@cicctencent/agent-core 0.1.1 → 0.1.4

package/dist/esm/memory/types.d.ts

@@ -0,0 +1,43 @@
+/** 记忆层级 */
+export type MemoryLayer = 'L0' | 'L1' | 'L2' | 'L3';
+/** 记忆条目（与上层 MemoryService 的 MemoryEntry 保持一致，上层负责转换） */
+export interface MemoryEntry {
+    /** 唯一标识（基于 key 生成） */
+    id: string;
+    /** 记忆分类：user_preference / project_knowledge / learned_fact / custom / scene / persona */
+    category: string;
+    /** 记忆键（用于 upsert） */
+    key: string;
+    /** 记忆内容 */
+    content: string;
+    /** 重要程度 1-5，默认 3 */
+    importance: number;
+    /** 创建时间（ISO 字符串） */
+    createdAt: string;
+    /** 最后更新时间（ISO 字符串） */
+    updatedAt: string;
+    /** 记忆层级：L0=原始对话 L1=原子事实 L2=场景块 L3=用户画像，默认 L1 */
+    memoryLayer: MemoryLayer;
+    /** 来源会话 ID（自动提取时记录） */
+    sourceSessionId?: string;
+    /** 提取时间戳（ISO 字符串） */
+    sourceTimestamp?: string;
+    /** L2 场景 ID（归属场景块） */
+    sceneId?: string;
+    /** L3 画像维度（如 coding_style, tool_preference） */
+    personaFacet?: string;
+    /** 来源层级（该条目从哪一层提炼而来） */
+    sourceLayer?: MemoryLayer;
+    /** 来源条目 ID 列表（溯源链） */
+    sourceIds?: string[];
+}
+/**
+ * MemoryServiceLike — 管道调度器所需的 MemoryService 最小接口
+ * 上层（server 侧）的 MemoryService 实现此接口即可接入管道
+ */
+export interface MemoryServiceLike {
+    getKeys(): string[];
+    getAllEntries(layer?: MemoryLayer): MemoryEntry[];
+    save(key: string, content: string, category: string, importance: number, extras?: Partial<Pick<MemoryEntry, 'memoryLayer' | 'sourceSessionId' | 'sourceTimestamp' | 'sceneId' | 'sourceLayer' | 'sourceIds'>>): MemoryEntry;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/esm/memory/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/memory/types.ts"],"names":[],"mappings":"AAIA,WAAW;AACX,MAAM,MAAM,WAAW,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAEpD,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,sBAAsB;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,yFAAyF;IACzF,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,oBAAoB;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,WAAW,EAAE,WAAW,CAAC;IACzB,uBAAuB;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qBAAqB;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sBAAsB;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wBAAwB;IACxB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,sBAAsB;IACtB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,IAAI,MAAM,EAAE,CAAC;IACpB,aAAa,CAAC,KAAK,CAAC,EAAE,WAAW,GAAG,WAAW,EAAE,CAAC;IAClD,IAAI,CACF,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,SAAS,GAAG,aAAa,GAAG,WAAW,CAAC,CAAC,GACnI,WAAW,CAAC;CAChB"}

package/dist/esm/memory/types.js

@@ -0,0 +1,5 @@
+// ============================================================
+// Memory 模块类型定义（独立于上层 MemoryService 实现）
+// ============================================================
+export {};
+//# sourceMappingURL=types.js.map

package/dist/esm/memory/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/memory/types.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,wCAAwC;AACxC,+DAA+D"}

