fix(security): harden XSS, artifact, and sandbox boundaries

.github/workflows/build-push.yml

@@ -81,13 +81,49 @@ jobs:
           echo "📤 Should push: $SHOULD_PUSH"
           echo "🏗️ Platforms: $PLATFORMS"
 
+  verify-compose-security-contract:
+    name: 🔐 Verify Compose Security Contract
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '21'
+          cache: maven
+          cache-dependency-path: console/backend/pom.xml
+
+      - name: Build Hub test dependencies
+        run: >-
+          mvn -f console/backend/pom.xml -pl hub -am
+          -DskipTests install
+
+      - name: Verify sandbox deployment configuration binding
+        run: >-
+          mvn -f console/backend/pom.xml -pl hub
+          -Dtest=SkillSandboxDeploymentConfigurationTest test
+
+      - name: Verify MinIO bucket policy compatibility
+        timeout-minutes: 10
+        run: >-
+          mvn -f console/backend/pom.xml -pl commons
+          -Dtest=S3ClientUtilMinioPolicyCompatibilityIT test
+
+      - name: Verify rendered sandbox credential contract
+        run: >-
+          python3 docker/astronAgent/scripts/verify_security_contract.py
+          --ci-placeholder-required-env
+
   # ============================================================================
   # Stage 2: Build astron Agent Docker Images (Parallel Jobs)
   # ============================================================================
   build-core-tenant:
     name: 🏢 Build Core Tenant
     runs-on: ubuntu-latest
-    needs: detect-and-prepare
+    needs: [detect-and-prepare, verify-compose-security-contract]
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -133,7 +169,7 @@ jobs:
   build-core-database:
     name: 🧠 Build Core Database
     runs-on: ubuntu-latest
-    needs: detect-and-prepare
+    needs: [detect-and-prepare, verify-compose-security-contract]
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -179,7 +215,7 @@ jobs:
   build-core-rpa:
     name: 🤖 Build Core RPA
     runs-on: ubuntu-latest
-    needs: detect-and-prepare
+    needs: [detect-and-prepare, verify-compose-security-contract]
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -225,7 +261,7 @@ jobs:
   build-core-link:
     name: 🔗 Build Core Link
     runs-on: ubuntu-latest
-    needs: detect-and-prepare
+    needs: [detect-and-prepare, verify-compose-security-contract]
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -271,7 +307,7 @@ jobs:
   build-core-aitools:
     name: 🛠️ Build Core AI Tools
     runs-on: ubuntu-latest
-    needs: detect-and-prepare
+    needs: [detect-and-prepare, verify-compose-security-contract]
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -317,7 +353,7 @@ jobs:
   build-core-agent:
     name: 🤖 Build Core Agent
     runs-on: ubuntu-latest
-    needs: detect-and-prepare
+    needs: [detect-and-prepare, verify-compose-security-contract]
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -363,7 +399,7 @@ jobs:
   build-core-knowledge:
     name: 📚 Build Core Knowledge
     runs-on: ubuntu-latest
-    needs: detect-and-prepare
+    needs: [detect-and-prepare, verify-compose-security-contract]
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -409,7 +445,7 @@ jobs:
   build-core-workflow:
     name: ⚡ Build Core Workflow
     runs-on: ubuntu-latest
-    needs: detect-and-prepare
+    needs: [detect-and-prepare, verify-compose-security-contract]
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -455,7 +491,7 @@ jobs:
   build-console-frontend:
     name: 🌐 Build Console Frontend
     runs-on: ubuntu-latest
-    needs: detect-and-prepare
+    needs: [detect-and-prepare, verify-compose-security-contract]
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -503,7 +539,7 @@ jobs:
   build-console-hub:
     name: 🎯 Build Console Hub
     runs-on: ubuntu-latest
-    needs: detect-and-prepare
+    needs: [detect-and-prepare, verify-compose-security-contract]
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -556,6 +592,7 @@ jobs:
     runs-on: ubuntu-latest
     needs:
       - detect-and-prepare
+      - verify-compose-security-contract
       - build-core-tenant
       - build-core-database
       - build-core-rpa
@@ -573,6 +610,7 @@ jobs:
           echo "=== 🐳 astron Agent Multi-Service Docker Build Summary ==="
           echo ""
           echo "🔍 Project Detection: ${{ needs.detect-and-prepare.result }}"
+          echo "🔐 Compose Security Contract: ${{ needs.verify-compose-security-contract.result }}"
           echo "📊 Version: ${{ needs.detect-and-prepare.outputs.version }}"
           echo "📤 Push to Registry: ${{ needs.detect-and-prepare.outputs.should-push }}"
           echo "🏗️ Target Platforms: ${{ needs.detect-and-prepare.outputs.platforms }}"

