jpmschweitzer/odysseus
1
0
Fork 0
mirror of https://github.com/pewdiepie-archdaemon/odysseus.git synced 2026-10-18 12:52:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat(runtime): bind remote and owned resources to authority

Browse Source
This commit is contained in:
Alexandre Teixeira
2026-10-02 03:00:46 +01:00
parent ba3e631d58
commit 571f685ad5
23 changed files with 2491 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/tool_approvals.py
+45 -2
View File
@@ -29,6 +29,8 @@ from src.agent_runtime.authority import RequestAuthority
if TYPE_CHECKING:
from src.agent_runtime.resource_binding import BoundFilesystemOperation
from src.agent_runtime.remote_resources import BoundBackendOperation
from src.agent_runtime.owned_resources import BoundOwnedOperation
DEFAULT_APPROVAL_TTL_SECONDS = 10 * 60
@@ -123,6 +125,8 @@ def _binding_payload(
result_integrity: str,
request_authority: RequestAuthority | None = None,
resource_operation=None,
backend_operation=None,
owned_operation=None,
) -> dict[str, Any]:
return {
"owner": _normalized_owner(owner),
@@ -145,6 +149,8 @@ def _binding_payload(
"result_integrity": str(result_integrity),
"request_authority": request_authority.to_dict() if request_authority is not None else None,
"resource_operation": resource_operation.to_dict() if resource_operation is not None else None,
"backend_operation": backend_operation.to_dict() if backend_operation is not None else None,
"owned_operation": owned_operation.to_dict() if owned_operation is not None else None,
}
@@ -176,6 +182,8 @@ class PendingToolApproval:
request_authority: RequestAuthority | None = None
# Server-resolved targets at proposal time; never read from the approval UI.
resource_operation: BoundFilesystemOperation | None = None
backend_operation: BoundBackendOperation | None = None
owned_operation: BoundOwnedOperation | None = None
def public_payload(self, *, reason: str | None = None) -> dict[str, Any]:
return {
@@ -286,6 +294,8 @@ class ExactToolApproval:
result_integrity=result_integrity,
request_authority=self.pending.request_authority,
resource_operation=self.pending.resource_operation,
backend_operation=self.pending.backend_operation,
owned_operation=self.pending.owned_operation,
)
return _canonical_digest(expected) == self.pending.digest
@@ -370,6 +380,7 @@ class ToolApprovalStore:
capabilities: ToolCapabilities,
request_text: Any = "",
request_authority: RequestAuthority | None = None,
client_runtime_context: dict | None = None,
) -> PendingToolApproval:
if request_authority is not None and not isinstance(request_authority, RequestAuthority):
raise TypeError("Approval authority must be server-owned RequestAuthority")
@@ -378,10 +389,38 @@ class ToolApprovalStore:
from src.agent_runtime.resource_binding import NATIVE_FILESYSTEM_TOOLS, resolve_filesystem_operation
from src.agent_runtime.resources import FilesystemRoot
resource_operation = None
if tool_name in NATIVE_FILESYSTEM_TOOLS:
backend_operation = None
owned_operation = None
from src.agent_runtime.remote_resources import BoundBackendOperation, resolve_backend
from src.agent_runtime.owned_resources import needs_owned_binding, resolve_owned_operation
from src.agent_runtime.resources import NativeBackendResource
try:
operation = ExactOperation.normalize(tool_name, content)
backend = resolve_backend(operation.transport_tool, context=client_runtime_context, content=operation.input, owner=_normalized_owner(owner))
if request_authority is not None and request_authority.inherited:
if not request_authority.permits(operation) or backend not in request_authority.backend_resources:
raise ValueError("Child approval exceeds originating authority")
backend_operation = BoundBackendOperation(backend,
request_authority.request_id if request_authority is not None else "",
_normalized_owner(owner), str(session_id or ""), operation.transport_tool, operation.input)
if isinstance(backend, NativeBackendResource) and needs_owned_binding(operation):
resolved_owned = resolve_owned_operation(operation, owner=_normalized_owner(owner),
thread_id=str(session_id or ""), request_id=backend_operation.request_id,
document_id=document_id)
if request_authority is not None and request_authority.inherited:
if not all(any(scope.permits(r) for scope in request_authority.owned_scopes) for r in resolved_owned.resources):
raise ValueError("Child approval exceeds originating record scope")
owned_operation = resolved_owned
if owned_operation.document_id:
document_id = owned_operation.document_id
document_version = owned_operation.document_version
document_digest = owned_operation.document_digest
except (ValueError, TypeError, OSError, RuntimeError, AttributeError):
pass # Unresolved proposals are never reconstructed at execution.
if tool_name in NATIVE_FILESYSTEM_TOOLS and backend_operation is not None and isinstance(backend_operation.resource, NativeBackendResource):
try:
roots = request_authority.resource_roots if request_authority is not None else ()
if not roots and workspace:
if not roots and workspace and (request_authority is None or not request_authority.inherited):
roots = (FilesystemRoot.seal(workspace, owner=_normalized_owner(owner)),)
resource_operation = resolve_filesystem_operation(
ExactOperation.normalize(tool_name, content), roots=roots, workspace=workspace or "",
@@ -409,6 +448,8 @@ class ToolApprovalStore:
result_integrity=result_integrity,
request_authority=request_authority,
resource_operation=resource_operation,
backend_operation=backend_operation,
owned_operation=owned_operation,
)
pending = PendingToolApproval(
approval_id=secrets.token_urlsafe(32),
@@ -434,6 +475,8 @@ class ToolApprovalStore:
request_text=str(request_text or ""),
request_authority=request_authority,
resource_operation=resource_operation,
backend_operation=backend_operation,
owned_operation=owned_operation,
)
with self._lock:
self._purge_expired_locked(now)