procesio-cli 0.1.1__py3-none-any.whl

procesio_cli/dashboard/server/google.py

@@ -0,0 +1,103 @@
+"""Google multi-account (profile) management for the dashboard.
+
+The 8 Google tools share one OAuth credential set under the `google:` namespace
+and support MULTIPLE accounts, each keyed by an arbitrary lowercase LABEL
+(`default`, `personal`, `work`, ...) - NOT by email. Only `google-mail` (and
+`google-contacts`) expose the `--account` surface + `auth-accounts`, and the token
+they write is shared by every Google tool, so we drive ALL account operations
+through `google-mail`.
+
+  list   -> google-mail auth-accounts        (+ best-effort email via get-profile)
+  add /
+  re-auth-> google-mail auth-login --account  (BLOCKS on browser consent -> a job)
+  remove -> google-mail auth-logout --account (fast)
+
+The OAuth CLIENT (google:oauth-client) is a precondition the user provisions as a
+normal credential (the card's client-key row); we only manage the per-account
+tokens here.
+"""
+from __future__ import annotations
+
+import re
+from typing import Any
+
+from . import inventory, jobs, runner
+
+_DRIVER = "google-mail"
+_LABEL_RE = re.compile(r"^[a-z0-9._-]+$")
+
+
+def _valid_label(label: str) -> bool:
+    return bool(_LABEL_RE.match(label))
+
+
+def _account_args(action_argv: list[str], label: str) -> list[str]:
+    """--account goes AFTER the action (a global flag stripped by the tool)."""
+    argv = list(action_argv)
+    if label:
+        argv += ["--account", label]
+    return argv
+
+
+def accounts(req) -> Any:
+    """List connected Google profiles - fast (labels only, no network). The email
+    for each is fetched lazily by the UI via /api/google/email so the list appears
+    instantly instead of blocking on a get-profile call per account."""
+    r = runner.run_tool(_DRIVER, ["auth-accounts"], timeout=30)
+    if not r["ok"]:
+        # Most common cause: the OAuth client isn't stored yet.
+        st = runner.run_tool(_DRIVER, ["auth-status"], timeout=20)
+        has_client = bool(st["ok"] and (st["data"] or {}).get("has_client"))
+        return {"ok": False, "has_client": has_client,
+                "accounts": [], "error": r["error"]}
+    data = r["data"] or {}
+    active = data.get("active")
+    out = [{"account": a.get("account"), "has_token": bool(a.get("has_token")),
+            "active": a.get("account") == active}
+           for a in data.get("accounts", [])]
+    return {"ok": True, "active": active, "accounts": out}
+
+
+def email(req) -> Any:
+    """Resolve one account's email address (a live get-profile call). Lazy, so a
+    slow or failing account never blocks the account list."""
+    label = (req.q("account") or "").strip().lower()
+    if not label or not _valid_label(label):
+        return (400, {"error": "invalid account"})
+    pr = runner.run_tool(_DRIVER, ["get-profile", "--account", label], timeout=25)
+    if pr["ok"] and isinstance(pr["data"], dict):
+        return {"account": label,
+                "email": pr["data"].get("emailAddress") or pr["data"].get("email")}
+    return {"account": label, "email": None,
+            "error": (pr.get("error") or {}).get("message")}
+
+
+def login(req) -> Any:
+    """Add a new profile or re-authorize an existing one (same command). Runs as a
+    job because auth-login opens a browser and blocks until the user consents."""
+    label = (req.body.get("account") or "default").strip().lower()
+    if not _valid_label(label):
+        return (400, {"error": "invalid label",
+                      "message": "Use a short label like 'personal' or 'work' "
+                                 "(lowercase letters, digits, . _ - ). Not an email."})
+    argv = ["run-tool.py", _DRIVER] + _account_args(["auth-login"],
+                                                    "" if label == "default" else label)
+    job = jobs.create("google-oauth", argv, stdin_signal=False)
+    snap = job.snapshot()
+    snap["account"] = label
+    return snap
+
+
+def remove(req) -> Any:
+    """Remove ONE profile's token (leaves the shared oauth-client intact)."""
