@kenhkl/agent-moss 0.17.13 → 0.17.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/dist/cli.js +10 -4
  2. package/dist/engine/coordinator.js +10 -4
  3. package/dist/server.js +10 -4
  4. package/package.json +1 -1
package/dist/cli.js CHANGED
@@ -2162,6 +2162,10 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
2162
2162
  }
2163
2163
  return null;
2164
2164
  }
2165
+ function isAskUserAction(actionType) {
2166
+ if (ASK_USER_ACTION_TYPES.includes(actionType)) return true;
2167
+ return actionType.endsWith("-askuser");
2168
+ }
2165
2169
  function consentWithinTtl(asked, aNext) {
2166
2170
  const raw = String(process.env.AGENT_MOSS_CONSENT_TTL_SECONDS || "").trim();
2167
2171
  const parsed = raw ? Number(raw) : CONSENT_TTL_SECONDS;
@@ -2180,7 +2184,7 @@ function hasValidConsent(actionHistory, aNext) {
2180
2184
  const tail = actionHistory.slice(-CONSENT_MAX_DISTANCE);
2181
2185
  for (let i = tail.length - 1; i >= 0; i--) {
2182
2186
  const h = tail[i];
2183
- if (String(h.actionType || "").toLowerCase() !== "ask_user_question") continue;
2187
+ if (!isAskUserAction(String(h.actionType || "").toLowerCase())) continue;
2184
2188
  const output = String(h.output || "").trim();
2185
2189
  if (!output) return false;
2186
2190
  const question = String(h.actionDetail || "");
@@ -2192,7 +2196,7 @@ function hasValidConsent(actionHistory, aNext) {
2192
2196
  return false;
2193
2197
  }
2194
2198
  function checkPasswordConsent(actionType, actionDetail, actionHistory, osType, aNext) {
2195
- if (actionType !== "bash") return null;
2199
+ if (!BASH_LIKE_ACTION_TYPES.includes(actionType)) return null;
2196
2200
  const pwdPatterns = runtimeConfigBridge.current?.effectivePasswordPatterns(osType) ?? PASSWORD_MODIFY_PATTERNS;
2197
2201
  const isPasswordModify = pwdPatterns.some((p) => p.test(actionDetail));
2198
2202
  if (!isPasswordModify) return null;
@@ -2208,7 +2212,7 @@ function checkPasswordConsent(actionType, actionDetail, actionHistory, osType, a
2208
2212
  };
2209
2213
  }
2210
2214
  function checkUserDeletionConsent(actionType, actionDetail, actionHistory, osType, aNext) {
2211
- if (actionType !== "bash") return null;
2215
+ if (!BASH_LIKE_ACTION_TYPES.includes(actionType)) return null;
2212
2216
  const udPatterns = runtimeConfigBridge.current?.effectiveUserDeletionPatterns(osType) ?? USER_DELETION_PATTERNS;
2213
2217
  const isUserDeletion = udPatterns.some((p) => p.test(actionDetail));
2214
2218
  if (!isUserDeletion) return null;
@@ -2314,7 +2318,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd, osType) {
2314
2318
  violatedLayers: ["L2.1"]
2315
2319
  };
2316
2320
  }
2317
- var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, CONSENT_TOPIC, CONSENT_NEGATIVE, CONSENT_AFFIRMATIVE, CONSENT_INPUT_REQUEST, CONSENT_MAX_DISTANCE, CONSENT_TTL_SECONDS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
2321
+ var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, CONSENT_TOPIC, CONSENT_NEGATIVE, CONSENT_AFFIRMATIVE, CONSENT_INPUT_REQUEST, CONSENT_MAX_DISTANCE, CONSENT_TTL_SECONDS, BASH_LIKE_ACTION_TYPES, ASK_USER_ACTION_TYPES, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
2318
2322
  var init_logic_rules = __esm({
2319
2323
  "src/engine/logic-rules.ts"() {
2320
2324
  "use strict";
@@ -2407,6 +2411,8 @@ var init_logic_rules = __esm({
2407
2411
  CONSENT_INPUT_REQUEST = /(?:请|输入|提供|填写|给出|告诉我).{0,8}(?:新的?)?(?:密码|口令|passwd|password)/i;
2408
2412
  CONSENT_MAX_DISTANCE = 5;
2409
2413
  CONSENT_TTL_SECONDS = 300;
2414
+ BASH_LIKE_ACTION_TYPES = ["bash", "executebash", "terminal-executebash"];
2415
+ ASK_USER_ACTION_TYPES = ["ask_user_question", "askuser"];
2410
2416
  INLINE_SCRIPT_RE = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
2411
2417
  DIR_TRAVERSAL_KW = loadInline().dir_traversal_keywords ?? [];
2412
2418
