orithos-cli 0.1.0__py3-none-any.whl

orithos_cli/configure.py

@@ -0,0 +1,103 @@
+"""orithos configure — one-time CLI setup."""
+
+import httpx
+import click
+
+from orithos_cli.config import (
+    CLIConfig,
+    CONFIG_FILE,
+    DEFAULT_API_URL,
+    write_config,
+)
+
+
+def _validate_key(api_url: str, api_key: str) -> str | None:
+    try:
+        r = httpx.get(
+            f"{api_url}/v1/scans?limit=1",
+            headers={"Authorization": f"Bearer {api_key}"},
+            timeout=10,
+        )
+        if r.status_code == 200:
+            return None
+        if r.status_code == 401:
+            return "API key rejected (401). Check the key and try again."
+        return f"Unexpected response: HTTP {r.status_code}"
+    except httpx.ConnectError:
+        return f"Cannot connect to {api_url}. Check the URL."
+    except httpx.TimeoutException:
+        return "Connection timed out."
+    except Exception as e:
+        return str(e)
+
+
+@click.command("configure")
+@click.option("--api-key", "-k", default="", help="Your Orithos API key (tsk_...)")
+@click.option("--show", is_flag=True, help="Show current config and exit")
+@click.option("--api-url", hidden=True, default="")  # hidden escape hatch for self-hosted
+def configure(api_key: str, show: bool, api_url: str) -> None:
+    """Set up CLI credentials.
+
+    Writes to ~/.orithos/config.json. Run once after creating an API key.
+    """
+    if show:
+        _show_config()
+        return
+
+    existing = CLIConfig.from_env()
+    target_url = api_url or existing.api_url or DEFAULT_API_URL
+
+    if api_key:
+        click.echo("Validating API key...", nl=False)
+        err = _validate_key(target_url, api_key)
+        if err:
+            click.echo(f" failed\nError: {err}", err=True)
+            raise click.Abort()
+        click.echo(" OK")
+        cfg = CLIConfig(
+            api_url=target_url,
+            org_id=existing.org_id,
+            timeout=existing.timeout,
+            api_key=api_key,
+        )
+        path = write_config(cfg)
+        click.echo(f"Saved to {path}")
+        return
+
+    api_key = click.prompt("API key", hide_input=True)
+    if not api_key:
+        click.echo("Error: API key is required.", err=True)
+        raise click.Abort()
+
+    click.echo("Validating API key...", nl=False)
+    err = _validate_key(target_url, api_key)
+    if err:
+        click.echo(f" failed\nError: {err}", err=True)
+        raise click.Abort()
+    click.echo(" OK")
+
+    cfg = CLIConfig(
+        api_url=target_url,
+        org_id=existing.org_id,
+        timeout=existing.timeout,
+        api_key=api_key,
+    )
+    path = write_config(cfg)
+    click.echo(f"Saved to {path}")
+
+
+def _show_config() -> None:
+    cfg = CLIConfig.from_env()
+    file_path = CONFIG_FILE if CONFIG_FILE.exists() else None
+    click.echo(f"Config file: {file_path or 'not found'}")
+    click.echo(f"  API URL:   {cfg.api_url}")
+    click.echo(f"  Org ID:    {cfg.org_id}")
+    click.echo(f"  Timeout:   {cfg.timeout}")
+    key_display = (
+        cfg.api_key[:12] + "…" + cfg.api_key[-4:]
+        if len(cfg.api_key) > 20
+        else "(not set)"
+    )
+    click.echo(f"  API Key:   {key_display}")
+    click.echo()
+    click.echo("Override with env vars: ORITHOS_API_KEY, ORITHOS_API_URL")

