@kenhkl/agent-moss 0.15.2 → 0.15.5

package/dist/cli.d.ts

@@ -1 +1,11 @@
 #!/usr/bin/env node
+/**
+ * AgentMoss CLI — TypeScript version.
+ * Supports: init | analyze | server
+ */
+/** 命令模式核心：把一条 shell 命令当 a_next 分析，输出 Deny/Allow（--json 时完整
+ *  JSON），返回退出码（Allow=0 / Deny=1）。导出供测试直接调用（CLI 分支再 process.exit）。
+ *  零文件读写——镜像 Python cli.py 的 _analyze_command。 */
+declare function analyzeRawCommand(command: string, useJson?: boolean): Promise<number>;
+
+export { analyzeRawCommand };

package/dist/cli.js

@@ -1439,6 +1439,7 @@ __export(runtime_config_exports, {
   getRuntimeConfigPath: () => getRuntimeConfigPath,
   getScenarioRules: () => getScenarioRules,
   hasRuntimeConfig: () => hasRuntimeConfig,
+  invalidateRuntimeConfigCache: () => invalidateRuntimeConfigCache,
   isL2CategoryEnabled: () => isL2CategoryEnabled,
   isLayerEnabled: () => isLayerEnabled,
   loadRuntimeConfig: () => loadRuntimeConfig,
@@ -1457,7 +1458,7 @@ __export(runtime_config_exports, {
   updateSkillCategoryEnabled: () => updateSkillCategoryEnabled,
   updateSkillEnabled: () => updateSkillEnabled
 });
-import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync4, mkdirSync, unlinkSync, readdirSync as readdirSync3 } from "fs";
+import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync4, mkdirSync, unlinkSync, readdirSync as readdirSync3, statSync } from "fs";
 import { join as join3 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import { dirname as dirname3 } from "path";
@@ -1474,6 +1475,7 @@ function saveRuntimeConfig(config) {
   const dir = p.substring(0, p.lastIndexOf("/"));
   if (dir && !existsSync4(dir)) mkdirSync(dir, { recursive: true });
   writeFileSync(p, JSON.stringify(config, null, 2), "utf-8");
+  invalidateRuntimeConfigCache();
 }
 function emptyRuntimeConfig() {
   return {
@@ -1487,6 +1489,9 @@ function emptyRuntimeConfig() {
     scenario_rules: {}
   };
 }
+function invalidateRuntimeConfigCache() {
+  runtimeConfigCache = null;
+}
 function loadRuntimeConfig() {
   const p = getRuntimeConfigPath();
   if (!existsSync4(p)) {
@@ -1498,9 +1503,14 @@ function loadRuntimeConfig() {
     return seeded;
   }
   try {
+    const st = statSync(p);
+    const cacheKey = `${p}|${st.mtimeMs}|${st.size}`;
+    if (runtimeConfigCache && runtimeConfigCache.key === cacheKey) {
+      return runtimeConfigCache.value;
+    }
     const data = JSON.parse(readFileSync4(p, "utf-8"));
     const merged = mergeConfig(data, generateSourceDefaults());
-    return {
+    const result = {
       version: data.version || 1,
       layers: {
         L1_heuristic: data.layers?.L1_heuristic ?? true,
@@ -1514,6 +1524,8 @@ function loadRuntimeConfig() {
       agent_rules: merged.agent_rules || {},
       scenario_rules: merged.scenario_rules || {}
     };
+    runtimeConfigCache = { key: cacheKey, value: result };
+    return result;
   } catch {
     return emptyRuntimeConfig();
   }
@@ -2503,7 +2515,7 @@ function updateScenarioCategoryEnabled(scenarioId, category, enabled) {
   saveRuntimeConfig(runtime);
   return runtime;
 }
-var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DEFAULT_LAYERS, DENY_MODE_LABELS, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, SKILL_ID_RE;
+var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DEFAULT_LAYERS, DENY_MODE_LABELS, runtimeConfigCache, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, SKILL_ID_RE;
 var init_runtime_config = __esm({
   "src/infra/runtime-config.ts"() {
     "use strict";
@@ -2533,6 +2545,7 @@ var init_runtime_config = __esm({
       deny_read: "\u4EC5\u62E6\u622A\u8BFB\u53D6",
       deny_both: "\u8BFB\u5199\u5747\u62E6\u622A"
     };
+    runtimeConfigCache = null;
     _AGENTS_DIR_PROD = join3(__dirname4, "agents");
     _AGENTS_DIR_DEV = join3(__dirname4, "..", "..", "..", "agent_moss", "agents");
     _SCENARIOS_DIR_PROD = join3(__dirname4, "scenarios");
@@ -2827,6 +2840,56 @@ function isInlineScriptCommand(actionDetail) {
   const re = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
   return re.test(actionDetail);
 }
+function resolvePathTokens(segment) {
+  const out = [];
+  const low = segment.toLowerCase();
+  for (const m of low.matchAll(HOME_PREFIX_RE)) {
+    const prefix = m[0];
+    const endIdx = (m.index ?? 0) + m[0].length;
+    const tail = low.slice(endIdx);
+    if (!tail || !(tail[0] === "/" || tail[0] === " ")) {
+      out.push([prefix, prefix]);
+      continue;
+    }
+    const token = tail.trim().split(/\s+/)[0] || "";
+    if (!token.startsWith("/")) continue;
+    const cleaned = token.replace(/\/+$/, "").replace(/^['"]|['"]$/g, "");
+    const segments = cleaned.split("/").filter((s) => s && s !== ".");
+    if (!segments.some((s) => s === "..")) continue;
+    let depth = 0;
+    const kept = [];
+    let escaped = false;
+    for (const s of segments) {
+      if (s === "..") {
+        depth -= 1;
+        if (kept.length) kept.pop();
+        if (depth < 0) {
+          escaped = true;
+          depth = 0;
+        }
+      } else {
+        depth += 1;
+        kept.push(s);
+      }
+    }
+    let resolved = kept.length ? "~/" + kept.join("/") : "~";
+    if (escaped) resolved += "\uFF08\u26A0\uFE0F .. \u5F39\u6808\u8D85\u51FA\u4E3B\u76EE\u5F55\u6839\uFF0C\u5B9E\u9645\u76EE\u6807\u5728\u4E3B\u76EE\u5F55\u4E4B\u5916\uFF09";
+    out.push([prefix + token, resolved]);
+  }
+  return out;
+}
+function buildPathContext(actionDetail) {
+  if (!PATH_CONTEXT_TRIGGER_RE.test(actionDetail)) return "";
+  const stripped = stripLiteralTextSegments(actionDetail);
+  const lines = [];
+  for (const seg of splitCommandSegments(stripped)) {
+    for (const [raw, lex] of resolvePathTokens(seg)) {
+      lines.push(`- \u547D\u4EE4\u6BB5 \`${seg.trim().slice(0, 60)}\`\uFF1A\`${raw}\` \u8BCD\u6CD5\u89E3\u6790\u4E3A \`${lex}\``);
+    }
+  }
+  if (!lines.length) return "";
+  return "## \u8DEF\u5F84\u89E3\u6790\u4E8B\u5B9E\uFF08\u8BCD\u6CD5\u5206\u6790\uFF0C\u786E\u5B9A\u6027\u7ED3\u8BBA\uFF09\n" + lines.join("\n") + "\n\n## \u8FD0\u884C\u65F6\u672A\u9A8C\u8BC1\uFF08\u4F9B\u53C2\u8003\uFF0C\u975E\u4E8B\u5B9E\uFF09\n- \u5206\u6790\u5668\u4E0D\u8BFB\u6587\u4EF6\u7CFB\u7EDF\uFF1A\u65E0\u6CD5\u786E\u8BA4\u8DEF\u5F84\u4E2D\u7684\u4E2D\u95F4\u76EE\u5F55\u662F\u5426\u4E3A\u7B26\u53F7\u94FE\u63A5\uFF1B\u82E5\u4E2D\u95F4\u6BB5\u5728\u6267\u884C\u65F6\u662F\uFF08\u6216\u88AB\u66FF\u6362\u4E3A\uFF09\u6307\u5411\u4E3B\u76EE\u5F55\u5916\u7684\u8F6F\u94FE\uFF0C\u5B9E\u9645\u64CD\u4F5C\u76EE\u6807\u53EF\u80FD\u968F\u4E4B\u6539\u53D8\u3002\u8BCD\u6CD5\u89E3\u6790\u7ED3\u679C\u57FA\u4E8E\u6807\u51C6\u8DEF\u5F84\u8BED\u4E49\uFF0C\u4E0D\u5E94\u56E0\u731C\u6D4B\u300C\u89E3\u6790\u4F9D\u8D56\u67D0\u6BB5\u662F\u5426\u5B58\u5728\u300D\u800C\u5426\u5B9A\u5B83\u3002";
+}
 function stripLiteralTextSegments(actionDetail) {
   const writeScriptExec = />\s*[/~]\S*\.(sh|py|pl|rb)\b/.test(actionDetail) && /(?:&&|\|\||;|\n|\|)\s*(?:bash|sh|zsh|dash|python|perl|ruby|node)/.test(actionDetail);
