@kenhkl/agent-moss 0.17.12 → 0.17.14

package/dist/cli.js

@@ -1964,9 +1964,9 @@ function runLogicCheck(input, opts) {
       }
     }
   }
-  const pwdResult = checkPasswordConsent(actionType, actionDetail, actionHistory, input.osType);
+  const pwdResult = checkPasswordConsent(actionType, actionDetail, actionHistory, input.osType, aNext);
   if (pwdResult) return pwdResult;
-  const userDelResult = checkUserDeletionConsent(actionType, actionDetail, actionHistory, input.osType);
+  const userDelResult = checkUserDeletionConsent(actionType, actionDetail, actionHistory, input.osType, aNext);
   if (userDelResult) return userDelResult;
   const comboResult = checkComboChain(actionHistory, aNext.actionDetail);
   if (comboResult) return comboResult;
@@ -2162,28 +2162,48 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
   }
   return null;
 }
-function hasUserConsent(actionHistory) {
-  return actionHistory.some((h) => {
-    const t = String(h.actionType || "").toLowerCase();
-    return t === "ask_user_question" && String(h.output || "").trim().length > 0;
-  });
-}
-function hasWeakConsent(actionHistory) {
-  return actionHistory.some((h) => {
-    if (String(h.actionType || "").toLowerCase() !== "ask_user_question") return false;
-    return CONSENT_TOPIC.test(String(h.actionDetail || ""));
-  });
+function isAskUserAction(actionType) {
+  if (ASK_USER_ACTION_TYPES.includes(actionType)) return true;
+  return actionType.endsWith("-askuser");
+}
+function consentWithinTtl(asked, aNext) {
+  const raw = String(process.env.AGENT_MOSS_CONSENT_TTL_SECONDS || "").trim();
+  const parsed = raw ? Number(raw) : CONSENT_TTL_SECONDS;
+  const ttl = Number.isFinite(parsed) ? parsed : CONSENT_TTL_SECONDS;
+  if (ttl <= 0) return true;
+  const askedAt = String(asked.calledAt || "").trim();
+  const nextAt = String(aNext?.calledAt || "").trim();
+  if (!askedAt || !nextAt) return true;
+  const a = Date.parse(askedAt);
+  const b = Date.parse(nextAt);
+  if (!Number.isFinite(a) || !Number.isFinite(b)) return true;
+  return Math.abs(b - a) <= ttl * 1e3;
+}
+function hasValidConsent(actionHistory, aNext) {
+  if (!actionHistory.length) return false;
+  const tail = actionHistory.slice(-CONSENT_MAX_DISTANCE);
+  for (let i = tail.length - 1; i >= 0; i--) {
+    const h = tail[i];
+    if (!isAskUserAction(String(h.actionType || "").toLowerCase())) continue;
+    const output = String(h.output || "").trim();
+    if (!output) return false;
+    const question = String(h.actionDetail || "");
+    if (!CONSENT_TOPIC.test(question)) return false;
+    if (CONSENT_NEGATIVE.test(output)) return false;
+    if (!CONSENT_INPUT_REQUEST.test(question) && !CONSENT_AFFIRMATIVE.test(output)) return false;
+    return consentWithinTtl(h, aNext);
+  }
+  return false;
 }
-function checkPasswordConsent(actionType, actionDetail, actionHistory, osType) {
-  if (actionType !== "bash") return null;
+function checkPasswordConsent(actionType, actionDetail, actionHistory, osType, aNext) {
+  if (!BASH_LIKE_ACTION_TYPES.includes(actionType)) return null;
   const pwdPatterns = runtimeConfigBridge.current?.effectivePasswordPatterns(osType) ?? PASSWORD_MODIFY_PATTERNS;
   const isPasswordModify = pwdPatterns.some((p) => p.test(actionDetail));
   if (!isPasswordModify) return null;
-  if (hasUserConsent(actionHistory)) return null;
