aria-code 0.62.0__tar.gz → 0.63.0__tar.gz

{aria_code-0.62.0 → aria_code-0.63.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aria-code
-Version: 0.62.0
+Version: 0.63.0
 Summary: AI coding and research workspace with optional finance and connected-domain tools
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/artheras/aria-code

{aria_code-0.62.0 → aria_code-0.63.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "aria-code"
-version = "0.62.0"
+version = "0.63.0"
 description = "AI coding and research workspace with optional finance and connected-domain tools"
 readme = "README.md"
 license = { text = "Apache-2.0" }

{aria_code-0.62.0 → aria_code-0.63.0}/src/aria_code/_version.py

@@ -17,4 +17,4 @@ from __future__ import annotations
 
 __all__ = ["__version__"]
 
-__version__ = "0.62.0"
+__version__ = "0.63.0"

{aria_code-0.62.0 → aria_code-0.63.0}/src/aria_code/aria_cli.py

@@ -1241,9 +1241,14 @@ _dedup_tool_schemas()
 
 # Tools that require user confirmation before execution
 _CONFIRM_TOOLS = {"write_file", "edit_file", "multi_edit", "run_command"}
-# In bot mode (ARIA_BOT_MODE=1): auto-approve all tools and suppress visual output
+# Bot mode (ARIA_BOT_MODE=1) is about output only: plain text for a chat card.
+# It used to start the session with every tool approved, and the Feishu and
+# Telegram bots set it — so whoever could message a bot could run shell
+# commands and write files on its host. Tools that need confirmation are now
+# refused in bot runs (nobody in a chat can answer the prompt); a bot that
+# needs one passes --allow-tools for exactly that tool.
 _ARIA_BOT_MODE: bool = bool(os.environ.get("ARIA_BOT_MODE"))
-_auto_approve_session: bool = _ARIA_BOT_MODE  # Set True when user chooses "Yes, allow all"
+_auto_approve_session: bool = False  # Set True when user chooses "Yes, allow all"
 
 # Per-tool session allow list — populated by "Always allow [tool] this session" choice.
 # More granular than _auto_approve_session: allows write_file without approving run_command.

{aria_code-0.62.0 → aria_code-0.63.0}/src/aria_code/aria_feishu_bot.py

@@ -15,7 +15,18 @@ OpenClaw 同款设计：任意输入（文字/语音/图片/文件）→ Aria AI
        FEISHU_APP_ID=cli_xxx        FEISHU_APP_SECRET=xxx
        ANTHROPIC_API_KEY=xxx        # 图片理解 / LLM
        OPENAI_API_KEY=xxx           # Whisper 语音转文字（可选）
-       FEISHU_ALLOWED_USER_IDS=uid1,uid2   # 留空=不限制
+       FEISHU_ALLOWED_USER_IDS=ou_xxx,ou_yyy   # 必填：留空 = 谁都不能用
+       FEISHU_ENCRYPT_KEY=xxx 或 FEISHU_VERIFICATION_TOKEN=xxx   # 独立运行时必填其一
+       ARIA_BOT_ALLOW_TOOLS=write_file      # 可选：机器人可免审批使用的工具
+
+安全边界（2026-10-03）：
+  - 白名单为空时拒绝所有人。之前留空 = 不限制，而机器人调用 aria 时自动批准
+    全部工具，于是任何能给它发消息的人都能在这台机器上跑 shell 命令。
+  - 机器人不再自动批准需要确认的工具（run_command / write_file / edit_file /
+    multi_edit）；没有人能在飞书里点「同意」，这些调用会被拒绝。确实需要的，
+    由管理员用 ARIA_BOT_ALLOW_TOOLS 逐个列出。
+  - 独立运行时校验飞书事件签名；未配置 Encrypt Key 或 Verification Token 时
+    拒绝一切事件。之前任何能访问端口的人都能伪造发件人。
 
 支持的消息类型：
   📝 文字（非命令）→ Aria LLM 自然语言回答
@@ -661,12 +672,27 @@ async def _async_run_aria(cmd: str, message_id: str) -> None:
 
