MjUdZddlmZddlZddlZddlmZddlmZddl m Z m Z ddl Z ddl mZddlmZdd lmZdd lmZdd lmZmZmZmZdd lmZdd lmZddlmZm Z m!Z!m"Z"m#Z#m$Z$ddl%m&Z&ddl'm(Z(ddl)m*Z*m+Z+m,Z,ddl-m.Z.ddl/m0Z0ddl1m2Z2e jfddZ4e4jke&de4jke(ddZ6dZ7dZ8dZ9dZ:d Z;d!ed$ed?8ddf dpd@ZMdqdAZNe4je jd4d:dBdC8dde;dDf drdEZOdsdFZPe4je jd4dGdH8e jddIdJ8e jddKdL8e jdMdNdO8e jddPdQ8e jddRdS8e jdTdUdV8e jdTdWdX8e jdYdZd[8e jdd\d]8e jd^d_d`8f dtdaZQdodbZReSdck(reRyy)uuCyberBrain26 command line interface. Every command in this module resolves its filesystem locations through :mod:`cyberbrain26.product.local_store` — the single existing resolution path that honours ``CYBERBRAIN_DATA_DIR`` / ``CYBERBRAIN_DB_PATH`` and creates the data directory with mode ``0o700``. No command here computes a data directory of its own, so ``roadmaps.json`` and the SQLite store can never diverge. Execution model (decided by the product owner, 2 Oct 2026) --------------------------------------------------------- ``cyberbrain run`` routes every roadmap step through :meth:`PtahBridge.execute_step`, which is the only entry that always applies ``InMemoryTaskDispatcher._authorize`` (identity -> scope -> policy -> approval) and writes an audit record. There is **no model call anywhere in this path**: a model turn has no action and no scope in the policy system, so it cannot be authorized through ``AuthorizedExecutionService``, and executing model-generated text would run untrusted input in the sandbox. The direct ``ModelGateway.chat`` call that previously lived in ``run`` is gone, and with it the ``--model`` and ``--lang`` options. As a direct consequence, roadmaps produced by ``cyberbrain plan`` carry planner steps whose payload declares no action; running such a roadmap executes nothing and reports every step as refused. That is the accepted, visible consequence of the decision and is stated by the command instead of being papered over. Operator-facing output --------------------- Diagnostics this module controls go to stderr via ``typer.echo(..., err=True)`` and every failure path exits non-zero. Progress lines go to stdout via ``rich.print``. This module never re-raises a handled exception, so a command failure never prints a Python traceback of its own. The libraries below it do log their own diagnostics (including stack traces) at ERROR level on stderr when a step is denied; suppressing that would hide real operational detail, so it is left in place. ) annotationsN)Sequence)Path) AnnotatedAny)print) __version__)SQLiteTaskQueue)SQLiteDatabase) DocumentTrustKG1NodeKnowledgeSource Sensitivity)EmbeddingConfig) MemoryService) PtahBridgeRoadmap RoadmapStatus RoadmapStep StepResult StepStatus) approvals_app) doctor_app)ensure_data_dir open_databaseresolve_db_path)AuditLog)PermissionScope) SecurityError cyberbrainzCyberBrain26 CLI Interface)namehelp approvals)r!doctorz7Explicit path to the CyberBrain26 SQLite database file.z2Explicit data directory holding the database file.zSeconds to wait for a human approval decision per step. Default 300 because the library default (30 s) is unusable for a two-terminal flow: on timeout the request is persisted as 'cancelled' and disappears from 'approvals pending'.a*Comma-separated permission scopes granted to the coder identity, e.g. 