langbot-plugin 0.7.16__tar.gz → 0.7.18__tar.gz

{langbot_plugin-0.7.16 → langbot_plugin-0.7.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: langbot-plugin
-Version: 0.7.16
+Version: 0.7.18
 Summary: This package contains the SDK, CLI for building plugins for LangBot, plus the runtime for hosting LangBot plugins
 Project-URL: Homepage, https://langbot.app
 Project-URL: Repository, https://github.com/langbot-app/langbot-plugin-sdk

{langbot_plugin-0.7.16 → langbot_plugin-0.7.18}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "langbot-plugin"
-version = "0.7.16"
+version = "0.7.18"
 description = "This package contains the SDK, CLI for building plugins for LangBot, plus the runtime for hosting LangBot plugins"
 readme = "README.md"
 authors = [

{langbot_plugin-0.7.16 → langbot_plugin-0.7.18}/src/langbot_plugin/api/definition/components/manifest.py

@@ -231,17 +231,62 @@ class ComponentManifest(pydantic.BaseModel):
             else None
         )
 
+    def _resolve_component_module(self) -> tuple[str, str]:
+        """Return the plugin directory to import from and the module path.
+
+        ``execution.python.path`` comes from the plugin's own manifest, so it is
+        untrusted input. Only a module inside the plugin directory may be
+        imported: absolute paths, drive letters and ``..`` components are
+        rejected outright rather than relied on to fail later during import.
+        """
+        if self.execution is None:
+            raise ValueError("Execution is not set")
+        python = self.execution.python
+        declared = python.path or ""
+        if not declared or "\x00" in declared:
+            raise ValueError("execution.python.path is empty")
+
+        portable = declared.replace("\\", "/")
+        if portable.startswith("/") or os.path.isabs(declared):
+            raise ValueError(
+                f"execution.python.path must be relative to the plugin: {declared}"
+            )
+        if any(part == ".." for part in portable.split("/")):
+            raise ValueError(
+                f"execution.python.path escapes the plugin directory: {declared}"
+            )
+        if len(portable.split("/", 1)[0]) >= 2 and portable.split("/", 1)[0][1] == ":":
+            raise ValueError(f"execution.python.path uses a drive letter: {declared}")
+
+        # Workers run at the plugin root; _rel_dir is the manifest's directory.
+        # Keep that directory in the module name so relative imports still work.
+        plugin_dir = os.path.abspath(".")
+        target = os.path.abspath(os.path.join(plugin_dir, self._rel_dir, portable))
+        if os.path.commonpath([plugin_dir, target]) != plugin_dir:
+            raise ValueError(
+                f"execution.python.path escapes the plugin directory: {declared}"
+            )
+
+        if target.endswith(".py"):
+            target = target[: -len(".py")]
+        relative = os.path.relpath(target, plugin_dir)
+        return plugin_dir, relative.replace(os.sep, ".").replace("/", ".")
+
     def get_python_component_class(self) -> typing.Type[typing.Any]:
         """获取Python组件类"""
         if self.execution is None:
             raise ValueError("Execution is not set")
-        module_path = os.path.join(self._rel_dir, self.execution.python.path)
-        if module_path.endswith(".py"):
-            module_path = module_path[:-3]
-        module_path = module_path.replace("/", ".").replace("\\", ".")
-        pwd = os.getcwd()
-        sys.path.append(pwd)
-        module = importlib.import_module(module_path)
+        plugin_dir, module_path = self._resolve_component_module()
+        # Insert for the duration of the import only: a permanent append would
+        # let one plugin shadow modules for every plugin loaded after it.
+        sys.path.insert(0, plugin_dir)
+        try:
+            module = importlib.import_module(module_path)
+        finally:
+            try:
+                sys.path.remove(plugin_dir)
+            except ValueError:  # pragma: no cover - defensive
+                pass
         return getattr(module, self.execution.python.attr)
 
     def to_plain_dict(self) -> dict:

{langbot_plugin-0.7.16 → langbot_plugin-0.7.18}/src/langbot_plugin/box/nsjail_backend.py

