tsugite-cli 0.25.2__tar.gz → 0.25.4__tar.gz

{tsugite_cli-0.25.2 → tsugite_cli-0.25.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: tsugite-cli
-Version: 0.25.2
+Version: 0.25.4
 Summary: Micro-agent runner for task automation using markdown definitions
 Author: Justyn Shull
 License: GNU AFFERO GENERAL PUBLIC LICENSE

{tsugite_cli-0.25.2 → tsugite_cli-0.25.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tsugite-cli"
-version = "0.25.2"
+version = "0.25.4"
 description = "Micro-agent runner for task automation using markdown definitions"
 authors = [{ name = "Justyn Shull" }]
 requires-python = ">=3.11"

{tsugite_cli-0.25.2 → tsugite_cli-0.25.4}/tsugite/providers/anthropic.py

@@ -5,7 +5,6 @@ from __future__ import annotations
 import asyncio
 import json
 import logging
-import os
 import re
 from typing import Any, AsyncIterator
 
@@ -13,7 +12,7 @@ import httpx
 
 from tsugite.user_agent import set_user_agent_header
 
-from .base import CompletionResponse, ModelInfo, StreamChunk, Usage, default_count_tokens
+from .base import CompletionResponse, ModelInfo, StreamChunk, Usage, default_count_tokens, resolve_api_key
 from .model_registry import calculate_cost, register_models
 from .model_registry import get_model_info as _get_model_info
 
@@ -63,9 +62,11 @@ _ANTHROPIC_MODELS: dict[str, ModelInfo] = {
 class AnthropicProvider:
     """Provider for the Anthropic Messages API."""
 
+    api_key_env = "ANTHROPIC_API_KEY"
+
     def __init__(self, name: str = "anthropic", api_key: str | None = None, api_base: str | None = None):
         self.name = name
-        self.api_key = api_key or os.getenv("ANTHROPIC_API_KEY")
+        self.api_key = api_key
         self.api_base = (api_base or API_BASE).rstrip("/")
         self._client: httpx.AsyncClient | None = None
         self._client_loop = None
@@ -92,8 +93,9 @@ class AnthropicProvider:
             "anthropic-version": API_VERSION,
         }
         set_user_agent_header(headers)
-        if self.api_key:
-            headers["x-api-key"] = self.api_key
+        api_key = self.api_key or resolve_api_key(self.api_key_env)
+        if api_key:
+            headers["x-api-key"] = api_key
         return headers
 
     async def acompletion(

{tsugite_cli-0.25.2 → tsugite_cli-0.25.4}/tsugite/providers/base.py

@@ -2,11 +2,20 @@
 
 from __future__ import annotations
 
+import logging
+import os
+import shutil
+import time
 from dataclasses import dataclass
 from typing import Any, AsyncIterator, Protocol, runtime_checkable
 
 _O200K_PREFIXES = ("gpt-4o", "o1", "o3", "o4", "chatgpt-4o")
 _tiktoken_cache: dict[str, Any] = {}
+API_KEY_CACHE_TTL_SECONDS = 60
+_secret_api_keys: dict[str, tuple[float, str | None]] = {}
+_backend_errors_logged: set[str] = set()
+
+logger = logging.getLogger(__name__)
 
 
 @dataclass
@@ -100,3 +109,42 @@ def default_count_tokens(text: str, model: str) -> int:
         return len(_tiktoken_cache[encoding_name].encode(text))
     except Exception:
         return len(text) // 4
+
+
+def api_key_secret_name(env_var: str) -> str:
+    """Secrets-backend name for the key read from ``env_var``."""
+    return env_var.lower().replace("_", "-")
+
+
+def resolve_api_key(env_var: str) -> str | None:
+    """Key from the secrets backend, else ``env_var``. Backend lookups are cached for ``API_KEY_CACHE_TTL_SECONDS``."""
+    now = time.monotonic()
+    cached = _secret_api_keys.get(env_var)
+    if cached is None or now - cached[0] >= API_KEY_CACHE_TTL_SECONDS:
+        from tsugite.secrets import get_backend
+
+        try:
+            _secret_api_keys[env_var] = (now, get_backend().get(api_key_secret_name(env_var)))
+        except Exception as e:
+            if env_var not in _backend_errors_logged:
+                _backend_errors_logged.add(env_var)
+                logger.warning("Secrets backend failed reading the key for %s, using the env var: %s", env_var, e)
+            return os.getenv(env_var)
+    return _secret_api_keys[env_var][1] or os.getenv(env_var)
+
+
+def invalidate_api_key_cache() -> None:
+    _secret_api_keys.clear()
+    _backend_errors_logged.clear()
+
+
+def configured_binary(provider: str) -> str | None:
+    from tsugite.config import load_config
+
+    return load_config().plugins.get(provider, {}).get("binary") or None
+
+
+def resolve_binary(provider: str, default: str) -> str | None:
+    """Path of a CLI provider's executable from config ``plugins.<provider>.binary``, else ``default`` on PATH."""
+    configured = configured_binary(provider)
+    return shutil.which(os.path.expanduser(configured) if configured else default)

