noah-code 0.1.0__py3-none-any.whl

noah_code/macos_sandbox.py

@@ -0,0 +1,142 @@
+"""Native macOS containment for NOOA's forked CodeAct worker."""
+
+from __future__ import annotations
+
+import contextlib
+import ctypes
+import ctypes.util
+import json
+import os
+import resource
+from collections.abc import Iterable
+from multiprocessing.connection import Connection
+from typing import Any
+
+
+class MacOSSandboxUnavailable(RuntimeError):
+    """Raised when the native macOS sandbox cannot be installed."""
+
+
+def _profile_path(path: str) -> str:
+    """Quote an absolute path as a sandbox profile string literal."""
+    return json.dumps(os.path.abspath(os.path.expanduser(path)))
+
+
+def build_macos_profile(read_paths: Iterable[str]) -> str:
+    """Build a deny-by-default profile with read-only interpreter access.
+
+    File metadata remains visible so Python can resolve imports and symlinks,
+    while file contents are readable only below explicitly trusted runtime
+    paths. The active repository is intentionally absent: workspace access must
+    cross the parent-side approval broker.
+    """
+    roots: set[str] = set()
+    for path in read_paths:
+        if not path:
+            continue
+        absolute = os.path.abspath(os.path.expanduser(path))
+        resolved = os.path.realpath(absolute)
+        if os.path.exists(resolved):
+            # macOS sandbox profiles match the path used by the operation, not
+            # only its canonical target. Keep both sides of symlinks such as
+            # /tmp -> /private/tmp and uv's versioned Python aliases.
+            roots.update({absolute, resolved})
+    roots.update(
+        path
+        for path in (
+            "/System/Library",
+            "/usr/lib",
+            "/private/var/db/dyld",
+        )
+        if os.path.exists(path)
+    )
+    ancestors: set[str] = {"/"}
+    for root in roots:
+        parent = os.path.dirname(root)
+        while parent and parent not in ancestors:
+            ancestors.add(parent)
+            next_parent = os.path.dirname(parent)
+            if next_parent == parent:
+                break
+            parent = next_parent
+    metadata_rules = "\n".join(
+        f"    (literal {_profile_path(path)})" for path in sorted(ancestors)
+    )
+    read_rules = "\n".join(f"    (subpath {_profile_path(path)})" for path in sorted(roots))
+    return f"""(version 1)
+(deny default)
+(allow file-read-metadata
+{metadata_rules}
+{read_rules}
+    (literal \"/dev/null\"))
+(allow file-read-data
+{read_rules}
+    (literal \"/dev/null\"))
+(allow file-write-data (literal \"/dev/null\"))
+(allow file-ioctl (literal \"/dev/null\"))
+(allow sysctl-read)
+(allow mach-lookup)
+(allow ipc-posix-shm)
+(allow signal (target self))
+"""
+
+
+def _install_native_sandbox(profile: str) -> None:
+    library = ctypes.util.find_library("sandbox")
+    if not library:
+        raise MacOSSandboxUnavailable("libsandbox is not available")
+    sandbox = ctypes.CDLL(library)
+    sandbox.sandbox_init.argtypes = [
+        ctypes.c_char_p,
+        ctypes.c_uint64,
+        ctypes.POINTER(ctypes.c_char_p),
+    ]
+    sandbox.sandbox_init.restype = ctypes.c_int
+    error = ctypes.c_char_p()
+    result = sandbox.sandbox_init(profile.encode(), 0, ctypes.byref(error))
+    if result == 0:
+        return
+    message = error.value.decode(errors="replace") if error.value else "unknown error"
+    free_error = getattr(sandbox, "sandbox_free_error", None)
+    if free_error is not None and error.value:
+        free_error(error)
+    raise MacOSSandboxUnavailable(f"sandbox_init failed: {message}")
+
+
+def _apply_resource_limits(*, max_memory_mb: int, max_cpu_seconds: int) -> None:
+    # macOS maps shared regions into a normal Python process at virtual sizes
+    # far beyond RLIMIT_AS, while RLIMIT_DATA cannot be lowered reliably below
+    # the inherited process footprint. Keep the parent-enforced wall timeout
+    # and CPU limit; the argument remains explicit so this difference cannot be
+    # mistaken for Linux's enforceable address-space cap.
