thothctl 0.16.3__tar.gz → 0.16.4__tar.gz

{thothctl-0.16.3 → thothctl-0.16.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: thothctl
-Version: 0.16.3
+Version: 0.16.4
 Summary: A CLI for Developer Control Plane. Accelerate your cloud IaC deployments.
 Project-URL: SourceCode, https://github.com/thothforge/thothctl
 Project-URL: HomePage, https://github.com/thothforge/thothctl

{thothctl-0.16.3 → thothctl-0.16.4}/src/thothctl/services/ai_review/ai_agent.py

@@ -18,6 +18,7 @@ from .utils.prompts import (
     SYSTEM_SECURITY_ANALYST,
     SYSTEM_CODE_REVIEWER,
     SYSTEM_FULL_ANALYSIS,
+    SYSTEM_COMPACT,
 )
 from .utils.fix_prompts import SYSTEM_FIX_GENERATOR
 from .tracing import span
@@ -85,10 +86,12 @@ class AIReviewAgent:
         """
         with span("ai_agent.analyze_directory", {"directory": directory}) as s:
             logger.info(f"Building rich context for {directory}")
+            self._emit_status("📦 Collecting project context (inventory, scan reports, plans)...")
             ctx = self.context_builder.build_context(directory)
 
             basic_risk = None
             if ctx.scan_results.get("total_findings", 0) > 0:
+                self._emit_status(f"⚠️  Found {ctx.scan_results['total_findings']} scan findings, assessing risk...")
                 basic_risk = self.risk_assessor.assess_risk(ctx.scan_results)
 
             if not self.cost_tracker.check_budget():
@@ -98,9 +101,28 @@ class AIReviewAgent:
                     return self._basic_analysis(ctx.scan_results, basic_risk)
                 return self._empty_result()
 
+            self._emit_status("🤖 Sending context to LLM for security analysis...")
             formatted = self.context_builder.format_for_ai(ctx)
-            fallback = (lambda: self._basic_analysis(ctx.scan_results, basic_risk)) if basic_risk else self._empty_result
-            result = self._call_ai(SYSTEM_FULL_ANALYSIS, formatted, "analyze_directory", fallback=fallback)
+            
+            # Use compact prompt for local models (Ollama) to fit VRAM constraints
+            if self._provider.name == "ollama":
+                # Hybrid: scan data for structured findings + LLM for recommendations
+                base_result = self._basic_analysis(ctx.scan_results, basic_risk) if basic_risk else self._empty_result()
+                try:
+                    ai_response = self._provider.analyze(SYSTEM_COMPACT, formatted)
+                    # AI might return JSON or text — either way, use it as recommendations
+                    if isinstance(ai_response, dict) and ai_response.get("recommendations"):
+                        base_result["recommendations"] = ai_response["recommendations"]
+                        base_result["architecture_assessment"] = ai_response.get("architecture_assessment", "")
+                    elif isinstance(ai_response, dict) and ai_response.get("_raw_text"):
+                        base_result["recommendations"] = [ai_response["_raw_text"][:2000]]
+                except Exception as e:
+                    logger.debug(f"LLM recommendations failed: {e}")
+                result = base_result
+            else:
+                system_prompt = SYSTEM_FULL_ANALYSIS
+                fallback = (lambda: self._basic_analysis(ctx.scan_results, basic_risk)) if basic_risk else self._empty_result
+                result = self._call_ai(system_prompt, formatted, "analyze_directory", fallback=fallback)
 
             result["_context"] = {
                 "project_type": ctx.project_type,
@@ -265,6 +287,12 @@ class AIReviewAgent:
                 return fallback()
             return self._empty_result()
 
+    @staticmethod
+    def _emit_status(msg: str) -> None:
+        """Print a status message visible during the spinner."""
+        from rich.console import Console
+        Console(stderr=True).print(f"[dim]{msg}[/dim]")
+
     @staticmethod
     def _empty_result() -> Dict[str, Any]:
         return {

{thothctl-0.16.3 → thothctl-0.16.4}/src/thothctl/services/ai_review/analyzers/code_reviewer.py

