agent-framework-lib 0.8.8.post6__tar.gz → 0.8.8.post8__tar.gz

{agent_framework_lib-0.8.8.post6/agent_framework_lib.egg-info → agent_framework_lib-0.8.8.post8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-framework-lib
-Version: 0.8.8.post6
+Version: 0.8.8.post8
 Summary: A comprehensive Python framework for building and serving conversational AI agents with FastAPI
 Author-email: Sebastian Pavel <sebastian@cinco.ai>, Elliott Girard <elliott.girard@icloud.com>
 Maintainer-email: Sebastian Pavel <sebastian@cinco.ai>

{agent_framework_lib-0.8.8.post6 → agent_framework_lib-0.8.8.post8}/agent_framework/security/sandbox_provider.py

@@ -491,24 +491,14 @@ class OpenShellProvider(SandboxProvider):
             )
         else:
             logger.info("[sandbox] pulled %d file(s) from %s for %s", pulled, src, name)
-        # Best-effort: remove the per-command subdir so a long-lived session does
-        # not accumulate output slices in /sandbox/output.
-        if out_subdir:
-            with contextlib.suppress(Exception):
-                self._run_cli(
-                    [
-                        "sandbox",
-                        "exec",
-                        "-n",
-                        name,
-                        "--no-tty",
-                        "--",
-                        "/bin/sh",
-                        "-c",
-                        f"rm -rf {src}",
-                    ],
-                    timeout=30,
-                )
+        # Do NOT delete the per-command subdir after collecting: multi-step
+        # workflows reuse earlier artifacts BY PATH inside the sandbox (e.g. the
+        # chart skill emits chart.png and the pdf skill embeds it as <img src>
+        # in a LATER command — deleting the slice here stripped the images from
+        # the PDFs). Per-command isolation only requires that each finalizer
+        # download its OWN slice (out_subdir), which still holds. The whole
+        # sandbox (and its accumulated output) is removed at session close /
+        # idle-reap, so slices never outlive the session.
 
     def close_session(self, session_id: str) -> None:
         self._delete_by_name(self._name(session_id))

{agent_framework_lib-0.8.8.post6 → agent_framework_lib-0.8.8.post8}/agent_framework/skills/builtin/scripts/create_and_register.py

@@ -117,7 +117,14 @@ def _verify_file(filepath: str) -> None:
 
 
 def _upload_file(filepath: str) -> dict:
-    """Upload the file to the Storage API and return the response dict."""
+    """Upload the file to the Storage API. NEVER fatal.
+
+    Returns the server response dict on success, or {} on ANY failure — the
+    parent ShellTool finalizer then delivers the file from AGENT_OUTPUT_DIR
+    (collect_out). A failed upload must not exit non-zero: that derailed the
+    agent into improvising its own (wrong) delivery, which was worse than just
+    letting the finalizer do its job.
+    """
     user_id = os.environ.get("AGENT_USER_ID", "default_user")
     session_id = os.environ.get("AGENT_SESSION_ID", "")
     host = os.environ.get("AGENT_HOST", "localhost")
@@ -141,12 +148,13 @@ def _upload_file(filepath: str) -> dict:
     try:
         with urllib.request.urlopen(req, timeout=30) as resp:
             return json.loads(resp.read().decode("utf-8"))
-    except urllib.error.HTTPError as e:
-        err = e.read().decode("utf-8", errors="replace")
-        _emit_error(f"Server {e.code}: {err}")
-    except urllib.error.URLError as e:
-        _emit_error(f"Cannot connect to server at http://{host}:{port}: {e.reason}")
-    return {}  # unreachable, but satisfies type checker
+    except Exception as e:  # noqa: BLE001 — soft-fail: finalizer delivers instead
+        print(
+            f"[create_and_register] direct upload failed ({e}); "
+            "falling back to automatic delivery by the framework",
+            file=sys.stderr,
+        )
+        return {}
 
 
 def _cleanup(filepath: str) -> bool:
@@ -183,11 +191,13 @@ def main() -> None:
 
     _verify_file(filepath)
 
-    # Delivery is the ShellTool parent finalizer's job (it has network + creds; the
-    # sandbox does not). The in-shell HTTP upload is OFF by default and never runs
-    # in the sandbox: it derails the agent (401 on an unreachable target) and a
-    # printed file_id makes the finalizer skip the file. Opt in explicitly with
-    # AGENT_SKILL_HTTP_UPLOAD=1 for legacy/local non-finalizer flows only.
+    # Delivery is belt-and-braces. PRIMARY: a direct upload to the agent's
+    # callback endpoint when AGENT_SKILL_HTTP_UPLOAD is set (the framework sets
+    # it in the sandbox when the callback port is published) — on success the
+    # download link is immediate. FALLBACK: the upload soft-fails (returns {})
+    # and the parent ShellTool finalizer delivers the file from AGENT_OUTPUT_DIR.
+    # Either way this script exits 0 with a clear success — the agent must never
+    # be tempted to improvise its own delivery.
     do_upload = os.environ.get("AGENT_SKILL_HTTP_UPLOAD", "").lower() in ("1", "true", "yes")
     upload_result = _upload_file(filepath) if do_upload else {}
 
