aria-code 0.52.0__py3-none-any.whl

aria_code/safety/permissions.py

@@ -0,0 +1,306 @@
+"""Unified permission and command-risk policy for Aria Code."""
+
+from __future__ import annotations
+
+import shlex
+from dataclasses import dataclass
+from enum import Enum
+from typing import Any, Dict
+
+
+SAFE_POLICIES = {"safe", "balanced", "full"}
+
+
+class PermissionMode(str, Enum):
+    READ_ONLY = "read-only"
+    WORKSPACE_WRITE = "workspace-write"
+    FULL_ACCESS = "full-access"
+
+
+@dataclass(frozen=True)
+class PolicyDecision:
+    allowed: bool
+    normalized_command: str
+    policy: str
+    risk: str
+    reason: str = ""
+    requires_approval: bool = False
+    network: bool = False
+
+
+@dataclass(frozen=True)
+class PermissionDecision:
+    allowed: bool
+    requires_approval: bool
+    risk: str
+    reason: str
+    normalized_command: str = ""
+    network: bool = False
+
+
+def normalize_command(command) -> str:
+    """Normalize common macOS command aliases used by models/users."""
+    if isinstance(command, list):
+        import shlex as _shlex
+        command = _shlex.join(str(c) for c in command)
+    raw = (command or "").strip()
+    if not raw:
+        return ""
+    try:
+        parts = shlex.split(raw)
+    except ValueError:
+        parts = []
+    if parts:
+        if parts[0] == "python":
+            parts[0] = "python3"
+        elif parts[0] == "pip":
+            parts[0] = "pip3"
+        return shlex.join(parts)
+    if raw.startswith("python ") and not raw.startswith("python3"):
+        return "python3" + raw[6:]
+    if raw == "python":
+        return "python3"
+    if raw.startswith("pip ") and not raw.startswith("pip3"):
+        return "pip3" + raw[3:]
+    if raw == "pip":
+        return "pip3"
+    return raw
+
+
+def command_uses_network(command: str) -> bool:
+    stripped = command.lower().strip()
+    network_prefixes = (
+        "curl ", "wget ", "http ", "https ", "gh ", "git fetch", "git pull",
+        "git push", "pip3 install", "pip install", "npm install", "npm i ",
+        "pnpm install", "yarn install", "brew install",
+    )
+    return any(stripped.startswith(prefix) for prefix in network_prefixes)
+
+
+def is_verification_command(command: str) -> bool:
+    stripped = command.lower().strip()
+    prefixes = (
+        "python3 -m py_compile",
+        "python -m py_compile",
+        "python3 -m pytest",
+        "python -m pytest",
+        "pytest",
+        "npm test",
+        "npm run test",
+        "npm run build",
+        "npx tsc --noemit",
+        "npx tsc --noEmit".lower(),
+        "tsc --noemit",
+        "go test",
+        "cargo test",
+        "mypy",
+        "ruff check",
+    )
+    return any(stripped.startswith(prefix) for prefix in prefixes)
+
+
+def classify_command_risk(command) -> str:
+    """Classify command risk into low/medium/high."""
+    if isinstance(command, list):
+        import shlex as _shlex
+        command = _shlex.join(str(c) for c in command)
+    normalized = f" {str(command).lower().strip()} "
+    stripped = normalized.strip()
+
+    high_risk_patterns = (
+        " rm ", " rm -", "chmod ", "chown ", "mkfs", "dd if=", "docker ", "kubectl ",
+        "shutdown", "reboot", "systemctl ", "launchctl ", "passwd", "sudo ",
+        "git push", "git reset --hard", "git checkout --", "mv ",
+        "> /dev/", ":(){ :", "fork bomb",
+    )
+    low_risk_prefixes = (
+        "ls", "pwd", "echo", "cat ", "head ", "tail ", "rg ", "find ", "git status",
+        "git diff", "git log", "which ", "whoami", "date", "uname ", "env",
+        "python3 --version", "node --version", "npm --version",
+    )
+    medium_risk_prefixes = (
+        "pip ", "pip3 ", "npm install", "npm i ", "npm run ", "python ", "python3 ",
+        "pytest", "make ", "go test", "cargo test", "git commit", "git pull", "git merge",
+        "gh ", "curl ", "wget ",
+    )
+
+    if any(pattern in normalized for pattern in high_risk_patterns):
+        return "high"
+    if stripped.startswith(low_risk_prefixes):
+        return "low"
+    if stripped.startswith(medium_risk_prefixes) or is_verification_command(stripped):
+        return "medium"
+    return "medium"
+
+
+class PermissionService:
+    """Central policy for tools and shell-command execution."""
