synth-ai 0.2.9.dev0__py3-none-any.whl → 0.2.23.dev3__py3-none-any.whl

synth_ai/utils/task_app_env.py

@@ -0,0 +1,186 @@
+import os
+
+import click
+
+from .base_url import PROD_BASE_URL_DEFAULT
+from .env import mask_str, resolve_env_var
+from .process import ensure_local_port_available
+from .task_app_state import persist_env_api_key
+from .user_config import load_user_env, update_user_config
+
+__all__ = [
+    "ensure_env_credentials",
+    "ensure_port_free",
+    "preflight_env_key",
+]
+
+
+def ensure_env_credentials(*, require_synth: bool = False, prompt: bool = True) -> None:
+    """Ensure required API keys are present in the process environment."""
+
+    load_user_env(override=False)
+
+    env_key = (os.environ.get("ENVIRONMENT_API_KEY") or "").strip()
+    if prompt and not env_key:
+        resolve_env_var("ENVIRONMENT_API_KEY")
+        env_key = (os.environ.get("ENVIRONMENT_API_KEY") or "").strip()
+
+    if env_key:
+        update_user_config(
+            {
+                "ENVIRONMENT_API_KEY": env_key,
+                "DEV_ENVIRONMENT_API_KEY": env_key,
+            }
+        )
+        persist_env_api_key(env_key)
+    elif prompt:
+        raise click.ClickException("ENVIRONMENT_API_KEY is required.")
+
+    synth_key = (os.environ.get("SYNTH_API_KEY") or "").strip()
+    if prompt and (require_synth or not synth_key):
+        resolve_env_var("SYNTH_API_KEY")
+        synth_key = (os.environ.get("SYNTH_API_KEY") or "").strip()
+
+    if synth_key:
+        update_user_config({"SYNTH_API_KEY": synth_key})
+    elif require_synth and prompt:
+        raise click.ClickException("SYNTH_API_KEY is required.")
+
+
+def ensure_port_free(port: int, host: str, *, force: bool) -> None:
+    """Ensure a TCP port is not in use, optionally killing processes when ``force`` is True."""
+
+    if ensure_local_port_available(host, port, force=force):
+        return
+
+    message = f"Port {port} is still in use. Stop the running server and try again."
+    if force:
+        raise click.ClickException(message)
+    raise click.ClickException(f"Port {port} appears to be in use. Restart with --force to terminate it.")
+
+
+def preflight_env_key(*, crash_on_failure: bool = False) -> None:
+    """Ensure ENVIRONMENT_API_KEY exists and attempt a backend registration."""
+
+    ensure_env_credentials(require_synth=False, prompt=not crash_on_failure)
+    load_user_env(override=False)
+
+    raw_backend = (
+        os.environ.get("BACKEND_BASE_URL")
+        or os.environ.get("SYNTH_BASE_URL")
+        or f"{PROD_BASE_URL_DEFAULT}/api"
+    )
+    backend_base = raw_backend.rstrip("/")
+    if not backend_base.endswith("/api"):
+        backend_base += "/api"
+
+    synth_key = os.environ.get("SYNTH_API_KEY") or ""
+    env_api_key = (os.environ.get("ENVIRONMENT_API_KEY") or "").strip()
+
+    def _mint_key() -> str | None:
+        try:
+            from synth_ai.learning.rl.secrets import mint_environment_api_key
+
+            key = mint_environment_api_key()
+            os.environ["ENVIRONMENT_API_KEY"] = key
+            os.environ.setdefault("DEV_ENVIRONMENT_API_KEY", key)
+            update_user_config(
+                {
+                    "ENVIRONMENT_API_KEY": key,
+                    "DEV_ENVIRONMENT_API_KEY": key,
+                }
+            )
+            persist_env_api_key(key)
+            click.echo(f"[preflight] minted ENVIRONMENT_API_KEY ({mask_str(key)})")
+            return key
+        except Exception as exc:  # pragma: no cover - defensive fallback
+            if crash_on_failure:
+                raise click.ClickException(
+                    f"[CRITICAL] Failed to mint ENVIRONMENT_API_KEY: {exc}"
+                ) from exc
+            click.echo(
+                f"[WARN] Failed to mint ENVIRONMENT_API_KEY automatically ({exc}); proceeding without upload"
+            )
+            return None
+
+    minted = False
+    if not env_api_key:
+        env_api_key = _mint_key() or ""
+        minted = bool(env_api_key)
+
+    if not env_api_key:
+        if crash_on_failure:
+            raise click.ClickException(
+                "[CRITICAL] ENVIRONMENT_API_KEY missing; run `synth-ai setup` to configure it."
