skilllite 0.1.1__py3-none-any.whl → 0.1.2__py3-none-any.whl

skilllite/mcp/server.py

@@ -98,7 +98,27 @@ except ImportError:
 
 class SecurityScanResult:
     """Result of a security scan."""
-    
+
+    # Issue types that are HARD BLOCKED in L3 sandbox (cannot execute even with confirmation)
+    # These operations are blocked at the sandbox runtime level, not just static analysis
+    HARD_BLOCKED_ISSUE_TYPES_L3 = {
+        "Process Execution",   # os.system, subprocess, etc.
+        "ProcessExecution",    # Alternative format
+        "process_execution",   # Snake case format
+    }
+
+    # Rule IDs that are specifically hard blocked in L3 sandbox
+    HARD_BLOCKED_RULE_IDS_L3 = {
+        "py-subprocess",       # subprocess.call/run/Popen
+        "py-os-system",        # os.system/popen/spawn
+        "js-child-process",    # child_process.exec/spawn
+    }
+
+    # Dangerous module imports that lead to hard blocks when combined with execution
+    HARD_BLOCKED_MODULES_L3 = {
+        "py-os-import",        # import os/subprocess/shutil
+    }
+
     def __init__(
         self,
         is_safe: bool,
@@ -108,6 +128,7 @@ class SecurityScanResult:
         high_severity_count: int = 0,
         medium_severity_count: int = 0,
         low_severity_count: int = 0,
+        sandbox_level: int = 3,
     ):
         self.is_safe = is_safe
         self.issues = issues
@@ -116,8 +137,31 @@ class SecurityScanResult:
         self.high_severity_count = high_severity_count
         self.medium_severity_count = medium_severity_count
         self.low_severity_count = low_severity_count
+        self.sandbox_level = sandbox_level
         self.timestamp = time.time()
-    
+
+        # Calculate hard blocked issues
+        self.hard_blocked_issues = self._find_hard_blocked_issues()
+        self.has_hard_blocked = len(self.hard_blocked_issues) > 0
+
+    def _find_hard_blocked_issues(self) -> List[Dict[str, Any]]:
+        """Find issues that are hard blocked in the current sandbox level."""
+        if self.sandbox_level < 3:
+            # Only L3 has hard blocks
+            return []
+
+        hard_blocked = []
+        for issue in self.issues:
+            issue_type = issue.get("issue_type", "")
+            rule_id = issue.get("rule_id", "")
+
+            # Check if this issue type or rule is hard blocked
+            if (issue_type in self.HARD_BLOCKED_ISSUE_TYPES_L3 or
+                rule_id in self.HARD_BLOCKED_RULE_IDS_L3):
+                hard_blocked.append(issue)
+
+        return hard_blocked
+
     def to_dict(self) -> Dict[str, Any]:
         return {
             "is_safe": self.is_safe,
@@ -127,42 +171,64 @@ class SecurityScanResult:
             "high_severity_count": self.high_severity_count,
             "medium_severity_count": self.medium_severity_count,
             "low_severity_count": self.low_severity_count,
-            "requires_confirmation": self.high_severity_count > 0,
+            "requires_confirmation": self.high_severity_count > 0 and not self.has_hard_blocked,
+            "has_hard_blocked": self.has_hard_blocked,
+            "hard_blocked_count": len(self.hard_blocked_issues),
+            "sandbox_level": self.sandbox_level,
         }
-    
+
     def format_report(self) -> str:
         """Format a human-readable security report."""
         if not self.issues:
             return "✅ Security scan passed. No issues found."
-        
+
         lines = [
             f"📋 Security Scan Report (ID: {self.scan_id[:8]})",
+            f"   Sandbox Level: L{self.sandbox_level}",
             f"   Found {len(self.issues)} item(s) for review:",
             "",
         ]
-        
+
         severity_icons = {
             "Critical": "🔴",
             "High": "🟠",
             "Medium": "🟡",
             "Low": "🟢",
         }
-        
+
         for idx, issue in enumerate(self.issues, 1):
             severity = issue.get("severity", "Medium")
             icon = severity_icons.get(severity, "⚪")
-            lines.append(f"  {icon} #{idx} [{severity}] {issue.get('issue_type', 'Unknown')}")
+
+            # Mark hard blocked issues
+            is_hard_blocked = issue in self.hard_blocked_issues
+            block_marker = " 🚫 [HARD BLOCKED]" if is_hard_blocked else ""
+
+            lines.append(f"  {icon} #{idx} [{severity}] {issue.get('issue_type', 'Unknown')}{block_marker}")
             lines.append(f"     ├─ Rule: {issue.get('rule_id', 'N/A')}")
             lines.append(f"     ├─ Line {issue.get('line_number', '?')}: {issue.get('description', '')}")
             lines.append(f"     └─ Code: {issue.get('code_snippet', '')[:60]}...")
             lines.append("")
-        
-        if self.high_severity_count > 0:
+
+        # Different messages based on whether there are hard blocked issues
+        if self.has_hard_blocked:
+            lines.append("🚫 HARD BLOCKED: This code contains operations that CANNOT be executed")
+            lines.append(f"   in the current L{self.sandbox_level} sandbox environment.")
+            lines.append("")
+            lines.append("   The following operations are permanently blocked at runtime:")
+            for issue in self.hard_blocked_issues:
+                lines.append(f"   • {issue.get('issue_type', 'Unknown')}: {issue.get('description', '')}")
+            lines.append("")
+            lines.append("   ⚠️  Even with confirmation, this code will fail to execute.")
+            lines.append("   Options:")
+            lines.append("   1. Modify the code to remove blocked operations")
+            lines.append("   2. Use a lower sandbox level (L1 or L2) if permitted")
+        elif self.high_severity_count > 0:
             lines.append("⚠️  High severity issues found. Confirmation required to execute.")
             lines.append(f"   To proceed, call execute_code with confirmed=true and scan_id=\"{self.scan_id}\"")
         else:
             lines.append("ℹ️  Only low/medium severity issues found. Safe to execute.")
-        
+
         return "\n".join(lines)
 
