steerable-agent-runtime 0.6.61__tar.gz → 0.6.63__tar.gz

{steerable_agent_runtime-0.6.61 → steerable_agent_runtime-0.6.63}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: steerable-agent-runtime
-Version: 0.6.61
+Version: 0.6.63
 Summary: Steerable agent runtime: LLM, tool, storage, and transport adapters.
 License: Apache-2.0
 Requires-Python: >=3.10

{steerable_agent_runtime-0.6.61 → steerable_agent_runtime-0.6.63}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "steerable-agent-runtime"
-version = "0.6.61"
+version = "0.6.63"
 description = "Steerable agent runtime: LLM, tool, storage, and transport adapters."
 license = { text = "Apache-2.0" }
 readme = "README.md"

{steerable_agent_runtime-0.6.61 → steerable_agent_runtime-0.6.63}/src/steerable_agent_runtime/approval.py

@@ -38,6 +38,7 @@ from steerable_agent_harness.policy import ToolMode, decide_tool_mode
 from steerable_agent_protocol.generated import ToolCall, ToolResult
 
 from .errors import ApprovalAborted
+from .sandboxed import DEFAULT_SHELL_TOOLS
 
 if TYPE_CHECKING:
     from .loop import LoopContext, ToolExecutor
@@ -142,9 +143,9 @@ _PATH_ARG_TOOLS = {
 def declared_target_paths(request: ApprovalRequest) -> list[str] | None:
     """Filesystem targets of a path-scoped tool, or None when the call is not one.
 
-    ``None`` means the approver cannot prove the call stays inside the
-    project, so the interactive prompt still runs. Shell commands stay in
-    that bucket: the command text can name paths the cwd does not.
+    ``None`` means this approver cannot prove the call from its path
+    arguments. Shell commands are judged separately, from the sandbox and
+    the working directory, not from the command text.
     """
     if request.tool_name == "present_files":
         files = request.arguments.get("files")
@@ -192,20 +193,54 @@ def path_inside_writable_roots(raw: str, roots: list[str]) -> bool:
     return False
 
 
-class WorkspaceAutoApprover:
-    """Skip the host prompt when every declared path is already inside a writable root.
+def shell_stays_in_workspace(request: ApprovalRequest, roots: list[str]) -> bool:
+    """True when a shell call's working directory is inside a writable root.
+
+    The command text is not parsed. Confinement is the OS sandbox's job:
+    writes outside the roots fail there. An omitted cwd uses the host's
+    project directory. An explicit cwd outside the roots, or one that
+    climbs out with ``..``, still needs a prompt.
+    """
+    if request.tool_name not in DEFAULT_SHELL_TOOLS or not roots:
+        return False
+    cwd = request.arguments.get("cwd")
+    if cwd is None:
+        return True
+    if not isinstance(cwd, str) or not cwd.strip():
+        return True
+    return path_inside_writable_roots(cwd, roots)
 
-    The allow is request-scoped. The next call is judged again, so an
-    in-project ``present_files`` does not grant the same tool outside the
-    project. Calls with no path we can check, or any path outside the roots,
-    fall through to the inner approver.
+
+class WorkspaceAutoApprover:
+    """Skip the host prompt for work the workspace sandbox already confines.
+
+    Embedders may also name host-owned control tools whose effects are limited
+    to internal session state and therefore need no interactive consent.
+    Path-scoped tools (``local_write_file``, ``local_edit_file``, reads,
+    ``present_files``) skip when every declared path is inside a writable
+    root. Shell tools skip only when the OS exec sandbox is on and the
+    working directory is inside those roots — the same split Codex uses
+    between ``workspace-write`` and ``on-request``. The allow is
+    request-scoped. The next call is judged again. Anything else falls
+    through to the inner approver.
     """
 
