@kenhkl/agent-moss 0.7.4 → 0.7.6

package/dist/cli.js

@@ -747,16 +747,17 @@ import { fileURLToPath as fileURLToPath2 } from "url";
 function loadAllSkills() {
   if (cachedSkills) return cachedSkills;
   cachedSkills = {};
-  if (!existsSync2(SKILLS_DIR)) {
-    console.warn("[AgentMoss] Skills directory not found:", SKILLS_DIR);
+  const dir = existsSync2(SKILLS_DIR) ? SKILLS_DIR : SKILLS_DIR_FALLBACK;
+  if (!existsSync2(dir)) {
+    console.warn("[AgentMoss] Skills directory not found:", SKILLS_DIR, "and fallback:", SKILLS_DIR_FALLBACK);
     return cachedSkills;
   }
-  const files = readdirSync(SKILLS_DIR).filter((f) => f.endsWith(".md"));
+  const files = readdirSync(dir).filter((f) => f.endsWith(".md"));
   for (const f of files) {
     const name = f.replace(".md", "");
-    cachedSkills[name] = readFileSync(resolve(SKILLS_DIR, f), "utf-8");
+    cachedSkills[name] = readFileSync(resolve(dir, f), "utf-8");
   }
-  console.log(`[AgentMoss] Loaded ${Object.keys(cachedSkills).length} skills`);
+  console.log(`[AgentMoss] Loaded ${Object.keys(cachedSkills).length} skills from ${dir}`);
   return cachedSkills;
 }
 function matchSkills(actionType, actionDetail, reason, maxSkills = 3) {
@@ -808,14 +809,15 @@ function formatSkillsForPrompt(skills) {
 ${s.skillContent}`
   ).join("\n\n---\n\n");
 }
-var __filename2, __dirname2, SKILLS_DIR, SKILL_KEYWORD_MAP, cachedSkills;
+var __filename2, __dirname2, SKILLS_DIR, SKILLS_DIR_FALLBACK, SKILL_KEYWORD_MAP, cachedSkills;
 var init_skill_loader = __esm({
   "src/engine/skill-loader.ts"() {
     "use strict";
     init_esm_shims();
     __filename2 = fileURLToPath2(import.meta.url);
     __dirname2 = dirname(__filename2);
-    SKILLS_DIR = resolve(__dirname2, "../../agent_moss/skills");
+    SKILLS_DIR = resolve(__dirname2, "../skills");
+    SKILLS_DIR_FALLBACK = resolve(__dirname2, "../../agent_moss/skills");
     SKILL_KEYWORD_MAP = {
       "file_access_guard": ["file", "\u6587\u4EF6", "path", "\u8DEF\u5F84", "read", "write", "cat", "open", "access", "\u8BBF\u95EE", "\u8BFB\u5199", "copy", "cp", "mv", "move"],
       "script_execution_guard": ["command", "shell", "bash", "exec", "execute", "\u6267\u884C", "\u547D\u4EE4", "script", "\u811A\u672C", "run", "\u8FD0\u884C", "subprocess", "system", "eval", "compile", "\u5B89\u88C5", "install", "pip", "npm"],
@@ -825,7 +827,9 @@ var init_skill_loader = __esm({
       "general_tool_risk_guard": ["tool", "\u5DE5\u5177", "api", "invoke", "\u8C03\u7528", "function", "\u51FD\u6570"],
       "lateral_movement_guard": ["ssh", "scp", "ftp", "sftp", "rdp", "vnc", "telnet", "\u5185\u7F51", "\u6A2A\u5411", "tunnel", "\u4EE3\u7406", "proxy", "port", "\u7AEF\u53E3", "scan", "\u626B\u63CF", "ping", "traceroute", "nslookup"],
       "persistence_backdoor_guard": ["cron", "crontab", "\u5B9A\u65F6", "scheduled", "startup", "\u542F\u52A8\u9879", "service", "\u670D\u52A1", "daemon", "\u5B88\u62A4", "registry", "\u6CE8\u518C\u8868", "backdoor", "\u540E\u95E8", "persist", "\u6301\u4E45\u5316", "authorized_keys", "bashrc", "zshrc", "profile", ".rc", "shell config", "shell \u914D\u7F6E"],
-      "resource_exhaustion_guard": ["fork", "bomb", "\u70B8\u5F39", "memory", "\u5185\u5B58", "disk", "\u78C1\u76D8", "cpu", "process", "\u8FDB\u7A0B", "dd", "while true", "\u65E0\u9650\u5FAA\u73AF", "\u8017\u5C3D", "exhaust", "\u8D44\u6E90"],
+      // 注意：避免裸 'memory'/'内存'/'dd'——会误命中 memory-addMemory（写记忆工具，
+      // 'dd' 是 'addMemory' 的子串）等无害操作。用组合词/命令前缀精准匹配攻击场景。
