@cicctencent/agent-core 0.1.1

package/src/security/guard.ts

@@ -0,0 +1,249 @@
+// ============================================================
+// SecurityGuard — 命令安全检查 + 凭证泄露检测（带规则编译缓存）
+// ============================================================
+
+import type { SanitizeResult, SecurityRule, SecurityPolicy } from './types.ts';
+
+/** 凭证泄露检测模式 */
+const CREDENTIAL_PATTERNS: Array<{ name: string; pattern: RegExp }> = [
+  { name: 'openai-key', pattern: /sk-[a-zA-Z0-9]{20,}/g },
+  { name: 'anthropic-key', pattern: /sk-ant-[a-zA-Z0-9-]{20,}/g },
+  { name: 'aws-access-key', pattern: /AKIA[0-9A-Z]{16}/g },
+  { name: 'aws-secret-key', pattern: /(?<![A-Za-z0-9/+=])[A-Za-z0-9/+=]{40}(?![A-Za-z0-9/+=])/g },
+  { name: 'github-token', pattern: /ghp_[a-zA-Z0-9]{36}/g },
+  { name: 'github-fine-grained', pattern: /github_pat_[a-zA-Z0-9_]{82}/g },
+  { name: 'generic-bearer', pattern: /Bearer\s+[a-zA-Z0-9._-]+/gi },
+  { name: 'generic-secret', pattern: /(?:password|secret|token|api_key|apikey)\s*[:=]\s*['"][^'"]{8,}['"]/gi },
+  { name: 'private-key', pattern: /-----BEGIN (?:RSA |EC |DSA )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA )?PRIVATE KEY-----/g },
+];
+
+/** 默认安全策略 */
+const DEFAULT_POLICY: SecurityPolicy = {
+  deleteProtection: true,
+  trashDir: '~/.workagent/.trash',
+  blacklistEnabled: true,
+  rules: [],
+};
+
+/** 内置黑名单规则 */
+const BUILTIN_BLACKLIST: SecurityRule[] = [
+  {
+    name: 'block-rm-root',
+    pattern: /^rm\s+(-[a-zA-Z]*\s+)*\/$/m,
+    severity: 'blocked',
+    action: 'block',
+    description: 'Block rm -rf / (destroy root filesystem)',
+  },
+  {
+    name: 'block-dd-disk',
+    pattern: /^dd\s+.*of=\/dev\/[sh]d/m,
+    severity: 'blocked',
+    action: 'block',
+    description: 'Block dd to disk device',
+  },
+  {
+    name: 'block-mkfs',
+    pattern: /^mkfs\./,
+    severity: 'blocked',
+    action: 'block',
+    description: 'Block filesystem format commands',
+  },
+  {
+    name: 'block-fork-bomb',
+    pattern: /^:\(\)\s*\{\s*:\|:\s*&\s*\}\s*;\s*:/,
+    severity: 'blocked',
+    action: 'block',
+    description: 'Block fork bomb',
+  },
+];
+
+/** 内置删除保护规则（rm → mv 到回收站，回收站路径通过 policy.trashDir 配置） */
+function createDeleteProtectionRule(trashDir: string): SecurityRule {
+  return {
+    name: 'delete-protection',
+    pattern: /^(sudo\s+)?rm\s+((?:-[a-zA-Z]+\s+)*)(.+)$/s,
+    severity: 'warn',
+    action: 'rewrite',
+    rewriter: (command: string) => {
+      const match = command.match(/^(sudo\s+)?rm\s+((?:-[a-zA-Z]+\s+)*)(.+)$/s);
+      if (!match) return command;
+      const targets = match[3];
+      const ts = Date.now();
+      return `mkdir -p ${trashDir} && mv ${targets} ${trashDir}/_del_${ts}`;
+    },
+    description: 'Rewrite rm to mv trash for delete protection',
+  };
+}
+
+export class SecurityGuard {
+  private policy: SecurityPolicy;
+
+  /** 已编译的正则规则缓存（避免每次 sanitize 重复遍历数组） */
+  private compiledBlacklist: SecurityRule[] | null = null;
+  private compiledCustomRewrite: SecurityRule[] | null = null;
+  private compiledCustomWarn: SecurityRule[] | null = null;
+  /** 删除保护规则（使用 policy.trashDir） */
+  private deleteProtectionRule: SecurityRule;
+
+  constructor(policy?: Partial<SecurityPolicy>) {
+    this.policy = { ...DEFAULT_POLICY, ...policy };
+    this.deleteProtectionRule = createDeleteProtectionRule(this.policy.trashDir);
+    this.invalidateCompiledRules();
+  }
+
+  /** 编译规则缓存（policy 变更时调用） */
+  private invalidateCompiledRules(): void {
+    this.compiledBlacklist = null;
+    this.compiledCustomRewrite = null;
+    this.compiledCustomWarn = null;
+  }
+
+  private getCompiledBlacklist(): SecurityRule[] {
+    if (!this.compiledBlacklist) {
+      this.compiledBlacklist = [...BUILTIN_BLACKLIST, ...this.policy.rules.filter((r) => r.action === 'block')];
+    }
+    return this.compiledBlacklist;
+  }
+
+  private getCompiledCustomRewrite(): SecurityRule[] {
+    if (!this.compiledCustomRewrite) {
+      this.compiledCustomRewrite = this.policy.rules.filter((r) => r.action === 'rewrite' && r.rewriter);
+    }
+    return this.compiledCustomRewrite;
+  }
+
+  private getCompiledCustomWarn(): SecurityRule[] {
+    if (!this.compiledCustomWarn) {
+      this.compiledCustomWarn = this.policy.rules.filter((r) => r.action === 'warn');
+    }
+    return this.compiledCustomWarn;
+  }
+
+  /** 检查命令安全性 */
+  sanitize(command: string): SanitizeResult {
+    const trimmedCmd = command.trim();
+
+    // ① 黑名单检查
+    if (this.policy.blacklistEnabled) {
+      for (const rule of this.getCompiledBlacklist()) {
+        if (this.matchRule(trimmedCmd, rule)) {
+          return {
+            safe: false,
+            reason: `BLOCKED: ${rule.description || rule.name}`,
+            severity: rule.severity,
+          };
+        }
+      }
+    }
+
+    // ② 删除保护（rm → mv 回收站）
+    if (this.policy.deleteProtection) {
+      if (this.matchRule(trimmedCmd, this.deleteProtectionRule)) {
+        const rewritten = this.deleteProtectionRule.rewriter!(trimmedCmd);
+        return {
+          safe: true,
+          rewritten,
+          reason: 'Delete protection: rm rewritten to mv trash',
+          severity: 'warn',
+        };
+      }
+    }
+
+    // ③ 自定义 rewrite 规则
+    for (const rule of this.getCompiledCustomRewrite()) {
+      if (!this.matchRule(trimmedCmd, rule)) continue;
+      return {
+        safe: true,
+        rewritten: rule.rewriter!(trimmedCmd),
+        reason: `Rewritten by rule: ${rule.name}`,
+        severity: rule.severity,
+      };
+    }
+
+    // ④ 自定义 warn 规则
+    for (const rule of this.getCompiledCustomWarn()) {
+      if (this.matchRule(trimmedCmd, rule)) {
+        return {
+          safe: true,
+          reason: `Warning: ${rule.description || rule.name}`,
+          severity: rule.severity,
+        };
+      }
+    }
+
+    // ⑤ 安全
+    return { safe: true, severity: 'safe' };
+  }
+
+  /** 添加自定义安全规则 */
+  addRule(rule: SecurityRule): void {
+    this.policy.rules.push(rule);
+    this.invalidateCompiledRules();
+  }
+
+  /** 移除规则 */
+  removeRule(name: string): void {
+    this.policy.rules = this.policy.rules.filter((r) => r.name !== name);
+    this.invalidateCompiledRules();
+  }
+
+  /** 更新安全策略 */
+  setPolicy(policy: Partial<SecurityPolicy>): void {
+    this.policy = { ...this.policy, ...policy };
+    if (policy.trashDir) {
+      this.deleteProtectionRule = createDeleteProtectionRule(this.policy.trashDir);
+    }
+    this.invalidateCompiledRules();
+  }
+
+  /** 获取当前策略 */
+  getPolicy(): SecurityPolicy {
+    return { ...this.policy };
+  }
+
+  // ---- 凭证泄露检测 ----
+
+  /**
+   * 扫描并脱敏文本中的敏感信息
+   * 将检测到的 API Key、Token、密码等替换为 [REDACTED:xxx]
+   * @param text 输入文本（通常是工具结果）
+   * @returns 脱敏后的文本
+   */
+  sanitizeCredentials(text: string): string {
+    if (!text || text.length < 10) return text;
+
+    let result = text;
+    for (const { name, pattern } of CREDENTIAL_PATTERNS) {
+      // 重置正则 lastIndex（全局标志下）
+      pattern.lastIndex = 0;
+      result = result.replace(pattern, `[REDACTED:${name}]`);
+    }
+    return result;
+  }
+
+  /**
+   * 检测文本是否包含敏感信息
+   * @param text 输入文本
+   * @returns 检测到的敏感信息类型列表
+   */
+  detectCredentials(text: string): string[] {
+    if (!text) return [];
+    const detected: string[] = [];
+    for (const { name, pattern } of CREDENTIAL_PATTERNS) {
+      pattern.lastIndex = 0;
+      if (pattern.test(text)) {
+        detected.push(name);
+      }
+    }
+    return detected;
+  }
+
+  // ---- 内部辅助 ----
+
+  private matchRule(command: string, rule: SecurityRule): boolean {
+    if (rule.pattern instanceof RegExp) {
+      return rule.pattern.test(command);
+    }
+    return rule.pattern(command);
+  }
+}

