sycommon-python-lib 0.2.7a18__tar.gz → 0.2.7a20__tar.gz

{sycommon_python_lib-0.2.7a18 → sycommon_python_lib-0.2.7a20}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sycommon-python-lib
-Version: 0.2.7a18
+Version: 0.2.7a20
 Summary: Add your description here
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -18,7 +18,7 @@ Requires-Dist: langchain==1.3.11
 Requires-Dist: langchain-core==1.4.8
 Requires-Dist: langchain-openai==1.3.3
 Requires-Dist: langfuse==4.13.0
-Requires-Dist: langgraph==1.2.7
+Requires-Dist: langgraph==1.2.8
 Requires-Dist: langgraph-checkpoint-postgres==3.1.0
 Requires-Dist: langgraph-checkpoint-redis==0.5.0
 Requires-Dist: ldap3==2.9.1
@@ -43,7 +43,7 @@ Requires-Dist: minio==7.2.20
 Requires-Dist: langchain-mcp-adapters==0.3.0
 Requires-Dist: fastapi-mcp==0.4.0
 Requires-Dist: psycopg[binary,pool]==3.3.4
-Requires-Dist: agent-client-protocol==0.10.1
+Requires-Dist: agent-client-protocol==0.11.0
 
 # sycommon-python-lib
 

{sycommon_python_lib-0.2.7a18 → sycommon_python_lib-0.2.7a20}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sycommon-python-lib"
-version = "0.2.7a18"
+version = "0.2.7a20"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -19,7 +19,7 @@ dependencies = [
     "langchain-core==1.4.8",
     "langchain-openai==1.3.3",
     "langfuse==4.13.0",
-    "langgraph==1.2.7",
+    "langgraph==1.2.8",
     "langgraph-checkpoint-postgres==3.1.0",
     "langgraph-checkpoint-redis==0.5.0",
     "ldap3==2.9.1",
@@ -44,7 +44,7 @@ dependencies = [
     "langchain-mcp-adapters==0.3.0",
     "fastapi-mcp==0.4.0",
     "psycopg[binary,pool]==3.3.4",
-    "agent-client-protocol==0.10.1",
+    "agent-client-protocol==0.11.0",
 ]
 
 [tool.setuptools]

{sycommon_python_lib-0.2.7a18 → sycommon_python_lib-0.2.7a20}/src/sycommon/agent/deep_agent.py

@@ -1485,9 +1485,9 @@ async def _sync_skills_to_sandbox(
         if chmod_readonly:
             try:
                 # sandbox_dest 是虚拟绝对路径(/skills/system),沙箱 shell 不重映射裸绝对路径,
-                # 须拼 $_SANDBOX_WORKSPACE 指向真实 workspace 才能命中。否则 chmod 静默失败。
+                # 须拼 $SANDBOX_ROOT 指向真实 workspace 才能命中。否则 chmod 静默失败。
                 await backend.aexecute(
-                    f'chmod -R 555 "$_SANDBOX_WORKSPACE{sandbox_dest}"',
+                    f'chmod -R 555 "$SANDBOX_ROOT{sandbox_dest}"',
                     _skip_lazy_sync=True)
                 SYLogger.info(f"[DeepAgent] 已设只读: chmod -R 555 {sandbox_dest}")
             except Exception as e:

{sycommon_python_lib-0.2.7a18 → sycommon_python_lib-0.2.7a20}/src/sycommon/agent/middleware/sandbox_path_guard.py

@@ -44,8 +44,10 @@ except Exception:  # 测试/独立引入环境兜底,行为与 sandbox.py 保持
 _WORKSPACE_ROOT = os.path.realpath(WORKSPACE_BASE).rstrip(os.sep)
 
