sycommon-python-lib 0.2.7a18__tar.gz → 0.2.7a19__tar.gz

{sycommon_python_lib-0.2.7a18 → sycommon_python_lib-0.2.7a19}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sycommon-python-lib
-Version: 0.2.7a18
+Version: 0.2.7a19
 Summary: Add your description here
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown

{sycommon_python_lib-0.2.7a18 → sycommon_python_lib-0.2.7a19}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sycommon-python-lib"
-version = "0.2.7a18"
+version = "0.2.7a19"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.11"

{sycommon_python_lib-0.2.7a18 → sycommon_python_lib-0.2.7a19}/src/sycommon/agent/middleware/sandbox_path_guard.py

@@ -44,8 +44,10 @@ except Exception:  # 测试/独立引入环境兜底,行为与 sandbox.py 保持
 _WORKSPACE_ROOT = os.path.realpath(WORKSPACE_BASE).rstrip(os.sep)
 
 
-# 工具 → 路径字段名映射(结构化参数,可安全改写/拦截)
-# get_share_url 是 app(base_tools)自定义工具,同样吃 file_path,纳入统一约束。
+# 工具 → 路径字段名(单字段)或多字段(列表)映射(结构化参数,可安全改写/拦截)。
+# get_share_url 是 app(base_tools)自定义工具,吃 file_path;
+# transfer_file 是 bridge/multi 模式注入的跨沙箱传输工具,吃 src_path + dst_path,
+# 两个路径字段都要过同一套越权校验(否则 agent 可借它绕过,把别人的绝对路径文件传出来)。
 _PATH_TOOLS = {
     "read_file": "file_path",
     "write_file": "file_path",
@@ -54,6 +56,7 @@ _PATH_TOOLS = {
     "glob": "path",
     "grep": "path",
     "get_share_url": "file_path",
+    "transfer_file": ["src_path", "dst_path"],
 }
 
 # 宿主沙箱根前缀(用于 execute 命令串扫描;shell 里无法安全改写,只能拦)。
@@ -114,22 +117,36 @@ class SandboxPathGuardMiddleware(AgentMiddleware):
         if not isinstance(args, dict):
             return await handler(request)
 
-        # 1) 结构化路径工具:read/write/edit/ls/grep/glob/get_share_url
-        field = _PATH_TOOLS.get(name)
-        if field:
-            raw = args.get(field)
-            if isinstance(raw, str) and _is_host_absolute(raw):
-                if self._self_ws and _within_self_workspace(raw, self._self_ws):
-                    # 自己工作目录内的绝对路径 → 改写为虚拟路径放行(零往返)
-                    new_tc = dict(tc)
-                    new_args = dict(args)
-                    new_args[field] = _to_virtual(raw, self._self_ws)
-                    new_tc["args"] = new_args
-                    new_request = dataclasses.replace(request, tool_call=new_tc)
-                    return await handler(new_request)
-                # 越界/跨用户宿主绝对路径 → 拦截
-                return ToolMessage(content=_DENIED_MSG, name=name,
-                                   tool_call_id=tc.get("id", ""), status="error")
+        # 1) 结构化路径工具:read/write/edit/ls/grep/glob/get_share_url/transfer_file
+        #    字段规格可为单字段(str)或多字段(list);多字段工具(如 transfer_file
+        #    的 src_path+dst_path)任一字段越界即拦整个调用,防借传输绕过读他人文件。
+        fields_spec = _PATH_TOOLS.get(name)
+        if fields_spec:
+            fields = [fields_spec] if isinstance(fields_spec, str) else list(fields_spec)
+            rewrites = {}  # field -> 改写后的虚拟路径
+            for field in fields:
+                raw = args.get(field)
+                if not isinstance(raw, str):
+                    continue
+                # transfer_file 支持 sandbox:<名称>: 前缀指定源/目标沙箱,剥掉前缀再判路径本身
+                path_part = raw.split(":", 2)[-1] if raw.startswith("sandbox:") else raw
+                if not _is_host_absolute(path_part):
+                    continue
+                if self._self_ws and _within_self_workspace(path_part, self._self_ws):
+                    # 自己工作目录内的绝对路径 → 改写为虚拟路径(剥前缀后改写,前缀保留)
+                    virtual = _to_virtual(path_part, self._self_ws)
+                    rewrites[field] = (raw[:len(raw) - len(path_part)] + virtual) \
+                        if raw.startswith("sandbox:") else virtual
+                else:
+                    # 越界/跨用户宿主绝对路径 → 整个调用拦
+                    return ToolMessage(content=_DENIED_MSG, name=name,
+                                       tool_call_id=tc.get("id", ""), status="error")
+            if rewrites:
+                new_args = dict(args)
+                new_args.update(rewrites)
+                new_tc = dict(tc)
+                new_tc["args"] = new_args
+                return await handler(dataclasses.replace(request, tool_call=new_tc))
             return await handler(request)
 