'python,shell'. Default is empty, and an empty value grants nothing: a step carrying code then ends closed at the scope gate. LIMITATION: --scopes currently applies only to the 'coder' role; it is NOT applied to security, evaluator, research, browser or planner steps. A code-carrying step with a non-coder role is not granted these scope(s) and is denied at the scope gate. This is a known limitation of the current identity_scopes schema and may be widened in a later design review.z roadmaps.jsongr@float!_DEFAULT_APPROVAL_TIMEOUT_SECONDSc#4K|]}|jywNvalue).0scopes 6/home/oem/CyberBrain26-unified/src/cyberbrain26/cli.py r.hs)S%%++)Sszfrozenset[str] _VALID_SCOPESc|tz S)zCReturn the roadmap index inside an already-resolved data directory.)_ROADMAPS_FILENAMEdata_dirs r-_roadmaps_filer4ns ( ((ct|}|jsiS tj|j }t|ts0tjd|ddtjd|S#t t f$r9}tjd|d|ddtjddd}~wwxYw) aGRead the roadmap index, or an empty mapping when nothing is stored yet. Raises: typer.Exit: With code 1 when the index exists but cannot be decoded. A corrupt index is refused rather than silently treated as empty, because "no roadmaps" and "unreadable roadmaps" must never look alike. zRoadmap index z could not be read: z5. Refusing to run; repair or move the file and retry.TerrNz3 is not a JSON object of roadmaps. Refusing to run.) r4existsjsonloads read_textOSError ValueErrortyperechoExit isinstancedict)r3pathdataexcs r-_load_roadmapsrHss ( #D ;;= &zz$..*+ dD ! TF"U V jjm K Z & TF"6se<1 1 jjm% &s#BC 4CC cbt|jtj|dy)zWrite the roadmap index into an already-created data directory. The directory is created by :func:`ensure_data_dir` with mode ``0o700`` before this is reached; it is never recreated here. )indentN)r4 write_textr;dumps)r3rFs r-_save_roadmapsrNs" 8'' 4(BCr5cPt||d}|tjd|S)aOpen the persistent SQLite store shared by every execution path. Persistence is mandatory: approval requests and audit records written by ``run`` must be readable by a second terminal running ``approvals``, so a store-less run would be a silent pass. There is deliberately no ``--no-persist`` flag on ``plan`` or ``run``. Args: db: Optional explicit database file path. data_dir: Resolved data directory used to derive the default path. Returns: The opened database handle. Raises: typer.BadParameter: If no handle could be opened. Never falls back to an in-memory store. T)db_pathr3persistzPersistent storage is mandatory for this command, but no SQLite database could be opened. Fix --db/--data-dir and retry; refusing to run without persistence because approvals and audit records would be lost.)rr@ BadParameter)dbr3databases r-_open_database_or_failrUs8&R(DIH   M  Or5) coder_scopescXt||}|r dt|ind}t|||S)aBuild a SQLite-backed :class:`PtahBridge` on the single shared store. Args: data_dir: Resolved data directory holding ``roadmaps.json``. db: Optional explicit database file path. approval_timeout_seconds: How long the bridge waits for each approval. coder_scopes: Scopes merged into the coder identity. Empty means the identity keeps no scopes, so a code step is denied at the scope gate before policy and approval are consulted. Returns: A bridge whose task queue, audit log and approval manager all share the same database file, so a decision made in another process is visible. coderN)rTapproval_timeout_secondsidentity_scopes)rUlistr)r3rSrZrWrTr[s