@xcanwin/manyoyo 8.2.1 → 8.3.0

package/README.en.md

@@ -0,0 +1,88 @@
+<p align="center">
+  <img src="./assets/manyoyo-logo-09-cyberpunk-terminal.svg" alt="MANYOYO logo" width="560" />
+</p>
+
+# <p align="center"><a href="https://github.com/xcanwin/manyoyo">MANYOYO</a></p>
+<p align="center"><b>MANYOYO – open-source sandbox for running AI coding agents (Claude Code / Codex / Gemini) safely in Docker/Podman</b></p>
+<p align="center">Run Claude Code / Codex / Gemini / OpenCode in YOLO mode inside a container: let the AI go wild without hurting your computer.</p>
+<p align="center">
+  <a href="https://www.npmjs.com/package/@xcanwin/manyoyo"><img alt="npm" src="https://img.shields.io/npm/v/@xcanwin/manyoyo?style=flat-square" /></a>
+  <a href="https://github.com/xcanwin/manyoyo/actions/workflows/npm-publish.yml"><img alt="Build status" src="https://img.shields.io/github/actions/workflow/status/xcanwin/manyoyo/npm-publish.yml?style=flat-square" /></a>
+  <a href="https://github.com/xcanwin/manyoyo/blob/main/LICENSE"><img alt="license" src="https://img.shields.io/badge/License-MIT-yellow.svg" /></a>
+</p>
+
+<p align="center">
+  <a href="README.md">中文</a> |
+  <a href="README.en.md"><b>English</b></a>
+</p>
+<p align="center">
+  Docs: <a href="https://xcanwin.github.io/manyoyo/en/">https://xcanwin.github.io/manyoyo/en/</a>
+</p>
+
+---
+
+## Install
+
+### macOS / Linux (recommended)
+
+```bash
+curl -fsSL https://github.com/xcanwin/manyoyo/raw/main/scripts/install.sh | sh
+```
+
+When it finishes, follow the on-screen prompts to finish setup. macOS needs nothing installed first. Linux: if the container runtime is missing, the installer explains why and, with your consent, installs it with sudo.
+
+### Already have Node.js and Docker/Podman
+
+```bash
+npm install -g @xcanwin/manyoyo
+manyoyo
+```
+
+## Daily use
+
+```bash
+manyoyo            # open the web UI
+manyoyo update     # upgrade
+manyoyo uninstall  # uninstall (config and data are kept by default)
+```
+
+## Command line (optional)
+
+```bash
+manyoyo init all   # import the agent configs already on this machine
+manyoyo run -y c   # start Claude Code in YOLO mode inside the sandbox
+```
+
+The default image `ghcr.io/xcanwin/manyoyo` is pulled automatically on first use; run `manyoyo build --iv 2.1.0-common` only if you need a custom image. More commands: [CLI reference](https://xcanwin.github.io/manyoyo/en/reference/cli-options).
+
+## What it does
+
+- **Multiple agents**: `claude`, `codex`, `gemini`, `opencode` behind one entry point
+- **Container isolation**: Docker / Podman; the agent only sees the work directory you give it
+- **Web UI**: chat, browse files and open a terminal in the browser, phone friendly
+- **One config**: run profiles, environment variables, mounts and image arguments in `~/.manyoyo/manyoyo.json`
+- **One command** to install, upgrade and uninstall
+
+| | Running the agent CLI directly | MANYOYO |
+| --- | --- | --- |
+| Host exposure | High | Lower |
+| Run boundary | Scattered | Centralised in the container and config |
+| Reproducible environment | Weak | Strong (image + config) |
+| High-risk mode warnings | Left to the tool | Explicit YOLO / SOLO / sock warnings |
+
+## Security notes
+
+MANYOYO reduces risk but is not "absolutely safe": the main isolation is a container, not a virtual machine; `YOLO / SOLO` can still run dangerous commands; `sock` mode exposes the host Docker socket; set a strong password before listening on a public address. See [Security notes](https://xcanwin.github.io/manyoyo/en/guide/security).
