@xcanwin/manyoyo 8.3.2 → 8.4.0

package/README.md

@@ -53,7 +53,7 @@ manyoyo init all   # 把本机已有的 Agent 配置搬进来
 manyoyo run -y c   # 在沙箱里以 YOLO 模式启动 Claude Code
 ```
 
-默认镜像 `ghcr.io/xcanwin/manyoyo` 首次使用时自动拉取；需要自定义镜像时再执行 `manyoyo build --iv 2.1.1-common`。更多命令见[命令速查](https://xcanwin.github.io/manyoyo/reference/cli-options)。
+默认镜像 `ghcr.io/xcanwin/manyoyo` 首次使用时自动拉取；需要自定义镜像时再执行 `manyoyo build --iv 2.2.0-common`。更多命令见[命令速查](https://xcanwin.github.io/manyoyo/reference/cli-options)。
 
 ## 它能做什么
 

package/bin/manyoyo.js

@@ -9,7 +9,7 @@ const net = require('net');
 const readline = require('readline');
 const { Command, Help } = require('commander');
 const { startWebServer } = require('../lib/web/server');
-const { buildContainerRunArgs, buildContainerRunCommand, runWithEnvFile } = require('../lib/container-run');
+const { buildContainerRunArgs, buildContainerRunCommand, runWithEnvFile, hasNetworkArg } = require('../lib/container-run');
 const { getManyoyoConfigPath, readManyoyoConfig, syncGlobalImageVersion } = require('../lib/global-config');
 const { resolveUpdateImageVersion } = require('../lib/image-version-policy');
 const { selectContainerRuntime, mergeRuntimeEnv } = require('../lib/container-runtime');
@@ -44,6 +44,12 @@ const {
     normalizeMirrors
 } = require('../lib/runtime-normalizers');
 const { applyAptMirror } = require('../lib/mirrors');
+const containerState = require('../lib/container-state');
+const { buildExecArgs, resolveContainerId } = require('../lib/container-exec');
+const { createNetworkManager, NETWORK_NAME } = require('../lib/container-network');
+const { normalizePolicy } = require('../lib/network-policy');
+const { withEnvEndpoints } = require('../lib/network-endpoints');
+const { resolveManageOptions } = require('../lib/container-manage-options');
 const {
     sanitizeSensitiveData,
     sanitizeServeLogText,
@@ -131,6 +137,8 @@ let CONTAINER_RUNTIME = null;
 let UPDATE_CHECK_ENABLED = true;
 // 全局配置 mirrors（apt/npm/pip 软件源，空 = 官方默认）：容器创建时在容器层生效，镜像不变
 let MIRRORS = { apt: '', npm: '', pip: '' };
+let MANAGE_OPTIONS = { autostart: '', network: null };
+let ENV_FILES = [];
 // serve 的容器环境状态，供 GET /api/system/runtime 读取
 const RUNTIME_STATE = { status: 'ready', message: '' };
 const DOCKER_DAEMON_ERROR_CODES = new Set(['PODMAN_MACHINE_UNAVAILABLE', 'DOCKER_DAEMON_UNAVAILABLE', 'PORT_IN_USE']);
@@ -342,6 +350,9 @@ function installServeProcessDiagnostics(logger) {
  * @property {string} [yolo] - YOLO 模式
  * @property {string} [containerMode] - 容器模式
  * @property {string} [containerRuntime] - 容器运行时（auto/docker/podman，默认 auto；仅全局配置生效）
+ * @property {string} [autostart] - 容器每次启动时由容器内 init 执行的 bash 脚本（新建容器时写入状态目录）
+ * @property {boolean} [autostartOnServe] - serve 启动时自动拉起此容器
+ * @property {object} [network] - 网络策略（preset / host / egress / peers，见 lib/network-policy.js），不写为默认收紧
  * @property {{apt?: string, npm?: string, pip?: string}} [mirrors] - 容器内 apt/npm/pip 软件源（http/https URL，空/缺省为官方默认；仅全局配置生效）
  * @property {boolean} [updateCheck] - serve 是否每天检查一次新版本（默认 true；仅全局配置生效，请求不附带任何本机信息）
  * @property {number} [cacheTTL] - 缓存过期天数
@@ -567,43 +578,16 @@ function addEnvFileTo(targetEnvs, envFile) {
     }
 
     if (fs.existsSync(filePath)) {
-        const content = fs.readFileSync(filePath, 'utf-8');
-        const lines = content.split('\n');
-
-        for (let line of lines) {
-            // Match pattern: (export )?(KEY)=(VALUE)
-            const match = line.match(/^(?:export\s+)?([a-zA-Z_][a-zA-Z0-9_]*)\s*=\s*(.*)$/);
-            if (match) {
-                let key = match[1];
-                let value = match[2].trim();
-
-                // Filter malicious characters
-                if (/[\r\n\0]/.test(value)) continue;
