sycommon-python-lib 0.2.7a42__tar.gz → 0.2.7a44__tar.gz

{sycommon_python_lib-0.2.7a42 → sycommon_python_lib-0.2.7a44}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sycommon-python-lib
-Version: 0.2.7a42
+Version: 0.2.7a44
 Summary: Add your description here
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -11,16 +11,16 @@ Requires-Dist: anyio==4.14.2
 Requires-Dist: decorator==5.3.1
 Requires-Dist: deepagents==0.6.12
 Requires-Dist: elasticsearch==9.4.1
-Requires-Dist: fastapi==0.139.0
+Requires-Dist: fastapi==0.139.2
 Requires-Dist: jinja2==3.1.6
 Requires-Dist: kafka-python==3.0.8
-Requires-Dist: langchain==1.3.13
+Requires-Dist: langchain==1.3.14
 Requires-Dist: langchain-core==1.4.9
 Requires-Dist: langchain-openai==1.3.5
 Requires-Dist: langfuse==4.14.0
 Requires-Dist: langgraph==1.2.9
 Requires-Dist: langgraph-checkpoint-postgres==3.1.0
-Requires-Dist: langgraph-checkpoint-redis==0.5.0
+Requires-Dist: langgraph-checkpoint-redis==0.5.1
 Requires-Dist: ldap3==2.9.1
 Requires-Dist: loguru==0.7.3
 Requires-Dist: mysql-connector-python==9.7.0
@@ -32,7 +32,7 @@ Requires-Dist: python-dotenv==1.2.2
 Requires-Dist: python-multipart==0.0.32
 Requires-Dist: pyyaml==6.0.3
 Requires-Dist: redis==7.4.0
-Requires-Dist: sentry-sdk[fastapi]==2.64.0
+Requires-Dist: sentry-sdk[fastapi]==2.66.0
 Requires-Dist: sqlalchemy[asyncio]==2.0.51
 Requires-Dist: starlette[full]==1.3.1
 Requires-Dist: tiktoken==0.13.0

{sycommon_python_lib-0.2.7a42 → sycommon_python_lib-0.2.7a44}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sycommon-python-lib"
-version = "0.2.7a42"
+version = "0.2.7a44"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -12,16 +12,16 @@ dependencies = [
     "decorator==5.3.1",
     "deepagents==0.6.12",
     "elasticsearch==9.4.1",
-    "fastapi==0.139.0",
+    "fastapi==0.139.2",
     "jinja2==3.1.6",
     "kafka-python==3.0.8",
-    "langchain==1.3.13",
+    "langchain==1.3.14",
     "langchain-core==1.4.9",
     "langchain-openai==1.3.5",
     "langfuse==4.14.0",
     "langgraph==1.2.9",
     "langgraph-checkpoint-postgres==3.1.0",
-    "langgraph-checkpoint-redis==0.5.0",
+    "langgraph-checkpoint-redis==0.5.1",
     "ldap3==2.9.1",
     "loguru==0.7.3",
     "mysql-connector-python==9.7.0",
@@ -33,7 +33,7 @@ dependencies = [
     "python-multipart==0.0.32",
     "pyyaml==6.0.3",
     "redis==7.4.0",
-    "sentry-sdk[fastapi]==2.64.0",
+    "sentry-sdk[fastapi]==2.66.0",
     "sqlalchemy[asyncio]==2.0.51",
     "starlette[full]==1.3.1",
     "tiktoken==0.13.0",

{sycommon_python_lib-0.2.7a42 → sycommon_python_lib-0.2.7a44}/src/sycommon/agent/deep_agent.py

@@ -398,6 +398,13 @@ class AgentConfig(BaseModel):
     # user 技能:标记启用沙箱 /skills/user(可写,内容由 MinIO 按 user 灌入);
     # 本地兜底路径仅当目录存在时用于开发期同步,生产期为 None。
     user_skills_dir: Optional[str] = None
+    # 接口专属技能:本地仓库目录路径(如 <repo>/skills/shengye-platform/oa),
+    # 同步到沙箱 /skills/<scoped_skills_scope>(只读),并以独立 source 追加到
+    # deepagents SkillsMiddleware,优先级高于 system/user(后 source 覆盖先 source)。
+    # 使用方:按接口路由在服务端硬编码 scope,前端不可改。
+    scoped_skills_dir: Optional[str] = None
+    # 沙箱挂载点 scope,如 "shengye-platform/oa"。仅当 scoped_skills_dir 非空时生效。
+    scoped_skills_scope: Optional[str] = None
     memory_dir: Optional[str] = None
 
