maf-sandbox-codeact 0.22.0__tar.gz → 0.23.0__tar.gz

{maf_sandbox_codeact-0.22.0 → maf_sandbox_codeact-0.23.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maf-sandbox-codeact
-Version: 0.22.0
+Version: 0.23.0
 Summary: CodeAct as a Microsoft Agent Framework tool — the model writes a short Python program and it runs inside a sandbox — written against maf-sandbox so it runs on any sandbox backend.
 Keywords: codeact,code-execution,sandbox,agent-framework,microsoft-agent-framework
 Author: SOKOLAI BV
@@ -15,8 +15,8 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development :: Interpreters
-Requires-Dist: maf-sandbox>=0.47.0,<0.48
-Requires-Dist: agent-framework-core>=1.19.0,<1.20
+Requires-Dist: maf-sandbox>=0.48.0,<0.49
+Requires-Dist: agent-framework-core>=1.20.0,<1.21
 Requires-Python: >=3.12, <3.15
 Project-URL: Homepage, https://www.sokol.ai
 Project-URL: Source, https://github.com/sokolaidev/maf-extensions
@@ -135,6 +135,41 @@ Network access is closed unless `egress_allow` names hosts. An allowed host can
 
 See [host-tool controls](https://github.com/sokolaidev/maf-extensions/blob/main/docs/sandbox/hosts.md#calling-host-tools) for registration, identities and limits.
 
+### Disable host functions when FIDES is enabled
+
+Pass `host_tools_enabled=False` to `make_codeact_tools` and, if constructing a spec separately, `codeact_sandbox_spec`. CodeAct ignores any supplied registry without reading or sealing it. It requests no `HOST_TOOLS`, advertises no host functions and installs no host-tool channel; Python computation remains available. The default is `True`, preserving registry behavior. The switch is host configuration and never a model tool argument.
+
+Use the same trusted setting that installs FIDES middleware. CodeAct does not infer that setting from tool metadata or the current call's security context:
+
+```python
+from agent_framework import Agent
+from agent_framework.security import (
+    LabelTrackingFunctionMiddleware,
+    PolicyEnforcementFunctionMiddleware,
+)
+from maf_sandbox_codeact import make_codeact_tools
+
+fides_enabled = True
+codeact_tools = make_codeact_tools(
+    router,
+    "data-analyst",
+    context,
+    host_tools=registry,
+    host_tools_enabled=not fides_enabled,
+    image="mcr.microsoft.com/devcontainers/python:3.13-bookworm",
+)
+middleware = (
+    [LabelTrackingFunctionMiddleware(), PolicyEnforcementFunctionMiddleware()]
+    if fides_enabled
+    else []
+)
+agent = Agent(client=client, tools=[sensitive_tool, *codeact_tools], middleware=middleware)
+```
+
+The host supplies `sensitive_tool` as an ordinary agent function tool with its FIDES declarations. Direct calls still pass through that middleware; generated code cannot reach the function through CodeAct's disabled channel. File, artifact and network settings remain independent.
+
+The setting is captured when building tools. To change it, stop admission through the old tool surface, await or cancel its active calls and complete cleanup, dispose its CodeAct sandboxes, then rebuild and replace the tools and middleware together. Changing the configuration variable alone does not revoke an existing tool. The router refuses reuse of a known sandbox with a different host-tool enablement contract; hosts must also retire old surfaces and instances across processes. This option disables nested calls and does not implement per-host-tool FIDES mediation.
+
 ## Runtime backends
 
 Use `CodeactRuntime` to select `run_code` instead of command execution. The host must verify that the backend evaluates Python statements and returns their output. The required instructions describe the modules and facilities available to the model.

{maf_sandbox_codeact-0.22.0 → maf_sandbox_codeact-0.23.0}/README.md

@@ -110,6 +110,41 @@ Network access is closed unless `egress_allow` names hosts. An allowed host can
 
 See [host-tool controls](https://github.com/sokolaidev/maf-extensions/blob/main/docs/sandbox/hosts.md#calling-host-tools) for registration, identities and limits.
 
+### Disable host functions when FIDES is enabled
+
+Pass `host_tools_enabled=False` to `make_codeact_tools` and, if constructing a spec separately, `codeact_sandbox_spec`. CodeAct ignores any supplied registry without reading or sealing it. It requests no `HOST_TOOLS`, advertises no host functions and installs no host-tool channel; Python computation remains available. The default is `True`, preserving registry behavior. The switch is host configuration and never a model tool argument.
+
+Use the same trusted setting that installs FIDES middleware. CodeAct does not infer that setting from tool metadata or the current call's security context:
+
+```python
+from agent_framework import Agent
+from agent_framework.security import (
+    LabelTrackingFunctionMiddleware,
+    PolicyEnforcementFunctionMiddleware,
+)
+from maf_sandbox_codeact import make_codeact_tools
+
+fides_enabled = True
+codeact_tools = make_codeact_tools(
+    router,
+    "data-analyst",
+    context,
+    host_tools=registry,
+    host_tools_enabled=not fides_enabled,
+    image="mcr.microsoft.com/devcontainers/python:3.13-bookworm",
+)
+middleware = (
+    [LabelTrackingFunctionMiddleware(), PolicyEnforcementFunctionMiddleware()]
+    if fides_enabled
+    else []
+)
+agent = Agent(client=client, tools=[sensitive_tool, *codeact_tools], middleware=middleware)
+```
+
+The host supplies `sensitive_tool` as an ordinary agent function tool with its FIDES declarations. Direct calls still pass through that middleware; generated code cannot reach the function through CodeAct's disabled channel. File, artifact and network settings remain independent.
+
+The setting is captured when building tools. To change it, stop admission through the old tool surface, await or cancel its active calls and complete cleanup, dispose its CodeAct sandboxes, then rebuild and replace the tools and middleware together. Changing the configuration variable alone does not revoke an existing tool. The router refuses reuse of a known sandbox with a different host-tool enablement contract; hosts must also retire old surfaces and instances across processes. This option disables nested calls and does not implement per-host-tool FIDES mediation.
+
 ## Runtime backends
 
 Use `CodeactRuntime` to select `run_code` instead of command execution. The host must verify that the backend evaluates Python statements and returns their output. The required instructions describe the modules and facilities available to the model.

{maf_sandbox_codeact-0.22.0 → maf_sandbox_codeact-0.23.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "maf-sandbox-codeact"
-version = "0.22.0"
+version = "0.23.0"
 description = "CodeAct as a Microsoft Agent Framework tool — the model writes a short Python program and it runs inside a sandbox — written against maf-sandbox so it runs on any sandbox backend."
 readme = "README.md"
 requires-python = ">=3.12,<3.15"
@@ -24,8 +24,8 @@ classifiers = [
     "Topic :: Software Development :: Interpreters",
 ]
 dependencies = [
-    "maf-sandbox>=0.47.0,<0.48",
-    "agent-framework-core>=1.19.0,<1.20",
+    "maf-sandbox>=0.48.0,<0.49",
+    "agent-framework-core>=1.20.0,<1.21",
 ]
 
 [[project.authors]]

{maf_sandbox_codeact-0.22.0 → maf_sandbox_codeact-0.23.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "maf-sandbox-codeact"
-version = "0.22.0"
+version = "0.23.0"
 description = "CodeAct as a Microsoft Agent Framework tool — the model writes a short Python program and it runs inside a sandbox — written against maf-sandbox so it runs on any sandbox backend."
 readme = "README.md"
 requires-python = ">=3.12,<3.15"
@@ -35,11 +35,10 @@ dependencies = [
     # import, and that one fails at the call, where no import check is looking. The number
     # itself is below, and `scripts/set_dependents_range.py` moves it — so this says which
     # release the floor is for, never which release that is.
-    "maf-sandbox>=0.47.0,<0.48",
-    # The `@tool` decorator. MAF is a genuine dependency of the tool itself, not of the host
-    # application. Both ends of the range are measured: 1.19 made an item's embedded label
-    # restrict-only, which the result wrapper now works with rather than against.
-    "agent-framework-core>=1.19.0,<1.20",
+    "maf-sandbox>=0.48.0,<0.49",
+    # MAF 1.20 binds approvals to the issuing session; older minors are excluded.
+    # The ceiling admits only the minor covered by the framework-contract tests.
+    "agent-framework-core>=1.20.0,<1.21",
 ]
 
 [project.urls]

{maf_sandbox_codeact-0.22.0 → maf_sandbox_codeact-0.23.0}/src/maf_sandbox_codeact/__init__.py

@@ -32,8 +32,8 @@ __all__ = [
     "make_codeact_tools",
 ]
 
-# Experimental package (Beta): importing it emits a UserWarning rather than a FutureWarning,
-# so a host running under `python -W error` can still import it.
+# Experimental package (Beta): importing it emits a warning, and catches it when
+# `python -W error` promotes it, so such a host can still import the package.
 import warnings as _warnings
 
 

{maf_sandbox_codeact-0.22.0 → maf_sandbox_codeact-0.23.0}/src/maf_sandbox_codeact/_tool.py

@@ -202,6 +202,7 @@ def codeact_sandbox_spec(
     files_in: TransferLimits = _DEFAULT_FILES_IN,
     files_out: TransferLimits = _DEFAULT_FILES_OUT,
     host_tools: HostToolRegistry | None = None,
+    host_tools_enabled: bool = True,
     egress_allow: Sequence[str | EgressRule] = (),
     runtime: CodeactRuntime | None = None,
     program: ProgramRequirements = ProgramRequirements(),
@@ -254,6 +255,10 @@ def codeact_sandbox_spec(
     one refuses this spec at attach.  Reading a registry **seals** it, so ask for the spec once
     everything is registered.
 