+    _ = max_memory_mb
+    if max_cpu_seconds > 0:
+        limit = max_cpu_seconds
+        _, hard = resource.getrlimit(resource.RLIMIT_CPU)
+        if hard != resource.RLIM_INFINITY:
+            limit = min(limit, hard)
+        resource.setrlimit(resource.RLIMIT_CPU, (limit, limit))
+
+
+def macos_worker_main(
+    conn: Connection,
+    init: dict[str, Any],
+    profile: str,
+    max_memory_mb: int,
+    max_cpu_seconds: int,
+) -> None:  # pragma: no cover - executed in a forked worker
+    """Install irreversible guards, then enter NOOA's normal worker loop."""
+    try:
+        _apply_resource_limits(
+            max_memory_mb=max_memory_mb,
+            max_cpu_seconds=max_cpu_seconds,
+        )
+        _install_native_sandbox(profile)
+    except BaseException as exc:  # noqa: BLE001 - child must fail closed
+        with contextlib.suppress(Exception):
+            conn.send({"type": "fatal", "error": f"{type(exc).__name__}: {exc}"})
+        os._exit(3)
+
+    from nooa.runtime.sandbox.worker import worker_main
+
+    worker_main(conn, init)

noah_code/mcp_setup.py

@@ -0,0 +1,91 @@
+"""Optional MCP server attachment for CodingAgent."""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any
+
+from noah_code.approvals import ApprovalBroker
+from noah_code.config import NoahCodeConfig
+from noah_code.permissions import PermissionCategory, PermissionEngine
+
+
+def mcp_config_paths(workspace: Path) -> list[Path]:
+    return [
+        workspace / ".mcp.json",
+        workspace / ".noah-code" / "mcp.json",
+        Path.home() / ".config" / "noah-code" / "mcp.json",
+    ]
+
+
+async def install_mcp(
+    agent: Any,
+    workspace: Path,
+    config: NoahCodeConfig,
+    *,
+    engine: PermissionEngine,
+    approvals: ApprovalBroker,
+) -> str:
+    """Attach configured MCP servers as agent attributes when available.
+
+    Permission category ``mcp`` is checked before first use via a thin wrapper
+    only if we can gate at attach time; otherwise servers are attached and
+    documented as requiring the mcp permission policy.
+    """
+    servers = dict(config.mcp.get("servers") or {})
+    mcp_file: Path | None = None
+    for path in mcp_config_paths(workspace):
+        if path.is_file():
+            mcp_file = path
+            break
+
+    if not servers and mcp_file is None:
+        return "mcp: none configured"
+
+    try:
+        from nooa.mcp import MCPManager
+    except ImportError:
+        return "mcp: nooa[mcp] not installed"
+
+    decision = engine.decide(PermissionCategory.MCP, "*")
+    if decision.denied:
+        return f"mcp: denied ({decision.reason})"
+    if decision.needs_ask:
+        try:
+            await approvals.require(decision)
+        except PermissionError as exc:
+            return f"mcp: {exc}"
+
+    attached: list[str] = []
+    try:
+        names = list(servers.keys()) if servers else MCPManager.list_servers(mcp_file=mcp_file)
+    except Exception as exc:  # noqa: BLE001
+        return f"mcp: list failed ({exc})"
+
+    for name in names:
+        try:
+            spec = servers.get(name, {})
+            tool = MCPManager.create_from_server(
+                name,
+                mcp_file=mcp_file,
+                **{k: v for k, v in spec.items() if k != "name"},
+            )
+            # Sanitize attribute name.
+            attr = re_attr(name)
+            setattr(agent, attr, tool)
+            approved = getattr(agent, "_sandbox_approved_roots", None)
+            if isinstance(approved, set):
+                approved.add(attr)
+            attached.append(attr)
+        except Exception as exc:  # noqa: BLE001
+            return f"mcp: attached={attached} error on {name}: {exc}"
+    return f"mcp: attached={attached}"
+
+
+def re_attr(name: str) -> str:
+    import re
+
+    cleaned = re.sub(r"[^a-zA-Z0-9_]", "_", name)
+    if cleaned and cleaned[0].isdigit():
+        cleaned = f"mcp_{cleaned}"
+    return cleaned or "mcp_server"

noah_code/permissions.py

@@ -0,0 +1,400 @@
+"""Deterministic allow/ask/deny permission engine."""
