@xcanwin/manyoyo 8.3.3 → 8.5.0

package/README.md

@@ -53,7 +53,7 @@ manyoyo init all   # 把本机已有的 Agent 配置搬进来
 manyoyo run -y c   # 在沙箱里以 YOLO 模式启动 Claude Code
 ```
 
-默认镜像 `ghcr.io/xcanwin/manyoyo` 首次使用时自动拉取；需要自定义镜像时再执行 `manyoyo build --iv 2.1.1-common`。更多命令见[命令速查](https://xcanwin.github.io/manyoyo/reference/cli-options)。
+默认镜像 `ghcr.io/xcanwin/manyoyo` 首次使用时自动拉取；需要自定义镜像时再执行 `manyoyo build --iv 2.2.0-common`。更多命令见[命令速查](https://xcanwin.github.io/manyoyo/reference/cli-options)。
 
 ## 它能做什么
 

package/bin/manyoyo.js

@@ -9,7 +9,8 @@ const net = require('net');
 const readline = require('readline');
 const { Command, Help } = require('commander');
 const { startWebServer } = require('../lib/web/server');
-const { buildContainerRunArgs, buildContainerRunCommand, runWithEnvFile } = require('../lib/container-run');
+const { isSidecarName } = require('../lib/egress-sidecar');
+const { buildContainerRunArgs, buildContainerRunCommand, runWithEnvFile, hasNetworkArg } = require('../lib/container-run');
 const { getManyoyoConfigPath, readManyoyoConfig, syncGlobalImageVersion } = require('../lib/global-config');
 const { resolveUpdateImageVersion } = require('../lib/image-version-policy');
 const { selectContainerRuntime, mergeRuntimeEnv } = require('../lib/container-runtime');
@@ -44,6 +45,12 @@ const {
     normalizeMirrors
 } = require('../lib/runtime-normalizers');
 const { applyAptMirror } = require('../lib/mirrors');
+const containerState = require('../lib/container-state');
+const { buildExecArgs, resolveContainerId } = require('../lib/container-exec');
+const { createNetworkManager, NETWORK_NAME } = require('../lib/container-network');
+const { normalizePolicy } = require('../lib/network-policy');
+const { withEnvEndpoints } = require('../lib/network-endpoints');
+const { resolveManageOptions } = require('../lib/container-manage-options');
 const {
     sanitizeSensitiveData,
     sanitizeServeLogText,
@@ -131,6 +138,8 @@ let CONTAINER_RUNTIME = null;
 let UPDATE_CHECK_ENABLED = true;
 // 全局配置 mirrors（apt/npm/pip 软件源，空 = 官方默认）：容器创建时在容器层生效，镜像不变
 let MIRRORS = { apt: '', npm: '', pip: '' };
+let MANAGE_OPTIONS = { autostart: '', network: null };
+let ENV_FILES = [];
 // serve 的容器环境状态，供 GET /api/system/runtime 读取
 const RUNTIME_STATE = { status: 'ready', message: '' };
 const DOCKER_DAEMON_ERROR_CODES = new Set(['PODMAN_MACHINE_UNAVAILABLE', 'DOCKER_DAEMON_UNAVAILABLE', 'PORT_IN_USE']);
@@ -342,6 +351,9 @@ function installServeProcessDiagnostics(logger) {
  * @property {string} [yolo] - YOLO 模式
  * @property {string} [containerMode] - 容器模式
  * @property {string} [containerRuntime] - 容器运行时（auto/docker/podman，默认 auto；仅全局配置生效）
+ * @property {string} [autostart] - 容器每次启动时由容器内 init 执行的 bash 脚本（新建容器时写入状态目录）
+ * @property {boolean} [autostartOnServe] - serve 启动时自动拉起此容器
+ * @property {object} [network] - 网络策略（preset / host / egress / peers，见 lib/network-policy.js），不写为默认收紧
  * @property {{apt?: string, npm?: string, pip?: string}} [mirrors] - 容器内 apt/npm/pip 软件源（http/https URL，空/缺省为官方默认；仅全局配置生效）
  * @property {boolean} [updateCheck] - serve 是否每天检查一次新版本（默认 true；仅全局配置生效，请求不附带任何本机信息）
  * @property {number} [cacheTTL] - 缓存过期天数
@@ -567,43 +579,16 @@ function addEnvFileTo(targetEnvs, envFile) {
     }
 
     if (fs.existsSync(filePath)) {
-        const content = fs.readFileSync(filePath, 'utf-8');
-        const lines = content.split('\n');
-
-        for (let line of lines) {
-            // Match pattern: (export )?(KEY)=(VALUE)
-            const match = line.match(/^(?:export\s+)?([a-zA-Z_][a-zA-Z0-9_]*)\s*=\s*(.*)$/);
