patchi 0.7.5__py3-none-any.whl

patchi/core/debug/dap_client.py

@@ -0,0 +1,268 @@
+from __future__ import annotations
+
+import json
+import logging
+import socket
+import time
+
+_log = logging.getLogger("patchi.debug.dap_client")
+
+
+class DAPError(Exception):
+    """A DAP request returned success=false."""
+
+
+class DAPClient:
+    """Minimal Debug Adapter Protocol client over TCP.
+
+    Drives any DAP-compliant debug adapter (debugpy, dlv dap, codelldb, …)
+    through the same code path.  This is *not* a full DAP implementation —
+    only the subset needed to capture post-exception state.
+    """
+
+    def __init__(self, host: str = "127.0.0.1", port: int = 5678):
+        self._host = host
+        self._port = port
+        self._sock: socket.socket | None = None
+        self._seq = 0
+        self._buffer = b""
+
+    # ── connection lifecycle ────────────────────────────────────────────
+
+    def connect(self, timeout: float = 15) -> None:
+        deadline = time.monotonic() + timeout
+        last_err = None
+        while time.monotonic() < deadline:
+            try:
+                self._sock = socket.create_connection(
+                    (self._host, self._port), timeout=min(5.0, deadline - time.monotonic())
+                )
+                self._sock.settimeout(timeout)
+                return
+            except (ConnectionRefusedError, OSError) as e:
+                last_err = e
+                time.sleep(0.5)
+        raise ConnectionError(
+            f"Could not connect to {self._host}:{self._port} after {timeout}s"
+        ) from last_err
+
+    def close(self) -> None:
+        if self._sock:
+            try:
+                self._sock.close()
+            except OSError:
+                pass
+            self._sock = None
+            self._buffer = b""
+
+    # ── low-level I/O ───────────────────────────────────────────────────
+
+    def _send(self, body: str) -> None:
+        raw = f"Content-Length: {len(body)}\r\n\r\n{body}".encode()
+        self._sock.sendall(raw)
+
+    def _recv(self, size: int = 8192) -> bytes:
+        chunk = self._sock.recv(size)
+        if not chunk:
+            raise ConnectionError("debug adapter closed the connection")
+        return chunk
+
+    def read_message(self) -> dict:
+        self._buffer += self._recv()
+        # peel off one complete DAP message
+        while True:
+            idx = self._buffer.find(b"\r\n\r\n")
+            if idx == -1:
+                self._buffer += self._recv()
+                continue
+            header = self._buffer[:idx].decode("ascii", errors="replace")
+            length = 0
+            for line in header.split("\r\n"):
+                if line.lower().startswith("content-length:"):
+                    length = int(line.split(":", 1)[1].strip())
+                    break
+            body_start = idx + 4
+            if len(self._buffer) < body_start + length:
+                self._buffer += self._recv()
+                continue
+            body = self._buffer[body_start : body_start + length]
+            self._buffer = self._buffer[body_start + length :]
+            return json.loads(body.decode("utf-8"))
+
+    # ── high-level wire helpers ─────────────────────────────────────────
+
+    def send_request(self, command: str, arguments: dict | None = None) -> int:
+        self._seq += 1
+        body = json.dumps(
+            {
+                "seq": self._seq,
+                "type": "request",
+                "command": command,
+                "arguments": arguments or {},
+            }
+        )
+        self._send(body)
+        return self._seq
+
+    def read_response(self, expected_seq: int) -> dict:
+        while True:
+            msg = self.read_message()
+            if msg["type"] == "response" and msg.get("request_seq") == expected_seq:
+                if not msg.get("success", False):
+                    err = msg.get(
+                        "message", msg.get("body", {}).get("error", {}).get("format", "unknown")
+                    )
+                    raise DAPError(f"{msg.get('command', '?')} failed: {err}")
+                return msg.get("body", {})
+            if msg["type"] == "event":
+                _log.debug("DAP event during response wait: %s", msg.get("event"))
+
+    def request(self, command: str, arguments: dict | None = None) -> dict:
+        seq = self.send_request(command, arguments)
+        return self.read_response(seq)
+
+    def wait_for_event(self, event: str) -> dict:
+        while True:
+            msg = self.read_message()
+            if msg["type"] == "event" and msg.get("event") == event:
+                return msg.get("body", {})
+
+    # ── standard DAP requests ──────────────────────────────────────────
+
+    def initialize(self) -> dict:
+        return self.request(