 
@@ -243,26 +309,37 @@ This skill executes code from MCP.
         
         return skill_dir, code_file
     
-    def scan_code(self, language: str, code: str) -> SecurityScanResult:
-        """Scan code for security issues without executing it."""
+    def scan_code(self, language: str, code: str, sandbox_level: Optional[int] = None) -> SecurityScanResult:
+        """Scan code for security issues without executing it.
+
+        Args:
+            language: Programming language (python, javascript, bash)
+            code: Code to scan
+            sandbox_level: Sandbox level to check against (default: from env or 3)
+        """
+        # Use default sandbox level if not specified
+        if sandbox_level is None:
+            sandbox_level = self.default_sandbox_level
+
         if not self.runtime_available:
             return SecurityScanResult(
                 is_safe=False,
-                issues=[{"severity": "Critical", "issue_type": "RuntimeError", 
+                issues=[{"severity": "Critical", "issue_type": "RuntimeError",
                         "description": f"skillbox not found at {self.skillbox_path}",
                         "rule_id": "system", "line_number": 0, "code_snippet": ""}],
                 scan_id="error",
                 code_hash="",
                 high_severity_count=1,
+                sandbox_level=sandbox_level,
             )
-        
+
         self._cleanup_expired_scans()
         code_hash = self._generate_code_hash(language, code)
         scan_id = self._generate_scan_id(code_hash)
-        
+
         try:
             skill_dir, code_file = self._create_temp_skill(language, code)
-            
+
             try:
                 result = subprocess.run(
                     [self.skillbox_path, "security-scan", code_file],
@@ -270,12 +347,12 @@ This skill executes code from MCP.
                     text=True,
                     timeout=30
                 )
-                
+
                 issues = self._parse_scan_output(result.stdout + result.stderr)
                 high_count = sum(1 for i in issues if i.get("severity") in ["Critical", "High"])
                 medium_count = sum(1 for i in issues if i.get("severity") == "Medium")
                 low_count = sum(1 for i in issues if i.get("severity") == "Low")
-                
+
                 scan_result = SecurityScanResult(
                     is_safe=high_count == 0,
                     issues=issues,
@@ -284,14 +361,15 @@ This skill executes code from MCP.
                     high_severity_count=high_count,
                     medium_severity_count=medium_count,
                     low_severity_count=low_count,
+                    sandbox_level=sandbox_level,
                 )
-                
+
                 self._scan_cache[scan_id] = scan_result
                 return scan_result
-                
+
             finally:
                 shutil.rmtree(skill_dir, ignore_errors=True)
-                
+
         except subprocess.TimeoutExpired:
             return SecurityScanResult(
                 is_safe=False,
@@ -301,6 +379,7 @@ This skill executes code from MCP.
                 scan_id=scan_id,
                 code_hash=code_hash,
                 high_severity_count=1,
+                sandbox_level=sandbox_level,
             )
         except Exception as e:
             return SecurityScanResult(
@@ -311,6 +390,7 @@ This skill executes code from MCP.
                 scan_id=scan_id,
                 code_hash=code_hash,
                 high_severity_count=1,
+                sandbox_level=sandbox_level,
             )
     
