Safe Debug Skill 安全审计

1271        )1272    elif args.run_selected:1273        if chosen["selected_goal"] == "training":1274            run_data = maybe_run_training(1275                repo_path=repo_path,1276                command=chosen["documented_command"],1277                train_script=train_execute_script,1278                lane=args.lane,1279                user_language=args.user_language,1280                full_training_authorized=args.full_training_authorized,1281                train_timeout=args.train_timeout,1282                dataset_hint=dataset_hint,1283                checkpoint_hint=checkpoint_hint,1284                resume_from=args.resume_from,1285                max_train_steps=args.max_train_steps,1286                shell_mode=args.shell_mode,1287                runtime_root=runtime_root,1288                model_profile_json=args.model_profile_json,1289                required_model_capabilities=args.require_model_capability,1290                gpu_monitor_enabled=not args.no_gpu_monitor,1291            )1292        else:1293            run_data = maybe_run_command(1294                repo_path,1295                chosen["documented_command"],1296                args.timeout,1297                args.user_language,1298                args.shell_mode,1299                runtime_root,1300                model_adapter,1301                args.monitor_gpu,1302            )1303

486487    try:488        argv = build_command(command, shell_mode)489        environment = dict(os.environ if child_env is None else child_env)490        spec["requested_argv"] = list(argv)491        atomic_write_json(run_dir / "spec.json", spec)492        if shell_mode == "direct":493            argv = resolve_direct_argv(argv, repo, environment)494        spec["argv"] = list(argv)495        atomic_write_json(run_dir / "spec.json", spec)496        creationflags = subprocess.CREATE_NEW_PROCESS_GROUP if os.name == "nt" else 0497        process = subprocess.Popen(498            argv,499            env=environment,500            cwd=repo,501            stdout=subprocess.PIPE,502            stderr=subprocess.PIPE,503            text=True,504            encoding="utf-8",505            errors="replace",506            bufsize=1,507            creationflags=creationflags,508            start_new_session=os.name != "nt",509        )510    except (FileNotFoundError, ShellSyntaxRequired, OSError, ValueError) as exc:

12361237    chosen = choose_goal(command_data.get("commands", []), repo_path)1238    dataset_hint = derive_dataset_hint(asset_data)

1292        else:1293            run_data = maybe_run_command(1294                repo_path,1295                chosen["documented_command"],1296                args.timeout,1297                args.user_language,1298                args.shell_mode,1299                runtime_root,1300                model_adapter,1301                args.monitor_gpu,1302            )

494                        value = {"error": str(exc)}495                    event("tool_result", tool=name, result=value)496                    state["tool_results"].append({"type": "tool_result", "tool_use_id": call["id"],497                        "content": json.dumps(value, ensure_ascii=False), "is_error": "error" in value})498                    state["pending"].pop(0)499                    tools_this_turn += 1500                    save()501                    if pause_after_tools and tools_this_turn >= pause_after_tools and state["status"] == "running":502                        state["status"] = "paused"503                        event("paused", reason="Explicit test/session checkpoint")504                    continue505                if state["tool_results"]:506                    state["messages"].append({"role": "user", "content": state.pop("tool_results")})507                    state["tool_results"] = []

517                save()518                event("model_request", call=state["model_calls"], reserved_tokens=reserve)519                response = provider.complete(state["messages"], SYSTEM, TOOLS, budget["max_output_tokens"], min(60, remaining))520                if not isinstance(response, dict):

109110`endpoint` optionally names the final HTTPS endpoint. Without it, the client111uses `ANTHROPIC_BASE_URL` or the official endpoint. For an already configured112Bearer gateway, set `metadata.auth_scheme` to `bearer` and name its credential113environment variable. Redirects are refused so credentials are not forwarded.114

342        raise ValueError("All budget limits must be positive integers")343    endpoint_identity = fingerprint(profile.get("endpoint") or os.getenv("ANTHROPIC_BASE_URL") or "https://api.anthropic.com")344    harness_identity = fingerprint([Path(__file__).read_bytes().replace(b"\r\n", b"\n").hex(), SYSTEM, TOOLS,

518                event("model_request", call=state["model_calls"], reserved_tokens=reserve)519                response = provider.complete(state["messages"], SYSTEM, TOOLS, budget["max_output_tokens"], min(60, remaining))520                if not isinstance(response, dict):

97        "",98        "## Error excerpt",99        "",100        "```text",101        data["error_excerpt"],102        "```",103        "",104        "## Conservative analysis",105        "",106        data["summary"],107        "",108    ]109    (output_dir / "DIAGNOSIS.md").write_text("\n".join(diagnosis), encoding="utf-8")110

152153    text = args.error_text or Path(args.error_file).read_text(encoding="utf-8", errors="ignore")154    data = analyze_error(text)155    if args.json:156        print(json.dumps(data, indent=2, ensure_ascii=False))157        return 0158159    write_outputs(Path(args.output_dir).resolve(), data)160    print(json.dumps(data, indent=2, ensure_ascii=False))161    return 0

83        "actions": suggested_actions(category),84        "error_excerpt": "\n".join(text.splitlines()[:12]) or text,85    }

20VALID_KINDS = {"failure-fix", "user-correction", "preference", "generalization"}21# Best-effort blocklist: keyword shapes plus common bare-credential formats.22# This is a guardrail, not a guarantee — callers still must not pass secrets.23SECRET_RE = re.compile(

4041def lessons_home() -> Path:42    root = os.environ.get("RIGORPILOT_HOME")43    return Path(root).expanduser() if root else Path.home() / ".rigorpilot"444546def lessons_enabled() -> bool:47    return os.environ.get("RIGORPILOT_LESSONS", "1") != "0"484950def lessons_path() -> Path:51    return lessons_home() / "lessons.jsonl"525354def overlay_path() -> Path:55    return lessons_home() / "PERSONAL_RIGOR.md"56

124    }125    path = lessons_path()126    path.parent.mkdir(parents=True, exist_ok=True)127    with path.open("a", encoding="utf-8") as handle:128        handle.write(json.dumps(entry, ensure_ascii=False) + "\n")129    return path130

13901391    context["lesson_recorded"] = maybe_record_lesson(repo_path, context) if args.run_selected else None1392

122    ]123    (output_dir / "PATCH_PLAN.md").write_text("\n".join(patch_plan), encoding="utf-8")124

138    }139    (output_dir / "status.json").write_text(json.dumps(status, indent=2, ensure_ascii=False), encoding="utf-8")140

145    parser.add_argument("--error-text", help="Inline error or symptom text.")146    parser.add_argument("--output-dir", default="debug_outputs", help="Directory for debug outputs.")147    parser.add_argument("--json", action="store_true", help="Emit JSON to stdout instead of writing files.")148    args = parser.parse_args()149150    if not args.error_file and not args.error_text:151        raise SystemExit("Provide --error-file or --error-text.")152153    text = args.error_text or Path(args.error_file).read_text(encoding="utf-8", errors="ignore")154    data = analyze_error(text)155    if args.json:156        print(json.dumps(data, indent=2, ensure_ascii=False))157        return 0158159    write_outputs(Path(args.output_dir).resolve(), data)160    print(json.dumps(data, indent=2, ensure_ascii=False))