+
+## Docs
+
+- 中文: <https://xcanwin.github.io/manyoyo/>
+- English: <https://xcanwin.github.io/manyoyo/en/> ([Install](https://xcanwin.github.io/manyoyo/en/guide/quick-start), [CLI reference](https://xcanwin.github.io/manyoyo/en/reference/cli-options), [Configuration](https://xcanwin.github.io/manyoyo/en/configuration/), [FAQ](https://xcanwin.github.io/manyoyo/en/troubleshooting/))
+
+## License
+
+MIT
+
+## Contributing
+
+[Issues](https://github.com/xcanwin/manyoyo/issues) and pull requests are welcome.

package/README.md

@@ -3,7 +3,8 @@
 </p>
 
 # <p align="center"><a href="https://github.com/xcanwin/manyoyo">MANYOYO（慢悠悠）</a></p>
-<p align="center">让 Claude Code / Codex / Gemini / OpenCode 在容器里放心跑 YOLO 模式：AI 随便折腾，伤不到你的电脑。</p>
+<p align="center"><b>MANYOYO – open-source sandbox for running AI coding agents (Claude Code / Codex / Gemini) safely in Docker/Podman</b></p>
+<p align="center">开源 AI Agent 沙箱：让 Claude Code / Codex / Gemini / OpenCode 在容器里放心跑 YOLO 模式，AI 随便折腾，伤不到你的电脑。</p>
 <p align="center">
   <a href="https://www.npmjs.com/package/@xcanwin/manyoyo"><img alt="npm" src="https://img.shields.io/npm/v/@xcanwin/manyoyo?style=flat-square" /></a>
   <a href="https://github.com/xcanwin/manyoyo/actions/workflows/npm-publish.yml"><img alt="Build status" src="https://img.shields.io/github/actions/workflow/status/xcanwin/manyoyo/npm-publish.yml?style=flat-square" /></a>
@@ -12,7 +13,7 @@
 
 <p align="center">
   <a href="README.md"><b>中文</b></a> |
-  <a href="https://xcanwin.github.io/manyoyo/en/">English</a>
+  <a href="README.en.md">English</a>
 </p>
 <p align="center">
   文档：<a href="https://xcanwin.github.io/manyoyo/">https://xcanwin.github.io/manyoyo/</a>
@@ -28,7 +29,7 @@
 curl -fsSL https://github.com/xcanwin/manyoyo/raw/main/scripts/install.sh | sh
 ```
 
-装完浏览器自动打开，按向导选 Agent、填 Key 就能开始对话。macOS 不需要预装任何东西；Linux 需要已有 Docker 或 Podman。
+装完按屏幕提示完成配置。macOS 不需要预装任何东西。Linux：缺少容器环境时，安装器会说明原因，征得你同意后用 sudo 自动安装。
 
 ### 已有 Node.js 和 Docker/Podman
 

package/bin/manyoyo.js

@@ -9,7 +9,7 @@ const net = require('net');
 const readline = require('readline');
 const { Command, Help } = require('commander');
 const { startWebServer } = require('../lib/web/server');
-const { buildContainerRunArgs, buildContainerRunCommand } = require('../lib/container-run');
+const { buildContainerRunArgs, buildContainerRunCommand, runWithEnvFile } = require('../lib/container-run');
 const { getManyoyoConfigPath, readManyoyoConfig, syncGlobalImageVersion } = require('../lib/global-config');
 const { resolveUpdateImageVersion } = require('../lib/image-version-policy');
 const { selectContainerRuntime, mergeRuntimeEnv } = require('../lib/container-runtime');
@@ -47,6 +47,7 @@ const { applyAptMirror } = require('../lib/mirrors');
 const {
     sanitizeSensitiveData,
     sanitizeServeLogText,
+    redactCommandArgs,
     formatServeLogValue,
     getServeProcessSnapshot
 } = require('../lib/serve-log');
@@ -728,6 +729,18 @@ async function ensureRunImage(runtime) {
     });
 }
 
+// 把 run 失败的 stderr 尾部（已打码）与可执行的修复提示拼进错误信息，而不是只剩一行 Command failed
+function explainCreateFailure(err) {
+    const raw = getCommandFailureText(err);
+    const tail = sanitizeServeLogText(String(err && err.stderr || '')).trim().split('\n').slice(-8).join('\n');
