@downcity/plugins 1.0.61 → 1.0.64

package/bin/shell/runtime/ShellApprovalRuntime.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Shell unrestricted sandbox 审批运行时。
+ *
+ * 关键点（中文）
+ * - agent 只能通过 shell tool 请求 unrestricted sandbox；真正执行前必须等待用户确认。
+ * - 审批结果最终回到原 tool result；session event 只用于 UI/CLI/Console 展示和操作。
+ * - V1 授权粒度固定为单次命令或单次 shell_start 创建的命令会话。
+ */
+import type { AgentContext } from "@downcity/agent/internal/types/runtime/agent/AgentContext.js";
+import type { ShellApprovalStatus } from "@downcity/agent/internal/executor/tools/shell/types/ShellPlugin.js";
+import type { ShellPluginState } from "../../shell/ShellRuntimeTypes.js";
+/**
+ * 校验 unrestricted sandbox 请求。
+ */
+export declare function validateUnrestrictedRequest(params: {
+    cmd: string;
+    reason?: string;
+}): string | null;
+/**
+ * 请求用户批准 unrestricted sandbox 执行。
+ */
+export declare function requestUnrestrictedApproval(params: {
+    state: ShellPluginState;
+    context: AgentContext;
+    shellId: string;
+    toolName: "shell_exec" | "shell_start";
+    cmd: string;
+    cwd: string;
+    reason: string;
+    ownerContextId?: string;
+}): Promise<{
+    approvalId: string;
+    status: ShellApprovalStatus;
+}>;
+/**
+ * 兑现 unrestricted sandbox 审批。
+ */
+export declare function resolveApproval(params: {
+    state: ShellPluginState;
+    context: AgentContext;
+    approvalId: string;
+    decision: ShellApprovalStatus;
+}): Promise<boolean>;
+/**
+ * 列出 pending unrestricted sandbox 审批。
+ */
+export declare function listPendingApprovals(state: ShellPluginState): Array<{
+    approvalId: string;
+    shellId: string;
+    ownerContextId?: string;
+    toolName: "shell_exec" | "shell_start";
+    cmd: string;
+    cwd: string;
+    reason: string;
+    createdAt: number;
+}>;
+//# sourceMappingURL=ShellApprovalRuntime.d.ts.map

package/bin/shell/runtime/ShellApprovalRuntime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ShellApprovalRuntime.d.ts","sourceRoot":"","sources":["../../../src/shell/runtime/ShellApprovalRuntime.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8DAA8D,CAAC;AACjG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oEAAoE,CAAC;AAC9G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAsDrE;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,GAAG,IAAI,CAShB;AAED;;GAEG;AACH,wBAAsB,2BAA2B,CAAC,MAAM,EAAE;IACxD,KAAK,EAAE,gBAAgB,CAAC;IACxB,OAAO,EAAE,YAAY,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,YAAY,GAAG,aAAa,CAAC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC;IACV,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,mBAAmB,CAAC;CAC7B,CAAC,CAkED;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,KAAK,EAAE,gBAAgB,CAAC;IACxB,OAAO,EAAE,YAAY,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,mBAAmB,CAAC;CAC/B,GAAG,OAAO,CAAC,OAAO,CAAC,CAiCnB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,CAAC;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,YAAY,GAAG,aAAa,CAAC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAWD"}