@@ -780,9 +780,9 @@ class NsjailBackend(BaseSandboxBackend):
         try:
             await asyncio.wait_for(process.wait(), timeout=timeout_sec)
         except asyncio.TimeoutError:
-            process.kill()
             timed_out = True
-            await process.wait()
+            # Let nsjail reap its children and remove their cgroups before exit.
+            await self._terminate_process(process)
         except asyncio.CancelledError:
             await self._terminate_process(process)
             await asyncio.gather(

{langbot_plugin-0.7.16 → langbot_plugin-0.7.18}/src/langbot_plugin/skill_store.py

@@ -8,6 +8,7 @@ import json
 import mimetypes
 import os
 import posixpath
+import re
 import shutil
 import stat
 import tempfile
@@ -22,16 +23,11 @@ from .artifact import build_tree_manifest
 from .workspace import workspace_namespace
 
 
-_FRONTMATTER_FIELDS = (
-    "name",
-    "display_name",
-    "description",
-)
-
 _PUBLIC_SKILL_FIELDS = (
     "name",
     "display_name",
     "description",
+    "metadata",
     "instructions",
     "package_root",
     "manifest_path",
@@ -151,9 +147,21 @@ def parse_frontmatter(content: str) -> tuple[dict, str]:
 
 
 def build_skill_md(metadata: dict, instructions: str) -> str:
+    # Preserve complete extensible Agent Skills frontmatter.
     frontmatter = {}
-    for key in _FRONTMATTER_FIELDS:
-        value = metadata.get(key)
+    for key, value in (metadata or {}).items():
+        if key in {
+            "package_root",
+            "manifest_path",
+            "entry_file",
+            "instructions",
+            "revision",
+            "created_at",
+            "updated_at",
+            "source_path",
+            "python_project",
+        }:
+            continue
         if value is None:
             continue
         if isinstance(value, str) and not value.strip():
@@ -220,9 +228,20 @@ class SkillStore:
             skill = self._load_published_skill(skill_name)
             retained_text_bytes += sum(
                 len(value.encode("utf-8"))
-                for value in skill.values()
-                if isinstance(value, str)
+                for key, value in skill.items()
+                if key != "metadata" and isinstance(value, str)
             )
+            metadata = skill.get("metadata")
+            if metadata is not None:
+                retained_text_bytes += len(
+                    json.dumps(
+                        metadata,
+                        ensure_ascii=False,
+                        sort_keys=True,
+                        default=str,
+                        separators=(",", ":"),
+                    ).encode("utf-8")
+                )
             if retained_text_bytes > _MAX_SKILL_LIST_TOTAL_TEXT_BYTES:
                 raise ValueError("Skill listing exceeds the configured text limit")
             skills.append(skill)
@@ -352,7 +371,9 @@ class SkillStore:
             )
 
         package_root, entry_file = discovered[0]
-        return self._load_skill_package(package_root, entry_file)
+        skill = self._load_skill_package(package_root, entry_file)
+        self._validate_agent_skill_package(package_root, skill.get("metadata") or {})
+        return skill
 
     def scan_import_directory(self, path: str, *, source_root: str) -> dict:
         """Scan a trusted import source without granting arbitrary host access."""
@@ -611,12 +632,16 @@ class SkillStore:
 
         tmp_dir = tempfile.mkdtemp(prefix="langbot_skill_preview_")
         try:
-            skill_root = self._extract_uploaded_skill_to_temp(file_bytes, tmp_dir)
+            skill_root, allow_root_package = self._extract_uploaded_skill_to_temp(
+                file_bytes, tmp_dir
+            )
             skill_root = self._resolve_source_subdir_root(skill_root, source_subdir)
+            allow_root_package = allow_root_package and not source_subdir.strip()
             return self._preview_skill_candidates(
                 skill_root,
                 base_target_name=self._uploaded_skill_target_stem(filename),
                 suffix=target_suffix,
+                allow_root_package=allow_root_package,
             )
         finally:
             shutil.rmtree(tmp_dir, ignore_errors=True)
@@ -637,18 +662,24 @@ class SkillStore:
 