   const pipeToInterpreter = /\|\s*(?:bash|sh|zsh|dash|python|perl|ruby|node)\b/.test(actionDetail);
@@ -3353,7 +3416,7 @@ function checkLateralMovement(actionDetail) {
   }
   return null;
 }
-var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES, HOME_TARGET_RE, HOME_ASSIGN_RE;
+var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, PATH_CONTEXT_TRIGGER_RE, HOME_PREFIX_RE, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES, HOME_TARGET_RE, HOME_ASSIGN_RE;
 var init_heuristic = __esm({
   "src/engine/heuristic.ts"() {
     "use strict";
@@ -3381,6 +3444,8 @@ var init_heuristic = __esm({
         description: c.reason
       }));
     })();
+    PATH_CONTEXT_TRIGGER_RE = /(?:^|[;&|]\s*)(?:rm|rmdir|unlink|ln|mv|cp|dd|truncate|shred|chmod|chown)\b/i;
+    HOME_PREFIX_RE = /(?:~|~(?=\/)|\$HOME\b|\$\{HOME\}|\/home\/[a-z0-9_.-]+)/gi;
     SENSITIVE_EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
     SEARCH_ACTION_PREFIXES = ["search-", "web-", "browser-", "query-", "websearch", "web_search"];
     HOME_TARGET_RE = /(?:^|[\s="'($])(?:~|(?:\$home|\$\{home\}))(?:\/(?:\.\*|\*|\.)?)?(?=[\s"';}|&)]|$)/i;
@@ -5112,7 +5177,7 @@ var init_tracker = __esm({
 });
 
 // src/engine/script-content-analyzer.ts
-import { statSync as statSync2, existsSync as existsSync9 } from "fs";
+import { statSync as statSync3, existsSync as existsSync9 } from "fs";
 import { resolve as resolve8, join as join6, isAbsolute as isAbsolute2 } from "path";
 import { homedir as homedir4 } from "os";
 function emptyChain() {
@@ -5226,7 +5291,7 @@ function extractInlineScriptPath(actionDetail) {
           try {
             const resolved = resolvePath2(tok.replace(/^['"]|['"]$/g, ""));
             if (existsSync9(resolved)) {
-              const stat = statSync2(resolved);
+              const stat = statSync3(resolved);
               if (stat.isFile()) return resolved;
             }
           } catch {
@@ -5240,7 +5305,7 @@ function extractInlineScriptPath(actionDetail) {
       try {
         const resolved = resolvePath2(p);
         if (existsSync9(resolved)) {
-          const stat = statSync2(resolved);
+          const stat = statSync3(resolved);
           if (stat.isFile()) return resolved;
         }
       } catch {
@@ -5256,7 +5321,7 @@ function extractInlineScriptPath(actionDetail) {
     try {
       resolved = resolvePath2(p);
       if (existsSync9(resolved)) {
-        const stat = statSync2(resolved);
+        const stat = statSync3(resolved);
         if (stat.isFile()) return resolved;
       }
     } catch {
@@ -5733,7 +5798,7 @@ async function runLLMAnalysis(input, previous) {
   } else {
     scriptAnalysis = analyzeScriptContent(input.aNext.actionType, input.aNext.actionDetail);
   }
-  const prompt = buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis, previous.skipL3Hints ?? "", scriptChainText);
+  const prompt = buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis, previous.skipL3Hints ?? "", scriptChainText, previous.pathContext ?? "");
   logPrompt(prompt, input.aNext, previous.llmLogPath);
   const result = await analyzeWithLLM(prompt, config);
   if (llmCache.size >= LLM_CACHE_MAX) {
@@ -5757,7 +5822,7 @@ ${prompt}
     console.warn("[AgentMoss] Failed to write LLM prompt to log:", e);
   }
 }
-function buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis, skipL3Hints = "", scriptChainText = "") {
+function buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis, skipL3Hints = "", scriptChainText = "", pathContext = "") {
