@aalis/plugin-tool-code-runner 0.1.2 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.ts +5 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +43 -4
- package/dist/index.js.map +1 -1
- package/dist/runner.d.ts +10 -0
- package/dist/runner.d.ts.map +1 -1
- package/dist/runner.js +31 -5
- package/dist/runner.js.map +1 -1
- package/package.json +11 -6
package/dist/index.d.ts
CHANGED
|
@@ -8,6 +8,7 @@ export declare const inject: {
|
|
|
8
8
|
service: string;
|
|
9
9
|
capabilities: string[];
|
|
10
10
|
})[];
|
|
11
|
+
optional: string[];
|
|
11
12
|
};
|
|
12
13
|
export declare const configSchema: ConfigSchema;
|
|
13
14
|
export declare const defaultConfig: {
|
|
@@ -23,6 +24,10 @@ export declare const defaultConfig: {
|
|
|
23
24
|
maxTimeout: number;
|
|
24
25
|
maxOutputSize: number;
|
|
25
26
|
workingDirectory: string;
|
|
27
|
+
sandbox: {
|
|
28
|
+
mode: string;
|
|
29
|
+
network: string;
|
|
30
|
+
};
|
|
26
31
|
};
|
|
27
32
|
export declare function apply(ctx: Context, config: Record<string, unknown>): void;
|
|
28
33
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAOzD,OAAO,yBAAyB,CAAC;AAIjC,eAAO,MAAM,IAAI,mCAAmC,CAAC;AACrD,eAAO,MAAM,WAAW,mCAAU,CAAC;AACnC,eAAO,MAAM,SAAS,UAAU,CAAC;AACjC,eAAO,MAAM,MAAM;;;;;;CAGlB,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,YA8E1B,CAAC;AAEF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;CAQzB,CAAC;AAuEF,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAoIzE"}
|
package/dist/index.js
CHANGED
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import { useCodeSandbox } from '@aalis/plugin-code-sandbox-api';
|
|
1
2
|
import { createProcessGateway } from '@aalis/plugin-process-api';
|
|
2
3
|
import { createStorageGateway } from '@aalis/plugin-storage-api';
|
|
3
4
|
import { toolsWithGroups, toStorageUri, useToolService } from '@aalis/plugin-tools-api';
|
|
@@ -9,6 +10,7 @@ export const displayName = '代码执行器';
|
|
|
9
10
|
export const subsystem = 'tools';
|
|
10
11
|
export const inject = {
|
|
11
12
|
required: [{ service: 'storage', capabilities: ['local-path'] }, 'process'],
|
|
13
|
+
optional: ['code-sandbox'],
|
|
12
14
|
};
|
|
13
15
|
export const configSchema = {
|
|
14
16
|
python: {
|
|
@@ -59,6 +61,33 @@ export const configSchema = {
|
|
|
59
61
|
default: 'workspace:/',
|
|
60
62
|
description: '脚本执行时的 storage URI 工作目录，如 workspace:/ 或 tmp:/run；相对路径会解释为 workspace:/ 下路径。',
|
|
61
63
|
},
|
|
64
|
+
sandbox: {
|
|
65
|
+
label: '代码沙箱',
|
|
66
|
+
fields: {
|
|
67
|
+
mode: {
|
|
68
|
+
type: 'select',
|
|
69
|
+
label: '隔离模式',
|
|
70
|
+
default: 'auto',
|
|
71
|
+
options: [
|
|
72
|
+
{ label: '自动（有沙箱则强制隔离，无则拒绝运行）', value: 'auto' },
|
|
73
|
+
{ label: '无隔离（裸进程，危险，仅信任环境）', value: 'none' },
|
|
74
|
+
],
|
|
75
|
+
description: 'auto：经 code-sandbox 服务（Linux bubblewrap / macOS sandbox-exec）把代码限制在「工作区 + 本次临时目录」、默认断网、' +
|
|
76
|
+
'只放行白名单环境变量；无可用沙箱后端时拒绝执行（fail-closed）。none：退回无隔离裸进程，每次告警。' +
|
|
77
|
+
'说明：v1 读放开（解释器需系统库），防的是写出工作区/联网外泄/篡改系统，不防读取本机其它文件。',
|
|
78
|
+
},
|
|
79
|
+
