virtuai-cli 1.0.7__tar.gz → 1.0.9__tar.gz

{virtuai_cli-1.0.7 → virtuai_cli-1.0.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: virtuai-cli
-Version: 1.0.7
+Version: 1.0.9
 Summary: Run VirtuAI deep agents on your local machine
 Author-email: uCloudStore <lmoreno@ucloudstore.com>
 License: Proprietary

{virtuai_cli-1.0.7 → virtuai_cli-1.0.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "virtuai-cli"
-version = "1.0.7"
+version = "1.0.9"
 description = "Run VirtuAI deep agents on your local machine"
 readme = "README.md"
 requires-python = ">=3.11"

{virtuai_cli-1.0.7 → virtuai_cli-1.0.9}/src/virtuai_cli/__init__.py

@@ -1,2 +1,2 @@
 """VirtuAI local CLI."""
-__version__ = "1.0.7"
+__version__ = "1.0.9"

{virtuai_cli-1.0.7 → virtuai_cli-1.0.9}/src/virtuai_cli/chat/look.py

@@ -190,6 +190,14 @@ T = {
     "guard_on": "🛡 comandos revisados por {model}" if _ES else "🛡 commands checked by {model}",
     "guard_rules_only": "🛡 {why} — se pedirá permiso para lo que no sea lectura" if _ES
                         else "🛡 {why} — anything but reads will be asked",
+    "ran_runner": "💻 {name}",
+    "ran_workstation": "📦 {name}",
+    "ran_browser": "🌐 navegador" if _ES else "🌐 browser",
+    "guard_read_title": "El agente quiere leer fuera de la carpeta" if _ES else "The agent wants to read outside the folder",
+    "guard_read_allow": "Permitir esta vez" if _ES else "Allow this once",
+    "guard_read_deny": "No" if _ES else "No",
+    "guard_read_dir": "Permitir lecturas en {dir} durante esta sesión" if _ES else "Allow reads in {dir} for this session",
+    "guard_you": "tú lo autorizaste" if _ES else "you authorized it",
     "guard_off": "⚠ comandos sin revisar" if _ES else "⚠ commands unchecked",
     "guard_off_note": ("sin clasificador: lo que ejecute el agente es tu responsabilidad (virtuai guard setup)"
                        if _ES else "no classifier: what the agent runs is your responsibility (virtuai guard setup)"),

{virtuai_cli-1.0.7 → virtuai_cli-1.0.9}/src/virtuai_cli/chat/steps.py

@@ -456,14 +456,18 @@ class CommandGuardPrompt(Vertical):
     BINDINGS = [
         Binding("1", "choose(0)", show=False),
         Binding("2", "choose(1)", show=False),
+        Binding("3", "choose(2)", show=False),
     ]
 
-    def __init__(self, command: str, verdict_text: str) -> None:
+    def __init__(self, command: str, verdict_text: str, *, read_dir: Optional[str] = None) -> None:
         super().__init__()
         self.command = command
         self.verdict_text = verdict_text
-        self.border_title = f"⚠ {T['guard_title']}"
-        self.result: "asyncio.Future[bool]" = asyncio.get_event_loop().create_future()
+        #: A read outside the workdir: its folder can be allowed for the session.
+        self.read_dir = read_dir
+        self.border_title = f"⚠ {T['guard_read_title'] if read_dir else T['guard_title']}"
+        #: "allow", "deny" or "dir".
+        self.result: "asyncio.Future[str]" = asyncio.get_event_loop().create_future()
 
     def compose(self):
         from rich.syntax import Syntax
@@ -479,8 +483,13 @@ class CommandGuardPrompt(Vertical):
             t.append(label, style="bold")
             return t
 
-        yield OptionList(Option(row("1", T["guard_allow"]), id="allow"),
-                         Option(row("2", T["guard_deny"]), id="deny"))
+        if self.read_dir:
+            yield OptionList(Option(row("1", T["guard_read_allow"]), id="allow"),
+                             Option(row("2", T["guard_read_deny"]), id="deny"),
+                             Option(row("3", T["guard_read_dir"].format(dir=self.read_dir)), id="dir"))
+        else:
+            yield OptionList(Option(row("1", T["guard_allow"]), id="allow"),
+                             Option(row("2", T["guard_deny"]), id="deny"))
 
     def on_mount(self) -> None:
         ol = self.query_one(OptionList)
@@ -488,17 +497,22 @@ class CommandGuardPrompt(Vertical):
         ol.focus()
 
     def action_choose(self, index: int) -> None:
-        self._answer(index == 0)
+        choices = ["allow", "deny"] + (["dir"] if self.read_dir else [])
+        if index < len(choices):
+            self._answer(choices[index])
 
     def on_option_list_option_selected(self, event: OptionList.OptionSelected) -> None:
         event.stop()
-        self._answer(event.option.id == "allow")
+        self._answer(event.option.id or "deny")
 
