@zhin.js/agent 0.2.1 → 0.3.1

package/lib/security/index.js

@@ -4,18 +4,16 @@
  * 提供多层安全防护：
  * - 执行策略（exec-policy）：命令执行安全
  * - 文件策略（file-policy）：文件访问安全
- * - 网络策略（network-policy）：网络访问安全
- * - 预算限制（budget-limiter）：资源使用限制
  * - 审计日志（audit-logger）：安全事件追踪
+ * - 网络策略（network-policy）：SSRF 防护、域名白名单、网络命令检测
  * - 沙箱环境（sandbox）：进程隔离和资源限制
- * - 增强沙箱（sandbox-enhanced）：更细粒度的安全控制
- * - 异常检测（anomaly-detection）：行为模式分析和异常检测
+ * - 增强沙箱（sandbox-enhanced）：更细粒度的安全控制（experimental）
+ * - 异常检测（anomaly-detection）：行为模式分析和异常检测（experimental）
  */
 // ── 核心安全策略 ──────────────────────────────────────────────────────
 export * from './file-policy.js';
 export * from './exec-policy.js';
 export * from './network-policy.js';
-export * from './budget-limiter.js';
 export * from './audit-logger.js';
 export * from './comm-message-context.js';
 export * from './owner-approve-always-store.js';
@@ -24,65 +22,4 @@ export * from './sandbox-enhanced.js';
 export * from './anomaly-detection.js';
 export * from './file-role-policy.js';
 export * from './dangerous-tool-policy.js';
-import { initAuditLogger, getAuditLogger, closeAuditLogger } from './audit-logger.js';
-import { initNetworkPolicy, getNetworkPolicy, resetNetworkPolicy } from './network-policy.js';
-import { initBudgetLimiter, getBudgetLimiter, resetBudgetLimiter } from './budget-limiter.js';
-/**
- * 初始化所有安全策略
- */
-export function initSecurityPolicies(config = {}) {
-    const auditLogger = initAuditLogger(config.audit || {});
-    const networkPolicy = initNetworkPolicy(config.network || {});
-    const budgetLimiter = initBudgetLimiter(config.budget || {});
-    return { auditLogger, networkPolicy, budgetLimiter };
-}
-/**
- * 重置所有安全策略（用于测试隔离）
- */
-export function resetSecurityPolicies() {
-    try {
-        closeAuditLogger();
-    }
-    catch { /* ignore */ }
-    try {
-        resetNetworkPolicy();
-    }
-    catch { /* ignore */ }
-    try {
-        resetBudgetLimiter();
-    }
-    catch { /* ignore */ }
-}
-/**
- * 获取安全策略状态
- */
-export function getSecurityPolicyStatus() {
-    try {
-        const audit = getAuditLogger();
-        const network = getNetworkPolicy();
-        const budget = getBudgetLimiter();
-        return {
-            audit: {
-                enabled: audit.getConfig().enabled,
-                eventCount: audit.getStats().totalEvents,
-            },
-            network: {
-                enabled: network.getConfig().enabled,
-                rulesCount: (network.getConfig().allowedDomains?.length || 0) +
-                    (network.getConfig().blockedDomains?.length || 0),
-            },
-            budget: {
-                enabled: budget.getConfig().enabled,
-                activeSessions: 0,
-            },
-        };
-    }
-    catch {
-        return {
-            audit: { enabled: false, eventCount: 0 },
-            network: { enabled: false, rulesCount: 0 },
-            budget: { enabled: false, activeSessions: 0 },
-        };
-    }
-}
 //# sourceMappingURL=index.js.map

package/lib/security/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,mEAAmE;AAEnE,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,4BAA4B,CAAC;AAK3C,OAAO,EAAe,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAEnG,OAAO,EAAiB,iBAAiB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE7G,OAAO,EAAiB,iBAAiB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAQ7G;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAA+B,EAAE;IAKpE,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,iBAAiB,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAE7D