talkops-opscloud 0.3.0b1__py3-none-any.whl

opscloud/mcp/trust.py

@@ -0,0 +1,105 @@
+"""SHA-256 trust store for project-level MCP configs.
+
+Before loading a project-level ``.mcp.json``, the trust store checks
+whether the file's SHA-256 fingerprint has been previously approved.
+This prevents untrusted configs from spawning processes.
+
+Usage::
+
+    from opscloud.mcp.trust import MCPTrustStore
+
+    trust = MCPTrustStore()
+    if trust.is_trusted(config_path):
+        # load and use
+    else:
+        # prompt user to trust
+        trust.trust(config_path)
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+
+from opscloud.config import paths
+from opscloud.utils.logger import AgentLogger
+
+logger = AgentLogger("MCPTrust")
+
+
+class MCPTrustStore:
+    """SHA-256 trust gating for project-level MCP configuration files.
+
+    Trust state is persisted as a JSON file at
+    ``~/.opscloud/.state/mcp_trust.json``.
+    """
+
+    TRUST_FILE = paths.MCP_TRUST_PATH
+
+    def __init__(self, trust_file: Path | None = None) -> None:
+        """Initialize MCPTrustStore with trust persistence file.
+
+        Args:
+            trust_file: Optional explicit path to the JSON trust store file.
+        """
+        self._trust_file = trust_file or self.TRUST_FILE
+        self._trusted: dict[str, str] = self._load()
+
+    def _load(self) -> dict[str, str]:
+        """Load trusted fingerprints from disk."""
+        if self._trust_file.exists():
+            try:
+                data = json.loads(self._trust_file.read_text(encoding="utf-8"))
+                return data.get("trusted", {})
+            except Exception as e:
+                logger.warning(f"Failed to load MCP trust store at {self._trust_file}: {e}")
+        return {}
+
+    def _save(self) -> None:
+        """Persist trusted fingerprints to disk."""
+        self._trust_file.parent.mkdir(parents=True, exist_ok=True)
+        self._trust_file.write_text(
+            json.dumps({"trusted": self._trusted}, indent=2),
+            encoding="utf-8",
+        )
+
+    def _fingerprint(self, config_path: Path) -> str:
+        """Compute SHA-256 of a config file."""
+        return hashlib.sha256(config_path.read_bytes()).hexdigest()
+
+    def is_trusted(self, config_path: Path) -> bool:
+        """Check if a config file's current content is trusted.
+
+        Returns True if the file's SHA-256 matches a previously
+        trusted fingerprint.
+        """
+        if not config_path.exists():
+            return False
+
+        key = str(config_path.resolve())
+        current = self._fingerprint(config_path)
+        return self._trusted.get(key) == current
+
+    def trust(self, config_path: Path) -> None:
+        """Mark a config file's current content as trusted.
+
+        Stores the SHA-256 fingerprint so future ``is_trusted()``
+        checks pass.
+        """
+        if not config_path.exists():
+            logger.warning(f"Cannot trust non-existent file: {config_path}")
+            return
+
+        key = str(config_path.resolve())
+        self._trusted[key] = self._fingerprint(config_path)
+        self._save()
+        logger.info(f"Trusted MCP config: {config_path}")
+
+    def revoke(self, config_path: Path) -> None:
+        """Revoke trust for a config file."""
+        key = str(config_path.resolve())
+        if key in self._trusted:
+            del self._trusted[key]
+            self._save()
+            logger.info(f"Revoked trust for MCP config: {config_path}")

opscloud/memory/__init__.py

@@ -0,0 +1,27 @@
+"""Persistent memory, onboarding wizard, and storage for opscloud."""
+
+from opscloud.memory.branch import BranchMemoryEntry, BranchMemoryStore
+from opscloud.memory.guard import ManagedMemoryGuardMiddleware
+from opscloud.memory.onboarding import (
+    ONBOARDING_NAME_MEMORY_END,
+    ONBOARDING_NAME_MEMORY_START,
+    extract_onboarding_name_block,
+    run_onboarding_if_needed,
+    strip_onboarding_name_markers,
+)
+from opscloud.memory.registry import MemoryRegistry
+from opscloud.memory.store import MemoryEntry, MemoryStore
+
+__all__ = [
+    "MemoryRegistry",
+    "ManagedMemoryGuardMiddleware",
+    "MemoryStore",
+    "MemoryEntry",
+    "BranchMemoryStore",
+    "BranchMemoryEntry",
+    "run_onboarding_if_needed",
+    "extract_onboarding_name_block",
+    "strip_onboarding_name_markers",
+    "ONBOARDING_NAME_MEMORY_START",
+    "ONBOARDING_NAME_MEMORY_END",
+]