+
+from __future__ import annotations
+
+import fnmatch
+import re
+import shlex
+from dataclasses import dataclass
+from enum import StrEnum
+from pathlib import Path
+from typing import Literal
+
+from noah_code.config import PermissionRule
+
+PermissionAction = Literal["allow", "ask", "deny"]
+
+
+class PermissionCategory(StrEnum):
+    READ = "read"
+    EDIT = "edit"
+    BASH = "bash"
+    EXTERNAL_DIRECTORY = "external_directory"
+    TASK = "task"
+    SKILL = "skill"
+    MCP = "mcp"
+    LSP = "lsp"
+
+
+# Patterns that are always denied regardless of mode / auto.
+_ALWAYS_DENY_BASH = (
+    re.compile(r"\brm\s+(-[^\s]*\s+)*-?[rR]?[fF]?[rR]?[fF]?\s+(/|\.|~|\*)"),
+    re.compile(r"\brm\s+.*\s+(-[^\s]*r|-rf|-fr)\b"),
+    re.compile(r"\b(mkfs|dd\s+if=|/dev/sd|/dev/disk|shred\b|wipefs\b)\b"),
+    re.compile(r":\(\)\s*\{\s*:\|:\s*&\s*\}\s*;:"),  # fork bomb
+    re.compile(r"\bgit\s+push\b"),
+    re.compile(r"\bgit\s+clean\b"),
+    re.compile(r"\bgit\s+reset\s+--hard\b"),
+    re.compile(r"\bgit\s+filter-branch\b"),
+    re.compile(r"\bprintenv\b"),
+    re.compile(r"\benv\b(?!\s+\w+=)"),
+    re.compile(r"\bexport\s+-p\b"),
+    re.compile(r"\bcat\s+.*\.pem\b"),
+    re.compile(r"\bcat\s+.*id_rsa\b"),
+    re.compile(r"\bchmod\s+-R\s+777\b"),
+    re.compile(r"\bcurl\b.*\|\s*(ba)?sh\b"),
+    re.compile(r"\bwget\b.*\|\s*(ba)?sh\b"),
+    re.compile(r"\bsudo\b"),
+    re.compile(r"\bchmod\b.+\s+/"),
+    re.compile(r"\bchown\b.+\s+/"),
+)
+
+# Mutating patterns that always require ask (even if a broad allow matched earlier
+# via auto) unless already an explicit session allow - handled by forcing ask
+# when compound/uncertain; these bump deny-adjacent risk to ask minimum.
+_ALWAYS_ASK_BASH = (
+    re.compile(r"\brm\b"),
+    re.compile(r"\bmv\b"),
+    re.compile(r"\bchmod\b"),
+    re.compile(r"\bchown\b"),
+    re.compile(r"\bkill\b"),
+    re.compile(r"\bpkill\b"),
+    re.compile(r"\bdocker\s+(rm|rmi|system\s+prune)\b"),
+    re.compile(r"\bnpm\s+(publish|unpublish)\b"),
+    re.compile(r"\bpip\s+install\b"),
+    re.compile(r"\buv\s+pip\s+install\b"),
+    re.compile(r"\bcurl\b"),
+    re.compile(r"\bwget\b"),
+)
+
+_MUTATING_GIT = re.compile(
+    r"\bgit\s+(commit|add|push|pull|fetch|rebase|merge|reset|clean|checkout|stash|tag|remote)\b"
+)
+_READ_ONLY_PREFIXES = (
+    "git status",
+    "git diff",
+    "git log",
+    "git show",
+    "git branch",
+    "git rev-parse",
+    "rg ",
+    "grep ",
+    "egrep ",
+    "fgrep ",
+    "find ",
+    "ls ",
+    "pwd",
+    "head ",
+    "tail ",
+    "wc ",
+    "file ",
+    "stat ",
+    "test ",
+    "pytest --collect-only",
+    "python -m pytest --collect-only",
+)
+_READ_ONLY_GIT_SUBCOMMANDS = frozenset({"branch", "diff", "log", "rev-parse", "show", "status"})
+
+_SECRET_BASENAMES = {
+    ".env",
+    ".env.local",
+    ".env.production",
+    ".env.development",
+    "credentials.json",
+    "service-account.json",
+    "id_rsa",
+    "id_ed25519",
+    "id_ecdsa",
+}
+_SECRET_SUFFIXES = (".pem", ".key", ".p12", ".pfx")
+_SECRET_ALLOW = {".env.example", ".env.sample", ".env.template"}
+
+
+@dataclass(frozen=True)
+class PermissionDecision:
+    category: str
+    target: str
+    action: PermissionAction
+    matching_rule: PermissionRule | None
+    reason: str
+    remember_pattern: str
+
+    @property
+    def allowed(self) -> bool:
+        return self.action == "allow"
+
+    @property
+    def denied(self) -> bool:
+        return self.action == "deny"
+
+    @property
+    def needs_ask(self) -> bool:
+        return self.action == "ask"
+
+
+def is_secret_path(path: str | Path) -> bool:
+    p = Path(path)
+    name = p.name
+    if name in _SECRET_ALLOW:
+        return False
+    if name in _SECRET_BASENAMES:
+        return True
+    if name.startswith(".env.") and name not in _SECRET_ALLOW:
+        return True
+    if any(name.endswith(suf) for suf in _SECRET_SUFFIXES):
+        return True
+    if "id_rsa" in name or "id_ed25519" in name:
+        return True
+    parts = p.parts
+    if ".git" in parts:
+        return True
+    return name.endswith(".db") and "noah-code" in str(p)
+
+
+def _match_rule(rule: PermissionRule, category: str, target: str) -> bool:
+    cat_ok = rule.category in {"*", category}
+    if not cat_ok:
+        return False
+    return fnmatch.fnmatch(target, rule.pattern) or fnmatch.fnmatch(Path(target).name, rule.pattern)
+
+
+class PermissionEngine:
+    """Ordered wildcard rules; last matching rule wins."""
+
+    def __init__(
+        self,
+        rules: list[PermissionRule] | None = None,
+        *,
+        mode: Literal["build", "plan"] = "build",
+        auto_approve: bool = False,
+    ) -> None:
+        self.rules: list[PermissionRule] = list(rules or [])
+        self.mode = mode
+        self.auto_approve = auto_approve
+        self._session_rules: list[PermissionRule] = []
+
+    def add_session_rule(self, rule: PermissionRule) -> None:
+        self._session_rules.append(rule)
+
+    def snapshot_session_rules(self) -> list[dict]:
+        return [r.model_dump() for r in self._session_rules]
+
+    def load_session_rules(self, raw: list[dict] | None) -> None:
+        self._session_rules = [PermissionRule.model_validate(r) for r in (raw or [])]
+
+    def decide(self, category: str, target: str) -> PermissionDecision:
+        normalized = target.strip() or "*"
+        # Hard denies for secrets on read/edit.
+        if (
+            category in {PermissionCategory.READ, PermissionCategory.EDIT}
+            and is_secret_path(normalized)
+            and Path(normalized).name not in _SECRET_ALLOW
+        ):
+            return PermissionDecision(
+                category=category,
+                target=normalized,
+                action="deny",
+                matching_rule=None,
+                reason="secret or credential path denied",
+                remember_pattern=normalized,
+            )
+
+        if category == PermissionCategory.BASH:
+            hard = self._hard_bash_deny(normalized)
+            if hard is not None:
+                return hard
+
+        if self.mode == "plan":
+            plan = self._plan_mode_gate(category, normalized)
+            if plan is not None:
+                return plan
+
+        matching: PermissionRule | None = None
+        for rule in [*self.rules, *self._session_rules]:
+            if _match_rule(rule, category, normalized):
+                matching = rule
+
+        if matching is None:
+            action: PermissionAction = "ask"
+            reason = "no matching rule; default ask"
+        else:
+            action = matching.action
+            reason = matching.reason or f"matched {matching.pattern}"
+
+        if category == PermissionCategory.BASH and action == "allow":
+            elevated = self._elevated_bash_ask(normalized)
+            if elevated is not None:
+                action = elevated.action
+                reason = elevated.reason
+                matching = elevated.matching_rule
+
+        if action == "ask" and self.auto_approve:
+            # --auto never overrides explicit deny; only ask → allow.
