language-operator 0.0.1 → 0.1.30

data/lib/language_operator/agent/safety/manager.rb

@@ -0,0 +1,207 @@
+# frozen_string_literal: true
+
+require_relative 'budget_tracker'
+require_relative 'rate_limiter'
+require_relative 'content_filter'
+require_relative 'audit_logger'
+require_relative '../../logger'
+require_relative '../../loggable'
+
+module LanguageOperator
+  module Agent
+    module Safety
+      # Safety Manager
+      #
+      # Coordinates all safety components (budget tracking, rate limiting,
+      # content filtering, audit logging) and provides a unified interface.
+      #
+      # @example
+      #   safety = Manager.new(
+      #     daily_budget: 10.0,
+      #     requests_per_minute: 10,
+      #     blocked_patterns: ['password']
+      #   )
+      #   safety.check_request!(message: "Hello", estimated_cost: 0.01)
+      class Manager
+        include LanguageOperator::Loggable
+
+        attr_reader :budget_tracker, :rate_limiter, :content_filter, :audit_logger
+
+        def initialize(config = {})
+          @config = config
+          @enabled = config.fetch(:enabled, true)
+
+          # Initialize components based on configuration
+          @budget_tracker = if budget_config_present?
+                              BudgetTracker.new(
+                                daily_budget: config[:daily_budget],
+                                hourly_budget: config[:hourly_budget],
+                                token_budget: config[:token_budget]
+                              )
+                            end
+
+          @rate_limiter = if rate_limit_config_present?
+                            RateLimiter.new(
+                              requests_per_minute: config[:requests_per_minute],
+                              requests_per_hour: config[:requests_per_hour],
+                              requests_per_day: config[:requests_per_day]
+                            )
+                          end
+
+          @content_filter = if content_filter_config_present?
+                              ContentFilter.new(
+                                blocked_patterns: config[:blocked_patterns] || [],
+                                blocked_topics: config[:blocked_topics] || [],
+                                case_sensitive: config[:case_sensitive] || false
+                              )
+                            end
+
+          @audit_logger = (AuditLogger.new if config.fetch(:audit_logging, true))
+
+          logger.info('Safety manager initialized',
+                      enabled: @enabled,
+                      budget_tracking: !@budget_tracker.nil?,
+                      rate_limiting: !@rate_limiter.nil?,
+                      content_filtering: !@content_filter.nil?,
+                      audit_logging: !@audit_logger.nil?)
+        end
+
+        # Check if safety checks are enabled
+        #
+        # @return [Boolean]
+        def enabled?
+          @enabled
+        end
+
+        # Perform all pre-request safety checks
+        #
+        # @param message [String] The message being sent
+        # @param estimated_cost [Float] Estimated cost of the request
+        # @param estimated_tokens [Integer] Estimated token count
+        # @raise [BudgetTracker::BudgetExceededError] If budget exceeded
+        # @raise [RateLimiter::RateLimitExceededError] If rate limit exceeded
+        # @raise [ContentFilter::ContentBlockedError] If content blocked
+        def check_request!(message:, estimated_cost: 0.0, estimated_tokens: 0)
+          return unless @enabled
+
+          begin
+            # Check content filter (input)
+            if @content_filter
+              @content_filter.check_content!(message, direction: :input)
+              logger.debug('Input content check passed')
+            end
+
+            # Check budget
+            if @budget_tracker
+              @budget_tracker.check_budget!(
+                estimated_cost: estimated_cost,
+                estimated_tokens: estimated_tokens
+              )
+              logger.debug('Budget check passed')
+            end
+
+            # Check rate limit
+            if @rate_limiter
+              @rate_limiter.check_rate_limit!
