@xcanwin/manyoyo 8.2.1 → 8.3.1

package/lib/rootless-network.js

@@ -0,0 +1,68 @@
+'use strict';
+
+const fs = require('fs');
+
+// rootless podman 的默认网络组件：4.x 用 slirp4netns，5.x 起用 pasta
+const PACKAGE_OF = { slirp4netns: 'slirp4netns', pasta: 'passt' };
+
+function parsePodmanMajor(versionText) {
+    const match = /(\d+)\.\d+/.exec(String(versionText || ''));
+    return match ? Number(match[1]) : null;
+}
+
+function defaultNetworkComponent(major) {
+    return major !== null && major >= 5 ? 'pasta' : 'slirp4netns';
+}
+
+function readOsRelease() {
+    try {
+        return fs.readFileSync('/etc/os-release', 'utf8');
+    } catch (e) {
+        return '';
+    }
+}
+
+function hasCommand(name) {
+    return String(process.env.PATH || '').split(':').some(dir => dir && fs.existsSync(`${dir}/${name}`));
+}
+
+// 与 scripts/offline/install.sh 的 Linux 分支保持同一套规则；不认识的发行版返回 null（只给说明）
+function installCommand(component, { osRelease = readOsRelease(), hasDnf = hasCommand('dnf') } = {}) {
+    const pkg = PACKAGE_OF[component] || component;
+    const ids = (String(osRelease).match(/^(?:ID|ID_LIKE)=(.*)$/gm) || [])
+        .map(line => line.split('=')[1].replace(/["']/g, '').toLowerCase())
+        .join(' ')
+        .split(/\s+/);
+    if (ids.some(id => id === 'debian' || id === 'ubuntu')) return `sudo apt-get install -y ${pkg}`;
+    if (ids.some(id => ['fedora', 'rhel', 'centos'].includes(id))) return `sudo ${hasDnf ? 'dnf' : 'yum'} install -y ${pkg}`;
+    return null;
+}
+
+function describeMissing(component, options) {
+    const pkg = PACKAGE_OF[component] || component;
+    const command = installCommand(component, options);
+    return {
+        reason: `rootless Podman 缺少默认网络组件 ${component}，容器无法创建网络。`,
+        action: command ? `请执行: ${command}` : `请用系统包管理器安装 ${pkg}（提供 ${component}）。`
+    };
+}
+
+/**
+ * 检查 rootless podman 的默认网络组件是否存在（只在 Linux 的 podman 上检查）。
+ * @returns {Promise<null|{component: string, reason: string, action: string}>} null 表示无需处理
+ */
+async function checkRootlessNetwork(runCommand, { command, env, timeout, platform = process.platform } = {}) {
+    if (platform !== 'linux' || !/(^|\/)podman$/.test(String(command || ''))) return null;
+    const run = async args => String(await runCommand(command, args, { env, timeout }) || '').trim();
+    try {
+        if ((await run(['info', '--format', '{{.Host.Security.Rootless}}'])) !== 'true') return null;
+        const component = defaultNetworkComponent(parsePodmanMajor(await run(['--version'])));
+        const field = component === 'pasta' ? 'Pasta' : 'Slirp4NetNS';
+        if (await run(['info', '--format', `{{.Host.${field}.Executable}}`])) return { component, missing: false };
+        return { component, missing: true, ...describeMissing(component) };
+    } catch (e) {
+        return null;
+    }
+}
+
+module.exports = { parsePodmanMajor, defaultNetworkComponent, installCommand, describeMissing, checkRootlessNetwork };

package/lib/serve-log.js

@@ -84,6 +84,16 @@ function sanitizeSensitiveData(obj) {
     return result;
 }
 
+// 命令行参数里的 KEY=值（--env / 镜像构建参数等）：敏感键的值整体打码，用于错误信息与 show-command
+function redactCommandArgs(args) {
+    const sensitive = /KEY|TOKEN|SECRET|PASSWORD|PASS|AUTH|CREDENTIAL/i;
+    return (Array.isArray(args) ? args : []).map(arg => {
+        const text = String(arg);
+        const match = /^([A-Za-z_][A-Za-z0-9_.]*)=/.exec(text);
+        return match && sensitive.test(match[1]) ? `${match[1]}=****` : text;
+    });
+}
+
 function formatServeLogValue(value) {
     if (value instanceof Error) {
         return sanitizeServeLogText(value.stack || value.message || String(value));
@@ -111,6 +121,7 @@ module.exports = {
     sanitizeProcessArgv,
     sanitizeServeLogText,
     sanitizeSensitiveData,
+    redactCommandArgs,
     formatServeLogValue,
     getServeProcessSnapshot
 };

package/lib/web/server.js

@@ -10,6 +10,7 @@ const http = require('http');
 const WebSocket = require('ws');
 const JSON5 = require('json5');
 const { buildContainerRunArgs } = require('../container-run');
+const { buildContainerIntegration, mergeIntegration } = require('../plugin');
 const { applyAptMirror } = require('../mirrors');
 const { normalizeMirrors } = require('../runtime-normalizers');
 const { estimateContainerCapacity } = require('../capacity');
@@ -3325,6 +3326,27 @@ function readWebMirrors(state) {
     }
 }
 
