patchi 0.7.5__py3-none-any.whl

patchi/cli/commands/watch_cmd.py

@@ -0,0 +1,304 @@
+"""
+`p watch` — Watch mode. Auto-scans on file saves.
+
+Usage:
+  p watch               — watch entire project
+  p watch src/auth      — watch specific area only
+  p watch --dry-run     — preview auto-fixes without applying
+  p watch --preview     — show detailed before/after of proposed fixes
+  p watch --auto-fix    — enable proactive fixing on file saves
+
+Runs until Ctrl+C. Every time a source file is saved, Patchi
+re-scans the changed area and updates the brain.
+"""
+
+from __future__ import annotations
+
+import logging
+import signal
+import time
+from pathlib import Path
+
+from patchi.cli.console import con
+from patchi.core.brain.freshness import BrainWatcher
+from patchi.core.config import require_project_root
+
+_log = logging.getLogger("patchi.cli.watch_cmd")
+
+
+def _show_preview(root: Path, fixes: list, applied: list) -> None:
+    """Show detailed before/after preview of proposed fixes."""
+
+    con.print()
+    con.print("[bold]Proposed Fixes — Preview[/bold]")
+    con.print("[dim]Showing what would change (not yet applied).[/dim]")
+    con.print()
+
+    for i, fix in enumerate(fixes, 1):
+        # Determine status
+        was_applied = fix in applied
+        status_color = "#22c55e" if was_applied else "#eab308"
+        status_text = "APPLIED" if was_applied else "PROPOSED"
+
+        con.print(f"  [bold]{i}. {fix.fix_type}[/bold] → {fix.file}")
+        if fix.name:
+            con.print(f"     [dim]Target: {fix.name}[/dim]")
+        con.print(f"     [{status_color}]{status_text}[/{status_color}]  [dim]{fix.description}[/dim]")
+
+        # Show before/after if the file exists and the fix has a suggested line
+        file_path = root / fix.file
+        if file_path.exists() and fix.suggested_line:
+            try:
+                lines = file_path.read_text(encoding="utf-8").splitlines()
+                line_num = fix.suggested_line
+                if 1 <= line_num <= len(lines):
+                    # Show context (2 lines before and after)
+                    start = max(0, line_num - 3)
+                    end = min(len(lines), line_num + 2)
+
+                    con.print(f"     [dim]Before (line {line_num}):[/dim]")
+                    for j in range(start, end):
+                        prefix = ">>>" if j == line_num - 1 else "   "
+                        con.print(f"       {prefix} {j+1:4d} │ {lines[j]}")
+
+                    con.print("     [green]After:[/green]")
+                    con.print(f"       >>> {line_num:4d} │ {fix.suggested_line}")
+            except Exception as _exc:
+                _log.warning('_show_preview failed: %s', _exc)
+
+        con.print()
+
+    # Summary
+    con.print(f"  [dim]Total: {len(fixes)} fixes ({len(applied)} applied, {len(fixes) - len(applied)} proposed)[/dim]")
+    con.print("  [dim]Run with --dry-run to preview without applying, or --auto-fix to enable auto-apply.[/dim]")
+    con.print()
+
+
+def run(
+    area: str | None = None,
+    root: Path | None = None,
+    dry_run: bool = False,
+    preview: bool = False,
+    auto_fix: bool = False,
+) -> None:
+    """Entry point for `p watch [area]`.
+
+    Args:
+        area: Optional subpath to watch.
+        root: Override project root.
+        dry_run: If True, preview auto-fixes without applying them.
+        preview: If True, show detailed before/after of proposed fixes.
+        auto_fix: If True, enable proactive fixing on file saves (overrides config).
