@xcanwin/manyoyo 8.3.3 → 8.4.0

package/lib/web/server.js

@@ -9,9 +9,19 @@ const { consumeLoginToken, isLoopbackHost } = require('../login-token');
 const http = require('http');
 const WebSocket = require('ws');
 const JSON5 = require('json5');
-const { buildContainerRunArgs } = require('../container-run');
+const { buildContainerRunArgs, hasNetworkArg } = require('../container-run');
 const { buildContainerIntegration, mergeIntegration } = require('../plugin');
 const { applyAptMirror } = require('../mirrors');
+const containerState = require('../container-state');
+const { buildExecArgs } = require('../container-exec');
+const { createNetworkManager, NETWORK_NAME } = require('../container-network');
+const { normalizePolicy } = require('../network-policy');
+const { withEnvEndpoints } = require('../network-endpoints');
+const { createEgressProxy, REALM: EGRESS_REALM } = require('../egress-proxy');
+const { createPortForwarder } = require('../port-forward');
+const { createContainerManageRoutes, pendingRisks } = require('./container-manage');
+const { resolveManageOptions } = require('../container-manage-options');
+const { defaultPolicy } = require('../network-policy');
 const { normalizeMirrors } = require('../runtime-normalizers');
 const { estimateContainerCapacity } = require('../capacity');
 const { extractAgentMessageFromCodexJsonl } = require('../codex-output');
@@ -1188,6 +1198,21 @@ function accumulateUsageTotal(baseline, turnUsage) {
     };
 }
 
+// 所有进用户容器的 exec 都经这里：env 从状态目录现读（见 lib/container-exec.js），子进程结束后删临时 env 文件
+function spawnContainerExec(ctx, containerName, execOptions, spawnOptions) {
+    const exec = buildExecArgs({ homeDir: ctx.homeDir || os.homedir(), dockerExecArgs: ctx.dockerExecArgs }, containerName, execOptions);
+    let child;
+    try {
+        child = spawn(ctx.dockerCmd, exec.args, { ...spawnOptions, env: ctx.dockerEnv });
+    } catch (e) {
+        exec.cleanup();
+        throw e;
+    }
+    child.once('close', exec.cleanup);
+    child.once('error', exec.cleanup);
+    return child;
+}
+
 // 起一个短命的容器内子进程，通过对应协议问一次元信息（初始化握手 / model 列表），拿到结果就杀掉进程——
 // 不是长驻会话，不会产生真实对话轮次或费用。
 function runAgentProtocolProcess(ctx, containerName, command, options = {}) {
@@ -1200,7 +1225,7 @@ function runAgentProtocolProcess(ctx, containerName, command, options = {}) {
         let stdoutAll = '';
         let child;
         try {
-            child = spawn(ctx.dockerCmd, ['exec', '-i', containerName, '/bin/bash', '-lc', command], { stdio: ['pipe', 'pipe', 'pipe'], env: ctx.dockerEnv });
+            child = spawnContainerExec(ctx, containerName, { interactive: true, command: ['/bin/bash', '-lc', command] }, { stdio: ['pipe', 'pipe', 'pipe'] });
         } catch (e) {
             resolve({ result: null, stdout: '' });
             return;
@@ -2493,40 +2518,16 @@ function normalizeStringArray(value, sourceLabel) {
         .filter(Boolean);
 }
 
-function parseEnvFileToArgs(filePath) {
+// 环境变量文件：只解析路径并检查存在，内容每次 exec 现读（见 lib/container-state.js 的 readEnvFiles）
+function resolveEnvFilePath(filePath) {
     const resolvedPath = expandHomeAliasPath(filePath);
     if (!path.isAbsolute(resolvedPath)) {
-        throw new Error(`envFile 仅支持绝对路径: ${filePath}`);
+        throw new Error(`环境变量文件仅支持绝对路径: ${filePath}`);
     }
     if (!fs.existsSync(resolvedPath)) {
-        throw new Error(`未找到环境文件: ${resolvedPath}`);
+        throw new Error(`未找到环境变量文件: ${resolvedPath}`);
     }
-
-    const content = fs.readFileSync(resolvedPath, 'utf-8');
-    const args = [];
-    const lines = content.split('\n');
-
-    for (let line of lines) {
-        const match = line.match(/^(?:export\s+)?([a-zA-Z_][a-zA-Z0-9_]*)\s*=\s*(.*)$/);
-        if (!match) {
-            continue;
-        }
-
-        const key = match[1];
-        let value = match[2].trim();
-        if (/[\r\n\0]/.test(value)) continue;
-        if (/[\$\(\)\`\|\&\*\{\};<>]/.test(value)) continue;
-        if (/^\(/.test(value)) continue;
-
-        if (/^"(.*)"$/.test(value)) {
-            value = value.slice(1, -1);
-        } else if (/^'(.*)'$/.test(value)) {
-            value = value.slice(1, -1);
-        }
-        args.push('--env', `${key}=${value}`);
-    }
-
-    return args;
+    return resolvedPath;
 }
 
