Jj.nUdZddlmZddlZddlZddlmZddlmZddl m Z gdZ eje ZdZd ed <d Zd ed <d Zd ed<dZd ed<dZd ed<dZded<dZd ed<d&dZd'd(dZd'd)dZ d'dd d*dZefd+dZddddd d,d Zd'd)d!Zd'd)d"Zd'd-d#Zdd$d.d%Z y)/aResolution and opening of the local (on-disk) store locations. This module only resolves filesystem locations and opens the local SQLite store. It never grants permissions, never changes the policy mode, and never disables the sandbox. Authorization, policy decisions, and sandbox enforcement remain the responsibility of the security plane. Precedence for the data directory is: explicit argument, then the ``CYBERBRAIN_DATA_DIR`` environment variable, then the platform-specific user data directory. Precedence for the database file is: explicit argument, then ``CYBERBRAIN_DB_PATH``, then ``/cyberbrain.sqlite3``. The workspaces directory (``/workspaces``) is the *sanctioned root* for host directories that the execution sandbox may bind read-write. :func:`resolve_workspace` is the single containment check against that root: a workspace outside it is refused, because a read-write bind mount of an arbitrary host directory would hand sandboxed code the whole host regardless of how well the rest of the sandbox is hardened. Retention configuration is fail-closed: a malformed ``CYBERBRAIN_RETENTION_DAYS`` value raises :class:`ValueError` instead of silently falling back to the default. ) annotationsN)Path) user_data_dir)SQLiteDatabase)DEFAULT_DB_FILENAMEDEFAULT_RETENTION_DAYS ENV_DATA_DIR ENV_DB_PATHENV_RETENTION_DAYSENV_WORKSPACES_ROOTensure_data_dirensure_workspaces_root open_databaseresolve_data_dirresolve_db_pathresolve_workspaceretention_days_from_envworkspaces_rootCYBERBRAIN_DATA_DIRstrr CYBERBRAIN_DB_PATHr CYBERBRAIN_RETENTION_DAYSr CYBERBRAIN_WORKSPACES_ROOTr zcyberbrain.sqlite3rZintr workspaces_WORKSPACES_DIRNAMEc ttjjtjj t |S)zHExpand ``~`` and environment references without touching the filesystem.)rospath expandvars expanduserr)r s F/home/oem/CyberBrain26-unified/src/cyberbrain26/product/local_store.py_expandr$@s/ ""277#5#5c$i#@A BBc4|t|jStjj t }|7|j r't|j jSttdjS)aResolve the base data directory. Precedence: ``explicit`` argument, then the ``CYBERBRAIN_DATA_DIR`` environment variable, then :func:`platformdirs.user_data_dir`. The returned path is absolute and expanded, but the directory is **not** created as a side effect of this call; creation happens in :func:`ensure_data_dir` or :func:`open_database`. Args: explicit: Optional explicit directory overriding all other sources. Returns: The resolved, absolute data directory path. It need not exist. CyberBrain26)r$resolverenvirongetr stripr)explicit env_values r#rrEssx ((** |,I!2y()1133 =0 1 9 9 ;;r%ct|}|j}|jddd|s |jd|S|S#t$rY|SwxYw)aResolve the data directory and create it with owner-only permissions. Args: data_dir: Optional explicit directory; see :func:`resolve_data_dir`. Returns: The resolved data directory, created with mode ``0o700`` where the platform supports it. Tparentsexist_okmode)rexistsmkdirchmodOSError)data_dirresolvedexisteds r#r r \sd )HooG NN4$UN;   NN5 ! O8O   O sA AAr8c|Lt|dk(st|jdr tdt|j St j jt}|Z|jrJ|j}|dk(s|jdr tdt|j St|tz j S)aUResolve the SQLite database file path. Precedence: ``explicit`` argument, then the ``CYBERBRAIN_DB_PATH`` environment variable, then ``/cyberbrain.sqlite3``. A non-``None`` ``data_dir`` argument takes precedence over the ``CYBERBRAIN_DATA_DIR`` environment variable but never overrides an explicit ``explicit`` path. Args: explicit: Optional explicit database file path with highest precedence. data_dir: Optional data directory used to derive the default filename. Returns: The resolved, absolute database path. It need not exist. z:memory:zfile:z.SQLiteDatabase requires a persistent file path) r startswith ValueErrorr$r(rr)r*r r+rr)r,r8r- candidates r#rrqs& x=J &#h-*B*B7*KMN Nx ((** {+I!2OO%   "i&:&:7&CMN Ny!))