Elydora-Infrastructure/Elydora-Python-SDK
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(python): audit providers claudecode codex cursor gemini

Browse Source 
Add _runtime (paths, config validation, status checks) and _shell_command
(quoting, parsers) and move the four providers onto them.

Claude-Session: https://claude.ai/code/session_01Agoc9bRVE9KL7mmWtey9Vq
This commit is contained in:
雷电芽衣 committed 2026-09-02 23:36:33 -04:00
1 parent ed34831c20
commit 6dd0197cab
15 files changed
+732 -1755
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

elydora/plugins/cursor.py
+40 -155
View File
@@ -2,79 +2,36 @@
from __future__ import annotations
import base64
import json
import os
import urllib.parse
from typing import List, Optional
from elydora._runtime_paths import resolve_agent_directory
from elydora.utils import base64url_encode
from ._transaction import FileChange
from ._managed_files import physical_directory_exists
from ._runtime import (
DEFAULT_BASE_URL,
present,
resolve_runtime_paths,
runtime_file_changes,
validate_private_key,
validate_runtime_tree,
)
from ._transaction import write_changes
from .base import AgentPlugin, InstallConfig, PluginStatus
from .cursor_contract import (
AGENT_KEY,
AUDIT_SCRIPT,
GUARD_SCRIPT,
build_handler,
remove_managed_hooks,
render_document,
runtime_contracts,
runtime_root,
same_path,
)
from .cursor_io import (
read_document,
rendered_change,
physical_directory_exists,
physical_file_exists,
require_runtime_directory,
runtime_change,
runtime_files_exist,
validate_config_directory,
validate_runtime_identity,
write_cursor_changes,
)
from .guard_template import generate_guard_script
from .hook_template import generate_hook_script
def _runtime_config(config: InstallConfig, agent_id: str) -> dict:
value = {
"org_id": config.get("org_id", ""),
"agent_id": agent_id,
"kid": config.get("kid", ""),
"base_url": config.get("base_url", "https://api.elydora.com"),
"agent_name": AGENT_KEY,
}
token = config.get("token", "")
if token:
value["token"] = token
return value
def _json_source(value: dict) -> str:
return json.dumps(value, indent=2) + "\n"
def _present(changes: List[Optional[FileChange]]) -> List[FileChange]:
return [change for change in changes if change is not None]
def _agent_paths(config: InstallConfig) -> tuple[str, str, str]:
agent_id = config.get("agent_id", "")
if not agent_id:
raise ValueError("agent_id is required")
agent_directory = resolve_agent_directory(runtime_root(), agent_id)
guard_path = os.path.join(agent_directory, GUARD_SCRIPT)
configured_guard = config.get("guard_script_path", "")
if not same_path(configured_guard, guard_path):
raise ValueError(
"Elydora guard runtime must use the managed agent directory: "
f"{guard_path}"
)
return agent_id, agent_directory, guard_path
PRODUCT = "Cursor"
def _validate_install_config(config: InstallConfig) -> None:
@@ -84,27 +41,14 @@ def _validate_install_config(config: InstallConfig) -> None:
raise ValueError(f"{field} is required")
if config.get("agent_name") != AGENT_KEY:
raise ValueError(f"Cursor installation requires agent_name {AGENT_KEY}")
private_key = config["private_key"]
try:
padded = private_key + "=" * ((4 - len(private_key) % 4) % 4)
seed = base64.b64decode(
padded.replace("-", "+").replace("_", "/"),
validate=True,
)
except (ValueError, UnicodeEncodeError) as error:
raise ValueError(
"private_key must be a canonical 32-byte base64url value"
) from error
if len(seed) != 32 or base64url_encode(seed) != private_key:
raise ValueError("private_key must be a canonical 32-byte base64url value")
base_url = config.get("base_url", "https://api.elydora.com")
validate_private_key(config["private_key"])
base_url = config.get("base_url", DEFAULT_BASE_URL)
if not isinstance(base_url, str):
raise ValueError("base_url must be a string")
parsed = urllib.parse.urlsplit(base_url)
if parsed.scheme not in ("http", "https") or not parsed.netloc:
raise ValueError("base_url must be an absolute HTTP or HTTPS URL")
token = config.get("token", "")
if not isinstance(token, str):
if not isinstance(config.get("token", ""), str):
raise ValueError("token must be a string")
@@ -117,58 +61,32 @@ class CursorPlugin(AgentPlugin):
_validate_install_config(config)
read_document()
validate_config_directory()
agent_id, agent_directory, guard_path = _agent_paths(config)
if not physical_directory_exists(runtime_root()):
return
if not physical_directory_exists(agent_directory):