+    const info = describeError(raw, { command: DOCKER_CMD });
+    const parts = [err.message];
+    if (tail) parts.push(tail);
+    if (info && info.code === 'ROOTLESS_NETWORK_MISSING') parts.push(`提示: ${info.reason}\n${info.action}`);
+    err.message = parts.join('\n');
+    return err;
+}
+
 function showImagePullHint(err) {
     const info = describeError(getCommandFailureText(err), { imageRef: `${IMAGE_NAME}:${IMAGE_VERSION}` });
     if (!info || !['IMAGE_PULL_FAILED', 'IMAGE_NOT_FOUND'].includes(info.code)) {
@@ -753,7 +766,7 @@ function runCmd(cmd, args, options = {}) {
         if (options.ignoreError) {
             return result.stdout || '';
         }
-        const err = new Error(`Command failed: ${cmd} ${args.join(' ')}`);
+        const err = new Error(`Command failed: ${cmd} ${redactCommandArgs(args).join(' ')}`);
         err.stdout = result.stdout;
         err.stderr = result.stderr;
         err.status = result.status;
@@ -1473,6 +1486,9 @@ https://github.com/xcanwin/manyoyo
         await runAppLauncher({ force: launcherArgs.force });
     }
 
+    // 顶层 -V 与 -v 等价（commander 只允许一个短选项；子命令里的 -v 仍是 --volume，不受影响）
+    if (process.argv.length === 3 && process.argv[2] === '-V') process.argv[2] = '-v';
+
     // Pre-handle -x/--shell-full: treat all following args as a single command
     normalizeShellFullArgv(process.argv);
     normalizeWorktreeArgv(process.argv);
@@ -1581,8 +1597,10 @@ https://github.com/xcanwin/manyoyo
         };
     }
 
-    // Load run config if specified
-    const runConfig = options.run ? loadRunConfig(options.run, config) : {};
+    // Load run config if specified；doctor 不带 -r 且 runs 里只有一个配置时，按它检查
+    const runsMap = config.runs && typeof config.runs === 'object' && !Array.isArray(config.runs) ? Object.keys(config.runs) : [];
+    const runNameToLoad = options.run || (selectedAction === 'doctor' && runsMap.length === 1 ? runsMap[0] : '');
+    const runConfig = runNameToLoad ? loadRunConfig(runNameToLoad, config) : {};
     const globalFirstConfig = normalizeFirstConfig(config.first, '全局配置');
     const runFirstConfig = normalizeFirstConfig(runConfig.first, '运行配置');
 
@@ -2175,10 +2193,12 @@ async function createNewContainer(runtime) {
     // 使用数组参数执行命令（安全方式）
     try {
         const args = buildDockerRunArgs(runtime);
-        dockerExecArgs(args, { stdio: 'pipe' });
+        runWithEnvFile(args, path.join(os.homedir(), '.manyoyo', 'tmp'), finalArgs => dockerExecArgs(finalArgs, { stdio: 'pipe' }));
     } catch (e) {
         showImagePullHint(e);
-        throw e;
+        // 失败的 run 可能留下 Created 状态的容器；这个名字创建前不存在，所以只清理本次留下的这一个
+        try { dockerExecArgs(['rm', '-f', runtime.containerName], { stdio: 'pipe' }); } catch (cleanupError) { /* 尽力清理 */ }
+        throw explainCreateFailure(e);
     }
 
     // Wait for container to be ready
@@ -2223,7 +2243,7 @@ function buildDockerRunArgs(runtime) {
  * @returns {string} 命令字符串
  */
 function buildDockerRunCmd(runtime) {
-    const args = buildDockerRunArgs(runtime);
+    const args = redactCommandArgs(buildDockerRunArgs(runtime));
     return buildContainerRunCommand(DOCKER_CMD, args);
 }
 

package/docker/res/claude/settings.json

@@ -1,4 +1,9 @@
 {
+    "attribution": {
+        "commit": "",
+        "pr": "",
+        "sessionUrl": false
+    },
     "statusLine": {
         "type": "command",
         "command": "bash /root/.claude/statusline.sh"

package/lib/container-run.js

@@ -1,5 +1,8 @@
 'use strict';
 
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
 const { buildMirrorEnvArgs } = require('./mirrors');
 
 function sanitizeDefaultCommand(defaultCommand) {
@@ -26,6 +29,38 @@ function buildContainerRunArgs(options) {
     return args;
 }
 
+/**
+ * 把命令行里的 `--env KEY=值` 挪进 0600 的临时 env 文件，改用 `--env-file` 传入，
+ * 避免密钥出现在 ps / /proc 与错误信息里；exec 返回（或抛错）后立即删除文件。
+ * 没有 KEY=值 形式的 env 时原样执行。
+ */
+function runWithEnvFile(args, dir, exec) {
+    const rest = [];
+    const lines = [];
+    let envFileIndex = -1;
+    for (let i = 0; i < args.length; i++) {
+        if (args[i] === '--env' && /^[^=]+=/.test(String(args[i + 1] ?? ''))) {
+            if (envFileIndex < 0) envFileIndex = rest.length;
+            lines.push(args[i + 1]);
+            i += 1;
+        } else {
+            rest.push(args[i]);
+        }
+    }
+    if (!lines.length) return exec(args);
+
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    fs.chmodSync(dir, 0o700);
+    const file = path.join(dir, `env-${process.pid}-${crypto.randomBytes(4).toString('hex')}`);
+    fs.writeFileSync(file, `${lines.join('\n')}\n`, { mode: 0o600, flag: 'wx' });
+    rest.splice(envFileIndex, 0, '--env-file', file);
+    try {
+        return exec(rest);
+    } finally {
+        fs.rmSync(file, { force: true });
+    }
+}
+
 function quoteShellArg(value) {
     const text = String(value);
     if (text.includes(' ') || text.includes('"') || text.includes('=')) {
@@ -40,5 +75,6 @@ function buildContainerRunCommand(dockerCmd, args) {
 
 module.exports = {
     buildContainerRunArgs,
+    runWithEnvFile,
     buildContainerRunCommand
 };

package/lib/doctor.js

@@ -2,6 +2,8 @@
 
 const { resolveContainerMode } = require('./container-modes');
 const { resolveAgentProgram } = require('./agent-resume');
+const { describeError } = require('./error-hints');
+const { checkRootlessNetwork } = require('./rootless-network');
 
 function createCheck(code, status, summary, action = '', detail = '') {
     return { code, status, summary, action, detail };
@@ -9,6 +11,8 @@ function createCheck(code, status, summary, action = '', detail = '') {
 
 // 卡死的 daemon（如无响应的 Docker Desktop）不能让诊断无限挂起
 const COMMAND_TIMEOUT_MS = 10000;
+// 真实启动一次容器（含网络配置），比 info 慢
+const START_TEST_TIMEOUT_MS = 60000;
 
 // runCommand 可以是同步或异步执行器；serve 里传异步的，避免阻塞事件循环
 async function runDoctorChecks(options = {}) {
@@ -45,13 +49,37 @@ async function runDoctorChecks(options = {}) {
         } catch (error) {
             checks.push(createCheck('DAEMON_UNAVAILABLE', 'error', `${runtimeCommand} daemon 不可用`, `启动 ${runtimeCommand} daemon 后重试。`, error.message || ''));
         }
+        const network = await checkRootlessNetwork(runCommand, { command: runtimeCommand, env: runtimeEnv, timeout: COMMAND_TIMEOUT_MS, platform: options.platform });
+        if (network && network.missing) {
+            checks.push(createCheck('ROOTLESS_NETWORK_MISSING', 'error', network.reason, network.action));
+        } else if (network) {
+            checks.push(createCheck('ROOTLESS_NETWORK_OK', 'ok', `rootless 网络组件可用: ${network.component}`));
+        }
