@tencent-ai/agent-sdk 0.3.206 → 0.3.209

package/cli/vendor/shim/sitecustomize.py

@@ -13,8 +13,11 @@ genie-safe-delete — Python 运行时安全删除 shim
 """
 
 import errno
+import builtins
+import io
 import json
 import os
+import socket
 import stat
 import sys
 import tempfile
@@ -29,6 +32,11 @@ _SESSION_ID = (
     or os.environ.get("CLAUDE_SESSION_ID")
 )
 _IN_SANDBOX = os.environ.get("CODEBUDDY_SAFE_DELETE_SANDBOX") == "1"
+_SAFE_DELETE_ENABLED = os.environ.get("CODEBUDDY_SAFE_DELETE_ENABLED") != "0"
+_BROKERED_FS_HOOK_ENABLED = (
+    os.environ.get("CODEBUDDY_BROKERED_FS_HOOK_ENABLED") == "1"
+    or _IN_SANDBOX
+)
 
 if _SESSION_ID:
     # __file__ 在 sitecustomize 加载时指向本文件路径，dirname 即 vendor/shim/
@@ -268,14 +276,484 @@ if _SESSION_ID:
     import pathlib
     import platform
 
+    _orig_builtin_open = builtins.open
+    _orig_io_open = io.open
+    _orig_os_open = os.open
     _orig_remove = os.remove
     _orig_unlink = os.unlink
     _orig_rmdir = os.rmdir
+    _orig_mkdir = os.mkdir
+    _orig_makedirs = os.makedirs
+    _orig_rename = os.rename
+    _orig_replace = os.replace
+    _orig_chmod = os.chmod
+    _orig_link = os.link
+    _orig_symlink = os.symlink
     _orig_shutil_rmtree = shutil.rmtree
+    _orig_shutil_copyfile = shutil.copyfile
+    _orig_shutil_copy2 = shutil.copy2
+    _orig_shutil_copytree = shutil.copytree
     _orig_path_unlink = pathlib.Path.unlink
     _orig_path_rmdir = pathlib.Path.rmdir
+    _orig_path_mkdir = pathlib.Path.mkdir
+    _orig_path_touch = pathlib.Path.touch
     _report_path = os.environ.get("CODEBUDDY_SAFE_DELETE_REPORT_PATH")
 
