rockycode 0.1.0__py3-none-any.whl

rockycode/engine/redact.py

@@ -0,0 +1,83 @@
+"""Scrub secrets from tool output before it enters the conversation history.
+
+History is the single thing that is BOTH sent to the model provider (the API
+prompt) AND written to the trajectory log, so redacting tool output at the
+tools.execute() chokepoint fixes both at once — and the model itself only ever
+sees `[redacted]`, so it can't later echo a key it read. (The user's own API key
+still travels in the request AUTH HEADER — that is how authentication works and
+is untouched; what we scrub is secret text that shows up in message CONTENT,
+e.g. from `env`, `cat .env`, or a printed token.)
+
+Two passes:
+  1. Known values — the literal values of the user's own sensitive env vars
+     (OPENAI_API_KEY, ANTHROPIC_AUTH_TOKEN, *_TOKEN, …). Highest precision:
+     redacts the actual secret wherever it appears (catches `env`/`printenv`).
+  2. Shapes — regexes for well-known secret formats when we don't know the
+     value (sk-…, ghp_…, AKIA…, AIza… google keys, JWTs, PRIVATE KEY blocks,
+     Bearer …, KEY=value) plus a generic high-entropy 32–64-char token
+     heuristic (mixed lower+UPPER+digit, so git SHAs / md5s are spared).
+"""
+from __future__ import annotations
+
+import os
+import re
+
+# Env var NAMES considered secret; their VALUES are scrubbed from output.
+_SENSITIVE_ENV = re.compile(r"(API_KEY|_TOKEN|_SECRET|PASSWORD|PASSWD|ANTHROPIC_|OPENAI_)", re.I)
+# Don't redact trivially short values — avoids nuking "1"/"true"/"dev" if such a
+# value ever lands in a sensitive-named var.
+_MIN_VALUE_LEN = 6
+
+_SHAPES: list[tuple[re.Pattern[str], str]] = [
+    (re.compile(r"-----BEGIN [A-Z ]*PRIVATE KEY-----.*?-----END [A-Z ]*PRIVATE KEY-----", re.S),
+     "[redacted: private key]"),
+    (re.compile(r"\b(?:sk|rk)-[A-Za-z0-9_-]{16,}"), "[redacted: api key]"),
+    (re.compile(r"\bgh[posur]_[A-Za-z0-9]{20,}"), "[redacted: github token]"),
+    (re.compile(r"\bAKIA[0-9A-Z]{16}\b"), "[redacted: aws key id]"),
+    (re.compile(r"\bxox[baprs]-[A-Za-z0-9-]{10,}"), "[redacted: slack token]"),
+    # Google API key: literal "AIza" + 35 url-safe base64 chars (fixed length).
+    (re.compile(r"\bAIza[0-9A-Za-z_-]{35}\b"), "[redacted: google api key]"),
+    # JWT: three base64url segments separated by dots, first starts with the
+    # canonical `eyJ` ({"…} header). Matches access/id tokens people print.
+    (re.compile(r"\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b"),
+     "[redacted: jwt]"),
+    (re.compile(r"(?i)\bBearer\s+[A-Za-z0-9._~+/-]{16,}=*"), "Bearer [redacted]"),
+    # NAME=value / NAME: value where the name ends in a secret word. The word
+    # must sit immediately before the separator, so MAX_TOKENS / TOKEN_COUNT
+    # (no separator right after the word) are NOT matched; ACCESS_TOKEN= is.
+    (re.compile(r"""(?im)^(\s*[\w.-]*(?:_API_KEY|_TOKEN|_SECRET|SECRET_KEY|PASSWORD|PASSWD)\s*[=:]\s*)
+                    (["']?[^\s"']{8,}["']?)""", re.VERBOSE),
+     r"\1[redacted]"),
+    # Generic high-entropy token: a 32–64 char base62-ish run that mixes
+    # lower + UPPER + digit. The three-class requirement is what spares
+    # low-diversity strings that are NOT secrets — a 40-hex git SHA / md5 (no
+    # uppercase), an ALL-CAPS constant, a decimal id — while still catching the
+    # opaque provider keys that don't carry a recognizable prefix. Runs LAST so
+    # the labelled shapes above win. Best-effort; may occasionally over-redact a
+    # mixed-case blob, which on tool output is the safe direction.
+    (re.compile(r"\b(?=[A-Za-z0-9_-]*[a-z])(?=[A-Za-z0-9_-]*[A-Z])(?=[A-Za-z0-9_-]*\d)"
+                r"[A-Za-z0-9_-]{32,64}\b"),
+     "[redacted: token]"),
+]
+
+
+def _known_values() -> list[str]:
+    vals = {
+        v for k, v in os.environ.items()
+        if v and len(v) >= _MIN_VALUE_LEN and _SENSITIVE_ENV.search(k)
+    }
+    # Longest first: if one secret value is a substring of another, redact the
+    # bigger match before the smaller can partially hit it.
+    return sorted(vals, key=len, reverse=True)
+
+
+def redact(text: str) -> str:
+    """Return *text* with known secret values and secret-shaped tokens masked."""
+    if not text:
+        return text
+    for value in _known_values():
+        if value in text:
+            text = text.replace(value, "[redacted]")
+    for rx, repl in _SHAPES:
+        text = rx.sub(repl, text)
+    return text

rockycode/engine/safety.py

@@ -0,0 +1,139 @@
+"""Command-safety classification for autonomous (goal) mode.
+
+Goal mode runs unattended, and the sandbox mounts the project READ-WRITE, so a
+destructive command reaches the user's real files. Every bash command is
+classified BEFORE it runs, and the goal/plan is pre-scanned at start. Three
+tiers (highest severity wins):
+
+  block  — destructive / irreversible: rm -rf of a filesystem/home/mount root,
+           mkfs, dd to a device, a fork bomb, shutdown. NEVER run in goal mode —
+           the model gets an error and must find a reversible path. Isolation
+           (goal runs on a COPY / git worktree) is the backstop so even a missed
+           one can't touch the user's real repo.
+  ask    — risky but sometimes legitimately needed: git push, sudo, curl|sh, a
+           system OR language package install (apt/brew/pip/npm/cargo/… — they
+           run code from a registry, so a poisoned/typosquat package is a real
+           supply-chain risk). Surfaced at goal START for ONE up-front approval;
+           if unapproved at runtime, treated as block.
+  allow  — everything else, incl. normal dev (rm -rf build/, git commit, npm run,
+           go build, pytest …).
+
+This guards the agent against its own long-horizon mistakes; it is NOT a
+security boundary against a hostile model (the container + copy isolation are).
+"""
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True)
+class Verdict:
+    action: str   # "allow" | "ask" | "block"
+    reason: str
+    pattern: str
+
+
+# rm -rf aimed at a filesystem/home/mount ROOT — not a named subdir. `rm -rf
+# build/` stays allow; `rm -rf /`, `~`, `$HOME`, `/workspace`, `.`, `*` are block.
+_RM_ROOT = re.compile(
+    r"""\brm\b[^\n|;&]*\s
+        (?:-\w+\s)*
+        (?:
+            /(?:\s|$|\*)                                   # bare /  or  /*
+          | /(?:etc|var|usr|s?bin|lib\w*|boot|sys|proc|dev|opt|root|home|srv|run)(?:/|\s|$)
+          | ~(?:/\s*\*?)?(?:\s|$)                          # ~  ~/  ~/*
+          | \$HOME\b
+          | /workspace(?:/\s*\*?)?(?:\s|$)
+          | \.\s*$                                         # trailing .
+          | \*\s*$                                         # trailing *
+        )
+    """,
+    re.VERBOSE,
+)
+
+_BLOCK = [
+    ("fork-bomb", re.compile(r":\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:"), "fork bomb"),
+    ("disk-write", re.compile(r"\b(mkfs\w*|fdisk|parted)\b|\bdd\b[^\n]*\bof=/dev/"), "raw disk / filesystem write"),
+    ("redirect-device", re.compile(r">\s*/dev/(sd|nvme|disk|mmcblk)\w+"), "redirect to a block device"),
+    ("power", re.compile(r"\b(shutdown|reboot|halt|poweroff|init\s+0)\b"), "power / host-state change"),
+    ("chmod-root", re.compile(r"\b(chmod|chown)\b[^\n]*\s-\w*R\w*\s[^\n]*\s(/|~|\$HOME|/workspace)(\s|$)"),
+     "recursive perms/owner change on a filesystem root"),
+]
+
+_ASK = [
+    ("git-push", re.compile(r"(?:^|[\n;&|(])\s*git\b[^\n'\"]*\bpush\b"),
+     "git push — publishes to a remote you can't review overnight"),
+    ("privilege", re.compile(r"(?:^|[\s|;&(])sudo\b|(?:^|[\s|;&(])su\s"),
+     "privilege escalation (sudo/su)"),
+    ("remote-exec", re.compile(r"\b(curl|wget|fetch)\b[^\n|]*\|\s*(sudo\s+)?(sh|bash|zsh|python\d?|perl|ruby|node)\b"),
+     "pipes a network download into a shell/interpreter"),
+    ("sys-install", re.compile(r"\b(apt|apt-get|yum|dnf|brew|pacman|snap)\b\s+(install|add|-S)\b"),
+     "system package install"),
+    # Language package installs fetch (and typically EXECUTE — setup.py, wheels,
+    # npm lifecycle scripts) arbitrary code from a public registry: typosquat /
+    # poisoned-package supply-chain risk. Gate them like a system install.
