honestcode 0.2.0__py3-none-any.whl

honestcode/sandbox/__init__.py

@@ -0,0 +1,195 @@
+"""
+Sandboxed code execution for HonestCode.
+
+Executes untrusted code in a fresh Python subprocess with resource limits:
+  - POSIX: RLIMIT_AS (memory), RLIMIT_CPU (cpu time), RLIMIT_NOFILE (open files)
+  - Windows: Job object with process/memory limits (best-effort via ctypes)
+  - Both: timeout, isolated temp directory, restricted PYTHONPATH
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+import re
+import subprocess
+import sys
+import tempfile
+import time
+from dataclasses import dataclass, field
+from pathlib import Path
+
+logger = logging.getLogger(__name__)
+
+__all__ = ["ExecutionResult", "SandboxExecutor"]
+
+# Environment variable names containing these markers are scrubbed before
+# the sandboxed subprocess starts, so secrets (API keys, tokens, passwords)
+# never reach code being executed.
+_SENSITIVE_ENV_MARKERS = (
+    "KEY",
+    "TOKEN",
+    "SECRET",
+    "PASSWORD",
+    "PASSWD",
+    "CREDENTIAL",
+    "AUTH",
+    "SIGNATURE",
+)
+
+
+@dataclass
+class ExecutionResult:
+    success: bool
+    stdout: str = ""
+    stderr: str = ""
+    output: str = ""
+    error: str = ""
+    error_type: str = ""
+    runtime_seconds: float = 0.0
+    details: dict = field(default_factory=dict)
+
+    def to_dict(self) -> dict:
+        return {
+            "success": self.success,
+            "stdout": self.stdout,
+            "stderr": self.stderr,
+            "output": self.output or self.stdout,
+            "error": self.error or self.stderr,
+            "error_type": self.error_type,
+            "runtime_seconds": self.runtime_seconds,
+            **self.details,
+        }
+
+
+class SandboxExecutor:
+    """Execute Python code snippets in a restricted subprocess."""
+
+    def __init__(self, timeout: int | None = None, memory_mb: int | None = None):
+        # Environment overrides (HONESTCODE_TIMEOUT / HONESTCODE_MEMORY_MB)
+        # apply when the caller does not pass explicit values.
+        env_timeout = os.environ.get("HONESTCODE_TIMEOUT", "")
+        self.timeout = (
+            timeout if timeout is not None else int(env_timeout) if env_timeout.isdigit() else 10
+        )
+        env_memory = os.environ.get("HONESTCODE_MEMORY_MB", "")
+        self.memory_mb = (
+            memory_mb if memory_mb is not None else int(env_memory) if env_memory.isdigit() else 256
+        )
+
+    def execute(
+        self,
+        code: str,
+        prelude: str = "",
+        known_names: set[str] | None = None,
+    ) -> ExecutionResult:
+        """Run *code* in a fresh Python interpreter and return the result."""
