rlmness-cli 0.2.0__py3-none-any.whl

rlmagent/config/loader.py

@@ -0,0 +1,119 @@
+"""Resolve provider, model, and credentials from environment then saved config."""
+
+from __future__ import annotations
+
+import os
+import tomllib
+from pathlib import Path
+
+from rlmagent.config.store import RlmAgentConfig, load_config, provider_info
+
+_DEFAULT_PROVIDER = "anthropic"
+
+#: Per-project settings, inside the project. Only these keys are read: a
+#: repository may pick its provider, model and fallbacks, never credentials,
+#: endpoints or the trust policy.
+PROJECT_SETTINGS = Path(".rlm-agent") / "settings.toml"
+PROJECT_KEYS = ("provider", "model", "fallback")
+
+
+def project_settings(cwd: str | os.PathLike[str] | None = None) -> dict[str, str]:
+    """The trusted project's own settings, or ``{}``."""
+    folder = Path(cwd or os.getcwd())
+    path = folder / PROJECT_SETTINGS
+    if not path.is_file():
+        return {}
+    from rlmagent.trust import project_settings_allowed
+
+    if not project_settings_allowed(folder):
+        return {}
+    try:
+        data = tomllib.loads(path.read_text(encoding="utf-8"))
+    except (OSError, UnicodeDecodeError, tomllib.TOMLDecodeError):
+        return {}
+    return {key: value.strip() for key in PROJECT_KEYS
+            if isinstance(value := data.get(key), str) and value.strip()}
+
+
+def load_provider(config: RlmAgentConfig | None = None) -> str:
+    """Active provider: ``RLM_AGENT_PROVIDER``, then config, then detection."""
+    env = os.environ.get("RLM_AGENT_PROVIDER")
+    if env:
+        return env.strip().lower()
+
+    if config is None and (project := project_settings().get("provider")):
+        return project.lower()
+    cfg = load_config() if config is None else config
+    if cfg.provider:
+        return cfg.provider.strip().lower()
+
+    # No explicit choice — infer from whichever key is present.
+    if os.environ.get("ANTHROPIC_API_KEY"):
+        return "anthropic"
+    if os.environ.get("OPENAI_API_KEY"):
+        return "openai"
+    return _DEFAULT_PROVIDER
+
+
+def load_model(provider: str, config: RlmAgentConfig | None = None) -> str | None:
+    """Model for *provider*: ``RLM_AGENT_MODEL``, then config, then ``None``."""
+    env = os.environ.get("RLM_AGENT_MODEL")
+    if env:
+        return env
+    if config is None:
+        project = project_settings()
+        if project.get("model") and project.get("provider", provider).lower() == provider:
+            return project["model"]
+    cfg = load_config() if config is None else config
+    if cfg.model and cfg.provider == provider:
+        return cfg.model
+    return None
+
+
+def load_api_key(provider: str, config: RlmAgentConfig | None = None) -> str | None:
+    """Key for *provider*: its env var, then config, then ``None``."""
+    try:
+        info = provider_info(provider)
+    except KeyError:
+        return None
+    env = os.environ.get(info.key_env)
+    if env:
+        return env
+    cfg = load_config() if config is None else config
+    return cfg.api_keys.get(provider)
+
+
+def apply_config(provider: str, config: RlmAgentConfig | None = None) -> None:
+    """Export saved credentials for *provider* into this process's environment."""
+    try:
+        info = provider_info(provider)
+    except KeyError:
+        return
+
+    if provider in ("vertex", "google", "mistral", "azure", "codex", "copilot", "claude-subscription", "xai", "xai-subscription"):
+        return
+    cfg = load_config() if config is None else config
+    key = cfg.api_keys.get(provider)
+    base_url = cfg.base_urls.get(provider) or info.base_url
+
+    if provider == "anthropic":
+        key_var, url_var = "ANTHROPIC_API_KEY", "ANTHROPIC_BASE_URL"
+    else:
+        key_var, url_var = "OPENAI_API_KEY", "OPENAI_BASE_URL"
+
+    # A real env var for the provider's own key name wins over the config file.
