ێj!l dZddlmZddlZddlZddlZddlZddlmZm Z ddl Z ddl m Z ddlmZddl mZdd lmZdd lmZmZdd lmZmZd d lmZmZmZerddlmZmZGddeZGddeZ GddZ!ddZ"dS)uHost-side client for the in-sandbox MCP gateway, driven through ``backend.exec_shell``. Three classes: * :class:`GatewayClient` — workspace-side facade over ``/health`` and ``/mcps``. Used by the sandboxed workspaces for top-level operations. * :class:`GatewayMCPClient` — an :class:`MCPClient` subclass whose protocol behaviour is replaced by gateway-relayed calls. Local stdio/HTTP machinery is bypassed; ``model_post_init`` is a no-op; ``connect`` / ``close`` / ``list_raw_tools`` / ``get_tool`` all round-trip through ``/mcps``. * :class:`GatewayMCPTool` — :class:`ToolBase` whose ``__call__`` invokes the upstream tool via ``POST /mcps/{name}/tools/{tool}``. Every request runs inside the sandbox: the host writes an optional body to a sandbox tempfile, spawns a small Python shim via :meth:`BackendBase.exec_shell` (see :mod:`._gateway_shim`), and parses the JSON envelope the shim prints on stdout. No host→sandbox network reachability is required — the gateway only binds sandbox loopback. ) annotationsN) TYPE_CHECKINGAny) PrivateAttr)logger) MCPClient)ToolResultState)PermissionBehaviorPermissionDecision)ToolBase ToolChunk)BODY_INLINE_LIMITSANDBOX_TMP_DIR SHIM_SCRIPT) BackendBase ExecResultcHeZdZUdZdZded<dZded<ddZddZddZ dS)GatewayMCPTooluAn MCP tool whose ``__call__`` is one ``exec_shell``-driven request to the gateway. Mirrors :class:`agentscope.tool.MCPTool` field-by-field so the toolkit treats it identically (same ``name`` format, same permission policy) — only the call path changes. Tboolis_mcpFis_state_injectedmcp_namestrtoolmcp.types.Toolgateway'GatewayClient'returnNonec||_d|d|j|_|jpd|_|jrt |jni}|dd|di|dg||_d|_d|_d|_ |j r(t|j d r|j j pd|_ ||_ ||_d S) aBuild a gateway-backed MCP tool. Mirrors the field surface of :class:`agentscope.tool.MCPTool` so the toolkit cannot tell the difference. Args: mcp_name (`str`): Upstream MCP server name; drives the visible ``mcp__{mcp}__{tool}`` name and the URL path. tool (`mcp.types.Tool`): Raw upstream tool descriptor as returned by the gateway. ``inputSchema`` is forwarded verbatim; ``annotations.readOnlyHint`` drives the permission policy. gateway (`GatewayClient`): Facade dispatching every call through :meth:`GatewayClient.exec_request`. mcp____typeobject propertiesrequiredF readOnlyHintN)rname description inputSchemadict setdefault input_schemais_concurrency_safeis_external_tool is_read_onlyrhasattrr*_tool_gateway)selfrrrschemas RC:\Projects\DSCons\.venv\Lib\site-packages\agentscope\workspace\_gateway_client.py__init__zGatewayMCPTool.__init__Ds0! 3H33 33 +1r+/+;Cd&'''&(+++,+++*b)))"#( %!   G(8. I I G $ 0 = FD   _argsr_kwargsr cK|jrttjdSttjdS)z{Read-only tools auto-allow; everything else defers via ``ASK``. Mirrors :meth:`MCPTool.check_permissions`. z1This is a read-only MCP tool. Allowing execution.)behaviormessagez1MCP tools must be explicitly allowed by the user.)r3r r ALLOWASK)r7r<r=s r9check_permissionsz GatewayMCPTool.check_permissionspsU   %+1K "'+G    r;kwargsrcK|jdd|jd|jjd|id{V\}}|dkr-t dt ||d gtj Stj |}| d }|td |jt j |S) a6Relay ``POST /mcps/{mcp}/tools/{tool}`` to the gateway. 