
    h3>                        S r SSKrSSKrSSKJrJrJrJrJrJ	r	  SSK
Jr  SSKJr  SSKJr   " S S\5      r " S	 S
\5      r\ " S S5      5       r\ " S S5      5       r " S S5      r " S S5      r " S S5      r\S:X  a  \" 5       rSSS.SSS.SSS.SSS.SS S./r\ HL  r\R5                  \5      r\" S!\S"    35        \" S#\S$    35        \" S%\S&    35        \" S'\S(    35        MN     \" S)\R;                  5       -   5        gg)*zy
Eden Core - Security & Safety System
Addresses: Sandboxing, permission management, action filtering, safety constraints
    N)AnyDictListSetOptionalCallable)Enum)datetime)	dataclassc                   (    \ rS rSrSrSrSrSrSrSr	g)	PermissionLevel   z Permission levels for operations	read_onlylimited_writefull_accessadmin N)
__name__
__module____qualname____firstlineno____doc__	READ_ONLYLIMITED_WRITEFULL_ACCESSADMIN__static_attributes__r       ;/home/james-whalen/eden-agi-project/eden_security_safety.pyr   r      s    *I#MKEr   r   c                   ,    \ rS rSrSrSrSrSrSrSr	Sr
g	)
	RiskLevel   zRisk assessment levelssafelowmediumhighcriticalr   N)r   r   r   r   r   SAFELOWMEDIUMHIGHCRITICALr   r   r   r   r!   r!      s     D
CFDHr   r!   c                   \    \ rS rSr% Sr\\S'   \\S'   \\/\	4   \S'   \
\S'   Sr\	\S'   S	rg
)SafetyConstraint   zSafety constraint definitionnamedescriptionchecker
risk_levelT
auto_blockr   N)r   r   r   r   r   str__annotations__r   r   boolr!   r4   r   r   r   r   r.   r.      s1    &
IseTk""Jr   r.   c                   t    \ rS rSr% Sr\\S'   \\S'   \\\4   \S'   \\S'   \	\S'   \\S'   S	r
\\   \S
'   Srg	)ActionAudit)   zAudit log entry for actions	timestampaction_type
parameterspermission_levelapprovedr3   Nreasonr   )r   r   r   r   r   r5   r6   r   r   r7   r@   r   r   r   r   r   r9   r9   )   s<    %NS#XNO FHSM r   r9   c                       \ rS rSrSrS rS\S\4S jrS\S\S\	4S	 jr
S\4S
 jrS\S\	4S jrS\S\	4S jrS\\\4   S\4S jrS\\\4   S\	4S jrS\\\4   4S jrSrg)SecurityManager5   z0Comprehensive security and permission managementc                 n    0 U l         [        5       U l        SS1U l        / U l        [        5       U l        g )Nz/home/claudez/tmp)permissionssetblocked_operationsallowed_paths	audit_logaction_hashesselfs    r   __init__SecurityManager.__init__8   s2    79,/E(6'?,.'*ur   	operationlevelc                      X R                   U'   g)z%Set permission level for an operationN)rE   )rL   rO   rP   s      r   set_permissionSecurityManager.set_permission?   s    &+#r   required_levelreturnc                     U R                   R                  U[        R                  5      n[        R                  S[        R                  S[        R
                  S[        R                  S0nXC   XB   :  $ )z0Check if operation has required permission levelr            )rE   getr   r   r   r   r   )rL   rO   rT   current_levellevel_hierarchys        r   check_permission SecurityManager.check_permissionC   sh    ((,,Y8Q8QR %%q))1''!!1	
 -1PPPr   c                 :    U R                   R                  U5        g)zPermanently block an operationN)rG   addrL   rO   s     r   block_operationSecurityManager.block_operationP   s    ##I.r   c                     XR                   ;   $ )zCheck if operation is blocked)rG   ra   s     r   
is_blockedSecurityManager.is_blockedT   s    3333r   pathc                    ^ SSK nUR                  R                  U5      m[        U4S jU R                   5       5      $ )z0Validate that path is within allowed directoriesr   Nc              3   F   >#    U  H  nTR                  U5      v   M     g 7fN
startswith).0allowedabs_paths     r   	<genexpr>0SecurityManager.validate_path.<locals>.<genexpr>\   s!     R?QG8&&w//?Q   !)osrg   abspathanyrH   )rL   rg   rs   ro   s      @r   validate_pathSecurityManager.validate_pathX   s/    77??4(Rt?Q?QRRRr   actionc                     [         R                  " USS9n[        R                  " UR	                  5       5      R                  5       $ )z/Create unique hash for action to prevent replayT)	sort_keys)jsondumpshashlibsha256encode	hexdigest)rL   rx   
action_strs      r   create_action_hash"SecurityManager.create_action_hash^   s3    ZZ$7
~~j//12<<>>r   c                 @    U R                  U5      nX R                  ;   $ )z#Check if action is a replay attempt)r   rJ   rL   rx   action_hashs      r   is_replay_attack SecurityManager.is_replay_attackc   s!    --f50000r   c                     U R                  U5      nU R                  R                  U5        [        U R                  5      S:  a  gg)z$Record action hash to prevent replayi'  N)r   rJ   r`   lenr   s      r   record_actionSecurityManager.record_actionh   sC    --f5{+ t!!"U* +r   )rJ   rH   rI   rG   rE   N)r   r   r   r   r   rM   r5   r   rR   r7   r]   rb   re   rv   r   r   r   r   r   r   r   r   r   rB   rB   5   s    :-, ,O ,Q# Q QSW Q/ /4C 4D 4S# S$ S?c3h ?C ?
