sycommon-python-lib 0.2.1a2__tar.gz → 0.2.1a4__tar.gz

{sycommon_python_lib-0.2.1a2 → sycommon_python_lib-0.2.1a4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sycommon-python-lib
-Version: 0.2.1a2
+Version: 0.2.1a4
 Summary: Add your description here
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown

{sycommon_python_lib-0.2.1a2 → sycommon_python_lib-0.2.1a4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sycommon-python-lib"
-version = "0.2.1a2"
+version = "0.2.1a4"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.11"

{sycommon_python_lib-0.2.1a2 → sycommon_python_lib-0.2.1a4}/src/sycommon/agent/sandbox/file_ops.py

@@ -27,15 +27,23 @@ class FileOperationsMixin:
 
     _timeout: int  # 类型提示，子类需要提供此属性
     user_id: str  # 类型提示，子类需要提供此属性
+    _auto_sync: bool = False  # 是否自动同步
+    _synced: bool = False  # 是否已同步
 
     async def _post_async(self: "HTTPSandboxBackend", endpoint: str, data: dict, timeout: int = None) -> dict:
         """发送异步 POST 请求"""
         ...
 
+    async def _ensure_synced(self: "HTTPSandboxBackend"):
+        """确保目录已同步（内部方法）"""
+        if self._auto_sync and not self._synced:
+            await self.async_sync()
+
     # ============== 目录操作 ==============
 
     async def als_info(self: "HTTPSandboxBackend", path: str) -> List[FileInfo]:
         """异步列出目录内容"""
+        await self._ensure_synced()
         SYLogger.info(f"[Sandbox] 列出目录: {path}")
         result = await self._post_async(f"{SANDBOX_API_PREFIX}/ls", {
             "path": path,
@@ -49,6 +57,7 @@ class FileOperationsMixin:
 
     async def aread(self: "HTTPSandboxBackend", file_path: str, offset: int = 0, limit: int = 2000) -> str:
         """异步读取文件内容"""
+        await self._ensure_synced()
         SYLogger.info(f"[Sandbox] 读取文件: {file_path} (offset={offset}, limit={limit})")
         result = await self._post_async(f"{SANDBOX_API_PREFIX}/read", {
             "file_path": file_path,
@@ -65,6 +74,7 @@ class FileOperationsMixin:
 
     async def awrite(self: "HTTPSandboxBackend", file_path: str, content: str) -> WriteResult:
         """异步写入文件"""
+        await self._ensure_synced()
         SYLogger.info(f"[Sandbox] 写入文件: {file_path} ({len(content)} 字符)")
         result = await self._post_async(f"{SANDBOX_API_PREFIX}/write", {
             "file_path": file_path,
@@ -89,6 +99,7 @@ class FileOperationsMixin:
         replace_all: bool = False
     ) -> EditResult:
         """异步编辑文件"""
+        await self._ensure_synced()
         result = await self._post_async(f"{SANDBOX_API_PREFIX}/edit", {
             "file_path": file_path,
             "old_string": base64.b64encode(old_string.encode()).decode(),
@@ -106,6 +117,7 @@ class FileOperationsMixin:
 
     async def aglob_info(self: "HTTPSandboxBackend", pattern: str, path: str = "/") -> List[FileInfo]:
         """异步 glob 搜索文件"""
+        await self._ensure_synced()
         result = await self._post_async(f"{SANDBOX_API_PREFIX}/glob", {
             "pattern": pattern,
             "path": path,
@@ -120,6 +132,7 @@ class FileOperationsMixin:
         glob: str = None
     ) -> List[GrepMatch] | str:
         """异步搜索文件内容"""
+        await self._ensure_synced()
         try:
             result = await self._post_async(f"{SANDBOX_API_PREFIX}/grep", {
                 "pattern": pattern,

{sycommon_python_lib-0.2.1a2 → sycommon_python_lib-0.2.1a4}/src/sycommon/agent/sandbox/http_sandbox_backend.py

