@xcanwin/manyoyo 8.3.3 → 8.5.0

package/lib/web/server.js

@@ -9,9 +9,23 @@ const { consumeLoginToken, isLoopbackHost } = require('../login-token');
 const http = require('http');
 const WebSocket = require('ws');
 const JSON5 = require('json5');
-const { buildContainerRunArgs } = require('../container-run');
+const { buildContainerRunArgs, hasNetworkArg } = require('../container-run');
 const { buildContainerIntegration, mergeIntegration } = require('../plugin');
 const { applyAptMirror } = require('../mirrors');
+const containerState = require('../container-state');
+const { buildExecArgs, resolveContainerId } = require('../container-exec');
+const { createNetworkManager, NETWORK_NAME } = require('../container-network');
+const { normalizePolicy } = require('../network-policy');
+const { withEnvEndpoints } = require('../network-endpoints');
+const { egressPaths, isSidecarName } = require('../egress-sidecar');
+const { read: readDenied } = require('../egress-denied');
+const { isBrowserBackground } = require('../browser-background');
+const { createDeniedNotifier } = require('./denied-notify');
+const { domainAllowed } = require('../network-policy');
+const { createPortForwarder } = require('../port-forward');
+const { createContainerManageRoutes, pendingRisks } = require('./container-manage');
+const { resolveManageOptions } = require('../container-manage-options');
+const { defaultPolicy } = require('../network-policy');
 const { normalizeMirrors } = require('../runtime-normalizers');
 const { estimateContainerCapacity } = require('../capacity');
 const { extractAgentMessageFromCodexJsonl } = require('../codex-output');
@@ -1188,6 +1202,21 @@ function accumulateUsageTotal(baseline, turnUsage) {
     };
 }
 
+// 所有进用户容器的 exec 都经这里：env 从状态目录现读（见 lib/container-exec.js），子进程结束后删临时 env 文件
+function spawnContainerExec(ctx, containerName, execOptions, spawnOptions) {
+    const exec = buildExecArgs({ homeDir: ctx.homeDir || os.homedir(), dockerExecArgs: ctx.dockerExecArgs }, containerName, execOptions);
+    let child;
+    try {
+        child = spawn(ctx.dockerCmd, exec.args, { ...spawnOptions, env: ctx.dockerEnv });
+    } catch (e) {
+        exec.cleanup();
+        throw e;
+    }
+    child.once('close', exec.cleanup);
+    child.once('error', exec.cleanup);
+    return child;
+}
+
 // 起一个短命的容器内子进程，通过对应协议问一次元信息（初始化握手 / model 列表），拿到结果就杀掉进程——
 // 不是长驻会话，不会产生真实对话轮次或费用。
 function runAgentProtocolProcess(ctx, containerName, command, options = {}) {
@@ -1200,7 +1229,7 @@ function runAgentProtocolProcess(ctx, containerName, command, options = {}) {
         let stdoutAll = '';
         let child;
         try {
-            child = spawn(ctx.dockerCmd, ['exec', '-i', containerName, '/bin/bash', '-lc', command], { stdio: ['pipe', 'pipe', 'pipe'], env: ctx.dockerEnv });
+            child = spawnContainerExec(ctx, containerName, { interactive: true, command: ['/bin/bash', '-lc', command] }, { stdio: ['pipe', 'pipe', 'pipe'] });
         } catch (e) {
             resolve({ result: null, stdout: '' });
             return;
@@ -2493,40 +2522,16 @@ function normalizeStringArray(value, sourceLabel) {
         .filter(Boolean);
 }
 
-function parseEnvFileToArgs(filePath) {
+// 环境变量文件：只解析路径并检查存在，内容每次 exec 现读（见 lib/container-state.js 的 readEnvFiles）
+function resolveEnvFilePath(filePath) {
     const resolvedPath = expandHomeAliasPath(filePath);
     if (!path.isAbsolute(resolvedPath)) {
-        throw new Error(`envFile 仅支持绝对路径: ${filePath}`);
+        throw new Error(`环境变量文件仅支持绝对路径: ${filePath}`);
     }
     if (!fs.existsSync(resolvedPath)) {
-        throw new Error(`未找到环境文件: ${resolvedPath}`);
+        throw new Error(`未找到环境变量文件: ${resolvedPath}`);
     }
-
-    const content = fs.readFileSync(resolvedPath, 'utf-8');
-    const args = [];
-    const lines = content.split('\n');
-
-    for (let line of lines) {
-        const match = line.match(/^(?:export\s+)?([a-zA-Z_][a-zA-Z0-9_]*)\s*=\s*(.*)$/);
-        if (!match) {
-            continue;
-        }
-
-        const key = match[1];
-        let value = match[2].trim();
-        if (/[\r\n\0]/.test(value)) continue;
-        if (/[\$\(\)\`\|\&\*\{\};<>]/.test(value)) continue;
-        if (/^\(/.test(value)) continue;
-
-        if (/^"(.*)"$/.test(value)) {
-            value = value.slice(1, -1);
-        } else if (/^'(.*)'$/.test(value)) {
-            value = value.slice(1, -1);
-        }
-        args.push('--env', `${key}=${value}`);
-    }
-
-    return args;
+    return resolvedPath;
 }
 