     @property
@@ -1278,6 +1285,12 @@ async def create_deep_agent(
     # 沙箱 skills 双层结构:/skills/system(只读,仓库源)+ /skills/user(可写,MinIO 按 user 灌入)
     system_path = "/skills/system" if config.system_skills_dir else None
     user_path = "/skills/user" if config.user_skills_dir else None
+    # 接口专属技能挂载点(如 "/skills/shengye-platform/oa"),仅当 dir+scope 同时非空才启用
+    scoped_path = (
+        f"/skills/{config.scoped_skills_scope}"
+        if config.scoped_skills_dir and config.scoped_skills_scope
+        else None
+    )
     memory_path = "/memory/AGENTS.md" if config.memory_dir else None
 
     # 同步 system 技能到沙箱(按版本检查,已同步则跳过)+ chmod 只读保护
@@ -1289,6 +1302,11 @@ async def create_deep_agent(
         await _sync_skills_to_sandbox(config.system_skills_dir, sandbox_backend,
                                       sandbox_dest="/skills/system", chmod_readonly=True)
 
+    # 同步接口专属技能到沙箱(只读)。与 system 同一套 version 感知增量同步机制。
+    if config.scoped_skills_dir and config.scoped_skills_scope and sandbox_backend:
+        await _sync_skills_to_sandbox(config.scoped_skills_dir, sandbox_backend,
+                                      sandbox_dest=scoped_path, chmod_readonly=True)
+
     # 创建 agent
     from deepagents import create_deep_agent as _create_deep_agent
     from deepagents import RubricMiddleware
@@ -1359,12 +1377,14 @@ async def create_deep_agent(
         "middleware": middleware_list,
     }
     # deepagents SkillsMiddleware 支持多 source (path, label),后 source 覆盖先 source
-    # → user 在后,user 同名技能优先于 system
+    # → user 在后,user 同名技能优先于 system;scoped 放最后,接口专属技能优先级最高
     _sources = []
     if system_path:
         _sources.append((system_path, "系统"))
     if user_path:
         _sources.append((user_path, "用户"))
+    if scoped_path:
+        _sources.append((scoped_path, "接口"))
     if _sources:
         agent_kwargs["skills"] = _sources
     if memory_path:

{sycommon_python_lib-0.2.7a42 → sycommon_python_lib-0.2.7a44}/src/sycommon/agent/middleware/skill_api_whitelist.py

@@ -35,11 +35,11 @@ from sycommon.logging.kafka_log import SYLogger
 
 # 命令路径形如  skills/system/sy-oa-skill/workflow-todo/scripts/x.py
 #               skills/user/sy-oa-skill/SKILL.md
-# 拆为 system/user 双层后,顶层段是 system|user,需跳过它取【第二段】作域级技能名
-# (如 sy-oa-skill),配合 SkillApiWhitelist 按顶级域配置。
-# (?<![\w]) 否定左查找:要求 skills 前不是单词字符,避免误匹配 myskills/。
+# 拆为 system/user/shengye-platform 多层后,顶层段是 system|user|shengye-platform,
+# 需跳过它取【第二段】作域级技能名(如 sy-oa-skill / oa),配合 SkillApiWhitelist
+# 按顶级域配置。(?<![\w]) 否定左查找:要求 skills 前不是单词字符,避免误匹配 myskills/。
 _SKILL_TOP_RE = re.compile(
-    r'(?<![\w])skills/(?:system|user)/([A-Za-z0-9_\-]+)(?:/|$)')
+    r'(?<![\w])skills/(?:system|user|shengye-platform)/([A-Za-z0-9_\-]+)(?:/|$)')
 
 # BASE_URL 占位符 ${VAR}
 _PLACEHOLDER_RE = re.compile(r'\$\{([A-Z_][A-Z0-9_]*)\}')

{sycommon_python_lib-0.2.7a42 → sycommon_python_lib-0.2.7a44}/src/sycommon/agent/middleware/skill_write_guard.py

