sycommon-python-lib 0.2.7a21__tar.gz → 0.2.7a23__tar.gz

{sycommon_python_lib-0.2.7a21 → sycommon_python_lib-0.2.7a23}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sycommon-python-lib
-Version: 0.2.7a21
+Version: 0.2.7a23
 Summary: Add your description here
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown

{sycommon_python_lib-0.2.7a21 → sycommon_python_lib-0.2.7a23}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sycommon-python-lib"
-version = "0.2.7a21"
+version = "0.2.7a23"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.11"

{sycommon_python_lib-0.2.7a21 → sycommon_python_lib-0.2.7a23}/src/sycommon/agent/middleware/sandbox_path_guard.py

@@ -61,7 +61,13 @@ _PATH_TOOLS = {
 
 # 宿主沙箱根前缀(用于 execute 命令串扫描;shell 里无法安全改写,只能拦)。
 # 命中即视为「引用了宿主沙箱真实路径」,一律拦。
-_HOST_SANDBOX_RE = re.compile(re.escape(_WORKSPACE_ROOT) + r'(?:/|\\)')
+# 注意：要拦到「根目录本身」和「根下子路径」两种形式。原来要求尾斜杠
+# (_WORKSPACE_ROOT/)，会漏过 `find /data/sycommon_sandbox -name x`（后跟空格，
+# 没有尾斜杠）这种「拿沙箱根当 find 起点」的越权扫描。改为允许「尾斜杠」或
+# 「词边界(后跟空白/行尾/引号)」，根目录本身与任意子路径都能命中。
+_HOST_SANDBOX_RE = re.compile(
+    re.escape(_WORKSPACE_ROOT) + r'(?:[/\\]|(?=\s|$|["\']))'
+)
 
 _DENIED_MSG = (
     "Error: 不允许使用宿主机绝对路径访问沙箱文件。"

{sycommon_python_lib-0.2.7a21 → sycommon_python_lib-0.2.7a23}/src/sycommon/agent/middleware/skill_api_whitelist.py

@@ -19,6 +19,8 @@
 allowlist:[] 空数组 → 注入空白名单（全拦截）。
 """
 
+import base64
+import hashlib
 import json
 import os
 import re
@@ -26,6 +28,7 @@ import shlex
 from typing import Optional
 
 from langchain.agents.middleware.types import AgentMiddleware
+from langchain_core.messages import ToolMessage
 from langgraph.prebuilt.tool_node import ToolCallRequest
 
 from sycommon.logging.kafka_log import SYLogger
@@ -41,14 +44,94 @@ _SKILL_TOP_RE = re.compile(
 # BASE_URL 占位符 ${VAR}
 _PLACEHOLDER_RE = re.compile(r'\$\{([A-Z_][A-Z0-9_]*)\}')
 