 function resolveContainerModeArgs(mode) {
@@ -2693,7 +2694,7 @@ function buildConfigDefaults(ctx, config) {
     const defaults = {
         containerName: hasOwn(parsed, 'containerName') ? String(parsed.containerName || '') : '',
         hostPath: sanitizeDefaultHostPath(pickFirstString(parsed.hostPath, ctx.hostPath)),
-        containerPath: pickFirstString(parsed.containerPath, ctx.containerPath),
+        containerPath: pickFirstString(parsed.containerPath),
         imageName: pickFirstString(parsed.imageName, ctx.imageName),
         imageVersion: pickFirstString(parsed.imageVersion, ctx.imageVersion),
         containerMode: hasOwn(parsed, 'containerMode') ? String(parsed.containerMode || '') : '',
@@ -2747,6 +2748,7 @@ function buildStaticContainerRuntime(ctx, containerName) {
         contModeArgs: Array.isArray(ctx.contModeArgs) ? ctx.contModeArgs.slice() : [],
         containerExtraArgs: Array.isArray(ctx.containerExtraArgs) ? ctx.containerExtraArgs.slice() : [],
         containerEnvs: Array.isArray(ctx.containerEnvs) ? ctx.containerEnvs.slice() : [],
+        envFiles: Array.isArray(ctx.envFiles) ? ctx.envFiles.slice() : [],
         containerVolumes: Array.isArray(ctx.containerVolumes) ? ctx.containerVolumes.slice() : [],
         containerPorts: Array.isArray(ctx.containerPorts) ? ctx.containerPorts.slice() : [],
         defaultCommand: buildDefaultCommand(ctx.execCommandPrefix, ctx.execCommand, ctx.execCommandSuffix) || '/bin/bash'
@@ -2797,7 +2799,9 @@ function buildCreateRuntime(ctx, state, payload) {
         defaults: {
             hostPath: ctx.hostPath,
             containerName: `my-${ctx.formatDate()}`,
-            containerPath: ctx.containerPath,
+            // 不用 ctx.containerPath：那是 serve 进程的启动目录（CLI 的 cwd 语义），与用户要挂载的目录无关；
+            // 没配置也没传时落到下面的 `|| hostPath`，容器内路径与宿主机路径一致
+            containerPath: '',
             imageName: ctx.imageName,
             imageVersion: ctx.imageVersion
         },
@@ -2818,6 +2822,12 @@ function buildCreateRuntime(ctx, state, payload) {
         parseServerListen: () => ({ host: '', port: 0 })
     });
 
+    // 自启动与网络：请求 > runs.<name> > 全局配置；请求里放开限制（open / 非本机绑定）要带 confirmRisk
+    const manage = resolveManageOptions({ requestOptions, runConfig, globalConfig: config });
+    if (manage.fromRequest && requestOptions.confirmRisk !== true && pendingRisks(defaultPolicy(), manage.network).length) {
+        throw new Error('该网络设置会放开限制（open 预设或绑定非本机地址），需要确认（confirmRisk）');
+    }
+
     const containerName = resolvedBase.containerName;
     validateContainerNameStrict(containerName);
 
@@ -2886,6 +2896,7 @@ function buildCreateRuntime(ctx, state, payload) {
     const resumeSupported = Boolean(buildAgentResumeCommand(agentProgram));
 
     let containerEnvs = Array.isArray(ctx.containerEnvs) ? ctx.containerEnvs.slice() : [];
+    let envFiles = Array.isArray(ctx.envFiles) ? ctx.envFiles.slice() : [];
     const hasRunEnv = hasOwn(runConfig, 'env');
     const hasRunEnvFile = hasOwn(runConfig, 'envFile');
     if (hasRequestEnv || hasRequestEnvFile || hasRunEnv || hasRunEnvFile || hasConfigEnv || hasConfigEnvFile) {
@@ -2896,13 +2907,8 @@ function buildCreateRuntime(ctx, state, payload) {
             envArgs.push('--env', `${parsed.key}=${parsed.value}`);
         });
 
