g3fiyfdZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl Z ddlmZmZddlmZddlmZmZmZmZmZddlmZddlmZdd lmZdd lm Z m!Z!dd l"m#Z#dd l$m%Z%m&Z&dd l'm(Z(m)Z)m*Z*m+Z+m,Z,ddl-m.Z.m/Z/m0Z0m1Z1ddl2m3Z3m4Z4m5Z5ddl6m7Z7m8Z8erddl9m:Z:m;Z;ddlrr?s r2restartzShellSession.restarts! $,,223 rBcX|jsy|jjB|js6 |jj d|jj  |jj||jd|_tjt 5|jj#dddd|_y#t tf$rtjddYwxYw#tj$r|jYwxYw#1swYd|_yxYw#d|_tjt 5|jj#dddd|_w#1swYd|_wxYwxYw)zStop the shell subprocess.Nzexit z8Failed to write exit command; terminating shell session.Texc_infor1)rer{rorfwriteflushBrokenPipeErrorOSErrorLOGGERdebugwait _kill_process subprocessTimeoutExpiredr*r+r,close)r@r1s r2r-zShellSession.stopsR}}  ==    '0@0@  !!(+ !!# !}}!!'!2:""$ $D $$Y/ $ !!# $ DM$W-  N! (( !     ! $ DM $D $$Y/ $ !!# $ DM $ DMsY5C"+,D7D7"&D  D #D41E 3D44E 7E !F)+FF)F& F)c|jr|jj d}t|tt j j }tj|z}|j5|j|jdr|n|d} |jj||jjd|d|jj|j%|||cdddS#tt f$r|j#|cYcdddSwxYw#1swYyxYw)z*Execute a command in the persistent shell.NzShell session is not running. zprintf 'z %s\n' $? )rer{r~_DONE_MARKER_PREFIXuuiduuid4hextime monotonicrl _drain_queueendswithrfrrrr_collect_output_after_exit_collect_output)r@rqr1rmarkerdeadlinepayloads r2executezShellSession.executes2}} 2 2 4 @1Cs# #'()9)9(:;>>#g- ZZ C    !(!1!1$!7gy^G A !!'* !!HVHL"AB !!# '''B C C$W- A66x@@ C C A C Cs1=)E'AD;E E7EEEEc g}d}d}d}d}d} d} |tjz } | dkrd} nT |jj| \} } | D| dk(rX| j |rG| jd\}}}|j|j} |j||n|dz }| jdd }|t|z }||jjkDrd}|jj||jjkDrd}| d k(rH| j!d }|j#d || j%d r#|j#d n|j#| t| r8t&j)d ||j+t-ddd||||Sdj/|}t-|| d||||S#tj $rd} YtwxYw)NrFTrrv utf-8replacerzr [stderr] z?Command timed out after %.2f seconds; restarting shell session.rTrVrXrYrZr\r])rrrigetrgEmpty startswith partition _safe_intstrip_drain_remaining_stderrencodelenramax_output_linesmax_output_bytesrstripappendrrwarningrrRjoin)r@rrr1 collectedr\r]rYrZrVrX remainingsourcedata_statusencodedstrippedrTs r2rzShellSession._collect_outputs! "   "" $   4>>#33IA~  #{{yA  |!doof&=#~~c2 1f NN6<<>: ,,YA 1 Kkk'95G 3w< 'KT\\:::%)" --9$,,"?"??%)"!;;t,  9XJ!78==&$$T*  &Y\  NNQ  LLN)#5#5'' #%11##  q;;   sG!!G98G9c Lg}d}d}d}d}d}ttj|z|} |tjz } | dkrn |jj | \} } | A|dz }| jdd } |t| z }||jjkDrd}|jj||jjkDrd}| d k(rH| jd } |jd | | jd r#|jd n|j| d}|jr|jj!}d j#|}t%||d||||S#t j $rY`wxYw)aCollect output after the shell exited unexpectedly. Called when a `BrokenPipeError` occurs while writing to stdin, indicating the shell process terminated (e.g., due to an 'exit' command). Args: deadline: Absolute time by which collection must complete. Returns: `CommandExecutionResult` with collected output and the process exit code. rFg?TrNrrrrzrrrr)minrrrirrgrrrrarrrrrrer{rrR)r@rrr\r]rYrZ drain_timeoutdrain_deadlinerrrrrrVrTs r2rz'ShellSession._collect_output_after_exit8s "   "" T^^- =xH&)99IA~ #{{yA | 1 Kkk'95G 3w< 'KT\\:::%)" --9$,,"?"??%)"!;;t,  9XJ!78==&$$T*  &EJ!% == **,I#%11##  I;;  s F F#"F#c|jsyttdrntjt 5tj tj|jjtjdddytjt 5|jjdddy#1swYyxYw#1swYyxYw)Nkillpg) rehasattrosr*r+ProcessLookupErrorrgetpgidpidsignalSIGKILLkillr?s r2rzShellSession._kill_processs}}  2x $$%78 I "**T]]%6%67H I I$$%78 % ""$ % % I I % %sA C %C CCct|jdD]}|jj||f!