@kenhkl/agent-moss 0.15.2 → 0.15.4

package/dist/rules/l1_rules.json

@@ -24,6 +24,12 @@
       "risk_type": "script_execution",
       "reason": "检测到强制删除文件 (rm -f /...)"
     },
+    {
+      "pattern": "\\bln\\s+(-[a-zA-Z]+\\s+)*(?:--\\s+)?-s[a-zA-Z]*\\s+(?:--\\s+)?(/(?![a-zA-Z0-9._~])|~/\\.\\.(?:\\s|$|\\\"|'|;|&|\\)|\\]|/)|~/(?![.a-zA-Z0-9_~-])|~/$|~(?:\\s|$|\\\"|'|;|&|\\)|\\])|\\$HOME/\\.\\.(?:\\s|$|\\\"|'|;|&|\\)|\\]|/)|\\$HOME/(?![.a-zA-Z0-9_~-])|\\$HOME/$|\\$HOME(?:\\s|$|\\\"|'|;|&|\\)|\\]))",
+      "risk_level": "high",
+      "risk_type": "file_access",
+      "reason": "检测到创建指向根目录/主目录本身的符号链接（symlink 逃逸原语：链接点进入后 ../ 可穿越到根/主目录层级，配合删除/写入实现越权）"
+    },
     {
       "pattern": "chmod\\s+(?:(?:-[a-zA-Z]*|--)\\s+)*[0-7]{0,3}7\\b",
       "risk_level": "critical",
@@ -867,4 +873,4 @@
       "scope": "home"
     }
   ]
-}
+}

package/dist/server.js

@@ -1438,6 +1438,7 @@ __export(runtime_config_exports, {
   getRuntimeConfigPath: () => getRuntimeConfigPath,
   getScenarioRules: () => getScenarioRules,
   hasRuntimeConfig: () => hasRuntimeConfig,
+  invalidateRuntimeConfigCache: () => invalidateRuntimeConfigCache,
   isL2CategoryEnabled: () => isL2CategoryEnabled,
   isLayerEnabled: () => isLayerEnabled,
   loadRuntimeConfig: () => loadRuntimeConfig,
@@ -1456,7 +1457,7 @@ __export(runtime_config_exports, {
   updateSkillCategoryEnabled: () => updateSkillCategoryEnabled,
   updateSkillEnabled: () => updateSkillEnabled
 });
-import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync4, mkdirSync, unlinkSync, readdirSync as readdirSync3 } from "fs";
+import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync4, mkdirSync, unlinkSync, readdirSync as readdirSync3, statSync } from "fs";
 import { join as join3 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import { dirname as dirname3 } from "path";
@@ -1473,6 +1474,7 @@ function saveRuntimeConfig(config) {
   const dir = p.substring(0, p.lastIndexOf("/"));
   if (dir && !existsSync4(dir)) mkdirSync(dir, { recursive: true });
   writeFileSync(p, JSON.stringify(config, null, 2), "utf-8");
+  invalidateRuntimeConfigCache();
 }
 function emptyRuntimeConfig() {
   return {
@@ -1486,6 +1488,9 @@ function emptyRuntimeConfig() {
     scenario_rules: {}
   };
 }
+function invalidateRuntimeConfigCache() {
+  runtimeConfigCache = null;
+}
 function loadRuntimeConfig() {
   const p = getRuntimeConfigPath();
   if (!existsSync4(p)) {
@@ -1497,9 +1502,14 @@ function loadRuntimeConfig() {
     return seeded;
   }
   try {
+    const st = statSync(p);
+    const cacheKey = `${p}|${st.mtimeMs}|${st.size}`;
+    if (runtimeConfigCache && runtimeConfigCache.key === cacheKey) {
+      return runtimeConfigCache.value;
+    }
     const data = JSON.parse(readFileSync4(p, "utf-8"));
     const merged = mergeConfig(data, generateSourceDefaults());
-    return {
+    const result = {
       version: data.version || 1,
       layers: {
         L1_heuristic: data.layers?.L1_heuristic ?? true,
@@ -1513,6 +1523,8 @@ function loadRuntimeConfig() {
       agent_rules: merged.agent_rules || {},
       scenario_rules: merged.scenario_rules || {}
     };
+    runtimeConfigCache = { key: cacheKey, value: result };
+    return result;
   } catch {
     return emptyRuntimeConfig();
   }
@@ -2502,7 +2514,7 @@ function updateScenarioCategoryEnabled(scenarioId, category, enabled) {
   saveRuntimeConfig(runtime);
   return runtime;
 }
-var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DEFAULT_LAYERS, DENY_MODE_LABELS, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, SKILL_ID_RE;