 
-# 工具 → 路径字段名映射(结构化参数,可安全改写/拦截)
-# get_share_url 是 app(base_tools)自定义工具,同样吃 file_path,纳入统一约束。
+# 工具 → 路径字段名(单字段)或多字段(列表)映射(结构化参数,可安全改写/拦截)。
+# get_share_url 是 app(base_tools)自定义工具,吃 file_path;
+# transfer_file 是 bridge/multi 模式注入的跨沙箱传输工具,吃 src_path + dst_path,
+# 两个路径字段都要过同一套越权校验(否则 agent 可借它绕过,把别人的绝对路径文件传出来)。
 _PATH_TOOLS = {
     "read_file": "file_path",
     "write_file": "file_path",
@@ -54,6 +56,7 @@ _PATH_TOOLS = {
     "glob": "path",
     "grep": "path",
     "get_share_url": "file_path",
+    "transfer_file": ["src_path", "dst_path"],
 }
 
 # 宿主沙箱根前缀(用于 execute 命令串扫描;shell 里无法安全改写,只能拦)。
@@ -114,22 +117,36 @@ class SandboxPathGuardMiddleware(AgentMiddleware):
         if not isinstance(args, dict):
             return await handler(request)
 
-        # 1) 结构化路径工具:read/write/edit/ls/grep/glob/get_share_url
-        field = _PATH_TOOLS.get(name)
-        if field:
-            raw = args.get(field)
-            if isinstance(raw, str) and _is_host_absolute(raw):
-                if self._self_ws and _within_self_workspace(raw, self._self_ws):
-                    # 自己工作目录内的绝对路径 → 改写为虚拟路径放行(零往返)
-                    new_tc = dict(tc)
-                    new_args = dict(args)
-                    new_args[field] = _to_virtual(raw, self._self_ws)
-                    new_tc["args"] = new_args
-                    new_request = dataclasses.replace(request, tool_call=new_tc)
-                    return await handler(new_request)
-                # 越界/跨用户宿主绝对路径 → 拦截
-                return ToolMessage(content=_DENIED_MSG, name=name,
-                                   tool_call_id=tc.get("id", ""), status="error")
+        # 1) 结构化路径工具:read/write/edit/ls/grep/glob/get_share_url/transfer_file
+        #    字段规格可为单字段(str)或多字段(list);多字段工具(如 transfer_file
+        #    的 src_path+dst_path)任一字段越界即拦整个调用,防借传输绕过读他人文件。
+        fields_spec = _PATH_TOOLS.get(name)
+        if fields_spec:
+            fields = [fields_spec] if isinstance(fields_spec, str) else list(fields_spec)
+            rewrites = {}  # field -> 改写后的虚拟路径
+            for field in fields:
+                raw = args.get(field)
+                if not isinstance(raw, str):
+                    continue
+                # transfer_file 支持 sandbox:<名称>: 前缀指定源/目标沙箱,剥掉前缀再判路径本身
+                path_part = raw.split(":", 2)[-1] if raw.startswith("sandbox:") else raw
+                if not _is_host_absolute(path_part):
+                    continue
+                if self._self_ws and _within_self_workspace(path_part, self._self_ws):
+                    # 自己工作目录内的绝对路径 → 改写为虚拟路径(剥前缀后改写,前缀保留)
+                    virtual = _to_virtual(path_part, self._self_ws)
+                    rewrites[field] = (raw[:len(raw) - len(path_part)] + virtual) \
+                        if raw.startswith("sandbox:") else virtual
+                else:
+                    # 越界/跨用户宿主绝对路径 → 整个调用拦
+                    return ToolMessage(content=_DENIED_MSG, name=name,
+                                       tool_call_id=tc.get("id", ""), status="error")
+            if rewrites:
+                new_args = dict(args)
+                new_args.update(rewrites)
+                new_tc = dict(tc)
+                new_tc["args"] = new_args
+                return await handler(dataclasses.replace(request, tool_call=new_tc))
             return await handler(request)
 
         # 2) execute(裸 shell):命令串里的宿主绝对路径无法安全改写,只能拦

{sycommon_python_lib-0.2.7a18 → sycommon_python_lib-0.2.7a20}/src/sycommon/agent/middleware/skill_api_whitelist.py

@@ -47,8 +47,8 @@ _PUSH_FILES = [
     ("sitecustomize.py", ".wl/sitecustomize.py"),
     ("skill_wl_check.py", ".wl/skill_wl_check.py"),
 ]
-# workspace 内白名单目录的 shell 形式（init_script 已 export $_SANDBOX_WORKSPACE，运行期展开）
-_WL_DIR = "$_SANDBOX_WORKSPACE/.wl"
+# workspace 内白名单目录的 shell 形式（init_script 已 export $SANDBOX_ROOT，运行期展开）
+_WL_DIR = "$SANDBOX_ROOT/.wl"
 
 
 def _resolve_placeholders(pattern: str, env_lookup) -> Optional[str]:

{sycommon_python_lib-0.2.7a18 → sycommon_python_lib-0.2.7a20}/src/sycommon/agent/multi_agent_team.py

@@ -46,6 +46,7 @@ from sycommon.agent.chat_events import ChatEvent, ChatEventBuilder, DEFAULT_AGEN
 from sycommon.middleware.token_tracking import TokenTrackingMiddleware
 from sycommon.middleware.tool_result_truncation import ToolResultTruncationMiddleware
 from sycommon.agent.middleware.skill_write_guard import SkillWriteGuardMiddleware
+from sycommon.agent.middleware.sandbox_path_guard import SandboxPathGuardMiddleware
 from sycommon.agent.middleware.sensitive_guard import (
     SensitiveGuardMiddleware, DowngradeState,
 )
@@ -643,6 +644,7 @@ async def create_multi_agent_team(
         TokenTrackingMiddleware(model_name=config.model_name, user_id=user_id),
         summarization_mw,
         SkillWriteGuardMiddleware(),
+        SandboxPathGuardMiddleware(user_id),
     ]
     shared = config.shared_tools or [get_current_date]
 
@@ -701,6 +703,7 @@ async def create_multi_agent_team(
             TokenTrackingMiddleware(model_name=config.model_name, user_id=user_id),
             coord_summarization_mw,
             SkillWriteGuardMiddleware(),
+            SandboxPathGuardMiddleware(user_id),
         ],
     )
 

{sycommon_python_lib-0.2.7a18 → sycommon_python_lib-0.2.7a20}/src/sycommon/agent/sandbox/file_ops.py

@@ -94,6 +94,30 @@ def _normalize_edit_error(error: str, file_path: str, old_string: str) -> str:
     return messages.get(code, error)
 