+// 会话容器与 CLI run 共用同一个 Playwright 浏览器模式集成（挂载目录、NO_PROXY 等）
+async function buildWebPlaywrightIntegration(ctx, state, runtime) {
+    let globalConfig = {};
+    try {
+        const snapshot = readWebConfigSnapshot(state.webConfigPath);
+        globalConfig = snapshot.parseError ? {} : (snapshot.parsed || {});
+    } catch (e) {
+        globalConfig = {};
+    }
+    const integration = await buildContainerIntegration({
+        globalConfig,
+        homeDir: ctx.homeDir,
+        runtimeCommand: ctx.dockerCmd || 'docker',
+        envEntries: (runtime.containerEnvs || []).filter((_, i) => i % 2 === 1)
+    });
+    if (integration.warning) {
+        console.warn(integration.warning);
+    }
+    return mergeIntegration(runtime, integration);
+}
+
 async function ensureWebContainer(ctx, state, containerInput, messageSessionRef = null) {
     const runtime = typeof containerInput === 'string'
         ? buildStaticContainerRuntime(ctx, containerInput)
@@ -3336,6 +3358,7 @@ async function ensureWebContainer(ctx, state, containerInput, messageSessionRef
 
     if (!ctx.containerExists(runtime.containerName)) {
         const mirrors = readWebMirrors(state);
+        const playwright = await buildWebPlaywrightIntegration(ctx, state, runtime);
         const args = buildContainerRunArgs({
             mirrors,
             containerName: runtime.containerName,
@@ -3344,9 +3367,9 @@ async function ensureWebContainer(ctx, state, containerInput, messageSessionRef
             imageName: runtime.imageName,
             imageVersion: runtime.imageVersion,
             contModeArgs: runtime.contModeArgs,
-            containerExtraArgs: runtime.containerExtraArgs,
-            containerEnvs: runtime.containerEnvs,
-            containerVolumes: runtime.containerVolumes,
+            containerExtraArgs: playwright.containerExtraArgs,
+            containerEnvs: playwright.containerEnvs,
+            containerVolumes: playwright.containerVolumes,
             containerPorts: runtime.containerPorts,
             defaultCommand: runtime.defaultCommand
         });
@@ -6327,6 +6350,7 @@ async function startWebServer(options) {
         authPassAuto: options.authPassAuto,
         serveTitle: typeof options.serveTitle === 'string' ? options.serveTitle : null,
         dockerCmd: options.dockerCmd,
+        homeDir: options.homeDir,
         dockerEnv: options.dockerEnv,
         loginTokenDir: options.loginTokenDir || '',
         doctorCheck: options.doctorCheck,