package/bin/shell/runtime/ShellApprovalRuntime.js

@@ -0,0 +1,182 @@
+/**
+ * Shell unrestricted sandbox 审批运行时。
+ *
+ * 关键点（中文）
+ * - agent 只能通过 shell tool 请求 unrestricted sandbox；真正执行前必须等待用户确认。
+ * - 审批结果最终回到原 tool result；session event 只用于 UI/CLI/Console 展示和操作。
+ * - V1 授权粒度固定为单次命令或单次 shell_start 创建的命令会话。
+ */
+import fs from "fs-extra";
+import path from "node:path";
+import { generateId } from "@downcity/agent/internal/utils/Id.js";
+import { getSessionRunContext } from "@downcity/agent/internal/executor/SessionRunScope.js";
+import { nowMs } from "./ShellActionRuntimeSupport.js";
+const DANGEROUS_COMMAND_PATTERNS = [
+    /\bsudo\b/,
+    /\brm\s+-[^&|;\n]*r[^&|;\n]*f\s+\/(?:\s|$)/,
+    /\bchmod\s+-R\s+777\s+\/(?:\s|$)/,
+    /\bssh-keygen\b/,
+    /\bsecurity\s+(?:add|delete|unlock|set|import|export)-/i,
+    /(?:^|[\s;&|])(?:nohup\s+)?[^;&|\n]*(?:&)\s*$/,
+];
+function isDangerousCommand(cmd) {
+    return DANGEROUS_COMMAND_PATTERNS.some((pattern) => pattern.test(cmd));
+}
+function resolveAuditPath(context) {
+    return path.join(context.rootPath, ".downcity", "logs", "unrestricted-sandbox-audit.jsonl");
+}
+async function appendAudit(params) {
+    const filePath = resolveAuditPath(params.context);
+    await fs.ensureDir(path.dirname(filePath));
+    await fs.appendFile(filePath, `${JSON.stringify(params.record)}\n`, "utf-8");
+}
+function publishApprovalResult(params) {
+    const sessionId = String(params.ownerContextId || "").trim();
+    if (!sessionId)
+        return;
+    const turnId = String(getSessionRunContext()?.turnId || sessionId).trim();
+    try {
+        params.context.session.get(sessionId).publishEvent({
+            type: "tool-approval-result",
+            turnId,
+            toolCallId: params.shellId,
+            toolName: params.toolName,
+            approvalId: params.approvalId,
+            decision: params.decision,
+        });
+    }
+    catch {
+        // ignore event delivery failures
+    }
+}
+/**
+ * 校验 unrestricted sandbox 请求。
+ */
+export function validateUnrestrictedRequest(params) {
+    const reason = String(params.reason || "").trim();
+    if (!reason) {
+        return "unrestricted sandbox requires a non-empty reason";
+    }
+    if (isDangerousCommand(params.cmd)) {
+        return "unrestricted sandbox rejected a dangerous command";
+    }
+    return null;
+}
+/**
+ * 请求用户批准 unrestricted sandbox 执行。
+ */
+export async function requestUnrestrictedApproval(params) {
+    const approvalId = `ap_${generateId()}`;
+    const createdAt = nowMs();
+    const ownerContextId = String(params.ownerContextId || "").trim() || undefined;
+    const status = await new Promise((resolve) => {
+        const timer = setTimeout(() => {
+            resolveApproval({
+                state: params.state,
+                context: params.context,
+                approvalId,
+                decision: "expired",
+            }).catch(() => undefined);
+        }, params.state.options.defaultApprovalTimeoutMs);
+        if (typeof timer.unref === "function")
+            timer.unref();
+        params.state.approvals.set(approvalId, {
+            approvalId,
+            shellId: params.shellId,
+            ...(ownerContextId ? { ownerContextId } : {}),
+            toolName: params.toolName,
+            cmd: params.cmd,
+            cwd: params.cwd,
+            reason: params.reason,
+            createdAt,
+            timer,
+            resolve,
+        });
+        if (ownerContextId) {
+            const turnId = String(getSessionRunContext()?.turnId || ownerContextId).trim();
+            try {
+                params.context.session.get(ownerContextId).publishEvent({
+                    type: "tool-approval-request",
+                    turnId,
+                    toolCallId: params.shellId,
+                    toolName: params.toolName,
+                    approvalId,
+                    sandbox: "unrestricted",
+                    cmd: params.cmd,
+                    cwd: params.cwd,
+                    reason: params.reason,
+                    status: "pending",
+                });
+            }
+            catch {
+                // ignore event delivery failures
+            }
+        }
+        appendAudit({
+            context: params.context,
+            record: {
+                event: "approval_requested",
+                approval_id: approvalId,
+                session_id: ownerContextId || null,
+                tool_call_id: params.shellId,
+                agent_id: params.context.config?.id || null,
+                cmd: params.cmd,
+                cwd: params.cwd,
+                reason: params.reason,
+                created_at: new Date(createdAt).toISOString(),
+            },
+        }).catch(() => undefined);
+    });
+    return { approvalId, status };
+}
+/**
+ * 兑现 unrestricted sandbox 审批。
+ */
+export async function resolveApproval(params) {
+    const approval = params.state.approvals.get(params.approvalId);
+    if (!approval)
+        return false;
+    params.state.approvals.delete(params.approvalId);
+    clearTimeout(approval.timer);
+    approval.resolve(params.decision);
+    publishApprovalResult({
+        context: params.context,
+        ownerContextId: approval.ownerContextId,
+        approvalId: approval.approvalId,
+        shellId: approval.shellId,
+        toolName: approval.toolName,
+        decision: params.decision,
+    });
+    await appendAudit({
+        context: params.context,
+        record: {
+            event: "approval_resolved",
+            approval_id: approval.approvalId,
+            session_id: approval.ownerContextId || null,
+            tool_call_id: approval.shellId,
+            agent_id: params.context.config?.id || null,
+            cmd: approval.cmd,
+            cwd: approval.cwd,
+            reason: approval.reason,
+            decision: params.decision,
+            resolved_at: new Date(nowMs()).toISOString(),
+        },
+    }).catch(() => undefined);
+    return true;
+}
+/**
+ * 列出 pending unrestricted sandbox 审批。
+ */
+export function listPendingApprovals(state) {
+    return Array.from(state.approvals.values()).map((approval) => ({
+        approvalId: approval.approvalId,
+        shellId: approval.shellId,
+        ...(approval.ownerContextId ? { ownerContextId: approval.ownerContextId } : {}),
+        toolName: approval.toolName,
+        cmd: approval.cmd,
+        cwd: approval.cwd,
+        reason: approval.reason,
+        createdAt: approval.createdAt,
+    }));
+}
+//# sourceMappingURL=ShellApprovalRuntime.js.map

package/bin/shell/runtime/ShellApprovalRuntime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ShellApprovalRuntime.js","sourceRoot":"","sources":["../../../src/shell/runtime/ShellApprovalRuntime.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAI5F,OAAO,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AAEvD,MAAM,0BAA0B,GAAG;IACjC,UAAU;IACV,2CAA2C;IAC3C,iCAAiC;IACjC,gBAAgB;IAChB,wDAAwD;IACxD,8CAA8C;CAC/C,CAAC;AAEF,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAqB;IAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,kCAAkC,CAAC,CAAC;AAC9F,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAG1B;IACC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,qBAAqB,CAAC,MAO9B;IACC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,MAAM,MAAM,GAAG,MAAM,CAAC,oBAAoB,EAAE,EAAE,MAAM,IAAI,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC;YACjD,IAAI,EAAE,sBAAsB;YAC5B,MAAM;YACN,UAAU,EAAE,MAAM,CAAC,OAAO;YAC1B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAG3C;IACC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,kDAAkD,CAAC;IAC5D,CAAC;IACD,IAAI,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,mDAAmD,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,MASjD;IAIC,MAAM,UAAU,GAAG,MAAM,UAAU,EAAE,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC;IAC1B,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IAE/E,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAsB,CAAC,OAAO,EAAE,EAAE;QAChE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,eAAe,CAAC;gBACd,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,UAAU;gBACV,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QAClD,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAErD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE;YACrC,UAAU;YACV,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS;YACT,KAAK;YACL,OAAO;SACR,CAAC,CAAC;QAEH,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,MAAM,CAAC,oBAAoB,EAAE,EAAE,MAAM,IAAI,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/E,IAAI,CAAC;gBACH,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,YAAY,CAAC;oBACtD,IAAI,EAAE,uBAAuB;oBAC7B,MAAM;oBACN,UAAU,EAAE,MAAM,CAAC,OAAO;oBAC1B,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU;oBACV,OAAO,EAAE,cAAc;oBACvB,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,MAAM,EAAE,SAAS;iBAClB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,iCAAiC;YACnC,CAAC;QACH,CAAC;QAED,WAAW,CAAC;YACV,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE;gBACN,KAAK,EAAE,oBAAoB;gBAC3B,WAAW,EAAE,UAAU;gBACvB,UAAU,EAAE,cAAc,IAAI,IAAI;gBAClC,YAAY,EAAE,MAAM,CAAC,OAAO;gBAC5B,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI;gBAC3C,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;aAC9C;SACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAKrC;IACC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACjD,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAElC,qBAAqB,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC;IAEH,MAAM,WAAW,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE;YACN,KAAK,EAAE,mBAAmB;YAC1B,WAAW,EAAE,QAAQ,CAAC,UAAU;YAChC,UAAU,EAAE,QAAQ,CAAC,cAAc,IAAI,IAAI;YAC3C,YAAY,EAAE,QAAQ,CAAC,OAAO;YAC9B,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI;YAC3C,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE;SAC7C;KACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAE1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAuB;IAU1D,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC7D,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC,CAAC,CAAC;AACN,CAAC"}