 
+# read 工具返回的“良性错误”关键词——这些是 agent 正常的文件探索/分页试探，
+# 不是系统故障。降级为 warning 而非 ERROR，避免淹没真正的错误日志。
+# 文案与 sycommon/middleware/sandbox.py 服务端 read 的错误返回对齐。
+_BENIGN_READ_ERROR_MARKERS = (
+    "not found",                      # agent 试探性读取不存在的路径
+    "outside the sandbox",            # 安全守卫拦截宿主绝对路径，agent 会自愈改用虚拟路径
+    "exceeds maximum preview size",   # 二进制文件超 500KiB，agent 在探索文件结构
+    "exceeds file length",            # 分页 offset 超出文件实际行数，agent 翻页越界
+    "empty contents",                 # 空文件提示
+)
+
+
+def _is_benign_read_error(err_msg: str) -> bool:
+    """判断 read 错误是否为 agent 正常工具行为（应降级为 warning 而非 ERROR）。
+
+    这些都是 LLM 探索文件系统时的正常试探/边界：路径不存在、宿主绝对路径、
+    大二进制文件、分页越界、空文件。若全刷成 ERROR 会淹没真正的异常日志。
+    """
+    if not err_msg:
+        return False
+    low = err_msg.lower()
+    return any(marker in low for marker in _BENIGN_READ_ERROR_MARKERS)
+
+
 @dataclass
 class TreeResult:
     """tree 操作结果"""
@@ -311,8 +335,12 @@ class FileOperationsMixin:
                 detail = str(result)[:200] if result else "(empty)"
                 return ReadResult(error=f"File '{file_path}': unexpected server response: {detail}")
             if result.get("error"):
-                SYLogger.error(f"[Sandbox] 读取文件失败: {result['error']}")
-                return ReadResult(error=f"File '{file_path}': {result['error']}")
+                err_msg = result['error']
+                if _is_benign_read_error(err_msg):
+                    SYLogger.warning(f"[Sandbox] 读取文件未命中(良性): {err_msg}")
+                else:
+                    SYLogger.error(f"[Sandbox] 读取文件失败: {err_msg}")
+                return ReadResult(error=f"File '{file_path}': {err_msg}")
             content = result.get("content", "")
             encoding = result.get("encoding", "utf-8")
             SYLogger.info(
@@ -361,11 +389,10 @@ class FileOperationsMixin:
                 return ReadResult(error=f"File '{file_path}': unexpected server response: {detail}")
             if result.get("error"):
                 err_msg = result['error']
-                if 'not found' in err_msg or 'outside the sandbox' in err_msg:
-                    # not found 是 agent 正常试探；outside the sandbox 是安全守卫拦截
-                    # agent 用了宿主绝对路径，属正常 tool-error（会自愈改用虚拟路径）。
-                    # 降级为 warning，避免把正常工具错误刷成 ERROR 级。
-                    SYLogger.warning(f"[Sandbox] 异步读取文件未找到: {err_msg}")
+                if _is_benign_read_error(err_msg):
+                    # 见 _is_benign_read_error：agent 正常的文件探索/分页试探，
+                    # 降级为 warning 避免淹没真正的异常日志。
+                    SYLogger.warning(f"[Sandbox] 异步读取文件未命中(良性): {err_msg}")
                 else:
                     SYLogger.error(f"[Sandbox] 异步读取文件失败: {err_msg}")
                 return ReadResult(error=f"File '{file_path}': {err_msg}")

{sycommon_python_lib-0.2.7a18 → sycommon_python_lib-0.2.7a20}/src/sycommon/agent/sandbox/http_sandbox_backend.py

@@ -473,6 +473,24 @@ class HTTPSandboxBackend(FileOperationsMixin, SandboxBackendProtocol):
                             SYLogger.info(
                                 f"[Sandbox] MinIO 恢复完成: {restored} 个文件")
                         finally:
+                            # restore_from_minio 复用了共享 backend self，内部经
+                            # aupload_files -> _get_async_session() 的 loop 不匹配逻辑，
+                            # 会在【本临时 loop】上惰性创建 aiohttp ClientSession。
+                            # 临时 loop 关闭前必须把这个 session 关掉，否则 loop.close()
+                            # 后它成为孤儿，aiohttp GC 时刷
+                            # "Unclosed client session" / "Unclosed connector"。
+                            # 仅当 session 确实绑定在本临时 loop 上才动它
+                            # （restore 若是空操作则 self._async_session 仍是主 loop 的，不能误关）。
+                            if (self._async_session is not None
+                                    and not self._async_session.closed
+                                    and self._session_loop_id == id(loop)):
+                                try:
+                                    loop.run_until_complete(
+                                        self._async_session.close())
+                                except Exception:
+                                    pass
+                                self._async_session = None
+                                self._session_loop_id = None
                             loop.close()
                 except Exception as e:
                     SYLogger.warning(

{sycommon_python_lib-0.2.7a18 → sycommon_python_lib-0.2.7a20}/src/sycommon/agent/sandbox/minio_sync.py

@@ -292,28 +292,30 @@ class MinioSyncService(metaclass=SingletonMeta):
 
     # ============== 批量扫描同步 ==============
 
-    def collect_sandbox_files(self, tree_result) -> list[str]:
-        """从沙箱 tree 结果中收集所有文件路径
+    def collect_sandbox_files(self, tree_result) -> dict[str, int]:
+        """从沙箱 tree 结果收集 {文件路径: 大小}。
 
