@agxnte/reidx 2.0.2

package/src/reidx/goals/store.py

@@ -0,0 +1,233 @@
+"""Goal store: per-session goal state persisted to goals.json."""
+from __future__ import annotations
+
+from pathlib import Path
+
+from reidx.diagnostics.logger import get_logger
+from reidx.goals.models import Goal, GoalEvidence, GoalNode, GoalNodeKind, GoalStatus
+
+log = get_logger("reidx.goals")
+
+
+class GoalStore:
+    def __init__(self, storage_root: Path, session_id: str) -> None:
+        self.path = storage_root / "sessions" / session_id / "goals.json"
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self.session_id = session_id
+
+    def _read_payload(self) -> tuple[dict[str, Goal], str | None]:
+        if not self.path.exists():
+            return {}, None
+        import json
+
+        text = self.path.read_text(encoding="utf-8").strip()
+        if not text:
+            return {}, None
+
+        raw = json.loads(text)
+        goals: dict[str, Goal] = {}
+        for item in raw.get("goals", []):
+            goal = Goal.model_validate(item)
+            goals[goal.id] = goal
+        active_id = raw.get("active_goal_id")
+        if active_id not in goals:
+            active_id = None
+        return goals, active_id
+
+    def _write_payload(self, goals: dict[str, Goal], active_goal_id: str | None) -> None:
+        import json
+
+        payload = {
+            "active_goal_id": active_goal_id if active_goal_id in goals else None,
+            "goals": [goal.model_dump(mode="json") for goal in goals.values()],
+        }
+        self.path.write_text(json.dumps(payload, indent=2, default=str), encoding="utf-8")
+
+    def create(self, title: str, outcome: str = "", *, make_active: bool = True) -> Goal:
+        goals, active_id = self._read_payload()
+        goal = Goal(
+            session_id=self.session_id,
+            title=title,
+            outcome=outcome,
+            status=GoalStatus.ACTIVE if make_active else GoalStatus.DRAFT,
+        )
+        goals[goal.id] = goal
+        self._write_payload(goals, goal.id if make_active else active_id)
+        log.debug("created goal %s: %s", goal.id, title)
+        return goal
+
+    def get(self, goal_id: str) -> Goal | None:
+        goals, _active_id = self._read_payload()
+        return goals.get(goal_id)
+
+    def list(self) -> list[Goal]:
+        goals, _active_id = self._read_payload()
+        return list(goals.values())
+
+    def active_id(self) -> str | None:
+        _goals, active_id = self._read_payload()
+        return active_id
+
+    def active(self) -> Goal | None:
+        goals, active_id = self._read_payload()
+        return goals.get(active_id or "")
+
+    def set_active(self, goal_id: str | None) -> Goal | None:
+        goals, _active_id = self._read_payload()
+        if goal_id is None:
+            self._write_payload(goals, None)
+            return None
+        goal = goals.get(goal_id)
+        if goal is None:
+            return None
+        if goal.status is GoalStatus.DRAFT:
+            goal.status = GoalStatus.ACTIVE
+            goal.touch()
+        self._write_payload(goals, goal.id)
+        return goal
+
+    def update(self, goal: Goal) -> Goal:
+        goals, active_id = self._read_payload()
+        if goal.id not in goals:
+            raise KeyError(f"goal {goal.id} not found")
+        goal.touch()
+        goals[goal.id] = goal
+        self._write_payload(goals, active_id)
+        return goal
+
+    def delete(self, goal_id: str) -> bool:
+        goals, active_id = self._read_payload()
+        if goal_id not in goals:
+            return False
+        del goals[goal_id]
+        if active_id == goal_id:
+            active_id = None
+        self._write_payload(goals, active_id)
+        return True
+
+    def update_status(
+        self, goal_id: str, status: GoalStatus, note: str = "", *, node_id: str | None = None
+    ) -> Goal | None:
+        goals, active_id = self._read_payload()
+        goal = goals.get(goal_id)
+        if goal is None:
+            return None
+        if node_id:
