@zhin.js/agent 0.1.24 → 0.1.26
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/lib/agent-prompt/registry.js +1 -1
- package/lib/agent-prompt/registry.js.map +1 -1
- package/lib/ai-event-bus.d.ts +19 -0
- package/lib/ai-event-bus.d.ts.map +1 -0
- package/lib/ai-event-bus.js +75 -0
- package/lib/ai-event-bus.js.map +1 -0
- package/lib/ai-event-subscriber.d.ts +38 -0
- package/lib/ai-event-subscriber.d.ts.map +1 -0
- package/lib/ai-event-subscriber.js +61 -0
- package/lib/ai-event-subscriber.js.map +1 -0
- package/lib/builtin/ask-user-tool.d.ts +2 -0
- package/lib/builtin/ask-user-tool.d.ts.map +1 -1
- package/lib/builtin/ask-user-tool.js +2 -0
- package/lib/builtin/ask-user-tool.js.map +1 -1
- package/lib/builtin/bash-tool.d.ts +7 -3
- package/lib/builtin/bash-tool.d.ts.map +1 -1
- package/lib/builtin/bash-tool.js +51 -9
- package/lib/builtin/bash-tool.js.map +1 -1
- package/lib/builtin/bing-search-html.d.ts.map +1 -1
- package/lib/builtin/bing-search-html.js +14 -7
- package/lib/builtin/bing-search-html.js.map +1 -1
- package/lib/builtin/builtin-base-tool.d.ts +2 -0
- package/lib/builtin/builtin-base-tool.d.ts.map +1 -1
- package/lib/builtin/builtin-base-tool.js +5 -0
- package/lib/builtin/builtin-base-tool.js.map +1 -1
- package/lib/builtin/edit-file-tool.d.ts +1 -1
- package/lib/builtin/edit-file-tool.d.ts.map +1 -1
- package/lib/builtin/edit-file-tool.js +33 -1
- package/lib/builtin/edit-file-tool.js.map +1 -1
- package/lib/builtin/file-edit-quote-utils.d.ts +1 -3
- package/lib/builtin/file-edit-quote-utils.d.ts.map +1 -1
- package/lib/builtin/file-edit-quote-utils.js +1 -3
- package/lib/builtin/file-edit-quote-utils.js.map +1 -1
- package/lib/builtin/glob-tool.d.ts +1 -1
- package/lib/builtin/glob-tool.d.ts.map +1 -1
- package/lib/builtin/glob-tool.js +15 -3
- package/lib/builtin/glob-tool.js.map +1 -1
- package/lib/builtin/grep-tool.d.ts +1 -1
- package/lib/builtin/grep-tool.d.ts.map +1 -1
- package/lib/builtin/grep-tool.js +16 -3
- package/lib/builtin/grep-tool.js.map +1 -1
- package/lib/builtin/list-dir-tool.d.ts +1 -1
- package/lib/builtin/list-dir-tool.d.ts.map +1 -1
- package/lib/builtin/list-dir-tool.js +14 -3
- package/lib/builtin/list-dir-tool.js.map +1 -1
- package/lib/builtin/read-file-tool.d.ts +1 -1
- package/lib/builtin/read-file-tool.d.ts.map +1 -1
- package/lib/builtin/read-file-tool.js +24 -3
- package/lib/builtin/read-file-tool.js.map +1 -1
- package/lib/builtin/run-deferred-task-tool.d.ts +3 -0
- package/lib/builtin/run-deferred-task-tool.d.ts.map +1 -1
- package/lib/builtin/run-deferred-task-tool.js +2 -0
- package/lib/builtin/run-deferred-task-tool.js.map +1 -1
- package/lib/builtin/spawn-task-tool.d.ts.map +1 -1
- package/lib/builtin/spawn-task-tool.js +2 -0
- package/lib/builtin/spawn-task-tool.js.map +1 -1
- package/lib/builtin/web-fetch-tool.d.ts +2 -2
- package/lib/builtin/web-fetch-tool.d.ts.map +1 -1
- package/lib/builtin/web-fetch-tool.js +12 -18
- package/lib/builtin/web-fetch-tool.js.map +1 -1
- package/lib/builtin/write-file-tool.d.ts +1 -1
- package/lib/builtin/write-file-tool.d.ts.map +1 -1
- package/lib/builtin/write-file-tool.js +33 -1
- package/lib/builtin/write-file-tool.js.map +1 -1
- package/lib/common-adapter-tools.d.ts +8 -41
- package/lib/common-adapter-tools.d.ts.map +1 -1
- package/lib/common-adapter-tools.js +23 -182
- package/lib/common-adapter-tools.js.map +1 -1
- package/lib/deferred-worker-runner.d.ts +13 -2
- package/lib/deferred-worker-runner.d.ts.map +1 -1
- package/lib/deferred-worker-runner.js +91 -13
- package/lib/deferred-worker-runner.js.map +1 -1
- package/lib/discovery/agents.js +1 -1
- package/lib/discovery/agents.js.map +1 -1
- package/lib/discovery/skills.js +1 -1
- package/lib/discovery/skills.js.map +1 -1
- package/lib/discovery/tools.d.ts +1 -1
- package/lib/discovery/tools.d.ts.map +1 -1
- package/lib/discovery/tools.js +17 -4
- package/lib/discovery/tools.js.map +1 -1
- package/lib/discovery/utils.js +1 -1
- package/lib/discovery/utils.js.map +1 -1
- package/lib/hooks.d.ts.map +1 -1
- package/lib/hooks.js +2 -0
- package/lib/hooks.js.map +1 -1
- package/lib/index.d.ts +9 -1
- package/lib/index.d.ts.map +1 -1
- package/lib/index.js +6 -0
- package/lib/index.js.map +1 -1
- package/lib/init/message-media.d.ts +3 -1
- package/lib/init/message-media.d.ts.map +1 -1
- package/lib/init/message-media.js +20 -0
- package/lib/init/message-media.js.map +1 -1
- package/lib/init/register-ai-service.js.map +1 -1
- package/lib/init/register-ai-trigger.d.ts.map +1 -1
- package/lib/init/register-ai-trigger.js +71 -10
- package/lib/init/register-ai-trigger.js.map +1 -1
- package/lib/init/register-builtin-tools.js +7 -7
- package/lib/init/register-builtin-tools.js.map +1 -1
- package/lib/init/register-typing-indicator.d.ts +9 -0
- package/lib/init/register-typing-indicator.d.ts.map +1 -0
- package/lib/init/register-typing-indicator.js +206 -0
- package/lib/init/register-typing-indicator.js.map +1 -0
- package/lib/init.d.ts.map +1 -1
- package/lib/init.js +2 -0
- package/lib/init.js.map +1 -1
- package/lib/mcp-client/connection.d.ts +2 -0
- package/lib/mcp-client/connection.d.ts.map +1 -1
- package/lib/mcp-client/connection.js +7 -0
- package/lib/mcp-client/connection.js.map +1 -1
- package/lib/mcp-client/index.d.ts +2 -0
- package/lib/mcp-client/index.d.ts.map +1 -1
- package/lib/mcp-client/index.js +19 -2
- package/lib/mcp-client/index.js.map +1 -1
- package/lib/monitoring/index.d.ts +79 -0
- package/lib/monitoring/index.d.ts.map +1 -0
- package/lib/monitoring/index.js +197 -0
- package/lib/monitoring/index.js.map +1 -0
- package/lib/monitoring/metrics.d.ts +240 -0
- package/lib/monitoring/metrics.d.ts.map +1 -0
- package/lib/monitoring/metrics.js +483 -0
- package/lib/monitoring/metrics.js.map +1 -0
- package/lib/orchestrator/agent-dispatcher.d.ts +170 -0
- package/lib/orchestrator/agent-dispatcher.d.ts.map +1 -0
- package/lib/orchestrator/agent-dispatcher.js +379 -0
- package/lib/orchestrator/agent-dispatcher.js.map +1 -0
