skyloom 1.5.3 → 1.6.0

package/dist/core/security.d.ts

@@ -0,0 +1,73 @@
+/**
+ * 安全与对齐模块 — Security & Alignment
+ *
+ * Danger level grading, red-line enforcement, audit trail, human-in-the-loop.
+ * All security decisions flow through this module before tool execution.
+ */
+export declare enum DangerLevel {
+    /** Read-only, no side effects — auto-approved */
+    SAFE = 0,
+    /** Minor side effects (write single file, git status) — logged */
+    LOW = 1,
+    /** Significant side effects (overwrite, delete, git push) — notify */
+    MEDIUM = 2,
+    /** Dangerous (sudo, remote deploy, mass delete) — confirm */
+    HIGH = 3,
+    /** Red-line — NEVER execute without human-in-the-loop */
+    CRITICAL = 4
+}
+declare const REDLINE_PATTERNS: RegExp[];
+declare const REDLINE_COMMANDS: string[];
+export interface AuditEntry {
+    ts: string;
+    agent: string;
+    tool: string;
+    args: Record<string, any>;
+    dangerLevel: DangerLevel;
+    approved: boolean;
+    result: string;
+    durationMs: number;
+    traceId: string;
+}
+export declare class SecurityContext {
+    auditLog: AuditEntry[];
+    deniedCount: number;
+    autoApprovedCount: number;
+    manualApprovedCount: number;
+    approvalMode: "auto" | "interactive" | "strict";
+    private approvalCallback;
+    constructor(opts?: {
+        mode?: "auto" | "interactive" | "strict";
+        onApprove?: (tool: string, args: Record<string, any>, level: DangerLevel) => Promise<boolean>;
+    });
+    /** Get the danger level for a tool. Defaults to SAFE for unknown tools. */
+    getDangerLevel(toolName: string): DangerLevel;
+    /** Check if arguments contain red-line patterns (critical danger). */
+    checkRedline(toolName: string, args: Record<string, any>): string | null;
+    /** Determine whether a tool call is permitted. Returns [approved, reason]. */
+    checkApproval(toolName: string, args: Record<string, any>, agentName: string): Promise<[boolean, string]>;
+    /** Record an audit entry. */
+    recordAudit(tool: string, agent: string, args: Record<string, any>, dangerLevel: DangerLevel, approved: boolean, resultPreview: string, durationMs: number, traceId: string): void;
+    /** Get summary statistics. */
+    getStats(): {
+        total: number;
+        denied: number;
+        autoApproved: number;
+        manualApproved: number;
+        byLevel: {
+            safe: number;
+            low: number;
+            medium: number;
+            high: number;
+            critical: number;
+        };
+        lastDenied: string[];
+    };
+    /** Install approval callback for interactive mode. */
+    setApprovalCallback(fn: (tool: string, args: Record<string, any>, level: DangerLevel) => Promise<boolean>): void;
+}
+export declare function getSecurity(): SecurityContext;
+export declare function resetSecurity(): void;
+/** Red-line patterns for reference (used by tools to self-check). */
+export { REDLINE_PATTERNS, REDLINE_COMMANDS };
+//# sourceMappingURL=security.d.ts.map

package/dist/core/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/core/security.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,oBAAY,WAAW;IACrB,iDAAiD;IACjD,IAAI,IAAI;IACR,kEAAkE;IAClE,GAAG,IAAI;IACP,sEAAsE;IACtE,MAAM,IAAI;IACV,6DAA6D;IAC7D,IAAI,IAAI;IACR,yDAAyD;IACzD,QAAQ,IAAI;CACb;AAKD,QAAA,MAAM,gBAAgB,UAMrB,CAAC;AAEF,QAAA,MAAM,gBAAgB,UAGrB,CAAC;AAyDF,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAKD,qBAAa,eAAe;IACnB,QAAQ,EAAE,UAAU,EAAE,CAAM;IAC5B,WAAW,SAAK;IAChB,iBAAiB,SAAK;IACtB,mBAAmB,SAAK;IACxB,YAAY,EAAE,MAAM,GAAG,aAAa,GAAG,QAAQ,CAAU;IAEhE,OAAO,CAAC,gBAAgB,CAAoG;gBAEhH,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,aAAa,GAAG,QAAQ,CAAC;QAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;KAAE;IAK9J,2EAA2E;IAC3E,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW;IAI7C,sEAAsE;IACtE,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,IAAI;IAYxE,8EAA8E;IACxE,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAsC/G,6BAA6B;IAC7B,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAsBlL,8BAA8B;IAC9B,QAAQ;;;;;;;;;;;;;;IAiBR,sDAAsD;IACtD,mBAAmB,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC;CAG1G;AAKD,wBAAgB,WAAW,IAAI,eAAe,CAG7C;AAED,wBAAgB,aAAa,IAAI,IAAI,CAEpC;AAED,qEAAqE;AACrE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/core/security.js

@@ -0,0 +1,220 @@
+"use strict";
+/**
+ * 安全与对齐模块 — Security & Alignment
+ *
+ * Danger level grading, red-line enforcement, audit trail, human-in-the-loop.
