{part.state.status === "error" ? part.state.error : "Sub-agent failed"}
diff --git a/apps/desktop/src/renderer/components/chat/tool-card.test.tsx b/apps/desktop/src/renderer/components/chat/tool-card.test.tsx
deleted file mode 100644
index 538d56fa..00000000
--- a/apps/desktop/src/renderer/components/chat/tool-card.test.tsx
+++ /dev/null
@@ -1,60 +0,0 @@
-import { describe, expect, test } from "bun:test"
-import { renderToStaticMarkup } from "react-dom/server"
-import { ToolCard } from "./tool-card"
-
-describe("ToolCard", () => {
- test("renders without a left-edge category accent", () => {
- const markup = renderToStaticMarkup(
-
} title="Shell" category="run" />,
- )
-
- expect({
- hasTitle: markup.includes(">Shell<"),
- hasLeftBorderAccent: markup.includes("border-l-"),
- }).toEqual({
- hasTitle: true,
- hasLeftBorderAccent: false,
- })
- })
-
- test("does not render collapsed lazy content", () => {
- let renderCount = 0
- const markup = renderToStaticMarkup(
-
}
- title="Shell"
- hasContent
- renderContent={() => {
- renderCount += 1
- return
expensive output
- }}
- />,
- )
-
- expect({ renderCount, hasContent: markup.includes("expensive output") }).toEqual({
- renderCount: 0,
- hasContent: false,
- })
- })
-
- test("renders lazy content when forced open", () => {
- let renderCount = 0
- const markup = renderToStaticMarkup(
-
}
- title="Shell"
- hasContent
- forceOpen
- renderContent={() => {
- renderCount += 1
- return
error output
- }}
- />,
- )
-
- expect({ renderCount, hasContent: markup.includes("error output") }).toEqual({
- renderCount: 1,
- hasContent: true,
- })
- })
-})
diff --git a/apps/desktop/src/renderer/components/chat/tool-card.tsx b/apps/desktop/src/renderer/components/chat/tool-card.tsx
deleted file mode 100644
index 470153fe..00000000
--- a/apps/desktop/src/renderer/components/chat/tool-card.tsx
+++ /dev/null
@@ -1,200 +0,0 @@
-import {
- Collapsible,
- CollapsibleContent,
- CollapsibleTrigger,
-} from "@devo/ui/components/collapsible"
-import { Tooltip, TooltipContent, TooltipTrigger } from "@devo/ui/components/tooltip"
-import { cn } from "@devo/ui/lib/utils"
-import { ChevronRightIcon } from "lucide-react"
-import type { ReactNode } from "react"
-import { memo, useState } from "react"
-
-// ============================================================
-// Tool categories — used by grouping and metrics.
-// ============================================================
-
-export type ToolCategory =
- | "explore"
- | "edit"
- | "run"
- | "delegate"
- | "plan"
- | "ask"
- | "fetch"
- | "other"
-
-export function getToolCategory(tool: string): ToolCategory {
- switch (tool) {
- case "read":
- case "glob":
- case "grep":
- case "list":
- return "explore"
- case "edit":
- case "write":
- case "apply_patch":
- return "edit"
- case "bash":
- return "run"
- case "task":
- return "delegate"
- case "todowrite":
- case "todoread":
- return "plan"
- case "question":
- case "request_user_input":
- return "ask"
- case "webfetch":
- return "fetch"
- default:
- return "other"
- }
-}
-
-// ============================================================
-// ToolCard — collapsible wrapper with icon, title, subtitle
-// ============================================================
-
-interface ToolCardProps {
- icon: ReactNode
- title: string
- subtitle?: string
- /** Right-aligned element in the header (duration, status, etc.) */
- trailing?: ReactNode
- /** Category for grouping and metrics */
- category?: ToolCategory
- /** Whether the card should be open by default */
- defaultOpen?: boolean
- /** Force the card open (for errors, permissions) */
- forceOpen?: boolean
- /** Whether the card has expandable content */
- hasContent?: boolean
- /** Status indicator */
- status?: "running" | "error" | "completed" | "pending"
- /** Expandable content */
- children?: ReactNode
- /** Lazily renders expandable content only after the card opens. */
- renderContent?: () => ReactNode
-}
-
-export const ToolCard = memo(function ToolCard({
- icon,
- title,
- subtitle,
- trailing,
- defaultOpen = false,
- forceOpen = false,
- hasContent = false,
- status,
- children,
- renderContent,
-}: ToolCardProps) {
- const [isOpen, setIsOpen] = useState(defaultOpen || forceOpen)
- const open = forceOpen || isOpen
- const showContent = hasContent && (children != null || renderContent != null)
- const content = open ? (renderContent ? renderContent() : children) : null
-
- const isError = status === "error"
- const isRunning = status === "running" || status === "pending"
-
- if (!showContent) {
- // Non-expandable: simple row
- return (
-
-
- {icon}
-
-
- {title}
-
- {subtitle && (
-
- }>
- {subtitle}
-
-
- {subtitle}
-
-
- )}
- {trailing &&
{trailing}}
-
- )
- }
-
- // Expandable: collapsible card
- return (
-
-
-
- }
- >
-
-
- {icon}
-
-
- {title}
-
- {subtitle && (
-
{subtitle}
- )}
- {trailing && (
-
{trailing}
- )}
-
-
- {open && {content}
}
-
-
- )
-})
diff --git a/apps/desktop/src/renderer/components/chat/tool-category.test.ts b/apps/desktop/src/renderer/components/chat/tool-category.test.ts
new file mode 100644
index 00000000..9a2cbb81
--- /dev/null
+++ b/apps/desktop/src/renderer/components/chat/tool-category.test.ts
@@ -0,0 +1,40 @@
+import { describe, expect, test } from "bun:test"
+import { getToolCategory } from "./tool-category"
+
+describe("getToolCategory", () => {
+ test("maps known tools to their category and falls back to other", () => {
+ expect({
+ read: getToolCategory("read"),
+ glob: getToolCategory("glob"),
+ grep: getToolCategory("grep"),
+ list: getToolCategory("list"),
+ edit: getToolCategory("edit"),
+ write: getToolCategory("write"),
+ applyPatch: getToolCategory("apply_patch"),
+ bash: getToolCategory("bash"),
+ task: getToolCategory("task"),
+ todowrite: getToolCategory("todowrite"),
+ todoread: getToolCategory("todoread"),
+ question: getToolCategory("question"),
+ requestUserInput: getToolCategory("request_user_input"),
+ webfetch: getToolCategory("webfetch"),
+ unknownMcp: getToolCategory("some_mcp_tool"),
+ }).toEqual({
+ read: "explore",
+ glob: "explore",
+ grep: "explore",
+ list: "explore",
+ edit: "edit",
+ write: "edit",
+ applyPatch: "edit",
+ bash: "run",
+ task: "delegate",
+ todowrite: "plan",
+ todoread: "plan",
+ question: "ask",
+ requestUserInput: "ask",
+ webfetch: "fetch",
+ unknownMcp: "other",
+ })
+ })
+})
diff --git a/apps/desktop/src/renderer/components/chat/tool-category.ts b/apps/desktop/src/renderer/components/chat/tool-category.ts
new file mode 100644
index 00000000..858eff46
--- /dev/null
+++ b/apps/desktop/src/renderer/components/chat/tool-category.ts
@@ -0,0 +1,43 @@
+// ============================================================
+// Tool categories — used by grouping and metrics.
+// ============================================================
+
+export type ToolCategory =
+ | "explore"
+ | "edit"
+ | "run"
+ | "delegate"
+ | "plan"
+ | "ask"
+ | "fetch"
+ | "other"
+
+export function getToolCategory(tool: string): ToolCategory {
+ switch (tool) {
+ case "read":
+ case "glob":
+ case "grep":
+ case "list":
+ return "explore"
+ case "edit":
+ case "write":
+ case "apply_patch":
+ return "edit"
+ case "bash":
+ case "shell_command":
+ case "exec_command":
+ return "run"
+ case "task":
+ return "delegate"
+ case "todowrite":
+ case "todoread":
+ return "plan"
+ case "question":
+ case "request_user_input":
+ return "ask"
+ case "webfetch":
+ return "fetch"
+ default:
+ return "other"
+ }
+}
diff --git a/apps/desktop/src/renderer/components/chat/transcript-disclosure.tsx b/apps/desktop/src/renderer/components/chat/transcript-disclosure.tsx
index 13bfcf49..e19fc11d 100644
--- a/apps/desktop/src/renderer/components/chat/transcript-disclosure.tsx
+++ b/apps/desktop/src/renderer/components/chat/transcript-disclosure.tsx
@@ -89,7 +89,7 @@ export const TranscriptDisclosure = memo(function TranscriptDisclosure({
})
const triggerClassName =
- "flex w-fit max-w-full items-center gap-1.5 border-0 bg-transparent p-0 m-0 text-sm text-muted-foreground/70 transition-colors hover:text-foreground"
+ "flex w-full max-w-full items-center gap-1.5 -mx-1.5 rounded border-0 bg-transparent px-1.5 py-0.5 m-0 text-left text-sm text-muted-foreground/70 transition-colors hover:text-foreground"
export interface TranscriptDisclosureTriggerProps {
label: ReactNode
@@ -109,22 +109,37 @@ export const TranscriptDisclosureTrigger = memo(function TranscriptDisclosureTri
const { isOpen, expandable } = useTranscriptDisclosure()
const ChevronIcon = isOpen ? ChevronDownIcon : ChevronRightIcon
+ // Leading chevron keeps the disclosure affordance at a fixed position;
+ // non-expandable rows render a same-width spacer so icons stay aligned.
+ const chevron = expandable ? (
+
+ ) : (
+
+ )
+ const trailingSlot = trailing ? (
+
{trailing}
+ ) : null
+
if (!expandable) {
return (
+ {chevron}
{leading}
{label}
- {trailing}
+ {trailingSlot}
)
}
return (
-
+
+ {chevron}
{leading}
{label}
-
- {trailing}
+ {trailingSlot}
)
})
@@ -132,16 +147,20 @@ export const TranscriptDisclosureTrigger = memo(function TranscriptDisclosureTri
export interface TranscriptDisclosureContentProps {
children: ReactNode
className?: string
+ /** Indent content under a left guide line (aligned with the chevron) instead of a bordered box. */
+ rail?: boolean
}
export const TranscriptDisclosureContent = memo(function TranscriptDisclosureContent({
children,
className,
+ rail = false,
}: TranscriptDisclosureContentProps) {
return (
{
+ // Called as `devo-linux-sandbox` — apply sandbox then exec.
+ devo_linux_sandbox::run_main();
+ }
other => {
eprintln!("unknown argv[0] alias: {other}");
std::process::exit(1);
@@ -161,14 +167,22 @@ where
.and_then(|s| s.to_str())
.unwrap_or("");
- // Direct alias hit: `devo-server` symlink or bare name.
+ // Direct alias hit: `devo-server` / `devo-linux-sandbox` symlink or bare name.
if file_name == SERVER_ALIAS {
return Some(SERVER_ALIAS);
}
+ if file_name == LINUX_SANDBOX_ALIAS {
+ return Some(LINUX_SANDBOX_ALIAS);
+ }
// Windows batch scripts pass the intended alias via a sentinel arg.
- if args.next().as_deref().is_some_and(is_server_alias_sentinel) {
- return Some(SERVER_ALIAS);
+ if let Some(sentinel) = args.next() {
+ if is_server_alias_sentinel(&sentinel) {
+ return Some(SERVER_ALIAS);
+ }
+ if is_linux_sandbox_alias_sentinel(&sentinel) {
+ return Some(LINUX_SANDBOX_ALIAS);
+ }
}
None
@@ -180,6 +194,12 @@ fn is_server_alias_sentinel(arg: &std::ffi::OsStr) -> bool {
.is_some_and(|rest| rest == SERVER_ALIAS)
}
+fn is_linux_sandbox_alias_sentinel(arg: &std::ffi::OsStr) -> bool {
+ arg.to_str()
+ .and_then(|s| s.strip_prefix(ALIAS_SENTINEL_PREFIX))
+ .is_some_and(|rest| rest == LINUX_SANDBOX_ALIAS)
+}
+
fn server_dispatch_args() -> Vec {
server_dispatch_args_from(std::env::args_os())
}
@@ -346,21 +366,25 @@ fn prepend_path_for_aliases() -> std::io::Result> {
#[cfg(unix)]
{
use std::os::unix::fs::symlink;
- let link = path.join(SERVER_ALIAS);
- symlink(&exe, &link)?;
+ for alias in [SERVER_ALIAS, LINUX_SANDBOX_ALIAS] {
+ let link = path.join(alias);
+ symlink(&exe, &link)?;
+ }
}
#[cfg(windows)]
{
// Each alias gets a .bat script that passes the alias name via a
// sentinel argument.
- let batch = path.join(format!("{SERVER_ALIAS}.bat"));
- std::fs::write(
- &batch,
- format!(
- "@echo off\r\n\"{}\" --devo-alias={SERVER_ALIAS} %*\r\n",
- exe.display()
- ),
- )?;
+ for alias in [SERVER_ALIAS, LINUX_SANDBOX_ALIAS] {
+ let batch = path.join(format!("{alias}.bat"));
+ std::fs::write(
+ &batch,
+ format!(
+ "@echo off\r\n\"{}\" --devo-alias={alias} %*\r\n",
+ exe.display()
+ ),
+ )?;
+ }
}
// ── Prepend to PATH ──
@@ -517,6 +541,30 @@ mod tests {
);
}
+ #[test]
+ fn argv0_alias_detects_linux_sandbox_batch_sentinel() {
+ let args = vec![
+ OsString::from("devo.exe"),
+ OsString::from("--devo-alias=devo-linux-sandbox"),
+ OsString::from("--permission-profile"),
+ OsString::from("{}"),
+ ];
+
+ assert_eq!(
+ super::argv0_alias_from_args(args),
+ Some(super::LINUX_SANDBOX_ALIAS)
+ );
+ }
+
+ #[test]
+ fn argv0_alias_detects_linux_sandbox_symlink_name() {
+ let args = vec![OsString::from("/tmp/devo-arg0/devo-linux-sandbox")];
+ assert_eq!(
+ super::argv0_alias_from_args(args),
+ Some(super::LINUX_SANDBOX_ALIAS)
+ );
+ }
+
#[test]
fn server_dispatch_args_remove_batch_alias_sentinel() {
let args = vec![
diff --git a/crates/cli/Cargo.toml b/crates/cli/Cargo.toml
index f1379c7f..1325f85b 100644
--- a/crates/cli/Cargo.toml
+++ b/crates/cli/Cargo.toml
@@ -19,6 +19,7 @@ devo-server = { workspace = true }
devo-tasks = { workspace = true }
devo-tui = { workspace = true }
devo-util-paths = { workspace = true }
+devo-windows-sandbox = { workspace = true }
devo-arg0 = { workspace = true }
anyhow = { workspace = true }
diff --git a/crates/cli/src/agent_command.rs b/crates/cli/src/agent_command.rs
index 108254f9..dd7a0be0 100644
--- a/crates/cli/src/agent_command.rs
+++ b/crates/cli/src/agent_command.rs
@@ -33,22 +33,13 @@ pub(crate) async fn run_agent(
) -> Result {
let cwd = std::env::current_dir()?;
let config_home = find_devo_home().context("could not determine devo home directory")?;
- let model_catalog = PresetModelCatalog::load_from_config(&config_home, Some(&cwd))?;
- let startup_warnings = model_catalog
- .warnings()
- .iter()
- .map(|warning| {
- format!(
- "Model catalog warning for {}: {}",
- warning.path.display(),
- warning.message
- )
- })
- .collect();
let app_config = FileSystemAppConfigLoader::new(config_home.clone()).load(Some(&cwd))?;
+ let model_catalog = PresetModelCatalog::load_from_config(&app_config.provider.model_overrides)?;
let project_key = project_config_key(&cwd);
let permission_preset =
initial_permission_preset(&app_config, &project_key, dangerously_skip_permissions);
+ let sandbox_profile =
+ initial_sandbox_profile(&app_config, &project_key, dangerously_skip_permissions);
let (onboarding_mode, resolved) = resolve_initial_provider_settings(
force_onboarding,
&app_config,
@@ -100,6 +91,7 @@ pub(crate) async fn run_agent(
provider: wire_api,
reasoning_effort_selection: model_reasoning_effort_selection,
permission_preset,
+ sandbox_profile,
// TODO: why do we need cwd here, maybe remove it ?
cwd,
},
@@ -108,7 +100,6 @@ pub(crate) async fn run_agent(
saved_models,
show_model_onboarding: onboarding_mode,
exit_after_onboarding,
- startup_warnings,
})
.await?;
tracing::info!("interactive tui returned to cli agent command");
@@ -133,6 +124,33 @@ fn initial_permission_preset(
permission_preset
}
+/// Sandbox profile shown as current when the TUI starts. Prefer the project
+/// `sandbox_profile` when set; otherwise derive it from the permission preset
+/// (Full Access → off, otherwise workspace).
+fn initial_sandbox_profile(
+ app_config: &AppConfig,
+ project_key: &str,
+ dangerously_skip_permissions: bool,
+) -> Option {
+ if dangerously_skip_permissions {
+ return Some("off".to_string());
+ }
+ let project = app_config.projects.get(project_key);
+ if let Some(profile) = project.and_then(|config| config.sandbox_profile.clone()) {
+ return Some(profile);
+ }
+ let preset = project
+ .and_then(|config| config.permission_preset)
+ .unwrap_or(PermissionPreset::Default);
+ Some(
+ match preset {
+ PermissionPreset::FullAccess => "off",
+ PermissionPreset::Default | PermissionPreset::AutoReview => "workspace",
+ }
+ .to_string(),
+ )
+}
+
/// Resolves the initial provider settings and whether onboarding should be shown.
///
/// `force_onboarding` requests onboarding regardless of stored configuration.
@@ -261,6 +279,7 @@ mod tests {
use pretty_assertions::assert_eq;
use super::initial_permission_preset;
+ use super::initial_sandbox_profile;
use super::resolve_initial_provider_settings;
use super::saved_model_entries;
use devo_core::AppConfig;
@@ -309,7 +328,8 @@ mod tests {
app_config.projects.insert(
"project-key".to_string(),
ProjectConfig {
- permission_preset: Some(PermissionPreset::ReadOnly),
+ permission_preset: Some(PermissionPreset::AutoReview),
+ sandbox_profile: None,
},
);
@@ -319,7 +339,7 @@ mod tests {
"project-key",
/*dangerously_skip_permissions*/ false,
),
- PermissionPreset::ReadOnly,
+ PermissionPreset::AutoReview,
);
}
@@ -329,7 +349,8 @@ mod tests {
app_config.projects.insert(
"project-key".to_string(),
ProjectConfig {
- permission_preset: Some(PermissionPreset::ReadOnly),
+ permission_preset: Some(PermissionPreset::AutoReview),
+ sandbox_profile: None,
},
);
@@ -343,6 +364,69 @@ mod tests {
);
}
+ #[test]
+ fn initial_sandbox_profile_uses_project_config_when_set() {
+ let mut app_config = AppConfig::default();
+ app_config.projects.insert(
+ "project-key".to_string(),
+ ProjectConfig {
+ permission_preset: None,
+ sandbox_profile: Some("strict".to_string()),
+ },
+ );
+
+ assert_eq!(
+ initial_sandbox_profile(
+ &app_config,
+ "project-key",
+ /*dangerously_skip_permissions*/ false,
+ ),
+ Some("strict".to_string()),
+ );
+ }
+
+ #[test]
+ fn initial_sandbox_profile_falls_back_to_permission_implied() {
+ let mut app_config = AppConfig::default();
+ app_config.projects.insert(
+ "full-access-project".to_string(),
+ ProjectConfig {
+ permission_preset: Some(PermissionPreset::FullAccess),
+ sandbox_profile: None,
+ },
+ );
+
+ assert_eq!(
+ initial_sandbox_profile(
+ &app_config,
+ "missing-project-key",
+ /*dangerously_skip_permissions*/ false,
+ ),
+ Some("workspace".to_string()),
+ );
+ assert_eq!(
+ initial_sandbox_profile(
+ &app_config,
+ "full-access-project",
+ /*dangerously_skip_permissions*/ false,
+ ),
+ Some("off".to_string()),
+ );
+ }
+
+ #[test]
+ fn initial_sandbox_profile_respects_dangerously_skip_permissions() {
+ let app_config = AppConfig::default();
+ assert_eq!(
+ initial_sandbox_profile(
+ &app_config,
+ "any",
+ /*dangerously_skip_permissions*/ true,
+ ),
+ Some("off".to_string()),
+ );
+ }
+
#[test]
fn resolve_initial_provider_settings_uses_catalog_fallback_during_onboarding() {
let actual = resolve_initial_provider_settings(
diff --git a/crates/cli/src/main.rs b/crates/cli/src/main.rs
index 39ca5b4b..40603c47 100644
--- a/crates/cli/src/main.rs
+++ b/crates/cli/src/main.rs
@@ -268,7 +268,18 @@ async fn run_cli() -> Result<()> {
}
fn direct_server_early_dispatch() -> devo_arg0::EarlyDispatch {
- devo_arg0::EarlyDispatch::Continue
+ let args: Vec = std::env::args().collect();
+ match devo_windows_sandbox::run_as_windows_sandbox_if_requested(&args) {
+ Ok(true) => {
+ // The helper exits the process on success; reaching here is unexpected.
+ devo_arg0::EarlyDispatch::Handled(Ok(()))
+ }
+ Ok(false) => devo_arg0::EarlyDispatch::Continue,
+ Err(error) => {
+ eprintln!("windows sandbox wrapper failed: {error}");
+ std::process::exit(1);
+ }
+ }
}
fn server_process_args_from_cli(cli: &Cli) -> Option {
diff --git a/crates/cli/src/prompt_command.rs b/crates/cli/src/prompt_command.rs
index 6f5d53d3..dad6ebb0 100644
--- a/crates/cli/src/prompt_command.rs
+++ b/crates/cli/src/prompt_command.rs
@@ -55,7 +55,7 @@ pub(crate) async fn run_prompt(
.unwrap_or_else(|_| AppConfig::default());
let resolved_provider =
devo_server::load_server_provider(&app_config, model_override, &home_dir)?;
- let model_catalog = PresetModelCatalog::load_from_config(&home_dir, Some(&cwd))?;
+ let model_catalog = PresetModelCatalog::load_from_config(&app_config.provider.model_overrides)?;
let turn_config = prompt_turn_config(
&app_config,
&model_catalog,
@@ -65,12 +65,22 @@ pub(crate) async fn run_prompt(
let selected_model = turn_config.model.slug.clone();
let mut session_state = SessionState::new(
- SessionConfig {
- agents_md: AgentsMdConfig {
- project_root_markers: app_config.project_root_markers.clone(),
- ..AgentsMdConfig::default()
- },
- ..SessionConfig::default()
+ {
+ let mut session_config = SessionConfig {
+ agents_md: AgentsMdConfig {
+ project_root_markers: app_config.project_root_markers.clone(),
+ ..AgentsMdConfig::default()
+ },
+ ..SessionConfig::default()
+ };
+ if let Some(sandbox_profile) = app_config
+ .projects
+ .get(&devo_core::project_config_key(&cwd))
+ .and_then(|project| project.sandbox_profile.clone())
+ {
+ session_config.sandbox_profile = Some(sandbox_profile);
+ }
+ session_config
},
cwd.clone(),
);
@@ -112,6 +122,7 @@ pub(crate) async fn run_prompt(
}),
network_proxy: None,
network_no_proxy: None,
+ sandbox_profile: session_state.config.sandbox_profile.clone(),
},
);
let provider = Arc::new(RoutedPromptProvider::new(
diff --git a/crates/client/README.md b/crates/client/README.md
index b06c46fa..32fadf7b 100644
--- a/crates/client/README.md
+++ b/crates/client/README.md
@@ -38,7 +38,8 @@ The short `ws://` listen target uses `127.0.0.1:3210`.
- `session_start`, `session_resume`, `session_list`: create, resume, and list
sessions.
- `session_title_update`, `session_metadata_update`,
- `session_permissions_update`: update session metadata shown by clients.
+ `session_permissions_update`, `session_sandbox_profile_update`: update session
+ metadata shown by clients.
- `session_compact`, `session_fork`, `session_rollback`: manage session history
and derived sessions.
- `agent_list`, `agent_spawn`, `agent_close`: inspect and manage background
diff --git a/crates/client/src/acp_permissions.rs b/crates/client/src/acp_permissions.rs
index 659ee7fd..142edb0d 100644
--- a/crates/client/src/acp_permissions.rs
+++ b/crates/client/src/acp_permissions.rs
@@ -143,9 +143,28 @@ fn acp_approval_request_notification(
.and_then(serde_json::Value::as_str)
.unwrap_or("ACP tool permission request")
.to_string();
- let target = params
- .get("toolCall")
- .and_then(|tool_call| tool_call.get("toolCallId"))
+ let meta = params.get("_meta");
+ let target = meta
+ .and_then(|meta| meta.get("target"))
+ .and_then(serde_json::Value::as_str)
+ .map(str::to_string)
+ .or_else(|| {
+ params
+ .get("toolCall")
+ .and_then(|tool_call| tool_call.get("rawInput"))
+ .and_then(|raw_input| raw_input.get("command"))
+ .and_then(serde_json::Value::as_str)
+ .map(str::to_string)
+ })
+ .filter(|value| !value.is_empty());
+ let justification = meta
+ .and_then(|meta| meta.get("justification"))
+ .and_then(serde_json::Value::as_str)
+ .filter(|value| !value.trim().is_empty())
+ .unwrap_or("Tool execution requires approval.")
+ .to_string();
+ let resource = meta
+ .and_then(|meta| meta.get("resource"))
.and_then(serde_json::Value::as_str)
.map(str::to_string);
let request = PendingServerRequestContext {
@@ -155,16 +174,41 @@ fn acp_approval_request_notification(
turn_id: Some(pending.turn_id),
item_id: Some(pending.item_id),
};
+ let command_pattern = meta
+ .and_then(|meta| meta.get("commandPattern"))
+ .and_then(|value| serde_json::from_value::>(value.clone()).ok());
+ let command_prefix = meta
+ .and_then(|meta| meta.get("commandPrefix"))
+ .and_then(|value| serde_json::from_value::>(value.clone()).ok());
+ let path = params
+ .get("toolCall")
+ .and_then(|tool_call| tool_call.get("locations"))
+ .and_then(serde_json::Value::as_array)
+ .and_then(|locations| locations.first())
+ .and_then(|location| location.get("path"))
+ .and_then(serde_json::Value::as_str)
+ .map(str::to_string)
+ .or_else(|| {
+ meta.and_then(|meta| meta.get("path"))
+ .and_then(serde_json::Value::as_str)
+ .map(str::to_string)
+ });
+ let host = meta
+ .and_then(|meta| meta.get("host"))
+ .and_then(serde_json::Value::as_str)
+ .map(str::to_string);
let payload = ApprovalRequestPayload {
request,
approval_id: approval_id.to_string().into(),
action_summary,
- justification: "ACP agent requested permission to continue this tool call.".to_string(),
- resource: target.clone(),
+ justification,
+ resource,
available_scopes: acp_approval_scopes(&pending.options),
- path: None,
- host: None,
+ path,
+ host,
target,
+ command_pattern,
+ command_prefix,
};
acp_item_notification(
"item/completed",
@@ -220,10 +264,46 @@ fn acp_item_notification(method: &str, event: ServerEvent) -> ServerNotification
fn acp_approval_scopes(options: &[AcpPermissionOption]) -> Vec {
let mut scopes = Vec::new();
- if options.iter().any(|option| option.kind == "allow_once") {
+ if options
+ .iter()
+ .any(|option| option.option_id == "allow_once" || option.kind == "allow_once")
+ {
scopes.push("once".to_string());
}
- if options.iter().any(|option| option.kind == "allow_always") {
+ if options
+ .iter()
+ .any(|option| option.option_id == "allow_session")
+ {
+ scopes.push("session".to_string());
+ }
+ if options
+ .iter()
+ .any(|option| option.option_id == "allow_prefix_rule")
+ {
+ scopes.push("command_prefix_persist".to_string());
+ }
+ if options
+ .iter()
+ .any(|option| option.option_id == "allow_path_prefix")
+ {
+ scopes.push("path_prefix".to_string());
+ }
+ if options
+ .iter()
+ .any(|option| option.option_id == "allow_host")
+ {
+ scopes.push("host".to_string());
+ }
+ // Fallback: generic allow_always without a more specific option id.
+ if !scopes.iter().any(|scope| scope == "session")
+ && options.iter().any(|option| {
+ option.kind == "allow_always"
+ && !matches!(
+ option.option_id.as_str(),
+ "allow_prefix_rule" | "allow_path_prefix" | "allow_host"
+ )
+ })
+ {
scopes.push("session".to_string());
}
scopes
@@ -249,24 +329,69 @@ fn acp_selected_permission_option(
params: &ApprovalResponseParams,
pending: &AcpPendingPermission,
) -> Option {
+ if matches!(params.decision, ApprovalDecisionValue::Cancel) {
+ return None;
+ }
+
+ // Prefer exact option ids so prefix / path / host approvals do not collapse
+ // into a generic allow_always / allow_once selection.
+ let preferred_option_ids: &[&str] = match (¶ms.decision, ¶ms.scope) {
+ (ApprovalDecisionValue::Approve, ApprovalScopeValue::CommandPrefixPersist) => {
+ &["allow_prefix_rule"]
+ }
+ (ApprovalDecisionValue::Approve, ApprovalScopeValue::PathPrefix) => &["allow_path_prefix"],
+ (ApprovalDecisionValue::Approve, ApprovalScopeValue::Host) => &["allow_host"],
+ (ApprovalDecisionValue::Approve, ApprovalScopeValue::Session) => {
+ &["allow_session", "allow_always", "allow_once"]
+ }
+ (ApprovalDecisionValue::Approve, _) => &["allow_once", "allow_session", "allow_always"],
+ (ApprovalDecisionValue::Deny, ApprovalScopeValue::Session) => {
+ &["reject_always", "reject_once"]
+ }
+ (ApprovalDecisionValue::Deny, _) => &["reject_once", "reject_always"],
+ (ApprovalDecisionValue::Cancel, _) => return None,
+ };
+
+ if let Some(option_id) = preferred_option_ids.iter().find_map(|option_id| {
+ pending
+ .options
+ .iter()
+ .find(|option| option.option_id == *option_id)
+ .map(|option| option.option_id.clone())
+ }) {
+ return Some(option_id);
+ }
+
+ // PathPrefix / Host must not silently widen to session/always when the
+ // exact option is missing — fall back to once or cancel.
+ if matches!(
+ (¶ms.decision, ¶ms.scope),
+ (
+ ApprovalDecisionValue::Approve,
+ ApprovalScopeValue::PathPrefix | ApprovalScopeValue::Host
+ )
+ ) {
+ return pending
+ .options
+ .iter()
+ .find(|option| option.option_id == "allow_once" || option.kind == "allow_once")
+ .map(|option| option.option_id.clone());
+ }
+
let preferred_kinds: &[&str] = match params.decision {
ApprovalDecisionValue::Approve => match params.scope {
- ApprovalScopeValue::Session => &["allow_always", "allow_once"],
+ ApprovalScopeValue::Session | ApprovalScopeValue::CommandPrefixPersist => {
+ &["allow_always", "allow_once"]
+ }
+ ApprovalScopeValue::PathPrefix | ApprovalScopeValue::Host => &["allow_once"],
ApprovalScopeValue::Once
| ApprovalScopeValue::Turn
- | ApprovalScopeValue::PathPrefix
- | ApprovalScopeValue::Host
| ApprovalScopeValue::Tool
| ApprovalScopeValue::CommandPrefix => &["allow_once", "allow_always"],
},
ApprovalDecisionValue::Deny => match params.scope {
ApprovalScopeValue::Session => &["reject_always", "reject_once"],
- ApprovalScopeValue::Once
- | ApprovalScopeValue::Turn
- | ApprovalScopeValue::PathPrefix
- | ApprovalScopeValue::Host
- | ApprovalScopeValue::Tool
- | ApprovalScopeValue::CommandPrefix => &["reject_once", "reject_always"],
+ _ => &["reject_once", "reject_always"],
},
ApprovalDecisionValue::Cancel => return None,
};
@@ -304,6 +429,7 @@ fn acp_approval_scope_label(scope: &ApprovalScopeValue) -> &'static str {
ApprovalScopeValue::Host => "host",
ApprovalScopeValue::Tool => "tool",
ApprovalScopeValue::CommandPrefix => "command_prefix",
+ ApprovalScopeValue::CommandPrefixPersist => "command_prefix_persist",
}
}
@@ -331,7 +457,10 @@ mod tests {
{ "optionId": "allow-once", "kind": "allow_once" },
{ "optionId": "allow-always", "kind": "allow_always" },
{ "optionId": "reject-once", "kind": "reject_once" }
- ]
+ ],
+ "_meta": {
+ "commandPattern": ["git", "add", "*"]
+ }
}),
Arc::clone(&pending_permissions),
notifications_tx,
@@ -378,13 +507,14 @@ mod tests {
},
approval_id: request_payload.approval_id.clone(),
action_summary: "Edit file".to_string(),
- justification: "ACP agent requested permission to continue this tool call."
