aicortexpy 0.1.0__py3-none-any.whl

aicortexpy/sandbox.py

@@ -0,0 +1,264 @@
+"""Sandbox / isolation strategy for agent subprocesses.
+
+Layers (defense in depth):
+  1. Provider-native — Codex config.toml / Claude permission+sandbox flags
+  2. Optional OS wrapper — Linux bubblewrap, macOS sandbox-exec
+  3. Windows — no bwrap/Seatbelt; rely on (1) + workdir confinement for MVP
+
+This mirrors Go execenv/codex_sandbox.go policy, including the macOS
+Seatbelt+network_access caveat (openai/codex#10390).
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+import shutil
+import tempfile
+from dataclasses import dataclass
+from pathlib import Path
+
+from .platform_info import (
+    env_truthy,
+    has_bubblewrap,
+    has_sandbox_exec,
+    host_os,
+)
+
+log = logging.getLogger("aicortexpy.sandbox")
+
+# Empty = treat macOS Codex network_access as broken (same as Go constant).
+CODEX_DARWIN_NETWORK_ACCESS_FIXED_VERSION = ""
+
+
+@dataclass
+class CodexSandboxPolicy:
+    mode: str  # workspace-write | danger-full-access | read-only
+    network_access: bool
+    reason: str
+
+
+@dataclass
+class SandboxPlan:
+    """How to launch one agent command."""
+
+    provider: str
+    work_dir: Path
+    policy_label: str
+    env_updates: dict[str, str]
+    # If set, replace argv with wrapper + original argv
+    wrap_argv: list[str] | None = None
+    notes: list[str] | None = None
+    # Temp files to delete after run
+    cleanup_paths: list[Path] | None = None
+
+
+def codex_sandbox_policy(detected_version: str = "") -> CodexSandboxPolicy:
+    os_name = host_os()
+    if os_name != "macos":
+        return CodexSandboxPolicy(
+            mode="workspace-write",
+            network_access=True,
+            reason="non-darwin — Landlock/workspace-write OK",
+        )
+    # darwin: network_access ignored under Seatbelt until upstream fix
+    if CODEX_DARWIN_NETWORK_ACCESS_FIXED_VERSION and detected_version:
+        # semver compare omitted in MVP — constant empty means always broken
+        pass
+    return CodexSandboxPolicy(
+        mode="danger-full-access",
+        network_access=False,
+        reason="macos Seatbelt ignores network_access (openai/codex#10390); "
+        "use danger-full-access so API calls work",
+    )
+
+
+def write_codex_sandbox_config(codex_home: Path, policy: CodexSandboxPolicy) -> Path:
+    """Write minimal config.toml sandbox block into per-task CODEX_HOME."""
+    codex_home.mkdir(parents=True, exist_ok=True)
+    cfg = codex_home / "config.toml"
+    block = (
+        "# managed-by: aicortex-python-daemon\n"
+        f'sandbox_mode = "{policy.mode}"\n'
+    )
+    if policy.mode == "workspace-write":
+        net = "true" if policy.network_access else "false"
+        block += (
+            "\n[sandbox_workspace_write]\n"
+            f"network_access = {net}\n"
+        )
+    # Preserve any existing user content below a marker if file already exists.
+    existing = ""
+    if cfg.is_file():
+        text = cfg.read_text(encoding="utf-8")
+        marker = "# managed-by: aicortex-python-daemon"
+        if marker in text:
+            # rewrite managed header only
+            rest = text.split(marker, 1)[1]
+            # drop until blank line after our block — keep simple: replace whole managed prefix
+            existing = ""
+            # Keep lines after first blank following old managed block is complex; overwrite.
+            _ = rest
+        else:
+            existing = "\n" + text
+    cfg.write_text(block + existing, encoding="utf-8")
+    log.info("codex sandbox config written mode=%s reason=%s", policy.mode, policy.reason)
+    return cfg
+
+
+def prepare_provider_sandbox(
+    provider: str,
+    work_dir: Path,
+    *,
+    codex_version: str = "",
+) -> SandboxPlan:
+    """Prepare env / config for a provider before spawn."""
+    notes: list[str] = []
+    env_updates: dict[str, str] = {}
+    cleanup: list[Path] = []
+    policy_label = "none"
+    wrap: list[str] | None = None
+
+    if provider == "codex":
+        policy = codex_sandbox_policy(codex_version)
+        policy_label = f"codex:{policy.mode}"
+        notes.append(policy.reason)
+        codex_home = work_dir.parent / "codex-home"
+        write_codex_sandbox_config(codex_home, policy)
+        env_updates["CODEX_HOME"] = str(codex_home)
+        # Seed auth/config from user home when present (read-only link prefer)
+        user_codex = Path.home() / ".codex"
+        for name in ("auth.json",):
+            src = user_codex / name
+            dst = codex_home / name
+            if src.is_file() and not dst.exists():
+                try:
+                    shutil.copy2(src, dst)
+                except OSError as e:
+                    notes.append(f"copy {name} failed: {e}")
+
+    elif provider == "claude":
+        policy_label = "claude:permission-mode"
+        notes.append(
+            "Claude OS sandbox available on macOS/Linux/WSL2 via Claude settings; "
+            "Windows native sandbox not available — permission mode only."
+        )
+        # Encourage workspace-scoped behavior; actual Seatbelt/bwrap is inside Claude.
+        env_updates.setdefault("CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC", "0")
+
+    else:
+        policy_label = f"{provider}:workdir-only"
+        notes.append("No provider-native sandbox wired; confine cwd to work_dir.")
+
+    # Optional OS wrapper (off by default — enable aicortex_OS_SANDBOX=1)
+    if env_truthy("aicortex_OS_SANDBOX", False):
+        wrap, wrap_notes, wrap_cleanup = build_os_wrapper(work_dir)
+        notes.extend(wrap_notes)
+        cleanup.extend(wrap_cleanup)
+        if wrap:
+            policy_label = f"{policy_label}+os-wrapper"
+
+    return SandboxPlan(
+        provider=provider,
+        work_dir=work_dir,
+        policy_label=policy_label,
+        env_updates=env_updates,
+        wrap_argv=wrap,
+        notes=notes,
+        cleanup_paths=cleanup,
+    )
+
+
+def build_os_wrapper(work_dir: Path) -> tuple[list[str] | None, list[str], list[Path]]:
+    """Return argv prefix to wrap the agent, or None if unavailable."""
+    notes: list[str] = []
+    cleanup: list[Path] = []
+    os_name = host_os()
+    root = str(work_dir.resolve())
+
+    if os_name == "linux" and has_bubblewrap():
+        # Minimal bwrap: allow read host, write only work_dir (+ /tmp)
+        wrap = [
+            "bwrap",
+            "--die-with-parent",
+            "--unshare-pid",
+            "--ro-bind", "/", "/",
+            "--dev", "/dev",
+            "--proc", "/proc",
+            "--tmpfs", "/tmp",
+            "--bind", root, root,
+            "--chdir", root,
+            "--",
+        ]
+        notes.append("linux bubblewrap wrapper enabled (aicortex_OS_SANDBOX=1)")
+        return wrap, notes, cleanup
+
+    if os_name == "macos" and has_sandbox_exec():
+        profile = _macos_seatbelt_profile(root)
+        fd, path = tempfile.mkstemp(prefix="aicortex-sb-", suffix=".sb")
+        os.close(fd)
+        Path(path).write_text(profile, encoding="utf-8")
+        cleanup.append(Path(path))
+        wrap = ["sandbox-exec", "-f", path]
+        notes.append("macos sandbox-exec wrapper enabled")
+        return wrap, notes, cleanup
+
+    if os_name == "windows":
+        notes.append(
+            "Windows OS wrapper not implemented (no bwrap/Seatbelt). "
+            "Use provider sandbox + workdir confinement; consider WSL2 for stronger isolation."
+        )
+        return None, notes, cleanup
+
+    notes.append(f"OS sandbox requested but no backend on {os_name}")
+    return None, notes, cleanup
+
+
+def _macos_seatbelt_profile(work_dir: str) -> str:
+    # Very small profile: allow most reads, write only work_dir + tmp + user caches.