opscloud/memory/branch.py

@@ -0,0 +1,61 @@
+"""Subagent branch memory storage for isolated learning persistence."""
+
+from __future__ import annotations
+
+from opscloud.utils.logger import get_logger
+import time
+import uuid
+from dataclasses import dataclass
+from pathlib import Path
+
+from opscloud.config.settings import settings
+
+logger = get_logger(__name__)
+
+
+@dataclass(frozen=True)
+class BranchMemoryEntry:
+    run_id: str
+    subagent_name: str
+    content: str
+    path: Path
+    created_at: float
+
+
+class BranchMemoryStore:
+    """Manages branch memory files under .opscloud/memories/{subagent_name}-{run_id}.md"""
+
+    def __init__(
+        self,
+        subagent_name: str,
+        *,
+        run_id: str | None = None,
+        project_root: Path | None = None,
+    ) -> None:
+        self.subagent_name = subagent_name
+        self.run_id = run_id or uuid.uuid4().hex[:8]
+        root = project_root or settings.project_root or Path.cwd()
+        self.memories_dir = root / ".opscloud" / "memories"
+        self.branch_file = self.memories_dir / f"{self.subagent_name}-{self.run_id}.md"
+
+    def write_observation(self, content: str) -> Path:
+        self.memories_dir.mkdir(parents=True, exist_ok=True)
+        timestamp = time.strftime("%Y-%m-%d %H:%M:%S")
+        entry_text = f"\n\n### [{timestamp}] Observation ({self.subagent_name})\n{content.strip()}"
+
+        if not self.branch_file.exists():
+            header = f"# Branch Memory: {self.subagent_name} (Run ID: {self.run_id})\nCreated at: {timestamp}"
+            self.branch_file.write_text(header + entry_text, encoding="utf-8")
+        else:
+            with self.branch_file.open("a", encoding="utf-8") as f:
+                f.write(entry_text)
+
+        return self.branch_file
+
+    def get_content(self) -> str:
+        if self.branch_file.is_file():
+            try:
+                return self.branch_file.read_text(encoding="utf-8")
+            except OSError:
+                return ""
+        return ""

opscloud/memory/guard.py

@@ -0,0 +1,19 @@
+"""Protect machine-managed memory blocks from agent edits while allowing user memory updates."""
+
+from __future__ import annotations
+
+from opscloud.middleware.memory_guard import (
+    ONBOARDING_NAME_MEMORY_END,
+    ONBOARDING_NAME_MEMORY_START,
+    ManagedMemoryGuardMiddleware,
+    extract_onboarding_name_block,
+    strip_onboarding_name_markers,
+)
+
+__all__ = [
+    "ManagedMemoryGuardMiddleware",
+    "ONBOARDING_NAME_MEMORY_START",
+    "ONBOARDING_NAME_MEMORY_END",
+    "extract_onboarding_name_block",
+    "strip_onboarding_name_markers",
+]

