@xcanwin/manyoyo 8.5.0 → 8.6.0

package/lib/web/server.js

@@ -15,17 +15,17 @@ const { applyAptMirror } = require('../mirrors');
 const containerState = require('../container-state');
 const { buildExecArgs, resolveContainerId } = require('../container-exec');
 const { createNetworkManager, NETWORK_NAME } = require('../container-network');
-const { normalizePolicy } = require('../network-policy');
+const { normalizePolicy, isUnrestricted: isUnrestrictedPolicy } = require('../network-policy');
 const { withEnvEndpoints } = require('../network-endpoints');
 const { egressPaths, isSidecarName } = require('../egress-sidecar');
 const { read: readDenied } = require('../egress-denied');
 const { isBrowserBackground } = require('../browser-background');
 const { createDeniedNotifier } = require('./denied-notify');
-const { domainAllowed } = require('../network-policy');
+const { domainRuleAllows } = require('../network-policy');
 const { createPortForwarder } = require('../port-forward');
 const { createContainerManageRoutes, pendingRisks } = require('./container-manage');
 const { resolveManageOptions } = require('../container-manage-options');
-const { defaultPolicy } = require('../network-policy');
+const { defaultPolicy, usesProxy } = require('../network-policy');
 const { normalizeMirrors } = require('../runtime-normalizers');
 const { estimateContainerCapacity } = require('../capacity');
 const { extractAgentMessageFromCodexJsonl } = require('../codex-output');
@@ -2826,10 +2826,10 @@ function buildCreateRuntime(ctx, state, payload) {
         parseServerListen: () => ({ host: '', port: 0 })
     });
 
-    // 自启动与网络：请求 > runs.<name> > 全局配置；请求里放开限制（open / 非本机绑定）要带 confirmRisk
+    // 自启动与网络：请求 > runs.<name> > 全局配置；请求里放开限制（自定义 / 很宽的允许规则 / 非本机绑定）要带 confirmRisk
     const manage = resolveManageOptions({ requestOptions, runConfig, globalConfig: config });
     if (manage.fromRequest && requestOptions.confirmRisk !== true && pendingRisks(defaultPolicy(), manage.network).length) {
-        throw new Error('该网络设置会放开限制（open 预设或绑定非本机地址），需要确认（confirmRisk）');
+        throw new Error('该网络设置会放开限制（自定义模式、很宽的允许规则或绑定非本机地址），需要确认（confirmRisk）');
     }
 
     const containerName = resolvedBase.containerName;
@@ -2952,7 +2952,7 @@ function buildCreateRuntime(ctx, state, payload) {
         agentPromptCommand,
         defaultCommand: buildDefaultCommand(shellPrefix, shell, shellSuffix) || '/bin/bash',
         // 仅供服务端内部复用（如"创建相同配置容器"/"复制容器"），绝不能透传给任何对外响应字段，
-        // 因为 env/volumes/ports 可能包含密钥原始值（对外响应向来只暴露 envCount 等计数）。
+        // 因为 env/volumes/ports 可能包含密钥原始值（对外响应不暴露它们）。
         runtimeSnapshot: {
             hostPath,
             containerPath,
@@ -2987,11 +2987,8 @@ function buildCreateRuntime(ctx, state, payload) {
             agentProgram: agentProgram || '',
             resumeSupported,
             yolo: yolo || '',
-            envCount: Math.floor(containerEnvs.length / 2),
             autostartEnabled: Boolean(manage.autostart.trim()),
-            networkPreset: manage.network.preset,
-            volumeCount: Math.floor(containerVolumes.length / 2),
-            portCount: Math.floor(containerPorts.length / 2)
+            networkPreset: manage.network.preset
         }
     };
 }
@@ -3336,10 +3333,10 @@ function createWebDeniedNotifier(ctx, sessionRef, emit) {
         if (!id || !containerState.stateExists(homeDir, id)) return null;
         const deniedDir = egressPaths(homeDir).denied;
         const policyOf = () => normalizePolicy(containerState.readNetworkRaw(homeDir, id) || undefined);
-        if (policyOf().preset !== 'allowlist') return null;
+        if (!usesProxy(policyOf())) return null;
         return createDeniedNotifier({
             read: () => readDenied(deniedDir, id),
-            isIgnored: host => isBrowserBackground(host) || domainAllowed(policyOf().egress.domains, host),
+            isIgnored: host => isBrowserBackground(host) || domainRuleAllows(policyOf(), host),
             emit
         });
     } catch (e) {
@@ -3503,8 +3500,8 @@ async function ensureWebContainer(ctx, state, containerInput, messageSessionRef
         const userEnvLines = containerState.userEnvLines(runtime.containerEnvs);
         const playwright = await buildWebPlaywrightIntegration(ctx, state, runtime);
         const containerEnvs = containerState.stripEnvKeys(playwright.containerEnvs, new Set(userEnvLines.map(containerState.envLineKey)));
-        const networkPolicy = await withEnvEndpoints(normalizePolicy(runtime.network), [...userEnvLines, ...containerState.readEnvFilePaths(runtime.envFiles || []).flatMap(file => file.entries.map(entry => `${entry.key}=${entry.value}`))]);
         const networkManager = getWebNetworkManager(ctx, state);
+        const networkPolicy = await withEnvEndpoints(await networkManager.resolveRefs(normalizePolicy(runtime.network)), [...userEnvLines, ...containerState.readEnvFilePaths(runtime.envFiles || []).flatMap(file => file.entries.map(entry => `${entry.key}=${entry.value}`))]);
         if (!hasNetworkArg([...(runtime.contModeArgs || []), ...(playwright.containerExtraArgs || [])])) {
             await networkManager.ensureBridgeNetwork();
         }
@@ -3514,7 +3511,7 @@ async function ensureWebContainer(ctx, state, containerInput, messageSessionRef
             envFiles: runtime.envFiles,
             autostart: runtime.autostart,
             network: networkPolicy,
-            netRequired: networkPolicy.preset !== 'open',
+            netRequired: !isUnrestrictedPolicy(networkPolicy),
             meta: { name: runtime.containerName }
         });
         const args = buildContainerRunArgs({
@@ -4619,9 +4616,6 @@ function buildSessionFallbackApplied(ctx, state, name, history, summary) {
         agentProgram: effectiveAgentProgram,
         resumeSupported: effectiveResumeSupported,
         yolo: defaults.yolo || '',
-        envCount: Object.keys(defaults.env || {}).length,
-        volumeCount: Array.isArray(defaults.volumes) ? defaults.volumes.length : 0,
-        portCount: Array.isArray(defaults.ports) ? defaults.ports.length : 0,
         status: summary.status || 'history'
     };
 }
@@ -6333,7 +6327,7 @@ async function handleWebApi(req, res, pathname, ctx, state) {
                     });
 
