netconverter-cli 0.4.0__py3-none-any.whl

netconverter_cli/presentation.py

@@ -0,0 +1,254 @@
+"""Human-readable local results; all server strings are literal, never markup."""
+import re
+import time
+from pathlib import Path
+
+from rich import box
+from rich.console import Group
+from rich.panel import Panel
+from rich.table import Table
+from rich.text import Text
+
+from .catalog import FIELD_LABELS, label
+from .palette import ACCENT, BG, DIM, ERROR, FG, MUTED, SUCCESS, WARNING
+
+BLUE = ACCENT  # 0.1.x name, still imported by callers
+
+# A card is a left accent bar; the bottom edge is blank, so cards space themselves.
+_BAR = box.Box("▍   \n▍   \n▍   \n▍   \n▍   \n▍   \n▍   \n    \n")
+_KINDS = {
+    "info": (ACCENT, ""),
+    "success": (SUCCESS, "✓ "),
+    "warning": (WARNING, "! "),
+    "error": (ERROR, "✕ "),
+    "muted": (DIM, ""),
+}
+
+
+def literal(value, style=''):
+    value = str(value)
+    value = re.sub(r'[\x00-\x08\x0b-\x1f\x7f]', '', value)
+    return Text(value, style=style)
+
+
+def card(title, body, kind='info'):
+    color, glyph = _KINDS.get(kind, _KINDS['info'])
+    heading_text = literal(glyph + str(title), f'bold {color if kind != "info" else FG}')
+    return Panel(body, box=_BAR, title=heading_text, title_align='left', border_style=color,
+                 padding=(0, 1), expand=True)
+
+
+def heading(title, body):
+    return card(title, body)
+
+
+def verdict_style(verdict):
+    value = str(verdict or '').lower()
+    if value in {'passed', 'completed'}:
+        return SUCCESS
+    if value in {'failed', 'blocked', 'cancelled'}:
+        return ERROR
+    if value in {'passed_with_warnings', 'needs_review'}:
+        return WARNING
+    return MUTED
+
+
+def badge(verdict):
+    value = str(verdict or 'unknown').replace('_', ' ').upper()
+    color = verdict_style(verdict)
+    if color == MUTED:
+        return literal(value.lower(), MUTED)
+    # A styled span, not a base style, so table padding does not stretch the pill.
+    return Text.assemble((f' {value} ', f'bold {BG} on {color}'))
+
+
+def commands_table(rows):
+    table = Table.grid(padding=(0, 2))
+    table.add_column(style=ACCENT, no_wrap=True, min_width=12)
+    table.add_column(style=FG)
+    for command, description in rows:
+        table.add_row(command, description)
+    return table
+
+
+HELP_SECTIONS = [
+    ('Work', [
+        ('/convert', 'Migrate a configuration to another vendor'),
+        ('/validate', 'Check a configuration: readiness, findings, parse gaps'),
+        ('/optimize', 'Cleanup and optimization findings'),
+        ('/open', 'Choose a configuration without submitting'),
+    ]),
+    ('Results', [
+        ('/jobs', 'Your server jobs'),
+        ('/resume JOB_ID', 'Follow a job and fetch its files'),
+        ('/status  /download', 'Refresh the active job · save its files'),
+        ('/target', 'Select the generated configuration, then /validate it'),
+    ]),
+    ('Questions', [
+        ('/nat  /policy  /routes', 'Summaries from the active job'),
+        ('/interfaces  /unused_objects', 'More summaries'),
+        ('/flow  /dependencies', 'Structured traffic and object questions'),
+    ]),
+    ('Your AI', [
+        ('/activity', 'What your AI assistant did through the bridge'),
+        ('/connect', 'Wire Claude Code or Desktop, Cursor, VS Code or Codex here'),
+        ('/model', 'Connect a model for plain-language questions here'),
+    ]),
+    ('Session', [
+        ('/allowance', 'Refresh server capabilities and limits'),
+        ('/clear  /home', 'Clear the conversation · show the start card'),
+    ]),
+]
+
+
+def help_view():
+    table = Table.grid(padding=(0, 2))
+    table.add_column(style=ACCENT, no_wrap=True)
+    table.add_column(style=FG)
+    for index, (section, rows) in enumerate(HELP_SECTIONS):
+        if index:
+            table.add_row('', '')
+        table.add_row(literal(section.upper(), f'bold {MUTED}'), '')
+        for command, description in rows:
+            table.add_row(command, description)
+    hint = literal('↑ ↓ choose · 1–9 jump · Enter continue · Esc cancel · Ctrl+Q quit', MUTED)
+    return card('Commands', Group(table, Text(''), hint))
+
+
+def _value(value):
+    return literal(label(value))
+
+
+def details_view(value, depth=0):
+    if depth >= 4:
+        return literal('Further detail is available in the saved report.', MUTED)
+    if isinstance(value, dict):
+        table = Table.grid(padding=(0, 2), expand=True)
+        table.add_column(style=MUTED, no_wrap=True, min_width=10, max_width=26)
+        table.add_column(ratio=1)
+        for key, child in list(value.items())[:40]:
+            name = FIELD_LABELS.get(key) or str(key).replace('_', ' ').capitalize()
+            table.add_row(literal(name), details_view(child, depth + 1))
+        if len(value) > 40:
+            table.add_row('', literal('More fields in the saved report.', MUTED))
+        return table
+    if isinstance(value, list):
+        if not value:
+            return literal('None', MUTED)
+        rows = []
+        for item in value[:12]:
+            rows.append(details_view(item, depth + 1))
+        if len(value) > 12:
+            rows.append(literal(f'{len(value)-12} more items in the saved report.', MUTED))
+        return Group(*rows)
+    if value is None:
+        return literal('—', MUTED)
+    return _value(value)
+
+
+def ago(timestamp):
+    if not isinstance(timestamp, (int, float)):
+        return '—'
+    seconds = max(0, time.time() - timestamp)
+    for unit, size in (('d', 86400), ('h', 3600), ('m', 60)):
+        if seconds >= size:
+            return f'{int(seconds // size)}{unit} ago'
+    return 'just now'
+
+
+def _when(job, local):
+    created = job.get('created_at')
+    if isinstance(created, str) and created:
+        from datetime import datetime
+        try:
+            return ago(datetime.fromisoformat(created.replace('Z', '+00:00')).timestamp())
+        except ValueError:
+            return created[:16]
+    return ago(local.get('submitted_at'))
+
+
+def jobs_view(jobs, state=None, compact=False, catalog=None):
+    state = state or {}
+    name = catalog.name if catalog else (lambda code: code or '—')
+    if not jobs:
+        return literal('No jobs yet. Start with /convert or /validate.', MUTED)
+    table = Table(box=None, padding=(0, 2), expand=True, header_style=f'bold {MUTED}')
+    table.add_column('Job', style=ACCENT, no_wrap=True)
+    table.add_column('Type', no_wrap=True)
+    if not compact:
+        table.add_column('Source → target', ratio=1, overflow='ellipsis', no_wrap=True)
+    table.add_column('Verdict', no_wrap=True)
+    if not compact:
+        table.add_column('When', style=MUTED, no_wrap=True, justify='right')
+    for job in jobs:
+        if not isinstance(job, dict):
+            continue
+        identity = job.get('job_id') or job.get('id') or '—'
+        local = state.get('jobs', {}).get(identity, {})
+        kind = job.get('job_type') or job.get('operation') or local.get('operation') or '—'
+        row = [literal(identity), literal(label(kind))]
+        if not compact:
+            options = local.get('options', {})
+            source = job.get('source_vendor') or state.get('configurations', {}).get(
+                job.get('configuration_id') or local.get('configuration_id'), {}).get('vendor')
+            target = job.get('target_vendor') or options.get('target_vendor')
+            route = name(source) + (f' → {name(target)}' if target and target != 'n/a' else '')
+            row.append(literal(route))
+        verdict = job.get('translation_status') or job.get('status', '—')
+        row.append(badge(verdict))
+        if not compact:
+            row.append(literal(_when(job, local)))
+        table.add_row(*row)
+    return Group(table, Text(''), literal('/resume JOB_ID follows a job and fetches its files.', MUTED))
+
+
+def artifacts_view(paths):
+    table = Table(box=None, padding=(0, 2), expand=True, header_style=f'bold {MUTED}')
+    table.add_column('File', style=ACCENT, ratio=4, overflow='fold')
+    table.add_column('Size', justify='right', no_wrap=True)
+    table.add_column('Type', no_wrap=True)
+    kinds = {'.xlsx': 'Evidence workbook', '.yaml': 'YAML', '.yml': 'YAML', '.txt': 'Text',
+             '.json': 'JSON', '.xml': 'XML', '.set': 'SET configuration'}
+    parents = []
+    for value in paths:
+        path = Path(value)
+        try:
+            size = f'{path.stat().st_size:,} B'
+        except OSError:
+            size = 'unavailable'
+        table.add_row(literal(path.name), literal(size), literal(kinds.get(path.suffix, 'Artifact')))
+        if str(path.parent) not in parents:
+            parents.append(str(path.parent))
+    return Group(table, Text(''), *(literal('Saved in ' + _home(p), MUTED) for p in parents))
+
+
+def _home(path):
+    home = str(Path.home())
+    return '~' + path[len(home):] if path.startswith(home + '/') else path
+
+
+def activity_line(entry):
+    """One bridge call as a single line: time · client · tool · what."""
+    when = time.strftime('%H:%M', time.localtime(entry.get('ts', 0)))
+    text = literal(when + '  ', MUTED)
+    text.append(literal((entry.get('client') or 'AI') + '  ', ACCENT))
+    tool = entry.get('tool', '?')
+    text.append(literal(tool.replace('_', ' ') + '  ', FG))
+    if tool == 'submit_file':
+        detail = f"{entry.get('path', '?')} · {entry.get('bytes', 0):,} B · sha {str(entry.get('sha256', ''))[:8]}…"
+        if entry.get('job_id'):
+            detail += f" → {entry['job_id']}"
+    elif tool == 'download':
+        detail = f"{entry.get('files', 0)} file(s) → {entry.get('path', '.')}"
+    else:
+        detail = f"{entry.get('job_id', '')} {str(entry.get('status', '')).replace('_', ' ')}".strip()
+    text.append(literal(detail, MUTED))
+    return text
+
+
+def activity_view(entries):
+    if not entries:
+        return literal('No bridge activity in this folder yet. Connect your AI with /connect, '
+                       'then ask it to validate a file here.', MUTED)
+    return Group(*(activity_line(e) for e in entries),
+                 Text(''), literal('Only paths, hashes, sizes and job IDs are recorded — never configuration text.', MUTED))

netconverter_cli/privacy.py

@@ -0,0 +1,105 @@
+"""Explicit model projection; detailed renderer data is never chat history."""
+
+from __future__ import annotations
+
+import re
+
+OPERATIONS = (
+    "analyze",
+    "optimize",
+    "convert",
+    "unused_objects",
+    "routes",
+    "interfaces",
+    "policy",
+    "nat",
+    "dependencies",
+    "flow",
+    "status",
+    "artifacts",
+)
+COUNT_FIELDS = frozenset(
+    {
+        "total_objects",
+        "total_unused",
+        "unused_network_count",
+        "unused_network_group_count",
+        "unused_service_count",
+        "unused_service_group_count",
+        "rules",
+        "routes",
+        "findings",
+        "total",
+        "shown",
+    }
+)
+STATUSES = frozenset(
+    {
+        "queued",
+        "processing",
+        "running",
+        "completed",
+        "failed",
+        "cancelled",
+        "passed",
+        "passed_with_warnings",
+        "needs_review",
+        "blocked",
+        "unavailable",
+        "needs_input",
+        "allowed",
+        "denied",
+        "unknown",
+        "partial",
+        "full",
+        "empty",
+    }
+)
+_IP = re.compile(
+    r"(?<![\w.])(?:\d{1,3}\.){3}\d{1,3}(?:/\d{1,2})?|(?<![\w:])(?:[0-9a-fA-F]{0,4}:){2,}[0-9a-fA-F:.]+(?:/\d{1,3})?"