+    native = os.environ.get(info.key_env)
+    if native:
+        key = native
+
+    if key and not os.environ.get(key_var):
+        os.environ[key_var] = key
+    if not os.environ.get(url_var):
+        os.environ[url_var] = base_url
+
+    # Ollama needs no credential but the OpenAI loader requires a non-empty key.
+    if not info.needs_key and not os.environ.get(key_var):
+        os.environ[key_var] = "ollama"
+
+
+__all__ = ["apply_config", "load_api_key", "load_model", "load_provider"]

rlmagent/config/prompts.py

@@ -0,0 +1,124 @@
+"""Interactive prompts for ``rlm-agent config``."""
+
+from __future__ import annotations
+
+import sys
+
+from rlmagent.config.secure_input import read_secret
+
+
+class PromptAborted(Exception):
+    """Raised when the user cancels the flow (EOF or Ctrl-C)."""
+
+
+def _write(text: str) -> None:
+    sys.stderr.write(text)
+    sys.stderr.flush()
+
+
+def _readline(prompt: str) -> str:
+    _write(prompt)
+    try:
+        line = sys.stdin.readline()
+    except (EOFError, KeyboardInterrupt):
+        raise PromptAborted from None
+    if not line:
+        raise PromptAborted
+    return line.strip()
+
+
+def choose(title: str, options: list[str], *, default: int = 0) -> int:
+    """Show a numbered menu and return the chosen zero-based index."""
+    _write(f"\n{title}\n\n")
+    for i, option in enumerate(options):
+        marker = ">" if i == default else " "
+        _write(f"  {marker} {i + 1}. {option}\n")
+
+    while True:
+        raw = _readline(f"\nSelect [1-{len(options)}] ({default + 1}): ")
+        if not raw:
+            return default
+        try:
+            index = int(raw) - 1
+        except ValueError:
+            _write("Enter a number.\n")
+            continue
+        if 0 <= index < len(options):
+            return index
+        _write(f"Enter a number between 1 and {len(options)}.\n")
+
+
+def choose_model(models: list[str], *, current: str | None = None) -> str:
+    """Pick a model from *models*, or enter a custom identifier."""
+    options = [*models, "Other (enter manually)"]
+    default = models.index(current) if current in models else 0
+    index = choose("Default model", options, default=default)
+    if index < len(models):
+        return models[index]
+
+    while True:
+        value = _readline("\nModel identifier: ")
+        if value:
+            return value
+        _write("Model identifier must not be empty.\n")
+
+
+def _read_secret(*, visible: bool = False) -> str:
+    """Read a line without echoing it, treating EOF/Ctrl+C as cancellation."""
+    try:
+        return read_secret(_write, visible=visible).strip()
+    except (EOFError, KeyboardInterrupt):
+        raise PromptAborted from None
+
+
+def ask_api_key(
+    label: str, *, required: bool, has_existing: bool, visible: bool = False,
+) -> str | None:
+    """Read an API key without echoing it. Returns ``None`` to keep the existing one."""
+    suffix = " (press Enter to keep the saved key)" if has_existing else ""
+    while True:
+        _write(f"\nAPI Key{suffix}:\n")
+        if not visible:
+            # Hidden input shows nothing at all — say so, or a working prompt
+            # is indistinguishable from a frozen one.
+            _write(
+                "  (input is hidden: type or paste, then press Enter.\n"
+                "   Nothing will appear on screen. Ctrl+C cancels.)\n"
+            )
+        value = _read_secret(visible=visible)
+
+        if value:
+            return value
+        if has_existing:
+            return None
+        if not required:
+            return ""
+        _write(f"{label} requires an API key.\n")
+
+
+def confirm(question: str, *, default: bool = True) -> bool:
+    """Ask a yes/no question."""
+    hint = "Y/n" if default else "y/N"
+    while True:
+        raw = _readline(f"\n{question} ({hint}) ").lower()
+        if not raw:
+            return default
+        if raw in {"y", "yes"}:
+            return True
+        if raw in {"n", "no"}:
+            return False
+
+
+def info(text: str) -> None:
+    """Print a status line."""
