AstrBot 4.12.4__py3-none-any.whl → 4.13.0__py3-none-any.whl

astrbot/dashboard/routes/config.py

@@ -2,6 +2,7 @@ import asyncio
 import inspect
 import os
 import traceback
+from pathlib import Path
 from typing import Any
 
 from quart import request
@@ -20,11 +21,22 @@ from astrbot.core.core_lifecycle import AstrBotCoreLifecycle
 from astrbot.core.platform.register import platform_cls_map, platform_registry
 from astrbot.core.provider import Provider
 from astrbot.core.provider.register import provider_registry
-from astrbot.core.star.star import star_registry
+from astrbot.core.star.star import StarMetadata, star_registry
+from astrbot.core.utils.astrbot_path import (
+    get_astrbot_plugin_data_path,
+)
 from astrbot.core.utils.llm_metadata import LLM_METADATAS
 from astrbot.core.utils.webhook_utils import ensure_platform_webhook_config
 
 from .route import Response, Route, RouteContext
+from .util import (
+    config_key_to_folder,
+    get_schema_item,
+    normalize_rel_path,
+    sanitize_filename,
+)
+
+MAX_FILE_BYTES = 500 * 1024 * 1024
 
 
 def try_cast(value: Any, type_: str):
@@ -106,6 +118,32 @@ def validate_config(data, schema: dict, is_core: bool) -> tuple[list[str], dict]
                 _validate_template_list(value, meta, f"{path}{key}", errors, validate)
                 continue
 
+            if meta["type"] == "file":
+                if not _expect_type(value, list, f"{path}{key}", errors, "list"):
+                    continue
+                for idx, item in enumerate(value):
+                    if not isinstance(item, str):
+                        errors.append(
+                            f"Invalid type {path}{key}[{idx}]: expected string, got {type(item).__name__}",
+                        )
+                        continue
+                    normalized = normalize_rel_path(item)
+                    if not normalized or not normalized.startswith("files/"):
+                        errors.append(
+                            f"Invalid file path {path}{key}[{idx}]: {item}",
+                        )
+                        continue
+                    key_path = f"{path}{key}"
+                    expected_folder = config_key_to_folder(key_path)
+                    expected_prefix = f"files/{expected_folder}/"
+                    if not normalized.startswith(expected_prefix):
+                        errors.append(
+                            f"Invalid file path {path}{key}[{idx}]: {item}",
+                        )
+                        continue
+                    value[idx] = normalized
+                continue
+
             if meta["type"] == "list" and not isinstance(value, list):
                 errors.append(
                     f"错误的类型 {path}{key}: 期望是 list, 得到了 {type(value).__name__}",
@@ -218,6 +256,9 @@ class ConfigRoute(Route):
             "/config/default": ("GET", self.get_default_config),
             "/config/astrbot/update": ("POST", self.post_astrbot_configs),
             "/config/plugin/update": ("POST", self.post_plugin_configs),
+            "/config/file/upload": ("POST", self.upload_config_file),
+            "/config/file/delete": ("POST", self.delete_config_file),
+            "/config/file/get": ("GET", self.get_config_file_list),
             "/config/platform/new": ("POST", self.post_new_platform),
             "/config/platform/update": ("POST", self.post_update_platform),
             "/config/platform/delete": ("POST", self.post_delete_platform),
@@ -876,6 +917,193 @@ class ConfigRoute(Route):
         except Exception as e:
             return Response().error(str(e)).__dict__
 