-        const envFileList = resolvedBase.envFile;
-        const envFileArgs = [];
-        envFileList.forEach(filePath => {
-            envFileArgs.push(...parseEnvFileToArgs(filePath));
-        });
-
-        containerEnvs = [...envArgs, ...envFileArgs];
+        containerEnvs = envArgs;
+        envFiles = resolvedBase.envFile.map(resolveEnvFilePath);
     }
 
     let containerVolumes = Array.isArray(ctx.containerVolumes) ? ctx.containerVolumes.slice() : [];
@@ -2934,8 +2940,11 @@ function buildCreateRuntime(ctx, state, payload) {
         contModeArgs,
         containerExtraArgs: Array.isArray(ctx.containerExtraArgs) ? ctx.containerExtraArgs.slice() : [],
         containerEnvs,
+        envFiles,
         containerVolumes,
         containerPorts,
+        autostart: manage.autostart,
+        network: manage.network,
         agentPromptCommand,
         defaultCommand: buildDefaultCommand(shellPrefix, shell, shellSuffix) || '/bin/bash',
         // 仅供服务端内部复用（如"创建相同配置容器"/"复制容器"），绝不能透传给任何对外响应字段，
@@ -2954,7 +2963,10 @@ function buildCreateRuntime(ctx, state, payload) {
             env: resolvedBase.env || {},
             envFile: resolvedBase.envFile || [],
             volumes: resolvedBase.volumes || [],
-            ports: resolvedBase.ports || []
+            ports: resolvedBase.ports || [],
+            autostart: manage.autostart,
+            // 复制容器时端口暴露（宿主机端口会冲突）与 peers（按 id 引用别的容器）不带过去
+            network: { ...manage.network, expose: [], peers: { inbound: [] } }
         },
         applied: {
             containerName,
@@ -2972,6 +2984,8 @@ function buildCreateRuntime(ctx, state, payload) {
             resumeSupported,
             yolo: yolo || '',
             envCount: Math.floor(containerEnvs.length / 2),
+            autostartEnabled: Boolean(manage.autostart.trim()),
+            networkPreset: manage.network.preset,
             volumeCount: Math.floor(containerVolumes.length / 2),
             portCount: Math.floor(containerPorts.length / 2)
         }
@@ -3015,7 +3029,11 @@ function buildCloneCreateOptionsFromSnapshot(runtimeSnapshot, fallbackHistory) {
             env: runtimeSnapshot.env || {},
             envFile: runtimeSnapshot.envFile || [],
             volumes: runtimeSnapshot.volumes || [],
-            ports: runtimeSnapshot.ports || []
+            ports: runtimeSnapshot.ports || [],
+            autostart: runtimeSnapshot.autostart || '',
+            network: runtimeSnapshot.network || undefined,
+            // 快照来自服务端、原容器创建时已确认过，复制不必再确认
+            confirmRisk: runtimeSnapshot.network ? true : undefined
         };
     }
 
@@ -3295,13 +3313,139 @@ async function cleanupStaleSetupTestContainers(ctx) {
         const names = String(listed || '').split('\n').map(line => line.trim())
             .filter(name => name.startsWith(SETUP_TEST_CONTAINER_PREFIX) && /^[A-Za-z0-9_.-]+$/.test(name));
         for (const name of names) {
+            const stateId = String(await ctx.dockerExecAsync(
+                ['inspect', '-f', '{{index .Config.Labels "manyoyo.id"}}', name], { timeout: 10000 }
+            ).catch(() => '') || '').trim();
             await ctx.dockerExecAsync(['rm', '-f', name], { timeout: 20000 }).catch(() => {});
+            if (stateId) containerState.removeState(ctx.homeDir || os.homedir(), stateId);
         }
     } catch (e) {
         ctx.logger.warn('cleanup stale setup test containers failed', { message: e && e.message });
     }
 }
 
