fix: fs tools

Author: Soulter

astrbot/core/tools/computer_tools/fs.py

@@ -12,9 +12,11 @@
   access depends on the local runtime implementation and host OS permissions.
   Upload and download tools are defined here, but `LocalBooter` does not
   implement them and the main agent does not expose them in local mode.
-- Member + local: read/write/edit/grep are restricted to `data/skills`,
-  `data/workspaces/{normalized_umo}`, and `/tmp/.astrbot`. Upload/download are
-  denied by `check_admin_permission` if invoked.
+- Member + local: read/grep are restricted to `data/skills`,
+  plugin-provided `data/plugins/*/skills`,
+  `data/workspaces/{normalized_umo}`, and `/tmp/.astrbot`; write/edit are
+  restricted to the same local roots except plugin-provided Skills, which are
+  read-only. Upload/download are denied by `check_admin_permission` if invoked.
 - Admin + sandbox: read/write/edit/grep are not path-restricted by this
   module;
   sandbox filesystem boundaries are enforced by the sandbox runtime. Upload and
@@ -45,6 +47,7 @@
 from astrbot.core.computer.file_read_utils import read_file_tool_result
 from astrbot.core.message.components import File, Image
 from astrbot.core.utils.astrbot_path import (
+    get_astrbot_plugin_path,
     get_astrbot_skills_path,
     get_astrbot_system_tmp_path,
     get_astrbot_temp_path,
@@ -67,15 +70,22 @@
 _IMAGE_FILE_SUFFIXES = {".bmp", ".gif", ".jpeg", ".jpg", ".png", ".webp"}
 
 
-def _restricted_env_path_labels(umo: str) -> list[str]:
+def _restricted_env_path_labels(umo: str, *, include_plugin_skills: bool) -> list[str]:
     """Labels for the allowed directories in a local(not sandbox) and restricted(not admin) environment"""
     normalized_umo = normalize_umo_for_workspace(umo)
-    return [
+    labels = [
         "data/skills",
-        f"data/workspaces/{normalized_umo}",
-        get_astrbot_system_tmp_path(),
-        get_astrbot_temp_path(),
     ]
+    if include_plugin_skills:
+        labels.append("data/plugins/*/skills")
+    labels.extend(
+        [
+            f"data/workspaces/{normalized_umo}",
+            get_astrbot_system_tmp_path(),
+            get_astrbot_temp_path(),
+        ]
+    )
+    return labels
 
 
 def get_astrbot_workspaces_path() -> str:
@@ -89,8 +99,30 @@ def _workspace_root(umo: str) -> Path:
     return (Path(get_astrbot_workspaces_path()) / normalized_umo).resolve(strict=False)
 
 
+def _plugin_skill_roots() -> tuple[Path, ...]:
+    plugins_root = Path(get_astrbot_plugin_path())
+    if not plugins_root.exists():
+        return ()
+    return tuple(
+        (plugin_dir / "skills").resolve(strict=False)
+        for plugin_dir in plugins_root.iterdir()
+        if plugin_dir.is_dir() and (plugin_dir / "skills").is_dir()
+    )
+
+
 def _read_allowed_roots(umo: str) -> tuple[Path, ...]:
     """Non-admin users can only read files within these directories (and their subdirectories)"""
+    return (
+        Path(get_astrbot_skills_path()).resolve(strict=False),
+        *_plugin_skill_roots(),
+        _workspace_root(umo),
+        Path(get_astrbot_system_tmp_path()).resolve(strict=False),
+        Path(get_astrbot_temp_path()).resolve(strict=False),
+    )
+
+
+def _write_allowed_roots(umo: str) -> tuple[Path, ...]:
+    """Non-admin users cannot modify plugin-provided Skills."""
     return (
         Path(get_astrbot_skills_path()).resolve(strict=False),
         _workspace_root(umo),
@@ -131,11 +163,16 @@ def _resolve_user_path(path: str, *, local_env: bool, umo: str) -> Path:
     return (Path.cwd() / candidate).resolve(strict=False)
 
