@kenhkl/agent-moss 0.9.1 → 0.10.0

package/README.md

@@ -1,6 +1,6 @@
 # AgentMoss (TypeScript)
 
-AgentMoss TypeScript 实现 — 可被任意 AI Agent 调用的独立通用安全分析服务。三层防御引擎（启发式 → 逻辑规则 → LLM 语义分析），两级快速放行白名单，fail-closed 安全原则。
+AgentMoss TypeScript 实现 — 可被任意 AI Agent 调用的独立通用安全分析服务。三层防御引擎（特征匹配 → 逻辑规则 → LLM 语义分析），两级快速放行白名单，fail-closed 安全原则。
 
 > 当前版本：**v0.2.1** | npm: `@kenhkl/agent-moss`
 
@@ -64,7 +64,7 @@ const result = await resp.json();
 ├── 完全安全 (15 bash 模式 + 6 action types) → 跳过 L2+L3
 └── 只读敏感 (15 bash 模式 + 8 action types) → 跳过 L3
 
-层1: 启发式静态检测 (<1ms)
+层1: 特征匹配静态检测 (<1ms)
 ├── 危险命令正则: 48 个模式（rm 分级检测，sudo 只拦截危险命令，nmap/masscan/zmap 检测）
 ├── → high/critical → 直接 Deny
 ├── → 内联脚本 file_access 转层3（避免 'python -c "cat /etc/shadow"' 假阳性）
@@ -102,7 +102,7 @@ const result = await resp.json();
 | `AGENT_MOSS_LLM_TIMEOUT` | LLM 单次调用超时（秒），覆盖配置文件 `timeout.prompt1_timeout` | `40` |
 | `AGENT_MOSS_LLM_RETRIES` | LLM 调用重试次数 | `2`（共 3 次尝试） |
 | `AGENT_MOSS_DISABLE_LLM` | 设为 `1` 禁用层3 LLM | 未设置 |
-| `AGENT_MOSS_DISABLE_HEURISTIC` | 设为 `1` 禁用层1 启发式 | 未设置 |
+| `AGENT_MOSS_DISABLE_HEURISTIC` | 设为 `1` 禁用层1 特征匹配 | 未设置 |
 | `AGENT_MOSS_DISABLE_LOGIC_RULES` | 设为 `1` 禁用层2 逻辑规则 | 未设置 |
 | `AGENT_MOSS_CUSTOM_RULES` | 自定义规则 JSON 数组 | `[]` |
 

package/dist/agents/__init__.py

@@ -51,29 +51,42 @@ def get_agent_extensions(agent_id: str) -> AgentExtensions | None:
         if agent_id in _cache:
             return _cache[agent_id]
 
-        rules_file = _AGENTS_DIR / agent_id / "rules.json"
-        if not rules_file.exists():
-            logger.debug("agent %s 无 rules.json，走通用模式", agent_id)
-            _cache[agent_id] = None
-            return None
-
+        # 统一存储：优先读 runtime_config 的 agent_rules 分区（用户可在 console
+        # 查看/编辑/禁用/新增，享受与通用规则一致的合并升级）。回退 rules.json
+        # （无 runtime_config 时，如直接起服务未 seed、或旧部署）。
+        ext = None
         try:
-            ext = AgentExtensions.from_json(rules_file)
-            _cache[agent_id] = ext
-            logger.info(
-                "加载 agent %s 定制规则: %d cmd patterns, %d injection keywords, "
-                "%d sensitive paths, %d builtin safe skills",
-                agent_id,
-                len(ext.extra_command_patterns),
-                len(ext.extra_injection_keywords),
-                len(ext.extra_sensitive_paths),
-                len(ext.builtin_safe_skills),
-            )
-            return ext
-        except Exception as e:
-            logger.error("加载 agent %s rules.json 失败: %s", agent_id, e)
-            _cache[agent_id] = None
-            return None
+            from ..infra.runtime_config import has_runtime_config, load_runtime_config, get_enabled_agent_extensions
+            if has_runtime_config():
+                ext = get_enabled_agent_extensions(load_runtime_config(), agent_id)
+        except Exception:
+            pass  # runtime_config 不可用时回退 rules.json
+
+        if ext is None:
+            rules_file = _AGENTS_DIR / agent_id / "rules.json"
+            if not rules_file.exists():
+                logger.debug("agent %s 无 rules.json，走通用模式", agent_id)
+                _cache[agent_id] = None
+                return None
+            try:
+                ext = AgentExtensions.from_json(rules_file)
+            except Exception as e:
+                logger.error("加载 agent %s rules.json 失败: %s", agent_id, e)
+                _cache[agent_id] = None
+                return None
+
+        _cache[agent_id] = ext
+        logger.info(
+            "加载 agent %s 定制规则: %d cmd patterns, %d injection keywords, "
+            "%d sensitive paths, %d builtin safe skills, %d builtin safe action types",
+            agent_id,
+            len(ext.extra_command_patterns),
+            len(ext.extra_injection_keywords),
+            len(ext.extra_sensitive_paths),
+            len(ext.builtin_safe_skills),
+            len(ext.builtin_safe_action_types),
+        )
+        return ext
 
