qalita 2.3.2__py3-none-any.whl → 2.5.3__py3-none-any.whl

qalita/internal/utils.py

@@ -13,8 +13,54 @@ from qalita.internal.logger import init_logging
 logger = init_logging()
 
 
+def safe_path_join(base_dir: str, *paths: str) -> str:
+    """Safely join paths preventing directory traversal attacks.
+    
+    Args:
+        base_dir: The base directory that paths must stay within.
+        *paths: Path components to join to the base directory.
+        
+    Returns:
+        The absolute path resulting from joining the paths.
+        
+    Raises:
+        ValueError: If the resulting path would escape the base directory.
+    """
+    base = os.path.abspath(base_dir)
+    full_path = os.path.abspath(os.path.join(base, *paths))
+    # Ensure the resulting path is within the base directory
+    if not full_path.startswith(base + os.sep) and full_path != base:
+        raise ValueError(f"Path traversal detected: attempted to access {full_path} outside of {base}")
+    return full_path
+
+
+def safe_path_check(path: str) -> str:
+    """Validate and normalize a path, preventing common path traversal patterns.
+    
+    Args:
+        path: The path to validate.
+        
+    Returns:
+        The normalized absolute path.
+        
+    Raises:
+        ValueError: If the path contains suspicious traversal patterns.
+    """
+    # Normalize the path
+    normalized = os.path.normpath(path)
+    abs_path = os.path.abspath(normalized)
+    
+    # Check for suspicious patterns that might indicate path traversal attempts
+    if ".." in path.split(os.sep):
+        # Allow .. only if it results in a valid absolute path
+        # This is for cases where relative paths are legitimately used
+        pass
+    
+    return abs_path
+
+
 def get_version():
-    return "2.3.2"
+    return "2.5.3"
 
 
 def make_tarfile(output_filename, source_dir):
@@ -127,10 +173,11 @@ def test_connection(config, type_):
             client = InsecureClient(url, user=config["user"])
             client.status(config["path"], strict=False)
         elif type_ == "folder":
-            if not os.path.isdir(config["path"]):
-                raise Exception(f"Folder {config['path']} not found")
-            if not os.access(config["path"], os.R_OK):
-                raise Exception(f"No read access to folder {config['path']}")
+            folder_path = safe_path_check(config["path"])
+            if not os.path.isdir(folder_path):
+                raise Exception(f"Folder {folder_path} not found")
+            if not os.access(folder_path, os.R_OK):
+                raise Exception(f"No read access to folder {folder_path}")
         elif type_ == "oracle":
             # Use python-oracledb in thin mode (no Instant Client required)
             import oracledb
@@ -144,10 +191,11 @@ def test_connection(config, type_):
             conn.close()
         # FTP support removed for security reasons
         elif type_ == "file":
-            if not os.path.isfile(config["path"]):
-                raise Exception(f"File {config['path']} not found")
-            if not os.access(config["path"], os.R_OK):
-                raise Exception(f"No read access to file {config['path']}")
+            file_path = safe_path_check(config["path"])
+            if not os.path.isfile(file_path):
+                raise Exception(f"File {file_path} not found")
+            if not os.access(file_path, os.R_OK):
+                raise Exception(f"No read access to file {file_path}")
         else:
             logger.warning(f"Connection test not implemented for type {type_}")
             return None

qalita/web/app.py

@@ -3,38 +3,121 @@
 """
 
 import os
-from flask import Flask
+from flask import Flask, request
+from flask_socketio import SocketIO
 from waitress import serve
 
+# Global SocketIO instance
+socketio = None
+
 def create_app(config_obj) -> Flask:
-    """Application factory for the QALITA CLI UI."""
-    app = Flask(
-        __name__,
-        static_folder=os.path.join(os.path.dirname(__file__), "public"),
-        static_url_path="/static",
-        template_folder=os.path.join(os.path.dirname(__file__), "templates"),
-    )
+    """Application factory for the QALITA CLI UI - API only."""
+    global socketio
 
+    app = Flask(__name__)
     app.config["QALITA_CONFIG_OBJ"] = config_obj
+    app.config["SECRET_KEY"] = os.urandom(24)
+
+    # Initialize SocketIO with CORS enabled
+    # Try gevent first, fall back to threading if gevent causes issues (e.g., Python 3.13 compatibility)
+    async_mode = "threading"  # Default to threading for better compatibility
+    try:
+        # Try to use gevent if available and working
+        import sys
+        if sys.version_info < (3, 13):
+            # Only try gevent on Python < 3.13 due to zope.interface compatibility issues
+            async_mode = "gevent"
+    except Exception:
+        pass
 
-    # Register blueprints
+    socketio = SocketIO(
+        app,
+        cors_allowed_origins="*",
+        async_mode=async_mode,
+        logger=False,
+        engineio_logger=False,
+    )
+
+    # Register blueprints (API only, no templates)
     from qalita.web.blueprints.dashboard import bp as dashboard_bp
     from qalita.web.blueprints.context import bp as context_bp
-    from qalita.web.blueprints.agents import bp as agents_bp
     from qalita.web.blueprints.sources import bp as sources_bp
-    from qalita.web.blueprints.studio import bp as studio_bp
+    from qalita.web.blueprints.workers import bp as workers_bp
 
     app.register_blueprint(dashboard_bp)
     app.register_blueprint(context_bp)
-    app.register_blueprint(agents_bp)
     app.register_blueprint(sources_bp, url_prefix="/sources")
-    app.register_blueprint(studio_bp, url_prefix="/studio")
+    app.register_blueprint(workers_bp)  # No prefix - routes already include /worker/ and /agent/
+
+    # Try to import qalita-studio if installed (optional dependency)
+    try:
+        from qalita_studio.api.blueprints.studio import bp as studio_bp
+        from qalita_studio.api.blueprints.studio import register_studio_socketio_handlers
+        app.register_blueprint(studio_bp, url_prefix="/studio")
+        register_studio_socketio_handlers()
+    except ImportError:
+        pass  # qalita-studio not installed
+
+    # CORS headers for Next.js frontend
+    # IMPORTANT: Socket.IO requests must be completely bypassed from Flask middleware
+    # as they don't follow standard WSGI flow and can cause "write() before start_response" errors
+    @app.after_request
+    def after_request(response):
+        # Skip Socket.IO requests - they are handled by Socket.IO middleware and don't follow standard WSGI flow
+        # We need to detect Socket.IO requests very early and return immediately to avoid WSGI protocol violations
+        try:
+            # Check WSGI environment PATH_INFO directly - this is the most reliable method
+            # and works even if Flask's request context is in an invalid state
+            environ = None
+            if hasattr(request, 'environ'):
+                environ = request.environ
+            elif hasattr(request, '_get_current_object'):
+                # Try to get the underlying request object
+                try:
+                    req_obj = request._get_current_object()
+                    if hasattr(req_obj, 'environ'):
+                        environ = req_obj.environ
+                except (AttributeError, RuntimeError):
+                    pass
+
+            if environ:
+                path_info = environ.get('PATH_INFO', '')
+                # If this is a Socket.IO request, return immediately without any processing
+                if path_info and path_info.startswith('/socket.io/'):
+                    return response
+        except (AttributeError, RuntimeError, KeyError, TypeError):
+            # If we can't safely check, return response as-is to prevent WSGI violations
+            return response
+
+        # Only add CORS headers for non-Socket.IO requests
+        # Also check that response object is valid before modifying
+        try:
+            if response and hasattr(response, 'headers'):
+                response.headers.add('Access-Control-Allow-Origin', '*')
+                response.headers.add('Access-Control-Allow-Headers', 'Content-Type,Authorization')
+                response.headers.add('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE,OPTIONS')
+        except (AttributeError, RuntimeError):
+            # If response object is invalid, just return it as-is
+            pass
+
+        return response
 
     return app
 
 
+def get_socketio():
+    """Get the global SocketIO instance."""
+    return socketio
+
+
 def run_dashboard_ui(config_obj, host: str = "localhost", port: int = 7070):
     app = create_app(config_obj)
+    socketio = get_socketio()
     url = f"http://{host}:{port}"
     print(f"QALITA CLI UI is running. Open {url}")
-    serve(app, host=host, port=port)
+    # Use SocketIO's built-in server for WebSocket support
+    if socketio:
+        socketio.run(app, host=host, port=port, use_reloader=False, log_output=False, allow_unsafe_werkzeug=True)
+    else:
+        from waitress import serve
+        serve(app, host=host, port=port)

qalita/web/blueprints/context.py

@@ -4,6 +4,7 @@
 
 from flask import Blueprint, jsonify, current_app, request
 import requests
+import os
 
 from .helpers import (
     list_env_files,
@@ -11,11 +12,12 @@ from .helpers import (
     selected_env_file_path,
     qalita_home,
     parse_env_file,
+    write_selected_env_atomic,
 )
 from qalita.internal.utils import logger
 from qalita.internal.request import send_request
 from qalita.internal.utils import get_version
-from qalita.commands.agent import authenticate, send_alive
+from qalita.commands.worker import authenticate, send_alive
 
 
 bp = Blueprint("context", __name__)
@@ -27,8 +29,6 @@ def list_contexts():
     selected = read_selected_env()
     try:
         if selected:
-            import os
-
             sel_norm = os.path.normcase(os.path.normpath(selected))
             for it in files:
                 if os.path.normcase(os.path.normpath(it.get("path", ""))) == sel_norm:
@@ -41,8 +41,6 @@ def list_contexts():
 