|jj|dfy)Nr)iterreadlineriput)r@streamlabellines r2rzShellSession._enqueue_streamsD"- +D KKOOUDM * +  &rBcn |jj#tj$rYywxYwr))ri get_nowaitrgrr?s r2rzShellSession._drain_queues7  &&(;;  s 44cttj|z|} |tjz }|dkry |jj |\}}||dk7rF|jd}|jd||jdr|jd#t j $rYywxYw)a\Drain any stderr output that arrived concurrently with the done marker. The stdout and stderr reader threads run independently. When a command writes to stderr just before exiting, the stderr output may still be in transit when the done marker arrives on stdout. This method briefly polls the queue to capture such output. Args: collected: The list to append collected stderr lines to. deadline: The original command deadline (used as an upper bound). drain_timeout: Maximum time to wait for additional stderr output. rrNrzrr) rrrrirrgrrrr) r@rrrrrrrrs r2rz$ShellSession._drain_remaining_stderrsT^^- =xH&)99IA~ #{{yA |v1{{4(H   y 3 4}}T"  & ;;  sB00CCcvtjt5t|cdddS#1swYyxYwr))r*r+ ValueErrorr[)values r2rzShellSession._safe_ints/   , u:   s /8N) rprr7rrqtuple[str, ...]rrzMapping[str, str]rDrErC)r1floatrDrE)rqrSr1rrDrR)rrSrrr1rrDrR)rrrDrR)rr rrSrDrE)g?)rz list[str]rrrrrDrE)rrSrDrU)rFrGrHrIrsrrr-rrrrrrr staticmethodrrKrBr2r'r'rsN!!$!! ! ' !  !&!$F !4C.U U U  U U nH T %' MQ'"'.3'DI' '>rBcbeZdZUdZdZded< dZded< dZded< ed d d Z y) _ShellToolInputz+Input schema for the persistent shell tool.N str | Nonerqz bool | Nonerz Annotated[Any, SkipJsonSchema()]runtimeafter)modec|j|js d}t||j|jr d}t||S)Nz2Shell tool requires either 'command' or 'restart'.z+Specify only one of 'command' or 'restart'.)rqrrrs r2validate_payloadz _ShellToolInput.validate_payloadsE <<  FCS/ ! << # ?CS/ ! rB)rDr) rFrGrHrIrqrJrrrrrKrBr2rrsH5GZ'G[/04G -4 '"#rBrc @eZdZdZeZ ddddddeddd dfdZe ddZ e ddZ eddZ e ddZ dd Ze dd Zdd Zdd Zdd ZddZddZddZ ddZdd d dZxZS)!ShellToolMiddlewareuMiddleware that registers a persistent shell tool for agents. The middleware exposes a single long-lived shell session. Use the execution policy to match your deployment's security posture: * `HostExecutionPolicy` – full host access; best for trusted environments where the agent already runs inside a container or VM that provides isolation. * `CodexSandboxExecutionPolicy` – reuses the Codex CLI sandbox for additional syscall/filesystem restrictions when the CLI is available. * `DockerExecutionPolicy` – launches a separate Docker container for each agent run, providing harder isolation, optional read-only root filesystems, and user remapping. When no policy is provided the middleware defaults to `HostExecutionPolicy`. N)startup_commandsshutdown_commandsexecution_policyredaction_rulestool_description tool_name shell_commandruct |r t|nd_|_j |_j| _||_ nt_ |xsd} td| D_ j|_j|_|xst } t#jt$| ddd dfd} | _j&g_y) aInitialize an instance of `ShellToolMiddleware`. Args: workspace_root: Base directory for the shell session. If omitted, a temporary directory is created when the agent starts and removed when it ends. startup_commands: Optional commands executed sequentially after the session starts. shutdown_commands: Optional commands executed before the session shuts down. execution_policy: Execution policy controlling timeouts, output limits, and resource configuration. Defaults to `HostExecutionPolicy` for native execution. redaction_rules: Optional redaction rules to sanitize command output before returning it to the model. !!! warning Redaction rules are applied post execution and do not prevent exfiltration of secrets or sensitive data when using `HostExecutionPolicy`. tool_description: Optional override for the registered shell tool description. tool_name: Name for the registered shell tool. Defaults to `"shell"`. shell_command: Optional shell executable (string) or argument sequence used to launch the persistent session. Defaults to an implementation-defined bash command. env: Optional environment variables to supply to the shell session. Values are coerced to strings before command execution. If omitted, the session inherits the parent process environment. NrKc3<K|]}|jywr))resolve).0rules r2 z/ShellToolMiddleware.