Merge pull request #3 from skundu42/experiment/continuous-improvement

loop harness imporvements

Author: skundu42

src/noah_code/agent.py

@@ -124,6 +124,7 @@ class _PermissionSandboxedExecutor(SandboxedExecutor):
             ("ws", "read_output"),
             ("ws", "replace"),
             ("ws", "run"),
+            ("ws", "run_trusted_readonly"),
             ("ws", "search"),
             ("ws", "write"),
             ("ws", "write_file"),
@@ -469,6 +470,7 @@ def __init__(
             config.permission_rules,
             mode=config.mode,
             auto_approve=config.auto_approve,
+            yolo=config.yolo,
         )
         self._engine.mode = config.mode
         self._approvals = approvals or ApprovalBroker(
@@ -859,14 +861,22 @@ async def handle(self, notification: dict[str, list]) -> RespondResult:
         in the notification. Understand the requested end state before acting.
         Conversational questions are first-class: answer them with
         ``self.message(...)`` then return DONE. Do not emit bare assistant prose.
+        IMPORTANT: ``self.message(...)`` is SYNCHRONOUS — call it WITHOUT
+        ``await`` (``self.message("...")``). Prefixing ``await`` raises
+        ``TypeError: object NoneType can't be used in 'await' expression``
+        because it returns ``None``. All ``self.ws.*``, ``self.web.*``,
+        ``self.lsp.*``, ``self.processes.*`` calls ARE async and need ``await``.
 
         Minimal tool cookbook:
         - ``await self.ws.list("**/*.py")`` lists files.
         - ``await self.ws.search("symbol")`` returns locations as text.
         - ``match = await self.ws.read("path.py", lines=(10, 30))`` returns an
           editable Match; ``await self.ws.replace(match, "replacement")`` edits it.
         - ``await self.ws.edit("path.py", "unique old text", "new text")`` is the
-          simple string-edit form. ``await self.ws.write("new.py", content)`` creates files.
+          simple string-edit form and takes exactly three arguments (path, old,
+          new); two-argument calls are invalid. For a Match from read(), edit
+          with ``await self.ws.replace(match, "replacement")`` instead.
+          ``await self.ws.write("new.py", content)`` creates files.
         - Prefer ``await self.ws.apply_patch(changes)`` for coherent edits. Each change is
           ``{"path": ..., "old": exact_text_or_None, "new": replacement_or_None}``;
           one call validates and atomically commits the full batch.
@@ -878,6 +888,19 @@ async def handle(self, notification: dict[str, list]) -> RespondResult:
           long-running commands. Consume logs by cursor; do not poll without new work.
         - ``result = await self.ws.run("pytest -q")`` runs validation; inspect
           ``result.returncode``, ``result.stdout``, and ``result.stderr``.
+          ``read_only=True`` skips approval ONLY for commands the engine
+          recognizes as read-only (``git status/log/diff/show``, ``rg``,
+          ``grep``, ``ls``, ``find`` (no -delete/-exec), ``head``, ``tail``,
+          ``wc``, ``sed``, ``awk``, ``sort``, ``uniq``, ``cut``, ``tr``,
+          ``tac``, ``column``, ``pwd``, ``file``, ``stat``, ``test``). It is
+          REJECTED for anything else — including ``pytest``, ``uv``, ``python``,
+          and build commands — so do NOT pass ``read_only=True`` for those; run
+          them with plain ``await self.ws.run(cmd)`` (YOLO auto-approves;
+          ``--auto`` prompts).
+        - If the host was launched with ``--yolo``, every approval is granted
+          automatically without prompting. That mode exists for throwaway or
+          sandboxed environments only; do not assume it is active — write code
+          that works under normal permission gating.
         - ``await self.web.fetch(url)`` reads a page; ``await self.web.search(query)``
           searches the public web. Both are read-only and allowed by default.
         - ``await self.github.list()`` / ``view(number)`` inspect pull requests.
@@ -919,10 +942,28 @@ async def handle(self, notification: dict[str, list]) -> RespondResult:
           or mutating ``gh pr`` through the shell.
         - Do not read secrets or expose sensitive environment values.
 