r- _build_bridger]s9*&b(3H7Cw\ 23O !9' r5c \|sgSg}|jdD]+}|j}|s||vs|j|-|Dcgc] }|tvs |}}|rGt j ddj |ddj ttd|Scc}w)aParse and validate a ``--scopes`` CSV against the security plane's set. Args: raw: Raw option value; empty or ``None`` means "grant nothing". Returns: The validated, de-duplicated scope list, preserving the given order. Raises: typer.BadParameter: If any entry is not a scope the identity layer defines. Guessing is refused instead of silently dropping values. ,zunknown scope(s) in --scopes: , z. Valid scopes are: .)splitstripappendr/r@rRjoinsorted)rawscopesitemr,unknowns r- _parse_scopesrks  F #!  U&( MM% !#)GE,FuGGG  ,TYYw-?,@A!!%6-+@!A B! E   M Hs B)B)cB|dkrtjd|d|S)zReject a non-positive approval timeout before it reaches the bridge. Raises: typer.BadParameter: If the timeout is not a positive number. rz=--approval-timeout must be a positive number of seconds, got ra)r@rRr)s r-_validate_approval_timeoutrms2  z  KE7RS T   Lr5c|jjd}t|tr |j r|j Sy)aReturn the step's explicitly declared action, or ``None`` when absent. No default is inferred. The dispatcher would silently fall back to ``"execute"`` for an absent action; the CLI refuses instead, so the operator sees which step forgot to declare one. actionN)payloadgetrCstrrc)stepros r-_declared_actionrts9\\  h 'F&#6<<>||~ r5c X|j|j|jDcgc]Z}|j|j|j|j |j t|jjd\c}t|jjdScc}w)anRender a roadmap into the JSON-compatible form stored in the index. ``depends_on`` is part of the persisted shape on purpose: dropping it here would make a stored roadmap claim to be dependency-free when it is not. Args: roadmap: The roadmap to render. Returns: A mapping that round-trips through :func:`_deserialize_roadmap`. idrole descriptionrp depends_onstatusrwr!stepsr{) rwr!r}rxryrprzrr{r*r)roadmapss r-_serialize_roadmaprsjj ]]  dd }}99ll$QXX.44     /55   sAB'cV|jdgDcgc]\}t|d|d|d|d|jdg|jdrt|dntj^}}t |d|d |t |jdd  Scc}w) apRebuild a roadmap from its stored JSON form. Args: data: One entry of the ``roadmaps.json`` index. Returns: The roadmap, with step identity and ``depends_on`` preserved. Raises: ValueError: If a step or the roadmap carries an unknown status value. KeyError: If the required ``id``, ``name`` or step keys are missing. r}rwrxryrprzr{rvr!pendingr|)rqrrPENDINGrr)rFrr}s r-_deserialize_roadmapr/s,'2&   w6-(iLuu\2../eeHo:ak*:CUCU   E   : &\TXXh :;   sA!B&c &|j|}||St|}||vrB!!D5AD  Dc*tdtdy)z%Display current CyberBrain26 version.z5[bold green]CyberBrain26[/bold green] version: [cyan]z[/cyan]N)rr rVr5r-versionr{s A+g VWr5.z--goalz-gzThe high-level goal to plan.)r"defaultz--idzRoadmap identifier.z--stepsz-nzNumber of planning steps.ct|}t||t}d|d}t|jt r|jj |tj|j|tddd|||dd }|jr|jjdg} t| d D cgc]:\} } td | d| jd d|| jd dd <} } } |j||| } t!|}t#| ||<t%||t'd|dt)| d| j*D]'} t'd| j,d| j.)yt1j2d|d|j4xsdddt1j6d cc} } w)a;Generate a roadmap plan from a goal using the PlannerAgent. Planning is not an execution path: the planner only builds an in-memory task list, so there is nothing to authorize here. The generated roadmap still carries action-less steps, which 'run' refuses. Exits non-zero when planning fails. )r3rSrZzptah:z:step-0zstep-0plannerzPlan for goal: plan)goal max_stepsro)rwrxryrpr9)startzstep-ry)rsub_taskz[bold green]Roadmap 'z' created with z steps[/bold green]z - rzPlanning failed for roadmap 'z': no error detail returnedz. No roadmap was written.Tr7N)rr]r&rCqueuer delete_jobasynciorun execute_steprsuccessrFrq enumeraterrHrrNrlenr}rwryr@rAerrorrB)rrr}r3rSresolved_data_dirr durable_idresult plan_datair step_recordsr~roadmapss r-rrs"(1 " !BF G,J&,,0  + [[,,)$0"H   F~~KKOOFB/ ")15 1 1#;EE-4!