ai-helper-agent 2.3.1 → 2.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-helper-agent",
-  "version": "2.3.1",
+  "version": "2.4.0",
   "description": "AI Helper Agent - Local file access and system command execution proxy for Chrome extension / AI Helper 代理服务，为 Chrome 扩展提供本地文件读写和系统命令执行",
   "type": "module",
   "main": "./src/server.js",

package/src/config.js

@@ -20,8 +20,9 @@ const DEFAULTS = {
   pairCodeTTL: 30,
   commandTimeout: 300000,
   fileMaxSize: 50 * 1024 * 1024,
-  // RAG URL 导入内网访问策略：allowedPrivateHosts 非空时仅放行白名单命中（总开关不生效）；
-  // 为空时由 allowPrivateNetwork 决定；缺省均关闭（默认拒绝内网），公网访问不受影响
+  // RAG URL 导入内网访问策略（B2 AND 闸，与扩展侧 network-scope.js 同序）：
+  // allowPrivateNetwork 开启 **且** allowedPrivateHosts 命中才放行内网；关闸时白名单不生效，
+  // 开闸但白名单为空仍拒绝；缺省均关闭（默认拒绝内网），公网访问不受影响
   ragUrlIngest: { allowPrivateNetwork: false, allowedPrivateHosts: [] },
   // 长期记忆语义召回（hybrid recall）的 embedding 配置：缺省关闭 → recall 只走关键词通道（Tier A），
   // 不引入任何新的默认网络调用。mode: 'openai-compat'（远端，零依赖）| 'local'（本地模型，需 RAG 依赖）。

package/src/executor.js

@@ -162,6 +162,29 @@ function generateExecId() {
   return crypto.randomBytes(8).toString('hex');
 }
 
+// ===== 超时策略（决策权威在 Agent 端：不受插件端 SW 生命周期影响） =====
+export const MAX_TIMEOUT_EXTENSIONS = 5;
+export const TOTAL_BUDGET_CAP_MS = 600000; // 与插件端 toolTimeout 上限对齐
+
+/**
+ * 命令总超时到期时的裁决纯函数（无副作用，便于单测）
+ * @param {{ outputInPeriod: boolean, extensions: number, elapsedMs: number, baseTimeout: number }} state
+ *   outputInPeriod: 本预算期内是否收到过 stdout/stderr 输出（输出流 = 心跳）
+ * @param {number} [capMs] 总预算封顶
+ * @param {number} [maxExtensions] 最大延长次数
+ * @returns {{ action: 'extend'|'kill', extensions: number, nextTimeoutMs?: number }}
+ */
+export function decideTimeoutAction(state, capMs = TOTAL_BUDGET_CAP_MS, maxExtensions = MAX_TIMEOUT_EXTENSIONS) {
+  const { outputInPeriod, extensions, elapsedMs, baseTimeout } = state;
+  if (extensions >= maxExtensions) return { action: 'kill', extensions };
+  // 本预算期完全无输出 → 视为挂起/静默失败，到点即杀，不再放大等待窗口
+  if (!outputInPeriod) return { action: 'kill', extensions };
+  const currentBudget = Math.min(baseTimeout * (1 + extensions), capMs);
+  const nextBudget = Math.min(baseTimeout * (2 + extensions), capMs);
+  if (nextBudget <= currentBudget) return { action: 'kill', extensions }; // 已触及总封顶
+  return { action: 'extend', extensions: extensions + 1, nextTimeoutMs: nextBudget - elapsedMs };
+}
+
 /**
  * 执行命令并通过 WebSocket 流式输出
  * @param {string} command - 完整命令字符串
@@ -169,13 +192,18 @@ function generateExecId() {
  * @param {Object} wsClient - 单个 WebSocket 客户端（用于流式输出）
  * @param {Function} onComplete - 完成回调 ({ execId, exitCode, killed, stdout?, stderr? })
  * @param {boolean} [collectOutput=false] - 是否收集完整 stdout/stderr 到内存
+ * @param {{ timeoutMs?: number }} [execOpts] - 受管模式协商：调用方显式传 timeoutMs 即接管超时权威
  * @returns {string} execId
  */
-function executeCommand(command, cwd, wsClient, onComplete, collectOutput = false) {
+function executeCommand(command, cwd, wsClient, onComplete, collectOutput = false, execOpts = {}) {
   const config = loadConfig();
   const workdir = cwd || config.workdir;
   const execId = generateExecId();
-  const timeout = config.commandTimeout || 300000;
+  // 协议协商：显式 timeoutMs → 受管模式（定时器与 WS 连接数解耦，延长由策略函数裁决）；
+  // 未传 → 旧语义（commandTimeout + 断连清定时器），保证新 agent × 旧插件行为不变
+  const requestedTimeout = Number(execOpts.timeoutMs) > 0 ? Math.round(Number(execOpts.timeoutMs)) : null;
+  const timeout = requestedTimeout || config.commandTimeout || 300000;
+  const managed = requestedTimeout != null;
 
   const { shell, args } = getShellForExec();
   // detached 的取舍（按平台 + shell 类型）：
@@ -209,14 +237,42 @@ function executeCommand(command, cwd, wsClient, onComplete, collectOutput = fals
   // 存储到 entry 中供 clearTimers 读取
   // stdoutBuf/stderrBuf 始终收集，用于回放给延迟连接的 WS 客户端
   // command/startTime 用于状态详情面板展示运行中进程
-  const entry = { process: proc, wsClients, stdoutBuf: '', stderrBuf: '', truncStdout: false, truncStderr: false, command, startTime: Date.now() };
+  const entry = {
+    process: proc, wsClients, stdoutBuf: '', stderrBuf: '',
+    truncStdout: false, truncStderr: false, command, startTime: Date.now(),
+    baseTimeout: timeout, managed, extensions: 0, outputInPeriod: false,
+    detached: false, timedOut: false,
+  };
   runningProcesses.set(execId, entry);
 
-  // 超时控制
-  entry.timeoutId = setTimeout(() => {
-    killed = true;
-    killProcess(execId);
-  }, timeout);
+  // 超时控制：受管模式到期先由策略函数裁决（期内有输出才延长，静默即杀）；旧模式到期直接杀
+  function armTimeout(ms) {
+    entry.timeoutId = setTimeout(() => {
+      entry.timeoutId = null;
+      if (!entry.managed) {
+        killed = true;
+        entry.timedOut = true;
+        killProcess(execId);
+        return;
+      }
+      const d = decideTimeoutAction({
+        outputInPeriod: entry.outputInPeriod,
+        extensions: entry.extensions,
+        elapsedMs: Date.now() - entry.startTime,
+        baseTimeout: entry.baseTimeout,
+      });
+      if (d.action === 'extend') {
+        entry.extensions = d.extensions;
+        entry.outputInPeriod = false;
+        armTimeout(d.nextTimeoutMs);
+      } else {
+        killed = true;
+        entry.timedOut = true;
+        killProcess(execId);
+      }
+    }, ms);
+  }
+  armTimeout(timeout);
 
   // 广播消息给所有连接的 WS 客户端
   function broadcast(data) {
@@ -241,6 +297,7 @@ function executeCommand(command, cwd, wsClient, onComplete, collectOutput = fals
   // stdout 流式输出
   proc.stdout.on('data', (chunk) => {
     const str = chunk.toString();
+    entry.outputInPeriod = true;
     if (collectOutput) stdoutCollected += str;
     const truncState = { truncated: entry.truncStdout };
     entry.stdoutBuf = appendWithLimit(entry.stdoutBuf, str, truncState);
@@ -254,6 +311,7 @@ function executeCommand(command, cwd, wsClient, onComplete, collectOutput = fals
   // stderr 流式输出
   proc.stderr.on('data', (chunk) => {
     const str = chunk.toString();
+    entry.outputInPeriod = true;
     if (collectOutput) stderrCollected += str;
     const truncState = { truncated: entry.truncStderr };
     entry.stderrBuf = appendWithLimit(entry.stderrBuf, str, truncState);
@@ -270,7 +328,7 @@ function executeCommand(command, cwd, wsClient, onComplete, collectOutput = fals
     finished = true;
     clearTimers();
     const finalExitCode = typeof exitCode === 'number' ? exitCode : -1;
-    broadcast({ type: 'exit', exitCode: finalExitCode, execId, killed });
+    broadcast({ type: 'exit', exitCode: finalExitCode, execId, killed, timedOut: entry.timedOut });
     // 移入已完成缓存，解决竞态条件：延迟连接的 WS 客户端可回放输出
     const cleanupTimeout = setTimeout(() => {
       completedProcesses.delete(execId);
@@ -280,6 +338,7 @@ function executeCommand(command, cwd, wsClient, onComplete, collectOutput = fals
       stderrBuf: entry.stderrBuf,
       exitCode: finalExitCode,
       killed,
+      timedOut: entry.timedOut,
       cleanupTimeout
     });
     runningProcesses.delete(execId);
@@ -330,10 +389,11 @@ function executeCommand(command, cwd, wsClient, onComplete, collectOutput = fals
  * 同步执行命令（阻塞等待完成，返回完整输出）
  * @returns {Promise<{execId, exitCode, stdout, stderr, killed, error?}>}
  */
-function executeCommandSync(command, cwd) {
+function executeCommandSync(command, cwd, timeoutMs) {
   return new Promise((resolve) => {
     const config = loadConfig();
-    const timeout = config.commandTimeout || 300000;
+    const requestedTimeout = Number(timeoutMs) > 0 ? Math.round(Number(timeoutMs)) : null;
+    const timeout = requestedTimeout || config.commandTimeout || 300000;
 
