sycommon-python-lib 0.2.7a22__py3-none-any.whl → 0.2.7a23__py3-none-any.whl

sycommon/agent/middleware/skill_api_whitelist.py

@@ -19,6 +19,8 @@
 allowlist:[] 空数组 → 注入空白名单（全拦截）。
 """
 
+import base64
+import hashlib
 import json
 import os
 import re
@@ -26,6 +28,7 @@ import shlex
 from typing import Optional
 
 from langchain.agents.middleware.types import AgentMiddleware
+from langchain_core.messages import ToolMessage
 from langgraph.prebuilt.tool_node import ToolCallRequest
 
 from sycommon.logging.kafka_log import SYLogger
@@ -41,14 +44,94 @@ _SKILL_TOP_RE = re.compile(
 # BASE_URL 占位符 ${VAR}
 _PLACEHOLDER_RE = re.compile(r'\$\{([A-Z_][A-Z0-9_]*)\}')
 
-# 推送到沙箱 workspace 内的 .wl 目录（沙箱强制路径隔离，绝对路径会被映射进 workspace，
-# 故用相对 POSIX 路径，落地为 {workspace}/.wl/，再 export PYTHONPATH 让 Python 自动 import）
-_PUSH_FILES = [
-    ("sitecustomize.py", ".wl/sitecustomize.py"),
-    ("skill_wl_check.py", ".wl/skill_wl_check.py"),
-]
 # workspace 内白名单目录的 shell 形式（init_script 已 export $SANDBOX_ROOT，运行期展开）
 _WL_DIR = "$SANDBOX_ROOT/.wl"
+# .wl 目录在 workspace 内的相对路径段（用于 hash 校验命令里的文件名）
+_WL_FILES = [
+    ".wl/sitecustomize.py",          # 极小 loader（明文，无业务逻辑）
+    ".wl/sitecustomize.payload",     # sitecustomize.py 源码的 base64
+    ".wl/skill_wl_check.payload",    # skill_wl_check.py 源码的 base64
+]
+
+# ---- 极小 loader（落盘为 .wl/sitecustomize.py）----
+# 不含任何白名单/拦截业务逻辑，只做"解码同目录 payload + exec"。
+# 关键：把 skill_wl_check 注册成真模块对象进 sys.modules，使 sitecustomize.payload
+# 里的 `import skill_wl_check; skill_wl_check.match(...)` 按原逻辑工作（逻辑不变）。
+_LOADER_SRC = b'''# sycommon injected loader: decode payloads, exec them. No business logic.
+import os, sys, base64, types
+_HERE = os.path.dirname(os.path.abspath(__file__))
+if _HERE not in sys.path:
+    sys.path.insert(0, _HERE)
+
+
+def _run(name, ns):
+    p = os.path.join(_HERE, name)
+    try:
+        with open(p, "rb") as f:
+            exec(compile(base64.b64decode(f.read()), name, "exec"), ns)
+    except Exception as _e:
+        sys.stderr.write("[.wl loader] load %s failed: %s\\n" % (name, _e))
+
+
+_wl = types.ModuleType("skill_wl_check")
+sys.modules["skill_wl_check"] = _wl
+_run("skill_wl_check.payload", _wl.__dict__)
+_run("sitecustomize.payload", globals())
+'''
+
+
+def _build_payload(src_name: str) -> bytes:
+    """读包内源码并 base64 编码，作为 .payload 落盘内容（防明文窥探）。"""
+    raw = _load_resource_bytes(src_name)
+    return base64.b64encode(raw)
+
+
+def _expected_hashes() -> dict:
+    """运行时从主进程源码算各 .wl 文件的预期 sha256（hex）。
+
+    payload 的预期 hash 算的是【编码后的 base64 字节】——即沙箱里实际落盘内容，
+    这样 sha256 比对的就是真实文件内容。loader 的预期 hash 算 _LOADER_SRC（固定常量）。
+    """
+    loader_bytes = _LOADER_SRC
+    sc_bytes = _build_payload("sitecustomize.py")
+    wl_bytes = _build_payload("skill_wl_check.py")
+    return {
+        ".wl/sitecustomize.py": hashlib.sha256(loader_bytes).hexdigest(),
+        ".wl/sitecustomize.payload": hashlib.sha256(sc_bytes).hexdigest(),
+        ".wl/skill_wl_check.payload": hashlib.sha256(wl_bytes).hexdigest(),
+    }
+
+
+# ---- .wl 写拦截（复刻 skill_write_guard 的正则集合）----
+# .wl 目录保护：精确匹配 .wl 或 .wl/...（带边界，防误伤 myapp.wl 之类）
+_WL_PROTECTED_RE = re.compile(r'\.wl(?:/|\s|"|\'|$)')
+# 写动作动词（命令首或分号/管道/空格后）
+_WRITE_VERB_RE = re.compile(
+    r'(^|[\s;&|])(rm|rmdir|mv|cp|chmod|chown|tee|truncate|install|rsync|scp|dd|>\.wl)\b')
+# 输出重定向 > 或 >>
+_REDIRECT_RE = re.compile(r'>>?')
+_WL_DENIED_MSG = "Error: .wl 为系统注入目录，禁止写入/修改/删除。"
+
+
+def _command_writes_wl(cmd: str) -> bool:
+    """execute 命令是否在写 .wl：命中 .wl 路径 且 含写动词或重定向。"""
+    if not _WL_PROTECTED_RE.search(cmd or ""):
+        return False
+    return bool(_WRITE_VERB_RE.search(cmd) or _REDIRECT_RE.search(cmd))
+
+
+def _is_wl_path(p: str) -> bool:
+    """file_path 是否落在 .wl 目录内（write_file/edit_file 拦截用）。
+
+    注意不能用 lstrip("./")——它是按字符集 strip，会把 ".wl" 的前导 "." 也吃成 "wl"。
+    改为逐前缀剥离再判。
+    """
+    s = (p or "").strip().replace("\\", "/")
+    # 剥前导 ./ 和 /
+    while s.startswith("./") or s.startswith("/"):
+        s = s[1:] if s.startswith("/") else s[2:]
+    return s == ".wl" or s.startswith(".wl/")
+
 
