Grayscale/nanobot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: trim unused filesystem allowlist state

Browse Source 
maintainer edit: simplify the exact-file allowlist follow-up by removing unused read-side state and keeping the exact path helper private to workspace_policy.
This commit is contained in:
chengyongru
2026-06-18 00:03:26 +08:00
committed by Xubin Ren
parent 15f218e918
commit 51f2dae855
2 changed files with 3 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nanobot/agent/tools/filesystem.py
+1 -4
View File
@@ -47,7 +47,6 @@ class _FsTool(Tool):
extra_allowed_dirs: list[Path] | None = None,
extra_read_allowed_dirs: list[Path] | None = None,
extra_write_allowed_dirs: list[Path] | None = None,
extra_read_allowed_files: list[Path] | None = None,
extra_write_allowed_files: list[Path] | None = None,
file_states: FileStates | None = None,
restrict_to_workspace: bool | None = None,
@@ -62,9 +61,7 @@ class _FsTool(Tool):
*(extra_read_allowed_dirs or []),
]
self._extra_write_allowed_dirs = list(extra_write_allowed_dirs or [])
self._extra_read_allowed_files = list(extra_read_allowed_files or [])
self._extra_write_allowed_files = list(extra_write_allowed_files or [])
self._extra_allowed_dirs = self._extra_read_allowed_dirs
self._restrict_to_workspace = (
bool(restrict_to_workspace)
if restrict_to_workspace is not None
@@ -143,7 +140,7 @@ class _FsTool(Tool):
return self._resolve_with_extra(
path,
self._extra_read_allowed_dirs,
self._extra_read_allowed_files,
None,
include_media_dir=True,
)
nanobot/security/workspace_policy.py
+2 -2
View File
@@ -44,7 +44,7 @@ def is_path_allowed(path: str | Path, roots: Iterable[str | Path]) -> bool:
return any(is_path_within(path, root) for root in roots)
def is_path_exactly_allowed(path: str | Path, files: Iterable[str | Path]) -> bool:
def _is_path_exactly_allowed(path: str | Path, files: Iterable[str | Path]) -> bool:
"""Return True when *path* resolves exactly to one of the allowed files."""
try:
resolved_path = Path(path).expanduser().resolve(strict=False)
@@ -96,7 +96,7 @@ def resolve_allowed_path(
if allowed_root is not None:
roots.append(allowed_root)
roots.extend(extra_allowed_roots or [])
if not is_path_allowed(resolved, roots) and not is_path_exactly_allowed(resolved, files):
if not is_path_allowed(resolved, roots) and not _is_path_exactly_allowed(resolved, files):
boundary = Path(allowed_root).expanduser() if allowed_root is not None else "allowed files"
raise WorkspaceBoundaryError(
f"Path {path} is outside allowed directory {boundary}"