package/dist/esm/middleware/types.d.ts

@@ -0,0 +1,52 @@
+import type { HookContext, HookResult } from '../hooks/types.ts';
+/**
+ * 中间件 before/after 接收的上下文信息
+ * 包含当前迭代的关键状态快照，中间件可读取但不应直接修改
+ */
+export interface MiddlewareContext {
+    /** 会话 ID */
+    sessionId: string;
+    /** 当前迭代轮次 */
+    iteration: number;
+    /** 当前消息列表（只读快照） */
+    messages: ReadonlyArray<{
+        role: string;
+        content: string | null;
+    }>;
+    /** 当前可用工具数量 */
+    toolCount: number;
+}
+/**
+ * 中间件接口 — Hook 系统的结构化增强层
+ *
+ * 与 Hook 共存，提供更清晰的 before/after 生命周期：
+ * - `before` / `after`：在每轮迭代的开始/结束执行
+ * - `onToolBefore` / `onToolAfter`：在工具执行前/后执行（与 before_tool/after_tool Hook 并行）
+ *
+ * 执行顺序：Middleware.before → Hook.on_iteration_start → ... → Hook.before_tool → Middleware.onToolBefore → 工具执行 → Hook.after_tool → Middleware.onToolAfter → ... → Middleware.after
+ */
+export interface Middleware {
+    /** 中间件名称（用于日志和调试） */
+    name: string;
+    /**
+     * 每轮迭代开始前调用
+     * 适合：预检查、上下文注入、状态审计
+     */
+    before?(ctx: MiddlewareContext): Promise<void>;
+    /**
+     * 每轮迭代结束后调用
+     * 适合：后处理、指标收集、日志记录
+     */
+    after?(ctx: MiddlewareContext): Promise<void>;
+    /**
+     * 工具执行前调用（与 before_tool Hook 同层）
+     * 返回值与 Hook 的 before_tool 合并（block/modify 均生效）
+     */
+    onToolBefore?(ctx: HookContext): Promise<HookResult | void>;
+    /**
+     * 工具执行后调用（与 after_tool Hook 同层）
+     * 返回值与 Hook 的 after_tool 合并（inject 均生效）
+     */
+    onToolAfter?(ctx: HookContext): Promise<HookResult | void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/esm/middleware/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/middleware/types.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAIjE;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,YAAY;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,QAAQ,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAClE,eAAe;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,MAAM,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/C;;;OAGG;IACH,KAAK,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9C;;;OAGG;IACH,YAAY,CAAC,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAE5D;;;OAGG;IACH,WAAW,CAAC,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;CAC5D"}

package/dist/esm/middleware/types.js

@@ -0,0 +1,5 @@
+// ============================================================
+// Middleware — 中间件管道类型定义
+// ============================================================
+export {};
+//# sourceMappingURL=types.js.map

package/dist/esm/middleware/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/middleware/types.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,yBAAyB;AACzB,+DAA+D"}

package/dist/esm/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

package/dist/esm/sandbox/types.d.ts

@@ -0,0 +1,59 @@
+import type { SecurityRule } from '../security/types.ts';
+import type { ShellExecutor, FileSystemExecutor } from '../tool/types.ts';
+/** 沙箱配置 */
+export interface SandboxConfig {
+    /** 沙箱根目录（默认 ~/.workagent/sandboxes/{id}） */
+    rootDir: string;
+    /** 允许的文件扩展名（脚本执行用），空 = 不限制 */
+    allowedExtensions?: string[];
+    /** 最大文件大小 (bytes)，默认 10MB */
+    maxFileSize?: number;
+    /** 执行超时 (ms)，默认 30000 */
+    execTimeout?: number;
+    /** 是否启用命令限制（默认 true） */
+    commandRestriction?: boolean;
+}
+/** 默认沙箱配置 */
+export declare const DEFAULT_SANDBOX_CONFIG: Partial<SandboxConfig>;
+/** 脚本语言类型 */
+export type ScriptLanguage = 'python' | 'nodejs' | 'shell';
+/** 沙箱实例接口 */
+export interface Sandbox {
+    readonly id: string;
+    readonly rootDir: string;
+    /** 获取受限的 Shell 执行器 */
+    getShellExecutor(): ShellExecutor;
+    /** 获取受限的文件系统执行器 */
+    getFileSystemExecutor(): FileSystemExecutor;
+    /**
+     * 运行脚本（写入临时文件并执行）
+     * @param language 脚本语言：python / nodejs / shell
+     * @param code     脚本代码
+     * @param timeout  执行超时 (ms)
+     */
+    runScript(language: ScriptLanguage, code: string, timeout?: number): Promise<string>;
+    /** 销毁沙箱（清理临时文件） */
+    destroy(): Promise<void>;
+}
+/** 沙箱管理器接口 */
+export interface SandboxManager {
+    /** 创建沙箱 */
+    create(id: string, config?: Partial<SandboxConfig>): Promise<Sandbox>;
+    /** 获取已创建的沙箱 */
+    get(id: string): Sandbox | undefined;
+    /** 销毁指定沙箱 */
+    destroy(id: string): Promise<void>;
+    /** 销毁所有沙箱 */
+    destroyAll(): Promise<void>;
+}
+/**
+ * 沙箱专用命令黑名单（在 SecurityGuard 基础上扩展）
+ * 这些规则阻止任何试图突破沙箱隔离的操作
+ */
+export declare const SANDBOX_BLOCKED_COMMANDS: SecurityRule[];
+/**
+ * 沙箱允许的环境变量白名单
+ * 只保留脚本运行所需的最小环境变量集合
+ */
+export declare const SANDBOX_SAFE_ENV_KEYS: string[];
+//# sourceMappingURL=types.d.ts.map