   const skillsText = formatSkillsForPrompt(matchedSkills);
   const historyStr = input.actionHistory.map((h, i) => `${i + 1}. ${h.actionType}: ${h.actionDetail}`).join("\n") || "(\u65E0\u5386\u53F2\u64CD\u4F5C)";
   const promptHistoryText = formatPromptHistory(input.promptHistory);
@@ -5765,7 +5830,7 @@ function buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis,
   const hintsText = formatHints(previous);
   const securityJudgeTemplate = templates["security_judge"];
   if (securityJudgeTemplate) {
-    return securityJudgeTemplate.replaceAll("{prompt_session}", input.promptSession || "\uFF08\u672A\u63D0\u4F9B\uFF09").replaceAll("{prompt_history_text}", promptHistoryText).replaceAll("{action_history}", historyStr).replaceAll("{action_type}", input.aNext.actionType).replaceAll("{action_detail}", input.aNext.actionDetail).replaceAll("{reason}", input.reason || "\u672A\u8BF4\u660E").replaceAll("{skills_text}", skillsText).replaceAll("{hints_text}", hintsText).replaceAll("{script_analysis_text}", scriptAnalysisText).replaceAll("{skip_l3_hints}", skipL3Hints).replaceAll("{{", "{").replaceAll("}}", "}");
+    return securityJudgeTemplate.replaceAll("{prompt_session}", input.promptSession || "\uFF08\u672A\u63D0\u4F9B\uFF09").replaceAll("{prompt_history_text}", promptHistoryText).replaceAll("{action_history}", historyStr).replaceAll("{action_type}", input.aNext.actionType).replaceAll("{action_detail}", input.aNext.actionDetail).replaceAll("{reason}", input.reason || "\u672A\u8BF4\u660E").replaceAll("{skills_text}", skillsText).replaceAll("{hints_text}", hintsText).replaceAll("{script_analysis_text}", scriptAnalysisText).replaceAll("{skip_l3_hints}", skipL3Hints).replaceAll("{path_context}", pathContext || "\uFF08\u672C\u547D\u4EE4\u65E0\u4E3B\u76EE\u5F55\u76F8\u5173\u8DEF\u5F84\u6BB5\uFF0C\u4E0D\u9002\u7528\uFF09").replaceAll("{{", "{").replaceAll("}}", "}");
   }
   console.warn("[AgentMoss] security_judge template missing, using sparse fallback prompt");
   return `## \u5F53\u524D\u64CD\u4F5C\u4E0A\u4E0B\u6587
@@ -8186,6 +8251,21 @@ async function runAnalysis(input) {
     if ((effectiveResult.riskLevel === "high" || effectiveResult.riskLevel === "critical") && (!skipInlineFileAccess || isCredentialPath)) {
       return effectiveResult;
     }
+  } else {
+    if (isInlineScriptCmd || isLiteralTextCmd) {
+      const inlineJudgment = analyzeInlineScript(input.aNext.actionDetail);
+      if (inlineJudgment.actionable && !inlineJudgment.allowed) {
+        return {
+          allowed: false,
+          reason: inlineJudgment.reason,
+          riskLevel: inlineJudgment.riskLevel,
+          riskType: inlineJudgment.riskType,
+          confidence: 90,
+          source: "logic_rule",
+          violatedLayers: ["L2.1"]
+        };
+      }
+    }
   }
   if (isLogicRulesEnabled()) {
     const formalSessions = [];
@@ -8287,12 +8367,14 @@ async function runAnalysis(input) {
   }
   let llmResult;
   try {
+    const pathContext = buildPathContext(input.aNext.actionDetail);
     llmResult = await runLLMAnalysis(input, {
       heuristic: heuristicResult,
       logic: logicResult,
       skipL3Hints,
       scriptChain: scriptChain ?? void 0,
-      llmLogPath: input.llmLogPath
+      llmLogPath: input.llmLogPath,
+      pathContext
     });
   } catch (e) {
     const { getLLMFailMode: getLLMFailMode2 } = await Promise.resolve().then(() => (init_config(), config_exports));
