@kenhkl/agent-moss 0.14.0 → 0.15.1

package/dist/cli.js

@@ -633,10 +633,15 @@ function loadMC() {
   try {
     const rt = (init_runtime_config(), __toCommonJS(runtime_config_exports));
     if (rules.length > 0 && typeof rt.hasRuntimeConfig === "function" && rt.hasRuntimeConfig()) {
-      const rtRules = rt.loadRuntimeConfig()?.L2_2?.ltl_rules?.rules || [];
+      const ltl = rt.loadRuntimeConfig()?.L2_2?.ltl_rules || {};
+      const rtRules = ltl.rules || [];
       const enabledById = {};
       for (const r of rtRules) if (r?.id) enabledById[r.id] = r.enabled !== false;
-      for (const r of rules) if (r?.id && r.id in enabledById) r.enabled = enabledById[r.id];
+      const catEnabled = ltl.category_enabled !== false;
+      for (const r of rules) {
+        if (r?.id && r.id in enabledById) r.enabled = enabledById[r.id];
+        if (!catEnabled) r.enabled = false;
+      }
     }
   } catch {
   }
@@ -1434,6 +1439,7 @@ __export(runtime_config_exports, {
   isLayerEnabled: () => isLayerEnabled,
   loadRuntimeConfig: () => loadRuntimeConfig,
   mergeConfig: () => mergeConfig,
+  pickDeletableRule: () => pickDeletableRule,
   saveRuntimeConfig: () => saveRuntimeConfig,
   updateAgentCategoryEnabled: () => updateAgentCategoryEnabled,
   updateAgentRuleEnabled: () => updateAgentRuleEnabled,
@@ -1599,8 +1605,16 @@ function getDisabledL2RulesWithSkipL3() {
 function _slugify(text) {
   return text.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_|_$/g, "") || "x";
 }
+function _fnv1a32(text) {
+  let h = 2166136261;
+  for (const b of Buffer.from(text, "utf-8")) {
+    h ^= b;
+    h = h * 16777619 >>> 0;
+  }
+  return h.toString(16).padStart(8, "0");
+}
 function _generatePatternId(pattern) {
-  return `pat_${_slugify(pattern)}`;
+  return `pat_${_slugify(pattern)}_${_fnv1a32(pattern)}`;
 }
 function _deriveDenyMode(rule) {
   if (rule.deny_mode) return rule.deny_mode;
@@ -1886,10 +1900,13 @@ function generateSourceDefaults() {
 }
 function _ltlRulesToRuntime() {
   const cands = [
-    join3(__dirname4, "..", "rules"),
-    join3(__dirname4, "..", "..", "..", "agent_moss", "rules"),
-    join3(process.cwd(), "agent_moss", "rules")
-  ];
+    getRuntimeConfigDir() && join3(getRuntimeConfigDir(), "rules"),
+    join3(__dirname4, "../rules"),
+    join3(__dirname4, "rules"),
+    join3(__dirname4, "../../../agent_moss/rules"),
+    join3(__dirname4, "../../../../agent_moss/rules"),
+    join3(process.cwd(), "agent_moss/rules")
+  ].filter(Boolean);
   let mc = {};
   for (const dir of cands) {
     const p = join3(dir, "mc_rules.json");
@@ -2249,16 +2266,20 @@ function addCustomRule(layer, category, rule) {
   saveRuntimeConfig(runtime);
   return runtime;
 }
-function deleteCustomRule(layer, category, ruleId) {
-  const runtime = loadRuntimeConfig();
-  const rules = runtime[layer]?.[category]?.rules || [];
-  const idx = rules.findIndex((r) => r.id === ruleId);
+function pickDeletableRule(rules, ruleId) {
