MetonaTeam/metona-ai-desktop
2
0
Fork 0
Code Issues 51 Pull Requests Actions Packages Projects Releases 8 Wiki Activity

v0.1.2: 全项目代码审查修复 + 子代理编排器 + 上下文压缩 + 并行工具执行

Browse Source 
后端修复: Ollama adapter 移除死代码/修复超时硬编码/iteration硬编码/pullModel无超时/流异常断开补发DONE; SSE解析器支持非字符串arguments; Sandbox fail-closed安全加固; IPC移除未使用变量

新增功能: TaskOrchestrator子任务编排器; DelegateTaskTool委派工具; Agent Loop并行工具执行; 上下文自动压缩; 记忆检索注入System Prompt

前端修复: useAgentStream text_delta thought累积bug; 工具调用状态正确流转; 修复重复stateChange事件; TraceStep.thought正确填充
This commit is contained in:
thzxx
2026-07-06 22:48:33 +08:00
parent 8cdb93f8bf
commit 6f08759f63
25 changed files with 1044 additions and 675 deletions
Download Patch File Download Diff File Expand all files Collapse all files
electron/harness/sandbox/permissions.ts
+3 -10
View File
@@ -31,16 +31,9 @@ export const DEFAULT_POLICIES: PermissionPolicy[] = [
{ toolName: 'memory_store', requiredLevel: PermissionLevel.WRITE },
{ toolName: 'run_command', requiredLevel: PermissionLevel.EXTERNAL_ACTION, deniedPatterns: [/MEMORY\.md/i], requireConfirmation: true, maxFrequency: 3 },
{ toolName: 'web_fetch', requiredLevel: PermissionLevel.READ },
// Browser 浏览器工具
{ toolName: 'browser_open', requiredLevel: PermissionLevel.EXTERNAL_ACTION, requireConfirmation: true, maxFrequency: 10 },
{ toolName: 'browser_screenshot', requiredLevel: PermissionLevel.READ, maxFrequency: 20 },
{ toolName: 'browser_evaluate', requiredLevel: PermissionLevel.EXTERNAL_ACTION, requireConfirmation: true, maxFrequency: 10 },
{ toolName: 'browser_extract', requiredLevel: PermissionLevel.READ },
{ toolName: 'browser_click', requiredLevel: PermissionLevel.EXTERNAL_ACTION, requireConfirmation: true, maxFrequency: 15 },
{ toolName: 'browser_type', requiredLevel: PermissionLevel.EXTERNAL_ACTION, requireConfirmation: true, maxFrequency: 15 },
{ toolName: 'browser_scroll', requiredLevel: PermissionLevel.READ },
{ toolName: 'browser_wait', requiredLevel: PermissionLevel.READ },
{ toolName: 'browser_close', requiredLevel: PermissionLevel.READ },
// web_browser — 统一浏览器工具（合并自 9 个独立 browser_* 工具）
// 由于该工具可执行 JS、点击元素等高风险操作，统一设为 EXTERNAL_ACTION
{ toolName: 'web_browser', requiredLevel: PermissionLevel.EXTERNAL_ACTION, requireConfirmation: true, maxFrequency: 20 },
];
export class PolicyEngine {
electron/harness/sandbox/sandbox.ts
+11 -8
View File
@@ -6,6 +6,8 @@
* @see docs/生产级通用 AI Agent 智能体桌面应用：完整设计与构建指南.html — 第五章
*/
import { resolve, sep } from 'path';
export interface SandboxConfig {
allowedPaths?: string[];
networkPolicy?: 'allowall' | 'deny-all' | 'allowlist';
@@ -45,20 +47,21 @@ export class SandboxManager {
/**
* 校验文件路径是否在白名单内
*
* 安全策略：fail-closed — 如果未配置任何白名单路径，拒绝所有访问。
*/
validatePath(requestedPath: string): { allowed: boolean; resolvedPath: string; reason?: string } {
const { resolve } = require('path');
const resolved = resolve(requestedPath);
if (requestedPath.includes('..')) {
return { allowed: false, resolvedPath: resolved, reason: 'Path traversal detected' };
if (this.allowedPaths.size === 0) {
return { allowed: false, resolvedPath: resolved, reason: 'No allowed paths configured (fail-closed)' };
}
if (this.allowedPaths.size > 0) {
const isAllowed = Array.from(this.allowedPaths).some((allowed) => resolved.startsWith(allowed));
if (!isAllowed) {
return { allowed: false, resolvedPath: resolved, reason: 'Path not in allowed list' };
}
const isAllowed = Array.from(this.allowedPaths).some(
(allowed) => resolved === allowed || resolved.startsWith(allowed + sep),
);
if (!isAllowed) {
return { allowed: false, resolvedPath: resolved, reason: 'Path not in allowed list' };
}
return { allowed: true, resolvedPath: resolved };