@allbluecn/web-app 0.12.0 → 0.12.3

package/src/server/ai-gateway/sandbox/local-process.ts

@@ -0,0 +1,329 @@
+import type {
+  ExecResult,
+  SandboxCapabilities,
+  SandboxFs,
+  SandboxFsStat,
+  SandboxHandle,
+  SandboxProcess,
+  SandboxProvider,
+  SpawnHandle,
+} from "@tanstack/ai-sandbox"
+import { spawn as spawnChild } from "node:child_process"
+import { randomUUID } from "node:crypto"
+import fsPromises from "node:fs/promises"
+import path from "node:path"
+import type { Readable } from "node:stream"
+
+const SIGNAL_NUM: Record<string, number> = {
+  SIGHUP: 1,
+  SIGINT: 2,
+  SIGQUIT: 3,
+  SIGILL: 4,
+  SIGTRAP: 5,
+  SIGABRT: 6,
+  SIGIOT: 6,
+  SIGFPE: 8,
+  SIGKILL: 9,
+  SIGBUS: 10,
+  SIGSEGV: 11,
+  SIGSYS: 12,
+  SIGPIPE: 13,
+  SIGALRM: 14,
+  SIGTERM: 15,
+  SIGURG: 16,
+  SIGSTOP: 17,
+  SIGTSTP: 18,
+  SIGCONT: 19,
+  SIGCHLD: 20,
+  SIGTTIN: 21,
+  SIGTTOU: 22,
+  SIGIO: 23,
+  SIGXCPU: 24,
+  SIGXFSZ: 25,
+  SIGVTALRM: 26,
+  SIGPROF: 27,
+  SIGWINCH: 28,
+  SIGINFO: 29,
+  SIGUSR1: 30,
+  SIGUSR2: 31,
+}
+
+function exitCodeOf(code: number | null, signal: NodeJS.Signals | null): number {
+  if (code !== null) return code
+  return 128 + (SIGNAL_NUM[signal ?? ""] ?? 0)
+}
+
+function toAsyncStrings(stream: Readable): AsyncIterable<string> {
+  return {
+    [Symbol.asyncIterator]: async function* () {
+      for await (const chunk of stream) {
+        yield typeof chunk === "string" ? chunk : chunk.toString("utf8")
+      }
+    },
+  }
+}
+
+function unsupported(surface: string): Error {
+  return new Error(
+    `localProcessSandbox 不支持 ${surface}（desktop 本机沙箱仅提供 fs/exec/env/process 面）`,
+  )
+}
+
+export function localProcessSandbox(config: { root: string }): SandboxProvider {
+  const root = path.resolve(config.root)
+  const live = new Map<string, SandboxHandle>()
+
+  // 如实声明：本机进程模型无端口暴露、无快照、无网络策略、无 fork。
+  // 虚报会让调用方依赖不存在的隔离能力（如 harness adapter 依赖 writableStdin=true 走 stdin 投递）。
+  const capabilities: SandboxCapabilities = {
+    fs: true,
+    exec: true,
+    env: true,
+    ports: false,
+    backgroundProcesses: true,
+    writableStdin: true,
+    killableProcesses: true,
+    snapshots: false,
+    networkPolicy: false,
+    durableFilesystem: true,
+    fork: false,
+  }
+
+  function sanitizeId(id: string): string {
+    if (!/^[a-zA-Z0-9._:-]+$/.test(id)) {
+      throw new Error(`非法沙箱 id（拒绝路径穿越/空白/绝对路径）：${JSON.stringify(id)}`)
+    }
+    return id
+  }
+
+  // 唯一安全防线：resolve 折叠 .. 之后再校验前缀，越界即抛错。
+  function resolveSafe(base: string, rel: string): string {
+    const resolved = path.resolve(base, rel)
+    if (resolved !== base && !resolved.startsWith(base + path.sep)) {
+      throw new Error(`路径越界（escape）：${JSON.stringify(rel)} 逃出沙箱工作区 ${base}`)
+    }
+    return resolved
+  }
+
+  function instanceDir(id: string): string {
+    return resolveSafe(root, sanitizeId(id))
+  }
+
+  async function dirExists(target: string): Promise<boolean> {
+    try {
+      const st = await fsPromises.stat(target)
+      return st.isDirectory()
+    } catch {
+      return false
+    }
+  }
+
+  function makeHandle(id: string, workspaceRoot: string, initialEnv: Record<string, string>): SandboxHandle {
+    let envMap: Record<string, string> = { ...initialEnv }
+
+    const fs: SandboxFs = {
+      // 全部 async：resolveSafe 的越界抛错必须变成 rejected promise，
+      // 裸 throw 会让调用方拿到同步异常而非可 await 的失败。
+      read: async (p) => fsPromises.readFile(resolveSafe(workspaceRoot, p), "utf8"),
+      readBytes: async (p) => Uint8Array.from(await fsPromises.readFile(resolveSafe(workspaceRoot, p))),
+      write: async (p, data) => fsPromises.writeFile(resolveSafe(workspaceRoot, p), data),
+      list: async (p) => {
+        const target = resolveSafe(workspaceRoot, p)
