chainlesschain 0.166.78 → 0.166.80

package/src/runtime/agent-core.js

@@ -3398,8 +3398,23 @@ export async function executeTool(name, args, context = {}) {
         throw error;
       }
       const initialDigest = digestPolicyAuthority(initialProjection);
+      const dockerSandboxDigest =
+        context.sandbox?.engine === "docker-egress"
+          ? digestPolicyAuthority(context.sandbox)
+          : null;
       shellDispatchPolicyAuthority = Object.freeze({
         policyVersion: `cc-shell-policy-authority/v1:${initialDigest}`,
+        revalidateDockerSandbox() {
+          if (
+            !dockerSandboxDigest ||
+            digestPolicyAuthority(liveExecutionContext.sandbox || null) !==
+              dockerSandboxDigest
+          ) {
+            const error = new Error("Docker egress sandbox authority changed");
+            error.code = "CC_SHELL_POLICY_AUTHORITY_CHANGED";
+            throw error;
+          }
+        },
         async revalidate() {
           try {
             if (
@@ -6637,34 +6652,59 @@ async function executeToolInner(
           );
         }
         await admitShellDispatch();
-        const { executeSandboxedShell, sandboxSummary } =
-          await import("../lib/agent-sandbox.js");
-        // Domain-restricted networking is ENFORCED by routing the sandboxed
-        // process's egress through a local filtering proxy (see
-        // sandbox-egress-proxy.js). Start it only when the policy actually
-        // restricts domains and network is on; tear it down after the command.
+        const {
+          assessAgentSandboxCapabilities,
+          executeDockerEgressShell,
+          executeSandboxedShell,
+          sandboxSummary,
+        } = await import("../lib/agent-sandbox.js");
+        // Keep the proxy on a separate event loop for legacy synchronous
+        // dispatch. The Docker egress route uses an asynchronous session.
         const sboxPolicy = shellSandbox.policy || {};
         const needsEgress =
           shellSandbox.network === true &&
           (sboxPolicy.allowedDomains?.length || 0) +
             (sboxPolicy.deniedDomains?.length || 0) >
             0;
+        const dockerEgress = shellSandbox.engine === "docker-egress";
         let egressProxy = null;
         let proxyHandle = null;
+        let privateSocketDir = null;
+        let dockerEgressSession = null;
+        let proxyFailed = false;
+        let authorityMonitor = null;
         if (needsEgress) {
           try {
-            const { createEgressProxy } =
-              await import("../lib/sandbox-egress-proxy.js");
-            proxyHandle = createEgressProxy(
+            const { startEgressProxyWorker } =
+              await import("../lib/sandbox-egress-worker.js");
+            if (dockerEgress) {
+              privateSocketDir = fs.mkdtempSync(
+                path.join(os.tmpdir(), "cc-egress-"),
+              );
+              fs.chmodSync(privateSocketDir, 0o700);
+            }
+            proxyHandle = await startEgressProxyWorker(
               {
                 allowedDomains: sboxPolicy.allowedDomains || [],
                 deniedDomains: sboxPolicy.deniedDomains || [],
                 allowPrivate: sboxPolicy.allowPrivate === true,
               },
-              { bindHost: "0.0.0.0" }, // reachable from the container/netns
+              {
+                bindHost: "127.0.0.1",
+                ...(privateSocketDir
+                  ? { socketPath: path.join(privateSocketDir, "broker.sock") }
+                  : {}),
+                onFailure() {
+                  proxyFailed = true;
+                  authorityMonitor?.revoke(
+                    Object.assign(new Error("Docker egress broker failed"), {
+                      code: "CC_DOCKER_EGRESS_BROKER_FAILED",
+                    }),
+                  );
+                },
+              },
             );
-            const listened = await proxyHandle.listen();
-            egressProxy = { port: listened.port };
+            if (proxyHandle.port) egressProxy = { port: proxyHandle.port };
           } catch {
             // If the proxy can't start, leave egressProxy null so the sandbox
             // fails closed (refuses) rather than running without enforcement.