orithos_cli/connection.py

@@ -0,0 +1,69 @@
+"""Connection management subcommands for Orithos CLI."""
+
+from __future__ import annotations
+
+import click
+import httpx
+
+from orithos_cli.config import get_config
+
+
+@click.group(name="connection")
+def connection_group() -> None:
+    """Manage AI agent connections."""
+    pass
+
+
+@connection_group.command("new")
+def new_connection() -> None:
+    """Interactive connection setup — endpoint, auth, model."""
+    from orithos_cli.connection_wizard import interactive_connection_wizard
+
+    interactive_connection_wizard()
+
+
+@connection_group.command("create")
+def create_connection() -> None:
+    """Create a new connection — interactive wizard."""
+    from orithos_cli.connection_wizard import interactive_connection_wizard
+
+    interactive_connection_wizard()
+
+
+@connection_group.command("list")
+def list_connections() -> None:
+    """List all connections."""
+    cfg = get_config()
+    try:
+        resp = httpx.get(f"{cfg.api_url}/v1/connections", headers=cfg.auth_headers(), timeout=cfg.timeout)
+        resp.raise_for_status()
+    except httpx.HTTPStatusError as exc:
+        click.echo(f"Error: {exc.response.status_code} — {exc.response.text}", err=True)
+        raise SystemExit(1)
+    data = resp.json()
+    items = data if isinstance(data, list) else data.get("items", [])
+    if not items:
+        click.echo("No connections found.")
+        return
+    for c in items:
+        health_color = "green" if c.get("health_status") == "healthy" else "red"
+        click.secho(f"[{c['id'][:8]}] {c.get('name', '?')}", bold=True)
+        click.echo(f"  URL: {c.get('base_url', '?')}  Model: {c.get('model_name', '?')}")
+        click.echo(f"  Health: ", nl=False)
+        click.secho(f"{c.get('health_status', 'unknown')}", fg=health_color)
+        if c.get("total_scans"):
+            click.echo(f"  Scans: {c['total_scans']}  Risk: {c.get('risk_score', 'N/A')}")
+
+
+@connection_group.command("delete")
+@click.argument("connection-id")
+def delete_connection(connection_id: str) -> None:
+    """Delete a connection by ID."""
+    cfg = get_config()
+    try:
+        resp = httpx.delete(f"{cfg.api_url}/v1/connections/{connection_id}", headers=cfg.auth_headers(), timeout=cfg.timeout)
+        resp.raise_for_status()
+    except httpx.HTTPStatusError as exc:
+        click.echo(f"Error: {exc.response.status_code} — {exc.response.text}", err=True)
+        raise SystemExit(1)
+    click.echo(f"Connection {connection_id[:8]} deleted.")

