- Change the ContainerIPCSocket path from "/tmp/yao.sock" to "/run/yao.sock" to align with system conventions for IPC sockets.
This change improves the configuration's compatibility with standard practices for inter-process communication.
- Add support for increasing the shared memory size (/dev/shm) for Chrome rendering in VNC images, setting it to a quarter of MaxMemory with a minimum of 256MB.
- This change addresses Chrome renderer/GPU process crashes by ensuring adequate memory allocation for namespace-based process isolation.
- Clean up the `guard.go` file by removing the `isAPIKey` and `getAccessTokenFromAPIKey` methods, which are no longer needed.
- Add comments to clarify the purpose of the API key authentication block, ensuring it remains intact for future implementation.
- This change streamlines the access token retrieval process and improves code clarity.
- Modify the expected API URL in the `TestBuildProxyConfig` to include the `/v1` prefix for consistency with the updated URL building logic.
- Remove unnecessary `modified` flags in the `prepareAttachments` method to streamline attachment processing and ensure clarity in the codebase.
This change enhances the accuracy of tests and improves the maintainability of the attachment handling logic.
- Introduce a whitelist mapping for `package.yao` sandbox arguments to corresponding Claude CLI flags, allowing selective argument passing.
- Update `BuildCommandWithContinuation` to iterate over the whitelist and append valid arguments to the Claude CLI command.
This change enhances the flexibility of argument handling in the Claude CLI, ensuring only specified arguments are processed.
- Update `buildAPIURL` function in OpenAI provider to delegate URL construction to `connector.BuildAPIURL`, ensuring consistent URL formatting across the agent LLM and sandbox proxy paths.
- Modify backend URL construction in Claude's `BuildProxyConfig` to utilize the shared `connector.BuildAPIURL` helper, applying the necessary `/v1` prefix for compatibility.
This change enhances code maintainability and consistency in API URL handling across different components.
- Introduce functionality to resolve and manage user-uploaded files in the sandbox environment.
- Implement `prepareAttachments` method to convert attachment URLs to local file paths and handle duplicates.
- Update message processing to replace attachment content with text references, allowing Claude CLI to access files using Read and Bash tools.
- Enhance documentation to inform users about the new attachment handling capabilities.
This change improves the interaction with user-uploaded files, enabling better integration within the Claude CLI environment.
- Add `resolveTeamConfigENV` function to process and replace environment variables in team configuration settings, including robot email domains, whitelist entries, and invite configuration.
- Enhance `loadTeamConfigs` to call the new function, ensuring that team configurations are properly resolved before storage.
This change improves the flexibility of team configurations by allowing dynamic environment variable substitution.
- Introduce `YaoAuthSource` and `OAuthEmail` fields in various structures to capture authentication source and OAuth email during user login and registration processes.
- Update `SignIDToken`, `GetInfo`, and `Map` functions to include new claims for Yao authentication source.
- Modify login context to preserve authentication source and OAuth email across different user flows.
- Enhance token issuance to include authentication source and OAuth email in claims for better tracking and user context.
- Ensure proper handling of OAuth email for third-party logins without affecting user profile email.
This change improves the user experience by providing clearer context on authentication methods used during login and registration processes.
- Introduce a new function `registerUserWithTeam` that handles user registration and default team creation with rollback on failure.
- Update `GinEntryRegister` and `LoginThirdParty` functions to utilize the new registration method, ensuring consistency in user and team creation.
- Remove redundant error handling for user provider retrieval in `GinEntryRegister`.
- Enhance logging for user registration and team creation failures.
- Modify .env file paths for AFTER_LOGIN_SUCCESS_URL and AFTER_LOGIN_FAILURE_URL to point to the release mode (dashboard) instead of the development mode (__yao_admin_root).
- Ensure backup files are removed after the changes to maintain a clean environment.
- Include additional skill markdown files and references for SUI and Yao agent development.
- Add new brand assets for Discord, Twitter, and Yao agents in the default template.
- Update index and layout files with new modification timestamps for consistency.
- Introduce a new VNC scope configuration for sandbox environments.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Ensure the existence of $HOME/.Xauthority for PyAutoGUI/Xlib compatibility.
- Adjust PYTHONPATH to maintain access to user-installed Python packages.
- Explicitly set XAUTHORITY to the correct path for X11 authentication.
