@kenhkl/agent-moss 0.11.3 → 0.11.4

package/dist/server.js

@@ -963,7 +963,11 @@ var init_logic_rules = __esm({
       // SSH 主机私钥（排除 .pub 公钥变体，对齐 Python .ssh/id_rsa(?!\.pub) 范式）
       { path: "/etc/ssh/ssh_host_rsa_key(?!\\.pub)", riskLevel: "critical", desc: "SSH \u4E3B\u673A RSA \u79C1\u94A5", credential: true },
       { path: "/etc/ssh/ssh_host_ed25519_key(?!\\.pub)", riskLevel: "critical", desc: "SSH \u4E3B\u673A Ed25519 \u79C1\u94A5", credential: true },
-      { path: "/etc/ssh/ssh_host_ecdsa_key(?!\\.pub)", riskLevel: "critical", desc: "SSH \u4E3B\u673A ECDSA \u79C1\u94A5", credential: true }
+      { path: "/etc/ssh/ssh_host_ecdsa_key(?!\\.pub)", riskLevel: "critical", desc: "SSH \u4E3B\u673A ECDSA \u79C1\u94A5", credential: true },
+      // Nginx 配置（仅拦截写入，对齐 Python linux.py sensitive_paths）
+      { path: "/etc/nginx/nginx.conf", riskLevel: "high", desc: "Nginx \u4E3B\u914D\u7F6E" },
+      { path: "/etc/nginx/conf.d/", riskLevel: "high", desc: "Nginx \u5B50\u914D\u7F6E\u76EE\u5F55" },
+      { path: "/etc/nginx/sites-enabled/", riskLevel: "high", desc: "Nginx \u542F\u7528\u7AD9\u70B9\u914D\u7F6E\u76EE\u5F55" }
     ];
     HOME_SENSITIVE_PATHS = [
       { path: ".ssh/id_rsa", riskLevel: "critical", desc: "SSH \u79C1\u94A5", credential: true },
@@ -2374,6 +2378,12 @@ function stripLiteralTextSegments(actionDetail) {
   }
   return resultParts.join("");
 }
+function stripHeredocContent(actionDetail) {
+  return actionDetail.replace(
+    /<<-?\s*(?:['"]?)([A-Za-z_][A-Za-z0-9_]*)(?:['"]?)[^\n]*\n[\s\S]*?\n\s*\1\s*(?:\n|$)/g,
+    "<<heredoc>>\n"
+  );
+}
 function splitCommandSegments(actionDetail) {
   const segments = [];
   let cur = "";
@@ -2538,11 +2548,13 @@ function checkSensitivePath(command, cwd, agentExt) {
 }
 function checkDangerousPatterns(actionType, actionDetail) {
   if (actionType === "file_write" || actionType === "file_edit") return null;
+  const scan = stripHeredocContent(actionDetail);
   const TEMP_DIRS = ["/tmp", "/var/tmp", "/run", "/dev/shm"];
   const isTempPath = TEMP_DIRS.some(
     (td) => new RegExp(`(?:^|[\\s/])${td.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[\\s/]|$)`).test(actionDetail)
   );
-  if (!isTempPath && (actionDetail.includes("*") || actionDetail.includes("?")) && ["rm ", "rm	", "del ", "del	", "delete", "remove ", "remove	", "\u5220\u9664", "\u79FB\u9664"].some((kw) => actionDetail.includes(kw))) {
+  const wildcardDeleteRe = /(?:\brm\b|\b(r?mdir|del|delete|remove|rmdir|unlink)\b|\b删除\b|\b移除\b)[\s\S]{0,40}?[*?]|[*?][\s\S]{0,40}?\b(?:rm|del|delete|remove|rmdir|unlink)\b|rm\s+-[a-zA-Z]*[rf][a-zA-Z]*\s+\S*[*?]/i;
+  if (!isTempPath && wildcardDeleteRe.test(scan)) {
     return {
       allowed: false,
       reason: "\u68C0\u6D4B\u5230\u901A\u914D\u7B26\u7ED3\u5408\u5220\u9664\u64CD\u4F5C\uFF0C\u53EF\u80FD\u9020\u6210\u6279\u91CF\u8BEF\u5220",
@@ -2805,7 +2817,10 @@ var init_heuristic = __esm({
       { pattern: />\s*\/boot\//i, severity: "critical", description: "\u8986\u76D6\u5199\u5165\u542F\u52A8\u5F15\u5BFC\u76EE\u5F55", riskType: "file_access" },
       // 注：/proc/ 重定向覆盖走 checkSensitivePath 的 high（内核参数 /proc/sys/），此处不拦 /proc/ 避免遮蔽（对齐 Python）。
       // --- High: download script + execute risk ---
+      // curl -X POST 外传敏感信息（对齐 Python linux.py: curl POST env/key/token）
+      { pattern: /curl\s+.*-X\s+POST.*\b(env|environment|secret|key|token|password)\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u901A\u8FC7 curl POST \u5916\u4F20\u53EF\u80FD\u5305\u542B\u654F\u611F\u4FE1\u606F\u7684\u8BF7\u6C42", riskType: "data_exfiltration" },
       { pattern: /(?:curl|wget)\s+.*(?:-o|--output|>)\s*\S+\.(?:sh|bash)\b/i, severity: "high", description: "\u8FDC\u7A0B\u4E0B\u8F7D\u811A\u672C\u5230\u672C\u5730", riskType: "script_execution" },
+      { pattern: /(?:curl|wget)\s+\S+.*\b(?:chmod|chown)\s+\+x\b/i, severity: "high", description: "\u8FDC\u7A0B\u4E0B\u8F7D\u540E\u4FEE\u6539\u53EF\u6267\u884C\u6743\u9650\uFF0C\u5B58\u5728\u8FDC\u7A0B\u4EE3\u7801\u6267\u884C\u98CE\u9669", riskType: "script_execution" },
       { pattern: /(?:curl|wget)\s+.*\s+&&?\s*(?:chmod\s+\+x|bash|sh)/i, severity: "high", description: "\u4E0B\u8F7D\u540E\u6267\u884C", riskType: "script_execution" },
       // --- High: package manager pipe-to-shell ---
       { pattern: /git\s+clone\s+.*\|.*bash/i, severity: "high", description: "git clone pipe shell", riskType: "script_execution" },