fix(safety): cache tool name lookup and lock custom rule registry

Avoid importing the full tools package on every filter scan, and make
the global custom-rule registry thread-safe with RLock snapshots.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Violet2314

trpc_agent_sdk/safety/_filter.py

@@ -49,6 +49,14 @@ def __init__(
         self.audit = AuditLogger(audit_path)
         self._configured_tool_name = tool_name
         self._block_on_review = (policy.block_on_review if block_on_review is None else block_on_review)
+        # Prefer lightweight context-var import; never pull trpc_agent_sdk.tools
+        # package (heavy optional deps like anthropic) on every scan.
+        self._get_tool_var = None
+        try:
+            from trpc_agent_sdk.tools._context_var import get_tool_var
+            self._get_tool_var = get_tool_var
+        except Exception:  # pylint: disable=broad-except
+            self._get_tool_var = None
 
     async def _before(self, ctx: Any, req: Any, rsp: FilterResult) -> None:
         """Scan the tool args; block execution when decision is DENY."""
@@ -98,8 +106,10 @@ async def _before(self, ctx: Any, req: Any, rsp: FilterResult) -> None:
                          f"rules={','.join(report.rule_ids)}")
 
     def _resolve_tool_name(self, ctx: Any) -> str:
+        get_tool_var = self._get_tool_var
+        if get_tool_var is None:
+            return self._configured_tool_name
         try:
-            from trpc_agent_sdk.tools import get_tool_var
             tool = get_tool_var()
             if tool is not None and getattr(tool, "name", None):
                 return tool.name

trpc_agent_sdk/safety/_scanner.py

@@ -24,20 +24,25 @@
 from ._types import ScanInput
 from ._types import max_risk_level
 
+import threading
+
 SCANNER_VERSION = "1.2.0"
 
 _custom_rules: list[SafetyRule] = []
+_custom_rules_lock = threading.RLock()
 
 
 def register_custom_rule(rule: SafetyRule) -> None:
     """Register a custom rule included in new scanners by default.
 
     Existing SafetyScanner instances are unaffected. Registration is
-    idempotent by rule_id.
+    idempotent by rule_id. Prefer passing ``rules=`` to SafetyScanner for
+    process-local isolation; the global registry is a convenience for plugins.
     """
-    global _custom_rules
-    _custom_rules = [r for r in _custom_rules if r.rule_id != rule.rule_id]
-    _custom_rules.append(rule)
+    with _custom_rules_lock:
+        global _custom_rules
+        _custom_rules = [r for r in _custom_rules if r.rule_id != rule.rule_id]
+        _custom_rules.append(rule)
 
 
 def register_rule(cls: type | None = None):
@@ -63,16 +68,23 @@ def _decorate(rule_cls: type) -> type:
 
 def unregister_custom_rule(rule_id: str) -> bool:
     """Remove a previously registered custom rule. Returns True if removed."""
-    global _custom_rules
-    before = len(_custom_rules)
-    _custom_rules = [r for r in _custom_rules if r.rule_id != rule_id]
-    return len(_custom_rules) < before
+    with _custom_rules_lock:
+        global _custom_rules
+        before = len(_custom_rules)
+        _custom_rules = [r for r in _custom_rules if r.rule_id != rule_id]
+        return len(_custom_rules) < before
 
 
 def clear_custom_rules() -> None:
     """Remove all custom rules from the registry."""
-    global _custom_rules
-    _custom_rules = []
+    with _custom_rules_lock:
+        global _custom_rules
+        _custom_rules = []
+
+
+def _snapshot_custom_rules() -> list[SafetyRule]:
+    with _custom_rules_lock:
+        return list(_custom_rules)
 
 
 class SafetyScanner:
@@ -84,7 +96,8 @@ def __init__(
         rules: Optional[list[SafetyRule]] = None,
     ):
         self.policy = policy
-        self.rules = rules if rules is not None else default_rules() + list(_custom_rules)
+        # Prefer explicit rules= for isolation; global registry is a snapshot.
+        self.rules = rules if rules is not None else default_rules() + _snapshot_custom_rules()
 
     def scan(self, scan_input: ScanInput) -> SafetyReport:
         """Scan *scan_input* and return a structured SafetyReport."""