 
-def _is_path_within_allowed_roots(path: str, umo: str) -> bool:
+def _is_path_within_allowed_roots(
+    path: str,
+    *,
+    umo: str,
+    allowed_roots: tuple[Path, ...],
+) -> bool:
     resolved = _resolve_user_path(path, local_env=True, umo=umo)
     return any(
         resolved == allowed_root or resolved.is_relative_to(allowed_root)
-        for allowed_root in _read_allowed_roots(umo)
+        for allowed_root in allowed_roots
     )
 
 
@@ -145,14 +182,24 @@ def _normalize_rw_path(
     restricted: bool,
     local_env: bool,
     umo: str,
+    write: bool = False,
 ) -> str:
     normalized_path = _resolve_tool_path(path, local_env=local_env, umo=umo)
     if not normalized_path:
         raise ValueError("`path` must be a non-empty string.")
-    if restricted and not _is_path_within_allowed_roots(normalized_path, umo):
-        allowed = ", ".join(_restricted_env_path_labels(umo))
+    if restricted:
+        allowed_roots = _write_allowed_roots(umo) if write else _read_allowed_roots(umo)
+    if restricted and not _is_path_within_allowed_roots(
+        normalized_path,
+        umo=umo,
+        allowed_roots=allowed_roots,
+    ):
+        allowed = ", ".join(
+            _restricted_env_path_labels(umo, include_plugin_skills=not write)
+        )
+        access = "Write" if write else "Read"
         raise PermissionError(
-            "Read access is restricted for this user. "
+            f"{access} access is restricted for this user. "
             f"Allowed directories: {allowed}. Blocked path: {normalized_path}."
         )
     return normalized_path
@@ -290,6 +337,7 @@ async def call(
                     restricted=restricted,
                     local_env=local_env,
                     umo=context.context.event.unified_msg_origin,
+                    write=True,
                 )
                 if local_env
                 else path.strip()
@@ -368,6 +416,7 @@ async def call(
                     restricted=restricted,
                     local_env=local_env,
                     umo=umo,
+                    write=True,
                 )
                 if local_env
                 else path.strip()
@@ -532,10 +581,16 @@ def _normalize_search_paths(
             disallowed = [
                 path
                 for path in normalized
-                if not _is_path_within_allowed_roots(path, umo)
+                if not _is_path_within_allowed_roots(
+                    path,
+                    umo=umo,
+                    allowed_roots=_read_allowed_roots(umo),
+                )
             ]
             if disallowed:
-                allowed = ", ".join(_restricted_env_path_labels(umo))
+                allowed = ", ".join(
+                    _restricted_env_path_labels(umo, include_plugin_skills=True)
+                )
                 blocked = ", ".join(disallowed)
                 raise PermissionError(
                     "Read access is restricted for this user. "

docs/en/use/computer.md

@@ -76,11 +76,12 @@ When enabled:
 
 - Admin users can use Shell, Python, file read, file write, file edit, and Grep search in `local` mode.
 - Non-admin users cannot use Shell or Python.
-- Non-admin users can only use file read, write, edit, and search inside restricted directories.
+- Non-admin users can only use file read, write, edit, and search inside restricted directories. Plugin-provided Skills are read/search-only and cannot be written or edited.
 
 Allowed directories for non-admin users in `local` mode include:
 
 - `data/skills`
+- `data/plugins/*/skills` (read-only, for plugin-provided Skills)
 - Current session's `data/workspaces/{normalized_umo}`
 - AstrBot temporary directories
 - `.astrbot` under the system temporary directory

docs/zh/use/computer.md

@@ -74,11 +74,12 @@ data/workspaces/{normalized_umo}/notes/todo.txt
 
 - 管理员可以使用 `local` 模式下的 Shell、Python、文件读取、文件写入、文件编辑和 Grep 搜索。
 - 非管理员不能使用 Shell 和 Python。
-- 非管理员只能在受限目录内使用文件读取、写入、编辑和搜索。
+- 非管理员只能在受限目录内使用文件读取、写入、编辑和搜索。插件内置 Skills 只允许读取和搜索，不允许写入或编辑。
 