         # 2) execute(裸 shell):命令串里的宿主绝对路径无法安全改写,只能拦

{sycommon_python_lib-0.2.7a18 → sycommon_python_lib-0.2.7a19}/src/sycommon/agent/multi_agent_team.py

@@ -46,6 +46,7 @@ from sycommon.agent.chat_events import ChatEvent, ChatEventBuilder, DEFAULT_AGEN
 from sycommon.middleware.token_tracking import TokenTrackingMiddleware
 from sycommon.middleware.tool_result_truncation import ToolResultTruncationMiddleware
 from sycommon.agent.middleware.skill_write_guard import SkillWriteGuardMiddleware
+from sycommon.agent.middleware.sandbox_path_guard import SandboxPathGuardMiddleware
 from sycommon.agent.middleware.sensitive_guard import (
     SensitiveGuardMiddleware, DowngradeState,
 )
@@ -643,6 +644,7 @@ async def create_multi_agent_team(
         TokenTrackingMiddleware(model_name=config.model_name, user_id=user_id),
         summarization_mw,
         SkillWriteGuardMiddleware(),
+        SandboxPathGuardMiddleware(user_id),
     ]
     shared = config.shared_tools or [get_current_date]
 
@@ -701,6 +703,7 @@ async def create_multi_agent_team(
             TokenTrackingMiddleware(model_name=config.model_name, user_id=user_id),
             coord_summarization_mw,
             SkillWriteGuardMiddleware(),
+            SandboxPathGuardMiddleware(user_id),
         ],
     )
 

{sycommon_python_lib-0.2.7a18 → sycommon_python_lib-0.2.7a19}/src/sycommon_python_lib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sycommon-python-lib
-Version: 0.2.7a18
+Version: 0.2.7a19
 Summary: Add your description here
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown

{sycommon_python_lib-0.2.7a18 → sycommon_python_lib-0.2.7a19}/src/sycommon_python_lib.egg-info/SOURCES.txt

@@ -323,6 +323,7 @@ tests/test_hotreload_snapshot.py
 tests/test_llm_apikey_contextvar.py
 tests/test_log_masker.py
 tests/test_resilient_pg_saver.py
+tests/test_sandbox_path_guard.py
 tests/test_sensitive_guard.py
 tests/test_simple_chat_agent.py
 tests/test_skill_regex_upgrade.py