+        known_names = known_names or set()
+        start = time.perf_counter()
+
+        with tempfile.TemporaryDirectory(prefix="honestcode_sandbox_") as tmpdir:
+            script_path = Path(tmpdir) / "script.py"
+            full_code = f"{prelude}\n{code}\n"
+            script_path.write_text(full_code, encoding="utf-8")
+
+            env = {
+                k: v
+                for k, v in os.environ.items()
+                if not any(marker in k.upper() for marker in _SENSITIVE_ENV_MARKERS)
+            }
+            env["PYTHONPATH"] = ""
+            env["PYTHONDONTWRITEBYTECODE"] = "1"
+
+            preexec = self._get_preexec_fn()
+            creationflags = self._get_creationflags()
+
+            try:
+                proc = subprocess.run(
+                    [sys.executable, "-u", str(script_path)],
+                    cwd=tmpdir,
+                    env=env,
+                    capture_output=True,
+                    text=True,
+                    timeout=self.timeout,
+                    preexec_fn=preexec,
+                    creationflags=creationflags,
+                )
+                runtime = time.perf_counter() - start
+                stdout = proc.stdout or ""
+                stderr = proc.stderr or ""
+                success = proc.returncode == 0
+                err_text = stderr[:50_000] if not success else ""
+                error_type = ""
+                if not success and err_text:
+                    m = re.search(r"^(\w+Error|\w+Exception)", err_text, re.MULTILINE)
+                    if m:
+                        error_type = m.group(1)
+                return ExecutionResult(
+                    success=success,
+                    stdout=stdout[:50_000],
+                    stderr=stderr[:50_000],
+                    output=stdout[:50_000],
+                    error=err_text,
+                    error_type=error_type,
+                    runtime_seconds=round(runtime, 3),
+                    details={"returncode": proc.returncode, "known_names": sorted(known_names)},
+                )
+            except subprocess.TimeoutExpired as e:
+                runtime = time.perf_counter() - start
+                return ExecutionResult(
+                    success=False,
+                    error=f"Execution timed out after {self.timeout}s",
+                    stderr=e.stderr or "",
+                    runtime_seconds=round(runtime, 3),
+                    details={"timeout": True},
+                )
+            except Exception as e:  # noqa: BLE001
+                runtime = time.perf_counter() - start
+                return ExecutionResult(
+                    success=False,
+                    error=f"Sandbox failed: {e}",
+                    runtime_seconds=round(runtime, 3),
+                )
+
+    def _get_preexec_fn(self):
+        """Return a POSIX preexec_fn that sets resource limits, if available.
+
+        Each limit is applied best-effort: some platforms (e.g. macOS CI
+        runners) reject certain ``setrlimit`` calls, and a single failure
+        inside ``preexec_fn`` kills the child before it can run at all.
+        """
+        if sys.platform == "win32":
+            return None
+        try:
+            import resource
+        except Exception:  # noqa: BLE001
+            return None
+
+        def limit_resources():
+            def _setrlimit(name, soft, hard):
+                try:
+                    resource.setrlimit(getattr(resource, name), (soft, hard))
+                except (ValueError, OSError):
+                    logger.warning("Could not set %s in sandbox: %s", name, sys.exc_info()[1])
+
+            # Memory limit
+            max_bytes = self.memory_mb * 1024 * 1024
+            _setrlimit("RLIMIT_AS", max_bytes, max_bytes)
+            # CPU time limit (soft = timeout, hard = timeout + 2s buffer)
+            _setrlimit("RLIMIT_CPU", self.timeout, self.timeout + 2)
+            # Limit open files to prevent fd exhaustion
+            _setrlimit("RLIMIT_NOFILE", 64, 64)
+
+        return limit_resources
+
+    def _get_creationflags(self) -> int:
+        """Return Windows-specific creation flags for process isolation."""
+        if sys.platform != "win32":
+            return 0
+        # CREATE_NO_WINDOW: don't open a console window
+        # BELOW_NORMAL_PRIORITY_CLASS: reduce scheduling priority
+        return 0x08000000 | 0x00008000
+
+    def validate_snippet(self, code: str, known_names: set[str]) -> ExecutionResult:
+        """Quickly run a snippet to see if it raises a NameError for unknown symbols."""
+        return self.execute(code=code, known_names=known_names)

honestcode/structure/__init__.py

@@ -0,0 +1,6 @@
+"""Structural code analysis helpers."""
+
+from honestcode.structure.extractor import StructureExtractor
+from honestcode.structure.relations import ParseResult, StructEdge
+
+__all__ = ["ParseResult", "StructEdge", "StructureExtractor"]

honestcode/structure/extractor.py

@@ -0,0 +1,296 @@
+"""
+Parse Python source files into ``ParseResult`` objects.
+
+Provides AST-based extraction of functions, classes, variables, imports,
+imports and intra-file reference edges with minimal false positives.