- package/lib/orchestrator/hook-registry.d.ts.map +1 -1
- package/lib/orchestrator/hook-registry.js +2 -0
- package/lib/orchestrator/hook-registry.js.map +1 -1
- package/lib/orchestrator/index.d.ts +2 -0
- package/lib/orchestrator/index.d.ts.map +1 -1
- package/lib/orchestrator/index.js +2 -0
- package/lib/orchestrator/index.js.map +1 -1
- package/lib/orchestrator/mcp-lifecycle.d.ts +1 -1
- package/lib/orchestrator/mcp-lifecycle.d.ts.map +1 -1
- package/lib/orchestrator/mcp-lifecycle.js +2 -2
- package/lib/orchestrator/mcp-lifecycle.js.map +1 -1
- package/lib/orchestrator/mcp-registry.d.ts +8 -1
- package/lib/orchestrator/mcp-registry.d.ts.map +1 -1
- package/lib/orchestrator/mcp-registry.js +28 -5
- package/lib/orchestrator/mcp-registry.js.map +1 -1
- package/lib/orchestrator/task-queue.d.ts +147 -0
- package/lib/orchestrator/task-queue.d.ts.map +1 -0
- package/lib/orchestrator/task-queue.js +337 -0
- package/lib/orchestrator/task-queue.js.map +1 -0
- package/lib/orchestrator/tool-selection.d.ts.map +1 -1
- package/lib/orchestrator/tool-selection.js +3 -0
- package/lib/orchestrator/tool-selection.js.map +1 -1
- package/lib/orchestrator/types.d.ts +8 -0
- package/lib/orchestrator/types.d.ts.map +1 -1
- package/lib/plugin-ai-hook-bus.d.ts +4 -0
- package/lib/plugin-ai-hook-bus.d.ts.map +1 -0
- package/lib/plugin-ai-hook-bus.js +24 -0
- package/lib/plugin-ai-hook-bus.js.map +1 -0
- package/lib/security/anomaly-detection.d.ts +119 -0
- package/lib/security/anomaly-detection.d.ts.map +1 -0
- package/lib/security/anomaly-detection.js +305 -0
- package/lib/security/anomaly-detection.js.map +1 -0
- package/lib/security/audit-logger.d.ts +158 -0
- package/lib/security/audit-logger.d.ts.map +1 -0
- package/lib/security/audit-logger.js +379 -0
- package/lib/security/audit-logger.js.map +1 -0
- package/lib/security/bash-tool-context.d.ts +3 -3
- package/lib/security/bash-tool-context.d.ts.map +1 -1
- package/lib/security/budget-limiter.d.ts +156 -0
- package/lib/security/budget-limiter.d.ts.map +1 -0
- package/lib/security/budget-limiter.js +363 -0
- package/lib/security/budget-limiter.js.map +1 -0
- package/lib/security/dangerous-tool-policy.d.ts +17 -0
- package/lib/security/dangerous-tool-policy.d.ts.map +1 -0
- package/lib/security/dangerous-tool-policy.js +137 -0
- package/lib/security/dangerous-tool-policy.js.map +1 -0
- package/lib/security/exec-policy.d.ts +21 -12
- package/lib/security/exec-policy.d.ts.map +1 -1
- package/lib/security/exec-policy.js +198 -25
- package/lib/security/exec-policy.js.map +1 -1
- package/lib/security/file-policy.d.ts +0 -1
- package/lib/security/file-policy.d.ts.map +1 -1
- package/lib/security/file-policy.js +112 -14
- package/lib/security/file-policy.js.map +1 -1
- package/lib/security/file-role-policy.d.ts +119 -0
- package/lib/security/file-role-policy.d.ts.map +1 -0
- package/lib/security/file-role-policy.js +268 -0
- package/lib/security/file-role-policy.js.map +1 -0
- package/lib/security/index.d.ts +59 -0
- package/lib/security/index.d.ts.map +1 -1
- package/lib/security/index.js +68 -0
- package/lib/security/index.js.map +1 -1
- package/lib/security/network-policy.d.ts +94 -0
- package/lib/security/network-policy.d.ts.map +1 -0
- package/lib/security/network-policy.js +291 -0
- package/lib/security/network-policy.js.map +1 -0
- package/lib/security/owner-approve-always-store.d.ts +2 -0
- package/lib/security/owner-approve-always-store.d.ts.map +1 -1
- package/lib/security/owner-approve-always-store.js +37 -0
- package/lib/security/owner-approve-always-store.js.map +1 -1
- package/lib/security/sandbox-enhanced.d.ts +170 -0
- package/lib/security/sandbox-enhanced.d.ts.map +1 -0
- package/lib/security/sandbox-enhanced.js +630 -0
- package/lib/security/sandbox-enhanced.js.map +1 -0
- package/lib/security/sandbox.d.ts +104 -0
- package/lib/security/sandbox.d.ts.map +1 -0
- package/lib/security/sandbox.js +373 -0
- package/lib/security/sandbox.js.map +1 -0
- package/lib/security/security-config.example.d.ts +33 -0
- package/lib/security/security-config.example.d.ts.map +1 -0
- package/lib/security/security-config.example.js +166 -0
- package/lib/security/security-config.example.js.map +1 -0
- package/lib/subagent-goal-notify.d.ts +13 -0
- package/lib/subagent-goal-notify.d.ts.map +1 -0
- package/lib/subagent-goal-notify.js +32 -0
- package/lib/subagent-goal-notify.js.map +1 -0
- package/lib/subagent.d.ts +24 -0
- package/lib/subagent.d.ts.map +1 -1
- package/lib/subagent.js +98 -16
- package/lib/subagent.js.map +1 -1
- package/lib/typing-indicator/adapter-integration.d.ts +140 -0
- package/lib/typing-indicator/adapter-integration.d.ts.map +1 -0
- package/lib/typing-indicator/adapter-integration.js +473 -0
- package/lib/typing-indicator/adapter-integration.js.map +1 -0
- package/lib/typing-indicator/index.d.ts +170 -0
- package/lib/typing-indicator/index.d.ts.map +1 -0
- package/lib/typing-indicator/index.js +311 -0
- package/lib/typing-indicator/index.js.map +1 -0
- package/lib/typing-indicator/integration.d.ts +91 -0
- package/lib/typing-indicator/integration.d.ts.map +1 -0
- package/lib/typing-indicator/integration.js +219 -0
- package/lib/typing-indicator/integration.js.map +1 -0
- package/lib/zhin-agent/config.d.ts +20 -2
- package/lib/zhin-agent/config.d.ts.map +1 -1
- package/lib/zhin-agent/config.js +28 -10
- package/lib/zhin-agent/config.js.map +1 -1
- package/lib/zhin-agent/event-emitter.d.ts +11 -0
- package/lib/zhin-agent/event-emitter.d.ts.map +1 -0
- package/lib/zhin-agent/event-emitter.js +43 -0
- package/lib/zhin-agent/event-emitter.js.map +1 -0
- package/lib/zhin-agent/index.d.ts +9 -31
- package/lib/zhin-agent/index.d.ts.map +1 -1
- package/lib/zhin-agent/index.js +70 -665
- package/lib/zhin-agent/index.js.map +1 -1
- package/lib/zhin-agent/llm-runner.d.ts +16 -0
- package/lib/zhin-agent/llm-runner.d.ts.map +1 -0
- package/lib/zhin-agent/llm-runner.js +85 -0
- package/lib/zhin-agent/llm-runner.js.map +1 -0
- package/lib/zhin-agent/model-resolver.d.ts +9 -0
