d000f33928
* Fix potential memory DoS via unbounded container output Add CONTAINER_MAX_OUTPUT_SIZE (default 10MB) to limit accumulated stdout/stderr from container processes. Without this limit, a malicious or buggy container could emit huge output leading to host memory exhaustion. Changes: - Add configurable CONTAINER_MAX_OUTPUT_SIZE in config.ts - Implement size-limited output buffering in runContainerAgent - Log warnings when truncation occurs - Include truncation status in container logs https://claude.ai/code/session_01TjVDwwaGwbcFDdmrFF2y8B * Update package-lock.json https://claude.ai/code/session_01TjVDwwaGwbcFDdmrFF2y8B --------- Co-authored-by: Claude <noreply@anthropic.com>
32 lines
1.4 KiB
TypeScript
32 lines
1.4 KiB
TypeScript
import path from 'path';
|
|
|
|
export const ASSISTANT_NAME = process.env.ASSISTANT_NAME || 'Andy';
|
|
export const POLL_INTERVAL = 2000;
|
|
export const SCHEDULER_POLL_INTERVAL = 60000;
|
|
|
|
// Absolute paths needed for container mounts
|
|
const PROJECT_ROOT = process.cwd();
|
|
const HOME_DIR = process.env.HOME || '/Users/user';
|
|
|
|
// Mount security: allowlist stored OUTSIDE project root, never mounted into containers
|
|
export const MOUNT_ALLOWLIST_PATH = path.join(HOME_DIR, '.config', 'nanoclaw', 'mount-allowlist.json');
|
|
export const STORE_DIR = path.resolve(PROJECT_ROOT, 'store');
|
|
export const GROUPS_DIR = path.resolve(PROJECT_ROOT, 'groups');
|
|
export const DATA_DIR = path.resolve(PROJECT_ROOT, 'data');
|
|
export const MAIN_GROUP_FOLDER = 'main';
|
|
|
|
export const CONTAINER_IMAGE = process.env.CONTAINER_IMAGE || 'nanoclaw-agent:latest';
|
|
export const CONTAINER_TIMEOUT = parseInt(process.env.CONTAINER_TIMEOUT || '300000', 10);
|
|
export const CONTAINER_MAX_OUTPUT_SIZE = parseInt(process.env.CONTAINER_MAX_OUTPUT_SIZE || '10485760', 10); // 10MB default
|
|
export const IPC_POLL_INTERVAL = 1000;
|
|
|
|
function escapeRegex(str: string): string {
|
|
return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
|
|
}
|
|
|
|
export const TRIGGER_PATTERN = new RegExp(`^@${escapeRegex(ASSISTANT_NAME)}\\b`, 'i');
|
|
|
|
// Timezone for scheduled tasks (cron expressions, etc.)
|
|
// Uses system timezone by default
|
|
export const TIMEZONE = process.env.TZ || Intl.DateTimeFormat().resolvedOptions().timeZone;
|