ai-helper-agent 2.3.1 → 2.4.0

package/src/security.js

@@ -229,36 +229,92 @@ async function checkPath(pathStr, tFn) {
 }
 
 // ==================== 命令分级管控 ====================
+//
+// 档位语义（见 checkCommand）：
+// - 黑名单 → level='deny'：不给确认弹窗、force 也不可绕过，只留给「目标本身就该绝对禁止」的动作
+// - 灰名单 → level='confirm'：真实用户确认弹窗；force（用户点确认 / 关闭确认开关）可跳过
+//
+// 已知能力边界（不在本层解决，遇到时以注释说明而不是假装防住）：
+// 1. 命令通道不受 allowedPaths 路径沙箱约束（checkPath 只作用于文件类工具），
+//    因此 `cat /etc/passwd` 这类「读取即外泄」的动作无法在本层拦截。
+// 2. 变量间接执行（`S=rm; $S -rf x`）与脚本文件的正文内容静态不可判（另见 collectCommandScopes 注释）。
+// 3. curl/wget/kill 等条目会给常规用法带来确认弹窗，属预期摩擦，可用「本次任务放行」降低频次。
+//
+// 豁免边界：下面 SUBSTITUTION_HARMLESS_HEADS 的只读豁免只适用于「命令替换」这一项
+// 语法特征，黑名单与其余灰名单条目不享任何豁免。
+
+// 命令替换特征用的两类只读名单：
+// - WHITELIST_HEADS 与原黑名单同源（纯输出命令：结果只会被打印）
+// - HARMLESS_HEADS 额外包含只读/不落盘的头命令（cd/true/test 等），
+//   仅用于判定「链式命令的原始整串」要不要参与替换特征，避免整串一票否决
+const SUBSTITUTION_WHITELIST_HEADS =
+  '(?:echo|printf|cat|head|tail|wc|ls|pwd|date|whoami|hostname|uname|id|env|printenv|which|type)';
+const SUBSTITUTION_HARMLESS_HEADS =
+  '(?:echo|printf|cat|head|tail|wc|ls|pwd|date|whoami|hostname|uname|id|env|printenv|which|type|true|false|test|cd|dir)';
+const SUBSTITUTION_BACKTICK = /`[^`\n]*`/;
+const SUBSTITUTION_DOLLAR = /\$\s*\((?:[^()]|\([^)]*\))*\)/;
+
+/**
+ * 命令替换特征的送检集合（档位纠偏后的误报控制）
+ * - 子段：只要段首不是纯输出命令就送检（`a=$(echo hi)`、剥壳后的内联载荷）
+ * - 原始整串：仅当整串头命令不在只读名单里才送检，否则 `pwd; echo $(date)`、
+ *   `cd /tmp; echo $(date)` 会被整串一票否决（原始误报根源）
+ * @param {string} whole 原始整串
+ * @param {string[]} scopes 全部子命令范围
+ * @returns {string[]}
+ */
+function substitutionCheckScopes(whole, scopes) {
+  // 拆分器会整段保留 `$( … )`/反引号，extractSubstitutions 再把同一文本递回来一遍；
+  // 只看剥掉替换后的外层位置，否则 `echo $(date)` 会因内层 `date` 不自替换而被重复送检
+  const positions = new Set(splitShellSegments(whole).map(stripEnvAssignments));
+  const out = scopes.filter((s) => s !== whole && !positions.has(s));
+  const isPlainOutput = new RegExp(`^${SUBSTITUTION_WHITELIST_HEADS}\\s`, 'i').test(whole);
+  const isHarmlessHead = new RegExp(`^(${SUBSTITUTION_HARMLESS_HEADS})\\b`, 'i').test(whole);
+  if (!isHarmlessHead && !isPlainOutput) out.push(whole);
+  // 回落：替换藏在引号参数里时（`git commit -m "feat: $(date)"`），拆分器不产出携带它的子段，
+  // 头命令豁免也不送整串——此时只扫含替换的那段引号文本，不得扩大到整个串
+  if (out.length === 0 && !isPlainOutput) {
+    const quoted = (whole.match(/"[^"]*"|'[^']*'/g) || []).filter(
+      (frag) => SUBSTITUTION_BACKTICK.test(frag) || SUBSTITUTION_DOLLAR.test(frag)
+    );
+    out.push(...quoted);
+  }
+  return out;
+}
 
