sid-harness 0.3.0__py3-none-any.whl

sid_harness/client.py

@@ -0,0 +1,161 @@
+"""HTTP client for SID's OpenAI-compatible ``/v1`` surface.
+
+Uses only the standard library (``urllib``), so the harness has zero third-party
+dependencies. Every call rides the caller's own SID key: routing, metering, and
+spend caps are the gateway's, not the harness's.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import urllib.error
+import urllib.request
+from typing import Any
+
+from . import config
+
+DEFAULT_BASE_URL = "https://superintelligencedog.com/v1"
+DEFAULT_ROUTING_PROFILE = "agent"
+
+
+class SIDClientError(RuntimeError):
+    """A SID call could not be completed (transport, auth, or bad response)."""
+
+
+class SIDClient:
+    def __init__(
+        self,
+        *,
+        base_url: str | None = None,
+        api_key: str | None = None,
+        routing_profile: str | None = None,
+        stability: str | None = None,
+        timeout: float = 180.0,
+    ) -> None:
+        self.base_url = (
+            base_url
+            or os.environ.get("SID_BASE_URL")
+            or config.get_base_url()
+            or DEFAULT_BASE_URL
+        ).rstrip("/")
+        self.api_key = (
+            api_key or os.environ.get("SID_API_KEY") or config.get_api_key() or ""
+        )
+        if not self.api_key:
+            raise SIDClientError(
+                "no SID API key: run `sid setup`, set SID_API_KEY, or pass --api-key."
+            )
+        self.routing_profile = (
+            routing_profile
+            or os.environ.get("SID_ROUTING_PROFILE")
+            or DEFAULT_ROUTING_PROFILE
+        )
+        self.stability = stability or os.environ.get("SID_ROUTING_STABILITY") or ""
+        self.timeout = timeout
+
+    def headers(self) -> dict[str, str]:
+        headers = {
+            "Authorization": f"Bearer {self.api_key}",
+            "Content-Type": "application/json",
+        }
+        if self.routing_profile:
+            headers["X-Routing-Profile"] = self.routing_profile
+        if self.stability:
+            headers["X-Routing-Stability"] = self.stability
+        return headers
+
+    def _post(self, path: str, payload: dict[str, Any]) -> dict[str, Any]:
+        url = f"{self.base_url}{path}"
+        data = json.dumps(payload).encode("utf-8")
+        request = urllib.request.Request(
+            url, data=data, headers=self.headers(), method="POST"
+        )
+        try:
+            with urllib.request.urlopen(request, timeout=self.timeout) as response:
+                body = response.read().decode("utf-8")
+        except urllib.error.HTTPError as exc:
+            detail = exc.read().decode("utf-8", "replace")
+            raise SIDClientError(
+                f"SID {path} failed: HTTP {exc.code}: {detail[:500]}"
+            ) from exc
+        except urllib.error.URLError as exc:
+            raise SIDClientError(
+                f"SID {path} unreachable at {self.base_url}: {exc.reason}"
+            ) from exc
+        try:
+            parsed = json.loads(body)
+        except json.JSONDecodeError as exc:
+            raise SIDClientError(
+                f"SID {path} returned a non-JSON response"
+            ) from exc
+        if not isinstance(parsed, dict):
+            raise SIDClientError(f"SID {path} returned an unexpected response shape")
+        return parsed
+
+    def _get(self, path: str) -> dict[str, Any]:
+        url = f"{self.base_url}{path}"
+        request = urllib.request.Request(url, headers=self.headers(), method="GET")
+        try:
+            with urllib.request.urlopen(request, timeout=self.timeout) as response:
+                body = response.read().decode("utf-8")
+        except urllib.error.HTTPError as exc:
+            detail = exc.read().decode("utf-8", "replace")
+            raise SIDClientError(
+                f"SID {path} failed: HTTP {exc.code}: {detail[:500]}"
+            ) from exc
+        except urllib.error.URLError as exc:
+            raise SIDClientError(
+                f"SID {path} unreachable at {self.base_url}: {exc.reason}"
+            ) from exc
+        try:
+            parsed = json.loads(body)
+        except json.JSONDecodeError as exc:
+            raise SIDClientError(
+                f"SID {path} returned a non-JSON response"
+            ) from exc
+        if not isinstance(parsed, dict):
+            raise SIDClientError(f"SID {path} returned an unexpected response shape")
+        return parsed
+
+    def me(self) -> dict[str, Any]:
+        """Verify the key and return the account summary from ``GET /v1/me``."""