 function resolveContainerModeArgs(mode) {
@@ -2693,7 +2698,7 @@ function buildConfigDefaults(ctx, config) {
     const defaults = {
         containerName: hasOwn(parsed, 'containerName') ? String(parsed.containerName || '') : '',
         hostPath: sanitizeDefaultHostPath(pickFirstString(parsed.hostPath, ctx.hostPath)),
-        containerPath: pickFirstString(parsed.containerPath, ctx.containerPath),
+        containerPath: pickFirstString(parsed.containerPath),
         imageName: pickFirstString(parsed.imageName, ctx.imageName),
         imageVersion: pickFirstString(parsed.imageVersion, ctx.imageVersion),
         containerMode: hasOwn(parsed, 'containerMode') ? String(parsed.containerMode || '') : '',
@@ -2747,6 +2752,7 @@ function buildStaticContainerRuntime(ctx, containerName) {
         contModeArgs: Array.isArray(ctx.contModeArgs) ? ctx.contModeArgs.slice() : [],
         containerExtraArgs: Array.isArray(ctx.containerExtraArgs) ? ctx.containerExtraArgs.slice() : [],
         containerEnvs: Array.isArray(ctx.containerEnvs) ? ctx.containerEnvs.slice() : [],
+        envFiles: Array.isArray(ctx.envFiles) ? ctx.envFiles.slice() : [],
         containerVolumes: Array.isArray(ctx.containerVolumes) ? ctx.containerVolumes.slice() : [],
         containerPorts: Array.isArray(ctx.containerPorts) ? ctx.containerPorts.slice() : [],
         defaultCommand: buildDefaultCommand(ctx.execCommandPrefix, ctx.execCommand, ctx.execCommandSuffix) || '/bin/bash'
@@ -2797,7 +2803,9 @@ function buildCreateRuntime(ctx, state, payload) {
         defaults: {
             hostPath: ctx.hostPath,
             containerName: `my-${ctx.formatDate()}`,
-            containerPath: ctx.containerPath,
+            // 不用 ctx.containerPath：那是 serve 进程的启动目录（CLI 的 cwd 语义），与用户要挂载的目录无关；
+            // 没配置也没传时落到下面的 `|| hostPath`，容器内路径与宿主机路径一致
+            containerPath: '',
             imageName: ctx.imageName,
             imageVersion: ctx.imageVersion
         },
@@ -2818,6 +2826,12 @@ function buildCreateRuntime(ctx, state, payload) {
         parseServerListen: () => ({ host: '', port: 0 })
     });
 
+    // 自启动与网络：请求 > runs.<name> > 全局配置；请求里放开限制（open / 非本机绑定）要带 confirmRisk
+    const manage = resolveManageOptions({ requestOptions, runConfig, globalConfig: config });
+    if (manage.fromRequest && requestOptions.confirmRisk !== true && pendingRisks(defaultPolicy(), manage.network).length) {
+        throw new Error('该网络设置会放开限制（open 预设或绑定非本机地址），需要确认（confirmRisk）');
+    }
+
     const containerName = resolvedBase.containerName;
     validateContainerNameStrict(containerName);
 
@@ -2886,6 +2900,7 @@ function buildCreateRuntime(ctx, state, payload) {
     const resumeSupported = Boolean(buildAgentResumeCommand(agentProgram));
 
     let containerEnvs = Array.isArray(ctx.containerEnvs) ? ctx.containerEnvs.slice() : [];
+    let envFiles = Array.isArray(ctx.envFiles) ? ctx.envFiles.slice() : [];
     const hasRunEnv = hasOwn(runConfig, 'env');
     const hasRunEnvFile = hasOwn(runConfig, 'envFile');
     if (hasRequestEnv || hasRequestEnvFile || hasRunEnv || hasRunEnvFile || hasConfigEnv || hasConfigEnvFile) {
@@ -2896,13 +2911,8 @@ function buildCreateRuntime(ctx, state, payload) {
             envArgs.push('--env', `${parsed.key}=${parsed.value}`);
         });
 
-        const envFileList = resolvedBase.envFile;
-        const envFileArgs = [];
-        envFileList.forEach(filePath => {
-            envFileArgs.push(...parseEnvFileToArgs(filePath));
-        });
-
-        containerEnvs = [...envArgs, ...envFileArgs];
+        containerEnvs = envArgs;
+        envFiles = resolvedBase.envFile.map(resolveEnvFilePath);
     }
 
