@kenhkl/agent-moss 0.12.6 → 0.12.8

package/dist/rules/l1_rules.json

@@ -822,6 +822,27 @@
       "desc": "环境变量/凭据配置文件",
       "deny_mode": "deny_both",
       "scope": "credential"
+    },
+    {
+      "path": ".config/agentmoss/config.json",
+      "risk_level": "critical",
+      "desc": "AgentMoss 配置中的 LLM api_key（凭据），读=泄露，写=篡改，均不可",
+      "deny_mode": "deny_both",
+      "scope": "home"
+    },
+    {
+      "path": ".config/agentmoss",
+      "risk_level": "high",
+      "desc": "AgentMoss 自身配置目录（runtime 规则/token 用量），agent 可读但不可写（防篡改关闭安全检测）",
+      "deny_mode": "deny_write",
+      "scope": "home"
+    },
+    {
+      "path": ".agentmoss/brain",
+      "risk_level": "high",
+      "desc": "AgentMoss Brain 数据（rules.json/skill_meta.json 自学习成果），agent 可读自查但不可写（防投毒）",
+      "deny_mode": "deny_write",
+      "scope": "home"
     }
   ]
 }

package/dist/rules/l2_rules.json

@@ -78,5 +78,140 @@
     {
       "pattern": "\\blgroupdel\\s"
     }
-  ]
+  ],
+  "combo_chains": {
+    "_comment": "L2 组合攻击链检测：单步操作可能无害，但按 kill chain 顺序组合即为后渗透攻击（参考 ChainWatch 六阶段 kill chain / 玄武实验室 Hermes 案例）。阶段 pattern 匹配 action_detail（含 tool call 参数），链定义要求至少 min_stages 个阶段按顺序出现才命中，防单步误报。A 会话内杀伤链 / D 提权-利用组合 / E 持久化-外联组合在 L2 实现（基于 action_history 子序列匹配）；B 跨会话组合链 / C 敏感数据传播链 / F 跨设备组合依赖行为图与数据流，由 formal_engine 实现。",
+    "stages": {
+      "LISTEN": [
+        "\\bflask\\b",
+        "\\bfastapi\\b",
+        "httpserver",
+        "http\\.server",
+        "\\bnc\\s+-l",
+        "\\bsocat\\b",
+        "nohup\\s+.*\\bpython",
+        "create\\s+.*listener",
+        "listen\\("
+      ],
+      "EXEC": [
+        "subprocess",
+        "os\\.system",
+        "shell\\s*=\\s*True",
+        "\\beval\\(",
+        "\\bexec\\(",
+        "/exec",
+        "\\bbash\\s+-c",
+        "run.*command"
+      ],
+      "SCAN": [
+        "\\bnc\\s+-z",
+        "\\bnmap\\b",
+        "port\\s*scan",
+        "\\bseq\\b.*\\bnc\\b",
+        "192\\.168\\..*nc",
+        "scan.*\\bport"
+      ],
+      "CRED": [
+        "known_hosts",
+        "\\.ssh",
+        "id_rsa",
+        "/etc/shadow",
+        "/etc/passwd",
+        "credential",
+        "aws.*credentials"
+      ],
+      "EXFIL": [
+        "\\bcurl\\s+.*https?://",
+        "\\bwget\\s+.*https?://",
+        "\\bscp\\s+.*@",
+        "\\brsync\\s+.*@",
+        "POST.*https?://"
+      ],
+      "PERSIST": [
