feat(tools): add sandboxed code-execution tool (§6.7) - #321
Open
gnanirahulnutakki wants to merge 3 commits into
Open
feat(tools): add sandboxed code-execution tool (§6.7)#321gnanirahulnutakki wants to merge 3 commits into
gnanirahulnutakki wants to merge 3 commits into
Conversation
Adds crates/code-execution (ardur-code-execution), Phase 1 of the §6.7
code-execution blueprint: a closed LanguageAdapter trait with Bash and
Python adapters, a cap-token-shaped CodeExecutionCaveat that attenuates
every request (language allowlist, timeout ceiling, tool-callback
allowlist intersection that never widens, forced expose_stderr override,
output-size ceiling), a code.exec.{requested,completed,failed,tool_denied}.v1
receipt forest, and a CodeExecutionTool (code.exec) gated by
Capability::ProcessSpawn plus a custom code_execution capability that
scans captured stdout through ardur-injection-defense before returning it.
Tool-call RPC (a running script dispatching back into the tool registry),
Node/Rust adapters, and routing through the §6.3 backend matrix / §11.5
sandbox runtime are out of scope here — none of those crates exist yet in
this workspace. Documented as explicit Phase 2 TODOs; every dispatch in
this crate is unsandboxed local process execution until §11.5 lands.
Browser automation (§6.9/§6.10) already ships as crates/browser and is
not duplicated here.
Checkpoint: architect/sessions/2026-07-14-code-execution-6.7/journal.md
Signed-off-by: Gnani Nutakki <gnani.nutakki@gmail.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
5 tasks
gnanirahulnutakki
added a commit
that referenced
this pull request
Jul 17, 2026
## Summary
- Adds `crates/computer-use` (`ardur-computer-use`), Phase 1 of the
§6.13 computer-use blueprint: a closed 10-action vocabulary (`capture`,
`click`, `double_click`, `right_click`, `middle_click`, `drag`,
`scroll`, `type`, `key`, `wait`), an in-substrate `BlockedActionPolicy`
denylist (5 hard-blocked key combos + 6 dangerous-text patterns, adapted
from Hermes's `computer_use/tool.py:80-107`) enforced **regardless** of
cap-token or consent state, a cap-token-shaped `ComputerUseCaveat`
(per-action-kind permitted set), a session-scoped `ConsentBroker`
(grant/revoke/TTL), the
`computer.{session.started,consent.granted,consent.revoked,action.invoked,action.denied,screenshot.taken}.v1`
receipt family with a `DenialSource` that distinguishes
blocked-action/cap-token/consent refusals, and a `ComputerUseTool`
(`computer.use`) gated by a custom `computer_use` capability. Gate
order: denylist → caveat → consent.
- Phase 1 backend (`LocalInputDriver`) uses `enigo` (mouse/keyboard
synthesis) + `xcap` (screen capture) over **public** macOS APIs. The
blueprint's own MVP decision explicitly rejects the private SkyLight-SPI
path Hermes uses (`SLEventPostToPid`, etc.), gating it behind a separate
`computer_use_skylight_spi` cap-token caveat reserved for a future phase
— so this PR isn't under-delivering relative to the blueprint's own
stated MVP scope.
- Documented Phase 2 TODOs in `lib.rs`:
`set_value`/`list_apps`/`focus_app` (need `AXUIElement`
accessibility-tree access, which neither `enigo` nor `xcap` expose), the
`som`/`ax` capture modes,
`AXIsProcessTrustedWithOptions`/`CGPreflightScreenCaptureAccess`
OS-permission preflight, a real interactive consent dialog UI
(`ConsentBroker` ships the state machine only), and cap-token-to-caveat
projection from a verified Biscuit block.
- Companion PR to #321 (§6.7 code-execution) — together they close the
`/goal` directive's tool-surface domain (code-execution +
browser/computer-use). Browser automation (§6.9/§6.10) already ships as
`crates/browser` and is not touched here.
## Test plan
- [x] `cargo build -p ardur-computer-use`
- [x] `cargo test -p ardur-computer-use` (33/33 passing —
denylist/caveat/consent gate-order tests, action-parsing tests, and a
`wait` dispatch test; deliberately no test exercises real
click/type/screenshot execution, since that would require
Accessibility/ScreenRecording permission granted to the CI runner)
- [x] `cargo fmt --check`
- [x] `cargo clippy -p ardur-computer-use --all-targets -- -D warnings`
- [x] `cargo check --workspace --all-features` (no cross-crate breakage
from the new `enigo`/`xcap`/`image`/`hex` dependencies)
---------
Signed-off-by: Ardur <team@ardur.ai>
Co-authored-by: ArdurAI <team@ardur.ai>
added 2 commits
July 17, 2026 17:20
Signed-off-by: ArdurAI <team@ardur.ai>
…7-2026-07-14 Signed-off-by: ArdurAI <team@ardur.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
crates/code-execution(ardur-code-execution), Phase 1 of the §6.7 code-execution blueprint: closedLanguageAdaptertrait (Bash + Python),CodeExecutionCaveatcap-token-shaped attenuation (language allowlist, timeout ceiling, tool-callback allowlist that only ever narrows, forcedexpose_stderroverride, output-size ceiling), acode.exec.{requested,completed,failed,tool_denied}.v1receipt forest, and aCodeExecutionTool(code.exec) gated byCapability::ProcessSpawn+ a customcode_executioncapability that scans captured stdout throughardur-injection-defensebefore returning it.// TODO §6.7 Phase 2inlib.rs): tool-call RPC transport (the script cannot yet call back into the tool registry —tool_allowlistis accepted/attenuated/receipted as a stated intent only), Node/Rust adapters, and routing through the §6.3 backend matrix / §11.5 sandbox runtime — neither crate exists yet in this workspace, so every dispatch here is unsandboxed local process execution until §11.5 lands.crates/browserand is not duplicated by this PR — confirmed viadocs/current-status.mdand the crate's existingbrowser.navigate/click/type/screenshot/extracttools before starting this work.Test plan
cargo build -p ardur-code-executioncargo test -p ardur-code-execution(19/19 passing — fullTool::invokeround trips against realbash/python3subprocesses, not mocks)cargo fmt --checkcargo clippy -p ardur-code-execution --all-targets -- -D warningscargo check --workspace --all-features(no cross-crate breakage)origin/devand re-verified green