+              logger.debug('Rate limit check passed')
+            end
+
+            logger.debug('All safety checks passed')
+          rescue BudgetTracker::BudgetExceededError,
+                 RateLimiter::RateLimitExceededError,
+                 ContentFilter::ContentBlockedError => e
+            # Log to audit
+            @audit_logger&.log_blocked_request(
+              reason: e.class.name,
+              details: {
+                message: e.message,
+                message_preview: message[0..100],
+                estimated_cost: estimated_cost,
+                estimated_tokens: estimated_tokens
+              }
+            )
+            raise
+          end
+        end
+
+        # Check response content
+        #
+        # @param response [String] The LLM response
+        # @raise [ContentFilter::ContentBlockedError] If content blocked
+        def check_response!(response)
+          return unless @enabled
+          return unless @content_filter
+
+          begin
+            @content_filter.check_content!(response, direction: :output)
+            logger.debug('Output content check passed')
+          rescue ContentFilter::ContentBlockedError => e
+            @audit_logger&.log_content_filter_event(
+              event: 'output_blocked',
+              details: {
+                message: e.message,
+                response_preview: response[0..100]
+              }
+            )
+            raise
+          end
+        end
+
+        # Record successful request
+        #
+        # @param cost [Float] Actual cost
+        # @param tokens [Integer] Actual token count
+        def record_request(cost:, tokens:)
+          return unless @enabled
+
+          @budget_tracker&.record_spending(cost: cost, tokens: tokens)
+          @rate_limiter&.record_request
+
+          @audit_logger&.log_budget_event(
+            event: 'request_completed',
+            details: {
+              cost: cost.round(4),
+              tokens: tokens,
+              budget_status: @budget_tracker&.status
+            }
+          )
+        end
+
+        # Get current safety status
+        #
+        # @return [Hash] Safety status information
+        def status
+          {
+            enabled: @enabled,
+            budget: @budget_tracker&.status,
+            rate_limits: @rate_limiter&.status,
+            content_filter: {
+              enabled: !@content_filter.nil?,
+              patterns: @config[:blocked_patterns]&.length || 0,
+              topics: @config[:blocked_topics]&.length || 0
+            }
+          }
+        end
+
+        private
+
+        def logger_component
+          'Safety::Manager'
+        end
+
+        def budget_config_present?
+          @config[:daily_budget] || @config[:hourly_budget] || @config[:token_budget]
+        end
+
+        def rate_limit_config_present?
+          @config[:requests_per_minute] || @config[:requests_per_hour] || @config[:requests_per_day]
+        end
+
+        def content_filter_config_present?
+          @config[:blocked_patterns]&.any? ||
+            @config[:blocked_topics]&.any?
+        end
+      end
+    end
+  end
+end

data/lib/language_operator/agent/safety/rate_limiter.rb

@@ -0,0 +1,150 @@
+# frozen_string_literal: true
+
+require_relative '../../logger'
+require_relative '../../loggable'
+
+module LanguageOperator
+  module Agent
+    module Safety
+      # Rate Limiter for enforcing request limits
+      #
+      # Enforces per-agent rate limiting to prevent runaway requests.
+      #
+      # @example
+      #   limiter = RateLimiter.new(requests_per_minute: 10, requests_per_hour: 100)
+      #   limiter.check_rate_limit!
+      class RateLimiter
+        include LanguageOperator::Loggable
+
+        class RateLimitExceededError < StandardError; end
+
+        def initialize(requests_per_minute: nil, requests_per_hour: nil, requests_per_day: nil)
+          @requests_per_minute = requests_per_minute&.to_i
+          @requests_per_hour = requests_per_hour&.to_i
+          @requests_per_day = requests_per_day&.to_i
+
+          @minute_requests = []
+          @hour_requests = []
+          @day_requests = []
+
+          logger.info('Rate limiter initialized',
+                      per_minute: @requests_per_minute,
+                      per_hour: @requests_per_hour,
+                      per_day: @requests_per_day)
+        end
+
+        # Check if a request would exceed rate limits
+        #
+        # @raise [RateLimitExceededError] If rate limit would be exceeded
+        def check_rate_limit!