+var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DEFAULT_LAYERS, DENY_MODE_LABELS, runtimeConfigCache, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, SKILL_ID_RE;
 var init_runtime_config = __esm({
   "src/infra/runtime-config.ts"() {
     "use strict";
@@ -2532,6 +2544,7 @@ var init_runtime_config = __esm({
       deny_read: "\u4EC5\u62E6\u622A\u8BFB\u53D6",
       deny_both: "\u8BFB\u5199\u5747\u62E6\u622A"
     };
+    runtimeConfigCache = null;
     _AGENTS_DIR_PROD = join3(__dirname4, "agents");
     _AGENTS_DIR_DEV = join3(__dirname4, "..", "..", "..", "agent_moss", "agents");
     _SCENARIOS_DIR_PROD = join3(__dirname4, "scenarios");
@@ -2826,6 +2839,56 @@ function isInlineScriptCommand(actionDetail) {
   const re = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
   return re.test(actionDetail);
 }
+function resolvePathTokens(segment) {
+  const out = [];
+  const low = segment.toLowerCase();
+  for (const m of low.matchAll(HOME_PREFIX_RE)) {
+    const prefix = m[0];
+    const endIdx = (m.index ?? 0) + m[0].length;
+    const tail = low.slice(endIdx);
+    if (!tail || !(tail[0] === "/" || tail[0] === " ")) {
+      out.push([prefix, prefix]);
+      continue;
+    }
+    const token = tail.trim().split(/\s+/)[0] || "";
+    if (!token.startsWith("/")) continue;
+    const cleaned = token.replace(/\/+$/, "").replace(/^['"]|['"]$/g, "");
+    const segments = cleaned.split("/").filter((s) => s && s !== ".");
+    if (!segments.some((s) => s === "..")) continue;
+    let depth = 0;
+    const kept = [];
+    let escaped = false;
+    for (const s of segments) {
+      if (s === "..") {
+        depth -= 1;
+        if (kept.length) kept.pop();
+        if (depth < 0) {
+          escaped = true;
+          depth = 0;
+        }
+      } else {
+        depth += 1;
+        kept.push(s);
+      }
+    }
+    let resolved = kept.length ? "~/" + kept.join("/") : "~";
+    if (escaped) resolved += "\uFF08\u26A0\uFE0F .. \u5F39\u6808\u8D85\u51FA\u4E3B\u76EE\u5F55\u6839\uFF0C\u5B9E\u9645\u76EE\u6807\u5728\u4E3B\u76EE\u5F55\u4E4B\u5916\uFF09";
+    out.push([prefix + token, resolved]);
+  }
+  return out;
+}
+function buildPathContext(actionDetail) {
+  if (!PATH_CONTEXT_TRIGGER_RE.test(actionDetail)) return "";
+  const stripped = stripLiteralTextSegments(actionDetail);
+  const lines = [];
+  for (const seg of splitCommandSegments(stripped)) {
+    for (const [raw, lex] of resolvePathTokens(seg)) {
+      lines.push(`- \u547D\u4EE4\u6BB5 \`${seg.trim().slice(0, 60)}\`\uFF1A\`${raw}\` \u8BCD\u6CD5\u89E3\u6790\u4E3A \`${lex}\``);
+    }
+  }
+  if (!lines.length) return "";
+  return "## \u8DEF\u5F84\u89E3\u6790\u4E8B\u5B9E\uFF08\u8BCD\u6CD5\u5206\u6790\uFF0C\u786E\u5B9A\u6027\u7ED3\u8BBA\uFF09\n" + lines.join("\n") + "\n\n## \u8FD0\u884C\u65F6\u672A\u9A8C\u8BC1\uFF08\u4F9B\u53C2\u8003\uFF0C\u975E\u4E8B\u5B9E\uFF09\n- \u5206\u6790\u5668\u4E0D\u8BFB\u6587\u4EF6\u7CFB\u7EDF\uFF1A\u65E0\u6CD5\u786E\u8BA4\u8DEF\u5F84\u4E2D\u7684\u4E2D\u95F4\u76EE\u5F55\u662F\u5426\u4E3A\u7B26\u53F7\u94FE\u63A5\uFF1B\u82E5\u4E2D\u95F4\u6BB5\u5728\u6267\u884C\u65F6\u662F\uFF08\u6216\u88AB\u66FF\u6362\u4E3A\uFF09\u6307\u5411\u4E3B\u76EE\u5F55\u5916\u7684\u8F6F\u94FE\uFF0C\u5B9E\u9645\u64CD\u4F5C\u76EE\u6807\u53EF\u80FD\u968F\u4E4B\u6539\u53D8\u3002\u8BCD\u6CD5\u89E3\u6790\u7ED3\u679C\u57FA\u4E8E\u6807\u51C6\u8DEF\u5F84\u8BED\u4E49\uFF0C\u4E0D\u5E94\u56E0\u731C\u6D4B\u300C\u89E3\u6790\u4F9D\u8D56\u67D0\u6BB5\u662F\u5426\u5B58\u5728\u300D\u800C\u5426\u5B9A\u5B83\u3002";
+}
