@aalis/plugin-tool-code-runner 0.2.0 → 0.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.ts +6 -4
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +44 -4
- package/dist/index.js.map +1 -1
- package/dist/runner.d.ts +10 -0
- package/dist/runner.d.ts.map +1 -1
- package/dist/runner.js +31 -5
- package/dist/runner.js.map +1 -1
- package/package.json +11 -6
package/dist/index.d.ts
CHANGED
|
@@ -4,10 +4,8 @@ export declare const name = "@aalis/plugin-tool-code-runner";
|
|
|
4
4
|
export declare const displayName = "\u4EE3\u7801\u6267\u884C\u5668";
|
|
5
5
|
export declare const subsystem = "tools";
|
|
6
6
|
export declare const inject: {
|
|
7
|
-
required:
|
|
8
|
-
|
|
9
|
-
capabilities: string[];
|
|
10
|
-
})[];
|
|
7
|
+
required: string[];
|
|
8
|
+
optional: string[];
|
|
11
9
|
};
|
|
12
10
|
export declare const configSchema: ConfigSchema;
|
|
13
11
|
export declare const defaultConfig: {
|
|
@@ -23,6 +21,10 @@ export declare const defaultConfig: {
|
|
|
23
21
|
maxTimeout: number;
|
|
24
22
|
maxOutputSize: number;
|
|
25
23
|
workingDirectory: string;
|
|
24
|
+
sandbox: {
|
|
25
|
+
mode: string;
|
|
26
|
+
network: string;
|
|
27
|
+
};
|
|
26
28
|
};
|
|
27
29
|
export declare function apply(ctx: Context, config: Record<string, unknown>): void;
|
|
28
30
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAOzD,OAAO,yBAAyB,CAAC;AAIjC,eAAO,MAAM,IAAI,mCAAmC,CAAC;AACrD,eAAO,MAAM,WAAW,mCAAU,CAAC;AACnC,eAAO,MAAM,SAAS,UAAU,CAAC;AACjC,eAAO,MAAM,MAAM;;;CAIlB,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,YA8E1B,CAAC;AAEF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;CAQzB,CAAC;AAuEF,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAkIzE"}
|
package/dist/index.js
CHANGED
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import { useCodeSandbox } from '@aalis/plugin-code-sandbox-api';
|
|
1
2
|
import { createProcessGateway } from '@aalis/plugin-process-api';
|
|
2
3
|
import { createStorageGateway } from '@aalis/plugin-storage-api';
|
|
3
4
|
import { toolsWithGroups, toStorageUri, useToolService } from '@aalis/plugin-tools-api';
|
|
@@ -8,7 +9,9 @@ export const name = '@aalis/plugin-tool-code-runner';
|
|
|
8
9
|
export const displayName = '代码执行器';
|
|
9
10
|
export const subsystem = 'tools';
|
|
10
11
|
export const inject = {
|
|
11
|
-
|
|
12
|
+
// storage 仅按名等待；local-path 由 createRunnerConfig 运行时探测 resolveLocalPath 守卫。
|
|
13
|
+
required: ['storage', 'process'],
|
|
14
|
+
optional: ['code-sandbox'],
|
|
12
15
|
};
|
|
13
16
|
export const configSchema = {
|
|
14
17
|
python: {
|
|
@@ -59,6 +62,33 @@ export const configSchema = {
|
|
|
59
62
|
default: 'workspace:/',
|
|
60
63
|
description: '脚本执行时的 storage URI 工作目录，如 workspace:/ 或 tmp:/run；相对路径会解释为 workspace:/ 下路径。',
|
|
61
64
|
},
|
|
65
|
+
sandbox: {
|
|
66
|
+
label: '代码沙箱',
|
|
67
|
+
fields: {
|
|
68
|
+
mode: {
|
|
69
|
+
type: 'select',
|
|
70
|
+
label: '隔离模式',
|
|
71
|
+
default: 'auto',
|
|
72
|
+
options: [
|
|
73
|
+
{ label: '自动（有沙箱则强制隔离，无则拒绝运行）', value: 'auto' },
|
|
74
|
+
{ label: '无隔离（裸进程，危险，仅信任环境）', value: 'none' },
|
|
75
|
+
],
|
|
76
|
+