+  const idx = rules.findIndex((r) => r.id === ruleId && (!r.builtin || r.source_removed));
   if (idx >= 0) {
-    const r = rules[idx];
-    if (r.builtin && !r.source_removed) return null;
     rules.splice(idx, 1);
-    saveRuntimeConfig(runtime);
+    return rules;
   }
+  if (rules.some((r) => r.id === ruleId)) return null;
+  return rules;
+}
+function deleteCustomRule(layer, category, ruleId) {
+  const runtime = loadRuntimeConfig();
+  const rules = runtime[layer]?.[category]?.rules || [];
+  if (pickDeletableRule(rules, ruleId) === null) return null;
+  saveRuntimeConfig(runtime);
   return runtime;
 }
 function addCustomSkill(skillId, category, keywords, content) {
@@ -6552,7 +6573,31 @@ function allCandidates(detail, max = 8) {
   return out;
 }
 function matchStageAny(detail, stages) {
-  for (const cand of allCandidates(detail)) {
+  const cands = allCandidates(detail);
+  if (cands.length === 0) return "";
+  const shell = cands[0];
+  const hits = [];
+  for (const [name, pats] of Object.entries(stages)) {
+    for (const p of pats) {
+      p.lastIndex = 0;
+      if (p.test(shell)) {
+        hits.push(name);
+        break;
+      }
+    }
+  }
+  if (hits.length > 0) {
+    if (hits.length === 1) return hits[0];
+    if (hits.includes("EXEC") && PURPOSE_EXEC_RE.test(shell)) return "EXEC";
+    if (hits.includes("LISTEN") && LISTEN_LEAD_RE.test(shell) && !LISTEN_NOISE_RE.test(shell)) {
+      return "LISTEN";
+    }
+    for (const s of STAGE_PRIORITY) {
+      if (hits.includes(s)) return s;
+    }
+    if (hits.includes("EXEC")) return "EXEC";
+  }
+  for (const cand of cands.slice(1)) {
     for (const [name, pats] of Object.entries(stages)) {
       for (const p of pats) {
         p.lastIndex = 0;
@@ -6562,7 +6607,7 @@ function matchStageAny(detail, stages) {
   }
   return "";
 }
-var B64_TOKEN_RE, QUOTED_STR_RE, OUTPUT_CMDS;
+var B64_TOKEN_RE, QUOTED_STR_RE, OUTPUT_CMDS, STAGE_PRIORITY, PURPOSE_EXEC_RE, LISTEN_LEAD_RE, LISTEN_NOISE_RE;
 var init_decode = __esm({
   "src/engine/formal-engine/decode.ts"() {
     "use strict";
@@ -6570,6 +6615,10 @@ var init_decode = __esm({
     B64_TOKEN_RE = /[A-Za-z0-9+/]+={0,2}/g;
     QUOTED_STR_RE = /('(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"|`(?:[^`\\]|\\.)*`)/g;
     OUTPUT_CMDS = /* @__PURE__ */ new Set(["echo", "printf", "print"]);
+    STAGE_PRIORITY = ["EXFIL", "PRIVESC", "PERSIST", "SCAN", "LISTEN"];
+    PURPOSE_EXEC_RE = /subprocess\.\w+\s*\(|os\.system\s*\(|shell\s*=\s*True|\beval\s*\(|\bexec\s*\(|os\.popen\s*\(|\/exec\b/i;
+    LISTEN_LEAD_RE = /http\.server|flask\s+run|nohup\b|nc\s+-l|socat\s+TCP-LISTEN/i;
+    LISTEN_NOISE_RE = /shell\s*=\s*True|os\.system|subprocess\.(?:run|call|Popen)|\beval\s*\(|\bexec\s*\(/i;
   }
 });
 
@@ -6958,6 +7007,62 @@ function checkSensitiveDataFlow(graph) {
   }
   return violations;
 }
+function extractInlineShell(s) {
+  const out = [];
+  let m;
+  INLINE_SHELL_RE.lastIndex = 0;
+  while ((m = INLINE_SHELL_RE.exec(s)) !== null) {
+    let g = m[1] ?? m[2] ?? m[3] ?? m[4] ?? "";
