@scemoon/cdh 1.0.0

package/onecode/agent/tools/permissions.py

@@ -0,0 +1,77 @@
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from enum import Enum
+from pathlib import Path
+from typing import Optional
+
+from onecode.agent.tools.errors import ToolPermissionError
+
+
+class PermissionResult(str, Enum):
+    ALLOW = "allow"
+    DENY = "deny"
+    ASK = "ask"
+
+
+def _resolve_path(p: str | Path) -> Path:
+    return Path(p).expanduser().resolve()
+
+
+def _is_within(child: Path, parent: Path) -> bool:
+    try:
+        child.relative_to(parent)
+        return True
+    except ValueError:
+        return False
+
+
+@dataclass
+class ToolPermissionContext:
+    deny_names: frozenset[str] = field(default_factory=frozenset)
+    deny_prefixes: tuple[str, ...] = ()
+    workspace_root: Optional[Path] = None
+    additional_working_directories: tuple[Path, ...] = ()
+
+    @classmethod
+    def from_iterables(
+        cls,
+        deny_names: list[str] | None = None,
+        deny_prefixes: list[str] | None = None,
+        *,
+        workspace_root: str | Path | None = None,
+        additional_working_directories: list[str | Path] | None = None,
+    ) -> ToolPermissionContext:
+        return cls(
+            deny_names=frozenset(name.lower() for name in (deny_names or [])),
+            deny_prefixes=tuple(prefix.lower() for prefix in (deny_prefixes or [])),
+            workspace_root=_resolve_path(workspace_root) if workspace_root else None,
+            additional_working_directories=tuple(
+                _resolve_path(p) for p in (additional_working_directories or [])
+            ),
+        )
+
+    def blocks_tool(self, tool_name: str) -> bool:
+        lowered = tool_name.lower()
+        return lowered in self.deny_names or any(
+            lowered.startswith(prefix) for prefix in self.deny_prefixes
+        )
+
+    def allowed_roots(self) -> tuple[Path, ...]:
+        roots: list[Path] = []
+        if self.workspace_root is not None:
+            roots.append(self.workspace_root)
+        roots.extend(self.additional_working_directories)
+        return tuple(roots)
+
+    def ensure_path_allowed(self, path: str | Path) -> Path:
+        resolved = _resolve_path(path)
+        roots = self.allowed_roots()
+        if not roots:
+            return resolved
+        if any(_is_within(resolved, root) for root in roots):
+            return resolved
+        roots_str = ", ".join(str(r) for r in roots)
+        raise ToolPermissionError(
+            f"path is outside allowed working directories: {resolved} (allowed: {roots_str})"
+        )

package/onecode/agent/tools/protocol.py

@@ -0,0 +1,20 @@
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Any, Literal, Optional
+
+
+@dataclass(frozen=True)
+class ToolCall:
+    name: str
+    input: dict[str, Any]
+    tool_use_id: Optional[str] = None
+
+
+@dataclass(frozen=True)
+class ToolResult:
+    name: str
+    output: Any
+    is_error: bool = False
+    tool_use_id: Optional[str] = None
+    content_type: Literal["text", "json"] = "json"