 
 def clear_agent_extensions_cache() -> None:

package/dist/agents/base.py

@@ -17,6 +17,7 @@ JSON schema（agent_moss/agents/<id>/rules.json）：
   "extra_injection_keywords": [InjectionKeyword...],
   "extra_sensitive_paths": [SensitivePath...],
   "builtin_safe_skills": ["xiaoo-guardian"],
+  "builtin_safe_action_types": ["memory-", "todomgr-", "mailbox-getEmailList"],
   "extra_skills": []
 }
 """
@@ -52,6 +53,9 @@ class AgentExtensions:
     extra_injection_keywords: list[InjectionKeyword] = field(default_factory=list)
     extra_sensitive_paths: list[SensitivePath] = field(default_factory=list)
     builtin_safe_skills: list[str] = field(default_factory=list)
+    # agent 专属"完全安全操作"白名单（精确名或前缀，前缀以 '-' 结尾）→ 跳过 L2+L3。
+    # 对齐 TS ts/src/agents/types.ts。前缀匹配（如 "memory-"）走 startswith，精确名走 ==。
+    builtin_safe_action_types: list[str] = field(default_factory=list)
     extra_skills: list[dict] = field(default_factory=list)
 
     @classmethod
@@ -112,5 +116,6 @@ class AgentExtensions:
             extra_injection_keywords=extra_inj_keywords,
             extra_sensitive_paths=extra_sensitive_paths,
             builtin_safe_skills=data.get("builtin_safe_skills", []),
+            builtin_safe_action_types=data.get("builtin_safe_action_types", []),
             extra_skills=data.get("extra_skills", []),
         )

package/dist/agents/opendesk/rules.json

@@ -0,0 +1,29 @@
+{
+  "agent_id": "opendesk",
+  "description": "OpenDesk 宿主 agent 专属安全规则。OpenDesk 工具按命名空间前缀组织（memory-/todomgr-/planning-/mailbox-/skill-manager-），其中纯数据/只读类操作走 L3 LLM 分析无意义且耗时 1~137s（实测日志），在此白名单豁免。发信类（sendEmail/replyEmail）外传风险保留 L3；skill-*/skill-manager-* 内部工具执行不经网关，本次不动。",
+  "extra_command_patterns": [],
+  "extra_injection_keywords": [],
+  "extra_sensitive_paths": [],
+  "builtin_safe_skills": [],
+  "builtin_safe_action_types": [
+    "memory-",
+    "todomgr-",
+    "planning-",
+    "mailbox-addMailAccount",
+    "mailbox-listMailAccounts",
+    "mailbox-removeMailAccount",
+    "mailbox-switchMailAccount",
+    "mailbox-getEmailList",
+    "mailbox-getEmailContent",
+    "mailbox-searchEmails",
+    "mailbox-markEmailReadStatus",
+    "mailbox-starEmail",
+    "mailbox-deleteEmail",
+    "mailbox-getMailSyncStatus",
+    "mailbox-getCalendarItems",
+    "mailbox-addCalendarItem",
+    "mailbox-deleteCalendarItem",
+    "mailbox-getCurrentTime"
+  ],
+  "extra_skills": []
+}