-    def __init__(self, inner: Approver, writable_roots: list[str]) -> None:
+    def __init__(
+        self,
+        inner: Approver,
+        writable_roots: list[str],
+        *,
+        sandbox_enforced: bool = False,
+        auto_allow_tools: tuple[str, ...] = (),
+    ) -> None:
         self._inner = inner
         self._roots = [root for root in writable_roots if isinstance(root, str) and root.strip()]
+        self._sandbox_enforced = sandbox_enforced
+        self._auto_allow_tools = frozenset(auto_allow_tools)
 
     async def approve(self, request: ApprovalRequest) -> ApprovalDecision:
+        if request.tool_name in self._auto_allow_tools:
+            return ApprovalDecision("allow_once", "trusted host control tool")
         paths = declared_target_paths(request)
         if (
             self._roots
@@ -213,6 +248,8 @@ class WorkspaceAutoApprover:
             and all(path_inside_writable_roots(path, self._roots) for path in paths)
         ):
             return ApprovalDecision("allow_once", "path is inside a writable project root")
+        if self._sandbox_enforced and shell_stays_in_workspace(request, self._roots):
+            return ApprovalDecision("allow_once", "command stays inside the workspace sandbox")
         return await self._inner.approve(request)
 
 

{steerable_agent_runtime-0.6.61 → steerable_agent_runtime-0.6.63}/src/steerable_agent_runtime/history.py

@@ -1,7 +1,6 @@
 """Typed append-only history — the model-visible record and its projection.
 
-Wave 1 foundation (docs/roadmap.md "Wave 1 — the foundation"): the
-model-visible transcript becomes a *projection* of a typed, append-only
+The model-visible transcript is a *projection* of a typed, append-only
 record instead of a mutable ``list[LLMMessage]`` that hooks rewrite in
 place.
 

{steerable_agent_runtime-0.6.61 → steerable_agent_runtime-0.6.63}/src/steerable_agent_runtime/llm/parts.py

@@ -1,6 +1,6 @@
 """Content parts — the structured form of ``LLMMessage.content``.
 
-Wave 1 (docs/roadmap.md "Wave 1 — the foundation"): message content is a
+Message content is a
 list of typed parts instead of a bare string, unblocking multimodal input,
 structured output, and (Wave 2) per-block cache annotations.
 

{steerable_agent_runtime-0.6.61 → steerable_agent_runtime-0.6.63}/src/steerable_agent_runtime/mcp.py

@@ -19,7 +19,7 @@ caps.
   finds them through the ``tool_search`` seam instead of paying for every
   schema in every request. Hosts pin favorites with ``exposure="direct"``.
 
-Architecture (recorded in docs/roadmap.md): in the desktop product, MCP
+In the desktop product, MCP
 servers are launched host-side (Electron main) and reached through
 `ToolRouter.register_remote` — a Seatbelt-confined sidecar never spawns
 them. `McpStdioClient` and `McpStreamableHttpClient` exist for hosts that

{steerable_agent_runtime-0.6.61 → steerable_agent_runtime-0.6.63}/src/steerable_agent_runtime/recording.py

@@ -1,10 +1,9 @@
 """RecordingProvider — capture every outbound LLM request, plus the
 prompt-invariant assertions built on the recording.
 
-Wave 0 tripwire (docs/roadmap.md "Wave 0 — prerequisites"): Wave 1 rewrites
-history into typed append-only envelopes, and without a recording of what the
-model actually saw, a correct rewrite can silently regress. This module closes
-that gap:
+Wave 1 rewrites history into typed append-only envelopes. Without a
+recording of what the model actually saw, a correct rewrite can silently
+regress. This module closes that gap:
 
 - ``RecordingProvider`` wraps any ``LLMProvider`` and snapshots every outbound
   request (messages + params) into a sink *before* delegating, so a failed

{steerable_agent_runtime-0.6.61 → steerable_agent_runtime-0.6.63}/src/steerable_agent_runtime/tool_search.py

@@ -26,8 +26,8 @@ from .tools import RegisteredTool, ToolRouter
 
 TOOL_SEARCH_NAME = "tool_search"
 
-#: Default matches per call. 8 matches codex's tool_discovery cap
-#: (docs/roadmap.md's tier comparison); the per-call ceiling below bounds
+#: Default matches per call. 8 matches codex's tool_discovery cap.
+#: The per-call ceiling below bounds
 #: the schema payload regardless of what a call requests.
 DEFAULT_MAX_RESULTS = 8
 #: Hard ceiling per call: every match carries a full schema, so an