package/src/security/types.ts

@@ -0,0 +1,46 @@
+// ============================================================
+// Security Guard 类型定义
+// ============================================================
+
+// ---- SanitizeResult ----
+
+export type Severity = 'safe' | 'warn' | 'danger' | 'blocked';
+
+export interface SanitizeResult {
+  /** 是否允许执行 */
+  safe: boolean;
+  /** 改写后的命令（如 rm → mv 到回收站） */
+  rewritten?: string;
+  /** 拒绝/警告原因 */
+  reason?: string;
+  /** 严重程度 */
+  severity: Severity;
+}
+
+// ---- SecurityRule / SecurityPolicy ----
+
+export interface SecurityRule {
+  /** 规则名称 */
+  name: string;
+  /** 匹配模式（正则或函数） */
+  pattern: RegExp | ((command: string) => boolean);
+  /** 命中后的严重程度 */
+  severity: Severity;
+  /** 命中后的处理：'block' 阻止 | 'rewrite' 改写 | 'warn' 放行但记录 */
+  action: 'block' | 'rewrite' | 'warn';
+  /** 改写函数（action='rewrite' 时使用） */
+  rewriter?: (command: string) => string;
+  /** 规则描述 */
+  description?: string;
+}
+
+export interface SecurityPolicy {
+  /** 是否启用删除保护（rm → mv 到回收站） */
+  deleteProtection: boolean;
+  /** 回收站路径 */
+  trashDir: string;
+  /** 是否启用黑名单 */
+  blacklistEnabled: boolean;
+  /** 自定义规则 */
+  rules: SecurityRule[];
+}