 
 def _resolve_placeholders(pattern: str, env_lookup) -> Optional[str]:
@@ -120,7 +203,8 @@ class SkillApiWhitelistMiddleware(AgentMiddleware):
 
     def __init__(self, sandbox_backend):
         self._backend = sandbox_backend
-        self._pushed: bool = False  # 注入脚本是否已推送（每 backend 实例一次）
+        # 注：不再缓存"已推送"标志。用户可在会话中删除 .wl/ 绕过白名单，
+        # 故改为每次 execute 前校验文件完整性、缺则重推（见 _ensure_sitecustomize）。
 
     def _env_lookup(self):
         """构造占位符查找器：先查主进程 os.environ，再查 sandbox env 字典。
@@ -155,27 +239,54 @@ class SkillApiWhitelistMiddleware(AgentMiddleware):
 
     # ---- 懒加载:把注入脚本推进沙箱 workspace/.wl ----
     async def _ensure_sitecustomize(self) -> bool:
-        """把 sitecustomize.py + skill_wl_check.py 推到沙箱 workspace 内的 .wl 目录。
+        """把 loader + 2 个 base64 payload 推到沙箱 workspace 内的 .wl 目录。
 
-        沙箱强制路径隔离：任何绝对路径都会被 resolve_sandbox_path 映射进用户 workspace，
-        真实 site-packages 无法写入。故改用「推到 workspace/.wl/ + export PYTHONPATH」
-        的方案：Python 启动时若 .wl 在 PYTHONPATH 上，会自动 import sitecustomize。
-
-        幂等：每个 backend 实例只推一次（_pushed 标记）。失败 fail-open（不阻塞业务）。
+        防篡改 + 自愈：每次 execute 前对 3 个文件算 sha256，与主进程源码算出的
+        预期 hash 比对。任一文件缺失/被改 → 全量重推 + chmod 555。
+        旧的 test -f 存在性校验挡不住「用户把 sitecustomize 改成空文件」，
+        sha256 内容校验才能挡。失败 fail-open（不阻塞业务）。
         """
-        if self._pushed:
-            return True
         backend = self._backend
         if backend is None:
             return False
         try:
-            files = []
-            for src, dst in _PUSH_FILES:
-                content = _load_resource_bytes(src)
-                files.append((dst, content))
+            expected = _expected_hashes()
+            # 一条命令取三个文件的 sha256（缺失则该行输出 MISSING），换行拼接返回。
+            files_quoted = " ".join(
+                shlex.quote(f) for f in _WL_FILES)
+            check_cmd = (
+                f'for f in {files_quoted}; do '
+                f'if [ -f "$SANDBOX_ROOT/$f" ]; then '
+                f'sha256sum "$SANDBOX_ROOT/$f" 2>/dev/null | cut -d" " -f1; '
+                f'else echo MISSING; fi; done'
+            )
+            try:
+                resp = await backend.aexecute(check_cmd)
+                actual_lines = (getattr(resp, "output", "") or "").strip().splitlines()
+            except Exception:
+                actual_lines = []
+
+            # 逐文件比对：长度/顺序与 _WL_FILES 对应
+            intact = (len(actual_lines) == len(_WL_FILES)
+                      and all(actual_lines[i] == expected[_WL_FILES[i]]
+                              for i in range(len(_WL_FILES))))
+
+            if intact:
+                return True  # 内容完整，无需重推
+
+            # 重推：loader 明文 + 2 个 payload
+            files = [
+                (".wl/sitecustomize.py", _LOADER_SRC),
+                (".wl/sitecustomize.payload", _build_payload("sitecustomize.py")),
+                (".wl/skill_wl_check.payload", _build_payload("skill_wl_check.py")),
+            ]
             await backend.aupload_files(files)
-            self._pushed = True
-            SYLogger.info("[Whitelist] 注入脚本已推送至沙箱 %s", _WL_DIR)
+            # chmod -R 555：挡普通用户改/删（root 仍可绕，靠 sha256 自愈兜底）
+            try:
+                await backend.aexecute(f'chmod -R 555 "{_WL_DIR}"')
+            except Exception as _ce:
+                SYLogger.warning("[Whitelist] chmod .wl 555 失败(非致命): %s", _ce)
+            SYLogger.info("[Whitelist] 注入脚本已(重新)推送至沙箱 %s (sha256 校验触发)", _WL_DIR)
             return True
         except Exception as e:
             SYLogger.error("[Whitelist] 推送 sitecustomize 失败(fail-open): %s", e)
@@ -195,10 +306,25 @@ class SkillApiWhitelistMiddleware(AgentMiddleware):
         handler,
     ):
         tc = request.tool_call
-        if tc.get("name") != "execute":
+        name = tc.get("name")
+        args = tc.get("args", {}) or {}
+
+        # ---- .wl 写拦截（短路 fail-closed，在任何业务逻辑之前）----
+        # 防 agent 经 write_file/edit_file/execute 篡改注入目录。参考 SkillWriteGuard。
+        if name in ("write_file", "edit_file"):
+            fp = args.get("file_path") if isinstance(args, dict) else ""
+            if _is_wl_path(fp):
+                return ToolMessage(content=_WL_DENIED_MSG, name=name,
+                                   tool_call_id=tc.get("id", ""), status="error")
+        elif name == "execute":
+            command = args.get("command", "") if isinstance(args, dict) else ""
+            if _command_writes_wl(command):
+                return ToolMessage(content=_WL_DENIED_MSG, name="execute",
+                                   tool_call_id=tc.get("id", ""), status="error")
+
+        if name != "execute":
             return await handler(request)
 
-        args = tc.get("args", {}) or {}
         command = args.get("command", "") if isinstance(args, dict) else ""
         if not command:
             return await handler(request)

sycommon/agent/sandbox/file_ops.py

@@ -54,6 +54,25 @@ _EDIT_ERROR_CODE_MAP = {
 }
 
 
+# 服务端 /ls 错误码 -> 人类可读文案（对齐 BaseSandbox._parse_ls_output 的
+# path_not_found / not_a_directory 语义）。未在表内的码原样透传。
+_LS_ERROR_MAP = {
+    "path_not_found": "path not found",
+    "not_a_directory": "not a directory",
+    "permission_denied": "permission denied",
+    "list_failed": "listing failed",
+}
+
+
+# 服务端 /delete 错误码 -> 人类可读文案（统一前缀 "Failed to delete '<path>': ..."，
+# 与 write 的 "Failed to write file '<path>': ..." 风格一致）。
+_DELETE_ERROR_MAP = {
+    "file_not_found": "file not found",
+    "is_directory": "is a directory, set recursive=true",
+    "permission_denied": "permission denied",
+}
+
+
 def _normalize_edit_error(error: str, file_path: str, old_string: str) -> str:
     """把服务端的自由格式错误串映射成与 BaseSandbox 一致的可读消息。
 
@@ -282,7 +301,14 @@ class FileOperationsMixin:
                 "path": path,
                 "user_id": self.user_id
             })
-            # 服务端 /ls 失败时返回 []（无 error 字段），HTTP 层失败已进 except
+            # 服务端路径不存在/非目录时返回 {"error": "path_not_found"/"not_a_directory"/...}
+            # 对齐 BaseSandbox._parse_ls_output，映射成 "Path '<path>': <reason>"，
+            # 而非当成空目录成功（否则 agent 会误判路径存在但无文件）。
+            if isinstance(result, dict) and result.get("error"):
+                err = result["error"]
+                # 归一化错误码为人类可读文案（对齐 BaseSandbox 的 path_not_found/not_a_directory 语义）
+                err_msg = _LS_ERROR_MAP.get(err, err)
+                return LsResult(entries=None, error=f"Path '{path}': {err_msg}")
             entries = [FileInfo(**item) for item in (result or [])]
             SYLogger.info(f"[Sandbox] 目录内容: {len(entries)} 项")
             return LsResult(entries=entries)
@@ -300,6 +326,10 @@ class FileOperationsMixin:
                 "path": path,
                 "user_id": self.user_id
             }, timeout=timeout)
+            if isinstance(result, dict) and result.get("error"):
+                err = result["error"]
+                err_msg = _LS_ERROR_MAP.get(err, err)
+                return LsResult(entries=None, error=f"Path '{path}': {err_msg}")
             entries = [FileInfo(**item) for item in (result or [])]
             SYLogger.info(f"[Sandbox] 目录内容: {len(entries)} 项")
             return LsResult(entries=entries)
@@ -606,7 +636,10 @@ class FileOperationsMixin:
     # ============== 树形目录 ==============
 
     def tree(self: "HTTPSandboxBackend", path: str = "/", max_depth: int = 30, max_files: int = 0) -> TreeResult:
-        """以树形结构展示目录"""
+        """以树形结构展示目录
+
+        错误前缀对齐 read/ls/grep/glob：统一包装为 "Path '<path>': <reason>"。
+        """
         try:
             self._lazy_sync_skill_from_path_sync(path)
             self._ensure_synced_sync()
@@ -618,13 +651,13 @@ class FileOperationsMixin:
                 "max_files": max_files,
             })
             if result.get("error"):
-                return TreeResult(error=result["error"])
+                return TreeResult(error=f"Path '{path}': {result['error']}")
             tree_node = TreeNode(
                 **result["tree"]) if result.get("tree") else None
             return TreeResult(tree=tree_node)
         except Exception as e:
             SYLogger.error(f"[Sandbox] tree 失败: {e}")
-            return TreeResult(error=str(e))
+            return TreeResult(error=f"Path '{path}': {e}")
 
     async def atree(self: "HTTPSandboxBackend", path: str = "/", max_depth: int = 30, max_files: int = 0, *, timeout: int = None) -> TreeResult:
         """异步以树形结构展示目录"""
@@ -639,13 +672,13 @@ class FileOperationsMixin:
                 "max_files": max_files,
             }, timeout=timeout)
             if result.get("error"):
-                return TreeResult(error=result["error"])
+                return TreeResult(error=f"Path '{path}': {result['error']}")
             tree_node = TreeNode(
                 **result["tree"]) if result.get("tree") else None
             return TreeResult(tree=tree_node)
         except Exception as e:
             SYLogger.error(f"[Sandbox] 异步 tree 失败: {e}")
-            return TreeResult(error=str(e))
+            return TreeResult(error=f"Path '{path}': {e}")
 
