mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-08-01 02:46:02 +00:00
21d9ec0db1
* perf(sandbox): cache LocalSandbox path-rewrite regexes per instance LocalSandbox re-sorted path_mappings and re-compiled its path-rewrite regex on every tool call: _resolve_paths_in_command (every bash), _resolve_paths_in_content (every write_file), and _reverse_resolve_paths_in_output (every bash output / read_file). The inputs are derived solely from self.path_mappings, which is assigned once in __init__ and never mutated, so the work is identical every call. Compile the patterns once per sandbox via functools.cached_property and reuse them; hoist 'import re' to module scope. Behavior is unchanged — only the per-call sort+escape+compile on the agent's hot path is removed. Fixes #3647. Adds tests covering caching identity, unchanged rewriting, path-segment boundary matching, and the empty-mappings pass-through. * perf(sandbox): also cache resolved local paths and sorted mapping views Beyond the regex compilation, _find_path_mapping, _is_read_only_path, _resolve_path_with_mapping and _reverse_resolve_path re-sorted path_mappings and re-ran Path(local_path).resolve() (a filesystem syscall) on every call. Since path_mappings is immutable, cache the resolved local root per mapping and the two sorted views via cached_property and reuse them. Behavior is unchanged; the reverse-output pattern builder now reuses the same resolved-path cache.
497 lines
21 KiB
Python
497 lines
21 KiB
Python
import errno
|
|
import logging
|
|
import ntpath
|
|
import os
|
|
import re
|
|
import shutil
|
|
import subprocess
|
|
from dataclasses import dataclass
|
|
from functools import cached_property
|
|
from pathlib import Path
|
|
from typing import NamedTuple
|
|
|
|
from deerflow.config.paths import VIRTUAL_PATH_PREFIX
|
|
from deerflow.sandbox.local.list_dir import list_dir
|
|
from deerflow.sandbox.sandbox import Sandbox
|
|
from deerflow.sandbox.search import GrepMatch, find_glob_matches, find_grep_matches
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class PathMapping:
|
|
"""A path mapping from a container path to a local path with optional read-only flag."""
|
|
|
|
container_path: str
|
|
local_path: str
|
|
read_only: bool = False
|
|
|
|
|
|
class ResolvedPath(NamedTuple):
|
|
path: str
|
|
mapping: PathMapping | None
|
|
|
|
|
|
class LocalSandbox(Sandbox):
|
|
@staticmethod
|
|
def _shell_name(shell: str) -> str:
|
|
"""Return the executable name for a shell path or command."""
|
|
return shell.replace("\\", "/").rsplit("/", 1)[-1].lower()
|
|
|
|
@staticmethod
|
|
def _is_powershell(shell: str) -> bool:
|
|
"""Return whether the selected shell is a PowerShell executable."""
|
|
return LocalSandbox._shell_name(shell) in {"powershell", "powershell.exe", "pwsh", "pwsh.exe"}
|
|
|
|
@staticmethod
|
|
def _is_cmd_shell(shell: str) -> bool:
|
|
"""Return whether the selected shell is cmd.exe."""
|
|
return LocalSandbox._shell_name(shell) in {"cmd", "cmd.exe"}
|
|
|
|
@staticmethod
|
|
def _is_msys_shell(shell: str) -> bool:
|
|
"""Return whether the selected shell is a Git Bash/MSYS shell."""
|
|
normalized = shell.replace("\\", "/").lower()
|
|
shell_name = LocalSandbox._shell_name(shell)
|
|
return shell_name in {"sh.exe", "bash.exe"} and any(part in normalized for part in ("/git/", "/mingw", "/msys"))
|
|
|
|
@staticmethod
|
|
def _find_first_available_shell(candidates: tuple[str, ...]) -> str | None:
|
|
"""Return the first executable shell path or command found from candidates."""
