Áj&dZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl m Z m Z ddlmZmZmZmZmZmZddlmZmZddlmZddlmZdd lmZdd lmZm Z dd l!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'ddl(Z(ddl)Z(dd l*m+Z+d dl,m-Z-m.Z.ddl/m0Z0m1Z1ddl2m3Z3ddl4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:d dl;mZ>m?Z?m@Z@erddlAmBZBgdZCdZDdZEdZFeFZGdZHdZIeHZJeIZKddddddd ZLdZMd!ZNd"ZOd#ZPejd$ZReFfd@d%ZSe jd&ZUdAd'ZVdBd(ZWdCd)ZXdDd*ZYe Gd+d,ZZd-Z[ejejfZ^dEd.Z_dFd/Z`dGd0ZaGd1d2eZbGd3d4ZcdHd5ZddId6ZedHd7ZfdHd8ZgdHd9ZhdJd:ZidKd;ZjdHd<ZkdHd=ZldLd>ZmdMd?Zny)Nu>Reference implementations of the ``agent_toolset_20260401`` tools — ``bash``, ``read``, ``write``, ``edit``, ``glob``, ``grep`` — plus the workdir/skills :class:`AgentToolContext`. This sits next to the other ``lib/tools`` helpers (the Messages tool runner, the memory tool, …). Importing it pulls in ``subprocess`` etc., so it is kept out of ``anthropic.lib.tools.__init__`` — depend on it explicitly (``from anthropic.lib.tools.agent_toolset import beta_agent_toolset_20260401``). The result of :func:`beta_agent_toolset_20260401` is a plain ``list[BetaAsyncFunctionTool]`` — *async* function tools, so it is for the **async** runners only: ``client.beta.sessions.events.tool_runner(...)`` (the ``SessionToolRunner``, always async) for a managed-agents session, or — via the :class:`~anthropic.lib.environments.EnvironmentWorker` — the self-hosted environment worker. The sync ``Anthropic`` ``messages.tool_runner`` accepts ``BetaRunnableTool``, which excludes the async function tools this returns, so it cannot consume this toolset. .. warning:: ``bash`` is **stateful**: it owns a persistent ``/bin/bash`` subprocess that is only torn down by its ``close`` cleanup hook. Only ``SessionToolRunner`` (and the ``EnvironmentWorker`` built on it) invoke that hook. The Messages ``client.beta.messages.tool_runner(...)`` does **not** call ``close``, so handing this toolset to the Messages tool runner leaks the bash subprocess (one orphaned shell per run). Run stateful tools under ``client.beta.sessions.events.tool_runner(...)`` / the environment worker, or drop ``bash`` from the toolset before using the Messages tool runner. Trust model: the file tools confine to ``workdir`` (symlink-aware) and are safe without a sandbox; ``bash`` is unrestricted and should run inside one. See :class:`AgentToolContext`. ) annotationsN)S_ISLNKS_ISREG) TYPE_CHECKINGAnyListOptional NamedTuplecast)Path PurePosixPath)partial)islice)asynccontextmanager)field dataclass)MappingCallableIterableIterator Awaitable AsyncIterator)run_sync)_withindownload_session_skills)NotGiven not_givenis_given).BetaManagedAgentsAgentToolset20260401BashInput.BetaManagedAgentsAgentToolset20260401EditInput.BetaManagedAgentsAgentToolset20260401GlobInput.BetaManagedAgentsAgentToolset20260401GrepInput.BetaManagedAgentsAgentToolset20260401ReadInput/BetaManagedAgentsAgentToolset20260401WriteInput) ToolError BetaContentBetaAsyncFunctionToolBetaFunctionToolResultTypebeta_async_tool)AsyncAnthropic) AgentToolContext BashSession BashResult resolve_pathbeta_agent_toolset_20260401beta_bash_toolbeta_read_toolbeta_write_toolbeta_edit_toolbeta_glob_toolbeta_grep_toolig^@iiPi@z image/pngz image/jpegz image/gifz image/webpapplication/pdf)z.pngz.jpgz.jpegz.gifz.webpz.pdfiiPz\x1b\[[0-9;?]