+        const entries = await fsPromises.readdir(target, { withFileTypes: true })
+        return entries.map((e) => ({
+          name: e.name,
+          path: path.join(target, e.name),
+          type: e.isDirectory() ? ("dir" as const) : ("file" as const),
+        }))
+      },
+      mkdir: async (p) => {
+        // fsPromises.mkdir 返回 string|undefined，契约要求 Promise<void>
+        await fsPromises.mkdir(resolveSafe(workspaceRoot, p), { recursive: true })
+      },
+      remove: async (p) => fsPromises.rm(resolveSafe(workspaceRoot, p), { recursive: true, force: true }),
+      rename: async (from, to) =>
+        fsPromises.rename(resolveSafe(workspaceRoot, from), resolveSafe(workspaceRoot, to)),
+      exists: async (p) => {
+        try {
+          await fsPromises.access(resolveSafe(workspaceRoot, p))
+          return true
+        } catch {
+          return false
+        }
+      },
+      lstat: async (p) => {
+        let st: import("node:fs").Stats
+        try {
+          st = await fsPromises.lstat(resolveSafe(workspaceRoot, p))
+        } catch {
+          return undefined
+        }
+        const mode = st.mode
+        if (st.isSymbolicLink()) return { type: "symlink", mode } satisfies SandboxFsStat
+        if (st.isDirectory()) return { type: "dir", mode } satisfies SandboxFsStat
+        if (st.isFile()) return { type: "file", mode, size: st.size } satisfies SandboxFsStat
+        return { type: "other", mode } satisfies SandboxFsStat
+      },
+    }
+
+    // 局部变量名避开 `process`——否则会遮蔽全局 process，`process.env` 被解析成 SandboxProcess.env
+    const proc: SandboxProcess = {
+      // 必须是 async：路径越界在 Promise 之外同步抛会让调用方拿到裸 throw
+      // 而非 rejected promise，`expect(...).rejects.toThrow()` 无法捕获。
+      exec: async (command, options) => {
+        const cwd = resolveSafe(workspaceRoot, options?.cwd ?? ".")
+        const childEnv = { ...process.env, PWD: cwd, ...envMap, ...(options?.env ?? {}) }
+        return new Promise<ExecResult>((resolve, reject) => {
+          let settled = false
+          let stdout = ""
+          let stderr = ""
+          let child: ReturnType<typeof spawnChild>
+
+          const fail = (err: Error) => {
+            if (settled) return
+            settled = true
+            options?.signal?.removeEventListener("abort", onAbort)
+            reject(err)
+          }
+          const finish = (code: number | null, signal: NodeJS.Signals | null) => {
+            if (settled) return
+            settled = true
+            options?.signal?.removeEventListener("abort", onAbort)
+            resolve({ stdout, stderr, exitCode: exitCodeOf(code, signal) })
+          }
+          const onAbort = () => {
+            if (settled) return
+            settled = true
+            child?.kill("SIGKILL")
+            reject(new Error(`exec 被 AbortSignal 取消：${command}`))
+          }
+
+          try {
+            child = spawnChild("sh", ["-c", command], { cwd, env: childEnv })
+          } catch (err) {
+            fail(err instanceof Error ? err : new Error(String(err)))
+            return
+          }
+
+          child.stdout!.on("data", (d: Buffer) => {
+            stdout += d.toString("utf8")
+          })
+          child.stderr!.on("data", (d: Buffer) => {
+            stderr += d.toString("utf8")
+          })
+          child.on("error", fail)
+          child.on("close", finish)
+          if (options?.signal) {
+            if (options.signal.aborted) {
+              onAbort()
+            } else {
+              options.signal.addEventListener("abort", onAbort, { once: true })
+            }
+          }
+        })
+      },
+      spawn: async (command, options) => {
+        const cwd = resolveSafe(workspaceRoot, options?.cwd ?? ".")