 function stripLiteralTextSegments(actionDetail) {
   const writeScriptExec = />\s*[/~]\S*\.(sh|py|pl|rb)\b/.test(actionDetail) && /(?:&&|\|\||;|\n|\|)\s*(?:bash|sh|zsh|dash|python|perl|ruby|node)/.test(actionDetail);
   const pipeToInterpreter = /\|\s*(?:bash|sh|zsh|dash|python|perl|ruby|node)\b/.test(actionDetail);
@@ -3352,7 +3415,7 @@ function checkLateralMovement(actionDetail) {
   }
   return null;
 }
-var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES, HOME_TARGET_RE, HOME_ASSIGN_RE;
+var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, PATH_CONTEXT_TRIGGER_RE, HOME_PREFIX_RE, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES, HOME_TARGET_RE, HOME_ASSIGN_RE;
 var init_heuristic = __esm({
   "src/engine/heuristic.ts"() {
     "use strict";
@@ -3380,6 +3443,8 @@ var init_heuristic = __esm({
         description: c.reason
       }));
     })();
+    PATH_CONTEXT_TRIGGER_RE = /(?:^|[;&|]\s*)(?:rm|rmdir|unlink|ln|mv|cp|dd|truncate|shred|chmod|chown)\b/i;
+    HOME_PREFIX_RE = /(?:~|~(?=\/)|\$HOME\b|\$\{HOME\}|\/home\/[a-z0-9_.-]+)/gi;
     SENSITIVE_EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
     SEARCH_ACTION_PREFIXES = ["search-", "web-", "browser-", "query-", "websearch", "web_search"];
     HOME_TARGET_RE = /(?:^|[\s="'($])(?:~|(?:\$home|\$\{home\}))(?:\/(?:\.\*|\*|\.)?)?(?=[\s"';}|&)]|$)/i;
@@ -4672,7 +4737,7 @@ init_esm_shims();
 init_heuristic();
 init_logic_rules();
 init_inline_analyzer();
-import { statSync as statSync2, existsSync as existsSync9 } from "fs";
+import { statSync as statSync3, existsSync as existsSync9 } from "fs";
 import { resolve as resolve8, join as join6, isAbsolute as isAbsolute2 } from "path";
 import { homedir as homedir4 } from "os";
 
@@ -6333,7 +6398,7 @@ function extractInlineScriptPath(actionDetail) {
           try {
             const resolved = resolvePath2(tok.replace(/^['"]|['"]$/g, ""));
             if (existsSync9(resolved)) {
-              const stat = statSync2(resolved);
+              const stat = statSync3(resolved);
               if (stat.isFile()) return resolved;
             }
           } catch {
@@ -6347,7 +6412,7 @@ function extractInlineScriptPath(actionDetail) {
       try {
         const resolved = resolvePath2(p);
         if (existsSync9(resolved)) {
-          const stat = statSync2(resolved);
+          const stat = statSync3(resolved);
           if (stat.isFile()) return resolved;
         }
       } catch {
@@ -6363,7 +6428,7 @@ function extractInlineScriptPath(actionDetail) {
     try {
       resolved = resolvePath2(p);
       if (existsSync9(resolved)) {
-        const stat = statSync2(resolved);
+        const stat = statSync3(resolved);
         if (stat.isFile()) return resolved;
       }
     } catch {
@@ -6574,7 +6639,7 @@ async function runLLMAnalysis(input, previous) {
   } else {
     scriptAnalysis = analyzeScriptContent(input.aNext.actionType, input.aNext.actionDetail);
   }
-  const prompt = buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis, previous.skipL3Hints ?? "", scriptChainText);
+  const prompt = buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis, previous.skipL3Hints ?? "", scriptChainText, previous.pathContext ?? "");
   logPrompt(prompt, input.aNext, previous.llmLogPath);
   const result = await analyzeWithLLM(prompt, config);
   if (llmCache.size >= LLM_CACHE_MAX) {
@@ -6598,7 +6663,7 @@ ${prompt}
     console.warn("[AgentMoss] Failed to write LLM prompt to log:", e);
   }
 }
-function buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis, skipL3Hints = "", scriptChainText = "") {