*[ -/]*[@-~]c t|r|S|S)uResolve a configured cap to an effective size limit. ``not_given`` selects ``default``; ``None`` disables the size check (uncapped); a positive int is the cap. Governs only the size guard — callers still reject non-regular files. r ) configureddefaults H/tmp/pip-target-k_scjv0h/lib/python/anthropic/lib/tools/agent_toolset.py_resolve_max_bytesr?s"*-::7:z!anthropic.lib.tools.agent_toolsetctjjDcic]\}}|jdr||c}}Scc}}w)uThe environment for the bash subprocess, with the runner's own credentials scrubbed. The bash tool runs model-issued commands, so it must never inherit the runner's ``ANTHROPIC_*`` variables (API key, environment key, per-work session tokens): a prompt-injected ``echo $ANTHROPIC_API_KEY`` would otherwise land the credential straight in the session transcript. Passing an explicit ``env`` to :class:`AgentToolContext` does NOT add to this default — it FULLY REPLACES it. The provided mapping becomes the entire bash environment verbatim; nothing here is merged in, so callers who want the scrubbed process environment plus extras must build that mapping themselves. ANTHROPIC_)osenvironitems startswith)kvs r>_default_bash_envrIs8 ZZ--/ RTQq||L7QAqD RR Rs AAc$t|tryt|tryt|tryt|tryt|t ry|j t jk(ry|jxsdjS)a2Map a filesystem ``OSError`` to a consistent, runtime-independent phrase. The raw ``OSError`` string is platform-specific (``[Errno 2] ENOENT: ...``) and can embed a host path; normalise the common cases so the model sees the same wording everywhere and never the runner's absolute paths. zno such file or directoryznot a directoryzis a directoryzpermission deniedzfile already existsz!too many levels of symbolic linksz i/o error) isinstanceFileNotFoundErrorNotADirectoryErrorIsADirectoryErrorPermissionErrorFileExistsErrorerrnoELOOPstrerrorlower)es r> _fs_reasonrVss!&'*!'( !&'!_%"!_%$ww%++2 JJ %+ , , ..r@c :t|d|dt|S)N: )r(rV)op file_pathrUs r> _fs_errorr[s" t2i[:a=/: ;;r@cgSNr^r@r>_empty_skill_dirsr_s Ir@ceZdZUdZeej Zded<dZ ded<dZ d ed <dZ d ed <dZ d ed<e Zded<e Zded<e Zded<edddZded<eeddZded<ddZd dZd dZd dZd!dZd"dZy)#r.uO Workdir + path-policy for the agent toolset. Trust model — two tiers: - The file tools (:func:`beta_read_tool`, :func:`beta_write_tool`, :func:`beta_edit_tool`, :func:`beta_glob_tool`, :func:`beta_grep_tool`) resolve paths against ``workdir`` and reject escapes unless ``unrestricted_paths`` is set. :func:`resolve_path` follows every symlink (including the leaf, even a dangling one) before the check and returns that canonical path for