@kenhkl/agent-moss 0.17.4 → 0.17.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/dist/cli.js +16 -2
  2. package/dist/engine/coordinator.js +10 -1
  3. package/dist/server.js +16 -2
  4. package/package.json +1 -1
package/dist/cli.js CHANGED
@@ -2095,12 +2095,19 @@ function hasUserConsent(actionHistory) {
2095
2095
  return t === "ask_user_question" && String(h.output || "").trim().length > 0;
2096
2096
  });
2097
2097
  }
2098
+ function hasWeakConsent(actionHistory) {
2099
+ return actionHistory.some((h) => {
2100
+ if (String(h.actionType || "").toLowerCase() !== "ask_user_question") return false;
2101
+ return CONSENT_TOPIC.test(String(h.actionDetail || ""));
2102
+ });
2103
+ }
2098
2104
  function checkPasswordConsent(actionType, actionDetail, actionHistory, osType) {
2099
2105
  if (actionType !== "bash") return null;
2100
2106
  const pwdPatterns = runtimeConfigBridge.current?.effectivePasswordPatterns(osType) ?? PASSWORD_MODIFY_PATTERNS;
2101
2107
  const isPasswordModify = pwdPatterns.some((p) => p.test(actionDetail));
2102
2108
  if (!isPasswordModify) return null;
2103
2109
  if (hasUserConsent(actionHistory)) return null;
2110
+ if (hasWeakConsent(actionHistory)) return null;
2104
2111
  return {
2105
2112
  allowed: false,
2106
2113
  reason: "\u6267\u884C\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u5BC6\u7801\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u5BC6\u7801\u4FEE\u6539\u98CE\u9669",
@@ -2117,6 +2124,7 @@ function checkUserDeletionConsent(actionType, actionDetail, actionHistory, osTyp
2117
2124
  const isUserDeletion = udPatterns.some((p) => p.test(actionDetail));
2118
2125
  if (!isUserDeletion) return null;
2119
2126
  if (hasUserConsent(actionHistory)) return null;
2127
+ if (hasWeakConsent(actionHistory)) return null;
2120
2128
  return {
2121
2129
  allowed: false,
2122
2130
  reason: "\u6267\u884C\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u7528\u6237\u5220\u9664\u98CE\u9669",
@@ -2218,7 +2226,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd, osType) {
2218
2226
  violatedLayers: ["L2.1"]
2219
2227
  };
2220
2228
  }
2221
- var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
2229
+ var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, CONSENT_TOPIC, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
2222
2230
  var init_logic_rules = __esm({
2223
2231
  "src/engine/logic-rules.ts"() {
2224
2232
  "use strict";
@@ -2305,6 +2313,7 @@ var init_logic_rules = __esm({
2305
2313
  reason: String(c.reason || "\u68C0\u6D4B\u5230\u7EC4\u5408\u653B\u51FB\u94FE")
2306
2314
  }));
2307
2315
  })();
2316
+ CONSENT_TOPIC = /密码|口令|passwd|password|凭据|凭证|用户|账户|账号|userdel|deluser|groupdel/i;
2308
2317
  INLINE_SCRIPT_RE = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
2309
2318
  DIR_TRAVERSAL_KW = loadInline().dir_traversal_keywords ?? [];
2310
2319
  _IFA = loadLogicRules().indirect_file_access ?? {};
@@ -12824,7 +12833,12 @@ function createApp() {
12824
12833
  allowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
12825
12834
  allowHeaders: ["*"]
12826
12835
  }));
12827
- app.use("*", logger());
12836
+ app.use(
12837
+ "*",
12838
+ logger(
12839
+ (str, ...rest) => console.log(str.replace(/([?&]token=)[^&\s"']+/gi, "$1***"), ...rest)
12840
+ )
12841
+ );
12828
12842
  const pools = new PooledLimiter();
12829
12843
  const limiter = new RateLimiter(rateLimitQps());
12830
12844
  app.use("*", async (c, next) => {
package/dist/engine/coordinator.js CHANGED
@@ -1345,12 +1345,19 @@ function hasUserConsent(actionHistory) {
1345
1345
  return t === "ask_user_question" && String(h.output || "").trim().length > 0;
1346
1346
  });
1347
1347
  }
1348
+ function hasWeakConsent(actionHistory) {
1349
+ return actionHistory.some((h) => {
1350
+ if (String(h.actionType || "").toLowerCase() !== "ask_user_question") return false;
1351
+ return CONSENT_TOPIC.test(String(h.actionDetail || ""));
1352
+ });
1353
+ }
1348
1354
  function checkPasswordConsent(actionType, actionDetail, actionHistory, osType) {
1349
1355
  if (actionType !== "bash") return null;
1350
1356
  const pwdPatterns = runtimeConfigBridge.current?.effectivePasswordPatterns(osType) ?? PASSWORD_MODIFY_PATTERNS;
1351
1357
  const isPasswordModify = pwdPatterns.some((p) => p.test(actionDetail));
1352
1358
  if (!isPasswordModify) return null;
1353
1359
  if (hasUserConsent(actionHistory)) return null;
1360
+ if (hasWeakConsent(actionHistory)) return null;
1354
1361
  return {
1355
1362
  allowed: false,
1356
1363
  reason: "\u6267\u884C\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u5BC6\u7801\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u5BC6\u7801\u4FEE\u6539\u98CE\u9669",
@@ -1367,6 +1374,7 @@ function checkUserDeletionConsent(actionType, actionDetail, actionHistory, osTyp
1367
1374
