g3fiz7dZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl m Z m Z ddl mZmZddlmZ ddlZdZ ddZe j,rddl m Z m Z ddlmZeGd d ej.ZeGd d eZeGd deZeGddeZgdZy#e$rdZYwxYw)z7Execution policies for the persistent shell middleware.) annotationsN)MappingSequence) dataclassfield)Pathzlangchain-shell-ctjt|tjtjtj|dddd||| S)NTzutf-8replace) stdinstdoutstderrcwdtextencodingerrorsbufsizeenv preexec_fnstart_new_session) subprocessPopenlistPIPE)commandrrrrs d/var/www/auto_recruiter/arenv/lib/python3.12/site-packages/langchain/agents/middleware/_execution.py_launch_subprocessrsK    W oo   +  ceZdZUdZdZded<dZded<dZded<dZd ed <d Z d ed <ddZ e j ddZ y )BaseExecutionPolicyaConfiguration contract for persistent shell sessions. Concrete subclasses encapsulate how a shell process is launched and constrained. Each policy documents its security guarantees and the operating environments in which it is appropriate. Use `HostExecutionPolicy` for trusted, same-host execution; `CodexSandboxExecutionPolicy` when the Codex CLI sandbox is available and you want additional syscall restrictions; and `DockerExecutionPolicy` for container-level isolation using Docker. g>@floatcommand_timeoutstartup_timeoutg$@termination_timeoutdintmax_output_linesN int | Nonemax_output_bytesc<|jdkr d}t|y)Nrz"max_output_lines must be positive.)r' ValueErrorselfmsgs r __post_init__z!BaseExecutionPolicy.__post_init__Is$  A %6CS/ ! &rcy)z$Launch the persistent shell process.N)r- workspacerrs rspawnzBaseExecutionPolicy.spawnNsrreturnNoner2rrMapping[str, str]r Sequence[str]r5subprocess.Popen[str])__name__ __module__ __qualname____doc__r"__annotations__r#r$r'r)r/abcabstractmethodr3r1rrr r 6s "OU!!OU!!%%c#'j'"  33 3  3  33rr ceZdZUdZdZded<dZded<dZded<ed d d Z ded <dfd Z dd Z ddZ ddZ eddZxZS)HostExecutionPolicyaRun the shell directly on the host process. This policy is best suited for trusted or single-tenant environments (CI jobs, developer workstations, pre-sandboxed containers) where the agent must access the host filesystem and tooling without additional isolation. Enforces optional CPU and memory limits to prevent runaway commands but offers **no** filesystem or network sandboxing; commands can modify anything the process user can reach. On Linux platforms resource limits are applied with `resource.prlimit` after the shell starts. On macOS, where `prlimit` is unavailable, limits are set in a `preexec_fn` before `exec`. In both cases the shell runs in its own process group so timeouts can terminate the full subtree. Nr(cpu_time_seconds memory_bytesTboolcreate_process_groupF)initreprdefault_limits_requestedc\t||j|jdkr d}t||j|jdkr d}t|t d|j|jfD|_|j rt d}t|yy)Nrz.cpu_time_seconds must be positive if provided.*memory_bytes must be positive if provided.c3$K|]}|du ywNr1).0values r z4HostExecutionPolicy.__post_init__..ws% "'E % szHostExecutionPolicy cpu/memory limits require the Python 'resource' module. Either remove the limits or run on a POSIX platform.) superr/rDr+rEanyrKresource RuntimeErrorr-r. __class__s rr/z!HostExecutionPolicy.__post_init__os   ,1F1F!1KBCS/ !    (T->->!-C>CS/ !!$% ,0,A,A4CTCT+U% "   ! !h&6G s# # '7 !rctt||||j|j}|j ||S)Nrrrr)rr_create_preexec_fnrG_apply_post_spawn_limits)r-r2rrprocesss rr3zHostExecutionPolicy.spawnsE% M..0"77   %%g.rcNjrjrydfd }|S)Ncj<jjf}tjtj|jjjf}t tdr%tjtj |yt tdr%tjtj|yyy)N RLIMIT_AS RLIMIT_DATA)rDrU setrlimit RLIMIT_CPUrEhasattrr`ra)limitr-s r _configurez:HostExecutionPolicy._create_preexec_fn.._configures$$0..0E0EF""8#6#6>  ,**D,=,=>8[1&&x'9'95AX}5&&x';';UC6 -rr4)rK_can_use_prlimit)r-rfs` rr[z&HostExecutionPolicy._create_preexec_fns(%%)>)>)@ DrcT|jr|jsyty|j}|y t j dtj }|j.||tj|j|jf|jk|j|jf}ttdr||tj|yttdr||tj|yyy#t$r}d}t||d}~wwxYw)N typing.Anyr`raz,Failed to apply resource limits via prlimit.)rKrgrUpidtypingcastprlimitrDrcrErdr`raOSErrorrV)r-r]rjrmreexcr.s rr\z,HostExecutionPolicy._apply_post_spawn_limitss%%T-B-B-D    kk ;  -kk,9AAG$$0X0043H3H$J_J_2`a  ,**D,=,=>8[1C!3!3U;X}5C!5!5u=6 -  -@Cs# , -sB*D (D D'D""D'cxtduxr1ttdxrtjj dS)Nrmlinux)rUrdsysplatform startswithr1rrrgz$HostExecutionPolicy._can_use_prlimits7 D  1), 1 ''0 rr4r7)r5 typing.Callable[[], None] | None)r]r:r5r6)r5rF)r;r<r=r>rDr?rErGrrKr/r3r[r\ staticmethodrg __classcell__rXs@rrCrCYs $(j'#L*#!