     def grep(
         self: "HTTPSandboxBackend",
@@ -745,7 +778,12 @@ class FileOperationsMixin:
         path: str,
         recursive: bool = False,
     ) -> DeleteResult:
-        """删除文件或文件夹"""
+        """删除文件或文件夹
+
+        错误文案对齐 write 的 "Failed to write file '<path>': ..." 风格，
+        统一为 "Failed to delete '<path>': <reason>"，并把服务端错误码
+        归一化（file_not_found / is_directory / permission_denied）。
+        """
         try:
             self._lazy_sync_skill_from_path_sync(path)
             self._ensure_synced_sync()
@@ -755,18 +793,15 @@ class FileOperationsMixin:
                 "user_id": self.user_id,
                 "recursive": recursive,
             })
-            delete_result = DeleteResult(
-                path=result.get("path", path),
-                error=result.get("error"),
-            )
-            if delete_result.error:
-                SYLogger.error(f"[Sandbox] 删除失败: {delete_result.error}")
-            else:
-                SYLogger.info(f"[Sandbox] 删除成功: {delete_result.path}")
-            return delete_result
+            err = result.get("error")
+            if err:
+                err_msg = _DELETE_ERROR_MAP.get(err, err)
+                return DeleteResult(path=path, error=f"Failed to delete '{path}': {err_msg}")
+            SYLogger.info(f"[Sandbox] 删除成功: {result.get('path', path)}")
+            return DeleteResult(path=result.get("path", path), error=None)
         except Exception as e:
             SYLogger.error(f"[Sandbox] 删除异常: {e}")
-            return DeleteResult(path=path, error=str(e))
+            return DeleteResult(path=path, error=f"Failed to delete '{path}': {e}")
 
     async def adelete(
         self: "HTTPSandboxBackend",
@@ -780,6 +815,8 @@ class FileOperationsMixin:
 
         _skip_lazy_sync=True 时跳过懒同步（供内部技能覆盖删除用，
         避免「删之前先把要删的技能上传一遍」的浪费）。
+
+        错误文案对齐 write/delete：统一 "Failed to delete '<path>': <reason>"。
         """
         try:
             if not _skip_lazy_sync:
@@ -791,18 +828,15 @@ class FileOperationsMixin:
                 "user_id": self.user_id,
                 "recursive": recursive,
             }, timeout=timeout)
-            delete_result = DeleteResult(
-                path=result.get("path", path),
-                error=result.get("error"),
-            )
-            if delete_result.error:
-                SYLogger.error(f"[Sandbox] 异步删除失败: {delete_result.error}")
-            else:
-                SYLogger.info(f"[Sandbox] 异步删除成功: {delete_result.path}")
-            return delete_result
+            err = result.get("error")
+            if err:
+                err_msg = _DELETE_ERROR_MAP.get(err, err)
+                return DeleteResult(path=path, error=f"Failed to delete '{path}': {err_msg}")
+            SYLogger.info(f"[Sandbox] 异步删除成功: {result.get('path', path)}")
+            return DeleteResult(path=result.get("path", path), error=None)
         except Exception as e:
             SYLogger.error(f"[Sandbox] 异步删除异常: {e}")
-            return DeleteResult(path=path, error=str(e))
+            return DeleteResult(path=path, error=f"Failed to delete '{path}': {e}")
 
     # ============== 文件存在检查 ==============
 

sycommon/agent/sandbox/http_sandbox_backend.py

@@ -1020,10 +1020,13 @@ class HTTPSandboxBackend(FileOperationsMixin, SandboxBackendProtocol):
                     "path": remote_path,
                     "user_id": self._user_id
                 }, timeout=timeout)
-                if ls_result and not ls_result.get("error"):
-                    for item in ls_result.get("files", ls_result.get("children", [])):
+                # /ls 返回可能是 list[FileInfo]（成功）或 {"error": ...}（路径不存在）。
+                # 路径不存在时不视为错误——相当于无已有子目录可跳过，走全量同步。
+                items = ls_result if isinstance(ls_result, list) else (ls_result or {}).get("files", [])
+                if ls_result and not (isinstance(ls_result, dict) and ls_result.get("error")):
+                    for item in items:
                         if item.get("is_dir", False):
-                            existing_subdirs.add(item.get("name", ""))
+                            existing_subdirs.add(item.get("name", item.get("path", "").rstrip("/").split("/")[-1]))
                     if existing_subdirs:
                         SYLogger.info(
                             f"[Sandbox] partial 模式，跳过已有子目录: {existing_subdirs}")
@@ -1398,10 +1401,12 @@ class HTTPSandboxBackend(FileOperationsMixin, SandboxBackendProtocol):
                     "path": remote_path,
                     "user_id": self._user_id
                 })
-                if ls_result and not ls_result.get("error"):
-                    for item in ls_result.get("files", ls_result.get("children", [])):
+                # /ls 成功返回 list[FileInfo]，路径不存在返回 {"error":...}（不视为错误，走全量）。
+                items = ls_result if isinstance(ls_result, list) else (ls_result or {}).get("files", [])
+                if ls_result and not (isinstance(ls_result, dict) and ls_result.get("error")):
+                    for item in items:
                         if item.get("is_dir", False):
-                            existing_subdirs.add(item.get("name", ""))
+                            existing_subdirs.add(item.get("name", item.get("path", "").rstrip("/").split("/")[-1]))
                     if existing_subdirs:
                         SYLogger.info(
                             f"[Sandbox] partial 模式，跳过已有子目录: {existing_subdirs}")

sycommon/middleware/sandbox.py

@@ -103,6 +103,14 @@ async def _cleanup_finished_processes():
 # ============== 常量配置 ==============
 
