fix(dashboard): allow shell to bypass lease check like screenshot

Dashboard is an administrative interface; both shell and screenshot
should be usable on any sandbox regardless of current lease holder.

- run_shell: pass require_lease=False to get_observer_booter_by_id
- Update test to verify admin shell access bypasses session ownership

Author: zouyonghe

astrbot/dashboard/routes/sandbox.py

@@ -160,8 +160,10 @@ async def run_shell(self, sandbox_id: str):
             command = str(data.get("command") or "").strip()
             if not command:
                 return jsonify(Response().error("command is required").__dict__)
+            # Dashboard shell access is an administrative operation; it does
+            # not need a lease so admins can operate any sandbox at any time.
             booter = await computer_client.sandbox_manager.get_observer_booter_by_id(
-                sandbox_id, self._session_id()
+                sandbox_id, self._session_id(), require_lease=False
             )
             shell = getattr(booter, "shell", None)
             if shell is None:

tests/test_dashboard.py

@@ -520,15 +520,25 @@ async def available():
 
 
 @pytest.mark.asyncio
-async def test_sandbox_dashboard_shell_respects_session_ownership(
+async def test_sandbox_dashboard_shell_bypasses_lease_for_admin_access(
     app: Quart,
     authenticated_header: dict,
     monkeypatch: pytest.MonkeyPatch,
 ):
+    """Dashboard shell is an administrative operation and must bypass lease."""
     from astrbot.core.computer import computer_client
     from astrbot.core.computer.sandbox_manager import SandboxManager
     from astrbot.core.computer.sandbox_registry import SandboxRegistry
 
+    class FakeShell:
+        async def exec(self, command, cwd=None, env=None, timeout=300, shell=True):
+            return {
+                "command": command,
+                "stdout": "ok\n",
+                "stderr": "",
+                "exit_code": 0,
+            }
+
     async def available():
         return True
 
@@ -551,7 +561,9 @@ async def available():
         lease_expires_at=9999999999,
         connect_info={"name": "Sandbox 1"},
     )
-    manager.session_booter["sandbox-1"] = SimpleNamespace(available=available)
+    manager.session_booter["sandbox-1"] = SimpleNamespace(
+        available=available, shell=FakeShell()
+    )
 
     test_client = app.test_client()
     response = await test_client.post(
@@ -562,8 +574,8 @@ async def available():
     data = await response.get_json()
 
     assert response.status_code == 200
-    assert data["status"] == "error"
-    assert "controlled by another session" in data["message"]
+    assert data["status"] == "ok"
+    assert data["data"]["result"]["stdout"] == "ok\n"
 
 
 @pytest.mark.asyncio