+
+The implementation uses the standard-library ``ast`` module directly; no
+native parser dependency is required. A ``parser`` constructor argument is
+accepted for callers who want to plug in a tree-sitter-backed parser that
+follows the same interface, but it is optional.
+"""
+
+from __future__ import annotations
+
+import ast
+from pathlib import Path
+
+from honestcode.structure.relations import ParseResult, StructEdge
+from honestcode.structure.utils import call_name
+
+__all__ = ["StructureExtractor"]
+
+
+class StructureExtractor:
+    """Extract functions, classes, variables, imports and local edges from a Python file."""
+
+    def __init__(self, parser=None):
+        # ``parser`` is accepted for backwards compatibility and for callers
+        # who want to plug in an alternate parser. The default implementation
+        # uses the standard-library ``ast`` module and does not require any
+        # native dependency.
+        self.parser = parser
+
+    def parse_file(self, file_path: str | Path) -> ParseResult:
+        """Parse *file_path* and return a ``ParseResult``."""
+        p = Path(file_path)
+        source = p.read_text(encoding="utf-8")
+        return self.parse_source(source)
+
+    def parse_source(self, source: str) -> ParseResult:
+        """Parse raw source code and return a ``ParseResult``."""
+        try:
+            tree = ast.parse(source)
+        except SyntaxError:
+            # Fallback: return empty result so callers can continue.
+            return ParseResult(
+                edges=[],
+                func_defs={},
+                class_defs={},
+                var_defs={},
+                imports=set(),
+            )
+
+        func_defs: dict[str, tuple[int, int]] = {}
+        class_defs: dict[str, tuple[int, int]] = {}
+        var_defs: dict[str, tuple[int, int]] = {}
+        imports: set[str] = set()
+        imported_symbols: dict[str, str] = {}
+        edges: list[StructEdge] = []
+
+        self._walk(
+            tree,
+            source,
+            scope="",
+            func_defs=func_defs,
+            class_defs=class_defs,
+            var_defs=var_defs,
+            imports=imports,
+            imported_symbols=imported_symbols,
+            edges=edges,
+        )
+
+        return ParseResult(
+            edges=edges,
+            func_defs=func_defs,
+            class_defs=class_defs,
+            var_defs=var_defs,
+            imports=imports,
+            imported_symbols=imported_symbols,
+            exported_symbols={n for n in func_defs if not n.startswith("_")}
+            | {n for n in class_defs if not n.startswith("_")},
+        )
+
+    def _walk(
+        self,
+        node: ast.AST,
+        source: str,
+        scope: str,
+        func_defs: dict[str, tuple[int, int]],
+        class_defs: dict[str, tuple[int, int]],
+        var_defs: dict[str, tuple[int, int]],
+        imports: set[str],
+        imported_symbols: dict[str, str],
+        edges: list[StructEdge],
+    ) -> None:
+        """Recursively walk the AST collecting definitions and edges."""
+        for child in ast.iter_child_nodes(node):
+            if isinstance(child, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                name = self._scoped_name(scope, child.name)
+                func_defs[name] = (child.lineno - 1, child.end_lineno - 1)
+                self._collect_local_edges(child, name, func_defs, class_defs, var_defs, edges)
+                self._walk(
+                    child,
+                    source,
+                    scope=name,
+                    func_defs=func_defs,
+                    class_defs=class_defs,
+                    var_defs=var_defs,
+                    imports=imports,
+                    imported_symbols=imported_symbols,
+                    edges=edges,
+                )
+            elif isinstance(child, ast.ClassDef):
+                name = self._scoped_name(scope, child.name)
+                class_defs[name] = (child.lineno - 1, child.end_lineno - 1)
+                self._collect_local_edges(child, name, func_defs, class_defs, var_defs, edges)
+                self._walk(
+                    child,
+                    source,
+                    scope=name,
+                    func_defs=func_defs,
+                    class_defs=class_defs,
+                    var_defs=var_defs,
+                    imports=imports,
+                    imported_symbols=imported_symbols,
+                    edges=edges,
+                )
+            elif isinstance(child, ast.Import):
+                for alias in child.names:
+                    imports.add(alias.name.split(".")[0])
+                    asname = alias.asname or alias.name.split(".")[-1]
+                    imported_symbols[asname] = alias.name
+            elif isinstance(child, ast.ImportFrom):
+                module = child.module or ""
+                if child.level:
+                    imports.add(module.split(".")[0] if module else ".")
