oasr 0.5.1__py3-none-any.whl → 0.6.0__py3-none-any.whl

policy/profile.py

@@ -11,7 +11,7 @@ from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any
 
-from policy.defaults import SAFE
+from profiles import BUILTIN_PROFILES, merge_profile_data
 
 
 @dataclass
@@ -107,17 +107,15 @@ def load(config: dict[str, Any], profile_name: str, cwd: Path | None = None) ->
 def _load_impl(config: dict[str, Any], profile_name: str) -> Profile:
     """Internal implementation of load()."""
     # Start with safe defaults
-    profile_data = SAFE.copy()
+    profile_data = BUILTIN_PROFILES["safe"].copy()
 
     # Try to load user-defined profile
     try:
         profiles = config.get("profiles", {})
         if profile_name in profiles:
-            user_profile = profiles[profile_name]
-            # Merge user overrides
-            for key in SAFE.keys():
-                if key in user_profile:
-                    profile_data[key] = user_profile[key]
+            profile_data = merge_profile_data(profile_data, profiles[profile_name])
+        elif profile_name in BUILTIN_PROFILES:
+            profile_data = merge_profile_data(profile_data, BUILTIN_PROFILES[profile_name])
         elif profile_name != "safe":
             # Warn if non-safe profile doesn't exist, but continue with safe defaults
             print(

profiles/__init__.py

@@ -0,0 +1,23 @@
+"""Profile loading utilities for OASR."""
+
+from profiles.builtins import BUILTIN_PROFILE_ORDER, BUILTIN_PROFILES
+from profiles.loader import load_profiles, merge_profile_data
+from profiles.paths import ensure_profile_dir, get_profile_dir
+from profiles.registry import get_profiles, list_profiles
+from profiles.summary import format_profile_summary, sorted_profile_names
+from profiles.validation import validate_profile_data, validate_profiles
+
+__all__ = [
+    "BUILTIN_PROFILES",
+    "BUILTIN_PROFILE_ORDER",
+    "load_profiles",
+    "get_profile_dir",
+    "ensure_profile_dir",
+    "format_profile_summary",
+    "get_profiles",
+    "list_profiles",
+    "merge_profile_data",
+    "sorted_profile_names",
+    "validate_profile_data",
+    "validate_profiles",
+]

profiles/builtins.py

@@ -0,0 +1,63 @@
+"""Built-in execution policy profiles."""
+
+from __future__ import annotations
+
+from typing import Any
+
+SAFE = {
+    "fs_read_roots": ["./"],
+    "fs_write_roots": ["./out", "./.oasr"],
+    "deny_paths": [
+        "~/.ssh",
+        "~/.aws",
+        "~/.gnupg",
+        "~/.config",
+        ".env",
+        "~/.bashrc",
+        "~/.zshrc",
+        "~/.profile",
+    ],
+    "allowed_commands": ["rg", "fd", "jq", "cat"],
+    "deny_shell": True,
+    "network": False,
+    "allow_env": False,
+}
+
+STRICT = {
+    "fs_read_roots": ["./"],
+    "fs_write_roots": ["./.oasr"],
+    "deny_paths": SAFE["deny_paths"],
+    "allowed_commands": ["rg", "cat"],
+    "deny_shell": True,
+    "network": False,
+    "allow_env": False,
+}
+
+DEV = {
+    "fs_read_roots": ["./", "~/projects"],
+    "fs_write_roots": ["./", "./out", "./.oasr", "~/projects"],
+    "deny_paths": SAFE["deny_paths"],
+    "allowed_commands": ["bash", "python", "node", "git", "curl", "rg", "fd", "jq", "cat", "npm", "pip"],
+    "deny_shell": False,
+    "network": True,
+    "allow_env": True,
+}
+
+UNSAFE = {
+    "fs_read_roots": ["/"],
+    "fs_write_roots": ["/"],
+    "deny_paths": [],
+    "allowed_commands": ["*"],
+    "deny_shell": False,
+    "network": True,
+    "allow_env": True,
+}
+
+BUILTIN_PROFILES: dict[str, dict[str, Any]] = {
+    "safe": SAFE,
+    "strict": STRICT,
+    "dev": DEV,
+    "unsafe": UNSAFE,
+}
+
+BUILTIN_PROFILE_ORDER = ("safe", "strict", "dev", "unsafe")