description: 'auto：经 code-sandbox 服务（Linux bubblewrap / macOS sandbox-exec）把代码限制在「工作区 + 本次临时目录」、默认断网、' +
|
|
77
|
+
'只放行白名单环境变量；无可用沙箱后端时拒绝执行（fail-closed）。none：退回无隔离裸进程，每次告警。' +
|
|
78
|
+
'说明：v1 读放开（解释器需系统库），防的是写出工作区/联网外泄/篡改系统，不防读取本机其它文件。',
|
|
79
|
+
},
|
|
80
|
+
network: {
|
|
81
|
+
type: 'select',
|
|
82
|
+
label: '子进程网络',
|
|
83
|
+
default: 'deny',
|
|
84
|
+
options: [
|
|
85
|
+
{ label: '断网（推荐）', value: 'deny' },
|
|
86
|
+
{ label: '放开（粗粒度，无法按域名过滤）', value: 'allow' },
|
|
87
|
+
],
|
|
88
|
+
description: '仅 auto 模式生效。deny：脚本内联网（含 fetch）会失败。allow：放开子进程网络（无法按域名白名单过滤）。',
|
|
89
|
+
},
|
|
90
|
+
},
|
|
91
|
+
},
|
|
62
92
|
};
|
|
63
93
|
export const defaultConfig = {
|
|
64
94
|
python: { enabled: true, interpreter: 'python3' },
|
|
@@ -67,10 +97,12 @@ export const defaultConfig = {
|
|
|
67
97
|
maxTimeout: 300000,
|
|
68
98
|
maxOutputSize: 131072,
|
|
69
99
|
workingDirectory: 'workspace:/',
|
|
100
|
+
sandbox: { mode: 'auto', network: 'deny' },
|
|
70
101
|
};
|
|
71
102
|
function resolveConfig(config) {
|
|
72
103
|
const py = config.python;
|
|
73
104
|
const js = config.javascript;
|
|
105
|
+
const sb = config.sandbox;
|
|
74
106
|
return {
|
|
75
107
|
python: {
|
|
76
108
|
enabled: py?.enabled ?? true,
|
|
@@ -84,6 +116,10 @@ function resolveConfig(config) {
|
|
|
84
116
|
maxTimeout: config.maxTimeout ?? 300000,
|
|
85
117
|
maxOutputSize: config.maxOutputSize ?? 131072,
|
|
86
118
|
workingDirectory: config.workingDirectory ?? 'workspace:/',
|
|
119
|
+
sandbox: {
|
|
120
|
+
mode: sb?.mode === 'none' ? 'none' : 'auto',
|
|
121
|
+
network: sb?.network === 'allow' ? 'allow' : 'deny',
|
|
122
|
+
},
|
|
87
123
|
};
|
|
88
124
|
}
|
|
89
125
|
function toRunnerCwdUri(input) {
|
|
@@ -99,7 +135,7 @@ function safeEnv() {
|
|
|
99
135
|
return env;
|
|
100
136
|
}
|
|
101
137
|
async function createRunnerConfig(ctx, cfg) {
|
|
102
|
-
if (ctx.getAllServices('storage'
|
|
138
|
+
if (!ctx.getAllServices('storage').some(e => typeof e.instance.resolveLocalPath === 'function')) {
|
|
103
139
|
throw new Error('代码执行器需要至少一个支持 local-path 的 storage entry');
|
|
104
140
|
}
|
|
105
141
|
const storage = createStorageGateway(ctx);
|
|
@@ -110,11 +146,17 @@ async function createRunnerConfig(ctx, cfg) {
|
|
|
110
146
|
maxOutputSize: cfg.maxOutputSize,
|
|
111
147
|
cwd: await storage.resolveLocalPath(cwdUri, 'read'),
|
|
112
148
|
env: safeEnv(),
|
|
149
|
+
// mode='none' → 不带 sandbox（裸跑）；mode='auto' → 带策略，runCode 经 code-sandbox 强制隔离或 fail-closed
|
|
150
|
+
sandbox: cfg.sandbox.mode === 'none' ? undefined : { network: cfg.sandbox.network },
|
|
151
|
+
codeSandbox: useCodeSandbox(ctx),
|
|
113
152
|
};
|
|
114
153
|
}
|
|
115
154
|
// ===== 插件入口 =====
|
|
116
155
|
export function apply(ctx, config) {
|
|
117
156
|
const cfg = resolveConfig(config);
|
|
157
|
+
if (cfg.sandbox.mode === 'none') {
|
|
158
|
+
ctx.logger.warn('⚠️ code-runner 运行在【无隔离】模式（sandbox.mode=none）：代码以宿主用户全权限裸跑，仅在完全可信环境使用。');
|
|
159
|
+
}
|
|
118
160
|
const cwdUri = toRunnerCwdUri(cfg.workingDirectory);
|
|
119
161
|
const proc = createProcessGateway(ctx);
|
|
120
162
|
const storage = createStorageGateway(ctx);
|
|