+    # -----------------------------------------------------------------------
+    # Brokered sandbox file-token support.
+    #
+    # Mirrors the shell/toybox broker model, but the interception point is
+    # Python's runtime file APIs. The host still owns policy and token issuing.
+    # -----------------------------------------------------------------------
+
+    _broker_socket_path = os.environ.get("CODEBUDDY_SANDBOX_BROKER_IPC_ADDRESS")
+    _broker_session_id = os.environ.get("CODEBUDDY_SANDBOX_BROKER_SESSION_ID") or _SESSION_ID
+    _broker_tool_call_id = (
+        os.environ.get("CODEBUDDY_SANDBOX_BROKER_TOOL_CALL_ID")
+        or os.environ.get("CODEBUDDY_TOOL_CALL_ID")
+    )
+    _broker_trace_id = os.environ.get("CODEBUDDY_SANDBOX_BROKER_TRACE_ID")
+    _broker_file_token_command = (
+        os.environ.get("CODEBUDDY_SANDBOX_FILE_TOKEN_OPERATION_COMMAND")
+        or "FileTokenRequest"
+    )
+    _broker_host_operation_command = os.environ.get(
+        "CODEBUDDY_SANDBOX_HOST_FILE_OPERATION_COMMAND"
+    )
+    _broker_request_seq = 0
+    _broker_host_operation_depth = 0
+    _COPYTREE_DEFAULT = object()
+
+    def _broker_enabled():
+        return bool(sys.platform == "darwin" and _BROKERED_FS_HOOK_ENABLED and _broker_socket_path and _broker_session_id and _broker_file_token_command)
+
+    def _broker_write_completed_enabled():
+        return bool(sys.platform == "darwin" and _BROKERED_FS_HOOK_ENABLED and _broker_socket_path and _broker_session_id)
+
+    def _broker_host_ops_enabled():
+        return bool(
+            sys.platform == "darwin"
+            and _BROKERED_FS_HOOK_ENABLED
+            and _broker_socket_path
+            and _broker_session_id
+            and _broker_host_operation_command
+            and _broker_host_operation_depth == 0
+        )
+
+    def _broker_abs_path(file_path, dir_fd=None):
+        if isinstance(file_path, int):
+            return None
+        try:
+            raw_path = os.fspath(file_path)
+        except TypeError:
+            return None
+        if isinstance(raw_path, bytes):
+            try:
+                raw_path = os.fsdecode(raw_path)
+            except UnicodeError:
+                return None
+        if not raw_path:
+            return None
+        if dir_fd is not None and not os.path.isabs(raw_path):
+            return None
+        return os.path.abspath(raw_path)
+
+    def _broker_readline(sock):
+        chunks = []
+        while True:
+            chunk = sock.recv(1)
+            if not chunk:
+                break
+            if chunk == b"\n":
+                break
+            chunks.append(chunk)
+        return b"".join(chunks).decode("utf-8", errors="replace")
+
+    def _broker_consume_token(token):
+        if sys.platform != "darwin":
+            return
+        import ctypes
+
+        lib = ctypes.CDLL(None, use_errno=True)
+        fn = lib.sandbox_extension_consume
+        fn.argtypes = [ctypes.c_char_p]
+        fn.restype = ctypes.c_int64
+        handle = fn(token.encode("utf-8"))
+        if handle <= 0:
+            err = ctypes.get_errno() or errno.EINVAL
+            raise OSError(err, os.strerror(err))
+
+    def _broker_send_request(request):
+        try:
+            with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as sock:
+                sock.settimeout(5)
+                sock.connect(_broker_socket_path)
+                sock.sendall((json.dumps(request, separators=(",", ":")) + "\n").encode("utf-8"))
+                line = _broker_readline(sock)
+        except Exception:
+            return None
+
+        try:
+            response = json.loads(line)
+        except Exception:
+            return None
+        return response if isinstance(response, dict) else None
+
+    def _broker_request_file_token(abs_path, operation):
+        global _broker_request_seq
+        if not _broker_enabled():
+            return
+
+        _broker_request_seq += 1
+        request = {
+            "id": "python-%d" % _broker_request_seq,
+            "command": _broker_file_token_command,
+            "runtime": "python",
+            "operation": operation,
+            "path": abs_path,
+            "sessionId": _broker_session_id,
+        }
+        if _broker_tool_call_id:
+            request["toolCallId"] = _broker_tool_call_id
+        if _broker_trace_id:
+            request["brokerTraceId"] = _broker_trace_id
+
+        response = _broker_send_request(request)
+        if response is None:
+            # Match toybox's fail-to-sandbox behavior: if IPC is unavailable,
+            # do not grant anything here; let the native sandbox decide.
+            return
+
+        token = response.get("token") if response.get("ok") is True else None
+        if isinstance(token, str) and token:
+            _broker_consume_token(token)
+            return
+        if response.get("decision") == "sandbox":
+            return
+
+        raise PermissionError(
+            response.get("error")
+            or "Brokered sandbox denied %s access to %s" % (operation, abs_path)
+        )
+
+    def _broker_notify_file_write_completed(abs_path, existed_before):
+        global _broker_request_seq
+        if existed_before:
+            return
+        if not _broker_write_completed_enabled():
+            return
+
+        _broker_request_seq += 1
+        request = {
+            "id": "python-%d" % _broker_request_seq,
+            "command": "FileWriteCompleted",
+            "runtime": "python",
+            "operation": "write",
+            "path": abs_path,
+            "sessionId": _broker_session_id,
+        }
+        if _broker_tool_call_id:
+            request["toolCallId"] = _broker_tool_call_id
+        if _broker_trace_id:
+            request["brokerTraceId"] = _broker_trace_id
+        _broker_send_request(request)
+
+    def _broker_request_host_operation(operation, primary_path, **fields):
