algo-cli-runtime 0.14.0__py3-none-any.whl

algo_cli/intelligence/acrobat_runtime.py

@@ -0,0 +1,302 @@
+"""B163, B164, B165, B175: Acrobat-derived runtime patterns.
+
+- B163: Deterministic Variant / Experiment Bucketing
+- B164: Broker / Sidecar Process Boundary
+- B165: Chunked Web Resource Loading
+- B175: Script Bytecode Compilation Cache
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Any, Callable, Protocol
+import hashlib
+import time
+
+
+# ── B163: Deterministic Variant / Experiment Bucketing ────────────────
+
+
+@dataclass
+class VariantRange:
+    """A numeric range mapping to a variant."""
+    start: int  # inclusive
+    end: int    # inclusive
+    variant: str
+
+
+@dataclass
+class ExperimentDefinition:
+    """An experiment with variant ranges (B163)."""
+    experiment_id: str
+    ranges: list[VariantRange] = field(default_factory=list)
+    control_variant: str = "control"
+
+    def assign(self, subject_id: str) -> str:
+        """Deterministically assign a variant based on subject_id hash."""
+        bucket = self._hash_bucket(subject_id)
+        for r in self.ranges:
+            if r.start <= bucket <= r.end:
+                return r.variant
+        return self.control_variant
+
+    def _hash_bucket(self, subject_id: str) -> int:
+        """Stable hash to bucket 1-1000."""
+        h = hashlib.sha256(f"{self.experiment_id}:{subject_id}".encode()).hexdigest()
+        return int(h[:8], 16) % 1000 + 1
+
+
+class ExperimentRegistry:
+    """Registry of experiments (B163)."""
+
+    def __init__(self) -> None:
+        self._experiments: dict[str, ExperimentDefinition] = {}
+
+    def register(self, experiment: ExperimentDefinition) -> None:
+        self._experiments[experiment.experiment_id] = experiment
+
+    def assign(self, experiment_id: str, subject_id: str) -> str:
+        """Assign a variant for the given experiment and subject."""
+        exp = self._experiments.get(experiment_id)
+        if not exp:
+            return "control"
+        return exp.assign(subject_id)
+
+    def all_experiments(self) -> list[str]:
+        return list(self._experiments.keys())
+
+
+# ── B164: Broker / Sidecar Process Boundary ───────────────────────────
+
+
+@dataclass
+class SidecarRequest:
+    """A request to a sidecar worker (B164)."""
+    command: str
+    params: dict[str, Any] = field(default_factory=dict)
+    timeout_seconds: float = 30.0
+    permission_envelope: dict[str, bool] = field(default_factory=dict)
+
+
+@dataclass
+class SidecarResult:
+    """Result from a sidecar worker (B164)."""
+    success: bool = True
+    output: Any = None
+    error: str = ""
+    timed_out: bool = False
+    crashed: bool = False
+    duration_ms: float = 0.0
+
+
+class SidecarWorker(Protocol):
+    """Protocol for sidecar workers (B164)."""
+    def execute(self, request: SidecarRequest) -> SidecarResult: ...
+
+
+class InProcessSidecar:
+    """A simple in-process sidecar for testing (B164)."""
+
+    def __init__(self, handlers: dict[str, Callable[[dict], Any]] | None = None) -> None:
+        self._handlers = handlers or {}
+
+    def register(self, command: str, handler: Callable[[dict], Any]) -> None:
+        self._handlers[command] = handler
+
+    def execute(self, request: SidecarRequest) -> SidecarResult:
+        start = time.monotonic()
+        handler = self._handlers.get(request.command)
+        if not handler:
+            return SidecarResult(
+                success=False,
+                error=f"unknown command: {request.command}",
+                duration_ms=(time.monotonic() - start) * 1000,
+            )
+        # Check permission envelope
+        if request.permission_envelope.get("external_send") and not request.permission_envelope.get("approved"):
+            return SidecarResult(
+                success=False,
+                error="external_send not approved",
+                duration_ms=(time.monotonic() - start) * 1000,
+            )
+        try:
+            output = handler(request.params)
+            return SidecarResult(
+                success=True,
+                output=output,
+                duration_ms=(time.monotonic() - start) * 1000,
+            )
+        except Exception as e:
+            return SidecarResult(
+                success=False,
+                error=str(e),
+                crashed=True,
+                duration_ms=(time.monotonic() - start) * 1000,
+            )
+
+
+class BrokerManager:
+    """Manages broker/sidecar process boundaries (B164)."""
+
+    def __init__(self) -> None:
+        self._workers: dict[str, SidecarWorker] = {}
+
+    def register_worker(self, name: str, worker: SidecarWorker) -> None:
+        self._workers[name] = worker
+
+    def dispatch(self, worker_name: str, request: SidecarRequest) -> SidecarResult:
+        """Dispatch a request to a named worker."""
