@zhin.js/agent 0.1.25 → 0.1.26

package/lib/security/sandbox.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Agent 沙箱环境
+ *
+ * 提供进程级隔离和资源限制。
+ *
+ * 功能：
+ * - 进程隔离（子进程执行）
+ * - 资源限制（CPU、内存、时间）
+ * - 文件系统隔离（工作目录限制）
+ * - 环境变量清理
+ * - 网络隔离（可选）
+ */
+export interface SandboxConfig {
+    /** 是否启用沙箱 */
+    enabled: boolean;
+    /** 工作目录限制（命令只能在此目录下执行） */
+    workingDirectory?: string;
+    /** 最大执行时间（毫秒） */
+    timeout?: number;
+    /** 最大内存使用（MB） */
+    maxMemoryMB?: number;
+    /** 最大 CPU 使用率（百分比） */
+    maxCpuPercent?: number;
+    /** 最大输出大小（字节） */
+    maxOutputSize?: number;
+    /** 允许的环境变量 */
+    allowedEnvVars?: string[];
+    /** 禁止的环境变量 */
+    blockedEnvVars?: string[];
+    /** 是否保留 HOME 目录 */
+    preserveHome?: boolean;
+    /** 是否保留 PATH */
+    preservePath?: boolean;
+    /** 额外的环境变量 */
+    extraEnvVars?: Record<string, string>;
+    /** 是否启用网络（默认 false） */
+    enableNetwork?: boolean;
+    /** 允许的域名（如果启用网络） */
+    allowedDomains?: string[];
+}
+export interface SandboxResult {
+    /** 是否成功 */
+    success: boolean;
+    /** 标准输出 */
+    stdout: string;
+    /** 标准错误 */
+    stderr: string;
+    /** 退出码 */
+    exitCode: number | null;
+    /** 执行时间（毫秒） */
+    duration: number;
+    /** 是否超时 */
+    timedOut: boolean;
+    /** 是否被沙箱阻止 */
+    blocked: boolean;
+    /** 阻止原因 */
+    blockReason?: string;
+    /** 资源使用情况 */
+    resourceUsage?: {
+        cpuTime: number;
+        memoryUsage: number;
+    };
+}
+export declare class Sandbox {
+    private config;
+    constructor(config?: Partial<SandboxConfig>);
+    /**
+     * 在沙箱中执行命令
+     */
+    execute(command: string, options?: {
+        cwd?: string;
+        env?: Record<string, string>;
+        timeout?: number;
+    }): Promise<SandboxResult>;
+    /**
+     * 不安全的命令执行（沙箱未启用时）
+     */
+    private executeUnsafe;
+    /**
+     * 更新配置
+     */
+    updateConfig(config: Partial<SandboxConfig>): void;
+    /**
+     * 获取配置
+     */
+    getConfig(): SandboxConfig;
+}
+/**
+ * 获取全局沙箱实例
+ */
+export declare function getSandbox(): Sandbox;
+/**
+ * 初始化沙箱
+ */
+export declare function initSandbox(config: Partial<SandboxConfig>): Sandbox;
+/**
+ * 在沙箱中执行命令
+ */
+export declare function executeInSandbox(command: string, options?: {
+    cwd?: string;
+    env?: Record<string, string>;
+    timeout?: number;
+}): Promise<SandboxResult>;
+//# sourceMappingURL=sandbox.d.ts.map

package/lib/security/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/security/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH,MAAM,WAAW,aAAa;IAC5B,aAAa;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,0BAA0B;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc;IACd,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc;IACd,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,mBAAmB;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,gBAAgB;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc;IACd,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,uBAAuB;IACvB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oBAAoB;IACpB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AA2CD,MAAM,WAAW,aAAa;IAC5B,WAAW;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW;IACX,MAAM,EAAE,MAAM,CAAC;IACf,WAAW;IACX,MAAM,EAAE,MAAM,CAAC;IACf,UAAU;IACV,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW;IACX,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW;IACX,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa;IACb,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AA4ID,qBAAa,OAAO;IAClB,OAAO,CAAC,MAAM,CAAgB;gBAElB,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM;IAI/C;;OAEG;IACG,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QACvC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,aAAa,CAAC;IA2H1B;;OAEG;YACW,aAAa;IAgE3B;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI;IAIlD;;OAEG;IACH,SAAS,IAAI,aAAa;CAG3B;AAMD;;GAEG;AACH,wBAAgB,UAAU,IAAI,OAAO,CAKpC;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,OAAO,CAGnE;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,aAAa,CAAC,CAEzB"}

package/lib/security/sandbox.js

@@ -0,0 +1,373 @@
+/**
+ * Agent 沙箱环境
+ *