     def _parse_scan_output(self, output: str) -> List[Dict[str, Any]]:
@@ -412,9 +492,31 @@ This skill executes code from MCP.
             }
         
         code_hash = self._generate_code_hash(language, code)
-        
+
         if sandbox_level >= 3 and not confirmed:
-            scan_result = self.scan_code(language, code)
+            scan_result = self.scan_code(language, code, sandbox_level=sandbox_level)
+
+            # Check for hard blocked issues first
+            if scan_result.has_hard_blocked:
+                return {
+                    "success": False,
+                    "stdout": "",
+                    "stderr": (
+                        f"🚫 Execution Blocked\n\n"
+                        f"{scan_result.format_report()}\n\n"
+                        f"❌ This code contains operations that are PERMANENTLY BLOCKED\n"
+                        f"   in the L{sandbox_level} sandbox environment.\n\n"
+                        f"   Even with confirmation, this code CANNOT be executed.\n\n"
+                        f"Options:\n"
+                        f"  1. Modify the code to remove blocked operations\n"
+                        f"  2. Use sandbox_level=1 or sandbox_level=2 (if permitted)\n"
+                    ),
+                    "exit_code": 4,
+                    "hard_blocked": True,
+                    "security_issues": scan_result.to_dict(),
+                }
+
+            # Soft risk: can be confirmed
             if scan_result.high_severity_count > 0:
                 return {
                     "success": False,
@@ -422,7 +524,9 @@ This skill executes code from MCP.
                     "stderr": (
                         f"🔐 Security Review Required\n\n"
                         f"{scan_result.format_report()}\n\n"
-                        f"To execute this code, call execute_code again with:\n"
+                        f"⚠️ IMPORTANT: You MUST ask the user for confirmation before proceeding.\n"
+                        f"Show this security report to the user and wait for their explicit approval.\n\n"
+                        f"If the user approves, call execute_code again with:\n"
                         f"  - confirmed: true\n"
                         f"  - scan_id: \"{scan_result.scan_id}\"\n"
                     ),
@@ -431,7 +535,7 @@ This skill executes code from MCP.
                     "scan_id": scan_result.scan_id,
                     "security_issues": scan_result.to_dict(),
                 }
-        
+
         if confirmed and scan_id:
             cached_result = self.verify_scan(scan_id, code_hash)
             if not cached_result:
@@ -444,6 +548,28 @@ This skill executes code from MCP.
                     ),
                     "exit_code": 3,
                 }
+
+            # Even with confirmation, check for hard blocked issues
+            if cached_result.has_hard_blocked:
+                return {
+                    "success": False,
+                    "stdout": "",
+                    "stderr": (
+                        f"🚫 Execution Blocked (Even After Confirmation)\n\n"
+                        f"The code contains operations that are PERMANENTLY BLOCKED\n"
+                        f"in the L{sandbox_level} sandbox environment:\n\n"
+                        + "\n".join(f"  • {issue.get('issue_type', 'Unknown')}: {issue.get('description', '')}"
+                                   for issue in cached_result.hard_blocked_issues) +
+                        f"\n\n"
+                        f"❌ Confirmation cannot override sandbox runtime restrictions.\n\n"
+                        f"Options:\n"
+                        f"  1. Modify the code to remove blocked operations\n"
+                        f"  2. Use sandbox_level=1 or sandbox_level=2 (if permitted)\n"
+                    ),
+                    "exit_code": 4,
+                    "hard_blocked": True,
+                    "security_issues": cached_result.to_dict(),
+                }
         