@@ -6,6 +6,8 @@ HTTP 客户端沙箱后端
 """
 
 import base64
+import os
+from pathlib import Path
 from typing import Optional, List
 
 from sycommon.logging.kafka_log import SYLogger
@@ -41,11 +43,29 @@ class HTTPSandboxBackend(FileOperationsMixin, SandboxBackendProtocol):
             user_id="user123"
         )
 
+        # 带自动同步目录
+        backend = HTTPSandboxBackend(
+            base_url="http://localhost:8080",
+            user_id="user123",
+            sync_dirs=[
+                ("/local/path/skills", "/skills"),
+                ("/local/path/memory", "/memory"),
+            ]
+        )
+        await backend.async_sync()  # 手动触发同步
+
         # 异步调用
         result = await backend.aexecute("python --version")
     """
 
-    def __init__(self, base_url: str, user_id: str, timeout: int = 120):
+    def __init__(
+        self,
+        base_url: str,
+        user_id: str,
+        timeout: int = 120,
+        sync_dirs: List[tuple[str, str]] = None,
+        auto_sync: bool = False
+    ):
         """
         初始化 HTTP 沙箱后端
 
@@ -53,10 +73,15 @@ class HTTPSandboxBackend(FileOperationsMixin, SandboxBackendProtocol):
             base_url: 沙箱服务地址，如 http://192.168.1.100:8080
             user_id: 用户ID，用于隔离工作目录
             timeout: 默认超时时间（秒）
+            sync_dirs: 要同步的目录列表 [(本地路径, 沙箱路径), ...]
+            auto_sync: 是否在首次文件操作时自动同步（默认 False）
         """
         self._base_url = base_url.rstrip("/")
         self._user_id = user_id
         self._timeout = timeout
+        self._sync_dirs = sync_dirs or []
+        self._auto_sync = auto_sync
+        self._synced = False
 
         # 生成 ID
         self._id = self._base_url.replace(
@@ -77,6 +102,8 @@ class HTTPSandboxBackend(FileOperationsMixin, SandboxBackendProtocol):
         group: str = "DEFAULT_GROUP",
         version: str = None,
         timeout: int = 120,
+        sync_dirs: List[tuple[str, str]] = None,
+        auto_sync: bool = False,
     ) -> "HTTPSandboxBackend":
         """
         从 Nacos 服务发现创建后端实例
@@ -87,6 +114,8 @@ class HTTPSandboxBackend(FileOperationsMixin, SandboxBackendProtocol):
             group: 服务分组
             version: 服务版本
             timeout: 超时时间
+            sync_dirs: 要同步的目录列表 [(本地路径, 沙箱路径), ...]
+            auto_sync: 是否在首次文件操作时自动同步
 
         Returns:
             HTTPSandboxBackend 实例
@@ -117,7 +146,13 @@ class HTTPSandboxBackend(FileOperationsMixin, SandboxBackendProtocol):
 
         SYLogger.info(f"Nacos 发现沙箱服务: {service_name} -> {base_url}")
 
-        return cls(base_url=base_url, user_id=user_id, timeout=timeout)
+        return cls(
+            base_url=base_url,
+            user_id=user_id,
+            timeout=timeout,
+            sync_dirs=sync_dirs,
+            auto_sync=auto_sync
+        )
 
     # ============== 内部方法 ==============
 
@@ -154,6 +189,7 @@ class HTTPSandboxBackend(FileOperationsMixin, SandboxBackendProtocol):
 
     async def aexecute(self, command: str, *, timeout: int = None) -> ExecuteResponse:
         """异步执行 shell 命令"""
+        await self._ensure_synced()
         SYLogger.info(f"[Sandbox] 执行命令: {command}")
         result = await self._post_async(f"{SANDBOX_API_PREFIX}/execute", {
             "command": command,
@@ -188,6 +224,160 @@ class HTTPSandboxBackend(FileOperationsMixin, SandboxBackendProtocol):
                 results.append(FileUploadResponse(path=path, error=str(e)))
         return results
 
