polyrob 0.5.0__py3-none-any.whl

agents/task/agent/core/safety_lifecycle.py

@@ -0,0 +1,228 @@
+"""Safety + lifecycle-control mixin (roadmap P9 decomposition; code-motion from service.py).
+
+The loop-safety (failure/overflow/stall detection, control-flag handling) and
+lifecycle (pause/resume/stop/cancel/reset) concern, moved verbatim off the
+``Agent`` god-file. ``Agent`` composes ``SafetyLifecycleMixin`` so call sites
+(run loop in step.py, and external ``agent.stop()`` / ``agent.reset_for_continuation()``)
+are unchanged.
+"""
+from __future__ import annotations
+
+import asyncio
+import time
+
+
+class SafetyLifecycleMixin:
+    """Failure/stall safety + pause/resume/stop/cancel/reset for Agent."""
+
+    def _too_many_failures(self) -> bool:
+        """Check if we should stop due to too many failures"""
+        if self.state.consecutive_failures >= self.max_failures:
+            self.logger.error(f'❌ Stopping due to {self.max_failures} consecutive failures', exc_info=True)
+            return True
+        return False
+
+    def _check_context_overflow(self) -> bool:
+        """Check if context exceeds threshold and trigger emergency prune.
+
+        SIMPLIFIED (Dec 2025): Uses CONTEXT_OVERFLOW_THRESHOLD from config (default 90%).
+        Let context grow naturally, only prune when necessary.
+
+        Returns:
+            True if pruning was triggered, False otherwise
+        """
+        if not hasattr(self, 'message_manager') or not self.message_manager:
+            return False
+
+        from agents.task.robust_parse_config import RobustParseConfig
+
+        usage_pct = self.message_manager.get_context_usage_percent()
+        threshold = RobustParseConfig.CONTEXT_OVERFLOW_THRESHOLD * 100  # Convert to percentage
+
+        if usage_pct >= threshold:
+            self.logger.info(f"📦 Context at {usage_pct:.1f}% (threshold: {threshold:.0f}%) - emergency prune")
+            self.message_manager.emergency_context_prune()
+            return True
+
+        return False
+
+    async def _check_for_stall(self) -> bool:
+        """Check if the agent is stalled and not making progress.
+
+        Returns:
+            True if agent is stalled and should be stopped
+        """
+        if not self.stall_timeout_seconds:
+            return False
+
+        current_time = time.time()
+
+        # IMPORTANT: Don't report stalls while waiting for LLM response
+        # LLM calls can legitimately take 60-200+ seconds for complex tasks
+        if self._llm_call_in_progress:
+            llm_duration = current_time - (self._llm_call_start_time or current_time)
+            # Only log at longer intervals (every 60s) to reduce noise
+            if llm_duration > 0 and int(llm_duration) % 60 == 0:
+                self.logger.debug(f"⏳ LLM call in progress for {llm_duration:.0f}s - stall check skipped")
+            return False
+
+        # Check if we've been inactive for too long (excluding LLM time)
+        time_since_activity = current_time - self.state.last_activity_time
+        if time_since_activity > self.stall_timeout_seconds:
+            self.logger.error(f"Agent stalled: No activity for {time_since_activity:.1f} seconds (limit: {self.stall_timeout_seconds}s)", exc_info=True)
+            return True
+
+        # Check if we're stuck on the same step for too long
+        if self.state.last_step_start_time:
+            time_in_step = current_time - self.state.last_step_start_time
+            if time_in_step > self.step_timeout_seconds:
+                self.logger.error(f"Agent stalled: Step taking {time_in_step:.1f} seconds (limit: {self.step_timeout_seconds}s)", exc_info=True)
+                return True
+
+        # Check if we're not making action progress
+        if self.state.total_actions_count == self._last_action_count:
+            # Only warn if we're NOT waiting for LLM
+            if not self._llm_call_in_progress:
+                self.logger.warning(f"No new actions in last {self._stall_check_interval} seconds")
+        else:
+            # Update last action count and activity time
+            self._last_action_count = self.state.total_actions_count
+            self.state.last_activity_time = current_time
+
+        return False
+
+    async def _stall_monitor_loop(self) -> None:
+        """Background task to monitor for stalls."""