- .to_string(),
- resource: Some("call-1".to_string()),
+ justification: "Tool execution requires approval.".to_string(),
+ resource: None,
available_scopes: vec!["once".to_string(), "session".to_string()],
path: None,
host: None,
- target: Some("call-1".to_string()),
+ target: None,
+ command_pattern: Some(vec!["git".to_string(), "add".to_string(), "*".to_string(),]),
+ command_prefix: None,
}
);
@@ -441,4 +571,225 @@ mod tests {
}
);
}
+
+ #[tokio::test]
+ async fn permission_request_resolves_prefix_persist_to_allow_prefix_rule() {
+ let pending_permissions = Arc::new(Mutex::new(HashMap::new()));
+ let (notifications_tx, mut notifications_rx) = mpsc::unbounded_channel();
+ let session_id = devo_protocol::SessionId::new();
+
+ handle_acp_request_permission(
+ serde_json::json!(88),
+ serde_json::json!({
+ "sessionId": session_id,
+ "toolCall": {
+ "toolCallId": "call-2",
+ "title": "Run git pull"
+ },
+ "options": [
+ { "optionId": "allow_once", "kind": "allow_once" },
+ { "optionId": "allow_session", "kind": "allow_always" },
+ { "optionId": "allow_prefix_rule", "kind": "allow_always" },
+ { "optionId": "reject_once", "kind": "reject_once" }
+ ],
+ "_meta": {
+ "commandPrefix": ["git", "pull"]
+ }
+ }),
+ Arc::clone(&pending_permissions),
+ notifications_tx,
+ )
+ .await
+ .expect("permission request is accepted");
+
+ let request_notification = notifications_rx
+ .try_recv()
+ .expect("approval request notification");
+ let ServerEvent::ItemCompleted(request_item) =
+ serde_json::from_value::(request_notification.params)
+ .expect("decode approval request event")
+ else {
+ panic!("expected item/completed request event");
+ };
+ let request_payload =
+ serde_json::from_value::(request_item.item.payload.clone())
+ .expect("decode approval request payload");
+ assert_eq!(
+ request_payload.available_scopes,
+ vec![
+ "once".to_string(),
+ "session".to_string(),
+ "command_prefix_persist".to_string(),
+ ]
+ );
+ assert_eq!(
+ request_payload.command_prefix,
+ Some(vec!["git".to_string(), "pull".to_string()])
+ );
+
+ let turn_id = request_item.context.turn_id.expect("request turn id");
+ let response_params = ApprovalResponseParams {
+ session_id,
+ turn_id,
+ approval_id: request_payload.approval_id.clone(),
+ decision: ApprovalDecisionValue::Approve,
+ scope: ApprovalScopeValue::CommandPrefixPersist,
+ };
+ let (response, _) = resolve_acp_permission_response(&pending_permissions, &response_params)
+ .await
+ .expect("pending permission resolves");
+ assert_eq!(
+ response,
+ serde_json::json!({
+ "jsonrpc": "2.0",
+ "id": 88,
+ "result": {
+ "outcome": {
+ "outcome": "selected",
+ "optionId": "allow_prefix_rule"
+ }
+ }
+ })
+ );
+ }
+
+ #[tokio::test]
+ async fn permission_request_resolves_path_and_host_scopes() {
+ let pending_permissions = Arc::new(Mutex::new(HashMap::new()));
+ let (notifications_tx, mut notifications_rx) = mpsc::unbounded_channel();
+ let session_id = devo_protocol::SessionId::new();
+
+ handle_acp_request_permission(
+ serde_json::json!(99),
+ serde_json::json!({
+ "sessionId": session_id,
+ "toolCall": {
+ "toolCallId": "call-3",
+ "title": "Write file",
+ "locations": [{ "path": "/tmp/out/file.txt" }]
+ },
+ "options": [
+ { "optionId": "allow_once", "kind": "allow_once" },
+ { "optionId": "allow_path_prefix", "kind": "allow_always" },
+ { "optionId": "allow_host", "kind": "allow_always" },
+ { "optionId": "reject_once", "kind": "reject_once" }
+ ],
+ "_meta": {
+ "host": "api.example.com"
+ }
+ }),
+ Arc::clone(&pending_permissions),
+ notifications_tx,
+ )
+ .await
+ .expect("permission request is accepted");
+
+ let request_notification = notifications_rx
+ .try_recv()
+ .expect("approval request notification");
+ let ServerEvent::ItemCompleted(request_item) =
+ serde_json::from_value::(request_notification.params)
+ .expect("decode approval request event")
+ else {
+ panic!("expected item/completed request event");
+ };
+ let request_payload =
+ serde_json::from_value::(request_item.item.payload.clone())
+ .expect("decode approval request payload");
+ assert_eq!(
+ request_payload.available_scopes,
+ vec![
+ "once".to_string(),
+ "path_prefix".to_string(),
+ "host".to_string(),
+ ]
+ );
+ assert_eq!(request_payload.path.as_deref(), Some("/tmp/out/file.txt"));
+ assert_eq!(request_payload.host.as_deref(), Some("api.example.com"));
+
+ let turn_id = request_item.context.turn_id.expect("request turn id");
+ let path_response_params = ApprovalResponseParams {
+ session_id,
+ turn_id,
+ approval_id: request_payload.approval_id.clone(),
+ decision: ApprovalDecisionValue::Approve,
+ scope: ApprovalScopeValue::PathPrefix,
+ };
+ let (path_response, _) =
+ resolve_acp_permission_response(&pending_permissions, &path_response_params)
+ .await
+ .expect("pending permission resolves");
+ assert_eq!(
+ path_response,
+ serde_json::json!({
+ "jsonrpc": "2.0",
+ "id": 99,
+ "result": {
+ "outcome": {
+ "outcome": "selected",
+ "optionId": "allow_path_prefix"
+ }
+ }
+ })
+ );
+ }
+
+ #[tokio::test]
+ async fn permission_request_uses_meta_target_not_tool_call_id() {
+ let pending_permissions = Arc::new(Mutex::new(HashMap::new()));
+ let (notifications_tx, mut notifications_rx) = mpsc::unbounded_channel();
+ let session_id = devo_protocol::SessionId::new();
+ let command = r#"echo "Hello from Devo!" > ~/Desktop/hello-devo.txt"#.to_string();
+ let title = format!("shell_command: {command}");
+
+ handle_acp_request_permission(
+ serde_json::json!(101),
+ serde_json::json!({
+ "sessionId": session_id,
+ "toolCall": {
+ "toolCallId": "call_00_O1jvONaD7gYFgfVFYGrr6527",
+ "title": title,
+ "rawInput": { "command": command.clone() }
+ },
+ "options": [
+ { "optionId": "allow_once", "kind": "allow_once" },
+ { "optionId": "allow_session", "kind": "allow_always" },
+ { "optionId": "reject_once", "kind": "reject_once" }
+ ],
+ "_meta": {
+ "target": command.clone(),
+ "resource": "ShellExec",
+ "justification": "Write a greeting file on the desktop."
+ }
+ }),
+ Arc::clone(&pending_permissions),
+ notifications_tx,
+ )
+ .await
+ .expect("permission request is accepted");
+
+ let request_notification = notifications_rx
+ .try_recv()
+ .expect("approval request notification");
+ let ServerEvent::ItemCompleted(request_item) =
+ serde_json::from_value::(request_notification.params)
+ .expect("decode approval request event")
+ else {
+ panic!("expected item/completed request event");
+ };
+ let request_payload =
+ serde_json::from_value::(request_item.item.payload.clone())
+ .expect("decode approval request payload");
+ assert_eq!(request_payload.target.as_deref(), Some(command.as_str()));
+ assert_eq!(request_payload.resource.as_deref(), Some("ShellExec"));
+ assert_eq!(
+ request_payload.justification,
+ "Write a greeting file on the desktop."
+ );
+ assert_ne!(
+ request_payload.target.as_deref(),
+ Some("call_00_O1jvONaD7gYFgfVFYGrr6527")
+ );
+ assert!(request_payload.command_pattern.is_none());
+ }
}
diff --git a/crates/client/src/client_core.rs b/crates/client/src/client_core.rs
index 69c93624..0d8a4328 100644
--- a/crates/client/src/client_core.rs
+++ b/crates/client/src/client_core.rs
@@ -474,6 +474,14 @@ impl ServerClientCore {
.await
}
+ pub(crate) async fn session_sandbox_profile_update(
+ &mut self,
+ params: SessionSandboxProfileUpdateParams,
+ ) -> Result {
+ self.request_devo("session/sandbox_profile/update", params)
+ .await
+ }
+
pub(crate) async fn session_compact(
&mut self,
params: SessionCompactParams,
diff --git a/crates/client/src/stdio.rs b/crates/client/src/stdio.rs
index a413aef5..3604f38c 100644
--- a/crates/client/src/stdio.rs
+++ b/crates/client/src/stdio.rs
@@ -185,6 +185,13 @@ impl StdioServerClient {
self.core.session_permissions_update(params).await
}
+ pub async fn session_sandbox_profile_update(
+ &mut self,
+ params: SessionSandboxProfileUpdateParams,
+ ) -> Result {
+ self.core.session_sandbox_profile_update(params).await
+ }
+
pub async fn session_compact(
&mut self,
params: SessionCompactParams,
diff --git a/crates/client/src/websocket.rs b/crates/client/src/websocket.rs
index c2acc9c8..ed8e9fe7 100644
--- a/crates/client/src/websocket.rs
+++ b/crates/client/src/websocket.rs
@@ -164,6 +164,15 @@ impl WebSocketServerClient {
.await
}
+ pub async fn session_sandbox_profile_update(
+ &mut self,
+ params: SessionSandboxProfileUpdateParams,
+ ) -> Result {
+ self.core
+ .request_devo("session/sandbox_profile/update", params)
+ .await
+ }
+
pub async fn session_compact(
&mut self,
params: SessionCompactParams,
diff --git a/crates/config/README.md b/crates/config/README.md
index 95e5ffd6..f7185462 100644
--- a/crates/config/README.md
+++ b/crates/config/README.md
@@ -167,7 +167,8 @@ check_on_startup = true
check_interval_hours = 24
[projects."/path/to/project"]
-permission_preset = "default" # read-only, default, auto-review, or full-access
+permission_preset = "default" # default, auto-review, or full-access
+sandbox_profile = "workspace" # workspace, devbox, read-only, strict, off, or a custom profile from sandbox.toml
[[hooks.PreToolUse]]
matcher = "exec_command"
@@ -453,21 +454,84 @@ The resolved runtime settings contain the provider id, wire API, final model
name, optional base URL, optional API key, model limits, reasoning effort selection,
response-storage flag, and preferred auth method.
-`model_slug` is the local catalog key matching a `slug` in the effective
-`models.json` catalog. `request_model` is the provider-specific model name used for
-the API request. The legacy `model_name` key is accepted when reading existing
-configuration, while subsequent writes use `request_model`. The effective catalog precedence is
-`/.devo/models.json`, then `/models.json`, then built-in
-defaults, merged by `slug`. Turn metadata records `model` as the catalog slug
-and `request_model` as the provider request model; these values may be
-identical.
-
-Untouched built-in entries in `/models.json` are synchronized with
-the catalog bundled in the running binary. Devo records the source fingerprint
-and update policy in a reserved `_devo` object. Editing model fields preserves
-the full entry as a user override. Set `_devo.update_policy` to `"pinned"` to
-prevent an unchanged built-in entry from being refreshed explicitly. Custom
-slugs and workspace-level catalogs are never rewritten by this synchronization.
+`model_slug` is the local catalog key. Model metadata starts from the built-in
+catalog and is overlaid field-by-field from user and workspace `config.toml`
+`[model.]` sections. Existing slugs are partial overrides; new slugs create
+custom models with safe defaults. `request_model` is the provider-facing model id
+used for the API request. The legacy `model_name` key is accepted when reading
+existing configuration, while subsequent writes use `request_model`. Turn
+metadata records `model` as the catalog slug and `request_model` as the provider
+request model; these values may be identical.
+
+Model metadata `provider` describes the wire API and accepts
+`openai_chat_completions`, `openai_responses`, or `anthropic_messages`. The
+binding's `invocation_method` is the operational connection choice and should
+match that metadata. A usable custom model therefore needs a
+`[providers.]` connection and `[model_bindings.]` binding; the provider's
+optional `credential` points to an API key stored in `auth.json`.
+
+A built-in partial override can be as small as:
+
+```toml
+[model.qwen3-coder-next]
+context_window = 262144
+effective_context_window_percent = 90
+```
+
+A custom model must also be selected through connection wiring:
+
+```toml
+[defaults]
+model_binding = "custom-example"
+
+[model.custom]
+display_name = "Custom"
+provider = "openai_responses"
+context_window = 128000
+reasoning_capability = { levels = ["low", "medium", "high"] }
+reasoning_implementation = "request_parameter"
+default_reasoning_effort = "medium"
+
+[providers.example]
+enabled = true
+name = "Example"
+base_url = "https://api.example.com/v1"
+credential = "example_api_key"
+wire_apis = ["openai_responses"]
+
+[model_bindings.custom-example]
+enabled = true
+model_slug = "custom"
+provider = "example"
+request_model = "provider-facing-model-id"
+invocation_method = "openai_responses"
+```
+
+`ModelOverrideConfig` exposes `display_name`, `description`, `channel`,
+`context_window`, `effective_context_window_percent`, `max_tokens`, `temperature`,
+`top_p`, `top_k`, `provider`, `reasoning_capability`,
+`reasoning_implementation`, `default_reasoning_effort`, `base_instructions`,
+`input_modalities`, `truncation_policy`, and `supports_image_detail_original`.
+`display_name` is the picker label, `description` is its explanatory text, and
+`channel` groups related models. The effective context is
+`context_window * effective_context_window_percent / 100` and is also the
+automatic-compaction boundary; `max_tokens` is the default response-output
+limit. `temperature`, `top_p`, and `top_k` are request sampling defaults.
+`reasoning_capability` defines the choices shown to users, while
+`reasoning_implementation` says whether a choice is disabled, sent as a request
+parameter, or mapped to a configured wire-model variant;
+`default_reasoning_effort` selects the initial effort. `input_modalities`
+declares text/image input support, `truncation_policy` selects a byte- or
+token-based request-content limit, and `supports_image_detail_original`
+enables original-resolution image detail. Omitted built-in fields are
+preserved. Omitted custom-model `base_instructions` use the default
+instructions, while an explicit empty string means no base instructions.
+
+Old `/models.json` and `/.devo/models.json` files are
+ignored. Migration is manual: copy desired fields into the corresponding user or
+workspace `config.toml` `[model.]` sections. The legacy top-level scalar
+`model = "slug"` remains readable, but it collides with the new `model` table
+namespace, so new configuration must select with `[defaults].model_binding`.
When reasoning effort resolution selects a model variant catalog slug, the provider
request model is resolved from enabled bindings for the same provider as the
diff --git a/crates/config/src/app.rs b/crates/config/src/app.rs
index 837df3ea..0768bf31 100644
--- a/crates/config/src/app.rs
+++ b/crates/config/src/app.rs
@@ -25,6 +25,7 @@ use crate::LoggingFileConfig;
use crate::McpConfig;
use crate::ModelBindingConfig;
use crate::OAuthCredentialsStoreMode;
+use crate::PermissionConfig;
use crate::ProviderConfigError;
use crate::ProviderConfigSection;
use crate::ProviderHttpConfig;
@@ -43,7 +44,7 @@ use crate::write_atomic;
use crate::write_provider_config;
/// Stores the fully normalized runtime configuration.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
pub struct AppConfig {
/// The policy that selects which model should generate context summaries.
pub summary_model: SummaryModelSelection,
@@ -71,6 +72,9 @@ pub struct AppConfig {
/// External lifecycle hooks keyed by event name.
#[serde(default, skip_serializing_if = "HooksConfig::is_empty")]
pub hooks: HooksConfig,
+ /// Configured rules and default behavior for tool permission requests.
+ #[serde(default)]
+ pub permission: PermissionConfig,
/// Provider, model, and active model defaults.
#[serde(flatten)]
pub provider: ProviderConfigSection,
@@ -91,6 +95,10 @@ pub struct AppConfig {
pub struct ProjectConfig {
/// Permission preset to use when starting new sessions for this project.
pub permission_preset: Option,
+ /// Sandbox profile to use when starting new sessions for this project.
+ /// Built-in values are `workspace`, `devbox`, `read-only`, `strict`, and
+ /// `off`; any other value names a custom profile from `sandbox.toml`.
+ pub sandbox_profile: Option,
}
/// Controls how the CLI checks for new releases at startup.
@@ -162,6 +170,7 @@ impl Default for AppConfig {
mcp: McpConfig::default(),
tools: ToolsConfig::default(),
hooks: HooksConfig::default(),
+ permission: PermissionConfig::default(),
provider: ProviderConfigSection::default(),
provider_http: ProviderHttpConfig::default(),
updates: UpdatesConfig {
@@ -303,10 +312,6 @@ impl AppConfigStore {
if !config.model_bindings.contains_key(&binding_id) {
anyhow::bail!("default model binding `{binding_id}` does not exist");
}
- if let Some(binding) = config.model_bindings.get(&binding_id) {
- config.model_provider = Some(binding.provider.clone());
- config.model = Some(binding.model_slug.clone());
- }
config.defaults.model_binding = Some(binding_id);
}
@@ -350,8 +355,6 @@ impl AppConfigStore {
anyhow::bail!("model binding `{value}` is disabled");
}
config.defaults.model_binding = Some(value.to_string());
- config.model_provider = Some(binding.provider.clone());
- config.model = Some(binding.model_slug.clone());
}
"thought_level" => {
config.model_reasoning_effort_selection = Some(value.to_string());
@@ -624,7 +627,7 @@ impl AppConfigLoader for FileSystemAppConfigLoader {
provider_section_from_value(&user_path, &user_config)?,
&user_config,
);
- merge_toml_values(&mut merged, user_config);
+ merge_app_config_values(&mut merged, user_config);
}
if let Some(workspace_root) = workspace_root {
@@ -635,7 +638,7 @@ impl AppConfigLoader for FileSystemAppConfigLoader {
provider_section_from_value(&project_path, &project_config)?,
&project_config,
);
- merge_toml_values(&mut merged, project_config);
+ merge_app_config_values(&mut merged, project_config);
}
}
@@ -643,7 +646,7 @@ impl AppConfigLoader for FileSystemAppConfigLoader {
provider_section_from_value(Path::new(""), &self.cli_overrides)?,
&self.cli_overrides,
);
- merge_toml_values_ref(&mut merged, &self.cli_overrides);
+ merge_app_config_values_ref(&mut merged, &self.cli_overrides);
let mut config: AppConfig =
merged
@@ -658,6 +661,28 @@ impl AppConfigLoader for FileSystemAppConfigLoader {
}
}
+fn merge_app_config_values(base: &mut toml::Value, overlay: toml::Value) {
+ replace_permission_section_if_present(base, &overlay);
+ merge_toml_values(base, overlay);
+}
+
+fn merge_app_config_values_ref(base: &mut toml::Value, overlay: &toml::Value) {
+ replace_permission_section_if_present(base, overlay);
+ merge_toml_values_ref(base, overlay);
+}
+
+/// Replaces permission configuration as a unit when a higher-priority source
+/// explicitly supplies its `[permission]` section.
+fn replace_permission_section_if_present(base: &mut toml::Value, overlay: &toml::Value) {
+ let Some(permission) = overlay.as_table().and_then(|table| table.get("permission")) else {
+ return;
+ };
+
+ if let Some(base_table) = base.as_table_mut() {
+ base_table.insert("permission".to_string(), permission.clone());
+ }
+}
+
fn merge_toml_values(base: &mut toml::Value, overlay: toml::Value) {
match (base, overlay) {
(toml::Value::Table(base_table), toml::Value::Table(overlay_table)) => {
diff --git a/crates/config/src/app_store_tests.rs b/crates/config/src/app_store_tests.rs
index 62102103..d02c2d44 100644
--- a/crates/config/src/app_store_tests.rs
+++ b/crates/config/src/app_store_tests.rs
@@ -66,7 +66,7 @@ enabled = true
Some("alt-binding")
);
assert_eq!(document["model_provider"].as_str(), Some("openai"));
- assert_eq!(document["model"].as_str(), Some("alt-model"));
+ assert_eq!(document["model"].as_str(), Some("test-model"));
assert_eq!(
store
.effective_config()
diff --git a/crates/config/src/lib.rs b/crates/config/src/lib.rs
index ab55d8eb..85b7c023 100644
--- a/crates/config/src/lib.rs
+++ b/crates/config/src/lib.rs
@@ -10,6 +10,7 @@ mod hooks;
mod logging;
mod mcp;
mod oauth;
+mod permission;
mod provider;
mod server;
mod skills;
@@ -22,6 +23,7 @@ pub use hooks::*;
pub use logging::*;
pub use mcp::*;
pub use oauth::*;
+pub use permission::*;
pub use provider::*;
pub use server::*;
pub use skills::*;
diff --git a/crates/config/src/permission.rs b/crates/config/src/permission.rs
new file mode 100644
index 00000000..a35430a0
--- /dev/null
+++ b/crates/config/src/permission.rs
@@ -0,0 +1,84 @@
+//! Typed permission-policy configuration.
+
+use serde::Deserialize;
+use serde::Serialize;
+
+/// Permission-policy configuration loaded from the `[permission]` TOML section.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Default)]
+#[serde(default)]
+pub struct PermissionConfig {
+ /// Rules evaluated by the permission-policy runtime in declaration order.
+ pub rules: Vec,
+ /// Behavior when no rule or prior decision resolves a tool call.
+ #[serde(rename = "default_mode")]
+ pub prompt_policy: PromptPolicy,
+}
+
+/// A single permission-policy rule.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct PermissionRule {
+ /// The action taken when this rule matches.
+ #[serde(default)]
+ pub action: RuleAction,
+ /// The tool category that this rule applies to.
+ #[serde(default)]
+ pub tool: ToolFilter,
+ /// An optional glob or domain pattern for the selected tool category.
+ pub pattern: Option,
+ /// How to interpret `pattern`.
+ #[serde(default)]
+ pub pattern_mode: PatternMode,
+}
+
+/// Selects whether a rule pattern matches a glob or a URL host.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
+#[serde(rename_all = "lowercase")]
+pub enum PatternMode {
+ /// Match the target with a glob pattern.
+ #[default]
+ Glob,
+ /// Match the URL host instead of the complete target.
+ Domain,
+}
+
+/// Action to take when a permission rule matches.
+///
+/// The default is deny so an omitted `action` cannot silently make a rule
+/// permissive.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
+#[serde(rename_all = "lowercase")]
+pub enum RuleAction {
+ Allow,
+ #[default]
+ Deny,
+ Ask,
+}
+
+/// Tool category used to filter a permission rule.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
+#[serde(rename_all = "snake_case")]
+pub enum ToolFilter {
+ /// Match every tool category.
+ #[default]
+ Any,
+ Bash,
+ Edit,
+ Read,
+ Grep,
+ Mcp,
+ WebFetch,
+ WebSearch,
+}
+
+/// Default behavior for permission requests that no rule resolves.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
+#[serde(rename_all = "lowercase")]
+pub enum PromptPolicy {
+ /// Ask the user to approve the request.
+ #[default]
+ Ask,
+ /// Deny the request without prompting.
+ Deny,
+ /// Send unresolved requests through the automatic reviewer.
+ Auto,
+}
diff --git a/crates/config/src/provider.rs b/crates/config/src/provider.rs
index 043ddee2..2b92ac95 100644
--- a/crates/config/src/provider.rs
+++ b/crates/config/src/provider.rs
@@ -1,6 +1,7 @@
mod auth;
mod persistence;
mod resolve;
+mod runtime_equivalence;
mod schema;
pub use devo_protocol::ProviderWireApi;
@@ -41,6 +42,7 @@ mod tests {
use super::AuthCredentialConfig;
use super::AuthCredentialKind;
use super::ModelBindingConfig;
+ use super::ModelOverrideConfig;
use super::ModelProviderConfig;
use super::PreferredAuthMethod;
use super::ProviderConfigSection;
@@ -49,6 +51,7 @@ mod tests {
use super::ResolvedModelBinding;
use super::ResolvedProviderSettings;
use super::UserAuthConfigFile;
+ use super::read_provider_config;
use super::read_user_auth_config;
use super::resolve_enabled_model_binding;
use super::resolve_model_binding;
@@ -445,6 +448,59 @@ name = "Other"
);
}
+ #[test]
+ fn write_provider_config_preserves_model_override_tables() {
+ let dir = tempfile::tempdir().expect("temp dir");
+ let config_file = dir.path().join(super::CONFIG_FILE_NAME);
+ std::fs::write(
+ &config_file,
+ r#"
+[model.grok-4]
+display_name = "Grok 4"
+context_window = 256000
+custom_model_key = "keep-me"
+"#,
+ )
+ .expect("write initial config");
+
+ let mut config = read_provider_config(&config_file).expect("read provider config");
+ config.providers.insert(
+ "xai".to_string(),
+ ModelProviderConfig {
+ name: "xAI".to_string(),
+ wire_apis: vec![ProviderWireApi::OpenAIResponses],
+ ..ModelProviderConfig::default()
+ },
+ );
+
+ write_provider_config(&config_file, &config).expect("write provider config");
+
+ let written = std::fs::read_to_string(&config_file).expect("read written config");
+ let document: toml::Value = toml::from_str(&written).expect("parse written config");
+ assert_eq!(
+ config.model_overrides,
+ [(
+ "grok-4".to_string(),
+ ModelOverrideConfig {
+ display_name: Some("Grok 4".to_string()),
+ context_window: Some(256_000),
+ ..ModelOverrideConfig::default()
+ },
+ )]
+ .into_iter()
+ .collect()
+ );
+ assert_eq!(document["model"].as_str(), None);
+ assert_eq!(
+ document["model"]["grok-4"]["display_name"].as_str(),
+ Some("Grok 4")
+ );
+ assert_eq!(
+ document["model"]["grok-4"]["custom_model_key"].as_str(),
+ Some("keep-me")
+ );
+ }
+
#[test]
fn write_provider_config_removes_cleared_known_fields() {
let dir = tempfile::tempdir().expect("temp dir");
diff --git a/crates/config/src/provider/persistence.rs b/crates/config/src/provider/persistence.rs
index 38efe7db..44289a07 100644
--- a/crates/config/src/provider/persistence.rs
+++ b/crates/config/src/provider/persistence.rs
@@ -86,7 +86,61 @@ fn update_provider_config_document(
.expect("provider config must serialize to a TOML table");
overlay_optional_key(document, replacement, "model_provider");
- overlay_optional_key(document, replacement, "model");
+ if config.model_overrides.is_empty() {
+ overlay_optional_key(document, replacement, "model");
+ } else {
+ let model_overrides = document
+ .entry("model".to_string())
+ .or_insert_with(|| Value::Table(Default::default()));
+ let model_overrides = ensure_table(model_overrides);
+ let replacement_overrides = replacement.get("model").and_then(Value::as_table);
+
+ for model_slug in config.model_overrides.keys() {
+ let model_override = model_overrides
+ .entry(model_slug.clone())
+ .or_insert_with(|| Value::Table(Default::default()));
+ let model_override = ensure_table(model_override);
+ let replacement_override = replacement_overrides
+ .and_then(|overrides| overrides.get(model_slug))
+ .and_then(Value::as_table);
+
+ if let Some(replacement_override) = replacement_override {
+ overlay_optional_key(model_override, replacement_override, "display_name");
+ overlay_optional_key(model_override, replacement_override, "description");
+ overlay_optional_key(model_override, replacement_override, "context_window");
+ overlay_optional_key(
+ model_override,
+ replacement_override,
+ "effective_context_window_percent",
+ );
+ overlay_optional_key(model_override, replacement_override, "max_tokens");
+ overlay_optional_key(model_override, replacement_override, "temperature");
+ overlay_optional_key(model_override, replacement_override, "top_p");
+ overlay_optional_key(model_override, replacement_override, "top_k");
+ overlay_optional_key(model_override, replacement_override, "provider");
+ overlay_optional_key(model_override, replacement_override, "reasoning_capability");
+ overlay_optional_key(
+ model_override,
+ replacement_override,
+ "reasoning_implementation",
+ );
+ overlay_optional_key(
+ model_override,
+ replacement_override,
+ "default_reasoning_effort",
+ );
+ overlay_optional_key(model_override, replacement_override, "base_instructions");
+ overlay_optional_key(model_override, replacement_override, "input_modalities");
+ overlay_optional_key(model_override, replacement_override, "channel");
+ overlay_optional_key(model_override, replacement_override, "truncation_policy");
+ overlay_optional_key(
+ model_override,
+ replacement_override,
+ "supports_image_detail_original",
+ );
+ }
+ }
+ }
overlay_optional_key(document, replacement, "model_reasoning_effort_selection");
document.remove("model_thinking_selection");
document.remove("model_thinking");
diff --git a/crates/config/src/provider/runtime_equivalence.rs b/crates/config/src/provider/runtime_equivalence.rs
new file mode 100644
index 00000000..283d1647
--- /dev/null
+++ b/crates/config/src/provider/runtime_equivalence.rs
@@ -0,0 +1,51 @@
+use super::ProviderConfigSection;
+
+impl ProviderConfigSection {
+ /// Returns whether both sections have identical provider runtime settings.
+ ///
+ /// This compares every field that historically participated in full section
+ /// equality except `model_overrides`. Those overrides shape catalog metadata
+ /// only, so changing them does not require rebuilding a provider or router.
+ pub fn is_operationally_equivalent_to(&self, other: &Self) -> bool {
+ let Self {
+ defaults: left_defaults,
+ model_provider: left_model_provider,
+ model: left_model,
+ model_reasoning_effort_selection: left_reasoning_effort,
+ model_auto_compact_token_limit: left_auto_compact_token_limit,
+ model_context_window: left_context_window,
+ disable_response_storage: left_disable_response_storage,
+ preferred_auth_method: left_preferred_auth_method,
+ providers: left_providers,
+ model_bindings: left_model_bindings,
+ model_overrides: _,
+ model_providers: left_model_providers,
+ } = self;
+ let Self {
+ defaults: right_defaults,
+ model_provider: right_model_provider,
+ model: right_model,
+ model_reasoning_effort_selection: right_reasoning_effort,
+ model_auto_compact_token_limit: right_auto_compact_token_limit,
+ model_context_window: right_context_window,
+ disable_response_storage: right_disable_response_storage,
+ preferred_auth_method: right_preferred_auth_method,
+ providers: right_providers,
+ model_bindings: right_model_bindings,
+ model_overrides: _,
+ model_providers: right_model_providers,
+ } = other;
+
+ left_defaults == right_defaults
+ && left_model_provider == right_model_provider
+ && left_model == right_model
+ && left_reasoning_effort == right_reasoning_effort
+ && left_auto_compact_token_limit == right_auto_compact_token_limit
+ && left_context_window == right_context_window
+ && left_disable_response_storage == right_disable_response_storage
+ && left_preferred_auth_method == right_preferred_auth_method
+ && left_providers == right_providers
+ && left_model_bindings == right_model_bindings
+ && left_model_providers == right_model_providers
+ }
+}
diff --git a/crates/config/src/provider/schema.rs b/crates/config/src/provider/schema.rs
index 3f4eda7c..32be0398 100644
--- a/crates/config/src/provider/schema.rs
+++ b/crates/config/src/provider/schema.rs
@@ -1,6 +1,11 @@
use std::collections::BTreeMap;
+use devo_protocol::InputModality;
use devo_protocol::ProviderWireApi;
+use devo_protocol::ReasoningCapability;
+use devo_protocol::ReasoningEffort;
+use devo_protocol::ReasoningImplementation;
+use devo_protocol::TruncationPolicyConfig;
use serde::Deserialize;
use serde::Serialize;
@@ -137,6 +142,48 @@ impl Default for ModelBindingConfig {
}
}
+/// Partial metadata overrides for one catalog model stored under `[model.]`.
+///
+/// Each field is optional so user, workspace, and command-line config layers can
+/// override independent model attributes without replacing lower-priority values.
+#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
+pub struct ModelOverrideConfig {
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub display_name: Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub description: Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub context_window: Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub effective_context_window_percent: Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub max_tokens: Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub temperature: Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub top_p: Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub top_k: Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub provider: Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub reasoning_capability: Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub reasoning_implementation: Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub default_reasoning_effort: Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub base_instructions: Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub input_modalities: Option>,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub channel: Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub truncation_policy: Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub supports_image_detail_original: Option,
+}
+
/// Durable default selections stored under `[defaults]`.
#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
pub struct ProviderDefaultsConfig {
@@ -197,13 +244,10 @@ pub enum AuthCredentialKind {
}
/// Provider-owned portion of app config, including active model selection.
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize)]
+#[derive(Debug, Clone, Default, PartialEq)]
pub struct ProviderConfigSection {
- #[serde(default, skip_serializing_if = "ProviderDefaultsConfig::is_empty")]
pub defaults: ProviderDefaultsConfig,
- #[serde(skip_serializing_if = "Option::is_none")]
pub model_provider: Option,
- #[serde(skip_serializing_if = "Option::is_none")]
pub model: Option,
/// Logical reasoning effort selection for the active model, such as `disabled`,
/// `enabled`, or one effort-like level supported by the selected model.
@@ -212,21 +256,14 @@ pub struct ProviderConfigSection {
/// field. The runtime later resolves it into the final request model,
/// provider `thinking` parameter, effective reasoning effort, and any
/// provider-specific extra payload.
- #[serde(skip_serializing_if = "Option::is_none")]
pub model_reasoning_effort_selection: Option,
- #[serde(skip_serializing_if = "Option::is_none")]
pub model_auto_compact_token_limit: Option,
- #[serde(skip_serializing_if = "Option::is_none")]
pub model_context_window: Option,
- #[serde(skip_serializing_if = "Option::is_none")]
pub disable_response_storage: Option,
- #[serde(skip_serializing_if = "Option::is_none")]
pub preferred_auth_method: Option,
- #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
pub providers: BTreeMap,
- #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
pub model_bindings: BTreeMap,
- #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+ pub model_overrides: BTreeMap,
pub model_providers: BTreeMap,
}
@@ -235,7 +272,7 @@ struct ProviderConfigSectionWire {
#[serde(default)]
defaults: ProviderDefaultsConfig,
model_provider: Option,
- model: Option,
+ model: Option,
model_reasoning_effort_selection: Option,
model_thinking_selection: Option,
model_thinking: Option,
@@ -251,12 +288,86 @@ struct ProviderConfigSectionWire {
model_providers: BTreeMap,
}
+#[derive(Deserialize)]
+#[serde(untagged)]
+enum ModelConfigField {
+ Legacy(String),
+ Overrides(BTreeMap),
+}
+
+#[derive(Serialize)]
+#[serde(untagged)]
+enum SerializedModelConfigField<'a> {
+ Legacy(&'a str),
+ Overrides(&'a BTreeMap),
+}
+
+#[derive(Serialize)]
+struct ProviderConfigSectionSerialize<'a> {
+ #[serde(default, skip_serializing_if = "ProviderDefaultsConfig::is_empty")]
+ defaults: &'a ProviderDefaultsConfig,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ model_provider: &'a Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ model: Option>,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ model_reasoning_effort_selection: &'a Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ model_auto_compact_token_limit: &'a Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ model_context_window: &'a Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ disable_response_storage: &'a Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ preferred_auth_method: &'a Option,
+ #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+ providers: &'a BTreeMap,
+ #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+ model_bindings: &'a BTreeMap,
+ #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+ model_providers: &'a BTreeMap,
+}
+
+impl Serialize for ProviderConfigSection {
+ fn serialize(&self, serializer: S) -> Result
+ where
+ S: serde::Serializer,
+ {
+ let model = if self.model_overrides.is_empty() {
+ self.model
+ .as_deref()
+ .map(SerializedModelConfigField::Legacy)
+ } else {
+ Some(SerializedModelConfigField::Overrides(&self.model_overrides))
+ };
+ ProviderConfigSectionSerialize {
+ defaults: &self.defaults,
+ model_provider: &self.model_provider,
+ model,
+ model_reasoning_effort_selection: &self.model_reasoning_effort_selection,
+ model_auto_compact_token_limit: &self.model_auto_compact_token_limit,
+ model_context_window: &self.model_context_window,
+ disable_response_storage: &self.disable_response_storage,
+ preferred_auth_method: &self.preferred_auth_method,
+ providers: &self.providers,
+ model_bindings: &self.model_bindings,
+ model_providers: &self.model_providers,
+ }
+ .serialize(serializer)
+ }
+}
+
impl From for ProviderConfigSection {
fn from(wire: ProviderConfigSectionWire) -> Self {
+ let (model, model_overrides) = match wire.model {
+ Some(ModelConfigField::Legacy(model)) => (Some(model), BTreeMap::new()),
+ Some(ModelConfigField::Overrides(model_overrides)) => (None, model_overrides),
+ None => (None, BTreeMap::new()),
+ };
Self {
defaults: wire.defaults,
model_provider: wire.model_provider,
- model: wire.model,
+ model,
model_reasoning_effort_selection: wire
.model_reasoning_effort_selection
.or(wire.model_thinking_selection)
@@ -267,6 +378,7 @@ impl From for ProviderConfigSection {
preferred_auth_method: wire.preferred_auth_method,
providers: wire.providers,
model_bindings: wire.model_bindings,
+ model_overrides,
model_providers: wire.model_providers,
}
}
@@ -370,6 +482,62 @@ impl ProviderConfigSection {
binding.enabled = overlay_binding.enabled;
}
}
+ for (model_slug, overlay_override) in overlay.model_overrides {
+ let model_override = self.model_overrides.entry(model_slug).or_default();
+ if overlay_override.display_name.is_some() {
+ model_override.display_name = overlay_override.display_name;
+ }
+ if overlay_override.description.is_some() {
+ model_override.description = overlay_override.description;
+ }
+ if overlay_override.context_window.is_some() {
+ model_override.context_window = overlay_override.context_window;
+ }
+ if overlay_override.effective_context_window_percent.is_some() {
+ model_override.effective_context_window_percent =
+ overlay_override.effective_context_window_percent;
+ }
+ if overlay_override.max_tokens.is_some() {
+ model_override.max_tokens = overlay_override.max_tokens;
+ }
+ if overlay_override.temperature.is_some() {
+ model_override.temperature = overlay_override.temperature;
+ }
+ if overlay_override.top_p.is_some() {
+ model_override.top_p = overlay_override.top_p;
+ }
+ if overlay_override.top_k.is_some() {
+ model_override.top_k = overlay_override.top_k;
+ }
+ if overlay_override.provider.is_some() {
+ model_override.provider = overlay_override.provider;
+ }
+ if overlay_override.reasoning_capability.is_some() {
+ model_override.reasoning_capability = overlay_override.reasoning_capability;
+ }
+ if overlay_override.reasoning_implementation.is_some() {
+ model_override.reasoning_implementation = overlay_override.reasoning_implementation;
+ }
+ if overlay_override.default_reasoning_effort.is_some() {
+ model_override.default_reasoning_effort = overlay_override.default_reasoning_effort;
+ }
+ if overlay_override.base_instructions.is_some() {
+ model_override.base_instructions = overlay_override.base_instructions;
+ }
+ if overlay_override.input_modalities.is_some() {
+ model_override.input_modalities = overlay_override.input_modalities;
+ }
+ if overlay_override.channel.is_some() {
+ model_override.channel = overlay_override.channel;
+ }
+ if overlay_override.truncation_policy.is_some() {
+ model_override.truncation_policy = overlay_override.truncation_policy;
+ }
+ if overlay_override.supports_image_detail_original.is_some() {
+ model_override.supports_image_detail_original =
+ overlay_override.supports_image_detail_original;
+ }
+ }
}
}
@@ -502,4 +670,123 @@ model_reasoning_effort_selection = "high"
assert!(!serialized.contains("model_thinking_selection"));
assert!(!serialized.contains("model_thinking"));
}
+
+ #[test]
+ fn provider_config_reads_legacy_model_selector() {
+ let config: ProviderConfigSection =
+ toml::from_str("model = \"legacy-model\"").expect("parse legacy model selector");
+
+ assert_eq!(config.model.as_deref(), Some("legacy-model"));
+ assert!(config.model_overrides.is_empty());
+ assert_eq!(
+ toml::to_string(&config).expect("serialize legacy model selector"),
+ "model = \"legacy-model\"\n"
+ );
+ }
+
+ #[test]
+ fn provider_config_reads_model_override_table() {
+ let config: ProviderConfigSection = toml::from_str(
+ r#"
+[model.grok-4]
+display_name = "Grok 4"
+description = "Fast reasoning model"
+context_window = 256000
+effective_context_window_percent = 90
+max_tokens = 8192
+temperature = 0.7
+top_p = 0.95
+top_k = 40.0
+provider = "openai_responses"
+reasoning_capability = "toggle"
+reasoning_implementation = "request_parameter"
+default_reasoning_effort = "high"
+base_instructions = "Be concise."