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACnC,IAAI,CAAC;QAAC,gBAAgB,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC;QAAC,kBAAkB,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,CAAC;QAAC,kBAAkB,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;AACtD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB;IAKrC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAElC,OAAO;YACL,KAAK,EAAE;gBACL,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,OAAO;gBAClC,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,WAAW;aACzC;YACD,OAAO,EAAE;gBACP,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO;gBACpC,UAAU,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,cAAc,EAAE,MAAM,IAAI,CAAC,CAAC;oBAClD,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,cAAc,EAAE,MAAM,IAAI,CAAC,CAAC;aAC7D;YACD,MAAM,EAAE;gBACN,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,OAAO;gBACnC,cAAc,EAAE,CAAC;aAClB;SACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE;YACxC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE;YAC1C,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE;SAC9C,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,mEAAmE;AAEnE,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,4BAA4B,CAAC"}

package/lib/security/network-policy.d.ts

@@ -1,98 +1,41 @@
 /**
- * 网络访问安全策略
- *
- * 控制 AI Agent 的网络请求，防止：
- * - 访问恶意域名
- * - 数据外泄
- * - SSRF 攻击
- * - 资源滥用
+ * 统一网络安全策略 — SSRF 防护、域名白名单、网络命令检测
  *
+ * 合并了原散落在 web-fetch-tool.ts / sandbox.ts / sandbox-enhanced.ts / exec-policy.ts 中的
+ * 网络安全检查逻辑，作为单一事实来源。
  */
+/** 网络命令模式（当 enableNetwork: false 时阻断） */
+export declare const NETWORK_COMMAND_PATTERNS: ReadonlyArray<RegExp>;
+/** SSRF 防护：检查主机名是否属于内网/私有/危险地址 */
+export declare function isBlockedSsrfHostname(hostname: string): boolean;
+/** 检查主机名是否匹配域名列表（精确匹配或子域名匹配） */
+export declare function hostnameMatchesList(hostname: string, domains: string[]): boolean;
+/** 从命令中提取所有 URL（小写） */
+export declare function extractUrlsFromCommand(command: string): string[];
+/** 从命令中提取第一个 URL（原始大小写） */
+export declare function extractFirstUrlFromCommand(command: string): string | undefined;
+/** 检测 curl 数据外泄模式（curl -d @file） */
+export declare function isDataExfiltrationAttempt(command: string): boolean;
 export interface NetworkPolicyConfig {
-    /** 是否启用网络策略 */
-    enabled: boolean;
-    /** 域名白名单（允许访问） */
+    enableNetwork?: boolean;
     allowedDomains?: string[];
-    /** 域名黑名单（禁止访问） */
-    blockedDomains?: string[];
-    /** IP 黑名单 */
-    blockedIPs?: string[];
-    /** 禁止私有 IP */
-    blockPrivateIPs?: boolean;
-    /** 最大请求大小（字节） */
-    maxRequestSize?: number;
-    /** 最大响应大小（字节） */
-    maxResponseSize?: number;
-    /** 请求超时（毫秒） */
-    requestTimeout?: number;
-    /** 每分钟最大请求数 */
-    rateLimit?: number;
-    /** 禁止的协议 */
-    blockedProtocols?: string[];
-    /** 禁止的端口 */
-    blockedPorts?: number[];
-}
-export interface NetworkPolicyResult {
-    allowed: boolean;
-    reason?: string;
-    /** 脱敏后的 URL */
-    sanitizedUrl?: string;
-}
-export declare class NetworkPolicy {
-    private config;
-    private rateLimiter;
-    private cleanupTimer?;
-    constructor(config?: Partial<NetworkPolicyConfig>);
-    /**
-     * 检查 URL 是否允许访问
-     */
-    checkUrl(url: string, userId?: string): NetworkPolicyResult;
-    /**
-     * 检查域名是否在黑名单中
-     */
-    private isBlockedDomain;
-    /**
-     * 检查域名是否在白名单中
-     */
-    private isAllowedDomain;
-    /**
-     * 检查是否为可疑域名
-     */
-    private isSuspiciousDomain;
-    /**
-     * 检查是否为私有 IP
-     */
-    private isPrivateIP;
-    /**
-     * 获取默认端口
-     */