+    wd = work_dir.replace("\\", "/")
+    return f"""
+(version 1)
+(deny default)
+(allow process*)
+(allow sysctl-read)
+(allow mach*)
+(allow file-read*)
+(allow file-write* (subpath "{wd}"))
+(allow file-write* (subpath "/private/tmp"))
+(allow file-write* (subpath "/tmp"))
+(allow file-write* (subpath "/private/var/folders"))
+(allow network*)
+""".strip()
+
+
+def apply_plan_to_command(plan: SandboxPlan, cmd: list[str]) -> list[str]:
+    if plan.wrap_argv:
+        return list(plan.wrap_argv) + cmd
+    return cmd
+
+
+def cleanup_plan(plan: SandboxPlan) -> None:
+    for p in plan.cleanup_paths or []:
+        try:
+            p.unlink(missing_ok=True)
+        except OSError:
+            pass
+
+
+def describe_default_strategy() -> str:
+    os_name = host_os()
+    lines = [
+        f"host_os={os_name}",
+        f"bubblewrap={has_bubblewrap()}",
+        f"sandbox-exec={has_sandbox_exec()}",
+        "layers:",
+        "  1) provider-native (Codex config / Claude flags) — default ON",
+        "  2) OS wrapper (bwrap / sandbox-exec) — aicortex_OS_SANDBOX=1",
+        "  3) Windows: provider + workdir only; prefer WSL2 for OS sandbox",
+    ]
+    if os_name == "macos":
+        lines.append(
+            "note: Codex on macOS uses danger-full-access until network_access Seatbelt fix"
+        )
+    return "\n".join(lines)

aicortexpy/stream.py

@@ -0,0 +1,422 @@
+"""Parse agent CLI stdout into daemon task messages + usage."""
+
+from __future__ import annotations
+
+import json
+import logging
+from dataclasses import dataclass, field
+from typing import Any, Callable
+
+log = logging.getLogger("aicortexpy.stream")
+
+STREAM_JSON_PROVIDERS = frozenset({"claude", "cursor", "gemini", "opencode", "copilot"})
+
+
+@dataclass
+class UsageAcc:
+    provider: str
+    model: str = ""
+    input_tokens: int = 0
+    output_tokens: int = 0
+    cache_read_tokens: int = 0
+    cache_write_tokens: int = 0
+
+    def as_dict(self) -> dict[str, Any]:
+        return {
+            "provider": self.provider,
+            "model": self.model or "unknown",
+            "input_tokens": self.input_tokens,
+            "output_tokens": self.output_tokens,
+            "cache_read_tokens": self.cache_read_tokens,
+            "cache_write_tokens": self.cache_write_tokens,
+        }
+
+    @property
+    def any(self) -> bool:
+        return any(
+            (
+                self.input_tokens,
+                self.output_tokens,
+                self.cache_read_tokens,
+                self.cache_write_tokens,
+            )
+        )
+
+
+@dataclass
+class StreamCollector:
+    provider: str
+    messages: list[dict[str, Any]] = field(default_factory=list)
+    usage: UsageAcc = field(default_factory=lambda: UsageAcc(provider=""))
+    text_parts: list[str] = field(default_factory=list)
+    session_id: str = ""
+    _seq: int = 0
+
+    def __post_init__(self) -> None:
+        self.usage = UsageAcc(provider=self.provider)
+
+    def _next_seq(self) -> int:
+        self._seq += 1
+        return self._seq
+
+    def add_text(self, content: str) -> None:
+        content = (content or "").strip()
+        if not content:
+            return
+        self.text_parts.append(content)
+        self.messages.append(
+            {
+                "seq": self._next_seq(),
+                "type": "text",
+                "content": content[:50_000],
+            }
+        )
+
+    def add_tool_use(self, tool: str, input_obj: dict[str, Any] | None = None) -> None:
+        msg: dict[str, Any] = {
+            "seq": self._next_seq(),
+            "type": "tool_use",
+            "tool": tool or "tool",
+        }
+        if input_obj:
+            msg["input"] = input_obj
+        self.messages.append(msg)
+
+    def add_tool_result(self, tool: str, output: str) -> None:
+        self.messages.append(
+            {
+                "seq": self._next_seq(),
+                "type": "tool_result",
+                "tool": tool or "tool",
+                "output": (output or "")[:50_000],
+            }
+        )
+
+    def feed_line(self, line: str) -> None:
+        line = line.strip()
+        if not line:
+            return
+        if self.provider == "claude":
+            self._feed_claude_json(line)
+        elif self.provider == "cursor":
+            self._feed_cursor_json(line)
+        elif self.provider == "gemini":
+            self._feed_gemini_json(line)
+        elif self.provider == "opencode":
+            self._feed_opencode_json(line)
+        elif self.provider == "copilot":
+            self._feed_copilot_json(line)
+
+    def _feed_claude_json(self, line: str) -> None:
+        try:
+            obj = json.loads(line)
