code-puppy-core-plugins 0.0.2__py3-none-any.whl

code_puppy_core_plugins/dbos_durable_exec/runtime.py

@@ -0,0 +1,65 @@
+"""Async context manager wrapping pydantic_agent.run() with DBOS workflow ID
+and (when needed) MCP toolset injection on the inner pydantic agent."""
+
+from __future__ import annotations
+
+from contextlib import asynccontextmanager
+
+from .workflow_ids import generate_dbos_workflow_id
+
+
+def skip_fallback_render(_agent) -> bool:
+    """DBOS renders its own output; tell core to skip the non-streaming fallback.
+
+    Only valid when DBOS is actually launched — otherwise we'd skip the
+    fallback render for plain pydantic agents, leaving users with no output.
+    """
+    from .lifecycle import is_launched
+
+    return is_launched()
+
+
+@asynccontextmanager
+async def dbos_run_context(agent, pydantic_agent, group_id, mcp_servers):
+    """Wrap a run() call with SetWorkflowID and a temporary MCP toolset swap.
+
+    For sub-agent invocations (group_id starting with 'invoke_agent'), append
+    an atomic counter to ensure DBOS workflow ID uniqueness across rapid
+    back-to-back calls. For the main agent, use group_id as-is.
+    """
+    from .lifecycle import is_launched
+
+    if not is_launched():
+        # DBOS not launched (e.g. running inside pytest) — be a no-op so the
+        # plain pydantic agent run proceeds normally.
+        yield
+        return
+
+    try:
+        from dbos import SetWorkflowID
+    except ImportError:
+        yield
+        return
+
+    workflow_id = (
+        generate_dbos_workflow_id(group_id)
+        if group_id and group_id.startswith("invoke_agent")
+        else group_id
+    )
+
+    # The inner pydantic agent under DBOSAgent is exposed via `.wrapped`
+    # (see pydantic_ai.agent.WrapperAgent). Fall back defensively.
+    inner = getattr(pydantic_agent, "wrapped", pydantic_agent)
+
+    original = None
+    swapped = False
+    if mcp_servers:
+        original = getattr(inner, "_toolsets", []) or []
+        inner._toolsets = list(original) + list(mcp_servers)
+        swapped = True
+    try:
+        with SetWorkflowID(workflow_id):
+            yield workflow_id
+    finally:
+        if swapped:
+            inner._toolsets = original

