@kenhkl/agent-moss 0.15.5 → 0.15.7

package/dist/server.js

@@ -407,6 +407,9 @@ function isLiteralTextCommand(command) {
       return false;
     }
   }
+  if (/\|\s*\b(?:tee|tac|install)\b/i.test(command)) {
+    return false;
+  }
   return true;
 }
 function extractInlineCode(command) {
@@ -1307,22 +1310,45 @@ var init_logic_rules = __esm({
   }
 });
 
+// src/engine/asset-dir.ts
+import { existsSync as existsSync3 } from "fs";
+import { resolve as resolve2 } from "path";
+function assetDirCandidates(moduleDir, name) {
+  return [
+    resolve2(moduleDir, name),
+    resolve2(moduleDir, "../../..", "agent_moss", name)
+  ];
+}
+function resolveAssetDir(moduleDir, name) {
+  for (const dir of assetDirCandidates(moduleDir, name)) {
+    if (existsSync3(dir)) return dir;
+  }
+  return null;
+}
+var init_asset_dir = __esm({
+  "src/engine/asset-dir.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
 // src/engine/skill-loader.ts
-import { readFileSync as readFileSync3, readdirSync as readdirSync2, existsSync as existsSync3 } from "fs";
-import { resolve as resolve2, dirname as dirname2 } from "path";
+import { readFileSync as readFileSync3, readdirSync as readdirSync2 } from "fs";
+import { resolve as resolve3, dirname as dirname2 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 function loadAllSkills() {
   if (cachedSkills) return cachedSkills;
   cachedSkills = {};
-  const dir = existsSync3(SKILLS_DIR) ? SKILLS_DIR : SKILLS_DIR_FALLBACK;
-  if (!existsSync3(dir)) {
-    console.warn("[AgentMoss] Skills directory not found:", SKILLS_DIR, "and fallback:", SKILLS_DIR_FALLBACK);
+  const dir = resolveAssetDir(__dirname3, "skills");
+  if (!dir) {
+    const [primary, fallback] = assetDirCandidates(__dirname3, "skills");
+    console.warn("[AgentMoss] Skills directory not found:", primary, "and fallback:", fallback);
     return cachedSkills;
   }
   const files = readdirSync2(dir).filter((f) => f.endsWith(".md"));
   for (const f of files) {
     const name = f.replace(".md", "");
-    cachedSkills[name] = readFileSync3(resolve2(dir, f), "utf-8");
+    cachedSkills[name] = readFileSync3(resolve3(dir, f), "utf-8");
   }
   console.log(`[AgentMoss] Loaded ${Object.keys(cachedSkills).length} skills from ${dir}`);
   return cachedSkills;
@@ -1376,16 +1402,15 @@ function formatSkillsForPrompt(skills) {
 ${s.skillContent}`
   ).join("\n\n---\n\n");
 }
-var __filename3, __dirname3, SKILLS_DIR, SKILLS_DIR_FALLBACK, SKILL_KEYWORD_MAP, cachedSkills;
+var __filename3, __dirname3, SKILL_KEYWORD_MAP, cachedSkills;
 var init_skill_loader = __esm({
   "src/engine/skill-loader.ts"() {
     "use strict";
     init_esm_shims();
     init_rules_loader();
+    init_asset_dir();
     __filename3 = fileURLToPath4(import.meta.url);
     __dirname3 = dirname2(__filename3);
-    SKILLS_DIR = resolve2(__dirname3, "../skills");
-    SKILLS_DIR_FALLBACK = resolve2(__dirname3, "../../../agent_moss/skills");
     SKILL_KEYWORD_MAP = (() => {
       const map = {};
       const cats = loadL3();
@@ -2555,7 +2580,7 @@ var init_runtime_config = __esm({
 
