sanityops-cli 0.1.3__py3-none-any.whl

sanityops_cli/utils/config_resolver.py

@@ -0,0 +1,358 @@
+# Copyright 2026 zipsonken
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+"""Generic config resolver with precedence chain: project > global > env > default."""
+
+from __future__ import annotations
+
+import os
+import tempfile
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+from sanityops_cli.utils.config_loader import read_file_with_encoding_fallback
+
+# Default config file locations
+DEFAULT_PROJECT_CONFIG_DIR = ".sanityops"
+DEFAULT_PROJECT_CONFIG_FILE = "inspect_config.yaml"
+GLOBAL_CONFIG_DIR = ".sanityops"
+GLOBAL_CONFIG_FILE = "config"
+
+
+def get_global_config_path() -> Path:
+    """Return the global config file path, cross-platform.
+
+    Uses Path.home() which correctly resolves:
+    - macOS/Linux: $HOME
+    - Windows: %USERPROFILE%
+    """
+    return Path.home() / GLOBAL_CONFIG_DIR / GLOBAL_CONFIG_FILE
+
+
+def get_project_config_path() -> Path:
+    """Return the project-level config file path in current working directory."""
+    return Path.cwd() / DEFAULT_PROJECT_CONFIG_DIR / DEFAULT_PROJECT_CONFIG_FILE
+
+
+def _read_yaml_file(path: Path) -> dict[str, Any]:
+    """Read a YAML file with encoding fallback (UTF-8 -> GBK for Windows).
+
+    Returns empty dict if file doesn't exist or is unreadable.
+    """
+    if not path.exists() or not path.is_file():
+        return {}
+
+    content = read_file_with_encoding_fallback(path)
+    if content is None:
+        return {}
+
+    try:
+        data = yaml.safe_load(content)
+        if not isinstance(data, dict):
+            return {}
+        return data
+    except yaml.YAMLError:
+        return {}
+
+
+def _is_global_config_path(path: Path) -> bool:
+    """Check if the path is the global config file path."""
+    return path == get_global_config_path()
+
+
+def _ensure_restricted_permissions(path: Path, is_file: bool = True) -> None:
+    """Ensure restricted permissions for global config paths.
+
+    For directories: 0o700 (owner-only access)
+    For files: 0o600 (owner-only read/write)
+
+    No-op for non-global paths. Best-effort on non-POSIX filesystems.
+    """
+    try:
+        if is_file:
+            path.chmod(0o600)
+        else:
+            path.chmod(0o700)
+    except OSError:
+        pass  # Non-POSIX filesystem (e.g., Windows)
+
+
+def _write_yaml_file(path: Path, data: dict[str, Any]) -> None:
+    """Write data to a YAML file with atomic replacement.
+
+    Creates parent directories if needed.
+    Uses an unpredictable temp file + rename to prevent corruption on
+    interruption and symlink attacks. The temp file is created with
+    owner-only permissions (0o600) from the start (via O_EXCL), so sensitive
+    values are never written to a world-readable file.
+    """
+    is_global = _is_global_config_path(path)
+
+    # Create parent directory
+    path.parent.mkdir(parents=True, exist_ok=True)
+
+    # For global config, restrict directory permissions first
+    if is_global:
+        _ensure_restricted_permissions(path.parent, is_file=False)
+
+    # Create an unpredictable temp file in the same directory with restrictive
+    # permissions. mkstemp() creates the file with mode 0o600 by default, meaning
+    # the file is owner-only from creation and symlink attacks are prevented.
+    fd, tmp_name = tempfile.mkstemp(
+        dir=path.parent,
+        prefix=f".{path.name}.tmp-",
+        text=True,
+    )
+    tmp_path = Path(tmp_name)
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as f:
+            yaml.safe_dump(data, f, default_flow_style=False, sort_keys=False)
+        # Atomic on POSIX, near-atomic on Windows
+        os.replace(tmp_path, path)
+        # Ensure restrictive permissions on the destination file after atomic
+        # replace. os.replace() may preserve existing destination permissions
+        # if the file already existed with looser permissions.