 MAX_OUTPUT_BYTES = 100_000
+
+# grep 墙钟超时（秒）。对齐 deepagents DEFAULT_GREP_TIMEOUT 的思路：
+# 大目录/死循环 symlink 会让 grep 无限挂住，占满 FastAPI worker。
+_GREP_TIMEOUT = 60
+
+# read 文本路径服务端字节上限（对齐 deepagents _READ_COMMAND_TEMPLATE 的
+# MAX_OUTPUT_BYTES=500KiB）：超大文本文件不会把整包塞进 HTTP 响应/内存。
+_READ_MAX_OUTPUT_BYTES = 500 * 1024
 # 默认工作目录配置
 # - Linux: /data/sycommon_sandbox (固定路径，自动创建)
 # - macOS/Windows: 使用系统临时目录
@@ -399,15 +407,26 @@ def _build_execute_command(init_script: str, user_command: str) -> tuple[str, di
     """
     if platform.system() == "Windows":
         # Windows: PowerShell 执行
+        # 注: Windows 仅本地调试用,未做 stdin 重定向(沙箱生产跑 Linux)。
         full_command = f'''{init_script}
 {user_command}
 '''
         return full_command, {"shell": True}
     else:
         # Linux/macOS: bash heredoc
+        # 用户命令包进 `( ... ) </dev/null`: 对整个子 shell 的 stdin 重定向到
+        # /dev/null,等价于 subprocess 的 stdin=DEVNULL(对齐 deepagents
+        # LocalShellBackend)。作用: 防止读 stdin 的命令(裸 cat / python REPL /
+        # ssh / 脚本里的 input())在沙箱非交互环境下挂死等待输入——否则会一直
+        # 占用 worker 直到 req.timeout(可达 180s)才被超时杀掉。
+        # 之所以要 `( ... )` 包一层: 用户命令可能是复合命令/管道/heredoc,直接
+        # `cmd </dev/null` 只对最后一条生效;包进子 shell 后重定向对该子 shell 内
+        # 所有命令统一生效。经核查全部技能脚本无正常依赖 stdin 的(手动验证码/
+        # 本地报表工具在沙箱里要么有 isatty 守卫走文件方案、要么本就不会触发),
+        # DEVNULL 不影响现有功能。
         full_command = f'''bash <<'COMMAND_EOF'
 {init_script}
-{user_command}
+( {user_command} ) </dev/null
 COMMAND_EOF
 '''
         return full_command, {}
@@ -517,8 +536,12 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
 
         try:
             # 使用 asyncio.create_subprocess_shell 异步执行命令，避免阻塞事件循环
+            # stdin=DEVNULL: 双重保险。命令内部已用 `( ... ) </dev/null` 把子 shell
+            # stdin 重定向(见 _build_execute_command),这里再在 subprocess 层 DEVNULL,
+            # 防止任何遗漏的读 stdin 命令挂住 worker。对齐 deepagents LocalShellBackend。
             process = await asyncio.create_subprocess_shell(
                 full_command,
+                stdin=asyncio.subprocess.DEVNULL,
                 stdout=asyncio.subprocess.PIPE,
                 stderr=asyncio.subprocess.PIPE,
                 cwd=workspace,
@@ -584,7 +607,7 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
                 truncated=False
             )
 
-    @sandbox_router.post("/ls", response_model=list[FileInfo])
+    @sandbox_router.post("/ls")  # response_model 不固定：dict(error)/list[FileInfo]
     async def ls_info(req: LsRequest):
         """列出目录内容
 
@@ -600,8 +623,10 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
 
         def _ls():
             workspace_resolved = os.path.realpath(workspace)
+            if not os.path.exists(target_path):
+                return None, "path_not_found"
             if not os.path.isdir(target_path):
-                return None
+                return None, "not_a_directory"
             results = []
             try:
                 with os.scandir(target_path) as it:
@@ -626,12 +651,13 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
                         results.append(info)
             except Exception as e:
                 SYLogger.error(f"[Sandbox Server] 列目录异常: {e}")
-            return results
+                return None, f"list_failed: {e}"
+            return results, None
 
-        result = await asyncio.to_thread(_ls)
-        if result is None:
-            SYLogger.error(f"[Sandbox Server] 列目录失败: 目录不存在 {target_path}")
-            return []
+        result, err = await asyncio.to_thread(_ls)
+        if err:
+            SYLogger.info(f"[Sandbox Server] 列目录未命中: {target_path} ({err})")
+            return {"error": err}
         SYLogger.info(f"[Sandbox Server] 目录内容: {len(result)} 项")
         return result
 
@@ -704,14 +730,25 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
             if is_text:
                 lines = []
                 lines_read = 0
+                # 服务端字节上限（对齐 deepagents _READ_COMMAND_TEMPLATE 的
+                # MAX_OUTPUT_BYTES）：避免单响应塞入 GB 级文本（超长行/巨大文件），
+                # 触顶即截断并附提示，让客户端走 offset/limit 分页续读。
+                current_bytes = 0
+                truncated = False
                 with open(file_path, 'r', encoding='utf-8', newline=None) as f:
                     for i, line in enumerate(f):
                         if i < req.offset:
                             continue
                         if lines_read >= req.limit:
                             break
-                        lines.append(line.rstrip('\n').rstrip('\r'))
+                        line_clean = line.rstrip('\n').rstrip('\r')
+                        line_bytes = len(line_clean.encode('utf-8')) + 1  # +1 for \n
+                        if current_bytes + line_bytes > _READ_MAX_OUTPUT_BYTES:
+                            truncated = True
+                            break
+                        lines.append(line_clean)
                         lines_read += 1
+                        current_bytes += line_bytes
 
                 if not lines:
                     if req.offset > 0:
@@ -721,6 +758,11 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
                     return ReadResponse(content="System reminder: File exists but has empty contents", error=None)
 
                 content = "\n".join(lines)
+                if truncated:
+                    content += (
+                        "\n\n[Output was truncated due to size limits. "
+                        "Continue reading with a larger offset or smaller limit to inspect the rest of the file.]"
+                    )
                 return ReadResponse(content=content, error=None, encoding="utf-8")
             else:
                 MAX_BINARY_BYTES = 500 * 1024
@@ -772,8 +814,21 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
             if parent:
                 os.makedirs(parent, exist_ok=True)
 