+            )
+        click.echo("[preflight] ENVIRONMENT_API_KEY missing; continuing without verification.")
+        return
+
+    if minted:
+        persist_env_api_key(env_api_key)
+
+    if not synth_key.strip():
+        click.echo("[preflight] SYNTH_API_KEY not set; skipping backend preflight.")
+        return
+
+    try:
+        import base64
+
+        import httpx
+        from nacl.public import PublicKey, SealedBox
+    except Exception:  # pragma: no cover - optional deps
+        click.echo("[preflight] Optional crypto dependencies missing; skipping upload.")
+        return
+
+    try:
+        with httpx.Client(timeout=15.0, headers={"Authorization": f"Bearer {synth_key}"}) as client:
+            click.echo(f"[preflight] backend={backend_base}")
+            click.echo("[preflight] fetching public key…")
+            rpk = client.get(f"{backend_base.rstrip('/')}/v1/crypto/public-key")
+            if rpk.status_code != 200:
+                click.echo(f"[preflight] public key fetch failed with {rpk.status_code}; skipping upload")
+                return
+            pk = (rpk.json() or {}).get("public_key")
+            if not pk:
+                click.echo("[preflight] no public key returned; skipping upload")
+                return
+
+            pk_bytes = base64.b64decode(pk, validate=True)
+            sealed_box = SealedBox(PublicKey(pk_bytes))
+            ciphertext = sealed_box.encrypt(env_api_key.encode("utf-8"))
+            ct_b64 = base64.b64encode(ciphertext).decode()
+            payload = {"name": "ENVIRONMENT_API_KEY", "ciphertext_b64": ct_b64}
+
+            click.echo(f"[preflight] posting to {backend_base.rstrip('/')}/v1/env-keys")
+            response = client.post(f"{backend_base.rstrip('/')}/v1/env-keys", json=payload)
+            if 200 <= response.status_code < 300:
+                click.echo(
+                    f"✅ ENVIRONMENT_API_KEY uploaded successfully ({mask_str(env_api_key)})"
+                )
+                try:
+                    ver = client.get(f"{backend_base.rstrip('/')}/v1/env-keys/verify")
+                    if ver.status_code == 200 and (ver.json() or {}).get("present"):
+                        click.echo("✅ Key verified in backend")
+                    else:
+                        click.echo(
+                            f"⚠️  Verification returned {ver.status_code}, but upload succeeded - proceeding"
+                        )
+                except Exception as verify_err:  # pragma: no cover - verification optional
+                    click.echo(
+                        f"⚠️  Verification check failed ({verify_err}), but upload succeeded - proceeding"
+                    )
+                return
+
+            snippet = response.text[:400] if response.text else ""
+            message = (
+                f"ENVIRONMENT_API_KEY upload failed with status {response.status_code}"
+                + (f" body={snippet}" if snippet else "")
+            )
+            if crash_on_failure:
+                raise click.ClickException(f"[CRITICAL] {message}")
+            click.echo(f"[WARN] {message}; proceeding anyway")
+    except Exception as exc:  # pragma: no cover - network failures
+        message = f"Backend preflight for ENVIRONMENT_API_KEY failed: {exc}"
+        if crash_on_failure:
+            raise click.ClickException(f"[CRITICAL] {message}") from exc
+        click.echo(f"[WARN] {message}; proceeding anyway")

synth_ai/utils/task_app_state.py

@@ -0,0 +1,318 @@
+import json
+import os
+from collections.abc import Callable
+from datetime import UTC, datetime
+from pathlib import Path
+from typing import Any
+
+DEFAULT_TASK_APP_SECRET_NAME = "synth-demo-task-app-secret"
+
+__all__ = [
+    "DEFAULT_TASK_APP_SECRET_NAME",
+    "current_task_app_id",