-                if (/[\$\(\)\`\|\&\*\{\};<>]/.test(value)) continue;
-                if (/^\(/.test(value)) continue;
-
-                // Remove quotes
-                if (/^"(.*)"$/.test(value)) {
-                    value = value.slice(1, -1);
-                } else if (/^'(.*)'$/.test(value)) {
-                    value = value.slice(1, -1);
-                }
-
-                if (key) {
-                    targetEnvs.push("--env", `${key}=${value}`);
-                }
-            }
-        }
+        // 与「环境变量」文本同一套语法（见 lib/env-text.js）；值里有被禁止的字符的行会被跳过并提示
+        const { entries, invalid } = containerState.parseEnvFileContent(fs.readFileSync(filePath, 'utf-8'));
+        entries.forEach(entry => targetEnvs.push('--env', `${entry.key}=${entry.value}`));
+        invalid.forEach(item => console.error(`${YELLOW}⚠️  ${filePath} 第 ${item.line} 行已跳过: ${item.reason}${NC}`));
         return {};
     }
     console.error(`${RED}⚠️  未找到环境文件: ${envFile}${NC}`);
     return {};
 }
 
-function addEnvFile(envFile) {
-    return addEnvFileTo(CONTAINER_ENVS, envFile);
-}
-
 // Playwright 浏览器模式的容器参数；在容器创建时（运行时已确定）才计算，失败只警告，不影响 run
 async function applyPlaywrightIntegration(runtime) {
     const integration = await buildContainerIntegration({
@@ -768,7 +752,10 @@ function getContainerStatus(name) {
 
 function removeContainer(name) {
     if ( !(QUIET.crm || QUIET.full) ) console.log(`${YELLOW}🗑️ 正在删除容器: ${name}...${NC}`);
+    // 先读 id：容器删掉后就查不到了；同时删状态目录，同名重建不会继承旧 env / 规则
+    const stateId = resolveContainerId(dockerExecArgs, name);
     dockerExecArgs(['rm', '-f', name], { stdio: 'pipe' });
+    if (stateId) containerState.removeState(os.homedir(), stateId);
     if ( !(QUIET.crm || QUIET.full) ) console.log(`${GREEN}✅ 已彻底删除。${NC}`);
 }
 
@@ -1503,6 +1490,9 @@ https://github.com/xcanwin/manyoyo
     const runConfig = runNameToLoad ? loadRunConfig(runNameToLoad, config) : {};
     const globalFirstConfig = normalizeFirstConfig(config.first, '全局配置');
     const runFirstConfig = normalizeFirstConfig(runConfig.first, '运行配置');
+    // 自启动脚本与网络策略：runs.<name> > 全局配置（新建容器时写进状态目录，Web 上可随时改）
+    const manageOptions = resolveManageOptions({ runConfig, globalConfig: config });
+    MANAGE_OPTIONS = manageOptions;
 
     const resolvedRuntime = resolveRuntimeConfig({
         cliOptions: options,
@@ -1551,7 +1541,17 @@ https://github.com/xcanwin/manyoyo
 
     // Merge mode (array values): concatenate all sources
     const envFileList = resolvedRuntime.envFile;
-    envFileList.forEach(ef => addEnvFile(ef));
+    // 环境变量文件不再在创建时展开成 --env：登记路径，每次 exec 现读（改了文件下一条命令就生效）
+    ENV_FILES = [];
+    envFileList.forEach(ef => {
+        const filePath = String(ef || '').trim();
+        if (!path.isAbsolute(filePath)) {
+            console.error(`${RED}⚠️  错误: --env-file 仅支持绝对路径: ${ef}${NC}`);
+            process.exit(1);
+        }
+        if (!fs.existsSync(filePath)) console.error(`${YELLOW}⚠️  未找到环境文件（创建后放进去也会生效）: ${ef}${NC}`);
+        ENV_FILES.push(filePath);
+    });
 
     const envMap = resolvedRuntime.env;
     Object.entries(envMap).forEach(([key, value]) => addEnv(`${key}=${value}`));
@@ -1612,6 +1612,8 @@ https://github.com/xcanwin/manyoyo
             containerMode: contModeValue || "",
             containerRuntime: config.containerRuntime || "auto",
             mirrors: MIRRORS,
+            autostart: manageOptions.autostart,
+            network: manageOptions.network,
             shellPrefix: EXEC_COMMAND_PREFIX.trim(),
             shell: EXEC_COMMAND || "",
             shellSuffix: EXEC_COMMAND_SUFFIX || "",
@@ -1753,6 +1755,9 @@ function createRuntimeContext(modeState = {}) {
         containerExtraArgs: CONTAINER_EXTRA_ARGS,
