alysis-code 0.13.0__py3-none-any.whl

alysis_code/safety/__init__.py

@@ -0,0 +1,11 @@
+from __future__ import annotations
+
+from .mcp_sanitize import MAX_MCP_TOOL_DESCRIPTION_CHARS, sanitize_mcp_tool_description
+from .safe_http import SafeHttpError, safe_http_request
+
+__all__ = [
+    "MAX_MCP_TOOL_DESCRIPTION_CHARS",
+    "SafeHttpError",
+    "safe_http_request",
+    "sanitize_mcp_tool_description",
+]

alysis_code/safety/mcp_sanitize.py

@@ -0,0 +1,29 @@
+from __future__ import annotations
+
+MAX_MCP_TOOL_DESCRIPTION_CHARS = 2000
+
+_STRIPPED_MCP_TOOL_DESCRIPTION_PREFIXES = (
+    "ignore previous",
+    "system:",
+    "user:",
+    "assistant:",
+    "you are now",
+    "new instructions:",
+    "<system>",
+    "</system>",
+    "[inst]",
+    "[/inst]",
+)
+
+
+def sanitize_mcp_tool_description(description: str) -> str:
+    kept_lines: list[str] = []
+    for line in str(description or "").splitlines():
+        normalized = line.lstrip().casefold()
+        if any(normalized.startswith(prefix) for prefix in _STRIPPED_MCP_TOOL_DESCRIPTION_PREFIXES):
+            continue
+        kept_lines.append(line)
+    body = "\n".join(kept_lines).strip()
+    if len(body) > MAX_MCP_TOOL_DESCRIPTION_CHARS:
+        body = body[:MAX_MCP_TOOL_DESCRIPTION_CHARS].rstrip()
+    return f"[mcp-tool-description begin]\n{body}\n[mcp-tool-description end]"

alysis_code/safety/safe_http.py

@@ -0,0 +1,297 @@
+from __future__ import annotations
+
+import ipaddress
+import socket
+from collections.abc import Callable
+from dataclasses import dataclass
+from typing import Any
+from urllib.parse import urljoin, urlsplit, urlunsplit
+
+import httpx
+
+
+class SafeHttpError(Exception):
+    """``recoverable=True`` marks failures specific to the requested URL or host
+    (a different target can succeed: oversized body, redirect problems, blocked
+    or invalid host). The default ``False`` marks environment-level failures
+    (network/DNS outage, invalid caller arguments)."""
+
+    def __init__(self, message: str, *, recoverable: bool = False) -> None:
+        super().__init__(message)
+        self.recoverable = recoverable
+
+
+_ALLOWED_SCHEMES = {"http", "https"}
+_REDIRECT_STATUS_CODES = {301, 302, 303, 307, 308}
+_DEFAULT_ACCEPT_ENCODING = "identity"
+Resolver = Callable[[str, int], list[str]]
+_DENIED_NETWORKS = tuple(
+    ipaddress.ip_network(network)
+    for network in (
+        "127.0.0.0/8",
+        "::1/128",
+        "169.254.0.0/16",
+        "fe80::/10",
+        "10.0.0.0/8",
+        "172.16.0.0/12",
+        "192.168.0.0/16",
+        "fc00::/7",
+        "0.0.0.0/32",
+        "::/128",
+        "224.0.0.0/4",
+        "ff00::/8",
+    )
+)
+
+
+@dataclass(frozen=True)
+class _SafeTarget:
+    request_url: str
+    connect_url: str
+    host_header: str
+
+
+async def safe_http_request(
+    method: str,
+    url: str,
+    *,
+    timeout: float = 30.0,
+    max_bytes: int = 10 * 1024 * 1024,
+    allow_redirects: bool = True,
+    max_redirects: int = 5,
+    headers: dict[str, str] | None = None,
+    json: Any = None,
+    content: bytes | None = None,
+    _transport: httpx.AsyncBaseTransport | None = None,
+    _resolver: Resolver | None = None,
+) -> httpx.Response:
+    if max_bytes < 0:
+        raise SafeHttpError("max_bytes must be non-negative.")
