@zhin.js/agent 0.2.1 → 0.3.0

package/lib/security/network-policy.js

@@ -1,305 +0,0 @@
-/**
- * 网络访问安全策略
- *
- * 控制 AI Agent 的网络请求，防止：
- * - 访问恶意域名
- * - 数据外泄
- * - SSRF 攻击
- * - 资源滥用
- *
- */
-import { URL } from 'node:url';
-const DEFAULT_CONFIG = {
-    enabled: true,
-    blockPrivateIPs: true,
-    maxRequestSize: 10 * 1024 * 1024, // 10 MB
-    maxResponseSize: 50 * 1024 * 1024, // 50 MB
-    requestTimeout: 30000, // 30 秒
-    rateLimit: 100, // 每分钟 100 次
-    blockedProtocols: ['file', 'ftp', 'gopher'],
-    blockedPorts: [22, 23, 25, 465, 587, 1080, 3389, 5900],
-};
-// ── 私有 IP 检测 ──────────────────────────────────────────────────────
-const PRIVATE_IP_PATTERNS = [
-    /^10\./, // 10.0.0.0/8
-    /^172\.(1[6-9]|2[0-9]|3[0-1])\./, // 172.16.0.0/12
-    /^192\.168\./, // 192.168.0.0/16
-    /^127\./, // 127.0.0.0/8 (localhost)
-    /^0\./, // 0.0.0.0
-    /^::1$/, // IPv6 localhost
-    /^fc00:/, // IPv6 private
-    /^fd[0-9a-f]{2}:/, // IPv6 private
-    /^fe80:/, // IPv6 link-local
-];
-/**
- * 检查 IP 是否为私有地址
- */
-function isPrivateIP(ip) {
-    return PRIVATE_IP_PATTERNS.some(pattern => pattern.test(ip));
-}
-// ── 常见危险域名模式 ──────────────────────────────────────────────────
-const SUSPICIOUS_DOMAIN_PATTERNS = [
-    /\.tk$/i, // 免费域名，常用于钓鱼
-    /\.ml$/i,
-    /\.ga$/i,
-    /\.cf$/i,
-    /\.gq$/i,
-    /pastebin\.com/i, // 代码分享，可能含恶意内容
-    /hastebin\.com/i,
-    /ngrok\.io/i, // 隧道服务
-    /serveo\.net/i,
-    /localtunnel\.me/i,
-];
-// ── 速率限制器 ────────────────────────────────────────────────────────
-class RateLimiter {
-    requests = new Map();
-    /**
-     * 检查是否超过速率限制
-     * @returns true 表示超过限制
-     */
-    isLimited(key, limit, windowMs = 60000) {
-        const now = Date.now();
-        const windowStart = now - windowMs;
-        // 获取或初始化请求记录
-        let timestamps = this.requests.get(key) || [];
-        // 清理过期记录
-        timestamps = timestamps.filter(t => t > windowStart);
-        // 检查是否超过限制
-        if (timestamps.length >= limit) {
-            return true;
-        }
-        // 记录本次请求
-        timestamps.push(now);
-        this.requests.set(key, timestamps);
-        return false;
-    }
-    /**
-     * 清理过期记录
-     */
-    cleanup() {
-        const now = Date.now();
-        for (const [key, timestamps] of this.requests.entries()) {
-            const valid = timestamps.filter(t => t > now - 120000); // 保留 2 分钟内的记录
-            if (valid.length === 0) {
-                this.requests.delete(key);
-            }
-            else {
-                this.requests.set(key, valid);
-            }
-        }
-    }
-}
-// ── 网络策略类 ────────────────────────────────────────────────────────
-export class NetworkPolicy {
-    config;
-    rateLimiter;
-    cleanupTimer;
-    constructor(config = {}) {
-        this.config = { ...DEFAULT_CONFIG, ...config };
-        this.rateLimiter = new RateLimiter();
-        // 定期清理速率限制器
-        this.cleanupTimer = setInterval(() => this.rateLimiter.cleanup(), 60000);
-        if (this.cleanupTimer && typeof this.cleanupTimer === 'object' && 'unref' in this.cleanupTimer) {
-            this.cleanupTimer.unref();
-        }
-    }
-    /**
-     * 检查 URL 是否允许访问
-     */
-    checkUrl(url, userId) {
-        if (!this.config.enabled) {
-            return { allowed: true };
-        }
-        let parsed;
-        try {
-            parsed = new URL(url);
-        }
-        catch {
-            return { allowed: false, reason: '无效的 URL 格式' };
-        }
-        // 1. 协议检查
-        if (this.config.blockedProtocols?.includes(parsed.protocol.replace(':', ''))) {
-            return {
-                allowed: false,
-                reason: `禁止的协议: ${parsed.protocol}`,
-                sanitizedUrl: `${parsed.protocol}//***`,
-            };
-        }
-        // 2. 端口检查
-        const port = parsed.port ? parseInt(parsed.port, 10) : this.getDefaultPort(parsed.protocol);
-        if (port && this.config.blockedPorts?.includes(port)) {
-            return {
-                allowed: false,
-                reason: `禁止的端口: ${port}`,
-                sanitizedUrl: `${parsed.protocol}//${parsed.hostname}:***`,
-            };
-        }
-        // 3. 私有 IP 检查（在白名单检查之前）
-        const hostname = parsed.hostname.toLowerCase();
-        if (this.config.blockPrivateIPs && this.isPrivateIP(hostname)) {
-            return {
-                allowed: false,
-                reason: '禁止访问私有 IP 地址',
-                sanitizedUrl: `${parsed.protocol}//***`,
-            };
-        }
-        // 4. 可疑域名检查（在白名单检查之前）
-        if (this.isSuspiciousDomain(hostname)) {
-            return {
-                allowed: false,
-                reason: `可疑域名: ${this.maskDomain(hostname)}`,
-                sanitizedUrl: `${parsed.protocol}//${this.maskDomain(hostname)}`,
-            };
-        }
-        // 5. 域名黑名单检查
-        if (this.isBlockedDomain(hostname)) {
-            return {
-                allowed: false,
-                reason: `域名在黑名单中: ${this.maskDomain(hostname)}`,
-                sanitizedUrl: `${parsed.protocol}//${this.maskDomain(hostname)}`,
-            };
-        }
-        // 6. 域名白名单检查
-        if (this.config.allowedDomains && this.config.allowedDomains.length > 0) {
-            if (!this.isAllowedDomain(hostname)) {
-                return {
-                    allowed: false,
-                    reason: `域名不在白名单中: ${this.maskDomain(hostname)}`,
-                    sanitizedUrl: `${parsed.protocol}//${this.maskDomain(hostname)}`,
-                };
-            }
-        }
-        // 7. 速率限制检查
-        const rateLimitKey = userId || hostname;
-        if (this.config.rateLimit && this.rateLimiter.isLimited(rateLimitKey, this.config.rateLimit)) {
-            return {
-                allowed: false,
-                reason: '请求过于频繁，请稍后再试',
-                sanitizedUrl: `${parsed.protocol}//${this.maskDomain(hostname)}`,
-            };
-        }
-        // 通过所有检查
-        return {
-            allowed: true,
-            sanitizedUrl: `${parsed.protocol}//${this.maskDomain(hostname)}${parsed.pathname}`,
-        };
-    }
-    /**
-     * 检查域名是否在黑名单中
-     */
-    isBlockedDomain(domain) {
-        if (!this.config.blockedDomains)
-            return false;
-        return this.config.blockedDomains.some(blocked => {
-            // 支持通配符匹配
-            if (blocked.startsWith('*.')) {
-                const suffix = blocked.slice(1); // *.example.com -> .example.com
-                return domain.endsWith(suffix) || domain === suffix.slice(1);
-            }
-            return domain === blocked || domain.endsWith(`.${blocked}`);
-        });
-    }
-    /**
-     * 检查域名是否在白名单中
-     */
-    isAllowedDomain(domain) {
-        if (!this.config.allowedDomains || this.config.allowedDomains.length === 0) {
-            return true; // 没有白名单则允许所有
-        }
-        return this.config.allowedDomains.some(allowed => {
-            if (allowed.startsWith('*.')) {
-                const suffix = allowed.slice(1);
-                return domain.endsWith(suffix) || domain === suffix.slice(1);
-            }
-            return domain === allowed || domain.endsWith(`.${allowed}`);
-        });
-    }
-    /**
-     * 检查是否为可疑域名
-     */
-    isSuspiciousDomain(domain) {
-        return SUSPICIOUS_DOMAIN_PATTERNS.some(pattern => pattern.test(domain));
-    }
-    /**
-     * 检查是否为私有 IP
-     */
-    isPrivateIP(hostname) {
-        // 简单的 IP 格式检查
-        const ipPattern = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
-        if (!ipPattern.test(hostname)) {
-            // 可能是域名，需要解析（这里简化处理）
-            return false;
-        }
-        return isPrivateIP(hostname);
-    }
-    /**
-     * 获取默认端口
-     */
-    getDefaultPort(protocol) {
-        const ports = {
-            'http:': 80,
-            'https:': 443,
-            'ftp:': 21,
-            'ssh:': 22,
-        };
-        return ports[protocol] || null;
-    }
-    /**
-     * 脱敏域名
-     */
-    maskDomain(domain) {
-        const parts = domain.split('.');
-        if (parts.length <= 2) {
-            return domain; // 顶级域名不脱敏
-        }
-        // 保留顶级域名，中间部分脱敏
-        return `***.${parts.slice(-2).join('.')}`;
-    }
-    /**
-     * 更新配置
-     */
-    updateConfig(config) {
-        this.config = { ...this.config, ...config };
-    }
-    /**
-     * 获取配置（脱敏）
-     */
-    getConfig() {
-        return { ...this.config };
-    }
-    dispose() {
-        if (this.cleanupTimer) {
-            clearInterval(this.cleanupTimer);
-            this.cleanupTimer = undefined;
-        }
-    }
-}
-// ── 全局网络策略实例 ──────────────────────────────────────────────────
-let globalNetworkPolicy = null;
-/**
- * 获取全局网络策略实例
- */
-export function getNetworkPolicy() {
-    if (!globalNetworkPolicy) {
-        globalNetworkPolicy = new NetworkPolicy();
-    }
-    return globalNetworkPolicy;
-}
-/**
- * 初始化网络策略
- */
-export function initNetworkPolicy(config) {
-    globalNetworkPolicy = new NetworkPolicy(config);
-    return globalNetworkPolicy;
-}
-/** 重置全局网络策略（用于测试隔离） */
-export function resetNetworkPolicy() {
-    globalNetworkPolicy = null;
-}
-/**
- * 检查 URL 是否允许访问
- */
-export function checkNetworkAccess(url, userId) {
-    return getNetworkPolicy().checkUrl(url, userId);
-}
-//# sourceMappingURL=network-policy.js.map

package/lib/security/network-policy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"network-policy.js","sourceRoot":"","sources":["../../src/security/network-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AA6B/B,MAAM,cAAc,GAAwB;IAC1C,OAAO,EAAE,IAAI;IACb,eAAe,EAAE,IAAI;IACrB,cAAc,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAO,QAAQ;IAC/C,eAAe,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAM,QAAQ;IAC/C,cAAc,EAAE,KAAK,EAAmB,OAAO;IAC/C,SAAS,EAAE,GAAG,EAA0B,YAAY;IACpD,gBAAgB,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC;IAC3C,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;CACvD,CAAC;AAEF,qEAAqE;AAErE,MAAM,mBAAmB,GAAG;IAC1B,OAAO,EAA2B,aAAa;IAC/C,gCAAgC,EAAE,gBAAgB;IAClD,aAAa,EAAsB,iBAAiB;IACpD,QAAQ,EAA2B,0BAA0B;IAC7D,MAAM,EAA6B,UAAU;IAC7C,OAAO,EAA4B,iBAAiB;IACpD,QAAQ,EAA2B,eAAe;IAClD,iBAAiB,EAAiB,eAAe;IACjD,QAAQ,EAA2B,kBAAkB;CACtD,CAAC;AAEF;;GAEG;AACH,SAAS,WAAW,CAAC,EAAU;IAC7B,OAAO,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,iEAAiE;AAEjE,MAAM,0BAA0B,GAAG;IACjC,QAAQ,EAAO,aAAa;IAC5B,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,gBAAgB,EAAG,eAAe;IAClC,gBAAgB;IAChB,YAAY,EAAO,OAAO;IAC1B,cAAc;IACd,kBAAkB;CACnB,CAAC;AAEF,oEAAoE;AAEpE,MAAM,WAAW;IACP,QAAQ,GAA0B,IAAI,GAAG,EAAE,CAAC;IAEpD;;;OAGG;IACH,SAAS,CAAC,GAAW,EAAE,KAAa,EAAE,WAAmB,KAAK;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,QAAQ,CAAC;QAEnC,aAAa;QACb,IAAI,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAE9C,SAAS;QACT,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC;QAErD,WAAW;QACX,IAAI,UAAU,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,SAAS;QACT,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAEnC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,OAAO;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc;YACtE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAWD,oEAAoE;AAEpE,MAAM,OAAO,aAAa;IAChB,MAAM,CAAsB;IAC5B,WAAW,CAAc;IACzB,YAAY,CAAkC;IAEtD,YAAY,SAAuC,EAAE;QACnD,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;QAErC,YAAY;QACZ,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;QACzE,IAAI,IAAI,CAAC,YAAY,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/F,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,GAAW,EAAE,MAAe;QACnC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QAClD,CAAC;QAED,UAAU;QACV,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;YAC7E,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,UAAU,MAAM,CAAC,QAAQ,EAAE;gBACnC,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,OAAO;aACxC,CAAC;QACJ,CAAC;QAED,UAAU;QACV,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5F,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,UAAU,IAAI,EAAE;gBACxB,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,MAAM;aAC3D,CAAC;QACJ,CAAC;QAED,wBAAwB;QACxB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9D,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,cAAc;gBACtB,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,OAAO;aACxC,CAAC;QACJ,CAAC;QAED,sBAAsB;QACtB,IAAI,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;gBAC5C,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;aACjE,CAAC;QACJ,CAAC;QAED,aAAa;QACb,IAAI,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,YAAY,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;gBAC/C,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;aACjE,CAAC;QACJ,CAAC;QAED,aAAa;QACb,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,aAAa,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;oBAChD,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;iBACjE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,YAAY;QACZ,MAAM,YAAY,GAAG,MAAM,IAAI,QAAQ,CAAC;QACxC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7F,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,cAAc;gBACtB,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;aACjE,CAAC;QACJ,CAAC;QAED,SAAS;QACT,OAAO;YACL,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE;SACnF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,MAAc;QACpC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc;YAAE,OAAO,KAAK,CAAC;QAE9C,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;YAC/C,UAAU;YACV,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,gCAAgC;gBACjE,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,MAAM,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,MAAc;QACpC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC,CAAC,aAAa;QAC5B,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;YAC/C,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAChC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,MAAM,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,kBAAkB,CAAC,MAAc;QACvC,OAAO,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,QAAgB;QAClC,cAAc;QACd,MAAM,SAAS,GAAG,sCAAsC,CAAC;QACzD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,qBAAqB;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,QAAgB;QACrC,MAAM,KAAK,GAA2B;YACpC,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,GAAG;YACb,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;SACX,CAAC;QACF,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;IACjC,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,MAAc;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,CAAC,UAAU;QAC3B,CAAC;QACD,gBAAgB;QAChB,OAAO,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAAoC;QAC/C,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,OAAO;QACL,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACjC,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAChC,CAAC;IACH,CAAC;CACF;AAED,iEAAiE;AAEjE,IAAI,mBAAmB,GAAyB,IAAI,CAAC;AAErD;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,mBAAmB,GAAG,IAAI,aAAa,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAoC;IACpE,mBAAmB,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,uBAAuB;AACvB,MAAM,UAAU,kBAAkB;IAChC,mBAAmB,GAAG,IAAI,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,MAAe;IAC7D,OAAO,gBAAgB,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC"}

package/lib/security/security-config.example.d.ts

@@ -1,33 +0,0 @@
-/**
- * Agent 安全策略配置示例
- *
- * 展示如何配置所有安全策略。
- */
-import type { SecurityPolicyConfig } from './index.js';
-/**
- * 生产环境安全配置
- *
- * 严格的安全策略，适用于生产环境
- */
-export declare const PRODUCTION_SECURITY_CONFIG: SecurityPolicyConfig;
-/**
- * 开发环境安全配置
- *
- * 宽松的安全策略，适用于开发和测试
- */
-export declare const DEVELOPMENT_SECURITY_CONFIG: SecurityPolicyConfig;
-/**
- * 最小安全配置
- *
- * 仅启用基本安全检查，适用于受信任环境
- */
-export declare const MINIMAL_SECURITY_CONFIG: SecurityPolicyConfig;
-/**
- * 根据环境获取安全配置
- */
-export declare function getSecurityConfigForEnvironment(env?: string): SecurityPolicyConfig;
-/**
- * 合并自定义配置与默认配置
- */
-export declare function mergeSecurityConfig(base: SecurityPolicyConfig, custom: Partial<SecurityPolicyConfig>): SecurityPolicyConfig;
-//# sourceMappingURL=security-config.example.d.ts.map

package/lib/security/security-config.example.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-config.example.d.ts","sourceRoot":"","sources":["../../src/security/security-config.example.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAE,oBA+DxC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,oBAgDzC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,oBAYrC,CAAC;AAEF;;GAEG;AACH,wBAAgB,+BAA+B,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,oBAAoB,CAWlF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,oBAAoB,EAC1B,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,GACpC,oBAAoB,CAMtB"}

package/lib/security/security-config.example.js

@@ -1,166 +0,0 @@
-/**
- * Agent 安全策略配置示例
- *
- * 展示如何配置所有安全策略。
- */
-/**
- * 生产环境安全配置
- *
- * 严格的安全策略，适用于生产环境
- */
-export const PRODUCTION_SECURITY_CONFIG = {
-    // 审计日志配置
-    audit: {
-        enabled: true,
-        logFile: 'data/audit/agent-audit.log',
-        minSeverity: 'info',
-        logSensitiveData: false, // 生产环境不记录敏感数据
-        retentionDays: 90, // 保留 90 天
-        maxFileSizeMB: 200, // 最大 200MB
-    },
-    // 网络策略配置
-    network: {
-        enabled: true,
-        // 允许访问的域名（白名单）
-        allowedDomains: [
-            'api.openai.com',
-            'api.anthropic.com',
-            'api.ollama.ai',
-            'github.com',
-            'api.github.com',
-            'registry.npmjs.org',
-            'api.npmjs.org',
-        ],
-        // 禁止访问的域名（黑名单）
-        blockedDomains: [
-            '*.malware.com',
-            '*.phishing.com',
-            'pastebin.com',
-            'hastebin.com',
-        ],
-        // 禁止私有 IP
-        blockPrivateIPs: true,
-        // 请求限制
-        maxRequestSize: 5 * 1024 * 1024, // 5MB
-        maxResponseSize: 20 * 1024 * 1024, // 20MB
-        requestTimeout: 15000, // 15 秒
-        rateLimit: 60, // 每分钟 60 次
-        // 禁止的协议
-        blockedProtocols: ['file', 'ftp', 'gopher', 'ssh'],
-        // 禁止的端口
-        blockedPorts: [22, 23, 25, 465, 587, 1080, 3306, 5432, 6379, 27017],
-    },
-    // 预算限制配置
-    budget: {
-        enabled: true,
-        // Token 限制
-        maxTokensPerSession: 500000, // 500K tokens
-        maxTokensPerUserPerDay: 2000000, // 2M tokens
-        // 成本限制
-        maxCostPerSession: 5.0, // $5
-        maxCostPerUserPerDay: 20.0, // $20
-        // 调用限制
-        maxToolCallsPerSession: 50,
-        maxIterationsPerSession: 15,
-        // 时长限制
-        maxSessionDuration: 1800000, // 30 分钟
-        // 警告阈值
-        warningThreshold: 75, // 75%
-        // 自动终止
-        autoTerminate: true,
-    },
-};
-/**
- * 开发环境安全配置
- *
- * 宽松的安全策略，适用于开发和测试
- */
-export const DEVELOPMENT_SECURITY_CONFIG = {
-    audit: {
-        enabled: true,
-        logFile: 'data/audit/agent-audit-dev.log',
-        minSeverity: 'warn', // 开发环境只记录警告及以上
-        logSensitiveData: true, // 开发环境可以记录敏感数据
-        retentionDays: 7, // 保留 7 天
-        maxFileSizeMB: 50, // 最大 50MB
-    },
-    network: {
-        enabled: true,
-        // 开发环境允许更多域名
-        allowedDomains: [
-            'api.openai.com',
-            'api.anthropic.com',
-            'api.ollama.ai',
-            'github.com',
-            'api.github.com',
-            'registry.npmjs.org',
-            'api.npmjs.org',
-            'localhost',
-            '127.0.0.1',
-            '*.dev',
-            '*.test',
-            '*.local',
-        ],
-        blockPrivateIPs: false, // 开发环境允许私有 IP
-        maxRequestSize: 50 * 1024 * 1024, // 50MB
-        maxResponseSize: 100 * 1024 * 1024, // 100MB
-        requestTimeout: 60000, // 60 秒
-        rateLimit: 200, // 每分钟 200 次
-        blockedProtocols: ['file', 'ftp'],
-        blockedPorts: [22, 25, 465, 587],
-    },
-    budget: {
-        enabled: true,
-        maxTokensPerSession: 2000000, // 2M tokens
-        maxTokensPerUserPerDay: 10000000, // 10M tokens
-        maxCostPerSession: 20.0, // $20
-        maxCostPerUserPerDay: 100.0, // $100
-        maxToolCallsPerSession: 200,
-        maxIterationsPerSession: 50,
-        maxSessionDuration: 7200000, // 2 小时
-        warningThreshold: 85, // 85%
-        autoTerminate: false,
-    },
-};
-/**
- * 最小安全配置
- *
- * 仅启用基本安全检查，适用于受信任环境
- */
-export const MINIMAL_SECURITY_CONFIG = {
-    audit: {
-        enabled: false,
-    },
-    network: {
-        enabled: false,
-    },
-    budget: {
-        enabled: false,
-    },
-};
-/**
- * 根据环境获取安全配置
- */
-export function getSecurityConfigForEnvironment(env) {
-    switch (env) {
-        case 'production':
-            return PRODUCTION_SECURITY_CONFIG;
-        case 'development':
-            return DEVELOPMENT_SECURITY_CONFIG;
-        case 'minimal':
-            return MINIMAL_SECURITY_CONFIG;
-        default:
-            return DEVELOPMENT_SECURITY_CONFIG;
-    }
-}
-/**
- * 合并自定义配置与默认配置
- */
-export function mergeSecurityConfig(base, custom) {
-    return {
-        audit: { ...base.audit, ...custom.audit },
