codebee 0.1.95 → 0.1.97

package/app/core/mcp_client.py

@@ -17,15 +17,20 @@ name 用于工具名前缀（mcp__<name>__<tool>），必须 [a-z0-9_-]。
 from __future__ import annotations
 
 import json
+import hashlib
 import os
 import re
+import shutil
 import subprocess
+import sys
 import threading
 import time
+from pathlib import Path
 
 _LOCK = threading.RLock()
 _TOOLS_CACHE = {}          # server_key → (ts, tools)
 _TOOLS_TTL = 300.0
+_TOOLS_CONFIG_SHA = ""
 
 MAX_SERVERS = 4
 MAX_MCP_TOOLS = 24         # 全部服务器合计注入内置智能体的工具数上限
@@ -39,8 +44,10 @@ _CLIENT_INFO = {"name": "CodeBee", "version": "1.0"}
 
 def invalidate_tools_cache():
     """服务器配置变化后丢弃已发现工具（插件启停等场景调用）。"""
+    global _TOOLS_CONFIG_SHA
     with _LOCK:
         _TOOLS_CACHE.clear()
+        _TOOLS_CONFIG_SHA = ""
 
 
 def parse_servers(text):
@@ -70,18 +77,86 @@ def parse_servers(text):
         args = [str(a) for a in args][:16]
         env = item.get("env") if isinstance(item.get("env"), dict) else {}
         env = {str(k): str(v) for k, v in list(env.items())[:16]}
-        out.append({"name": name, "command": command, "args": args, "env": env})
+        disabled = item.get("disabled_tools")
+        if not isinstance(disabled, list):
+            disabled = []
+        disabled = list(dict.fromkeys(str(x).strip()[:120] for x in disabled
+                                      if str(x or "").strip()))[:200]
+        out.append({"name": name, "command": command, "args": args, "env": env,
+                    "disabled_tools": disabled})
     return out, None
 
 
+def _sandbox_launch(server, sandbox, workdir):
+    """Build an OS-isolated stdio server launch or refuse to spawn it.
+
+    MCP tools are arbitrary configured programs. On Linux they run under
+    bubblewrap with only declared roots mounted; platforms without an equivalent
+    backend fail closed. Runtime variables are synthetic/minimal unless explicitly
+    included in the task env allowlist.
+    """
+    from . import policy
+    if not sandbox or not workdir:
+        raise RuntimeError("MCP 调用缺少任务沙箱策略或工作目录，拒绝启动")
+    if os.name != "posix" or sys.platform == "darwin" or not shutil.which("bwrap"):
+        raise RuntimeError("MCP 服务尚无可用的 OS 隔离后端，拒绝启动")
+    root = Path(workdir).expanduser().resolve(strict=True)
+    normalized = policy.normalize_sandbox(sandbox, root)
+    roots = [Path(value).resolve(strict=True)
+             for value in normalized.get("allowed_roots") or []]
+    if not roots:
+        raise RuntimeError("MCP 沙箱没有允许目录，拒绝启动")
+    cwd = root if policy.path_allowed(root, normalized) else roots[0]
+    argv = _bubblewrap_argv(server, normalized, roots, cwd)
+    return argv, _sandbox_env(server, normalized), str(cwd)
+
+
+def _sandbox_env(server, sandbox):
+    """Pass only the minimal runtime environment and explicitly allowed values."""
+    env = {"PATH": os.environ.get("PATH", "/usr/bin:/bin"),
+           "HOME": "/tmp", "TMPDIR": "/tmp"}
+    for name in sandbox.get("env_allowlist") or []:
+        if name in os.environ:
+            env[name] = os.environ[name]
+        elif name in (server.get("env") or {}):
+            env[name] = str(server["env"][name])
+    return env
+
+
+def _bubblewrap_argv(server, sandbox, roots, cwd):
+    """Build bwrap argv from already validated paths (also host-testable)."""
+    argv = ["bwrap", "--die-with-parent", "--new-session", "--tmpfs", "/"]
+    for system_path in ("/usr", "/bin", "/sbin", "/lib", "/lib64", "/etc"):
+        if os.path.exists(system_path):
+            argv.extend(["--dir", system_path, "--ro-bind", system_path, system_path])
+    argv.extend(["--dir", "/proc", "--dir", "/dev", "--proc", "/proc",
+                 "--dev", "/dev", "--tmpfs", "/tmp"])
+    if sandbox.get("network") is False:
+        argv.append("--unshare-net")
+    for allowed_root in roots:
+        for parent in reversed(allowed_root.parents):
+            if str(parent) != "/":
+                argv.extend(["--dir", str(parent)])
+        argv.extend(["--dir", str(allowed_root), "--bind",
+                     str(allowed_root), str(allowed_root)])
+    argv.extend(["--chdir", str(cwd), "--", server["command"]]
+                + list(server.get("args") or []))
+    return argv
+
+
 class _Session:
     """一次性的 MCP 服务器会话：spawn → initialize → （list/call）→ 杀树。"""
 