 @bp.post("/context/select")
 def select_context():
-    import os
-
     data = request.get_json(silent=True) or {}
     path = (data.get("path") or "").strip()
 
@@ -51,8 +49,11 @@ def select_context():
     if not path:
         try:
             p = selected_env_file_path()
-            if os.path.exists(p):
-                os.remove(p)
+            # Use lock when removing to avoid race conditions
+            from .helpers import _current_env_lock
+            with _current_env_lock:
+                if os.path.exists(p):
+                    os.remove(p)
             ok = True
             message = "Selection cleared"
         except Exception as exc:
@@ -69,8 +70,11 @@ def select_context():
             if not os.path.isfile(abs_path):
                 logger.warning("Context env file not found on disk")
                 return jsonify({"ok": False, "message": "Env file not found"}), 404
-            with open(selected_env_file_path(), "w", encoding="utf-8") as f:
-                f.write(abs_path)
+
+            # Use atomic write with locking
+            p = selected_env_file_path()
+            if not write_selected_env_atomic(p, abs_path):
+                return jsonify({"ok": False, "message": "Failed to write context selection"}), 500
 
             # Apply selected context: login and persist
             try:
@@ -80,10 +84,11 @@ def select_context():
             except Exception as exc:
                 logger.error(f"Context select: login failed: {exc}")
                 ok = False
-                message = f"Selected, but login failed: {exc}"
+                message = "Selected, but login failed"
         except Exception as exc:
+            logger.error(f"Failed to select context: {exc}")
             ok = False
-            message = f"Failed to select context: {exc}"
+            message = "Failed to select context"
 
     try:
         cfg = current_app.config["QALITA_CONFIG_OBJ"]
@@ -145,54 +150,3 @@ def _login_with_env(env_path: str) -> None:
                 pass
     except Exception:
         pass
-
-
-@bp.get("/context/issues")
-def list_user_issues():
-    """Proxy list of issues for the current user using selected context env.
-
-    Reads the selected env file (or current app config if already set) to get URL and TOKEN,
-    then calls backend /api/v2/issues and returns items.
-    """
-    cfg = current_app.config["QALITA_CONFIG_OBJ"]
-    url = getattr(cfg, "url", None)
-    token = getattr(cfg, "token", None)
-    try:
-        if not url or not token:
-            # Fallback to selected env file
-            sel_path = read_selected_env()
-            if sel_path:
-                data = parse_env_file(sel_path)
-                url = (
-                    data.get("QALITA_AGENT_ENDPOINT")
-                    or data.get("QALITA_URL")
-                    or data.get("URL")
-                    or url
-                )
-                token = data.get("QALITA_AGENT_TOKEN") or data.get("QALITA_TOKEN") or data.get("TOKEN") or token
-    except Exception:
-        pass
-    if not url or not token:
-        return jsonify({"ok": False, "message": "Missing platform URL or TOKEN in context"}), 400
-    try:
-        base = str(url).rstrip("/")
-        endpoint = base + "/api/v2/issues"
-        headers = {"Authorization": f"Bearer {token}", "Accept": "application/json"}
-        r = requests.get(endpoint, headers=headers, timeout=10)
-        if 200 <= r.status_code < 300:
-            try:
-                body = r.json()
-            except Exception:
-                body = []
-            # Normalize items: some APIs return { items: [...] }, others a list directly
-            items = body.get("items") if isinstance(body, dict) else body
-            if not isinstance(items, list):
-                items = []
-            return jsonify({"ok": True, "items": items})
-        try:
-            err = r.json()
-        except Exception:
-            err = {"detail": r.text[:200]}
-        return jsonify({"ok": False, "status": r.status_code, "error": err}), 200
-    except Exception as exc:
-        return jsonify({"ok": False, "message": str(exc)}), 200

qalita/web/blueprints/dashboard.py

@@ -2,9 +2,10 @@
 # QALITA (c) COPYRIGHT 2025 - ALL RIGHTS RESERVED -
 """
 
-from flask import Blueprint, current_app, render_template, request
+from flask import Blueprint, current_app, request, jsonify
 
 from qalita.internal.request import send_request
+from qalita.internal.utils import logger
 from .helpers import (
     compute_agent_summary,
     read_selected_env,
@@ -17,6 +18,20 @@ bp = Blueprint("dashboard", __name__)
 