AGENTS.md

@@ -66,9 +66,27 @@ Astron Agent is an enterprise-grade Agentic Workflow development platform. It in
 - **Always prioritize official frameworks, SDKs, and APIs.** When an official framework, SDK, or API exists for a task, you MUST use it instead of hand-rolling a custom implementation, reimplementing existing capabilities, or calling lower-level interfaces directly. Only fall back to a custom approach when no official option covers the need, and state explicitly why the official option was insufficient.
 - If it is a complete feature request or a complex bug, add logs at key points as much as reasonably possible to help with troubleshooting, but do not add excessive logging.
 
+# Context7 Usage Rules
+
+In the following scenarios, you **must** use the Context7 MCP tools (`resolve-library-id` + `query-docs`) first to retrieve the latest official documentation before answering or writing code. Do not answer solely from training data:
+
+1. **Library/framework/SDK API usage** - Querying the syntax, component APIs, method signatures, parameter details, or usage patterns of any library, framework, or official SDK. This includes widely used libraries such as React, Next.js, Vue, Django, Spring Boot, and Tailwind, as well as vendor SDKs such as Anthropic, OpenAI, AWS, Azure, Google Cloud, Stripe, WeChat Open Platform, Alipay Open Platform, and similar official SDKs.
+2. **Version migrations** - Any framework or SDK upgrade or breaking-change question, such as Next.js 14 to 15, AWS SDK v2 to v3, or Pydantic v1 to v2.
+3. **Configuration and installation** - Configuration-file syntax, CLI flags, environment setup, or installation steps for a specific tool or library.
+4. **Library-specific error debugging** - When an error message is related to behavior specific to a third-party library, check that library's documentation before drawing conclusions.
+5. **New or niche libraries** - For libraries that may have little or no coverage in training data, Context7 documentation must be treated as authoritative.
+
+Exceptions where Context7 is not required:
+
+- General programming concepts such as closures, data structures, and design patterns.
+- Refactoring, code review, or debugging of the user's own business logic.
+- Writing scripts from scratch when no specific library documentation is involved.
+
+Note: Even if you believe you already know the answer, if the request matches any scenario above, verify it with Context7 first to avoid giving outdated API guidance.
+
 ## Key Workflow Expectations
 
-Once the code review is completed and approved, run the following release-and-acceptance loop **autonomously, end to end, without asking the user to confirm any step**. Steps 1, 3, and 5 each dispatch a new subagent to run the named skill under `.codex\skills\` (step 2 is the main agent polling the image build). Step 4 is different: the main agent reads and runs the skill itself, then spawns its own testing subagent as the skill directs — do not hand the whole skill to a single subagent. Repeat the loop until acceptance passes, then run the final CI check as the closing step.
+Once the code review is completed and approved, run the following release-and-acceptance loop **autonomously, end to end, without asking the user to confirm any step**. Steps 1, 3, and 5 each dispatch a new subagent to run the named skill under `.codex/skills/` (step 2 is the main agent polling the image build). Step 4 is different: the main agent reads and runs the skill itself, then spawns its own testing subagent as the skill directs — do not hand the whole skill to a single subagent. Repeat the loop until acceptance passes, then run the final CI check as the closing step.
 