{tsugite_cli-0.25.2 → tsugite_cli-0.25.4}/tsugite/providers/openai_compat.py

@@ -5,14 +5,13 @@ from __future__ import annotations
 import asyncio
 import json
 import logging
-import os
 from typing import Any, AsyncIterator
 
 import httpx
 
 from tsugite.user_agent import set_user_agent_header
 
-from .base import CompletionResponse, ModelInfo, StreamChunk, Usage, default_count_tokens
+from .base import CompletionResponse, ModelInfo, StreamChunk, Usage, default_count_tokens, resolve_api_key
 from .model_registry import calculate_cost, register_models
 from .model_registry import get_model_info as _get_model_info
 
@@ -122,10 +121,12 @@ class OpenAICompatProvider:
         api_base: str,
         api_key: str | None = None,
         extra_headers: dict[str, str] | None = None,
+        api_key_env: str | None = None,
     ):
         self.name = name
         self.api_base = api_base.rstrip("/")
         self.api_key = api_key
+        self.api_key_env = api_key_env
         self.extra_headers = extra_headers or {}
         self._client: httpx.AsyncClient | None = None
         self._client_loop = None
@@ -148,8 +149,9 @@ class OpenAICompatProvider:
         headers: dict[str, str] = {"Content-Type": "application/json"}
         set_user_agent_header(headers)
         headers.update(self.extra_headers)
-        if self.api_key:
-            headers["Authorization"] = f"Bearer {self.api_key}"
+        api_key = self.api_key or (resolve_api_key(self.api_key_env) if self.api_key_env else None)
+        if api_key:
+            headers["Authorization"] = f"Bearer {api_key}"
         return headers
 
     async def acompletion(
@@ -282,16 +284,12 @@ def create_provider(name: str = "openai", **kwargs: Any) -> OpenAICompatProvider
 
     api_base = kwargs.get("api_base") or config.get("api_base") or "https://api.openai.com/v1"
 
-    api_key = kwargs.get("api_key")
-    if not api_key:
-        env_key = config.get("api_key_env")
-        api_key = os.getenv(env_key) if env_key else None
-
     extra_headers = {**config.get("extra_headers", {}), **kwargs.get("extra_headers", {})}
 
     return OpenAICompatProvider(
         name=name,
         api_base=api_base,
-        api_key=api_key,
+        api_key=kwargs.get("api_key"),
         extra_headers=extra_headers,
+        api_key_env=config.get("api_key_env"),
     )

{tsugite_cli-0.25.2 → tsugite_cli-0.25.4}/tsugite/providers/openrouter.py

@@ -59,11 +59,10 @@ class OpenRouterProvider(OpenAICompatProvider):
 
 
 def create_provider(name: str = "openrouter", **kwargs: Any) -> OpenRouterProvider:
-    import os
-
     return OpenRouterProvider(
         name=name,
         api_base=kwargs.get("api_base") or "https://openrouter.ai/api/v1",
-        api_key=kwargs.get("api_key") or os.getenv("OPENROUTER_API_KEY"),
+        api_key=kwargs.get("api_key"),
         extra_headers=kwargs.get("extra_headers", {}),
+        api_key_env="OPENROUTER_API_KEY",
     )