+
+    READ_TOOLS = {"read_file", "list_files", "search_code", "project_context", "git_status", "git_diff"}
+    WRITE_TOOLS = {"write_file", "edit_file", "apply_change", "apply_patch", "reject_change"}
+
+    def __init__(
+        self,
+        mode: PermissionMode | str = PermissionMode.WORKSPACE_WRITE,
+        command_policy: str = "safe",
+        network_enabled: bool = True,
+    ) -> None:
+        try:
+            self.mode = PermissionMode(mode)
+        except ValueError:
+            self.mode = PermissionMode.WORKSPACE_WRITE
+        self.command_policy = command_policy if command_policy in SAFE_POLICIES else "safe"
+        self.network_enabled = network_enabled
+
+    def evaluate_tool(self, tool_name: str, params: Dict[str, Any] | None = None) -> PermissionDecision:
+        name = (tool_name or "").strip()
+        if name in self.READ_TOOLS:
+            return PermissionDecision(True, False, "low", "Read-only tool allowed.")
+        if name in self.WRITE_TOOLS:
+            if self.mode == PermissionMode.READ_ONLY:
+                return PermissionDecision(False, False, "medium", "Writes are blocked in read-only mode.")
+            return PermissionDecision(
+                True,
+                self.mode != PermissionMode.FULL_ACCESS,
+                "medium",
+                "Write requires review or explicit approval before disk mutation.",
+            )
+        if name == "run_command":
+            return self.evaluate_command(str((params or {}).get("command", "")))
+        return PermissionDecision(False, False, "unknown", f"Unknown tool '{name}' is blocked.")
+
+    def evaluate_command(self, command: str, policy: str | None = None) -> PermissionDecision:
+        decision = evaluate_command_policy(
+            command,
+            policy or self.command_policy,
+            mode=self.mode.value,
+            network_enabled=self.network_enabled,
+        )
+        return PermissionDecision(
+            allowed=decision.allowed,
+            requires_approval=decision.requires_approval,
+            risk=decision.risk,
+            reason=decision.reason or "Command allowed.",
+            normalized_command=decision.normalized_command,
+            network=decision.network,
+        )
+
+
+def evaluate_command_policy(
+    command: str,
+    policy: str = "safe",
+    *,
+    mode: str = PermissionMode.WORKSPACE_WRITE.value,
+    network_enabled: bool = True,
+) -> PolicyDecision:
+    """Return policy decision for command execution."""
+    normalized = normalize_command(command)
+    selected_policy = (policy or "safe").strip().lower()
+    if selected_policy not in SAFE_POLICIES:
+        selected_policy = "safe"
+    try:
+        selected_mode = PermissionMode(mode)
+    except ValueError:
+        # Fail closed. An unrecognised mode used to resolve to WORKSPACE_WRITE,
+        # which is more permissive than READ_ONLY, not less: under read-only a
+        # write command is a hard block, while under workspace-write it is a
+        # block the user can unlock by approving. Resolving an invalid value to
+        # the laxer of the two turns a typo — or a caller passing a *policy*
+        # name into the *mode* slot — into an approval prompt that should never
+        # have been offered.