+        const image = `${options.imageName || ''}:${options.imageVersion || ''}`;
+        let imageAvailable = false;
         try {
-            const image = `${options.imageName || ''}:${options.imageVersion || ''}`;
             const detail = String(await runCommand(runtimeCommand, ['image', 'inspect', image], { env: runtimeEnv, timeout: COMMAND_TIMEOUT_MS }) || '').trim();
             checks.push(createCheck('IMAGE_AVAILABLE', 'ok', `镜像可用: ${image}`, '', detail));
+            imageAvailable = true;
         } catch (error) {
             checks.push(createCheck('IMAGE_MISSING', 'warning', '目标镜像尚不可用', '执行 manyoyo build，或拉取匹配镜像。', error.message || ''));
         }
+        // 镜像在、网络组件也没查出问题时，真实启动一次：info 正常不代表容器能起来
+        if (imageAvailable && !(network && network.missing)) {
+            try {
+                await runCommand(runtimeCommand, ['run', '--rm', '--entrypoint', '', image, 'true'], { env: runtimeEnv, timeout: START_TEST_TIMEOUT_MS });
+                checks.push(createCheck('CONTAINER_START_OK', 'ok', '容器可以正常启动'));
+            } catch (error) {
+                const raw = `${error.message || ''}\n${error.stderr || ''}`;
+                const info = describeError(raw, { command: runtimeCommand, imageRef: image });
+                checks.push(createCheck(
+                    'CONTAINER_START_FAILED', 'error',
+                    info ? info.reason : '容器无法启动',
+                    info ? info.action : `手动执行 ${runtimeCommand} run --rm ${image} true 查看原因。`,
+                    String(error.stderr || error.message || '').trim().split('\n').slice(-5).join('\n')
+                ));
+            }
+        }
     }
 
     checks.push(options.configExists === true
@@ -71,9 +99,13 @@ async function runDoctorChecks(options = {}) {
     }
 
     const pluginConfig = options.pluginConfig;
-    checks.push(pluginConfig && typeof pluginConfig === 'object' && !Array.isArray(pluginConfig)
-        ? createCheck('PLUGIN_CONFIG_VALID', 'ok', '插件配置有效')
-        : createCheck('PLUGIN_CONFIG_INVALID', 'warning', '插件配置不存在或格式无效', '将 plugins 配置为对象(map)。'));
+    if (pluginConfig === undefined || pluginConfig === null) {
+        checks.push(createCheck('PLUGIN_CONFIG_VALID', 'ok', '未配置插件'));
+    } else {
+        checks.push(typeof pluginConfig === 'object' && !Array.isArray(pluginConfig)
+            ? createCheck('PLUGIN_CONFIG_VALID', 'ok', '插件配置有效')
+            : createCheck('PLUGIN_CONFIG_INVALID', 'warning', '插件配置格式无效', '将 plugins 配置为对象(map)。'));
+    }
 
     if (options.portStatus === 'available') {
         checks.push(createCheck('PORT_AVAILABLE', 'ok', '监听端口可用'));

package/lib/error-hints.js

@@ -1,7 +1,14 @@
 'use strict';
 
+const { describeMissing } = require('./rootless-network');
+
 // 原始运行时/系统错误 -> “原因 + 下一步”。新增映射只改这里。
 const RULES = [
+    {
+        code: 'ROOTLESS_NETWORK_MISSING',
+        pattern: /could not find (slirp4netns|pasta)/i,
+        describe: (ctx, match) => describeMissing(match[1].toLowerCase(), ctx)
+    },
     {
         code: 'PODMAN_MACHINE_UNAVAILABLE',
         pattern: /Cannot connect to Podman|unable to connect to Podman socket|podman machine start|podman system connection/i,
@@ -78,8 +85,9 @@ function describeError(text, context = {}) {
     const raw = String(text || '');
     const ctx = { command: 'docker', imageRef: '', port: '', ...context };