+    """
+    try:
+        r = root or require_project_root()
+    except RuntimeError as e:
+        con.print(f"[red]{e}[/red]")
+        return
+
+    area_label = f" [dim]→ {area}[/dim]" if area else " [dim](full project)[/dim]"
+    flags = []
+    if dry_run:
+        flags.append("dry-run")
+    if preview:
+        flags.append("preview")
+    if auto_fix:
+        flags.append("auto-fix")
+    flag_label = f" [yellow]({', '.join(flags)})[/yellow]" if flags else ""
+    con.print()
+    con.print(f"[bold #C8621A]Watch mode{area_label}{flag_label}[/bold #C8621A]")
+    con.print("[dim]Patchi is watching for file changes. Press Ctrl+C to stop.[/dim]")
+    con.print()
+
+    _running = [True]
+    _scan_count = [0]
+
+    def on_change(changed_paths: list[str]) -> None:
+        _scan_count[0] += 1
+        n = len(changed_paths)
+        short = changed_paths[0] if changed_paths else "?"
+        label = f"{short}" if n == 1 else f"{short} +{n - 1} more"
+
+        # Respect quiet hours — skip auto-scan during quiet window (WIRE-05)
+        try:
+            from patchi.core import config as cfg_mod
+            from patchi.core.notifications.quiet_hours import is_quiet_now
+
+            conf = cfg_mod.load(r)
+            qh = conf.get("quiet_hours", {})
+            if is_quiet_now(qh):
+                con.print(f"[dim]Quiet hours active — skipping auto-scan for {label}[/dim]")
+                return
+        except Exception as e:
+            _log.warning("on_change failed: %s", e)
+
+        con.print(f"[#C8621A]↺[/#C8621A] [dim]{label} changed — rescanning…[/dim]")
+
+        # Determine minimal area to rescan
+        rescan_area = area
+        if not rescan_area and changed_paths:
+            # Use the parent directory of the first changed file as the target
+            parent = str(Path(changed_paths[0]).parent)
+            if parent and parent != ".":
+                rescan_area = parent
+
+        try:
+            from patchi.cli.commands.scan_cmd import run as run_scan
+
+            run_scan(area=rescan_area, quiet=True, root=r)
+            con.print("[#4ADE80]✓[/#4ADE80] [dim]Brain updated.[/dim]")
+        except Exception as e:
+            con.print(f"[yellow]⚠[/yellow] [dim]Rescan failed: {e}[/dim]")
+
+        # ── Phase 4b: Proactive fixes on save (behind config flag) ─────────
+        try:
+            from patchi.core import config as cfg_mod
+            from patchi.core.brain.proactive import (
+                escalate_to_governor,
+                run_proactive,
+            )
+            from patchi.core.security.tool_verify import high_findings_on_file
+
+            conf = cfg_mod.load(r)
+            auto_fix_cfg = conf.get("auto_fix", {}) or {}
+            # --auto-fix flag overrides config.auto_fix.enabled
+            af_enabled = auto_fix or bool(auto_fix_cfg.get("enabled", False))
+            af_unsafe = bool(auto_fix_cfg.get("unsafe", False))
+            verify_sast = bool(auto_fix_cfg.get("verify_sast", False))
+
+            norm = []
+            for p in changed_paths:
+                pp = Path(p)
+                try:
+                    norm.append(pp.relative_to(r).as_posix())
+                except ValueError:
+                    norm.append(pp.as_posix())
+            if not norm:
+                norm = changed_paths
+
+            # Snapshot existing HIGH/CRITICAL findings BEFORE applying fixes so
+            # we only flag regressions the fix actually introduced (not
+            # pre-existing ones on every save).