@@ -10174,10 +10256,14 @@ function printHelp() {
 
 Commands:
   init                  Generate input.json template
-  analyze <input>       Run security analysis on input JSON
+  analyze <input>       Analyze an input JSON file, or a raw shell command string
+                        e.g. agent-moss analyze "cat ~/.ssh/id_rsa"  \u2192 prints Deny/Allow
   server                Start HTTP API server
   install               Install systemd service for AgentMoss
 
+Analyze options:
+  --json                Command mode: print the full JSON result instead of plain Deny/Allow
+
 Server options:
   --host <host>         Listen host (default: 127.0.0.1)
   --port <port>         Listen port (default: 9090, 0=auto assign)
@@ -10186,6 +10272,22 @@ Install options:
   --enable              Enable service on boot (systemctl enable)
 `);
 }
+async function analyzeRawCommand(command, useJson = false) {
+  const { runAnalysis: runAnalysis2 } = await Promise.resolve().then(() => (init_coordinator(), coordinator_exports));
+  const result = await runAnalysis2({
+    sessionId: "cli-command",
+    promptSession: "",
+    actionHistory: [],
+    aNext: { actionType: "bash", actionDetail: command },
+    reason: "",
+    osType: process.platform === "win32" ? "windows" : "linux",
+    cwd: process.cwd(),
+    agentId: ""
+  });
+  if (useJson) console.log(JSON.stringify(result, null, 2));
+  else console.log(result.allowed ? "Allow" : "Deny");
+  return result.allowed ? 0 : 1;
+}
 async function main() {
   const args = process.argv.slice(2);
   const command = args[0];
@@ -10211,14 +10313,33 @@ async function main() {
       break;
     }
     case "analyze": {
-      if (!args[1]) {
-        console.error("Usage: agent-moss analyze <input.json>");
+      const target = args[1];
+      if (!target) {
+        console.error('Usage: agent-moss analyze <input.json | "shell command">');
         process.exit(1);
       }
       const fs7 = await import("fs");
       const path6 = await import("path");
       const { runAnalysis: runAnalysis2 } = await Promise.resolve().then(() => (init_coordinator(), coordinator_exports));
-      const filePath = path6.resolve(args[1]);
+      const useJson = args.includes("--json");
+      const osType = process.platform === "win32" ? "windows" : "linux";
+      const isFile = fs7.existsSync(target) && fs7.statSync(target).isFile();
+      if (!isFile) {
+        if (fs7.existsSync(target)) {
+          console.error(`\u9519\u8BEF: \u4E0D\u662F\u6587\u4EF6: ${target}`);
+          process.exit(2);
+        }
+        if (/\.(json|ya?ml|toml)$/i.test(target)) {
+          console.error(`\u9519\u8BEF: \u6587\u4EF6\u4E0D\u5B58\u5728: ${target}`);
+          process.exit(2);
+        }
+        if (!target.trim()) {
+          console.error("\u9519\u8BEF: \u8F93\u5165\u4E3A\u7A7A\uFF08\u8BF7\u7ED9 JSON \u6587\u4EF6\u8DEF\u5F84\u6216 shell \u547D\u4EE4\uFF09");
+          process.exit(2);
+        }
+        process.exit(await analyzeRawCommand(target, useJson));
+      }
+      const filePath = path6.resolve(target);
       const data = JSON.parse(fs7.readFileSync(filePath, "utf-8"));
       const result = await runAnalysis2({
         sessionId: data.session_id || "unknown",
@@ -10430,6 +10551,9 @@ if (isMain) {
     process.exit(1);
   });
 }
+export {
+  analyzeRawCommand
+};
 //! 顺序即 fail-closed 短路优先级：verify 逐个执行，首个返回违规的性质成为
 //! first_violation，后续不再评估。调整顺序影响判定归属，须与 Python
 //! properties.py ALL_PROPERTIES 保持一致并双端测试确认。