@@ -6675,10 +6715,39 @@ async function executeToolInner(
         let result;
         try {
           // Proxy startup and dynamic imports are asynchronous. Re-read the
-          // live authority once more after they settle and immediately before
-          // the synchronous sandbox dispatch.
-          await shellDispatchPolicyAuthority?.revalidate?.();
-          refreshPluginExecutionAuthority();
+          // live authority after they settle and before sandbox dispatch.
+          if (dockerEgress && proxyHandle?.socketPath) {
+            const { createDockerEgressAuthorityMonitor } =
+              await import("../lib/sandbox-egress-authority-monitor.js");
+            authorityMonitor = createDockerEgressAuthorityMonitor({
+              async revalidate() {
+                await shellDispatchPolicyAuthority?.revalidate?.();
+                shellDispatchPolicyAuthority?.revalidateDockerSandbox?.();
+                refreshPluginExecutionAuthority();
+                if (pluginBinSandboxPolicy) {
+                  const error = new Error(
+                    "A plugin sandbox authority appeared while Docker egress was running",
+                  );
+                  error.code = "ERR_PLUGIN_BIN_SANDBOX_ROUTE_CONFLICT";
+                  error.pluginBinFailClosed = true;
+                  throw error;
+                }
+                if (proxyFailed || proxyHandle.revision !== 0) {
+                  const error = new Error(
+                    "Docker egress authority changed during execution",
+                  );
+                  error.code = "CC_DOCKER_EGRESS_AUTHORITY_CHANGED";
+                  throw error;
+                }
+              },
+              abortProxy: () => proxyHandle.abort(),
+            });
+            authorityMonitor.start();
+            await authorityMonitor.checkNow();
+          } else {
+            await shellDispatchPolicyAuthority?.revalidate?.();
+            refreshPluginExecutionAuthority();
+          }
           if (pluginBinSandboxPolicy) {
             const error = new Error(
               "A plugin sandbox authority appeared while the legacy shell sandbox was starting",
@@ -6687,15 +6756,64 @@ async function executeToolInner(
             error.pluginBinFailClosed = true;
             throw error;
           }
-          result = executeSandboxedShell(args.command, shellSandbox, {
-            cwd: args.cwd || cwd,
-            timeout: _resolveShellTimeout(args.timeout),
-            maxBuffer: 1024 * 1024,
-            egressProxy,
-            env: sandboxChildEnvironment,
-            auditContext: createShellProcessAuditContext(),
-          });
+          if (dockerEgress && !proxyHandle?.socketPath) {
+            result = {
+              stdout: "",
+              stderr: "Docker egress policy broker is unavailable",
+              exitCode: 1,
+              failedToStart: true,
+              sandboxCapabilities: assessAgentSandboxCapabilities(
+                shellSandbox,
+                {
+                  execution: { attempted: true, started: false },
+                  availability: {
+                    available: false,
+                    reason: "egress-broker-unavailable",
+                  },
+                },
+              ),
+            };
+          } else if (dockerEgress) {
+            result = await executeDockerEgressShell(
+              args.command,
+              shellSandbox,
+              {
+                cwd: args.cwd || cwd,
+                timeoutMs: _resolveShellTimeout(args.timeout),
+                brokerSocketPath: proxyHandle.socketPath,
+                env: sandboxChildEnvironment,
+                auditContext: createShellProcessAuditContext(),
+                onSession(session) {
+                  dockerEgressSession = session;
+                  authorityMonitor.attachSession(session);
+                },
+                async beforeStart() {
+                  await authorityMonitor.checkFresh();
+                  authorityMonitor.assertAuthorized();
+                },
