mirror of
https://github.com/farcasclaudiu/openclaw.git
synced 2026-06-28 13:01:42 +03:00
feat: add exec host routing + node daemon
This commit is contained in:
Peter Steinberger
@@ -0,0 +1,654 @@
|
||||
import crypto from "node:crypto";
|
||||
import { spawn } from "node:child_process";
|
||||
import fs from "node:fs";
|
||||
import os from "node:os";
|
||||
import path from "node:path";
|
||||
|
||||
import type { BridgeInvokeRequestFrame } from "../infra/bridge/server/types.js";
|
||||
import {
|
||||
addAllowlistEntry,
|
||||
matchAllowlist,
|
||||
recordAllowlistUse,
|
||||
requestExecApprovalViaSocket,
|
||||
resolveCommandResolution,
|
||||
resolveExecApprovals,
|
||||
} from "../infra/exec-approvals.js";
|
||||
import { getMachineDisplayName } from "../infra/machine-name.js";
|
||||
import { VERSION } from "../version.js";
|
||||
|
||||
import { BridgeClient } from "./bridge-client.js";
|
||||
import {
|
||||
ensureNodeHostConfig,
|
||||
saveNodeHostConfig,
|
||||
type NodeHostGatewayConfig,
|
||||
} from "./config.js";
|
||||
|
||||
type NodeHostRunOptions = {
|
||||
gatewayHost: string;
|
||||
gatewayPort: number;
|
||||
gatewayTls?: boolean;
|
||||
gatewayTlsFingerprint?: string;
|
||||
nodeId?: string;
|
||||
displayName?: string;
|
||||
};
|
||||
|
||||
type SystemRunParams = {
|
||||
command: string[];
|
||||
rawCommand?: string | null;
|
||||
cwd?: string | null;
|
||||
env?: Record<string, string>;
|
||||
timeoutMs?: number | null;
|
||||
needsScreenRecording?: boolean | null;
|
||||
agentId?: string | null;
|
||||
sessionKey?: string | null;
|
||||
};
|
||||
|
||||
type SystemWhichParams = {
|
||||
bins: string[];
|
||||
};
|
||||
|
||||
type RunResult = {
|
||||
exitCode?: number;
|
||||
timedOut: boolean;
|
||||
success: boolean;
|
||||
stdout: string;
|
||||
stderr: string;
|
||||
error?: string | null;
|
||||
truncated: boolean;
|
||||
};
|
||||
|
||||
type ExecEventPayload = {
|
||||
sessionKey: string;
|
||||
runId: string;
|
||||
host: string;
|
||||
command?: string;
|
||||
exitCode?: number;
|
||||
timedOut?: boolean;
|
||||
success?: boolean;
|
||||
output?: string;
|
||||
reason?: string;
|
||||
};
|
||||
|
||||
const OUTPUT_CAP = 200_000;
|
||||
const OUTPUT_EVENT_TAIL = 20_000;
|
||||
|
||||
const blockedEnvKeys = new Set([
|
||||
"PATH",
|
||||
"NODE_OPTIONS",
|
||||
"PYTHONHOME",
|
||||
"PYTHONPATH",
|
||||
"PERL5LIB",
|
||||
"PERL5OPT",
|
||||
"RUBYOPT",
|
||||
]);
|
||||
|
||||
const blockedEnvPrefixes = ["DYLD_", "LD_"];
|
||||
|
||||
class SkillBinsCache {
|
||||
private bins = new Set<string>();
|
||||
private lastRefresh = 0;
|
||||
private readonly ttlMs = 90_000;
|
||||
private readonly fetch: () => Promise<string[]>;
|
||||
|
||||
constructor(fetch: () => Promise<string[]>) {
|
||||
this.fetch = fetch;
|
||||
}
|
||||
|
||||
async current(force = false): Promise<Set<string>> {
|
||||
if (force || Date.now() - this.lastRefresh > this.ttlMs) {
|
||||
await this.refresh();
|
||||
}
|
||||
return this.bins;
|
||||
}
|
||||
|
||||
private async refresh() {
|
||||
try {
|
||||
const bins = await this.fetch();
|
||||
this.bins = new Set(bins);
|
||||
this.lastRefresh = Date.now();
|
||||
} catch {
|
||||
if (!this.lastRefresh) {
|
||||
this.bins = new Set();
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
function sanitizeEnv(overrides?: Record<string, string> | null): Record<string, string> | undefined {
|
||||
if (!overrides) return undefined;
|
||||
const merged = { ...process.env } as Record<string, string>;
|
||||
for (const [rawKey, value] of Object.entries(overrides)) {
|
||||
const key = rawKey.trim();
|
||||
if (!key) continue;
|
||||
const upper = key.toUpperCase();
|
||||
if (blockedEnvKeys.has(upper)) continue;
|
||||
if (blockedEnvPrefixes.some((prefix) => upper.startsWith(prefix))) continue;
|
||||
merged[key] = value;
|
||||
}
|
||||
return merged;
|
||||
}
|
||||
|
||||
function formatCommand(argv: string[]): string {
|
||||
return argv
|
||||
.map((arg) => {
|
||||
const trimmed = arg.trim();
|
||||
if (!trimmed) return "\"\"";
|
||||
const needsQuotes = /\s|"/.test(trimmed);
|
||||
if (!needsQuotes) return trimmed;
|
||||
return `"${trimmed.replace(/"/g, '\\"')}"`;
|
||||
})
|
||||
.join(" ");
|
||||
}
|
||||
|
||||
function truncateOutput(raw: string, maxChars: number): { text: string; truncated: boolean } {
|
||||
if (raw.length <= maxChars) return { text: raw, truncated: false };
|
||||
return { text: `... (truncated) ${raw.slice(raw.length - maxChars)}`, truncated: true };
|
||||
}
|
||||
|
||||
async function runCommand(
|
||||
argv: string[],
|
||||
cwd: string | undefined,
|
||||
env: Record<string, string> | undefined,
|
||||
timeoutMs: number | undefined,
|
||||
): Promise<RunResult> {
|
||||
return await new Promise((resolve) => {
|
||||
let stdout = "";
|
||||
let stderr = "";
|
||||
let outputLen = 0;
|
||||
let truncated = false;
|
||||
let timedOut = false;
|
||||
let settled = false;
|
||||
|
||||
const child = spawn(argv[0], argv.slice(1), {
|
||||
cwd,
|
||||
env,
|
||||
stdio: ["ignore", "pipe", "pipe"],
|
||||
windowsHide: true,
|
||||
});
|
||||
|
||||
const onChunk = (chunk: Buffer, target: "stdout" | "stderr") => {
|
||||
if (outputLen >= OUTPUT_CAP) {
|
||||
truncated = true;
|
||||
return;
|
||||
}
|
||||
const remaining = OUTPUT_CAP - outputLen;
|
||||
const slice = chunk.length > remaining ? chunk.subarray(0, remaining) : chunk;
|
||||
const str = slice.toString("utf8");
|
||||
outputLen += slice.length;
|
||||
if (target === "stdout") stdout += str;
|
||||
else stderr += str;
|
||||
if (chunk.length > remaining) truncated = true;
|
||||
};
|
||||
|
||||
child.stdout?.on("data", (chunk) => onChunk(chunk as Buffer, "stdout"));
|
||||
child.stderr?.on("data", (chunk) => onChunk(chunk as Buffer, "stderr"));
|
||||
|
||||
let timer: NodeJS.Timeout | undefined;
|
||||
if (timeoutMs && timeoutMs > 0) {
|
||||
timer = setTimeout(() => {
|
||||
timedOut = true;
|
||||
try {
|
||||
child.kill("SIGKILL");
|
||||
} catch {
|
||||
// ignore
|
||||
}
|
||||
}, timeoutMs);
|
||||
}
|
||||
|
||||
const finalize = (exitCode?: number, error?: string | null) => {
|
||||
if (settled) return;
|
||||
settled = true;
|
||||
if (timer) clearTimeout(timer);
|
||||
resolve({
|
||||
exitCode,
|
||||
timedOut,
|
||||
success: exitCode === 0 && !timedOut && !error,
|
||||
stdout,
|
||||
stderr,
|
||||
error: error ?? null,
|
||||
truncated,
|
||||
});
|
||||
};
|
||||
|
||||
child.on("error", (err) => {
|
||||
finalize(undefined, err.message);
|
||||
});
|
||||
child.on("exit", (code) => {
|
||||
finalize(code === null ? undefined : code, null);
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
function resolveEnvPath(env?: Record<string, string>): string[] {
|
||||
const raw =
|
||||
env?.PATH ??
|
||||
(env as Record<string, string>)?.Path ??
|
||||
process.env.PATH ??
|
||||
process.env.Path ??
|
||||
"";
|
||||
return raw.split(path.delimiter).filter(Boolean);
|
||||
}
|
||||
|
||||
function resolveExecutable(bin: string, env?: Record<string, string>) {
|
||||
if (bin.includes("/") || bin.includes("\\")) return null;
|
||||
const extensions =
|
||||
process.platform === "win32"
|
||||
? (process.env.PATHEXT ?? process.env.PathExt ?? ".EXE;.CMD;.BAT;.COM")
|
||||
.split(";")
|
||||
.map((ext) => ext.toLowerCase())
|
||||
: [""];
|
||||
for (const dir of resolveEnvPath(env)) {
|
||||
for (const ext of extensions) {
|
||||
const candidate = path.join(dir, bin + ext);
|
||||
if (fs.existsSync(candidate)) return candidate;
|
||||
}
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
async function handleSystemWhich(params: SystemWhichParams, env?: Record<string, string>) {
|
||||
const bins = params.bins
|
||||
.map((bin) => bin.trim())
|
||||
.filter(Boolean);
|
||||
const found: Record<string, string> = {};
|
||||
for (const bin of bins) {
|
||||
const path = resolveExecutable(bin, env);
|
||||
if (path) found[bin] = path;
|
||||
}
|
||||
return { bins: found };
|
||||
}
|
||||
|
||||
function buildExecEventPayload(payload: ExecEventPayload): ExecEventPayload {
|
||||
if (!payload.output) return payload;
|
||||
const trimmed = payload.output.trim();
|
||||
if (!trimmed) return payload;
|
||||
const { text } = truncateOutput(trimmed, OUTPUT_EVENT_TAIL);
|
||||
return { ...payload, output: text };
|
||||
}
|
||||
|
||||
export async function runNodeHost(opts: NodeHostRunOptions): Promise<void> {
|
||||
const config = await ensureNodeHostConfig();
|
||||
const nodeId = opts.nodeId?.trim() || config.nodeId;
|
||||
if (nodeId !== config.nodeId) {
|
||||
config.nodeId = nodeId;
|
||||
config.token = undefined;
|
||||
}
|
||||
const displayName =
|
||||
opts.displayName?.trim() || config.displayName || (await getMachineDisplayName());
|
||||
config.displayName = displayName;
|
||||
const gateway: NodeHostGatewayConfig = {
|
||||
host: opts.gatewayHost,
|
||||
port: opts.gatewayPort,
|
||||
tls: opts.gatewayTls === true,
|
||||
tlsFingerprint: opts.gatewayTlsFingerprint,
|
||||
};
|
||||
config.gateway = gateway;
|
||||
await saveNodeHostConfig(config);
|
||||
|
||||
let disconnectResolve: (() => void) | null = null;
|
||||
let disconnectSignal = false;
|
||||
const waitForDisconnect = () =>
|
||||
new Promise<void>((resolve) => {
|
||||
if (disconnectSignal) {
|
||||
disconnectSignal = false;
|
||||
resolve();
|
||||
return;
|
||||
}
|
||||
disconnectResolve = resolve;
|
||||
});
|
||||
|
||||
const client = new BridgeClient({
|
||||
host: gateway.host ?? "127.0.0.1",
|
||||
port: gateway.port ?? 18790,
|
||||
tls: gateway.tls,
|
||||
tlsFingerprint: gateway.tlsFingerprint,
|
||||
nodeId,
|
||||
token: config.token,
|
||||
displayName,
|
||||
platform: process.platform,
|
||||
version: VERSION,
|
||||
deviceFamily: os.platform(),
|
||||
modelIdentifier: os.hostname(),
|
||||
caps: ["system"],
|
||||
commands: ["system.run", "system.which"],
|
||||
onPairToken: async (token) => {
|
||||
config.token = token;
|
||||
await saveNodeHostConfig(config);
|
||||
},
|
||||
onAuthReset: async () => {
|
||||
if (!config.token) return;
|
||||
config.token = undefined;
|
||||
await saveNodeHostConfig(config);
|
||||
},
|
||||
onInvoke: async (frame) => {
|
||||
await handleInvoke(frame, client, skillBins);
|
||||
},
|
||||
onDisconnected: () => {
|
||||
if (disconnectResolve) {
|
||||
disconnectResolve();
|
||||
disconnectResolve = null;
|
||||
} else {
|
||||
disconnectSignal = true;
|
||||
}
|
||||
},
|
||||
});
|
||||
|
||||
const skillBins = new SkillBinsCache(async () => {
|
||||
const res = await client.request("skills.bins", {});
|
||||
const bins = Array.isArray(res?.bins) ? res.bins.map((b) => String(b)) : [];
|
||||
return bins;
|
||||
});
|
||||
|
||||
while (true) {
|
||||
try {
|
||||
await client.connect();
|
||||
await waitForDisconnect();
|
||||
} catch {
|
||||
// ignore connect errors; retry
|
||||
}
|
||||
await new Promise((resolve) => setTimeout(resolve, 1500));
|
||||
}
|
||||
}
|
||||
|
||||
async function handleInvoke(
|
||||
frame: BridgeInvokeRequestFrame,
|
||||
client: BridgeClient,
|
||||
skillBins: SkillBinsCache,
|
||||
) {
|
||||
const command = String(frame.command ?? "");
|
||||
if (command === "system.which") {
|
||||
try {
|
||||
const params = decodeParams<SystemWhichParams>(frame.paramsJSON);
|
||||
if (!Array.isArray(params.bins)) {
|
||||
throw new Error("INVALID_REQUEST: bins required");
|
||||
}
|
||||
const env = sanitizeEnv(undefined);
|
||||
const payload = await handleSystemWhich(params, env);
|
||||
client.sendInvokeResponse({
|
||||
type: "invoke-res",
|
||||
id: frame.id,
|
||||
ok: true,
|
||||
payloadJSON: JSON.stringify(payload),
|
||||
});
|
||||
} catch (err) {
|
||||
client.sendInvokeResponse({
|
||||
type: "invoke-res",
|
||||
id: frame.id,
|
||||
ok: false,
|
||||
error: { code: "INVALID_REQUEST", message: String(err) },
|
||||
});
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
if (command !== "system.run") {
|
||||
client.sendInvokeResponse({
|
||||
type: "invoke-res",
|
||||
id: frame.id,
|
||||
ok: false,
|
||||
error: { code: "UNAVAILABLE", message: "command not supported" },
|
||||
});
|
||||
return;
|
||||
}
|
||||
|
||||
let params: SystemRunParams;
|
||||
try {
|
||||
params = decodeParams<SystemRunParams>(frame.paramsJSON);
|
||||
} catch (err) {
|
||||
client.sendInvokeResponse({
|
||||
type: "invoke-res",
|
||||
id: frame.id,
|
||||
ok: false,
|
||||
error: { code: "INVALID_REQUEST", message: String(err) },
|
||||
});
|
||||
return;
|
||||
}
|
||||
|
||||
if (!Array.isArray(params.command) || params.command.length === 0) {
|
||||
client.sendInvokeResponse({
|
||||
type: "invoke-res",
|
||||
id: frame.id,
|
||||
ok: false,
|
||||
error: { code: "INVALID_REQUEST", message: "command required" },
|
||||
});
|
||||
return;
|
||||
}
|
||||
|
||||
const argv = params.command.map((item) => String(item));
|
||||
const rawCommand = typeof params.rawCommand === "string" ? params.rawCommand.trim() : "";
|
||||
const cmdText = rawCommand || formatCommand(argv);
|
||||
const agentId = params.agentId?.trim() || undefined;
|
||||
const approvals = resolveExecApprovals(agentId);
|
||||
const security = approvals.agent.security;
|
||||
const ask = approvals.agent.ask;
|
||||
const askFallback = approvals.agent.askFallback;
|
||||
const autoAllowSkills = approvals.agent.autoAllowSkills;
|
||||
const sessionKey = params.sessionKey?.trim() || "node";
|
||||
const runId = crypto.randomUUID();
|
||||
const env = sanitizeEnv(params.env ?? undefined);
|
||||
const resolution = resolveCommandResolution(cmdText, params.cwd ?? undefined, env);
|
||||
const allowlistMatch =
|
||||
security === "allowlist" ? matchAllowlist(approvals.allowlist, resolution) : null;
|
||||
const bins = autoAllowSkills ? await skillBins.current() : new Set<string>();
|
||||
const skillAllow =
|
||||
autoAllowSkills && resolution?.executableName ? bins.has(resolution.executableName) : false;
|
||||
|
||||
if (security === "deny") {
|
||||
client.sendEvent(
|
||||
"exec.denied",
|
||||
buildExecEventPayload({
|
||||
sessionKey,
|
||||
runId,
|
||||
host: "node",
|
||||
command: cmdText,
|
||||
reason: "security=deny",
|
||||
}),
|
||||
);
|
||||
client.sendInvokeResponse({
|
||||
type: "invoke-res",
|
||||
id: frame.id,
|
||||
ok: false,
|
||||
error: { code: "UNAVAILABLE", message: "SYSTEM_RUN_DISABLED: security=deny" },
|
||||
});
|
||||
return;
|
||||
}
|
||||
|
||||
const requiresAsk =
|
||||
ask === "always" ||
|
||||
(ask === "on-miss" && security === "allowlist" && !allowlistMatch && !skillAllow);
|
||||
|
||||
let approvedByAsk = false;
|
||||
if (requiresAsk) {
|
||||
const decision = await requestExecApprovalViaSocket({
|
||||
socketPath: approvals.socketPath,
|
||||
token: approvals.token,
|
||||
request: {
|
||||
command: cmdText,
|
||||
cwd: params.cwd ?? undefined,
|
||||
host: "node",
|
||||
security,
|
||||
ask,
|
||||
agentId,
|
||||
resolvedPath: resolution?.resolvedPath ?? null,
|
||||
},
|
||||
});
|
||||
if (decision === "deny") {
|
||||
client.sendEvent(
|
||||
"exec.denied",
|
||||
buildExecEventPayload({
|
||||
sessionKey,
|
||||
runId,
|
||||
host: "node",
|
||||
command: cmdText,
|
||||
reason: "user-denied",
|
||||
}),
|
||||
);
|
||||
client.sendInvokeResponse({
|
||||
type: "invoke-res",
|
||||
id: frame.id,
|
||||
ok: false,
|
||||
error: { code: "UNAVAILABLE", message: "SYSTEM_RUN_DENIED: user denied" },
|
||||
});
|
||||
return;
|
||||
}
|
||||
if (!decision) {
|
||||
if (askFallback === "full") {
|
||||
approvedByAsk = true;
|
||||
} else if (askFallback === "allowlist") {
|
||||
if (allowlistMatch || skillAllow) {
|
||||
approvedByAsk = true;
|
||||
} else {
|
||||
client.sendEvent(
|
||||
"exec.denied",
|
||||
buildExecEventPayload({
|
||||
sessionKey,
|
||||
runId,
|
||||
host: "node",
|
||||
command: cmdText,
|
||||
reason: "approval-required",
|
||||
}),
|
||||
);
|
||||
client.sendInvokeResponse({
|
||||
type: "invoke-res",
|
||||
id: frame.id,
|
||||
ok: false,
|
||||
error: { code: "UNAVAILABLE", message: "SYSTEM_RUN_DENIED: approval required" },
|
||||
});
|
||||
return;
|
||||
}
|
||||
} else {
|
||||
client.sendEvent(
|
||||
"exec.denied",
|
||||
buildExecEventPayload({
|
||||
sessionKey,
|
||||
runId,
|
||||
host: "node",
|
||||
command: cmdText,
|
||||
reason: "approval-required",
|
||||
}),
|
||||
);
|
||||
client.sendInvokeResponse({
|
||||
type: "invoke-res",
|
||||
id: frame.id,
|
||||
ok: false,
|
||||
error: { code: "UNAVAILABLE", message: "SYSTEM_RUN_DENIED: approval required" },
|
||||
});
|
||||
return;
|
||||
}
|
||||
}
|
||||
if (decision === "allow-once") {
|
||||
approvedByAsk = true;
|
||||
}
|
||||
if (decision === "allow-always") {
|
||||
approvedByAsk = true;
|
||||
if (security === "allowlist") {
|
||||
const pattern = resolution?.resolvedPath ?? resolution?.rawExecutable ?? argv[0] ?? "";
|
||||
if (pattern) addAllowlistEntry(approvals.file, agentId, pattern);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (security === "allowlist" && !allowlistMatch && !skillAllow && !approvedByAsk) {
|
||||
client.sendEvent(
|
||||
"exec.denied",
|
||||
buildExecEventPayload({
|
||||
sessionKey,
|
||||
runId,
|
||||
host: "node",
|
||||
command: cmdText,
|
||||
reason: "allowlist-miss",
|
||||
}),
|
||||
);
|
||||
client.sendInvokeResponse({
|
||||
type: "invoke-res",
|
||||
id: frame.id,
|
||||
ok: false,
|
||||
error: { code: "UNAVAILABLE", message: "SYSTEM_RUN_DENIED: allowlist miss" },
|
||||
});
|
||||
return;
|
||||
}
|
||||
|
||||
if (allowlistMatch) {
|
||||
recordAllowlistUse(approvals.file, agentId, allowlistMatch, cmdText, resolution?.resolvedPath);
|
||||
}
|
||||
|
||||
if (params.needsScreenRecording === true) {
|
||||
client.sendEvent(
|
||||
"exec.denied",
|
||||
buildExecEventPayload({
|
||||
sessionKey,
|
||||
runId,
|
||||
host: "node",
|
||||
command: cmdText,
|
||||
reason: "permission:screenRecording",
|
||||
}),
|
||||
);
|
||||
client.sendInvokeResponse({
|
||||
type: "invoke-res",
|
||||
id: frame.id,
|
||||
ok: false,
|
||||
error: { code: "UNAVAILABLE", message: "PERMISSION_MISSING: screenRecording" },
|
||||
});
|
||||
return;
|
||||
}
|
||||
|
||||
client.sendEvent(
|
||||
"exec.started",
|
||||
buildExecEventPayload({
|
||||
sessionKey,
|
||||
runId,
|
||||
host: "node",
|
||||
command: cmdText,
|
||||
}),
|
||||
);
|
||||
|
||||
const result = await runCommand(
|
||||
argv,
|
||||
params.cwd?.trim() || undefined,
|
||||
env,
|
||||
params.timeoutMs ?? undefined,
|
||||
);
|
||||
if (result.truncated) {
|
||||
const suffix = "... (truncated)";
|
||||
if (result.stderr.trim().length > 0) {
|
||||
result.stderr = `${result.stderr}\n${suffix}`;
|
||||
} else {
|
||||
result.stdout = `${result.stdout}\n${suffix}`;
|
||||
}
|
||||
}
|
||||
const combined = [result.stdout, result.stderr, result.error].filter(Boolean).join("\n");
|
||||
client.sendEvent(
|
||||
"exec.finished",
|
||||
buildExecEventPayload({
|
||||
sessionKey,
|
||||
runId,
|
||||
host: "node",
|
||||
command: cmdText,
|
||||
exitCode: result.exitCode,
|
||||
timedOut: result.timedOut,
|
||||
success: result.success,
|
||||
output: combined,
|
||||
}),
|
||||
);
|
||||
|
||||
client.sendInvokeResponse({
|
||||
type: "invoke-res",
|
||||
id: frame.id,
|
||||
ok: true,
|
||||
payloadJSON: JSON.stringify({
|
||||
exitCode: result.exitCode,
|
||||
timedOut: result.timedOut,
|
||||
success: result.success,
|
||||
stdout: result.stdout,
|
||||
stderr: result.stderr,
|
||||
error: result.error ?? null,
|
||||
}),
|
||||
});
|
||||
}
|
||||
|
||||
function decodeParams<T>(raw?: string | null): T {
|
||||
if (!raw) {
|
||||
throw new Error("INVALID_REQUEST: paramsJSON required");
|
||||
}
|
||||
return JSON.parse(raw) as T;
|
||||
}
|
||||
Reference in New Issue
Block a user