polyrob 0.5.0__py3-none-any.whl

core/wallet/signer.py

@@ -0,0 +1,51 @@
+"""Signer seam: produces ECDSA / EIP-712 signatures for ONE agent address.
+
+The raw private key NEVER crosses this boundary outward. LocalEoaSigner is the
+self-custody backend; CdpSigner/TurnkeySigner (deferred) implement the same
+Protocol so the custody backend is swappable without touching venue tools.
+"""
+from __future__ import annotations
+
+from typing import Protocol, runtime_checkable
+
+from eth_account import Account
+from eth_account.messages import encode_defunct, encode_typed_data
+
+
+@runtime_checkable
+class Signer(Protocol):
+    @property
+    def address(self) -> str: ...
+    def sign_message(self, data: bytes) -> str: ...
+    def sign_typed_data(self, domain: dict, types: dict, message: dict) -> str: ...
+
+
+class LocalEoaSigner:
+    """Self-custody EOA signer wrapping an eth_account LocalAccount."""
+
+    def __init__(self, private_key: bytes):
+        self._account = Account.from_key(private_key)
+
+    @property
+    def address(self) -> str:
+        return self._account.address
+
+    @property
+    def account(self):
+        """The native LocalAccount, for SDKs that require it (e.g. Hyperliquid).
+
+        In-process use only — never returned from a tool action / logged."""
+        return self._account
+
+    def sign_message(self, data: bytes) -> str:
+        signed = self._account.sign_message(encode_defunct(data))
+        return signed.signature.hex() if signed.signature.hex().startswith("0x") else "0x" + signed.signature.hex()
+
+    def sign_typed_data(self, domain: dict, types: dict, message: dict) -> str:
+        signable = encode_typed_data(domain_data=domain, message_types=types, message_data=message)
+        signed = self._account.sign_message(signable)
+        sig = signed.signature.hex()
+        return sig if sig.startswith("0x") else "0x" + sig
+
+    def __repr__(self) -> str:  # never leak the key
+        return f"<LocalEoaSigner address={self._account.address}>"

cron/README.md

@@ -0,0 +1,65 @@
+# Cron Package — durable scheduled runs
+
+_Last reviewed: 2026-06-30. For env flags see ../docs/CONFIGURATION.md; for the autonomy loops see ../docs/guide/architecture.md and ../AGENTS.md._
+
+## Overview
+
+The `cron` package provides **durable, scheduled agent runs** — the home for work
+that must survive a process restart, which in-memory `delegate_task` cannot. Jobs
+are persisted in SQLite (`data/cron.db`, WAL + jittered retry) and executed by a
+ticker that is safe under multiple workers via a file-based tick lock.
+
+Off by default: nothing ticks unless `CRON_ENABLED=true`. It is wired into both the
+API lifespan and the local CLI through the shared autonomy runtime
+(`core/autonomy_runtime.py::start_autonomy`), alongside the goal board and curator.
+
+## Package structure
+
+```
+cron/
+├── schedule.py   # PURE schedule parser + next-run computation (tz-naive, local
+│                 #   wall-clock, reference time passed in → deterministic):
+│                 #   durations ("30m"), `every monday 09:00`, 5-field cron,
+│                 #   ISO one-shot
+├── jobs.py       # SQLite cron_jobs store — durable schedule state; WAL mode with
+│                 #   jittered retry on write contention
+├── service.py    # CronService — schedule / list / cancel API over schedule+jobs
+│                 #   (thin, fully testable; shared by the tool and the ticker)
+├── scheduler.py  # tick(): find due jobs → run each through an injected async
+│                 #   runner under a hard per-run duration cap → reschedule
+│                 #   (recurring) or complete (one-shot); file-based TickLock
+├── runner.py     # CronTicker (drives tick() on an interval) + make_agent_runner
+│                 #   (W3 fix: actually runs run_session, not just create_session)
+└── delivery.py   # out-of-band result delivery after a run: allowlist
+                  #   {telegram, email, twitter}; [SILENT] suppresses; tenant-scoped
+                  #   recipient; fail-open; inside the scheduler wait_for budget
+```
+
+## Execution model
+
+1. `CronTicker` calls `scheduler.tick()` on an interval.
