@xcanwin/manyoyo 8.5.1 → 8.6.2

package/lib/web/server.js

@@ -13,19 +13,19 @@ const { buildContainerRunArgs, hasNetworkArg } = require('../container-run');
 const { buildContainerIntegration, mergeIntegration } = require('../plugin');
 const { applyAptMirror } = require('../mirrors');
 const containerState = require('../container-state');
-const { buildExecArgs, resolveContainerId } = require('../container-exec');
+const { buildExecArgs, resolveContainerId, readMergedEnv } = require('../container-exec');
 const { createNetworkManager, NETWORK_NAME } = require('../container-network');
-const { normalizePolicy } = require('../network-policy');
+const { normalizePolicy, isUnrestricted: isUnrestrictedPolicy } = require('../network-policy');
 const { withEnvEndpoints } = require('../network-endpoints');
 const { egressPaths, isSidecarName } = require('../egress-sidecar');
 const { read: readDenied } = require('../egress-denied');
 const { isBrowserBackground } = require('../browser-background');
 const { createDeniedNotifier } = require('./denied-notify');
-const { domainAllowed } = require('../network-policy');
+const { domainRuleAllows } = require('../network-policy');
 const { createPortForwarder } = require('../port-forward');
 const { createContainerManageRoutes, pendingRisks } = require('./container-manage');
 const { resolveManageOptions } = require('../container-manage-options');
-const { defaultPolicy } = require('../network-policy');
+const { defaultPolicy, usesProxy } = require('../network-policy');
 const { normalizeMirrors } = require('../runtime-normalizers');
 const { estimateContainerCapacity } = require('../capacity');
 const { extractAgentMessageFromCodexJsonl } = require('../codex-output');
@@ -829,7 +829,7 @@ function buildCodexAgentExecCommand(template, prompt, options = {}) {
         const hasJson = /(?:^|\s)--json(?:\s|$)/.test(suffix);
         const injectedFlags = hasJson ? '' : ' --json';
         const hasModel = /(?:^|\s)(?:-m|--model)(?:\s|$)/.test(suffix);
-        const modelFlag = model && !hasModel ? ` --model ${model}` : '';
+        const modelFlag = model && !hasModel ? ` --model ${quoteBashSingleValue(model)}` : '';
         if (sessionId) {
             const promptIndex = suffix.indexOf('{prompt}');
             const resumeSuffix = `${suffix.slice(0, promptIndex)}${quoteBashSingleValue(sessionId)} ${suffix.slice(promptIndex)}`;
@@ -877,7 +877,7 @@ function buildClaudeAgentExecCommand(template, prompt, options = {}) {
     }
     const model = options && typeof options.model === 'string' ? options.model.trim() : '';
     if (model) {
-        flagSpecs.push({ flag: `--model ${model}`, pattern: /(?:^|\s)--model(?:\s|$)/ });
+        flagSpecs.push({ flag: `--model ${quoteBashSingleValue(model)}`, pattern: /(?:^|\s)--model(?:\s|$)/ });
     }
     const claudeTemplate = prependAgentFlags(
         templateText,
@@ -896,7 +896,7 @@ function buildGeminiAgentExecCommand(template, prompt, options = {}) {
     ];
     const model = options && typeof options.model === 'string' ? options.model.trim() : '';
     if (model) {
-        flagSpecs.push({ flag: `--model ${model}`, pattern: /(?:^|\s)(?:-m|--model)(?:\s|$)/ });
+        flagSpecs.push({ flag: `--model ${quoteBashSingleValue(model)}`, pattern: /(?:^|\s)(?:-m|--model)(?:\s|$)/ });
     }
     const geminiTemplate = prependAgentFlags(
         templateText,
@@ -922,7 +922,7 @@ function buildOpenCodeAgentExecCommand(template, prompt, options = {}) {
     }
     const model = options && typeof options.model === 'string' ? options.model.trim() : '';
     if (model) {
-        flagSpecs.push({ flag: `--model ${model}`, pattern: /(?:^|\s)(?:-m|--model)(?:\s|$)/ });
+        flagSpecs.push({ flag: `--model ${quoteBashSingleValue(model)}`, pattern: /(?:^|\s)(?:-m|--model)(?:\s|$)/ });
     }
     const opencodeTemplate = prependAgentFlags(
         templateText,
@@ -1319,6 +1319,61 @@ function extractOpenCodeModelsFromOutput(text) {
         .map(value => ({ value, label: value, description: '' }));
 }
 