+// 过滤代理固定端口：容器里的代理地址写在各自的 managed.env 里，serve 重启后端口不能变
+const EGRESS_PROXY_PORT = 8936;
+
+function probeEgressProxy(port) {
+    return new Promise(resolve => {
+        const req = http.request({ host: '127.0.0.1', port, method: 'GET', path: 'http://manyoyo.invalid/', timeout: 3000 }, res => {
+            res.resume();
+            resolve(res.statusCode === 407 && String(res.headers['proxy-authenticate'] || '').includes(EGRESS_REALM));
+        });
+        req.on('error', () => resolve(false));
+        req.on('timeout', () => { req.destroy(); resolve(false); });
+        req.end();
+    });
+}
+
+// 过滤代理（域名白名单的强制点）：有 allowlist 容器时才启动；同机另一个 serve 已经提供就复用它
+function ensureWebEgressProxy(ctx, state) {
+    if (!state.egressProxyPromise) {
+        const homeDir = ctx.homeDir || os.homedir();
+        // 每个 CONNECT 都读策略 / token：加 2 秒缓存，保存策略后最多 2 秒生效
+        const cache = new Map();
+        const cached = (key, load) => {
+            const hit = cache.get(key);
+            if (hit && Date.now() - hit.at < 2000) return hit.value;
+            const value = load();
+            cache.set(key, { at: Date.now(), value });
+            return value;
+        };
+        const proxy = createEgressProxy({
+            upstream: process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy || '',
+            getToken: id => cached(`t:${id}`, () => containerState.readEgressToken(homeDir, id)),
+            getPolicy: id => cached(`p:${id}`, () => {
+                try {
+                    const policy = normalizePolicy(containerState.readNetworkRaw(homeDir, id) || undefined);
+                    return { preset: policy.preset, domains: policy.egress.domains, rules: policy.egress.rules };
+                } catch (e) {
+                    return null;
+                }
+            })
+        });
+        state.egressProxyPromise = proxy.start({ host: '0.0.0.0', port: EGRESS_PROXY_PORT })
+            .then(port => { state.egressProxy = proxy; return { port }; })
+            .catch(async error => {
+                if (error.code === 'EADDRINUSE' && await probeEgressProxy(EGRESS_PROXY_PORT)) return { port: EGRESS_PROXY_PORT };
+                state.egressProxyPromise = null;
+                throw new Error(error.code === 'EADDRINUSE' ? `过滤代理端口 ${EGRESS_PROXY_PORT} 被其他程序占用` : error.message);
+            });
+    }
+    return state.egressProxyPromise;
+}
+
+function getWebPortForwarder(ctx, state) {
+    if (!state.portForwarder) {
+        const homeDir = ctx.homeDir || os.homedir();
+        state.portForwarder = createPortForwarder({
+            command: ctx.dockerCmd,
+            env: ctx.dockerEnv,
+            homeDir,
+            // id → 当前容器名：只信运行时里真实存在的（serve 启动时与接口调用时登记），meta.json 里的旧名字可能已被同名新容器占用
+            resolveName: id => (state.containerNames && state.containerNames.get(id)) || '',
+            warn: message => ctx.logger.warn(message)
+        });
+    }
+    return state.portForwarder;
+}
+
+// 运行时就绪后的容器服务：规则对账 + start 事件订阅（外部重启后补下发）、serve 启动时拉起标记了“自动拉起”的容器、
+// 恢复端口暴露。没有 watchStarts 的替身管理器（单测）不启动任何后台服务。
+async function startContainerServices(ctx, state) {
+    const manager = getWebNetworkManager(ctx, state);
+    const homeDir = ctx.homeDir || os.homedir();
+    sweepStaleExecEnvFiles(homeDir);
+    state.networkWatch = manager.watchStarts();
+    const forwarder = getWebPortForwarder(ctx, state);
+    // 以运行时里真实存在的容器为准（按 id 对应名字）；状态目录里有、容器却没有的是孤儿，既不拉起也不转发
+    state.containerNames = new Map((await manager.listManaged()).map(item => [item.id, item.name]));
+    for (const id of containerState.listStateIds(homeDir)) {
+        const name = state.containerNames.get(id);
+        if (!name) continue;
+        let policy;
+        try { policy = normalizePolicy(containerState.readNetworkRaw(homeDir, id) || undefined); } catch (e) { continue; }
+        if (policy.autostartOnServe) {
+            try {
+                if (ctx.getContainerStatus(name) !== 'running') await ctx.dockerExecAsync(['start', name], { timeout: 30000 });
+            } catch (e) {
+                ctx.logger.warn('autostart container failed', { name, message: e && e.message });
+            }
+        }
+        if (policy.expose.length) await forwarder.sync(id, policy.expose);
+    }
+}
+
+// serve 异常退出时 exec 的临时 env 文件（明文）可能残留：启动时清掉超过 6 小时的（正在跑的长任务不会这么久还没读完它）
+function sweepStaleExecEnvFiles(homeDir) {
+    const dir = path.join(homeDir, '.manyoyo', 'tmp');
+    try {
+        for (const entry of fs.readdirSync(dir)) {
+            if (!/^(exec|env)-/.test(entry)) continue;
+            const file = path.join(dir, entry);
+            if (Date.now() - fs.statSync(file).mtimeMs > 6 * 3600 * 1000) fs.rmSync(file, { force: true });
+        }
+    } catch (e) { /* 没有目录 */ }
+}
+
+// 运行时就绪后启动 startContainerServices
+function startContainerNetworkWatch(ctx, state) {
+    const manager = getWebNetworkManager(ctx, state);
+    if (typeof manager.watchStarts !== 'function' || state.networkWatch || state.containerServicesStarting) return;
+    state.containerServicesStarting = true;
+    const deadline = Date.now() + 10 * 60 * 1000;
+    const tick = () => {
+        const status = ctx.runtimeState.status;
+        if (status === 'ready') {
+            startContainerServices(ctx, state).catch(e => ctx.logger.warn('container services failed', { message: e && e.message }));
+            return;
+        }
+        if (status === 'failed' || Date.now() > deadline) return;
+        setTimeout(tick, 1000).unref();
+    };
+    tick();
+}
+
 function startStaleSetupCleanup(ctx) {
     const deadline = Date.now() + 10 * 60 * 1000;
     const tick = () => {
@@ -3347,6 +3491,25 @@ async function buildWebPlaywrightIntegration(ctx, state, runtime) {
     return mergeIntegration(runtime, integration);
 }
 