+    ("pkg-install", re.compile(
+        r"(?:^|[\s;&|(])(?:"
+        r"(?:python[23]?\s+-m\s+)?pip[23]?\s+install"      # pip / pip3 / python -m pip install
+        r"|uv\s+(?:pip\s+install|add)"
+        r"|npm\s+(?:install|i|ci|add)(?:\s|$)"
+        r"|(?:yarn|pnpm)\s+(?:add|install|i)(?:\s|$)"
+        r"|gem\s+install"
+        r"|cargo\s+(?:install|add)"
+        r"|go\s+(?:install|get)(?:\s|$)"
+        r"|poetry\s+(?:add|install)"
+        r"|conda\s+install"
+        r")", re.I),
+     "language package install — runs code from a registry (supply-chain risk)"),
+]
+
+
+def classify_command(command: str) -> Verdict:
+    """Classify a single bash command into allow / ask / block."""
+    cmd = command.strip()
+    if not cmd:
+        return Verdict("allow", "", "")
+    if re.search(r"\brm\b.*-\w*[rR]", cmd) and _RM_ROOT.search(cmd):
+        return Verdict("block", "recursive force-remove of a filesystem/home/mount root", "rm-rf-root")
+    for pat, rx, why in _BLOCK:
+        if rx.search(cmd):
+            return Verdict("block", why, pat)
+    for pat, rx, why in _ASK:
+        if rx.search(cmd):
+            return Verdict("ask", why, pat)
+    return Verdict("allow", "", "")
+
+
+def pre_scan(text: str) -> list[Verdict]:
+    """Classify each line of a goal / plan; return the non-allow verdicts, deduped
+    by pattern (block first, then ask). Used for the goal-start pre-flight, where
+    'ask' verdicts become the one up-front approval batch."""
+    seen: dict[str, Verdict] = {}
+    for line in text.splitlines():
+        v = classify_command(line)
+        if v.action != "allow" and v.pattern not in seen:
+            seen[v.pattern] = v
+    return sorted(seen.values(), key=lambda v: 0 if v.action == "block" else 1)
+
+
+# Network-intent hints in an objective/plan — used to surface "this goal may
+# need network" in the up-front approval, so the offline-by-default goal sandbox
+# can be opted online before the user leaves. Heuristic + conservative: a miss
+# just means the run stays offline and a network step fails gracefully.
+_NET_HINT = re.compile(
+    r"(?i)\b("
+    r"pip3?\s+install|(apt|apt-get|yum|dnf|brew|pacman|snap|conda)\s+(install|update|add|-S)|"
+    r"npm\s+(i|install|ci)|yarn\s+add|pnpm\s+add|poetry\s+add|cargo\s+add|go\s+get|"
+    r"download|install\s+(the\s+)?\w+\s+(package|librar|dependen|module|toolkit)|"
+    r"\bclone\b|\bcurl\b|\bwget\b|https?://|\bpypi\b|from\s+the\s+internet|"
+    r"fetch\s+(from|the)|\bnetwork\b|\binternet\b"
+    r")\b"
+)
+
+
+def network_intent(text: str) -> str | None:
+    """A short reason string if *text* (an objective or plan) looks like it needs
+    network access, else None. Feeds the goal pre-flight network approval."""
+    m = _NET_HINT.search(text or "")
+    return m.group(0).strip() if m else None

rockycode/engine/sandbox.py

@@ -0,0 +1,219 @@
+"""Chat sandbox: a lightweight Docker container that runs the agent's tools
+in isolation while sharing the project directory.
+
+Same Session interface as container.DockerSession (exec / stop), so the
+existing build_session_registry() works unchanged — only the container
+internals differ (no conda, no /testbed, just /workspace).
+
+Lifecycle: created on /sandbox on, destroyed on /sandbox off or app exit.
+
+The default image is minimal (debian:bookworm-slim). Override via
+ROCKYCODE_SANDBOX_IMAGE if Docker Hub is unreachable.
