Explore Code Skill Security Audit

1291            )1292        else:1293            run_data = maybe_run_command(1294                repo_path,1295                chosen["documented_command"],1296                args.timeout,1297                args.user_language,1298                args.shell_mode,1299                runtime_root,1300                model_adapter,1301                args.monitor_gpu,1302            )1303

486487    try:488        argv = build_command(command, shell_mode)489        environment = dict(os.environ if child_env is None else child_env)490        spec["requested_argv"] = list(argv)491        atomic_write_json(run_dir / "spec.json", spec)492        if shell_mode == "direct":493            argv = resolve_direct_argv(argv, repo, environment)494        spec["argv"] = list(argv)495        atomic_write_json(run_dir / "spec.json", spec)496        creationflags = subprocess.CREATE_NEW_PROCESS_GROUP if os.name == "nt" else 0497        process = subprocess.Popen(498            argv,499            env=environment,500            cwd=repo,501            stdout=subprocess.PIPE,

1516This is local execution with credential environment filtering, not an OS sandbox.17Approved programs can access the host and network; use only trusted repositories18until an isolated executor is configured. Commands that change scientific19conditions must be explicitly reviewed. P1 targets small evaluations, not full20training or autonomous source repair.21

1106    parser.add_argument("--user-language", default="en", help="Language tag for human-readable reports.")1107    parser.add_argument("--run-selected", action="store_true", help="Execute the selected documented command.")1108    parser.add_argument("--include-analysis-pass", action="store_true", help="Run analyze-project and record its outputs in the stage ledger.")

1271        )1272    elif args.run_selected:1273        if chosen["selected_goal"] == "training":1274            run_data = maybe_run_training(1275                repo_path=repo_path,1276                command=chosen["documented_command"],1277                train_script=train_execute_script,1278                lane=args.lane,

494                        value = {"error": str(exc)}495                    event("tool_result", tool=name, result=value)496                    state["tool_results"].append({"type": "tool_result", "tool_use_id": call["id"],497                        "content": json.dumps(value, ensure_ascii=False), "is_error": "error" in value})498                    state["pending"].pop(0)499                    tools_this_turn += 1500                    save()501                    if pause_after_tools and tools_this_turn >= pause_after_tools and state["status"] == "running":502                        state["status"] = "paused"503                        event("paused", reason="Explicit test/session checkpoint")504                    continue505                if state["tool_results"]:506                    state["messages"].append({"role": "user", "content": state.pop("tool_results")})507                    state["tool_results"] = []

513                    break514                state["model_calls"] += 1515                state["model_pending"] = True516                state["usage_complete"] = False517                save()518                event("model_request", call=state["model_calls"], reserved_tokens=reserve)519                response = provider.complete(state["messages"], SYSTEM, TOOLS, budget["max_output_tokens"], min(60, remaining))520                if not isinstance(response, dict):

109110`endpoint` optionally names the final HTTPS endpoint. Without it, the client111uses `ANTHROPIC_BASE_URL` or the official endpoint. For an already configured112Bearer gateway, set `metadata.auth_scheme` to `bearer` and name its credential113environment variable. Redirects are refused so credentials are not forwarded.114

254) -> None:255    total_chars = 0256    with log_path.open("w", encoding="utf-8", newline="") as log:257        while True:258            chunk = stream.read(4096)259            if not chunk:260                break261            log.write(chunk)262            log.flush()263            capture.append(chunk)264            total_chars += len(chunk)265            journal.event("stream_chunk", stream=stream_name, characters=len(chunk))266    journal.event("stream_closed", stream=stream_name, characters=total_chars)267

400401        def event(kind, **data):402            with (output / "trajectory.jsonl").open("a", encoding="utf-8") as handle:403                handle.write(json.dumps({"time": utc_now(), "type": kind, **data}, ensure_ascii=False) + "\n")404

156157Usage and elapsed execution time accumulate across resumes (offline pause time158is excluded). Before each model request, UTF-8 request bytes plus output tokens159and overhead provide a conservative token reservation. Reported usage is stored;160gateway token accounting may differ. Output size is checked between actions,161not an OS disk quota. `CANCEL` is checked between actions; use the runtime CANCEL162file to stop an active process. Credentials are not included in provider errors.163Do not publish traces from private repositories without reviewing their contents.164

543                    raise ProviderError("Duplicate provider tool call IDs; execution stopped")544                event("model_response", content=blocks, usage=usage, model=response.get("model"))545                state["messages"].append({"role": "assistant", "content": blocks})546                state["pending"] = [{k: b[k] for k in ["id", "name", "input"]} for b in tool_blocks]547                if sum(state["usage"].values()) > budget["max_total_tokens"]:

6667def sanitize(text: str) -> Optional[str]:68    cleaned = " ".join(str(text or "").split())[:MAX_FIELD_CHARS]69    if not cleaned:70        return None71    if SECRET_RE.search(cleaned):72        return None73    return cleaned74

61    try:62        if status in {"partial", "blocked"}:63            path = store.record_lesson(64                kind="failure-fix",65                skill="ai-research-reproduction",66                summary=f"[{status}] {context.get('main_blocker', 'unrecorded blocker')}",67                detail=str(context.get("documented_command") or ""),68                fingerprint=fingerprint,69            )

124    }125    path = lessons_path()126    path.parent.mkdir(parents=True, exist_ok=True)127    with path.open("a", encoding="utf-8") as handle:128        handle.write(json.dumps(entry, ensure_ascii=False) + "\n")129    return path130

4950def lessons_path() -> Path:51    return lessons_home() / "lessons.jsonl"52

58        return None59    fingerprint = store.repo_fingerprint(repo_path)60    status = context.get("status")61    try:62        if status in {"partial", "blocked"}:63            path = store.record_lesson(64                kind="failure-fix",65                skill="ai-research-reproduction",66                summary=f"[{status}] {context.get('main_blocker', 'unrecorded blocker')}",67                detail=str(context.get("documented_command") or ""),68                fingerprint=fingerprint,69            )70            return str(path) if path else None

20VALID_KINDS = {"failure-fix", "user-correction", "preference", "generalization"}21# Best-effort blocklist: keyword shapes plus common bare-credential formats.22# This is a guardrail, not a guarantee — callers still must not pass secrets.23SECRET_RE = re.compile(24    r"(api[_-]?key|secret|token|password|passwd|authorization|bearer\s+\S|-----BEGIN"25    r"|AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{20,}|gho_[A-Za-z0-9]{20,}|sk-[A-Za-z0-9_-]{16,}"26    r"|xox[a-z]-[A-Za-z0-9-]{10,}|AIza[0-9A-Za-z_-]{30,})",27    re.IGNORECASE,28)29MAX_FIELD_CHARS = 300

658) -> Dict[str, Any]:659    root = Path(runtime_root).resolve()660    parent_dir = root / run_id661    state_path = parent_dir / "state.json"662    spec_path = parent_dir / "spec.json"663    if not state_path.is_file() or not spec_path.is_file():664        raise FileNotFoundError(f"Unknown or incomplete runtime run: {run_id}")665    recovery = reconcile_run(parent_dir)666    state = read_json(state_path)667    status = str(state.get("status") or recovery.get("status"))668    if status in ACTIVE_STATES:669        raise RuntimeError(f"Run {run_id} is still active or orphaned ({status}); refusing duplicate execution")670    if status == "success" and not allow_success_retry:671        raise RuntimeError(f"Run {run_id} already succeeded; use allow_success_retry only when repetition is intentional")672    spec = read_json(spec_path)673    selected_timeout = int(timeout if timeout is not None else spec.get("timeout_seconds", 60))674    if selected_timeout <= 0:675        raise ValueError("retry timeout must be greater than zero")676    return run_persistent_command(677        repo=Path(spec["cwd"]),678        command=str(spec["command"]),679        timeout=selected_timeout,

696    recover_parser.add_argument("--stale-after", type=float, default=30.0)697    cancel_parser = subparsers.add_parser("cancel", help="Write a cancellation request for an actively monitored run.")698    cancel_parser.add_argument("--run-id", required=True)699    retry_parser = subparsers.add_parser("retry", help="Explicitly retry a terminal run as a new attempt.")700    retry_parser.add_argument("--run-id", required=True)701    retry_parser.add_argument("--timeout", type=int)702    retry_parser.add_argument("--allow-success-retry", action="store_true")703    args = parser.parse_args()

711            payload = recover_runtime_root(root, args.stale_after)712        elif args.action == "cancel":713            payload = request_cancel(root, args.run_id)714        else:715            payload = retry_run(716                runtime_root=root,717                run_id=args.run_id,718                timeout=args.timeout,719                allow_success_retry=args.allow_success_retry,720            )721    except (FileNotFoundError, RuntimeError, ValueError) as exc:

671        raise RuntimeError(f"Run {run_id} already succeeded; use allow_success_retry only when repetition is intentional")672    spec = read_json(spec_path)673    selected_timeout = int(timeout if timeout is not None else spec.get("timeout_seconds", 60))674    if selected_timeout <= 0:675        raise ValueError("retry timeout must be greater than zero")676    return run_persistent_command(677        repo=Path(spec["cwd"]),678        command=str(spec["command"]),679        timeout=selected_timeout,680        runtime_root=root,681        shell_mode=str(spec.get("shell_mode") or "direct"),