+        except json.JSONDecodeError:
+            return
+        if not isinstance(obj, dict):
+            return
+        typ = str(obj.get("type") or "")
+
+        if typ == "assistant":
+            message = obj.get("message") or {}
+            content = message.get("content") if isinstance(message, dict) else None
+            if isinstance(content, list):
+                for block in content:
+                    if not isinstance(block, dict):
+                        continue
+                    btype = block.get("type")
+                    if btype == "text":
+                        self.add_text(str(block.get("text") or ""))
+                    elif btype == "tool_use":
+                        self.add_tool_use(
+                            str(block.get("name") or "tool"),
+                            block.get("input")
+                            if isinstance(block.get("input"), dict)
+                            else None,
+                        )
+            usage = message.get("usage") if isinstance(message, dict) else None
+            self._merge_usage(usage if isinstance(usage, dict) else None, message)
+
+        elif typ == "result":
+            # Final result event often carries usage + result text
+            result = obj.get("result")
+            if isinstance(result, str) and result.strip():
+                self.add_text(result)
+            self._merge_usage(obj.get("usage") if isinstance(obj.get("usage"), dict) else None, obj)
+            model = obj.get("model")
+            if isinstance(model, str) and model:
+                self.usage.model = model
+            sid = obj.get("session_id")
+            if isinstance(sid, str) and sid.strip():
+                self.session_id = sid.strip()
+        elif typ == "system":
+            sid = obj.get("session_id")
+            if isinstance(sid, str) and sid.strip():
+                self.session_id = sid.strip()
+
+        elif typ == "user":
+            message = obj.get("message") or {}
+            content = message.get("content") if isinstance(message, dict) else None
+            if isinstance(content, list):
+                for block in content:
+                    if isinstance(block, dict) and block.get("type") == "tool_result":
+                        self.add_tool_result(
+                            str(block.get("tool_use_id") or "tool"),
+                            str(block.get("content") or ""),
+                        )
+
+    def _merge_usage(self, usage: dict[str, Any] | None, parent: dict[str, Any] | None = None) -> None:
+        if parent and isinstance(parent.get("model"), str):
+            self.usage.model = parent["model"] or self.usage.model
+        if not usage:
+            return
+        self.usage.input_tokens += int(usage.get("input_tokens") or 0)
+        self.usage.output_tokens += int(usage.get("output_tokens") or 0)
+        self.usage.cache_read_tokens += int(
+            usage.get("cache_read_input_tokens")
+            or usage.get("cache_read_tokens")
+            or 0
+        )
+        self.usage.cache_write_tokens += int(
+            usage.get("cache_creation_input_tokens")
+            or usage.get("cache_write_tokens")
+            or 0
+        )
+
+    def _feed_cursor_json(self, line: str) -> None:
+        try:
+            obj = json.loads(line)
+        except json.JSONDecodeError:
+            return
+        if not isinstance(obj, dict):
+            return
+        sid = obj.get("session_id") or obj.get("sessionId")
+        if isinstance(sid, str) and sid.strip():
+            self.session_id = sid.strip()
+        typ = str(obj.get("type") or "")
+
+        if typ == "assistant":
+            message = obj.get("message")
+            if isinstance(message, str):
+                try:
+                    message = json.loads(message)
+                except json.JSONDecodeError:
+                    message = None
+            if isinstance(message, dict):
+                content = message.get("content")
+                if isinstance(content, list):
+                    for block in content:
+                        if not isinstance(block, dict):
+                            continue
+                        btype = str(block.get("type") or "")
+                        if btype in ("text", "output_text"):
+                            self.add_text(str(block.get("text") or ""))
+                        elif btype == "tool_use":
+                            self.add_tool_use(
+                                str(block.get("name") or "tool"),
+                                block.get("input")
+                                if isinstance(block.get("input"), dict)