         containerEnvs: CONTAINER_ENVS,
         mirrors: MIRRORS,
+        autostart: MANAGE_OPTIONS.autostart,
+        network: MANAGE_OPTIONS.network,
+        envFiles: ENV_FILES,
         firstContainerEnvs: FIRST_CONTAINER_ENVS,
         containerVolumes: CONTAINER_VOLUMES,
         containerPorts: CONTAINER_PORTS,
@@ -2047,15 +2052,16 @@ function executeFirstCommand(runtime) {
         console.log(`⚙️  首次预执行命令: ${YELLOW}${firstCommand}${NC}`);
     }
 
-    const firstExecArgs = [
-        'exec',
-        ...(runtime.firstContainerEnvs || []),
-        runtime.containerName,
-        '/bin/bash',
-        '-c',
-        firstCommand
-    ];
-    const firstExecResult = spawnSync(`${DOCKER_CMD}`, firstExecArgs, { stdio: 'inherit', env: DOCKER_ENV });
+    const firstExec = buildExecArgs({ homeDir: os.homedir(), dockerExecArgs }, runtime.containerName, {
+        extraEnv: containerState.envArgsToLines(runtime.firstContainerEnvs),
+        command: ['/bin/bash', '-c', firstCommand]
+    });
+    let firstExecResult;
+    try {
+        firstExecResult = spawnSync(`${DOCKER_CMD}`, firstExec.args, { stdio: 'inherit', env: DOCKER_ENV });
+    } finally {
+        firstExec.cleanup();
+    }
     if (firstExecResult.error) {
         throw firstExecResult.error;
     }
@@ -2083,15 +2089,38 @@ async function createNewContainer(runtime) {
     );
     const defaultCommand = runtime.execCommand;
 
+    // 用户 env 不进容器配置（podman inspect 看不到明文），改写进状态目录的 box/env，每次 exec 现读
+    const userEnvLines = containerState.userEnvLines(runtime.containerEnvs);
     await applyPlaywrightIntegration(runtime);
+    runtime.containerEnvs = containerState.stripEnvKeys(runtime.containerEnvs, new Set(userEnvLines.map(containerState.envLineKey)));
 
     if (runtime.showCommand) {
+        runtime.state = previewContainerState();
         console.log(buildDockerRunCmd(runtime));
         process.exit(0);
     }
 
     await ensureRunImage(runtime);
 
+    const networkPolicy = await withEnvEndpoints(normalizePolicy(runtime.network), [...userEnvLines, ...containerState.readEnvFilePaths(runtime.envFiles || []).flatMap(file => file.entries.map(entry => `${entry.key}=${entry.value}`))]);
+    const networkManager = createCliNetworkManager(runtime);
+    if (!hasNetworkArg([...(runtime.contModeArgs || []), ...(runtime.containerExtraArgs || [])])) {
+        try {
+            await networkManager.ensureBridgeNetwork();
+        } catch (e) {
+            throw new Error(`无法创建 ${NETWORK_NAME} 网络: ${e.message}`);
+        }
+    }
+    runtime.state = containerState.createState({
+        homeDir: os.homedir(),
+        envLines: userEnvLines,
+        envFiles: runtime.envFiles,
+        autostart: runtime.autostart,
+        network: networkPolicy,
+        netRequired: networkPolicy.preset !== 'open',
+        meta: { name: runtime.containerName }
+    });
+
     // 使用数组参数执行命令（安全方式）
     try {
         const args = buildDockerRunArgs(runtime);
@@ -2100,12 +2129,16 @@ async function createNewContainer(runtime) {
         showImagePullHint(e);
         // 失败的 run 可能留下 Created 状态的容器；这个名字创建前不存在，所以只清理本次留下的这一个
         try { dockerExecArgs(['rm', '-f', runtime.containerName], { stdio: 'pipe' }); } catch (cleanupError) { /* 尽力清理 */ }
+        containerState.removeState(os.homedir(), runtime.state.id);
         throw explainCreateFailure(e);
     }
 
     // Wait for container to be ready
     await waitForContainerReady(runtime.containerName);
 
+    // 先下发网络规则再做任何 exec；失败即关闭（容器留着，init 在等门闩，不会跑自启动）
+    await networkManager.apply(runtime.containerName, { expectId: runtime.state.id });
+
     applyAptMirror({
         dockerExecArgs,
