JOJO
6ee8cda2a7
This commit introduces a substantial security and runtime architecture update for host mode, with three major goals: (1) enforce OS-level sandboxing by default, (2) support a controlled temporary direct-execution escape hatch for admin users, and (3) eliminate silent fallback behavior that could hide risk. Backend/runtime changes:\n- Added a unified host sandbox runner (macOS sandbox-exec / Linux bubblewrap+seccomp / Windows WSL2).\n- Converted host terminal creation to sandboxed interactive shells by default.\n- Kept run_command/run_python on the same execution policy and added host execution mode plumbing (sandbox|direct).\n- Added session-scoped direct mode with TTL auto-revert (default 10 minutes), configurable via environment.\n- Added execution mode APIs (GET/POST /api/execution-mode), host+admin gating, status propagation, and rate limiting.\n- Added runtime refresh hooks so tool calls honor TTL expiration and mode transitions consistently.\n- Removed docker->host silent fallback paths: docker startup/runtime failures now fail fast instead of degrading silently.\n- Added host sandbox prompt injection (host-only) to guide agent behavior under permission constraints. Configuration and policy changes:\n- Added HOST_EXECUTION_MODE_DEFAULT and HOST_EXECUTION_DIRECT_TTL_SECONDS.\n- Added HOST_SANDBOX_MACOS_WRITABLE_PATHS to support user-defined writable path allowlists.\n- Updated macOS sandbox profile generation to use minimal defaults (workspace + tmp + /dev/null) plus explicit allowlist extensions.\n- Updated .env.example documentation for new execution/sandbox controls. Frontend changes:\n- Extended permission popover to a two-column model (Permission + Execution Environment) for host admin sessions.\n- Added execution mode state/options to app state, fetching, and status synchronization flows.\n- Added execution mode switching action and user feedback toasts.\n- Kept warning emphasis via text styling only (removed warning border per UX request). Validation:\n- Python syntax checks passed for modified backend modules.\n- Existing smoke tests passed: python3 -m unittest test.test_server_refactor_smoke\n- Frontend production build passed: npm run build
91 lines
3.2 KiB
Python
91 lines
3.2 KiB
Python
"""终端与会话管理配置。"""
|
|
|
|
import os
|
|
|
|
MAX_TERMINALS = 3
|
|
TERMINAL_BUFFER_SIZE = 100000
|
|
TERMINAL_DISPLAY_SIZE = 50000
|
|
TERMINAL_TIMEOUT = 300
|
|
TERMINAL_OUTPUT_WAIT = 5
|
|
TERMINAL_SNAPSHOT_DEFAULT_LINES = 50
|
|
TERMINAL_SNAPSHOT_MAX_LINES = 200
|
|
TERMINAL_SNAPSHOT_MAX_CHARS = 6000000
|
|
TERMINAL_INPUT_MAX_CHARS = 50000
|
|
|
|
|
|
def _parse_bindings(raw_value: str):
|
|
items = []
|
|
for chunk in raw_value.split(","):
|
|
chunk = chunk.strip()
|
|
if not chunk:
|
|
continue
|
|
items.append(chunk)
|
|
return items
|
|
|
|
|
|