-            with open(file_path, 'wb') as f:
-                f.write(content)
+            # O_NOFOLLOW 防 symlink 写劫持（对齐 deepagents filesystem.py:473-475）：
+            # target 本身若是 symlink（即使 resolve 后仍在 workspace 内，跨用户
+            # 也可被植入），拒绝穿过它写。无 O_NOFOLLOW 平台退化为 open()。
+            flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
+            if hasattr(os, "O_NOFOLLOW"):
+                flags |= os.O_NOFOLLOW
+            if overwrite:
+                flags |= getattr(os, "O_TRUNC", 0)
+            fd = os.open(file_path, flags, 0o644)
+            try:
+                with os.fdopen(fd, 'wb') as f:
+                    f.write(content)
+            except Exception:
+                fd = -1  # fdopen 已接管 fd；这里仅防误关
+                raise
 
             action = "覆盖" if (os.path.exists(file_path) and overwrite) else "新建"
             SYLogger.info(
@@ -827,8 +882,16 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
                 SYLogger.error(f"[Sandbox Server] 编辑失败: 权限不足 {file_path}")
                 return EditResponse(error="permission_denied")
 
-            with open(file_path, 'rb') as f:
-                raw = f.read()
+            # 读取用 O_NOFOLLOW 防 symlink（对齐 deepagents filesystem.py:412）：
+            # 若 file_path 是 symlink，O_NOFOLLOW 会直接报错，不穿过链接读目标。
+            read_flags = os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0)
+            fd = os.open(file_path, read_flags)
+            try:
+                with os.fdopen(fd, 'rb') as f:
+                    raw = f.read()
+            except Exception:
+                fd = -1
+                raise
 
             try:
                 content = raw.decode('utf-8')
@@ -868,8 +931,15 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
             else:
                 new_content = content.replace(matched_old, matched_new, 1)
 
-            with open(file_path, 'wb') as f:
-                f.write(new_content.encode('utf-8'))
+            # O_NOFOLLOW 防 symlink 写劫持（对齐 deepagents filesystem.py:537-539）。
+            write_flags = os.O_WRONLY | os.O_TRUNC | getattr(os, "O_NOFOLLOW", 0)
+            fd = os.open(file_path, write_flags)
+            try:
+                with os.fdopen(fd, 'wb') as f:
+                    f.write(new_content.encode('utf-8'))
+            except Exception:
+                fd = -1
+                raise
 
             SYLogger.info(f"[Sandbox Server] 编辑成功: {file_path} (替换 {count} 处)")
             virtual_path = _to_virtual_path(file_path, workspace)
@@ -895,8 +965,15 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
             parent = os.path.dirname(file_path)
             if parent:
                 os.makedirs(parent, exist_ok=True)
-            with open(file_path, 'wb') as f:
-                f.write(content)
+            # O_NOFOLLOW 防 symlink 写劫持（对齐 deepagents filesystem.py:913-916）。
+            flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC | getattr(os, "O_NOFOLLOW", 0)
+            fd = os.open(file_path, flags, 0o644)
+            try:
+                with os.fdopen(fd, 'wb') as f:
+                    f.write(content)
+            except Exception:
+                fd = -1
+                raise
             return UploadResponse(path=file_path, error=None)
 
         try:
@@ -956,8 +1033,15 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
                     parent = os.path.dirname(file_path)
                     if parent:
                         os.makedirs(parent, exist_ok=True)
-                    with open(file_path, 'wb') as f:
-                        f.write(content)
+                    # O_NOFOLLOW 防 symlink 写劫持（对齐 deepagents filesystem.py）。
+                    flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC | getattr(os, "O_NOFOLLOW", 0)
+                    fd = os.open(file_path, flags, 0o644)
+                    try:
+                        with os.fdopen(fd, 'wb') as f:
+                            f.write(content)
+                    except Exception:
+                        fd = -1
+                        raise
                     results.append(BatchUploadResult(path=file_entry.path))
                     success_count += 1
                 except Exception as e:
@@ -1137,7 +1221,9 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
             return GrepResponse(error=str(e))
 
         quoted_path = shlex.quote(search_path)
-        grep_opts = "-rHnF"
+        # -Z：文件名与行数据之间用 NUL 分隔（对齐 deepagents sandbox.py:783 的 grep -rHnFZ），
+        # 文件名含 ":" 时也能无歧义解析；旧实现按冒号切，遇到含冒号文件名会静默错路径/错行号。
+        grep_opts = "-rHnFZ"
 
         # 安全处理 glob_pattern，使用 shlex.quote 防止命令注入
         glob_pattern = f"--include={shlex.quote(req.glob)}" if req.glob else ""
@@ -1149,11 +1235,23 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
         # 使用 asyncio.create_subprocess_shell 异步执行
         proc = await asyncio.create_subprocess_shell(
             cmd,
+            stdin=asyncio.subprocess.DEVNULL,
             stdout=asyncio.subprocess.PIPE,
             stderr=asyncio.subprocess.PIPE,
             start_new_session=_SUBPROCESS_NEW_SESSION,
         )
-        stdout, stderr = await proc.communicate()
+        # 墙钟超时（对齐 deepagents DEFAULT_GREP_TIMEOUT 思路）：大目录/死循环 symlink
+        # 会让 grep 无限挂住，进而占满 FastAPI worker。超时即杀进程组，返回 partial_error。
+        try:
+            stdout, stderr = await asyncio.wait_for(proc.communicate(), timeout=_GREP_TIMEOUT)
+        except asyncio.TimeoutError:
+            await _kill_process_tree(proc)
+            SYLogger.warning(
+                f"[Sandbox Server] grep 超时({ _GREP_TIMEOUT}s)，已终止: pattern={req.pattern!r}, path={req.path!r}")
+            return GrepResponse(
+                matches=[],
+                partial_error=f"grep timed out after {_GREP_TIMEOUT}s. Try a more specific pattern or a narrower path.",
+            )
         result_text = stdout.decode('utf-8') if stdout else ''
         stderr_text = stderr.decode('utf-8', errors='replace') if stderr else ''
 
