mirror of
https://github.com/Significant-Gravitas/AutoGPT.git
synced 2026-02-14 00:35:02 -05:00
52b3aebf71
## Summary
Full integration of the **Claude Agent SDK** to replace the existing
one-turn OpenAI-compatible CoPilot implementation with a multi-turn,
tool-using AI agent.
### What changed
**Core SDK Integration** (`chat/sdk/` — new module)
- **`service.py`**: Main orchestrator — spawns Claude Code CLI as a
subprocess per user message, streams responses back via SSE. Handles
conversation history compression, session lifecycle, and error recovery.
- **`response_adapter.py`**: Translates Claude Agent SDK events (text
deltas, tool use, errors, result messages) into the existing CoPilot
`StreamEvent` protocol so the frontend works unchanged.
- **`tool_adapter.py`**: Bridges CoPilot's MCP tools (find_block,
run_block, create_agent, etc.) into the SDK's tool format. Handles
schema conversion and result serialization.
- **`security_hooks.py`**: Pre/Post tool-use hooks that enforce a strict
allowlist of tools, block path traversal, sandbox file operations to
per-session workspace directories, cap sub-agent spawning, and prevent
the model from accessing unauthorized system resources.
- **`transcript.py`**: JSONL transcript I/O utilities for the stateless
`--resume` feature (see below).
**Stateless Multi-Turn Resume** (new)
- Instead of compressing conversation history via LLM on every turn
(lossy and expensive), we capture Claude Code's native JSONL session
transcript via a **Stop hook** callback, persist it in the DB
(`ChatSession.sdkTranscript`), and restore it on the next turn via
`--resume <file>`.
- This preserves full tool call/result context across turns with zero
token overhead for history.
- Feature-flagged via `CLAUDE_AGENT_USE_RESUME` (default: off).
- DB migration: `ALTER TABLE "ChatSession" ADD COLUMN "sdkTranscript"
TEXT`.
**Sandboxed Tool Execution** (`chat/tools/`)
- **`bash_exec.py`**: Sandboxed bash execution using bubblewrap
(`bwrap`) with read-only root filesystem, per-session writable
workspace, resource limits (CPU, memory, file size), and network
isolation.
- **`sandbox.py`**: Shared bubblewrap sandbox infrastructure — generates
`bwrap` command lines with configurable mounts, environment, and
resource constraints.
- **`web_fetch.py`**: URL fetching tool with domain allowlist, size
limits, and content-type filtering.
- **`check_operation_status.py`**: Polling tool for long-running
operations (agent creation, block execution) so the SDK doesn't block
waiting.
- **`find_block.py`** / **`run_block.py`**: Enhanced with category
filtering, optimized response size (removed raw JSON schemas), and
better error handling.
**Security**
- Path traversal prevention: session IDs sanitized, all file ops
confined to workspace dirs, symlink resolution.
- Tool allowlist enforcement via SDK hooks — model cannot call arbitrary
tools.
- Built-in `Bash` tool blocked via `disallowed_tools` to prevent
bypassing sandboxed `bash_exec`.
- Sub-agent (`Task`) spawning capped at configurable limit (default:
10).
- CodeQL-clean path sanitization patterns.
**Streaming & Reconnection**
- SSE stream registry backed by Redis Streams for crash-resilient
reconnection.
- Long-running operation tracking with TTL-based cleanup.
- Atomic message append to prevent race conditions on concurrent writes.
**Configuration** (`config.py`)
- `use_claude_agent_sdk` — master toggle (default: on)
- `claude_agent_model` — model override for SDK path
- `claude_agent_max_buffer_size` — JSON parsing buffer (10MB)
- `claude_agent_max_subtasks` — sub-agent cap (10)
- `claude_agent_use_resume` — transcript-based resume (default: off)
- `thinking_enabled` — extended thinking for Claude models
**Tests**
- `sdk/response_adapter_test.py` — 366 lines covering all event
translation paths
- `sdk/security_hooks_test.py` — 165 lines covering tool blocking, path
traversal, subtask limits
- `chat/model_test.py` — 214 lines covering session model serialization
- `chat/service_test.py` — Integration tests including multi-turn resume
keyword recall
- `tools/find_block_test.py` / `run_block_test.py` — Extended with new
tool behavior tests
## Test plan
- [x] Unit tests pass (`sdk/response_adapter_test.py`,
`security_hooks_test.py`, `model_test.py`)
- [x] Integration test: multi-turn keyword recall via `--resume`
(`service_test.py::test_sdk_resume_multi_turn`)
- [x] Manual E2E: CoPilot chat sessions with tool calls, bash execution,
and multi-turn context
- [x] Pre-commit hooks pass (ruff, isort, black, pyright, flake8)
- [ ] Staging deployment with `claude_agent_use_resume=false` initially
- [ ] Enable resume in staging, verify transcript capture and recall
<!-- greptile_comment -->
<h2>Greptile Overview</h2>
<details><summary><h3>Greptile Summary</h3></summary>
This PR replaces the existing OpenAI-compatible CoPilot with a full
Claude Agent SDK integration, introducing multi-turn conversations,
stateless resume via JSONL transcripts, and sandboxed tool execution.
