JOJO
8257e4d34d
- docker：只读/审批档 run_command、后台命令与持久终端改用非特权 uid(10001) 执行角色，内核 DAC 强制只读，取代文本特征识别；Dockerfile 加固（agent 用户 / git safe.directory / 去 setuid） - macOS：只读与可写沙箱 profile 统一为白名单读模型（deny default + 系统目录/工作区/路径授权），修复 deny 顺序导致的工作区 .env 实际可读漏洞；可写 profile 白名单化后审批不再放大读取，越界读取唯一途径为路径授权 - 权限模式：受限档（readonly/approval/auto_approval）与 direct 执行环境硬互斥——进入受限档压回沙箱并记录，切回 unrestricted 恢复，存量受限+direct 对话加载自愈矫正 - 配置：路径授权来源收敛为 host_sandbox_policy.json + 环境变量两个通道（移除 settings.json 映射） - 修复：新建对话权限模式被个性化默认值覆盖、/new 切只读后回落无限制的继承 bug - 原生文件工具读边界与沙箱白名单同源对齐
98 lines
3.7 KiB
Python
98 lines
3.7 KiB
Python
"""终端与会话管理配置。"""
|
||
|
||
import os
|
||
|
||
MAX_TERMINALS = 3
|
||
TERMINAL_BUFFER_SIZE = 100000
|
||
TERMINAL_DISPLAY_SIZE = 50000
|
||
TERMINAL_TIMEOUT = 300
|
||
TERMINAL_OUTPUT_WAIT = 5
|
||
TERMINAL_SNAPSHOT_DEFAULT_LINES = 50
|
||
TERMINAL_SNAPSHOT_MAX_LINES = 200
|
||
TERMINAL_SNAPSHOT_MAX_CHARS = 6000000
|
||
TERMINAL_INPUT_MAX_CHARS = 50000
|
||
|
||
|
||
def _parse_bindings(raw_value: str):
|
||
items = []
|
||
for chunk in raw_value.split(","):
|
||
chunk = chunk.strip()
|
||
if not chunk:
|
||
continue
|
||
items.append(chunk)
|
||
return items
|
||
|
||
|
||
def _parse_paths(raw_value: str):
|
||
items = []
|
||
for chunk in (raw_value or "").split(","):
|
||
chunk = chunk.strip()
|
||
if not chunk:
|
||
continue
|
||
items.append(chunk)
|
||
return items
|
||
|
||
|
||
_env_prefix = "TERMINAL_SANDBOX_ENV_"
|
||
TERMINAL_SANDBOX_MODE = os.environ.get("TERMINAL_SANDBOX_MODE", "host").lower()
|
||
TERMINAL_SANDBOX_IMAGE = os.environ.get("TERMINAL_SANDBOX_IMAGE", "python:3.11-slim")
|
||
TERMINAL_SANDBOX_MOUNT_PATH = os.environ.get("TERMINAL_SANDBOX_MOUNT_PATH", "/workspace")
|
||
TERMINAL_SANDBOX_SHELL = os.environ.get("TERMINAL_SANDBOX_SHELL", "/bin/bash")
|
||
TERMINAL_SANDBOX_NETWORK = os.environ.get("TERMINAL_SANDBOX_NETWORK", "bridge")
|
||
TERMINAL_SANDBOX_CPUS = os.environ.get("TERMINAL_SANDBOX_CPUS", "")
|
||
TERMINAL_SANDBOX_MEMORY = os.environ.get("TERMINAL_SANDBOX_MEMORY", "")
|
||
TERMINAL_SANDBOX_BINDS = _parse_bindings(os.environ.get("TERMINAL_SANDBOX_BINDS", ""))
|
||
TERMINAL_SANDBOX_BIN = os.environ.get("TERMINAL_SANDBOX_BIN", "docker")
|
||