 const BLACKLIST_PATTERNS = [
   // 高危写入系统目录
   /^\s*rm\s+-rf\s+\/(\*|\s|$)/,
   /^\s*rm\s+-rf\s+~(\*|\s|$)/,
   /^\s*rm\s+-rf\s+\/dev\//,
-  /^\s*rm\s+-rf\s+\/etc\//,
   /^\s*rm\s+-rf\s+\/proc\//,
   /^\s*rm\s+-rf\s+\/sys\//,
+  // 递归删除关键系统目录：原表只列了 /dev /etc /proc /sys，/usr /var /bin /root 等同样删了就起不来
+  // 目标紧跟分隔符或结尾，因此 /tmp、/private/tmp 之类不会被误判成系统目录
+  /^\s*rm\s+-(?:[rRf]+|--recursive|--force)\s+(-\S+\s+)*(\/usr|\/var|\/bin|\/sbin|\/lib32|\/lib64|\/lib|\/etc|\/boot|\/opt|\/sys|\/dev|\/root|\/System|\/Library)(\/|\*|\s|$)/,
   // 格式化/磁盘破坏
   /^\s*mkfs\./,
   /^\s*dd\s+if=.*of=\/dev\//,
   /^\s*>\s*\/dev\/sd/,
-  // 覆盖系统文件
-  /^\s*>\s*\/etc\/passwd/,
-  /^\s*>\s*\/etc\/shadow/,
-  /^\s*>\s*\/etc\/sudoers/,
+  // 覆盖系统文件：重定向可以出现在命令任意位置（`echo x > /etc/passwd`），只锁定行首 `^>` 会漏掉。
+  // 兼容 `>`/`>>`/`>&`/`&>` 与 `2>` 等 fd 形式，目标路径紧跟空白/结尾以免误伤 `/etc/passwd_xxx`。
+  /(?:^|[\s;|])\d*&?>>?&?\s*\/etc\/passwd(\s|$)/,
+  /(?:^|[\s;|])\d*&?>>?&?\s*\/etc\/shadow(\s|$)/,
+  /(?:^|[\s;|])\d*&?>>?&?\s*\/etc\/sudoers(\s|$)/,
   // fork bomb
   /:\(\)\s*{\s*:\s*\|\s*:\s*&\s*};\s*:/,
   // shebang 直接执行（出现在命令开头）
   /^\s*#!/,
-  // 恶意管道执行
-  /(curl|wget|lynx|links)\s+.*\|\s*(ba)?sh/,
-  /git\s+clone\s+.*\|\s*(ba)?sh/,
-  // 修改根目录权限
-  /^\s*chmod\s+(-R\s+)?(0?777|a\+rwx)\s+\//,
-  /^\s*chown\s+-R\s+\S+\s+\//,
-  // Shell 命令替换注入 — 允许 echo/printf 等纯输出命令中使用
-  /^\s*(?!(echo|printf|cat|head|tail|wc|ls|pwd|date|whoami|hostname|uname|id|env|printenv|which|type)\s).*`[^`]*`/,
-  /^\s*(?!(echo|printf|cat|head|tail|wc|ls|pwd|date|whoami|hostname|uname|id|env|printenv|which|type)\s).*\$\s*\([^)]*\)/,
+  // 恶意管道执行（管道右侧解释器允许带 sudo/doas 提权前缀，否则 `curl … | sudo sh` 只降级为 confirm）
+  /(curl|wget|lynx|links)\s+.*\|\s*(?:(?:sudo|doas|runas)\s+)*(?:[^|\s]+\s+)*(ba)?sh\b/,
+  /git\s+clone\s+.*\|\s*(?:(?:sudo|doas|runas)\s+)*(?:[^|\s]+\s+)*(ba)?sh\b/,
+  // 修改根目录权限/属主：只留给「目标本身就是根 /」的绝对禁止动作。
+  // `\/` 必须紧跟空白或结尾才命中，否则 `\s+\/` 会把 `chmod 777 /tmp/x` 这类普通绝对路径
+  // 也当根目录硬拒（force 不可越）；非根目标改权限回落灰名单 confirm。
+  /^\s*chmod\s+(-R\s+)?(0?777|a\+rwx)\s+\/(\s|$)/,
+  /^\s*chown\s+-R\s+\S+\s+\/(\s|$)/,
+  // 注：命令替换（$( … ) / 反引号）属「语法可疑」而非「效果危险」，已下调到灰名单，
+  //     否则 `a=$(echo hi)`、`ts=$(date +%s)` 这类零风险写法连确认机会都没有就被硬拒
   // Windows 高危破坏性命令（大小写不敏感）
   /^\s*format\s+[a-zA-Z]:/i,                                                          // 格式化磁盘
   /^\s*diskpart\b/i,                                                                  // 磁盘分区操作
@@ -270,15 +326,41 @@ const SCRIPT_INTERPRETERS = '(bash|sh|zsh|python3?|node|ruby|perl|php|lua)';
 
 const GRAYLIST_PATTERNS = [
   { pattern: /^\s*sudo\s/, reasonKey: 'security.cmdSudo' },
+  // sudo 的同类替代品：不单独列进名单就成一个免费的提权绕道
+  { pattern: /^\s*doas\s/, reasonKey: 'security.cmdDoas' },
+  { pattern: /^\s*runas\s+\/user:/i, reasonKey: 'security.cmdDoas' },
   { pattern: /npm\s+(i|install)\s+-g\s/, reasonKey: 'security.cmdNpmGlobal' },
   { pattern: /pip\s+(install|uninstall)\s/, reasonKey: 'security.cmdPip' },
   { pattern: /^\s*chmod\s+-R\s+777\s/, reasonKey: 'security.cmdChmod777' },
-  { pattern: /^\s*rm\s+-rf\s+(?!\/|~)/, reasonKey: 'security.cmdRmrf' },
+  // 递归强制删除：原表只拦了 `-rf` 这一种拼写，`rm -r -f x`、`rm --recursive --force x` 原本静默执行。
+  // 必须同时带递归与强删（`rm -f x` 不拦）；黑名单只留给目标本身就该绝对禁止的系统目录
+  { pattern: /^\s*rm\s+(?:-(?=[a-zA-Z]*[rR][a-zA-Z]*[fF])[a-zA-Z]+|-(?=[a-zA-Z]*[rR])[a-zA-Z]+\s*(?:-(?=[a-zA-Z]*[fF])[a-zA-Z]+|--force|--recursive)|--recursive\s*--force|--force\s*--recursive)\s/, reasonKey: 'security.cmdRmrf' },
   { pattern: /git\s+push\s+(-f|--force)/, reasonKey: 'security.cmdGitForcePush' },
   { pattern: /^\s*(shutdown|reboot|halt|poweroff)/, reasonKey: 'security.cmdShutdown' },
   { pattern: /^\s*>\s*\/etc\/hosts/, reasonKey: 'security.cmdHosts' },
   { pattern: /\beval\s+/, reasonKey: 'security.cmdEval' },
 