-        tree 根节点 name 通常是 user_id（如 "osulcode.xiao"），
-        收集时跳过根节点，从其 children 开始递归，这样路径不含 user_id 前缀，
-        与 astat/adownload_files 的路径语义一致。
+        tree 根节点 name 通常是 user_id（如 "osulcode.xiao"），收集时跳过根节点，
+        从 children 开始递归，路径不含 user_id 前缀，与 astat/adownload_files 语义一致。
+        size 取节点 .size，缺失记为 -1（表示「未知」，diff 时按「可能变化」处理，即重传）。
+
+        用 size 做 diff 是为了让「会话中途直推过、随后 agent 原地改写」的文件能在
+        会话末尾扫描时被重新同步（否则路径已存在会被当成无变化忽略，丢掉改写后的版本）。
         """
         if tree_result.error or not tree_result.tree:
-            return []
+            return {}
 
         root = tree_result.tree
-        files = []
+        files: dict[str, int] = {}
         if root.is_dir and root.children:
             for child in root.children:
                 self._collect_files_from_node(child, "", files)
 
-        # tree 在文件过多时会插入 "... (truncated, max N files)" 虚拟节点，过滤掉
-        files = [f for f in files if "truncated" not in f]
-        return files
+        # tree 文件过多时插入 "... (truncated, max N files)" 虚拟节点，过滤掉
+        return {fp: sz for fp, sz in files.items() if "truncated" not in fp}
 
-    def _collect_files_from_node(self, node, prefix: str, files: list):
-        """递归收集文件节点"""
+    def _collect_files_from_node(self, node, prefix: str, files: dict[str, int]):
+        """递归收集文件节点到 {path: size}"""
         if not node:
             return
 
@@ -324,21 +326,26 @@ class MinioSyncService(metaclass=SingletonMeta):
                 for child in node.children:
                     self._collect_files_from_node(child, path, files)
         else:
-            files.append(path)
+            # size 缺失（None）记为 -1，diff 时按「可能变化」处理，避免漏传
+            size = node.size if node.size is not None else -1
+            files[path] = size
 
-    def _exclude_system_skills(self, files: list[str]) -> list[str]:
+    def _exclude_system_skills(self, files) -> list[str]:
         """过滤掉 /skills/system/ 前缀文件——system 是只读仓库产物,不进 MinIO。
 
         路径形如 skills/system/sy-oa-skill/...(collect_sandbox_files 已 strip 根 user_id
         前缀,根盘符 / 由调用方拼接)。兼容带不带前导斜杠。
+
+        files 可为 dict（{path:size}）或 list[str]：dict 时按 key 过滤并返回新 dict，
+        list 时按元素过滤并返回新 list。
         """
-        out = []
-        for fp in files:
+        def _keep(fp):
             norm = fp.replace("\\", "/").lstrip("/")
-            if norm == "skills/system" or norm.startswith("skills/system/"):
-                continue
-            out.append(fp)
-        return out
+            return not (norm == "skills/system" or norm.startswith("skills/system/"))
+
+        if isinstance(files, dict):
+            return {fp: sz for fp, sz in files.items() if _keep(fp)}
+        return [fp for fp in files if _keep(fp)]
 
     async def sync_sandbox_to_minio(self, sandbox_backend, user_id: str) -> int:
         """扫描沙箱目录，增量同步文件到 MinIO
@@ -390,7 +397,7 @@ class MinioSyncService(metaclass=SingletonMeta):
 
         prefix = f"{user_id.lower()}/{dir_name}/"
 
-        # 3. 获取 MinIO 已有副本
+        # 3. 获取 MinIO 已有副本（{相对路径: MinioObject}，取其 .size 做 diff）
         existing_objects = {}
         try:
             objects = await asyncio.to_thread(
@@ -403,14 +410,21 @@ class MinioSyncService(metaclass=SingletonMeta):
         except Exception as e:
             SYLogger.warning(f"[MinIO] 列出已有副本失败，将全量上传: {e}")
 