-  if (hasWeakConsent(actionHistory)) return null;
+  if (hasValidConsent(actionHistory, aNext)) return null;
   return {
     allowed: false,
-    reason: "\u6267\u884C\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u5BC6\u7801\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u5BC6\u7801\u4FEE\u6539\u98CE\u9669",
+    reason: "\u6267\u884C\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u7528\u6237\u660E\u786E\u6388\u6743\u7684 ask_user_question\uFF08\u987B\u7528\u6237\u6B63\u9762\u56DE\u7B54\u4E14\u4E0E\u672C\u6B21\u64CD\u4F5C\u76F8\u5173\uFF09\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u5BC6\u7801\u4FEE\u6539\u98CE\u9669",
     riskLevel: "high",
     riskType: "consent_missing",
     confidence: 85,
@@ -2191,16 +2211,15 @@ function checkPasswordConsent(actionType, actionDetail, actionHistory, osType) {
     violatedLayers: ["L2.1"]
   };
 }
-function checkUserDeletionConsent(actionType, actionDetail, actionHistory, osType) {
-  if (actionType !== "bash") return null;
+function checkUserDeletionConsent(actionType, actionDetail, actionHistory, osType, aNext) {
+  if (!BASH_LIKE_ACTION_TYPES.includes(actionType)) return null;
   const udPatterns = runtimeConfigBridge.current?.effectiveUserDeletionPatterns(osType) ?? USER_DELETION_PATTERNS;
   const isUserDeletion = udPatterns.some((p) => p.test(actionDetail));
   if (!isUserDeletion) return null;
-  if (hasUserConsent(actionHistory)) return null;
-  if (hasWeakConsent(actionHistory)) return null;
+  if (hasValidConsent(actionHistory, aNext)) return null;
   return {
     allowed: false,
-    reason: "\u6267\u884C\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u7528\u6237\u5220\u9664\u98CE\u9669",
+    reason: "\u6267\u884C\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u7528\u6237\u660E\u786E\u6388\u6743\u7684 ask_user_question\uFF08\u987B\u7528\u6237\u6B63\u9762\u56DE\u7B54\u4E14\u4E0E\u672C\u6B21\u64CD\u4F5C\u76F8\u5173\uFF09\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u7528\u6237\u5220\u9664\u98CE\u9669",
     riskLevel: "high",
     riskType: "consent_missing",
     confidence: 85,
@@ -2299,7 +2318,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd, osType) {
     violatedLayers: ["L2.1"]
   };
 }
-var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, CONSENT_TOPIC, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
+var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, CONSENT_TOPIC, CONSENT_NEGATIVE, CONSENT_AFFIRMATIVE, CONSENT_INPUT_REQUEST, CONSENT_MAX_DISTANCE, CONSENT_TTL_SECONDS, BASH_LIKE_ACTION_TYPES, ASK_USER_ACTION_TYPES, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
 var init_logic_rules = __esm({
   "src/engine/logic-rules.ts"() {
     "use strict";
@@ -2387,6 +2406,13 @@ var init_logic_rules = __esm({
       }));
     })();
     CONSENT_TOPIC = /密码|口令|passwd|password|凭据|凭证|用户|账户|账号|userdel|deluser|groupdel/i;
+    CONSENT_NEGATIVE = /(?:否|不|别|取消|拒绝|停止|终止|算了|\bno\b|\bnope\b|\bcancel\b|\babort\b|\bstop\b|\bdeny\b|\breject\b|\bdecline\b|\bdon'?t\b|\bdo\s+not\b)/i;
+    CONSENT_AFFIRMATIVE = /(?:是|好|可以|行|嗯|对|确认|同意|继续|执行|删除|删掉|移除|修改|重置|改密|\byes\b|\by\b|\byep\b|\byeah\b|\bok\b|\bokay\b|\bconfirm(?:ed)?\b|\bproceed\b|\bcontinue\b|\bsure\b|\bapprove\b|\baccept\b|\bagree\b|\bdo\s+it\b|\bgo\s+ahead\b)/i;
