refactor: remove unused proxy policy and private constants (#7554)

* refactor: remove unused proxy policy and private constants

* refactor(sandbox): share provisioner runtime mount path

backend/app/gateway/auth/password.py

@@ -19,7 +19,6 @@ import hashlib
 
 import bcrypt
 
-_CURRENT_VERSION = 2
 _PREFIX_V2 = "$dfv2$"
 _PREFIX_V1 = "$dfv1$"
 

backend/packages/harness/deerflow/community/aio_sandbox/remote_backend.py

@@ -37,12 +37,13 @@ from .sandbox_info import SandboxInfo
 
 logger = logging.getLogger(__name__)
 
+_LARK_CLI_RUNTIME_CONTAINER_PATH = "/mnt/integrations/lark-cli/runtime"
 _PROVISIONER_EXTRA_MOUNT_PATHS = {
     "/mnt/acp-workspace",
     "/mnt/integrations/lark-cli/config",
     "/mnt/integrations/lark-cli/config/locks",
     "/mnt/integrations/lark-cli/data",
-    "/mnt/integrations/lark-cli/runtime",
+    _LARK_CLI_RUNTIME_CONTAINER_PATH,
 }
 _MANAGED_SKILL_CATEGORY_NAMES = (
     "public",
@@ -56,9 +57,6 @@ _RESERVED_SANDBOX_MOUNT_PATHS = (
     "/mnt/integrations/lark-cli",
 )
 
-_LARK_CLI_RUNTIME_CONTAINER_PATH = "/mnt/integrations/lark-cli/runtime"
-_LARK_CLI_CONFIG_CONTAINER_PATH = "/mnt/integrations/lark-cli/config"
-_LARK_CLI_DATA_CONTAINER_PATH = "/mnt/integrations/lark-cli/data"
 _AIO_DEFAULT_MAX_SHELL_SESSIONS = 10
 
 

backend/packages/harness/deerflow/skills/skillscan/orchestrator.py

@@ -1591,7 +1591,6 @@ _PYTHON_CLIENT_SPECS = {
     "aiohttp.ClientSession": _ClientSpec(frozenset({"request", "get", "post", "put", "patch", "delete", "head", "options"}), async_context=True),
 }
 _PYTHON_CLIENT_CONSTRUCTORS = frozenset(_PYTHON_CLIENT_SPECS)
-_PYTHON_CLIENT_SINK_METHODS = frozenset().union(*(spec.methods for spec in _PYTHON_CLIENT_SPECS.values()))
 _PYTHON_CLIENT_ANALYSIS_BUDGET = 100_000
 _PYTHON_SCOPE_NODES = (ast.FunctionDef, ast.AsyncFunctionDef, ast.Lambda, ast.ClassDef)
 _PYTHON_COMPREHENSION_NODES = (ast.ListComp, ast.SetComp, ast.DictComp, ast.GeneratorExp)

backend/tests/test_provisioner_mount_contract.py

@@ -12,6 +12,8 @@ def _literal_assignment(path: Path, name: str):
     tree = ast.parse(path.read_text(encoding="utf-8"), filename=str(path))
     for node in tree.body:
         if isinstance(node, ast.Assign) and any(isinstance(target, ast.Name) and target.id == name for target in node.targets):
+            if isinstance(node.value, ast.Set):
+                return {_literal_assignment(path, item.id) if isinstance(item, ast.Name) else ast.literal_eval(item) for item in node.value.elts}
             return ast.literal_eval(node.value)
     raise AssertionError(f"{name} not found in {path}")
 

backend/tests/test_skillscan_native.py

@@ -13,9 +13,10 @@ import pytest
 from deerflow.skills.package_files import EXEC_SNIFF_BYTES, is_executable_binary_prefix
 from deerflow.skills.security_scanner import scan_skill_content
 from deerflow.skills.skillscan import StaticScanBlockedError, enforce_static_scan, scan_archive_preflight, scan_skill_dir
-from deerflow.skills.skillscan.orchestrator import _PYTHON_CLIENT_SINK_METHODS, MAX_FILE_BYTES
+from deerflow.skills.skillscan.orchestrator import _PYTHON_CLIENT_SPECS, MAX_FILE_BYTES
 
 _FINDING_FIELDS = {"rule_id", "severity", "file", "line", "message", "remediation", "evidence"}
+_CLIENT_SINK_METHODS = frozenset().union(*(spec.methods for spec in _PYTHON_CLIENT_SPECS.values()))
 
 
 def _write_skill(skill_dir: Path, content: str = "# Demo\n") -> None:
@@ -1415,7 +1416,7 @@ def _runtime_client_receivers(source: str, *, raise_errors: bool = False) -> lis
 
         def __getattr__(self, name: str):
             def _sink(*_args: object, **_kwargs: object) -> type:
-                if name in _PYTHON_CLIENT_SINK_METHODS:
+                if name in _CLIENT_SINK_METHODS:
                     calls.append(self._tag)
                 return ValueError
 

frontend/src/core/auth/proxy-policy.ts

@@ -1,55 +0,0 @@
-export interface ProxyPolicy {
-  /** Allowed upstream path prefixes */
-  readonly allowedPaths: readonly string[];
-  /** Request headers to strip before forwarding */
-  readonly strippedRequestHeaders: ReadonlySet<string>;
-  /** Response headers to strip before returning */
-  readonly strippedResponseHeaders: ReadonlySet<string>;
-  /** Credential mode: which cookie to forward */
-  readonly credential: { readonly type: "cookie"; readonly name: string };
-  /** Timeout in ms */
-  readonly timeoutMs: number;
-  /** CSRF: required for non-GET/HEAD */
-  readonly csrf: boolean;
-}
-
-export const LANGGRAPH_COMPAT_POLICY: ProxyPolicy = {
-  allowedPaths: [
-    "threads",
-    "runs",
-    "assistants",
-    "store",
-    "models",
-    "mcp",
-    "skills",
-    "memory",
-  ],
-  strippedRequestHeaders: new Set([
-    "host",
-    "connection",
-    "keep-alive",
-    "transfer-encoding",
-    "te",
-    "trailer",
-    "upgrade",
-    "authorization",
-    "x-api-key",
-    "origin",
-    "referer",
-    "proxy-authorization",
-    "proxy-authenticate",
-  ]),
-  strippedResponseHeaders: new Set([
-    "connection",
-    "keep-alive",
-    "transfer-encoding",
-    "te",
-    "trailer",
-    "upgrade",
-    "content-length",
-    "set-cookie",
-  ]),
-  credential: { type: "cookie", name: "access_token" },
-  timeoutMs: 120_000,
-  csrf: true,
-};