sycommon_python_lib-0.2.7a19/tests/test_sandbox_path_guard.py

@@ -0,0 +1,297 @@
+"""SandboxPathGuardMiddleware: 规范化/拦截沙箱工具调用里的宿主绝对路径。
+
+不实例化沙箱,纯逻辑测 awrap_tool_call:构造假 request + handler,断言三态
+(拦截返回 error ToolMessage / 改写 args 后放行 / 原样放行)。
+
+测试用 tmp_path 作 WORKSPACE_BASE,避免依赖产线 /data/sycommon_sandbox。
+通过 monkeypatch 替换模块级 _WORKSPACE_ROOT / WORKSPACE_BASE / _HOST_SANDBOX_RE,
+保证「middleware 算的前缀」就是测试构造的临时根。
+"""
+import os
+import re
+import sys
+
+import pytest
+from langgraph.prebuilt.tool_node import ToolCallRequest
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "src"))
+
+from sycommon.agent.middleware import sandbox_path_guard as spg
+from sycommon.agent.middleware.sandbox_path_guard import (
+    SandboxPathGuardMiddleware, _is_host_absolute, _within_self_workspace,
+    _to_virtual, _sanitize_user_id,
+)
+
+
+# ============== fixtures: 把工作根钉到 tmp_path ==============
+
+@pytest.fixture
+def workspace(tmp_path, monkeypatch):
+    """用一个真实临时目录作 WORKSPACE_BASE,并重算模块级锚点。
+
+    _WORKSPACE_ROOT 是模块加载时 realpath 算出的,测试必须 monkeypatch 它,
+    否则 _is_host_absolute 会按真实沙箱根(/data/sycommon_sandbox 或 tempdir)判,
+    与测试构造的路径对不上。
+    """
+    root = os.path.realpath(str(tmp_path)).rstrip(os.sep)
+    monkeypatch.setattr(spg, "WORKSPACE_BASE", root)
+    monkeypatch.setattr(spg, "_WORKSPACE_ROOT", root)
+    monkeypatch.setattr(spg, "_HOST_SANDBOX_RE",
+                        re.compile(re.escape(root) + r'(?:/|\\)'))
+    return root
+
+
+def _self_ws(workspace, user="osulcode.xiao"):
+    return os.path.join(workspace, _sanitize_user_id(user))
+
+
+def _req(name, args):
+    call = {"name": name, "args": args, "id": "call_1", "type": "tool_call"}
+    return ToolCallRequest(tool_call=call, tool=None, state={}, runtime=None)
+
+
+# ============== 纯函数 ==============
+
+def test_is_host_absolute_virtual_relative_false(workspace):
+    assert not _is_host_absolute("/skills/system/x/SKILL.md")
+    assert not _is_host_absolute("./output/report.pdf")
+    assert not _is_host_absolute("result.xlsx")
+    assert not _is_host_absolute("")
+
+
+def test_is_host_absolute_root_outside_false(workspace):
+    # 沙箱根之外的宿主路径不算(沙箱里本就读不到,留给服务端 not found)
+    assert not _is_host_absolute("/etc/passwd")
+    assert not _is_host_absolute("/tmp/anything")
+
+
+def test_is_host_absolute_within_root_true(workspace):
+    p = os.path.join(workspace, "osulcode.xiao", "skills", "x.py")
+    assert _is_host_absolute(p)
+    assert _is_host_absolute(workspace)            # 根本身
+
+
+def test_within_self_workspace(workspace):
+    self_ws = _self_ws(workspace)
+    mine = os.path.join(self_ws, "skills", "a.py")
+    other = os.path.join(workspace, "gary.liu", "skills", "a.py")
+    assert _within_self_workspace(mine, self_ws)
+    assert not _within_self_workspace(other, self_ws)
+
+
+def test_to_virtual(workspace):
+    self_ws = _self_ws(workspace)
+    p = os.path.join(self_ws, "skills", "system", "x", "SKILL.md")
+    assert _to_virtual(p, self_ws) == "/skills/system/x/SKILL.md"
+    assert _to_virtual(self_ws, self_ws) == "/"    # 工作目录根
+
+
+def test_to_virtual_posix_separators(workspace):
+    r"""虚拟路径必须用 / 分隔,不出现反斜杠。"""
+    self_ws = _self_ws(workspace)
+    p = os.path.join(self_ws, "output", "report.pdf")
+    v = _to_virtual(p, self_ws)
+    assert "\\" not in v