+2. `tick()` acquires the file `TickLock` (safe under `workers>1`), finds due jobs,
+   and runs each through the injected runner with a hard duration cap.
+3. `make_agent_runner` runs the real agent loop (`create_session` + `run_session`,
+   `skip_memory=True`); a one-shot job is marked done, a recurring job is
+   rescheduled to its next run.
+4. If the job requested delivery, `delivery.py` sends the final result to the
+   chosen sink (within the tick's `wait_for` budget).
+
+## Key invariants
+
+- **W3 run-loop fix (default on, `CRON_RUN_LOOP`):** cron historically called only
+  `create_session` and never ran the loop, so jobs created an idle session and did
+  nothing. It now runs `run_session`.
+- **Idle-gate:** `scheduler.tick()` skips while the interactive REPL is busy
+  (shared CWD safety — see `core/interactive_gate.py`); inert on the server.
+- **Delivery is gated** separately (`CRON_DELIVERY_ENABLED`, default off) and
+  fail-open.
+
+## Related
+
+- Agent-facing tool surface: `tools/cronjob_tools.py`
+  (`cronjob_schedule` / `list` / `cancel`), registered only when `CRON_ENABLED=true`.
+- Durable cross-session **goal board** (reuses this package's `TickLock` pattern):
+  `agents/task/goals/` + `agents/task/goals/dispatcher.py`.
+- Shared lifecycle: `core/autonomy_runtime.py`.

cron/delivery.py

@@ -0,0 +1,277 @@
+"""Cron result delivery (W3, Reference-parity §_deliver_result).
+
+After a cron job runs the agent loop (W3 run-loop fix), its final result can be
+delivered out-of-band to an external sink — email, twitter, or telegram — so a
+scheduled task can actually *report back* instead of dying silently in a session.
+
+Design constraints (Fusion-validated):
+
+- **Allowlisted targets** ``{telegram, email, twitter}`` — never an arbitrary sink.
+- **`[SILENT]`** anywhere in the result (case-insensitive) suppresses delivery,
+  matching the Reference convention (the agent opts a run out of notifying).
+- **Tenant-scoped** — the recipient is resolved from the *job's owner*, not from a
+  free-form payload address, except where the agent is delivering to its own
+  configured channel. A cron job must not be able to exfiltrate to a stranger.
+- **Fail-open** — a sink that errors (or is unconfigured) logs and returns False;
+  it NEVER fails the cron job. Delivery is best-effort reporting, not core work.
+- **Inside the budget** — callers invoke this from within the scheduler's
+  ``asyncio.wait_for(runner(job), timeout=max_duration_seconds)``, so delivery I/O
+  shares the per-run hard cap rather than running unbounded after a hard-cancel.
+
+Gated by ``CRON_DELIVERY_ENABLED`` (default OFF) at the call site (``cron/runner.py``).
+"""
+from __future__ import annotations
+
+import logging
+from typing import Any, Optional
+
+logger = logging.getLogger(__name__)
+
+ALLOWED_TARGETS = ("telegram", "email", "twitter")
+SILENT_MARKER = "[SILENT]"
+
+
+def _allow_explicit_target() -> bool:
+    """Whether an agent-supplied ``deliver_target`` (arbitrary address/chat) is honored.
+
+    Default FALSE → delivery always goes to the JOB OWNER's own channel, closing the
+    exfiltration vector where a (possibly prompt-injected) cron job sets
+    ``deliver_target="attacker@evil.com"``. Operators of trusted single-user installs
+    can opt in with ``CRON_DELIVERY_ALLOW_EXPLICIT_TARGET=true``.
+    """
+    import os
+    return os.getenv("CRON_DELIVERY_ALLOW_EXPLICIT_TARGET", "").strip().lower() in (
+        "1", "true", "yes", "on")
+
+
+def is_silent(final: Optional[str]) -> bool:
+    """True when the agent opted this run out of delivery via ``[SILENT]``."""