-            if (match) {
-                let key = match[1];
-                let value = match[2].trim();
-
-                // Filter malicious characters
-                if (/[\r\n\0]/.test(value)) continue;
-                if (/[\$\(\)\`\|\&\*\{\};<>]/.test(value)) continue;
-                if (/^\(/.test(value)) continue;
-
-                // Remove quotes
-                if (/^"(.*)"$/.test(value)) {
-                    value = value.slice(1, -1);
-                } else if (/^'(.*)'$/.test(value)) {
-                    value = value.slice(1, -1);
-                }
-
-                if (key) {
-                    targetEnvs.push("--env", `${key}=${value}`);
-                }
-            }
-        }
+        // 与「环境变量」文本同一套语法（见 lib/env-text.js）；值里有被禁止的字符的行会被跳过并提示
+        const { entries, invalid } = containerState.parseEnvFileContent(fs.readFileSync(filePath, 'utf-8'));
+        entries.forEach(entry => targetEnvs.push('--env', `${entry.key}=${entry.value}`));
+        invalid.forEach(item => console.error(`${YELLOW}⚠️  ${filePath} 第 ${item.line} 行已跳过: ${item.reason}${NC}`));
         return {};
     }
     console.error(`${RED}⚠️  未找到环境文件: ${envFile}${NC}`);
     return {};
 }
 
-function addEnvFile(envFile) {
-    return addEnvFileTo(CONTAINER_ENVS, envFile);
-}
-
 // Playwright 浏览器模式的容器参数；在容器创建时（运行时已确定）才计算，失败只警告，不影响 run
 async function applyPlaywrightIntegration(runtime) {
     const integration = await buildContainerIntegration({
@@ -768,7 +753,10 @@ function getContainerStatus(name) {
 
 function removeContainer(name) {
     if ( !(QUIET.crm || QUIET.full) ) console.log(`${YELLOW}🗑️ 正在删除容器: ${name}...${NC}`);
+    // 先读 id：容器删掉后就查不到了；同时删状态目录，同名重建不会继承旧 env / 规则
+    const stateId = resolveContainerId(dockerExecArgs, name);
     dockerExecArgs(['rm', '-f', name], { stdio: 'pipe' });
+    if (stateId) containerState.removeState(os.homedir(), stateId);
     if ( !(QUIET.crm || QUIET.full) ) console.log(`${GREEN}✅ 已彻底删除。${NC}`);
 }
 
@@ -1007,6 +995,7 @@ function getContList() {
                 const image = cols[4] || '';
                 // include manyoyo runtime containers (image match)
                 // and plugin containers (both legacy manyoyo-* and new my-* prefixes)
+                if (isSidecarName(name)) return false; // 域名白名单的过滤代理容器不是用户的会话容器
                 return image.includes('manyoyo') || name.startsWith('manyoyo-') || name.startsWith('my-');
             });
 
@@ -1503,6 +1492,9 @@ https://github.com/xcanwin/manyoyo
     const runConfig = runNameToLoad ? loadRunConfig(runNameToLoad, config) : {};
     const globalFirstConfig = normalizeFirstConfig(config.first, '全局配置');
     const runFirstConfig = normalizeFirstConfig(runConfig.first, '运行配置');
+    // 自启动脚本与网络策略：runs.<name> > 全局配置（新建容器时写进状态目录，Web 上可随时改）
+    const manageOptions = resolveManageOptions({ runConfig, globalConfig: config });
+    MANAGE_OPTIONS = manageOptions;
 
     const resolvedRuntime = resolveRuntimeConfig({
         cliOptions: options,
@@ -1551,7 +1543,17 @@ https://github.com/xcanwin/manyoyo
 
     // Merge mode (array values): concatenate all sources
     const envFileList = resolvedRuntime.envFile;
-    envFileList.forEach(ef => addEnvFile(ef));
+    // 环境变量文件不再在创建时展开成 --env：登记路径，每次 exec 现读（改了文件下一条命令就生效）
+    ENV_FILES = [];
+    envFileList.forEach(ef => {
+        const filePath = String(ef || '').trim();
+        if (!path.isAbsolute(filePath)) {
+            console.error(`${RED}⚠️  错误: --env-file 仅支持绝对路径: ${ef}${NC}`);
+            process.exit(1);
+        }