4xx / 5xx responses come back as ``ToolChunk(state=ERROR)`` so the agent loop can reason about failure. Raises :class:`RuntimeError` only if the gateway returns 2xx with no ``chunk`` payload (protocol violation). POST/mcps/z/tools/ argumentsbodyNtext)r&rL)contentstatechunkzgateway returned no chunk for )r6 exec_requestrr5r+r _safe_detailr ERRORjsonloadsget RuntimeErrormodel_validate)r7rDstatusrJpayload chunk_dicts r9__call__zGatewayMCPTool.__call__s"]77  >> ' 333r;N)rrrrrrr r!)r<rr=rr r )rDrr r) __name__ __module__ __qualname____doc__r__annotations__rr:rCr[r;r9rr8sF#####* * * * X    $444444r;rcveZdZUdZedZded<dd Zd d d dZd!dZ d"d#dZ d$dZ d%dZ d&dZ dS)'GatewayMCPClientuaAn :class:`MCPClient` whose protocol logic is replaced by gateway-relayed calls. Constructed from the dict returned by ``GET /mcps`` (or freshly from user input via :meth:`GatewayClient.make_client`). The local MCP machinery is short-circuited entirely: * ``model_post_init`` does nothing (parent's ``_initialize_client`` is never called — no stdio context manager is built). * ``connect`` registers the MCP on the gateway via ``POST /mcps``. * ``close`` deregisters via ``DELETE /mcps/{name}``. * ``list_raw_tools`` / ``get_tool`` fetch and wrap upstream tools. N)defaultz'GatewayClient | None'r6_GatewayMCPClient__contextrr r!cdS)uxNo-op — the parent builds local stdio/HTTP transport, which the gateway-relayed client does not need. Nra)r7res r9model_post_initz GatewayMCPClient.model_post_inits  r;F connectedrrrirc*||_|r d|_dSdS)aWire this client to a gateway facade. Instances come out of ``model_validate(spec)`` with the public field surface set but no transport wiring. ``attach`` injects it so :meth:`connect` / :meth:`close` / :meth:`list_raw_tools` can talk to the gateway. Args: gateway (`GatewayClient`): Facade dispatching calls through :meth:`GatewayClient.exec_request`. connected (`bool`, defaults to `False`): When ``True``, mark this client as already connected (used by :meth:`GatewayClient.list_mcps` for entries the gateway is already serving). TN)r6 _is_connected)r7rris r9attachzGatewayMCPClient.attachs+,   &!%D    & &r;c <K|jrtd|jd|jJ|d}|jdd|d{V\}}|d kr(td |jd t ||d |_dS) aRRegister this MCP on the gateway via ``POST /mcps``. All MCPs (stateless and stateful) must be registered so that ``/mcps/{name}/tools/{tool}`` can locate the client. Raises: `RuntimeError`: Already connected, gateway unreachable, or gateway returned 4xx/5xx. MCP z8 is already connected. Call close() before reconnecting.NrS)moderF/mcpsrIrKzgateway failed to add MCP : T)rkrVr+r6 model_dumprPrQ)r7rJrX resp_bodys r9connectzGatewayMCPClient.connects   4ty444 }(((F++"&-"<"<  #=# #        S==5TY55 2255 "r;T ignore_errorsc RK|js|rdStd|jd|jJ |jdd|jd{V\}}|dkr*|s(td|jdt ||n#t $r|sYnwxYwd |_dS) zDeregister this MCP via ``DELETE /mcps/{name}``. Args: ignore_errors (`bool`, defaults to `True`): Suppress "not connected" precondition and gateway 4xx/5xx. Mirrors :meth:`MCPClient.close`. Nrnz( is not connected. Call connect() first.DELETErGrKzgateway failed to remove MCP rqF)rkrVr+r6rPrQ Exception)r7rurXrss r9closezGatewayMCPClient.closes/!  