         containerName: runtime.containerName,
@@ -2123,8 +2156,26 @@ async function createNewContainer(runtime) {
  * 构建 Docker run 命令参数数组（安全方式，避免命令注入）
  * @returns {string[]} 命令参数数组
  */
+// 容器网络规则的下发器：CLI 与 serve 各建一份，helper 容器用当前 imageVersion 的官方镜像
+function createCliNetworkManager(runtime) {
+    return createNetworkManager({
+        command: DOCKER_CMD,
+        env: DOCKER_ENV,
+        homeDir: os.homedir(),
+        imageRef: () => `${runtime.imageName}:${runtime.imageVersion}`,
+        getMirrorUrls: () => Object.values(runtime.mirrors || {}).filter(Boolean)
+    });
+}
+
+function previewContainerState() {
+    const dir = path.join(os.homedir(), '.manyoyo', 'containers', '<id>');
+    return { id: '<id>', box: path.join(dir, 'box'), sys: path.join(dir, 'sys') };
+}
+
 function buildDockerRunArgs(runtime) {
     return buildContainerRunArgs({
+        state: runtime.state,
+        defaultNetwork: NETWORK_NAME,
         containerName: runtime.containerName,
         hostPath: runtime.hostPath,
         containerPath: runtime.containerPath,
@@ -2159,6 +2210,7 @@ async function connectExistingContainer(runtime) {
     if (status !== 'running') {
         dockerExecArgs(['start', runtime.containerName], { stdio: 'pipe' });
     }
+    await createCliNetworkManager(runtime).ensureReady(runtime.containerName);
 
     // Get default command from label
     const defaultCommand = dockerExecArgs(['inspect', '-f', '{{index .Config.Labels "manyoyo.default_cmd"}}', runtime.containerName]).trim();
@@ -2183,6 +2235,8 @@ async function setupContainer(runtime) {
             process.exit(0);
         }
         runtime.execCommand = joinExecCommand(runtime.execCommandPrefix, runtime.execCommand, runtime.execCommandSuffix);
+        runtime.containerEnvs = containerState.stripEnvKeys(runtime.containerEnvs, new Set(containerState.userEnvLines(runtime.containerEnvs).map(containerState.envLineKey)));
+        runtime.state = previewContainerState();
         console.log(buildDockerRunCmd(runtime));
         process.exit(0);
     }
@@ -2193,7 +2247,7 @@ async function setupContainer(runtime) {
     }
 }
 
-function executeInContainer(runtime, defaultCommand) {
+async function executeInContainer(runtime, defaultCommand) {
     if (!containerExists(runtime.containerName)) {
         throw new Error(`未找到容器: ${runtime.containerName}`);
     }
@@ -2202,6 +2256,7 @@ function executeInContainer(runtime, defaultCommand) {
     if (status !== 'running') {
         dockerExecArgs(['start', runtime.containerName], { stdio: 'pipe' });
     }
+    await createCliNetworkManager(runtime).ensureReady(runtime.containerName);
 
     getHelloTip(runtime.containerName, defaultCommand, runtime.execCommand);
     if (!(runtime.quiet.cmd || runtime.quiet.full)) {
@@ -2210,10 +2265,15 @@ function executeInContainer(runtime, defaultCommand) {
     }
 
     // Execute command in container
-    if (runtime.execCommand) {
-        spawnSync(`${DOCKER_CMD}`, ['exec', '-it', runtime.containerName, '/bin/bash', '-c', runtime.execCommand], { stdio: 'inherit', env: DOCKER_ENV });
-    } else {
-        spawnSync(`${DOCKER_CMD}`, ['exec', '-it', runtime.containerName, '/bin/bash'], { stdio: 'inherit', env: DOCKER_ENV });
+    const exec = buildExecArgs({ homeDir: os.homedir(), dockerExecArgs }, runtime.containerName, {
+        interactive: true,
+        tty: true,
+        command: runtime.execCommand ? ['/bin/bash', '-c', runtime.execCommand] : ['/bin/bash']
+    });
+    try {
+        spawnSync(`${DOCKER_CMD}`, exec.args, { stdio: 'inherit', env: DOCKER_ENV });
+    } finally {
+        exec.cleanup();
     }
 }
 
@@ -2458,6 +2518,7 @@ async function runWebServerMode(runtime) {