opscloud/memory/onboarding.py

@@ -0,0 +1,120 @@
+"""First-run interactive onboarding wizard and memory preference management for opscloud."""
+
+from __future__ import annotations
+
+import logging
+from pathlib import Path
+import sys
+
+from opscloud.config.paths import DATA_DIR, ensure_agent_dir, user_agent_md
+from opscloud.utils.logger import get_logger
+
+logger = get_logger(__name__)
+
+ONBOARDING_NAME_MEMORY_START = "<!-- opscloud:onboarding-name:start -->"
+ONBOARDING_NAME_MEMORY_END = "<!-- opscloud:onboarding-name:end -->"
+
+
+def _normalize_memory_name(name: str) -> str:
+    return " ".join(name.split())
+
+
+def _onboarding_name_memory_block(
+    name: str = "Cloud Platform & DevOps Engineer",
+    provider: str = "custom-model",
+    cloud: str = "AWS",
+    region: str = "us-east-1",
+    iac: str = "Terraform",
+) -> str:
+    """Format the machine-managed onboarding block with comment markers."""
+    return (
+        f"{ONBOARDING_NAME_MEMORY_START}\n"
+        f"- The user's role/name is \"{name}\".\n"
+        f"- Primary Cloud Provider: {cloud}\n"
+        f"- Default Region: {region}\n"
+        f"- IaC Tool Preference: {iac}\n"
+        f"- Primary Model Provider: {provider}\n"
+        f"{ONBOARDING_NAME_MEMORY_END}"
+    )
+
+
+def _upsert_onboarding_name_memory(existing: str, block: str) -> str:
+    """Insert or replace the machine-managed onboarding block."""
+    start = existing.find(ONBOARDING_NAME_MEMORY_START)
+    end = existing.find(ONBOARDING_NAME_MEMORY_END)
+    if start != -1 and end != -1 and start < end:
+        end += len(ONBOARDING_NAME_MEMORY_END)
+        prefix = existing[:start].rstrip()
+        suffix = existing[end:].strip()
+        parts = [part for part in (prefix, block, suffix) if part]
+        return "\n\n".join(parts).rstrip() + "\n"
+
+    base = existing.rstrip()
+    if not base:
+        return f"## User Preferences & Defaults\n\n{block}\n"
+    if "## User Preferences" in base or "## User Preferences & Defaults" in base:
+        return f"{base}\n\n{block}\n"
+    return f"{base}\n\n## User Preferences & Defaults\n\n{block}\n"
+
+
+def extract_onboarding_name_block(text: str) -> str | None:
+    """Extract the managed onboarding block (including markers) if present."""
+    start = text.find(ONBOARDING_NAME_MEMORY_START)
+    end = text.find(ONBOARDING_NAME_MEMORY_END)
+    if start == -1 or end == -1 or start >= end:
+        return None
+    return text[start : end + len(ONBOARDING_NAME_MEMORY_END)]
+
+
+def strip_onboarding_name_markers(text: str) -> str:
+    """Remove onboarding markers from text while preserving inner content."""
+    return text.replace(ONBOARDING_NAME_MEMORY_START, "").replace(
+        ONBOARDING_NAME_MEMORY_END, ""
+    )
+
+
+def run_onboarding_if_needed(agent_name: str = "opscloud") -> None:
+    """Run onboarding on interactive terminal if user AGENTS.md is missing or empty."""
+    user_md = user_agent_md(agent_name)
+    if user_md.is_file() and user_md.stat().st_size > 0:
+        return
+
+    # Check if standard input is interactive
+    if not sys.stdin.isatty():
+        logger.info("Non-interactive terminal detected; seeding default cloud preferences.")
+        block = _onboarding_name_memory_block()
+        try:
+            ensure_agent_dir(agent_name)
+            user_md.write_text(f"## User Preferences & Defaults\n\n{block}\n", encoding="utf-8")
+        except OSError as e:
+            logger.error("Failed to write default onboarding memory file: %s", e)
+        return
+
+    print("====================================================")
+    print("      Welcome to OpsCloud Setup & Preferences!      ")
+    print("====================================================")
+    try:
+        name = input("Enter your preferred name or role (default: Cloud Platform & DevOps Engineer): ").strip() or "Cloud Platform & DevOps Engineer"
+        cloud = input("Primary Cloud Provider (AWS, GCP, Azure, Multi, default: AWS): ").strip() or "AWS"
+        region = input("Default Region (e.g. us-east-1, us-west-2, default: us-east-1): ").strip() or "us-east-1"
+        iac = input("IaC Tool Preference (Terraform, OpenTofu, Helm, None, default: Terraform): ").strip() or "Terraform"
+        provider = input("LLM Model / Provider (default: anthropic): ").strip() or "anthropic"
+    except (KeyboardInterrupt, EOFError):
+        print("\nOnboarding aborted. Using default configuration.")
+        name, cloud, region, iac, provider = (
+            "Cloud Platform & DevOps Engineer",
+            "AWS",
+            "us-east-1",
+            "Terraform",
+            "anthropic",
+        )
+
+    block = _onboarding_name_memory_block(
+        name=name, provider=provider, cloud=cloud, region=region, iac=iac
+    )
+    try:
+        ensure_agent_dir(agent_name)
+        user_md.write_text(f"## User Preferences & Defaults\n\n{block}\n", encoding="utf-8")
+        print(f"Setup complete! Preferences saved to {user_md}")
+    except OSError as e:
+        logger.error("Failed to write onboarding memory file: %s", e)