+        global _broker_request_seq
+        if not _broker_host_ops_enabled():
+            return False
+
+        _broker_request_seq += 1
+        request = {
+            "id": "python-%d" % _broker_request_seq,
+            "command": _broker_host_operation_command,
+            "runtime": "python",
+            "operation": operation,
+            "sessionId": _broker_session_id,
+        }
+        request.update(fields)
+        if _broker_tool_call_id:
+            request["toolCallId"] = _broker_tool_call_id
+        if _broker_trace_id:
+            request["brokerTraceId"] = _broker_trace_id
+
+        response = _broker_send_request(request)
+        if response is None:
+            return False
+        if response.get("ok") is True:
+            return True
+        if response.get("decision") == "sandbox":
+            return False
+        raise PermissionError(
+            response.get("error")
+            or "Brokered sandbox denied host %s for %s" % (operation, primary_path)
+        )
+
+    def _broker_call_native_host_operation(fn, *args, **kwargs):
+        global _broker_host_operation_depth
+        _broker_host_operation_depth += 1
+        try:
+            return fn(*args, **kwargs)
+        finally:
+            _broker_host_operation_depth -= 1
+
+    def _broker_operation_for_mode(mode):
+        mode = mode or "r"
+        return "write" if any(ch in mode for ch in "wax+") else "read"
+
+    def _broker_operation_for_flags(flags):
+        write_flags = (
+            os.O_WRONLY
+            | os.O_RDWR
+            | os.O_CREAT
+            | os.O_TRUNC
+            | os.O_APPEND
+            | getattr(os, "O_TMPFILE", 0)
+        )
+        return "write" if flags & write_flags else "read"
+
+    def _broker_gate(file_path, operation, dir_fd=None):
+        abs_path = _broker_abs_path(file_path, dir_fd=dir_fd)
+        if abs_path:
+            _broker_request_file_token(abs_path, operation)
+
+    def _brokered_open(
+        open_fn,
+        file,
+        mode="r",
+        buffering=-1,
+        encoding=None,
+        errors=None,
+        newline=None,
+        closefd=True,
+        opener=None,
+    ):
+        operation = _broker_operation_for_mode(mode)
+        abs_path = _broker_abs_path(file)
+        existed_before = bool(abs_path and os.path.exists(abs_path))
+        if abs_path:
+            _broker_request_file_token(abs_path, operation)
+        file_obj = open_fn(file, mode, buffering, encoding, errors, newline, closefd, opener)
+        if operation == "write" and abs_path and os.path.exists(abs_path):
+            _broker_notify_file_write_completed(abs_path, existed_before)
+        return file_obj
+
+    def _brokered_builtin_open(
+        file,
+        mode="r",
+        buffering=-1,
+        encoding=None,
+        errors=None,
+        newline=None,
+        closefd=True,
+        opener=None,
+    ):
+        return _brokered_open(
+            _orig_builtin_open,
+            file, mode, buffering, encoding, errors, newline, closefd, opener,
+        )
+
+    def _brokered_io_open(
+        file,
+        mode="r",
+        buffering=-1,
+        encoding=None,
+        errors=None,
+        newline=None,
+        closefd=True,
+        opener=None,
+    ):
+        return _brokered_open(
+            _orig_io_open,
+            file, mode, buffering, encoding, errors, newline, closefd, opener,
+        )
+
+    def _brokered_os_open(path, flags, mode=0o777, *, dir_fd=None):
+        _broker_gate(path, _broker_operation_for_flags(flags), dir_fd=dir_fd)
+        if dir_fd is not None:
+            return _orig_os_open(path, flags, mode, dir_fd=dir_fd)
+        return _orig_os_open(path, flags, mode)
+
+    def _brokered_os_mkdir(path, mode=0o777, *, dir_fd=None):
+        abs_path = _broker_abs_path(path, dir_fd=dir_fd)
+        if abs_path and isinstance(mode, int) and _broker_request_host_operation(
+            "mkdir", abs_path, path=abs_path, mode=mode
+        ):
+            return None
+        if dir_fd is not None:
+            return _broker_call_native_host_operation(_orig_mkdir, path, mode, dir_fd=dir_fd)
+        return _broker_call_native_host_operation(_orig_mkdir, path, mode)
+
+    def _brokered_os_makedirs(name, mode=0o777, exist_ok=False):
+        abs_path = _broker_abs_path(name)
+        if abs_path and isinstance(mode, int):
+            if not exist_ok and os.path.exists(abs_path):
+                return _broker_call_native_host_operation(
+                    _orig_makedirs, name, mode=mode, exist_ok=exist_ok
+                )
+            if _broker_request_host_operation(
+                "mkdir", abs_path, path=abs_path, recursive=True, mode=mode
+            ):
+                return None
+        return _broker_call_native_host_operation(
+            _orig_makedirs, name, mode=mode, exist_ok=exist_ok
+        )
+
+    def _brokered_os_rename(src, dst, *, src_dir_fd=None, dst_dir_fd=None):
+        from_path = _broker_abs_path(src, dir_fd=src_dir_fd)
+        to_path = _broker_abs_path(dst, dir_fd=dst_dir_fd)
+        if from_path and to_path and _broker_request_host_operation(
+            "rename", from_path, **{"from": from_path, "to": to_path}
+        ):
+            return None
+        if src_dir_fd is not None or dst_dir_fd is not None:
+            return _broker_call_native_host_operation(
+                _orig_rename, src, dst, src_dir_fd=src_dir_fd, dst_dir_fd=dst_dir_fd
+            )
+        return _broker_call_native_host_operation(_orig_rename, src, dst)
+
+    def _brokered_os_replace(src, dst, *, src_dir_fd=None, dst_dir_fd=None):
+        from_path = _broker_abs_path(src, dir_fd=src_dir_fd)
+        to_path = _broker_abs_path(dst, dir_fd=dst_dir_fd)
+        if from_path and to_path and _broker_request_host_operation(
+            "rename", from_path, **{"from": from_path, "to": to_path}
+        ):
+            return None