- package/lib/zhin-agent/model-resolver.d.ts.map +1 -0
- package/lib/zhin-agent/model-resolver.js +25 -0
- package/lib/zhin-agent/model-resolver.js.map +1 -0
- package/lib/zhin-agent/phase-trace.d.ts +12 -0
- package/lib/zhin-agent/phase-trace.d.ts.map +1 -0
- package/lib/zhin-agent/phase-trace.js +24 -0
- package/lib/zhin-agent/phase-trace.js.map +1 -0
- package/lib/zhin-agent/prompt-assembly.d.ts +22 -0
- package/lib/zhin-agent/prompt-assembly.d.ts.map +1 -0
- package/lib/zhin-agent/prompt-assembly.js +66 -0
- package/lib/zhin-agent/prompt-assembly.js.map +1 -0
- package/lib/zhin-agent/prompt-builder.d.ts +200 -0
- package/lib/zhin-agent/prompt-builder.d.ts.map +1 -0
- package/lib/zhin-agent/prompt-builder.js +574 -0
- package/lib/zhin-agent/prompt-builder.js.map +1 -0
- package/lib/zhin-agent/prompt-templates.d.ts +160 -0
- package/lib/zhin-agent/prompt-templates.d.ts.map +1 -0
- package/lib/zhin-agent/prompt-templates.js +436 -0
- package/lib/zhin-agent/prompt-templates.js.map +1 -0
- package/lib/zhin-agent/prompt.d.ts +18 -15
- package/lib/zhin-agent/prompt.d.ts.map +1 -1
- package/lib/zhin-agent/prompt.js +194 -111
- package/lib/zhin-agent/prompt.js.map +1 -1
- package/lib/zhin-agent/session-io.d.ts +10 -0
- package/lib/zhin-agent/session-io.d.ts.map +1 -0
- package/lib/zhin-agent/session-io.js +14 -0
- package/lib/zhin-agent/session-io.js.map +1 -0
- package/lib/zhin-agent/task-continuation.d.ts +144 -0
- package/lib/zhin-agent/task-continuation.d.ts.map +1 -0
- package/lib/zhin-agent/task-continuation.js +346 -0
- package/lib/zhin-agent/task-continuation.js.map +1 -0
- package/lib/zhin-agent/text-sanitize.d.ts +2 -5
- package/lib/zhin-agent/text-sanitize.d.ts.map +1 -1
- package/lib/zhin-agent/text-sanitize.js +2 -25
- package/lib/zhin-agent/text-sanitize.js.map +1 -1
- package/lib/zhin-agent/tool-calls-user-format.d.ts.map +1 -1
- package/lib/zhin-agent/tool-calls-user-format.js +12 -3
- package/lib/zhin-agent/tool-calls-user-format.js.map +1 -1
- package/lib/zhin-agent/tool-orchestration.d.ts +9 -0
- package/lib/zhin-agent/tool-orchestration.d.ts.map +1 -0
- package/lib/zhin-agent/tool-orchestration.js +68 -0
- package/lib/zhin-agent/tool-orchestration.js.map +1 -0
- package/lib/zhin-agent/tool-search-orchestrator.d.ts.map +1 -1
- package/lib/zhin-agent/tool-search-orchestrator.js +5 -2
- package/lib/zhin-agent/tool-search-orchestrator.js.map +1 -1
- package/lib/zhin-agent/turn-pipeline.d.ts +5 -0
- package/lib/zhin-agent/turn-pipeline.d.ts.map +1 -0
- package/lib/zhin-agent/turn-pipeline.js +541 -0
- package/lib/zhin-agent/turn-pipeline.js.map +1 -0
- package/lib/zhin-agent/turn-tracker.d.ts +17 -0
- package/lib/zhin-agent/turn-tracker.d.ts.map +1 -0
- package/lib/zhin-agent/turn-tracker.js +54 -0
- package/lib/zhin-agent/turn-tracker.js.map +1 -0
- package/lib/zhin-agent/web-search-locale-attach.d.ts +4 -0
- package/lib/zhin-agent/web-search-locale-attach.d.ts.map +1 -0
- package/lib/zhin-agent/web-search-locale-attach.js +19 -0
- package/lib/zhin-agent/web-search-locale-attach.js.map +1 -0
- package/lib/zhin-agent/zhin-agent-private.d.ts +66 -0
- package/lib/zhin-agent/zhin-agent-private.d.ts.map +1 -0
- package/lib/zhin-agent/zhin-agent-private.js +4 -0
- package/lib/zhin-agent/zhin-agent-private.js.map +1 -0
- package/package.json +5 -5
|
@@ -0,0 +1,630 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* 增强的沙箱环境
|
|
3
|
+
*
|
|
4
|
+
* 提供更细粒度的安全控制:
|
|
5
|
+
* - 文件系统访问控制(白名单/黑名单)
|
|
6
|
+
* - 网络隔离
|
|
7
|
+
* - 资源监控
|
|
8
|
+
* - 配置热更新
|
|
9
|
+
*/
|
|
10
|
+
import * as child_process from 'node:child_process';
|
|
11
|
+
import * as path from 'node:path';
|
|
12
|
+
import * as os from 'node:os';
|
|
13
|
+
import * as fs from 'node:fs';
|
|
14
|
+
const DEFAULT_ENHANCED_CONFIG = {
|
|
15
|
+
enabled: true,
|
|
16
|
+
timeout: 30000,
|
|
17
|
+
maxMemoryMB: 512,
|
|
18
|
+
maxCpuPercent: 50,
|
|
19
|
+
maxOutputSize: 10 * 1024 * 1024,
|
|
20
|
+
preserveHome: true,
|
|
21
|
+
preservePath: true,
|
|
22
|
+
enableNetwork: false,
|
|
23
|
+
allowedEnvVars: [
|
|
24
|
+
'PATH',
|
|
25
|
+
'HOME',
|
|
26
|
+
'USER',
|
|
27
|
+
'SHELL',
|
|
28
|
+
'LANG',
|
|
29
|
+
'LC_ALL',
|
|
30
|
+
'LC_CTYPE',
|
|
31
|
+
'TERM',
|
|
32
|
+
'NODE_ENV',
|
|
33
|
+
'npm_config_cache',
|
|
34
|
+
'npm_config_prefix',
|
|
35
|
+
],
|
|
36
|
+
blockedEnvVars: [
|
|
37
|
+
'AWS_SECRET_ACCESS_KEY',
|
|
38
|
+
'AWS_ACCESS_KEY_ID',
|
|
39
|
+
'AZURE_CLIENT_SECRET',
|
|
40
|
+
'AZURE_CLIENT_ID',
|
|
41
|
+
'GOOGLE_APPLICATION_CREDENTIALS',
|
|
42
|
+
'KUBECONFIG',
|
|
43
|
+
'DOCKER_HOST',
|
|
44
|
+
'DOCKER_TLS_VERIFY',
|
|
45
|
+
'DOCKER_CERT_PATH',
|
|
46
|
+
'SSH_AUTH_SOCK',
|
|
47
|
+
'SSH_AGENT_PID',
|
|
48
|
+
'GPG_AGENT_INFO',
|
|
49
|
+
'XDG_RUNTIME_DIR',
|
|
50
|
+
],
|
|
51
|
+
fileSystem: {
|
|
52
|
+
allowedPaths: [],
|
|
53
|
+
blockedPaths: [
|
|
54
|
+
'/etc/shadow',
|
|
55
|
+
'/etc/gshadow',
|
|
56
|
+
'/etc/ssl/private',
|
|
57
|
+
'/root/.ssh',
|
|
58
|
+
'/root/.gnupg',
|
|
59
|
+
],
|
|
60
|
+
allowedExtensions: [],
|
|
61
|
+
blockedExtensions: ['.pem', '.key', '.p12', '.pfx'],
|
|
62
|
+
allowTempFiles: true,
|
|
63
|
+
allowDelete: false,
|
|
64
|
+
},
|
|
65
|
+
monitoring: {
|
|
66
|
+
enabled: true,
|
|
67
|
+
interval: 1000,
|
|
68
|
+
logUsage: false,
|
|
69
|
+
thresholds: {
|
|
70
|
+
cpuPercent: 80,
|
|
71
|
+
memoryMB: 400,
|
|
72
|
+
executionTime: 25000,
|
|
73
|
+
},
|
|
74
|
+
},
|
|
75
|
+
};
|
|
76
|
+
// ── 文件系统访问检查 ──────────────────────────────────────────────────
|
|
77
|
+
/**
|
|
78
|
+
* 检查文件路径是否允许访问
|
|
79
|
+
*/
|
|
80
|
+
function checkFileAccess(filePath, config) {
|
|
81
|
+
const fileSystem = config.fileSystem;
|
|
82
|
+
if (!fileSystem) {
|
|
83
|
+
return { allowed: true };
|
|
84
|
+
}
|
|
85
|
+
const resolvedPath = path.resolve(filePath);
|
|
86
|
+
const ext = path.extname(resolvedPath);
|
|
87
|
+
// 检查黑名单路径(优先级最高)
|
|
88
|
+
if (fileSystem.blockedPaths) {
|
|
89
|
+
for (const blockedPath of fileSystem.blockedPaths) {
|
|
90
|
+
if (resolvedPath.startsWith(blockedPath)) {