 // src/agents/index.ts
 import { readFileSync as readFileSync5, existsSync as existsSync5 } from "fs";
-import { resolve as resolve3, dirname as dirname4 } from "path";
+import { resolve as resolve4, dirname as dirname4 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 function resolveAgentsDir() {
   if (existsSync5(AGENTS_DIR_PROD)) return AGENTS_DIR_PROD;
@@ -2575,7 +2600,7 @@ function getAgentExtensions(agentId) {
   }
   if (ext === null) {
     const agentsDir = resolveAgentsDir();
-    const rulesFile = resolve3(agentsDir, agentId, "rules.json");
+    const rulesFile = resolve4(agentsDir, agentId, "rules.json");
     if (!existsSync5(rulesFile)) {
       cache.set(agentId, null);
       return null;
@@ -2622,15 +2647,15 @@ var init_agents = __esm({
     init_esm_shims();
     __filename4 = fileURLToPath6(import.meta.url);
     __dirname5 = dirname4(__filename4);
-    AGENTS_DIR_PROD = resolve3(__dirname5, "agents");
-    AGENTS_DIR_DEV_FALLBACK = resolve3(__dirname5, "../../../agent_moss/agents");
+    AGENTS_DIR_PROD = resolve4(__dirname5, "agents");
+    AGENTS_DIR_DEV_FALLBACK = resolve4(__dirname5, "../../../agent_moss/agents");
     cache = /* @__PURE__ */ new Map();
   }
 });
 
 // src/scenarios/index.ts
 import { readFileSync as readFileSync6, existsSync as existsSync6 } from "fs";
-import { resolve as resolve4, dirname as dirname5 } from "path";
+import { resolve as resolve5, dirname as dirname5 } from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 function resolveScenariosDir() {
   if (existsSync6(SCENARIOS_DIR_PROD)) return SCENARIOS_DIR_PROD;
@@ -2650,7 +2675,7 @@ function getScenarioExtensions(scenarioId) {
   }
   if (ext === null) {
     const scenariosDir = resolveScenariosDir();
-    const rulesFile = resolve4(scenariosDir, scenarioId, "rules.json");
+    const rulesFile = resolve5(scenariosDir, scenarioId, "rules.json");
     if (!existsSync6(rulesFile)) {
       cache2.set(scenarioId, null);
       return null;
@@ -2703,8 +2728,8 @@ var init_scenarios = __esm({
     init_agents();
     __filename5 = fileURLToPath7(import.meta.url);
     __dirname6 = dirname5(__filename5);
-    SCENARIOS_DIR_PROD = resolve4(__dirname6, "scenarios");
-    SCENARIOS_DIR_DEV_FALLBACK = resolve4(__dirname6, "../../../agent_moss/scenarios");
+    SCENARIOS_DIR_PROD = resolve5(__dirname6, "scenarios");
+    SCENARIOS_DIR_DEV_FALLBACK = resolve5(__dirname6, "../../../agent_moss/scenarios");
     cache2 = /* @__PURE__ */ new Map();
   }
 });
@@ -2891,7 +2916,7 @@ function buildPathContext(actionDetail) {
 }
 function stripLiteralTextSegments(actionDetail) {
   const writeScriptExec = />\s*[/~]\S*\.(sh|py|pl|rb)\b/.test(actionDetail) && /(?:&&|\|\||;|\n|\|)\s*(?:bash|sh|zsh|dash|python|perl|ruby|node)/.test(actionDetail);
-  const pipeToInterpreter = /\|\s*(?:bash|sh|zsh|dash|python|perl|ruby|node)\b/.test(actionDetail);
+  const pipeToInterpreter = /\|\s*(?:bash|sh|zsh|dash|python|perl|ruby|node|crontab|at)\b/.test(actionDetail);
   if (writeScriptExec || pipeToInterpreter) {
     return actionDetail;
   }
@@ -4032,13 +4057,13 @@ var require_backup = __commonJS({
     var runBackup = (backup, handler) => {
       let rate = 0;
       let useDefault = true;
-      return new Promise((resolve9, reject) => {
+      return new Promise((resolve10, reject) => {
         setImmediate(function step() {
           try {
             const progress = backup.transfer(rate);
             if (!progress.remainingPages) {
               backup.close();
-              resolve9(progress);
+              resolve10(progress);
               return;
             }
             if (useDefault) {
@@ -4517,25 +4542,25 @@ init_skill_loader();
 