tsugite_cli-0.25.4/tsugite/secrets/sqlite.py

@@ -0,0 +1,205 @@
+"""SQLite secret backend with Fernet encryption."""
+
+import base64
+import getpass
+import os
+import secrets
+import shutil
+import sqlite3
+import subprocess
+import sys
+import threading
+from pathlib import Path
+
+KEYCHAIN_SERVICE = "tsugite"
+# `security find-generic-password` exit status for errSecItemNotFound.
+MACOS_ITEM_NOT_FOUND = 44
+
+
+class SqliteSecretBackend:
+    """Stores secrets in SQLite, encrypted with Fernet. A passphrase is always required."""
+
+    def __init__(self, config: dict):
+        from tsugite.config import get_xdg_data_path
+
+        path = config.get("path") or str(get_xdg_data_path("secrets") / "secrets.db")
+        self._db_path = Path(path)
+        self._conn: sqlite3.Connection | None = None
+        self._key_cache: dict[bytes, bytes] = {}
+        self._keychain_account = (config.get("keychain_account") or "secrets") if config.get("keychain") else None
+        if self._keychain_account and any(c in self._keychain_account for c in '"\\\r\n'):
+            raise ValueError("keychain_account must not contain quotes, backslashes or line breaks")
+        self._keychain_lock = threading.Lock()
+        self._passphrase_value = self._resolve_passphrase(config)
+        if not self._passphrase_value and not self._keychain_account:
+            raise ValueError(
+                "sqlite secrets backend requires a passphrase. Set TSUGITE_SECRETS_KEY env var, "
+                "configure key_file or keychain in secrets config, or use an interactive terminal."
+            )
+
+    def _get_conn(self) -> sqlite3.Connection:
+        if self._conn is None:
+            self._db_path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+            new_db = not self._db_path.exists()
+            self._conn = sqlite3.connect(str(self._db_path), check_same_thread=False)
+            if new_db:
+                self._db_path.chmod(0o600)
+            self._conn.execute("PRAGMA journal_mode=WAL")
+            self._conn.execute("CREATE TABLE IF NOT EXISTS secrets (name TEXT PRIMARY KEY, value TEXT NOT NULL)")
+            self._conn.commit()
+        return self._conn
+
+    def _resolve_passphrase(self, config: dict) -> str | None:
+        env_key = os.environ.get("TSUGITE_SECRETS_KEY")
+        if env_key:
+            return env_key
+        key_file = config.get("key_file")
+        if key_file:
+            kf = Path(key_file).expanduser()
+            if kf.is_file():
+                return kf.read_text().strip()
+        if config.get("keychain"):
+            return None
+        if config.get("passphrase"):
+            return config["passphrase"]
+        if sys.stdin.isatty():
+            passphrase = getpass.getpass("Secrets passphrase: ")
+            return passphrase or None
+        return None
+
+    @property
+    def _passphrase(self) -> str:
+        with self._keychain_lock:
+            if self._passphrase_value is None:
+                self._passphrase_value = self._keychain_passphrase()
+            return self._passphrase_value
+
+    def _keychain_passphrase(self) -> str:
+        import fcntl
+
+        self._db_path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+        with open(self._db_path.with_name(self._db_path.name + ".lock"), "a") as lock:
+            fcntl.flock(lock, fcntl.LOCK_EX)
+            return self._lookup_or_create_key()
+
+    def _lookup_or_create_key(self) -> str:
+        account = self._keychain_account
+        key = _keychain_lookup(account)
+        if key:
+            return key
+        if self._get_conn().execute("SELECT 1 FROM secrets LIMIT 1").fetchone():
+            raise ValueError(
+                f"The OS keychain has no secrets key (service '{KEYCHAIN_SERVICE}', account '{account}'), "
+                f"but {self._db_path} already holds encrypted secrets. Restore the key to the keychain "
+                "or set TSUGITE_SECRETS_KEY."
+            )
+        key = secrets.token_urlsafe(32)
+        _keychain_store(account, key)
+        if _keychain_lookup(account) != key:
+            raise ValueError(