@@ -6,7 +6,7 @@ from typing import Dict, Any, List
 logger = logging.getLogger(__name__)
 
 # File extensions to analyze
-IAC_EXTENSIONS = {".tf", ".hcl", ".tfvars", ".yaml", ".yml", ".json"}
+IAC_EXTENSIONS = {".tf", ".hcl", ".tfvars"}
 
 
 class CodeReviewer:
@@ -24,6 +24,12 @@ class CodeReviewer:
 
         for f in dir_path.rglob("*"):
             if f.suffix in exts and not any(p.startswith(".") for p in f.parts):
+                # Skip non-IaC directories
+                if any(skip in f.parts for skip in (
+                    "Reports", ".terraform", "node_modules", ".terragrunt-cache",
+                    "cdk.out", "__pycache__", ".git", "html_reports", "tfplan",
+                )):
+                    continue
                 try:
                     content = f.read_text(errors="ignore")
                     rel_path = str(f.relative_to(dir_path))

{thothctl-0.16.3 → thothctl-0.16.4}/src/thothctl/services/ai_review/analyzers/context_builder.py

@@ -38,6 +38,7 @@ class ContextBuilder:
         # Run each collector independently — failures don't block others
         self._collect_inventory(ctx)
         self._collect_scan_results(ctx)
+        self._collect_plan_files(ctx)
         self._collect_blast_radius(ctx)
         self._collect_code(ctx)
 
@@ -97,12 +98,30 @@ class ContextBuilder:
                 )
             sections.append("")
 
-        # Code section (only key files, truncated)
+        # Code section — only include files referenced in findings + plan summaries
         if ctx.code_files:
             sections.append("## Key IaC Files")
-            char_budget = 30000
+            char_budget = 12000  # ~3K tokens for code context
+
+            # Prioritize: plans first, then files mentioned in scan findings
+            referenced_files = set()
+            for tool_data in ctx.scan_results.get("tools", {}).values():
+                for f in tool_data.get("findings", []):
+                    ref = f.get("file", "")
+                    if ref:
+                        referenced_files.add(ref)
+
+            # Sort: plans first, then referenced files, then others
+            def priority(item):
+                path, _ = item
+                if "[PLAN]" in path:
+                    return 0
+                if any(ref in path for ref in referenced_files):
+                    return 1
+                return 2
+
             used = 0
-            for path, content in sorted(ctx.code_files.items()):
+            for path, content in sorted(ctx.code_files.items(), key=priority):
                 header = f"\n--- {path} ---\n"
                 if used + len(header) + len(content) > char_budget:
                     remaining = len(ctx.code_files) - len([s for s in sections if s.startswith("--- ")])
@@ -165,43 +184,74 @@ class ContextBuilder:
             ctx.errors.append(f"Inventory unavailable: {e}")
 
     def _collect_scan_results(self, ctx: IaCContext) -> None:
-        """Check for existing scan reports or run a quick scan."""
+        """Check for existing scan reports at project root."""
         try:
-            from ..report_analyzer import ReportAnalyzer
+            from .report_analyzer import ReportAnalyzer
 
             analyzer = ReportAnalyzer()
-            reports_dir = Path(ctx.directory) / "Reports"
 
-            # First check if reports already exist
-            if reports_dir.exists():
+            # Look for Reports/ at target dir and up to project root
+            target = Path(ctx.directory)
+            reports_dir = None
+            for parent in [target] + list(target.parents):
+                candidate = parent / "Reports"
+                if candidate.exists():
+                    reports_dir = candidate
+                    break
+                if (parent / ".thothcf.toml").exists() or (parent / ".git").exists():
+                    break
+
+            if reports_dir and reports_dir.exists():
                 ctx.scan_results = analyzer.parse_scan_results(str(reports_dir))
                 if ctx.scan_results.get("total_findings", 0) > 0:
                     logger.info(f"Found existing scan results: {ctx.scan_results['total_findings']} findings")
                     return
 
