polyrob 0.5.0__py3-none-any.whl

core/runtime_paths.py

@@ -0,0 +1,135 @@
+"""Location: core/runtime_paths.py
+
+One resolver for all path roots — the single seam that separates installed
+**code** (read-only), **config** (secrets), and the **runtime workspace** the
+agent can write to.
+
+The whole point (doc 01 "runtime isolation"): on the SERVER/headless path,
+``realpath(workspace_root)`` must NOT live under ``realpath(code_root)`` (the
+install/code tree that also holds ``config/.env.production`` secrets), so even a
+confinement miss in a file tool cannot reach the agent's own source or the master
+secrets. The CLI *local* mode is the single documented exception — it keeps
+Claude-Code-style CWD-as-workspace (consented, single-user).
+
+This module is intentionally dependency-light and lives in ``core/`` (NOT on the
+action-registration import path), so it carries no ``from __future__ import
+annotations`` landmine. ``POLYROB_DATA_DIR`` is read via ``os.getenv`` only —
+never ``BotConfig.get`` (which is a getattr that silently ignores the env).
+"""
+
+import os
+from dataclasses import dataclass
+from pathlib import Path
+
+
+# code_root == the install/code root: the parent of this ``core/`` package.
+# Same value as ``core/config.py``'s ``base_dir`` (dirname(dirname(__file__))).
+_CODE_ROOT = Path(__file__).resolve().parent.parent
+
+# FHS default for a systemd service's mutable state. Used on the server path when
+# no explicit POLYROB_DATA_DIR is given and the location is writable/creatable.
+_SERVER_DATA_HOME = Path("/var/lib/polyrob")
+
+
+@dataclass(frozen=True)
+class RuntimePaths:
+    """The four resolved path roots. Frozen — resolve once, read everywhere."""
+
+    code_root: Path
+    config_dir: Path
+    data_home: Path
+    workspace_root: Path
+
+
+def _server_default_data_home() -> Path:
+    """Server data-home when POLYROB_DATA_DIR is unset.
+
+    Prefer FHS ``/var/lib/polyrob`` when its parent is writable (or it already
+    exists), else fall back to ``~/.polyrob`` so a non-root / locked-down service
+    user still gets a writable home OUTSIDE the code tree.
+    """
+    try:
+        if _SERVER_DATA_HOME.exists():
+            return _SERVER_DATA_HOME
+        parent = _SERVER_DATA_HOME.parent
+        if parent.exists() and os.access(str(parent), os.W_OK):
+            return _SERVER_DATA_HOME
+    except Exception:
+        pass
+    return Path.home() / ".polyrob"
+
+
+def resolve_runtime_paths(*, local: bool) -> RuntimePaths:
+    """Resolve (code_root, config_dir, data_home, workspace_root).
+
+    Precedence (LOCKED — doc 01 T1):
+      - code_root     = the install/code root (parent of ``core/``).
+      - data_home     = ``POLYROB_DATA_DIR`` if set; elif local → ``cwd/.polyrob``;
+                        else server → ``/var/lib/polyrob`` (if writable) else
+                        ``~/.polyrob``.
