tactus 0.20.1__tar.gz → 0.21.0__tar.gz

{tactus-0.20.1 → tactus-0.21.0}/.gitignore

@@ -37,6 +37,7 @@ yarn-error.log*
 .tactus/config.yml
 progress.output
 .tac/
+examples/output/
 
 *storybook.log
 storybook-static

{tactus-0.20.1 → tactus-0.21.0}/CHANGELOG.md

@@ -2,12 +2,26 @@
 
 <!-- version list -->
 
-## v0.20.1 (2026-01-10)
+## v0.21.0 (2026-01-10)
 
 ### Bug Fixes
 
-- Correct Toolset declaration syntax
-  ([`c075c97`](https://github.com/AnthusAI/Tactus/commit/c075c97841c918187d83378224687155a4c2d924))
+- Clarify summarization prompts are logged
+  ([`1fbabee`](https://github.com/AnthusAI/Tactus/commit/1fbabeef3c6634fb9b2927e39a3e575f1074ff7d))
+
+- Clarify template namespaces and rendering
+  ([`b4b61c1`](https://github.com/AnthusAI/Tactus/commit/b4b61c15107a85c83c7646d347fafc3dd98943c3))
+
+- Remove incompatible tests and skip deprecated YAML test
+  ([`5960ed3`](https://github.com/AnthusAI/Tactus/commit/5960ed3580d958101dffca626c0d2cdd773e83be))
+
+- Support message alias for agent calls
+  ([`43c911b`](https://github.com/AnthusAI/Tactus/commit/43c911bd9ad8aa3be6b7f0751f044d25f40cd9fa))
+
+### Chores
+
+- Update .gitignore to include tmp/ directory
+  ([`9871bae`](https://github.com/AnthusAI/Tactus/commit/9871baeaa0d0dd3a14861d1e88b329164f238a2f))
 
 
 ## v0.20.0 (2026-01-09)

{tactus-0.20.1 → tactus-0.21.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tactus
-Version: 0.20.1
+Version: 0.21.0
 Summary: Tactus: Lua-based DSL for agentic workflows
 Project-URL: Homepage, https://github.com/AnthusAI/Tactus
 Project-URL: Documentation, https://github.com/AnthusAI/Tactus/tree/main/docs

{tactus-0.20.1 → tactus-0.21.0}/SPECIFICATION.md

@@ -1883,12 +1883,12 @@ local web_search = Tool.get("web_search")  -- From MCP server
 local result = web_search({query = "weather"})
 ```
 
-### Toolset with type="lua"
+### toolset() with type="lua"
 
 Group multiple related tools into a named toolset:
 
 ```lua
-Toolset "math_tools" {
+toolset("math_tools", {
     type = "lua",
     tools = {
         {
@@ -3260,4 +3260,4 @@ Tests are executed using Behave programmatically with:
 
 **Declarative + Imperative:** Declare HITL points in YAML for documentation, invoke them in Lua for control.
 
-**BDD Testing:** First-class Gherkin specifications with built-in steps, custom steps, parallel execution, and consistency evaluation.
+**BDD Testing:** First-class Gherkin specifications with built-in steps, custom steps, parallel execution, and consistency evaluation.

{tactus-0.20.1 → tactus-0.21.0}/docs/CONFIGURATION.md

@@ -93,6 +93,138 @@ default_model: "gpt-4o-mini"
 