@@ -1,9 +1,13 @@
 """系统技能只读守卫中间件。
 
-拦 write_file / edit_file / execute 三类写操作对 /skills/system 的命中,
-返回 error ToolMessage(不调 handler,短路)。/skills/user 不拦。
+拦 write_file / edit_file / execute 三类写操作对以下只读路径的命中,
+返回 error ToolMessage(不调 handler,短路):
+- /skills/system           —— 全员共享系统技能
+- /skills/shengye-platform —— 接口专属技能(按接口 scope 挂载)
 
-双层防护之一(另一层是沙箱 chmod -R 555 /skills/system):
+/skills/user 不拦。
+
+双层防护之一(另一层是沙箱 chmod -R 555 对应目录):
 本中间件负责给 agent 清晰错误反馈并 fail-closed,chmod 负责兜底防 shell 绕过。
 """
 import re
@@ -11,8 +15,10 @@ from langchain.agents.middleware.types import AgentMiddleware
 from langchain_core.messages import ToolMessage
 from langgraph.prebuilt.tool_node import ToolCallRequest
 
-# /skills/system 或 /skills/system/... (行尾/引号/空白/斜杠均可作边界,防匹配 /skills/systembackup)
-_PROTECTED_PATH_RE = re.compile(r'/skills/system(?:/|\s|"|\'|$)')
+# /skills/system 或 /skills/shengye-platform 及其子路径
+# (行尾/引号/空白/斜杠均可作边界,防匹配 /skills/systembackup 这类同前缀异名)
+_PROTECTED_PATH_RE = re.compile(
+    r'/skills/(?:system|shengye-platform)(?:/|\s|"|\'|$)')
 
 # 写动作动词(命令首或分号/管道/空格后)
 _WRITE_VERB_RE = re.compile(
@@ -21,14 +27,17 @@ _WRITE_VERB_RE = re.compile(
 _REDIRECT_RE = re.compile(r'>>?')
 
 _WRITE_TOOLS = {"write_file", "edit_file"}
-_DENIED_MSG = ("Error: 系统技能 /skills/system 为只读，禁止写入/修改/删除。"
+_DENIED_MSG = ("Error: 系统/接口技能 /skills/system 与 /skills/shengye-platform 为只读，禁止写入/修改/删除。"
                "读取(read_file)和执行脚本(python ...)不受限，直接用即可，不要把脚本复制到工作目录再跑。"
                "如需修改脚本本身，复制到 /skills/user/ 后编辑。")
 
+# 前缀列表(用于 _is_protected_path 的字符串判定)
+_PROTECTED_PREFIXES = ("/skills/system", "/skills/shengye-platform")
+
 
 def _is_protected_path(p: str) -> bool:
     s = (p or "").strip().replace("\\", "/")
-    return s == "/skills/system" or s.startswith("/skills/system/")
+    return any(s == prefix or s.startswith(prefix + "/") for prefix in _PROTECTED_PREFIXES)
 
 
 def _command_writes_system(cmd: str) -> bool:

{sycommon_python_lib-0.2.7a42 → sycommon_python_lib-0.2.7a44}/src/sycommon/middleware/traceid.py

@@ -1,4 +1,5 @@
 import json
+import os
 import re
 from typing import Dict, Any
 from fastapi import Request, Response
@@ -6,6 +7,11 @@ from sycommon.logging.kafka_log import SYLogger
 from sycommon.tools.merge_headers import merge_headers
 from sycommon.tools.snowflake import Snowflake
 
+# 🔑 OOM 防护：响应体聚合/重写阈值。超过此大小（attachment 下载、大二进制预览、PPTX 图片数组）
+# 的响应跳过整包聚合，避免单请求在内存里同时存原始 bytes + json 解析结果 + 重编码 bytes 三份拷贝。
+# 默认 2MB；可经环境变量 TRACEID_MAX_AGGREGATE_BODY 覆盖。
+_MAX_AGGREGATE_BODY = int(os.environ.get("TRACEID_MAX_AGGREGATE_BODY", 2 * 1024 * 1024))
+
 
 def setup_trace_id_handler(app):
     @app.middleware("http")
@@ -188,38 +194,86 @@ def setup_trace_id_handler(app):
                         pass
 