++ X &)< < E E GGr%c*tjjt}||j s|S|j } t |}|dkrt td||S#t $r}t td||d}~wwxYw)aRead the retention window from the environment, fail-closed. Unset or empty values yield ``default``. Any present value that is not a positive integer raises :class:`ValueError`; a malformed value never falls back to the default silently. Args: default: Value returned when the environment variable is unset or empty. Returns: The configured retention window in days. Raises: ValueError: If the variable is set to a non-integer or non-positive value. Nz! must be a positive integer, got rz must be positive, got )rr)r*r r+rr>)defaultrawtextvalueexcs r#rrs" **..+ ,C {#))+ 99;DD   z.//FsgNOO L !""CC7 K  s A// B8B  BT)db_pathr8persistretention_daysc|syt||}|jjddd| tn|}t ||S)aOpen the local SQLite store, creating its parent directory if needed. When ``persist`` is ``False`` the call is a no-op that touches no files and no directories; it returns ``None`` instead of a database handle. Args: db_path: Optional explicit database path; see :func:`resolve_db_path`. data_dir: Optional data directory used when ``db_path`` is not given. persist: When ``False``, return ``None`` without touching the filesystem. retention_days: Optional explicit retention window. Defaults to :func:`retention_days_from_env`. Returns: The opened :class:`SQLiteDatabase`, or ``None`` when ``persist`` is ``False``. Raises: ValueError: If the retention window is malformed or non-positive. Nr;Tr/r0)rH)rparentr5rr)rFr8rGrHr dayss r#rrsL4  7X 6DKKdT>(6(> " $ND $t 44r%cBt|tz jS)aReturn the workspaces directory inside the data directory. The directory is **not** created here; callers create it lazily with :func:`ensure_workspaces_root`. The sanctioned root is deliberately derived from :func:`resolve_data_dir` instead of being configured separately, so there is exactly one source of truth for "where CyberBrain26 stores its things". Deployments that need a different root set ``CYBERBRAIN_WORKSPACES_ROOT`` (or pass the root explicitly to the caller); that is an explicit decision to widen the sandbox, never a silent fallback. Args: data_dir: Optional explicit data directory; see :func:`resolve_data_dir`. Returns: The resolved ``/workspaces`` path. It need not exist. )rrr(r;s r#rrs& X &)< < E E GGr%ct|}|j}|jddd|s |jd|S|S#t$r"}t j d||Yd}~|Sd}~wwxYw)a Resolve the workspaces root and create it with owner-only permissions. Args: data_dir: Optional explicit data directory; see :func:`resolve_data_dir`. Returns: The resolved workspaces root, created with mode ``0o700`` where the platform supports it. Tr/r0z8could not restrict permissions of workspaces root %s: %sN)rr4r5r6r7loggerwarning)r8r9r:rEs r#rrsx(HooG NN4$UN;   NN5 ! O8O  NNJHVY   O sA A3A..A3c|'t|jjn t}t |j}||k(xs|j |S)a1Report whether ``path`` resolves inside the sanctioned workspaces root. Both sides are resolved, so symlinks and ``..`` segments are collapsed before the comparison: a symlink inside the root that points at ``/etc`` resolves to ``/etc`` and is therefore *not* contained. Args: path: Candidate path, typically a workspace taken from a step payload. root: Optional root to compare against; defaults to :func:`workspaces_root`. Returns: ``True`` when the resolved path is the root itself or below it. )rr"r(rr$is_relative_to)r rootallowedr?s r#is_within_workspaces_rootrTsV483Cd4j##%--/IZG %%'I   D9#;#;G#DDr%)rRc|'t|jjn t}t |j}||k7r#|j |st d|d|d|S)a&Resolve a workspace path and refuse it when it escapes the workspaces root. This is the containment check every read-write workspace mount has to pass. It is deliberately small and lives next to :func:`workspaces_root` so that the sandbox provider and any future policy check share one definition of "a workspace we are willing to hand to sandboxed code". Args: workspace: Candidate workspace path from a step payload. root: Optional root to confine to; defaults to :func:`workspaces_root`. Returns: The resolved workspace path, which is inside ``root``. Raises: ValueError: If the resolved workspace is outside ``root``. The message names both the offending path and the allowed root so the refusal is auditable. z workspace z( is outside the allowed workspaces root z&; refusing to bind-mount it read-write)rr"r(rr$rQr>) workspacerRrSr?s r#rrs(483Cd4j##%--/IZG "**,IGI$<$rfs7.# &? "   8 $) c)' S'5C57S7/S/  'S'C <.,#'!H#'!H!H !H !HH,BD"&"&!% 5 5 5 5  5  5DH,4E(KOr%