+        selected_mode = PermissionMode.READ_ONLY
+
+    risk = classify_command_risk(normalized)
+    network = command_uses_network(normalized)
+    if network and not network_enabled:
+        return PolicyDecision(
+            allowed=False,
+            normalized_command=normalized,
+            policy=selected_policy,
+            risk=risk,
+            reason=f"Network command blocked by policy: {normalized}",
+            requires_approval=False,
+            network=True,
+        )
+    if selected_mode == PermissionMode.READ_ONLY and risk != "low":
+        return PolicyDecision(
+            allowed=False,
+            normalized_command=normalized,
+            policy=selected_policy,
+            risk=risk,
+            reason=f"Command blocked by read-only mode (risk={risk}): {normalized}",
+            requires_approval=False,
+            network=network,
+        )
+    if risk == "high" and selected_policy != "full":
+        return PolicyDecision(
+            allowed=False,
+            normalized_command=normalized,
+            policy=selected_policy,
+            risk=risk,
+            reason=(
+                f"Command blocked by policy '{selected_policy}' (risk={risk}): {normalized}. "
+                "Use /config set command_policy=full only if you understand the risk."
+            ),
+            requires_approval=selected_policy == "balanced",
+            network=network,
+        )
+    # Verification is the one class of command the agent must be able to run
+    # under the default policy. `safe` blocked pytest, py_compile, npm test and
+    # tsc --noEmit, so the loop could write a fix and then had no way to find
+    # out whether it worked — and the model said so out loud: "由于安全策略的
+    # 限制，我无法执行 pytest ... 但我相信测试应该能够通过". An agent that
+    # cannot check its own work is guessing, and the whole acceptance gate rests
+    # on being able to run exactly these commands.
+    #
+    # The exposure is small and bounded by what `is_verification_command`
+    # matches: test and type-check runners, anchored at the start of the
+    # command. It stays subject to read-only mode and to the network rule
+    # above, and `high` risk was already rejected before this point — so a
+    # command like `pytest && rm -rf /` never reaches here.
+    if selected_policy == "safe" and risk != "low" and is_verification_command(normalized):
+        return PolicyDecision(
+            allowed=True,
+            normalized_command=normalized,
+            policy=selected_policy,
+            risk=risk,
+            reason="",
+            requires_approval=False,
+            network=network,
+        )
+
+    if selected_policy == "safe" and risk != "low":
+        extra = ""
+        norm_low = normalized.lower()
+        if "pip3" in norm_low or "pip " in norm_low or norm_low.startswith("pip"):
+            extra = (
+                "\n\n💡 依赖安装提示：运行 `/config set command_policy=balanced` 后重试，"
+                "或手动在终端执行该命令。不要重试相同命令！"
+            )
+        elif "python" in norm_low and ("~/" in normalized or "/Desktop/" in normalized):
+            extra = (
+                "\n\n💡 脚本执行提示：运行 `/config set command_policy=balanced` 后重试。"
+                "不要重试相同命令！"
+            )
+        return PolicyDecision(
+            allowed=False,
+            normalized_command=normalized,
+            policy=selected_policy,
+            risk=risk,
+            reason=(
+                f"Command blocked by policy '{selected_policy}' (risk={risk}): {normalized}. "
+                "Use /config set command_policy=balanced or /run --dry-run <cmd> first."
+                + extra
+            ),
+            requires_approval=True,
+            network=network,
+        )
+    return PolicyDecision(
+        allowed=True,
+        normalized_command=normalized,
+        policy=selected_policy,
+        risk=risk,
+        reason="",
+        requires_approval=False,
+        network=network,
+    )

aria_code/safety/service.py

@@ -0,0 +1,102 @@
+"""SafetyService — one facade over Aria's three safety domains.
