@aalis/plugin-code-sandbox-os 0.5.2 → 0.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +24 -0
- package/dist/index.d.ts +8 -8
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +17 -14
- package/dist/index.js.map +1 -1
- package/package.json +8 -6
package/README.md
ADDED
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
# @aalis/plugin-code-sandbox-os
|
|
2
|
+
|
|
3
|
+
代码沙箱（OS 原生）：Linux bubblewrap / macOS sandbox-exec 隔离不可信代码执行
|
|
4
|
+
|
|
5
|
+
## 安装
|
|
6
|
+
|
|
7
|
+
```bash
|
|
8
|
+
pnpm add @aalis/plugin-code-sandbox-os
|
|
9
|
+
```
|
|
10
|
+
|
|
11
|
+
## 提供 / 依赖
|
|
12
|
+
|
|
13
|
+
`definePlugin` 默认导出：
|
|
14
|
+
|
|
15
|
+
- provides：`codeSandbox`（服务名 `code-sandbox`）
|
|
16
|
+
- uses：`processService`（`process`）、`logger`、`provide`
|
|
17
|
+
|
|
18
|
+
## 文档
|
|
19
|
+
|
|
20
|
+
详见 [docs/plugins/plugin-code-sandbox-os.md](../../docs/plugins/plugin-code-sandbox-os.md)。
|
|
21
|
+
|
|
22
|
+
## 许可
|
|
23
|
+
|
|
24
|
+
见仓库根目录 LICENSE。
|
package/dist/index.d.ts
CHANGED
|
@@ -1,9 +1,9 @@
|
|
|
1
|
-
import type
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
}
|
|
8
|
-
export
|
|
1
|
+
import { type ProcessService } from '@aalis/api-process';
|
|
2
|
+
import { type Logger } from '@aalis/core';
|
|
3
|
+
declare const _default: import("@aalis/core").PluginDefinition<{
|
|
4
|
+
processService: import("@aalis/core").ServiceDescriptor<ProcessService, import("@aalis/core").ServiceRef<ProcessService>>;
|
|
5
|
+
logger: import("@aalis/core").ServiceDescriptor<(identity: symbol) => Logger, Logger>;
|
|
6
|
+
provide: import("@aalis/core").ServiceDescriptor<(identity: symbol) => import("@aalis/core").Provide, import("@aalis/core").Provide>;
|
|
7
|
+
}>;
|
|
8
|
+
export default _default;
|
|
9
9
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,OAAO,EAAyC,KAAK,cAAc,EAAkB,MAAM,oBAAoB,CAAC;AAChH,OAAO,EAAgB,KAAK,MAAM,EAAmB,MAAM,aAAa,CAAC;;;;;;AAoDzE,wBAeG"}
|
package/dist/index.js
CHANGED
|
@@ -5,14 +5,10 @@
|
|
|
5
5
|
// **经现有 `process` 服务网关** spawn（不碰 process-api / process-local 的实现，
|
|
6
6
|
// 也不直接 import node:child_process / node:fs——OS 探测靠经网关功能性试跑）。
|
|
7
7
|
// ============================================================
|
|
8
|
-
import {
|
|
8
|
+
import { codeSandbox } from '@aalis/api-code-sandbox';
|
|
9
|
+
import { createProcessGateway, processService } from '@aalis/api-process';
|
|
10
|
+
import { definePlugin, logger, provide } from '@aalis/core';
|
|
9
11
|
import { wrapForSandbox } from './sandbox.js';
|
|
10
|
-
export const name = '@aalis/plugin-code-sandbox-os';
|
|
11
|
-
export const displayName = '代码沙箱（OS）';
|
|
12
|
-
export const provides = ['code-sandbox'];
|
|
13
|
-
export const inject = {
|
|
14
|
-
required: ['process'],
|
|
15
|
-
};
|
|
16
12
|
/**
|
|
17
13
|
* 功能性探测：经 process 网关真正跑一次最小沙箱命令，跑通才算可用。
|
|
18
14
|
* 比「命令是否存在」更强——一次覆盖 存在性 + Linux unprivileged userns 是否真能用。
|
|
@@ -60,11 +56,18 @@ class OsCodeSandboxService {
|
|
|
60
56
|
return this.proc.execFile(wrapped.cmd, wrapped.args, { cwd: req.cwd, timeout: req.timeout });
|
|
61
57
|
}
|
|
62
58
|
}
|
|
63
|
-
export
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
59
|
+
export default definePlugin({
|
|
60
|
+
name: '@aalis/plugin-code-sandbox-os',
|
|
61
|
+
displayName: '代码沙箱（OS）',
|
|
62
|
+
provides: [codeSandbox],
|
|
63
|
+