+    "load_demo_dir",
+    "load_template_id",
+    "now_iso",
+    "persist_api_key",
+    "persist_demo_dir",
+    "persist_env_api_key",
+    "persist_task_url",
+    "persist_template_id",
+    "read_task_app_config",
+    "record_task_app",
+    "resolve_task_app_entry",
+    "task_app_config_path",
+    "task_app_id_from_path",
+    "update_task_app_entry",
+    "write_task_app_config",
+]
+
+
+def task_app_config_path() -> str:
+    return os.path.expanduser("~/.synth-ai/task_app_config.json")
+
+
+def read_task_app_config() -> dict[str, Any]:
+    path = task_app_config_path()
+    try:
+        if os.path.isfile(path):
+            with open(path, encoding="utf-8") as handle:
+                loaded = json.load(handle) or {}
+                if isinstance(loaded, dict):
+                    apps = loaded.get("apps")
+                    if isinstance(apps, dict):
+                        return apps
+    except Exception:
+        pass
+    return {}
+
+
+def write_task_app_config(apps: dict[str, Any]) -> None:
+    payload = {"apps": apps}
+    try:
+        path = task_app_config_path()
+        os.makedirs(os.path.dirname(path), exist_ok=True)
+        with open(path, "w", encoding="utf-8") as handle:
+            json.dump(payload, handle, indent=2, sort_keys=True)
+    except Exception:
+        pass
+
+
+def now_iso() -> str:
+    return (
+        datetime.now(UTC)
+        .replace(microsecond=0)
+        .isoformat()
+        .replace("+00:00", "Z")
+    )
+
+
+def task_app_id_from_path(path: str | Path | None) -> str | None:
+    if not path:
+        return None
+    try:
+        return str(Path(path).expanduser().resolve())
+    except Exception:
+        return None
+
+
+def current_task_app_id() -> str | None:
+    try:
+        return str(Path.cwd().resolve())
+    except Exception:
+        return None
+
+
+def update_task_app_entry(
+    path: str | Path | None,
+    *,
+    template_id: str | None = None,
+    mutate: Callable[[dict[str, Any]], None] | None = None,
+) -> dict[str, Any]:
+    task_id = task_app_id_from_path(path)
+    if task_id is None:
+        task_id = current_task_app_id()
+    if task_id is None:
+        return {}
+
+    apps = read_task_app_config()
+    now = now_iso()
+    entry = apps.get(task_id)
+    if entry is None:
+        entry = {
+            "task_app_path": task_id,
+            "template_id": template_id,
+            "created_at": now,
+            "last_used": now,
+            "modal": {
+                "app_name": None,
+                "base_url": None,
+                "secret_name": DEFAULT_TASK_APP_SECRET_NAME,
+                "created_at": None,
+                "last_used": None,
+            },
+        }
+        apps[task_id] = entry
+    else:
+        entry.setdefault(
+            "modal",
+            {
+                "app_name": None,
+                "base_url": None,
+                "secret_name": DEFAULT_TASK_APP_SECRET_NAME,
+                "created_at": None,
+                "last_used": None,
+            },
+        )
+        if template_id is not None:
+            entry["template_id"] = template_id
+
+    if mutate is not None:
+        mutate(entry)
+
+    entry["last_used"] = now
+    write_task_app_config(apps)
+    return entry
+
+
+def record_task_app(
+    path: str,
+    *,
+    template_id: str | None = None,
+    secret_name: str | None = None,
+) -> None:
+
+    def _mutate(entry: dict[str, Any]) -> None:
+        if secret_name:
+            modal_block = entry.setdefault(
+                "modal",
+                {
+                    "app_name": None,
+                    "base_url": None,
+                    "secret_name": DEFAULT_TASK_APP_SECRET_NAME,
+                    "created_at": None,
+                    "last_used": None,