-            # Try running a quick checkov scan
-            try:
-                from ...scan.scan_service import ScanService
-
-                scan_svc = ScanService()
-                tmp_reports = str(Path(ctx.directory) / "Reports")
-                scan_svc.execute_scans(
-                    directory=ctx.directory,
-                    reports_dir=tmp_reports,
-                    selected_tools=["checkov"],
-                    options={},
-                    html_reports_format="simple",
-                )
-                ctx.scan_results = analyzer.parse_scan_results(tmp_reports)
-                logger.info(f"Quick scan: {ctx.scan_results.get('total_findings', 0)} findings")
-            except Exception as scan_err:
-                logger.debug(f"Quick scan failed: {scan_err}")
-                ctx.errors.append(f"Live scan unavailable: {scan_err}")
+            ctx.errors.append("No scan reports found. Run 'thothctl scan iac' first for richer AI analysis.")
 
         except Exception as e:
             logger.debug(f"Scan results collection failed: {e}")
             ctx.errors.append(f"Scan results unavailable: {e}")
 
+    def _collect_plan_files(self, ctx: IaCContext) -> None:
+        """Collect tfplan.json summaries for change analysis."""
+        try:
+            import json as _json
+            target = Path(ctx.directory)
+
+            # Find tfplan.json in target and project-level stacks/tfplan/
+            plan_files = list(target.rglob("tfplan.json"))
+            for parent in [target] + list(target.parents):
+                if (parent / ".thothcf.toml").exists() or (parent / ".git").exists():
+                    tfplan_dir = parent / "stacks" / "tfplan"
+                    if tfplan_dir.exists():
+                        plan_files.extend(tfplan_dir.rglob("tfplan.json"))
+                    break
+
+            for pf in plan_files[:5]:
+                try:
+                    with open(pf) as f:
+                        plan = _json.load(f)
+                    changes = plan.get("resource_changes", [])
+                    creates = sum(1 for c in changes if "create" in c.get("change", {}).get("actions", []))
+                    updates = sum(1 for c in changes if "update" in c.get("change", {}).get("actions", []))
+                    deletes = sum(1 for c in changes if "delete" in c.get("change", {}).get("actions", []))
+                    ctx.code_files[f"[PLAN] {pf.name} ({pf.parent.name})"] = (
+                        f"# Terraform Plan: {pf.parent.name}\n"
+                        f"# Creates: {creates}, Updates: {updates}, Deletes: {deletes}\n"
+                        f"# Total resource changes: {len(changes)}\n"
+                        + "\n".join(
+                            f"# {c['type']}.{c['name']} → {c['change']['actions']}"
+                            for c in changes[:20]
+                        )
+                    )
+                except Exception:
+                    pass
+            if plan_files:
+                logger.info(f"Found {len(plan_files)} tfplan.json files")
+        except Exception as e:
+            logger.debug(f"Plan file collection failed: {e}")
+
     def _collect_blast_radius(self, ctx: IaCContext) -> None:
         """Run BlastRadiusService for dependency analysis."""
         try:
@@ -235,7 +285,7 @@ class ContextBuilder:
     def _collect_code(self, ctx: IaCContext) -> None:
         """Collect raw IaC files as supplementary context."""
         try:
-            from ..code_reviewer import CodeReviewer
+            from .code_reviewer import CodeReviewer
 
             reviewer = CodeReviewer()
             ctx.code_files = reviewer.collect_code_for_review(ctx.directory)

{thothctl-0.16.3 → thothctl-0.16.4}/src/thothctl/services/ai_review/config/ai_settings.py

@@ -18,7 +18,7 @@ DEFAULT_CONFIG_FILE = "ai_config.yaml"
 class ProviderConfig:
     """Configuration for a single AI provider."""
     model: str = ""
-    max_tokens: int = 4000
+    max_tokens: int = 8000
     temperature: float = 0.1
     api_key: str = ""
     region: str = "us-east-1"

{thothctl-0.16.3 → thothctl-0.16.4}/src/thothctl/services/ai_review/providers/ollama_provider.py