+                beforeReceipt: () => authorityMonitor.finish(),
+              },
+            );
+          } else {
+            result = executeSandboxedShell(args.command, shellSandbox, {
+              cwd: args.cwd || cwd,
+              timeout: _resolveShellTimeout(args.timeout),
+              maxBuffer: 1024 * 1024,
+              egressProxy,
+              env: sandboxChildEnvironment,
+              auditContext: createShellProcessAuditContext(),
+            });
+          }
         } finally {
+          authorityMonitor?.stop();
+          await authorityMonitor?.awaitCleanup();
+          if (dockerEgressSession) {
+            try {
+              await dockerEgressSession.close();
+            } catch {
+              /* execution result retains its cleanup status */
+            }
+          }
           if (proxyHandle) {
             try {
               await proxyHandle.close();
@@ -6703,10 +6821,52 @@ async function executeToolInner(
               /* best-effort teardown */
             }
           }
+          if (privateSocketDir) {
+            try {
+              fs.rmSync(path.join(privateSocketDir, "broker.sock"), {
+                force: true,
+              });
+              fs.rmdirSync(privateSocketDir);
+            } catch {
+              /* a failed broker cleanup remains visible via failed-to-start */
+            }
+          }
+        }
+        if (dockerEgress && authorityMonitor?.revocationError) {
+          const revoked = authorityMonitor.revocationError;
+          result.authorityFailure = {
+            code: revoked.code || "CC_DOCKER_EGRESS_AUTHORITY_CHANGED",
+            ...(revoked.cleanupError ? { cleanupFailed: true } : {}),
+          };
+          if (result.exitCode === 0) {
+            result = {
+              ...result,
+              exitCode: 1,
+              stderr:
+                "Docker egress authority was revoked; execution outcome must not be retried automatically.",
+              executionOutcome: "completed-cleanup-unknown",
+              retrySafe: false,
+              sandboxCapabilities: assessAgentSandboxCapabilities(
+                shellSandbox,
+                {
+                  execution: { attempted: true, outcomeUnknown: true },
+                },
+              ),
+            };
+          }
         }
         const common = {
           sandbox: sandboxSummary(shellSandbox),
           sandboxCapabilities: result.sandboxCapabilities || null,
+          ...(result.executionOutcome
+            ? {
+                executionOutcome: result.executionOutcome,
+                retrySafe: result.retrySafe,
+              }
+            : {}),
+          ...(result.authorityFailure
+            ? { authorityFailure: result.authorityFailure }
+            : {}),
           shellCommandPolicy: shellPolicy,
           approval: approvalOutcome,
           policyTrace: ["shell-policy", "approval", "sandbox"],
@@ -11740,7 +11900,33 @@ export async function chatWithTools(rawMessages, options) {
     throw new Error("Invalid API response: no choices returned");
   }
   const choice = data.choices[0];
-  const out = { message: choice.message };
+  const providerMessage = choice.message;
+  if (
+    !providerMessage ||
+    typeof providerMessage !== "object" ||
+    Array.isArray(providerMessage) ||
+    providerMessage.role !== "assistant" ||
+    (providerMessage.content !== null &&
+      providerMessage.content !== undefined &&
+      typeof providerMessage.content !== "string") ||
+    (Object.hasOwn(providerMessage, "tool_calls") &&
+      !Array.isArray(providerMessage.tool_calls)) ||
+    (Object.hasOwn(providerMessage, "reasoning_content") &&
+      providerMessage.reasoning_content !== null &&
+      typeof providerMessage.reasoning_content !== "string") ||
+    Object.keys(providerMessage).some(
+      (key) =>
+        !["role", "content", "tool_calls", "reasoning_content"].includes(key),
+    )
+  ) {
+    throw new TypeError("Invalid API response: unsupported assistant message");
+  }
+  // Provider reasoning text is not part of the governed replay protocol.
