subactor-shell 0.2.2__py3-none-any.whl

subactor_shell/terminal.py

@@ -0,0 +1,79 @@
+"""Safe terminal presentation for canonical Subactor resource links."""
+
+from __future__ import annotations
+
+import os
+import re
+from collections.abc import Mapping
+from urllib.parse import urlencode, urlsplit, urlunsplit
+
+from rich.text import Text
+
+
+_TICKET = re.compile(r"\bPLF-[0-9]{1,20}\b", re.IGNORECASE)
+_FALSE = frozenset({"0", "false", "no", "off", "never"})
+_TRUE = frozenset({"1", "true", "yes", "on", "always"})
+
+
+def terminal_hyperlinks_enabled(
+    *,
+    is_terminal: bool,
+    env: Mapping[str, str] | None = None,
+) -> bool:
+    values = os.environ if env is None else env
+    if not is_terminal:
+        return False
+    preference = values.get("SUBACTOR_TERMINAL_HYPERLINKS", "auto").strip().lower()
+    if preference in _FALSE:
+        return False
+    if preference in _TRUE:
+        return True
+    if values.get("TERM", "").lower() == "dumb":
+        return False
+    return bool(
+        values.get("WT_SESSION")
+        or values.get("VTE_VERSION")
+        or values.get("KONSOLE_VERSION")
+        or values.get("KITTY_WINDOW_ID")
+        or re.search(r"^(vscode|wezterm|iterm\.app|ghostty)$", values.get("TERM_PROGRAM", ""), re.I)
+        or re.search(r"jetbrains|jediterm", values.get("TERMINAL_EMULATOR", ""), re.I)
+        or re.search(r"kitty|wezterm|foot|contour", values.get("TERM", ""), re.I)
+    )
+
+
+def canonical_ticket_links(text: str, control_url: str, *, limit: int = 20) -> list[tuple[str, str]]:
+    parsed = urlsplit(control_url)
+    if parsed.scheme not in {"http", "https"} or not parsed.hostname:
+        return []
+    if parsed.username or parsed.password or parsed.query or parsed.fragment:
+        return []
+
+    result: list[tuple[str, str]] = []
+    seen: set[str] = set()
+    for match in _TICKET.finditer(text):
+        ticket = match.group(0).upper()
+        if ticket in seen:
+            continue
+        seen.add(ticket)
+        query = urlencode({"tab": "delegation", "action": "view", "ticket": ticket, "filter": ticket})
+        url = urlunsplit((parsed.scheme, parsed.netloc, "/", query, ""))
+        result.append((ticket, url))
+        if len(result) >= limit:
+            break
+    return result
+
+
+def ticket_link_lines(
+    text: str,
+    control_url: str,
+    *,
+    hyperlinks: bool,
+) -> list[Text]:
+    lines: list[Text] = []
+    for ticket, url in canonical_ticket_links(text, control_url):
+        line = Text("  ")
+        line.append(ticket, style="cyan")
+        line.append(": ")
+        line.append(url, style=f"link {url}" if hyperlinks else None)
+        lines.append(line)
+    return lines

subactor_shell/token_budget.py

@@ -0,0 +1,46 @@
+from __future__ import annotations
+
+import math
+from dataclasses import dataclass
+from typing import Any
+
+
+@dataclass(slots=True)
+class TokenUsage:
+    input_tokens: int = 0
+    cached_input_tokens: int = 0
+    output_tokens: int = 0
+    estimated: bool = False
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "input_tokens": max(0, int(self.input_tokens)),
+            "cached_input_tokens": max(0, int(self.cached_input_tokens)),
+            "output_tokens": max(0, int(self.output_tokens)),
+            "estimated": bool(self.estimated),
+        }
+
+    def add(self, other: "TokenUsage") -> "TokenUsage":
+        return TokenUsage(
+            input_tokens=self.input_tokens + other.input_tokens,
+            cached_input_tokens=self.cached_input_tokens + other.cached_input_tokens,
+            output_tokens=self.output_tokens + other.output_tokens,
+            estimated=self.estimated or other.estimated,
+        )
+
+
+def estimate_text_tokens(text: str) -> int:
+    """Tokenizer-independent estimate used only when an API returns no usage."""
+
+    if not text:
+        return 0
+    return max(1, math.ceil(len(text) / 3.6))
+
+
+def estimate_messages_tokens(messages: list[dict[str, Any]]) -> int:
+    total = 2
+    for item in messages:
+        total += 4
+        total += estimate_text_tokens(str(item.get("role", "")))
+        total += estimate_text_tokens(str(item.get("content", "")))
+    return total

