patchi 0.7.5__py3-none-any.whl

patchi/core/hosted/webhooks.py

@@ -0,0 +1,156 @@
+"""
+Hosted Webhooks — Outbound alert forwarding for Patchi hosted mode.
+
+Stores webhook subscriptions in .patchi/hosted/webhooks.json and delivers
+finding/anomaly alerts via signed POST requests. Delivery failures are
+logged to the audit log; repeated failures auto-disable a webhook.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import json
+import logging
+import time
+import uuid
+from pathlib import Path
+
+_log = logging.getLogger("patchi.hosted.webhooks")
+
+MAX_FAILURES = 5  # consecutive failures before auto-disable
+
+
+def _path(root: Path) -> Path:
+    return root / ".patchi" / "hosted" / "webhooks.json"
+
+
+def _load(root: Path) -> list[dict]:
+    p = _path(root)
+    if not p.exists():
+        return []
+    try:
+        return json.loads(p.read_text(encoding="utf-8"))
+    except Exception as e:
+        _log.warning("webhook load failed: %s", e)
+        return []
+
+
+def _save(root: Path, hooks: list[dict]) -> None:
+    p = _path(root)
+    p.parent.mkdir(parents=True, exist_ok=True)
+    tmp = p.with_suffix(".tmp")
+    tmp.write_text(json.dumps(hooks, indent=2), encoding="utf-8")
+    tmp.replace(p)
+
+
+def list_webhooks(root: Path) -> list[dict]:
+    """All webhooks with secret redacted."""
+    out = []
+    for h in _load(root):
+        out.append(
+            {k: v for k, v in h.items() if k != "secret"} | {"has_secret": bool(h.get("secret"))}
+        )
+    return out
+
+
+def add_webhook(
+    root: Path, url: str, events: list[str] | None = None, name: str = "", secret: str = ""
+) -> dict:
+    """Register a webhook. Returns its record (with id)."""
+    hooks = _load(root)
+    record = {
+        "id": uuid.uuid4().hex[:10],
+        "url": url,
+        "events": events or ["finding", "anomaly", "scan_completed"],
+        "name": name or url[:40],
+        "secret": secret,
+        "enabled": True,
+        "consecutive_failures": 0,
+        "last_delivery": None,
+        "created_at": time.time(),
+    }
+    hooks.append(record)
+    _save(root, hooks)
+    return {k: v for k, v in record.items() if k != "secret"}
+
+
+def remove_webhook(root: Path, hook_id: str) -> bool:
+    hooks = _load(root)
+    before = len(hooks)
+    hooks = [h for h in hooks if h.get("id") != hook_id]
+    if len(hooks) < before:
+        _save(root, hooks)
+        return True
+    return False
+
+
+def _sign(payload_bytes: bytes, secret: str) -> str:
+    return hmac.new(secret.encode("utf-8"), payload_bytes, hashlib.sha256).hexdigest()
+
+
+def dispatch_event(root: Path, event: str, data: dict) -> int:
+    """Fan an event out to matching enabled webhooks. Returns delivery count.
+
+    Never raises — delivery issues are logged and counted per-hook.
+    """
+    delivered = 0
+    hooks = _load(root)
+    dirty = False
+
+    for h in hooks:
+        if not h.get("enabled"):
+            continue
+        if event not in h.get("events", []) and "*" not in h.get("events", []):
+            continue
+
+        body = json.dumps({"event": event, "data": data, "ts": time.time()}).encode("utf-8")
+        headers = {"Content-Type": "application/json"}
+        if h.get("secret"):
+            headers["X-Patchi-Signature"] = _sign(body, h["secret"])
+
+        ok = False
+        try:
+            import urllib.request
+
+            req = urllib.request.Request(h["url"], data=body, headers=headers, method="POST")
+            with urllib.request.urlopen(req, timeout=10) as resp:
+                ok = 200 <= resp.status < 300
+        except Exception as e:
+            _log.debug("webhook %s delivery failed: %s", h["id"], e)
+
+        if ok:
+            h["consecutive_failures"] = 0
+            h["last_delivery"] = time.time()
+            delivered += 1
+        else:
+            h["consecutive_failures"] = h.get("consecutive_failures", 0) + 1
+            if h["consecutive_failures"] >= MAX_FAILURES:
+                h["enabled"] = False
+                try:
+                    from patchi.core.hosted.audit_log import write as audit_write
+
+                    audit_write(
+                        root,
+                        "webhook.disabled",
+                        data={
+                            "id": h["id"],
+                            "reason": f"{MAX_FAILURES} consecutive delivery failures",
+                        },
+                    )
+                except Exception as _exc:
+                    _log.warning('dispatch_event failed: %s', _exc)
+        dirty = True
+
+    if dirty:
+        _save(root, hooks)
+
+    try:
+        from patchi.core.hosted.audit_log import write as audit_write
+
+        if delivered:
+            audit_write(root, "webhook.delivered", data={"event": event, "count": delivered})
+    except Exception as _exc:
+        _log.warning('dispatch_event failed: %s', _exc)
+
+    return delivered

patchi/core/memory.py

@@ -0,0 +1,437 @@
+"""
+Memory system for Patchi.
