cecli-dev 1.0.0rc7__tar.gz → 1.0.0rc8__tar.gz

{cecli_dev-1.0.0rc7 → cecli_dev-1.0.0rc8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cecli-dev
-Version: 1.0.0rc7
+Version: 1.0.0rc8
 Summary: we also can't pronounce cecli
 Project-URL: Homepage, https://github.com/dwash96/cecli
 Project-URL: Documentation, https://github.com/dwash96/cecli

{cecli_dev-1.0.0rc7 → cecli_dev-1.0.0rc8}/cecli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.0rc7'
-__version_tuple__ = version_tuple = (1, 0, 0, 'rc7')
+__version__ = version = '1.0.0rc8'
+__version_tuple__ = version_tuple = (1, 0, 0, 'rc8')
 
-__commit_id__ = commit_id = 'g7153f3816'
+__commit_id__ = commit_id = 'g98591f5a3'

{cecli_dev-1.0.0rc7 → cecli_dev-1.0.0rc8}/cecli/helpers/orchestration/environment.py

@@ -202,16 +202,30 @@ class AgentExecutionEnv:
     # Shared across all AgentExecutionEnv instances — any agent can read/write
     _shared_state: TrackedDict = TrackedDict()
 
-    def __init__(self, coder: Any) -> None:
+    def __init__(self, coder: Any, orchestration_config: dict[str, Any] | None = None) -> None:
+        from typing import Any as _Any
+
+        self._orchestration_config: dict[str, _Any] = orchestration_config or {}
+        self._DANGEROUS_BUILTINS: set[str] = {
+            "eval",
+            "exec",
+            "open",
+            "__import__",
+            "compile",
+            "breakpoint",
+            "globals",
+            "locals",
+        }
+
         self.state = TrackedDict()
         self.state._set_owner(self)
         self._shared_state._set_owner(self, is_shared=True)
 
         # Initialize early so _safe_builtins can reference them
-        self.globals: dict[str, Any] = {}
-        self.locals: dict[str, Any] = {}
+        self.globals: dict[str, _Any] = {}
+        self.locals: dict[str, _Any] = {}
 
-        self._safe_builtins: dict[str, Any] = {
+        self._safe_builtins: dict[str, _Any] = {
             "print": print,
             "range": range,
             "len": len,
@@ -267,6 +281,32 @@ class AgentExecutionEnv:
             "pathlib": _SafePathlib,
         }
 
+        # Task 3: allowed_builtins — extend _safe_builtins with user-requested builtins
+        allowed_builtins: list[str] = self._orchestration_config.get("allowed_builtins", [])
+        for name in allowed_builtins:
+            if name.startswith("_"):
+                raise ValueError(f"Cannot allow private builtin '{name}'")
+            if name in self._DANGEROUS_BUILTINS and not self._orchestration_config.get(
+                "disable_security"
+            ):
+                raise ValueError(f"Cannot allow dangerous builtin '{name}'")
+            self._safe_builtins[name] = __builtins__[name]
+
+        # When security is fully disabled, expose dangerous builtins
+        if self._orchestration_config.get("disable_security", False):
+            for name in self._DANGEROUS_BUILTINS:
+                self._safe_builtins[name] = __builtins__[name]
+
+        # When allow_classes is enabled, expose __build_class__ needed by Python
+        if self._orchestration_config.get("allow_classes", False):
+            self._safe_builtins["__build_class__"] = __builtins__["__build_class__"]
+
+        # When allowed_imports is configured, expose __import__ so imports work,
+        # and add __name__ since imported modules reference it.
+        if self._orchestration_config.get("allowed_imports"):
+            self._safe_builtins["__import__"] = __builtins__["__import__"]
+            self._safe_builtins["__name__"] = "__sandbox__"
+
         self.globals.clear()
         _agent = AgentProxy(coder)
         _agent._env = self
@@ -382,7 +422,8 @@ class AgentExecutionEnv:
 