+    def _get_plugin_metadata_by_name(self, plugin_name: str) -> StarMetadata | None:
+        for plugin_md in star_registry:
+            if plugin_md.name == plugin_name:
+                return plugin_md
+        return None
+
+    def _resolve_config_file_scope(
+        self,
+    ) -> tuple[str, str, str, StarMetadata, AstrBotConfig]:
+        """将请求参数解析为一个明确的配置作用域。
+
+        当前支持的 scope：
+        - scope=plugin：name=<plugin_name>，key=<config_key_path>
+        """
+
+        scope = request.args.get("scope") or "plugin"
+        name = request.args.get("name")
+        key_path = request.args.get("key")
+
+        if scope != "plugin":
+            raise ValueError(f"Unsupported scope: {scope}")
+        if not name or not key_path:
+            raise ValueError("Missing name or key parameter")
+
+        md = self._get_plugin_metadata_by_name(name)
+        if not md or not md.config:
+            raise ValueError(f"Plugin {name} not found or has no config")
+
+        return scope, name, key_path, md, md.config
+
+    async def upload_config_file(self):
+        """上传文件到插件数据目录（用于某个 file 类型配置项）。"""
+
+        try:
+            scope, name, key_path, md, config = self._resolve_config_file_scope()
+        except ValueError as e:
+            return Response().error(str(e)).__dict__
+
+        meta = get_schema_item(getattr(config, "schema", None), key_path)
+        if not meta or meta.get("type") != "file":
+            return Response().error("Config item not found or not file type").__dict__
+
+        file_types = meta.get("file_types")
+        allowed_exts: list[str] = []
+        if isinstance(file_types, list):
+            allowed_exts = [
+                str(ext).lstrip(".").lower() for ext in file_types if str(ext).strip()
+            ]
+
+        files = await request.files
+        if not files:
+            return Response().error("No files uploaded").__dict__
+
+        storage_root_path = Path(get_astrbot_plugin_data_path()).resolve(strict=False)
+        plugin_root_path = (storage_root_path / name).resolve(strict=False)
+        try:
+            plugin_root_path.relative_to(storage_root_path)
+        except ValueError:
+            return Response().error("Invalid name parameter").__dict__
+        plugin_root_path.mkdir(parents=True, exist_ok=True)
+
+        uploaded: list[str] = []
+        folder = config_key_to_folder(key_path)
+        errors: list[str] = []
+        for file in files.values():
+            filename = sanitize_filename(file.filename or "")
+            if not filename:
+                errors.append("Invalid filename")
+                continue
+
+            file_size = getattr(file, "content_length", None)
+            if isinstance(file_size, int) and file_size > MAX_FILE_BYTES:
+                errors.append(f"File too large: {filename}")
+                continue
+
+            ext = os.path.splitext(filename)[1].lstrip(".").lower()
+            if allowed_exts and ext not in allowed_exts:
+                errors.append(f"Unsupported file type: {filename}")
+                continue
+
+            rel_path = f"files/{folder}/{filename}"
+            save_path = (plugin_root_path / rel_path).resolve(strict=False)
+            try:
+                save_path.relative_to(plugin_root_path)
+            except ValueError:
+                errors.append(f"Invalid path: {filename}")
+                continue
+
+            save_path.parent.mkdir(parents=True, exist_ok=True)
+            await file.save(str(save_path))
+            if save_path.is_file() and save_path.stat().st_size > MAX_FILE_BYTES:
+                save_path.unlink()
+                errors.append(f"File too large: {filename}")
+                continue