+ * All security decisions flow through this module before tool execution.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REDLINE_COMMANDS = exports.REDLINE_PATTERNS = exports.SecurityContext = exports.DangerLevel = void 0;
+exports.getSecurity = getSecurity;
+exports.resetSecurity = resetSecurity;
+const logger_1 = require("./logger");
+const log = (0, logger_1.getLogger)("security");
+/* ── Danger levels ── */
+var DangerLevel;
+(function (DangerLevel) {
+    /** Read-only, no side effects — auto-approved */
+    DangerLevel[DangerLevel["SAFE"] = 0] = "SAFE";
+    /** Minor side effects (write single file, git status) — logged */
+    DangerLevel[DangerLevel["LOW"] = 1] = "LOW";
+    /** Significant side effects (overwrite, delete, git push) — notify */
+    DangerLevel[DangerLevel["MEDIUM"] = 2] = "MEDIUM";
+    /** Dangerous (sudo, remote deploy, mass delete) — confirm */
+    DangerLevel[DangerLevel["HIGH"] = 3] = "HIGH";
+    /** Red-line — NEVER execute without human-in-the-loop */
+    DangerLevel[DangerLevel["CRITICAL"] = 4] = "CRITICAL";
+})(DangerLevel || (exports.DangerLevel = DangerLevel = {}));
+/* ═══════════════════════════════════════
+   Red-line list: operations that are NEVER auto-approved
+   ═══════════════════════════════════════ */
+const REDLINE_PATTERNS = [
+    /rm\s+-rf/, /format\s+\w:/, /dd\s+if=/,
+    />\s*\/dev\/sd/, /mkfs\./, /:(){ :\|:& };:/,
+    /sudo\s+rm/, /chmod\s+777\s+\//, /wget.*\|.*sh/,
+    /curl.*\|.*bash/, /eval\s+\$/, /exec\s+\$/,
+    /subprocess\.call.*rm/, /os\.system.*rm/,
+];
+exports.REDLINE_PATTERNS = REDLINE_PATTERNS;
+const REDLINE_COMMANDS = [
+    "shutdown", "reboot", "init 0", "init 6",
+    "del /f /s /q C:\\*", "rd /s /q C:\\",
+];
+exports.REDLINE_COMMANDS = REDLINE_COMMANDS;
+/* ═══════════════════════════════════════
+   Per-tool danger level mapping
+   ═══════════════════════════════════════ */
+const TOOL_DANGER_MAP = {
+    read_file: DangerLevel.SAFE,
+    list_directory: DangerLevel.SAFE,
+    tree: DangerLevel.SAFE,
+    file_search: DangerLevel.SAFE,
+    code_search: DangerLevel.SAFE,
+    grep: DangerLevel.SAFE,
+    git_status: DangerLevel.SAFE,
+    git_diff: DangerLevel.SAFE,
+    git_log: DangerLevel.SAFE,
+    system_info: DangerLevel.SAFE,
+    system_diagnose: DangerLevel.SAFE,
+    list_processes: DangerLevel.SAFE,
+    list_installed_apps: DangerLevel.SAFE,
+    list_skills: DangerLevel.SAFE,
+    recall_facts: DangerLevel.SAFE,
+    mcp_list_servers: DangerLevel.SAFE,
+    write_file: DangerLevel.LOW,
+    edit_file: DangerLevel.LOW,
+    copy_file: DangerLevel.LOW,
+    move_file: DangerLevel.LOW,
+    http_get: DangerLevel.LOW,
+    fetch_page: DangerLevel.LOW,
+    web_search: DangerLevel.LOW,
+    remember_fact: DangerLevel.LOW,
+    use_skill: DangerLevel.LOW,
+    task_done: DangerLevel.LOW,
+    delete_file: DangerLevel.MEDIUM,
+    git_add: DangerLevel.MEDIUM,
+    git_commit: DangerLevel.MEDIUM,
+    git_checkout: DangerLevel.MEDIUM,