         tmp_dir = tempfile.mkdtemp(prefix="langbot_skill_upload_")
         try:
-            skill_root = self._extract_uploaded_skill_to_temp(file_bytes, tmp_dir)
+            skill_root, allow_root_package = self._extract_uploaded_skill_to_temp(
+                file_bytes, tmp_dir
+            )
             skill_root = self._resolve_source_subdir_root(skill_root, source_subdir)
+            allow_root_package = allow_root_package and not source_subdir.strip()
             previews = self._preview_skill_candidates(
                 skill_root,
                 base_target_name=self._uploaded_skill_target_stem(filename),
                 suffix=target_suffix,
+                allow_root_package=allow_root_package,
             )
             selected_previews = self._select_preview_candidates(
                 previews,
                 {"source_paths": source_paths or [], "source_path": source_path},
             )
-            scanned = self._install_preview_candidates(skill_root, selected_previews)
+            scanned = self._install_preview_candidates(
+                skill_root, selected_previews, allow_root_package=allow_root_package
+            )
             return scanned
         finally:
             shutil.rmtree(tmp_dir, ignore_errors=True)
@@ -881,15 +912,31 @@ class SkillStore:
         imported = self._read_skill_package(source_root) if source_root else None
         staging_root, package_root = self._stage_package(source_root or None)
         try:
-            metadata = {
-                "name": skill_name,
-                "display_name": self._resolve_create_field(
-                    data, "display_name", imported, default=""
-                ),
-                "description": self._resolve_create_field(
-                    data, "description", imported, default=""
-                ),
-            }
+            metadata = dict((imported or {}).get("metadata") or {})
+            metadata.update(
+                {
+                    "name": skill_name,
+                    "display_name": self._resolve_create_field(
+                        data, "display_name", imported, default=""
+                    ),
+                    "description": self._resolve_create_field(
+                        data, "description", imported, default=""
+                    ),
+                }
+            )
+            for key, value in data.items():
+                if (
+                    key
+                    not in {
+                        "name",
+                        "display_name",
+                        "description",
+                        "instructions",
+                        "package_root",
+                    }
+                    and value is not None
+                ):
+                    metadata[key] = value
             instructions = self._resolve_create_field(
                 data, "instructions", imported, default=""
             )
@@ -1137,6 +1184,7 @@ class SkillStore:
             "name": skill_name,
             "display_name": str(metadata.get("display_name") or skill_name).strip(),
             "description": str(metadata.get("description") or "").strip(),
+            "metadata": dict(metadata),
             "instructions": instructions,
             "package_root": package_root,
             "entry_file": entry_file,
@@ -1168,6 +1216,7 @@ class SkillStore:
             "entry_file": skill.get("entry_file", "SKILL.md"),
             "display_name": skill.get("display_name", ""),
             "description": skill.get("description", ""),
+            "metadata": dict(skill.get("metadata") or {}),
             "instructions": skill.get("instructions", ""),
         }
 
@@ -1193,7 +1242,12 @@ class SkillStore:
         return os.path.join(self.root, target_name)
 
     def _preview_skill_candidates(
-        self, root_path: str, *, base_target_name: str, suffix: str
+        self,
+        root_path: str,
+        *,
+        base_target_name: str,
+        suffix: str,
+        allow_root_package: bool = False,
     ) -> list[dict]:
         discovered = self._discover_skill_directories(root_path, max_depth=2)
         if not discovered:
@@ -1205,6 +1259,12 @@ class SkillStore:
         for package_root, entry_file in discovered:
             skill = self._load_skill_package(package_root, entry_file)
             relative_path = os.path.relpath(package_root, root_path)
+            is_archive_root_skill = allow_root_package and relative_path in ("", ".")
+            self._validate_agent_skill_package(
+                package_root,
+                skill.get("metadata") or {},
+                require_directory_name=not is_archive_root_skill,
+            )
             if relative_path in ("", "."):
                 relative_path = ""
             skill["source_path"] = relative_path.replace(os.sep, "/")
@@ -1216,6 +1276,37 @@ class SkillStore:
         previews.sort(key=lambda item: item["source_path"])
         return [self._serialize_skill_with_source(preview) for preview in previews]
 