__init__..(sI #DLLNI s) args_schema descriptionFrqrc|j|j}j|||d|jS)Nr) tool_call_id)_get_or_create_resourcesstate_run_shell_toolr)rrqr resourcesr@s r2 shell_toolz0ShellToolMiddleware.__init__..shell_tool1sE55gmmDI''#8$11( rB)rz!ToolRuntime[None, ShellToolState]rqrrrWrDToolMessage | str)superrsr_workspace_root _tool_name_normalize_shell_command_shell_command_normalize_envrd_execution_policyrtuple_redaction_rules_normalize_commands_startup_commands_shutdown_commandsDEFAULT_TOOL_DESCRIPTIONr!r _shell_tooltools)r@workspace_rootrrrrrrrrurulesrr __class__s` r2rszShellToolMiddleware.__init__s.b 7EtN34#";;MJ //4  '%5D "%8%:D "%2CHI ',I D "&!9!9:J!K"&":":;L"M'B*B doo? T#'! 6       U &&&' rBcD|yt|tr|fSt|S)NrK) isinstancerSr )commandss r2r z'ShellToolMiddleware._normalize_commandsBs)   h $; XrBcf|yt|tr|fn t|}|s d}t||S)N)z /bin/bashz1Shell command must contain at least one argument.)rrSr r)r normalizedrs r2rz,ShellToolMiddleware._normalize_shell_commandLs>  !)3M3)Gm%US`Ma ECS/ !rBc|yi}|jD]0\}}t|ts d}t|t|||<2|S)Nz+Environment variable names must be strings.)itemsrrS TypeError)rurkeyrrs r2r z"ShellToolMiddleware._normalize_envXsV ;%' ))+ )JCc3'Cn$!%jJsO  ) rBc,|j|}d|iS)z1Start the shell session and run startup commands.rN)rr@rrrs r2 before_agentz ShellToolMiddleware.before_agentds11%8 )955rBc.K|j||Sw)z7Async start the shell session and run startup commands.)r!r@rrs r2 abefore_agentz!ShellToolMiddleware.abefore_agentjs  00c|jd}t|tsy |j|j|j y#|j wxYw)zDRun shutdown commands and release resources when an agent completes.rNN)rrr5_run_shutdown_commandsr/r:r s r2 after_agentzShellToolMiddleware.after_agentnsSII78 )%67  "  ' ' (9(9 :    !I   !s AA"c.K|j||Sw)zJAsync run shutdown commands and release resources when an agent completes.)r(r#s r2 aafter_agentz ShellToolMiddleware.aafter_agentzsw//r%c|jd}t|tr|S|j}|t d|d<|S)aGet existing resources from state or create new ones if they don't exist. This method enables resumability by checking if resources already exist in the state (e.g., after an interrupt), and only creating new resources if they're not present. Args: state: The agent state which may contain shell session resources. Returns: Session resources, either retrieved from state or newly created. rNdict[str, Any])rrr5_create_resourcesr )r@rr new_resourcess r2rz,ShellToolMiddleware._get_or_create_resources~sKII78 i!2 3 ..0 CP u%&?@rBc`|j}d}|0tjt}t |j }n|}|j ddt||j|j|jxsi} |jtjd||j|t)|||jS#t$rNtj!d|j#|jj$||j'wxYw)N)prefixT)parentsexist_okzStarted shell session in %sz5Starting shell session failed; cleaning up resources.)r/r0r7)rtempfileTemporaryDirectoryrrnamemkdirr'r rrdrrinfo_run_startup_commands BaseException exceptionr-r>r.r5)r@rpr0workspace_pathr/s r2r-z%ShellToolMiddleware._create_resourcess (( ;?  119JKG!',,/N&N   =   " "       #    MMO KK5~ F  & &w /!'$J`J`aa    T U LL//CC D"!   