- Pass secrets as environment variables for Claude CLI to ensure proper access.
- Refactor VNC image support check to utilize a centralized keyword list for better maintainability.
- Introduce a new Chrome image for the sandbox, enabling VNC access with real Chrome and CDP support (amd64 only).
- Update README to reflect the addition of the Chrome image and its build instructions.
- Modify build script to include a dedicated build process for the Chrome image.
- Enhance .gitignore to exclude the new Chrome plan file.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Fix ListDir to support BusyBox/Alpine ls by falling back from GNU
--time-style format, resolving CI test failures
- Update parseLS to handle both GNU (epoch) and BusyBox (date string) formats
- Fix claude-proxy streaming: always include usage in message_delta events
to prevent Claude CLI from falling back to non-streaming mode
- Fix claude-proxy non-streaming: ensure usage is always present in responses
- Add paragraph separators between text blocks in Claude executor stream parser
- Translate VNC proxy UI from Chinese to English
- Rename sandbox-claude-playwright to sandbox-claude-browser across
Dockerfiles, build scripts, and documentation
Co-authored-by: Cursor <cursoragent@cursor.com>
- Implement GetSandboxID method to return a mock sandbox ID for testing.
- Add GetVNCUrl method to return an empty string for VNC access in tests.
- Update SandboxExecutor interface to include new methods for sandbox identification and VNC URL retrieval.
- Enhance context creation to set sandbox ID and VNC URL properties in the sandbox instance.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Add passwordless sudo for sandbox user in playwright and desktop images
- Configure Yao branding for Fluxbox (CUI dark theme, centered logo)
- Configure Yao branding for XFCE (panel icons, wallpaper, workspace shortcut)
- Add D-Bus support for XFCE desktop environment
- Add dynamic wallpaper generation with configurable resolution and logo size
- Hide Fluxbox toolbar for cleaner Playwright automation view
- Create chromium wrapper script using Playwright's bundled browser
- Add feh and imagemagick for wallpaper management in Fluxbox
- Update .gitignore for config scripts and TODO file
Co-authored-by: Cursor <cursoragent@cursor.com>
- Add VNC-enabled Docker images (playwright, desktop) with Xvfb, x11vnc, noVNC
- Implement VNC proxy service for WebSocket-based VNC access
- Add API endpoints: /sandbox/{id}/vnc, /vnc/client, /vnc/ws
- Support dynamic VNC port mapping for Docker Desktop (macOS/Windows)
- Add YAO_SANDBOX_VNC_PORT_MAPPING config option for local development
- Update build.sh to support building VNC images
- Include design document and updated README
Co-authored-by: Cursor <cursoragent@cursor.com>
- Add SecureCookie field to EntryConfig struct for frontend access
- Add GetCookieName helper to response package for dynamic cookie names
- Update guard.go to use GetCookieName instead of hardcoded __Host- prefix
- Pass secure_cookie setting to /user/entry API response
Co-authored-by: Cursor <cursoragent@cursor.com>
- Add SecureCookie field to TempSecurityConfig and SecurityConfig for better cookie security management.
- Implement SetSecureCookieEnabled and IsSecureCookieEnabled functions to manage secure cookie settings globally.
- Update response handling to utilize secure cookie settings, ensuring compliance with security best practices.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Update start command to check if the current directory is a Yao app root or a subdirectory, providing clearer error messages for users.
- Modify installation logic to handle empty directories more effectively, ensuring the init app is installed only when appropriate.
- Improve welcome message formatting and update links for documentation and community resources.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Add prod builds (stripped) and prod-upx builds (compressed) for Linux
- Add prod builds (stripped) for macOS (UPX not supported)
- Add docker/production-slim for slim images using prod-upx binaries
- Update build-docker.yml to build slim variants
- Update build-macos.yml to sign and notarize all 4 variants
- Add BUILDOPTIONS constant to show build flags in version output
- Add make release-all target for building both dev and prod locally
Linux artifacts: 6 variants (dev, prod, prod-upx for amd64/arm64)
macOS artifacts: 4 variants (dev, prod for amd64/arm64)
Docker images: 6 variants (dev, prod, prod-slim for amd64/arm64)
Co-authored-by: Cursor <cursoragent@cursor.com>
- Update Makefile to include new production and UPX build targets for optimized binaries.
- Add BUILDOPTIONS constant to share/const.go for tracking build configurations.
