procesio-cli 0.1.1__py3-none-any.whl

procesio_cli/dashboard/server/llmtest.py

@@ -0,0 +1,181 @@
+"""LLM-agnostic verification + setup copilot.
+
+The dashboard cannot call Claude, so every model-backed feature here goes through
+the `llm` tool, which is provider-neutral (OpenAI / Azure / local / Anthropic /
+Codex CLI - whatever the user configured). Nothing here hardcodes a provider.
+
+Features:
+  * provider_test  - ping a provider's credential (llm test-provider)
+  * test_tool      - run a tool's live probe, then have the model judge the result
+  * test_agent     - run an agent's status/readiness, then a model summary
+  * context_inspect- summarize what the context/state store actually contains
+  * copilot        - a setup assistant that reads the current state and replies
+                     with guidance plus one-click suggested actions
+"""
+from __future__ import annotations
+
+import json
+import sqlite3
+from typing import Any
+
+import registry
+from tools._lib import userdata
+
+from . import inventory, runner, validate
+
+
+def _provider_ready() -> bool:
+    return any(p.get("key_present") for p in inventory.providers().get("providers", []))
+
+
+def _llm(system: str, user: str, *, max_tokens: int = 400) -> tuple[str | None, str | None]:
+    """One provider-agnostic completion via the llm tool (default provider)."""
+    messages = json.dumps([{"role": "user", "content": user}])
+    argv = ["complete", "--system", system, "--messages", messages,
+            "--temperature", "0", "--max-tokens", str(max_tokens)]
+    r = runner.run_tool("llm", argv, timeout=90)
+    if r["ok"]:
+        return (r["data"] or {}).get("content"), None
+    err = r["error"] or {}
+    return None, (err.get("message") or err.get("code") or "llm call failed")
+
+
+def provider_test(req) -> Any:
+    provider = (req.body.get("provider") or "").strip()
+    argv = ["test-provider"] + (["--provider", provider] if provider else [])
+    r = runner.run_tool("llm", argv, timeout=60)
+    if r["ok"]:
+        d = r["data"] or {}
+        return {"ok": True, "provider": provider or d.get("provider"),
+                "model": d.get("model"), "usage": d.get("usage")}
+    err = r["error"] or {}
+    return {"ok": False, "provider": provider,
+            "detail": err.get("message") or err.get("code") or "failed"}
+
+
+def _tool_entry(name: str) -> dict | None:
+    for t in registry.list_tools():
+        if t["name"] == name:
+            return t
+    return None
+
+
+def test_tool(req) -> Any:
+    name = (req.body.get("name") or "").strip()
+    entry = _tool_entry(name)
+    if entry is None:
+        return (404, {"error": "unknown tool"})
+    probe = validate.probe("tool:" + name, entry, force=True)
+    out = {"name": name, "ok": probe["status"] == "connected",
+           "summary": probe["status"], "probe": probe}
+    if _provider_ready():
+        content, err = _llm(
+            "You verify software integrations. Given a tool's live-check result, "
+            "say in ONE sentence whether the credential works and what to do if not.",
+            f"Tool '{name}'. Live check: {json.dumps(probe)}.", max_tokens=120)
+        out["llm"] = content or f"(llm unavailable: {err})"
+    else:
+        out["llm"] = "configure an LLM provider to get a judged explanation"
+    return out
+
+
+def test_agent(req) -> Any:
+    name = (req.body.get("name") or "").strip()
+    entry = None
+    for a in registry.list_agents():
+        if a["name"] == name:
+            entry = a
+            break
+    if entry is None:
+        return (404, {"error": "unknown agent"})
+    action_names = {a["name"] for a in entry.get("actions", [])}
+    detail: Any
+    if "status" in action_names:
+        r = runner.run_agent(name, ["status"], timeout=90)
+        detail = r["data"] if r["ok"] else r["error"]
+        ok = r["ok"] and bool(entry.get("ready"))