+ * 提供进程级隔离和资源限制。
+ *
+ * 功能：
+ * - 进程隔离（子进程执行）
+ * - 资源限制（CPU、内存、时间）
+ * - 文件系统隔离（工作目录限制）
+ * - 环境变量清理
+ * - 网络隔离（可选）
+ */
+import * as child_process from 'node:child_process';
+import * as os from 'node:os';
+import * as fs from 'node:fs';
+const DEFAULT_CONFIG = {
+    enabled: true,
+    timeout: 30000, // 30 秒
+    maxMemoryMB: 512, // 512 MB
+    maxCpuPercent: 50, // 50%
+    maxOutputSize: 10 * 1024 * 1024, // 10 MB
+    preserveHome: true,
+    preservePath: true,
+    enableNetwork: false,
+    allowedEnvVars: [
+        'PATH',
+        'HOME',
+        'USER',
+        'SHELL',
+        'LANG',
+        'LC_ALL',
+        'LC_CTYPE',
+        'TERM',
+        'NODE_ENV',
+        'npm_config_cache',
+        'npm_config_prefix',
+    ],
+    blockedEnvVars: [
+        'AWS_SECRET_ACCESS_KEY',
+        'AWS_ACCESS_KEY_ID',
+        'AZURE_CLIENT_SECRET',
+        'AZURE_CLIENT_ID',
+        'GOOGLE_APPLICATION_CREDENTIALS',
+        'KUBECONFIG',
+        'DOCKER_HOST',
+        'DOCKER_TLS_VERIFY',
+        'DOCKER_CERT_PATH',
+        'SSH_AUTH_SOCK',
+        'SSH_AGENT_PID',
+        'GPG_AGENT_INFO',
+        'XDG_RUNTIME_DIR',
+    ],
+};
+// ── 环境变量清理 ──────────────────────────────────────────────────────
+/**
+ * 清理环境变量，移除敏感变量并只保留允许的变量
+ */
+function cleanEnvironment(config) {
+    const cleanEnv = {};
+    // 保留允许的环境变量
+    if (config.allowedEnvVars) {
+        for (const varName of config.allowedEnvVars) {
+            if (process.env[varName]) {
+                cleanEnv[varName] = process.env[varName];
+            }
+        }
+    }
+    // 移除被阻止的环境变量
+    if (config.blockedEnvVars) {
+        for (const varName of config.blockedEnvVars) {
+            delete cleanEnv[varName];
+        }
+    }
+    // 保留 HOME 目录
+    if (config.preserveHome) {
+        cleanEnv.HOME = os.homedir();
+    }
+    // 保留 PATH
+    if (config.preservePath) {
+        cleanEnv.PATH = process.env.PATH || '/usr/local/bin:/usr/bin:/bin';
+    }
+    // 添加额外的环境变量（但要检查是否在阻止列表中）
+    if (config.extraEnvVars) {
+        for (const [key, value] of Object.entries(config.extraEnvVars)) {
+            // 检查是否在阻止列表中
+            if (config.blockedEnvVars && config.blockedEnvVars.includes(key)) {
+                continue; // 跳过被阻止的变量
+            }
+            cleanEnv[key] = value;
+        }
+    }
+    return cleanEnv;
+}
+// ── 命令验证 ──────────────────────────────────────────────────────────
+function matchDangerousSandboxCommand(command) {
+    const lower = command.toLowerCase();
+    if ((lower.includes('curl') || lower.includes('wget')) &&
+        lower.includes('|') &&
+        /\bsh\b/.test(lower)) {
+        return '沙箱内禁止执行危险命令模式: curl|sh / wget|sh 类管道';
+    }
+    if ((lower.includes('curl') || lower.includes('wget')) &&
+        lower.includes('&&') &&
+        lower.includes('./')) {
+        return '沙箱内禁止执行危险命令模式: curl/wget 下载后直接执行';
+    }
+    if (/\b(?:rm|rmdir)\b/.test(lower) && lower.includes('node_modules')) {
+        return '沙箱内禁止执行危险命令模式: 删除 node_modules';
+    }
+    if (lower.includes('find') && lower.includes('node_modules') && lower.includes('-delete')) {
+        return '沙箱内禁止执行危险命令模式: find -delete node_modules';
+    }
+    if (lower.includes('eval(') || lower.includes('exec(')) {
+        return '沙箱内禁止执行危险命令模式: eval/exec';
+    }
+    if (lower.includes('child_process') || lower.includes('spawn(') || lower.includes('fork(')) {
+        return '沙箱内禁止执行危险命令模式: 进程注入相关调用';
+    }
+    return undefined;
+}
+/**
+ * 验证命令是否在沙箱允许范围内
+ */
+function validateCommand(command, config) {
+    // 检查是否尝试更改目录
+    if (/\bcd\s/.test(command)) {
+        return { valid: false, reason: '沙箱内禁止使用 cd 命令' };
+    }
+    // 检查是否尝试访问沙箱外的文件
+    if (config.workingDirectory) {
+        // 检查绝对路径访问
+        const absolutePathPattern = /(?:^|\s|;|&&|\|\|)(\/[^\s;|&`"'{}[\]()]+?)(?:\s|$|;|&&|\|\|)/g;
+        let match;
+        while ((match = absolutePathPattern.exec(command)) !== null) {
+            const filePath = match[1].trim();
+            // 检查是否是沙箱内的路径
+            const allowedPaths = [
+                config.workingDirectory,
+                '/dev/null',