+    @staticmethod
+    def _validate_agent_skill_package(
+        package_root: str, metadata: dict, *, require_directory_name: bool = True
+    ) -> None:
+        name = metadata.get("name")
+        if not isinstance(name, str) or not name.strip():
+            raise ValueError(
+                f"Skill package {package_root} must declare a frontmatter name"
+            )
+        name = name.strip()
+        if not re.fullmatch(r"[a-z0-9]+(?:-[a-z0-9]+)*", name):
+            raise ValueError(
+                "Skill name must use lowercase letters, numbers, and hyphens"
+            )
+        if len(name) > 64:
+            raise ValueError("Skill name cannot exceed 64 characters")
+        directory_name = os.path.basename(os.path.normpath(package_root))
+        if require_directory_name and name != directory_name:
+            raise ValueError(
+                f'Skill frontmatter name "{name}" must match directory "{directory_name}"'
+            )
+        description = metadata.get("description")
+        if not isinstance(description, str) or not description.strip():
+            raise ValueError(
+                f'Skill "{name}" must declare a non-empty frontmatter description'
+            )
+        if len(description) > 1024:
+            raise ValueError(
+                f'Skill "{name}" description cannot exceed 1024 characters'
+            )
+
     @staticmethod
     def _serialize_skill_with_source(skill: dict) -> dict:
         data = SkillStore._serialize_skill(skill)
@@ -1265,7 +1356,11 @@ class SkillStore:
         return selected
 
     def _install_preview_candidates(
-        self, root_path: str, selected_previews: list[dict]
+        self,
+        root_path: str,
+        selected_previews: list[dict],
+        *,
+        allow_root_package: bool = False,
     ) -> list[dict]:
         installed: list[dict] = []
         try:
@@ -1273,7 +1368,18 @@ class SkillStore:
                 source_root = self._preview_source_root(
                     root_path, preview["source_path"]
                 )
-                scanned = SkillStore(self.root).scan_directory(source_root)
+                if preview["source_path"] or not allow_root_package:
+                    scanned = SkillStore(self.root).scan_directory(source_root)
+                else:
+                    entry = self._find_skill_entry(source_root)
+                    if entry is None:
+                        raise ValueError(f"No SKILL.md found in {source_root}")
+                    scanned = self._load_skill_package(entry[0], entry[1])
+                    self._validate_agent_skill_package(
+                        source_root,
+                        scanned.get("metadata") or {},
+                        require_directory_name=False,
+                    )
                 skill_name = self._validate_skill_name(scanned["name"])
                 self._ensure_legacy_packages_published()
                 with self._skill_lock(skill_name):
@@ -1303,7 +1409,9 @@ class SkillStore:
 
         return installed
 
-    def _extract_uploaded_skill_to_temp(self, file_bytes: bytes, tmp_dir: str) -> str:
+    def _extract_uploaded_skill_to_temp(
+        self, file_bytes: bytes, tmp_dir: str
+    ) -> tuple[str, bool]:
         extract_dir = os.path.join(tmp_dir, "extracted")
         try:
             with zipfile.ZipFile(io.BytesIO(file_bytes), "r") as zf:
@@ -1313,8 +1421,8 @@ class SkillStore:
 
         entries = os.listdir(extract_dir)
         if len(entries) == 1 and os.path.isdir(os.path.join(extract_dir, entries[0])):
-            return os.path.join(extract_dir, entries[0])
-        return extract_dir
+            return os.path.join(extract_dir, entries[0]), False
+        return extract_dir, True
 
