pisces-cli 0.1.0__py3-none-any.whl

pisces/llm_client.py

@@ -0,0 +1,263 @@
+"""
+pisces.llm_client
+~~~~~~~~~~~~~~~~~
+Multi-provider LLM client abstraction.
+
+Supported providers:
+    openai     — OpenAI API (GPT-4o, GPT-4o-mini, o1, ...)
+    anthropic  — Anthropic API (Claude 3.5 Haiku/Sonnet, ...)
+    gemini     — Google Gemini API (gemini-2.0-flash, ...)
+    groq       — Groq API (llama-3.3-70b, mixtral, ...) [OpenAI-compatible]
+    ollama     — Local Ollama server [OpenAI-compatible]
+    lmstudio   — Local LM Studio server [OpenAI-compatible]
+
+Security: credentials come from environment only (see config_manager.get_api_key).
+
+Design:
+    - Lazy imports: only import a provider's SDK when it's actually used.
+    - Single unified LLMRequest / LLMResponse model.
+    - Retry with exponential backoff for rate-limit / transient errors.
+    - Timeout enforced on every call.
+"""
+
+from __future__ import annotations
+
+import time
+
+from pisces.config_manager import get_api_key
+from pisces.models import LLMRequest, LLMResponse
+
+# ─────────────────────────────────────────────────────────────
+# Provider base URLs for OpenAI-compatible providers
+# ─────────────────────────────────────────────────────────────
+
+_OPENAI_COMPAT_BASE_URLS: dict[str, str] = {
+    "groq": "https://api.groq.com/openai/v1",
+    "ollama": "http://localhost:11434/v1",
+    "lmstudio": "http://localhost:1234/v1",
+}
+
+# ─────────────────────────────────────────────────────────────
+# Retry settings
+# ─────────────────────────────────────────────────────────────
+
+_MAX_RETRIES = 3
+_RETRY_DELAY_S = 2.0  # seconds, doubled on each retry
+_REQUEST_TIMEOUT = 120  # seconds
+
+
+# ─────────────────────────────────────────────────────────────
+# Dispatch
+# ─────────────────────────────────────────────────────────────
+
+
+def call_llm(
+    request: LLMRequest,
+    provider: str,
+    model: str,
+) -> LLMResponse:
+    """
+    Dispatch an LLM call to the correct provider function.
+
+    Raises:
+        EnvironmentError  — API key not found
+        RuntimeError      — SDK not installed, or all retries exhausted
+    """
+    provider = provider.lower()
+
+    dispatch = {
+        "openai": _call_openai_compat,
+        "groq": _call_openai_compat,
+        "ollama": _call_openai_compat,
+        "lmstudio": _call_openai_compat,
+        "anthropic": _call_anthropic,
+        "gemini": _call_gemini,
+    }
+
+    fn = dispatch.get(provider)
+    if fn is None:
+        raise RuntimeError(f"Unknown provider: '{provider}'")
+
+    return fn(request, provider=provider, model=model)
+
+
+# ─────────────────────────────────────────────────────────────
+# OpenAI-compatible (openai, groq, ollama, lmstudio)
+# ─────────────────────────────────────────────────────────────
+
+
+def _call_openai_compat(
+    request: LLMRequest,
+    provider: str,
+    model: str,
+) -> LLMResponse:
+    try:
+        from openai import APIError, OpenAI, RateLimitError  # lazy import
+    except ImportError:
+        raise RuntimeError("openai SDK not installed. Run: pip install openai")
+
+    api_key = get_api_key(provider) or "ollama"  # ollama/lmstudio don't need a key
+    base_url = _OPENAI_COMPAT_BASE_URLS.get(provider)
+
+    client_kwargs: dict = {
+        "api_key": api_key,
+        "timeout": _REQUEST_TIMEOUT,
+    }
+    if base_url:
+        client_kwargs["base_url"] = base_url
+
+    client = OpenAI(**client_kwargs)
+
+    delay = _RETRY_DELAY_S
+    last_error: Exception | None = None
+
+    for attempt in range(1, _MAX_RETRIES + 1):
+        try:
+            response = client.chat.completions.create(
+                model=model,
+                messages=[
+                    {"role": "system", "content": request.system_prompt},
+                    {"role": "user", "content": request.user_prompt},
+                ],
+                temperature=request.temperature,
+                max_tokens=request.max_tokens,
+            )
+            content = response.choices[0].message.content or ""
+            usage = response.usage
+
+            return LLMResponse(
+                content=content,
+                model=model,
+                provider=provider,
+                input_tokens=usage.prompt_tokens if usage else 0,
+                output_tokens=usage.completion_tokens if usage else 0,
+            )
+
+        except RateLimitError as e:
+            last_error = e
+            if attempt < _MAX_RETRIES:
+                time.sleep(delay)
+                delay *= 2
+            continue
+        except APIError as e:
+            raise RuntimeError(f"[{provider}] API error: {e}") from e
+
+    raise RuntimeError(
+        f"[{provider}] Rate limit hit — all {_MAX_RETRIES} retries exhausted. "
+        f"Last error: {last_error}"
+    )
+
+
+# ─────────────────────────────────────────────────────────────
+# Anthropic
+# ─────────────────────────────────────────────────────────────
+
+
+def _call_anthropic(
+    request: LLMRequest,
+    provider: str,
+    model: str,
+) -> LLMResponse:
+    try:
+        import anthropic as ant  # lazy import
+    except ImportError:
+        raise RuntimeError("anthropic SDK not installed. Run: pip install anthropic")
+
+    api_key = get_api_key("anthropic")
+    client = ant.Anthropic(api_key=api_key, timeout=_REQUEST_TIMEOUT)
+
+    delay = _RETRY_DELAY_S
+    last_error: Exception | None = None
+
+    for attempt in range(1, _MAX_RETRIES + 1):
+        try:
+            msg = client.messages.create(
+                model=model,
+                max_tokens=request.max_tokens,
+                system=request.system_prompt,
+                messages=[{"role": "user", "content": request.user_prompt}],
+                temperature=request.temperature,
+            )
+            content = msg.content[0].text if msg.content else ""
+            return LLMResponse(
+                content=content,
+                model=model,
+                provider="anthropic",
+                input_tokens=msg.usage.input_tokens,
+                output_tokens=msg.usage.output_tokens,
+            )
+        except ant.RateLimitError as e:
+            last_error = e
+            if attempt < _MAX_RETRIES:
+                time.sleep(delay)
+                delay *= 2
+            continue
+        except ant.APIError as e:
+            raise RuntimeError(f"[anthropic] API error: {e}") from e
+
+    raise RuntimeError(
+        f"[anthropic] Rate limit hit — {_MAX_RETRIES} retries exhausted. Last: {last_error}"
+    )
+
+
+# ─────────────────────────────────────────────────────────────
+# Google Gemini
+# ─────────────────────────────────────────────────────────────
+
+
+def _call_gemini(
+    request: LLMRequest,
+    provider: str,
+    model: str,
+) -> LLMResponse:
+    try:
+        import google.generativeai as genai  # lazy import
+    except ImportError:
+        raise RuntimeError(
+            "google-generativeai SDK not installed. Run: pip install google-generativeai"
+        )
+
+    api_key = get_api_key("gemini")
+    genai.configure(api_key=api_key)
+
+    generation_config = genai.types.GenerationConfig(
+        temperature=request.temperature,
+        max_output_tokens=request.max_tokens,
+    )
+
+    gemini_model = genai.GenerativeModel(
+        model_name=model,
+        system_instruction=request.system_prompt,
+        generation_config=generation_config,
+    )
+
+    delay = _RETRY_DELAY_S
+    last_error: Exception | None = None
+
+    for attempt in range(1, _MAX_RETRIES + 1):
+        try:
+            response = gemini_model.generate_content(request.user_prompt)
+            content = response.text or ""
+            return LLMResponse(
+                content=content,
+                model=model,
+                provider="gemini",
+                input_tokens=response.usage_metadata.prompt_token_count
+                if response.usage_metadata
+                else 0,
+                output_tokens=response.usage_metadata.candidates_token_count
+                if response.usage_metadata
+                else 0,
+            )
+        except Exception as e:
+            if "quota" in str(e).lower() or "rate" in str(e).lower():
+                last_error = e
+                if attempt < _MAX_RETRIES:
+                    time.sleep(delay)
+                    delay *= 2
+                continue
+            raise RuntimeError(f"[gemini] API error: {e}") from e
+
+    raise RuntimeError(
+        f"[gemini] Rate limit hit — {_MAX_RETRIES} retries exhausted. Last: {last_error}"
+    )

pisces/models.py

@@ -0,0 +1,413 @@
+"""
+pisces.models
+~~~~~~~~~~~~~
+All shared data models for pisces.