s 7CAD-c|jsy|jD]`}|j||jj}|js|j dvsEd|d|j }t |y)NrNrzStartup command 'z' failed with exit code )rrr startup_timeoutrXrVr~)r@r/rqresultrs r2r8z)ShellToolMiddleware._run_startup_commandss|%% -- (G__Wd6L6L6\6\_]FF$4$4I$E)'2J6K[K[J\]"3''  (rBc|jsy|jD]|} |j||jj}|jrt j d|n/|jdvr!t j d||j~y#tttf$r#}t j d||dYd}~d}~wwxYw)Nrz Shutdown command '%s' timed out.r=z%Shutdown command '%s' exited with %s.z'Failed to run shutdown command '%s': %sTr) rrr command_timeoutrXrrrVr~r r)r@r/rqr?excs r2r'z*ShellToolMiddleware._run_shutdown_commandss&& .. G  $:P:P:`:`a##NN#EwO%%Y6NN?&JZJZ !-9 =wVZ sA9BC.C  Cci}|}|jD]D}|j|\}}|s|j|jgj |F||fS)z3Apply configured redaction rules to command output.)r apply setdefaultpii_typeextend)r@contentmatches_by_typeupdatedrmatchess r2_apply_redactionsz%ShellToolMiddleware._apply_redactionsse57)) ND#zz'2 GW**4=="=DDWM N''rBc  |j}|jdrMtjd |j |j |d}|j||dS|jd}|rt|ts d }t|tjd ||j||jj } | jr5|jj} d | d d}|j||ddddS |j!| j"\} } | xsd} | j.r7| j1d|jj2d| j4d} | j6rM|jj87| j1d|jj8d| j:d} | j*dvr"| j1d| j*} d}nd}d| j*| j.| j6| j4| j:| d}|j| |||S#t $r(}tjdd}t||d}~wwxYw#t$$rs} tj'd| j(d| j(d}|j||dd| j*| j(| j,idcYd} ~ Sd} ~ wwxYw) Nrz$Restarting shell session on request.z=Restarting shell session failed; session remains unavailable.z Failed to restart shell session.zShell session restarted.success)rrqzDShell tool expects a 'command' string when restart is not requested.zExecuting shell command: %srzError: Command timed out after z.1fz seconds.errorT)rXrV)rartifactz+Blocking command output due to detected %s.zOutput blocked: detected .F)rXrVrKz z ... Output truncated at z lines (observed z).z bytes (observed r=z Exit code: )rXrVrYrZr\r]redaction_matches)r/rrr7rr8r9r:r _format_tool_messagerrSrr rArXrLrTrrrFrVrKrYrrr\rZrr])r@rrrr/errrmessagerqr?timeout_secondssanitized_outputrKrO final_statusrPs r2rz#ShellToolMiddleware._run_shell_tools6## ;;y ! KK> ? 2!**73 1G,,Wl9,U U++i(j#6XC$ $ 17;$2H2H2X2XY   "44DDO77LIVG,,!%!% -  (,(>(>v}}(M % g,<}  $ $#**,-.++/+A+A+R+R*ST#//04   $ $)?)?)P)P)\#**,-.++/+A+A+R+R*ST#//04    9 ,"2"9"9";! -   s6!IJ J&#J  J L A(LL L )rPcJ|xsi}||St|||j||S)N)rHrr5rrP)r r)r@rHrrrPs r2rSz(ShellToolMiddleware._format_tool_message3s8>r  N%   rBr))rzstr | Path | Noner(tuple[str, ...] | list[str] | str | NonerrZrzBaseExecutionPolicy | Nonerz6tuple[RedactionRule, ...] | list[RedactionRule] | NonerrrrSrSequence[str] | str | NoneruMapping[str, Any] | NonerDrE)rrZrDr)rr[rDr)rur\rDzdict[str, str] | None)rrMrr$rDdict[str, Any] | None)rrMrr$rDrE)rrMrDr5)rDr5)r/r'rDrE)rHrSrDz%tuple[str, dict[str, list[PIIMatch]]])rr5rr,rrrDr ) rHrSrrrzLiteral['success', 'error']rPr]rDr)rFrGrHrIrM state_schemaSHELL_TOOL_NAMErsrr rr rr!r$r(r*rr-r8r'rLrrS __classcell__)rs@r2rrs "L-1S(FJFJ7;RV'+(48(,S()S(C S( D S( 5 S(PS(%S(S(2S(&S( S(j:  1      66 1 " "0*b:("(] $]  ] ! ] ] J+/   ! ,  (    rBr)rrrrr)r/r'r0r6r1rrDrE)LrI __future__rr*loggingrrgrrr3rjrrr< dataclassesrrpathlibrtypingrrr r r langchain_core.messagesr langchain_core.tools.baser "langgraph.channels.untracked_valuerpydanticrrpydantic.json_schemartyping_extensionsrr&langchain.agents.middleware._executionrrrrr&langchain.agents.middleware._redactionrrrr!langchain.agents.middleware.typesrrrlangchain.toolsr r!collections.abcr"r#langgraph.runtimer$ getLoggerrFrrrr_r3r5rMrRr'rr__all__rKrBr2rts@@"  (??/3=//3 \[-1)   8 $)Q $KV[      $Z $   JJZ i6j /.#*=>j Z  rB