+            uploaded.append(rel_path)
+
+        if not uploaded:
+            return (
+                Response()
+                .error(
+                    "Upload failed: " + ", ".join(errors)
+                    if errors
+                    else "Upload failed",
+                )
+                .__dict__
+            )
+
+        return Response().ok({"uploaded": uploaded, "errors": errors}).__dict__
+
+    async def delete_config_file(self):
+        """删除插件数据目录中的文件。"""
+
+        scope = request.args.get("scope") or "plugin"
+        name = request.args.get("name")
+        if not name:
+            return Response().error("Missing name parameter").__dict__
+        if scope != "plugin":
+            return Response().error(f"Unsupported scope: {scope}").__dict__
+
+        data = await request.get_json()
+        rel_path = data.get("path") if isinstance(data, dict) else None
+        rel_path = normalize_rel_path(rel_path)
+        if not rel_path or not rel_path.startswith("files/"):
+            return Response().error("Invalid path parameter").__dict__
+
+        md = self._get_plugin_metadata_by_name(name)
+        if not md:
+            return Response().error(f"Plugin {name} not found").__dict__
+
+        storage_root_path = Path(get_astrbot_plugin_data_path()).resolve(strict=False)
+        plugin_root_path = (storage_root_path / name).resolve(strict=False)
+        try:
+            plugin_root_path.relative_to(storage_root_path)
+        except ValueError:
+            return Response().error("Invalid name parameter").__dict__
+        target_path = (plugin_root_path / rel_path).resolve(strict=False)
+        try:
+            target_path.relative_to(plugin_root_path)
+        except ValueError:
+            return Response().error("Invalid path parameter").__dict__
+        if target_path.is_file():
+            target_path.unlink()
+
+        return Response().ok(None, "Deleted").__dict__
+
+    async def get_config_file_list(self):
+        """获取配置项对应目录下的文件列表。"""
+
+        try:
+            _, name, key_path, _, config = self._resolve_config_file_scope()
+        except ValueError as e:
+            return Response().error(str(e)).__dict__
+
+        meta = get_schema_item(getattr(config, "schema", None), key_path)
+        if not meta or meta.get("type") != "file":
+            return Response().error("Config item not found or not file type").__dict__
+
+        storage_root_path = Path(get_astrbot_plugin_data_path()).resolve(strict=False)
+        plugin_root_path = (storage_root_path / name).resolve(strict=False)
+        try:
+            plugin_root_path.relative_to(storage_root_path)
+        except ValueError:
+            return Response().error("Invalid name parameter").__dict__
+
+        folder = config_key_to_folder(key_path)
+        target_dir = (plugin_root_path / "files" / folder).resolve(strict=False)
+        try:
+            target_dir.relative_to(plugin_root_path)
+        except ValueError:
+            return Response().error("Invalid path parameter").__dict__
+
+        if not target_dir.exists() or not target_dir.is_dir():
+            return Response().ok({"files": []}).__dict__
+
+        files: list[str] = []
+        for path in target_dir.rglob("*"):
+            if not path.is_file():
+                continue
+            try:
+                rel_path = path.relative_to(plugin_root_path).as_posix()
+            except ValueError:
+                continue
+            if rel_path.startswith("files/"):
+                files.append(rel_path)
+
+        return Response().ok({"files": files}).__dict__
+
     async def post_new_platform(self):
         new_platform_config = await request.json
 
