@kenhkl/agent-moss 0.16.4 → 0.16.5

package/dist/cli.js

@@ -5724,6 +5724,27 @@ function parseIf(content, args) {
 ${chosen}
 ${content.slice(fiPos + 2)}`;
 }
+function stripNonExecutableLines(content) {
+  if (!content) return content;
+  const out = [];
+  let heredocEnd = null;
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (heredocEnd !== null) {
+      if (line.trim() === heredocEnd) heredocEnd = null;
+      out.push(line);
+      continue;
+    }
+    const m = HEREDOC_RE.exec(line);
+    if (m) heredocEnd = m[1];
+    const stripped = line.replace(/^\s+/, "");
+    if (i === 0 && stripped.startsWith("#!")) continue;
+    if (stripped.startsWith("#")) continue;
+    out.push(line);
+  }
+  return out.join("\n");
+}
 function markLoopsReachable(content) {
   return content;
 }
@@ -5745,12 +5766,13 @@ function extractCallsFromContent(content) {
   }
   return calls;
 }
-var CHILD_CALL_RE2, ShellBackend;
+var HEREDOC_RE, CHILD_CALL_RE2, ShellBackend;
 var init_shell_backend = __esm({
   "src/engine/script-engine/backends/shell-backend.ts"() {
     "use strict";
     init_esm_shims();
     init_symbolic();
+    HEREDOC_RE = /<<-?\s*['"]?(\w+)['"]?/;
     CHILD_CALL_RE2 = /(?:^|\s|&&|\|\|)\s*((?:\/bin\/)?bash|sh|zsh|(?:python|python3|node|ruby|perl|php|lua))\s+(\S+(?:\.(?:sh|shrc|py|js|rb|pl|php|lua))?)([^\n;|&]*?)$/gmi;
     ShellBackend = class {
       language = "shell";
@@ -5780,6 +5802,7 @@ var init_shell_backend = __esm({
             bound = symOut;
           }
         }
+        bound = stripNonExecutableLines(bound);
         const loopMarked = markLoopsReachable(bound);
         const calls = extractCallsFromContent(loopMarked);
         return {
@@ -6192,7 +6215,30 @@ function resolvePath2(p) {
   }
   return resolve9(expanded);
 }
-function scanScriptChainWithL1(chain, input) {
+function scanExtensionPatterns(ext, content) {
+  const pats = ext?.extra_command_patterns;
+  if (!pats || pats.length === 0) return null;
+  for (const p of pats) {
+    const src = typeof p === "string" ? p : p?.pattern;
+    if (!src) continue;
+    let re;
+    try {
+      re = new RegExp(src, "i");
+    } catch {
+      continue;
+    }
+    if (re.test(content)) {
+      const risk = typeof p === "string" ? "high" : p.risk_level || "high";
+      return {
+        riskLevel: risk,
+        riskType: typeof p === "string" ? "sensitive_action" : p.risk_type || "sensitive_action",
+        reason: typeof p === "string" ? `\u547D\u4E2D\u6269\u5C55\u89C4\u5219: ${src}` : p.reason || `\u547D\u4E2D\u6269\u5C55\u89C4\u5219: ${src}`
+      };
+    }
+  }
+  return null;
+}
+function scanScriptChainWithL1(chain, input, ext) {
   for (const node of chain.nodes) {
     if (node.error || !node.preprocessedContent || node.l1Hit) continue;
     const virtualInput = {
@@ -6200,6 +6246,19 @@ function scanScriptChainWithL1(chain, input) {
       aNext: { actionType: "bash", actionDetail: node.preprocessedContent }
     };
     const l1 = scanDangerousCommandPatterns("bash", node.preprocessedContent, input.osType);
+    const extHit = scanExtensionPatterns(ext, node.preprocessedContent);
+    if (extHit) {