+    CONSENT_INPUT_REQUEST = /(?:请|输入|提供|填写|给出|告诉我).{0,8}(?:新的?)?(?:密码|口令|passwd|password)/i;
+    CONSENT_MAX_DISTANCE = 5;
+    CONSENT_TTL_SECONDS = 300;
+    BASH_LIKE_ACTION_TYPES = ["bash", "executebash", "terminal-executebash"];
+    ASK_USER_ACTION_TYPES = ["ask_user_question", "askuser"];
     INLINE_SCRIPT_RE = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
     DIR_TRAVERSAL_KW = loadInline().dir_traversal_keywords ?? [];
     _IFA = loadLogicRules().indirect_file_access ?? {};
@@ -12459,7 +12485,10 @@ async function analyzeRoute(c) {
       aNext: {
         actionType: req.a_next.action_type,
         actionDetail: req.a_next.action_detail,
-        instanceId
+        instanceId,
+        // called_at 一并透传：L2 授权（consent）的时效窗需要「提问时刻」与
+        // 「本次动作时刻」两侧都有时间戳才生效（对齐 Python routes.py）。
+        calledAt: req.a_next.called_at
       },
       reason: req.reason,
       osType,

package/dist/engine/coordinator.d.ts

@@ -66,6 +66,7 @@ interface AnalysisInput {
         actionType: string;
         actionDetail: string;
         output?: string;
+        calledAt?: string;
     }[];
     /** 完整的交错历史 prompt（可选），每轮 {text, actions} 或纯文本 string（AgentGate v3 旧格式），按时间序。
      *  供 L2 意图一致性与 L3 语义分析使用；空则回退单条 promptSession。 */
@@ -92,6 +93,7 @@ interface AnalysisInput {
         actionType: string;
         actionDetail: string;
         instanceId?: string;
+        calledAt?: string;
     };
     reason: string;
     osType: string;

package/dist/engine/coordinator.js

@@ -1141,9 +1141,9 @@ function runLogicCheck(input, opts) {
       }
     }
   }
-  const pwdResult = checkPasswordConsent(actionType, actionDetail, actionHistory, input.osType);
+  const pwdResult = checkPasswordConsent(actionType, actionDetail, actionHistory, input.osType, aNext);
   if (pwdResult) return pwdResult;
-  const userDelResult = checkUserDeletionConsent(actionType, actionDetail, actionHistory, input.osType);
+  const userDelResult = checkUserDeletionConsent(actionType, actionDetail, actionHistory, input.osType, aNext);
   if (userDelResult) return userDelResult;
   const comboResult = checkComboChain(actionHistory, aNext.actionDetail);
   if (comboResult) return comboResult;
@@ -1339,28 +1339,48 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
   }
   return null;
 }
-function hasUserConsent(actionHistory) {
-  return actionHistory.some((h) => {
-    const t = String(h.actionType || "").toLowerCase();
-    return t === "ask_user_question" && String(h.output || "").trim().length > 0;
-  });
-}
-function hasWeakConsent(actionHistory) {
-  return actionHistory.some((h) => {
-    if (String(h.actionType || "").toLowerCase() !== "ask_user_question") return false;
-    return CONSENT_TOPIC.test(String(h.actionDetail || ""));
-  });
+function isAskUserAction(actionType) {
+  if (ASK_USER_ACTION_TYPES.includes(actionType)) return true;
+  return actionType.endsWith("-askuser");
+}
+function consentWithinTtl(asked, aNext) {
+  const raw = String(process.env.AGENT_MOSS_CONSENT_TTL_SECONDS || "").trim();
+  const parsed = raw ? Number(raw) : CONSENT_TTL_SECONDS;
+  const ttl = Number.isFinite(parsed) ? parsed : CONSENT_TTL_SECONDS;
+  if (ttl <= 0) return true;
+  const askedAt = String(asked.calledAt || "").trim();
+  const nextAt = String(aNext?.calledAt || "").trim();
+  if (!askedAt || !nextAt) return true;
+  const a = Date.parse(askedAt);