{steerable_agent_runtime-0.6.61 → steerable_agent_runtime-0.6.63}/src/steerable_agent_runtime.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: steerable-agent-runtime
-Version: 0.6.61
+Version: 0.6.63
 Summary: Steerable agent runtime: LLM, tool, storage, and transport adapters.
 License: Apache-2.0
 Requires-Python: >=3.10

{steerable_agent_runtime-0.6.61 → steerable_agent_runtime-0.6.63}/tests/test_approval.py

@@ -512,6 +512,25 @@ async def test_workspace_auto_approver_allows_paths_inside_writable_roots(tmp_pa
     assert inner.requests == []
 
 
+@pytest.mark.asyncio
+async def test_workspace_auto_approver_allows_named_host_control_tools() -> None:
+    from steerable_agent_runtime.approval import WorkspaceAutoApprover
+
+    inner = _ScriptedApprover([ApprovalDecision("deny_once", "should not ask")])
+    approver = WorkspaceAutoApprover(
+        inner,
+        [],
+        auto_allow_tools=("update_goal", "loop_stop"),
+    )
+
+    goal = await approver.approve(_request("update_goal", {"action": "complete"}))
+    loop = await approver.approve(_request("loop_stop", {"id": "loop-1"}))
+
+    assert goal.kind == "allow_once"
+    assert loop.kind == "allow_once"
+    assert inner.requests == []
+
+
 @pytest.mark.asyncio
 async def test_workspace_auto_approver_asks_when_a_path_leaves_the_project(tmp_path) -> None:
     from steerable_agent_runtime.approval import WorkspaceAutoApprover
@@ -569,3 +588,56 @@ async def test_workspace_auto_approver_does_not_cache_the_tool_name(tmp_path) ->
     assert inside.kind == "allow_once"
     assert outside.kind == "deny_once"
     assert len(inner.requests) == 1
+
+
+@pytest.mark.asyncio
+async def test_workspace_auto_approver_allows_sandboxed_shell_inside_writable_roots(tmp_path) -> None:
+    from steerable_agent_runtime.approval import WorkspaceAutoApprover
+
+    project = tmp_path / "111-2"
+    project.mkdir()
+    source = tmp_path / "sources"
+    source.mkdir()
+    inner = _ScriptedApprover([ApprovalDecision("deny_once", "should not ask")])
+    approver = WorkspaceAutoApprover(inner, [str(project), str(source)], sandbox_enforced=True)
+
+    omitted = await approver.approve(_request("local_exec_shell", {"command": "mkdir notes"}))
+    nested = await approver.approve(
+        _request("local_exec_shell", {"command": "touch a.md", "cwd": str(project / "notes")})
+    )
+    linked = await approver.approve(
+        _request("bash", {"command": "ls", "cwd": str(source / "raw")})
+    )
+    relative = await approver.approve(
+        _request("shell", {"command": "pwd", "cwd": "subdir"})
+    )
+
+    assert omitted.kind == "allow_once"
+    assert nested.kind == "allow_once"
+    assert linked.kind == "allow_once"
+    assert relative.kind == "allow_once"
+    assert inner.requests == []
+
+
+@pytest.mark.asyncio
+async def test_workspace_auto_approver_asks_for_shell_that_leaves_the_sandbox(tmp_path) -> None:
+    from steerable_agent_runtime.approval import WorkspaceAutoApprover
+
+    project = tmp_path / "111-2"
+    project.mkdir()
+    inner = _ScriptedApprover([ApprovalDecision("allow_once", "user allowed")] * 3)
+    confined = WorkspaceAutoApprover(inner, [str(project)], sandbox_enforced=True)
+    open_sandbox = WorkspaceAutoApprover(inner, [str(project)], sandbox_enforced=False)
+
+    outside = await confined.approve(
+        _request("local_exec_shell", {"command": "ls", "cwd": str(tmp_path / "other")})
+    )
+    climbed = await confined.approve(
+        _request("local_exec_shell", {"command": "ls", "cwd": "../outside"})
+    )
+    unsandboxed = await open_sandbox.approve(
+        _request("local_exec_shell", {"command": "ls", "cwd": str(project)})
+    )
+
+    assert [item.kind for item in (outside, climbed, unsandboxed)] == ["allow_once"] * 3
+    assert [item.tool_name for item in inner.requests] == ["local_exec_shell"] * 3