-# 推送到沙箱 workspace 内的 .wl 目录（沙箱强制路径隔离，绝对路径会被映射进 workspace，
-# 故用相对 POSIX 路径，落地为 {workspace}/.wl/，再 export PYTHONPATH 让 Python 自动 import）
-_PUSH_FILES = [
-    ("sitecustomize.py", ".wl/sitecustomize.py"),
-    ("skill_wl_check.py", ".wl/skill_wl_check.py"),
-]
 # workspace 内白名单目录的 shell 形式（init_script 已 export $SANDBOX_ROOT，运行期展开）
 _WL_DIR = "$SANDBOX_ROOT/.wl"
+# .wl 目录在 workspace 内的相对路径段（用于 hash 校验命令里的文件名）
+_WL_FILES = [
+    ".wl/sitecustomize.py",          # 极小 loader（明文，无业务逻辑）
+    ".wl/sitecustomize.payload",     # sitecustomize.py 源码的 base64
+    ".wl/skill_wl_check.payload",    # skill_wl_check.py 源码的 base64
+]
+
+# ---- 极小 loader（落盘为 .wl/sitecustomize.py）----
+# 不含任何白名单/拦截业务逻辑，只做"解码同目录 payload + exec"。
+# 关键：把 skill_wl_check 注册成真模块对象进 sys.modules，使 sitecustomize.payload
+# 里的 `import skill_wl_check; skill_wl_check.match(...)` 按原逻辑工作（逻辑不变）。
+_LOADER_SRC = b'''# sycommon injected loader: decode payloads, exec them. No business logic.
+import os, sys, base64, types
+_HERE = os.path.dirname(os.path.abspath(__file__))
+if _HERE not in sys.path:
+    sys.path.insert(0, _HERE)
+
+
+def _run(name, ns):
+    p = os.path.join(_HERE, name)
+    try:
+        with open(p, "rb") as f:
+            exec(compile(base64.b64decode(f.read()), name, "exec"), ns)
+    except Exception as _e:
+        sys.stderr.write("[.wl loader] load %s failed: %s\\n" % (name, _e))
+
+
+_wl = types.ModuleType("skill_wl_check")
+sys.modules["skill_wl_check"] = _wl
+_run("skill_wl_check.payload", _wl.__dict__)
+_run("sitecustomize.payload", globals())
+'''
+
+
+def _build_payload(src_name: str) -> bytes:
+    """读包内源码并 base64 编码，作为 .payload 落盘内容（防明文窥探）。"""
+    raw = _load_resource_bytes(src_name)
+    return base64.b64encode(raw)
+
+
+def _expected_hashes() -> dict:
+    """运行时从主进程源码算各 .wl 文件的预期 sha256（hex）。
+
+    payload 的预期 hash 算的是【编码后的 base64 字节】——即沙箱里实际落盘内容，
+    这样 sha256 比对的就是真实文件内容。loader 的预期 hash 算 _LOADER_SRC（固定常量）。
+    """
+    loader_bytes = _LOADER_SRC
+    sc_bytes = _build_payload("sitecustomize.py")
+    wl_bytes = _build_payload("skill_wl_check.py")
+    return {
+        ".wl/sitecustomize.py": hashlib.sha256(loader_bytes).hexdigest(),
+        ".wl/sitecustomize.payload": hashlib.sha256(sc_bytes).hexdigest(),
+        ".wl/skill_wl_check.payload": hashlib.sha256(wl_bytes).hexdigest(),
+    }
+
+
+# ---- .wl 写拦截（复刻 skill_write_guard 的正则集合）----
+# .wl 目录保护：精确匹配 .wl 或 .wl/...（带边界，防误伤 myapp.wl 之类）
+_WL_PROTECTED_RE = re.compile(r'\.wl(?:/|\s|"|\'|$)')
+# 写动作动词（命令首或分号/管道/空格后）
+_WRITE_VERB_RE = re.compile(
+    r'(^|[\s;&|])(rm|rmdir|mv|cp|chmod|chown|tee|truncate|install|rsync|scp|dd|>\.wl)\b')
+# 输出重定向 > 或 >>
+_REDIRECT_RE = re.compile(r'>>?')
+_WL_DENIED_MSG = "Error: .wl 为系统注入目录，禁止写入/修改/删除。"
+
+
+def _command_writes_wl(cmd: str) -> bool:
+    """execute 命令是否在写 .wl：命中 .wl 路径 且 含写动词或重定向。"""
+    if not _WL_PROTECTED_RE.search(cmd or ""):
+        return False
+    return bool(_WRITE_VERB_RE.search(cmd) or _REDIRECT_RE.search(cmd))
+
+
+def _is_wl_path(p: str) -> bool:
+    """file_path 是否落在 .wl 目录内（write_file/edit_file 拦截用）。
+
+    注意不能用 lstrip("./")——它是按字符集 strip，会把 ".wl" 的前导 "." 也吃成 "wl"。
+    改为逐前缀剥离再判。
+    """
+    s = (p or "").strip().replace("\\", "/")
+    # 剥前导 ./ 和 /
+    while s.startswith("./") or s.startswith("/"):
+        s = s[1:] if s.startswith("/") else s[2:]
+    return s == ".wl" or s.startswith(".wl/")
+
 