+        if is_global:
+            _ensure_restricted_permissions(path, is_file=True)
+    except BaseException:
+        # Close fd if os.fdopen() failed before wrapping it (the fd would
+        # otherwise leak). If fdopen succeeded, the file is already closed and
+        # os.close() raises OSError (EBADF), which we swallow.
+        try:
+            os.close(fd)
+        except OSError:
+            pass
+        # Clean up temp file on failure
+        if tmp_path.exists():
+            tmp_path.unlink(missing_ok=True)
+        raise
+
+
+def _get_nested_value(data: dict[str, Any], key: str) -> Any:
+    """Get a nested value from a dict using dot-separated key.
+
+    Example: _get_nested_value({"server": {"base_url": "x"}}, "server.base_url")
+    Returns None if any intermediate key is missing or not a dict.
+    """
+    parts = key.split(".")
+    current: Any = data
+    for part in parts:
+        if not isinstance(current, dict):
+            return None
+        current = current.get(part)
+        if current is None:
+            return None
+    return current
+
+
+def _set_nested_value(data: dict[str, Any], key: str, value: Any) -> None:
+    """Set a nested value in a dict using dot-separated key.
+
+    Creates intermediate dicts as needed.
+    Example: _set_nested_value(data, "server.base_url", "x")
+    """
+    parts = key.split(".")
+    current = data
+    for part in parts[:-1]:
+        if part not in current or not isinstance(current[part], dict):
+            current[part] = {}
+        current = current[part]
+    current[parts[-1]] = value
+
+
+def _unset_nested_value(data: dict[str, Any], key: str) -> bool:
+    """Remove a nested key from a dict using dot-separated key.
+
+    Returns True if key was present and removed, False otherwise.
+    Cleans up empty intermediate dicts after removal.
+    """
+    parts = key.split(".")
+    current = data
+
+    # Track path for cleanup of empty parents
+    path_stack: list[tuple[dict[str, Any], str]] = []
+
+    # Navigate to parent
+    for part in parts[:-1]:
+        if not isinstance(current, dict) or part not in current:
+            return False
+        path_stack.append((current, part))
+        current = current[part]
+
+    if not isinstance(current, dict):
+        return False
+
+    final_key = parts[-1]
+    if final_key in current:
+        del current[final_key]
+    else:
+        return False
+
+    # Clean up empty intermediate dicts (from deepest to shallowest)
+    for parent_dict, child_key in reversed(path_stack):
+        child = parent_dict[child_key]
+        if isinstance(child, dict) and not child:
+            del parent_dict[child_key]
+
+    return True
+
+
+class ConfigResolver:
+    """Generic config resolver with precedence chain.
+
+    Precedence: project-level > global > environment variable > default.
+
+    Attributes:
+        config_key: Dot-separated config key (e.g., "server.base_url").
+        env_var: Environment variable name (e.g., "SANITYOPS_BASE_URL").
+        default: Default value if none of the above provide a value.
+    """
+
+    def __init__(
+        self,
+        config_key: str,
+        env_var: str | None = None,
+        default: str | None = None,
+    ):
+        self.config_key = config_key
+        self.env_var = env_var
+        self.default = default
+
+    def resolve(self) -> str | None:
+        """Resolve config value following precedence chain.
+
+        Returns:
+            The resolved value, or None if not found and no default.
+        """
+        # 1. Project-level config
+        project_config = _read_yaml_file(get_project_config_path())
+        value = _get_nested_value(project_config, self.config_key)
+        if value is not None:
+            return str(value) if not isinstance(value, str) else value
+
+        # 2. Global config
+        global_config = _read_yaml_file(get_global_config_path())
+        value = _get_nested_value(global_config, self.config_key)
+        if value is not None:
+            return str(value) if not isinstance(value, str) else value
+
+        # 3. Environment variable
+        if self.env_var:
+            env_value = os.environ.get(self.env_var)
+            if env_value is not None:
+                return env_value
+
+        # 4. Default
+        return self.default
+
+    def resolve_all_sources(self) -> dict[str, str | None]:
+        """Resolve value from each source for display purposes.
+
+        Returns dict with keys: 'project', 'global', 'env', 'default'.
+        Useful for --list output showing where each value comes from.