     let containerVolumes = Array.isArray(ctx.containerVolumes) ? ctx.containerVolumes.slice() : [];
@@ -2934,8 +2944,11 @@ function buildCreateRuntime(ctx, state, payload) {
         contModeArgs,
         containerExtraArgs: Array.isArray(ctx.containerExtraArgs) ? ctx.containerExtraArgs.slice() : [],
         containerEnvs,
+        envFiles,
         containerVolumes,
         containerPorts,
+        autostart: manage.autostart,
+        network: manage.network,
         agentPromptCommand,
         defaultCommand: buildDefaultCommand(shellPrefix, shell, shellSuffix) || '/bin/bash',
         // 仅供服务端内部复用（如"创建相同配置容器"/"复制容器"），绝不能透传给任何对外响应字段，
@@ -2954,7 +2967,10 @@ function buildCreateRuntime(ctx, state, payload) {
             env: resolvedBase.env || {},
             envFile: resolvedBase.envFile || [],
             volumes: resolvedBase.volumes || [],
-            ports: resolvedBase.ports || []
+            ports: resolvedBase.ports || [],
+            autostart: manage.autostart,
+            // 复制容器时端口暴露（宿主机端口会冲突）与 peers（按 id 引用别的容器）不带过去
+            network: { ...manage.network, expose: [], peers: { inbound: [] } }
         },
         applied: {
             containerName,
@@ -2972,6 +2988,8 @@ function buildCreateRuntime(ctx, state, payload) {
             resumeSupported,
             yolo: yolo || '',
             envCount: Math.floor(containerEnvs.length / 2),
+            autostartEnabled: Boolean(manage.autostart.trim()),
+            networkPreset: manage.network.preset,
             volumeCount: Math.floor(containerVolumes.length / 2),
             portCount: Math.floor(containerPorts.length / 2)
         }
@@ -3015,7 +3033,11 @@ function buildCloneCreateOptionsFromSnapshot(runtimeSnapshot, fallbackHistory) {
             env: runtimeSnapshot.env || {},
             envFile: runtimeSnapshot.envFile || [],
             volumes: runtimeSnapshot.volumes || [],
-            ports: runtimeSnapshot.ports || []
+            ports: runtimeSnapshot.ports || [],
+            autostart: runtimeSnapshot.autostart || '',
+            network: runtimeSnapshot.network || undefined,
+            // 快照来自服务端、原容器创建时已确认过，复制不必再确认
+            confirmRisk: runtimeSnapshot.network ? true : undefined
         };
     }
 
@@ -3138,7 +3160,7 @@ function listWebManyoyoContainers(ctx) {
     const candidates = [];
     output.trim().split('\n').forEach(line => {
         const [name, status, image] = line.split('\t');
-        if (!ctx.isValidContainerName(name)) {
+        if (!ctx.isValidContainerName(name) || isSidecarName(name)) {
             return;
         }
         const imageName = image || '';
@@ -3295,13 +3317,114 @@ async function cleanupStaleSetupTestContainers(ctx) {
         const names = String(listed || '').split('\n').map(line => line.trim())
             .filter(name => name.startsWith(SETUP_TEST_CONTAINER_PREFIX) && /^[A-Za-z0-9_.-]+$/.test(name));
         for (const name of names) {
+            const stateId = String(await ctx.dockerExecAsync(
+                ['inspect', '-f', '{{index .Config.Labels "manyoyo.id"}}', name], { timeout: 10000 }
+            ).catch(() => '') || '').trim();
             await ctx.dockerExecAsync(['rm', '-f', name], { timeout: 20000 }).catch(() => {});
+            if (stateId) containerState.removeState(ctx.homeDir || os.homedir(), stateId);
         }
     } catch (e) {
         ctx.logger.warn('cleanup stale setup test containers failed', { message: e && e.message });
     }
 }
 