+                f"Stored the secrets key in the OS keychain (account '{account}') but could not read it back"
+            )
+        return key
+
+    def _derive_key(self, salt: bytes) -> bytes:
+        cached = self._key_cache.get(salt)
+        if cached:
+            return cached
+        from cryptography.hazmat.primitives import hashes
+        from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
+
+        kdf = PBKDF2HMAC(algorithm=hashes.SHA256(), length=32, salt=salt, iterations=480_000)
+        key = base64.urlsafe_b64encode(kdf.derive(self._passphrase.encode()))
+        self._key_cache[salt] = key
+        return key
+
+    def _encrypt(self, value: str) -> str:
+        from cryptography.fernet import Fernet
+
+        salt = os.urandom(16)
+        key = self._derive_key(salt)
+        token = Fernet(key).encrypt(value.encode())
+        return base64.b64encode(salt + token).decode()
+
+    def _decrypt(self, blob: str) -> str:
+        from cryptography.fernet import Fernet, InvalidToken
+
+        try:
+            raw = base64.b64decode(blob)
+        except Exception as e:
+            raise ValueError(f"Corrupted secret value: {e}") from e
+        if len(raw) < 17:
+            raise ValueError("Corrupted secret value: too short")
+        salt, token = raw[:16], raw[16:]
+        key = self._derive_key(salt)
+        try:
+            return Fernet(key).decrypt(token).decode()
+        except InvalidToken:
+            raise ValueError("Wrong passphrase or corrupted secret")
+
+    def get(self, name: str) -> str | None:
+        row = self._get_conn().execute("SELECT value FROM secrets WHERE name=?", (name,)).fetchone()
+        if row is None:
+            return None
+        return self._decrypt(row[0])
+
+    def set(self, name: str, value: str) -> None:
+        encrypted = self._encrypt(value)
+        conn = self._get_conn()
+        conn.execute(
+            "INSERT OR REPLACE INTO secrets (name, value) VALUES (?, ?)",
+            (name, encrypted),
+        )
+        conn.commit()
+
+    def delete(self, name: str) -> bool:
+        conn = self._get_conn()
+        cursor = conn.execute("DELETE FROM secrets WHERE name=?", (name,))
+        conn.commit()
+        return cursor.rowcount > 0
+
+    def list_names(self) -> list[str]:
+        rows = self._get_conn().execute("SELECT name FROM secrets ORDER BY name").fetchall()
+        return [r[0] for r in rows]
+
+
+def _keychain_tool() -> str:
+    if sys.platform == "darwin":
+        return "/usr/bin/security"
+    tool = shutil.which("secret-tool")
+    if not tool:
+        raise ValueError(
+            "secrets keychain is enabled but secret-tool was not found. Install libsecret-tools "
+            "and run a Secret Service (gnome-keyring, KeePassXC or KWallet)."
+        )
+    return tool
+
+
+def _keychain_lookup(account: str) -> str | None:
+    tool = _keychain_tool()
+    if sys.platform == "darwin":
+        cmd = [tool, "find-generic-password", "-s", KEYCHAIN_SERVICE, "-a", account, "-w"]
+    else:
+        cmd = [tool, "lookup", "service", KEYCHAIN_SERVICE, "account", account]
+    result = subprocess.run(cmd, capture_output=True, text=True)
+    if result.returncode == 0:
+        return result.stdout.strip()
+    # secret-tool exits 1 with empty stderr for a missing item.
+    missing = result.returncode == MACOS_ITEM_NOT_FOUND if sys.platform == "darwin" else not result.stderr.strip()
+    if missing:
+        return None
+    raise ValueError(f"Could not read the secrets key from the OS keychain: {result.stderr.strip()}")
+
+
+def _keychain_store(account: str, key: str) -> None:
+    tool = _keychain_tool()
+    if sys.platform == "darwin":
+        # argv is visible to other local users through `ps`.
+        cmd = [tool, "-i"]
+        stdin = f'add-generic-password -s "{KEYCHAIN_SERVICE}" -a "{account}" -w "{key}"\n'
+    else:
+        cmd = [tool, "store", "--label=Tsugite secrets key", "service", KEYCHAIN_SERVICE, "account", account]
+        stdin = key
+    result = subprocess.run(cmd, input=stdin, capture_output=True, text=True)
+    if result.returncode != 0:
+        raise ValueError(f"Could not store the secrets key in the OS keychain: {result.stderr.strip()}")

