@kenhkl/agent-moss 0.10.3 → 0.10.4

package/dist/engine/coordinator.js

@@ -401,6 +401,27 @@ var init_inline_analyzer = __esm({
 
 // src/engine/logic-rules.ts
 import * as fs2 from "fs";
+function isWriteOperation(actionType, actionDetail, writeKeywords = WRITE_KEYWORDS) {
+  if (writeKeywords.some((kw) => actionType.includes(kw) || actionDetail.includes(kw))) return true;
+  if (WRITE_COMMAND_RES.some((rx) => rx.test(actionDetail))) return true;
+  if (/\bsed\s+-[a-zA-Z]*i/i.test(actionDetail)) return true;
+  if (actionDetail.includes(">")) {
+    const detailWithoutDevnull = actionDetail.replace(DEVNULL_REDIRECT_RE, "");
+    if (detailWithoutDevnull.includes(">")) {
+      const firstWord = actionDetail.trim().split(/\s+/)[0]?.toLowerCase() || "";
+      if (!READ_ONLY_COMMANDS.has(firstWord)) return true;
+    }
+  }
+  return false;
+}
+function matchDangerousAction(actionDetail, action) {
+  if (/[^\x00-\x7f]/.test(action)) {
+    return actionDetail.includes(action);
+  }
+  const escaped = action.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const re = new RegExp(`(?<![-\\w])${escaped}\\b`, "i");
+  return re.test(actionDetail);
+}
 function runLogicCheck(input) {
   const { actionHistory, aNext, cwd } = input;
   const actionDetail = aNext.actionDetail.toLowerCase();
@@ -415,7 +436,7 @@ function runLogicCheck(input) {
       const promptLower = input.promptSession.toLowerCase();
       for (const pattern of INTENT_DEVIATION_PATTERNS) {
         const intentMatched = pattern.intentKeywords.some((kw) => promptLower.includes(kw));
-        const dangerousMatched = pattern.dangerousActions.some((kw) => actionDetail.includes(kw));
+        const dangerousMatched = pattern.dangerousActions.some((kw) => matchDangerousAction(actionDetail, kw));
         if (intentMatched && dangerousMatched) {
           return {
             allowed: false,
@@ -470,16 +491,7 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
   if (NON_WRITE_TOOL_PREFIXES.some((p) => actionType.startsWith(p))) return null;
   if (NON_WRITE_TOOLS.has(actionType)) return null;
   const isBashLike = actionType === "bash" || actionType === "executebash" || actionType === "terminal-executebash";
-  let isWrite = isBashLike ? WRITE_KEYWORDS.some((kw) => actionType.includes(kw) || actionDetail.includes(kw)) : WRITE_KEYWORDS.some((kw) => actionType.includes(kw));
-  if (!isWrite && actionDetail.includes(">")) {
-    const detailWithoutDevnull = actionDetail.replace(/(?:2|&|1)?\s*>\s*\/dev\/null\b/g, "");
-    if (detailWithoutDevnull.includes(">")) {
-      const firstWord = actionDetail.split(/\s/)[0]?.toLowerCase() || "";
-      if (!READ_ONLY_REDIR_CMDS.has(firstWord)) {
-        isWrite = true;
-      }
-    }
-  }
+  const isWrite = isBashLike ? isWriteOperation(actionType, actionDetail) : WRITE_KEYWORDS.some((kw) => actionType.includes(kw));
   if (!isWrite) return null;
   const targetPaths = extractFilePaths(actionDetail);
   if (targetPaths.length === 0) return null;
@@ -636,7 +648,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
     violatedLayers: ["2"]
   };
 }
-var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, READ_ONLY_REDIR_CMDS, WRITE_KEYWORDS, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
