tsugite-cli 0.25.2__tar.gz → 0.25.3__tar.gz

{tsugite_cli-0.25.2 → tsugite_cli-0.25.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: tsugite-cli
-Version: 0.25.2
+Version: 0.25.3
 Summary: Micro-agent runner for task automation using markdown definitions
 Author: Justyn Shull
 License: GNU AFFERO GENERAL PUBLIC LICENSE

{tsugite_cli-0.25.2 → tsugite_cli-0.25.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tsugite-cli"
-version = "0.25.2"
+version = "0.25.3"
 description = "Micro-agent runner for task automation using markdown definitions"
 authors = [{ name = "Justyn Shull" }]
 requires-python = ">=3.11"

{tsugite_cli-0.25.2 → tsugite_cli-0.25.3}/tsugite/providers/anthropic.py

@@ -5,7 +5,6 @@ from __future__ import annotations
 import asyncio
 import json
 import logging
-import os
 import re
 from typing import Any, AsyncIterator
 
@@ -13,7 +12,7 @@ import httpx
 
 from tsugite.user_agent import set_user_agent_header
 
-from .base import CompletionResponse, ModelInfo, StreamChunk, Usage, default_count_tokens
+from .base import CompletionResponse, ModelInfo, StreamChunk, Usage, default_count_tokens, resolve_api_key
 from .model_registry import calculate_cost, register_models
 from .model_registry import get_model_info as _get_model_info
 
@@ -63,9 +62,11 @@ _ANTHROPIC_MODELS: dict[str, ModelInfo] = {
 class AnthropicProvider:
     """Provider for the Anthropic Messages API."""
 
+    api_key_env = "ANTHROPIC_API_KEY"
+
     def __init__(self, name: str = "anthropic", api_key: str | None = None, api_base: str | None = None):
         self.name = name
-        self.api_key = api_key or os.getenv("ANTHROPIC_API_KEY")
+        self.api_key = api_key
         self.api_base = (api_base or API_BASE).rstrip("/")
         self._client: httpx.AsyncClient | None = None
         self._client_loop = None
@@ -92,8 +93,9 @@ class AnthropicProvider:
             "anthropic-version": API_VERSION,
         }
         set_user_agent_header(headers)
-        if self.api_key:
-            headers["x-api-key"] = self.api_key
+        api_key = self.api_key or resolve_api_key(self.api_key_env)
+        if api_key:
+            headers["x-api-key"] = api_key
         return headers
 
     async def acompletion(

{tsugite_cli-0.25.2 → tsugite_cli-0.25.3}/tsugite/providers/base.py

@@ -2,11 +2,20 @@
 
 from __future__ import annotations
 
+import logging
+import os
+import shutil
+import time
 from dataclasses import dataclass
 from typing import Any, AsyncIterator, Protocol, runtime_checkable
 
 _O200K_PREFIXES = ("gpt-4o", "o1", "o3", "o4", "chatgpt-4o")
 _tiktoken_cache: dict[str, Any] = {}
+API_KEY_CACHE_TTL_SECONDS = 60
+_secret_api_keys: dict[str, tuple[float, str | None]] = {}
+_backend_errors_logged: set[str] = set()
+
+logger = logging.getLogger(__name__)
 
 
 @dataclass
@@ -100,3 +109,42 @@ def default_count_tokens(text: str, model: str) -> int:
         return len(_tiktoken_cache[encoding_name].encode(text))
     except Exception:
         return len(text) // 4
+
+
+def api_key_secret_name(env_var: str) -> str:
+    """Secrets-backend name for the key read from ``env_var``."""
+    return env_var.lower().replace("_", "-")
+
+
+def resolve_api_key(env_var: str) -> str | None:
+    """Key from the secrets backend, else ``env_var``. Backend lookups are cached for ``API_KEY_CACHE_TTL_SECONDS``."""
+    now = time.monotonic()
+    cached = _secret_api_keys.get(env_var)
+    if cached is None or now - cached[0] >= API_KEY_CACHE_TTL_SECONDS:
+        from tsugite.secrets import get_backend
+
+        try:
+            _secret_api_keys[env_var] = (now, get_backend().get(api_key_secret_name(env_var)))
+        except Exception as e:
+            if env_var not in _backend_errors_logged:
+                _backend_errors_logged.add(env_var)
+                logger.warning("Secrets backend failed reading the key for %s, using the env var: %s", env_var, e)
+            return os.getenv(env_var)
+    return _secret_api_keys[env_var][1] or os.getenv(env_var)
+
+
+def invalidate_api_key_cache() -> None:
+    _secret_api_keys.clear()
+    _backend_errors_logged.clear()
+
+
+def configured_binary(provider: str) -> str | None:
+    from tsugite.config import load_config
+
+    return load_config().plugins.get(provider, {}).get("binary") or None
+
+
+def resolve_binary(provider: str, default: str) -> str | None:
+    """Path of a CLI provider's executable from config ``plugins.<provider>.binary``, else ``default`` on PATH."""
+    configured = configured_binary(provider)
+    return shutil.which(os.path.expanduser(configured) if configured else default)