+        try:
+            while not self.state.stopped:
+                await asyncio.sleep(self._stall_check_interval)
+
+                if self.state.stopped:
+                    # Don't check for stalls when stopped
+                    break
+
+                if await self._check_for_stall():
+                    self.logger.error("Stall detected - stopping agent", exc_info=True)
+                    self.state.consecutive_failures = self.max_failures  # Force stop
+                    self.state.stopped = True
+                    break
+        except asyncio.CancelledError:
+            self.logger.debug("Stall monitor cancelled")
+        except Exception as e:
+            self.logger.error(f"Error in stall monitor: {e}", exc_info=True)
+
+    async def _handle_control_flags(self) -> bool:
+        """Handle stop and done flags. Returns True if execution should stop.
+
+        NOTE: Pause functionality removed (Dec 2025). The blocking wait loop was
+        incompatible with continuous chat design where new messages should be processed.
+
+        For user interruption, use stop which cleanly exits. Users can send a new
+        message to continue with a different task (auto-resume via COMPLETED → RESUMED).
+        """
+        # Check state.done to stop execution when agent signals completion
+        if self.state.done:
+            self.logger.info('✅ Agent execution complete (state.done=True)')
+            return True
+        if self.state.stopped:
+            self.logger.info('⏹️ Agent execution stopped by control flag')
+            raise InterruptedError("Agent stopped")
+
+        # Legacy: treat paused as stopped for backwards compatibility
+        # The paused flag is deprecated - use stopped instead
+        if self.state.paused:
+            self.logger.info('⏹️ Agent paused flag set - treating as stop (pause deprecated)')
+            self.state.stopped = True  # Normalize to stopped
+            raise InterruptedError("Agent stopped (paused flag deprecated)")
+
+        return False
+
+    def pause(self) -> None:
+        """DEPRECATED: Pause functionality removed. Now calls stop() instead.
+
+        The PAUSED state was removed because the blocking wait loop was incompatible
+        with continuous chat design. Use stop() for user interruption, and send a
+        new message to continue with modifications (auto-resume via COMPLETED → RESUMED).
+        """
+        self.logger.warning('⚠️ pause() is DEPRECATED - redirecting to stop()')
+        self.state.stopped = True  # Use stopped instead of paused
+
+    def resume(self) -> None:
+        """DEPRECATED: Resume functionality removed. Sessions auto-resume on new message.
+
+        The explicit resume action is no longer needed. When a new message is sent
+        to a completed/cancelled session, it automatically resumes via the
+        continuous chat flow (COMPLETED → RESUMED → RUNNING).
+        """
+        self.logger.warning('⚠️ resume() is DEPRECATED - no action taken')
+        # No action needed - sessions auto-resume on new message
+
+    async def stop(self) -> None:
+        """Stop the agent execution."""
+        self.logger.info('⏹️ Stopping agent execution')
+        self.state.stopped = True
+
+        # Browser cleanup - release context through orchestrator
+        try:
+            # Release through orchestrator (delegates to BrowserManager)
+            await self.orchestrator.release_browser_context(self.agent_id, close=True)
+        except Exception as e:
+            self.logger.debug(f"Browser cleanup failed: {e}")
+
+        self.logger.info("Agent stopped")
+
+    def cancel(self) -> None:
+        """Cancel the agent execution immediately.
+
+        Sets cancellation flag that will be checked in the main run loop,
+        causing execution to stop at the next step boundary.
+        """
+        self.logger.info('❌ Cancelling agent execution')
+        self._cancelled = True
+
+    def reset_for_continuation(self) -> None:
+        """Reset agent state for continuous chat continuation.
+
+        Called when reusing an existing agent for a new task phase.
+        Resets execution flags while preserving message history and context.