1tCH~ 1$ 1
DcN r   rB   c                       \ rS rSrSrS rS rS\S\4S jr	S\S\4S jr
S\S\4S	 jrS\S\4S
 jrS\4S jrS\\\4   S\\\4   4S jrS\S\S\4S jrS\4S jrSrg)SafetyControllers   z1Safety constraint enforcement and risk assessmentc                 N    0 U l         / U l        0 U l        U R                  5         g rj   )constraints
safety_logviolation_count_setup_default_constraintsrK   s    r   rM   SafetyController.__init__v   s'    8:&(/1 	'')r   c           
      v  ^  T R                  [        SSU 4S j[        R                  SS95        T R                  [        SSU 4S j[        R                  S	S95        T R                  [        S
SU 4S j[        R
                  SS95        T R                  [        SSU 4S j[        R                  SS95        g)z Setup default safety constraintsno_system_modificationz%Prevent modifications to system filesc                 0   > TR                  U 5      (       + $ rj   )_is_system_modificationrx   rL   s    r   <lambda>=SafetyController._setup_default_constraints.<locals>.<lambda>   s    t'C'CF'K#Kr   T)r0   r1   r2   r3   r4   controlled_network_accessz)Network access requires explicit approvalc                 b   > TR                  U 5      (       + =(       d    U R                  SS5      $ )Nr?   F)_is_network_operationrZ   r   s    r   r   r      s(    t'A'A&'I#I#jVZZXbdiMj#jr   Fresource_limitszEnforce resource usage limitsc                 &   > TR                  U 5      $ rj   )_check_resource_limitsr   s    r   r   r      s    4#>#>v#Fr   controlled_self_modificationz'Self-modification requires human reviewc                 b   > TR                  U 5      (       + =(       d    U R                  SS5      $ )Nhuman_approvedF)_is_self_modificationrZ   r   s    r   r   r      s(    t'A'A&'I#I#pVZZXhjoMp#pr   N)add_constraintr.   r!   r,   r+   r*   rK   s   `r   r   +SafetyController._setup_default_constraints~   s     	,)?K ))
 	 	,,Cj ~~
 	 	,"7F ''
 	 	,/Ap ))
 	r   rx   rU   c                 Z   ^ / SQnUR                  SS5      m[        U4S jU 5       5      $ )z%Check if action modifies system files)z/etc/z/sys/z/proc/z/boot/rg    c              3   F   >#    U  H  nTR                  U5      v   M     g 7frj   rk   )rm   dprg   s     r   rp   ;SafetyController._is_system_modification.<locals>.<genexpr>   s     A24??2&&rr   rZ   ru   )rL   rx   dangerous_pathsrg   s      @r   r   (SafetyController._is_system_modification   s)    @zz&"%AAAAr   c                 2    / SQnUR                  S5      U;   $ )z'Check if action involves network access)http_requestsocket_connectdownloaduploadtype)rZ   )rL   rx   network_operationss      r   r   &SafetyController._is_network_operation   s    Uzz&!%777r   c                     SSSS.nUR                  S0 5      nUR                  5        H  u  pEUR                  US5      U:  d  M    g   g)	z'Check if action exceeds resource limitsi  <   d   )max_memory_mbmax_cpu_time_secmax_file_size_mb	resourcesr   FT)rZ   items)rL   rx   limitsr   resourcelimits         r   r   'SafetyController._check_resource_limits   sS     " " #
 JJ{B/	%||~OH}}Xq)E1  . r   c                 Z   ^ / SQnUR                  SS5      m[        U4S jU 5       5      $ )z(Check if action modifies Eden's own code)eden_core.pyzcapabilities/zreal_capabilities/rg   r   c              3   ,   >#    U  H	  oT;   v   M     g 7frj   r   )rm   sprg   s     r   rp   9SafetyController._is_self_modification.<locals>.<genexpr>   s     3
":
s   r   )rL   rx   
self_pathsrg   s      @r   r   &SafetyController._is_self_modification   s)    L
zz&"%3
333r   
constraintc                 4    XR                   UR                  '   g)zAdd a safety constraintN)r   r0   )rL   r   s     r   r   SafetyController.add_constraint   s    ,6)r   c           	      H   / n[         R                  nSnU R                  R                  5        H  u  pV UR	                  U5      (       d  UR                  UUR                  UR                  R                  S.5        U R                  R                  US5      S-   U R                  U'   U R                  UR                  U5      S:  a  UR                  nUR                  (       a  SnM  M  M     [!        U5      S:H  UUR                  U["        R$                  " 5       R'                  5       S.nU R(                  R                  UUS	.5        U$ ! [         aG  nUR                  US[        U5       3[         R                  R                  S.5        Sn SnAGMm  SnAff = f)
zm
Check action against all safety constraints

