agent-loop-guard-runtime 0.6.0a2__py3-none-any.whl

app/providers/mock.py

@@ -0,0 +1,169 @@
+from __future__ import annotations
+
+import asyncio
+import json
+import uuid
+from collections.abc import AsyncIterator
+from typing import Any
+
+from app.core.token_meter import estimate_tokens
+from app.providers.base import ProviderResult, ProviderStream
+
+
+def _json_bytes(value: dict[str, Any]) -> bytes:
+    return json.dumps(value, ensure_ascii=False, separators=(",", ":")).encode("utf-8")
+
+
+def _text_from_body(body: dict[str, Any]) -> str:
+    for key in ("input", "prompt"):
+        value = body.get(key)
+        if isinstance(value, str) and value.strip():
+            return value.strip()
+    messages = body.get("messages")
+    if isinstance(messages, list):
+        for item in reversed(messages):
+            if isinstance(item, dict):
+                content = item.get("content")
+                if isinstance(content, str) and content.strip():
+                    return content.strip()
+                if isinstance(content, list):
+                    parts = [
+                        str(part.get("text"))
+                        for part in content
+                        if isinstance(part, dict) and part.get("text")
+                    ]
+                    if parts:
+                        return " ".join(parts)
+    return "mock request"
+
+
+def _usage(protocol: str, body: dict[str, Any], output: str) -> dict[str, int]:
+    input_tokens = estimate_tokens(body)
+    output_tokens = estimate_tokens(output)
+    if protocol == "anthropic":
+        return {"input_tokens": input_tokens, "output_tokens": output_tokens}
+    return {
+        "prompt_tokens": input_tokens,
+        "completion_tokens": output_tokens,
+        "total_tokens": input_tokens + output_tokens,
+    }
+
+
+class MockProvider:
+    """Deterministic local provider used for demos and tests."""
+
+    async def models(self) -> ProviderResult:
+        payload = {
+            "object": "list",
+            "data": [
+                {"id": "demo-model", "object": "model", "created": 0, "owned_by": "agent-loop-guard"},
+                {"id": "mock-loop-model", "object": "model", "created": 0, "owned_by": "agent-loop-guard"},
+            ],
+        }
+        return ProviderResult(200, {"content-type": "application/json"}, _json_bytes(payload), payload)
+
+    async def count_tokens(self, body: dict[str, Any]) -> ProviderResult:
+        payload = {"input_tokens": estimate_tokens(body)}
+        return ProviderResult(200, {"content-type": "application/json"}, _json_bytes(payload), payload)
+
+    async def request(self, protocol: str, endpoint: str, body: dict[str, Any]) -> ProviderResult:
+        if endpoint.endswith("/models"):
+            return await self.models()
+        if endpoint.endswith("/messages/count_tokens"):
+            return await self.count_tokens(body)
+
+        status = int(body.get("mock_status") or 200)
+        if body.get("mock_error") or status >= 400:
+            payload = {
+                "error": {
+                    "type": "mock_error",
+                    "code": "mock_error",
+                    "message": str(body.get("mock_error") or "mock upstream error"),
+                }
+            }
+            return ProviderResult(status, {"content-type": "application/json"}, _json_bytes(payload), payload)
+
+        prompt = _text_from_body(body)
+        output = f"Mock response for: {prompt[:120]}"
+        model = str(body.get("model") or "demo-model")
+        if protocol == "anthropic":
+            payload = {
+                "id": f"msg_{uuid.uuid4().hex[:16]}",
+                "type": "message",
+                "role": "assistant",
+                "model": model,
+                "content": [{"type": "text", "text": output}],
+                "stop_reason": "end_turn",
+                "usage": _usage(protocol, body, output),
+            }
+        elif endpoint.endswith("/responses"):
+            payload = {
+                "id": f"resp_{uuid.uuid4().hex[:16]}",
+                "object": "response",
+                "model": model,
+                "output": [
+                    {
+                        "type": "message",
+                        "role": "assistant",
+                        "content": [{"type": "output_text", "text": output}],
+                    }
+                ],
+                "usage": _usage(protocol, body, output),
+            }
+        else:
+            payload = {
+                "id": f"chatcmpl_{uuid.uuid4().hex[:16]}",
+                "object": "chat.completion",
+                "model": model,
+                "choices": [
+                    {
+                        "index": 0,
+                        "finish_reason": "stop",
+                        "message": {"role": "assistant", "content": output},
+                    }
+                ],
+                "usage": _usage(protocol, body, output),
+            }
+        return ProviderResult(200, {"content-type": "application/json"}, _json_bytes(payload), payload)
+
+    async def stream(self, protocol: str, endpoint: str, body: dict[str, Any]) -> ProviderStream:
+        prompt = _text_from_body(body)
+        model = str(body.get("model") or "demo-model")
+        chunks = [
+            f"Mock streaming response for: {prompt[:80]}",
+            " -- guarded by Agent Loop Guard.",
+        ]
+
+        async def iterator() -> AsyncIterator[bytes]:
+            if protocol == "anthropic":
+                yield b"event: message_start\n"
+                start = {"type": "message_start", "message": {"id": "msg_mock", "model": model}}
+                yield b"data: " + _json_bytes(start) + b"\n\n"
+                for chunk in chunks:
+                    await asyncio.sleep(0)
+                    payload = {"type": "content_block_delta", "delta": {"type": "text_delta", "text": chunk}}
+                    yield b"event: content_block_delta\n"
+                    yield b"data: " + _json_bytes(payload) + b"\n\n"
+                usage = _usage(protocol, body, "".join(chunks))
+                yield b"event: message_delta\n"
+                yield b"data: " + _json_bytes({"type": "message_delta", "usage": usage}) + b"\n\n"
+                yield b"event: message_stop\n"
+                yield b"data: {\"type\":\"message_stop\"}\n\n"
+                return
+
+            for chunk in chunks:
+                await asyncio.sleep(0)
+                if endpoint.endswith("/responses"):
+                    payload = {"type": "response.output_text.delta", "delta": chunk}
+                else:
+                    payload = {
+                        "id": "chatcmpl_mock",
+                        "object": "chat.completion.chunk",
+                        "model": model,
+                        "choices": [{"index": 0, "delta": {"content": chunk}, "finish_reason": None}],
+                    }
+                yield b"data: " + _json_bytes(payload) + b"\n\n"
+            yield b"data: [DONE]\n\n"
+
+        return ProviderStream(200, {"content-type": "text/event-stream"}, iterator())
+

