AbstractAgent 0.3.17__tar.gz → 0.3.18__tar.gz

{abstractagent-0.3.17/src/abstractagent.egg-info → abstractagent-0.3.18}/PKG-INFO

@@ -1,17 +1,17 @@
 Metadata-Version: 2.4
 Name: abstractagent
-Version: 0.3.17
+Version: 0.3.18
 Summary: Agent implementations using AbstractRuntime and AbstractCore
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: abstractcore[tools]>=2.13.41
+Requires-Dist: abstractcore[tools]>=2.25.0
 Requires-Dist: abstractruntime>=0.7.0
 Provides-Extra: apple
-Requires-Dist: abstractcore[all-apple]>=2.13.41; extra == "apple"
+Requires-Dist: abstractcore[all-apple]>=2.25.0; extra == "apple"
 Requires-Dist: abstractruntime[apple]>=0.7.0; extra == "apple"
 Provides-Extra: gpu
-Requires-Dist: abstractcore[all-gpu]>=2.13.41; extra == "gpu"
+Requires-Dist: abstractcore[all-gpu]>=2.25.0; extra == "gpu"
 Requires-Dist: abstractruntime[gpu]>=0.7.0; extra == "gpu"
 Provides-Extra: dev
 Requires-Dist: pytest>=7.0; extra == "dev"

{abstractagent-0.3.17 → abstractagent-0.3.18}/pyproject.toml

@@ -4,22 +4,22 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "abstractagent"
-version = "0.3.17"
+version = "0.3.18"
 description = "Agent implementations using AbstractRuntime and AbstractCore"
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
-    "abstractcore[tools]>=2.13.41",
+    "abstractcore[tools]>=2.25.0",
     "abstractruntime>=0.7.0",
 ]
 
 [project.optional-dependencies]
 apple = [
-    "abstractcore[all-apple]>=2.13.41",
+    "abstractcore[all-apple]>=2.25.0",
     "abstractruntime[apple]>=0.7.0",
 ]
 gpu = [
-    "abstractcore[all-gpu]>=2.13.41",
+    "abstractcore[all-gpu]>=2.25.0",
     "abstractruntime[gpu]>=0.7.0",
 ]
 dev = [

{abstractagent-0.3.17 → abstractagent-0.3.18}/src/abstractagent/sandbox/local.py

@@ -11,7 +11,7 @@ import os
 import subprocess
 import sys
 import time
-from typing import Optional
+from typing import Any, Optional
 
 from .interface import ExecutionResult
 
@@ -22,9 +22,14 @@ class LocalSandbox:
         *,
         cwd: Optional[str] = None,
         python_executable: Optional[str] = None,
+        command_sandbox: Any = None,
     ):
+        """`command_sandbox`: an AbstractCore `abstractcore.tools.sandbox.Sandbox` (round 12). When
+        given, the interpreter runs inside it (OS sandbox bound to the run's workspaces, the host's
+        scrubbed environment, a private TMPDIR); the caller refuses before when it `refuses`."""
         self._cwd = cwd or os.getcwd()
         self._python = python_executable or sys.executable
+        self._command_sandbox = command_sandbox
 
     def reset(self) -> None:
         # Stateless sandbox (new subprocess per call).
@@ -47,10 +52,19 @@ class LocalSandbox:
             except (TypeError, ValueError):
                 t = 0.0
             eff_timeout = t if t > 0 else None
+        argv = [self._python, "-c", code]
+        env = None
+        box = self._command_sandbox
+        if box is not None:
+            if box.kind == "unsandboxed":
+                env = box.env_for()
+            else:
+                argv, env = box.wrap(argv, self._cwd)
         try:
             completed = subprocess.run(
-                [self._python, "-c", code],
+                argv,
                 cwd=self._cwd,
+                env=env,
                 capture_output=True,
                 text=True,
                 timeout=eff_timeout,

{abstractagent-0.3.17 → abstractagent-0.3.18}/src/abstractagent/tools/code_execution.py

@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+from typing import Optional
+
 from abstractcore.tools import tool
 
 
@@ -25,16 +27,30 @@ def _bound_output(text: str, *, max_chars: int) -> str:
     )
 