+    if max_redirects < 0:
+        raise SafeHttpError("max_redirects must be non-negative.")
+
+    current_url = str(url or "").strip()
+    if not current_url:
+        raise SafeHttpError("url must be a non-empty string.")
+    current_method = str(method or "").strip().upper() or "GET"
+    request_headers = _headers_with_default_accept_encoding(headers)
+    redirects_seen = 0
+    request_json = json
+    request_content = content
+
+    async with httpx.AsyncClient(
+        follow_redirects=False,
+        timeout=httpx.Timeout(timeout),
+        transport=_transport,
+    ) as client:
+        while True:
+            target = _validate_and_resolve_target(
+                current_url,
+                resolver=_resolver or _resolve_host_addresses,
+                use_resolved_connect_url=_transport is None,
+            )
+            try:
+                response = await _single_request(
+                    client=client,
+                    method=current_method,
+                    target=target,
+                    headers=request_headers,
+                    json=request_json,
+                    content=request_content,
+                    max_bytes=max_bytes,
+                )
+            except httpx.DecodingError as exc:
+                raise SafeHttpError(
+                    "Response decompression failed: server or proxy returned invalid "
+                    "Content-Encoding bytes. safe_http_request sends "
+                    "Accept-Encoding: identity by default; check upstream compression handling.",
+                    recoverable=True,
+                ) from exc
+            if not allow_redirects or response.status_code not in _REDIRECT_STATUS_CODES:
+                return response
+
+            location = str(response.headers.get("location") or "").strip()
+            if not location:
+                raise SafeHttpError(
+                    f"Redirect response {response.status_code} missing Location header.",
+                    recoverable=True,
+                )
+            if redirects_seen >= max_redirects:
+                raise SafeHttpError(f"Too many redirects (>{max_redirects}).", recoverable=True)
+            redirects_seen += 1
+            current_url = urljoin(current_url, location)
+            if response.status_code == 303 or (
+                response.status_code in {301, 302} and current_method not in {"GET", "HEAD"}
+            ):
+                current_method = "GET"
+                request_json = None
+                request_content = None
+
+
+def _headers_with_default_accept_encoding(headers: dict[str, str] | None) -> dict[str, str]:
+    request_headers = dict(headers or {})
+    if not any(key.lower() == "accept-encoding" for key in request_headers):
+        request_headers["Accept-Encoding"] = _DEFAULT_ACCEPT_ENCODING
+    return request_headers
+
+
+async def _single_request(
+    *,
+    client: httpx.AsyncClient,
+    method: str,
+    target: _SafeTarget,
+    headers: dict[str, str],
+    json: Any,
+    content: bytes | None,
+    max_bytes: int,
+) -> httpx.Response:
+    outbound_headers = dict(headers)
+    outbound_headers["Host"] = target.host_header
+    request = httpx.Request(method, target.request_url, headers=outbound_headers)
+    body = bytearray()
+    response_headers: httpx.Headers | None = None
+    status_code = 0
+    extensions: dict[str, Any] = {}
+    async with client.stream(
+        method,
+        target.connect_url,
+        headers=outbound_headers,
+        json=json,
+        content=content,
+    ) as response:
+        status_code = int(response.status_code)
+        response_headers = httpx.Headers(response.headers)
+        extensions = dict(response.extensions)