         contModeArgs: runtime.contModeArgs,
         containerExtraArgs: runtime.containerExtraArgs,
         containerEnvs: runtime.containerEnvs,
+        envFiles: runtime.envFiles,
         containerVolumes: runtime.containerVolumes,
         containerPorts: runtime.containerPorts,
         validateHostPath: value => validateHostPathOrThrow(value),
@@ -2574,7 +2635,7 @@ async function main() {
         // 7-8. Execute command and handle post-exit interactions
         let shouldContinue = true;
         while (shouldContinue) {
-            executeInContainer(runtime, defaultCommand);
+            await executeInContainer(runtime, defaultCommand);
             shouldContinue = await handlePostExit(runtime, defaultCommand);
         }
 

package/docker/manyoyo.Dockerfile

@@ -114,7 +114,7 @@ RUN <<EOX
     # Python
     apt-get -o Acquire::https::Verify-Peer=false update -y
     apt-get -o Acquire::https::Verify-Peer=false install -y --no-install-recommends \
-        ca-certificates openssl curl wget net-tools iputils-ping dnsutils socat ncat ssh \
+        ca-certificates openssl curl wget net-tools iputils-ping dnsutils socat ncat ssh nftables \
         git gh g++ make sqlite3 \
         procps psmisc lsof supervisor \
         nano jq file tree ripgrep less bc xxd tar zip unzip gzip \
@@ -230,18 +230,47 @@ RUN <<EOX
         cp /tmp/docker-res/opencode/opencode.json ~/.config/opencode/opencode.json
     ;; esac
 
-    # 安装 Playwright CLI skills 与 chromium 浏览器
+    # 安装 Playwright CLI skills、patchright-core 与 Google Chrome
     PLAYWRIGHT_CLI_INSTALL_DIR=/tmp/playwright-cli-install
     mkdir -p "$PLAYWRIGHT_CLI_INSTALL_DIR/.playwright"
     cd "$PLAYWRIGHT_CLI_INSTALL_DIR"
-    PLAYWRIGHT_CLI_VERSION=$(node -p "const pkg = require('/tmp/manyoyo-package.json'); const value = String(pkg.playwrightCliVersion || '').trim(); if (!value) { throw new Error('package.json.playwrightCliVersion is required'); } value")
+    pkg_field() { node -p "const pkg = require('/tmp/manyoyo-package.json'); const value = String(pkg.$1 || '').trim(); if (!value) { throw new Error('package.json.$1 is required'); } value"; }
+    PLAYWRIGHT_CLI_VERSION=$(pkg_field playwrightCliVersion)
+    PATCHRIGHT_CORE_VERSION=$(pkg_field patchrightCoreVersion)
+    PATCHRIGHT_CORE_INTEGRITY=$(pkg_field patchrightCoreIntegrity)
     npm install -g "@playwright/cli@${PLAYWRIGHT_CLI_VERSION}"
-    # 浏览器与系统依赖都用 @playwright/cli 自带的 playwright-core 安装；
+    # 把 @playwright/cli 自带的 playwright-core 换成 patchright-core（开源补丁版，可从源码逐字节复现）：
+    # 官方版会在页面与 Worker 里启用 CDP Runtime 域，被检测站点识别；patchright 去掉了这一痕迹。
+    # 两者必须同 minor（容器内 client 与宿主机 launchServer 要求 minor 完全一致），并以 package.json 里的 integrity 校验，不一致就中止构建
+    CLI_DIR="$(npm root -g)/@playwright/cli"
+    CLI_CORE_VERSION=$(node -p "require('$CLI_DIR/node_modules/playwright-core/package.json').version")
+    [ "${CLI_CORE_VERSION%.*}" = "${PATCHRIGHT_CORE_VERSION%.*}" ] || { echo "playwright-core ${CLI_CORE_VERSION} 与 patchright-core ${PATCHRIGHT_CORE_VERSION} minor 不一致" >&2; exit 1; }
+    npm pack "patchright-core@${PATCHRIGHT_CORE_VERSION}" --silent >/dev/null
+    PATCHRIGHT_TARBALL="patchright-core-${PATCHRIGHT_CORE_VERSION}.tgz"
+    [ "sha512-$(openssl dgst -sha512 -binary "$PATCHRIGHT_TARBALL" | openssl base64 -A)" = "$PATCHRIGHT_CORE_INTEGRITY" ] || { echo "patchright-core 完整性校验失败" >&2; exit 1; }
+    for core in $(find "$CLI_DIR" -type d -name playwright-core -path '*/node_modules/playwright-core'); do
+        rm -rf "$core"
+        mkdir -p "$core"
+        tar -xzf "$PATCHRIGHT_TARBALL" -C "$core" --strip-components=1
+        # patchright 的客户端默认在隔离世界执行 evaluate（页面读不到 Agent 的变量，Agent 也读不到页面自己定义的全局变量），
