proxy-aiops 0.3.0__tar.gz → 0.3.1__tar.gz

{proxy_aiops-0.3.0 → proxy_aiops-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proxy-aiops
-Version: 0.3.0
+Version: 0.3.1
 Summary: Governed AI-ops for Traefik + Caddy + HAProxy reverse proxies / load balancers: routes, services, upstream health, TLS cert expiry sweep, 5xx error-rate RCA, route conflict analysis, and governed writes (caddy config, haproxy server state/weight) with a built-in governance harness (audit, budget, undo, risk tiers)
 Author-email: wei <zhouwei008@gmail.com>
 License-Expression: MIT

proxy_aiops-0.3.1/RELEASE_NOTES.md

@@ -0,0 +1,26 @@
+# Release notes — proxy-aiops 0.3.1
+
+Previous release: 0.3.0.
+
+## Fixed: the HAProxy branch could not talk to any current HAProxy
+
+Every HAProxy path was hardcoded to Data Plane API **v2**. HAProxy 3.x ships
+Data Plane API v3, which serves **only** `/v3` — every `/v2` path returns 404.
+So the whole HAProxy platform branch was unusable against a current HAProxy,
+failing at the very first probe.
+
+The path registry now holds v3 paths, and the connection probes `/v3/info` once
+per connection and rewrites the prefix to `/v2` when it sees an older server.
+Both generations work; the probe is cached, so a v3 server costs one extra
+request per connection and a v2 server two.
+
+## Live-verified: HAProxy
+
+Verified against **HAProxy 3.0.25 with Data Plane API v3.0.21**: `doctor`, plus
+reads cross-checked against the Data Plane API itself — the configured backend
+and its two servers were reported accurately, including `serversUp: 0` for
+servers pointed at closed ports.
+
+With Traefik 3.2.5 and Caddy 2 verified in 0.3.0, **all three platforms are now
+live-verified**. See [docs/VERIFICATION.md](docs/VERIFICATION.md) — guarded
+config writes and TLS/certificate expiry against real certificates remain open.

{proxy_aiops-0.3.0 → proxy_aiops-0.3.1}/docs/VERIFICATION.md

@@ -3,7 +3,9 @@
 This document records what has and has not been validated against real reverse
 proxies, so the maturity claim is auditable rather than a vibe.
 
-## Already live-verified ✅ — Traefik 3.2.5 and Caddy 2 (2026-07-20)
+## Already live-verified ✅ — all three platforms (2026-07-20)
+
+Traefik 3.2.5, Caddy 2, and HAProxy 3.0.25 (Data Plane API v3.0.21).
 
 - `doctor` against both live endpoints (unauthenticated admin APIs, as the tool
   documents for traefik/caddy).
@@ -22,9 +24,11 @@ that never round-trips through float64.
 
 ## Not yet live-verified ⚠️
 
-- **HAProxy** — the whole platform branch. It talks to the Data Plane API, which
-  needs a `program api` section in `haproxy.cfg` plus a dataplaneapi binary; that
-  setup was not built for this round. This is now the largest gap in this repo.
+- **HAProxy is now verified** — and that run found the branch was **entirely
+  broken**: every path was hardcoded to Data Plane API v2, but HAProxy 3.x serves
+  only `/v3`, so the first probe 404'd. The connection now detects the API
+  generation and supports both. Still untested there: runtime server state changes
+  and the stats-derived traffic analyses under real load.
 - **TLS / certificate expiry** (`certs`) against real certificates — both verified
   instances served plaintext on a lab port.
 - **Guarded config writes** (`config set/delete`) and their undo paths.

{proxy_aiops-0.3.0 → proxy_aiops-0.3.1}/proxy_aiops/connection.py

@@ -84,6 +84,8 @@ class ProxyConnection:
             auth=self._build_auth(target),
             headers={"Accept": "application/json"},
         )
+        # HAProxy Data Plane API generation, resolved lazily by _haproxy_path.
+        self._dpapi_prefix: str | None = None
 
     @staticmethod
     def _build_auth(target: TargetConfig) -> Any | None:
@@ -104,8 +106,29 @@ class ProxyConnection:
     def platform(self) -> Any:
         return self._target.platform_obj
 