+    http_post: DangerLevel.MEDIUM,
+    mcp_add_server: DangerLevel.MEDIUM,
+    mcp_remove_server: DangerLevel.MEDIUM,
+    launch_app: DangerLevel.MEDIUM,
+    open_path: DangerLevel.MEDIUM,
+    browser_open: DangerLevel.MEDIUM,
+    run_bash: DangerLevel.HIGH,
+    shell_exec: DangerLevel.HIGH,
+    kill_process: DangerLevel.HIGH,
+    package_manager: DangerLevel.HIGH,
+    service_control: DangerLevel.HIGH,
+    delegate_to: DangerLevel.HIGH,
+    mcp_scaffold_server: DangerLevel.HIGH,
+};
+/* ═══════════════════════════════════════
+   Security context — per-session security state
+   ═══════════════════════════════════════ */
+class SecurityContext {
+    constructor(opts) {
+        this.auditLog = [];
+        this.deniedCount = 0;
+        this.autoApprovedCount = 0;
+        this.manualApprovedCount = 0;
+        this.approvalMode = "auto";
+        this.approvalCallback = null;
+        if (opts?.mode)
+            this.approvalMode = opts.mode;
+        if (opts?.onApprove)
+            this.approvalCallback = opts.onApprove;
+    }
+    /** Get the danger level for a tool. Defaults to SAFE for unknown tools. */
+    getDangerLevel(toolName) {
+        return TOOL_DANGER_MAP[toolName] ?? DangerLevel.SAFE;
+    }
+    /** Check if arguments contain red-line patterns (critical danger). */
+    checkRedline(toolName, args) {
+        if (toolName !== "run_bash" && toolName !== "shell_exec")
+            return null;
+        const cmd = String(args.command || args.cmd || "").toLowerCase();
+        for (const pattern of REDLINE_PATTERNS) {
+            if (pattern.test(cmd))
+                return `Red-line pattern detected: ${pattern.source.slice(0, 40)}`;
+        }
+        for (const forbidden of REDLINE_COMMANDS) {
+            if (cmd.includes(forbidden))
+                return `Red-line command: ${forbidden}`;
+        }
+        return null;
+    }
+    /** Determine whether a tool call is permitted. Returns [approved, reason]. */
+    async checkApproval(toolName, args, agentName) {
+        const level = this.getDangerLevel(toolName);
+        // Red-line check
+        const redline = this.checkRedline(toolName, args);
+        if (redline) {
+            log.warn("redline_blocked", { agent: agentName, tool: toolName, reason: redline });
+            return [false, redline];
+        }
+        // Safe — always allow
+        if (level === DangerLevel.SAFE)
+            return [true, "safe"];
+        // Strict mode — deny all non-safe
+        if (this.approvalMode === "strict") {
+            return [false, `Strict mode: tool '${toolName}' (level ${level}) requires manual approval`];
+        }
+        // Auto mode — allow LOW, prompt for MEDIUM+, deny CRITICAL
+        if (this.approvalMode === "auto") {
+            if (level <= DangerLevel.LOW)
+                return [true, "auto-low"];
+            if (level === DangerLevel.CRITICAL)
+                return [false, `CRITICAL tool '${toolName}' requires explicit human approval`];