+        const childEnv = { ...process.env, PWD: cwd, ...envMap, ...(options?.env ?? {}) }
+        const child = spawnChild("sh", ["-c", command], { cwd, env: childEnv })
+        const handle: SpawnHandle = {
+          pid: child.pid ?? -1,
+          stdout: toAsyncStrings(child.stdout!),
+          stderr: toAsyncStrings(child.stderr!),
+          stdin: {
+            write: (data) =>
+              new Promise<void>((resolve, reject) => {
+                child.stdin!.write(data, (err) => (err ? reject(err) : resolve()))
+              }),
+            end: () =>
+              new Promise<void>((resolve, reject) => {
+                child.stdin!.end((err?: Error | null) => (err ? reject(err) : resolve()))
+              }),
+          },
+          wait: () =>
+            new Promise<number>((resolve) => {
+              if (child.exitCode !== null || child.signalCode !== null) {
+                resolve(exitCodeOf(child.exitCode, child.signalCode))
+                return
+              }
+              child.on("close", (code, signal) => resolve(exitCodeOf(code, signal)))
+            }),
+          kill: async (signal = "SIGTERM") => {
+            child.kill(signal)
+          },
+        }
+        const onAbort = () => {
+          child.kill("SIGTERM")
+        }
+        if (options?.signal) {
+          if (options.signal.aborted) {
+            onAbort()
+          } else {
+            options.signal.addEventListener("abort", onAbort, { once: true })
+          }
+        }
+        return handle
+      },
+    }
+
+    const destroy = async () => {
+      live.delete(id)
+      await fsPromises.rm(workspaceRoot, { recursive: true, force: true })
+    }
+
+    return {
+      id,
+      provider: "local-process",
+      workspaceRoot,
+      capabilities,
+      fs,
+      git: {
+        clone: () => Promise.reject(unsupported("git.clone")),
+        status: () => Promise.reject(unsupported("git.status")),
+        add: () => Promise.reject(unsupported("git.add")),
+        commit: () => Promise.reject(unsupported("git.commit")),
+        push: () => Promise.reject(unsupported("git.push")),
+        pull: () => Promise.reject(unsupported("git.pull")),
+        branch: () => Promise.reject(unsupported("git.branch")),
+      },
+      process: proc,
+      ports: {
+        connect: () => Promise.reject(unsupported("ports.connect")),
+      },
+      env: {
+        set: async (vars) => {
+          envMap = { ...envMap, ...vars }
+        },
+      },
+      destroy,
+    }
+  }
+
+  return {
+    name: "local-process",
+    capabilities: () => capabilities,
+    create: async (input) => {
+      // 未提供 id → 回退 UUID；提供空串/非法字符 → 抛错（拒绝静默使用不可寻址实例）。
+      const id = input.id === undefined ? randomUUID() : sanitizeId(input.id)
+      const workspaceRoot = instanceDir(id)
+      await fsPromises.mkdir(workspaceRoot, { recursive: true })
+      const handle = makeHandle(id, workspaceRoot, { ...(input.env ?? {}) })
+      live.set(id, handle)
+      return handle
+    },
+    resume: async (input) => {
+      // 本机模型：工作目录还在 = 可恢复；destroy 删目录后自然返回 null。
+      const id = sanitizeId(input.id)
+      const workspaceRoot = instanceDir(id)