+            pre_highs: dict[str, set] = {}
+            if af_enabled and not dry_run and verify_sast:
+                for cf in norm:
+                    cp = Path(r) / cf
+                    if cp.exists() and cp.suffix == ".py":
+                        try:
+                            pre_highs[cf] = {
+                                (h.type, h.cwe) for h in high_findings_on_file(cp)
+                            }
+                        except Exception as e:
+                            _log.warning("SAST pre-snapshot failed for %s: %s", cf, e)
+                            pre_highs[cf] = set()
+
+            # Apply only if auto_fix enabled AND not in dry-run mode
+            should_apply = af_enabled and not dry_run
+            result = run_proactive(r, norm, apply=should_apply, unsafe=af_unsafe)
+
+            if result["fixes"]:
+                mode = "preview" if (dry_run or preview) else "apply"
+                con.print(
+                    f"[dim]Proactive ({mode}): {len(result['fixes'])} fix(es) proposed "
+                    f"({len(result['applied'])} applied, "
+                    f"{len(result['escalated'])} need review).[/dim]"
+                )
+
+                # --preview: show detailed before/after for each proposed fix
+                if preview and result["fixes"]:
+                    _show_preview(r, result["fixes"], result["applied"])
+
+            for fix in result["escalated"]:
+                escalate_to_governor(r, fix)
+                con.print(
+                    f"[#FACC15]⚠[/#FACC15] [yellow]Escalated to Governor:[/yellow] "
+                    f"{fix.fix_type} → {fix.file}" + (f" ({fix.name})" if fix.name else "")
+                )
+                con.print(f"  [dim]{fix.description}[/dim]")
+
+            # ── Phase 4b: verify applied fixes did not introduce a HIGH/CRITICAL SAST finding ──
+            # Opt-in (default off): Semgrep is slow per-file, so this is gated behind
+            # auto_fix.verify_sast to keep watch-mode latency acceptable. Only NEW highs
+            # (absent before the fix) are flagged, avoiding re-reporting pre-existing ones.
+            if should_apply and verify_sast:
+                try:
+                    from patchi.core import memory as mem
+                    from patchi.core.security.tool_verify import verify_proactive_fixes
+
+                    issues = verify_proactive_fixes(
+                        r,
+                        [fx.file for fx in result.get("applied", [])],
+                        pre_highs,
+                    )
+                    for iss in issues:
+                        mem.save_issue(iss)
+                        con.print(
+                            f"[red]⚠ SAST regression after proactive fix:[/red] "
+                            f"{iss['file']}:{iss.get('line', 0)} [{iss['name']}]"
+                        )
+                except Exception as e:
+                    con.print(f"[dim]SAST verify skipped: {e}[/dim]")
+        except Exception as e:
+            con.print(f"[dim]Proactive check skipped: {e}[/dim]")
+
+        # ── Phase 4b: change-impact (blast radius) on save ────────────────
+        try:
+            from patchi.cli.commands.reason_cmd import run_impact
+
+            if norm:
+                run_impact(norm, root=r)
+        except Exception as e:
+            con.print(f"[dim]Impact analysis skipped: {e}[/dim]")
+
+        # ── Phase 4b: secrets sweep on changed files only ─────────────────
+        try:
+            from patchi.core import memory as mem
+            from patchi.core.brain.secrets import scan_secrets
+
+            hits = scan_secrets(r, paths=norm) if norm else []
+            for h in hits:
+                mem.save_issue(
+                    {
+                        "source": "secrets",
+                        "fix_type": "secret_leak",
+                        "file": h.path,
+                        "name": h.rule,
+                        "description": f"Possible secret ({h.rule}) at line {h.line}: {h.snippet}",
+                        "severity": "high",
+                    }
+                )
+                con.print(
+                    f"[#FACC15]🔒[/#FACC15] [yellow]Secret detected:[/yellow] "
+                    f"{h.path}:{h.line} [{h.rule}]"
+                )
+                con.print(f"  [dim]{h.snippet}[/dim]")
+            if hits:
+                con.print(f"[dim]Escalated {len(hits)} secret hit(s) to Governor for review.[/dim]")
+        except Exception as e:
+            con.print(f"[dim]Secrets check skipped: {e}[/dim]")
+
+        con.print()
+
+    def handle_stop(sig, frame) -> None:
+        _running[0] = False
+        con.print()
+        con.print(f"[dim]Watch stopped. {_scan_count[0]} rescan(s) triggered this session.[/dim]")
+        con.print()
+
+    signal.signal(signal.SIGINT, handle_stop)
+    signal.signal(signal.SIGTERM, handle_stop)
+
+    try:
+        watcher = BrainWatcher(root=r, on_change=on_change, area=area, debounce_ms=600)
+        watcher.start()
+
+        # Keep main thread alive
+        while _running[0]:
+            time.sleep(0.2)
+
+        watcher.stop()
+
+    except RuntimeError as e:
+        con.print(f"[red]{e}[/red]")
+    except Exception as e:
+        con.print(f"[red]Watch error: {e}[/red]")

patchi/cli/commands/web_cmd.py

@@ -0,0 +1,114 @@
+"""
+`p web` command — launch the unified Patchi web UI.