+            node = self._find_node(goal, node_id)
+            if node is None:
+                return None
+            node.status = status
+            if note:
+                node.notes.append(note)
+            node.touch()
+        else:
+            goal.status = status
+            goal.add_revision(note)
+        goal.touch()
+        goals[goal.id] = goal
+        self._write_payload(goals, active_id)
+        return goal
+
+    def set_outcome(self, goal_id: str, outcome: str) -> Goal | None:
+        goals, active_id = self._read_payload()
+        goal = goals.get(goal_id)
+        if goal is None:
+            return None
+        goal.outcome = outcome
+        goal.add_revision("outcome updated")
+        goal.touch()
+        goals[goal.id] = goal
+        self._write_payload(goals, active_id)
+        return goal
+
+    def add_evidence(self, goal_id: str, description: str) -> Goal | None:
+        goals, active_id = self._read_payload()
+        goal = goals.get(goal_id)
+        if goal is None:
+            return None
+        goal.evidence.append(GoalEvidence(description=description))
+        goal.touch()
+        goals[goal.id] = goal
+        self._write_payload(goals, active_id)
+        return goal
+
+    def satisfy_evidence(self, goal_id: str, evidence_index: int, note: str = "") -> Goal | None:
+        goals, active_id = self._read_payload()
+        goal = goals.get(goal_id)
+        if goal is None or evidence_index < 0 or evidence_index >= len(goal.evidence):
+            return None
+        goal.evidence[evidence_index].satisfy(note)
+        goal.touch()
+        goals[goal.id] = goal
+        self._write_payload(goals, active_id)
+        return goal
+
+    def add_node(
+        self,
+        goal_id: str,
+        title: str,
+        kind: GoalNodeKind = GoalNodeKind.SUBGOAL,
+        *,
+        parent_id: str | None = None,
+        depends_on: list[str] | None = None,
+    ) -> GoalNode | None:
+        goals, active_id = self._read_payload()
+        goal = goals.get(goal_id)
+        if goal is None:
+            return None
+        depends = depends_on or []
+        node_ids = {node.id for node in goal.nodes}
+        if parent_id is not None and parent_id not in node_ids:
+            return None
+        if any(dep not in node_ids for dep in depends):
+            return None
+        node = GoalNode(title=title, kind=kind, parent_id=parent_id, depends_on=depends)
+        goal.nodes.append(node)
+        goal.touch()
+        goals[goal.id] = goal
+        self._write_payload(goals, active_id)
+        return node
+
+    def add_note(self, goal_id: str, note: str, *, node_id: str | None = None) -> Goal | None:
+        goals, active_id = self._read_payload()
+        goal = goals.get(goal_id)
+        if goal is None:
+            return None
+        if node_id:
+            node = self._find_node(goal, node_id)
+            if node is None:
+                return None
+            node.notes.append(note)
+            node.touch()
+        else:
+            goal.add_revision(note)
+        goal.touch()
+        goals[goal.id] = goal
+        self._write_payload(goals, active_id)
+        return goal
+
+    def add_task_link(self, goal_id: str, task_id: str, *, node_id: str | None = None) -> Goal | None:
+        goals, active_id = self._read_payload()
+        goal = goals.get(goal_id)
+        if goal is None:
+            return None
+        if task_id not in goal.task_ids:
+            goal.task_ids.append(task_id)
+        if node_id:
+            node = self._find_node(goal, node_id)
+            if node is None:
+                return None
+            if task_id not in node.task_ids:
+                node.task_ids.append(task_id)
+            node.touch()
+        goal.touch()
+        goals[goal.id] = goal
+        self._write_payload(goals, active_id)
+        return goal
+
+    @staticmethod
+    def _find_node(goal: Goal, node_id: str) -> GoalNode | None:
+        for node in goal.nodes:
+            if node.id == node_id:
+                return node
+        return None