**Key changes:**
- **SDK integration** (`chat/sdk/`): spawns Claude Code CLI subprocess
per message, translates events to frontend protocol, bridges MCP tools
- **Stateless resume**: captures JSONL transcripts via Stop hook,
persists in `ChatSession.sdkTranscript`, restores with `--resume`
(feature-flagged, default off)
- **Sandboxed execution**: bubblewrap sandbox for bash commands with
filesystem whitelist, network isolation, resource limits
- **Security hooks**: tool allowlist enforcement, path traversal
prevention, workspace-scoped file operations, sub-agent spawn limits
- **Long-running operations**: delegates `create_agent`/`edit_agent` to
existing stream_registry infrastructure for SSE reconnection
- **Feature flag**: `CHAT_USE_CLAUDE_AGENT_SDK` with LaunchDarkly
support, defaults to enabled
**Security issues found:**
- Path traversal validation has logic errors in `security_hooks.py:82`
(tilde expansion order) and `service.py:266` (redundant `..` check)
- Config validator always prefers env var over explicit `False` value
(`config.py:162`)
- Race condition in `routes.py:323` — message persisted before task
registration, could duplicate on retry
- Resource limits in sandbox may fail silently (`sandbox.py:109`)
**Test coverage is strong** with 366 lines for response adapter, 165 for
security hooks, and integration tests for multi-turn resume.
</details>
<details><summary><h3>Confidence Score: 3/5</h3></summary>
- This PR is generally safe but has critical security issues in path
validation that must be fixed before merge
- Score reflects strong architecture and test coverage offset by real
security vulnerabilities: the tilde expansion bug in `security_hooks.py`
could allow sandbox escape, the race condition could cause message
duplication, and the silent ulimit failures could bypass resource
limits. The bubblewrap sandbox and allowlist enforcement are
well-designed, but the path validation bugs need fixing. The transcript
resume feature is properly feature-flagged. Overall the implementation
is solid but the security issues prevent a higher score.
- Pay close attention to
`backend/api/features/chat/sdk/security_hooks.py` (path traversal
vulnerability), `backend/api/features/chat/routes.py` (race condition),
`backend/api/features/chat/tools/sandbox.py` (silent resource limit
failures), and `backend/api/features/chat/sdk/service.py` (redundant
security check)
</details>
<details><summary><h3>Sequence Diagram</h3></summary>
```mermaid
sequenceDiagram
participant Frontend
participant Routes as routes.py
participant SDKService as sdk/service.py
participant ClaudeSDK as Claude Agent SDK CLI
participant SecurityHooks as security_hooks.py
participant ToolAdapter as tool_adapter.py
participant CoPilotTools as tools/*
participant Sandbox as sandbox.py (bwrap)
participant DB as Database
participant Redis as stream_registry
Frontend->>Routes: POST /chat (user message)
Routes->>SDKService: stream_chat_completion_sdk()
SDKService->>DB: get_chat_session()
DB-->>SDKService: session + messages
alt Resume enabled AND transcript exists
SDKService->>SDKService: validate_transcript()
SDKService->>SDKService: write_transcript_to_tempfile()
Note over SDKService: Pass --resume to SDK
else No resume
SDKService->>SDKService: _compress_conversation_history()
Note over SDKService: Inject history into user message