     let resolved = false;
     let syncTimeoutId = null;
@@ -344,14 +404,19 @@ function executeCommandSync(command, cwd) {
         resolved = true;
         resolve(result);
       }
-    }, true);
+    }, true, { timeoutMs });
 
-    // 超时兜底（超时后额外 5s 用于 kill 完成）
+    // 兜底（超时后额外 5s 用于 kill 完成）：内层策略失效时到点杀进程并回收已收集输出，不再返回空串
     syncTimeoutId = setTimeout(() => {
       if (!resolved) {
         resolved = true;
         killProcess(execId);
-        resolve({ execId, exitCode: -1, killed: true, stdout: '', stderr: '', error: translate(currentLang, 'error.commandTimeout') });
+        const e = runningProcesses.get(execId);
+        resolve({
+          execId, exitCode: -1, killed: true,
+          stdout: e ? e.stdoutBuf : '', stderr: e ? e.stderrBuf : '',
+          error: translate(currentLang, 'error.commandTimeout'),
+        });
       }
     }, timeout + 5000);
   });
@@ -379,7 +444,7 @@ function addWsClient(execId, wsClient) {
     if (completed.error) {
       wsClient.send(JSON.stringify({ type: 'error', error: completed.error, execId }));
     }
-    wsClient.send(JSON.stringify({ type: 'exit', exitCode: completed.exitCode, execId, killed: completed.killed }));
+    wsClient.send(JSON.stringify({ type: 'exit', exitCode: completed.exitCode, execId, killed: completed.killed, timedOut: completed.timedOut === true }));
     clearTimeout(completed.cleanupTimeout);
     completedProcesses.delete(execId);
     return true;
@@ -397,8 +462,10 @@ function disconnectWsClient(execId, wsClient) {
 
   entry.wsClients.delete(wsClient);
 
-  // 所有客户端都断开了 → 取消超时，进程继续运行
-  if (entry.wsClients.size === 0) {
+  // 旧语义：所有客户端断开 → 取消超时，进程自由运行（挂起型服务依赖此行为）。
+  // 受管模式：断开可能只是插件端 SW 被 Chrome 杀掉/网络闪断，绝不可解除超时权威，
+  // 仅显式 detach（entry.detached）才豁免——连接状态不再反推用户意图。
+  if (entry.wsClients.size === 0 && (!entry.managed || entry.detached)) {
     if (entry.timeoutId) {
       clearTimeout(entry.timeoutId);
       entry.timeoutId = null;
@@ -411,6 +478,20 @@ function disconnectWsClient(execId, wsClient) {
   return true;
 }
 
+/**
+ * 显式声明 daemon 化：取消超时定时器，进程继续运行（插件端空闲挂起分支调用）
+ */
+function detachProcess(execId) {
+  const entry = runningProcesses.get(execId);
+  if (!entry) return false;
+  entry.detached = true;
+  if (entry.timeoutId) {
+    clearTimeout(entry.timeoutId);
+    entry.timeoutId = null;
+  }
+  return true;
+}
+
 /**
  * 停止正在运行的命令（跨平台兼容，递归终止全部子进程）
  * - macOS/Linux: SIGTERM to process group（-pid）→ 5s → SIGKILL to process group
@@ -486,4 +567,4 @@ function getRunningProcesses() {
   return list;
 }
 