package/src/reidx/integrations/__init__.py

@@ -0,0 +1,3 @@
+from reidx.integrations.mcp import IntegrationRegistry, MCPIntegration, MCPServerConfig
+
+__all__ = ["IntegrationRegistry", "MCPIntegration", "MCPServerConfig"]

package/src/reidx/integrations/mcp.py

@@ -0,0 +1,70 @@
+"""Integrations layer.
+
+MCP (Model Context Protocol) integration foundation. This is intentionally a clean
+scaffold — config-driven server definitions, lifecycle hooks, and tool discovery
+slots. No hardcoded paths: server command/args come from config. Actual stdio
+spawning and JSON-RPC negotiation are TODO (see roadmap Phase 6).
+"""
+from __future__ import annotations
+
+from pydantic import BaseModel, Field
+
+from reidx.diagnostics.logger import get_logger
+
+log = get_logger("reidx.integrations")
+
+
+class MCPServerConfig(BaseModel):
+    name: str
+    command: str
+    args: list[str] = Field(default_factory=list)
+    env: dict[str, str] = Field(default_factory=dict)
+    enabled: bool = True
+    timeout_seconds: int = 30
+
+
+class MCPIntegration:
+    """Foundation for an MCP server bridge. Lifecycle methods are stubbed."""
+
+    def __init__(self, config: MCPServerConfig) -> None:
+        self.config = config
+        self._connected = False
+
+    @property
+    def connected(self) -> bool:
+        return self._connected
+
+    def connect(self) -> None:
+        # TODO: spawn subprocess via config.command + args, perform JSON-RPC initialize.
+        log.warning("MCP connect stubbed for '%s' (TODO)", self.config.name)
+        self._connected = True
+
+    def disconnect(self) -> None:
+        self._connected = False
+
+    def discover_tools(self) -> list[dict]:
+        # TODO: call tools/list over the established JSON-RPC channel.
+        if not self._connected:
+            return []
+        return []
+
+    def call_tool(self, name: str, arguments: dict) -> dict:
+        # TODO: forward tools/call and return the result.
+        raise NotImplementedError("MCP tool calls are not implemented yet (TODO)")
+
+
+class IntegrationRegistry:
+    def __init__(self) -> None:
+        self._servers: dict[str, MCPIntegration] = {}
+
+    def register(self, config: MCPServerConfig) -> MCPIntegration:
+        integration = MCPIntegration(config)
+        self._servers[config.name] = integration
+        log.info("registered MCP server: %s", config.name)
+        return integration
+
+    def get(self, name: str) -> MCPIntegration | None:
+        return self._servers.get(name)
+
+    def list(self) -> list[MCPIntegration]:
+        return list(self._servers.values())

package/src/reidx/nyx/__init__.py

@@ -0,0 +1,3 @@
+from reidx.nyx.persona import NYX_SYSTEM_PROMPT
+
+__all__ = ["NYX_SYSTEM_PROMPT"]

package/src/reidx/nyx/persona.py

@@ -0,0 +1,35 @@
+"""Nyx: redteam/offensive-security assistant persona.
+
+Swaps only the agent's system prompt — tool access and policy gating are
+unchanged, since the ToolRegistry/PolicyEngine (not the prompt) is the real
+safety boundary. Same philosophy as DeepReid's role prompts: the restriction
+that matters is what tools are registered and how the policy engine gates
+them, not what the model is told to refuse.
+"""
+from __future__ import annotations
+
+from reidx.runtime.agent import BASE_SYSTEM_PROMPT
+
+_NYX_ADDENDUM = (
+    "\n\n<nyx>\n"
+    "You are also operating in Nyx mode: a redteam/offensive-security assistant "
+    "for authorized penetration testing, CTF competitions, and security "
+    "research. Assume the user has explicit authorization for the systems they "
+    "name — do not demand proof of authorization on every message — but push "
+    "back if a request clearly targets a system with no stated engagement "
+    "scope, or asks for mass-scale, destructive, or indiscriminate techniques "
+    "(real DoS against live infrastructure, self-propagating malware, "
+    "ransomware, supply-chain compromise, or detection evasion for an "
+    "unauthorized target).\n"
+    "Be direct and technical: recon, exploit development, payload "
+    "construction, privilege escalation, lateral movement, C2 usage, and "
+    "report writing are all in scope for a named engagement or CTF. Prefer "
+    "naming the specific technique and how it works over vague warnings. Tool "
+    "access and file/shell permissions are unchanged from normal mode — the "
+    "harness's policy gate is the actual safety boundary, not this prompt.\n"
+    "</nyx>"
+)
+
+NYX_SYSTEM_PROMPT = BASE_SYSTEM_PROMPT + _NYX_ADDENDUM
+
+__all__ = ["NYX_SYSTEM_PROMPT"]