%$%#UEJtJ$$     ""-,  rrCceZdZUdZdZded<dZded<eeZ d ed < dd Z dd Z dd Z ddZ eddZy)CodexSandboxExecutionPolicyaLaunch the shell through the Codex CLI sandbox. Ideal when you have the Codex CLI installed and want the additional syscall and filesystem restrictions provided by Anthropic's Seatbelt (macOS) or Landlock/seccomp (Linux) profiles. Commands still run on the host, but within the sandbox requested by the CLI. If the Codex binary is unavailable or the runtime lacks the required kernel features (e.g., Landlock inside some containers), process startup fails with a `RuntimeError`. Configure sandbox behavior via `config_overrides` to align with your Codex CLI profile. This policy does not add its own resource limits; combine it with host-level guards (cgroups, container resource limits) as needed. codexstrbinaryautoz(typing.Literal['auto', 'macos', 'linux']rs)default_factoryzMapping[str, typing.Any]config_overridescD|j|}t|||ddSNFrZ)_build_commandr)r-r2rr full_commands rr3z!CodexSandboxExecutionPolicy.spawns0**73 ! #   rc J|j}|j}|d|g}tt|jj D],\}}|j d|d|j|g.|jd|j ||S)Nsandboxz-c=z--) _resolve_binary_determine_platformsorteddictritemsextend_format_overrideappend)r-rr} platform_argrkeyrQs rrz*CodexSandboxExecutionPolicy._build_commands%%'//1 #)9l"C  d&;&;!r}r?rsrrrr3rrrrvrr1rrrzrzs FC9?H6?16t1L.L          rrzceZdZUdZdZded<dZded<dZded <d Zded <d Z d ed<d Z ded<d Z ded<d Z ded<d Z ded<d Zded<dfd Z ddZ ddZeddZd dZxZS)!DockerExecutionPolicyanRun the shell inside a dedicated Docker container. Choose this policy when commands originate from untrusted users or you require strong isolation between sessions. By default the workspace is bind-mounted only when it refers to an existing non-temporary directory; ephemeral sessions run without a mount to minimise host exposure. The container's network namespace is disabled by default (`--network none`) and you can enable further hardening via `read_only_rootfs` and `user`. The security guarantees depend on your Docker daemon configuration. Run the agent on a host where Docker is locked down (rootless mode, AppArmor/SELinux, etc.) and review any additional volumes or capabilities passed through ``extra_run_args``. The default image is `python:3.12-alpine3.19`; supply a custom image if you need preinstalled tooling. dockerr|r}zpython:3.12-alpine3.19imageTrFremove_container_on_exitFnetwork_enabledNzSequence[str] | Noneextra_run_argsr(rEztyping.Any | NonerDz str | Nonecpusread_only_rootfsuserct||j|jdkr d}t||j d}t ||j '|j js d}t||j'|jjs d}t|t|jxsd|_ y)NrrMzxDockerExecutionPolicy does not support cpu_time_seconds; configure CPU limits using Docker run options such as '--cpus'.z.cpus must be a non-empty string when provided.z.user must be a non-empty string when provided.r1) rSr/rEr+rDrVrstriprtuplerrWs rr/z#DockerExecutionPolicy.__post_init__+s     (T->->!-C>CS/ !  ,= s# # 99 ):BCS/ ! 99 ):BCS/ !#D$7$7$=2>rc|j|||}tjj}t |||ddSr)rosenvironcopyr)r-r2rrrhost_envs rr3zDockerExecutionPolicy.spawn>sD**9c7C ::??$! #   rc|j}|ddg}|jr|jd|js|j ddg|j &|j dt |j g|j|r7t |}|j d|d|g|j d |gn|j d d g|jr|jd |jD]\}}|j d |d |g|j|j d|jg|j|j d|jg|jr|j |j|j|j|j ||S)Nrunz-iz--rmz --networknonez--memoryz-v:z-w/z --read-onlyz-erz--cpusz--user)rrrrrrEr|_should_mount_workspacerrrrrr) r-r2rrr}r host_pathrrQs rrz$DockerExecutionPolicy._build_commandOs %%'#)5$"7  ( (    '##   f 5 6    (   S1B1B-C D E  ' ' 2II   )Ai['A B C   y 1 2   s ,     .))+ :JC   #aw'7 8 9 : 99   499 5 6 99   499 5 6       3 3 4DJJ'G$rcB|jjt SrO)namertSHELL_TEMP_PREFIX)r2s rrz-DockerExecutionPolicy._should_mount_workspaceqs>>,,->???rc|tj|j}|d}t||jz|S)NzTDocker execution policy requires the '%s' CLI to be installed and available on PATH.rrs rrz%DockerExecutionPolicy._resolve_binaryus>||DKK( <* sT[[01 1 rr4r7)r2rrr8rr9r5r)r2rr5rFr)r;r<r=r>r}r?rrrrrErDrrrr/r3rrvrrrwrxs@rrrs FC)E3)%)d)!OT!+/N(/#L*#*.'.D*"d"D*?&        "      D@@rr)r rzrrC) rr9rr8rrrrurrFr5r:)r> __future__rr@rrrrrrrkcollections.abcrr dataclassesrrpathlibrrU ImportErrorrr TYPE_CHECKINGABCr rCrzr__all__r1rrrs'="  -( '     1   0 1 3#''3 3D e -e  e P H"5H HV n/n nb ] HsB;;CC