@@ -1130,8 +1358,14 @@ class ConfigRoute(Route):
             raise ValueError(f"插件 {plugin_name} 不存在")
         if not md.config:
             raise ValueError(f"插件 {plugin_name} 没有注册配置")
+        assert md.config is not None
 
         try:
-            save_config(post_configs, md.config)
+            errors, post_configs = validate_config(
+                post_configs, getattr(md.config, "schema", {}), is_core=False
+            )
+            if errors:
+                raise ValueError(f"格式校验未通过: {errors}")
+            md.config.save_config(post_configs)
         except Exception as e:
             raise e

astrbot/dashboard/routes/persona.py

@@ -57,6 +57,7 @@ class PersonaRoute(Route):
                             "system_prompt": persona.system_prompt,
                             "begin_dialogs": persona.begin_dialogs or [],
                             "tools": persona.tools,
+                            "skills": persona.skills,
                             "folder_id": persona.folder_id,
                             "sort_order": persona.sort_order,
                             "created_at": persona.created_at.isoformat()
@@ -96,6 +97,7 @@ class PersonaRoute(Route):
                         "system_prompt": persona.system_prompt,
                         "begin_dialogs": persona.begin_dialogs or [],
                         "tools": persona.tools,
+                        "skills": persona.skills,
                         "folder_id": persona.folder_id,
                         "sort_order": persona.sort_order,
                         "created_at": persona.created_at.isoformat()
@@ -120,6 +122,7 @@ class PersonaRoute(Route):
             system_prompt = data.get("system_prompt", "").strip()
             begin_dialogs = data.get("begin_dialogs", [])
             tools = data.get("tools")
+            skills = data.get("skills")
             folder_id = data.get("folder_id")  # None 表示根目录
             sort_order = data.get("sort_order", 0)
 
