From a5399bd69db170aaf83d64252535f50445b0ca19 Mon Sep 17 00:00:00 2001 From: Your Name Date: Sat, 25 Jul 2026 14:23:04 +0800 Subject: [PATCH] =?UTF-8?q?chore:=20=E7=A7=BB=E9=99=A4=E4=B8=8D=E5=AD=98?= =?UTF-8?q?=E5=9C=A8=E7=9A=84=20etcdutl=20=E5=91=BD=E4=BB=A4=E5=8F=8A?= =?UTF-8?q?=E5=85=B6=E7=9B=B8=E5=85=B3=E9=80=BB=E8=BE=91=E5=92=8C=E6=B5=8B?= =?UTF-8?q?=E8=AF=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- backend/agent_tools.py | 21 +-------------------- tests/test_agent_tools.py | 9 ++------- 2 files changed, 3 insertions(+), 27 deletions(-) diff --git a/backend/agent_tools.py b/backend/agent_tools.py index b8fd9bc..e3259b0 100644 --- a/backend/agent_tools.py +++ b/backend/agent_tools.py @@ -137,7 +137,7 @@ SHELL_READ_ONLY_COMMANDS: dict[str, set[str] | None] = { "lspci": None, "lsusb": None, "dmidecode": None, "sysctl": None, "udevadm": None, } -# etcdctl / etcdutl 由 classify_shell_command 中的专用块处理 (两段式命令) +# etcdctl 由 classify_shell_command 中的专用块处理 (两段式命令) # 从通用白名单中移除，避免被单段式逻辑误判 # etcdctl 单段式只读 verb @@ -162,11 +162,6 @@ _ETCDCTL_WRITE_SUBVERBS = { "user": {"add", "delete", "grant-role", "revoke-role", "passwd"}, "role": {"add", "delete", "grant-permission", "revoke-permission"}, } -# etcdutl snapshot 只读子命令 -_ETCDUTL_SNAPSHOT_READ = {"status", "hash"} -# etcdutl snapshot 写子命令 (需人工审批) -_ETCDUTL_SNAPSHOT_WRITE = {"restore", "make"} - # 系统修改命令白名单：需要人工审批 SHELL_WRITE_COMMANDS: dict[str, set[str] | None] = { "systemctl": {"restart", "start", "stop", "reload", "enable", "disable", "daemon-reload"}, @@ -238,20 +233,6 @@ def classify_shell_command(command: str) -> CommandDecision: raise ValueError(f"etcdctl {ev} 不支持子命令: {esub}") raise ValueError(f"etcdctl 不支持该子命令: {ev}") - if binary == "etcdutl": - non_flags = [a for a in parts[1:] if not a.startswith("-")] - ev = non_flags[0].lower() if non_flags else None - esub = non_flags[1].lower() if len(non_flags) > 1 else None - if ev == "snapshot": - if esub in _ETCDUTL_SNAPSHOT_READ: - return CommandDecision("read", False, ev, parts[1:]) - if esub in _ETCDUTL_SNAPSHOT_WRITE: - return CommandDecision("write", True, ev, parts[1:]) - raise ValueError(f"etcdutl snapshot 不支持子命令: {esub}") - if ev == "version": - return CommandDecision("read", False, ev, parts[1:]) - raise ValueError(f"etcdutl 不支持该子命令: {ev}") - if binary in SHELL_READ_ONLY_COMMANDS: allowed = SHELL_READ_ONLY_COMMANDS[binary] if allowed is not None and (verb is None or verb not in allowed): diff --git a/tests/test_agent_tools.py b/tests/test_agent_tools.py index 7ad4b76..02d6b3a 100644 --- a/tests/test_agent_tools.py +++ b/tests/test_agent_tools.py @@ -127,8 +127,8 @@ class EtcdCommandPolicyTest(unittest.TestCase): self.assertEqual(decision.mode, "read") self.assertFalse(decision.requires_approval) - def test_etcdutl_snapshot_status_is_read_only(self): - decision = classify_shell_command("etcdutl snapshot status /tmp/etcd.db") + def test_etcdctl_alarm_list_is_read_only(self): + decision = classify_shell_command("etcdctl alarm list") self.assertEqual(decision.mode, "read") self.assertFalse(decision.requires_approval) @@ -157,11 +157,6 @@ class EtcdCommandPolicyTest(unittest.TestCase): self.assertEqual(decision.mode, "write") self.assertTrue(decision.requires_approval) - def test_etcdutl_snapshot_restore_requires_approval(self): - decision = classify_shell_command("etcdutl snapshot restore /tmp/etcd.db") - self.assertEqual(decision.mode, "write") - self.assertTrue(decision.requires_approval) - def test_etcdctl_rejects_unknown_subcommand(self): with self.assertRaises(ValueError): classify_shell_command("etcdctl bogus command")