opscloud/memory/registry.py

@@ -0,0 +1,134 @@
+"""Memory management and discovery across user and project scopes for opscloud."""
+
+from __future__ import annotations
+
+from pathlib import Path
+import threading
+from typing import Any
+
+from langgraph.store.base import BaseStore
+
+from opscloud.utils.logger import get_logger
+
+logger = get_logger(__name__)
+
+
+class MemoryRegistry:
+    """Discovers and manages memory files across user and project scopes."""
+
+    _instance: MemoryRegistry | None = None
+    _lock = threading.Lock()
+
+    def __init__(self, store: BaseStore | None = None) -> None:
+        """Initialize MemoryRegistry.
+
+        Args:
+            store: Optional LangGraph BaseStore instance.
+        """
+        self._store = store
+
+    @classmethod
+    def get_instance(cls, store: BaseStore | None = None) -> MemoryRegistry:
+        """Retrieve the singleton instance of MemoryRegistry.
+
+        Args:
+            store: Optional store to configure if not already set.
+
+        Returns:
+            MemoryRegistry: The singleton registry instance.
+        """
+        if cls._instance is None:
+            with cls._lock:
+                if cls._instance is None:
+                    cls._instance = cls(store=store)
+        elif store is not None and cls._instance._store is None:
+            cls._instance._store = store
+        return cls._instance
+
+    def get_memory_paths_for_scope(
+        self,
+        scope: str = "auto",
+        project_root: Path | None = None,
+        agent_id: str | None = None,
+    ) -> list[Path]:
+        """Resolve physical memory paths for a given scope ('user', 'project', 'auto')."""
+        paths: list[Path] = []
+        root = project_root or Path.cwd()
+
+        from opscloud.config import paths as app_paths
+
+        # User scope
+        if scope in ("user", "auto"):
+            primary_md = app_paths.ensure_user_agent_md(agent_id or app_paths.DEFAULT_AGENT_NAME)
+            paths.append(primary_md)
+            paths.append(app_paths.DATA_DIR / "AGENTS.md")
+            if agent_id and agent_id != app_paths.DEFAULT_AGENT_NAME:
+                paths.append(app_paths.user_agent_md(agent_id))
+
+        # Project scope
+        if scope in ("project", "auto"):
+            paths.append(app_paths.project_opscloud_dir(root) / "AGENTS.md")
+            paths.append(root / ".opscloud" / "AGENTS.md")
+            paths.append(root / "AGENTS.md")
+
+        resolved_paths: list[Path] = []
+        for p in paths:
+            try:
+                abs_p = p.expanduser().resolve()
+                if abs_p not in resolved_paths and abs_p.is_file():
+                    resolved_paths.append(abs_p)
+            except Exception:
+                pass
+
+        return resolved_paths
+
+    def get_all_memory_sources(
+        self,
+        project_root: Path | None = None,
+        agent_id: str | None = None,
+    ) -> list[str]:
+        """Return a list of all existing AGENTS.md paths."""
+        if isinstance(project_root, str) and agent_id is None:
+            try:
+                p = Path(project_root)
+                if p.is_dir() or "/" in project_root or "\\" in project_root:
+                    project_root = p
+                else:
+                    agent_id = project_root
+                    project_root = None
+            except Exception:
+                pass
+        paths = self.get_memory_paths_for_scope("auto", project_root=project_root, agent_id=agent_id)
+        return [str(p) for p in paths]
+
+    # ── Store-backed memory operations ─────────────────────────────────
+
+    async def save_memory(self, thread_id: str, key: str, value: str) -> None:
+        """Save a memory entry for a thread."""
+        if self._store:
+            await self._store.aput(
+                namespace=("memory", thread_id),
+                key=key,
+                value={"content": value},
+            )
+
+    async def get_memory(self, thread_id: str, key: str) -> str | None:
+        """Retrieve a memory entry."""
+        if self._store:
+            item = await self._store.aget(namespace=("memory", thread_id), key=key)
+            if item and isinstance(item.value, dict):
+                return item.value.get("content")
+        return None
+
+    async def list_memories(self, thread_id: str) -> list[dict[str, Any]]:
+        """List all memories for a thread."""
+        if self._store:
+            items = await self._store.asearch(("memory", thread_id))
+            return [
+                {
+                    "key": item.key,
+                    "content": (item.value.get("content", "") if isinstance(item.value, dict) else str(item.value)),
+                }
+                for item in items
+            ]
+        return []