@@ -1,6 +1,8 @@
 """Ollama provider for AI review — uses local models via OpenAI-compatible API."""
 import json
 import logging
+import os
+import uuid
 from typing import Dict, Any
 
 from ..config.ai_settings import ProviderConfig
@@ -11,6 +13,23 @@ logger = logging.getLogger(__name__)
 DEFAULT_OLLAMA_BASE_URL = "http://localhost:11434/v1"
 DEFAULT_OLLAMA_MODEL = "llama3"
 
+# Session ID for grouping related traces in Langfuse
+_session_id = None
+
+
+def get_session_id() -> str:
+    """Get or create a session ID for this thothctl run."""
+    global _session_id
+    if _session_id is None:
+        _session_id = f"thothctl-{uuid.uuid4().hex[:8]}"
+    return _session_id
+
+
+def reset_session():
+    """Reset session for a new workflow run."""
+    global _session_id
+    _session_id = None
+
 
 class OllamaProvider:
     """Ollama local model integration via its OpenAI-compatible API."""
@@ -26,10 +45,20 @@ class OllamaProvider:
     def client(self):
         if self._client is None:
             try:
-                from openai import OpenAI
+                # Use Langfuse-wrapped OpenAI client if configured
+                import os
+                if os.environ.get("LANGFUSE_PUBLIC_KEY"):
+                    try:
+                        from langfuse.openai import OpenAI
+                        logger.info("Using Langfuse-instrumented OpenAI client")
+                    except Exception:
+                        from openai import OpenAI
+                else:
+                    from openai import OpenAI
                 self._client = OpenAI(
                     base_url=self.base_url,
                     api_key="ollama",  # Ollama doesn't need a real key
+                    timeout=1800.0,  # 30 min — large models on limited VRAM are very slow
                 )
             except ImportError:
                 raise ImportError("openai package required. Install with: pip install openai")
@@ -51,20 +80,50 @@ class OllamaProvider:
                 "temperature": self.temperature,
             }
 
+            # Add Langfuse metadata if available
+            if os.environ.get("LANGFUSE_PUBLIC_KEY"):
+                kwargs["metadata"] = {
+                    "session_id": get_session_id(),
+                    "tags": ["thothctl", "ai-review"],
+                }
+
             try:
-                kwargs["response_format"] = {"type": "json_object"}
                 response = self.client.chat.completions.create(**kwargs)
+                if not response.choices[0].message.content:
+                    raise ValueError("Empty response")
             except Exception:
-                kwargs.pop("response_format", None)
+                kwargs.pop("metadata", None)
                 response = self.client.chat.completions.create(**kwargs)
 
-            text = response.choices[0].message.content
+            text = response.choices[0].message.content or ""
             usage = response.usage
 
+            if not text:
+                raise ValueError("Empty response from model")
+
+            # Try to extract JSON from response
             if "```json" in text:
                 text = text.split("```json")[1].split("```")[0].strip()
             elif "```" in text:
                 text = text.split("```")[1].split("```")[0].strip()
+            elif text.strip().startswith("{"):
+                text = text.strip()
+            else:
+                # Model didn't return JSON — find any JSON block in the response
+                import re
+                json_match = re.search(r'\{[^{}]*(?:\{[^{}]*\}[^{}]*)*\}', text, re.DOTALL)
+                if json_match:
+                    text = json_match.group(0)
+                else:
+                    # No JSON at all — wrap the text response as a result
+                    text = json.dumps({
+                        "summary": {"total_findings": 0},
+                        "findings": [],
+                        "risk_score": 0,
+                        "recommendations": [text[:500]],
+                        "architecture_assessment": text[:1000],
+                        "_raw_text": text[:2000],
+                    })
 
             result = json.loads(text)
             input_tokens = getattr(usage, "prompt_tokens", 0) or 0

