tinet-agent-cli 0.1.0.dev36__py3-none-any.whl

taco/core/access_token_manager.py

@@ -0,0 +1,98 @@
+from __future__ import annotations
+
+import hashlib
+import threading
+from datetime import UTC, datetime
+
+import httpx
+
+from taco.core.config_store import ConfigStore, TacoConfig
+from taco.core.developer_center_client import DeveloperCenterClient
+from taco.core.profile_resolver import ProfileResolver, ResolvedProfile
+
+
+_REFRESH_LOCKS: dict[tuple[str, str], threading.Lock] = {}
+_REFRESH_LOCKS_GUARD = threading.Lock()
+
+
+def credential_fingerprint(profile: ResolvedProfile) -> str:
+    material = f"{profile.endpoint.rstrip('/')}\n{profile.access_key_id}"
+    return hashlib.sha256(material.encode("utf-8")).hexdigest()
+
+
+class AccessTokenManager:
+    def __init__(
+        self,
+        store: ConfigStore | None = None,
+        *,
+        resolver: ProfileResolver | None = None,
+        http_client: httpx.Client | None = None,
+    ) -> None:
+        self.store = store or ConfigStore()
+        self.resolver = resolver or ProfileResolver(self.store)
+        self.http_client = http_client
+
+    def get_access_token(self, profile: ResolvedProfile) -> str:
+        cached = self._matching_token(profile)
+        if cached is not None:
+            return cached
+        if profile.legacy_access_token:
+            self._save(profile, profile.legacy_access_token)
+            return profile.legacy_access_token
+        return self.refresh_access_token(profile)
+
+    def refresh_access_token(
+        self,
+        profile: ResolvedProfile,
+        stale_access_token: str | None = None,
+    ) -> str:
+        with _profile_refresh_lock(self.store, profile.name):
+            cached = self._matching_token(profile)
+            if (
+                stale_access_token is not None
+                and cached is not None
+                and cached != stale_access_token
+            ):
+                return cached
+            client = DeveloperCenterClient(
+                endpoint=profile.endpoint,
+                access_key_id=profile.access_key_id,
+                access_key_secret=profile.access_key_secret,
+                http_client=self.http_client,
+            )
+            try:
+                token = str(client.cli_auth()["access_token"])
+            finally:
+                client.close()
+            self._save(profile, token)
+            return token
+
+    def _matching_token(self, profile: ResolvedProfile) -> str | None:
+        cached = self.store.get_auth_token(profile.name)
+        if not cached or cached.get("credential_fingerprint") != credential_fingerprint(profile):
+            return None
+        token = cached.get("access_token")
+        return token if isinstance(token, str) and token else None
+
+    def _save(self, profile: ResolvedProfile, token: str) -> None:
+        known_names = self.resolver.known_names()
+
+        def mutate(config: TacoConfig) -> None:
+            config.auth_tokens = {
+                name: value
+                for name, value in config.auth_tokens.items()
+                if name in known_names
+            }
+            config.auth_tokens[profile.name] = {
+                "access_token": token,
+                "credential_fingerprint": credential_fingerprint(profile),
+                "updated_at": datetime.now(UTC).replace(microsecond=0).isoformat().replace("+00:00", "Z"),
+            }
+
+        self.store.update(mutate)
+
+
+def _profile_refresh_lock(store: ConfigStore, profile_name: str) -> threading.Lock:
+    key = (str(store.path.resolve()), profile_name)
+    with _REFRESH_LOCKS_GUARD:
+        return _REFRESH_LOCKS.setdefault(key, threading.Lock())