+  // 命令替换（$( … ) / 反引号）：从黑名单下调至此。只扫「替换确实落在有风险位置」的范围：
+  // 子段只看非纯输出段，整串只看非只读头命令（见 substitutionCheckScopes）
+  { pattern: SUBSTITUTION_BACKTICK, substitutionOnly: true, reasonKey: 'security.cmdCmdSubstitution' },
+  { pattern: SUBSTITUTION_DOLLAR, substitutionOnly: true, reasonKey: 'security.cmdCmdSubstitution' },
+
+  // 裸写/销毁文件内容：原表只拦了 `of=/dev/`，写普通文件同样能毁数据
+  { pattern: /^\s*dd\s+.*\bof=/, reasonKey: 'security.cmdDdWrite' },
+  { pattern: /^\s*shred\b/, reasonKey: 'security.cmdShred' },
+  { pattern: /^\s*truncate\s+.*(?:-s\s*0\b|--size[=\s][+-]?0\b)/, reasonKey: 'security.cmdTruncate' },
+
+  // 权限/属主变更：原表只拦 777 与 +x，`chmod 000` 一样致文件不可用
+  { pattern: /^\s*chmod\s+(-R\s+)?(0?00[0-7]|0?777|a-rwx)\b/, reasonKey: 'security.cmdChmodDestroy' },
+  { pattern: /^\s*chown\s+/, reasonKey: 'security.cmdChown' },
+
+  // 网络外联：原表只拦 `curl … | sh`，而拉取/上传本身就是数据外泄面
+  { pattern: /^\s*(curl|wget|nc|telnet|ssh|scp)\b/, reasonKey: 'security.cmdNetwork' },
+
+  // 进程操作与系统服务/计划任务
+  { pattern: /^\s*(kill|pkill|killall)\s+/, reasonKey: 'security.cmdKillProcess' },
+  { pattern: /^\s*(systemctl|launchctl|crontab|sysctl)\b/, reasonKey: 'security.cmdSystemService' },
+
   // 脚本解释器执行外部文件
   { pattern: new RegExp(`^\\s*${SCRIPT_INTERPRETERS}(\\s+[^-]\\S*)*\\s+\\S*\\.${SCRIPT_EXTENSIONS}\\b`), reasonKey: 'security.cmdExecExternalScript' },
   // 直接执行脚本
@@ -295,8 +377,311 @@ const GRAYLIST_PATTERNS = [
   { pattern: /^\s*net\s+(user|localgroup)\b/i, reasonKey: 'security.cmdNet' },
   { pattern: /^\s*sc\s+(stop|delete|config)\b/i, reasonKey: 'security.cmdSc' },
   { pattern: /^\s*taskkill\s+\/[a-zA-Z]*f/i, reasonKey: 'security.cmdTaskkillF' },
+  // PowerShell 侧的破坏性 cmdlet 与 base64 内联载荷：
+  // -EncodedCommand 的内容静态看不出是什么，安全网关上“看不出来”只能当成需要确认
+  { pattern: /\bremove-item\b[\s\S]*-(?:recurse|force)/i, reasonKey: 'security.cmdPsRemoveItem' },
+  { pattern: /^\s*(?:powershell|pwsh)\b.*\s-(?:e|enc|encodedcommand)\s/i, reasonKey: 'security.cmdPsEncoded' },
 ];
 