+      if (!(await dirExists(workspaceRoot))) return null
+      const handle = makeHandle(id, workspaceRoot, {})
+      live.set(id, handle)
+      return handle
+    },
+    destroy: async (input) => {
+      const workspaceRoot = instanceDir(input.id)
+      live.delete(input.id)
+      await fsPromises.rm(workspaceRoot, { recursive: true, force: true })
+    },
+  }
+}

package/src/server/ai-gateway/sandbox/policy-levels.ts

@@ -0,0 +1,3 @@
+export const SANDBOX_POLICY_LEVELS = ["readonly", "workspace-write", "full"] as const
+
+export type SandboxPolicyLevel = (typeof SANDBOX_POLICY_LEVELS)[number]

package/src/server/ai-gateway/sandbox/policy.ts

@@ -0,0 +1,267 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { defineSandboxPolicy, type SandboxPolicy } from "@tanstack/ai-sandbox"
+import { SANDBOX_POLICY_LEVELS, type SandboxPolicyLevel } from "./policy-levels"
+export { SANDBOX_POLICY_LEVELS, type SandboxPolicyLevel } from "./policy-levels"
+
+/**
+ * 沙箱策略三档（P3 §9.3-2）。档位由 ChatThread.sandboxPolicy 持久化，
+ * 「full」档需用户显式确认（serverFn 要求 confirmFull: true）——策略本身不设
+ * 默认，服务端装配侧统一走 SANDBOX_DEFAULT_POLICY_LEVEL 兜底。
+ */
+export const SANDBOX_DEFAULT_POLICY_LEVEL: SandboxPolicyLevel = "readonly"
+
+export function isSandboxPolicyLevel(v: unknown): v is SandboxPolicyLevel {
+  return typeof v === "string" && (SANDBOX_POLICY_LEVELS as readonly string[]).includes(v)
+}
+
+/**
+ * 只读命令白名单。pattern 语义见 @tanstack/ai-sandbox policy.d.ts：
+ * glob 前缀锚定（`*` → `.*`，整串 `^...$`），故 `ls*` 与裸 `ls` 语义等价
+ * （`^ls.*$` 的 `.*` 可匹配空串）——两者都声明只为了可读性。真正需要留意
+ * 的是避免裸前缀通配：`git branch*` 会误放行 `git branch -d foo`，故 git
+ * 只读子命令逐一枚举；`find*` 放行后由 destructive 清单的 `find* -delete*`
+ * 等 ask 项兜住破坏性变体（deny > ask > allow 优先级）。
+ */
+export const SANDBOX_READONLY_COMMANDS = [
+  "ls",
+  "ls*",
+  "pwd",
+  "cat*",
+  "head*",
+  "tail*",
+  "grep*",
+  "egrep*",
+  "fgrep*",
+  "rg*",
+  "zgrep*",
+  "find*",
+  "wc*",
+  "which*",
+  "whereis*",
+  "type*",
+  "tree*",
+  "stat*",
+  "file*",
+  "du*",
+  "df*",
+  "printenv*",
+  "uname*",
+  "hostname*",
+  "date*",
+  "whoami*",
+  "node -v",
+  "node --version",
+  "npm -v",
+  "npm --version",
+  "pnpm -v",
+  "pnpm --version",
+  "pnpm --help",
+  "npm --help",
+  "pnpm help*",
+  "npm help*",
+  "pnpm ls*",
+  "pnpm list*",
+  "pnpm why*",
+  "pnpm outdated*",
+  "pnpm view*",
+  "npm ls*",
+  "npm list*",
+  "npm outdated*",
+  "npm view*",
+  "git status*",
+  "git log*",
+  "git diff*",
+  "git show*",
+  "git rev-parse*",
+  "git rev-list*",
+  "git remote",
+  "git remote -v",
+  "git remote show*",
+  "git branch",
+  "git branch -a",
+  "git branch -r",
+  "git branch --all",
+  "git branch --list*",
+  "git branch --contains*",
+  "git branch --remotes*",
+  "git branch --no-color*",
+  "git branch --sort*",
+  "git config --get*",
+  "git config --global --get*",
+  "git config --local --get*",
+  "git tag",
+  "git tag --list*",
+  "git tag -n*",
+  "git ls-files*",
+  "git ls-remote*",
+  "git ls-tree*",
+  "git describe*",
+  "git stash list*",
+  "npm whoami*",
+  "npm config get*",
+  "pnpm config get*",
+] as const
+
+/** 工作区写档额外放行：依赖安装、脚本执行、git 本地写入。 */
+export const SANDBOX_WORKSPACE_WRITE_COMMANDS = [
+  "pnpm install",
+  "pnpm i",
+  "pnpm i*",