     @staticmethod
     def _validate_zip_upload_size(file_bytes: bytes) -> None:

langbot_plugin-0.7.18/src/langbot_plugin/version.py

@@ -0,0 +1 @@
+__version__ = "0.7.18"

langbot_plugin-0.7.18/tests/api/definition/test_manifest_component_path.py

@@ -0,0 +1,183 @@
+"""Component module resolution must stay inside the plugin directory.
+
+``execution.python.path`` is plugin-authored manifest data, so it is untrusted.
+These tests pin the resolver to the plugin directory and check that importing a
+component no longer leaves the plugin directory on ``sys.path``.
+"""
+
+import sys
+import textwrap
+
+import pytest
+
+from langbot_plugin.api.definition.components.manifest import ComponentManifest
+
+
+@pytest.fixture(autouse=True)
+def _clean_component_modules(tmp_path, monkeypatch):
+    """Drop cached component modules so each test resolves its own plugin dir."""
+    monkeypatch.chdir(tmp_path)
+    before = {
+        name
+        for name in sys.modules
+        if name == "components" or name.startswith("components.")
+    }
+    for name in before:
+        sys.modules.pop(name, None)
+    yield
+    for name in [
+        n for n in sys.modules if n == "components" or n.startswith("components.")
+    ]:
+        sys.modules.pop(name, None)
+
+
+def _manifest(rel_path: str, python_path: str, attr: str = "Component"):
+    return ComponentManifest(
+        owner="plugin",
+        manifest={
+            "apiVersion": "v1",
+            "kind": "Command",
+            "metadata": {
+                "name": "probe",
+                "label": {"en_US": "probe"},
+                "description": {"en_US": "probe"},
+            },
+            "spec": {},
+            "execution": {"python": {"path": python_path, "attr": attr}},
+        },
+        rel_path=rel_path,
+    )
+
+
+def _plugin(tmp_path, files: dict[str, str]):
+    for name, content in files.items():
+        target = tmp_path / name
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_text(textwrap.dedent(content))
+    return tmp_path
+
+
+@pytest.mark.parametrize(
+    "declared",
+    [
+        "../outside.py",
+        "../../etc/evil.py",
+        "components/../../outside.py",
+        "/etc/passwd.py",
+        "C:/windows/evil.py",
+        "c:evil.py",
+        "",
+    ],
+)
+def test_paths_outside_the_plugin_are_rejected(tmp_path, declared):
+    plugin = _plugin(tmp_path, {"manifest.yaml": ""})
+    manifest = _manifest(str(plugin / "manifest.yaml"), declared)
+    with pytest.raises(ValueError):
+        manifest.get_python_component_class()
+
+
+def test_component_inside_the_plugin_is_imported(tmp_path, monkeypatch):
+    plugin = _plugin(
+        tmp_path,
+        {
+            "components/__init__.py": "",
+            "components/inside_once.py": """
+                class Component:
+                    marker = "INSIDE"
+            """,
+        },
+    )
+    manifest = _manifest(str(plugin / "manifest.yaml"), "components/inside_once.py")
+
+    component = manifest.get_python_component_class()
+
+    assert component.marker == "INSIDE"
+
+
+def test_import_does_not_leave_the_plugin_dir_on_sys_path(tmp_path, monkeypatch):
+    """A leaked path would let one plugin shadow modules for later plugins."""
+    plugin = _plugin(
+        tmp_path,
+        {
+            "components/__init__.py": "",
+            "components/leak_check.py": """
+                class Component:
+                    marker = "INSIDE"
+            """,
+        },
+    )
+    manifest = _manifest(str(plugin / "manifest.yaml"), "components/leak_check.py")
+    before = list(sys.path)
+
+    manifest.get_python_component_class()
+
+    assert str(plugin) not in sys.path
+    assert len(sys.path) == len(before)
+
+
+def test_relative_path_without_py_suffix_works(tmp_path, monkeypatch):
+    plugin = _plugin(
+        tmp_path,
+        {
+            "components/__init__.py": "",
+            "components/no_suffix_mod.py": """
+                class Component:
+                    marker = "NO_SUFFIX"
+            """,
+        },
+    )
+    manifest = _manifest(str(plugin / "manifest.yaml"), "components/no_suffix_mod")
+
+    assert manifest.get_python_component_class().marker == "NO_SUFFIX"
+
+
+def test_importing_a_missing_component_leaves_sys_path_clean(tmp_path, monkeypatch):
+    plugin = _plugin(tmp_path, {"manifest.yaml": ""})
+    manifest = _manifest(str(plugin / "manifest.yaml"), "components/missing.py")
+    before = list(sys.path)
+
+    with pytest.raises(ModuleNotFoundError):
+        manifest.get_python_component_class()
+
+    assert str(plugin) not in sys.path
+    assert len(sys.path) == len(before)
+
+
+@pytest.mark.parametrize("packages", [True, False])
+def test_nested_component_preserves_package_and_relative_imports(tmp_path, packages):
+    files = {
+        "components/knowledge_engine/parser.py": 'VALUE = "parsed"',
+        "components/knowledge_engine/engine.py": """
+            from .parser import VALUE
+
+            class Component:
+                marker = VALUE
+
+                def lazy_import(self):
+                    from .parser import VALUE
+                    return VALUE
+        """,
+    }
+    if packages:
+        files.update(
+            {
+                "components/__init__.py": "",
+                "components/knowledge_engine/__init__.py": "",
+            }
+        )
+    _plugin(tmp_path, files)
+    manifest = _manifest("components/knowledge_engine/engine.yaml", "engine.py")
+    before = list(sys.path)
+
+    component = manifest.get_python_component_class()
+
+    assert component.__module__ == "components.knowledge_engine.engine"
+    assert component.marker == "parsed"
+    assert component().lazy_import() == "parsed"
+    assert sys.path == before
+
+
+def test_manifest_outside_plugin_root_is_rejected(tmp_path):
+    manifest = _manifest(str(tmp_path.parent / "outside.yaml"), "outside.py")
+    with pytest.raises(ValueError, match="escapes the plugin directory"):
+        manifest.get_python_component_class()

