patchwork-os 1.1.0-beta.4.canary.444 → 1.1.0-beta.4.canary.445
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -13,38 +13,55 @@
|
|
|
13
13
|
* (keeps cost-routing quotes in parity with actual reconcile billing).
|
|
14
14
|
*/
|
|
15
15
|
export const DEFAULT_MODEL = "claude-haiku-4-5-20251001";
|
|
16
|
-
|
|
17
|
-
* Will `executeAgent` route this call to the subprocess (`claude -p`) driver —
|
|
18
|
-
* the ONLY driver that enforces `--disallowed-tools`? Mirrors the dispatch in
|
|
19
|
-
* `executeAgent` exactly (explicit driver, then pwCfg, then auto-detect) so the
|
|
20
|
-
* worker-sandbox guard agrees with where the call actually lands. `probeClaudeCli`
|
|
21
|
-
* / `loadPatchworkConfig` are cheap + idempotent, so calling them here too is fine.
|
|
22
|
-
*/
|
|
23
|
-
function resolvesToSubprocessDriver(driver, deps) {
|
|
16
|
+
function resolveSandboxEnforcement(driver, deps) {
|
|
24
17
|
if (driver === "subprocess" || driver === "claude-code")
|
|
25
|
-
return
|
|
18
|
+
return "granular";
|
|
19
|
+
if (driver === "codex")
|
|
20
|
+
return "codex-lockdown";
|
|
26
21
|
if (driver !== undefined)
|
|
27
|
-
return
|
|
22
|
+
return "none"; // anthropic/claude/openai/grok/gemini*/local
|
|
28
23
|
const pwCfg = deps.loadPatchworkConfig();
|
|
29
24
|
if (pwCfg.model === "local")
|
|
30
|
-
return
|
|
25
|
+
return "none";
|
|
31
26
|
if (pwCfg.driver === "subprocess" || pwCfg.driver === "claude-code")
|
|
32
|
-
return
|
|
27
|
+
return "granular";
|
|
33
28
|
if (process.env.ANTHROPIC_API_KEY)
|
|
34
|
-
return
|
|
35
|
-
return deps.probeClaudeCli(); // CLI present → subprocess; else falls back to API
|
|
29
|
+
return "none"; // auto-detect → anthropic API
|
|
30
|
+
return deps.probeClaudeCli() ? "granular" : "none"; // CLI present → subprocess; else falls back to API
|
|
36
31
|
}
|
|
32
|
+
/**
|
|
33
|
+
* CodexDriver's coarsest lockdown — read-only filesystem, no network, no
|
|
34
|
+
* interactive approval escalation (see src/drivers/codex/subprocess.ts's
|
|
35
|
+
* SandboxMode/ApprovalMode). This is the ONLY translation available for a
|
|
36
|
+
* worker-mandated tool sandbox on the codex driver: Codex has no per-tool
|
|
37
|
+
* `--disallowed-tools` equivalent, so we cannot allow-list individual tools
|
|
38
|
+
* the way the subprocess driver does. Strictly safer than the granular
|
|
39
|
+
* sandbox (blocks everything it would ALSO block, plus more) at the cost of
|
|
40
|
+
* blocking some tools the granular sandbox would still permit (harmless
|
|
41
|
+
* reads). Deliberately OVERRIDES — never merges with — whatever
|
|
42
|
+
* providerOptions the step itself requested: a worker-owned step must never
|
|
43
|
+
* be able to negotiate its own escape hatch (e.g. `danger-full-access`) out
|
|
44
|
+
* from under the gate.