@@ -1169,44 +1267,53 @@ def setup_sandbox_handler(app: FastAPI, config: dict = None):
         def _parse_grep_results():
             workspace_resolved = os.path.realpath(workspace)
             matches = []
-            for line in result_text.strip().split("\n"):
-                if not line:
-                    continue
-                first_colon = line.find(":")
-                if first_colon == -1:
-                    continue
-                second_colon = line.find(":", first_colon + 1)
-                if second_colon == -1:
-                    continue
-
-                path_part = line[:first_colon]
-
-                # 路径安全检查（对齐 deepagents 0.6.4）：
-                # resolve 后必须在 workspace 内，跳过 symlink 逃逸的结果
-                try:
-                    resolved = os.path.realpath(path_part)
-                    if not _is_path_within(resolved, workspace_resolved):
-                        SYLogger.warning(f"[Sandbox Server] grep 跳过逃逸路径: {path_part}")
-                        continue
-                except OSError:
-                    continue
-
-                # 将绝对路径转换为虚拟路径
-                try:
-                    virtual_path_part = _to_virtual_path(path_part, workspace)
-                except ValueError:
-                    virtual_path_part = path_part
-                try:
-                    line_num = int(line[first_colon + 1:second_colon])
-                except ValueError:
-                    continue
-                text_part = line[second_colon + 1:]
-
-                matches.append(GrepMatch(
-                    path=virtual_path_part,
-                    line=line_num,
-                    text=text_part
-                ))
+            # grep -Z 输出每条匹配：<path>\0<lineno>:<text>\n，连续拼接。
+            # 按 NUL split 后：
+            #   seg[0] = 第一个 path
+            #   seg[i>0] = "<lineno>:<text>\n<next_path>"（数据 + 紧跟的下一个 path）
+            #   最后一段 = "<lineno>:<text>\n"（无后续 path）
+            # 用「每段按第一个 \n 切：前半是 lineno:text，后半是 next_path」解析，
+            # 这样文件名含 ":"、文本含 ":" 都不会错位（path 整段不按冒号切）。
+            segments = result_text.split("\0")
+            if not segments:
+                return matches
+            current_path = segments[0].rstrip("\n")
+            for seg in segments[1:]:
+                nl = seg.find("\n")
+                if nl == -1:
+                    data_part, next_path = seg, None
+                else:
+                    data_part = seg[:nl]
+                    rest = seg[nl + 1:].rstrip("\n")
+                    next_path = rest or None
+                # data_part = "lineno:text"，按第一个冒号切（文本可含冒号）
+                colon = data_part.find(":")
+                if colon > 0 and data_part[:colon].isdigit():
+                    line_num = int(data_part[:colon])
+                    text_part = data_part[colon + 1:]
+                    if current_path:
+                        path_part = current_path
+                        # 路径安全检查（对齐 deepagents 0.6.4）：
+                        # resolve 后必须在 workspace 内，跳过 symlink 逃逸的结果
+                        try:
+                            resolved = os.path.realpath(path_part)
+                            if not _is_path_within(resolved, workspace_resolved):
+                                SYLogger.warning(f"[Sandbox Server] grep 跳过逃逸路径: {path_part}")
+                                continue
+                        except OSError:
+                            continue
+                        # 将绝对路径转换为虚拟路径
+                        try:
+                            virtual_path_part = _to_virtual_path(path_part, workspace)
+                        except ValueError:
+                            virtual_path_part = path_part
+                        matches.append(GrepMatch(
+                            path=virtual_path_part,
+                            line=line_num,
+                            text=text_part
+                        ))
+                if next_path:
+                    current_path = next_path
             return matches
 
         matches = await asyncio.to_thread(_parse_grep_results)

{sycommon_python_lib-0.2.7a22.dist-info → sycommon_python_lib-0.2.7a23.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sycommon-python-lib
-Version: 0.2.7a22
+Version: 0.2.7a23
 Summary: Add your description here
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown

{sycommon_python_lib-0.2.7a22.dist-info → sycommon_python_lib-0.2.7a23.dist-info}/RECORD