+input_modalities = ["text", "image"]
+channel = "xAI"
+truncation_policy = { mode = "tokens", limit = 12000 }
+supports_image_detail_original = true
+"#,
+ )
+ .expect("parse model overrides");
+
+ assert_eq!(config.model, None);
+ assert_eq!(
+ config.model_overrides,
+ BTreeMap::from([(
+ "grok-4".to_string(),
+ ModelOverrideConfig {
+ display_name: Some("Grok 4".to_string()),
+ description: Some("Fast reasoning model".to_string()),
+ context_window: Some(256_000),
+ effective_context_window_percent: Some(90),
+ max_tokens: Some(8_192),
+ temperature: Some(0.7),
+ top_p: Some(0.95),
+ top_k: Some(40.0),
+ provider: Some(ProviderWireApi::OpenAIResponses),
+ reasoning_capability: Some(ReasoningCapability::Toggle),
+ reasoning_implementation: Some(ReasoningImplementation::RequestParameter),
+ default_reasoning_effort: Some(ReasoningEffort::High),
+ base_instructions: Some("Be concise.".to_string()),
+ input_modalities: Some(vec![InputModality::Text, InputModality::Image]),
+ channel: Some("xAI".to_string()),
+ truncation_policy: Some(TruncationPolicyConfig::tokens(12_000)),
+ supports_image_detail_original: Some(true),
+ },
+ )])
+ );
+
+ let serialized = toml::to_string(&config).expect("serialize model overrides");
+ assert!(serialized.contains("[model.grok-4]"));
+ assert!(!serialized.contains("model = \""));
+ }
+
+ #[test]
+ fn provider_config_operational_equality_ignores_model_overrides() {
+ let baseline = ProviderConfigSection::default();
+ let metadata_override = ProviderConfigSection {
+ model_overrides: BTreeMap::from([(
+ "custom-model".to_string(),
+ ModelOverrideConfig {
+ display_name: Some("Custom Model".to_string()),
+ ..ModelOverrideConfig::default()
+ },
+ )]),
+ ..baseline.clone()
+ };
+
+ assert_ne!(baseline, metadata_override);
+ assert!(baseline.is_operationally_equivalent_to(&metadata_override));
+ }
+
+ #[test]
+ fn provider_config_operational_equality_detects_provider_and_binding_changes() {
+ let baseline = ProviderConfigSection::default();
+ let provider_change = ProviderConfigSection {
+ providers: BTreeMap::from([(
+ "openai".to_string(),
+ ProviderVendorConfig {
+ name: "OpenAI".to_string(),
+ ..ProviderVendorConfig::default()
+ },
+ )]),
+ ..baseline.clone()
+ };
+ let binding_change = ProviderConfigSection {
+ model_bindings: BTreeMap::from([(
+ "main".to_string(),
+ ModelBindingConfig {
+ model_slug: "gpt-5.5".to_string(),
+ provider: "openai".to_string(),
+ request_model: "gpt-5.5".to_string(),
+ ..ModelBindingConfig::default()
+ },
+ )]),
+ ..baseline.clone()
+ };
+
+ assert!(!baseline.is_operationally_equivalent_to(&provider_change));
+ assert!(!baseline.is_operationally_equivalent_to(&binding_change));
+ }
}
diff --git a/crates/config/src/tests.rs b/crates/config/src/tests.rs
index 33b10e4a..ac426944 100644
--- a/crates/config/src/tests.rs
+++ b/crates/config/src/tests.rs
@@ -20,13 +20,20 @@ use super::HooksConfig;
use super::LogRotation;
use super::LoggingConfig;
use super::ModelBindingConfig;
+use super::ModelOverrideConfig;
use super::OAuthCredentialsStoreMode;
+use super::PatternMode;
+use super::PermissionConfig;
+use super::PermissionRule;
use super::ProjectConfig;
+use super::PromptPolicy;
use super::ProviderConfigSection;
use super::ProviderDefaultsConfig;
use super::ProviderHttpConfig;
use super::ProviderVendorConfig;
+use super::RuleAction;
use super::SummaryModelSelection;
+use super::ToolFilter;
use super::ToolsConfig;
use super::UpdatesConfig;
use crate::BundledSkillsConfig;
@@ -34,6 +41,8 @@ use crate::SkillsConfig;
use devo_protocol::ProviderModelBinding;
use devo_protocol::ProviderVendor;
use devo_protocol::ProviderWireApi;
+use devo_protocol::ReasoningEffort;
+use devo_protocol::TruncationPolicyConfig;
fn unique_temp_dir(name: &str) -> PathBuf {
let nanos = SystemTime::now()
@@ -130,6 +139,7 @@ check_interval_hours = 48
mcp: super::McpConfig::default(),
tools: ToolsConfig::default(),
hooks: HooksConfig::default(),
+ permission: PermissionConfig::default(),
provider: ProviderConfigSection::default(),
provider_http: super::ProviderHttpConfig::default(),
updates: UpdatesConfig {
@@ -145,6 +155,284 @@ check_interval_hours = 48
let _ = std::fs::remove_dir_all(root);
}
+#[test]
+fn loader_defaults_permission_config_when_section_is_absent() {
+ let root = unique_temp_dir("permission-default");
+ let home = root.join("home").join(".devo");
+ std::fs::create_dir_all(&home).expect("home config dir");
+
+ let config = FileSystemAppConfigLoader::new(home)
+ .load(None)
+ .expect("load config");
+
+ assert_eq!(config.permission, PermissionConfig::default());
+
+ let _ = std::fs::remove_dir_all(root);
+}
+
+#[test]
+fn loader_reads_permission_rules_and_auto_default_mode() {
+ let root = unique_temp_dir("permission-rules");
+ let home = root.join("home").join(".devo");
+ std::fs::create_dir_all(&home).expect("home config dir");
+ std::fs::write(
+ home.join("config.toml"),
+ r#"
+[permission]
+default_mode = "auto"
+
+[[permission.rules]]
+action = "allow"
+tool = "bash"
+pattern = "git *"
+
+[[permission.rules]]
+action = "deny"
+tool = "edit"
+pattern = "**/.env"
+
+[[permission.rules]]
+action = "ask"
+tool = "web_fetch"
+pattern = "example.com"
+pattern_mode = "domain"
+
+[[permission.rules]]
+tool = "read"
+"#,
+ )
+ .expect("write user config");
+
+ let config = FileSystemAppConfigLoader::new(home)
+ .load(None)
+ .expect("load config");
+
+ assert_eq!(
+ config.permission,
+ PermissionConfig {
+ rules: vec![
+ PermissionRule {
+ action: RuleAction::Allow,
+ tool: ToolFilter::Bash,
+ pattern: Some("git *".to_string()),
+ pattern_mode: PatternMode::Glob,
+ },
+ PermissionRule {
+ action: RuleAction::Deny,
+ tool: ToolFilter::Edit,
+ pattern: Some("**/.env".to_string()),
+ pattern_mode: PatternMode::Glob,
+ },
+ PermissionRule {
+ action: RuleAction::Ask,
+ tool: ToolFilter::WebFetch,
+ pattern: Some("example.com".to_string()),
+ pattern_mode: PatternMode::Domain,
+ },
+ PermissionRule {
+ action: RuleAction::Deny,
+ tool: ToolFilter::Read,
+ pattern: None,
+ pattern_mode: PatternMode::Glob,
+ },
+ ],
+ prompt_policy: PromptPolicy::Auto,
+ }
+ );
+
+ let _ = std::fs::remove_dir_all(root);
+}
+
+#[test]
+fn default_app_config_serializes_permission_default_mode() {
+ let serialized = toml::Value::try_from(AppConfig::default()).expect("serialize config");
+
+ assert_eq!(
+ serialized
+ .get("permission")
+ .and_then(toml::Value::as_table)
+ .and_then(|permission| permission.get("default_mode"))
+ .and_then(toml::Value::as_str),
+ Some("ask")
+ );
+}
+
+#[test]
+fn loader_rejects_invalid_permission_rule_action() {
+ let root = unique_temp_dir("permission-invalid-action");
+ let home = root.join("home").join(".devo");
+ std::fs::create_dir_all(&home).expect("home config dir");
+ std::fs::write(
+ home.join("config.toml"),
+ "[[permission.rules]]\naction = 'approve'\n",
+ )
+ .expect("write user config");
+
+ let result = FileSystemAppConfigLoader::new(home).load(None);
+
+ assert!(matches!(result, Err(super::AppConfigError::Parse { .. })));
+
+ let _ = std::fs::remove_dir_all(root);
+}
+
+#[test]
+fn loader_preserves_lower_permission_section_when_higher_layer_omits_it() {
+ let root = unique_temp_dir("permission-preserve-overlay");
+ let home = root.join("home").join(".devo");
+ let workspace = root.join("workspace");
+ std::fs::create_dir_all(&home).expect("home config dir");
+ std::fs::create_dir_all(workspace.join(".devo")).expect("workspace config dir");
+ std::fs::write(
+ home.join("config.toml"),
+ "[permission]\ndefault_mode = 'deny'\n[[permission.rules]]\naction = 'allow'\ntool = 'web_search'\n",
+ )
+ .expect("write user config");
+ std::fs::write(
+ workspace.join(".devo").join("config.toml"),
+ "[logging]\nlevel = 'debug'\n",
+ )
+ .expect("write project config");
+
+ let config = FileSystemAppConfigLoader::new(home)
+ .load(Some(&workspace))
+ .expect("load config");
+
+ assert_eq!(
+ config.permission,
+ PermissionConfig {
+ rules: vec![PermissionRule {
+ action: RuleAction::Allow,
+ tool: ToolFilter::WebSearch,
+ pattern: None,
+ pattern_mode: PatternMode::Glob,
+ }],
+ prompt_policy: PromptPolicy::Deny,
+ }
+ );
+
+ let _ = std::fs::remove_dir_all(root);
+}
+
+#[test]
+fn loader_replaces_lower_permission_section_when_higher_layer_supplies_it() {
+ let root = unique_temp_dir("permission-replace-overlay");
+ let home = root.join("home").join(".devo");
+ let workspace = root.join("workspace");
+ std::fs::create_dir_all(&home).expect("home config dir");
+ std::fs::create_dir_all(workspace.join(".devo")).expect("workspace config dir");
+ std::fs::write(
+ home.join("config.toml"),
+ "[permission]\ndefault_mode = 'auto'\n[[permission.rules]]\naction = 'allow'\ntool = 'bash'\n",
+ )
+ .expect("write user config");
+ std::fs::write(
+ workspace.join(".devo").join("config.toml"),
+ "[permission]\ndefault_mode = 'deny'\n[[permission.rules]]\naction = 'ask'\ntool = 'mcp'\n",
+ )
+ .expect("write project config");
+
+ let config = FileSystemAppConfigLoader::new(home)
+ .load(Some(&workspace))
+ .expect("load config");
+
+ assert_eq!(
+ config.permission,
+ PermissionConfig {
+ rules: vec![PermissionRule {
+ action: RuleAction::Ask,
+ tool: ToolFilter::Mcp,
+ pattern: None,
+ pattern_mode: PatternMode::Glob,
+ }],
+ prompt_policy: PromptPolicy::Deny,
+ }
+ );
+
+ let _ = std::fs::remove_dir_all(root);
+}
+
+#[test]
+fn loader_cli_overlay_preserves_workspace_permission_when_omitted() {
+ let root = unique_temp_dir("permission-cli-preserve-overlay");
+ let home = root.join("home").join(".devo");
+ let workspace = root.join("workspace");
+ std::fs::create_dir_all(&home).expect("home config dir");
+ std::fs::create_dir_all(workspace.join(".devo")).expect("workspace config dir");
+ std::fs::write(
+ workspace.join(".devo").join("config.toml"),
+ "[permission]\ndefault_mode = 'auto'\n[[permission.rules]]\naction = 'allow'\ntool = 'bash'\npattern = 'git *'\n",
+ )
+ .expect("write project config");
+ let cli_overrides: toml::Value = "[logging]\nlevel = 'trace'\n"
+ .parse()
+ .expect("parse cli overrides");
+
+ let config = FileSystemAppConfigLoader::new(home)
+ .with_cli_overrides(cli_overrides)
+ .load(Some(&workspace))
+ .expect("load config");
+
+ assert_eq!(
+ config.permission,
+ PermissionConfig {
+ rules: vec![PermissionRule {
+ action: RuleAction::Allow,
+ tool: ToolFilter::Bash,
+ pattern: Some("git *".to_string()),
+ pattern_mode: PatternMode::Glob,
+ }],
+ prompt_policy: PromptPolicy::Auto,
+ }
+ );
+
+ let _ = std::fs::remove_dir_all(root);
+}
+
+#[test]
+fn loader_cli_overlay_replaces_workspace_permission_section() {
+ let root = unique_temp_dir("permission-cli-replace-overlay");
+ let home = root.join("home").join(".devo");
+ let workspace = root.join("workspace");
+ std::fs::create_dir_all(&home).expect("home config dir");
+ std::fs::create_dir_all(workspace.join(".devo")).expect("workspace config dir");
+ std::fs::write(
+ workspace.join(".devo").join("config.toml"),
+ "[permission]\ndefault_mode = 'auto'\n[[permission.rules]]\naction = 'allow'\ntool = 'bash'\npattern = 'git *'\n",
+ )
+ .expect("write project config");
+ let cli_overrides: toml::Value = r#"
+[permission]
+default_mode = "deny"
+
+[[permission.rules]]
+action = "ask"
+tool = "mcp"
+pattern = "deploy"
+"#
+ .parse()
+ .expect("parse cli overrides");
+
+ let config = FileSystemAppConfigLoader::new(home)
+ .with_cli_overrides(cli_overrides)
+ .load(Some(&workspace))
+ .expect("load config");
+
+ assert_eq!(
+ config.permission,
+ PermissionConfig {
+ rules: vec![PermissionRule {
+ action: RuleAction::Ask,
+ tool: ToolFilter::Mcp,
+ pattern: Some("deploy".to_string()),
+ pattern_mode: PatternMode::Glob,
+ }],
+ prompt_policy: PromptPolicy::Deny,
+ }
+ );
+
+ let _ = std::fs::remove_dir_all(root);
+}
+
#[test]
fn default_app_config_enables_code_search() {
assert_eq!(
@@ -560,6 +848,84 @@ request_model = "project/model"
let _ = std::fs::remove_dir_all(root);
}
+#[test]
+fn loader_merges_model_overrides_field_by_field_across_layers() {
+ let root = unique_temp_dir("config-model-overrides-overlay");
+ let home = root.join("home").join(".devo");
+ let workspace = root.join("workspace");
+ std::fs::create_dir_all(&home).expect("home config dir");
+ std::fs::create_dir_all(workspace.join(".devo")).expect("workspace config dir");
+
+ std::fs::write(
+ home.join("config.toml"),
+ r#"
+[model.grok-4]
+display_name = "User Grok"
+description = "User description"
+context_window = 128000
+temperature = 0.4
+provider = "openai_chat_completions"
+default_reasoning_effort = "medium"
+truncation_policy = { mode = "tokens", limit = 8000 }
+"#,
+ )
+ .expect("write user config");
+ std::fs::write(
+ workspace.join(".devo").join("config.toml"),
+ r#"
+[model.grok-4]
+description = "Workspace description"
+context_window = 192000
+top_p = 0.9
+"#,
+ )
+ .expect("write workspace config");
+ let cli_overrides: toml::Value = r#"
+[model.grok-4]
+display_name = "CLI Grok"
+temperature = 0.2
+
+[model.grok-4-mini]
+display_name = "Grok 4 Mini"
+max_tokens = 4096
+"#
+ .parse()
+ .expect("parse cli overrides");
+
+ let loader = FileSystemAppConfigLoader::new(home).with_cli_overrides(cli_overrides);
+ let config = loader.load(Some(&workspace)).expect("load config");
+
+ assert_eq!(
+ config.provider.model_overrides,
+ BTreeMap::from([
+ (
+ "grok-4".to_string(),
+ ModelOverrideConfig {
+ display_name: Some("CLI Grok".to_string()),
+ description: Some("Workspace description".to_string()),
+ context_window: Some(192_000),
+ temperature: Some(0.2),
+ top_p: Some(0.9),
+ provider: Some(ProviderWireApi::OpenAIChatCompletions),
+ default_reasoning_effort: Some(ReasoningEffort::Medium),
+ truncation_policy: Some(TruncationPolicyConfig::tokens(8_000)),
+ ..ModelOverrideConfig::default()
+ },
+ ),
+ (
+ "grok-4-mini".to_string(),
+ ModelOverrideConfig {
+ display_name: Some("Grok 4 Mini".to_string()),
+ max_tokens: Some(4_096),
+ ..ModelOverrideConfig::default()
+ },
+ ),
+ ])
+ );
+
+ let _ = std::fs::remove_dir_all(root);
+}
+
/// Trace: L2-DES-APP-005
/// Verifies: CLI provider overrides participate in the same provider merge precedence as other CLI config.
#[test]
@@ -687,6 +1053,7 @@ fn provider_upsert_writes_user_config_when_workspace_is_active() {
assert!(user_config.contains("[providers.openrouter]"));
assert!(user_config.contains("[model_bindings.qwen-openrouter]"));
assert!(user_config.contains("model_binding = \"qwen-openrouter\""));
+ assert!(document.get("model").is_none());
assert_eq!(
document["providers"]["openrouter"]["headers"].as_str(),
Some(r#"{"X-Devo":"yes"}"#)
@@ -824,6 +1191,62 @@ fn loader_reads_project_configs() {
let root = unique_temp_dir("config-projects");
let home = root.join("home").join(".devo");
std::fs::create_dir_all(&home).expect("home config dir");
+ std::fs::write(
+ home.join("config.toml"),
+ "[projects.\"C:\\\\repo\"]\npermission_preset = 'auto-review'\n",
+ )
+ .expect("write user config");
+
+ let loader = FileSystemAppConfigLoader::new(home);
+ let config = loader.load(None).expect("load config");
+
+ assert_eq!(
+ config.projects,
+ BTreeMap::from([(
+ "C:\\repo".to_string(),
+ ProjectConfig {
+ permission_preset: Some(PermissionPreset::AutoReview),
+ sandbox_profile: None,
+ },
+ )])
+ );
+
+ let _ = std::fs::remove_dir_all(root);
+}
+
+#[test]
+fn loader_reads_project_sandbox_profile() {
+ let root = unique_temp_dir("config-projects-sandbox");
+ let home = root.join("home").join(".devo");
+ std::fs::create_dir_all(&home).expect("home config dir");
+ std::fs::write(
+ home.join("config.toml"),
+ "[projects.\"C:\\\\repo\"]\nsandbox_profile = 'strict'\n",
+ )
+ .expect("write user config");
+
+ let loader = FileSystemAppConfigLoader::new(home);
+ let config = loader.load(None).expect("load config");
+
+ assert_eq!(
+ config.projects,
+ BTreeMap::from([(
+ "C:\\repo".to_string(),
+ ProjectConfig {
+ permission_preset: None,
+ sandbox_profile: Some("strict".to_string()),
+ },
+ )])
+ );
+
+ let _ = std::fs::remove_dir_all(root);
+}
+
+#[test]
+fn loader_maps_legacy_read_only_preset_to_default() {
+ let root = unique_temp_dir("config-legacy-read-only");
+ let home = root.join("home").join(".devo");
+ std::fs::create_dir_all(&home).expect("home config dir");
std::fs::write(
home.join("config.toml"),
"[projects.\"C:\\\\repo\"]\npermission_preset = 'read-only'\n",
@@ -838,7 +1261,8 @@ fn loader_reads_project_configs() {
BTreeMap::from([(
"C:\\repo".to_string(),
ProjectConfig {
- permission_preset: Some(PermissionPreset::ReadOnly),
+ permission_preset: Some(PermissionPreset::Default),
+ sandbox_profile: None,
},
)])
);
diff --git a/crates/core/Cargo.toml b/crates/core/Cargo.toml
index 5c74981c..89f265c1 100644
--- a/crates/core/Cargo.toml
+++ b/crates/core/Cargo.toml
@@ -16,10 +16,13 @@ code-search = ["dep:devo-code-search"]
[dependencies]
devo-config = { workspace = true }
devo-code-search = { workspace = true, optional = true }
+devo-execpolicy = { workspace = true }
devo-network-proxy = { workspace = true }
devo-protocol = { workspace = true }
devo-provider = { workspace = true }
devo-safety = { workspace = true }
+devo-sandbox = { workspace = true }
+devo-windows-sandbox = { workspace = true }
devo-skills = { workspace = true }
devo-tools = { workspace = true }
devo-util-process = { workspace = true }
diff --git a/crates/core/models.json b/crates/core/models.json
index 9dedfbc9..0e50fd15 100644
--- a/crates/core/models.json
+++ b/crates/core/models.json
@@ -1,97 +1,27 @@
[
{
- "slug": "qwen3-coder-next",
- "display_name": "qwen3-coder-next",
- "channel": "Qwen",
- "provider": "openai_chat_completions",
- "description": "3B activated parameters (80B total parameters) released at 02/2026 by Qwen",
- "reasoning_capability": "unsupported",
- "default_reasoning_level": "",
- "supported_reasoning_levels": [],
- "temperature": 1.0,
- "top_p": 0.95,
- "top_k": 40,
- "context_window": 256000,
- "effective_context_window_percent": 95,
- "input_modalities": [
- "text"
- ],
- "truncation_policy": {
- "mode": "tokens",
- "limit": 10000
- },
- "max_tokens": 4096
- },
- {
- "slug": "gemma4-12b",
- "display_name": "gemma4-12b",
- "channel": "Gemma4",
- "provider": "openai_chat_completions",
- "description": "",
- "reasoning_capability": "toggle",
- "default_reasoning_level": "",
- "supported_reasoning_levels": [],
- "temperature": 1.0,
- "top_p": 0.95,
- "top_k": 64,
- "context_window": 65536,
- "effective_context_window_percent": 95,
- "input_modalities": [
- "text"
- ],
- "truncation_policy": {
- "mode": "tokens",
- "limit": 10000
- },
- "max_tokens": 4096
- },
- {
- "slug": "kimi-k2.5",
- "display_name": "kimi-k2.5",
+ "slug": "kimi-k3",
+ "display_name": "kimi-k3",
"channel": "Kimi",
"provider": "openai_chat_completions",
- "description": "An open-weight, native multimodal agentic model, 3B activated parameters (80B total parameters) released at 2026 by moonshot",
+ "description": "Kimi's flagship model",
"reasoning_capability": "toggle",
- "default_reasoning_level": "",
- "supported_reasoning_levels": [],
- "reasoning_implementation": {
- "model_variant": {
- "variants": [
- {
- "selection_value": "disabled",
- "model_slug": "kimi-k2.5",
- "reasoning_effort": null,
- "extra_body": {
- "thinking": {
- "type": "disabled"
- }
- },
- "label": "Off",
- "description": "Disable reasoning effort"
- },
- {
- "selection_value": "enabled",
- "model_slug": "kimi-k2.5",
- "reasoning_effort": "medium",
- "label": "On",
- "description": "Enable thinking"
- }
- ]
- }
- },
- "temperature": 1.0,
- "top_p": 0.95,
- "context_window": 256000,
+ "default_reasoning_level": "high",
+ "supported_reasoning_levels": [
+ "low",
+ "high",
+ "max"
+ ],
+ "context_window": 1048576,
+ "max_tokens": 8096,
"effective_context_window_percent": 95,
"truncation_policy": {
"mode": "tokens",
"limit": 10000
},
"input_modalities": [
- "text",
- "image"
- ],
- "max_tokens": 4096
+ "text", "image"
+ ]
},
{
"slug": "MiniMax-M3",
diff --git a/crates/core/src/durable_record.rs b/crates/core/src/durable_record.rs
index ad7f94a9..3415a8f5 100644
--- a/crates/core/src/durable_record.rs
+++ b/crates/core/src/durable_record.rs
@@ -1051,6 +1051,23 @@ pub enum GoalProgressType {
// ── Context Records ────────────────────────────────────────────────────
+/// Work around `serde_json` `arbitrary_precision` breaking `f64` fields inside
+/// internally tagged enums (`DurableRecord`): buffered number content can appear
+/// as a map to the nested deserializer.
+fn deserialize_f64_via_json_value<'de, D>(deserializer: D) -> Result
+where
+ D: serde::Deserializer<'de>,
+{
+ use serde::de::Error;
+ let value = serde_json::Value::deserialize(deserializer)?;
+ match value {
+ serde_json::Value::Number(number) => number
+ .as_f64()
+ .ok_or_else(|| D::Error::custom("expected finite f64")),
+ other => serde_json::from_value(other).map_err(D::Error::custom),
+ }
+}
+
#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
pub struct ContextSnapshotRecordedRecord {
pub schema_version: u32,
@@ -1069,6 +1086,9 @@ pub struct ContextCompactionStartedRecord {
pub turn_id: TurnId,
pub compaction_id: String,
pub pre_compaction_context_size: u64,
+ /// Compaction trigger ratio. Custom deserialize works around `serde_json`
+ /// `arbitrary_precision` breaking `f64` inside internally tagged enums.
+ #[serde(deserialize_with = "deserialize_f64_via_json_value")]
pub threshold_ratio: f64,
pub started_at: DateTime,
}
diff --git a/crates/core/src/mcp.rs b/crates/core/src/mcp.rs
index c65137d7..7068b20b 100644
--- a/crates/core/src/mcp.rs
+++ b/crates/core/src/mcp.rs
@@ -331,7 +331,7 @@ mod tests {
}
#[test]
- fn exposure_uses_codex_threshold() {
+ fn exposure_uses_direct_mcp_tool_threshold() {
let tools = (0..DIRECT_MCP_TOOL_EXPOSURE_THRESHOLD)
.map(|idx| {
let mut tool = tool_with_meta(None);
diff --git a/crates/core/src/model_catalog.rs b/crates/core/src/model_catalog.rs
index 6605deca..f3629272 100644
--- a/crates/core/src/model_catalog.rs
+++ b/crates/core/src/model_catalog.rs
@@ -1,129 +1,68 @@
//! Builtin model catalog loading and resolution for core.
//!
-//! Main focus:
-//! - load the bundled preset list from disk-independent embedded assets
-//! - load per-user and per-project model overrides from the filesystem
-//! - convert raw `ModelPreset` values into runtime `Model` values
-//! - provide the concrete builtin implementation of the shared `ModelCatalog` trait
-//!
-//! Design:
-//! - catalog loading stays in `devo-core` because the embedded assets live here
-//! - this module is the bridge between raw preset/config data and runtime model consumers
-//! - models are sorted and materialized here so downstream code can work only with resolved `Model`
-//! - precedence is: `/.devo/models.json` > `~/.devo/models.json` > builtin
-//!
-//! Boundary:
-//! - this module should not define the runtime model shape itself; that lives in `devo-protocol`
-//! - serde compatibility for the raw preset file belongs in `model_preset.rs`
-//! - execution logic should depend on `ModelCatalog` and `Model`, not on how this module reads JSON
-//!
-use std::path::{Path, PathBuf};
+//! The embedded `models.json` asset is the catalog base. Configuration can
+//! override individual metadata fields or add custom models without creating
+//! or reading a filesystem catalog.
+use std::collections::BTreeMap;
use crate::{Model, ModelCatalog, ModelError, ModelPreset};
-use serde_json::Value;
-
-mod user_sync;
+use devo_config::ModelOverrideConfig;
const BUILTIN_MODELS_JSON: &str = include_str!("../models.json");
pub use crate::model_preset::default_base_instructions;
-/// Filesystem-independent loader for the built-in model catalog bundled with the binary.
-///
-/// Use [`PresetModelCatalog::load_from_config`] to include user and project overrides.
-/// Use [`PresetModelCatalog::load`] for the builtin-only variant (tests, doctor, etc.).
+/// A catalog resolved from embedded presets and configuration overrides.
#[derive(Debug, Clone, Default)]
pub struct PresetModelCatalog {
models: Vec,
- warnings: Vec,
-}
-
-/// Non-fatal filesystem catalog issue recorded while loading `models.json`.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct ModelCatalogWarning {
- pub path: PathBuf,
- pub message: String,
}
impl PresetModelCatalog {
- /// Loads the built-in catalog only (no filesystem overrides).
+ /// Loads the built-in embedded catalog only.
pub fn load() -> Result {
Ok(Self {
models: load_builtin_models()?,
- warnings: Vec::new(),
})
}
- /// Loads the effective catalog from three layers. Precedence is:
- /// 1. `/.devo/models.json` (project overrides)
- /// 2. `config_home/models.json` (user overrides)
- /// 3. built-in models (embedded fallback)
- ///
- /// Implementation loads from fallback to highest precedence so later
- /// layers can replace entries with the same slug.
- ///
- /// The user file is synchronized with the built-in list while preserving
- /// pinned, edited, and user-defined entries.
+ /// Loads the embedded catalog with configured metadata overrides.
pub fn load_from_config(
- config_home: &Path,
- workspace_root: Option<&Path>,
+ model_overrides: &BTreeMap,
+ ) -> Result {
+ Self::with_model_overrides(model_overrides)
+ }
+
+ /// Loads embedded presets and applies overrides by model slug.
+ pub fn with_model_overrides(
+ model_overrides: &BTreeMap,
) -> Result {
let mut presets = load_builtin_model_presets()?;
- let mut warnings = Vec::new();
- let user_path = config_home.join("models.json");
- let project_path =
- workspace_root.map(|workspace_root| workspace_root.join(".devo").join("models.json"));
- let user_path_is_workspace_owned = project_path
- .as_ref()
- .is_some_and(|project_path| catalog_paths_alias(&user_path, project_path));
-
- if !user_path_is_workspace_owned {
- let builtin_entries: Vec = serde_json::from_str(BUILTIN_MODELS_JSON)?;
- let user_sync = user_sync::synchronize_user_catalog(&user_path, &builtin_entries);
- if let Some(user_presets) = user_sync.presets {
- presets = merge_model_presets(presets, user_presets);
- }
- for message in user_sync.warnings {
- tracing::warn!(
- path = %user_path.display(),
- warning = %message,
- "model catalog synchronization warning"
- );
- warnings.push(ModelCatalogWarning {
- path: user_path.clone(),
- message,
- });
+ for (slug, overrides) in model_overrides {
+ if let Some(preset) = presets.iter_mut().find(|preset| preset.slug == *slug) {
+ preset.apply_overrides(overrides);
+ } else {
+ presets.push(ModelPreset::from_overrides(slug, overrides));
}
}
- if let Some(project_path) = project_path {
- merge_filesystem_model_presets(&mut presets, &mut warnings, &project_path);
- }
-
+ // `sort_by` is stable, keeping custom zero-priority entries after the
+ // embedded entries that were loaded first.
presets.sort_by(|left, right| right.priority.cmp(&left.priority));
Ok(Self {
models: presets.into_iter().map(Model::from).collect(),
- warnings,
})
}
/// Creates a catalog from an already-loaded model list.
pub fn new(models: Vec) -> Self {
- Self {
- models,
- warnings: Vec::new(),
- }
+ Self { models }
}
/// Returns the loaded models by value.
pub fn into_inner(self) -> Vec {
self.models
}
-
- /// Returns non-fatal warnings encountered while loading filesystem overrides.
- pub fn warnings(&self) -> &[ModelCatalogWarning] {
- &self.warnings
- }
}
impl ModelCatalog for PresetModelCatalog {
@@ -162,86 +101,6 @@ pub fn load_builtin_models() -> Result, PresetModelCatalogError> {
Ok(presets.into_iter().map(Model::from).collect())
}
-/// Reads model presets from a filesystem JSON path. Missing files return `None`;
-/// invalid files return an error so callers can warn while continuing.
-fn load_models_from_file(path: &Path) -> Result>, ModelCatalogFileError> {
- let contents = match std::fs::read_to_string(path) {
- Ok(contents) => contents,
- Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(None),
- Err(error) => return Err(ModelCatalogFileError::Read(error)),
- };
- if contents.trim().is_empty() {
- return Ok(Some(Vec::new()));
- }
- serde_json::from_str(&contents)
- .map(Some)
- .map_err(ModelCatalogFileError::Parse)
-}
-
-fn catalog_paths_alias(left: &Path, right: &Path) -> bool {
- if left == right {
- return true;
- }
- if let (Ok(left), Ok(right)) = (std::fs::canonicalize(left), std::fs::canonicalize(right))
- && left == right
- {
- return true;
- }
- if left.file_name() != right.file_name() {
- return false;
- }
-
- match (left.parent(), right.parent()) {
- (Some(left_parent), Some(right_parent)) => {
- match (
- std::fs::canonicalize(left_parent),
- std::fs::canonicalize(right_parent),
- ) {
- (Ok(left_parent), Ok(right_parent)) => left_parent == right_parent,
- _ => false,
- }
- }
- _ => false,
- }
-}
-
-fn merge_filesystem_model_presets(
- presets: &mut Vec,
- warnings: &mut Vec,
- path: &Path,
-) {
- match load_models_from_file(path) {
- Ok(Some(overrides)) => {
- *presets = merge_model_presets(std::mem::take(presets), overrides);
- }
- Ok(None) => {}
- Err(error) => {
- let message = error.to_string();
- tracing::warn!(
- path = %path.display(),
- error = %message,
- "skipping invalid model catalog override"
- );
- warnings.push(ModelCatalogWarning {
- path: path.to_path_buf(),
- message,
- });
- }
- }
-}
-
-/// Merges two model lists by slug. Entries from `overlay` replace matching
-/// entries in `base`; entries with new slugs are appended.
-fn merge_model_presets(mut base: Vec, overlay: Vec) -> Vec {
- for entry in overlay {
- match base.iter_mut().find(|m| m.slug == entry.slug) {
- Some(existing) => *existing = entry,
- None => base.push(entry),
- }
- }
- base
-}
-
/// Errors produced while loading the builtin catalog.
