ElebobaandClaude Opus 5.5
65acf3abf1
CI / ruff · mypy · pytest (pull_request) Successful in 39m13s
- prefilter: правила из config/agent_rules.yaml (длина, команды, shell,
секреты и системные файлы, prompt injection) — без LLM
- guard: отдельный вызов, JSON {verdict, reason}; невалидный ответ = attack,
недоступный LLM — «попробуйте позже», а не атака
- planner: только AgentLogQuery (контейнер из белого списка, ≤ 7 д, шаблон
≤ 200 без вложенных квантификаторов, лимит ≤ 500); логи в LLM не идут
- бот: «🤖 Спросить агента» → показывает построенный grep и строки;
атака — вежливый отказ и 🛡 администраторам; квота 30 в сутки
- журнал agent_requests + log_queries (mode=agent)
- при LLM_PROVIDER=mock агент выключен
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
119 lines
4.6 KiB
Python
119 lines
4.6 KiB
Python
"""Entry point: settings → texts → dispatcher → long polling (ADR-002)."""
|
|
|
|
import asyncio
|
|
import contextlib
|
|
import logging
|
|
|
|
from aiogram import Bot, Dispatcher
|
|
from aiogram.client.session.aiohttp import AiohttpSession
|
|
|
|
from app import __version__
|
|
from app.access.service import AccessService
|
|
from app.agent.service import Agent
|
|
from app.bot.fsm import make_storage
|
|
from app.bot.middlewares.access import AccessMiddleware
|
|
from app.bot.routers import commit, common, logs, members, status
|
|
from app.config import Settings
|
|
from app.db.maintenance import cleanup_loop
|
|
from app.db.migrate import upgrade
|
|
from app.db.session import SessionMaker, make_engine, make_sessionmaker
|
|
from app.health import heartbeat
|
|
from app.llm.factory import make_provider
|
|
from app.logs.journal import LogJournal
|
|
from app.logs_setup import setup_logging
|
|
from app.repo.drafts import DraftService
|
|
from app.repo.git import UploadsRepo
|
|
from app.repo.publisher import Publisher
|
|
from app.runtime.checks import Checker, load_checks
|
|
from app.runtime.docker import DockerClient
|
|
from app.runtime.snapshots import SnapshotStore, snapshot_loop
|
|
from app.texts import Texts, load_texts
|
|
|
|
log = logging.getLogger("tgit")
|
|
|
|
|
|
def build_dispatcher(
|
|
texts: Texts,
|
|
sessions: SessionMaker,
|
|
access: AccessService,
|
|
repo: UploadsRepo,
|
|
commit_url_template: str = "",
|
|
docker: DockerClient | None = None,
|
|
checker: Checker | None = None,
|
|
agent: Agent | None = None,
|
|
) -> Dispatcher:
|
|
dp = Dispatcher(storage=make_storage(sessions))
|
|
gate = AccessMiddleware(access, texts)
|
|
# Outer middleware: runs before filters, so nothing — not even a stale button — reaches a handler unchecked.
|
|
dp.message.outer_middleware(gate)
|
|
dp.callback_query.outer_middleware(gate)
|
|
dp.include_router(members.build_router(texts, access))
|
|
dp.include_router(
|
|
commit.build_router(texts, repo, DraftService(sessions), Publisher(repo, sessions), commit_url_template)
|
|
)
|
|
dp.include_router(status.build_router(texts, docker, checker))
|
|
dp.include_router(logs.build_router(texts, docker, LogJournal(sessions), agent, access))
|
|
dp.include_router(common.build_router(texts, access))
|
|
return dp
|
|
|
|
|
|
async def run(settings: Settings) -> None:
|
|
texts = load_texts(settings.runtime.config_dir)
|
|
checks_cfg = load_checks(settings.runtime.config_dir)
|
|
engine = make_engine(settings.database.url)
|
|
await upgrade(engine)
|
|
sessions = make_sessionmaker(engine)
|
|
access = AccessService(sessions, settings.access)
|
|
await access.bootstrap_admins()
|
|
# No DOCKER_URL (e.g. `make run` without Docker): «Статус» answers «Docker недоступен», the rest works
|
|
docker = DockerClient(settings.docker) if settings.docker.url else None
|
|
store = SnapshotStore(sessions)
|
|
checker = Checker(docker, store, checks_cfg) if docker else None
|
|
# The mock provider answers `{}` to the guard — every question would be an «attack»: no real LLM, no agent
|
|
llm = make_provider(settings.llm) if settings.llm.provider != "mock" else None
|
|
agent = Agent.from_config(llm, sessions, settings.runtime.config_dir) if llm else None
|
|
dp = build_dispatcher(
|
|
texts, sessions, access, UploadsRepo(settings.git), settings.git.commit_url_template, docker, checker, agent
|
|
)
|
|
rt = settings.runtime
|
|
background = [
|
|
asyncio.create_task(heartbeat(rt.heartbeat_file, rt.heartbeat_interval)),
|
|
asyncio.create_task(cleanup_loop(sessions)),
|
|
]
|
|
if docker:
|
|
background.append(asyncio.create_task(snapshot_loop(docker, store, settings.docker.snapshot_interval)))
|
|
proxy = settings.telegram.proxy_url
|
|
session = AiohttpSession(proxy=proxy.get_secret_value()) if proxy else None
|
|
bot = Bot(settings.telegram.bot_token.get_secret_value(), session=session)
|
|
log.info(
|
|
"tgit %s starting, %d bootstrap admin(s), telegram %s, docker %s, agent %s",
|
|
__version__,
|
|
len(settings.access.admin_ids),
|
|
"via proxy" if proxy else "direct",
|
|
"on" if docker else "off",
|
|
settings.llm.provider if agent else "off",
|
|
)
|
|
try:
|
|
await dp.start_polling(bot, handle_signals=True)
|
|
finally:
|
|
for task in background:
|
|
task.cancel()
|
|
for task in background:
|
|
with contextlib.suppress(asyncio.CancelledError):
|
|
await task
|
|
await bot.session.close()
|
|
if docker:
|
|
await docker.aclose()
|
|
if checker:
|
|
await checker.aclose()
|
|
if llm:
|
|
await llm.aclose()
|
|
await engine.dispose()
|
|
log.info("tgit stopped")
|
|
|
|
|
|
def main() -> None:
|
|
settings = Settings()
|
|
setup_logging(settings.runtime.log_level)
|
|
asyncio.run(run(settings))
|