chore(merge): sync master into dev/4.11.x

src/langbot/pkg/plugin/agent_runner_actions.py

@@ -8,6 +8,7 @@ import time
 
 from langbot_plugin.runtime.io import handler
 
+from ..api.http.context import ExecutionContext
 
 from ..agent.runner.run_ledger_store import TERMINAL_STATUSES
 
@@ -217,7 +218,14 @@ def register(h):
             return handler.ActionResponse.success(data={'items': []})
 
         try:
+            action_context = h._require_runtime_action_context()
+            execution_context = ExecutionContext(
+                instance_uuid=action_context.instance_uuid,
+                workspace_uuid=action_context.workspace_uuid,
+                placement_generation=action_context.placement_generation,
+            )
             runners = await registry.list_runners(
+                execution_context,
                 bound_plugins=[str(item) for item in include_plugins] if include_plugins else None,
                 use_cache=bool(data.get('use_cache', True)),
             )

src/langbot/pkg/plugin/archive.py

@@ -0,0 +1,98 @@
+from __future__ import annotations
+
+import io
+import zipfile
+
+import yaml
+
+
+_PLUGIN_ARCHIVE_MAX_ENTRIES = 512
+_PLUGIN_ARCHIVE_MAX_ENTRY_BYTES = 16 * 1024 * 1024
+_PLUGIN_ARCHIVE_MAX_TOTAL_BYTES = 64 * 1024 * 1024
+_PLUGIN_ARCHIVE_MAX_COMPRESSION_RATIO = 100
+_PLUGIN_METADATA_MAX_BYTES = 1024 * 1024
+_PLUGIN_REQUIREMENTS_MAX_ENTRIES = 1000
+
+
+def _read_plugin_archive_member(
+    archive: zipfile.ZipFile,
+    member: zipfile.ZipInfo,
+    *,
+    max_bytes: int = _PLUGIN_METADATA_MAX_BYTES,
+) -> bytes:
+    if member.file_size > max_bytes:
+        raise ValueError(f'Plugin metadata file exceeds the {max_bytes}-byte limit: {member.filename}')
+    with archive.open(member, 'r') as source:
+        content = source.read(max_bytes + 1)
+    if len(content) > max_bytes or len(content) != member.file_size:
+        raise ValueError(f'Plugin metadata file has an invalid size: {member.filename}')
+    return content
+
+
+def inspect_plugin_archive_metadata(
+    file_bytes: bytes,
+    *,
+    require_manifest: bool = True,
+) -> tuple[dict, list[str], list[str]]:
+    """Validate archive size metadata and read only bounded preview fields."""
+
+    with zipfile.ZipFile(io.BytesIO(file_bytes)) as archive:
+        members = archive.infolist()
+        if len(members) > _PLUGIN_ARCHIVE_MAX_ENTRIES:
+            raise ValueError('Plugin archive contains too many entries')
+
+        total_uncompressed = 0
+        files: dict[str, zipfile.ZipInfo] = {}
+        names: list[str] = []
+        for member in members:
+            if member.is_dir():
+                continue
+            if member.flag_bits & 0x1:
+                raise ValueError('Encrypted plugin archives are not supported')
+            if member.file_size > _PLUGIN_ARCHIVE_MAX_ENTRY_BYTES:
+                raise ValueError(f'Plugin archive entry exceeds the size limit: {member.filename}')
+            if (
+                member.file_size
+                and member.file_size > max(member.compress_size, 1) * _PLUGIN_ARCHIVE_MAX_COMPRESSION_RATIO
+            ):
+                raise ValueError(f'Plugin archive entry exceeds the compression-ratio limit: {member.filename}')
+            total_uncompressed += member.file_size
+            if total_uncompressed > _PLUGIN_ARCHIVE_MAX_TOTAL_BYTES:
+                raise ValueError('Plugin archive exceeds the uncompressed size limit')
+            normalized = member.filename.replace('\\', '/').strip('/')
+            names.append(member.filename)
+            files.setdefault(normalized.lower(), member)
+
+        manifest_member = files.get('manifest.yaml') or files.get('manifest.yml')
+        if manifest_member is None:
+            if require_manifest:
+                raise ValueError('manifest.yaml is required')
+            manifest = {}
+        else:
+            manifest = yaml.safe_load(_read_plugin_archive_member(archive, manifest_member).decode('utf-8')) or {}
+        if not isinstance(manifest, dict):
+            raise ValueError('Plugin manifest must be an object')
+
+        requirements: list[str] = []
+        requirements_member = next(
+            (
+                member
+                for normalized, member in files.items()
+                if normalized == 'requirements.txt' or normalized.endswith('/requirements.txt')
+            ),
+            None,
+        )
+        if requirements_member is not None:
+            content = _read_plugin_archive_member(
+                archive,
+                requirements_member,
+            ).decode(
+                'utf-8',
+                errors='ignore',
+            )
+            requirements = [
+                line.strip()[:1000]
+                for line in content.splitlines()
+                if line.strip() and not line.strip().startswith('#')
+            ][:_PLUGIN_REQUIREMENTS_MAX_ENTRIES]
+        return manifest, requirements, names