+                },
+            )
+            modal_block["secret_name"] = secret_name
+
+    update_task_app_entry(path, template_id=template_id, mutate=_mutate if secret_name else None)
+
+
+def _select_entry(
+    *,
+    preferred_path: str | None = None,
+    predicate: Callable[[dict[str, Any]], bool] | None = None,
+) -> tuple[str | None, dict[str, Any]]:
+    entries = read_task_app_config()
+    if not entries:
+        return None, {}
+
+    def _matches(entry: dict[str, Any]) -> bool:
+        return predicate(entry) if predicate is not None else True
+
+    if preferred_path:
+        entry = entries.get(preferred_path)
+        if isinstance(entry, dict) and _matches(entry):
+            return preferred_path, entry
+
+    try:
+        cwd = str(Path.cwd().resolve())
+        entry = entries.get(cwd)
+        if isinstance(entry, dict) and _matches(entry):
+            return cwd, entry
+    except Exception:
+        pass
+
+    best_path: str | None = None
+    best_entry: dict[str, Any] = {}
+    best_ts = ""
+    for path, entry in entries.items():
+        if not isinstance(entry, dict) or not _matches(entry):
+            continue
+        ts = str(entry.get("last_used") or "")
+        if ts > best_ts:
+            best_ts = ts
+            best_path = path
+            best_entry = entry
+    return best_path, best_entry
+
+
+def resolve_task_app_entry(
+    preferred_path: str | None = None,
+    *,
+    predicate: Callable[[dict[str, Any]], bool] | None = None,
+) -> tuple[str | None, dict[str, Any]]:
+    path, entry = _select_entry(preferred_path=preferred_path, predicate=predicate)
+    return path, entry if isinstance(entry, dict) else {}
+
+
+def persist_demo_dir(demo_dir: str) -> None:
+    def _mutate(entry: dict[str, Any]) -> None:
+        entry["is_demo"] = True
+
+    update_task_app_entry(demo_dir, mutate=_mutate)
+
+
+def load_demo_dir() -> str | None:
+    path, _ = _select_entry(predicate=lambda entry: entry.get("is_demo") or entry.get("template_id"))
+    return path
+
+
+def persist_template_id(template_id: str | None) -> None:
+    demo_dir = load_demo_dir() or current_task_app_id()
+    if demo_dir is None:
+        return
+    update_task_app_entry(demo_dir, template_id=template_id)
+
+
+def load_template_id() -> str | None:
+    _, entry = _select_entry(predicate=lambda item: item.get("template_id"))
+    value = entry.get("template_id") if isinstance(entry, dict) else None
+    return str(value) if isinstance(value, str) else None
+
+
+def persist_api_key(key: str) -> None:
+    target = load_demo_dir() or current_task_app_id()
+
+    def _mutate(entry: dict[str, Any]) -> None:
+        secrets = entry.setdefault("secrets", {})
+        secrets["synth_api_key"] = key
+
+    update_task_app_entry(target, mutate=_mutate)
+
+
+def persist_env_api_key(key: str, path: str | Path | None = None) -> None:
+    target = path or load_demo_dir()
+
+    def _mutate(entry: dict[str, Any]) -> None:
+        secrets = entry.setdefault("secrets", {})
+        secrets["environment_api_key"] = key
+
+    update_task_app_entry(target, mutate=_mutate)
+
+
+def _derive_modal_app_name(url: str | None) -> str | None:
+    if not url:
+        return None
+    try:
+        from urllib.parse import urlparse
+
+        host = urlparse(url).hostname or ""
+        if "--" not in host:
+            return None
+        suffix = host.split("--", 1)[1]
+        core = suffix.split(".modal", 1)[0]
+        if core.endswith("-fastapi-app"):
+            core = core[: -len("-fastapi-app")]
+        return core.strip() or None
+    except Exception:
+        return None
+
+
+def persist_task_url(url: str, *, name: str | None = None, path: str | None = None) -> None:
+    normalized_url = (url or "").rstrip("/")