+
+All persistent data outside config lives here. Organised JSON files,
+one per category. Human-readable. Viewable and deletable from CLI and web UI.
+
+Rules:
+- Every write is atomic (write to temp, rename to target).
+- Deleting any category triggers a rescan of that area on next run.
+- Callers never read the JSON files directly — always go through these functions.
+"""
+
+import json
+
+# ── Low-level read/write ───────────────────────────────────────────────────────
+import logging
+import threading
+import time
+import uuid
+from datetime import UTC
+from pathlib import Path
+from typing import Any
+
+from patchi.core.atomic import atomic_replace
+from patchi.core.config import require_project_root
+from patchi.core.constants import (
+    MEMORY_FILES,
+    MemoryCategory,
+)
+
+_log = logging.getLogger("patchi.core.memory")
+
+# Serializes read-modify-write ops (e.g. save_scan_result) that the Coordinator
+# calls from parallel agent threads — without it, concurrent writers race on
+# the same .tmp file (PermissionError/FileNotFoundError on Windows).
+_WRITE_LOCK = threading.RLock()
+
+
+def _mem_path(category: MemoryCategory, root: Path) -> Path:
+    return root / MEMORY_FILES[category]
+
+
+def _read(category: MemoryCategory, root: Path) -> Any:
+    path = _mem_path(category, root)
+    if not path.exists():
+        return [] if category in _list_categories() else {}
+    with path.open("r", encoding="utf-8") as f:
+        return json.load(f)
+
+
+def _write(category: MemoryCategory, data: Any, root: Path) -> None:
+    with _WRITE_LOCK:
+        path = _mem_path(category, root)
+        path.parent.mkdir(parents=True, exist_ok=True)
+        tmp = path.with_suffix(".tmp")
+        with tmp.open("w", encoding="utf-8") as f:
+            json.dump(data, f, indent=2)
+        atomic_replace(tmp, path)
+
+
+def _update(category: MemoryCategory, fn: Any, root: Path) -> Any:
+    """Thread-safe read-modify-write: lock, read, mutate via fn, write back."""
+    r = _root(root)
+    with _WRITE_LOCK:
+        data = _read(category, r)
+        result = fn(data)
+        _write(category, result, r)
+    return result
+
+
+def _list_categories() -> set[MemoryCategory]:
+    return {
+        MemoryCategory.PATCHES,
+        MemoryCategory.FAILED,
+        MemoryCategory.ISSUES,
+        MemoryCategory.RESTRICTIONS,
+        MemoryCategory.TOKENS,
+    }
+
+
+def _root(root: Path | None) -> Path:
+    return root or require_project_root()
+
+
+# ── Generic read / delete ──────────────────────────────────────────────────────
+
+
+def read(category: MemoryCategory, root: Path | None = None) -> Any:
+    """Return all memory data for a category."""
+    return _read(category, _root(root))
+
+
+def delete(category: MemoryCategory, root: Path | None = None) -> None:
+    """
+    Clear all memory for a category.
+    Resets to empty list or dict (not deleting the file itself,
+    so Patchi knows to re-scan on next run).
