@kenhkl/agent-moss 0.14.0 → 0.15.0

package/dist/engine/coordinator.js

@@ -628,10 +628,15 @@ function loadMC() {
   try {
     const rt = (init_runtime_config(), __toCommonJS(runtime_config_exports));
     if (rules.length > 0 && typeof rt.hasRuntimeConfig === "function" && rt.hasRuntimeConfig()) {
-      const rtRules = rt.loadRuntimeConfig()?.L2_2?.ltl_rules?.rules || [];
+      const ltl = rt.loadRuntimeConfig()?.L2_2?.ltl_rules || {};
+      const rtRules = ltl.rules || [];
       const enabledById = {};
       for (const r of rtRules) if (r?.id) enabledById[r.id] = r.enabled !== false;
-      for (const r of rules) if (r?.id && r.id in enabledById) r.enabled = enabledById[r.id];
+      const catEnabled = ltl.category_enabled !== false;
+      for (const r of rules) {
+        if (r?.id && r.id in enabledById) r.enabled = enabledById[r.id];
+        if (!catEnabled) r.enabled = false;
+      }
     }
   } catch {
   }
@@ -1429,6 +1434,7 @@ __export(runtime_config_exports, {
   isLayerEnabled: () => isLayerEnabled,
   loadRuntimeConfig: () => loadRuntimeConfig,
   mergeConfig: () => mergeConfig,
+  pickDeletableRule: () => pickDeletableRule,
   saveRuntimeConfig: () => saveRuntimeConfig,
   updateAgentCategoryEnabled: () => updateAgentCategoryEnabled,
   updateAgentRuleEnabled: () => updateAgentRuleEnabled,
@@ -1594,8 +1600,16 @@ function getDisabledL2RulesWithSkipL3() {
 function _slugify(text) {
   return text.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_|_$/g, "") || "x";
 }
+function _fnv1a32(text) {
+  let h = 2166136261;
+  for (const b of Buffer.from(text, "utf-8")) {
+    h ^= b;
+    h = h * 16777619 >>> 0;
+  }
+  return h.toString(16).padStart(8, "0");
+}
 function _generatePatternId(pattern) {
-  return `pat_${_slugify(pattern)}`;
+  return `pat_${_slugify(pattern)}_${_fnv1a32(pattern)}`;
 }
 function _deriveDenyMode(rule) {
   if (rule.deny_mode) return rule.deny_mode;
@@ -1881,10 +1895,13 @@ function generateSourceDefaults() {
 }
 function _ltlRulesToRuntime() {
   const cands = [
-    join3(__dirname4, "..", "rules"),
-    join3(__dirname4, "..", "..", "..", "agent_moss", "rules"),
-    join3(process.cwd(), "agent_moss", "rules")
-  ];
+    getRuntimeConfigDir() && join3(getRuntimeConfigDir(), "rules"),
+    join3(__dirname4, "../rules"),
+    join3(__dirname4, "rules"),
+    join3(__dirname4, "../../../agent_moss/rules"),
+    join3(__dirname4, "../../../../agent_moss/rules"),
+    join3(process.cwd(), "agent_moss/rules")
+  ].filter(Boolean);
   let mc = {};
   for (const dir of cands) {
     const p = join3(dir, "mc_rules.json");
@@ -2244,16 +2261,20 @@ function addCustomRule(layer, category, rule) {
   saveRuntimeConfig(runtime);
   return runtime;
 }
-function deleteCustomRule(layer, category, ruleId) {
-  const runtime = loadRuntimeConfig();
-  const rules = runtime[layer]?.[category]?.rules || [];
-  const idx = rules.findIndex((r) => r.id === ruleId);
+function pickDeletableRule(rules, ruleId) {
+  const idx = rules.findIndex((r) => r.id === ruleId && (!r.builtin || r.source_removed));
   if (idx >= 0) {
-    const r = rules[idx];