+// serve 进程的网络规则下发器（一份，懒创建）
+function getWebNetworkManager(ctx, state) {
+    if (ctx.networkManager) return ctx.networkManager;
+    if (!state.networkManager) {
+        state.networkManager = createNetworkManager({
+            command: ctx.dockerCmd,
+            env: ctx.dockerEnv,
+            homeDir: ctx.homeDir || os.homedir(),
+            imageRef: () => `${ctx.imageName}:${ctx.imageVersion}`,
+            getMirrorUrls: () => Object.values(readWebMirrors(state)).filter(Boolean),
+            getFilterProxy: () => ensureWebEgressProxy(ctx, state),
+            warn: message => ctx.logger.warn(message)
+        });
+    }
+    return state.networkManager;
+}
+
+// 进入容器前一律检查网络规则（宿主机侧的“本次启动已下发”状态）：文件浏览也会 exec /bin/bash -lc，
+// 里面的 .bashrc 等是 Agent 能改的代码，不能在规则缺失的窗口里跑
 async function ensureWebContainer(ctx, state, containerInput, messageSessionRef = null) {
     const runtime = typeof containerInput === 'string'
         ? buildStaticContainerRuntime(ctx, containerInput)
@@ -3358,8 +3521,27 @@ async function ensureWebContainer(ctx, state, containerInput, messageSessionRef
 
     if (!ctx.containerExists(runtime.containerName)) {
         const mirrors = readWebMirrors(state);
+        // 用户 env 不进容器配置，写进状态目录的 box/env，每次 exec 现读（见 lib/container-exec.js）
+        const userEnvLines = containerState.userEnvLines(runtime.containerEnvs);
         const playwright = await buildWebPlaywrightIntegration(ctx, state, runtime);
+        const containerEnvs = containerState.stripEnvKeys(playwright.containerEnvs, new Set(userEnvLines.map(containerState.envLineKey)));
+        const networkPolicy = await withEnvEndpoints(normalizePolicy(runtime.network), [...userEnvLines, ...containerState.readEnvFilePaths(runtime.envFiles || []).flatMap(file => file.entries.map(entry => `${entry.key}=${entry.value}`))]);
+        const networkManager = getWebNetworkManager(ctx, state);
+        if (!hasNetworkArg([...(runtime.contModeArgs || []), ...(playwright.containerExtraArgs || [])])) {
+            await networkManager.ensureBridgeNetwork();
+        }
+        const containerStateInfo = containerState.createState({
+            homeDir: ctx.homeDir || os.homedir(),
+            envLines: userEnvLines,
+            envFiles: runtime.envFiles,
+            autostart: runtime.autostart,
+            network: networkPolicy,
+            netRequired: networkPolicy.preset !== 'open',
+            meta: { name: runtime.containerName }
+        });
         const args = buildContainerRunArgs({
+            state: containerStateInfo,
+            defaultNetwork: NETWORK_NAME,
             mirrors,
             containerName: runtime.containerName,
             hostPath: runtime.hostPath,
@@ -3368,22 +3550,31 @@ async function ensureWebContainer(ctx, state, containerInput, messageSessionRef
             imageVersion: runtime.imageVersion,
             contModeArgs: runtime.contModeArgs,
             containerExtraArgs: playwright.containerExtraArgs,
-            containerEnvs: playwright.containerEnvs,
+            containerEnvs,
             containerVolumes: playwright.containerVolumes,
             containerPorts: runtime.containerPorts,
             defaultCommand: runtime.defaultCommand
         });
 