app/providers/upstream.py

@@ -0,0 +1,101 @@
+from __future__ import annotations
+
+from collections.abc import AsyncIterator
+from urllib.parse import urljoin, urlparse
+
+import httpx
+
+from app.core.security import filtered_upstream_headers
+from app.providers.base import ProviderResult, ProviderStream
+
+
+def validate_base_url(base_url: str) -> str:
+    parsed = urlparse(base_url)
+    if parsed.scheme not in {"http", "https"} or not parsed.netloc:
+        raise ValueError("Upstream base URL must be an absolute http(s) URL.")
+    return base_url.rstrip("/") + "/"
+
+
+def _target(base_url: str, endpoint: str) -> str:
+    return urljoin(validate_base_url(base_url), endpoint.lstrip("/"))
+
+
+def _response_headers(headers: httpx.Headers) -> dict[str, str]:
+    hop_by_hop = {
+        "connection",
+        "content-length",
+        "keep-alive",
+        "proxy-authenticate",
+        "proxy-authorization",
+        "te",
+        "trailer",
+        "transfer-encoding",
+        "upgrade",
+    }
+    return {key: value for key, value in headers.items() if key.lower() not in hop_by_hop}
+
+
+class UpstreamProvider:
+    def __init__(self, *, base_url: str, api_key: str | None, protocol: str):
+        self.base_url = validate_base_url(base_url)
+        self.api_key = api_key
+        self.protocol = protocol
+
+    def _headers(self, incoming: dict[str, str]) -> dict[str, str]:
+        headers = filtered_upstream_headers(incoming)
+        if self.api_key:
+            if self.protocol == "anthropic":
+                headers["x-api-key"] = self.api_key
+                headers.setdefault("anthropic-version", "2023-06-01")
+            else:
+                headers["authorization"] = f"Bearer {self.api_key}"
+        return headers
+
+    async def request(self, endpoint: str, raw_body: bytes, incoming_headers: dict[str, str]) -> ProviderResult:
+        async with httpx.AsyncClient(timeout=None) as client:
+            response = await client.request(
+                "POST" if raw_body else "GET",
+                _target(self.base_url, endpoint),
+                content=raw_body if raw_body else None,
+                headers=self._headers(incoming_headers),
+            )
+        json_body = None
+        try:
+            json_body = response.json()
+        except ValueError:
+            pass
+        return ProviderResult(
+            response.status_code,
+            _response_headers(response.headers),
+            response.content,
+            json_body,
+            response.headers.get("content-type"),
+        )
+
+    async def stream(
+        self, endpoint: str, raw_body: bytes, incoming_headers: dict[str, str]
+    ) -> ProviderStream:
+        client = httpx.AsyncClient(timeout=None)
+        request = client.build_request(
+            "POST",
+            _target(self.base_url, endpoint),
+            content=raw_body,
+            headers=self._headers(incoming_headers),
+        )
+        response = await client.send(request, stream=True)
+
+        async def iterator() -> AsyncIterator[bytes]:
+            try:
+                async for chunk in response.aiter_bytes():
+                    yield chunk
+            finally:
+                await response.aclose()
+                await client.aclose()
+
+        return ProviderStream(
+            response.status_code,
+            _response_headers(response.headers),
+            iterator(),
+            response.headers.get("content-type") or "text/event-stream",
+        )
+

app/replay/__init__.py

@@ -0,0 +1 @@
+"""Session Replay SDK and export helpers."""