+      - config_dir    = ``code_root/config`` (server) or ``data_home`` (local).
+      - workspace_root= ``cwd`` (local, project-root mode) or ``data_home/task``.
+    """
+    code_root = _CODE_ROOT
+
+    env_data_dir = os.getenv("POLYROB_DATA_DIR")
+    if env_data_dir:
+        data_home = Path(env_data_dir).resolve()
+    elif local:
+        # Local home is the project-scoped ``.polyrob`` dir (doc 02 rename).
+        data_home = (Path.cwd() / ".polyrob").resolve()
+    else:
+        data_home = _server_default_data_home().resolve()
+
+    if local:
+        config_dir = data_home
+        workspace_root = Path.cwd().resolve()
+    else:
+        config_dir = code_root / "config"
+        workspace_root = data_home / "task"
+
+    return RuntimePaths(
+        code_root=code_root,
+        config_dir=config_dir,
+        data_home=data_home,
+        workspace_root=workspace_root,
+    )
+
+
+# The PathManager's own legacy default (agents/task/path.py reads DATA_ROOT,
+# NOT POLYROB_DATA_DIR — the landmine at the heart of RC-1, 2026-07-07).
+_LEGACY_SESSIONS_DEFAULT = "./data/task"
+
+
+def resolve_session_data_root() -> Path:
+    """Resolve the session ARTIFACT tree root (PathManager ``data_root``).
+
+    RC-1 (2026-07-07 webview full-control handoff): the agent process resolves
+    its session tree via ``build_cli_container`` (``POLYROB_DATA_DIR`` →
+    ``{data_home}/sessions``) and installs it as the global ``pm()``; the
+    webview process never ran that bootstrap, so its ``pm()`` fell back to the
+    PathManager default (env ``DATA_ROOT`` → ``./data/task``) — a DIFFERENT
+    tree. Every non-agent process that reads session artifacts must resolve
+    the root through THIS function so the trees cannot diverge again.
+
+    Resolution order:
+      1. Explicit ``DATA_ROOT`` — the PathManager's own env — always wins (an
+         operator who set it meant it; existing DATA_ROOT test rigs unchanged).
+      2. ``POLYROB_DATA_DIR`` set (headless/server data home) →
+         ``{POLYROB_DATA_DIR}/sessions`` — exactly what ``build_cli_container``
+         produces for the agent process (parity pinned by test).
+      3. Neither set → the legacy ``./data/task``, byte-identical to a bare
+         ``PathManager()``.
+
+    The local-dev CLI branches (``POLYROB_DATA_DIR`` unset → ``cwd/.polyrob/
+    sessions``) are deliberately NOT mirrored: this function runs in OTHER
+    processes whose cwd is not the CLI's, so guessing would be wrong more
+    often than the byte-identical legacy default.
+    """
+    explicit = os.getenv("DATA_ROOT")
+    if explicit and explicit.strip():
+        return Path(explicit).resolve()
+    data_home = os.getenv("POLYROB_DATA_DIR")
+    if data_home and data_home.strip():
+        return Path(data_home).resolve() / "sessions"
+    return Path(_LEGACY_SESSIONS_DEFAULT).resolve()