-        # 4. 找出需要同步的文件（新增的不在 MinIO 中）
-        sandbox_file_set = set(sandbox_files)
+        # 4. 找出需要同步的文件：
+        #    - MinIO 中没有（新增）
+        #    - 或 MinIO 有但 size 不一致（被改写，含「中途直推过初版、随后改写」的场景）
+        #    注意 sandbox size 未知(-1)一律视为变化，宁可重传也不漏传。
         changed_files = [
-            fp for fp in sandbox_files if fp not in existing_objects]
+            fp for fp, sz in sandbox_files.items()
+            if fp not in existing_objects
+            or sz < 0
+            or existing_objects[fp].size != sz
+        ]
 
         # 5. 找出需要删除的文件（MinIO 中存在但沙箱中已不存在）
         deleted_files = [
-            fp for fp in existing_objects if fp not in sandbox_file_set]
+            fp for fp in existing_objects if fp not in sandbox_files
+        ]
 
         # 删除 MinIO 中的孤立文件
         if deleted_files:
@@ -486,6 +500,109 @@ class MinioSyncService(metaclass=SingletonMeta):
             SYLogger.warning(f"[MinIO] 同步文件异常: {fp}, error={e}")
             return False
 
+    # ============== 用户上传文件直推（fire-and-forget 后台）==============
+    # 用户刚传上来的文件优先落 MinIO：不等会话结束扫描，免得沙箱中途崩溃丢文件。
+    # 这两条只做“上传”，不删孤儿、不扫描；会话末尾的全量扫描仍负责 diff/清理。
+    _background_tasks: set = set()
+
+    @staticmethod
+    def make_user_file_key(user_id: str, file_path: str) -> str:
+        """构造 {user_id}/current/{path} 的 object key（对外共用，调用方也用得上）"""
+        clean = file_path.replace("\\", "/").lstrip("./").lstrip("/")
+        return f"{user_id.lower()}/current/{clean}"
+
+    def _push_batch_sync(self, user_id: str, files: list[tuple[str, bytes]]) -> int:
+        """同步直推一批已落盘的用户文件到 MinIO（阻塞，跑在后台线程）
+
+        files: [(相对路径, 文件内容), ...]，相对路径不带前导 /（与沙箱根语义一致）。
+        返回成功条数。逐文件做，单文件失败不影响其余。
+        """
+        if not self._client:
+            return 0
+        ok = 0
+        for fp, content in files:
+            object_key = self.make_user_file_key(user_id, fp)
+            mime_type, _ = mimetypes.guess_type(fp)
+            if self.upload_bytes(
+                object_key, content,
+                content_type=mime_type or "application/octet-stream",
+            ):
+                ok += 1
+        return ok
+
+    async def _push_batch_async(self, user_id: str, files: list[tuple[str, bytes]]) -> int:
+        """异步直推一批用户文件：并发上传，单文件失败不影响其余。
+
+        并发 cap 与全量同步的 CONCURRENT_BATCH 对齐（5），避免突发上传打满 MinIO。
+        """
+        if not self._client:
+            return 0
+        if not files:
+            return 0
+
+        async def _one(fp, content):
+            object_key = self.make_user_file_key(user_id, fp)
+            mime_type, _ = mimetypes.guess_type(fp)
+            return await self.aupload_bytes(
+                object_key, content,
+                content_type=mime_type or "application/octet-stream",
+            )
+
+        results = await asyncio.gather(
+            *(_one(fp, c) for fp, c in files), return_exceptions=True
+        )
+        return sum(1 for r in results if r is True)
+
+    def push_user_files_batch(self, user_id: str, files: list[tuple[str, bytes]]) -> None:
+        """用户上传后立即 fire-and-forget 直推 MinIO（首选入口，安全无副作用）。
+
+        在独立后台线程/事件循环上跑，绝不阻塞调用方（上传响应/聊天）。MinIO 不可用
+        或上传失败都不影响主流程，只记日志——会话末尾的全量扫描会兜底。
+        保持对 _background_tasks 的强引用，防止 GC 提前回收正在跑的任务。
+        """
+        if not self.is_available():
+            return
+        # 去掉空内容/空路径，并 strip 前导斜杠与 ./
+        norm = []
+        for fp, content in files:
+            if not fp or content is None:
+                continue
+            clean = fp.replace("\\", "/").lstrip("./").lstrip("/")
+            if not clean:
+                continue
+            norm.append((clean, content))
+        if not norm:
+            return
+
+        # 逐个 upload_bytes 是同步 minio SDK 调用，丢到线程里做更省事也更稳；
+        # 这里用一整批一个 to_thread 而不是每文件一个，减少线程调度开销。
+        async def _run():
+            try:
+                ok = await asyncio.to_thread(self._push_batch_sync, user_id, norm)
+                SYLogger.info(
+                    f"[MinIO] 用户文件已直推: user={user_id}, ok={ok}/{len(norm)}")
+            except Exception as e:
+                SYLogger.warning(f"[MinIO] 用户文件直推失败（不影响主流程）: user={user_id}, error={e}")
+
+        try:
+            coro = _run()
+            self._background_tasks.add(coro)
+            coro.add_done_callback(self._background_tasks.discard)
+            asyncio.ensure_future(coro)
+        except RuntimeError:
+            # 无运行中的事件循环（极少数调用上下文），退化为后台线程兜底
+            import threading
+            def _bg():
+                try:
+                    ok = self._push_batch_sync(user_id, norm)
+                    SYLogger.info(
+                        f"[MinIO] 用户文件已直推(bg-thread): user={user_id}, ok={ok}/{len(norm)}")
+                except Exception as e:
+                    SYLogger.warning(f"[MinIO] 用户文件直推失败(bg): user={user_id}, error={e}")
+            threading.Thread(
+                target=_bg, name=f"minio-userpush-{user_id}", daemon=True
+            ).start()
+
     # ============== 反向同步（MinIO → 沙箱） ==============
 
     async def restore_from_minio(self, sandbox_backend, user_id: str) -> int:

{sycommon_python_lib-0.2.7a18 → sycommon_python_lib-0.2.7a20}/src/sycommon/middleware/sandbox.py

@@ -136,7 +136,6 @@ def _build_init_script(workspace: str) -> str:
         safe_workspace = workspace.replace("'", "''")
         return f'''
 $env:SANDBOX_ROOT = '{safe_workspace}'
-$env:_SANDBOX_WORKSPACE = '{safe_workspace}'
 Set-Location '{safe_workspace}'
 '''
 
@@ -144,7 +143,6 @@ Set-Location '{safe_workspace}'
     return f'''
 # 沙箱环境初始化
 export SANDBOX_ROOT={safe_workspace}
-export _SANDBOX_WORKSPACE={safe_workspace}
 
 # 资源限制（防止失控进程）
 ulimit -f 1048576 2>/dev/null     # 单文件最大 1GB
@@ -154,7 +152,7 @@ ulimit -c 0 2>/dev/null           # 禁止 core dump
 sandbox_path() {{
     local path="$1"
     # 如果路径已经在 workspace 内，直接返回
-    if [[ "$path" == "$_SANDBOX_WORKSPACE"* ]]; then
+    if [[ "$path" == "$SANDBOX_ROOT"* ]]; then
         echo "$path"
         return
     fi
@@ -162,7 +160,7 @@ sandbox_path() {{
     if [[ "$path" == /* ]]; then
         # 移除开头的 /
         path="${{path#/}}"
-        echo "$_SANDBOX_WORKSPACE/$path"
+        echo "$SANDBOX_ROOT/$path"
     else
         # 相对路径，基于当前目录
         echo "$path"
@@ -173,13 +171,13 @@ sandbox_path() {{
 cd() {{
     local target="$1"
     if [[ -z "$target" ]]; then
-        command cd "$_SANDBOX_WORKSPACE"
-    elif [[ "$target" == "$_SANDBOX_WORKSPACE"* ]]; then
+        command cd "$SANDBOX_ROOT"
+    elif [[ "$target" == "$SANDBOX_ROOT"* ]]; then
         # 路径已经在 workspace 内，直接 cd
         command cd "$target"
     elif [[ "$target" == /* ]]; then
         # 其他绝对路径映射到沙箱内
-        local mapped="$_SANDBOX_WORKSPACE/${{target#/}}"
+        local mapped="$SANDBOX_ROOT/${{target#/}}"
         command cd "$mapped"
     else
         command cd "$target"
@@ -191,11 +189,11 @@ mkdir() {{
     local args=("$@")
     local new_args=()
     for arg in "${{args[@]}}"; do
-        if [[ "$arg" == "$_SANDBOX_WORKSPACE"* ]]; then
+        if [[ "$arg" == "$SANDBOX_ROOT"* ]]; then
             # 路径已经在 workspace 内，直接使用
             new_args+=("$arg")
         elif [[ "$arg" == /* ]]; then
-            new_args+=("$_SANDBOX_WORKSPACE/${{arg#/}}")
+            new_args+=("$SANDBOX_ROOT/${{arg#/}}")
         else
             new_args+=("$arg")
         fi
@@ -204,7 +202,7 @@ mkdir() {{
 }}
 
