@scemoon/cdh 1.0.7 → 1.0.9-beta.1

package/onecode/agent/permissions.py

@@ -0,0 +1,150 @@
+from __future__ import annotations
+
+import fnmatch
+from dataclasses import dataclass, field
+from enum import Enum
+from pathlib import Path
+from typing import Optional
+
+
+class PermissionResult(Enum):
+    ALLOW = "allow"
+    DENY = "deny"
+    ASK = "ask"
+
+
+@dataclass
+class PathRule:
+    pattern: str
+    permission: PermissionResult = PermissionResult.ALLOW
+
+    def matches(self, path: str) -> bool:
+        return (
+            fnmatch.fnmatch(path, self.pattern) or
+            fnmatch.fnmatch(Path(path).name, self.pattern) or
+            fnmatch.fnmatch(Path(path).stem, self.pattern)
+        )
+
+
+@dataclass
+class CommandRule:
+    pattern: str
+    permission: PermissionResult = PermissionResult.ALLOW
+
+    def matches(self, cmd: str) -> bool:
+        normalized = cmd.strip()
+        if fnmatch.fnmatch(normalized, self.pattern):
+            return True
+        parts = normalized.split()
+        if parts:
+            cmd_base = parts[0]
+            args = " ".join(parts[1:]) if len(parts) > 1 else ""
+            if args and fnmatch.fnmatch(f"{cmd_base} {args}", self.pattern):
+                return True
+            if fnmatch.fnmatch(cmd_base, self.pattern):
+                return True
+        return False
+
+
+@dataclass
+class PermissionSet:
+    path_rules: list[PathRule] = field(default_factory=list)
+    command_rules: list[CommandRule] = field(default_factory=list)
+    default_path_permission: PermissionResult = PermissionResult.ALLOW
+    default_command_permission: PermissionResult = PermissionResult.ALLOW
+
+    def check_path(self, path: str) -> PermissionResult:
+        matched = self.default_path_permission
+        for rule in self.path_rules:
+            if rule.matches(path):
+                matched = rule.permission
+        return matched
+
+    def check_command(self, cmd: str) -> PermissionResult:
+        matched = self.default_command_permission
+        for rule in self.command_rules:
+            if rule.matches(cmd):
+                matched = rule.permission
+        return matched
+
+    def allow_path(self, pattern: str) -> None:
+        self.path_rules.append(PathRule(pattern, PermissionResult.ALLOW))
+
+    def deny_path(self, pattern: str) -> None:
+        self.path_rules.append(PathRule(pattern, PermissionResult.DENY))
+
+    def ask_path(self, pattern: str) -> None:
+        self.path_rules.append(PathRule(pattern, PermissionResult.ASK))
+
+    def allow_command(self, pattern: str) -> None:
+        self.command_rules.append(CommandRule(pattern, PermissionResult.ALLOW))
+
+    def deny_command(self, pattern: str) -> None:
+        self.command_rules.append(CommandRule(pattern, PermissionResult.DENY))
+
+    def ask_command(self, pattern: str) -> None:
+        self.command_rules.append(CommandRule(pattern, PermissionResult.ASK))
+
+    @classmethod
+    def from_config(cls, config: dict) -> "PermissionSet":
+        ps = cls()
+        perm_map = {"allow": PermissionResult.ALLOW, "ask": PermissionResult.ASK, "deny": PermissionResult.DENY}
+
+        if "path" in config:
+            for pattern, action in config["path"].items():
+                if action in perm_map:
+                    getattr(ps, f"{action}_path")(pattern)
+
+        if "command" in config:
+            for pattern, action in config["command"].items():
+                if action in perm_map:
+                    getattr(ps, f"{action}_command")(pattern)
+
+        if "default" in config:
+            default = config["default"]
+            if "path" in default and default["path"] in perm_map:
+                ps.default_path_permission = perm_map[default["path"]]
+            if "command" in default and default["command"] in perm_map:
+                ps.default_command_permission = perm_map[default["command"]]
+
+        return ps
+
+
+class PermissionChecker:
+    def __init__(self, permission_set: Optional[PermissionSet] = None):
+        self.permission_set = permission_set or PermissionSet()
+
+    def check_file_read(self, path: str) -> PermissionResult:
+        return self.permission_set.check_path(path)
+
+    def check_file_write(self, path: str) -> PermissionResult:
+        return self.permission_set.check_path(path)
+
+    def check_command(self, cmd: str) -> PermissionResult:
+        return self.permission_set.check_command(cmd)
+
+    def is_allowed(self, permission: PermissionResult) -> bool:
+        return permission == PermissionResult.ALLOW
+
+    def is_denied(self, permission: PermissionResult) -> bool:
+        return permission == PermissionResult.DENY
+
+    def requires_approval(self, permission: PermissionResult) -> bool:
+        return permission == PermissionResult.ASK
+
+
+def create_safe_permission_set() -> PermissionSet:
+    ps = PermissionSet()
+    ps.deny_path("**/.env")
+    ps.deny_path("**/secrets/**")
+    ps.deny_path("**/credentials/**")
+    ps.deny_command("rm -rf /")
+    ps.deny_command("rm -rf /*")
+    ps.deny_command("dd if=*")
+    ps.deny_command("mkfs.*")
+    ps.deny_command(":(){:|:&};:")
+    ps.ask_command("sudo *")
+    ps.ask_command("chmod 777 *")
+    ps.ask_command("curl *")
+    ps.ask_command("wget *")
+    return ps