network: {
|
|
80
|
+
type: 'select',
|
|
81
|
+
label: '子进程网络',
|
|
82
|
+
default: 'deny',
|
|
83
|
+
options: [
|
|
84
|
+
{ label: '断网（推荐）', value: 'deny' },
|
|
85
|
+
{ label: '放开（粗粒度，无法按域名过滤）', value: 'allow' },
|
|
86
|
+
],
|
|
87
|
+
description: '仅 auto 模式生效。deny：脚本内联网（含 fetch）会失败。allow：放开子进程网络（无法按域名白名单过滤）。',
|
|
88
|
+
},
|
|
89
|
+
},
|
|
90
|
+
},
|
|
62
91
|
};
|
|
63
92
|
export const defaultConfig = {
|
|
64
93
|
python: { enabled: true, interpreter: 'python3' },
|
|
@@ -67,10 +96,12 @@ export const defaultConfig = {
|
|
|
67
96
|
maxTimeout: 300000,
|
|
68
97
|
maxOutputSize: 131072,
|
|
69
98
|
workingDirectory: 'workspace:/',
|
|
99
|
+
sandbox: { mode: 'auto', network: 'deny' },
|
|
70
100
|
};
|
|
71
101
|
function resolveConfig(config) {
|
|
72
102
|
const py = config.python;
|
|
73
103
|
const js = config.javascript;
|
|
104
|
+
const sb = config.sandbox;
|
|
74
105
|
return {
|
|
75
106
|
python: {
|
|
76
107
|
enabled: py?.enabled ?? true,
|
|
@@ -84,6 +115,10 @@ function resolveConfig(config) {
|
|
|
84
115
|
maxTimeout: config.maxTimeout ?? 300000,
|
|
85
116
|
maxOutputSize: config.maxOutputSize ?? 131072,
|
|
86
117
|
workingDirectory: config.workingDirectory ?? 'workspace:/',
|
|
118
|
+
sandbox: {
|
|
119
|
+
mode: sb?.mode === 'none' ? 'none' : 'auto',
|
|
120
|
+
network: sb?.network === 'allow' ? 'allow' : 'deny',
|
|
121
|
+
},
|
|
87
122
|
};
|
|
88
123
|
}
|
|
89
124
|
function toRunnerCwdUri(input) {
|
|
@@ -110,11 +145,17 @@ async function createRunnerConfig(ctx, cfg) {
|
|
|
110
145
|
maxOutputSize: cfg.maxOutputSize,
|
|
111
146
|
cwd: await storage.resolveLocalPath(cwdUri, 'read'),
|
|
112
147
|
env: safeEnv(),
|
|
148
|
+
// mode='none' → 不带 sandbox（裸跑）；mode='auto' → 带策略，runCode 经 code-sandbox 强制隔离或 fail-closed
|
|
149
|
+
sandbox: cfg.sandbox.mode === 'none' ? undefined : { network: cfg.sandbox.network },
|
|
150
|
+
codeSandbox: useCodeSandbox(ctx),
|
|
113
151
|
};
|
|
114
152
|
}
|
|
115
153
|
// ===== 插件入口 =====
|
|
116
154
|
export function apply(ctx, config) {
|
|
117
155
|
const cfg = resolveConfig(config);
|
|
156
|
+
if (cfg.sandbox.mode === 'none') {
|
|
157
|
+
ctx.logger.warn('⚠️ code-runner 运行在【无隔离】模式（sandbox.mode=none）：代码以宿主用户全权限裸跑，仅在完全可信环境使用。');
|
|
158
|
+
}
|
|
118
159
|
const cwdUri = toRunnerCwdUri(cfg.workingDirectory);
|
|
119
160
|
const proc = createProcessGateway(ctx);
|
|
120
161
|
const storage = createStorageGateway(ctx);
|
|
@@ -167,8 +208,7 @@ export function apply(ctx, config) {
|
|
|
167
208
|
},
|
|
168
209
|
},
|
|
169
210
|
},
|
|
170
|
-
|
|
171
|
-
safety: 'dangerous',
|
|
211
|
+
visibility: 'restricted',
|
|
172
212
|
permissions: ['tool:code.python', 'system:process.exec', 'runtime:python'],
|
|
173
213
|
handler: async (args) => {
|
|
174
214
|
const code = args.code;
|
|
@@ -217,8 +257,7 @@ export function apply(ctx, config) {
|
|
|
217
257
|
},
|
|
218
258
|
},
|
|
219
259
|
},
|
|
220
|
-
|
|
221
|
-
safety: 'dangerous',
|
|
260
|
+
visibility: 'restricted',
|
|
222
261
|