{tsugite_cli-0.25.2 → tsugite_cli-0.25.3}/tsugite/providers/openai_compat.py

@@ -5,14 +5,13 @@ from __future__ import annotations
 import asyncio
 import json
 import logging
-import os
 from typing import Any, AsyncIterator
 
 import httpx
 
 from tsugite.user_agent import set_user_agent_header
 
-from .base import CompletionResponse, ModelInfo, StreamChunk, Usage, default_count_tokens
+from .base import CompletionResponse, ModelInfo, StreamChunk, Usage, default_count_tokens, resolve_api_key
 from .model_registry import calculate_cost, register_models
 from .model_registry import get_model_info as _get_model_info
 
@@ -122,10 +121,12 @@ class OpenAICompatProvider:
         api_base: str,
         api_key: str | None = None,
         extra_headers: dict[str, str] | None = None,
+        api_key_env: str | None = None,
     ):
         self.name = name
         self.api_base = api_base.rstrip("/")
         self.api_key = api_key
+        self.api_key_env = api_key_env
         self.extra_headers = extra_headers or {}
         self._client: httpx.AsyncClient | None = None
         self._client_loop = None
@@ -148,8 +149,9 @@ class OpenAICompatProvider:
         headers: dict[str, str] = {"Content-Type": "application/json"}
         set_user_agent_header(headers)
         headers.update(self.extra_headers)
-        if self.api_key:
-            headers["Authorization"] = f"Bearer {self.api_key}"
+        api_key = self.api_key or (resolve_api_key(self.api_key_env) if self.api_key_env else None)
+        if api_key:
+            headers["Authorization"] = f"Bearer {api_key}"
         return headers
 
     async def acompletion(
@@ -282,16 +284,12 @@ def create_provider(name: str = "openai", **kwargs: Any) -> OpenAICompatProvider
 
     api_base = kwargs.get("api_base") or config.get("api_base") or "https://api.openai.com/v1"
 
-    api_key = kwargs.get("api_key")
-    if not api_key:
-        env_key = config.get("api_key_env")
-        api_key = os.getenv(env_key) if env_key else None
-
     extra_headers = {**config.get("extra_headers", {}), **kwargs.get("extra_headers", {})}
 
     return OpenAICompatProvider(
         name=name,
         api_base=api_base,
-        api_key=api_key,
+        api_key=kwargs.get("api_key"),
         extra_headers=extra_headers,
+        api_key_env=config.get("api_key_env"),
     )

{tsugite_cli-0.25.2 → tsugite_cli-0.25.3}/tsugite/providers/openrouter.py

@@ -59,11 +59,10 @@ class OpenRouterProvider(OpenAICompatProvider):
 
 
 def create_provider(name: str = "openrouter", **kwargs: Any) -> OpenRouterProvider:
-    import os
-
     return OpenRouterProvider(
         name=name,
         api_base=kwargs.get("api_base") or "https://openrouter.ai/api/v1",
-        api_key=kwargs.get("api_key") or os.getenv("OPENROUTER_API_KEY"),
+        api_key=kwargs.get("api_key"),
         extra_headers=kwargs.get("extra_headers", {}),
+        api_key_env="OPENROUTER_API_KEY",
     )

{tsugite_cli-0.25.2 → tsugite_cli-0.25.3}/tsugite/secrets/sqlite.py

@@ -3,10 +3,18 @@
 import base64
 import getpass
 import os
+import secrets
+import shutil
 import sqlite3
+import subprocess
 import sys
+import threading
 from pathlib import Path
 
+KEYCHAIN_SERVICE = "tsugite"
+# `security find-generic-password` exit status for errSecItemNotFound.
+MACOS_ITEM_NOT_FOUND = 44
+
 
 class SqliteSecretBackend:
     """Stores secrets in SQLite, encrypted with Fernet. A passphrase is always required."""
@@ -18,14 +26,15 @@ class SqliteSecretBackend:
         self._db_path = Path(path)
         self._conn: sqlite3.Connection | None = None
         self._key_cache: dict[bytes, bytes] = {}
-        self._passphrase = self._resolve_passphrase(
-            config_passphrase=config.get("passphrase"),
-            key_file=config.get("key_file"),
-        )
-        if not self._passphrase:
+        self._keychain_account = (config.get("keychain_account") or "secrets") if config.get("keychain") else None
+        if self._keychain_account and any(c in self._keychain_account for c in '"\\\r\n'):
+            raise ValueError("keychain_account must not contain quotes, backslashes or line breaks")
+        self._keychain_lock = threading.Lock()
+        self._passphrase_value = self._resolve_passphrase(config)
+        if not self._passphrase_value and not self._keychain_account:
             raise ValueError(
                 "sqlite secrets backend requires a passphrase. Set TSUGITE_SECRETS_KEY env var, "
-                "configure key_file in secrets config, or use an interactive terminal."
+                "configure key_file or keychain in secrets config, or use an interactive terminal."
             )
 
     def _get_conn(self) -> sqlite3.Connection:
@@ -40,25 +49,50 @@ class SqliteSecretBackend:
             self._conn.commit()
         return self._conn
 