+            // MEDIUM/HIGH with auto mode => need callback
+            if (this.approvalCallback) {
+                const approved = await this.approvalCallback(toolName, args, level);
+                return [approved, approved ? "user-approved" : "user-denied"];
+            }
+            return [true, "auto-med"]; // no callback → auto-allow but log
+        }
+        // Interactive mode — prompt for LOW+
+        if (this.approvalCallback) {
+            const approved = await this.approvalCallback(toolName, args, level);
+            return [approved, approved ? "user-approved" : "user-denied"];
+        }
+        return [true, "no-callback"];
+    }
+    /** Record an audit entry. */
+    recordAudit(tool, agent, args, dangerLevel, approved, resultPreview, durationMs, traceId) {
+        const entry = {
+            ts: new Date().toISOString(),
+            agent, tool, args, dangerLevel, approved,
+            result: resultPreview.slice(0, 500),
+            durationMs, traceId,
+        };
+        this.auditLog.push(entry);
+        if (this.auditLog.length > 5000)
+            this.auditLog.shift();
+        if (approved) {
+            if (dangerLevel >= DangerLevel.HIGH)
+                this.manualApprovedCount++;
+            else
+                this.autoApprovedCount++;
+        }
+        else {
+            this.deniedCount++;
+        }
+        log.info(dangerLevel >= DangerLevel.HIGH ? "dangerous_tool_executed" : "tool_executed", {
+            tool, agent, level: dangerLevel, approved,
+        });
+    }
+    /** Get summary statistics. */
+    getStats() {
+        return {
+            total: this.auditLog.length,
+            denied: this.deniedCount,
+            autoApproved: this.autoApprovedCount,
+            manualApproved: this.manualApprovedCount,
+            byLevel: {
+                safe: this.auditLog.filter(e => e.dangerLevel === DangerLevel.SAFE).length,
+                low: this.auditLog.filter(e => e.dangerLevel === DangerLevel.LOW).length,
+                medium: this.auditLog.filter(e => e.dangerLevel === DangerLevel.MEDIUM).length,
+                high: this.auditLog.filter(e => e.dangerLevel === DangerLevel.HIGH).length,
+                critical: this.auditLog.filter(e => e.dangerLevel === DangerLevel.CRITICAL).length,
+            },
+            lastDenied: this.auditLog.filter(e => !e.approved).slice(-5).map(e => `${e.tool}: ${e.result}`),
+        };
+    }
+    /** Install approval callback for interactive mode. */
+    setApprovalCallback(fn) {
+        this.approvalCallback = fn;
+    }
+}
+exports.SecurityContext = SecurityContext;
+/* ── Global security context ── */
+let globalSecurity = null;
+function getSecurity() {
+    if (!globalSecurity)
+        globalSecurity = new SecurityContext();
+    return globalSecurity;
+}
+function resetSecurity() {
+    globalSecurity = null;
+}
+//# sourceMappingURL=security.js.map