+  const message = { role: "assistant", content: providerMessage.content };
+  if (Object.hasOwn(providerMessage, "tool_calls")) {
+    message.tool_calls = providerMessage.tool_calls;
+  }
+  const out = { message };
   const providerReceipt = supportsOpenAIRequestIdentity
     ? _openAIProviderRequestReceipt(response, data, providerRequestId)
     : null;

package/src/assets/web-panel/assets/EvolutionSettings-D75_iBoc.js

@@ -1 +0,0 @@
-import{I as r,J as T,U as c,c as a,K as o,S as I,V as C,o as M,r as k,a as V,b as L,P as R,Q as d,R as m,F,Z as H}from"./vendor-Bn1JzzAn.js";import{_ as J,u as N,d as i}from"./index-CLUa68JH.js";import{R as W}from"./icons-DG5UD-6K.js";function B(P){return["ask","agent"].map(t=>{const n=P?.readiness?.[t],e=n?.state==="admitted",f=n?.scope==="deployment-admission"&&n.runtimeVerification==="not_checked"&&Array.isArray(n.requiredCommands)&&n.requiredCommands.includes(t)&&(e?n.ready===!0&&n.taskReady===null:["not_configured","disabled","invalid","command_not_allowed"].includes(n.state)&&n.ready===!1&&n.taskReady===!1);return{command:t,state:f?n.state:"unknown",summary:f?e?"部署准入通过":"部署准入被阻断":"未提供准入诊断",detail:f&&typeof n.detail=="string"?n.detail:"当前 CLI 未提供可识别的部署准入诊断，请更新 CLI。",remediation:f&&typeof n.remediation=="string"?n.remediation:""}})}function U(P,t){for(const n of Object.keys(P))delete P[n];Object.assign(P,{source:"none",effectiveEnabled:!1,profileEnabled:!1,verified:!1,commands:[],readiness:null},t||{})}const A={__name:"EvolutionSettings",setup(P,{expose:t}){t();const n=N(),e=k(!1),f=k(!1),S=k(!1),p=k(!1),w=k(!1),g=k(""),_=k(""),E=k(""),v=V({source:"none",effectiveEnabled:!1,profileEnabled:!1,verified:!1,commands:[]}),x=L(()=>e.value||f.value||S.value||p.value||w.value),h=L(()=>B(v));function b(s){U(v,s),_.value=v.descriptorPath||"",E.value=v.trustRootPath||"",g.value=v.modulePath||g.value||""}async function u(s,z=3e4){return await n.waitConnected(8e3),(await n.sendRaw(s,z)).result}async function y(){e.value=!0;try{b(await u({type:"evolution.deployment.status"}))}catch(s){i.error("读取配置失败："+s.message)}finally{e.value=!1}}async function O(){if(!_.value.trim()||!E.value.trim()){i.warning("请填写描述符和信任根公钥的绝对路径");return}f.value=!0;try{b(await u({type:"evolution.deployment.configure",descriptorPath:_.value.trim(),trustRootPath:E.value.trim()},6e4)),i.success("签名校验通过，配置已保存并启用；自动发布仍为 HOLD")}catch(s){i.error("配置失败："+s.message)}finally{f.value=!1}}async function D(){if(!g.value.trim()){i.warning("请填写测试部署宿主模块的服务器绝对路径");return}p.value=!0;try{b(await u({type:"evolution.deployment.init-test",modulePath:g.value.trim()},6e4)),i.success("TEST 测试开发环境已生成并启用；禁止用于生产")}catch(s){i.error("生成测试环境失败："+s.message)}finally{p.value=!1}}async function l(){if(!_.value.trim()||!E.value.trim()){i.warning("请填写正式描述符和正式信任根公钥的绝对路径");return}w.value=!0;try{b(await u({type:"evolution.deployment.replace-test",descriptorPath:_.value.trim(),trustRootPath:E.value.trim()},6e4)),i.success("测试根已安全轮换为正式受管证书；请重启 cc ui、IDE 或 Desktop 长驻进程后做正式验证")}catch(s){i.error("替换失败："+s.message)}finally{w.value=!1}}async function q(){S.value=!0;try{b(await u({type:"evolution.deployment.set-enabled",enabled:!v.profileEnabled})),i.success(v.profileEnabled?"