thothctl-0.16.4/src/thothctl/services/ai_review/strands_agent.py

@@ -0,0 +1,119 @@
+"""Strands-based IaC Security Agent — multi-agent orchestration.
+
+Supports two modes:
+- Swarm: Agents hand off autonomously (requires tool-calling models: Bedrock, OpenAI)
+- Workflow: Deterministic pipeline (works with any model including Ollama)
+
+NOTE: Strands Ollama adapter has a known streaming bug in v1.43.0.
+For Ollama, use the existing ai_agent.py (direct OpenAI client).
+This module is ready for Bedrock/OpenAI models.
+
+Usage:
+    from thothctl.services.ai_review.strands_agent import run_security_review
+    
+    # With Bedrock (recommended for production)
+    report = run_security_review("us.anthropic.claude-3-5-sonnet-20241022-v2:0", ".")
+    
+    # With OpenAI
+    report = run_security_review("openai/gpt-4-turbo", ".")
+"""
+import json
+import logging
+import os
+from pathlib import Path
+from typing import Optional
+
+from strands import Agent
+
+logger = logging.getLogger(__name__)
+
+
+def _get_model(model_id: str):
+    """Create a Strands model from a model ID string."""
+    if model_id.startswith("ollama/"):
+        from strands.models.ollama import OllamaModel
+        model_name = model_id.replace("ollama/", "")
+        host = os.environ.get("OLLAMA_HOST", "http://localhost:11434").rstrip("/v1").rstrip("/")
+        return OllamaModel(model_id=model_name, host=host)
+    elif model_id.startswith("openai/"):
+        from strands.models.openai import OpenAIModel
+        return OpenAIModel(model_id=model_id.replace("openai/", ""))
+    else:
+        # Default to Bedrock
+        from strands.models.bedrock import BedrockModel
+        return BedrockModel(model_id=model_id)
+
+
+def _build_context(directory: str) -> str:
+    """Build IaC context from thothctl services."""
+    from .analyzers.context_builder import ContextBuilder
+    builder = ContextBuilder()
+    ctx = builder.build_context(directory)
+    return builder.format_for_ai(ctx)
+
+
+def run_security_review(model_id: str, directory: str) -> str:
+    """Run multi-agent security review as a deterministic workflow.
+    
+    Pipeline: Context → Security Analysis → Architecture Review → Recommendations
+    Each agent receives the previous agent's output as context.
+    """
+    os.environ["THOTH_AGENT_DIR"] = str(Path(directory).resolve())
+    model = _get_model(model_id)
+    context = _build_context(directory)
+
+    # Agent 1: Security Analyst
+    security_agent = Agent(
+        model=model,
+        system_prompt="""You are a security analyst. Given IaC scan findings, identify the TOP 5 most critical issues.
+For each issue, include: severity, title (from scan data), resource name, file path, and a 1-line remediation.
+Use ONLY the findings provided. Do NOT invent issues. Format as a numbered list.""",
+    )
+
+    # Agent 2: Architecture Reviewer  
+    architecture_agent = Agent(
+        model=model,
+        system_prompt="""You are an architecture reviewer. Given security findings and IaC context, assess:
+1. Module structure quality (are modules well-organized?)
+2. Dependency risks (what's the blast radius?)
+3. Version hygiene (outdated modules?)
+Provide a brief assessment (5-7 sentences).""",
+    )
+
+    # Agent 3: Recommendations
+    recommendations_agent = Agent(
+        model=model,
+        system_prompt="""You are a DevSecOps advisor. Given security findings and architecture assessment, provide:
+1. Top 3 immediate actions (with exact file:line to modify)
+2. Risk score (0-100, where 100 is critical)
+3. Whether to block the pipeline (yes/no with reason)
+Be concise. Max 10 lines.""",
+    )
+
+    # Execute pipeline
+    logger.info("🔍 Agent 1: Security Analysis...")
+    security_result = security_agent(f"Analyze these IaC findings:\n\n{context}")
+
+    logger.info("🏗️ Agent 2: Architecture Review...")
+    arch_result = architecture_agent(
+        f"Context:\n{context}\n\nSecurity findings:\n{security_result}"
+    )
+
+    logger.info("💡 Agent 3: Recommendations...")
+    recs_result = recommendations_agent(
+        f"Security findings:\n{security_result}\n\nArchitecture assessment:\n{arch_result}"
+    )
+
+    # Combine results
+    report = f"""# 🤖 AI Security Review (Multi-Agent)
+
+## 🔍 Security Findings
+{security_result}
+
+## 🏗️ Architecture Assessment
+{arch_result}
+
+## 💡 Recommendations
+{recs_result}
+"""
+    return report