+        Forbidden inside sandboxed code cells (do NOT attempt - they always fail
+        and burn turns): ``import os``, ``import sys``, ``import subprocess``,
+        ``import shutil``, ``import nooa``, ``import noah_code``, and any of
+        ``eval()``, ``exec()``, ``compile()``, ``__import__()``. If you need to
+        run shell logic or a host feature, do it with ``self.ws.run(...)``
+        (read-only shell is auto-approved), ``self.web``, ``self.lsp``, or the
+        dedicated tools - never by importing a blocked module. Use
+        ``self.ws.inspect(...)`` on Python data; do not try to reach host
+        objects from a cell.
+
         Return exactly one valid RespondResult:
         - DONE - request complete
         - NEED_INPUT - user input genuinely required
         - WAIT - a registered background job is still running
+
+        To end the turn, call ``return_result(RespondReason.DONE,
+        explanation="...")`` — ``return_result`` takes a ``RespondReason``
+        and an ``explanation`` string, NEVER a bare string as ``result=``
+        (that raises ``return_result validation error: 'result' has wrong
+        type``). To show the user text, call the synchronous
+        ``self.message("...")`` first (no ``await``), then
+        ``return_result(RespondReason.DONE, explanation="summary")``.
         """
         ...
 

src/noah_code/approvals.py

@@ -85,15 +85,6 @@ async def require(self, decision: PermissionDecision) -> None:
             raise PermissionError(
                 f"rejected [{decision.category}] {decision.target}: {decision.reason}"
             )
-        if choice == ApprovalChoice.SESSION:
-            self._engine.add_session_rule(
-                PermissionRule(
-                    category=decision.category,
-                    pattern=decision.remember_pattern,
-                    action="allow",
-                    reason="remembered for session",
-                )
-            )
 
     async def _ask(self, decision: PermissionDecision) -> ApprovalChoice:
         req_id = str(uuid.uuid4())
@@ -128,7 +119,28 @@ async def _ask(self, decision: PermissionDecision) -> ApprovalChoice:
             async def _resolve() -> None:
                 try:
                     async with self._ui_lock:
-                        choice = await handler(request)
+                        # A concurrent twin of this request may have just been
+                        # granted a session-wide allow. Re-check before putting
+                        # a second identical prompt in front of the user, and
+                        # register new session rules inside the same critical
+                        # section so queued twins observe them immediately.
+                        fresh = self._engine.decide(decision.category, decision.target)
+                        if fresh.allowed:
+                            choice = ApprovalChoice.ONCE
+                        else:
+                            choice = await handler(request)
+                            if (
+                                choice == ApprovalChoice.SESSION
+                                and not fut.done()
+                            ):
+                                self._engine.add_session_rule(
+                                    PermissionRule(
+                                        category=decision.category,
+                                        pattern=decision.remember_pattern,
+                                        action="allow",
+                                        reason="remembered for session",
+                                    )
+                                )
                 except Exception as exc:
                     if not fut.done():
                         fut.set_exception(exc)

src/noah_code/budget.py

@@ -14,6 +14,7 @@
 from __future__ import annotations
 
 import asyncio
+import math
 import threading
 import time
 from typing import Any
@@ -25,6 +26,30 @@ class BudgetExceeded(RuntimeError):
     """Raised when a configured session cap would be exceeded."""
 
 
+def _sanitize_tokens(value: Any) -> int:
+    """Garbage-proof a token count; providers occasionally report NaN/inf."""
+
+    try:
+        number = float(value)
+    except (TypeError, ValueError):
+        return 0
+    if not math.isfinite(number):
+        return 0
+    return max(int(number), 0)
+
+
+def _sanitize_cost(value: Any) -> float:
+    """Drop NaN/garbage cost, keep +inf so a broken pricing feed fails closed."""
+
+    try:
+        number = float(value)
+    except (TypeError, ValueError):
+        return 0.0
+    if math.isnan(number):
+        return 0.0
+    return max(number, 0.0)
+
+
 class BudgetGuard:
     """Thread-safe accumulator against optional token/cost/wall-clock caps."""
 
