patchi 0.7.5__py3-none-any.whl

patchi/web/api/dev_check.py

@@ -0,0 +1,320 @@
+"""
+Dev Check API — run p dev check gates from the web UI.
+
+Runs the three gates (ruff lint, pytest, security scan) and returns
+structured results for display in the Command Center card.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import logging
+import os
+import time
+from pathlib import Path
+
+from fastapi import APIRouter, Request
+from fastapi.responses import JSONResponse
+from starlette.templating import Jinja2Templates
+
+_log = logging.getLogger("patchi.web.api.dev_check")
+
+
+router = APIRouter(prefix="/api")
+
+templates = Jinja2Templates(directory=str(Path(__file__).parent.parent / "templates"))
+
+
+@router.post("/dev-check")
+async def run_dev_check(request: Request, strict: bool = False, fast: bool = False) -> JSONResponse:
+    """Run p dev check gates and return results.
+
+    Gates:
+    1. Ruff lint (fast)
+    2. Pytest (may timeout on slow tests)
+    3. Security scan (changed files)
+    """
+    root = request.app.state.root
+
+    results = {"gates": [], "overall": "PASS", "strict": strict}
+    overall_pass = True
+
+    # Gate 1: Ruff
+    gate1 = await _run_gate(
+        "Ruff Lint",
+        ["python", "-m", "ruff", "check", "patchi/",
+         "--select", "E,F,W", "--ignore", "E501,E402,E741", "--quiet"],
+        root,
+        timeout=30,
+    )
+    results["gates"].append(gate1)
+    if gate1["status"] != "PASS":
+        overall_pass = False
+
+    # Gate 2: Pytest — stable test files only
+    _STABLE = [
+        "tests/test_config.py", "tests/test_charter.py", "tests/test_contract.py",
+        "tests/test_base.py", "tests/test_memory.py",
+        "tests/test_web.py", "tests/test_assurance.py",
+        "tests/test_risk_gate.py", "tests/test_scanner.py", "tests/test_detector.py",
+        "tests/test_secrets.py", "tests/test_security_config.py",
+        "tests/test_sigma_engine.py", "tests/test_blast_radius_v2.py",
+        "tests/test_chain_engine.py",
+        "tests/test_language_support.py", "tests/test_ast_utils.py",
+        "tests/test_import_graph.py",
+        "tests/test_hosted_mode.py", "tests/test_hosted_tokens.py",
+        "tests/test_hosted_audit_log.py", "tests/test_hosted_ip_reputation.py",
+        "tests/test_hosted_log_parsers.py", "tests/test_hosted_watchlist.py",
+        "tests/test_hosted_anomaly.py",
+        "tests/test_new_agents.py", "tests/test_p3_agents.py",
+        "tests/test_v2_agent_audit.py", "tests/test_v2_smoke.py",
+        "tests/test_attack_agent.py", "tests/test_doc_claim_agent.py",
+        "tests/test_fix_agents.py", "tests/test_scanners.py",
+        "tests/test_smart_agent.py",
+        "tests/test_governor_v2.py", "tests/test_governor_integration.py",
+        "tests/test_layered_brain.py", "tests/test_brain_watcher.py",
+        "tests/test_rebuilt_modules.py",
+        "tests/test_reasoning.py", "tests/test_noise_reduction.py",
+        "tests/test_ignore_learner.py", "tests/test_corpus_noise.py",
+        "tests/test_ai_client.py", "tests/test_debug_capture.py",
+        "tests/test_debug_codelldb.py", "tests/test_debug_node.py",
+        "tests/test_debug_powershell.py",
+        "tests/test_freshness.py", "tests/test_patch.py",
+        "tests/test_proactive.py", "tests/test_proactive_phase5.py",
+        "tests/test_snapshot.py", "tests/test_verify.py",
+        "tests/test_verify_loop.py", "tests/test_generated_suite.py",
+        "tests/test_app_profile.py", "tests/test_audit.py",
+        "tests/test_framework.py",
+        "tests/test_new_features.py", "tests/test_route_mapper.py",
+        "tests/test_applier.py", "tests/test_dispatcher.py",
+        "tests/test_notifications.py", "tests/test_queue.py",
+        "tests/test_scheduler.py", "tests/test_domain_loader.py",
+    ]
+    _CORE = [
+        "tests/test_config.py", "tests/test_charter.py", "tests/test_contract.py",
+        "tests/test_base.py", "tests/test_memory.py", "tests/test_web.py",