-    def __init__(self, server):
+    def __init__(self, server, sandbox=None, workdir=None, timeout_s=None):
         self.server = server
+        self.sandbox = sandbox
+        self.workdir = workdir
+        self.timeout_s = timeout_s
+        self.deadline = None
         self.proc = None
         self.lines = None       # reader 线程产出的行队列
         self.err = None
+        self._reader_threads = []
 
     def _pump_err(self):
         try:
@@ -89,6 +164,11 @@ class _Session:
                 pass
         except Exception:
             pass
+        finally:
+            try:
+                self.proc.stderr.close()
+            except Exception:
+                pass
 
     def _pump_out(self):
         try:
@@ -97,25 +177,48 @@ class _Session:
         except Exception:
             pass
         finally:
+            try:
+                self.proc.stdout.close()
+            except Exception:
+                pass
             self.lines.put(None)      # EOF 哨兵
 
     def __enter__(self):
+        if self.timeout_s is not None:
+            self.deadline = time.monotonic() + max(0.0, float(self.timeout_s))
         try:
+            argv, env, cwd = _sandbox_launch(self.server, self.sandbox, self.workdir)
+            if self.deadline is not None and time.monotonic() >= self.deadline:
+                raise RuntimeError("MCP 任务时限已到，拒绝启动")
             self.proc = subprocess.Popen(
-                [self.server["command"]] + list(self.server.get("args") or []),
+                argv,
                 stdin=subprocess.PIPE, stdout=subprocess.PIPE,
                 stderr=subprocess.PIPE, text=False,
-                env={**os.environ, **(self.server.get("env") or {})})
+                env=env, cwd=cwd, start_new_session=True)
         except Exception as e:
             raise RuntimeError("MCP 服务器启动失败: %s" % e)
         import queue as _queue
         self.lines = _queue.Queue()
-        threading.Thread(target=self._pump_out, daemon=True).start()
-        threading.Thread(target=self._pump_err, daemon=True).start()
-        self._request("initialize", {
-            "protocolVersion": "2024-11-05", "capabilities": {},
-            "clientInfo": _CLIENT_INFO}, timeout=_INIT_TIMEOUT)
-        self._notify("notifications/initialized")
+        self._reader_threads = [
+            threading.Thread(target=self._pump_out, daemon=True),
+            threading.Thread(target=self._pump_err, daemon=True),
+        ]
+        for thread in self._reader_threads:
+            thread.start()
+        try:
+            init_timeout = _INIT_TIMEOUT
+            if self.deadline is not None:
+                init_timeout = min(init_timeout, self.deadline - time.monotonic())
+                if init_timeout <= 0:
+                    raise RuntimeError("MCP 任务时限已到，初始化未执行")
+            self._request("initialize", {
+                "protocolVersion": "2024-11-05", "capabilities": {},
+                "clientInfo": _CLIENT_INFO}, timeout=init_timeout)
+            self._notify("notifications/initialized")
+        except Exception:
+            # Context manager __exit__ is not called when __enter__ raises.
+            self.__exit__(None, None, None)
+            raise
         return self
 
     def __exit__(self, *exc):
@@ -125,12 +228,44 @@ class _Session:
                     self.proc.stdin.close()
                 except Exception:
                     pass
-        finally:
             try:
-                if self.proc:
+                if self.proc and self.proc.poll() is None:
+                    # bwrap runs in its own process group; terminate descendants
+                    # as well as the launcher so timed-out MCP servers cannot
+                    # leave background children holding pipes or doing work.
+                    try:
+                        from . import runner
+                        runner._kill_tree(self.proc.pid)
+                    except Exception:
+                        pass
                     self.proc.kill()
             except Exception:
                 pass
+            try:
+                if self.proc:
+                    self.proc.wait(timeout=1)
+            except Exception:
+                pass
+        finally:
+            # Close all parent-side pipe handles even if initialization failed.
+            # Do not close a stream while its reader is blocked in read(): the
+            # buffered stream lock can make close wait forever if an escaped
+            # descendant still holds the pipe open. Let daemon readers finish
+            # on EOF and close only streams no thread currently owns.
+            for thread in self._reader_threads:
+                try:
+                    thread.join(timeout=0.2)
+                except Exception:
+                    pass
+            for name in ("stdout", "stderr"):
+                pipe = getattr(self.proc, name, None) if self.proc else None
+                readers_alive = any(
+                    thread.is_alive() for thread in self._reader_threads)
+                if pipe and not readers_alive:
+                    try:
+                        pipe.close()
+                    except Exception:
+                        pass
         return False
 
     def _send(self, obj):
@@ -143,12 +278,17 @@ class _Session:
 
     def _request(self, method, params, timeout):
         """单请求单响应；忽略通知与未知 id 的服务端请求。"""
+        duration = max(0.0, float(timeout))
+        if self.deadline is not None:
+            duration = min(duration, self.deadline - time.monotonic())
+        if duration <= 0:
+            raise RuntimeError("%s 超时（任务时限已到）" % method)
         rid = id({})
         self._send({"jsonrpc": "2.0", "id": 1 if method == "initialize" else rid,
                     "method": method, "params": params or {}})
-        deadline = time.time() + max(1.0, timeout)
+        deadline = time.monotonic() + duration
         while True:
-            remain = deadline - time.time()
+            remain = deadline - time.monotonic()
             if remain <= 0:
                 raise RuntimeError("%s 超时（%.0fs）" % (method, timeout))
             try:
@@ -174,10 +314,10 @@ class _Session:
             return msg.get("result") or {}
 
 
-def list_tools(server):
+def list_tools(server, *, sandbox=None, workdir=None):
     """发现服务器工具。返回 {"ok", "tools":[{"name","description","input_schema"}], "error"}。"""
     try:
-        with _Session(server) as sess:
+        with _Session(server, sandbox=sandbox, workdir=workdir) as sess:
             res = sess._request("tools/list", {}, timeout=_INIT_TIMEOUT)
         tools = []
         for t in (res.get("tools") or [])[:16]:
@@ -192,11 +332,13 @@ def list_tools(server):
         return {"ok": False, "tools": [], "error": str(e)[:200]}
 
