JjBUdZddlmZddlZddlmZddlmZddlm Z ddl m Z ddl m Z dd lmZgd Zd Zd ed <d8dZd9dZd:dZed d;dZe dGddZe ddZded<dj8d!ej@j8d"ejBj8d#ejDj8d$ejFj8d%ejHj8d&ejJj8d'ejLj8d(ejNj8d)ejBj8d*ejBj8d+ejBj8d,ejBj8d-ejBj8ejBj8ejJj8d.Z(d/ed0<e)hd1Z*d2ed3<e)hd4Z+d2ed5<e)e(e*ze+zZ,d2ed6<d>d7Z-y)?a4 Canonical action vocabulary shared by the policy and permission layers. Every authorization decision is a comparison of a caller-supplied string against a fixed vocabulary of action names. Two gates used to consult that vocabulary with the raw string, so a value such as ``"execute_shell "`` (trailing space) or ``"RUN_SHELL"`` matched no entry at all: the scope gate was skipped and the action was not classified as sensitive. This module is the single normalization point both gates call before they look anything up, so the very same canonical string decides the scope check, the sensitivity classification and the policy rule match. The vocabulary is also explicit. An action the system does not know is unregistered and is denied by default; it becomes usable only when it is registered here (scope-mapped, classified as sensitive, or listed as a known safe non-mutating action). Opting in is a code change, not a runtime string, which is what keeps an invented action name from being treated as harmless. It also owns the format of an *already granted* authorization, because the second gate in front of the sandbox needs the same vocabulary as the first one. A ``cyberbrain run`` step declares its action once; the dispatcher's authorization chain requests the human approval and then hands control to the agent, whose own gateway re-checks that very action immediately before the provider runs. Those two checks are one decision, not two, so the outer one mints an ``ExecutionAuthorization`` naming the agent, the action and a digest of the exact payload a human approved, and binds it to the single in-flight agent call. The inner gateway re-verifies identity, action and payload digest against that grant instead of raising a second, independent approval request: defence in depth is preserved (every gate still runs, and a payload that changed after the operator approved it is refused) while one human decision stays one human decision. The grant is deliberately not a bearer token that can be passed around. It lives in a context variable scoped to the dispatcher's own ``await``, so it cannot be read out of a payload, cannot be stored, cannot survive a process restart, and is gone before the next task is dispatched. A durable task retried after a restart therefore reruns the whole chain and asks a human again. This module imports nothing from the rest of the security plane except ``identity`` (which has no security-plane imports of its own), so ``policy``, ``permission``, the extension layer's dispatcher and the execution plane's gateway can all depend on it without an import cycle. ) annotationsN)Iterator)contextmanager) ContextVar) dataclass)Final)PermissionScope) ACTION_SCOPE_REQUIREMENTS!DEFAULT_EXECUTION_TIMEOUT_SECONDS KNOWN_ACTIONSKNOWN_SAFE_ACTIONSSENSITIVE_ACTIONSExecutionAuthorizationbound_execution_authorizationcurrent_execution_authorizationexecution_payload_digestis_registered_actionnormalize_actionz Final[int]r c`t|tsy|jjS)uReturn the canonical form of an action name. Both sides of every decision — the scope lookup and the policy classification — must call this first, otherwise a cosmetic difference in the caller's string silently selects a different (weaker) authorization path. Surrounding whitespace and letter case are not part of an action's identity, so they are removed rather than trusted. Args: action: The raw action value. Anything that is not a string carries no action name at all and normalizes to the empty string, which is unregistered and therefore denied. Returns: The stripped, lower-cased action name, or ``""`` when none can be read. ) isinstancestrstriploweractions I/home/oem/CyberBrain26-unified/src/cyberbrain26/security_plane/actions.pyrrLs&" fc " <<>   !!ctt|tr|jjSt |S)aReturn the language token the execution layer will actually act on. The execution gateway maps ``"py"``/``"python"`` and ``"sh"``/``"shell"`` onto one action each, so a digest taken from the raw payload value and a digest taken from the gateway's normalized value must agree; that is why the same strip/lower-case rule is applied on both sides. A non-string is rendered with ``repr`` rather than folded into the empty string, so a malformed value can never collide with an absent one in a digest. )rrrrrepr)languages r_canonical_languager#bs.