+        return self._get("/me")
+
+    def chat(
+        self,
+        *,
+        messages: list[dict[str, Any]],
+        tools: list[dict[str, Any]] | None = None,
+        model: str = "auto",
+        max_tokens: int = 8000,
+        temperature: float = 0.0,
+        reasoning_effort: str | None = None,
+    ) -> dict[str, Any]:
+        payload: dict[str, Any] = {
+            "model": model,
+            "messages": messages,
+            "temperature": temperature,
+            "max_tokens": max_tokens,
+        }
+        if tools:
+            payload["tools"] = tools
+            payload["tool_choice"] = "auto"
+        if reasoning_effort:
+            payload["reasoning_effort"] = reasoning_effort
+        return self._post("/chat/completions", payload)
+
+    def verify_patch(
+        self,
+        diff: str,
+        *,
+        context: str | None = None,
+        reviewer_model: str | None = None,
+        model: str = "auto",
+    ) -> dict[str, Any]:
+        payload: dict[str, Any] = {"diff": diff, "model": model}
+        if context:
+            payload["context"] = context
+        if reviewer_model:
+            payload["reviewer_model"] = reviewer_model
+        return self._post("/verify/patch", payload)

sid_harness/companion.py

@@ -0,0 +1,151 @@
+"""sid companion — the desktop launcher for the localhost bridge.
+
+One process, one click:
+
+* starts the loopback bridge over the folder the user chose;
+* opens the SID Studio with a one-time pairing code in the URL fragment, which
+  the Studio exchanges for the bridge token — no manual URL or token paste;
+* read-only by default. ``--write`` makes write mode *available*; the user still
+  has to click "Enable write access" in the Studio, which is the explicit
+  per-session grant the bridge records.
+
+The installer (``infra/sid-harness/install/``) registers this command at login
+so the bridge is already running when the user opens the Studio.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import time
+import webbrowser
+from pathlib import Path
+from typing import Any
+from urllib.parse import urlencode
+
+from .bridge import (
+    ALLOWED_ORIGINS,
+    DEFAULT_PORT,
+    PAIR_TTL_SECONDS,
+    bridge_state_dir,
+    serve,
+)
+
+DEFAULT_STUDIO_URL = "https://app.superintelligencedog.com/studio.html"
+
+
+def pair_url(base_url: str, studio_url: str, code: str) -> str:
+    """The one-click URL: code rides the fragment, so it never hits a server log."""
+    fragment = urlencode({"sid-pair": code, "sid-bridge": base_url})
+    return f"{studio_url}#{fragment}"
+
+
+def write_session_file(path: Path, payload: dict[str, Any]) -> Path:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    tmp = path.with_name(path.name + ".tmp")
+    tmp.write_text(json.dumps(payload, indent=2, sort_keys=True) + "\n", encoding="utf-8")
+    try:
+        os.chmod(tmp, 0o600)
+    except OSError:  # Windows has no POSIX mode bits here
+        pass
+    os.replace(tmp, path)
+    return path
+
+
+def run(
+    directory: str | os.PathLike[str],
+    *,
+    port: int = DEFAULT_PORT,
+    studio_url: str = DEFAULT_STUDIO_URL,
+    write: bool = False,
+    open_browser: bool = True,
+    token: str | None = None,
+    pair_code: str | None = None,
+    pair_ttl: float = PAIR_TTL_SECONDS,
+    state_dir: str | os.PathLike[str] | None = None,
+    allowed_origins: tuple[str, ...] | list[str] | None = None,
+    base_url: str | None = None,
+) -> int:
+    httpd = serve(
+        directory,
+        port=port,
+        token=token,
+        write_capable=write,
+        pair_code=pair_code,
+        pair_ttl=pair_ttl,