+        if src_dir_fd is not None or dst_dir_fd is not None:
+            return _broker_call_native_host_operation(
+                _orig_replace, src, dst, src_dir_fd=src_dir_fd, dst_dir_fd=dst_dir_fd
+            )
+        return _broker_call_native_host_operation(_orig_replace, src, dst)
+
+    def _brokered_os_chmod(path, mode, *, dir_fd=None, follow_symlinks=True):
+        abs_path = _broker_abs_path(path, dir_fd=dir_fd)
+        if abs_path and isinstance(mode, int) and follow_symlinks and _broker_request_host_operation(
+            "chmod", abs_path, path=abs_path, mode=mode
+        ):
+            return None
+        if dir_fd is not None:
+            return _broker_call_native_host_operation(
+                _orig_chmod, path, mode, dir_fd=dir_fd, follow_symlinks=follow_symlinks
+            )
+        return _broker_call_native_host_operation(
+            _orig_chmod, path, mode, follow_symlinks=follow_symlinks
+        )
+
+    def _brokered_os_link(src, dst, *, src_dir_fd=None, dst_dir_fd=None, follow_symlinks=True):
+        from_path = _broker_abs_path(src, dir_fd=src_dir_fd)
+        to_path = _broker_abs_path(dst, dir_fd=dst_dir_fd)
+        should_broker = follow_symlinks and from_path and to_path
+        try:
+            should_broker = should_broker and not os.path.islink(from_path)
+        except Exception:
+            should_broker = False
+        if should_broker and _broker_request_host_operation(
+            "link", from_path, **{"from": from_path, "to": to_path, "symbolic": False}
+        ):
+            return None
+        if src_dir_fd is not None or dst_dir_fd is not None:
+            return _broker_call_native_host_operation(
+                _orig_link, src, dst, src_dir_fd=src_dir_fd, dst_dir_fd=dst_dir_fd,
+                follow_symlinks=follow_symlinks
+            )
+        return _broker_call_native_host_operation(
+            _orig_link, src, dst, follow_symlinks=follow_symlinks
+        )
+
+    def _brokered_os_symlink(src, dst, target_is_directory=False, *, dir_fd=None):
+        source = None
+        try:
+            source = os.fspath(src)
+            if isinstance(source, bytes):
+                source = os.fsdecode(source)
+        except (TypeError, UnicodeError):
+            source = None
+        to_path = _broker_abs_path(dst, dir_fd=dir_fd)
+        if source and to_path and _broker_request_host_operation(
+            "link", to_path, **{"from": source, "to": to_path, "symbolic": True}
+        ):
+            return None
+        if dir_fd is not None:
+            return _broker_call_native_host_operation(
+                _orig_symlink, src, dst, target_is_directory, dir_fd=dir_fd
+            )
+        return _broker_call_native_host_operation(
+            _orig_symlink, src, dst, target_is_directory
+        )
+
+    def _brokered_shutil_copyfile(src, dst, *, follow_symlinks=True):
+        from_path = _broker_abs_path(src)
+        to_path = _broker_abs_path(dst)
+        if follow_symlinks and from_path and to_path and _broker_request_host_operation(
+            "copy", from_path, **{"from": from_path, "to": to_path, "recursive": False}
+        ):
+            return dst
+        return _broker_call_native_host_operation(
+            _orig_shutil_copyfile, src, dst, follow_symlinks=follow_symlinks
+        )
+
+    def _brokered_shutil_copytree(
+        src,
+        dst,
+        symlinks=False,
+        ignore=None,
+        copy_function=_COPYTREE_DEFAULT,
+        ignore_dangling_symlinks=False,
+        dirs_exist_ok=False,
+    ):
+        native_copy_function = (
+            _orig_shutil_copy2
+            if copy_function is _COPYTREE_DEFAULT
+            else copy_function
+        )
+        can_broker = (
+            symlinks is False
+            and ignore is None
+            and native_copy_function is _orig_shutil_copy2
+            and ignore_dangling_symlinks is False
+            and dirs_exist_ok is False
+        )
+        from_path = _broker_abs_path(src) if can_broker else None
+        to_path = _broker_abs_path(dst) if can_broker else None
+        if from_path and to_path and _broker_request_host_operation(
+            "copy", from_path, **{"from": from_path, "to": to_path, "recursive": True}
+        ):
+            return dst
+        return _broker_call_native_host_operation(
+            _orig_shutil_copytree,
+            src,
+            dst,
+            symlinks=symlinks,
+            ignore=ignore,
+            copy_function=native_copy_function,
+            ignore_dangling_symlinks=ignore_dangling_symlinks,
+            dirs_exist_ok=dirs_exist_ok,
+        )
+
+    def _brokered_path_mkdir(self, mode=0o777, parents=False, exist_ok=False):
+        abs_path = _broker_abs_path(self)
+        if abs_path and isinstance(mode, int):
+            if not exist_ok and os.path.exists(abs_path):
+                return _broker_call_native_host_operation(
+                    _orig_path_mkdir, self, mode=mode, parents=parents, exist_ok=exist_ok
+                )
+            if _broker_request_host_operation(
+                "mkdir", abs_path, path=abs_path, recursive=parents, mode=mode
+            ):
+                return None
+        return _broker_call_native_host_operation(
+            _orig_path_mkdir, self, mode=mode, parents=parents, exist_ok=exist_ok
+        )
+
+    def _brokered_path_touch(self, mode=0o666, exist_ok=True):
+        abs_path = _broker_abs_path(self)
+        can_broker = abs_path and mode == 0o666 and (exist_ok or not os.path.exists(abs_path))
+        if can_broker and _broker_request_host_operation("touch", abs_path, path=abs_path):
+            return None
+        return _broker_call_native_host_operation(
+            _orig_path_touch, self, mode=mode, exist_ok=exist_ok
+        )
+
     def _path_for_compare(path):
         return os.path.normcase(os.path.realpath(os.path.abspath(path)))
 