+// 模型目录要在容器里起一个 Agent 进程才能问到，很慢：按“容器 + Agent 程序”缓存，
+// 并合并同一时刻的重复请求。缓存挂在 ctx 上（随 serve 实例走），不放模块级，避免测试之间串味
+const MODEL_CATALOG_TTL_MS = 10 * 60 * 1000;
+const modelCatalogCaches = new WeakMap();
+
+async function fetchAgentModelCatalogCached(ctx, containerName, agentProgram) {
+    let cache = modelCatalogCaches.get(ctx);
+    if (!cache) {
+        cache = new Map();
+        modelCatalogCaches.set(ctx, cache);
+    }
+    const key = `${containerName}\u0000${agentProgram}`;
+    const hit = cache.get(key);
+    if (hit && (hit.pending || Date.now() - hit.at < MODEL_CATALOG_TTL_MS)) {
+        return hit.pending || hit.models;
+    }
+    const pending = fetchAgentModelCatalog(ctx, containerName, agentProgram).then(models => {
+        // 探测失败（超时 / 容器没起来）返回空数组，不缓存，下次还能重试
+        if (models.length) cache.set(key, { at: Date.now(), models });
+        else cache.delete(key);
+        return models;
+    }, error => {
+        cache.delete(key);
+        throw error;
+    });
+    cache.set(key, { pending });
+    return pending;
+}
+
+// 以会话实际配置的 env 生成模型选项。defaultModel 是“跟随默认”实际用的模型；
+// Claude 另有按档位别名（opus / sonnet / haiku …）一行一个的选项：value 是别名（--model opus 由 CLI 按 env 解析），
+// label 是该档位对应的真实模型名。不同档位指向同一个模型也各占一行，不合并。
+// 只读 *_MODEL 这类非敏感键，容器可写的 env 只用来展示，不参与任何安全判断
+const CLAUDE_TIER_ORDER = ['opus', 'fable', 'sonnet', 'haiku'];
+
+function buildEnvModelOptions(agentProgram, env) {
+    const source = env && typeof env === 'object' ? env : {};
+    const defaultKey = { claude: 'ANTHROPIC_MODEL', codex: 'OPENAI_MODEL', opencode: 'OPENAI_MODEL', gemini: 'GEMINI_MODEL' }[agentProgram];
+    if (!defaultKey) return { defaultModel: '', options: [] };
+    const defaultModel = normalizeStoredAgentModelValue(source[defaultKey]);
+    if (agentProgram !== 'claude') return { defaultModel, options: [] };
+    const tiers = [];
+    Object.keys(source).forEach(key => {
+        const matched = key.match(/^ANTHROPIC_DEFAULT_([A-Z0-9]+)_MODEL$/);
+        const model = matched ? normalizeStoredAgentModelValue(source[key]) : '';
+        if (model) tiers.push({ alias: matched[1].toLowerCase(), model });
+    });
+    const rank = alias => (CLAUDE_TIER_ORDER.includes(alias) ? CLAUDE_TIER_ORDER.indexOf(alias) : CLAUDE_TIER_ORDER.length);
+    tiers.sort((x, y) => rank(x.alias) - rank(y.alias) || x.alias.localeCompare(y.alias));
+    return {
+        defaultModel,
+        options: tiers.map(tier => ({ value: tier.alias, label: tier.model, description: tier.alias }))
+    };
+}
+
 async function fetchAgentModelCatalog(ctx, containerName, agentProgram) {
     if (agentProgram === 'claude') {
         const requestLine = JSON.stringify({
@@ -2826,10 +2881,10 @@ function buildCreateRuntime(ctx, state, payload) {
         parseServerListen: () => ({ host: '', port: 0 })
     });
 
-    // 自启动与网络：请求 > runs.<name> > 全局配置；请求里放开限制（open / 非本机绑定）要带 confirmRisk
+    // 自启动与网络：请求 > runs.<name> > 全局配置；请求里放开限制（自定义 / 很宽的允许规则 / 非本机绑定）要带 confirmRisk
     const manage = resolveManageOptions({ requestOptions, runConfig, globalConfig: config });
     if (manage.fromRequest && requestOptions.confirmRisk !== true && pendingRisks(defaultPolicy(), manage.network).length) {
-        throw new Error('该网络设置会放开限制（open 预设或绑定非本机地址），需要确认（confirmRisk）');
+        throw new Error('该网络设置会放开限制（自定义模式、很宽的允许规则或绑定非本机地址），需要确认（confirmRisk）');
     }
 