+          now = Time.now
+
+          # Clean up old requests
+          cleanup_old_requests(now)
+
+          # Check per-minute limit
+          if @requests_per_minute && @minute_requests.length >= @requests_per_minute
+            oldest = @minute_requests.first
+            wait_time = 60 - (now - oldest)
+            logger.error('Per-minute rate limit exceeded',
+                         current: @minute_requests.length,
+                         limit: @requests_per_minute,
+                         wait_time: wait_time.round(1))
+            raise RateLimitExceededError,
+                  "Per-minute rate limit exceeded: #{@minute_requests.length}/#{@requests_per_minute} " \
+                  "(retry in #{wait_time.round(1)}s)"
+          end
+
+          # Check per-hour limit
+          if @requests_per_hour && @hour_requests.length >= @requests_per_hour
+            oldest = @hour_requests.first
+            wait_time = 3600 - (now - oldest)
+            logger.error('Per-hour rate limit exceeded',
+                         current: @hour_requests.length,
+                         limit: @requests_per_hour,
+                         wait_time: (wait_time / 60).round(1))
+            raise RateLimitExceededError,
+                  "Per-hour rate limit exceeded: #{@hour_requests.length}/#{@requests_per_hour} " \
+                  "(retry in #{(wait_time / 60).round(1)}m)"
+          end
+
+          # Check per-day limit
+          if @requests_per_day && @day_requests.length >= @requests_per_day
+            oldest = @day_requests.first
+            wait_time = 86_400 - (now - oldest)
+            logger.error('Per-day rate limit exceeded',
+                         current: @day_requests.length,
+                         limit: @requests_per_day,
+                         wait_time: (wait_time / 3600).round(1))
+            raise RateLimitExceededError,
+                  "Per-day rate limit exceeded: #{@day_requests.length}/#{@requests_per_day} " \
+                  "(retry in #{(wait_time / 3600).round(1)}h)"
+          end
+
+          logger.debug('Rate limit check passed',
+                       minute_requests: @minute_requests.length,
+                       hour_requests: @hour_requests.length,
+                       day_requests: @day_requests.length)
+        end
+
+        # Record a request
+        def record_request
+          now = Time.now
+          cleanup_old_requests(now)
+
+          @minute_requests << now
+          @hour_requests << now
+          @day_requests << now
+
+          logger.debug('Request recorded',
+                       minute_count: @minute_requests.length,
+                       hour_count: @hour_requests.length,
+                       day_count: @day_requests.length)
+        end
+
+        # Get current rate limit status
+        #
+        # @return [Hash] Rate limit status information
+        def status
+          now = Time.now
+          cleanup_old_requests(now)
+
+          {
+            per_minute: {
+              requests: @minute_requests.length,
+              limit: @requests_per_minute,
+              remaining: @requests_per_minute ? (@requests_per_minute - @minute_requests.length) : nil
+            },
+            per_hour: {
+              requests: @hour_requests.length,
+              limit: @requests_per_hour,
+              remaining: @requests_per_hour ? (@requests_per_hour - @hour_requests.length) : nil
+            },
+            per_day: {
+              requests: @day_requests.length,
+              limit: @requests_per_day,
+              remaining: @requests_per_day ? (@requests_per_day - @day_requests.length) : nil
+            }
+          }
+        end
+
+        private
+
+        def logger_component
+          'Safety::RateLimiter'
+        end
+
+        def cleanup_old_requests(now)
+          # Remove requests older than 1 minute
+          @minute_requests.reject! { |t| (now - t) > 60 }
+
+          # Remove requests older than 1 hour
+          @hour_requests.reject! { |t| (now - t) > 3600 }
+
+          # Remove requests older than 1 day
+          @day_requests.reject! { |t| (now - t) > 86_400 }
+        end
+      end
+    end
+  end
+end

data/lib/language_operator/agent/safety/safe_executor.rb

@@ -0,0 +1,115 @@
+# frozen_string_literal: true
+
+module LanguageOperator
+  module Agent
+    module Safety
+      # Executes Ruby code in a sandboxed context with method whitelisting
+      # Wraps the execution context to prevent dangerous method calls at runtime
+      class SafeExecutor
+        class SecurityError < StandardError; end
+
+        # Methods that are always safe to call
+        ALWAYS_SAFE_METHODS = %i[
+          nil? == != eql? equal? hash object_id class is_a? kind_of? instance_of?