+                '/tmp/',
+                '/usr/',
+                '/bin/',
+                '/sbin/',
+                '/etc/', // 允许读取系统配置
+                '/var/',
+                '/proc/',
+            ];
+            const isAllowed = allowedPaths.some(allowed => filePath.startsWith(allowed));
+            if (!isAllowed) {
+                return {
+                    valid: false,
+                    reason: `沙箱内禁止访问工作目录外的文件: ${filePath}`,
+                };
+            }
+        }
+        // 检查父目录遍历
+        if (/\.\.\//.test(command)) {
+            return {
+                valid: false,
+                reason: '沙箱内禁止使用父目录遍历（../）',
+            };
+        }
+    }
+    const blocked = matchDangerousSandboxCommand(command);
+    if (blocked) {
+        return { valid: false, reason: blocked };
+    }
+    return { valid: true };
+}
+// ── 沙箱执行器 ────────────────────────────────────────────────────────
+export class Sandbox {
+    config;
+    constructor(config = {}) {
+        this.config = { ...DEFAULT_CONFIG, ...config };
+    }
+    /**
+     * 在沙箱中执行命令
+     */
+    async execute(command, options) {
+        if (!this.config.enabled) {
+            // 沙箱未启用，直接执行
+            return this.executeUnsafe(command, options);
+        }
+        const startTime = Date.now();
+        // 验证命令
+        const validation = validateCommand(command, this.config);
+        if (!validation.valid) {
+            return {
+                success: false,
+                stdout: '',
+                stderr: validation.reason,
+                exitCode: 1,
+                duration: Date.now() - startTime,
+                timedOut: false,
+                blocked: true,
+                blockReason: validation.reason,
+            };
+        }
+        // 清理环境变量
+        const cleanEnv = cleanEnvironment(this.config);
+        // 合并用户提供的环境变量（但要检查是否在阻止列表中）
+        if (options?.env) {
+            for (const [key, value] of Object.entries(options.env)) {
+                // 检查是否在阻止列表中
+                if (this.config.blockedEnvVars && this.config.blockedEnvVars.includes(key)) {
+                    continue; // 跳过被阻止的变量
+                }
+                cleanEnv[key] = value;
+            }
+        }
+        // 设置工作目录
+        const cwd = options?.cwd || this.config.workingDirectory || process.cwd();
+        // 确保工作目录存在
+        if (!fs.existsSync(cwd)) {
+            fs.mkdirSync(cwd, { recursive: true });
+        }
+        // 执行命令
+        return new Promise((resolve) => {
+            const timeout = options?.timeout || this.config.timeout || 30000;
+            let timedOut = false;
+            let killed = false;
+            const child = child_process.spawn('bash', ['-c', command], {
+                cwd,
+                env: cleanEnv,
+                stdio: ['pipe', 'pipe', 'pipe'],
+                timeout,
+                // 资源限制（仅 Linux/macOS）
+                ...(process.platform !== 'win32' && {
+                // 内存限制（通过 ulimit）
+                // 注意：Node.js 没有直接的内存限制 API，需要通过 ulimit 命令
+                }),
+            });
+            let stdout = '';
+            let stderr = '';
+            child.stdout?.on('data', (data) => {
+                const chunk = data.toString();
+                if (stdout.length + chunk.length <= (this.config.maxOutputSize || 10 * 1024 * 1024)) {
+                    stdout += chunk;
+                }
+            });
+            child.stderr?.on('data', (data) => {
+                const chunk = data.toString();
+                if (stderr.length + chunk.length <= (this.config.maxOutputSize || 10 * 1024 * 1024)) {
+                    stderr += chunk;
+                }
+            });
+            // 超时处理
+            const timer = setTimeout(() => {
+                timedOut = true;
+                killed = true;
+                child.kill('SIGKILL');
+            }, timeout);
+            child.on('close', (exitCode) => {
+                clearTimeout(timer);
+                const duration = Date.now() - startTime;
+                resolve({
+                    success: exitCode === 0 && !timedOut,