+        state_dir=state_dir,
+        allowed_origins=tuple(allowed_origins) if allowed_origins is not None else ALLOWED_ORIGINS,
+        base_url=base_url,
+    )
+    bridge_url = f"http://127.0.0.1:{httpd.server_address[1]}"
+    url = pair_url(bridge_url, studio_url, httpd.bridge_pair_code)
+    state = Path(state_dir).expanduser().resolve() if state_dir else bridge_state_dir()
+    try:
+        write_session_file(state / "session.json", {
+            "pid": os.getpid(),
+            "started_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
+            "bridge_url": bridge_url,
+            "studio_url": studio_url,
+            "dir": str(httpd.bridge_dir),
+            "read_only": httpd.read_only,
+            "write_capable": httpd.bridge_write_capable,
+            "pair_expires_at": int(httpd.bridge_pair_expires_at),
+            "pair_url": url,
+        })
+    except OSError as exc:
+        print(f"sid companion: could not write {state / 'session.json'}: {exc}")
+
+    print(f"sid companion: {bridge_url}")
+    print(f"workspace: {httpd.bridge_dir}")
+    print(f"mode: {'write available (explicit grant required)' if write else 'read-only'}")
+    print(f"pair: {url}")
+    if open_browser:
+        try:
+            webbrowser.open(url)
+        except Exception as exc:  # opening the browser is best-effort; the URL is printed
+            print(f"sid companion: could not open the browser: {exc}")
+    try:
+        httpd.serve_forever()
+    except KeyboardInterrupt:
+        print("\nsid companion: stopped")
+    finally:
+        httpd.server_close()
+    return 0
+
+
+def main(argv: list[str] | None = None) -> int:
+    ap = argparse.ArgumentParser(
+        prog="sid companion",
+        description="Start the local bridge and open the Studio with one-click pairing.",
+    )
+    ap.add_argument("--dir", required=True, help="Folder the Studio may read (and, if granted, write).")
+    ap.add_argument("--port", type=int, default=DEFAULT_PORT)
+    ap.add_argument("--studio-url", default=DEFAULT_STUDIO_URL)
+    ap.add_argument("--write", action="store_true", help="Make write mode available (default: read-only).")
+    ap.add_argument("--no-open", action="store_true", help="Do not open the browser (print the pair URL).")
+    ap.add_argument("--token", default=None, help="Fixed token (default: generated per launch).")
+    ap.add_argument("--pair-code", default=None, help="Fixed pairing code (default: generated per launch).")
+    ap.add_argument("--pair-ttl", type=float, default=PAIR_TTL_SECONDS)
+    ap.add_argument("--state-dir", default=None)
+    ap.add_argument("--allow-origin", action="append", default=None, metavar="ORIGIN")
+    ap.add_argument("--base-url", default=None)
+    args = ap.parse_args(argv)
+    origins = ALLOWED_ORIGINS + tuple(args.allow_origin or ())
+    return run(
+        args.dir,
+        port=args.port,
+        studio_url=args.studio_url,
+        write=args.write,
+        open_browser=not args.no_open,
+        token=args.token,
+        pair_code=args.pair_code,
+        pair_ttl=args.pair_ttl,
+        state_dir=args.state_dir,
+        allowed_origins=origins,
+        base_url=args.base_url,
+    )
+
+
+if __name__ == "__main__":  # pragma: no cover
+    raise SystemExit(main())

sid_harness/config.py

@@ -0,0 +1,68 @@
+"""Persistent local configuration for the SID harness.
+
+``sid setup`` writes ``~/.sid/config.json`` (owner-only where the OS supports
+it). The CLI and client read it as a fallback so the key and default workspace
+survive new terminals. ``SID_CONFIG_PATH`` overrides the location for tests and
+packaged installs.
