 'external'
+                           else 'pilot key — ASA → Palo Alto'))
+    if isinstance(credential, str):
+        stored = save_secret(account(server), credential)
+        print('Server key saved in OS credential store.' if stored else 'Credential store unavailable; server key is in memory for this session only.')
+    else:
+        print('Signed in with your NetConverter account; no key is stored.')
+    provider = None
+    try:
+        print('\n2 / 2  Connect a model (optional)')
+        print('A model chooses operations only. Configurations and detailed results stay out of model requests.')
+        name_default = settings.get('provider') or 'none'
+        while True:
+            name = ask(f'Model provider: none / ollama / anthropic / openai / gemini [{name_default}]: ').strip().lower() or name_default
+            if name not in {'none','ollama','anthropic','openai','gemini'}:
+                print('Choose one of the listed providers.')
+                continue
+            if name == 'none':
+                print('Guided commands selected. Use /model inside the terminal to connect later.')
+                break
+            model_default = settings.get('model') if name == settings.get('provider') else ''
+            model = ask(f'Exact API model ID [{model_default or ""}]: ').strip() or model_default
+            key = '' if name == 'ollama' else secret(f'{name} API key (hidden; blank uses saved key): ').strip()
+            print('Testing a synthetic tool call…')
+            try:
+                provider = connect_model(name, model, key)
+            except Exception as exc:
+                print(str(exc) if isinstance(exc, ProviderError) else ProviderError.MESSAGES['protocol'])
+                choice = ask('Retry model setup or continue without a model? [retry / guided]: ').strip().lower()
+                if choice == 'guided':
+                    print('Guided commands selected. Use /model to retry later.')
+                    break
+                name_default = name
+                continue
+            print(f'Model connected: {provider.name} / {provider.model}')
+            break
+        store_settings(root, {'server':server, 'provider':None, 'model':None})
+        stored = save_model(root, provider)
+        if not stored:
+            print('Model key is in memory only; enter it again after restarting.')
+        return client, provider
+    except BaseException:
+        client.close()
+        if provider:
+            provider.close()
+        raise