feat: add role-based Local computer permissions

[Soulter]

Summary

• replace the implicit Local behavior behind computer_use_require_admin with an explicit role-based permission matrix for members and administrators
• configure three independent Local permissions: code execution, execution-environment network access, and access to files outside the workspace
• enforce the resolved role policy consistently across Shell, Python, file tools, managed shell sessions, and the local-file message bridge
• isolate any restricted execution on Linux with bubblewrap or on macOS with Seatbelt; unsupported platforms fail closed instead of falling back to unrestricted execution
• keep computer_use_require_admin for remote Sandbox runtimes only, with its existing semantics and a Sandbox-only dashboard control
• migrate legacy configurations automatically: the old switch determines member execution, while member network and filesystem access remain restricted

Default Local policy

Role	Execute code	Execution network	Files outside workspace
Member	No	No	No
Administrator	Yes	Yes	Yes

The dashboard presents these permissions as a full-width Unix-style matrix directly below the Local runtime selector. Network access is disabled when execution is disabled, and elevated member access produces a visible warning.

The stored configuration remains explicit and forward-compatible:

computer_use_local_permissions:
  member:
    allow_execution: false
    allow_network: false
    filesystem_scope: workspace
  admin:
    allow_execution: true
    allow_network: true
    filesystem_scope: host

Runtime behavior

• allow_execution=false denies new Shell and Python execution for that role.
• allow_network=false isolates the process network namespace/profile.
• filesystem_scope=workspace limits Shell, Python, read, write, edit, grep, and local file sending to approved workspace, Skill, and temporary roots.
• any restricted execution uses the OS sandbox and retains CPU, process, file, descriptor, wall-time, and output limits.
• a fully trusted policy (allow_network=true and filesystem_scope=host) preserves direct Local execution.
• Windows currently supports execution only when disabled or fully trusted; restricted combinations fail closed and the dashboard explains this limitation explicitly. Use remote Sandbox when granular Windows isolation is required.

Linux requires bwrap and functional unprivileged user namespaces for restricted policies. macOS requires /usr/bin/sandbox-exec. Apple marks sandbox-exec as deprecated, so this implementation remains isolated behind the Local permission boundary and covered by integration tests.

Validation

• uv run ruff format .
• uv run ruff check .
• focused permission, config, filesystem, message, shell, and Python tests: 183 passed, 1 skipped
• main test suite excluding one host-plugin-sensitive cache module: 2073 passed, 1 skipped
• the excluded cache module under a clean ASTRBOT_ROOT: 3 passed
• pnpm exec vue-tsc --noEmit
• pnpm exec vite build
• macOS Seatbelt integration: host filesystem without network and workspace filesystem with network both enforced independently
• Linux bubblewrap command coverage: workspace/host filesystem and isolated/shared network combinations are generated independently

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	astrbot-docs	2871b34	Commit Preview URL Branch Preview URL	Sep 15 2026, 07:39 AM

[sourcery-ai]

Sorry @RC-CHN, your pull request is larger than the review limit of 150,000 diff characters

[w31r4]

@RC-CHN 冲突解一下

[w31r4]

勉强采用的方案, 隔离不充分不彻底, 凑合的 Beta 版本