+// Agent 一轮对话里，容器被过滤代理拦下的新域名（浏览器后台请求不算）：只在 allowlist 容器上轮询
+function createWebDeniedNotifier(ctx, sessionRef, emit) {
+    try {
+        const homeDir = ctx.homeDir || os.homedir();
+        const id = resolveContainerId(ctx.dockerExecArgs, sessionRef.containerName);
+        if (!id || !containerState.stateExists(homeDir, id)) return null;
+        const deniedDir = egressPaths(homeDir).denied;
+        const policyOf = () => normalizePolicy(containerState.readNetworkRaw(homeDir, id) || undefined);
+        if (policyOf().preset !== 'allowlist') return null;
+        return createDeniedNotifier({
+            read: () => readDenied(deniedDir, id),
+            isIgnored: host => isBrowserBackground(host) || domainAllowed(policyOf().egress.domains, host),
+            emit
+        });
+    } catch (e) {
+        return null;
+    }
+}
+
+function getWebPortForwarder(ctx, state) {
+    if (!state.portForwarder) {
+        const homeDir = ctx.homeDir || os.homedir();
+        state.portForwarder = createPortForwarder({
+            command: ctx.dockerCmd,
+            env: ctx.dockerEnv,
+            homeDir,
+            // id → 当前容器名：只信运行时里真实存在的（serve 启动时与接口调用时登记），meta.json 里的旧名字可能已被同名新容器占用
+            resolveName: id => (state.containerNames && state.containerNames.get(id)) || '',
+            warn: message => ctx.logger.warn(message)
+        });
+    }
+    return state.portForwarder;
+}
+
+// 运行时就绪后的容器服务：规则对账 + start 事件订阅（外部重启后补下发）、serve 启动时拉起标记了“自动拉起”的容器、
+// 恢复端口暴露。没有 watchStarts 的替身管理器（单测）不启动任何后台服务。
+async function startContainerServices(ctx, state) {
+    const manager = getWebNetworkManager(ctx, state);
+    const homeDir = ctx.homeDir || os.homedir();
+    sweepStaleExecEnvFiles(homeDir);
+    const reconcile = () => reconcileContainerServices(ctx, state, manager);
+    state.networkWatch = manager.watchStarts({ onReconnect: reconcile });
+    await reconcile();
+}
+
+// 拉起 autostartOnServe 的容器并恢复端口暴露：serve 启动时做一次，运行时重启后（事件流重连）再做一次，幂等
+async function reconcileContainerServices(ctx, state, manager) {
+    const homeDir = ctx.homeDir || os.homedir();
+    const forwarder = getWebPortForwarder(ctx, state);
+    // 以运行时里真实存在的容器为准（按 id 对应名字）；状态目录里有、容器却没有的是孤儿，既不拉起也不转发
+    state.containerNames = new Map((await manager.listManaged()).map(item => [item.id, item.name]));
+    for (const id of containerState.listStateIds(homeDir)) {
+        const name = state.containerNames.get(id);
+        if (!name) continue;
+        let policy;
+        try { policy = normalizePolicy(containerState.readNetworkRaw(homeDir, id) || undefined); } catch (e) { continue; }
+        if (policy.autostartOnServe) {
+            try {
+                if (ctx.getContainerStatus(name) !== 'running') await ctx.dockerExecAsync(['start', name], { timeout: 30000 });
+            } catch (e) {
+                ctx.logger.warn('autostart container failed', { name, message: e && e.message });
+            }
+        }
+        if (policy.expose.length) await forwarder.sync(id, policy.expose);
+    }
+}
+
+// serve 异常退出时 exec 的临时 env 文件（明文）可能残留：启动时清掉超过 6 小时的（正在跑的长任务不会这么久还没读完它）
+function sweepStaleExecEnvFiles(homeDir) {
+    const dir = path.join(homeDir, '.manyoyo', 'tmp');
+    try {
+        for (const entry of fs.readdirSync(dir)) {
+            if (!/^(exec|env)-/.test(entry)) continue;
+            const file = path.join(dir, entry);
+            if (Date.now() - fs.statSync(file).mtimeMs > 6 * 3600 * 1000) fs.rmSync(file, { force: true });
+        }
+    } catch (e) { /* 没有目录 */ }
+}
+
+// 运行时就绪后启动 startContainerServices
+function startContainerNetworkWatch(ctx, state) {
+    const manager = getWebNetworkManager(ctx, state);
+    if (typeof manager.watchStarts !== 'function' || state.networkWatch || state.containerServicesStarting) return;
+    state.containerServicesStarting = true;
+    const deadline = Date.now() + 10 * 60 * 1000;
+    const tick = () => {
+        const status = ctx.runtimeState.status;
+        if (status === 'ready') {
+            startContainerServices(ctx, state).catch(e => ctx.logger.warn('container services failed', { message: e && e.message }));
+            return;
+        }
+        if (status === 'failed' || Date.now() > deadline) return;
+        setTimeout(tick, 1000).unref();
+    };
+    tick();
+}
+
 function startStaleSetupCleanup(ctx) {
     const deadline = Date.now() + 10 * 60 * 1000;
     const tick = () => {
@@ -3347,6 +3470,24 @@ async function buildWebPlaywrightIntegration(ctx, state, runtime) {
     return mergeIntegration(runtime, integration);
 }
 
+// serve 进程的网络规则下发器（一份，懒创建）
+function getWebNetworkManager(ctx, state) {
+    if (ctx.networkManager) return ctx.networkManager;
+    if (!state.networkManager) {
+        state.networkManager = createNetworkManager({
+            command: ctx.dockerCmd,
+            env: ctx.dockerEnv,
+            homeDir: ctx.homeDir || os.homedir(),
+            imageRef: () => `${ctx.imageName}:${ctx.imageVersion}`,
+            getMirrorUrls: () => Object.values(readWebMirrors(state)).filter(Boolean),
+            warn: message => ctx.logger.warn(message)
+        });
+    }
+    return state.networkManager;
+}
+
+// 进入容器前一律检查网络规则（宿主机侧的“本次启动已下发”状态）：文件浏览也会 exec /bin/bash -lc，
+// 里面的 .bashrc 等是 Agent 能改的代码，不能在规则缺失的窗口里跑
 async function ensureWebContainer(ctx, state, containerInput, messageSessionRef = null) {
     const runtime = typeof containerInput === 'string'
         ? buildStaticContainerRuntime(ctx, containerInput)
@@ -3358,8 +3499,27 @@ async function ensureWebContainer(ctx, state, containerInput, messageSessionRef
 