package/onecode/agent/tools/registry.py

@@ -0,0 +1,134 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any, Iterable, Mapping, Optional, Protocol
+
+from onecode.agent.tools.errors import ToolInputError, ToolPermissionError
+from onecode.agent.tools.protocol import ToolCall, ToolResult
+from onecode.agent.tools.schema_validation import validate_json_schema
+
+
+@dataclass(frozen=True)
+class ToolSpec:
+    name: str
+    description: str
+    input_schema: Mapping[str, Any]
+    aliases: tuple[str, ...] = ()
+    is_read_only: bool = False
+    is_destructive: bool = False
+    max_result_size_chars: int = 20_000
+
+
+class Tool(Protocol):
+    def spec(self) -> ToolSpec: ...
+
+    def run(self, tool_input: dict[str, Any]) -> ToolResult: ...
+
+
+class ToolRegistry:
+    def __init__(
+        self,
+        tools: Iterable[Tool] | None = None,
+    ) -> None:
+        self._tools: list[Tool] = []
+        self._by_name: dict[str, Tool] = {}
+        if tools:
+            for tool in tools:
+                self.register(tool)
+
+    def register(self, tool: Tool) -> None:
+        spec = tool.spec()
+        key = spec.name.lower()
+        if key in self._by_name:
+            raise ValueError(f"duplicate tool name: {spec.name}")
+        self._tools.append(tool)
+        self._by_name[key] = tool
+        for alias in spec.aliases:
+            alias_key = alias.lower()
+            if alias_key in self._by_name:
+                raise ValueError(f"duplicate tool alias: {alias}")
+            self._by_name[alias_key] = tool
+
+    def list_specs(self) -> list[ToolSpec]:
+        return [tool.spec() for tool in self._tools]
+
+    def get(self, name: str) -> Tool | None:
+        return self._by_name.get(name.lower())
+
+    def make_openai_schemas(self) -> list[dict]:
+        schemas = []
+        for spec in self.list_specs():
+            schemas.append({
+                "type": "function",
+                "function": {
+                    "name": spec.name,
+                    "description": spec.description,
+                    "parameters": dict(spec.input_schema),
+                },
+            })
+        return schemas
+
+    def dispatch(
+        self,
+        call: ToolCall,
+    ) -> ToolResult:
+        tool = self.get(call.name)
+        if tool is None:
+            return ToolResult(
+                name=call.name,
+                output={"error": f"unknown tool: {call.name}"},
+                is_error=True,
+                tool_use_id=call.tool_use_id,
+            )
+        try:
+            spec = tool.spec()
+
+            # Schema validation
+            validate_json_schema(call.input, spec.input_schema, tool_name=call.name)
+
+            # Execute
+            result = tool.run(call.input)
+
+            # Enforce max result size — truncate oversized output so the
+            # context window is not flooded by a single tool result.
+            max_chars = spec.max_result_size_chars
+            if max_chars > 0 and isinstance(result.output, str) and len(result.output) > max_chars:
+                result = ToolResult(
+                    name=result.name,
+                    output=result.output[:max_chars]
+                    + f"\n\n[Output truncated to {max_chars} characters]",
+                    is_error=result.is_error,
+                    tool_use_id=result.tool_use_id or call.tool_use_id,
+                    content_type=result.content_type,
+                )
+
+            if result.tool_use_id is None:
+                return ToolResult(
+                    name=result.name,
+                    output=result.output,
+                    is_error=result.is_error,
+                    tool_use_id=call.tool_use_id,
+                    content_type=result.content_type,
+                )
+            return result
+        except ToolInputError as e:
+            return ToolResult(
+                name=call.name,
+                output={"error": str(e)},
+                is_error=True,
+                tool_use_id=call.tool_use_id,
+            )
+        except ToolPermissionError as e:
+            return ToolResult(
+                name=call.name,
+                output={"error": str(e)},
+                is_error=True,
+                tool_use_id=call.tool_use_id,
+            )
+        except Exception as e:
+            return ToolResult(
+                name=call.name,
+                output={"error": str(e)},
+                is_error=True,
+                tool_use_id=call.tool_use_id,
+            )

