steerable-agent-runtime 0.6.68__tar.gz → 0.6.69__tar.gz

{steerable_agent_runtime-0.6.68 → steerable_agent_runtime-0.6.69}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: steerable-agent-runtime
-Version: 0.6.68
+Version: 0.6.69
 Summary: Steerable agent runtime: LLM, tool, storage, and transport adapters.
 License: Apache-2.0
 Requires-Python: >=3.10

{steerable_agent_runtime-0.6.68 → steerable_agent_runtime-0.6.69}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "steerable-agent-runtime"
-version = "0.6.68"
+version = "0.6.69"
 description = "Steerable agent runtime: LLM, tool, storage, and transport adapters."
 license = { text = "Apache-2.0" }
 readme = "README.md"

{steerable_agent_runtime-0.6.68 → steerable_agent_runtime-0.6.69}/src/steerable_agent_runtime/approval.py

@@ -238,6 +238,15 @@ class WorkspaceAutoApprover:
         self._sandbox_enforced = sandbox_enforced
         self._auto_allow_tools = frozenset(auto_allow_tools)
 
+    def set_sandbox_enforced(self, enforced: bool) -> None:
+        """Match a mid-turn sandbox toggle.
+
+        Shell auto-approval is only valid while the OS sandbox is actually
+        confining the command. Full access turns that off, so the next shell
+        call has to ask again.
+        """
+        self._sandbox_enforced = enforced
+
     async def approve(self, request: ApprovalRequest) -> ApprovalDecision:
         if request.tool_name in self._auto_allow_tools:
             return ApprovalDecision("allow_once", "trusted host control tool")

{steerable_agent_runtime-0.6.68 → steerable_agent_runtime-0.6.69}/src/steerable_agent_runtime/sandboxed.py

@@ -100,6 +100,7 @@ class SandboxedToolExecutor:
         command_arg: str = "command",
         require_full: bool = False,
         require_backend: bool = False,
+        active: bool = True,
     ) -> None:
         self._inner = inner
         self._backend = backend
@@ -107,12 +108,24 @@ class SandboxedToolExecutor:
         self._command_arg = command_arg
         self._require_full = require_full
         self._require_backend = require_backend
+        self._active = active
+
+    def set_active(self, active: bool) -> None:
+        """Turn command rewriting on or off for later calls in this turn.
+
+        A mid-turn steer can switch the composer sandbox between workspace
+        and full access. Calls already in flight keep the policy they started
+        with; the next ``execute`` reads this flag.
+        """
+        self._active = active
 
     def concurrency_safe(self, call: ToolCall) -> bool:
         check = getattr(self._inner, "concurrency_safe", None)
         return bool(check is not None and check(call))
 
     async def execute(self, call: ToolCall, ctx: LoopContext) -> ToolResult:
+        if not self._active:
+            return await self._inner.execute(call, ctx)
         if call.name not in self._shell_tools:
             return await self._inner.execute(call, ctx)
         arguments = call.arguments or {}

{steerable_agent_runtime-0.6.68 → steerable_agent_runtime-0.6.69}/src/steerable_agent_runtime.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: steerable-agent-runtime
-Version: 0.6.68
+Version: 0.6.69
 Summary: Steerable agent runtime: LLM, tool, storage, and transport adapters.
 License: Apache-2.0
 Requires-Python: >=3.10

{steerable_agent_runtime-0.6.68 → steerable_agent_runtime-0.6.69}/tests/test_sandboxed.py

@@ -186,3 +186,22 @@ async def test_non_command_shaped_call_passes_through() -> None:
     await executor.execute(_call("bash"), LoopContext())
     assert backend.wrapped == []
     assert len(inner.calls) == 2
+
+
+@pytest.mark.asyncio
+async def test_set_active_false_runs_the_raw_command() -> None:
+    inner = _RecordingExecutor()
+    backend = _FakeBackend()
+    executor = SandboxedToolExecutor(inner, backend)
+    executor.set_active(False)
+
+    result = await executor.execute(_call("bash", command="echo hi"), LoopContext())
+
+    assert result.success
+    assert inner.calls[0].arguments["command"] == "echo hi"
+    assert backend.wrapped == []
+    assert "_sandbox" not in (result.data or {})
+
+    executor.set_active(True)
+    await executor.execute(_call("bash", command="echo ho"), LoopContext())
+    assert backend.wrapped == ["echo ho"]