+        """
+        result: dict[str, str | None] = {}
+
+        # Project-level
+        project_config = _read_yaml_file(get_project_config_path())
+        project_value = _get_nested_value(project_config, self.config_key)
+        result["project"] = str(project_value) if project_value is not None else None
+
+        # Global
+        global_config = _read_yaml_file(get_global_config_path())
+        global_value = _get_nested_value(global_config, self.config_key)
+        result["global"] = str(global_value) if global_value is not None else None
+
+        # Env
+        result["env"] = os.environ.get(self.env_var) if self.env_var else None
+
+        # Default
+        result["default"] = self.default
+
+        return result
+
+    @staticmethod
+    def set_global(key: str, value: str) -> None:
+        """Set a value in the global config file.
+
+        Creates the file if it doesn't exist. Merges with existing content.
+        """
+        path = get_global_config_path()
+        data = _read_yaml_file(path)
+        _set_nested_value(data, key, value)
+        _write_yaml_file(path, data)
+
+    @staticmethod
+    def set_project(key: str, value: str) -> None:
+        """Set a value in the project-level config file.
+
+        Creates the file if it doesn't exist. Merges with existing content.
+        """
+        path = get_project_config_path()
+        data = _read_yaml_file(path)
+        _set_nested_value(data, key, value)
+        _write_yaml_file(path, data)
+
+    @staticmethod
+    def unset_global(key: str) -> bool:
+        """Remove a key from the global config file.
+
+        Returns True if key was present and removed, False otherwise.
+        If the file becomes empty after removal, it is deleted.
+        """
+        path = get_global_config_path()
+        data = _read_yaml_file(path)
+        if not data:
+            return False
+        removed = _unset_nested_value(data, key)
+        if removed:
+            if data:
+                _write_yaml_file(path, data)
+            else:
+                # File is now empty; remove it entirely
+                path.unlink(missing_ok=True)
+        return removed
+
+    @staticmethod
+    def unset_project(key: str) -> bool:
+        """Remove a key from the project-level config file.
+
+        Returns True if key was present and removed, False otherwise.
+        If the file becomes empty after removal, it is deleted.
+        """
+        path = get_project_config_path()
+        data = _read_yaml_file(path)
+        if not data:
+            return False
+        removed = _unset_nested_value(data, key)
+        if removed:
+            if data:
+                _write_yaml_file(path, data)
+            else:
+                # File is now empty; remove it entirely
+                path.unlink(missing_ok=True)
+        return removed
+
+    @staticmethod
+    def list_global() -> dict[str, Any]:
+        """List all config values from global config file."""
+        return _read_yaml_file(get_global_config_path())
+
+    @staticmethod
+    def list_project() -> dict[str, Any]:
+        """List all config values from project-level config file."""
+        return _read_yaml_file(get_project_config_path())

sanityops_cli/utils/validators.py

@@ -0,0 +1,117 @@
+# Copyright 2026 zipsonken
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+"""local validators for sanityops-cli"""
+
+import json
+import os
+from pathlib import Path
+
+from sanityops_cli.exceptions.base_exceptions import ValidationError
+
+# Exclude directories
+EXCLUDED_DIRS = {
+    ".git",
+    "node_modules",
+    "__pycache__",
+    "dist",
+    "build",
+    ".venv",
+    "venv",
+    ".idea",
+    ".vscode",
+}
+
+def validate_inspect_directory(directory: str) -> None:
+    """validate inspect directory"""
+    import os
+    from pathlib import Path
+
+    path = Path(directory)
+
+    # folder exists
+    if not path.exists():
+        raise ValidationError(f"Folder does not exist: {directory}")
+
+    # is a directory
+    if not path.is_dir():
+        raise ValidationError(f"Path is not a directory: {directory}")
+
+    # folder is readable