-    if (r.builtin && !r.source_removed) return null;
     rules.splice(idx, 1);
-    saveRuntimeConfig(runtime);
+    return rules;
   }
+  if (rules.some((r) => r.id === ruleId)) return null;
+  return rules;
+}
+function deleteCustomRule(layer, category, ruleId) {
+  const runtime = loadRuntimeConfig();
+  const rules = runtime[layer]?.[category]?.rules || [];
+  if (pickDeletableRule(rules, ruleId) === null) return null;
+  saveRuntimeConfig(runtime);
   return runtime;
 }
 function addCustomSkill(skillId, category, keywords, content) {
@@ -6492,8 +6513,36 @@ function allCandidates(detail, max = 8) {
   }
   return out;
 }
+var STAGE_PRIORITY = ["EXFIL", "PRIVESC", "PERSIST", "SCAN", "LISTEN"];
+var PURPOSE_EXEC_RE = /subprocess\.\w+\s*\(|os\.system\s*\(|shell\s*=\s*True|\beval\s*\(|\bexec\s*\(|os\.popen\s*\(|\/exec\b/i;
+var LISTEN_LEAD_RE = /http\.server|flask\s+run|nohup\b|nc\s+-l|socat\s+TCP-LISTEN/i;
+var LISTEN_NOISE_RE = /shell\s*=\s*True|os\.system|subprocess\.(?:run|call|Popen)|\beval\s*\(|\bexec\s*\(/i;
 function matchStageAny(detail, stages) {
-  for (const cand of allCandidates(detail)) {
+  const cands = allCandidates(detail);
+  if (cands.length === 0) return "";
+  const shell = cands[0];
+  const hits = [];
+  for (const [name, pats] of Object.entries(stages)) {
+    for (const p of pats) {
+      p.lastIndex = 0;
+      if (p.test(shell)) {
+        hits.push(name);
+        break;
+      }
+    }
+  }
+  if (hits.length > 0) {
+    if (hits.length === 1) return hits[0];
+    if (hits.includes("EXEC") && PURPOSE_EXEC_RE.test(shell)) return "EXEC";
+    if (hits.includes("LISTEN") && LISTEN_LEAD_RE.test(shell) && !LISTEN_NOISE_RE.test(shell)) {
+      return "LISTEN";
+    }
+    for (const s of STAGE_PRIORITY) {
+      if (hits.includes(s)) return s;
+    }
+    if (hits.includes("EXEC")) return "EXEC";
+  }
+  for (const cand of cands.slice(1)) {
     for (const [name, pats] of Object.entries(stages)) {
       for (const p of pats) {
         p.lastIndex = 0;
@@ -6774,7 +6823,7 @@ function loadCrossSessionChains() {
   return CROSS_SESSION_CHAINS;
 }
 var CRED_FILE_RE = /(known_hosts|\.ssh|id_rsa|\/etc\/shadow|\/etc\/passwd|credentials)/i;
-var EXFIL_RE = /https?:\/\/|scp\s+.*@|rsync\s+.*@/i;
+var EXFIL_RE = /https?:\/\/(?!127\.\d+\.\d+\.\d+|0\.0\.0\.0|localhost|\[?::1\]?)[^\s]+|\bscp\s+.*@|\brsync\s+.*@/i;
 function checkCrossSessionChain(graph) {
   const violations = [];
   const nodes = allNodes(graph);
@@ -6875,9 +6924,67 @@ function checkSensitiveDataFlow(graph) {
 }
 var EBPF_NET_RE = /connect|sendto|network_connect/i;
 var REMOTE_RE = /to\s+\d+\.\d+\.\d+\.\d+|remote_addr/i;
-var PRIVESC_RE = /\bsudo\b|\bsu\b|chmod\s+u\s*\+\s*s|pkexec|setuid/i;
 var EXFIL_ACTION_RE = /\bcurl\b|\bwget\b|\bscp\b|\brsync\b|\brclone\b|\bftp\b|connect\s+.*\d+\.\d+\.\d+\.\d+|open\s+.*tcp|base64\s+.*\-o/i;
 var CRED_STRICT_RE = /(known_hosts|\.ssh|id_rsa|\.pem|\b\.key\b|\/etc\/shadow|\/etc\/passwd|\.aws\/credentials|credentials\.json|netrc|password|secrets?\.ya?ml|credentials?\s*(file|path)?\s*(=|\:)|\bconfig.*(password|token))/i;
