|
| 1 | +# 347 - Python Requirements Risk Mapper |
| 2 | + |
| 3 | +```rig |
| 4 | +import { agent, p, s, defineTool, steering } from "rig"; |
| 5 | +
|
| 6 | +const classifyPackageRisk = defineTool("classifyPackageRisk", { |
| 7 | + description: "Classify a Python package's risk level based on name and version heuristics", |
| 8 | + parameters: s.object({ name: s.string, version: s.string }), |
| 9 | + handler({ name, version }) { |
| 10 | + const knownLegacy = ["django", "flask", "requests", "urllib3", "cryptography", "pillow", "numpy"]; |
| 11 | + const versionParts = version.split(".").map(Number); |
| 12 | + const major = versionParts[0] ?? 0; |
| 13 | + const isOutdated = major === 0 || (knownLegacy.includes(name.toLowerCase()) && major < 2); |
| 14 | + const riskLevel: "low" | "medium" | "high" = |
| 15 | + isOutdated && knownLegacy.includes(name.toLowerCase()) ? "high" as const |
| 16 | + : isOutdated ? "medium" as const |
| 17 | + : "low" as const; |
| 18 | + return { isOutdated, riskLevel }; |
| 19 | + }, |
| 20 | +}); |
| 21 | +
|
| 22 | +// Agent role: map Python requirements to risk levels and recommend an action. |
| 23 | +const pythonRequirementsRiskMapper = agent({ |
| 24 | + model: "small", |
| 25 | + instructions: p`requirements.txt: ${p.readOptional("requirements.txt", "# no requirements.txt found")} |
| 26 | +installed packages: ${p.bash("pip list --format=json 2>/dev/null || echo '[]'")} |
| 27 | +
|
| 28 | +For each package found in requirements.txt or the installed list, call classifyPackageRisk with its name and version. Build a packages record. Count riskyCount (medium or high risk). Choose recommendedAction: audit if any high-risk, review if any medium-risk, ok otherwise.`, |
| 29 | + output: s.object({ |
| 30 | + packages: s.record(s.object({ |
| 31 | + version: s.string, |
| 32 | + isOutdated: s.boolean, |
| 33 | + riskLevel: s.enum("low", "medium", "high"), |
| 34 | + })), |
| 35 | + totalPackages: s.int, |
| 36 | + riskyCount: s.int, |
| 37 | + recommendedAction: s.enum("audit", "review", "ok"), |
| 38 | + }), |
| 39 | + tools: [classifyPackageRisk], |
| 40 | + addons: [steering()], |
| 41 | + maxTurns: 5, |
| 42 | +}); |
| 43 | +
|
| 44 | +export default pythonRequirementsRiskMapper; |
| 45 | +``` |
0 commit comments