+    def _haproxy_path(self, path: str) -> str:
+        """Rewrite a ``/v3/`` Data Plane API path to ``/v2/`` on an older server.
+
+        HAProxy 3.x ships Data Plane API v3, which serves **only** ``/v3`` — every
+        ``/v2`` path 404s. Older installs are the mirror image. The registry holds
+        the current (v3) paths and this probes ``/v3/info`` once per connection,
+        falling back to ``/v2`` so both generations work. Probed lazily and cached:
+        a v3 server costs one extra request per connection, a v2 server two.
+        """
+        if not path.startswith("/v3/"):
+            return path
+        if self._dpapi_prefix is None:
+            try:
+                resp = self._client.request("GET", "/v3/info")
+                self._dpapi_prefix = "/v3/" if resp.status_code < 400 else "/v2/"
+            except httpx.HTTPError:
+                self._dpapi_prefix = "/v3/"  # unreachable: let the real call report it
+        return self._dpapi_prefix + path[4:]
+
     def _request(self, method: str, path: str, **kwargs: Any) -> Any:
         label = self._target.platform_obj.label
+        if self._target.platform == "haproxy":
+            path = self._haproxy_path(path)
         try:
             resp = self._client.request(method, path, **kwargs)
         except httpx.HTTPError as exc:

{proxy_aiops-0.3.0 → proxy_aiops-0.3.1}/proxy_aiops/platform.py

@@ -18,7 +18,7 @@ v0.1 registers three platforms:
     read via ``GET /config/``, targeted config writes via ``PATCH/POST/DELETE
     /config/<path>`` and full replace via ``POST /load``. This platform carries
     the write surface (prior-config capture → replayable undo).
-  * **haproxy** — HAProxy Data Plane API v2 (``/v2/services/haproxy/...``,
+  * **haproxy** — HAProxy Data Plane API v3, with v2 fallback (``/v3/services/haproxy/...``,
     HTTP Basic auth): frontends/backends/servers/stats reads plus runtime
     server writes (admin state ready/drain/maint, weight).
 
@@ -288,19 +288,24 @@ _CADDY_UNSUPPORTED = {
     ),
 }
 
-# ─── HAProxy (Data Plane API v2, HTTP Basic auth) ────────────────────────────
+# ─── HAProxy (Data Plane API, HTTP Basic auth) ──────────────────────────────
+# Paths are written for Data Plane API **v3** (HAProxy 3.x). A v2 server is
+# still supported: the connection probes once and rewrites the /v3/ prefix to
+# /v2/ when it sees an older API. Verified live against dataplaneapi v3.0.21,
+# which serves ONLY /v3 — every /v2 path 404s, so hardcoding v2 (as this did)
+# made the whole HAProxy branch unusable on any current HAProxy.
 _HAPROXY_PATHS = {
-    "probe": "/v2/info",
-    "version": "/v2/info",
-    "frontends": "/v2/services/haproxy/configuration/frontends",
-    "frontend_detail": "/v2/services/haproxy/configuration/frontends/{name}",
-    "binds": "/v2/services/haproxy/configuration/binds?frontend={frontend}",
-    "backends": "/v2/services/haproxy/configuration/backends",
-    "backend_detail": "/v2/services/haproxy/configuration/backends/{name}",
-    "servers": "/v2/services/haproxy/configuration/servers?backend={backend}",
-    "runtime_servers": "/v2/services/haproxy/runtime/servers?backend={backend}",
-    "runtime_server": "/v2/services/haproxy/runtime/servers/{name}?backend={backend}",
-    "stats": "/v2/services/haproxy/stats/native",
+    "probe": "/v3/info",
+    "version": "/v3/info",
+    "frontends": "/v3/services/haproxy/configuration/frontends",
+    "frontend_detail": "/v3/services/haproxy/configuration/frontends/{name}",
+    "binds": "/v3/services/haproxy/configuration/binds?frontend={frontend}",
+    "backends": "/v3/services/haproxy/configuration/backends",
+    "backend_detail": "/v3/services/haproxy/configuration/backends/{name}",
+    "servers": "/v3/services/haproxy/configuration/servers?backend={backend}",
+    "runtime_servers": "/v3/services/haproxy/runtime/servers?backend={backend}",
+    "runtime_server": "/v3/services/haproxy/runtime/servers/{name}?backend={backend}",
+    "stats": "/v3/services/haproxy/stats/native",
 }
 _HAPROXY_UNSUPPORTED = {
     "metrics": (

{proxy_aiops-0.3.0 → proxy_aiops-0.3.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "proxy-aiops"
-version = "0.3.0"
+version = "0.3.1"
 description = "Governed AI-ops for Traefik + Caddy + HAProxy reverse proxies / load balancers: routes, services, upstream health, TLS cert expiry sweep, 5xx error-rate RCA, route conflict analysis, and governed writes (caddy config, haproxy server state/weight) with a built-in governance harness (audit, budget, undo, risk tiers)"
 readme = "README.md"
 license = "MIT"