+
+        This is CRITICAL for continuous chat to work properly:
+        - Without this reset, _last_result contains is_done=True from previous run
+        - The run() loop checks _last_result and exits immediately if is_done=True
+        - User's new message would never be processed
+        """
+        self.logger.info('♻️ Resetting agent state for continuation')
+
+        # Cancel any running stall monitor task from previous run
+        # This prevents stale monitors from interfering with new execution
+        if hasattr(self, '_stall_check_task') and self._stall_check_task:
+            if not self._stall_check_task.done():
+                self._stall_check_task.cancel()
+                self.logger.debug('Cancelled stale stall monitor task from previous run')
+            self._stall_check_task = None
+
+        # Reset last result - prevents immediate exit due to previous is_done=True
+        self._last_result = None
+
+        # Reset cancellation flag
+        self._cancelled = False
+
+        # Reset execution control flags in AgentState
+        self.state.stopped = False
+        self.state.done = False
+        self.state.paused = False
+
+        # Reset failure counters for fresh execution
+        self.state.consecutive_failures = 0
+
+        # Reset loop detection state
+        self.state.reset_loop_detection()
+
+        # Update activity time
+        self.state.update_activity_time()
+
+        self.logger.info(
+            f'✅ Agent reset complete. State: steps={self.state.n_steps}, '
+            f'actions={self.state.total_actions_count}, '
+            f'history_messages={len(self.message_manager.history.messages)}'
+        )

agents/task/agent/core/secret_guard.py

@@ -0,0 +1,293 @@
+"""Secret and binary file guard (polyrob context-reference safety).
+
+Pure, dependency-free helpers used by context-reference ingestion and knowledge-base
+loaders to decide whether a file is safe to read or ingest.  Three concerns:
+
+  1. ``is_secret_path`` — does this path look like a credential / secret file?
+  2. ``is_binary_file`` — is this file binary (unreadable as text)?
+  3. ``estimate_tokens_rough`` — cheap token-count estimate for budget checks.
+
+No I/O side-effects on ``is_secret_path``; ``is_binary_file`` reads at most 4 096 bytes.
+"""
+from __future__ import annotations
+
+import fnmatch
+import mimetypes
+from pathlib import Path
+from typing import Iterable
+
+# ---------------------------------------------------------------------------
+# Secret detection
+# ---------------------------------------------------------------------------
+
+# Name globs matched case-insensitively against the file's basename.
+# Entries that contain a path separator are matched against the path's
+# components (see _matches_path_glob below).
+SECRET_NAME_GLOBS: tuple[str, ...] = (
+    ".env*",
+    "*.pem",
+    "*.key",
+    "id_rsa",
+    "id_ed25519",
+    "id_*",
+    "*credential*",
+    "*secret*",
+    "*.p12",
+    "*.pfx",
+    ".netrc",
+    ".npmrc",
+    ".pypirc",
+    ".pgpass",
+    "bot.db",
+    # polyrob-specific relative-path patterns
+    "config/.env.*",
+    ".polyrob/.env",
+    ".rob/.env",  # legacy home (still holds live secrets via transition fallback)
+)
+
+# Tool-facing subset: unambiguous CREDENTIAL filenames only. Used by the
+# file-editing tools (filesystem/coding) to refuse reading/writing secret files
+# that are legitimately IN-ROOT under POLYROB_LOCAL (workspace == project cwd, so
+# confinement can't catch them). Deliberately NARROWER than SECRET_NAME_GLOBS:
+# excludes the broad ``*secret*``/``*credential*`` substrings (would block a
+# Python ``secrets.py``) and the ``data/`` dir rule (a legit project data dir),
+# so ordinary project files stay editable. See is_credential_file().
+CREDENTIAL_NAME_GLOBS: tuple[str, ...] = (
+    ".env*",
+    "*.env",   # WS-7: catch `polyrob.env`, `prod.env` etc — the prod env file's
+               # basename does NOT start with `.env`, so `.env*` alone missed it,
+               # leaving the file that holds AGENT_COMPUTE_POSTURE + approval flags
+               # writable by an agent surface (a self-posture-escalation path).