opscloud/memory/store.py

@@ -0,0 +1,223 @@
+"""Memory storage — structured precedence-based memory management for opscloud.
+
+Precedence for memory locations:
+  1. **Project-scoped** (highest priority): ``{project_root}/.opscloud/memory/``
+  2. **User-scoped** (fallback): ``~/.opscloud/memory/``
+
+Each memory entry is a plain Markdown file. Memories are loaded at session start
+and injected into the system prompt or queried via ``/memory`` commands.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+import logging
+from pathlib import Path
+import re
+import time
+from typing import Sequence
+
+from opscloud.config.paths import DATA_DIR
+from opscloud.utils.logger import get_logger
+
+logger = get_logger(__name__)
+
+_MAX_MEMORY_LINE_COUNT = 250
+"""Hard cap on memory lines injected into context."""
+
+_MAX_MEMORY_BYTES = 30_000
+"""Hard cap on total memory bytes injected into context."""
+
+
+@dataclass(frozen=True)
+class MemoryEntry:
+    """A single persisted memory entry."""
+
+    key: str
+    content: str
+    source: str  # "project" | "user"
+    path: Path
+    modified_at: float
+
+
+class MemoryStore:
+    """CRUD operations for Markdown-file-based persistent memories.
+
+    Precedence rules:
+      - Writes go to the project store if a project root is detected,
+        otherwise to the user store.
+      - Reads merge both stores, with project entries overriding user
+        entries of the same key.
+    """
+
+    def __init__(
+        self,
+        *,
+        project_root: Path | None = None,
+        user_home: Path | None = None,
+    ) -> None:
+        self._project_dir = (
+            (project_root / ".opscloud" / "memory") if project_root else None
+        )
+        base_user = (user_home / ".opscloud") if user_home else DATA_DIR
+        self._user_dir = base_user / "memory"
+
+    # ── Write ────────────────────────────────────────────
+
+    def save(self, key: str, content: str, *, scope: str = "auto") -> Path:
+        """Persist a memory entry.
+
+        Args:
+            key: Filename stem (e.g. ``"prefer-terraform-fmt"``).
+            content: Markdown content to store.
+            scope: ``"project"``, ``"user"``, or ``"auto"`` (default).
+                Auto writes to project if available, else user.
+
+        Returns:
+            Path: Path to the written file.
+        """
+        target_dir = self._resolve_write_dir(scope)
+        target_dir.mkdir(parents=True, exist_ok=True)
+
+        safe_key = _sanitize_key(key)
+        target = target_dir / f"{safe_key}.md"
+        target.write_text(content, encoding="utf-8")
+        return target
+
+    def delete(self, key: str) -> bool:
+        """Delete a memory by key from both scopes.
+
+        Args:
+            key: Filename stem to delete.
+
+        Returns:
+            bool: True if at least one file was deleted, False otherwise.
+        """
+        safe_key = _sanitize_key(key)
+        deleted = False
+        for directory in self._all_dirs():
+            path = directory / f"{safe_key}.md"
+            if path.is_file():
+                try:
+                    path.unlink()
+                    deleted = True
+                except OSError as exc:
+                    logger.warning("Failed to delete memory file %s: %s", path, exc)
+        return deleted
+
+    # ── Read ─────────────────────────────────────────────
+
+    def list_all(self) -> list[MemoryEntry]:
+        """List all memory entries, project overriding user for same key."""
+        entries: dict[str, MemoryEntry] = {}
+
+        # User first (lower priority)
+        for entry in self._scan_dir(self._user_dir, source="user"):