the operation, so a symlink inside the workdir that points outside it can neither pass the check nor be followed afterwards — a real boundary, consistent with the memory tool, so the file tools are safe to use without a sandbox. - :func:`beta_bash_tool` runs an unrestricted ``/bin/bash`` regardless of ``unrestricted_paths``. Confinement for it must come from the OS layer (e.g. a self-hosted environment runner). Attributes: workdir: Base directory for resolving relative tool paths. Defaults to :func:`os.getcwd` captured when the context is constructed (TS parity: ``process.cwd()`` at construction), so a ``chdir`` between constructing this context and the first tool call does not move where paths resolve. Pass an explicit path to override. unrestricted_paths: When ``False`` (default), the file tools reject paths that resolve outside ``workdir``. Does **not** constrain :func:`beta_bash_tool`. env: Optional environment for the bash subprocess. When unset, the bash tool inherits the process environment with the runner's ``ANTHROPIC_*`` credentials scrubbed. When provided, it FULLY REPLACES that default environment — the mapping is used verbatim and is NOT merged with or added to the scrubbed process environment. To keep the defaults plus extra vars, build the combined mapping yourself before passing it. max_file_bytes: Size cap for the ``read`` and ``edit`` tools, which both load the whole file into memory. ``not_given`` (default) uses the built-in 256 KiB cap; a positive int sets a custom cap; ``None`` disables the cap entirely. Disabling it reintroduces the OOM risk on a model-controlled path, so pass ``None`` only when the sandbox can absorb arbitrarily large files. The non-regular-file (FIFO/device) guard always applies regardless of this value. Image/PDF files, which ``read`` returns as base64 content blocks, are not subject to the 256 KiB default (``max_image_base64_bytes`` / ``max_pdf_bytes`` govern instead), but an explicit positive cap binds them too. max_image_base64_bytes: Cap on the *base64-encoded* size of an image ``read`` returns as a content block. ``not_given`` (default) uses the built-in 5 MiB cap — a memory bound plus the API's per-image limit; a positive int overrides it; ``None`` disables it (only ``max_file_bytes`` / the API's own limit then apply). max_pdf_bytes: Cap on the raw size of a PDF ``read`` returns as a document block. ``not_given`` (default) uses the built-in 20 MiB cap; a positive int overrides it; ``None`` disables it. )default_factorystr | os.PathLike[str]workdirFboolunrestricted_pathsNzAsyncAnthropic | Noneclientz str | None session_idOptional[Mapping[str, str]]envint | None | NotGivenmax_file_bytesmax_image_base64_bytes max_pdf_bytes)r=initreprzBashSession | None_bash)rarnro list[Path] _skill_dirscK|j8tj|j|jd{|_|jS7wNri)rpr/startrcriselfs r>bashzAgentToolContext.bash sB :: *004880LLDJzzMs;AAAc|K|j*|jjd{d|_yy7 wr])rpcloserws r>r{zAgentToolContext.closes5 :: !