+    label = (req.body.get("account") or "").strip().lower()
+    if not label:
+        return (400, {"error": "account label is required"})
+    if not _valid_label(label):
+        return (400, {"error": "invalid label"})
+    argv = _account_args(["auth-logout"], "" if label == "default" else label)
+    r = runner.run_tool(_DRIVER, argv, timeout=30)
+    if r["ok"]:
+        inventory.invalidate()
+        return {"ok": True, "account": label, "data": r["data"]}
+    return {"ok": False, "account": label, "error": r["error"]}

procesio_cli/dashboard/server/handler.py

@@ -0,0 +1,160 @@
+"""HTTP request handler: routing, token gate, JSON + SSE + static serving.
+
+Stdlib only. Domain logic lives in inventory/validate/setup/llmtest; this module
+just parses the request, enforces the loopback token on /api/*, dispatches, and
+serializes the response. Route handlers are imported lazily inside each branch so
+the server boots even while later-milestone modules are still being added.
+"""
+from __future__ import annotations
+
+import json
+import traceback
+from http.server import BaseHTTPRequestHandler
+from pathlib import Path
+from urllib.parse import parse_qs, urlparse
+
+from . import security
+
+WEB_DIR = Path(__file__).resolve().parents[1] / "web"
+
+_CTYPES = {".html": "text/html; charset=utf-8",
+           ".js": "application/javascript; charset=utf-8",
+           ".css": "text/css; charset=utf-8",
+           ".svg": "image/svg+xml", ".ico": "image/x-icon"}
+
+
+class Req:
+    """Minimal parsed-request view passed to route handlers."""
+    def __init__(self, method: str, path: str, query: dict, body: dict | None):
+        self.method = method
+        self.path = path
+        self.query = query
+        self.body = body or {}
+
+    def q(self, name: str, default=None):
+        v = self.query.get(name)
+        return v[0] if isinstance(v, list) and v else default
+
+
+class Handler(BaseHTTPRequestHandler):
+    server_version = "AATDashboard/0.1"
+    protocol_version = "HTTP/1.1"
+
+    # ---- low-level response helpers -------------------------------------
+    def _send_json(self, obj, status: int = 200):
+        payload = json.dumps(obj, ensure_ascii=False, default=str).encode("utf-8")
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json; charset=utf-8")
+        self.send_header("Content-Length", str(len(payload)))
+        self.send_header("Cache-Control", "no-store")
+        self.end_headers()
+        self.wfile.write(payload)
+
+    def _send_bytes(self, data: bytes, ctype: str, status: int = 200):
+        self.send_response(status)
+        self.send_header("Content-Type", ctype)
+        self.send_header("Content-Length", str(len(data)))
+        self.send_header("Cache-Control", "no-store")  # local tool - always fresh
+        self.end_headers()
+        self.wfile.write(data)
+
+    def _sse_open(self):
+        self.send_response(200)
+        self.send_header("Content-Type", "text/event-stream; charset=utf-8")
+        self.send_header("Cache-Control", "no-store")
+        self.send_header("Connection", "keep-alive")
+        self.end_headers()
+
+    def _sse_send(self, event: str, data: dict):
+        chunk = f"event: {event}\ndata: {json.dumps(data, default=str)}\n\n"
+        self.wfile.write(chunk.encode("utf-8"))
+        self.wfile.flush()
+
+    # ---- auth -----------------------------------------------------------
+    def _authed(self, query: dict) -> bool:
+        tok = self.headers.get("X-Dashboard-Token")
+        if not tok:
+            q = query.get("token")
+            tok = q[0] if isinstance(q, list) and q else None
+        return security.token_ok(tok)
+
+    # ---- static ---------------------------------------------------------
+    def _serve_static(self, path: str):
+        rel = "index.html" if path in ("/", "") else path.lstrip("/")
+        if rel.startswith("static/"):
+            rel = rel[len("static/"):]
+        target = (WEB_DIR / rel).resolve()