TERMINAL_SANDBOX_NAME_PREFIX = os.environ.get("TERMINAL_SANDBOX_NAME_PREFIX", "agent-term")
|
||
TERMINAL_SANDBOX_ENV = {
|
||
key[len(_env_prefix):]: value
|
||
for key, value in os.environ.items()
|
||
if key.startswith(_env_prefix)
|
||
}
|
||
TERMINAL_SANDBOX_REQUIRE = os.environ.get("TERMINAL_SANDBOX_REQUIRE", "0") not in {"0", "false", "False"}
|
||
LINUX_SAFETY = os.environ.get("LINUX_SAFETY", "0") not in {"0", "false", "False"}
|
||
TOOLBOX_TERMINAL_IDLE_SECONDS = int(os.environ.get("TOOLBOX_TERMINAL_IDLE_SECONDS", "900"))
|
||
MAX_ACTIVE_USER_CONTAINERS = int(os.environ.get("MAX_ACTIVE_USER_CONTAINERS", "8"))
|
||
HOST_EXECUTION_MODE_DEFAULT = os.environ.get("HOST_EXECUTION_MODE_DEFAULT", "sandbox").strip().lower()
|
||
# 沙箱可写路径的「部署通道」（逗号分隔）。路径授权只有两个来源：
|
||
# config/host_sandbox_policy.json（前端「路径授权」UI）+ 本变量（真·环境变量），
|
||
# 两者合并去重（见 modules/host_sandbox_policy.py::get_macos_writable_paths）。
|
||
# settings.json 的 terminal.macos_writable_paths 映射已于 2026-08-30 移除；
|
||
# .env 注入技术上仍会生效，但不是受支持的配置通道（不推荐使用）。
|
||
HOST_SANDBOX_MACOS_WRITABLE_PATHS = _parse_paths(
|
||
os.environ.get("HOST_SANDBOX_MACOS_WRITABLE_PATHS", "")
|
||
)
|
||
HOST_SANDBOX_NETWORK_PERMISSION = os.environ.get(
|
||
"HOST_SANDBOX_NETWORK_PERMISSION", "restricted"
|
||
).strip().lower()
|
||
|
||
__all__ = [
|
||
"MAX_TERMINALS",
|
||
"TERMINAL_BUFFER_SIZE",
|
||
"TERMINAL_DISPLAY_SIZE",
|
||
"TERMINAL_TIMEOUT",
|
||
"TERMINAL_OUTPUT_WAIT",
|
||
"TERMINAL_SNAPSHOT_DEFAULT_LINES",
|
||
"TERMINAL_SNAPSHOT_MAX_LINES",
|
||
"TERMINAL_SNAPSHOT_MAX_CHARS",
|
||
"TERMINAL_INPUT_MAX_CHARS",
|
||
"TERMINAL_SANDBOX_MODE",
|
||
"TERMINAL_SANDBOX_IMAGE",
|
||
"TERMINAL_SANDBOX_MOUNT_PATH",
|
||
"TERMINAL_SANDBOX_SHELL",
|
||
"TERMINAL_SANDBOX_NETWORK",
|
||
"TERMINAL_SANDBOX_CPUS",
|
||
"TERMINAL_SANDBOX_MEMORY",
|
||
"TERMINAL_SANDBOX_BINDS",
|
||
"TERMINAL_SANDBOX_BIN",
|
||
"TERMINAL_SANDBOX_NAME_PREFIX",
|
||
"TERMINAL_SANDBOX_ENV",
|
||
"TERMINAL_SANDBOX_REQUIRE",
|
||
"LINUX_SAFETY",
|
||
"TOOLBOX_TERMINAL_IDLE_SECONDS",
|
||
"MAX_ACTIVE_USER_CONTAINERS",
|
||
"HOST_EXECUTION_MODE_DEFAULT",
|
||
"HOST_SANDBOX_MACOS_WRITABLE_PATHS",
|
||
"HOST_SANDBOX_NETWORK_PERMISSION",
|
||
]
|