 
+# Round 12: the one sentence when the installed AbstractCore has no command sandbox.
+NO_CORE_SANDBOX = (
+    "Commands are refused: the installed AbstractCore has no command sandbox "
+    "(abstractcore.tools.sandbox, AbstractCore 2.25.0 or newer)."
+)
+
+
 @tool(
     name="execute_python",
-    description="Execute a Python snippet in a subprocess sandbox. Returns stdout/stderr/exit_code in full.",
+    description="Execute a Python snippet in a subprocess, sandboxed to this run's workspaces. Returns stdout/stderr/exit_code in full.",
     when_to_use="When you need to compute, inspect files, or transform data using Python code",
+    # Stamped by the host (AbstractRuntime) with the run's workspace set; never model-facing.
+    hide_args=["_sandbox"],
 )
-def execute_python(code: str, timeout_s: float = 0.0, max_output_chars: int = 0) -> dict:
+def execute_python(code: str, timeout_s: float = 0.0, max_output_chars: int = 0, _sandbox: Optional[dict] = None) -> dict:
     """Execute Python code in a local subprocess.
 
     Notes:
-    - This is a dev sandbox. It is not a hardened security boundary.
+    - Round 12: when the host stamps `_sandbox` (the run's effective workspace set), the
+      interpreter runs inside AbstractCore's OS sandbox (macOS sandbox-exec, Linux bwrap/Landlock),
+      starting in the run's private workspace with the host's scrubbed environment. No sandbox
+      on the host (or an AbstractCore without one) = refused (`error` carries the sentence,
+      nothing runs). A host that configured AbstractCore's command policy refuses an unstamped
+      call. Library use without a host policy runs as before.
     - `timeout_s <= 0` (the default) means NO timeout (ADR-0027: no low default
       timeouts on correctness-critical paths — a 10s default silently killed
       legitimate long computations and reported them as errors). Pass a positive
@@ -48,7 +64,24 @@ def execute_python(code: str, timeout_s: float = 0.0, max_output_chars: int = 0)
 
     from ..sandbox.local import LocalSandbox
 
-    sandbox = LocalSandbox()
+    try:
+        from abstractcore.tools import sandbox as core_sandbox
+    except ImportError:
+        return {"stdout": "", "stderr": "", "exit_code": 126, "duration_ms": 0.0, "error": NO_CORE_SANDBOX, "success": False}
+    box = core_sandbox.sandbox_for_tool_call(_sandbox)
+    if box.refuses:
+        return {
+            "stdout": "",
+            "stderr": "",
+            "exit_code": 126,
+            "duration_ms": 0.0,
+            "error": box.refusal(),
+            "success": False,
+            "sandbox": box.describe(),
+            "sandbox_line": box.rendered_line(),
+        }
+    bound = box if (box.spec is not None or box.kind != core_sandbox.KIND_UNSANDBOXED) else None
+    sandbox = LocalSandbox(cwd=box.spec.private_workspace if box.spec is not None else None, command_sandbox=bound)
     #[WARNING:TIMEOUT] caller-supplied only; <= 0 = unlimited (ADR-0027)
     timeout = float(timeout_s)
     result = sandbox.execute(code, timeout_s=timeout if timeout > 0 else None)
@@ -56,11 +89,15 @@ def execute_python(code: str, timeout_s: float = 0.0, max_output_chars: int = 0)
         cap = int(max_output_chars)
     except (TypeError, ValueError):
         cap = 0
-    return {
+    out = {
         "stdout": _bound_output(result.stdout, max_chars=cap),
         "stderr": _bound_output(result.stderr, max_chars=cap),
         "exit_code": int(result.exit_code),
         "duration_ms": float(result.duration_ms),
         "error": result.error,
     }
+    if bound is not None:
+        out["sandbox"] = bound.describe()
+        out["sandbox_line"] = bound.rendered_line()
+    return out
 

{abstractagent-0.3.17 → abstractagent-0.3.18/src/abstractagent.egg-info}/PKG-INFO

@@ -1,17 +1,17 @@
 Metadata-Version: 2.4
 Name: abstractagent
-Version: 0.3.17
+Version: 0.3.18
 Summary: Agent implementations using AbstractRuntime and AbstractCore
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: abstractcore[tools]>=2.13.41
+Requires-Dist: abstractcore[tools]>=2.25.0
 Requires-Dist: abstractruntime>=0.7.0
 Provides-Extra: apple
-Requires-Dist: abstractcore[all-apple]>=2.13.41; extra == "apple"
+Requires-Dist: abstractcore[all-apple]>=2.25.0; extra == "apple"
 Requires-Dist: abstractruntime[apple]>=0.7.0; extra == "apple"
 Provides-Extra: gpu
-Requires-Dist: abstractcore[all-gpu]>=2.13.41; extra == "gpu"
+Requires-Dist: abstractcore[all-gpu]>=2.25.0; extra == "gpu"
 Requires-Dist: abstractruntime[gpu]>=0.7.0; extra == "gpu"
 Provides-Extra: dev
 Requires-Dist: pytest>=7.0; extra == "dev"