+        worker = self._workers.get(worker_name)
+        if not worker:
+            return SidecarResult(success=False, error=f"unknown worker: {worker_name}")
+        try:
+            return worker.execute(request)
+        except Exception as e:
+            # Worker crash does not kill the broker
+            return SidecarResult(success=False, error=str(e), crashed=True)
+
+    def available_workers(self) -> list[str]:
+        return list(self._workers.keys())
+
+
+# ── B165: Chunked Web Resource Loading ──────────────────────────────
+
+
+@dataclass
+class ResourceChunk:
+    """A chunk of a web resource (B165)."""
+    chunk_id: str
+    version: str = ""
+    size_bytes: int = 0
+    optional: bool = True
+
+
+@dataclass
+class ChunkLoadResult:
+    """Result of loading a chunk."""
+    chunk_id: str
+    loaded: bool = True
+    from_cache: bool = False
+    error: str = ""
+    load_time_ms: float = 0.0
+
+
+class ChunkedResourceLoader:
+    """Lazy-loads optional feature chunks (B165)."""
+
+    def __init__(self) -> None:
+        self._chunks: dict[str, ResourceChunk] = {}
+        self._cache: dict[str, Any] = {}
+        self._loaded: set[str] = set()
+
+    def register_chunk(self, chunk: ResourceChunk) -> None:
+        self._chunks[chunk.chunk_id] = chunk
+
+    def load(self, chunk_id: str, loader: Callable[[], Any] | None = None) -> ChunkLoadResult:
+        """Load a chunk by ID, using the provided loader function."""
+        start = time.monotonic()
+        chunk = self._chunks.get(chunk_id)
+        if not chunk:
+            return ChunkLoadResult(chunk_id=chunk_id, loaded=False, error=f"unknown chunk: {chunk_id}")
+        if chunk_id in self._cache:
+            return ChunkLoadResult(
+                chunk_id=chunk_id, loaded=True, from_cache=True,
+                load_time_ms=(time.monotonic() - start) * 1000,
+            )
+        if loader:
+            try:
+                self._cache[chunk_id] = loader()
+                self._loaded.add(chunk_id)
+                return ChunkLoadResult(
+                    chunk_id=chunk_id, loaded=True,
+                    load_time_ms=(time.monotonic() - start) * 1000,
+                )
+            except Exception as e:
+                return ChunkLoadResult(
+                    chunk_id=chunk_id, loaded=False, error=str(e),
+                    load_time_ms=(time.monotonic() - start) * 1000,
+                )
+        return ChunkLoadResult(
+            chunk_id=chunk_id, loaded=False, error="no loader provided",
+            load_time_ms=(time.monotonic() - start) * 1000,
+        )
+
+    def is_loaded(self, chunk_id: str) -> bool:
+        return chunk_id in self._loaded
+
+    def invalidate(self, chunk_id: str) -> bool:
+        """Invalidate a cached chunk."""
+        if chunk_id in self._cache:
+            del self._cache[chunk_id]
+            self._loaded.discard(chunk_id)
+            return True
+        return False
+
+    def all_chunks(self) -> list[str]:
+        return list(self._chunks.keys())
+
+
+# ── B175: Script Bytecode Compilation Cache ──────────────────────────
+
+
+@dataclass
+class CacheEntry:
+    """A compiled script cache entry (B175)."""
+    source_path: str
+    cache_path: str
+    source_mtime: float
+    platform: str
+
+
+class ScriptBytecodeCache:
+    """Caches compiled scripts to avoid re-parsing on every startup (B175)."""
+
+    def __init__(self, platform: str = "win") -> None:
+        self._platform = platform
+        self._entries: dict[str, CacheEntry] = {}
+        self._compile_fn: Callable[[str], bytes] | None = None
+
+    def set_compiler(self, compile_fn: Callable[[str], bytes]) -> None:
+        self._compile_fn = compile_fn
+
+    def get_or_compile(self, source_path: str, source_mtime: float) -> tuple[bytes, bool]:
+        """Get cached bytecode or compile from source.
+        Returns (bytecode, from_cache).
+        """
+        entry = self._entries.get(source_path)
+        if entry and entry.source_mtime >= source_mtime and entry.platform == self._platform:
+            # Cache hit
+            return b"", True  # In real impl, would read cache file
+
+        # Cache miss - compile
+        if not self._compile_fn:
+            raise RuntimeError("no compiler set")
+        bytecode = self._compile_fn(source_path)
+        self._entries[source_path] = CacheEntry(
+            source_path=source_path,
+            cache_path=f"{source_path}.cache",
+            source_mtime=source_mtime,
+            platform=self._platform,
+        )
+        return bytecode, False
+
+    def invalidate(self, source_path: str) -> bool:
+        """Invalidate a cache entry."""