 
 def _resolve_placeholders(pattern: str, env_lookup) -> Optional[str]:
@@ -120,7 +203,8 @@ class SkillApiWhitelistMiddleware(AgentMiddleware):
 
     def __init__(self, sandbox_backend):
         self._backend = sandbox_backend
-        self._pushed: bool = False  # 注入脚本是否已推送（每 backend 实例一次）
+        # 注：不再缓存"已推送"标志。用户可在会话中删除 .wl/ 绕过白名单，
+        # 故改为每次 execute 前校验文件完整性、缺则重推（见 _ensure_sitecustomize）。
 
     def _env_lookup(self):
         """构造占位符查找器：先查主进程 os.environ，再查 sandbox env 字典。
@@ -155,27 +239,54 @@ class SkillApiWhitelistMiddleware(AgentMiddleware):
 
     # ---- 懒加载:把注入脚本推进沙箱 workspace/.wl ----
     async def _ensure_sitecustomize(self) -> bool:
-        """把 sitecustomize.py + skill_wl_check.py 推到沙箱 workspace 内的 .wl 目录。
+        """把 loader + 2 个 base64 payload 推到沙箱 workspace 内的 .wl 目录。
 
-        沙箱强制路径隔离：任何绝对路径都会被 resolve_sandbox_path 映射进用户 workspace，
-        真实 site-packages 无法写入。故改用「推到 workspace/.wl/ + export PYTHONPATH」
-        的方案：Python 启动时若 .wl 在 PYTHONPATH 上，会自动 import sitecustomize。
-
-        幂等：每个 backend 实例只推一次（_pushed 标记）。失败 fail-open（不阻塞业务）。
+        防篡改 + 自愈：每次 execute 前对 3 个文件算 sha256，与主进程源码算出的
+        预期 hash 比对。任一文件缺失/被改 → 全量重推 + chmod 555。
+        旧的 test -f 存在性校验挡不住「用户把 sitecustomize 改成空文件」，
+        sha256 内容校验才能挡。失败 fail-open（不阻塞业务）。
         """
-        if self._pushed:
-            return True
         backend = self._backend
         if backend is None:
             return False
         try:
-            files = []
-            for src, dst in _PUSH_FILES:
-                content = _load_resource_bytes(src)
-                files.append((dst, content))
+            expected = _expected_hashes()
+            # 一条命令取三个文件的 sha256（缺失则该行输出 MISSING），换行拼接返回。
+            files_quoted = " ".join(
+                shlex.quote(f) for f in _WL_FILES)
+            check_cmd = (
+                f'for f in {files_quoted}; do '
+                f'if [ -f "$SANDBOX_ROOT/$f" ]; then '
+                f'sha256sum "$SANDBOX_ROOT/$f" 2>/dev/null | cut -d" " -f1; '
+                f'else echo MISSING; fi; done'
+            )
+            try:
+                resp = await backend.aexecute(check_cmd)
+                actual_lines = (getattr(resp, "output", "") or "").strip().splitlines()
+            except Exception:
+                actual_lines = []
+
+            # 逐文件比对：长度/顺序与 _WL_FILES 对应
+            intact = (len(actual_lines) == len(_WL_FILES)
+                      and all(actual_lines[i] == expected[_WL_FILES[i]]
+                              for i in range(len(_WL_FILES))))
+
+            if intact:
+                return True  # 内容完整，无需重推
+
+            # 重推：loader 明文 + 2 个 payload
+            files = [
+                (".wl/sitecustomize.py", _LOADER_SRC),
+                (".wl/sitecustomize.payload", _build_payload("sitecustomize.py")),
+                (".wl/skill_wl_check.payload", _build_payload("skill_wl_check.py")),
+            ]
             await backend.aupload_files(files)
-            self._pushed = True
-            SYLogger.info("[Whitelist] 注入脚本已推送至沙箱 %s", _WL_DIR)
+            # chmod -R 555：挡普通用户改/删（root 仍可绕，靠 sha256 自愈兜底）
+            try:
+                await backend.aexecute(f'chmod -R 555 "{_WL_DIR}"')
+            except Exception as _ce:
+                SYLogger.warning("[Whitelist] chmod .wl 555 失败(非致命): %s", _ce)
+            SYLogger.info("[Whitelist] 注入脚本已(重新)推送至沙箱 %s (sha256 校验触发)", _WL_DIR)
             return True
         except Exception as e:
             SYLogger.error("[Whitelist] 推送 sitecustomize 失败(fail-open): %s", e)
@@ -195,10 +306,25 @@ class SkillApiWhitelistMiddleware(AgentMiddleware):
         handler,
     ):
         tc = request.tool_call
-        if tc.get("name") != "execute":
+        name = tc.get("name")
+        args = tc.get("args", {}) or {}
+
+        # ---- .wl 写拦截（短路 fail-closed，在任何业务逻辑之前）----
+        # 防 agent 经 write_file/edit_file/execute 篡改注入目录。参考 SkillWriteGuard。
+        if name in ("write_file", "edit_file"):
+            fp = args.get("file_path") if isinstance(args, dict) else ""
+            if _is_wl_path(fp):
+                return ToolMessage(content=_WL_DENIED_MSG, name=name,
+                                   tool_call_id=tc.get("id", ""), status="error")
+        elif name == "execute":
+            command = args.get("command", "") if isinstance(args, dict) else ""
+            if _command_writes_wl(command):
+                return ToolMessage(content=_WL_DENIED_MSG, name="execute",
+                                   tool_call_id=tc.get("id", ""), status="error")
+
+        if name != "execute":
             return await handler(request)
 