permissions: ['tool:code.javascript', 'system:process.exec', 'runtime:javascript'],
|
|
223
262
|
handler: async (args) => {
|
|
224
263
|
const code = args.code;
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAuB,MAAM,2BAA2B,CAAC;AAEtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACxF,OAAO,EAAqB,OAAO,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,yBAAyB,CAAC;AAEjC,oBAAoB;AAEpB,MAAM,CAAC,MAAM,IAAI,GAAG,gCAAgC,CAAC;AACrD,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC;AACnC,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC;AACjC,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAuB,MAAM,2BAA2B,CAAC;AAEtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACxF,OAAO,EAAqB,OAAO,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,yBAAyB,CAAC;AAEjC,oBAAoB;AAEpB,MAAM,CAAC,MAAM,IAAI,GAAG,gCAAgC,CAAC;AACrD,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC;AACnC,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC;AACjC,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,CAAC;IAC3E,QAAQ,EAAE,CAAC,cAAc,CAAC;CAC3B,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAiB;IACxC,MAAM,EAAE;QACN,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE;YACN,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE;YACnE,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,SAAS;gBAClB,WAAW,EAAE,6CAA6C;aAC3D;SACF;KACF;IACD,UAAU,EAAE;QACV,KAAK,EAAE,sBAAsB;QAC7B,MAAM,EAAE;YACN,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE;YACvE,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,MAAM;gBACf,WAAW,EAAE,mBAAmB;aACjC;SACF;KACF;IACD,cAAc,EAAE;QACd,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,YAAY;KAC1B;IACD,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,aAAa;KAC3B;IACD,aAAa,EAAE;QACb,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,0BAA0B;KACxC;IACD,gBAAgB,EAAE;QAChB,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,aAAa;QACtB,WAAW,EAAE,4EAA4E;KAC1F;IACD,OAAO,EAAE;QACP,KAAK,EAAE,MAAM;QACb,MAAM,EAAE;YACN,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE;oBACP,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE;oBAC/C,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE;iBAC9C;gBACD,WAAW,EACT,yFAAyF;oBACzF,0DAA0D;oBAC1D,mDAAmD;aACtD;YACD,OAAO,EAAE;gBACP,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE;oBACP,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE;oBAClC,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE;iBAC7C;gBACD,WAAW,EACT,+DAA+D;aAClE;SACF;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE;IACjD,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE;IAClD,cAAc,EAAE,KAAK;IACrB,UAAU,EAAE,MAAM;IAClB,aAAa,EAAE,MAAM;IACrB,gBAAgB,EAAE,aAAa;IAC/B,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE;CAC3C,CAAC;AAcF,SAAS,aAAa,CAAC,MAA+B;IACpD,MAAM,EAAE,GAAG,MAAM,CAAC,MAA6C,CAAC;IAChE,MAAM,EAAE,GAAG,MAAM,CAAC,UAAiD,CAAC;IACpE,MAAM,EAAE,GAAG,MAAM,CAAC,OAA8C,CAAC;IACjE,OAAO;QACL,MAAM,EAAE;YACN,OAAO,EAAG,EAAE,EAAE,OAAmB,IAAI,IAAI;YACzC,WAAW,EAAG,EAAE,EAAE,WAAsB,IAAI,SAAS;SACtD;QACD,UAAU,EAAE;YACV,OAAO,EAAG,EAAE,EAAE,OAAmB,IAAI,IAAI;YACzC,WAAW,EAAG,EAAE,EAAE,WAAsB,IAAI,MAAM;SACnD;QACD,cAAc,EAAG,MAAM,CAAC,cAAyB,IAAI,KAAK;QAC1D,UAAU,EAAG,MAAM,CAAC,UAAqB,IAAI,MAAM;QACnD,aAAa,EAAG,MAAM,CAAC,aAAwB,IAAI,MAAM;QACzD,gBAAgB,EAAG,MAAM,CAAC,gBAA2B,IAAI,aAAa;QACtE,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAC3C,OAAO,EAAE,EAAE,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;SACpD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB;IAC/C,OAAO,YAAY,CAAC,KAAK,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,OAAO;IACd,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAC9F,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,GAAY,EAAE,GAAqB;IACnE,IAAI,GAAG,CAAC,cAAc,CAAiB,SAAS,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACpD,OAAO;QACL,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,GAAG,EAAE,MAAM,OAAO,CAAC,gBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC;QACpD,GAAG,EAAE,OAAO,EAAE;QACd,0FAA0F;QAC1F,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE;QACnF,WAAW,EAAE,cAAc,CAAC,GAAG,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,mBAAmB;AAEnB,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,MAA+B;IACjE,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAChC,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACpD,MAAM,IAAI,GAAmB,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,OAAO,GAAmB,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAE1D,eAAe;IACf,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;IAE/D,SAAS;IACT,SAAS,CAAC,aAAa,CAAC;QACtB,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,MAAM;QACb,WAAW,EAAE,8CAA8C;KAC5D,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IAE5G,uDAAuD;IACvD,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,UAAU,CAAC,QAAQ,CAAC;YAClB,UAAU,EAAE;gBACV,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE;oBACR,IAAI,EAAE,YAAY;oBAClB,WAAW,EACT,OAAO,MAAM,2CAA2C;wBACxD,wCAAwC;wBACxC,wBAAwB;wBACxB,oDAAoD;wBACpD,+CAA+C;wBAC/C,kCAAkC;wBAClC,qCAAqC;wBACrC,oCAAoC;wBACpC,yBAAyB;wBACzB,kCAAkC;wBAClC,aAAa;wBACb,oCAAoC;wBACpC,+CAA+C;wBAC/C,uCAAuC;wBACvC,wCAAwC;oBAC1C,UAAU,EAAE;wBACV,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE;4BACV,IAAI,EAAE;gCACJ,IAAI,EAAE,QAAQ;gCACd,WAAW,EAAE,kBAAkB;6BAChC;4BACD,OAAO,EAAE;gCACP,IAAI,EAAE,QAAQ;gCACd,WAAW,EAAE,eAAe,GAAG,CAAC,cAAc,OAAO,GAAG,CAAC,UAAU,GAAG;6BACvE;yBACF;wBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;wBAClB,oBAAoB,EAAE,KAAK;qBAC5B;iBACF;aACF;YACD,UAAU,EAAE,YAAY;YACxB,WAAW,EAAE,CAAC,kBAAkB,EAAE,qBAAqB,EAAE,gBAAgB,CAAC;YAC1E,OAAO,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE;gBACpB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAc,CAAC;gBACjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAC;gBACnD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;gBAClD,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACxD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;gBACxG,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC;SACF,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