|
|
91
|
+
return {
|
|
92
|
+
allowed: false,
|
|
93
|
+
reason: `路径在黑名单中: ${blockedPath}`,
|
|
94
|
+
};
|
|
95
|
+
}
|
|
96
|
+
}
|
|
97
|
+
}
|
|
98
|
+
// 检查文件扩展名黑名单
|
|
99
|
+
if (fileSystem.blockedExtensions && fileSystem.blockedExtensions.length > 0) {
|
|
100
|
+
if (fileSystem.blockedExtensions.includes(ext)) {
|
|
101
|
+
return {
|
|
102
|
+
allowed: false,
|
|
103
|
+
reason: `文件扩展名在黑名单中: ${ext}`,
|
|
104
|
+
};
|
|
105
|
+
}
|
|
106
|
+
}
|
|
107
|
+
// 检查白名单路径(如果配置了白名单,且路径不在黑名单中)
|
|
108
|
+
if (fileSystem.allowedPaths && fileSystem.allowedPaths.length > 0) {
|
|
109
|
+
const isAllowed = fileSystem.allowedPaths.some(allowedPath => resolvedPath.startsWith(allowedPath));
|
|
110
|
+
if (!isAllowed) {
|
|
111
|
+
return {
|
|
112
|
+
allowed: false,
|
|
113
|
+
reason: `路径不在白名单中: ${resolvedPath}`,
|
|
114
|
+
};
|
|
115
|
+
}
|
|
116
|
+
}
|
|
117
|
+
// 检查文件扩展名白名单(如果配置了白名单)
|
|
118
|
+
if (fileSystem.allowedExtensions && fileSystem.allowedExtensions.length > 0) {
|
|
119
|
+
if (!fileSystem.allowedExtensions.includes(ext)) {
|
|
120
|
+
return {
|
|
121
|
+
allowed: false,
|
|
122
|
+
reason: `文件扩展名不在白名单中: ${ext}`,
|
|
123
|
+
};
|
|
124
|
+
}
|
|
125
|
+
}
|
|
126
|
+
return { allowed: true };
|
|
127
|
+
}
|
|
128
|
+
/**
|
|
129
|
+
* 检查命令是否尝试删除文件
|
|
130
|
+
*/
|
|
131
|
+
function checkDeleteOperation(command, config) {
|
|
132
|
+
const fileSystem = config.fileSystem;
|
|
133
|
+
if (!fileSystem || fileSystem.allowDelete) {
|
|
134
|
+
return { allowed: true };
|
|
135
|
+
}
|
|
136
|
+
// 检查删除命令
|
|
137
|
+
const deletePatterns = [
|
|
138
|
+
/\brm\s+/,
|
|
139
|
+
/\brmdir\s+/,
|
|
140
|
+
/\bunlink\s+/,
|
|
141
|
+
/\bshred\s+/,
|
|
142
|
+
];
|
|
143
|
+
for (const pattern of deletePatterns) {
|
|
144
|
+
if (pattern.test(command)) {
|
|
145
|
+
return {
|
|
146
|
+
allowed: false,
|
|
147
|
+
reason: '沙箱内禁止删除文件',
|
|
148
|
+
};
|
|
149
|
+
}
|
|
150
|
+
}
|
|
151
|
+
return { allowed: true };
|
|
152
|
+
}
|
|
153
|
+
// ── 网络访问检查 ──────────────────────────────────────────────────────
|
|
154
|
+
/**
|
|
155
|
+
* 检查命令是否尝试访问网络
|
|
156
|
+
*/
|
|
157
|
+
function checkNetworkAccess(command, config) {
|
|
158
|
+
if (config.enableNetwork) {
|
|
159
|
+
return { allowed: true };
|
|
160
|
+
}
|
|
161
|
+
// 检查网络命令
|
|
162
|
+
const networkPatterns = [
|
|
163
|
+
/\bcurl\s+/,
|
|
164
|
+
/\bwget\s+/,
|
|
165
|
+
/\bnc\s+/,
|
|
166
|
+
/\bnetcat\s+/,
|
|
167
|
+
/\bssh\s+/,
|
|
168
|
+
/\bscp\s+/,
|
|
169
|
+
/\brsync\s+/,
|
|
170
|
+
/\bping\s+/,
|
|
171
|
+
/\btraceroute\s+/,
|
|
172
|
+
/\bnmap\s+/,
|
|
173
|
+
/\bhttp\s+/,
|
|
174
|
+
/\bhttps\s+/,
|
|
175
|
+
];
|
|
176
|
+
for (const pattern of networkPatterns) {
|
|
177
|
+
if (pattern.test(command)) {
|
|
178
|
+
return {
|
|
179
|
+
allowed: false,
|
|
180
|
+
reason: '沙箱内禁止网络访问',
|
|
181
|
+
};
|
|
182
|
+
}
|
|
183
|
+
}
|
|
184
|
+
return { allowed: true };
|
|
185
|
+
}
|
|
186
|
+
// ── 命令验证 ──────────────────────────────────────────────────────────
|
|
187
|
+
/**
|
|
188
|
+
* 验证命令是否在沙箱允许范围内
|
|
189
|
+
*/
|
|
190
|
+
function validateEnhancedCommand(command, config) {
|
|
191
|
+
// 检查是否尝试更改目录
|
|
192
|
+
if (/\bcd\s/.test(command)) {
|
|
193
|
+
return { valid: false, reason: '沙箱内禁止使用 cd 命令' };
|
|
194
|
+
}
|
|
195
|
+
// 检查是否尝试下载恶意内容(优先级最高)
|
|
196
|
+
const dangerousPatterns = [
|
|
197
|
+
/curl.*\|\s*sh/,
|
|
198
|
+
/wget.*\|\s*sh/,
|
|
199
|
+
/curl.*&&.*\./,
|
|
200
|
+
/wget.*&&.*\./,
|
|
201
|
+
/eval\s*\(/,
|
|
202
|
+
/exec\s*\(/,
|
|
203
|
+
/child_process/,
|
|
204
|
+
/spawn\s*\(/,
|
|
205
|
+
/fork\s*\(/,
|
|
206
|
+
];
|
|
207
|
+
for (const pattern of dangerousPatterns) {
|
|
208
|
+
if (pattern.test(command)) {
|
|
209
|
+
return {
|
|
210
|
+
valid: false,
|
|
211
|
+
reason: `沙箱内禁止执行危险命令模式: ${pattern.source}`,
|
|
212
|
+
};
|
|
213
|
+
}
|
|
214
|
+
}
|
|
215
|
+
// 检查网络访问
|
|
216
|
+
const networkResult = checkNetworkAccess(command, config);
|
|
217
|
+
if (!networkResult.allowed) {
|
|
218
|
+
return {
|
|
219
|
+
valid: false,
|
|
220
|
+
reason: networkResult.reason,
|
|
221
|
+
};
|
|
222
|
+
}
|
|
223
|
+
// 检查删除操作
|
|
224
|
+
const deleteResult = checkDeleteOperation(command, config);
|
|
225
|
+
if (!deleteResult.allowed) {
|
|
226
|
+
return {
|
|
227
|
+
valid: false,
|
|
228
|
+
reason: deleteResult.reason,
|
|
229
|
+
};
|
|
230
|
+
}
|
|
231
|
+
// 检查是否尝试访问沙箱外的文件
|
|
232
|
+
if (config.workingDirectory) {
|
|
233
|
+
// 检查绝对路径访问
|
|
234
|
+
const absolutePathPattern = /(?:^|\s|;|&&|\|\|)(\/[^\s;|&`"'{}[\]()]+?)(?:\s|$|;|&&|\|\|)/g;
|
|
235
|
+
let match;
|
|
236
|
+
while ((match = absolutePathPattern.exec(command)) !== null) {
|
|
237
|
+
const filePath = match[1].trim();
|
|
238
|
+
// 检查是否是沙箱内的路径
|
|
239
|
+
const allowedPaths = [
|
|
240
|
+
config.workingDirectory,
|
|
241
|
+
'/dev/null',
|
|
242
|
+
'/tmp/',
|
|
243
|
+
'/usr/',
|
|
244
|
+
'/bin/',
|
|
245
|
+
'/sbin/',
|
|
246
|
+
'/etc/',
|
|
247
|
+
'/var/',
|
|
248
|
+
'/proc/',
|
|
249
|
+
];
|
|
250
|
+
const isAllowed = allowedPaths.some(allowed => filePath.startsWith(allowed));
|
|
251
|
+
if (!isAllowed) {
|
|
252
|
+
return {
|
|
253
|
+
valid: false,
|
|
254
|
+
reason: `沙箱内禁止访问工作目录外的文件: ${filePath}`,
|
|
255
|
+
};
|
|
256
|
+
}
|
|
257
|
+
}
|
|
258
|
+
// 检查父目录遍历
|
|
259
|
+
if (/\.\.\//.test(command)) {
|
|
260
|
+
return {
|
|
261
|
+
valid: false,
|
|
262
|
+
reason: '沙箱内禁止使用父目录遍历(../)',
|
|
263
|
+
};
|
|
264
|
+
}
|
|
265
|
+
}
|
|
266
|
+
// 检查文件访问权限(从命令中提取文件路径)
|
|
267
|
+
const filePathPattern = /(?:^|\s|;|&&|\|\|)([^\s;|&`"'{}[\]()]+\.[a-zA-Z]+)(?:\s|$|;|&&|\|\|)/g;
|
|
268
|
+
let fileMatch;
|
|
269
|
+
while ((fileMatch = filePathPattern.exec(command)) !== null) {
|
|
270
|
+
const filePath = fileMatch[1].trim();
|
|
271
|
+
// 只检查看起来像文件路径的字符串
|
|
272
|
+
if (filePath.includes('/') || filePath.includes('.')) {
|
|
273
|
+
const fileAccessResult = checkFileAccess(filePath, config);
|
|
274
|
+
if (!fileAccessResult.allowed) {
|
|
275
|
+
return {
|
|
276
|
+
valid: false,
|