@@ -314,7 +792,7 @@ if _SESSION_ID:
         if not _report_path:
             return
         try:
-            with open(_report_path, "a", encoding="utf-8") as f:
+            with _orig_builtin_open(_report_path, "a", encoding="utf-8") as f:
                 f.write(json.dumps({
                     "operation": "trash",
                     "runtime": "python",
@@ -419,11 +897,30 @@ if _SESSION_ID:
         return False
 
     # -----------------------------------------------------------------------
-    # 核心：尝试移入回收站。优先 binary，降级到平台内联实现。
+    # 核心：移入回收站。
     # 返回 True=已移入回收站；抛错=fail-closed，调用方不得真删。
     # -----------------------------------------------------------------------
 
-    def _try_trash(abs_path):
+    def _try_broker_delete(abs_path, recursive=False, force=False):
+        if not _broker_host_ops_enabled():
+            return "unavailable"
+        try:
+            if _broker_request_host_operation(
+                "delete",
+                abs_path,
+                path=abs_path,
+                deleteMode="trash",
+                recursive=bool(recursive),
+                force=bool(force),
+            ):
+                return "ok"
+            return "unavailable"
+        except PermissionError:
+            return "denied"
+        except Exception:
+            return "unavailable"
+
+    def _try_trash(abs_path, recursive=False, force=False):
         if sys.platform == "win32" and _IN_SANDBOX:
             message = (
                 "[safe-delete][SAFE_DELETE_FAIL_CLOSED] "
@@ -439,6 +936,15 @@ if _SESSION_ID:
                 pass
             raise OSError(message)
         _check_bulk_delete_guard(abs_path)
+
+        broker_result = _try_broker_delete(abs_path, recursive=recursive, force=force)
+        if broker_result == "ok":
+            return True
+        if broker_result == "denied":
+            raise PermissionError(
+                "[safe-delete] broker denied delete: path=%s" % abs_path
+            )
+
         if _try_trash_via_binary(abs_path):
             _record_trash(abs_path)
             return True
@@ -461,17 +967,18 @@ if _SESSION_ID:
         except OSError:
             return False
 