package/onecode/agent/permissions_store.py

@@ -0,0 +1,73 @@
+from __future__ import annotations
+
+from typing import Optional
+
+from onecode.agent.agents.types import AgentPermission
+
+
+class PermissionStore:
+    """Persists user-defined allow_always / reject_always overrides across
+    ``set_agent()`` calls so permissions survive mode switches.
+
+    Usage::
+
+        store = PermissionStore()
+        store.set_override("bash", AgentPermission.ALLOW)   # user said "Allow always"
+        store.set_override("edit", AgentPermission.DENY)    # user said "Reject always"
+        ...
+        store.apply_to(current_agent)                       # re-apply after set_agent
+    """
+
+    def __init__(self) -> None:
+        # perm_key → AgentPermission  (e.g. "bash" → AgentPermission.ALLOW)
+        self._overrides: dict[str, AgentPermission] = {}
+
+    def set_override(self, perm_key: str, perm: AgentPermission) -> None:
+        """Record a user override for the given permission key."""
+        self._overrides[perm_key] = perm
+
+    def get_override(self, perm_key: str) -> Optional[AgentPermission]:
+        return self._overrides.get(perm_key)
+
+    def clear_override(self, perm_key: str) -> None:
+        self._overrides.pop(perm_key, None)
+
+    def clear_all(self) -> None:
+        self._overrides.clear()
+
+    def apply_to(self, agent) -> None:
+        """Apply all recorded overrides to an AgentConfig instance.
+
+        Call this after ``set_agent()`` to restore the user's choices.
+
+        Agents with ``permissions_locked`` (e.g. PlanAgent) are skipped
+        entirely — their permission set is an intentional mode-level
+        restriction (read-only plan gate) that user overrides from other
+        modes must never bypass, including fields that happen to be ASK
+        rather than hard-DENY.
+        """
+        if getattr(agent, "permissions_locked", False):
+            return
+        for perm_key, perm in self._overrides.items():
+            attr_name = f"permission_{perm_key}"
+            if hasattr(agent, attr_name):
+                current = getattr(agent, attr_name)
+                if current == AgentPermission.DENY:
+                    continue
+                setattr(agent, attr_name, perm)
+
+    def to_dict(self) -> dict[str, str]:
+        return {k: v.value for k, v in self._overrides.items()}
+
+    @classmethod
+    def from_dict(cls, d: dict[str, str]) -> PermissionStore:
+        store = cls()
+        for k, v in d.items():
+            try:
+                store._overrides[k] = AgentPermission(v)
+            except ValueError:
+                pass
+        return store
+
+    def snapshot(self) -> dict[str, AgentPermission]:
+        return dict(self._overrides)