+
+One server, one UI:
+  - Mission Control dashboard (/)          — health, live agent feed, tools
+  - Brain map / Council / Attacks / Tests  — intelligence views
+  - Findings / Review / Chat               — workflow pages
+  - Hosted control plane   (/hosted)       — overview, compliance, webhooks
+
+Usage:
+    p web                 # serve on 127.0.0.1:1612
+    p web --port 8000     # custom port
+    p web --open          # also open the browser
+
+Requires the `web` extra:  pip install patchi[web]
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from rich.console import Console
+
+console = Console()
+
+DEFAULT_HOST = "127.0.0.1"
+DEFAULT_PORT = 1612
+
+
+def _resolve_project(explicit: str | None) -> Path:
+    """Pick the project to serve — EXACTLY like every other p <command>.
+
+    1:1 rule: the web UI opens the project the terminal is standing in.
+    Resolution is the same find_project_root() walk-up every other command
+    uses (nearest .patchi at or above cwd). The only extra is an explicit
+    --project override. Anything else refuses, same message, same exit.
+
+    The multi-project story lives IN the web UI (header switcher), not in
+    magic cwd guessing here.
+    """
+    from patchi.core.config import find_project_root
+
+    if explicit:
+        p = Path(explicit).expanduser().resolve()
+        if not (p / ".patchi").is_dir():
+            console.print(
+                f"[red]{p} has no .patchi directory.[/red] Run [bold]p init[/bold] there first."
+            )
+            raise SystemExit(1)
+        return p
+
+    found = find_project_root()
+    if found:
+        if found.resolve() == Path.home().resolve():
+            console.print(
+                "[yellow]Note:[/yellow] resolved to your HOME directory "
+                f"({found}) because it contains a .patchi folder. "
+                "If that's not intentional, cd into your real project or use "
+                "[bold]--project <path>[/bold]."
+            )
+        return found
+
+    # Same contract as require_project_root(); candidates listed as FYI only
+    from patchi.core.tenant import TenantManager
+
+    console.print(
+        "[red]No .patchi directory found.[/red] Run [bold]p init[/bold] in your project folder first."
+    )
+    nearby = TenantManager().discover_projects(near=Path.cwd())
+    if nearby:
+        console.print("[dim]Patchi projects near here:[/dim]")
+        for c in nearby[:5]:
+            console.print(f'[dim]  - {c}  ->  p web --project "{c}"[/dim]')
+        if len(nearby) > 5:
+            console.print(f"[dim]  … and {len(nearby) - 5} more[/dim]")
+    raise SystemExit(1)
+
+
+def run(
+    root: Path | None = None,
+    host: str = DEFAULT_HOST,
+    port: int = DEFAULT_PORT,
+    open_browser: bool = False,
+    project: str | None = None,
+) -> None:
+    """Start the unified Patchi web server (blocking)."""
