aria-code 0.167.0__py3-none-win_amd64.whl

aria_code/safety/sandbox.py

@@ -0,0 +1,148 @@
+"""Confine run_command to what the permission mode says, at the OS level.
+
+"workspace-write" and "network off" were checks on the command text: a
+pattern list caught `curl` and `rm -rf /`, but a script could still write
+anywhere in the home directory and open any connection. On macOS a command
+now runs under sandbox-exec (Seatbelt), as Codex does:
+
+- workspace-write: writes only to the command's directory (and the git
+  repository it is in), Aria's output folders, temporary directories and /dev.
+- read-only: writes only to temporary directories and /dev.
+- network off: no outbound IP connections at all, localhost included, since a
+  local proxy would otherwise carry traffic out.
+- full-access, or ``os_sandbox: off`` in the config: no sandbox.
+
+On Linux, bubblewrap (when installed) provides the equivalent read-only root
+and writable-root mounts plus an isolated network namespace. If it is absent,
+or on Windows, command policy still applies; capability() reports the limit.
+"""
+
+from __future__ import annotations
+
+import os
+import shutil
+import sys
+import tempfile
+from pathlib import Path
+from typing import Iterable, Sequence
+
+SANDBOX_EXEC = "/usr/bin/sandbox-exec"
+CONFINED_MODES = ("read-only", "workspace-write")
+
+
+def available() -> bool:
+    return (sys.platform == "darwin" and os.access(SANDBOX_EXEC, os.X_OK)) or (
+        sys.platform.startswith("linux") and bool(shutil.which("bwrap"))
+    )
+
+
+def capability(setting: object = None) -> str:
+    if not enabled(setting):
+        return "disabled"
+    if not available():
+        return "policy-only"
+    return "bubblewrap" if sys.platform.startswith("linux") else "seatbelt"
+
+
+def enabled(setting: object = None) -> bool:
+    """False when the user turned it off (config os_sandbox, or ARIA_OS_SANDBOX)."""
+    value = setting if setting not in (None, "") else os.environ.get("ARIA_OS_SANDBOX", "auto")
+    return str(value).strip().lower() not in ("off", "false", "0", "no", "disabled")
+
+
+def _real(path: Path | str) -> str | None:
+    try:
+        return os.path.realpath(os.path.expanduser(str(path)))
+    except (OSError, ValueError):
+        return None
+
+
+def _git_root(start: Path) -> Path | None:
+    for directory in (start, *start.parents):
+        if (directory / ".git").exists():
+            return directory
+    return None
+
+
+def writable_roots(mode: str, cwd: Path | str | None, extra: Iterable[Path | str] = ()) -> list[str]:
+    """Directories a command may write to under ``mode``, as real paths."""
+    roots: list[Path | str] = ["/dev", "/tmp", "/private/var/folders", tempfile.gettempdir()]
+    if os.environ.get("TMPDIR"):
+        roots.append(os.environ["TMPDIR"])
+    if mode == "workspace-write":
+        here = Path(cwd or os.getcwd()).expanduser()
+        roots.append(here)
+        repo = _git_root(here.resolve())
+        if repo:
+            roots.append(repo)
+        try:
+            from aria_code.artifacts import artifact_root, user_output_root
+            roots += [user_output_root(), artifact_root()]
+        except Exception:
+            pass
+        roots += list(extra)
+    seen: dict[str, None] = {}