+    if not os.access(path, os.R_OK | os.X_OK):
+        raise ValidationError(f"Folder is not readable: {directory}")
+
+    # folder is not empty
+    try:
+        items = list(path.iterdir())
+        # Exclude certain directories from the list of items
+        items = [i for i in items if i.name not in EXCLUDED_DIRS]
+        if not items:
+            raise ValidationError(f"Folder is empty: {directory}")
+    except PermissionError:
+        raise ValidationError(f"Folder is not readable: {directory}") from None
+
+
+def validate_artifact_inputs(
+    skills: list[str],
+    tools: list[str],
+    prompts: list[str],
+    level: str,
+) -> None:
+    """validate artifact inputs for inspect command"""
+    if not skills and not tools and not prompts:
+        raise ValidationError("at least one of (--skill / --tools / --prompt) must be provided")
+
+    for label, paths in [("Skill", skills), ("Tools Schema", tools), ("System Prompt", prompts)]:
+        for path_str in paths:
+            p = Path(path_str)
+            if not p.exists():
+                raise ValidationError(f"Path does not exist: {path_str}")
+
+            if label == "Skill":
+                if p.is_file():
+                    if not os.access(p, os.R_OK):
+                        raise ValidationError(f"File is not readable: {path_str}")
+                    if p.stat().st_size == 0:
+                        raise ValidationError(f"File is empty: {path_str}")
+                elif p.is_dir():
+                    if not os.access(p, os.R_OK):
+                        raise ValidationError(f"Directory is not readable: {path_str}")
+                else:
+                    raise ValidationError(f"Skill path must be a file or directory: {path_str}")
+            else:
+                if not p.is_file():
+                    raise ValidationError(f"Path is not a file: {path_str}")
+                if not os.access(p, os.R_OK):
+                    raise ValidationError(f"File is not readable: {path_str}")
+                if p.stat().st_size == 0:
+                    raise ValidationError(f"File is empty: {path_str}")
+
+    for path_str in tools:
+        try:
+            content = Path(path_str).read_text(encoding="utf-8")
+        except Exception:
+            raise ValidationError(f"File is not readable: {path_str}") from None
+        try:
+            parsed = json.loads(content)
+        except json.JSONDecodeError:
+            raise ValidationError(f"Tools Schema is not valid JSON: {path_str}") from None
+        if not isinstance(parsed, (dict, list)):
+            raise ValidationError(f"Tools Schema must be a JSON object or array: {path_str}")
+
+    if level.upper() not in ("L1", "L2", "L3"):
+        raise ValidationError(f"Level must be one of L1/L2/L3, current value: {level}")
+
+

sanityops_cli-0.1.3.dist-info/METADATA

@@ -0,0 +1,213 @@
+Metadata-Version: 2.5
+Name: sanityops-cli
+Version: 0.1.3
+Summary: CLI tool for static defect inspection of AI logical artifacts
+Project-URL: Homepage, https://sanityops.org
+Project-URL: Documentation, https://sanityops.org
+Project-URL: Repository, https://github.com/sanityops-org/sanityops-cli
+Project-URL: Issues, https://github.com/sanityops-org/sanityops-cli/issues
+Author: Sanityops Team
+License: Apache-2.0
+License-File: LICENSE
+License-File: NOTICE
+Keywords: ai,cli,defect-detection,llm,static-analysis
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.11
+Requires-Dist: anyio>=4.0
+Requires-Dist: defect-check
+Requires-Dist: httpx>=0.27
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: rich>=13.0
+Requires-Dist: sanityops-agent>=0.0.4
+Requires-Dist: tomli-w>=1.0
+Requires-Dist: tomli>=2.0
+Requires-Dist: typer>=0.12
+Provides-Extra: dev
+Requires-Dist: ruff>=0.6.0; extra == 'dev'
+Provides-Extra: test
+Requires-Dist: pytest-httpx>=0.30; extra == 'test'
+Requires-Dist: pytest>=8.0; extra == 'test'
+Description-Content-Type: text/markdown
+
+# Sanityops CLI
+
+A command-line tool for static defect inspection of AI logical artifacts (System Prompts, Skills, Tool Schemas). Designed for local development and CI/CD integration.
