ڎj_DdZddlZddlZddlmZmZddlmZddlm Z m Z m Z m Z ddl mZddlmZmZd d lmZmZmZmZdd lmZdd lmZGd deZGddeZGddeZdS)z The tool protocol in agentscope.N)abstractmethodABC)Path)AsyncGeneratorAnyCallableList) BaseModel)DEFAULT_DANGEROUS_FILESDEFAULT_DANGEROUS_DIRECTORIES)PermissionContextPermissionDecisionPermissionRulePermissionBehavior) ToolChunk)_remove_title_fieldc@eZdZdZedededeffd ZxZS) ParamsBasezdA base class for tool parameters that remove the title field from the exported JSON schema. argskwargsreturncPttj|i|S)z_An override implementation to remove the title field from the exported schema. )rsupermodel_json_schema)clsrr __class__s CC:\Projects\DSCons\.venv\Lib\site-packages\agentscope\tool\_base.pyrzParamsBase.model_json_schemas* ##<577#*DDD ~& " " "   r c xK|r4ttjdt|dt dgs9t jjr jd i|Sjd i|d{VS d dtdtdttdfffd d i|S) aInvoke the tool, layering any registered middlewares around :meth:`call`. Tools are always invoked with keyword arguments only. ``*args`` is accepted in the signature solely to stay Liskov-compatible with subclasses that override ``__call__`` with their own positional parameters; any positional argument actually passed here is rejected (raising :exc:`TypeError`) so it fails loudly instead of being silently dropped. Middlewares are applied in an onion fashion: the first registered middleware is the outermost layer and runs its pre-logic before any inner layers, then its post-logic after all inner layers have completed. z5 must be called with keyword arguments only, but got z positional argument(s).rBNrindex chain_kwargsrcKtkrwtj jr jdi|23d{V}|WV 6dS jdi|d{V}t |t r|23d{V}|WV 6dS|WVdS}t |}dtdt tdfffd }| ||23d{V}|WV 6dS)z"Execute the tool middleware chain.Nkwrc@Kdzfi|23d{V}|WV 6dS)Nr r/)rLchunk execute_chainrIs rr-z>ToolBase.__call__..execute_chain..next_handlers`(5}UQY'E'E"'E'E$$$$$$$e# (F'E'Es)r*r,r-r/) leninspectisasyncgenfunctionrG isinstancerr&rrr1) rIrJrNresultmwr,r-rOr@r0s ` rrOz(ToolBase.__call__..execute_chains K((((-di88 %'0ty'@'@<'@'@$$$$$$$e# (A'@'@$-49#<#<|#<#<<<<<<t##r cLKt|jdtjdgS)aPGenerate suggested permission rules for the tool input. .. note:: Suggest a single tool-name-level rule (``rule_content=None``) that allows all invocations of this tool. Tools can override this to provide finer-grained suggestions. For example: - File tools (Read/Write/Edit): suggest a glob pattern covering the parent directory (e.g., "src/main.py" -> "src/**") - Bash: suggest command prefix patterns (e.g., "git commit -m 'xxx'" -> "git commit:*") - Grep/Glob: suggest patterns based on search paths Args: tool_input (`dict[str, Any]`): The tool input data Returns: `List[PermissionRule]`: List of suggested permission rules (usually 1, max 5 for compound operations) N suggested) tool_namerbbehaviorsource)rr5rALLOWr`s rgenerate_suggestionszToolBase.generate_suggestions;s56 )!+1"      r file_pathc6tj}t|j}|g|z}tjtj|}|D]}tjtj|} tj||| |tj zs||krdS#t$rYwxYwdS)uCheck if a file path is within any allowed working directory. A "working directory" is the process's current directory plus any entries in :attr:`PermissionContext.working_directories`. Paths are compared via :func:`os.path.realpath` so that aliases like macOS's ``/tmp`` → ``/private/tmp`` and symlinked working directories compare equal on both sides. Used by tools that conditionally auto-allow file operations in :attr:`PermissionMode.ACCEPT_EDITS` (e.g. Write, Edit, and the filesystem-command branch of Bash). Args: file_path (`str`): The file path to check. context (`PermissionContext`): The permission context containing the working directories. Returns: `bool`: True if ``file_path`` is within any allowed working directory. TF) osgetcwdlistworking_directorieskeyspathrealpath expanduserrelpath startswithsep ValueError) r0rlr\ current_diradditional_dirsall_working_dirs abs_file_path working_dirabs_working_dirs r_path_in_allowed_working_pathz&ToolBase._path_in_allowed_working_path^s8ikk w:??AABB'=?:((););I)F)FGG +  K g.."";//O  ???!,,_rv-EFF $77448     us=AD  DDctjtj|}t |j}d|D}tj|}|}|jD]}||krdS|j D]}|} | |vrdSdS)atCheck if a file path is dangerous (sensitive file or directory). A path is considered dangerous if: 1. The filename matches a dangerous file (e.g., .bashrc, .gitconfig) 2. Any path segment matches a dangerous directory (e.g., .git, .ssh) Case-insensitive matching is used to prevent bypasses on case-insensitive filesystems (macOS, Windows). Args: file_path (`str`): The file path to check Returns: `bool`: True if the path is dangerous and should require explicit permission Example: >>> self._is_dangerous_path("/home/user/.bashrc") True >>> self._is_dangerous_path("/home/user/.git/config") True >>> self._is_dangerous_path("/home/user/project/main.py") False c6g|]}|Sr/)lower).0ps r z/ToolBase._is_dangerous_path..s :::!AGGII:::r TF) rnrsabspathrurpartsbasenamerr>r?) r0rlabs_path path_partspath_parts_lowerfilenamefilename_lowerdangerous_file dangerous_dirdangerous_dir_lowers r_is_dangerous_pathzToolBase._is_dangerous_paths:7??27#5#5i#@#@AA(^^) ::z:::7##H--!))"2  N!5!5!7!777tt8 "7  M"/"5"5"7"7 "&666tt7ur )N)"r!r"r#r$r3__annotations__r&rboolr:r;r<r=r r>rpr r?r rCrrrGrZrrrr^rardrrkrrr/r rr+r+^s III*.sCx.   E+"d"""N#t###FDKHcDj!"9OT#Y888M'D49DDD :>   ./$6            ^ItO4 4     >I'I'I' ^ItO4 4 I'I'I'I'V4cN4#4  444^4!cN! !!!!0$Dj$cN$  $$$$B! cN!  n ! ! ! ! F22#2  2222h1C1D111111r r+)r$rQrnabcrrpathlibrtypingrrrr pydanticr _constantsr r permissionrrrr _responser_utilsrrr)r+r/r rrs'& ########666666666666NNNNNNNN ! '''''' O O O O O O O O7 7 7 7 7 7 7 7 teeeeeseeeeer