 # ── Multimodal helpers ────────────────────────────────────────────────────────
 
-def _is_allowed_user(user_id: str) -> bool:
-    """Check FEISHU_ALLOWED_USER_IDS allowlist (empty = allow all)."""
-    raw = os.environ.get("FEISHU_ALLOWED_USER_IDS", "").strip()
-    if not raw:
-        return True
-    return user_id in {u.strip() for u in raw.split(",") if u.strip()}
+def _is_allowed_user(*sender_ids: str) -> bool:
+    """Whether any of the sender's ids (user_id, open_id) is on the allowlist.
+
+    Fails closed: an empty FEISHU_ALLOWED_USER_IDS allows nobody. It used to
+    allow everybody, and the bot runs aria with tools — so an unconfigured
+    deployment answered anyone who could message it.
+    """
+    raw = os.environ.get("FEISHU_ALLOWED_USER_IDS", "")
+    allowed = {u.strip() for u in raw.split(",") if u.strip()}
+    return any(i in allowed for i in sender_ids if i)
+
+
+def _bot_cli_flags() -> list[str]:
+    """Extra aria CLI flags for bot-run commands: only an explicit tool allowlist.
+
+    Bot mode no longer approves every tool. A tool that needs confirmation is
+    refused, because nobody in the chat can answer the prompt; an operator who
+    needs one names it in ARIA_BOT_ALLOW_TOOLS.
+    """
+    tools = [t.strip() for t in os.environ.get("ARIA_BOT_ALLOW_TOOLS", "").split(",") if t.strip()]
+    return ["--allow-tools", ",".join(tools)] if tools else []
 
 
 async def _query_aria_direct(text: str, timeout: int = 90) -> str:
@@ -709,10 +735,11 @@ async def _query_aria_llm(text: str, timeout: int = 120) -> str:
     if not aria_cli.exists():
         return "❌ aria_cli.py 未找到，请检查 ARIA_CODE_DIR 配置。"
     try:
-        # ARIA_BOT_MODE=1: auto-approves tools + suppresses visual diffs in aria_cli
+        # ARIA_BOT_MODE=1: plain output for a chat card. It no longer approves
+        # tools; see _bot_cli_flags.
         bot_env = {**os.environ, "ARIA_BOT_MODE": "1"}
         proc = await asyncio.create_subprocess_exec(
-            sys.executable, str(aria_cli), "-p", text,
+            sys.executable, str(aria_cli), "-p", text, *_bot_cli_flags(),
             stdin=asyncio.subprocess.DEVNULL,   # no interactive prompts
             stdout=asyncio.subprocess.PIPE,
             stderr=asyncio.subprocess.PIPE,
@@ -939,23 +966,57 @@ async def _analyze_file(file_bytes: bytes, filename: str) -> str:
 
 # ── Event verifier ────────────────────────────────────────────────────────────
 
-def verify_feishu_signature(timestamp: str, nonce: str, body_bytes: bytes,
-                            encrypt_key: str) -> bool:
-    """Verify Feishu event signature (optional but recommended in production)."""
-    if not encrypt_key:
-        return True
-    s = (timestamp + nonce + encrypt_key).encode() + body_bytes
-    return hmac.compare_digest(
-        hashlib.sha256(s).hexdigest(),
-        ""  # caller should pass the X-Lark-Signature header value
-    )
+def verify_feishu_request(headers: Dict[str, str], body: bytes, payload: Dict[str, Any]) -> tuple[bool, str]:
+    """(trusted, reason) for an event received directly from Feishu.
+
+    The same two checks the relay applies (aria_relay_server._verify_feishu_request),
+    kept separate because the relay ships without this module's dependencies:
+      - Encrypt Key: X-Lark-Signature = sha256(timestamp + nonce + key + body)
+      - Verification Token: the token field in the event body
+    With neither configured every event is refused, unless
+    FEISHU_ALLOW_UNVERIFIED_EVENTS=1 is set for local testing.
+
+    This replaces verify_feishu_signature, which compared the digest with an
+    empty string and was never called: the standalone server dispatched any
+    POST, so anyone who could reach the port chose the sender — including one
+    on the allowlist.
+    """
+    headers = {k.lower(): v for k, v in (headers or {}).items()}
+    encrypt_key = os.environ.get("FEISHU_ENCRYPT_KEY", "")
+    token = os.environ.get("FEISHU_VERIFICATION_TOKEN", "")
+    if encrypt_key:
+        signature = headers.get("x-lark-signature", "")
+        if not signature:
+            return False, "missing X-Lark-Signature"
+        digest = hashlib.sha256(
+            (headers.get("x-lark-request-timestamp", "") + headers.get("x-lark-request-nonce", "")
+             + encrypt_key).encode("utf-8") + body
+        ).hexdigest()
+        if not hmac.compare_digest(digest, signature):
+            return False, "signature mismatch"
+        return True, ""
+    if token:
+        sent = payload.get("token") or (payload.get("header") or {}).get("token", "")
+        if not hmac.compare_digest(str(sent), token):
+            return False, "verification token mismatch"
+        return True, ""
+    if os.environ.get("FEISHU_ALLOW_UNVERIFIED_EVENTS", "").strip().lower() in {"1", "true", "yes", "on"}:
+        return True, ""
+    return False, ("neither FEISHU_ENCRYPT_KEY nor FEISHU_VERIFICATION_TOKEN is set; "
+                   "unverified events are refused")
 