LtyLLL }((( &*m&@&@$$$''!!!!!! FI}}]}"9DI99#FI6699        #sAB BBlist[mcp.types.Tool]c vKjJjddjdd{V\}}|dkr(tdjdt ||t j|}d|D}|_jfd |D}j fd |D}|S) aFetch upstream tools via ``GET /mcps/{name}/tools``. Returns raw :class:`mcp.types.Tool` descriptors (upstream names, no ``mcp__`` prefix) so the inherited :meth:`get_tool` can re-wrap them like a local :class:`MCPClient`. The unfiltered list is cached; the returned list has ``enable_tools`` / ``disable_tools`` applied. Raises: `RuntimeError`: Gateway returned non-2xx. NGETrGz/toolsrKz%gateway failed to list tools for MCP rqcVg|]&}tjj|'Sra)mcptypesToolrW).0ds r9 z3GatewayMCPClient.list_raw_tools..*s*DDD!SY^22155DDDr;c0g|]}|jjv|Sra)r+ enable_toolsrtr7s r9rz3GatewayMCPClient.list_raw_tools..0s(MMMq4;L1L1L1L1L1Lr;c0g|]}|jjv|Sra)r+ disable_toolsrs r9rz3GatewayMCPClient.list_raw_tools..2s/d6H(H(H(H(H(Hr;) r6rPr+rVrQrSrT _cached_toolsrr)r7rXrJdata raw_toolss` r9list_raw_toolszGatewayMCPClient.list_raw_toolss3}(((!]77  &TY & & &         S==0 00--00 z$DDtDDD &   (MMMMIMMMI   )$Ir;r+rrcK|j|d{V|jpgD]$}|j|kr||cS%t d|d|jd)uLook up a single tool by upstream name and wrap it. Falls back to :meth:`list_raw_tools` on cache miss, then searches the unfiltered cache so tools that ``enable_tools`` / ``disable_tools`` would have hidden are still resolvable — matching :meth:`MCPClient.get_tool`. Raises: `ValueError`: No tool with that upstream name exists on the gateway. NzTool z not found in MCP .)rrr+ _wrap_tool ValueError)r7r+raws r9get_toolzGatewayMCPClient.get_tool7s   %%%'' ' ' ' ' ' ' '%+ , ,Cx4s+++++  ``. timeout (`float | None`, defaults to `None`): Per-request timeout forwarded to :meth:`BackendBase.exec_shell`; ``None`` waits indefinitely. inline_limit (`int`, defaults to `BODY_INLINE_LIMIT`): Response bodies above this size spill through a sandbox tempfile rather than base64-inline through stdout. tmp_dir (`str`, defaults to `SANDBOX_TMP_DIR`): Sandbox directory for request/response tempfiles. Must be writable by the gateway process. gateway_log_path (`str | None`, defaults to `None`): Sandbox-side path of the gateway's stdout/stderr log file. When set, :meth:`exec_request` failures trigger a ``/health`` probe and — if the gateway is unreachable — a tail of this log is emitted at ``ERROR`` level to help diagnose crashes. auth_token (`str | None`, defaults to `None`): Optional bearer token forwarded to the gateway by the in-sandbox shim. instance_nonce (`str | None`, defaults to `None`): Optional nonce expected from ``/health``. Used by shared network backends to make sure the probed port belongs to the gateway process that was just launched before sending auth. g@iN) rrrrrrrr_health_probe_timeout_log_tail_bytes) r7rrrrrrrrs r9r:zGatewayClient.