#[derive(Debug, thiserror::Error)]
pub enum PresetModelCatalogError {
@@ -250,58 +109,26 @@ pub enum PresetModelCatalogError {
Parse(#[from] serde_json::Error),
}
-#[derive(Debug, thiserror::Error)]
-enum ModelCatalogFileError {
- #[error("failed to read model catalog: {0}")]
- Read(#[from] std::io::Error),
- #[error("failed to parse model catalog: {0}")]
- Parse(#[from] serde_json::Error),
-}
-
#[cfg(test)]
mod tests {
- use std::path::PathBuf;
- use std::time::{SystemTime, UNIX_EPOCH};
+ use std::collections::BTreeMap;
use pretty_assertions::assert_eq;
use super::{
- PresetModelCatalog, default_base_instructions, load_builtin_models, merge_model_presets,
+ PresetModelCatalog, default_base_instructions, load_builtin_model_presets,
+ load_builtin_models,
+ };
+ use crate::{
+ InputModality, Model, ModelCatalog, ModelOverrideConfig, ProviderWireApi,
+ ReasoningCapability, ReasoningEffort, ReasoningImplementation, TruncationPolicyConfig,
};
- use crate::{ModelCatalog, ModelPreset};
-
- fn unique_temp_dir(name: &str) -> PathBuf {
- let nanos = SystemTime::now()
- .duration_since(UNIX_EPOCH)
- .expect("system time")
- .as_nanos();
- let path = std::env::temp_dir().join(format!("devo-{name}-{nanos}"));
- std::fs::create_dir_all(&path).expect("create temp dir");
- path
- }
-
- fn make_preset(slug: &str, display_name: &str, priority: i32) -> ModelPreset {
- ModelPreset {
- slug: slug.into(),
- display_name: display_name.into(),
- priority,
- ..ModelPreset::default()
- }
- }
-
- fn model_by_slug(models: &[crate::Model], slug: &str) -> crate::Model {
- models
- .iter()
- .find(|model| model.slug == slug)
- .cloned()
- .expect("model exists")
- }
#[test]
fn builtin_models_load_from_bundled_json() {
let models = load_builtin_models().expect("load builtin models");
assert!(!models.is_empty());
- assert_eq!(models[0].slug, "qwen3-coder-next");
+ assert_eq!(models[0].slug, "kimi-k3");
}
#[test]
@@ -317,362 +144,235 @@ mod tests {
}
#[test]
- fn merge_by_slug_overrides_existing() {
- let base = vec![make_preset("a", "Base A", 10)];
- let overlay = vec![make_preset("a", "Overlay A", 20)];
- let merged = merge_model_presets(base, overlay);
- assert_eq!(merged.len(), 1);
- assert_eq!(merged[0].display_name, "Overlay A");
- assert_eq!(merged[0].priority, 20);
+ fn builtin_models_have_channel_fields() {
+ let models = load_builtin_models().expect("load builtin models");
+ assert!(
+ models
+ .iter()
+ .any(|model| model.channel.as_deref() == Some("DeepSeek"))
+ );
}
#[test]
- fn merge_by_slug_appends_new() {
- let base = vec![make_preset("a", "A", 10)];
- let overlay = vec![make_preset("b", "B", 20)];
- let merged = merge_model_presets(base, overlay);
- assert_eq!(merged.len(), 2);
- assert_eq!(merged[0].slug, "a");
- assert_eq!(merged[1].slug, "b");
- }
+ fn load_from_config_applies_partial_builtin_override_without_replacing_metadata() {
+ let builtin = load_builtin_models()
+ .expect("load builtins")
+ .into_iter()
+ .find(|model| model.slug == "kimi-k3")
+ .expect("kimi model");
+ let catalog = PresetModelCatalog::load_from_config(&BTreeMap::from([(
+ "kimi-k3".to_string(),
+ ModelOverrideConfig {
+ display_name: Some("Configured Kimi".to_string()),
+ ..ModelOverrideConfig::default()
+ },
+ )]))
+ .expect("load catalog");
- #[test]
- fn merge_empty_overlay_does_nothing() {
- let base = vec![make_preset("a", "A", 10)];
- let merged = merge_model_presets(base, Vec::new());
- assert_eq!(merged.len(), 1);
- assert_eq!(merged[0].display_name, "A");
+ assert_eq!(
+ catalog.get("kimi-k3").expect("configured kimi"),
+ &Model {
+ display_name: "Configured Kimi".to_string(),
+ ..builtin
+ }
+ );
}
#[test]
- fn load_from_config_returns_builtin_when_no_filesystem_files() {
- let root = unique_temp_dir("catalog-builtin-only");
- let home = root.join("home").join(".devo");
- std::fs::create_dir_all(&home).expect("create home");
-
- let catalog =
- PresetModelCatalog::load_from_config(&home, /*workspace_root*/ None).expect("load");
- let models = catalog.into_inner();
- assert!(!models.is_empty());
- assert_eq!(models[0].slug, "qwen3-coder-next");
-
- let _ = std::fs::remove_dir_all(root);
- }
+ fn load_from_config_keeps_explicit_toggle_from_legacy_toggle_with_levels() {
+ let builtin = load_builtin_models()
+ .expect("load builtins")
+ .into_iter()
+ .find(|model| model.slug == "glm-5.2")
+ .expect("glm model");
+ assert!(matches!(
+ builtin.reasoning_capability,
+ ReasoningCapability::ToggleWithLevels(_)
+ ));
+
+ let catalog = PresetModelCatalog::load_from_config(&BTreeMap::from([(
+ "glm-5.2".to_string(),
+ ModelOverrideConfig {
+ reasoning_capability: Some(ReasoningCapability::Toggle),
+ ..ModelOverrideConfig::default()
+ },
+ )]))
+ .expect("load catalog");
- #[test]
- fn load_from_config_creates_managed_user_file_when_missing() {
- let root = unique_temp_dir("catalog-seed");
- let home = root.join("home").join(".devo");
- std::fs::create_dir_all(&home).expect("create home");
-
- let user_file = home.join("models.json");
- assert!(!user_file.exists());
-
- let _catalog =
- PresetModelCatalog::load_from_config(&home, /*workspace_root*/ None).expect("load");
-
- assert!(user_file.exists());
- let contents = std::fs::read_to_string(&user_file).expect("read");
- let entries: Vec =
- serde_json::from_str(&contents).expect("parse managed user catalog");
- assert!(!entries.is_empty());
- assert!(entries.iter().all(|entry| {
- entry["_devo"]["update_policy"] == "managed"
- && entry["_devo"]["builtin_sha256"]
- .as_str()
- .is_some_and(|hash| hash.starts_with("sha256:"))
- }));
-
- let _ = std::fs::remove_dir_all(root);
+ assert_eq!(
+ catalog.get("glm-5.2").expect("configured glm"),
+ &Model {
+ reasoning_capability: ReasoningCapability::Toggle,
+ ..builtin
+ }
+ );
}
#[test]
- fn load_from_config_preserves_custom_models_when_appending_builtins() {
- let root = unique_temp_dir("catalog-no-overwrite");
- let home = root.join("home").join(".devo");
- std::fs::create_dir_all(&home).expect("create home");
-
- let user_file = home.join("models.json");
- std::fs::write(
- &user_file,
- "[{\"slug\":\"custom\",\"display_name\":\"Custom\"}]",
- )
- .expect("write");
-
- let catalog =
- PresetModelCatalog::load_from_config(&home, /*workspace_root*/ None).expect("load");
- let models = catalog.into_inner();
+ fn load_from_config_applies_complete_metadata_override() {
+ let catalog = PresetModelCatalog::load_from_config(&BTreeMap::from([(
+ "qwen3-coder-next".to_string(),
+ ModelOverrideConfig {
+ display_name: Some("Configured Qwen".to_string()),
+ description: Some("Configured description".to_string()),
+ context_window: Some(128_000),
+ effective_context_window_percent: Some(80),
+ max_tokens: Some(8_192),
+ temperature: Some(0.4),
+ top_p: Some(0.7),
+ top_k: Some(24.0),
+ provider: Some(ProviderWireApi::AnthropicMessages),
+ reasoning_capability: Some(ReasoningCapability::Levels(vec![
+ ReasoningEffort::Low,
+ ReasoningEffort::High,
+ ])),
+ reasoning_implementation: Some(ReasoningImplementation::RequestParameter),
+ default_reasoning_effort: Some(ReasoningEffort::High),
+ base_instructions: Some("Configured instructions".to_string()),
+ input_modalities: Some(vec![InputModality::Image]),
+ channel: Some("Configured channel".to_string()),
+ truncation_policy: Some(TruncationPolicyConfig::tokens(4_096)),
+ supports_image_detail_original: Some(true),
+ },
+ )]))
+ .expect("load catalog");
- assert!(models.iter().any(|m| m.slug == "custom"));
- assert!(models.iter().any(|m| m.slug == "qwen3-coder-next"));
- let entries: Vec = serde_json::from_str(
- &std::fs::read_to_string(&user_file).expect("read synchronized user catalog"),
- )
- .expect("parse synchronized user catalog");
assert_eq!(
- entries[0],
- serde_json::json!({"slug": "custom", "display_name": "Custom"})
+ catalog.get("qwen3-coder-next").expect("configured qwen"),
+ &Model {
+ slug: "qwen3-coder-next".to_string(),
+ display_name: "Configured Qwen".to_string(),
+ provider: ProviderWireApi::AnthropicMessages,
+ description: Some("Configured description".to_string()),
+ reasoning_capability: ReasoningCapability::Levels(vec![
+ ReasoningEffort::Low,
+ ReasoningEffort::High,
+ ]),
+ default_reasoning_effort: Some(ReasoningEffort::High),
+ reasoning_implementation: Some(ReasoningImplementation::RequestParameter),
+ base_instructions: "Configured instructions".to_string(),
+ context_window: 128_000,
+ effective_context_window_percent: Some(80),
+ truncation_policy: TruncationPolicyConfig::tokens(4_096),
+ input_modalities: vec![InputModality::Image],
+ supports_image_detail_original: true,
+ channel: Some("Configured channel".to_string()),
+ temperature: Some(0.4),
+ top_p: Some(0.7),
+ top_k: Some(24.0),
+ max_tokens: Some(8_192),
+ }
);
-
- let _ = std::fs::remove_dir_all(root);
}
#[test]
- fn load_from_config_applies_user_model_token_overrides() {
- let root = unique_temp_dir("catalog-user-token-overrides");
- let home = root.join("home").join(".devo");
- std::fs::create_dir_all(&home).expect("create home");
-
- std::fs::write(
- home.join("models.json"),
- r#"[
- {
- "slug": "qwen3-coder-next",
- "display_name": "Custom Qwen",
- "context_window": 123456,
- "effective_context_window_percent": 77,
- "max_tokens": 7654
- }
- ]"#,
- )
- .expect("write user models");
-
- let catalog =
- PresetModelCatalog::load_from_config(&home, /*workspace_root*/ None).expect("load");
- let model = model_by_slug(&catalog.into_inner(), "qwen3-coder-next");
-
- assert_eq!(model.context_window, 123456);
- assert_eq!(model.effective_context_window_percent, Some(77));
- assert_eq!(model.max_tokens, Some(7654));
-
- let _ = std::fs::remove_dir_all(root);
- }
-
- #[test]
- fn load_from_config_missing_base_instructions_fall_back_to_default() {
- let root = unique_temp_dir("catalog-missing-base-instructions");
- let home = root.join("home").join(".devo");
- std::fs::create_dir_all(&home).expect("create home");
-
- std::fs::write(
- home.join("models.json"),
- r#"[
- {
- "slug": "qwen3-coder-next",
- "display_name": "Custom Qwen"
- }
- ]"#,
- )
- .expect("write user models");
-
- let catalog =
- PresetModelCatalog::load_from_config(&home, /*workspace_root*/ None).expect("load");
- let model = model_by_slug(&catalog.into_inner(), "qwen3-coder-next");
-
- assert_eq!(model.display_name, "Custom Qwen");
- assert_eq!(model.base_instructions, default_base_instructions());
-
- let _ = std::fs::remove_dir_all(root);
- }
+ fn load_from_config_creates_minimal_custom_model_with_fallback_instructions() {
+ let catalog = PresetModelCatalog::load_from_config(&BTreeMap::from([(
+ "custom".to_string(),
+ ModelOverrideConfig::default(),
+ )]))
+ .expect("load catalog");
- #[test]
- fn load_from_config_project_overrides_user_by_slug() {
- let root = unique_temp_dir("catalog-project-wins");
- let home = root.join("home").join(".devo");
- let workspace = root.join("workspace");
- std::fs::create_dir_all(&home).expect("create home");
- std::fs::create_dir_all(workspace.join(".devo")).expect("create project");
-
- std::fs::write(
- home.join("models.json"),
- r#"[{"slug":"custom","display_name":"User","context_window":111,"effective_context_window_percent":66,"max_tokens":222}]"#,
- )
- .expect("write user models");
- std::fs::write(
- workspace.join(".devo").join("models.json"),
- r#"[{"slug":"custom","display_name":"Project","context_window":333,"effective_context_window_percent":88,"max_tokens":444}]"#,
- )
- .expect("write project models");
-
- let catalog = PresetModelCatalog::load_from_config(&home, Some(&workspace)).expect("load");
- let model = model_by_slug(&catalog.into_inner(), "custom");
-
- assert_eq!(model.display_name, "Project");
- assert_eq!(model.context_window, 333);
- assert_eq!(model.effective_context_window_percent, Some(88));
- assert_eq!(model.max_tokens, Some(444));
-
- let _ = std::fs::remove_dir_all(root);
+ assert_eq!(
+ catalog.get("custom").expect("custom model"),
+ &Model {
+ slug: "custom".to_string(),
+ display_name: "custom".to_string(),
+ base_instructions: default_base_instructions().to_string(),
+ ..Model::default()
+ }
+ );
}
#[test]
- fn load_from_config_does_not_sync_catalog_shared_by_user_and_workspace_paths() {
- let root = unique_temp_dir("catalog-shared-user-workspace");
- let workspace = root.join("workspace");
- let shared_home = workspace.join(".devo");
- std::fs::create_dir_all(&shared_home).expect("create shared catalog directory");
- let shared_catalog = shared_home.join("models.json");
- let contents = r#"[{"slug":"qwen3-coder-next","display_name":"Workspace-owned catalog"}]"#;
- std::fs::write(&shared_catalog, contents).expect("write shared catalog");
-
- let catalog =
- PresetModelCatalog::load_from_config(&shared_home, Some(&workspace)).expect("load");
+ fn load_from_config_creates_fully_specified_custom_model() {
+ let catalog = PresetModelCatalog::with_model_overrides(&BTreeMap::from([(
+ "custom".to_string(),
+ ModelOverrideConfig {
+ display_name: Some("Custom".to_string()),
+ description: Some("Custom description".to_string()),
+ context_window: Some(64_000),
+ effective_context_window_percent: Some(75),
+ max_tokens: Some(4_096),
+ temperature: Some(0.2),
+ top_p: Some(0.6),
+ top_k: Some(12.0),
+ provider: Some(ProviderWireApi::OpenAIResponses),
+ reasoning_capability: Some(ReasoningCapability::Toggle),
+ reasoning_implementation: Some(ReasoningImplementation::RequestParameter),
+ default_reasoning_effort: Some(ReasoningEffort::Medium),
+ base_instructions: Some("Custom instructions".to_string()),
+ input_modalities: Some(vec![InputModality::Text, InputModality::Image]),
+ channel: Some("Custom channel".to_string()),
+ truncation_policy: Some(TruncationPolicyConfig::tokens(2_048)),
+ supports_image_detail_original: Some(true),
+ },
+ )]))
+ .expect("load catalog");
assert_eq!(
- catalog
- .get("qwen3-coder-next")
- .expect("workspace model")
- .display_name,
- "Workspace-owned catalog"
- );
- assert_eq!(
- std::fs::read_to_string(&shared_catalog).expect("read shared catalog"),
- contents
+ catalog.get("custom").expect("custom model"),
+ &Model {
+ slug: "custom".to_string(),
+ display_name: "Custom".to_string(),
+ provider: ProviderWireApi::OpenAIResponses,
+ description: Some("Custom description".to_string()),
+ reasoning_capability: ReasoningCapability::Toggle,
+ default_reasoning_effort: Some(ReasoningEffort::Medium),
+ reasoning_implementation: Some(ReasoningImplementation::RequestParameter),
+ base_instructions: "Custom instructions".to_string(),
+ context_window: 64_000,
+ effective_context_window_percent: Some(75),
+ truncation_policy: TruncationPolicyConfig::tokens(2_048),
+ input_modalities: vec![InputModality::Text, InputModality::Image],
+ supports_image_detail_original: true,
+ channel: Some("Custom channel".to_string()),
+ temperature: Some(0.2),
+ top_p: Some(0.6),
+ top_k: Some(12.0),
+ max_tokens: Some(4_096),
+ }
);
-
- let _ = std::fs::remove_dir_all(root);
}
- #[cfg(unix)]
#[test]
- fn load_from_config_does_not_sync_symlinked_workspace_catalog() {
- use std::os::unix::fs::symlink;
-
- let root = unique_temp_dir("catalog-symlinked-user-workspace");
- let config_home = root.join("catalog");
- let workspace = root.join("workspace");
- std::fs::create_dir_all(&config_home).expect("create catalog directory");
- std::fs::create_dir_all(&workspace).expect("create workspace");
- symlink(&config_home, workspace.join(".devo")).expect("symlink workspace catalog");
- let shared_catalog = config_home.join("models.json");
- let contents =
- r#"[{"slug":"qwen3-coder-next","display_name":"Symlinked workspace catalog"}]"#;
- std::fs::write(&shared_catalog, contents).expect("write shared catalog");
-
- let catalog =
- PresetModelCatalog::load_from_config(&config_home, Some(&workspace)).expect("load");
+ fn load_from_config_keeps_explicit_empty_base_instructions() {
+ let catalog = PresetModelCatalog::load_from_config(&BTreeMap::from([(
+ "custom".to_string(),
+ ModelOverrideConfig {
+ base_instructions: Some(String::new()),
+ ..ModelOverrideConfig::default()
+ },
+ )]))
+ .expect("load catalog");
assert_eq!(
catalog
- .get("qwen3-coder-next")
- .expect("workspace model")
- .display_name,
- "Symlinked workspace catalog"
+ .get("custom")
+ .expect("custom model")
+ .base_instructions,
+ ""
);
- assert_eq!(
- std::fs::read_to_string(&shared_catalog).expect("read shared catalog"),
- contents
- );
-
- let _ = std::fs::remove_dir_all(root);
}
#[test]
- fn load_from_config_uses_workspace_user_builtin_precedence_by_slug() {
- let root = unique_temp_dir("catalog-precedence");
- let home = root.join("home").join(".devo");
- let workspace = root.join("workspace");
- std::fs::create_dir_all(&home).expect("create home");
- std::fs::create_dir_all(workspace.join(".devo")).expect("create project");
-
- let user_models = home.join("models.json");
- let workspace_models = workspace.join(".devo").join("models.json");
- std::fs::write(
- &user_models,
- r#"[{"slug":"qwen3-coder-next","display_name":"User","context_window":111,"effective_context_window_percent":66,"max_tokens":222}]"#,
- )
- .expect("write user models");
- std::fs::write(
- &workspace_models,
- r#"[{"slug":"qwen3-coder-next","display_name":"Workspace","context_window":333,"effective_context_window_percent":88,"max_tokens":444}]"#,
- )
- .expect("write project models");
- let workspace_contents =
- std::fs::read_to_string(&workspace_models).expect("read project models before load");
-
- let catalog = PresetModelCatalog::load_from_config(&home, Some(&workspace)).expect("load");
- let model = model_by_slug(&catalog.into_inner(), "qwen3-coder-next");
-
- assert_eq!(
- model,
- crate::Model::from(ModelPreset {
- slug: "qwen3-coder-next".into(),
- display_name: "Workspace".into(),
- context_window: 333,
- effective_context_window_percent: Some(88),
- input_modalities: vec![crate::InputModality::Text, crate::InputModality::Image],
- max_tokens: Some(444),
- ..ModelPreset::default()
- })
- );
- assert_eq!(
- std::fs::read_to_string(&workspace_models).expect("read project models after load"),
- workspace_contents
- );
+ fn custom_models_follow_builtins_with_equal_priority() {
+ let catalog = PresetModelCatalog::load_from_config(&BTreeMap::from([(
+ "custom".to_string(),
+ ModelOverrideConfig::default(),
+ )]))
+ .expect("load catalog");
+ let models = catalog.into_inner();
- let _ = std::fs::remove_dir_all(root);
+ assert_eq!(models.last().expect("custom model").slug, "custom");
}
#[test]
- fn load_from_config_records_warning_and_continues_for_invalid_filesystem_catalog() {
- let root = unique_temp_dir("catalog-invalid-warning");
- let home = root.join("home").join(".devo");
- std::fs::create_dir_all(&home).expect("create home");
- let user_file = home.join("models.json");
- std::fs::write(&user_file, "{not valid json").expect("write invalid user models");
-
- let catalog =
- PresetModelCatalog::load_from_config(&home, /*workspace_root*/ None).expect("load");
-
- assert!(catalog.get("qwen3-coder-next").is_some());
- assert_eq!(catalog.warnings().len(), 1);
- assert_eq!(catalog.warnings()[0].path, user_file);
+ fn embedded_presets_remain_the_only_catalog_base() {
assert!(
- catalog.warnings()[0]
- .message
- .contains("failed to parse model catalog")
+ !load_builtin_model_presets()
+ .expect("load embedded presets")
+ .is_empty()
);
-
- let _ = std::fs::remove_dir_all(root);
- }
-
- #[test]
- fn builtin_models_have_channel_fields() {
- let models = load_builtin_models().expect("load builtin models");
- let deepseek_models: Vec<_> = models
- .iter()
- .filter(|m| m.channel.as_deref() == Some("DeepSeek"))
- .collect();
- assert!(!deepseek_models.is_empty());
- assert!(deepseek_models.iter().any(|m| m.slug == "deepseek-v4-pro"));
- }
-
- #[test]
- fn load_from_config_preserves_explicit_base_instructions() {
- let root = unique_temp_dir("catalog-preserve-base-instructions");
- let home = root.join("home").join(".devo");
- std::fs::create_dir_all(&home).expect("create home");
-
- std::fs::write(
- home.join("models.json"),
- r#"[
- {
- "slug": "qwen3-coder-next",
- "display_name": "Custom Qwen",
- "base_instructions": "Custom catalog instructions"
- }
- ]"#,
- )
- .expect("write user models");
-
- let catalog =
- PresetModelCatalog::load_from_config(&home, /*workspace_root*/ None).expect("load");
- let model = model_by_slug(&catalog.into_inner(), "qwen3-coder-next");
-
- assert_eq!(model.display_name, "Custom Qwen");
- assert_eq!(model.base_instructions, "Custom catalog instructions");
- assert_ne!(model.base_instructions, default_base_instructions());
-
- let _ = std::fs::remove_dir_all(root);
}
}
diff --git a/crates/core/src/model_catalog/user_sync.rs b/crates/core/src/model_catalog/user_sync.rs
deleted file mode 100644
index 17e42172..00000000
--- a/crates/core/src/model_catalog/user_sync.rs
+++ /dev/null
@@ -1,638 +0,0 @@
-use std::collections::{HashMap, HashSet};
-use std::fs;
-use std::io::Write;
-use std::path::Path;
-
-use crate::ModelPreset;
-use serde_json::{Map, Value};
-use sha2::{Digest, Sha256};
-
-const METADATA_KEY: &str = "_devo";
-const BUILTIN_SHA256_KEY: &str = "builtin_sha256";
-const UPDATE_POLICY_KEY: &str = "update_policy";
-const MANAGED_POLICY: &str = "managed";
-const PINNED_POLICY: &str = "pinned";
-
-#[derive(Debug)]
-pub(super) struct UserCatalogSyncOutcome {
- pub(super) presets: Option>,
- pub(super) warnings: Vec,
-}
-
-pub(super) fn synchronize_user_catalog(
- user_path: &Path,
- builtin_entries: &[Value],
-) -> UserCatalogSyncOutcome {
- synchronize_user_catalog_with_writer(user_path, builtin_entries, write_atomic)
-}
-
-fn synchronize_user_catalog_with_writer(
- user_path: &Path,
- builtin_entries: &[Value],
- writer: F,
-) -> UserCatalogSyncOutcome
-where
- F: FnOnce(&Path, &[u8]) -> std::io::Result<()>,
-{
- let (mut user_entries, existed) = match read_user_entries(user_path) {
- Ok(entries) => entries,
- Err(message) => {
- return UserCatalogSyncOutcome {
- presets: None,
- warnings: vec![message],
- };
- }
- };
-
- if let Err(error) = parse_presets(&user_entries) {
- return UserCatalogSyncOutcome {
- presets: None,
- warnings: vec![format!("failed to parse model catalog: {error}")],
- };
- }
-
- let original_entries = user_entries.clone();
- synchronize_entries(&mut user_entries, builtin_entries);
-
- let presets = match parse_presets(&user_entries) {
- Ok(presets) => presets,
- Err(error) => {
- return UserCatalogSyncOutcome {
- presets: None,
- warnings: vec![format!(
- "failed to parse synchronized model catalog: {error}"
- )],
- };
- }
- };
-
- let mut warnings = Vec::new();
- if !existed || user_entries != original_entries {
- match serde_json::to_string_pretty(&user_entries) {
- Ok(mut serialized) => {
- serialized.push('\n');
- if let Err(error) = writer(user_path, serialized.as_bytes()) {
- warnings.push(format!(
- "failed to persist synchronized model catalog: {error}"
- ));
- }
- }
- Err(error) => warnings.push(format!(
- "failed to serialize synchronized model catalog: {error}"
- )),
- }
- }
-
- UserCatalogSyncOutcome {
- presets: Some(presets),
- warnings,
- }
-}
-
-fn read_user_entries(path: &Path) -> Result<(Vec, bool), String> {
- let contents = match fs::read_to_string(path) {
- Ok(contents) => contents,
- Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
- return Ok((Vec::new(), false));
- }
- Err(error) => return Err(format!("failed to read model catalog: {error}")),
- };
-
- if contents.trim().is_empty() {
- return Ok((Vec::new(), true));
- }
-
- serde_json::from_str(&contents)
- .map(|entries| (entries, true))
- .map_err(|error| format!("failed to parse model catalog: {error}"))
-}
-
-fn parse_presets(entries: &[Value]) -> Result, serde_json::Error> {
- serde_json::from_value(Value::Array(entries.to_vec()))
-}
-
-fn synchronize_entries(user_entries: &mut Vec, builtin_entries: &[Value]) {
- let builtins_by_slug: HashMap<&str, (&Value, String)> = builtin_entries
- .iter()
- .filter_map(|entry| {
- let slug = entry.get("slug")?.as_str()?;
- Some((slug, (entry, fingerprint(entry))))
- })
- .collect();
- let mut existing_slugs = HashSet::new();
-
- for user_entry in user_entries.iter_mut() {
- let Some(slug) = user_entry
- .get("slug")
- .and_then(Value::as_str)
- .map(str::to_owned)
- else {
- continue;
- };
- existing_slugs.insert(slug.clone());
-
- let Some((builtin_entry, builtin_hash)) = builtins_by_slug.get(slug.as_str()) else {
- continue;
- };
-
- match management_state(user_entry) {
- EntryManagement::Pinned => {}
- EntryManagement::Managed { source_hash } => {
- let user_hash = fingerprint(user_entry);
- if user_hash == source_hash {
- *user_entry =
- managed_builtin_entry(builtin_entry, Some(user_entry), builtin_hash);
- }
- }
- EntryManagement::Legacy => {
- if fingerprint(user_entry) == *builtin_hash {
- *user_entry =
- managed_builtin_entry(builtin_entry, Some(user_entry), builtin_hash);
- } else {
- pin_entry(user_entry);
- }
- }
- }
- }
-
- for builtin_entry in builtin_entries {
- let Some(slug) = builtin_entry.get("slug").and_then(Value::as_str) else {
- continue;
- };
- if existing_slugs.insert(slug.to_owned()) {
- let builtin_hash = fingerprint(builtin_entry);
- user_entries.push(managed_builtin_entry(
- builtin_entry,
- /*previous_entry*/ None,
- &builtin_hash,
- ));
- }
- }
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-enum EntryManagement {
- Legacy,
- Managed { source_hash: String },
- Pinned,
-}
-
-fn management_state(entry: &Value) -> EntryManagement {
- let Some(metadata) = entry.get(METADATA_KEY).and_then(Value::as_object) else {
- return EntryManagement::Legacy;
- };
- let policy = metadata.get(UPDATE_POLICY_KEY).and_then(Value::as_str);
- let source_hash = metadata
- .get(BUILTIN_SHA256_KEY)
- .and_then(Value::as_str)
- .filter(|hash| is_valid_builtin_hash(hash))
- .map(str::to_owned);
-
- match (policy, source_hash) {
- (Some(PINNED_POLICY), _) => EntryManagement::Pinned,
- (Some(MANAGED_POLICY), Some(source_hash)) => EntryManagement::Managed { source_hash },
- (Some(MANAGED_POLICY), None) => EntryManagement::Legacy,
- (Some(_), _) => EntryManagement::Pinned,
- (None, Some(source_hash)) => EntryManagement::Managed { source_hash },
- (None, None) => EntryManagement::Legacy,
- }
-}
-
-fn is_valid_builtin_hash(hash: &str) -> bool {
- hash.strip_prefix("sha256:").is_some_and(|digest| {
- digest.len() == 64 && digest.bytes().all(|byte| byte.is_ascii_hexdigit())
- })
-}
-
-fn fingerprint(entry: &Value) -> String {
- let mut content = entry.clone();
- if let Some(object) = content.as_object_mut() {
- object.remove(METADATA_KEY);
- }
- let canonical = canonicalize_json(&content);
- let digest = Sha256::digest(
- serde_json::to_vec(&canonical).expect("serializing serde_json::Value cannot fail"),
- );
- format!("sha256:{digest:x}")
-}
-
-fn canonicalize_json(value: &Value) -> Value {
- match value {
- Value::Array(values) => Value::Array(values.iter().map(canonicalize_json).collect()),
- Value::Object(object) => {
- let mut entries: Vec<_> = object.iter().collect();
- entries.sort_unstable_by(|(left, _), (right, _)| left.cmp(right));
- Value::Object(
- entries
- .into_iter()
- .map(|(key, value)| (key.clone(), canonicalize_json(value)))
- .collect(),
- )
- }
- Value::Number(number) => Value::Number(canonical_number(number)),
- scalar => scalar.clone(),
- }
-}
-
-fn canonical_number(number: &serde_json::Number) -> serde_json::Number {
- if let Some(value) = number.as_i64() {
- return value.into();
- }
- if let Some(value) = number.as_u64() {
- return value.into();
- }
-
- let value = number
- .as_f64()
- .expect("serde_json numbers are finite numeric values");
- if value == 0.0 {
- return 0.into();
- }
- if value.fract() == 0.0 && value >= i64::MIN as f64 && value <= i64::MAX as f64 {
- return (value as i64).into();
- }
- serde_json::Number::from_f64(value).expect("serde_json numbers are finite")
-}
-
-fn managed_builtin_entry(
- builtin_entry: &Value,
- previous_entry: Option<&Value>,
- builtin_hash: &str,
-) -> Value {
- let mut managed = builtin_entry.clone();
- let object = managed
- .as_object_mut()
- .expect("built-in model entries must be JSON objects");
- object.remove(METADATA_KEY);
-
- let mut metadata = previous_entry
- .and_then(|entry| entry.get(METADATA_KEY))
- .and_then(Value::as_object)
- .cloned()
- .unwrap_or_default();
- metadata.insert(
- BUILTIN_SHA256_KEY.into(),
- Value::String(builtin_hash.to_owned()),
- );
- metadata.insert(
- UPDATE_POLICY_KEY.into(),
- Value::String(MANAGED_POLICY.into()),
- );
- object.insert(METADATA_KEY.into(), Value::Object(metadata));
- managed
-}
-
-fn pin_entry(entry: &mut Value) {
- let object = entry
- .as_object_mut()
- .expect("validated model entries must be JSON objects");
- let metadata = object
- .entry(METADATA_KEY)
- .or_insert_with(|| Value::Object(Map::new()));
- if !metadata.is_object() {
- *metadata = Value::Object(Map::new());
- }
- metadata.as_object_mut().expect("metadata object").insert(
- UPDATE_POLICY_KEY.into(),
- Value::String(PINNED_POLICY.into()),
- );
-}
-
-fn write_atomic(path: &Path, data: &[u8]) -> std::io::Result<()> {
- let parent = path.parent().unwrap_or_else(|| Path::new("."));
- fs::create_dir_all(parent)?;
- let mut temp_file = tempfile::NamedTempFile::new_in(parent)?;
- temp_file.write_all(data)?;
- temp_file.as_file().sync_all()?;
- temp_file
- .persist(path)
- .map(|_persisted_file| ())
- .map_err(|error| error.error)
-}
-
-#[cfg(test)]
-mod tests {
- use std::fs;
- use std::path::Path;
-
- use crate::ModelPreset;
- use pretty_assertions::assert_eq;
- use serde_json::{Value, json};
- use sha2::{Digest, Sha256};
- use tempfile::TempDir;
-
- use super::{synchronize_user_catalog, synchronize_user_catalog_with_writer};
-
- fn model(slug: &str, display_name: &str) -> Value {
- json!({
- "slug": slug,
- "display_name": display_name,
- "provider": "openai_chat_completions",
- "context_window": 200000,
- "input_modalities": ["text"]
- })
- }
-
- fn sha256(entry: &Value) -> String {
- let mut canonical = entry.clone();
- canonical
- .as_object_mut()
- .expect("model entry object")
- .remove("_devo");
- let digest = Sha256::digest(serde_json::to_vec(&canonical).expect("serialize model"));
- format!("sha256:{digest:x}")
- }
-
- fn managed(entry: &Value) -> Value {
- let mut expected = entry.clone();
- expected
- .as_object_mut()
- .expect("model entry object")
- .insert(
- "_devo".into(),
- json!({
- "builtin_sha256": sha256(entry),
- "update_policy": "managed"
- }),
- );
- expected
- }
-
- fn pinned(entry: &Value) -> Value {
- let mut expected = entry.clone();
- expected
- .as_object_mut()
- .expect("model entry object")
- .insert(
- "_devo".into(),
- json!({
- "update_policy": "pinned"
- }),
- );
- expected
- }
-
- fn read_entries(path: &Path) -> Vec {
- serde_json::from_str(&fs::read_to_string(path).expect("read catalog"))
- .expect("parse catalog")
- }
-
- fn write_entries(path: &Path, entries: &[Value]) {
- fs::write(
- path,
- serde_json::to_string_pretty(entries).expect("serialize catalog"),
- )
- .expect("write catalog");
- }
-
- #[test]
- fn missing_user_catalog_creates_managed_builtin_copy() {
- let temp = TempDir::new().expect("temp dir");
- let path = temp.path().join("nested").join("models.json");
- let builtins = vec![model("a", "Builtin A"), model("b", "Builtin B")];
-
- let outcome = synchronize_user_catalog(&path, &builtins);
-
- assert_eq!(outcome.warnings, Vec::::new());
- assert!(outcome.presets.is_some());
- assert_eq!(
- read_entries(&path),
- builtins.iter().map(managed).collect::>()
- );
- }
-
- #[test]
- fn untouched_managed_entry_tracks_changed_builtin() {
- let temp = TempDir::new().expect("temp dir");
- let path = temp.path().join("models.json");
- let previous = model("a", "Previous");
- write_entries(&path, &[managed(&previous)]);
- let current = model("a", "Current");
-
- let outcome = synchronize_user_catalog(&path, std::slice::from_ref(¤t));
-
- assert_eq!(outcome.warnings, Vec::::new());
- assert_eq!(read_entries(&path), vec![managed(¤t)]);
- }
-
- #[test]
- fn edited_managed_entry_is_preserved() {
- let temp = TempDir::new().expect("temp dir");
- let path = temp.path().join("models.json");
- let previous = model("a", "Previous");
- let mut edited = managed(&previous);
- edited["display_name"] = json!("User edit");
- write_entries(&path, std::slice::from_ref(&edited));
- let current = model("a", "Current");
-
- let outcome = synchronize_user_catalog(&path, &[current]);
-
- assert_eq!(outcome.warnings, Vec::::new());
- assert_eq!(read_entries(&path), vec![edited]);
- }
-
- #[test]
- fn explicitly_pinned_entry_is_preserved() {
- let temp = TempDir::new().expect("temp dir");
- let path = temp.path().join("models.json");
- let user = pinned(&model("a", "Pinned"));
- write_entries(&path, std::slice::from_ref(&user));
-
- let outcome = synchronize_user_catalog(&path, &[model("a", "Current")]);
-
- assert_eq!(outcome.warnings, Vec::::new());
- assert_eq!(read_entries(&path), vec![user]);
- }
-
- #[test]
- fn invalid_managed_fingerprints_are_migrated_conservatively() {
- let temp = TempDir::new().expect("temp dir");
- let path = temp.path().join("models.json");
- let mut missing = model("a", "Missing hash user edit");
- missing["_devo"] = json!({"update_policy": "managed"});
- let mut non_string = model("a", "Non-string hash user edit");
- non_string["_devo"] = json!({
- "builtin_sha256": 42,
- "update_policy": "managed"
- });
- let mut malformed = model("a", "Malformed hash user edit");
- malformed["_devo"] = json!({
- "builtin_sha256": "sha256:not-a-valid-digest",
- "update_policy": "managed"
- });
- write_entries(
- &path,
- &[missing.clone(), non_string.clone(), malformed.clone()],
- );
- missing["_devo"]["update_policy"] = json!("pinned");
- non_string["_devo"]["update_policy"] = json!("pinned");
- malformed["_devo"]["update_policy"] = json!("pinned");
-
- let outcome = synchronize_user_catalog(&path, &[model("a", "Builtin")]);
-
- assert_eq!(outcome.warnings, Vec::::new());
- assert_eq!(read_entries(&path), vec![missing, non_string, malformed]);
- }
-
- #[test]
- fn legacy_entries_are_classified_without_losing_custom_models() {
- let temp = TempDir::new().expect("temp dir");
- let path = temp.path().join("models.json");
- let unchanged = model("a", "Builtin A");
- let changed = model("b", "User B");
- let custom = model("custom", "Custom");
- write_entries(&path, &[unchanged.clone(), changed.clone(), custom.clone()]);
- let builtins = vec![unchanged.clone(), model("b", "Builtin B")];
-
- let outcome = synchronize_user_catalog(&path, &builtins);
-
- assert_eq!(outcome.warnings, Vec::::new());
- assert_eq!(
- read_entries(&path),
- vec![managed(&unchanged), pinned(&changed), custom]
- );
- }
-
- #[test]
- fn new_builtins_are_appended_and_removed_builtins_are_preserved() {
- let temp = TempDir::new().expect("temp dir");
- let path = temp.path().join("models.json");
- let removed = managed(&model("removed", "Removed"));
- write_entries(&path, std::slice::from_ref(&removed));
- let added = model("added", "Added");
-
- let outcome = synchronize_user_catalog(&path, std::slice::from_ref(&added));
-
- assert_eq!(outcome.warnings, Vec::::new());
- assert_eq!(read_entries(&path), vec![removed, managed(&added)]);
- }
-
- #[test]
- fn json_formatting_and_key_order_do_not_count_as_edits() {
- let temp = TempDir::new().expect("temp dir");
- let path = temp.path().join("models.json");
- let mut previous = model("a", "Previous");
- previous["nested"] = json!({"alpha": 1, "beta": 2});
- let previous_hash = sha256(&previous);
- fs::write(
- &path,
- format!(
- r#"[{{"provider":"openai_chat_completions","slug":"a","nested":{{"beta":2,"alpha":1}},"input_modalities":["text"],"context_window":200000,"display_name":"Previous","_devo":{{"update_policy":"managed","builtin_sha256":"{previous_hash}"}}}}]"#
- ),
- )
- .expect("write reordered catalog");
- let current = model("a", "Current");
-
- let outcome = synchronize_user_catalog(&path, std::slice::from_ref(¤t));
-
- assert_eq!(outcome.warnings, Vec::::new());
- assert_eq!(read_entries(&path), vec![managed(¤t)]);
- }
-
- #[test]
- fn equivalent_number_representations_do_not_count_as_edits() {
- let temp = TempDir::new().expect("temp dir");
- let path = temp.path().join("models.json");
- let mut previous = model("a", "Previous");
- previous["temperature"] = json!(1);
- let mut user_entry = managed(&previous);
- user_entry["temperature"] = json!(1.0);
- write_entries(&path, &[user_entry]);
- let mut current = previous;
- current["display_name"] = json!("Current");
-
- let outcome = synchronize_user_catalog(&path, std::slice::from_ref(¤t));
-
- assert_eq!(outcome.warnings, Vec::::new());
- assert_eq!(read_entries(&path), vec![managed(¤t)]);
- }
-
- #[test]
- fn unchanged_managed_catalog_is_not_rewritten() {
- let temp = TempDir::new().expect("temp dir");
- let path = temp.path().join("models.json");
- let current = model("a", "Current");
- let managed_current = managed(¤t);
- let compact =
- serde_json::to_string(&vec![managed_current]).expect("serialize compact JSON");
- fs::write(&path, &compact).expect("write compact catalog");
-
- let outcome = synchronize_user_catalog(&path, std::slice::from_ref(¤t));
-
- assert_eq!(outcome.warnings, Vec::::new());
- assert_eq!(fs::read_to_string(&path).expect("read catalog"), compact);
- }
-
- #[test]
- fn managed_updates_preserve_unknown_metadata_fields() {
- let temp = TempDir::new().expect("temp dir");
- let path = temp.path().join("models.json");
- let previous = model("a", "Previous");
- let mut managed_previous = managed(&previous);
- managed_previous["_devo"]["future_metadata"] = json!({"keep": true});
- write_entries(&path, &[managed_previous]);
- let current = model("a", "Current");
- let mut expected = managed(¤t);
- expected["_devo"]["future_metadata"] = json!({"keep": true});
-
- let outcome = synchronize_user_catalog(&path, std::slice::from_ref(¤t));
-
- assert_eq!(outcome.warnings, Vec::::new());
- assert_eq!(read_entries(&path), vec![expected]);
- }
-
- #[test]
- fn unknown_model_fields_count_as_user_customization() {
- let temp = TempDir::new().expect("temp dir");
- let path = temp.path().join("models.json");
- let previous = model("a", "Previous");
- let mut customized = managed(&previous);
- customized["future_provider_option"] = json!({"enabled": true});
- write_entries(&path, std::slice::from_ref(&customized));
-
- let outcome = synchronize_user_catalog(&path, &[model("a", "Current")]);
-
- assert_eq!(outcome.warnings, Vec::::new());
- assert_eq!(read_entries(&path), vec![customized]);
- }
-
- #[test]
- fn invalid_user_json_is_not_overwritten() {
- let temp = TempDir::new().expect("temp dir");
- let path = temp.path().join("models.json");
- let invalid = "{not valid json";
- fs::write(&path, invalid).expect("write invalid catalog");
-
- let outcome = synchronize_user_catalog(&path, &[model("a", "Builtin")]);
-
- assert_eq!(outcome.presets, None);
- assert_eq!(outcome.warnings.len(), 1);
- assert!(outcome.warnings[0].contains("failed to parse model catalog"));
- assert_eq!(
- fs::read_to_string(&path).expect("read invalid catalog"),
- invalid
- );
- }
-
- #[test]
- fn write_failure_returns_synchronized_presets_and_warning() {
- let temp = TempDir::new().expect("temp dir");
- let path = temp.path().join("models.json");
- let previous = model("a", "Previous");
- write_entries(&path, &[managed(&previous)]);
- let current = model("a", "Current");
-
- let outcome = synchronize_user_catalog_with_writer(
- &path,
- std::slice::from_ref(¤t),
- |_path, _data| Err(std::io::Error::other("injected write failure")),
- );
-
- assert_eq!(outcome.warnings.len(), 1);
- assert!(outcome.warnings[0].contains("failed to persist synchronized model catalog"));
- assert_eq!(read_entries(&path), vec![managed(&previous)]);
- let expected_presets: Vec =
- serde_json::from_value(Value::Array(vec![current])).expect("parse current preset");
- assert_eq!(outcome.presets, Some(expected_presets));
- }
-}
diff --git a/crates/core/src/model_preset.rs b/crates/core/src/model_preset.rs
index 8d39c28d..ec284962 100644
--- a/crates/core/src/model_preset.rs
+++ b/crates/core/src/model_preset.rs
@@ -15,6 +15,7 @@
//! - turn execution should consume `Model`, not `ModelPreset`
//! - loading policy and catalog access live in `model_catalog.rs`; this file only defines the raw shape
//!