 
 # ── Main event dispatcher (called by feishu_routes.py or standalone) ──────────
 
-async def dispatch_event(raw: Dict[str, Any]) -> Dict[str, Any]:
+async def dispatch_event(raw: Dict[str, Any], *, authorized_by_binding: bool = False) -> Dict[str, Any]:
     """
     Handle one Feishu event payload.
+
+    authorized_by_binding: the relay client passes True. The relay forwards an
+    event only to the machine its sender bound with a code shown on that
+    machine, so the binding is the authorization; a local allowlist would add
+    nothing, since the relay knows the bound id. What limits a compromised
+    relay is that bot-run commands cannot use confirmation-required tools.
     Supports: text / audio / image / file / post (富文本)
     Returns a dict to be sent as JSON response (HTTP 200 required by Feishu).
     """
@@ -985,8 +1046,18 @@ async def dispatch_event(raw: Dict[str, Any]) -> Dict[str, Any]:
                      json.dumps(raw, ensure_ascii=False)[:600])
         return {"code": 0}
 
-    if not _is_allowed_user(user_id):
-        logger.warning("Blocked user %s (not in FEISHU_ALLOWED_USER_IDS)", user_id)
+    open_id = sender.get("open_id", "")
+    if not authorized_by_binding and not _is_allowed_user(sender.get("user_id", ""), open_id):
+        logger.warning("Blocked sender user_id=%s open_id=%s (not in FEISHU_ALLOWED_USER_IDS)",
+                       sender.get("user_id", ""), open_id)
+        # Say why only in a direct chat: in a group the bot would answer every
+        # message from everyone not on the list.
+        if msg.get("chat_type") == "p2p":
+            await reply_text(
+                msg_id,
+                "⛔ 你还没有使用 Aria 的权限。请把下面的 ID 发给管理员，"
+                f"加入 FEISHU_ALLOWED_USER_IDS：\n{open_id or sender.get('user_id', '')}",
+            )
         return {"code": 0}
 
     content_raw = msg.get("content", "{}")
@@ -1386,6 +1457,33 @@ async def _handle_file(file_key: str, filename: str, message_id: str) -> None:
 