-    def _answer(self, allowed: bool, note: str = "") -> None:
+    def _answer(self, choice: str, note: str = "") -> None:
         if self.result.done():
             return
-        self.result.set_result(allowed)
-        self.settle(note or (T["guard_allowed"] if allowed else T["guard_denied"]))
+        self.result.set_result(choice)
+        allowed = choice in ("allow", "dir")
+        if not note:
+            note = T["guard_allowed"] if allowed else (T["guard_read_deny"] if self.read_dir else T["guard_denied"])
+        self.settle(note)
 
     def settle(self, note: str) -> None:
         self.add_class("-answered")
@@ -512,5 +526,5 @@ class CommandGuardPrompt(Vertical):
 
     def expire(self) -> None:
         if not self.result.done():
-            self.result.set_result(False)
+            self.result.set_result("deny")
             self.settle(T["guard_expired"])

{virtuai_cli-1.0.7 → virtuai_cli-1.0.9}/src/virtuai_cli/chat/tui.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import asyncio
 import json
+import os
 import time
 from pathlib import Path
 from typing import Optional
@@ -260,6 +261,7 @@ class ChatApp(App):
         # what you run with ! goes back to the agent.
         self._guard_on = command_guard.enabled()
         self._authorized: dict[str, float] = {}  # command -> when, for the runner
+        self._read_dirs: set = set()             # folders you let it read this session
         self._handoff: Optional[str] = None      # the refused command, if you run it
         self._shell_context: list[str] = []
         self._turn_plan = False  # the turn streaming now asked for plan mode
@@ -1923,14 +1925,22 @@ class ChatApp(App):
         ok, what = await command_guard.available()
         self._set_status(T["guard_on"].format(model=what) if ok else T["guard_rules_only"].format(why=what))
 
-    async def _guard_decide(self, command: str, timeout: float) -> tuple[bool, str]:
-        """(run it?, what the guard thought). Asks you when it is not clearly safe."""
+    async def _guard_decide(self, command: str, timeout: float,
+                            read_path: Optional[str] = None) -> tuple[bool, str, bool]:
+        """(run it?, what the guard thought, were you asked?). Asks you when
+        it is not clearly safe. `read_path`: the agent reading a file outside
+        the workdir — shown as the command that would read it, with the
+        option to allow its folder for the session."""
         verdict = await command_guard.classify(command, str(self.workdir))
         if verdict.safe:
-            return True, verdict.describe()
+            return True, verdict.describe(), False
         from virtuai_cli.chat.steps import CommandGuardPrompt
 
-        prompt = CommandGuardPrompt(command, verdict.describe())
+        read_dir = None
+        if read_path is not None:
+            p = Path(os.path.expanduser(read_path))
+            read_dir = str(p if p.suffix == "" and not p.name.startswith(".") and p.is_dir() else p.parent)
+        prompt = CommandGuardPrompt(command, verdict.describe(), read_dir=read_dir)
         target = self._current_turn if self._current_turn is not None and self._current_turn.is_mounted else None
         if target is not None:
             await target.mount(prompt)
@@ -1941,18 +1951,21 @@ class ChatApp(App):
         if not self._focused:
             devtools.notify(T["guard_title"], command[:120])
         try:
-            allowed = await asyncio.wait_for(asyncio.shield(prompt.result), timeout)
+            choice = await asyncio.wait_for(asyncio.shield(prompt.result), timeout)
         except asyncio.TimeoutError:
             prompt.expire()
-            allowed = False
-        if not allowed:
+            choice = "deny"
+        allowed = choice in ("allow", "dir")
+        if choice == "dir" and read_dir:
+            self._read_dirs.add(str(Path(read_dir).resolve()))
+        if not allowed and read_path is None:
             self._handoff = command
             inp = self.query_one(ChatInput)
             if not inp.text.strip():
                 inp.text = f"!{command}"
                 inp.move_cursor(inp.document.end)
         self.query_one(ChatInput).focus()
-        return allowed, verdict.describe()
+        return allowed, verdict.describe(), True
 
     @staticmethod
     def _refusal(command: str, why: str) -> str:
@@ -1966,13 +1979,63 @@ class ChatApp(App):
             "another way — wait, or continue without it."
         )
 
+    def _mark_card(self, command: str, note: str, asked: bool) -> None:
+        """Show on the command's step what the guard decided. The runner's
+        frame ids are not the tool's, so the step is found by its command."""
+        turn = self._current_turn
+        if turn is None:
+            return
+        from virtuai_cli.chat.widgets import ToolCallCard
+
+        def command_of(card) -> str:
+            text = card.input_str.strip()
+            if text.startswith("{"):
+                try:
+                    import json
+
+                    return str(json.loads(text).get("command") or "").strip()
+                except (ValueError, AttributeError):
+                    pass
+            return text
+
+        for card in reversed(list(turn.query(ToolCallCard))):
+            if not card.guard and command_of(card) == command.strip():
+                card.guard, card.guard_asked = note, asked
+                card._redraw()
+                return
+
+    async def _guard_read(self, path: str, frame: dict) -> Optional[str]:
+        """The agent reading a file or listing a folder: free in the workdir
+        and in folders you allowed; elsewhere you are asked, with what Tev1
+        makes of `cat <path>` (reading ~/.aws is "secrets")."""
+        if command_guard.is_inside(path, str(self.workdir)):
+            return None
+        resolved = Path(os.path.expanduser(path)).resolve()
+        if any(resolved == Path(d) or resolved.is_relative_to(d) for d in self._read_dirs):
+            return None
+        import shlex
+
+        timeout = max(30.0, float(frame.get("timeout_secs") or 300) - 15)
+        allowed, why, _ = await self._guard_decide(f"cat {shlex.quote(path)}", timeout, read_path=path)
+        if allowed:
+            return None
+        # As the read's own script reports an error (one JSON line), so
+        # BaseSandbox's ls/read/glob hand it to the agent as the reason.
+        return json.dumps({"error": (
+            f"not read: it is outside the workdir ({self.workdir}) and the user did not allow it. "
+            "Work inside the workdir, or ask the user for what you need from there.")})
+
     async def _guard_command(self, command: str, frame: dict) -> Optional[str]:
         """The runner's COMMAND_GATE: None runs it, a string goes back instead."""
+        if frame.get("purpose") == "read":
+            return await self._guard_read(str(frame.get("path") or "."), frame)
         when = self._authorized.pop(command, None)
         if when is not None and time.monotonic() - when < 300:
+            self._mark_card(command, T["guard_you"], True)
             return None  # you already said yes to it, through the server's prompt
         timeout = max(30.0, float(frame.get("timeout_secs") or 300) - 15)
-        allowed, why = await self._guard_decide(command, timeout)
+        allowed, why, asked = await self._guard_decide(command, timeout)
+        self._mark_card(command, T["guard_you"] if asked and allowed else why, asked)
         return None if allowed else self._refusal(command, why)
 
     async def _guard_approval(self, event: dict) -> None:
@@ -1986,7 +2049,7 @@ class ChatApp(App):
             allowed = True
         else:
             timeout = max(30.0, float(event.get("timeout_secs") or 300) - 15)
-            allowed, why = await self._guard_decide(command, timeout)
+            allowed, why, _ = await self._guard_decide(command, timeout)
             if allowed:
                 self._authorized[command] = time.monotonic()
         await self._post_approval(request_id, allowed, "" if allowed else self._why_not(why))
@@ -2314,13 +2377,24 @@ class ChatApp(App):
                 await turn.set_todos(step.get("items", []))
         # usage, model_end, cancelled: nothing to show (web chat shows nothing either).
 