+    if (/^["']/.test(g) && (/"\s*,/.test(g) || /'\s*,/.test(g))) {
+      g = g.replace(/['"\[\],]+/g, " ");
+    }
+    g = g.trim();
+    if (g) out.push(g);
+  }
+  return out;
+}
+function containsPrivesc(shell) {
+  if (!shell) return false;
+  for (const seg of shell.split(/\&\&|\|\||;|\n/)) {
+    const s = seg.trim();
+    if (!s) continue;
+    const toks = s.split(/\s+/);
+    const head = (toks[0] || "").toLowerCase();
+    const rest = toks.slice(1).join(" ");
+    if (head === "chmod" && /(?:u\+s|g\+s|[2-7][0-7]{3})/.test(rest)) return true;
+    if (head === "setcap" && /cap_/.test(rest)) return true;
+    if (head === "pkexec" || head === "doas") return true;
+    if (head === "sudo") {
+      if (/^-u\s+/.test(rest)) {
+        if (/^-u\s+root\b/.test(rest)) return true;
+        continue;
+      }
+      const m = /^(\S+)(.*)$/.exec(rest);
+      if (m) {
+        const nxt = m[1].toLowerCase();
+        const tail = m[2];
+        if (PKG_MGR.has(nxt)) continue;
+        if (SHELLS.has(nxt)) return true;
+        if (nxt === "-i" || nxt === "-s") return true;
+        if (nxt.startsWith("su")) return true;
+        if (nxt.startsWith("/") && /bin\/(?:bash|sh|zsh|dash|fish)$/.test(nxt)) return true;
+      }
+      if (/\/(?:usr\/(?:local\/)?bin|bin)\/(?:bash|sh|zsh|dash|fish)\b/.test(rest)) return true;
+      if (/\bchmod\s+(?:u\+s|g\+s|[2-7][0-7]{3})\b/.test(rest)) return true;
+      if (/\bsetcap\s+cap_\w+/.test(rest)) return true;
+      if (/\bvisudo\b/.test(rest)) return true;
+      if (/\bpasswd\s+root\b/.test(rest)) return true;
+      if (/\buseradd\b/.test(rest)) return true;
+    }
+    if (head === "su") {
+      if (!rest) return true;
+      if (/^-l?\s*$/.test(rest)) return true;
+      if (/^root\b/.test(rest) || /^-l?\s+root\b/.test(rest)) return true;
+    }
+  }
+  if (/\bset(?:uid|euid|gid|egid|reuid|regid|resuid|resgid)\s*\(/i.test(shell)) return true;
+  return false;
+}
 function isExfilNode(n) {
   if (n.stage === "EXFIL") return true;
   if (EXFIL_RE.test(n.actionDetail) && EXFIL_ACTION_RE.test(n.actionDetail)) return true;
@@ -6972,8 +7077,12 @@ function isCredNode(n) {
   return CRED_STRICT_RE.test(n.actionDetail);
 }
 function isPrivescNode(n) {
-  if (n.stage === "PRIVESC") return true;
-  return PRIVESC_RE.test(n.actionDetail);
+  const shell = stripStringLiterals(n.actionDetail);
+  if (containsPrivesc(shell)) return true;
+  for (const cmd of extractInlineShell(shell)) {
+    if (containsPrivesc(cmd)) return true;
+  }
+  return false;
 }
 function checkNeverExfilAfterPrivesc(graph) {
   const violations = [];
@@ -7223,7 +7332,7 @@ function checkSensitiveDataAggregation(graph) {
   }
   return violations;
 }
-var CROSS_SESSION_CHAINS, CRED_FILE_RE, EXFIL_RE, EBPF_NET_RE, REMOTE_RE, PRIVESC_RE, EXFIL_ACTION_RE, CRED_STRICT_RE, TOOL_REGISTRY, COMPUTE_RE, STRONG_COMPUTE_TYPES, DL_OR_LOW_RE, ALL_PROPERTIES;