  _IFA = loadLogicRules().indirect_file_access ?? {};
package/dist/engine/coordinator.js CHANGED
@@ -1339,6 +1339,10 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
1339
1339
  }
1340
1340
  return null;
1341
1341
  }
1342
+ function isAskUserAction(actionType) {
1343
+ if (ASK_USER_ACTION_TYPES.includes(actionType)) return true;
1344
+ return actionType.endsWith("-askuser");
1345
+ }
1342
1346
  function consentWithinTtl(asked, aNext) {
1343
1347
  const raw = String(process.env.AGENT_MOSS_CONSENT_TTL_SECONDS || "").trim();
1344
1348
  const parsed = raw ? Number(raw) : CONSENT_TTL_SECONDS;
@@ -1357,7 +1361,7 @@ function hasValidConsent(actionHistory, aNext) {
1357
1361
  const tail = actionHistory.slice(-CONSENT_MAX_DISTANCE);
1358
1362
  for (let i = tail.length - 1; i >= 0; i--) {
1359
1363
  const h = tail[i];
1360
- if (String(h.actionType || "").toLowerCase() !== "ask_user_question") continue;
1364
+ if (!isAskUserAction(String(h.actionType || "").toLowerCase())) continue;
1361
1365
  const output = String(h.output || "").trim();
1362
1366
  if (!output) return false;
1363
1367
  const question = String(h.actionDetail || "");
@@ -1369,7 +1373,7 @@ function hasValidConsent(actionHistory, aNext) {
1369
1373
  return false;
1370
1374
  }
1371
1375
  function checkPasswordConsent(actionType, actionDetail, actionHistory, osType, aNext) {
1372
- if (actionType !== "bash") return null;
1376
+ if (!BASH_LIKE_ACTION_TYPES.includes(actionType)) return null;
1373
1377
  const pwdPatterns = runtimeConfigBridge.current?.effectivePasswordPatterns(osType) ?? PASSWORD_MODIFY_PATTERNS;
1374
1378
  const isPasswordModify = pwdPatterns.some((p) => p.test(actionDetail));
1375
1379
  if (!isPasswordModify) return null;
@@ -1385,7 +1389,7 @@ function checkPasswordConsent(actionType, actionDetail, actionHistory, osType, a
1385
1389
  };
1386
1390
  }
1387
1391
  function checkUserDeletionConsent(actionType, actionDetail, actionHistory, osType, aNext) {
1388
- if (actionType !== "bash") return null;
1392
+ if (!BASH_LIKE_ACTION_TYPES.includes(actionType)) return null;
1389
1393
  const udPatterns = runtimeConfigBridge.current?.effectiveUserDeletionPatterns(osType) ?? USER_DELETION_PATTERNS;
1390
1394
  const isUserDeletion = udPatterns.some((p) => p.test(actionDetail));
1391
1395
  if (!isUserDeletion) return null;
@@ -1491,7 +1495,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd, osType) {
1491
1495
  violatedLayers: ["L2.1"]
1492
1496
  };
1493
1497
  }
1494
- var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, CONSENT_TOPIC, CONSENT_NEGATIVE, CONSENT_AFFIRMATIVE, CONSENT_INPUT_REQUEST, CONSENT_MAX_DISTANCE, CONSENT_TTL_SECONDS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
1498
+ var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, CONSENT_TOPIC, CONSENT_NEGATIVE, CONSENT_AFFIRMATIVE, CONSENT_INPUT_REQUEST, CONSENT_MAX_DISTANCE, CONSENT_TTL_SECONDS, BASH_LIKE_ACTION_TYPES, ASK_USER_ACTION_TYPES, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
1495
1499
  var init_logic_rules = __esm({
1496
1500
  "src/engine/logic-rules.ts"() {
1497
1501
  "use strict";
@@ -1584,6 +1588,8 @@ var init_logic_rules = __esm({
1584
1588
  CONSENT_INPUT_REQUEST = /(?:请|输入|提供|填写|给出|告诉我).{0,8}(?:新的?)?(?:密码|口令|passwd|password)/i;
1585
1589
  CONSENT_MAX_DISTANCE = 5;
1586
1590
  CONSENT_TTL_SECONDS = 300;
1591
+ BASH_LIKE_ACTION_TYPES = ["bash", "executebash", "terminal-executebash"];
1592
+ ASK_USER_ACTION_TYPES = ["ask_user_question", "askuser"];
1587
1593
  INLINE_SCRIPT_RE = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
1588
1594
  DIR_TRAVERSAL_KW = loadInline().dir_traversal_keywords ?? [];
1589
1595
  _IFA = loadLogicRules().indirect_file_access ?? {};
package/dist/server.js CHANGED
@@ -1870,6 +1870,10 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