+  "pnpm add*",
+  "pnpm up*",
+  "pnpm dlx*",
+  "pnpm run*",
+  "pnpm dev*",
+  "pnpm build",
+  "pnpm test*",
+  "pnpm lint*",
+  "pnpm format*",
+  "pnpm typecheck*",
+  "npm install",
+  "npm install*",
+  "npm i",
+  "npm i*",
+  "npm add*",
+  "npm run*",
+  "npm dlx*",
+  "npx*",
+  "node*",
+  "git add*",
+  "git commit*",
+  "git stash push*",
+  "git stash save*",
+  "mkdir*",
+  "touch*",
+  "cp*",
+] as const
+
+/**
+ * 破坏性清单：「full」档也需 ask（用户显式确认后才执行），其余档因 default
+ * 已是 'ask' 而天然拦截——在此显式声明，使档位语义不依赖 default 的取值。
+ * glob 前缀匹配有粒度限制（`find . -name x -delete` 这类 flag 后置形式仍会被
+ * `find*` 放行），故 find 的破坏性 flag 另列 deny 项兜住常见形态。
+ */
+export const SANDBOX_DESTRUCTIVE_COMMANDS = [
+  "rm*",
+  "rmdir*",
+  "shred*",
+  "truncate*",
+  "unlink*",
+  "mv*",
+  "find* -delete*",
+  "find* -exec*",
+  "find* -ok*",
+  "git push*",
+  "git reset*",
+  "git checkout --*",
+  "git checkout .",
+  "git clean*",
+  "git rebase*",
+  "git filter-branch*",
+  "git filter-repo*",
+  "git branch -d*",
+  "git branch -D*",
+  "git branch --delete*",
+  "git stash drop*",
+  "git stash clear*",
+  "git stash apply*",
+  "git stash pop*",
+  "git tag -d*",
+  "git tag --delete*",
+  "git remote remove*",
+  "docker rm*",
+  "docker rmi*",
+  "docker system prune*",
+  "docker volume rm*",
+  "kubectl delete*",
+  "helm uninstall*",
+  "drop table*",
+  "drop database*",
+  "delete from*",
+  "truncate table*",
+  "curl*",
+  "wget*",
+  "nc*",
+  "ncat*",
+] as const
+
+/** 全档强制 deny：提权、磁盘级破坏、宿主关停。deny 优先级最高，不可被放行。 */
+export const SANDBOX_CATASTROPHIC_COMMANDS = [
+  "sudo*",
+  "su*",
+  "doas*",
+  "dd*",
+  "mkfs*",
+  "fdisk*",
+  "parted*",
+  "diskutil erase*",
+  "shutdown*",
+  "reboot*",
+  "halt*",
+  "poweroff*",
+  "systemctl*",
+  "launchctl*",
+  "git push --force*",
+  "git push -f*",
+  "rm -rf /",
+  "rm -rf /*",
+  "rm -rf ~",
+  "rm -rf ~/*",
+  "rm -rf ..",
+  "rm -rf ./*",
+] as const
+
+/**
+ * 按档位派生策略。fail-closed（§9.3-2）：readonly / workspace-write 的 default
+ * 为 'ask'，任何未命中白名单的命令都走 interrupts 审批而非静默放行；full 档
+ * default 为 'allow' 但破坏性清单仍 ask、灾难清单仍 deny。
+ */
+export function sandboxPolicyFor(level: SandboxPolicyLevel): SandboxPolicy {
+  switch (level) {
+    case "readonly":
+      return defineSandboxPolicy({
+        commands: {
+          allow: [...SANDBOX_READONLY_COMMANDS],
+          ask: [...SANDBOX_DESTRUCTIVE_COMMANDS],
+          deny: [...SANDBOX_CATASTROPHIC_COMMANDS],
+        },
+        capabilities: { fileWrite: "deny", network: "deny" },
+        default: "ask",
+      })
+    case "workspace-write":
+      return defineSandboxPolicy({
+        commands: {
+          allow: [...SANDBOX_READONLY_COMMANDS, ...SANDBOX_WORKSPACE_WRITE_COMMANDS],
+          ask: [...SANDBOX_DESTRUCTIVE_COMMANDS],
+          deny: [...SANDBOX_CATASTROPHIC_COMMANDS],
+        },
+        capabilities: { fileWrite: "allow", network: "ask" },
+        default: "ask",
+      })
+    case "full":
+      return defineSandboxPolicy({
+        commands: {
+          ask: [...SANDBOX_DESTRUCTIVE_COMMANDS],
+          deny: [...SANDBOX_CATASTROPHIC_COMMANDS],
+        },
+        capabilities: { fileWrite: "allow", network: "allow" },
+        default: "allow",
+      })
+  }
+}