+  const b = Date.parse(nextAt);
+  if (!Number.isFinite(a) || !Number.isFinite(b)) return true;
+  return Math.abs(b - a) <= ttl * 1e3;
+}
+function hasValidConsent(actionHistory, aNext) {
+  if (!actionHistory.length) return false;
+  const tail = actionHistory.slice(-CONSENT_MAX_DISTANCE);
+  for (let i = tail.length - 1; i >= 0; i--) {
+    const h = tail[i];
+    if (!isAskUserAction(String(h.actionType || "").toLowerCase())) continue;
+    const output = String(h.output || "").trim();
+    if (!output) return false;
+    const question = String(h.actionDetail || "");
+    if (!CONSENT_TOPIC.test(question)) return false;
+    if (CONSENT_NEGATIVE.test(output)) return false;
+    if (!CONSENT_INPUT_REQUEST.test(question) && !CONSENT_AFFIRMATIVE.test(output)) return false;
+    return consentWithinTtl(h, aNext);
+  }
+  return false;
 }
-function checkPasswordConsent(actionType, actionDetail, actionHistory, osType) {
-  if (actionType !== "bash") return null;
+function checkPasswordConsent(actionType, actionDetail, actionHistory, osType, aNext) {
+  if (!BASH_LIKE_ACTION_TYPES.includes(actionType)) return null;
   const pwdPatterns = runtimeConfigBridge.current?.effectivePasswordPatterns(osType) ?? PASSWORD_MODIFY_PATTERNS;
   const isPasswordModify = pwdPatterns.some((p) => p.test(actionDetail));
   if (!isPasswordModify) return null;
-  if (hasUserConsent(actionHistory)) return null;
-  if (hasWeakConsent(actionHistory)) return null;
+  if (hasValidConsent(actionHistory, aNext)) return null;
   return {
     allowed: false,
-    reason: "\u6267\u884C\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u5BC6\u7801\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u5BC6\u7801\u4FEE\u6539\u98CE\u9669",
+    reason: "\u6267\u884C\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u7528\u6237\u660E\u786E\u6388\u6743\u7684 ask_user_question\uFF08\u987B\u7528\u6237\u6B63\u9762\u56DE\u7B54\u4E14\u4E0E\u672C\u6B21\u64CD\u4F5C\u76F8\u5173\uFF09\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u5BC6\u7801\u4FEE\u6539\u98CE\u9669",
     riskLevel: "high",
     riskType: "consent_missing",
     confidence: 85,
@@ -1368,16 +1388,15 @@ function checkPasswordConsent(actionType, actionDetail, actionHistory, osType) {
     violatedLayers: ["L2.1"]
   };
 }
-function checkUserDeletionConsent(actionType, actionDetail, actionHistory, osType) {
-  if (actionType !== "bash") return null;
+function checkUserDeletionConsent(actionType, actionDetail, actionHistory, osType, aNext) {
+  if (!BASH_LIKE_ACTION_TYPES.includes(actionType)) return null;
   const udPatterns = runtimeConfigBridge.current?.effectiveUserDeletionPatterns(osType) ?? USER_DELETION_PATTERNS;
   const isUserDeletion = udPatterns.some((p) => p.test(actionDetail));
   if (!isUserDeletion) return null;
-  if (hasUserConsent(actionHistory)) return null;
-  if (hasWeakConsent(actionHistory)) return null;
+  if (hasValidConsent(actionHistory, aNext)) return null;
   return {
     allowed: false,
-    reason: "\u6267\u884C\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u7528\u6237\u5220\u9664\u98CE\u9669",
+    reason: "\u6267\u884C\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u7528\u6237\u660E\u786E\u6388\u6743\u7684 ask_user_question\uFF08\u987B\u7528\u6237\u6B63\u9762\u56DE\u7B54\u4E14\u4E0E\u672C\u6B21\u64CD\u4F5C\u76F8\u5173\uFF09\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u7528\u6237\u5220\u9664\u98CE\u9669",
