@kenhkl/agent-moss 0.16.13 → 0.17.0

package/dist/rules/l2_rules.json

@@ -173,7 +173,8 @@
         "(?:cat|head|tail|less|more|grep)\\s+[^;&|\\n]*known_hosts",
         "\\bpython3?\\s+-c\\s+['\\\"][\\s\\S]{0,200}?(?:base64\\.b64encode|open\\s*\\(|Path\\(|io\\.open\\s*\\(|read_text\\s*\\(|read\\s*\\()[\\s\\S]{0,200}?(?:/etc/shadow|/etc/passwd|id_rsa|credentials|\\.ssh)",
         "(?:grep|find|cat)\\s+[^;&|\\n]*\\b(?:password|secret|passwd|shadow|credential|api[_-]?key)\\b[^;&|\\n]*(?:/etc/shadow|/etc/passwd|id_rsa|credentials|\\.ssh)",
-        "(?:cp|mv|dd|curl)\\s+[^;&|\\n]*(?:/etc/shadow|/etc/passwd|id_rsa|credentials|\\.ssh)"
+        "(?:cp|mv|dd|curl)\\s+[^;&|\\n]*(?:/etc/shadow|/etc/passwd|id_rsa|credentials|\\.ssh)",
+        "(?:cat|head|tail|less|more|sed|awk|strings|base64|dd|cp|mv|grep|xxd|od)\\s+[^;&|\\n]*(?:\\.config/agentmoss/auth_token|\\.agentmoss/stateful_chains|agent_moss_policy_cache|agent_moss/rules|agent_moss/skills|agent_moss/agents/|agent_moss/scenarios/)"
       ],
       "PERSIST": [
         "(?:echo|printf|cat)\\b[^;\\n]*\\|[^;\\n]*(?:crontab|at\\b)\\s*-",

package/dist/rules/logic_rules.json

@@ -0,0 +1,73 @@
+{
+  "_comment": "L2 逻辑规则的识别词表（Python engine/logic_rules.py ↔ TS engine/logic-rules.ts 单一事实源）。全部为子串匹配，被匹配文本先转小写。",
+  "_dir_traversal_note": "目录遍历词表不在这里：它复用 inline_rules.json 的 dir_traversal_keywords —— 两处原本就是逐字相同的 10 条，再放一份就是给自己造双份维护。",
+  "indirect_file_access": {
+    "_comment": "间接文件访问（Rule 4.5）：内联脚本用目录遍历动态发现文件 + 读写/执行调用。四组词分别决定「有没有文件操作」和「是读还是写/执行」—— 写/执行时所有敏感文件都拦，只读时只拦凭据文件。",
+    "read_keywords": [
+      "read(",
+      "readline",
+      "readlines",
+      "fread",
+      "fgets",
+      "load(",
+      "getpass",
+      "file_get_contents"
+    ],
+    "write_keywords": [
+      "write(",
+      "writelines",
+      "fwrite",
+      "file_put_contents"
+    ],
+    "exec_keywords": [
+      "system(",
+      "exec(",
+      "eval(",
+      "popen(",
+      "os.system",
+      "os.popen",
+      "subprocess",
+      "os.exec",
+      "os.spawn",
+      "shell=true",
+      "check_output",
+      "check_call",
+      "run(",
+      "passthru",
+      "shell_exec",
+      "proc_open"
+    ],
+    "open_keywords": [
+      "open(",
+      "fopen("
+    ]
+  },
+  "_more": "另有几组「谁算写操作 / 谁算临时目录」的通用名单，原先散在 logic_rules.py 的三个函数里各写一份。",
+  "non_write_tool_prefixes": [
+    "memory-",
+    "skill-manager-",
+    "mailbox-",
+    "app-"
+  ],
+  "_non_write_tool_prefixes_comment": "写判定豁免的非写工具前缀（不含 skill-，与 heuristic 的敏感路径排除名单刻意差一项）。",
+  "write_commands": [
+    "cp",
+    "mv",
+    "install",
+    "tee",
+    "dd",
+    "truncate",
+    "mkfs",
+    "fdisk",
+    "parted"
+  ],
+  "_write_commands_comment": "写/删命令集合（逐段首词判定，供重定向/通配判定用）。",
+  "source_arg_commands": [
+    "cp",
+    "mv",
+    "install",
+    "rsync"
+  ],
+  "_source_arg_commands_comment": "第一个位置参数是「源文件」的命令：源在敏感目录 → 视为读取。",
+  "_reused": "不重复存的两组：① 写/删命令词边界正则 = platform_traits.json 的 write_command_res（逐字相同）；② 工具排除前缀 = heuristic_rules.json 的 sensitive_excluded_prefixes（逐字相同）；③ 临时目录名单 = heuristic_rules.json 的 temp_dirs（L1/L2 共用一份）。"
+}