+        if source_path in self._entries:
+            del self._entries[source_path]
+            return True
+        return False
+
+    def is_stale(self, source_path: str, source_mtime: float) -> bool:
+        """Check if a cache entry is stale."""
+        entry = self._entries.get(source_path)
+        if not entry:
+            return True
+        return entry.source_mtime < source_mtime or entry.platform != self._platform
+
+    def cache_stats(self) -> dict[str, int]:
+        """Return cache statistics."""
+        return {
+            "entries": len(self._entries),
+            "platform": hash(self._platform),  # just for testing
+        }

algo_cli/intelligence/acrobat_security.py

@@ -0,0 +1,261 @@
+"""B159, B161, B173: Acrobat-derived security patterns.
+
+- B159: Search/Redaction Pattern Packs
+- B161: Pre-Model Disqualification Rules
+- B173: Native Messaging Host Allowlist
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Any
+import re
+
+
+# ── B159: Search/Redaction Pattern Packs ───────────────────────────────
+
+
+@dataclass
+class RedactionPattern:
+    """A single redaction pattern (B159)."""
+    display_name: str
+    regex: str
+    examples: str = ""
+    category: str = "general"
+    severity: str = "medium"  # "low", "medium", "high"
+
+
+@dataclass
+class RedactionCode:
+    """A legal/business reason code for redaction (B159)."""
+    name: str
+    description: str = ""
+
+
+@dataclass
+class RedactionMatch:
+    """A matched span for redaction."""
+    pattern_name: str
+    span: tuple[int, int]
+    text: str
+    code: str = ""
+    locale: str = "ENU"
+
+
+@dataclass
+class RedactionPatternPack:
+    """A locale-specific pack of redaction patterns (B159)."""
+    locale: str = "ENU"
+    patterns: list[RedactionPattern] = field(default_factory=list)
+    codes: list[RedactionCode] = field(default_factory=list)
+
+    def scan(self, text: str, enabled_categories: set[str] | None = None) -> list[RedactionMatch]:
+        """Scan text for matches against all patterns."""
+        matches: list[RedactionMatch] = []
+        for pattern in self.patterns:
+            if enabled_categories and pattern.category not in enabled_categories:
+                continue
+            try:
+                for m in re.finditer(pattern.regex, text):
+                    matches.append(RedactionMatch(
+                        pattern_name=pattern.display_name,
+                        span=(m.start(), m.end()),
+                        text=m.group(),
+                        locale=self.locale,
+                    ))
+            except re.error:
+                continue
+        return matches
+
+
+class RedactionPackRegistry:
+    """Registry of locale-specific redaction packs (B159)."""
+
+    def __init__(self) -> None:
+        self._packs: dict[str, RedactionPatternPack] = {}
+
+    def register(self, pack: RedactionPatternPack) -> None:
+        self._packs[pack.locale] = pack
+
+    def get(self, locale: str) -> RedactionPatternPack | None:
+        # Try exact locale
+        if locale in self._packs:
+            return self._packs[locale]
+        # Try language prefix
+        lang = locale.split("_")[0].upper()
+        if lang in self._packs:
+            return self._packs[lang]
+        # Fall back to ENU
+        return self._packs.get("ENU")
+
+    def scan(self, text: str, locale: str = "ENU", enabled_categories: set[str] | None = None) -> list[RedactionMatch]:
+        """Scan text using the best available locale pack."""
+        pack = self.get(locale)
+        if not pack:
+            return []
+        return pack.scan(text, enabled_categories)
+
+    def available_locales(self) -> list[str]:
+        return list(self._packs.keys())
+
+
+# Default patterns (ENU)
+def default_enu_pack() -> RedactionPatternPack:
+    """Create a default ENU redaction pack with common PII patterns."""
