agent: 限制工具资源并收紧网络信任边界 - #5
Open
wen227 wants to merge 1 commit into
Open
Conversation
There was a problem hiding this comment.
Pull request overview
This PR tightens the agent’s trust boundary and resource limits across tools, focusing on preventing untrusted workspace configuration from influencing network/runtime behavior and ensuring tool outputs are bounded and safely drained.
Changes:
- Disable implicit workspace
.envloading in the CLI and document the new expectation for injecting API keys. - Force
web_fetchto ignore system proxy environment variables so DNS/SSRF checks remain effective end-to-end, and add regression coverage. - Harden tool I/O: bound
read_fileline retention while still draining/validating full UTF-8, and makebashoutput draining concurrent with output caps and descendant cleanup.
Reviewed changes
Copilot reviewed 10 out of 11 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| README.md | Documents that .env is no longer implicitly loaded and recommends trusted env injection. |
| crates/kuncode-cli/src/main.rs | Removes dotenvy auto-loading from the CLI entrypoint. |
| crates/kuncode-cli/Cargo.toml | Drops dotenvy dependency from the CLI crate. |
| crates/kuncode-agent/src/tool/web_fetch/tests.rs | Adds regression test ensuring system proxy env vars are ignored. |
| crates/kuncode-agent/src/tool/web_fetch/address.rs | Removes proxy-host exemption logic from the guarded resolver. |
| crates/kuncode-agent/src/tool/web_fetch.rs | Disables proxy discovery and uses the direct-only guarded resolver. |
| crates/kuncode-agent/src/tool/filesystem/read_file.rs | Implements bounded per-line retention with full drain + UTF-8 validation; adds tests. |
| crates/kuncode-agent/src/tool/filesystem/ls.rs | Restricts non-UTF-8 filename test to Linux to match platform behavior. |
| crates/kuncode-agent/src/tool/filesystem/glob.rs | Restricts non-UTF-8 filename test to Linux to match platform behavior. |
| crates/kuncode-agent/src/tool/bash.rs | Concurrently drains stdout/stderr with caps, records truncation, and kills Unix process groups on timeout/cancel; adds tests. |
| Cargo.lock | Removes dotenvy from the resolved dependency graph. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+263
to
+268
| impl Drop for ManagedChild { | ||
| fn drop(&mut self) { | ||
| if self.cleanup_armed { | ||
| self.signal_termination(); | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
变更
read_file改为有界单行读取；超长行只保留 2 KB 前缀，但仍排空并校验完整 UTF-8 内容。.env，并同步更新依赖和 README。行为变化
.env不再自动加载。HTTP_PROXY、HTTPS_PROXY或ALL_PROXY。验证
cargo fmt --all -- --checkcargo clippy --workspace --all-targets -- -D warningscargo check --workspace --all-targetscargo doc --workspace --no-depscargo test --workspace：741 passed，4 ignored，0 failed新增回归覆盖超大双流输出、超长/跳过行、跨缓冲区 UTF-8、超时/取消后代清理，以及代理环境隔离。