code_puppy_core_plugins/dbos_durable_exec/startup_lock.py

@@ -0,0 +1,155 @@
+"""Cross-process startup serialization for the DBOS durable-exec plugin.
+
+Multiple Code Puppy instances launched at the same instant (e.g. several
+Zellij panes each spawning their own process) all open the *same* shared
+DBOS SQLite system database and run schema migration + workflow recovery
+during ``DBOS.launch()``. SQLite is single-writer, so the racers collide on
+the write lock, and the losers either raise ``database is locked`` (or an
+Alembic migration conflict) and disable durable execution -- or, on older
+builds, exit the whole process with code 1.
+
+This module provides:
+
+* :func:`interprocess_lock` -- a cross-platform advisory file lock so that
+  DBOS initialization happens one process at a time. Late starters *wait*
+  for the lock instead of racing the migration.
+* :func:`enable_sqlite_wal` -- flips the shared SQLite database into WAL
+  journal mode (a persistent, header-level setting) so that, once
+  initialized, concurrent reads/writes are far less likely to block.
+
+Both helpers fail soft: locking and PRAGMA tuning are best-effort
+optimizations, never correctness requirements, so any platform quirk
+degrades to the previous (racy) behavior rather than blocking startup.
+"""
+
+from __future__ import annotations
+
+import contextlib
+import os
+import sys
+import time
+from typing import Iterator
+
+# Platform-specific locking primitives; deliberately no third-party dep
+# (filelock/portalocker) — the stdlib covers both POSIX and Windows.
+try:  # POSIX
+    import fcntl
+
+    _HAVE_FCNTL = True
+except ImportError:  # pragma: no cover - Windows
+    _HAVE_FCNTL = False
+
+try:  # Windows
+    import msvcrt
+
+    _HAVE_MSVCRT = True
+except ImportError:  # pragma: no cover - POSIX
+    _HAVE_MSVCRT = False
+
+
+def _try_acquire(fd: int) -> bool:
+    """Attempt a single non-blocking exclusive lock on ``fd``.
+
+    Returns True on success, False if the lock is currently held elsewhere.
+    """
+    if _HAVE_FCNTL:
+        try:
+            fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+            return True
+        except OSError:
+            return False
+    if _HAVE_MSVCRT:
+        try:
+            msvcrt.locking(fd, msvcrt.LK_NBLCK, 1)
+            return True
+        except OSError:
+            return False
+    # No locking primitive available: behave as if always acquired.
+    return True
+
+
+def _release(fd: int) -> None:
+    """Best-effort release of a lock previously taken on ``fd``."""
+    try:
+        if _HAVE_FCNTL:
+            fcntl.flock(fd, fcntl.LOCK_UN)
+        elif _HAVE_MSVCRT:
+            msvcrt.locking(fd, msvcrt.LK_UNLCK, 1)
+    except OSError:
+        pass
+
+
+@contextlib.contextmanager
+def interprocess_lock(lock_path: str, timeout: float = 30.0) -> Iterator[bool]:
+    """Hold a cross-process advisory lock for the duration of the block.
+
+    Serializes a critical section across separate Code Puppy processes. Late
+    arrivals poll until the holder releases or ``timeout`` seconds elapse.
+
+    Yields:
+        True if the lock was actually acquired, False if it timed out (the
+        caller still runs -- we never want a cosmetic lock to *prevent*
+        startup, only to order it when possible).
+    """
+    os.makedirs(os.path.dirname(lock_path), exist_ok=True)
+
+    fd = None
+    acquired = False
+    try:
+        # Windows requires a real byte in the file to lock a region.
+        fd = os.open(lock_path, os.O_RDWR | os.O_CREAT, 0o644)
+        if _HAVE_MSVCRT:
+            try:
+                os.write(fd, b"\0")
+                os.lseek(fd, 0, os.SEEK_SET)
+            except OSError:
+                pass
+
+        deadline = time.monotonic() + max(timeout, 0.0)
+        while True:
+            if _try_acquire(fd):
+                acquired = True
+                break
+            if time.monotonic() >= deadline:
+                break
+            time.sleep(0.1)
+
+        yield acquired
+    finally:
+        if fd is not None:
+            if acquired:
+                _release(fd)
+            try:
+                os.close(fd)
+            except OSError:
+                pass
+
+
+def enable_sqlite_wal(sqlite_path: str) -> None:
+    """Switch the shared SQLite DB to WAL journal mode (best effort).
+
+    WAL is a persistent, header-level setting, so a single successful call
+    sticks for every future connection (including DBOS's own engine). It lets
+    readers and a writer coexist, dramatically reducing ``database is locked``
+    errors at runtime. Failures are swallowed -- this is pure optimization.
+    """
+    try:
+        import sqlite3
+    except ImportError:  # pragma: no cover - sqlite3 is stdlib
+        return
+
+    try:
+        os.makedirs(os.path.dirname(sqlite_path), exist_ok=True)
+        # busy_timeout here only affects *this* connection, but WAL is what
+        # we actually persist. timeout keeps this probe from hanging.
+        conn = sqlite3.connect(sqlite_path, timeout=5.0)
+        try:
+            conn.execute("PRAGMA journal_mode=WAL;")
+            conn.execute("PRAGMA busy_timeout=30000;")
+            conn.commit()
+        finally:
+            conn.close()
+    except Exception as exc:  # noqa: BLE001 - cosmetic optimization, fail soft
+        # Surface a hint in debug mode but never block startup.
+        if os.environ.get("CODE_PUPPY_DEBUG"):
+            sys.stderr.write(f"[dbos_durable_exec] WAL setup skipped: {exc}\n")

code_puppy_core_plugins/dbos_durable_exec/workflow_ids.py

@@ -0,0 +1,16 @@
+"""Atomic counter for unique DBOS workflow IDs (sub-agent invocations)."""
+
+from __future__ import annotations
+
+import itertools
+
+_dbos_workflow_counter = itertools.count()
+
+
+def generate_dbos_workflow_id(base_id: str) -> str:
+    """Generate a unique DBOS workflow ID by appending an atomic counter.
+
+    DBOS requires workflow IDs to be unique across all executions.
+    """
+    counter = next(_dbos_workflow_counter)
+    return f"{base_id}-{counter}"