     riskLevel: "high",
     riskType: "consent_missing",
     confidence: 85,
@@ -1476,7 +1495,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd, osType) {
     violatedLayers: ["L2.1"]
   };
 }
-var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, CONSENT_TOPIC, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
+var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, CONSENT_TOPIC, CONSENT_NEGATIVE, CONSENT_AFFIRMATIVE, CONSENT_INPUT_REQUEST, CONSENT_MAX_DISTANCE, CONSENT_TTL_SECONDS, BASH_LIKE_ACTION_TYPES, ASK_USER_ACTION_TYPES, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
 var init_logic_rules = __esm({
   "src/engine/logic-rules.ts"() {
     "use strict";
@@ -1564,6 +1583,13 @@ var init_logic_rules = __esm({
       }));
     })();
     CONSENT_TOPIC = /密码|口令|passwd|password|凭据|凭证|用户|账户|账号|userdel|deluser|groupdel/i;
+    CONSENT_NEGATIVE = /(?:否|不|别|取消|拒绝|停止|终止|算了|\bno\b|\bnope\b|\bcancel\b|\babort\b|\bstop\b|\bdeny\b|\breject\b|\bdecline\b|\bdon'?t\b|\bdo\s+not\b)/i;
+    CONSENT_AFFIRMATIVE = /(?:是|好|可以|行|嗯|对|确认|同意|继续|执行|删除|删掉|移除|修改|重置|改密|\byes\b|\by\b|\byep\b|\byeah\b|\bok\b|\bokay\b|\bconfirm(?:ed)?\b|\bproceed\b|\bcontinue\b|\bsure\b|\bapprove\b|\baccept\b|\bagree\b|\bdo\s+it\b|\bgo\s+ahead\b)/i;
+    CONSENT_INPUT_REQUEST = /(?:请|输入|提供|填写|给出|告诉我).{0,8}(?:新的?)?(?:密码|口令|passwd|password)/i;
+    CONSENT_MAX_DISTANCE = 5;
+    CONSENT_TTL_SECONDS = 300;
+    BASH_LIKE_ACTION_TYPES = ["bash", "executebash", "terminal-executebash"];
+    ASK_USER_ACTION_TYPES = ["ask_user_question", "askuser"];
     INLINE_SCRIPT_RE = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
     DIR_TRAVERSAL_KW = loadInline().dir_traversal_keywords ?? [];
     _IFA = loadLogicRules().indirect_file_access ?? {};

package/dist/rules/l1_rules.json

@@ -697,14 +697,14 @@
       "reason": "检测到 MongoDB 删除集合 (db.<col>.drop())"
     },
     {
-      "pattern": "(?:del|rmdir|rd)\\s+[\\\\/][a-zA-Z]:",
+      "pattern": "(?:del|rmdir|rd)\\s+[\\\\/]?[a-zA-Z]:",
       "risk_level": "critical",
       "risk_type": "script_execution",
       "reason": "检测到递归删除关键路径 (del/rmdir C:\\)",
       "os": "windows"
     },
     {
-      "pattern": "del\\s+[\\\\/][a-zA-Z]:",
+      "pattern": "del\\s+[\\\\/]?[a-zA-Z]:",
       "risk_level": "critical",
       "risk_type": "script_execution",
       "reason": "检测到删除卷根目录文件 (del C:\\)",
@@ -816,7 +816,7 @@
       "os": "windows"
     },
     {
-      "pattern": "\\bSet-Content\\b[^;&|\\n]*\\b-[A-Za-z]*Stream\\b",
+      "pattern": "\\bSet-Content\\b[^;&|\\n]*\\s-[A-Za-z]*Stream\\b",
       "risk_level": "high",
       "risk_type": "script_execution",
       "reason": "检测到写入 NTFS 备用数据流（用于隐藏载荷）",

package/dist/scenarios/bank/rules.json

@@ -1,9 +1,9 @@
 {
   "scenario_id": "bank",
-  "description": "银行沙箱场景定制规则。客户约束：沙箱用户（sandbox）仅允许读写 /home/sandbox、/opt/sandbox、/tmp 三个目录，其他根目录一律禁止读写；禁止远程访问/横向移动（ssh 家族 + scp/sftp/sshpass/ssh-copy-id + 用 ssh 的 rsync）。本地操作（ssh-keygen/ssh-add/ssh-agent、本地 rsync）不受影响。另放行 /dev/null、/dev/stdout、/dev/stderr —— 这三个是 666/可写、仅作流丢弃与输出重定向用的标准设备文件（`2>/dev/null` 是最常见的运维写法），不放行会让大量正常命令被误拦；/dev 下**其余**文件（/dev/mem、/dev/sda、/dev/shm…）照常拦。",