-        await ensureWebImage(ctx, state, webImageRef(ctx, runtime), { failFast: true });
-
         try {
+            await ensureWebImage(ctx, state, webImageRef(ctx, runtime), { failFast: true });
             ctx.dockerExecArgs(args, { stdio: 'pipe' });
         } catch (e) {
+            containerState.removeState(ctx.homeDir || os.homedir(), containerStateInfo.id);
             ctx.showImagePullHint(e);
             throw e;
         }
 
         await ctx.waitForContainerReady(runtime.containerName, { throwOnFailure: true });
+        // 先下发网络规则再做任何 exec；失败即关闭（抛错，容器留着，init 在等门闩）
+        await networkManager.apply(runtime.containerName, { expectId: containerStateInfo.id });
+        // 创建时填的端口暴露：容器已就绪、规则已下发后立即开始转发；端口被占等失败只警告，网络页里能看到没有生效
+        if (networkPolicy.expose.length) {
+            if (!state.containerNames) state.containerNames = new Map();
+            state.containerNames.set(containerStateInfo.id, runtime.containerName);
+            const failures = await getWebPortForwarder(ctx, state).sync(containerStateInfo.id, networkPolicy.expose);
+            failures.forEach(message => console.warn(message));
+        }
         applyAptMirror({
             dockerExecArgs: ctx.dockerExecArgs,
             containerName: runtime.containerName,
@@ -3409,16 +3600,18 @@ async function ensureWebContainer(ctx, state, containerInput, messageSessionRef
             `容器 ${runtime.containerName} 已启动。`
         );
     }
+    await getWebNetworkManager(ctx, state).ensureReady(runtime.containerName);
 }
 
 async function execCommandInWebContainer(ctx, containerName, command, options = {}) {
     const opts = options && typeof options === 'object' ? options : {};
     const agentProgram = typeof opts.agentProgram === 'string' ? opts.agentProgram : '';
     return await new Promise((resolve, reject) => {
-        const process = spawn(
-            ctx.dockerCmd,
-            ['exec', containerName, '/bin/bash', '-lc', command],
-            { stdio: ['ignore', 'pipe', 'pipe'], env: ctx.dockerEnv }
+        const process = spawnContainerExec(
+            ctx,
+            containerName,
+            { withEnv: opts.withEnv !== false, command: ['/bin/bash', '-lc', command] },
+            { stdio: ['ignore', 'pipe', 'pipe'] }
         );
 
         const MAX_RAW_OUTPUT_CHARS = 32 * 1024 * 1024;
@@ -3483,10 +3676,11 @@ __MANYOYO_NODE__`;
 }
 
 function spawnContainerRawFileStream(ctx, containerName, filePath) {
-    return spawn(
-        ctx.dockerCmd,
-        ['exec', containerName, 'cat', '--', filePath],
-        { stdio: ['ignore', 'pipe', 'pipe'], env: ctx.dockerEnv }
+    return spawnContainerExec(
+        ctx,
+        containerName,
+        { withEnv: false, command: ['cat', '--', filePath] },
+        { stdio: ['ignore', 'pipe', 'pipe'] }
     );
 }
 