package/onecode/agent/project_doc.py

@@ -0,0 +1,19 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+
+def load_project_doc(workspace_root: Path) -> str:
+    """Read ``AGENTS.md`` at the project root if present.
+
+    Convention mirrors ``AGENTS.md`` / ``CLAUDE.md``: exactly one file at
+    the workspace root that all AI agents must read.  Unlike skills,
+    this is not registered — it's injected directly as project context.
+    """
+    path = workspace_root.resolve() / "AGENTS.md"
+    if not path.exists():
+        return ""
+    try:
+        return path.read_text(encoding="utf-8")
+    except Exception:
+        return ""

package/onecode/agent/question_detect.py

@@ -0,0 +1,230 @@
+"""Shared plain-text question detection for auto-AskUser conversion.
+
+Both the engine (intercepts mid-turn, before tool execution) and the ACP
+adapter (end-of-turn fallback) must agree on what counts as a question, or
+plain-text questions slip through and the user's input gets queued instead
+of becoming an AskUser dialog.
+
+Detection uses two layers:
+- Layer 1 — Semantic (intent): explicit "need user input" signals
+- Layer 2 — Syntax (punctuation): question marks as fallback
+
+Self-talk patterns are excluded (the LLM is reasoning to itself, no input
+needed).
+"""
+
+from __future__ import annotations
+
+import re
+
+# Patterns indicating the LLM explicitly needs human input
+SEMANTIC_NEEDS_INPUT = [
+    r"需要用户", r"需要您", r"需要您提供",
+    r"请确认", r"请选择", r"询问您", r"问您",
+    r"需要确认", r"需要知道", r"请告诉我",
+    r"等待您的", r"需要.*信息", r"需要哪些参数",
+    r"请提供", r"请问要", r"请问您", r"需要.*id",
+    r"哪个用户", r"哪个文件", r"什么参数", r"如何处理",
+    r"^请问",
+    r"could you (tell me|confirm|provide|let me know)",
+    r"i need to know",
+    r"please (confirm|tell me|specify|provide|select|choose)",
+    r"which .*(user|file|parameter|option|setting)",
+    r"what .*(parameter|user|file|option|setting)",
+    r"what should i",
+    r"which (file|user|option|one)",
+    r"should i (proceed|continue|upgrade|execute)",
+    r"do you want (me to|to)",
+    r"can you (tell me|confirm|specify)",
+    r"let me know (which|what|if|whether)",
+    r"i'?m not sure (which|what|who|how)",
+    r"you('d| would) like (me to|to)",
+    r"would you like (me to|to)",
+    r"(could i|may i) get (the|your)",
+    r"pick (a|an|the)",
+    r"choose (a|an|the|which)",
+    r"what'?s the (user|file|path|parameter)",
+    r"which one",
+    r"confirm the (user|file|path|parameter)",
+    r"specify (the|which|what)",
+    r"what .*(file|user|path|parameter)",
+    r"which .*should i",
+    r"(do you|would you|should i)",
+]
+
+# Patterns where SEMANTIC_NEEDS_INPUT matched but it's actually a polite
+# instruction/statement rather than a genuine question. These are LLM
+# self-talk statements of what it needs ("请告诉我错误信息" = "tell me the error"
+# as a statement of need, not a question).
+SEMANTIC_NEEDS_INPUT_EXCLUSIONS = [
+    r"请尝试后告知结果", r"请尝试", r"请告知", r"请先",
+    r"请试试", r"请按", r"请过一会儿", r"请执行",
+    r"请查看", r"请参考", r"请注意", r"请检查",
+    r"请运行", r"请输入", r"请提交", r"请刷新",
+]
+