subactor_shell/vault.py

@@ -0,0 +1,170 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Callable, Any
+from urllib.parse import quote, unquote, urlsplit
+
+import httpx
+
+
+class VaultError(RuntimeError):
+    """Vault error that never includes request bodies or secret values."""
+
+
+@dataclass(frozen=True, slots=True)
+class VaultRef:
+    mount: str
+    path: str
+    field: str
+
+    @classmethod
+    def parse(cls, value: str) -> "VaultRef":
+        parsed = urlsplit(value)
+        if parsed.scheme != "vault":
+            raise ValueError("Referencja Vault musi zaczynać się od vault://")
+        if parsed.username or parsed.password or parsed.query:
+            raise ValueError("Referencja Vault nie może zawierać danych logowania ani query")
+        mount = unquote(parsed.netloc).strip()
+        path = unquote(parsed.path).strip("/")
+        field = unquote(parsed.fragment).strip()
+        if not mount or not path or not field:
+            raise ValueError("Użyj formatu vault://MOUNT/SCIEZKA#POLE")
+        segments = [mount, *path.split("/"), field]
+        if any(not segment or segment in {".", ".."} for segment in segments):
+            raise ValueError("Nieprawidłowa ścieżka Vault")
+        return cls(mount=mount, path=path, field=field)
+
+    @property
+    def api_path(self) -> str:
+        encoded_mount = quote(self.mount, safe="")
+        encoded_path = "/".join(quote(part, safe="") for part in self.path.split("/"))
+        return f"/v1/{encoded_mount}/data/{encoded_path}"
+
+
+class VaultClient:
+    def __init__(
+        self,
+        address: str,
+        token_loader: Callable[[], str],
+        *,
+        namespace: str = "",
+        verify_tls: bool = True,
+        timeout_seconds: float = 10.0,
+        transport: httpx.BaseTransport | None = None,
+    ):
+        self.address = address.rstrip("/")
+        if not self.address.startswith(("http://", "https://")):
+            raise ValueError("vault.address musi być adresem http:// lub https://")
+        self._token_loader = token_loader
+        self.namespace = namespace.strip()
+        self.verify_tls = verify_tls
+        self.timeout_seconds = timeout_seconds
+        self.transport = transport
+
+    def _headers(self, *, wrap_ttl: str = "") -> dict[str, str]:
+        token = self._token_loader().strip()
+        if not token:
+            raise VaultError("Token Vault jest pusty")
+        headers = {"X-Vault-Token": token}
+        if self.namespace:
+            headers["X-Vault-Namespace"] = self.namespace
+        if wrap_ttl:
+            headers["X-Vault-Wrap-TTL"] = wrap_ttl
+        return headers
+
+    def _client(self) -> httpx.Client:
+        return httpx.Client(
+            base_url=self.address,
+            verify=self.verify_tls,
+            timeout=self.timeout_seconds,
+            transport=self.transport,
+        )
+
+    @staticmethod
+    def _raise_status(response: httpx.Response, operation: str) -> None:
+        request_id = response.headers.get("x-vault-request-id", "")
+        suffix = f", request_id={request_id}" if request_id else ""
+        raise VaultError(f"Vault: {operation} zakończone HTTP {response.status_code}{suffix}")
+
+    def read_field(self, reference: str | VaultRef) -> str:
+        ref = reference if isinstance(reference, VaultRef) else VaultRef.parse(reference)
+        try:
+            with self._client() as client:
+                response = client.get(ref.api_path, headers=self._headers())
+        except httpx.HTTPError as exc:
+            raise VaultError(f"Vault: błąd połączenia podczas odczytu ({type(exc).__name__})") from exc
+        if response.status_code != 200:
+            self._raise_status(response, "odczyt")
+        try:
+            value = response.json()["data"]["data"][ref.field]
