JjLUdZddlmZddlZddlZddlmZddlmZddl m Z m Z m Z m Z ddlmZmZddlmZmZdd lmZmZmZmZdd lmZmZmZdd lmZdd lm Z m!Z!m"Z"d Z#de$d<dZ%de$d<ddZ&Gdde"Z'GddZ(gdZ)y)z7Authorized entry point for invoking execution backends.) annotationsN)Any)ExecutionProvider)!DEFAULT_EXECUTION_TIMEOUT_SECONDSExecutionAuthorizationcurrent_execution_authorizationexecution_payload_digest)ApprovalManagerApprovalStatus)AuditEventTypeAuditLog)DataClassification EgressGate EgressPolicy EgressRequest)EgressPermissionGateLocalClassificationGateRemoteClassificationGate) AgentIdentity)PermissionDecisionPermissionGateway SecurityErrorengagement_profilestrENGAGEMENT_PROFILE_KEYnetwork_allowedNETWORK_ALLOWED_KEYct|dd}t|tsy|jt}t|tsy|jt duS)a*Report whether this identity's engagement profile authorised egress. The grant has to be *explicit*, so the check is a strict identity test against the singleton ``True``: the string ``"true"``, the integer ``1``, a truthy value of any other type, and a missing profile all resolve to ``False``. An identity that carries no engagement profile therefore behaves exactly as it did before the profile existed - the network namespace stays unshared - and no other role changes behaviour by accident. This is the only place the sandbox is allowed to be told that sharing the host's network namespace is authorised, and it says nothing about whether the code itself is trusted; see :class:`~cyberbrain26.execution_plane.bubblewrap_provider.BubblewrapExecutionProvider`. metadataNFT)getattr isinstancedictgetrr)identityrprofiles Q/home/oem/CyberBrain26-unified/src/cyberbrain26/execution_plane/secure_gateway.py!engagement_profile_allows_networkr'+sPxT2H h %ll12G gt $ ;;* +t 33ceZdZdZy)ExecutionRefusedaRaised when a request is refused before any code reached a provider. This type is the structural marker for "refused, nothing ran". Only the three gates standing in front of ``provider.execute`` raise it: identity validation, permission denial, and a missing/denied/expired approval. Every failure at or after the provider call raises a plain ``SecurityError`` (or propagates the provider's own exception), because there the sandbox may already have executed the code and produced side effects. Consumers must tell the two cases apart structurally, by type, never by matching the error message: only a refusal is safe to re-dispatch. N)__name__ __module__ __qualname____doc__r(r&r*r*Cs r(r*ceZdZdZddddd ddZedd ddZ dd Z dd Z dd Z dd  dd Z y)AuthorizedExecutionServiceaEnforce identity, permission, approval, and audit before execution. The underlying execution provider is a sandbox backend, not an authorization boundary. Application and agent code should invoke this service so unauthenticated calls cannot reach the backend. This is the inner of the two gates in front of the provider, and it is not a formality: scope, policy, approval and audit all run again here, on the values this call actually carries. What it no longer does is raise a *second* independent approval request for a decision a human already made. When the dispatcher's chain has already obtained an approval for the same agent, the same canonical action and a byte-identical execution payload, the grant it minted is re-verified here (identity, action, digest, and that the approval record is still ``approved``) and recorded as a reuse instead of a new request. Anything else - no grant, a different action, a changed payload, a different identity, an approval that is no longer approved - leaves this service on its own full gate, and a stale grant is refused outright rather than executed. Ng>@g?)approval_manager audit_logapproval_timeout_secondsapproval_poll_intervalc|dks|dkr td||_||_||_|xs|jxs t |_t |dd}tt|g}t||jd|_ |j|j_|j|jj_||_ ||_ t|_t!