mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-07-28 08:56:13 +00:00
5 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Ryker_Feng
|
9124f991de
|
fix(mcp): make stdio MCP-produced files resolvable via virtual sandbox paths (#3597) (#3600)
* fix(mcp): migrate local MCP-produced files into sandbox outputs (#3597) Stdio MCP servers (e.g. Playwright) write files to host paths that the sandbox/artifact API cannot resolve, since it only serves paths under /mnt/user-data. Copy local files referenced by ResourceLink results into the thread's sandbox outputs dir and rewrite their URIs to /mnt/user-data/outputs/... so they become readable. Also scope pooled MCP sessions by user_id:thread_id instead of thread_id alone, matching the per-(user_id, thread_id) filesystem isolation. * fix(mcp): restrict file migration to trusted source roots (#3597) Add a source-root allowlist to the MCP file-migration path so a malicious or buggy MCP server cannot have us copy arbitrary host files (e.g. /etc/passwd) into a thread's outputs directory, from where the artifact API would serve them. Files are migrated only when located under the OS temp dir (Playwright's default), the thread's own user-data tree, or an operator-configured root via DEERFLOW_MCP_MIGRATION_SOURCE_ROOTS. Expand test coverage with allowlist/security cases (path escape refusal, trusted-root acceptance), URL-encoded file:// paths, converter content branches (image/embedded/error/structured), and copy/resolve failure fallbacks. * fix(mcp): harden local file migration into sandbox outputs Address robustness and security gaps in the MCP ResourceLink file migration: - Set migrated files to 0o644 so a differently-UID sandbox container can read them, instead of inheriting the source's (possibly 0o600) mode. - Enforce the 100MB size cap during the copy (chunked, byte-counted) rather than from a prior stat(), closing the grow-after-stat TOCTOU. - Create the destination atomically with O_CREAT|O_EXCL to remove the check-then-create name-collision race. - Document the shared-$TMPDIR multi-tenant read surface and mitigation. Add regression tests: symlink escape refusal, explicit $TMPDIR source migration, 0o644 mode, and the outputs/user-data resolve() OSError fallback branches. * fix(mcp): migrate playwright text file outputs * fix(mcp): translate MCP file outputs to virtual paths instead of copying (#3597) Pin stdio MCP subprocess cwd and TMPDIR/TMP/TEMP under the thread workspace so produced files always land in the mounted user-data tree, then rewrite returned references via deterministic host->virtual path translation. Free text is best-effort only: a reference is rewritten only when it resolves to an existing file inside the thread's tree, and bare filenames are matched against files created/modified by the same tool call. Replaces the previous copy-into-outputs + regex approach (which missed cases like temp/page-*.yml). * style(mcp): apply ruff format to mcp path translation tests * perf(mcp): offload stdio FS work off event loop and gate on transport Address review on #3600: - Wrap the workspace dir prep, snapshot diff, and per-token path resolution in asyncio.to_thread so they no longer block the event loop (matches the repo's blocking-IO gate convention). - Gate the cwd/temp pinning and snapshots on stdio transport only; SSE/HTTP servers skip the filesystem work entirely. - Skip the post-call snapshot diff when the result has no text content. * test(mcp): cover stdio transport gating and text-content after-walk skip Add unit/integration coverage for the new review-driven behavior: - _prepare_stdio_workspace dir/temp/snapshot bundle - _result_has_text_content detection (text, embedded text, image, empty) - non-stdio transport skips cwd/temp pinning and touches no workspace dirs - post-call snapshot diff is skipped without text content and runs with it * fix(mcp): address stdio path rewrite review feedback - Restrict the stdio MCP temp directory to 0700 instead of 0777. - Preserve operator-provided stdio cwd values while keeping injected cwd values as strings. - Add debug logging for deterministic path rewrites and bare-filename rewrite decisions. - Document the stdio cwd/temp pinning, virtual-path translation, and user/thread session scope. - Cover explicit cwd preservation and temp-dir permissions in session-pool tests. --------- Co-authored-by: Willem Jiang <willem.jiang@gmail.com> |
||
|
Ryker_Feng
|
d8b728f7cb
|
fix(mcp): close stdio sessions on their owning loop to avoid cross-task cancel-scope error (#3379) (#3392)
* fix(mcp): close stdio sessions on their owning loop to avoid cross-task cancel-scope error (#3379) Adopt an owner-task lifecycle for pooled MCP ClientSessions so each session is entered, initialized, and exited within a single asyncio task on its owning event loop. This eliminates the anyio "Attempted to exit cancel scope in a different task than it was entered in" RuntimeError that surfaced when stdio MCP tools were used via the sync tool wrapper (which spins up and tears down event loops across tasks). Also harden the pool lifecycle: - track in-flight session creation per (server, scope) to dedupe concurrent get_session() calls for the same key - make close_scope/close_server/close_all/close_all_sync cover both established entries and in-flight creations so sessions cannot be resurrected or leaked after close - handle cross-loop preemption of an in-flight creation by cancelling the stale owner task instead of only signalling it - define close_all_sync() semantics for a running loop on the current thread (signal-only, async completion) and route reset_mcp_tools_cache through a deterministic async close in that case * fix(mcp): avoid reset deadlock on running loop cache reset * fix(mcp): address session pool review feedback |
