mirror of
https://github.com/hanzoai/chat.git
synced 2026-09-30 20:51:17 +00:00
zeekay
9539f5a380
execute_code no longer POSTs /v1/exec behind a shared service key. It leases a Hanzo sandbox (cloud /v1/sandboxes) with the CALLER's own hanzo.id bearer, runs the program there, and reports what it printed and what it wrote. The session IS the sandbox. `session_id` is the sandbox id, the artifact directory is its workdir, an expired session is a lease the reaper ended. There is no session table here because there is no second object to keep in sync. Why the key had to be deleted rather than fixed ----------------------------------------------- A shared service key IS custom auth, and it is also why that surface could not bill: it carries no tenant, so cloud could not tell whose org a run belonged to — apps/exec's own header says so. With the user's bearer the run lands on the account that ran it, because the account is the only thing the call carries. It was never even wired: `EnvVar.CODE_API_KEY` does not exist in the shipped @hanzochat/agents, so `authFields: [undefined]` at every call site and setting the env var was a silent no-op. Deleted at all ~20 sites, plus the guard in loadAuthValues that existed only to survive the `undefined`, plus the client's key-entry path in the tool-auth contract (`fieldsMap[execute_code]` is now `[]` and verifyToolAuth never consults the credential store for it). What the tool does now ---------------------- One round trip. The program rides the exec channel's stdin, so the source is never quoted into a command line. Its stdout/stderr are redirected to files, so the command's own stdout carries only four framed lines — exit code, then base64 of out, err and the new-file list. That is unforgeable by construction: a delimiter would let a program that printed the delimiter name files it never wrote. Scratch lives in /tmp, never in /mnt/data, so the artifact scan cannot mistake this tool's own source for a user's output. The language menu is measured against the sandbox image rather than inherited: `d`, `f90` and `r` are dropped (no compiler), `rb` added, `ts` runs on bun. Files in and out ride the same three verbs: upload is POST /:id/fs, download is GET /:id/fs, and "is this session still alive?" is GET /:id — one question where there used to be a `lastModified` fetch and a 23-hour freshness rule that only together approximated it. PTC is declared and not executable: it is a different protocol (it suspends the run and resumes from a continuation token) and cloud answers it 501, so offering a tool that fails mid-run is worse than not offering one. De-branding: user-facing prose first, wire second. The `LIBRECHAT_TEST_RUN_HOOK` env var and the `@librechat/*` requires are renamed because BOTH ends live in this repo. The `application/vnd.librechat.*` artifact MIMEs are NOT renamed — they are identifiers on the wire, no user reads them, and a rename needs a migration story it would not buy anything. NOTICE and LICENSE are untouched.