+
+Rule: every other module imports FROM here. Nothing in here imports
+from other pisces modules. This prevents circular imports.
+"""
+
+from __future__ import annotations
+
+import uuid
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from enum import Enum
+
+# ─────────────────────────────────────────────────────────────
+# Severity
+# ─────────────────────────────────────────────────────────────
+
+
+class Severity(str, Enum):
+    """
+    Security finding severity levels.
+
+    Inherits from str so Severity.HIGH == "HIGH" works,
+    and JSON serialisation is automatic.
+    """
+
+    CRITICAL = "CRITICAL"
+    HIGH = "HIGH"
+    MEDIUM = "MEDIUM"
+    LOW = "LOW"
+    INFO = "INFO"
+
+    @classmethod
+    def from_str(cls, value: str) -> Severity:
+        try:
+            return cls(value.upper())
+        except ValueError:
+            return cls.INFO
+
+    def __lt__(self, other: Severity) -> bool:
+        _order = {
+            Severity.CRITICAL: 0,
+            Severity.HIGH: 1,
+            Severity.MEDIUM: 2,
+            Severity.LOW: 3,
+            Severity.INFO: 4,
+        }
+        return _order[self] < _order[other]
+
+
+# ─────────────────────────────────────────────────────────────
+# Repair state machine
+# ─────────────────────────────────────────────────────────────
+
+
+class RepairState(str, Enum):
+    """
+    Lifecycle states of a single repair attempt.
+
+    DETECTED → EXPLAINED → PROPOSED → JUDGED → AWAITING_APPROVAL
+    → APPROVED → CHECKPOINTED → APPLIED → VALIDATING
+    → SUCCEEDED  (terminal ✓)
+    → FAILED → HEALING → PROPOSED  (retry loop)
+    → ROLLED_BACK  (terminal, all attempts exhausted)
+    → REJECTED     (terminal, human said N)
+    """
+
+    DETECTED = "DETECTED"
+    EXPLAINED = "EXPLAINED"
+    PROPOSED = "PROPOSED"
+    JUDGED = "JUDGED"
+    AWAITING_APPROVAL = "AWAITING_APPROVAL"
+    APPROVED = "APPROVED"
+    CHECKPOINTED = "CHECKPOINTED"
+    APPLIED = "APPLIED"
+    VALIDATING = "VALIDATING"
+    SUCCEEDED = "SUCCEEDED"
+    FAILED = "FAILED"
+    HEALING = "HEALING"
+    REJECTED = "REJECTED"
+    ROLLED_BACK = "ROLLED_BACK"
+
+
+# ─────────────────────────────────────────────────────────────
+# AST-extracted file intelligence
+# ─────────────────────────────────────────────────────────────
+
+
+@dataclass
+class FunctionInfo:
+    """Information extracted from a function definition."""
+
+    name: str
+    line_start: int
+    line_end: int
+    is_async: bool = False
+    decorators: list[str] = field(default_factory=list)
+    calls: list[str] = field(default_factory=list)  # function names called inside
+    args: list[str] = field(default_factory=list)  # parameter names
+    docstring: str | None = None
+
+
+@dataclass
+class ClassInfo:
+    """Information extracted from a class definition."""
+
+    name: str
+    line_start: int
+    line_end: int
+    bases: list[str] = field(default_factory=list)
+    methods: list[str] = field(default_factory=list)
+    decorators: list[str] = field(default_factory=list)
+
+
+@dataclass
+class ImportInfo:
+    """A single import statement."""
+
+    module: str  # e.g. "os.path" or "subprocess"
+    names: list[str]  # e.g. ["run", "Popen"] or ["*"]
+    line: int
+    is_from: bool = False  # True = "from X import Y"
+
+
+@dataclass
+class SecurityConstruct:
+    """
+    A security-relevant code construct spotted during AST analysis.