+        if (!fs.existsSync(filePath)) console.error(`${YELLOW}⚠️  未找到环境文件（创建后放进去也会生效）: ${ef}${NC}`);
+        ENV_FILES.push(filePath);
+    });
 
     const envMap = resolvedRuntime.env;
     Object.entries(envMap).forEach(([key, value]) => addEnv(`${key}=${value}`));
@@ -1612,6 +1614,8 @@ https://github.com/xcanwin/manyoyo
             containerMode: contModeValue || "",
             containerRuntime: config.containerRuntime || "auto",
             mirrors: MIRRORS,
+            autostart: manageOptions.autostart,
+            network: manageOptions.network,
             shellPrefix: EXEC_COMMAND_PREFIX.trim(),
             shell: EXEC_COMMAND || "",
             shellSuffix: EXEC_COMMAND_SUFFIX || "",
@@ -1753,6 +1757,9 @@ function createRuntimeContext(modeState = {}) {
         containerExtraArgs: CONTAINER_EXTRA_ARGS,
         containerEnvs: CONTAINER_ENVS,
         mirrors: MIRRORS,
+        autostart: MANAGE_OPTIONS.autostart,
+        network: MANAGE_OPTIONS.network,
+        envFiles: ENV_FILES,
         firstContainerEnvs: FIRST_CONTAINER_ENVS,
         containerVolumes: CONTAINER_VOLUMES,
         containerPorts: CONTAINER_PORTS,
@@ -2047,15 +2054,16 @@ function executeFirstCommand(runtime) {
         console.log(`⚙️  首次预执行命令: ${YELLOW}${firstCommand}${NC}`);
     }
 
-    const firstExecArgs = [
-        'exec',
-        ...(runtime.firstContainerEnvs || []),
-        runtime.containerName,
-        '/bin/bash',
-        '-c',
-        firstCommand
-    ];
-    const firstExecResult = spawnSync(`${DOCKER_CMD}`, firstExecArgs, { stdio: 'inherit', env: DOCKER_ENV });
+    const firstExec = buildExecArgs({ homeDir: os.homedir(), dockerExecArgs }, runtime.containerName, {
+        extraEnv: containerState.envArgsToLines(runtime.firstContainerEnvs),
+        command: ['/bin/bash', '-c', firstCommand]
+    });
+    let firstExecResult;
+    try {
+        firstExecResult = spawnSync(`${DOCKER_CMD}`, firstExec.args, { stdio: 'inherit', env: DOCKER_ENV });
+    } finally {
+        firstExec.cleanup();
+    }
     if (firstExecResult.error) {
         throw firstExecResult.error;
     }
@@ -2083,15 +2091,38 @@ async function createNewContainer(runtime) {
     );
     const defaultCommand = runtime.execCommand;
 
+    // 用户 env 不进容器配置（podman inspect 看不到明文），改写进状态目录的 box/env，每次 exec 现读
+    const userEnvLines = containerState.userEnvLines(runtime.containerEnvs);
     await applyPlaywrightIntegration(runtime);
+    runtime.containerEnvs = containerState.stripEnvKeys(runtime.containerEnvs, new Set(userEnvLines.map(containerState.envLineKey)));
 
     if (runtime.showCommand) {
+        runtime.state = previewContainerState();
         console.log(buildDockerRunCmd(runtime));
         process.exit(0);
     }
 
     await ensureRunImage(runtime);
 
+    const networkPolicy = await withEnvEndpoints(normalizePolicy(runtime.network), [...userEnvLines, ...containerState.readEnvFilePaths(runtime.envFiles || []).flatMap(file => file.entries.map(entry => `${entry.key}=${entry.value}`))]);
+    const networkManager = createCliNetworkManager(runtime);
+    if (!hasNetworkArg([...(runtime.contModeArgs || []), ...(runtime.containerExtraArgs || [])])) {
+        try {
+            await networkManager.ensureBridgeNetwork();
+        } catch (e) {
+            throw new Error(`无法创建 ${NETWORK_NAME} 网络: ${e.message}`);
+        }
+    }
+    runtime.state = containerState.createState({
+        homeDir: os.homedir(),
+        envLines: userEnvLines,
+        envFiles: runtime.envFiles,
+        autostart: runtime.autostart,