tsugite_cli-0.25.2/tsugite/secrets/sqlite.py

@@ -1,121 +0,0 @@
-"""SQLite secret backend with Fernet encryption."""
-
-import base64
-import getpass
-import os
-import sqlite3
-import sys
-from pathlib import Path
-
-
-class SqliteSecretBackend:
-    """Stores secrets in SQLite, encrypted with Fernet. A passphrase is always required."""
-
-    def __init__(self, config: dict):
-        from tsugite.config import get_xdg_data_path
-
-        path = config.get("path") or str(get_xdg_data_path("secrets") / "secrets.db")
-        self._db_path = Path(path)
-        self._conn: sqlite3.Connection | None = None
-        self._key_cache: dict[bytes, bytes] = {}
-        self._passphrase = self._resolve_passphrase(
-            config_passphrase=config.get("passphrase"),
-            key_file=config.get("key_file"),
-        )
-        if not self._passphrase:
-            raise ValueError(
-                "sqlite secrets backend requires a passphrase. Set TSUGITE_SECRETS_KEY env var, "
-                "configure key_file in secrets config, or use an interactive terminal."
-            )
-
-    def _get_conn(self) -> sqlite3.Connection:
-        if self._conn is None:
-            self._db_path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
-            new_db = not self._db_path.exists()
-            self._conn = sqlite3.connect(str(self._db_path), check_same_thread=False)
-            if new_db:
-                self._db_path.chmod(0o600)
-            self._conn.execute("PRAGMA journal_mode=WAL")
-            self._conn.execute("CREATE TABLE IF NOT EXISTS secrets (name TEXT PRIMARY KEY, value TEXT NOT NULL)")
-            self._conn.commit()
-        return self._conn
-
-    @staticmethod
-    def _resolve_passphrase(
-        config_passphrase: str | None = None,
-        key_file: str | None = None,
-    ) -> str | None:
-        env_key = os.environ.get("TSUGITE_SECRETS_KEY")
-        if env_key:
-            return env_key
-        if key_file:
-            kf = Path(key_file).expanduser()
-            if kf.is_file():
-                return kf.read_text().strip()
-        if config_passphrase:
-            return config_passphrase
-        if sys.stdin.isatty():
-            passphrase = getpass.getpass("Secrets passphrase: ")
-            return passphrase or None
-        return None
-
-    def _derive_key(self, salt: bytes) -> bytes:
-        cached = self._key_cache.get(salt)
-        if cached:
-            return cached
-        from cryptography.hazmat.primitives import hashes
-        from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
-
-        kdf = PBKDF2HMAC(algorithm=hashes.SHA256(), length=32, salt=salt, iterations=480_000)
-        key = base64.urlsafe_b64encode(kdf.derive(self._passphrase.encode()))
-        self._key_cache[salt] = key
-        return key
-
-    def _encrypt(self, value: str) -> str:
-        from cryptography.fernet import Fernet
-
-        salt = os.urandom(16)
-        key = self._derive_key(salt)
-        token = Fernet(key).encrypt(value.encode())
-        return base64.b64encode(salt + token).decode()
-
-    def _decrypt(self, blob: str) -> str:
-        from cryptography.fernet import Fernet, InvalidToken
-
-        try:
-            raw = base64.b64decode(blob)
-        except Exception as e:
-            raise ValueError(f"Corrupted secret value: {e}") from e
-        if len(raw) < 17:
-            raise ValueError("Corrupted secret value: too short")
-        salt, token = raw[:16], raw[16:]
-        key = self._derive_key(salt)
-        try:
-            return Fernet(key).decrypt(token).decode()
-        except InvalidToken:
-            raise ValueError("Wrong passphrase or corrupted secret")
-
-    def get(self, name: str) -> str | None:
-        row = self._get_conn().execute("SELECT value FROM secrets WHERE name=?", (name,)).fetchone()
-        if row is None:
-            return None
-        return self._decrypt(row[0])
-
-    def set(self, name: str, value: str) -> None:
-        encrypted = self._encrypt(value)
-        conn = self._get_conn()
-        conn.execute(
-            "INSERT OR REPLACE INTO secrets (name, value) VALUES (?, ?)",
-            (name, encrypted),
-        )
-        conn.commit()
-
-    def delete(self, name: str) -> bool:
-        conn = self._get_conn()
-        cursor = conn.execute("DELETE FROM secrets WHERE name=?", (name,))
-        conn.commit()
-        return cursor.rowcount > 0
-
-    def list_names(self) -> list[str]:
-        rows = self._get_conn().execute("SELECT name FROM secrets ORDER BY name").fetchall()
-        return [r[0] for r in rows]