+    for root in roots:
+        real = _real(root)
+        if real and real != "/":
+            seen[real] = None
+    return list(seen)
+
+
+def _quote(path: str) -> str:
+    return '"' + path.replace("\\", "\\\\").replace('"', '\\"') + '"'
+
+
+def profile(roots: Sequence[str], network: bool) -> str:
+    """A Seatbelt profile: everything allowed except writes outside ``roots`` (and the network if off)."""
+    keep = " ".join(f"(require-not (subpath {_quote(r)}))" for r in roots)
+    lines = ["(version 1)", "(allow default)", f"(deny file-write* (require-all {keep}))"]
+    if not network:
+        lines.append('(deny network-outbound (remote ip "*:*"))')
+    return "\n".join(lines)
+
+
+def wrap(command: str | Sequence[str], *, use_shell: bool, mode: str, network: bool,
+         cwd: Path | str | None = None, setting: object = None,
+         workspace: Path | str | None = None, extra: Iterable[Path | str] = ()) -> list[str] | None:
+    """The argv that runs ``command`` in the sandbox, or None to run it as is."""
+    if mode not in CONFINED_MODES or not enabled(setting) or not available():
+        return None
+    roots = writable_roots(mode, workspace or cwd, extra)
+    if use_shell or isinstance(command, str):
+        shell = shutil.which("sh") or "/bin/sh"
+        body = command if isinstance(command, str) else " ".join(command)
+        argv = [shell, "-c", body]
+    else:
+        argv = list(command)
+    if sys.platform.startswith("linux"):
+        # No fallback after launch failure: a kernel that forbids namespaces
+        # must return the bwrap error, never execute the command unconfined.
+        wrapped = [shutil.which("bwrap") or "bwrap", "--die-with-parent", "--new-session",
+                   "--unshare-pid", "--unshare-ipc", "--unshare-uts", "--ro-bind", "/", "/",
+                   "--proc", "/proc", "--dev", "/dev"]
+        if not network:
+            wrapped.append("--unshare-net")
+        for root in roots:
+            if root not in ("/dev", "/proc", "/") and os.path.isdir(root):
+                wrapped += ["--bind", root, root]
+        return [*wrapped, "--chdir", _real(cwd or os.getcwd()) or "/", "--", *argv]
+    return [SANDBOX_EXEC, "-p", profile(roots, network), *argv]
+
+
+def denial_hint(text: str, *, mode: str, network: bool) -> str:
+    """What to tell the model when the sandbox stopped a command."""
+    if not any(error in text for error in ("Operation not permitted", "Read-only file system",
+                                           "Network is unreachable", "bwrap:")):
+        return ""
+    limits = ["writes outside the project, Aria's output folder and temporary directories"
+              if mode == "workspace-write" else "all writes outside temporary directories"]
+    if not network:
+        limits.append("network access")
+    return (f"The command ran in the {mode} sandbox, which blocks {' and '.join(limits)}. "
+            "Do not retry it as is. If it needs more, tell the user what and why; they can switch "
+            "the permission mode (Shift+Tab, or /config set permission_mode=full-access) or turn "
+            "the network on (/config set network_enabled=true).")
+
+
+__all__ = ["available", "enabled", "capability", "writable_roots", "profile", "wrap", "denial_hint"]