package/onecode/agent/tools/sandbox.py

@@ -0,0 +1,264 @@
+from __future__ import annotations
+
+import enum
+import os
+import resource
+import subprocess
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Optional
+
+
+class SandboxMode(enum.Enum):
+    NONE = "none"
+    BUBBLEWRAP = "bwrap"
+    DOCKER = "docker"
+
+
+@dataclass
+class ResourceLimits:
+    cpu_time: int = 30
+    memory_mb: int = 512
+    max_procs: int = 10
+    max_open_files: int = 100
+    max_pseudo_terminals: int = 0
+
+
+@dataclass
+class SandboxConfig:
+    workspace_root: Path
+    mode: SandboxMode = SandboxMode.NONE
+    resource_limits: ResourceLimits = field(default_factory=ResourceLimits)
+    read_only_bindings: tuple[str, ...] = ("/usr", "/bin", "/lib", "/lib64", "/opt", "/tmp")
+    network_enabled: bool = False
+    env_whitelist: tuple[str, ...] = ("PATH", "HOME", "USER", "TERM", "LANG", "LC_*")
+
+
+class SandboxError(Exception):
+    pass
+
+
+class Sandbox:
+    def __init__(self, config: SandboxConfig):
+        self.config = config
+        self._bwrap_available: Optional[bool] = None
+
+    def _check_bwrap_available(self) -> bool:
+        if self._bwrap_available is not None:
+            return self._bwrap_available
+        try:
+            subprocess.run(["bwrap", "--version"], capture_output=True, check=True)
+            self._bwrap_available = True
+        except (subprocess.CalledProcessError, FileNotFoundError):
+            self._bwrap_available = False
+        return self._bwrap_available
+
+    def _build_bwrap_cmd(self, cmd: str) -> list[str]:
+        ws = str(self.config.workspace_root.resolve())
+
+        bwrap_args = ["bwrap"]
+
+        bwrap_args.extend(["--dev", "/dev"])
+        bwrap_args.extend(["--proc", "/proc"])
+
+        bwrap_args.extend(["--bind", ws, "/workspace"])
+
+        for ro_path in self.config.read_only_bindings:
+            p = Path(ro_path)
+            if p.exists():
+                bwrap_args.extend(["--ro-bind", str(p), str(p)])
+
+        bwrap_args.extend(["--tmpfs", "/tmp"])
+        bwrap_args.extend(["--tmpfs", "/var/tmp"])
+
+        if not self.config.network_enabled:
+            bwrap_args.append("--unshare-net")
+
+        bwrap_args.extend(["--uid", str(os.getuid())])
+        bwrap_args.extend(["--gid", str(os.getgid())])
+
+        env = " ".join(f"{k}={v}" for k, v in os.environ.items() if k in self.config.env_whitelist or k.startswith("LC_"))
+        bwrap_args.extend(["--setenv", "HOME", "/workspace"])
+        bwrap_args.extend(["--setenv", "PATH", "/usr/local/sbin:/usr/local/bin:/usr/bin:/bin"])
+
+        bwrap_args.extend(["--chdir", "/workspace"])
+
+        bwrap_args.extend(["--", "sh", "-c", cmd])
+
+        return bwrap_args
+
+    def _set_resource_limits(self) -> None:
+        """Deprecated: applied rlimits to the parent process which broke
+        ``subprocess.run``.  Kept as a no-op for backward compatibility —
+        use :meth:`_exec_direct` (which now applies the limits in a
+        ``preexec_fn``) instead.
+        """
+        return
+
+    def exec(self, cmd: str, timeout: int = 60) -> dict:
+        """Public entry point — dispatches to the right backend for the mode."""
+        mode = self.config.mode
+
+        if mode == SandboxMode.NONE:
+            return self._exec_direct(cmd, timeout)
+        if mode == SandboxMode.BUBBLEWRAP:
+            if self._check_bwrap_available():
+                return self._exec_bwrap(cmd, timeout)
+            return self._exec_direct(cmd, timeout)
+        if mode == SandboxMode.DOCKER:
+            return self._exec_docker(cmd, timeout)
+        return self._exec_direct(cmd, timeout)
+
+    def _exec_direct(self, cmd: str, timeout: int) -> dict:
+        # Apply resource limits in the *child* process only — calling
+        # ``setrlimit`` on the parent (this Python interpreter) shrinks
+        # its own address space, which then fails with ``EAGAIN`` on the
+        # very next ``fork``/``execve`` that ``subprocess.run`` performs.
+        limits = self.config.resource_limits
+
+        def _preexec_apply_rlimits() -> None:  # pragma: no cover (runs in child)
+            try:
+                resource.setrlimit(
+                    resource.RLIMIT_CPU, (limits.cpu_time, limits.cpu_time + 5)
+                )
+            except (ValueError, OSError, resource.error):
+                pass
+            try:
+                mem_bytes = limits.memory_mb * 1024 * 1024
+                resource.setrlimit(
+                    resource.RLIMIT_AS, (mem_bytes, mem_bytes)
+                )
+            except (ValueError, OSError, resource.error):
+                pass
+            try:
+                resource.setrlimit(
+                    resource.RLIMIT_NPROC, (limits.max_procs, limits.max_procs + 5)
+                )