+    return bool(final) and SILENT_MARKER in final.upper()
+
+
+def delivery_outcome(final: Optional[str], ok: bool) -> str:
+    """Classify a cron delivery for the observability log: ``suppressed`` (agent chose
+    ``[SILENT]``), ``sent`` (delivered), or ``failed`` (real send failure).
+
+    The runner previously logged both a ``[SILENT]`` opt-out and a genuine send error
+    as ``ok=False``, so harmless status-digest opt-outs were indistinguishable from
+    broken deliveries in the journal. ``is_silent`` takes precedence because a silent
+    run never attempts a send (``deliver_result`` returns False for it).
+    """
+    if is_silent(final):
+        return "suppressed"
+    return "sent" if ok else "failed"
+
+
+async def deliver_result(
+    task_agent: Any,
+    job: Any,
+    final: Optional[str],
+    *,
+    target: Optional[str],
+    deliver_target: Optional[str] = None,
+    session_id: Optional[str] = None,
+) -> bool:
+    """Deliver a cron job's final result to an allowlisted external sink.
+
+    Returns True on a successful send, False otherwise (unknown/blank target,
+    empty/`[SILENT]` result, sink unconfigured, or any sink exception). Never
+    raises — delivery must not fail the job.
+
+    ``session_id`` (Task 7, optional): when provided, a SUCCESSFUL send marks the
+    episodic row for this session as ``surfaced`` (the digest builder then omits
+    it via ``exclude_surfaced=True``, avoiding double-reporting what was already
+    delivered out-of-band). Callers must pass ``session_id`` AFTER the episode
+    row has been written (``finalize_episode``) — the mark is a plain ``UPDATE``
+    that no-ops if the row doesn't exist yet (see ``cron/runner.py`` ordering).
+    """
+    if not target:
+        return False
+    target = target.strip().lower()
+    if target not in ALLOWED_TARGETS:
+        logger.warning("cron delivery: target %r not in allowlist %s", target, ALLOWED_TARGETS)
+        return False
+    if not final or not final.strip():
+        return False
+    if is_silent(final):
+        logger.info("cron delivery: job %s opted out via [SILENT]", getattr(job, "id", "?"))
+        return False
+
+    # Security: ignore an agent-supplied explicit recipient unless an operator opted in.
+    # By default, deliver only to the job owner's own channel (no exfiltration).
+    if deliver_target and not _allow_explicit_target():
+        logger.info("cron delivery: ignoring explicit deliver_target (owner-only by default)")
+        deliver_target = None
+
+    ok = False
+    try:
+        if target == "email":
+            ok = await _deliver_email(task_agent, job, final, deliver_target)
+        elif target == "twitter":
+            ok = await _deliver_twitter(task_agent, job, final)
+        elif target == "telegram":
+            ok = await _deliver_telegram(task_agent, job, final, deliver_target)
+    except Exception as e:  # fail-open: a delivery error never fails the job
+        logger.error("cron delivery to %s failed for job %s: %s",
+                     target, getattr(job, "id", "?"), e, exc_info=True)
+        return False
+    if ok and session_id:
+        _mark_surfaced(session_id, getattr(job, "user_id", None))
+    return ok
+
+
+def _mark_surfaced(session_id: str, user_id: Optional[str] = None) -> None:
+    """Fail-open: mark the delivered session's episode as surfaced (Task 7).
+
+    Scoped to the job's own ``user_id`` (episodes are keyed on the composite
+    ``(user_id, session_id)``) so a session_id collision across tenants can't
+    flip another tenant's row.
+    """
+    try:
+        from modules.memory.registry import get_memory_registry
+        prov = get_memory_registry().active()
+        if prov is not None and hasattr(prov, "mark_episode_surfaced"):
+            prov.mark_episode_surfaced(session_id=session_id, user_id=user_id)
+    except Exception:
+        logger.debug("cron delivery: mark_episode_surfaced skipped", exc_info=True)
+
+
+# --- sinks -------------------------------------------------------------------
+# Each sink resolves its tool lazily from the task_agent's container/config and is
+# wrapped by deliver_result's try/except. Kept as module functions so tests can
+# monkeypatch them without standing up SMTP/Twitter/Telegram.