-        args = tc.get("args", {}) or {}
         command = args.get("command", "") if isinstance(args, dict) else ""
         if not command:
             return await handler(request)

{sycommon_python_lib-0.2.7a21 → sycommon_python_lib-0.2.7a23}/src/sycommon/agent/sandbox/file_ops.py

@@ -54,6 +54,25 @@ _EDIT_ERROR_CODE_MAP = {
 }
 
 
+# 服务端 /ls 错误码 -> 人类可读文案（对齐 BaseSandbox._parse_ls_output 的
+# path_not_found / not_a_directory 语义）。未在表内的码原样透传。
+_LS_ERROR_MAP = {
+    "path_not_found": "path not found",
+    "not_a_directory": "not a directory",
+    "permission_denied": "permission denied",
+    "list_failed": "listing failed",
+}
+
+
+# 服务端 /delete 错误码 -> 人类可读文案（统一前缀 "Failed to delete '<path>': ..."，
+# 与 write 的 "Failed to write file '<path>': ..." 风格一致）。
+_DELETE_ERROR_MAP = {
+    "file_not_found": "file not found",
+    "is_directory": "is a directory, set recursive=true",
+    "permission_denied": "permission denied",
+}
+
+
 def _normalize_edit_error(error: str, file_path: str, old_string: str) -> str:
     """把服务端的自由格式错误串映射成与 BaseSandbox 一致的可读消息。
 
@@ -282,7 +301,14 @@ class FileOperationsMixin:
                 "path": path,
                 "user_id": self.user_id
             })
-            # 服务端 /ls 失败时返回 []（无 error 字段），HTTP 层失败已进 except
+            # 服务端路径不存在/非目录时返回 {"error": "path_not_found"/"not_a_directory"/...}
+            # 对齐 BaseSandbox._parse_ls_output，映射成 "Path '<path>': <reason>"，
+            # 而非当成空目录成功（否则 agent 会误判路径存在但无文件）。
+            if isinstance(result, dict) and result.get("error"):
+                err = result["error"]
+                # 归一化错误码为人类可读文案（对齐 BaseSandbox 的 path_not_found/not_a_directory 语义）
+                err_msg = _LS_ERROR_MAP.get(err, err)
+                return LsResult(entries=None, error=f"Path '{path}': {err_msg}")
             entries = [FileInfo(**item) for item in (result or [])]
             SYLogger.info(f"[Sandbox] 目录内容: {len(entries)} 项")
             return LsResult(entries=entries)
@@ -300,6 +326,10 @@ class FileOperationsMixin:
                 "path": path,
                 "user_id": self.user_id
             }, timeout=timeout)
+            if isinstance(result, dict) and result.get("error"):
+                err = result["error"]
+                err_msg = _LS_ERROR_MAP.get(err, err)
+                return LsResult(entries=None, error=f"Path '{path}': {err_msg}")
             entries = [FileInfo(**item) for item in (result or [])]
             SYLogger.info(f"[Sandbox] 目录内容: {len(entries)} 项")
             return LsResult(entries=entries)
@@ -606,7 +636,10 @@ class FileOperationsMixin:
     # ============== 树形目录 ==============
 