1870
1870
  }
1871
1871
  return null;
1872
1872
  }
1873
+ function isAskUserAction(actionType) {
1874
+ if (ASK_USER_ACTION_TYPES.includes(actionType)) return true;
1875
+ return actionType.endsWith("-askuser");
1876
+ }
1873
1877
  function consentWithinTtl(asked, aNext) {
1874
1878
  const raw = String(process.env.AGENT_MOSS_CONSENT_TTL_SECONDS || "").trim();
1875
1879
  const parsed = raw ? Number(raw) : CONSENT_TTL_SECONDS;
@@ -1888,7 +1892,7 @@ function hasValidConsent(actionHistory, aNext) {
1888
1892
  const tail = actionHistory.slice(-CONSENT_MAX_DISTANCE);
1889
1893
  for (let i = tail.length - 1; i >= 0; i--) {
1890
1894
  const h = tail[i];
1891
- if (String(h.actionType || "").toLowerCase() !== "ask_user_question") continue;
1895
+ if (!isAskUserAction(String(h.actionType || "").toLowerCase())) continue;
1892
1896
  const output = String(h.output || "").trim();
1893
1897
  if (!output) return false;
1894
1898
  const question = String(h.actionDetail || "");
@@ -1900,7 +1904,7 @@ function hasValidConsent(actionHistory, aNext) {
1900
1904
  return false;
1901
1905
  }
1902
1906
  function checkPasswordConsent(actionType, actionDetail, actionHistory, osType, aNext) {
1903
- if (actionType !== "bash") return null;
1907
+ if (!BASH_LIKE_ACTION_TYPES.includes(actionType)) return null;
1904
1908
  const pwdPatterns = runtimeConfigBridge.current?.effectivePasswordPatterns(osType) ?? PASSWORD_MODIFY_PATTERNS;
1905
1909
  const isPasswordModify = pwdPatterns.some((p) => p.test(actionDetail));
1906
1910
  if (!isPasswordModify) return null;
@@ -1916,7 +1920,7 @@ function checkPasswordConsent(actionType, actionDetail, actionHistory, osType, a
1916
1920
  };
1917
1921
  }
1918
1922
  function checkUserDeletionConsent(actionType, actionDetail, actionHistory, osType, aNext) {
1919
- if (actionType !== "bash") return null;
1923
+ if (!BASH_LIKE_ACTION_TYPES.includes(actionType)) return null;
1920
1924
  const udPatterns = runtimeConfigBridge.current?.effectiveUserDeletionPatterns(osType) ?? USER_DELETION_PATTERNS;
1921
1925
  const isUserDeletion = udPatterns.some((p) => p.test(actionDetail));
1922
1926
  if (!isUserDeletion) return null;
@@ -2022,7 +2026,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd, osType) {
2022
2026
  violatedLayers: ["L2.1"]
2023
2027
  };
2024
2028
  }
2025
- var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, CONSENT_TOPIC, CONSENT_NEGATIVE, CONSENT_AFFIRMATIVE, CONSENT_INPUT_REQUEST, CONSENT_MAX_DISTANCE, CONSENT_TTL_SECONDS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
2029
+ var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, CONSENT_TOPIC, CONSENT_NEGATIVE, CONSENT_AFFIRMATIVE, CONSENT_INPUT_REQUEST, CONSENT_MAX_DISTANCE, CONSENT_TTL_SECONDS, BASH_LIKE_ACTION_TYPES, ASK_USER_ACTION_TYPES, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
2026
2030
  var init_logic_rules = __esm({
2027
2031
  "src/engine/logic-rules.ts"() {
2028
2032
  "use strict";
@@ -2115,6 +2119,8 @@ var init_logic_rules = __esm({
2115
2119
  CONSENT_INPUT_REQUEST = /(?:请|输入|提供|填写|给出|告诉我).{0,8}(?:新的?)?(?:密码|口令|passwd|password)/i;
2116
2120
  CONSENT_MAX_DISTANCE = 5;
2117
2121
  CONSENT_TTL_SECONDS = 300;
2122
+ BASH_LIKE_ACTION_TYPES = ["bash", "executebash", "terminal-executebash"];
2123
+ ASK_USER_ACTION_TYPES = ["ask_user_question", "askuser"];
2118
2124
  INLINE_SCRIPT_RE = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
2119
2125
  DIR_TRAVERSAL_KW = loadInline().dir_traversal_keywords ?? [];
2120
2126
  _IFA = loadLogicRules().indirect_file_access ?? {};
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@kenhkl/agent-moss",
3
- "version": "0.17.13",
3
+ "version": "0.17.14",
4
4
  "description": "Multi-layer security analysis engine for AI agents (TypeScript)",
5
5
  "type": "module",
6
6
  "main": "dist/server.js",