+    assert v == "/output/report.pdf"
+
+
+# ============== awrap_tool_call: read_file ==============
+
+@pytest.mark.asyncio
+async def test_read_file_virtual_passthrough(workspace):
+    mw = SandboxPathGuardMiddleware("osulcode.xiao")
+
+    async def handler(req):
+        return "REACHED"
+
+    res = await mw.awrap_tool_call(
+        _req("read_file", {"file_path": "/skills/system/x/SKILL.md"}), handler)
+    assert res == "REACHED"
+
+
+@pytest.mark.asyncio
+async def test_read_file_self_abs_path_rewritten(workspace):
+    """自己工作目录的宿主绝对路径 → 改写为虚拟路径,放行。"""
+    mw = SandboxPathGuardMiddleware("osulcode.xiao")
+    self_ws = _self_ws(workspace)
+    abs_path = os.path.join(self_ws, "skills", "system", "x", "SKILL.md")
+    seen = {}
+
+    async def handler(req):
+        seen["args"] = req.tool_call["args"]
+        return "REACHED"
+
+    res = await mw.awrap_tool_call(
+        _req("read_file", {"file_path": abs_path}), handler)
+    assert res == "REACHED"
+    assert seen["args"]["file_path"] == "/skills/system/x/SKILL.md"
+
+
+@pytest.mark.asyncio
+async def test_read_file_cross_user_abs_path_denied(workspace):
+    """别人的工作目录宿主绝对路径 → 拦截。"""
+    mw = SandboxPathGuardMiddleware("osulcode.xiao")
+    other = os.path.join(workspace, "gary.liu", "skills", "x", "SKILL.md")
+    called = {"n": 0}
+
+    async def handler(req):
+        called["n"] += 1
+        return "REACHED"
+
+    res = await mw.awrap_tool_call(_req("read_file", {"file_path": other}), handler)
+    assert called["n"] == 0
+    assert res.status == "error"
+    assert "宿主机绝对路径" in str(res.content)
+
+
+# ============== awrap_tool_call: transfer_file(多字段) ==============
+
+@pytest.mark.asyncio
+async def test_transfer_file_both_relative_passthrough(workspace):
+    mw = SandboxPathGuardMiddleware("osulcode.xiao")
+
+    async def handler(req):
+        return "REACHED"
+
+    res = await mw.awrap_tool_call(
+        _req("transfer_file", {"src_path": "./a.py", "dst_path": "./b.py",
+                               "direction": "any"}), handler)
+    assert res == "REACHED"
+
+
+@pytest.mark.asyncio
+async def test_transfer_file_src_self_rewritten(workspace):
+    """src 是自己工作目录绝对路径 → 改写 src,放行。"""
+    mw = SandboxPathGuardMiddleware("osulcode.xiao")
+    self_ws = _self_ws(workspace)
+    src_abs = os.path.join(self_ws, "data.csv")
+    seen = {}
+
+    async def handler(req):
+        seen["args"] = req.tool_call["args"]
+        return "REACHED"
+
+    await mw.awrap_tool_call(
+        _req("transfer_file", {"src_path": src_abs, "dst_path": "./out.csv",
+                               "direction": "any"}), handler)
+    assert seen["args"]["src_path"] == "/data.csv"
+    assert seen["args"]["dst_path"] == "./out.csv"   # dst 未改
+
+
+@pytest.mark.asyncio
+async def test_transfer_file_dst_cross_user_denied(workspace):
+    """dst 指向别人的工作目录 → 整个调用拦截(防往别人目录写)。"""
+    mw = SandboxPathGuardMiddleware("osulcode.xiao")
+    other = os.path.join(workspace, "gary.liu", "out.csv")
+    called = {"n": 0}
+
+    async def handler(req):
+        called["n"] += 1
+        return "REACHED"
+
+    res = await mw.awrap_tool_call(
+        _req("transfer_file", {"src_path": "./a.py", "dst_path": other,
+                               "direction": "any"}), handler)
+    assert called["n"] == 0
+    assert res.status == "error"