已启用":"已停用")}catch(s){i.error("更新失败："+s.message)}finally{S.value=!1}}M(y);const j={ws:n,loading:e,saving:f,toggling:S,initializingTest:p,replacingTest:w,modulePath:g,descriptorPath:_,trustRootPath:E,status:v,busy:x,readinessRows:h,apply:b,request:u,loadStatus:y,save:O,initTest:D,replaceTest:l,toggle:q,computed:L,onMounted:M,reactive:V,ref:k,get ReloadOutlined(){return W},get message(){return i},get useWsStore(){return N},get deploymentReadinessRows(){return B},get replaceDeploymentStatus(){return U}};return Object.defineProperty(j,"__isScriptSetup",{enumerable:!1,value:!0}),j}},K={class:"page-head"},Q={class:"mono"},Z={class:"mono"},G={class:"admission-status","aria-live":"polite"},X=["data-admission-command"],Y={class:"mono"},$={key:0,class:"mono"};function ee(P,t,n,e,f,S){const p=r("a-button"),w=r("a-alert"),g=r("a-input"),_=r("a-form-item"),E=r("a-divider"),v=r("a-space"),x=r("a-form"),h=r("a-card"),b=r("a-col"),u=r("a-tag"),y=r("a-descriptions-item"),O=r("a-descriptions"),D=r("a-row");return R(),T("div",null,[c("div",K,[t[4]||(t[4]=c("div",null,[c("h2",{class:"page-title"},"Skill 自进化配置"),c("p",{class:"page-sub"},"统一配置受治理部署；CLI、IDE 插件与 cc ui 共享。")],-1)),a(p,{loading:e.loading,onClick:e.loadStatus},{icon:o(()=>[a(e.ReloadOutlined)]),default:o(()=>[t[3]||(t[3]=d("刷新 ",-1))]),_:1},8,["loading"])]),a(w,{message:"不会开启自动发布",description:"此开关只启用经过签名的 Skill 自进化运行时。候选项进入 active 前仍需人工审核，自动发布始终保持 HOLD。",type:"warning","show-icon":"",class:"notice"}),e.status.deploymentMode==="test"?(R(),I(w,{key:0,message:"当前为 TEST 测试开发环境",description:"本机自动生成的测试密钥不能用于生产。正式 descriptor 和 trust root 到位后，请使用下方“一键替换测试证书并转正式”。",type:"error","show-icon":"",class:"notice"})):C("v-if",!0),a(D,{gutter:16},{default:o(()=>[a(b,{xs:24,xl:15},{default:o(()=>[a(h,{title:"上线前测试与正式部署",class:"panel-card"},{default:o(()=>[a(x,{layout:"vertical"},{default:o(()=>[a(_,{label:"测试部署宿主模块"},{extra:o(()=>[...t[5]||(t[5]=[d("首次填写后点击一次即可生成 Ed25519 测试密钥、签名描述符并启用；宿主模块修改后再次点击可刷新。",-1)])]),default:o(()=>[a(g,{value:e.modulePath,"onUpdate:value":t[0]||(t[0]=l=>e.modulePath=l),disabled:e.busy,placeholder:"运行 cc ui 的机器上 deployment host .mjs/.js 的绝对路径"},null,8,["value","disabled"])]),_:1}),a(p,{type:"primary",loading:e.initializingTest,onClick:e.initTest},{default:o(()=>[...t[6]||(t[6]=[d("一键生成/刷新测试环境",-1)])]),_:1},8,["loading"]),a(E),a(_,{label:"签名部署描述符"},{extra:o(()=>[...t[7]||(t[7]=[d("Web 页面不能读取本机文件选择器，请填写运行 cc ui 的机器上的绝对路径。",-1)])]),default:o(()=>[a(g,{value:e.descriptorPath,"onUpdate:value":t[1]||(t[1]=l=>e.descriptorPath=l),disabled:e.busy,placeholder:"deployment descriptor JSON 的服务器绝对路径"},null,8,["value","disabled"])]),_:1}),a(_,{label:"Ed25519 信任根公钥"},{default:o(()=>[a(g,{value:e.trustRootPath,"onUpdate:value":t[2]||(t[2]=l=>e.trustRootPath=l),disabled:e.busy,placeholder:"信任根 public key 的服务器绝对路径"},null,8,["value","disabled"])]),_:1}),a(v,null,{default:o(()=>[a(p,{type:"primary",loading:e.saving,onClick:e.save},{default:o(()=>[...t[8]||(t[8]=[d("校验、保存并启用",-1)])]),_:1},8,["loading"]),a(p,{danger:e.status.profileEnabled,disabled:!e.status.descriptorPath,loading:e.toggling,onClick:e.toggle},{default:o(()=>[d(m(e.status.profileEnabled?"