+    else:
+        detail = entry.get("tool_status", {})
+        ok = bool(entry.get("ready"))
+    out = {"name": name, "ok": ok, "ready": entry.get("ready"),
+           "summary": "ready" if entry.get("ready") else "not ready",
+           "tool_status": entry.get("tool_status", {}), "status": detail}
+    if _provider_ready():
+        content, err = _llm(
+            "You verify multi-tool agents. In ONE sentence, say whether this agent "
+            "is ready to run and what is missing if not.",
+            f"Agent '{name}'. Ready={entry.get('ready')}. "
+            f"Driven tools: {json.dumps(entry.get('tool_status', {}))}.", max_tokens=120)
+        out["llm"] = content or f"(llm unavailable: {err})"
+    return out
+
+
+def _sample_titles(limit: int = 15) -> list[str]:
+    p = userdata.store_db_path()
+    if not p.exists():
+        return []
+    try:
+        con = sqlite3.connect(f"file:{p}?mode=ro", uri=True, timeout=5)
+        rows = con.execute(
+            "SELECT title FROM records WHERE status='active' "
+            "ORDER BY updated DESC LIMIT ?", (limit,)).fetchall()
+        con.close()
+        return [r[0] for r in rows]
+    except sqlite3.Error:
+        return []
+
+
+def context_inspect(req) -> Any:
+    stats = inventory.store_stats()
+    titles = _sample_titles()
+    out = {"stats": stats, "sample_titles": titles}
+    if _provider_ready() and (stats or titles):
+        content, err = _llm(
+            "You summarize a knowledge store. In 2-3 short lines say what the user's "
+            "context covers and what looks thin. No preamble.",
+            f"Store stats: {json.dumps(stats)}. Recent record titles: {json.dumps(titles)}.",
+            max_tokens=200)
+        out["summary"] = content or f"(llm unavailable: {err})"
+    else:
+        out["summary"] = ("Configure an LLM provider for a written summary. "
+                          f"Raw: {stats}")
+    return out
+
+
+_COPILOT_SYSTEM = (
+    "You are the setup assistant embedded in the Agents-and-Tools dashboard. Help "
+    "the user get tools and agents working. Be concise and concrete. You cannot see "
+    "or enter secret values yourself - for a credential, direct the user to the "
+    "Store button. Reply as STRICT JSON: {\"reply\": \"...\", \"suggestions\": "
+    "[{\"action\": one of set_credential|edit_config|test_tool|test_agent|"
+    "oauth_login|web_login|bootstrap, \"label\": \"...\", \"data\": {...}}]}. "
+    "Keep suggestions to at most 4, each directly relevant. data carries the args "
+    "(tool/secret for set_credential; component/name for edit_config; name for "
+    "test_tool/test_agent; tool for oauth_login)."
+)
+
+
+def copilot(req) -> Any:
+    message = (req.body.get("message") or "").strip()
+    if not message:
+        return (400, {"error": "message is required"})
+    if not _provider_ready():
+        return {"reply": "No LLM provider is configured yet. Open the LLM Providers "
+                "tab, store a key, and test it - then I can help.", "suggestions": []}
+    inv = inventory.build()
+    state = {
+        "fresh_start": inv["fresh_start"],
+        "llm_ready": inv["summary"]["llm_ready"],
+        "tools_needing_setup": [t["name"] for t in inv["tools"] if t.get("needs_setup")][:25],
+        "agents_needing_setup": [a["name"] for a in inv["agents"] if a.get("needs_setup")][:25],
+    }
+    content, err = _llm(_COPILOT_SYSTEM,
+                        f"Current state: {json.dumps(state)}\n\nUser: {message}",
+                        max_tokens=600)
+    if content is None:
+        return {"reply": f"LLM call failed: {err}", "suggestions": []}
+    parsed = runner._parse_json(content)
+    if isinstance(parsed, dict) and "reply" in parsed:
+        parsed.setdefault("suggestions", [])
+        return parsed
+    return {"reply": content, "suggestions": []}