     if (!ctx.containerExists(runtime.containerName)) {
         const mirrors = readWebMirrors(state);
+        // 用户 env 不进容器配置，写进状态目录的 box/env，每次 exec 现读（见 lib/container-exec.js）
+        const userEnvLines = containerState.userEnvLines(runtime.containerEnvs);
         const playwright = await buildWebPlaywrightIntegration(ctx, state, runtime);
+        const containerEnvs = containerState.stripEnvKeys(playwright.containerEnvs, new Set(userEnvLines.map(containerState.envLineKey)));
+        const networkPolicy = await withEnvEndpoints(normalizePolicy(runtime.network), [...userEnvLines, ...containerState.readEnvFilePaths(runtime.envFiles || []).flatMap(file => file.entries.map(entry => `${entry.key}=${entry.value}`))]);
+        const networkManager = getWebNetworkManager(ctx, state);
+        if (!hasNetworkArg([...(runtime.contModeArgs || []), ...(playwright.containerExtraArgs || [])])) {
+            await networkManager.ensureBridgeNetwork();
+        }
+        const containerStateInfo = containerState.createState({
+            homeDir: ctx.homeDir || os.homedir(),
+            envLines: userEnvLines,
+            envFiles: runtime.envFiles,
+            autostart: runtime.autostart,
+            network: networkPolicy,
+            netRequired: networkPolicy.preset !== 'open',
+            meta: { name: runtime.containerName }
+        });
         const args = buildContainerRunArgs({
+            state: containerStateInfo,
+            defaultNetwork: NETWORK_NAME,
             mirrors,
             containerName: runtime.containerName,
             hostPath: runtime.hostPath,
@@ -3368,22 +3528,31 @@ async function ensureWebContainer(ctx, state, containerInput, messageSessionRef
             imageVersion: runtime.imageVersion,
             contModeArgs: runtime.contModeArgs,
             containerExtraArgs: playwright.containerExtraArgs,
-            containerEnvs: playwright.containerEnvs,
+            containerEnvs,
             containerVolumes: playwright.containerVolumes,
             containerPorts: runtime.containerPorts,
             defaultCommand: runtime.defaultCommand
         });
 
-        await ensureWebImage(ctx, state, webImageRef(ctx, runtime), { failFast: true });
-
         try {
+            await ensureWebImage(ctx, state, webImageRef(ctx, runtime), { failFast: true });
             ctx.dockerExecArgs(args, { stdio: 'pipe' });
         } catch (e) {
+            containerState.removeState(ctx.homeDir || os.homedir(), containerStateInfo.id);
             ctx.showImagePullHint(e);
             throw e;
         }
 
         await ctx.waitForContainerReady(runtime.containerName, { throwOnFailure: true });
+        // 先下发网络规则再做任何 exec；失败即关闭（抛错，容器留着，init 在等门闩）
+        await networkManager.apply(runtime.containerName, { expectId: containerStateInfo.id });
+        // 创建时填的端口暴露：容器已就绪、规则已下发后立即开始转发；端口被占等失败只警告，网络页里能看到没有生效
+        if (networkPolicy.expose.length) {
+            if (!state.containerNames) state.containerNames = new Map();
+            state.containerNames.set(containerStateInfo.id, runtime.containerName);
+            const failures = await getWebPortForwarder(ctx, state).sync(containerStateInfo.id, networkPolicy.expose);
+            failures.forEach(message => console.warn(message));
+        }
         applyAptMirror({
             dockerExecArgs: ctx.dockerExecArgs,
             containerName: runtime.containerName,
@@ -3409,16 +3578,18 @@ async function ensureWebContainer(ctx, state, containerInput, messageSessionRef
             `容器 ${runtime.containerName} 已启动。`
         );
     }
+    await getWebNetworkManager(ctx, state).ensureReady(runtime.containerName);
 }
 
 async function execCommandInWebContainer(ctx, containerName, command, options = {}) {
     const opts = options && typeof options === 'object' ? options : {};
     const agentProgram = typeof opts.agentProgram === 'string' ? opts.agentProgram : '';
     return await new Promise((resolve, reject) => {
-        const process = spawn(
-            ctx.dockerCmd,
-            ['exec', containerName, '/bin/bash', '-lc', command],
-            { stdio: ['ignore', 'pipe', 'pipe'], env: ctx.dockerEnv }
+        const process = spawnContainerExec(
+            ctx,
+            containerName,
+            { withEnv: opts.withEnv !== false, command: ['/bin/bash', '-lc', command] },
+            { stdio: ['ignore', 'pipe', 'pipe'] }
         );
 
         const MAX_RAW_OUTPUT_CHARS = 32 * 1024 * 1024;
@@ -3483,10 +3654,11 @@ __MANYOYO_NODE__`;
 }
 
 function spawnContainerRawFileStream(ctx, containerName, filePath) {
-    return spawn(
-        ctx.dockerCmd,
-        ['exec', containerName, 'cat', '--', filePath],
-        { stdio: ['ignore', 'pipe', 'pipe'], env: ctx.dockerEnv }
+    return spawnContainerExec(
+        ctx,
+        containerName,
+        { withEnv: false, command: ['cat', '--', filePath] },
+        { stdio: ['ignore', 'pipe', 'pipe'] }
     );
 }
 