+    Not a full finding — just a hint for the scanner.
+    """
+
+    kind: str  # e.g. "subprocess_call", "pickle_load", "eval_call"
+    line: int
+    code: str  # source snippet (best-effort)
+    details: str = ""
+
+
+@dataclass
+class FileContext:
+    """
+    Serialised intelligence for a single Python file.
+    Stored as one entry in context.json["files"].
+    """
+
+    path: str  # relative to project root
+    hash: str  # SHA-256 hex digest
+    functions: list[FunctionInfo] = field(default_factory=list)
+    classes: list[ClassInfo] = field(default_factory=list)
+    imports: list[ImportInfo] = field(default_factory=list)
+    calls: list[str] = field(default_factory=list)
+    security_constructs: list[SecurityConstruct] = field(default_factory=list)
+    parse_error: str | None = None  # set if AST failed
+
+    def to_dict(self) -> dict:
+        return {
+            "path": self.path,
+            "hash": self.hash,
+            "functions": [
+                {
+                    "name": f.name,
+                    "line_start": f.line_start,
+                    "line_end": f.line_end,
+                    "is_async": f.is_async,
+                    "decorators": f.decorators,
+                    "calls": f.calls,
+                    "args": f.args,
+                    "docstring": f.docstring,
+                }
+                for f in self.functions
+            ],
+            "classes": [
+                {
+                    "name": c.name,
+                    "line_start": c.line_start,
+                    "line_end": c.line_end,
+                    "bases": c.bases,
+                    "methods": c.methods,
+                    "decorators": c.decorators,
+                }
+                for c in self.classes
+            ],
+            "imports": [
+                {
+                    "module": i.module,
+                    "names": i.names,
+                    "line": i.line,
+                    "is_from": i.is_from,
+                }
+                for i in self.imports
+            ],
+            "calls": self.calls,
+            "security_constructs": [
+                {
+                    "kind": s.kind,
+                    "line": s.line,
+                    "code": s.code,
+                    "details": s.details,
+                }
+                for s in self.security_constructs
+            ],
+            "parse_error": self.parse_error,
+        }
+
+    @classmethod
+    def from_dict(cls, data: dict) -> FileContext:
+        fc = cls(path=data["path"], hash=data["hash"])
+        fc.functions = [
+            FunctionInfo(
+                name=f["name"],
+                line_start=f["line_start"],
+                line_end=f["line_end"],
+                is_async=f.get("is_async", False),
+                decorators=f.get("decorators", []),
+                calls=f.get("calls", []),
+                args=f.get("args", []),
+                docstring=f.get("docstring"),
+            )
+            for f in data.get("functions", [])
+        ]
+        fc.classes = [
+            ClassInfo(
+                name=c["name"],
+                line_start=c["line_start"],
+                line_end=c["line_end"],
+                bases=c.get("bases", []),
+                methods=c.get("methods", []),
+                decorators=c.get("decorators", []),
+            )
+            for c in data.get("classes", [])
+        ]
+        fc.imports = [
+            ImportInfo(
+                module=i["module"],
+                names=i["names"],
+                line=i["line"],
+                is_from=i.get("is_from", False),
+            )
+            for i in data.get("imports", [])
+        ]
+        fc.calls = data.get("calls", [])
+        fc.security_constructs = [
+            SecurityConstruct(
+                kind=s["kind"],
+                line=s["line"],
+                code=s["code"],
+                details=s.get("details", ""),
+            )
+            for s in data.get("security_constructs", [])
+        ]
+        fc.parse_error = data.get("parse_error")
+        return fc
+
+
+# ─────────────────────────────────────────────────────────────
+# Finding (security scanner output)
+# ─────────────────────────────────────────────────────────────
+
+
+@dataclass
+class Finding:
+    """
+    A single security finding produced by the scanner.