@@ -168,7 +210,6 @@ export function apply(ctx, config) {
|
|
|
168
210
|
},
|
|
169
211
|
},
|
|
170
212
|
visibility: 'restricted',
|
|
171
|
-
permissions: ['tool:code.python', 'system:process.exec', 'runtime:python'],
|
|
172
213
|
handler: async (args) => {
|
|
173
214
|
const code = args.code;
|
|
174
215
|
const timeout = args.timeout;
|
|
@@ -217,7 +258,6 @@ export function apply(ctx, config) {
|
|
|
217
258
|
},
|
|
218
259
|
},
|
|
219
260
|
visibility: 'restricted',
|
|
220
|
-
permissions: ['tool:code.javascript', 'system:process.exec', 'runtime:javascript'],
|
|
221
261
|
handler: async (args) => {
|
|
222
262
|
const code = args.code;
|
|
223
263
|
const timeout = args.timeout;
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAuB,MAAM,2BAA2B,CAAC;AAEtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACxF,OAAO,EAAqB,OAAO,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,yBAAyB,CAAC;AAEjC,oBAAoB;AAEpB,MAAM,CAAC,MAAM,IAAI,GAAG,gCAAgC,CAAC;AACrD,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC;AACnC,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC;AACjC,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,QAAQ,EAAE,CAAC,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAuB,MAAM,2BAA2B,CAAC;AAEtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACxF,OAAO,EAAqB,OAAO,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,yBAAyB,CAAC;AAEjC,oBAAoB;AAEpB,MAAM,CAAC,MAAM,IAAI,GAAG,gCAAgC,CAAC;AACrD,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC;AACnC,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC;AACjC,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,2EAA2E;IAC3E,QAAQ,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;IAChC,QAAQ,EAAE,CAAC,cAAc,CAAC;CAC3B,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAiB;IACxC,MAAM,EAAE;QACN,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE;YACN,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE;YACnE,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,SAAS;gBAClB,WAAW,EAAE,6CAA6C;aAC3D;SACF;KACF;IACD,UAAU,EAAE;QACV,KAAK,EAAE,sBAAsB;QAC7B,MAAM,EAAE;YACN,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE;YACvE,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,MAAM;gBACf,WAAW,EAAE,mBAAmB;aACjC;SACF;KACF;IACD,cAAc,EAAE;QACd,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,YAAY;KAC1B;IACD,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,aAAa;KAC3B;IACD,aAAa,EAAE;QACb,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,0BAA0B;KACxC;IACD,gBAAgB,EAAE;QAChB,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,aAAa;QACtB,WAAW,EAAE,4EAA4E;KAC1F;IACD,OAAO,EAAE;QACP,KAAK,EAAE,MAAM;QACb,MAAM,EAAE;YACN,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE;oBACP,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE;oBAC/C,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE;iBAC9C;gBACD,WAAW,EACT,yFAAyF;oBACzF,0DAA0D;oBAC1D,mDAAmD;aACtD;YACD,OAAO,EAAE;gBACP,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE;oBACP,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE;oBAClC,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE;iBAC7C;gBACD,WAAW,EACT,+DAA+D;aAClE;SACF;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE;IACjD,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE;IAClD,cAAc,EAAE,KAAK;IACrB,UAAU,EAAE,MAAM;IAClB,aAAa,EAAE,MAAM;IACrB,gBAAgB,EAAE,aAAa;IAC/B,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE;CAC3C,CAAC;AAcF,SAAS,aAAa,CAAC,MAA+B;IACpD,MAAM,EAAE,GAAG,MAAM,CAAC,MAA6C,CAAC;IAChE,MAAM,EAAE,GAAG,MAAM,CAAC,UAAiD,CAAC;IACpE,MAAM,EAAE,GAAG,MAAM,CAAC,OAA8C,CAAC;IACjE,OAAO;QACL,MAAM,EAAE;YACN,OAAO,EAAG,EAAE,EAAE,OAAmB,IAAI,IAAI;YACzC,WAAW,EAAG,EAAE,EAAE,WAAsB,IAAI,SAAS;SACtD;QACD,UAAU,EAAE;YACV,OAAO,EAAG,EAAE,EAAE,OAAmB,IAAI,IAAI;YACzC,WAAW,EAAG,EAAE,EAAE,WAAsB,IAAI,MAAM;SACnD;QACD,cAAc,EAAG,MAAM,CAAC,cAAyB,IAAI,KAAK;QAC1D,UAAU,EAAG,MAAM,CAAC,UAAqB,IAAI,MAAM;QACnD,aAAa,EAAG,MAAM,CAAC,aAAwB,IAAI,MAAM;QACzD,gBAAgB,EAAG,MAAM,CAAC,gBAA2B,IAAI,aAAa;QACtE,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAC3C,OAAO,EAAE,EAAE,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;SACpD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB;IAC/C,OAAO,YAAY,CAAC,KAAK,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,OAAO;IACd,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAC9F,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,GAAY,EAAE,GAAqB;IACnE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAiB,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,gBAAgB,KAAK,UAAU,CAAC,EAAE,CAAC;QAChH,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACpD,OAAO;QACL,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,GAAG,EAAE,MAAM,OAAO,CAAC,gBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC;QACpD,GAAG,EAAE,OAAO,EAAE;QACd,0FAA0F;QAC1F,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE;QACnF,WAAW,EAAE,cAAc,CAAC,GAAG,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,mBAAmB;AAEnB,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,MAA+B;IACjE,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAChC,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACpD,MAAM,IAAI,GAAmB,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,OAAO,GAAmB,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAE1D,eAAe;IACf,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;IAE/D,SAAS;IACT,SAAS,CAAC,aAAa,CAAC;QACtB,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,MAAM;QACb,WAAW,EAAE,8CAA8C;KAC5D,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IAE5G,uDAAuD;IACvD,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,UAAU,CAAC,QAAQ,CAAC;YAClB,UAAU,EAAE;gBACV,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE;oBACR,IAAI,EAAE,YAAY;oBAClB,WAAW,EACT,OAAO,MAAM,2CAA2C;wBACxD,wCAAwC;wBACxC,wBAAwB;wBACxB,oDAAoD;wBACpD,+CAA+C;wBAC/C,kCAAkC;wBAClC,qCAAqC;wBACrC,oCAAoC;wBACpC,yBAAyB;wBACzB,kCAAkC;wBAClC,aAAa;wBACb,oCAAoC;wBACpC,+CAA+C;wBAC/C,uCAAuC;wBACvC,wCAAwC;oBAC1C,UAAU,EAAE;wBACV,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE;4BACV,IAAI,EAAE;gCACJ,IAAI,EAAE,QAAQ;gCACd,WAAW,EAAE,kBAAkB;6BAChC;4BACD,OAAO,EAAE;gCACP,IAAI,EAAE,QAAQ;gCACd,WAAW,EAAE,eAAe,GAAG,CAAC,cAAc,OAAO,GAAG,CAAC,UAAU,GAAG;6BACvE;yBACF;wBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;wBAClB,oBAAoB,EAAE,KAAK;qBAC5B;iBACF;aACF;YACD,UAAU,EAAE,YAAY;YACxB,OAAO,