+    "*.pem",
+    "*.key",
+    "*.p12",
+    "*.pfx",
+    "id_rsa",
+    "id_ed25519",
+    "id_dsa",
+    "id_ecdsa",
+    ".netrc",
+    ".npmrc",
+    ".pypirc",
+    ".pgpass",
+    ".htpasswd",
+    # polyrob-specific relative-path patterns
+    "config/.env.*",
+    ".polyrob/.env",
+    ".rob/.env",
+)
+
+# WS-7: absolute system config directories whose contents are HARD-DENIED for any
+# agent-writable surface (esp. the posture-2 `self_env` patch_source, which reaches
+# the install tree). These hold the frozen security flags / secrets; the agent must
+# never edit them. Source files elsewhere under the install tree stay patchable.
+PROTECTED_CONFIG_DIRS: tuple[str, ...] = (
+    "/etc/polyrob",
+    "/etc/rob",
+)
+
+
+def is_protected_config_path(path: Path) -> bool:
+    """True if *path* is inside a protected system-config dir (WS-7).
+
+    Realpath-free NAME/prefix check on the given path (callers that need traversal
+    safety realpath first). Complements :func:`is_credential_file` (name-shaped
+    secrets anywhere) with a location rule for absolute system config the self_env
+    tool could otherwise reach.
+    """
+    try:
+        s = str(path)
+    except Exception:
+        return False
+    norm = s.replace("\\", "/")
+    for d in PROTECTED_CONFIG_DIRS:
+        if norm == d or norm.startswith(d + "/"):
+            return True
+    return False
+
+
+def is_credential_file(path: Path) -> bool:
+    """Return *True* if *path*'s NAME looks like a credential/secret file.
+
+    Basename + multi-component path-glob checks against ``CREDENTIAL_NAME_GLOBS``
+    only — NO parent-dir (``data/``) rule and NO ``*secret*`` substring, so it is
+    safe to apply to arbitrary project files in local mode. This is the guard the
+    filesystem/coding tools use to refuse a secret file that lives inside the
+    workspace (the gap the confinement floor can't cover when workspace == cwd).
+    """
+    name = path.name
+    for glob in CREDENTIAL_NAME_GLOBS:
+        if "/" not in glob:
+            if _matches_name_glob(name, glob):
+                return True
+        elif _matches_path_glob(path, glob):
+            return True
+    return False
+
+
+# Any *directory component* of the path that matches one of these names makes
+# the whole path a secret path.
+SECRET_DIR_PARTS: frozenset[str] = frozenset({
+    ".ssh",
+    ".aws",
+    ".gnupg",
+    ".kube",
+    ".docker",
+    ".azure",
+    ".config/gh",
+    "data",
+})
+
+
+def _path_parts_lower(path: Path) -> list[str]:
+    """Return the parts of *path* in lower-case (POSIX separators)."""
+    return [p.lower() for p in path.parts]
+
+
+def _matches_name_glob(name: str, glob: str) -> bool:
+    """Case-insensitive fnmatch of *name* against *glob*."""
+    return fnmatch.fnmatch(name.lower(), glob.lower())
+
+
+def _matches_path_glob(path: Path, glob: str) -> bool:
+    """Match a multi-component glob like ``config/.env.*`` or ``.rob/.env``.
+
+    Strategy: slide a window of ``len(glob_parts)`` consecutive path parts and
+    check if they join (with ``/``) case-insensitively to the glob.
+    """
+    glob_parts = glob.lower().replace("\\", "/").split("/")
+    n = len(glob_parts)
+    parts = [p.lower() for p in path.parts]
+    for i in range(len(parts) - n + 1):
+        window = "/".join(parts[i : i + n])
+        # Rebuild glob as a single fnmatch pattern with / separators.
+        if fnmatch.fnmatch(window, "/".join(glob_parts)):
+            return True
+    return False
+
+
+def _is_data_db(path: Path) -> bool:
+    """``*.db`` rule: applies only when a parent directory is named ``data``."""
+    if not path.name.lower().endswith(".db"):
+        return False
+    # Check parent directories (not the file itself).
+    return any(p.lower() == "data" for p in path.parts[:-1])
+
+
+def _dir_part_match(path: Path, dir_parts: Iterable[str]) -> bool:
+    """True if any directory *component* of *path* matches a ``dir_parts`` entry.
+
+    Multi-segment entries (e.g. ``.config/gh``) are matched as a consecutive
+    window of path parts joined with ``/``.