+use devo_config::ModelOverrideConfig;
use devo_protocol::InputModality;
use devo_protocol::Model;
use devo_protocol::ProviderWireApi;
@@ -132,6 +133,75 @@ impl Default for ModelPreset {
}
}
+impl ModelPreset {
+ /// Applies configured metadata overrides while preserving fields that were omitted.
+ pub fn apply_overrides(&mut self, overrides: &ModelOverrideConfig) {
+ if let Some(display_name) = &overrides.display_name {
+ self.display_name.clone_from(display_name);
+ }
+ if let Some(description) = &overrides.description {
+ self.description = Some(description.clone());
+ }
+ if let Some(context_window) = overrides.context_window {
+ self.context_window = context_window;
+ }
+ if let Some(effective_context_window_percent) = overrides.effective_context_window_percent {
+ self.effective_context_window_percent = Some(effective_context_window_percent);
+ }
+ if let Some(max_tokens) = overrides.max_tokens {
+ self.max_tokens = Some(max_tokens);
+ }
+ if let Some(temperature) = overrides.temperature {
+ self.temperature = Some(temperature);
+ }
+ if let Some(top_p) = overrides.top_p {
+ self.top_p = Some(top_p);
+ }
+ if let Some(top_k) = overrides.top_k {
+ self.top_k = Some(top_k);
+ }
+ if let Some(provider) = overrides.provider {
+ self.provider = provider;
+ }
+ if let Some(reasoning_capability) = &overrides.reasoning_capability {
+ self.reasoning_capability = reasoning_capability.clone();
+ self.supported_reasoning_levels.clear();
+ }
+ if let Some(reasoning_implementation) = &overrides.reasoning_implementation {
+ self.reasoning_implementation = Some(reasoning_implementation.clone());
+ }
+ if let Some(default_reasoning_effort) = overrides.default_reasoning_effort {
+ self.default_reasoning_effort = Some(default_reasoning_effort);
+ }
+ if let Some(base_instructions) = &overrides.base_instructions {
+ self.base_instructions = Some(base_instructions.clone());
+ }
+ if let Some(input_modalities) = &overrides.input_modalities {
+ self.input_modalities.clone_from(input_modalities);
+ }
+ if let Some(channel) = &overrides.channel {
+ self.channel = Some(channel.clone());
+ }
+ if let Some(truncation_policy) = overrides.truncation_policy {
+ self.truncation_policy = truncation_policy;
+ }
+ if let Some(supports_image_detail_original) = overrides.supports_image_detail_original {
+ self.supports_image_detail_original = supports_image_detail_original;
+ }
+ }
+
+ /// Creates a safe custom preset and applies its configured metadata overrides.
+ pub fn from_overrides(slug: &str, overrides: &ModelOverrideConfig) -> Self {
+ let mut preset = Self {
+ slug: slug.to_string(),
+ display_name: slug.to_string(),
+ ..Self::default()
+ };
+ preset.apply_overrides(overrides);
+ preset
+ }
+}
+
impl From for Model {
fn from(value: ModelPreset) -> Self {
let supported_reasoning_levels = value.supported_reasoning_levels;
diff --git a/crates/core/src/query.rs b/crates/core/src/query.rs
index 67517102..4351d31a 100644
--- a/crates/core/src/query.rs
+++ b/crates/core/src/query.rs
@@ -1220,178 +1220,194 @@ pub async fn query_with_options(
let mut final_response = None;
let mut stop_reason = None;
- while let Some(event) = stream.next().await {
- match event {
- Ok(StreamEvent::TextStart { .. }) => {}
- Ok(StreamEvent::TextDelta { text, .. }) => {
- assistant_text.push_str(&text);
- emit_query_event(&on_event, QueryEvent::TextDelta(text)).await;
- }
- Ok(StreamEvent::ReasoningStart { .. }) => {}
- Ok(StreamEvent::ReasoningDelta { text, .. }) => {
- reasoning_text.push_str(&text);
- emit_query_event(&on_event, QueryEvent::ReasoningDelta(text)).await;
- }
- Ok(StreamEvent::ReasoningDone { .. }) => {
- emit_query_event(&on_event, QueryEvent::ReasoningCompleted).await;
- }
- Ok(StreamEvent::ToolCallStart {
- index,
- id,
- name,
- input,
- }) => {
- tool_uses.push((index, id, name, input, String::new(), false));
- }
- Ok(StreamEvent::HostedToolCallStart {
- index,
- id,
- name,
- input,
- }) => {
- let id = normalize_hosted_tool_id(index, id, &name);
- let name = normalize_hosted_tool_name(name);
- hosted_tool_inputs.insert(id.clone(), (index, name.clone(), input.clone()));
- emit_hosted_tool_start(
- &on_event,
- &mut emitted_hosted_tool_starts,
- &id,
- &name,
- &input,
- )
- .await;
+ loop {
+ tokio::select! {
+ biased;
+ _ = async {
+ if let Some(ct) = options.cancel_token.as_ref() {
+ ct.cancelled().await
+ } else {
+ std::future::pending::<()>().await
+ }
+ } =>
+ {
+ break;
}
- Ok(StreamEvent::HostedToolCallDone {
- index,
- id,
- name,
- input,
- output,
- status,
- }) => {
- let id = normalize_hosted_tool_id(index, id, &name);
- let name = normalize_hosted_tool_name(name);
- let previous_input = hosted_tool_inputs
- .get(&id)
- .map(|(_, _, previous_input)| previous_input);
- let input = hosted_tool_input_or_previous(input, previous_input);
- hosted_tool_inputs.insert(id.clone(), (index, name.clone(), input.clone()));
- emit_hosted_tool_start(
- &on_event,
- &mut emitted_hosted_tool_starts,
- &id,
- &name,
- &input,
- )
- .await;
- emit_hosted_tool_result(
- &on_event,
- &mut emitted_hosted_tool_results,
- &session.cwd,
- HostedToolResultEvent {
- id: &id,
- name: &name,
- input: &input,
+ event = stream.next() => {
+ let Some(event) = event else { break; };
+ match event {
+ Ok(StreamEvent::TextStart { .. }) => {}
+ Ok(StreamEvent::TextDelta { text, .. }) => {
+ assistant_text.push_str(&text);
+ emit_query_event(&on_event, QueryEvent::TextDelta(text)).await;
+ }
+ Ok(StreamEvent::ReasoningStart { .. }) => {}
+ Ok(StreamEvent::ReasoningDelta { text, .. }) => {
+ reasoning_text.push_str(&text);
+ emit_query_event(&on_event, QueryEvent::ReasoningDelta(text)).await;
+ }
+ Ok(StreamEvent::ReasoningDone { .. }) => {
+ emit_query_event(&on_event, QueryEvent::ReasoningCompleted).await;
+ }
+ Ok(StreamEvent::ToolCallStart {
+ index,
+ id,
+ name,
+ input,
+ }) => {
+ tool_uses.push((index, id, name, input, String::new(), false));
+ }
+ Ok(StreamEvent::HostedToolCallStart {
+ index,
+ id,
+ name,
+ input,
+ }) => {
+ let id = normalize_hosted_tool_id(index, id, &name);
+ let name = normalize_hosted_tool_name(name);
+ hosted_tool_inputs.insert(id.clone(), (index, name.clone(), input.clone()));
+ emit_hosted_tool_start(
+ &on_event,
+ &mut emitted_hosted_tool_starts,
+ &id,
+ &name,
+ &input,
+ )
+ .await;
+ }
+ Ok(StreamEvent::HostedToolCallDone {
+ index,
+ id,
+ name,
+ input,
output,
status,
- },
- )
- .await;
- }
- Ok(StreamEvent::ToolCallInputDelta {
- index,
- partial_json,
- }) => {
- if let Some(tool_use) = tool_uses
- .iter_mut()
- .rev()
- .find(|(tool_index, ..)| *tool_index == index)
- {
- tool_use.4.push_str(&partial_json);
- tool_use.5 = true;
- }
- }
- Ok(StreamEvent::MessageDone { response }) => {
- stop_reason = response.stop_reason.clone();
- final_response = Some(response.clone());
-
- // Accumulate all usage counters at completion time.
- session.total_input_tokens += response.usage.input_tokens;
- session.total_output_tokens += response.usage.output_tokens;
- session.total_tokens += response.usage.display_total_tokens();
- session.total_cache_creation_tokens +=
- response.usage.cache_creation_input_tokens.unwrap_or(0);
- session.total_cache_read_tokens +=
- response.usage.cache_read_input_tokens.unwrap_or(0);
- session.last_input_tokens = response.usage.input_tokens;
- session.last_turn_tokens = response.usage.display_total_tokens();
-
- emit_query_event(
- &on_event,
- QueryEvent::Usage {
- usage: response.usage.clone(),
- },
- )
- .await;
- }
- Ok(StreamEvent::UsageDelta(usage)) => {
- emit_query_event(&on_event, QueryEvent::UsageDelta { usage }).await;
- }
- Err(e) => {
- warn!(
- provider = provider.name(),
- model = %turn_config.model.slug,
- turn = session.turn_count,
- error = ?e,
- "stream error"
- );
- if !assistant_text.is_empty()
- || !reasoning_text.is_empty()
- || !tool_uses.is_empty()
- || !hosted_tool_inputs.is_empty()
- || final_response.is_some()
- {
- return Err(AgentError::Provider(e));
- }
-
- match provider_retry_decision(&e, &mut retry_count, &mut context_compacted) {
- ProviderRetryDecision::CompactAndRetry => {
- warn!("context_too_long - compacting and retrying");
- // Proactive: must compact even if token estimates disagree
- // with the provider; preserve from latest user only.
- summarize_and_compact(
- session,
+ }) => {
+ let id = normalize_hosted_tool_id(index, id, &name);
+ let name = normalize_hosted_tool_name(name);
+ let previous_input = hosted_tool_inputs
+ .get(&id)
+ .map(|(_, _, previous_input)| previous_input);
+ let input = hosted_tool_input_or_previous(input, previous_input);
+ hosted_tool_inputs.insert(id.clone(), (index, name.clone(), input.clone()));
+ emit_hosted_tool_start(
&on_event,
- &provider,
- &compaction_model_slug,
- &compaction_request_model,
- turn_config.model.max_tokens.unwrap_or(4096) as usize,
- CompactionKind::Proactive,
+ &mut emitted_hosted_tool_starts,
+ &id,
+ &name,
+ &input,
+ )
+ .await;
+ emit_hosted_tool_result(
+ &on_event,
+ &mut emitted_hosted_tool_results,
+ &session.cwd,
+ HostedToolResultEvent {
+ id: &id,
+ name: &name,
+ input: &input,
+ output,
+ status,
+ },
)
.await;
- session.turn_count -= 1;
- continue 'query_loop;
}
- ProviderRetryDecision::RetryAfter(backoff) => {
- warn!(
- attempt = retry_count,
- backoff_ms = backoff.as_millis(),
- "transient provider stream error - retrying with exponential backoff"
- );
- wait_for_provider_retry(
+ Ok(StreamEvent::ToolCallInputDelta {
+ index,
+ partial_json,
+ }) => {
+ if let Some(tool_use) = tool_uses
+ .iter_mut()
+ .rev()
+ .find(|(tool_index, ..)| *tool_index == index)
+ {
+ tool_use.4.push_str(&partial_json);
+ tool_use.5 = true;
+ }
+ }
+ Ok(StreamEvent::MessageDone { response }) => {
+ stop_reason = response.stop_reason.clone();
+ final_response = Some(response.clone());
+
+ // Accumulate all usage counters at completion time.
+ session.total_input_tokens += response.usage.input_tokens;
+ session.total_output_tokens += response.usage.output_tokens;
+ session.total_tokens += response.usage.display_total_tokens();
+ session.total_cache_creation_tokens +=
+ response.usage.cache_creation_input_tokens.unwrap_or(0);
+ session.total_cache_read_tokens +=
+ response.usage.cache_read_input_tokens.unwrap_or(0);
+ session.last_input_tokens = response.usage.input_tokens;
+ session.last_turn_tokens = response.usage.display_total_tokens();
+
+ emit_query_event(
&on_event,
- options.cancel_token.as_ref(),
- provider.name(),
- &turn_config.model.slug,
- retry_count,
- backoff,
+ QueryEvent::Usage {
+ usage: response.usage.clone(),
+ },
)
- .await?;
- session.turn_count -= 1;
- continue 'query_loop;
+ .await;
}
- ProviderRetryDecision::Fail => {
- return Err(AgentError::Provider(e));
+ Ok(StreamEvent::UsageDelta(usage)) => {
+ emit_query_event(&on_event, QueryEvent::UsageDelta { usage }).await;
+ }
+ Err(e) => {
+ warn!(
+ provider = provider.name(),
+ model = %turn_config.model.slug,
+ turn = session.turn_count,
+ error = ?e,
+ "stream error"
+ );
+ if !assistant_text.is_empty()
+ || !reasoning_text.is_empty()
+ || !tool_uses.is_empty()
+ || !hosted_tool_inputs.is_empty()
+ || final_response.is_some()
+ {
+ return Err(AgentError::Provider(e));
+ }
+
+ match provider_retry_decision(&e, &mut retry_count, &mut context_compacted) {
+ ProviderRetryDecision::CompactAndRetry => {
+ warn!("context_too_long - compacting and retrying");
+ // Proactive: must compact even if token estimates disagree
+ // with the provider; preserve from latest user only.
+ summarize_and_compact(
+ session,
+ &on_event,
+ &provider,
+ &compaction_model_slug,
+ &compaction_request_model,
+ turn_config.model.max_tokens.unwrap_or(4096) as usize,
+ CompactionKind::Proactive,
+ )
+ .await;
+ session.turn_count -= 1;
+ continue 'query_loop;
+ }
+ ProviderRetryDecision::RetryAfter(backoff) => {
+ warn!(
+ attempt = retry_count,
+ backoff_ms = backoff.as_millis(),
+ "transient provider stream error - retrying with exponential backoff"
+ );
+ wait_for_provider_retry(
+ &on_event,
+ options.cancel_token.as_ref(),
+ provider.name(),
+ &turn_config.model.slug,
+ retry_count,
+ backoff,
+ )
+ .await?;
+ session.turn_count -= 1;
+ continue 'query_loop;
+ }
+ ProviderRetryDecision::Fail => {
+ return Err(AgentError::Provider(e));
+ }
+ }
}
}
}
@@ -1718,6 +1734,25 @@ pub async fn query_with_options(
emit_query_event(&on_event, QueryEvent::TurnComplete { stop_reason: sr }).await;
}
debug!("no tool calls, ending query loop");
+ session.end_turn();
+ if options
+ .cancel_token
+ .as_ref()
+ .is_some_and(|ct| ct.is_cancelled())
+ {
+ return Err(AgentError::Aborted);
+ }
+ return Ok(());
+ }
+
+ // If the turn was cancelled (e.g. mid-stream interrupt with partial
+ // tool calls), save whatever partial assistant content was already
+ // committed above, skip tool execution, and end the turn.
+ if options
+ .cancel_token
+ .as_ref()
+ .is_some_and(|ct| ct.is_cancelled())
+ {
session.end_turn();
return Ok(());
}
@@ -5174,12 +5209,13 @@ mod tests {
.await
.expect("first query should succeed");
- let events = seen_events.lock().expect("lock events");
- assert!(events.iter().any(|event| matches!(
- event,
- QueryEvent::ReasoningDelta(text) if text == "plan"
- )));
- drop(events);
+ {
+ let events = seen_events.lock().expect("lock events");
+ assert!(events.iter().any(|event| matches!(
+ event,
+ QueryEvent::ReasoningDelta(text) if text == "plan"
+ )));
+ }
let assistant_message = session
.messages
diff --git a/crates/core/src/session.rs b/crates/core/src/session.rs
index d054db70..4d6d897b 100644
--- a/crates/core/src/session.rs
+++ b/crates/core/src/session.rs
@@ -33,6 +33,10 @@ pub struct SessionConfig {
pub permission_profile: RuntimePermissionProfile,
pub agents_md: AgentsMdConfig,
pub available_skills_instructions: Option,
+ /// Active sandbox profile name for child processes spawned by tools.
+ /// `None` means no sandboxing; otherwise the value is a profile name such
+ /// as `"workspace"`, `"strict"`, or `"off"`.
+ pub sandbox_profile: Option,
}
#[derive(Debug, Clone, PartialEq, Eq)]
@@ -61,6 +65,7 @@ impl Default for SessionConfig {
permission_profile,
agents_md: AgentsMdConfig::default(),
available_skills_instructions: None,
+ sandbox_profile: Some("workspace".to_string()),
}
}
}
diff --git a/crates/core/src/tools/bash.txt b/crates/core/src/tools/bash.txt
index 959888b0..dbf8458a 100644
--- a/crates/core/src/tools/bash.txt
+++ b/crates/core/src/tools/bash.txt
@@ -16,7 +16,6 @@ Before executing the command, please follow these steps:
- For example, before running "mkdir foo/bar", first use `ls foo` to check that "foo" exists and is the intended parent directory
2. Command Execution:
- - Start the command string with a brief `# ...` comment on its own line explaining the command's purpose, then put the command on the next line
- Always quote file paths that contain spaces with double quotes (e.g., rm "path with spaces/file.txt")
- Examples of proper quoting:
- mkdir "/Users/name/My Documents" (correct)
@@ -44,7 +43,7 @@ Usage notes:
- If the commands are independent and can run in parallel, make multiple shell_command tool calls in a single message. For example, if you need to run "git status" and "git diff", send a single message with two shell_command tool calls in parallel.
- ${chaining}
- Use ';' only when you need to run commands sequentially but don't care if earlier commands fail
- - DO NOT use bare newlines to separate multiple commands. The leading purpose-comment newline and newlines inside quoted strings or scripts are allowed
+ - DO NOT use bare newlines to separate multiple commands. Newlines inside quoted strings or scripts are allowed
- AVOID using `cd && `. Use the `workdir` parameter to change directories instead.
Use workdir="/foo/bar" with command: pytest tests
diff --git a/crates/core/src/tools/client_terminal_shell.rs b/crates/core/src/tools/client_terminal_shell.rs
index 34e44fd1..9c37a738 100644
--- a/crates/core/src/tools/client_terminal_shell.rs
+++ b/crates/core/src/tools/client_terminal_shell.rs
@@ -433,6 +433,7 @@ mod tests {
file_read_ledger: None,
network_proxy: None,
network_no_proxy: None,
+ sandbox_profile: None,
}
}
diff --git a/crates/core/src/tools/exec_policy_amend.rs b/crates/core/src/tools/exec_policy_amend.rs
new file mode 100644
index 00000000..2201f1b9
--- /dev/null
+++ b/crates/core/src/tools/exec_policy_amend.rs
@@ -0,0 +1,114 @@
+//! Prefix-rule amendment helpers for exec policy.
+
+/// Prefixes that are too broad or dangerous to turn into persistent allow rules.
+static BANNED_PREFIX_SUGGESTIONS: &[&[&str]] = &[
+ &["python3"],
+ &["python3", "-"],
+ &["python3", "-c"],
+ &["python"],
+ &["python", "-"],
+ &["python", "-c"],
+ &["py"],
+ &["py", "-3"],
+ &["pythonw"],
+ &["pyw"],
+ &["pypy"],
+ &["pypy3"],
+ &["git"],
+ &["bash"],
+ &["bash", "-lc"],
+ &["sh"],
+ &["sh", "-c"],
+ &["sh", "-lc"],
+ &["zsh"],
+ &["zsh", "-lc"],
+ &["/bin/zsh"],
+ &["/bin/zsh", "-lc"],
+ &["/bin/bash"],
+ &["/bin/bash", "-lc"],
+ &["pwsh"],
+ &["pwsh", "-Command"],
+ &["pwsh", "-c"],
+ &["powershell"],
+ &["powershell", "-Command"],
+ &["powershell", "-c"],
+ &["powershell.exe"],
+ &["powershell.exe", "-Command"],
+ &["powershell.exe", "-c"],
+ &["env"],
+ &["sudo"],
+ &["node"],
+ &["node", "-e"],
+ &["perl"],
+ &["perl", "-e"],
+ &["ruby"],
+ &["ruby", "-e"],
+ &["php"],
+ &["php", "-r"],
+ &["lua"],
+ &["lua", "-e"],
+ &["osascript"],
+ &["rm"],
+ &["dd"],
+ &["mkfs"],
+ &["shred"],
+];
+
+/// Returns true when a model-suggested prefix rule is too broad to auto-approve.
+pub fn is_banned_prefix_suggestion(prefix_rule: &[String]) -> bool {
+ if prefix_rule.is_empty() {
+ return true;
+ }
+ BANNED_PREFIX_SUGGESTIONS.iter().any(|banned| {
+ prefix_rule.len() == banned.len()
+ && prefix_rule
+ .iter()
+ .map(String::as_str)
+ .eq(banned.iter().copied())
+ })
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+ use pretty_assertions::assert_eq;
+
+ #[test]
+ fn rejects_banned_interpreter_prefixes() {
+ assert!(is_banned_prefix_suggestion(&[
+ "python3".to_string(),
+ "-c".to_string()
+ ]));
+ assert!(is_banned_prefix_suggestion(&[
+ "bash".to_string(),
+ "-lc".to_string()
+ ]));
+ assert!(is_banned_prefix_suggestion(&["rm".to_string()]));
+ }
+
+ #[test]
+ fn allows_specific_command_prefixes() {
+ assert!(!is_banned_prefix_suggestion(&[
+ "cargo".to_string(),
+ "test".to_string()
+ ]));
+ assert!(!is_banned_prefix_suggestion(&[
+ "git".to_string(),
+ "status".to_string()
+ ]));
+ }
+
+ #[test]
+ fn empty_prefix_is_banned() {
+ assert!(is_banned_prefix_suggestion(&[]));
+ }
+
+ #[test]
+ fn exact_banned_match_only() {
+ assert!(!is_banned_prefix_suggestion(&[
+ "git".to_string(),
+ "status".to_string()
+ ]));
+ assert_eq!(is_banned_prefix_suggestion(&["git".to_string()]), true);
+ }
+}
diff --git a/crates/core/src/tools/exec_policy_loader.rs b/crates/core/src/tools/exec_policy_loader.rs
new file mode 100644
index 00000000..929bb5cb
--- /dev/null
+++ b/crates/core/src/tools/exec_policy_loader.rs
@@ -0,0 +1,135 @@
+//! Load exec policy rule files from the Devo home directory.
+
+use std::io::ErrorKind;
+use std::path::{Path, PathBuf};
+
+use devo_execpolicy::{Error as ExecPolicyRuleError, Policy, PolicyParser};
+use devo_util_paths::find_devo_home;
+use thiserror::Error;
+
+const RULES_DIR_NAME: &str = "rules";
+const RULE_EXTENSION: &str = "rules";
+
+#[derive(Debug, Error)]
+pub enum ExecPolicyLoadError {
+ #[error("failed to resolve DEVO_HOME: {0}")]
+ DevoHome(#[from] std::io::Error),
+
+ #[error("failed to read rules directory {dir}: {source}")]
+ ReadDir {
+ dir: PathBuf,
+ source: std::io::Error,
+ },
+
+ #[error("failed to read rules file {path}: {source}")]
+ ReadFile {
+ path: PathBuf,
+ source: std::io::Error,
+ },
+
+ #[error("failed to parse rules file {path}: {source}")]
+ ParsePolicy {
+ path: String,
+ source: Box,
+ },
+}
+
+/// Loads all `*.rules` files from `$DEVO_HOME/rules/` (or `~/.devo/rules/`).
+pub fn load_exec_policy_from_devo_home() -> Result {
+ let devo_home = find_devo_home()?;
+ load_exec_policy_from_dir(devo_home.join(RULES_DIR_NAME))
+}
+
+/// Loads all `*.rules` files from `rules_dir`, sorted by path.
+pub fn load_exec_policy_from_dir(
+ rules_dir: impl AsRef,
+) -> Result {
+ let policy_paths = collect_policy_files(rules_dir.as_ref())?;
+ let mut parser = PolicyParser::new();
+ for policy_path in &policy_paths {
+ let contents = std::fs::read_to_string(policy_path).map_err(|source| {
+ ExecPolicyLoadError::ReadFile {
+ path: policy_path.clone(),
+ source,
+ }
+ })?;
+ let identifier = policy_path.to_string_lossy().to_string();
+ parser.parse(&identifier, &contents).map_err(|source| {
+ ExecPolicyLoadError::ParsePolicy {
+ path: identifier,
+ source: Box::new(source),
+ }
+ })?;
+ }
+ Ok(parser.build())
+}
+
+fn collect_policy_files(dir: &Path) -> Result, ExecPolicyLoadError> {
+ let read_dir = match std::fs::read_dir(dir) {
+ Ok(read_dir) => read_dir,
+ Err(source) if source.kind() == ErrorKind::NotFound => return Ok(Vec::new()),
+ Err(source) => {
+ return Err(ExecPolicyLoadError::ReadDir {
+ dir: dir.to_path_buf(),
+ source,
+ });
+ }
+ };
+
+ let mut policy_paths = read_dir
+ .filter_map(|entry| entry.ok())
+ .filter_map(|entry| {
+ let path = entry.path();
+ let file_type = entry.file_type().ok()?;
+ if path
+ .extension()
+ .and_then(|ext| ext.to_str())
+ .is_some_and(|ext| ext == RULE_EXTENSION)
+ && file_type.is_file()
+ {
+ Some(path)
+ } else {
+ None
+ }
+ })
+ .collect::>();
+ policy_paths.sort();
+ Ok(policy_paths)
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+ use devo_execpolicy::Decision;
+ use pretty_assertions::assert_eq;
+ use tempfile::tempdir;
+
+ #[test]
+ fn loads_rules_from_directory() {
+ let tmp = tempdir().expect("create temp dir");
+ let rules_dir = tmp.path().join("rules");
+ std::fs::create_dir_all(&rules_dir).expect("create rules dir");
+ std::fs::write(
+ rules_dir.join("allow_git.rules"),
+ r#"prefix_rule(pattern=["git", "status"], decision="allow")
+"#,
+ )
+ .expect("write rules file");
+
+ let policy = load_exec_policy_from_dir(&rules_dir).expect("load policy");
+ let fallback = |_cmd: &[String]| Decision::Prompt;
+ let evaluation = policy.check(&["git".to_string(), "status".to_string()], &fallback);
+ assert_eq!(evaluation.decision, Decision::Allow);
+ }
+
+ #[test]
+ fn missing_rules_directory_returns_empty_policy() {
+ let tmp = tempdir().expect("create temp dir");
+ let policy = load_exec_policy_from_dir(tmp.path().join("missing-rules"))
+ .expect("missing rules dir should yield empty policy");
+ let fallback = |_cmd: &[String]| Decision::Prompt;
+ let evaluation = policy.check(&["git".to_string(), "status".to_string()], &fallback);
+ // Empty policy falls through to heuristics fallback.