+)
+_CONFIG = re.compile(
+    r"(?im)^\s*(?:object(?:-group)?\s|access-list\s|interface\s|hostname\s|set\s+(?:rulebase|network|address|deviceconfig|shared)|<\??(?:xml|config)\b)"
+)
+
+
+def model_summary(result: dict) -> dict:
+    """Never accept a server-supplied prose/summary blob as model context."""
+    out: dict = {}
+    for key in ("status", "translation_status", "verdict", "data_quality"):
+        value = str(result.get(key, "")).lower()
+        if value in STATUSES:
+            out[key] = value
+    for key in ("job_id", "configuration_id", "query_id"):
+        value = result.get(key)
+        if isinstance(value, str) and re.fullmatch(
+            r"(?:tra|psc|opt|cfg|qry)_[a-f0-9]{8,40}", value
+        ):
+            out[key] = value
+    counts = result.get("counts", {})
+    if isinstance(counts, dict):
+        out["counts"] = {
+            key: value
+            for key, value in counts.items()
+            if key in COUNT_FIELDS and type(value) is int and 0 <= value <= 10**9
+        }
+    if result.get("requires_input") is True:
+        out["status"] = "needs_input"
+    return out
+
+
+def safe_prompt(text: str, identifiers: list[str]) -> tuple[str, dict[str, str]]:
+    if len(text) > 4000 or _CONFIG.search(text) or "```" in text:
+        raise ValueError(
+            "Select a config with /open; configuration text is not sent to the conversational model"
+        )
+    bindings: dict[str, str] = {}
+    values = sorted(
+        set([v for v in identifiers if v] + _IP.findall(text)), key=len, reverse=True
+    )
+    for value in values:
+        if value in text:
+            alias = f"NC_REF_{len(bindings) + 1}"
+            text = text.replace(value, alias)
+            bindings[alias] = value
+    return text, bindings

netconverter_cli/providers.py

@@ -0,0 +1,246 @@
+"""Stateless provider protocols. Only a closed vocabulary and projected counts leave."""
+
+from __future__ import annotations
+import json
+import re
+from urllib.parse import urlsplit
+import httpx
+from .privacy import model_summary
+
+OPERATIONS = (
+    "analyze",
+    "optimize",
+    "convert",
+    "unused_objects",
+    "routes",
+    "interfaces",
+    "policy",
+    "nat",
+    "dependencies",
+    "flow",
+    "status",
+    "artifacts",
+)
+SCHEMA = {
+    "type": "object",
+    "properties": {"operation": {"type": "string", "enum": list(OPERATIONS)}},
+    "required": ["operation"],
+    "additionalProperties": False,
+}
+SYSTEM = (
+    "Select one NetConverter operation using the request_operation tool. "
+    "The operation argument must be a single string, not a schema or list. "
+    'For example, finding unused objects requires {"operation":"unused_objects"}. '
+    "Parameters and conversion decisions are collected by the terminal. Never invent parameters."
+)
+# Unknown words are opaque references, never sent verbatim. No configuration text,
+# arbitrary prose, filenames, identifiers, addresses, or provider-returned text is retained.
+WORDS = frozenset(
+    "find unused objects explain what can be cleaned up clean cleanup analyze analysis optimize optimization convert conversion migrate migration asa cisco palo alto set xml panorama routing routes consolidation recommendations ideas show get list interfaces policy rules nat dependencies where used traffic flow tcp udp port open allow allowed deny denied is do i have status progress job artifacts download reports evidence configuration source target selected please help me the a an and or to from for in on of with how which this that it my does check".split()
+)
+
+
+def abstract_intent(text):
+    if len(text) > 4000:
+        raise ValueError("Question is too long")
+    # Keep only individually allowlisted words; everything else becomes a fixed
+    # opaque marker. Even a pasted configuration cannot cross this boundary.