uses: { processService, logger, provide },
|
|
64
|
+
async apply(caps) {
|
|
65
|
+
const log = caps.logger.child('code-sandbox-os');
|
|
66
|
+
// 网关每次调用重新解析当前胜者，process 提供者换人后无需重启本插件
|
|
67
|
+
const proc = createProcessGateway(caps.processService);
|
|
68
|
+
const backend = await probeBackend(proc, log);
|
|
69
|
+
caps.provide(codeSandbox, new OsCodeSandboxService(proc, backend));
|
|
70
|
+
log.info(`code-sandbox-os 就绪（后端: ${backend === 'none' ? '无 —— 沙箱不可用，code_runner 将 fail-closed' : backend}）`);
|
|
71
|
+
},
|
|
72
|
+
});
|
|
70
73
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,yDAAyD;AACzD,EAAE;AACF,0DAA0D;AAC1D,mEAAmE;AACnE,6DAA6D;AAC7D,+DAA+D;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,yDAAyD;AACzD,EAAE;AACF,0DAA0D;AAC1D,mEAAmE;AACnE,6DAA6D;AAC7D,+DAA+D;AAE/D,OAAO,EAA2B,WAAW,EAA0B,MAAM,yBAAyB,CAAC;AACvG,OAAO,EAAE,oBAAoB,EAAwC,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAChH,OAAO,EAAE,YAAY,EAAe,MAAM,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAuB,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnE;;;GAGG;AACH,KAAK,UAAU,YAAY,CAAC,IAAoB,EAAE,MAAc;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,6BAA6B,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtG,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAClG,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,8CAA8C,CAAC,CAAC;QAC1E,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,MAAM,CAAC,IAAI,CAAC,wBAAwB,QAAQ,0CAA0C,CAAC,CAAC;QACxF,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,oBAAoB;IAEL;IACA;IAFnB,YACmB,IAAoB,EACpB,QAAwB;QADxB,SAAI,GAAJ,IAAI,CAAgB;QACpB,aAAQ,GAAR,QAAQ,CAAgB;IACxC,CAAC;IAEJ,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC;IAClC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAsB;QAC9B,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACrG,0EAA0E;QAC1E,uDAAuD;QACvD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/F,CAAC;CACF;AAED,eAAe,YAAY,CAAC;IAC1B,IAAI,EAAE,+BAA+B;IACrC,WAAW,EAAE,UAAU;IACvB,QAAQ,EAAE,CAAC,WAAW,CAAC;IACvB,IAAI,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE;IACzC,KAAK,CAAC,KAAK,CAAC,IAAI;QACd,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACjD,uCAAuC;QACvC,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACnE,GAAG,CAAC,IAAI,CACN,0BAA0B,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,OAAO,GAAG,CACnG,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@aalis/plugin-code-sandbox-os",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.6.0",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -24,21 +24,23 @@
|
|
|
24
24
|
"dist"
|
|
25
25
|
],
|
|
26
26
|
"dependencies": {
|
|
27
|
-
"@aalis/api-code-sandbox": ">=0.
|
|
28
|
-
"@aalis/api-process": ">=0.
|
|
27
|
+
"@aalis/api-code-sandbox": ">=0.6.0 <1.0.0",
|
|
28
|
+
"@aalis/api-process": ">=0.7.0 <1.0.0"
|
|
29
29
|
},
|
|
30
30
|
"devDependencies": {
|
|
31
31
|
"@types/node": "^22.0.0",
|
|
32
32
|
"typescript": "^5.7.0",
|
|
33
|
-
"@aalis/core": "0.
|
|
33
|
+
"@aalis/core": "0.17.0"
|
|
34
34
|
},
|
|
35
35
|
"peerDependencies": {
|
|
36
|
-
"@aalis/core": ">=0.
|
|
36
|
+
"@aalis/core": ">=0.17.0 <1.0.0"
|
|
37
37
|
},
|
|
38
38
|
"aalis": {
|
|
39
39
|
"service": {
|
|
40
40
|
"required": [
|
|
41
|
-
"
|
|
41
|
+
"logger",
|
|
42
|
+
"process",
|
|
43
|
+
"provide"
|
|
42
44
|
],
|
|
43
45
|
"provides": [
|
|
44
46
|
"code-sandbox"
|