+    async def aupload_directory(
+        self,
+        local_dir: str,
+        remote_path: str = "/",
+        exclude_patterns: List[str] = None
+    ) -> dict:
+        """
+        异步上传整个目录到沙箱
+
+        Args:
+            local_dir: 本地目录路径
+            remote_path: 沙箱中的目标路径（默认为根目录）
+            exclude_patterns: 要排除的文件模式列表（如 [".git", "__pycache__", "*.pyc"]）
+
+        Returns:
+            dict: {"success": int, "failed": int, "errors": list}
+
+        Example:
+            await backend.aupload_directory(
+                local_dir="/path/to/project/skills",
+                remote_path="/skills",
+                exclude_patterns=[".git", "__pycache__"]
+            )
+        """
+        local_path = Path(local_dir)
+        if not local_path.exists():
+            raise FileNotFoundError(f"本地目录不存在: {local_dir}")
+
+        if not local_path.is_dir():
+            raise NotADirectoryError(f"路径不是目录: {local_dir}")
+
+        exclude_patterns = exclude_patterns or [".git", "__pycache__", ".pyc", ".DS_Store", "node_modules"]
+
+        def should_exclude(name: str) -> bool:
+            for pattern in exclude_patterns:
+                if pattern.startswith("*"):
+                    if name.endswith(pattern[1:]):
+                        return True
+                elif name == pattern:
+                    return True
+            return False
+
+        files_to_upload = []
+
+        # 收集所有文件
+        for root, dirs, files in os.walk(local_path):
+            # 过滤排除的目录
+            dirs[:] = [d for d in dirs if not should_exclude(d)]
+
+            for file in files:
+                if should_exclude(file):
+                    continue
+
+                local_file = Path(root) / file
+                # 计算相对路径
+                relative_path = local_file.relative_to(local_path)
+                # 构建沙箱中的目标路径
+                sandbox_path = str(Path(remote_path) / relative_path)
+
+                files_to_upload.append((sandbox_path, local_file))
+
+        SYLogger.info(f"[Sandbox] 准备上传 {len(files_to_upload)} 个文件到沙箱")
+
+        # 批量上传
+        success_count = 0
+        failed_count = 0
+        errors = []
+
+        for sandbox_path, local_file in files_to_upload:
+            try:
+                with open(local_file, "rb") as f:
+                    content = f.read()
+
+                result = await self._post_async(f"{SANDBOX_API_PREFIX}/upload", {
+                    "path": sandbox_path,
+                    "content": base64.b64encode(content).decode(),
+                    "user_id": self._user_id
+                })
+
+                if result.get("error"):
+                    failed_count += 1
+                    errors.append({"path": sandbox_path, "error": result["error"]})
+                else:
+                    success_count += 1
+
+            except Exception as e:
+                failed_count += 1
+                errors.append({"path": sandbox_path, "error": str(e)})
+
+        SYLogger.info(f"[Sandbox] 目录上传完成: 成功 {success_count}, 失败 {failed_count}")
+
+        return {
+            "success": success_count,
+            "failed": failed_count,
+            "errors": errors
+        }
+
+    async def async_sync(self) -> dict:
+        """
+        手动同步所有配置的目录到沙箱
+
+        Returns:
+            dict: 每个目录的同步结果 {"path": result}
+
+        Example:
+            backend = HTTPSandboxBackend(
+                base_url="http://localhost:8080",
+                user_id="user123",
+                sync_dirs=[
+                    ("/local/skills", "/skills"),
+                    ("/local/memory", "/memory"),
+                ]
+            )
+            result = await backend.async_sync()
+        """
+        if not self._sync_dirs:
+            SYLogger.info("[Sandbox] 没有配置同步目录")
+            return {}
+
+        results = {}
+        for local_path, remote_path in self._sync_dirs:
+            SYLogger.info(f"[Sandbox] 同步目录: {local_path} -> {remote_path}")
+            local_dir = Path(local_path)
+
+            if not local_dir.exists():
+                SYLogger.error(f"[Sandbox] 本地目录不存在: {local_path}")
+                results[local_path] = {"error": "目录不存在"}
+                continue
+
+            if local_dir.is_dir():
+                result = await self.aupload_directory(
+                    local_dir=str(local_dir),
+                    remote_path=remote_path
+                )
+            else:
+                # 单文件
+                with open(local_dir, "rb") as f:
+                    content = f.read()
+                upload_results = await self.aupload_files([(remote_path, content)])
+                result = {"success": 1 if not upload_results[0].error else 0,
+                          "failed": 1 if upload_results[0].error else 0,
+                          "errors": [{"path": remote_path, "error": upload_results[0].error}] if upload_results[0].error else []}
+
+            results[local_path] = result
+
+        self._synced = True
+        SYLogger.info("[Sandbox] 目录同步完成")
+        return results
+
+    async def _ensure_synced(self):
+        """确保目录已同步（内部方法，用于 auto_sync）"""
+        if self._auto_sync and not self._synced:
+            await self.async_sync()
+
     async def adownload_files(self, paths: List[str]) -> List[FileDownloadResponse]:
         """异步下载多个文件"""
         results = []