+        "tests/test_risk_gate.py", "tests/test_scanner.py", "tests/test_detector.py",
+        "tests/test_secrets.py", "tests/test_language_support.py", "tests/test_ast_utils.py",
+        "tests/test_import_graph.py", "tests/test_ai_client.py",
+        "tests/test_freshness.py", "tests/test_framework.py",
+    ]
+    _ptests = _CORE if fast else _STABLE
+    # Use xdist only on 4+ CPU machines
+    _ptargs = ["python", "-m", "pytest"]
+    import os as _os
+    if _os.cpu_count() and _os.cpu_count() >= 4:
+        try:
+            import xdist  # noqa: F401
+            _ptargs += ["-n", "auto", "--dist", "loadscope"]
+        except ImportError:
+            pass
+    gate2 = await _run_gate(
+        "Pytest", _ptargs + _ptests + [
+         "-q", "--tb=no"],
+         root,
+         timeout=360,
+    )
+    results["gates"].append(gate2)
+    if gate2["status"] != "PASS":
+        overall_pass = False
+
+    # Gate 3: Security Scan (changed files)
+    gate3 = await _run_gate(
+        "Security Scan",
+        ["python", "-m", "patchi.cli.main", "scan",
+         "--changed", "--quiet", "--json"],
+        root,
+        timeout=60,
+    )
+    results["gates"].append(gate3)
+    if gate3["status"] != "PASS":
+        overall_pass = False
+
+    results["overall"] = "PASS" if overall_pass else "FAIL"
+    results["timestamp"] = time.time()
+    results["strict"] = strict
+    results["fast"] = fast
+
+    # Record history for the timing chart
+    _record_history(root, results)
+
+    return JSONResponse(results)
+
+
+async def _run_gate(
+    name: str,
+    cmd: list[str],
+    cwd: Path,
+    timeout: int = 60,
+) -> dict:
+    """Run a single gate and return structured result."""
+    start = time.time()
+
+    try:
+        # Use temp files to avoid pipe deadlock on Windows when
+        # pytest subprocess tests keep pipe handles open.
+        import tempfile
+        tmp_out = tempfile.NamedTemporaryFile(mode='wb', suffix='.out', delete=False)
+        tmp_err = tempfile.NamedTemporaryFile(mode='wb', suffix='.err', delete=False)
+        try:
+            proc = await asyncio.create_subprocess_exec(
+                *cmd,
+                cwd=str(cwd),
+                stdout=tmp_out,
+                stderr=tmp_err,
+            )
+            await asyncio.wait_for(proc.wait(), timeout=timeout)
+        finally:
+            tmp_out.close()
+            tmp_err.close()
+        elapsed = time.time() - start
+        try:
+            output = open(tmp_out.name, 'rb').read().decode('utf-8', errors='replace') + open(tmp_err.name, 'rb').read().decode('utf-8', errors='replace')
+        except Exception:
+            output = ''
+        # Cleanup
+        try:
+            os.unlink(tmp_out.name)
+            os.unlink(tmp_err.name)
+        except Exception as _exc:
+            _log.warning('_run_gate failed: %s', _exc)
+
+        # Parse output for specific gate info
+        parsed = _parse_gate_output(name, output)
+
+        return {
+            "name": name,
+            "status": "PASS" if proc.returncode == 0 else "FAIL",
+            "exit_code": proc.returncode,
+            "elapsed": round(elapsed, 1),
+            "output": output[:2000],  # Truncate long output
+            "parsed": parsed,
+        }
+
+    except TimeoutError:
+        return {
+            "name": name,
+            "status": "TIMEOUT",
+            "exit_code": -1,
+            "elapsed": timeout,
+            "output": f"Gate timed out after {timeout}s",
+            "parsed": {},
+        }
+    except Exception as e:
+        return {
+            "name": name,
+            "status": "ERROR",
+            "exit_code": -1,
+            "elapsed": time.time() - start,
+            "output": str(e),
+            "parsed": {},
+        }
+
+
+def _record_history(root: Path, results: dict) -> None:
+    """Append gate timing data to history file for the chart."""