+      node.l1Hit = true;
+      node.l1RiskLevel = extHit.riskLevel;
+      node.l1RiskType = extHit.riskType;
+      node.l1Reason = extHit.reason;
+      if (extHit.riskLevel === "critical") {
+        chain.hasCritical = true;
+        chain.firstHitNode = node;
+        break;
+      }
+      continue;
+    }
     if (l1 && !l1.allowed) {
       node.l1Hit = true;
       node.l1RiskLevel = l1.riskLevel;
@@ -6263,7 +6322,7 @@ function scanScriptChainKeywords(chain) {
   }
   return chain;
 }
-function analyzeScriptContent2(input) {
+function analyzeScriptContent2(input, ext) {
   const actionType = input.aNext.actionType.toLowerCase();
   if (actionType !== "bash") return emptyChain();
   const { path: scriptPath, args: scriptArgs } = extractScriptPathWithArgs(input.aNext.actionDetail);
@@ -6295,7 +6354,7 @@ function analyzeScriptContent2(input) {
   const tracker = new RecursiveTracker(l1Adapter);
   const chain = tracker.track(resolvedPath, isInline ? null : scriptArgs, input.cwd || process.cwd());
   if (chain.nodes.length === 0) return chain;
-  scanScriptChainWithL1(chain, input);
+  scanScriptChainWithL1(chain, input, ext);
   scanScriptChainWithL2(chain, input);
   scanScriptChainKeywords(chain);
   return chain;
@@ -8973,9 +9032,13 @@ async function runAnalysis(input) {
       }
     }
   }
+  const agentExt = mergeAgentExtensions(
+    isLayerEnabled("agent_rules_enabled") ? getAgentExtensions(input.agentId) : null,
+    isLayerEnabled("scenario_rules_enabled") ? getScenarioExtensionsMulti(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "") : null
+  );
   let scriptChain = null;
   if (input.aNext.actionType.toLowerCase() === "bash") {
-    scriptChain = analyzeScriptContent2(input);
+    scriptChain = analyzeScriptContent2(input, agentExt);
     if (scriptChain.nodes.length > 0) {
       for (const node of scriptChain.nodes) {
         if (node.unanalyzable) {
@@ -9027,10 +9090,6 @@ async function runAnalysis(input) {
   const actionType = input.aNext.actionType.toLowerCase();
   const rawDetail = extractRawCommand(input.aNext.actionDetail);
   const lowerDetail = rawDetail.toLowerCase();
-  const agentExt = mergeAgentExtensions(
-    isLayerEnabled("agent_rules_enabled") ? getAgentExtensions(input.agentId) : null,
-    isLayerEnabled("scenario_rules_enabled") ? getScenarioExtensionsMulti(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "") : null
-  );
   if (FULLY_SAFE_TOOLS.has(actionType)) {
     return {
       allowed: true,

package/dist/engine/coordinator.js

@@ -5901,6 +5901,28 @@ function parseIf(content, args) {
 ${chosen}
 ${content.slice(fiPos + 2)}`;
 }
+var HEREDOC_RE = /<<-?\s*['"]?(\w+)['"]?/;
+function stripNonExecutableLines(content) {
+  if (!content) return content;
+  const out = [];
+  let heredocEnd = null;
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (heredocEnd !== null) {
+      if (line.trim() === heredocEnd) heredocEnd = null;
+      out.push(line);
+      continue;
+    }
+    const m = HEREDOC_RE.exec(line);
+    if (m) heredocEnd = m[1];
+    const stripped = line.replace(/^\s+/, "");
+    if (i === 0 && stripped.startsWith("#!")) continue;