 # ── Standalone HTTP server (for testing without FastAPI) ──────────────────────
 
+async def _standalone_handle(request):
+    """POST /feishu/event for the standalone server: verify, then dispatch."""
+    from aiohttp import web
+
+    raw = await request.read()
+    try:
+        body = json.loads(raw)
+    except Exception:
+        return web.json_response({"code": 1, "msg": "bad json"}, status=400)
+    # Before anything else, the URL-verification challenge included: it
+    # carries the token too, and answering it unverified is a free probe.
+    trusted, reason = verify_feishu_request(dict(request.headers), raw, body)
+    if not trusted:
+        logger.warning("refused an unverified Feishu event: %s", reason)
+        return web.json_response({"code": 1, "msg": "unverified event"}, status=401)
+    return web.json_response(await dispatch_event(body))
+
+
+def _standalone_app():
+    from aiohttp import web
+
+    app = web.Application()
+    app.router.add_post("/feishu/event", _standalone_handle)
+    app.router.add_post("/api/v1/feishu/event", _standalone_handle)
+    return app
+
+
 async def _standalone_server(host: str = "0.0.0.0", port: int = 8888) -> None:
     """Minimal aiohttp-based server for standalone Feishu event reception."""
     try:
@@ -1394,17 +1492,7 @@ async def _standalone_server(host: str = "0.0.0.0", port: int = 8888) -> None:
         logger.error("aiohttp not installed. pip install aiohttp")
         return
 
-    async def handle(request):
-        try:
-            body = await request.json()
-        except Exception:
-            return web.json_response({"code": 1, "msg": "bad json"}, status=400)
-        result = await dispatch_event(body)
-        return web.json_response(result)
-
-    app = web.Application()
-    app.router.add_post("/feishu/event", handle)
-    app.router.add_post("/api/v1/feishu/event", handle)
+    app = _standalone_app()
 
     runner = web.AppRunner(app)
     await runner.setup()

{aria_code-0.62.0 → aria_code-0.63.0}/src/aria_code/aria_telegram_bot.py

@@ -45,6 +45,10 @@ class TelegramBot:
         self._running = False
         self._client: Optional[httpx.AsyncClient] = None
 
+    def is_allowed(self, chat_id: int) -> bool:
+        """Fails closed: an empty allowlist allows nobody."""
+        return chat_id in self.allowed_chat_ids
+
     # ── Low-level API ─────────────────────────────────────────────────────────
 
     def _url(self, method: str) -> str:
@@ -157,8 +161,10 @@ class TelegramBot:
                 if not text or not chat_id:
                     continue
 
-                # ACL check
-                if self.allowed_chat_ids and chat_id not in self.allowed_chat_ids:
+                # ACL check. Fails closed: an empty TELEGRAM_ALLOWED_IDS allows
+                # nobody. It used to allow everybody — anyone who found the bot
+                # could drive the daemon's commands.
+                if not self.is_allowed(chat_id):
                     await self.send_message(
                         chat_id,
                         "⛔ 未授权。请将你的 Chat ID 添加到 `TELEGRAM_ALLOWED_IDS`。\n你的 ID: `" + str(chat_id) + "`",

{aria_code-0.62.0 → aria_code-0.63.0}/src/aria_code/clients/aria_relay_client.py

@@ -80,7 +80,9 @@ async def _handle_message(raw_msg: dict, ws) -> None:
         result = {"error": "aria_feishu_bot unavailable"}
     else:
         try:
-            result = await bot.dispatch_event(payload)
+            # The relay routes an event only to the machine its sender bound
+            # with a code shown here, so that binding is the authorization.
+            result = await bot.dispatch_event(payload, authorized_by_binding=True)
         except Exception as e:
             logger.exception("dispatch_event error")
             result = {"error": str(e)[:300]}

{aria_code-0.62.0 → aria_code-0.63.0}/src/aria_code.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aria-code
-Version: 0.62.0
+Version: 0.63.0
 Summary: AI coding and research workspace with optional finance and connected-domain tools
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/artheras/aria-code

{aria_code-0.62.0 → aria_code-0.63.0}/src/aria_code.egg-info/SOURCES.txt

@@ -511,6 +511,7 @@ tests/test_canvas_cmds.py
 tests/test_channel_intake.py
 tests/test_channels.py
 tests/test_chart_handlers.py
+tests/test_chat_bots_fail_closed.py
 tests/test_chat_routing.py
 tests/test_ci_security_workflow.py
 tests/test_cli_app_split.py