+function buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis, skipL3Hints = "", scriptChainText = "", pathContext = "") {
   const skillsText = formatSkillsForPrompt(matchedSkills);
   const historyStr = input.actionHistory.map((h, i) => `${i + 1}. ${h.actionType}: ${h.actionDetail}`).join("\n") || "(\u65E0\u5386\u53F2\u64CD\u4F5C)";
   const promptHistoryText = formatPromptHistory(input.promptHistory);
@@ -6606,7 +6671,7 @@ function buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis,
   const hintsText = formatHints(previous);
   const securityJudgeTemplate = templates["security_judge"];
   if (securityJudgeTemplate) {
-    return securityJudgeTemplate.replaceAll("{prompt_session}", input.promptSession || "\uFF08\u672A\u63D0\u4F9B\uFF09").replaceAll("{prompt_history_text}", promptHistoryText).replaceAll("{action_history}", historyStr).replaceAll("{action_type}", input.aNext.actionType).replaceAll("{action_detail}", input.aNext.actionDetail).replaceAll("{reason}", input.reason || "\u672A\u8BF4\u660E").replaceAll("{skills_text}", skillsText).replaceAll("{hints_text}", hintsText).replaceAll("{script_analysis_text}", scriptAnalysisText).replaceAll("{skip_l3_hints}", skipL3Hints).replaceAll("{{", "{").replaceAll("}}", "}");
+    return securityJudgeTemplate.replaceAll("{prompt_session}", input.promptSession || "\uFF08\u672A\u63D0\u4F9B\uFF09").replaceAll("{prompt_history_text}", promptHistoryText).replaceAll("{action_history}", historyStr).replaceAll("{action_type}", input.aNext.actionType).replaceAll("{action_detail}", input.aNext.actionDetail).replaceAll("{reason}", input.reason || "\u672A\u8BF4\u660E").replaceAll("{skills_text}", skillsText).replaceAll("{hints_text}", hintsText).replaceAll("{script_analysis_text}", scriptAnalysisText).replaceAll("{skip_l3_hints}", skipL3Hints).replaceAll("{path_context}", pathContext || "\uFF08\u672C\u547D\u4EE4\u65E0\u4E3B\u76EE\u5F55\u76F8\u5173\u8DEF\u5F84\u6BB5\uFF0C\u4E0D\u9002\u7528\uFF09").replaceAll("{{", "{").replaceAll("}}", "}");
   }
   console.warn("[AgentMoss] security_judge template missing, using sparse fallback prompt");
   return `## \u5F53\u524D\u64CD\u4F5C\u4E0A\u4E0B\u6587
@@ -8989,6 +9054,21 @@ async function runAnalysis(input) {
     if ((effectiveResult.riskLevel === "high" || effectiveResult.riskLevel === "critical") && (!skipInlineFileAccess || isCredentialPath)) {
       return effectiveResult;
     }
+  } else {
+    if (isInlineScriptCmd || isLiteralTextCmd) {
+      const inlineJudgment = analyzeInlineScript(input.aNext.actionDetail);
+      if (inlineJudgment.actionable && !inlineJudgment.allowed) {
+        return {
+          allowed: false,
+          reason: inlineJudgment.reason,
+          riskLevel: inlineJudgment.riskLevel,
+          riskType: inlineJudgment.riskType,
+          confidence: 90,
+          source: "logic_rule",
+          violatedLayers: ["L2.1"]
+        };
+      }
+    }
   }
   if (isLogicRulesEnabled()) {
     const formalSessions = [];
@@ -9090,12 +9170,14 @@ async function runAnalysis(input) {
   }
   let llmResult;
   try {
+    const pathContext = buildPathContext(input.aNext.actionDetail);
     llmResult = await runLLMAnalysis(input, {
       heuristic: heuristicResult,
       logic: logicResult,
       skipL3Hints,
       scriptChain: scriptChain ?? void 0,
-      llmLogPath: input.llmLogPath
+      llmLogPath: input.llmLogPath,
+      pathContext
     });
   } catch (e) {
     const { getLLMFailMode: getLLMFailMode2 } = await Promise.resolve().then(() => (init_config(), config_exports));