aria_code/safety/service.py

@@ -0,0 +1,102 @@
+"""SafetyService — one facade over Aria's three safety domains.
+
+The architecture contract's safety layer calls for command policy, broker
+risk policy, and privacy controls to be reachable through a single service
+(registry spec ``safety`` → SafetyService, capabilities: command.policy,
+privacy, audit, sandbox). The three implementations already exist and stay
+where they are; this facade composes them behind one config-driven object so
+launcher/daemon/CLI/MCP consumers stop reaching into three packages with
+three different conventions:
+
+  • command/tool policy   → safety.permissions.PermissionService
+  • privacy controls      → privacy.PrivacySettings           (lazy import)
+  • broker/trading risk   → brokers.trading policy helpers    (lazy import)
+
+Cross-domain imports are deferred to call time, so importing ``safety``
+never drags in broker or privacy modules (mirrors SettingsService's
+injection-clean layering).
+"""
+
+from __future__ import annotations
+
+from typing import Any, Dict, Optional
+
+from .permissions import PermissionDecision, PermissionService, classify_command_risk
+
+
+class SafetyService:
+    """Config-driven facade over command, privacy, and trading safety."""
+
+    def __init__(self, config: Optional[Dict[str, Any]] = None) -> None:
+        self._config: Dict[str, Any] = dict(config or {})
+        self._permissions = self._build_permissions(self._config)
+
+    # ── lifecycle ────────────────────────────────────────────────────────────
+
+    @staticmethod
+    def _build_permissions(config: Dict[str, Any]) -> PermissionService:
+        return PermissionService(
+            mode=config.get("permission_mode", "workspace-write"),
+            command_policy=config.get("command_policy", "safe"),
+            network_enabled=bool(config.get("network_enabled", True)),
+        )
+
+    def refresh(self, config: Dict[str, Any]) -> None:
+        """Rebuild policy state after a config change (e.g. /config set)."""
+        self._config = dict(config)
+        self._permissions = self._build_permissions(self._config)
+
+    # ── command / tool policy (capability: command.policy) ──────────────────
+
+    @property
+    def permissions(self) -> PermissionService:
+        return self._permissions
+
+    def evaluate_tool(self, tool_name: str, params: Optional[Dict[str, Any]] = None) -> PermissionDecision:
+        return self._permissions.evaluate_tool(tool_name, params)
+
+    def evaluate_command(self, command: str, policy: Optional[str] = None) -> PermissionDecision:
+        return self._permissions.evaluate_command(command, policy)
+
+    def classify_risk(self, command: str) -> str:
+        return classify_command_risk(command)
+
+    # ── privacy controls (capability: privacy) ──────────────────────────────
+
+    def privacy(self):
+        """Current PrivacySettings derived from config."""
+        # Package-qualified on purpose. The bare `privacy` and the packaged
+        # `aria_code.privacy` are distinct module objects with distinct class
+        # objects, and every other caller in the tree uses the packaged form —
+        # importing it bare here handed those callers a PrivacySettings that
+        # was not the PrivacySettings they compare against.
+        #
+        # The trading helpers below stay bare precisely because the opposite is
+        # true there: every brokers.trading caller in the tree is bare, so the
+        # packaged form is what would split the class.
+        from aria_code.privacy import PrivacySettings
+        return PrivacySettings.from_config(self._config)
+
+    # ── broker / trading risk (capability: audit — trading is the audited
+    #    domain today; the jsonl audit sink lives with the trading policy) ───
+
+    def trading_policy(self, broker_type: str = ""):
+        """TradingPolicy resolved from config (paper/live, confirm, limits)."""
+        from brokers.trading import policy_from_config
+        return policy_from_config(self._config, broker_type)
+
+    def trading_mode(self, broker_type: str = "") -> str:
+        from brokers.trading import resolve_trading_mode
+        return resolve_trading_mode(self._config, broker_type)
+
+    def trading_dry_run(self) -> bool:
+        """Global operational kill-switch (env ARIA_DRY_RUN).
+
+        The name matters: this docstring is the only documentation the switch
+        has — no .md file mentions it — and it used to name a variable that
+        nothing reads. Anyone who followed it to freeze live trading got no
+        freeze and no error. tests/test_env_switch_docs.py now fails if any
+        docstring names an ARIA_* variable the tree never reads.
+        """
+        from brokers.trading import global_dry_run
+        return global_dry_run()

aria_code/service_endpoints.py

@@ -0,0 +1,14 @@
+"""Current production hosts; retired hosts must never receive account tokens."""
+
+from urllib.parse import urlsplit
+
+API_URL = "https://api.arthera.xyz"
+SITE_URL = "https://arthera.xyz"
+
+
+def current_url(url: str, *, website=False) -> str:
+    value = (url or "").strip().rstrip("/")
+    host = (urlsplit(value).hostname or "").lower()
+    if host == "arthera.finance" or host.endswith(".arthera.finance"):
+        return SITE_URL if website else API_URL
+    return value