end
SDKService->>SecurityHooks: create_security_hooks()
SDKService->>ToolAdapter: create_copilot_mcp_server()
SDKService->>ClaudeSDK: spawn subprocess with MCP server
loop Streaming Conversation
ClaudeSDK->>SDKService: AssistantMessage (text/tool_use)
SDKService->>Frontend: StreamTextDelta / StreamToolInputAvailable
alt Tool Call
ClaudeSDK->>SecurityHooks: PreToolUse hook
SecurityHooks->>SecurityHooks: validate path, check allowlist
alt Tool blocked
SecurityHooks-->>ClaudeSDK: deny
else Tool allowed
SecurityHooks-->>ClaudeSDK: allow
ClaudeSDK->>ToolAdapter: call MCP tool
alt Long-running tool (create_agent, edit_agent)
ToolAdapter->>Redis: register task
ToolAdapter->>DB: save OperationPendingResponse
ToolAdapter->>ToolAdapter: spawn background task
ToolAdapter-->>ClaudeSDK: OperationStartedResponse
else Regular tool (find_block, bash_exec)
ToolAdapter->>CoPilotTools: execute()
alt bash_exec
CoPilotTools->>Sandbox: run_sandboxed()
Sandbox->>Sandbox: build bwrap command
Note over Sandbox: Network isolation,<br/>filesystem whitelist,<br/>resource limits
Sandbox-->>CoPilotTools: stdout, stderr, exit_code
end
CoPilotTools-->>ToolAdapter: result
ToolAdapter->>ToolAdapter: stash full output
ToolAdapter-->>ClaudeSDK: MCP response
end
SecurityHooks->>SecurityHooks: PostToolUse hook (log)
end
end
ClaudeSDK->>SDKService: UserMessage (ToolResultBlock)
SDKService->>ToolAdapter: pop_pending_tool_output()
SDKService->>Frontend: StreamToolOutputAvailable
end
ClaudeSDK->>SecurityHooks: Stop hook
SecurityHooks->>SDKService: transcript_path callback
SDKService->>SDKService: read_transcript_file()
SDKService->>DB: save transcript to session.sdkTranscript
ClaudeSDK->>SDKService: ResultMessage (success)
SDKService->>Frontend: StreamFinish
SDKService->>DB: upsert_chat_session()
```
</details>
<sub>Last reviewed commit: 28c1121</sub>
<!-- greptile_other_comments_section -->
<!-- /greptile_comment -->
---------
Co-authored-by: Swifty <craigswift13@gmail.com>
154 lines
3.9 KiB
TOML
154 lines
3.9 KiB
TOML
[tool.poetry]
|
|
name = "autogpt-platform-backend"
|
|
version = "0.6.22"
|
|
description = "A platform for building AI-powered agentic workflows"
|
|
authors = ["AutoGPT <info@agpt.co>"]
|
|
readme = "README.md"
|
|
packages = [{ include = "backend", format = "sdist" }]
|
|
|
|
|
|
[tool.poetry.dependencies]
|
|
python = ">=3.10,<3.14"
|
|
aio-pika = "^9.5.5"
|
|
aiohttp = "^3.10.0"
|
|
aiodns = "^3.5.0"
|
|
anthropic = "^0.79.0"
|
|
apscheduler = "^3.11.1"
|
|
autogpt-libs = { path = "../autogpt_libs", develop = true }
|
|
bleach = { extras = ["css"], version = "^6.2.0" }
|
|
claude-agent-sdk = "^0.1.0"
|
|
click = "^8.2.0"
|
|
cryptography = "^46.0"
|
|
discord-py = "^2.5.2"
|
|
e2b-code-interpreter = "^1.5.2"
|
|
elevenlabs = "^1.50.0"
|
|
fastapi = "^0.128.6"
|
|
feedparser = "^6.0.11"
|
|
flake8 = "^7.3.0"
|
|
google-api-python-client = "^2.177.0"
|
|
google-auth-oauthlib = "^1.2.2"
|
|
google-cloud-storage = "^3.2.0"
|
|
googlemaps = "^4.10.0"
|
|
gravitasml = "^0.1.4"
|
|
groq = "^0.30.0"
|
|
html2text = "^2024.2.26"
|
|
jinja2 = "^3.1.6"
|
|
jsonref = "^1.1.0"
|
|
jsonschema = "^4.25.0"
|
|
langfuse = "^3.14.1"
|
|
launchdarkly-server-sdk = "^9.14.1"
|
|
mem0ai = "^0.1.115"
|
|
moviepy = "^2.1.2"
|
|
ollama = "^0.6.1"
|
|
openai = "^1.97.1"
|
|
orjson = "^3.10.0"