|_t%|_y)Nrz3approval timeout and poll interval must be positive provider_nameunknown)local_provider_idsT)policyr3 base_decision) ValueErrorproviderpermission_gatewayr2r3r r r frozensetr egress_gate policy_enginer4r5rremote_classification_gaterlocal_classification_gateregress_permission_gate) selfr=r>r2r3r4r5r7 egress_policys r&__init__z#AuthorizedExecutionService.__init__gs $q (,Ba,GRS S  "4 0"P&8&B&BPhj  /9E $ =/8RS %]dnndhi,0NN):>..--7(@%&<#+C*D')@)B&&:&<#r()timeout_seconds workspacec LKt|ts td|jj }|dvrd}n|dvrd}nt d||j j|||} | jtjk(rC|jtj|||d| jt| j| jtjk(r>|j!|||||||s'|j#||||| jd{t%|} |j&j(r|j&j(nd } d } t+j,|j/d j1} t3|r |j4nd | | t7t8j:h| } |j<j?||jtj|||d|j&j(|  |j&jC||||| d{}|jMddk(xr|jMdd }|jtjF||||rdnd|j&j(|S7#t@$r}td |d}~wwxYw7#tD$r=}|jtjF|||dtI|jJd}~wwxYww)aAuthorize and run a Python or shell task through the sandbox. The approval gate below reuses the dispatcher's grant when - and only when - that grant provably covers this exact call; see :meth:`_grant_covers_this_execution`. z0a valid agent identity is required for execution>pypythonexecute_python>shshell execute_shellz unsupported execution language: deniedNr8zhttp://localhostzutf-8)agent_id provider_idpayload_sha256classifications destinationzegress denied by policystartednetwork)rHrI allow_networkfailed return_coder timed_outF succeeded)'r!rr*striplowerr<r>evaluatedecisionrDENY_auditr TOOL_CALLEDreasonREQUIRE_APPROVAL_grant_covers_this_execution_wait_for_approvalr'r=r7hashlibsha256encode hexdigestrrRr?rPUBLICr@ authorizerexecute Exception TOOL_RESULTtyper+r#)rEr$codelanguagetask_idrHrIlangactionrbrZr7destrTrequesterrresultexc successfuls r&rpz"AuthorizedExecutionService.executes (M2"#UV V~~%%' # #%F _ $$F?zJK K**33HfiP    2 7 7 7 KK**  #8??3 3    2 C C C44&$i'--fi(//:(C 8<}}7R7R 33Xa !  G(<=GGI*2X&& %) &'9'@'@&AB   G    & &w /  & &     MM ' '!   ==00 /#+ 1F$ZZ .!3ZFJJ{TY>^5L5L#L  * *    112$'.':w~~## M O  r(c K|j}|3|jtj|||ddt d|d|j |||d|i|}|jtj |||d|jt|j|j}tjj|z} tjj| kr|j|j} | n| jt j"k(r3|jtj$|||d| j&xsd y| jt j(k7rnWtj*t|j,|d{tjj| kr|j3|j|j} | 8| jt j(k(r|j1|j| | jj4nd } |jtj|||| |jt d | d |d7#tj.$rK|j1|j|jtj|||d |jwxYww)N unavailablez"approval manager is not configuredz!Approval unavailable for action ''rv)contextrfpendingapprovedzapproval granted cancelledmissingrz for action ')r2rdr rr*create_requestAPPROVAL_REQUIRED request_idminr4rHasyncioget_running_looptimerrr rrreviewerPENDINGsleepr5CancelledErrorcancel check_expiredr) rEr$rxresourcervrfrrz wait_secondsdeadlinerrs r&riz-AuthorizedExecutionService._wait_for_approvaljs'' ? KK..4  #%Fvha#PQ Q((   ( )   , ,         488':Q:QR ++-224|C **,113h>!--g.@.@A?>>^%<%<<KK&77 "((>,> >>^%;%;;mmC(C(C\$RSSS!**,113h>: %%g&8&89  7>>^5K5K#K NN7-- .)0)<%%)  * *         6(-xqIJJ5T%%  NN7-- . KK..""    s@C K:BJ"K:#A J-J.)JB?K:JAK77K:rXc |jW||jjd}|||d<|jj||j|j||||yy)N)detailr=rY)actorrRrvrxr|r)r3r=r7recordrR) rE event_typervr$rxr|rrYrs r&rdz!AuthorizedExecutionService._auditst >> %  MM77(H"&-# NN ! !''!**! "  &r()r=rr>rr2zApprovalManager | Noner3zAuditLog | Noner4floatr5rreturnNone)r$rrtrrurrvrrHintrI str | Nonerzdict[str, Any])r$rrxrrtrrurrIrrHrrvrrbool) rrrvrr$rrxrrr) r$rrxrrrrvrrfrrr)rr rvrr$rrxrr|rrrrYz bool | Nonerr) r+r,r-r.rGrrprhrrirdr/r(r&r1r1Rs248%)*.(,=#=.= 1 = # =#(=!&= =P A $ppp p  ppp pdNNN N  N  NNN N`%     @PKPKPK PK  PK  PK PKv $"      r(r1)rrr1r*r')r$rrr)*r. __future__rrrjtypingr/cyberbrain26.extension_layer.execution_providerr#cyberbrain26.security_plane.actionsrrrr $cyberbrain26.security_plane.approvalr r !cyberbrain26.security_plane.auditr r "cyberbrain26.security_plane.egressrrrr,cyberbrain26.security_plane.extension_pointsrrr$cyberbrain26.security_plane.identityr&cyberbrain26.security_plane.permissionrrrr__annotations__rr'r*r1__all__r/r(r&rs="M QF  ?32,S,40 } GGT  r(