+        async for chunk in response.aiter_bytes():
+            if not chunk:
+                continue
+            if len(body) + len(chunk) > max_bytes:
+                raise SafeHttpError(
+                    f"Response body exceeded max_bytes={max_bytes}.", recoverable=True
+                )
+            body.extend(chunk)
+    return httpx.Response(
+        status_code=status_code,
+        headers=response_headers,
+        content=bytes(body),
+        request=request,
+        extensions=extensions,
+    )
+
+
+def _validate_and_resolve_target(
+    url: str,
+    *,
+    resolver: Resolver,
+    use_resolved_connect_url: bool,
+) -> _SafeTarget:
+    split = urlsplit(str(url or "").strip())
+    scheme = split.scheme.lower()
+    if scheme not in _ALLOWED_SCHEMES:
+        raise SafeHttpError(
+            f"Unsupported URL scheme: {split.scheme or '(missing)'}", recoverable=True
+        )
+    if split.hostname is None:
+        raise SafeHttpError("URL must include a hostname.", recoverable=True)
+    if split.username is not None or split.password is not None:
+        raise SafeHttpError("Embedded URL credentials are not allowed.", recoverable=True)
+    try:
+        port = split.port
+    except ValueError as exc:
+        raise SafeHttpError("URL has an invalid port value.", recoverable=True) from exc
+    if port is None:
+        port = 443 if scheme == "https" else 80
+
+    host = split.hostname
+    try:
+        literal_address = ipaddress.ip_address(host)
+    except ValueError:
+        literal_address = None
+    if literal_address is not None:
+        reason = _blocked_ip_reason(literal_address)
+        if reason is not None:
+            raise SafeHttpError(
+                f"Blocked URL host '{host}': resolved to denied address(es): "
+                f"{literal_address.compressed} ({reason}).",
+                recoverable=True,
+            )
+
+    addresses = resolver(host, port)
+    parsed_addresses = [_parse_ip_address(address, host=host) for address in addresses]
+    blocked = [
+        f"{address.compressed} ({_blocked_ip_reason(address)})"
+        for address in parsed_addresses
+        if _blocked_ip_reason(address) is not None
+    ]
+    if blocked:
+        raise SafeHttpError(
+            f"Blocked URL host '{host}': resolved to denied address(es): {', '.join(blocked)}.",
+            recoverable=True,
+        )
+
+    host_header = _host_header(host=host, port=split.port, scheme=scheme)
+    request_url = urlunsplit((split.scheme, split.netloc, split.path, split.query, ""))
+    if use_resolved_connect_url and scheme != "https":
+        connect_ip = parsed_addresses[0].compressed
+        connect_host = f"[{connect_ip}]" if ":" in connect_ip else connect_ip
+        connect_netloc = _host_header(host=connect_host, port=port, scheme=scheme, force_port=True)
+        connect_url = urlunsplit((split.scheme, connect_netloc, split.path, split.query, ""))
+    else:
+        # HTTPS must keep the original hostname for SNI and certificate validation.
+        # The DNS result is still preflight-validated above for SSRF-denied ranges.
+        connect_url = request_url
+    return _SafeTarget(
+        request_url=request_url,
+        connect_url=connect_url,
+        host_header=host_header,
+    )
+
+
+def _resolve_host_addresses(host: str, port: int) -> list[str]:
+    try:
+        infos = socket.getaddrinfo(host, port, type=socket.SOCK_STREAM)
+    except OSError as exc:
+        raise SafeHttpError(f"Failed to resolve host '{host}': {exc}") from exc
+    addresses: list[str] = []
+    seen: set[str] = set()
+    for _family, _socktype, _proto, _canonname, sockaddr in infos:
+        if not sockaddr:
+            continue
+        address = str(sockaddr[0] or "").strip()
