chenxin
684261f4b4
- 百工域 domains/baigong：capabilities（统一能力契约：执行类型 builtin/qiankun/mcp/http + 四维风险标注 + 来源版本）、mandates（授契 grant / 行契 charter 预算时间窗，撤销立即生效）、tool_calls（净化摘要 + 观察标证）；请命复用 pending_confirmations 加 expires_at/brief_json（超时=拒绝执行 HJ-1302，六要素说明） - 司命裁决器 siming.py：四维取最高档（能力/数据/后果/情境）；禁域为代码常量不可配置（递归删根/格式化/写裸设备/fork 炸弹、file:// 协议、密钥材料外发）——专项测试断言恶意标注与篡改对象仍拒 HJ-1301 - 执行链：禁域→裁决（HJ-1303 未授契拒且双留痕）→请命→执行（乾坤经 SandboxClient HMAC；MCP 经 call_tool；内置无副作用）→净化标证（观察非事实，敏感遮蔽+体量截断）→行动账 - MCP 登记/启停/刷新自动派生与撤下 capabilities（博闻登记接入点）；内置能力种子（echo/datetime/qiankun.shell/web.fetch） - 端点：/capabilities /mandates /petitions /tool-calls + /tools 兼容投影；前端百工页四区（能力目录四维标注/授契行契/请命批准拒绝/行动账观察标证） - 退役：modules/safety|skills|tool_runtime|agent、application/tool_runtime、services/skills|safety、tool_policies/skills/model_endpoint_overrides 表（迁移 006）、前端 SkillManager/ToolsConsole/旧 tools 页 - 验收（test_baigong_siming 四用例）：未授契被拒留痕、请命超时不执行、禁域不可关闭、结果为观察不入忆；后端 454、前端 220、BFF 4、神识 5 包全绿（2 个预存环境失败不变）
87 lines
2.5 KiB
Python
87 lines
2.5 KiB
Python
"""乾坤沙箱工作区文件读取（百工执行产物预览）。
|
||
|
||
隔离前缀语义：workspace/<subject>/（subject=character_id，一角色一持久工作区）；
|
||
subject 经白名单替换杜绝路径注入，沙箱端另有 canonicalize 校验兜底。
|
||
"""
|
||
|
||
from __future__ import annotations
|
||
|
||
import re
|
||
import uuid
|
||
|
||
from app.integrations.sandbox.auth import AuthorizationContext
|
||
from app.integrations.sandbox.client import SandboxClient
|
||
from app.integrations.sandbox.models import (
|
||
DirEntry,
|
||
FileListRequest,
|
||
FileReadRequest,
|
||
FileReadResponse,
|
||
)
|
||
|
||
_ISOLATE_SAFE = re.compile(r"[^A-Za-z0-9_.-]")
|
||
|
||
|
||
def isolate_workdir(
|
||
base: str | None,
|
||
*,
|
||
subject_id: str | None,
|
||
run_id: str | None,
|
||
trace_id: str | None,
|
||
) -> str:
|
||
"""把工作区根目录隔离到主体级子目录，防跨主体信息泄漏。"""
|
||
root = base or "workspace"
|
||
key = subject_id or run_id or trace_id or f"adhoc_{uuid.uuid4().hex[:8]}"
|
||
safe = _ISOLATE_SAFE.sub("_", key).strip("._-") or "adhoc"
|
||
return f"{root}/{safe}"
|
||
|
||
|
||
async def read_sandbox_file(
|
||
sandbox: SandboxClient,
|
||
path: str,
|
||
*,
|
||
run_id: str | None = None,
|
||
character_id: str | None = None,
|
||
trace_id: str | None = None,
|
||
isolated: bool = True,
|
||
) -> FileReadResponse:
|
||
effective = path
|
||
if isolated:
|
||
workdir = isolate_workdir("workspace", subject_id=character_id, run_id=run_id, trace_id=trace_id)
|
||
effective = f"{workdir}/{path.lstrip('/')}"
|
||
return await sandbox.file_read(
|
||
FileReadRequest(path=effective),
|
||
AuthorizationContext(
|
||
trace_id=trace_id or str(uuid.uuid4()),
|
||
risk_level="L0",
|
||
tool="file_read",
|
||
character_id=character_id,
|
||
run_id=run_id,
|
||
),
|
||
)
|
||
|
||
|
||
async def list_sandbox_dir(
|
||
sandbox: SandboxClient,
|
||
path: str = ".",
|
||
*,
|
||
run_id: str | None = None,
|
||
character_id: str | None = None,
|
||
trace_id: str | None = None,
|
||
isolated: bool = True,
|
||
) -> list[DirEntry]:
|
||
effective = path
|
||
if isolated:
|
||
workdir = isolate_workdir("workspace", subject_id=character_id, run_id=run_id, trace_id=trace_id)
|
||
effective = f"{workdir}/{path.lstrip('/')}"
|
||
result = await sandbox.file_list(
|
||
FileListRequest(path=effective),
|
||
AuthorizationContext(
|
||
trace_id=trace_id or str(uuid.uuid4()),
|
||
risk_level="L0",
|
||
tool="file_list",
|
||
character_id=character_id,
|
||
run_id=run_id,
|
||
),
|
||
)
|
||
return result.entries
|