@@ -3516,7 +3688,7 @@ function inferFileLanguage(filePath) {
 }
 
 async function execJsonCommandInWebContainer(ctx, containerName, command) {
-    const result = await execCommandInWebContainer(ctx, containerName, command);
+    const result = await execCommandInWebContainer(ctx, containerName, command, { withEnv: false });
     if (result.exitCode !== 0) {
         throw new Error(result.output || '容器命令执行失败');
     }
@@ -3821,10 +3993,11 @@ async function execAgentInWebContainerStream(ctx, state, sessionRefOrContainerNa
         : reserveWebAgentRun(state, sessionRef);
     let process;
     try {
-        process = spawn(
-            ctx.dockerCmd,
-            ['exec', sessionRef.containerName, '/bin/bash', '-lc', command],
-            { stdio: ['ignore', 'pipe', 'pipe'], env: ctx.dockerEnv }
+        process = spawnContainerExec(
+            ctx,
+            sessionRef.containerName,
+            { command: ['/bin/bash', '-lc', command] },
+            { stdio: ['ignore', 'pipe', 'pipe'] }
         );
     } catch (e) {
         // spawn 同步抛错（如 dockerCmd 不存在）时必须释放锁，否则这个容器永远发不出消息
@@ -4184,9 +4357,14 @@ async function runSetupConnectionTest(ctx, state, agent, envMap) {
     const workpath = getSetupWorkpath(state);
     fs.mkdirSync(workpath, { recursive: true });
     const containerName = `manyoyo-setup-test-${crypto.randomBytes(4).toString('hex')}`;
-    const containerEnvs = [];
-    Object.entries(envMap).forEach(([key, value]) => containerEnvs.push('--env', `${key}=${value}`));
+    const testHome = ctx.homeDir || os.homedir();
+    const containerStateInfo = containerState.createState({
+        homeDir: testHome,
+        envLines: Object.entries(envMap).map(([key, value]) => `${key}=${value}`),
+        meta: { name: containerName }
+    });
     const args = buildContainerRunArgs({
+        state: containerStateInfo,
         containerName,
         hostPath: workpath,
         containerPath: '/workspace',
@@ -4194,7 +4372,7 @@ async function runSetupConnectionTest(ctx, state, agent, envMap) {
         imageVersion: ctx.imageVersion,
         contModeArgs: [],
         containerExtraArgs: [],
-        containerEnvs,
+        containerEnvs: [],
         containerVolumes: [],
         containerPorts: [],
         defaultCommand: '/bin/bash'
@@ -4220,6 +4398,7 @@ async function runSetupConnectionTest(ctx, state, agent, envMap) {
         } catch (e) {
             // 容器可能根本没创建成功
         }
+        containerState.removeState(testHome, containerStateInfo.id);
     }
 }
 
@@ -4605,6 +4784,9 @@ function spawnWebTerminalProcess(ctx, containerName, cols, rows) {
         'if [ -f ~/.bashrc ]; then',
         '    . ~/.bashrc',
         'fi',
+        'if [ -f /run/manyoyo-sys/env.sh ]; then',
+        '    . /run/manyoyo-sys/env.sh',
+        'fi',
         'if [ -n "${MANYOYO_TERM_COLS:-}" ] && [ -n "${MANYOYO_TERM_ROWS:-}" ]; then',
         '    COLUMNS="$MANYOYO_TERM_COLS"',
         '    LINES="$MANYOYO_TERM_ROWS"',
@@ -4628,20 +4810,16 @@ function spawnWebTerminalProcess(ctx, containerName, cols, rows) {
 
     const termValue = process.env.TERM && process.env.TERM !== 'dumb' ? process.env.TERM : 'xterm-256color';
     const colorTermValue = process.env.COLORTERM || 'truecolor';
-    const dockerExecArgs = [
-        'exec',
-        '-i',
-        '-e', `TERM=${termValue}`,
-        '-e', `COLORTERM=${colorTermValue}`,
-        '-e', `MANYOYO_TERM_COLS=${String(cols)}`,
-        '-e', `MANYOYO_TERM_ROWS=${String(rows)}`,
-        containerName,
-        '/bin/bash',
-        '-lc',
-        terminalBootstrap
-    ];
-
-    return spawn(ctx.dockerCmd, dockerExecArgs, { stdio: ['pipe', 'pipe', 'pipe'], env: ctx.dockerEnv });
+    return spawnContainerExec(ctx, containerName, {
+        interactive: true,
+        envs: [
+            `TERM=${termValue}`,
+            `COLORTERM=${colorTermValue}`,
+            `MANYOYO_TERM_COLS=${String(cols)}`,
+            `MANYOYO_TERM_ROWS=${String(rows)}`
+        ],
+        command: ['/bin/bash', '-lc', terminalBootstrap]
+    }, { stdio: ['pipe', 'pipe', 'pipe'] });
 }
 