+    task_id = task_app_id_from_path(path) or current_task_app_id()
+    if task_id is None:
+        return
+
+    existing = read_task_app_config().get(task_id, {})
+    previous_modal = dict(existing.get("modal", {})) if isinstance(existing, dict) else {}
+
+    derived_name = name or _derive_modal_app_name(normalized_url)
+
+    def _mutate(entry: dict[str, Any]) -> None:
+        modal_block = entry.setdefault(
+            "modal",
+            {
+                "app_name": None,
+                "base_url": None,
+                "secret_name": DEFAULT_TASK_APP_SECRET_NAME,
+                "created_at": None,
+                "last_used": None,
+            },
+        )
+        now = now_iso()
+        if modal_block.get("created_at") is None:
+            modal_block["created_at"] = now
+        modal_block["last_used"] = now
+        modal_block["base_url"] = normalized_url
+        if derived_name:
+            modal_block["app_name"] = derived_name
+        modal_block["secret_name"] = DEFAULT_TASK_APP_SECRET_NAME
+
+    entry = update_task_app_entry(path or task_id, mutate=_mutate)
+
+    modal_after = entry.get("modal", {}) if isinstance(entry, dict) else {}
+    changed: list[str] = []
+    if previous_modal.get("base_url") != modal_after.get("base_url"):
+        changed.append("TASK_APP_BASE_URL")
+    if derived_name and previous_modal.get("app_name") != modal_after.get("app_name"):
+        changed.append("TASK_APP_NAME")
+    if previous_modal.get("secret_name") != modal_after.get("secret_name"):
+        changed.append("TASK_APP_SECRET_NAME")
+
+    if changed:
+        print(f"Saved {', '.join(changed)} to {task_app_config_path()}")
+        if "TASK_APP_SECRET_NAME" in changed:
+            print(f"TASK_APP_SECRET_NAME={DEFAULT_TASK_APP_SECRET_NAME}")

synth_ai/utils/tunnel/__init__.py

@@ -0,0 +1,12 @@
+"""
+Cloudflare Tunnel utilities.
+
+This module provides utilities for managing Cloudflare Tunnel deployments,
+including credential storage and configuration.
+"""
+from synth_ai.utils.tunnel.config import store_tunnel_credentials
+
+__all__ = [
+    "store_tunnel_credentials",
+]
+

synth_ai/utils/tunnel/config.py

@@ -0,0 +1,55 @@
+"""
+Utility functions for storing tunnel credentials in .env files.
+"""
+from pathlib import Path
+from typing import Optional
+
+from synth_ai.utils.env import write_env_var_to_dotenv
+
+
+def store_tunnel_credentials(
+    tunnel_url: str,
+    access_client_id: Optional[str] = None,
+    access_client_secret: Optional[str] = None,
+    env_file: Optional[Path] = None,
+) -> None:
+    """
+    Store tunnel credentials in .env file for optimizer to use.
+    
+    Writes:
+    - TASK_APP_URL=<tunnel_url>
+    - CF_ACCESS_CLIENT_ID=<client_id> (if Access enabled)
+    - CF_ACCESS_CLIENT_SECRET=<client_secret> (if Access enabled)
+    
+    Args:
+        tunnel_url: Public tunnel URL (e.g., "https://cust-abc123.usesynth.ai")
+        access_client_id: Cloudflare Access client ID (optional)
+        access_client_secret: Cloudflare Access client secret (optional)
+        env_file: Path to .env file (defaults to .env in current directory)
+    """
+    write_env_var_to_dotenv(
+        "TASK_APP_URL",
+        tunnel_url,
+        output_file_path=env_file,
+        print_msg=True,
+        mask_msg=False,
+    )
+    
+    if access_client_id:
+        write_env_var_to_dotenv(
+            "CF_ACCESS_CLIENT_ID",
+            access_client_id,
+            output_file_path=env_file,
+            print_msg=True,
+            mask_msg=True,
+        )
+    
+    if access_client_secret:
+        write_env_var_to_dotenv(
+            "CF_ACCESS_CLIENT_SECRET",
+            access_client_secret,
+            output_file_path=env_file,
+            print_msg=True,
+            mask_msg=True,
+        )
+