停用":"启用"),1)]),_:1},8,["danger","disabled","loading"]),e.status.deploymentMode==="test"?(R(),I(p,{key:0,loading:e.replacingTest,onClick:e.replaceTest},{default:o(()=>[...t[9]||(t[9]=[d("一键替换测试证书并转正式",-1)])]),_:1},8,["loading"])):C("v-if",!0)]),_:1})]),_:1})]),_:1})]),_:1}),a(b,{xs:24,xl:9},{default:o(()=>[a(h,{title:"治理状态",class:"panel-card status-card"},{default:o(()=>[a(O,{column:1,size:"small"},{default:o(()=>[a(y,{label:"部署模式"},{default:o(()=>[a(u,{color:e.status.deploymentMode==="test"?"red":"blue"},{default:o(()=>[d(m(e.status.deploymentMode==="test"?"TEST（仅限上线前联调）":e.status.deploymentMode||"none"),1)]),_:1},8,["color"])]),_:1}),a(y,{label:"生效状态"},{default:o(()=>[a(u,{color:e.status.effectiveEnabled?"green":"default"},{default:o(()=>[d(m(e.status.effectiveEnabled?"已启用":"未启用"),1)]),_:1},8,["color"])]),_:1}),a(y,{label:"生效来源"},{default:o(()=>[d(m(e.status.source||"none"),1)]),_:1}),a(y,{label:"签名校验"},{default:o(()=>[a(u,{color:e.status.verified?"green":"red"},{default:o(()=>[d(m(e.status.verified?"已通过":"未通过"),1)]),_:1},8,["color"])]),_:1}),a(y,{label:"自动发布"},{default:o(()=>[a(u,{color:"orange"},{default:o(()=>[...t[10]||(t[10]=[d("HOLD",-1)])]),_:1})]),_:1}),a(y,{label:"配置文件"},{default:o(()=>[c("span",Q,m(e.status.profilePath||"—"),1)]),_:1}),a(y,{label:"允许命令"},{default:o(()=>[c("span",Z,m((e.status.commands||[]).join(", ")||"—"),1)]),_:1})]),_:1}),c("section",G,[t[11]||(t[11]=c("h3",null,"模型命令部署准入",-1)),t[12]||(t[12]=c("p",null,"这里只检查部署准入，实际任务运行尚未验证。",-1)),(R(!0),T(F,null,H(e.readinessRows,l=>(R(),T("div",{key:l.command,"data-admission-command":l.command},[c("strong",null,m(l.command)+"："+m(l.summary),1),c("p",Y,m(l.detail),1),l.remediation?(R(),T("p",$,m(l.remediation),1)):C("v-if",!0)],8,X))),128))]),e.status.error?(R(),I(w,{key:0,message:e.status.error,type:"error","show-icon":"",class:"error"},null,8,["message"])):C("v-if",!0)]),_:1})]),_:1})]),_:1})])}const le=J(A,[["render",ee],["__scopeId","data-v-5a42105e"],["__file","/tmp/cc-web-panel-IFJ857/repo/packages/web-panel/src/views/EvolutionSettings.vue"]]);export{le as default};

package/src/assets/web-panel/assets/devWarning-DaEBln_q.js

@@ -1 +0,0 @@
-import{Q as r}from"./index-CLUa68JH.js";const o=((n,a,e)=>{r(n,`[ant-design-vue: ${a}] ${e}`)});export{o as d};

package/src/assets/web-panel/assets/index-DG1mcYTa.js

@@ -1 +0,0 @@
-import{A as o}from"./Row-D6nf9-c-.js";import{a0 as t}from"./index-CLUa68JH.js";import"./vendor-Bn1JzzAn.js";import"./responsiveObserve-AJK3SLzJ.js";import"./useFlexGapSupport-Dq7N6R05.js";import"./styleChecker-BPyFfTuR.js";import"./index-Dj3K5kHs.js";import"./icons-DG5UD-6K.js";const l=t(o);export{l as default};

package/src/assets/web-panel/assets/index-DRs5Pe8u.js

@@ -1 +0,0 @@
-import{C as o}from"./Col-DmiRHy96.js";import{a0 as t}from"./index-CLUa68JH.js";import"./vendor-Bn1JzzAn.js";import"./index-Dj3K5kHs.js";import"./icons-DG5UD-6K.js";const s=t(o);export{s as default};