                 };
-                // 域名白名单下被过滤代理拦下的新域名：对话进行中立即提示一次
+                // 有域名规则时被过滤代理拦下的新域名：对话进行中立即提示一次
                 const deniedNotifier = createWebDeniedNotifier(ctx, sessionRef, text => handleStreamEvent({ type: 'trace', stream: 'stdout', text }));
                 try {
                     if (deniedNotifier) deniedNotifier.start();

package/manyoyo.example.json

@@ -30,14 +30,17 @@
     "ports": ["8888:8888"],
 
     // 网络策略（新建容器时写入，Web「容器」页随时改，不需要重启容器）。不写 = 默认收紧：允许公网，
-    // 禁止宿主机其他端口、局域网 / 私有网段、云元数据与其他容器。
-    // preset：restricted（默认）/ allowlist（域名白名单，需要 serve 运行）/ open（不加规则）
+    // 禁止宿主机、局域网 / 私有网段、云元数据与其他容器。
+    // preset：restricted（默认）/ allowlist（只放行你写的允许规则）/ custom（没匹配的就允许）
+    // outbound / inbound：规则从上往下，第一条命中的生效。action：allow / deny；target（入站为 source）：
+    // IP / 网段 / 域名（仅出站）/ @containers @container:<名称> @host @private @public @metadata @any；ports 空 = 全部；proto：all / tcp / udp
     "network": {
+        "version": 2,
         "preset": "restricted",
-        // 允许容器访问的宿主机端口（宿主机上监听 0.0.0.0 的服务）
-        "host": [],
-        // 直连放行的 IP 规则，例如局域网里的模型网关：{ "cidr": "192.168.1.50", "ports": "8000", "proto": "tcp" }
-        "egress": { "domains": [], "rules": [] },
+        // 例：允许容器访问宿主机的 Ollama：{ "action": "allow", "target": "@host", "ports": "11434", "proto": "tcp" }
+        "outbound": [],
+        // 例：允许容器 B 访问我的 7000 端口：{ "action": "allow", "source": "@container:B", "ports": "7000", "proto": "tcp" }
+        "inbound": [],
         // 端口暴露（需要 serve 运行）：监听地址默认 127.0.0.1；绑 0.0.0.0 等于局域网 / 公网可见
         "expose": []
     },

package/package.json

@@ -1,14 +1,16 @@
 {
     "name": "@xcanwin/manyoyo",
-    "version": "8.5.0",
+    "version": "8.6.0",
     "imageVersion": "2.2.0-common",
     "playwrightCliVersion": "0.1.19",
     "patchrightCoreVersion": "1.63.0",
     "patchrightCoreIntegrity": "sha512-nuRJVTMVKoOFzY8vmwFqJZR3F0trUCKiPzDSgCOPq/yHHTefm9czILV23dXJsi5mvS7sCy7U1CqG7edA/21DtQ==",
-    "description": "MANYOYO – open-source AI agent sandbox: run AI coding agents (Claude Code / Codex / Gemini) safely in Docker/Podman",
+    "description": "MANYOYO（慢悠悠）– open-source AI coding agent sandbox: run Claude Code, Codex, Gemini CLI and OpenCode in YOLO mode safely inside Docker/Podman",
     "keywords": [
         "manyoyo",
         "ai-agent",
+        "ai-sandbox",
+        "coding-agent",
         "agent-cli",
         "security-sandbox",
         "claude-code",
@@ -23,7 +25,7 @@
         "type": "git",
         "url": "git+https://github.com/xcanwin/manyoyo.git"
     },
-    "license": "MIT",
+    "license": "Apache-2.0",
     "author": "xcanwin",
     "type": "commonjs",
     "main": "bin/manyoyo.js",