code_puppy_core_plugins/dbos_durable_exec/wrapper.py

@@ -0,0 +1,58 @@
+"""DBOSAgent wrapper, registered via the wrap_pydantic_agent hook.
+
+The DBOS wrapper can't pickle async-generator MCP toolsets, so we stash
+them off the inner pydantic agent before wrapping. They're restored at
+run-time inside :mod:`runtime` so MCP tools remain available during the run.
+"""
+
+from __future__ import annotations
+
+import itertools
+
+_reload_count = itertools.count()
+
+
+def wrap_with_dbos_agent(
+    agent,
+    pydantic_agent,
+    *,
+    event_stream_handler=None,
+    message_group=None,
+    kind: str = "main",
+):
+    """Return a DBOSAgent wrapping ``pydantic_agent`` (or None if DBOS missing).
+
+    Returns None — meaning "don't wrap, leave the plain pydantic agent alone" —
+    in three cases:
+      1. pydantic_ai.durable_exec.dbos is not importable.
+      2. DBOS itself was never launched (e.g. wrapper hook fired in the
+         pytest process where on_startup() was never called).
+
+    Without case 2 the wrapper would hand back a DBOSAgent whose .run()
+    fails because there is no running DBOS instance — exactly the
+    `run_with_mcp returned None` regression seen when [durable] extras
+    were installed in the CI test environment.
+    """
+    from .lifecycle import is_launched
+
+    if not is_launched():
+        return None
+
+    try:
+        from pydantic_ai.durable_exec.dbos import DBOSAgent
+    except ImportError:
+        return None
+
+    # Reset toolsets — DBOS can't pickle async-generator MCP toolsets.
+    # The runtime hook re-injects MCP servers from its own arg at run time.
+    pydantic_agent._toolsets = []
+
+    name_suffix = next(_reload_count)
+    agent_name = getattr(agent, "name", "agent")
+    # Sub-agent path historically didn't pass an event stream handler.
+    handler = event_stream_handler if kind == "main" else None
+    return DBOSAgent(
+        pydantic_agent,
+        name=f"{agent_name}-{kind}-{name_suffix}",
+        event_stream_handler=handler,
+    )