+                    stdout: stdout.slice(0, this.config.maxOutputSize),
+                    stderr: stderr.slice(0, this.config.maxOutputSize),
+                    exitCode,
+                    duration,
+                    timedOut,
+                    blocked: false,
+                    resourceUsage: {
+                        cpuTime: 0, // 需要从 /proc 或 ps 获取
+                        memoryUsage: 0,
+                    },
+                });
+            });
+            child.on('error', (error) => {
+                clearTimeout(timer);
+                resolve({
+                    success: false,
+                    stdout,
+                    stderr: error.message,
+                    exitCode: 1,
+                    duration: Date.now() - startTime,
+                    timedOut: false,
+                    blocked: false,
+                });
+            });
+        });
+    }
+    /**
+     * 不安全的命令执行（沙箱未启用时）
+     */
+    async executeUnsafe(command, options) {
+        const startTime = Date.now();
+        return new Promise((resolve) => {
+            const timeout = options?.timeout || 30000;
+            let timedOut = false;
+            const child = child_process.spawn('bash', ['-c', command], {
+                cwd: options?.cwd || process.cwd(),
+                env: { ...process.env, ...options?.env },
+                stdio: ['pipe', 'pipe', 'pipe'],
+                timeout,
+            });
+            let stdout = '';
+            let stderr = '';
+            child.stdout?.on('data', (data) => {
+                stdout += data.toString();
+            });
+            child.stderr?.on('data', (data) => {
+                stderr += data.toString();
+            });
+            const timer = setTimeout(() => {
+                timedOut = true;
+                child.kill('SIGKILL');
+            }, timeout);
+            child.on('close', (exitCode) => {
+                clearTimeout(timer);
+                resolve({
+                    success: exitCode === 0 && !timedOut,
+                    stdout,
+                    stderr,
+                    exitCode,
+                    duration: Date.now() - startTime,
+                    timedOut,
+                    blocked: false,
+                });
+            });
+            child.on('error', (error) => {
+                clearTimeout(timer);
+                resolve({
+                    success: false,
+                    stdout,
+                    stderr: error.message,
+                    exitCode: 1,
+                    duration: Date.now() - startTime,
+                    timedOut: false,
+                    blocked: false,
+                });
+            });
+        });
+    }
+    /**
+     * 更新配置
+     */
+    updateConfig(config) {
+        this.config = { ...this.config, ...config };
+    }
+    /**
+     * 获取配置
+     */
+    getConfig() {
+        return { ...this.config };
+    }
+}
+// ── 全局沙箱实例 ──────────────────────────────────────────────────────
+let globalSandbox = null;
+/**
+ * 获取全局沙箱实例
+ */
+export function getSandbox() {
+    if (!globalSandbox) {
+        globalSandbox = new Sandbox();
+    }
+    return globalSandbox;
+}
+/**
+ * 初始化沙箱
+ */
+export function initSandbox(config) {
+    globalSandbox = new Sandbox(config);
+    return globalSandbox;
+}
+/**
+ * 在沙箱中执行命令
+ */
+export async function executeInSandbox(command, options) {
+    return getSandbox().execute(command, options);
+}
+//# sourceMappingURL=sandbox.js.map

package/lib/security/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/security/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAC;AAEpD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAiC9B,MAAM,cAAc,GAAkB;IACpC,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,KAAK,EAAY,OAAO;IACjC,WAAW,EAAE,GAAG,EAAU,SAAS;IACnC,aAAa,EAAE,EAAE,EAAS,MAAM;IAChC,aAAa,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAG,QAAQ;IAC1C,YAAY,EAAE,IAAI;IAClB,YAAY,EAAE,IAAI;IAClB,aAAa,EAAE,KAAK;IACpB,cAAc,EAAE;QACd,MAAM;QACN,MAAM;QACN,MAAM;QACN,OAAO;QACP,MAAM;QACN,QAAQ;QACR,UAAU;QACV,MAAM;QACN,UAAU;QACV,kBAAkB;QAClB,mBAAmB;KACpB;IACD,cAAc,EAAE;QACd,uBAAuB;QACvB,mBAAmB;QACnB,qBAAqB;QACrB,iBAAiB;QACjB,gCAAgC;QAChC,YAAY;QACZ,aAAa;QACb,mBAAmB;QACnB,kBAAkB;QAClB,eAAe;QACf,eAAe;QACf,gBAAgB;QAChB,iBAAiB;KAClB;CACF,CAAC;AA4BF,mEAAmE;AAEnE;;GAEG;AACH,SAAS,gBAAgB,CAAC,MAAqB;IAC7C,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAE5C,YAAY;IACZ,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzB,QAAQ,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;IAED,aAAa;IACb,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC5C,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,aAAa;IACb,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,UAAU;IACV,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,8BAA8B,CAAC;IACrE,CAAC;IAED,0BAA0B;IAC1B,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/D,aAAa;YACb,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjE,SAAS,CAAE,WAAW;YACxB,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,qEAAqE;AAErE,SAAS,4BAA4B,CAAC,OAAe;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,IACE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClD,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EACpB,CAAC;QACD,OAAO,sCAAsC,CAAC;IAChD,CAAC;IACD,IACE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClD,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EACpB,CAAC;QACD,OAAO,kCAAkC,CAAC;IAC5C,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACrE,OAAO,gCAAgC,CAAC;IAC1C,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1F,OAAO,0CAA0C,CAAC;IACpD,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3F,OAAO,yBAAyB,CAAC;IACnC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,OAAe,EAAE,MAAqB;IAC7D,aAAa;IACb,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACnD,CAAC;IAED,iBAAiB;IACjB,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,WAAW;QACX,MAAM,mBAAmB,GAAG,+DAA+D,CAAC;QAC5F,IAAI,KAAK,CAAC;QACV,OAAO,CAAC,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACjC,cAAc;YACd,MAAM,YAAY,GAAG;gBACnB,MAAM,CAAC,gBAAgB;gBACvB,WAAW;gBACX,OAAO;gBACP,OAAO;gBACP,OAAO;gBACP,QAAQ;gBACR,OAAO,EAAG,WAAW;gBACrB,OAAO;gBACP,QAAQ;aACT,CAAC;YAEF,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;YAC7E,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,oBAAoB,QAAQ,EAAE;iBACvC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,UAAU;QACV,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,mBAAmB;aAC5B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC3C,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,oEAAoE;AAEpE,MAAM,OAAO,OAAO;IACV,MAAM,CAAgB;IAE9B,YAAY,SAAiC,EAAE;QAC7C,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,OAAe,EAAE,OAI9B;QACC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,aAAa;YACb,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,OAAO;QACP,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,UAAU,CAAC,MAAO;gBAC1B,QAAQ,EAAE,CAAC;gBACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAChC,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,UAAU,CAAC,MAAM;aAC/B,CAAC;QACJ,CAAC;QAED,SAAS;QACT,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE/C,4BAA4B;QAC5B,IAAI,OAAO,EAAE,GAAG,EAAE,CAAC;YACjB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvD,aAAa;gBACb,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC3E,SAAS,CAAE,WAAW;gBACxB,CAAC;gBACD,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACxB,CAAC;QACH,CAAC;QAED,SAAS;QACT,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAE1E,WAAW;QACX,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAED,OAAO;QACP,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC;YACjE,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,MAAM,GAAG,KAAK,CAAC;YAEnB,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;gBACzD,GAAG;gBACH,GAAG,EAAE,QAAQ;gBACb,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,OAAO;gBACP,sBAAsB;gBACtB,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI;gBAClC,kBAAkB;gBAClB,0CAA0C;iBAC3C,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAEhB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9B,IAAI,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;oBACpF,MAAM,IAAI,KAAK,CAAC;gBAClB,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9