,GAAG,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC;IACvE,CAAC;IAED,2DAA2D;IAC3D,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAC3B,UAAU,CAAC,QAAQ,CAAC;YAClB,UAAU,EAAE;gBACV,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE;oBACR,IAAI,EAAE,gBAAgB;oBACtB,WAAW,EACT,OAAO,MAAM,yDAAyD;wBACtE,mDAAmD;wBACnD,wBAAwB;wBACxB,kBAAkB;wBAClB,kBAAkB;wBAClB,2BAA2B;wBAC3B,4BAA4B;wBAC5B,iCAAiC;wBACjC,aAAa;wBACb,2BAA2B;wBAC3B,0BAA0B;wBAC1B,+CAA+C;oBACjD,UAAU,EAAE;wBACV,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE;4BACV,IAAI,EAAE;gCACJ,IAAI,EAAE,QAAQ;gCACd,WAAW,EAAE,oCAAoC;6BAClD;4BACD,OAAO,EAAE;gCACP,IAAI,EAAE,QAAQ;gCACd,WAAW,EAAE,eAAe,GAAG,CAAC,cAAc,OAAO,GAAG,CAAC,UAAU,GAAG;6BACvE;yBACF;wBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;wBAClB,oBAAoB,EAAE,KAAK;qBAC5B;iBACF;aACF;YACD,UAAU,EAAE,YAAY;YACxB,WAAW,EAAE,CAAC,sBAAsB,EAAE,qBAAqB,EAAE,oBAAoB,CAAC;YAClF,OAAO,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE;gBACpB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAc,CAAC;gBACjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAC;gBACnD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;gBACtD,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACxD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;gBAC7G,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC;SACF,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,GAAG,CAAC,UAAU,CAAC,WAAW,GAAG,CAAC,CAAC;IAC/E,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,MAAM,GAAG,CAAC,CAAC;AAClD,CAAC"}
|
package/dist/runner.d.ts
CHANGED
|
@@ -4,6 +4,7 @@
|
|
|
4
4
|
* 临时目录通过 ProcessService.makeTempDir 在 storage tmp:/ 下分配，
|
|
5
5
|
* 子进程通过 ProcessService.spawn 启动；不直接依赖 node:fs/child_process。
|
|
6
6
|
*/
|
|
7
|
+
import type { CodeSandboxService } from '@aalis/plugin-code-sandbox-api';
|
|
7
8
|
import type { ProcessService } from '@aalis/plugin-process-api';
|
|
8
9
|
import type { StorageService } from '@aalis/plugin-storage-api';
|
|
9
10
|
export interface RunnerConfig {
|
|
@@ -14,6 +15,15 @@ export interface RunnerConfig {
|
|
|
14
15
|
cwd: string;
|
|
15
16
|
/** 透传给子进程的环境变量；不提供时由 ProcessService 默认合入 process.env */
|
|
16
17
|
env?: Record<string, string | undefined>;
|
|
18
|
+
/**
|
|
19
|
+
* 沙箱：给定即要求 OS 隔离（写白名单 = [cwd, 本次临时目录]、网络按 network、env 仅白名单）；
|
|
20
|
+
* undefined = 无隔离（对应 sandbox.mode='none'）。
|
|
21
|
+
*/
|
|
22
|
+
sandbox?: {
|
|
23
|
+
network: 'deny' | 'allow';
|
|
24
|
+
};
|
|
25
|
+
/** code-sandbox 服务（auto 模式下用；不可用 → fail-closed） */
|
|
26
|
+
codeSandbox?: CodeSandboxService;
|
|
17
27
|
}
|
|
18
28
|
export interface RunResult {
|
|
19
29
|
exitCode: number;
|
package/dist/runner.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC;;;OAGG;IACH,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACxC,mDAAmD;IACnD,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAQD;;;;;;;;;;;GAWG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,cAAc,EACvB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,YAAY,EACpB,OAAO,CAAC,EAAE,MAAM,EAChB,SAAS,GAAE,MAAM,EAAO,GACvB,OAAO,CAAC,SAAS,CAAC,CAuEpB"}