+        network: networkPolicy,
+        netRequired: networkPolicy.preset !== 'open',
+        meta: { name: runtime.containerName }
+    });
+
     // 使用数组参数执行命令（安全方式）
     try {
         const args = buildDockerRunArgs(runtime);
@@ -2100,12 +2131,16 @@ async function createNewContainer(runtime) {
         showImagePullHint(e);
         // 失败的 run 可能留下 Created 状态的容器；这个名字创建前不存在，所以只清理本次留下的这一个
         try { dockerExecArgs(['rm', '-f', runtime.containerName], { stdio: 'pipe' }); } catch (cleanupError) { /* 尽力清理 */ }
+        containerState.removeState(os.homedir(), runtime.state.id);
         throw explainCreateFailure(e);
     }
 
     // Wait for container to be ready
     await waitForContainerReady(runtime.containerName);
 
+    // 先下发网络规则再做任何 exec；失败即关闭（容器留着，init 在等门闩，不会跑自启动）
+    await networkManager.apply(runtime.containerName, { expectId: runtime.state.id });
+
     applyAptMirror({
         dockerExecArgs,
         containerName: runtime.containerName,
@@ -2123,8 +2158,26 @@ async function createNewContainer(runtime) {
  * 构建 Docker run 命令参数数组（安全方式，避免命令注入）
  * @returns {string[]} 命令参数数组
  */
+// 容器网络规则的下发器：CLI 与 serve 各建一份，helper 容器用当前 imageVersion 的官方镜像
+function createCliNetworkManager(runtime) {
+    return createNetworkManager({
+        command: DOCKER_CMD,
+        env: DOCKER_ENV,
+        homeDir: os.homedir(),
+        imageRef: () => `${runtime.imageName}:${runtime.imageVersion}`,
+        getMirrorUrls: () => Object.values(runtime.mirrors || {}).filter(Boolean)
+    });
+}
+
+function previewContainerState() {
+    const dir = path.join(os.homedir(), '.manyoyo', 'containers', '<id>');
+    return { id: '<id>', box: path.join(dir, 'box'), sys: path.join(dir, 'sys') };
+}
+
 function buildDockerRunArgs(runtime) {
     return buildContainerRunArgs({
+        state: runtime.state,
+        defaultNetwork: NETWORK_NAME,
         containerName: runtime.containerName,
         hostPath: runtime.hostPath,
         containerPath: runtime.containerPath,
@@ -2159,6 +2212,7 @@ async function connectExistingContainer(runtime) {
     if (status !== 'running') {
         dockerExecArgs(['start', runtime.containerName], { stdio: 'pipe' });
     }
+    await createCliNetworkManager(runtime).ensureReady(runtime.containerName);
 
     // Get default command from label
     const defaultCommand = dockerExecArgs(['inspect', '-f', '{{index .Config.Labels "manyoyo.default_cmd"}}', runtime.containerName]).trim();
@@ -2183,6 +2237,8 @@ async function setupContainer(runtime) {
             process.exit(0);
         }
         runtime.execCommand = joinExecCommand(runtime.execCommandPrefix, runtime.execCommand, runtime.execCommandSuffix);
+        runtime.containerEnvs = containerState.stripEnvKeys(runtime.containerEnvs, new Set(containerState.userEnvLines(runtime.containerEnvs).map(containerState.envLineKey)));
+        runtime.state = previewContainerState();
         console.log(buildDockerRunCmd(runtime));
         process.exit(0);
     }
@@ -2193,7 +2249,7 @@ async function setupContainer(runtime) {
     }
 }
 
-function executeInContainer(runtime, defaultCommand) {
+async function executeInContainer(runtime, defaultCommand) {
     if (!containerExists(runtime.containerName)) {
         throw new Error(`未找到容器: ${runtime.containerName}`);
     }
@@ -2202,6 +2258,7 @@ function executeInContainer(runtime, defaultCommand) {
     if (status !== 'running') {
         dockerExecArgs(['start', runtime.containerName], { stdio: 'pipe' });
     }
+    await createCliNetworkManager(runtime).ensureReady(runtime.containerName);
 