package/bin/shell/types/ShellPluginOptions.d.ts

@@ -50,6 +50,10 @@ export interface ShellPluginOptions {
      * `shell.exec` 默认总超时，单位毫秒。
      */
     defaultExecTimeoutMs?: number;
+    /**
+     * unrestricted sandbox 审批默认超时时间，单位毫秒。
+     */
+    defaultApprovalTimeoutMs?: number;
 }
 /**
  * ShellPlugin 归一化后的运行参数。
@@ -91,5 +95,9 @@ export interface ResolvedShellPluginOptions {
      * `shell.exec` 默认总超时，单位毫秒。
      */
     defaultExecTimeoutMs: number;
+    /**
+     * unrestricted sandbox 审批默认超时时间，单位毫秒。
+     */
+    defaultApprovalTimeoutMs: number;
 }
 //# sourceMappingURL=ShellPluginOptions.d.ts.map

package/bin/shell/types/ShellPluginOptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ShellPluginOptions.d.ts","sourceRoot":"","sources":["../../../src/shell/types/ShellPluginOptions.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;OAEG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,sBAAsB,EAAE,MAAM,CAAC;IAE/B;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAC;CAC9B"}
+{"version":3,"file":"ShellPluginOptions.d.ts","sourceRoot":"","sources":["../../../src/shell/types/ShellPluginOptions.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;OAEG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;OAEG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,sBAAsB,EAAE,MAAM,CAAC;IAE/B;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,wBAAwB,EAAE,MAAM,CAAC;CAClC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@downcity/plugins",
-  "version": "1.0.61",
+  "version": "1.0.64",
   "type": "module",
   "description": "Downcity 内建 plugin 集合包",
   "main": "./bin/index.js",
@@ -22,7 +22,7 @@
     "node-cron": "^4.2.1",
     "ws": "^8.21.0",
     "zod": "^4.4.3",
-    "@downcity/agent": "^1.1.107"
+    "@downcity/agent": "^1.1.111"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",

