boos
3bb1272c6d
validate_path_within_cwd used exists() to decide whether a path was new. exists() follows symlinks, so a *dangling* symlink (target missing) reported false and fell into the not-yet-existing branch, which only bound-checked the nearest existing ancestor — never the symlink itself. An approved `ln -s /etc/cron.d/pwn evil` inside the sandbox would therefore pass validation, and a subsequent Write to `evil` would follow the link and create a file outside the sandbox. In AcceptEdits mode this chained cleanly: approve one innocuous-looking symlink (Execute), then writes auto-allow. Resolve every path component with lstat (symlink_metadata, which does not follow links) instead of exists(): - Final component: if it is a symlink (dangling or live), resolve its real target via read_link + canonicalize-nearest-ancestor and reject unless the target stays within the sandbox. - Ancestor walk: an intermediate dangling symlink directory is likewise resolved and bound-checked rather than skipped. Live symlinks were already caught by canonicalize; this closes the dangling case. It does not close the check-vs-open TOCTOU (the open happens inside the SDK tool and would need O_NOFOLLOW/openat2 there); tracked for phase 2 along with OS-level bash isolation. Covered by tests/agent_sandbox.rs (dangling symlink to absolute and relative targets, write tool through a dangling link, write through an intermediate dangling symlink dir, all rejected; dangling link pointing inside and ordinary new files still allowed) plus mirrored in-crate unit tests.
BoosAPI
AI Aggregation Gateway + Workflow Studio — one endpoint for many AI relay stations
Aggregate New API / One API / OneHub / DoneHub / Veloera / AnyRouter / Sub2API stations
into one API key and one compatible endpoint, with model discovery, smart routing, logs, billing, and failover.
Workflow Studio embeds the ComfyUI frontend and can run against Comfy Cloud, RunningHub, your own ComfyUI, or BoosAPI's API-native executor.
中文 | English | Deployment
Introduction
BoosAPI is a self-hosted Rust gateway for AI relay stations. It centralizes upstream sites, accounts, downstream API keys, model routes, usage logs, image/video generation, user dashboards, and Workflow Studio in one service.
Supported upstreams:
- Relay panels: New API, One API, OneHub, DoneHub, Veloera, AnyRouter, Sub2API
- Compatible APIs: OpenAI / Claude / Gemini compatible, cliproxyapi / CPA
- Preset providers: Aliyun, Zhipu, Doubao Coding Plan, DeepSeek, Moonshot, MiniMax, ModelScope
- OAuth connections: Codex, Claude, Gemini CLI, Antigravity
Key Features
Unified API Gateway
- OpenAI-compatible
/v1/chat/completions,/v1/responses,/v1/images/generations,/v1/models, and files endpoints - Claude-compatible
/v1/messages, including request/response and streaming event conversion - Smart token routing, channel cooldown, failover, model discovery, and usage accounting
- Admin and user dashboards with API key management and model visibility controls
Workflow Studio
Workflow Studio uses an embedded ComfyUI frontend. The execution backend is selected by comfyui.backend:
| backend | Purpose |
|---|---|
cloud |
Proxy Comfy Cloud API for cloud execution and subscription models |
runninghub |
Proxy RunningHub's ComfyUI-compatible API for its plugins, models, and workflows |
external |
Proxy a full ComfyUI instance you deploy yourself |
boosapi |
Use BoosAPI's Rust API-native workflow executor and configured model routes |
docker |
Local full ComfyUI mode for GPU machines and local model directories |
Cloud, RunningHub, external API, and BoosAPI executor modes do not require a GPU on the BoosAPI server. A GPU is only needed when you run local ComfyUI inference on the same machine.
Assistants
- Video / workflow assistant with Markdown chat, reasoning sections, attachments, and model route selection
- Picture assistant using
/v1/images/generations, background tasks, progress display, cancellation, and Workspace archive - Volcengine video task templates for create-task and query-task flows
Hardware Guide
| Mode | CPU | Memory | Disk | GPU |
|---|---|---|---|---|
Gateway, admin UI, /v1/* proxy only |
2 cores minimum, 4 recommended | 2GB minimum, 4GB recommended | 10GB+ | Not required |
| BoosAPI + Workflow UI + remote APIs / Comfy Cloud / RunningHub | 4 cores recommended | 4GB minimum, 8GB recommended | 20-50GB | Not required |
| External ComfyUI proxy | 4 cores recommended | 8GB recommended | 50GB+ | Not on BoosAPI; required by the ComfyUI machine as needed |
| Local Docker / local ComfyUI image generation | 4-8 cores | 16GB+ | 100GB+ | NVIDIA 8GB VRAM minimum, 12GB+ recommended |
| Local video / digital human / large workflows | 8 cores+ | 32GB minimum, 64GB recommended | 200GB-1TB | NVIDIA 24GB VRAM minimum, 48GB+ recommended |
Recommended SaaS gateway server:
4 CPU cores
8GB RAM
50GB SSD
No GPU required
Quick Start
cp config.toml.example config.toml
./build-and-run.sh
For a production bundle with embedded web assets:
./build-and-run.sh --production
The production output is intended to run with only:
boosapi
config.toml
Web assets and Workflow UI assets are embedded in the Rust binary when built for production.
Workflow Backend Configuration
Comfy Cloud:
[comfyui]
backend = "cloud"
base_url = "https://cloud.comfy.org"
api_key = "your-comfy-cloud-api-key"
RunningHub:
[comfyui]
backend = "runninghub"
base_url = "https://www.runninghub.cn/your-comfy-compatible-endpoint"
api_key = "your-runninghub-api-key"
External ComfyUI:
[comfyui]
backend = "external"
base_url = "http://127.0.0.1:8188"
BoosAPI API-native executor:
[comfyui]
backend = "boosapi"
Environment Variables
Configuration can be overridden with BOOSAPI_<SECTION>__<KEY>:
BOOSAPI_SERVER__HOST=0.0.0.0
BOOSAPI_SERVER__PORT=4000
BOOSAPI_AUTH__AUTH_TOKEN=your-admin-token
BOOSAPI_AUTH__PROXY_TOKEN=sk-your-proxy-token
BOOSAPI_AUTH__JWT_SECRET=your-jwt-secret
BOOSAPI_DB__URL=sqlite:data/boosapi.db?mode=rwc
Tech Stack
| Layer | Tech |
|---|---|
| Backend | Rust, Axum 0.8, Tokio |
| Database | SQLx, SQLite runtime path, PostgreSQL schema/migration preparation |
| Proxy engine | Token Router + Proxy Conductor |
| Protocols | OpenAI / Claude / Gemini compatible transformers |
| Frontend | React 19 + Vite |
| Workflow UI | Embedded ComfyUI frontend variants for cloud/external-compatible backends |
| Static serving | Rust binary serves dist/web and Workflow UI assets |
| Container | Docker / Docker Compose |
Node.js is only a build-time tool for the frontend. Production does not require a Node.js process.
Local Development
cargo check
cargo run
pnpm install
pnpm run dev:web
Build checks:
cargo check
pnpm run typecheck:web
npx vite build