+ assert_eq!(evaluation.decision, Decision::Prompt);
+ }
+}
diff --git a/crates/core/src/tools/handlers/agent.rs b/crates/core/src/tools/handlers/agent.rs
index 145ee929..2428dcfd 100644
--- a/crates/core/src/tools/handlers/agent.rs
+++ b/crates/core/src/tools/handlers/agent.rs
@@ -928,6 +928,7 @@ mod tests {
file_read_ledger: None,
network_proxy: None,
network_no_proxy: None,
+ sandbox_profile: None,
}
}
}
diff --git a/crates/core/src/tools/handlers/apply_patch.rs b/crates/core/src/tools/handlers/apply_patch.rs
index dd68f374..93726618 100644
--- a/crates/core/src/tools/handlers/apply_patch.rs
+++ b/crates/core/src/tools/handlers/apply_patch.rs
@@ -190,6 +190,7 @@ mod tests {
file_read_ledger: None,
network_proxy: None,
network_no_proxy: None,
+ sandbox_profile: None,
},
serde_json::json!({
"patchText": "*** Begin Patch\n*** Add File: file.txt\n+hello\n*** End Patch"
diff --git a/crates/core/src/tools/handlers/bash.rs b/crates/core/src/tools/handlers/bash.rs
index 18fa1c13..13d900ad 100644
--- a/crates/core/src/tools/handlers/bash.rs
+++ b/crates/core/src/tools/handlers/bash.rs
@@ -29,10 +29,10 @@ impl BashHandler {
Self {
spec: ToolSpec {
name: "shell_command".into(),
- description: "Executes a shell command in the selected platform shell with optional timeout and output limits. Start the command string with a brief `# ...` comment on its own line explaining the command's purpose, then put the command on the next line.".into(),
+ description: "Executes a shell command in the selected platform shell with optional timeout and output limits.".into(),
input_schema: JsonSchema::object(
std::collections::BTreeMap::from([
- ("command".to_string(), JsonSchema::string(Some("The command to execute. Start with a brief `# ...` purpose comment on the line above the command."))),
+ ("command".to_string(), JsonSchema::string(Some("The command to execute."))),
("cmd".to_string(), JsonSchema::string(Some("Alias for command"))),
("timeout".to_string(), JsonSchema::integer(Some("Optional timeout in milliseconds"))),
("timeout_ms".to_string(), JsonSchema::integer(Some("Alias for timeout"))),
@@ -135,6 +135,7 @@ impl ToolHandler for BashHandler {
timeout_ms,
yield_time_ms,
max_output_tokens,
+ sandbox_profile: ctx.sandbox_profile.clone(),
},
None,
ctx.cancel_token.clone(),
diff --git a/crates/core/src/tools/handlers/code_search.rs b/crates/core/src/tools/handlers/code_search.rs
index cdae1555..85a8c7d8 100644
--- a/crates/core/src/tools/handlers/code_search.rs
+++ b/crates/core/src/tools/handlers/code_search.rs
@@ -294,6 +294,7 @@ mod tests {
file_read_ledger: None,
network_proxy: None,
network_no_proxy: None,
+ sandbox_profile: None,
}
}
diff --git a/crates/core/src/tools/handlers/edit.rs b/crates/core/src/tools/handlers/edit.rs
index 00d5d456..53aacfb6 100644
--- a/crates/core/src/tools/handlers/edit.rs
+++ b/crates/core/src/tools/handlers/edit.rs
@@ -279,6 +279,7 @@ mod tests {
file_read_ledger: Some(ledger),
network_proxy: None,
network_no_proxy: None,
+ sandbox_profile: None,
}
}
diff --git a/crates/core/src/tools/handlers/exec_command.rs b/crates/core/src/tools/handlers/exec_command.rs
index f48736b8..4b34acce 100644
--- a/crates/core/src/tools/handlers/exec_command.rs
+++ b/crates/core/src/tools/handlers/exec_command.rs
@@ -48,14 +48,12 @@ impl ExecCommandHandler {
background_tasks,
spec: ToolSpec {
name: "exec_command".into(),
- description: "Execute a command with PTY support and process management. Start the command string with a brief `# ...` comment on its own line explaining the command's purpose, then put the command on the next line.".into(),
+ description: "Execute a command with PTY support and process management.".into(),
input_schema: JsonSchema::object(
std::collections::BTreeMap::from([
(
"cmd".to_string(),
- JsonSchema::string(Some(
- "The command to execute. Start with a brief `# ...` purpose comment on the line above the command.",
- )),
+ JsonSchema::string(Some("The command to execute.")),
),
(
"workdir".to_string(),
@@ -219,13 +217,14 @@ impl ToolHandler for ExecCommandHandler {
));
};
- let spawned_process = UnifiedExecProcess::spawn(
+ let spawned_process = UnifiedExecProcess::spawn_with_sandbox(
process_id,
&args.cmd,
&cwd,
args.shell.as_deref(),
args.login,
args.tty,
+ ctx.sandbox_profile.clone(),
)
.await;
let (proc, _broadcast_rx) = match spawned_process {
@@ -621,6 +620,7 @@ mod tests {
file_read_ledger: None,
network_proxy: None,
network_no_proxy: None,
+ sandbox_profile: None,
}
}
diff --git a/crates/core/src/tools/handlers/file_write.rs b/crates/core/src/tools/handlers/file_write.rs
index 27e750ed..9e10ef68 100644
--- a/crates/core/src/tools/handlers/file_write.rs
+++ b/crates/core/src/tools/handlers/file_write.rs
@@ -207,6 +207,7 @@ mod tests {
file_read_ledger: None,
network_proxy: None,
network_no_proxy: None,
+ sandbox_profile: None,
},
serde_json::json!({
"filePath": path.clone(),
diff --git a/crates/core/src/tools/handlers/goal_update.rs b/crates/core/src/tools/handlers/goal_update.rs
index abac8912..90f07dfc 100644
--- a/crates/core/src/tools/handlers/goal_update.rs
+++ b/crates/core/src/tools/handlers/goal_update.rs
@@ -152,6 +152,7 @@ mod tests {
file_read_ledger: None,
network_proxy: None,
network_no_proxy: None,
+ sandbox_profile: None,
};
let error = handler
diff --git a/crates/core/src/tools/handlers/read.rs b/crates/core/src/tools/handlers/read.rs
index 9af13c1c..beefd9bd 100644
--- a/crates/core/src/tools/handlers/read.rs
+++ b/crates/core/src/tools/handlers/read.rs
@@ -260,6 +260,7 @@ mod tests {
file_read_ledger: None,
network_proxy: None,
network_no_proxy: None,
+ sandbox_profile: None,
},
serde_json::json!({
"filePath": "sample.txt",
diff --git a/crates/core/src/tools/handlers/shell_command.rs b/crates/core/src/tools/handlers/shell_command.rs
index 4424b38f..f2b4049d 100644
--- a/crates/core/src/tools/handlers/shell_command.rs
+++ b/crates/core/src/tools/handlers/shell_command.rs
@@ -31,14 +31,12 @@ impl ShellCommandHandler {
Self {
spec: ToolSpec {
name: "shell_command".into(),
- description: "Executes a shell command with optional timeout. Start the command string with a brief `# ...` comment on its own line explaining the command's purpose, then put the command on the next line.".into(),
+ description: "Executes a shell command with optional timeout.".into(),
input_schema: JsonSchema::object(
std::collections::BTreeMap::from([
(
"command".to_string(),
- JsonSchema::string(Some(
- "The command to execute. Start with a brief `# ...` purpose comment on the line above the command.",
- )),
+ JsonSchema::string(Some("The command to execute.")),
),
(
"workdir".to_string(),
@@ -127,6 +125,7 @@ impl ToolHandler for ShellCommandHandler {
timeout_ms,
yield_time_ms: default_yield_time_ms(),
max_output_tokens: default_max_output_tokens(),
+ sandbox_profile: ctx.sandbox_profile.clone(),
},
None,
ctx.cancel_token.clone(),
diff --git a/crates/core/src/tools/handlers/tool_search.rs b/crates/core/src/tools/handlers/tool_search.rs
index bac23cfd..b611ea36 100644
--- a/crates/core/src/tools/handlers/tool_search.rs
+++ b/crates/core/src/tools/handlers/tool_search.rs
@@ -459,6 +459,7 @@ mod tests {
file_read_ledger: None,
network_proxy: None,
network_no_proxy: None,
+ sandbox_profile: None,
},
serde_json::json!({ "query": "knowledge base" }),
None,
@@ -597,6 +598,7 @@ mod tests {
file_read_ledger: None,
network_proxy: None,
network_no_proxy: None,
+ sandbox_profile: None,
},
serde_json::json!({ "query": format!("select:{requested}") }),
None,
diff --git a/crates/core/src/tools/mod.rs b/crates/core/src/tools/mod.rs
index 3411247b..a1e5548d 100644
--- a/crates/core/src/tools/mod.rs
+++ b/crates/core/src/tools/mod.rs
@@ -36,7 +36,13 @@ pub mod tool_summary {
pub mod unified_exec;
pub(crate) mod apply_patch;
+pub mod exec_policy_amend;
pub(crate) mod read;
+pub use exec_policy_amend::is_banned_prefix_suggestion;
+pub(crate) mod exec_policy_loader;
+pub use exec_policy_loader::{
+ ExecPolicyLoadError, load_exec_policy_from_devo_home, load_exec_policy_from_dir,
+};
pub(crate) mod shell_exec;
pub(crate) mod websearch_prompt;
diff --git a/crates/core/src/tools/registry.rs b/crates/core/src/tools/registry.rs
index 5b28703b..ae0884d6 100644
--- a/crates/core/src/tools/registry.rs
+++ b/crates/core/src/tools/registry.rs
@@ -527,6 +527,7 @@ mod tests {
file_read_ledger: None,
network_proxy: None,
network_no_proxy: None,
+ sandbox_profile: None,
}
}
diff --git a/crates/core/src/tools/registry_plan.rs b/crates/core/src/tools/registry_plan.rs
index 34bb6133..336d18f4 100644
--- a/crates/core/src/tools/registry_plan.rs
+++ b/crates/core/src/tools/registry_plan.rs
@@ -96,7 +96,7 @@ fn shell_command_schema() -> JsonSchema {
(
"command".to_string(),
JsonSchema::string(Some(
- "The shell command to execute in the selected platform shell. Start with a brief `# ...` purpose comment on the line above the command.",
+ "The shell command to execute in the selected platform shell.",
)),
),
(
@@ -592,9 +592,7 @@ fn exec_command_schema() -> JsonSchema {
BTreeMap::from([
(
"cmd".to_string(),
- JsonSchema::string(Some(
- "Shell command to execute. Start with a brief `# ...` purpose comment on the line above the command.",
- )),
+ JsonSchema::string(Some("Shell command to execute.")),
),
(
"command".to_string(),
@@ -943,7 +941,7 @@ pub fn build_tool_registry_plan(config: &ToolPlanConfig) -> ToolRegistryPlan {
ToolSpec {
name: "exec_command".to_string(),
description:
- "Run a shell command in attached or background mode. Start the command string with a brief `# ...` comment on its own line explaining the command's purpose, then put the command on the next line. Attached mode returns output or a process ID for write_stdin; background mode returns a task id for await_task, list_tasks, and cancel_task."
+ "Run a shell command in attached or background mode. Attached mode returns output or a process ID for write_stdin; background mode returns a task id for await_task, list_tasks, and cancel_task."
.to_string(),
input_schema: exec_command_schema(),
output_mode: ToolOutputMode::Mixed,
@@ -1065,36 +1063,6 @@ mod tests {
assert!(props.contains_key("cmd"));
assert!(props.contains_key("timeout_ms"));
assert!(props.contains_key("tty"));
- assert!(
- props["command"]
- .description
- .as_deref()
- .is_some_and(|description| description.contains("purpose comment"))
- );
- }
-
- #[test]
- fn command_tool_descriptions_request_a_leading_purpose_comment() {
- let plan = build_tool_registry_plan(&ToolPlanConfig::default());
- let descriptions = plan
- .specs
- .iter()
- .filter(|spec| matches!(spec.name.as_str(), "shell_command" | "exec_command"))
- .map(|spec| (spec.name.as_str(), spec.description.as_str()))
- .collect::>();
-
- assert_eq!(descriptions.len(), 2);
- assert!(
- descriptions
- .values()
- .all(|description| description.contains("brief `# ...` comment"))
- );
- assert!(
- exec_command_schema().properties.as_ref().unwrap()["cmd"]
- .description
- .as_deref()
- .is_some_and(|description| description.contains("purpose comment"))
- );
}
#[test]
diff --git a/crates/core/src/tools/router.rs b/crates/core/src/tools/router.rs
index 2f292468..1e67b9a6 100644
--- a/crates/core/src/tools/router.rs
+++ b/crates/core/src/tools/router.rs
@@ -32,7 +32,7 @@ type CompletionCallback = dyn Fn(ToolCallResult) -> BoxFuture<'static, ()> + Sen
type CompletionCallbackArc = Arc;
type ExecutionStartCallback = dyn Fn(ToolCall) -> BoxFuture<'static, ()> + Send + Sync;
type ExecutionStartCallbackArc = Arc;
-type PermissionFuture = futures::future::BoxFuture<'static, Result<(), String>>;
+type PermissionFuture = futures::future::BoxFuture<'static, Result>;
type PermissionCheckFn = dyn Fn(ToolPermissionRequest) -> PermissionFuture + Send + Sync;
const PROGRESS_DRAIN_GRACE_MS: u64 = 50;
/// Content written into a tool-result item when a tool is cancelled mid-execution.
@@ -275,9 +275,34 @@ impl ToolRuntime {
}
};
+ let mut sandbox_profile = self.context.sandbox_profile.clone();
+ let mut already_bypassed_sandbox = sandbox_profile_is_inactive(sandbox_profile.as_deref());
+ // `already_approved`: only user/session/auto-review approvals unlock
+ // a silent unsandbox retry after SANDBOX_DENIED (UnlessTrusted). Policy
+ // Allow without asking stays false so denial surfaces for require_escalated.
+ let mut already_approved = false;
if let Some(request) = self.permission_request_for_call(call, tool_name) {
match self.permission.check(request).await {
- Ok(()) => {}
+ Ok(grant) => {
+ already_approved = grant.already_approved;
+ if grant.bypass_sandbox {
+ // `unsandboxed_execution_allowed`: deny-read policies
+ // must stay sandboxed even after escalation approval.
+ if devo_sandbox::unsandboxed_execution_allowed(
+ sandbox_profile.as_deref(),
+ &self.context.cwd,
+ ) {
+ sandbox_profile = Some("off".to_string());
+ already_bypassed_sandbox = true;
+ } else {
+ info!(
+ tool = %tool_name,
+ id = %call.id,
+ "keeping sandbox after escalation because profile has deny-read paths"
+ );
+ }
+ }
+ }
Err(reason) => {
let message = format!("permission denied: {reason}");
super::hook_events::post_tool_use_failure(
@@ -297,7 +322,7 @@ impl ToolRuntime {
}
info!(tool = %tool_name, id = %call.id, "executing tool");
- let ctx = crate::contracts::ToolContext {
+ let build_ctx = |sandbox_profile: Option| crate::contracts::ToolContext {
tool_call_id: crate::invocation::ToolCallId(call.id.clone()),
session_id: self.context.session_id.clone(),
turn_id: self.context.turn_id.clone(),
@@ -312,6 +337,7 @@ impl ToolRuntime {
file_read_ledger: Some(Arc::clone(&self.context.file_read_ledger)),
network_proxy: self.context.network_proxy.clone(),
network_no_proxy: self.context.network_no_proxy.clone(),
+ sandbox_profile,
};
let (progress_sender, progress_task) = match on_progress {
@@ -334,8 +360,53 @@ impl ToolRuntime {
let result = tokio::select! {
biased;
() = cancel_token.cancelled() => Err(crate::contracts::ToolCallError::Cancelled),
- result = tool.handle(ctx, input, progress_sender) => result,
+ result = tool.handle(build_ctx(sandbox_profile.clone()), input.clone(), progress_sender) => result,
};
+
+ // UnlessTrusted-style failure upgrade (tool orchestrator):
+ // only silently retry sandbox-off once when this call was already
+ // user-/session-/auto-review-approved. Otherwise return the denial so
+ // the model can re-call with `sandbox_permissions: require_escalated`.
+ // Deny-read profiles never silent-unsandbox (`unsandboxed_execution_allowed`).
+ let result = match result {
+ Ok(output)
+ if !already_bypassed_sandbox
+ && already_approved
+ && is_shell_family_tool(tool_name)
+ && tool_result_is_sandbox_denied(&output) =>
+ {
+ if !devo_sandbox::unsandboxed_execution_allowed(
+ sandbox_profile.as_deref(),
+ &self.context.cwd,
+ ) {
+ info!(
+ tool = %tool_name,
+ id = %call.id,
+ "skipping unsandbox retry after SANDBOX_DENIED because profile has deny-read paths"
+ );
+ Ok(output)
+ } else {
+ info!(
+ tool = %tool_name,
+ id = %call.id,
+ "retrying tool without sandbox after SANDBOX_DENIED (already approved)"
+ );
+ tokio::select! {
+ biased;
+ () = cancel_token.cancelled() => {
+ Err(crate::contracts::ToolCallError::Cancelled)
+ }
+ result = tool.handle(
+ build_ctx(Some("off".to_string())),
+ input,
+ None,
+ ) => result,
+ }
+ }
+ }
+ other => other,
+ };
+
if let Some(progress_task) = progress_task
&& tokio::time::timeout(
Duration::from_millis(PROGRESS_DRAIN_GRACE_MS),
@@ -447,6 +518,10 @@ impl ToolRuntime {
let host = host_for_tool_input(tool_name, &call.input);
let target = target_for_tool_input(tool_name, &call.input);
let command_prefix = command_prefix_for_tool_input(tool_name, &call.input);
+ let command_argv =
+ command_str_for_tool_input(tool_name, &call.input).and_then(safe_shell_argv);
+ let command_pattern = command_str_for_tool_input(tool_name, &call.input)
+ .and_then(|command| generalize_command_pattern(command, &self.context.cwd));
Some(ToolPermissionRequest {
tool_call_id: call.id.clone(),
tool_name: tool_name.to_string(),
@@ -465,6 +540,8 @@ impl ToolRuntime {
host,
target,
command_prefix,
+ command_argv,
+ command_pattern,
requests_escalation: requests_explicit_escalation(&call.input),
})
}
@@ -484,6 +561,26 @@ fn canonical_tool_name<'a>(registry: &ToolRegistry, tool_name: &'a str) -> &'a s
}
}
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct PermissionGrant {
+ /// When true, this invocation must run with sandbox profile off/None.
+ pub bypass_sandbox: bool,
+ /// When true, a user (or session-cache / auto-review) approval already
+ /// covered this call — `already_approved`. Policy Allow without
+ /// asking leaves this false.
+ pub already_approved: bool,
+}
+
+impl PermissionGrant {
+ /// Grant from an interactive (or session-cache / auto-review) approval.
+ pub fn from_approval(bypass_sandbox: bool) -> Self {
+ Self {
+ bypass_sandbox,
+ already_approved: true,
+ }
+ }
+}
+
#[derive(Clone)]
pub struct PermissionChecker {
inner: Arc,
@@ -500,10 +597,10 @@ impl PermissionChecker {
}
pub fn always_allow() -> Self {
- PermissionChecker::new(|_| Box::pin(async { Ok(()) }))
+ PermissionChecker::new(|_| Box::pin(async { Ok(PermissionGrant::default()) }))
}
- pub async fn check(&self, request: ToolPermissionRequest) -> Result<(), String> {
+ pub async fn check(&self, request: ToolPermissionRequest) -> Result {
(self.inner)(request).await
}
}
@@ -523,6 +620,8 @@ pub struct ToolRuntimeContext {
pub hooks: Option,
pub network_proxy: Option,
pub network_no_proxy: Option,
+ /// Active sandbox profile name for child processes spawned by tools.
+ pub sandbox_profile: Option,
}
impl Default for ToolRuntimeContext {
@@ -541,6 +640,7 @@ impl Default for ToolRuntimeContext {
hooks: None,
network_proxy: None,
network_no_proxy: None,
+ sandbox_profile: None,
}
}
}
@@ -637,6 +737,12 @@ pub struct ToolPermissionRequest {
pub host: Option,
pub target: Option,
pub command_prefix: Option>,
+ /// Shell argv for the command after safety screening (no metacharacters,
+ /// no leading env assignment); used to match session command patterns.
+ pub command_argv: Option>,
+ /// Generalized command pattern (e.g. `git add *`) offered as the
+ /// session-scoped approval grant for shell tools.
+ pub command_pattern: Option>,
pub requests_escalation: bool,
}
@@ -763,10 +869,21 @@ fn command_prefix_for_tool_input(
if tool_name == "exec_command"
&& let Some(prefix_rule) = input.get("prefix_rule").and_then(prefix_rule_from_value)
{
+ if crate::tools::exec_policy_amend::is_banned_prefix_suggestion(&prefix_rule) {
+ return None;
+ }
return Some(prefix_rule);
}
- let command = match tool_name {
+ let command = command_str_for_tool_input(tool_name, input)?;
+ command_prefix(command)
+}
+
+fn command_str_for_tool_input<'a>(
+ tool_name: &str,
+ input: &'a serde_json::Value,
+) -> Option<&'a str> {
+ match tool_name {
"bash" | "shell_command" => input
.get("command")
.or_else(|| input.get("cmd"))
@@ -776,8 +893,7 @@ fn command_prefix_for_tool_input(
.or_else(|| input.get("command"))
.and_then(serde_json::Value::as_str),
_ => None,
- }?;
- command_prefix(command)
+ }
}
fn prefix_rule_from_value(value: &serde_json::Value) -> Option> {
@@ -789,16 +905,73 @@ fn prefix_rule_from_value(value: &serde_json::Value) -> Option> {
(!prefix.is_empty()).then(|| prefix.into_iter().map(str::to_string).collect())
}
+pub fn sandbox_permissions_from_input(input: &serde_json::Value) -> String {
+ input
+ .get("sandbox_permissions")
+ .and_then(serde_json::Value::as_str)
+ .unwrap_or("")
+ .to_string()
+}
+
fn requests_explicit_escalation(input: &serde_json::Value) -> bool {
matches!(
- input
- .get("sandbox_permissions")
- .and_then(serde_json::Value::as_str),
- Some("require_escalated" | "with_additional_permissions")
+ sandbox_permissions_from_input(input).as_str(),
+ "require_escalated" | "with_additional_permissions"
) || input.get("additional_permissions").is_some()
}
+fn sandbox_profile_is_inactive(profile: Option<&str>) -> bool {
+ matches!(
+ profile.map(str::trim),
+ None | Some("") | Some("off") | Some("none")
+ )
+}
+
+fn is_shell_family_tool(tool_name: &str) -> bool {
+ matches!(
+ tool_name,
+ "bash" | "shell_command" | "exec_command" | "write_stdin"
+ )
+}
+
+fn tool_result_is_sandbox_denied(output: &crate::contracts::ToolResult) -> bool {
+ let text = match &output.content {
+ crate::contracts::ToolResultContent::Text(text) => text.as_str(),
+ crate::contracts::ToolResultContent::Mixed {
+ text: Some(text), ..
+ } => text.as_str(),
+ crate::contracts::ToolResultContent::Json(_)
+ | crate::contracts::ToolResultContent::Mixed { text: None, .. } => "",
+ };
+ // Only the structured prefix triggers router unsandbox retry. Free-form
+ // keyword heuristics (`is_likely_sandbox_denied`) stay in
+ // `devo_sandbox` where exit codes can exclude 2/126/127 false positives.
+ text.starts_with("SANDBOX_DENIED:") || output.result_summary.starts_with("SANDBOX_DENIED:")
+}
+
+pub fn command_str_for_permission_request(request: &ToolPermissionRequest) -> Option {
+ request
+ .target
+ .clone()
+ .or_else(|| {
+ command_str_for_tool_input(&request.tool_name, &request.input).map(str::to_string)
+ })
+ .filter(|command| !command.is_empty())
+}
+
fn command_prefix(command: &str) -> Option> {
+ let argv = safe_shell_argv(command)?;
+ prefix_from_argv(&argv)
+}
+
+/// Splits a shell command string into argv, rejecting anything that makes
+/// token-based matching unsafe: compound commands, expansions, redirects,
+/// and leading env assignments. Returns `None` unless the command is a
+/// single plain invocation.
+fn safe_shell_argv(command: &str) -> Option> {
+ if command_contains_line_separators(command) {
+ return None;
+ }
let argv = shlex::split(command)?;
if argv
.iter()
@@ -809,7 +982,14 @@ fn command_prefix(command: &str) -> Option> {
{
return None;
}
- prefix_from_argv(&argv)
+ Some(argv)
+}
+
+fn command_contains_line_separators(command: &str) -> bool {
+ command
+ .as_bytes()
+ .iter()
+ .any(|b| matches!(b, b'\n' | b'\r' | 0x0b | 0x0c))
}
fn shell_token_requires_user_scope(command: &str, token: &str) -> bool {
@@ -819,6 +999,26 @@ fn shell_token_requires_user_scope(command: &str, token: &str) -> bool {
|| command.contains("||")
|| command.contains("$(")
|| command.contains('`')
+ || command_contains_standalone_ampersand(command)
+}
+
+/// True when `command` has a background `&` (not `&&`).
+///
+/// Uses shlex tokenization so `&` inside quoted strings (e.g. URL query
+/// strings) does not count. Also treats a token that *ends* with `&`
+/// (`sleep 1& rm x` → `1&`) as a background operator — shells parse that
+/// the same way as a spaced `&`.
+fn command_contains_standalone_ampersand(command: &str) -> bool {
+ shlex::split(command).is_some_and(|argv| {
+ argv.iter()
+ .any(|token| token_is_background_ampersand(token))
+ })
+}
+
+fn token_is_background_ampersand(token: &str) -> bool {
+ // `&&` is AND-list, not background. A lone `&`, or any other token that
+ // ends with `&` (`1&`, `cmd&`), is background.
+ token != "&&" && (token == "&" || token.ends_with('&'))
}
fn looks_like_env_assignment(token: &str) -> bool {
@@ -850,6 +1050,130 @@ fn prefix_from_argv(argv: &[String]) -> Option> {
)
}
+/// Upper bounds for generalized command patterns; commands beyond them fall
+/// back to per-call approval instead of a session grant.
+const COMMAND_PATTERN_MAX_TOKENS: usize = 16;
+const COMMAND_PATTERN_MAX_WILDCARDS: usize = 8;
+
+/// Programs whose arguments must never be generalized into a session approval
+/// pattern: privilege escalation, shell re-entry, and argument-driven command
+/// execution can each turn a broad pattern into an arbitrary command grant.
+const COMMAND_PATTERN_PROGRAM_BLOCKLIST: &[&str] = &[
+ "sudo",
+ "doas",
+ "run0",
+ "sh",
+ "bash",
+ "zsh",
+ "fish",
+ "env",
+ "xargs",
+ "find",
+ "eval",
+ // Destructive / irreversible programs must never generalize to wildcards
+ // (e.g. `rm foo` → `rm *` would auto-approve any rm for the session).
+ "rm",
+ "rmdir",
+ "dd",
+ "mkfs",
+ "shred",
+ "wipe",
+ "chmod",
+ "chown",
+ "chgrp",
+ "mv",
+ "python",
+ "python3",
+ "perl",
+ "ruby",
+ "node",
+ "php",
+ "lua",
+ "osascript",
+];
+
+/// Derives a generalized command pattern (e.g. `git add file.txt` ->
+/// `["git", "add", "*"]`) used as a session-scoped approval grant. The
+/// program, flags, and leading subcommand words stay verbatim; the first
+/// value-like token and every later non-flag token become `*`. Returns
+/// `None` when the command cannot be generalized safely (compound commands,
+/// expansions, env assignments, blocklisted programs such as `sudo` or
+/// `sh -c`, or patterns beyond the token/wildcard limits).
+pub fn generalize_command_pattern(command: &str, cwd: &Path) -> Option> {
+ let argv = safe_shell_argv(command)?;
+ command_pattern_from_argv(&argv, cwd)
+}
+
+fn command_pattern_from_argv(argv: &[String], _cwd: &Path) -> Option> {
+ if argv.is_empty() || argv.len() > COMMAND_PATTERN_MAX_TOKENS {
+ return None;
+ }
+ let program = argv.first()?;
+ if COMMAND_PATTERN_PROGRAM_BLOCKLIST.contains(&program_basename(program)) {
+ return None;
+ }
+ let mut pattern = Vec::with_capacity(argv.len());
+ pattern.push(program.clone());
+ let mut wildcards = 0;
+ let mut values_started = false;
+ for token in &argv[1..] {
+ // Flags stay verbatim in any position; subcommand words stay
+ // verbatim only until the first value-like token appears.
+ if token.starts_with('-') || (!values_started && is_subcommand_word(token)) {
+ pattern.push(token.clone());
+ continue;
+ }
+ values_started = true;
+ wildcards += 1;
+ if wildcards > COMMAND_PATTERN_MAX_WILDCARDS {
+ return None;
+ }
+ pattern.push("*".to_string());
+ }
+ Some(pattern)
+}
+
+/// Matches a generalized command pattern against a concrete argv. An inner
+/// `*` matches exactly one token; a trailing `*` matches one or more tokens.
+/// Patterns without `*` require a full verbatim match.
+pub fn command_pattern_matches(pattern: &[String], argv: &[String]) -> bool {
+ let mut args = argv.iter();
+ let mut tokens = pattern.iter().peekable();
+ while let Some(token) = tokens.next() {
+ if token.as_str() == "*" {
+ if tokens.peek().is_none() {
+ return args.next().is_some();
+ }
+ if args.next().is_none() {
+ return false;
+ }
+ continue;
+ }
+ if args.next() != Some(token) {
+ return false;
+ }
+ }
+ args.next().is_none()
+}
+
+fn program_basename(program: &str) -> &str {
+ program.rsplit(['/', '\\']).next().unwrap_or(program)
+}
+
+fn is_subcommand_word(token: &str) -> bool {
+ // Subcommand words are short lowercase identifiers (`^[a-z][a-z0-9_-]{0,31}$`,
+ // e.g. `add` in `git add`); the charset already excludes path and
+ // assignment punctuation such as `.`, `/`, `=`, `:`, `~`.
+ // Do not probe the filesystem: cwd existence would make patterns drift.
+ let mut chars = token.chars();
+ let Some(first) = chars.next() else {
+ return false;
+ };
+ first.is_ascii_lowercase()
+ && token.len() <= 32
+ && chars.all(|ch| ch.is_ascii_lowercase() || ch.is_ascii_digit() || ch == '-' || ch == '_')
+}
+
fn justification_for_tool_input(input: &serde_json::Value) -> Option {
input
.get("justification")
@@ -1177,7 +1501,7 @@ mod tests {
if n == "blocked" {
Err("blocked".into())
} else {
- Ok(())
+ Ok(PermissionGrant::default())
}
})
});
@@ -1285,7 +1609,7 @@ mod tests {
.expect("send once")
.send(request)
.expect("receiver still alive");
- Box::pin(async { Ok(()) })
+ Box::pin(async { Ok(PermissionGrant::default()) })
});
let runtime = ToolRuntime::new_with_context(
registry,
@@ -1304,6 +1628,7 @@ mod tests {
hooks: None,
network_proxy: None,
network_no_proxy: None,
+ sandbox_profile: None,
},
);
let call = ToolCall {
@@ -1530,6 +1855,194 @@ mod tests {
);
}
+ #[test]
+ fn exec_command_banned_prefix_rule_is_not_offered() {
+ assert_eq!(
+ command_prefix_for_tool_input(
+ "exec_command",
+ &serde_json::json!({
+ "cmd": "git status",
+ "prefix_rule": ["git"]
+ })
+ ),
+ None
+ );
+ }
+
+ fn strs(tokens: &[&str]) -> Vec {
+ tokens.iter().map(|token| token.to_string()).collect()
+ }
+
+ #[test]
+ fn command_pattern_generalizes_value_arguments() {
+ let cwd = std::path::Path::new("/nonexistent-cwd-for-pattern-tests");
+ assert_eq!(
+ generalize_command_pattern("git add file.txt", cwd),
+ Some(strs(&["git", "add", "*"]))
+ );
+ // Interpreters are blocklisted and must not generalize.
+ assert_eq!(generalize_command_pattern("node -e 'foo.bar'", cwd), None);
+ assert_eq!(
+ generalize_command_pattern("git commit -m 'initial commit'", cwd),
+ Some(strs(&["git", "commit", "-m", "*"]))
+ );
+ assert_eq!(
+ generalize_command_pattern("git add a.txt b.txt", cwd),
+ Some(strs(&["git", "add", "*", "*"]))
+ );
+ // Words after the first value are values too, even if they look like subcommands.
+ assert_eq!(
+ generalize_command_pattern("git add file.txt docs", cwd),
+ Some(strs(&["git", "add", "*", "*"]))
+ );
+ }
+
+ #[test]
+ fn command_pattern_allows_verbatim_patterns_without_wildcards() {
+ let cwd = std::path::Path::new("/nonexistent-cwd-for-pattern-tests");
+ assert_eq!(
+ generalize_command_pattern("cargo build --release", cwd),
+ Some(strs(&["cargo", "build", "--release"]))
+ );
+ assert_eq!(
+ generalize_command_pattern("git status", cwd),
+ Some(strs(&["git", "status"]))
+ );
+ }
+
+ #[test]
+ fn command_pattern_rejects_unsafe_commands() {
+ let cwd = std::path::Path::new("/nonexistent-cwd-for-pattern-tests");
+ // Blocklisted programs, including via path basename.
+ assert_eq!(generalize_command_pattern("sudo rm -rf /tmp/x", cwd), None);
+ assert_eq!(generalize_command_pattern("rm /tmp/x", cwd), None);
+ assert_eq!(
+ generalize_command_pattern("dd if=/dev/zero of=x", cwd),
+ None
+ );
+ assert_eq!(generalize_command_pattern("/usr/bin/sudo ls", cwd), None);
+ assert_eq!(generalize_command_pattern("sh -c 'ls'", cwd), None);
+ assert_eq!(generalize_command_pattern("bash -c 'ls'", cwd), None);
+ assert_eq!(generalize_command_pattern("find . -name foo", cwd), None);
+ assert_eq!(generalize_command_pattern("xargs rm", cwd), None);
+ assert_eq!(generalize_command_pattern("env ls", cwd), None);
+ assert_eq!(generalize_command_pattern("eval ls", cwd), None);
+ // Compound commands, expansions, redirects, env assignments.
+ assert_eq!(
+ generalize_command_pattern("git add a && git commit", cwd),
+ None
+ );
+ assert_eq!(generalize_command_pattern("cat x | grep y", cwd), None);
+ assert_eq!(generalize_command_pattern("echo hi > out.txt", cwd), None);
+ assert_eq!(generalize_command_pattern("echo $(pwd)", cwd), None);
+ assert_eq!(generalize_command_pattern("FOO=bar cargo test", cwd), None);
+ // Background `&` (not `&&`) must not be treated as a safe prefix.
+ assert_eq!(
+ generalize_command_pattern("sleep 1 & touch /tmp/x", cwd),
+ None
+ );
+ // Quoted URL query `&` is not a background operator.
+ assert!(!command_contains_standalone_ampersand(
+ r#"curl "http://example.com/?a=1&b=2""#
+ ));
+ assert!(command_contains_standalone_ampersand("sleep 1 & touch x"));
+ assert!(command_contains_standalone_ampersand("sleep 1& rm x"));
+ assert!(!command_contains_standalone_ampersand("true && false"));
+ assert!(!token_is_background_ampersand("&&"));
+ assert!(token_is_background_ampersand("1&"));
+ assert!(token_is_background_ampersand("&"));
+ // Unparseable quoting.
+ assert_eq!(
+ generalize_command_pattern("git add 'unterminated", cwd),
+ None
+ );
+ }
+
+ #[test]
+ fn command_pattern_enforces_token_and_wildcard_limits() {
+ let cwd = std::path::Path::new("/nonexistent-cwd-for-pattern-tests");
+ // 17 tokens exceeds the 16-token cap.
+ assert_eq!(
+ generalize_command_pattern("git a b c d e f g h i j k l m n o p", cwd),
+ None
+ );
+ // 9 wildcards exceeds the 8-wildcard cap.
+ assert_eq!(
+ generalize_command_pattern("git add A B C D E F G H I", cwd),
+ None
+ );
+ // 8 wildcards is still allowed.
+ assert_eq!(
+ generalize_command_pattern("git add A B C D E F G H", cwd),
+ Some(strs(&[
+ "git", "add", "*", "*", "*", "*", "*", "*", "*", "*"
+ ]))
+ );
+ }
+
+ #[test]
+ fn command_pattern_keeps_subcommand_words_without_cwd_stat() {
+ let tempdir = tempfile::tempdir().expect("tempdir");
+ let cwd = tempdir.path();
+ std::fs::write(cwd.join("add"), "placeholder").expect("write placeholder");
+
+ // Existing cwd path must not turn a subcommand word into a wildcard.