+                else:
+                    imports.add(module.split(".")[0])
+                for alias in child.names:
+                    asname = alias.asname or alias.name
+                    imported_symbols[asname] = f"{module}.{alias.name}" if module else alias.name
+            elif isinstance(child, ast.Assign):
+                for target in child.targets:
+                    self._record_var_def(target, scope, var_defs)
+            elif isinstance(child, ast.AnnAssign):
+                if child.target is not None:
+                    self._record_var_def(child.target, scope, var_defs)
+            else:
+                self._walk(
+                    child,
+                    source,
+                    scope,
+                    func_defs=func_defs,
+                    class_defs=class_defs,
+                    var_defs=var_defs,
+                    imports=imports,
+                    imported_symbols=imported_symbols,
+                    edges=edges,
+                )
+
+    def _record_var_def(
+        self,
+        target: ast.expr,
+        scope: str,
+        var_defs: dict[str, tuple[int, int]],
+    ) -> None:
+        if isinstance(target, ast.Name):
+            name = self._scoped_name(scope, target.id)
+            var_defs[name] = (target.lineno - 1, target.lineno - 1)
+        elif isinstance(target, (ast.Tuple, ast.List)):
+            for elt in target.elts:
+                self._record_var_def(elt, scope, var_defs)
+
+    @staticmethod
+    def _scoped_name(scope: str, name: str) -> str:
+        return f"{scope}.{name}" if scope else name
+
+    def _collect_local_edges(
+        self,
+        node: ast.AST,
+        context: str,
+        func_defs: dict[str, tuple[int, int]],
+        class_defs: dict[str, tuple[int, int]],
+        var_defs: dict[str, tuple[int, int]],
+        edges: list[StructEdge],
+    ) -> None:
+        """Create edges from references inside *node* to locally defined symbols."""
+        local_names = set(func_defs.keys()) | set(class_defs.keys()) | set(var_defs.keys())
+
+        for child in ast.walk(node):
+            if isinstance(child, ast.Name) and isinstance(child.ctx, ast.Load):
+                if child.id in local_names:
+                    edges.append(
+                        StructEdge(
+                            src_start=child.lineno - 1,
+                            src_end=child.lineno - 1,
+                            tgt_start=func_defs.get(child.id, (0, 0))[0],
+                            tgt_end=func_defs.get(child.id, (0, 0))[1],
+                            relation_type="same_scope",
+                            name=child.id,
+                        )
+                    )
+            elif isinstance(child, ast.Attribute) and isinstance(child.ctx, ast.Load):
+                root_name = self._attribute_root(child)
+                if root_name and root_name in local_names:
+                    edges.append(
+                        StructEdge(
+                            src_start=child.lineno - 1,
+                            src_end=child.lineno - 1,
+                            tgt_start=func_defs.get(root_name, (0, 0))[0],
+                            tgt_end=func_defs.get(root_name, (0, 0))[1],
+                            relation_type="same_scope",
+                            name=root_name,
+                        )
+                    )
+
+    @staticmethod
+    def _attribute_root(node: ast.Attribute) -> str | None:
+        """Return the leftmost Name of an attribute chain, if any."""
+        current: ast.expr = node.value
+        while isinstance(current, ast.Attribute):
+            current = current.value
+        return current.id if isinstance(current, ast.Name) else None
+
+    def scan_file(self, file_path: str | Path) -> list[dict]:
+        """Return a list of obvious issues in a single file.