**""$ $ $DJ " $s *<:<cK|j |jyt|j|j|jd{|_y7 w)zDownload the session agent's skills into ``{workdir}/skills//``. No-op unless both :attr:`client` and :attr:`session_id` are set. The download + safe archive extraction lives in :mod:`anthropic.lib.tools._skills`. N)rgrc)rfrgrrcrrrws r> setup_skillszAgentToolContext.setup_skillssG ;; $//"9 !8QUQ`Q`jnjvjv!wwwsA A A AcK|jD]0} tttj|dd{2g|_y7#t $r!}t jd||Yd}~bd}~wwxYww)uRemove the skill directories :meth:`setup_skills` downloaded. Only the directories this context created are removed — a pre-existing ``{workdir}/skills`` tree is left untouched. T) ignore_errorsNz,failed to remove downloaded skill dir %s: %s)rrrrshutilrmtree Exceptionlogwarning)rx skill_dirrUs r>_cleanup_skillsz AgentToolContext._cleanup_skillssv )) ZI Zwv}}itTUUU Z V Z JIWXYY Zs>A9(A A A  A9 A  A6A1,A91A66A9cBK|jd{|S7wr])r}rws r> __aenter__zAgentToolContext.__aenter__,s"!!!  "s cK |jd{|jd{y77#|jd{7wxYwwr])r{r)rxexcs r> __aexit__zAgentToolContext.__aexit__0sG )**,  &&( ( (  ($&&( ( (s?A959A7A9AA AAAreturnr/rNone)rr.)robjectrr)__name__ __module__ __qualname____doc__rrCgetcwdrc__annotations__rerfrgrirrkrlrmrpr_rrryr{r}rrrr^r@r>r.r.s4r',BII&FG #F$$%)F !(!J !'+C $+,5N)54=1=+4M(4 %dU KE K$4EEX]^K^  x )r@r.(cxttjtjtjSr])OSErrorrQrRrCrSr^r@r>_symlink_loop_errorr;s 5;; EKK 8 99r@c Pttjjt |}g}d} |j dj t|S#t$r tdt$r}|jtvr|}Yd}~nd}~wwxYw ttj|j}n_#t$rS}|jtvs|j |k(r|j#|j$|j }Yd}~d}~wwxYw|s||dz }|t&kDr tttjjtjj)|j tj*|}q)u>Return ``path`` with ``.``/``..`` collapsed lexically and every symlink followed, or raise ``OSError`` — the same outcome on every supported Python, and never a partly resolved path. Trailing components that do not exist yet are kept as spelled, so a new file under new directories still canonicalises; a dangling symlink met on the way is read and followed by hand, and more than ``_MAX_SYMLINK_HOPS`` such hops count as a loop. Non-strict ``Path.resolve()`` is avoided because its symlink-loop handling differs between CPython versions. rT)strictNr)r rCpathnormpathstrresolvejoinpathreversed RuntimeErrorrrrQ_MISSING_ERRNOSrlstatst_modeparentappendname_MAX_SYMLINK_HOPSjoinreadlink)rprefix missing_tailhopsrU unresolved is_symlinks r> _canonicalizer?sS"''""3t9- .F L D  76>>>.77,9OP P 2%'T 1 wwo-J   &!1!9!9:J wwo-&1H    ,]]F        # #%' 'bgg&&rww||FMM2;;vCV'WXY/ s0'A B<BB(C D$A DD$c Jt|}t|jj} t|j r|n||z }|jst||st d|d|S#t $r }t d|dt||d}~wwxYw)u"Resolve ``p`` against the workdir; reject results that escape it. Absolute and relative inputs go through the same canonicalise-then-contain check — an absolute path that lands inside the workdir is permitted, only paths that resolve *outside* are rejected. ``.`` and ``..