+var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, WRITE_KEYWORDS, WRITE_COMMAND_RES, READ_ONLY_COMMANDS, DEVNULL_REDIRECT_RE, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
 var init_logic_rules = __esm({
   "src/engine/logic-rules.ts"() {
     "use strict";
@@ -708,8 +720,105 @@ var init_logic_rules = __esm({
       "cat"
     ]);
     NON_WRITE_TOOL_PREFIXES = ["memory-", "skill-manager-", "mailbox-", "app-"];
-    READ_ONLY_REDIR_CMDS = /* @__PURE__ */ new Set(["cat", "head", "tail", "less", "more", "grep", "find", "awk", "sed", "sort", "uniq", "wc", "cut", "strings", "od", "xxd", "hexdump"]);
     WRITE_KEYWORDS = ["write", "\u5199\u5165", "save", "\u4FDD\u5B58", "modify", "\u4FEE\u6539", "update", "\u66F4\u65B0", "delete", "\u5220\u9664", "remove", "\u79FB\u9664", "create", "\u521B\u5EFA", "append", "\u8FFD\u52A0", "truncate", "\u622A\u65AD", "overwrite", "\u8986\u76D6", "replace", "\u66FF\u6362"];
+    WRITE_COMMAND_RES = [
+      /\brm\b/,
+      /\bunlink\b/,
+      /\brmdir\b/,
+      /\bshred\b/,
+      /\bcp\b/,
+      /\bmv\b/,
+      /\binstall\b/,
+      /\btee\b/,
+      /\bdd\b/,
+      /\bmkfs\b/,
+      /\b(fdisk|parted|cfdisk|sfdisk)\b/,
+      /\bchmod\b/,
+      /\bchown\b/,
+      /\btruncate\b/
+    ];
+    READ_ONLY_COMMANDS = /* @__PURE__ */ new Set([
+      "cat",
+      "head",
+      "tail",
+      "less",
+      "more",
+      "grep",
+      "find",
+      "awk",
+      "sed",
+      "sort",
+      "uniq",
+      "wc",
+      "cut",
+      "strings",
+      "od",
+      "xxd",
+      "hexdump",
+      "tr",
+      "file",
+      "stat",
+      "du",
+      "df",
+      "ls",
+      "dir",
+      "tree",
+      "nl",
+      "tac",
+      "rev",
+      "lsblk",
+      "blockdev",
+      "smartctl",
+      "udevadm",
+      "dmidecode",
+      "lscpu",
+      "lspci",
+      "lsusb",
+      "lsmem",
+      "lsns",
+      "lsof",
+      "hwinfo",
+      "inxi",
+      "fdisk",
+      "parted",
+      "dmesg",
+      "journalctl",
+      "systemctl",
+      "hostnamectl",
+      "localectl",
+      "timedatectl",
+      "ps",
+      "top",
+      "free",
+      "vmstat",
+      "iostat",
+      "mpstat",
+      "pidof",
+      "pgrep",
+      "ip",
+      "ifconfig",
+      "route",
+      "ss",
+      "netstat",
+      "arp",
+      "ethtool",
+      "nmcli",
+      "uname",
+      "arch",
+      "nproc",
+      "getconf",
+      "getent",
+      "id",
+      "whoami",
+      "who",
+      "w",
+      "last",
+      "uptime",
+      "lsmod",
+      "modinfo",
+      "sysctl"
+    ]);
+    DEVNULL_REDIRECT_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/;
     READ_KEYWORDS = ["read", "\u8BFB\u53D6", "cat", "head", "tail", "less", "more", "view", "\u67E5\u770B", "open", "\u6253\u5F00", "load", "\u52A0\u8F7D", "grep", "search", "\u641C\u7D22", "find", "\u67E5\u627E"];
     CREATE_KEYWORDS = ["\u521B\u5EFA", "\u65B0\u5EFA", "create", "new file", "touch"];
     PASSWORD_MODIFY_PATTERNS = [
@@ -731,7 +840,7 @@ var init_logic_rules = __esm({
     INTENT_DEVIATION_PATTERNS = [
       {
         intentKeywords: ["\u8BFB\u53D6", "\u67E5\u770B", "\u5206\u6790", "read", "analyze", "view", "list", "\u5217\u51FA"],