+/**
+ * 链式命令拆分：黑白名单绝大多数模式锚定命令串开头，而模型很习惯写
+ * `cd /x && sudo rm -rf y`、`echo pw | sudo -S apt install`、`bash -c "sudo ..."`，
+ * 只检查整串开头会让后面几段完全绕过灰名单（用户表现为“点过一次后此后再也不弹框”）。
+ * 这里把一条命令拆成逐个“子命令范围”，逐段比对，只增不减判定强度。
+ * 已知能力边界：变量间接执行（`S=rm; $S -rf x`）无法静态判定，不在本层解决。
+ */
+// 会把内联脚本作为参数传入的解释器（只对它们解开内联载荷，避免 grep -c 之类误报）
+const INLINE_EXEC_INTERPRETERS = /^(?:\.\/|\/usr\/(?:local\/)?bin\/)?(?:sh|bash|zsh|dash|ksh|fish|powershell|pwsh|cmd|python[0-9.]*|node|perl|ruby|php|lua)\b/i;
+const INLINE_EXEC_FLAG = /\s-(?:c|e)\s+(.+)$/is;
+// Windows 侧的内联载荷：cmd 用 /c /k，PowerShell 用 -Command 与 -EncodedCommand（base64/UTF-16LE）
+const CMD_SLASH_FLAG = /\s\/([ck])\s+(.+)$/is;
+const PS_INLINE_FLAG = /\s-(?:command|encodedcommand|enc)\s+(.+)$/i;
+const PS_ENCODED_FLAG = /-(?:encodedcommand|enc)\b/i;
+const ENV_ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
+// 前缀包装器：仅当整段以它们开头时才剥离（否则会把普通命令的参数误当成命令）。
+// sudo/doas 是提权包装器：剥掉它们不是免检，而是让后面的 `rm -rf /usr`、`mkfs`、`dd of=/dev/`
+// 这类「绝对禁止项」暴露到段首黑名单正则下——`sudo` 绝不能成为硬拒项的降级通行证。
+const COMMAND_WRAPPERS = /^(?:nohup|time|timeout|nice|stdbuf|env|exec|command|xargs|sudo|doas)\b/i;
+const OPTION_OR_SIZE_TOKEN = /^(?:[-+]|\d+(?:\.\d+)?[a-z%]*$)/i;
+
+/** 去掉包裹引号 */
+function unquote(text) {
+  const s = text.trim();
+  if (s.length >= 2 && ((s[0] === '"' && s.endsWith('"')) || (s[0] === "'" && s.endsWith("'")))) {
+    return s.slice(1, -1);
+  }
+  return s;
+}
+
+/** 去掉开头的 `KEY=VAL` 环变量前缀（`FOO=1 sudo xxx` 依旧要看 sudo） */
+function stripEnvAssignments(segment) {
+  const tokens = segment.trim().split(/\s+/);
+  let i = 0;
+  while (i < tokens.length && ENV_ASSIGNMENT.test(tokens[i])) i++;
+  return tokens.slice(i).join(' ');
+}
+
+/**
+ * 逐层剥前缀包装器及其环变量/选项/数值参数，返回每一层剥壳后的中间形态：
+ * `nohup sudo …`、`env FOO=1 sudo …`、`timeout 10 -k 5 sudo …` 都得让后面的命令逐层暴露在段首。
+ * 保留中间形态而非一步剥到底，是因为 sudo/doas 同时是灰名单条目：
+ * `nohup sudo apt install foo` 必须既产出 `sudo apt install foo`（灰名单 sudo 仍可见），
+ * 又产出 `apt install foo`；而 `sudo rm -rf /usr` 要产出 `rm -rf /usr`（黑名单绝对禁止项）。
+ * @param {string} segment
+ * @returns {string[]} 每剥一层得到的中间形态（可能多个），段首不是包装器时为空数组
+ */
+function peelCommandWrappers(segment) {
+  const tokens = segment.trim().split(/\s+/);
+  const out = [];
+  // 段首不是包装器就不动：否则 `ls -la` 之类会被剥成光杆参数
+  while (tokens.length >= 2 && COMMAND_WRAPPERS.test(tokens[0])) {
+    tokens.shift(); // 去掉当前这一层包装器
+    // 连同它自己的环变量/选项/数值参数一起跳过（env FOO=1、timeout 10 -k 5、sudo -S）
+    while (tokens.length && (ENV_ASSIGNMENT.test(tokens[0]) || OPTION_OR_SIZE_TOKEN.test(tokens[0]))) {
+      tokens.shift();
+    }
+    const rest = tokens.join(' ');
+    if (rest) out.push(rest);
+  }
+  return out;
+}
+
+/**
+ * 折叠 shell 绝对路径里的冗余分隔符与 `/.`、`/X/..` 段：`//usr`、`/.//usr`、`/tmp/../usr`
+ * 在 POSIX 下与 `/usr` 指向同一目录，不能靠换个写法绕过系统目录 / 设备黑名单。
+ * 同时覆盖 `of=//dev/sda`、`--path=/./usr` 这类 `key=/value` 形态（只归一化以 `/` 开头的值部分）。
+ * 只处理以 `/` 开头的路径（或其值），引号内容本就不进这一层，不会误伤 URL 里的 `://`。
+ * @param {string} segment
+ * @returns {string} 归一化后的串（与入参相同表示无可折叠）
+ */
+function normalizeShellPathTargets(segment) {
+  return segment
+    .split(/\s+/)
+    .map((tok) => {
+      // 拆开 `key=` 前缀（dd 的 if=/of=、长选项 --path= 等），只对以 / 开头的值做归一
+      const eq = tok.indexOf('=');
+      const prefix = eq > -1 ? tok.slice(0, eq + 1) : '';
+      const pathPart = eq > -1 ? tok.slice(eq + 1) : tok;
+      if (!pathPart.startsWith('/')) return tok;
+      let p = pathPart;
+      let prev;
+      do {
+        prev = p;
+        p = p
+          .replace(/\/\/+/g, '/')
+          .replace(/\/\.(?=\/|$)/g, '')
+          .replace(/\/[^/.][^/]*\/\.\.(?=\/|$)/g, '')
+          .replace(/^\/\.\.(?=\/|$)/, ''); // 根之上的 .. 等价根：/../x → /x
+      } while (p !== prev);
+      return prefix + p;
+    })
+    .join(' ');
+}
+
+/**
+ * 取出解释器内联载荷（POSIX `-c/-e`、cmd `/c /k`、PowerShell `-Command/-EncodedCommand`）
+ * @param {string} segment
+ * @returns {string[]}
+ */
+function extractInlinePayloads(segment) {
+  if (!INLINE_EXEC_INTERPRETERS.test(segment)) return [];
+  const payloads = [];
+
+  const posix = segment.match(INLINE_EXEC_FLAG);
+  if (posix) payloads.push(unquote(posix[1]));
+
+  const cmd = segment.match(CMD_SLASH_FLAG);
+  if (cmd) payloads.push(unquote(cmd[2]));
+
+  const ps = segment.match(PS_INLINE_FLAG);
+  if (ps) {
+    const raw = unquote(ps[1]);
+    if (PS_ENCODED_FLAG.test(segment)) {
+      // -EncodedCommand 走 base64(UTF-16LE)：解不出来就当作不命中，不当成放行依据
+      try {
+        payloads.push(Buffer.from(raw, 'base64').toString('utf16le'));
+      } catch {
+        /* 非法 base64：保留原文已由上面的 push 覆盖，不影响判定 */
+      }
+    } else {
+      payloads.push(raw);
+    }
+  }
+
+  return payloads.map((p) => String(p || '').trim()).filter(Boolean);
