ai-helper-agent 2.3.1 → 2.4.1

package/README.md

@@ -110,9 +110,9 @@ All file operations are restricted to directories listed in the `allowedPaths` w
 | Type | Examples |
 |------|----------|
 | Disk destruction | `rm -rf /`, `mkfs.*`, `dd if=... of=/dev/...` |
+| Recursive delete of critical system dirs | `rm -rf /usr`, `/var`, `/bin`, `/sbin`, `/lib`, `/boot`, `/opt`, `/root`, `/System`, `/Library` |
 | System file overwrite | `> /etc/passwd`, `> /etc/shadow` |
 | Malicious pipe execution | `curl ... \| bash`, `git clone ... \| sh` |
-| Shell injection | Backticks, `$()`, `${}` command substitution |
 | Fork bomb | `:(){ :\|:& };:` |
 
 **Greylist** — Requires user confirmation before execution:
@@ -122,10 +122,20 @@ All file operations are restricted to directories listed in the `allowedPaths` w
 | `sudo ...` | Requires admin privileges |
 | `npm install -g ...` | Global package installation |
 | `pip install/uninstall` | Python package management |
-| `chmod -R 777` | Recursive permission modification |
-| `rm -rf ...` | Recursive forced deletion |
+| `chmod -R 777`, `chmod 000`, `chmod a-rwx` | Permission change that renders a file unusable |
+| `chown ...` | Change file owner |
+| `rm -rf ...` (incl. `rm -r -f`, `rm --recursive --force`) | Recursive forced deletion |
+| `dd of=...`, `shred`, `truncate -s 0` | Raw overwrite / destroy / empty a file |
+| `curl`, `wget`, `nc`, `ssh`, `scp` | Outbound network connection |
+| `kill`, `pkill`, `killall` | Terminate processes |
+| `systemctl`, `launchctl`, `crontab`, `sysctl` | System service / scheduled jobs / kernel parameters |
 | `git push --force` | Force push |
 | `shutdown/reboot` | System shutdown/restart |
+| backticks, `$()` command substitution | Statically unclear where the substituted result flows |
+
+> Command substitution (`$(…)`, backticks) is treated as *suspicious syntax*, not a *dangerous effect*: it sits in the greylist (confirm), not the blacklist, and read-only heads such as `echo`/`pwd`/`cd` are exempted so `pwd; echo $(date)` runs directly. Commands **inside** a substitution — including one nested in quotes, e.g. `bash -c "echo \`rm -rf /\`"` — are still checked against the black/grey lists.
+
+> Anti-bypass: privilege prefixes (`sudo` / `doas`) are peeled before matching, so a hard-forbidden action stays `deny` even when wrapped — `sudo rm -rf /usr`, `sudo dd of=/dev/sda`, `sudo sh -c "rm -rf /usr"`, `curl … | sudo sh`. Redirects that overwrite system files match anywhere in the line (`echo x > /etc/passwd`), path spellings are normalized (`rm -rf //usr` ≡ `/usr`), and the root-permission blacklist targets only `/` itself (plain absolute paths like `chmod 777 /tmp/x` fall back to greylist confirm, not a hard block).
 
 ### Authentication
 

package/dist/assets/__vite-browser-external-CM3Eme-n.js

@@ -0,0 +1 @@
+import{t as e}from"./chunk-CMxvf4Kt.js";var t=e(((e,t)=>{t.exports={}}));export{t};

package/dist/assets/agent-store-Ce3f4Ya3.js

@@ -0,0 +1 @@
+import{r as e}from"./chunk-CMxvf4Kt.js";import{a as t,c as n}from"./i18n-ouMgDZ2t.js";import{_ as r,v as i}from"./session-store-CmGs_rhh.js";var a=e({createAgent:()=>m,deleteAgent:()=>g,getActiveAgentId:()=>_,getAgent:()=>p,getAllAgents:()=>d,getCustomAgents:()=>f,setActiveAgentId:()=>v,updateAgent:()=>h});t(`zh`,{agentStore:{unnamedAgent:`未命名Agent`}}),t(`en`,{agentStore:{unnamedAgent:`Unnamed Agent`}});var o=`customAgents`,s=`activeAssistantId`,c=`activeAgentId`,l=!1;async function u(){if(l)return;l=!0;let e=await chrome.storage.local.get([c,s]),t=e[c],n=e[s];t&&!n&&!t.startsWith(`pa_`)&&(await chrome.storage.local.set({[s]:t}),await chrome.storage.local.remove(c))}async function d(){let e=(await chrome.storage.local.get([o]))[o]||[];return[...r,...e]}async function f(){return(await chrome.storage.local.get([o]))[o]||[]}async function p(e){return e&&(await d()).find(t=>t.id===e)||null}async function m(e){let t=await f(),r={id:i(),name:e.name||n(`agentStore.unnamedAgent`),description:e.description||``,icon:e.icon||`🤖`,systemPrompt:e.systemPrompt||``,toolIds:e.toolIds||null,skillIds:e.skillIds||null,mcpExcludedServerIds:e.mcpExcludedServerIds??null,isBuiltin:!1,allowSubDispatch:e.allowSubDispatch===void 0?!1:e.allowSubDispatch,model:e.model||null,temperature:e.temperature===void 0?null:e.temperature,topP:e.topP===void 0?null:e.topP,createdAt:new Date().toISOString(),updatedAt:new Date().toISOString()};return t.push(r),await chrome.storage.local.set({[o]:t}),r}async function h(e,t){let n=await f(),r=n.findIndex(t=>t.id===e);return r===-1?null:(n[r]={...n[r],...t,id:e,isBuiltin:!1,updatedAt:new Date().toISOString()},await chrome.storage.local.set({[o]:n}),n[r])}async function g(e){let t=await f(),n=t.findIndex(t=>t.id===e);return n===-1?!1:(t.splice(n,1),await chrome.storage.local.set({[o]:t}),(await chrome.storage.local.get([s]))[s]===e&&await chrome.storage.local.remove(s),!0)}async function _(){return await u(),(await chrome.storage.local.get([s]))[s]||null}async function v(e){e?await chrome.storage.local.set({[s]:e}):await chrome.storage.local.remove(s)}export{p as a,h as c,_ as i,m as n,d as o,g as r,v as s,a as t};