@kenhkl/agent-moss 0.12.8 → 0.13.0

package/dist/rules/mc_rules.json

@@ -0,0 +1,137 @@
+{
+  "_comment": "L2.2 模型检测规则单一事实源（Python + TS 共用）。原子命题正则 + LTL 公式（前缀 AST）。公式在事件迹位置 0 处评估：LTL 公式满足 = 攻击存在。对应站点 detection-l2-2.html 的 10 条 LTL + 5 条 CTL 规则（CTL 活性降级为 G(!φ) 安全不变量，见 docs/DETECTION_METHODS.md 5.4）。",
+  "ap_patterns": {
+    "reads_credential": [
+      "known_hosts|\\.ssh|id_rsa|\\.pem|/etc/shadow|/etc/passwd|\\.aws/credentials|credentials\\.json|netrc|secrets?\\.ya?ml|credential"
+    ],
+    "network_egress": [
+      "https?://|scp\\s+.*@|rsync\\s+.*@|curl\\s+(-X\\s+POST|--data|-F)|wget\\s+--post|base64\\s+.*-o"
+    ],
+    "execute_file": [
+      "subprocess|os\\.system|shell\\s*=\\s*True|\\beval\\(|\\bexec\\(|bash\\s+|sh\\s+-c|python\\s+|node\\s+|\\.\\/|chmod\\s+\\+x"
+    ],
+    "write_file": [
+      ">\\s*/|tee\\s+/-o\\s+|>>\\s*/|mv\\s+.*/|cp\\s+.*/"
+    ],
+    "delete_file": [
+      "\\brm\\s+|\\bunlink\\s+|\\brmdir\\s+"
+    ],
+    "disable_security": [
+      "iptables\\s+-F|setenforce\\s+0|systemctl\\s+stop\\s+(firewall|apparmor|fail2ban)|ufw\\s+disable"
+    ],
+    "install_persistence": [
+      "crontab\\s+-e|echo.*\\|\\s*crontab|systemctl\\s+(enable|start)|/etc/init\\.d|\\.bashrc|\\.profile|at\\s+now|systemd"
+    ],
+    "privilege_escalation": [
+      "\\bsudo\\b|\\bsu\\b|chmod\\s+u\\s*\\+\\s*s|setcap|pkexec|doas|setuid"
+    ],
+    "download_file": [
+      "curl\\s+.*(-o|--output)\\s+|wget\\s+|git\\s+clone\\s+|docker\\s+pull\\s+|pip\\s+install\\s+"
+    ],
+    "archive_data": [
+      "\\btar\\s+|\\bzip\\s+|gzip|base64\\s+|7z\\s+"
+    ],
+    "prompt_injection": [
+      "ignore (?:previous|prior|all) (?:instructions?|commands?)|<INFORMATION>|TODO:\\s*(?:send|email|transfer|delete|forward|reserve)"
+    ],
+    "sensitive_data": [
+      "api[_-]?token|access[_-]?token|bearer\\s+[a-z0-9._-]+|sk-[a-z0-9_-]+|-----BEGIN [A-Z ]*PRIVATE KEY-----|\\.env(?:\\.[a-z0-9_-]+)?|ssn|credit card|bank account|iban"
+    ],
+    "lateral_movement": [
+      "\\bssh\\s+.*@|scp\\s+.*@|rsync\\s+.*@"
+    ],
+    "clear_logs": [
+      "history\\s+-c|>/var/log/|journalctl.*--vacuum|logrotate.*-f|shred.*(log|journal)|rm\\s+(-rf|-r)\\s+/var/log/|truncate.*log"
+    ]
+  },
+  "rules": [
+    {
+      "id": "mc-ltl-001",
+      "type": "ltl",
+      "formula": ["F", ["&", ["ap", "reads_credential"], ["F", ["ap", "network_egress"]]]],
+      "risk_level": "critical",
+      "action": "block",
+      "reason": "凭证读取后网络外传（mc-ltl-001）"
+    },
+    {
+      "id": "mc-ltl-002",
+      "type": "ltl",
+      "formula": ["F", ["&", ["ap", "download_file"], ["F", ["ap", "execute_file"]]]],
+      "risk_level": "critical",
+      "action": "block",
+      "reason": "下载后执行（mc-ltl-002）"
+    },
+    {
+      "id": "mc-ltl-003",
+      "type": "ltl",
+      "formula": ["F", ["&", ["ap", "disable_security"], ["F", ["|", ["ap", "execute_file"], ["|", ["ap", "delete_file"], ["ap", "privilege_escalation"]]]]]],
+      "risk_level": "critical",
+      "action": "block",
+      "reason": "禁用安全后破坏性操作（mc-ltl-003）"
+    },
+    {
+      "id": "mc-ltl-004",
+      "type": "ltl",
+      "formula": ["F", ["&", ["ap", "prompt_injection"], ["F", ["|", ["ap", "network_egress"], ["|", ["ap", "write_file"], ["ap", "execute_file"]]]]]],
+      "risk_level": "critical",
+      "action": "block",
+      "reason": "注入后敏感操作（mc-ltl-004）"
+    },
+    {
+      "id": "mc-ltl-005",
+      "type": "ltl",
+      "formula": ["F", ["&", ["ap", "reads_credential"], ["F", ["ap", "lateral_movement"]]]],
+      "risk_level": "critical",
+      "action": "block",
+      "reason": "凭证读取后横向移动（mc-ltl-005）"
+    },
+    {
+      "id": "mc-ltl-006",
+      "type": "ltl",
+      "formula": ["F", ["&", ["ap", "sensitive_data"], ["F", ["ap", "clear_logs"]]]],
+      "risk_level": "critical",
+      "action": "block",
+      "reason": "敏感数据访问后清除日志（mc-ltl-006）"
+    },
+    {
+      "id": "mc-ltl-007",
+      "type": "ltl",
+      "formula": ["F", ["&", ["ap", "privilege_escalation"], ["F", ["ap", "install_persistence"]]]],
+      "risk_level": "critical",
+      "action": "block",
+      "reason": "提权后安装持久化（mc-ltl-007）"
+    },
+    {
+      "id": "mc-ltl-008",
+      "type": "ltl",
+      "formula": ["F", ["&", ["ap", "download_file"], ["F", ["ap", "install_persistence"]]]],
+      "risk_level": "critical",
+      "action": "block",
+      "reason": "下载后安装持久化（mc-ltl-008）"
+    },
+    {
+      "id": "mc-ltl-009",
+      "type": "ltl",
+      "formula": ["F", ["&", ["ap", "sensitive_data"], ["F", ["&", ["ap", "archive_data"], ["F", ["ap", "network_egress"]]]]]],
+      "risk_level": "critical",
+      "action": "block",
+      "reason": "敏感数据→归档→外传（mc-ltl-009）"
+    },
+    {
+      "id": "mc-ltl-010",
+      "type": "ltl",
+      "formula": ["F", ["ap", "install_persistence"]],
+      "risk_level": "medium",
+      "action": "approval",
+      "reason": "持久化机制安装，需审批（mc-ltl-010）"
+    },
+    {
+      "id": "mc-ctl-001",
+      "type": "ltl",
+      "formula": ["F", ["ap", "clear_logs"]],
+      "risk_level": "critical",
+      "action": "block",
+      "reason": "安全不变量：任何情况不得清除日志（mc-ctl-001，AG(!clear_logs) 线性迹降级：违反 ⟺ 出现 clear_logs ⟺ F(clear_logs) 成立）"
+    }
+  ]
+}