{abstractagent-0.3.17 → abstractagent-0.3.18}/src/abstractagent.egg-info/SOURCES.txt

@@ -63,6 +63,7 @@ tests/test_codeact_logic.py
 tests/test_codeact_runtime_verifier_policy.py
 tests/test_delegate_session_route_composition.py
 tests/test_emit_inventory_drift.py
+tests/test_execute_python_sandbox.py
 tests/test_gated_remainder_wave_2026_07_14.py
 tests/test_generation_params_media_policies.py
 tests/test_history_monster_clamp.py

{abstractagent-0.3.17 → abstractagent-0.3.18}/src/abstractagent.egg-info/requires.txt

@@ -1,15 +1,15 @@
-abstractcore[tools]>=2.13.41
+abstractcore[tools]>=2.25.0
 abstractruntime>=0.7.0
 
 [apple]
-abstractcore[all-apple]>=2.13.41
+abstractcore[all-apple]>=2.25.0
 abstractruntime[apple]>=0.7.0
 
 [dev]
 pytest>=7.0
 
 [gpu]
-abstractcore[all-gpu]>=2.13.41
+abstractcore[all-gpu]>=2.25.0
 abstractruntime[gpu]>=0.7.0
 
 [test]

abstractagent-0.3.18/tests/test_execute_python_sandbox.py

@@ -0,0 +1,121 @@
+"""Round 12: execute_python runs inside AbstractCore's OS command sandbox.
+
+Real macOS tests (sandbox-exec) with scratch folders and markers; the runtime path
+(AbstractRuntime stamps `_sandbox` on the CodeAct tool call) is exercised end to end."""
+
+from __future__ import annotations
+
+import os
+import sys
+from pathlib import Path
+
+import pytest
+
+from abstractcore.tools import sandbox as core_sandbox
+from abstractcore.tools.sandbox import SandboxRow, SandboxSpec
+
+from abstractagent.tools.code_execution import NO_CORE_SANDBOX, execute_python
+
+MARK = "R12-AGENT-REFUSED-MARKER"
+
+macos_only = pytest.mark.skipif(
+    sys.platform != "darwin" or not os.access(core_sandbox.SANDBOX_EXEC, os.X_OK),
+    reason="real sandbox test: this host is not macOS with /usr/bin/sandbox-exec (Linux backends are tested in abstractcore)",
+)
+
+
+@pytest.fixture(autouse=True)
+def _fresh_host():
+    core_sandbox._reset_host_for_tests()
+    yield
+    core_sandbox._reset_host_for_tests()
+
+
+@pytest.fixture
+def t(tmp_path, monkeypatch):
+    root = Path(os.path.realpath(tmp_path))
+    for d in ("home", "priv", "refused", "rw"):
+        (root / d).mkdir()
+    (root / "refused/secret.txt").write_text(MARK)
+    monkeypatch.setenv("HOME", str(root / "home"))
+    return root
+
+
+def _stamp(t: Path, refused=True):
+    return SandboxSpec(
+        private_workspace=str(t / "priv"),
+        posture="any_except_denied",
+        allowed=(SandboxRow(str(t / "rw"), "rw"),),
+        refused=(str(t / "refused"),) if refused else (),
+    ).to_stamp()
+
+
+def test_sandbox_arg_is_hidden_from_the_model():
+    assert "_sandbox" not in execute_python._tool_definition.parameters
+
+
+@macos_only
+def test_refused_path_is_unreadable_from_python(t):
+    code = f"print(open({str(t / 'refused/secret.txt')!r}).read())"
+    res = execute_python(code, _sandbox=_stamp(t))
+    assert MARK not in res["stdout"] and res["exit_code"] != 0
+    assert "Operation not permitted" in res["stderr"]
+    assert res["sandbox"]["kind"] == "macos-sandbox-exec" and res["sandbox_line"] == "Sandbox: macOS sandbox-exec"
+    ok = execute_python(code, _sandbox=_stamp(t, refused=False))
+    assert MARK in ok["stdout"]  # positive control
+
+
+@macos_only
+def test_starts_in_the_private_workspace_with_a_private_tmpdir(t):
+    res = execute_python("import os,tempfile;open('w.txt','w').write('x');print(os.getcwd());print(tempfile.gettempdir())", _sandbox=_stamp(t))
+    assert res["stdout"].split() == [str(t / "priv"), str(t / "priv/.tmp")]
+    assert (t / "priv/w.txt").exists()
+
+