+    """
+    parts_lower = [p.lower() for p in path.parts[:-1]]  # skip the filename
+    for dp in dir_parts:
+        dp_lower = dp.lower()
+        dp_segs = dp_lower.split("/")
+        n = len(dp_segs)
+        window_pat = "/".join(dp_segs)
+        for i in range(len(parts_lower) - n + 1):
+            window = "/".join(parts_lower[i : i + n])
+            if fnmatch.fnmatch(window, window_pat):
+                return True
+    return False
+
+
+def is_secret_path(path: Path, *, root: Path) -> bool:  # noqa: ARG001
+    """Return *True* if *path* looks like a credential / secret file.
+
+    Checks (in order):
+    1. Any parent directory component matches ``SECRET_DIR_PARTS``.
+    2. The basename matches a simple (no ``/``) ``SECRET_NAME_GLOBS`` entry.
+    3. The path contains a multi-component pattern from ``SECRET_NAME_GLOBS``
+       (e.g. ``config/.env.production``, ``.rob/.env``).
+    4. The ``*.db`` rule: applies only when a parent dir is named ``data``.
+
+    ``root`` is accepted for callers that want to pass it (future: relative-path
+    normalisation), but is not required for the current checks.
+    """
+    # 1. Parent-directory check
+    if _dir_part_match(path, SECRET_DIR_PARTS):
+        return True
+
+    name = path.name
+
+    # 2. Simple (no-slash) glob matches on the basename
+    simple_globs = [g for g in SECRET_NAME_GLOBS if "/" not in g]
+    for glob in simple_globs:
+        if _matches_name_glob(name, glob):
+            return True
+
+    # 3. Multi-component path patterns
+    path_globs = [g for g in SECRET_NAME_GLOBS if "/" in g]
+    for glob in path_globs:
+        if _matches_path_glob(path, glob):
+            return True
+
+    # 4. *.db inside a `data/` directory
+    if _is_data_db(path):
+        return True
+
+    return False
+
+
+# ---------------------------------------------------------------------------
+# Binary detection
+# ---------------------------------------------------------------------------
+
+# Extensions we always treat as plain text regardless of mime type.
+_TEXT_EXTENSIONS: frozenset[str] = frozenset({
+    ".txt", ".json", ".yaml", ".yml", ".toml",
+    ".js", ".ts", ".tsx", ".sh",
+    ".csv", ".html", ".xml", ".rst",
+    ".ini", ".cfg", ".sql", ".md", ".py",
+})
+
+# Extensions for extractable document formats — callers decide how to read
+# them; we report them as NOT binary so they are not silently skipped.
+_EXTRACTABLE_EXTENSIONS: frozenset[str] = frozenset({
+    ".pdf", ".docx", ".doc", ".odt",
+    ".xlsx", ".xls", ".ods",
+    ".pptx", ".ppt",
+    ".epub", ".rtf",
+})
+
+
+def is_binary_file(path: Path) -> bool:
+    """Return *True* if *path* is a binary file that cannot be decoded as text.
+
+    Detection order:
+    1. Text-extension allowlist → always False (text).
+    2. Extractable-document list → False (callers handle extraction).
+    3. mimetypes guess: ``text/*`` → False.
+    4. Null-byte sniff of the first 4 096 bytes → True if a null byte is found.
+    5. Default → False (assume text when uncertain).
+    """
+    suffix = path.suffix.lower()
+
+    if suffix in _TEXT_EXTENSIONS:
+        return False
+    if suffix in _EXTRACTABLE_EXTENSIONS:
+        return False
+
+    mime, _ = mimetypes.guess_type(str(path))
+    if mime and mime.startswith("text/"):
+        return False
+
+    # Null-byte sniff
+    try:
+        data = path.read_bytes()[:4096]
+    except OSError:
+        return False  # can't read → let the caller handle it
+
+    return b"\x00" in data
+
+
+# ---------------------------------------------------------------------------
+# Token estimation
+# ---------------------------------------------------------------------------
+
+
+def estimate_tokens_rough(text: str) -> int:
+    """Rough token count: ``max(1, len(text) // 4)`` (chars-per-token ≈ 4)."""
+    return max(1, len(text) // 4)