__init__is[Z ( ( 0$,-0"%)r;rcK |dddd{V\}}n#t$rYdSwxYw|dkrdS|jdS tj|}n##tjt tf$rYdSwxYwt|tsdS| d}t|toF| o2|j otj||jS) ukProbe ``/health``. any other outcome (shim transport failure, non-200) → ``False``. With no expected ``instance_nonce``, HTTP 200 means healthy. When a nonce is configured, the response must be a JSON object containing the matching ``instance_nonce``. Transport failures, non-200 responses, malformed JSON, non-object JSON, and nonce mismatches return ``False``. The ``/health`` path is treated specially by :meth:`exec_request` — it never triggers the failure diagnostic, so a dead gateway does not recursively probe itself. r|/healthF) include_authNTr)rPrxrrSrTJSONDecodeErrorUnicodeDecodeError TypeError isinstancer.rUrisasciisecretscompare_digest)r7rXrJrYnonces r9healthzGatewayClient.healthsT !%!2!2""3""LFDD    55  S==5   &4 j&&GG$&8)D   55 '4(( 5 ,-- uc " " C  C#++-- C&ud.ABB  s!& 44 AA>=A>list[GatewayMCPClient]cKddd{V\}}|dkr tdt||tj|}fd|DS)u>Fetch every MCP the gateway is currently serving. Returned clients are marked already-connected (via :meth:`GatewayMCPClient.attach`) — the gateway is already maintaining their upstream sessions. Raises: `RuntimeError`: Gateway returned non-2xx. r|rpNrKzgateway failed to list MCPs: c>g|]}|dS)Trh) make_client)rspecr7s r9rz+GatewayClient.list_mcps..s,III4   66IIIr;)rPrVrQrSrT)r7rXrJspecss` r9 list_mcpszGatewayClient.list_mcpss"..ug>>>>>>>>  S==L VT0J0JLL  4  IIII5IIIIr;Frhrdict[str, Any]rirccht|}||||S)uBuild a :class:`GatewayMCPClient` wired to this gateway. Args: spec (`dict[str, Any]`): ``MCPClient.model_dump(mode="json")`` payload — either from ``GET /mcps`` or from user input via ``add_mcp``. connected (`bool`, defaults to `False`): Mark the client as already-connected. Set by :meth:`list_mcps`; leave ``False`` when the caller will ``await client.connect()`` itself. rh)rcrWrl)r7rriclients r9rzGatewayClient.make_clients2""0066 di 000 r;c KdS)uNo-op kept for API parity — the transport holds no host-side resources, but callers keep their shutdown idiom. Nra)r7s r9aclosezGatewayClient.acloses  r;T)rJrmethodpathrJrrtuple[int, bytes]c Kd}d}|m|jdtjjd}|}|j|t j|ddd{V |j dd t|d |j ||t|j |j|r |jpdndg |j d{V}|2 |j|d{VnJ#t"$rYn>wxYwn9#|2 |j|d{Vw#t"$rYwwxYwwxYw|jd kr;t'd |jd|jddd t j|j}n2#t"$r%} t'd|jdd| d} ~ wwxYwt1|d} | dkr&t'd|ddd|vrZ|d} |j| d{V} |j| d{Vn8#t"$rYn,wxYwt7j|dd} | | fS#t"$r)} |dkr|||| d{Vd} ~ wwxYw)uRelay one HTTP request through the sandbox. Writes ``body`` (if any) to a sandbox tempfile, runs ``python3 -c ...`` inside the sandbox via :meth:`BackendBase.exec_shell`, and parses the JSON envelope the shim prints on stdout. Inline bodies are base64-decoded; oversized bodies are pulled back through ``body_file``. Request and response tempfiles are best-effort cleaned up. On any failure — shim non-zero exit, non-JSON stdout, or ``status == -1`` transport error — a self-diagnostic step probes ``/health`` and, if the gateway is unreachable, tails :attr:`gateway_log_path` at ``ERROR`` level so the real crash cause reaches the host log stream. The original exception is always re-raised so the caller's error contract is unchanged. The ``/health`` path itself skips diagnosis to avoid recursing on a dead gateway. Args: method (`str`): HTTP verb (``GET`` / ``POST`` / ``DELETE``). path (`str`): Path-only URL, e.g. ``/mcps//tools/``. body (`Any`, optional): JSON-serializable request