`` components are collapsed lexically first; then every symlink (including the leaf, even a dangling one) is followed before the containment check, so a symlink under the workdir that targets ``/etc`` is rejected — and the resolved path is what the tool then operates on, so it can't be followed afterwards either. A symlink loop or an unreadable component rejects the path outright rather than falling back to an unresolved path. See the trust model on :class:`AgentToolContext`. zpath rXNz escapes workdir) r rcrr is_absoluter ValueErrorrVrer)ctxp candidaterootfullrUs r>r1r1gsQI   $ $ &D@)*?*?*AYtiGWX  ! !'$*=5%5677 K @5R 1 78a?@s A99 B"BB"c(eZdZUdZded< ded<y)r0uResult of :meth:`BashSession.exec` — the captured output and exit code. A ``NamedTuple`` so it unpacks positionally (``out, code = await s.exec(...)``) and reads by name (``result.output`` / ``result.exit_code``) interchangeably. routputint exit_codeN)rrrrrr^r@r>r0r0s K?N8r@r0cVeZdZdZd dZeddd dZed dZe fd dZ d dZ y)r/uA persistent ``/bin/bash`` process; cwd, env and jobs survive across calls. .. warning:: :class:`BashSession` is **stateful and not safe to share concurrently**. Interleaved :meth:`exec` calls would race for the same stdin/stdout pipes (mixed input, output read by the wrong caller, and corrupted sentinel detection). Each :class:`AgentToolContext` creates its own session, so the safe pattern is *one context per session* — never a single ``AgentToolContext`` (or hand-constructed ``BashSession``) shared across multiple sessions running on different self-hosted environments. Holding the shared instance behind a per-call lock would serialize all bash work and is almost certainly not what you want. c||_y)uUse :meth:`BashSession.start` to construct — ``__init__`` takes an already-spawned process and is intended for internal use.N)_proc)rxprocs r>__init__zBashSession.__init__s  r@Nruc K| t|n t}tjgd|i|ddddtj tj tj d{}||S7 w)N)z /bin/bashz --noprofilez--norcdumb)PS1PS2TERM)cwdristdinstdoutstderr)dictrIanyio open_process subprocessPIPESTDOUT)clsrcribasers r>rvzBashSession.startsmOtCy1B1D'' 2>4>2v>//??$$   4y sA*A;,A9- A;c2|jjduS)uWhether the underlying bash process has exited / been torn down. Inverse of "alive". Named ``closed`` (not ``alive``) to match the TS ``BashSession.closed`` boolean — porting code between the two SDKs should not have to flip the sense of this check. N)r returncoderws r>closedzBashSession.closedszz$$D00r@cK|jr td|jj|jjJ|jj}|jjdt j jd}|ddd|dd}d|d|d}|j|jd{td |jdfd } tj|5|d{dddt"j%dj'd} | j)|} | dkrt+| j-dS| d| j/d} | | t1|zdj-} | rt3| j5dnd} rd| z} t+| | S77#1swYxYw#t$rZ}tjd 5|jd{7dddn #1swYnxYwtd |d|d}~wtj $rFtjd 5|jd{7ddd#1swYxYwwxYw#t6$rd} YwxYww)Nz)bash session terminated; restart required __ANT_CMD__DONE__z''z{ z } &1; printf '\nz %d\n' $? FcK jdd{}|syj|t t kDrdt t z =dvry]7G#tj$rYywxYww)NTi)receiver EndOfStreamextendlenBASH_OUTPUT_LIMIT)chunkbufmarkerr truncateds r>read_until_sentinelz-BashSession.exec..read_until_sentinels"(.."66E 5!s8//:c#h):::; $IS=6((s8A=A$A"A$AA="A$$A:7A=9A::A=Tshieldzbash command timed out after srreplaceerrorsr z[output truncated] r)rrrrruuiduuid4hexsendencode bytearrayr fail_after TimeoutError CancelScoper{get_cancelled_exc_class_ANSIsubdecoderfindr0striprstriprr splitlinesr)rxcmdtimeoutrsentinelsentinel_splitwrappedrrUtextidxouttailcoderrrrs @@@@r>execzBashSession.execs ;;JK Kzz+ 0A0A0MMM   ""  0 019$RaL>HQRL>:u=n=M[Yjj)***k "  $ !!'