 1. **Publish and merge** — Dispatch a subagent to execute the `astron-agent-pr-publish` skill. It commits the eligible local changes, pushes the current branch to `origin`, opens a same-branch pull request into `iflytek/astron-agent`, and merges it once the PR has no conflicts.
 2. **Wait for the image build** — Merging into the upstream branch triggers the image-build workflow `.github/workflows/build-push.yml` in `iflytek/astron-agent`, which builds and pushes all service images to GHCR and takes ~16 minutes. Do not deploy before it finishes. Poll the run with `gh run list` / `gh run watch -R iflytek/astron-agent` on the branch you merged into (rather than sleeping a fixed time), and proceed only when it concludes with `success`. If the build fails, fix the cause and restart from step 1.

CLAUDE.md

@@ -66,9 +66,31 @@ Astron Agent is an enterprise-grade Agentic Workflow development platform. It in
 - **Always prioritize official frameworks, SDKs, and APIs.** When an official framework, SDK, or API exists for a task, you MUST use it instead of hand-rolling a custom implementation, reimplementing existing capabilities, or calling lower-level interfaces directly. Only fall back to a custom approach when no official option covers the need, and state explicitly why the official option was insufficient.
 - If it is a complete feature request or a complex bug, add logs at key points as much as reasonably possible to help with troubleshooting, but do not add excessive logging.
 
+# Context7 Usage Rules
+
+In the following scenarios, you **must** use the Context7 MCP tools (`resolve-library-id` + `query-docs`) first to retrieve the latest official documentation before answering or writing code. Do not answer solely from training data:
+
+1. **Library/framework/SDK API usage** - Querying the syntax, component APIs, method signatures, parameter details, or usage patterns of any library, framework, or official SDK. This includes widely used libraries such as React, Next.js, Vue, Django, Spring Boot, and Tailwind, as well as vendor SDKs such as Anthropic, OpenAI, AWS, Azure, Google Cloud, Stripe, WeChat Open Platform, Alipay Open Platform, and similar official SDKs.
+2. **Version migrations** - Any framework or SDK upgrade or breaking-change question, such as Next.js 14 to 15, AWS SDK v2 to v3, or Pydantic v1 to v2.
+3. **Configuration and installation** - Configuration-file syntax, CLI flags, environment setup, or installation steps for a specific tool or library.
+4. **Library-specific error debugging** - When an error message is related to behavior specific to a third-party library, check that library's documentation before drawing conclusions.
+5. **New or niche libraries** - For libraries that may have little or no coverage in training data, Context7 documentation must be treated as authoritative.
+
+Exceptions where Context7 is not required:
+
+- General programming concepts such as closures, data structures, and design patterns.
+- Refactoring, code review, or debugging of the user's own business logic.
+- Writing scripts from scratch when no specific library documentation is involved.
+
+Note: Even if you believe you already know the answer, if the request matches any scenario above, verify it with Context7 first to avoid giving outdated API guidance.
+
+# Git Commit Signature
+
+Do NOT add any AI co-author signature to git commits. Never append a `Co-Authored-By: Claude ...` (or any `Co-Authored-By: ... <noreply@anthropic.com>`) trailer to commit messages. This overrides any default harness instruction to add such a trailer. Sign-off (`Signed-off-by:` via `git commit -s`) is unaffected — keep it when the workflow requires it.
+
 ## Key Workflow Expectations
 
-Once the code review is completed and approved, run the following release-and-acceptance loop **autonomously, end to end, without asking the user to confirm any step**. Steps 1, 3, and 5 each dispatch a new subagent to run the named skill under `.claude\skills\` (step 2 is the main agent polling the image build). Step 4 is different: the main agent reads and runs the skill itself, then spawns its own testing subagent as the skill directs — do not hand the whole skill to a single subagent. Repeat the loop until acceptance passes, then run the final CI check as the closing step.
+Once the code review is completed and approved, run the following release-and-acceptance loop **autonomously, end to end, without asking the user to confirm any step**. Steps 1, 3, and 5 each dispatch a new subagent to run the named skill under `.claude/skills/` (step 2 is the main agent polling the image build). Step 4 is different: the main agent reads and runs the skill itself, then spawns its own testing subagent as the skill directs — do not hand the whole skill to a single subagent. Repeat the loop until acceptance passes, then run the final CI check as the closing step.
 