@@ -66,9 +91,9 @@ def add_usage(
         cost_usd: float = 0.0,
     ) -> None:
         with self._lock:
-            self._prompt_tokens += max(int(prompt_tokens), 0)
-            self._completion_tokens += max(int(completion_tokens), 0)
-            self._cost_usd += max(float(cost_usd), 0.0)
+            self._prompt_tokens += _sanitize_tokens(prompt_tokens)
+            self._completion_tokens += _sanitize_tokens(completion_tokens)
+            self._cost_usd += _sanitize_cost(cost_usd)
 
     def enforce(self) -> None:
         """Raise BudgetExceeded when any configured cap is breached."""
@@ -92,7 +117,7 @@ def sync_cost_usd(self, total_cost_usd: float) -> None:
         """
 
         with self._lock:
-            self._cost_usd = max(self._cost_usd, max(float(total_cost_usd), 0.0))
+            self._cost_usd = max(self._cost_usd, _sanitize_cost(total_cost_usd))
         self.enforce()
 
     def observe_cost_usd(self, total_cost_usd: float) -> None:
@@ -104,7 +129,7 @@ def observe_cost_usd(self, total_cost_usd: float) -> None:
         """
 
         with self._lock:
-            self._cost_usd = max(self._cost_usd, max(float(total_cost_usd), 0.0))
+            self._cost_usd = max(self._cost_usd, _sanitize_cost(total_cost_usd))
             if self.exceeded is None:
                 self.exceeded = self._breach()
 
@@ -143,9 +168,9 @@ def load_state(self, data: dict[str, Any] | None) -> None:
         if not data:
             return
         with self._lock:
-            self._prompt_tokens = max(int(data.get("prompt_tokens", 0)), 0)
-            self._completion_tokens = max(int(data.get("completion_tokens", 0)), 0)
-            self._cost_usd = max(float(data.get("cost_usd", 0.0)), 0.0)
+            self._prompt_tokens = _sanitize_tokens(data.get("prompt_tokens", 0))
+            self._completion_tokens = _sanitize_tokens(data.get("completion_tokens", 0))
+            self._cost_usd = _sanitize_cost(data.get("cost_usd", 0.0))
             started_at = float(data.get("started_at", time.time()))
             self._started_wall = min(started_at, time.time())
             elapsed = max(time.time() - self._started_wall, 0.0)
@@ -176,7 +201,7 @@ def _cost_from_response(response: Any, usage: dict[str, Any]) -> float:
             import litellm
 
             cost = litellm.completion_cost(completion_response=raw)
-        return max(float(cost or 0.0), 0.0)
+        return _sanitize_cost(cost)
     except Exception:  # noqa: BLE001 - pricing must never break a turn
         return 0.0
 
@@ -192,12 +217,19 @@ def _usage_from_response(response: Any) -> tuple[int, int, float]:
 
     usage = getattr(response, "usage", None)
     usage_dict = usage if isinstance(usage, dict) else {}
-    prompt = int(usage_dict.get("prompt_tokens") or usage_dict.get("input_tokens") or 0)
-    completion = int(usage_dict.get("completion_tokens") or usage_dict.get("output_tokens") or 0)
+    prompt = _sanitize_tokens(usage_dict.get("prompt_tokens") or usage_dict.get("input_tokens"))
+    completion = _sanitize_tokens(
+        usage_dict.get("completion_tokens") or usage_dict.get("output_tokens")
+    )
     cost = _cost_from_response(response, usage_dict)
     try:
         if isinstance(usage, dict):
-            usage.setdefault("cost_usd", cost)
+            existing = usage.get("cost_usd")
+            if existing is None or not math.isfinite(float(existing)):
+                # Never leave provider-reported NaN/inf on the telemetry seam.
+                usage["cost_usd"] = cost
+            else:
+                usage.setdefault("cost_usd", cost)
         elif cost > 0.0:
             response.usage = {"cost_usd": cost}
     except Exception:  # noqa: BLE001 - telemetry must never break a turn