+    try:
+        import json as _json
+
+        history_path = root / ".patchi" / "dev_check_history.json"
+        history_path.parent.mkdir(parents=True, exist_ok=True)
+
+        history: list[dict] = []
+        if history_path.is_file():
+            try:
+                history = _json.loads(history_path.read_text(encoding="utf-8"))
+            except Exception:
+                history = []
+
+        entry = {
+            "timestamp": results.get("timestamp", time.time()),
+            "overall": results.get("overall", "?"),
+            "fast": results.get("fast", False),
+            "gates": [],
+        }
+        for g in results.get("gates", []):
+            entry["gates"].append({
+                "name": g.get("name", "?"),
+                "status": g.get("status", "?"),
+                "elapsed": g.get("elapsed", 0),
+            })
+        entry["total_time"] = sum(g["elapsed"] for g in entry["gates"])
+
+        history.append(entry)
+
+        # Keep last 50 runs
+        if len(history) > 50:
+            history = history[-50:]
+
+        tmp = history_path.with_suffix(".json.tmp")
+        tmp.write_text(_json.dumps(history, indent=2), encoding="utf-8")
+        tmp.replace(history_path)
+    except Exception as _exc:
+        _log.debug("dev_check history write skipped: %s", _exc)
+
+
+@router.get("/dev-check/history")
+async def dev_check_history(request: Request) -> JSONResponse:
+    """Return gate execution history for the timing chart."""
+    root = request.app.state.root
+    import json as _json
+
+    history_path = root / ".patchi" / "dev_check_history.json"
+    history: list[dict] = []
+    if history_path.is_file():
+        try:
+            history = _json.loads(history_path.read_text(encoding="utf-8"))
+        except Exception:
+            history = []
+
+    # Keep last 20 for the chart
+    recent = history[-20:]
+    return JSONResponse({"ok": True, "runs": recent, "count": len(recent)})
+
+
+def _parse_gate_output(gate_name: str, output: str) -> dict:
+    """Parse gate output for specific metrics."""
+    parsed = {}
+
+    if gate_name == "Ruff Lint":
+        # Count errors
+        error_lines = [line for line in output.splitlines() if line.startswith("Found ")]
+        if error_lines:
+            parts = error_lines[0].split()
+            if len(parts) >= 2:
+                parsed["error_count"] = int(parts[1])
+
+        # Count by code
+        codes = {}
+        for line in output.splitlines():
+            if " E" in line or " F" in line or " W" in line:
+                parts = line.split()
+                for p in parts:
+                    if len(p) == 4 and p[0] in "EFW":
+                        codes[p] = codes.get(p, 0) + 1
+        parsed["by_code"] = codes
+
+    elif gate_name == "Pytest":
+        # Parse pytest summary
+        for line in output.splitlines():
+            if "passed" in line or "failed" in line:
+                parsed["summary"] = line.strip()
+            if "error" in line.lower() and "test" in line.lower():
+                parsed["collection_error"] = line.strip()
+
+    elif gate_name == "Security Scan":
+        # Try to parse JSON output
+        try:
+            # Find JSON in output (may have other text before/after)
+            for line in output.splitlines():
+                line = line.strip()
+                if line.startswith("{"):
+                    data = json.loads(line)
+                    parsed["findings"] = data.get("total_findings", 0)
+                    parsed["domains"] = data.get("domains", [])
+                    break
+        except (json.JSONDecodeError, AttributeError):
+            parsed["parse_error"] = "Could not parse JSON output"
+
+    return parsed

patchi/web/api/fix.py

@@ -0,0 +1,134 @@
+"""Fix API — apply/reject patches."""