+    try:
+        import uvicorn  # noqa: F401
+    except ImportError as e:
+        console.print(
+            "[red]Missing dependencies.[/red] Install with: [bold]pip install patchi[web][/bold]"
+        )
+        raise SystemExit(1) from e
+
+    project_root = root or _resolve_project(project)
+
+    url = f"http://{host}:{port}"
+    console.print()
+    console.print(f"[bold #C8621A]Patchi Web UI[/bold #C8621A] -> [link={url}]{url}[/link]")
+    console.print("[dim]Mission Control · Council · Red Team · Live Tests · Hosted[/dim]")
+    console.print("[dim]Press Ctrl+C to stop.[/dim]")
+    console.print()
+
+    from patchi.web.app import create_app
+
+    app = create_app(project_root)
+
+    if open_browser:
+        import threading
+        import webbrowser
+
+        threading.Timer(1.5, webbrowser.open, args=(url,)).start()
+
+    uvicorn.run(app, host=host, port=port, log_level="warning")

patchi/cli/console.py

@@ -0,0 +1,101 @@
+"""
+Shared Console factory — ensures consistent encoding handling across all commands.
+
+Usage:
+    from patchi.cli.console import con
+    con.print("...")
+
+    # Once, early in dispatch (main.py), after CLI flags are parsed:
+    from patchi.cli.console import configure_theme
+    configure_theme(explicit=getattr(args, "theme", None),
+                     no_color_flag=getattr(args, "no_color", False),
+                     json_mode=getattr(args, "json_output", False))
+"""
+from __future__ import annotations
+
+import logging
+import os
+import sys
+
+from rich.console import Console
+
+_encoding_fixed = False
+
+
+_log = logging.getLogger("patchi.cli.console")
+
+
+def _ensure_utf8():
+    global _encoding_fixed
+    if _encoding_fixed:
+        return
+    _encoding_fixed = True
+    try:
+        if sys.stdout.encoding and sys.stdout.encoding.lower() != "utf-8":
+            sys.stdout.reconfigure(encoding="utf-8", errors="replace")
+    except Exception as e:
+        _log.warning("_ensure_utf8 failed: %s", e)
+
+
+_ensure_utf8()
+con = Console(highlight=False)
+
+# Active symbol set for the current palette (style.py reads this). Starts as
+# the dark palette's symbols so con.print(...) with semantic tokens works
+# correctly even if configure_theme() is never called (e.g. tests, scripts
+# that import con directly without going through main.py's dispatch).
+_active_symbols: dict[str, str] = {}
+
+
+def configure_theme(
+    explicit: str | None = None,
+    no_color_flag: bool = False,
+    json_mode: bool = False,
+    root=None,
+) -> str:
+    """
+    Resolve the effective palette (see themes.resolve_palette_name for the
+    exact precedence) and apply it to the shared `con`. Returns the palette
+    name actually applied, mainly so callers/tests can assert on it.
+
+    Safe to call multiple times (e.g. once per command invocation) --
+    push_theme() replaces the active theme rather than stacking indefinitely
+    in practice, since this is only ever called once per process at
+    dispatch time, not nested.
+    """
+    from patchi.cli.themes import PALETTES, resolve_palette_name
+
+    config_theme = None
+    try:
+        from patchi.core import config as cfg
+
+        config_theme = cfg.get("theme", root)
+    except Exception as e:
+        _log.debug("configure_theme: could not read config theme, using default: %s", e)
+
+    no_color_env = no_color_flag or bool(os.environ.get("NO_COLOR"))
+    is_tty = con.is_terminal
+
+    name = resolve_palette_name(
+        explicit=explicit,
+        config_theme=config_theme,
+        no_color_env=no_color_env,
+        is_tty=is_tty,
+        json_mode=json_mode,
+    )
+    palette = PALETTES[name]
+    con.push_theme(palette["theme"])
+    con.no_color = name == "mono"
+    _active_symbols.clear()
+    _active_symbols.update(palette["symbols"])
+    return name
+
+
+def symbol(key: str) -> str:
+    """Get the current palette's symbol for 'ok'/'warn'/'err', defaulting to
+    the dark palette's Unicode glyphs if configure_theme() was never called."""
+    if not _active_symbols:
+        from patchi.cli.themes import PALETTES
+
+        return PALETTES["dark"]["symbols"].get(key, "")
+    return _active_symbols.get(key, "")

patchi/cli/display/__init__.py

@@ -0,0 +1 @@
+