-    @staticmethod
-    def _resolve_passphrase(
-        config_passphrase: str | None = None,
-        key_file: str | None = None,
-    ) -> str | None:
+    def _resolve_passphrase(self, config: dict) -> str | None:
         env_key = os.environ.get("TSUGITE_SECRETS_KEY")
         if env_key:
             return env_key
+        key_file = config.get("key_file")
         if key_file:
             kf = Path(key_file).expanduser()
             if kf.is_file():
                 return kf.read_text().strip()
-        if config_passphrase:
-            return config_passphrase
+        if config.get("keychain"):
+            return None
+        if config.get("passphrase"):
+            return config["passphrase"]
         if sys.stdin.isatty():
             passphrase = getpass.getpass("Secrets passphrase: ")
             return passphrase or None
         return None
 
+    @property
+    def _passphrase(self) -> str:
+        with self._keychain_lock:
+            if self._passphrase_value is None:
+                self._passphrase_value = self._keychain_passphrase()
+            return self._passphrase_value
+
+    def _keychain_passphrase(self) -> str:
+        account = self._keychain_account
+        key = _keychain_lookup(account)
+        if key:
+            return key
+        if self._get_conn().execute("SELECT 1 FROM secrets LIMIT 1").fetchone():
+            raise ValueError(
+                f"The OS keychain has no secrets key (service '{KEYCHAIN_SERVICE}', account '{account}'), "
+                f"but {self._db_path} already holds encrypted secrets. Restore the key to the keychain "
+                "or set TSUGITE_SECRETS_KEY."
+            )
+        key = secrets.token_urlsafe(32)
+        _keychain_store(account, key)
+        if _keychain_lookup(account) != key:
+            raise ValueError(
+                f"Stored the secrets key in the OS keychain (account '{account}') but could not read it back"
+            )
+        return key
+
     def _derive_key(self, salt: bytes) -> bytes:
         cached = self._key_cache.get(salt)
         if cached:
@@ -119,3 +153,45 @@ class SqliteSecretBackend:
     def list_names(self) -> list[str]:
         rows = self._get_conn().execute("SELECT name FROM secrets ORDER BY name").fetchall()
         return [r[0] for r in rows]
+
+
+def _keychain_tool() -> str:
+    if sys.platform == "darwin":
+        return "/usr/bin/security"
+    tool = shutil.which("secret-tool")
+    if not tool:
+        raise ValueError(
+            "secrets keychain is enabled but secret-tool was not found. Install libsecret-tools "
+            "and run a Secret Service (gnome-keyring, KeePassXC or KWallet)."
+        )
+    return tool
+
+
+def _keychain_lookup(account: str) -> str | None:
+    tool = _keychain_tool()
+    if sys.platform == "darwin":
+        cmd = [tool, "find-generic-password", "-s", KEYCHAIN_SERVICE, "-a", account, "-w"]
+    else:
+        cmd = [tool, "lookup", "service", KEYCHAIN_SERVICE, "account", account]
+    result = subprocess.run(cmd, capture_output=True, text=True)
+    if result.returncode == 0:
+        return result.stdout.strip()
+    # secret-tool exits 1 with empty stderr for a missing item.
+    missing = result.returncode == MACOS_ITEM_NOT_FOUND if sys.platform == "darwin" else not result.stderr.strip()
+    if missing:
+        return None
+    raise ValueError(f"Could not read the secrets key from the OS keychain: {result.stderr.strip()}")
+
+
+def _keychain_store(account: str, key: str) -> None:
+    tool = _keychain_tool()
+    if sys.platform == "darwin":
+        # argv is visible to other local users through `ps`.
+        cmd = [tool, "-i"]
+        stdin = f'add-generic-password -s "{KEYCHAIN_SERVICE}" -a "{account}" -w "{key}"\n'
+    else:
+        cmd = [tool, "store", "--label=Tsugite secrets key", "service", KEYCHAIN_SERVICE, "account", account]
+        stdin = key
+    result = subprocess.run(cmd, input=stdin, capture_output=True, text=True)
+    if result.returncode != 0:
+        raise ValueError(f"Could not store the secrets key in the OS keychain: {result.stderr.strip()}")