+
+from __future__ import annotations
+
+from fastapi import APIRouter, Request
+from fastapi.responses import JSONResponse
+
+from patchi.core.tenant import tenant_context
+
+router = APIRouter(prefix="/api/fix")
+
+
+@router.post("/apply/{patch_id}")
+async def apply_patch(patch_id: str, request: Request) -> JSONResponse:
+    root = request.app.state.root
+    # IDOR fix: use context manager for tenant isolation and verify patch ownership
+    with tenant_context(root):
+        from patchi.core import memory as mem
+
+        patches = mem.read("patches", root)
+        patch = next((p for p in patches if p.get("id") == patch_id), None)
+
+        if not patch:
+            return JSONResponse({"ok": False, "error": "Patch not found"}, status_code=404)
+
+        # Verify patch belongs to this tenant/project (prevent IDOR enumeration)
+        patch_project = patch.get("project") or patch.get("tenant") or ""
+        if patch_project and patch_project != str(root) and patch_project not in str(root):
+            return JSONResponse({"ok": False, "error": "Patch not found"}, status_code=404)
+
+        from patchi.core.fix.applier import PatchApplier
+        from patchi.core.fix.patch import Patch
+
+        try:
+            p = Patch.from_dict(patch)
+            applier = PatchApplier(root)
+            applier.apply(p)
+            return JSONResponse({"ok": True, "message": f"Applied patch {patch_id}"})
+        except Exception as e:
+            return JSONResponse({"ok": False, "error": str(e)}, status_code=500)
+
+    # Fallback (unreachable due to with)
+    return JSONResponse({"ok": False, "error": "Tenant error"}, status_code=500)
+
+
+@router.post("/reject/{patch_id}")
+async def reject_patch(patch_id: str, request: Request) -> JSONResponse:
+    root = request.app.state.root
+    with tenant_context(root):
+        from patchi.core import memory as mem
+
+        try:
+            mem.record_rejection(patch_id, "web_user", root)
+            return JSONResponse({"ok": True, "message": f"Rejected patch {patch_id}"})
+        except Exception as e:
+            return JSONResponse({"ok": False, "error": str(e)}, status_code=500)
+
+
+@router.post("/apply-all-safe")
+async def apply_all_safe(request: Request) -> JSONResponse:
+    """Apply every pending patch that passes the risk gate for auto-apply.
+
+    Patches the gate flags as BLOCK or REQUIRE_REVIEW are skipped and reported,
+    never applied. This backs the "Apply all safe" button in the review UI.
+    """
+    root = request.app.state.root
+    from patchi.core import memory as mem
+    from patchi.core.fix.applier import PatchApplier
+    from patchi.core.fix.patch import Patch
+    from patchi.core.fix.risk_gate import RiskGate
+
+    patches_raw = mem.read("patches", root)
+    if not patches_raw:
+        return JSONResponse(
+            {
+                "ok": True,
+                "applied": [],
+                "skipped": [],
+                "failed": [],
+                "message": "No patches pending",
+            }
+        )
+
+    gate = RiskGate(root)
+    applier = PatchApplier(root)
+
+    applied: list[dict] = []
+    skipped: list[dict] = []
+    failed: list[dict] = []
+
+    for raw in patches_raw:
+        pid = raw.get("id", "?")