-    private getDefaultPort;
-    /**
-     * 脱敏域名
-     */
-    private maskDomain;
-    /**
-     * 更新配置
-     */
-    updateConfig(config: Partial<NetworkPolicyConfig>): void;
-    /**
-     * 获取配置（脱敏）
-     */
-    getConfig(): NetworkPolicyConfig;
-    dispose(): void;
 }
 /**
- * 获取全局网络策略实例
+ * 检查网络命令访问权限（sandbox 层）
+ * - enableNetwork: false → 阻断所有网络命令
+ * - enableNetwork: true + allowedDomains → 仅允许指定域名
  */
-export declare function getNetworkPolicy(): NetworkPolicy;
-/**
- * 初始化网络策略
- */
-export declare function initNetworkPolicy(config: Partial<NetworkPolicyConfig>): NetworkPolicy;
-/** 重置全局网络策略（用于测试隔离） */
-export declare function resetNetworkPolicy(): void;
+export declare function checkNetworkCommandAccess(command: string, config: NetworkPolicyConfig): {
+    allowed: boolean;
+    reason?: string;
+};
 /**
- * 检查 URL 是否允许访问
+ * 校验 exec-policy 允许的网络命令（curl/wget）的 URL 安全性
+ * - 阻断数据外泄模式（curl -d @file）
+ * - 阻断 SSRF 目标（内网/元数据端点）
  */
-export declare function checkNetworkAccess(url: string, userId?: string): NetworkPolicyResult;
+export declare function validateNetworkCommandUrl(command: string): {
+    safe: boolean;
+    reason?: string;
+};
 //# sourceMappingURL=network-policy.d.ts.map

package/lib/security/network-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"network-policy.d.ts","sourceRoot":"","sources":["../../src/security/network-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,MAAM,WAAW,mBAAmB;IAClC,eAAe;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB;IAClB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,kBAAkB;IAClB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa;IACb,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc;IACd,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,iBAAiB;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY;IACZ,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,YAAY;IACZ,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAkGD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAID,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,YAAY,CAAC,CAAiC;gBAE1C,MAAM,GAAE,OAAO,CAAC,mBAAmB,CAAM;IAWrD;;OAEG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,mBAAmB;IAuF3D;;OAEG;IACH,OAAO,CAAC,eAAe;IAavB;;OAEG;IACH,OAAO,CAAC,eAAe;IAcvB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAI1B;;OAEG;IACH,OAAO,CAAC,WAAW;IAUnB;;OAEG;IACH,OAAO,CAAC,cAAc;IAUtB;;OAEG;IACH,OAAO,CAAC,UAAU;IASlB;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,IAAI;IAIxD;;OAEG;IACH,SAAS,IAAI,mBAAmB;IAIhC,OAAO,IAAI,IAAI;CAMhB;AAMD;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,CAKhD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,aAAa,CAGrF;AAED,uBAAuB;AACvB,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,mBAAmB,CAEpF"}
+{"version":3,"file":"network-policy.d.ts","sourceRoot":"","sources":["../../src/security/network-policy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,yCAAyC;AACzC,eAAO,MAAM,wBAAwB,EAAE,aAAa,CAAC,MAAM,CAa1D,CAAC;AAIF,kCAAkC;AAClC,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAyB/D;AAID,gCAAgC;AAChC,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAMhF;AAMD,uBAAuB;AACvB,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAEhE;AAED,2BAA2B;AAC3B,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG9E;AAID,oCAAoC;AACpC,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAGlE;AAID,MAAM,WAAW,mBAAmB;IAClC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,mBAAmB,GAC1B;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA8CvC;AAID;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA0B7F"}

package/lib/security/network-policy.js