+var CROSS_SESSION_CHAINS, CRED_FILE_RE, EXFIL_RE, EBPF_NET_RE, REMOTE_RE, EXFIL_ACTION_RE, CRED_STRICT_RE, INLINE_SHELL_RE, PKG_MGR, SHELLS, TOOL_REGISTRY, COMPUTE_RE, STRONG_COMPUTE_TYPES, DL_OR_LOW_RE, ALL_PROPERTIES;
 var init_properties = __esm({
   "src/engine/formal-engine/properties.ts"() {
     "use strict";
@@ -7231,14 +7340,17 @@ var init_properties = __esm({
     init_rules_loader();
     init_ir();
     init_ltl();
+    init_decode();
     CROSS_SESSION_CHAINS = null;
     CRED_FILE_RE = /(known_hosts|\.ssh|id_rsa|\/etc\/shadow|\/etc\/passwd|credentials)/i;
-    EXFIL_RE = /https?:\/\/|scp\s+.*@|rsync\s+.*@/i;
+    EXFIL_RE = /https?:\/\/(?!127\.\d+\.\d+\.\d+|0\.0\.0\.0|localhost|\[?::1\]?)[^\s]+|\bscp\s+.*@|\brsync\s+.*@/i;
     EBPF_NET_RE = /connect|sendto|network_connect/i;
     REMOTE_RE = /to\s+\d+\.\d+\.\d+\.\d+|remote_addr/i;
-    PRIVESC_RE = /\bsudo\b|\bsu\b|chmod\s+u\s*\+\s*s|pkexec|setuid/i;
     EXFIL_ACTION_RE = /\bcurl\b|\bwget\b|\bscp\b|\brsync\b|\brclone\b|\bftp\b|connect\s+.*\d+\.\d+\.\d+\.\d+|open\s+.*tcp|base64\s+.*\-o/i;
     CRED_STRICT_RE = /(known_hosts|\.ssh|id_rsa|\.pem|\b\.key\b|\/etc\/shadow|\/etc\/passwd|\.aws\/credentials|credentials\.json|netrc|password|secrets?\.ya?ml|credentials?\s*(file|path)?\s*(=|\:)|\bconfig.*(password|token))/i;
+    INLINE_SHELL_RE = /(?:os\.system|os\.popen)\s*\(\s*['"]([^'"]+)['"]|subprocess\.[a-z_]+\(\s*\[([^\]]+)\]|subprocess\.[a-z_]+\(\s*['"]([^'"]+)['"]|(?:bash|sh|zsh)\s+-c\s*['"]([^'"]+)['"]/gi;
+    PKG_MGR = /* @__PURE__ */ new Set(["apt", "apt-get", "aptitude", "yum", "dnf", "pacman", "zypper", "apk", "brew"]);
+    SHELLS = /* @__PURE__ */ new Set(["bash", "sh", "zsh", "dash", "fish", "ksh", "csh", "tcsh", "nologin"]);
     TOOL_REGISTRY = null;
     COMPUTE_RE = /subprocess|os\.system|shell\s*=\s*True|\beval\(|\bexec\(|bash\s+[^\s]|sh\s+-c|python3?\s+|node\s+|\btimeout\s+|nohup\s+|\b\.\/[\w./-]+/i;
     STRONG_COMPUTE_TYPES = /* @__PURE__ */ new Set(["python", "node", "exec", "terminal", "cmd"]);
@@ -9753,9 +9865,16 @@ function createConsoleRouter() {
     };
     const mc = loadMC();
     const rules = mc.rules || [];
+    let catEnabled = true;
+    try {
+      const rt = loadRuntimeConfig();
+      catEnabled = rt.L2_2?.ltl_rules?.category_enabled !== false;
+    } catch {
+    }
     return {
       enabled_via: "L2_logic_rules",
       description: "\u65F6\u5E8F\u4E0E\u6570\u636E\u6D41\u653B\u51FB\u68C0\u6D4B\uFF08L2.2 \u6A21\u578B\u68C0\u6D4B\uFF09",
+      category_enabled: catEnabled,
       ltl_rules: rules.map((r) => ({
         id: r.id,
         type: r.type,
@@ -9769,9 +9888,9 @@ function createConsoleRouter() {
     };
   }
   function withL22View(rc) {
-    if (rc && rc.L2_2 && typeof rc.L2_2 === "object" && !Array.isArray(rc.L2_2)) {
-      const cat = rc.L2_2.ltl_rules;
-      const rls = cat && cat.rules || [];
+    const l22 = rc && rc.L2_2;
+    if (l22 && typeof l22 === "object" && !Array.isArray(l22) && l22.ltl_rules && typeof l22.ltl_rules === "object" && !Array.isArray(l22.ltl_rules)) {
+      const rls = l22.ltl_rules.rules || [];
       const ltlHumanLocal = {