* ,)+++ ,.yySZZyZ9:jj" 7djjlB/ /4Cj%C#h-')*002 043t(+,"D (3.C#t$$y +4, , , R""$/ #jjl"" # # #!>wiqIJPQ Q,,. ""$/ #jjl"" #  #  , D sC K G')K =G8 G,G*G,"G8*B K 4 J9K *G,,G51G88 J6IH:+H.,H:1 I:I ?I0J6J)JJ) J6)J2 .J66K 9 KK KK cK|jjLtjd5 |jjj d{ddd|jj Z|jjtjd5|jjd{dddtjd5 |jj d{dddy7#t $rYwxYw#1swYxYw7l#1swYkxYw78#t $rYAwxYw#1swYyxYww)NTr) rrrracloserrkill move_on_afterwaitrws r>r{zBashSession.closes' ::   '""$/ ****11333  :: ( JJOO $$Q' (jjoo''' (   d +  jj'')))  4   ( ( (*    s-E D)'DDDA E *D7D5 D7 E +E-E E E E D D&#D)%D&&D))D2.E 5D77E<E E EEEEEE )rzanyio.abc.Processrr)rcrbrirhrr/)rrd)rrrfloatrr0r) rrrrr classmethodrvpropertyrBASH_DEFAULT_TIMEOUTr r{r^r@r>r/r/sI  `d  115IJ%Xr@r/cltdfd }tdttt|S)NcKddfd  d dfd } |jd{yy7#jd{7wwxYww)z)Run a command in a persistent bash shell.Nc~K3tjjjd{S7wrt)r/rvrcri)rsessionsr>_sessionz3beta_bash_tool..bash_tool.._session$s7 + 1 1#++377 1 KKNLs 1=;=cxK|r,  jd{d d{y|s td|r|dz nt} d{}|j||d{\}}|dk7r t||S7p7a787#tt f$r}td||d}~wwxYww)Nzbash session restartedzbash: command is requiredg@@)rzbash: r)r{r(rr rr) commandrestart timeout_msrrrr rUrrs r>ryz/beta_bash_tool..bash_tool..bash-s&!--/))"Gj  / ;<<-7j6)=QG 5"*$"#&&'&"BB Tqyn$J* %B ,/ 5& -14 5sgB:B B:BB: BBB2B3B:B:B:BBB7#B22B77B:r)NNN)r Optional[str]rOptional[bool]rz Optional[int]rr)r{)ryrrrs @@r> bash_toolz!beta_bash_tool..bash_tools'+ hl " 4B Wd   , &J"mmo%%#%"mmo%%#s1A$AA$AA$A!AA!!A$ryr input_schema)rz,AsyncIterator[Callable[..., Awaitable[str]]])rr,r"r r)rr!s` r>r3r3s>,&,&f ? C  3  r@c |dk(rt|jt}n&t|jt}||dzdznd}t |j r0|j $| |j nt||j }|||kDrtd|d|d|dtj|jjd }|dk(r d d d|d d Sdd tt||d d S)uRead an image/PDF as a base64 ``image``/``document`` content block. The text cap does not apply here — its 256 KiB default would reject most real images. Instead the media caps (``max_image_base64_bytes`` / ``max_pdf_bytes``, defaulting to the API's own limits) govern, checked against the stat size before opening (same OOM rationale as the text path) and tightened by an *explicitly* configured ``max_file_bytes`` — an explicit cap is a memory bound and binds every read. r9Nrread:  is  bytes, exceeds z -byte limit for image/PDF files.asciidocumentbase64)type media_typedata)r,sourceimage)r?rmDEFAULT_MAX_PDF_BYTESrlDEFAULT_MAX_IMAGE_BASE64_BYTESr!rkminr(r+standard_b64encode read_bytesrr r)targetrZsizer-rlimitb64_capr.s r>_read_binary_blockr:Ts &&"3#4#46KL$S%?%?A_`&-&9A"t""#(:(:(F&+m""UCDVDV9W TE\& 4v5EeWLlmnn  $ $V%6%6%8 9 @ @ ID&&"xO`jn.opp#4Z3HRVW r@c>tdtddfd }|S)Nreadr"c K t |} |j}t |j std|dt j|jj}|'|r tdt|||j| gSt j}|.