         code_str = code_str.strip()
         code_str = _escape_newlines_in_strings(code_str)
-        code_str, extra_globals = _strip_allowed_imports(code_str)
+        extra_allowed = frozenset(self._orchestration_config.get("allowed_imports", []))
+        code_str, extra_globals = _strip_allowed_imports(code_str, extra_allowed=extra_allowed)
         self.globals.update(extra_globals)
         if not code_str:
             return {"results": "", "state_variables": self._state_snapshot()}
@@ -411,8 +452,13 @@ class AgentExecutionEnv:
             return {"results": code, "state_variables": self._state_snapshot()}
 
         try:
-            tree = SecurityFilter().visit(tree)
-            tree = LoopYieldInjector().visit(tree)
+            if not self._orchestration_config.get("disable_security", False):
+                tree = SecurityFilter(
+                    allowed_imports=extra_allowed,
+                    allow_classes=self._orchestration_config.get("allow_classes", False),
+                ).visit(tree)
+            if not self._orchestration_config.get("disable_loop_protection", False):
+                tree = LoopYieldInjector().visit(tree)
             ast.fix_missing_locations(tree)
         except SecurityError as e:
             return _build_result(f"Security Error: {e}")
@@ -477,7 +523,9 @@ def build_orchestration_context_block(agent_config: dict[str, Any]) -> str | Non
     if not agent_config.get("allow_orchestration", True):
         return None
 
-    return """<context name="orchestration" from="agent">
+    orchestration_config = agent_config.get("orchestration", {})
+
+    context = """<context name="orchestration" from="agent">
 The `Orchestrate` tool lets you batch multiple tool calls in a single step by writing Python code in a limited, secure sandbox.
 This is much more efficient than making individual tool calls for loop-heavy workflows.
 Variables and methods defined in a script are persisted in subsequent turns.
@@ -611,6 +659,28 @@ await Agent.edit_region(
 4. Use `print(...)` to output results — only printed output is returned
 </context>"""
 
+    # Task 6: Append sandbox configuration overrides when non-empty
+    if orchestration_config:
+        overrides: list[str] = []
+        if orchestration_config.get("allowed_imports"):
+            overrides.append(
+                f"- Allowed extra imports: {orchestration_config['allowed_imports']}"
+            )
+        if orchestration_config.get("allowed_builtins"):
+            overrides.append(
+                f"- Allowed extra builtins: {orchestration_config['allowed_builtins']}"
+            )
+        if orchestration_config.get("allow_classes"):
+            overrides.append("- Class definitions are allowed (__init__, __str__, etc.)")
+        if orchestration_config.get("disable_security"):
+            overrides.append("- ⚠ Security filtering is DISABLED")
+        if orchestration_config.get("disable_loop_protection"):
+            overrides.append("- ⚠ Loop protection is DISABLED")
+        if overrides:
+            context += "\n### Sandbox Configuration Overrides\n" + "\n".join(overrides) + "\n"
+
+    return context
+
 
 # flake8: noqa
 # fmt: on

{cecli_dev-1.0.0rc7 → cecli_dev-1.0.0rc8}/cecli/helpers/orchestration/safe_methods.py

@@ -586,12 +586,21 @@ _PREIMPORTED_MODULES: frozenset[str] = frozenset(
 )
 
 
-def _strip_allowed_imports(code: str) -> tuple[str, dict[str, object]]:
+def _strip_allowed_imports(
+    code: str,
+    extra_allowed: frozenset[str] | None = None,
+) -> tuple[str, dict[str, object]]:
     """Strip import lines for modules already pre-imported in the sandbox.
 
     The sandbox provides ``re``, ``math``, ``itertools``, ``collections``,
     ``datetime``, ``traceback``, and ``json`` as read-only proxies.
 