- Modify version command to display build options.
- Update Dockerfile to install UPX for compression during builds.
- Add release and prod targets to streamline artifact creation.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Replace the existing NanoID generation in generateContextID with UUID for improved uniqueness.
- Update RequestID method to return the context ID directly instead of generating a new NanoID.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Refactor BuildCommand to support session continuation using --continue flag.
- Introduce BuildCommandWithContinuation to handle both initial and continuation requests.
- Add BuildLastUserMessageJSONL for generating JSONL from the last user message in continuation scenarios.
- Enhance Executor to check for existing sessions and adjust command building accordingly.
- Update environment setup to ensure session data is stored correctly for persistence.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Update ReadFile method to read directly from the host's bind-mounted workspace instead of using Docker's CopyFromContainer, enhancing performance.
- Introduce containerPathToHost method to convert container paths to host paths, ensuring proper access to bind-mounted directories.
- Simplify idle container cleanup logic by storing the idle time in a variable for better readability.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Implement secure config file location (/tmp/.yao/proxy.json) instead of user-visible /workspace/
- Add generic options map support for backend-specific parameters (e.g., thinking for Volcengine GLM-4.7)
- Add secrets support for passing sensitive env vars (e.g., GITHUB_TOKEN) to sandbox container
- Remove excessive debug logs, keep critical ones with log.Printf("[Sandbox]...")
- Fix test assertions for system prompt passing via CLI args instead of env var
- Update i18n messages for sandbox loading states
Co-authored-by: Cursor <cursoragent@cursor.com>
- Send ChunkMessageStart before ChunkText in parseStream
- This initializes stream state (inGroup=true) required for Buffer.AddAssistantMessage
- Only send ChunkMessageEnd if message was started
Co-authored-by: Cursor <cursoragent@cursor.com>
- Fix Claude CLI output parsing: only extract content from final
assistant message (with stop_reason) to avoid duplicate content
- Remove trailing "..." from sandbox loading message
Co-authored-by: Cursor <cursoragent@cursor.com>
- Fix missing SystemPrompt field in sandbox executor options conversion
(was causing Claude CLI to be skipped even when prompts were configured)
- Rewrite parseStream to handle Claude CLI stream-json output format:
- system: initialization message
- assistant: message with content array (text, tool_use)
- result: final result with verification string
- Add comprehensive E2E tests via caller for sandbox integration:
- TestSandboxE2E_ClaudeCLIExecution: verify command execution
- TestSandboxE2E_FileCreation: verify file operations
- TestSandboxE2E_HookOnlyMode: verify Claude CLI skip logic
- TestSandboxE2E_StreamingResponse: verify streaming works
- Add real_e2e_test.go for direct Claude CLI execution testing
Co-authored-by: Cursor <cursoragent@cursor.com>
- Update TestClaudeCommandBuilding to expect new command format
- Rename TestClaudeCCRConfigBuilding to TestClaudeProxyConfigBuilding
- Update assertions for claude-proxy env vars instead of CCR
- Apply gofmt formatting to proxy/types.go
Co-authored-by: Cursor <cursoragent@cursor.com>
- Add --input-format stream-json, --output-format stream-json, --verbose flags
- Use heredoc to pass messages via stdin (no CLI length limit)
- Add BuildInputJSONL function for message conversion
- Add shouldSkipClaudeCLI logic to skip when no prompts/skills/mcp
- Update executor to conditionally start claude-proxy only when needed
- Add SystemPrompt field to Options for skip logic
- Add E2E tests for skip mode and command building
- Fix tests to reflect new command structure
Co-authored-by: Cursor <cursoragent@cursor.com>
- Add claude-proxy: lightweight Go proxy to translate between Anthropic
and OpenAI-compatible APIs with full streaming and tool-calling support
- Update Dockerfile to include claude-proxy binary (multi-arch)
- Add auto-start proxy via entrypoint when env vars are set
- Update executor.go to write proxy config and start proxy
- Simplify command.go to use direct Claude CLI with proxy
- Support both docker run -e and config file for proxy settings
Co-authored-by: Cursor <cursoragent@cursor.com>
- Adjusted assertions in the command test to verify the updated command structure, which now begins with "bash" and includes specific flags for executing CCR commands.
- Enhanced the test to ensure the user prompt is correctly included in the command, improving the accuracy of the test verification.