app/replay/costs.py

@@ -0,0 +1,37 @@
+from __future__ import annotations
+
+import os
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+
+def load_pricing(path: str | Path | None = None) -> dict[str, dict[str, int]]:
+    selected = Path(path or os.getenv("ALG_MODEL_PRICING", "model-pricing.yml"))
+    if not selected.exists():
+        return {"demo-model": {"input_micros_per_million": 0, "output_micros_per_million": 0}}
+    with selected.open(encoding="utf-8") as handle:
+        data: dict[str, Any] = yaml.safe_load(handle) or {}
+    return {
+        str(model): {
+            "input_micros_per_million": int(row.get("input_micros_per_million", 0)),
+            "output_micros_per_million": int(row.get("output_micros_per_million", 0)),
+        }
+        for model, row in (data.get("models") or {}).items()
+        if isinstance(row, dict)
+    }
+
+
+def estimate_cost_micros(
+    model: str | None, input_tokens: int, output_tokens: int, pricing: dict | None = None
+) -> tuple[int, bool]:
+    catalog = pricing or load_pricing()
+    row = catalog.get(model or "")
+    if not row:
+        return 0, True
+    total = (
+        input_tokens * int(row.get("input_micros_per_million", 0))
+        + output_tokens * int(row.get("output_micros_per_million", 0))
+    ) // 1_000_000
+    return total, True

app/replay/formats.py

@@ -0,0 +1,87 @@
+from __future__ import annotations
+
+import hashlib
+import json
+from typing import Any
+
+
+def trace_to_jsonl(bundle: dict[str, Any]) -> str:
+    rows = [{"record_type": "run", **bundle["run"]}]
+    rows.extend({"record_type": "span", **item} for item in bundle.get("spans", []))
+    rows.extend({"record_type": "event", **item} for item in bundle.get("events", []))
+    rows.extend({"record_type": "artifact", **item} for item in bundle.get("artifacts", []))
+    return "".join(json.dumps(row, ensure_ascii=False, sort_keys=True) + "\n" for row in rows)
+
+
+def trace_to_otel(bundle: dict[str, Any]) -> dict[str, Any]:
+    run = bundle["run"]
+    trace_id = hashlib.sha256(str(run["id"]).encode("utf-8")).hexdigest()[:32]
+
+    def otel_span_id(value: str) -> str:
+        return hashlib.sha256(value.encode("utf-8")).hexdigest()[:16]
+
+    spans = []
+    events_by_span: dict[str, list[dict[str, Any]]] = {}
+    for event in bundle.get("events", []):
+        if event.get("span_id"):
+            events_by_span.setdefault(event["span_id"], []).append(event)
+    for span in bundle.get("spans", []):
+        spans.append(
+            {
+                "traceId": trace_id,
+                "spanId": otel_span_id(span["id"]),
+                "parentSpanId": (
+                    otel_span_id(span["parent_span_id"])
+                    if span.get("parent_span_id")
+                    else ""
+                ),
+                "name": span["name"],
+                "startTimeUnixNano": str(span["start_ns"]),
+                "endTimeUnixNano": str(span.get("end_ns") or span["start_ns"]),
+                "status": {"code": "STATUS_CODE_ERROR" if span["status"] in {"error", "blocked"} else "STATUS_CODE_OK"},
+                "attributes": [
+                    {"key": str(key), "value": {"stringValue": str(value)}}
+                    for key, value in span.get("attributes", {}).items()
+                ],
+                "events": [
+                    {
+                        "timeUnixNano": str(event["timestamp_ns"]),
+                        "name": event["name"],
+                        "attributes": [
+                            {"key": str(key), "value": {"stringValue": str(value)}}
+                            for key, value in event.get("attributes", {}).items()
+                        ],
+                    }
+                    for event in events_by_span.get(span["id"], [])
+                ],
+            }
+        )
+    return {
+        "resourceSpans": [
+            {
+                "resource": {
+                    "attributes": [
+                        {"key": "service.name", "value": {"stringValue": "agent-loop-guard"}},
+                        {"key": "project.id", "value": {"stringValue": run["project_id"]}},
+                    ]
+                },
+                "scopeSpans": [{"scope": {"name": "agent-loop-guard.replay"}, "spans": spans}],
+            }
+        ]
+    }
+
+
+def jsonl_to_trace(text: str) -> dict[str, Any]:
+    bundle: dict[str, Any] = {"spans": [], "events": [], "artifacts": []}
+    for line in text.splitlines():
+        if not line.strip():
+            continue
+        row = json.loads(line)
+        record_type = row.pop("record_type", None)
+        if record_type == "run":
+            bundle["run"] = row
+        elif record_type in {"span", "event", "artifact"}:
+            bundle[f"{record_type}s"].append(row)
+    if "run" not in bundle:
+        raise ValueError("JSONL bundle does not contain a run record.")
+    return bundle