             # 处理响应体
-            response_body = b""
+            # 🔑 OOM 防护：对大响应体（文件下载/二进制预览/PPTX 图片数组）跳过整包聚合。
+            # 否则上百 MB 的 attachment 会被 response_body += chunk 全量读进内存，再 json.loads/dumps
+            # 产生多份拷贝，单请求即可吃掉数百 MB。大响应只改写 header 不重写 body。
+            content_disposition = response.headers.get(
+                "content-disposition", "").lower()
+            _is_attachment = content_disposition.startswith("attachment")
             try:
-                async for chunk in response.body_iterator:
-                    response_body += chunk
-
-                content_disposition = response.headers.get(
-                    "content-disposition", "").lower()
+                content_length_str = response.headers.get("content-length", "")
+                content_length = int(content_length_str) if content_length_str.isdigit() else None
+            except (TypeError, ValueError):
+                content_length = None
+            # 超过阈值(默认 2MB)或 attachment 下载 → 跳过聚合，直接透传 body（仍注入 traceId header）
+            _skip_aggregate = (
+                _is_attachment
+                or (content_length is not None and content_length > _MAX_AGGREGATE_BODY)
+            )
 
-                # JSON 响应体注入 traceId
-                if "application/json" in response_content_type and not content_disposition.startswith("attachment"):
-                    try:
-                        data = json.loads(response_body)
-                        new_body = response_body
-                        if isinstance(data, dict):
-                            data["traceId"] = trace_id
-                            new_body = json.dumps(
-                                data, ensure_ascii=False).encode()
-
-                        # 重建 Response 以更新 Body 和 Content-Length
-                        response = Response(
-                            content=new_body,
-                            status_code=response.status_code,
-                            headers=dict(response.headers),
-                            media_type=response.media_type
-                        )
-                        response.headers["content-length"] = str(len(new_body))
-                        response.headers["x-traceid-header"] = trace_id
-                        # 恢复 CORS
-                        for k, v in cors_headers.items():
-                            response.headers[k] = v
-                    except json.JSONDecodeError:
-                        # 非 JSON 或解析失败，仅更新长度
+            response_body = b""
+            if _skip_aggregate:
+                # 大响应：不读 body，保留原 StreamingResponse 的 body_iterator 透传。
+                # 仅补 header，不动 body/Content-Length。
+                response.headers["x-traceid-header"] = trace_id
+                for k, v in cors_headers.items():
+                    response.headers[k] = v
+                response_log_body = f"<skipped: large response, content-length={content_length}, attachment={_is_attachment}>"
+            else:
+                try:
+                    async for chunk in response.body_iterator:
+                        response_body += chunk
+                        # 聚合期再兜一道防线上限：流式 body 没有 Content-Length，读到超限就放弃重写
+                        if len(response_body) > _MAX_AGGREGATE_BODY:
+                            _skip_aggregate = True
+                            break
+                except StopAsyncIteration:
+                    pass
+
+                if _skip_aggregate:
+                    # 流式响应超限，恢复为透传已读部分（不重写 JSON，保留原 body）
+                    response.headers["x-traceid-header"] = trace_id
+                    for k, v in cors_headers.items():
+                        response.headers[k] = v
+                    response_log_body = f"<skipped: large response during aggregate, size={len(response_body)}>"
+                else:
+                    # JSON 响应体注入 traceId
+                    if "application/json" in response_content_type and not _is_attachment:
+                        try:
+                            data = json.loads(response_body)
+                            new_body = response_body
+                            if isinstance(data, dict):
+                                data["traceId"] = trace_id
+                                new_body = json.dumps(
+                                    data, ensure_ascii=False).encode()
+
+                            # 重建 Response 以更新 Body 和 Content-Length
+                            response = Response(
+                                content=new_body,
+                                status_code=response.status_code,
+                                headers=dict(response.headers),
+                                media_type=response.media_type
+                            )
+                            response.headers["content-length"] = str(len(new_body))
+                            response.headers["x-traceid-header"] = trace_id
+                            # 恢复 CORS
+                            for k, v in cors_headers.items():
+                                response.headers[k] = v
+                        except json.JSONDecodeError:
+                            # 非 JSON 或解析失败，仅更新长度
+                            response = Response(
+                                content=response_body,
+                                status_code=response.status_code,
+                                headers=dict(response.headers),
+                                media_type=response.media_type
+                            )
+                            response.headers["content-length"] = str(
+                                len(response_body))
+                            response.headers["x-traceid-header"] = trace_id
+                            for k, v in cors_headers.items():
+                                response.headers[k] = v
+                    else:
+                        # 非 JSON 响应
                         response = Response(
                             content=response_body,
                             status_code=response.status_code,
@@ -231,21 +285,6 @@ def setup_trace_id_handler(app):
                         response.headers["x-traceid-header"] = trace_id
                         for k, v in cors_headers.items():
                             response.headers[k] = v
-                else:
-                    # 非 JSON 响应
-                    response = Response(
-                        content=response_body,
-                        status_code=response.status_code,
-                        headers=dict(response.headers),
-                        media_type=response.media_type
-                    )
-                    response.headers["content-length"] = str(
-                        len(response_body))
-                    response.headers["x-traceid-header"] = trace_id
-                    for k, v in cors_headers.items():
-                        response.headers[k] = v
-            except StopAsyncIteration:
-                pass
 