+      "resource_exhaustion_guard": ["fork", "bomb", "\u70B8\u5F39", "memory bomb", "oom", "out of memory", "\u5185\u5B58\u6EA2\u51FA", "\u5185\u5B58\u8017\u5C3D", "\u5185\u5B58\u6CC4\u6F0F", "disk", "\u78C1\u76D8", "cpu", "process", "\u8FDB\u7A0B", "dd if=", "/dev/zero", "/dev/null", "yes >", "while true", "\u65E0\u9650\u5FAA\u73AF", "\u8017\u5C3D", "exhaust", "\u8D44\u6E90"],
       "skill_installation_guard": ["skill", "plugin", "\u63D2\u4EF6", "extension", "\u6269\u5C55", "install skill", "\u5B89\u88C5\u63D2\u4EF6", "\u5B89\u88C5\u6280\u80FD", "marketplace", "\u5546\u5E97"],
       "supply_chain_guard": ["dependency", "\u4F9D\u8D56", "package", "\u5305", "npm install", "pip install", "requirements", "import", "library", "\u5E93", "registry", "\u4ED3\u5E93", "supply", "\u4F9B\u5E94\u94FE", "typosquatting"],
       "intent_deviation_guard": ["rm", "del", "delete", "remove", "\u5220\u9664", "format", "\u683C\u5F0F\u5316", "drop", "truncate", "\u6E05\u7A7A", "wipe", "\u64E6\u9664", "\u91CD\u7F6E", "reset", "sudo", "root", "admin", "\u7BA1\u7406\u5458", "privilege", "\u63D0\u6743"]
@@ -841,28 +845,30 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 function loadTemplates() {
   if (cachedTemplates) return cachedTemplates;
   cachedTemplates = {};
-  if (!existsSync3(TEMPLATES_DIR)) {
-    console.warn("[AgentMoss] Templates directory not found:", TEMPLATES_DIR);
+  const dir = existsSync3(TEMPLATES_DIR) ? TEMPLATES_DIR : TEMPLATES_DIR_FALLBACK;
+  if (!existsSync3(dir)) {
+    console.warn("[AgentMoss] Templates directory not found:", TEMPLATES_DIR, "and fallback:", TEMPLATES_DIR_FALLBACK);
     return cachedTemplates;
   }
   for (const file of TEMPLATE_FILES) {
-    const filePath = resolve2(TEMPLATES_DIR, file);
+    const filePath = resolve2(dir, file);
     if (existsSync3(filePath)) {
       const key = file.replace(".txt", "").replace("_template", "");
       cachedTemplates[key] = readFileSync2(filePath, "utf-8");
     }
   }
-  console.log(`[AgentMoss] Loaded ${Object.keys(cachedTemplates).length} templates`);
+  console.log(`[AgentMoss] Loaded ${Object.keys(cachedTemplates).length} templates from ${dir}`);
   return cachedTemplates;
 }
-var __filename3, __dirname3, TEMPLATES_DIR, TEMPLATE_FILES, cachedTemplates;
+var __filename3, __dirname3, TEMPLATES_DIR, TEMPLATES_DIR_FALLBACK, TEMPLATE_FILES, cachedTemplates;
 var init_template_loader = __esm({
   "src/engine/template-loader.ts"() {
     "use strict";
     init_esm_shims();
     __filename3 = fileURLToPath3(import.meta.url);
     __dirname3 = dirname2(__filename3);
-    TEMPLATES_DIR = resolve2(__dirname3, "../../agent_moss/templates");
+    TEMPLATES_DIR = resolve2(__dirname3, "../templates");
+    TEMPLATES_DIR_FALLBACK = resolve2(__dirname3, "../../agent_moss/templates");
     TEMPLATE_FILES = ["prompt1_template.txt", "prompt2_template.txt", "security_judge_template.txt"];
     cachedTemplates = null;
   }
@@ -1100,13 +1106,14 @@ async function runLLMAnalysis(input, previous) {
 function buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis) {
   const skillsText = formatSkillsForPrompt(matchedSkills);
   const historyStr = input.actionHistory.map((h, i) => `${i + 1}. ${h.actionType}: ${h.actionDetail}`).join("\n") || "(\u65E0\u5386\u53F2\u64CD\u4F5C)";
-  const templateName = previous.heuristic || previous.logic ? "prompt2" : "prompt1";
-  const baseTemplate = templates[templateName] || templates["prompt1"] || "";
   const scriptAnalysisText = scriptAnalysis ? formatScriptAnalysisForPrompt(scriptAnalysis) : "";
   const hintsText = formatHints(previous);
-  return `${baseTemplate}
-
-## \u5F53\u524D\u64CD\u4F5C\u4E0A\u4E0B\u6587