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE;gBACpB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAc,CAAC;gBACjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAC;gBACnD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;gBAClD,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACxD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;gBACxG,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC;SACF,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,GAAG,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC;IACvE,CAAC;IAED,2DAA2D;IAC3D,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAC3B,UAAU,CAAC,QAAQ,CAAC;YAClB,UAAU,EAAE;gBACV,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE;oBACR,IAAI,EAAE,gBAAgB;oBACtB,WAAW,EACT,OAAO,MAAM,yDAAyD;wBACtE,mDAAmD;wBACnD,wBAAwB;wBACxB,kBAAkB;wBAClB,kBAAkB;wBAClB,2BAA2B;wBAC3B,4BAA4B;wBAC5B,iCAAiC;wBACjC,aAAa;wBACb,2BAA2B;wBAC3B,0BAA0B;wBAC1B,+CAA+C;oBACjD,UAAU,EAAE;wBACV,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE;4BACV,IAAI,EAAE;gCACJ,IAAI,EAAE,QAAQ;gCACd,WAAW,EAAE,oCAAoC;6BAClD;4BACD,OAAO,EAAE;gCACP,IAAI,EAAE,QAAQ;gCACd,WAAW,EAAE,eAAe,GAAG,CAAC,cAAc,OAAO,GAAG,CAAC,UAAU,GAAG;6BACvE;yBACF;wBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;wBAClB,oBAAoB,EAAE,KAAK;qBAC5B;iBACF;aACF;YACD,UAAU,EAAE,YAAY;YACxB,OAAO,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE;gBACpB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAc,CAAC;gBACjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAC;gBACnD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;gBACtD,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACxD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;gBAC7G,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC;SACF,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,GAAG,CAAC,UAAU,CAAC,WAAW,GAAG,CAAC,CAAC;IAC/E,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,MAAM,GAAG,CAAC,CAAC;AAClD,CAAC"}
|
package/dist/runner.d.ts
CHANGED
|
@@ -4,6 +4,7 @@
|
|
|
4
4
|
* 临时目录通过 ProcessService.makeTempDir 在 storage tmp:/ 下分配，
|
|
5
5
|
* 子进程通过 ProcessService.spawn 启动；不直接依赖 node:fs/child_process。
|
|
6
6
|
*/
|
|
7
|
+
import type { CodeSandboxService } from '@aalis/plugin-code-sandbox-api';
|
|
7
8
|
import type { ProcessService } from '@aalis/plugin-process-api';
|
|
8
9
|
import type { StorageService } from '@aalis/plugin-storage-api';
|
|
9
10
|
export interface RunnerConfig {
|
|
@@ -14,6 +15,15 @@ export interface RunnerConfig {
|
|
|
14
15
|
cwd: string;
|
|
15
16
|
/** 透传给子进程的环境变量；不提供时由 ProcessService 默认合入 process.env */
|
|
16
17
|
env?: Record<string, string | undefined>;
|
|
18
|
+
/**
|
|
19
|
+
* 沙箱：给定即要求 OS 隔离（写白名单 = [cwd, 本次临时目录]、网络按 network、env 仅白名单）；
|
|
20
|
+
* undefined = 无隔离（对应 sandbox.mode='none'）。
|
|
21
|
+
*/
|
|
22
|
+
sandbox?: {
|
|
23
|
+
network: 'deny' | 'allow';
|
|
24
|
+
};
|
|
25
|
+
/** code-sandbox 服务（auto 模式下用；不可用 → fail-closed） */
|
|
26
|
+
codeSandbox?: CodeSandboxService;
|
|
17
27
|
}
|
|
18
28
|
export interface RunResult {
|
|
19
29
|
exitCode: number;
|