+          respond_to? send_to? methods public_methods private_methods
+          instance_variables instance_variable_get instance_variable_set
+          to_s to_str inspect to_a to_h to_i to_f to_sym
+          freeze frozen? dup clone
+        ].freeze
+
+        def initialize(context, validator: nil)
+          @context = context
+          @validator = validator || ASTValidator.new
+          @audit_log = []
+        end
+
+        # Execute code in the sandboxed context
+        # @param code [String] Ruby code to execute
+        # @param file_path [String] Path to file (for error reporting)
+        # @return [Object] Result of code execution
+        def eval(code, file_path = '(eval)')
+          # Step 1: Validate code with AST analysis
+          @validator.validate!(code, file_path)
+
+          # Step 2: Execute in sandboxed context
+          sandbox = SandboxProxy.new(@context, self)
+
+          # Step 3: Execute using instance_eval
+          # Note: We still use instance_eval but with validated code
+          # and wrapped context
+          sandbox.instance_eval(code, file_path)
+        rescue ASTValidator::SecurityError => e
+          # Re-raise validation errors as executor errors for clarity
+          raise SecurityError, "Code validation failed: #{e.message}"
+        end
+
+        # Log method calls for auditing
+        def log_call(receiver, method_name, args)
+          @audit_log << {
+            timestamp: Time.now,
+            receiver: receiver.class.name,
+            method: method_name,
+            args: args.map(&:class).map(&:name)
+          }
+        end
+
+        # Get audit log
+        attr_reader :audit_log
+
+        # Proxy class that wraps the context and intercepts method calls
+        class SandboxProxy < BasicObject
+          def initialize(context, executor)
+            @__context__ = context
+            @__executor__ = executor
+          end
+
+          # Delegate method calls to the underlying context
+          # but check for dangerous methods first
+          def method_missing(method_name, *args, &)
+            # Log the call
+            @__executor__.log_call(@__context__, method_name, args)
+
+            # Check if method is safe
+            unless safe_method?(method_name)
+              ::Kernel.raise ::LanguageOperator::Agent::Safety::SafeExecutor::SecurityError,
+                             "Method '#{method_name}' is not allowed in sandboxed code"
+            end
+
+            # Delegate to underlying context
+            @__context__.send(method_name, *args, &)
+          end
+
+          def respond_to_missing?(method_name, include_private = false)
+            @__context__.respond_to?(method_name, include_private)
+          end
+
+          # Provide access to safe constants from the context
+          def const_missing(name)
+            # Allow access to HTTP and Shell helper classes
+            if name == :HTTP
+              return ::LanguageOperator::Dsl::HTTP
+            elsif name == :Shell
+              return ::LanguageOperator::Dsl::Shell
+            end
+
+            # Otherwise delegate to the context's module
+            @__context__.class.const_get(name)
+          rescue ::NameError
+            ::Kernel.raise ::NameError, "uninitialized constant #{name}"
+          end
+
+          private
+
+          def safe_method?(method_name)
+            # Always allow safe basic methods
+            return true if ::LanguageOperator::Agent::Safety::SafeExecutor::ALWAYS_SAFE_METHODS.include?(method_name)
+
+            # Check if the underlying context responds to the method
+            # (This allows DSL methods defined on the context)
+            @__context__.respond_to?(method_name)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/language_operator/agent/scheduler.rb

@@ -0,0 +1,183 @@
+# frozen_string_literal: true
+
+require 'rufus-scheduler'
+require_relative 'executor'
+require_relative 'instrumentation'
+require_relative '../logger'
+require_relative '../loggable'
+
+module LanguageOperator
+  module Agent
+    # Task Scheduler
+    #
+    # Handles scheduled and event-driven task execution using rufus-scheduler.
+    #
+    # @example
+    #   scheduler = Scheduler.new(agent)
+    #   scheduler.start
+    class Scheduler
+      include LanguageOperator::Loggable
+      include LanguageOperator::Agent::Instrumentation
+
+      attr_reader :agent, :rufus_scheduler
+
+      # Initialize the scheduler
+      #
+      # @param agent [LanguageOperator::Agent::Base] The agent instance
+      def initialize(agent)
+        @agent = agent
+        @rufus_scheduler = Rufus::Scheduler.new
+        @executor = Executor.new(agent)
+
+        logger.debug('Scheduler initialized',
+                     workspace: @agent.workspace_path,
+                     servers: @agent.servers_info.length)
+      end
+
+      # Start the scheduler
+      #
+      # @return [void]
+      def start
+        logger.info('Agent starting in scheduled mode')
+        logger.info("Workspace: #{@agent.workspace_path}")
+        logger.info("Connected to #{@agent.servers_info.length} MCP server(s)")
+
+        setup_schedules
+        logger.info('Scheduler started, waiting for scheduled tasks')
+        @rufus_scheduler.join
+      end
+
+      # Start the scheduler with a workflow definition
+      #
+      # @param agent_def [LanguageOperator::Dsl::AgentDefinition] The agent definition with workflow
+      # @return [void]
+      def start_with_workflow(agent_def)
+        logger.info('Agent starting in scheduled mode with workflow',
+                    agent_name: agent_def.name,
+                    has_workflow: !agent_def.workflow.nil?)