(C ~~%%'' >rc<t|tr|St|S)zBRender one payload field into the material a digest is taken over.)rrr!)values r _digest_fieldr&qsuc*5;U ;r)timeout_secondscdjt|t|t|t|f}tj|j dj S)aReturn a stable fingerprint of everything that decides what will run. The digest covers the four inputs the execution gateway hands to the provider - the code, the normalized language, the workspace it runs in and the timeout - and nothing else. It is the security-critical half of the single-approval flow: the outer gate approves this fingerprint, so the inner gate may only skip asking again while the payload in front of it still hashes to it. Any difference in any of the four fields (including whitespace in the workspace path) produces a different digest, which the inner gate refuses instead of executing. Fields are joined with a NUL separator, which cannot occur in the payload, so no two different field tuples can produce the same material. zutf-8)joinr&r#hashlibsha256encode hexdigest)coder" workspacer'materials rrrvsZ*{{ $   ) ) $ / *  H >>(//'2 3 = = ??rT)frozenc^eZdZUdZded<ded<ded<ded<dZded <dZded <d d Zy) raOne already-granted authorization for exactly one execution payload. Minted by the dispatcher's authorization chain *after* a human approved the declared action, and consumed by the execution gateway for the very payload the digest was taken over. Immutable and unforgeable from outside: the only producer is the dispatcher, it never travels in a payload or a database, and its lifetime is one in-flight agent call (see :func:`bound_execution_authorization`). Attributes: agent_id: Identity the approval was granted to. A grant is never usable by another identity, so one agent's approval cannot be spent by a second one. task_id: Dispatch task the approval belongs to, recorded for the audit trail. The binding that actually scopes the grant to one task is the context-variable lifetime, not this field. action: Canonical action a human approved. The gateway ignores the grant entirely when the action it is about to perform differs, which is what keeps an approval for one action from authorizing another (a step declaring the non-mutating label ``"code"``, for instance, still raises its own approval for ``execute_python``). resource: The declared resource of the dispatch, carried for the audit trail only. It is deliberately *not* compared at consumption time: the dispatcher's declared resource and the gateway's execution workspace are different attributes of a step, and the workspace is already covered by the payload digest. payload_digest: Fingerprint from :func:`execution_payload_digest`. approval_request_id: The approval request a human decided, or ``None`` when the outer chain allowed the action outright. A grant without a request id carries no human decision, so the gateway never treats it as a substitute for one. ragent_idtask_idrpayload_digestNz str | Noneapproval_request_idresourcecd|j|k(xr |j|k(xr|j|k(S)axReport whether this grant authorizes the execution being attempted. Callers must have already decided that the grant's action is the action being performed; a differing action is not answered here, because the right response to "approved something else" is to run the full authorization chain for the real action, not to fail a match. )r4rr6)selfr4rr6s rcoverszExecutionAuthorization.coverss9 MMX % 6 v% 6##~5 r)r4rrrr6rreturnbool)__name__ __module__ __qualname____doc____annotations__r7r8r;rrrrs9BM L K&**Hj  rr$cyberbrain26_execution_authorization)defaultz)ContextVar[ExecutionAuthorization | None] _CURRENT_EXECUTION_AUTHORIZATIONc*tjS)zCReturn the grant bound to the dispatch currently in flight, if any.)rFgetrCrrrrs + / / 11rc#Ktj|} dtj|y#tj|wxYww)aBind ``authorization`` for the duration of one agent call. Security rationale: the binding is both the propagation mechanism and the security boundary. Because the context variable is set and reset around the dispatcher's own ``await agent.execute(...)``, a grant is readable by the gates of exactly that one call and by nothing else - it cannot be read from the payload, forged by a caller, smuggled in through the event bus, reused by a later step or persisted for a later process. Binding ``None`` clears any grant inherited from an enclosing scope, so a nested dispatch cannot spend an outer task's approval. N)rFsetreset) authorizationtokens rrrs= - 0 0 ?E6 (..u5(..u5sA 3A A  A  read_file write_file delete_file execute_shellexecute_pythonaccess_networkaccess_browser execute_gitexecute_dockeraccess_secrets access_mcp audit_logpublish_contentsend_external_message data_upload scan_network vuln_scan)exploit_targetcredential_accesszFinal[dict[str, str]]r >r^rOr\rPr]rQrSrWrVrRr_rZr`r[zFinal[frozenset[str]]r>r/planevaluater r c$t|tvS)zCheck whether an action name is part of the canonical vocabulary. The name is normalized first, so a whitespace or case variant of a known action is recognised rather than treated as a different, unknown action. )rr rs rrr^s F #} 44r)robjectr<r)r"rdr<r)r%rdr<r) r/rdr"rdr0rdr'rdr<r)r<ExecutionAuthorization | None)rLrer<zIterator[None])rrdr<r=).rA __future__rr+collections.abcr contextlibr contextvarsr dataclassesrtypingr$cyberbrain26.security_plane.identityr __all__r rBrr#r&rrrFrr READ_FILEr% WRITE_FILE DELETE_FILESHELLPYTHONNETWORKBROWSERGITDOCKERSECRETSMCPAUDITr frozensetrr r rrCrrr{s)V#$%"!@ $13!:2", <@ @ @@ @  @  @@ $5 5 5 pOY*DO "K 2 606660*4**00*4/,,22*4?..44*4_**00 *4 o,,22 *4 o--33 *4o--33*4?&&,,*4o,,22*4o--33*4/%%++*4&&,,*4,..44-*4._44::/*40?**001*4DO++11E*4F((..G*4H&--33 )0066S*40*f,5,(^-66R,S)S '(+<