taco/core/api_client.py

@@ -0,0 +1,263 @@
+from __future__ import annotations
+
+import json
+from dataclasses import dataclass
+from typing import Any, Iterator
+
+import httpx
+
+from taco.core.access_token_manager import AccessTokenManager
+from taco.core.config_store import ConfigStore
+from taco.core.errors import TacoError
+from taco.core.http_headers import with_cli_user_agent
+from taco.core.profile_resolver import ProfileResolver, ResolvedProfile
+
+
+@dataclass(frozen=True, slots=True)
+class SseEvent:
+    data: Any
+    event: str | None = None
+    id: str | None = None
+    retry: int | None = None
+
+
+class ApiClient:
+    def __init__(
+        self,
+        store: ConfigStore | None = None,
+        *,
+        profile_resolver: ProfileResolver | None = None,
+        token_manager: AccessTokenManager | None = None,
+        http_client: httpx.Client | None = None,
+    ) -> None:
+        self.store = store or ConfigStore()
+        self._owns_http_client = http_client is None
+        self.http_client = http_client or httpx.Client(timeout=30)
+        self.profile_resolver = profile_resolver or ProfileResolver(self.store)
+        self.token_manager = token_manager or AccessTokenManager(
+            self.store,
+            resolver=self.profile_resolver,
+            http_client=self.http_client,
+        )
+
+    def close(self) -> None:
+        if self._owns_http_client:
+            self.http_client.close()
+
+    def __enter__(self) -> ApiClient:
+        return self
+
+    def __exit__(self, *args: object) -> None:
+        self.close()
+
+    def get(
+        self,
+        path: str,
+        *,
+        params: dict[str, Any] | None = None,
+        profile: str | None = None,
+    ) -> Any:
+        return self.request("GET", path, params=params, profile=profile)
+
+    def post(
+        self,
+        path: str,
+        *,
+        json: dict[str, Any] | None = None,
+        profile: str | None = None,
+    ) -> Any:
+        return self.request("POST", path, json=json, profile=profile)
+
+    def request(
+        self,
+        method: str,
+        path: str,
+        *,
+        params: dict[str, Any] | None = None,
+        json: dict[str, Any] | None = None,
+        profile: str | None = None,
+        retry_on_auth: bool = True,
+    ) -> Any:
+        resolved = self.profile_resolver.resolve(profile)
+        access_token = self.token_manager.get_access_token(resolved)
+        try:
+            response = self.http_client.request(
+                method,
+                _console_url(resolved, path),
+                params=params,
+                json=json,
+                headers=self._headers(access_token),
+            )
+        except httpx.HTTPError as error:
+            raise _connection_error(error) from error
+
+        if response.status_code == 401 and retry_on_auth:
+            self.token_manager.refresh_access_token(
+                resolved,
+                stale_access_token=access_token,
+            )
+            return self.request(
+                method,
+                path,
+                params=params,
+                json=json,
+                profile=resolved.name,
+                retry_on_auth=False,
+            )
+
+        if response.status_code >= 400:
+            raise _request_error(response)
+
+        if not response.content:
+            return None
+        try:
+            return response.json()
+        except ValueError as error:
+            raise TacoError(
+                code="API_RESPONSE_INVALID",
+                message="Console API 成功响应不是合法 JSON。",
+                exit_code=4,
+                status=response.status_code,
+                hint="请检查网关、代理和服务端响应格式。",
+            ) from error
+
+    def stream(
+        self,
+        method: str,
+        path: str,
+        *,
+        params: dict[str, Any] | None = None,
+        json: dict[str, Any] | None = None,
+        profile: str | None = None,
+        retry_on_auth: bool = True,
+    ) -> Iterator[SseEvent]:
+        resolved = self.profile_resolver.resolve(profile)
+        access_token = self.token_manager.get_access_token(resolved)