 
-def call_tool(server, tool_name, arguments, timeout_s=_CALL_TIMEOUT):
+def call_tool(server, tool_name, arguments, timeout_s=_CALL_TIMEOUT,
+              *, sandbox=None, workdir=None):
     """调用一个工具。返回 {"ok", "text", "error", "is_error"}。"""
     try:
-        timeout = min(_CALL_TIMEOUT_MAX, max(5.0, float(timeout_s or _CALL_TIMEOUT)))
-        with _Session(server) as sess:
+        timeout = min(_CALL_TIMEOUT_MAX, max(0.001, float(timeout_s or _CALL_TIMEOUT)))
+        with _Session(server, sandbox=sandbox, workdir=workdir,
+                      timeout_s=timeout) as sess:
             res = sess._request("tools/call",
                                 {"name": tool_name,
                                  "arguments": arguments if isinstance(arguments, dict) else {}},
@@ -216,46 +358,67 @@ def call_tool(server, tool_name, arguments, timeout_s=_CALL_TIMEOUT):
 
 # ---- 面向 builtin_agent 的合并视图（带缓存） ----
 
-def tool_specs_cached(force=False):
+def tool_specs_cached(force=False, *, sandbox=None, workdir=None):
     """全部服务器的工具合并清单：[{server, name(原名), full_name, description,
     input_schema}]。TTL 内走缓存；单个服务器失败跳过（error 挂在条目外不打断）。"""
+    global _TOOLS_CONFIG_SHA
+    if not sandbox or not workdir:
+        return []
+    config_text = _settings_text()
+    config_sha = hashlib.sha256(config_text.encode("utf-8")).hexdigest()
+    scope_sha = hashlib.sha256(json.dumps({
+        "workdir": os.path.realpath(workdir), "sandbox": sandbox,
+    }, sort_keys=True, default=str).encode("utf-8")).hexdigest()
     with _LOCK:
+        if config_sha != _TOOLS_CONFIG_SHA:
+            _TOOLS_CACHE.clear()
+            _TOOLS_CONFIG_SHA = config_sha
         if not force:
             hit = True
-            for key, (ts, _t) in _TOOLS_CACHE.items():
+            scoped = [(key, value) for key, value in _TOOLS_CACHE.items()
+                      if isinstance(key, tuple) and key[0] == scope_sha]
+            for key, (ts, _t) in scoped:
                 if time.time() - ts > _TOOLS_TTL:
                     hit = False
                     break
-            if hit and _TOOLS_CACHE:
+            if hit and scoped:
                 out = []
-                for _key, (_ts, tools) in _TOOLS_CACHE.items():
+                for _key, (_ts, tools) in scoped:
                     out.extend(tools)
                 return out[:MAX_MCP_TOOLS]
-    servers, err = parse_servers(_settings_text())
+    servers, err = parse_servers(config_text)
     if err or not servers:
         return []
+    from . import policy
+    disabled = set(policy.normalize_disabled_tools(
+        (sandbox or {}).get("disabled_tools")))
     out = []
     with _LOCK:
         _TOOLS_CACHE.clear()
     for srv in servers:
-        res = list_tools(srv)
+        res = list_tools(srv, sandbox=sandbox, workdir=workdir)
         if not res.get("ok"):
             continue
         specs = []
         for t in res["tools"]:
+            full_name = "mcp__%s__%s" % (srv["name"], t["name"])
+            if (t["name"] in srv.get("disabled_tools", [])
+                    or t["name"] in disabled or full_name in disabled):
+                continue
             specs.append({"server": srv["name"], "name": t["name"],
-                          "full_name": "mcp__%s__%s" % (srv["name"], t["name"]),
+                          "full_name": full_name,
                           "description": t["description"],
                           "input_schema": t["input_schema"]})
         with _LOCK:
-            _TOOLS_CACHE[srv["name"]] = (time.time(), specs)
+            _TOOLS_CACHE[(scope_sha, srv["name"])] = (time.time(), specs)
         out.extend(specs)
         if len(out) >= MAX_MCP_TOOLS:
             break
     return out[:MAX_MCP_TOOLS]
 