@@ -1,305 +1,158 @@
 /**
- * 网络访问安全策略
- *
- * 控制 AI Agent 的网络请求，防止：
- * - 访问恶意域名
- * - 数据外泄
- * - SSRF 攻击
- * - 资源滥用
+ * 统一网络安全策略 — SSRF 防护、域名白名单、网络命令检测
  *
+ * 合并了原散落在 web-fetch-tool.ts / sandbox.ts / sandbox-enhanced.ts / exec-policy.ts 中的
+ * 网络安全检查逻辑，作为单一事实来源。
  */
-import { URL } from 'node:url';
-const DEFAULT_CONFIG = {
-    enabled: true,
-    blockPrivateIPs: true,
-    maxRequestSize: 10 * 1024 * 1024, // 10 MB
-    maxResponseSize: 50 * 1024 * 1024, // 50 MB
-    requestTimeout: 30000, // 30 秒
-    rateLimit: 100, // 每分钟 100 次
-    blockedProtocols: ['file', 'ftp', 'gopher'],
-    blockedPorts: [22, 23, 25, 465, 587, 1080, 3389, 5900],
-};
-// ── 私有 IP 检测 ──────────────────────────────────────────────────────
-const PRIVATE_IP_PATTERNS = [
-    /^10\./, // 10.0.0.0/8
-    /^172\.(1[6-9]|2[0-9]|3[0-1])\./, // 172.16.0.0/12
-    /^192\.168\./, // 192.168.0.0/16
-    /^127\./, // 127.0.0.0/8 (localhost)
-    /^0\./, // 0.0.0.0
-    /^::1$/, // IPv6 localhost
-    /^fc00:/, // IPv6 private
-    /^fd[0-9a-f]{2}:/, // IPv6 private
-    /^fe80:/, // IPv6 link-local
+// ── 网络命令模式 ──────────────────────────────────────────────────────
+/** 网络命令模式（当 enableNetwork: false 时阻断） */
+export const NETWORK_COMMAND_PATTERNS = [
+    /\bcurl\s+/,
+    /\bwget\s+/,
+    /\bnc\s+/,
+    /\bnetcat\s+/,
+    /\bssh\s+/,
+    /\bscp\s+/,
+    /\brsync\s+/,
+    /\bping\s+/,
+    /\btraceroute\s+/,
+    /\bnmap\s+/,
+    /\bhttp\s+/,
+    /\bhttps\s+/,
 ];
+// ── SSRF 防护 ─────────────────────────────────────────────────────────
+/** SSRF 防护：检查主机名是否属于内网/私有/危险地址 */
+export function isBlockedSsrfHostname(hostname) {
+    const h = hostname.toLowerCase();
+    return (
+    // Localhost
+    h === 'localhost' ||
+        h === '127.0.0.1' ||
+        h === '::1' ||
+        h === '0.0.0.0' ||
+        h.endsWith('.local') ||
+        // IPv4 private ranges
+        h.startsWith('10.') ||
+        h.startsWith('192.168.') ||
+        /^172\.(1[6-9]|2\d|3[01])\./.test(h) ||
+        // Cloud metadata endpoints (AWS/GCP/Azure)
+        h === '169.254.169.254' ||
+        h === 'metadata.google.internal' ||
+        h === 'metadata.google.com' ||
+        // IPv6 private/link-local ranges
+        /^fd[0-9a-f]{2}:/i.test(h) ||
+        /^fe80:/i.test(h) ||
+        // System-level domain blocklist
+        h.endsWith('.onion') ||
+        h.endsWith('.internal') ||
+        h.endsWith('.localhost'));
+}
+// ── 域名匹配 ──────────────────────────────────────────────────────────
+/** 检查主机名是否匹配域名列表（精确匹配或子域名匹配） */
+export function hostnameMatchesList(hostname, domains) {
+    const h = hostname.toLowerCase();
+    return domains.some(domain => {
+        const d = domain.toLowerCase().replace(/^\./, '');
+        return h === d || h.endsWith('.' + d);
+    });
+}
+// ── URL 提取 ───────────────────────────────────────────────────────────
+const URL_PATTERN = /https?:\/\/[^\s'"`&|;)}\]]+/gi;
+/** 从命令中提取所有 URL（小写） */
+export function extractUrlsFromCommand(command) {
+    return (command.match(URL_PATTERN) || []).map(u => u.toLowerCase());
+}
+/** 从命令中提取第一个 URL（原始大小写） */
+export function extractFirstUrlFromCommand(command) {
+    const match = command.match(/https?:\/\/[^\s'"`&|;)}\]]+/i);
+    return match ? match[0] : undefined;
+}
+// ── 数据外泄检测 ───────────────────────────────────────────────────────
+/** 检测 curl 数据外泄模式（curl -d @file） */
+export function isDataExfiltrationAttempt(command) {
+    const lower = command.toLowerCase();
+    return /\bcurl\b/.test(lower) && /-d\s+@|--data-binary\s+@/.test(lower);
+}
 /**
- * 检查 IP 是否为私有地址
+ * 检查网络命令访问权限（sandbox 层）