+        except (KeyError, TypeError, ValueError) as exc:
+            raise VaultError(f"Vault: brak pola '{ref.field}' w odpowiedzi KV v2") from exc
+        if not isinstance(value, (str, int, float, bool)):
+            raise VaultError(f"Vault: pole '{ref.field}' nie jest wartością skalarną")
+        return str(value)
+
+    def write_field(self, reference: str | VaultRef, value: str) -> None:
+        ref = reference if isinstance(reference, VaultRef) else VaultRef.parse(reference)
+        headers = self._headers()
+        headers["Content-Type"] = "application/merge-patch+json"
+        try:
+            with self._client() as client:
+                patch = client.patch(ref.api_path, headers=headers, json={"data": {ref.field: value}})
+                if patch.status_code in {200, 204}:
+                    return
+                if patch.status_code not in {400, 403, 404, 405}:
+                    self._raise_status(patch, "zapis PATCH")
+
+                # Bezpieczny fallback: odczyt i zapis z CAS. Nie nadpisujemy
+                # pozostałych pól na ślepo, gdy PATCH jest wyłączony.
+                read = client.get(ref.api_path, headers=self._headers())
+                if read.status_code == 404:
+                    current: dict[str, Any] = {}
+                    version = 0
+                elif read.status_code == 200:
+                    payload = read.json().get("data", {})
+                    current = dict(payload.get("data", {}))
+                    version = int(payload.get("metadata", {}).get("version", 0))
+                else:
+                    self._raise_status(read, "odczyt przed zapisem CAS")
+                current[ref.field] = value
+                post = client.post(
+                    ref.api_path,
+                    headers=self._headers(),
+                    json={"options": {"cas": version}, "data": current},
+                )
+                if post.status_code not in {200, 204}:
+                    self._raise_status(post, "zapis CAS")
+        except httpx.HTTPError as exc:
+            raise VaultError(f"Vault: błąd połączenia podczas zapisu ({type(exc).__name__})") from exc
+
+    def wrap_read(self, reference: str | VaultRef, ttl: str = "5m") -> str:
+        """Return a one-time Vault wrapping token for the whole KV response."""
+        ref = reference if isinstance(reference, VaultRef) else VaultRef.parse(reference)
+        if not ttl or len(ttl) > 16:
+            raise ValueError("Nieprawidłowy TTL wrappingu")
+        try:
+            with self._client() as client:
+                response = client.get(ref.api_path, headers=self._headers(wrap_ttl=ttl))
+        except httpx.HTTPError as exc:
+            raise VaultError(f"Vault: błąd połączenia podczas wrappingu ({type(exc).__name__})") from exc
+        if response.status_code != 200:
+            self._raise_status(response, "response wrapping")
+        try:
+            token = response.json()["wrap_info"]["token"]
+        except (KeyError, TypeError, ValueError) as exc:
+            raise VaultError("Vault: odpowiedź nie zawiera wrapping tokenu") from exc
+        if not isinstance(token, str) or not token:
+            raise VaultError("Vault: pusty wrapping token")
+        return token
+
+    def health(self) -> tuple[bool, str]:
+        try:
+            with self._client() as client:
+                response = client.get("/v1/sys/health")
+        except httpx.HTTPError as exc:
+            return False, f"błąd połączenia ({type(exc).__name__})"
+        # 200 active, 429 standby, 472/473 DR/performance standby są osiągalne.
+        if response.status_code in {200, 429, 472, 473}:
+            return True, f"HTTP {response.status_code}"
+        return False, f"HTTP {response.status_code}"