 
-def dispatch_full_name(full_name, arguments, timeout_s=_CALL_TIMEOUT):
+def dispatch_full_name(full_name, arguments, timeout_s=_CALL_TIMEOUT, *,
+                       sandbox=None, workdir=None, disabled_tools=None):
     """mcp__<server>__<tool> → 找服务器配置并调用。返回 {"ok","text","error"}。"""
     m = re.match(r"^mcp__([a-z0-9_-]{1,24})__(.+)$", str(full_name or ""))
     if not m:
@@ -267,7 +430,15 @@ def dispatch_full_name(full_name, arguments, timeout_s=_CALL_TIMEOUT):
     srv = next((s for s in servers if s["name"] == sname), None)
     if not srv:
         return {"ok": False, "text": "", "error": "MCP 服务器 %s 未配置" % sname}
-    return call_tool(srv, tool, arguments, timeout_s=timeout_s)
+    if tool in (srv.get("disabled_tools") or []):
+        return {"ok": False, "text": "", "error": "MCP 工具已禁用: %s" % full_name}
+    if (full_name in set(str(x) for x in (disabled_tools or []))
+            or tool in set(str(x) for x in (disabled_tools or []))):
+        return {"ok": False, "text": "", "error": "任务策略已禁用 MCP 工具: %s" % full_name}
+    if sandbox is None or not workdir:
+        return {"ok": False, "text": "", "error": "MCP 调用缺少任务沙箱策略或工作目录，拒绝启动"}
+    return call_tool(srv, tool, arguments, timeout_s=timeout_s,
+                     sandbox=sandbox, workdir=workdir)
 