+        if WEB_DIR.resolve() not in target.parents and target != WEB_DIR.resolve():
+            self._send_json({"error": "forbidden"}, 403)
+            return
+        if not target.is_file():
+            self._send_json({"error": "not found", "path": path}, 404)
+            return
+        ctype = _CTYPES.get(target.suffix, "application/octet-stream")
+        self._send_bytes(target.read_bytes(), ctype)
+
+    # ---- dispatch -------------------------------------------------------
+    def do_GET(self):
+        parsed = urlparse(self.path)
+        path, query = parsed.path, parse_qs(parsed.query)
+        if not path.startswith("/api/"):
+            return self._serve_static(path)
+        if not self._authed(query):
+            return self._send_json({"error": "unauthorized"}, 401)
+        if path == "/api/validate/all":
+            return self._route_sse(Req("GET", path, query, None))
+        return self._route(Req("GET", path, query, None))
+
+    def do_POST(self):
+        parsed = urlparse(self.path)
+        path, query = parsed.path, parse_qs(parsed.query)
+        if not self._authed(query):
+            return self._send_json({"error": "unauthorized"}, 401)
+        body = self._read_body()
+        return self._route(Req("POST", path, query, body))
+
+    def _read_body(self) -> dict | None:
+        length = int(self.headers.get("Content-Length") or 0)
+        if not length:
+            return None
+        raw = self.rfile.read(length)
+        try:
+            return json.loads(raw.decode("utf-8"))
+        except (ValueError, UnicodeDecodeError):
+            return None
+
+    def _route(self, req: Req):
+        try:
+            from . import routes
+            fn = routes.resolve(req.method, req.path)
+            if fn is None:
+                return self._send_json({"error": "no such route",
+                                        "path": req.path}, 404)
+            result = fn(req)
+            if isinstance(result, tuple):
+                status, obj = result
+                return self._send_json(obj, status)
+            return self._send_json(result)
+        except Exception as e:  # noqa: BLE001 - surface as JSON, never 500-crash
+            return self._send_json(
+                {"error": "handler_exception", "message": str(e),
+                 "trace": traceback.format_exc().splitlines()[-6:]}, 500)
+
+    def _route_sse(self, req: Req):
+        try:
+            from . import validate
+            self._sse_open()
+            for event, data in validate.stream_all(req):
+                self._sse_send(event, data)
+            self._sse_send("done", {"ok": True})
+        except BrokenPipeError:
+            pass
+        except Exception as e:  # noqa: BLE001
+            try:
+                self._sse_send("error", {"message": str(e)})
+            except Exception:
+                pass
+
+    def log_message(self, fmt, *args):
+        # Quiet by default; the launcher prints a startup banner instead.
+        pass

procesio_cli/dashboard/server/inventory.py

@@ -0,0 +1,213 @@
+"""The read model: assemble the full dashboard picture from the live registry.
+
+Reads are in-process (import registry / userdata / bootstraplib) so the inventory
+is fast and always reflects the real folder + Credential Manager state. The only
+subprocess reads here are the store stats and llm providers (they belong to tools
+that own their own config/DB).
+"""
+from __future__ import annotations
+
+import json
+import sqlite3
+import threading
+import time
+from typing import Any
+
+import registry
+from agents.orchestrator import bootstraplib
+from tools._lib import creds, userdata
+
+# A full build scans every manifest (a few seconds on a large registry). Cache it
+# briefly and serialize builds so a page reload, a validation reconnect, or two
+# concurrent requests never stack N full scans. Mutations (credential/config
+# writes) call invalidate() so the next read reflects the change immediately.