     getHelloTip(runtime.containerName, defaultCommand, runtime.execCommand);
     if (!(runtime.quiet.cmd || runtime.quiet.full)) {
@@ -2210,10 +2267,15 @@ function executeInContainer(runtime, defaultCommand) {
     }
 
     // Execute command in container
-    if (runtime.execCommand) {
-        spawnSync(`${DOCKER_CMD}`, ['exec', '-it', runtime.containerName, '/bin/bash', '-c', runtime.execCommand], { stdio: 'inherit', env: DOCKER_ENV });
-    } else {
-        spawnSync(`${DOCKER_CMD}`, ['exec', '-it', runtime.containerName, '/bin/bash'], { stdio: 'inherit', env: DOCKER_ENV });
+    const exec = buildExecArgs({ homeDir: os.homedir(), dockerExecArgs }, runtime.containerName, {
+        interactive: true,
+        tty: true,
+        command: runtime.execCommand ? ['/bin/bash', '-c', runtime.execCommand] : ['/bin/bash']
+    });
+    try {
+        spawnSync(`${DOCKER_CMD}`, exec.args, { stdio: 'inherit', env: DOCKER_ENV });
+    } finally {
+        exec.cleanup();
     }
 }
 
@@ -2458,6 +2520,7 @@ async function runWebServerMode(runtime) {
         contModeArgs: runtime.contModeArgs,
         containerExtraArgs: runtime.containerExtraArgs,
         containerEnvs: runtime.containerEnvs,
+        envFiles: runtime.envFiles,
         containerVolumes: runtime.containerVolumes,
         containerPorts: runtime.containerPorts,
         validateHostPath: value => validateHostPathOrThrow(value),
@@ -2574,7 +2637,7 @@ async function main() {
         // 7-8. Execute command and handle post-exit interactions
         let shouldContinue = true;
         while (shouldContinue) {
-            executeInContainer(runtime, defaultCommand);
+            await executeInContainer(runtime, defaultCommand);
             shouldContinue = await handlePostExit(runtime, defaultCommand);
         }
 

package/docker/manyoyo.Dockerfile

@@ -114,7 +114,7 @@ RUN <<EOX
     # Python
     apt-get -o Acquire::https::Verify-Peer=false update -y
     apt-get -o Acquire::https::Verify-Peer=false install -y --no-install-recommends \
-        ca-certificates openssl curl wget net-tools iputils-ping dnsutils socat ncat ssh \
+        ca-certificates openssl curl wget net-tools iputils-ping dnsutils socat ncat ssh nftables \
         git gh g++ make sqlite3 \
         procps psmisc lsof supervisor \
         nano jq file tree ripgrep less bc xxd tar zip unzip gzip \
@@ -230,18 +230,47 @@ RUN <<EOX
         cp /tmp/docker-res/opencode/opencode.json ~/.config/opencode/opencode.json
     ;; esac
 
-    # 安装 Playwright CLI skills 与 chromium 浏览器
+    # 安装 Playwright CLI skills、patchright-core 与 Google Chrome
     PLAYWRIGHT_CLI_INSTALL_DIR=/tmp/playwright-cli-install
     mkdir -p "$PLAYWRIGHT_CLI_INSTALL_DIR/.playwright"
     cd "$PLAYWRIGHT_CLI_INSTALL_DIR"
-    PLAYWRIGHT_CLI_VERSION=$(node -p "const pkg = require('/tmp/manyoyo-package.json'); const value = String(pkg.playwrightCliVersion || '').trim(); if (!value) { throw new Error('package.json.playwrightCliVersion is required'); } value")
+    pkg_field() { node -p "const pkg = require('/tmp/manyoyo-package.json'); const value = String(pkg.$1 || '').trim(); if (!value) { throw new Error('package.json.$1 is required'); } value"; }
+    PLAYWRIGHT_CLI_VERSION=$(pkg_field playwrightCliVersion)
+    PATCHRIGHT_CORE_VERSION=$(pkg_field patchrightCoreVersion)
+    PATCHRIGHT_CORE_INTEGRITY=$(pkg_field patchrightCoreIntegrity)
     npm install -g "@playwright/cli@${PLAYWRIGHT_CLI_VERSION}"
-    # 浏览器与系统依赖都用 @playwright/cli 自带的 playwright-core 安装；