@@ -213,9 +223,9 @@ def main() -> None:
         "filename": os.path.basename(filepath),
         "mime_type": mime,
         "local_cleaned": local_cleaned,
-        # The file is created; the framework delivers it to storage automatically
-        # and appends the download link to this command's result. The agent must
-        # NOT try to upload or authenticate.
+        # Whether the direct upload succeeded or the parent finalizer delivers,
+        # the file ALWAYS reaches storage. The agent must NOT try to upload or
+        # authenticate anything itself.
         "delivery": "automatic",
         "message": (
             f"File '{os.path.basename(filepath)}' created successfully and is being "
@@ -223,11 +233,16 @@ def main() -> None:
             "command's result. Do not upload or authenticate."
         ),
     }
-    # Surface storage fields ONLY when an explicit upload actually happened.
-    if upload_result:
+    # Direct upload succeeded → surface the storage fields right away (the
+    # finalizer sees the file_id in stdout and will not re-register the file).
+    if upload_result.get("file_id"):
         output["file_id"] = upload_result.get("file_id", "")
         output["download_url"] = upload_result.get("download_url", "")
         output["size_bytes"] = upload_result.get("size_bytes", 0)
+        output["message"] = (
+            f"File '{os.path.basename(filepath)}' created and stored — "
+            f"download link: {output['download_url']}"
+        )
     print(json.dumps(output))
 
 

{agent_framework_lib-0.8.8.post6 → agent_framework_lib-0.8.8.post8}/agent_framework/tools/shell_tool.py

@@ -276,18 +276,24 @@ class ShellTool(AgentTool):
     )
 
     def _workspace_secrets_to_inject(self, skill_env_keys: set[str]) -> dict[str, str]:
-        """Workspace secrets to expose for this call (just-in-time).
-
-        Only secrets a currently loaded skill declares it needs (``requires_env``)
-        are exposed, so the default sandbox holds none. The legacy blanket
-        behavior is available via ``SHELL_INJECT_ALL_WORKSPACE_SECRETS=true``.
+        """Workspace secrets to expose for this call.
+
+        ALL workspace secrets are injected by default: a workspace exists
+        precisely so the user can hand the agent secrets it must be able to USE
+        in the shell — gating them behind a skill's ``requires_env`` broke that
+        core flow (functional regression). The hardening boundary is the
+        CONTAINER env (infra creds, allowlisted out by ``build_shell_env``), not
+        the user's own workspace secrets; their values are still redacted in any
+        displayed output. Set ``SHELL_INJECT_ALL_WORKSPACE_SECRETS=false`` to
+        opt in to the restrictive just-in-time mode (only secrets declared by a
+        loaded skill's ``requires_env``).
         """
         if not self._workspace_secrets:
             return {}
-        raw = os.environ.get("SHELL_INJECT_ALL_WORKSPACE_SECRETS", "").strip().lower()
-        if raw in ("true", "1", "yes", "on"):
-            return dict(self._workspace_secrets)
-        return {k: v for k, v in self._workspace_secrets.items() if k in skill_env_keys}
+        raw = os.environ.get("SHELL_INJECT_ALL_WORKSPACE_SECRETS", "true").strip().lower()
+        if raw in ("false", "0", "no", "off"):
+            return {k: v for k, v in self._workspace_secrets.items() if k in skill_env_keys}
+        return dict(self._workspace_secrets)
 
     def set_workspace_secrets(self, secrets: dict[str, str] | None) -> None:
         """Set per-session workspace secrets injected as env vars in shell_exec.
@@ -335,11 +341,9 @@ class ShellTool(AgentTool):
             os.environ,
             skill_env_keys=skill_env_keys,
         )
-        # Workspace secrets are injected JUST-IN-TIME: only those a currently
-        # loaded skill explicitly declares it needs (requires_env). The default
-        # sandbox therefore holds NO workspace secrets — a cracked sandbox sees
-        # nothing. Set SHELL_INJECT_ALL_WORKSPACE_SECRETS=true to restore the
-        # legacy blanket injection (discouraged).
+        # Workspace secrets: ALL injected (the workspace flow — the user hands
+        # the agent secrets it must be able to use in the shell). The hardening
+        # boundary is the container env (allowlisted above), not these.
         injected_ws = self._workspace_secrets_to_inject(skill_env_keys)
         for key, value in injected_ws.items():
             env[key] = value
@@ -768,6 +772,13 @@ class ShellTool(AgentTool):
         )
         env["AGENT_HOST"] = callback_host
         env["AGENT_PORT"] = str(callback_port)
+        # Belt-and-braces delivery: enable the skill's DIRECT upload to the
+        # callback endpoint (PRIMARY — immediate download link; requires the
+        # callback port to be published, see AGENT_SANDBOX_CALLBACK_PORT). The
+        # upload soft-fails: on any error the file stays in AGENT_OUTPUT_DIR and
+        # the parent finalizer delivers it via collect_out (FALLBACK). Set
+        # AGENT_SKILL_HTTP_UPLOAD=0 in the host env to force finalizer-only.
+        env["AGENT_SKILL_HTTP_UPLOAD"] = os.environ.get("AGENT_SKILL_HTTP_UPLOAD", "1")
         # Tell upload scripts whether to authenticate.
         env["REQUIRE_AUTH"] = os.environ.get("REQUIRE_AUTH", "false")
         # Scoped, short-lived session token (HMAC, user/session) so the sandbox

{agent_framework_lib-0.8.8.post6 → agent_framework_lib-0.8.8.post8/agent_framework_lib.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-framework-lib
-Version: 0.8.8.post6
+Version: 0.8.8.post8
 Summary: A comprehensive Python framework for building and serving conversational AI agents with FastAPI
 Author-email: Sebastian Pavel <sebastian@cinco.ai>, Elliott Girard <elliott.girard@icloud.com>
 Maintainer-email: Sebastian Pavel <sebastian@cinco.ai>

{agent_framework_lib-0.8.8.post6 → agent_framework_lib-0.8.8.post8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agent-framework-lib"
-version = "0.8.8post6"
+version = "0.8.8post8"
 description = "A comprehensive Python framework for building and serving conversational AI agents with FastAPI"
 readme = {file = "README.md", content-type = "text/markdown"}
 license = {text = "MIT"}