+            except (ValueError, OSError, resource.error):
+                pass
+            try:
+                resource.setrlimit(
+                    resource.RLIMIT_NOFILE,
+                    (limits.max_open_files, limits.max_open_files + 10),
+                )
+            except (ValueError, OSError, resource.error):
+                pass
+
+        try:
+            result = subprocess.run(
+                cmd,
+                shell=True,
+                capture_output=True,
+                text=True,
+                cwd=str(self.config.workspace_root),
+                timeout=timeout,
+                preexec_fn=_preexec_apply_rlimits,
+            )
+            return {
+                "success": result.returncode == 0,
+                "stdout": result.stdout,
+                "stderr": result.stderr,
+                "returncode": result.returncode,
+                "sandbox": "none",
+            }
+        except subprocess.TimeoutExpired:
+            return {"success": False, "error": "Command timed out", "sandbox": "none"}
+        except Exception as e:
+            return {"success": False, "error": str(e), "sandbox": "none"}
+
+    def _exec_bwrap(self, cmd: str, timeout: int) -> dict:
+        bwrap_cmd = self._build_bwrap_cmd(cmd)
+
+        try:
+            result = subprocess.run(
+                bwrap_cmd,
+                capture_output=True,
+                text=True,
+                cwd=str(self.config.workspace_root),
+                timeout=timeout,
+            )
+            return {
+                "success": result.returncode == 0,
+                "stdout": result.stdout,
+                "stderr": result.stderr,
+                "returncode": result.returncode,
+                "sandbox": "bwrap",
+            }
+        except subprocess.TimeoutExpired:
+            return {"success": False, "error": "Command timed out", "sandbox": "bwrap"}
+        except FileNotFoundError:
+            return {"success": False, "error": "bwrap not installed", "sandbox": "bwrap"}
+        except Exception as e:
+            return {"success": False, "error": str(e), "sandbox": "bwrap"}
+
+    def _exec_docker(self, cmd: str, timeout: int) -> dict:
+        import docker
+
+        ws = str(self.config.workspace_root.resolve())
+
+        docker_cmd = [
+            "sh", "-c",
+            f"cd /workspace && {cmd}"
+        ]
+
+        try:
+            client = docker.from_env()
+            container = client.containers.run(
+                "alpine:latest",
+                docker_cmd,
+                detach=True,
+                mem_limit=f"{self.config.resource_limits.memory_mb}m",
+                cpu_period=100000,
+                cpu_quota=self.config.resource_limits.cpu_time * 1000,
+                network_mode="none" if not self.config.network_enabled else "bridge",
+                volumes={ws: {"bind": "/workspace", "mode": "rw"}},
+                working_dir="/workspace",
+                user=f"{os.getuid()}:{os.getgid()}",
+                remove=True,
+            )
+            result = container.wait(timeout=timeout)
+            logs = container.logs().decode("utf-8", errors="replace")
+            return {
+                "success": result["StatusCode"] == 0,
+                "stdout": logs,
+                "stderr": "",
+                "returncode": result["StatusCode"],
+                "sandbox": "docker",
+            }
+        except docker.errors.DockerException:
+            return {"success": False, "error": "Docker not available", "sandbox": "docker"}
+        except docker.errors.TimeoutError:
+            return {"success": False, "error": "Container timed out", "sandbox": "docker"}
+        except Exception as e:
+            return {"success": False, "error": str(e), "sandbox": "docker"}
+
+
+def create_sandbox(
+    workspace_root: Path,
+    mode: str = "auto",
+    **kwargs,
+) -> Sandbox:
+    if mode == "auto":
+        sandbox_mode = SandboxMode.NONE
+        if Path("/usr/bin/bwrap").exists():
+            sandbox_mode = SandboxMode.BUBBLEWRAP
+        elif Path("/var/run/docker.sock").exists():
+            try:
+                subprocess.run(["docker", "info"], capture_output=True, check=True)
+                sandbox_mode = SandboxMode.DOCKER
+            except (subprocess.CalledProcessError, FileNotFoundError):
+                pass
+    elif mode == "bwrap":
+        sandbox_mode = SandboxMode.BUBBLEWRAP
+    elif mode == "docker":
+        sandbox_mode = SandboxMode.DOCKER
+    else:
+        sandbox_mode = SandboxMode.NONE
+
+    config = SandboxConfig(
+        workspace_root=workspace_root,
+        mode=sandbox_mode,
+        resource_limits=ResourceLimits(**kwargs) if kwargs else ResourceLimits(),
+    )
+
+    return Sandbox(config)