     def tree(self: "HTTPSandboxBackend", path: str = "/", max_depth: int = 30, max_files: int = 0) -> TreeResult:
-        """以树形结构展示目录"""
+        """以树形结构展示目录
+
+        错误前缀对齐 read/ls/grep/glob：统一包装为 "Path '<path>': <reason>"。
+        """
         try:
             self._lazy_sync_skill_from_path_sync(path)
             self._ensure_synced_sync()
@@ -618,13 +651,13 @@ class FileOperationsMixin:
                 "max_files": max_files,
             })
             if result.get("error"):
-                return TreeResult(error=result["error"])
+                return TreeResult(error=f"Path '{path}': {result['error']}")
             tree_node = TreeNode(
                 **result["tree"]) if result.get("tree") else None
             return TreeResult(tree=tree_node)
         except Exception as e:
             SYLogger.error(f"[Sandbox] tree 失败: {e}")
-            return TreeResult(error=str(e))
+            return TreeResult(error=f"Path '{path}': {e}")
 
     async def atree(self: "HTTPSandboxBackend", path: str = "/", max_depth: int = 30, max_files: int = 0, *, timeout: int = None) -> TreeResult:
         """异步以树形结构展示目录"""
@@ -639,13 +672,13 @@ class FileOperationsMixin:
                 "max_files": max_files,
             }, timeout=timeout)
             if result.get("error"):
-                return TreeResult(error=result["error"])
+                return TreeResult(error=f"Path '{path}': {result['error']}")
             tree_node = TreeNode(
                 **result["tree"]) if result.get("tree") else None
             return TreeResult(tree=tree_node)
         except Exception as e:
             SYLogger.error(f"[Sandbox] 异步 tree 失败: {e}")
-            return TreeResult(error=str(e))
+            return TreeResult(error=f"Path '{path}': {e}")
 
     def grep(
         self: "HTTPSandboxBackend",
@@ -745,7 +778,12 @@ class FileOperationsMixin:
         path: str,
         recursive: bool = False,
     ) -> DeleteResult:
-        """删除文件或文件夹"""
+        """删除文件或文件夹
+
+        错误文案对齐 write 的 "Failed to write file '<path>': ..." 风格，
+        统一为 "Failed to delete '<path>': <reason>"，并把服务端错误码
+        归一化（file_not_found / is_directory / permission_denied）。
+        """
         try:
             self._lazy_sync_skill_from_path_sync(path)
             self._ensure_synced_sync()
@@ -755,18 +793,15 @@ class FileOperationsMixin:
                 "user_id": self.user_id,
                 "recursive": recursive,
             })
-            delete_result = DeleteResult(
-                path=result.get("path", path),
-                error=result.get("error"),
-            )
-            if delete_result.error:
-                SYLogger.error(f"[Sandbox] 删除失败: {delete_result.error}")
-            else:
-                SYLogger.info(f"[Sandbox] 删除成功: {delete_result.path}")
-            return delete_result
+            err = result.get("error")
+            if err:
+                err_msg = _DELETE_ERROR_MAP.get(err, err)
+                return DeleteResult(path=path, error=f"Failed to delete '{path}': {err_msg}")
+            SYLogger.info(f"[Sandbox] 删除成功: {result.get('path', path)}")
+            return DeleteResult(path=result.get("path", path), error=None)
         except Exception as e:
             SYLogger.error(f"[Sandbox] 删除异常: {e}")
-            return DeleteResult(path=path, error=str(e))
+            return DeleteResult(path=path, error=f"Failed to delete '{path}': {e}")
 
     async def adelete(
         self: "HTTPSandboxBackend",
@@ -780,6 +815,8 @@ class FileOperationsMixin:
 