code_puppy_core_plugins/destructive_command_guard/AGENTS.md

@@ -0,0 +1,79 @@
+# AGENTS.md — Destructive Command Guard
+
+> Scope: **this plugin only** (`code_puppy/plugins/destructive_command_guard/`).
+> It intercepts destructive shell commands (`rm -rf /`, `git reset --hard`,
+> `docker prune`, `diskpart`, ...) and prompts/blocks before they run.
+> Force-push blocking is a **separate sibling plugin** (`force_push_guard/`) —
+> out of scope here, but the two share the allowlist (see below).
+
+## What lives here
+
+| File | Responsibility |
+|------|----------------|
+| `detector.py` | Pure-regex detection. No LLM, no I/O, no config reads. Returns a `DestructiveCommandMatch(pattern_name, description)` or `None`. |
+| `register_callbacks.py` | The `run_shell_command` hook: legacy disable flag → detect → allowlist → interactive prompt (TTY) / hard-block (non-interactive). |
+| `__init__.py` | Docstring inventory of covered patterns. Keep it in sync when you add patterns. |
+
+Config knobs live in `code_puppy/config.py` (NOT here):
+- `disable_dangerous_command_guard` — legacy all-or-nothing kill-switch (also disables force-push guard). `get_disable_dangerous_command_guard()`.
+- `dangerous_command_guard_allow` — granular per-pattern allowlist, shared with the force-push guard. `get_dangerous_command_guard_allowlist()` / `is_dangerous_command_allowlisted()`.
+
+Tests: `tests/plugins/test_destructive_command_detector.py` (detector) and
+`tests/plugins/test_command_guard_allowlist.py` (allowlist + callback).
+
+## Callback precedence (do not reorder without cause)
+
+1. `get_disable_dangerous_command_guard()` → if True, allow (full legacy bypass).
+2. `detect_destructive_command(command)` → if `None`, allow.
+3. `is_dangerous_command_allowlisted(match.pattern_name)` → if True, allow silently.
+4. Interactive TTY → prompt the user (approve / reject).
+5. Non-interactive (CI, sub-agent, piped) → **hard-block** with an error dict.
+
+Return `None` to allow, `{"blocked": True, "reasoning": ..., "error_message": ...}` to deny.
+
+## Recipe: add a new destructive pattern
+
+1. **Add the regex tuple** to the right list in `detector.py`
+   (`_UNIX_DESTRUCTIVE_PATTERNS`, `_POWERSHELL_...`, or `_CMD_...`):
+   `(re.compile(r"..."), "short-name", "human description")`.
+   Order matters — **first match wins**; put more-specific patterns first.
+2. **Add a pre-filter substring** to `_PREFILTER_SUBSTRINGS` if your keyword
+   isn't already there. Detection bails early unless a cheap substring hits,
+   so a missing prefilter = your pattern never fires.
+3. **Add tests** in `tests/plugins/test_destructive_command_detector.py`.
+   Use the `_hits(cmd)` / `_miss(cmd)` helpers (they prefix `&& ` so
+   `_is_real_command` passes). Add at least one positive AND one
+   false-positive/negative case (e.g. the same word inside `echo '...'`).
+4. **Update the `__init__.py` docstring** inventory.
+5. `ruff check --fix` and `ruff format .`, then run the tests.
+
+## Non-negotiable conventions
+
+- **`pattern_name` is an API contract.** It is (a) shown to the user and
+  (b) the exact key users put in `dangerous_command_guard_allow`. Renaming one
+  silently breaks people's allowlists. Treat renames as breaking changes.
+- **Detector stays pure.** No config reads, no `emit_*`, no network, no
+  filesystem. All side effects belong in `register_callbacks.py`. This keeps
+  the detector trivially unit-testable and fast.
+- **False positives are worse than they look.** A too-greedy regex trains
+  users to reflexively approve prompts, which defeats the guard. Anchor
+  carefully (`\b`, end-of-string `$`), and always add a `_miss` test proving
+  safe look-alikes (`rm -i`, `git reset --soft`, `echo 'rm -rf /'`) don't fire.
+- **Fail closed on ambiguity, fail open on our own errors.** If a command
+  looks destructive, block/prompt. But never let the guard crash the app —
+  the `run_shell_command` hook must degrade gracefully.
+- **Cross-platform.** Patterns cover Unix, PowerShell, and CMD. New coverage
+  should consider all three where the operation exists.
+- **Emojis in prompt strings are intentional** in `register_callbacks.py`
+  (the panel UI). Don't strip them when editing nearby lines.
+- **600-line hard cap per file**; split into submodules if a file outgrows it.
+- Run `ruff check --fix` and `ruff format .` before committing.
+- **Never add a Claude / AI co-author trailer to commits.**
+
+## Quick test commands
+
+```bash
+# detector + allowlist + callback behavior
+pytest tests/plugins/test_destructive_command_detector.py \
+       tests/plugins/test_command_guard_allowlist.py -o addopts="" -q
+```

code_puppy_core_plugins/destructive_command_guard/__init__.py

@@ -0,0 +1,14 @@
+"""Destructive command guard plugin.
+
+Intercepts potentially-destructive shell commands and prompts the user for
+approval before allowing them through. Always active, pure regex, no LLM calls.
+
+Covers:
+- Unix/Linux: rm -rf /, rm -rf ~, rm -rf /*, rm -rf ~/*
+- Cross-platform (git, docker, npm/yarn, twine, SQL clients):
+  git push --mirror, git clean -fd, git reset --hard, git checkout/restore .,
+  DROP via SQL client, docker prune, npm/yarn publish, twine upload
+- Windows PowerShell: Remove-Item -Recurse -Force, Format-Volume, Clear-Disk,
+  Remove-ItemProperty, Clear-RecycleBin, irm | iex (remote code execution)
+- Windows CMD: rd /s /q, del /s system files, format, diskpart, bcdedit, reg delete
+"""