+
+def _config_and_container(task_agent: Any):
+    config = getattr(task_agent, "config", None)
+    container = getattr(task_agent, "container", None)
+    return config, container
+
+
+async def _deliver_email(task_agent: Any, job: Any, final: str, deliver_target: Optional[str]) -> bool:
+    # Tenant scope: only the job owner's own address. ``deliver_target`` is honored
+    # only as an explicit user-supplied override (the agent scheduling for itself);
+    # callers that don't trust it should leave it None and rely on owner lookup.
+    to_email = deliver_target or _owner_email(task_agent, job)
+    if not to_email:
+        logger.info("cron delivery: no email recipient for job %s", getattr(job, "id", "?"))
+        return False
+    config, container = _config_and_container(task_agent)
+    from tools.email_tool import EmailTool
+    tool = EmailTool("email", config, container)
+    await tool.ensure_initialized()
+    subject = f"[POLYROB cron] {getattr(job, 'task', 'scheduled task')[:60]}"
+    return bool(await tool.send_email(to_email=to_email, subject=subject, body=final))
+
+
+async def _deliver_twitter(task_agent: Any, job: Any, final: str) -> bool:
+    config, container = _config_and_container(task_agent)
+    from tools.twitter_tool import TwitterTool
+    tool = TwitterTool("twitter", config, container)
+    text = final.strip()
+    if len(text) > 280:
+        text = text[:277] + "..."
+    return bool(await tool.post(text=text))
+
+
+async def _deliver_telegram(task_agent: Any, job: Any, final: str, deliver_target: Optional[str]) -> bool:
+    # Telegram routing goes through the bot's message sink if one is registered on
+    # the container. Best-effort: absent a router, log and skip (fail-open).
+    _, container = _config_and_container(task_agent)
+    sink = None
+    if container is not None and hasattr(container, "get_service"):
+        sink = container.get_service("telegram_sink") or container.get_service("message_router")
+    chat_id = deliver_target or _owner_telegram(task_agent, job)
+    if sink is None or not chat_id:
+        logger.info("cron delivery: telegram sink/chat unavailable for job %s", getattr(job, "id", "?"))
+        return False
+
+    # Gate proactive send by surface send-policy (WhatsApp 24h window etc.).
+    # For Telegram (no window), resolve_proactive_send returns ("send", None) — no-op.
+    from core.surfaces.proactive import resolve_proactive_send
+    _action, _extra = await resolve_proactive_send(container, "telegram", chat_id, final)
+    if _action == "suppress":
+        logger.info("cron delivery: suppressed (send policy) for job %s", getattr(job, "id", "?"))
+        return False
+    if _action == "template":
+        # TODO(4.x): send approved template instead of suppress
+        logger.info(
+            "cron delivery: send window closed; template required (job %s) — suppressing free-text",
+            getattr(job, "id", "?"),
+        )
+        return False
+
+    send = getattr(sink, "send_message", None)
+    if send is None:
+        return False
+    res = send(chat_id, final)
+    if hasattr(res, "__await__"):
+        res = await res
+    return bool(res)
+
+
+def _owner_email(task_agent: Any, job: Any) -> Optional[str]:
+    """Resolve the job owner's email (tenant scope).
+
+    1. A registered ``user_directory`` service (real multi-user store) — the hook
+       point for a proper user store.
+    2. E3 fallback: the single configured ``POLYROB_OWNER_EMAIL`` for single-owner
+       headless deploys where nothing registers ``user_directory`` (mirrors the
+       telegram ``_configured_owner_telegram_id`` fallback). Without this, the
+       user_directory service is never registered, so ``deliver="email"`` was
+       always unreachable.