%1553KL    '' D,G!"341':((3 %j\\AR@SSfgh 2A Db0 1 2  +J._execute s:MM )D%-(//  TWWI&VV  (3t/);2A Fz ' aborted: Nz Of those, zJ step(s) were never dispatched because their dependencies did not succeed.rz' did NOT complete: z of z step(s) failed (z).z ' completed: zQ step(s) executed and authorized. No model was called; only declared actions ran.returnNone)rrrkrmr]r@rArerr}r4rBrrrr RuntimeErrorr>r?rrf)rr3rSapproval_timeoutrhrrPrWtimeout_secondsrrGdetailrrrr~rs` @@@@@r-rrs*(1b+<=G (L01ABO " !0! F  JJ J & HJ#g,(, ,    |#7H d7==!""3DIIfX>N4O3PPRh   jjm JJ J<}S-?,@AF F1 <* =&  Yzl+cU;Fjjm%&s-F;;H 3HH ctd}t|}t}|jj ddt }t |}t|||}|S)u3Vytvoří MemoryService s výchozími komponentami.Nr2T)parentsexist_ok)rT audit_logconfig)rrrlancedb_directorymkdirrr r)r3rPrrrTmemory_services r-_get_memory_servicerNsi t$Hx0G  F ""4$"? Ig&H#N r5z--actionz;Action: ingest, search, hybrid-search, graph-search, or kg1z--pathz Path for ingest/ingest-directoryz--queryzQuery for searchtopicz --kg1-typezType for KG1 nodez--business-semanticszBusiness semantics for KG1 nodez--domain-constraintszDomain constraints for KG1 nodeTz"--auto-classify/--no-auto-classifyz0Enable/disable auto-classification during ingestz$--validate-stale/--no-validate-stalez-Filter out superseded documents during searchFz --timelinez=Show document timeline with valid_from/valid_to/superseded_byz --traversalz-Entity traversal: neighbors, path, or relatedrJz--depthu+Hloubka procházení grafu pro graph-searchc |dk(r.|,tjddtjd|dk(r.|,tjddtjd|d k(r.|,tjd dtjdt} |dk(r|Jtjd ||rtjd  t |j } d } d }| j dD]}|js|jjdr0 | j|\}}|r(tjd|j| dz } n'tjd|j|dz }tjd| d|dy|dvr:|Jtjd||rtjd |d k(r)| j|d}tjdn| j|d}|r|D]}| j|jdd}|s'tjd |jdtjd!|j tjd"|j"tjd#|j$xsd$n|rtjd%t'|d&t)|dD]\}}t'|jd'dd(kDr|jd'ddd(d)zn|jd'd}|jd*d}|jd+d}tjd,|d-|tjd.|jdd/|d0|ntjd1yyy|d3k(ro|Jtjd4| | j+|d| 5}|r|D]}| j|jdd}|s'tjd |jdtjd!|j tjd"|j"tjd#|j$xsd$nV|r>tjd%t'|d6t)|dD] \}}t'|jd'dd(kDr|jd'ddd(d)zn|jd'd}tjd,|d-|tjd.|jdd7|jd8d d9tjd:|jd;d$|jdj-|dd?ntjd1tjdA||s,tjdBdtjd t/dC|dDt1||t3dEdFt4j6t8j:dGdH|idI|xsdJigK}| j=|}tjdL|j>tjdM|j@tjdNtC|jDjGytjdP|dtjd#t$r7}tjd|jd|d|dz }Yd}~d}~wwxYw#t$r5}tjd|dtjddd}~wwxYw#t$r5}tjd2|dtjddd}~wwxYw#t$r5}tjd@|dtjddd}~wwxYw#t$r5}tjdO|dtjddd}~wwxYw)QzQKnowledge plane entry: ingest directory, search embeddings, or register KG1 node.ingestNz--path is required for 'ingest'Tr7r9searchz --query is required for 'search' hybrid-searchz'--query is required for 'hybrid-search'uIngestování adresáře: z0Auto-classifikace: zapnuta (entitace, typologie)r*rau Zaregistrován nový soubor: u& Soubor již existuje (přeskočen): u Chyba při zpracování ruKompletně zpracováno u nových souborů, u přeskočeno.uChyba při ingestování: )rruHledání s dotazem: uLStaleness validace: zapnuta (výsledky bez platných entit budou vynechány) )limitz.Hybrid search: keyword + semantic + RRF fusionrwrz Dokument: z valid_from: z valid_to: z superseded_by: zN/Az Nalezeno u výsledků:textdz... source_idrEz z. z ID: z , Zdroj: z , Cesta: uŽádné výsledky nenalezeny.uChyba