+            "initialize",
+            {
+                "clientID": "patchi-debug",
+                "clientName": "Patchi Debugger",
+                "adapterID": "python",
+                "pathFormat": "path",
+                "linesStartAt1": True,
+                "columnsStartAt1": True,
+                "supportsVariableType": True,
+                "supportsRunInTerminalRequest": False,
+            },
+        )
+
+    def launch(
+        self,
+        program: str,
+        args: list[str] | None = None,
+        *,
+        type: str = "python",
+        console: str = "none",
+        sourceLanguages: list[str] | None = None,
+    ) -> dict:
+        args_body = {
+            "type": type,
+            "request": "launch",
+            "name": "Patchi Debug",
+            "program": program,
+            "args": args or [],
+            "console": console,
+        }
+        if sourceLanguages is not None:
+            args_body["sourceLanguages"] = sourceLanguages
+        return self.request("launch", args_body)
+
+    def set_exception_breakpoints(self, filters: list[str] | None = None) -> dict:
+        return self.request(
+            "setExceptionBreakpoints",
+            {
+                "filters": filters or ["uncaught"],
+            },
+        )
+
+    def set_function_breakpoints(self, names: list[str]) -> dict:
+        return self.request(
+            "setFunctionBreakpoints",
+            {
+                "breakpoints": [{"name": n} for n in names],
+            },
+        )
+
+    def set_breakpoints(self, source_path: str, lines: list[int]) -> dict:
+        return self.request(
+            "setBreakpoints",
+            {
+                "source": {"path": source_path},
+                "breakpoints": [{"line": ln} for ln in lines],
+            },
+        )
+
+    def configuration_done(self) -> dict:
+        return self.request("configurationDone")
+
+    def continue_req(self, thread_id: int = 1) -> dict:
+        return self.request("continue", {"threadId": thread_id})
+
+    def stack_trace(self, thread_id: int, levels: int = 30) -> dict:
+        return self.request(
+            "stackTrace",
+            {
+                "threadId": thread_id,
+                "levels": levels,
+            },
+        )
+
+    def scopes(self, frame_id: int) -> dict:
+        return self.request("scopes", {"frameId": frame_id})
+
+    def variables(self, var_ref: int) -> dict:
+        return self.request("variables", {"variablesReference": var_ref})
+
+    def disconnect(self) -> dict:
+        return self.request("disconnect")
+
+    # ── non-blocking launch flow ───────────────────────────────────────
+
+    def launch_no_wait(
+        self,
+        program: str,
+        args: list[str] | None = None,
+        *,
+        type: str = "python",
+        console: str = "none",
+        sourceLanguages: list[str] | None = None,
+    ) -> int:
+        """Send ``launch`` + ``configurationDone`` without waiting for the
+        launch response.
+
+        Some adapters (codelldb) defer the ``launch`` response until
+        ``configurationDone`` has been processed.  Blocking on the response
+        before sending ``configurationDone`` deadlocks, so this sends both
+        back-to-back and returns the launch request seq.
+        """
+        body = {
+            "type": type,
+            "request": "launch",
+            "name": "Patchi Debug",
+            "program": program,
+            "args": args or [],
+            "console": console,
+        }
+        if sourceLanguages is not None:
+            body["sourceLanguages"] = sourceLanguages
+        launch_seq = self.send_request("launch", body)
+        self.send_request("configurationDone", {})
+        return launch_seq
+
+    def wait_for_stopped(self, timeout: float) -> dict:
+        """Read messages until a ``stopped`` event arrives (within *timeout*).
+
+        Other events and responses (including the deferred ``launch``
+        response) are consumed and discarded.  Raises ``TimeoutError`` if no
+        stop happens in time.
+        """
+        deadline = time.monotonic() + timeout
+        while True:
+            remaining = deadline - time.monotonic()
+            if remaining <= 0:
+                raise TimeoutError("timed out waiting for 'stopped' event")
+            try:
+                self._sock.settimeout(min(max(remaining, 0.5), 5.0))
+                msg = self.read_message()
+            except (ConnectionError, OSError, TimeoutError) as exc:
+                raise TimeoutError("timed out waiting for 'stopped' event") from exc
+            if msg.get("type") == "event" and msg.get("event") == "stopped":
+                return msg.get("body", {})

patchi/core/detector/audit.py

@@ -0,0 +1,194 @@
+"""
+Audit log — hash-chained, append-only event log.
+
+Wraps the existing governance SQLite log and hosted JSON-lines log into a single
+interface, receiving Event objects. Every event published to the EventBus with an
+audit handler is written through this layer.
+
+Hash chaining: each entry includes the SHA-256 of the previous entry, forming an
+immutable chain. Exporting produces a verifiable lineage.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import logging
+import os
+from dataclasses import dataclass, field
+from datetime import UTC, datetime
+from pathlib import Path
+from typing import Any
+
+from patchi.core.detector.event import Event
+
+logger = logging.getLogger("patchi.detector.audit")
+
+
+@dataclass
+class AuditEntry:
+    """A single entry in the audit log — wraps an Event with hash chaining."""
+
+    event: Event
+    previous_hash: str = ""
+    entry_hash: str = field(default_factory=lambda: "")
+    written_at: str = field(default_factory=lambda: datetime.now(UTC).isoformat())
+
+    def __post_init__(self) -> None:
+        if not self.entry_hash:
+            self.entry_hash = self._compute_hash()
+
+    def _compute_hash(self) -> str:
+        raw = json.dumps(self.to_dict(signed=True), sort_keys=True, default=str)
+        return hashlib.sha256(raw.encode()).hexdigest()
+
+    def to_dict(self, signed: bool = False) -> dict:
+        d: dict[str, Any] = {
+            "event": self.event.to_dict(),
+            "written_at": self.written_at,
+        }
+        if signed:
+            d["previous_hash"] = self.previous_hash
+            d["entry_hash"] = self.entry_hash
+        return d
+
+
+class AuditLog:
+    """
+    Event-driven audit log with hash chaining.
+
+    Writes to a JSON-lines file at `.patchi/detector/audit.log.jsonl`.
+    Each line is a JSON object with the event, timestamp, and chain hash.
+
+    Export produces a full verifiable chain. Governance SQLite log is still
+    written for backward compatibility (high-level action tracking).
+    """
+
+    def __init__(self, root: Path | None = None):
+        self._root = root
+        self._last_hash = ""
+        self._chain_length = 0
+        self._file: Any = None  # open file handle
+        if root:
+            self._open()
+
+    def _open(self) -> None:
+        if not self._root:
+            return
+        log_dir = self._root / ".patchi" / "detector"
+        log_dir.mkdir(parents=True, exist_ok=True)
+        log_path = log_dir / "audit.log.jsonl"
+
+        # Load the last entry's hash if the file exists
+        if log_path.exists() and log_path.stat().st_size > 0:
+            try:
+                with open(log_path, encoding="utf-8") as f:
+                    for line in f:
+                        if line.strip():
+                            entry = json.loads(line)
+                            self._last_hash = entry.get("entry_hash", "")
+                            self._chain_length += 1
+            except (json.JSONDecodeError, OSError):
+                logger.warning("Corrupt audit log — starting fresh chain")
+                self._last_hash = ""
+                self._chain_length = 0
+
+        self._log_path = log_path
+        self._file = open(log_path, "a", encoding="utf-8")  # noqa: SIM115
+
+    async def write(self, event: Event) -> None:
+        """Write an event to the audit log with hash chaining."""
+        entry = AuditEntry(
+            event=event,
+            previous_hash=self._last_hash,
+        )
+        self._last_hash = entry.entry_hash
+        self._chain_length += 1
+        line = json.dumps(entry.to_dict(signed=True), default=str) + "\n"
+
+        if self._file:
+            try:
+                self._file.write(line)
+                self._file.flush()
+                os.fsync(self._file.fileno())
+            except OSError as exc:
+                logger.error("Failed to write audit log: %s", exc)
+
+    async def write_batch(self, events: list[Event]) -> None:
+        for event in events:
+            await self.write(event)
+
+    def export(self) -> str:
+        """Export the full audit log as a JSON array (for reporting/sharing)."""
+        if not self._root:
+            return "[]"
+        log_path = self._root / ".patchi" / "detector" / "audit.log.jsonl"
+        if not log_path.exists():
+            return "[]"
+        entries = []
+        with open(log_path, encoding="utf-8") as f:
+            for line in f:
+                if line.strip():
+                    entries.append(json.loads(line))
+        return json.dumps(entries, indent=2, default=str)
+
+    def verify_chain(self) -> tuple[bool, int]:
+        """Verify the hash chain integrity. Returns (valid, verified_count)."""
+        if not self._root:
+            return True, 0
+        log_path = self._root / ".patchi" / "detector" / "audit.log.jsonl"
+        if not log_path.exists():
+            return True, 0
+        prev_hash = ""
+        count = 0
+        with open(log_path, encoding="utf-8") as f:
+            for line in f:
+                if not line.strip():
+                    continue
+                try:
+                    entry = json.loads(line)
+                except json.JSONDecodeError:
+                    return False, count
+                if entry.get("previous_hash", "") != prev_hash:
+                    return False, count
+                prev_hash = entry.get("entry_hash", "")
+                count += 1
+        return True, count
+
+    def close(self) -> None:
+        if self._file:
+            self._file.close()
+            self._file = None
+
+    def __enter__(self) -> AuditLog:
+        return self
+
+    def __exit__(self, exc_type, exc_val, exc_tb) -> None:
+        self.close()
+
+    @property
+    def stats(self) -> dict:
+        return {
+            "chain_length": self._chain_length,
+            "last_hash": self._last_hash[:16] + "...",
+        }
+
+
+# ── Shared bus setup (convenience) ──────────────────────────────────────────
+
+
+def setup_audit_logger(bus, root: Path) -> AuditLog:
+    """
+    Create an AuditLog and attach it as the bus's audit handler.
+
+    Returns the AuditLog instance so callers can export/verify.
+    """
+
+    audit_log = AuditLog(root=root)
+
+    async def audit_handler(event: Event) -> None:
+        await audit_log.write(event)
+
+    bus._audit_handler = audit_handler  # type: ignore[attr-defined]
+    logger.info("Audit log attached to bus at .patchi/detector/audit.log.jsonl")
+    return audit_log

patchi/core/detector/bus.py

@@ -0,0 +1,226 @@
+"""
+EventBus — in-memory async pub/sub for the detector pipeline.
+
+Features:
+- Subscribe by EventSource, TechniqueID, severity threshold, or agent name
+- Rate-limited dispatch (prevents handler resource exhaustion)
+- Batch collection (time/buffer-based for bulk processing)
+- Auditable: every published event is forwarded to the audit log
+"""
+
+from __future__ import annotations
+
+import asyncio
+import logging
+import time
+from collections import defaultdict
+from collections.abc import Awaitable, Callable
+from dataclasses import dataclass
+
+from patchi.core.detector.event import Event, EventSeverity, EventSource, TechniqueID
+
+logger = logging.getLogger("patchi.detector.bus")
+
+# Type alias for event handlers
+EventHandler = Callable[[Event], Awaitable[None]]
+
+
+_log = logging.getLogger("patchi.core.bus")
+
+
+@dataclass
+class Subscription:
+    """A single subscription to the event bus."""
+
+    handler: EventHandler
+    source: set[EventSource] | None = None
+    technique_filter: set[str] | None = None
+    agent_filter: set[str] | None = None
+    min_severity: EventSeverity | None = None
+    name: str = ""
+
+
+class RateLimiter:
+    """Sliding-window rate limiter per handler."""
+
+    def __init__(self, max_per_second: float = 100.0):
+        self._windows: dict[str, list[float]] = defaultdict(list)
+        self._max_per_second = max_per_second
+
+    def allow(self, key: str) -> bool:
+        now = time.monotonic()
+        window = self._windows[key]
+        cutoff = now - 1.0
+        while window and window[0] < cutoff:
+            window.pop(0)
+        if len(window) >= self._max_per_second:
+            return False
+        window.append(now)
+        return True
+
+    def reset(self, key: str) -> None:
+        self._windows.pop(key, None)
+
+
+class EventBus:
+    """
+    In-memory event bus with filtering, rate limiting, and audit forwarding.
+
+    Usage:
+        bus = EventBus()
+
+        async def on_scan_event(event: Event):
+            print(f"Got: {event.summary}")
+
+        bus.subscribe(on_scan_event, source={EventSource.AGENT})
+        await bus.publish(event)
+
+        # Collect in batches
+        async for batch in bus.collect_batch(timeout_s=5.0, max_events=100):
+            await process(batch)
+    """
+
+    def __init__(
+        self,
+        audit_handler: EventHandler | None = None,
+        rate_limit: float = 200.0,
+    ):
+        self._subscriptions: list[Subscription] = []
+        self._lock = asyncio.Lock()
+        self._rate_limiter = RateLimiter(max_per_second=rate_limit)
+        self._audit_handler = audit_handler
+        self._batch_queue: asyncio.Queue[Event] = asyncio.Queue()
+        self._running = False
+
+    # ── Subscription management ────────────────────────────────────────────────
+
+    def subscribe(
+        self,
+        handler: EventHandler,
+        *,
+        source: set[EventSource] | None = None,
+        technique_id: set[str] | None = None,
+        agent: set[str] | None = None,
+        min_severity: EventSeverity | None = None,
+        name: str = "",
+    ) -> Subscription:
+        sub = Subscription(
+            handler=handler,
+            source=source,
+            technique_filter=technique_id,
+            agent_filter=agent,
+            min_severity=min_severity,
+            name=name or getattr(handler, "__name__", str(id(handler))),
+        )
+        self._subscriptions.append(sub)
+        return sub
+
+    def unsubscribe(self, sub: Subscription) -> None:
+        if sub in self._subscriptions:
+            self._subscriptions.remove(sub)
+
+    def clear(self) -> None:
+        self._subscriptions.clear()
+
+    # ── Publishing ─────────────────────────────────────────────────────────────
+
+    async def publish(self, event: Event) -> None:
+        """Publish a single event to matching subscribers."""
+        tid = (
+            event.technique_id.value
+            if isinstance(event.technique_id, TechniqueID)
+            else event.technique_id
+        )
+
+        matched_any = False
+        async with self._lock:
+            for sub in self._subscriptions:
+                if not self._matches(event, sub, tid):
+                    continue
+                handler_key = f"{sub.name}:{tid}"
+                if not self._rate_limiter.allow(handler_key):
+                    logger.debug("Rate limit hit for %s on %s", sub.name, tid)
+                    continue
+                matched_any = True
+                try:
+                    await sub.handler(event)
+                except Exception as e:
+                    _log.warning("EventBus.publish failed: %s", e)
+                    logger.exception("Handler %s failed on event %s", sub.name, event.event_id)
+
+        # Always queue for batch collection
+        await self._batch_queue.put(event)
+
+        # Forward to audit handler (separate from subscriptions so it always fires)
+        if self._audit_handler:
+            try:
+                await self._audit_handler(event)
+            except Exception as e:
+                _log.warning("EventBus.publish failed: %s", e)
+                logger.exception("Audit handler failed on event %s", event.event_id)
+
+        if not matched_any:
+            logger.debug("Event %s had zero matching subscribers", event.event_id)
+
+    async def publish_batch(self, events: list[Event]) -> None:
+        """Publish multiple events in sequence."""
+        for event in events:
+            await self.publish(event)
+
+    # ── Batch collection ──────────────────────────────────────────────────────
+
+    async def collect_batch(
+        self,
+        timeout_s: float = 5.0,
+        max_events: int = 100,
+    ) -> list[Event]:
+        """
+        Collect events into a batch (blocks until timeout or max_events reached).
+
+        Usage:
+            while True:
+                batch = await bus.collect_batch(timeout_s=1.0)
+                if batch:
+                    await save_to_db(batch)
+        """
+        events: list[Event] = []
+        deadline = time.monotonic() + timeout_s
+
+        while len(events) < max_events:
+            remaining = deadline - time.monotonic()
+            if remaining <= 0:
+                break
+            try:
+                ev = await asyncio.wait_for(
+                    self._batch_queue.get(),
+                    timeout=remaining,
+                )
+                events.append(ev)
+            except TimeoutError:
+                break
+
+        return events
+
+    # ── Stats ──────────────────────────────────────────────────────────────────
+
+    def subscriber_count(self) -> int:
+        return len(self._subscriptions)
+
+    def stats(self) -> dict:
+        return {
+            "subscribers": len(self._subscriptions),
+            "queue_depth": self._batch_queue.qsize(),
+        }
+
+    # ── Matching logic ─────────────────────────────────────────────────────────
+
+    def _matches(self, event: Event, sub: Subscription, tid: str) -> bool:
+        if sub.source is not None and event.source not in sub.source:
+            return False
+        if sub.technique_filter is not None and tid not in sub.technique_filter:
+            return False
+        if sub.agent_filter is not None and event.agent_name not in sub.agent_filter:
+            return False
+        if sub.min_severity is not None and event.severity.sort_key() > sub.min_severity.sort_key():
+            return False
+        return True