+# Patterns indicating the LLM is just reasoning (self-talk, no input needed)
+SEMANTIC_SELF_TALK = [
+    r"^让我想想", r"^我需要先", r"^我可以先",
+    r"^首先", r"^然后", r"^接下来", r"^好的",
+    r"自言自语", r"我在想", r"我在考虑",
+    r"让我先", r"我先来", r"先执行",
+    r"^let me (think|check|read|look|find|see)",
+    r"^i('ll| will| can| should)?( be)? (checking|reading|looking|finding|seeing|thinking)",
+    r"^first(ly)?(,| )?(i('ll| will| can| should)?)?",
+    r"^then(,| )?(i('ll| will| can| should)?)?",
+    r"^next(,| )?(i('ll| will| can| should)?)?",
+    r"^okay(|,| ) (so|let me|i('ll| will| can| should)?)",
+    r"^alright(|,| ) (so|let me|i('ll| will| can| should)?)",
+    r"^sure(|,| ) (so|let me|i('ll| will| can| should)?)",
+    r"^sounds good(|,| )",
+    r"^i('ll| will| can| should)?( go ahead| start| begin| proceed| execute)",
+    r"^i('ll| will| can| should)?( need to| have to| want to) (check|read|look|find|see|think|consider|proceed|execute|verify|confirm|fix|update|change|add|remove)",
+    r"^i('m| am)( going to| about to)?",
+    r"^looks like",
+    r"^it seems (like|that)",
+    r"^based on",
+    r"^let me just",
+    r"^i('ll| will)? just (check|read|look|find|see|try)",
+    r"^i think (that )?",
+    r"^i believe (that )?",
+    r"i('m| am) thinking (about|that)",
+    r"i('m| am) considering",
+    r"^here('s| is)",
+    r"^so(,| )? i('ll| will| can| should)?",
+    r"^okay so",
+    r"i need to consider",
+]
+
+
+def semantic_needs_input(text: str) -> bool:
+    """True when the text carries an explicit "I need user input" signal.
+
+    Self-talk patterns take precedence: an LLM reasoning to itself does not
+    need the user, even if it happens to mention an input-like phrase.
+
+    Polite instruction exclusions: phrases like "请尝试后告知结果" are
+    statements of what the LLM needs, not genuine questions.
+    """
+    if not text:
+        return False
+    for pattern in SEMANTIC_SELF_TALK:
+        if re.search(pattern, text, re.IGNORECASE):
+            return False
+    for pattern in SEMANTIC_NEEDS_INPUT:
+        if re.search(pattern, text, re.IGNORECASE):
+            for excl in SEMANTIC_NEEDS_INPUT_EXCLUSIONS:
+                if re.search(excl, text, re.IGNORECASE):
+                    return False
+            return True
+    return False
+
+
+def has_trailing_question_mark(text: str) -> bool:
+    """True when the text ends with a question marker (？/CJK+?)."""
+    stripped = text.rstrip() if text else ""
+    if not stripped:
+        return False
+    if stripped.endswith("\uff1f"):
+        return True
+    if stripped.endswith("?") and len(stripped) >= 2:
+        prev = stripped[-2]
+        return "\u4e00" <= prev <= "\u9fff" or "\u3000" <= prev <= "\u303f"
+    return False
+
+
+def has_question_mark_in_last_sentence(text: str) -> bool:
+    """True when the FINAL sentence of the text contains a question mark.
+
+    This is the loose fallback: unlike checking anywhere in the output, an
+    aside or rhetorical ``?`` buried in the middle of the response does not
+    count — only a question that closes the turn does. This keeps auto-ask