-export { executeCommand, executeCommandSync, addWsClient, disconnectWsClient, killProcess, getRunningProcesses, pickShell };
+export { executeCommand, executeCommandSync, addWsClient, disconnectWsClient, killProcess, detachProcess, getRunningProcesses, pickShell };

package/src/locales/en.json

@@ -107,7 +107,7 @@
     "err_pathNotAllowed": "File path not allowed: {reason}",
     "err_invalidUrl": "Invalid URL (http/https required)",
     "err_urlFetchFailed": "URL fetch failed: HTTP {status}",
-    "err_urlPrivateBlocked": "Access to private network address blocked: {host} (configure the allowlist or enable the private-network switch on the agent)",
+    "err_urlPrivateBlocked": "Access to private network address blocked: {host} (requires the private-network switch enabled AND the host in the allowlist; either alone is not sufficient)",
     "err_urlTooLarge": "URL response exceeds the size limit ({limit})",
     "err_urlTooManyRedirects": "Too many URL redirects (limit: {max})",
     "err_contentTooLarge": "Import content exceeds the size limit ({limit})",
@@ -168,6 +168,7 @@
     "commandInvalid": "Invalid command",
     "commandBlocked": "High-risk command blocked: \"{command}\"",
     "cmdSudo": "Command requires administrator privileges (sudo)",
+    "cmdDoas": "Command requires privilege escalation (doas/runas)",
     "cmdNpmGlobal": "Global npm package installation",
     "cmdPip": "pip install/uninstall package",
     "cmdChmod777": "Recursively change permissions to 777",
@@ -186,7 +187,18 @@
     "cmdReg": "Modify registry (reg)",
     "cmdNet": "User/group management (net)",
     "cmdSc": "Service management (sc)",
-    "cmdTaskkillF": "Force kill process (taskkill /f)"
+    "cmdTaskkillF": "Force kill process (taskkill /f)",
+    "cmdPsRemoveItem": "PowerShell recursive/forced delete (Remove-Item)",
+    "cmdPsEncoded": "Execute base64-encoded PowerShell script",
+    "cmdCmdSubstitution": "Command contains command substitution ($( ) or backticks)",
+    "cmdDdWrite": "Write raw file content via dd",
+    "cmdShred": "Destroy file irrecoverably (shred)",
+    "cmdTruncate": "Truncate file content to zero (truncate)",
+    "cmdChmodDestroy": "Change permissions making file unusable (chmod 000/777/a-rwx)",
+    "cmdChown": "Change file owner (chown)",
+    "cmdNetwork": "Initiate outbound network connection",
+    "cmdKillProcess": "Terminate processes (kill/pkill/killall)",
+    "cmdSystemService": "Modify system services / cron / kernel parameters"
   },
   "trash": {
     "moveFailed": "Move to trash failed: {message}",
@@ -305,6 +317,8 @@
     "readFailed": "Failed to read memory file: {error}",
     "writeFailed": "Failed to write memory file: {error}",
     "parseFailed": "Memory file parse failed: {error}",
+    "injectionPatternBlocked": "Memory content appears to contain prompt-injection instructions (e.g. ignore previous instructions / override system prompt); write rejected",
+    "rateLimited": "Memory writes in this session are too frequent; anti-poisoning rate limit reached, please retry later",
     "updatedDuplicate": "Updated existing memory: {id} (content identical, merged)",
     "added": "Added memory: {id} ({type}){warning}",
     "nearLimitWarning": "\n⚠️ Memory count approaching limit (facts: {facts}/{maxFacts}, summaries: {summaries}/{maxSummaries}). Consider calling agent_memory action=manage to review and clean up.",