+
+    id          — unique, stable identifier: "<rule>:<file>:<line>"
+    rule        — rule name, e.g. "HARDCODED_SECRET"
+    severity    — Severity enum value
+    file        — relative path to the file
+    line        — line number (1-indexed)
+    code        — the offending source line(s)
+    description — short one-line description
+    impact      — why this matters
+    remediation — what to do about it
+    """
+
+    rule: str
+    severity: Severity
+    file: str
+    line: int
+    code: str
+    description: str
+    impact: str = ""
+    remediation: str = ""
+    id: str = field(default_factory=lambda: "")
+
+    def __post_init__(self) -> None:
+        if not self.id:
+            self.id = f"{self.rule}:{self.file}:{self.line}"
+
+    def to_dict(self) -> dict:
+        return {
+            "id": self.id,
+            "rule": self.rule,
+            "severity": self.severity.value,
+            "file": self.file,
+            "line": self.line,
+            "code": self.code,
+            "description": self.description,
+            "impact": self.impact,
+            "remediation": self.remediation,
+        }
+
+    @classmethod
+    def from_dict(cls, data: dict) -> Finding:
+        return cls(
+            id=data.get("id", ""),
+            rule=data["rule"],
+            severity=Severity.from_str(data["severity"]),
+            file=data["file"],
+            line=data["line"],
+            code=data["code"],
+            description=data["description"],
+            impact=data.get("impact", ""),
+            remediation=data.get("remediation", ""),
+        )
+
+
+# ─────────────────────────────────────────────────────────────
+# LLM request / response
+# ─────────────────────────────────────────────────────────────
+
+
+@dataclass
+class LLMRequest:
+    system_prompt: str
+    user_prompt: str
+    temperature: float = 0.2  # low temp for deterministic patches
+    max_tokens: int = 4096
+
+
+@dataclass
+class LLMResponse:
+    content: str
+    model: str
+    provider: str
+    input_tokens: int = 0
+    output_tokens: int = 0
+
+
+# ─────────────────────────────────────────────────────────────
+# Judge result
+# ─────────────────────────────────────────────────────────────
+
+
+@dataclass
+class JudgeResult:
+    decision: str  # "APPROVED" | "REJECTED"
+    security_ok: bool
+    functionality_ok: bool
+    scope_ok: bool
+    regression_risk: str  # "LOW" | "MEDIUM" | "HIGH"
+    patch_quality: str  # "GOOD" | "ACCEPTABLE" | "POOR"
+    completeness: str  # "COMPLETE" | "PARTIAL" | "INCOMPLETE"
+    reasoning: str
+
+    @property
+    def approved(self) -> bool:
+        return self.decision.upper() == "APPROVED"
+
+    def to_dict(self) -> dict:
+        return {
+            "decision": self.decision,
+            "security_ok": self.security_ok,
+            "functionality_ok": self.functionality_ok,
+            "scope_ok": self.scope_ok,
+            "regression_risk": self.regression_risk,
+            "patch_quality": self.patch_quality,
+            "completeness": self.completeness,
+            "reasoning": self.reasoning,
+        }
+
+
+# ─────────────────────────────────────────────────────────────
+# Repair record (history entry)
+# ─────────────────────────────────────────────────────────────
+
+
+@dataclass
+class RepairRecord:
+    """Stored in .pisces/history/<repair_id>/metadata.json"""
+
+    repair_id: str = field(default_factory=lambda: str(uuid.uuid4())[:8])
+    state: RepairState = RepairState.DETECTED
+    finding_id: str = ""
+    file: str = ""
+    rule: str = ""
+    severity: str = Severity.HIGH.value
+    provider: str = ""
+    model: str = ""
+    judge_result: dict | None = None
+    human_approved: bool | None = None
+    attempts: int = 0
+    started_at: str = field(default_factory=lambda: datetime.now(timezone.utc).isoformat())
+    finished_at: str | None = None
+
+    def to_dict(self) -> dict:
+        return {
+            "repair_id": self.repair_id,
+            "state": self.state.value,
+            "finding_id": self.finding_id,
+            "file": self.file,
+            "rule": self.rule,
+            "severity": self.severity,
+            "provider": self.provider,
+            "model": self.model,
+            "judge_result": self.judge_result,
+            "human_approved": self.human_approved,
+            "attempts": self.attempts,
+            "started_at": self.started_at,
+            "finished_at": self.finished_at,
+        }