         try:
             skill_dir, _ = self._create_temp_skill(language, code)
@@ -594,7 +720,10 @@ class MCPServer:
                     description=(
                         "Execute a skill with the given input parameters. "
                         "Use list_skills to see available skills and "
-                        "get_skill_info to understand required parameters."
+                        "get_skill_info to understand required parameters. "
+                        "IMPORTANT: If the skill has high-severity security issues, "
+                        "you MUST show the security report to the user and ASK for their explicit confirmation "
+                        "before setting confirmed=true. Do NOT auto-confirm without user approval."
                     ),
                     inputSchema={
                         "type": "object",
@@ -606,6 +735,17 @@ class MCPServer:
                             "input": {
                                 "type": "object",
                                 "description": "Input parameters for the skill"
+                            },
+                            "confirmed": {
+                                "type": "boolean",
+                                "description": (
+                                    "Set to true ONLY after the user has explicitly approved execution. "
+                                    "You must ask the user for confirmation first."
+                                )
+                            },
+                            "scan_id": {
+                                "type": "string",
+                                "description": "Scan ID from security review (required when confirmed=true)"
                             }
                         },
                         "required": ["skill_name"]
@@ -639,8 +779,9 @@ class MCPServer:
                     name="execute_code",
                     description=(
                         "Execute code in a secure sandbox environment. "
-                        "If security issues are found, you must set confirmed=true "
-                        "and provide the scan_id from a previous scan_code call."
+                        "IMPORTANT: If security issues are found, you MUST show the security report "
+                        "to the user and ASK for their explicit confirmation before setting confirmed=true. "
+                        "Do NOT auto-confirm without user approval."
                     ),
                     inputSchema={
                         "type": "object",
@@ -657,8 +798,8 @@ class MCPServer:
                             "confirmed": {
                                 "type": "boolean",
                                 "description": (
-                                    "Set to true to confirm execution despite security warnings. "
-                                    "Required when high-severity issues are found."
+                                    "Set to true ONLY after the user has explicitly approved execution. "
+                                    "You must ask the user for confirmation first."
                                 ),
                                 "default": False
                             },
@@ -772,6 +913,18 @@ class MCPServer:
             sandbox_level=sandbox_level,
         )
         
+        # Handle hard blocked case - this is a definitive block, not a confirmation request
+        if result.get("hard_blocked"):
+            return CallToolResult(
+                isError=True,
+                content=[
+                    TextContent(
+                        type="text",
+                        text=result["stderr"]
+                    )
+                ]
+            )
+
         if result.get("requires_confirmation"):
             return CallToolResult(
                 content=[
@@ -781,15 +934,15 @@ class MCPServer:
                     )
                 ]
             )
-        
+
         output_lines = []
         if result["stdout"]:
             output_lines.append(f"Output:\n{result['stdout']}")
         if result["stderr"]:
             output_lines.append(f"Errors:\n{result['stderr']}")
-        
+
         output_text = "\n".join(output_lines) if output_lines else "Execution completed successfully (no output)"
-        
+
         if result["success"]:
             return CallToolResult(
                 content=[
@@ -921,9 +1074,18 @@ class MCPServer:
         )
 
     async def _handle_run_skill(self, arguments: Dict[str, Any]) -> "CallToolResult":
-        """Handle run_skill tool call."""
+        """
+        Handle run_skill tool call using UnifiedExecutionService.
+
+        This method uses the unified execution layer which:
+        1. Reads sandbox level at runtime
+        2. Handles security scanning
+        3. Properly downgrades sandbox level after confirmation
+        """
         skill_name = arguments.get("skill_name")
         input_data = arguments.get("input", {})
+        confirmed = arguments.get("confirmed", False)
+        scan_id = arguments.get("scan_id")
 
         if not skill_name:
             return CallToolResult(
@@ -959,36 +1121,82 @@ class MCPServer:
                 ]
             )
 
-        # Execute the skill
-        try:
-            result = self.skill_manager.execute(skill_name, input_data)
+        # Get skill info
+        skill = self.skill_manager.get_skill(skill_name)
+        if not skill:
+            return CallToolResult(
+                isError=True,
+                content=[
+                    TextContent(
+                        type="text",
+                        text=f"Could not load skill: {skill_name}"
+                    )
+                ]
+            )
 