package/dist/rules/manifest.json

@@ -0,0 +1,6 @@
+{
+  "_comment": "规则包清单。schema_version 是**契约**：引擎启动时按自己认识的版本校验，不匹配直接报错（不会'读不懂就当空'）。结构有破坏性变更时才 +1；新增文件/新增可选键不用动。",
+  "schema_version": 1,
+  "name": "agent-moss-rules",
+  "description": "AgentMoss 内置规则包：L1/L2/L3 规则、平台特征、脚本与形式化引擎识别名单。契约与校验见 agent_moss/rules_contract.py。"
+}

package/dist/rules/platform_traits.json

@@ -0,0 +1,389 @@
+{
+  "_comment": [
+    "平台行为特征（Platform Traits）—— 双端共用的单一事实源。",
+    "Python: agent_moss/profiles/*.py  ← rules_loader.load_platform_traits()",
+    "TS:     ts/src/engine/platform-traits.ts ← rules-loader.loadPlatformTraits()",
+    "",
+    "这些不是『检测规则』而是『放行/豁免的边界』，直接决定判定的宽严，改动务必谨慎：",
+    "  fully_safe_commands            首段命令命中 → 跳过 L2 + L3",
+    "  readonly_sensitive_commands    首段命令命中 → 跳 L3，保留 L2（L1 敏感路径照常）",
+    "  read_only_commands             命令词命中 → 重定向 > 视为输出而非写文件",
+    "  write_command_res              命令词命中 → 视为写/删意图（词边界正则）",
+    "  write_keywords / read_keywords 意图关键词（子串匹配，不加词边界）",
+    "  safe_action_types              action_type 命中 → 跳过 L2 + L3",
+    "  readonly_sensitive_action_types action_type 命中 → 跳 L3，保留 L2",
+    "",
+    "macos / harmony 继承 linux（同为类 Unix 命令集），只写 inherits 即可。",
+    "列表类字段保持顺序（与源码一致）；集合类字段（read_only_commands / safe_action_types /",
+    "readonly_sensitive_action_types）已按字典序排列 —— 仅做成员判断，顺序无语义。",
+    "改动后自查：python3 -m pytest tests/test_platform_traits.py"
+  ],
+  "_schema": 1,
+  "linux": {
+    "write_keywords": [
+      "write",
+      "写入",
+      "save",
+      "保存",
+      "modify",
+      "修改",
+      "update",
+      "更新",
+      "delete",
+      "删除",
+      "remove",
+      "移除",
+      "create",
+      "创建",
+      "append",
+      "追加",
+      "truncate",
+      "截断",
+      "overwrite",
+      "覆盖",
+      "replace",
+      "替换",
+      "edit"
+    ],
+    "read_keywords": [
+      "read",
+      "读取",
+      "cat",
+      "head",
+      "tail",
+      "less",
+      "more",
+      "view",
+      "查看",
+      "open",
+      "打开",
+      "load",
+      "加载",
+      "grep",
+      "search",
+      "搜索",
+      "find",
+      "查找"
+    ],
+    "write_command_res": [
+      "\\brm\\b",
+      "\\bunlink\\b",
+      "\\brmdir\\b",
+      "\\bshred\\b",
+      "\\bcp\\b",
+      "\\bmv\\b",
+      "\\binstall\\b",
+      "\\btee\\b",
+      "\\bdd\\b",
+      "\\bmkfs\\b",
+      "\\b(fdisk|parted|cfdisk|sfdisk)\\b",
+      "\\bchmod\\b",
+      "\\bchown\\b",
+      "\\btruncate\\b"
+    ],
+    "read_only_commands": [
+      "arch",
+      "arp",
+      "awk",
+      "blockdev",
+      "cat",
+      "cut",
+      "df",
+      "dir",
+      "dmesg",
+      "dmidecode",
+      "du",
+      "echo",
+      "ethtool",
+      "fdisk",
+      "file",
+      "find",
+      "free",
+      "getconf",
+      "getent",
+      "grep",
+      "head",
+      "hexdump",
+      "hostnamectl",