+        # 对 Agent 毫无用处；把客户端 evaluate / $eval 等 12 处默认值改回主世界（与官方 Playwright 行为一致）。
+        # 在 integrity 校验之后做，次数对不上就中止（升级 patchright 时必须人工复核）；实测不影响 dabi / rebrowser 等检测
+        ISOLATED_DEFAULTS=12
+        [ "$(grep -o 'isolatedContext = true' "$core/lib/coreBundle.js" | wc -l)" = "$ISOLATED_DEFAULTS" ] || { echo "patchright-core 里 isolatedContext 默认值数量不是 ${ISOLATED_DEFAULTS}，请人工复核" >&2; exit 1; }
+        sed -i 's/isolatedContext = true/isolatedContext = false/g' "$core/lib/coreBundle.js"
+    done
     # 默认在 Xvfb 虚拟屏（配轻量窗口管理器）里跑有头浏览器，所以装 xvfb、fluxbox 与常见字体；x11vnc / noVNC 供 playwright vnc 模式使用
-    PLAYWRIGHT_CORE_CLI="$(npm root -g)/@playwright/cli/node_modules/playwright-core/cli.js"
-    node "$PLAYWRIGHT_CORE_CLI" install-deps chromium
-    apt-get install -y --no-install-recommends xvfb fluxbox x11vnc novnc websockify fonts-noto-cjk fonts-noto-color-emoji fonts-liberation
-    node "$PLAYWRIGHT_CORE_CLI" install --no-shell chromium
+    apt-get update
+    apt-get install -y --no-install-recommends xvfb fluxbox x11vnc novnc websockify fonts-noto-cjk fonts-noto-color-emoji fonts-liberation gpg
+    # Google Chrome stable：官方 apt 源（amd64 / arm64 都有），固定签名密钥指纹，apt 再校验 Release 签名
+    curl -fsSL https://dl.google.com/linux/linux_signing_key.pub -o /tmp/google-linux-signing-key.pub
+    [ "$(gpg --show-keys --with-colons /tmp/google-linux-signing-key.pub | awk -F: '/^fpr/{print $10; exit}')" = "EB4C1BFD4F042F6DDDCCEC917721F63BD38B4796" ] || { echo "Google 签名密钥指纹不符" >&2; exit 1; }
+    gpg --dearmor < /tmp/google-linux-signing-key.pub > /usr/share/keyrings/google-chrome.gpg
+    echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/google-chrome.gpg] https://dl.google.com/linux/chrome/deb/ stable main" > /etc/apt/sources.list.d/google-chrome.list
+    apt-get update
+    apt-get install -y --no-install-recommends google-chrome-stable
+    rm -f /etc/apt/sources.list.d/google-chrome.list /etc/cron.daily/google-chrome
+    google-chrome --version
     playwright-cli install --skills
     PLAYWRIGHT_CLI_SKILL_SOURCE="$PLAYWRIGHT_CLI_INSTALL_DIR/.claude/skills/playwright-cli"
     for target in ~/.claude/skills/playwright-cli ~/.codex/skills/playwright-cli ~/.gemini/skills/playwright-cli; do
@@ -261,8 +290,12 @@ EOX
 # Playwright 默认配置（挂载宿主机目录时会被覆盖，路径固定）与按需启动 Xvfb 的 playwright-cli 包装
 COPY ./docker/res/playwright/browser.json /run/manyoyo-playwright/config.json
 COPY ./docker/res/playwright/stealth.init.js /run/manyoyo-playwright/stealth.init.js
+COPY ./docker/res/playwright/env /run/manyoyo-playwright/env
 COPY --chmod=755 ./docker/res/playwright/playwright-cli.sh /usr/local/sbin/playwright-cli
 RUN ln -s playwright-cli /usr/local/sbin/playwright-mcp
+# Chrome 154 起，不安全页面（http://host.containers.internal 这类宿主机别名）不能向 local 地址空间发请求（含同源 fetch），
+# 会让 Agent 测试宿主机上的本地网页时 fetch 失败（旧的 Chromium 没有这个限制）；这条企业策略关闭该检查，只在容器内的 Chrome 生效
+COPY ./docker/res/playwright/chrome-policy.json /etc/opt/chrome/policies/managed/local-network.json
 
 # 从 cache-stage 复制 JDT LSP 到最终位置，避免中转层残留
 COPY --from=cache-stage /opt/jdtls /root/.local/share/jdtls

package/docker/res/agent/update-agents.sh

@@ -32,7 +32,7 @@ echo "[manyoyo] Agent CLI versions before update:"
 print_agent_versions
 
 if [ "${#update_packages[@]}" -gt 0 ]; then
-    npm_config_update_notifier=false npm install -g npm@latest "${update_packages[@]}" @playwright/cli@latest
+    npm_config_update_notifier=false npm install -g npm@latest "${update_packages[@]}"
     npm config set allow-scripts=@anthropic-ai/claude-code,@openai/codex,@google/gemini-cli,opencode-ai,@playwright/cli,pyright,typescript-language-server,typescript --location=user
 else
     echo "[manyoyo] No existing Agent CLI found; skip npm install."