+    _write(f"{text}\n")
+
+
+__all__ = [
+    "PromptAborted",
+    "ask_api_key",
+    "choose",
+    "choose_model",
+    "confirm",
+    "info",
+]

rlmagent/config/secure_input.py

@@ -0,0 +1,213 @@
+"""Hidden (non-echoing) line input that works across Windows and POSIX terminals."""
+
+from __future__ import annotations
+
+import sys
+from collections.abc import Callable
+
+# Windows console mode flags (winbase.h)
+_ENABLE_PROCESSED_INPUT = 0x0001
+_ENABLE_LINE_INPUT = 0x0002
+_ENABLE_ECHO_INPUT = 0x0004
+_STD_INPUT_HANDLE = -10
+
+
+class SecureInputUnavailable(Exception):
+    """Raised by a strategy that cannot apply on this terminal."""
+
+
+def _read_line() -> str:
+    """Read one line from stdin, raising ``EOFError`` at end of input."""
+    line = sys.stdin.readline()
+    if not line:
+        raise EOFError
+    return line.rstrip("\r\n")
+
+
+# ---------------------------------------------------------------------------
+# Strategy 1 — Windows console
+# ---------------------------------------------------------------------------
+
+
+def _read_windows(write: Callable[[str], None]) -> str:
+    """Read with echo disabled via the Windows console API."""
+    if sys.platform != "win32":
+        raise SecureInputUnavailable("not Windows")
+
+    import ctypes
+    from ctypes import wintypes
+
+    kernel32 = ctypes.WinDLL("kernel32", use_last_error=True)
+    kernel32.GetStdHandle.restype = wintypes.HANDLE
+    kernel32.GetStdHandle.argtypes = [wintypes.DWORD]
+    kernel32.GetConsoleMode.argtypes = [
+        wintypes.HANDLE, ctypes.POINTER(wintypes.DWORD),
+    ]
+    kernel32.SetConsoleMode.argtypes = [wintypes.HANDLE, wintypes.DWORD]
+
+    handle = kernel32.GetStdHandle(_STD_INPUT_HANDLE)
+    if not handle or handle == wintypes.HANDLE(-1).value:
+        raise SecureInputUnavailable("no stdin console handle")
+
+    original = wintypes.DWORD()
+    # Authoritative probe: this fails when stdin is a pipe or ConPTY stream,
+    # even though isatty() may still report True.
+    if not kernel32.GetConsoleMode(handle, ctypes.byref(original)):
+        raise SecureInputUnavailable("stdin is not a console")
+
+    # Keep LINE_INPUT (paste, backspace, arrow keys) and PROCESSED_INPUT
+    # (Ctrl+C -> SIGINT). Only echo goes away.
+    quiet = (
+        original.value | _ENABLE_LINE_INPUT | _ENABLE_PROCESSED_INPUT
+    ) & ~_ENABLE_ECHO_INPUT
+
+    if not kernel32.SetConsoleMode(handle, quiet):
+        raise SecureInputUnavailable("could not disable console echo")
+    try:
+        value = _read_line()
+    finally:
+        kernel32.SetConsoleMode(handle, original.value)
+    write("\n")  # the user's Enter was not echoed
+    return value
+
+
+# ---------------------------------------------------------------------------
+# Strategy 2 — POSIX terminal
+# ---------------------------------------------------------------------------
+
+
+def _read_posix(write: Callable[[str], None]) -> str:
+    """Read with echo disabled via termios."""
+    if sys.platform == "win32":
+        raise SecureInputUnavailable("Windows uses the console strategy")
+    try:
+        import termios
+    except ImportError as exc:
+        raise SecureInputUnavailable("termios unavailable") from exc
+
+    try:
+        fd = sys.stdin.fileno()
+        original = termios.tcgetattr(fd)
+    except (OSError, ValueError, termios.error) as exc:
+        raise SecureInputUnavailable("stdin is not a terminal") from exc
+
+    quiet = list(original)
+    quiet[3] &= ~termios.ECHO  # lflags
+    try:
+        termios.tcsetattr(fd, termios.TCSADRAIN, quiet)
+        value = _read_line()
+    finally:
+        termios.tcsetattr(fd, termios.TCSADRAIN, original)
+    write("\n")
+    return value
+
+
+# ---------------------------------------------------------------------------
+# Strategy 3 — non-interactive stdin
+# ---------------------------------------------------------------------------
+
+
+def _read_piped(write: Callable[[str], None]) -> str:
+    """Read plainly when stdin is not a terminal (piped or scripted input)."""