 // src/engine/template-loader.ts
 init_esm_shims();
+init_asset_dir();
 import { readFileSync as readFileSync7, existsSync as existsSync7 } from "fs";
-import { resolve as resolve5, dirname as dirname6 } from "path";
+import { resolve as resolve6, dirname as dirname6 } from "path";
 import { fileURLToPath as fileURLToPath8 } from "url";
 var __filename6 = fileURLToPath8(import.meta.url);
 var __dirname7 = dirname6(__filename6);
-var TEMPLATES_DIR = resolve5(__dirname7, "../templates");
-var TEMPLATES_DIR_FALLBACK = resolve5(__dirname7, "../../../agent_moss/templates");
 var TEMPLATE_FILES = ["prompt1_template.txt", "prompt2_template.txt", "security_judge_template.txt"];
 var cachedTemplates = null;
 function loadTemplates() {
   if (cachedTemplates) return cachedTemplates;
   cachedTemplates = {};
-  const dir = existsSync7(TEMPLATES_DIR) ? TEMPLATES_DIR : TEMPLATES_DIR_FALLBACK;
-  if (!existsSync7(dir)) {
-    console.warn("[AgentMoss] Templates directory not found:", TEMPLATES_DIR, "and fallback:", TEMPLATES_DIR_FALLBACK);
+  const dir = resolveAssetDir(__dirname7, "templates");
+  if (!dir) {
+    const [primary, fallback] = assetDirCandidates(__dirname7, "templates");
+    console.warn("[AgentMoss] Templates directory not found:", primary, "and fallback:", fallback);
     return cachedTemplates;
   }
   for (const file of TEMPLATE_FILES) {
-    const filePath = resolve5(dir, file);
+    const filePath = resolve6(dir, file);
     if (existsSync7(filePath)) {
       const key = file.replace(".txt", "").replace("_template", "");
       cachedTemplates[key] = readFileSync7(filePath, "utf-8");
@@ -4548,7 +4573,7 @@ function loadTemplates() {
 // src/engine/script-analyzer.ts
 init_esm_shims();
 import { readFileSync as readFileSync8 } from "fs";
-import { resolve as resolve6, join as join4 } from "path";
+import { resolve as resolve7, join as join4 } from "path";
 var SUSPICIOUS_PATTERNS = [
   // Network exfiltration (curl/wget POST in scripts is almost never legitimate)
   { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
@@ -4681,7 +4706,7 @@ function assessKeywordCombinationRisk(matchedKeywords, scriptContent) {
 }
 function readScriptContent(scriptPath, maxLines = 500) {
   try {
-    const expandedPath = scriptPath.startsWith("~") ? join4(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve6(scriptPath);
+    const expandedPath = scriptPath.startsWith("~") ? join4(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve7(scriptPath);
     const raw = readFileSync8(expandedPath, "utf-8");
     const lines = raw.split("\n").slice(0, maxLines);
     return { content: lines.join("\n"), lineCount: lines.length, error: "" };
@@ -4738,7 +4763,7 @@ init_heuristic();
 init_logic_rules();
 init_inline_analyzer();
 import { statSync as statSync3, existsSync as existsSync9 } from "fs";
-import { resolve as resolve8, join as join6, isAbsolute as isAbsolute2 } from "path";
+import { resolve as resolve9, join as join6, isAbsolute as isAbsolute2 } from "path";
 import { homedir as homedir4 } from "os";
 