package/dist/rules/tool_registry.json

@@ -0,0 +1,25 @@
+{
+  "_comment": "Tool Registry — 工具名/命令 → 数据流属性（单一事实源，双端共用）。对齐站点 registry.ts：actionClass（read/write/compute/network_egress/message_egress/unknown）+ requireHighIntegrity（该工具是否要求高完整性输入）。驱动 Rule 5/9/10/11 的按动作类分流 block/observe 与低完整性判定。",
+  "tools": {
+    "bash": { "actionClass": "compute", "requireHighIntegrity": true },
+    "shell": { "actionClass": "compute", "requireHighIntegrity": true },
+    "terminal": { "actionClass": "compute", "requireHighIntegrity": true },
+    "cmd": { "actionClass": "compute", "requireHighIntegrity": true },
+    "python": { "actionClass": "compute", "requireHighIntegrity": true },
+    "node": { "actionClass": "compute", "requireHighIntegrity": true },
+    "exec": { "actionClass": "compute", "requireHighIntegrity": true },
+    "curl": { "actionClass": "network_egress", "requireHighIntegrity": false },
+    "wget": { "actionClass": "network_egress", "requireHighIntegrity": false },
+    "scp": { "actionClass": "network_egress", "requireHighIntegrity": false },
+    "rsync": { "actionClass": "network_egress", "requireHighIntegrity": false },
+    "nc": { "actionClass": "network_egress", "requireHighIntegrity": false },
+    "file.read": { "actionClass": "read", "requireHighIntegrity": false },
+    "file_read": { "actionClass": "read", "requireHighIntegrity": false },
+    "read_file": { "actionClass": "read", "requireHighIntegrity": false },
+    "cat": { "actionClass": "read", "requireHighIntegrity": false },
+    "file.write": { "actionClass": "write", "requireHighIntegrity": false },
+    "file_write": { "actionClass": "write", "requireHighIntegrity": false },
+    "write_file": { "actionClass": "write", "requireHighIntegrity": false },
+    "echo": { "actionClass": "write", "requireHighIntegrity": false }
+  }
+}

package/dist/scenarios/__init__.py

@@ -109,11 +109,40 @@ def clear_scenario_extensions_cache() -> None:
         _cache.clear()
 
 
+def get_scenario_extensions_multi(scenario_spec: str | None) -> AgentExtensions | None:
+    """按逗号分隔的场景列表加载并合并扩展（AGENT_MOSS_SCENARIO 支持多场景）。
+
+    引擎层兜底 env 时使用：`AGENT_MOSS_SCENARIO=bank,meow` 会被拆成多个场景 id，
+    逐个加载后合并成一个 AgentExtensions（append 语义，与 console 的
+    _enabled_scenario_ids 逗号分隔口径一致）。
+
+    Args:
+        scenario_spec: 逗号分隔的场景 id 字符串（可为空）。
+
+    Returns:
+        合并后的 AgentExtensions，或 None（无任何场景可加载）。
+    """
+    if not scenario_spec:
+        return None
+    ids = [s.strip() for s in scenario_spec.split(",") if s.strip()]
+    if not ids:
+        return None
+    exts = [get_scenario_extensions(sid) for sid in ids]
+    non_null = [e for e in exts if e is not None]
+    if not non_null:
+        return None
+    merged: AgentExtensions | None = non_null[0]
+    for e in non_null[1:]:
+        merged = AgentExtensions.merge(merged, e)
+    return merged
+
+
 __all__ = [
     "AgentExtensions",
     "InjectionKeyword",
     "CommandPattern",
     "SensitivePath",
     "get_scenario_extensions",
+    "get_scenario_extensions_multi",
     "clear_scenario_extensions_cache",
 ]