+    if (stripped.startsWith("#")) continue;
+    out.push(line);
+  }
+  return out.join("\n");
+}
 function markLoopsReachable(content) {
   return content;
 }
@@ -5951,6 +5973,7 @@ var ShellBackend = class {
         bound = symOut;
       }
     }
+    bound = stripNonExecutableLines(bound);
     const loopMarked = markLoopsReachable(bound);
     const calls = extractCallsFromContent(loopMarked);
     return {
@@ -6417,7 +6440,30 @@ function resolvePath2(p) {
   }
   return resolve9(expanded);
 }
-function scanScriptChainWithL1(chain, input) {
+function scanExtensionPatterns(ext, content) {
+  const pats = ext?.extra_command_patterns;
+  if (!pats || pats.length === 0) return null;
+  for (const p of pats) {
+    const src = typeof p === "string" ? p : p?.pattern;
+    if (!src) continue;
+    let re;
+    try {
+      re = new RegExp(src, "i");
+    } catch {
+      continue;
+    }
+    if (re.test(content)) {
+      const risk = typeof p === "string" ? "high" : p.risk_level || "high";
+      return {
+        riskLevel: risk,
+        riskType: typeof p === "string" ? "sensitive_action" : p.risk_type || "sensitive_action",
+        reason: typeof p === "string" ? `\u547D\u4E2D\u6269\u5C55\u89C4\u5219: ${src}` : p.reason || `\u547D\u4E2D\u6269\u5C55\u89C4\u5219: ${src}`
+      };
+    }
+  }
+  return null;
+}
+function scanScriptChainWithL1(chain, input, ext) {
   for (const node of chain.nodes) {
     if (node.error || !node.preprocessedContent || node.l1Hit) continue;
     const virtualInput = {
@@ -6425,6 +6471,19 @@ function scanScriptChainWithL1(chain, input) {
       aNext: { actionType: "bash", actionDetail: node.preprocessedContent }
     };
     const l1 = scanDangerousCommandPatterns("bash", node.preprocessedContent, input.osType);
+    const extHit = scanExtensionPatterns(ext, node.preprocessedContent);
+    if (extHit) {
+      node.l1Hit = true;
+      node.l1RiskLevel = extHit.riskLevel;
+      node.l1RiskType = extHit.riskType;
+      node.l1Reason = extHit.reason;
+      if (extHit.riskLevel === "critical") {
+        chain.hasCritical = true;
+        chain.firstHitNode = node;
+        break;
+      }
+      continue;
+    }
     if (l1 && !l1.allowed) {
       node.l1Hit = true;
       node.l1RiskLevel = l1.riskLevel;
@@ -6488,7 +6547,7 @@ function scanScriptChainKeywords(chain) {
   }
   return chain;
 }
-function analyzeScriptContent2(input) {
+function analyzeScriptContent2(input, ext) {
   const actionType = input.aNext.actionType.toLowerCase();
   if (actionType !== "bash") return emptyChain();
   const { path: scriptPath, args: scriptArgs } = extractScriptPathWithArgs(input.aNext.actionDetail);
@@ -6520,7 +6579,7 @@ function analyzeScriptContent2(input) {
   const tracker = new RecursiveTracker(l1Adapter);
   const chain = tracker.track(resolvedPath, isInline ? null : scriptArgs, input.cwd || process.cwd());
   if (chain.nodes.length === 0) return chain;
-  scanScriptChainWithL1(chain, input);
+  scanScriptChainWithL1(chain, input, ext);
   scanScriptChainWithL2(chain, input);
   scanScriptChainKeywords(chain);
   return chain;
@@ -8343,9 +8402,13 @@ async function runAnalysis(input) {