+    # 把 @playwright/cli 自带的 playwright-core 换成 patchright-core（开源补丁版，可从源码逐字节复现）：
+    # 官方版会在页面与 Worker 里启用 CDP Runtime 域，被检测站点识别；patchright 去掉了这一痕迹。
+    # 两者必须同 minor（容器内 client 与宿主机 launchServer 要求 minor 完全一致），并以 package.json 里的 integrity 校验，不一致就中止构建
+    CLI_DIR="$(npm root -g)/@playwright/cli"
+    CLI_CORE_VERSION=$(node -p "require('$CLI_DIR/node_modules/playwright-core/package.json').version")
+    [ "${CLI_CORE_VERSION%.*}" = "${PATCHRIGHT_CORE_VERSION%.*}" ] || { echo "playwright-core ${CLI_CORE_VERSION} 与 patchright-core ${PATCHRIGHT_CORE_VERSION} minor 不一致" >&2; exit 1; }
+    npm pack "patchright-core@${PATCHRIGHT_CORE_VERSION}" --silent >/dev/null
+    PATCHRIGHT_TARBALL="patchright-core-${PATCHRIGHT_CORE_VERSION}.tgz"
+    [ "sha512-$(openssl dgst -sha512 -binary "$PATCHRIGHT_TARBALL" | openssl base64 -A)" = "$PATCHRIGHT_CORE_INTEGRITY" ] || { echo "patchright-core 完整性校验失败" >&2; exit 1; }
+    for core in $(find "$CLI_DIR" -type d -name playwright-core -path '*/node_modules/playwright-core'); do
+        rm -rf "$core"
+        mkdir -p "$core"
+        tar -xzf "$PATCHRIGHT_TARBALL" -C "$core" --strip-components=1
+        # patchright 的客户端默认在隔离世界执行 evaluate（页面读不到 Agent 的变量，Agent 也读不到页面自己定义的全局变量），
+        # 对 Agent 毫无用处；把客户端 evaluate / $eval 等 12 处默认值改回主世界（与官方 Playwright 行为一致）。
+        # 在 integrity 校验之后做，次数对不上就中止（升级 patchright 时必须人工复核）；实测不影响 dabi / rebrowser 等检测
+        ISOLATED_DEFAULTS=12
+        [ "$(grep -o 'isolatedContext = true' "$core/lib/coreBundle.js" | wc -l)" = "$ISOLATED_DEFAULTS" ] || { echo "patchright-core 里 isolatedContext 默认值数量不是 ${ISOLATED_DEFAULTS}，请人工复核" >&2; exit 1; }
+        sed -i 's/isolatedContext = true/isolatedContext = false/g' "$core/lib/coreBundle.js"
+    done
     # 默认在 Xvfb 虚拟屏（配轻量窗口管理器）里跑有头浏览器，所以装 xvfb、fluxbox 与常见字体；x11vnc / noVNC 供 playwright vnc 模式使用
-    PLAYWRIGHT_CORE_CLI="$(npm root -g)/@playwright/cli/node_modules/playwright-core/cli.js"
-    node "$PLAYWRIGHT_CORE_CLI" install-deps chromium
-    apt-get install -y --no-install-recommends xvfb fluxbox x11vnc novnc websockify fonts-noto-cjk fonts-noto-color-emoji fonts-liberation
-    node "$PLAYWRIGHT_CORE_CLI" install --no-shell chromium
+    apt-get update
+    apt-get install -y --no-install-recommends xvfb fluxbox x11vnc novnc websockify fonts-noto-cjk fonts-noto-color-emoji fonts-liberation gpg
+    # Google Chrome stable：官方 apt 源（amd64 / arm64 都有），固定签名密钥指纹，apt 再校验 Release 签名
+    curl -fsSL https://dl.google.com/linux/linux_signing_key.pub -o /tmp/google-linux-signing-key.pub
+    [ "$(gpg --show-keys --with-colons /tmp/google-linux-signing-key.pub | awk -F: '/^fpr/{print $10; exit}')" = "EB4C1BFD4F042F6DDDCCEC917721F63BD38B4796" ] || { echo "Google 签名密钥指纹不符" >&2; exit 1; }
+    gpg --dearmor < /tmp/google-linux-signing-key.pub > /usr/share/keyrings/google-chrome.gpg
+    echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/google-chrome.gpg] https://dl.google.com/linux/chrome/deb/ stable main" > /etc/apt/sources.list.d/google-chrome.list
+    apt-get update
+    apt-get install -y --no-install-recommends google-chrome-stable
+    rm -f /etc/apt/sources.list.d/google-chrome.list /etc/cron.daily/google-chrome
+    google-chrome --version
     playwright-cli install --skills
     PLAYWRIGHT_CLI_SKILL_SOURCE="$PLAYWRIGHT_CLI_INSTALL_DIR/.claude/skills/playwright-cli"
     for target in ~/.claude/skills/playwright-cli ~/.codex/skills/playwright-cli ~/.gemini/skills/playwright-cli; do
@@ -261,8 +290,12 @@ EOX
 # Playwright 默认配置（挂载宿主机目录时会被覆盖，路径固定）与按需启动 Xvfb 的 playwright-cli 包装
 COPY ./docker/res/playwright/browser.json /run/manyoyo-playwright/config.json