+      "hwinfo",
+      "id",
+      "ifconfig",
+      "inxi",
+      "iostat",
+      "ip",
+      "journalctl",
+      "last",
+      "less",
+      "localectl",
+      "ls",
+      "lsblk",
+      "lscpu",
+      "lsmem",
+      "lsmod",
+      "lsns",
+      "lsof",
+      "lspci",
+      "lsusb",
+      "modinfo",
+      "more",
+      "mpstat",
+      "netstat",
+      "nl",
+      "nmcli",
+      "nproc",
+      "od",
+      "parted",
+      "pgrep",
+      "pidof",
+      "printf",
+      "ps",
+      "rev",
+      "route",
+      "sed",
+      "smartctl",
+      "sort",
+      "ss",
+      "stat",
+      "strings",
+      "sysctl",
+      "systemctl",
+      "tac",
+      "tail",
+      "timedatectl",
+      "top",
+      "tr",
+      "tree",
+      "udevadm",
+      "uname",
+      "uniq",
+      "uptime",
+      "vmstat",
+      "w",
+      "wc",
+      "who",
+      "whoami",
+      "xxd"
+    ],
+    "fully_safe_commands": [
+      "^ls(?:\\s|$)",
+      "^dir(?:\\s|$)",
+      "^pwd(?:\\s|$)",
+      "^which\\s+",
+      "^whereis\\s+",
+      "^realpath\\s+",
+      "^basename\\s+",
+      "^dirname\\s+",
+      "^file\\s+",
+      "^stat\\s+",
+      "^du(?:\\s|$)",
+      "^echo\\s+",
+      "^printf\\s+",
+      "^type\\s+",
+      "^command\\s+",
+      "^whoami(?:\\s|$)",
+      "^id(?:\\s|$)",
+      "^hostname(?:\\s|$)",
+      "^uname(?:\\s|$)",
+      "^date(?:\\s|$)",
+      "^env(?:\\s|$)",
+      "^printenv(?:\\s|$)",
+      "^tty(?:\\s|$)",
+      "^arch(?:\\s|$)",
+      "^uptime(?:\\s|$)",
+      "^groups(?:\\s|$)",
+      "^logname(?:\\s|$)",
+      "^df(?:\\s|$)",
+      "^free(?:\\s|$)",
+      "^vmstat(?:\\s|$)",
+      "^nproc(?:\\s|$)",
+      "^lscpu(?:\\s|$)",
+      "^lsblk(?:\\s|$)",
+      "^lspci(?:\\s|$)",
+      "^lsusb(?:\\s|$)",
+      "^lsmod(?:\\s|$)"
+    ],
+    "readonly_sensitive_commands": [
+      "^cat\\s+\\S",
+      "^head(?:\\s|$)",
+      "^tail(?:\\s|$)",
+      "^less(?:\\s|$)",
+      "^more(?:\\s|$)",
+      "^wc(?:\\s|$)",
+      "^grep(?:\\s|$)",
+      "^find\\s+",
+      "^ag(?:\\s|$)",
+      "^rg(?:\\s|$)",
+      "^awk\\s+",
+      "^(?!.*(?:\\s|['\\\"])-[a-zA-Z]*i[a-zA-Z]*\\b)(?!.*(?:\\s|['\\\"])--in-place)sed\\s+",
+      "^cut\\s+",
+      "^sort(?:\\s|$)",
+      "^uniq(?:\\s|$)",
+      "^ps(?:\\s|$)",
+      "^ss(?:\\s|$)",
+      "^netstat(?:\\s|$)",
+      "^lsof(?:\\s|$)",
+      "^systemctl\\s+(?:status|is-active|is-enabled|is-failed|list-units|list-unit-files|list-dependencies|show|cat)\\b",
+      "^service\\s+\\S+\\s+status\\b",
+      "^journalctl\\b(?!.*--(?:vacuum-size|vacuum-time|vacuum-files|rotate|flush|sync)\\b)"
+    ],
+    "safe_action_types": [
+      "ask_user_question",
+      "count_text_length",
+      "filemgr-globfiles",
+      "glob",
+      "list_dir",
+      "ls"
+    ],
+    "readonly_sensitive_action_types": [