+
+
+@pytest.mark.asyncio
+async def test_transfer_file_src_cross_user_denied(workspace):
+    """src 是别人的工作目录 → 拦截(防借传输读他人文件)。"""
+    mw = SandboxPathGuardMiddleware("osulcode.xiao")
+    other = os.path.join(workspace, "gary.liu", "secret.csv")
+    called = {"n": 0}
+
+    async def handler(req):
+        called["n"] += 1
+        return "REACHED"
+
+    res = await mw.awrap_tool_call(
+        _req("transfer_file", {"src_path": other, "dst_path": "./out.csv",
+                               "direction": "any"}), handler)
+    assert called["n"] == 0
+    assert res.status == "error"
+
+
+@pytest.mark.asyncio
+async def test_transfer_file_sandbox_prefix_self_rewritten(workspace):
+    """sandbox:<名称>: 前缀 + 自己工作目录路径 → 剥前缀判,改写时保留前缀。"""
+    mw = SandboxPathGuardMiddleware("osulcode.xiao")
+    self_ws = _self_ws(workspace)
+    src_abs = os.path.join(self_ws, "data.csv")
+    seen = {}
+
+    async def handler(req):
+        seen["args"] = req.tool_call["args"]
+        return "REACHED"
+
+    await mw.awrap_tool_call(
+        _req("transfer_file", {"src_path": f"sandbox:MacBook-Pro:{src_abs}",
+                               "dst_path": "./out.csv", "direction": "any"}), handler)
+    assert seen["args"]["src_path"] == f"sandbox:MacBook-Pro:/data.csv"
+
+
+# ============== awrap_tool_call: execute ==============
+
+@pytest.mark.asyncio
+async def test_execute_host_abs_path_denied(workspace):
+    """execute 命令串含宿主沙箱路径 → 拦(无法安全改写)。"""
+    mw = SandboxPathGuardMiddleware("osulcode.xiao")
+    self_ws = _self_ws(workspace)
+    cmd = f"cat {os.path.join(self_ws, 'skills', 'x.py')}"
+    called = {"n": 0}
+
+    async def handler(req):
+        called["n"] += 1
+        return "REACHED"
+
+    res = await mw.awrap_tool_call(_req("execute", {"command": cmd}), handler)
+    assert called["n"] == 0
+    assert res.status == "error"
+
+
+@pytest.mark.asyncio
+async def test_execute_relative_allowed(workspace):
+    """execute 用相对路径 / 虚拟路径 / $_SANDBOX_WORKSPACE → 放行。"""
+    mw = SandboxPathGuardMiddleware("osulcode.xiao")
+
+    async def handler(req):
+        return "REACHED"
+
+    for cmd in ["cat ./SKILL.md",
+                "python /skills/system/x/scripts/run.py",
+                "head $_SANDBOX_WORKSPACE/skills/x.py",
+                "ls /etc"]:
+        res = await mw.awrap_tool_call(_req("execute", {"command": cmd}), handler)
+        assert res == "REACHED", f"误拦了正常命令: {cmd}"
+
+
+# ============== 无关工具 / 边界 ==============
+
+@pytest.mark.asyncio
+async def test_unrelated_tool_passthrough(workspace):
+    mw = SandboxPathGuardMiddleware("osulcode.xiao")
+
+    async def handler(req):
+        return "REACHED"
+
+    res = await mw.awrap_tool_call(
+        _req("web_search", {"queries": ["x"]}), handler)
+    assert res == "REACHED"
+
+
+@pytest.mark.asyncio
+async def test_no_user_id_still_blocks_cross_user(workspace):
+    """user_id 为空(self_ws 算不出)时:自己的也改不了,但跨用户的越权仍要拦。"""
+    mw = SandboxPathGuardMiddleware("")
+    other = os.path.join(workspace, "gary.liu", "skills", "x", "SKILL.md")
+    called = {"n": 0}
+
+    async def handler(req):
+        called["n"] += 1
+        return "REACHED"
+
+    res = await mw.awrap_tool_call(_req("read_file", {"file_path": other}), handler)
+    assert called["n"] == 0
+    assert res.status == "error"