+            action = "allow"
+            reason = f"{reason} (auto-approved)"
+
+        return PermissionDecision(
+            category=category,
+            target=normalized,
+            action=action,
+            matching_rule=matching,
+            reason=reason,
+            remember_pattern=self._remember_pattern(category, normalized),
+        )
+
+    def _remember_pattern(self, category: str, target: str) -> str:
+        if category == PermissionCategory.BASH:
+            try:
+                parts = shlex.split(target)
+            except ValueError:
+                parts = target.split()
+            if parts:
+                return f"{parts[0]} *"
+            return "*"
+        return target
+
+    def _hard_bash_deny(self, command: str) -> PermissionDecision | None:
+        try:
+            tokens = shlex.split(command)
+        except ValueError:
+            tokens = []
+
+        for index, token in enumerate(tokens):
+            if Path(token).name != "git":
+                continue
+            remaining = tokens[index + 1 :]
+            if any(part in {"push", "clean", "filter-branch"} for part in remaining) or (
+                "reset" in remaining and "--hard" in remaining
+            ):
+                return PermissionDecision(
+                    category=PermissionCategory.BASH,
+                    target=command,
+                    action="deny",
+                    matching_rule=None,
+                    reason="destructive git command denied",
+                    remember_pattern=command,
+                )
+            if self.auto_approve and not self.is_readonly_command(command):
+                return PermissionDecision(
+                    category=PermissionCategory.BASH,
+                    target=command,
+                    action="deny",
+                    matching_rule=None,
+                    reason="mutating or unrecognized git commands are not auto-approved",
+                    remember_pattern=command,
+                )
+
+        for pat in _ALWAYS_DENY_BASH:
+            if pat.search(command):
+                return PermissionDecision(
+                    category=PermissionCategory.BASH,
+                    target=command,
+                    action="deny",
+                    matching_rule=None,
+                    reason="destructive or secret-exposing command denied",
+                    remember_pattern=command,
+                )
+        lowered = command.lower()
+        if "aws_secret" in lowered or "private key" in lowered:
+            return PermissionDecision(
+                category=PermissionCategory.BASH,
+                target=command,
+                action="deny",
+                matching_rule=None,
+                reason="credential dump denied",
+                remember_pattern=command,
+            )
+        return None
+
+    def _elevated_bash_ask(self, command: str) -> PermissionDecision | None:
+        """Force ask for risky commands unless a session allow rule already matched."""
+        session_allowed = any(
+            r.action == "allow" and _match_rule(r, PermissionCategory.BASH, command)
+            for r in self._session_rules
+        )
+        if session_allowed:
+            return None
+        for pat in _ALWAYS_ASK_BASH:
+            if pat.search(command):
+                return PermissionDecision(
+                    category=PermissionCategory.BASH,
+                    target=command,
+                    action="ask",
+                    matching_rule=None,
+                    reason="elevated-risk shell command requires approval",
+                    remember_pattern=self._remember_pattern(PermissionCategory.BASH, command),
+                )
+        return None
+
+    def _plan_mode_gate(self, category: str, target: str) -> PermissionDecision | None:
+        if category == PermissionCategory.EDIT:
+            return PermissionDecision(
+                category=category,
+                target=target,
+                action="deny",
+                matching_rule=None,
+                reason="plan mode forbids file edits",
+                remember_pattern=target,
+            )
+        if category == PermissionCategory.BASH and not self.is_readonly_command(target):
+            return PermissionDecision(
+                category=category,
+                target=target,
+                action="deny",
+                matching_rule=None,
+                reason="plan mode forbids mutating shell commands",
+                remember_pattern=target,
+            )
+        return None
+
+    @staticmethod
+    def is_readonly_command(command: str) -> bool:
+        cmd = command.strip()
+        if not cmd:
+            return True
+        if _is_compound(cmd):
+            return False
+        lowered = cmd.lower()
+        if _MUTATING_GIT.search(lowered):
+            return False
+        try:
+            tokens = shlex.split(cmd)
+        except ValueError:
+            return False
+        if not tokens:
+            return True
+        program = Path(tokens[0]).name.lower()
+        if program == "git":
+            return len(tokens) > 1 and tokens[1].lower() in _READ_ONLY_GIT_SUBCOMMANDS
+        if program == "pwd":
+            return len(tokens) == 1
+        return any(lowered == p.strip() or lowered.startswith(p) for p in _READ_ONLY_PREFIXES[6:])
+
+    @staticmethod
+    def is_uncertain_shell(command: str) -> bool:
+        return _is_compound(command)
+
+
+def _is_compound(command: str) -> bool:
+    """Detect pipes, chains, redirects, substitutions, heredocs."""
+    # Rough conservative scan - not a full shell parser.
+    specials = ("|", "&&", "||", ";", "`", "$(", "${", ">", "<", "<<", "\n")
+    in_single = False
+    in_double = False
+    i = 0
+    while i < len(command):
+        ch = command[i]
+        if ch == "'" and not in_double:
+            in_single = not in_single
+        elif ch == '"' and not in_single:
+            in_double = not in_double
+        elif not in_single and not in_double:
+            for sp in specials:
+                if command.startswith(sp, i):
+                    return True
+        i += 1
+    try:
+        shlex.split(command)
+    except ValueError:
+        return True
+    return False