+}
+
+/**
+ * 取出 `$( … )` 与反引号内部的子命令
+ * 拆分器为了保留黑名单语义不拆这些位置，但里面的敏感段同样得过灰名单
+ * （如 `echo $(sudo id)`：黑名单对 echo 开头的替换网开一面，灰名单必须看到 sudo）
+ * @param {string} segment
+ * @returns {string[]}
+ */
+function extractSubstitutions(segment) {
+  const found = [];
+  const scan = (text) => {
+    for (let i = 0; i < text.length; i++) {
+      const ch = text[i];
+      if (ch === '`') {
+        const end = text.indexOf('`', i + 1);
+        if (end > i) {
+          found.push(text.slice(i + 1, end));
+          i = end;
+        }
+        continue;
+      }
+      if (ch === '$' && text[i + 1] === '(') {
+        let depth = 0;
+        let j = i + 1;
+        for (; j < text.length; j++) {
+          if (text[j] === '(') depth++;
+          else if (text[j] === ')') {
+            depth--;
+            if (depth === 0) break;
+          }
+        }
+        if (j < text.length) {
+          found.push(text.slice(i + 2, j));
+          i = j;
+        }
+      }
+    }
+  };
+
+  scan(segment);
+  // 拆分器在引号内不扫替换（为了不把 `"a && b"` 误拆），于是被引号包住的替换内层会整个逃检：
+  // `bash -c "echo `rm -rf /`"` 曾直接判 allow。这里补扫引号片段内部，使内层命令照常进名单
+  for (const frag of segment.match(/"[^"]*"|'[^']*'/g) || []) {
+    scan(frag.slice(1, -1));
+  }
+
+  return found.map((s) => s.trim()).filter(Boolean);
+}
+
+/**
+ * 按 shell 控制符拆分命令串（引号 / 反引号 / $( ) 内部不拆）
+ * @param {string} command
+ * @returns {string[]} 非空子命令段
+ */
+function splitShellSegments(command) {
+  const parts = [];
+  let buf = '';
+  let quote = null;
+  const push = () => {
+    const seg = buf.trim();
+    if (seg) parts.push(seg);
+    buf = '';
+  };
+
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+
+    if (quote) {
+      buf += ch;
+      if (ch === '\\' && quote === '"' && i + 1 < command.length) {
+        buf += command[++i];
+      } else if (ch === quote) {
+        quote = null;
+      }
+      continue;
+    }
+
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      buf += ch;
+      continue;
+    }
+
+    if (ch === '\\' && i + 1 < command.length) {
+      buf += ch + command[++i];
+      continue;
+    }
+
+    // 反引号命令替换：整段保留，不在此处拆分
+    if (ch === '`') {
+      buf += ch;
+      i++;
+      for (; i < command.length; i++) {
+        buf += command[i];
+        if (command[i] === '`') break;
+      }
+      continue;
+    }
+
+    // $( ... ) 命令替换：朴素配对一层括号
+    if (ch === '$' && command[i + 1] === '(') {
+      let depth = 0;
+      for (; i < command.length; i++) {
+        buf += command[i];
+        if (command[i] === '(') depth++;
+        else if (command[i] === ')') {
+          depth--;
+          if (depth === 0) break;
+        }
+      }
+      continue;
+    }
+
+    const two = command.slice(i, i + 2);
+    if (two === '&&' || two === '||') {
+      push();
+      i++;
+      continue;
+    }
+
+    if (ch === ';' || ch === '|' || ch === '&' || ch === '\n') {
+      push();
+      continue;
+    }
+
+    buf += ch;
+  }
+  push();
+  return parts;
+}
+
+/**
+ * 收集一条命令需要接受检查的全部“子命令范围”
+ * 始终包含原始整串（保留现有黑名单语义，例如 fork bomb 这种本身带控制符的模式），
+ * 再追加逐段拆分结果与解释器 -c/-e 内联载荷（递归一层层解开，深度封顶防死循环）。
+ * @param {string} command
+ * @param {number} [depth]
+ * @param {string[]} [out]
+ * @returns {string[]}
+ */
+function collectCommandScopes(command, depth = 3, out = []) {
+  const trimmed = String(command || '').trim();
+  if (!trimmed) return out;
+  if (!out.includes(trimmed)) out.push(trimmed);
+  if (depth <= 0) return out;
+
+  for (const seg of splitShellSegments(trimmed)) {
+    const normalized = stripEnvAssignments(seg);
+    if (normalized && !out.includes(normalized)) out.push(normalized);
+
+    // `nohup sudo …`、`env FOO=1 sudo …`、`timeout 10 sudo …`、`sudo rm -rf /usr`：
+    // 包装器/提权前缀只是外层，逐层剥壳后递归送检，不得把敏感命令藏到段首正则看不见的后面
+    for (const peeled of peelCommandWrappers(normalized)) {
+      collectCommandScopes(peeled, depth - 1, out);
+    }
+
+    // 路径变形归一化：`rm -rf //usr`、`rm -rf /.//usr` 等价的系统目录不能因写法不同而降级为 confirm
+    const pathScope = normalizeShellPathTargets(normalized);
+    if (pathScope && !out.includes(pathScope)) out.push(pathScope);
+
+    // 解释器内联载荷：POSIX `-c/-e`、cmd `/c /k`、PowerShell `-Command/-EncodedCommand`
+    for (const payload of extractInlinePayloads(seg)) {
+      collectCommandScopes(payload, depth - 1, out);
+    }
+    // `$( … )` 与反引号内部：拆分器为了保留黑名单语义整段不动，这里单独取出送检
+    for (const sub of extractSubstitutions(seg)) {
+      collectCommandScopes(sub, depth - 1, out);
+    }
+  }
+  return out;
+}
+
 /**
  * 检查命令安全性
  * @param {boolean} [force=false] - 用户已确认（跳过灰名单但保留黑名单）
@@ -309,15 +694,27 @@ function checkCommand(command, force = false, tFn) {
   }
 