+_INV_TTL = 4.0
+_INV_LOCK = threading.Lock()
+_INV_CACHE: dict[str, Any] = {"ts": 0.0, "data": None}
+
+
+def invalidate() -> None:
+    with _INV_LOCK:
+        _INV_CACHE["ts"] = 0.0
+        _INV_CACHE["data"] = None
+
+
+def _probe_kind(entry: dict[str, Any]) -> str | None:
+    """What live-validation path exists for this capability: an explicit
+    healthcheck, else a conventional auth-status action, else nothing."""
+    if entry.get("healthcheck"):
+        return "healthcheck"
+    action_names = {a["name"] for a in entry.get("actions", [])}
+    if "auth-status" in action_names:
+        return "auth-status"
+    return None
+
+
+def _present_sessions() -> set[str]:
+    """Base names of saved web sessions (X.json / X.profile / X.cookies.json)."""
+    d = userdata.sessions_dir()
+    names: set[str] = set()
+    if not d.exists():
+        return names
+    for p in d.iterdir():
+        for suf in (".cookies.json", ".json", ".profile"):
+            if p.name.endswith(suf):
+                names.add(p.name[: -len(suf)])
+                break
+    return names
+
+
+def _annotate(entry: dict[str, Any], kind: str,
+              present_sessions: set[str] | None = None) -> dict[str, Any]:
+    entry["kind"] = kind
+    missing = set(entry.get("missing_secrets", []))
+    # OAuth tools carry oauth-token/oauth-accounts secrets that are PRODUCED by the
+    # sign-in flow (auth-login), not entered by hand. Hide them from the card so a
+    # newcomer sees "Connect (sign in)" instead of confusing set/delete rows for a
+    # token they can't type. The oauth CLIENT key (which the user does provide) stays.
+    has_oauth = any(a.get("name") == "auth-login" for a in entry.get("actions", []))
+
+    def _oauth_output(nm: str) -> bool:
+        return has_oauth and (nm.endswith("oauth-token") or nm.endswith("oauth-accounts"))
+
+    entry["secrets_status"] = [
+        {"name": s["name"], "description": s.get("description", ""),
+         "present": s["name"] not in missing}
+        for s in entry.get("secrets", []) if not _oauth_output(s["name"])
+    ]
+    entry["probe"] = _probe_kind(entry)
+    # A tool may need a saved web login instead of (or on top of) a credential.
+    ws = entry.get("web_session")
+    session_missing = False
+    if ws:
+        present = ws["name"] in (present_sessions or set())
+        entry["web_session_status"] = {
+            "name": ws["name"], "login_url": ws.get("login_url", ""),
+            "persistent": ws.get("persistent", False), "channel": ws.get("channel", ""),
+            "label": ws.get("label", ""), "present": present}
+        session_missing = not present
+    entry["needs_setup"] = bool(missing) or session_missing or (
+        kind == "agent" and not entry.get("ready", False))
+    return entry
+
+
+def store_stats() -> dict[str, Any] | None:
+    """Record/run counts read straight from the SQLite store (read-only), so the
+    dashboard never shells out to the context-store tool for a simple count -
+    faster, and immune to the keyring-import hang that afflicts subprocesses
+    spawned from a detached parent."""
+    p = userdata.store_db_path()
+    if not p.exists():
+        return None
+    try:
+        con = sqlite3.connect(f"file:{p}?mode=ro", uri=True, timeout=5)
+    except sqlite3.Error:
+        return None
+    try:
+        rec = con.execute("SELECT count(*) FROM records").fetchone()[0]
+        runs = con.execute("SELECT count(*) FROM runs").fetchone()[0]
+        openruns = con.execute(
+            "SELECT count(*) FROM runs WHERE status IN ('open','active')").fetchone()[0]
+        return {"records": rec, "runs": runs, "open_runs": openruns}
+    except sqlite3.Error:
+        return None  # schema not initialized yet (fresh install)
+    finally:
+        con.close()
+
+
+def providers() -> dict[str, Any]:
+    """llm provider config + key presence (NEVER a key value), read in-process
+    from providers.json + Credential Manager. Mirrors the llm tool's
+    list-providers shape without importing that tool's provider adapters (which
+    require its own sys.path) or spawning a subprocess."""