+"""
+
+from __future__ import annotations
+
+import contextlib
+import json
+import os
+from pathlib import Path
+from typing import Any
+
+DEFAULT_CONFIG_PATH = "~/.sid/config.json"
+
+
+def config_path() -> Path:
+    override = os.environ.get("SID_CONFIG_PATH")
+    if override:
+        return Path(override).expanduser()
+    return Path(DEFAULT_CONFIG_PATH).expanduser()
+
+
+def load_config() -> dict[str, Any]:
+    path = config_path()
+    try:
+        raw = path.read_text(encoding="utf-8")
+    except (FileNotFoundError, OSError):
+        return {}
+    try:
+        data = json.loads(raw)
+    except json.JSONDecodeError:
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def save_config(config: dict[str, Any]) -> Path:
+    path = config_path()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    payload = json.dumps(config, indent=2, sort_keys=True, ensure_ascii=False) + "\n"
+    temporary = path.with_name(path.name + ".tmp")
+    flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
+    descriptor = os.open(temporary, flags, 0o600)
+    with os.fdopen(descriptor, "w", encoding="utf-8") as handle:
+        handle.write(payload)
+    os.replace(temporary, path)
+    # pragma: no cover - Windows ACLs do not map cleanly
+    with contextlib.suppress(OSError):
+        os.chmod(path, 0o600)
+    return path
+
+
+def get_api_key() -> str:
+    value = load_config().get("api_key")
+    return value if isinstance(value, str) else ""
+
+
+def get_base_url() -> str:
+    value = load_config().get("base_url")
+    return value if isinstance(value, str) else ""
+
+
+def get_default_dir() -> str:
+    value = load_config().get("default_dir")
+    return value if isinstance(value, str) else ""

sid_harness/context/__init__.py

@@ -0,0 +1,40 @@
+"""Repo-scale context for the SID harness (SUB-55).
+
+A local, read-only index over a whole repository plus retrieval that reuses the
+gateway's existing ``app.rag`` seam — so the agent reasons over the tree, not a
+submitted subset (design/07-agent-service.md:126-127).
+
+- ``build_index(dir_or_driver)`` -> ``RepoIndex`` (paths, languages, symbols).
+- ``retrieve_context(index, query, k=...)`` -> ``app.rag`` chunks.
+- ``context_block(index, query, k=...)`` -> sanitized, data-boundaried text.
+
+Nothing here writes to the tree or leaves the machine except as model context
+under the caller's own key. Secret / VCS / dependency paths are excluded by the
+same denylist SUB-54 uses (``local_workspace.safe_rel_path``).
+"""
+
+from .index import (
+    DEFAULT_MAX_FILE_BYTES,
+    DEFAULT_MAX_FILES,
+    DEFAULT_MAX_TOTAL_BYTES,
+    IndexedFile,
+    RepoIndex,
+    build_index,
+    extract_symbols,
+    language_of,
+)
+from .retrieval import Chunk, context_block, retrieve_context
+
+__all__ = [
+    "DEFAULT_MAX_FILES",
+    "DEFAULT_MAX_FILE_BYTES",
+    "DEFAULT_MAX_TOTAL_BYTES",
+    "Chunk",
+    "IndexedFile",
+    "RepoIndex",
+    "build_index",
+    "context_block",
+    "extract_symbols",
+    "language_of",
+    "retrieve_context",
+]

sid_harness/context/index.py

@@ -0,0 +1,267 @@
+"""Local, read-only repo index for the SID harness (SUB-55).
+
+The SUB-53/54 workspace is deliberately bounded (<=200 files / <=8 MB) because
+it is handed to the loop as in-memory ``workspace_files``. That bound is wrong
+for *context*: to reason over a repository the agent needs the whole tree, not a
+submitted subset (design/07-agent-service.md:126-127 calls full-repo
+provisioning the "later slice").
+
+This module is that slice, local and read-only:
+
+- it walks the whole tree through the SAME denylist and ``.gitignore`` SUB-54
+  already uses (``local_workspace``), so secrets / VCS / dependency paths are
+  excluded by construction — no second safety model;
+- it builds a lightweight index — path, language, size, and extracted symbol
+  names — with generous, configurable bounds and an honest ``truncated`` flag;
+- it never writes to the tree and never touches the network.
+
+Retrieval lives in ``retrieval`` and reuses the gateway's ``app.rag.retrieve``
+seam (no second RAG).