+        headers = self._headers(access_token)
+        headers["Accept"] = "text/event-stream"
+        should_retry = False
+
+        try:
+            with self.http_client.stream(
+                method,
+                _console_url(resolved, path),
+                params=params,
+                json=json,
+                headers=headers,
+            ) as response:
+                if response.status_code == 401 and retry_on_auth:
+                    should_retry = True
+                else:
+                    if response.status_code >= 400:
+                        response.read()
+                        raise _request_error(response)
+                    yield from _iter_sse_events(response.iter_lines())
+                    return
+        except httpx.HTTPError as error:
+            raise _connection_error(error) from error
+
+        if should_retry:
+            self.token_manager.refresh_access_token(
+                resolved,
+                stale_access_token=access_token,
+            )
+            yield from self.stream(
+                method,
+                path,
+                params=params,
+                json=json,
+                profile=resolved.name,
+                retry_on_auth=False,
+            )
+
+    def _headers(self, access_token: str) -> dict[str, str]:
+        return with_cli_user_agent({"Authorization": f"Bearer {access_token}"})
+
+
+def _console_url(profile: ResolvedProfile, path: str) -> str:
+    return f"{profile.endpoint}/agent/console/api/{path.lstrip('/')}"
+
+
+def _request_error(response: httpx.Response) -> TacoError:
+    try:
+        payload = response.json()
+    except ValueError:
+        payload = {}
+    message = None
+    remote_code = None
+    if isinstance(payload, dict):
+        if payload.get("message"):
+            message = str(payload["message"])
+        if isinstance(payload.get("code"), str):
+            remote_code = payload["code"]
+    return TacoError(
+        code="API_REQUEST_FAILED",
+        message=message
+        or f"Console API 请求失败，HTTP 状态码 {response.status_code}。",
+        exit_code=4,
+        status=response.status_code,
+        hint="请检查 Console API 地址、认证状态和请求参数。",
+        remote_code=remote_code,
+    )
+
+
+def _connection_error(error: httpx.HTTPError) -> TacoError:
+    return TacoError(
+        code="API_CONNECTION_FAILED",
+        message=f"无法连接 Console API：{error}",
+        exit_code=4,
+        hint="请检查网络、代理、证书和 Console API 地址。",
+    )
+
+
+def _iter_sse_events(lines: Iterator[str]) -> Iterator[SseEvent]:
+    data_lines: list[str] = []
+    event_type: str | None = None
+    event_id: str | None = None
+    retry: int | None = None
+    first_line = True
+
+    def dispatch() -> SseEvent | None:
+        if not data_lines:
+            return None
+        raw_data = "\n".join(data_lines)
+        if raw_data == "[DONE]":
+            raise StopIteration
+        try:
+            data: Any = json.loads(raw_data)
+        except json.JSONDecodeError:
+            data = raw_data
+        return SseEvent(data=data, event=event_type, id=event_id, retry=retry)
+
+    try:
+        for line in lines:
+            if first_line:
+                line = line.removeprefix("\ufeff")
+                first_line = False
+            if line == "":
+                event = dispatch()
+                if event is not None:
+                    yield event
+                data_lines = []
+                event_type = None
+                continue
+
+            if line.startswith(":"):
+                continue
+            field, separator, value = line.partition(":")
+            if separator and value.startswith(" "):
+                value = value[1:]
+            if field == "data":
+                data_lines.append(value)
+            elif field == "event":
+                event_type = value
+            elif field == "id" and "\x00" not in value:
+                event_id = value
+            elif field == "retry" and value.isdigit():
+                retry = int(value)
+
+        event = dispatch()
+        if event is not None:
+            yield event
+    except StopIteration:
+        return