package/dist/esm/sandbox/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/sandbox/types.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAI1E,WAAW;AACX,MAAM,WAAW,aAAa;IAC5B,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,8BAA8B;IAC9B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,6BAA6B;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yBAAyB;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wBAAwB;IACxB,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,aAAa;AACb,eAAO,MAAM,sBAAsB,EAAE,OAAO,CAAC,aAAa,CAIzD,CAAC;AAIF,aAAa;AACb,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE3D,aAAa;AACb,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sBAAsB;IACtB,gBAAgB,IAAI,aAAa,CAAC;IAClC,mBAAmB;IACnB,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;;OAKG;IACH,SAAS,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrF,mBAAmB;IACnB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAID,cAAc;AACd,MAAM,WAAW,cAAc;IAC7B,WAAW;IACX,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,eAAe;IACf,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IACrC,aAAa;IACb,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,aAAa;IACb,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAID;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,YAAY,EAyFlD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,EAezC,CAAC"}

package/dist/esm/sandbox/types.js

@@ -0,0 +1,125 @@
+// ============================================================
+// Sandbox — 脚本沙箱类型定义 + 内置安全规则
+// ============================================================
+/** 默认沙箱配置 */
+export const DEFAULT_SANDBOX_CONFIG = {
+    maxFileSize: 10 * 1024 * 1024, // 10MB
+    execTimeout: 30000,
+    commandRestriction: true,
+};
+// ---- 沙箱内置安全规则 ----
+/**
+ * 沙箱专用命令黑名单（在 SecurityGuard 基础上扩展）
+ * 这些规则阻止任何试图突破沙箱隔离的操作
+ */
+export const SANDBOX_BLOCKED_COMMANDS = [
+    // 禁止提权
+    {
+        name: 'sandbox-block-sudo',
+        pattern: /^(sudo|su)\s/,
+        severity: 'blocked',
+        action: 'block',
+        description: 'Sandbox: privilege escalation blocked',
+    },
+    // 禁止修改系统目录
+    {
+        name: 'sandbox-block-system-write',
+        pattern: /\b(write|tee|cp|mv)\s+.*\s+\/(etc|usr|bin|sbin|var|sys|proc)\b/,
+        severity: 'blocked',
+        action: 'block',
+        description: 'Sandbox: system directory write blocked',
+    },
+    // 禁止修改文件权限
+    {
+        name: 'sandbox-block-chmod',
+        pattern: /^(chmod|chown|chgrp)\s/,
+        severity: 'blocked',
+        action: 'block',
+        description: 'Sandbox: permission change blocked',
+    },
+    // 禁止修改防火墙
+    {
+        name: 'sandbox-block-iptables',
+        pattern: /^(iptables|nftables|ufw)\s/,
