power-loop 5.2.2__tar.gz → 5.3.0__tar.gz

{power_loop-5.2.2 → power_loop-5.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: power-loop
-Version: 5.2.2
+Version: 5.3.0
 Summary: Embeddable agent execution kernel — LLM loop, hooks, events, tools, dynamic sub-agents.
 Author-email: zhangran <zhangran24@126.com>
 License: MIT

{power_loop-5.2.2 → power_loop-5.3.0}/power_loop/__init__.py

@@ -15,7 +15,7 @@ Stability tiers
 无版本承诺，可随时变更或删除。
 """
 
-__version__ = "5.2.2"
+__version__ = "5.3.0"
 
 # Public LLM contract (SDK-free) re-exported so callers (e.g. writing llm.* hooks or
 # a custom LLMService) don't reach into the internal vendored transport package (H3.4).

{power_loop-5.2.2 → power_loop-5.3.0}/power_loop/_vendor/llm_client/interface.py

@@ -467,6 +467,11 @@ class OpenAICompatibleChatConfig:
     stream_max_restarts: int = 0
     stream_resume_instruction: str = "继续，从你上次中断的位置继续输出。不要重复已经输出的内容。"
     capability_overrides: dict[str, Any] = field(default_factory=dict)
+    # Config-level request kwargs merged under every request's ``extra`` (request wins; nested
+    # ``extra_body`` dicts are merged key-by-key). This is how a host turns a per-model switch
+    # (e.g. DashScope ``extra_body.enable_thinking``) on for a whole loop without touching the
+    # pipeline's per-call LLMRequest.
+    request_extra: dict[str, Any] = field(default_factory=dict)
 
     @property
     def is_ready(self) -> bool:

{power_loop-5.2.2 → power_loop-5.3.0}/power_loop/_vendor/llm_client/llm_factory.py

@@ -82,6 +82,19 @@ def _format_messages_for_debug(messages: Sequence[dict[str, Any]]) -> str:
 
 
 
+def merge_request_extra(base: dict[str, Any] | None, override: dict[str, Any] | None) -> dict[str, Any]:
+    """Config-level ``request_extra`` under a request's ``extra`` (request wins; ``extra_body`` merged)."""
+    out: dict[str, Any] = dict(base or {})
+    for k, v in dict(override or {}).items():
+        if k == "extra_body" and isinstance(v, dict) and isinstance(out.get("extra_body"), dict):
+            out["extra_body"] = {**out["extra_body"], **v}
+        else:
+            out[k] = v
+    if isinstance(out.get("extra_body"), dict):
+        out["extra_body"] = dict(out["extra_body"])
+    return out
+
+
 class OpenAICompatibleChatLLMService(LLMService):
     """
     Minimal OpenAI-compatible chat completion client.
@@ -445,12 +458,12 @@ class OpenAICompatibleChatLLMService(LLMService):
                 await asyncio.sleep(delay)
         raise cast(Exception, last_err)
 
-    def _request_kwargs(self, request: LLMRequest) -> dict[str, Any]:
+    def _request_kwargs(self, request: LLMRequest) -> dict[str, Any]:  # noqa: C901
         """
         Map `LLMRequest` into kwargs for OpenAI-compatible chat.completions.create.
         Falls back to self._cfg for default settings.
         """
-        out: dict[str, Any] = dict(request.extra or {})
+        out: dict[str, Any] = merge_request_extra(getattr(self._cfg, "request_extra", None), request.extra)
         out["model"] = request.model if request.model else self._cfg.model
         
         req_temp = request.temperature if request.temperature is not None else self._cfg.temperature

{power_loop-5.2.2 → power_loop-5.3.0}/power_loop/runtime/env.py

@@ -35,6 +35,10 @@ class RuntimeEnv:
     # conversation-scoped / cross-process board. See runtime.blackboard.
     blackboard: Blackboard | None = None
     blackboard_id: str | None = None
+    # Command categories the host forbids for `bash` / `background_run` (see
+    # tools.command_policy): "package_install" | "download" | "daemon". "pipe_to_shell"
+    # is always blocked. Empty (default) = only the always-blocked set applies.
+    blocked_command_categories: frozenset[str] = frozenset()
 