taco/core/assets.py

@@ -0,0 +1,81 @@
+from __future__ import annotations
+
+import json
+import re
+from importlib import resources
+from typing import Any
+
+from taco.core.errors import TacoError
+
+
+_RESOURCE_NAME = re.compile(r"^[a-z0-9][a-z0-9.-]*$")
+
+
+def load_json_asset(group: str, name: str) -> dict[str, Any]:
+    if group not in {"schemas", "scenarios", "examples"} or not _RESOURCE_NAME.fullmatch(name):
+        raise _asset_not_found(group, name)
+    resource = resources.files("taco.assets").joinpath(group, f"{name}.json")
+    if not resource.is_file():
+        raise _asset_not_found(group, name)
+    try:
+        payload = json.loads(resource.read_text(encoding="utf-8"))
+    except (OSError, UnicodeError, json.JSONDecodeError) as error:
+        raise TacoError(
+            code="ASSET_INVALID",
+            message=f"内置资源损坏：{group}/{name}",
+            exit_code=7,
+        ) from error
+    if not isinstance(payload, dict):
+        raise TacoError(
+            code="ASSET_INVALID",
+            message=f"内置资源不是 JSON 对象：{group}/{name}",
+            exit_code=7,
+        )
+    return payload
+
+
+def list_json_assets(group: str) -> list[str]:
+    if group not in {"schemas", "scenarios", "examples"}:
+        raise _asset_not_found(group, "*")
+    root = resources.files("taco.assets").joinpath(group)
+    try:
+        return sorted(
+            resource.name.removesuffix(".json")
+            for resource in root.iterdir()
+            if resource.is_file()
+            and resource.name.endswith(".json")
+            and _RESOURCE_NAME.fullmatch(resource.name.removesuffix(".json"))
+        )
+    except OSError as error:
+        raise TacoError(
+            code="ASSET_INVALID",
+            message=f"无法读取内置资源目录：{group}",
+            exit_code=7,
+        ) from error
+
+
+def load_skill_files() -> dict[str, str]:
+    root = resources.files("taco.assets").joinpath("skills", "taco")
+    files: dict[str, str] = {}
+    for name in ("SKILL.md", "manifest.json"):
+        resource = root.joinpath(name)
+        if not resource.is_file():
+            raise _asset_not_found("skills", f"taco/{name}")
+        try:
+            files[name] = resource.read_text(encoding="utf-8")
+        except (OSError, UnicodeError) as error:
+            raise TacoError(
+                code="ASSET_INVALID",
+                message=f"内置 Skill 资源损坏：{name}",
+                exit_code=7,
+            ) from error
+    return files
+
+
+def _asset_not_found(group: str, name: str) -> TacoError:
+    return TacoError(
+        code="ASSET_NOT_FOUND",
+        message=f"未找到内置资源：{group}/{name}",
+        exit_code=6,
+        hint="请执行 taco help -o json 查看当前版本支持的资源。",
+    )