+        severity: 'blocked',
+        action: 'block',
+        description: 'Sandbox: firewall modification blocked',
+    },
+    // 禁止篡改关键环境变量
+    {
+        name: 'sandbox-block-env-export',
+        pattern: /^(export|setx)\s+(HOME|PATH|SHELL)/i,
+        severity: 'blocked',
+        action: 'block',
+        description: 'Sandbox: critical env modification blocked',
+    },
+    // 禁止挂载
+    {
+        name: 'sandbox-block-mount',
+        pattern: /^(mount|umount)\s/,
+        severity: 'blocked',
+        action: 'block',
+        description: 'Sandbox: mount operation blocked',
+    },
+    // 禁止内核模块操作
+    {
+        name: 'sandbox-block-kernel',
+        pattern: /^(insmod|rmmod|modprobe)\s/,
+        severity: 'blocked',
+        action: 'block',
+        description: 'Sandbox: kernel module operation blocked',
+    },
+    // 禁止全局文件系统搜索（find / 等绝对路径搜索）
+    {
+        name: 'sandbox-block-find-global',
+        pattern: /\bfind\s+\//,
+        severity: 'blocked',
+        action: 'block',
+        description: 'Sandbox: global filesystem search blocked. Use relative paths (find . -name "...") within the sandbox.',
+    },
+    // 禁止 locate 命令（系统级文件索引搜索）
+    {
+        name: 'sandbox-block-locate',
+        pattern: /^(locate|updatedb)\s/,
+        severity: 'blocked',
+        action: 'block',
+        description: 'Sandbox: locate command blocked. Use find with relative paths.',
+    },
+    // 禁止 grep/ripgrep 从绝对路径递归搜索
+    {
+        name: 'sandbox-block-grep-absolute',
+        pattern: /\b(grep|rg|ag)\s+(-[a-zA-Z]*\s+)*.*\s+\/(?!\/)(?:etc|usr|bin|sbin|var|sys|proc|home|opt|lib|tmp)(?:\/|$)/,
+        severity: 'blocked',
+        action: 'block',
+        description: 'Sandbox: recursive search on system paths blocked. Search within sandbox directory only.',
+    },
+    // 禁止向用户主目录写入文件（绝对路径写操作）
+    {
+        name: 'sandbox-block-write-user-dir',
+        pattern: /(?:writeFile|writeFileSync)\s*\([\s\S]*?['"]?\/(Users|home)\/|\b(cp|mv|tee)\s+[^|;&]*\s+['"]?\/(Users|home)\//,
+        severity: 'blocked',
+        action: 'block',
+        description: 'Sandbox: writing to user directory blocked. Use relative paths (e.g. "output.pptx") within the sandbox.',
+    },
+];
+/**
+ * 沙箱允许的环境变量白名单
+ * 只保留脚本运行所需的最小环境变量集合
+ */
+export const SANDBOX_SAFE_ENV_KEYS = [
+    // 基础环境
+    'PATH', 'HOME', 'USER', 'USERNAME',
+    // 本地化
+    'LANG', 'LC_ALL', 'LC_CTYPE', 'TERM',
+    // Python
+    'PYTHONIOENCODING', 'PYTHONUTF8', 'PYTHONPATH',
+    // Node.js
+    'NODE_PATH', 'NODE_ENV',
+    // 临时目录
+    'TMPDIR', 'TEMP', 'TMP',
+    // Windows 系统
+    'SystemRoot', 'windir', 'COMSPEC',
+    // 系统标识
+    'OS', 'PROCESSOR_ARCHITECTURE',
+];
+//# sourceMappingURL=types.js.map