+                                else None,
+                            )
+        elif typ == "tool_use":
+            params = obj.get("parameters") or obj.get("input")
+            if isinstance(params, str):
+                try:
+                    params = json.loads(params)
+                except json.JSONDecodeError:
+                    params = {"raw": params}
+            self.add_tool_use(
+                str(obj.get("tool_name") or obj.get("name") or "tool"),
+                params if isinstance(params, dict) else None,
+            )
+        elif typ == "tool_call":
+            title = str(obj.get("title") or obj.get("name") or obj.get("tool") or "tool")
+            raw_input = obj.get("rawInput") or obj.get("input") or obj.get("parameters")
+            self.add_tool_use(
+                title, raw_input if isinstance(raw_input, dict) else None
+            )
+        elif typ == "tool_result":
+            self.add_tool_result(
+                str(obj.get("tool_use_id") or obj.get("toolCallId") or "tool"),
+                str(obj.get("output") or obj.get("content") or ""),
+            )
+        elif typ == "text":
+            part = obj.get("part")
+            if isinstance(part, dict) and part.get("text"):
+                self.add_text(str(part["text"]))
+            elif obj.get("text"):
+                self.add_text(str(obj["text"]))
+        elif typ == "result":
+            result = obj.get("result") or obj.get("result_text")
+            if isinstance(result, str) and result.strip():
+                self.add_text(result)
+            usage = obj.get("usage")
+            if isinstance(usage, dict):
+                self._merge_usage(usage, obj)
+            model = obj.get("model")
+            if isinstance(model, str) and model:
+                self.usage.model = model
+
+    def _feed_gemini_json(self, line: str) -> None:
+        try:
+            obj = json.loads(line)
+        except json.JSONDecodeError:
+            return
+        if not isinstance(obj, dict):
+            return
+        typ = str(obj.get("type") or "")
+        if typ == "init":
+            sid = obj.get("session_id") or obj.get("sessionId")
+            if isinstance(sid, str) and sid.strip():
+                self.session_id = sid.strip()
+        elif typ == "message":
+            if str(obj.get("role") or "") == "assistant" and obj.get("content"):
+                self.add_text(str(obj["content"]))
+        elif typ == "tool_use":
+            params = obj.get("parameters") or obj.get("input")
+            if isinstance(params, str):
+                try:
+                    params = json.loads(params)
+                except json.JSONDecodeError:
+                    params = None
+            self.add_tool_use(
+                str(obj.get("tool_name") or obj.get("name") or "tool"),
+                params if isinstance(params, dict) else None,
+            )
+        elif typ == "tool_result":
+            self.add_tool_result(
+                str(obj.get("tool_id") or obj.get("tool_use_id") or "tool"),
+                str(obj.get("output") or ""),
+            )
+        elif typ == "result":
+            stats = obj.get("stats")
+            if isinstance(stats, dict):
+                models = stats.get("models")
+                if isinstance(models, dict):
+                    for model, m in models.items():
+                        if not isinstance(m, dict):
+                            continue
+                        if isinstance(model, str) and model:
+                            self.usage.model = model
+                        self.usage.input_tokens += int(m.get("input_tokens") or m.get("inputTokens") or 0)
+                        self.usage.output_tokens += int(
+                            m.get("output_tokens") or m.get("outputTokens") or 0
+                        )
+                        self.usage.cache_read_tokens += int(m.get("cached") or 0)
+
+    def _feed_opencode_json(self, line: str) -> None:
+        try:
+            obj = json.loads(line)
+        except json.JSONDecodeError:
+            return
+        if not isinstance(obj, dict):
+            return
+        sid = obj.get("sessionID") or obj.get("sessionId") or obj.get("session_id")
+        if isinstance(sid, str) and sid.strip():
+            self.session_id = sid.strip()
+        typ = str(obj.get("type") or "")
+        part = obj.get("part") if isinstance(obj.get("part"), dict) else {}
+
+        if typ == "text":
+            text = str(part.get("text") or obj.get("text") or "")
+            if text:
+                self.add_text(text)
+        elif typ == "tool_use":
+            tool = str(part.get("tool") or obj.get("tool") or "tool")
