velune-cli 1.0.0__py3-none-any.whl

velune/tools/git/state.py

@@ -0,0 +1,134 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+from velune.tools.base.tool import BaseTool
+
+
+class GitStatus(BaseTool):
+    """Tool for viewing git status."""
+
+    def get_name(self) -> str:
+        return "git_status"
+
+    def get_description(self) -> str:
+        return "View git repository status"
+
+    async def execute(self, directory: str = ".") -> dict:
+        """Get git status."""
+        import subprocess
+
+        root_path = Path(directory)
+        if not (root_path / ".git").exists():
+            raise ValueError("Not a git repository")
+
+        import asyncio
+        import functools
+        result = await asyncio.to_thread(
+            functools.partial(
+                subprocess.run,
+                ["git", "status", "--porcelain"],
+                cwd=root_path,
+                capture_output=True,
+                text=True,
+            )
+        )
+
+        status = {
+            "modified": [],
+            "added": [],
+            "deleted": [],
+            "untracked": [],
+        }
+
+        for line in result.stdout.strip().split("\n"):
+            if line:
+                status_code = line[:2]
+                file_path = line[3:]
+
+                if status_code[0] == "M":
+                    status["modified"].append(file_path)
+                elif status_code[0] == "A":
+                    status["added"].append(file_path)
+                elif status_code[0] == "D":
+                    status["deleted"].append(file_path)
+                elif status_code[0] == "?":
+                    status["untracked"].append(file_path)
+
+        return status
+
+    def get_schema(self) -> dict:
+        return {
+            "type": "object",
+            "properties": {
+                "directory": {
+                    "type": "string",
+                    "description": "Git repository directory",
+                },
+            },
+        }
+
+
+class GitBranch(BaseTool):
+    """Tool for viewing git branches."""
+
+    def get_name(self) -> str:
+        return "git_branch"
+
+    def get_description(self) -> str:
+        return "View git branches"
+
+    async def execute(self, directory: str = ".") -> dict:
+        """Get git branches."""
+        import subprocess
+
+        root_path = Path(directory)
+        if not (root_path / ".git").exists():
+            raise ValueError("Not a git repository")
+
+        # Get current branch
+        import asyncio
+        import functools
+        current_result = await asyncio.to_thread(
+            functools.partial(
+                subprocess.run,
+                ["git", "branch", "--show-current"],
+                cwd=root_path,
+                capture_output=True,
+                text=True,
+            )
+        )
+        current_branch = current_result.stdout.strip()
+
+        # Get all branches
+        all_result = await asyncio.to_thread(
+            functools.partial(
+                subprocess.run,
+                ["git", "branch", "-a"],
+                cwd=root_path,
+                capture_output=True,
+                text=True,
+            )
+        )
+
+        branches = []
+        for line in all_result.stdout.split("\n"):
+            if line:
+                branch_name = line.strip().replace("* ", "")
+                branches.append(branch_name)
+
+        return {
+            "current": current_branch,
+            "all": branches,
+        }
+
+    def get_schema(self) -> dict:
+        return {
+            "type": "object",
+            "properties": {
+                "directory": {
+                    "type": "string",
+                    "description": "Git repository directory",
+                },
+            },
+        }

velune/tools/module.py

@@ -0,0 +1,65 @@
+from velune.kernel.bootstrap import RuntimeEnvironment, SubsystemModule
+
+
+def _create_tool_registry(env: RuntimeEnvironment):
+    import logging
+
+    from velune.tools import (
+        CreateFile,
+        DeleteFile,
+        ExecuteCommand,
+        FindFiles,
+        FindReferences,
+        GitBlame,
+        GitBranch,
+        GitCheckout,
+        GitCommit,
+        GitDiff,
+        GitLog,
+        GitStatus,
+        GoToDefinition,
+        GrepFiles,
+        ReadDirectory,
+        ReadFile,
+        SemanticCodeSearch,
+        SymbolSearch,
+        TerminalHistory,
+        WebFetch,
+        WriteFile,
+    )
+    from velune.tools.base.registry import ToolRegistry
+
+    logger = logging.getLogger("velune.tools.module")
+
+    execution_executor = env.container.get("runtime.execution_executor")
+
+    tool_registry = ToolRegistry()
+    execute_cmd_tool = ExecuteCommand(
+        sandbox=execution_executor.sandbox,
+        workspace_path=str(env.workspace)
+    )
+    default_tools = [
+        ReadFile(workspace=env.workspace), ReadDirectory(workspace=env.workspace),
+        WriteFile(workspace=env.workspace), CreateFile(workspace=env.workspace),
+        DeleteFile(workspace=env.workspace),
+        GrepFiles(), FindFiles(), GitLog(), GitDiff(), GitBlame(), GitStatus(), GitBranch(),
+        GitCommit(), GitCheckout(), execute_cmd_tool, TerminalHistory(),
+        SemanticCodeSearch(), SymbolSearch(), GoToDefinition(), FindReferences(), WebFetch()
+    ]
+    for tool in default_tools:
+        tool_registry.register(tool)
+
+    broken = tool_registry.list_broken_tools()
+    if broken:
+        logger.warning("Tools failed validation: %s", broken)
+
+    return tool_registry
+
+TOOL_MODULES = [
+    SubsystemModule(
+        name="tool_registry",
+        factory=_create_tool_registry,
+        container_key="runtime.tool_registry",
+        dependencies=["runtime.execution_executor"],
+    )
+]

velune/tools/terminal/execute.py

@@ -0,0 +1,72 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from velune.execution.sandbox import SubprocessSandbox
+
+from velune.tools.base.tool import BaseTool
+
+
+class ExecuteCommand(BaseTool):
+    """Tool for executing terminal commands."""
+
+    def __init__(self, sandbox: SubprocessSandbox | None = None, workspace_path: str | None = None):
+        self._sandbox = sandbox
+        self._workspace_path = workspace_path
+
+    def get_name(self) -> str:
+        return "execute_command"
+
+    def get_description(self) -> str:
+        return "Execute a terminal command"
+
+    async def execute(
+        self,
+        command: str,
+        directory: str | None = None,
+        timeout: int = 30,
+    ) -> dict:
+        """Execute a command."""
+        from pathlib import Path
+
+        from velune.core.errors.execution import SandboxError
+        from velune.execution.command_spec import CommandSpec
+        from velune.execution.sandbox import SubprocessSandbox
+
+        workspace = Path(directory or self._workspace_path or Path.cwd())
+        sandbox = self._sandbox or SubprocessSandbox(workspace)
+
+        try:
+            spec = CommandSpec.from_string(command, cwd=workspace, timeout=float(timeout))
+        except SandboxError as e:
+            sandbox.emit_rejection(command, str(e))
+            raise e
+
+        result = sandbox.execute(spec)
+        return {
+            "exit_code": result.exit_code,
+            "stdout": result.stdout,
+            "stderr": result.stderr,
+            "duration_ms": result.duration_ms,
+        }
+
+    def get_schema(self) -> dict:
+        return {
+            "type": "object",
+            "properties": {
+                "command": {
+                    "type": "string",
+                    "description": "Command to execute",
+                },
+                "directory": {
+                    "type": "string",
+                    "description": "Working directory",
+                },
+                "timeout": {
+                    "type": "integer",
+                    "description": "Command timeout in seconds",
+                },
+            },
+            "required": ["command"],
+        }

velune/tools/terminal/history.py

@@ -0,0 +1,47 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+from velune.tools.base.tool import BaseTool
+
+
+class TerminalHistory(BaseTool):
+    """Tool for viewing terminal history."""
+
+    def get_name(self) -> str:
+        return "terminal_history"
+
+    def get_description(self) -> str:
+        return "View terminal command history"
+
+    async def execute(
+        self,
+        limit: int = 50,
+    ) -> list[str]:
+        """Get terminal history."""
+        history_file = Path.home() / ".bash_history"
+
+        if not history_file.exists():
+            history_file = Path.home() / ".zsh_history"
+
+        if not history_file.exists():
+            return []
+
+        with open(history_file, encoding="utf-8", errors="ignore") as f:
+            lines = f.readlines()
+
+        # Get last N lines
+        history = [line.strip() for line in lines[-limit:]]
+
+        return history
+
+    def get_schema(self) -> dict:
+        return {
+            "type": "object",
+            "properties": {
+                "limit": {
+                    "type": "integer",
+                    "description": "Number of history entries to return",
+                },
+            },
+        }

velune/tools/web/fetch.py

@@ -0,0 +1,55 @@
+"""Web fetch tools."""
+
+from velune.tools.base.tool import BaseTool
+from velune.tools.web.validator import validate_url
+
+
+class WebFetch(BaseTool):
+    """Tool for fetching web content."""
+
+    def get_name(self) -> str:
+        return "web_fetch"
+
+    def get_description(self) -> str:
+        return "Fetch content from a URL"
+
+    async def execute(
+        self,
+        url: str,
+        timeout: int = 10,
+    ) -> str:
+        """Fetch content from URL."""
+        import httpx
+
+        is_valid, error = validate_url(url)
+        if not is_valid:
+            raise ValueError(f"URL validation failed: {error}")
+
+        async with httpx.AsyncClient(
+            timeout=timeout,
+            follow_redirects=True,
+            max_redirects=3,  # Prevent redirect chains to internal services
+        ) as client:
+            response = await client.get(url)
+            response.raise_for_status()
+            # Limit response size to prevent memory exhaustion
+            content = response.text
+            if len(content) > 500_000:  # 500KB limit
+                content = content[:500_000] + "\n... [TRUNCATED: response exceeded 500KB]"
+            return content
+
+    def get_schema(self) -> dict:
+        return {
+            "type": "object",
+            "properties": {
+                "url": {
+                    "type": "string",
+                    "description": "Fetch content from a URL. HTTPS only. Private/internal IPs blocked.",
+                },
+                "timeout": {
+                    "type": "integer",
+                    "description": "Request timeout in seconds",
+                },
+            },
+            "required": ["url"],
+        }

velune/tools/web/validator.py

@@ -0,0 +1,96 @@
+import ipaddress
+import socket
+from urllib.parse import urlparse
+
+BLOCKED_HOSTS = frozenset({
+    "169.254.169.254",   # AWS IMDS v1
+    "169.254.170.2",     # AWS ECS metadata
+    "metadata.google.internal",
+    "metadata.goog",
+    "169.254.0.0",       # link-local broadcast
+})
+
+BLOCKED_PREFIXES = (
+    "169.254.",          # link-local range (catch-all)
+)
+
+def _is_private_ip(address: str) -> tuple[bool, str]:
+    """Returns (is_blocked, reason). Resolves hostnames."""
+    try:
+        ip = ipaddress.ip_address(address)
+    except ValueError:
+        # It's a hostname — resolve it
+        try:
+            socket.setdefaulttimeout(3)
+            resolved = socket.getaddrinfo(address, None, proto=socket.IPPROTO_TCP)
+            for family, _, _, _, sockaddr in resolved:
+                ip_str = sockaddr[0]
+                blocked, reason = _is_private_ip(ip_str)
+                if blocked:
+                    return True, f"hostname {address!r} resolves to blocked IP {ip_str}: {reason}"
+        except socket.gaierror:
+            return False, ""  # Can't resolve — let the request fail naturally
+        return False, ""
+
+    if ip.is_loopback:
+        return True, "loopback address"
+    if ip.is_private:
+        return True, "private network range"
+    if ip.is_link_local:
+        return True, "link-local address (fe80::/10 or 169.254.x.x)"
+    if ip.is_reserved:
+        return True, "reserved address"
+    if ip.is_multicast:
+        return True, "multicast address"
+    # Explicitly check for 0.0.0.0/8
+    if isinstance(ip, ipaddress.IPv4Address) and ip in ipaddress.ip_network("0.0.0.0/8"):
+        return True, "unspecified address range"
+    return False, ""
+
+def validate_url(url: str, allow_http: bool = False) -> tuple[bool, str | None]:
+    """
+    Validate URL for SSRF safety.
+    Returns (is_valid, error_message).
+    """
+    try:
+        parsed = urlparse(url)
+    except Exception:
+        return False, "Unparseable URL"
+
+    # Reject credentials in URL
+    if parsed.username or parsed.password:
+        return False, "URLs with embedded credentials are not allowed"
+
+    if parsed.scheme not in ("https", "http"):
+        return False, f"Scheme '{parsed.scheme}' not allowed"
+    if parsed.scheme == "http" and not allow_http:
+        return False, "HTTP not allowed — use HTTPS"
+
+    hostname = parsed.hostname
+    if not hostname:
+        return False, "No hostname"
+    hostname = hostname.lower().strip(".")
+
+    if hostname in BLOCKED_HOSTS:
+        return False, f"Host '{hostname}' is explicitly blocked"
+    for prefix in BLOCKED_PREFIXES:
+        if hostname.startswith(prefix):
+            return False, f"Host '{hostname}' matches blocked prefix"
+
+    # Reject numeric escape forms (0x7f000001, 0177.0.0.1, decimal integer, etc.)
+    # We use socket.inet_aton which handles hex, octal, decimal, integer, and multi-dot notations
+    # exactly the way the OS/socket libraries parse numeric IPv4 addresses.
+    try:
+        packed = socket.inet_aton(hostname)
+        ip_str = socket.inet_ntoa(packed)
+        blocked, reason = _is_private_ip(ip_str)
+        if blocked:
+            return False, f"Numeric IP {hostname} resolves to blocked: {reason}"
+    except OSError:
+        pass
+
+    blocked, reason = _is_private_ip(hostname)
+    if blocked:
+        return False, reason
+
+    return True, None