při vyhledávání: z graph-searchzGraph search pro entitu: )rdepthu$ výsledků (graph-based retrieval):u , Skóre: scorez.3fu Grafová vzdálenost: graph_distancematched_entitiesz Matched entity: r`u!Chyba při vyhledávání grafu: uRegistrační KG1 node typu: u3--business-semantics je povinné pro KG1 registracizkg1--z cli-inputz cli://input)r source_uritrust sensitivityapprovedprimaryr,general)rwrsourcebusiness_semanticsdomain_constraintsevidenceuKG1 node zaregistrován: z Typ: z Business semantics: uChyba při registraci KG1: uNeznámá akce: )$r@rArBrrresolverglobis_filer! startswith register_filer> hybrid_searchsemantic_search get_documentrq valid_fromvalid_to superseded_byrr graph_searchrer hashrr REVIEWEDrPUBLICregister_kg1_noderwrr\rkeys)rorEquerykg1_typerr auto_classifyvalidate_staletimeline traversalrr root_pathfiles_processed files_skipped file_path _documentcreatederesultsrdocrrrentitieskg1_noderegistered_nodes r- knowledger gs9dl 4$?jjm em 54@jjm  U] <$Gjjm(*N  /v67  JJI J *T **,IOM&__S1 + $$&y~~/H/H/M +-;-I-I)-T* 7"!JJ)HHX'YZ+q0O!JJ)OPYP^P^O_'`a)Q.M + JJ00AATUbTccqr s . .    *5'23  JJe f *((66uB6G KL(88b8I%WF(55fjjr6JKC \&**T2B1C#DE %5cnn5E#FG ^CLL>#BC %89J9J9Se8T#UV W Ys7|nLAB!*7A!6bIAvCFvzzRXZ\G]C^adCd6::fb1$37%?jpjtjtu{}kAD & ; ;I!::fb1DJJA3b/0JJ6::d+;* !    .ug67 *$11%r1OG%WF(55fjjr6JKC \&**T2B1C#DE %5cnn5E#FG ^CLL>#BC %89J9J9Se8T#UV W Ys7|n4XYZ!*7A!6VIAvCFvzzRXZ\G]C^adCd6::fb1$37%?jpjtjtu{}kADJJA3b/0JJ6::d+;*! JJLRV W**Q-  *(1T*<%=$>?&),'00 + 2 2! %./A#B$+-?-L9#M H->>xHO JJ2?3E3E2FG H JJ!5!5 67 8 JJ/_5W5W5\5\5^0_/`a b  %fX.D9jjm_#+ %? ?OrRSQT#U[_`%* +  * JJ3A37T B**Q-T ) *J * JJ4QC8d C**Q-T ) *< * JJ:1#>D I**Q-T ) *@ * JJ4QC8d C**Q-T ) *sA_' _'=A%^$"_':A+`(&F`(#>a)"F'a) Aa)C b*$ _$-,__'_$$_'' `%00`  `%( a&10a!!a&) b'20b""b'* c(30c##c(ctyr()apprVr5r-mainr sEr5__main__)r3rrr)r3rrdict[str, Any])r3rrFrrr)rS Path | Noner3rrr ) r3rrSrrZr%rWz Sequence[str]rr)rgrrrz list[str])r*r%rr%)rsrr str | None)r~rrr)rFrrr)rrr3rrrrrrr) rrrrrrr}intr3GAnnotated[Path | None, typer.Option('--data-dir', help=_DATA_DIR_HELP)]rS;Annotated[Path | None, typer.Option('--db', help=_DB_HELP)]rr)rsrrrrbool) rrrr3rrSrrzQAnnotated[float, typer.Option('--approval-timeout', help=_APPROVAL_TIMEOUT_HELP)]rhz;Annotated[str, typer.Option('--scopes', help=_SCOPES_HELP)])rr)rorrrErrrrrrrrrrrrrrrrrrrrrr)T__doc__ __future__rrr;collections.abcrpathlibrtypingrrr@richr cyberbrain26r cyberbrain26.control_planer $cyberbrain26.data_plane.sqlite_storer &cyberbrain26.knowledge_plane.contractsr r rr-cyberbrain26.knowledge_plane.embedding_configr+cyberbrain26.knowledge_plane.memory_servicer&cyberbrain26.orchestration.ptah_bridgerrrrrrcyberbrain26.product.approvalsrcyberbrain26.product.doctorr cyberbrain26.product.local_storerrr!cyberbrain26.security_plane.auditr$cyberbrain26.security_plane.identityr&cyberbrain26.security_plane.permissionrTyperr add_typer_DB_HELP_DATA_DIR_HELP_APPROVAL_TIMEOUT_HELP _SCOPES_HELPr1r&__annotations__ frozensetr/r4rHrNrUr]rkrmrtrrrcommandrOptionrrrrr rrrVr5r-r5s "H# $! $6? JE92\\6@@ekk|*FG m+ . jx ( DEK J %,1!50!*)S?)S S ~S ) :DD#%  $     B:   <@&&XXX  S(D7UV"ell9f;PQaD7RS FJE EE E E DE EEP "ell3;[\ FJ *JLmmm D m  m Hmmj2%,,sJ5rs#u||D(9[\$ T9;MN ELL,=PQ*ell41GNop*ell41GNop&%,,t-QYKL'5<<.T\KL!U\\%<{|(ELL}Crsa1^__ _ _ _ _  _  _____ __D  zFr5