+  "description": "银行沙箱场景定制规则。客户约束：沙箱用户（sandbox）仅允许读写 /home/sandbox、/opt/sandbox、/tmp 三个目录，其他根目录一律禁止读写；禁止远程访问/横向移动（ssh 家族 + scp/sftp/sshpass/ssh-copy-id + 用 ssh 的 rsync）。本地操作（ssh-keygen/ssh-add/ssh-agent、本地 rsync）不受影响。另放行 /dev/null、/dev/stdout、/dev/stderr —— 这三个是 666/可写、仅作流丢弃与输出重定向用的标准设备文件（`2>/dev/null` 是最常见的运维写法），不放行会让大量正常命令被误拦；/dev 下**其余**文件（/dev/mem、/dev/sda、/dev/shm…）照常拦。。另：`/bin/ls`、`/usr/bin/python3` 这类**命令的绝对路径写法**属正常执行，不算路径访问（2026-10 修误报）；但用 `>/cp/mv/tee/install/ln` 往这些目录**写文件**仍然拦。",
   "extra_command_patterns": [
     {
-      "pattern": "(?<![\\w.:~/-])/(?:(?!home/sandbox(?:\\s|/|$)|opt/sandbox(?:\\s|/|$)|tmp(?:\\s|/|$)|dev/null(?=[\\s;&|<>)\"'`]|$)|dev/stdout(?=[\\s;&|<>)\"'`]|$)|dev/stderr(?=[\\s;&|<>)\"'`]|$))[^\\s;&|>\"'`]*|[^\\s;&|>\"'`]*/\\.\\.[^\\s;&|>\"'`]*)|(?:^|[\\s;&|<>=(`'\"!/])(?:\\.\\./|\\.\\.(?=\\s|$|[;&|]))|(?:^|[\\s;&|<>=(`'\"!])~(?!sandbox\\b)[\\w-]+",
+      "pattern": "(?<![\\w.:~/-])/(?:(?!home/sandbox(?:\\s|/|$)|opt/sandbox(?:\\s|/|$)|tmp(?:\\s|/|$)|dev/null(?=[\\s;&|<>)\"'`]|$)|dev/stdout(?=[\\s;&|<>)\"'`]|$)|dev/stderr(?=[\\s;&|<>)\"'`]|$)|(?:usr/)?(?:local/)?s?bin/(?!.*\\.\\.)[^\\s;&|>\"'`]*(?=[\\s;&|<>)\"'`]|$))[^\\s;&|>\"'`]*|[^\\s;&|>\"'`]*/\\.\\.[^\\s;&|>\"'`]*)|(?:^|[\\s;&|<>=(`'\"!/])(?:\\.\\./|\\.\\.(?=\\s|$|[;&|]))|(?:^|[\\s;&|<>=(`'\"!])~(?!sandbox\\b)[\\w-]+",
       "risk_level": "high",
       "risk_type": "file_access",
       "reason": "bank 场景：访问允许目录（/home/sandbox、/opt/sandbox、/tmp，以及 /dev/null、/dev/stdout、/dev/stderr 三个标准流重定向目标）之外的路径（含根目录 /），或用 .. 逃逸 / ~其它用户"
@@ -13,6 +13,18 @@
       "risk_level": "critical",
       "risk_type": "network_access",
       "reason": "bank 场景：禁止远程访问 / 横向移动（ssh / scp / sftp / sshpass / ssh-copy-id / rsync -e ssh）"
+    },
+    {
+      "pattern": "(?:^|[\\s;&|(])(?:>|>>|\\btee\\b|\\bcp\\b|\\bmv\\b|\\binstall\\b|\\bln\\b)[^;&|\\n]*?/(?:usr/)?(?:local/)?s?bin/",
+      "risk_level": "high",
+      "risk_type": "file_access",
+      "reason": "bank 场景：向系统可执行目录（/bin、/sbin、/usr/bin、/usr/local/bin 等）写入文件 —— 可执行路径本身作为命令运行是放行的，但把它当写目标不行"
+    },
+    {
+      "pattern": "(?:^|[;&|(\\n])\\s*(?:sudo\\s+)?crontab\\s+(?!-l\\b)\\S",
+      "risk_level": "high",
+      "risk_type": "persistence",
+      "reason": "bank 场景：禁止写系统定时任务（crontab 安装/编辑/删除）——写操作落在 /var/spool/cron，属白名单外，且是持久化后门；`crontab -l` 只读放行"
     }
   ],
   "extra_injection_keywords": [],

package/dist/server.js

@@ -1672,9 +1672,9 @@ function runLogicCheck(input, opts) {
       }
     }
   }
-  const pwdResult = checkPasswordConsent(actionType, actionDetail, actionHistory, input.osType);
+  const pwdResult = checkPasswordConsent(actionType, actionDetail, actionHistory, input.osType, aNext);
   if (pwdResult) return pwdResult;
-  const userDelResult = checkUserDeletionConsent(actionType, actionDetail, actionHistory, input.osType);
+  const userDelResult = checkUserDeletionConsent(actionType, actionDetail, actionHistory, input.osType, aNext);
   if (userDelResult) return userDelResult;
   const comboResult = checkComboChain(actionHistory, aNext.actionDetail);
   if (comboResult) return comboResult;
@@ -1870,28 +1870,48 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
   }
   return null;
 }
-function hasUserConsent(actionHistory) {
-  return actionHistory.some((h) => {
-    const t = String(h.actionType || "").toLowerCase();
-    return t === "ask_user_question" && String(h.output || "").trim().length > 0;
-  });
-}
-function hasWeakConsent(actionHistory) {