taco/core/config_store.py

@@ -0,0 +1,209 @@
+from __future__ import annotations
+
+import json
+import os
+import tempfile
+from dataclasses import dataclass, field
+from json import JSONDecodeError
+from pathlib import Path
+from typing import Any, Callable, Literal
+
+from taco.core.errors import TacoError
+from taco.core.file_lock import (
+    DEFAULT_LOCK_TIMEOUT_SECONDS,
+    InterProcessFileLock,
+)
+
+
+Profile = dict[str, Any]
+AuthToken = dict[str, str]
+ConfigScope = Literal["global", "explicit"]
+
+
+@dataclass(slots=True)
+class TacoConfig:
+    current_profile: str | None = None
+    profiles: dict[str, Profile] = field(default_factory=dict)
+    auth_tokens: dict[str, AuthToken] = field(default_factory=dict)
+
+
+@dataclass(frozen=True, slots=True)
+class ResolvedConfigPath:
+    path: Path
+    scope: ConfigScope
+
+
+def resolve_config_path(
+    *,
+    path: Path | None = None,
+) -> ResolvedConfigPath:
+    """解析固定全局配置路径；显式路径仅供依赖注入和测试。"""
+    if path is not None:
+        resolved = path.expanduser()
+        if not resolved.is_absolute():
+            resolved = (Path.cwd() / resolved).resolve()
+        else:
+            resolved = resolved.resolve()
+        return ResolvedConfigPath(path=resolved, scope="explicit")
+
+    return ResolvedConfigPath(path=global_config_path(), scope="global")
+
+
+def global_config_path() -> Path:
+    return Path.home() / ".taco" / "config.json"
+
+
+class ConfigStore:
+    def __init__(
+        self,
+        path: Path | None = None,
+        *,
+        lock_timeout_seconds: float = DEFAULT_LOCK_TIMEOUT_SECONDS,
+    ) -> None:
+        resolved = resolve_config_path(path=path)
+        self.path = resolved.path
+        self.scope: ConfigScope = resolved.scope
+        self.lock_path = self.path.with_name(f"{self.path.name}.lock")
+        self.lock_timeout_seconds = lock_timeout_seconds
+
+    def load(self) -> TacoConfig:
+        if not self.path.exists():
+            return TacoConfig()
+
+        try:
+            content = self.path.read_text(encoding="utf-8")
+        except OSError as error:
+            raise _invalid_config_error(self.path) from error
+        if not content.strip():
+            return TacoConfig()
+        try:
+            payload = json.loads(content)
+        except JSONDecodeError as error:
+            raise _invalid_config_error(self.path) from error
+        if not isinstance(payload, dict):
+            raise _invalid_config_error(self.path)
+        current_profile = payload.get("currentProfile")
+        profiles = payload.get("profiles", {})
+        auth_tokens = payload.get("authTokens", {})
+        if (
+            (current_profile is not None and not isinstance(current_profile, str))
+            or not isinstance(profiles, dict)
+            or not isinstance(auth_tokens, dict)
+            or any(
+                not isinstance(name, str) or not isinstance(value, dict)
+                for name, value in profiles.items()
+            )
+            or any(
+                not isinstance(name, str) or not isinstance(value, dict)
+                for name, value in auth_tokens.items()
+            )
+        ):
+            raise _invalid_config_error(self.path)
+        return TacoConfig(
+            current_profile=current_profile,
+            profiles=profiles,
+            auth_tokens=auth_tokens,
+        )
+
+    def save(self, config: TacoConfig) -> None:
+        with self._lock():
+            self._save_unlocked(config)
+
+    def update(
+        self,
+        mutator: Callable[[TacoConfig], TacoConfig | None],
+    ) -> TacoConfig:
+        """Atomically load, mutate and save the configuration under one lock."""
+        with self._lock():
+            config = self.load()
+            replacement = mutator(config)
+            if replacement is not None:
+                if not isinstance(replacement, TacoConfig):
+                    raise TypeError("config mutator must return TacoConfig or None")
+                config = replacement
+            self._save_unlocked(config)
+            return config
+
+    def _lock(self) -> InterProcessFileLock:
+        return InterProcessFileLock(
+            self.lock_path,
+            timeout_seconds=self.lock_timeout_seconds,
+        )
+
+    def _save_unlocked(self, config: TacoConfig) -> None:
+        payload = {
+            "currentProfile": config.current_profile,
+            "profiles": config.profiles,
+            "authTokens": config.auth_tokens,
+        }
+        temporary: Path | None = None
+        try:
+            self.path.parent.mkdir(parents=True, exist_ok=True)
+            descriptor, temporary_name = tempfile.mkstemp(
+                dir=self.path.parent,
+                prefix=f".{self.path.name}.",
+                suffix=".tmp",
+                text=True,
+            )
+            temporary = Path(temporary_name)
+            os.chmod(temporary, 0o600)
+            with os.fdopen(descriptor, "w", encoding="utf-8") as file:
+                file.write(
+                    json.dumps(payload, ensure_ascii=False, indent=2) + "\n"
+                )
+                file.flush()
+                os.fsync(file.fileno())
+            os.replace(temporary, self.path)
+            try:
+                os.chmod(self.path, 0o600)
+            except OSError:
+                pass
+        except OSError as error:
+            raise TacoError(
+                code="CONFIG_FILE_WRITE_FAILED",
+                message="无法写入 TACO 配置文件。",
+                exit_code=2,
+                hint=f"请检查目录权限和磁盘空间：{self.path}",
+            ) from error
+        finally:
+            if temporary is not None and temporary.exists():
+                try:
+                    temporary.unlink()
+                except OSError:
+                    pass
+
+    def get_profile(self, profile: str | None = None) -> Profile:
+        config = self.load()
+        profile_name = profile or config.current_profile
+        return config.profiles.get(profile_name or "", {})
+
+    def get_auth_token(self, profile_name: str) -> AuthToken | None:
+        token = self.load().auth_tokens.get(profile_name)
+        return dict(token) if token is not None else None
+
+    def update_auth_token(self, profile_name: str, token: AuthToken) -> None:
+        def mutate(config: TacoConfig) -> None:
+            config.auth_tokens[profile_name] = dict(token)
+
+        self.update(mutate)
+
+    def delete_auth_token(self, profile_name: str) -> None:
+        def mutate(config: TacoConfig) -> None:
+            config.auth_tokens.pop(profile_name, None)
+
+        self.update(mutate)
+
+    def describe(self) -> dict[str, Any]:
+        return {
+            "config_path": str(self.path),
+            "config_scope": self.scope,
+        }
+
+
+def _invalid_config_error(path: Path) -> TacoError:
+    return TacoError(
+        code="CONFIG_FILE_INVALID",
+        message="配置文件不是合法 JSON 对象。",
+        exit_code=2,
+        hint=f"请检查或删除配置文件：{path}",
+    )

taco/core/context.py

@@ -0,0 +1,19 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+import typer
+
+
+@dataclass(slots=True)
+class CliContext:
+    profile: str | None = None
+    json_output: bool = False
+    no_input: bool = False
+
+
+def get_cli_context(ctx: typer.Context) -> CliContext:
+    state = ctx.find_root().obj
+    if isinstance(state, CliContext):
+        return state
+    return CliContext()