 COPY ./docker/res/playwright/stealth.init.js /run/manyoyo-playwright/stealth.init.js
+COPY ./docker/res/playwright/env /run/manyoyo-playwright/env
 COPY --chmod=755 ./docker/res/playwright/playwright-cli.sh /usr/local/sbin/playwright-cli
 RUN ln -s playwright-cli /usr/local/sbin/playwright-mcp
+# Chrome 154 起，不安全页面（http://host.containers.internal 这类宿主机别名）不能向 local 地址空间发请求（含同源 fetch），
+# 会让 Agent 测试宿主机上的本地网页时 fetch 失败（旧的 Chromium 没有这个限制）；这条企业策略关闭该检查，只在容器内的 Chrome 生效
+COPY ./docker/res/playwright/chrome-policy.json /etc/opt/chrome/policies/managed/local-network.json
 
 # 从 cache-stage 复制 JDT LSP 到最终位置，避免中转层残留
 COPY --from=cache-stage /opt/jdtls /root/.local/share/jdtls

package/docker/res/agent/update-agents.sh

@@ -32,7 +32,7 @@ echo "[manyoyo] Agent CLI versions before update:"
 print_agent_versions
 
 if [ "${#update_packages[@]}" -gt 0 ]; then
-    npm_config_update_notifier=false npm install -g npm@latest "${update_packages[@]}" @playwright/cli@latest
+    npm_config_update_notifier=false npm install -g npm@latest "${update_packages[@]}"
     npm config set allow-scripts=@anthropic-ai/claude-code,@openai/codex,@google/gemini-cli,opencode-ai,@playwright/cli,pyright,typescript-language-server,typescript --location=user
 else
     echo "[manyoyo] No existing Agent CLI found; skip npm install."

package/docker/res/playwright/browser.json

@@ -1,27 +1,24 @@
 {
     "outputDir": "/tmp/.playwright-cli",
     "browser": {
-        "chromiumSandbox": false,
         "browserName": "chromium",
+        "contextOptions": {
+            "viewport": null
+        },
         "initScript": [
             "/run/manyoyo-playwright/stealth.init.js"
         ],
-        "contextOptions": {
-            "locale": "en-US",
-            "timezoneId": "UTC",
-            "viewport": null,
-            "extraHTTPHeaders": {
-                "Accept-Language": "en-US,en;q=0.9"
-            }
-        },
         "launchOptions": {
-            "channel": "chromium",
+            "channel": "chrome",
+            "chromiumSandbox": false,
             "headless": false,
             "args": [
                 "--lang=en-US",
-                "--window-size=1920,1080",
+                "--window-size=1920,1058",
+                "--window-position=0,0",
                 "--disable-blink-features=AutomationControlled",
-                "--force-webrtc-ip-handling-policy=disable_non_proxied_udp"
+                "--force-webrtc-ip-handling-policy=disable_non_proxied_udp",
+                "--disable-webrtc"
             ]
         }
     }

package/docker/res/playwright/chrome-policy.json

@@ -0,0 +1,3 @@
+{
+    "LocalNetworkAccessRestrictionsTemporaryOptOut": true
+}

package/docker/res/playwright/env

@@ -0,0 +1,3 @@
+export TZ='UTC'
+export LANG='en_US.UTF-8'
+export LANGUAGE='en_US:en'

package/docker/res/playwright/playwright-cli.sh

@@ -3,6 +3,11 @@
 # 以 playwright-cli 名字调用时交给 @playwright/cli；以 playwright-mcp 名字调用时启动 stdio MCP（读同一份 $PLAYWRIGHT_MCP_CONFIG）。
 export DISPLAY=:99
 CONFIG="${PLAYWRIGHT_MCP_CONFIG:-/run/manyoyo-playwright/config.json}"
+# 语言与时区用进程环境变量（TZ / LANG / LANGUAGE）原生提供，页面与 Worker 才一致；由宿主机生成，与 config.json 同目录
+ENV_FILE="$(dirname "$CONFIG")/env"
+if [ -r "$ENV_FILE" ]; then
+    . "$ENV_FILE"
+fi
 # 浏览器在容器外（headed / chrome / vnc）时不需要虚拟屏
 if ! grep -qE '"(remoteEndpoint|cdpEndpoint)"' "$CONFIG" 2>/dev/null; then
     # 以锁文件里的进程是否活着为准；容器被 kill 后遗留的 socket 与锁文件要清掉

package/docker/res/playwright/stealth.init.js

@@ -1,14 +1,16 @@
 'use strict';
 (function () {