+            call_id = str(part.get("callID") or part.get("call_id") or "")
+            state = part.get("state") if isinstance(part.get("state"), dict) else {}
+            raw_in = state.get("input")
+            inp: dict[str, Any] | None = None
+            if isinstance(raw_in, dict):
+                inp = raw_in
+            elif isinstance(raw_in, str):
+                try:
+                    parsed = json.loads(raw_in)
+                    inp = parsed if isinstance(parsed, dict) else {"text": raw_in}
+                except json.JSONDecodeError:
+                    inp = {"text": raw_in}
+            self.add_tool_use(tool, inp)
+            if str(state.get("status") or "") == "completed":
+                out = state.get("output")
+                self.add_tool_result(call_id or tool, str(out or ""))
+        elif typ == "step_finish":
+            tokens = part.get("tokens") if isinstance(part.get("tokens"), dict) else None
+            if tokens:
+                self.usage.input_tokens += int(tokens.get("input") or 0)
+                self.usage.output_tokens += int(tokens.get("output") or 0)
+                cache = tokens.get("cache") if isinstance(tokens.get("cache"), dict) else {}
+                self.usage.cache_read_tokens += int(cache.get("read") or 0)
+                self.usage.cache_write_tokens += int(cache.get("write") or 0)
+
+    def _feed_copilot_json(self, line: str) -> None:
+        try:
+            obj = json.loads(line)
+        except json.JSONDecodeError:
+            return
+        if not isinstance(obj, dict):
+            return
+        typ = str(obj.get("type") or "")
+        data = obj.get("data") if isinstance(obj.get("data"), dict) else {}
+
+        if typ == "session.start":
+            sid = data.get("sessionId") or data.get("session_id")
+            if isinstance(sid, str) and sid.strip():
+                self.session_id = sid.strip()
+            model = data.get("selectedModel") or data.get("model")
+            if isinstance(model, str) and model:
+                self.usage.model = model
+        elif typ == "assistant.message_delta":
+            delta = str(data.get("deltaContent") or data.get("content") or "")
+            if delta:
+                self.add_text(delta)
+        elif typ == "assistant.message":
+            content = str(data.get("content") or "")
+            if content and not self.text_parts:
+                self.add_text(content)
+            reasoning = str(data.get("reasoningText") or "")
+            if reasoning:
+                self.messages.append(
+                    {"seq": self._next_seq(), "type": "thinking", "content": reasoning[:50_000]}
+                )
+            reqs = data.get("toolRequests")
+            if isinstance(reqs, list):
+                for tr in reqs:
+                    if not isinstance(tr, dict):
+                        continue
+                    self.add_tool_use(
+                        str(tr.get("name") or tr.get("tool") or "tool"),
+                        tr.get("arguments") if isinstance(tr.get("arguments"), dict) else None,
+                    )
+            out_tok = data.get("outputTokens")
+            if out_tok is not None:
+                self.usage.output_tokens += int(out_tok or 0)
+        elif typ in ("assistant.reasoning", "assistant.reasoning_delta"):
+            text = str(data.get("content") or data.get("deltaContent") or "")
+            if text:
+                self.messages.append(
+                    {"seq": self._next_seq(), "type": "thinking", "content": text[:50_000]}
+                )
+        elif typ == "tool.execution_complete":
+            call_id = str(data.get("toolCallId") or data.get("tool_call_id") or "tool")
+            result = data.get("result") if isinstance(data.get("result"), dict) else {}
+            out = str(result.get("content") or data.get("error", {}).get("message") or "")
+            if not out and isinstance(data.get("error"), dict):
+                out = str(data["error"].get("message") or "")
+            self.add_tool_result(call_id, out)
+        elif typ == "result":
+            sid = obj.get("sessionId") or data.get("sessionId")
+            if isinstance(sid, str) and sid.strip():
+                self.session_id = sid.strip()
+
+    def finalize_plain_output(self, text: str) -> None:
+        """For non-JSON providers: one text message from full stdout."""
+        if self.messages:
+            return
+        self.add_text(text)
+
+    def output_text(self) -> str:
+        if self.text_parts:
+            return "\n".join(self.text_parts)
+        return ""
+
+
+MessageSink = Callable[[list[dict[str, Any]]], None]