|
|
for shell in candidates:
|
|
if os.path.isabs(shell):
|
|
if os.path.isfile(shell) and os.access(shell, os.X_OK):
|
|
return shell
|
|
continue
|
|
|
|
shell_from_path = shutil.which(shell)
|
|
if shell_from_path is not None:
|
|
return shell_from_path
|
|
|
|
return None
|
|
|
|
def __init__(self, id: str, path_mappings: list[PathMapping] | None = None):
|
|
"""
|
|
Initialize local sandbox with optional path mappings.
|
|
|
|
Args:
|
|
id: Sandbox identifier
|
|
path_mappings: List of path mappings with optional read-only flag.
|
|
Skills directory is read-only by default.
|
|
"""
|
|
super().__init__(id)
|
|
self.path_mappings = path_mappings or []
|
|
# Track files written through write_file so read_file only
|
|
# reverse-resolves paths in agent-authored content.
|
|
self._agent_written_paths: set[str] = set()
|
|
|
|
# ``path_mappings`` is set once in ``__init__`` and never mutated, so the
|
|
# sorted views and compiled path-rewrite patterns below are stable for the
|
|
# sandbox's lifetime. Caching them avoids re-sorting and re-compiling these
|
|
# regexes on every bash/read_file/write_file call (the agent's hot path).
|
|
|
|
@cached_property
|
|
def _command_pattern(self) -> re.Pattern[str] | None:
|
|
"""Compiled matcher for container paths in shell commands (shell-aware boundaries)."""
|
|
mappings = sorted(self.path_mappings, key=lambda m: len(m.container_path), reverse=True)
|
|
if not mappings:
|
|
return None
|
|
# The lookahead (?=/|$|...) ensures we only match at a path-segment boundary,
|
|
# preventing /mnt/skills from matching inside /mnt/skills-extra.
|
|
patterns = [re.escape(m.container_path) + r"(?=/|$|[\s\"';&|<>()])(?:/[^\s\"';&|<>()]*)?" for m in mappings]
|
|
return re.compile("|".join(f"({p})" for p in patterns))
|
|
|
|
@cached_property
|
|
def _content_pattern(self) -> re.Pattern[str] | None:
|
|
"""Compiled matcher for container paths in plain file content (text boundaries)."""
|
|
mappings = sorted(self.path_mappings, key=lambda m: len(m.container_path), reverse=True)
|
|
if not mappings:
|
|
return None
|
|
patterns = [re.escape(m.container_path) + r"(?=/|$|[^\w./-])(?:/[^\s\"';&|<>()]*)?" for m in mappings]
|
|
return re.compile("|".join(f"({p})" for p in patterns))
|
|
|
|
@cached_property
|
|
def _reverse_output_patterns(self) -> list[re.Pattern[str]]:
|
|
"""Compiled matchers for local paths in command output (longest local path first)."""
|
|
return [re.compile(re.escape(self._resolved_local_paths[m]) + r"(?:[/\\][^\s\"';&|<>()]*)?") for m in self._mappings_by_local_specificity]
|
|
|
|
@cached_property
|
|
def _resolved_local_paths(self) -> dict[PathMapping, str]:
|
|
"""Filesystem-resolved local root per mapping. ``Path.resolve()`` hits the
|
|
disk, and the mounted directories don't move, so resolve once and reuse."""
|
|
return {m: str(Path(m.local_path).resolve()) for m in self.path_mappings}
|
|
|
|
@cached_property
|
|
def _mappings_by_container_specificity(self) -> list[PathMapping]:
|
|
"""Mappings ordered most-specific-container-first (for forward resolution)."""
|
|
return sorted(self.path_mappings, key=lambda m: len(m.container_path.rstrip("/") or "/"), reverse=True)
|
|
|
|
@cached_property
|
|
def _mappings_by_local_specificity(self) -> list[PathMapping]:
|
|
"""Mappings ordered longest-local-path-first (for reverse resolution)."""
|
|
return sorted(self.path_mappings, key=lambda m: len(m.local_path), reverse=True)
|
|
|
|
def _is_read_only_path(self, resolved_path: str) -> bool:
|
|
"""Check if a resolved path is under a read-only mount.