core/seams.py

@@ -0,0 +1,35 @@
+"""Core ⇄ platform seam contracts.
+
+This module is the single home for the dependency-inversion seams between polyrob-core
+(the agent framework) and polyrob-platform (auth/billing/metering). Core declares the
+Protocols + permissive defaults; platform injects real implementations.
+
+This commit seeds ONLY the usage carrier type. The five Protocols (UsageRecorder,
+SessionAdmissionPolicy, PaymentVerifier, plus the auth/admission defaults) land in the
+seam-inversion plan. Keep this module free of any platform import (modules.credits/
+payments/x402, api.* platform modules).
+"""
+
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True)
+class LLMUsage:
+    """One LLM call's billable usage, carried across the UsageRecorder seam.
+
+    Field names mirror the kwargs the agent loop already passes to the platform usage
+    tracker (agents/task/agent/core/next_action_internal.py). The platform recorder maps
+    this onto modules.credits.usage_tracker.UsageRecord; core never imports that type.
+    """
+
+    user_id: str
+    session_id: str
+    agent_id: str
+    model: str
+    provider: str
+    input_tokens: int
+    output_tokens: int
+    cached_tokens: int
+    duration_seconds: float
+    component: str
+    purpose: str

core/secret_scan.py

@@ -0,0 +1,25 @@
+"""SEC-1 backstop: does a directory look like a secrets/code tree?
+
+Used to WARN (or optionally refuse) when the agent's persistent workspace is the
+cwd default AND that cwd contains secrets/VCS — the launch-in-a-repo footgun
+(memory rob-glm-livetest-paramodel-bug-2026-06-20). This is a STEER, not a
+read-denial guard; real per-read denial belongs at the filesystem/coding
+chokepoint in a separate hardening PR (analysis §8.3).
+"""
+import os
+from typing import List
+
+_EXACT = {".env", ".env.production", ".env.development", ".git",
+          "id_rsa", "credentials.json"}
+_SUFFIX = (".pem",)
+
+
+def looks_like_secrets_tree(path: str) -> List[str]:
+    found: List[str] = []
+    try:
+        for name in os.listdir(path):
+            if name in _EXACT or name.endswith(_SUFFIX):
+                found.append(name)
+    except OSError:
+        return []
+    return sorted(found)

core/secret_scrub.py

@@ -0,0 +1,71 @@
+"""core.secret_scrub — conservative secret-shape redaction for PERSISTED content.
+
+POLYROB's message-history sensitive-data filter (``messages/filters.py``) was
+allowlist-only: it redacted just the credentials explicitly registered in
+``sensitive_data``. Any UNregistered secret that lands in a tool result (a
+``cat .env``, an MCP response echoing an auth header, a printed private key) was
+written verbatim into ``message_history.json`` and the compaction checkpoints on
+disk, in the clear.
+
+This module adds a pattern backstop. Unlike the CLI's display-only scrubber
+(``cli/ui/secrets.py``), this one runs over content that is FED BACK TO THE MODEL
+and kept as working state, so it deliberately OMITS the aggressive
+hex/base64 catch-alls: redacting every 32-char hex or 40-char base64 run would
+corrupt legitimate working data (a git SHA the agent is comparing, a base64 blob
+it is processing). Only HIGH-CONFIDENCE credential shapes are redacted here.
+
+Pure (no I/O, no state). Defense-in-depth, NOT a security boundary — the real fix
+for secret EXPOSURE is workspace path-confinement at the tool layer.
+"""
+from __future__ import annotations
+
+import re
+from typing import Optional
+
+#: Replacement marker. Matches the ``<secret>…</secret>`` convention the history
+#: filter already uses for registered sensitive values, so the model sees one shape.
+REDACTED = "<secret>redacted</secret>"
+
+#: PEM private-key blocks (multi-line) — redact the whole block.
+_PEM_RE = re.compile(
+    r"-----BEGIN [A-Z ]*PRIVATE KEY-----.*?-----END [A-Z ]*PRIVATE KEY-----",
+    re.DOTALL,
+)
+
+#: ``Bearer <token>`` — run before the kv rule (kv value would stop at the space
+#: and leave the token). 8+ token chars.
+_BEARER_RE = re.compile(r"(?i)\bBearer\s+[A-Za-z0-9._\-]{8,}")
+
+#: ``key = value`` / ``key: value`` where the key NAME signals a credential.
+#: Key is preserved (line stays readable); only the value (>=6 chars) is redacted.
+_KV_RE = re.compile(
+    r"(?i)\b(api[_-]?key|apikey|secret|client_secret|password|passwd|"
+    r"access[_-]?token|auth[_-]?token|token|authorization|bearer)"
+    r"(\s*[=:]\s*)"
+    r"(['\"]?)([^\s'\"]{6,})\3"
+)
+
+#: Provider-style opaque keys: ``sk-``/``pk-``/``rk-`` (OpenAI/Anthropic/Stripe),
+#: ``rob_`` (POLYROB API keys), and AWS ``AKIA…`` access-key ids.
+_PROVIDER_KEY_RE = re.compile(r"\b(?:sk|pk|rk)-[A-Za-z0-9_-]{16,}")
+_ROB_KEY_RE = re.compile(r"\brob_[A-Za-z0-9]{16,}")
+_AWS_RE = re.compile(r"\bAKIA[0-9A-Z]{16}\b")
+
+
+def scrub_secret_shapes(text: Optional[str]) -> str:
+    """Redact high-confidence credential shapes from *text*.
+
+    Returns "" for None. No-op for content with no secret-shaped substrings, so it
+    is safe to apply to every persisted message's string content and tool args.
+    Conservative by design — see the module docstring on why hex/base64 blobs are
+    intentionally left intact.
+    """
+    if not text:
+        return ""
+    out = _PEM_RE.sub(REDACTED, text)
+    out = _BEARER_RE.sub(REDACTED, out)
+    out = _KV_RE.sub(lambda m: f"{m.group(1)}{m.group(2)}{REDACTED}", out)
+    out = _PROVIDER_KEY_RE.sub(REDACTED, out)
+    out = _ROB_KEY_RE.sub(REDACTED, out)
+    out = _AWS_RE.sub(REDACTED, out)
+    return out