+"""
+from __future__ import annotations
+
+import asyncio
+import os
+import shlex
+from pathlib import Path
+from typing import Optional
+
+from rockycode.engine.tools import (
+    GLOB_MAX_PATHS,
+    GREP_MAX_MATCHES,
+    RISK,
+    SCHEMAS,
+    Tool,
+    _truncate,
+)
+
+# python-preinstalled so the agent can run/test code offline and an approved
+# `pip install` doesn't have to apt-bootstrap the toolchain (the old .deb pile).
+# Override with ROCKYCODE_SANDBOX_IMAGE for non-python projects.
+DEFAULT_SANDBOX_IMAGE = "python:3.12-slim"
+EXEC_TIMEOUT_S = 120
+
+
+class ChatSandbox:
+    """One lightweight container per chat session; project dir mounted at /workspace."""
+
+    def __init__(self, container_id: str, workdir: Path) -> None:
+        self.container_id = container_id
+        self.workdir = workdir
+        self._running = True
+
+    @classmethod
+    async def start(cls, workdir: Path, *, image: str | None = None,
+                    network: bool = False) -> "ChatSandbox":
+        img = image or os.getenv("ROCKYCODE_SANDBOX_IMAGE", DEFAULT_SANDBOX_IMAGE)
+        wd = workdir.resolve()
+        # network=False → `--network none`: no egress at all. This is the SAFE
+        # DEFAULT for every surface (no exfiltration, no apt/pip rabbit-holes);
+        # the container can only touch the mounted workspace. Callers that need
+        # the network (goal mode when the plan implies it, chat/exec on request)
+        # pass network=True explicitly and say so out loud.
+        net_args = [] if network else ["--network", "none"]
+        proc = await asyncio.create_subprocess_exec(
+            "docker", "run", "-d", "--rm",
+            *net_args,
+            "-v", f"{wd}:/workspace:rw",
+            "-w", "/workspace",
+            img, "tail", "-f", "/dev/null",
+            stdout=asyncio.subprocess.PIPE,
+            stderr=asyncio.subprocess.PIPE,
+        )
+        out, err = await proc.communicate()
+        if proc.returncode != 0:
+            msg = err.decode(errors="replace").strip()
+            hint = ""
+            if "pull access denied" in msg.lower() or "not found" in msg.lower():
+                hint = (
+                    f"\n  [hint] this image may not be pulled yet. "
+                    f"try: docker pull {img}"
+                )
+            elif "Cannot connect" in msg or "Is the docker daemon" in msg:
+                hint = "\n  [hint] docker daemon is not running or not reachable."
+            raise RuntimeError(f"sandbox start failed for {img}: {msg}{hint}")
+        return cls(out.decode().strip(), wd)
+
+    async def exec(
+        self,
+        script: str,
+        *,
+        stdin: Optional[bytes] = None,
+        timeout: int = EXEC_TIMEOUT_S,
+    ) -> tuple[str, int]:
+        if not self._running:
+            return "[error] sandbox has been stopped", 1
+        proc = await asyncio.create_subprocess_exec(
+            "docker", "exec", "-i", self.container_id, "bash", "-c", script,
+            stdin=asyncio.subprocess.PIPE if stdin is not None else asyncio.subprocess.DEVNULL,
+            stdout=asyncio.subprocess.PIPE,
+            stderr=asyncio.subprocess.STDOUT,
+        )
+        try:
+            out, _ = await asyncio.wait_for(proc.communicate(input=stdin), timeout=timeout)
+        except asyncio.TimeoutError:
+            proc.kill()
+            return f"[timeout] command exceeded {timeout}s and was killed", 124
+        return out.decode(errors="replace"), proc.returncode or 0
+
+    async def stop(self) -> None:
+        self._running = False
+        proc = await asyncio.create_subprocess_exec(
+            "docker", "rm", "-f", self.container_id,
+            stdout=asyncio.subprocess.DEVNULL,
+            stderr=asyncio.subprocess.DEVNULL,
+        )
+        await proc.wait()
+
+    @property
+    def is_running(self) -> bool:
+        return self._running
+
+
+# ── tool wrappers (same logic as container.py, minus conda / SWE-bench paths) ──
+
+async def _bash(sandbox: ChatSandbox, command: str) -> str:
+    out, code = await sandbox.exec(command)
+    if out.startswith("[timeout]"):
+        return out
+    return _truncate(f"[exit {code}]\n{out}" if out else f"[exit {code}]")
+
+
+async def _read_file(sandbox: ChatSandbox, path: str, offset=None, limit=None) -> str:
+    q = shlex.quote(path)
+    # cat -n before sed: absolute line numbers survive windowed reads (same
+    # contract as the local and bench-container read_file).
