newt-core 0.8.2

Newt-Agent core types, errors, and the NeMoCode-style tier router
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88

//! #2796: real worker/host execution grounds command discovery without a host which.
//! Runs in the normal workspace test job; no model server or installed tools needed.

fn main() {
    if let Some(code) = newt_core::maybe_dispatch() {
        std::process::exit(code);
    }
    #[cfg(unix)]
    tokio::runtime::Runtime::new().unwrap().block_on(run());
}

#[cfg(unix)]
async fn run() {
    use agent_bridle::{Caveats, Gate, Tool};
    use std::os::unix::fs::PermissionsExt;
    let root = tempfile::tempdir().unwrap();
    let root = root.path().canonicalize().unwrap();
    let bin = root.join("bin with spaces");
    std::fs::create_dir(&bin).unwrap();
    for name in ["gh", "git"] {
        let path = bin.join(name);
        std::fs::write(&path, "#!/bin/sh\nexit 99\n").unwrap();
        std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o755)).unwrap();
    }
    let mut passed = true;
    for tool in [
        Box::new(agent_bridle::BrushShellTool::new()) as Box<dyn Tool>,
        Box::new(agent_bridle::HostShellTool::new()),
    ] {
        let cx = Gate::new(0)
            .authorize(tool.as_ref(), &Caveats::top())
            .unwrap();
        for (cmd, expected, status) in [
            (
                "which gh && which git",
                format!("{}/gh\n{}/git\n", bin.display(), bin.display()),
                0,
            ),
            ("which missing_2796", String::new(), 1),
            (
                "printf ignored | which git",
                format!("{}/git\n", bin.display()),
                0,
            ),
            (
                "PATH='bin with spaces'; which gh",
                "bin with spaces/gh\n".into(),
                0,
            ),
        ] {
            let out = tool
                .invoke(
                    serde_json::json!({
                        "cmd": cmd, "cwd": root, "env": {"PATH": bin}
                    }),
                    &cx,
                )
                .await
                .unwrap();
            if (out["exit_code"].as_i64().unwrap() == 0) != (status == 0)
                || out["stdout"] != expected
            {
                eprintln!("{cmd}: expected {status}/{expected:?}, got {out}");
                passed = false;
            }
        }
    }
    assert!(passed, "#2796 shell discovery regression");

    // Discovering a command must not grant permission to execute it.
    let tool = agent_bridle::BrushShellTool::new();
    let caveats = Caveats {
        exec: agent_bridle::Scope::only(["unrelated-command".to_owned()]),
        ..Caveats::top()
    };
    let cx = Gate::new(0).authorize(&tool, &caveats).unwrap();
    let out = tool
        .invoke(
            serde_json::json!({
                "cmd": "which gh && gh", "cwd": root, "env": {"PATH": bin}
            }),
            &cx,
        )
        .await
        .unwrap();
    assert_eq!(out["denied"], true, "lookup must not authorize gh: {out}");
    assert_eq!(out["stdout"], format!("{}/gh\n", bin.display()), "{out}");
}