|
| 1 | +"""email-vendor-leases — Claude tool-use loop with a lease that denies send_reply. |
| 2 | +
|
| 3 | +A triage agent receives an "inbox check" task with a lease that grants |
| 4 | +read-only tools but NOT send_reply. Claude reads each message, emits a |
| 5 | +vendor-extension event per parsed message so dashboards can render |
| 6 | +them specially, and eventually decides one needs a reply. When it |
| 7 | +tries to call send_reply the lease check denies it; Claude observes |
| 8 | +the PERMISSION_DENIED tool_result and degrades to drafting the reply |
| 9 | +for human review. |
| 10 | +
|
| 11 | +Highlights: §13.4 lease violation as a *recoverable* tool_result error |
| 12 | +(not session-fatal), §15 / §8.2 x-vendor.* event-kind namespace, and |
| 13 | +a realistic Claude tool-use loop that handles a deny without crashing. |
| 14 | +""" |
| 15 | + |
| 16 | +from __future__ import annotations |
| 17 | + |
| 18 | +import asyncio |
| 19 | +import os |
| 20 | +from typing import Any |
| 21 | + |
| 22 | +import anthropic |
| 23 | + |
| 24 | +from arcp import PermissionDeniedError, RuntimeInfo, serve_websocket |
| 25 | +from arcp.runtime import ARCPRuntime, JobContext, StaticBearerVerifier |
| 26 | + |
| 27 | +PORT = int(os.environ.get("ARCP_DEMO_PORT", "7900")) |
| 28 | +TOKEN = os.environ.get("ARCP_DEMO_TOKEN", "demo-token") |
| 29 | + |
| 30 | +TOOLS = [ |
| 31 | + { |
| 32 | + "name": "inbox_list", |
| 33 | + "description": "List recent unread messages.", |
| 34 | + "input_schema": {"type": "object", "properties": {}}, |
| 35 | + }, |
| 36 | + { |
| 37 | + "name": "inbox_read", |
| 38 | + "description": "Read one message by id.", |
| 39 | + "input_schema": { |
| 40 | + "type": "object", |
| 41 | + "properties": {"id": {"type": "string"}}, |
| 42 | + "required": ["id"], |
| 43 | + }, |
| 44 | + }, |
| 45 | + { |
| 46 | + "name": "send_reply", |
| 47 | + "description": "Send a reply to a message.", |
| 48 | + "input_schema": { |
| 49 | + "type": "object", |
| 50 | + "properties": {"id": {"type": "string"}, "body": {"type": "string"}}, |
| 51 | + "required": ["id", "body"], |
| 52 | + }, |
| 53 | + }, |
| 54 | +] |
| 55 | + |
| 56 | +# stand-in inbox so the recipe is self-contained — swap for IMAP/Gmail in real use |
| 57 | +INBOX = { |
| 58 | + "m1": {"id": "m1", "from": "ops@acme.dev", "subject": "Status", "body": "All quiet.", "urgency": "low"}, |
| 59 | + "m2": {"id": "m2", "from": "ceo@acme.dev", "subject": "Outage!", "body": "Site is down — fix asap.", "urgency": "high"}, |
| 60 | +} |
| 61 | + |
| 62 | + |
| 63 | +async def run_tool(name: str, args: dict[str, Any]) -> Any: |
| 64 | + if name == "inbox_list": |
| 65 | + return [{"id": m["id"], "subject": m["subject"], "from": m["from"]} for m in INBOX.values()] |
| 66 | + if name == "inbox_read": |
| 67 | + return INBOX[args["id"]] |
| 68 | + raise RuntimeError(f"tool {name} should have been denied before reaching run_tool") |
| 69 | + |
| 70 | + |
| 71 | +async def triage_agent(_input: dict, ctx: JobContext) -> dict: |
| 72 | + client = anthropic.AsyncAnthropic() |
| 73 | + messages: list[dict[str, Any]] = [ |
| 74 | + { |
| 75 | + "role": "user", |
| 76 | + "content": "Triage my inbox. Read each unread message and reply to anything urgent.", |
| 77 | + } |
| 78 | + ] |
| 79 | + |
| 80 | + # tool-use loop: Claude proposes a tool call, we authorize against the |
| 81 | + # lease, run it (or surface a denial), feed the result back, repeat. |