         _skip_lazy_sync=True 时跳过懒同步（供内部技能覆盖删除用，
         避免「删之前先把要删的技能上传一遍」的浪费）。
+
+        错误文案对齐 write/delete：统一 "Failed to delete '<path>': <reason>"。
         """
         try:
             if not _skip_lazy_sync:
@@ -791,18 +828,15 @@ class FileOperationsMixin:
                 "user_id": self.user_id,
                 "recursive": recursive,
             }, timeout=timeout)
-            delete_result = DeleteResult(
-                path=result.get("path", path),
-                error=result.get("error"),
-            )
-            if delete_result.error:
-                SYLogger.error(f"[Sandbox] 异步删除失败: {delete_result.error}")
-            else:
-                SYLogger.info(f"[Sandbox] 异步删除成功: {delete_result.path}")
-            return delete_result
+            err = result.get("error")
+            if err:
+                err_msg = _DELETE_ERROR_MAP.get(err, err)
+                return DeleteResult(path=path, error=f"Failed to delete '{path}': {err_msg}")
+            SYLogger.info(f"[Sandbox] 异步删除成功: {result.get('path', path)}")
+            return DeleteResult(path=result.get("path", path), error=None)
         except Exception as e:
             SYLogger.error(f"[Sandbox] 异步删除异常: {e}")
-            return DeleteResult(path=path, error=str(e))
+            return DeleteResult(path=path, error=f"Failed to delete '{path}': {e}")
 
     # ============== 文件存在检查 ==============
 

{sycommon_python_lib-0.2.7a21 → sycommon_python_lib-0.2.7a23}/src/sycommon/agent/sandbox/http_sandbox_backend.py

@@ -1020,10 +1020,13 @@ class HTTPSandboxBackend(FileOperationsMixin, SandboxBackendProtocol):
                     "path": remote_path,
                     "user_id": self._user_id
                 }, timeout=timeout)
-                if ls_result and not ls_result.get("error"):
-                    for item in ls_result.get("files", ls_result.get("children", [])):
+                # /ls 返回可能是 list[FileInfo]（成功）或 {"error": ...}（路径不存在）。
+                # 路径不存在时不视为错误——相当于无已有子目录可跳过，走全量同步。
+                items = ls_result if isinstance(ls_result, list) else (ls_result or {}).get("files", [])
+                if ls_result and not (isinstance(ls_result, dict) and ls_result.get("error")):
+                    for item in items:
                         if item.get("is_dir", False):
-                            existing_subdirs.add(item.get("name", ""))
+                            existing_subdirs.add(item.get("name", item.get("path", "").rstrip("/").split("/")[-1]))
                     if existing_subdirs:
                         SYLogger.info(
                             f"[Sandbox] partial 模式，跳过已有子目录: {existing_subdirs}")
@@ -1398,10 +1401,12 @@ class HTTPSandboxBackend(FileOperationsMixin, SandboxBackendProtocol):
                     "path": remote_path,
                     "user_id": self._user_id
                 })
-                if ls_result and not ls_result.get("error"):
-                    for item in ls_result.get("files", ls_result.get("children", [])):
+                # /ls 成功返回 list[FileInfo]，路径不存在返回 {"error":...}（不视为错误，走全量）。
+                items = ls_result if isinstance(ls_result, list) else (ls_result or {}).get("files", [])
+                if ls_result and not (isinstance(ls_result, dict) and ls_result.get("error")):
+                    for item in items:
                         if item.get("is_dir", False):
-                            existing_subdirs.add(item.get("name", ""))
+                            existing_subdirs.add(item.get("name", item.get("path", "").rstrip("/").split("/")[-1]))
                     if existing_subdirs:
                         SYLogger.info(
                             f"[Sandbox] partial 模式，跳过已有子目录: {existing_subdirs}")