|j|kDrtd|d|jd|d|jd }|s|St%|d k7r td |\}} |j'd} t)d|dz } | dkDr| n t%| } dj+| | | S#t$r}td||d}~wwxYw#t$rt$r}td|d |d}~wt $r}t#d |||d}~wwxYww)z,Read a file rooted at the working directory.r&N: not a regular filez5read: view_range is not supported for image/PDF filesr'r(z6-byte limit. Use bash (head/tail/sed) to read a slice.utf-8encodingzQ: not valid UTF-8 text (binary files are only supported for image/PDF extensions)r<r z/read: view_range must be [start_line, end_line]rrr)r1rr(statrr_BINARY_MEDIA_TYPESgetsuffixrTr:st_sizer?rk read_textUnicodeDecodeErrorrr[rsplitmaxr)rZ view_ranger6rUstr-r8r start_lineend_linelinesrvendrs r>r<zbeta_read_tool..readrs 1!#y1F 9B2::&& 3G HII,001D1D1FGJ%#$[\\*69bjj*VYZ[[&s'9'9:E RZZ%%7YKtBJJ<7GwO@@ ##W#5DK z?a MN N) H 4 AzA~&"Q,hCJyyuS)**S 1fQCL)q 0 12  !  #tu  9FIq1q 8 9s`F? EB E;F?AE;3A(F? E8$E33E88F?;F< F F<)F77F<<F?r])rZrrKzOptional[List[int]]rr+)r,r&)rr<s` r>r4r4qs&&/]^-+_-+^ Kr@c<tdtdfd }|S)Nwriter"c(K t|} |jj dd|j |ddt|d |S#t$r}td||d}~wwxYw#t $r}td|||d}~wwxYww) z4Write a file, creating parent directories as needed.zwrite: NT)parentsexist_okr?r@rRzwrote z bytes to ) r1rr(rmkdir write_textrr[r)rZcontentr6rUrs r>rRzbeta_write_tool..writes 2!#y1F : MM  t  <   g  8G ~Z {;; 2gaSM* 1 2  :GY2 9 :sEB A0A3B A0A++A00B3 B<B  BB)rZrrXrrr)r,r')rrRs` r>r5r5s%'0_` <a < Lr@c>tdtddfd }|S)Neditr"c TK t |} |j}t |j std|dt j}|.|j|kDrtd|d|jd|d|jd}|j|} | d k(rtd ||s| d kDrtd| d|d|r|j||n|j||d } |j| dd|d|r| dSd dS#t$r}td||d}~wwxYw#t$rt$r}td|d |d}~wt$r}td |||d}~wwxYw#t$r}td |||d}~wwxYww)z-Replace text in a file by exact string match.zedit: Nr>r'r(z5-byte limit. Use bash (sed/awk) to edit a large file.r?r@z1: not valid UTF-8 text (cannot edit binary files)rZrzedit: old_string not found in rzedit: old_string appears z times in z (must be unique)zedited z (z replacement(s)))r1rr(rBrrr?rkrFrGrHrr[countrrW) rZ old_string new_string replace_allr6rUrLr8rr\updatedrs r>rZzbeta_edit_tool..edits 1!#y1F 9 B2::&& 3G HII&s'9'9:E RZZ%%7YKtBJJ<7GwO??##W#5D :& A:r6r6s(&/]^%T_%TN Kr@cV |jjS#t$rYywxYw)Ng)rBst_mtimer)rs r>_mtime_or_zerorcs+vvx   s  ((c#rK|D]} t|}t||s|!y#t$rY.wxYww)zYield the matches whose canonical path is inside ``root``; a match that cannot be canonicalised (symlink loop, unreadable) is dropped, not raised.N)rrr)matchesrmatch canonicals r> _confinedrhsJ %e,I 9d #K    s 7 ( 77 4747c>tdtddfd }|S)Nglobr"c Kd}t|jr4js tdtd}|j d}nqjs"dt |j vr td|r t|}n#tjj}|}js|} tt|j|t}|tt!||}|sy|j#t$d d j'd |dt(DS#t$r}td||d}~wwxYw#ttf$r}td||d}~wwxYww) z1List files matching a glob pattern, newest first.Nz$glob: absolute pattern not permitted/z..z*glob: '..' is not permitted in the patternzglob: no matchesT)keyreverserc32K|]}t|ywr])r).0ms r> z/beta_glob_tool..glob..sEAQEs)r rrer(lstripr partsr1rrcrlistrrjWALK_MAX_ENTRIESrrhsortrcrGLOB_RESULT_LIMIT)patternrconfinerpatrUrers r>rjzbeta_glob_tool..globsp#' = $ $ &)) FGG9D..