+    if sys.stdin.isatty():
+        raise SecureInputUnavailable("stdin is interactive")
+    return _read_line()
+
+
+# ---------------------------------------------------------------------------
+# Strategy 4 — visible fallback
+# ---------------------------------------------------------------------------
+
+
+def _read_visible(write: Callable[[str], None]) -> str:
+    """Last resort: read with echo on, after warning the user."""
+    write(
+        "\nWarning: this terminal does not support hidden input.\n"
+        "The value you type will be VISIBLE on screen.\n"
+    )
+    return _read_line()
+
+
+_STRATEGIES: tuple[Callable[[Callable[[str], None]], str], ...] = (
+    _read_piped,
+    _read_windows,
+    _read_posix,
+    _read_visible,
+)
+
+_STRATEGY_NAMES = {
+    "_read_piped": "piped stdin (not a terminal)",
+    "_read_windows": "Windows console, echo disabled",
+    "_read_posix": "POSIX terminal, echo disabled",
+    "_read_visible": "visible input (no hidden-input support)",
+}
+
+
+def read_secret(
+    write: Callable[[str], None] | None = None, *, visible: bool = False,
+) -> str:
+    """Read one line without echoing it, falling back until a strategy works."""
+    emit = write if write is not None else _default_write
+    if visible:
+        return _read_line()
+    for strategy in _STRATEGIES:
+        try:
+            return strategy(emit)
+        except SecureInputUnavailable:
+            continue
+    raise EOFError  # unreachable: _read_visible never signals unavailable
+
+
+def describe_terminal() -> list[str]:
+    """Report how this terminal handles hidden input (diagnostics only)."""
+    lines = [
+        f"platform      : {sys.platform}",
+        f"stdin.isatty(): {sys.stdin.isatty()}",
+    ]
+    if sys.platform == "win32":
+        lines.append(f"console mode  : {_probe_windows_console()}")
+    lines.append(f"selected      : {_select_strategy_name()}")
+    return lines
+
+
+def _probe_windows_console() -> str:
+    """Describe whether stdin is a real Windows console."""
+    import ctypes
+    from ctypes import wintypes
+
+    kernel32 = ctypes.WinDLL("kernel32", use_last_error=True)
+    kernel32.GetStdHandle.restype = wintypes.HANDLE
+    kernel32.GetStdHandle.argtypes = [wintypes.DWORD]
+    kernel32.GetConsoleMode.argtypes = [
+        wintypes.HANDLE, ctypes.POINTER(wintypes.DWORD),
+    ]
+    handle = kernel32.GetStdHandle(_STD_INPUT_HANDLE)
+    mode = wintypes.DWORD()
+    if kernel32.GetConsoleMode(handle, ctypes.byref(mode)):
+        return f"available (mode={hex(mode.value)})"
+    return f"UNAVAILABLE (error {ctypes.get_last_error()}) - hidden input not possible"
+
+
+def _select_strategy_name() -> str:
+    """Name the strategy that would be used, without reading input."""
+    if not sys.stdin.isatty():
+        return _STRATEGY_NAMES["_read_piped"]
+    if sys.platform == "win32":
+        if "available (" in _probe_windows_console():
+            return _STRATEGY_NAMES["_read_windows"]
+        return _STRATEGY_NAMES["_read_visible"]
+    try:
+        import termios
+
+        termios.tcgetattr(sys.stdin.fileno())
+    except Exception:
+        return _STRATEGY_NAMES["_read_visible"]
+    return _STRATEGY_NAMES["_read_posix"]
+
+
+def _default_write(text: str) -> None:
+    sys.stderr.write(text)
+    sys.stderr.flush()
+
+
+__all__ = ["SecureInputUnavailable", "describe_terminal", "read_secret"]