return
identity_exists = validate_runtime_identity(
os.path.join(agent_directory, "config.json"),
agent_id,
)
runtime_exists = False
for file_path, label in (
(guard_path, "Elydora guard runtime"),
(os.path.join(agent_directory, AUDIT_SCRIPT), "Elydora audit runtime"),
(os.path.join(agent_directory, "private.key"), "Elydora private key"),
(os.path.join(agent_directory, "chain-state.json"), "Elydora chain state"),
(os.path.join(agent_directory, "status-cache.json"), "Elydora status cache"),
(os.path.join(agent_directory, "error.log"), "Elydora error log"),
):
runtime_exists = physical_file_exists(file_path, label) or runtime_exists
if runtime_exists and not identity_exists:
raise ValueError(
"Elydora runtime identity cannot be verified without config.json: "
f"{agent_directory}"
)
paths = resolve_runtime_paths(config)
validate_runtime_tree(paths.agent_directory, paths.agent_id, AGENT_KEY, PRODUCT)
def install(self, config: InstallConfig) -> None:
self.preflight_install(config)
document = read_document()
agent_id, agent_directory, guard_path = _agent_paths(config)
require_runtime_directory(agent_directory)
audit_path = os.path.join(agent_directory, AUDIT_SCRIPT)
runtime_config_path = os.path.join(agent_directory, "config.json")
validate_runtime_identity(runtime_config_path, agent_id)
paths = resolve_runtime_paths(config)
if not physical_directory_exists(
paths.agent_directory, "Elydora agent runtime directory"
):
raise FileNotFoundError(
f"Elydora agent runtime directory is missing: {paths.agent_directory}"
)
validate_runtime_tree(paths.agent_directory, paths.agent_id, AGENT_KEY, PRODUCT)
hooks = remove_managed_hooks(document.hooks)
hooks["preToolUse"] = [
*hooks.get("preToolUse", []),
build_handler(guard_path),
]
hooks["postToolUse"] = [
*hooks.get("postToolUse", []),
build_handler(audit_path),
]
hooks["preToolUse"] = [*hooks.get("preToolUse", []), build_handler(paths.guard_path)]
hooks["postToolUse"] = [*hooks.get("postToolUse", []), build_handler(paths.audit_path)]
hooks["postToolUseFailure"] = [
*hooks.get("postToolUseFailure", []),
build_handler(audit_path),
build_handler(paths.audit_path),
]
hook_script = generate_hook_script(
audit_script = generate_hook_script(
org_id=config.get("org_id", ""),
agent_id=agent_id,
agent_id=paths.agent_id,
kid=config.get("kid", ""),
base_url=config.get("base_url", "https://api.elydora.com"),
base_url=config.get("base_url", DEFAULT_BASE_URL),
success_output="{}\n",
fail_closed=True,
native_payload=True,
@@ -176,67 +94,34 @@ class CursorPlugin(AgentPlugin):
)
guard_script = generate_guard_script(
AGENT_KEY,
agent_id,
paths.agent_id,
success_output='{"permission":"allow"}\n',
fail_closed=True,
deny_protocol="cursor",
)
changes = _present([
runtime_change(
guard_path,
"Elydora guard runtime",
guard_script,
0o700,
),
runtime_change(
runtime_config_path,
"Elydora runtime config",
_json_source(_runtime_config(config, agent_id)),
0o600,
),
runtime_change(
os.path.join(agent_directory, "private.key"),
"Elydora private key",
config.get("private_key", ""),
0o600,
),
runtime_change(
audit_path,
"Elydora audit runtime",
hook_script,
0o700,
),
rendered_change(render_document(document, hooks)),
])
write_cursor_changes(changes, "Install Cursor hooks")
changes = [
*runtime_file_changes(config, paths, AGENT_KEY, guard_script, audit_script),
*present([rendered_change(render_document(document, hooks))]),
]
write_changes(changes, "Install Cursor hooks")
print(f" Cursor hooks: {document.file_path}")
def uninstall(self, agent_id: str = "") -> None:
document = read_document()
hooks = remove_managed_hooks(document.hooks, agent_id)
change = rendered_change(render_document(document, hooks))
write_cursor_changes(
[] if change is None else [change],
"Uninstall Cursor hooks",
)
if change is not None:
write_changes([change], "Uninstall Cursor hooks")
def status(self) -> PluginStatus:
document = read_document()
contracts = runtime_contracts(document.hooks)
if not contracts:
return PluginStatus(
installed=False,
agent=AGENT_KEY,
details="Not installed",
)
return PluginStatus(installed=False, agent=AGENT_KEY, details="Not installed")
installed = runtime_files_exist(contracts)
details = (
f"Config: {document.file_path}"
if installed
else f"Configured at {document.file_path}; runtime files missing"
)
return PluginStatus(
installed=installed,
agent=AGENT_KEY,
details=details,
)
return PluginStatus(installed=installed, agent=AGENT_KEY, details=details)