package/dist/runner.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC;;;OAGG;IACH,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACxC,mDAAmD;IACnD,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAQD;;;;;;;;;;;GAWG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,cAAc,EACvB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,YAAY,EACpB,OAAO,CAAC,EAAE,MAAM,EAChB,SAAS,GAAE,MAAM,EAAO,GACvB,OAAO,CAAC,SAAS,CAAC,CAuEpB"}
|
package/dist/runner.js
CHANGED
|
@@ -30,12 +30,38 @@ export async function runCode(proc, storage, interpreter, code, ext, config, tim
|
|
|
30
30
|
const scriptUri = `${tmp.uri}/script${ext}`;
|
|
31
31
|
await storage.writeFile(scriptUri, Buffer.from(code, 'utf-8'));
|
|
32
32
|
const scriptPath = `${tmp.path}/script${ext}`;
|
|
33
|
+
// 沙箱策略按本次运行实际路径构造（scope-ready：cwd 来自运行时 resolveLocalPath，
|
|
34
|
+
// 将来 #3 storage 按 session 命名空间化后自动变 per-session 隔离）。
|
|
35
|
+
const policy = config.sandbox
|
|
36
|
+
? { fsRead: [config.cwd], fsWrite: [config.cwd, tmp.path], network: config.sandbox.network }
|
|
37
|
+
: undefined;
|
|
38
|
+
// fail-closed：要求隔离但本机无可用沙箱后端 → 拒绝执行（不静默裸跑）。
|
|
39
|
+
if (policy && !config.codeSandbox?.available) {
|
|
40
|
+
return {
|
|
41
|
+
exitCode: -1,
|
|
42
|
+
stdout: '',
|
|
43
|
+
stderr: '',
|
|
44
|
+
error: `代码执行已禁用（沙箱不可用，backend=${config.codeSandbox?.backend ?? 'none'}）：` +
|
|
45
|
+
'请安装 bubblewrap（Linux：apt/dnf install bubblewrap）并确保 unprivileged user namespaces 已启用；' +
|
|
46
|
+
"macOS 自带 sandbox-exec 无需安装。或在 code-runner 配置设 sandbox.mode='none' 接受无隔离运行。",
|
|
47
|
+
};
|
|
48
|
+
}
|
|
49
|
+
const env = { ...(config.env ?? {}), PYTHONIOENCODING: 'utf-8' };
|
|
33
50
|
try {
|
|
34
|
-
const result =
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
51
|
+
const result = policy
|
|
52
|
+
? await config.codeSandbox.run({
|
|
53
|
+
cmd: interpreter,
|
|
54
|
+
args: [...extraArgs, scriptPath],
|
|
55
|
+
cwd: config.cwd,
|
|
56
|
+
env,
|
|
57
|
+
timeout: effectiveTimeout,
|
|
58
|
+
policy,
|
|
59
|
+
})
|
|
60
|
+
: await proc.execFile(interpreter, [...extraArgs, scriptPath], {
|
|
61
|
+
cwd: config.cwd,
|
|
62
|
+
env,
|
|
63
|
+
timeout: effectiveTimeout,
|
|
64
|
+
});
|
|
39
65
|
return {
|
|
40
66
|
exitCode: result.code ?? -1,
|
|
41
67
|
stdout: truncateOutput(result.stdout, config.maxOutputSize),
|
package/dist/runner.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"runner.js","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"runner.js","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA8BrC,SAAS,cAAc,CAAC,MAAc,EAAE,OAAe;IACrD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,OAAO;QAAE,OAAO,MAAM,CAAC;IACjE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtF,OAAO,GAAG,SAAS,iBAAiB,OAAO,MAAM,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,IAAoB,EACpB,OAAuB,EACvB,WAAmB,EACnB,IAAY,EACZ,GAAW,EACX,MAAoB,EACpB,OAAgB,EAChB,YAAsB,EAAE;IAExB,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,MAAM,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IACvG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,GAAG,GAAG,CAAC,GAAG,UAAU,GAAG,EAAE,CAAC;QAC5C,MAAM,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,GAAG,GAAG,CAAC,IAAI,UAAU,GAAG,EAAE,CAAC;QAE9C,0DAA0D;QAC1D,qDAAqD;QACrD