{proxy_aiops-0.3.0 → proxy_aiops-0.3.1}/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/AIops-tools/Proxy-AIops",
     "source": "github"
   },
-  "version": "0.3.0",
+  "version": "0.3.1",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "proxy-aiops",
-      "version": "0.3.0",
+      "version": "0.3.1",
       "transport": {
         "type": "stdio"
       }

proxy_aiops-0.3.1/tests/test_dpapi_version.py

@@ -0,0 +1,56 @@
+"""HAProxy Data Plane API generation must be detected, not assumed.
+
+Regression from live verification against HAProxy 3.0 / dataplaneapi v3.0.21,
+which serves ONLY /v3 — every /v2 path 404s. The registry previously hardcoded
+/v2, so the entire HAProxy branch was unusable against any current HAProxy.
+"""
+
+from __future__ import annotations
+
+from unittest.mock import MagicMock
+
+import pytest
+
+from proxy_aiops.connection import ProxyConnection
+
+
+def _conn(probe_status: int) -> ProxyConnection:
+    c = ProxyConnection.__new__(ProxyConnection)
+    client = MagicMock(name="client")
+    client.request.return_value = MagicMock(status_code=probe_status)
+    c._client = client
+    c._dpapi_prefix = None
+    return c
+
+
+@pytest.mark.unit
+def test_v3_server_keeps_v3_paths():
+    c = _conn(200)
+    assert c._haproxy_path("/v3/info") == "/v3/info"
+    assert c._haproxy_path("/v3/services/haproxy/configuration/backends") == (
+        "/v3/services/haproxy/configuration/backends"
+    )
+
+
+@pytest.mark.unit
+def test_v2_server_gets_paths_rewritten():
+    c = _conn(404)  # /v3/info missing => an older Data Plane API
+    assert c._haproxy_path("/v3/info") == "/v2/info"
+    assert c._haproxy_path("/v3/services/haproxy/configuration/backends") == (
+        "/v2/services/haproxy/configuration/backends"
+    )
+
+
+@pytest.mark.unit
+def test_probe_is_cached_not_repeated_per_request():
+    c = _conn(200)
+    for _ in range(5):
+        c._haproxy_path("/v3/info")
+    assert c._client.request.call_count == 1
+
+
+@pytest.mark.unit
+def test_non_versioned_paths_are_untouched():
+    c = _conn(200)
+    assert c._haproxy_path("/metrics") == "/metrics"
+    assert c._client.request.call_count == 0, "must not probe for unrelated paths"

{proxy_aiops-0.3.0 → proxy_aiops-0.3.1}/tests/test_platform.py

@@ -44,9 +44,11 @@ def test_path_templates_differ_per_platform():
     ha = get_platform(HAPROXY)
     assert tr.path("routers") == "/api/http/routers"
     assert tr.path("router_detail", name="web@file").endswith("/web%40file")
-    assert ha.path("backends") == "/v2/services/haproxy/configuration/backends"
+    # The registry holds Data Plane API **v3** paths (HAProxy 3.x serves only
+    # /v3); the connection rewrites them to /v2 for an older server.
+    assert ha.path("backends") == "/v3/services/haproxy/configuration/backends"
     assert ha.path("runtime_server", name="web1", backend="app") == (
-        "/v2/services/haproxy/runtime/servers/web1?backend=app"
+        "/v3/services/haproxy/runtime/servers/web1?backend=app"
     )
     assert get_platform(CADDY).path("config_load") == "/load"
 

{proxy_aiops-0.3.0 → proxy_aiops-0.3.1}/uv.lock

@@ -484,7 +484,7 @@ wheels = [
 
 [[package]]
 name = "proxy-aiops"
-version = "0.3.0"
+version = "0.3.1"
 source = { editable = "." }
 dependencies = [
     { name = "cryptography" },

proxy_aiops-0.3.0/RELEASE_NOTES.md

@@ -1,27 +0,0 @@
-# Release notes — proxy-aiops 0.3.0
-
-Previous release: 0.2.0.
-
-## Fixed: route priority lost precision and collapsed distinct values
-
-Traefik route priority is an int64. Routing it through the float helper rendered it
-in scientific notation (`9.223372036854776e+18`) *and* lost precision, because a
-float64 cannot represent values near 2**63 exactly.
-
-The practical consequence, seen on a live Traefik: two routers with **different**
-priorities (…806 and …805) displayed as the **same** number. Route priority decides
-matching order, so this actively misleads anyone debugging which route wins.
-
-Integer quantities — route priority, server weight, request totals, session counts —
-now use an exact `as_int` that returns an existing `int` untouched instead of
-round-tripping it through float64. Genuinely fractional values are unchanged.
-
-If you parse these fields, the JSON changes from `9.223372036854776e+18` to
-`9223372036854775806`, and counters from `12.0` to `12`.
-
-## Live-verified
-
-Against **Traefik 3.2.5** and **Caddy 2**: reads cross-checked against each proxy's
-own API, plus the three analyses. See [docs/VERIFICATION.md](docs/VERIFICATION.md) —
-**HAProxy remains unverified** (its Data Plane API setup was not built for this
-round) and is now the largest gap here.