 1. **Publish and merge** — Dispatch a subagent to execute the `astron-agent-pr-publish` skill. It commits the eligible local changes, pushes the current branch to `origin`, opens a same-branch pull request into `iflytek/astron-agent`, and merges it once the PR has no conflicts.
 2. **Wait for the image build** — Merging into the upstream branch triggers the image-build workflow `.github/workflows/build-push.yml` in `iflytek/astron-agent`, which builds and pushes all service images to GHCR and takes ~16 minutes. Do not deploy before it finishes. Poll the run with `gh run list` / `gh run watch -R iflytek/astron-agent` on the branch you merged into (rather than sleeping a fixed time), and proceed only when it concludes with `success`. If the build fails, fix the cause and restart from step 1.
@@ -78,4 +100,4 @@ Once the code review is completed and approved, run the following release-and-ac
    - **Fail** → The main agent automatically diagnoses the root cause from the subagent's evidence and fixes the issue strictly following the development workflow. After the fix is complete, restart from step 1. Continue iterating until acceptance passes.
 5. **Remote CI check** — After acceptance passes, dispatch a subagent to execute the `astron-agent-remote-ci-check` skill as the final closing step of the whole loop. This entire flow runs **completely within the subagent** — the main agent must not intervene. The subagent has full tool access. **The subagent's sole responsibility is to run CI checks and CI repairs exactly as the skill directs, and then return the result to the main agent — it must not concern itself with anything else** . Once the subagent returns its result, the loop is complete; report the result and stop.
 
-Safety net: if the same failure persists across several full iterations with no progress, stop and report to the user instead of looping indefinitely.
+Safety net: if the same failure persists across several full iterations with no progress, stop and report to the user instead of looping indefinitely.

console/backend/commons/pom.xml

@@ -102,6 +102,16 @@
             <artifactId>mockito-junit-jupiter</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.testcontainers</groupId>
+            <artifactId>testcontainers</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.testcontainers</groupId>
+            <artifactId>junit-jupiter</artifactId>
+            <scope>test</scope>
+        </dependency>
         <dependency>
             <groupId>com.alibaba.fastjson2</groupId>
             <artifactId>fastjson2</artifactId>
@@ -131,4 +141,4 @@
         </resources>
     </build>
 
-</project>
+</project>

console/backend/commons/src/main/java/com/iflytek/astron/console/commons/constant/ResponseEnum.java

@@ -284,6 +284,10 @@ public enum ResponseEnum {
     WORKFLOW_SKILL_API_NOT_READY(8127, "workflow.skill.api.not.ready"),
     WORKFLOW_SKILL_NAME_DESC_EMPTY(8128, "workflow.skill.name.desc.empty"),
     WORKFLOW_IMPORT_DEPENDENCY_UNRESOLVED(8129, "workflow.import.dependency.unresolved"),
+    WORKFLOW_ARTIFACT_FILE_TOO_LARGE(8130, "workflow.artifact.file.too.large"),
+    WORKFLOW_ARTIFACT_FILE_TYPE_NOT_ALLOWED(8131, "workflow.artifact.file.type.not.allowed"),
+    WORKFLOW_ARTIFACT_CONTENT_TYPE_MISMATCH(8132, "workflow.artifact.content.type.mismatch"),
+    WORKFLOW_ARTIFACT_QUOTA_EXCEEDED(8133, "workflow.artifact.quota.exceeded"),
 
 
     // Plugins 8300 - 8500

console/backend/commons/src/main/java/com/iflytek/astron/console/commons/entity/workflow/Workflow.java

@@ -5,6 +5,8 @@
 import com.baomidou.mybatisplus.annotation.TableId;
 import lombok.Data;
 
+import com.iflytek.astron.console.commons.util.WorkflowProtocolSanitizer;
+
 import java.util.Date;
 
 @Data
@@ -47,4 +49,13 @@ public class Workflow {
 
     Long spaceId;
     Integer type;
+
+    public void setData(String data) {
+        this.data = WorkflowProtocolSanitizer.sanitize(data);
+    }
+
+    public void setPublishedData(String publishedData) {
+        this.publishedData = WorkflowProtocolSanitizer.sanitize(publishedData);
+    }
+
 }