|
277
|
+
reason: fileAccessResult.reason,
|
|
278
|
+
};
|
|
279
|
+
}
|
|
280
|
+
}
|
|
281
|
+
}
|
|
282
|
+
return { valid: true };
|
|
283
|
+
}
|
|
284
|
+
// ── 环境变量清理 ──────────────────────────────────────────────────────
|
|
285
|
+
/**
|
|
286
|
+
* 清理环境变量
|
|
287
|
+
*/
|
|
288
|
+
function cleanEnhancedEnvironment(config) {
|
|
289
|
+
const cleanEnv = {};
|
|
290
|
+
// 保留允许的环境变量
|
|
291
|
+
if (config.allowedEnvVars) {
|
|
292
|
+
for (const varName of config.allowedEnvVars) {
|
|
293
|
+
if (process.env[varName]) {
|
|
294
|
+
cleanEnv[varName] = process.env[varName];
|
|
295
|
+
}
|
|
296
|
+
}
|
|
297
|
+
}
|
|
298
|
+
// 移除被阻止的环境变量
|
|
299
|
+
if (config.blockedEnvVars) {
|
|
300
|
+
for (const varName of config.blockedEnvVars) {
|
|
301
|
+
delete cleanEnv[varName];
|
|
302
|
+
}
|
|
303
|
+
}
|
|
304
|
+
// 保留 HOME 目录
|
|
305
|
+
if (config.preserveHome) {
|
|
306
|
+
cleanEnv.HOME = os.homedir();
|
|
307
|
+
}
|
|
308
|
+
// 保留 PATH
|
|
309
|
+
if (config.preservePath) {
|
|
310
|
+
cleanEnv.PATH = process.env.PATH || '/usr/local/bin:/usr/bin:/bin';
|
|
311
|
+
}
|
|
312
|
+
// 添加额外的环境变量(但要检查是否在阻止列表中)
|
|
313
|
+
if (config.extraEnvVars) {
|
|
314
|
+
for (const [key, value] of Object.entries(config.extraEnvVars)) {
|
|
315
|
+
if (config.blockedEnvVars && config.blockedEnvVars.includes(key)) {
|
|
316
|
+
continue;
|
|
317
|
+
}
|
|
318
|
+
cleanEnv[key] = value;
|
|
319
|
+
}
|
|
320
|
+
}
|
|
321
|
+
return cleanEnv;
|
|
322
|
+
}
|
|
323
|
+
// ── 资源监控 ──────────────────────────────────────────────────────────
|
|
324
|
+
/**
|
|
325
|
+
* 资源监控器
|
|
326
|
+
*/
|
|
327
|
+
class ResourceMonitor {
|
|
328
|
+
startTime;
|
|
329
|
+
intervalId = null;
|
|
330
|
+
peakMemory = 0;
|
|
331
|
+
warnings = [];
|
|
332
|
+
config;
|
|
333
|
+
constructor(config) {
|
|
334
|
+
this.config = config;
|
|
335
|
+
this.startTime = Date.now();
|
|
336
|
+
}
|
|
337
|
+
start() {
|
|
338
|
+
if (!this.config.monitoring?.enabled) {
|
|
339
|
+
return;
|
|
340
|
+
}
|
|
341
|
+
const interval = this.config.monitoring.interval || 1000;
|
|
342
|
+
this.intervalId = setInterval(() => {
|
|
343
|
+
this.checkResources();
|
|
344
|
+
}, interval);
|
|
345
|
+
}
|
|
346
|
+
stop() {
|
|
347
|
+
if (this.intervalId) {
|
|
348
|
+
clearInterval(this.intervalId);
|
|
349
|
+
this.intervalId = null;
|
|
350
|
+
}
|
|
351
|
+
const duration = Date.now() - this.startTime;
|
|
352
|
+
const memoryUsage = process.memoryUsage();
|
|
353
|
+
return {
|
|
354
|
+
cpuTime: duration, // 简化:使用实际时间代替 CPU 时间
|
|
355
|
+
memoryUsage: memoryUsage.heapUsed,
|
|
356
|
+
peakMemoryUsage: this.peakMemory,
|
|
357
|
+
executionTime: duration,
|
|
358
|
+
ioRead: 0, // 需要平台特定实现
|
|
359
|
+
ioWrite: 0,
|
|
360
|
+
};
|
|
361
|
+
}
|
|
362
|
+
getWarnings() {
|
|
363
|
+
return [...this.warnings];
|
|
364
|
+
}
|
|
365
|
+
checkResources() {
|
|
366
|
+
const memoryUsage = process.memoryUsage();
|
|
367
|
+
const currentMemory = memoryUsage.heapUsed;
|
|
368
|
+
// 更新峰值内存
|
|
369
|
+
if (currentMemory > this.peakMemory) {
|
|
370
|
+
this.peakMemory = currentMemory;
|
|
371
|
+
}
|
|
372
|
+
// 检查内存阈值
|
|
373
|
+
const thresholds = this.config.monitoring?.thresholds;
|
|
374
|
+
if (thresholds?.memoryMB) {
|
|
375
|
+
const memoryMB = currentMemory / (1024 * 1024);
|
|
376
|
+
if (memoryMB > thresholds.memoryMB) {
|
|
377
|
+
this.warnings.push(`内存使用超过阈值: ${memoryMB.toFixed(2)}MB > ${thresholds.memoryMB}MB`);
|
|
378
|
+
}
|
|
379
|
+
}
|
|
380
|
+
// 检查执行时间阈值
|
|
381
|
+
if (thresholds?.executionTime) {
|
|
382
|
+
const elapsed = Date.now() - this.startTime;
|
|
383
|
+
if (elapsed > thresholds.executionTime) {
|
|
384
|
+
this.warnings.push(`执行时间超过阈值: ${elapsed}ms > ${thresholds.executionTime}ms`);
|
|
385
|
+
}
|
|
386
|
+
}
|
|
387
|
+
}
|
|
388
|
+
}
|
|
389
|
+
// ── 增强沙箱类 ────────────────────────────────────────────────────────
|
|
390
|
+
export class EnhancedSandbox {
|
|
391
|
+
config;
|
|
392
|
+
configListeners = [];
|
|
393
|
+
constructor(config = {}) {
|
|
394
|
+
this.config = { ...DEFAULT_ENHANCED_CONFIG, ...config };
|
|
395
|
+
}
|
|
396
|
+
/**
|
|
397
|
+
* 在沙箱中执行命令
|
|
398
|
+
*/
|
|
399
|
+
async execute(command, options) {
|
|
400
|
+
if (!this.config.enabled) {
|
|
401
|
+
return this.executeUnsafe(command, options);
|
|
402
|
+
}
|
|
403
|
+
const startTime = Date.now();
|
|
404
|
+
const warnings = [];
|
|
405
|
+
// 验证命令
|
|
406
|
+
const validation = validateEnhancedCommand(command, this.config);
|
|
407
|
+
if (!validation.valid) {
|
|
408
|
+
return {
|
|
409
|
+
success: false,
|
|
410
|
+
stdout: '',
|
|
411
|
+
stderr: validation.reason,
|
|
412
|
+
exitCode: 1,
|
|
413
|
+
duration: Date.now() - startTime,
|
|
414
|
+
timedOut: false,
|
|
415
|
+
blocked: true,
|
|
416
|
+
blockReason: validation.reason,
|
|
417
|
+
};
|
|
418
|
+
}
|
|
419
|
+
// 清理环境变量
|
|
420
|
+
const cleanEnv = cleanEnhancedEnvironment(this.config);
|
|
421
|
+
// 合并用户提供的环境变量
|
|
422
|
+
if (options?.env) {
|
|
423
|
+
for (const [key, value] of Object.entries(options.env)) {
|
|
424
|
+
if (this.config.blockedEnvVars && this.config.blockedEnvVars.includes(key)) {
|
|
425
|
+
continue;
|
|
426
|
+
}
|
|
427
|
+
cleanEnv[key] = value;
|
|
428
|
+
}
|
|
429
|
+
}
|
|
430
|
+
// 设置工作目录
|
|
431
|
+
const cwd = options?.cwd || this.config.workingDirectory || process.cwd();
|
|
432
|
+
// 确保工作目录存在
|
|
433
|
+
if (!fs.existsSync(cwd)) {
|
|
434
|
+
fs.mkdirSync(cwd, { recursive: true });
|
|
435
|
+
}
|
|
436
|
+
// 创建资源监控器
|
|
437
|
+
const monitor = new ResourceMonitor(this.config);
|
|
438
|
+
monitor.start();
|
|
439
|
+
// 执行命令
|
|
440
|
+
return new Promise((resolve) => {
|
|
441
|
+
const timeout = options?.timeout || this.config.timeout || 30000;
|
|
442
|
+
let timedOut = false;
|
|
443
|
+
const child = child_process.spawn('bash', ['-c', command], {
|
|
444
|
+
cwd,
|
|
445
|
+
env: cleanEnv,
|
|
446
|
+
stdio: ['pipe', 'pipe', 'pipe'],
|
|
447
|
+
timeout,
|
|
448
|
+
});
|
|
449
|
+
let stdout = '';
|
|
450
