JOJO
6ee8cda2a7
This commit introduces a substantial security and runtime architecture update for host mode, with three major goals: (1) enforce OS-level sandboxing by default, (2) support a controlled temporary direct-execution escape hatch for admin users, and (3) eliminate silent fallback behavior that could hide risk. Backend/runtime changes:\n- Added a unified host sandbox runner (macOS sandbox-exec / Linux bubblewrap+seccomp / Windows WSL2).\n- Converted host terminal creation to sandboxed interactive shells by default.\n- Kept run_command/run_python on the same execution policy and added host execution mode plumbing (sandbox|direct).\n- Added session-scoped direct mode with TTL auto-revert (default 10 minutes), configurable via environment.\n- Added execution mode APIs (GET/POST /api/execution-mode), host+admin gating, status propagation, and rate limiting.\n- Added runtime refresh hooks so tool calls honor TTL expiration and mode transitions consistently.\n- Removed docker->host silent fallback paths: docker startup/runtime failures now fail fast instead of degrading silently.\n- Added host sandbox prompt injection (host-only) to guide agent behavior under permission constraints. Configuration and policy changes:\n- Added HOST_EXECUTION_MODE_DEFAULT and HOST_EXECUTION_DIRECT_TTL_SECONDS.\n- Added HOST_SANDBOX_MACOS_WRITABLE_PATHS to support user-defined writable path allowlists.\n- Updated macOS sandbox profile generation to use minimal defaults (workspace + tmp + /dev/null) plus explicit allowlist extensions.\n- Updated .env.example documentation for new execution/sandbox controls. Frontend changes:\n- Extended permission popover to a two-column model (Permission + Execution Environment) for host admin sessions.\n- Added execution mode state/options to app state, fetching, and status synchronization flows.\n- Added execution mode switching action and user feedback toasts.\n- Kept warning emphasis via text styling only (removed warning border per UX request). Validation:\n- Python syntax checks passed for modified backend modules.\n- Existing smoke tests passed: python3 -m unittest test.test_server_refactor_smoke\n- Frontend production build passed: npm run build
68 lines
2.6 KiB
Plaintext
68 lines
2.6 KiB
Plaintext
# === API Keys ===============================================================
|
||
# 基础推理模型（必填）
|
||
AGENT_API_BASE_URL=https://api.example.com
|
||
AGENT_API_KEY=your-api-key
|
||
AGENT_MODEL_ID=deepseek-chat
|
||
|
||
# 智能思考模型（可选，留空则回退到基础模型）
|
||
AGENT_THINKING_API_BASE_URL=
|
||
AGENT_THINKING_API_KEY=
|
||
AGENT_THINKING_MODEL_ID=
|
||
|
||
# 第三方搜索（可选）
|
||
AGENT_TAVILY_API_KEY=
|
||
|
||
# 每轮最大响应 token（可选）
|
||
AGENT_DEFAULT_RESPONSE_MAX_TOKENS=32768
|
||
|
||
# === 管理员账户 ===============================================================
|
||
# 使用 `python - <<'PY' ... generate_password_hash` 生成哈希
|
||
AGENT_ADMIN_USERNAME=admin
|
||
AGENT_ADMIN_PASSWORD_HASH=
|
||
|
||
# === Web Session =============================================================
|
||
WEB_SECRET_KEY=replace-with-random-hex
|
||
|
||
# === 终端容器沙箱 =============================================================
|
||
# 模式：docker / host
|
||
TERMINAL_SANDBOX_MODE=docker
|
||
# 宿主机模式工作区配置（JSON 文件）
|
||
HOST_WORKSPACES_FILE=./config/host_workspaces.json
|
||
# 容器镜像及挂载路径
|
||
TERMINAL_SANDBOX_IMAGE=python:3.11-slim
|
||
TERMINAL_SANDBOX_MOUNT_PATH=/workspace
|
||
TERMINAL_SANDBOX_SHELL=/bin/bash
|
||
# 资源与网络限制
|
||
TERMINAL_SANDBOX_NETWORK=bridge
|
||
TERMINAL_SANDBOX_CPUS=0.5
|
||
TERMINAL_SANDBOX_MEMORY=1g
|
||
# 附加绑定目录（逗号分隔，可留空）
|
||
TERMINAL_SANDBOX_BINDS=
|
||
# 运行时路径及容器名称前缀
|
||
TERMINAL_SANDBOX_BIN=docker
|
||
TERMINAL_SANDBOX_NAME_PREFIX=agent-term
|
||
# 启动失败时是否强制报错（建议 1；当前实现中 docker 失败会直接报错）
|
||
TERMINAL_SANDBOX_REQUIRE=0
|
||
# 宿主机执行环境默认模式：sandbox / direct（建议 sandbox）
|
||
HOST_EXECUTION_MODE_DEFAULT=sandbox
|
||
# direct 模式自动回退秒数：600=10分钟，0 或 -1 表示不自动回退
|
||
HOST_EXECUTION_DIRECT_TTL_SECONDS=600
|
||
# macOS 宿主机沙箱：额外可写白名单路径（逗号分隔，默认仅工作区+/tmp）
|
||
HOST_SANDBOX_MACOS_WRITABLE_PATHS=
|
||
# 注入到容器的额外环境变量（以 TERMINAL_SANDBOX_ENV_* 命名）
|
||
# 例如：TERMINAL_SANDBOX_ENV_HTTP_PROXY=http://127.0.0.1:7890
|
||
|
||
# === 资源控制 ================================================================
|
||
PROJECT_MAX_STORAGE_MB=2048
|
||
MAX_ACTIVE_USER_CONTAINERS=8
|
||
|
||
# === MCP 工具扩展（可选） =====================================================
|
||
# 1=启用，0=禁用
|
||
MCP_TOOLS_ENABLED=1
|
||
# MCP 服务配置文件路径（默认 data/mcp_servers.json）
|
||
MCP_SERVERS_FILE=./data/mcp_servers.json
|
||
# MCP 协议版本（默认 2025-06-18）
|
||
MCP_PROTOCOL_VERSION=2025-06-18
|
||
# MCP 默认超时（秒）
|
||
MCP_DEFAULT_TIMEOUT_SECONDS=25
|