{langbot_plugin-0.7.16 → langbot_plugin-0.7.18}/tests/box/test_nsjail_backend.py

@@ -573,9 +573,11 @@ async def test_exec_timeout(backend, tmp_base):
 
 
 @pytest.mark.anyio
-async def test_run_nsjail_cancellation_terminates_and_reaps_process(
+@pytest.mark.parametrize("stop_reason", ["timeout", "cancel"])
+async def test_run_nsjail_termination_allows_cleanup(
     backend,
     monkeypatch,
+    stop_reason,
 ):
     class EmptyStream:
         async def read(self, _size):
@@ -589,6 +591,7 @@ async def test_run_nsjail_cancellation_terminates_and_reaps_process(
             self.wait_started = asyncio.Event()
             self.exit_requested = asyncio.Event()
             self.terminated = False
+            self.killed = False
 
         async def wait(self):
             self.wait_started.set()
@@ -601,6 +604,7 @@ async def test_run_nsjail_cancellation_terminates_and_reaps_process(
             self.exit_requested.set()
 
         def kill(self):
+            self.killed = True
             self.exit_requested.set()
 
     process = HangingProcess()
@@ -614,14 +618,22 @@ async def test_run_nsjail_cancellation_terminates_and_reaps_process(
         create_subprocess_exec,
     )
     task = asyncio.create_task(
-        backend._run_nsjail(["nsjail", "--help"], timeout_sec=60)
+        backend._run_nsjail(
+            ["nsjail", "--help"],
+            timeout_sec=0.01 if stop_reason == "timeout" else 60,
+        )
     )
     await process.wait_started.wait()
-    task.cancel()
-
-    with pytest.raises(asyncio.CancelledError):
-        await task
+    if stop_reason == "cancel":
+        task.cancel()
+        with pytest.raises(asyncio.CancelledError):
+            await task
+    else:
+        result = await task
+        assert result.timed_out is True
+        assert result.return_code == -1
     assert process.terminated is True
+    assert process.killed is False
     assert process.returncode == -15