+    When *extra_allowed* is provided, import statements for those modules
+    are also allowed through (neither stripped nor commented out).  The caller
+    is responsible for ensuring those names are resolvable at execution time
+    (either by pre-importing them into the sandbox globals or letting the
+    ``SecurityFilter`` allow the ``import`` statement through).
+
     Returns ``(code, extra_globals)`` where *extra_globals* maps imported
     names to their resolved values.  The caller must inject these into the
     execution namespace before running the code.
@@ -606,7 +615,11 @@ def _strip_allowed_imports(code: str) -> tuple[str, dict[str, object]]:
 
     import re as _re
 
+    preimported = _PREIMPORTED_MODULES
+    skip_allowed = extra_allowed or frozenset()
+
     lines = code.splitlines()
+
     result = []
     extra_globals: dict[str, object] = {}
 
@@ -619,7 +632,11 @@ def _strip_allowed_imports(code: str) -> tuple[str, dict[str, object]]:
             r"import\s+(\w+)(?:\s+as\s+(\w+))?\s*$",
             stripped,
         )
-        if m and m.group(1) in _PREIMPORTED_MODULES:
+        if m and m.group(1) in skip_allowed:
+            result.append(line)
+            continue
+
+        if m and m.group(1) in preimported:
             mod_name = m.group(1)
             alias = m.group(2) or mod_name
 
@@ -637,7 +654,11 @@ def _strip_allowed_imports(code: str) -> tuple[str, dict[str, object]]:
             r"from\s+(\w+)\s+import\s+(.*)$",
             stripped,
         )
-        if m and m.group(1) in _PREIMPORTED_MODULES:
+        if m and m.group(1) in skip_allowed:
+            result.append(line)
+            continue
+
+        if m and m.group(1) in preimported:
             mod_name = m.group(1)
             names_clause = m.group(2)
 

{cecli_dev-1.0.0rc7 → cecli_dev-1.0.0rc8}/cecli/helpers/orchestration/security.py

@@ -59,6 +59,41 @@ class SecurityFilter(ast.NodeTransformer):
 
     _SAFE_DUNDER: set[str] = {"__name__", "__doc__"}
 
+    _SAFE_CLASS_DUNDERS: frozenset[str] = frozenset(
+        {
+            "__init__",
+            "__str__",
+            "__repr__",
+            "__iter__",
+            "__next__",
+            "__len__",
+            "__getitem__",
+            "__setitem__",
+            "__contains__",
+            "__enter__",
+            "__exit__",
+            "__aenter__",
+            "__aexit__",
+            "__await__",
+            "__anext__",
+            "__aiter__",
+            "__del__",
+            "__init_subclass__",
+            "__set_name__",
+            "__class_getitem__",
+        }
+    )
+
+    def __init__(
+        self,
+        allowed_imports: frozenset[str] | None = None,
+        allow_classes: bool = False,
+    ):
+        super().__init__()
+        self._allowed_imports = allowed_imports or frozenset()
+        self._allow_classes = allow_classes
+        self._class_depth = 0
+
     # ------------------------------------------------------------------
     # Helpers
     # ------------------------------------------------------------------
@@ -89,17 +124,24 @@ class SecurityFilter(ast.NodeTransformer):
     # Statement visitors (import / global / nonlocal)
     # ------------------------------------------------------------------
 
-    def visit_Import(self, node: ast.Import) -> ast.Expr:
-        return self._make_raise_stmt(
-            f"Security filter error at line {node.lineno}: "
-            "Imports are disabled in the agent orchestration environment."
-        )
+    def visit_Import(self, node: ast.Import) -> ast.Expr | ast.Import:
+        for alias in node.names:
+            if alias.name not in self._allowed_imports:
+                return self._make_raise_stmt(
+                    f"Security filter error at line {node.lineno}: "
+                    f"Import '{alias.name}' is not in allowed_imports."
+                )
 