@@ -3516,7 +3710,7 @@ function inferFileLanguage(filePath) {
 }
 
 async function execJsonCommandInWebContainer(ctx, containerName, command) {
-    const result = await execCommandInWebContainer(ctx, containerName, command);
+    const result = await execCommandInWebContainer(ctx, containerName, command, { withEnv: false });
     if (result.exitCode !== 0) {
         throw new Error(result.output || '容器命令执行失败');
     }
@@ -3821,10 +4015,11 @@ async function execAgentInWebContainerStream(ctx, state, sessionRefOrContainerNa
         : reserveWebAgentRun(state, sessionRef);
     let process;
     try {
-        process = spawn(
-            ctx.dockerCmd,
-            ['exec', sessionRef.containerName, '/bin/bash', '-lc', command],
-            { stdio: ['ignore', 'pipe', 'pipe'], env: ctx.dockerEnv }
+        process = spawnContainerExec(
+            ctx,
+            sessionRef.containerName,
+            { command: ['/bin/bash', '-lc', command] },
+            { stdio: ['ignore', 'pipe', 'pipe'] }
         );
     } catch (e) {
         // spawn 同步抛错（如 dockerCmd 不存在）时必须释放锁，否则这个容器永远发不出消息
@@ -4184,9 +4379,14 @@ async function runSetupConnectionTest(ctx, state, agent, envMap) {
     const workpath = getSetupWorkpath(state);
     fs.mkdirSync(workpath, { recursive: true });
     const containerName = `manyoyo-setup-test-${crypto.randomBytes(4).toString('hex')}`;
-    const containerEnvs = [];
-    Object.entries(envMap).forEach(([key, value]) => containerEnvs.push('--env', `${key}=${value}`));
+    const testHome = ctx.homeDir || os.homedir();
+    const containerStateInfo = containerState.createState({
+        homeDir: testHome,
+        envLines: Object.entries(envMap).map(([key, value]) => `${key}=${value}`),
+        meta: { name: containerName }
+    });
     const args = buildContainerRunArgs({
+        state: containerStateInfo,
         containerName,
         hostPath: workpath,
         containerPath: '/workspace',
@@ -4194,7 +4394,7 @@ async function runSetupConnectionTest(ctx, state, agent, envMap) {
         imageVersion: ctx.imageVersion,
         contModeArgs: [],
         containerExtraArgs: [],
-        containerEnvs,
+        containerEnvs: [],
         containerVolumes: [],
         containerPorts: [],
         defaultCommand: '/bin/bash'
@@ -4220,6 +4420,7 @@ async function runSetupConnectionTest(ctx, state, agent, envMap) {
         } catch (e) {
             // 容器可能根本没创建成功
         }
+        containerState.removeState(testHome, containerStateInfo.id);
     }
 }
 
@@ -4628,20 +4829,16 @@ function spawnWebTerminalProcess(ctx, containerName, cols, rows) {
 
     const termValue = process.env.TERM && process.env.TERM !== 'dumb' ? process.env.TERM : 'xterm-256color';
     const colorTermValue = process.env.COLORTERM || 'truecolor';
-    const dockerExecArgs = [
-        'exec',
-        '-i',
-        '-e', `TERM=${termValue}`,
-        '-e', `COLORTERM=${colorTermValue}`,
-        '-e', `MANYOYO_TERM_COLS=${String(cols)}`,
-        '-e', `MANYOYO_TERM_ROWS=${String(rows)}`,
-        containerName,
-        '/bin/bash',
-        '-lc',
-        terminalBootstrap
-    ];
-
-    return spawn(ctx.dockerCmd, dockerExecArgs, { stdio: ['pipe', 'pipe', 'pipe'], env: ctx.dockerEnv });
+    return spawnContainerExec(ctx, containerName, {
+        interactive: true,
+        envs: [
+            `TERM=${termValue}`,
+            `COLORTERM=${colorTermValue}`,
+            `MANYOYO_TERM_COLS=${String(cols)}`,
+            `MANYOYO_TERM_ROWS=${String(rows)}`
+        ],
+        command: ['/bin/bash', '-lc', terminalBootstrap]
+    }, { stdio: ['pipe', 'pipe', 'pipe'] });
 }
 
 function bindTerminalWebSocket(ctx, state, ws, containerName, cols, rows) {
@@ -5209,6 +5406,7 @@ async function handleWebApi(req, res, pathname, ctx, state) {
                     ctx.retryRuntimeHeal();
                     if (ctx.autoPullImage) startWebImagePrepare(ctx, state);
                     startStaleSetupCleanup(ctx);
+                    startContainerNetworkWatch(ctx, state);
                 }
                 // 镜像拉取失败的条目会一直挂着：清掉后重新拉
                 if (ctx.runtimeState.status === 'ready' && ctx.autoPullImage) {
@@ -6321,6 +6519,26 @@ async function handleWebApi(req, res, pathname, ctx, state) {
         }
     ];
 