       }
     }
   }
+  const agentExt = mergeAgentExtensions(
+    isLayerEnabled("agent_rules_enabled") ? getAgentExtensions(input.agentId) : null,
+    isLayerEnabled("scenario_rules_enabled") ? getScenarioExtensionsMulti(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "") : null
+  );
   let scriptChain = null;
   if (input.aNext.actionType.toLowerCase() === "bash") {
-    scriptChain = analyzeScriptContent2(input);
+    scriptChain = analyzeScriptContent2(input, agentExt);
     if (scriptChain.nodes.length > 0) {
       for (const node of scriptChain.nodes) {
         if (node.unanalyzable) {
@@ -8397,10 +8460,6 @@ async function runAnalysis(input) {
   const actionType = input.aNext.actionType.toLowerCase();
   const rawDetail = extractRawCommand(input.aNext.actionDetail);
   const lowerDetail = rawDetail.toLowerCase();
-  const agentExt = mergeAgentExtensions(
-    isLayerEnabled("agent_rules_enabled") ? getAgentExtensions(input.agentId) : null,
-    isLayerEnabled("scenario_rules_enabled") ? getScenarioExtensionsMulti(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "") : null
-  );
   if (FULLY_SAFE_TOOLS.has(actionType)) {
     return {
       allowed: true,

package/dist/scenarios/bank/rules.json

@@ -1,12 +1,12 @@
 {
   "scenario_id": "bank",
-  "description": "银行沙箱场景定制规则。客户约束：沙箱用户（sandbox）仅允许读写 /home/sandbox、/opt/sandbox、/tmp 三个目录，其他根目录一律禁止读写；禁止远程访问/横向移动（ssh 家族 + scp/sftp/sshpass/ssh-copy-id + 用 ssh 的 rsync）。本地操作（ssh-keygen/ssh-add/ssh-agent、本地 rsync）不受影响。",
+  "description": "银行沙箱场景定制规则。客户约束：沙箱用户（sandbox）仅允许读写 /home/sandbox、/opt/sandbox、/tmp 三个目录，其他根目录一律禁止读写；禁止远程访问/横向移动（ssh 家族 + scp/sftp/sshpass/ssh-copy-id + 用 ssh 的 rsync）。本地操作（ssh-keygen/ssh-add/ssh-agent、本地 rsync）不受影响。另放行 /dev/null、/dev/stdout、/dev/stderr —— 这三个是 666/可写、仅作流丢弃与输出重定向用的标准设备文件（`2>/dev/null` 是最常见的运维写法），不放行会让大量正常命令被误拦；/dev 下**其余**文件（/dev/mem、/dev/sda、/dev/shm…）照常拦。",
   "extra_command_patterns": [
     {
-      "pattern": "(?<![\\w.:~/-])/(?:(?!home/sandbox(?:\\s|/|$)|opt/sandbox(?:\\s|/|$)|tmp(?:\\s|/|$))[^\\s;&|>\"'`]*|[^\\s;&|>\"'`]*/\\.\\.[^\\s;&|>\"'`]*)|(?:^|[\\s;&|<>=(`'\"!/])(?:\\.\\./|\\.\\.(?=\\s|$|[;&|]))|(?:^|[\\s;&|<>=(`'\"!])~(?!sandbox\\b)[\\w-]+",
+      "pattern": "(?<![\\w.:~/-])/(?:(?!home/sandbox(?:\\s|/|$)|opt/sandbox(?:\\s|/|$)|tmp(?:\\s|/|$)|dev/null(?=[\\s;&|<>)\"'`]|$)|dev/stdout(?=[\\s;&|<>)\"'`]|$)|dev/stderr(?=[\\s;&|<>)\"'`]|$))[^\\s;&|>\"'`]*|[^\\s;&|>\"'`]*/\\.\\.[^\\s;&|>\"'`]*)|(?:^|[\\s;&|<>=(`'\"!/])(?:\\.\\./|\\.\\.(?=\\s|$|[;&|]))|(?:^|[\\s;&|<>=(`'\"!])~(?!sandbox\\b)[\\w-]+",
       "risk_level": "high",
       "risk_type": "file_access",
-      "reason": "bank 场景：访问允许目录（/home/sandbox、/opt/sandbox、/tmp）之外的路径（含根目录 /），或用 .. 逃逸 / ~其它用户"
+      "reason": "bank 场景：访问允许目录（/home/sandbox、/opt/sandbox、/tmp，以及 /dev/null、/dev/stdout、/dev/stderr 三个标准流重定向目标）之外的路径（含根目录 /），或用 .. 逃逸 / ~其它用户"
     },
     {