   const trimmed = command.trim();
+  // 只有空白字符的命令同样无法分类：安全网关上“无法分类”不得当成 allow
+  if (!trimmed) {
+    return { safe: false, level: 'deny', reason: tr('security.commandInvalid', undefined, tFn) };
+  }
+
+  // 0. 子命令范围：原始整串 + 链式拆分段 + 解释器内联载荷
+  //    黑名单与灰名单逐段判定，不得只看命令串开头
+  const scopes = collectCommandScopes(trimmed);
+  // 命令替换特征另有自己的送检集合（只读头命令豁免），不得复用整串
+  const substScopes = substitutionCheckScopes(trimmed, scopes);
 
   // 1. 黑名单始终生效（即使是 force 模式也不可绕过）
-  for (const pattern of BLACKLIST_PATTERNS) {
-    if (pattern.test(trimmed)) {
-      return {
-        safe: false,
-        level: 'deny',
-        reason: tr('security.commandBlocked', { command: trimmed.substring(0, 100) }, tFn)
-      };
+  for (const scope of scopes) {
+    for (const pattern of BLACKLIST_PATTERNS) {
+      if (pattern.test(scope)) {
+        return {
+          safe: false,
+          level: 'deny',
+          reason: tr('security.commandBlocked', { command: trimmed.substring(0, 100) }, tFn)
+        };
+      }
     }
   }
 
@@ -340,14 +737,19 @@ function checkCommand(command, force = false, tFn) {
     return { safe: true, level: 'allow' };
   }
 
-  // 3. 检查灰名单
-  for (const entry of GRAYLIST_PATTERNS) {
-    if (entry.pattern.test(trimmed)) {
-      return {
-        safe: false,
-        level: 'confirm',
-        reason: tr(entry.reasonKey, undefined, tFn)
-      };
+  // 3. 检查灰名单（逐段：`cd x && sudo y` 里的 sudo 同样要用户确认）
+  for (const scope of scopes) {
+    for (const entry of GRAYLIST_PATTERNS) {
+      const candidates = entry.substitutionOnly ? substScopes : [scope];
+      for (const candidate of candidates) {
+        if (entry.pattern.test(candidate)) {
+          return {
+            safe: false,
+            level: 'confirm',
+            reason: tr(entry.reasonKey, undefined, tFn)
+          };
+        }
+      }
     }
   }
 
@@ -355,4 +757,4 @@ function checkCommand(command, force = false, tFn) {
   return { safe: true, level: 'allow' };
 }
 