+    p = userdata.config_dir("llm") / "providers.json"
+    if not p.exists():
+        return {"default": None, "providers": [],
+                "error": {"code": "no_config", "message": "no providers.json yet"}}
+    try:
+        cfg = json.loads(p.read_text(encoding="utf-8"))
+    except ValueError as e:
+        return {"default": None, "providers": [],
+                "error": {"code": "bad_config", "message": str(e)}}
+    default = cfg.get("default")
+    out = []
+    for name, pc in (cfg.get("providers") or {}).items():
+        out.append({
+            "name": name,
+            "adapter": pc.get("adapter", "openai_compat"),
+            "base_url": pc.get("base_url"),
+            "model": pc.get("model"),
+            "auth_style": pc.get("auth_style", "bearer"),
+            "config": {k: v for k, v in pc.items() if k != "api_key"},
+            "key_present": creds.has_for_report("llm", name),
+            "is_default": name == default,
+        })
+    return {"default": default, "providers": out}
+
+
+def build(force: bool = False) -> dict[str, Any]:
+    """Cached, single-flight inventory build."""
+    with _INV_LOCK:
+        fresh = (_INV_CACHE["data"] is not None
+                 and (time.time() - _INV_CACHE["ts"]) < _INV_TTL)
+        if fresh and not force:
+            return _INV_CACHE["data"]
+        data = _build()
+        _INV_CACHE["ts"] = time.time()
+        _INV_CACHE["data"] = data
+        return data
+
+
+def _build() -> dict[str, Any]:
+    tool_entries = registry.list_tools()
+    tool_index = {t["name"]: t for t in tool_entries}
+    sessions = _present_sessions()
+    tools = [_annotate(t, "tool", sessions) for t in tool_entries]
+    agents = [_annotate(a, "agent", sessions)
+              for a in registry.list_agents(tool_index=tool_index)]
+    skills = registry.list_skills()
+    for s in skills:
+        s["kind"] = "skill"
+
+    store = store_stats()
+    fresh = bootstraplib.freshness(store)
+    prov = providers()
+    llm_ready = any(p.get("key_present") for p in prov.get("providers", []))
+
+    def cnt(items, pred):
+        return sum(1 for x in items if pred(x))
+
+    def is_ready(x):  # truly set up: no missing secrets, no missing session, loads
+        return not x.get("needs_setup") and not x.get("error")
+
+    summary = {
+        "tools": {
+            "total": len(tools),
+            "ready": cnt(tools, is_ready),
+            "needs_setup": cnt(tools, lambda t: t.get("needs_setup")),
+            "errored": cnt(tools, lambda t: t.get("error")),
+        },
+        "agents": {
+            "total": len(agents),
+            "ready": cnt(agents, is_ready),
+            "needs_setup": cnt(agents, lambda a: a.get("needs_setup")),
+            "errored": cnt(agents, lambda a: a.get("error")),
+        },
+        "skills": {"total": len(skills)},
+        "llm_ready": llm_ready,
+    }
+
+    return {
+        "summary": summary,
+        "tools": tools,
+        "agents": agents,
+        "skills": skills,
+        "providers": prov,
+        "store": store,
+        "userdata": {
+            **userdata.describe(),
+            "scan": fresh["scan"],
+        },
+        "fresh_start": fresh["fresh_start"],
+        "onboarding": bootstraplib.onboarding_hint() if fresh["fresh_start"] else None,
+    }

procesio_cli/dashboard/server/jobs.py

@@ -0,0 +1,118 @@
+"""Background jobs for interactive setup steps that outlive one request.
+
+Two shapes:
+  * a plain job that runs a script to completion and streams its output
+    (OAuth login: the tool opens a browser and self-completes on the localhost
+    redirect), and
+  * a signal job that launches a script which blocks for a stdin ENTER
+    (web save-session: a headed browser opens, the human logs in, then the UI
+    sends the signal to persist the session).