 // src/engine/script-engine/tracker.ts
@@ -6441,7 +6466,7 @@ function resolvePath2(p) {
   if (expanded.startsWith("~/") || expanded === "~") {
     expanded = join6(homedir4(), expanded.slice(1));
   }
-  return resolve8(expanded);
+  return resolve9(expanded);
 }
 function scanScriptChainWithL1(chain, input) {
   for (const node of chain.nodes) {
@@ -6817,7 +6842,7 @@ async function analyzeWithLLM(prompt, config) {
       }
       if (attempt < maxRetries) {
         console.error(`[AgentMoss] LLM call failed (attempt ${attempt + 1}/${maxRetries + 1}), retrying in ${retryCfg.retryInterval}s:`, err.message);
-        await new Promise((resolve9) => setTimeout(resolve9, retryCfg.retryInterval * 1e3));
+        await new Promise((resolve10) => setTimeout(resolve10, retryCfg.retryInterval * 1e3));
       } else {
         clearTimeout(totalTimeoutTimer);
         console.error("[AgentMoss] LLM call failed after all retries:", err.message);
@@ -10046,12 +10071,12 @@ function createApp() {
 }
 async function findFreePort(startPort, host = "127.0.0.1", scan = 100) {
   for (let port = startPort; port < startPort + scan; port++) {
-    const free = await new Promise((resolve9) => {
+    const free = await new Promise((resolve10) => {
       const server = net.createServer();
       server.listen(port, host, () => {
-        server.close(() => resolve9(true));
+        server.close(() => resolve10(true));
       });
-      server.on("error", () => resolve9(false));
+      server.on("error", () => resolve10(false));
     });
     if (free) {
       if (port !== startPort) {
@@ -10092,4 +10117,3 @@ export {
 //!   P6 mc-ltl-rules                 LTL 模型检测
 //!   P7 low-integrity-command-exec   低完整性命令执行
 //!   P8 sensitive-data-aggregation   敏感数据聚合外传
-//# sourceMappingURL=server.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kenhkl/agent-moss",
-  "version": "0.15.5",
+  "version": "0.15.7",
   "description": "Multi-layer security analysis engine for AI agents (TypeScript)",
   "type": "module",
   "main": "dist/server.js",
@@ -20,6 +20,7 @@
   },
   "files": [
     "dist",
+    "!dist/**/*.map",
     "README.md"
   ],
   "scripts": {
@@ -49,4 +50,4 @@
     "vitest": "^4.1.10"
   },
   "license": "MIT"
-}
+}

package/dist/agents/__init__.py

@@ -1,105 +0,0 @@
-"""三方 agent 定制化注册中心
-
-按 `agent_id` 加载该 agent 的专属规则集（JSON 单一事实源）。
-规则文件位置：`agent_moss/agents/<agent_id>/rules.json`
-
-Python 与 TypeScript 两端共享同一份 rules.json：
-- py: agent_moss/agents/__init__.py:get_agent_extensions
-- ts: ts/src/agents/index.ts:getAgentExtensions
-
-使用：
-    from agent_moss.agents import get_agent_extensions
-    ext = get_agent_extensions("xiaoo")
-    if ext:
-        # 把 ext.extra_command_patterns 追加到通用规则之后
-        ...
-
-无 agent_id 或 rules.json 不存在时返回 None（通用模式）。
-"""
-
-from pathlib import Path
-import threading
-import logging
-
-from .base import AgentExtensions, InjectionKeyword, CommandPattern, SensitivePath
-
-logger = logging.getLogger(__name__)
-
-_AGENTS_DIR = Path(__file__).parent
-_cache: dict[str, AgentExtensions | None] = {}
-_lock = threading.Lock()
-
-
-def get_agent_extensions(agent_id: str) -> AgentExtensions | None:
-    """按 agent_id 加载该 agent 的专属规则集。
-
-    Args:
-        agent_id: 调用方 agent 标识，如 "xiaoo" / "opencode" / "opendesk"。
-                  空字符串返回 None（通用模式）。
-
-    Returns:
-        AgentExtensions 实例，或 None（无 agent 专属规则）。
-    """
-    if not agent_id:
-        return None
-
-    # 双重检查锁定，避免并发重复 IO
-    if agent_id in _cache:
-        return _cache[agent_id]
-
-    with _lock:
-        if agent_id in _cache:
-            return _cache[agent_id]
-
-        # 统一存储：优先读 runtime_config 的 agent_rules 分区（用户可在 console
-        # 查看/编辑/禁用/新增，享受与通用规则一致的合并升级）。回退 rules.json
-        # （无 runtime_config 时，如直接起服务未 seed、或旧部署）。
-        ext = None
-        try:
-            from ..infra.runtime_config import has_runtime_config, load_runtime_config, get_enabled_agent_extensions
-            if has_runtime_config():
-                ext = get_enabled_agent_extensions(load_runtime_config(), agent_id)
-        except Exception:
-            pass  # runtime_config 不可用时回退 rules.json
-
-        if ext is None:
-            rules_file = _AGENTS_DIR / agent_id / "rules.json"
-            if not rules_file.exists():
-                logger.debug("agent %s 无 rules.json，走通用模式", agent_id)
-                _cache[agent_id] = None
-                return None
-            try:
-                ext = AgentExtensions.from_json(rules_file)
-            except Exception as e:
-                logger.error("加载 agent %s rules.json 失败: %s", agent_id, e)
-                _cache[agent_id] = None
-                return None
-
-        _cache[agent_id] = ext
-        logger.info(
-            "加载 agent %s 定制规则: %d cmd patterns, %d injection keywords, "
-            "%d sensitive paths, %d builtin safe skills, %d builtin safe action types",
-            agent_id,
-            len(ext.extra_command_patterns),
-            len(ext.extra_injection_keywords),
-            len(ext.extra_sensitive_paths),
-            len(ext.builtin_safe_skills),
-            len(ext.builtin_safe_action_types),
-        )
-        return ext
-
-
-def clear_agent_extensions_cache() -> None:
-    """清空 agent 扩展缓存（用于测试或 rules.json 热加载）"""
-    with _lock:
-        _cache.clear()
-
-
-__all__ = [
-    "AgentExtensions",
-    "InjectionKeyword",
-    "CommandPattern",
-    "SensitivePath",
-    "get_agent_extensions",
-    "clear_agent_extensions_cache",
-]