+
+The architecture contract's safety layer calls for command policy, broker
+risk policy, and privacy controls to be reachable through a single service
+(registry spec ``safety`` → SafetyService, capabilities: command.policy,
+privacy, audit, sandbox). The three implementations already exist and stay
+where they are; this facade composes them behind one config-driven object so
+launcher/daemon/CLI/MCP consumers stop reaching into three packages with
+three different conventions:
+
+  • command/tool policy   → safety.permissions.PermissionService
+  • privacy controls      → privacy.PrivacySettings           (lazy import)
+  • broker/trading risk   → brokers.trading policy helpers    (lazy import)
+
+Cross-domain imports are deferred to call time, so importing ``safety``
+never drags in broker or privacy modules (mirrors SettingsService's
+injection-clean layering).
+"""
+
+from __future__ import annotations
+
+from typing import Any, Dict, Optional
+
+from .permissions import PermissionDecision, PermissionService, classify_command_risk
+
+
+class SafetyService:
+    """Config-driven facade over command, privacy, and trading safety."""
+
+    def __init__(self, config: Optional[Dict[str, Any]] = None) -> None:
+        self._config: Dict[str, Any] = dict(config or {})
+        self._permissions = self._build_permissions(self._config)
+
+    # ── lifecycle ────────────────────────────────────────────────────────────
+
+    @staticmethod
+    def _build_permissions(config: Dict[str, Any]) -> PermissionService:
+        return PermissionService(
+            mode=config.get("permission_mode", "workspace-write"),
+            command_policy=config.get("command_policy", "safe"),
+            network_enabled=bool(config.get("network_enabled", True)),
+        )
+
+    def refresh(self, config: Dict[str, Any]) -> None:
+        """Rebuild policy state after a config change (e.g. /config set)."""
+        self._config = dict(config)
+        self._permissions = self._build_permissions(self._config)
+
+    # ── command / tool policy (capability: command.policy) ──────────────────
+
+    @property
+    def permissions(self) -> PermissionService:
+        return self._permissions
+
+    def evaluate_tool(self, tool_name: str, params: Optional[Dict[str, Any]] = None) -> PermissionDecision:
+        return self._permissions.evaluate_tool(tool_name, params)
+
+    def evaluate_command(self, command: str, policy: Optional[str] = None) -> PermissionDecision:
+        return self._permissions.evaluate_command(command, policy)
+
+    def classify_risk(self, command: str) -> str:
+        return classify_command_risk(command)
+
+    # ── privacy controls (capability: privacy) ──────────────────────────────
+
+    def privacy(self):
+        """Current PrivacySettings derived from config."""
+        # Package-qualified on purpose. The bare `privacy` and the packaged
+        # `aria_code.privacy` are distinct module objects with distinct class
+        # objects, and every other caller in the tree uses the packaged form —
+        # importing it bare here handed those callers a PrivacySettings that
+        # was not the PrivacySettings they compare against.
+        #
+        # The trading helpers below stay bare precisely because the opposite is
+        # true there: every brokers.trading caller in the tree is bare, so the
+        # packaged form is what would split the class.
+        from aria_code.privacy import PrivacySettings
+        return PrivacySettings.from_config(self._config)
+
+    # ── broker / trading risk (capability: audit — trading is the audited
+    #    domain today; the jsonl audit sink lives with the trading policy) ───
+
+    def trading_policy(self, broker_type: str = ""):
+        """TradingPolicy resolved from config (paper/live, confirm, limits)."""
+        from brokers.trading import policy_from_config
+        return policy_from_config(self._config, broker_type)
+
+    def trading_mode(self, broker_type: str = "") -> str:
+        from brokers.trading import resolve_trading_mode
+        return resolve_trading_mode(self._config, broker_type)
+
+    def trading_dry_run(self) -> bool:
+        """Global operational kill-switch (env ARIA_DRY_RUN).
+
+        The name matters: this docstring is the only documentation the switch
+        has — no .md file mentions it — and it used to name a variable that
+        nothing reads. Anyone who followed it to freeze live trading got no
+        freeze and no error. tests/test_env_switch_docs.py now fails if any
+        docstring names an ARIA_* variable the tree never reads.
+        """
+        from brokers.trading import global_dry_run
+        return global_dry_run()