-        network: { ...base.network, ...custom.network },
-        budget: { ...base.budget, ...custom.budget },
-    };
-}
-//# sourceMappingURL=security-config.example.js.map

package/lib/security/security-config.example.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-config.example.js","sourceRoot":"","sources":["../../src/security/security-config.example.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAyB;IAC9D,SAAS;IACT,KAAK,EAAE;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,4BAA4B;QACrC,WAAW,EAAE,MAAM;QACnB,gBAAgB,EAAE,KAAK,EAAE,cAAc;QACvC,aAAa,EAAE,EAAE,EAAQ,UAAU;QACnC,aAAa,EAAE,GAAG,EAAO,WAAW;KACrC;IAED,SAAS;IACT,OAAO,EAAE;QACP,OAAO,EAAE,IAAI;QACb,eAAe;QACf,cAAc,EAAE;YACd,gBAAgB;YAChB,mBAAmB;YACnB,eAAe;YACf,YAAY;YACZ,gBAAgB;YAChB,oBAAoB;YACpB,eAAe;SAChB;QACD,eAAe;QACf,cAAc,EAAE;YACd,eAAe;YACf,gBAAgB;YAChB,cAAc;YACd,cAAc;SACf;QACD,UAAU;QACV,eAAe,EAAE,IAAI;QACrB,OAAO;QACP,cAAc,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAI,MAAM;QACzC,eAAe,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO;QAC1C,cAAc,EAAE,KAAK,EAAc,OAAO;QAC1C,SAAS,EAAE,EAAE,EAAsB,WAAW;QAC9C,QAAQ;QACR,gBAAgB,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC;QAClD,QAAQ;QACR,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC;KACpE;IAED,SAAS;IACT,MAAM,EAAE;QACN,OAAO,EAAE,IAAI;QACb,WAAW;QACX,mBAAmB,EAAE,MAAM,EAAQ,cAAc;QACjD,sBAAsB,EAAE,OAAO,EAAI,YAAY;QAC/C,OAAO;QACP,iBAAiB,EAAE,GAAG,EAAa,KAAK;QACxC,oBAAoB,EAAE,IAAI,EAAS,MAAM;QACzC,OAAO;QACP,sBAAsB,EAAE,EAAE;QAC1B,uBAAuB,EAAE,EAAE;QAC3B,OAAO;QACP,kBAAkB,EAAE,OAAO,EAAQ,QAAQ;QAC3C,OAAO;QACP,gBAAgB,EAAE,EAAE,EAAe,MAAM;QACzC,OAAO;QACP,aAAa,EAAE,IAAI;KACpB;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAyB;IAC/D,KAAK,EAAE;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,gCAAgC;QACzC,WAAW,EAAE,MAAM,EAAS,eAAe;QAC3C,gBAAgB,EAAE,IAAI,EAAM,eAAe;QAC3C,aAAa,EAAE,CAAC,EAAY,SAAS;QACrC,aAAa,EAAE,EAAE,EAAW,UAAU;KACvC;IAED,OAAO,EAAE;QACP,OAAO,EAAE,IAAI;QACb,aAAa;QACb,cAAc,EAAE;YACd,gBAAgB;YAChB,mBAAmB;YACnB,eAAe;YACf,YAAY;YACZ,gBAAgB;YAChB,oBAAoB;YACpB,eAAe;YACf,WAAW;YACX,WAAW;YACX,OAAO;YACP,QAAQ;YACR,SAAS;SACV;QACD,eAAe,EAAE,KAAK,EAAM,cAAc;QAC1C,cAAc,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAG,OAAO;QAC1C,eAAe,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ;QAC5C,cAAc,EAAE,KAAK,EAAO,OAAO;QACnC,SAAS,EAAE,GAAG,EAAc,YAAY;QACxC,gBAAgB,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;QACjC,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC;KACjC;IAED,MAAM,EAAE;QACN,OAAO,EAAE,IAAI;QACb,mBAAmB,EAAE,OAAO,EAAO,YAAY;QAC/C,sBAAsB,EAAE,QAAQ,EAAG,aAAa;QAChD,iBAAiB,EAAE,IAAI,EAAY,MAAM;QACzC,oBAAoB,EAAE,KAAK,EAAQ,OAAO;QAC1C,sBAAsB,EAAE,GAAG;QAC3B,uBAAuB,EAAE,EAAE;QAC3B,kBAAkB,EAAE,OAAO,EAAQ,OAAO;QAC1C,gBAAgB,EAAE,EAAE,EAAe,MAAM;QACzC,aAAa,EAAE,KAAK;KACrB;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAyB;IAC3D,KAAK,EAAE;QACL,OAAO,EAAE,KAAK;KACf;IAED,OAAO,EAAE;QACP,OAAO,EAAE,KAAK;KACf;IAED,MAAM,EAAE;QACN,OAAO,EAAE,KAAK;KACf;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,+BAA+B,CAAC,GAAY;IAC1D,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,YAAY;YACf,OAAO,0BAA0B,CAAC;QACpC,KAAK,aAAa;YAChB,OAAO,2BAA2B,CAAC;QACrC,KAAK,SAAS;YACZ,OAAO,uBAAuB,CAAC;QACjC;YACE,OAAO,2BAA2B,CAAC;IACvC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAA0B,EAC1B,MAAqC;IAErC,OAAO;QACL,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE;QACzC,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;QAC/C,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE;KAC7C,CAAC;AACJ,CAAC"}