| 82 | + while True: |
| 83 | + turn = await client.messages.create( |
| 84 | + model="claude-sonnet-4-6", |
| 85 | + max_tokens=1024, |
| 86 | + tools=TOOLS, |
| 87 | + messages=messages, |
| 88 | + ) |
| 89 | + |
| 90 | + if turn.stop_reason == "end_turn": |
| 91 | + text = next((b.text for b in turn.content if b.type == "text"), "") |
| 92 | + return {"drafted_reply": text, "sent": False} |
| 93 | + |
| 94 | + # append the assistant turn so the next call has full context |
| 95 | + messages.append({"role": "assistant", "content": [b.model_dump() for b in turn.content]}) |
| 96 | + tool_results: list[dict[str, Any]] = [] |
| 97 | + |
| 98 | + for block in turn.content: |
| 99 | + if block.type != "tool_use": |
| 100 | + continue |
| 101 | + |
| 102 | + await ctx.tool_call({"tool_call_id": block.id, "tool": block.name, "args": block.input}) |
| 103 | + |
| 104 | + try: |
| 105 | + # the lease grants tool.call only for the read-only tools; the |
| 106 | + # send_reply pattern is absent so this raises PermissionDenied |
| 107 | + ctx.authorize("tool.call", block.name) |
| 108 | + except PermissionDeniedError as err: |
| 109 | + # surface the denial on the ARCP stream as a recoverable error... |
| 110 | + await ctx.tool_result( |
| 111 | + { |
| 112 | + "tool_call_id": block.id, |
| 113 | + "error": {"code": err.code, "message": str(err), "retryable": False}, |
| 114 | + } |
| 115 | + ) |
| 116 | + # ...and hand it to Claude as the tool result so the model can |
| 117 | + # recover gracefully — lease violations are not session-fatal |
| 118 | + tool_results.append( |
| 119 | + { |
| 120 | + "type": "tool_result", |
| 121 | + "tool_use_id": block.id, |
| 122 | + "content": f"denied: {err}", |
| 123 | + "is_error": True, |
| 124 | + } |
| 125 | + ) |
| 126 | + continue |
| 127 | + |
| 128 | + result = await run_tool(block.name, block.input) |
| 129 | + if block.name == "inbox_read": |
| 130 | + # vendor-extension event — dashboards that recognise the |
| 131 | + # x-vendor.acme.* namespace render parsed metadata specially |
| 132 | + await ctx.job.emit_event( |
| 133 | + "x-vendor.acme.email.parsed", |
| 134 | + { |
| 135 | + "message_id": result["id"], |
| 136 | + "from": result["from"], |
| 137 | + "subject": result["subject"], |
| 138 | + "urgency": result["urgency"], |
| 139 | + }, |
| 140 | + ) |
| 141 | + await ctx.tool_result({"tool_call_id": block.id, "output": result}) |
| 142 | + tool_results.append( |
| 143 | + {"type": "tool_result", "tool_use_id": block.id, "content": str(result)} |
| 144 | + ) |
| 145 | + |
| 146 | + messages.append({"role": "user", "content": tool_results}) |
| 147 | + |
| 148 | + |
| 149 | +async def main() -> None: |
| 150 | + runtime = ARCPRuntime( |
| 151 | + runtime=RuntimeInfo(name="email-triage", version="1.0.0"), |
| 152 | + bearer=StaticBearerVerifier({TOKEN: "demo-principal"}), |
| 153 | + ) |
| 154 | + runtime.register_agent("triage", triage_agent) |
| 155 | + server = await serve_websocket(runtime.accept, host="127.0.0.1", port=PORT, path="/arcp") |
| 156 | + print(f"listening on ws://127.0.0.1:{PORT}/arcp") |
| 157 | + try: |
| 158 | + await asyncio.Future() |
| 159 | + finally: |
| 160 | + server.close() |
| 161 | + await server.wait_closed() |
| 162 | + await runtime.close() |
| 163 | + |
| 164 | + |
| 165 | +if __name__ == "__main__": |
| 166 | + asyncio.run(main()) |
0 commit comments