package/dist/esm/sandbox/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/sandbox/types.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,8BAA8B;AAC9B,+DAA+D;AAqB/D,aAAa;AACb,MAAM,CAAC,MAAM,sBAAsB,GAA2B;IAC5D,WAAW,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO;IACtC,WAAW,EAAE,KAAK;IAClB,kBAAkB,EAAE,IAAI;CACzB,CAAC;AAwCF,qBAAqB;AAErB;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmB;IACtD,OAAO;IACP;QACE,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,uCAAuC;KACrD;IACD,WAAW;IACX;QACE,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,gEAAgE;QACzE,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,yCAAyC;KACvD;IACD,WAAW;IACX;QACE,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,wBAAwB;QACjC,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,oCAAoC;KAClD;IACD,UAAU;IACV;QACE,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,wCAAwC;KACtD;IACD,aAAa;IACb;QACE,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,qCAAqC;QAC9C,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,4CAA4C;KAC1D;IACD,OAAO;IACP;QACE,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,kCAAkC;KAChD;IACD,WAAW;IACX;QACE,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,0CAA0C;KACxD;IACD,6BAA6B;IAC7B;QACE,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,wGAAwG;KACtH;IACD,0BAA0B;IAC1B;QACE,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,gEAAgE;KAC9E;IACD,4BAA4B;IAC5B;QACE,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,0GAA0G;QACnH,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,0FAA0F;KACxG;IACD,wBAAwB;IACxB;QACE,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,+GAA+G;QACxH,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,yGAAyG;KACvH;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAa;IAC7C,OAAO;IACP,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU;IAClC,MAAM;IACN,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM;IACpC,SAAS;IACT,kBAAkB,EAAE,YAAY,EAAE,YAAY;IAC9C,UAAU;IACV,WAAW,EAAE,UAAU;IACvB,OAAO;IACP,QAAQ,EAAE,MAAM,EAAE,KAAK;IACvB,aAAa;IACb,YAAY,EAAE,QAAQ,EAAE,SAAS;IACjC,OAAO;IACP,IAAI,EAAE,wBAAwB;CAC/B,CAAC"}

package/dist/esm/security/guard.d.ts

@@ -0,0 +1,36 @@
+import type { SanitizeResult, SecurityRule, SecurityPolicy } from './types.ts';
+export declare class SecurityGuard {
+    private policy;
+    /** 已编译的正则规则缓存（避免每次 sanitize 重复遍历数组） */
+    private compiledBlacklist;
+    private compiledCustomRewrite;
+    private compiledCustomWarn;
+    /** 删除保护规则（使用 policy.trashDir） */
+    private deleteProtectionRule;
+    private windowsDeleteProtectionRule;
+    constructor(policy?: Partial<SecurityPolicy>);
+    /** 编译规则缓存（policy 变更时调用） */
+    private invalidateCompiledRules;
+    private getCompiledBlacklist;
+    private getCompiledCustomRewrite;
+    private getCompiledCustomWarn;
+    /** 检查命令安全性 */
+    sanitize(command: string): SanitizeResult;
+    /** 添加自定义安全规则 */
+    addRule(rule: SecurityRule): void;
+    /** 移除规则 */
+    removeRule(name: string): void;
+    /** 更新安全策略 */
+    setPolicy(policy: Partial<SecurityPolicy>): void;
+    /** 获取当前策略 */
+    getPolicy(): SecurityPolicy;
+    /**
+     * 扫描并脱敏文本中的敏感信息
+     * 将检测到的 API Key、Token、密码等替换为 [REDACTED:xxx]
+     * @param text 输入文本（通常是工具结果）
+     * @returns 脱敏后的文本
+     */
+    sanitizeCredentials(text: string): string;
+    private matchRule;
+}
+//# sourceMappingURL=guard.d.ts.map

package/dist/esm/security/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../../src/security/guard.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAiI/E,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAiB;IAE/B,uCAAuC;IACvC,OAAO,CAAC,iBAAiB,CAA+B;IACxD,OAAO,CAAC,qBAAqB,CAA+B;IAC5D,OAAO,CAAC,kBAAkB,CAA+B;IACzD,iCAAiC;IACjC,OAAO,CAAC,oBAAoB,CAAe;IAC3C,OAAO,CAAC,2BAA2B,CAAsB;gBAE7C,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC;IAS5C,2BAA2B;IAC3B,OAAO,CAAC,uBAAuB;IAM/B,OAAO,CAAC,oBAAoB;IAO5B,OAAO,CAAC,wBAAwB;IAOhC,OAAO,CAAC,qBAAqB;IAO7B,cAAc;IACd,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc;IAyEzC,gBAAgB;IAChB,OAAO,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAKjC,WAAW;IACX,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAK9B,aAAa;IACb,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI;IAWhD,aAAa;IACb,SAAS,IAAI,cAAc;IAM3B;;;;;OAKG;IACH,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAczC,OAAO,CAAC,SAAS;CAMlB"}

package/dist/esm/security/guard.js

@@ -0,0 +1,287 @@
+// ============================================================
+// SecurityGuard — 命令安全检查 + 凭证泄露检测（带规则编译缓存）
+// ============================================================
+/** 凭证泄露检测模式 */
+const CREDENTIAL_PATTERNS = [
+    { name: 'openai-key', pattern: /sk-[a-zA-Z0-9]{20,}/g },
+    { name: 'anthropic-key', pattern: /sk-ant-[a-zA-Z0-9-]{20,}/g },
+    { name: 'aws-access-key', pattern: /AKIA[0-9A-Z]{16}/g },
+    { name: 'aws-secret-key', pattern: /(?<![A-Za-z0-9/+=])[A-Za-z0-9/+=]{40,44}(?![A-Za-z0-9/+=])/g },
+    { name: 'github-token', pattern: /ghp_[a-zA-Z0-9]{36}/g },
+    { name: 'github-fine-grained', pattern: /github_pat_[a-zA-Z0-9_]{82}/g },
+    { name: 'generic-bearer', pattern: /Bearer\s+[a-zA-Z0-9._-]+/gi },
+    { name: 'generic-secret', pattern: /(?:password|secret|token|api_key|apikey)\s*[:=]\s*['"][^'"]{8,}['"]/gi },
+    { name: 'private-key', pattern: /-----BEGIN (?:RSA |EC |DSA )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA )?PRIVATE KEY-----/g },
+];
+/** 默认安全策略 */
+const DEFAULT_POLICY = {
+    deleteProtection: true,
+    trashDir: '~/.workagent/.trash',
+    winTrashDir: '$env:USERPROFILE\\.workagent\\.trash',
+    platform: 'unix',
+    blacklistEnabled: true,
+    rules: [],
+};
+/** 内置黑名单规则 */
+const BUILTIN_BLACKLIST = [
+    // ---- Unix ----
+    {
+        name: 'block-rm-root',
+        pattern: /^rm\s+(-[a-zA-Z]*\s+)*\/$/m,
+        severity: 'blocked',
+        action: 'block',
+        description: 'Block rm -rf / (destroy root filesystem)',
+    },
+    {
+        name: 'block-dd-disk',
+        pattern: /^dd\s+.*of=\/dev\/[sh]d/m,
+        severity: 'blocked',
+        action: 'block',
+        description: 'Block dd to disk device',
+    },
+    {
+        name: 'block-mkfs',
+        pattern: /^mkfs\./,
+        severity: 'blocked',
+        action: 'block',
+        description: 'Block filesystem format commands',
+    },
+    {
+        name: 'block-fork-bomb',
+        pattern: /^:\(\)\s*\{\s*:\|:\s*&\s*\}\s*;\s*:/,
+        severity: 'blocked',
+        action: 'block',
+        description: 'Block fork bomb',
+    },
+    // ---- Windows ----
+    {
+        name: 'block-format-drive',
+        pattern: /format\s+[a-z]:/i,
+        severity: 'blocked',
+        action: 'block',
+        description: 'Block format drive command',
+    },
+    {
+        name: 'block-clear-disk',
+        pattern: /clear-disk/i,
+        severity: 'blocked',
+        action: 'block',
+        description: 'Block Clear-Disk command',
+    },
+    {
+        name: 'block-rd-system-drive',
+        pattern: /^rd\s+\/s\s+[a-z]:\s*$/i,
+        severity: 'blocked',
+        action: 'block',
+        description: 'Block rd /s on drive root',
+    },
+    {
+        name: 'block-remove-item-drive-root',
+        pattern: /(?:Remove-Item|ri|del)\s+.*[a-z]:\s*$/i,
+        severity: 'blocked',
+        action: 'block',
+        description: 'Block Remove-Item on drive root',
+    },
+];
+/** 内置删除保护规则（rm → mv 到回收站，回收站路径通过 policy.trashDir 配置） */
+function createDeleteProtectionRule(trashDir) {
+    return {
+        name: 'delete-protection',
+        pattern: /^(sudo\s+)?rm\s+((?:-[a-zA-Z]+\s+)*)(.+)$/s,
+        severity: 'warn',
+        action: 'rewrite',
+        rewriter: (command) => {
+            const match = command.match(/^(sudo\s+)?rm\s+((?:-[a-zA-Z]+\s+)*)(.+)$/s);
+            if (!match)
+                return command;
+            const targets = match[3];
+            const ts = Date.now();