+def test_fail_closed_without_a_sandbox(t, monkeypatch):
+    monkeypatch.setattr(core_sandbox, "host_sandbox_kind", lambda posture="allowed_only": core_sandbox.KIND_NONE)
+    res = execute_python(f"open({str(t / 'priv/ran')!r},'w')", _sandbox=_stamp(t))
+    assert res["success"] is False and res["error"].startswith("Commands are not sandboxed on this gateway host")
+    assert not (t / "priv/ran").exists()
+
+
+def test_fail_closed_without_core_sandbox_module(t, monkeypatch):
+    import abstractcore.tools as core_tools
+
+    monkeypatch.setitem(sys.modules, "abstractcore.tools.sandbox", None)
+    monkeypatch.delattr(core_tools, "sandbox", raising=False)
+    res = execute_python(f"open({str(t / 'priv/ran')!r},'w')", _sandbox=_stamp(t))
+    assert res["success"] is False and res["error"] == NO_CORE_SANDBOX
+    assert not (t / "priv/ran").exists()
+
+
+def test_configured_host_refuses_unstamped_call(t):
+    core_sandbox.configure_host(env={"PATH": "/usr/bin:/bin"})
+    res = execute_python(f"open({str(t / 'priv/ran')!r},'w')")
+    assert res["success"] is False and res["error"] == core_sandbox.REFUSED_NO_SPEC
+    assert not (t / "priv/ran").exists()
+
+
+@macos_only
+def test_codeact_tool_call_through_the_runtime_is_sandboxed(t):
+    """A CodeAct-style TOOL_CALLS effect: the runtime stamps the run's workspaces on
+    execute_python; reading a refused workspace fails inside the sandbox."""
+    from abstractruntime.core.models import Effect, EffectType, RunState
+    from abstractruntime.integrations.abstractcore.effect_handlers import make_tool_calls_handler
+    from abstractruntime.integrations.abstractcore.tool_executor import MappingToolExecutor
+
+    handler = make_tool_calls_handler(tools=MappingToolExecutor.from_tools([execute_python]))
+    run_vars = {
+        "workspace_root": str(t / "priv"),
+        "workspace_access_mode": "all_except_ignored",
+        "workspace_allowed_paths": [str(t / "rw")],
+        "workspace_ignored_paths": str(t / "refused"),
+    }
+    run = RunState.new(workflow_id="wf", entry_node="n", session_id="s", vars=run_vars)
+    code = f"print(open({str(t / 'refused/secret.txt')!r}).read())"
+    effect = Effect(type=EffectType.TOOL_CALLS, payload={"tool_calls": [{"call_id": "c1", "name": "execute_python", "arguments": {"code": code, "_sandbox": {"private_workspace": "/", "posture": "any_except_denied"}}}]})
+    outcome = handler(run, effect, None)
+    res = outcome.result["results"][0]
+    out = res["output"]
+    assert MARK not in str(out)
+    assert out["sandbox"]["kind"] == "macos-sandbox-exec" and out["sandbox"]["refused"] == [str(t / "refused")]

{abstractagent-0.3.17 → abstractagent-0.3.18}/tests/test_packaging_profiles.py

@@ -18,7 +18,7 @@ def _project() -> dict:
 def test_base_dependency_floors_match_gateway_alignment() -> None:
     deps = set(_project()["dependencies"])
 
-    assert "abstractcore[tools]>=2.13.41" in deps
+    assert "abstractcore[tools]>=2.25.0" in deps
     assert "abstractruntime>=0.7.0" in deps
 
 
@@ -26,11 +26,11 @@ def test_hardware_profile_extras_are_core_runtime_cascades() -> None:
     extras = _project()["optional-dependencies"]
 
     assert set(extras["apple"]) == {
-        "abstractcore[all-apple]>=2.13.41",
+        "abstractcore[all-apple]>=2.25.0",
         "abstractruntime[apple]>=0.7.0",
     }
     assert set(extras["gpu"]) == {
-        "abstractcore[all-gpu]>=2.13.41",
+        "abstractcore[all-gpu]>=2.25.0",
         "abstractruntime[gpu]>=0.7.0",
     }
     assert "all-apple" not in extras