feat: Auth, sandbox egress, file handling, and bash batch execution#88
Merged
Conversation
- Added AUTH_ENABLED configuration to control API key authentication on user endpoints, with detailed documentation updates. - Introduced a new batch file upload endpoint to support multi-file uploads, preserving subdirectory structures. - Implemented a new PTC server for bash execution, allowing users to run bash code with the same JSON protocol as the Python server. - Updated Dockerfile to include jq for JSON processing in the bash PTC server. - Enhanced existing endpoints and services to accommodate the new features and ensure proper handling of authentication and file management.
- Added configuration options for enabling sandbox network access, allowing sandboxes to reach the internet through an inline allowlist proxy. - Implemented egress proxy and firewall to enforce outbound traffic restrictions, preventing SSRF vulnerabilities. - Updated Docker configurations to support new sandbox features, including persistent skill-deps caching. - Enhanced API with endpoints to inspect and purge the skill-deps cache, facilitating better management of installed dependencies. - Refactored execution services to accommodate network-enabled sandboxes, ensuring proper handling of package installations across multiple languages.
- Enhanced file upload logic to skip extension checks for agent files, allowing skill-priming uploads from the LibreChat host. - Increased the maximum number of files per session from 300 to 1000 to accommodate larger skill bundles and prevent upload errors.
- Added normalization functions for Python and Bash tool names to ensure compatibility with SDK-generated code. - Updated file handling in execution services to support new metadata fields, including `inherited`, `modified_from`, and `entity_id`. - Introduced read-only file handling during uploads, allowing for better management of file permissions in sandbox environments. - Enhanced unit tests to cover new features and ensure robust validation of file and tool name handling.
…essions - Egress proxy tunnel test: use IP literal 127.0.0.1 instead of localhost to avoid IPv6 resolution mismatch in CI - Batch upload mock: add missing is_read_only param to fake_store - Client-replay test: allow inherited file refs in exec response (matches LibreChat CodeExecutor.ts contract) - Bandit B103: suppress intentional 0o1777 chmod on shared skill-deps dir Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
AUTH_ENABLEDtoggle and Basic auth support so the API can run behind trusted proxies without x-api-key headers, while admin endpoints still requireMASTER_API_KEY.ENABLE_SANDBOX_NETWORK) that lets sandboxes reach PyPI, npm, Go modules, and crates.io for skill dependency installs — all other outbound traffic is blocked.ptc_bash_server.pyREPL server for bash/shell tool calls, with corresponding routing in the execution runner.Test plan
pytest tests/unit/(new tests added for egress proxy, orchestrator, bash server, tool name normalization, upload read-only, runner nested paths, request helpers, output processor, exec models)pytest tests/integration/(new auth-enabled/disabled and programmatic API tests)pytest tests/functional/AUTH_ENABLED=falsedisables auth on user endpoints but admin endpoints still requireMASTER_API_KEYhttps://<key>@host)ENABLE_SANDBOX_NETWORK=trueallows pip/npm installs inside sandboxes and blocks non-allowlisted hostsflake8,black --check,mypy,bandit🤖 Generated with Claude Code