aria_code-0.63.0/tests/test_chat_bots_fail_closed.py

@@ -0,0 +1,178 @@
+"""Chat bots must refuse by default and must not approve tools on anyone's behalf.
+
+Before 2026-10-03 three things combined on the Feishu bot:
+
+  1. FEISHU_ALLOWED_USER_IDS empty meant "allow everybody";
+  2. the bot ran aria with ARIA_BOT_MODE=1, which started the session with
+     every tool approved — run_command, write_file, edit_file, multi_edit;
+  3. the standalone server dispatched any POST without checking it came from
+     Feishu, so the sender (allowlisted or not) was whatever the POST said.
+
+Together: anyone who could reach the port, or message an unconfigured bot,
+could run shell commands on its host. The Telegram bot had (1) too. Each test
+here pins one link of that chain.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import hashlib
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+from unittest import mock
+
+import pytest
+
+import aria_feishu_bot as bot
+from aria_telegram_bot import TelegramBot
+
+ROOT = Path(__file__).resolve().parents[1]
+
+ENV_KEYS = ("FEISHU_ALLOWED_USER_IDS", "FEISHU_ENCRYPT_KEY", "FEISHU_VERIFICATION_TOKEN",
+            "FEISHU_ALLOW_UNVERIFIED_EVENTS", "ARIA_BOT_ALLOW_TOOLS")
+
+
+@pytest.fixture(autouse=True)
+def clean_env(monkeypatch):
+    for key in ENV_KEYS:
+        monkeypatch.delenv(key, raising=False)
+
+
+def _event(text="/run /price AAPL", *, open_id="ou_stranger", user_id="", chat_type="p2p"):
+    return {
+        "header": {"event_type": "im.message.receive_v1"},
+        "event": {
+            "sender": {"sender_id": {"open_id": open_id, "user_id": user_id}},
+            "message": {"message_id": "om_1", "chat_id": "oc_1", "chat_type": chat_type,
+                        "message_type": "text", "content": json.dumps({"text": text})},
+        },
+    }
+
+
+def _dispatch(event, **kwargs):
+    """Run dispatch_event and report (replies sent, commands started)."""
+    replies, commands = [], []
+
+    async def fake_reply(message_id, text):
+        replies.append(text)
+
+    async def fake_command(text, message_id, user_id, chat_id):
+        commands.append(text)
+
+    async def run():
+        with mock.patch.object(bot, "reply_text", fake_reply), \
+             mock.patch.object(bot, "_handle_command", fake_command):
+            await bot.dispatch_event(event, **kwargs)
+            await asyncio.sleep(0)  # let create_task'd handlers run
+
+    asyncio.run(run())
+    return replies, commands
+
+
+class TestFeishuAllowlist:
+    def test_an_empty_allowlist_allows_nobody(self):
+        assert not bot._is_allowed_user("ou_anyone", "u_anyone")
+
+    def test_either_sender_id_can_be_listed(self, monkeypatch):
+        monkeypatch.setenv("FEISHU_ALLOWED_USER_IDS", "ou_alice, u_bob")
+        assert bot._is_allowed_user("", "ou_alice")
+        assert bot._is_allowed_user("u_bob", "ou_other")
+        assert not bot._is_allowed_user("u_eve", "ou_eve")
+
+    def test_an_unlisted_sender_runs_nothing_and_is_told_their_id(self):
+        replies, commands = _dispatch(_event())
+        assert commands == []
+        assert len(replies) == 1 and "ou_stranger" in replies[0]
+
+    def test_in_a_group_an_unlisted_sender_is_ignored_silently(self):
+        replies, commands = _dispatch(_event(chat_type="group"))
+        assert (replies, commands) == ([], [])
+
+    def test_a_listed_sender_is_served(self, monkeypatch):
+        monkeypatch.setenv("FEISHU_ALLOWED_USER_IDS", "ou_alice")
+        _, commands = _dispatch(_event(open_id="ou_alice"))
+        assert commands == ["/run /price AAPL"]
+
+    def test_the_relay_binding_authorizes_its_sender(self):
+        # The relay only forwards to the machine the sender bound.
+        _, commands = _dispatch(_event(), authorized_by_binding=True)
+        assert commands == ["/run /price AAPL"]