body; ``None`` for no body. include_auth (`bool`, defaults to `True`): Whether to send the configured bearer token to the shim. Health probes set this to ``False`` so a port-race cannot leak the token to a process that is not the gateway. Returns: `tuple[int, bytes]`: Status code + raw response bytes (callers decode). Raises: `RuntimeError`: Shim crash (non-zero exit / non-JSON stdout) or transport failure (``status == -1``). r%N/z.jsonF) ensure_asciizutf-8python3z-czhttp://127.0.0.1:)rrzgateway shim exited with rqreplaceerrorsiz'gateway shim produced non-JSON stdout: rrXzgateway request failed: errorz unknown error body_filerJr)ruuiduuid4hexr write_filerSdumpsencode exec_shellrrrrrr delete_pathrx exit_coderVstderrdecoderTstdoutrrU read_filebase64 b64decode_diagnose_failure)r7rrrJrrwrote_body_fileresultenverXspilled body_bytesexcs r9rPzGatewayClient.exec_requests^ &*  <AA$*,,*:AAAI'O,)) 4e444;;GDD        <  -1\-D-D!#ED,=EtEE!D-.. 3?G.BR !L.E . . ( ( ( ( ( (#."l66GGGGGGGGGG$/?."l66GGGGGGGGGG$/ 1$$"F0@FF}++9+==dsdCFF  j//   "/}TcT*//  X''F||";www88;; c!!k*#'<#9#9'#B#BBBBBBB ,227;;;;;;;;;; D$-cggfb.A.ABB :% %   y  ,,VT3?????????   s8A!DJ% C=<J%= D J% D  J%E D32E3 E=E?EEA J%F('J%( G2 GGA0J% I)(J%) I63J%5I66.J%% K/$KKr BaseExceptioncK |d{V}n#t$rd}YnwxYw|rdStjd||||j|jdS |j|jd{V}n3#t$r&}tjd|j|Yd}~dSd}~wwxYw||j dd}tjdt||j|dS)uXBest-effort post-failure diagnostic invoked by :meth:`exec_request` on any request failure. Probes ``/health`` (via :meth:`health`, which short-circuits the diagnostic path); if the gateway does not answer, emits the tail of :attr:`gateway_log_path` at ``ERROR`` level so the real crash cause reaches the host log stream. Every step is guarded — diagnosis must never raise, so the caller's original exception is always the one that surfaces. Args: method (`str`): HTTP verb of the failed request (for log context). path (`str`): Path of the failed request (for log context). exc (`BaseException`): Original exception raised by the shim call (for log context; not re-raised here). NFzfGateway unreachable during %s %s: %s. Probing /health failed. Attempting to tail gateway log at %r ...z$Failed to read gateway log at %r: %srrz*Gateway log tail (last %d bytes of %r): %s) rrxrrrrrrrlen)r7rrrhealthy log_bytesread_exctails r9rzGatewayClient._diagnose_failureust2  KKMM))))))GG   GGG    F  7     !      ( F "l44T5JKKKKKKKKII    L6%    FFFFF  $..00188 8JJ 9 II  !       s$ ..%B B2 B--B2)rrrrrrrrrrrrrrrrr r!)r r)r r)rrrirr rcr) rrrrrJrrrr r)rrrrrrr r!) r\r]r^r_rrr:rrrrrPrrar;r9rr`s!%-&'+!%%););););););)z& & & & PJJJJ. *! uuuuuun@ @ @ @ @ @ r;rrXrrJbytesr rc tj|}n4#t$r'd|d|dddcYSwxYwt |t rd|vrd|d|dSd|dt |ddS)uBest-effort ``HTTP : `` string from a gateway error response — tolerates non-JSON, missing ``detail``, etc. zHTTP rqNrrrdetail)rSrTrxrrr.r)rXrJrs r9rQrQsGz$ GGGFvFFdsd!2!2)!2!D!DFFFFFG$2(d"2"21v11h111 .6 . .SYYtt_ . ..s.AA)rXrrJrr r)#r_ __future__rrrSrrtypingrr mcp.typesr~pydanticr_loggingrr r@r permissionr r rr r _gateway_shimrrrrrrrcrrQrar;r9rs,#"""""  %%%%%%%% %%%%%%'&&&&&&& /........ b4b4b4b4b4Xb4b4b4Pz z z z z yz z z @U U U U U U U U v / / / / / /r;