+"""
+
+from __future__ import annotations
+
+import os
+import re
+from dataclasses import dataclass
+from pathlib import Path
+
+from ..local_workspace import LocalWorkspace, LocalWorkspaceError, safe_rel_path
+
+# Repo-scale defaults: large enough for a real repository, still bounded so a
+# runaway tree cannot exhaust memory. The in-memory workspace bound (200 files
+# / 8 MB) is intentionally NOT used here.
+DEFAULT_MAX_FILES = 20000
+DEFAULT_MAX_TOTAL_BYTES = 64 * 1024 * 1024
+DEFAULT_MAX_FILE_BYTES = 512 * 1024
+
+# Pruned during the walk for speed; correctness still runs every file through
+# the shared denylist (``safe_rel_path``), which refuses the same names.
+_SKIP_DIRS = {
+    ".git",
+    ".hg",
+    ".svn",
+    "node_modules",
+    ".venv",
+    "venv",
+    "__pycache__",
+    ".mypy_cache",
+    ".ruff_cache",
+    ".pytest_cache",
+    ".tox",
+    ".idea",
+    ".vscode",
+    "dist",
+    "build",
+}
+
+_LANGUAGE_BY_SUFFIX = {
+    ".py": "python",
+    ".pyi": "python",
+    ".js": "javascript",
+    ".mjs": "javascript",
+    ".cjs": "javascript",
+    ".jsx": "javascript",
+    ".ts": "typescript",
+    ".tsx": "typescript",
+    ".go": "go",
+    ".rs": "rust",
+    ".rb": "ruby",
+    ".java": "java",
+    ".kt": "kotlin",
+    ".c": "c",
+    ".h": "c",
+    ".cc": "cpp",
+    ".cpp": "cpp",
+    ".hpp": "cpp",
+    ".cs": "csharp",
+    ".php": "php",
+    ".sh": "shell",
+    ".bash": "shell",
+    ".ps1": "powershell",
+    ".sql": "sql",
+    ".md": "markdown",
+    ".rst": "markdown",
+    ".toml": "toml",
+    ".yaml": "yaml",
+    ".yml": "yaml",
+    ".json": "json",
+    ".html": "html",
+    ".css": "css",
+}
+
+# Lightweight, deterministic symbol extraction — not a parser. Python gets
+# def/class at any indent; a generic pattern covers the common declaration
+# keywords of the other indexed languages.
+_PY_SYMBOL = re.compile(r"^[ \t]*(?:async[ \t]+)?(?:def|class)[ \t]+([A-Za-z_]\w*)", re.MULTILINE)
+_GENERIC_SYMBOL = re.compile(
+    r"^[ \t]*(?:export[ \t]+)?(?:default[ \t]+)?(?:async[ \t]+)?"
+    r"(?:function|class|interface|type|enum|struct|impl|trait|fn|func)"
+    r"[ \t]+([A-Za-z_]\w*)",
+    re.MULTILINE,
+)
+
+
+def language_of(path: str) -> str:
+    """Map a path to a coarse language label by extension ('text' otherwise)."""
+    return _LANGUAGE_BY_SUFFIX.get(Path(path).suffix.lower(), "text")
+
+
+def extract_symbols(text: str, language: str) -> tuple[str, ...]:
+    """Extract declared symbol names (deduped, source order). Deterministic."""
+    pattern = _PY_SYMBOL if language == "python" else _GENERIC_SYMBOL
+    seen: dict[str, None] = {}
+    for name in pattern.findall(text):
+        seen.setdefault(name, None)
+    return tuple(seen)
+
+
+@dataclass(frozen=True)
+class IndexedFile:
+    path: str
+    language: str
+    size: int
+    symbols: tuple[str, ...]
+    text: str
+
+
+@dataclass
+class RepoIndex:
+    """A read-only snapshot of an indexed tree."""
+
+    root: Path
+    git: dict
+    files: dict[str, IndexedFile]
+    skipped: list[tuple[str, str]]
+    truncated: bool = False
+
+    @property
+    def total_bytes(self) -> int:
+        return sum(entry.size for entry in self.files.values())
+
+    def paths(self) -> list[str]:
+        return sorted(self.files)
+
+    def entries(self) -> list[IndexedFile]:
+        return [self.files[path] for path in self.paths()]
+
+    def symbol_index(self) -> dict[str, list[str]]:
+        """Map each symbol name to the sorted paths that declare it."""