||
|
zhongli-sz
|
3ae82dc663
|
fix(mcp): add auth interceptor with channel user_id and keep header propagation to mcp tools (#3294)
* 修复channel中的user_id传递到interceptor中的bug, mcp可通过header传递user_id到mcp工具 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(channel,mcp,gateway): normalize channel user_id and add regression tests Normalize external channel user ids into filesystem-safe runtime context while preserving raw channel_user_id, and document gateway user_id propagation semantics. Add regression coverage for channel user_id context mapping, gateway user_id precedence/internal-role behavior, and MCP interceptor header forwarding via meta.headers. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(auth,mcp): harden user id normalization and header handling Increase sanitized user-id digest suffix to 16 hex chars, replace internal system role magic string with a shared constant, and harden MCP header forwarding with Mapping type checks. Add regression tests for empty channel user_id handling, unsupported header types, and updated digest length behavior. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: zhongli <335302680@qq.com> Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
Willem Jiang
|
162fb2143e
|
fix(mcp): skip session pooling for HTTP/SSE transports to avoid anyioRuntimeError (#3203) (#3224)
* fix(mcp): skip session pooling for HTTP/SSE transports to avoid anyio RuntimeError (#3203) HTTP/SSE transports use anyio.TaskGroup internally for streamable connections. These task groups have cancel scopes bound to the async task that created them, so closing a pooled session from a different task raises RuntimeError. Restrict session pooling to stdio transports only. * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * docs: clarify MCP pooling applies only to stdio tools Agent-Logs-Url: https://github.com/bytedance/deer-flow/sessions/2dd9881d-54c6-45fd-90bc-154a09e29841 Co-authored-by: WillemJiang <219644+WillemJiang@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> |
||
|
Willem Jiang
|
c881d95898
|
fix(mcp): persist MCP sessions across tool calls for stateful servers (#3089)
* fix(mcp): persist MCP sessions across tool calls for stateful servers MCP tools loaded via langchain-mcp-adapters created a new session on every call, causing stateful servers like Playwright to lose browser state (pages, forms) between consecutive tool invocations within the same thread. Add MCPSessionPool that maintains persistent sessions scoped by (server_name, thread_id). Tool calls within the same thread now reuse the same MCP session, preserving server-side state. Sessions are evicted in LRU order (max 256) and cleaned up on cache invalidation. Fixes #3054 * fix(sandbox): add group/other read permissions to uploaded files for Docker sandbox (#3127) When using AIO sandbox with LocalContainerBackend, uploaded files are created with 0o600 (owner-only) permissions by the gateway process running as root. The sandbox process inside the Docker container runs as a non-root user and cannot read these bind-mounted files, causing a "Permission denied" error on read_file. Add `needs_upload_permission_adjustment` attribute to SandboxProvider (default True) to indicate that uploaded files need chmod adjustment. LocalSandboxProvider opts out (same user). A new `_make_file_sandbox_readable` function adds S_IRGRP | S_IROTH bits after files are written, changing permissions from 0o600 to 0o644 so the sandbox can read the uploads. * fix(mcp): address review comments on session pool and tools - _extract_thread_id: return "default" instead of stringifying None when get_config() returns no thread_id - call_with_persistent_session: fix **arguments annotation from dict[str,Any] to Any - Replace private _convert_call_tool_result import with a local implementation that handles all MCP content block types - _make_session_pool_tool: accept tool_interceptors and apply the configured interceptor chain on every call (preserving OAuth and custom interceptors) - MCPSessionPool: replace asyncio.Lock with threading.Lock; restructure get/close methods to never await while holding the lock; add close_all_sync() that closes sessions on their owning event loops - reset_mcp_tools_cache: use pool.close_all_sync() instead of asyncio.run-in-thread to close sessions deterministically - test: add test_session_pool_tool_sync_wrapper_path_is_safe covering tool invocation via the sync wrapper (tool.func) path Agent-Logs-Url: https://github.com/bytedance/deer-flow/sessions/9e7f9e7f-1d2b-464a-b3b7-7f1649b74122 Co-authored-by: WillemJiang <219644+WillemJiang@users.noreply.github.com> * fix(mcp): extract SESSION_CLOSE_TIMEOUT to class constant Agent-Logs-Url: https://github.com/bytedance/deer-flow/sessions/9e7f9e7f-1d2b-464a-b3b7-7f1649b74122 Co-authored-by: WillemJiang <219644+WillemJiang@users.noreply.github.com> * Potential fix for pull request finding 'Empty except' Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> |