+        if address and address not in seen:
+            seen.add(address)
+            addresses.append(address)
+    if not addresses:
+        raise SafeHttpError(f"Host '{host}' did not resolve to any address.", recoverable=True)
+    return addresses
+
+
+def _parse_ip_address(value: str, *, host: str) -> ipaddress._BaseAddress:
+    try:
+        return ipaddress.ip_address(value)
+    except ValueError as exc:
+        raise SafeHttpError(
+            f"Resolver returned a non-IP address for host '{host}': {value!r}",
+            recoverable=True,
+        ) from exc
+
+
+def _blocked_ip_reason(address: ipaddress._BaseAddress) -> str | None:
+    for network in _DENIED_NETWORKS:
+        if address.version == network.version and address in network:
+            return str(network)
+    return None
+
+
+def _host_header(
+    *,
+    host: str,
+    port: int | None,
+    scheme: str,
+    force_port: bool = False,
+) -> str:
+    bracketed_host = f"[{host}]" if ":" in host and not host.startswith("[") else host
+    default_port = 443 if scheme == "https" else 80
+    if port is None or (port == default_port and not force_port):
+        return bracketed_host
+    return f"{bracketed_host}:{port}"

alysis_code/safety/subagent_report.py

@@ -0,0 +1,184 @@
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from typing import Any
+
+_MAX_REPORTED_TAGS = 16
+_MAX_REPORTED_TAG_CHARS = 64
+
+_ROLE_TAGS = frozenset({"assistant", "developer", "function", "system", "tool", "user"})
+_HARNESS_TAGS = frozenset(
+    {
+        "asset_content",
+        "asset_summary",
+        "asset_text",
+        "assistant_summary",
+        "available_tool_catalog",
+        "environment_context",
+        "explicit_skill_context",
+        "matched_skill_context",
+        "ocr_text",
+        "repo_conventions",
+        "resume_context",
+        "scoped_prompt_prelude",
+        "skill_context",
+        "skill_instructions",
+        "subagent_context",
+        "subagent_turn_context",
+        "task_brief",
+        "tool_call",
+        "workspace_binding_context",
+    }
+)
+
+_TAG_RE = re.compile(
+    r"<\s*/?\s*(?P<name>[A-Za-z][A-Za-z0-9:_-]*)\b[^<>]*>",
+    flags=re.IGNORECASE,
+)
+_ESCAPED_TAG_RE = re.compile(
+    r"&lt;\s*/?\s*(?P<name>[A-Za-z][A-Za-z0-9:_-]*)\b.*?&gt;",
+    flags=re.IGNORECASE,
+)
+_BLOCKED_INSTRUCTION_MARKER_RE = re.compile(
+    r"\[blocked untrusted subagent "
+    r"(?:instruction_override|permission_override|tool_demand)\]",
+    flags=re.IGNORECASE,
+)
+
+_HIGH_RISK_PATTERNS: tuple[tuple[str, tuple[re.Pattern[str], ...]], ...] = (
+    (
+        "instruction_override",
+        (
+            re.compile(
+                r"\b(?:ignore|disregard|forget|override|bypass)\s+"
+                r"(?:(?:all|any|the|your)\s+)?"
+                r"(?:previous|prior|above|earlier|system|developer|parent)\s+"
+                r"(?:instructions?|rules?|directives?|prompts?)\b",
+                flags=re.IGNORECASE,
+            ),
+            re.compile(
+                r"\b(?:follow|obey|use)\s+(?:these|the\s+following|my|new)\s+"
+                r"instructions?\s+(?:instead|now)\b",
+                flags=re.IGNORECASE,
+            ),
+        ),
+    ),
+    (
+        "permission_override",
+        (
+            re.compile(
+                r"\b(?:grant|escalate|elevate|change|set|switch|override|enable|disable|bypass)\s+"
+                r"(?:(?:the|your|parent|session)\s+)?"
+                r"(?:permissions?|permission\s+mode|sandbox(?:\s+mode)?|approval(?:\s+mode)?)"
+                r"(?:\s+(?:to|as)\s+[A-Za-z0-9_-]+)?\b",
+                flags=re.IGNORECASE,
+            ),
+            re.compile(
+                r"\b(?:you|the\s+parent|parent|assistant|main\s+agent)\s+(?:now\s+)?"
