@kenhkl/agent-moss 0.12.3 → 0.12.5

package/dist/rules/l1_rules.json

@@ -323,6 +323,12 @@
       "risk_level": "medium",
       "risk_type": "data_exfiltration",
       "reason": "导出敏感凭证"
+    },
+    {
+      "pattern": "(?:\\$\\(|`)\\s*(?:\\S+=\\S*\\s+)*(?:touch|rm|mkdir|mv|cp|dd|tee|truncate|chmod|chown|mkfifo|mknod|ln|shred|mkfs|nc|ncat|socat|bash|sh|zsh|dash|python|python3|perl|ruby|node|php|eval|exec|base64|sudo|su)\\b",
+      "risk_level": "critical",
+      "risk_type": "script_execution",
+      "reason": "检测到命令替换隐藏执行（$(...)/反引号载荷含写/执行命令），可能产生文件系统副作用"
     }
   ],
   "injection_detection": [

package/dist/server.js

@@ -2783,6 +2783,7 @@ var init_heuristic = __esm({
 var token_stats_exports = {};
 __export(token_stats_exports, {
   getRecentRecords: () => getRecentRecords,
+  getRecentRecordsCount: () => getRecentRecordsCount,
   getTokenStats: () => getTokenStats,
   getTokenTrend: () => getTokenTrend,
   recordTokenUsage: () => recordTokenUsage,
@@ -2903,9 +2904,14 @@ function getTokenStats(days = 0, startDate, endDate) {
     by_date: a.byDate
   };
 }
-function getRecentRecords(limit = 20) {
+function getRecentRecords(limit = 20, offset = 0) {
   const records = loadAllRecords(getStatsPath());
-  return records.slice(-limit);
+  const start = Math.max(0, records.length - offset - limit);
+  const end = records.length - offset;
+  return records.slice(start, end);
+}
+function getRecentRecordsCount() {
+  return loadAllRecords(getStatsPath()).length;
 }
 function getTokenTrend(days = 0, startDate, endDate) {
   const records = filterByDate(loadAllRecords(getStatsPath()), days, startDate, endDate);
@@ -4661,10 +4667,10 @@ function formatPromptHistory(promptHistory, maxTextChars = 500) {
   const lines = [];
   for (let i = 0; i < promptHistory.length; i++) {
     const turn = promptHistory[i];
-    const text = (turn?.text || "").trim();
+    const text = (typeof turn === "string" ? turn : turn?.text || "").trim();
     if (!text) continue;
     let line = `  \u7B2C${i + 1}\u8F6E\u7528\u6237\u610F\u56FE: ${text.slice(0, maxTextChars)}`;
-    const actions = turn?.actions;
+    const actions = typeof turn === "string" ? void 0 : turn?.actions;
     if (actions && actions.length > 0) {
       const types = actions.map((a) => a?.actionType).filter((t) => typeof t === "string" && t.length > 0);
       if (types.length > 0) {
@@ -5468,7 +5474,8 @@ function createConsoleRouter() {
   });
   console2.get("/api/token-stats/recent", (c) => {
     const limit = parseInt(c.req.query("limit") || "20", 10);
-    return c.json(getRecentRecords(limit));
+    const offset = parseInt(c.req.query("offset") || "0", 10);
+    return c.json({ records: getRecentRecords(limit, offset), total: getRecentRecordsCount() });
   });
   console2.get("/api/token-stats/trend", (c) => {
     const days = parseInt(c.req.query("days") || "7", 10);