package/docker/res/playwright/browser.json

@@ -1,27 +1,24 @@
 {
     "outputDir": "/tmp/.playwright-cli",
     "browser": {
-        "chromiumSandbox": false,
         "browserName": "chromium",
+        "contextOptions": {
+            "viewport": null
+        },
         "initScript": [
             "/run/manyoyo-playwright/stealth.init.js"
         ],
-        "contextOptions": {
-            "locale": "en-US",
-            "timezoneId": "UTC",
-            "viewport": null,
-            "extraHTTPHeaders": {
-                "Accept-Language": "en-US,en;q=0.9"
-            }
-        },
         "launchOptions": {
-            "channel": "chromium",
+            "channel": "chrome",
+            "chromiumSandbox": false,
             "headless": false,
             "args": [
                 "--lang=en-US",
-                "--window-size=1920,1080",
+                "--window-size=1920,1058",
+                "--window-position=0,0",
                 "--disable-blink-features=AutomationControlled",
-                "--force-webrtc-ip-handling-policy=disable_non_proxied_udp"
+                "--force-webrtc-ip-handling-policy=disable_non_proxied_udp",
+                "--disable-webrtc"
             ]
         }
     }

package/docker/res/playwright/chrome-policy.json

@@ -0,0 +1,3 @@
+{
+    "LocalNetworkAccessRestrictionsTemporaryOptOut": true
+}

package/docker/res/playwright/env

@@ -0,0 +1,3 @@
+export TZ='UTC'
+export LANG='en_US.UTF-8'
+export LANGUAGE='en_US:en'

package/docker/res/playwright/playwright-cli.sh

@@ -3,6 +3,11 @@
 # 以 playwright-cli 名字调用时交给 @playwright/cli；以 playwright-mcp 名字调用时启动 stdio MCP（读同一份 $PLAYWRIGHT_MCP_CONFIG）。
 export DISPLAY=:99
 CONFIG="${PLAYWRIGHT_MCP_CONFIG:-/run/manyoyo-playwright/config.json}"
+# 语言与时区用进程环境变量（TZ / LANG / LANGUAGE）原生提供，页面与 Worker 才一致；由宿主机生成，与 config.json 同目录
+ENV_FILE="$(dirname "$CONFIG")/env"
+if [ -r "$ENV_FILE" ]; then
+    . "$ENV_FILE"
+fi
 # 浏览器在容器外（headed / chrome / vnc）时不需要虚拟屏
 if ! grep -qE '"(remoteEndpoint|cdpEndpoint)"' "$CONFIG" 2>/dev/null; then
     # 以锁文件里的进程是否活着为准；容器被 kill 后遗留的 socket 与锁文件要清掉

package/docker/res/playwright/stealth.init.js

@@ -1,14 +1,16 @@
 'use strict';
 (function () {
     try {
-        const toolbar = 87;
-        const patch = (name, fallback, getter) => {
-            const original = Object.getOwnPropertyDescriptor(window, name);
-            if (!original || !original.get) return;
-            const real = original.get;
-            Object.defineProperty(window, name, { ...original, get: getter(function () { const value = real.call(this); return value === 0 ? fallback() : value; }) });
-        };
-        patch('outerWidth', () => window.innerWidth, fn => Object.getOwnPropertyDescriptor({ get outerWidth() { return fn.call(this); } }, 'outerWidth').get);
-        patch('outerHeight', () => window.innerHeight + toolbar, fn => Object.getOwnPropertyDescriptor({ get outerHeight() { return fn.call(this); } }, 'outerHeight').get);
+        const blocked = ['RTCPeerConnection', 'webkitRTCPeerConnection', 'RTCIceCandidate', 'RTCRtpSender', 'RTCRtpReceiver', 'RTCRtpTransceiver', 'RTCDataChannel'];
+        for (const name of blocked) {
+            Object.defineProperty(globalThis, name, { configurable: true, writable: true, value: undefined });
+        }
+        if (navigator.mediaDevices) {
+            Object.defineProperty(navigator.mediaDevices, 'getUserMedia', {
+                configurable: true,
+                writable: true,
+                value: async () => { throw new DOMException('WebRTC is disabled', 'NotAllowedError'); }
+            });
+        }
     } catch (_) {}
 })();

package/lib/container-exec.js

@@ -0,0 +1,132 @@
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const crypto = require('crypto');
+const state = require('./container-state');
+
+const ID_LABEL = 'manyoyo.id';
+
+/**
+ * 读容器的 manyoyo.id 标签；没有标签（旧容器）或容器不存在返回 ''。
+ * @param {(args: string[], options?: object) => string} dockerExecArgs
+ */
+function resolveContainerId(dockerExecArgs, containerName) {
+    try {
+        const out = String(dockerExecArgs(
+            ['inspect', '-f', `{{index .Config.Labels "${ID_LABEL}"}}`, containerName],
+            { stdio: 'pipe' }
+        ) || '').trim();
+        return state.isValidId(out) ? out : '';
+    } catch (e) {
+        return '';
+    }
+}
+
+// managed.env 在只读挂载的 sys/ 里（容器改不了）；box/env 是容器可写的，按不可信输入读取（见 container-state.js）