+    ``host_tools_enabled=False`` ignores the registry without reading or sealing it.
+    Pass ``not fides_enabled`` from trusted host configuration to disable nested calls
+    while FIDES is enabled. Rebuild the tools and dispose existing sandboxes when changing it.
+
     Raises:
         ValueError: when an ``egress_allow`` host is blank, scheme-qualified, or holds
             whitespace or a comma.
@@ -265,7 +270,8 @@ def codeact_sandbox_spec(
         outputs=outputs,
         files_in=files_in,
         files_out=files_out,
-        surface=_host_tools(host_tools),
+        surface=_host_tools(_enabled_host_tools(host_tools, host_tools_enabled)),
+        host_tools_enabled=host_tools_enabled,
         egress_allow=egress_allow,
         runtime=runtime,
         program=program,
@@ -285,6 +291,7 @@ def make_codeact_tools(
     withhold_guest_output: bool = False,
     outbound_max_confidentiality: str | None = None,
     host_tools: HostToolRegistry | None = None,
+    host_tools_enabled: bool = True,
     image: str | None = None,
     image_id: str | None = None,
     exec_timeout_seconds: int = 120,
@@ -402,6 +409,10 @@ def make_codeact_tools(
             answered the sink question, the guest may hand it conversation-derived arguments,
             and every other undeclared leg is read as the worst it could be — so this one is
             too, and the cap above applies.
+        host_tools_enabled: Host-only switch, default ``True``. ``False`` ignores the registry
+            without reading or sealing it and installs no host-tool channel. Pass
+            ``not fides_enabled`` from the same configuration that installs FIDES middleware.
+            Rebuild the tools and dispose existing sandboxes when changing this setting.
         image: OCI reference of a sandbox image with a Python interpreter on its path.
         image_id: A backend-native disk-image id, skipping resolution.
         exec_timeout_seconds: Execution bound; for ``run_code`` this includes backend queue
@@ -437,6 +448,7 @@ def make_codeact_tools(
     """
     configured = router is not None and router.enabled
     if configured:
+        host_tools = _enabled_host_tools(host_tools, host_tools_enabled)
         _validate_runtime(runtime, takes_files=file_store is not None, outputs=outputs)
         if runtime is not None and host_tools is not None and len(host_tools):
             raise ValueError("CodeAct runtime host tools require a native channel; not supported")
@@ -516,6 +528,7 @@ def make_codeact_tools(
         files_in=files_in,
         files_out=files_out,
         surface=surface,
+        host_tools_enabled=host_tools_enabled if configured else True,
         egress_allow=egress_allow if configured else (),
         runtime=runtime if configured else None,
         program=program if configured else ProgramRequirements(),
@@ -644,6 +657,14 @@ def _validated_hosts(hosts: Sequence[str | EgressRule]) -> tuple[str | EgressRul
     return tuple(hosts)
 
 
+def _enabled_host_tools(
+    host_tools: HostToolRegistry | None, enabled: bool
+) -> HostToolRegistry | None:
+    if not isinstance(cast(object, enabled), bool):
+        raise TypeError("host_tools_enabled must be a bool from trusted host configuration")
+    return host_tools if enabled else None
+
+
 def _host_tools(host_tools: HostToolRegistry | None) -> HostToolAggregate | None:
     """What a host's registry means for this kind, or ``None`` when nothing is callable.
 
@@ -667,6 +688,7 @@ def _codeact_spec(
     files_in: TransferLimits,
     files_out: TransferLimits,
     surface: HostToolAggregate | None,
+    host_tools_enabled: bool = True,
     egress_allow: Sequence[str | EgressRule] = (),
     runtime: CodeactRuntime | None = None,
     program: ProgramRequirements = ProgramRequirements(),
@@ -703,6 +725,11 @@ def _codeact_spec(
     if authority:
         requires.add(Capability.ATTACHED_IDENTITY)
     egress = Egress.ALLOWLIST if effective_egress else Egress.CLOSED
+    execution_contract = (
+        runtime_contract(runtime) if runtime is not None else f"codeact:{program.profile}"
+    )
+    if not host_tools_enabled:
+        execution_contract += ":host-tools-disabled"
     return SandboxSpec(
         kind=CODEACT_KIND,
         image=image,
@@ -713,9 +740,7 @@ def _codeact_spec(
         max_identity_scope=IdentityScope.PER_SANDBOX if authority else None,
         max_identity_retention_seconds=credential_retention_seconds,
         work_dir=runtime.guest_work_dir if runtime is not None else None,
-        execution_contract=runtime_contract(runtime)
-        if runtime is not None
-        else f"codeact:{program.profile}",
+        execution_contract=execution_contract,
         program=program if runtime is None else None,
         # Model-written code can write outside the call path and leave processes running.
         confined_to_guest_call_path=False,