Returns: Dict with keys: safe, violations, risk_level, blocked
F)r   r1   r3   r   rW   TzConstraint check failed: N)r#   
violationsr3   blockedr;   )rx   result)r!   r(   r   r   r2   appendr1   r3   valuer   rZ   _compare_riskr4   	Exceptionr5   r+   r   r
   now	isoformatr   )	rL   rx   r   max_riskr   constraint_namer   er   s	            r   check_safetySafetyController.check_safety   s    
>>+/+;+;+A+A+C'O!))&11%%&5'1'='=&0&;&;&A&A'  =A<P<P<T<TUdfg<hkl<lD((9 ))**?*?JQN#-#8#8 ",,"& - 2 ,D8 
Oq($"..!113
 	 
 	
 +  !!"1%>s1vh#G"+.."6"6# 
 s   B4E
F!;FF!risk1risk2c           
          [         R                  S[         R                  S[         R                  S[         R                  S[         R
                  S0nX1   nX2   nXE:  a  gXE:  a  gg)z"Compare two risk levels (-1, 0, 1)r   rW   rX   rY      )r!   r(   r)   r*   r+   r,   )rL   r   r   risk_valuesval1val2s         r   r   SafetyController._compare_risk   sa     NNAMM1aNNA
 !!;[r   c                    [        U R                  5      n[        S U R                   5       5      nSS S[        R                  " 5       R                  5        SS SU SU S	S
U-  [        US5      -  S SX-
   SS S3n[        U R                  R                  5       S SS9 H  u  pEX4 SU S3-  nM     US-  nU R                  SS  H   nUS   nUSUS    SUS    SUS    S3-  nM"     U$ )zGenerate safety reportc              3   B   #    U  H  oS    S   (       d  M  Sv   M     g7f)r   r#   rW   Nr   )rm   logs     r   rp   5SafetyController.get_safety_report.<locals>.<genexpr>  s     Qx=;P11s   	z
Eden Core - Safety Report
2==================================================
Generated: z