+        logger.info("Workspace: #{@agent.workspace_path}")
+        logger.info("Connected to #{@agent.servers_info.length} MCP server(s)")
+
+        # Extract schedule from agent definition or use default
+        cron_schedule = agent_def.schedule&.cron || '0 6 * * *'
+
+        logger.info('Scheduling workflow', cron: cron_schedule, agent: agent_def.name)
+
+        @rufus_scheduler.cron(cron_schedule) do
+          with_span('agent.scheduler.execute', attributes: {
+                      'scheduler.cron_expression' => cron_schedule,
+                      'agent.name' => agent_def.name,
+                      'scheduler.task_type' => 'workflow'
+                    }) do
+            logger.timed('Scheduled workflow execution') do
+              logger.info('Executing scheduled workflow', agent: agent_def.name)
+              result = @executor.execute_workflow(agent_def)
+              result_text = result.is_a?(String) ? result : result.content
+              preview = result_text[0..200]
+              preview += '...' if result_text.length > 200
+              logger.info('Workflow completed', result_preview: preview)
+            end
+          end
+        end
+
+        logger.info('Scheduler started, waiting for scheduled tasks')
+        @rufus_scheduler.join
+      end
+
+      # Stop the scheduler
+      #
+      # @return [void]
+      def stop
+        logger.info('Shutting down scheduler')
+        @rufus_scheduler.shutdown
+        logger.info('Scheduler stopped')
+      end
+
+      private
+
+      def logger_component
+        'Agent::Scheduler'
+      end
+
+      # Setup schedules from config
+      #
+      # @return [void]
+      def setup_schedules
+        schedules = @agent.config.dig('agent', 'schedules') || []
+
+        logger.debug('Loading schedules from config', count: schedules.length)
+
+        if schedules.empty?
+          logger.warn('No schedules configured, using default daily schedule')
+          setup_default_schedule
+          return
+        end
+
+        schedules.each do |schedule|
+          add_schedule(schedule)
+        end
+
+        logger.info("#{schedules.length} schedule(s) configured")
+      end
+
+      # Add a single schedule
+      #
+      # @param schedule [Hash] Schedule configuration
+      # @return [void]
+      def add_schedule(schedule)
+        cron = schedule['cron']
+        task = schedule['task']
+        agent_name = @agent.config.dig('agent', 'name')
+
+        logger.info('Scheduling task', cron: cron, task: task[0..100])
+
+        @rufus_scheduler.cron(cron) do
+          with_span('agent.scheduler.execute', attributes: {
+                      'scheduler.cron_expression' => cron,
+                      'agent.name' => agent_name,
+                      'scheduler.task_type' => 'scheduled'
+                    }) do
+            logger.timed('Scheduled task execution') do
+              logger.info('Executing scheduled task', task: task[0..100])
+              result = @executor.execute(task)
+              preview = result[0..200]
+              preview += '...' if result.length > 200
+              logger.info('Task completed', result_preview: preview)
+            end
+          end
+        end
+      end
+
+      # Setup default daily schedule
+      #
+      # @return [void]
+      def setup_default_schedule
+        instructions = @agent.config.dig('agent', 'instructions') ||
+                       'Check for updates and report status'
+        agent_name = @agent.config.dig('agent', 'name')
+        cron = '0 6 * * *'
+
+        logger.info('Setting up default schedule', cron: cron,
+                                                   instructions: instructions[0..100])
+
+        @rufus_scheduler.cron(cron) do
+          with_span('agent.scheduler.execute', attributes: {
+                      'scheduler.cron_expression' => cron,
+                      'agent.name' => agent_name,
+                      'scheduler.task_type' => 'default'
+                    }) do
+            logger.timed('Daily task execution') do
+              logger.info('Executing daily task')
+              result = @executor.execute(instructions)
+              preview = result[0..200]
+              preview += '...' if result.length > 200
+              logger.info('Daily task completed', result_preview: preview)
+            end
+          end
+        end
+
+        logger.info('Scheduled: Daily at 6:00 AM')
+      end
+    end
+  end
+end