|
|
45
|
+
*/
|
|
46
|
+
const CODEX_WORKER_SANDBOX_LOCKDOWN = {
|
|
47
|
+
sandboxMode: "read-only",
|
|
48
|
+
approvalMode: "never",
|
|
49
|
+
networkAccess: false,
|
|
50
|
+
webSearch: false,
|
|
51
|
+
};
|
|
37
52
|
export async function executeAgent(input, deps) {
|
|
38
53
|
const { prompt, driver, model, mcpAccess, sandbox, allowedTools, disallowedTools, providerOptions, enforceSandbox, } = input;
|
|
39
|
-
// NEVER-WIDEN guard. A worker-mandated sandbox is enforceable only on
|
|
40
|
-
//
|
|
41
|
-
// the worker's agent step could perform exactly the risky
|
|
42
|
-
// believed it sandboxed. Fail closed: refuse to run rather than
|
|
43
|
-
// The "[agent step failed:" prefix is the marker the runners
|
|
44
|
-
// step failure (halting non-optional steps), so the agent
|
|
45
|
-
|
|
54
|
+
// NEVER-WIDEN guard. A worker-mandated sandbox is enforceable only on drivers
|
|
55
|
+
// resolveSandboxEnforcement recognizes; on any other driver the deny list is
|
|
56
|
+
// silently dropped and the worker's agent step could perform exactly the risky
|
|
57
|
+
// action the gate believed it sandboxed. Fail closed: refuse to run rather than
|
|
58
|
+
// run un-gated. The "[agent step failed:" prefix is the marker the runners
|
|
59
|
+
// already treat as a step failure (halting non-optional steps), so the agent
|
|
60
|
+
// never executes.
|
|
61
|
+
const sandboxEnforcement = resolveSandboxEnforcement(driver, deps);
|
|
62
|
+
if (enforceSandbox && sandboxEnforcement === "none") {
|
|
46
63
|
return {
|
|
47
|
-
text: "[agent step failed: worker autonomy requires the subprocess driver to enforce its tool sandbox — set the agent step (or recipe) driver to `subprocess`/`claude-code`; refusing to run un-sandboxed]",
|
|
64
|
+
text: "[agent step failed: worker autonomy requires the subprocess or codex driver to enforce its tool sandbox — set the agent step (or recipe) driver to `subprocess`/`claude-code`/`codex`; refusing to run un-sandboxed]",
|
|
48
65
|
servedBy: { driver: driver ?? "auto" },
|
|
49
66
|
};
|
|
50
67
|
}
|
|
@@ -84,11 +101,16 @@ export async function executeAgent(input, deps) {
|
|
|
84
101
|
driver === "gemini" ||
|
|
85
102
|
driver === "gemini-api" ||
|
|
86
103
|
driver === "codex") {
|
|
104
|
+
// A worker-mandated sandbox on the codex driver overrides — never merges
|
|
105
|
+
// with — the step's own providerOptions. See CODEX_WORKER_SANDBOX_LOCKDOWN.
|
|
106
|
+
const effectiveProviderOptions = driver === "codex" && enforceSandbox
|
|
107
|
+
? CODEX_WORKER_SANDBOX_LOCKDOWN
|
|
108
|
+
: providerOptions;
|
|
87
109
|
return stamp(driver, model,
|
|
88
110
|
// Only pass the 4th arg when set so the common (unconstrained) call keeps
|
|
89
111
|
// its 3-arg shape — backward-compatible with callers/mocks.