package/dist/core/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/core/security.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAmOH,kCAGC;AAED,sCAEC;AAxOD,qCAAqC;AAErC,MAAM,GAAG,GAAG,IAAA,kBAAS,EAAC,UAAU,CAAC,CAAC;AAElC,yBAAyB;AACzB,IAAY,WAWX;AAXD,WAAY,WAAW;IACrB,iDAAiD;IACjD,6CAAQ,CAAA;IACR,kEAAkE;IAClE,2CAAO,CAAA;IACP,sEAAsE;IACtE,iDAAU,CAAA;IACV,6DAA6D;IAC7D,6CAAQ,CAAA;IACR,yDAAyD;IACzD,qDAAY,CAAA;AACd,CAAC,EAXW,WAAW,2BAAX,WAAW,QAWtB;AAED;;6CAE6C;AAC7C,MAAM,gBAAgB,GAAG;IACvB,UAAU,EAAY,cAAc,EAAU,UAAU;IACxD,eAAe,EAAO,QAAQ,EAAgB,gBAAgB;IAC9D,WAAW,EAAW,kBAAkB,EAAM,cAAc;IAC5D,gBAAgB,EAAM,WAAW,EAAa,WAAW;IACzD,sBAAsB,EAAE,gBAAgB;CACzC,CAAC;AAgNO,4CAAgB;AA9MzB,MAAM,gBAAgB,GAAG;IACvB,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ;IACxC,oBAAoB,EAAE,eAAe;CACtC,CAAC;AA2MyB,4CAAgB;AAzM3C;;6CAE6C;AAC7C,MAAM,eAAe,GAAgC;IACnD,SAAS,EAAE,WAAW,CAAC,IAAI;IAC3B,cAAc,EAAE,WAAW,CAAC,IAAI;IAChC,IAAI,EAAE,WAAW,CAAC,IAAI;IACtB,WAAW,EAAE,WAAW,CAAC,IAAI;IAC7B,WAAW,EAAE,WAAW,CAAC,IAAI;IAC7B,IAAI,EAAE,WAAW,CAAC,IAAI;IACtB,UAAU,EAAE,WAAW,CAAC,IAAI;IAC5B,QAAQ,EAAE,WAAW,CAAC,IAAI;IAC1B,OAAO,EAAE,WAAW,CAAC,IAAI;IACzB,WAAW,EAAE,WAAW,CAAC,IAAI;IAC7B,eAAe,EAAE,WAAW,CAAC,IAAI;IACjC,cAAc,EAAE,WAAW,CAAC,IAAI;IAChC,mBAAmB,EAAE,WAAW,CAAC,IAAI;IACrC,WAAW,EAAE,WAAW,CAAC,IAAI;IAC7B,YAAY,EAAE,WAAW,CAAC,IAAI;IAC9B,gBAAgB,EAAE,WAAW,CAAC,IAAI;IAElC,UAAU,EAAE,WAAW,CAAC,GAAG;IAC3B,SAAS,EAAE,WAAW,CAAC,GAAG;IAC1B,SAAS,EAAE,WAAW,CAAC,GAAG;IAC1B,SAAS,EAAE,WAAW,CAAC,GAAG;IAC1B,QAAQ,EAAE,WAAW,CAAC,GAAG;IACzB,UAAU,EAAE,WAAW,CAAC,GAAG;IAC3B,UAAU,EAAE,WAAW,CAAC,GAAG;IAC3B,aAAa,EAAE,WAAW,CAAC,GAAG;IAC9B,SAAS,EAAE,WAAW,CAAC,GAAG;IAC1B,SAAS,EAAE,WAAW,CAAC,GAAG;IAE1B,WAAW,EAAE,WAAW,CAAC,MAAM;IAC/B,OAAO,EAAE,WAAW,CAAC,MAAM;IAC3B,UAAU,EAAE,WAAW,CAAC,MAAM;IAC9B,YAAY,EAAE,WAAW,CAAC,MAAM;IAChC,SAAS,EAAE,WAAW,CAAC,MAAM;IAC7B,cAAc,EAAE,WAAW,CAAC,MAAM;IAClC,iBAAiB,EAAE,WAAW,CAAC,MAAM;IACrC,UAAU,EAAE,WAAW,CAAC,MAAM;IAC9B,SAAS,EAAE,WAAW,CAAC,MAAM;IAC7B,YAAY,EAAE,WAAW,CAAC,MAAM;IAEhC,QAAQ,EAAE,WAAW,CAAC,IAAI;IAC1B,UAAU,EAAE,WAAW,CAAC,IAAI;IAC5B,YAAY,EAAE,WAAW,CAAC,IAAI;IAC9B,eAAe,EAAE,WAAW,CAAC,IAAI;IACjC,eAAe,EAAE,WAAW,CAAC,IAAI;IACjC,WAAW,EAAE,WAAW,CAAC,IAAI;IAC7B,mBAAmB,EAAE,WAAW,CAAC,IAAI;CACtC,CAAC;AAiBF;;6CAE6C;AAC7C,MAAa,eAAe;IAS1B,YAAY,IAAkJ;QARvJ,aAAQ,GAAiB,EAAE,CAAC;QAC5B,gBAAW,GAAG,CAAC,CAAC;QAChB,sBAAiB,GAAG,CAAC,CAAC;QACtB,wBAAmB,GAAG,CAAC,CAAC;QACxB,iBAAY,GAAsC,MAAM,CAAC;QAExD,qBAAgB,GAA+F,IAAI,CAAC;QAG1H,IAAI,IAAI,EAAE,IAAI;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC;QAC9C,IAAI,IAAI,EAAE,SAAS;YAAE,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC;IAC9D,CAAC;IAED,2EAA2E;IAC3E,cAAc,CAAC,QAAgB;QAC7B,OAAO,eAAe,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC;IACvD,CAAC;IAED,sEAAsE;IACtE,YAAY,CAAC,QAAgB,EAAE,IAAyB;QACtD,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,YAAY;YAAE,OAAO,IAAI,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACjE,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;YACvC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,8BAA8B