+    """
+    r = _root(root)
+    empty: Any = [] if category in _list_categories() else {}
+    _write(category, empty, r)
+
+
+def delete_all(root: Path | None = None) -> None:
+    """Wipe everything. Called after user types CONFIRM."""
+    r = _root(root)
+    for category in MemoryCategory:
+        delete(category, r)
+
+
+def summary(root: Path | None = None) -> dict[str, Any]:
+    """High-level counts per category — used by `p memory` and Overview panel."""
+    r = _root(root)
+    out: dict[str, Any] = {}
+    for category in MemoryCategory:
+        data = _read(category, r)
+        if isinstance(data, list):
+            out[category.value] = {"count": len(data)}
+        elif isinstance(data, dict):
+            out[category.value] = {"keys": list(data.keys())}
+        else:
+            out[category.value] = {}
+    return out
+
+
+# ── Brain ──────────────────────────────────────────────────────────────────────
+
+
+def get_brain(root: Path | None = None) -> dict:
+    return _read(MemoryCategory.BRAIN, _root(root))
+
+
+def save_brain(brain: dict, root: Path | None = None) -> None:
+    _write(MemoryCategory.BRAIN, brain, _root(root))
+
+
+# ── Layered brain ─────────────────────────────────────────────────────────────
+
+
+def get_layers(root: Path | None = None) -> dict:
+    return _read(MemoryCategory.LAYERS, _root(root))
+
+
+def save_layers(layers: dict, root: Path | None = None) -> None:
+    _write(MemoryCategory.LAYERS, layers, _root(root))
+
+
+# ── Project charter (guard rails) ─────────────────────────────────────────────
+
+
+def get_charter(root: Path | None = None) -> dict:
+    return _read(MemoryCategory.CHARTER, _root(root))
+
+
+def save_charter(charter: dict, root: Path | None = None) -> None:
+    _write(MemoryCategory.CHARTER, charter, _root(root))
+
+
+def mark_brain_stale(
+    changed_files: list[str],
+    root: Path | None = None,
+    stale_layers: list[str] | None = None,
+) -> None:
+    r = _root(root)
+    brain = _read(MemoryCategory.BRAIN, r)
+    brain["stale"] = True
+    brain["stale_reason"] = f"{len(changed_files)} file(s) changed"
+    brain["changed_files"] = changed_files
+    if stale_layers is not None:
+        brain["stale_layers"] = sorted(stale_layers)
+    _write(MemoryCategory.BRAIN, brain, r)
+
+
+# ── Patches ────────────────────────────────────────────────────────────────────
+
+
+def list_patches(root: Path | None = None) -> list[dict]:
+    return _read(MemoryCategory.PATCHES, _root(root))
+
+
+def save_patch(patch: dict, root: Path | None = None) -> str:
+    """Append a patch record. Returns the patch ID."""
+    r = _root(root)
+    patches = _read(MemoryCategory.PATCHES, r)
+    if "id" not in patch:
+        patch["id"] = str(uuid.uuid4())[:8]
+    patch.setdefault("timestamp", _now())
+    patches.append(patch)
+    _write(MemoryCategory.PATCHES, patches, r)
+    return patch["id"]
+
+
+def get_patch(patch_id: str, root: Path | None = None) -> dict | None:
+    for p in list_patches(root):
+        if p.get("id") == patch_id:
+            return p
+    return None
+
+
+def delete_patches(root: Path | None = None) -> None:
+    delete(MemoryCategory.PATCHES, root)
+
+
+# ── Failed patches ─────────────────────────────────────────────────────────────
+
+
+def list_failed(root: Path | None = None) -> list[dict]:
+    return _read(MemoryCategory.FAILED, _root(root))
+
+
+def save_failed(patch_id: str, reason: str, diff: str = "", root: Path | None = None) -> None:
+    r = _root(root)
+    failed = _read(MemoryCategory.FAILED, r)
+    failed.append(
+        {
+            "id": patch_id,
+            "reason": reason,
+            "diff": diff,
+            "timestamp": _now(),
+        }
+    )
+    _write(MemoryCategory.FAILED, failed, r)
+
+
+def delete_failed(root: Path | None = None) -> None:
+    delete(MemoryCategory.FAILED, root)
+
+
+# ── Scan results ───────────────────────────────────────────────────────────────
+
+
+def get_scan_results(root: Path | None = None) -> dict:
+    return _read(MemoryCategory.SCANS, _root(root))
+
+
+def save_scan_result(scanner_name: str, result: dict, root: Path | None = None) -> None:
+    def _mutate(scans: dict) -> dict:
+        scans[scanner_name] = {**result, "timestamp": _now()}
+        return scans
+
+    _update(MemoryCategory.SCANS, _mutate, root)
+
+
+# ── Scan history ──────────────────────────────────────────────────────────────
+SCAN_HISTORY_FILE = ".patchi/scan_history.json"
+SCAN_HISTORY_MAX = 50  # keep last 50 scans
+
+
+def get_scan_history(root: Path | None = None) -> list[dict]:
+    """Return the list of past scan summaries, newest first."""