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO;YAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE;YAC5F,CAAC,CAAC,SAAS,CAAC;QACd,4CAA4C;QAC5C,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC;YAC7C,OAAO;gBACL,QAAQ,EAAE,CAAC,CAAC;gBACZ,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,EAAE;gBACV,KAAK,EACH,yBAAyB,MAAM,CAAC,WAAW,EAAE,OAAO,IAAI,MAAM,IAAI;oBAClE,uFAAuF;oBACvF,4EAA4E;aAC/E,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM;gBACnB,CAAC,CAAC,MAAM,MAAM,CAAC,WAAY,CAAC,GAAG,CAAC;oBAC5B,GAAG,EAAE,WAAW;oBAChB,IAAI,EAAE,CAAC,GAAG,SAAS,EAAE,UAAU,CAAC;oBAChC,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,GAAG;oBACH,OAAO,EAAE,gBAAgB;oBACzB,MAAM;iBACP,CAAC;gBACJ,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,SAAS,EAAE,UAAU,CAAC,EAAE;oBAC3D,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,GAAG;oBACH,OAAO,EAAE,gBAAgB;iBAC1B,CAAC,CAAC;YACP,OAAO;gBACL,QAAQ,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;gBAC3B,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC;gBAC3D,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC;aAC5D,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oDAAoD;YACpD,MAAM,CAAC,GAAG,GAET,CAAC;YACF,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;gBACb,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC;gBAC/C,OAAO;oBACL,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;oBAC7B,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC;oBAC7D,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC;oBAC7D,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxC,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,CAAC,CAAC;gBACZ,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,CAAC,CAAC,OAAO;aACjB,CAAC;QACJ,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC;AACH,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,10 +1,11 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@aalis/plugin-tool-code-runner",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.5.0",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"description": "代码执行工具：运行代码片段并取回结果",
|
|
6
6
|
"type": "module",
|
|
7
7
|
"keywords": [
|
|
8
|
+
"aalis",
|
|
8
9
|
"aalis-plugin"
|
|
9
10
|
],
|
|
10
11
|
"main": "dist/index.js",
|
|
@@ -13,23 +14,27 @@
|
|
|
13
14
|
"dist"
|
|
14
15
|
],
|
|
15
16
|
"dependencies": {
|
|
16
|
-
"@aalis/plugin-
|
|
17
|
-
"@aalis/plugin-
|
|
18
|
-
"@aalis/plugin-
|
|
17
|
+
"@aalis/plugin-code-sandbox-api": "^0.5.0",
|
|
18
|
+
"@aalis/plugin-process-api": "^0.5.0",
|
|
19
|
+
"@aalis/plugin-storage-api": "^0.5.0",
|
|
20
|
+
"@aalis/plugin-tools-api": "^0.5.0"
|
|
19
21
|
},
|
|
20
22
|
"devDependencies": {
|
|
21
23
|
"@types/node": "^22.0.0",
|
|
22
24
|
"typescript": "^5.7.0",
|
|
23
|
-
"@aalis/core": "0.
|
|
25
|
+
"@aalis/core": "0.5.0"
|
|
24
26
|
},
|
|
25
27
|
"peerDependencies": {
|
|
26
|
-
"@aalis/core": "
|
|
28
|
+
"@aalis/core": ">=0.2.0 <1.0.0"
|
|
27
29
|
},
|
|
28
30
|
"aalis": {
|
|
29
31
|
"service": {
|
|
30
32
|
"required": [
|
|
31
33
|
"storage",
|
|
32
34
|
"process"
|
|
35
|
+
],
|
|
36
|
+
"optional": [
|
|
37
|
+
"code-sandbox"
|
|
33
38
|
]
|
|
34
39
|
}
|
|
35
40
|
},
|