{sycommon_python_lib-0.2.1a2 → sycommon_python_lib-0.2.1a4}/src/sycommon/middleware/sandbox.py

@@ -3,6 +3,25 @@
 
 提供沙箱容器的中间件和 API 路由
 支持 user_id 隔离，每个用户独立工作目录
+
+目录结构:
+    {WORKSPACE_BASE}/                    # 默认: /tmp/sycommon_sandbox
+        ├── user_001/                    # 用户 test_user_001 隔离目录
+        │   ├── skills/                  # 同步的 /skills
+        │   │   └── multi-search-engine/
+        │   │       ├── config.json
+        │   │       └── ...
+        │   └── memory/                  # 同步的 /memory
+        │       └── AGENTS.md
+        └── user_002/                    # 其他用户完全隔离
+            ├── skills/...
+            └── memory/...
+
+路径隔离:
+    所有 API 端点使用统一路径解析 (resolve_sandbox_path):
+    - /skills/foo.md -> {workspace}/skills/foo.md
+    - skills/foo.md -> {workspace}/skills/foo.md
+    - 防止路径遍历攻击 (../../../etc/passwd)
 """
 
 import os
@@ -35,6 +54,33 @@ def get_user_workspace(user_id: str) -> str:
     return workspace
 
 
+def resolve_sandbox_path(path: str, workspace: str) -> str:
+    """
+    将沙箱路径解析到用户工作目录，实现路径隔离
+
+    所有路径（包括绝对路径）都会映射到用户工作目录下：
+    - /skills/foo.md -> {workspace}/skills/foo.md
+    - skills/foo.md -> {workspace}/skills/foo.md
+
+    同时防止路径遍历攻击，确保解析后的路径仍在工作目录内
+    """
+    # 移除开头的 / 使其成为相对路径
+    if os.path.isabs(path):
+        path = path.lstrip('/')
+
+    # 规范化路径，防止 ../ 等路径遍历
+    path = os.path.normpath(path)
+
+    # 拼接到工作目录
+    resolved = os.path.normpath(os.path.join(workspace, path))
+
+    # 安全检查：确保最终路径在工作目录内
+    if not resolved.startswith(workspace):
+        raise ValueError(f"Path traversal detected: {path}")
+
+    return resolved
+
+
 # ============== 请求/响应模型 ==============
 
 class ExecuteRequest(BaseModel):
@@ -288,10 +334,11 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
     async def ls_info(req: LsRequest):
         """列出目录内容"""
         workspace = get_user_workspace(req.user_id)
-        target_path = req.path
-
-        if not os.path.isabs(target_path):
-            target_path = os.path.join(workspace, target_path)
+        try:
+            target_path = resolve_sandbox_path(req.path, workspace)
+        except ValueError as e:
+            SYLogger.error(f"[Sandbox Server] 列目录失败: {e}")
+            return []
 
         if not os.path.isdir(target_path):
             SYLogger.error(f"[Sandbox Server] 列目录失败: 目录不存在 {target_path}")
@@ -321,10 +368,11 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
     async def read_file(req: ReadRequest):
         """读取文件内容"""
         workspace = get_user_workspace(req.user_id)
-        file_path = req.file_path
-
-        if not os.path.isabs(file_path):
-            file_path = os.path.join(workspace, file_path)
+        try:
+            file_path = resolve_sandbox_path(req.file_path, workspace)
+        except ValueError as e:
+            SYLogger.error(f"[Sandbox Server] 读取失败: {e}")
+            return ReadResponse(error=str(e), content=None)
 