+ * - enableNetwork: false → 阻断所有网络命令
+ * - enableNetwork: true + allowedDomains → 仅允许指定域名
  */
-function isPrivateIP(ip) {
-    return PRIVATE_IP_PATTERNS.some(pattern => pattern.test(ip));
-}
-// ── 常见危险域名模式 ──────────────────────────────────────────────────
-const SUSPICIOUS_DOMAIN_PATTERNS = [
-    /\.tk$/i, // 免费域名，常用于钓鱼
-    /\.ml$/i,
-    /\.ga$/i,
-    /\.cf$/i,
-    /\.gq$/i,
-    /pastebin\.com/i, // 代码分享，可能含恶意内容
-    /hastebin\.com/i,
-    /ngrok\.io/i, // 隧道服务
-    /serveo\.net/i,
-    /localtunnel\.me/i,
-];
-// ── 速率限制器 ────────────────────────────────────────────────────────
-class RateLimiter {
-    requests = new Map();
-    /**
-     * 检查是否超过速率限制
-     * @returns true 表示超过限制
-     */
-    isLimited(key, limit, windowMs = 60000) {
-        const now = Date.now();
-        const windowStart = now - windowMs;
-        // 获取或初始化请求记录
-        let timestamps = this.requests.get(key) || [];
-        // 清理过期记录
-        timestamps = timestamps.filter(t => t > windowStart);
-        // 检查是否超过限制
-        if (timestamps.length >= limit) {
-            return true;
-        }
-        // 记录本次请求
-        timestamps.push(now);
-        this.requests.set(key, timestamps);
-        return false;
-    }
-    /**
-     * 清理过期记录
-     */
-    cleanup() {
-        const now = Date.now();
-        for (const [key, timestamps] of this.requests.entries()) {
-            const valid = timestamps.filter(t => t > now - 120000); // 保留 2 分钟内的记录
-            if (valid.length === 0) {
-                this.requests.delete(key);
-            }
-            else {
-                this.requests.set(key, valid);
+export function checkNetworkCommandAccess(command, config) {
+    // 网络未启用时，阻断所有网络命令
+    if (!config.enableNetwork) {
+        for (const pattern of NETWORK_COMMAND_PATTERNS) {
+            if (pattern.test(command)) {
+                const cmd = command.match(pattern)?.[0]?.trim() || 'network command';
+                return {
+                    allowed: false,
+                    reason: `沙箱网络未启用，禁止执行网络命令: ${cmd}（配置 enableNetwork: true 以允许）`,
+                };
             }
         }
+        return { allowed: true };
     }
-}
-// ── 网络策略类 ────────────────────────────────────────────────────────
-export class NetworkPolicy {
-    config;
-    rateLimiter;
-    cleanupTimer;
-    constructor(config = {}) {
-        this.config = { ...DEFAULT_CONFIG, ...config };
-        this.rateLimiter = new RateLimiter();
-        // 定期清理速率限制器
-        this.cleanupTimer = setInterval(() => this.rateLimiter.cleanup(), 60000);
-        if (this.cleanupTimer && typeof this.cleanupTimer === 'object' && 'unref' in this.cleanupTimer) {
-            this.cleanupTimer.unref();
-        }
-    }
-    /**
-     * 检查 URL 是否允许访问
-     */
-    checkUrl(url, userId) {
-        if (!this.config.enabled) {
-            return { allowed: true };
-        }
-        let parsed;
-        try {
-            parsed = new URL(url);
-        }
-        catch {
-            return { allowed: false, reason: '无效的 URL 格式' };
-        }
-        // 1. 协议检查
-        if (this.config.blockedProtocols?.includes(parsed.protocol.replace(':', ''))) {
-            return {
-                allowed: false,
-                reason: `禁止的协议: ${parsed.protocol}`,
-                sanitizedUrl: `${parsed.protocol}//***`,
-            };
-        }
-        // 2. 端口检查
-        const port = parsed.port ? parseInt(parsed.port, 10) : this.getDefaultPort(parsed.protocol);
-        if (port && this.config.blockedPorts?.includes(port)) {
-            return {
-                allowed: false,
-                reason: `禁止的端口: ${port}`,
-                sanitizedUrl: `${parsed.protocol}//${parsed.hostname}:***`,
-            };
-        }
-        // 3. 私有 IP 检查（在白名单检查之前）
-        const hostname = parsed.hostname.toLowerCase();
-        if (this.config.blockPrivateIPs && this.isPrivateIP(hostname)) {
-            return {
-                allowed: false,
-                reason: '禁止访问私有 IP 地址',
-                sanitizedUrl: `${parsed.protocol}//***`,
-            };
-        }
-        // 4. 可疑域名检查（在白名单检查之前）
-        if (this.isSuspiciousDomain(hostname)) {
-            return {
-                allowed: false,
-                reason: `可疑域名: ${this.maskDomain(hostname)}`,
-                sanitizedUrl: `${parsed.protocol}//${this.maskDomain(hostname)}`,
-            };
-        }
-        // 5. 域名黑名单检查
-        if (this.isBlockedDomain(hostname)) {
-            return {
-                allowed: false,
-                reason: `域名在黑名单中: ${this.maskDomain(hostname)}`,
-                sanitizedUrl: `${parsed.protocol}//${this.maskDomain(hostname)}`,
-            };
-        }
-        // 6. 域名白名单检查
-        if (this.config.allowedDomains && this.config.allowedDomains.length > 0) {
-            if (!this.isAllowedDomain(hostname)) {
+    // 网络已启用但有域名白名单时，校验 URL
+    if (config.allowedDomains && config.allowedDomains.length > 0) {
+        const urls = extractUrlsFromCommand(command);
+        if (urls.length === 0) {
+            // 网络命令必须包含可校验的 URL
+            const hasNetworkCommand = NETWORK_COMMAND_PATTERNS.some(pattern => pattern.test(command));
+            if (hasNetworkCommand) {
                 return {
                     allowed: false,
-                    reason: `域名不在白名单中: ${this.maskDomain(hostname)}`,
-                    sanitizedUrl: `${parsed.protocol}//${this.maskDomain(hostname)}`,
+                    reason: `启用 allowedDomains 时，网络命令必须包含可校验的 URL（如 http://example.com）`,
                 };
             }
+            return { allowed: true };
         }
-        // 7. 速率限制检查
-        const rateLimitKey = userId || hostname;
-        if (this.config.rateLimit && this.rateLimiter.isLimited(rateLimitKey, this.config.rateLimit)) {
-            return {
-                allowed: false,
-                reason: '请求过于频繁，请稍后再试',
-                sanitizedUrl: `${parsed.protocol}//${this.maskDomain(hostname)}`,
-            };
-        }
-        // 通过所有检查
-        return {
-            allowed: true,
-            sanitizedUrl: `${parsed.protocol}//${this.maskDomain(hostname)}${parsed.pathname}`,
-        };
-    }
-    /**
-     * 检查域名是否在黑名单中
-     */
-    isBlockedDomain(domain) {
-        if (!this.config.blockedDomains)
-            return false;
-        return this.config.blockedDomains.some(blocked => {
-            // 支持通配符匹配
-            if (blocked.startsWith('*.')) {
-                const suffix = blocked.slice(1); // *.example.com -> .example.com
-                return domain.endsWith(suffix) || domain === suffix.slice(1);
+        for (const url of urls) {
+            try {
+                const hostname = new URL(url).hostname;
+                if (!hostnameMatchesList(hostname, config.allowedDomains)) {
+                    return {
+                        allowed: false,
+                        reason: `域名 ${hostname} 不在允许列表中（允许: ${config.allowedDomains.join(', ')}）`,
+                    };
+                }
             }
-            return domain === blocked || domain.endsWith(`.${blocked}`);
-        });
-    }
-    /**
-     * 检查域名是否在白名单中
-     */
-    isAllowedDomain(domain) {
-        if (!this.config.allowedDomains || this.config.allowedDomains.length === 0) {
-            return true; // 没有白名单则允许所有
-        }
-        return this.config.allowedDomains.some(allowed => {
-            if (allowed.startsWith('*.')) {
-                const suffix = allowed.slice(1);
-                return domain.endsWith(suffix) || domain === suffix.slice(1);
+            catch {
+                // URL 解析失败，放行（可能是相对路径或其他格式）
             }
-            return domain === allowed || domain.endsWith(`.${allowed}`);
-        });
-    }
-    /**
-     * 检查是否为可疑域名
-     */
-    isSuspiciousDomain(domain) {
-        return SUSPICIOUS_DOMAIN_PATTERNS.some(pattern => pattern.test(domain));
-    }
-    /**
-     * 检查是否为私有 IP
-     */
-    isPrivateIP(hostname) {
-        // 简单的 IP 格式检查
-        const ipPattern = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
-        if (!ipPattern.test(hostname)) {
-            // 可能是域名，需要解析（这里简化处理）
-            return false;
         }
-        return isPrivateIP(hostname);
     }
-    /**
-     * 获取默认端口
-     */
-    getDefaultPort(protocol) {
-        const ports = {
-            'http:': 80,
-            'https:': 443,
-            'ftp:': 21,
-            'ssh:': 22,
+    return { allowed: true };
+}
+// ── exec-policy 层网络命令 URL 校验 ────────────────────────────────────
+/**
+ * 校验 exec-policy 允许的网络命令（curl/wget）的 URL 安全性
+ * - 阻断数据外泄模式（curl -d @file）
+ * - 阻断 SSRF 目标（内网/元数据端点）
+ */
+export function validateNetworkCommandUrl(command) {
+    // 数据外泄检测
+    if (isDataExfiltrationAttempt(command)) {
+        return {
+            safe: false,
+            reason: '检测到潜在数据外泄模式（curl -d @file）。如需上传文件，请使用具体的文件路径。',
         };
-        return ports[protocol] || null;
     }
-    /**
-     * 脱敏域名
-     */
-    maskDomain(domain) {
-        const parts = domain.split('.');
-        if (parts.length <= 2) {
-            return domain; // 顶级域名不脱敏
+    // SSRF 检测
+    const url = extractFirstUrlFromCommand(command);
+    if (url) {
+        try {
+            const hostname = new URL(url).hostname;
+            if (isBlockedSsrfHostname(hostname)) {
+                return {
+                    safe: false,
+                    reason: `URL 目标 ${hostname} 属于内网/私有/危险地址，已被 SSRF 防护拦截。`,
+                };
+            }
         }
-        // 保留顶级域名，中间部分脱敏
-        return `***.${parts.slice(-2).join('.')}`;
-    }
-    /**
-     * 更新配置
-     */
-    updateConfig(config) {
-        this.config = { ...this.config, ...config };
-    }
-    /**
-     * 获取配置（脱敏）
-     */
-    getConfig() {
-        return { ...this.config };
-    }
-    dispose() {
-        if (this.cleanupTimer) {
-            clearInterval(this.cleanupTimer);
-            this.cleanupTimer = undefined;
+        catch {
+            // URL 解析失败，不拦截
         }
     }
-}
-// ── 全局网络策略实例 ──────────────────────────────────────────────────
-let globalNetworkPolicy = null;
-/**
- * 获取全局网络策略实例
- */
-export function getNetworkPolicy() {
-    if (!globalNetworkPolicy) {
-        globalNetworkPolicy = new NetworkPolicy();
-    }
-    return globalNetworkPolicy;
-}
-/**
- * 初始化网络策略
- */
-export function initNetworkPolicy(config) {
-    globalNetworkPolicy = new NetworkPolicy(config);
-    return globalNetworkPolicy;
-}
-/** 重置全局网络策略（用于测试隔离） */
-export function resetNetworkPolicy() {
-    globalNetworkPolicy = null;
-}
-/**
- * 检查 URL 是否允许访问
- */
-export function checkNetworkAccess(url, userId) {
-    return getNetworkPolicy().checkUrl(url, userId);
+    return { safe: true };
 }
 //# sourceMappingURL=network-policy.js.map