     @classmethod
     def from_env(

{power_loop-5.2.2 → power_loop-5.3.0}/power_loop/runtime/provider.py

@@ -167,6 +167,7 @@ class LLMProviderConfig:
             temperature=self.temperature,
             max_retries=self.max_retries,
             capability_overrides=dict(self.capability_overrides),
+            request_extra=dict(self.extra.get("request_extra") or {}),
         )
 
     def to_anthropic(self) -> AnthropicChatConfig:

power_loop-5.3.0/power_loop/tools/command_policy.py

@@ -0,0 +1,201 @@
+"""Category-level command policy for ``bash`` / ``background_run`` (rule layer).
+
+`_dangerous_command_reason` in default_tools is the *absolute* deny-list (sudo, mkfs, rm -rf /…).
+This module is the layer above it: it classifies a shell command into coarse **categories** —
+installing packages, downloading files, piping a download into an interpreter, starting daemons —
+and the host decides per agent which categories are blocked (``RuntimeEnv.blocked_command_categories``).
+
+Why a category layer and not one big regex: a sandbox that can reach npm/pypi through the egress
+proxy *will* have a model install playwright + chromium the first time a skill points it at a
+tool it doesn't have (that is exactly what happened, and it cost 20 minutes and a few hundred MB).
+The fix is not to blacklist "playwright" — it is to make "install software" a capability the
+operator grants, with a refusal message that tells the model what to do instead.
+
+Lexical only, no semantics: we split on shell operators (shlex with punctuation_chars) and look at
+each simple command's program name + subcommand. False negatives are possible (``python -c
+"import subprocess; …"``); that is what the host's optional LLM review layer is for. False
+positives are cheap: the model gets a tool result telling it the category and the exit.
+
+Library default: nothing blocked except ``pipe_to_shell`` (there is no legitimate use for
+``curl … | sh`` inside an agent sandbox). Hosts opt in to more.
+"""
+from __future__ import annotations
+
+import re
+import shlex
+from pathlib import Path
+
+CATEGORIES: tuple[str, ...] = ("package_install", "download", "pipe_to_shell", "daemon")
+ALWAYS_BLOCKED: frozenset[str] = frozenset({"pipe_to_shell"})
+
+_OPERATORS = {"|", "||", "&&", ";", "&", "(", ")", ";;", "|&"}
+_INTERPRETERS = {"sh", "bash", "zsh", "dash", "ksh", "python", "python3", "node", "perl", "ruby", "php"}
+_WRAPPERS = {"env", "nice", "time", "command", "exec", "builtin", "nohup", "setsid", "stdbuf", "timeout"}
+
+_NODE_PM = {"npm", "pnpm", "yarn", "bun"}
+_NODE_PM_INSTALL = {"i", "install", "add", "ci", "update", "upgrade", "up", "dlx", "exec"}
+_PY_PM = {"pip", "pip3", "pipx", "poetry", "uv", "conda", "mamba", "pipenv"}
+_PY_PM_INSTALL = {"install", "add", "sync", "download"}
+_SYS_PM = {"apt", "apt-get", "apk", "yum", "dnf", "brew", "pacman", "zypper", "snap"}
+_SYS_PM_INSTALL = {"install", "add", "reinstall", "upgrade", "dist-upgrade"}
+_LANG_PM = {"cargo": {"install"}, "gem": {"install"}, "go": {"install", "get"}, "cpan": {"install"}}
+_DAEMON_PROGS = {"systemctl", "service", "daemonize", "pm2", "forever", "supervisord", "supervisorctl",
+                 "screen", "tmux", "start-stop-daemon"}
+_SERVER_PROGS = {"node", "python", "python3", "npm", "npx", "pnpm", "yarn", "bun", "deno", "serve",
+                 "http-server", "uvicorn", "gunicorn", "flask", "ruby", "php", "caddy", "nginx"}
+
+_PIPE_TO_SHELL_RE = re.compile(
+    r"(?:\bcurl\b|\bwget\b)[^|\n]*\|\s*(?:sudo\s+)?(?:sh|bash|zsh|dash|ksh|python3?|node|perl|ruby)\b"
+    r"|<\(\s*(?:curl|wget)\b"
+    r"|\b(?:sh|bash|zsh|python3?|node)\s+-c\s+[\"']?\$\(\s*(?:curl|wget)\b",
+    re.I,
+)
+
+
+def _segments(command: str) -> list[list[str]]:
+    """Split a shell command into simple commands (token lists) on operators."""
+    try:
+        lexer = shlex.shlex(command, posix=True, punctuation_chars=True)
+        lexer.whitespace_split = True
+        lexer.commenters = ""
+        tokens = list(lexer)
+    except ValueError:
+        tokens = command.split()
+    segs: list[list[str]] = []
+    cur: list[str] = []
+    for tok in tokens:
+        if tok in _OPERATORS or tok == "\n":
+            if cur:
+                segs.append(cur)
+            cur = []
+            if tok == "&":
+                segs.append(["&"])  # marker: previous segment was backgrounded
+        else:
+            cur.append(tok)
+    if cur:
+        segs.append(cur)
+    return segs
+
+
+def _program(seg: list[str]) -> tuple[str, list[str]]:
+    """Program basename + remaining args, skipping ``FOO=bar`` assignments and wrappers."""
+    i = 0
+    while i < len(seg):
+        tok = seg[i]
+        if re.match(r"^[A-Za-z_][A-Za-z0-9_]*=", tok):
+            i += 1
+            continue
+        name = Path(tok).name
