impyard 0.1.0

Rent the intelligence, own the governance — a control plane for imps: software colleagues whose every action passes through a gateway you control (default-deny egress, injected credentials, budgets, approval gates, audit).
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129

//! `impyard server gates` — the approval desk. A human lists pending gates,
//! inspects the exact payload that would go out, and approves or denies. No
//! model at the edge (D12/§3.9): a person decides. Approve executes the gate
//! idempotently; deny records the refusal. Both append to the imp's journal
//! and the audit log.

use crate::action;
use crate::action::gate;
use crate::util::BErr;

fn resolve(id_or_prefix: &str) -> Result<String, BErr> {
    let all = gate::list_all();
    crate::util::resolve_prefix("gate", id_or_prefix, all.iter().map(|g| g.id.as_str()))
}

pub fn ls(json: bool) -> Result<(), BErr> {
    let pending = gate::list_pending();
    if json {
        println!("{}", serde_json::to_string_pretty(&pending)?);
        return Ok(());
    }
    if pending.is_empty() {
        println!("no pending gates");
        return Ok(());
    }
    println!("{:<12}  {:<10}  {:<16}  FILED", "GATE", "IMP", "INTENT");
    for g in pending {
        println!(
            "{:<12}  {:<10}  {:<16}  {}",
            g.id, g.imp, g.intent, g.filed_at
        );
    }
    println!("\napprove: impyard server gates approve <id>   deny: impyard server gates deny <id> \"reason\"");
    Ok(())
}

pub fn show(id: &str) -> Result<(), BErr> {
    let id = resolve(id)?;
    let g = gate::load(&id).ok_or_else(|| format!("no such gate {id}"))?;
    println!("gate     {}", g.id);
    println!("imp   {}", g.imp);
    println!("intent   {}   (executor: {})", g.intent, g.executor);
    println!("state    {}", g.state);
    println!("filed    {}", g.filed_at);
    if let Some(by) = &g.decided_by {
        println!(
            "decided  {} by {} {}",
            g.decided_at.as_deref().unwrap_or(""),
            by,
            g.decision_note.as_deref().unwrap_or("")
        );
    }
    if let Some(r) = &g.result {
        println!("result   {r}");
    }
    if let Some(e) = &g.error {
        println!("error    {e}");
    }
    if !g.rationale.is_empty() {
        println!("rationale {}", g.rationale);
    }
    // Render the change per executor: a charter gate shows a current-vs-proposed
    // diff; a code gate shows the worktree diff; everything else shows its payload.
    match g.executor.as_str() {
        "identity" => {
            let proposed = g
                .payload
                .get("identity")
                .or_else(|| g.payload.get("charter"))
                .and_then(|v| v.as_str())
                .unwrap_or("");
            match action::identity_diff(&g.imp, proposed) {
                Some(d) => println!("\nidentity change — current vs proposed:\n{d}"),
                None => println!("\n(the proposed identity is identical to the current one)"),
            }
        }
        "purpose" => {
            let ch = g
                .payload
                .get("channel_id")
                .and_then(|v| v.as_str())
                .unwrap_or("");
            let proposed = g
                .payload
                .get("purpose")
                .and_then(|v| v.as_str())
                .unwrap_or("");
            match action::purpose_diff(ch, proposed) {
                Some(d) => println!("\npurpose change (channel {ch}) — current vs proposed:\n{d}"),
                None => println!("\n(the proposed purpose is identical to the current one)"),
            }
        }
        "git-pr" => {
            println!("\npayload:\n{}", serde_json::to_string_pretty(&g.payload)?);
            match action::worktree_diff(&g.run_id) {
                Some(d) if !d.is_empty() => println!("\ndiff — what would be committed:\n{d}"),
                _ => println!("\ndiff — (no changes found in the worktree)"),
            }
        }
        _ => println!(
            "\npayload — the exact action that will run:\n{}",
            serde_json::to_string_pretty(&g.payload)?
        ),
    }
    Ok(())
}

pub async fn approve(id: &str, note: Option<&str>) -> Result<(), BErr> {
    let id = resolve(id)?;
    let who = std::env::var("USER").unwrap_or_else(|_| "admin".into());
    match action::execute_gate(&id, &who, note).await {
        Ok(g) => {
            println!("approved and executed {} ({})", g.id, g.intent);
            if let Some(r) = &g.result {
                println!("result: {r}");
            }
            Ok(())
        }
        Err(e) => Err(format!("gate {id}: {e}").into()),
    }
}

pub fn deny(id: &str, note: Option<&str>) -> Result<(), BErr> {
    let id = resolve(id)?;
    let who = std::env::var("USER").unwrap_or_else(|_| "admin".into());
    let g = action::deny_gate(&id, &who, note)?;
    println!("denied {} ({})", g.id, g.intent);
    Ok(())
}