package/manyoyo.example.json

@@ -68,38 +68,25 @@
     //     }
     // },
 
-    // 可选插件（manyoyo playwright）
+    // 可选插件（manyoyo playwright）：容器内浏览器默认就能用，这里只放少量可调项
     "plugins": {
         "playwright": {
-            // mixed: 支持容器+宿主机；container: 仅容器；host: 仅宿主机
-            "runtime": "mixed",
-            // 启用场景（可按需裁剪）
-            "enabledScenes": ["mcp-cont-headless", "mcp-cont-headed", "mcp-host-headless", "mcp-host-headed", "cli-host-headless", "cli-host-headed", "dev-host-headed"],
-            // my run 默认注入的 playwright-cli 宿主场景
-            "cliSessionScene": "cli-host-headless",
-            // mcp-add 默认 host（可改为 localhost / 127.0.0.1）
-            "mcpDefaultHost": "host.docker.internal",
-            // mcp-cont-headed 场景读取的密码环境变量名（默认 VNC_PASSWORD）
-            "vncPasswordEnvKey": "VNC_PASSWORD",
-            // playwright ext-download 的 CRX prodversion 参数
-            "extensionProdversion": "132.0.0.0",
-            // 注入 navigator.platform（默认与内置 UA 对齐为 MacIntel）
-            "navigatorPlatform": "MacIntel",
+            // headed / chrome / vnc 模式的浏览器服务端口（容器通过 token 路径连接）
+            "port": 8935,
+            // vnc 模式的原生 VNC 端口与 noVNC 网页端口（只发布到 127.0.0.1）
+            "vncPort": 5900,
+            "novncPort": 6080,
+            // 浏览器语言与时区，留空时跟随宿主机
+            "locale": "",
+            "timezoneId": "",
+            // 强制 navigator.platform；留空则使用浏览器真实值（推荐，与 UA、字体、WebGL 自洽）
+            "navigatorPlatform": "",
             // 是否禁用 WebRTC（默认 false）
             "disableWebRTC": false,
-            // dev-host-headed 读取的 Chrome DevToolsActivePort 文件；留空时自动探测常见路径
+            // chrome 模式读取的 DevToolsActivePort 文件；留空时自动探测常见路径
             "devtoolsActivePortPath": "",
-            // dev-host-headed 连接 Chrome CDP 的超时时间（毫秒）
-            "devtoolsCdpTimeout": 60000,
-            "ports": {
-                "mcpContHeadless": 8931,
-                "mcpContHeaded": 8932,
-                "mcpHostHeadless": 8933,
-                "mcpHostHeaded": 8934,
-                "cliHostHeadless": 8935,
-                "cliHostHeaded": 8936,
-                "mcpContHeadedNoVnc": 6080
-            }
+            // playwright ext-download 的 CRX prodversion 参数
+            "extensionProdversion": "132.0.0.0"
         }
     },
 
@@ -118,7 +105,8 @@
             "yolo": "c",
             "plugins": {
                 "playwright": {
-                    "runtime": "container"
+                    "locale": "zh-CN",
+                    "timezoneId": "Asia/Shanghai"
                 }
             }
         }

package/package.json

@@ -1,9 +1,9 @@
 {
     "name": "@xcanwin/manyoyo",
-    "version": "8.2.1",
-    "imageVersion": "2.1.0-common",
+    "version": "8.3.1",
+    "imageVersion": "2.1.1-common",
     "playwrightCliVersion": "0.1.21",
-    "description": "AI Agent CLI Security Sandbox for Docker and Podman",
+    "description": "MANYOYO – open-source AI agent sandbox: run AI coding agents (Claude Code / Codex / Gemini) safely in Docker/Podman",
     "keywords": [
         "manyoyo",
         "ai-agent",
@@ -40,7 +40,7 @@
         "prepack": "npm run build:web",
         "test": "jest --coverage && npm run test:web",
         "test:unit": "jest test/ --testPathIgnorePatterns '<rootDir>/temp/' '<rootDir>/test/integration/' && npm run test:web",
-        "test:integration": "jest test/integration/",
+        "test:integration": "jest test/integration/ --runInBand",
         "test:installer": "jest test/installer.test.js",
         "lint:sh": "command -v shellcheck >/dev/null 2>&1 || { echo '未安装 shellcheck：macOS 用 brew install shellcheck，Debian/Ubuntu 用 sudo apt install shellcheck，或用 docker run --rm -v \"$PWD:/mnt\" -w /mnt koalaman/shellcheck:stable scripts/install.sh scripts/offline/*.sh' >&2; exit 1; } && shellcheck -s sh -x -e SC1091 scripts/install.sh scripts/offline/*.sh",
         "docs:dev": "vitepress dev docs --host 127.0.0.1 --port 5173",
@@ -65,10 +65,9 @@
         "manyoyo.example.json"
     ],
     "dependencies": {
-        "@playwright/mcp": "0.0.82",
+        "@playwright/cli": "0.1.21",
         "commander": "^15.0.0",
         "json5": "^2.2.3",
-        "playwright": "1.63.0",
         "ws": "^8.21.3"
     },
     "devDependencies": {

package/docker/res/playwright/cli-cont-headless.init.js

@@ -1,12 +0,0 @@
-'use strict';
-
-(function () {
-    const platformValue = 'MacIntel';
-    try {
-        const navProto = Object.getPrototypeOf(navigator);
-        Object.defineProperty(navProto, 'platform', {
-            configurable: true,
-            get: () => platformValue
-        });
-    } catch (_) {}
-})();