 function bindTerminalWebSocket(ctx, state, ws, containerName, cols, rows) {
@@ -5209,6 +5387,7 @@ async function handleWebApi(req, res, pathname, ctx, state) {
                     ctx.retryRuntimeHeal();
                     if (ctx.autoPullImage) startWebImagePrepare(ctx, state);
                     startStaleSetupCleanup(ctx);
+                    startContainerNetworkWatch(ctx, state);
                 }
                 // 镜像拉取失败的条目会一直挂着：清掉后重新拉
                 if (ctx.runtimeState.status === 'ready' && ctx.autoPullImage) {
@@ -6096,69 +6275,79 @@ async function handleWebApi(req, res, pathname, ctx, state) {
                 });
 
                 let lastPartialPersistAt = 0;
-                try {
-                    const result = await execAgentInWebContainerStream(ctx, state, sessionRef, command, {
-                        agentProgram: agentMeta.agentProgram,
-                        // 复用路由入口占好的那把锁，而不是另起一份运行登记
-                        runState,
-                        onEvent: event => {
-                            // token 级增量：只走网线，不进事件日志，历史落盘按
-                            // AGENT_STREAM_PARTIAL_PERSIST_INTERVAL_MS 节流
-                            const isPartialDelta = event && event.type === 'content_delta' && event.partial === true;
-                            if (event && event.type === 'trace' && event.text) {
-                                traceLines.push(String(event.text));
-                                if (event.traceEvent && typeof event.traceEvent === 'object') {
-                                    traceEvents.push(event.traceEvent);
-                                }
-                                patchWebSessionMessage(state.webHistoryDir, sessionRef, traceMessage && traceMessage.id, {
-                                    content: traceLines.join('\n'),
-                                    traceEvents: traceEvents.slice(),
+                const handleStreamEvent = event => {
+                    // token 级增量：只走网线，不进事件日志，历史落盘按
+                    // AGENT_STREAM_PARTIAL_PERSIST_INTERVAL_MS 节流
+                    const isPartialDelta = event && event.type === 'content_delta' && event.partial === true;
+                    if (event && event.type === 'trace' && event.text) {
+                        traceLines.push(String(event.text));
+                        if (event.traceEvent && typeof event.traceEvent === 'object') {
+                            traceEvents.push(event.traceEvent);
+                        }
+                        patchWebSessionMessage(state.webHistoryDir, sessionRef, traceMessage && traceMessage.id, {
+                            content: traceLines.join('\n'),
+                            traceEvents: traceEvents.slice(),
+                            pending: true
+                        });
+                    }
+                    if (event && event.type === 'content_delta' && typeof event.content === 'string') {
+                        const now = Date.now();
+                        const shouldPersist = !isPartialDelta
+                            || now - lastPartialPersistAt >= AGENT_STREAM_PARTIAL_PERSIST_INTERVAL_MS;
+                        if (!streamingReplyMessageId) {
+                            const streamingReplyMessage = appendWebSessionMessage(
+                                state.webHistoryDir,
+                                sessionRef,
+                                'assistant',
+                                event.content,
+                                {
+                                    mode: 'agent',
+                                    streamingReply: true,
                                     pending: true
-                                });
-                            }
-                            if (event && event.type === 'content_delta' && typeof event.content === 'string') {
-                                const now = Date.now();
-                                const shouldPersist = !isPartialDelta
-                                    || now - lastPartialPersistAt >= AGENT_STREAM_PARTIAL_PERSIST_INTERVAL_MS;
-                                if (!streamingReplyMessageId) {
-                                    const streamingReplyMessage = appendWebSessionMessage(
-                                        state.webHistoryDir,
-                                        sessionRef,
-                                        'assistant',
-                                        event.content,
-                                        {
-                                            mode: 'agent',
-                                            streamingReply: true,
-                                            pending: true
-                                        }
-                                    );
-                                    streamingReplyMessageId = streamingReplyMessage && streamingReplyMessage.id
-                                        ? streamingReplyMessage.id
-                                        : '';
-                                    lastPartialPersistAt = now;
-                                } else if (shouldPersist) {
-                                    patchWebSessionMessage(state.webHistoryDir, sessionRef, streamingReplyMessageId, {
-                                        content: event.content,
-                                        pending: true
-                                    });
-                                    lastPartialPersistAt = now;
                                 }
-                            }
-                            if (isPartialDelta) {
-                                lastStreamWriteAt = Date.now();
-                                // 只发增量片段：前端在 content_chunk 上做追加，
-                                // reset 表示换了一条 assistant 消息、从空白重新开始
-                                sendNdjson(res, event.chunkReset === true
-                                    ? { type: 'content_chunk', text: '', reset: true }
-                                    : { type: 'content_chunk', text: event.chunk });
-                                return;
-                            }
-                            emitStreamEvent(event, resolveWebStreamControlEventType(event), {
-                                transportType: event && event.type ? event.type : '',
-                                text: event && (event.text || event.content) ? String(event.text || event.content) : ''
+                            );
+                            streamingReplyMessageId = streamingReplyMessage && streamingReplyMessage.id
+                                ? streamingReplyMessage.id
+                                : '';
+                            lastPartialPersistAt = now;
+                        } else if (shouldPersist) {
+                            patchWebSessionMessage(state.webHistoryDir, sessionRef, streamingReplyMessageId, {
+                                content: event.content,
+                                pending: true
                             });
+                            lastPartialPersistAt = now;
                         }
+                    }
+                    if (isPartialDelta) {
+                        lastStreamWriteAt = Date.now();
+                        // 只发增量片段：前端在 content_chunk 上做追加，
+                        // reset 表示换了一条 assistant 消息、从空白重新开始
+                        sendNdjson(res, event.chunkReset === true
+                            ? { type: 'content_chunk', text: '', reset: true }
+                            : { type: 'content_chunk', text: event.chunk });
+                        return;
+                    }
+                    emitStreamEvent(event, resolveWebStreamControlEventType(event), {
+                        transportType: event && event.type ? event.type : '',
+                        text: event && (event.text || event.content) ? String(event.text || event.content) : ''
                     });
+
+                };
+                // 域名白名单下被过滤代理拦下的新域名：对话进行中立即提示一次
+                const deniedNotifier = createWebDeniedNotifier(ctx, sessionRef, text => handleStreamEvent({ type: 'trace', stream: 'stdout', text }));
+                try {
+                    if (deniedNotifier) deniedNotifier.start();
+                    let result;
+                    try {
+                        result = await execAgentInWebContainerStream(ctx, state, sessionRef, command, {
+                            agentProgram: agentMeta.agentProgram,
+                            // 复用路由入口占好的那把锁，而不是另起一份运行登记
+                            runState,
+                            onEvent: handleStreamEvent
+                        });
+                    } finally {
+                        if (deniedNotifier) deniedNotifier.stop();
+                    }
                     ctx.logger.info('agent turn finished', {
                         session: turnSessionKey,
                         durationMs: Date.now() - turnStartedAt,
@@ -6321,6 +6510,26 @@ async function handleWebApi(req, res, pathname, ctx, state) {
         }
     ];
 
