AthenaandClaude Sonnet 5
1183ab5282
Adds synapse/slash_commands.py: a chat message that's nothing but /tool_name(arg=val, arg=val) dispatches straight through tools.dispatch(), skipping model selection, RAG/playbook context assembly, and the ask-policy approval round-trip entirely. A human typing this IS the approval - there's no one else to ask - so it's a deliberate, reviewed bypass of the approval step specifically, not of anything a tool validates internally (path boundaries, size caps, Curry's own sandbox checks all still run). Argument values parse via ast.literal_eval only: strings/numbers/bools/None/literal containers, no names, no calls, no attribute access - a malformed or hostile-looking argument fails to parse rather than executing anything. Wired into chat_stream_endpoint (main.py) as an early short-circuit, before any of the RAG/model-selection work that a slash-command doesn't need. Web needed no changes (it already forwards raw text unchanged); the TUI previously swallowed every leading "/" locally and never reached the backend with it, so tui_app.py's _handle_slash now falls through to _start_chat for anything shaped like a tool call while still handling its own local meta-commands (/help, /model, /new, ...) exactly as before. Also finally wires Curry in as ten real tools (curry_declare_constant, curry_get_constant/_latest, curry_list_constants, curry_retire_constant, curry_declare_function, curry_get_function, curry_list_functions, curry_call_function, curry_retire_function) - deferred from the vendoring pass. The five write/execute ones are ACTION tools in the same always-ask-regardless-of-global-policy floor as edit_source (ALWAYS_ASK_ACTION_TOOLS, generalized in tools.py from the old self_edit-only ALWAYS_ASK_TOOLS so future tool families share one place to register into). curry_call_function is gated as an action for the same reason run_snippet is: it executes code, even sandboxed. Fixed a real bug surfaced while wiring this up: curry_db is a long-lived singleton holding one sqlite3 connection (unlike NexusOS's own memory store, which opens/closes a fresh connection per call specifically to dodge this), and sqlite3 forbids using a connection from a different thread than created it. That's a non-issue in production (uvicorn's single event-loop thread), but Starlette's TestClient runs the ASGI app through an anyio portal thread, so it broke immediately under test. Fixed at the source (curry_core.py, Curry.__init__) with check_same_thread=False, documented as a second deliberate vendoring deviation alongside the PR #4 sandbox fix - there was never real concurrent access here, just an overly strict same-thread assertion tripping on a thread-identity change with only one logical caller. Verified: 244 backend tests pass (18 new for the parser + endpoint wiring + curry tool registration, 4 new for the TUI passthrough); the 12 pre-existing C/C++/Rust toolchain failures are unrelated and unchanged. Confirmed by hand over the real HTTP endpoint: successful dispatch, zero tool_request events (approval bypass working as designed), a format()-dunder exploit attempt still rejected by the vendored sandbox fix even through the new tool registration, malformed arguments rejected before ever reaching dispatch, and an unknown tool name rejected cleanly. Wheel rebuilt and content-checked (bin/check.sh's gate now also asserts slash_commands.py ships). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
82 lines
3.1 KiB
Bash
82 lines
3.1 KiB
Bash
#!/usr/bin/env bash
|
|
# One command that answers "is this shippable" - Python tests + frontend lint.
|
|
#
|
|
# ponytail: this IS the CI. The remote is self-hosted Gitea with no act_runner,
|
|
# so a .github/workflows file would never execute. Run this before tagging a
|
|
# release; wire it to a runner the day one exists.
|
|
set -uo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
|
|
fail=0
|
|
|
|
if [ ! -x Promethean/bin/python ]; then
|
|
echo "!! no Promethean venv - run ./install.sh first" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "== pytest =="
|
|
# Explicit dirs: a bare `pytest` would walk Promethean/ and node_modules too.
|
|
Promethean/bin/python -m pytest -q tests management || fail=1
|
|
|
|
echo "== eslint =="
|
|
if [ -d interface/web/node_modules ]; then
|
|
(cd interface/web && npm run lint) || fail=1
|
|
else
|
|
echo "-- skipped: interface/web/node_modules missing (npm install)"
|
|
fi
|
|
|
|
echo "== powershell parse =="
|
|
# The Windows installer has died at parse twice. Cheap to catch here if pwsh
|
|
# happens to be installed on the Linux box; the ASCII guard in tests/ is the
|
|
# portable half of the same check.
|
|
if command -v pwsh >/dev/null; then
|
|
for f in install-windows.ps1 launch_nexus.ps1; do
|
|
pwsh -NoProfile -Command "\$e=\$null
|
|
[System.Management.Automation.Language.Parser]::ParseFile('$f',[ref]\$null,[ref]\$e) | Out-Null
|
|
if (\$e) { \$e | ForEach-Object { Write-Host '$f:' \$_.Message }; exit 1 }" || fail=1
|
|
done
|
|
else
|
|
echo "-- skipped: pwsh not installed"
|
|
fi
|
|
|
|
echo "== shell parse =="
|
|
for f in scripts/install-termux.sh launch_nexus.sh management/nexus-cli.sh; do
|
|
[ -f "$f" ] && { bash -n "$f" || fail=1; }
|
|
done
|
|
|
|
echo "== packaging =="
|
|
# The wheel is the other shippable artifact, so it belongs in the same gate:
|
|
# a broken pyproject or a missing web build only shows up at build time.
|
|
if Promethean/bin/python -c "import build, twine" 2>/dev/null; then
|
|
rm -rf .build-check
|
|
if Promethean/bin/python -m build --outdir .build-check >/dev/null 2>&1; then
|
|
Promethean/bin/python -m twine check .build-check/* || fail=1
|
|
# The compiled UI has to actually be inside the wheel - a wheel that
|
|
# builds but ships no dist/ serves a blank page.
|
|
Promethean/bin/python - <<'PY' || fail=1
|
|
import glob, sys, zipfile
|
|
wheels = glob.glob(".build-check/*.whl")
|
|
if not wheels:
|
|
sys.exit("no wheel produced")
|
|
names = zipfile.ZipFile(wheels[0]).namelist()
|
|
if not any(n.startswith("synapse/_resources/web/") for n in names):
|
|
sys.exit("wheel is missing the compiled web UI (cd interface/web && npm run build)")
|
|
if not any(n.startswith("synapse/_resources/playbooks/") for n in names):
|
|
sys.exit("wheel is missing the seed playbooks")
|
|
if "synapse/curry_core.py" not in names or "synapse/curry_store.py" not in names:
|
|
sys.exit("wheel is missing vendored Curry (synapse/curry_core.py / curry_store.py)")
|
|
if "synapse/slash_commands.py" not in names:
|
|
sys.exit("wheel is missing synapse/slash_commands.py")
|
|
print(f"wheel OK: {len(names)} files")
|
|
PY
|
|
else
|
|
echo "!! wheel build failed"; fail=1
|
|
fi
|
|
rm -rf .build-check
|
|
else
|
|
echo "-- skipped: build/twine missing (pip install -e '.[dev]')"
|
|
fi
|
|
|
|
[ "$fail" -eq 0 ] && echo "OK" || echo "FAILED"
|
|
exit "$fail"
|
GitNexus · part of the Nexus stack