|
+
let stderr = '';
|
|
451
|
+
child.stdout?.on('data', (data) => {
|
|
452
|
+
const chunk = data.toString();
|
|
453
|
+
if (stdout.length + chunk.length <= (this.config.maxOutputSize || 10 * 1024 * 1024)) {
|
|
454
|
+
stdout += chunk;
|
|
455
|
+
}
|
|
456
|
+
});
|
|
457
|
+
child.stderr?.on('data', (data) => {
|
|
458
|
+
const chunk = data.toString();
|
|
459
|
+
if (stderr.length + chunk.length <= (this.config.maxOutputSize || 10 * 1024 * 1024)) {
|
|
460
|
+
stderr += chunk;
|
|
461
|
+
}
|
|
462
|
+
});
|
|
463
|
+
const timer = setTimeout(() => {
|
|
464
|
+
timedOut = true;
|
|
465
|
+
child.kill('SIGKILL');
|
|
466
|
+
}, timeout);
|
|
467
|
+
child.on('close', (exitCode) => {
|
|
468
|
+
clearTimeout(timer);
|
|
469
|
+
const resourceUsage = monitor.stop();
|
|
470
|
+
const monitorWarnings = monitor.getWarnings();
|
|
471
|
+
warnings.push(...monitorWarnings);
|
|
472
|
+
resolve({
|
|
473
|
+
success: exitCode === 0 && !timedOut,
|
|
474
|
+
stdout: stdout.slice(0, this.config.maxOutputSize),
|
|
475
|
+
stderr: stderr.slice(0, this.config.maxOutputSize),
|
|
476
|
+
exitCode,
|
|
477
|
+
duration: Date.now() - startTime,
|
|
478
|
+
timedOut,
|
|
479
|
+
blocked: false,
|
|
480
|
+
resourceUsage,
|
|
481
|
+
warnings: warnings.length > 0 ? warnings : undefined,
|
|
482
|
+
});
|
|
483
|
+
});
|
|
484
|
+
child.on('error', (error) => {
|
|
485
|
+
clearTimeout(timer);
|
|
486
|
+
monitor.stop();
|
|
487
|
+
resolve({
|
|
488
|
+
success: false,
|
|
489
|
+
stdout,
|
|
490
|
+
stderr: error.message,
|
|
491
|
+
exitCode: 1,
|
|
492
|
+
duration: Date.now() - startTime,
|
|
493
|
+
timedOut: false,
|
|
494
|
+
blocked: false,
|
|
495
|
+
});
|
|
496
|
+
});
|
|
497
|
+
});
|
|
498
|
+
}
|
|
499
|
+
/**
|
|
500
|
+
* 不安全的命令执行
|
|
501
|
+
*/
|
|
502
|
+
async executeUnsafe(command, options) {
|
|
503
|
+
const startTime = Date.now();
|
|
504
|
+
return new Promise((resolve) => {
|
|
505
|
+
const timeout = options?.timeout || 30000;
|
|
506
|
+
let timedOut = false;
|
|
507
|
+
const child = child_process.spawn('bash', ['-c', command], {
|
|
508
|
+
cwd: options?.cwd || process.cwd(),
|
|
509
|
+
env: { ...process.env, ...options?.env },
|
|
510
|
+
stdio: ['pipe', 'pipe', 'pipe'],
|
|
511
|
+
timeout,
|
|
512
|
+
});
|
|
513
|
+
let stdout = '';
|
|
514
|
+
let stderr = '';
|
|
515
|
+
child.stdout?.on('data', (data) => {
|
|
516
|
+
stdout += data.toString();
|
|
517
|
+
});
|
|
518
|
+
child.stderr?.on('data', (data) => {
|
|
519
|
+
stderr += data.toString();
|
|
520
|
+
});
|
|
521
|
+
const timer = setTimeout(() => {
|
|
522
|
+
timedOut = true;
|
|
523
|
+
child.kill('SIGKILL');
|
|
524
|
+
}, timeout);
|
|
525
|
+
child.on('close', (exitCode) => {
|
|
526
|
+
clearTimeout(timer);
|
|
527
|
+
resolve({
|
|
528
|
+
success: exitCode === 0 && !timedOut,
|
|
529
|
+
stdout,
|
|
530
|
+
stderr,
|
|
531
|
+
exitCode,
|
|
532
|
+
duration: Date.now() - startTime,
|
|
533
|
+
timedOut,
|
|
534
|
+
blocked: false,
|
|
535
|
+
});
|
|
536
|
+
});
|
|
537
|
+
child.on('error', (error) => {
|
|
538
|
+
clearTimeout(timer);
|
|
539
|
+
resolve({
|
|
540
|
+
success: false,
|
|
541
|
+
stdout,
|
|
542
|
+
stderr: error.message,
|
|
543
|
+
exitCode: 1,
|
|
544
|
+
duration: Date.now() - startTime,
|
|
545
|
+
timedOut: false,
|
|
546
|
+
blocked: false,
|
|
547
|
+
});
|
|
548
|
+
});
|
|
549
|
+
});
|
|
550
|
+
}
|
|
551
|
+
/**
|
|
552
|
+
* 更新配置(热更新)
|
|
553
|
+
*/
|
|
554
|
+
updateConfig(config) {
|
|
555
|
+
this.config = { ...this.config, ...config };
|
|
556
|
+
this.notifyConfigListeners();
|
|
557
|
+
}
|
|
558
|
+
/**
|
|
559
|
+
* 获取配置
|
|
560
|
+
*/
|
|
561
|
+
getConfig() {
|
|
562
|
+
return { ...this.config };
|
|
563
|
+
}
|
|
564
|
+
/**
|
|
565
|
+
* 添加配置变更监听器
|
|
566
|
+
*/
|
|
567
|
+
onConfigChange(listener) {
|
|
568
|
+
this.configListeners.push(listener);
|
|
569
|
+
return () => {
|
|
570
|
+
const index = this.configListeners.indexOf(listener);
|
|
571
|
+
if (index > -1) {
|
|
572
|
+
this.configListeners.splice(index, 1);
|
|
573
|
+
}
|
|
574
|
+
};
|
|
575
|
+
}
|
|
576
|
+
/**
|
|
577
|
+
* 通知配置变更监听器
|
|
578
|
+
*/
|
|
579
|
+
notifyConfigListeners() {
|
|
580
|
+
for (const listener of this.configListeners) {
|
|
581
|
+
try {
|
|
582
|
+
listener(this.config);
|
|
583
|
+
}
|
|
584
|
+
catch (error) {
|
|
585
|
+
console.error('[EnhancedSandbox] Config listener error:', error);
|
|
586
|
+
}
|
|
587
|
+
}
|
|
588
|
+
}
|
|
589
|
+
/**
|
|
590
|
+
* 检查文件访问权限
|
|
591
|
+
*/
|
|
592
|
+
checkFileAccess(filePath) {
|
|
593
|
+
return checkFileAccess(filePath, this.config);
|
|
594
|
+
}
|
|
595
|
+
/**
|
|
596
|
+
* 检查命令安全性
|
|
597
|
+
*/
|
|
598
|
+
checkCommandSafety(command) {
|
|
599
|
+
const validation = validateEnhancedCommand(command, this.config);
|
|
600
|
+
return {
|
|
601
|
+
safe: validation.valid,
|
|
602
|
+
reason: validation.reason,
|
|
603
|
+
};
|
|
604
|
+
}
|
|
605
|
+
}
|
|
606
|
+
// ── 全局实例 ──────────────────────────────────────────────────────────
|
|
607
|
+
let globalEnhancedSandbox = null;
|
|
608
|
+
/**
|
|
609
|
+
* 获取全局增强沙箱实例
|
|
610
|
+
*/
|
|
611
|
+
export function getEnhancedSandbox() {
|
|
612
|
+
if (!globalEnhancedSandbox) {
|
|
613
|
+
globalEnhancedSandbox = new EnhancedSandbox();
|
|
614
|
+
}
|
|
615
|
+
return globalEnhancedSandbox;
|
|
616
|
+
}
|
|
617
|
+
/**
|
|
618
|
+
* 初始化增强沙箱
|
|
619
|
+
*/
|
|
620
|
+
export function initEnhancedSandbox(config) {
|
|
621
|
+
globalEnhancedSandbox = new EnhancedSandbox(config);
|
|
622
|
+
return globalEnhancedSandbox;
|
|
623
|
+
}
|
|
624
|
+
/**
|
|
625
|
+
* 在增强沙箱中执行命令
|
|
626
|
+
*/
|
|
627
|
+
export async function executeInEnhancedSandbox(command, options) {
|
|
628
|
+
return getEnhancedSandbox().execute(command, options);
|
|
629
|
+
}
|
|
630
|
+
