vudt15andClaude Sonnet 5
ae4fe72b2e
EPIC R05 (Team Hoa) - one security/approval path for every tool call.
R05-T01 domain/tools/{tool_descriptor,tool_registry}.py
ToolCapability (READ/WRITE/EXECUTE/NETWORK, composable) + ToolDescriptor +
ToolRegistry, replacing three independently-maintained gating lists
(core/tools.py::WRITE_TOOLS, code_agent.py's WRITE_TOOLS|MS365_WRITE_TOOLS,
chat_agent.py's literal ("run_command","install_package") tuple) with one
capability lookup.
R05-T02 infrastructure/filesystem/{file_tools,command_tools,fetch_tools,tool_context}.py
core/tools.py's execute_tool if/elif chain split into per-concern modules.
core/tools.py is now a strangler-fig shim: re-exports ToolContext/ToolError,
dispatches through a {name: handler} dict built from the split modules.
core/tools.py: 566 -> 291 lines.
R05-T03 application/conversations/tool_policy_gateway.py
ToolPolicyGateway.allow(name, gate, payload) - capability-driven ALLOW vs
ask-the-gate decision. Wired into both chat_agent.py::run_cowork and
code_agent.py::run_code, replacing their separate hand-rolled checks.
Verified equivalent to the old hardcoded sets by test.
R05-T04 (behavior change, not just refactor)
MCP/connector tools (core/mcp_client.py, core/ext_connectors.py) reached
chat_agent.py via extra_executor(name, args) with NO permission check at
all. They are now tagged with a conservative default capability
(WRITE|EXECUTE|NETWORK - no MCP tool self-declares risk) and routed through
the SAME ToolPolicyGateway as built-ins. When "confirm before running
commands" is on, MCP/connector calls now prompt like run_command already
did - a real gap closed, and a user-visible change worth calling out.
R05-T05 infrastructure/mcp/mcp_source_manager.py
McpToolSourceManager extracts the connection cache/lock/start-or-skip
lifecycle out of state.py::AppContext (_mcp_connections/_conn_lock) into a
standalone, directly-testable class. AppContext.build_mcp_tools and
_ms365_builtin_connection now call ensure()/stop(); _ext_connections
(unified Connectors) is out of scope for this task and keeps its own lock.
New tests: tests/unit/test_tool_registry_and_policy.py,
test_code_agent_tool_policy.py, test_cowork_extra_tool_policy.py,
test_mcp_source_manager.py (26 new tests).
Suite: 254 passed, 4 pre-existing failures unrelated to R05 (2 EPIC R02
config-security, 2 environment-dependent routing tests - see checklist).
check_imports: PASS. All new files < 400 LOC.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
56 lines
2.4 KiB
Python
56 lines
2.4 KiB
Python
"""Fetch tools - fetch_url, jira_search, jira_get_issue (R05-T02).
|
|
|
|
Moved verbatim out of ``core/tools.py`` (see ``file_tools.py`` for why). The
|
|
network access these three carry is exactly what the ``ToolCapability.NETWORK``
|
|
tag added in R05-T01/domain/tools/tool_registry.py describes.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
from typing import Any, Dict
|
|
|
|
from .tool_context import ToolContext
|
|
|
|
|
|
def fetch_url(ctx: ToolContext, args: Dict[str, Any]) -> Dict[str, Any]:
|
|
"""Fetch a URL's text content (web page / online document / SharePoint-
|
|
OneDrive share link) via link_fetch — the same parser task-link attachments
|
|
use. Honors the Sandbox Security Layer's "Block network" policy."""
|
|
url = str(args.get("url", "")).strip()
|
|
if not url:
|
|
return {"ok": False, "output": "fetch_url: 'url' is required."}
|
|
if not url.lower().startswith(("http://", "https://")):
|
|
return {"ok": False, "output": f"fetch_url: not an http(s) URL: {url}"}
|
|
if not ctx.allow_url_fetch:
|
|
return {"ok": False,
|
|
"output": ("fetch_url: URL fetching is turned off in Settings → Security "
|
|
"(\"Allow the agent to fetch URLs\").")}
|
|
# A pasted Jira issue link on the CONNECTED Jira host is read via the
|
|
# authenticated API (so private issues resolve, not a login page). Public
|
|
# links / any other URL fall through to the normal fetcher below.
|
|
from cowork_local.core import jira_tool
|
|
if jira_tool.is_jira_issue_url(ctx.jira, url):
|
|
return {"ok": True, "output": jira_tool.get_issue_by_url(ctx.jira, url)}
|
|
from cowork_local.core.link_fetch import fetch_link_preview
|
|
|
|
return {"ok": True, "output": fetch_link_preview(url)}
|
|
|
|
|
|
def jira_search(ctx: ToolContext, args: Dict[str, Any]) -> Dict[str, Any]:
|
|
from cowork_local.core import jira_tool
|
|
|
|
out = jira_tool.search(ctx.jira, str(args.get("jql", "")),
|
|
int(args.get("max_results", 25) or 25))
|
|
return {"ok": not out.lower().startswith(("jira is not configured", "jira search failed")),
|
|
"output": out}
|
|
|
|
|
|
def jira_get_issue(ctx: ToolContext, args: Dict[str, Any]) -> Dict[str, Any]:
|
|
from cowork_local.core import jira_tool
|
|
|
|
out = jira_tool.get_issue(ctx.jira, str(args.get("key", "")))
|
|
return {"ok": not out.lower().startswith(("jira is not configured", "could not fetch")),
|
|
"output": out}
|
|
|
|
|
|
__all__ = ["fetch_url", "jira_search", "jira_get_issue"]
|