package/src/locales/zh.json

@@ -107,7 +107,7 @@
     "err_pathNotAllowed": "文件路径不允许访问：{reason}",
     "err_invalidUrl": "无效的 URL（须为 http/https）",
     "err_urlFetchFailed": "URL 抓取失败: HTTP {status}",
-    "err_urlPrivateBlocked": "访问内网地址被拒绝：{host}（可在代理端配置白名单或开启允许内网开关）",
+    "err_urlPrivateBlocked": "访问内网地址被拒绝：{host}（需开启允许内网开关并将目标主机加入白名单，两者缺一不可）",
     "err_urlTooLarge": "URL 响应体超过大小限制（{limit}）",
     "err_urlTooManyRedirects": "URL 重定向次数超过上限（{max}）",
     "err_contentTooLarge": "导入内容超过大小限制（{limit}）",
@@ -168,6 +168,7 @@
     "commandInvalid": "命令无效",
     "commandBlocked": "高危命令被拦截: \"{command}\"",
     "cmdSudo": "命令需要管理员权限 (sudo)",
+    "cmdDoas": "命令需要提权 (doas/runas)",
     "cmdNpmGlobal": "全局安装 npm 包",
     "cmdPip": "pip 安装/卸载包",
     "cmdChmod777": "递归修改权限为 777",
@@ -186,7 +187,18 @@
     "cmdReg": "修改注册表 (reg)",
     "cmdNet": "用户/用户组管理 (net)",
     "cmdSc": "服务管理 (sc)",
-    "cmdTaskkillF": "强制结束进程 (taskkill /f)"
+    "cmdTaskkillF": "强制结束进程 (taskkill /f)",
+    "cmdPsRemoveItem": "PowerShell 递归/强制删除 (Remove-Item)",
+    "cmdPsEncoded": "执行 base64 编码的 PowerShell 脚本",
+    "cmdCmdSubstitution": "命令中包含命令替换（$( … ) 或反引号）",
+    "cmdDdWrite": "使用 dd 裸写文件内容",
+    "cmdShred": "不可恢复地销毁文件 (shred)",
+    "cmdTruncate": "清空文件内容 (truncate)",
+    "cmdChmodDestroy": "修改权限致文件不可用 (chmod 000/777/a-rwx)",
+    "cmdChown": "修改文件属主 (chown)",
+    "cmdNetwork": "向外发起网络连接",
+    "cmdKillProcess": "结束进程 (kill/pkill/killall)",
+    "cmdSystemService": "修改系统服务/计划任务/内核参数"
   },
   "trash": {
     "moveFailed": "移至回收站失败: {message}",
@@ -305,6 +317,8 @@
     "readFailed": "读取记忆文件失败: {error}",
     "writeFailed": "写入记忆文件失败: {error}",
     "parseFailed": "记忆文件解析失败: {error}",
+    "injectionPatternBlocked": "记忆内容疑似包含提示注入指令（如忽略既有指令 / 覆盖系统提示），已拒绝写入",
+    "rateLimited": "本会话记忆写入过于频繁，已触发防批量投毒上限，请稍后再试",
     "updatedDuplicate": "已更新已有记忆: {id}（内容相同，已合并）",
     "added": "已添加记忆: {id} ({type}){warning}",
     "nearLimitWarning": "\n⚠️ 记忆数量接近上限（事实: {facts}/{maxFacts}, 摘要: {summaries}/{maxSummaries}），建议调用 agent_memory action=manage 进行审查整理。",

package/src/memory/injection.js

@@ -11,6 +11,7 @@ export const MEMORY_INJECTION_CONFIG = {
   itemOverheadChars: 50,     // 每条渲染开销近似（序号、[重要性: N]、(标签: ...)）
   maxTopicTags: 8,           // 索引提示最多展示的主题标签数
   maxTagLength: 12,          // 单个主题标签最大长度（超出截断）
+  tier1MaxChars: 500,        // Tier1 常驻单条长度上限（P1-3：防大载荷永久驻留 system prompt）
 };
 
 /**
@@ -85,9 +86,18 @@ export function selectMemoriesForInjection(facts, summaries, config = MEMORY_INJ
   const summaryList = Array.isArray(summaries) ? summaries : [];
   const threshold = config.alwaysInjectImportance;
 
-  // Tier1：常驻（不占预算），内部按价值降序
+  // Tier1：常驻（不占预算），内部按价值降序。
+  // P1-3 来源分级：仅 origin==='user'（用户在面板手动新建/编辑）可进永久常驻；
+  // origin 缺失（旧数据）或 'model'（模型经工具/自动压缩写入）一律降入 Tier2/Tier3——
+  // 即便模型把投毒记忆的 importance 顶到 ≥8 也无法常驻，只能按需/预算召回。
+  // 单条长度 > tier1MaxChars 也不进 Tier1（防大载荷永久驻留）；未配置该字段时不限制（自定义 config 兼容）。
+  const tier1MaxChars = config.tier1MaxChars ?? Infinity;
+  const isTier1Eligible = (m) =>
+    m.origin === 'user'
+    && (m.importance || 5) >= threshold
+    && (typeof m.content === 'string' ? m.content.length <= tier1MaxChars : false);
   const tier1 = factList
-    .filter(m => (m.importance || 5) >= threshold)
+    .filter(isTier1Eligible)
     .sort((a, b) => calcMemoryValue(b, now) - calcMemoryValue(a, now));
   const tier1Set = new Set(tier1);
 

