yumoqing
b399663863
1. tool_sources.py(新): global/org/pipeline/role/project 五级工具作用域解析
- 策略表 pipeline_tool_policies allow/deny(配套 models+CRUD json)
- capability 两层语义: 映射手册(all/概念技能,含global层) + 声明注入
(仅org/pipeline/role/project/user层)——防 generic 会话经 global 概念
技能拿到~70个产线工具,击穿七层隔离(单测 29/29 含此回归)
- role 白名单是过滤器非添加器,且作用于 base+capability 全集
2. agent_config: GENERAL_TOOLS 加 patch_file(定点替换,唯一性校验);
write_file 描述引导改文件优先用 patch_file
3. upload_tools: is_image + build_image_parts(OpenAI多模态data URL,
8MB/张+4张/条上限,超限显式告知不静默丢)
4. agent_chat/agent_chat_generic: 图片分流不进文本上下文,
image_paths 传 gateway
5. load_path: 策略管理页注册
48 lines
1.5 KiB
Python
48 lines
1.5 KiB
Python
#!/usr/bin/env python3
|
||
"""RBAC path registration for pipeline_core module.
|
||
|
||
2026-08-28：产线管理三功能（产线定义/产线步骤/发布记录）已移除，
|
||
对应的 pipelines / pipeline_steps / pipeline_versions / pipeline_editor
|
||
CRUD 页面与 API 全部删除，注册清单同步清理。
|
||
"""
|
||
import os, sys, subprocess
|
||
|
||
MOD = "pipeline_core"
|
||
|
||
PATHS_LOGINED = [
|
||
f"/{MOD}",
|
||
# 工具作用域策略管理页（2026-09-10，五级作用域工具解析的 allow/deny 配置）
|
||
f"/{MOD}/pipeline_tool_policies/*",
|
||
]
|
||
|
||
|
||
def main():
|
||
# app root: 本脚本位于 <app>/pkgs/<mod>/scripts/，上溯三级即 app 根
|
||
script_dir = os.path.dirname(os.path.abspath(__file__))
|
||
candidates = [
|
||
os.path.dirname(os.path.dirname(os.path.dirname(script_dir))),
|
||
os.path.expanduser("~/pipeline"),
|
||
]
|
||
root = None
|
||
for c in candidates:
|
||
if os.path.isfile(os.path.join(c, "set_role_perm.py")):
|
||
root = c
|
||
break
|
||
if not root:
|
||
print("ERROR: pipeline root not found (set_role_perm.py missing)")
|
||
sys.exit(1)
|
||
set_perm = os.path.join(root, "set_role_perm.py")
|
||
py = sys.executable
|
||
count = 0
|
||
for path in PATHS_LOGINED:
|
||
r = subprocess.run([py, set_perm, "logined", path], capture_output=True, text=True, cwd=root)
|
||
if r.returncode == 0:
|
||
count += 1
|
||
else:
|
||
print(f" WARN: {path} -> {r.stderr.strip()[-80:]}")
|
||
print(f"Registered {count}/{len(PATHS_LOGINED)} paths for {MOD}")
|
||
|
||
|
||
if __name__ == "__main__":
|
||
main()
|