     for (const rule of RULES) {
-        if (rule.pattern.test(raw)) {
-            return { code: rule.code, ...rule.describe(ctx) };
+        const match = rule.pattern.exec(raw);
+        if (match) {
+            return { code: rule.code, ...rule.describe(ctx, match) };
         }
     }
     return null;

package/lib/json5-text-edit.js

@@ -235,11 +235,26 @@ function formatPropertyKey(key) {
     return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key) ? key : JSON.stringify(key);
 }
 
+// 某个位置所在行的缩进
+function lineIndentAt(text, index) {
+    const lineStart = text.lastIndexOf('\n', index - 1) + 1;
+    return /^[ \t]*/.exec(text.slice(lineStart))[0];
+}
+
+// 多行值（JSON.stringify 的结果）的后续行补上插入位置的缩进，否则内层会顶格
+function reindent(valueText, indent) {
+    return String(valueText).replace(/\n/g, `\n${indent}`);
+}
+
 // 永远只在对象的 '{' 后面插入，不管这个对象原来是空的还是已经有属性——
 // 不用去判断"是不是最后一个属性、要不要补逗号"，语法上总是安全的
 function insertObjectProperty(text, objectStartIndex, key, valueText) {
-    const prefix = `\n    ${formatPropertyKey(key)}: `;
-    const insertion = `${prefix}${valueText},`;
+    const objectIndent = lineIndentAt(text, objectStartIndex);
+    const childIndent = `${objectIndent}    `;
+    const prefix = `\n${childIndent}${formatPropertyKey(key)}: `;
+    // 空对象：闭合的 } 另起一行，不要贴在逗号后面
+    const closesRightAfter = text[skipTrivia(text, objectStartIndex + 1)] === '}';
+    const insertion = `${prefix}${reindent(valueText, childIndent)},${closesRightAfter ? `\n${objectIndent}` : ''}`;
     const insertPos = objectStartIndex + 1;
     const nextText = `${text.slice(0, insertPos)}${insertion}${text.slice(insertPos)}`;
     return { text: nextText, valueStart: insertPos + prefix.length };
@@ -269,7 +284,7 @@ function upsertValueByPath(text, pathParts, valueText) {
         if (existingRange) {
             if (isLast) {
                 return applyTextReplacements(currentText, [
-                    { start: existingRange.start, end: existingRange.end, text: valueText }
+                    { start: existingRange.start, end: existingRange.end, text: reindent(valueText, lineIndentAt(currentText, existingRange.start)) }
                 ]);
             }
             const nextObjectStart = skipTrivia(currentText, existingRange.start);

package/lib/rootless-network.js

@@ -0,0 +1,68 @@
+'use strict';
+
+const fs = require('fs');
+
+// rootless podman 的默认网络组件：4.x 用 slirp4netns，5.x 起用 pasta
+const PACKAGE_OF = { slirp4netns: 'slirp4netns', pasta: 'passt' };
+
+function parsePodmanMajor(versionText) {
+    const match = /(\d+)\.\d+/.exec(String(versionText || ''));
+    return match ? Number(match[1]) : null;
+}
+
+function defaultNetworkComponent(major) {
+    return major !== null && major >= 5 ? 'pasta' : 'slirp4netns';
+}
+
+function readOsRelease() {
+    try {
+        return fs.readFileSync('/etc/os-release', 'utf8');
+    } catch (e) {
+        return '';
+    }
+}
+
+function hasCommand(name) {
+    return String(process.env.PATH || '').split(':').some(dir => dir && fs.existsSync(`${dir}/${name}`));
+}
+
+// 与 scripts/offline/install.sh 的 Linux 分支保持同一套规则；不认识的发行版返回 null（只给说明）
+function installCommand(component, { osRelease = readOsRelease(), hasDnf = hasCommand('dnf') } = {}) {
+    const pkg = PACKAGE_OF[component] || component;