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC5F,CAAC;QACD,KAAK,MAAM,SAAS,IAAI,gBAAgB,EAAE,CAAC;YACzC,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,OAAO,qBAAqB,SAAS,EAAE,CAAC;QACvE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,IAAyB,EAAE,SAAiB;QAChF,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAE5C,iBAAiB;QACjB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClD,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACnF,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1B,CAAC;QAED,sBAAsB;QACtB,IAAI,KAAK,KAAK,WAAW,CAAC,IAAI;YAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAEtD,kCAAkC;QAClC,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,CAAC,KAAK,EAAE,sBAAsB,QAAQ,YAAY,KAAK,4BAA4B,CAAC,CAAC;QAC9F,CAAC;QAED,2DAA2D;QAC3D,IAAI,IAAI,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YACjC,IAAI,KAAK,IAAI,WAAW,CAAC,GAAG;gBAAE,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACxD,IAAI,KAAK,KAAK,WAAW,CAAC,QAAQ;gBAAE,OAAO,CAAC,KAAK,EAAE,kBAAkB,QAAQ,oCAAoC,CAAC,CAAC;YACnH,8CAA8C;YAC9C,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBACpE,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;YAChE,CAAC;YACD,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,mCAAmC;QAChE,CAAC;QAED,qCAAqC;QACrC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACpE,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC/B,CAAC;IAED,6BAA6B;IAC7B,WAAW,CAAC,IAAY,EAAE,KAAa,EAAE,IAAyB,EAAE,WAAwB,EAAE,QAAiB,EAAE,aAAqB,EAAE,UAAkB,EAAE,OAAe;QACzK,MAAM,KAAK,GAAe;YACxB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ;YACxC,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACnC,UAAU,EAAE,OAAO;SACpB,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI;YAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAEvD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,WAAW,IAAI,WAAW,CAAC,IAAI;gBAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC;;gBAC3D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,eAAe,EAAE;YACtF,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,8BAA8B;IAC9B,QAAQ;QACN,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;YAC3B,MAAM,EAAE,IAAI,CAAC,WAAW;YACxB,YAAY,EAAE,IAAI,CAAC,iBAAiB;YACpC,cAAc,EAAE,IAAI,CAAC,mBAAmB;YACxC,OAAO,EAAE;gBACP,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM;gBAC1E,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM;gBACxE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM;gBAC9E,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM;gBAC1E,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM;aACnF;YACD,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;SAChG,CAAC;IACJ,CAAC;IAED,sDAAsD;IACtD,mBAAmB,CAAC,EAAqF;QACvG,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAC;IAC7B,CAAC;CACF;AApHD,0CAoHC;AAED,mCAAmC;AACnC,IAAI,cAAc,GAA2B,IAAI,CAAC;AAElD,SAAgB,WAAW;IACzB,IAAI,CAAC,cAAc;QAAE,cAAc,GAAG,IAAI,eAAe,EAAE,CAAC;IAC5D,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAgB,aAAa;IAC3B,cAAc,GAAG,IAAI,CAAC;AACxB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skyloom",