package/src/memory/routes.js

@@ -160,6 +160,9 @@ export async function memoryDispatch(req, res, pathname, url, t, requestBody = {
   }
 
   const body = requestBody || {};
+  // P1-3：记忆来源以 HTTP header 为权威——模型只能控制 body（经 tool-memory.js 原样透传），
+  // 控制不了 background 发请求时的 header；仅 options 面板的 agentApi 会带 X-Memory-Caller: user。
+  const callerOrigin = String(req?.headers?.['x-memory-caller'] || '').toLowerCase() === 'user' ? 'user' : 'model';
 
   try {
     let data;
@@ -170,6 +173,9 @@ export async function memoryDispatch(req, res, pathname, url, t, requestBody = {
     } else if (method === 'backfillVectors') {
       // 不接受请求体：只做「按当前配置把全部记忆补进向量缓存」，t 用于渲染跳过原因
       data = await service.backfillVectors(t);
+    } else if (method === 'store') {
+      // P1-3：store 传入可信 ctx（源于上面的 header 判定），忽略 body 里模型可伪造的 origin
+      data = await service.store(body, t, { origin: callerOrigin });
     } else {
       data = await service[method](body, t);
     }

package/src/memory/service.js

@@ -68,6 +68,42 @@ function normalizeImportance(value) {
   return Math.min(IMPORTANCE_MAX, Math.max(IMPORTANCE_MIN, Math.round(n)));
 }
 
+// P1-3 记忆来源分级：origin 记录每条记忆的可信来源，用于注入侧决定能否进 Tier1 常驻。
+// 关键：origin 由「谁发的请求」在运行时判定，模型不能自封——agent_memory 的 body 经扩展
+// tool-memory.js 以 { ...args } 原样透传，模型可往 args 塞任意字段，故 origin 绝不能读 body，
+// 只认调用方透传进来的可信 ctx（源于 HTTP header）。缺失一律按 'model'（默认不可信 → 降出 Tier1）。
+const MEMORY_ORIGIN_USER = 'user';   // 用户在面板（options）手动新建/编辑
+const MEMORY_ORIGIN_MODEL = 'model'; // 模型经 agent_memory 工具或自动压缩写入
+
+// 写入侧 fail-closed 拦截：命中提示注入短语的记忆直接拒写（中英常见越狱载荷形态）。
+// 宁可少存一条，不可把可疑指令放进会回注 system prompt 的记忆库。
+const MEMORY_INJECTION_PATTERNS = [
+  /ignore\s+(all\s+)?previous\s+instructions/i,
+  /ignore\s+the\s+(above|system)\s+prompt/i,
+  /disregard\s+(all\s+)?(previous|above)/i,
+  /system\s*(prompt|override)\s*[:：]/i,
+  /you\s+are\s+now\s+(in\s+)?(developer|jailbreak|dan)\s*mode/i,
+  /忽略(以上|之前|上面)(的)?(所有)?指令/,
+  /无视.{0,6}(系统|之前).{0,6}(提示|指令)/,
+];
+
+function detectInjectionPattern(content) {
+  if (typeof content !== 'string' || !content) return null;
+  return MEMORY_INJECTION_PATTERNS.find((re) => re.test(content)) || null;
+}
+
+// 频率上限：同一 (origin:sessionId) 在进程存活期内的写入条数上限（防批量投毒）。
+// 进程内计数、daemon 重启即清零——best-effort 兜底，不是持久配额。
+const MEMORY_STORE_RATE_LIMIT = 20;
+const storeRateCounter = new Map();
+
+function bumpStoreRate(origin, sessionId) {
+  const key = `${origin}:${sessionId || 'unknown'}`;
+  const next = (storeRateCounter.get(key) || 0) + 1;
+  storeRateCounter.set(key, next);
+  return next;
+}
+
 /**
  * 词面命中门槛：整词/整段命中可直接成命中；只碰碎块时需单元素 ≥ 2 才算。
  * 这一条是碎 bigram 噪声的真正出口（旧实现里「写网」「个国」这类随机 2 字块也能凑出分）。
@@ -231,8 +267,10 @@ export function createMemoryService({
    * store：新增/更新/删除记忆（迁移自 executeAgentMemoryStore tool-memory.js:215-347）
    * args.action 为子动作 add/update/delete（扩展转发层已将 subAction 映射到 action）
    */
-  async function store(args, t) {
+  async function store(args, t, ctx = {}) {
     const { action, type, category, content, title, tags, importance, memoryId, sourceSessionId } = args;
+    // P1-3：origin 只认调用方透传的可信 ctx（源于 HTTP header），绝不从 args 取——模型可伪造 body。
+    const origin = ctx && ctx.origin === MEMORY_ORIGIN_USER ? MEMORY_ORIGIN_USER : MEMORY_ORIGIN_MODEL;
 