%C ))dmG6L6R6R.R LMM9'T2DCKK(002C)) 16$))C.2BCDG  9Wg67G  6yyE1C2C)DEEE+"9#fQCL1q89G$ 1fQCL)q 0 1sOBF D=4F(E-AF= EEEFF,E;;FFr]rzrrrrr)r,r$)rrjs` r>r7r7s(&/]^&F_&FP Kr@c>tdtddfd }|S)Ngrepr"c K |r t|n"tjj}t jdx}rtj|ddd|dt|gd d{}|jd k(ry |jd k7r(t d |jjd|jjd}t|t kDr|dt dt dz}|S t#j$|}t)||S#t$r}t d||d}~wwxYw7#t"j&$r}t d||d}~wwxYww)z.Search file contents for a regular expression.zgrep: Nrgz-nz --no-headingz-ez--F)checkrrmrzgrep: rg failed: rrz [output truncated at  bytes]zgrep: invalid regex: )r1r rcrrr(rwhichr run_processrrrrrrGREP_OUTPUT_LIMITrecompileerror _walk_grep) rzrsearchrUrresultrrxrs r>rzbeta_grep_tool..grep$s~ 104\#t,$s{{:K:S:S:UFd# #2 #!,,T>4$F LF  A%#  A%"3FMM4H4HPY4H4Z3[ \]]--&&i&8C3x++,,-2IJ[I\\c0ddJ @G$B"f%%/ 1fQCL)q 0 1 xx @3A378a ? @sYE51D)AE57E 8BE5E  E5) E2EEE5 E2E--E22E5r]r})r,r%)rrs` r>r8r8#s%&/]^&_&: Kr@c g t d fd d fd }|jr ||nd}tj|D]\}}}|Dcgc]&}|dvst ||z j r%|(c}|dd|D]P}t ||z } | j r"|dz }|t kDs || r9 rdj ndccS rdj SdScc}w) Nct|dzzdkrjdtdyj|y)Nrrz[output truncated at rFT)rrr)linebudgethitss r>pushz_walk_grep..pushIsF#d)a- A: KK/0A/B'J K Dr@c  |jd5}d|jdvr dddy|jdt|dD]e\}}t |t kDr|j djd }j|sL|d |d |r]dddy  dddy#1swYyxYw#t$rYywxYw) NrbiTrrrrz :F) openr<seek enumeraterGREP_MAX_LINE_LENGTHrrrr)rfirawrrrs r>scanz_walk_grep..scanRs 4 %AaffSk) % %q '1o%FAs3x"66 ::Y:7>>vFDyyttfAaS$4H/I$ % %% % %   sQC CC A(CC,C-C 6C8C C C C CCr)z.git node_modulesrrrm)rrrrd)rr rrd)ris_filerCwalkr rrwr) rrrseendirpathdirnames filenamesdrrrrrs ` @@@r>rrEsD F&~~ V ,.GGFO E (GXy$q0H'HRVW^R_bcRcQoQoQqHQK" EG}t+??$ **$t*.2499T? D E  E#499T?4 4s C3 C3=C3c~t|t|t|t|t |t |gS)uReturn the ``agent_toolset_20260401`` implementations bound to ``ctx``. The result is a plain list of :class:`~anthropic.lib.tools.BetaAsyncFunctionTool` instances — *async* function tools, so it is for the **async** runners only: the ``AsyncAnthropic`` ``client.beta.messages.tool_runner`` and ``client.beta.sessions.events.tool_runner`` (always async). The sync ``Anthropic`` ``messages.tool_runner`` takes ``BetaRunnableTool``, which excludes the async function tools this returns. Filter or extend it before passing it on:: tools = [*beta_agent_toolset_20260401(ctx), my_custom_tool] tools = [t for t in beta_agent_toolset_20260401(ctx) if t.name != "grep"] )r3r4r5r6r7r8)rs r>r2r2{s> sssss  r@)r<rjr=rrz int | None)rzdict[str, str])rUrrr)rYrrZrrUrrr()rrq)rr)rr rr )rr.rrrr )rr.rzBetaAsyncFunctionTool[Any]) r6r rZrr7rr-rrr.rr))rr rr)rezIterable[Path]rr rzIterator[Path])rzre.Pattern[str]rr rr)rr.rz list[BetaAsyncFunctionTool[Any]])or __future__rrCrrrQr+rloggingrrBrrtypingrrrr r r pathlibr r functoolsr itertoolsr contextlibr dataclassesrrcollections.abcrrrrrrr anyio.abcanyio.to_threadr_skillsrr_typesrr_utilsr! types.betar"r#r$r%r&r'_beta_functionsr(r)r*r+r,_clientr-__all__rrDEFAULT_MAX_FILE_BYTESREAD_MAX_BYTESr2r1READ_IMAGE_MAX_BASE64_BYTESREAD_PDF_MAX_BYTESrCrrryrwrrr? getLoggerrrIrVr[r_r.rENOENTENOTDIRrrrr1r0r/r3r:r4r5r6rcrhr7r8rr2r^r@r>rsB# !GG'*([[ $5)) #'"1(<*        /0J`;g;<S"/,< u)u) u)p<</:%ZP2 8 8 FFR8v:1h$)X *ZD35lr@