package/dist/agents/base.py

@@ -1,158 +0,0 @@
-"""三方 agent 定制化扩展 — 数据载体
-
-`AgentExtensions` 描述某个宿主 agent（xiaoO / opencode / opendesk）在通用安全规则
-之上需要追加的专属规则。规则以 JSON 单一事实源存储（agent_moss/agents/<id>/rules.json），
-Python 与 TypeScript 两端共享同一份文件。
-
-设计原则：
-- 所有字段以 `extra_` 为前缀，表示"追加到通用规则之后"，不覆盖通用规则。
-- 通用规则先匹配；命中即短路，避免重复检测。
-- agent 专属规则只做"通用规则没覆盖的宿主 agent 特有风险"。
-
-JSON schema（agent_moss/agents/<id>/rules.json）：
-{
-  "agent_id": "xiaoo",
-  "description": "xiaoO 宿主 agent 专属安全规则",
-  "extra_command_patterns": [CommandPattern...],
-  "extra_injection_keywords": [InjectionKeyword...],
-  "extra_sensitive_paths": [SensitivePath...],
-  "builtin_safe_skills": ["xiaoo-guardian"],
-  "builtin_safe_action_types": ["memory-", "todomgr-", "mailbox-getEmailList"],
-  "extra_skills": []
-}
-"""
-
-from dataclasses import dataclass, field
-from pathlib import Path
-import json
-import logging
-
-from agent_moss.profiles.base import CommandPattern, SensitivePath
-
-logger = logging.getLogger(__name__)
-
-
-@dataclass
-class InjectionKeyword:
-    """Prompt 注入关键词条目"""
-    keyword: str
-    risk_level: str      # low / medium / high / critical
-    lang: str            # en / zh
-
-
-@dataclass
-class AgentExtensions:
-    """三方 agent 定制化扩展
-
-    由 `agent_moss.agents.get_agent_extensions(agent_id)` 按需加载。
-    缺失 rules.json 时返回 None（通用模式）。
-    """
-    agent_id: str
-    description: str = ""
-    extra_command_patterns: list[CommandPattern] = field(default_factory=list)
-    extra_injection_keywords: list[InjectionKeyword] = field(default_factory=list)
-    extra_sensitive_paths: list[SensitivePath] = field(default_factory=list)
-    builtin_safe_skills: list[str] = field(default_factory=list)
-    # agent 专属"完全安全操作"白名单（精确名或前缀，前缀以 '-' 结尾）→ 跳过 L2+L3。
-    # 对齐 TS ts/src/agents/types.ts。前缀匹配（如 "memory-"）走 startswith，精确名走 ==。
-    builtin_safe_action_types: list[str] = field(default_factory=list)
-    extra_skills: list[dict] = field(default_factory=list)
-
-    @classmethod
-    def merge(cls, *exts: "AgentExtensions | None") -> "AgentExtensions | None":
-        """合并多个 AgentExtensions（如 agent 规则 + 场景规则），追加式拼接各 extra_* 列表。
-
-        全部为 None 时返回 None（通用模式）。非 None 时以第一个非空实例为骨架，
-        其余实例的 extra_* / builtin_safe_* 列表依次追加在后（不覆盖）。
-        """
-        non_null = [e for e in exts if e is not None]
-        if not non_null:
-            return None
-        base = non_null[0]
-        return cls(
-            agent_id=base.agent_id,
-            description=base.description,
-            extra_command_patterns=[
-                p for e in non_null for p in e.extra_command_patterns
-            ],
-            extra_injection_keywords=[
-                k for e in non_null for k in e.extra_injection_keywords
-            ],
-            extra_sensitive_paths=[
-                sp for e in non_null for sp in e.extra_sensitive_paths
-            ],
-            builtin_safe_skills=[