-    def visit_ImportFrom(self, node: ast.ImportFrom) -> ast.Expr:
-        return self._make_raise_stmt(
-            f"Security filter error at line {node.lineno}: "
-            "Imports are disabled in the agent orchestration environment."
-        )
+        return node
+
+    def visit_ImportFrom(self, node: ast.ImportFrom) -> ast.Expr | ast.ImportFrom:
+        if node.module is None or node.module not in self._allowed_imports:
+            return self._make_raise_stmt(
+                f"Security filter error at line {node.lineno}: "
+                f"Import from '{node.module}' is not in allowed_imports."
+            )
+
+        return node
 
     def visit_Global(self, node: ast.Global) -> ast.Expr:
         return self._make_raise_stmt(
@@ -114,17 +156,47 @@ class SecurityFilter(ast.NodeTransformer):
         )
 
     # ------------------------------------------------------------------
-    # Expression visitors (attribute access / dangerous calls)
+    def visit_ClassDef(self, node: ast.ClassDef) -> ast.ClassDef | ast.Expr:
+        if self._allow_classes:
+            self._class_depth += 1
+            self.generic_visit(node)
+            self._class_depth -= 1
+            return node
+
+        return self._make_raise_stmt(
+            f"Security filter error at line {node.lineno}: "
+            "Class definitions are disabled in the orchestration environment."
+        )
+
+    def visit_FunctionDef(self, node: ast.FunctionDef) -> ast.FunctionDef | ast.Expr:
+        if self._allow_classes and self._class_depth > 0 and node.name.startswith("__"):
+            if node.name not in self._SAFE_CLASS_DUNDERS:
+                return self._make_raise_stmt(
+                    f"Security filter error at line {node.lineno}: "
+                    f"Method name '{node.name}' is not allowed. "
+                    f"Only safe dunder methods are permitted inside class bodies."
+                )
+
+        return self.generic_visit(node)
+
     # ------------------------------------------------------------------
+    # Expression visitors (attribute access / dangerous calls)
 
     def visit_Attribute(self, node: ast.Attribute):
         if node.attr.startswith("_"):
             if node.attr in self._SAFE_DUNDER:
                 return self.generic_visit(node)
 
+            if (
+                self._allow_classes
+                and self._class_depth > 0
+                and node.attr in self._SAFE_CLASS_DUNDERS
+            ):
+                return self.generic_visit(node)
+
             if isinstance(node.ctx, (ast.Store, ast.Del)):
                 verb = "assign to" if isinstance(node.ctx, ast.Store) else "delete"
-                raise SecurityError(
+                return self._make_raise_expr(
                     f"Security filter error at line {node.lineno}: "
                     f"cannot {verb} private attribute '{node.attr}'"
                 )

{cecli_dev-1.0.0rc7 → cecli_dev-1.0.0rc8}/cecli/helpers/orchestration/service.py

@@ -24,7 +24,11 @@ class OrchestrationService:
             cls._instances[coder] = instance
             return instance
 
-        instance = AgentExecutionEnv(coder)
+        orchestration_config = {}
+        if hasattr(coder, "agent_config"):
+            orchestration_config = coder.agent_config.get("orchestration", {})
+
+        instance = AgentExecutionEnv(coder, orchestration_config=orchestration_config)
         cls._instances[coder] = instance
         cls._uuid_index[coder.uuid] = instance
         return instance

{cecli_dev-1.0.0rc7 → cecli_dev-1.0.0rc8}/cecli/website/docs/config/agent-mode.md

@@ -166,6 +166,55 @@ Agent Mode can also be configured directly in your configuration file. See the [
 - **`command_timeout`**: Time in seconds to wait for shell commands to finish before automatic backgrounding occurs (default: None)
 - **`diff_colors`**: When enabled, diff output in edit tool responses uses color-coded lines - removed lines in magenta, added lines in light green, and context lines in plain text (default: true)
 
