@kenhkl/agent-moss 0.11.3 → 0.11.5

package/dist/cli.js

@@ -964,7 +964,11 @@ var init_logic_rules = __esm({
       // SSH 主机私钥（排除 .pub 公钥变体，对齐 Python .ssh/id_rsa(?!\.pub) 范式）
       { path: "/etc/ssh/ssh_host_rsa_key(?!\\.pub)", riskLevel: "critical", desc: "SSH \u4E3B\u673A RSA \u79C1\u94A5", credential: true },
       { path: "/etc/ssh/ssh_host_ed25519_key(?!\\.pub)", riskLevel: "critical", desc: "SSH \u4E3B\u673A Ed25519 \u79C1\u94A5", credential: true },
-      { path: "/etc/ssh/ssh_host_ecdsa_key(?!\\.pub)", riskLevel: "critical", desc: "SSH \u4E3B\u673A ECDSA \u79C1\u94A5", credential: true }
+      { path: "/etc/ssh/ssh_host_ecdsa_key(?!\\.pub)", riskLevel: "critical", desc: "SSH \u4E3B\u673A ECDSA \u79C1\u94A5", credential: true },
+      // Nginx 配置（仅拦截写入，对齐 Python linux.py sensitive_paths）
+      { path: "/etc/nginx/nginx.conf", riskLevel: "high", desc: "Nginx \u4E3B\u914D\u7F6E" },
+      { path: "/etc/nginx/conf.d/", riskLevel: "high", desc: "Nginx \u5B50\u914D\u7F6E\u76EE\u5F55" },
+      { path: "/etc/nginx/sites-enabled/", riskLevel: "high", desc: "Nginx \u542F\u7528\u7AD9\u70B9\u914D\u7F6E\u76EE\u5F55" }
     ];
     HOME_SENSITIVE_PATHS = [
       { path: ".ssh/id_rsa", riskLevel: "critical", desc: "SSH \u79C1\u94A5", credential: true },
@@ -2299,7 +2303,7 @@ function runHeuristicCheck(input) {
       }
     }
   }
-  const injectionText = `${input.aNext.actionType} ${input.aNext.actionDetail} ${input.reason || ""} ${input.promptSession || ""}`.toLowerCase();
+  const injectionText = isSearchActionType(input.aNext.actionType) ? `${input.aNext.actionType} ${input.reason || ""} ${input.promptSession || ""}`.toLowerCase() : `${input.aNext.actionType} ${input.aNext.actionDetail} ${input.reason || ""} ${input.promptSession || ""}`.toLowerCase();
   const injectionHits = checkInjectionKeywords(injectionText, agentExt?.extra_injection_keywords);
   if (injectionHits.length > 0) {
     const topHit = injectionHits.reduce((a, b) => severityRank(a.riskLevel) >= severityRank(b.riskLevel) ? a : b);
@@ -2375,6 +2379,12 @@ function stripLiteralTextSegments(actionDetail) {
   }
   return resultParts.join("");
 }
+function stripHeredocContent(actionDetail) {
+  return actionDetail.replace(
+    /<<-?\s*(?:['"]?)([A-Za-z_][A-Za-z0-9_]*)(?:['"]?)[^\n]*\n[\s\S]*?\n\s*\1\s*(?:\n|$)/g,
+    "<<heredoc>>\n"
+  );
+}
 function splitCommandSegments(actionDetail) {
   const segments = [];
   let cur = "";
@@ -2420,6 +2430,10 @@ function severityRank(s) {
   const ranks = { low: 1, medium: 2, high: 3, critical: 4 };
   return ranks[s] || 0;
 }
+function isSearchActionType(actionType) {
+  const at = actionType.toLowerCase();
+  return SEARCH_ACTION_PREFIXES.some((p) => at.startsWith(p)) || ["websearch", "web_search", "search", "query"].includes(at);
+}
 function checkSensitivePath(command, cwd, agentExt) {
   const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
   const isWriteOpFlag = isWriteOperation("", command);
@@ -2539,11 +2553,13 @@ function checkSensitivePath(command, cwd, agentExt) {
 }
 function checkDangerousPatterns(actionType, actionDetail) {
   if (actionType === "file_write" || actionType === "file_edit") return null;
+  const scan = stripHeredocContent(actionDetail);