@@ -142,6 +145,7 @@ class PersonaRoute(Route):
                 system_prompt=system_prompt,
                 begin_dialogs=begin_dialogs if begin_dialogs else None,
                 tools=tools if tools else None,
+                skills=skills if skills else None,
                 folder_id=folder_id,
                 sort_order=sort_order,
             )
@@ -156,6 +160,7 @@ class PersonaRoute(Route):
                             "system_prompt": persona.system_prompt,
                             "begin_dialogs": persona.begin_dialogs or [],
                             "tools": persona.tools or [],
+                            "skills": persona.skills or [],
                             "folder_id": persona.folder_id,
                             "sort_order": persona.sort_order,
                             "created_at": persona.created_at.isoformat()
@@ -183,6 +188,7 @@ class PersonaRoute(Route):
             system_prompt = data.get("system_prompt")
             begin_dialogs = data.get("begin_dialogs")
             tools = data.get("tools")
+            skills = data.get("skills")
 
             if not persona_id:
                 return Response().error("缺少必要参数: persona_id").__dict__
@@ -200,6 +206,7 @@ class PersonaRoute(Route):
                 system_prompt=system_prompt,
                 begin_dialogs=begin_dialogs,
                 tools=tools,
+                skills=skills,
             )
 
             return Response().ok({"message": "人格更新成功"}).__dict__

astrbot/dashboard/routes/skills.py

@@ -0,0 +1,148 @@
+import os
+import traceback
+
+from quart import request
+
+from astrbot.core import DEMO_MODE, logger
+from astrbot.core.computer.computer_client import get_booter
+from astrbot.core.skills.skill_manager import SkillManager
+from astrbot.core.utils.astrbot_path import get_astrbot_temp_path
+
+from .route import Response, Route, RouteContext
+
+
+class SkillsRoute(Route):
+    def __init__(self, context: RouteContext, core_lifecycle) -> None:
+        super().__init__(context)
+        self.core_lifecycle = core_lifecycle
+        self.routes = {
+            "/skills": ("GET", self.get_skills),
+            "/skills/upload": ("POST", self.upload_skill),
+            "/skills/update": ("POST", self.update_skill),
+            "/skills/delete": ("POST", self.delete_skill),
+        }
+        self.register_routes()
+
+    async def get_skills(self):
+        try:
+            cfg = self.core_lifecycle.astrbot_config.get("provider_settings", {}).get(
+                "skills", {}
+            )
+            runtime = cfg.get("runtime", "local")
+            skills = SkillManager().list_skills(
+                active_only=False, runtime=runtime, show_sandbox_path=False
+            )
+            return Response().ok([skill.__dict__ for skill in skills]).__dict__
+        except Exception as e:
+            logger.error(traceback.format_exc())
+            return Response().error(str(e)).__dict__
+
+    async def upload_skill(self):
+        if DEMO_MODE:
+            return (
+                Response()
+                .error("You are not permitted to do this operation in demo mode")
+                .__dict__
+            )
+
+        temp_path = None
+        try:
+            files = await request.files
+            file = files.get("file")
+            if not file:
+                return Response().error("Missing file").__dict__
+            filename = os.path.basename(file.filename or "skill.zip")
+            if not filename.lower().endswith(".zip"):
+                return Response().error("Only .zip files are supported").__dict__
+
+            temp_dir = get_astrbot_temp_path()
+            os.makedirs(temp_dir, exist_ok=True)
+            temp_path = os.path.join(temp_dir, filename)
+            await file.save(temp_path)
+
+            cfg = self.core_lifecycle.astrbot_config.get("provider_settings", {}).get(
+                "skills", {}
+            )
+            runtime = cfg.get("runtime", "local")
+            if runtime == "sandbox":
+                sandbox_enabled = (
+                    self.core_lifecycle.astrbot_config.get("provider_settings", {})
+                    .get("sandbox", {})
+                    .get("enable", False)
+                )
+                if not sandbox_enabled:
+                    return (
+                        Response()
+                        .error(
+                            "Sandbox is not enabled. Please enable sandbox before using sandbox runtime."
+                        )
+                        .__dict__
+                    )
+            skill_mgr = SkillManager()
+            skill_name = skill_mgr.install_skill_from_zip(temp_path, overwrite=True)
+
+            if runtime == "sandbox":
+                sb = await get_booter(self.core_lifecycle.star_context, "skills-upload")
+                remote_root = "/home/shared/skills"
+                remote_zip = f"{remote_root}/{skill_name}.zip"
+                await sb.shell.exec(f"mkdir -p {remote_root}")
+                upload_result = await sb.upload_file(temp_path, remote_zip)
+                if not upload_result.get("success", False):
+                    return (
+                        Response().error("Failed to upload skill to sandbox").__dict__
+                    )
+                await sb.shell.exec(
+                    f"unzip -o {remote_zip} -d {remote_root} && rm -f {remote_zip}"
+                )
+
+            return (
+                Response()
+                .ok({"name": skill_name}, "Skill uploaded successfully.")
+                .__dict__
+            )
+        except Exception as e:
+            logger.error(traceback.format_exc())
+            return Response().error(str(e)).__dict__
+        finally:
+            if temp_path and os.path.exists(temp_path):
+                try:
+                    os.remove(temp_path)
+                except Exception:
+                    logger.warning(f"Failed to remove temp skill file: {temp_path}")
+
+    async def update_skill(self):
+        if DEMO_MODE:
+            return (
+                Response()
+                .error("You are not permitted to do this operation in demo mode")
+                .__dict__
+            )
+        try:
+            data = await request.get_json()
+            name = data.get("name")
+            active = data.get("active", True)
+            if not name:
+                return Response().error("Missing skill name").__dict__
+            SkillManager().set_skill_active(name, bool(active))
+            return Response().ok({"name": name, "active": bool(active)}).__dict__
+        except Exception as e:
+            logger.error(traceback.format_exc())
+            return Response().error(str(e)).__dict__
+
+    async def delete_skill(self):
+        if DEMO_MODE:
+            return (
+                Response()
+                .error("You are not permitted to do this operation in demo mode")
+                .__dict__
+            )
+        try:
+            data = await request.get_json()
+            name = data.get("name")
+            if not name:
+                return Response().error("Missing skill name").__dict__
+            SkillManager().delete_skill(name)
+            return Response().ok({"name": name}).__dict__
+        except Exception as e:
+            logger.error(traceback.format_exc())
+            return Response().error(str(e)).__dict__