B,IAAI,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;oBACpF,MAAM,IAAI,KAAK,CAAC;gBAClB,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,OAAO;YACP,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,QAAQ,GAAG,IAAI,CAAC;gBAChB,MAAM,GAAG,IAAI,CAAC;gBACd,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC,EAAE,OAAO,CAAC,CAAC;YAEZ,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC7B,YAAY,CAAC,KAAK,CAAC,CAAC;gBAEpB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBAExC,OAAO,CAAC;oBACN,OAAO,EAAE,QAAQ,KAAK,CAAC,IAAI,CAAC,QAAQ;oBACpC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;oBAClD,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;oBAClD,QAAQ;oBACR,QAAQ;oBACR,QAAQ;oBACR,OAAO,EAAE,KAAK;oBACd,aAAa,EAAE;wBACb,OAAO,EAAE,CAAC,EAAE,oBAAoB;wBAChC,WAAW,EAAE,CAAC;qBACf;iBACF,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;gBAEpB,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM;oBACN,MAAM,EAAE,KAAK,CAAC,OAAO;oBACrB,QAAQ,EAAE,CAAC;oBACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAChC,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,OAI5C;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC;YAC1C,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;gBACzD,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;gBAClC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE;gBACxC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,OAAO;aACR,CAAC,CAAC;YAEH,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAEhB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAChC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,QAAQ,GAAG,IAAI,CAAC;gBAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC,EAAE,OAAO,CAAC,CAAC;YAEZ,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC7B,YAAY,CAAC,KAAK,CAAC,CAAC;gBAEpB,OAAO,CAAC;oBACN,OAAO,EAAE,QAAQ,KAAK,CAAC,IAAI,CAAC,QAAQ;oBACpC,MAAM;oBACN,MAAM;oBACN,QAAQ;oBACR,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAChC,QAAQ;oBACR,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;gBAEpB,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM;oBACN,MAAM,EAAE,KAAK,CAAC,OAAO;oBACrB,QAAQ,EAAE,CAAC;oBACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAChC,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAA8B;QACzC,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;CACF;AAED,mEAAmE;AAEnE,IAAI,aAAa,GAAmB,IAAI,CAAC;AAEzC;;GAEG;AACH,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,IAAI,OAAO,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,MAA8B;IACxD,aAAa,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAe,EAAE,OAIvD;IACC,OAAO,UAAU,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC"}

package/lib/security/security-config.example.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Agent 安全策略配置示例
+ *
+ * 展示如何配置所有安全策略。
+ */
+import type { SecurityPolicyConfig } from './index.js';
+/**
+ * 生产环境安全配置
+ *
+ * 严格的安全策略，适用于生产环境
+ */
+export declare const PRODUCTION_SECURITY_CONFIG: SecurityPolicyConfig;
+/**
+ * 开发环境安全配置
+ *
+ * 宽松的安全策略，适用于开发和测试
+ */
+export declare const DEVELOPMENT_SECURITY_CONFIG: SecurityPolicyConfig;
+/**
+ * 最小安全配置
+ *
+ * 仅启用基本安全检查，适用于受信任环境
+ */
+export declare const MINIMAL_SECURITY_CONFIG: SecurityPolicyConfig;
+/**
+ * 根据环境获取安全配置
+ */
+export declare function getSecurityConfigForEnvironment(env?: string): SecurityPolicyConfig;
+/**
+ * 合并自定义配置与默认配置
+ */
+export declare function mergeSecurityConfig(base: SecurityPolicyConfig, custom: Partial<SecurityPolicyConfig>): SecurityPolicyConfig;
+//# sourceMappingURL=security-config.example.d.ts.map

package/lib/security/security-config.example.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-config.example.d.ts","sourceRoot":"","sources":["../../src/security/security-config.example.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAE,oBA+DxC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,oBAgDzC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,oBAYrC,CAAC;AAEF;;GAEG;AACH,wBAAgB,+BAA+B,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,oBAAoB,CAWlF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,oBAAoB,EAC1B,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,GACpC,oBAAoB,CAMtB"}