+        if name in _WRAPPERS:
+            i += 1
+            # `timeout 30 cmd`, `nice -n 5 cmd`: skip their own option/value tokens
+            while i < len(seg) and (seg[i].startswith("-") or re.fullmatch(r"\d+[smhd]?", seg[i])):
+                i += 1
+            continue
+        return name, seg[i + 1:]
+    return "", []
+
+
+def _subcommand(args: list[str]) -> str:
+    for a in args:
+        if not a.startswith("-"):
+            return a
+    return ""
+
+
+def classify_command(command: str) -> set[str]:
+    """Return the set of policy categories a command touches (empty = plain)."""
+    cats: set[str] = set()
+    if not command or not command.strip():
+        return cats
+    if _PIPE_TO_SHELL_RE.search(command):
+        cats.add("pipe_to_shell")
+    segs = _segments(command)
+    for idx, seg in enumerate(segs):
+        if seg == ["&"]:
+            continue
+        prog, args = _program(seg)
+        if not prog:
+            continue
+        sub = _subcommand(args)
+        backgrounded = idx + 1 < len(segs) and segs[idx + 1] == ["&"]
+
+        # ── package_install ──
+        if prog in _NODE_PM and (sub in _NODE_PM_INSTALL or (prog == "yarn" and not sub)):
+            cats.add("package_install")
+        elif prog == "npx" or prog == "corepack":
+            cats.add("package_install")
+        elif prog in _PY_PM:
+            subs = {a for a in args if not a.startswith("-")}
+            if subs & _PY_PM_INSTALL or (prog == "uv" and "pip" in subs and "install" in subs):
+                cats.add("package_install")
+        elif prog.startswith("python") and "-m" in args:
+            m = args.index("-m")
+            if m + 1 < len(args) and args[m + 1] in {"pip", "ensurepip"} and "install" in args:
+                cats.add("package_install")
+        elif prog in _SYS_PM and sub in _SYS_PM_INSTALL:
+            cats.add("package_install")
+        elif prog in _LANG_PM and sub in _LANG_PM[prog]:
+            cats.add("package_install")
+        elif prog == "playwright" and sub == "install":
+            cats.add("package_install")
+
+        # ── download ──
+        if prog == "curl":
+            if any(a in {"-o", "-O", "--output", "--remote-name", "-J", "--remote-header-name"}
+                   or a.startswith(("-o", "--output=")) or re.fullmatch(r"-[a-zA-Z]*[oO][a-zA-Z]*", a)
+                   for a in args):
+                cats.add("download")
+        elif prog == "wget":
+            to_stdout = any(a in {"-O-", "-qO-", "-O", "--output-document=-"} and (a.endswith("-") or
+                            (a == "-O" and "-" in args[args.index(a) + 1:args.index(a) + 2]))
+                            for a in args)
+            if not to_stdout:
+                cats.add("download")
+        elif prog in {"aria2c", "axel"}:
+            cats.add("download")
+        elif prog == "git" and sub in {"clone", "fetch", "pull"}:
+            cats.add("download")
+
+        # ── daemon ──
+        if prog in _DAEMON_PROGS:
+            cats.add("daemon")
+        elif backgrounded and prog in _SERVER_PROGS:
+            cats.add("daemon")
+        # wrappers that only exist to daemonize
+        if seg and Path(seg[0]).name in {"nohup", "setsid"}:
+            cats.add("daemon")
+    return cats
+
+
+_EXITS = {
+    "package_install": (
+        "installing packages (npm/pip/apt/cargo…) is disabled for this agent. Use what is preinstalled "
+        "in the sandbox; if something is genuinely missing, tell the user so the platform can add it. "
+        "For screenshots of HTML prototypes use the render_html tool, not a browser install."
+    ),
+    "download": (
+        "downloading files with curl/wget/git clone is disabled for this agent. Use the platform's "
+        "fetch_file / web_read tools for content you need, or ask the user to provide the file."
+    ),
+    "pipe_to_shell": (
+        "piping a download straight into a shell/interpreter (curl … | sh) is never allowed."
+    ),
+    "daemon": (
+        "starting long-running/background daemons is disabled for this agent. Run the command in the "
+        "foreground with a timeout, or use the background_run tool for a bounded job."
+    ),
+}
+
+
+def command_policy_reason(command: str, blocked: frozenset[str] | set[str] | None) -> str | None:
+    """Return a refusal message if ``command`` touches a blocked category, else None."""
+    effective = set(ALWAYS_BLOCKED) | set(blocked or ())
+    hit = classify_command(command) & effective
+    if not hit:
+        return None
+    cat = next(c for c in CATEGORIES if c in hit)  # stable, most-severe-first order
+    return f"Error: Command blocked by sandbox policy ({cat}): {_EXITS[cat]}"
+
+
+__all__ = ["ALWAYS_BLOCKED", "CATEGORIES", "classify_command", "command_policy_reason"]