+            return `mkdir -p ${trashDir} && mv ${targets} ${trashDir}/_del_${ts}`;
+        },
+        description: 'Rewrite rm to mv trash for delete protection',
+    };
+}
+/** Windows 删除保护规则（Remove-Item → Move-Item 回收站） */
+function createWindowsDeleteProtectionRule(winTrashDir) {
+    return {
+        name: 'windows-delete-protection',
+        pattern: /^(Remove-Item|ri|del)\s+(.+)$/i,
+        severity: 'warn',
+        action: 'rewrite',
+        rewriter: (command) => {
+            const match = command.match(/^(Remove-Item|ri|del)\s+(.+)$/i);
+            if (!match)
+                return command;
+            const targets = match[2]
+                .replace(/-Recurse/gi, '')
+                .replace(/-Force/gi, '')
+                .replace(/-Confirm:\$false/gi, '')
+                .replace(/\/s/gi, '')
+                .replace(/\/q/gi, '')
+                .trim();
+            const ts = Date.now();
+            return `New-Item -ItemType Directory -Force -Path "${winTrashDir}" | Out-Null; Move-Item -Path ${targets} -Destination "${winTrashDir}\\_del_${ts}" -Force`;
+        },
+        description: 'Rewrite Remove-Item to Move-Item trash for delete protection (Windows)',
+    };
+}
+export class SecurityGuard {
+    policy;
+    /** 已编译的正则规则缓存（避免每次 sanitize 重复遍历数组） */
+    compiledBlacklist = null;
+    compiledCustomRewrite = null;
+    compiledCustomWarn = null;
+    /** 删除保护规则（使用 policy.trashDir） */
+    deleteProtectionRule;
+    windowsDeleteProtectionRule;
+    constructor(policy) {
+        this.policy = { ...DEFAULT_POLICY, ...policy };
+        this.deleteProtectionRule = createDeleteProtectionRule(this.policy.trashDir);
+        this.windowsDeleteProtectionRule = this.policy.winTrashDir
+            ? createWindowsDeleteProtectionRule(this.policy.winTrashDir)
+            : createWindowsDeleteProtectionRule(DEFAULT_POLICY.winTrashDir);
+        this.invalidateCompiledRules();
+    }
+    /** 编译规则缓存（policy 变更时调用） */
+    invalidateCompiledRules() {
+        this.compiledBlacklist = null;
+        this.compiledCustomRewrite = null;
+        this.compiledCustomWarn = null;
+    }
+    getCompiledBlacklist() {
+        if (!this.compiledBlacklist) {
+            this.compiledBlacklist = [...BUILTIN_BLACKLIST, ...this.policy.rules.filter((r) => r.action === 'block')];
+        }
+        return this.compiledBlacklist;
+    }
+    getCompiledCustomRewrite() {
+        if (!this.compiledCustomRewrite) {
+            this.compiledCustomRewrite = this.policy.rules.filter((r) => r.action === 'rewrite' && r.rewriter);
+        }
+        return this.compiledCustomRewrite;
+    }
+    getCompiledCustomWarn() {
+        if (!this.compiledCustomWarn) {
+            this.compiledCustomWarn = this.policy.rules.filter((r) => r.action === 'warn');
+        }
+        return this.compiledCustomWarn;
+    }
+    /** 检查命令安全性 */
+    sanitize(command) {
+        const trimmedCmd = command.trim();
+        // ① 黑名单检查
+        if (this.policy.blacklistEnabled) {
+            for (const rule of this.getCompiledBlacklist()) {
+                if (this.matchRule(trimmedCmd, rule)) {
+                    return {
+                        safe: false,
+                        reason: `BLOCKED: ${rule.description || rule.name}`,
+                        severity: rule.severity,
+                    };
+                }
+            }
+        }
+        // ② 删除保护（平台感知）
+        if (this.policy.deleteProtection) {
+            const platform = this.policy.platform ?? 'unix';
+            // Windows 删除保护
