@kenhkl/agent-moss 0.10.1 → 0.10.2

package/dist/engine/coordinator.js

@@ -467,8 +467,10 @@ function extractFilePaths(text) {
   return [...new Set(paths)];
 }
 function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, cwd) {
+  if (NON_WRITE_TOOL_PREFIXES.some((p) => actionType.startsWith(p))) return null;
   if (NON_WRITE_TOOLS.has(actionType)) return null;
-  let isWrite = WRITE_KEYWORDS.some((kw) => actionType.includes(kw) || actionDetail.includes(kw));
+  const isBashLike = actionType === "bash" || actionType === "executebash" || actionType === "terminal-executebash";
+  let isWrite = isBashLike ? WRITE_KEYWORDS.some((kw) => actionType.includes(kw) || actionDetail.includes(kw)) : WRITE_KEYWORDS.some((kw) => actionType.includes(kw));
   if (!isWrite && actionDetail.includes(">")) {
     const detailWithoutDevnull = actionDetail.replace(/(?:2|&|1)?\s*>\s*\/dev\/null\b/g, "");
     if (detailWithoutDevnull.includes(">")) {
@@ -634,7 +636,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
     violatedLayers: ["2"]
   };
 }
-var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, READ_ONLY_REDIR_CMDS, WRITE_KEYWORDS, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
+var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, READ_ONLY_REDIR_CMDS, WRITE_KEYWORDS, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
 var init_logic_rules = __esm({
   "src/engine/logic-rules.ts"() {
     "use strict";
@@ -686,7 +688,26 @@ var init_logic_rules = __esm({
       { path: "secrets.yaml", riskLevel: "high", desc: "\u5BC6\u94A5\u914D\u7F6E\u6587\u4EF6" },
       { path: ".env", riskLevel: "high", desc: "\u73AF\u5883\u53D8\u91CF/\u51ED\u636E\u914D\u7F6E\u6587\u4EF6" }
     ];
-    NON_WRITE_TOOLS = /* @__PURE__ */ new Set(["ask_user_question", "glob", "grep", "list_dir", "count_text_length", "search"]);
+    NON_WRITE_TOOLS = /* @__PURE__ */ new Set([
+      "ask_user_question",
+      "glob",
+      "grep",
+      "list_dir",
+      "count_text_length",
+      "search",
+      // filemgr 只读三件套（globfiles 在 coordinator FULLY_SAFE_TOOLS 提前放行，此处兜底防御非 coordinator 入口）
+      "filemgr-globfiles",
+      "filemgr-readfile",
+      "filemgr-grepfiles",
+      // 通用只读工具名
+      "read",
+      "read_file",
+      "file_read",
+      "head",
+      "tail",
+      "cat"
+    ]);
+    NON_WRITE_TOOL_PREFIXES = ["memory-", "skill-manager-", "mailbox-", "app-"];
     READ_ONLY_REDIR_CMDS = /* @__PURE__ */ new Set(["cat", "head", "tail", "less", "more", "grep", "find", "awk", "sed", "sort", "uniq", "wc", "cut", "strings", "od", "xxd", "hexdump"]);
     WRITE_KEYWORDS = ["write", "\u5199\u5165", "save", "\u4FDD\u5B58", "modify", "\u4FEE\u6539", "update", "\u66F4\u65B0", "delete", "\u5220\u9664", "remove", "\u79FB\u9664", "create", "\u521B\u5EFA", "append", "\u8FFD\u52A0", "truncate", "\u622A\u65AD", "overwrite", "\u8986\u76D6", "replace", "\u66FF\u6362"];
     READ_KEYWORDS = ["read", "\u8BFB\u53D6", "cat", "head", "tail", "less", "more", "view", "\u67E5\u770B", "open", "\u6253\u5F00", "load", "\u52A0\u8F7D", "grep", "search", "\u641C\u7D22", "find", "\u67E5\u627E"];