+- **`orchestration`**: A nested configuration object for the Orchestrate tool's Python sandbox.
+  When absent or empty, the sandbox runs with default restrictions. See [Orchestration
+  Configuration](#orchestration-configuration) below for details.
+
+#### Orchestration Configuration
+
+The `Orchestrate` tool runs user code in a secure Python sandbox with the following
+restrictions:
+- **No imports** — only pre-imported modules (`re`, `math`, `itertools`, `collections`,
+  `datetime`, `traceback`, `json`, `pathlib`) are available
+- **No private/dunder access** — attributes starting with `_` are blocked
+- **No dangerous builtins** — `eval`, `exec`, `open`, `compile`, `breakpoint`,
+  `__import__`, `globals`, `locals`, `setattr`, `delattr` are blocked
+- **No global/nonlocal statements**
+- **Loop protection** — `while`/`for` loops yield cooperatively to prevent hangs
+
+These restrictions can be selectively relaxed via the `orchestration` config block:
+
+- **`allowed_imports`**: Array of module names to allow importing. Example:
+  `["os", "typing"]`. Only standard library modules should be allowed; third-party
+  modules may execute arbitrary code at import time.
+
+- **`allowed_builtins`**: Array of builtin function names to add to the sandbox.
+  Example: `["setattr", "property"]`. Dangerous builtins (`eval`, `exec`, `open`, etc.)
+  cannot be added.
+
+- **`allow_classes`**: Boolean (default: `false`). When `true`, class definitions are
+  permitted and dunder methods (`__init__`, `__str__`, `__repr__`, `__iter__`, etc.)
+  are allowed inside class bodies.
+
+- **`disable_security`**: Boolean (default: `false`). When `true`, the AST-level security
+  filter is skipped entirely. ⚠ Use with extreme caution — this disables all import
+  blocking, dunder blocking, and dangerous builtin blocking.
+
+- **`disable_loop_protection`**: Boolean (default: `false`). When `true`, the cooperative
+  yield injection is skipped. Use only if you are certain the orchestration code has no
+  unbounded loops.
+
+Example:
+
+```yaml
+agent-config:
+  orchestration:
+    allowed_imports:
+      - os
+      - typing
+    allow_classes: true
+```
+
 #### Essential Tools
 
 Certain tools are always available regardless of includelist/excludelist settings:
@@ -288,7 +337,16 @@ agent-config:
   allowed_commands: ["wc -l*"]  # Commands matching these glob patterns will not prompt for confirmation
   show_lint_errors: false  # When enabled, linting errors are shown in tool output (default: false)
   hot_reload: false  # When enabled, skills configuration is hot-reloaded automatically (default: false)
-фвδ::  diff_colors: true  # When enabled, diff output uses color-coded lines (default: true)
+  diff_colors: true  # When enabled, diff output uses color-coded lines (default: true)
+
+  # Orchestration sandbox configuration (optional)
+  orchestration:
+    allowed_imports: []  # Optional: Module names to allow importing
+    allowed_builtins: []  # Optional: Builtin names to add
+    allow_classes: false  # Optional: Allow class definitions
+    disable_security: false  # Optional: Disable security filter (⚠ dangerous)
+    disable_loop_protection: false  # Optional: Disable loop yield injection
+
   # Skills configuration (see Skills documentation for details)
   skills_paths: ["~/my-skills", "./project-skills"]  # Directories to search for skills
   skills_includelist: ["python-refactoring", "react-components"]  # Optional: Whitelist of skills to include

{cecli_dev-1.0.0rc7 → cecli_dev-1.0.0rc8}/cecli_dev.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cecli-dev
-Version: 1.0.0rc7
+Version: 1.0.0rc8
 Summary: we also can't pronounce cecli
 Project-URL: Homepage, https://github.com/dwash96/cecli
 Project-URL: Documentation, https://github.com/dwash96/cecli

{cecli_dev-1.0.0rc7 → cecli_dev-1.0.0rc8}/cecli_dev.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "1.0.0rc7",
+  "tag": "1.0.0rc8",
   "distance": 0,
-  "node": "g7153f3816855bda81793e015fd981b8d196e0881",
+  "node": "g98591f5a3ad677245a548454e1fcd8440c8c6117",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-07-21"