         if not os.path.isfile(file_path):
             SYLogger.error(f"[Sandbox Server] 读取失败: 文件不存在 {file_path}")
@@ -360,10 +408,11 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
     async def write_file(req: WriteRequest):
         """写入新文件"""
         workspace = get_user_workspace(req.user_id)
-        file_path = req.file_path
-
-        if not os.path.isabs(file_path):
-            file_path = os.path.join(workspace, file_path)
+        try:
+            file_path = resolve_sandbox_path(req.file_path, workspace)
+        except ValueError as e:
+            SYLogger.error(f"[Sandbox Server] 写入失败: {e}")
+            return WriteResponse(error=str(e), path=None)
 
         SYLogger.info(f"[Sandbox Server] 写入文件: {file_path}")
 
@@ -392,10 +441,11 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
     async def edit_file(req: EditRequest):
         """编辑文件"""
         workspace = get_user_workspace(req.user_id)
-        file_path = req.file_path
-
-        if not os.path.isabs(file_path):
-            file_path = os.path.join(workspace, file_path)
+        try:
+            file_path = resolve_sandbox_path(req.file_path, workspace)
+        except ValueError as e:
+            SYLogger.error(f"[Sandbox Server] 编辑失败: {e}")
+            return EditResponse(error=str(e))
 
         SYLogger.info(f"[Sandbox Server] 编辑文件: {file_path}")
 
@@ -440,10 +490,10 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
     async def upload_file(req: UploadRequest):
         """上传文件"""
         workspace = get_user_workspace(req.user_id)
-        file_path = req.path
-
-        if not os.path.isabs(file_path):
-            file_path = os.path.join(workspace, file_path)
+        try:
+            file_path = resolve_sandbox_path(req.path, workspace)
+        except ValueError as e:
+            return UploadResponse(path=req.path, error=str(e))
 
         try:
             content = base64.b64decode(req.content)
@@ -464,10 +514,10 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
     async def download_file(req: DownloadRequest):
         """下载文件"""
         workspace = get_user_workspace(req.user_id)
-        file_path = req.path
-
-        if not os.path.isabs(file_path):
-            file_path = os.path.join(workspace, file_path)
+        try:
+            file_path = resolve_sandbox_path(req.path, workspace)
+        except ValueError as e:
+            return DownloadResponse(path=req.path, error=str(e))
 
         if not os.path.isfile(file_path):
             return DownloadResponse(path=file_path, error="file_not_found")
@@ -490,10 +540,11 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
         import glob as glob_module
 
         workspace = get_user_workspace(req.user_id)
-        search_path = req.path
-
-        if not os.path.isabs(search_path):
-            search_path = os.path.join(workspace, search_path)
+        try:
+            search_path = resolve_sandbox_path(req.path, workspace)
+        except ValueError as e:
+            SYLogger.error(f"[Sandbox Server] glob 失败: {e}")
+            return []
 
         full_pattern = os.path.join(search_path, req.pattern)
         matches = sorted(glob_module.glob(full_pattern, recursive=True))
@@ -517,10 +568,11 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
         import shlex
 
         workspace = get_user_workspace(req.user_id)
-        search_path = req.path or workspace
-
-        if not os.path.isabs(search_path):
-            search_path = os.path.join(workspace, search_path)
+        try:
+            search_path = resolve_sandbox_path(req.path or "/", workspace)
+        except ValueError as e:
+            SYLogger.error(f"[Sandbox Server] grep 失败: {e}")
+            return []
 
         quoted_path = shlex.quote(search_path)
         grep_opts = "-rHnF"

{sycommon_python_lib-0.2.1a2 → sycommon_python_lib-0.2.1a4}/src/sycommon_python_lib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sycommon-python-lib
-Version: 0.2.1a2
+Version: 0.2.1a4
 Summary: Add your description here
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown