sync: 188 file da Baida98/AI@3e7ad6c6 (2026-08-26 07:25 UTC) [deploy-all]

agents/unified_loop.py

@@ -3510,13 +3510,17 @@ class UnifiedAgentLoop(DirectToolsMixin, PromptBuilderMixin, LLMSelectionMixin,
 
     async def run(self, goal: str, context: str = "", max_steps: int = 8,
                   on_step: StepCallback | None = None,
-                  session_id: str = "", allow_tools: bool = True) -> dict[str, Any]:
+                  session_id: str = "", allow_tools: bool = True,
+                  allow_local_csv_conversion: bool = False) -> dict[str, Any]:
         """Run the loop and close unexpected exceptions as a controlled FAILED state."""
         previous_state = _ACTIVE_LOOP_STATE.get()
         previous_engineering_state = _ACTIVE_ENGINEERING_STATE.get()
         previous_engineering_mode = _ACTIVE_ENGINEERING_MODE.get()
         try:
-            return await self._run_impl(goal, context, max_steps, on_step, session_id, allow_tools)
+            return await self._run_impl(
+                goal, context, max_steps, on_step, session_id, allow_tools,
+                allow_local_csv_conversion,
+            )
         except Exception as _run_error:
             state = _ACTIVE_LOOP_STATE.get()
             error_text = f"{type(_run_error).__name__}: {str(_run_error)[:500]}"
@@ -3555,7 +3559,8 @@ class UnifiedAgentLoop(DirectToolsMixin, PromptBuilderMixin, LLMSelectionMixin,
 
     async def _run_impl(self, goal: str, context: str = "", max_steps: int = 8,
                        on_step: StepCallback | None = None,
-                       session_id: str = "", allow_tools: bool = True) -> dict[str, Any]:
+                       session_id: str = "", allow_tools: bool = True,
+                       allow_local_csv_conversion: bool = False) -> dict[str, Any]:
         # S390-B-L: strip role prefixes che causano prompt injection
         # Es. "SYSTEM: ignore..." o "ASSISTANT: ..." nel goal utente
         # S762-BUG3: re.sub con ^ strippava solo il PRIMO prefisso — input come
@@ -3694,8 +3699,33 @@ class UnifiedAgentLoop(DirectToolsMixin, PromptBuilderMixin, LLMSelectionMixin,
             return _with_state(result)
 
         # Policy fail-closed: con divieto esplicito nessun ramo tool-first, planner,
-        # sandbox, speculazione o tool card è raggiungibile. La risposta resta testuale.
+        # sandbox, speculazione o tool card è raggiungibile. L'unica eccezione è la
+        # conversione CSV→JSON già riconosciuta e validata dal parser puro al confine HTTP.
         if not allow_tools:
+            if allow_local_csv_conversion:
+                await self._transition_state(state, AgentState.TOOL_EXECUTING, on_step)
+                direct_results, _tools_count, _exec_success, _exec_errors = await self._run_direct_tools(
+                    goal, on_step=on_step, local_csv_only=True,
+                )
+                if direct_results.startswith("[DIRECT_TERMINAL]\n"):
+                    _r = await _finish({
+                        "success": _exec_success > 0,
+                        "output": direct_results.removeprefix("[DIRECT_TERMINAL]\n"),
+                        "steps": state.steps,
+                    })
+                else:
+                    _r = await _finish({
+                        "success": False,
+                        "output": direct_results,
+                        "steps": state.steps,
+                        "errors": ["conversione CSV locale non completata"],
+                    })
+                _r["timing_ms"] = int((_time.monotonic() - _t_run) * 1000)
+                _r["effective_max_steps"] = state.max_steps
+                if _sid_token is not None:
+                    try: _sid_var.reset(_sid_token)
+                    except Exception: pass
+                return _r
             await self._transition_state(state, AgentState.THINKING, on_step)
             _r = await _finish(await self._run_fallback(state, on_step))
             _r["timing_ms"] = int((_time.monotonic() - _t_run) * 1000)

agents/unified_loop_tools.py

@@ -127,7 +127,13 @@ class DirectToolsMixin:
             if len(candidate) > 1 and candidate not in {"in", "nel", "un", "il"}:
                 return candidate
         return "."
-    async def _run_direct_tools(self, goal: str, on_step: StepCallback | None = None) -> tuple[str, int, int, int]:
+    async def _run_direct_tools(
+        self,
+        goal: str,
+        on_step: StepCallback | None = None,
+        *,
+        local_csv_only: bool = False,
+    ) -> tuple[str, int, int, int]:
         """
         S193: Esegue tool direttamente via TOOL_REGISTRY senza smolagents o LLM per routing.
         Returns: 4-tuple (results_str, n_called, n_success, n_errors).
@@ -610,6 +616,10 @@ class DirectToolsMixin:
             return (_terminal_conversion, 1,
                     int(_terminal_conversion.startswith("[DIRECT_TERMINAL]")),
                     int(": errore" in _terminal_conversion or ": timeout" in _terminal_conversion))
+        # Policy ristretta: dopo il riconoscimento HTTP del CSV locale non sono
+        # ammessi altri direct tool, né fallback impliciti a immagine/rete.
+        if local_csv_only:
+            return ("[convert_csv_to_json: conversione locale non riconosciuta]", 0, 0, 1)
         _terminal_image = await _t_generate_image()
         if _terminal_image is not None:
             return (_terminal_image, 1,

api/agent.py

@@ -650,6 +650,7 @@ async def create_agent_task(body: AgentTaskIn, role: AuthRole = Depends(require_
         'session_id':        body.session_id or '',   # P17-F2: BB session key (normalize None→'')
         'forbid_tools':       _tool_policy.forbid_tools,
         'literal_response':   _tool_policy.literal_response,
+        'allow_local_csv_conversion': _tool_policy.allow_local_csv_conversion,
     }
     # Le credenziali BYOK restano in una mappa runtime separata dai metadata task
     # e non raggiungono Supabase, checkpoint o buffer SSE.
@@ -827,10 +828,15 @@ async def stream_agent_task(task_id: str, request: Request, resume: int = 0, rol
     task = _agent_tasks[task_id]
     # I task restaurati da persistenza potrebbero non contenere metadata runtime.
     # Ricostruire la policy dal goal mantiene il resume fail-closed.
-    if "forbid_tools" not in task or "literal_response" not in task:
+    if (
+        "forbid_tools" not in task
+        or "literal_response" not in task
+        or "allow_local_csv_conversion" not in task
+    ):
         _restored_policy = build_task_tool_policy(task.get("goal", ""))
         task["forbid_tools"] = _restored_policy.forbid_tools
         task["literal_response"] = _restored_policy.literal_response
+        task["allow_local_csv_conversion"] = _restored_policy.allow_local_csv_conversion
     _last_event_id = request.headers.get("Last-Event-ID") or request.headers.get("last-event-id")
     _resume_from   = int(_last_event_id) if (_last_event_id and _last_event_id.isdigit()) else resume
 
@@ -1378,6 +1384,7 @@ async def stream_agent_task(task_id: str, request: Request, resume: int = 0, rol
                     on_step=step_cb,
                     session_id=task.get('session_id', '') or '',
                     allow_tools=not bool(task.get('forbid_tools', False)),
+                    allow_local_csv_conversion=bool(task.get('allow_local_csv_conversion', False)),
                 )
                 _agent_tasks[task_id]['status'] = 'SUCCESS'
                 asyncio.create_task(sb_update_status(task_id, 'SUCCESS')).add_done_callback(_log_task_exc)

api/task_tool_policy.py

@@ -36,14 +36,33 @@ class TaskToolPolicy:
 
     forbid_tools: bool
     literal_response: str | None = None
+    # Eccezione deliberatamente stretta: una conversione CSV→JSON completamente
+    # locale può usare soltanto il percorso deterministico, non il planner né i
+    # tool generici, quando l'utente vieta rete/shell/servizi esterni.
+    allow_local_csv_conversion: bool = False
 
     def to_dict(self) -> dict[str, object]:
         return {
             "forbid_tools": self.forbid_tools,
             "literal_response": self.literal_response,
+            "allow_local_csv_conversion": self.allow_local_csv_conversion,
         }
 