{thothctl-0.16.3 → thothctl-0.16.4}/src/thothctl/services/ai_review/utils/prompts.py

@@ -94,16 +94,19 @@ Respond in valid JSON with this structure:
 }"""
 
 SYSTEM_FULL_ANALYSIS = """You are an expert Infrastructure as Code (IaC) security and architecture analyst.
-You are the AI agent for ThothCTL, an AI-Powered Infrastructure Lifecycle CLI that provides:
+You are the AI agent for ThothCTL, an AI-Powered Infrastructure Lifecycle CLI.
 
-**Available context sources (provided when available):**
-- **Infrastructure Inventory**: Modules, providers, versions from Terraform Registry and private registries. Includes version status (up-to-date, outdated, deprecated).
-- **Security Scan Findings**: Results from Checkov, KICS, Trivy, OPA/Conftest, Terraform Compliance. Each tool covers different aspects — Checkov for CIS benchmarks, Trivy for CVEs, KICS for misconfigurations, OPA for custom org policies.
-- **Blast Radius Analysis**: Dependency graph showing which components are affected by changes, risk scores per component, criticality ratings, and rollback plans.
-- **Raw IaC Source Code**: Terraform, OpenTofu, Terragrunt, CloudFormation files.
+**CRITICAL RULES:**
+1. Use ONLY the scan findings provided below. Do NOT invent or hallucinate findings.
+2. Each finding MUST have the exact resource name and file_path from the scan data.
+3. If a finding says "resource: module.vpc" and "file: main.tf", use those exact values.
+4. The "title" field MUST come from the scan tool's check_name/title, not be "Untitled".
 
-**Enforcement context:**
-- ThothCTL supports "soft" (report only) and "hard" (block pipeline) enforcement modes
+**Context sources provided:**
+- **Security Scan Findings**: Real results from Checkov, KICS, Trivy with resource names and file paths.
+- **Terraform Plans**: Shows what resources will be created/modified/deleted per stack.
+- **Infrastructure Inventory**: Modules, providers, versions.
+- **IaC Source Code**: Actual .tf files from the project stacks.
 - Your recommendations should indicate which findings warrant "hard" enforcement
 
 Perform a comprehensive analysis covering:
@@ -133,8 +136,9 @@ Respond in valid JSON with this structure:
       "title": "string",
       "description": "string",
       "resource": "string",
-      "remediation": "string",
-      "code_example": "string",
+      "file_path": "string (exact path where the fix must be applied, e.g. stacks/platform/data/rds/main.tf)",
+      "remediation": "string (what to change and WHERE in the file)",
+      "code_example": "string (the exact HCL code block to add/modify)",
       "compliance": ["string"],
       "source_tool": "string",
       "enforce_hard": false
@@ -144,3 +148,20 @@ Respond in valid JSON with this structure:
   "risk_score": float,
   "recommendations": ["string"]
 }"""
+
+
+SYSTEM_COMPACT = """You are a senior IaC security advisor. Given scan findings and terraform code, provide:
+
+1. TOP 5 most critical issues with exact file path and line to fix
+2. For each issue: one HCL code snippet showing the fix
+3. Overall risk assessment (score 0-100)
+
+Format each finding as:
+## [SEVERITY] Title
+**File**: path/to/file.tf:LINE
+**Fix**:
+```hcl
+code here
+```
+
+Be specific. Use the exact resources and files from the scan data."""

thothctl-0.16.4/src/thothctl/version.py

@@ -0,0 +1,2 @@
+"""Version module."""
+__version__ = "0.16.4"

thothctl-0.16.3/src/thothctl/version.py

@@ -1,2 +0,0 @@
-"""Version module."""
-__version__ = "0.16.3"