+ assert_eq!(
+ generalize_command_pattern("git add", cwd),
+ Some(strs(&["git", "add"]))
+ );
+ }
+
+ #[test]
+ fn command_pattern_matches_trailing_wildcard_one_or_more() {
+ let pattern = strs(&["git", "add", "*"]);
+ assert!(command_pattern_matches(
+ &pattern,
+ &strs(&["git", "add", "file.txt"])
+ ));
+ assert!(command_pattern_matches(
+ &pattern,
+ &strs(&["git", "add", "a", "b"])
+ ));
+ assert!(!command_pattern_matches(&pattern, &strs(&["git", "add"])));
+ assert!(!command_pattern_matches(
+ &pattern,
+ &strs(&["git", "commit", "x"])
+ ));
+ assert!(!command_pattern_matches(
+ &pattern,
+ &strs(&["sudo", "git", "add", "x"])
+ ));
+ }
+
+ #[test]
+ fn command_pattern_matches_inner_wildcard_exactly_one() {
+ let pattern = strs(&["git", "commit", "-m", "*", "--amend"]);
+ assert!(command_pattern_matches(
+ &pattern,
+ &strs(&["git", "commit", "-m", "msg", "--amend"])
+ ));
+ assert!(!command_pattern_matches(
+ &pattern,
+ &strs(&["git", "commit", "-m", "a", "b", "--amend"])
+ ));
+ assert!(!command_pattern_matches(
+ &pattern,
+ &strs(&["git", "commit", "-m", "--amend"])
+ ));
+ }
+
+ #[test]
+ fn command_pattern_matches_verbatim_requires_exact_argv() {
+ let pattern = strs(&["git", "status"]);
+ assert!(command_pattern_matches(&pattern, &strs(&["git", "status"])));
+ assert!(!command_pattern_matches(
+ &pattern,
+ &strs(&["git", "status", "-s"])
+ ));
+ assert!(!command_pattern_matches(&pattern, &strs(&["git"])));
+ }
+
#[test]
fn explicit_sandbox_permissions_request_escalation() {
assert!(requests_explicit_escalation(&serde_json::json!({
@@ -1543,6 +2056,343 @@ mod tests {
})));
}
+ #[test]
+ fn sandbox_profile_inactive_detection() {
+ assert!(sandbox_profile_is_inactive(None));
+ assert!(sandbox_profile_is_inactive(Some("")));
+ assert!(sandbox_profile_is_inactive(Some("off")));
+ assert!(sandbox_profile_is_inactive(Some("none")));
+ assert!(!sandbox_profile_is_inactive(Some("workspace")));
+ }
+
+ #[test]
+ fn tool_result_detects_sandbox_denied_prefix() {
+ let denied = ToolResult::error(
+ ToolResultContent::Text("SANDBOX_DENIED: blocked".into()),
+ "failed",
+ ToolCallError::ExecutionFailed("SANDBOX_DENIED: blocked".into()),
+ );
+ assert!(tool_result_is_sandbox_denied(&denied));
+
+ let other = ToolResult::error(
+ ToolResultContent::Text("exit code 1".into()),
+ "failed",
+ ToolCallError::ExecutionFailed("exit code 1".into()),
+ );
+ assert!(!tool_result_is_sandbox_denied(&other));
+ }
+
+ #[tokio::test]
+ async fn execute_single_retries_without_sandbox_when_already_approved() {
+ struct SandboxAwareTool {
+ spec: ToolSpec,
+ attempts: Arc>>>,
+ }
+
+ #[async_trait]
+ impl ToolHandler for SandboxAwareTool {
+ fn spec(&self) -> &ToolSpec {
+ &self.spec
+ }
+
+ async fn handle(
+ &self,
+ ctx: ToolContext,
+ _input: serde_json::Value,
+ _progress: Option,
+ ) -> Result {
+ self.attempts
+ .lock()
+ .expect("attempts lock")
+ .push(ctx.sandbox_profile.clone());
+ if ctx.sandbox_profile.as_deref() == Some("workspace") {
+ return Ok(ToolResult::error(
+ ToolResultContent::Text(
+ "SANDBOX_DENIED: The command was blocked by the OS sandbox.".into(),
+ ),
+ "denied",
+ ToolCallError::ExecutionFailed("SANDBOX_DENIED".into()),
+ ));
+ }
+ Ok(ToolResult::success(
+ ToolResultContent::Text("ok outside sandbox".into()),
+ "ok",
+ ))
+ }
+ }
+
+ let attempts = Arc::new(std::sync::Mutex::new(Vec::new()));
+ let mut builder = ToolRegistryBuilder::new();
+ builder.register_handler(
+ "shell_command",
+ Arc::new(SandboxAwareTool {
+ spec: ToolSpec {
+ name: "shell_command".into(),
+ description: String::new(),
+ input_schema: JsonSchema::object(Default::default(), None, None),
+ output_mode: ToolOutputMode::Text,
+ execution_mode: ToolExecutionMode::Mutating,
+ capability_tags: vec![ToolCapabilityTag::ExecuteProcess],
+ supports_parallel: false,
+ preparation_feedback: ToolPreparationFeedback::None,
+ display_name: None,
+ supports_cancellation: None,
+ supports_streaming: None,
+ },
+ attempts: Arc::clone(&attempts),
+ }),
+ );
+ builder.push_spec(ToolSpec {
+ name: "shell_command".into(),
+ description: String::new(),
+ input_schema: JsonSchema::object(Default::default(), None, None),
+ output_mode: ToolOutputMode::Text,
+ execution_mode: ToolExecutionMode::Mutating,
+ capability_tags: vec![ToolCapabilityTag::ExecuteProcess],
+ supports_parallel: false,
+ preparation_feedback: ToolPreparationFeedback::None,
+ display_name: None,
+ supports_cancellation: None,
+ supports_streaming: None,
+ });
+ let registry = Arc::new(builder.build());
+
+ let permission_checks = Arc::new(std::sync::atomic::AtomicUsize::new(0));
+ let permission_checks_for_checker = Arc::clone(&permission_checks);
+ let checker = PermissionChecker::new(move |_request| {
+ permission_checks_for_checker.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+ Box::pin(async {
+ Ok(PermissionGrant::from_approval(
+ /*bypass_sandbox*/ false,
+ ))
+ })
+ });
+
+ let mut runtime = ToolRuntime::new(registry, checker);
+ runtime.context.sandbox_profile = Some("workspace".to_string());
+
+ let call = ToolCall {
+ id: "deny1".into(),
+ name: "shell_command".into(),
+ input: serde_json::json!({ "command": "touch /tmp/x" }),
+ };
+ let result = runtime.execute_single(&call, &None).await;
+ assert!(!result.is_error);
+ assert_eq!(result.content.into_string(), "ok outside sandbox");
+ assert_eq!(
+ permission_checks.load(std::sync::atomic::Ordering::SeqCst),
+ 1,
+ "SANDBOX_DENIED retry must not request a second permission check"
+ );
+ assert_eq!(
+ *attempts.lock().expect("attempts lock"),
+ vec![Some("workspace".to_string()), Some("off".to_string())]
+ );
+ }
+
+ #[tokio::test]
+ async fn execute_single_does_not_silent_unsandbox_without_approval() {
+ struct SandboxAwareTool {
+ spec: ToolSpec,
+ attempts: Arc>>>,
+ }
+
+ #[async_trait]
+ impl ToolHandler for SandboxAwareTool {
+ fn spec(&self) -> &ToolSpec {
+ &self.spec
+ }
+
+ async fn handle(
+ &self,
+ ctx: ToolContext,
+ _input: serde_json::Value,
+ _progress: Option,
+ ) -> Result {
+ self.attempts
+ .lock()
+ .expect("attempts lock")
+ .push(ctx.sandbox_profile.clone());
+ Ok(ToolResult::error(
+ ToolResultContent::Text(
+ "SANDBOX_DENIED: The command was blocked by the OS sandbox.".into(),
+ ),
+ "denied",
+ ToolCallError::ExecutionFailed("SANDBOX_DENIED".into()),
+ ))
+ }
+ }
+
+ let attempts = Arc::new(std::sync::Mutex::new(Vec::new()));
+ let mut builder = ToolRegistryBuilder::new();
+ builder.register_handler(
+ "shell_command",
+ Arc::new(SandboxAwareTool {
+ spec: ToolSpec {
+ name: "shell_command".into(),
+ description: String::new(),
+ input_schema: JsonSchema::object(Default::default(), None, None),
+ output_mode: ToolOutputMode::Text,
+ execution_mode: ToolExecutionMode::Mutating,
+ capability_tags: vec![ToolCapabilityTag::ExecuteProcess],
+ supports_parallel: false,
+ preparation_feedback: ToolPreparationFeedback::None,
+ display_name: None,
+ supports_cancellation: None,
+ supports_streaming: None,
+ },
+ attempts: Arc::clone(&attempts),
+ }),
+ );
+ builder.push_spec(ToolSpec {
+ name: "shell_command".into(),
+ description: String::new(),
+ input_schema: JsonSchema::object(Default::default(), None, None),
+ output_mode: ToolOutputMode::Text,
+ execution_mode: ToolExecutionMode::Mutating,
+ capability_tags: vec![ToolCapabilityTag::ExecuteProcess],
+ supports_parallel: false,
+ preparation_feedback: ToolPreparationFeedback::None,
+ display_name: None,
+ supports_cancellation: None,
+ supports_streaming: None,
+ });
+ let registry = Arc::new(builder.build());
+
+ // Policy Allow: already_approved stays false (PermissionGrant::default).
+ let checker =
+ PermissionChecker::new(|_| Box::pin(async { Ok(PermissionGrant::default()) }));
+
+ let mut runtime = ToolRuntime::new(registry, checker);
+ runtime.context.sandbox_profile = Some("workspace".to_string());
+
+ let call = ToolCall {
+ id: "deny2".into(),
+ name: "shell_command".into(),
+ input: serde_json::json!({ "command": "touch /tmp/x" }),
+ };
+ let result = runtime.execute_single(&call, &None).await;
+ assert!(result.is_error);
+ assert!(
+ result.content.into_string().starts_with("SANDBOX_DENIED:"),
+ "denial must surface for require_escalated"
+ );
+ assert_eq!(
+ *attempts.lock().expect("attempts lock"),
+ vec![Some("workspace".to_string())],
+ "must not silent unsandbox without already_approved"
+ );
+ }
+
+ #[tokio::test]
+ async fn execute_single_skips_unsandbox_retry_when_profile_has_deny_read() {
+ struct SandboxAwareTool {
+ spec: ToolSpec,
+ attempts: Arc>>>,
+ }
+
+ #[async_trait]
+ impl ToolHandler for SandboxAwareTool {
+ fn spec(&self) -> &ToolSpec {
+ &self.spec
+ }
+
+ async fn handle(
+ &self,
+ ctx: ToolContext,
+ _input: serde_json::Value,
+ _progress: Option,
+ ) -> Result {
+ self.attempts
+ .lock()
+ .expect("attempts lock")
+ .push(ctx.sandbox_profile.clone());
+ Ok(ToolResult::error(
+ ToolResultContent::Text(
+ "SANDBOX_DENIED: The command was blocked by the OS sandbox.".into(),
+ ),
+ "denied",
+ ToolCallError::ExecutionFailed("SANDBOX_DENIED".into()),
+ ))
+ }
+ }
+
+ let attempts = Arc::new(std::sync::Mutex::new(Vec::new()));
+ let mut builder = ToolRegistryBuilder::new();
+ builder.register_handler(
+ "shell_command",
+ Arc::new(SandboxAwareTool {
+ spec: ToolSpec {
+ name: "shell_command".into(),
+ description: String::new(),
+ input_schema: JsonSchema::object(Default::default(), None, None),
+ output_mode: ToolOutputMode::Text,
+ execution_mode: ToolExecutionMode::Mutating,
+ capability_tags: vec![ToolCapabilityTag::ExecuteProcess],
+ supports_parallel: false,
+ preparation_feedback: ToolPreparationFeedback::None,
+ display_name: None,
+ supports_cancellation: None,
+ supports_streaming: None,
+ },
+ attempts: Arc::clone(&attempts),
+ }),
+ );
+ builder.push_spec(ToolSpec {
+ name: "shell_command".into(),
+ description: String::new(),
+ input_schema: JsonSchema::object(Default::default(), None, None),
+ output_mode: ToolOutputMode::Text,
+ execution_mode: ToolExecutionMode::Mutating,
+ capability_tags: vec![ToolCapabilityTag::ExecuteProcess],
+ supports_parallel: false,
+ preparation_feedback: ToolPreparationFeedback::None,
+ display_name: None,
+ supports_cancellation: None,
+ supports_streaming: None,
+ });
+ let registry = Arc::new(builder.build());
+
+ let checker = PermissionChecker::new(|_| {
+ Box::pin(async {
+ Ok(PermissionGrant::from_approval(
+ /*bypass_sandbox*/ false,
+ ))
+ })
+ });
+
+ let temp = tempfile::tempdir().expect("tempdir");
+ let workspace = temp.path();
+ let config_dir = workspace.join(".devo");
+ std::fs::create_dir_all(&config_dir).expect("mkdir");
+ std::fs::write(
+ config_dir.join("sandbox.toml"),
+ r#"
+[profiles.locked]
+extends = "workspace"
+deny = ["/etc/passwd"]
+"#,
+ )
+ .expect("write config");
+
+ let mut runtime = ToolRuntime::new(registry, checker);
+ runtime.context.cwd = workspace.to_path_buf();
+ runtime.context.sandbox_profile = Some("locked".to_string());
+
+ let call = ToolCall {
+ id: "deny3".into(),
+ name: "shell_command".into(),
+ input: serde_json::json!({ "command": "cat /etc/passwd" }),
+ };
+ let result = runtime.execute_single(&call, &None).await;
+ assert!(result.is_error);
+ assert_eq!(
+ *attempts.lock().expect("attempts lock"),
+ vec![Some("locked".to_string())],
+ "deny-read profiles must not silent-unsandbox after SANDBOX_DENIED"
+ );
+ }
+
fn test_permission_request(tool_name: &str) -> ToolPermissionRequest {
ToolPermissionRequest {
tool_call_id: "call".into(),
@@ -1558,6 +2408,8 @@ mod tests {
host: None,
target: None,
command_prefix: None,
+ command_argv: None,
+ command_pattern: None,
requests_escalation: false,
}
}
diff --git a/crates/core/src/tools/shell_exec.rs b/crates/core/src/tools/shell_exec.rs
index 41ec22f2..e66fc284 100644
--- a/crates/core/src/tools/shell_exec.rs
+++ b/crates/core/src/tools/shell_exec.rs
@@ -18,6 +18,48 @@ const DEFAULT_YIELD_TIME_MS: u64 = 1_000;
const DEFAULT_MAX_OUTPUT_TOKENS: usize = 16_000;
const TRUNCATED_SUFFIX: &str = "\n\n... [truncated]";
+#[cfg(not(unix))]
+fn try_windows_sandbox_launch(
+ sandbox_profile: Option<&str>,
+ workdir: &std::path::Path,
+ shell: &ShellSpec,
+ command: &str,
+) -> anyhow::Result> {
+ use std::sync::Once;
+ if !devo_windows_sandbox::should_wrap_profile(sandbox_profile) {
+ return Ok(None);
+ }
+ let profile = sandbox_profile.expect("checked by should_wrap_profile");
+ let profile_name = profile
+ .parse::()
+ .map_err(|error| anyhow::anyhow!("invalid sandbox profile '{profile}': {error}"))?;
+ let config = devo_sandbox::load_sandbox_config(workdir)?;
+ let resolved = profile_name.resolve_profile(workdir, &config)?;
+ let request = devo_windows_sandbox::WindowsSandboxRequest {
+ command: command.to_string(),
+ shell_program: shell.program.to_string(),
+ shell_args: shell.args.iter().map(|arg| arg.to_string()).collect(),
+ cwd: workdir.to_path_buf(),
+ readable_roots: resolved.read_only,
+ writable_roots: resolved.read_write,
+ deny_read: resolved.deny,
+ restrict_network: resolved.restrict_network,
+ };
+ match devo_windows_sandbox::prepare_windows_sandbox_launch(&request)? {
+ Some(launch) => Ok(Some(launch)),
+ None => {
+ static WARNED: Once = Once::new();
+ WARNED.call_once(|| {
+ tracing::warn!(
+ "Windows sandbox profile is active but launch preparation is not wired yet; \
+ commands run unwrapped"
+ );
+ });
+ Ok(None)
+ }
+ }
+}
+
pub(crate) struct ShellExecRequest {
pub command: String,
pub workdir: PathBuf,
@@ -28,6 +70,7 @@ pub(crate) struct ShellExecRequest {
pub timeout_ms: u64,
pub yield_time_ms: u64,
pub max_output_tokens: usize,
+ pub sandbox_profile: Option,
}
struct PtyRunConfig {
@@ -38,6 +81,7 @@ struct PtyRunConfig {
timeout_ms: u64,
yield_time_ms: u64,
max_output_tokens: usize,
+ sandbox_profile: Option,
}
struct PtyChildGuard {
@@ -133,6 +177,7 @@ pub(crate) async fn execute_shell_command(
timeout_ms,
yield_time_ms,
max_output_tokens,
+ sandbox_profile,
} = request;
if !workdir.exists() {
@@ -168,6 +213,7 @@ pub(crate) async fn execute_shell_command(
timeout_ms,
yield_time_ms,
max_output_tokens,
+ sandbox_profile,
},
progress,
cancel_token,
@@ -177,22 +223,139 @@ pub(crate) async fn execute_shell_command(
info!(command = %command_to_run, shell = shell.program, "executing shell command");
let command_preview = preview(&command_to_run);
- let mut child = Command::new(shell.program);
+
+ // Linux pipe spawns compose a bwrap wrapper with the pre_exec sandbox when
+ // the profile needs enforcement Landlock cannot express (deny paths,
+ // network restriction); everything else runs unwrapped.
+ #[cfg(unix)]
+ let sandbox_wrap = match devo_sandbox::wrap_command_for_profile(
+ sandbox_profile.as_deref(),
+ &workdir,
+ devo_sandbox::WrapMode::PipeComposed,
+ &devo_sandbox::SandboxLogger::new(),
+ ) {
+ Ok(wrap) => wrap,
+ Err(error) => {
+ return Ok(FunctionToolOutput::error(format!(
+ "failed to set up sandbox: {error}"
+ )));
+ }
+ };
+ #[cfg(not(unix))]
+ let sandbox_wrap = devo_sandbox::SandboxWrap::None;
+ #[cfg(not(unix))]
+ let windows_launch = match try_windows_sandbox_launch(
+ sandbox_profile.as_deref(),
+ &workdir,
+ &shell,
+ &command_to_run,
+ ) {
+ Ok(launch) => launch,
+ Err(error) => {
+ return Ok(FunctionToolOutput::error(format!(
+ "failed to set up Windows sandbox: {error}"
+ )));
+ }
+ };
+
+ let mut child = match &sandbox_wrap {
+ devo_sandbox::SandboxWrap::Wrapped(wrapped) => {
+ let mut child = Command::new(&wrapped.program);
+ child
+ .args(&wrapped.prefix_args)
+ .arg(shell.program)
+ .args(shell.args)
+ .arg(&command_to_run);
+ child
+ }
+ devo_sandbox::SandboxWrap::None => {
+ #[cfg(not(unix))]
+ if let Some(launch) = &windows_launch {
+ let mut child = Command::new(&launch.program);
+ child.args(&launch.args);
+ for (key, value) in &launch.env {
+ child.env(key, value);
+ }
+ child
+ } else {
+ let mut child = Command::new(shell.program);
+ child.args(shell.args).arg(&command_to_run);
+ child
+ }
+ #[cfg(unix)]
+ {
+ let mut child = Command::new(shell.program);
+ child.args(shell.args).arg(&command_to_run);
+ child
+ }
+ }
+ };
child
- .args(shell.args)
- .arg(&command_to_run)
.stdin(Stdio::null())
.stdout(Stdio::piped())
.stderr(Stdio::piped())
.current_dir(&workdir)
.kill_on_drop(true);
+ #[cfg(unix)]
+ {
+ let sandbox_workspace = workdir.clone();
+ let helper_enforces = matches!(
+ &sandbox_wrap,
+ devo_sandbox::SandboxWrap::Wrapped(wrapped) if wrapped.helper_enforces
+ );
+ let sandbox_plan = if helper_enforces {
+ None
+ } else {
+ match devo_util_process::sandbox::resolve_profile_for_spawn(
+ sandbox_profile.as_deref(),
+ &sandbox_workspace,
+ ) {
+ Ok(plan) => plan,
+ Err(error) => {
+ return Ok(FunctionToolOutput::error(format!(
+ "failed to resolve sandbox profile: {error}"
+ )));
+ }
+ }
+ };
+ unsafe {
+ child.pre_exec(move || {
+ devo_util_process::sandbox::apply_resolved_in_child(sandbox_plan.as_ref())
+ });
+ }
+ }
+ #[cfg(not(unix))]
+ let _ = &sandbox_profile;
+
if cfg!(windows) {
child.env("PYTHONUTF8", "1");
}
+ apply_sandbox_proxy_env(&mut child, sandbox_profile.as_deref(), &workdir);
+
+ let spawned = match child.spawn() {
+ Ok(child) => child,
+ Err(error) => {
+ return Ok(FunctionToolOutput::error(format!(
+ "failed to spawn process: {error}"
+ )));
+ }
+ };
+ // bwrap mounts are not up when spawn returns, so the placeholder directory
+ // must outlive the launch; remove it after a delay instead.
+ if let devo_sandbox::SandboxWrap::Wrapped(wrapped) = &sandbox_wrap
+ && let Some(directory) = &wrapped.placeholder_dir
+ {
+ let directory = directory.clone();
+ tokio::spawn(async move {
+ tokio::time::sleep(devo_sandbox::PLACEHOLDER_CLEANUP_DELAY).await;
+ devo_sandbox::remove_placeholder_dir(&directory);
+ });
+ }
+
let result = tokio::select! {
- result = timeout(Duration::from_millis(timeout_ms), child.output()) => result,
+ result = timeout(Duration::from_millis(timeout_ms), spawned.wait_with_output()) => result,
_ = cancel_token.cancelled() => {
return Ok(FunctionToolOutput::error("command cancelled"));
}
@@ -221,10 +384,22 @@ pub(crate) async fn execute_shell_command(
}),
))
} else {
- let code = output.status.code().unwrap_or(-1);
- Ok(FunctionToolOutput::error(format!(
- "exit code {code}\n{result_text}"
- )))
+ #[cfg(unix)]
+ let unix_signal = {
+ use std::os::unix::process::ExitStatusExt;
+ output.status.signal()
+ };
+ #[cfg(not(unix))]
+ let unix_signal: Option = None;
+ let error_message = devo_sandbox::shell_error_message_with_signal(
+ sandbox_profile.as_deref(),
+ output.status.code(),
+ unix_signal,
+ &stdout,
+ &stderr,
+ &result_text,
+ );
+ Ok(FunctionToolOutput::error(error_message))
}
}
Ok(Err(error)) => Ok(FunctionToolOutput::error(format!(
@@ -336,6 +511,16 @@ fn platform_shell(login: bool) -> ShellSpec {
}
}
+fn apply_sandbox_proxy_env(
+ child: &mut Command,
+ sandbox_profile: Option<&str>,
+ workdir: &std::path::Path,
+) {
+ for (key, value) in devo_sandbox::proxy_env_for_sandbox_profile(sandbox_profile, workdir) {
+ child.env(key, value);
+ }
+}
+
async fn run_with_pty(
config: PtyRunConfig,
progress: Option,
@@ -349,6 +534,7 @@ async fn run_with_pty(
timeout_ms,
yield_time_ms,
max_output_tokens,
+ sandbox_profile,
} = config;
let pty_system = native_pty_system();
let pair = pty_system
@@ -360,20 +546,108 @@ async fn run_with_pty(
})
.map_err(|error| anyhow::anyhow!("failed to open PTY: {error}"))?;
- let mut builder = CommandBuilder::new(shell.program);
- builder.args(shell.args);
- builder.arg(&command_to_run);
+ // PTY spawns have no pre_exec hook: enforce the profile by wrapping the
+ // command in the OS sandbox launcher (macOS sandbox-exec, Linux bwrap).
+ // The wrapped child must NOT also apply the profile (no nested sandboxes).
+ #[cfg(unix)]
+ let sandbox_wrap = match devo_sandbox::wrap_command_for_profile(
+ sandbox_profile.as_deref(),
+ &workdir,
+ devo_sandbox::WrapMode::PtyOnly,
+ &devo_sandbox::SandboxLogger::new(),
+ ) {
+ Ok(wrap) => wrap,
+ Err(error) => {
+ return Ok(FunctionToolOutput::error(format!(
+ "failed to set up sandbox: {error}"
+ )));
+ }
+ };
+ #[cfg(not(unix))]
+ let sandbox_wrap = devo_sandbox::SandboxWrap::None;
+ #[cfg(not(unix))]
+ let windows_launch = match try_windows_sandbox_launch(
+ sandbox_profile.as_deref(),
+ &workdir,
+ &shell,
+ &command_to_run,
+ ) {
+ Ok(launch) => launch,
+ Err(error) => {
+ return Ok(FunctionToolOutput::error(format!(
+ "failed to set up Windows sandbox: {error}"
+ )));
+ }
+ };
+ #[cfg(not(unix))]
+ let _ = sandbox_profile;
+
+ let mut builder = match &sandbox_wrap {
+ devo_sandbox::SandboxWrap::Wrapped(wrapped) => {
+ let mut builder = CommandBuilder::new(&wrapped.program);
+ builder.args(&wrapped.prefix_args);
+ builder.arg(shell.program);
+ builder
+ }
+ devo_sandbox::SandboxWrap::None => {
+ #[cfg(not(unix))]
+ if let Some(launch) = &windows_launch {
+ let mut builder = CommandBuilder::new(launch.program.to_string_lossy());
+ builder.args(
+ launch
+ .args
+ .iter()
+ .map(|arg| arg.as_str())
+ .collect::>(),
+ );
+ for (key, value) in &launch.env {
+ builder.env(key, value);
+ }
+ builder
+ } else {
+ CommandBuilder::new(shell.program)
+ }
+ #[cfg(unix)]
+ CommandBuilder::new(shell.program)
+ }
+ };
+ #[cfg(not(unix))]
+ if windows_launch.is_none() {
+ builder.args(shell.args);
+ builder.arg(&command_to_run);
+ }
+ #[cfg(unix)]
+ {
+ builder.args(shell.args);
+ builder.arg(&command_to_run);
+ }
builder.cwd(&workdir);
if cfg!(windows) {
builder.env("PYTHONUTF8", "1");
builder.env("TERM", "xterm-256color");
builder.env("COLORTERM", "truecolor");
}
+ for (key, value) in
+ devo_sandbox::proxy_env_for_sandbox_profile(sandbox_profile.as_deref(), &workdir)
+ {
+ builder.env(key, value);
+ }
let child = pair
.slave
.spawn_command(builder)
.map_err(|error| anyhow::anyhow!("failed to spawn PTY command: {error}"))?;
+ // bwrap mounts are not up when spawn returns, so the placeholder directory
+ // must outlive the launch; remove it after a delay instead.
+ if let devo_sandbox::SandboxWrap::Wrapped(wrapped) = &sandbox_wrap
+ && let Some(directory) = &wrapped.placeholder_dir
+ {
+ let directory = directory.clone();
+ tokio::spawn(async move {
+ tokio::time::sleep(devo_sandbox::PLACEHOLDER_CLEANUP_DELAY).await;
+ devo_sandbox::remove_placeholder_dir(&directory);
+ });
+ }
let mut child = PtyChildGuard::new(child);
drop(pair.slave);
@@ -459,7 +733,8 @@ async fn run_with_pty(
let is_error = exit_code.unwrap_or(1) != 0;
let content = if is_error {
- format!("exit code {}\n{}", exit_code.unwrap_or(-1), text)
+ let code = exit_code.unwrap_or(-1);
+ devo_sandbox::shell_error_message(sandbox_profile.as_deref(), code, &text, "", &text)
} else {
text.clone()
};
@@ -505,6 +780,7 @@ mod tests {
timeout_ms: 5000,
yield_time_ms: 100,
max_output_tokens: 100,
+ sandbox_profile: None,
},
Some(tx),
CancellationToken::new(),
@@ -532,6 +808,7 @@ mod tests {
timeout_ms: 5000,
yield_time_ms: 100,
max_output_tokens: 100,
+ sandbox_profile: None,
},
None,
CancellationToken::new(),
@@ -561,6 +838,7 @@ mod tests {
timeout_ms: 10_000,
yield_time_ms: 100,
max_output_tokens: 100,
+ sandbox_profile: None,
},
None,
cancel_token,
@@ -599,6 +877,7 @@ mod tests {
timeout_ms: 10_000,
yield_time_ms: 100,
max_output_tokens: 100,
+ sandbox_profile: None,
},
None,
task_cancel_token,
@@ -635,6 +914,7 @@ mod tests {
timeout_ms: 5000,
yield_time_ms: 100,
max_output_tokens: 100,
+ sandbox_profile: None,
},
None,
CancellationToken::new(),
@@ -668,6 +948,7 @@ mod tests {
timeout_ms: 5000,
yield_time_ms: 100,
max_output_tokens: 100,
+ sandbox_profile: None,
},
None,
CancellationToken::new(),
diff --git a/crates/core/src/tools/unified_exec/process.rs b/crates/core/src/tools/unified_exec/process.rs
index 049fd38f..300ef9af 100644
--- a/crates/core/src/tools/unified_exec/process.rs
+++ b/crates/core/src/tools/unified_exec/process.rs
@@ -8,7 +8,7 @@ use std::time::Instant;
use devo_util_process::SpawnedProcess;
pub use devo_util_process::TerminalSize;
use devo_util_process::combine_output_receivers;
-use devo_util_process::spawn_pipe_process_no_stdin;
+use devo_util_process::spawn_pipe_process_no_stdin_sandboxed;
use devo_util_process::spawn_pty_process;
use tokio::sync::Mutex as AsyncMutex;
use tokio::sync::broadcast;
@@ -33,7 +33,7 @@ const UNIFIED_EXEC_ENV: [(&str, &str); 10] = [
("PAGER", "cat"),
("GIT_PAGER", "cat"),
("GH_PAGER", "cat"),
- ("CODEX_CI", "1"),
+ ("DEVO_CI", "1"),
];
/// Max time (in seconds) a PTY process can live without any write_stdin interaction.
@@ -159,31 +159,50 @@ impl UnifiedExecProcess {
shell: Option<&str>,
login: bool,
tty: bool,
+ ) -> Result<(Self, broadcast::Receiver>), String> {
+ Self::spawn_with_sandbox(process_id, cmd, cwd, shell, login, tty, None).await
+ }
+
+ pub async fn spawn_with_sandbox(
+ process_id: i32,
+ cmd: &str,
+ cwd: &Path,
+ shell: Option<&str>,
+ login: bool,
+ tty: bool,
+ sandbox_profile: Option,
) -> Result<(Self, broadcast::Receiver>), String> {
let shell_spec = resolve_shell(shell, login);
let command = command_for_shell(cmd, &shell_spec);
let mut args = shell_spec.args.clone();
args.push(command);
- let env = unified_exec_env();
+ let env = unified_exec_env(cwd, sandbox_profile.as_deref());
let spawned = if tty {
- spawn_pty_process(
+ spawn_pty_with_sandbox_wrap(
&shell_spec.program,
&args,
cwd,
&env,
- /*arg0*/ &None,
TerminalSize {
rows: PTY_ROWS,
cols: PTY_COLS,
},
+ sandbox_profile.as_deref(),
)
- .await
- .map_err(|error| format!("failed to spawn PTY command: {error}"))?
+ .await?
} else {
- spawn_pipe_process_no_stdin(&shell_spec.program, &args, cwd, &env, /*arg0*/ &None)
- .await
- .map_err(|error| format!("failed to spawn command: {error}"))?
+ spawn_pipe_process_no_stdin_sandboxed(
+ &shell_spec.program,
+ &args,
+ cwd,
+ &env,
+ /*arg0*/ &None,
+ &[],
+ sandbox_profile,
+ )
+ .await
+ .map_err(|error| format!("failed to spawn command: {error}"))?
};
Ok(Self::from_spawned_process(process_id, tty, spawned))
@@ -195,24 +214,24 @@ impl UnifiedExecProcess {
shell: Option<&str>,
login: bool,
size: Option,
+ sandbox_profile: Option,
) -> Result<(Self, broadcast::Receiver>), String> {
let shell_spec = resolve_shell(shell, login);
let args = interactive_shell_args(&shell_spec.program, login);
- let env = unified_exec_env();
+ let env = unified_exec_env(cwd, sandbox_profile.as_deref());
- let spawned = spawn_pty_process(
+ let spawned = spawn_pty_with_sandbox_wrap(
&shell_spec.program,
&args,
cwd,
&env,
- /*arg0*/ &None,
size.unwrap_or(TerminalSize {
rows: PTY_ROWS,
cols: PTY_COLS,
}),
+ sandbox_profile.as_deref(),
)
- .await
- .map_err(|error| format!("failed to spawn interactive shell: {error}"))?;
+ .await?;
Ok(Self::from_spawned_process(
process_id, /*tty*/ true, spawned,
@@ -326,7 +345,52 @@ impl UnifiedExecProcess {
}
}
-fn unified_exec_env() -> HashMap {
+/// Spawn a PTY process, enforcing `sandbox_profile` by wrapping the command
+/// in the OS sandbox launcher (macOS `sandbox-exec`, Linux `bwrap`). PTY
+/// spawns have no `pre_exec` hook, so the wrapper carries the full profile
+/// policy and the wrapped child must NOT also apply it (no nested sandboxes).
+async fn spawn_pty_with_sandbox_wrap(
+ program: &str,
+ args: &[String],
+ cwd: &Path,
+ env: &HashMap,
+ size: TerminalSize,
+ sandbox_profile: Option<&str>,
+) -> Result {
+ let wrap = devo_sandbox::wrap_command_for_profile(
+ sandbox_profile,
+ cwd,
+ devo_sandbox::WrapMode::PtyOnly,
+ &devo_sandbox::SandboxLogger::new(),
+ )
+ .map_err(|error| format!("failed to set up sandbox: {error}"))?;
+ let (program, args) = match &wrap {
+ devo_sandbox::SandboxWrap::Wrapped(wrapped) => {
+ let mut wrapped_args = wrapped.prefix_args.clone();
+ wrapped_args.push(program.to_string());
+ wrapped_args.extend(args.iter().cloned());
+ (wrapped.program.clone(), wrapped_args)
+ }
+ devo_sandbox::SandboxWrap::None => (program.to_string(), args.to_vec()),
+ };
+ let spawned = spawn_pty_process(&program, &args, cwd, env, /*arg0*/ &None, size)
+ .await
+ .map_err(|error| format!("failed to spawn PTY command: {error}"))?;
+ // bwrap mounts are not up when spawn returns, so the placeholder directory
+ // must outlive the launch; remove it after a delay instead.
+ if let devo_sandbox::SandboxWrap::Wrapped(wrapped) = &wrap
+ && let Some(directory) = &wrapped.placeholder_dir
+ {
+ let directory = directory.clone();
+ tokio::spawn(async move {
+ sleep(devo_sandbox::PLACEHOLDER_CLEANUP_DELAY).await;
+ devo_sandbox::remove_placeholder_dir(&directory);
+ });
+ }
+ Ok(spawned)
+}
+
+fn unified_exec_env(cwd: &Path, sandbox_profile: Option<&str>) -> HashMap {
let mut env = std::env::vars().collect::>();
for (key, value) in UNIFIED_EXEC_ENV {
env.insert(key.to_string(), value.to_string());
@@ -334,6 +398,12 @@ fn unified_exec_env() -> HashMap {
if cfg!(windows) {
env.insert("PYTHONUTF8".to_string(), "1".to_string());
}
+ #[cfg(unix)]
+ for (key, value) in devo_sandbox::proxy_env_for_sandbox_profile(sandbox_profile, cwd) {
+ env.insert(key, value);
+ }
+ #[cfg(not(unix))]
+ let _ = (cwd, sandbox_profile);
env
}
@@ -627,7 +697,7 @@ mod tests {
#[tokio::test]
#[cfg(unix)]
- async fn process_non_tty_applies_codex_unified_exec_env() {
+ async fn process_non_tty_applies_devo_unified_exec_env() {
let (proc, mut rx) = UnifiedExecProcess::spawn(
6,
"printf '%s|%s|%s' \"$NO_COLOR\" \"$TERM\" \"$PAGER\"",
@@ -668,7 +738,7 @@ mod tests {
}
#[test]
- fn resolve_shell_uses_user_shell_default_and_codex_style_args() {
+ fn resolve_shell_uses_user_shell_default_and_login_args() {
assert_eq!(
resolve_shell_with_default(
/*shell_override*/ None, /*login*/ true, "/bin/zsh"
diff --git a/crates/core/tests/pty_sandbox_e2e.rs b/crates/core/tests/pty_sandbox_e2e.rs
new file mode 100644
index 00000000..3312f508
--- /dev/null
+++ b/crates/core/tests/pty_sandbox_e2e.rs
@@ -0,0 +1,103 @@
+//! PTY sandbox e2e: `UnifiedExecProcess::spawn_with_sandbox` with `tty: true`
+//! must enforce the sandbox profile through the OS launcher wrapper (macOS
+//! `sandbox-exec`, Linux `bwrap`) — PTY spawns have no `pre_exec` hook.
+//!
+//! The test skips when no sandbox launcher is available on this machine (the
+//! wrap API then declines to wrap, which is a supported degradation).