|
|
90
|
-
|
|
91
|
-
? deps.providerDriverFn(driver, prompt, model,
|
|
112
|
+
effectiveProviderOptions
|
|
113
|
+
? deps.providerDriverFn(driver, prompt, model, effectiveProviderOptions)
|
|
92
114
|
: deps.providerDriverFn(driver, prompt, model));
|
|
93
115
|
}
|
|
94
116
|
if (driver === "subprocess" || driver === "claude-code") {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"agentExecutor.js","sourceRoot":"","sources":["../../src/recipes/agentExecutor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAkGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,2BAA2B,CAAC;
|
|
1
|
+
{"version":3,"file":"agentExecutor.js","sourceRoot":"","sources":["../../src/recipes/agentExecutor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAkGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAoBzD,SAAS,yBAAyB,CAChC,MAA0B,EAC1B,IAAuB;IAEvB,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO,UAAU,CAAC;IAC3E,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,gBAAgB,CAAC;IAChD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,CAAC,6CAA6C;IACtF,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;IACzC,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa;QACjE,OAAO,UAAU,CAAC;IACpB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAAE,OAAO,MAAM,CAAC,CAAC,8BAA8B;IAChF,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,mDAAmD;AACzG,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,6BAA6B,GAA4B;IAC7D,WAAW,EAAE,WAAW;IACxB,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,SAAS,EAAE,KAAK;CACjB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAyB,EACzB,IAAuB;IAEvB,MAAM,EACJ,MAAM,EACN,MAAM,EACN,KAAK,EACL,SAAS,EACT,OAAO,EACP,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,GACf,GAAG,KAAK,CAAC;IAEV,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,gFAAgF;IAChF,2EAA2E;IAC3E,6EAA6E;IAC7E,kBAAkB;IAClB,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,cAAc,IAAI,kBAAkB,KAAK,MAAM,EAAE,CAAC;QACpD,OAAO;YACL,IAAI,EAAE,sNAAsN;YAC5N,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,IAAI,MAAM,EAAE;SACvC,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GACX,SAAS,KAAK,SAAS;QACvB,OAAO,KAAK,SAAS;QACrB,YAAY,KAAK,SAAS;QAC1B,eAAe,KAAK,SAAS;QAC3B,CAAC,CAAC;YACE,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;YAC7C,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;YACzC,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC;YACnD,GAAG,CAAC,eAAe,KAAK,SAAS,IAAI,EAAE,eAAe,EAAE,CAAC;SAC1D;QACH,CAAC,CAAC,SAAS,CAAC;IAEhB,yEAAyE;IACzE,wEAAwE;IACxE,oEAAoE;IACpE,qEAAqE;IACrE,0EAA0E;IAC1E,MAAM,KAAK,GAAG,KAAK,EACjB,cAAsB,EACtB,aAAiC,EACjC,CAAuB,EACD,EAAE;QACxB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;QAClB,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC;QACzB,OAAO;YACL,GAAG,CAAC;YACJ,QAAQ,EAAE;gBACR,MAAM,EAAE,cAAc;gBACtB,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,KAAK,CACV,WAAW,EACX,KAAK,IAAI,aAAa,EACtB,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,IAAI,aAAa,CAAC,CACjD,CAAC;IACJ,CAAC;IACD,IACE,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,MAAM;QACjB,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,YAAY;QACvB,MAAM,KAAK,OAAO,EAClB,CAAC;QACD,yEAAyE;QACzE,4EAA4E;QAC5E,MAAM,wBAAwB,GAC5B,MAAM,KAAK,OAAO,IAAI,cAAc;YAClC,CAAC,CAAC,6BAA6B;YAC/B,CAAC,CAAC,eAAe,CAAC;QACtB,OAAO,KAAK,CACV,MAAM,EACN,KAAK;QACL,0EAA0E;QAC1E,4DAA4D;QAC5D,wBAAwB;YACtB,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,wBAAwB,CAAC;YACxE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CACjD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,KAAK,CACV,OAAO,EACP,KAAK,IAAI,aAAa,EACtB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,aAAa,CAAC,CAC7C,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,GAAG,CAAC,CAAC;IACjD,CAAC;IAED,2EAA2E;IAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;IACzC,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO,KAAK,CACV,OAAO,EACP,KAAK,IAAI,aAAa,EACtB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,aAAa,CAAC,CAC7C,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QACpE,OAAO,KAAK,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,+DAA+D;IAC/D,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QAClC,OAAO,KAAK,CACV,WAAW,EACX,KAAK,IAAI,aAAa,EACtB,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,IAAI,aAAa,CAAC,CACjD,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,uEAAuE;IACvE,6EAA6E;IAC7E,+DAA+D;IAC/D,OAAO,KAAK,CACV,WAAW,EACX,KAAK,IAAI,aAAa,EACtB,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,IAAI,aAAa,CAAC,CACjD,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "patchwork-os",
|
|
3
|
-
"version": "1.1.0-beta.4.canary.
|
|
3
|
+
"version": "1.1.0-beta.4.canary.445",
|
|
4
4
|
"description": "Your personal AI runtime, local-first. Patchwork OS gives any AI model a consistent set of tools, YAML recipes, a delegation policy with approval queue, and a durable trace memory — all on your machine, all under your policy.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "dist/index.js",
|