package/onecode/agent/tools/schema_validation.py

@@ -0,0 +1,100 @@
+from __future__ import annotations
+
+from typing import Any, Mapping
+
+from onecode.agent.tools.errors import ToolInputError
+
+
+def validate_json_schema(
+    input_data: dict[str, Any],
+    schema: Mapping[str, Any],
+    tool_name: str = "",
+) -> None:
+    """Validate input against JSON Schema.
+
+    Supports: required fields, type checks, string patterns, enums,
+    nested objects, and arrays.
+    """
+    if not schema:
+        return
+
+    errors: list[str] = []
+    props = schema.get("properties", {})
+    required = set(schema.get("required", []))
+
+    # Check required fields
+    for field in required:
+        if field not in input_data or input_data[field] is None:
+            errors.append(f"missing required field: '{field}'")
+
+    # Validate each present field
+    for field, value in input_data.items():
+        prop_schema = props.get(field)
+        if prop_schema is None:
+            continue
+        _validate_field(field, value, prop_schema, errors, input_data)
+
+    if errors:
+        prefix = f" in tool '{tool_name}'" if tool_name else ""
+        msg = f"input validation failed{prefix}:\n" + "\n".join(f"  - {e}" for e in errors)
+        raise ToolInputError(msg)
+
+
+def _validate_field(
+    field: str,
+    value: Any,
+    schema: dict[str, Any],
+    errors: list[str],
+    root_input: dict[str, Any],
+) -> None:
+    json_type = schema.get("type", "")
+
+    if json_type == "string":
+        if not isinstance(value, str):
+            errors.append(f"'{field}': expected string, got {type(value).__name__}")
+        else:
+            pattern = schema.get("pattern")
+            if pattern:
+                import re
+                if not re.match(pattern, value):
+                    errors.append(f"'{field}': does not match pattern {pattern!r}")
+
+    elif json_type == "integer":
+        if not isinstance(value, int) or isinstance(value, bool):
+            errors.append(f"'{field}': expected integer, got {type(value).__name__}")
+
+    elif json_type == "number":
+        if not isinstance(value, (int, float)) or isinstance(value, bool):
+            errors.append(f"'{field}': expected number, got {type(value).__name__}")
+
+    elif json_type == "boolean":
+        if not isinstance(value, bool):
+            errors.append(f"'{field}': expected boolean, got {type(value).__name__}")
+
+    elif json_type == "array":
+        if not isinstance(value, list):
+            errors.append(f"'{field}': expected array, got {type(value).__name__}")
+        else:
+            items_schema = schema.get("items")
+            if items_schema:
+                for i, item in enumerate(value):
+                    _validate_field(f"{field}[{i}]", item, items_schema, errors, root_input)
+
+    elif json_type == "object":
+        if not isinstance(value, dict):
+            errors.append(f"'{field}': expected object, got {type(value).__name__}")
+        else:
+            sub_required = set(schema.get("required", []))
+            sub_props = schema.get("properties", {})
+            for sub_field in sub_required:
+                if sub_field not in value:
+                    errors.append(f"'{field}.{sub_field}': missing required field")
+            for sub_field, sub_value in value.items():
+                sub_schema = sub_props.get(sub_field)
+                if sub_schema:
+                    _validate_field(f"{field}.{sub_field}", sub_value, sub_schema, errors, root_input)
+
+    # Check enum values
+    enum_values = schema.get("enum")
+    if enum_values is not None and value not in enum_values:
+        errors.append(f"'{field}': must be one of {enum_values}, got {value!r}")

package/onecode/agent/tools/skill_tools.py

@@ -0,0 +1,52 @@
+from __future__ import annotations
+
+from typing import Any
+
+from onecode.agent.tools.protocol import ToolResult
+from onecode.agent.tools.registry import ToolSpec
+from onecode.skills.loader import SkillLoader
+from onecode.skills.argument_substitution import substitute_arguments
+
+
+class SkillTool:
+    """Run a SKILL.md skill (Clawd-Code pattern)."""
+
+    def __init__(self, loader: SkillLoader):
+        self._loader = loader
+
+    def spec(self) -> ToolSpec:
+        return ToolSpec(
+            name="Skill",
+            description="Run a registered skill by name with optional arguments. Skills are markdown-based instruction sets with YAML frontmatter.",
+            input_schema={
+                "type": "object",
+                "properties": {
+                    "name": {"type": "string", "description": "Skill name to run"},
+                    "arguments": {
+                        "type": "array",
+                        "items": {"type": "string"},
+                        "description": "Optional positional arguments ($0, $1, $path, $ARGUMENTS)",
+                    },
+                },
+                "required": ["name"],
+            },
+        )
+
+    def run(self, tool_input: dict[str, Any]) -> ToolResult:
+        name = tool_input.get("name", "")
+        args = tool_input.get("arguments") or []
+        skill = self._loader.get(name)
+        if not skill:
+            return ToolResult(
+                name="Skill",
+                output={"error": f"skill '{name}' not found"},
+                is_error=True,
+            )
+        content = skill.content
+        if args:
+            content = substitute_arguments(content, args)
+        return ToolResult(
+            name="Skill",
+            output={"name": name, "content": content, "description": skill.description},
+        )
+