+  const securityJudgeTemplate = templates["security_judge"];
+  if (securityJudgeTemplate) {
+    return securityJudgeTemplate.replaceAll("{prompt_session}", input.promptSession || "\uFF08\u672A\u63D0\u4F9B\uFF09").replaceAll("{action_history}", historyStr).replaceAll("{action_type}", input.aNext.actionType).replaceAll("{action_detail}", input.aNext.actionDetail).replaceAll("{reason}", input.reason || "\u672A\u8BF4\u660E").replaceAll("{skills_text}", skillsText).replaceAll("{hints_text}", hintsText).replaceAll("{script_analysis_text}", scriptAnalysisText).replaceAll("{{", "{").replaceAll("}}", "}");
+  }
+  console.warn("[AgentMoss] security_judge template missing, using sparse fallback prompt");
+  return `## \u5F53\u524D\u64CD\u4F5C\u4E0A\u4E0B\u6587
 - \u4F1A\u8BDD ID: ${input.sessionId}
 - \u7528\u6237\u4EFB\u52A1: ${input.promptSession || "\u672A\u6307\u5B9A"}
 - \u64CD\u4F5C\u7CFB\u7EDF: ${input.osType}
@@ -1128,8 +1135,7 @@ ${scriptAnalysisText ? `
 ## \u811A\u672C\u5185\u5BB9\u5206\u6790
 ${scriptAnalysisText}` : ""}
 
-\u8BF7\u6839\u636E\u4EE5\u4E0A\u4FE1\u606F\uFF0C\u5BF9\u5373\u5C06\u6267\u884C\u7684\u64CD\u4F5C\u8FDB\u884C\u5B89\u5168\u5224\u65AD\u3002\u4F60\u5FC5\u987B\u8F93\u51FA\u4E25\u683C\u7684 JSON \u683C\u5F0F\uFF0C
-\u4E0D\u8981\u5305\u542B\u4EFB\u4F55\u5176\u4ED6\u6587\u5B57\u3001\u6CE8\u91CA\u6216 markdown \u6807\u8BB0\u3002
+\u8BF7\u6839\u636E\u4EE5\u4E0A\u4FE1\u606F\uFF0C\u5BF9\u5373\u5C06\u6267\u884C\u7684\u64CD\u4F5C\u8FDB\u884C\u5B89\u5168\u5224\u65AD\u3002\u524D\u7F6E\u68C0\u6D4B\u4E3A low/medium \u4E14\u6709\u5408\u7406\u6267\u884C\u7406\u7531\u65F6\u5E94\u5F53\u5141\u8BB8\u3002\u4F60\u5FC5\u987B\u8F93\u51FA\u4E25\u683C\u7684 JSON \u683C\u5F0F\uFF0C\u4E0D\u8981\u5305\u542B\u4EFB\u4F55\u5176\u4ED6\u6587\u5B57\u3001\u6CE8\u91CA\u6216 markdown \u6807\u8BB0\u3002
 
 \u8F93\u51FA\u683C\u5F0F:
 {"allowed": true/false, "reason": "\u5224\u65AD\u7406\u7531", "riskLevel": "low|medium|high|critical", "riskType": "\u98CE\u9669\u7C7B\u578B", "confidence": 0-100}`;
@@ -1176,7 +1182,9 @@ async function analyzeWithLLM(prompt, config) {
         temperature: config.temperature || 0.1,
         max_tokens: config.maxTokens || 1024,
         messages: [
-          { role: "system", content: "\u4F60\u662F\u4E00\u4E2A AI Agent \u5B89\u5168\u5BA1\u8BA1\u4E13\u5BB6\u3002\u4F60\u7684\u4EFB\u52A1\u662F\u5206\u6790\u5373\u5C06\u6267\u884C\u7684\u547D\u4EE4\u662F\u5426\u5B89\u5168\u3002\u4F60\u5FC5\u987B\u53EA\u8F93\u51FA\u7EAF JSON\uFF0C\u4E0D\u8981\u5305\u542B\u4EFB\u4F55 markdown \u6807\u8BB0\u3001\u4EE3\u7801\u5757\u6216\u5176\u4ED6\u6587\u5B57\u3002" },
+          // security_judge 模板自带角色定义与判断规则，system 仅做输出格式约束，
+          // 避免与模板里的"你是 xiaoO Audit Agent 安全审计员"角色定义冲突（对齐 Python：无独立 system）。
+          { role: "system", content: "\u53EA\u8F93\u51FA\u7EAF JSON\uFF0C\u4E0D\u8981\u5305\u542B markdown \u6807\u8BB0\u3001\u4EE3\u7801\u5757\u6216\u4EFB\u4F55\u5176\u4ED6\u6587\u5B57\u3002" },
           { role: "user", content: prompt }
         ]
       });
@@ -1322,8 +1330,9 @@ async function runAnalysis(input) {
   }
   const logicResult = isLogicRulesEnabled() ? runLogicCheck(input) : null;
   if (logicResult && !logicResult.allowed) {
+    const isCredentialPath = logicResult.riskType === "sensitive_path_access" && (logicResult.riskLevel === "high" || logicResult.riskLevel === "critical");
     const skipInlineFileAccess = isInlineScriptCmd && logicResult.riskType === "sensitive_path_access";
-    if (!skipInlineFileAccess) {
+    if (!skipInlineFileAccess || isCredentialPath) {
       return logicResult;
     }
   }