+            if ((platform === 'windows' || platform === 'auto') && this.windowsDeleteProtectionRule) {
+                if (this.matchRule(trimmedCmd, this.windowsDeleteProtectionRule)) {
+                    const rewritten = this.windowsDeleteProtectionRule.rewriter(trimmedCmd);
+                    return {
+                        safe: true,
+                        rewritten,
+                        reason: 'Delete protection: Remove-Item rewritten to Move-Item trash (Windows)',
+                        severity: 'warn',
+                    };
+                }
+            }
+            // Unix 删除保护
+            if (platform === 'unix' || platform === 'auto') {
+                if (this.matchRule(trimmedCmd, this.deleteProtectionRule)) {
+                    const rewritten = this.deleteProtectionRule.rewriter(trimmedCmd);
+                    return {
+                        safe: true,
+                        rewritten,
+                        reason: 'Delete protection: rm rewritten to mv trash',
+                        severity: 'warn',
+                    };
+                }
+            }
+        }
+        // ③ 自定义 rewrite 规则
+        for (const rule of this.getCompiledCustomRewrite()) {
+            if (!this.matchRule(trimmedCmd, rule))
+                continue;
+            return {
+                safe: true,
+                rewritten: rule.rewriter(trimmedCmd),
+                reason: `Rewritten by rule: ${rule.name}`,
+                severity: rule.severity,
+            };
+        }
+        // ④ 自定义 warn 规则
+        for (const rule of this.getCompiledCustomWarn()) {
+            if (this.matchRule(trimmedCmd, rule)) {
+                return {
+                    safe: true,
+                    reason: `Warning: ${rule.description || rule.name}`,
+                    severity: rule.severity,
+                };
+            }
+        }
+        // ⑤ 安全
+        return { safe: true, severity: 'safe' };
+    }
+    /** 添加自定义安全规则 */
+    addRule(rule) {
+        this.policy.rules.push(rule);
+        this.invalidateCompiledRules();
+    }
+    /** 移除规则 */
+    removeRule(name) {
+        this.policy.rules = this.policy.rules.filter((r) => r.name !== name);
+        this.invalidateCompiledRules();
+    }
+    /** 更新安全策略 */
+    setPolicy(policy) {
+        this.policy = { ...this.policy, ...policy };
+        if (policy.trashDir) {
+            this.deleteProtectionRule = createDeleteProtectionRule(this.policy.trashDir);
+        }
+        if (policy.winTrashDir) {
+            this.windowsDeleteProtectionRule = createWindowsDeleteProtectionRule(this.policy.winTrashDir);
+        }
+        this.invalidateCompiledRules();
+    }
+    /** 获取当前策略 */
+    getPolicy() {
+        return { ...this.policy };
+    }
+    // ---- 凭证泄露检测 ----
+    /**
+     * 扫描并脱敏文本中的敏感信息
+     * 将检测到的 API Key、Token、密码等替换为 [REDACTED:xxx]
+     * @param text 输入文本（通常是工具结果）
+     * @returns 脱敏后的文本
+     */
+    sanitizeCredentials(text) {
+        if (!text || text.length < 10)
+            return text;
+        let result = text;
+        for (const { name, pattern } of CREDENTIAL_PATTERNS) {
+            // 重置正则 lastIndex（全局标志下）
+            pattern.lastIndex = 0;
+            result = result.replace(pattern, `[REDACTED:${name}]`);
+        }
+        return result;
+    }
+    // ---- 内部辅助 ----
+    matchRule(command, rule) {
+        if (rule.pattern instanceof RegExp) {
+            return rule.pattern.test(command);
+        }
+        return rule.pattern(command);
+    }
+}
+//# sourceMappingURL=guard.js.map