|
|
|
|
When multiple mappings match (nested mounts), prefer the most specific
|
|
mapping (i.e. the one whose local_path is the longest prefix of the
|
|
resolved path), similar to how ``_resolve_path`` handles container paths.
|
|
"""
|
|
resolved = str(Path(resolved_path).resolve())
|
|
|
|
best_mapping: PathMapping | None = None
|
|
best_prefix_len = -1
|
|
|
|
for mapping in self.path_mappings:
|
|
local_resolved = self._resolved_local_paths[mapping]
|
|
if resolved == local_resolved or resolved.startswith(local_resolved + os.sep):
|
|
prefix_len = len(local_resolved)
|
|
if prefix_len > best_prefix_len:
|
|
best_prefix_len = prefix_len
|
|
best_mapping = mapping
|
|
|
|
if best_mapping is None:
|
|
return False
|
|
|
|
return best_mapping.read_only
|
|
|
|
def _find_path_mapping(self, path: str) -> tuple[PathMapping, str] | None:
|
|
path_str = str(path)
|
|
|
|
for mapping in self._mappings_by_container_specificity:
|
|
container_path = mapping.container_path.rstrip("/") or "/"
|
|
if container_path == "/":
|
|
if path_str.startswith("/"):
|
|
return mapping, path_str.lstrip("/")
|
|
continue
|
|
|
|
if path_str == container_path or path_str.startswith(container_path + "/"):
|
|
relative = path_str[len(container_path) :].lstrip("/")
|
|
return mapping, relative
|
|
|
|
return None
|
|
|
|
def _resolve_path_with_mapping(self, path: str) -> ResolvedPath:
|
|
"""
|
|
Resolve container path to actual local path using mappings.
|
|
|
|
Args:
|
|
path: Path that might be a container path
|
|
|
|
Returns:
|
|
Resolved local path and the matched mapping, if any
|
|
"""
|
|
path_str = str(path)
|
|
|
|
mapping_match = self._find_path_mapping(path_str)
|
|
if mapping_match is None:
|
|
return ResolvedPath(path_str, None)
|
|
|
|
mapping, relative = mapping_match
|
|
local_root = Path(self._resolved_local_paths[mapping])
|
|
resolved_path = (local_root / relative).resolve() if relative else local_root
|
|
|
|
try:
|
|
resolved_path.relative_to(local_root)
|
|
except ValueError as exc:
|
|
raise PermissionError(errno.EACCES, "Access denied: path escapes mounted directory", path_str) from exc
|
|
|
|
return ResolvedPath(str(resolved_path), mapping)
|
|
|
|
def _resolve_path(self, path: str) -> str:
|
|
return self._resolve_path_with_mapping(path).path
|
|
|
|
def _is_resolved_path_read_only(self, resolved: ResolvedPath) -> bool:
|
|
return bool(resolved.mapping and resolved.mapping.read_only) or self._is_read_only_path(resolved.path)
|
|
|
|
def _reverse_resolve_path(self, path: str) -> str:
|
|
"""
|
|
Reverse resolve local path back to container path using mappings.
|
|
|
|
Args:
|
|
path: Local path that might need to be mapped to container path
|
|
|
|
Returns:
|
|
Container path if mapping exists, otherwise original path
|
|
"""
|
|
normalized_path = path.replace("\\", "/")
|
|
path_str = str(Path(normalized_path).resolve())
|
|
|
|
# Try each mapping (longest local path first for more specific matches)
|
|
for mapping in self._mappings_by_local_specificity:
|
|
local_path_resolved = self._resolved_local_paths[mapping]
|
|
if path_str == local_path_resolved or path_str.startswith(local_path_resolved + "/"):
|
|
# Replace the local path prefix with container path
|
|
relative = path_str[len(local_path_resolved) :].lstrip("/")
|
|
resolved = f"{mapping.container_path}/{relative}" if relative else mapping.container_path
|
|
return resolved
|
|
|
|
# No mapping found, return original path
|
|
return path_str
|
|
|
|
def _reverse_resolve_paths_in_output(self, output: str) -> str:
|
|
"""
|
|
Reverse resolve local paths back to container paths in output string.