+    return " ".join(
+        word.lower() if word.lower() in WORDS else "REFERENCE"
+        for word in re.findall(r"\S+", text)
+    )
+
+
+class ProviderError(RuntimeError):
+    """Only locally authored messages may be displayed; never provider bodies."""
+    MESSAGES = {
+        "authentication": "The provider rejected the API key (401). Enter an API key for this provider; a NetConverter key will not work here.",
+        "access": "This API key cannot access the requested model (403). Check project permissions and model access.",
+        "model": "The model was not found or is not available to this API key. Check the exact API model ID.",
+        "quota": "The provider reports insufficient API quota or credits. Check API billing and project spending limits.",
+        "rate_limit": "The provider is rate limiting requests (429). Wait briefly, then retry.",
+        "request": "The provider rejected the request (400). Check the model ID and its support for Responses/function tools.",
+        "timeout": "The model request timed out. Retry, choose another model, or continue with guided commands.",
+        "connection": "Could not reach the model endpoint. Check connectivity; for Ollama, start the local service.",
+        "service": "The provider is temporarily unavailable. Retry later or use guided commands.",
+        "protocol": "The model did not return one permitted operation. Select a model with function/tool calling support.",
+        "configuration": "Choose a supported provider and an explicit API model ID.",
+        "missing_key": "Enter the provider's API key in the hidden key field.",
+    }
+
+    def __init__(self, code="protocol"):
+        self.code = code if code in self.MESSAGES else "protocol"
+        super().__init__(self.MESSAGES[self.code])
+
+
+def response_error(response):
+    """Classify a closed set of error codes without echoing raw provider text."""
+    code = None
+    try:
+        error = response.json().get("error", {})
+        if isinstance(error, dict):
+            candidate = error.get("code") or error.get("type")
+            if candidate in ("insufficient_quota", "model_not_found", "invalid_api_key"):
+                code = candidate
+    except (ValueError, AttributeError, TypeError):
+        pass
+    if response.status_code == 401 or code == "invalid_api_key":
+        return ProviderError("authentication")
+    if code == "insufficient_quota" or response.status_code == 402:
+        return ProviderError("quota")
+    if code == "model_not_found" or response.status_code == 404:
+        return ProviderError("model")
+    return ProviderError({400:"request", 403:"access", 429:"rate_limit"}.get(response.status_code, "service"))
+
+
+class Provider:
+    def __init__(self, name, model, key="", *, endpoint=None, transport=None):
+        if (
+            name not in {"openai", "anthropic", "gemini", "ollama"}
+            or not model
+            or not re.fullmatch(r"[A-Za-z0-9_.:/-]{1,160}", model)
+        ):
+            raise ValueError("Select a supported provider and an explicit model")
+        self.name, self.model, self.key = name, model, key
+        defaults = {
+            "openai": "https://api.openai.com/v1",
+            "anthropic": "https://api.anthropic.com/v1",
+            "gemini": "https://generativelanguage.googleapis.com/v1beta",
+            "ollama": "http://127.0.0.1:11434",
+        }
+        self.endpoint = endpoint or defaults[name]
+        if name != "ollama" and self.endpoint != defaults[name]:
+            raise ValueError("Hosted providers use their fixed official endpoint")
+        parts = urlsplit(self.endpoint)
+        if (
+            parts.username
+            or parts.password
+            or parts.query
+            or parts.fragment
+            or (
+                name == "ollama"
+                and (
+                    parts.scheme != "http"
+                    or parts.hostname not in {"localhost", "127.0.0.1", "::1"}
+                )
+            )
+        ):
+            raise ValueError("Local inference requires an explicit loopback endpoint")
+        self.http = httpx.Client(
+            timeout=45, transport=transport, follow_redirects=False, trust_env=False
+        )
+
+    def close(self):
+        self.http.close()
+
+    def select(self, text, summary=None):
+        content = json.dumps(
+            {"intent": abstract_intent(text), "context": model_summary(summary or {})}
+        )
+        function = {