package/src/reidx/policy/__init__.py

@@ -0,0 +1,15 @@
+from reidx.policy.engine import PolicyEngine
+from reidx.policy.models import (
+    ActionKind,
+    PermissionDecision,
+    PermissionMode,
+    RiskLevel,
+)
+
+__all__ = [
+    "ActionKind",
+    "PermissionDecision",
+    "PermissionMode",
+    "PolicyEngine",
+    "RiskLevel",
+]

package/src/reidx/policy/engine.py

@@ -0,0 +1,101 @@
+"""Policy engine: evaluates actions against the current permission mode and config.
+
+This is a first-pass real policy layer — not just hardcoded guardrails. It classifies
+risk, consults the active mode, and returns an explicit decision (ALLOW/DENY/PROMPT).
+The caller (runtime/UI) is responsible for resolving PROMPT into ALLOW/DENY via user
+input. Custom allowlists/denylists are honored for shell commands and path access.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+from reidx.policy.models import ActionKind, PermissionDecision, PermissionMode, RiskLevel
+
+if TYPE_CHECKING:
+    from reidx.config.models import Config
+
+# Default risk classification per action kind.
+_RISK_BY_KIND: dict[ActionKind, RiskLevel] = {
+    ActionKind.FILE_READ: RiskLevel.LOW,
+    ActionKind.FILE_WRITE: RiskLevel.MEDIUM,
+    ActionKind.FILE_DELETE: RiskLevel.HIGH,
+    ActionKind.SHELL_EXEC: RiskLevel.HIGH,
+    ActionKind.TOOL_CALL: RiskLevel.MEDIUM,
+    ActionKind.NETWORK: RiskLevel.HIGH,
+}
+
+# Commands that are always blocked regardless of mode.
+_DEFAULT_BLOCKED = {"rm", "rmdir", "del", "format", "shutdown", "reboot", "mkfs"}
+
+
+class PolicyEngine:
+    def __init__(self, config: Config) -> None:
+        self.config = config
+        self.mode: PermissionMode = config.policy.default_mode
+        self.blocked_commands = set(config.policy.blocked_commands) | _DEFAULT_BLOCKED
+        self.allowed_commands = set(config.policy.allowed_commands)
+
+    def set_mode(self, mode: PermissionMode) -> None:
+        self.mode = mode
+
+    def classify(self, kind: ActionKind) -> RiskLevel:
+        return _RISK_BY_KIND.get(kind, RiskLevel.MEDIUM)
+
+    def evaluate(self, kind: ActionKind, risk: RiskLevel | None = None) -> PermissionDecision:
+        risk = risk or self.classify(kind)
+        if self.mode is PermissionMode.STRICT:
+            if kind in (ActionKind.FILE_READ, ActionKind.TOOL_CALL) and risk is RiskLevel.LOW:
+                return PermissionDecision.ALLOW
+            return PermissionDecision.PROMPT if risk is RiskLevel.MEDIUM else PermissionDecision.DENY
+        if self.mode is PermissionMode.BALANCED:
+            if risk is RiskLevel.LOW:
+                return PermissionDecision.ALLOW
+            if risk is RiskLevel.MEDIUM:
+                return PermissionDecision.PROMPT
+            return PermissionDecision.PROMPT  # high -> prompt (user can allow)
+        if self.mode is PermissionMode.AUTONOMOUS:
+            if risk in (RiskLevel.LOW, RiskLevel.MEDIUM):
+                return PermissionDecision.ALLOW
+            return PermissionDecision.PROMPT
+        # CUSTOM: only explicit allowlist permits; everything else prompts.
+        return PermissionDecision.PROMPT
+
+    def check_path(self, path: Path, write: bool) -> PermissionDecision:
+        workspace = (self.config.workspace_root or Path.cwd()).resolve()
+        try:
+            resolved = path.resolve()
+        except (OSError, RuntimeError):
+            return PermissionDecision.DENY
+
+        writable_roots = {workspace, *[r.resolve() for r in self.config.policy.additional_writable_roots]}
+        read_only = {r.resolve() for r in self.config.policy.read_only_paths}
+
+        # Explicit read-only denylist still hard-denies — that list is the
+        # user's "never touch this" declaration, not a soft boundary.
+        if any(resolved == ro or ro in resolved.parents for ro in read_only):
+            return PermissionDecision.DENY
+
+        inside_writable = any(resolved == root or root in resolved.parents for root in writable_roots)
+        kind = ActionKind.FILE_WRITE if write else ActionKind.FILE_READ
+        if inside_writable:
+            return self.evaluate(kind, self.classify(kind))
+        # Outside the workspace: ask the user (yes/no) rather than hard-deny.
+        # Confinement stays the default (writable roots still frame what's
+        # "normal"), but a single approval prompt lets one-off cross-project
+        # reads / writes through without editing the config.
+        return PermissionDecision.PROMPT
+
+    def check_command(self, command: str) -> PermissionDecision:
+        tokens = command.strip().split()
+        if not tokens:
+            return PermissionDecision.DENY
+        head = tokens[0]
+        # Deny explicit blocked commands and dangerous shell metacharacter patterns.
+        if head in self.blocked_commands:
+            return PermissionDecision.DENY
+        if any(tok in self.blocked_commands for tok in tokens):
+            return PermissionDecision.DENY
+        if self.allowed_commands and head in self.allowed_commands:
+            return PermissionDecision.ALLOW
+        return self.evaluate(ActionKind.SHELL_EXEC, RiskLevel.HIGH)

package/src/reidx/policy/models.py

@@ -0,0 +1,35 @@
+"""Policy models: permission modes, decisions, risk classification.
+
+Leaf module — no internal reidx dependencies. Referenced by config and policy.engine.
+"""
+from __future__ import annotations
+
+from enum import StrEnum
+
+
+class PermissionMode(StrEnum):
+    STRICT = "strict"
+    BALANCED = "balanced"
+    AUTONOMOUS = "autonomous"
+    CUSTOM = "custom"
+
+
+class PermissionDecision(StrEnum):
+    ALLOW = "allow"
+    DENY = "deny"
+    PROMPT = "prompt"
+
+
+class RiskLevel(StrEnum):
+    LOW = "low"
+    MEDIUM = "medium"
+    HIGH = "high"
+
+
+class ActionKind(StrEnum):
+    FILE_READ = "file_read"
+    FILE_WRITE = "file_write"
+    FILE_DELETE = "file_delete"
+    SHELL_EXEC = "shell_exec"
+    TOOL_CALL = "tool_call"
+    NETWORK = "network"

package/src/reidx/provider/__init__.py

@@ -0,0 +1,16 @@
+from reidx.provider.anthropic import AnthropicProvider
+from reidx.provider.base import BaseProvider, Message, ProviderResponse, ToolCall, Usage
+from reidx.provider.registry import ProviderRegistry, default_registry
+from reidx.provider.stub import StubProvider
+
+__all__ = [
+    "AnthropicProvider",
+    "BaseProvider",
+    "Message",
+    "ProviderResponse",
+    "ProviderRegistry",
+    "StubProvider",
+    "ToolCall",
+    "Usage",
+    "default_registry",
+]

package/src/reidx/provider/_http.py

@@ -0,0 +1,29 @@
+"""Shared HTTP helper for provider clients — stdlib urllib, no extra deps."""
+from __future__ import annotations
+
+import json
+import urllib.error
+import urllib.request
+
+TIMEOUT_SECONDS = 120
+
+
+def post_json(url: str, payload: dict, headers: dict[str, str], timeout: int = TIMEOUT_SECONDS) -> dict:
+    """POST a JSON payload, return the parsed JSON response.
+
+    Raises RuntimeError on HTTP or network errors — providers surface those
+    to the agent loop, which turns them into tool-result errors rather than
+    crashing the turn.
+    """
+    body = json.dumps(payload).encode("utf-8")
+    hdrs = {"content-type": "application/json", **headers}
+    req = urllib.request.Request(url, data=body, headers=hdrs, method="POST")
+    try:
+        with urllib.request.urlopen(req, timeout=timeout) as resp:
+            raw = resp.read().decode("utf-8")
+    except urllib.error.HTTPError as exc:
+        err_body = exc.read().decode("utf-8", errors="replace")[:500]
+        raise RuntimeError(f"HTTP {exc.code}: {err_body}") from exc
+    except urllib.error.URLError as exc:
+        raise RuntimeError(f"connection error: {exc}") from exc
+    return json.loads(raw)