     const containerName = resolvedBase.containerName;
@@ -2952,7 +3007,7 @@ function buildCreateRuntime(ctx, state, payload) {
         agentPromptCommand,
         defaultCommand: buildDefaultCommand(shellPrefix, shell, shellSuffix) || '/bin/bash',
         // 仅供服务端内部复用（如"创建相同配置容器"/"复制容器"），绝不能透传给任何对外响应字段，
-        // 因为 env/volumes/ports 可能包含密钥原始值（对外响应向来只暴露 envCount 等计数）。
+        // 因为 env/volumes/ports 可能包含密钥原始值（对外响应不暴露它们）。
         runtimeSnapshot: {
             hostPath,
             containerPath,
@@ -2987,11 +3042,8 @@ function buildCreateRuntime(ctx, state, payload) {
             agentProgram: agentProgram || '',
             resumeSupported,
             yolo: yolo || '',
-            envCount: Math.floor(containerEnvs.length / 2),
             autostartEnabled: Boolean(manage.autostart.trim()),
-            networkPreset: manage.network.preset,
-            volumeCount: Math.floor(containerVolumes.length / 2),
-            portCount: Math.floor(containerPorts.length / 2)
+            networkPreset: manage.network.preset
         }
     };
 }
@@ -3336,10 +3388,10 @@ function createWebDeniedNotifier(ctx, sessionRef, emit) {
         if (!id || !containerState.stateExists(homeDir, id)) return null;
         const deniedDir = egressPaths(homeDir).denied;
         const policyOf = () => normalizePolicy(containerState.readNetworkRaw(homeDir, id) || undefined);
-        if (policyOf().preset !== 'allowlist') return null;
+        if (!usesProxy(policyOf())) return null;
         return createDeniedNotifier({
             read: () => readDenied(deniedDir, id),
-            isIgnored: host => isBrowserBackground(host) || domainAllowed(policyOf().egress.domains, host),
+            isIgnored: host => isBrowserBackground(host) || domainRuleAllows(policyOf(), host),
             emit
         });
     } catch (e) {
@@ -3503,8 +3555,8 @@ async function ensureWebContainer(ctx, state, containerInput, messageSessionRef
         const userEnvLines = containerState.userEnvLines(runtime.containerEnvs);
         const playwright = await buildWebPlaywrightIntegration(ctx, state, runtime);
         const containerEnvs = containerState.stripEnvKeys(playwright.containerEnvs, new Set(userEnvLines.map(containerState.envLineKey)));
-        const networkPolicy = await withEnvEndpoints(normalizePolicy(runtime.network), [...userEnvLines, ...containerState.readEnvFilePaths(runtime.envFiles || []).flatMap(file => file.entries.map(entry => `${entry.key}=${entry.value}`))]);
         const networkManager = getWebNetworkManager(ctx, state);
+        const networkPolicy = await withEnvEndpoints(await networkManager.resolveRefs(normalizePolicy(runtime.network)), [...userEnvLines, ...containerState.readEnvFilePaths(runtime.envFiles || []).flatMap(file => file.entries.map(entry => `${entry.key}=${entry.value}`))]);
         if (!hasNetworkArg([...(runtime.contModeArgs || []), ...(playwright.containerExtraArgs || [])])) {
             await networkManager.ensureBridgeNetwork();
         }
@@ -3514,7 +3566,7 @@ async function ensureWebContainer(ctx, state, containerInput, messageSessionRef
             envFiles: runtime.envFiles,
             autostart: runtime.autostart,
             network: networkPolicy,
-            netRequired: networkPolicy.preset !== 'open',
+            netRequired: !isUnrestrictedPolicy(networkPolicy),
             meta: { name: runtime.containerName }
         });
         const args = buildContainerRunArgs({
@@ -4619,9 +4671,6 @@ function buildSessionFallbackApplied(ctx, state, name, history, summary) {
         agentProgram: effectiveAgentProgram,
         resumeSupported: effectiveResumeSupported,
         yolo: defaults.yolo || '',
-        envCount: Object.keys(defaults.env || {}).length,
-        volumeCount: Array.isArray(defaults.volumes) ? defaults.volumes.length : 0,
-        portCount: Array.isArray(defaults.ports) ? defaults.ports.length : 0,
         status: summary.status || 'history'
     };
 }
@@ -5956,7 +6005,7 @@ async function handleWebApi(req, res, pathname, ctx, state) {
                     containerInfo.defaultCommand
                 );
                 const agentProgram = resolveAgentProgram(effectiveTemplate);
-                const models = await fetchAgentModelCatalog(ctx, sessionRef.containerName, agentProgram);
+                const models = await fetchAgentModelCatalogCached(ctx, sessionRef.containerName, agentProgram);
                 sendJson(res, 200, {
                     name: buildWebSessionKey(sessionRef.containerName, sessionRef.agentId),
                     agentProgram,
@@ -5964,6 +6013,34 @@ async function handleWebApi(req, res, pathname, ctx, state) {
                 });
             }
         },
+        {
+            // 毫秒级：只读宿主机上的 env 文件，不进容器；慢的 CLI 目录探测走上面的 /models
+            method: 'GET',
+            match: currentPath => currentPath.match(/^\/api\/sessions\/([^/]+)\/model-options$/),
+            handler: async match => {
+                const sessionRef = getValidSessionRef(ctx, res, match[1]);
+                if (!sessionRef) {
+                    return;
+                }
+                const containerMap = listWebManyoyoContainers(ctx);
+                const containerInfo = containerMap[sessionRef.containerName] || {};
+                const history = loadWebSessionHistory(state.webHistoryDir, sessionRef.containerName);
+                const agentProgram = resolveAgentProgram(resolveEffectiveAgentPromptCommandForSession(
+                    history,
+                    sessionRef.agentId,
+                    containerInfo.defaultCommand
+                ));
+                let env = {};
+                try {
+                    env = readMergedEnv({ homeDir: ctx.homeDir || os.homedir(), dockerExecArgs: ctx.dockerExecArgs }, sessionRef.containerName);
+                } catch (e) { /* 读不到 env 就只给空选项 */ }
+                sendJson(res, 200, {
+                    name: buildWebSessionKey(sessionRef.containerName, sessionRef.agentId),
+                    agentProgram,
+                    ...buildEnvModelOptions(agentProgram, env)
+                });
+            }
+        },
         {
             method: 'POST',
             match: currentPath => currentPath.match(/^\/api\/sessions\/([^/]+)\/model$/),
@@ -6333,7 +6410,7 @@ async function handleWebApi(req, res, pathname, ctx, state) {
                     });
 