SAFETY SUMMARY:
2--------------------------------------------------z
Total Actions Checked: z
Safe Actions:  (r   rW   .1fz%)
Violations: z

CONSTRAINT VIOLATIONS:

c                     U S   $ )NrW   r   )xs    r   r   4SafetyController.get_safety_report.<locals>.<lambda>%  s    YZ[\Y]r   T)keyreversez: z violations
z
Most recent safety checks:
Nr   z  [r;   z] Risk: r3   z, Safe: r#   )
r   r   sumr
   r   r   maxsortedr   r   )rL   total_checkssafe_actionsreportr   countr   r   s           r   get_safety_report"SafetyController.get_safety_report  sN   4??+QQQ 	LLN$$&' (  	$~ &nBs</L!0DDSI J() *  	 '-T-A-A-G-G-I~gk&l"O)E7-@@F 'm 	23??23'C]FF;/09M8NhW]^dWeVffhiiF ( r   )r   r   r   N)r   r   r   r   r   rM   r   r   r7   r   r   r   r   r.   r   r5   r   r   r!   intr   r   r   r   r   r   r   r   s   s    ;*$LBd Bt B8D 8T 8
T d  4D 4T 47)9 724S> 2d38n 2h9 Y 3 (3 r   r   c            	           \ rS rSrSrS rS r\R                  4S\	\
\4   S\S\	\
\4   4S jjrSS	\
S
\
S\	\
\4   4S jjrS\
4S jrSrg)RobustSecuritySystemi0  z"Unified security and safety systemc                 n    [        5       U l        [        5       U l        / U l        U R                  5         g rj   )rB   security_managerr   safety_controllerrI   _setup_default_permissionsrK   s    r   rM   RobustSecuritySystem.__init__3  s-     / 1!1!3,. 	'')r   c                    U R                   R                  S[        R                  5        U R                   R                  S[        R                  5        U R                   R                  S[        R                  5        U R                   R                  S[        R
                  5        U R                   R                  S[        R                  5        U R                   R                  S[        R                  5        g)zSetup default permission levels	file_read
file_writebash_commandnetwork_requestsystem_modificationself_modificationN)r  rR   r   r   r   r   r   rK   s    r   r  /RobustSecuritySystem._setup_default_permissions;  s    ,,[/:S:ST,,\?;X;XY,,^_=Z=Z[,,->@[@[\,,-BODYDYZ,,-@/BWBWXr   rx   required_permissionrU   c           
         UR                  SS5      nU R                  R                  U5      (       a  U R                  S5      $ U R                  R	                  U5      (       a  U R                  S5      $ U R                  R                  X25      (       d  U R                  SUR                   S35      $ SU;   a4  U R                  R                  US   5      (       d  U R                  S5      $ U R                  R                  U5      nUS	   (       a;  U R                  S
SR                  US    Vs/ s H  oUS   PM	     sn5       3US   S9$ U R                  R                  U5        [        [        R                  " 5       R                  5       UUUR                  SUS   S9nU R                   R#                  U5        SSUS   [%        U R                   5      S-
  US   (       d  US   S.$ / S.$ s  snf )zx
Authorize action through security and safety checks