procesio_cli/dashboard/server/procesio_env.py

@@ -0,0 +1,94 @@
+"""PROCESIO environments panel — dashboard routes.
+
+Every operation is a thin wrapper over an EXISTING procesio tool action run through
+`runner.run_tool` (the same subprocess bridge every other setup action uses). The
+dashboard never reimplements the environment logic, credential handling, or URL
+validation — the tool remains the single source of truth, so this stays trivial to
+maintain: add an action to the tool and it shows up here for free.
+
+Read:   list-environments, list-credentials
+Write:  set-environment, add-environment, remove-environment  (environments)
+        set-default, remove-credential                        (credentials)
+"""
+from __future__ import annotations
+
+from typing import Any
+
+from . import inventory, runner
+
+TOOL = "procesio"
+
+
+def _run(argv: list[str], *, mutating: bool) -> dict[str, Any]:
+    """Run a procesio action and shape a uniform {ok, data, error}. On a successful
+    mutation, drop the inventory cache so the card (and its env-aware health probe)
+    re-reads on the next poll."""
+    res = runner.run_tool(TOOL, argv, timeout=90)
+    if mutating and res["ok"]:
+        inventory.invalidate()
+    return {"ok": res["ok"], "data": res.get("data"), "error": res.get("error")}
+
+
+def _name(req) -> str:
+    return (req.body.get("name") or "").strip()
+
+
+# -- read -------------------------------------------------------------------
+
+def state(req) -> Any:
+    """Everything the panel needs in one round-trip: the environment registry
+    (built-ins + user, the default, bound credentials) and the credential profiles
+    (names/types/workspaces/environment binding — never a secret value)."""
+    envs = _run(["list-environments"], mutating=False)
+    creds = _run(["list-credentials"], mutating=False)
+    return {
+        "environments": envs["data"],
+        "environments_error": envs["error"],
+        "credentials": creds["data"],
+        "credentials_error": creds["error"],
+    }
+
+
+# -- environments -----------------------------------------------------------
+
+def set_environment(req) -> Any:
+    if not _name(req):
+        return (400, {"error": "name is required"})
+    return _run(["set-environment", "--name", _name(req)], mutating=True)
+
+
+def add_environment(req) -> Any:
+    b = req.body or {}
+    name = (b.get("name") or "").strip()
+    web = (b.get("web_base") or "").strip()
+    app = (b.get("app_base") or "").strip()
+    forms = (b.get("forms_base") or "").strip()
+    if not (name and web and app and forms):
+        return (400, {"error": "name, web_base, app_base and forms_base are all required"})
+    argv = ["add-environment", "--name", name,
+            "--web-base", web, "--app-base", app, "--forms-base", forms]
+    if (b.get("auth_base") or "").strip():
+        argv += ["--auth-base", b["auth_base"].strip()]
+    if b.get("make_default"):
+        argv += ["--make-default"]
+    return _run(argv, mutating=True)
+
+
+def remove_environment(req) -> Any:
+    if not _name(req):
+        return (400, {"error": "name is required"})
+    return _run(["remove-environment", "--name", _name(req)], mutating=True)
+
+
+# -- credentials (existing profile actions; no secrets pass through here) ----
+
+def set_default_credential(req) -> Any:
+    if not _name(req):
+        return (400, {"error": "name is required"})
+    return _run(["set-default", "--name", _name(req)], mutating=True)
+
+
+def remove_credential(req) -> Any:
+    if not _name(req):
+        return (400, {"error": "name is required"})
+    return _run(["remove-credential", "--name", _name(req)], mutating=True)

procesio_cli/dashboard/server/routes.py

@@ -0,0 +1,74 @@
+"""Central route wiring. One place maps URL -> handler function.
+
+Handlers take a `Req` and return either a JSON-able object (200) or a
+(status, object) tuple. SSE routes (validate/all) are handled directly in
+handler.py. Later-milestone route modules are wired only when their file exists,
+so a not-yet-built module never blocks the ones already present - but a real
+import error inside an existing module still surfaces.
+"""
+from __future__ import annotations
+
+import importlib.util
+from typing import Callable
+
+_GET: dict[str, Callable] = {}
+_POST: dict[str, Callable] = {}
+
+
+def resolve(method: str, path: str):
+    return (_GET if method == "GET" else _POST).get(path)
+
+
+def _exists(mod: str) -> bool:
+    return importlib.util.find_spec(f"dashboard.server.{mod}") is not None
+
+
+def _wire():
+    from . import inventory, validate
+
+    _GET["/api/health"] = lambda req: {"ok": True}
+    _GET["/api/inventory"] = lambda req: inventory.build(
+        force=req.q("force") in ("1", "true", "yes"))
+    _POST["/api/validate/one"] = validate.validate_one_route
+
+    if _exists("setup"):
+        from . import setup
+        _POST["/api/credential/set"] = setup.credential_set
+        _POST["/api/credential/delete"] = setup.credential_delete
+        _GET["/api/credential/check"] = setup.credential_check
+        _POST["/api/bootstrap"] = setup.bootstrap
+        _GET["/api/config/list"] = setup.config_list
+        _GET["/api/config/get"] = setup.config_get
+        _POST["/api/config/validate"] = setup.config_validate
+        _POST["/api/config/set"] = setup.config_set
+        _POST["/api/session/start"] = setup.session_start
+        _POST["/api/session/commit"] = setup.session_commit
+        _POST["/api/oauth/start"] = setup.oauth_start
+        _GET["/api/job/get"] = setup.job_get
+
+    if _exists("google"):
+        from . import google
+        _GET["/api/google/accounts"] = google.accounts
+        _GET["/api/google/email"] = google.email
+        _POST["/api/google/login"] = google.login
+        _POST["/api/google/remove"] = google.remove
+
+    if _exists("procesio_env"):
+        from . import procesio_env
+        _GET["/api/procesio/state"] = procesio_env.state
+        _POST["/api/procesio/set-environment"] = procesio_env.set_environment
+        _POST["/api/procesio/add-environment"] = procesio_env.add_environment
+        _POST["/api/procesio/remove-environment"] = procesio_env.remove_environment
+        _POST["/api/procesio/set-default-credential"] = procesio_env.set_default_credential
+        _POST["/api/procesio/remove-credential"] = procesio_env.remove_credential
+
+    if _exists("llmtest"):
+        from . import llmtest
+        _POST["/api/llm/provider/test"] = llmtest.provider_test
+        _POST["/api/test/tool"] = llmtest.test_tool
+        _POST["/api/test/agent"] = llmtest.test_agent
+        _GET["/api/context/inspect"] = llmtest.context_inspect
+        _POST["/api/copilot"] = llmtest.copilot
+
+
+_wire()

procesio_cli/dashboard/server/runner.py

@@ -0,0 +1,150 @@
+"""Subprocess bridge to the framework's own scripts.
+
+The dashboard reads registry data by importing `registry` directly (fast, in
+process). But anything that RUNS a tool/agent or writes a credential goes through
+the existing scripts as a subprocess, so each runs in its own venv-correct process
+exactly as it does from the terminal - the dashboard never reimplements a tool's
+logic or its credential handling.
+
+Every well-behaved tool emits exactly one JSON object on stdout (io.emit / io.fail)
+and logs to stderr, so we parse stdout as JSON and keep stderr for diagnostics.
+"""
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+from typing import Any
+
+PROJECT_ROOT = Path(__file__).resolve().parents[2]
+VENV_PY = PROJECT_ROOT / ".venv" / "Scripts" / "python.exe"
+
+
+def python_exe() -> str:
+    """The interpreter to launch scripts with. Prefer the project venv; the
+    scripts also self-reexec into it, so this is belt-and-suspenders."""
+    return str(VENV_PY) if VENV_PY.exists() else sys.executable
+
+
+def flags_from(args: dict[str, Any] | None) -> list[str]:
+    """Turn {name: value} into ['--name', 'value', ...].
+
+    Booleans become a bare flag when True and are dropped when False (the common
+    argparse store_true convention). Everything else is stringified. Values that
+    are dict/list are JSON-encoded (some tools take JSON string args)."""
+    out: list[str] = []
+    for k, v in (args or {}).items():
+        flag = f"--{k}"
+        if isinstance(v, bool):
+            if v:
+                out.append(flag)
+            continue
+        if isinstance(v, (dict, list)):
+            v = json.dumps(v, ensure_ascii=False)
+        out.extend([flag, str(v)])
+    return out
+
+
+def run_script(script_rel: str, argv: list[str], *, stdin_text: str | None = None,
+               timeout: float = 60.0, env: dict[str, str] | None = None) -> dict[str, Any]:
+    """Run scripts/<script_rel> with argv. Returns raw process result.
+
+    `env` overlays extra environment on the inherited env (e.g. AAT_USER_ID for the
+    multi-user web platform, so userdata + creds resolve per-user in the subprocess).
+    Never raises on a non-zero exit - the caller inspects returncode/stdout."""
+    script = PROJECT_ROOT / "scripts" / script_rel
+    cmd = [python_exe(), str(script), *argv]
+    proc_env = {**os.environ, **env} if env else None
+    try:
+        proc = subprocess.run(
+            cmd, input=stdin_text, capture_output=True, text=True,
+            encoding="utf-8", errors="replace", timeout=timeout,
+            cwd=str(PROJECT_ROOT), env=proc_env,
+        )
+    except subprocess.TimeoutExpired as e:
+        return {"returncode": -1, "stdout": "", "stderr": f"timeout after {timeout}s",
+                "timed_out": True, "cmd": cmd}
+    return {"returncode": proc.returncode, "stdout": proc.stdout or "",
+            "stderr": proc.stderr or "", "timed_out": False, "cmd": cmd}
+
+
+def _parse_json(text: str) -> Any:
+    """Parse a tool's stdout as one JSON object. Tolerate leading/trailing noise
+    by falling back to the last line that parses."""
+    text = (text or "").strip()
+    if not text:
+        return None
+    try:
+        return json.loads(text)
+    except ValueError:
+        for line in reversed(text.splitlines()):
+            line = line.strip()
+            if line and line[0] in "{[":
+                try:
+                    return json.loads(line)
+                except ValueError:
+                    continue
+    return None
+
+
+def run_tool(tool: str, argv: list[str], *, timeout: float = 60.0,