     if (!action) return { success: false, error: t('memory.missingAction') };
     // delete 不需要 type（memoryId 全局唯一），add/update 需要
@@ -252,6 +290,11 @@ export function createMemoryService({
       return { success: false, error: t('memory.invalidImportance', { value: String(importance) }) };
     }
 
+    // P1-3 写入侧 fail-closed：命中提示注入短语的内容（add/update）直接拒写
+    if ((action === 'add' || action === 'update') && content !== undefined && detectInjectionPattern(content)) {
+      return { success: false, error: t('memory.injectionPatternBlocked'), code: 'injection_blocked' };
+    }
+
     return withMemoryLock(async () => {
       const readResult = await readMemoryFile();
       if (!readResult.success) return { success: false, error: t('memory.readFailed', { error: readResult.error }) };
@@ -261,6 +304,11 @@ export function createMemoryService({
       const targetArray = type === 'fact' ? memoryData.facts : memoryData.summaries;
 
       if (action === 'add') {
+        // P1-3 频率上限：仅对带真实 sessionId 的会话计数限流（贴合“同一会话内”语义）；
+        // 无 sessionId 的写入（如自动压缩）不归入会话桶，避免全局误伤。
+        if (sourceSessionId && bumpStoreRate(origin, sourceSessionId) > MEMORY_STORE_RATE_LIMIT) {
+          return { success: false, error: t('memory.rateLimited'), code: 'rate_limited' };
+        }
         const newMemory = {
           id: generateMemoryId(type),
           type,
@@ -272,7 +320,8 @@ export function createMemoryService({
           lastAccessAt: null,
           createdAt: now,
           updatedAt: now,
-          sourceSessionId: sourceSessionId || null
+          sourceSessionId: sourceSessionId || null,
+          origin
         };
         if (type === 'summary' && title) {
           newMemory.title = title;
@@ -285,6 +334,9 @@ export function createMemoryService({
           duplicate.tags = tags || duplicate.tags;
           duplicate.importance = importanceValue ?? duplicate.importance;
           duplicate.sourceSessionId = sourceSessionId || duplicate.sourceSessionId;
+          // P1-3：用户编辑可把来源升为 user；模型写入永不改判已有来源（缺失才补 model）
+          if (origin === MEMORY_ORIGIN_USER) duplicate.origin = MEMORY_ORIGIN_USER;
+          else if (duplicate.origin === undefined) duplicate.origin = MEMORY_ORIGIN_MODEL;
           const writeResult = await writeMemoryFile(memoryData);
           if (!writeResult.success) return { success: false, error: t('memory.writeFailed', { error: writeResult.error }) };
           queueVectorBackfill(duplicate.id, duplicate);
@@ -342,6 +394,9 @@ export function createMemoryService({
         if (importanceValue !== null) existing.importance = importanceValue;
         if (category !== undefined) existing.category = category;
         if (type === 'summary' && title !== undefined) existing.title = title;
+        // P1-3：用户编辑 → 升为 user；模型更新 → 保留原来源（缺失才补 model），绝不提权
+        if (origin === MEMORY_ORIGIN_USER) existing.origin = MEMORY_ORIGIN_USER;
+        else if (existing.origin === undefined) existing.origin = MEMORY_ORIGIN_MODEL;
         existing.updatedAt = now;
 
         const writeResult = await writeMemoryFile(memoryData);

package/src/rag/manager.js

@@ -799,7 +799,7 @@ export class RagManager {
 
   /**
    * 导入 URL 内容（HTML 提取正文 / 文本直取 / PDF 下载解析）
-   * 安全：逐跳重定向校验 + 私网拦截（白名单优先/总开关，见 url-guard.js）+ 响应体大小上限
+   * 安全：逐跳重定向校验 + 私网拦截（B2 AND 闸：开关开且白名单命中才放行，见 url-guard.js）+ 响应体大小上限
    * @param {string} collectionId
    * @param {{url: string, metadata?: object, chunkConfig?: object}} input
    */