             # 构建响应日志
             response_log_body = response_body.decode('utf-8', errors='ignore')

{sycommon_python_lib-0.2.7a42 → sycommon_python_lib-0.2.7a44}/src/sycommon_python_lib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sycommon-python-lib
-Version: 0.2.7a42
+Version: 0.2.7a44
 Summary: Add your description here
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -11,16 +11,16 @@ Requires-Dist: anyio==4.14.2
 Requires-Dist: decorator==5.3.1
 Requires-Dist: deepagents==0.6.12
 Requires-Dist: elasticsearch==9.4.1
-Requires-Dist: fastapi==0.139.0
+Requires-Dist: fastapi==0.139.2
 Requires-Dist: jinja2==3.1.6
 Requires-Dist: kafka-python==3.0.8
-Requires-Dist: langchain==1.3.13
+Requires-Dist: langchain==1.3.14
 Requires-Dist: langchain-core==1.4.9
 Requires-Dist: langchain-openai==1.3.5
 Requires-Dist: langfuse==4.14.0
 Requires-Dist: langgraph==1.2.9
 Requires-Dist: langgraph-checkpoint-postgres==3.1.0
-Requires-Dist: langgraph-checkpoint-redis==0.5.0
+Requires-Dist: langgraph-checkpoint-redis==0.5.1
 Requires-Dist: ldap3==2.9.1
 Requires-Dist: loguru==0.7.3
 Requires-Dist: mysql-connector-python==9.7.0
@@ -32,7 +32,7 @@ Requires-Dist: python-dotenv==1.2.2
 Requires-Dist: python-multipart==0.0.32
 Requires-Dist: pyyaml==6.0.3
 Requires-Dist: redis==7.4.0
-Requires-Dist: sentry-sdk[fastapi]==2.64.0
+Requires-Dist: sentry-sdk[fastapi]==2.66.0
 Requires-Dist: sqlalchemy[asyncio]==2.0.51
 Requires-Dist: starlette[full]==1.3.1
 Requires-Dist: tiktoken==0.13.0

{sycommon_python_lib-0.2.7a42 → sycommon_python_lib-0.2.7a44}/src/sycommon_python_lib.egg-info/requires.txt

@@ -5,16 +5,16 @@ anyio==4.14.2
 decorator==5.3.1
 deepagents==0.6.12
 elasticsearch==9.4.1
-fastapi==0.139.0
+fastapi==0.139.2
 jinja2==3.1.6
 kafka-python==3.0.8
-langchain==1.3.13
+langchain==1.3.14
 langchain-core==1.4.9
 langchain-openai==1.3.5
 langfuse==4.14.0
 langgraph==1.2.9
 langgraph-checkpoint-postgres==3.1.0
-langgraph-checkpoint-redis==0.5.0
+langgraph-checkpoint-redis==0.5.1
 ldap3==2.9.1
 loguru==0.7.3
 mysql-connector-python==9.7.0
@@ -26,7 +26,7 @@ python-dotenv==1.2.2
 python-multipart==0.0.32
 pyyaml==6.0.3
 redis==7.4.0
-sentry-sdk[fastapi]==2.64.0
+sentry-sdk[fastapi]==2.66.0
 sqlalchemy[asyncio]==2.0.51
 starlette[full]==1.3.1
 tiktoken==0.13.0