         "mc-ltl-001": "\u5148\u8BFB\u53D6\u4E86\u51ED\u636E/\u5BC6\u94A5\uFF0C\u4E4B\u540E\u51FA\u73B0\u7F51\u7EDC\u5916\u4F20",
         "mc-ltl-002": "\u5148\u4E0B\u8F7D/\u83B7\u53D6\u4E86\u6587\u4EF6\uFF0C\u4E4B\u540E\u6267\u884C\u4E86\u6587\u4EF6",
@@ -9788,6 +9907,7 @@ function createConsoleRouter() {
       rc.L2_2 = {
         enabled_via: "L2_logic_rules",
         description: "\u65F6\u5E8F\u4E0E\u6570\u636E\u6D41\u653B\u51FB\u68C0\u6D4B\uFF08L2.2 \u6A21\u578B\u68C0\u6D4B\uFF09",
+        category_enabled: l22.ltl_rules.category_enabled !== false,
         ltl_rules: rls.map((r) => ({
           id: r.id,
           type: "ltl",
@@ -9824,7 +9944,7 @@ function createConsoleRouter() {
   console2.put("/api/categories/enabled", async (c) => {
     const b = await c.req.json();
     const rc = updateCategoryEnabled(b.layer, b.category, b.enabled);
-    return c.json(rc);
+    return c.json(withL22View(rc));
   });
   console2.post("/api/rules", async (c) => {
     const b = await c.req.json();
@@ -9840,13 +9960,13 @@ function createConsoleRouter() {
       credential: b.credential,
       deny_mode: b.deny_mode
     });
-    return c.json(rc);
+    return c.json(withL22View(rc));
   });
   console2.delete("/api/rules", async (c) => {
     const b = await c.req.json();
     deleteCustomRule(b.layer, b.category, b.rule_id);
     const rc = loadRuntimeConfig();
-    return c.json(rc);
+    return c.json(withL22View(rc));
   });
   console2.get("/api/skills", (c) => {
     const rc = loadRuntimeConfig();
@@ -9855,23 +9975,23 @@ function createConsoleRouter() {
   console2.put("/api/skills/enabled", async (c) => {
     const b = await c.req.json();
     const rc = updateSkillEnabled(b.skill_id, b.enabled);
-    return c.json(rc);
+    return c.json(withL22View(rc));
   });
   console2.put("/api/skill-categories/enabled", async (c) => {
     const b = await c.req.json();
     const rc = updateSkillCategoryEnabled(b.category, b.enabled);
-    return c.json(rc);
+    return c.json(withL22View(rc));
   });
   console2.post("/api/skills", async (c) => {
     const b = await c.req.json();
     const rc = addCustomSkill(b.skill_id, b.category || "user_custom", b.keywords || [], b.content);
-    return c.json(rc);
+    return c.json(withL22View(rc));
   });
   console2.delete("/api/skills", async (c) => {
     const b = await c.req.json();
     deleteCustomSkill(b.skill_id, b.category);
     const rc = loadRuntimeConfig();
-    return c.json(rc);
+    return c.json(withL22View(rc));
   });
   console2.get("/api/skills/:skill_id/content", async (c) => {
     const skillId = c.req.param("skill_id");
@@ -9977,7 +10097,7 @@ function createConsoleRouter() {
   console2.post("/api/reset", (c) => {
     const defaults = generateSourceDefaults();
     saveRuntimeConfig(defaults);
-    return c.json(defaults);
+    return c.json(withL22View(defaults));
   });
   console2.get("/api/token-stats", (c) => {
     const days = parseInt(c.req.query("days") || "7", 10);