使用 Gemma 4 实现简易代理工具调用

# 安全：限制 list_directory_contents 只能在该基础目录及其子目录中操作
# 在脚本启动时设置为当前工作目录
SAFE_BASE_DIR = os.path.abspath(os.getcwd())

def list_directory_contents(path: str = ".") -> str:
    """列出路径下的文件和目录，限定在安全基础目录内"""
    try:
        # 将路径解析为绝对路径，并确认其位于 SAFE_BASE_DIR 内部
        # 此方法阻止诸如 '../../etc' 或绝对路径 '/' 的遍历尝试
        requested = os.path.abspath(os.path.join(SAFE_BASE_DIR, path))
        if not (requested == SAFE_BASE_DIR or requested.startswith(SAFE_BASE_DIR + os.sep)):
            return (
                f"错误：访问被拒绝。路径 '{path}' 解析到了允许的工作区之外 "
                f"({SAFE_BASE_DIR})。"
            )
        ...

entries = sorted(os.listdir(requested))
        if not entries:
            return f"The directory '{path}' is empty."

        lines = [f"Contents of '{path}' ({len(entries)} item(s)):"]
        for name in entries:
            full = os.path.join(requested, name)
            if os.path.isdir(full):
                lines.append(f"  [DIR]  {name}/")
            else:
                try:
                    size = os.path.getsize(full)
                    lines.append(f"  [FILE] {name} ({size} bytes)")
                except OSError:
                    lines.append(f"  [FILE] {name}")
        return "\n".join(lines)

{
    "type": "function",
    "function": {
        "name": "list_directory_contents",
        "description": (
            "Lists files and subdirectories inside a path within the user's workspace. "
            "Use this to inspect the environment before answering questions about local files."
        ),
        "parameters": {
            "type": "object",
            "properties": {
                "path": {
                    "type": "string",
                    "description": (
                        "A relative path inside the workspace, e.g. '.', 'data', or 'src/utils'. "
                        "Defaults to the workspace root."
                    )
                }
            },
            "required": []
        }
    }
}

def execute_python_code(code: str) -> str:
    """Executes a snippet of Python code and returns whatever was printed to stdout.

    This is a learning-only sandbox. exec() is fundamentally unsafe; do not expose this tool
    to untrusted users or networks. The restrictions below stop the casual cases, not a 
    determined attacker.
    """
    try:
        # A minimal restricted environment. We strip __builtins__ down to a small
        # whitelist so that, e.g., open(), eval(), and __import__ are not directly
        # available from the snippet's global scope.
        safe_builtins = {
            "abs": abs, "all": all, "any": any, "bool": bool, "dict": dict,
            "divmod": divmod, "enumerate": enumerate, "filter": filter, "float": float,
            "int": int, "len": len, "list": list, "map": map, "max": max, "min": min,
            "pow": pow, "print": print, "range": range, "repr": repr, "reversed": reversed,
            "round": round, "set": set, "sorted": sorted, "str": str, "sum": sum,
            "tuple": tuple, "zip": zip,
        }
        # Pre-import a couple of safe, useful modules so the model doesn't have to.
        import math, statistics
        restricted_globals = {
            "__builtins__": safe_builtins,
            "math": math,
            "statistics": statistics,
        }

# Capture stdout so we can hand the printed output back to the model
        buffer = io.StringIO()
        with contextlib.redirect_stdout(buffer):
            exec(code, restricted_globals, {})

        output = buffer.getvalue().strip()
        if not output:
            return "Code executed successfully but produced no output. Use print() to return a value."
        return f"Output:\n{output}"

if "tool_calls" in message and message["tool_calls"]:
    print("[TOOL EXECUTION]")
    messages.append(message)

    num_tools = len(message["tool_calls"])
    for i, tool_call in enumerate(message["tool_calls"]):
        function_name = tool_call["function"]["name"]
        arguments = tool_call["function"]["arguments"]
        ...
        if function_name in TOOL_FUNCTIONS:
            func = TOOL_FUNCTIONS[function_name]
            try:
                result = func(**arguments)
                ...
                messages.append({
                    "role": "tool",
                    "content": str(result),
                    "name": function_name
                })

def _short(v):
    if isinstance(v, str):
        flat = v.replace("\n", "\\n")
        if len(flat) > 60:
            flat = flat[:57] + "..."
        return f"'{flat}'"
    return str(v)

args_str = ", ".join(f"{k}={_short(v)}" for k, v in arguments.items())

[SYSTEM]
  ○ Tool: execute_python_code......................[LOADED]
  ○ Tool: list_directory_contents..................[LOADED]
  ○ Workspace: /Users/matt/projects/gemma_agent.....[SANDBOXED]

[PROMPT]
What scripts are in my current folder, and which one looks like it should be used to process CSVs?

[EXECUTION]
  ● Querying model...

[TOOL EXECUTION]
  └── Calling: list_directory_contents
     ├─ Args: path='.'
     └─ Result: Contents of '.' (5 item(s)):
                  [FILE] README.md (412 bytes)
                  [FILE] csv_cleaner.py (1834 bytes)
                  [FILE] main.py (10786 bytes)
                  [FILE] notes.txt (88 bytes)
                  [FILE] sales_report.py (2210 bytes)

[EXECUTION]
  ● Synthesizing results...

[RESPONSE]
Your current folder contains five files. The one that looks intended for CSV
processing is csv_cleaner.py — its name strongly suggests it handles CSV input.
sales_report.py may also touch CSV data, but its name is more about output than
ingestion.

[SYSTEM]
  ○ Tool: execute_python_code......................[LOADED]
  ○ Tool: list_directory_contents..................[LOADED]
  ○ Workspace: /Users/matt/projects/gemma_agent.....[SANDBOXED]

[PROMPT]
What is the standard deviation of the numbers 12, 18, 23, 24, 29, 31, 35, 41, 44, 47, rounded to four decimal places?

[EXECUTION]
  ● Querying model...

[TOOL EXECUTION]
  └── Calling: execute_python_code
     ├─ Args: code='nums = [12, 18, 23, 24, 29, 31, 35, 41, 44, 47]\nprint(rou...'
     └─ Result: Output:
                11.4659

[EXECUTION]
  ● Synthesizing results...

[RESPONSE]
The standard deviation of those numbers, rounded to four decimal places, is 11.4659.

[SYSTEM]
  ○ Tool: execute_python_code......................[LOADED]
  ○ Tool: list_directory_contents..................[LOADED]
  ○ Workspace: /Users/matt/projects/gemma_agent.....[SANDBOXED]

[PROMPT]
Look at the files in the current folder and tell me the total size in kilobytes, rounded to two decimal places.

[EXECUTION]
  ● Querying model...

[TOOL EXECUTION]
  ┌── Calling: list_directory_contents
  │  ├─ Args: path='.'
  │  └─ Result: Contents of '.' (5 item(s)):
  │              [FILE] README.md (412 bytes)
  │              [FILE] csv_cleaner.py (1834 bytes)
  │              [FILE] main.py (10786 bytes)
  │              [FILE] notes.txt (88 bytes)
  │              [FILE] sales_report.py (2210 bytes)
  │
  └── Calling: execute_python_code
     ├─ Args: code='sizes = [412, 1834, 10786, 88, 2210]\nprint(round(sum(siz...'
     └─ Result: Output:
                15.33

[EXECUTION]
  ● Synthesizing results...

[RESPONSE]
The five files in the current folder total 15.33 KB.