-export { checkPath, checkCommand, normalizePathFormat, isHardBlocked };
+export { checkPath, checkCommand, normalizePathFormat, isHardBlocked, collectCommandScopes };

package/src/server.js

@@ -14,7 +14,7 @@ import { loadConfig, saveConfig, setConfigLang } from './config.js';
 import { verifyToken, startPairCodeRotation, stopPairCodeRotation, handlePairRequest, setAuthLang } from './auth.js';
 import { checkPath, checkCommand, normalizePathFormat, setSecurityLang } from './security.js';
 import { moveToTrash, restoreFromTrash, listTrash, startPeriodicCleanup, stopPeriodicCleanup, setTrashLang } from './trash.js';
-import { executeCommand, executeCommandSync, addWsClient, disconnectWsClient, killProcess, getRunningProcesses, setExecutorLang } from './executor.js';
+import { executeCommand, executeCommandSync, addWsClient, disconnectWsClient, killProcess, detachProcess, getRunningProcesses, setExecutorLang } from './executor.js';
 import { setConsoleOutput, setLoggerLocale, logAuth, logFs, logExec, logSecurity, logSystem, logError, queryLogs, getLogDates } from './logger.js';
 import { initSearchTools, getSearchToolsAvailable, searchFiles, searchContent, setSearchLang } from './search.js';
 import { detectRagAvailable, isRagAvailable, resetRagDetection, setRagLang, getLastRagProbeError } from './rag/detect.js';
@@ -253,7 +253,7 @@ function getAllowedOrigin(req) {
 function jsonResponse(res, status, data) {
   const headers = {
     'Content-Type': 'application/json; charset=utf-8',
-    'Access-Control-Allow-Headers': 'Content-Type, Authorization',
+    'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Memory-Caller',
     'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS'
   };
   const allowedOrigin = getAllowedOrigin(res.req);
@@ -444,7 +444,7 @@ export function startServer() {
     // CORS 预检（仅放行 Chrome 扩展来源）
     if (req.method === 'OPTIONS') {
       const optHeaders = {
-        'Access-Control-Allow-Headers': 'Content-Type, Authorization',
+        'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Memory-Caller',
         'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS'
       };
       const allowedOrigin = getAllowedOrigin(req);
@@ -1603,7 +1603,7 @@ export function startServer() {
       // === 命令执行 ===
 
       if (pathname === '/api/exec') {
-        const { command, cwd, wait, force } = body;
+        const { command, cwd, wait, force, timeoutMs } = body;
         if (!command || typeof command !== 'string') return jsonResponse(res, 400, { success: false, error: t('error.missingCommand') });
 
         // 校验 cwd
@@ -1628,7 +1628,7 @@ export function startServer() {
         // 同步等待模式
         if (wait) {
           try {
-            const result = await executeCommandSync(command, resolvedCwd);
+            const result = await executeCommandSync(command, resolvedCwd, timeoutMs);
             logExec('completed', {
               command,
               cwd: resolvedCwd,
@@ -1654,7 +1654,7 @@ export function startServer() {
           }
         }
 
-        // 异步模式
+        // 异步模式（透传 timeoutMs → 受管模式；未传则维持旧语义）
         const execId = executeCommand(command, resolvedCwd, null, (result) => {
           logExec('completed', {
             command,
@@ -1663,7 +1663,7 @@ export function startServer() {
             exitCode: result.exitCode,
             killed: result.killed
           });
-        });
+        }, false, { timeoutMs });
         logExec('started', { command, cwd: resolvedCwd, execId });
         return jsonResponse(res, 200, {
           success: true,
@@ -1680,6 +1680,14 @@ export function startServer() {
         return jsonResponse(res, 200, { success: stopped, execId: body.execId });
       }
 
+      // 显式 daemon 化：豁免超时（插件端空闲挂起分支调用；
+      // 替代"WS 全断开即清定时器"的隐式推断，通讯故障不再意外保活）
+      if (pathname === '/api/exec/detach') {
+        const detached = detachProcess(body.execId);
+        logExec('detached', { execId: body.execId, success: detached });
+        return jsonResponse(res, 200, { success: detached, execId: body.execId });
+      }
+
       // === Skill 操作（需要 body） ===
 
       // 回收站恢复
@@ -2122,8 +2130,20 @@ export function startServer() {
           ws.close();
           return;
         }
-        // 客户端断开时，从监听列表中移除；所有客户端都断开后取消超时
+        // 控制面心跳：检测半开连接（TCP 假死）。浏览器对 ping 自动回 pong，
+        // 两拍未回视为连接已死 → terminate → 走 disconnect 收敛路径（受管模式定时器仍在）
+        ws.isAlive = true;
+        ws.on('pong', () => { ws.isAlive = true; });
+        const heartbeat = setInterval(() => {
+          if (ws.readyState !== 1) { clearInterval(heartbeat); return; }
+          if (!ws.isAlive) { try { ws.terminate(); } catch {} clearInterval(heartbeat); return; }
+          ws.isAlive = false;
+          ws.ping();
+        }, 30000);
+        heartbeat.unref();
+        // 客户端断开时，从监听列表中移除；所有客户端都断开后按受管/旧语义分别处理超时
         ws.on('close', () => {
+          clearInterval(heartbeat);
           disconnectWsClient(execId, ws);
         });
       });

package/dist/assets/agent-store-DcAs6YyA.js

@@ -1,2 +0,0 @@
-import{r as e}from"./rolldown-runtime-C0FnF6B9.js";import{a as t,c as n}from"./i18n-C4jSRoCH.js";import{_ as r,v as i}from"./session-store-CzVQCgQ_.js";var a=e({createAgent:()=>m,deleteAgent:()=>g,getActiveAgentId:()=>_,getAgent:()=>p,getAllAgents:()=>d,getCustomAgents:()=>f,setActiveAgentId:()=>v,updateAgent:()=>h});t(`zh`,{agentStore:{unnamedAgent:`未命名Agent`}}),t(`en`,{agentStore:{unnamedAgent:`Unnamed Agent`}});var o=`customAgents`,s=`activeAssistantId`,c=`activeAgentId`,l=!1;async function u(){if(l)return;l=!0;let e=await chrome.storage.local.get([c,s]),t=e[c],n=e[s];t&&!n&&!t.startsWith(`pa_`)&&(await chrome.storage.local.set({[s]:t}),await chrome.storage.local.remove(c))}async function d(){let e=(await chrome.storage.local.get([o]))[o]||[];return[...r,...e]}async function f(){return(await chrome.storage.local.get([o]))[o]||[]}async function p(e){return e&&(await d()).find(t=>t.id===e)||null}async function m(e){let t=await f(),r={id:i(),name:e.name||n(`agentStore.unnamedAgent`),description:e.description||``,icon:e.icon||`🤖`,systemPrompt:e.systemPrompt||``,toolIds:e.toolIds||null,skillIds:e.skillIds||null,mcpExcludedServerIds:e.mcpExcludedServerIds??null,isBuiltin:!1,allowSubDispatch:e.allowSubDispatch!==void 0&&e.allowSubDispatch,model:e.model||null,temperature:e.temperature===void 0?null:e.temperature,topP:e.topP===void 0?null:e.topP,createdAt:new Date().toISOString(),updatedAt:new Date().toISOString()};return t.push(r),await chrome.storage.local.set({[o]:t}),r}async function h(e,t){let n=await f(),r=n.findIndex(t=>t.id===e);return r===-1?null:(n[r]={...n[r],...t,id:e,isBuiltin:!1,updatedAt:new Date().toISOString()},await chrome.storage.local.set({[o]:n}),n[r])}async function g(e){let t=await f(),n=t.findIndex(t=>t.id===e);return n!==-1&&(t.splice(n,1),await chrome.storage.local.set({[o]:t}),(await chrome.storage.local.get([s]))[s]===e&&await chrome.storage.local.remove(s),!0)}async function _(){return await u(),(await chrome.storage.local.get([s]))[s]||null}async function v(e){e?await chrome.storage.local.set({[s]:e}):await chrome.storage.local.remove(s)}export{p as a,h as c,_ as i,m as n,d as o,g as r,v as s,a as t};
-//# sourceMappingURL=agent-store-DcAs6YyA.js.map