-  return actionHistory.some((h) => {
-    if (String(h.actionType || "").toLowerCase() !== "ask_user_question") return false;
-    return CONSENT_TOPIC.test(String(h.actionDetail || ""));
-  });
+function isAskUserAction(actionType) {
+  if (ASK_USER_ACTION_TYPES.includes(actionType)) return true;
+  return actionType.endsWith("-askuser");
+}
+function consentWithinTtl(asked, aNext) {
+  const raw = String(process.env.AGENT_MOSS_CONSENT_TTL_SECONDS || "").trim();
+  const parsed = raw ? Number(raw) : CONSENT_TTL_SECONDS;
+  const ttl = Number.isFinite(parsed) ? parsed : CONSENT_TTL_SECONDS;
+  if (ttl <= 0) return true;
+  const askedAt = String(asked.calledAt || "").trim();
+  const nextAt = String(aNext?.calledAt || "").trim();
+  if (!askedAt || !nextAt) return true;
+  const a = Date.parse(askedAt);
+  const b = Date.parse(nextAt);
+  if (!Number.isFinite(a) || !Number.isFinite(b)) return true;
+  return Math.abs(b - a) <= ttl * 1e3;
+}
+function hasValidConsent(actionHistory, aNext) {
+  if (!actionHistory.length) return false;
+  const tail = actionHistory.slice(-CONSENT_MAX_DISTANCE);
+  for (let i = tail.length - 1; i >= 0; i--) {
+    const h = tail[i];
+    if (!isAskUserAction(String(h.actionType || "").toLowerCase())) continue;
+    const output = String(h.output || "").trim();
+    if (!output) return false;
+    const question = String(h.actionDetail || "");
+    if (!CONSENT_TOPIC.test(question)) return false;
+    if (CONSENT_NEGATIVE.test(output)) return false;
+    if (!CONSENT_INPUT_REQUEST.test(question) && !CONSENT_AFFIRMATIVE.test(output)) return false;
+    return consentWithinTtl(h, aNext);
+  }
+  return false;
 }
-function checkPasswordConsent(actionType, actionDetail, actionHistory, osType) {
-  if (actionType !== "bash") return null;
+function checkPasswordConsent(actionType, actionDetail, actionHistory, osType, aNext) {
+  if (!BASH_LIKE_ACTION_TYPES.includes(actionType)) return null;
   const pwdPatterns = runtimeConfigBridge.current?.effectivePasswordPatterns(osType) ?? PASSWORD_MODIFY_PATTERNS;
   const isPasswordModify = pwdPatterns.some((p) => p.test(actionDetail));
   if (!isPasswordModify) return null;
-  if (hasUserConsent(actionHistory)) return null;
-  if (hasWeakConsent(actionHistory)) return null;
+  if (hasValidConsent(actionHistory, aNext)) return null;
   return {
     allowed: false,
-    reason: "\u6267\u884C\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u5BC6\u7801\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u5BC6\u7801\u4FEE\u6539\u98CE\u9669",
+    reason: "\u6267\u884C\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u7528\u6237\u660E\u786E\u6388\u6743\u7684 ask_user_question\uFF08\u987B\u7528\u6237\u6B63\u9762\u56DE\u7B54\u4E14\u4E0E\u672C\u6B21\u64CD\u4F5C\u76F8\u5173\uFF09\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u5BC6\u7801\u4FEE\u6539\u98CE\u9669",
     riskLevel: "high",
     riskType: "consent_missing",
     confidence: 85,
@@ -1899,16 +1919,15 @@ function checkPasswordConsent(actionType, actionDetail, actionHistory, osType) {
     violatedLayers: ["L2.1"]
   };
 }
-function checkUserDeletionConsent(actionType, actionDetail, actionHistory, osType) {
-  if (actionType !== "bash") return null;
+function checkUserDeletionConsent(actionType, actionDetail, actionHistory, osType, aNext) {