astrbot/dashboard/routes/util.py

@@ -0,0 +1,102 @@
+"""Dashboard 路由工具集。
+
+这里放一些 dashboard routes 可复用的小工具函数。
+
+目前主要用于「配置文件上传（file 类型配置项）」功能：
+- 清洗/规范化用户可控的文件名与相对路径
+- 将配置 key 映射到配置项独立子目录
+"""
+
+import os
+
+
+def get_schema_item(schema: dict | None, key_path: str) -> dict | None:
+    """按 dot-path 获取 schema 的节点。
+
+    同时支持：
+    - 扁平 schema（直接 key 命中）
+    - 嵌套 object schema（{type: "object", items: {...}}）
+    """
+
+    if not isinstance(schema, dict) or not key_path:
+        return None
+    if key_path in schema:
+        return schema.get(key_path)
+
+    current = schema
+    parts = key_path.split(".")
+    for idx, part in enumerate(parts):
+        if part not in current:
+            return None
+        meta = current.get(part)
+        if idx == len(parts) - 1:
+            return meta
+        if not isinstance(meta, dict) or meta.get("type") != "object":
+            return None
+        current = meta.get("items", {})
+    return None
+
+
+def sanitize_filename(name: str) -> str:
+    """清洗上传文件名，避免路径穿越与非法名称。
+
+    - 丢弃目录部分，仅保留 basename
+    - 将路径分隔符替换为下划线
+    - 拒绝空字符串 / "." / ".."
+    """
+
+    cleaned = os.path.basename(name).strip()
+    if not cleaned or cleaned in {".", ".."}:
+        return ""
+    for sep in (os.sep, os.altsep):
+        if sep:
+            cleaned = cleaned.replace(sep, "_")
+    return cleaned
+
+
+def sanitize_path_segment(segment: str) -> str:
+    """清洗目录片段（URL/path 安全，避免穿越）。
+
+    仅保留 [A-Za-z0-9_-]，其余替换为 "_"
+    """
+
+    cleaned = []
+    for ch in segment:
+        if (
+            ("a" <= ch <= "z")
+            or ("A" <= ch <= "Z")
+            or ch.isdigit()
+            or ch
+            in {
+                "-",
+                "_",
+            }
+        ):
+            cleaned.append(ch)
+        else:
+            cleaned.append("_")
+    result = "".join(cleaned).strip("_")
+    return result or "_"
+
+
+def config_key_to_folder(key_path: str) -> str:
+    """将 dot-path 的配置 key 转成稳定的文件夹路径。"""
+
+    parts = [sanitize_path_segment(p) for p in key_path.split(".") if p]
+    return "/".join(parts) if parts else "_"
+
+
+def normalize_rel_path(rel_path: str | None) -> str | None:
+    """规范化用户传入的相对路径，并阻止路径穿越。"""
+
+    if not isinstance(rel_path, str):
+        return None
+    rel = rel_path.replace("\\", "/").lstrip("/")
+    if not rel:
+        return None
+    parts = [p for p in rel.split("/") if p]
+    if any(part in {".", ".."} for part in parts):
+        return None
+    if rel.startswith("../") or "/../" in rel:
+        return None
+    return "/".join(parts)

astrbot/dashboard/server.py

@@ -7,6 +7,8 @@ from typing import cast
 import jwt
 import psutil
 from flask.json.provider import DefaultJSONProvider
+from hypercorn.asyncio import serve
+from hypercorn.config import Config as HyperConfig
 from psutil._common import addr as psutil_addr
 from quart import Quart, g, jsonify, request
 from quart.logging import default_handler
@@ -77,6 +79,7 @@ class AstrBotDashboard:
         self.chat_route = ChatRoute(self.context, db, core_lifecycle)
         self.chatui_project_route = ChatUIProjectRoute(self.context, db)
         self.tools_root = ToolsRoute(self.context, core_lifecycle)
+        self.skills_route = SkillsRoute(self.context, core_lifecycle)
         self.conversation_route = ConversationRoute(self.context, db, core_lifecycle)
         self.file_route = FileRoute(self.context)
         self.session_management_route = SessionManagementRoute(
@@ -244,11 +247,22 @@ class AstrBotDashboard:
 
         logger.info(display)
 
-        return self.app.run_task(
-            host=host,
-            port=port,
-            shutdown_trigger=self.shutdown_trigger,
-        )
+        # 配置 Hypercorn
+        config = HyperConfig()
+        config.bind = [f"{host}:{port}"]
+
+        # 根据配置决定是否禁用访问日志
+        disable_access_log = self.core_lifecycle.astrbot_config.get(
+            "dashboard", {}
+        ).get("disable_access_log", True)
+        if disable_access_log:
+            config.accesslog = None
+        else:
+            # 启用访问日志，使用简洁格式
+            config.accesslog = "-"
+            config.access_log_format = "%(h)s %(r)s %(s)s %(b)s %(D)s"
+
+        return serve(self.app, config, shutdown_trigger=self.shutdown_trigger)
 
     async def shutdown_trigger(self):
         await self.shutdown_event.wait()

{astrbot-4.12.4.dist-info → astrbot-4.13.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: AstrBot
-Version: 4.12.4
+Version: 4.13.0
 Summary: Easy-to-use multi-platform LLM chatbot and development framework
 License-File: LICENSE
 Keywords: Astrbot,Astrbot Module,Astrbot Plugin