+            "name": "request_operation",
+            "description": "Request a permitted operation for the selected revision",
+            "parameters": SCHEMA,
+        }
+        headers = {}
+        if self.name == "openai":
+            url = self.endpoint + "/responses"
+            headers = {"Authorization": "Bearer " + self.key}
+            body = {
+                "model": self.model,
+                "store": False,
+                "instructions": SYSTEM,
+                "input": content,
+                "tools": [{"type": "function", **function, "strict": True}],
+                "tool_choice": "required",
+                "parallel_tool_calls": False,
+            }
+        elif self.name == "anthropic":
+            url = self.endpoint + "/messages"
+            headers = {"x-api-key": self.key, "anthropic-version": "2023-06-01"}
+            body = {
+                "model": self.model,
+                "max_tokens": 256,
+                "system": SYSTEM,
+                "messages": [{"role": "user", "content": content}],
+                "tools": [
+                    {
+                        "name": function["name"],
+                        "description": function["description"],
+                        "input_schema": SCHEMA,
+                    }
+                ],
+                "tool_choice": {"type": "tool", "name": "request_operation"},
+            }
+        elif self.name == "gemini":
+            if "/" in self.model or ":" in self.model:
+                raise ValueError("Use the Gemini model ID without a path")
+            url = self.endpoint + "/models/" + self.model + ":generateContent"
+            headers = {"x-goog-api-key": self.key}
+            body = {
+                "systemInstruction": {"parts": [{"text": SYSTEM}]},
+                "contents": [{"role": "user", "parts": [{"text": content}]}],
+                "tools": [{"functionDeclarations": [function]}],
+                "toolConfig": {
+                    "functionCallingConfig": {
+                        "mode": "ANY",
+                        "allowedFunctionNames": ["request_operation"],
+                    }
+                },
+            }
+        else:
+            url = self.endpoint + "/api/chat"
+            body = {
+                "model": self.model,
+                "stream": False,
+                "options": {"num_ctx": 4096, "num_predict": 128, "temperature": 0},
+                "messages": [
+                    {"role": "system", "content": SYSTEM},
+                    {"role": "user", "content": content},
+                ],
+                "tools": [{"type": "function", "function": function}],
+            }
+        try:
+            response = self.http.post(url, json=body, headers=headers)
+            if response.is_error:
+                raise response_error(response)
+            data = response.json()
+            if self.name == "openai":
+                calls = [
+                    (c["name"], json.loads(c["arguments"]))
+                    for c in data["output"]
+                    if c["type"] == "function_call"
+                ]
+            elif self.name == "anthropic":
+                calls = [
+                    (c["name"], c["input"])
+                    for c in data["content"]
+                    if c["type"] == "tool_use"
+                ]
+            elif self.name == "gemini":
+                calls = [
+                    (p["functionCall"]["name"], p["functionCall"]["args"])
+                    for p in data["candidates"][0]["content"]["parts"]
+                    if "functionCall" in p
+                ]
+            else:
+                calls = [
+                    (c["function"]["name"], c["function"]["arguments"])
+                    for c in data["message"].get("tool_calls", [])
+                ]
+            if len(calls) != 1 or calls[0][0] != "request_operation":
+                raise ValueError()
+            args = calls[0][1]
+            if (
+                not isinstance(args, dict)
+                or set(args) != {"operation"}
+                or args["operation"] not in OPERATIONS
+            ):
+                raise ValueError()
+            return args["operation"]
+        except httpx.TimeoutException:
+            raise ProviderError("timeout") from None
+        except httpx.HTTPError:
+            raise ProviderError("connection") from None
+        except (ValueError, KeyError, IndexError, TypeError):
+            raise ProviderError("protocol") from None