Returns: Dict with keys: authorized, reason, risk_level, audit_id
r   unknownz Operation is permanently blockedz Potential replay attack detectedz#Insufficient permissions (requires )rg   zPath not in allowed directoriesr   zSafety violation: z, r   r   r3   )r3   T)r;   r<   r=   r>   r?   r3   zAction approvedrW   r#   )
authorizedr@   r3   audit_idwarnings)rZ   r  re   _create_denialr   r]   r   rv   r  r   joinr   r9   r
   r   r   rI   r   r   )rL   rx   r  r<   safety_resultvaudits          r   authorize_action%RobustSecuritySystem.authorize_actionD  s    jj3   ++K88&&'IJJ   11&99&&'IJJ $$55kWW&&)LM`MfMfLggh'ijj V((66vf~FF**+LMM ..;;FC#&&$TYYWcId/eIdA,Id/e%f$gh(6 '   	++F3 lln..0#066$\2
 	e$ ''5DNN+a/;H;Pl3
 	

 WY
 	
% 0fs   1G2r@   r3   c                     SUUSS.$ )zCreate denial responseFN)r  r@   r3   r  r   )rL   r@   r3   s      r   r  #RobustSecuritySystem._create_denial}  s      $	
 	
r   c                    [        S U R                   5       5      n[        U R                  5      U-
  nSS S[        R                  " 5       R                  5        SS S[        U R                  5       SU S	S
U-  [        [        U R                  5      S5      -  S SU S	S
U-  [        [        U R                  5      S5      -  S S3nX0R                  R                  5       -  nUSS S3-  nU R                  SS  Hl  nUR                  (       a  SOSnX5 SUR                   SUR                   SUR                   S3-  nUR                  (       d  MY  USUR                   S3-  nMn     U$ )z&Generate comprehensive security reportc              3   J   #    U  H  oR                   (       d  M  S v   M     g7f)rW   N)r?   )rm   r  s     r   rp   ;RobustSecuritySystem.get_security_report.<locals>.<genexpr>  s     GnUqqns   #	#z
Eden Core - Security Report
r   r   z

AUTHORIZATION SUMMARY:
r   z
Total Actions: z
Approved: r   r   rW   r   z%)
Denied: z%)

z

RECENT AUDIT LOG (last 10):
r   iNu   ✓u   ✗z [z] z	 - Risk: z   Reason: )r   rI   r   r
   r   r   r   r  r   r?   r;   r<   r3   r@   )rL   r?   deniedr   r  statuss         r   get_security_report(RobustSecuritySystem.get_security_report  s~   GdnnGGT^^$x/ 	LLN$$&' (  	DNN#$ %*Bs8|CDNN(;Q$??D E		3v:c#dnn"5q99#> ? 	((::<<5fXR@@^^CD)E#nnU%F5??"32e6G6G5H	RWRbRbQcceffF|||K~R88	 * r   )rI   r  r  N)r%   )r   r   r   r   r   rM   r  r   r   r   r5   r   r  r  r%  r   r   r   r   r  r  0  s}    ,*Y @O?\?\7
tCH~ 7
-<7
aefiknfnao7
r
S 
c 
cSVh 
S r   r  __main__r	  z/home/claude/test.txt)r   rg   r
  z/home/claude/output.txtr  zls -la)r   commandz/etc/passwdr  r   z	
Action: r   zAuthorized: r  zReason: r@   zRisk: r3   r   )r   r}   r{   typingr   r   r   r   r   r   enumr	   r
   dataclassesr   r   r!   r.   r9   rB   r   r  r   securityactionsrx   r  r   printr%  r   r   r   <module>r/     sa  
   ; ;   !d      ! ! !; ;|z zzq qj z#%H &=>'@AH5}5$n=G **62
6&>*+,VL1234)*+,vl+,-.  
$--/
/0' r   