@sofagent/rules 1.2.3 → 1.2.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -2,19 +2,12 @@
|
|
|
2
2
|
// ============================================================
|
|
3
3
|
// tool-secret-leak.ts · 移植 audit rule-a2（密钥泄漏检测）
|
|
4
4
|
// v1.2.0：tool 视角——扫 args 字面量里的密钥模式
|
|
5
|
+
// v1.2.5 P1-27: SECRET_PATTERNS 抽到 @sofagent/core 共享——此前本文件用严格
|
|
6
|
+
// 48 位 sk- 模式导致 32-47 位密钥被 ToolGate 放行（与 A2 漂移互补成洞）。
|
|
5
7
|
// ============================================================
|
|
6
8
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
7
9
|
exports.toolSecretLeak = void 0;
|
|
8
|
-
|
|
9
|
-
const SECRET_PATTERNS = [
|
|
10
|
-
{ pattern: /AKIA[A-Z0-9]{16}/, label: 'AWS Access Key' },
|
|
11
|
-
{ pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----/, label: 'Private Key' },
|
|
12
|
-
{ pattern: /sk-[a-zA-Z0-9]{48}/, label: 'OpenAI API Key' },
|
|
13
|
-
{ pattern: /sk-proj-[a-zA-Z0-9_]{40,}/, label: 'OpenAI Project Key' },
|
|
14
|
-
{ pattern: /sk-svcacct-[a-zA-Z0-9_]{40,}/, label: 'OpenAI Service Account Key' },
|
|
15
|
-
{ pattern: /sk-admin-[a-zA-Z0-9_]{40,}/, label: 'OpenAI Admin Key' },
|
|
16
|
-
{ pattern: /gh[ps]_[A-Za-z0-9]{36}/, label: 'GitHub Token' },
|
|
17
|
-
];
|
|
10
|
+
const core_1 = require("@sofagent/core");
|
|
18
11
|
/**
|
|
19
12
|
* 从 tool call args 中提取所有字符串值（递归）
|
|
20
13
|
*/
|
|
@@ -42,7 +35,7 @@ exports.toolSecretLeak = {
|
|
|
42
35
|
const allStrings = extractStrings(ctx.args);
|
|
43
36
|
const detections = [];
|
|
44
37
|
for (const str of allStrings) {
|
|
45
|
-
for (const { pattern, label } of SECRET_PATTERNS) {
|
|
38
|
+
for (const { pattern, label } of core_1.SECRET_PATTERNS) {
|
|
46
39
|
if (pattern.test(str)) {
|
|
47
40
|
detections.push(label);
|
|
48
41
|
}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@sofagent/rules",
|
|
3
|
-
"version": "1.2.
|
|
3
|
+
"version": "1.2.5",
|
|
4
4
|
"description": "sofagent 规则引擎纯函数包——从 audit 抽出，零 fs/git 依赖，供编排引擎 tool call 事前拦截",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|
|
@@ -26,5 +26,8 @@
|
|
|
26
26
|
"!dist/**/*.d.ts.map",
|
|
27
27
|
"!dist/**/*.test.*",
|
|
28
28
|
"README.md"
|
|
29
|
-
]
|
|
29
|
+
],
|
|
30
|
+
"dependencies": {
|
|
31
|
+
"@sofagent/core": "^1.2.4"
|
|
32
|
+
}
|
|
30
33
|
}
|