-  "version": "1.5.3",
+  "version": "1.6.0",
   "description": "天空织机 Skyloom — 6 weather-themed AI agents: Fog, Rain, Frost, Snow, Dew, Fair",
   "preferGlobal": true,
   "type": "commonjs",

package/src/core/agent.ts

@@ -222,9 +222,11 @@ export class BaseAgent {
   protected injectBehaviorRules(prompt: string): string {
     const lang = (this.config as any).llm?.language || 'zh';
     if (lang === 'en') {
-      return prompt + `\n\n## Behavior\n- Act, don't narrate. No "I will..." before tool calls.\n- Stay in scope. Do what's asked, then stop.\n- Batch independent tool calls in one response.\n- Verify writes: read back, report verified state.\n- Call list_skills when the task needs specialized capabilities.`;
+      return prompt +
+        `\n\n## Thinking Protocol\nBefore acting, briefly weigh: (1) **What** is the actual need? (2) **How** sure am I? If <80%, flag with [uncertain] and ask.\nIf stuck, admit it — propose a partial answer or ask the user. Never fabricate.\n\n## Behavior\n- Act, don't narrate. No "I will..." before tool calls.\n- Stay in scope. Do what's asked, then stop.\n- Batch independent tool calls in one response.\n- Verify writes: read back, report verified state.\n- Call list_skills when the task needs specialized capabilities.`;
     }
-    return prompt + `\n\n## 行为守则\n- 直接行动,不预告。不说「我将要...」,直接调用工具\n- 不擅自扩大范围。用户要什么做什么,核心完成即止\n- 独立的工具调用一次发出,并行执行\n- 写入后回读验证,汇报已验证状态而非仅尝试\n- 任务涉及专业能力时（PPT/Excel/PDF/网页设计/代码审查等），先调 list_skills 查看可用技能，再用 use_skill 激活`;
+    return prompt +
+      `\n\n## 思考协议\n行动前快速判断：(1) 用户真实需求是什么？(2) 我有多大把握？低于80%标注 [不确定] 并主动询问。\n卡住时承认，给出部分答案或请求用户指导。绝不编造。\n\n## 行为守则\n- 直接行动,不预告。不说「我将要...」,直接调用工具\n- 不擅自扩大范围。用户要什么做什么,核心完成即止\n- 独立的工具调用一次发出,并行执行\n- 写入后回读验证,汇报已验证状态而非仅尝试\n- 任务涉及专业能力时（PPT/Excel/PDF/网页设计/代码审查等），先调 list_skills 查看可用技能，再用 use_skill 激活`;
   }
 
   protected injectProgrammingWisdom(prompt: string): string {
@@ -1401,12 +1403,20 @@ export class BaseAgent {
     }
   }
 
+  private _security: any = null;
+  get security(): any { if (!this._security) { try { const { getSecurity } = require('./security'); this._security = getSecurity(); } catch { this._security = {}; } } return this._security; }
+
   protected async checkToolApproval(toolName: string, toolArgs: Record<string, any>): Promise<boolean> {
+    try {
+      const sec = this.security;
+      if (sec?.checkApproval) {
+        const [approved, reason] = await sec.checkApproval(toolName, toolArgs, this.name);
+        if (!approved) log.warn('tool_blocked', { tool: toolName, agent: this.name, reason });
+        return approved;
+      }
+    } catch { /* fall through */ }
     const mode = (this.config as any).cli?.approvalMode || 'auto';
     if (mode === 'strict') return false;
-    if (mode === 'interactive' && this.approvalCallback) {
-      return this.approvalCallback(toolName, toolArgs);
-    }
     return true;
   }
 

package/src/core/learn.ts

@@ -0,0 +1,146 @@
+/**
+ * 持续学习模块 — post-task review + experience recording.