+        state = raw.get("state", "")
+        if state in ("applied", "rejected"):
+            continue  # only pending patches
+        try:
+            patch = Patch.from_dict(raw)
+        except Exception as e:
+            failed.append({"id": pid, "reason": f"unparseable: {e}"})
+            continue
+
+        decision = gate.evaluate(patch)
+        if decision.is_blocked() or decision.needs_review():
+            skipped.append(
+                {
+                    "id": pid,
+                    "reason": decision.decision.value
+                    if hasattr(decision.decision, "value")
+                    else str(decision.decision),
+                    "detail": getattr(decision, "reasons", None) or "",
+                }
+            )
+            continue
+
+        try:
+            result = applier.apply(patch)
+            entry = {"id": pid}
+            if result.success:
+                applied.append(entry)
+            else:
+                entry["reason"] = getattr(result, "error", "") or "applier refused"
+                failed.append(entry)
+        except Exception as e:
+            failed.append({"id": pid, "reason": str(e)})
+
+    return JSONResponse(
+        {
+            "ok": True,
+            "applied": applied,
+            "skipped": skipped,
+            "failed": failed,
+            "message": f"{len(applied)} applied, {len(skipped)} need review, {len(failed)} failed",
+        }
+    )

patchi/web/api/guard.py

@@ -0,0 +1,65 @@
+"""Guard API — HTMX fragments for hosted guard monitoring."""
+
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter, Request
+from fastapi.responses import HTMLResponse
+
+logger = logging.getLogger("patchi.web.api.guard")
+
+router = APIRouter(prefix="/api/guard")
+
+
+@router.get("/threats", response_class=HTMLResponse)
+async def get_threats(request: Request) -> str:
+    root = request.app.state.root
+    lines = [
+        "<table style='width:100%;font-size:12px;'>",
+        "<tr><th>IP</th><th>Score</th><th>Reason</th></tr>",
+    ]
+    try:
+        from patchi.core.hosted.watchlist import WatchlistTracker
+
+        tracker = WatchlistTracker(root)
+        for t in tracker.top(10):
+            ip = t.get("ip", "?")
+            score = t.get("score", 0)
+            reason = (t.get("reason", "") or "")[:60]
+            lines.append(
+                f"<tr><td style='font-family:var(--font-mono)'>{ip}</td>"
+                f"<td>{score}</td><td>{reason}</td></tr>"
+            )
+    except Exception:
+        lines.append("<tr><td colspan='3'>No threats</td></tr>")
+    lines.append("</table>")
+    return "".join(lines)
+
+
+@router.get("/live", response_class=HTMLResponse)
+async def get_live(request: Request) -> str:
+    root = request.app.state.root
+    lines: list[str] = []
+    try:
+        import time
+
+        from patchi.core.hosted.audit_log import read_recent
+
+        raw = read_recent(root, 10)
+        for e in reversed(raw):
+            ts = e.get("timestamp", 0)
+            tstr = time.strftime("%H:%M:%S", time.localtime(ts)) if ts else "--:--:--"
+            data = e.get("data", {})
+            msg = data.get("title", data.get("message", e.get("event", "")))
+            lines.append(
+                f"<div style='margin-bottom:3px'>"
+                f"<span style='color:var(--text-dim)'>{tstr}</span> "
+                f"<span>{msg}</span>"
+                f"</div>"
+            )
+    except Exception as e:
+        logger.warning("Failed to load recent audit events: %s", e)
+    if not lines:
+        lines.append("<div style='color:var(--text-dim)'>No recent events</div>")
+    return "".join(lines)

patchi/web/api/hosted.py

@@ -0,0 +1,128 @@
+"""Hosted API — hosted mode actions."""