//# sourceMappingURL=sandbox-enhanced.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sandbox-enhanced.js","sourceRoot":"","sources":["../../src/security/sandbox-enhanced.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAkE9B,MAAM,uBAAuB,GAA0B;IACrD,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,KAAK;IACd,WAAW,EAAE,GAAG;IAChB,aAAa,EAAE,EAAE;IACjB,aAAa,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IAC/B,YAAY,EAAE,IAAI;IAClB,YAAY,EAAE,IAAI;IAClB,aAAa,EAAE,KAAK;IACpB,cAAc,EAAE;QACd,MAAM;QACN,MAAM;QACN,MAAM;QACN,OAAO;QACP,MAAM;QACN,QAAQ;QACR,UAAU;QACV,MAAM;QACN,UAAU;QACV,kBAAkB;QAClB,mBAAmB;KACpB;IACD,cAAc,EAAE;QACd,uBAAuB;QACvB,mBAAmB;QACnB,qBAAqB;QACrB,iBAAiB;QACjB,gCAAgC;QAChC,YAAY;QACZ,aAAa;QACb,mBAAmB;QACnB,kBAAkB;QAClB,eAAe;QACf,eAAe;QACf,gBAAgB;QAChB,iBAAiB;KAClB;IACD,UAAU,EAAE;QACV,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE;YACZ,aAAa;YACb,cAAc;YACd,kBAAkB;YAClB,YAAY;YACZ,cAAc;SACf;QACD,iBAAiB,EAAE,EAAE;QACrB,iBAAiB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;QACnD,cAAc,EAAE,IAAI;QACpB,WAAW,EAAE,KAAK;KACnB;IACD,UAAU,EAAE;QACV,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE;YACV,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,GAAG;YACb,aAAa,EAAE,KAAK;SACrB;KACF;CACF,CAAC;AA4CF,iEAAiE;AAEjE;;GAEG;AACH,SAAS,eAAe,CACtB,QAAgB,EAChB,MAA6B;IAE7B,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAEvC,iBAAiB;IACjB,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;QAC5B,KAAK,MAAM,WAAW,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;YAClD,IAAI,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBACzC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,YAAY,WAAW,EAAE;iBAClC,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,aAAa;IACb,IAAI,UAAU,CAAC,iBAAiB,IAAI,UAAU,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5E,IAAI,UAAU,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,eAAe,GAAG,EAAE;aAC7B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,IAAI,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,SAAS,GAAG,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAC3D,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC,CACrC,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,aAAa,YAAY,EAAE;aACpC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,IAAI,UAAU,CAAC,iBAAiB,IAAI,UAAU,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,gBAAgB,GAAG,EAAE;aAC9B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAC3B,OAAe,EACf,MAA6B;IAE7B,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,SAAS;IACT,MAAM,cAAc,GAAG;QACrB,SAAS;QACT,YAAY;QACZ,aAAa;QACb,YAAY;KACb,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,WAAW;aACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,mEAAmE;AAEnE;;GAEG;AACH,SAAS,kBAAkB,CACzB,OAAe,EACf,MAA6B;IAE7B,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,SAAS;IACT,MAAM,eAAe,GAAG;QACtB,WAAW;QACX,WAAW;QACX,SAAS;QACT,aAAa;QACb,UAAU;QACV,UAAU;QACV,YAAY;QACZ,WAAW;QACX,iBAAiB;QACjB,WAAW;QACX,WAAW;QACX,YAAY;KACb,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,WAAW;aACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,qEAAqE;AAErE;;GAEG;AACH,SAAS,uBAAuB,CAC9B,OAAe,EACf,MAA6B;IAE7B,aAAa;IACb,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACnD,CAAC;IAED,sBAAsB;IACtB,MAAM,iBAAiB,GAAG;QACxB,eAAe;QACf,eAAe;QACf,cAAc;QACd,cAAc;QACd,WAAW;QACX,WAAW;QACX,eAAe;QACf,YAAY;QACZ,WAAW;KACZ,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,kBAAkB,OAAO,CAAC,MAAM,EAAE;aAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,SAAS;IACT,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1D,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC3B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,aAAa,CAAC,MAAM;SAC7B,CAAC;IACJ,CAAC;IAED,SAAS;IACT,MAAM,YAAY,GAAG,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3D,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,YAAY,CAAC,MAAM;SAC5B,CAAC;IACJ,CAAC;IAED,iBAAiB;IACjB,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,WAAW;QACX,MAAM,mBAAmB,GAAG,+DAA+D,CAAC;QAC5F,IAAI,KAAK,CAAC;QACV,OAAO,CAAC,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACjC,cAAc;YACd,MAAM,YAAY,GAAG;gBACnB,MAAM,CAAC,gBAAgB;gBACvB,WAAW;gBACX,OAAO;gBACP,OAAO;gBACP,OAAO;gBACP,QAAQ;gBACR,OAAO;gBACP,OAAO;gBACP,QAAQ;aACT,CAAC;YAEF,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;YAC7E,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,oBAAoB,QAAQ,EAAE;iBACvC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,UAAU;QACV,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,mBAAmB;aAC5B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,MAAM,eAAe,GAAG,uEAAuE,CAAC;IAChG,IAAI,SAAS,CAAC;IACd,OAAO,CAAC,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,kBAAkB;QAClB,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,MAAM,gBAAgB,GAAG,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC3D,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;gBAC9B,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,gBAAgB,CAAC,MAAM;iBAChC,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,mEAAmE;AAEnE;;GAEG;AACH,SAAS,wBAAwB,CAAC,MAA6B;IAC7D,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAE5C,YAAY;IACZ,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzB,QAAQ,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;IAED,aAAa;IACb,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC5C,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,aAAa;IACb,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,UAAU;IACV,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,8BAA8B,CAAC;IACrE,CAAC;IAED,0BAA0B;IAC1B,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/D,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjE,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,qEAAqE;AAErE;;GAEG;AACH,MAAM,eAAe;IACX,SAAS,CAAS;IAClB,UAAU,GAA0B,IAAI,CAAC;IACzC,UAAU,GAAW,CAAC,CAAC;IACvB,QAAQ,GAAa,EAAE,CAAC;IACxB,MAAM,CAAwB;IAEtC,YAAY,MAA6B;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC;YACrC,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,IAAI,IAAI,CAAC;QAEzD,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE;YACjC,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,CAAC,EAAE,QAAQ,CAAC,CAAC;IACf,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC/B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAE1C,OAAO;YACL,OAAO,EAAE,QAAQ,EAAE,qBAAqB;YACxC,WAAW,EAAE,WAAW,CAAC,QAAQ;YACjC,eAAe,EAAE,IAAI,CAAC,UAAU;YAChC,aAAa,EAAE,QAAQ;YACvB,MAAM,EAAE,CAAC,EAAE,WAAW;YACtB,OAAO,EAAE,CAAC;SACX,CAAC;IACJ,CAAC;IAED,WAAW;QACT,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAEO,cAAc;QACpB,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,aAAa,GAAG,WAAW,CAAC,QAAQ,CAAC;QAE3C,SAAS;QACT,IAAI,aAAa,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YACpC,IAAI,CAAC,UAAU,GAAG,aAAa,CAAC;QAClC,CAAC;QAED,SAAS;QACT,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC;QACtD,IAAI,UAAU,EAAE,QAAQ,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,aAAa,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;YAC/C,IAAI,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;QAED,WAAW;QACX,IAAI,UAAU,EAAE,aAAa,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;YAC5C,IAAI,OAAO,GAAG,UAAU,CAAC,aAAa,EAAE,CAAC;gBACvC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,OAAO,QAAQ,UAAU,CAAC,aAAa,IAAI,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,oEAAoE;AAEpE,MAAM,OAAO,eAAe;IAClB,MAAM,CAAwB;IAC9B,eAAe,GAAmD,EAAE,CAAC;IAE7E,YAAY,SAAyC,EAAE;QACrD,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,uBAAuB,EAAE,GAAG,MAAM,EAAE,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,OAAe,EAAE,OAI9B;QACC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,OAAO;QACP,MAAM,UAAU,GAAG,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,UAAU,CAAC,MAAO;gBAC1B,QAAQ,EAAE,CAAC;gBACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAChC,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,UAAU,CAAC,MAAM;aAC/B,CAAC;QACJ,CAAC;QAED,SAAS;QACT,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEvD,cAAc;QACd,IAAI,OAAO,EAAE,GAAG,EAAE,CAAC;YACjB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvD,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC3E,SAAS;gBACX,CAAC;gBACD,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACxB,CAAC;QACH,CAAC;QAED,SAAS;QACT,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAE1E,WAAW;QACX,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAED,UAAU;QACV,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,OAAO,CAAC,KAAK,EAAE,CAAC;QAEhB,OAAO;QACP,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC;YACjE,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;gBACzD,GAAG;gBACH,GAAG,EAAE,QAAQ;gBACb,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,OAAO;aACR,CAAC,CAAC;YAEH,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAEhB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9B,IAAI,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;oBACpF,MAAM,IAAI,KAAK,CAAC;gBAClB,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9B,IAAI,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;oBACpF,MAAM,IAAI,KAAK,CAAC;gBAClB,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,QAAQ,GAAG,IAAI,CAAC;gBAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC,EAAE,OAAO,CAAC,CAAC;YAEZ,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC7B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;gBACrC,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;gBAC9C,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;gBAElC,OAAO,CAAC;oBACN,OAAO,EAAE,QAAQ,KAAK,CAAC,IAAI,CAAC,QAAQ;oBACpC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;oBAClD,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;oBAClD,QAAQ;oBACR,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAChC,QAAQ;oBACR,OAAO,EAAE,KAAK;oBACd,aAAa;oBACb,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;iBACrD,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,IAAI,EAAE,CAAC;gBAEf,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM;oBACN,MAAM,EAAE,KAAK,CAAC,OAAO;oBACrB,QAAQ,EAAE,CAAC;oBACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAChC,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,OAI5C;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC;YAC1C,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;gBACzD,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;gBAClC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE;gBACxC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,OAAO;aACR,CAAC,CAAC;YAEH,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAEhB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,QAAQ,GAAG,IAAI,CAAC;gBAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC,EAAE,OAAO,CAAC,CAAC;YAEZ,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC7B,YAAY,CAAC,KAAK,CAAC,CAAC;gBAEpB,OAAO,CAAC;oBACN,OAAO,EAAE,QAAQ,KAAK,CAAC,IAAI,CAAC,QAAQ;oBACpC,MAAM;oBACN,MAAM;oBACN,QAAQ;oBACR,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAChC,QAAQ;oBACR,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;gBAEpB,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM;oBACN,MAAM,EAAE,KAAK,CAAC,OAAO;oBACrB,QAAQ,EAAE,CAAC;oBACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAChC,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAAsC;QACjD,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QAC5C,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,QAAiD;QAC9D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,OAAO,GAAG,EAAE;YACV,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;gBACf,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,qBAAqB;QAC3B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC5C,IAAI,CAAC;gBACH,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,QAAgB;QAC9B,OAAO,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,OAAe;QAChC,MAAM,UAAU,GAAG,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACjE,OAAO;YACL,IAAI,EAAE,UAAU,CAAC,KAAK;YACtB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC;IACJ,CAAC;CACF;AAED,qEAAqE;AAErE,IAAI,qBAAqB,GAA2B,IAAI,CAAC;AAEzD;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,qBAAqB,GAAG,IAAI,eAAe,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAsC;IACxE,qBAAqB,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAe,EACf,OAIC;IAED,OAAO,kBAAkB,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACxD,CAAC"}
|