+             env: dict[str, str] | None = None) -> dict[str, Any]:
+    """Run a tool via scripts/run-tool.py and normalize the outcome.
+
+    Returns {ok, data, error, returncode, stderr}. `ok` is True only when the
+    process exited 0 AND stdout parsed to a non-error JSON object. `env` overlays
+    extra environment (e.g. AAT_USER_ID for per-user isolation)."""
+    res = run_script("run-tool.py", [tool, *argv], timeout=timeout, env=env)
+    return _normalize(res)
+
+
+def run_agent(agent: str, argv: list[str], *, timeout: float = 120.0,
+              env: dict[str, str] | None = None) -> dict[str, Any]:
+    res = run_script("run-agent.py", [agent, *argv], timeout=timeout, env=env)
+    return _normalize(res)
+
+
+def _normalize(res: dict[str, Any]) -> dict[str, Any]:
+    data = _parse_json(res["stdout"])
+    is_err_envelope = isinstance(data, dict) and "error" in data
+    ok = res["returncode"] == 0 and data is not None and not is_err_envelope
+    err = None
+    if not ok:
+        if is_err_envelope:
+            err = data["error"]
+        elif res.get("timed_out"):
+            err = {"code": "timeout", "message": res["stderr"]}
+        elif data is None:
+            err = {"code": "no_json",
+                   "message": (res["stderr"] or res["stdout"] or "").strip()[:800]
+                   or "tool produced no JSON output"}
+        else:
+            err = {"code": "nonzero_exit",
+                   "message": (res["stderr"] or "").strip()[:800]}
+    return {"ok": ok, "data": data, "error": err,
+            "returncode": res["returncode"], "stderr": res["stderr"][:2000]}
+
+
+def check_credential(tool: str, secret: str) -> bool:
+    """True if the secret is present in Credential Manager (via set-credential
+    --check, which honors namespace:name shared secrets the same way)."""
+    res = run_script("set-credential.py", [tool, secret, "--check"], timeout=20)
+    return res["returncode"] == 0
+
+
+def set_credential(tool: str, secret: str, value: str) -> dict[str, Any]:
+    """Store a secret by piping it to set-credential.py --stdin. The value is
+    never placed on the command line, never logged, never written to disk here."""
+    res = run_script("set-credential.py", [tool, secret, "--stdin"],
+                     stdin_text=value, timeout=25)
+    ok = res["returncode"] == 0
+    msg = (res["stdout"] or res["stderr"] or "").strip()
+    return {"ok": ok, "message": msg}
+
+
+def delete_credential(tool: str, secret: str) -> dict[str, Any]:
+    res = run_script("set-credential.py", [tool, secret, "--delete"], timeout=20)
+    return {"ok": res["returncode"] == 0,
+            "message": (res["stdout"] or res["stderr"]).strip()}

procesio_cli/dashboard/server/security.py

@@ -0,0 +1,29 @@
+"""Local-only access gate for the dashboard.
+
+Threat model: single user, own laptop, server bound to 127.0.0.1. The token stops
+another local process (or a random browser tab hitting localhost) from driving the
+API. It is NOT multi-user auth - that is out of scope until the shared/remote mode
+is built.
+
+Secrets never pass through here on the way out: no GET ever returns a stored
+credential value, and set-credential receives values only over loopback POST which
+are piped straight to the credential store (see runner.set_credential).
+"""
+from __future__ import annotations
+
+import hmac
+import secrets as _secrets  # stdlib
+
+
+_TOKEN = _secrets.token_urlsafe(24)
+
+
+def token() -> str:
+    return _TOKEN
+
+
+def token_ok(candidate: str | None) -> bool:
+    """Constant-time compare so a wrong token leaks no timing signal."""
+    if not candidate:
+        return False
+    return hmac.compare_digest(candidate, _TOKEN)