|
package/dist/runner.js
CHANGED
|
@@ -30,12 +30,38 @@ export async function runCode(proc, storage, interpreter, code, ext, config, tim
|
|
|
30
30
|
const scriptUri = `${tmp.uri}/script${ext}`;
|
|
31
31
|
await storage.writeFile(scriptUri, Buffer.from(code, 'utf-8'));
|
|
32
32
|
const scriptPath = `${tmp.path}/script${ext}`;
|
|
33
|
+
// 沙箱策略按本次运行实际路径构造（scope-ready：cwd 来自运行时 resolveLocalPath，
|
|
34
|
+
// 将来 #3 storage 按 session 命名空间化后自动变 per-session 隔离）。
|
|
35
|
+
const policy = config.sandbox
|
|
36
|
+
? { fsRead: [config.cwd], fsWrite: [config.cwd, tmp.path], network: config.sandbox.network }
|
|
37
|
+
: undefined;
|
|
38
|
+
// fail-closed：要求隔离但本机无可用沙箱后端 → 拒绝执行（不静默裸跑）。
|
|
39
|
+
if (policy && !config.codeSandbox?.available) {
|
|
40
|
+
return {
|
|
41
|
+
exitCode: -1,
|
|
42
|
+
stdout: '',
|
|
43
|
+
stderr: '',
|
|
44
|
+
error: `代码执行已禁用（沙箱不可用，backend=${config.codeSandbox?.backend ?? 'none'}）：` +
|
|
45
|
+
'请安装 bubblewrap（Linux：apt/dnf install bubblewrap）并确保 unprivileged user namespaces 已启用；' +
|
|
46
|
+
"macOS 自带 sandbox-exec 无需安装。或在 code-runner 配置设 sandbox.mode='none' 接受无隔离运行。",
|
|
47
|
+
};
|
|
48
|
+
}
|
|
49
|
+
const env = { ...(config.env ?? {}), PYTHONIOENCODING: 'utf-8' };
|
|
33
50
|
try {
|
|
34
|
-
const result =
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
51
|
+
const result = policy
|
|
52
|
+
? await config.codeSandbox.run({
|
|
53
|
+
cmd: interpreter,
|
|
54
|
+
args: [...extraArgs, scriptPath],
|
|
55
|
+
cwd: config.cwd,
|
|
56
|
+
env,
|
|
57
|
+
timeout: effectiveTimeout,
|
|
58
|
+
policy,
|
|
59
|
+
})
|
|
60
|
+
: await proc.execFile(interpreter, [...extraArgs, scriptPath], {
|
|
61
|
+
cwd: config.cwd,
|
|
62
|
+
env,
|
|
63
|
+
timeout: effectiveTimeout,
|
|
64
|
+
});
|
|
39
65
|
return {
|
|
40
66
|
exitCode: result.code ?? -1,
|
|
41
67
|
stdout: truncateOutput(result.stdout, config.maxOutputSize),
|
package/dist/runner.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"runner.js","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"runner.js","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA8BrC,SAAS,cAAc,CAAC,MAAc,EAAE,OAAe;IACrD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,OAAO;QAAE,OAAO,MAAM,CAAC;IACjE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtF,OAAO,GAAG,SAAS,iBAAiB,OAAO,MAAM,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,IAAoB,EACpB,OAAuB,EACvB,WAAmB,EACnB,IAAY,EACZ,GAAW,EACX,MAAoB,EACpB,OAAgB,EAChB,YAAsB,EAAE;IAExB,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,MAAM,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IACvG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,GAAG,GAAG,CAAC,GAAG,UAAU,GAAG,EAAE,CAAC;QAC5C,MAAM,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,GAAG,GAAG,CAAC,IAAI,UAAU,GAAG,EAAE,CAAC;QAE9C,0DAA0D;QAC1D,qDAAqD;QACrD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO;YAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE;YAC5F,CAAC,CAAC,SAAS,CAAC;QACd,4CAA4C;QAC5C,