+
+from __future__ import annotations
+
+from fastapi import APIRouter, Request
+from fastapi.responses import JSONResponse
+
+router = APIRouter(prefix="/api/hosted")
+
+
+@router.get("/status")
+async def hosted_status(request: Request) -> JSONResponse:
+    root = request.app.state.root
+    from patchi.core import config as cfg
+
+    try:
+        config = cfg.load(root)
+    except Exception:
+        config = {}
+
+    hosted = config.get("hosted", {})
+    return JSONResponse(
+        {
+            "enabled": hosted.get("enabled", False),
+            "log_path": hosted.get("log_path", ""),
+        }
+    )
+
+
+@router.post("/init")
+async def hosted_init(request: Request) -> JSONResponse:
+    root = request.app.state.root
+    from patchi.core import config as cfg_mod
+
+    try:
+        body = await request.json()
+        log_path = body.get("log_path", "/var/log/nginx/access.log")
+        log_format = body.get("log_format", "nginx")
+        escalate = body.get("escalate", True)
+
+        cfg_mod.set_value("hosted.log_path", log_path, root)
+        cfg_mod.set_value("hosted.log_format", log_format, root)
+        cfg_mod.set_value("hosted.escalate", escalate, root)
+        cfg_mod.set_value("hosted.enabled", True, root)
+
+        hosted_dir = root / ".patchi" / "hosted"
+        hosted_dir.mkdir(parents=True, exist_ok=True)
+
+        return JSONResponse(
+            {
+                "ok": True,
+                "message": "Hosted mode configured",
+                "log_path": log_path,
+                "log_format": log_format,
+            }
+        )
+    except Exception as e:
+        return JSONResponse({"ok": False, "error": str(e)}, status_code=500)
+
+
+@router.get("/tokens")
+async def list_tokens(request: Request) -> JSONResponse:
+    root = request.app.state.root
+    from patchi.core.hosted import tokens as tokens_mod
+
+    return JSONResponse({"tokens": tokens_mod.list_tokens(root)})
+
+
+@router.post("/tokens")
+async def create_token(request: Request) -> JSONResponse:
+    root = request.app.state.root
+    from patchi.core.hosted import tokens as tokens_mod
+
+    try:
+        body = await request.json()
+        name = body.get("name", "unnamed")
+        plaintext = tokens_mod.generate(root, name)
+        return JSONResponse(
+            {
+                "ok": True,
+                "token": plaintext,
+                "message": "Token generated — shown once",
+            }
+        )
+    except Exception as e:
+        return JSONResponse({"ok": False, "error": str(e)}, status_code=500)
+
+
+@router.delete("/tokens/{token_id}")
+async def revoke_token(token_id: str, request: Request) -> JSONResponse:
+    root = request.app.state.root
+    from patchi.core.tenant import tenant_context
+
+    with tenant_context(root):
+        from patchi.core.hosted import tokens as tokens_mod
+
+        # IDOR fix: verify token exists and belongs to tenant (list scope)
+        existing = {t.get("id") for t in tokens_mod.list_tokens(root)}
+        if token_id not in existing:
+            return JSONResponse({"ok": False, "error": "Token not found"}, status_code=404)
+        ok = tokens_mod.revoke(root, token_id)
+        if ok:
+            return JSONResponse({"ok": True, "message": f"Token {token_id} revoked"})
+        return JSONResponse({"ok": False, "error": "Token not found"}, status_code=404)
+
+
+@router.post("/block/{ip}")
+async def block_ip(ip: str, request: Request) -> JSONResponse:
+    root = request.app.state.root
+    from patchi.core.tenant import tenant_context
+
+    with tenant_context(root):
+        from patchi.core.hosted import ip_reputation
+
+        ip_reputation.block(ip, root)
+        return JSONResponse({"ok": True, "message": f"Blocked {ip}"})
+
+
+@router.post("/unblock/{ip}")
+async def unblock_ip(ip: str, request: Request) -> JSONResponse:
+    root = request.app.state.root
+    from patchi.core.tenant import tenant_context
+
+    with tenant_context(root):
+        from patchi.core.hosted import ip_reputation
+
+        ip_reputation.unblock(ip, root)
+        return JSONResponse({"ok": True, "message": f"Unblocked {ip}"})