package/dist/assets/agent-store-DcAs6YyA.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-store-DcAs6YyA.js","names":[],"sources":["../../src/side_panel/agent-store.js"],"sourcesContent":["// side_panel/agent-store.js - Agent 数据持久化\nimport { BUILTIN_AGENTS, generateAgentId } from '../shared/agent-defaults.js';\nimport { t, registerTranslations } from '../shared/i18n.js';\n\nregisterTranslations('zh', {\n  agentStore: {\n    unnamedAgent: '未命名Agent',\n  },\n});\nregisterTranslations('en', {\n  agentStore: {\n    unnamedAgent: 'Unnamed Agent',\n  },\n});\n\nconst STORAGE_KEY = 'customAgents';\nconst ACTIVE_KEY = 'activeAssistantId';\nconst LEGACY_ACTIVE_KEY = 'activeAgentId';\n\nlet migratedActiveKey = false;\n\nasync function migrateLegacyActiveKey() {\n  if (migratedActiveKey) return;\n  migratedActiveKey = true;\n\n  const result = await chrome.storage.local.get([LEGACY_ACTIVE_KEY, ACTIVE_KEY]);\n  const legacyValue = result[LEGACY_ACTIVE_KEY];\n  const newValue = result[ACTIVE_KEY];\n\n  if (legacyValue && !newValue && !legacyValue.startsWith('pa_')) {\n    await chrome.storage.local.set({ [ACTIVE_KEY]: legacyValue });\n    await chrome.storage.local.remove(LEGACY_ACTIVE_KEY);\n  }\n}\n\n/**\n * 获取所有 Agent（内置 + 用户自定义）\n * @returns {Promise<Array>}\n */\nexport async function getAllAgents() {\n  const result = await chrome.storage.local.get([STORAGE_KEY]);\n  const customAgents = result[STORAGE_KEY] || [];\n  return [...BUILTIN_AGENTS, ...customAgents];\n}\n\n/**\n * 仅获取用户自定义的 Agent\n * @returns {Promise<Array>}\n */\nexport async function getCustomAgents() {\n  const result = await chrome.storage.local.get([STORAGE_KEY]);\n  return result[STORAGE_KEY] || [];\n}\n\n/**\n * 根据 ID 获取单个 Agent\n * @param {string} agentId\n * @returns {Promise<Object|null>}\n */\nexport async function getAgent(agentId) {\n  if (!agentId) return null;\n  const all = await getAllAgents();\n  return all.find(a => a.id === agentId) || null;\n}\n\n/**\n * 创建新的自定义 Agent\n * @param {Object} agentData - 不含 id 的 Agent 数据\n * @returns {Promise<Object>}\n */\nexport async function createAgent(agentData) {\n  const agents = await getCustomAgents();\n  const newAgent = {\n    id: generateAgentId(),\n    name: agentData.name || t('agentStore.unnamedAgent'),\n    description: agentData.description || '',\n    icon: agentData.icon || '🤖',\n    systemPrompt: agentData.systemPrompt || '',\n    toolIds: agentData.toolIds || null,  // null = 继承全局\n    skillIds: agentData.skillIds || null, // null = 继承全部启用技能\n    mcpExcludedServerIds: agentData.mcpExcludedServerIds ?? null, // MCP 服务排除列表（服务级 deny-list）\n    isBuiltin: false,\n    allowSubDispatch: agentData.allowSubDispatch !== undefined ? agentData.allowSubDispatch : false,\n    model: agentData.model || null,\n    temperature: agentData.temperature !== undefined ? agentData.temperature : null,\n    topP: agentData.topP !== undefined ? agentData.topP : null,\n    createdAt: new Date().toISOString(),\n    updatedAt: new Date().toISOString(),\n  };\n  agents.push(newAgent);\n  await chrome.storage.local.set({ [STORAGE_KEY]: agents });\n  return newAgent;\n}\n\n/**\n * 更新已有的自定义 Agent\n * @param {string} agentId\n * @param {Object} updates\n * @returns {Promise<Object|null>}\n */\nexport async function updateAgent(agentId, updates) {\n  const agents = await getCustomAgents();\n  const idx = agents.findIndex(a => a.id === agentId);\n  if (idx === -1) return null;\n  \n  agents[idx] = {\n    ...agents[idx],\n    ...updates,\n    id: agentId,  // id 不可变\n    isBuiltin: false,  // 不可变\n    updatedAt: new Date().toISOString(),\n  };\n  await chrome.storage.local.set({ [STORAGE_KEY]: agents });\n  return agents[idx];\n}\n\n/**\n * 删除自定义 Agent\n * @param {string} agentId\n * @returns {Promise<boolean>}\n */\nexport async function deleteAgent(agentId) {\n  const agents = await getCustomAgents();\n  const idx = agents.findIndex(a => a.id === agentId);\n  if (idx === -1) return false;\n  \n  agents.splice(idx, 1);\n  await chrome.storage.local.set({ [STORAGE_KEY]: agents });\n\n  // 如果删除的 Agent 是当前选中的，重置为默认\n  const result = await chrome.storage.local.get([ACTIVE_KEY]);\n  if (result[ACTIVE_KEY] === agentId) {\n    await chrome.storage.local.remove(ACTIVE_KEY);\n  }\n  \n  return true;\n}\n\n/**\n * 获取当前选中的 Agent ID\n * @returns {Promise<string|null>}\n */\nexport async function getActiveAgentId() {\n  await migrateLegacyActiveKey();\n  const result = await chrome.storage.local.get([ACTIVE_KEY]);\n  return result[ACTIVE_KEY] || null;\n}\n\n/**\n * 设置当前选中的 Agent ID\n * @param {string|null} agentId\n */\nexport async function setActiveAgentId(agentId) {\n  if (agentId) {\n    await chrome.storage.local.set({ [ACTIVE_KEY]: agentId });\n  } else {\n    await chrome.storage.local.remove(ACTIVE_KEY);\n  }\n}\n\n/**\n * 从模板创建 Agent\n * @param {Object} template\n * @returns {Promise<Object>}\n */\nexport async function createAgentFromTemplate(template) {\n  return createAgent({\n    name: template.name,\n    icon: template.icon,\n    description: template.description,\n    systemPrompt: template.systemPrompt,\n    toolIds: template.toolIds ? [...template.toolIds] : null,\n    allowSubDispatch: template.allowSubDispatch || false,\n  });\n}\n"],"mappings":"+TAIA,EAAqB,KAAM,CACzB,WAAY,CACV,aAAc,UAChB,CACF,CAAC,EACD,EAAqB,KAAM,CACzB,WAAY,CACV,aAAc,eAChB,CACF,CAAC,EAED,IAAM,EAAc,eACd,EAAa,oBACb,EAAoB,gBAEtB,EAAoB,GAExB,eAAe,GAAyB,CACtC,GAAI,EAAmB,OACvB,EAAoB,GAEpB,IAAM,EAAS,MAAM,OAAO,QAAQ,MAAM,IAAI,CAAC,EAAmB,CAAU,CAAC,EACvE,EAAc,EAAO,GACrB,EAAW,EAAO,GAEpB,GAAe,CAAC,GAAY,CAAC,EAAY,WAAW,KAAK,IAC3D,MAAM,OAAO,QAAQ,MAAM,IAAI,EAAG,GAAa,CAAY,CAAC,EAC5D,MAAM,OAAO,QAAQ,MAAM,OAAO,CAAiB,EAEvD,CAMA,eAAsB,GAAe,CAEnC,IAAM,GAAe,MADA,OAAO,QAAQ,MAAM,IAAI,CAAC,CAAW,CAAC,EAAA,CAC/B,IAAgB,CAAC,EAC7C,MAAO,CAAC,GAAG,EAAgB,GAAG,CAAY,CAC5C,CAMA,eAAsB,GAAkB,CAEtC,OAAO,MADc,OAAO,QAAQ,MAAM,IAAI,CAAC,CAAW,CAAC,EAAA,CAC7C,IAAgB,CAAC,CACjC,CAOA,eAAsB,EAAS,EAAS,CAGtC,OAFK,IAEE,MADW,EAAa,EAAA,CACpB,KAAK,GAAK,EAAE,KAAO,CAAO,GAFhB,IAGvB,CAOA,eAAsB,EAAY,EAAW,CAC3C,IAAM,EAAS,MAAM,EAAgB,EAC/B,EAAW,CACf,GAAI,EAAgB,EACpB,KAAM,EAAU,MAAQ,EAAE,yBAAyB,EACnD,YAAa,EAAU,aAAe,GACtC,KAAM,EAAU,MAAQ,KACxB,aAAc,EAAU,cAAgB,GACxC,QAAS,EAAU,SAAW,KAC9B,SAAU,EAAU,UAAY,KAChC,qBAAsB,EAAU,sBAAwB,KACxD,UAAW,GACX,iBAAkB,EAAU,mBAAqB,IAAA,IAAY,EAAU,iBACvE,MAAO,EAAU,OAAS,KAC1B,YAAa,EAAU,cAAgB,IAAA,GAAoC,KAAxB,EAAU,YAC7D,KAAM,EAAU,OAAS,IAAA,GAA6B,KAAjB,EAAU,KAC/C,UAAW,IAAI,KAAK,CAAA,CAAE,YAAY,EAClC,UAAW,IAAI,KAAK,CAAA,CAAE,YAAY,CACpC,EAGA,OAFA,EAAO,KAAK,CAAQ,EACpB,MAAM,OAAO,QAAQ,MAAM,IAAI,EAAG,GAAc,CAAO,CAAC,EACjD,CACT,CAQA,eAAsB,EAAY,EAAS,EAAS,CAClD,IAAM,EAAS,MAAM,EAAgB,EAC/B,EAAM,EAAO,UAAU,GAAK,EAAE,KAAO,CAAO,EAWlD,OAVI,IAAQ,GAAW,MAEvB,EAAO,GAAO,CACZ,GAAG,EAAO,GACV,GAAG,EACH,GAAI,EACJ,UAAW,GACX,UAAW,IAAI,KAAK,CAAA,CAAE,YAAY,CACpC,EACA,MAAM,OAAO,QAAQ,MAAM,IAAI,EAAG,GAAc,CAAO,CAAC,EACjD,EAAO,GAChB,CAOA,eAAsB,EAAY,EAAS,CACzC,IAAM,EAAS,MAAM,EAAgB,EAC/B,EAAM,EAAO,UAAU,GAAK,EAAE,KAAO,CAAO,EAYlD,OAXI,IAAQ,KAEZ,EAAO,OAAO,EAAK,CAAC,EACpB,MAAM,OAAO,QAAQ,MAAM,IAAI,EAAG,GAAc,CAAO,CAAC,GAIpD,MADiB,OAAO,QAAQ,MAAM,IAAI,CAAC,CAAU,CAAC,EAAA,CAC/C,KAAgB,GACzB,MAAM,OAAO,QAAQ,MAAM,OAAO,CAAU,EAGvC,GACT,CAMA,eAAsB,GAAmB,CAGvC,OAFA,MAAM,EAAuB,GAEtB,MADc,OAAO,QAAQ,MAAM,IAAI,CAAC,CAAU,CAAC,EAAA,CAC5C,IAAe,IAC/B,CAMA,eAAsB,EAAiB,EAAS,CAC1C,EACF,MAAM,OAAO,QAAQ,MAAM,IAAI,EAAG,GAAa,CAAQ,CAAC,EAExD,MAAM,OAAO,QAAQ,MAAM,OAAO,CAAU,CAEhD"}