       "pattern": "(?:^|[;&|\\n]|\\$\\(|`)\\s*(?:sudo\\s+(?:-\\S+\\s+)*|doas\\s+|nohup\\s+|time\\s+|timeout\\s+(?:\\S+\\s+)?|env\\s+(?:\\w+=\\S*\\s+)*|command\\s+|builtin\\s+|exec\\s+|xargs\\s+(?:-\\S+\\s+)*)*ssh(?![\\w-])(?!-keygen|-add|-agent)|(?:^|[;&|\\n]|\\$\\(|`)\\s*(?:sudo\\s+(?:-\\S+\\s+)*|doas\\s+|nohup\\s+|time\\s+|timeout\\s+(?:\\S+\\s+)?|env\\s+(?:\\w+=\\S*\\s+)*|command\\s+|builtin\\s+|exec\\s+|xargs\\s+(?:-\\S+\\s+)*)*(?:scp|sftp|sshpass|ssh-copy-id)(?![\\w-])|(?:^|[;&|\\n]|\\$\\(|`)\\s*(?:sudo\\s+(?:-\\S+\\s+)*|doas\\s+|nohup\\s+|time\\s+|timeout\\s+(?:\\S+\\s+)?|env\\s+(?:\\w+=\\S*\\s+)*|command\\s+|builtin\\s+|exec\\s+|xargs\\s+(?:-\\S+\\s+)*)*rsync\\b[^\\n]*?\\s(?:-e|--rsh)[=\\s]",

package/dist/server.js

@@ -5723,6 +5723,27 @@ function parseIf(content, args) {
 ${chosen}
 ${content.slice(fiPos + 2)}`;
 }
+function stripNonExecutableLines(content) {
+  if (!content) return content;
+  const out = [];
+  let heredocEnd = null;
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (heredocEnd !== null) {
+      if (line.trim() === heredocEnd) heredocEnd = null;
+      out.push(line);
+      continue;
+    }
+    const m = HEREDOC_RE.exec(line);
+    if (m) heredocEnd = m[1];
+    const stripped = line.replace(/^\s+/, "");
+    if (i === 0 && stripped.startsWith("#!")) continue;
+    if (stripped.startsWith("#")) continue;
+    out.push(line);
+  }
+  return out.join("\n");
+}
 function markLoopsReachable(content) {
   return content;
 }
@@ -5744,12 +5765,13 @@ function extractCallsFromContent(content) {
   }
   return calls;
 }
-var CHILD_CALL_RE2, ShellBackend;
+var HEREDOC_RE, CHILD_CALL_RE2, ShellBackend;
 var init_shell_backend = __esm({
   "src/engine/script-engine/backends/shell-backend.ts"() {
     "use strict";
     init_esm_shims();
     init_symbolic();
+    HEREDOC_RE = /<<-?\s*['"]?(\w+)['"]?/;
     CHILD_CALL_RE2 = /(?:^|\s|&&|\|\|)\s*((?:\/bin\/)?bash|sh|zsh|(?:python|python3|node|ruby|perl|php|lua))\s+(\S+(?:\.(?:sh|shrc|py|js|rb|pl|php|lua))?)([^\n;|&]*?)$/gmi;
     ShellBackend = class {
       language = "shell";
@@ -5779,6 +5801,7 @@ var init_shell_backend = __esm({
             bound = symOut;
           }
         }
+        bound = stripNonExecutableLines(bound);
         const loopMarked = markLoopsReachable(bound);
         const calls = extractCallsFromContent(loopMarked);
         return {
@@ -6191,7 +6214,30 @@ function resolvePath2(p) {
   }
   return resolve9(expanded);
 }
-function scanScriptChainWithL1(chain, input) {
+function scanExtensionPatterns(ext, content) {
+  const pats = ext?.extra_command_patterns;
+  if (!pats || pats.length === 0) return null;
+  for (const p of pats) {
+    const src = typeof p === "string" ? p : p?.pattern;
+    if (!src) continue;
+    let re;
+    try {
+      re = new RegExp(src, "i");
+    } catch {
+      continue;
+    }
+    if (re.test(content)) {
+      const risk = typeof p === "string" ? "high" : p.risk_level || "high";
+      return {
+        riskLevel: risk,
+        riskType: typeof p === "string" ? "sensitive_action" : p.risk_type || "sensitive_action",
+        reason: typeof p === "string" ? `\u547D\u4E2D\u6269\u5C55\u89C4\u5219: ${src}` : p.reason || `\u547D\u4E2D\u6269\u5C55\u89C4\u5219: ${src}`
+      };
+    }
+  }
+  return null;
+}
+function scanScriptChainWithL1(chain, input, ext) {
   for (const node of chain.nodes) {