+  if (!BASH_LIKE_ACTION_TYPES.includes(actionType)) return null;
   const udPatterns = runtimeConfigBridge.current?.effectiveUserDeletionPatterns(osType) ?? USER_DELETION_PATTERNS;
   const isUserDeletion = udPatterns.some((p) => p.test(actionDetail));
   if (!isUserDeletion) return null;
-  if (hasUserConsent(actionHistory)) return null;
-  if (hasWeakConsent(actionHistory)) return null;
+  if (hasValidConsent(actionHistory, aNext)) return null;
   return {
     allowed: false,
-    reason: "\u6267\u884C\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u7528\u6237\u5220\u9664\u98CE\u9669",
+    reason: "\u6267\u884C\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u7528\u6237\u660E\u786E\u6388\u6743\u7684 ask_user_question\uFF08\u987B\u7528\u6237\u6B63\u9762\u56DE\u7B54\u4E14\u4E0E\u672C\u6B21\u64CD\u4F5C\u76F8\u5173\uFF09\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u7528\u6237\u5220\u9664\u98CE\u9669",
     riskLevel: "high",
     riskType: "consent_missing",
     confidence: 85,
@@ -2007,7 +2026,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd, osType) {
     violatedLayers: ["L2.1"]
   };
 }
-var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, CONSENT_TOPIC, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
+var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, CONSENT_TOPIC, CONSENT_NEGATIVE, CONSENT_AFFIRMATIVE, CONSENT_INPUT_REQUEST, CONSENT_MAX_DISTANCE, CONSENT_TTL_SECONDS, BASH_LIKE_ACTION_TYPES, ASK_USER_ACTION_TYPES, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
 var init_logic_rules = __esm({
   "src/engine/logic-rules.ts"() {
     "use strict";
@@ -2095,6 +2114,13 @@ var init_logic_rules = __esm({
       }));
     })();
     CONSENT_TOPIC = /密码|口令|passwd|password|凭据|凭证|用户|账户|账号|userdel|deluser|groupdel/i;
+    CONSENT_NEGATIVE = /(?:否|不|别|取消|拒绝|停止|终止|算了|\bno\b|\bnope\b|\bcancel\b|\babort\b|\bstop\b|\bdeny\b|\breject\b|\bdecline\b|\bdon'?t\b|\bdo\s+not\b)/i;
+    CONSENT_AFFIRMATIVE = /(?:是|好|可以|行|嗯|对|确认|同意|继续|执行|删除|删掉|移除|修改|重置|改密|\byes\b|\by\b|\byep\b|\byeah\b|\bok\b|\bokay\b|\bconfirm(?:ed)?\b|\bproceed\b|\bcontinue\b|\bsure\b|\bapprove\b|\baccept\b|\bagree\b|\bdo\s+it\b|\bgo\s+ahead\b)/i;
+    CONSENT_INPUT_REQUEST = /(?:请|输入|提供|填写|给出|告诉我).{0,8}(?:新的?)?(?:密码|口令|passwd|password)/i;
+    CONSENT_MAX_DISTANCE = 5;
+    CONSENT_TTL_SECONDS = 300;
+    BASH_LIKE_ACTION_TYPES = ["bash", "executebash", "terminal-executebash"];
+    ASK_USER_ACTION_TYPES = ["ask_user_question", "askuser"];
     INLINE_SCRIPT_RE = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
     DIR_TRAVERSAL_KW = loadInline().dir_traversal_keywords ?? [];
     _IFA = loadLogicRules().indirect_file_access ?? {};
@@ -12130,7 +12156,10 @@ async function analyzeRoute(c) {
       aNext: {
         actionType: req.a_next.action_type,
         actionDetail: req.a_next.action_detail,
-        instanceId
+        instanceId,
+        // called_at 一并透传：L2 授权（consent）的时效窗需要「提问时刻」与
+        // 「本次动作时刻」两侧都有时间戳才生效（对齐 Python routes.py）。
+        calledAt: req.a_next.called_at
       },
       reason: req.reason,
       osType,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kenhkl/agent-moss",
-  "version": "0.17.12",
+  "version": "0.17.14",
   "description": "Multi-layer security analysis engine for AI agents (TypeScript)",
   "type": "module",
   "main": "dist/server.js",