package/scripts/unrestricted-sandbox-approval.test.mjs

@@ -0,0 +1,156 @@
+/**
+ * @file 验证 shell unrestricted sandbox 审批运行时。
+ *
+ * 关键点（中文）
+ * - 测试编译后的 bin 输出，避免测试文件进入 package 源码导出面。
+ * - 直接驱动 shell runtime state，模拟 UI/Console 收到 approval_id 后批准或拒绝。
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+
+import {
+  approveShellApproval,
+  closeAllShellSessions,
+  createShellPluginState,
+  denyShellApproval,
+  execShellCommand,
+  startShellSession,
+} from "../bin/shell/runtime/ShellActionRuntime.js";
+
+async function create_fixture() {
+  const root_path = await fs.mkdtemp(path.join(os.tmpdir(), "downcity-unrestricted-"));
+  const events = [];
+  const context = {
+    rootPath: root_path,
+    env: {},
+    config: { id: "test-agent" },
+    paths: {
+      getDowncityChannelMetaPath: () => path.join(root_path, ".downcity", "channel", "meta.json"),
+    },
+    session: {
+      get: () => ({
+        publishEvent: (event) => {
+          events.push(event);
+        },
+      }),
+    },
+  };
+  return {
+    root_path,
+    events,
+    context,
+  };
+}
+
+async function wait_for_approval(state) {
+  const started_at = Date.now();
+  while (Date.now() - started_at < 2000) {
+    const approval = Array.from(state.approvals.values())[0];
+    if (approval) return approval;
+    await new Promise((resolve) => setTimeout(resolve, 10));
+  }
+  throw new Error("approval request was not created");
+}
+
+test("shell_start unrestricted requires reason", async () => {
+  const fixture = await create_fixture();
+  const state = createShellPluginState({ defaultApprovalTimeoutMs: 500 });
+  try {
+    await assert.rejects(
+      startShellSession(state, fixture.context, {
+        cmd: "printf should-not-run",
+        cwd: fixture.root_path,
+        shell: "/bin/sh",
+        login: false,
+        sandbox: "unrestricted",
+      }),
+      /requires a non-empty reason/,
+    );
+  } finally {
+    await closeAllShellSessions(state, true);
+    await fs.rm(fixture.root_path, { recursive: true, force: true });
+  }
+});
+
+test("shell_start unrestricted denied returns denied tool result without execution", async () => {
+  const fixture = await create_fixture();
+  const state = createShellPluginState({
+    defaultApprovalTimeoutMs: 2000,
+    defaultInlineWaitMs: 20,
+  });
+  try {
+    const marker_path = path.join(fixture.root_path, "should-not-exist.txt");
+    const pending_result = startShellSession(state, fixture.context, {
+      cmd: `printf denied > ${JSON.stringify(marker_path)}`,
+      cwd: fixture.root_path,
+      shell: "/bin/sh",
+      login: false,
+      sandbox: "unrestricted",
+      reason: "测试拒绝 unrestricted sandbox 不会执行命令。",
+      ownerContextId: "session_test",
+    });
+
+    const approval = await wait_for_approval(state);
+    assert.equal(approval.toolName, "shell_start");
+    assert.equal(fixture.events[0]?.type, "tool-approval-request");
+    assert.equal(fixture.events[0]?.approvalId, approval.approvalId);
+
+    assert.equal(
+      await denyShellApproval(state, fixture.context, approval.approvalId),
+      true,
+    );
+    const result = await pending_result;
+
+    assert.equal(result.shell.sandboxMode, "unrestricted");
+    assert.equal(result.shell.approvalStatus, "denied");
+    assert.equal(result.shell.status, "failed");
+    assert.match(result.chunk.output, /User denied unrestricted sandbox execution/);
+    await assert.rejects(fs.stat(marker_path), /ENOENT/);
+    assert.equal(fixture.events.at(-1)?.type, "tool-approval-result");
+    assert.equal(fixture.events.at(-1)?.decision, "denied");
+  } finally {
+    await closeAllShellSessions(state, true);
+    await fs.rm(fixture.root_path, { recursive: true, force: true });
+  }
+});
+
+test("shell_exec unrestricted approved executes in unrestricted sandbox", async () => {
+  const fixture = await create_fixture();
+  const state = createShellPluginState({
+    defaultApprovalTimeoutMs: 2000,
+    defaultInlineWaitMs: 20,
+    defaultExecTimeoutMs: 2000,
+  });
+  try {
+    const pending_result = execShellCommand(state, fixture.context, {
+      cmd: "printf unrestricted-ok",
+      cwd: fixture.root_path,
+      shell: "/bin/sh",
+      login: false,
+      sandbox: "unrestricted",
+      reason: "测试批准后执行 unrestricted sandbox 命令。",
+      timeoutMs: 2000,
+    });
+
+    const approval = await wait_for_approval(state);
+    assert.equal(approval.toolName, "shell_exec");
+    assert.equal(
+      await approveShellApproval(state, fixture.context, approval.approvalId),
+      true,
+    );
+    const result = await pending_result;
+
+    assert.equal(result.shell.sandboxed, false);
+    assert.equal(result.shell.sandboxMode, "unrestricted");
+    assert.equal(result.shell.approvalStatus, "approved");
+    assert.equal(result.shell.exitCode, 0);
+    assert.equal(result.chunk.output, "unrestricted-ok");
+  } finally {
+    await closeAllShellSessions(state, true);
+    await fs.rm(fixture.root_path, { recursive: true, force: true });
+  }
+});