-    def _is_under_os_tmp_dir(abs_path):
+    def _is_under_root(root, abs_path):
         try:
             target = _path_for_compare(os.fsdecode(abs_path))
-        except (TypeError, UnicodeError):
+            root_path = _path_for_compare(root)
+            rel = os.path.relpath(target, root_path)
+        except (TypeError, UnicodeError, ValueError):
             return False
+        return rel not in ("", ".") and rel != ".." and not rel.startswith(".." + os.sep) and not os.path.isabs(rel)
+
+    def _is_under_os_tmp_dir(abs_path):
         for tmp_dir in _os_tmp_dirs:
-            try:
-                rel = os.path.relpath(target, tmp_dir)
-            except ValueError:
-                continue
-            if rel not in ("", ".") and rel != ".." and not rel.startswith(".." + os.sep) and not os.path.isabs(rel):
+            if _is_under_root(tmp_dir, abs_path):
                 return True
         return False
 
@@ -489,6 +996,9 @@ if _SESSION_ID:
                 return True
         return False
 
+    def _should_bypass_safe_delete(abs_path):
+        return _is_under_os_tmp_dir(abs_path) or _is_pip_site_packages_temp_dir(abs_path)
+
     # -----------------------------------------------------------------------
     # 包装：os.remove / os.unlink （文件，不能是目录）
     # -----------------------------------------------------------------------
@@ -498,7 +1008,7 @@ if _SESSION_ID:
         if dir_fd is not None:
             return _orig_remove(path, dir_fd=dir_fd)
         abs_path = os.path.abspath(os.fspath(path))
-        if _is_under_os_tmp_dir(abs_path) or _is_pip_site_packages_temp_dir(abs_path):
+        if _should_bypass_safe_delete(abs_path):
             return _orig_remove(path)
         st = _safe_lstat(abs_path)
         if not st:
@@ -515,7 +1025,7 @@ if _SESSION_ID:
         if dir_fd is not None:
             return _orig_rmdir(path, dir_fd=dir_fd)
         abs_path = os.path.abspath(os.fspath(path))
-        if _is_under_os_tmp_dir(abs_path) or _is_pip_site_packages_temp_dir(abs_path):
+        if _should_bypass_safe_delete(abs_path):
             return _orig_rmdir(path)
         st = _safe_lstat(abs_path)
         if not st:
@@ -539,7 +1049,7 @@ if _SESSION_ID:
                 path, ignore_errors=ignore_errors, onerror=onerror, **kwargs
             )
 