app/replay/sdk.py

@@ -0,0 +1,102 @@
+from __future__ import annotations
+
+import time
+import uuid
+from contextlib import AbstractContextManager
+from dataclasses import dataclass, field
+from typing import Any
+
+import httpx
+
+from app.core.redaction import redact_value
+
+
+class ReplayClient:
+    def __init__(self, base_url: str = "http://127.0.0.1:8787", timeout: float = 10):
+        self.base_url = base_url.rstrip("/")
+        self.timeout = timeout
+
+    def trace(self, **attributes: Any) -> TraceContext:
+        return TraceContext(self, attributes)
+
+    def ingest(self, payload: dict[str, Any]) -> dict[str, Any]:
+        response = httpx.post(
+            f"{self.base_url}/api/v1/traces", json=redact_value(payload), timeout=self.timeout
+        )
+        response.raise_for_status()
+        return response.json()
+
+
+@dataclass
+class SpanContext(AbstractContextManager["SpanContext"]):
+    trace: TraceContext
+    name: str
+    attributes: dict[str, Any] = field(default_factory=dict)
+    parent_span_id: str | None = None
+    span_id: str = field(default_factory=lambda: f"spn_{uuid.uuid4().hex[:24]}")
+    start_ns: int = field(default_factory=time.time_ns)
+    end_ns: int | None = None
+    status: str = "ok"
+    events: list[dict[str, Any]] = field(default_factory=list)
+
+    def event(self, name: str, severity: str = "info", **attributes: Any) -> None:
+        self.events.append(
+            {
+                "name": name,
+                "severity": severity,
+                "timestamp_ns": time.time_ns(),
+                "attributes": attributes,
+            }
+        )
+
+    def __exit__(self, exc_type, exc, traceback) -> bool:
+        self.end_ns = time.time_ns()
+        if exc is not None:
+            self.status = "error"
+            self.event("exception", "error", type=type(exc).__name__, message=str(exc))
+        self.trace.spans.append(
+            {
+                "span_id": self.span_id,
+                "parent_span_id": self.parent_span_id,
+                "name": self.name,
+                "status": self.status,
+                "start_ns": self.start_ns,
+                "end_ns": self.end_ns,
+                "attributes": self.attributes,
+                "events": self.events,
+            }
+        )
+        return False
+
+
+@dataclass
+class TraceContext(AbstractContextManager["TraceContext"]):
+    client: ReplayClient
+    attributes: dict[str, Any] = field(default_factory=dict)
+    trace_id: str = field(default_factory=lambda: f"trc_{uuid.uuid4().hex[:24]}")
+    start_ns: int = field(default_factory=time.time_ns)
+    spans: list[dict[str, Any]] = field(default_factory=list)
+    result: dict[str, Any] | None = None
+
+    def span(
+        self,
+        name: str,
+        *,
+        parent_span_id: str | None = None,
+        **attributes: Any,
+    ) -> SpanContext:
+        return SpanContext(self, name, attributes, parent_span_id)
+
+    def __exit__(self, exc_type, exc, traceback) -> bool:
+        status = "error" if exc is not None else "ok"
+        self.result = self.client.ingest(
+            {
+                "trace_id": self.trace_id,
+                "status": status,
+                "start_ns": self.start_ns,
+                "end_ns": time.time_ns(),
+                "attributes": self.attributes,
+                "spans": self.spans,
+            }
+        )
+        return False

app/sandbox/__init__.py

@@ -0,0 +1,2 @@
+"""Docker-backed, Linux-first sandbox technical preview."""
+

app/sandbox/policy.py

@@ -0,0 +1,22 @@
+from __future__ import annotations
+
+import re
+
+DENIED_COMMAND_PATTERNS = (
+    r"\b(?:docker|podman)\b",
+    r"\bmount\b",
+    r"\b(?:shutdown|reboot|poweroff)\b",
+    r"\bnsenter\b",
+    r"/proc/(?:1|sysrq-trigger)",
+    r":\s*\(\s*\)\s*\{.*:\s*\|\s*:",
+)
+
+
+def validate_command(command: list[str]) -> None:
+    if not command:
+        raise ValueError("A command is required after --")
+    rendered = " ".join(command)
+    for pattern in DENIED_COMMAND_PATTERNS:
+        if re.search(pattern, rendered, re.IGNORECASE):
+            raise ValueError(f"Command denied by sandbox policy: {pattern}")
+