retoor
9a8046ab2a
- Add `cmd_isslop_prune`, `cmd_isslop_clear`, `cmd_isslop_analyze` CLI commands for AI usage analysis job management - Register `/game` router with `index` and `farm` endpoints for Code Farm idle game - Add `politics` to allowed TOPICS constant replacing `signals` - Introduce `ISSLOP_DIR`, `ISSLOP_WORKSPACES_DIR`, `ISSLOP_RUNS_DIR`, `ISSLOP_MEDIA_DIR` config paths - Add `clear_user_stars` and `clear_user_projects_cache` calls on vote and project create/delete - Update `make prod` to use `nproc` workers via `DEVPLACE_WEB_WORKERS` env var - Convert `database.py` and `utils.py` to packages for modular structure - Add `devplace apikey` and `devplace token` CLI subcommands for API key and access token management
84 lines
4.6 KiB
HTML
84 lines
4.6 KiB
HTML
<div class="docs-content" data-render>
|
|
# Security and limits
|
|
|
|
The controls that keep Devii safe and bounded. See also [Data and persistence](/docs/devii-data.html) and [Configuration and CLI](/docs/devii-config.html).
|
|
|
|
## Per-account memory isolation
|
|
|
|
The self-learning lesson store is **owner-scoped and never shared**. Each session gets a
|
|
`LessonStore` filtered by `(owner_kind, owner_id)` - the main DB for signed-in users, a private
|
|
in-memory DB for guests. One account can never recall another account's lessons. The user purges
|
|
their own memory with the `forget_lessons` tool (clear all, or only lessons matching a query). The
|
|
system prompt forbids storing credentials, passwords, API keys, or secrets in a lesson.
|
|
|
|
## Spending limits
|
|
|
|
Spend is capped per owner over a rolling 24 hours, read from `devii_usage_ledger` (the authoritative
|
|
source). The admin-configurable caps are `devii_user_daily_usd`, `devii_guest_daily_usd`, and
|
|
`devii_admin_daily_usd` (default `0` = unlimited, so administrators are exempt by default). The cap
|
|
is checked before each turn; a turn already over the limit is refused. The spend from scheduled-task
|
|
runs and from cancelled or interrupted turns is recorded to the ledger and counted against the cap,
|
|
not forgiven. Pricing is configurable (`devii_price_*`) and applied per turn.
|
|
|
|
## JavaScript execution toggle
|
|
|
|
The `client` handler can run JavaScript in the user's own browser (`run_js`) for live tutorials and
|
|
demos. This is gated by the `devii_allow_eval` config field (default on); when off, `run_js` is
|
|
refused while the other client tools (navigate, reload, highlight, toast, context) still work.
|
|
|
|
## Admin-only analytics
|
|
|
|
Site-wide analytics is a documented, admin-secured HTTP endpoint - `GET /admin/analytics` (returns
|
|
JSON, 403 for non-admins; see the [Admin API](/docs/admin.html)). Devii reaches it through the normal
|
|
`site_analytics` catalog tool, so the platform enforces admin access; the agent never queries the
|
|
database directly for it.
|
|
|
|
## Primary-administrator-only database tools
|
|
|
|
The read-only database tools (`db_list_tables`, `db_table_schema`, `db_list_rows`, `db_get_row`,
|
|
`db_query`, `db_design_query`) carry `requires_primary_admin=True`, so they are offered only to the
|
|
**primary administrator** (the oldest Admin account). Their schema is withheld from every other
|
|
session and the dispatcher independently refuses them, so a member, a guest, or a junior admin never
|
|
sees them and Devii is unaware they exist. They are strictly read-only (SELECT-validated) and never
|
|
write to the database.
|
|
|
|
## Web fetch
|
|
|
|
`fetch_url` sends realistic browser headers, reduces pages to text, caps size, and refuses private,
|
|
loopback, and link-local addresses (an SSRF guard) unless explicitly allowed, limiting the blast
|
|
radius of a prompt-injected page. `http_request` (arbitrary external API calls) and `attach_url`
|
|
(storing a remote file as an attachment) share the same SSRF guard and size cap, so neither can be
|
|
forged into a request against internal addresses. `attach_url` runs the downloaded bytes through the
|
|
normal upload validation (allowed types, size limit) before storing them.
|
|
|
|
## Email
|
|
|
|
The `email_*` tools are restricted to signed-in users (never guests) and gated by
|
|
`devii_email_enabled`. Each IMAP/SMTP host is resolved and checked against the same SSRF guard
|
|
(private, loopback, link-local addresses refused) before any connection, so a saved account cannot
|
|
be pointed at an internal service to probe the network. Credentials live per owner in
|
|
`email_accounts`, scoped to `(owner_kind, owner_id)` like every other Devii store; a tool never
|
|
returns the stored password (it reports only whether one is set). Sending mail (`email_send`) is a
|
|
real outbound action the system prompt tells Devii to confirm with the user first, and deleting a
|
|
message (`email_delete_message`) or removing a saved account (`email_account_delete`) is
|
|
confirmation-gated by the dispatcher.
|
|
|
|
## Confidentiality
|
|
|
|
The system prompt instructs Devii never to disclose the underlying AI model, provider, inference
|
|
endpoint, or any backend URL or infrastructure detail, even when such values appear inside a tool
|
|
result, and to omit the model name when reporting cost.
|
|
|
|
## Audit trail
|
|
|
|
Every turn is recorded in `devii_turns` (owner, username, timestamps, truncated prompt and reply,
|
|
iterations, tool-call count, cost, and any error), giving administrators a complete account-scoped
|
|
history.
|
|
|
|
## Account scope
|
|
|
|
A signed-in user's Devii operates that user's **own** account via the platform API with their API
|
|
key, so it has exactly the permissions that user has (admins included). It cannot exceed the
|
|
account's authority; the platform enforces every action.
|
|
</div>
|