def _parse_paths(raw_value: str):
|
|
items = []
|
|
for chunk in (raw_value or "").split(","):
|
|
chunk = chunk.strip()
|
|
if not chunk:
|
|
continue
|
|
items.append(chunk)
|
|
return items
|
|
|
|
|
|
_env_prefix = "TERMINAL_SANDBOX_ENV_"
|
|
TERMINAL_SANDBOX_MODE = os.environ.get("TERMINAL_SANDBOX_MODE", "docker").lower()
|
|
TERMINAL_SANDBOX_IMAGE = os.environ.get("TERMINAL_SANDBOX_IMAGE", "python:3.11-slim")
|
|
TERMINAL_SANDBOX_MOUNT_PATH = os.environ.get("TERMINAL_SANDBOX_MOUNT_PATH", "/workspace")
|
|
TERMINAL_SANDBOX_SHELL = os.environ.get("TERMINAL_SANDBOX_SHELL", "/bin/bash")
|
|
TERMINAL_SANDBOX_NETWORK = os.environ.get("TERMINAL_SANDBOX_NETWORK", "bridge")
|
|
TERMINAL_SANDBOX_CPUS = os.environ.get("TERMINAL_SANDBOX_CPUS", "")
|
|
TERMINAL_SANDBOX_MEMORY = os.environ.get("TERMINAL_SANDBOX_MEMORY", "")
|
|
TERMINAL_SANDBOX_BINDS = _parse_bindings(os.environ.get("TERMINAL_SANDBOX_BINDS", ""))
|
|
TERMINAL_SANDBOX_BIN = os.environ.get("TERMINAL_SANDBOX_BIN", "docker")
|
|
TERMINAL_SANDBOX_NAME_PREFIX = os.environ.get("TERMINAL_SANDBOX_NAME_PREFIX", "agent-term")
|
|
TERMINAL_SANDBOX_ENV = {
|
|
key[len(_env_prefix):]: value
|
|
for key, value in os.environ.items()
|
|
if key.startswith(_env_prefix)
|
|
}
|
|
TERMINAL_SANDBOX_REQUIRE = os.environ.get("TERMINAL_SANDBOX_REQUIRE", "0") not in {"0", "false", "False"}
|
|
LINUX_SAFETY = os.environ.get("LINUX_SAFETY", "0") not in {"0", "false", "False"}
|
|
TOOLBOX_TERMINAL_IDLE_SECONDS = int(os.environ.get("TOOLBOX_TERMINAL_IDLE_SECONDS", "900"))
|
|
MAX_ACTIVE_USER_CONTAINERS = int(os.environ.get("MAX_ACTIVE_USER_CONTAINERS", "8"))
|
|
HOST_EXECUTION_MODE_DEFAULT = os.environ.get("HOST_EXECUTION_MODE_DEFAULT", "sandbox").strip().lower()
|
|
HOST_EXECUTION_DIRECT_TTL_SECONDS = int(os.environ.get("HOST_EXECUTION_DIRECT_TTL_SECONDS", "600"))
|
|
HOST_SANDBOX_MACOS_WRITABLE_PATHS = _parse_paths(
|
|
os.environ.get("HOST_SANDBOX_MACOS_WRITABLE_PATHS", "")
|
|
)
|
|
|
|
__all__ = [
|
|
"MAX_TERMINALS",
|
|
"TERMINAL_BUFFER_SIZE",
|
|
"TERMINAL_DISPLAY_SIZE",
|
|
"TERMINAL_TIMEOUT",
|
|
"TERMINAL_OUTPUT_WAIT",
|
|
"TERMINAL_SNAPSHOT_DEFAULT_LINES",
|
|
"TERMINAL_SNAPSHOT_MAX_LINES",
|
|
"TERMINAL_SNAPSHOT_MAX_CHARS",
|
|
"TERMINAL_INPUT_MAX_CHARS",
|
|
"TERMINAL_SANDBOX_MODE",
|
|
"TERMINAL_SANDBOX_IMAGE",
|
|
"TERMINAL_SANDBOX_MOUNT_PATH",
|
|
"TERMINAL_SANDBOX_SHELL",
|
|
"TERMINAL_SANDBOX_NETWORK",
|
|
"TERMINAL_SANDBOX_CPUS",
|
|
"TERMINAL_SANDBOX_MEMORY",
|
|
"TERMINAL_SANDBOX_BINDS",
|
|
"TERMINAL_SANDBOX_BIN",
|
|
"TERMINAL_SANDBOX_NAME_PREFIX",
|
|
"TERMINAL_SANDBOX_ENV",
|
|
"TERMINAL_SANDBOX_REQUIRE",
|
|
"LINUX_SAFETY",
|
|
"TOOLBOX_TERMINAL_IDLE_SECONDS",
|
|
"MAX_ACTIVE_USER_CONTAINERS",
|
|
"HOST_EXECUTION_MODE_DEFAULT",
|
|
"HOST_EXECUTION_DIRECT_TTL_SECONDS",
|
|
"HOST_SANDBOX_MACOS_WRITABLE_PATHS",
|
|
]
|