|
|
pika = "^1.3.2"
|
|
pinecone = "^7.3.0"
|
|
poetry = "2.1.1" # CHECK DEPENDABOT SUPPORT BEFORE UPGRADING
|
|
postmarker = "^1.0"
|
|
praw = "~7.8.1"
|
|
prisma = "^0.15.0"
|
|
rank-bm25 = "^0.2.2"
|
|
prometheus-client = "^0.24.1"
|
|
prometheus-fastapi-instrumentator = "^7.0.0"
|
|
psutil = "^7.0.0"
|
|
psycopg2-binary = "^2.9.10"
|
|
pydantic = { extras = ["email"], version = "^2.12.5" }
|
|
pydantic-settings = "^2.12.0"
|
|
pytest = "^8.4.1"
|
|
pytest-asyncio = "^1.1.0"
|
|
python-dotenv = "^1.1.1"
|
|
python-multipart = "^0.0.22"
|
|
redis = "^6.2.0"
|
|
regex = "^2025.9.18"
|
|
replicate = "^1.0.6"
|
|
sentry-sdk = {extras = ["anthropic", "fastapi", "launchdarkly", "openai", "sqlalchemy"], version = "^2.44.0"}
|
|
sqlalchemy = "^2.0.40"
|
|
strenum = "^0.4.9"
|
|
stripe = "^11.5.0"
|
|
supabase = "2.28.0"
|
|
tenacity = "^9.1.4"
|
|
todoist-api-python = "^2.1.7"
|
|
tweepy = "^4.16.0"
|
|
uvicorn = { extras = ["standard"], version = "^0.40.0" }
|
|
websockets = "^15.0"
|
|
youtube-transcript-api = "^1.2.1"
|
|
yt-dlp = "2025.12.08"
|
|
zerobouncesdk = "^1.1.2"
|
|
# NOTE: please insert new dependencies in their alphabetical location
|
|
pytest-snapshot = "^0.9.0"
|
|
aiofiles = "^25.1.0"
|
|
tiktoken = "^0.12.0"
|
|
aioclamd = "^1.0.0"
|
|
setuptools = "^80.9.0"
|
|
gcloud-aio-storage = "^9.5.0"
|
|
pandas = "^2.3.1"
|
|
firecrawl-py = "^4.3.6"
|
|
exa-py = "^1.14.20"
|
|
croniter = "^6.0.0"
|
|
stagehand = "^0.5.1"
|
|
gravitas-md2gdocs = "^0.1.0"
|
|
posthog = "^7.6.0"
|
|
|
|
[tool.poetry.group.dev.dependencies]
|
|
aiohappyeyeballs = "^2.6.1"
|
|
black = "^24.10.0"
|
|
faker = "^38.2.0"
|
|
httpx = "^0.28.1"
|
|
isort = "^5.13.2"
|
|
poethepoet = "^0.41.0"
|
|
pre-commit = "^4.4.0"
|
|
pyright = "^1.1.407"
|
|
pytest-mock = "^3.15.1"
|
|
pytest-watcher = "^0.6.3"
|
|
requests = "^2.32.5"
|
|
ruff = "^0.15.0"
|
|
# NOTE: please insert new dependencies in their alphabetical location
|
|
|
|
[build-system]
|
|
requires = ["poetry-core"]
|
|
build-backend = "poetry.core.masonry.api"
|
|
|
|
[tool.poetry.scripts]
|
|
app = "backend.app:main"
|
|
rest = "backend.rest:main"
|
|
db = "backend.db:main"
|
|
ws = "backend.ws:main"
|
|
scheduler = "backend.scheduler:main"
|
|
notification = "backend.notification:main"
|
|
executor = "backend.exec:main"
|
|
cli = "backend.cli:main"
|
|
format = "linter:format"
|
|
lint = "linter:lint"
|
|
test = "run_tests:test"
|
|
load-store-agents = "test.load_store_agents:run"
|
|
export-api-schema = "backend.cli.generate_openapi_json:main"
|
|
gen-prisma-stub = "gen_prisma_types_stub:main"
|
|
oauth-tool = "backend.cli.oauth_tool:cli"
|
|
|
|
[tool.isort]
|
|
profile = "black"
|
|
|
|
[tool.pytest-watcher]
|
|
now = false
|
|
clear = true
|
|
delay = 0.2
|
|
runner = "pytest"
|
|
runner_args = []
|
|
patterns = ["*.py"]
|
|
ignore_patterns = []
|
|
|
|
[tool.pytest.ini_options]
|
|
asyncio_mode = "auto"
|
|
asyncio_default_fixture_loop_scope = "session"
|
|
# Disable syrupy plugin to avoid conflict with pytest-snapshot
|
|
# Both provide --snapshot-update argument causing ArgumentError
|
|
addopts = "-p no:syrupy"
|
|
filterwarnings = [
|
|
"ignore:'audioop' is deprecated:DeprecationWarning:discord.player",
|
|
"ignore:invalid escape sequence:DeprecationWarning:tweepy.api",
|
|
]
|
|
|
|
[tool.ruff]
|
|
target-version = "py310"
|