 **Security**: Sidecar files can contain file paths and command execution. Only use trusted sidecar files.
 
+## Sandbox Configuration
+
+Tactus runs procedures in Docker containers by default for security isolation. You can configure sandbox behavior at any configuration level (user, project, or sidecar).
+
+### Basic Sandbox Settings
+
+```yaml
+# ~/.tactus/config.yml or .tactus/config.yml
+sandbox:
+  enabled: true                    # Default: true (if Docker available)
+  image: "tactus-sandbox:local"    # Docker image name (auto-built on first use)
+  timeout: 3600                    # Max execution time in seconds (default: 1 hour)
+  mcp_servers_path: "~/.tactus/mcp-servers"  # Path to MCP servers
+```
+
+**Note**: If Docker is unavailable and `enabled: true`, execution will fail with an error. Use `--no-sandbox` flag or `enabled: false` to explicitly run without isolation.
+
+### Resource Limits
+
+Control memory and CPU usage per container:
+
+```yaml
+sandbox:
+  limits:
+    memory: "2g"     # Per-container memory limit (default: 2GB)
+    cpus: "2"        # Per-container CPU cores (default: 2)
+```
+
+**Error handling**:
+- Out of memory: Container killed with exit code 137
+- Timeout exceeded: Container killed with exit code 124
+
+### Network Configuration
+
+Control network access for procedures:
+
+```yaml
+sandbox:
+  network: "bridge"  # Network mode (default: bridge)
+
+  # Options:
+  # - "bridge": Default Docker bridge (allows outbound connections)
+  # - "none": No network access (most secure, but can't call LLM APIs)
+  # - "host": Use host network (not recommended for security)
+  # - "custom-network": Use a custom Docker network
+```
+
+**Security consideration**: Default `bridge` mode allows outbound connections (needed for LLM API calls), but agents could potentially exfiltrate data. See [Sandboxing Guide: Threat Model](./SANDBOXING.md#threat-model) for details.
+
+### Volume Mounts
+
+Mount host directories into the container:
+
+```yaml
+sandbox:
+  volumes:
+    - "/host/data:/data:ro"           # Read-only mount
+    - "/host/outputs:/outputs:rw"     # Read-write mount
+    - "/shared/config:/config:ro"
+```
+
+**Default mounts** (always included):
+- Workspace: Temporary directory at `/workspace` (ephemeral, destroyed after run)
+- MCP Servers: `~/.tactus/mcp-servers` at `/mcp-servers` (read-only)
+
+### Environment Variables
+
+Pass environment variables to the container:
+
+```yaml
+sandbox:
+  env:
+    CUSTOM_VAR: "value"
+    DEBUG: "true"
+    LOG_LEVEL: "info"
+```
+
+**Automatically passed through** (no configuration needed):
+- `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `GOOGLE_API_KEY`
+- `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_DEFAULT_REGION`, `AWS_SESSION_TOKEN`
+- `AZURE_OPENAI_API_KEY`, `AZURE_OPENAI_ENDPOINT`
+
+### Per-Procedure Sandbox Configuration
+
+Use sidecar files to customize sandbox settings per procedure:
+
+**Example**: `financial_analysis.tac.yml`
+```yaml
+# Procedure-specific sandbox configuration
+sandbox:
+  enabled: true
+
+  limits:
+    memory: "4g"      # More memory for data-heavy processing
+    cpus: "4"         # More CPU cores
+
+  timeout: 1800       # 30 minute timeout
+
+  network: "none"     # No network access for sensitive data
+
+  volumes:
+    - "/data/financial:/data:ro"      # Read-only financial data
+    - "/output/reports:/reports:rw"   # Write reports here
+
+  env:
+    DATA_PATH: "/data"
+    OUTPUT_PATH: "/reports"
+```
+
+**Use cases for per-procedure sandbox configs**:
+- Higher resource limits for data-intensive procedures
+- Network isolation for procedures handling sensitive data
+- Custom volume mounts for specific data sources
+- Procedure-specific environment variables
+
+### Disabling the Sandbox
+
+To run without Docker isolation:
+
+**Via CLI**:
+```bash
+tactus run procedure.tac --no-sandbox
+```
+
+**Via configuration**:
+```yaml
+sandbox:
+  enabled: false
+```
+
+**Security warning**: Running without sandbox removes OS-level isolation. Only disable for trusted procedures or development. See [Sandboxing Guide](./SANDBOXING.md) for security implications.
+
 ### Directory-Level Configuration
 
 You can place `.tactus/config.yml` files in any directory to configure settings for procedures in that directory and subdirectories.
@@ -322,6 +454,7 @@ api_key = config.get("openai_api_key")
 
 ## See Also
 
+- [Sandboxing & Security](SANDBOXING.md) - Security concepts and threat models
 - [Tool Roadmap](TOOL_ROADMAP.md) - Information about tool loading
 - [README](../README.md) - General Tactus documentation
 - [Examples](../examples/) - Example procedures with sidecar configs