+                r"(?:have|has)\s+(?:full|unrestricted|elevated)\s+"
+                r"(?:access|permissions?)\b",
+                flags=re.IGNORECASE,
+            ),
+        ),
+    ),
+    (
+        "tool_demand",
+        (
+            re.compile(
+                r"\b(?:you|the\s+parent|parent|assistant|main\s+agent)\s+"
+                r"(?:must|should|shall|need(?:s)?\s+to)\s+(?:now\s+)?"
+                r"(?:call|run|invoke|use|execute)\s+(?:the\s+)?"
+                r"(?:[A-Za-z][A-Za-z0-9.-]*_[A-Za-z0-9_.-]+|"
+                r"[A-Za-z][A-Za-z0-9_.-]*\s+tool)\b",
+                flags=re.IGNORECASE,
+            ),
+            re.compile(
+                r"\b(?:call|run|invoke|use|execute)\s+(?:the\s+)?"
+                r"(?:[A-Za-z][A-Za-z0-9.-]*_[A-Za-z0-9_.-]+|"
+                r"[A-Za-z][A-Za-z0-9_.-]*\s+tool)\s+(?:now|instead)\b",
+                flags=re.IGNORECASE,
+            ),
+        ),
+    ),
+)
+
+
+@dataclass(frozen=True, slots=True)
+class SanitizedSubagentReport:
+    text: str
+    sanitized: bool
+    detected_categories: tuple[str, ...] = ()
+    detected_tags: tuple[str, ...] = ()
+
+    def metadata(self) -> dict[str, Any]:
+        return {
+            "sanitized": self.sanitized,
+            "detected_categories": list(self.detected_categories),
+            "detected_tags": list(self.detected_tags),
+        }
+
+
+def _tag_category(tag_name: str) -> str | None:
+    normalized = tag_name.casefold()
+    if normalized in _ROLE_TAGS:
+        return "role_tag"
+    if (
+        normalized in _HARNESS_TAGS
+        or normalized.endswith("_context")
+        or normalized.startswith("alysis_")
+    ):
+        return "harness_tag"
+    return None
+
+
+def sanitize_subagent_report(text: str) -> SanitizedSubagentReport:
+    original = str(text or "")
+    categories: set[str] = set()
+    tags: set[str] = set()
+
+    def _escape_tag(match: re.Match[str]) -> str:
+        tag_name = str(match.group("name") or "")
+        category = _tag_category(tag_name)
+        if category is None:
+            return match.group(0)
+        categories.add(category)
+        tags.add(tag_name.casefold()[:_MAX_REPORTED_TAG_CHARS])
+        return match.group(0).replace("<", "&lt;").replace(">", "&gt;")
+
+    sanitized_text = _TAG_RE.sub(_escape_tag, original)
+    for category, patterns in _HIGH_RISK_PATTERNS:
+        for pattern in patterns:
+            sanitized_text, replacements = pattern.subn(
+                f"[blocked untrusted subagent {category}]",
+                sanitized_text,
+            )
+            if replacements:
+                categories.add(category)
+
+    ordered_categories = tuple(
+        category
+        for category in (
+            "role_tag",
+            "harness_tag",
+            "instruction_override",
+            "permission_override",
+            "tool_demand",
+        )
+        if category in categories
+    )
+    ordered_tags = tuple(sorted(tags)[:_MAX_REPORTED_TAGS])
+    return SanitizedSubagentReport(
+        text=sanitized_text,
+        sanitized=sanitized_text != original,
+        detected_categories=ordered_categories,
+        detected_tags=ordered_tags,
+    )
+
+
+def subagent_report_evidence_text(text: str) -> str:
+    def _remove_protected_wrapper(match: re.Match[str]) -> str:
+        return " " if _tag_category(str(match.group("name") or "")) is not None else match.group(0)
+
+    without_wrappers = _ESCAPED_TAG_RE.sub(_remove_protected_wrapper, str(text or ""))
+    return _BLOCKED_INSTRUCTION_MARKER_RE.sub(" ", without_wrappers)