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC;YAC7C,OAAO;gBACL,QAAQ,EAAE,CAAC,CAAC;gBACZ,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,EAAE;gBACV,KAAK,EACH,yBAAyB,MAAM,CAAC,WAAW,EAAE,OAAO,IAAI,MAAM,IAAI;oBAClE,uFAAuF;oBACvF,4EAA4E;aAC/E,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM;gBACnB,CAAC,CAAC,MAAM,MAAM,CAAC,WAAY,CAAC,GAAG,CAAC;oBAC5B,GAAG,EAAE,WAAW;oBAChB,IAAI,EAAE,CAAC,GAAG,SAAS,EAAE,UAAU,CAAC;oBAChC,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,GAAG;oBACH,OAAO,EAAE,gBAAgB;oBACzB,MAAM;iBACP,CAAC;gBACJ,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,SAAS,EAAE,UAAU,CAAC,EAAE;oBAC3D,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,GAAG;oBACH,OAAO,EAAE,gBAAgB;iBAC1B,CAAC,CAAC;YACP,OAAO;gBACL,QAAQ,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;gBAC3B,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC;gBAC3D,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC;aAC5D,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oDAAoD;YACpD,MAAM,CAAC,GAAG,GAET,CAAC;YACF,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;gBACb,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC;gBAC/C,OAAO;oBACL,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;oBAC7B,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC;oBAC7D,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC;oBAC7D,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxC,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,CAAC,CAAC;gBACZ,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,CAAC,CAAC,OAAO;aACjB,CAAC;QACJ,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC;AACH,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,10 +1,11 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@aalis/plugin-tool-code-runner",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.4.0",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"description": "代码执行工具：运行代码片段并取回结果",
|
|
6
6
|
"type": "module",
|
|
7
7
|
"keywords": [
|
|
8
|
+
"aalis",
|
|
8
9
|
"aalis-plugin"
|
|
9
10
|
],
|
|
10
11
|
"main": "dist/index.js",
|
|
@@ -13,23 +14,27 @@
|
|
|
13
14
|
"dist"
|
|
14
15
|
],
|
|
15
16
|
"dependencies": {
|
|
16
|
-
"@aalis/plugin-process-api": "^0.
|
|
17
|
-
"@aalis/plugin-
|
|
18
|
-
"@aalis/plugin-storage-api": "^0.
|
|
17
|
+
"@aalis/plugin-process-api": "^0.4.0",
|
|
18
|
+
"@aalis/plugin-code-sandbox-api": "^0.4.0",
|
|
19
|
+
"@aalis/plugin-storage-api": "^0.4.0",
|
|
20
|
+
"@aalis/plugin-tools-api": "^0.4.0"
|
|
19
21
|
},
|
|
20
22
|
"devDependencies": {
|
|
21
23
|
"@types/node": "^22.0.0",
|
|
22
24
|
"typescript": "^5.7.0",
|
|
23
|
-
"@aalis/core": "0.
|
|
25
|
+
"@aalis/core": "0.4.0"
|
|
24
26
|
},
|
|
25
27
|
"peerDependencies": {
|
|
26
|
-
"@aalis/core": "
|
|
28
|
+
"@aalis/core": ">=0.2.0 <1.0.0"
|
|
27
29
|
},
|
|
28
30
|
"aalis": {
|
|
29
31
|
"service": {
|
|
30
32
|
"required": [
|
|
31
33
|
"storage",
|
|
32
34
|
"process"
|
|
35
|
+
],
|
|
36
|
+
"optional": [
|
|
37
|
+
"code-sandbox"
|
|
33
38
|
]
|
|
34
39
|
}
|
|
35
40
|
},
|