+function readTextOrEmpty(file, untrusted = false) {
+    if (untrusted) return state.readBoxText(file, state.MAX_ENV_BYTES).text;
+    try {
+        return fs.readFileSync(file, 'utf-8');
+    } catch (e) {
+        return '';
+    }
+}
+
+/**
+ * 合成一次 exec 的 env 行：managed → 用户 env（box/env）→ extra，后者覆盖前者，非法行一律丢弃。
+ * podman 对非法行（1BAD=x、含空格的 key）会原样传进容器，所以必须由宿主机先过滤。
+ * @returns {{lines: string[], invalid: object[]}}
+ */
+function composeEnvLines(managedText, boxText, extraLines = [], fileEntries = []) {
+    const merged = new Map();
+    const invalid = [];
+    const take = (text, source) => {
+        const parsed = state.parseEnvText(text);
+        parsed.entries.forEach(entry => merged.set(entry.key, entry.value));
+        parsed.invalid.forEach(item => invalid.push({ ...item, source }));
+    };
+    take(managedText, 'managed');
+    // 环境变量文件（已解析、已校验的条目）排在 managed 之后、box/env 之前：表格里的变量优先于文件
+    (fileEntries || []).forEach(entry => merged.set(entry.key, entry.value));
+    take(boxText, 'box');
+    // extra 是命令行 / 配置里已经成形的 KEY=VALUE（值是字面量，不再做去引号）
+    (extraLines || []).forEach(line => {
+        const i = String(line).indexOf('=');
+        if (i > 0 && state.ENV_KEY_RE.test(line.slice(0, i))) merged.set(line.slice(0, i), line.slice(i + 1));
+        else invalid.push({ line: 0, text: String(line), reason: '缺少 KEY=VALUE', source: 'extra' });
+    });
+    // 写给 docker / podman 的 --env-file：值是字面量（它们不处理引号），所以这里一律原样输出
+    return { lines: [...merged].map(([key, value]) => `${key}=${value}`), invalid };
+}
+
+function writeTempEnvFile(homeDir, lines) {
+    const dir = path.join(homeDir, '.manyoyo', 'tmp');
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    fs.chmodSync(dir, 0o700);
+    const file = path.join(dir, `exec-${process.pid}-${crypto.randomBytes(4).toString('hex')}`);
+    fs.writeFileSync(file, `${lines.join('\n')}\n`, { mode: 0o600, flag: 'wx' });
+    return file;
+}
+
+/**
+ * 所有进入用户容器的 `exec` 都经这里构造参数（Agent、终端、CLI 命令、first 预执行）。
+ * 用户 env 与 manyoyo 注入的 env 放在宿主机文件里，每次 exec 现读，所以改了下一条命令就生效；
+ * 值通过 0600 临时 env 文件传入，不出现在 ps 里；调用方必须在子进程启动后（或结束时）调 cleanup()。
+ *
+ * @param {{homeDir?: string, dockerExecArgs: Function}} ctx
+ * @param {string} containerName
+ * @param {object} options
+ * @param {boolean} [options.interactive] -i
+ * @param {boolean} [options.tty] -t
+ * @param {string} [options.user]
+ * @param {string[]} [options.envs] 非敏感的 KEY=VALUE（TERM 等），以 --env 传入
+ * @param {string[]} [options.extraEnv] 敏感/用户 KEY=VALUE（first.env），进临时文件，优先级最高
+ * @param {boolean} [options.withEnv=true] false 时不加载用户/managed env（读文件等与环境无关的 exec）
+ * @param {string[]} options.command 容器内要运行的命令与参数
+ * @returns {{args: string[], cleanup: () => void, invalid: object[], containerId: string}}
+ */
+function buildExecArgs(ctx, containerName, options = {}) {
+    const homeDir = ctx.homeDir || os.homedir();
+    const withEnv = options.withEnv !== false;
+    const args = ['exec'];
+    if (options.interactive) args.push('-i');
+    if (options.tty) args.push('-t');
+    if (options.user) args.push('--user', options.user);
+
+    let containerId = '';
+    let lines = [];
+    let invalid = [];
+    const extra = options.extraEnv || [];
+    if (withEnv) {
+        containerId = resolveContainerId(ctx.dockerExecArgs, containerName);
+        if (containerId && state.stateExists(homeDir, containerId)) {
+            const p = state.paths(homeDir, containerId);
+            ({ lines, invalid } = composeEnvLines(readTextOrEmpty(p.managedEnv), readTextOrEmpty(p.env, true), extra, state.envFileEntries(homeDir, containerId)));
+        } else {
+            containerId = '';
+            ({ lines, invalid } = composeEnvLines('', '', extra));
+        }
+    } else if (extra.length) {
+        ({ lines, invalid } = composeEnvLines('', '', extra));
+    }
+
+    let envFile = '';
+    if (lines.length) {
+        envFile = writeTempEnvFile(homeDir, lines);
+        args.push('--env-file', envFile);
+    }
+    (options.envs || []).forEach(entry => args.push('--env', entry));
+    args.push(containerName, ...(options.command || []));
+
+    let cleaned = false;
+    const cleanup = () => {
+        if (cleaned || !envFile) return;
+        cleaned = true;
+        try { fs.rmSync(envFile, { force: true }); } catch (e) { /* 尽力清理 */ }
+    };
+    return { args, cleanup, invalid, containerId };
+}
+
+module.exports = { ID_LABEL, resolveContainerId, composeEnvLines, buildExecArgs };