{power_loop-5.2.2 → power_loop-5.3.0}/power_loop/tools/default_tools.py

@@ -23,6 +23,7 @@ from power_loop.runtime.exec_backend import DEFAULT_SHELL_BACKEND, ShellBackend
 from power_loop.runtime.human_input import request_user_input
 from power_loop.runtime.runtime_state import get_tool_runtime_context
 from power_loop.runtime.skills import get_default_loader
+from power_loop.tools.command_policy import command_policy_reason
 
 logger = logging.getLogger(__name__)
 
@@ -531,6 +532,9 @@ class BashSession:
         reason = _dangerous_command_reason(command)
         if reason:
             return f"Error: Dangerous command blocked ({reason}). Run it manually if you really intend it."
+        policy_err = command_policy_reason(command, get_runtime_env().blocked_command_categories)
+        if policy_err:
+            return policy_err
 
         with self._lock:
             if self._proc is None or self._proc.poll() is not None:
@@ -1220,6 +1224,9 @@ class BackgroundManager:
         reason = _dangerous_command_reason(command)
         if reason:
             return f"Error: Dangerous command blocked ({reason}). Run it manually if you really intend it."
+        policy_err = command_policy_reason(command, get_runtime_env().blocked_command_categories)
+        if policy_err:
+            return policy_err
 
         scope_err = _validate_bash_command_scope(command)
         if scope_err:

{power_loop-5.2.2 → power_loop-5.3.0}/power_loop.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: power-loop
-Version: 5.2.2
+Version: 5.3.0
 Summary: Embeddable agent execution kernel — LLM loop, hooks, events, tools, dynamic sub-agents.
 Author-email: zhangran <zhangran24@126.com>
 License: MIT

{power_loop-5.2.2 → power_loop-5.3.0}/power_loop.egg-info/SOURCES.txt

@@ -84,6 +84,7 @@ power_loop/runtime/store/backends/postgres.py
 power_loop/runtime/store/backends/sqlite.py
 power_loop/tools/__init__.py
 power_loop/tools/blackboard.py
+power_loop/tools/command_policy.py
 power_loop/tools/default_manifest.py
 power_loop/tools/default_tools.py
 power_loop/tools/registry.py