 
+def _is_local_csv_conversion(goal: str) -> bool:
+    """Riconosce solo la conversione CSV→JSON già validata dal parser puro.
+
+    L'import è locale e senza side effect: riusa la grammatica dei nomi sicuri,
+    il parsing CSV rigoroso e la validazione record-per-record del percorso
+    deterministico, evitando una seconda regex di autorizzazione divergente.
+    """
+    try:
+        from agents.file_conversion import convert_csv_attachment_to_json
+        return convert_csv_attachment_to_json(goal) is not None
+    except Exception:
+        return False
+
+
 def build_task_tool_policy(goal: object) -> TaskToolPolicy:
     """Classifica solo istruzioni utente nel goal HTTP, senza inferenze LLM."""
     if not isinstance(goal, str):
@@ -53,4 +72,8 @@ def build_task_tool_policy(goal: object) -> TaskToolPolicy:
     explicit_denial = bool(_EXPLICIT_TOOL_DENIAL_RE.search(normalized))
     literal_match = _LITERAL_RESPONSE_RE.search(normalized) if explicit_denial else None
     literal = literal_match.group(1) if literal_match else None
-    return TaskToolPolicy(forbid_tools=explicit_denial, literal_response=literal)
+    return TaskToolPolicy(
+        forbid_tools=explicit_denial,
+        literal_response=literal,
+        allow_local_csv_conversion=explicit_denial and literal is None and _is_local_csv_conversion(normalized),
+    )

tests/test_task_tool_policy.py

@@ -13,21 +13,37 @@ class TaskToolPolicyTests(unittest.TestCase):
         )
         self.assertTrue(policy.forbid_tools)
         self.assertEqual(policy.literal_response, "TEST_E2E_OK")
+        self.assertFalse(policy.allow_local_csv_conversion)
 
     def test_explicit_tool_denial_without_literal_contract_stays_tool_free(self) -> None:
         policy = build_task_tool_policy("Spiega il concetto senza usare strumenti o rete.")
         self.assertTrue(policy.forbid_tools)
         self.assertIsNone(policy.literal_response)
+        self.assertFalse(policy.allow_local_csv_conversion)
+
+    def test_restricted_local_csv_conversion_is_explicitly_qualified(self) -> None:
+        policy = build_task_tool_policy(
+            "Esegui solo nel workspace VFS locale questa conversione deterministica.\n"
+            "Crea capability_catalog.csv con contenuto esatto: id,name,active\n"
+            "1,alpha,true\n2,beta,false\n"
+            ". Poi crea capability_catalog.json con lo stesso catalogo come array JSON valido di due oggetti.\n"
+            "Non usare rete, shell, servizi esterni o provider aggiuntivi."
+        )
+        self.assertTrue(policy.forbid_tools)
+        self.assertIsNone(policy.literal_response)
+        self.assertTrue(policy.allow_local_csv_conversion)
 
     def test_normal_task_remains_unrestricted(self) -> None:
         policy = build_task_tool_policy("Cerca le notizie di oggi e sintetizzale.")
         self.assertFalse(policy.forbid_tools)
         self.assertIsNone(policy.literal_response)
+        self.assertFalse(policy.allow_local_csv_conversion)
 
     def test_partial_wording_does_not_create_a_literal_contract(self) -> None:
         policy = build_task_tool_policy("Rispondi esclusivamente con una spiegazione, senza strumenti.")
         self.assertTrue(policy.forbid_tools)
         self.assertIsNone(policy.literal_response)
+        self.assertFalse(policy.allow_local_csv_conversion)
 
 
 if __name__ == "__main__":