+    from firing on every turn just because the LLM's prose happens to
+    contain a question mark.
+    """
+    stripped = text.rstrip() if text else ""
+    if not stripped:
+        return False
+    m = max(
+        stripped.rfind("。"), stripped.rfind("！"), stripped.rfind("？"),
+        stripped.rfind("."), stripped.rfind("!"), stripped.rfind("?"),
+        stripped.rfind("\n"),
+    )
+    tail = stripped[m + 1:] if m >= 0 else stripped
+    return "?" in tail or "？" in tail
+
+
+def looks_like_question(text: str, *, strict: bool = False) -> bool:
+    """True when the text asks the user for input.
+
+    ``strict=True`` (used when the LLM made no tool calls): the question
+    must be signalled by intent or by trailing question punctuation, so
+    ordinary prose or code containing a stray ``?`` is not misread.
+
+    ``strict=False`` (used when tool calls accompany the text): a question
+    mark in the FINAL sentence also counts, so a question followed by tool
+    execution is still intercepted — but an aside ``?`` in the middle of the
+    output does not trigger auto-ask.
+    """
+    if not text or not text.strip():
+        return False
+    if semantic_needs_input(text):
+        return True
+    if has_trailing_question_mark(text):
+        return True
+    if not strict and has_question_mark_in_last_sentence(text):
+        return True
+    return False
+
+
+# Common markdown block/emphasis markers that bloat the AskUser widget.
+# We strip these from the auto-ask question so the dialog stays compact.
+_MARKDOWN_STRIP = (
+    r"\*\*", r"__", r"`", r"```", r"\*",
+    r"^#+\s?", r"^>\s?", r"^\s*[-*+]\s+", r"^\s*\d+\.\s+",
+    r"^---\s*$", r"^\|", r"\|\s*$",
+)
+
+
+def strip_markdown(text: str) -> str:
+    """Strip common markdown syntax so question text renders cleanly."""
+    if not text:
+        return ""
+    lines = []
+    for raw in text.splitlines():
+        line = raw
+        for pat in _MARKDOWN_STRIP:
+            line = re.sub(pat, "", line)
+        lines.append(line.strip())
+    return "\n".join(lines).strip()
+
+
+def compact_question(text: str, *, max_chars: int = 240) -> str:
+    """Condense a (possibly markdown-laden) question to a compact snippet.
+
+    Used for auto-AskUser conversion so the dialog shows the trailing
+    question sentence instead of the whole preamble/plan text.
+    """
+    if not text:
+        return ""
+    clean = strip_markdown(text)
+
+    # Prefer the final sentence, anchored on CJK/Latin sentence terminators.
+    tail = ""
+    for marker in ("。", "！", "\uff1f", ". ", "! ", "? ", "\n"):
+        idx = clean.rfind(marker)
+        if idx >= 0:
+            tail = clean[idx + 1:].strip()
+            break
+    if len(tail) < 12:
+        tail = clean
+
+    if len(tail) <= max_chars:
+        return tail
+
+    # Hard truncate at a sentence boundary near the limit.
+    prefix = tail[:max_chars]
+    cut = max(prefix.rfind("。"), prefix.rfind("，"), prefix.rfind(". "), prefix.rfind(", "))
+    if cut >= max_chars * 3 // 4:
+        prefix = prefix[:cut + 1]
+    return prefix.rstrip() + "…"