 
 _SETTINGS_TEXT = None     # main.py 启动注入（读 settings.mcp_servers）——本模块

package/app/core/mocks.py

@@ -1,64 +1,64 @@
-# -*- coding: utf-8 -*-
-"""内置演示/测试智能体（mock）：不消耗任何配额即可跑通全流程。"""
-from __future__ import annotations
-
-import hashlib
-
-
-def _seed(agent_id):
-    return int(hashlib.sha256(agent_id.encode("utf-8")).hexdigest()[:6], 16)
-
-
-def draft_manuscript(task, round_no):
-    """生成一份示例稿件（mock 起草/修订直接落盘的内容）。"""
-    title = task.get("title") or "未命名章节"
-    goal = task.get("goal") or ""
-    return (
-        "# {title}\n\n"
-        "这是第 {r} 轮 mock 草稿（演示用，不消耗模型配额）。\n\n"
-        "## 任务目标\n{goal}\n\n"
-        "## 正文\n"
-        "夜色沿着山脊线缓慢退去，主角终于看清了石门上的刻痕——那不是文字，"
-        "而是一段被反复涂抹又反复显影的名字。他伸手触碰的瞬间，耳边响起的"
-        "却是自己昨夜说过的话。{extra}\n\n"
-        "（本轮修订关注：{focus}）\n"
-    ).format(
-        title=title, r=round_no, goal=goal,
-        extra="这一段在第 2 轮修订中补充了人物动机的伏笔。" if round_no >= 2 else "",
-        focus="节奏与悬念铺排" if round_no == 1 else "人物弧光与首尾呼应",
-    )
-
-
-def implement_note(task):
-    return "（mock 实现）已在目标目录写入 mock-impl.txt 作为变更占位。"
-
-
-def critique(agent_id, round_no, dims, threshold):
-    """确定性评分：第 1 轮略低于阈值，第 2 轮达标，用于验证发布门禁逻辑。"""
-    s = _seed(agent_id)
-    scores = {}
-    for i, d in enumerate(dims):
-        jitter = ((s >> i) % 5) * 0.1
-        scores[d] = round(min(9.5, 4.8 + 1.2 * round_no + jitter), 1)
-    passed = all(v >= threshold for v in scores.values())
-    issues = []
-    if round_no == 1:
-        issues = [
-            {"dim": dims[0], "severity": "major", "note": "开篇信息密度偏低，钩子出现太晚（mock 意见）"},
-            {"dim": dims[-1], "severity": "minor", "note": "段落长短交替不够，读感偏平（mock 意见）"},
-        ]
-    return {
-        "scores": scores,
-        "issues": issues,
-        "summary": "mock 总评：第 %d 轮稿件%s发布阈值" % (round_no, "已达到" if passed else "尚未达到"),
-    }
-
-
-def review(task, verify_passed):
-    return {
-        "pass": bool(verify_passed),
-        "scores": {"正确性": 8.0 if verify_passed else 5.0, "可维护性": 8.0, "安全": 8.5},
-        "issues": [] if verify_passed else [
-            {"severity": "major", "title": "验证命令未通过", "detail": "请检查测试输出（mock 意见）"}],
-        "summary": "mock 代码评审：%s" % ("通过" if verify_passed else "未通过"),
-    }
+# -*- coding: utf-8 -*-
+"""内置演示/测试智能体（mock）：不消耗任何配额即可跑通全流程。"""
+from __future__ import annotations
+
+import hashlib
+
+
+def _seed(agent_id):
+    return int(hashlib.sha256(agent_id.encode("utf-8")).hexdigest()[:6], 16)
+
+
+def draft_manuscript(task, round_no):
+    """生成一份示例稿件（mock 起草/修订直接落盘的内容）。"""
+    title = task.get("title") or "未命名章节"
+    goal = task.get("goal") or ""
+    return (
+        "# {title}\n\n"
+        "这是第 {r} 轮 mock 草稿（演示用，不消耗模型配额）。\n\n"
+        "## 任务目标\n{goal}\n\n"
+        "## 正文\n"
+        "夜色沿着山脊线缓慢退去，主角终于看清了石门上的刻痕——那不是文字，"
+        "而是一段被反复涂抹又反复显影的名字。他伸手触碰的瞬间，耳边响起的"
+        "却是自己昨夜说过的话。{extra}\n\n"
+        "（本轮修订关注：{focus}）\n"
+    ).format(
+        title=title, r=round_no, goal=goal,
+        extra="这一段在第 2 轮修订中补充了人物动机的伏笔。" if round_no >= 2 else "",
+        focus="节奏与悬念铺排" if round_no == 1 else "人物弧光与首尾呼应",
+    )
+
+
+def implement_note(task):
+    return "（mock 实现）已在目标目录写入 mock-impl.txt 作为变更占位。"
+
+
+def critique(agent_id, round_no, dims, threshold):
+    """确定性评分：第 1 轮略低于阈值，第 2 轮达标，用于验证发布门禁逻辑。"""
+    s = _seed(agent_id)
+    scores = {}
+    for i, d in enumerate(dims):
+        jitter = ((s >> i) % 5) * 0.1
+        scores[d] = round(min(9.5, 4.8 + 1.2 * round_no + jitter), 1)
+    passed = all(v >= threshold for v in scores.values())
+    issues = []
+    if round_no == 1:
+        issues = [
+            {"dim": dims[0], "severity": "major", "note": "开篇信息密度偏低，钩子出现太晚（mock 意见）"},
+            {"dim": dims[-1], "severity": "minor", "note": "段落长短交替不够，读感偏平（mock 意见）"},
+        ]
+    return {
+        "scores": scores,
+        "issues": issues,
+        "summary": "mock 总评：第 %d 轮稿件%s发布阈值" % (round_no, "已达到" if passed else "尚未达到"),
+    }
+
+
+def review(task, verify_passed):
+    return {
+        "pass": bool(verify_passed),
+        "scores": {"正确性": 8.0 if verify_passed else 5.0, "可维护性": 8.0, "安全": 8.5},
+        "issues": [] if verify_passed else [
+            {"severity": "major", "title": "验证命令未通过", "detail": "请检查测试输出（mock 意见）"}],
+        "summary": "mock 代码评审：%s" % ("通过" if verify_passed else "未通过"),
+    }