package/src/shell/ShellPlugin.ts

@@ -29,8 +29,11 @@ import {
   closeAllShellSessions,
   closeShellSession,
   createShellPluginState,
+  approveShellApproval,
+  denyShellApproval,
   execShellCommand,
   getShellSessionStatus,
+  listShellApprovals,
   readShellSession,
   startShellSession,
   waitShellSession,
@@ -108,6 +111,42 @@ export class ShellPlugin extends BasePlugin {
           data: await this.close(params.context, params.payload as ShellCloseRequest),
         }),
       },
+      approvals: {
+        execute: async () => ({
+          success: true,
+          data: { approvals: listShellApprovals(this.state) },
+        }),
+      },
+      approve: {
+        execute: async (params) => {
+          const payload = params.payload as { approvalId?: unknown; approval_id?: unknown };
+          const approvalId = String(payload?.approvalId || payload?.approval_id || "").trim();
+          if (!approvalId) {
+            return { success: false, error: "approvalId is required" };
+          }
+          const ok = await approveShellApproval(this.state, params.context, approvalId);
+          return {
+            success: ok,
+            data: { approvalId, approved: ok },
+            ...(ok ? {} : { error: "approval request not found" }),
+          };
+        },
+      },
+      deny: {
+        execute: async (params) => {
+          const payload = params.payload as { approvalId?: unknown; approval_id?: unknown };
+          const approvalId = String(payload?.approvalId || payload?.approval_id || "").trim();
+          if (!approvalId) {
+            return { success: false, error: "approvalId is required" };
+          }
+          const ok = await denyShellApproval(this.state, params.context, approvalId);
+          return {
+            success: ok,
+            data: { approvalId, denied: ok },
+            ...(ok ? {} : { error: "approval request not found" }),
+          };
+        },
+      },
     };
 
     this.lifecycle = {
@@ -122,6 +161,7 @@ export class ShellPlugin extends BasePlugin {
           }
         }
         this.state.sessions.clear();
+        this.state.approvals.clear();
         this.state.context = null;
       },
     };

package/src/shell/ShellRuntimeTypes.ts

@@ -9,9 +9,58 @@
 
 import type { ChildProcessWithoutNullStreams } from "node:child_process";
 import type { AgentContext } from "@downcity/agent/internal/types/runtime/agent/AgentContext.js";
-import type { ShellSessionSnapshot } from "@downcity/agent/internal/executor/tools/shell/types/ShellPlugin.js";
+import type {
+  ShellApprovalStatus,
+  ShellSessionSnapshot,
+} from "@downcity/agent/internal/executor/tools/shell/types/ShellPlugin.js";
 import type { ResolvedShellPluginOptions } from "@/shell/types/ShellPluginOptions.js";
 
+/**
+ * unrestricted sandbox 审批运行态。
+ */
+export type ShellApprovalRuntimeState = {
+  /**
+   * 当前审批请求 ID。
+   */
+  approvalId: string;
+  /**
+   * 关联的 shell_id。
+   */
+  shellId: string;
+  /**
+   * 所属 session/聊天上下文。
+   */
+  ownerContextId?: string;
+  /**
+   * 关联工具名。
+   */
+  toolName: "shell_exec" | "shell_start";
+  /**
+   * 申请执行的命令。
+   */
+  cmd: string;
+  /**
+   * 命令执行目录。
+   */
+  cwd: string;
+  /**
+   * 申请原因。
+   */
+  reason: string;
+  /**
+   * 当前审批创建时间。
+   */
+  createdAt: number;
+  /**
+   * 审批超时定时器。
+   */
+  timer: NodeJS.Timeout;
+  /**
+   * 兑现审批结果。
+   */
+  resolve: (status: ShellApprovalStatus) => void;
+};
+
 /**
  * 单个 shell wait 调用挂起时注册的 waiter。
  */
@@ -88,6 +137,10 @@ export type ShellPluginState = {
    * 当前实例持有的全部 in-memory shell session。
    */
   sessions: Map<string, ShellSessionRuntimeState>;
+  /**
+   * 当前实例持有的全部 pending unrestricted sandbox 审批。
+   */
+  approvals: Map<string, ShellApprovalRuntimeState>;
   /**
    * 当前实例最近一次启动时绑定的 agent context。
    *