+
+        Kept for backwards compatibility; prefer the AST-based scan in
+        ``honestcode.mcp.tools`` for richer diagnostics.
+        """
+        p = Path(file_path)
+        res = self.parse_file(p)
+        source = p.read_text(encoding="utf-8")
+
+        defined = set(res.func_defs.keys()) | set(res.class_defs.keys()) | set(res.var_defs.keys())
+        defined |= res.imports
+        defined |= {
+            "print",
+            "len",
+            "range",
+            "enumerate",
+            "zip",
+            "map",
+            "filter",
+            "sorted",
+            "sum",
+            "min",
+            "max",
+            "abs",
+            "round",
+            "int",
+            "str",
+            "float",
+            "bool",
+            "list",
+            "dict",
+            "set",
+            "tuple",
+            "type",
+            "isinstance",
+            "hasattr",
+            "getattr",
+            "open",
+            "input",
+            "repr",
+            "vars",
+            "locals",
+            "globals",
+            "dir",
+            "super",
+            "Exception",
+            "ValueError",
+            "TypeError",
+            "KeyError",
+            "IndexError",
+            "AttributeError",
+        }
+
+        issues: list[dict] = []
+        try:
+            tree = ast.parse(source)
+        except SyntaxError:
+            return issues
+
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Call):
+                continue
+            name = call_name(node.func)
+            if not name:
+                continue
+            base = name.split(".")[0]
+            if base in defined or name in defined:
+                continue
+            issues.append({"type": "undefined_call", "name": name, "line": node.lineno})
+
+        return issues

honestcode/structure/multi_lang.py

@@ -0,0 +1,180 @@
+"""Optional tree-sitter multi-language symbol extraction.
+
+Python remains the fully supported language (stdlib ``ast``). For JavaScript,
+TypeScript and a few other popular languages, symbol extraction is available
+when the optional extras are installed::
+
+    pip install -e "honestcode[multi-language]"
+
+Everything degrades gracefully: without tree-sitter, ``is_supported`` still
+recognizes the file by extension, but ``extract_symbols`` raises
+``TreeSitterUnavailable`` so callers can report a clear message instead of a
+traceback.
+"""
+
+from __future__ import annotations
+
+import importlib
+import logging
+from pathlib import Path
+
+logger = logging.getLogger(__name__)
+
+LANG_BY_EXT: dict[str, str] = {
+    ".js": "javascript",
+    ".jsx": "javascript",
+    ".mjs": "javascript",
+    ".cjs": "javascript",
+    ".ts": "typescript",
+    ".tsx": "typescript",
+    ".go": "go",
+    ".rs": "rust",
+    ".java": "java",
+}
+
+# node type -> symbol kind, per language (tree-sitter grammar node names).
+_SYMBOL_RULES: dict[str, list[tuple[str, str]]] = {
+    "javascript": [
+        ("function_declaration", "function"),
+        ("class_declaration", "class"),
+        ("method_definition", "method"),
+        ("function_expression", "function"),
+    ],
+    "typescript": [
+        ("function_declaration", "function"),
+        ("class_declaration", "class"),
+        ("method_definition", "method"),
+        ("function_expression", "function"),
+        ("interface_declaration", "interface"),
+        ("type_alias_declaration", "type"),
+        ("enum_declaration", "enum"),
+    ],
+    "go": [
+        ("function_declaration", "function"),
+        ("method_declaration", "method"),
+        ("type_declaration", "type"),
+        ("type_spec", "type"),
+    ],
+    "rust": [
+        ("function_item", "function"),
+        ("struct_item", "struct"),
+        ("enum_item", "enum"),
+        ("trait_item", "trait"),
+        ("impl_item", "impl"),
+    ],
+    "java": [
+        ("class_declaration", "class"),
+        ("interface_declaration", "interface"),
+        ("enum_declaration", "enum"),
+        ("method_declaration", "method"),
+    ],
+}
+
+# Some grammars name their declaration nodes with a ``type_identifier``
+# instead of an ``identifier`` (e.g. TypeScript type aliases, Go type specs);
+# the query patterns below use the correct node type per language.