-        if _is_under_os_tmp_dir(abs_path) or _is_pip_site_packages_temp_dir(abs_path):
+        if _should_bypass_safe_delete(abs_path):
             return _orig_shutil_rmtree(
                 path, ignore_errors=ignore_errors, onerror=onerror, **kwargs
             )
@@ -556,7 +1066,7 @@ if _SESSION_ID:
             )
 
         try:
-            _try_trash(abs_path)
+            _try_trash(abs_path, recursive=True)
         except Exception as e:
             if ignore_errors:
                 return
@@ -571,7 +1081,7 @@ if _SESSION_ID:
 
     def _safe_path_unlink(self, missing_ok=False):
         abs_path = os.path.abspath(str(self))
-        if _is_under_os_tmp_dir(abs_path) or _is_pip_site_packages_temp_dir(abs_path):
+        if _should_bypass_safe_delete(abs_path):
             return _orig_path_unlink(self, missing_ok=missing_ok)
         st = _safe_lstat(abs_path)
         if not st:
@@ -584,7 +1094,7 @@ if _SESSION_ID:
 
     def _safe_path_rmdir(self):
         abs_path = os.path.abspath(str(self))
-        if _is_under_os_tmp_dir(abs_path) or _is_pip_site_packages_temp_dir(abs_path):
+        if _should_bypass_safe_delete(abs_path):
             return _orig_path_rmdir(self)
         st = _safe_lstat(abs_path)
         if not st:
@@ -599,9 +1109,28 @@ if _SESSION_ID:
     # 安装 patch
     # -----------------------------------------------------------------------
 
-    os.remove = _safe_remove
-    os.unlink = _safe_remove  # CPython 里 os.unlink is os.remove，显式 patch 兼容其它实现
-    os.rmdir = _safe_rmdir
-    shutil.rmtree = _safe_shutil_rmtree
-    pathlib.Path.unlink = _safe_path_unlink
-    pathlib.Path.rmdir = _safe_path_rmdir
+    if _broker_enabled():
+        builtins.open = _brokered_builtin_open
+        io.open = _brokered_io_open
+        os.open = _brokered_os_open
+
+    if _broker_host_ops_enabled():
+        os.mkdir = _brokered_os_mkdir
+        os.makedirs = _brokered_os_makedirs
+        os.rename = _brokered_os_rename
+        os.replace = _brokered_os_replace
+        os.chmod = _brokered_os_chmod
+        os.link = _brokered_os_link
+        os.symlink = _brokered_os_symlink
+        shutil.copyfile = _brokered_shutil_copyfile
+        shutil.copytree = _brokered_shutil_copytree
+        pathlib.Path.mkdir = _brokered_path_mkdir
+        pathlib.Path.touch = _brokered_path_touch
+
+    if _SAFE_DELETE_ENABLED:
+        os.remove = _safe_remove
+        os.unlink = _safe_remove  # CPython 里 os.unlink is os.remove，显式 patch 兼容其它实现
+        os.rmdir = _safe_rmdir
+        shutil.rmtree = _safe_shutil_rmtree
+        pathlib.Path.unlink = _safe_path_unlink
+        pathlib.Path.rmdir = _safe_path_rmdir

package/cli/vendor/toybox-macos/LICENSE

@@ -0,0 +1,12 @@
+Copyright (C) 2006, 2019 by Rob Landley <rob@landley.net>
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.