+    routes.push(...createContainerManageRoutes({
+        ctx,
+        state,
+        req,
+        res,
+        deps: {
+            sendJson,
+            readJsonBody,
+            decodeSessionName,
+            getNetworkManager: () => getWebNetworkManager(ctx, state),
+            getPortForwarder: () => getWebPortForwarder(ctx, state),
+            rememberContainerName: (id, name) => {
+                if (!state.containerNames) state.containerNames = new Map();
+                state.containerNames.set(id, name);
+            },
+            ensureWebContainer,
+            execCommandInWebContainer
+        }
+    }));
+
     for (const route of routes) {
         if (route.method !== req.method) {
             continue;
@@ -6370,6 +6588,8 @@ async function startWebServer(options) {
         contModeArgs: options.contModeArgs,
         containerExtraArgs: options.containerExtraArgs,
         containerEnvs: options.containerEnvs,
+        networkManager: options.networkManager,
+        envFiles: options.envFiles,
         containerVolumes: options.containerVolumes,
         containerPorts: options.containerPorts,
         validateHostPath: options.validateHostPath,
@@ -6598,7 +6818,7 @@ async function startWebServer(options) {
             console.log(`${GREEN}✅ MANYOYO Web 服务已启动: http://${listenHost}:${listenPort}${NC}`);
             console.log(`${CYAN}提示: 左侧是 manyoyo 容器与 AGENT 列表，右侧是聊天/终端/文件/详情/配置/检查工作台。${NC}`);
             if (ctx.serverHost === '0.0.0.0') {
-                console.log(`${CYAN}提示: 当前监听全部网卡，请用本机局域网 IP 访问。${NC}`);
+                console.log(`${CYAN}提示: 当前监听全部网卡，请用本机局域网 / 公网 IP 访问。${NC}`);
             }
             console.log(`${CYAN}🔐 登录用户名: ${YELLOW}${ctx.authUser}${NC}`);
             if (ctx.authPassAuto) {
@@ -6617,6 +6837,7 @@ async function startWebServer(options) {
     });
 
     startStaleSetupCleanup(ctx);
+    startContainerNetworkWatch(ctx, state);
     if (ctx.autoPullImage) {
         startWebImagePrepare(ctx, state);
     }
@@ -6628,6 +6849,12 @@ async function startWebServer(options) {
         port: listenPort,
         close: () => new Promise(resolve => {
             ctx.logger.info('web server closing');
+            if (state.networkWatch) {
+                state.networkWatch.stop();
+                state.networkWatch = null;
+            }
+            if (state.portForwarder) state.portForwarder.closeAll();
+            if (state.egressProxy) state.egressProxy.stop();
             for (const session of state.terminalSessions.values()) {
                 const ptyProcess = session && session.ptyProcess;
                 if (ptyProcess && !ptyProcess.killed) {

package/manyoyo.example.json

@@ -29,6 +29,24 @@
     "volumes": [],
     "ports": ["8888:8888"],
 
+    // 网络策略（新建容器时写入，Web「容器」页随时改，不需要重启容器）。不写 = 默认收紧：允许公网，
+    // 禁止宿主机其他端口、局域网 / 私有网段、云元数据与其他容器。
+    // preset：restricted（默认）/ allowlist（域名白名单，需要 serve 运行）/ open（不加规则）
+    "network": {
+        "preset": "restricted",
+        // 允许容器访问的宿主机端口（宿主机上监听 0.0.0.0 的服务）
+        "host": [],
+        // 直连放行的 IP 规则，例如局域网里的模型网关：{ "cidr": "192.168.1.50", "ports": "8000", "proto": "tcp" }
+        "egress": { "domains": [], "rules": [] },
+        // 端口暴露（需要 serve 运行）：监听地址默认 127.0.0.1；绑 0.0.0.0 等于局域网 / 公网可见
+        "expose": []
+    },
+
+    // 容器每次启动（新建、重启、serve 拉起）都由容器内 init 执行一次的 bash 脚本；新建容器时写入，之后在 Web「容器」页随时改
+    "autostart": "",
+    // serve 启动时是否自动拉起此容器（配合 autostart 使用）
+    "autostartOnServe": false,
+
     // 仅首次创建容器时执行一次（创建后、常规 shell 前）
     "first": {
         // 仅支持绝对路径，如 /abs/path.env
@@ -81,8 +99,8 @@
             "timezoneId": "",
             // 强制 navigator.platform；留空则使用浏览器真实值（推荐，与 UA、字体、WebGL 自洽）
             "navigatorPlatform": "",
-            // 是否禁用 WebRTC（默认 false）
-            "disableWebRTC": false,
+            // 是否禁用 WebRTC（默认 true：否则 STUN 会暴露本机公网 IP；需要视频会议类网站时设为 false）
+            "disableWebRTC": true,
             // chrome 模式读取的 DevToolsActivePort 文件；留空时自动探测常见路径
             "devtoolsActivePortPath": "",
             // playwright ext-download 的 CRX prodversion 参数