-            if result.success:
-                return CallToolResult(
-                    content=[
-                        TextContent(
-                            type="text",
-                            text=f"Skill '{skill_name}' executed successfully.\n\nOutput:\n{result.output}"
-                        )
-                    ]
-                )
-            else:
-                return CallToolResult(
-                    isError=True,
-                    content=[
-                        TextContent(
-                            type="text",
-                            text=f"Skill '{skill_name}' execution failed.\n\nError:\n{result.error}"
+        # Use UnifiedExecutionService
+        from ..sandbox.execution_service import UnifiedExecutionService
+        from ..sandbox.context import ExecutionContext
+
+        service = UnifiedExecutionService.get_instance()
+
+        # MCP uses async confirmation pattern (return report -> client calls back with confirmed=True)
+        # Create a "callback" that captures the scan result for MCP's async flow
+        scan_result_holder = {"result": None}
+
+        def mcp_confirmation_callback(report: str, scan_id_from_scan: str) -> bool:
+            # If client already confirmed, return True
+            if confirmed:
+                return True
+            # Otherwise, store the result and return False to abort execution
+            # MCP will then return the report to the client
+            scan_result_holder["result"] = {"report": report, "scan_id": scan_id_from_scan}
+            return False
+
+        # Execute using unified service
+        result = service.execute_skill(
+            skill_info=skill,
+            input_data=input_data,
+            confirmation_callback=mcp_confirmation_callback if not confirmed else lambda r, s: True,
+        )
+
+        # Check if we need to return a security report (MCP async confirmation pattern)
+        if scan_result_holder["result"] is not None:
+            report_data = scan_result_holder["result"]
+            return CallToolResult(
+                content=[
+                    TextContent(
+                        type="text",
+                        text=(
+                            f"🔐 Security Review Required for skill '{skill_name}'\n\n"
+                            f"{report_data['report']}\n\n"
+                            f"⚠️ IMPORTANT: You MUST ask the user for confirmation before proceeding.\n"
+                            f"Show this security report to the user and wait for their explicit approval.\n\n"
+                            f"If the user approves, call run_skill again with:\n"
+                            f"  - confirmed: true\n"
+                            f"  - scan_id: \"{report_data['scan_id']}\"\n"
                         )
-                    ]
-                )
-        except Exception as e:
+                    )
+                ]
+            )
+
+        # Return execution result
+        if result.success:
+            return CallToolResult(
+                content=[
+                    TextContent(
+                        type="text",
+                        text=f"Skill '{skill_name}' executed successfully.\n\nOutput:\n{result.output}"
+                    )
+                ]
+            )
+        else:
             return CallToolResult(
                 isError=True,
                 content=[
                     TextContent(
                         type="text",
-                        text=f"Error executing skill '{skill_name}': {str(e)}"
+                        text=f"Skill '{skill_name}' execution failed.\n\nError:\n{result.error}"
                     )
                 ]
             )

skilllite/quick.py

@@ -92,7 +92,8 @@ class SkillRunner:
         allow_network: Optional[bool] = None,
         enable_sandbox: Optional[bool] = None,
         execution_timeout: Optional[int] = None,
-        max_memory_mb: Optional[int] = None
+        max_memory_mb: Optional[int] = None,
+        confirmation_callback: Optional[Callable[[str, str], bool]] = None
     ):
         """
         Initialize SkillRunner.
@@ -122,6 +123,9 @@ class SkillRunner:
             enable_sandbox: Whether to enable sandbox protection (defaults from .env or True)
             execution_timeout: Skill execution timeout in seconds (defaults from .env or 120)
             max_memory_mb: Maximum memory limit in MB (defaults from .env or 512)
+            confirmation_callback: Callback for security confirmation when sandbox_level=3.
+                Signature: (security_report: str, scan_id: str) -> bool
+                If None and sandbox_level=3, will use interactive terminal confirmation.
         """
         # Load .env
         load_env(env_file)
@@ -161,7 +165,11 @@ class SkillRunner:
         
         self.custom_tool_executor = custom_tool_executor
         self.use_enhanced_loop = use_enhanced_loop
-        
+
+        # Security confirmation callback
+        # If None and sandbox_level=3, will use interactive terminal confirmation
+        self.confirmation_callback = confirmation_callback
+
         # Lazy initialization
         self._client = None
         self._manager = None
@@ -282,7 +290,8 @@ Example of CORRECT approach:
                 model=self.model,
                 max_iterations=self.max_iterations,
                 custom_tools=self.custom_tools if self.custom_tools else None,
-                custom_tool_executor=tool_executor
+                custom_tool_executor=tool_executor,
+                confirmation_callback=self.confirmation_callback
             )
         else:
             # Use basic AgenticLoop (backward compatible)
@@ -290,7 +299,8 @@ Example of CORRECT approach:
                 client=self.client,
                 model=self.model,
                 system_prompt=self.system_context,
-                max_iterations=self.max_iterations
+                max_iterations=self.max_iterations,
+                confirmation_callback=self.confirmation_callback
             )
         
         response = loop.run(user_message)