     try {
-        const toolbar = 87;
-        const patch = (name, fallback, getter) => {
-            const original = Object.getOwnPropertyDescriptor(window, name);
-            if (!original || !original.get) return;
-            const real = original.get;
-            Object.defineProperty(window, name, { ...original, get: getter(function () { const value = real.call(this); return value === 0 ? fallback() : value; }) });
-        };
-        patch('outerWidth', () => window.innerWidth, fn => Object.getOwnPropertyDescriptor({ get outerWidth() { return fn.call(this); } }, 'outerWidth').get);
-        patch('outerHeight', () => window.innerHeight + toolbar, fn => Object.getOwnPropertyDescriptor({ get outerHeight() { return fn.call(this); } }, 'outerHeight').get);
+        const blocked = ['RTCPeerConnection', 'webkitRTCPeerConnection', 'RTCIceCandidate', 'RTCRtpSender', 'RTCRtpReceiver', 'RTCRtpTransceiver', 'RTCDataChannel'];
+        for (const name of blocked) {
+            Object.defineProperty(globalThis, name, { configurable: true, writable: true, value: undefined });
+        }
+        if (navigator.mediaDevices) {
+            Object.defineProperty(navigator.mediaDevices, 'getUserMedia', {
+                configurable: true,
+                writable: true,
+                value: async () => { throw new DOMException('WebRTC is disabled', 'NotAllowedError'); }
+            });
+        }
     } catch (_) {}
 })();

package/lib/browser-background.js

@@ -0,0 +1,23 @@
+'use strict';
+
+const { domainAllowed } = require('./network-policy');
+
+// 容器里的 Chrome 启动后会自己连一些谷歌的后台服务（更新、账号同步、字体 / 资源）。白名单下它们必然被拦，
+// 对用户没有意义：网络分区的“最近被拦截”把它们折叠成“浏览器后台请求”，对话里也不为它们提示。
+// 数据只写在这一处。
+const BROWSER_BACKGROUND_DOMAINS = [
+    'accounts.google.com',
+    'update.googleapis.com',
+    'www.google.com',
+    'www.gstatic.com',
+    'dl.google.com',
+    'clients2.google.com',
+    'android.clients.google.com',
+    'content-autofill.googleapis.com'
+];
+
+function isBrowserBackground(host) {
+    return domainAllowed(BROWSER_BACKGROUND_DOMAINS, host);
+}
+
+module.exports = { BROWSER_BACKGROUND_DOMAINS, isBrowserBackground };

package/lib/container-env.sh

@@ -0,0 +1,34 @@
+# manyoyo 容器内的 env 加载：init.sh 启动自启动前加载，终端里的 `reload-env` 也用它。
+# 由宿主机以只读目录挂到 /run/manyoyo-sys/env.sh，容器内不可改。
+# 与宿主机侧（lib/env-text.js）同一语法：一行 KEY=VALUE，# 注释与空行忽略，可选 `export ` 前缀与 `=` 两侧空白，
+# 值两端成对的引号去掉；不展开变量、不执行命令；key 必须合法
+load_env() {
+    local file=$1 line key val
+    [ -f "$file" ] || return 0
+    while IFS= read -r line || [ -n "$line" ]; do
+        line=${line%$'\r'}
+        line="${line#"${line%%[![:space:]]*}"}"
+        line="${line%"${line##*[![:space:]]}"}"
+        case $line in ''|'#'*) continue ;; esac
+        if [[ $line =~ ^export[[:space:]]+ ]]; then line=${line#"${BASH_REMATCH[0]}"}; fi
+        [[ $line =~ ^([^=[:space:]]+)[[:space:]]*=[[:space:]]*(.*)$ ]] || continue
+        key=${BASH_REMATCH[1]}
+        val=${BASH_REMATCH[2]}
+        [[ $key =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || continue
+        if [ "${#val}" -ge 2 ]; then
+            case $val in
+                \"*\") val=${val:1:${#val}-2} ;;
+                \'*\') val=${val:1:${#val}-2} ;;
+            esac
+        fi
+        export "$key=$val"
+    done < "$file"
+}
+
+# 已打开的终端里让最新的环境变量生效（优先级与新开终端一致：managed < 环境变量文件 < 用户 env）
+reload-env() {
+    local sys=${MANYOYO_SYS_DIR:-/run/manyoyo-sys} box=${MANYOYO_BOX_DIR:-/run/manyoyo}
+    load_env "$sys/managed.env"
+    load_env "$sys/files.env"
+    load_env "$box/env"
+}