core/secrets.py

@@ -0,0 +1,35 @@
+"""The single ENV-VAR-NAME predicate for DISPLAY REDACTION.
+
+Reused by cli config show, core.config_service, and the webview config router.
+
+NOTE: this is distinct from core/bootstrap._is_secret_key, which is a *backfill
+selector* (a narrow allowlist of names we import from config/.env.production) —
+a different question; do not conflate them.
+
+Value-shape scrubbing of transcript text is yet another concern and lives in
+cli/ui/secrets.py.
+"""
+from __future__ import annotations
+
+_SECRET_HINTS = (
+    "KEY", "TOKEN", "SECRET", "PASSWORD", "PASSPHRASE", "PASS", "JWT",
+    "CREDENTIAL", "PRIVATE", "SIGNATURE", "SEED", "MNEMONIC",
+)
+
+
+def is_secret_key(name: str) -> bool:
+    """Return True if name appears to be a secret (for display redaction).
+
+    Checks if any of the secret substring hints appear case-insensitively in the name.
+    Used to decide whether to redact a config value in display output.
+
+    Args:
+        name: The environment variable name to check.
+
+    Returns:
+        True if the name matches a secret hint, False otherwise.
+    """
+    if not name:
+        return False
+    upper = name.upper()
+    return any(hint in upper for hint in _SECRET_HINTS)

core/security_logging_filter.py

@@ -0,0 +1,148 @@
+"""
+Security logging filter to prevent secrets from being logged.
+"""
+
+import logging
+import re
+from typing import Set, Pattern
+
+class SecretScrubbingFilter(logging.Filter):
+    """Filter that scrubs sensitive information from log records."""
+
+    # Common secret patterns to match
+    SECRET_PATTERNS = [
+        # API keys - various formats
+        re.compile(r'(?i)api[_-]?key["\']?\s*[:=]\s*["\']?([a-zA-Z0-9+/=]{20,})["\']?'),
+        re.compile(r'(?i)key["\']?\s*[:=]\s*["\']?([a-zA-Z0-9+/=]{20,})["\']?'),
+        re.compile(r'(?i)token["\']?\s*[:=]\s*["\']?([a-zA-Z0-9+/=_-]{20,})["\']?'),
+        re.compile(r'(?i)secret["\']?\s*[:=]\s*["\']?([a-zA-Z0-9+/=_-]{20,})["\']?'),
+
+        # Passwords
+        re.compile(r'(?i)password["\']?\s*[:=]\s*["\']?([^\s"\']{6,})["\']?'),
+        re.compile(r'(?i)passwd["\']?\s*[:=]\s*["\']?([^\s"\']{6,})["\']?'),
+
+        # Bearer tokens
+        re.compile(r'(?i)bearer\s+([a-zA-Z0-9+/=_-]{20,})'),
+
+        # Specific service patterns
+        re.compile(r'sk-[a-zA-Z0-9]{48}'),  # OpenAI API keys
+        re.compile(r'claude-[a-zA-Z0-9_-]{20,}'),  # Anthropic keys
+        re.compile(r'pc-[a-zA-Z0-9]{32}'),  # Pinecone keys
+
+        # Generic base64-looking strings that might be keys
+        re.compile(r'([a-zA-Z0-9+/]{32,}={0,2})'),
+    ]
+
+    # Fields that should always be scrubbed if they contain potential secrets
+    SENSITIVE_FIELDS = {
+        'api_key', 'apikey', 'api-key',
+        'secret_key', 'secretkey', 'secret-key', 'secret',
+        'password', 'passwd', 'pass',
+        'token', 'access_token', 'refresh_token',
+        'authorization', 'auth',
+        'key', 'private_key', 'public_key',
+        'client_secret', 'client_id'
+    }
+
+    def __init__(self, mask_length: int = 4, mask_char: str = '*'):
+        """
+        Initialize the filter.
+
+        Args:
+            mask_length: Number of characters to show at start/end
+            mask_char: Character to use for masking
+        """
+        super().__init__()
+        self.mask_length = mask_length
+        self.mask_char = mask_char
+
+    def mask_secret(self, secret: str) -> str:
+        """Mask a secret string, showing only first/last few characters."""
+        if len(secret) <= self.mask_length * 2:
+            return self.mask_char * len(secret)
+
+        start = secret[:self.mask_length]
+        end = secret[-self.mask_length:]
+        middle_length = len(secret) - (self.mask_length * 2)
+        return f"{start}{self.mask_char * min(middle_length, 10)}{end}"
+
+    def scrub_message(self, message: str) -> str:
+        """Scrub secrets from a message string."""
+        scrubbed = message
+
+        # Apply all secret patterns
+        for pattern in self.SECRET_PATTERNS:
+            def replace_secret(match):
+                full_match = match.group(0)
+                if len(match.groups()) > 0:
+                    secret = match.group(1)
+                    masked_secret = self.mask_secret(secret)
+                    return full_match.replace(secret, masked_secret)
+                return self.mask_secret(full_match)
+
+            scrubbed = pattern.sub(replace_secret, scrubbed)
+
+        return scrubbed
+
+    def filter(self, record: logging.LogRecord) -> bool:
+        """
+        Filter method called on each log record.
+
+        Returns:
+            True to allow the record through, False to drop it
+        """
+        # Scrub the main message
+        if hasattr(record, 'msg') and record.msg:
+            if isinstance(record.msg, str):
+                record.msg = self.scrub_message(record.msg)
+
+        # Scrub formatted message
+        if hasattr(record, 'getMessage'):
+            try:
+                original_get_message = record.getMessage
+
+                def scrubbed_get_message():
+                    msg = original_get_message()
+                    return self.scrub_message(msg) if isinstance(msg, str) else msg
+
+                record.getMessage = scrubbed_get_message
+            except Exception:
+                pass
+
+        # Scrub any dictionary-like extra data
+        if hasattr(record, '__dict__'):
+            for key, value in record.__dict__.items():
+                if isinstance(value, str) and (
+                    key.lower() in self.SENSITIVE_FIELDS or
+                    any(field in key.lower() for field in self.SENSITIVE_FIELDS)
+                ):
+                    record.__dict__[key] = self.mask_secret(value)
+
+        return True
+
+
+def install_secret_scrubbing_filter(logger_name: str = None):
+    """
+    Install the secret scrubbing filter on a logger.
+
+    Args:
+        logger_name: Name of logger to install on, None for root logger
+    """
+    logger = logging.getLogger(logger_name)
+
+    # Check if filter is already installed
+    for filter_obj in logger.filters:
+        if isinstance(filter_obj, SecretScrubbingFilter):
+            return
+
+    filter_obj = SecretScrubbingFilter()
+    logger.addFilter(filter_obj)
+
+
+def install_global_secret_scrubbing():
+    """Install secret scrubbing on the root logger to catch all logs."""
+    install_secret_scrubbing_filter()
+
+
+# Auto-install on import
+install_global_secret_scrubbing()