package/README.en.md

@@ -1,88 +0,0 @@
-<p align="center">
-  <img src="./assets/manyoyo-logo-09-cyberpunk-terminal.svg" alt="MANYOYO logo" width="560" />
-</p>
-
-# <p align="center"><a href="https://github.com/xcanwin/manyoyo">MANYOYO</a></p>
-<p align="center"><b>MANYOYO – open-source sandbox for running AI coding agents (Claude Code / Codex / Gemini) safely in Docker/Podman</b></p>
-<p align="center">Run Claude Code / Codex / Gemini / OpenCode in YOLO mode inside a container: let the AI go wild without hurting your computer.</p>
-<p align="center">
-  <a href="https://www.npmjs.com/package/@xcanwin/manyoyo"><img alt="npm" src="https://img.shields.io/npm/v/@xcanwin/manyoyo?style=flat-square" /></a>
-  <a href="https://github.com/xcanwin/manyoyo/actions/workflows/npm-publish.yml"><img alt="Build status" src="https://img.shields.io/github/actions/workflow/status/xcanwin/manyoyo/npm-publish.yml?style=flat-square" /></a>
-  <a href="https://github.com/xcanwin/manyoyo/blob/main/LICENSE"><img alt="license" src="https://img.shields.io/badge/License-MIT-yellow.svg" /></a>
-</p>
-
-<p align="center">
-  <a href="README.md">中文</a> |
-  <a href="README.en.md"><b>English</b></a>
-</p>
-<p align="center">
-  Docs: <a href="https://xcanwin.github.io/manyoyo/en/">https://xcanwin.github.io/manyoyo/en/</a>
-</p>
-
----
-
-## Install
-
-### macOS / Linux (recommended)
-
-```bash
-curl -fsSL https://github.com/xcanwin/manyoyo/raw/main/scripts/install.sh | sh
-```
-
-When it finishes, follow the on-screen prompts to finish setup. macOS needs nothing installed first. Linux: if the container runtime is missing, the installer explains why and, with your consent, installs it with sudo.
-
-### Already have Node.js and Docker/Podman
-
-```bash
-npm install -g @xcanwin/manyoyo
-manyoyo
-```
-
-## Daily use
-
-```bash
-manyoyo            # open the web UI
-manyoyo update     # upgrade
-manyoyo uninstall  # uninstall (config and data are kept by default)
-```
-
-## Command line (optional)
-
-```bash
-manyoyo init all   # import the agent configs already on this machine
-manyoyo run -y c   # start Claude Code in YOLO mode inside the sandbox
-```
-
-The default image `ghcr.io/xcanwin/manyoyo` is pulled automatically on first use; run `manyoyo build --iv 2.1.1-common` only if you need a custom image. More commands: [CLI reference](https://xcanwin.github.io/manyoyo/en/reference/cli-options).
-
-## What it does
-
-- **Multiple agents**: `claude`, `codex`, `gemini`, `opencode` behind one entry point
-- **Container isolation**: Docker / Podman; the agent only sees the work directory you give it
-- **Web UI**: chat, browse files and open a terminal in the browser, phone friendly
-- **One config**: run profiles, environment variables, mounts and image arguments in `~/.manyoyo/manyoyo.json`
-- **One command** to install, upgrade and uninstall
-
-| | Running the agent CLI directly | MANYOYO |
-| --- | --- | --- |
-| Host exposure | High | Lower |
-| Run boundary | Scattered | Centralised in the container and config |
-| Reproducible environment | Weak | Strong (image + config) |
-| High-risk mode warnings | Left to the tool | Explicit YOLO / SOLO / sock warnings |
-
-## Security notes
-
-MANYOYO reduces risk but is not "absolutely safe": the main isolation is a container, not a virtual machine; `YOLO / SOLO` can still run dangerous commands; `sock` mode exposes the host Docker socket; set a strong password before listening on a public address. See [Security notes](https://xcanwin.github.io/manyoyo/en/guide/security).
-
-## Docs
-
-- 中文: <https://xcanwin.github.io/manyoyo/>
-- English: <https://xcanwin.github.io/manyoyo/en/> ([Install](https://xcanwin.github.io/manyoyo/en/guide/quick-start), [CLI reference](https://xcanwin.github.io/manyoyo/en/reference/cli-options), [Configuration](https://xcanwin.github.io/manyoyo/en/configuration/), [FAQ](https://xcanwin.github.io/manyoyo/en/troubleshooting/))
-
-## License
-
-MIT
-
-## Contributing
-
-[Issues](https://github.com/xcanwin/manyoyo/issues) and pull requests are welcome.