+var INLINE_SHELL_RE = /(?:os\.system|os\.popen)\s*\(\s*['"]([^'"]+)['"]|subprocess\.[a-z_]+\(\s*\[([^\]]+)\]|subprocess\.[a-z_]+\(\s*['"]([^'"]+)['"]|(?:bash|sh|zsh)\s+-c\s*['"]([^'"]+)['"]/gi;
+function extractInlineShell(s) {
+  const out = [];
+  let m;
+  INLINE_SHELL_RE.lastIndex = 0;
+  while ((m = INLINE_SHELL_RE.exec(s)) !== null) {
+    let g = m[1] ?? m[2] ?? m[3] ?? m[4] ?? "";
+    if (/^["']/.test(g) && (/"\s*,/.test(g) || /'\s*,/.test(g))) {
+      g = g.replace(/['"\[\],]+/g, " ");
+    }
+    g = g.trim();
+    if (g) out.push(g);
+  }
+  return out;
+}
+var PKG_MGR = /* @__PURE__ */ new Set(["apt", "apt-get", "aptitude", "yum", "dnf", "pacman", "zypper", "apk", "brew"]);
+var SHELLS = /* @__PURE__ */ new Set(["bash", "sh", "zsh", "dash", "fish", "ksh", "csh", "tcsh", "nologin"]);
+function containsPrivesc(shell) {
+  if (!shell) return false;
+  for (const seg of shell.split(/\&\&|\|\||;|\n/)) {
+    const s = seg.trim();
+    if (!s) continue;
+    const toks = s.split(/\s+/);
+    const head = (toks[0] || "").toLowerCase();
+    const rest = toks.slice(1).join(" ");
+    if (head === "chmod" && /(?:u\+s|g\+s|[2-7][0-7]{3})/.test(rest)) return true;
+    if (head === "setcap" && /cap_/.test(rest)) return true;
+    if (head === "pkexec" || head === "doas") return true;
+    if (head === "sudo") {
+      if (/^-u\s+/.test(rest)) {
+        if (/^-u\s+root\b/.test(rest)) return true;
+        continue;
+      }
+      const m = /^(\S+)(.*)$/.exec(rest);
+      if (m) {
+        const nxt = m[1].toLowerCase();
+        const tail = m[2];
+        if (PKG_MGR.has(nxt)) continue;
+        if (SHELLS.has(nxt)) return true;
+        if (nxt === "-i" || nxt === "-s") return true;
+        if (nxt.startsWith("su")) return true;
+        if (nxt.startsWith("/") && /bin\/(?:bash|sh|zsh|dash|fish)$/.test(nxt)) return true;
+      }
+      if (/\/(?:usr\/(?:local\/)?bin|bin)\/(?:bash|sh|zsh|dash|fish)\b/.test(rest)) return true;
+      if (/\bchmod\s+(?:u\+s|g\+s|[2-7][0-7]{3})\b/.test(rest)) return true;
+      if (/\bsetcap\s+cap_\w+/.test(rest)) return true;
+      if (/\bvisudo\b/.test(rest)) return true;
+      if (/\bpasswd\s+root\b/.test(rest)) return true;
+      if (/\buseradd\b/.test(rest)) return true;
+    }
+    if (head === "su") {
+      if (!rest) return true;
+      if (/^-l?\s*$/.test(rest)) return true;
+      if (/^root\b/.test(rest) || /^-l?\s+root\b/.test(rest)) return true;
+    }
+  }
+  if (/\bset(?:uid|euid|gid|egid|reuid|regid|resuid|resgid)\s*\(/i.test(shell)) return true;
+  return false;
+}
 function isExfilNode(n) {
   if (n.stage === "EXFIL") return true;
   if (EXFIL_RE.test(n.actionDetail) && EXFIL_ACTION_RE.test(n.actionDetail)) return true;
@@ -6892,8 +6999,12 @@ function isCredNode(n) {
   return CRED_STRICT_RE.test(n.actionDetail);
 }
 function isPrivescNode(n) {
-  if (n.stage === "PRIVESC") return true;
-  return PRIVESC_RE.test(n.actionDetail);
+  const shell = stripStringLiterals(n.actionDetail);
+  if (containsPrivesc(shell)) return true;
+  for (const cmd of extractInlineShell(shell)) {
+    if (containsPrivesc(cmd)) return true;
+  }
+  return false;
 }
 function checkNeverExfilAfterPrivesc(graph) {
   const violations = [];