+
+Jobs live in memory only. The dashboard is single-user and local; a restart just
+drops in-flight logins, which the user re-runs.
+"""
+from __future__ import annotations
+
+import subprocess
+import threading
+import time
+import uuid
+from typing import Any
+
+from . import runner
+
+_JOBS: dict[str, "Job"] = {}
+_LOCK = threading.Lock()
+
+
+class Job:
+    def __init__(self, kind: str, argv: list[str], *, stdin_signal: bool):
+        self.id = uuid.uuid4().hex[:12]
+        self.kind = kind
+        self.argv = argv
+        self.stdin_signal = stdin_signal
+        self.status = "starting"   # starting|awaiting_signal|running|done|failed
+        self.logs: list[str] = []
+        self.result: dict | None = None
+        self.error: str | None = None
+        self.created = time.time()
+        self._proc: subprocess.Popen | None = None
+        self._lock = threading.Lock()
+
+    def _log(self, line: str):
+        with self._lock:
+            self.logs.append(line.rstrip("\n"))
+            if len(self.logs) > 400:
+                self.logs = self.logs[-400:]
+
+    def start(self):
+        cmd = [runner.python_exe(), str(runner.PROJECT_ROOT / "scripts" / self.argv[0]),
+               *self.argv[1:]]
+        try:
+            self._proc = subprocess.Popen(
+                cmd, cwd=str(runner.PROJECT_ROOT), text=True, encoding="utf-8",
+                errors="replace", bufsize=1,
+                stdin=subprocess.PIPE if self.stdin_signal else subprocess.DEVNULL,
+                stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+        except Exception as e:  # noqa: BLE001
+            self.status = "failed"
+            self.error = f"could not launch: {e}"
+            return
+        self.status = "awaiting_signal" if self.stdin_signal else "running"
+        threading.Thread(target=self._pump, daemon=True).start()
+
+    def _pump(self):
+        assert self._proc is not None
+        for line in self._proc.stdout:  # blocks until each line / EOF
+            self._log(line)
+        self._proc.wait()
+        result = runner._parse_json("\n".join(self.logs))
+        if self._proc.returncode == 0 and isinstance(result, dict) and "error" not in result:
+            self.status = "done"
+            self.result = result
+        else:
+            self.status = "failed"
+            if isinstance(result, dict) and "error" in result:
+                self.error = result["error"].get("message") if isinstance(
+                    result["error"], dict) else str(result["error"])
+            else:
+                self.error = (self.logs[-1] if self.logs else
+                              f"exited with code {self._proc.returncode}")
+
+    def signal(self) -> bool:
+        """Send the ENTER that a save-session subprocess is blocking on."""
+        if not (self._proc and self._proc.stdin and self.status == "awaiting_signal"):
+            return False
+        try:
+            self._proc.stdin.write("\n")
+            self._proc.stdin.flush()
+            self.status = "running"
+            return True
+        except Exception:  # noqa: BLE001
+            return False
+
+    def wait(self, timeout: float) -> None:
+        if self._proc:
+            try:
+                self._proc.wait(timeout=timeout)
+            except subprocess.TimeoutExpired:
+                pass
+
+    def snapshot(self) -> dict[str, Any]:
+        with self._lock:
+            return {"id": self.id, "kind": self.kind, "status": self.status,
+                    "logs": list(self.logs[-40:]), "result": self.result,
+                    "error": self.error}
+
+
+def create(kind: str, argv: list[str], *, stdin_signal: bool = False) -> Job:
+    job = Job(kind, argv, stdin_signal=stdin_signal)
+    with _LOCK:
+        _JOBS[job.id] = job
+    job.start()
+    return job
+
+
+def get(job_id: str) -> Job | None:
+    with _LOCK:
+        return _JOBS.get(job_id)