src/langbot/pkg/plugin/github.py

@@ -0,0 +1,97 @@
+from __future__ import annotations
+
+import re
+from typing import Any
+from urllib.parse import unquote, urlparse
+
+
+_GITHUB_OWNER_PATTERN = re.compile(r'^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$')
+_GITHUB_REPO_PATTERN = re.compile(r'^[A-Za-z0-9._-]{1,100}$')
+
+
+def _positive_github_id(value: object, field_name: str) -> int:
+    if isinstance(value, bool):
+        raise ValueError(f'{field_name} must be a positive GitHub identifier')
+    try:
+        identifier = int(value)
+    except (TypeError, ValueError) as exc:
+        raise ValueError(f'{field_name} must be a positive GitHub identifier') from exc
+    if identifier <= 0 or str(value).strip() != str(identifier):
+        raise ValueError(f'{field_name} must be a positive GitHub identifier')
+    return identifier
+
+
+def validate_github_release_asset_url(
+    asset_url: object,
+    *,
+    owner: str,
+    repo: str,
+    release_tag: str,
+) -> str:
+    """Accept only a GitHub browser release URL tied to the requested release."""
+
+    normalized_url = str(asset_url or '').strip()
+    parsed = urlparse(normalized_url)
+    try:
+        port = parsed.port
+    except ValueError as exc:
+        raise ValueError('asset_url has an invalid port') from exc
+    if (
+        parsed.scheme != 'https'
+        or (parsed.hostname or '').lower() != 'github.com'
+        or parsed.username is not None
+        or parsed.password is not None
+        or port not in {None, 443}
+        or parsed.fragment
+    ):
+        raise ValueError('asset_url must be an HTTPS GitHub release asset URL')
+    decoded_path = unquote(parsed.path)
+    expected_prefix = f'/{owner}/{repo}/releases/download/{release_tag}/'
+    if not decoded_path.casefold().startswith(
+        f'/{owner}/{repo}/releases/download/'.casefold()
+    ) or not decoded_path.startswith(expected_prefix):
+        raise ValueError('asset_url does not match the requested GitHub release')
+    if decoded_path == expected_prefix or decoded_path.endswith('/'):
+        raise ValueError('asset_url must identify a GitHub release asset')
+    return normalized_url
+
+
+def validate_github_plugin_install_info(install_info: dict[str, Any]) -> dict[str, Any]:
+    """Normalize a GitHub install request without trusting a tenant-provided URL."""
+
+    owner = str(install_info.get('owner') or '').strip()
+    repo = str(install_info.get('repo') or '').strip()
+    release_tag = str(install_info.get('release_tag') or '').strip()
+    if _GITHUB_OWNER_PATTERN.fullmatch(owner) is None:
+        raise ValueError('owner must be a valid GitHub repository owner')
+    if _GITHUB_REPO_PATTERN.fullmatch(repo) is None:
+        raise ValueError('repo must be a valid GitHub repository name')
+    if not release_tag or '\x00' in release_tag or len(release_tag) > 255:
+        raise ValueError('release_tag must identify a GitHub release')
+
+    release_id_value = install_info.get('release_id')
+    asset_id_value = install_info.get('asset_id')
+    normalized = dict(install_info)
+    normalized.update(
+        {
+            'owner': owner,
+            'repo': repo,
+            'release_tag': release_tag,
+            'github_url': f'https://github.com/{owner}/{repo}',
+        }
+    )
+    if release_id_value is not None or asset_id_value is not None:
+        if release_id_value is None or asset_id_value is None:
+            raise ValueError('release_id and asset_id must be provided together')
+        normalized['release_id'] = _positive_github_id(release_id_value, 'release_id')
+        normalized['asset_id'] = _positive_github_id(asset_id_value, 'asset_id')
+        normalized.pop('asset_url', None)
+        return normalized
+
+    normalized['asset_url'] = validate_github_release_asset_url(
+        install_info.get('asset_url'),
+        owner=owner,
+        repo=repo,
+        release_tag=release_tag,
+    )
+    return normalized