+    @staticmethod
+    def _where(loc) -> str:
+        """Where a step ran, as web chat says it — not the raw dict."""
+        if isinstance(loc, dict):
+            kind = loc.get("kind")
+            if kind == "browser":
+                return T["ran_browser"]
+            key = "ran_workstation" if kind == "workstation" else "ran_runner"
+            return T[key].format(name=loc.get("name") or kind or "")
+        return str(loc or "")
+
     @staticmethod
     def _decorate_card(card, event: dict) -> None:
         """What web chat shows on a step besides its name: where it ran, the
         command's language, which knowledge base a search read."""
         if card is None or not hasattr(card, "ran_in"):
             return
-        card.ran_in = event.get("ran_in") or ""
+        card.ran_in = ChatApp._where(event.get("ran_in"))
         card.language = event.get("language") or ("bash" if event.get("display") == "execute" else "")
         if event.get("display") == "kb_search" and event.get("kb_name"):
             card.tool_name = f"📚 {event['kb_name']}"

{virtuai_cli-1.0.7 → virtuai_cli-1.0.9}/src/virtuai_cli/chat/widgets.py

@@ -797,6 +797,9 @@ class ToolCallCard(ExpandableCard):
         self.ran_in: str = ""
         self.elapsed: Optional[float] = None
         self.language: str = ""
+        # What the command guard decided (command_guard.py), when it ran here.
+        self.guard: str = ""
+        self.guard_asked = False
         self.add_class("-running")
         self._redraw()
 
@@ -808,6 +811,8 @@ class ToolCallCard(ExpandableCard):
             head.append(f"  {self.elapsed:.1f}s", style="dim")
         if self.ran_in:
             head.append(f"  · {self.ran_in}", style="dim")
+        if self.guard:
+            head.append(f"  🛡 {self.guard}", style="yellow" if self.guard_asked else "dim green")
 
         cmd = self.input_str.strip()
         cmd_lines = cmd.splitlines() if cmd else []

{virtuai_cli-1.0.7 → virtuai_cli-1.0.9}/src/virtuai_cli/command_guard.py

@@ -69,14 +69,61 @@ class Verdict:
     ms: int = 0
     reason: str = ""
     probabilities: dict = field(default_factory=dict)
+    #: Paths it touches outside the workdir: always the person's call.
+    outside: list = field(default_factory=list)
 
     def describe(self) -> str:
-        if self.source == "rules":
-            return self.reason
-        if self.source == "unavailable":
-            return self.reason
-        p = f", p_safe {self.p_safe:.2f}" if self.p_safe is not None else ""
-        return f"{self.source}: {self.kind}{p}"
+        if self.source in ("rules", "unavailable"):
+            text = self.reason
+        else:
+            p = f", p_safe {self.p_safe:.2f}" if self.p_safe is not None else ""
+            text = f"{self.source}: {self.kind}{p}"
+        if self.outside:
+            text += f" · outside the workdir: {', '.join(self.outside[:3])}"
+        return text
+
+
+# ── Where it reaches ─────────────────────────────────────────────────────────
+
+def is_inside(path: str, workdir: str) -> bool:
+    """Whether `path` (absolute, ~, or relative to the workdir) stays in it."""
+    if not workdir:
+        return True
+    from pathlib import Path
+
+    base = Path(workdir).expanduser().resolve()
+    p = Path(os.path.expanduser(path))
+    p = (p if p.is_absolute() else base / p).resolve()
+    return p == base or p.is_relative_to(base)
+
+
+def outside_paths(command: str, workdir: str) -> list[str]:
+    """The arguments of `command` that name a place outside the workdir.
+
+    Path-like words only — absolute, ~, or climbing with .. — so a pattern
+    like `grep -rn "a/b"` is not taken for one. A `cd` elsewhere counts."""
+    if not workdir:
+        return []
+    out = []
+    for seg in _SEGMENT_SPLIT.split(command or ""):
+        try:
+            words = shlex.split(seg)
+        except ValueError:
+            continue
+        for w in words[1:] if words else []:
+            if w.startswith("-") and "=" in w:
+                w = w.split("=", 1)[1]
+            if w.startswith("$") or "${" in w or "/$" in w:
+                # $HOME, ${X}/y: where it points is not known here — asked.
+                out.append(w)
+                continue
+            if not (w.startswith(("/", "~")) or w == ".." or w.startswith("../") or "/../" in w):
+                continue
+            if w.startswith("/dev/null"):
+                continue
+            if not is_inside(w, workdir):
+                out.append(w)
+    return out
 
 
 # ── Layer 1: rules ───────────────────────────────────────────────────────────
@@ -243,9 +290,22 @@ async def available() -> tuple[bool, str]:
 
 
 async def classify(command: str, workdir: str = "") -> Verdict:
-    """What the guard thinks of `command`. Never raises."""
+    """What the guard thinks of `command`. Never raises.
+
+    A command that reaches outside the workdir is never cleared on its own:
+    Tev1 still says what it does (reading ~/.aws is "secrets"), and the
+    person decides."""
+    outside = outside_paths(command, workdir)
+    verdict = await _classify(command, skip_rules_clear=bool(outside))
+    if outside:
+        verdict.safe = False
+        verdict.outside = outside
+    return verdict
+
+
+async def _classify(command: str, skip_rules_clear: bool = False) -> Verdict:
     found = rules_verdict(command)
-    if found is not None:
+    if found is not None and not (skip_rules_clear and found.safe):
         return found
     model = model_name()
     if model is None:

{virtuai_cli-1.0.7 → virtuai_cli-1.0.9}/src/virtuai_cli/runner.py

@@ -612,7 +612,10 @@ async def _handle_frame(
             dest = exec_.jail_path(str(frame["path"]), wd)
             if dest is not None:
                 exec_.before_write(dest)
-        elif purpose != "read" and exec_.COMMAND_GATE is not None:
+        elif exec_.COMMAND_GATE is not None and (purpose != "read" or frame.get("path")):
+            # A read is asked about only for where it reads (the gate lets
+            # the workdir through); an older server sends no path, and its
+            # reads go through as before.
             try:
                 refusal = await exec_.COMMAND_GATE(command, frame)
             except Exception as exc:  # the guard failing must not run the command

{virtuai_cli-1.0.7 → virtuai_cli-1.0.9}/src/virtuai_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: virtuai-cli
-Version: 1.0.7
+Version: 1.0.9
 Summary: Run VirtuAI deep agents on your local machine
 Author-email: uCloudStore <lmoreno@ucloudstore.com>
 License: Proprietary

{virtuai_cli-1.0.7 → virtuai_cli-1.0.9}/tests/test_command_guard.py

@@ -141,3 +141,54 @@ def test_without_a_gate_the_runner_runs_as_before(tmp_path, monkeypatch):
     asyncio.run(runner._handle_frame({"type": "execute", "id": "1", "command": "echo ok"}, tmp_path, ws,
                                      lambda *a: None))
     assert _results(ws) == [(0, "ok\n")]
+
+
+# ── Outside the workdir ──────────────────────────────────────────────────────
+
+@pytest.mark.parametrize("cmd,outside", [
+    ("cat ~/.ssh/id_rsa", ["~/.ssh/id_rsa"]),
+    ("ls /", ["/"]),
+    ("cd .. && ls", [".."]),
+    ("cat ../other/README.md", ["../other/README.md"]),
+    ("cat src/a.py", []),
+    ('grep -rn "a/b" .', []),
+    ("ls 2>/dev/null", []),
+    ('find "$HOME" -maxdepth 4 -name .git', ["$HOME"]),
+    ("cat ${XDG_CONFIG_HOME}/x", ["${XDG_CONFIG_HOME}/x"]),
+])
+def test_paths_outside_the_workdir_are_found(tmp_path, cmd, outside):
+    assert guard.outside_paths(cmd, str(tmp_path)) == outside
+
+
+def test_a_read_only_command_outside_the_workdir_is_asked(tmp_path, monkeypatch):
+    from virtuai_cli import config
+
+    config.set_key("command_classifier", "off")
+    v = asyncio.run(guard.classify("cat ~/.aws/credentials", str(tmp_path)))
+    assert not v.safe and v.outside == ["~/.aws/credentials"]
+    assert asyncio.run(guard.classify("cat a.txt", str(tmp_path))).safe
+
+
+def test_the_absolute_workdir_is_inside(tmp_path):
+    assert guard.is_inside(str(tmp_path / "src" / "a.py"), str(tmp_path))
+    assert not guard.is_inside("/etc/hosts", str(tmp_path))
+
+
+def test_a_read_with_a_path_goes_to_the_gate_and_one_without_does_not(tmp_path, monkeypatch):
+    seen = []
+
+    async def gate(command, frame):
+        seen.append(frame.get("path"))
+        return None
+
+    monkeypatch.setattr(executor, "COMMAND_GATE", gate)
+    ws = WS()
+
+    async def go():
+        await runner._handle_frame({"type": "execute", "id": "1", "command": "true", "purpose": "read",
+                                    "path": "/etc/hosts"}, tmp_path, ws, lambda *a: None)
+        await runner._handle_frame({"type": "execute", "id": "2", "command": "true", "purpose": "read"},
+                                   tmp_path, ws, lambda *a: None)
+
+    asyncio.run(go())
+    assert seen == ["/etc/hosts"]