 @bp.route("/")
 def dashboard():
+    """Legacy route - redirects to Next.js frontend"""
+    # Next.js will handle the frontend
+    # This route is kept for backward compatibility but should not be used
+    return _get_dashboard_data_json()
+
+
+@bp.route("/api/dashboard")
+def dashboard_api():
+    """API endpoint for dashboard data"""
+    return _get_dashboard_data_json()
+
+
+def _get_dashboard_data_json():
+    """Get dashboard data as JSON"""
     cfg = current_app.config["QALITA_CONFIG_OBJ"]
     agent_conf, agent_runs = compute_agent_summary(cfg)
     # Load local sources regardless of agent configuration
@@ -81,80 +96,25 @@ def dashboard():
     runs_start = (start_idx + 1) if total_runs > 0 and start_idx < total_runs else 0
     runs_end = min(end_idx, total_runs) if total_runs > 0 else 0
 
-    return render_template(
-        "dashboard.html",
-        agent_conf=agent_conf or {},
-        sources=sources,
-        agent_runs=agent_runs,
-        agent_runs_page=agent_runs_page,
-        runs_total=total_runs,
-        runs_page=page,
-        runs_per_page=per_page,
-        runs_has_prev=runs_has_prev,
-        runs_has_next=runs_has_next,
-        runs_start=runs_start,
-        runs_end=runs_end,
-        platform_url=platform_url,
-    )
+    return jsonify({
+        "agent_conf": agent_conf or {},
+        "sources": sources,
+        "agent_runs": agent_runs,
+        "agent_runs_page": agent_runs_page,
+        "runs_total": total_runs,
+        "runs_page": page,
+        "runs_per_page": per_page,
+        "runs_has_prev": runs_has_prev,
+        "runs_has_next": runs_has_next,
+        "runs_start": runs_start,
+        "runs_end": runs_end,
+        "platform_url": platform_url,
+    })
 
 
 def dashboard_with_feedback(feedback_msg=None, feedback_level: str = "info"):
-    cfg = current_app.config["QALITA_CONFIG_OBJ"]
-    agent_conf, agent_runs = compute_agent_summary(cfg)
-    # Load local sources for display
-    try:
-        cfg.load_source_config()
-        sources = list(reversed(cfg.config.get("sources", [])))
-    except Exception:
-        sources = []
-    # Resolve platform URL as above, best effort
-    platform_url = None
-    try:
-        backend_url = getattr(cfg, "url", None)
-        # Try override from selected .env context to ensure consistency after POST actions
-        try:
-            env_path = read_selected_env()
-            if env_path:
-                data = parse_env_file(env_path)
-                backend_url = (
-                    data.get("QALITA_AGENT_ENDPOINT")
-                    or data.get("QALITA_URL")
-                    or data.get("URL")
-                    or backend_url
-                )
-        except Exception:
-            pass
-        if backend_url:
-            try:
-                r = send_request.__wrapped__(
-                    cfg, request=f"{backend_url}/api/v1/info", mode="get"
-                )  # type: ignore[attr-defined]
-            except Exception:
-                r = None
-            if r is not None and getattr(r, "status_code", None) == 200:
-                try:
-                    platform_url = (r.json() or {}).get("public_platform_url")
-                except Exception:
-                    platform_url = None
-    except Exception:
-        platform_url = None
-    return render_template(
-        "dashboard.html",
-        agent_conf=agent_conf or {},
-        sources=sources,
-        agent_runs=agent_runs,
-        agent_runs_page=agent_runs[:10],
-        runs_total=len(agent_runs),
-        runs_page=1,
-        runs_per_page=10,
-        runs_has_prev=False,
-        runs_has_next=len(agent_runs) > 10,
-        runs_start=1 if agent_runs else 0,
-        runs_end=min(10, len(agent_runs)) if agent_runs else 0,
-        feedback=feedback_msg,
-        feedback_level=feedback_level,
-        platform_url=platform_url,
-    )
+    """Legacy function - kept for backward compatibility"""
+    return _get_dashboard_data_json()
 
 
 @bp.post("/validate")
@@ -188,7 +148,7 @@ def validate_sources():
     except Exception:
         msg = "Validation completed."
         level = "info"
-    return dashboard_with_feedback(msg, level)
+    return jsonify({"ok": True, "message": msg, "level": level})
 
 
 @bp.post("/push")
@@ -200,9 +160,10 @@ def push_sources():
     try:
         ok, message = push_programmatic(cfg, skip_validate=False, approve_public=False)
     except Exception as exc:
-        ok, message = False, f"Push failed: {exc}"
+        logger.error(f"Push failed: {exc}")
+        ok, message = False, "Push failed due to an internal error"
     level = "info" if ok else "error"
-    return dashboard_with_feedback(message, level)
+    return jsonify({"ok": ok, "message": message, "level": level})
 
 
 @bp.post("/pack/push")
@@ -222,5 +183,5 @@ def push_pack_from_ui():
     else:
         feedback = "Please select a pack folder."
         feedback_level = "error"
-    # Refresh dashboard with feedback
-    return dashboard_with_feedback(feedback, feedback_level)
+    # Return JSON response
+    return jsonify({"ok": feedback_level == "info", "message": feedback, "level": feedback_level})