+    window = ""
+    if offset or limit:
+        start = max(int(offset or 1), 1)
+        end = str(start + int(limit) - 1) if limit else "$"
+        window = f" | sed -n '{start},{end}p'"
+    out, _code = await sandbox.exec(
+        f'if [ -d {q} ]; then echo "[directory] {path}"; ls -p {q}; '
+        f'elif [ -e {q} ]; then cat -n {q}{window}; '
+        f'else echo "[error] file not found: {path}"; exit 1; fi'
+    )
+    return _truncate(out.rstrip("\n"))
+
+
+async def _write_file(sandbox: ChatSandbox, path: str, content: str) -> str:
+    q = shlex.quote(path)
+    out, code = await sandbox.exec(
+        f'mkdir -p "$(dirname {q})" && cat > {q}', stdin=content.encode()
+    )
+    if code != 0:
+        return f"[error] write failed: {out.strip()}"
+    return f"[ok] wrote {len(content)} chars to {path}"
+
+
+async def _edit_file(sandbox: ChatSandbox, path: str, old_string: str, new_string: str) -> str:
+    q = shlex.quote(path)
+    text, code = await sandbox.exec(f"cat {q}")
+    if code != 0:
+        return f"[error] file not found: {path}"
+    n = text.count(old_string)
+    if n == 0:
+        return "[error] old_string not found in file. read the file again — it may have changed."
+    if n > 1:
+        return f"[error] old_string appears {n} times; include more surrounding context to make it unique."
+    return await _write_file(sandbox, path, text.replace(old_string, new_string, 1))
+
+
+async def _grep(sandbox: ChatSandbox, pattern: str, path: str = ".", include: str | None = None) -> str:
+    inc = f" --include={shlex.quote(include)}" if include else ""
+    excludes = " ".join(f"--exclude-dir={d}" for d in (".git", "__pycache__", ".venv", "node_modules"))
+    cmd = f"grep -rnIE {excludes}{inc} -e {shlex.quote(pattern)} {shlex.quote(path)}"
+    out, code = await sandbox.exec(cmd)
+    out = out.rstrip("\n")
+    if code == 1:
+        return "[no matches]"
+    if code != 0:
+        return f"[error] grep failed (bad pattern or path): {out[:200]}"
+    lines = out.splitlines()
+    if len(lines) > GREP_MAX_MATCHES:
+        lines = lines[:GREP_MAX_MATCHES]
+        lines.append(f"[truncated at {GREP_MAX_MATCHES} matches — narrow the pattern]")
+    return _truncate("\n".join(lines))
+
+
+_GLOB_PY = (
+    "import glob, sys; "
+    f"hits = sorted(glob.glob(sys.argv[1], recursive=True))[:{GLOB_MAX_PATHS}]; "
+    "print('\\n'.join(hits) if hits else '[no matches]')"
+)
+
+
+async def _glob(sandbox: ChatSandbox, pattern: str) -> str:
+    out, code = await sandbox.exec(f"python3 -c {shlex.quote(_GLOB_PY)} {shlex.quote(pattern)}")
+    if code != 0:
+        return f"[error] glob failed: {out.strip()[:200]}"
+    return _truncate(out.rstrip("\n"))
+
+
+def build_sandbox_registry(sandbox: ChatSandbox, *, extras: dict[str, Tool] | None = None) -> dict[str, Tool]:
+    """Build a tool registry bound to a chat sandbox (same schema, capsuled execution).
+
+    extras are merged on top — e.g. web_search/web_research/web_fetch that run on the
+    host, not inside the container.
+    """
+    fns = {
+        "bash": lambda command: _bash(sandbox, command),
+        "read_file": lambda path, offset=None, limit=None: _read_file(sandbox, path, offset, limit),
+        "write_file": lambda path, content: _write_file(sandbox, path, content),
+        "edit_file": lambda path, old_string, new_string: _edit_file(
+            sandbox, path, old_string, new_string
+        ),
+        "grep": lambda pattern, path=".", include=None: _grep(sandbox, pattern, path, include),
+        "glob": lambda pattern: _glob(sandbox, pattern),
+    }
+    # Same risk tiers as the host registry (read_file/grep/glob = "safe") so the
+    # loop's read-parallelism kicks in inside the sandbox too — goal mode and
+    # `chat --sandbox` both build their registry here. Without this the reads
+    # default to "risky" and every explore batch runs serially.
+    reg = {name: Tool(name=name, schema=SCHEMAS[name], fn=fn, risk=RISK.get(name, "risky"))
+           for name, fn in fns.items()}
+    if extras:
+        reg.update(extras)
+    return reg