|
|
|
|
Args:
|
|
output: Output string that may contain local paths
|
|
|
|
Returns:
|
|
Output with local paths resolved to container paths
|
|
"""
|
|
# Patterns are compiled once per sandbox (longest local path first for
|
|
# correct prefix matching) and reused across calls.
|
|
result = output
|
|
for pattern in self._reverse_output_patterns:
|
|
|
|
def replace_match(match: re.Match) -> str:
|
|
matched_path = match.group(0)
|
|
return self._reverse_resolve_path(matched_path)
|
|
|
|
result = pattern.sub(replace_match, result)
|
|
|
|
return result
|
|
|
|
def _resolve_paths_in_command(self, command: str) -> str:
|
|
"""
|
|
Resolve container paths to local paths in a command string.
|
|
|
|
Args:
|
|
command: Command string that may contain container paths
|
|
|
|
Returns:
|
|
Command with container paths resolved to local paths
|
|
"""
|
|
pattern = self._command_pattern
|
|
if pattern is None:
|
|
return command
|
|
|
|
def replace_match(match: re.Match) -> str:
|
|
matched_path = match.group(0)
|
|
return self._resolve_path(matched_path)
|
|
|
|
return pattern.sub(replace_match, command)
|
|
|
|
def _resolve_paths_in_content(self, content: str) -> str:
|
|
"""Resolve container paths to local paths in arbitrary file content.
|
|
|
|
Unlike ``_resolve_paths_in_command`` which uses shell-aware boundary
|
|
characters, this method treats the content as plain text and resolves
|
|
every occurrence of a container path prefix. Resolved paths are
|
|
normalized to forward slashes to avoid backslash-escape issues on
|
|
Windows hosts (e.g. ``C:\\Users\\..`` breaking Python string literals).
|
|
|
|
Args:
|
|
content: File content that may contain container paths.
|
|
|
|
Returns:
|
|
Content with container paths resolved to local paths (forward slashes).
|
|
"""
|
|
pattern = self._content_pattern
|
|
if pattern is None:
|
|
return content
|
|
|
|
def replace_match(match: re.Match) -> str:
|
|
matched_path = match.group(0)
|
|
resolved = self._resolve_path(matched_path)
|
|
# Normalize to forward slashes so that Windows backslash paths
|
|
# don't create invalid escape sequences in source files.
|
|
return resolved.replace("\\", "/")
|
|
|
|
return pattern.sub(replace_match, content)
|
|
|
|
@staticmethod
|
|
def _get_shell() -> str:
|
|
"""Detect available shell executable with fallback."""
|
|
shell = LocalSandbox._find_first_available_shell(("/bin/zsh", "/bin/bash", "/bin/sh", "sh"))
|
|
if shell is not None:
|
|
return shell
|
|
|
|
if os.name == "nt":
|
|
system_root = os.environ.get("SystemRoot", r"C:\Windows")
|
|
shell = LocalSandbox._find_first_available_shell(
|
|
(
|
|
"pwsh",
|
|
"pwsh.exe",
|
|
"powershell",
|
|
"powershell.exe",
|
|
ntpath.join(system_root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
|
|
"cmd.exe",
|
|
)
|
|
)
|
|
if shell is not None:
|
|
return shell
|
|
|
|
raise RuntimeError("No suitable shell executable found. Tried /bin/zsh, /bin/bash, /bin/sh, `sh` on PATH, then PowerShell and cmd.exe fallbacks for Windows.")
|
|
|
|
raise RuntimeError("No suitable shell executable found. Tried /bin/zsh, /bin/bash, /bin/sh, and `sh` on PATH.")