   const TEMP_DIRS = ["/tmp", "/var/tmp", "/run", "/dev/shm"];
   const isTempPath = TEMP_DIRS.some(
     (td) => new RegExp(`(?:^|[\\s/])${td.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[\\s/]|$)`).test(actionDetail)
   );
-  if (!isTempPath && (actionDetail.includes("*") || actionDetail.includes("?")) && ["rm ", "rm	", "del ", "del	", "delete", "remove ", "remove	", "\u5220\u9664", "\u79FB\u9664"].some((kw) => actionDetail.includes(kw))) {
+  const wildcardDeleteRe = /(?:\brm\b|\b(r?mdir|del|delete|remove|rmdir|unlink)\b|\b删除\b|\b移除\b)[\s\S]{0,40}?[*?]|[*?][\s\S]{0,40}?\b(?:rm|del|delete|remove|rmdir|unlink)\b|rm\s+-[a-zA-Z]*[rf][a-zA-Z]*\s+\S*[*?]/i;
+  if (!isTempPath && wildcardDeleteRe.test(scan)) {
     return {
       allowed: false,
       reason: "\u68C0\u6D4B\u5230\u901A\u914D\u7B26\u7ED3\u5408\u5220\u9664\u64CD\u4F5C\uFF0C\u53EF\u80FD\u9020\u6210\u6279\u91CF\u8BEF\u5220",
@@ -2685,7 +2701,7 @@ function checkLateralMovement(actionDetail) {
   }
   return null;
 }
-var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, SENSITIVE_EXCLUDED_PREFIXES;
+var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES;
 var init_heuristic = __esm({
   "src/engine/heuristic.ts"() {
     "use strict";
@@ -2806,7 +2822,10 @@ var init_heuristic = __esm({
       { pattern: />\s*\/boot\//i, severity: "critical", description: "\u8986\u76D6\u5199\u5165\u542F\u52A8\u5F15\u5BFC\u76EE\u5F55", riskType: "file_access" },
       // 注：/proc/ 重定向覆盖走 checkSensitivePath 的 high（内核参数 /proc/sys/），此处不拦 /proc/ 避免遮蔽（对齐 Python）。
       // --- High: download script + execute risk ---
+      // curl -X POST 外传敏感信息（对齐 Python linux.py: curl POST env/key/token）
+      { pattern: /curl\s+.*-X\s+POST.*\b(env|environment|secret|key|token|password)\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u901A\u8FC7 curl POST \u5916\u4F20\u53EF\u80FD\u5305\u542B\u654F\u611F\u4FE1\u606F\u7684\u8BF7\u6C42", riskType: "data_exfiltration" },
       { pattern: /(?:curl|wget)\s+.*(?:-o|--output|>)\s*\S+\.(?:sh|bash)\b/i, severity: "high", description: "\u8FDC\u7A0B\u4E0B\u8F7D\u811A\u672C\u5230\u672C\u5730", riskType: "script_execution" },
+      { pattern: /(?:curl|wget)\s+\S+.*\b(?:chmod|chown)\s+\+x\b/i, severity: "high", description: "\u8FDC\u7A0B\u4E0B\u8F7D\u540E\u4FEE\u6539\u53EF\u6267\u884C\u6743\u9650\uFF0C\u5B58\u5728\u8FDC\u7A0B\u4EE3\u7801\u6267\u884C\u98CE\u9669", riskType: "script_execution" },
       { pattern: /(?:curl|wget)\s+.*\s+&&?\s*(?:chmod\s+\+x|bash|sh)/i, severity: "high", description: "\u4E0B\u8F7D\u540E\u6267\u884C", riskType: "script_execution" },
       // --- High: package manager pipe-to-shell ---
       { pattern: /git\s+clone\s+.*\|.*bash/i, severity: "high", description: "git clone pipe shell", riskType: "script_execution" },
@@ -2848,6 +2867,7 @@ var init_heuristic = __esm({
       { pattern: /\b(useradd|luseradd|groupadd|usermod|lusermod|groupmod|lgroupmod)\b[^&|;]*?\s-p\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u901A\u8FC7 -p \u53C2\u6570\u8BBE\u7F6E\u6216\u4FEE\u6539\u5BC6\u7801 (useradd/usermod/groupmod)", riskType: "script_execution" }
     ];
     SENSITIVE_EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
+    SEARCH_ACTION_PREFIXES = ["search-", "web-", "browser-", "query-", "websearch", "web_search"];
   }
 });