+        "\\bcrontab\\b",
+        "\\bsystemd\\b",
+        "systemctl\\s+enable",
+        "\\.bashrc",
+        "\\.profile",
+        "/etc/rc\\.local",
+        "\\bnohup\\b",
+        "\\bdaemon\\b",
+        "startup\\s+item",
+        "\\bat\\s+reboot"
+      ],
+      "PRIVESC": [
+        "\\bsudo\\b",
+        "\\bsu\\b",
+        "chmod\\s+u\\s*\\+\\s*s",
+        "\\bsetuid\\b",
+        "\\bpkexec\\b",
+        "\\bdoas\\b"
+      ]
+    },
+    "chains": [
+      {
+        "id": "listener-exec-scan",
+        "stages": ["LISTEN", "EXEC", "SCAN"],
+        "min_stages": 3,
+        "risk_level": "high",
+        "reason": "组合攻击链：建立监听服务 → 获取命令执行能力 → 网络侦察"
+      },
+      {
+        "id": "listener-exec-cred",
+        "stages": ["LISTEN", "EXEC", "CRED"],
+        "min_stages": 3,
+        "risk_level": "critical",
+        "reason": "组合攻击链：建立监听服务 → 获取命令执行能力 → 访问凭据文件"
+      },
+      {
+        "id": "listener-exec-exfil",
+        "stages": ["LISTEN", "EXEC", "EXFIL"],
+        "min_stages": 3,
+        "risk_level": "critical",
+        "reason": "组合攻击链：建立监听服务 → 获取命令执行能力 → 数据外传"
+      },
+      {
+        "id": "listener-exec-persist",
+        "stages": ["LISTEN", "EXEC", "PERSIST"],
+        "min_stages": 3,
+        "risk_level": "high",
+        "reason": "组合攻击链：建立监听服务 → 获取命令执行能力 → 持久化后门"
+      },
+      {
+        "id": "exec-scan-cred",
+        "stages": ["EXEC", "SCAN", "CRED"],
+        "min_stages": 3,
+        "risk_level": "high",
+        "reason": "组合攻击链：获取命令执行能力 → 网络侦察 → 访问凭据文件"
+      },
+      {
+        "id": "exec-privesc-cred",
+        "stages": ["EXEC", "PRIVESC", "CRED"],
+        "min_stages": 3,
+        "risk_level": "high",
+        "reason": "组合攻击链：获取命令执行能力 → 提权 → 访问凭据文件"
+      },
+      {
+        "id": "privesc-cred-exfil",
+        "stages": ["PRIVESC", "CRED", "EXFIL"],
+        "min_stages": 3,
+        "risk_level": "critical",
+        "reason": "组合攻击链：提权 → 访问凭据文件 → 数据外传"
+      },
+      {
+        "id": "persist-exfil",
+        "stages": ["PERSIST", "EXFIL"],
+        "min_stages": 2,
+        "risk_level": "high",
+        "reason": "组合攻击链：持久化后门 → 数据外传（C2 信标）"
+      },
+      {
+        "id": "exec-persist-exfil",
+        "stages": ["EXEC", "PERSIST", "EXFIL"],
+        "min_stages": 3,
+        "risk_level": "critical",
+        "reason": "组合攻击链：获取命令执行能力 → 持久化后门 → 数据外传"
+      }
+    ]
+  }
 }