 # 切换到 workspace 目录
-cd "$_SANDBOX_WORKSPACE"
+cd "$SANDBOX_ROOT"
 '''
 
 def _sanitize_user_id(user_id: str) -> str:

{sycommon_python_lib-0.2.7a18 → sycommon_python_lib-0.2.7a20}/src/sycommon_python_lib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sycommon-python-lib
-Version: 0.2.7a18
+Version: 0.2.7a20
 Summary: Add your description here
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -18,7 +18,7 @@ Requires-Dist: langchain==1.3.11
 Requires-Dist: langchain-core==1.4.8
 Requires-Dist: langchain-openai==1.3.3
 Requires-Dist: langfuse==4.13.0
-Requires-Dist: langgraph==1.2.7
+Requires-Dist: langgraph==1.2.8
 Requires-Dist: langgraph-checkpoint-postgres==3.1.0
 Requires-Dist: langgraph-checkpoint-redis==0.5.0
 Requires-Dist: ldap3==2.9.1
@@ -43,7 +43,7 @@ Requires-Dist: minio==7.2.20
 Requires-Dist: langchain-mcp-adapters==0.3.0
 Requires-Dist: fastapi-mcp==0.4.0
 Requires-Dist: psycopg[binary,pool]==3.3.4
-Requires-Dist: agent-client-protocol==0.10.1
+Requires-Dist: agent-client-protocol==0.11.0
 
 # sycommon-python-lib
 

{sycommon_python_lib-0.2.7a18 → sycommon_python_lib-0.2.7a20}/src/sycommon_python_lib.egg-info/SOURCES.txt

@@ -323,6 +323,7 @@ tests/test_hotreload_snapshot.py
 tests/test_llm_apikey_contextvar.py
 tests/test_log_masker.py
 tests/test_resilient_pg_saver.py
+tests/test_sandbox_path_guard.py
 tests/test_sensitive_guard.py
 tests/test_simple_chat_agent.py
 tests/test_skill_regex_upgrade.py

{sycommon_python_lib-0.2.7a18 → sycommon_python_lib-0.2.7a20}/src/sycommon_python_lib.egg-info/requires.txt

@@ -12,7 +12,7 @@ langchain==1.3.11
 langchain-core==1.4.8
 langchain-openai==1.3.3
 langfuse==4.13.0
-langgraph==1.2.7
+langgraph==1.2.8
 langgraph-checkpoint-postgres==3.1.0
 langgraph-checkpoint-redis==0.5.0
 ldap3==2.9.1
@@ -37,4 +37,4 @@ minio==7.2.20
 langchain-mcp-adapters==0.3.0
 fastapi-mcp==0.4.0
 psycopg[binary,pool]==3.3.4
-agent-client-protocol==0.10.1
+agent-client-protocol==0.11.0