+    r = _root(root)
+    path = r / SCAN_HISTORY_FILE
+    if not path.exists():
+        return []
+    try:
+        with path.open("r", encoding="utf-8") as f:
+            data = json.load(f)
+        return data if isinstance(data, list) else []
+    except Exception:
+        return []
+
+
+def record_scan(summary: dict, root: Path | None = None) -> None:
+    """Append a scan summary to history. Keeps only the last SCAN_HISTORY_MAX entries."""
+    r = _root(root)
+    path = r / SCAN_HISTORY_FILE
+    with _WRITE_LOCK:
+        r.mkdir(parents=True, exist_ok=True)
+        history = []
+        if path.exists():
+            try:
+                with path.open("r", encoding="utf-8") as f:
+                    history = json.load(f)
+            except Exception:
+                history = []
+        if not isinstance(history, list):
+            history = []
+        history.insert(0, summary)
+        history = history[:SCAN_HISTORY_MAX]
+        tmp = path.with_suffix(".tmp")
+        with tmp.open("w", encoding="utf-8") as f:
+            json.dump(history, f, indent=2, default=str)
+        atomic_replace(tmp, path)
+
+
+# ── Known issues ───────────────────────────────────────────────────────────────
+
+
+def list_issues(root: Path | None = None) -> list[dict]:
+    return _read(MemoryCategory.ISSUES, _root(root))
+
+
+def save_issue(issue: dict, root: Path | None = None) -> None:
+    r = _root(root)
+    issues = _read(MemoryCategory.ISSUES, r)
+    issue.setdefault("id", str(uuid.uuid4())[:8])
+    issue.setdefault("timestamp", _now())
+    issues.append(issue)
+    _write(MemoryCategory.ISSUES, issues, r)
+
+
+def resolve_issue(issue_id: str, root: Path | None = None) -> bool:
+    r = _root(root)
+    issues = _read(MemoryCategory.ISSUES, r)
+    before = len(issues)
+    issues = [i for i in issues if i.get("id") != issue_id]
+    _write(MemoryCategory.ISSUES, issues, r)
+    return len(issues) < before
+
+
+def delete_issues(root: Path | None = None) -> None:
+    delete(MemoryCategory.ISSUES, root)
+
+
+# ── Dev tokens (names only, not values) ───────────────────────────────────────
+
+
+def list_tokens(root: Path | None = None) -> list[dict]:
+    return _read(MemoryCategory.TOKENS, _root(root))
+
+
+def save_token(name: str, env_var: str, root: Path | None = None) -> None:
+    r = _root(root)
+    tokens = _read(MemoryCategory.TOKENS, r)
+    if not any(t["name"] == name for t in tokens):
+        tokens.append({"name": name, "env_var": env_var, "added": _now()})
+        _write(MemoryCategory.TOKENS, tokens, r)
+
+
+def remove_token(name: str, root: Path | None = None) -> bool:
+    r = _root(root)
+    tokens = _read(MemoryCategory.TOKENS, r)
+    before = len(tokens)
+    tokens = [t for t in tokens if t["name"] != name]
+    _write(MemoryCategory.TOKENS, tokens, r)
+    return len(tokens) < before
+
+
+# ── Helpers ────────────────────────────────────────────────────────────────────
+
+
+def _now() -> str:
+    from datetime import datetime
+
+    return datetime.now(UTC).isoformat()
+
+
+def clear_all(root: "Path | None" = None) -> None:
+    """Wipe every memory category. Irreversible."""
