nolo-cli 0.1.18 → 0.1.20

package/agent-runtime/localToolPolicy.ts

@@ -0,0 +1,130 @@
+import type {
+  AgentRuntimeToolCallInput,
+  AgentRuntimeToolResult,
+} from "./types";
+
+type EnvLike = Record<string, string | undefined>;
+
+export type LocalToolPolicyDecision =
+  | { allowed: true; toolName: string }
+  | { allowed: false; toolName: string; reason: string };
+
+const NEVER_LOCAL_TOOLS = new Set([
+  "deleteSpaces",
+  "updateAgent",
+  "updateSelf",
+  "createAgent",
+]);
+
+const DEFAULT_LOCAL_TOOLS = new Set([
+  "listWorkspaceFiles",
+  "readWorkspaceFile",
+  "writeWorkspaceFile",
+  "replaceWorkspaceText",
+  "listFiles",
+  "readFile",
+  "writeFile",
+  "searchWorkspace",
+  "applyPatch",
+  "gitStatus",
+  "gitDiff",
+  "gitCreateBranch",
+  "gitAdd",
+  "gitCommit",
+  "commitWorkspace",
+  "runPackageScript",
+  "execBash",
+]);
+
+function parseToolAllowlist(value: string | undefined) {
+  return (value ?? "")
+    .split(",")
+    .map((item) => item.trim())
+    .filter(Boolean);
+}
+
+function isLocalShellModeEnabled(env: EnvLike) {
+  return ["worktree", "dangerous", "1", "true"].includes(env.NOLO_LOCAL_SHELL_MODE || "");
+}
+
+function isRestrictedLocalToolMode(env: EnvLike) {
+  return env.NOLO_LOCAL_TOOL_MODE === "restricted";
+}
+
+function isToolDeclaredOrExplicitlyFree(args: {
+  env: EnvLike;
+  agentToolNames?: string[];
+  toolName: string;
+}) {
+  return (
+    new Set(args.agentToolNames ?? []).has(args.toolName) ||
+    args.env.NOLO_LOCAL_ALLOW_UNDECLARED_TOOLS === "1"
+  );
+}
+
+export function resolveLocalToolPolicy(args: {
+  env: EnvLike;
+  agentToolNames?: string[];
+  toolName: string;
+}): LocalToolPolicyDecision {
+  const restrictedMode = isRestrictedLocalToolMode(args.env);
+  const isShellTool = args.toolName === "execShell" || args.toolName === "execBash";
+  if (isShellTool) {
+    if (isLocalShellModeEnabled(args.env)) {
+      return { allowed: true, toolName: args.toolName };
+    }
+    return {
+      allowed: false,
+      toolName: args.toolName,
+      reason: `${args.toolName} requires NOLO_LOCAL_SHELL_MODE=worktree.`,
+    };
+  }
+
+  if (NEVER_LOCAL_TOOLS.has(args.toolName)) {
+    return {
+      allowed: false,
+      toolName: args.toolName,
+      reason: `${args.toolName} is blocked by the local runtime safety policy.`,
+    };
+  }
+
+  const allowedByEnv = new Set(parseToolAllowlist(args.env.NOLO_LOCAL_ALLOWED_TOOLS));
+  const agentTools = new Set(args.agentToolNames ?? []);
+  if (!restrictedMode && agentTools.has(args.toolName)) {
+    return { allowed: true, toolName: args.toolName };
+  }
+  if (DEFAULT_LOCAL_TOOLS.has(args.toolName) && agentTools.has(args.toolName)) {
+    return { allowed: true, toolName: args.toolName };
+  }
+  if (allowedByEnv.has(args.toolName) && agentTools.has(args.toolName)) {
+    return { allowed: true, toolName: args.toolName };
+  }
+
+  return {
+    allowed: false,
+    toolName: args.toolName,
+    reason:
+      `${args.toolName} is not enabled for local runtime runs. ` +
+      "Set NOLO_LOCAL_ALLOWED_TOOLS and make sure the agent declares the tool before using it locally.",
+  };
+}
+
+export async function executeLocalToolWithPolicy(args: {
+  env: EnvLike;
+  agentToolNames?: string[];
+  call: AgentRuntimeToolCallInput;
+  executors?: Record<string, (call: AgentRuntimeToolCallInput) => Promise<AgentRuntimeToolResult>>;
+}): Promise<AgentRuntimeToolResult> {
+  const decision = resolveLocalToolPolicy({
+    env: args.env,
+    agentToolNames: args.agentToolNames,
+    toolName: args.call.name,
+  });
+  if (!decision.allowed) throw new Error(decision.reason);
+
+  const executor = args.executors?.[args.call.name];
+  if (!executor) {
+    throw new Error(`${args.call.name} is allowed by policy but no local executor is registered.`);
+  }
+  return executor(args.call);
+}