|
|
|
|
def execute_command(self, command: str) -> str:
|
|
# Resolve container paths in command before execution
|
|
resolved_command = self._resolve_paths_in_command(command)
|
|
shell = self._get_shell()
|
|
|
|
if os.name == "nt":
|
|
env = None
|
|
if self._is_powershell(shell):
|
|
args = [shell, "-NoProfile", "-Command", resolved_command]
|
|
elif self._is_cmd_shell(shell):
|
|
args = [shell, "/c", resolved_command]
|
|
else:
|
|
args = [shell, "-c", resolved_command]
|
|
if self._is_msys_shell(shell):
|
|
env = {
|
|
**os.environ,
|
|
"MSYS_NO_PATHCONV": "1",
|
|
"MSYS2_ARG_CONV_EXCL": "*",
|
|
}
|
|
|
|
result = subprocess.run(
|
|
args,
|
|
shell=False,
|
|
capture_output=True,
|
|
text=True,
|
|
timeout=600,
|
|
env=env,
|
|
)
|
|
else:
|
|
args = [shell, "-c", resolved_command]
|
|
result = subprocess.run(
|
|
args,
|
|
shell=False,
|
|
capture_output=True,
|
|
text=True,
|
|
timeout=600,
|
|
)
|
|
output = result.stdout
|
|
if result.stderr:
|
|
output += f"\nStd Error:\n{result.stderr}" if output else result.stderr
|
|
if result.returncode != 0:
|
|
output += f"\nExit Code: {result.returncode}"
|
|
|
|
final_output = output if output else "(no output)"
|
|
# Reverse resolve local paths back to container paths in output
|
|
return self._reverse_resolve_paths_in_output(final_output)
|
|
|
|
def list_dir(self, path: str, max_depth=2) -> list[str]:
|
|
resolved_path = self._resolve_path(path)
|
|
entries = list_dir(resolved_path, max_depth)
|
|
# Reverse resolve local paths back to container paths and preserve
|
|
# list_dir's trailing "/" marker for directories.
|
|
result: list[str] = []
|
|
for entry in entries:
|
|
is_dir = entry.endswith(("/", "\\"))
|
|
reversed_entry = self._reverse_resolve_path(entry.rstrip("/\\")) if is_dir else self._reverse_resolve_path(entry)
|
|
result.append(f"{reversed_entry}/" if is_dir and not reversed_entry.endswith("/") else reversed_entry)
|
|
return result
|
|
|
|
def read_file(self, path: str) -> str:
|
|
resolved_path = self._resolve_path(path)
|
|
try:
|
|
with open(resolved_path, encoding="utf-8") as f:
|
|
content = f.read()
|
|
# Only reverse-resolve paths in files that were previously written
|
|
# by write_file (agent-authored content). User-uploaded files,
|
|
# external tool output, and other non-agent content should not be
|
|
# silently rewritten — see discussion on PR #1935.
|
|
if resolved_path in self._agent_written_paths:
|
|
content = self._reverse_resolve_paths_in_output(content)
|
|
return content
|
|
except OSError as e:
|
|
# Re-raise with the original path for clearer error messages, hiding internal resolved paths
|
|
raise type(e)(e.errno, e.strerror, path) from None
|
|
|
|
def download_file(self, path: str) -> bytes:
|
|
normalised = path.replace("\\", "/")
|
|
stripped_path = normalised.lstrip("/")
|
|
allowed_prefix = VIRTUAL_PATH_PREFIX.lstrip("/")
|
|
if stripped_path != allowed_prefix and not stripped_path.startswith(f"{allowed_prefix}/"):
|
|
logger.error("Refused download outside allowed directory: path=%s, allowed_prefix=%s", path, VIRTUAL_PATH_PREFIX)
|
|
raise PermissionError(errno.EACCES, f"Access denied: path must be under '{VIRTUAL_PATH_PREFIX}'", path)
|
|
|
|
resolved_path = self._resolve_path(path)
|
|
max_download_size = 100 * 1024 * 1024
|
|
try:
|
|
file_size = os.path.getsize(resolved_path)
|
|
if file_size > max_download_size:
|
|
raise OSError(errno.EFBIG, f"File exceeds maximum download size of {max_download_size} bytes", path)
|
|
# TOCTOU note: the file could grow between getsize() and read(); accepted
|
|
# tradeoff since this is a controlled sandbox environment.
|
|
with open(resolved_path, "rb") as f:
|
|
return f.read()
|
|
except OSError as e:
|
|
# Re-raise with the original path for clearer error messages, hiding internal resolved paths
|
|
raise type(e)(e.errno, e.strerror, path) from None
|
|
|
|
def write_file(self, path: str, content: str, append: bool = False) -> None:
|
|
resolved = self._resolve_path_with_mapping(path)
|
|
resolved_path = resolved.path
|
|
if self._is_resolved_path_read_only(resolved):
|
|
raise OSError(errno.EROFS, "Read-only file system", path)
|
|
try:
|
|
dir_path = os.path.dirname(resolved_path)
|
|
if dir_path:
|
|
os.makedirs(dir_path, exist_ok=True)
|
|
# Resolve container paths in content to local paths
|
|
# using the content-specific resolver (forward-slash safe)
|
|
resolved_content = self._resolve_paths_in_content(content)
|
|
mode = "a" if append else "w"
|
|
with open(resolved_path, mode, encoding="utf-8") as f:
|
|
f.write(resolved_content)
|
|
# Track this path so read_file knows to reverse-resolve on read.
|
|
# Only agent-written files get reverse-resolved; user uploads and
|
|
# external tool output are left untouched.
|
|
self._agent_written_paths.add(resolved_path)
|
|
except OSError as e:
|
|
# Re-raise with the original path for clearer error messages, hiding internal resolved paths
|
|
raise type(e)(e.errno, e.strerror, path) from None
|
|
|
|
def glob(self, path: str, pattern: str, *, include_dirs: bool = False, max_results: int = 200) -> tuple[list[str], bool]:
|
|
resolved_path = Path(self._resolve_path(path))
|
|
matches, truncated = find_glob_matches(resolved_path, pattern, include_dirs=include_dirs, max_results=max_results)
|
|
return [self._reverse_resolve_path(match) for match in matches], truncated
|
|
|
|
def grep(
|
|
self,
|
|
path: str,
|
|
pattern: str,
|
|
*,
|
|
glob: str | None = None,
|
|
literal: bool = False,
|
|
case_sensitive: bool = False,
|
|
max_results: int = 100,
|
|
) -> tuple[list[GrepMatch], bool]:
|
|
resolved_path = Path(self._resolve_path(path))
|
|
matches, truncated = find_grep_matches(
|
|
resolved_path,
|
|
pattern,
|
|
glob_pattern=glob,
|
|
literal=literal,
|
|
case_sensitive=case_sensitive,
|
|
max_results=max_results,
|
|
)
|
|
return [
|
|
GrepMatch(
|
|
path=self._reverse_resolve_path(match.path),
|
|
line_number=match.line_number,
|
|
line=match.line,
|
|
)
|
|
for match in matches
|
|
], truncated
|
|
|
|
def update_file(self, path: str, content: bytes) -> None:
|
|
resolved = self._resolve_path_with_mapping(path)
|
|
resolved_path = resolved.path
|
|
if self._is_resolved_path_read_only(resolved):
|
|
raise OSError(errno.EROFS, "Read-only file system", path)
|
|
try:
|
|
dir_path = os.path.dirname(resolved_path)
|
|
if dir_path:
|
|
os.makedirs(dir_path, exist_ok=True)
|
|
with open(resolved_path, "wb") as f:
|
|
f.write(content)
|
|
except OSError as e:
|
|
# Re-raise with the original path for clearer error messages, hiding internal resolved paths
|
|
raise type(e)(e.errno, e.strerror, path) from None
|