+
+    def test_the_relay_client_says_so(self):
+        source = (ROOT / "src" / "aria_code" / "clients" / "aria_relay_client.py").read_text(encoding="utf-8")
+        assert "dispatch_event(payload, authorized_by_binding=True)" in source
+
+
+class TestFeishuEventVerification:
+    BODY = json.dumps({"token": "tok", "challenge": "c"}).encode()
+
+    def test_nothing_configured_refuses_everything(self):
+        trusted, reason = bot.verify_feishu_request({}, self.BODY, json.loads(self.BODY))
+        assert not trusted and "refused" in reason
+
+    def test_the_local_testing_escape_hatch_is_explicit(self, monkeypatch):
+        monkeypatch.setenv("FEISHU_ALLOW_UNVERIFIED_EVENTS", "1")
+        assert bot.verify_feishu_request({}, self.BODY, {})[0]
+
+    def test_verification_token(self, monkeypatch):
+        monkeypatch.setenv("FEISHU_VERIFICATION_TOKEN", "tok")
+        assert bot.verify_feishu_request({}, self.BODY, {"token": "tok"})[0]
+        assert not bot.verify_feishu_request({}, self.BODY, {"token": "forged"})[0]
+
+    def test_signature(self, monkeypatch):
+        monkeypatch.setenv("FEISHU_ENCRYPT_KEY", "key")
+        good = hashlib.sha256(b"17" + b"n" + b"key" + self.BODY).hexdigest()
+        headers = {"X-Lark-Request-Timestamp": "17", "X-Lark-Request-Nonce": "n"}
+        assert bot.verify_feishu_request({**headers, "X-Lark-Signature": good}, self.BODY, {})[0]
+        assert not bot.verify_feishu_request({**headers, "X-Lark-Signature": "0" * 64}, self.BODY, {})[0]
+        assert not bot.verify_feishu_request(headers, self.BODY, {})[0]
+
+    def test_the_standalone_server_refuses_a_forged_event(self, monkeypatch):
+        aiohttp_test = pytest.importorskip("aiohttp.test_utils")
+        monkeypatch.setenv("FEISHU_VERIFICATION_TOKEN", "tok")
+        monkeypatch.setenv("FEISHU_ALLOWED_USER_IDS", "ou_admin")
+        dispatched = []
+
+        async def fake_dispatch(body, **kwargs):
+            dispatched.append(body)
+            return {"code": 0}
+
+        async def run():
+            with mock.patch.object(bot, "dispatch_event", fake_dispatch):
+                async with aiohttp_test.TestClient(aiohttp_test.TestServer(bot._standalone_app())) as client:
+                    forged = _event(open_id="ou_admin")  # claims to be the admin, has no token
+                    refused = await client.post("/feishu/event", data=json.dumps(forged))
+                    genuine = await client.post("/feishu/event", data=json.dumps({**forged, "token": "tok"}))
+                    return refused.status, genuine.status
+
+        refused, genuine = asyncio.run(run())
+        assert refused == 401
+        assert genuine == 200
+        assert len(dispatched) == 1
+
+
+class TestBotsDoNotApproveTools:
+    def test_bot_mode_starts_with_nothing_approved(self):
+        proc = subprocess.run(
+            [sys.executable, "-c", "import aria_code.aria_cli as c; print(c._auto_approve_session)"],
+            capture_output=True, text=True, timeout=120, env={**os.environ, "ARIA_BOT_MODE": "1"},
+        )
+        assert proc.returncode == 0, proc.stderr[-1000:]
+        assert proc.stdout.strip().splitlines()[-1] == "False"
+
+    def test_no_tools_are_allowed_unless_the_operator_names_them(self, monkeypatch):
+        assert bot._bot_cli_flags() == []
+        monkeypatch.setenv("ARIA_BOT_ALLOW_TOOLS", "write_file, edit_file")
+        assert bot._bot_cli_flags() == ["--allow-tools", "write_file,edit_file"]
+
+
+class TestTelegramAllowlist:
+    def test_an_empty_allowlist_allows_nobody(self):
+        assert not TelegramBot(token="t").is_allowed(12345)
+
+    def test_a_listed_chat_is_allowed(self):
+        assert TelegramBot(token="t", allowed_chat_ids={12345}).is_allowed(12345)
+        assert not TelegramBot(token="t", allowed_chat_ids={12345}).is_allowed(999)