orithos_cli/connection_wizard.py

@@ -0,0 +1,129 @@
+"""Interactive connection wizard for Orithos CLI — matching dashboard form."""
+
+from __future__ import annotations
+
+import json
+import httpx
+import click
+
+from orithos_cli.config import get_config, fmt_http_error
+
+
+def _s(text: str = "", fg: str | None = None, dim: bool = False, bold: bool = False) -> str:
+    return click.style(text, fg=fg, dim=dim, bold=bold)
+
+
+API_FORMAT_OPTIONS = [
+    ("openai", "OpenAI-compatible", "OpenAI / v1/chat/completions format"),
+    ("anthropic", "Anthropic", "Anthropic / v1/messages format"),
+    ("custom", "Custom", "Custom API format"),
+]
+
+AUTH_OPTIONS = [
+    ("bearer_token", "Bearer Token", "Authorization: Bearer <key>"),
+    ("x-api-key", "X-API-Key", "X-API-Key header"),
+]
+
+
+def _pick(options: list[tuple[str, str, str]], prompt: str, default: int = 1) -> str:
+    for i, (_, label, desc) in enumerate(options, 1):
+        click.echo(f"  [{i}] {_s(label, bold=True)} \u2014 {_s(desc, dim=True)}")
+    choice = click.prompt(prompt, type=int, default=default)
+    if choice < 1 or choice > len(options):
+        choice = default
+    return options[choice - 1][0]
+
+
+def interactive_connection_wizard() -> None:
+    cfg = get_config()
+
+    click.echo()
+    click.echo(_s("\u2726 Orithos Connection Wizard", fg="green", bold=True))
+    click.echo(_s("  Configure an LLM endpoint connection.", dim=True))
+    click.echo()
+
+    # Step 1: Identity
+    click.echo(_s("Step 1/3: Endpoint Details", fg="green"))
+    name = click.prompt("  Connection name", default="")
+    if not name:
+        click.echo(_s("  Name is required.", fg="red"))
+        raise SystemExit(1)
+    base_url = click.prompt("  Base URL", default="")
+    if not base_url:
+        click.echo(_s("  URL is required.", fg="red"))
+        raise SystemExit(1)
+    api_format = _pick(API_FORMAT_OPTIONS, "  API format")
+    model_name = click.prompt("  Model name (optional)", default="")
+    click.echo()
+
+    # Step 2: Authentication
+    click.echo(_s("Step 2/3: Authentication", fg="green"))
+    auth_scheme = _pick(AUTH_OPTIONS, "  Auth scheme")
+    api_key = click.prompt("  API key (optional, hidden)", hide_input=True, default="")
+    custom_header_raw = click.prompt("  Custom header (optional, format: HeaderName: value)", default="")
+    click.echo()
+
+    # Step 3: Confirm & Save
+    click.echo(_s("Step 3/3: Confirm & Save", fg="green"))
+
+    custom_headers: dict[str, str] | None = None
+    if custom_header_raw and ":" in custom_header_raw:
+        idx = custom_header_raw.index(":")
+        key = custom_header_raw[:idx].strip()
+        val = custom_header_raw[idx + 1:].strip()
+        if key and val:
+            custom_headers = {key: val}
+
+    click.echo(_s("\u250c" + "\u2500" * 47 + "\u2510", dim=True))
+    for line in [
+        f" Name:       {name}",
+        f" URL:        {base_url}",
+        f" Format:     {api_format}",
+        f" Model:      {model_name or '(not set)'}",
+        f" Auth:       {auth_scheme}",
+        f" API key:    {'(set)' if api_key else '(not set)'}",
+        f" Custom hdr: {custom_header_raw or '(none)'}",
+    ]:
+        click.echo(_s(f"\u2502 {line:<45}\u2502", dim=True))
+    click.echo(_s("\u2514" + "\u2500" * 47 + "\u2518", dim=True))
+    click.echo()
+
+    if not click.confirm(_s("  Save connection?", dim=True), default=True):
+        click.echo(_s("  Cancelled.", fg="yellow"))
+        return
+
+    payload: dict = {
+        "name": name,
+        "base_url": base_url,
+        "api_format": api_format,
+    }
+    if model_name:
+        payload["model_name"] = model_name
+    if auth_scheme:
+        payload["auth_scheme"] = auth_scheme
+    if api_key:
+        payload["api_key"] = api_key
+    if custom_headers:
+        payload["custom_headers"] = custom_headers
+
+    try:
+        r = httpx.post(
+            f"{cfg.api_url}/v1/connections",
+            json=payload,
+            headers=cfg.auth_headers(),
+            timeout=cfg.timeout,
+        )
+        r.raise_for_status()
+    except httpx.HTTPStatusError as exc:
+        click.echo(_s(f"Error: {fmt_http_error(exc)}", fg="red"), err=True)
+        raise SystemExit(1)
+    except httpx.RequestError as exc:
+        click.echo(_s(f"Connection error: {exc}", fg="red"), err=True)
+        raise SystemExit(1)
+
+    data = r.json()
+    cid = data.get("id", "?")[:8]
+    click.echo(_s(f"\u2726 Connection created: {cid}", fg="green", bold=True))
+    click.echo(_s(f"  Name: {data.get('name', '?')}", dim=True))
+    click.echo(_s(f"  URL:  {data.get('base_url', '?')}", dim=True))
+    click.echo(_s(f"  Auth: {data.get('auth_scheme', '?')}", dim=True))

orithos_cli/discovery.py

@@ -0,0 +1,78 @@
+"""Asset discovery subcommands for Orithos CLI."""
+
+from __future__ import annotations
+
+import click
+import httpx
+
+from orithos_cli.config import get_config
+
+
+@click.group(name="discovery")
+def discovery_group() -> None:
+    """Discover AI assets from connected repositories."""
+    pass
+
+
+@discovery_group.command("scan-repo")
+@click.option("--repo", required=True, help="GitHub repo URL (e.g. https://github.com/org/repo)")
+@click.option("--token", envvar="GITHUB_TOKEN", default=None, help="GitHub personal access token for private repos")
+def scan_repo(repo: str, token: str | None) -> None:
+    """Scan a GitHub repository for AI agent assets."""
+    cfg = get_config()
+    url = f"{cfg.api_url}/v1/discovery/scan-repo"
+    payload: dict = {"repo_url": repo}
+    if token:
+        payload["github_token"] = token
+    resp = httpx.post(url, json=payload, headers=cfg.auth_headers(), timeout=cfg.timeout)
+    resp.raise_for_status()
+    data = resp.json()
+    discovered = data.get("discovered", [])
+    if not discovered:
+        click.echo("No AI assets detected in this repository.")
+        return
+    click.secho(f"Discovered {len(discovered)} asset(s) in {data.get('repo', repo)}:", bold=True)
+    for a in discovered:
+        confidence_color = "green" if a.get("confidence", 0) >= 0.8 else ("yellow" if a.get("confidence", 0) >= 0.5 else "white")
+        click.secho(f"  [{a.get('type', '?')}] {a.get('source_file', '?')}", fg=confidence_color)
+        click.echo(f"       Confidence: {a.get('confidence', 0):.0%}")
+
+
+@discovery_group.command("assets")
+@click.option("--status", default="pending", help="Filter by status (pending|added|dismissed)")
+def list_assets(status: str) -> None:
+    """List discovered assets for the organization."""
+    cfg = get_config()
+    url = f"{cfg.api_url}/v1/discovery/assets?status={status}"
+    resp = httpx.get(url, headers=cfg.auth_headers(), timeout=cfg.timeout)
+    resp.raise_for_status()
+    data = resp.json()
+    if not data:
+        click.echo(f"No {status} assets found.")
+        return
+    for a in data:
+        click.secho(f"[{a.get('asset_type', '?')}] {a.get('source_file', '?')}", bold=True)
+        click.echo(f"  ID: {a['id'][:8]}  Confidence: {a.get('confidence', 0):.0%}")
+        click.echo(f"  Repo: {a.get('repo_url', '?')}")
+
+
+@discovery_group.command("add")
+@click.argument("asset-id")
+def add_asset(asset_id: str) -> None:
+    """Mark a discovered asset as added (connection created)."""
+    cfg = get_config()
+    url = f"{cfg.api_url}/v1/discovery/assets/{asset_id}/add"
+    resp = httpx.post(url, headers=cfg.auth_headers(), timeout=cfg.timeout)
+    resp.raise_for_status()
+    click.echo("Asset marked as added.")
+
+
+@discovery_group.command("dismiss")
+@click.argument("asset-id")
+def dismiss_asset(asset_id: str) -> None:
+    """Dismiss a discovered asset (not relevant)."""
+    cfg = get_config()
+    url = f"{cfg.api_url}/v1/discovery/assets/{asset_id}/dismiss"
+    resp = httpx.post(url, headers=cfg.auth_headers(), timeout=cfg.timeout)
+    resp.raise_for_status()
+    click.echo("Asset dismissed.")

orithos_cli/graph.py

@@ -0,0 +1,102 @@
+"""Security graph subcommands for Orithos CLI."""
+
+from __future__ import annotations
+
+import json
+import click
+import httpx
+
+from orithos_cli.config import get_config
+
+
+@click.group(name="graph")
+def graph_group() -> None:
+    """Explore the AI security tool risk graph."""
+    pass
+
+
+@graph_group.command("topology")
+@click.option("--json", "as_json", is_flag=True, help="Raw JSON output")
+def get_topology(as_json: bool) -> None:
+    """Show the full tool risk graph with risk scores."""
+    cfg = get_config()
+    url = f"{cfg.api_url}/v1/graph/topology"
+    resp = httpx.get(url, headers=cfg.auth_headers(), timeout=cfg.timeout)
+    resp.raise_for_status()
+    data = resp.json()
+
+    if as_json:
+        click.echo(json.dumps(data, indent=2))
+        return
+
+    nodes = data.get("nodes", [])
+    edges = data.get("edges", [])
+
+    click.secho(f"Tool Risk Graph — {len(nodes)} nodes, {len(edges)} edges", bold=True)
+    click.echo("")
+
+    for n in nodes:
+        risk_color = {"critical": "red", "high": "yellow", "medium": "blue", "low": "green"}.get(
+            n.get("risk_level", ""), "white"
+        )
+        click.secho(f"  [{n.get('risk_level', '?').upper()}] {n['tool_name']}", fg=risk_color)
+        click.echo(f"       Family: {n.get('tool_family', '?')}")
+        caps = n.get("capabilities", [])
+        if caps:
+            click.echo(f"       Capabilities: {', '.join(caps[:5])}")
+
+    if edges:
+        click.echo("")
+        click.secho("Edges:", bold=True)
+        for e in edges:
+            risk_color = {"critical": "red", "high": "yellow"}.get(e.get("risk_contribution", ""), "white")
+            click.echo(f"  {e['source_tool']} → {e['target_tool']} ", nl=False)
+            click.secho(f"[{e.get('risk_contribution', '?')}]", fg=risk_color)
+
+
+@graph_group.command("agent")
+@click.argument("agent-id")
+@click.option("--json", "as_json", is_flag=True, help="Raw JSON output")
+def get_agent_graph(agent_id: str, as_json: bool) -> None:
+    """Show the tool dependency graph for a specific agent.
+
+    AGENT_ID is the UUID of the agent.
+    """
+    cfg = get_config()
+    url = f"{cfg.api_url}/v1/graph/agent/{agent_id}"
+    resp = httpx.get(url, headers=cfg.auth_headers(), timeout=cfg.timeout)
+    resp.raise_for_status()
+    data = resp.json()
+
+    if as_json:
+        click.echo(json.dumps(data, indent=2))
+        return
+
+    agent = data.get("agent", {})
+    click.secho(f"Agent: {agent.get('name', '?')} ({agent.get('model', '?')})", bold=True)
+    click.echo(f"  ID: {agent.get('id', '?')[:8]}")
+
+    findings = data.get("findings", [])
+    if findings:
+        click.echo("")
+        click.secho(f"Findings ({len(findings)}):", bold=True)
+        for f in findings[:10]:
+            sev_color = {"critical": "red", "high": "yellow"}.get(f.get("severity", ""), "white")
+            click.secho(f"  [{f.get('severity', '?').upper()}] {f.get('attack_path', '?')[:80]}", fg=sev_color)
+
+    policies = data.get("policies", [])
+    if policies:
+        click.echo("")
+        click.secho(f"Policies ({len(policies)}):", bold=True)
+        for p in policies:
+            click.echo(f"  {p.get('tool_name', '?')} → {p.get('decision', '?')}")
+
+    graph = data.get("graph", {})
+    g_nodes = graph.get("nodes", [])
+    g_edges = graph.get("edges", [])
+    if g_nodes:
+        click.echo("")
+        click.secho(f"Tool Subgraph ({len(g_nodes)} nodes, {len(g_edges)} edges):", bold=True)
+        for n in g_nodes:
+            risk_color = {"critical": "red", "high": "yellow"}.get(n.get("risk_level", ""), "white")
+            click.secho(f"  [{n.get('risk_level', '?').upper()}] {n['tool_name']}", fg=risk_color)