+    return RedactionPatternPack(
+        locale="ENU",
+        patterns=[
+            RedactionPattern(
+                display_name="Phone Numbers",
+                regex=r"\b\d{3}[-.\s]\d{3}[-.\s]\d{4}\b|\b\d{3}[-.\s]\d{4}\b",
+                examples="555-123-4567, 555-1212",
+                category="phone",
+                severity="medium",
+            ),
+            RedactionPattern(
+                display_name="Credit Cards",
+                regex=r"(\b)(((\d{4}(-|\s|\.|_)?){3}(\d{3,4})))",
+                examples="1234-5678-9012-3456",
+                category="credit_card",
+                severity="high",
+            ),
+            RedactionPattern(
+                display_name="Social Security Numbers",
+                regex=r"(\b)((\d{3}(-|\s|\.|_)\d{2}(-|\s|\.|_)\d{4})|(\d{9}))(\b)",
+                examples="123-45-6789",
+                category="ssn",
+                severity="high",
+            ),
+            RedactionPattern(
+                display_name="Email Addresses",
+                regex=r"([a-zA-Z0-9_])([a-zA-Z0-9_\-\.])*@([a-zA-Z0-9\-])+\.([a-zA-Z\.]+)",
+                examples="user@example.com",
+                category="email",
+                severity="medium",
+            ),
+        ],
+        codes=[
+            RedactionCode(name="(b) (1) (A)", description="FOIA exemption"),
+            RedactionCode(name="(b) (6)", description="Personal privacy"),
+        ],
+    )
+
+
+# ── B161: Pre-Model Disqualification Rules ─────────────────────────────
+
+
+@dataclass
+class DisqualificationRule:
+    """A deterministic disqualification rule (B161)."""
+    rule_id: str
+    tag_type: str  # "table", "artifact", "toc", "any", etc.
+    tag_subtype: str = ""
+    nested_in_tag: str = ""
+    action: str = "disqualify"  # "disqualify" or "allow"
+    conditions: list[dict[str, Any]] = field(default_factory=list)
+
+
+@dataclass
+class DisqualificationResult:
+    """Result of checking disqualification rules."""
+    disqualified: bool
+    rule_id: str = ""
+    reason: str = ""
+
+
+class DisqualificationEngine:
+    """Checks candidates against deterministic rules before model calls (B161)."""
+
+    def __init__(self) -> None:
+        self._rules: list[DisqualificationRule] = []
+
+    def add_rule(self, rule: DisqualificationRule) -> None:
+        self._rules.append(rule)
+
+    def check(self, candidate: dict[str, Any]) -> DisqualificationResult:
+        """Check a candidate against all rules.
+
+        Candidate should have: tag_type, tag_subtype, nested_in (dict with tag_type).
+        """
+        for rule in self._rules:
+            if rule.tag_type != "any" and rule.tag_type != candidate.get("tag_type"):
+                continue
+            if rule.tag_subtype and rule.tag_subtype != candidate.get("tag_subtype"):
+                continue
+            if rule.nested_in_tag:
+                nested = candidate.get("nested_in", {})
+                if nested.get("tag_type") != rule.nested_in_tag:
+                    continue
+            if rule.action == "disqualify":
+                return DisqualificationResult(
+                    disqualified=True,
+                    rule_id=rule.rule_id,
+                    reason=f"disqualified by rule: {rule.rule_id}",
+                )
+        return DisqualificationResult(disqualified=False)
+
+    @property
+    def rule_count(self) -> int:
+        return len(self._rules)
+
+
+def default_disqual_controls() -> list[DisqualificationRule]:
+    """Default disqualification rules from Acrobat's disqual-controls.json."""
+    return [
+        DisqualificationRule(
+            rule_id="table_inside_list",
+            tag_type="table",
+            nested_in_tag="list",
+        ),
+        DisqualificationRule(
+            rule_id="rule_watermark",
+            tag_type="artifact",
+            tag_subtype="watermark",
+        ),
+        DisqualificationRule(
+            rule_id="toc",
+            tag_type="toc",
+        ),
+        DisqualificationRule(
+            rule_id="rule_True_MC",
+            tag_type="any",
+        ),
+    ]
+
+
+# ── B173: Native Messaging Host Allowlist ─────────────────────────────
+
+
+@dataclass
+class NativeMessagingHostManifest:
+    """A native messaging host manifest (B173)."""
+    name: str
+    description: str = ""
+    path: str = ""
+    host_type: str = "stdio"
+    allowed_origins: list[str] = field(default_factory=list)
+
+
+class NativeMessagingAllowlist:
+    """Validates incoming messages against an allowlist of origins (B173)."""
+
+    def __init__(self) -> None:
+        self._hosts: dict[str, NativeMessagingHostManifest] = {}
+
+    def register(self, manifest: NativeMessagingHostManifest) -> None:
+        self._hosts[manifest.name] = manifest
+
+    def is_allowed(self, host_name: str, origin: str) -> bool:
+        """Check if an origin is allowed for a host."""
+        host = self._hosts.get(host_name)
+        if not host:
+            return False
+        if not host.allowed_origins:
+            return False  # empty allowlist rejects all
+        return origin in host.allowed_origins
+
+    def get_host(self, name: str) -> NativeMessagingHostManifest | None:
+        return self._hosts.get(name)
+
+    def all_hosts(self) -> list[str]:
+        return list(self._hosts.keys())