@@ -150,13 +150,13 @@ sycommon/agent/mcp/tool_loader.py,sha256=OQa-lE7RL2s3Lqh-kNOKaUrb130hvorB_HjyFBq
 sycommon/agent/middleware/sandbox_path_guard.py,sha256=K1SnxA8pDxkCSucOkranwUvC9_8rd3l_-TIR8gMMTK8,8102
 sycommon/agent/middleware/sensitive_guard.py,sha256=ApmC094ogG4jIwEWRaUawTpQSDs722k0OTjdeAEQ7Qc,22159
 sycommon/agent/middleware/sitecustomize.py,sha256=Bt7XFnWV_LJo89l858AGp5VUkXwefpLGmjkCtLe-CMw,4800
-sycommon/agent/middleware/skill_api_whitelist.py,sha256=h3CntW-FIdAfrKMo4QoC6lA35f8Y1iH7hcHldYMi4lw,10946
+sycommon/agent/middleware/skill_api_whitelist.py,sha256=2qVsrwS6VkkPKHrvjJMNUfBDokdMJkP-mn-V-ZCn7X8,16643
 sycommon/agent/middleware/skill_wl_check.py,sha256=rCJ9F6aWPh8tVQBIPmcq2lKDsfwiJQduwSUku_8kXfs,3952
 sycommon/agent/middleware/skill_write_guard.py,sha256=ZbeRysGBqn0knjmDWRgPu7c8Pr5lGnjFgeEpAukSSWQ,2702
 sycommon/agent/sandbox/__init__.py,sha256=jR7LlkD4J4Y6QYyRXQClkwmqDBCCPmycV_hQV9p9YHw,4621
 sycommon/agent/sandbox/consistent_hash.py,sha256=8Jgk-W4NAD2-u5_vKRVlPmql_e0Vy4aNORiXOuzvIrs,7277
-sycommon/agent/sandbox/file_ops.py,sha256=e9OwBZZfOtFvVhJ1Lixggi4eD2Djn56naZLiF_YIpa0,35128
-sycommon/agent/sandbox/http_sandbox_backend.py,sha256=2rF33c1x1n2c1H6P_H-AzS7_VoLbDD1xk3l7ZSwJSj8,69863
+sycommon/agent/sandbox/file_ops.py,sha256=VTK7xduMMWLVTr9JViMnmPeh7s8Ojr8YwYA4ovMZZg0,37138
+sycommon/agent/sandbox/http_sandbox_backend.py,sha256=1Cj_JYdvwP3PFPa_4xFPnrGdt67Wp5iQdoziSzjeqoE,70481
 sycommon/agent/sandbox/minio_sync.py,sha256=NuvgI2SQb6pdegei_a4pCqrwTjC8DTxkCvM3ABadljs,29326
 sycommon/agent/sandbox/sandbox_pool.py,sha256=eMn8sLakCWf90l6ni2-333QM8oBdX1CflV-WzneFp_k,9133
 sycommon/agent/sandbox/sandbox_recovery.py,sha256=X-eDODx1tmGMh_iTngV6e1ppfDBHpTdkPreJusN5MHY,7358
@@ -234,7 +234,7 @@ sycommon/middleware/exception.py,sha256=UAy0tKijI_2JoKjwT3h62aL-tybftP3IETvcr26N
 sycommon/middleware/middleware.py,sha256=1qA_0rT7pv1xTfuvA0kdYkxVOHYT6roSSNO7Cmf2wYg,1778
 sycommon/middleware/monitor_memory.py,sha256=pYRK-wRuDd6enSg9Pf8tQxPdYQS6S0AyjyXeKFRLKEs,628
 sycommon/middleware/mq.py,sha256=9X6KKtadFjBXKS5L3kEKujYio9wwGfWgXwWOAHO-HDg,254
-sycommon/middleware/sandbox.py,sha256=BfbVYeYgzbndOc60Cu0ZJbUby1YFOT-q0G_h5AhxVjw,54340
+sycommon/middleware/sandbox.py,sha256=CFisRjXs_hqktuxElDmZB-xKX2vb-Rk2xHE7pc0wf_w,61417
 sycommon/middleware/timeout.py,sha256=KlxOPa8xl2dg6yuRi_EzkVJG8bX4stb5ueYxctzzGM8,1433
 sycommon/middleware/token_tracking.py,sha256=rEbgV1bgWMdzAERx4aq5XAvOIT6jTY_tK1P0xHJnL3o,6609
 sycommon/middleware/tool_result_truncation.py,sha256=SREo6tb_RDHxqiQdO0N82pio-Cpo0YSrHNa1sASUafM,12429
@@ -308,8 +308,8 @@ sycommon/tools/syemail.py,sha256=BDFhgf7WDOQeTcjxJEQdu0dQhnHFPO_p3eI0-Ni3LhQ,561
 sycommon/tools/timing.py,sha256=OiiE7P07lRoMzX9kzb8sZU9cDb0zNnqIlY5pWqHcnkY,2064
 sycommon/xxljob/__init__.py,sha256=7eoBlQxv-B39IfRSCY2bkqdGYs1QRe1umAWd88VMEEM,86
 sycommon/xxljob/xxljob_service.py,sha256=1yifwIBNGsCIxLnQjHKiBlbsigc_zvPH-dMTZcNxe-Q,7649
-sycommon_python_lib-0.2.7a22.dist-info/METADATA,sha256=O2pYEf0WwGJmrL74b_5LZ9TWxd1JBt5xsQo0yQZ3SV4,7962
-sycommon_python_lib-0.2.7a22.dist-info/WHEEL,sha256=K260EYznzXsJYBQGqmI8VTxEdiZYNvDZwW9cBh9-_MA,91
-sycommon_python_lib-0.2.7a22.dist-info/entry_points.txt,sha256=gsR4SssKxDWjRU8ggidzNcdMXDPRSKRS7UaGyNP84Qg,92
-sycommon_python_lib-0.2.7a22.dist-info/top_level.txt,sha256=RgphKrg7nJyZ7irJqbxFr-5H2LUYTvI7ivoWZH2hcD0,29
-sycommon_python_lib-0.2.7a22.dist-info/RECORD,,
+sycommon_python_lib-0.2.7a23.dist-info/METADATA,sha256=-nxp2cHfOFVzCFhRco15gVP5z2m1FX-offmy-DKZDs4,7962
+sycommon_python_lib-0.2.7a23.dist-info/WHEEL,sha256=K260EYznzXsJYBQGqmI8VTxEdiZYNvDZwW9cBh9-_MA,91
+sycommon_python_lib-0.2.7a23.dist-info/entry_points.txt,sha256=gsR4SssKxDWjRU8ggidzNcdMXDPRSKRS7UaGyNP84Qg,92
+sycommon_python_lib-0.2.7a23.dist-info/top_level.txt,sha256=RgphKrg7nJyZ7irJqbxFr-5H2LUYTvI7ivoWZH2hcD0,29
+sycommon_python_lib-0.2.7a23.dist-info/RECORD,,