+    """
+    container = getattr(task_agent, "container", None)
+    if container is not None and hasattr(container, "get_service"):
+        users = container.get_service("user_directory")
+        if users is not None and hasattr(users, "get_email"):
+            try:
+                addr = users.get_email(getattr(job, "user_id", None))
+                if addr:
+                    return addr
+            except Exception:
+                pass
+    # 2. single-owner env fallback (SSOT in core.instance)
+    try:
+        from core.instance import resolve_owner_email
+        return resolve_owner_email()
+    except Exception:
+        return None
+
+
+def _configured_owner_telegram_id() -> Optional[str]:
+    """The single configured owner telegram id, for headless single-owner deploys.
+
+    A goal/cron run started by the autonomy loops carries a non-numeric tenant id
+    (e.g. ``"rob"`` — now also the aliased tenant of the owner's OWN chat), so it
+    cannot self-resolve a telegram chat. When the deploy is owner-locked to exactly
+    ONE telegram id via ``ALLOWED_TELEGRAM_USER_IDS`` (or an explicit
+    ``POLYROB_OWNER_TELEGRAM_ID``), that id IS the owner's chat.
+
+    SSOT: delegates to ``core.instance.resolve_owner_telegram_id`` — the SAME resolver
+    the inbound owner alias uses, so the id an owner-tg sender is aliased FROM and the
+    chat an out-of-band delivery is routed TO stay in lockstep.
+    """
+    from core.instance import resolve_owner_telegram_id
+    return resolve_owner_telegram_id()
+
+
+def _owner_telegram(task_agent: Any, job: Any) -> Optional[str]:
+    """Resolve the job owner's telegram chat id (tenant scope)."""
+    uid = getattr(job, "user_id", None)
+    # 1. explicit user-directory mapping (real multi-user store)
+    container = getattr(task_agent, "container", None)
+    if container is not None and hasattr(container, "get_service"):
+        users = container.get_service("user_directory")
+        if users is not None and hasattr(users, "get_telegram_chat_id"):
+            try:
+                cid = users.get_telegram_chat_id(uid)
+                if cid:
+                    return str(cid)
+            except Exception:
+                pass
+    # 2. the user_id IS the telegram chat id (telegram-origin sessions).
+    if uid and str(uid).isdigit():
+        return str(uid)
+    # 3. headless autonomy run (non-numeric tenant): fall back to the single
+    #    configured owner id so proactive outreach actually reaches the owner.
+    return _configured_owner_telegram_id()

cron/digest.py

@@ -0,0 +1,124 @@
+"""Owner daily digest — one pushed message written from evidence, not self-report.
+
+A deterministic ($0, no-LLM) composer over the same sources the owner can already
+audit — the unified ledger (money in/out), the durable event log (goals moved,
+skills changed, sessions run), the goal board's open asks (pending approvals), and
+episodes (what ran). Composed in code and pushed via the existing cron delivery
+rail (``cron/delivery.deliver_result``), so it costs nothing and cannot
+hallucinate. Runs as a cron job carrying ``payload.digest=true`` — the runner
+routes such a job here instead of paying for a model turn.
+
+Every read is a module-level seam so tests can monkeypatch it; every read fails
+open (a missing source contributes nothing, never an exception).
+"""
+import time
+from typing import Any, Dict, List, Optional
+
+
+def _ledger(user_id: str, days: int) -> Dict[str, Any]:
+    try:
+        from core.async_bridge import run_coroutine_sync
+        from modules.credits.unified_ledger import build_ledger
+        # Loop-safe: compose_digest is awaited inside the cron runner's running
+        # loop, where a bare asyncio.run would raise and empty the money section.