package/src/rag/url-guard.js

@@ -1,8 +1,8 @@
 // agent/src/rag/url-guard.js - RAG URL 导入的 SSRF 防护
 // 三层防线：
 //   1. 目标地址干预：DNS 解析后按真实 IP 判断私网/保留段，决定是否放行
-//      放行优先级：白名单非空 → 仅白名单命中放行（总开关不生效，白名单优先）；
-//                 白名单为空 → 由总开关 allowPrivateNetwork 决定（缺省关闭）
+//      内网放行采用「总闸 + 白名单」的 B2 AND 闸语义（与扩展侧 src/shared/network-scope.js 同序）：
+//      开关开 **且** 白名单命中才放行；关闸时白名单命中也拒绝；开闸但白名单为空仍拒绝
 //   2. 重定向逐跳校验：redirect: manual 手动跟随，每一跳都重新过第 1 层（防合法地址 302 跳内网）
 //   3. 响应体大小上限：流式累计，超限立即中断（防超大响应 OOM）
 // 注：DNS 校验与实际连接存在二次解析的理论窗口（DNS rebinding），
@@ -66,16 +66,30 @@ export function matchesHostAllowlist(hostname, allowlist) {
 }
 
 /**
- * 私网目标放行决策
- * 优先级：白名单非空 → 仅白名单命中放行（总开关不生效）；
- *         白名单为空（或仅空白条目）→ 由总开关 allowPrivateNetwork 决定
+ * 私网目标放行决策（B2 AND 闸，判定顺序与扩展侧 src/shared/network-scope.js 的 decideNetworkAccess 一致）：
+ *   1. 总开关关闭 → 拒绝（白名单命中也无效，白名单不被自动清空）
+ *   2. 开关开启 + 白名单为空（或仅空白条目）→ 拒绝（"启用能力"不等于"放行全部内网"）
+ *   3. 开关开启 + 白名单非空 → 仅放行命中条目
+ * @returns {{ allowed: boolean, reason: string }} reason: gateClosed / noAllowlistedHost / hostNotAllowlisted / allowlisted
  */
-export function isPrivateTargetAllowed(hostname, policy) {
+export function decidePrivateAccess(hostname, policy) {
   const p = policy && typeof policy === 'object' ? policy : {};
-  const allowlist = Array.isArray(p.allowedPrivateHosts) ? p.allowedPrivateHosts : [];
-  const hasAllowlist = allowlist.some((entry) => String(entry || '').trim() !== '');
-  if (hasAllowlist) return matchesHostAllowlist(hostname, allowlist);
-  return p.allowPrivateNetwork === true;
+  // 规则 1：总闸未开一律拒绝，白名单不单独生效
+  if (p.allowPrivateNetwork !== true) return { allowed: false, reason: 'gateClosed' };
+  const allowlist = (Array.isArray(p.allowedPrivateHosts) ? p.allowedPrivateHosts : [])
+    .filter((entry) => String(entry || '').trim() !== '');
+  // 规则 2：开关开着但没配任何条目 → 仍拒绝，避免存在"整个内网全开"的状态
+  if (allowlist.length === 0) return { allowed: false, reason: 'noAllowlistedHost' };
+  // 规则 3：仅放行命中条目
+  if (matchesHostAllowlist(hostname, allowlist)) return { allowed: true, reason: 'allowlisted' };
+  return { allowed: false, reason: 'hostNotAllowlisted' };
+}
+
+/**
+ * 私网目标是否放行（decidePrivateAccess 的布尔视图，保持既有调用方与用例形状）
+ */
+export function isPrivateTargetAllowed(hostname, policy) {
+  return decidePrivateAccess(hostname, policy).allowed;
 }
 
 /**
@@ -104,8 +118,9 @@ export async function assertUrlAllowed(urlStr, policy) {
     ? [hostname]
     : (await lookup(hostname, { all: true })).map((r) => r.address);
   if (!ips.some(isPrivateAddress)) return; // 公网目标直接放行
-  if (!isPrivateTargetAllowed(hostname, policy)) {
-    throw new RagError('urlPrivateBlocked', { host: hostname });
+  const decision = decidePrivateAccess(hostname, policy);
+  if (!decision.allowed) {
+    throw new RagError('urlPrivateBlocked', { host: hostname, reason: decision.reason });
   }
 }