vudt15andClaude Sonnet 5
ae4fe72b2e
EPIC R05 (Team Hoa) - one security/approval path for every tool call.
R05-T01 domain/tools/{tool_descriptor,tool_registry}.py
ToolCapability (READ/WRITE/EXECUTE/NETWORK, composable) + ToolDescriptor +
ToolRegistry, replacing three independently-maintained gating lists
(core/tools.py::WRITE_TOOLS, code_agent.py's WRITE_TOOLS|MS365_WRITE_TOOLS,
chat_agent.py's literal ("run_command","install_package") tuple) with one
capability lookup.
R05-T02 infrastructure/filesystem/{file_tools,command_tools,fetch_tools,tool_context}.py
core/tools.py's execute_tool if/elif chain split into per-concern modules.
core/tools.py is now a strangler-fig shim: re-exports ToolContext/ToolError,
dispatches through a {name: handler} dict built from the split modules.
core/tools.py: 566 -> 291 lines.
R05-T03 application/conversations/tool_policy_gateway.py
ToolPolicyGateway.allow(name, gate, payload) - capability-driven ALLOW vs
ask-the-gate decision. Wired into both chat_agent.py::run_cowork and
code_agent.py::run_code, replacing their separate hand-rolled checks.
Verified equivalent to the old hardcoded sets by test.
R05-T04 (behavior change, not just refactor)
MCP/connector tools (core/mcp_client.py, core/ext_connectors.py) reached
chat_agent.py via extra_executor(name, args) with NO permission check at
all. They are now tagged with a conservative default capability
(WRITE|EXECUTE|NETWORK - no MCP tool self-declares risk) and routed through
the SAME ToolPolicyGateway as built-ins. When "confirm before running
commands" is on, MCP/connector calls now prompt like run_command already
did - a real gap closed, and a user-visible change worth calling out.
R05-T05 infrastructure/mcp/mcp_source_manager.py
McpToolSourceManager extracts the connection cache/lock/start-or-skip
lifecycle out of state.py::AppContext (_mcp_connections/_conn_lock) into a
standalone, directly-testable class. AppContext.build_mcp_tools and
_ms365_builtin_connection now call ensure()/stop(); _ext_connections
(unified Connectors) is out of scope for this task and keeps its own lock.
New tests: tests/unit/test_tool_registry_and_policy.py,
test_code_agent_tool_policy.py, test_cowork_extra_tool_policy.py,
test_mcp_source_manager.py (26 new tests).
Suite: 254 passed, 4 pre-existing failures unrelated to R05 (2 EPIC R02
config-security, 2 environment-dependent routing tests - see checklist).
check_imports: PASS. All new files < 400 LOC.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
63 lines
2.6 KiB
Python
63 lines
2.6 KiB
Python
"""ToolContext / ToolError / CancelFn - the sandboxed execution context every
|
|
built-in tool runs against (moved out of ``core/tools.py`` in R05-T02).
|
|
|
|
Kept as its own leaf module (no dependency on any sibling in this package) so
|
|
``file_tools.py``, ``command_tools.py`` and ``fetch_tools.py`` can each import
|
|
it without creating an import cycle back through ``core/tools.py``, which
|
|
itself re-exports ``ToolContext``/``ToolError`` from here for the existing
|
|
callers (``core/chat_agent.py``, ``core/code_agent.py``,
|
|
``core/task_executors.py``) that do ``from .tools import ToolContext``.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
from dataclasses import dataclass
|
|
from pathlib import Path
|
|
from typing import Any, Callable, Dict, Optional
|
|
|
|
CancelFn = Callable[[], bool]
|
|
|
|
|
|
class ToolError(Exception):
|
|
pass
|
|
|
|
|
|
@dataclass
|
|
class ToolContext:
|
|
workdir: Path
|
|
flatten_writes: bool = False # Cowork: force every write into the workdir root
|
|
sandbox: bool = False # Code tab: isolate run_command/install_package into <workdir>/.venv
|
|
# Sandbox Security Layer — Settings' "Resource Limits" (cpu_percent/memory_mb/
|
|
# disk_mb), applied to every run_command/install_package this context runs.
|
|
# None (default) = no limits, matching pre-existing behavior.
|
|
resource_limits: Optional[Dict[str, float]] = None
|
|
# Sandbox Security Layer — Settings' "Block network for agent commands"
|
|
# (policy-level, see deps.py::network_blocked_env). False (default) =
|
|
# unrestricted, matching pre-existing behavior.
|
|
block_network: bool = False
|
|
# Whether the fetch_url tool may read URLs — SEPARATE from block_network
|
|
# (reading a web page/share link for info is safe; running networked shell
|
|
# commands is the risk). Defaults True; set from agent_security.allow_url_fetch.
|
|
allow_url_fetch: bool = True
|
|
# Jira read connector config (base_url/email/api_token) — None disables the
|
|
# jira_* tools' ability to connect. Populated from config.data["jira"].
|
|
jira: Optional[Dict[str, Any]] = None
|
|
|
|
def resolve(self, rel: str) -> Path:
|
|
"""Resolve ``rel`` inside the workdir, rejecting escapes."""
|
|
if rel in ("", "."):
|
|
return self.workdir
|
|
candidate = (self.workdir / rel).expanduser()
|
|
try:
|
|
resolved = candidate.resolve()
|
|
except OSError as exc:
|
|
raise ToolError(f"Invalid path: {rel} ({exc})")
|
|
root = self.workdir.resolve()
|
|
if resolved != root and root not in resolved.parents:
|
|
raise ToolError(
|
|
f"Refused: '{rel}' is outside the working folder ({root})."
|
|
)
|
|
return resolved
|
|
|
|
|
|
__all__ = ["CancelFn", "ToolError", "ToolContext"]
|