+        index: dict[str, list[str]] = {}
+        for path in self.paths():
+            for symbol in self.files[path].symbols:
+                index.setdefault(symbol, []).append(path)
+        return index
+
+    def find_symbol(self, name: str) -> list[str]:
+        return self.symbol_index().get(name, [])
+
+    def documents(self) -> list[dict]:
+        """rag-shaped documents: ``{"id": int, "title": path, "content": text}``."""
+        return [
+            {"id": index, "title": path, "content": self.files[path].text}
+            for index, path in enumerate(self.paths())
+        ]
+
+    def stats(self) -> dict:
+        languages: dict[str, int] = {}
+        for entry in self.files.values():
+            languages[entry.language] = languages.get(entry.language, 0) + 1
+        return {
+            "root": str(self.root),
+            "files": len(self.files),
+            "bytes": self.total_bytes,
+            "symbols": len(self.symbol_index()),
+            "skipped": len(self.skipped),
+            "truncated": self.truncated,
+            "languages": languages,
+        }
+
+
+def _iter_files(root: Path):
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = sorted(name for name in dirnames if name.lower() not in _SKIP_DIRS)
+        for name in sorted(filenames):
+            yield Path(dirpath) / name
+
+
+def build_index(
+    directory: str | os.PathLike[str] | LocalWorkspace,
+    *,
+    max_files: int = DEFAULT_MAX_FILES,
+    max_total_bytes: int = DEFAULT_MAX_TOTAL_BYTES,
+    max_file_bytes: int = DEFAULT_MAX_FILE_BYTES,
+) -> RepoIndex:
+    """Build a read-only repo index for ``directory`` (or an open driver).
+
+    Applies the shared denylist and the tree's ``.gitignore``; never writes.
+    """
+    workspace = directory if isinstance(directory, LocalWorkspace) else LocalWorkspace.open(directory)
+    root = workspace.root
+    ignore = workspace.gitignore.ignored
+
+    files: dict[str, IndexedFile] = {}
+    skipped: list[tuple[str, str]] = []
+    total = 0
+    truncated = False
+
+    for path in _iter_files(root):
+        rel = path.relative_to(root).as_posix()
+        try:
+            safe = safe_rel_path(rel)
+        except LocalWorkspaceError as exc:
+            skipped.append((rel, str(exc)))
+            continue
+        if ignore(rel):
+            skipped.append((rel, "gitignored"))
+            continue
+        try:
+            size = path.stat().st_size
+        except OSError as exc:
+            skipped.append((rel, f"stat failed: {exc}"))
+            continue
+        if size > max_file_bytes:
+            skipped.append((rel, f"exceeds {max_file_bytes}-byte file limit"))
+            continue
+        if len(files) >= max_files:
+            truncated = True
+            skipped.append((rel, f"exceeds {max_files}-file index limit"))
+            continue
+        if total + size > max_total_bytes:
+            truncated = True
+            skipped.append((rel, f"exceeds {max_total_bytes}-byte index limit"))
+            continue
+        try:
+            text = path.read_text(encoding="utf-8")
+        except (OSError, UnicodeDecodeError) as exc:
+            skipped.append((rel, f"not readable utf-8 text: {exc}"))
+            continue
+        language = language_of(safe)
+        files[safe] = IndexedFile(
+            path=safe,
+            language=language,
+            size=size,
+            symbols=extract_symbols(text, language),
+            text=text,
+        )
+        total += size
+
+    return RepoIndex(
+        root=root,
+        git=workspace.git.as_dict(),
+        files=files,
+        skipped=skipped,
+        truncated=truncated,
+    )
+
+
+__all__ = [
+    "DEFAULT_MAX_FILES",
+    "DEFAULT_MAX_FILE_BYTES",
+    "DEFAULT_MAX_TOTAL_BYTES",
+    "IndexedFile",
+    "RepoIndex",
+    "build_index",
+    "extract_symbols",
+    "language_of",
+]