     if (node.error || !node.preprocessedContent || node.l1Hit) continue;
     const virtualInput = {
@@ -6199,6 +6245,19 @@ function scanScriptChainWithL1(chain, input) {
       aNext: { actionType: "bash", actionDetail: node.preprocessedContent }
     };
     const l1 = scanDangerousCommandPatterns("bash", node.preprocessedContent, input.osType);
+    const extHit = scanExtensionPatterns(ext, node.preprocessedContent);
+    if (extHit) {
+      node.l1Hit = true;
+      node.l1RiskLevel = extHit.riskLevel;
+      node.l1RiskType = extHit.riskType;
+      node.l1Reason = extHit.reason;
+      if (extHit.riskLevel === "critical") {
+        chain.hasCritical = true;
+        chain.firstHitNode = node;
+        break;
+      }
+      continue;
+    }
     if (l1 && !l1.allowed) {
       node.l1Hit = true;
       node.l1RiskLevel = l1.riskLevel;
@@ -6262,7 +6321,7 @@ function scanScriptChainKeywords(chain) {
   }
   return chain;
 }
-function analyzeScriptContent2(input) {
+function analyzeScriptContent2(input, ext) {
   const actionType = input.aNext.actionType.toLowerCase();
   if (actionType !== "bash") return emptyChain();
   const { path: scriptPath, args: scriptArgs } = extractScriptPathWithArgs(input.aNext.actionDetail);
@@ -6294,7 +6353,7 @@ function analyzeScriptContent2(input) {
   const tracker = new RecursiveTracker(l1Adapter);
   const chain = tracker.track(resolvedPath, isInline ? null : scriptArgs, input.cwd || process.cwd());
   if (chain.nodes.length === 0) return chain;
-  scanScriptChainWithL1(chain, input);
+  scanScriptChainWithL1(chain, input, ext);
   scanScriptChainWithL2(chain, input);
   scanScriptChainKeywords(chain);
   return chain;
@@ -8972,9 +9031,13 @@ async function runAnalysis(input) {
       }
     }
   }
+  const agentExt = mergeAgentExtensions(
+    isLayerEnabled("agent_rules_enabled") ? getAgentExtensions(input.agentId) : null,
+    isLayerEnabled("scenario_rules_enabled") ? getScenarioExtensionsMulti(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "") : null
+  );
   let scriptChain = null;
   if (input.aNext.actionType.toLowerCase() === "bash") {
-    scriptChain = analyzeScriptContent2(input);
+    scriptChain = analyzeScriptContent2(input, agentExt);
     if (scriptChain.nodes.length > 0) {
       for (const node of scriptChain.nodes) {
         if (node.unanalyzable) {
@@ -9026,10 +9089,6 @@ async function runAnalysis(input) {
   const actionType = input.aNext.actionType.toLowerCase();
   const rawDetail = extractRawCommand(input.aNext.actionDetail);
   const lowerDetail = rawDetail.toLowerCase();
-  const agentExt = mergeAgentExtensions(
-    isLayerEnabled("agent_rules_enabled") ? getAgentExtensions(input.agentId) : null,
-    isLayerEnabled("scenario_rules_enabled") ? getScenarioExtensionsMulti(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "") : null
-  );
   if (FULLY_SAFE_TOOLS.has(actionType)) {
     return {
       allowed: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kenhkl/agent-moss",
-  "version": "0.16.4",
+  "version": "0.16.5",
   "description": "Multi-layer security analysis engine for AI agents (TypeScript)",
   "type": "module",
   "main": "dist/server.js",