orithos_cli/guardrail.py

@@ -0,0 +1,131 @@
+"""Guardrail subcommands for Orithos CLI."""
+
+from __future__ import annotations
+
+import json
+import click
+import httpx
+
+from orithos_cli.config import get_config
+
+
+@click.group(name="guardrail")
+def guardrail_group() -> None:
+    """Manage AI security guardrails — generate, list, export, regenerate."""
+    pass
+
+
+@guardrail_group.command("generate")
+@click.argument("scan-id")
+def generate_guardrails(scan_id: str) -> None:
+    """Generate guardrails from a completed scan. Calls LLM to synthesize rules.
+
+    SCAN_ID is the UUID of the scan to generate guardrails from.
+    """
+    cfg = get_config()
+    url = f"{cfg.api_url}/v1/guardrails/generate"
+    try:
+        resp = httpx.post(
+            url, json={"scan_id": scan_id}, headers=cfg.auth_headers(), timeout=120.0
+        )
+        resp.raise_for_status()
+    except httpx.HTTPStatusError as exc:
+        click.echo(f"Error: {exc.response.status_code} — {exc.response.text}", err=True)
+        raise SystemExit(1)
+    except Exception as exc:
+        click.echo(f"Error: {exc}", err=True)
+        raise SystemExit(1)
+    data = resp.json()
+    if "error" in data:
+        click.echo(f"Generation failed: {data['error']}")
+        return
+    click.echo(json.dumps(data, indent=2))
+
+
+@guardrail_group.command("list")
+@click.option(
+    "--status", default=None, help="Filter by status (active|draft|review_needed)"
+)
+def list_guardrails(status: str | None) -> None:
+    """List all guardrails for the organization."""
+    cfg = get_config()
+    url = f"{cfg.api_url}/v1/guardrails"
+    params = {}
+    if status:
+        params["status"] = status
+    resp = httpx.get(
+        url, params=params or None, headers=cfg.auth_headers(), timeout=cfg.timeout
+    )
+    resp.raise_for_status()
+    data = resp.json()
+    items = data if isinstance(data, list) else data.get("items", [])
+    if not items:
+        click.echo("No guardrails found.")
+        return
+    for g in items:
+        status_color = (
+            "green"
+            if g.get("status") == "active"
+            else ("yellow" if g.get("status") == "review_needed" else "white")
+        )
+        click.secho(
+            f"[{g.get('status', '?')}] {g['name']} (v{g.get('version', 1)})",
+            bold=True,
+            fg=status_color,
+        )
+        click.echo(f"  ID: {g['id'][:8]}  Rules: {g.get('rule_count', 0)}")
+        click.echo(f"  Created: {g.get('created_at', '?')}")
+
+
+@guardrail_group.command("export")
+@click.argument("guardrail-id")
+@click.option(
+    "--format",
+    "fmt",
+    default="structured",
+    type=click.Choice(["structured", "nemo", "classifier"]),
+    help="Export format: structured (default), nemo (Colang YAML), classifier (LLM prompt)",
+)
+@click.option("--output", "-o", default=None, help="Write to file instead of stdout")
+def export_guardrail(guardrail_id: str, fmt: str, output: str | None) -> None:
+    """Export a guardrail in different formats.
+
+    GUARDRAIL_ID is the UUID of the guardrail to export.
+
+    Structured export (default) creates a Policy resource — uses POST.
+    Nemo/classifier exports are read-only — uses GET.
+    """
+    cfg = get_config()
+
+    if fmt == "structured":
+        url = f"{cfg.api_url}/v1/guardrails/{guardrail_id}/export-policy"
+        resp = httpx.post(url, headers=cfg.auth_headers(), timeout=cfg.timeout)
+    else:
+        url = f"{cfg.api_url}/v1/guardrails/{guardrail_id}/export?format={fmt}"
+        resp = httpx.get(url, headers=cfg.auth_headers(), timeout=cfg.timeout)
+
+    resp.raise_for_status()
+    content_type = resp.headers.get("content-type", "")
+    if "text/" in content_type:
+        text = resp.text
+    else:
+        text = json.dumps(resp.json(), indent=2)
+
+    ext = {"structured": "yaml", "nemo": "yml", "classifier": "txt"}.get(fmt, "txt")
+    filename = output or f"guardrail-{guardrail_id[:8]}.{ext}"
+
+    with open(filename, "w") as f:
+        f.write(text)
+    click.echo(f"Exported to {filename} ({len(text)} bytes)")
+
+
+@guardrail_group.command("regenerate")
+@click.argument("guardrail-id")
+def regenerate_guardrail(guardrail_id: str) -> None:
+    """Re-generate guardrail rules from the source scan using LLM."""
+    cfg = get_config()
+    url = f"{cfg.api_url}/v1/guardrails/{guardrail_id}/regenerate"
+    resp = httpx.post(url, headers=cfg.auth_headers(), timeout=cfg.timeout)
+    resp.raise_for_status()
+    data = resp.json()
+    click.echo(json.dumps(data, indent=2))