package/dist/scenarios/__init__.py

@@ -0,0 +1,119 @@
+"""场景定制化规则注册中心（客户沙箱场景级规则）
+
+按 `scenario_id` 加载该场景的专属规则集（JSON 单一事实源）。
+规则文件位置：`agent_moss/scenarios/<scenario_id>/rules.json`
+
+与 agent 定制规则（agent_moss/agents/<id>/rules.json）**同构**——场景规则也是
+`AgentExtensions` 结构（extra_command_patterns / extra_injection_keywords /
+extra_sensitive_paths / builtin_safe_skills / builtin_safe_action_types），
+唯一区别是顶层 id 字段叫 `scenario_id` 而非 `agent_id`，由
+`AgentExtensions.from_json(..., id_key="scenario_id")` 解析。
+
+设计动机：agent 规则靠调用方传 `agent_id`（真实 agent instance 身份）启用；
+场景规则是**部署级**约束（客户沙箱的目录访问边界、禁 ssh 等），没有天然调用方
+身份，启用判定为：
+1. 调用方显式传 `scenario_id`（请求级，与 agent_id 并列）
+2. 兜底环境变量 `AGENT_MOSS_SCENARIO`（部署级，客户沙箱设一次，所有请求生效）
+3. 两者都空 → 通用模式（不加载场景规则）
+
+使用：
+    from agent_moss.scenarios import get_scenario_extensions
+    ext = get_scenario_extensions("bank")
+    if ext:
+        # 把 ext.extra_command_patterns 追加到 agent_ext/通用规则之后
+        ...
+
+Python 与 TypeScript 两端共享同一份 rules.json：
+- py: agent_moss/scenarios/__init__.py:get_scenario_extensions
+- ts: ts/src/scenarios/index.ts:getScenarioExtensions
+
+无 scenario_id 或 rules.json 不存在时返回 None（通用模式）。
+"""
+
+from pathlib import Path
+import threading
+import logging
+
+# 场景规则与 agent 规则同构：复用 AgentExtensions 数据载体（agents/base.py）
+from ..agents.base import AgentExtensions, InjectionKeyword, CommandPattern, SensitivePath  # noqa: F401
+
+logger = logging.getLogger(__name__)
+
+_SCENARIOS_DIR = Path(__file__).parent
+_cache: dict[str, AgentExtensions | None] = {}
+_lock = threading.Lock()
+
+
+def get_scenario_extensions(scenario_id: str) -> AgentExtensions | None:
+    """按 scenario_id 加载该场景的专属规则集。
+
+    Args:
+        scenario_id: 场景标识，如 "bank"。空字符串返回 None（通用模式）。
+
+    Returns:
+        AgentExtensions 实例，或 None（无场景专属规则 / rules.json 不存在）。
+    """
+    if not scenario_id:
+        return None
+
+    # 双重检查锁定，避免并发重复 IO
+    if scenario_id in _cache:
+        return _cache[scenario_id]
+
+    with _lock:
+        if scenario_id in _cache:
+            return _cache[scenario_id]
+
+        # 统一存储：优先读 runtime_config 的 scenario_rules 分区（用户可在 console
+        # 查看/编辑/禁用/新增，与 agent_rules 同构，享受一致的合并升级）。回退
+        # rules.json（无 runtime_config 时，如直接起服务未 seed、或旧部署）。
+        ext = None
+        try:
+            from ..infra.runtime_config import (has_runtime_config, load_runtime_config,
+                                               get_enabled_scenario_extensions)
+            if has_runtime_config():
+                ext = get_enabled_scenario_extensions(load_runtime_config(), scenario_id)
+        except Exception:
+            pass  # runtime_config 不可用时回退 rules.json
+
+        if ext is None:
+            rules_file = _SCENARIOS_DIR / scenario_id / "rules.json"
+            if not rules_file.exists():
+                logger.debug("场景 %s 无 rules.json，走通用模式", scenario_id)
+                _cache[scenario_id] = None
+                return None
+            try:
+                ext = AgentExtensions.from_json(rules_file, id_key="scenario_id")
+            except Exception as e:
+                logger.error("加载场景 %s rules.json 失败: %s", scenario_id, e)
+                _cache[scenario_id] = None
+                return None
+
+        _cache[scenario_id] = ext
+        logger.info(
+            "加载场景 %s 定制规则: %d cmd patterns, %d injection keywords, "
+            "%d sensitive paths, %d builtin safe skills, %d builtin safe action types",
+            scenario_id,
+            len(ext.extra_command_patterns),
+            len(ext.extra_injection_keywords),
+            len(ext.extra_sensitive_paths),
+            len(ext.builtin_safe_skills),
+            len(ext.builtin_safe_action_types),
+        )
+        return ext
+
+
+def clear_scenario_extensions_cache() -> None:
+    """清空场景扩展缓存（用于测试或 rules.json 热加载）"""
+    with _lock:
+        _cache.clear()
+
+
+__all__ = [
+    "AgentExtensions",
+    "InjectionKeyword",
+    "CommandPattern",
+    "SensitivePath",
+    "get_scenario_extensions",
+    "clear_scenario_extensions_cache",
+]

package/dist/scenarios/bank/rules.json

@@ -0,0 +1,23 @@
+{
+  "scenario_id": "bank",
+  "description": "银行沙箱场景定制规则。客户约束：沙箱用户（sandbox）仅允许读写 /home/sandbox、/opt/sandbox、/tmp 三个目录，其他根目录一律禁止读写；禁止执行 ssh 命令（横向移动/远程访问）。",
+  "extra_command_patterns": [
+    {
+      "pattern": "(?:^|[;\\s>&|@'\"])(/(?!home/sandbox(?:\\s|/|$)|opt/sandbox(?:\\s|/|$)|tmp(?:\\s|/|$))[^\\s;&|>\"]+)",
+      "risk_level": "high",
+      "risk_type": "file_access",
+      "reason": "bank 场景：访问允许目录（/home/sandbox、/opt/sandbox、/tmp）之外的绝对路径"
+    },
+    {
+      "pattern": "(?:^|[;&|:]\\s*)ssh(?:\\s|$)",
+      "risk_level": "critical",
+      "risk_type": "network_access",
+      "reason": "bank 场景：禁止执行 ssh 命令（横向移动/远程访问）"
+    }
+  ],
+  "extra_injection_keywords": [],
+  "extra_sensitive_paths": [],
+  "builtin_safe_skills": [],
+  "builtin_safe_action_types": [],
+  "extra_skills": []
+}