  const isUserDeletion = udPatterns.some((p) => p.test(actionDetail));
1368
1375
  if (!isUserDeletion) return null;
1369
1376
  if (hasUserConsent(actionHistory)) return null;
1377
+ if (hasWeakConsent(actionHistory)) return null;
1370
1378
  return {
1371
1379
  allowed: false,
1372
1380
  reason: "\u6267\u884C\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u7528\u6237\u5220\u9664\u98CE\u9669",
@@ -1468,7 +1476,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd, osType) {
1468
1476
  violatedLayers: ["L2.1"]
1469
1477
  };
1470
1478
  }
1471
- var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
1479
+ var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, CONSENT_TOPIC, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
1472
1480
  var init_logic_rules = __esm({
1473
1481
  "src/engine/logic-rules.ts"() {
1474
1482
  "use strict";
@@ -1555,6 +1563,7 @@ var init_logic_rules = __esm({
1555
1563
  reason: String(c.reason || "\u68C0\u6D4B\u5230\u7EC4\u5408\u653B\u51FB\u94FE")
1556
1564
  }));
1557
1565
  })();
1566
+ CONSENT_TOPIC = /密码|口令|passwd|password|凭据|凭证|用户|账户|账号|userdel|deluser|groupdel/i;
1558
1567
  INLINE_SCRIPT_RE = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
1559
1568
  DIR_TRAVERSAL_KW = loadInline().dir_traversal_keywords ?? [];
1560
1569
  _IFA = loadLogicRules().indirect_file_access ?? {};
package/dist/server.js CHANGED
@@ -1845,12 +1845,19 @@ function hasUserConsent(actionHistory) {
1845
1845
  return t === "ask_user_question" && String(h.output || "").trim().length > 0;
1846
1846
  });
1847
1847
  }
1848
+ function hasWeakConsent(actionHistory) {
1849
+ return actionHistory.some((h) => {
1850
+ if (String(h.actionType || "").toLowerCase() !== "ask_user_question") return false;
1851
+ return CONSENT_TOPIC.test(String(h.actionDetail || ""));
1852
+ });
1853
+ }
1848
1854
  function checkPasswordConsent(actionType, actionDetail, actionHistory, osType) {
1849
1855
  if (actionType !== "bash") return null;
1850
1856
  const pwdPatterns = runtimeConfigBridge.current?.effectivePasswordPatterns(osType) ?? PASSWORD_MODIFY_PATTERNS;
1851
1857
  const isPasswordModify = pwdPatterns.some((p) => p.test(actionDetail));
1852
1858
  if (!isPasswordModify) return null;
1853
1859
  if (hasUserConsent(actionHistory)) return null;
1860
+ if (hasWeakConsent(actionHistory)) return null;
1854
1861
  return {
1855
1862
  allowed: false,
1856
1863
  reason: "\u6267\u884C\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u5BC6\u7801\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u5BC6\u7801\u4FEE\u6539\u98CE\u9669",
@@ -1867,6 +1874,7 @@ function checkUserDeletionConsent(actionType, actionDetail, actionHistory, osTyp
1867
1874
  const isUserDeletion = udPatterns.some((p) => p.test(actionDetail));
1868
1875
  if (!isUserDeletion) return null;
1869
1876
  if (hasUserConsent(actionHistory)) return null;
1877
+ if (hasWeakConsent(actionHistory)) return null;
1870
1878
  return {
1871
1879
  allowed: false,
1872
1880
  reason: "\u6267\u884C\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u7528\u6237\u5220\u9664\u98CE\u9669",
@@ -1968,7 +1976,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd, osType) {
1968
1976
  violatedLayers: ["L2.1"]
1969
1977
  };
1970
1978
  }
1971
- var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
1979
+ var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, CONSENT_TOPIC, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
1972
1980
  var init_logic_rules = __esm({
1973
1981
  "src/engine/logic-rules.ts"() {
1974
1982
  "use strict";
@@ -2055,6 +2063,7 @@ var init_logic_rules = __esm({
2055
2063
  reason: String(c.reason || "\u68C0\u6D4B\u5230\u7EC4\u5408\u653B\u51FB\u94FE")
2056
2064
  }));
2057
2065
  })();
2066
+ CONSENT_TOPIC = /密码|口令|passwd|password|凭据|凭证|用户|账户|账号|userdel|deluser|groupdel/i;
2058
2067
  INLINE_SCRIPT_RE = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
2059
2068
  DIR_TRAVERSAL_KW = loadInline().dir_traversal_keywords ?? [];
2060
2069
  _IFA = loadLogicRules().indirect_file_access ?? {};
@@ -12495,7 +12504,12 @@ function createApp() {
12495
12504
  allowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
12496
12505
  allowHeaders: ["*"]
12497
12506
  }));
12498
- app.use("*", logger());
12507
+ app.use(
12508
+ "*",
12509
+ logger(
12510
+ (str, ...rest) => console.log(str.replace(/([?&]token=)[^&\s"']+/gi, "$1***"), ...rest)
12511
+ )
12512
+ );
12499
12513
  const pools = new PooledLimiter();
12500
12514
  const limiter = new RateLimiter(rateLimitQps());
12501
12515
  app.use("*", async (c, next) => {
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@kenhkl/agent-moss",
3
- "version": "0.17.4",
3
+ "version": "0.17.6",
4
4
  "description": "Multi-layer security analysis engine for AI agents (TypeScript)",
5
5
  "type": "module",
6
6
  "main": "dist/server.js",