+    const ids = (String(osRelease).match(/^(?:ID|ID_LIKE)=(.*)$/gm) || [])
+        .map(line => line.split('=')[1].replace(/["']/g, '').toLowerCase())
+        .join(' ')
+        .split(/\s+/);
+    if (ids.some(id => id === 'debian' || id === 'ubuntu')) return `sudo apt-get install -y ${pkg}`;
+    if (ids.some(id => ['fedora', 'rhel', 'centos'].includes(id))) return `sudo ${hasDnf ? 'dnf' : 'yum'} install -y ${pkg}`;
+    return null;
+}
+
+function describeMissing(component, options) {
+    const pkg = PACKAGE_OF[component] || component;
+    const command = installCommand(component, options);
+    return {
+        reason: `rootless Podman 缺少默认网络组件 ${component}，容器无法创建网络。`,
+        action: command ? `请执行: ${command}` : `请用系统包管理器安装 ${pkg}（提供 ${component}）。`
+    };
+}
+
+/**
+ * 检查 rootless podman 的默认网络组件是否存在（只在 Linux 的 podman 上检查）。
+ * @returns {Promise<null|{component: string, reason: string, action: string}>} null 表示无需处理
+ */
+async function checkRootlessNetwork(runCommand, { command, env, timeout, platform = process.platform } = {}) {
+    if (platform !== 'linux' || !/(^|\/)podman$/.test(String(command || ''))) return null;
+    const run = async args => String(await runCommand(command, args, { env, timeout }) || '').trim();
+    try {
+        if ((await run(['info', '--format', '{{.Host.Security.Rootless}}'])) !== 'true') return null;
+        const component = defaultNetworkComponent(parsePodmanMajor(await run(['--version'])));
+        const field = component === 'pasta' ? 'Pasta' : 'Slirp4NetNS';
+        if (await run(['info', '--format', `{{.Host.${field}.Executable}}`])) return { component, missing: false };
+        return { component, missing: true, ...describeMissing(component) };
+    } catch (e) {
+        return null;
+    }
+}
+
+module.exports = { parsePodmanMajor, defaultNetworkComponent, installCommand, describeMissing, checkRootlessNetwork };

package/lib/serve-log.js

@@ -84,6 +84,16 @@ function sanitizeSensitiveData(obj) {
     return result;
 }
 
+// 命令行参数里的 KEY=值（--env / 镜像构建参数等）：敏感键的值整体打码，用于错误信息与 show-command
+function redactCommandArgs(args) {
+    const sensitive = /KEY|TOKEN|SECRET|PASSWORD|PASS|AUTH|CREDENTIAL/i;
+    return (Array.isArray(args) ? args : []).map(arg => {
+        const text = String(arg);
+        const match = /^([A-Za-z_][A-Za-z0-9_.]*)=/.exec(text);
+        return match && sensitive.test(match[1]) ? `${match[1]}=****` : text;
+    });
+}
+
 function formatServeLogValue(value) {
     if (value instanceof Error) {
         return sanitizeServeLogText(value.stack || value.message || String(value));
@@ -111,6 +121,7 @@ module.exports = {
     sanitizeProcessArgv,
     sanitizeServeLogText,
     sanitizeSensitiveData,
+    redactCommandArgs,
     formatServeLogValue,
     getServeProcessSnapshot
 };

package/package.json

@@ -1,9 +1,9 @@
 {
     "name": "@xcanwin/manyoyo",
-    "version": "8.2.1",
+    "version": "8.3.0",
     "imageVersion": "2.1.0-common",
     "playwrightCliVersion": "0.1.21",
-    "description": "AI Agent CLI Security Sandbox for Docker and Podman",
+    "description": "MANYOYO – open-source AI agent sandbox: run AI coding agents (Claude Code / Codex / Gemini) safely in Docker/Podman",
     "keywords": [
         "manyoyo",
         "ai-agent",