+        return run_coroutine_sync(build_ledger(user_id, days=max(1, int(days)))) or {}
+    except Exception:
+        return {}
+
+
+def _event_aggregate(user_id: str, since_ts: Optional[float]) -> Dict[str, Any]:
+    try:
+        from agents.task.telemetry.event_log import get_event_log, event_log_enabled
+        if not event_log_enabled():
+            return {}
+        return get_event_log().aggregate(since_ts=since_ts, user_id=user_id) or {}
+    except Exception:
+        return {}
+
+
+def _open_asks(user_id: str, data_dir: Optional[str]) -> List[Dict[str, Any]]:
+    try:
+        import os
+
+        from agents.task.goals.board import GoalBoard
+        board = GoalBoard(os.path.join(data_dir or "data", "goals.db"))
+        rows = board.asks(user_id=user_id, status="open") or []
+        out = []
+        for a in rows:
+            get = (a.get if isinstance(a, dict) else lambda k, d=None: getattr(a, k, d))
+            out.append({"title": get("title") or get("what") or ""})
+        return out
+    except Exception:
+        return []
+
+
+def _episodes(user_id: str, since_ts: Optional[float]) -> List[Dict[str, Any]]:
+    try:
+        from core.async_bridge import run_coroutine_sync
+        from modules.memory.registry import memory_recall_episodes
+        rows = run_coroutine_sync(memory_recall_episodes(
+            user_id=user_id, since_ts=int(since_ts) if since_ts else None,
+            limit=20, order="newest"))
+        out = []
+        for r in rows or []:
+            get = (r.get if isinstance(r, dict) else lambda k, d=None: getattr(r, k, d))
+            out.append({"kind": get("kind"), "outcome": get("outcome")})
+        return out
+    except Exception:
+        return []
+
+
+async def compose_digest(user_id: str, *, days: int = 1,
+                         data_dir: Optional[str] = None, db=None) -> str:
+    """Build the digest text from evidence. Pure-ish (all reads fail-open)."""
+    since_ts = time.time() - max(1, int(days)) * 86400
+    ledger = _ledger(user_id, days)
+    agg = _event_aggregate(user_id, since_ts)
+    asks = _open_asks(user_id, data_dir)
+    episodes = _episodes(user_id, since_ts)
+
+    counts = agg.get("counts_by_kind", {}) or {}
+    n_sessions = len(episodes)
+    n_goals = int(counts.get("goal_run", 0)) + int(counts.get("goal_completion", 0))
+    n_self_mods = int(counts.get("self_modification", 0))
+    earned = float(ledger.get("earned_usd") or 0.0)
+    spent = float(ledger.get("total_spend_usd") or 0.0)
+    net = float(ledger.get("net_usd") or (earned - spent))
+    pending_n = int(ledger.get("pending_invoices") or 0)
+    pending_usd = float(ledger.get("pending_invoices_usd") or 0.0)
+
+    period = "today" if days == 1 else f"last {days}d"
+    lines = [f"Daily digest — {period}:"]
+    lines.append(f"• Activity: {n_sessions} session(s), {n_goals} goal event(s), "
+                 f"{n_self_mods} self-change(s)")
+    lines.append(f"• Money: earned ${earned:.2f}, spent ${spent:.2f}, net ${net:.2f}"
+                 + (f"; {pending_n} pending invoice(s) ${pending_usd:.2f}" if pending_n else ""))
+    if asks:
+        lines.append(f"• Pending approvals ({len(asks)}):")
+        for a in asks[:5]:
+            title = (a.get("title") or "").strip().replace("\n", " ")[:80]
+            lines.append(f"   - {title}")
+    else:
+        lines.append("• Pending approvals: none")
+    return "\n".join(lines)
+
+
+async def run_digest(task_agent: Any, job: Any) -> bool:
+    """Compose the digest for the job's tenant and deliver it out-of-band.
+
+    A $0 tick: no model call. Returns True when a send is attempted-and-succeeds
+    (or is intentionally suppressed); False on delivery failure. Never raises."""
+    try:
+        payload = dict(getattr(job, "payload", {}) or {})
+        days = int(payload.get("days", 1) or 1)
+        data_dir = payload.get("data_dir")
+        text = await compose_digest(getattr(job, "user_id", ""), days=days, data_dir=data_dir)
+    except Exception:
+        return False
+    target = payload.get("deliver") or "telegram"
+    try:
+        from cron.delivery import deliver_result
+        return await deliver_result(task_agent, job, text, target=target,
+                                    deliver_target=payload.get("deliver_target"))
+    except Exception:
+        return False