                 };
-                // 域名白名单下被过滤代理拦下的新域名：对话进行中立即提示一次
+                // 有域名规则时被过滤代理拦下的新域名：对话进行中立即提示一次
                 const deniedNotifier = createWebDeniedNotifier(ctx, sessionRef, text => handleStreamEvent({ type: 'trace', stream: 'stdout', text }));
                 try {
                     if (deniedNotifier) deniedNotifier.start();
@@ -6878,5 +6955,6 @@ async function startWebServer(options) {
 }
 
 module.exports = {
-    startWebServer
+    startWebServer,
+    buildEnvModelOptions
 };

package/manyoyo.example.json

@@ -30,14 +30,17 @@
     "ports": ["8888:8888"],
 
     // 网络策略（新建容器时写入，Web「容器」页随时改，不需要重启容器）。不写 = 默认收紧：允许公网，
-    // 禁止宿主机其他端口、局域网 / 私有网段、云元数据与其他容器。
-    // preset：restricted（默认）/ allowlist（域名白名单，需要 serve 运行）/ open（不加规则）
+    // 禁止宿主机、局域网 / 私有网段、云元数据与其他容器。
+    // preset：restricted（默认）/ allowlist（只放行你写的允许规则）/ custom（没匹配的就允许）
+    // outbound / inbound：规则从上往下，第一条命中的生效。action：allow / deny；target（入站为 source）：
+    // IP / 网段 / 域名（仅出站）/ @containers @container:<名称> @host @private @public @metadata @any；ports 空 = 全部；proto：all / tcp / udp
     "network": {
+        "version": 2,
         "preset": "restricted",
-        // 允许容器访问的宿主机端口（宿主机上监听 0.0.0.0 的服务）
-        "host": [],
-        // 直连放行的 IP 规则，例如局域网里的模型网关：{ "cidr": "192.168.1.50", "ports": "8000", "proto": "tcp" }
-        "egress": { "domains": [], "rules": [] },
+        // 例：允许容器访问宿主机的 Ollama：{ "action": "allow", "target": "@host", "ports": "11434", "proto": "tcp" }
+        "outbound": [],
+        // 例：允许容器 B 访问我的 7000 端口：{ "action": "allow", "source": "@container:B", "ports": "7000", "proto": "tcp" }
+        "inbound": [],
         // 端口暴露（需要 serve 运行）：监听地址默认 127.0.0.1；绑 0.0.0.0 等于局域网 / 公网可见
         "expose": []
     },

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@xcanwin/manyoyo",
-    "version": "8.5.1",
+    "version": "8.6.2",
     "imageVersion": "2.2.0-common",
     "playwrightCliVersion": "0.1.19",
     "patchrightCoreVersion": "1.63.0",