-        dangerousActions: ["\u5220\u9664", "remove", "delete", "rm ", "\u683C\u5F0F\u5316", "format"],
+        dangerousActions: ["\u5220\u9664", "remove", "delete", "rm", "\u683C\u5F0F\u5316", "format"],
         reason: "\u539F\u59CB\u610F\u56FE\u4E3A\u8BFB\u53D6/\u5206\u6790\uFF0C\u4F46\u6267\u884C\u4E86\u5220\u9664\u64CD\u4F5C"
       },
       {
@@ -1951,12 +2060,14 @@ function severityRank(s) {
 }
 function checkSensitivePath(command, cwd, agentExt) {
   const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
-  const _WRITE_CMD_RES = [/\brm\b/, /\bunlink\b/, /\brmdir\b/, /\bshred\b/, /\bcp\b/, /\bmv\b/, /\binstall\b/, /\btee\b/, /\bdd\b/, /\bmkfs\b/, /\b(fdisk|parted|cfdisk|sfdisk)\b/, /\bchmod\b/, /\bchown\b/, /\btruncate\b/];
-  const _DEVNULL_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/;
-  const _READONLY_CMDS = /* @__PURE__ */ new Set(["cat", "head", "tail", "less", "more", "grep", "find", "awk", "sed", "sort", "uniq", "wc", "cut", "strings", "od", "xxd", "hexdump", "tr", "file", "stat", "du", "df", "ls", "dir", "tree", "nl", "tac", "rev", "lsblk", "blockdev", "smartctl", "udevadm", "dmidecode", "lscpu", "lspci", "lsusb", "lsmem", "lsns", "lsof", "hwinfo", "inxi", "fdisk", "parted", "dmesg", "journalctl", "systemctl", "hostnamectl", "localectl", "timedatectl", "ps", "top", "free", "vmstat", "iostat", "mpstat", "pidof", "pgrep", "ip", "ifconfig", "route", "ss", "netstat", "arp", "ethtool", "nmcli", "uname", "arch", "nproc", "getconf", "getent", "id", "whoami", "who", "w", "last", "uptime", "lsmod", "modinfo", "sysctl"]);
-  const isWriteOpFlag = _WRITE_CMD_RES.some((rx) => rx.test(command)) || /\bsed\s+-[a-zA-Z]*i/.test(command) || command.includes(">") && !command.replace(_DEVNULL_RE, "").includes(">") || command.includes(">") && command.replace(_DEVNULL_RE, "").includes(">") && !_READONLY_CMDS.has(command.trim().split(/\s+/)[0]?.toLowerCase() || "") || WRITE_KEYWORDS.some((kw) => "".includes(kw) || command.includes(kw));
+  const isWriteOpFlag = isWriteOperation("", command);
+  const pathMatches = (text, path3) => {
+    const escaped = path3.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const re = path3.startsWith(".") || path3.startsWith("/") ? new RegExp(`(?:^|[\\s/\\\\'"])${escaped}\\b`, "i") : new RegExp(`\\b${escaped}\\b`, "i");
+    return re.test(text);
+  };
   for (const sp of ROOT_SENSITIVE_PATHS) {
-    if (command.includes(sp.path.toLowerCase())) {
+    if (pathMatches(command, sp.path.toLowerCase())) {
       if (sp.path === "/dev/random") {
         if (isWriteOpFlag) {
           continue;
@@ -2010,7 +2121,7 @@ function checkSensitivePath(command, cwd, agentExt) {
     for (const sp of agentExt.extra_sensitive_paths) {
       const spPath = sp.path.toLowerCase();
       const expanded = `${expandedCwd}/${spPath}`;
-      if (command.includes(spPath) || command.includes(expanded.toLowerCase())) {
+      if (pathMatches(command, spPath) || pathMatches(command, expanded.toLowerCase())) {
         const denyMode = sp.deny_mode || (sp.credential ? "deny_both" : sp.read_only ? "deny_read" : "deny_write");
         if (denyMode === "deny_read") {
           if (isWriteOpFlag) continue;