profiles/loader.py

@@ -0,0 +1,74 @@
+"""Profile loading and merging utilities."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+from typing import Any
+
+if sys.version_info >= (3, 11):
+    import tomllib
+else:
+    import tomli as tomllib
+
+from profiles.builtins import BUILTIN_PROFILES
+from profiles.paths import get_profile_dir
+
+
+def list_profile_files(profile_dir: Path | None = None) -> list[Path]:
+    """Return profile files from ~/.oasr/profile."""
+    directory = profile_dir or get_profile_dir()
+    if not directory.exists():
+        return []
+    return sorted(p for p in directory.glob("*.toml") if p.is_file())
+
+
+def load_profile_file(path: Path) -> dict[str, Any]:
+    """Load a profile TOML file containing only profile keys."""
+    with open(path, "rb") as f:
+        data = tomllib.load(f)
+    if not isinstance(data, dict):
+        raise ValueError("Profile file must contain a table of profile settings")
+    return data
+
+
+def load_profile_files(profile_dir: Path | None = None) -> dict[str, dict[str, Any]]:
+    """Load profile files into a name->profile map."""
+    profiles: dict[str, dict[str, Any]] = {}
+    for path in list_profile_files(profile_dir):
+        name = path.stem
+        try:
+            profiles[name] = load_profile_file(path)
+        except Exception as exc:
+            print(f"⚠ Warning: Failed to load profile '{name}': {exc}", file=sys.stderr)
+    return profiles
+
+
+def merge_profiles(
+    builtin: dict[str, dict[str, Any]],
+    file_profiles: dict[str, dict[str, Any]],
+    inline_profiles: dict[str, dict[str, Any]],
+) -> dict[str, dict[str, Any]]:
+    """Merge profiles with precedence: inline > file > builtin."""
+    merged: dict[str, dict[str, Any]] = {}
+    for source in (builtin, file_profiles, inline_profiles):
+        for name, profile in source.items():
+            merged[name] = profile.copy()
+    return merged
+
+
+def merge_profile_data(base: dict[str, Any], overrides: dict[str, Any]) -> dict[str, Any]:
+    """Merge profile values with override precedence."""
+    merged = base.copy()
+    merged.update(overrides)
+    return merged
+
+
+def load_profiles(
+    inline_profiles: dict[str, dict[str, Any]] | None = None,
+    profile_dir: Path | None = None,
+) -> dict[str, dict[str, Any]]:
+    """Load merged profiles from builtin + profile files + inline config."""
+    inline_profiles = inline_profiles or {}
+    file_profiles = load_profile_files(profile_dir)
+    return merge_profiles(BUILTIN_PROFILES, file_profiles, inline_profiles)

profiles/paths.py

@@ -0,0 +1,22 @@
+"""Profile directory paths and helpers."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+
+def get_profile_dir() -> Path:
+    """Return ~/.oasr/profile directory (dynamic)."""
+    try:
+        from config import OASR_DIR
+
+        return OASR_DIR / "profile"
+    except Exception:
+        return Path.home() / ".oasr" / "profile"
+
+
+def ensure_profile_dir() -> Path:
+    """Ensure ~/.oasr/profile directory exists."""
+    directory = get_profile_dir()
+    directory.mkdir(parents=True, exist_ok=True)
+    return directory

profiles/registry.py

@@ -0,0 +1,19 @@
+"""Profile registry operations."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from profiles.loader import load_profiles
+from profiles.summary import sorted_profile_names
+
+
+def list_profiles(inline_profiles: dict[str, dict[str, Any]] | None = None) -> list[str]:
+    """Return ordered profile names with all sources merged."""
+    profiles = load_profiles(inline_profiles=inline_profiles or {})
+    return sorted_profile_names(profiles)
+
+
+def get_profiles(inline_profiles: dict[str, dict[str, Any]] | None = None) -> dict[str, dict[str, Any]]:
+    """Return merged profiles."""
+    return load_profiles(inline_profiles=inline_profiles or {})

profiles/summary.py

@@ -0,0 +1,23 @@
+"""Profile listing and summary helpers."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from profiles.builtins import BUILTIN_PROFILE_ORDER
+
+
+def sorted_profile_names(profiles: dict[str, Any]) -> list[str]:
+    """Return profile names sorted with built-ins first."""
+    names = sorted(profiles.keys())
+    ordered = [name for name in BUILTIN_PROFILE_ORDER if name in profiles]
+    remaining = [name for name in names if name not in ordered]
+    return ordered + remaining
+
+
+def format_profile_summary(name: str, profile: dict[str, Any]) -> str:
+    """Format a single-line profile summary."""
+    network = "on" if profile.get("network") else "off"
+    env = "on" if profile.get("allow_env") else "off"
+    shell = "on" if not profile.get("deny_shell", True) else "off"
+    return f"{name:12} network={network} env={env} shell={shell}"

profiles/validation.py

@@ -0,0 +1,34 @@
+"""Profile validation helpers."""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+def validate_profile_data(profile_name: str, profile_data: dict[str, Any]) -> None:
+    """Validate a single profile data structure."""
+    if "fs_read_roots" in profile_data and not isinstance(profile_data["fs_read_roots"], list):
+        raise ValueError(f"Profile '{profile_name}': fs_read_roots must be a list")
+    if "fs_write_roots" in profile_data and not isinstance(profile_data["fs_write_roots"], list):
+        raise ValueError(f"Profile '{profile_name}': fs_write_roots must be a list")
+    if "deny_paths" in profile_data and not isinstance(profile_data["deny_paths"], list):
+        raise ValueError(f"Profile '{profile_name}': deny_paths must be a list")
+    if "allowed_commands" in profile_data and not isinstance(profile_data["allowed_commands"], list):
+        raise ValueError(f"Profile '{profile_name}': allowed_commands must be a list")
+    if "deny_shell" in profile_data and not isinstance(profile_data["deny_shell"], bool):
+        raise ValueError(f"Profile '{profile_name}': deny_shell must be a boolean")
+    if "network" in profile_data and not isinstance(profile_data["network"], bool):
+        raise ValueError(f"Profile '{profile_name}': network must be a boolean")
+    if "allow_env" in profile_data and not isinstance(profile_data["allow_env"], bool):
+        raise ValueError(f"Profile '{profile_name}': allow_env must be a boolean")
+
+
+def validate_profiles(profiles: dict[str, Any]) -> None:
+    """Validate profile map structure."""
+    if not isinstance(profiles, dict):
+        raise ValueError("profiles must be a table (dictionary)")
+
+    for profile_name, profile_data in profiles.items():
+        if not isinstance(profile_data, dict):
+            raise ValueError(f"Profile '{profile_name}' must be a table (dictionary)")
+        validate_profile_data(profile_name, profile_data)