package/docker/res/playwright/cli-cont-headless.json

@@ -1,37 +0,0 @@
-{
-    "outputDir": "/tmp/.playwright-cli",
-    "browser": {
-        "chromiumSandbox": true,
-        "browserName": "chromium",
-        "initScript": [
-            "/app/config/cli-cont-headless.init.js"
-        ],
-        "launchOptions": {
-            "channel": "chromium",
-            "headless": true,
-            "args": [
-                "--user-agent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36",
-                "--lang=zh-CN",
-                "--window-size=1366,768",
-                "--disable-blink-features=AutomationControlled",
-                "--force-webrtc-ip-handling-policy=disable_non_proxied_udp"
-            ]
-        },
-        "contextOptions": {
-            "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36",
-            "locale": "zh-CN",
-            "timezoneId": "Asia/Shanghai",
-            "viewport": {
-                "width": 1366,
-                "height": 768
-            },
-            "screen": {
-                "width": 1366,
-                "height": 768
-            },
-            "extraHTTPHeaders": {
-                "Accept-Language": "zh-CN,zh;q=0.9"
-            }
-        }
-    }
-}

package/lib/plugin/playwright-assets/compose-headed.yaml

@@ -1,19 +0,0 @@
-services:
-  playwright:
-    build:
-      context: .
-      dockerfile: headed.Dockerfile
-      args:
-        PLAYWRIGHT_MCP_BASE_IMAGE: mcr.microsoft.com/playwright/mcp:${PLAYWRIGHT_MCP_DOCKER_TAG:-latest}
-    image: ${PLAYWRIGHT_MCP_IMAGE:-localhost/xcanwin/manyoyo-playwright-headed}
-    container_name: ${PLAYWRIGHT_MCP_CONTAINER_NAME:-my-playwright-mcp-cont-headed}
-    init: true
-    stdin_open: true
-    ports:
-      - "127.0.0.1:${PLAYWRIGHT_MCP_PORT:-8932}:${PLAYWRIGHT_MCP_PORT:-8932}"
-      - "127.0.0.1:${PLAYWRIGHT_MCP_NOVNC_PORT:-6080}:6080"
-    environment:
-      VNC_PASSWORD: "${VNC_PASSWORD:?VNC_PASSWORD is required}"
-    volumes:
-      - ${PLAYWRIGHT_MCP_CONFIG_PATH:?PLAYWRIGHT_MCP_CONFIG_PATH is required}:/app/config/playwright.json:ro
-    command: ["node", "cli.js", "--config", "/app/config/playwright.json"]

package/lib/plugin/playwright-assets/compose-headless.yaml

@@ -1,11 +0,0 @@
-services:
-  playwright:
-    image: mcr.microsoft.com/playwright/mcp:${PLAYWRIGHT_MCP_DOCKER_TAG:-latest}
-    container_name: ${PLAYWRIGHT_MCP_CONTAINER_NAME:-my-playwright-mcp-cont-headless}
-    init: true
-    stdin_open: true
-    ports:
-      - "127.0.0.1:${PLAYWRIGHT_MCP_PORT:-8931}:${PLAYWRIGHT_MCP_PORT:-8931}"
-    volumes:
-      - ${PLAYWRIGHT_MCP_CONFIG_PATH:?PLAYWRIGHT_MCP_CONFIG_PATH is required}:/app/config/playwright.json:ro
-    command: ["--config", "/app/config/playwright.json"]

package/lib/plugin/playwright-assets/headed.Dockerfile

@@ -1,15 +0,0 @@
-ARG PLAYWRIGHT_MCP_BASE_IMAGE=mcr.microsoft.com/playwright/mcp:latest
-FROM ${PLAYWRIGHT_MCP_BASE_IMAGE}
-
-USER root
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-        ca-certificates xvfb x11vnc novnc websockify fluxbox && \
-    update-ca-certificates && \
-    apt-get clean && \
-    rm -rf /tmp/* /var/tmp/* /var/log/apt /var/log/*.log /var/lib/apt/lists/*
-
-COPY init-headed.sh /usr/local/bin/init-headed.sh
-RUN chmod +x /usr/local/bin/init-headed.sh
-
-ENTRYPOINT ["/usr/local/bin/init-headed.sh"]

package/lib/plugin/playwright-assets/init-headed.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-export DISPLAY=:99
-
-Xvfb :99 -screen 0 1920x1080x24 -nolisten tcp &
-fluxbox >/tmp/fluxbox.log 2>&1 &
-
-if [[ -z "${VNC_PASSWORD:-}" ]]; then
-    echo "VNC_PASSWORD is required."
-    exit 1
-fi
-
-x11vnc -display :99 -forever -shared -rfbport 5900 -localhost -passwd "$VNC_PASSWORD" >/tmp/x11vnc.log 2>&1 &
-websockify --web=/usr/share/novnc/ 6080 localhost:5900 >/tmp/websockify.log 2>&1 &
-
-exec "$@"