+            entries[entry.key] = entry
+
+        # Project second (higher priority, overwrites same key)
+        if self._project_dir:
+            for entry in self._scan_dir(self._project_dir, source="project"):
+                entries[entry.key] = entry
+
+        return sorted(entries.values(), key=lambda e: e.key)
+
+    def get(self, key: str) -> MemoryEntry | None:
+        """Get a single memory by key (project takes precedence)."""
+        safe_key = _sanitize_key(key)
+        # Check project first
+        if self._project_dir:
+            path = self._project_dir / f"{safe_key}.md"
+            if path.is_file():
+                return _read_entry(path, source="project")
+        # Then user
+        path = self._user_dir / f"{safe_key}.md"
+        if path.is_file():
+            return _read_entry(path, source="user")
+        return None
+
+    def load_context(self) -> str:
+        """Build the system-prompt memory injection string.
+
+        Returns:
+            str: Concatenated memory content capped at line/byte limits.
+        """
+        entries = self.list_all()
+        if not entries:
+            return ""
+
+        parts: list[str] = []
+        total_lines = 0
+        total_bytes = 0
+
+        for entry in entries:
+            lines = entry.content.splitlines()
+            if total_lines + len(lines) > _MAX_MEMORY_LINE_COUNT:
+                break
+            encoded = entry.content.encode("utf-8")
+            if total_bytes + len(encoded) > _MAX_MEMORY_BYTES:
+                break
+            parts.append(f"## Memory: {entry.key}\n{entry.content}")
+            total_lines += len(lines)
+            total_bytes += len(encoded)
+
+        if not parts:
+            return ""
+
+        return (
+            "# Persisted Memories\n"
+            "The following are learnings extracted from previous conversations.\n\n"
+            + "\n\n".join(parts)
+        )
+
+    # ── Private ──────────────────────────────────────────
+
+    def _resolve_write_dir(self, scope: str) -> Path:
+        if scope == "project" and self._project_dir:
+            return self._project_dir
+        if scope == "user":
+            return self._user_dir
+        if self._project_dir:
+            return self._project_dir
+        return self._user_dir
+
+    def _all_dirs(self) -> list[Path]:
+        dirs = [self._user_dir]
+        if self._project_dir:
+            dirs.append(self._project_dir)
+        return dirs
+
+    @staticmethod
+    def _scan_dir(directory: Path | None, *, source: str) -> list[MemoryEntry]:
+        if directory is None or not directory.is_dir():
+            return []
+        entries: list[MemoryEntry] = []
+        for path in sorted(directory.glob("*.md")):
+            entry = _read_entry(path, source=source)
+            if entry is not None:
+                entries.append(entry)
+        return entries
+
+
+def _read_entry(path: Path, *, source: str) -> MemoryEntry | None:
+    try:
+        content = path.read_text(encoding="utf-8")
+        return MemoryEntry(
+            key=path.stem,
+            content=content,
+            source=source,
+            path=path,
+            modified_at=path.stat().st_mtime,
+        )
+    except (OSError, UnicodeDecodeError) as exc:
+        logger.warning("Could not read memory file %s: %s", path, exc)
+        return None
+
+
+def _sanitize_key(key: str) -> str:
+    """Sanitize a memory key for use as a filename stem."""
+    key = key.strip().lower()
+    key = re.sub(r"[^\w\-]", "-", key)
+    key = re.sub(r"-{2,}", "-", key)
+    key = key.strip("-")
+    return key[:64] or "memory"