+_NAME_NODE_TYPES: dict[str, dict[str, str]] = {
+    "typescript": {"type_alias_declaration": "type_identifier"},
+    "go": {"type_spec": "type_identifier"},
+}
+
+_QUERIES: dict[str, object] = {}
+
+
+class TreeSitterUnavailable(RuntimeError):
+    """Raised when tree-sitter (or a language grammar) is not installed."""
+
+
+def detect_language(path: str | Path) -> str | None:
+    """Return the language name for *path* by extension, or None."""
+    return LANG_BY_EXT.get(Path(path).suffix.lower())
+
+
+def is_supported(path: str | Path) -> bool:
+    return detect_language(path) is not None
+
+
+def _import_tree_sitter():  # pragma: no cover - requires optional extras
+    try:
+        from tree_sitter import Language, Parser  # noqa: F401
+
+        return Language, Parser
+    except ImportError as exc:
+        raise TreeSitterUnavailable(
+            "tree-sitter is not installed. Run: pip install -e '.[multi-language]'"
+        ) from exc
+
+
+def _load_language(name: str) -> object:  # pragma: no cover - requires optional extras
+    """Load a language grammar, supporting tree-sitter >= 0.21 binding APIs."""
+    try:
+        module = importlib.import_module(f"tree_sitter_{name}")
+    except ImportError as exc:
+        raise TreeSitterUnavailable(
+            f"Grammar for '{name}' not installed (tree-sitter-{name} package)"
+        ) from exc
+
+    factory = getattr(module, "language", None)
+    if factory is None:  # old-style bindings
+        raise TreeSitterUnavailable(f"Unsupported tree-sitter-{name} binding (no language())")
+    lang = factory()
+    # tree-sitter >= 0.22 returns a Language instance; 0.21 returns a handle.
+    try:
+        from tree_sitter import Language
+
+        if not isinstance(lang, Language):
+            lang = Language(lang)
+    except Exception:  # noqa: BLE001
+        pass
+    return lang
+
+
+def _query_for(name: str, Language) -> object:  # pragma: no cover - requires optional extras
+    if name in _QUERIES:
+        return _QUERIES[name]
+    name_node_overrides = _NAME_NODE_TYPES.get(name, {})
+    parts = [
+        f"({node} name: ({name_node_overrides.get(node, 'identifier')}) @name.{kind})"
+        for node, kind in _SYMBOL_RULES[name]
+    ]
+    query = Language.query(" ".join(parts))
+    _QUERIES[name] = query
+    return query
+
+
+def extract_symbols(path: str | Path) -> list[dict]:  # pragma: no cover - requires optional extras
+    """Extract ``{name, line, kind}`` symbols from a non-Python source file.
+
+    Raises ``TreeSitterUnavailable`` when the optional dependency is missing.
+    """
+    path = Path(path)
+    lang = detect_language(path)
+    if lang is None:
+        raise ValueError(f"Unsupported language for {path}")
+
+    Language, Parser = _import_tree_sitter()
+    grammar = _load_language(lang)
+    parser = Parser()
+    parser.language = grammar
+    source = path.read_bytes()
+
+    tree = parser.parse(source)
+    query = _query_for(lang, Language)
+    captures = query.captures(tree.root_node)
+
+    symbols: list[dict] = []
+    for node, tag in captures:
+        tag = str(tag)
+        if not tag.startswith("name."):
+            continue
+        name = node.text.decode("utf-8", errors="replace")
+        if not name:
+            continue
+        symbols.append(
+            {
+                "name": name,
+                "line": node.start_point[0] + 1,
+                "kind": tag.split(".", 1)[1],
+            }
+        )
+    return symbols