 非管理员在 `local` 模式下允许访问的目录包括：
 
 - `data/skills`
+- `data/plugins/*/skills`（只读，用于插件内置 Skills）
 - 当前会话的 `data/workspaces/{normalized_umo}`
 - AstrBot 的临时目录
 - 系统临时目录中的 `.astrbot`

tests/test_computer_fs_tools.py

@@ -49,9 +49,11 @@ def _setup_local_fs_tools(
 ) -> Any:
     workspaces_root = tmp_path / "workspaces"
     skills_root = tmp_path / "skills"
+    plugins_root = tmp_path / "plugins"
     temp_root = tmp_path / "temp"
     workspaces_root.mkdir()
     skills_root.mkdir()
+    plugins_root.mkdir()
     temp_root.mkdir()
 
     monkeypatch.setattr(
@@ -64,6 +66,11 @@ def _setup_local_fs_tools(
         "get_astrbot_skills_path",
         lambda: str(skills_root),
     )
+    monkeypatch.setattr(
+        fs_tools,
+        "get_astrbot_plugin_path",
+        lambda: str(plugins_root),
+    )
     monkeypatch.setattr(
         fs_tools,
         "get_astrbot_temp_path",
@@ -123,7 +130,9 @@ def _make_epub_bytes(*, chapter_count: int = 1) -> bytes:
                 'media-type="application/xhtml+xml"/>'
             )
             spine_items.append(f'<itemref idref="chapter{index}"/>')
-            nav_links.append(f'<li><a href="chapter{index}.xhtml">Chapter {index}</a></li>')
+            nav_links.append(
+                f'<li><a href="chapter{index}.xhtml">Chapter {index}</a></li>'
+            )
             archive.writestr(
                 f"OEBPS/chapter{index}.xhtml",
                 f"""<?xml version="1.0" encoding="utf-8"?>
@@ -181,6 +190,59 @@ def _make_epub_bytes(*, chapter_count: int = 1) -> bytes:
     return buffer.getvalue()
 
 
+@pytest.mark.asyncio
+async def test_restricted_local_member_can_read_plugin_provided_skill(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path,
+):
+    _setup_local_fs_tools(monkeypatch, tmp_path)
+    plugin_skill = (
+        tmp_path
+        / "plugins"
+        / "astrbot_plugin_demo"
+        / "skills"
+        / "demo-skill"
+        / "SKILL.md"
+    )
+    plugin_skill.parent.mkdir(parents=True)
+    plugin_skill.write_text("# Demo Skill\n\nRead plugin docs.", encoding="utf-8")
+
+    result = await fs_tools.FileReadTool().call(
+        _make_context(role="member"),
+        path=str(plugin_skill),
+    )
+
+    assert result == "# Demo Skill\n\nRead plugin docs."
+
+
+@pytest.mark.asyncio
+async def test_restricted_local_member_cannot_write_plugin_provided_skill(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path,
+):
+    _setup_local_fs_tools(monkeypatch, tmp_path)
+    plugin_skill = (
+        tmp_path
+        / "plugins"
+        / "astrbot_plugin_demo"
+        / "skills"
+        / "demo-skill"
+        / "SKILL.md"
+    )
+    plugin_skill.parent.mkdir(parents=True)
+    plugin_skill.write_text("# Demo Skill\n", encoding="utf-8")
+
+    result = await fs_tools.FileWriteTool().call(
+        _make_context(role="member"),
+        path=str(plugin_skill),
+        content="# Changed\n",
+    )
+
+    assert "Write access is restricted for this user." in result
+    assert "data/plugins/*/skills" not in result
+    assert plugin_skill.read_text(encoding="utf-8") == "# Demo Skill\n"
+
+
 def test_detect_text_encoding_allows_utf8_probe_cut_mid_character():
     sample = '{"results": ["中文内容"]}'.encode()[:-1]