+
+#![cfg(unix)]
+
+use std::path::{Path, PathBuf};
+
+use devo_core::tools::unified_exec::process::{UnifiedExecProcess, collect_output};
+
+const MARKER: &str = "pty-e2e-marker-9d4c2b";
+const PROFILE: &str = "ptye2edeny";
+
+struct TempDirGuard(PathBuf);
+
+impl Drop for TempDirGuard {
+ fn drop(&mut self) {
+ let _ = std::fs::remove_dir_all(&self.0);
+ }
+}
+
+fn temp_workspace(tag: &str) -> (PathBuf, TempDirGuard) {
+ let nanos = std::time::SystemTime::now()
+ .duration_since(std::time::UNIX_EPOCH)
+ .expect("system clock after Unix epoch")
+ .as_nanos();
+ let workspace =
+ std::env::temp_dir().join(format!("devo-pty-e2e-{tag}-{}-{nanos}", std::process::id()));
+ std::fs::create_dir_all(workspace.join(".devo")).expect("create .devo config directory");
+ std::fs::write(
+ workspace.join(".devo").join("sandbox.toml"),
+ format!("[profiles.{PROFILE}]\nextends = \"workspace\"\ndeny = [\"secret.txt\"]\n"),
+ )
+ .expect("write sandbox.toml");
+ std::fs::write(workspace.join("secret.txt"), format!("SECRET={MARKER}"))
+ .expect("write denied file");
+ std::fs::write(workspace.join("control.txt"), "hello workspace").expect("write control file");
+ let workspace = std::fs::canonicalize(&workspace).expect("canonicalize temp workspace");
+ let guard = TempDirGuard(workspace.clone());
+ (workspace, guard)
+}
+
+async fn run_pty_command(command: &str, workspace: &Path, process_id: i32) -> String {
+ let (process, mut rx) = UnifiedExecProcess::spawn_with_sandbox(
+ process_id,
+ command,
+ workspace,
+ /*shell*/ Some("bash"),
+ /*login*/ false,
+ /*tty*/ true,
+ Some(PROFILE.to_string()),
+ )
+ .await
+ .expect("PTY spawn should succeed");
+ collect_output(&mut rx, &process, 15_000, 4_000)
+ .await
+ .output
+}
+
+#[tokio::test]
+async fn pty_spawn_enforces_deny_read_and_write() {
+ let (workspace, _guard) = temp_workspace("deny");
+
+ // Skip when the machine has no sandbox launcher (the supported
+ // warn-and-run-unwrapped degradation).
+ match devo_sandbox::wrap_command_for_profile(
+ Some(PROFILE),
+ &workspace,
+ devo_sandbox::WrapMode::PtyOnly,
+ &devo_sandbox::SandboxLogger::new(),
+ ) {
+ Ok(devo_sandbox::SandboxWrap::Wrapped(_)) => {}
+ other => {
+ eprintln!("skipping: no sandbox launcher available ({other:?})");
+ return;
+ }
+ }
+
+ // A denied file must not be readable from inside the PTY.
+ let output = run_pty_command("cat secret.txt", &workspace, 1).await;
+ assert!(
+ !output.contains(MARKER),
+ "PTY child read a denied path:\n{output}"
+ );
+
+ // A denied file must not be writable from inside the PTY.
+ let _ = run_pty_command("echo hijacked >> secret.txt", &workspace, 2).await;
+ assert_eq!(
+ std::fs::read_to_string(workspace.join("secret.txt")).expect("read denied file"),
+ format!("SECRET={MARKER}"),
+ "denied file content must be unchanged"
+ );
+
+ // A non-denied file stays readable (the sandbox did not break the PTY).
+ let output = run_pty_command("cat control.txt", &workspace, 3).await;
+ assert!(
+ output.contains("hello workspace"),
+ "PTY child must still read the control file:\n{output}"
+ );
+}
diff --git a/crates/execpolicy/BUILD.bazel b/crates/execpolicy/BUILD.bazel
new file mode 100644
index 00000000..ec673461
--- /dev/null
+++ b/crates/execpolicy/BUILD.bazel
@@ -0,0 +1,6 @@
+load("//:defs.bzl", "codex_rust_crate")
+
+codex_rust_crate(
+ name = "execpolicy",
+ crate_name = "devo_execpolicy",
+)
diff --git a/crates/execpolicy/Cargo.toml b/crates/execpolicy/Cargo.toml
new file mode 100644
index 00000000..64ba501e
--- /dev/null
+++ b/crates/execpolicy/Cargo.toml
@@ -0,0 +1,33 @@
+[package]
+description = "Devo exec policy: prefix-based Starlark rules for command decisions."
+edition.workspace = true
+license.workspace = true
+name = "devo-execpolicy"
+version.workspace = true
+
+[lib]
+doctest = false
+name = "devo_execpolicy"
+path = "src/lib.rs"
+
+[[bin]]
+name = "devo-execpolicy"
+path = "src/main.rs"
+
+[lints]
+workspace = true
+
+[dependencies]
+anyhow = { workspace = true }
+clap = { workspace = true, features = ["derive"] }
+devo-util-paths = { workspace = true }
+multimap = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
+shlex = { workspace = true }
+starlark = { workspace = true }
+thiserror = { workspace = true }
+
+[dev-dependencies]
+pretty_assertions = { workspace = true }
+tempfile = { workspace = true }
diff --git a/crates/execpolicy/README.md b/crates/execpolicy/README.md
new file mode 100644
index 00000000..ca6e5cc9
--- /dev/null
+++ b/crates/execpolicy/README.md
@@ -0,0 +1,97 @@
+# devo-execpolicy
+
+## Overview
+
+- Policy engine and CLI built around `prefix_rule(pattern=[...], decision?, justification?, match?, not_match?)` plus `host_executable(name=..., paths=[...])`.
+- This release covers the prefix-rule subset of the execpolicy language plus host executable metadata; a richer language will follow.
+- Tokens are matched in order; any `pattern` element may be a list to denote alternatives. `decision` defaults to `allow`; valid values: `allow`, `prompt`, `forbidden`.
+- `justification` is an optional human-readable rationale for why a rule exists. It can be provided for any `decision` and may be surfaced in different contexts (for example, in approval prompts or rejection messages). When `decision = "forbidden"` is used, include a recommended alternative in the `justification`, when appropriate (e.g., ``"Use `jj` instead of `git`."``).
+- `match` / `not_match` supply example invocations that are validated at load time (think of them as unit tests); examples can be token arrays or strings (strings are tokenized with `shlex`).
+- The CLI always prints the JSON serialization of the evaluation result.
+
+## Policy shapes
+
+- Prefix rules use Starlark syntax:
+
+```starlark
+prefix_rule(
+ pattern = ["cmd", ["alt1", "alt2"]], # ordered tokens; list entries denote alternatives
+ decision = "prompt", # allow | prompt | forbidden; defaults to allow
+ justification = "explain why this rule exists",
+ match = [["cmd", "alt1"], "cmd alt2"], # examples that must match this rule
+ not_match = [["cmd", "oops"], "cmd alt3"], # examples that must not match this rule
+)
+```
+
+- Host executable metadata can optionally constrain which absolute paths may
+ resolve through basename rules:
+
+```starlark
+host_executable(
+ name = "git",
+ paths = [
+ "/opt/homebrew/bin/git",
+ "/usr/bin/git",
+ ],
+)
+```
+
+- Matching semantics:
+ - execpolicy always tries exact first-token matches first.
+ - With host-executable resolution disabled, `/usr/bin/git status` only matches a rule whose first token is `/usr/bin/git`.
+ - With host-executable resolution enabled, if no exact rule matches, execpolicy may fall back from `/usr/bin/git` to basename rules for `git`.
+ - If `host_executable(name="git", ...)` exists, basename fallback is only allowed for listed absolute paths.
+ - If no `host_executable()` entry exists for a basename, basename fallback is allowed.
+
+## CLI
+
+- From the Devo CLI, run `devo execpolicy check` with one or more policy files (for example `src/default.rules`) to check a command:
+
+```bash
+devo execpolicy check --rules path/to/policy.rules git status
+```
+
+- To opt into basename fallback for absolute program paths, pass `--resolve-host-executables`:
+
+```bash
+devo execpolicy check \
+ --rules path/to/policy.rules \
+ --resolve-host-executables \
+ /usr/bin/git status
+```
+
+- Pass multiple `--rules` flags to merge rules, evaluated in the order provided, and use `--pretty` for formatted JSON.
+- You can also run the standalone dev binary directly during development:
+
+```bash
+cargo run -p devo-execpolicy -- check --rules path/to/policy.rules git status
+```
+
+- Example outcomes:
+ - Match: `{"matchedRules":[{...}],"decision":"allow"}`
+ - No match: `{"matchedRules":[]}`
+
+## Response shape
+
+```json
+{
+ "matchedRules": [
+ {
+ "prefixRuleMatch": {
+ "matchedPrefix": ["", "..."],
+ "decision": "allow|prompt|forbidden",
+ "resolvedProgram": "/absolute/path/to/program",
+ "justification": "..."
+ }
+ }
+ ],
+ "decision": "allow|prompt|forbidden"
+}
+```
+
+- When no rules match, `matchedRules` is an empty array and `decision` is omitted.
+- `matchedRules` lists every rule whose prefix matched the command; `matchedPrefix` is the exact prefix that matched.
+- `resolvedProgram` is omitted unless an absolute executable path matched via basename fallback.
+- The effective `decision` is the strictest severity across all matches (`forbidden` > `prompt` > `allow`).
+
+Note: `execpolicy` commands are still in preview. The API may have breaking changes in the future.
diff --git a/crates/execpolicy/examples/example.codexpolicy b/crates/execpolicy/examples/example.codexpolicy
new file mode 100644
index 00000000..4040f612
--- /dev/null
+++ b/crates/execpolicy/examples/example.codexpolicy
@@ -0,0 +1,78 @@
+
+# Example policy to illustrate syntax; not comprehensive and not recommended for actual use.
+
+prefix_rule(
+ pattern = ["git", "reset", "--hard"],
+ decision = "forbidden",
+ justification = "destructive operation",
+ match = [
+ ["git", "reset", "--hard"],
+ ],
+ not_match = [
+ ["git", "reset", "--keep"],
+ "git reset --merge",
+ ],
+)
+
+prefix_rule(
+ pattern = ["ls"],
+ match = [
+ ["ls"],
+ ["ls", "-l"],
+ ["ls", "-a", "."],
+ ],
+)
+
+prefix_rule(
+ pattern = ["cat"],
+ match = [
+ ["cat", "file.txt"],
+ ["cat", "-n", "README.md"],
+ ],
+)
+
+prefix_rule(
+ pattern = ["cp"],
+ decision = "prompt",
+ match = [
+ ["cp", "foo", "bar"],
+ "cp -r src dest",
+ ],
+)
+
+prefix_rule(
+ pattern = ["head"],
+ match = [
+ ["head", "README.md"],
+ ["head", "-n", "5", "CHANGELOG.md"],
+ ],
+ not_match = [
+ ["hea", "-n", "1,5p", "CHANGELOG.md"],
+ ],
+)
+
+prefix_rule(
+ pattern = ["printenv"],
+ match = [
+ ["printenv"],
+ ["printenv", "PATH"],
+ ],
+ not_match = [
+ ["print", "-0"],
+ ],
+)
+
+prefix_rule(
+ pattern = ["pwd"],
+ match = [
+ ["pwd"],
+ ],
+)
+
+prefix_rule(
+ pattern = ["which"],
+ match = [
+ ["which", "python3"],
+ ["which", "-a", "python3"],
+ ],
+)
diff --git a/crates/execpolicy/src/amend.rs b/crates/execpolicy/src/amend.rs
new file mode 100644
index 00000000..3232db05
--- /dev/null
+++ b/crates/execpolicy/src/amend.rs
@@ -0,0 +1,339 @@
+use std::fs::OpenOptions;
+use std::io::Read;
+use std::io::Seek;
+use std::io::SeekFrom;
+use std::io::Write;
+use std::path::Path;
+use std::path::PathBuf;
+
+use crate::decision::Decision;
+use crate::rule::NetworkRuleProtocol;
+use crate::rule::normalize_network_rule_host;
+use thiserror::Error;
+
+#[derive(Debug, Error)]
+pub enum AmendError {
+ #[error("prefix rule requires at least one token")]
+ EmptyPrefix,
+ #[error("invalid network rule: {0}")]
+ InvalidNetworkRule(String),
+ #[error("policy path has no parent: {path}")]
+ MissingParent { path: PathBuf },
+ #[error("failed to create policy directory {dir}: {source}")]
+ CreatePolicyDir {
+ dir: PathBuf,
+ source: std::io::Error,
+ },
+ #[error("failed to format prefix tokens: {source}")]
+ SerializePrefix { source: serde_json::Error },
+ #[error("failed to serialize network rule field: {source}")]
+ SerializeNetworkRule { source: serde_json::Error },
+ #[error("failed to open policy file {path}: {source}")]
+ OpenPolicyFile {
+ path: PathBuf,
+ source: std::io::Error,
+ },
+ #[error("failed to write to policy file {path}: {source}")]
+ WritePolicyFile {
+ path: PathBuf,
+ source: std::io::Error,
+ },
+ #[error("failed to lock policy file {path}: {source}")]
+ LockPolicyFile {
+ path: PathBuf,
+ source: std::io::Error,
+ },
+ #[error("failed to seek policy file {path}: {source}")]
+ SeekPolicyFile {
+ path: PathBuf,
+ source: std::io::Error,
+ },
+ #[error("failed to read policy file {path}: {source}")]
+ ReadPolicyFile {
+ path: PathBuf,
+ source: std::io::Error,
+ },
+ #[error("failed to read metadata for policy file {path}: {source}")]
+ PolicyMetadata {
+ path: PathBuf,
+ source: std::io::Error,
+ },
+}
+
+/// Note this thread uses advisory file locking and performs blocking I/O, so it
+/// should be used with `tokio::task::spawn_blocking` when called from an async
+/// context.
+pub fn blocking_append_allow_prefix_rule(
+ policy_path: &Path,
+ prefix: &[String],
+) -> Result<(), AmendError> {
+ if prefix.is_empty() {
+ return Err(AmendError::EmptyPrefix);
+ }
+
+ let tokens = prefix
+ .iter()
+ .map(serde_json::to_string)
+ .collect::, _>>()
+ .map_err(|source| AmendError::SerializePrefix { source })?;
+ let pattern = format!("[{}]", tokens.join(", "));
+ let rule = format!(r#"prefix_rule(pattern={pattern}, decision="allow")"#);
+ append_rule_line(policy_path, &rule)
+}
+
+/// Note this function uses advisory file locking and performs blocking I/O, so
+/// it should be used with `tokio::task::spawn_blocking` when called from an
+/// async context.
+pub fn blocking_append_network_rule(
+ policy_path: &Path,
+ host: &str,
+ protocol: NetworkRuleProtocol,
+ decision: Decision,
+ justification: Option<&str>,
+) -> Result<(), AmendError> {
+ let host = normalize_network_rule_host(host)
+ .map_err(|err| AmendError::InvalidNetworkRule(err.to_string()))?;
+ if let Some(raw) = justification
+ && raw.trim().is_empty()
+ {
+ return Err(AmendError::InvalidNetworkRule(
+ "justification cannot be empty".to_string(),
+ ));
+ }
+
+ let host = serde_json::to_string(&host)
+ .map_err(|source| AmendError::SerializeNetworkRule { source })?;
+ let protocol = serde_json::to_string(protocol.as_policy_string())
+ .map_err(|source| AmendError::SerializeNetworkRule { source })?;
+ let decision = serde_json::to_string(match decision {
+ Decision::Allow => "allow",
+ Decision::Prompt => "prompt",
+ Decision::Forbidden => "deny",
+ })
+ .map_err(|source| AmendError::SerializeNetworkRule { source })?;
+
+ let mut args = vec![
+ format!("host={host}"),
+ format!("protocol={protocol}"),
+ format!("decision={decision}"),
+ ];
+ if let Some(justification) = justification {
+ let justification = serde_json::to_string(justification)
+ .map_err(|source| AmendError::SerializeNetworkRule { source })?;
+ args.push(format!("justification={justification}"));
+ }
+ let rule = format!("network_rule({})", args.join(", "));
+ append_rule_line(policy_path, &rule)
+}
+
+fn append_rule_line(policy_path: &Path, rule: &str) -> Result<(), AmendError> {
+ let dir = policy_path
+ .parent()
+ .ok_or_else(|| AmendError::MissingParent {
+ path: policy_path.to_path_buf(),
+ })?;
+ match std::fs::create_dir(dir) {
+ Ok(()) => {}
+ Err(ref source) if source.kind() == std::io::ErrorKind::AlreadyExists => {}
+ Err(source) => {
+ return Err(AmendError::CreatePolicyDir {
+ dir: dir.to_path_buf(),
+ source,
+ });
+ }
+ }
+
+ append_locked_line(policy_path, rule)
+}
+
+fn append_locked_line(policy_path: &Path, line: &str) -> Result<(), AmendError> {
+ let mut file = OpenOptions::new()
+ .create(true)
+ .read(true)
+ .append(true)
+ .open(policy_path)
+ .map_err(|source| AmendError::OpenPolicyFile {
+ path: policy_path.to_path_buf(),
+ source,
+ })?;
+ file.lock().map_err(|source| AmendError::LockPolicyFile {
+ path: policy_path.to_path_buf(),
+ source,
+ })?;
+
+ file.seek(SeekFrom::Start(0))
+ .map_err(|source| AmendError::SeekPolicyFile {
+ path: policy_path.to_path_buf(),
+ source,
+ })?;
+ let mut contents = String::new();
+ file.read_to_string(&mut contents)
+ .map_err(|source| AmendError::ReadPolicyFile {
+ path: policy_path.to_path_buf(),
+ source,
+ })?;
+
+ if contents.lines().any(|existing| existing == line) {
+ return Ok(());
+ }
+
+ if !contents.is_empty() && !contents.ends_with('\n') {
+ file.write_all(b"\n")
+ .map_err(|source| AmendError::WritePolicyFile {
+ path: policy_path.to_path_buf(),
+ source,
+ })?;
+ }
+
+ file.write_all(format!("{line}\n").as_bytes())
+ .map_err(|source| AmendError::WritePolicyFile {
+ path: policy_path.to_path_buf(),
+ source,
+ })?;
+
+ Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+ use pretty_assertions::assert_eq;
+ use tempfile::tempdir;
+
+ #[test]
+ fn appends_rule_and_creates_directories() {
+ let tmp = tempdir().expect("create temp dir");
+ let policy_path = tmp.path().join("rules").join("default.rules");
+
+ blocking_append_allow_prefix_rule(
+ &policy_path,
+ &[String::from("echo"), String::from("Hello, world!")],
+ )
+ .expect("append rule");
+
+ let contents = std::fs::read_to_string(&policy_path).expect("default.rules should exist");
+ assert_eq!(
+ contents,
+ r#"prefix_rule(pattern=["echo", "Hello, world!"], decision="allow")
+"#
+ );
+ }
+
+ #[test]
+ fn appends_rule_without_duplicate_newline() {
+ let tmp = tempdir().expect("create temp dir");
+ let policy_path = tmp.path().join("rules").join("default.rules");
+ std::fs::create_dir_all(policy_path.parent().unwrap()).expect("create policy dir");
+ std::fs::write(
+ &policy_path,
+ r#"prefix_rule(pattern=["ls"], decision="allow")
+"#,
+ )
+ .expect("write seed rule");
+
+ blocking_append_allow_prefix_rule(
+ &policy_path,
+ &[String::from("echo"), String::from("Hello, world!")],
+ )
+ .expect("append rule");
+
+ let contents = std::fs::read_to_string(&policy_path).expect("read policy");
+ assert_eq!(
+ contents,
+ r#"prefix_rule(pattern=["ls"], decision="allow")
+prefix_rule(pattern=["echo", "Hello, world!"], decision="allow")
+"#
+ );
+ }
+
+ #[test]
+ fn inserts_newline_when_missing_before_append() {
+ let tmp = tempdir().expect("create temp dir");
+ let policy_path = tmp.path().join("rules").join("default.rules");
+ std::fs::create_dir_all(policy_path.parent().unwrap()).expect("create policy dir");
+ std::fs::write(
+ &policy_path,
+ r#"prefix_rule(pattern=["ls"], decision="allow")"#,
+ )
+ .expect("write seed rule without newline");
+
+ blocking_append_allow_prefix_rule(
+ &policy_path,
+ &[String::from("echo"), String::from("Hello, world!")],
+ )
+ .expect("append rule");
+
+ let contents = std::fs::read_to_string(&policy_path).expect("read policy");
+ assert_eq!(
+ contents,
+ r#"prefix_rule(pattern=["ls"], decision="allow")
+prefix_rule(pattern=["echo", "Hello, world!"], decision="allow")
+"#
+ );
+ }
+
+ #[test]
+ fn appends_network_rule() {
+ let tmp = tempdir().expect("create temp dir");
+ let policy_path = tmp.path().join("rules").join("default.rules");
+
+ blocking_append_network_rule(
+ &policy_path,
+ "Api.GitHub.com",
+ NetworkRuleProtocol::Https,
+ Decision::Allow,
+ Some("Allow https_connect access to api.github.com"),
+ )
+ .expect("append network rule");
+
+ let contents = std::fs::read_to_string(&policy_path).expect("read policy");
+ assert_eq!(
+ contents,
+ r#"network_rule(host="api.github.com", protocol="https", decision="allow", justification="Allow https_connect access to api.github.com")
+"#
+ );
+ }
+
+ #[test]
+ fn appends_prefix_and_network_rules() {
+ let tmp = tempdir().expect("create temp dir");
+ let policy_path = tmp.path().join("rules").join("default.rules");
+
+ blocking_append_allow_prefix_rule(&policy_path, &[String::from("curl")])
+ .expect("append prefix rule");
+ blocking_append_network_rule(
+ &policy_path,
+ "api.github.com",
+ NetworkRuleProtocol::Https,
+ Decision::Allow,
+ Some("Allow https_connect access to api.github.com"),
+ )
+ .expect("append network rule");
+
+ let contents = std::fs::read_to_string(&policy_path).expect("read policy");
+ assert_eq!(
+ contents,
+ r#"prefix_rule(pattern=["curl"], decision="allow")
+network_rule(host="api.github.com", protocol="https", decision="allow", justification="Allow https_connect access to api.github.com")
+"#
+ );
+ }
+
+ #[test]
+ fn rejects_wildcard_network_rule_host() {
+ let tmp = tempdir().expect("create temp dir");
+ let policy_path = tmp.path().join("rules").join("default.rules");
+ let err = blocking_append_network_rule(
+ &policy_path,
+ "*.example.com",
+ NetworkRuleProtocol::Https,
+ Decision::Allow,
+ /*justification*/ None,
+ )
+ .expect_err("wildcards should be rejected");
+ assert_eq!(
+ err.to_string(),
+ "invalid network rule: invalid rule: network_rule host must be a specific host; wildcards are not allowed"
+ );
+ }
+}
diff --git a/crates/execpolicy/src/decision.rs b/crates/execpolicy/src/decision.rs
new file mode 100644
index 00000000..15dc1f71
--- /dev/null
+++ b/crates/execpolicy/src/decision.rs
@@ -0,0 +1,27 @@
+use serde::Deserialize;
+use serde::Serialize;
+
+use crate::error::Error;
+use crate::error::Result;
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Ord, PartialOrd, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum Decision {
+ /// Command may run without further approval.
+ Allow,
+ /// Request explicit user approval; rejected outright when running with `approval_policy="never"`.
+ Prompt,
+ /// Command is blocked without further consideration.
+ Forbidden,
+}
+
+impl Decision {
+ pub fn parse(raw: &str) -> Result {
+ match raw {
+ "allow" => Ok(Self::Allow),
+ "prompt" => Ok(Self::Prompt),
+ "forbidden" => Ok(Self::Forbidden),
+ other => Err(Error::InvalidDecision(other.to_string())),
+ }
+ }
+}
diff --git a/crates/execpolicy/src/error.rs b/crates/execpolicy/src/error.rs
new file mode 100644
index 00000000..0f2be753
--- /dev/null
+++ b/crates/execpolicy/src/error.rs
@@ -0,0 +1,101 @@
+use starlark::Error as StarlarkError;
+use thiserror::Error;
+
+pub type Result = std::result::Result;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct TextPosition {
+ pub line: usize,
+ pub column: usize,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct TextRange {
+ pub start: TextPosition,
+ pub end: TextPosition,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ErrorLocation {
+ pub path: String,
+ pub range: TextRange,
+}
+
+#[derive(Debug, Error)]
+pub enum Error {
+ #[error("invalid decision: {0}")]
+ InvalidDecision(String),
+ #[error("invalid pattern element: {0}")]
+ InvalidPattern(String),
+ #[error("invalid example: {0}")]
+ InvalidExample(String),
+ #[error("invalid rule: {0}")]
+ InvalidRule(String),
+ #[error(
+ "expected every example to match at least one rule. rules: {rules:?}; unmatched examples: \
+ {examples:?}"
+ )]
+ ExampleDidNotMatch {
+ rules: Vec,
+ examples: Vec,
+ location: Option,
+ },
+ #[error("expected example to not match rule `{rule}`: {example}")]
+ ExampleDidMatch {
+ rule: String,
+ example: String,
+ location: Option,
+ },
+ #[error("starlark error: {0}")]
+ Starlark(StarlarkError),
+}
+
+impl Error {
+ pub fn with_location(self, location: ErrorLocation) -> Self {
+ match self {
+ Error::ExampleDidNotMatch {
+ rules,
+ examples,
+ location: None,
+ } => Error::ExampleDidNotMatch {
+ rules,
+ examples,
+ location: Some(location),
+ },
+ Error::ExampleDidMatch {
+ rule,
+ example,
+ location: None,
+ } => Error::ExampleDidMatch {
+ rule,
+ example,
+ location: Some(location),
+ },
+ other => other,
+ }
+ }
+
+ pub fn location(&self) -> Option {
+ match self {
+ Error::ExampleDidNotMatch { location, .. }
+ | Error::ExampleDidMatch { location, .. } => location.clone(),
+ Error::Starlark(err) => err.span().map(|span| {
+ let resolved = span.resolve_span();
+ ErrorLocation {
+ path: span.filename().to_string(),
+ range: TextRange {
+ start: TextPosition {
+ line: resolved.begin.line + 1,
+ column: resolved.begin.column + 1,
+ },
+ end: TextPosition {
+ line: resolved.end.line + 1,
+ column: resolved.end.column + 1,
+ },
+ },
+ }
+ }),
+ _ => None,
+ }
+ }
+}
diff --git a/crates/execpolicy/src/execpolicycheck.rs b/crates/execpolicy/src/execpolicycheck.rs
new file mode 100644
index 00000000..b72995d0
--- /dev/null
+++ b/crates/execpolicy/src/execpolicycheck.rs
@@ -0,0 +1,95 @@
+use std::fs;
+use std::path::PathBuf;
+
+use anyhow::Context;
+use anyhow::Result;
+use clap::Parser;
+use serde::Serialize;
+
+use crate::Decision;
+use crate::MatchOptions;
+use crate::Policy;
+use crate::PolicyParser;
+use crate::RuleMatch;
+
+/// Arguments for evaluating a command against one or more execpolicy files.
+#[derive(Debug, Parser, Clone)]
+pub struct ExecPolicyCheckCommand {
+ /// Paths to execpolicy rule files to evaluate (repeatable).
+ #[arg(short = 'r', long = "rules", value_name = "PATH", required = true)]
+ pub rules: Vec,
+
+ /// Pretty-print the JSON output.
+ #[arg(long)]
+ pub pretty: bool,
+
+ /// Resolve absolute program paths against basename rules, gated by any
+ /// `host_executable()` definitions in the loaded policy files.
+ #[arg(long)]
+ pub resolve_host_executables: bool,
+
+ /// Command tokens to check against the policy.
+ #[arg(
+ value_name = "COMMAND",
+ required = true,
+ trailing_var_arg = true,
+ allow_hyphen_values = true
+ )]
+ pub command: Vec,
+}
+
+impl ExecPolicyCheckCommand {
+ /// Load the policies for this command, evaluate the command, and render JSON output.
+ pub fn run(&self) -> Result<()> {
+ let policy = load_policies(&self.rules)?;
+ let matched_rules = policy.matches_for_command_with_options(
+ &self.command,
+ /*heuristics_fallback*/ None,
+ &MatchOptions {
+ resolve_host_executables: self.resolve_host_executables,
+ },
+ );
+
+ let json = format_matches_json(&matched_rules, self.pretty)?;
+ println!("{json}");
+
+ Ok(())
+ }
+}
+
+pub fn format_matches_json(matched_rules: &[RuleMatch], pretty: bool) -> Result {
+ let output = ExecPolicyCheckOutput {
+ matched_rules,
+ decision: matched_rules.iter().map(RuleMatch::decision).max(),
+ };
+
+ if pretty {
+ serde_json::to_string_pretty(&output).map_err(Into::into)
+ } else {
+ serde_json::to_string(&output).map_err(Into::into)
+ }
+}
+
+pub fn load_policies(policy_paths: &[PathBuf]) -> Result {
+ let mut parser = PolicyParser::new();
+
+ for policy_path in policy_paths {
+ let policy_file_contents = fs::read_to_string(policy_path)
+ .with_context(|| format!("failed to read policy at {}", policy_path.display()))?;
+ let policy_identifier = policy_path.to_string_lossy().to_string();
+ parser
+ .parse(&policy_identifier, &policy_file_contents)
+ .with_context(|| format!("failed to parse policy at {}", policy_path.display()))?;
+ }
+
+ Ok(parser.build())
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct ExecPolicyCheckOutput<'a> {
+ #[serde(rename = "matchedRules")]
+ matched_rules: &'a [RuleMatch],
+ #[serde(skip_serializing_if = "Option::is_none")]
+ decision: Option,
+}
diff --git a/crates/execpolicy/src/executable_name.rs b/crates/execpolicy/src/executable_name.rs
new file mode 100644
index 00000000..bb3e8a53
--- /dev/null
+++ b/crates/execpolicy/src/executable_name.rs
@@ -0,0 +1,29 @@
+use std::path::Path;
+
+#[cfg(windows)]
+const WINDOWS_EXECUTABLE_SUFFIXES: [&str; 4] = [".exe", ".cmd", ".bat", ".com"];
+
+pub(crate) fn executable_lookup_key(raw: &str) -> String {
+ #[cfg(windows)]
+ {
+ let raw = raw.to_ascii_lowercase();
+ for suffix in WINDOWS_EXECUTABLE_SUFFIXES {
+ if raw.ends_with(suffix) {
+ let stripped_len = raw.len() - suffix.len();
+ return raw[..stripped_len].to_string();
+ }
+ }
+ raw
+ }
+
+ #[cfg(not(windows))]
+ {
+ raw.to_string()
+ }
+}
+
+pub(crate) fn executable_path_lookup_key(path: &Path) -> Option {
+ path.file_name()
+ .and_then(|name| name.to_str())
+ .map(executable_lookup_key)
+}
diff --git a/crates/execpolicy/src/lib.rs b/crates/execpolicy/src/lib.rs
new file mode 100644
index 00000000..45d36424
--- /dev/null
+++ b/crates/execpolicy/src/lib.rs
@@ -0,0 +1,30 @@
+pub(crate) mod amend;
+pub(crate) mod decision;
+pub(crate) mod error;
+pub(crate) mod execpolicycheck;
+mod executable_name;
+pub(crate) mod parser;
+pub(crate) mod policy;
+pub mod rule;
+
+pub use amend::AmendError;
+pub use amend::blocking_append_allow_prefix_rule;
+pub use amend::blocking_append_network_rule;
+pub use decision::Decision;
+pub use error::Error;
+pub use error::ErrorLocation;
+pub use error::Result;
+pub use error::TextPosition;
+pub use error::TextRange;
+pub use execpolicycheck::ExecPolicyCheckCommand;
+pub use parser::PolicyParser;
+pub use policy::Evaluation;
+pub use policy::MatchOptions;
+pub use policy::Policy;
+pub use rule::NetworkRuleProtocol;
+pub use rule::PatternToken;
+pub use rule::PrefixPattern;
+pub use rule::PrefixRule;
+pub use rule::Rule;
+pub use rule::RuleMatch;
+pub use rule::RuleRef;
diff --git a/crates/execpolicy/src/main.rs b/crates/execpolicy/src/main.rs
new file mode 100644
index 00000000..30f6b20e
--- /dev/null
+++ b/crates/execpolicy/src/main.rs
@@ -0,0 +1,18 @@
+use anyhow::Result;
+use clap::Parser;
+use devo_execpolicy::ExecPolicyCheckCommand;
+
+/// CLI for evaluating exec policies
+#[derive(Parser)]
+#[command(name = "devo-execpolicy")]
+enum Cli {
+ /// Evaluate a command against a policy.
+ Check(ExecPolicyCheckCommand),
+}
+
+fn main() -> Result<()> {
+ let cli = Cli::parse();
+ match cli {
+ Cli::Check(cmd) => cmd.run(),
+ }
+}
diff --git a/crates/execpolicy/src/parser.rs b/crates/execpolicy/src/parser.rs
new file mode 100644
index 00000000..c788d86f
--- /dev/null
+++ b/crates/execpolicy/src/parser.rs
@@ -0,0 +1,473 @@
+use devo_util_paths::absolute_path::AbsolutePathBuf;
+use multimap::MultiMap;
+use starlark::any::ProvidesStaticType;
+use starlark::codemap::FileSpan;
+use starlark::environment::GlobalsBuilder;
+use starlark::environment::Module;
+use starlark::eval::Evaluator;
+use starlark::starlark_module;
+use starlark::syntax::AstModule;
+use starlark::syntax::Dialect;
+use starlark::values::Value;
+use starlark::values::list::ListRef;
+use starlark::values::list::UnpackList;
+use starlark::values::none::NoneType;
+use std::cell::RefCell;
+use std::cell::RefMut;
+use std::collections::HashMap;
+use std::path::Path;
+use std::sync::Arc;
+
+use crate::decision::Decision;
+use crate::error::Error;
+use crate::error::ErrorLocation;
+use crate::error::Result;
+use crate::error::TextPosition;
+use crate::error::TextRange;
+use crate::executable_name::executable_lookup_key;
+use crate::executable_name::executable_path_lookup_key;
+use crate::rule::NetworkRule;
+use crate::rule::NetworkRuleProtocol;
+use crate::rule::PatternToken;
+use crate::rule::PrefixPattern;
+use crate::rule::PrefixRule;
+use crate::rule::RuleRef;
+use crate::rule::validate_match_examples;
+use crate::rule::validate_not_match_examples;
+
+pub struct PolicyParser {
+ builder: RefCell,
+}
+
+impl Default for PolicyParser {
+ fn default() -> Self {
+ Self::new()
+ }
+}
+
+impl PolicyParser {
+ pub fn new() -> Self {
+ Self {
+ builder: RefCell::new(PolicyBuilder::new()),
+ }
+ }
+
+ /// Parses a policy, tagging parser errors with `policy_identifier` so failures include the
+ /// identifier alongside line numbers.
+ pub fn parse(&mut self, policy_identifier: &str, policy_file_contents: &str) -> Result<()> {
+ let pending_validation_count = self.builder.borrow().pending_example_validations.len();
+ let mut dialect = Dialect::Extended.clone();
+ dialect.enable_f_strings = true;
+ let ast = AstModule::parse(
+ policy_identifier,
+ policy_file_contents.to_string(),
+ &dialect,
+ )
+ .map_err(Error::Starlark)?;
+ let globals = GlobalsBuilder::standard().with(policy_builtins).build();
+ Module::with_temp_heap(|module| {
+ let mut eval = Evaluator::new(&module);
+ eval.extra = Some(&self.builder);
+ eval.eval_module(ast, &globals)
+ .map(|_| ())
+ .map_err(Error::Starlark)
+ })?;
+ self.builder
+ .borrow()
+ .validate_pending_examples_from(pending_validation_count)?;
+ Ok(())
+ }
+
+ pub fn build(self) -> crate::policy::Policy {
+ self.builder.into_inner().build()
+ }
+}
+
+#[derive(Debug, ProvidesStaticType)]
+struct PolicyBuilder {
+ rules_by_program: MultiMap 
- 
+ 
Devo の組み込みモデルカタログには、Qwen、Kimi、MiniMax、GLM、DeepSeek の検証済みモデル定義が含まれています。
diff --git a/README.md b/README.md
index ac7f00c6..99417e77 100644
--- a/README.md
+++ b/README.md
@@ -89,7 +89,7 @@ runtime behavior, and workspace execution under your control.