+    try:
+        r = root or require_project_root()
+        mem_dir = r / _PATCHI_DIR
+        for f in mem_dir.glob("*.json"):
+            if f.name != "config.json":
+                tmp = f.with_suffix(".tmp")
+                with tmp.open("w", encoding="utf-8") as fh:
+                    json.dump({}, fh)
+                atomic_replace(tmp, f)
+    except Exception as e:
+        _log.warning("clear_all failed: %s", e)
+
+
+# ── Health score history ───────────────────────────────────────────────────────
+
+_PATCHI_DIR = ".patchi"
+
+
+def log_health_score(score: int, finding_count: int, root: "Path | None" = None) -> None:
+    """Append a health score data point to history.json after every scan."""
+    r = root or require_project_root()
+    path = r / _PATCHI_DIR / "history.json"
+    try:
+        history: list[dict] = json.loads(path.read_text(encoding="utf-8")) if path.exists() else []
+    except Exception as e:
+        _log.warning("log_health_score failed: %s", e)
+        history = []
+
+    history.append(
+        {
+            "ts": int(time.time()),
+            "health_score": score,
+            "finding_count": finding_count,
+            "type": "scan",
+        }
+    )
+    # Keep last 500 entries
+    history = history[-500:]
+    # Atomic write: tmp + rename
+    tmp = path.with_suffix(".tmp")
+    tmp.write_text(json.dumps(history, indent=2), encoding="utf-8")
+    atomic_replace(tmp, path)
+
+
+def get_health_history(root: "Path | None" = None) -> list[dict]:
+    """Return all health score history entries."""
+    r = root or require_project_root()
+    path = r / _PATCHI_DIR / "history.json"
+    try:
+        return json.loads(path.read_text(encoding="utf-8")) if path.exists() else []
+    except Exception as e:
+        _log.warning("get_health_history failed: %s", e)
+        return []
+
+
+# ── Rejection learning ─────────────────────────────────────────────────────────
+
+
+def record_rejection(finding_type: str, root: "Path | None" = None) -> int:
+    """
+    Track how many times the user has rejected a finding type.
+    Returns the new rejection count for that type.
+    """
+    r = root or require_project_root()
+    path = r / _PATCHI_DIR / "rejection_counts.json"
+    try:
+        counts: dict = json.loads(path.read_text(encoding="utf-8")) if path.exists() else {}
+    except Exception as e:
+        _log.warning("record_rejection failed: %s", e)
+        counts = {}
+
+    counts[finding_type] = counts.get(finding_type, 0) + 1
+    # Atomic write: tmp + rename
+    tmp = path.with_suffix(".tmp")
+    tmp.write_text(json.dumps(counts, indent=2), encoding="utf-8")
+    atomic_replace(tmp, path)
+    return counts[finding_type]
+
+
+def get_rejection_counts(root: "Path | None" = None) -> dict[str, int]:
+    """Return all rejection counts by finding type."""
+    r = root or require_project_root()
+    path = r / _PATCHI_DIR / "rejection_counts.json"
+    try:
+        return json.loads(path.read_text(encoding="utf-8")) if path.exists() else {}
+    except Exception as e:
+        _log.warning("get_rejection_counts failed: %s", e)
+        return {}

patchi/core/notifications/__init__.py

@@ -0,0 +1,18 @@
+"""Patchi notification system — public API."""
+
+from patchi.core.notifications.channels import ChannelConfig, ChannelType, load_channels
+from patchi.core.notifications.digest import DigestQueue
+from patchi.core.notifications.escalation import EscalationTracker
+from patchi.core.notifications.notifier import Notifier
+from patchi.core.notifications.quiet_hours import is_quiet_now, should_suppress
+
+__all__ = [
+    "Notifier",
+    "ChannelConfig",
+    "ChannelType",
+    "load_channels",
+    "DigestQueue",
+    "EscalationTracker",
+    "should_suppress",
+    "is_quiet_now",
+]