+      "file_read",
+      "filemgr-grepfiles",
+      "filemgr-readfile",
+      "grep",
+      "head",
+      "read",
+      "read_file",
+      "tail"
+    ]
+  },
+  "windows": {
+    "write_keywords": [
+      "write",
+      "写入",
+      "save",
+      "保存",
+      "modify",
+      "修改",
+      "update",
+      "更新",
+      "delete",
+      "删除",
+      "remove",
+      "移除",
+      "create",
+      "创建",
+      "append",
+      "追加",
+      "overwrite",
+      "覆盖",
+      "replace",
+      "替换",
+      "set",
+      "设置"
+    ],
+    "read_keywords": [
+      "read",
+      "读取",
+      "type",
+      "findstr",
+      "dir",
+      "view",
+      "查看",
+      "open",
+      "打开",
+      "load",
+      "加载",
+      "search",
+      "搜索",
+      "find",
+      "查找",
+      "get",
+      "获取"
+    ],
+    "write_command_res": [
+      "\\b(del|erase)\\b",
+      "\\brmdir\\b",
+      "\\b(rd)\\b",
+      "\\bcopy\\b",
+      "\\b(xcopy|robocopy)\\b",
+      "\\b(move|movefile)\\b",
+      "\\breplace\\b",
+      "\\bicacls\\b",
+      "\\battrib\\b",
+      "\\breg(?:\\.exe)?\\s+(?:add|delete|copy|save|restore|import|load|unload)\\b",
+      "\\bformat\\b",
+      "\\bdiskpart\\b",
+      "\\bmkdir\\b",
+      "\\bmd\\b",
+      "\\bsetx\\b",
+      "\\bwmic\\b"
+    ],
+    "read_only_commands": [
+      "cls",
+      "cmd",
+      "comp",
+      "dir",
+      "diskpart",
+      "driverquery",
+      "echo",
+      "fc",
+      "find",
+      "findstr",
+      "getmac",
+      "help",
+      "hostname",
+      "ipconfig",
+      "more",
+      "netstat",
+      "powershell",
+      "query",
+      "reg",
+      "sort",
+      "systeminfo",
+      "tasklist",
+      "tree",
+      "type",
+      "ver",
+      "w32tm",
+      "where",
+      "whoami",
+      "wmic"
+    ],
+    "fully_safe_commands": [
+      "^dir(?:\\s|$)",
+      "^where\\s+",
+      "^echo\\s+",
+      "^cd(?:\\s|$)",
+      "^tree(?:\\s|$)",
+      "^help(?:\\s|$)",
+      "^cls(?:\\s|$)",
+      "^ver(?:\\s|$)",
+      "^whoami(?:\\s|$)",
+      "^hostname(?:\\s|$)",
+      "^systeminfo(?:\\s|$)",
+      "^tasklist(?:\\s|$)",
+      "^getmac(?:\\s|$)",
+      "^driverquery(?:\\s|$)",
+      "^netstat(?:\\s|$)"
+    ],
+    "readonly_sensitive_commands": [
+      "^type\\s+",
+      "^findstr\\s+",
+      "^sc\\s+query\\b",
+      "^reg\\s+query\\b"
+    ],
+    "safe_action_types": [
+      "ask_user_question",
+      "count_text_length",
+      "filemgr-globfiles",
+      "glob",
+      "list_dir",
+      "ls"
+    ],
+    "readonly_sensitive_action_types": [
+      "file_read",
+      "filemgr-grepfiles",
+      "filemgr-readfile",
+      "grep",
+      "head",
+      "read",
+      "read_file",
+      "tail"
+    ]
+  },
+  "macos": {
+    "inherits": "linux"
+  },
+  "harmony": {
+    "inherits": "linux"
+  }
+}