-                s for e in non_null for s in e.builtin_safe_skills
-            ],
-            builtin_safe_action_types=[
-                t for e in non_null for t in e.builtin_safe_action_types
-            ],
-            extra_skills=[
-                sk for e in non_null for sk in e.extra_skills
-            ],
-        )
-
-    @classmethod
-    def from_json(cls, rules_file: Path, id_key: str = "agent_id") -> "AgentExtensions":
-        """从 rules.json 加载 AgentExtensions。
-
-        Args:
-            rules_file: agent_moss/agents/<id>/rules.json 的绝对路径（场景规则传
-                        agent_moss/scenarios/<id>/rules.json，id_key="scenario_id"）
-            id_key: JSON 中的 id 字段名。agent 规则默认 "agent_id"；
-                    场景规则（agent_moss/scenarios/<id>/rules.json）用 "scenario_id"。
-
-        Returns:
-            AgentExtensions 实例
-
-        Raises:
-            ValueError: JSON 结构不合法
-        """
-        with open(rules_file, "r", encoding="utf-8") as f:
-            data = json.load(f)
-
-        agent_id = data.get(id_key, "")
-        if not agent_id:
-            raise ValueError(f"rules.json 缺少 {id_key} 字段: {rules_file}")
-
-        # extra_command_patterns: dict → CommandPattern
-        extra_cmd_patterns: list[CommandPattern] = []
-        for p in data.get("extra_command_patterns", []):
-            extra_cmd_patterns.append(CommandPattern(
-                pattern=p["pattern"],
-                risk_level=p["risk_level"],
-                risk_type=p["risk_type"],
-                reason=p["reason"],
-            ))
-
-        # extra_injection_keywords: dict → InjectionKeyword
-        extra_inj_keywords: list[InjectionKeyword] = []
-        for k in data.get("extra_injection_keywords", []):
-            extra_inj_keywords.append(InjectionKeyword(
-                keyword=k["keyword"],
-                risk_level=k["risk_level"],
-                lang=k.get("lang", "en"),
-            ))
-
-        # extra_sensitive_paths: dict → SensitivePath
-        extra_sensitive_paths: list[SensitivePath] = []
-        for sp in data.get("extra_sensitive_paths", []):
-            extra_sensitive_paths.append(SensitivePath(
-                path=sp["path"],
-                risk_level=sp["risk_level"],
-                desc=sp["desc"],
-                credential=sp.get("credential", False),
-                read_only=sp.get("read_only", False),
-                deny_mode=sp.get("deny_mode", ""),
-            ))
-
-        return cls(
-            agent_id=agent_id,
-            description=data.get("description", ""),
-            extra_command_patterns=extra_cmd_patterns,
-            extra_injection_keywords=extra_inj_keywords,
-            extra_sensitive_paths=extra_sensitive_paths,
-            builtin_safe_skills=data.get("builtin_safe_skills", []),
-            builtin_safe_action_types=data.get("builtin_safe_action_types", []),
-            extra_skills=data.get("extra_skills", []),
-        )