+
+**[Documentation](https://sanityops.org)** | **[Report Bug](https://github.com/sanityops-org/sanityops-cli/issues)** | **[Request Feature](https://github.com/sanityops-org/sanityops-cli/issues)**
+
+## Features
+
+- **Multi-level inspection depth** — Choose between L1 (fast), L2 (standard), or L3 (deep) check levels
+- **Multiple artifact types** — Inspect System Prompts, Skills, and Tool Schemas
+- **CI/CD ready** — Designed for automated pipeline integration
+- **Configurable rules** — Customize inspection behavior via YAML configuration
+
+## Installation
+
+### From Curl (Recommended)
+
+**macOS and Linux:**
+
+```bash
+curl -fsSL https://downloads.sanityops.org/sanityops-cli/install.sh | bash
+```
+
+**Windows PowerShell:**
+
+```powershell
+irm https://downloads.sanityops.org/sanityops-cli/install.ps1 | iex
+```
+
+For a reviewable PowerShell installation, download the script first:
+
+```powershell
+irm https://downloads.sanityops.org/sanityops-cli/install.ps1 -OutFile install.ps1
+Get-Content .\install.ps1
+.\install.ps1
+```
+
+Both installers verify the downloaded binary against `checksums.txt` before installing. They default to user-writable locations (`~/.local/bin` on macOS/Linux and `%USERPROFILE%\.sanityops\bin` on Windows), then add the Windows directory to the user PATH if needed.
+
+### From PyPI
+
+```bash
+pip install sanityops-cli
+```
+
+### From Source
+
+```bash
+git clone https://github.com/sanityops-org/sanityops-cli.git
+cd sanityops-cli
+pip install -e .
+```
+
+## Quick Start
+
+### 1. Initialize Configuration
+
+```bash
+sanityops-cli init
+```
+
+This creates `.sanityops/inspect_config.yaml` in your current directory with a
+freshly generated project UUID. The generated file matches the template below —
+edit the artifact paths to point at your prompts, tools, and skills.
+
+### 2. Configure Artifacts
+
+Edit `.sanityops/inspect_config.yaml` to specify your artifacts:
+
+```yaml
+project:
+  id: <your-project-id>          # required: UUID
+
+# Optional: omit to use LLM_* environment variables
+# model:
+#   provider: anthropic
+#   api_key: sk-ant-...
+#   model_id: claude-sonnet-4-20250514
+#   base_url: ""
+
+prompts:
+  - file: prompts/system_prompt.md
+
+tools:
+  - file: tools/search_tools.json
+
+skills:
+  - file: skills/code_review.md   # file only, not directories
+```
+
+### 3. Run Inspection
+
+```bash
+# Standard inspection (L2 depth)
+sanityops-cli inspect
+
+# Fast inspection (L1 depth)
+sanityops-cli inspect --check-level L1
+
+# Deep inspection (L3 depth)
+sanityops-cli inspect --check-level L3
+
+# Skip defect check, only analyze artifacts
+sanityops-cli inspect --skip-defect-check
+
+# Use custom config file
+sanityops-cli inspect --config path/to/config.yaml
+```
+
+### Check Levels
+
+| Level | Description | Use Case |
+|-------|-------------|----------|
+| L1 | Fast | Quick validation during development |
+| L2 | Standard | Default, balanced depth for regular use |
+| L3 | Deep | Comprehensive analysis for production releases |
+
+## Documentation
+
+Full documentation is available at [sanityops.org](https://sanityops.org).
+
+## Requirements
+
+- Python >= 3.11
+- OpenAI API key (or compatible LLM provider) for defect checking
+
+## Development
+
+### Setup
+
+```bash
+# Clone the repository
+git clone https://github.com/sanityops-org/sanityops-cli.git
+cd sanityops-cli
+
+# Create virtual environment
+python -m venv .venv
+source .venv/bin/activate  # On Windows: .venv\Scripts\activate
+
+# Install development dependencies
+pip install -e ".[dev,test]"
+```
+
+### Run Tests
+
+```bash
+pytest
+```
+
+### Code Style
+
+This project uses [Ruff](https://docs.astral.sh/ruff/) for linting. Run:
+
+```bash
+ruff check .
+```
+
+## Contributing
+
+We welcome contributions! Please see our [Contributing Guide](CONTRIBUTING.md) for details on:
+
+- Development setup
+- Code style guidelines
+- Pull request process
+- Commit message conventions
+
+## License
+
+This project is licensed under the Apache License 2.0 - see the [LICENSE](LICENSE) file for details.
+
+## Acknowledgments
+
+Built with [Typer](https://typer.tiangolo.com/) and [Rich](https://github.com/Textualize/rich).