christian.meyer/lai_automatisierung
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Replace Aider with a secure mini-SWE-agent worker #1

Merged
christian.meyer merged 12 commits from feature/mini-swe-agent-worker into main 2026-08-31 17:39:42 +02:00
Conversation 0 Commits 12 Files Changed 103 +10
2 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit badb8bb730 - Show all commits

7
src/lai_automation/security.py
View File

@@ -35,6 +35,11 @@ _PROTECTED_REPOSITORY_PATH = re.compile(
_PARENT_PATH = re.compile(r"(?:^|[/\s'\"=])\.\.(?:/|$|[\s'\";&|])") _PARENT_PATH = re.compile(r"(?:^|[/\s'\"=])\.\.(?:/|$|[\s'\";&|])")
_BACKGROUND_PROCESS = re.compile(r"(?<![&>])&(?![&>])") _BACKGROUND_PROCESS = re.compile(r"(?<![&>])&(?![&>])")
_SERVER_COMMAND = re.compile(r"(?<![A-Za-z0-9_.-])php\s+-S(?:\s|$)") _SERVER_COMMAND = re.compile(r"(?<![A-Za-z0-9_.-])php\s+-S(?:\s|$)")
_TEMPORARY_ARTIFACT = re.compile(
r"(?i)(?:^|[/\s'\"=])(?:[^/\s'\";&|<>]+\.(?:bak|backup|orig|rej|swp|temp|tmp)"
r"|(?:test_)?debug\.(?:php|py|js|ts)|scratch\.(?:php|py|js|ts))"
r"(?=$|[\s'\";&|<>])"
)
_CHANGE_DIRECTORY = re.compile( _CHANGE_DIRECTORY = re.compile(
r"(?:^|[;&|]\s*)cd\s+(?P<target>'[^']*'|\"[^\"]*\"|[^\s;&|]+)" r"(?:^|[;&|]\s*)cd\s+(?P<target>'[^']*'|\"[^\"]*\"|[^\s;&|]+)"
) )
@@ -158,6 +163,8 @@ class SafeLocalEnvironment:
raise ValueError("Command rejected by safety policy: path outside repository") raise ValueError("Command rejected by safety policy: path outside repository")
if _PROTECTED_REPOSITORY_PATH.search(command): if _PROTECTED_REPOSITORY_PATH.search(command):
raise ValueError("Command rejected by safety policy: protected repository path") raise ValueError("Command rejected by safety policy: protected repository path")
if _TEMPORARY_ARTIFACT.search(command):
raise ValueError("Command rejected by safety policy: temporary artifact")
if _BACKGROUND_PROCESS.search(command) or _SERVER_COMMAND.search(command): if _BACKGROUND_PROCESS.search(command) or _SERVER_COMMAND.search(command):
raise ValueError("Command rejected by safety policy: persistent process") raise ValueError("Command rejected by safety policy: persistent process")
for match in _CHANGE_DIRECTORY.finditer(command): for match in _CHANGE_DIRECTORY.finditer(command):

3
tests/test_security.py
View File

@@ -48,6 +48,9 @@ def test_environment_rejects_cwd_outside_repository(tmp_path: Path) -> None:
"cd .. && pwd", "cd .. && pwd",
"php -S 127.0.0.1:8000", "php -S 127.0.0.1:8000",
"php artisan serve &", "php artisan serve &",
"cp config/app.php config/app.php.bak",
"printf debug > test_debug.php",
"touch scratch.py",
], ],
) )
def test_environment_rejects_unsafe_commands(tmp_path: Path, command: str) -> None: def test_environment_rejects_unsafe_commands(tmp_path: Path, command: str) -> None: