Cyrene_v2

809 Commits 7 Branches 0 Tags

2 Commits

Include renames

Author	SHA1	Message	Date
AskaEth	ed5bd92e1b	fix(exec): 沙箱子进程不再继承宿主完整环境（P0-7，审计 §4.3） CI / Backend (build / vet / test / cross-compile) (push) Has been cancelled Details CI / Frontend (tsc + vite build) (push) Has been cancelled Details - buildEnv 不再以 os.Environ() 全集为基，改为「平台最小必需键白名单」裁剪后再叠加 req.Env · Windows：PATH/PATHEXT/SYSTEMROOT/WINDIR/COMSPEC/TEMP/TMP/USERPROFILE/HOMEDRIVE/HOMEPATH/APPDATA/LOCALAPPDATA/NUMBER_OF_PROCESSORS/OS/PROCESSOR_ARCHITECTURE · Unix：PATH/HOME/TMPDIR/LANG/LC_ALL/USER/SHELL - 键名匹配在 Windows 上大小写不敏感（避免宿主写 Path 时漏掉），overlay 覆盖 base 时同口径去重 - envAllowed 语义不变：调用方能显式放行的键照旧，仅改变 base 来源 - 新增 TestTerminal_Env_HostNotInherited（非并行，t.Setenv）：父进程设非白名单变量，断言子进程读不到；反证＝把该键加进白名单立刻 FAIL	2026-10-04 12:29:43 +08:00
Aska	430fc4666b	feat(exec): 本地执行 Provider + 放权终端沙箱（白名单/工作目录/超时/输出截断/默认关）+ 文件沙箱；config 增 ExecSandbox(默认关)	2026-09-06 06:59:23 +08:00

Author

SHA1

Message

Date

AskaEth

ed5bd92e1b

fix(exec): 沙箱子进程不再继承宿主完整环境（P0-7，审计 §4.3）

CI / Backend (build / vet / test / cross-compile) (push) Has been cancelled

Details

CI / Frontend (tsc + vite build) (push) Has been cancelled

Details

- buildEnv 不再以 os.Environ() 全集为基，改为「平台最小必需键白名单」裁剪后再叠加 req.Env
  · Windows：PATH/PATHEXT/SYSTEMROOT/WINDIR/COMSPEC/TEMP/TMP/USERPROFILE/HOMEDRIVE/HOMEPATH/APPDATA/LOCALAPPDATA/NUMBER_OF_PROCESSORS/OS/PROCESSOR_ARCHITECTURE
  · Unix：PATH/HOME/TMPDIR/LANG/LC_ALL/USER/SHELL
- 键名匹配在 Windows 上大小写不敏感（避免宿主写 Path 时漏掉），overlay 覆盖 base 时同口径去重
- envAllowed 语义不变：调用方能显式放行的键照旧，仅改变 base 来源
- 新增 TestTerminal_Env_HostNotInherited（非并行，t.Setenv）：父进程设非白名单变量，断言子进程读不到；反证＝把该键加进白名单立刻 FAIL

2026-10-04 12:29:43 +08:00

Aska

430fc4666b

feat(exec): 本地执行 Provider + 放权终端沙箱（白名单/工作目录/超时/输出截断/默认关）+ 文件沙箱；config 增 ExecSandbox(默认关)

2026-09-06 06:59:23 +08:00