+    routes.push(...createContainerManageRoutes({
+        ctx,
+        state,
+        req,
+        res,
+        deps: {
+            sendJson,
+            readJsonBody,
+            decodeSessionName,
+            getNetworkManager: () => getWebNetworkManager(ctx, state),
+            getPortForwarder: () => getWebPortForwarder(ctx, state),
+            rememberContainerName: (id, name) => {
+                if (!state.containerNames) state.containerNames = new Map();
+                state.containerNames.set(id, name);
+            },
+            ensureWebContainer,
+            execCommandInWebContainer
+        }
+    }));
+
     for (const route of routes) {
         if (route.method !== req.method) {
             continue;
@@ -6370,6 +6579,8 @@ async function startWebServer(options) {
         contModeArgs: options.contModeArgs,
         containerExtraArgs: options.containerExtraArgs,
         containerEnvs: options.containerEnvs,
+        networkManager: options.networkManager,
+        envFiles: options.envFiles,
         containerVolumes: options.containerVolumes,
         containerPorts: options.containerPorts,
         validateHostPath: options.validateHostPath,
@@ -6598,7 +6809,7 @@ async function startWebServer(options) {
             console.log(`${GREEN}✅ MANYOYO Web 服务已启动: http://${listenHost}:${listenPort}${NC}`);
             console.log(`${CYAN}提示: 左侧是 manyoyo 容器与 AGENT 列表，右侧是聊天/终端/文件/详情/配置/检查工作台。${NC}`);
             if (ctx.serverHost === '0.0.0.0') {
-                console.log(`${CYAN}提示: 当前监听全部网卡，请用本机局域网 IP 访问。${NC}`);
+                console.log(`${CYAN}提示: 当前监听全部网卡，请用本机局域网 / 公网 IP 访问。${NC}`);
             }
             console.log(`${CYAN}🔐 登录用户名: ${YELLOW}${ctx.authUser}${NC}`);
             if (ctx.authPassAuto) {
@@ -6617,6 +6828,7 @@ async function startWebServer(options) {
     });
 
     startStaleSetupCleanup(ctx);
+    startContainerNetworkWatch(ctx, state);
     if (ctx.autoPullImage) {
         startWebImagePrepare(ctx, state);
     }
@@ -6628,6 +6840,11 @@ async function startWebServer(options) {
         port: listenPort,
         close: () => new Promise(resolve => {
             ctx.logger.info('web server closing');
+            if (state.networkWatch) {
+                state.networkWatch.stop();
+                state.networkWatch = null;
+            }
+            if (state.portForwarder) state.portForwarder.closeAll();
             for (const session of state.terminalSessions.values()) {
                 const ptyProcess = session && session.ptyProcess;
                 if (ptyProcess && !ptyProcess.killed) {