package/onecode/agent/session.py

@@ -0,0 +1,3 @@
+from __future__ import annotations
+
+from cdh.session_store import AgentSession, SessionData  # noqa: F401

package/onecode/agent/snapshot.py

@@ -0,0 +1,144 @@
+from __future__ import annotations
+
+import fnmatch
+import json
+import os
+import shutil
+import tarfile
+import uuid
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Optional
+
+
+@dataclass
+class SnapshotInfo:
+    id: str
+    name: str
+    timestamp: str
+    description: str
+    size_bytes: int
+    file_count: int
+
+
+class SnapshotManager:
+    def __init__(self, base_path: Optional[Path] = None):
+        from onecode.config import ONECODE_DIR
+        self.base_path = base_path or (ONECODE_DIR / "snapshots")
+        self.base_path.mkdir(parents=True, exist_ok=True)
+
+    def create(
+        self,
+        workspace: Path,
+        name: str,
+        description: str = "",
+        exclude_patterns: Optional[list[str]] = None,
+    ) -> SnapshotInfo:
+        snapshot_id = str(uuid.uuid4())[:8]
+        snapshot_dir = self.base_path / snapshot_id
+        snapshot_dir.mkdir(parents=True, exist_ok=True)
+
+        tar_path = snapshot_dir / "snapshot.tar.gz"
+        manifest_path = snapshot_dir / "manifest.json"
+
+        exclude_patterns = exclude_patterns or [
+            ".git",
+            "node_modules",
+            "__pycache__",
+            "*.pyc",
+            ".pytest_cache",
+            ".venv",
+            "venv",
+            ".env",
+            "*.egg-info",
+            ".cdh",
+            "snapshots",
+        ]
+
+        file_count = 0
+        with tarfile.open(str(tar_path), "w:gz") as tar:
+            for root, dirs, files in os.walk(workspace):
+                dirs[:] = [d for d in dirs if not self._should_exclude(d, exclude_patterns)]
+
+                for file in files:
+                    file_path = Path(root) / file
+                    if not self._should_exclude(file_path.name, exclude_patterns):
+                        try:
+                            tar.add(str(file_path), arcname=str(file_path.relative_to(workspace)))
+                            file_count += 1
+                        except Exception:
+                            pass
+
+        size_bytes = tar_path.stat().st_size
+
+        manifest = {
+            "id": snapshot_id,
+            "name": name,
+            "description": description,
+            "timestamp": datetime.now(timezone.utc).isoformat(),
+            "workspace": str(workspace),
+            "file_count": file_count,
+            "size_bytes": size_bytes,
+        }
+        manifest_path.write_text(json.dumps(manifest, indent=2), encoding="utf-8")
+
+        return SnapshotInfo(
+            id=snapshot_id,
+            name=name,
+            timestamp=manifest["timestamp"],
+            description=description,
+            size_bytes=size_bytes,
+            file_count=file_count,
+        )
+
+    def restore(self, snapshot_id: str, target_dir: Path) -> bool:
+        snapshot_dir = self.base_path / snapshot_id
+        if not snapshot_dir.exists():
+            return False
+
+        tar_path = snapshot_dir / "snapshot.tar.gz"
+        if not tar_path.exists():
+            return False
+
+        target_dir.mkdir(parents=True, exist_ok=True)
+
+        with tarfile.open(str(tar_path), "r:gz") as tar:
+            tar.extractall(target_dir)
+
+        return True
+
+    def list(self) -> list[SnapshotInfo]:
+        snapshots = []
+        for snapshot_dir in self.base_path.iterdir():
+            if not snapshot_dir.is_dir():
+                continue
+            manifest_path = snapshot_dir / "manifest.json"
+            if not manifest_path.exists():
+                continue
+            try:
+                manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
+                snapshots.append(SnapshotInfo(
+                    id=manifest["id"],
+                    name=manifest["name"],
+                    timestamp=manifest["timestamp"],
+                    description=manifest.get("description", ""),
+                    size_bytes=manifest.get("size_bytes", 0),
+                    file_count=manifest.get("file_count", 0),
+                ))
+            except Exception:
+                continue
+        return sorted(snapshots, key=lambda s: s.timestamp, reverse=True)
+
+    def delete(self, snapshot_id: str) -> bool:
+        snapshot_dir = self.base_path / snapshot_id
+        if snapshot_dir.exists():
+            shutil.rmtree(snapshot_dir)
+            return True
+        return False
+
+    def _should_exclude(self, name: str, patterns: list[str]) -> bool:
+        for pattern in patterns:
+            if fnmatch.fnmatch(name, pattern):
+                return True
+        return False

package/onecode/agent/tools/__init__.py

@@ -0,0 +1,17 @@
+from onecode.agent.tools.file_ops import FileOps, ShellTool, ToolFactory
+from onecode.agent.tools.protocol import ToolCall, ToolResult
+from onecode.agent.tools.errors import ToolError, ToolInputError, ToolPermissionError, ToolExecutionError
+from onecode.agent.tools.registry import Tool, ToolRegistry, ToolSpec
+from onecode.agent.tools.permissions import ToolPermissionContext, PermissionResult
+from onecode.agent.tools.permission_handler import InteractivePermissionHandler, PermissionDecision, PermissionHandler
+from onecode.agent.tools.schema_validation import validate_json_schema
+
+__all__ = [
+    "FileOps", "ShellTool", "ToolFactory",
+    "ToolCall", "ToolResult",
+    "ToolError", "ToolInputError", "ToolPermissionError", "ToolExecutionError",
+    "Tool", "ToolRegistry", "ToolSpec",
+    "ToolPermissionContext", "PermissionResult",
+    "InteractivePermissionHandler", "PermissionDecision", "PermissionHandler",
+    "validate_json_schema",
+]