+ *
+ * After each task, the agent writes a structured review.
+ * Failed attempts are indexed for similarity search to avoid repetition.
+ */
+
+import * as fs from "fs";
+import * as path from "path";
+import { USER_CONFIG_DIR } from "./config";
+import { getLogger } from "./logger";
+
+const log = getLogger("learn");
+
+/* ── Data types ── */
+export interface TaskReview {
+  ts: string;
+  agent: string;
+  goal: string;
+  success: boolean;
+  durationMs: number;
+  toolCalls: string[];
+  errorMsg?: string;
+  rootCause?: string;
+  improvement?: string;
+}
+
+export interface ExperienceEntry {
+  id: string;
+  pattern: string;       // What went wrong (key for similarity search)
+  solution: string;      // What fixed it
+  frequency: number;     // How often this pattern repeats
+  lastSeen: string;
+}
+
+/* ── Persistence ── */
+const reviewDir = path.join(USER_CONFIG_DIR, "reviews");
+const expFile = path.join(USER_CONFIG_DIR, "experiences.json");
+const reviewDir_ = reviewDir; // for closure
+
+function ensureDir() { if (!fs.existsSync(reviewDir_)) fs.mkdirSync(reviewDir_, { recursive: true }); }
+
+/* ═══════════════════════════════════════
+   Task Review Recording
+   ═══════════════════════════════════════ */
+export function recordReview(review: TaskReview): void {
+  ensureDir();
+  const file = path.join(reviewDir_, `${review.ts.slice(0, 10)}_${review.agent}.jsonl`);
+  const line = JSON.stringify(review);
+  fs.appendFileSync(file, line + "\n");
+  log.debug("review_recorded", { agent: review.agent, success: review.success });
+
+  // If failed, also record as experience
+  if (!review.success && review.errorMsg) {
+    recordExperience(review.errorMsg, review.rootCause || "unknown", review.improvement || "no improvement noted");
+  }
+}
+
+/* ═══════════════════════════════════════
+   Experience Recording (for failure patterns)
+   ═══════════════════════════════════════ */
+function loadExperiences(): ExperienceEntry[] {
+  try {
+    if (fs.existsSync(expFile)) return JSON.parse(fs.readFileSync(expFile, "utf-8"));
+  } catch { /* ignore */ }
+  return [];
+}
+
+function saveExperiences(entries: ExperienceEntry[]): void {
+  ensureDir();
+  fs.writeFileSync(expFile, JSON.stringify(entries, null, 2), "utf-8");
+}
+
+export function recordExperience(errorPattern: string, rootCause: string, solution: string): void {
+  const entries = loadExperiences();
+  const normalized = errorPattern.toLowerCase().slice(0, 200);
+
+  // Check for existing similar pattern (simple substring match)
+  const existing = entries.find(e => e.pattern.toLowerCase().includes(normalized.slice(0, 50)) || normalized.includes(e.pattern.toLowerCase().slice(0, 50)));
+  if (existing) {
+    existing.frequency++;
+    existing.lastSeen = new Date().toISOString();
+    if (solution && solution !== "no improvement noted") existing.solution = solution;
+  } else {
+    entries.push({
+      id: Math.random().toString(36).slice(2, 10),
+      pattern: errorPattern.slice(0, 200),
+      solution,
+      frequency: 1,
+      lastSeen: new Date().toISOString(),
+    });
+  }
+
+  // Keep top 100 experiences, sorted by frequency
+  entries.sort((a, b) => b.frequency - a.frequency);
+  if (entries.length > 100) entries.splice(100);
+  saveExperiences(entries);
+}
+
+/* ═══════════════════════════════════════
+   Query experiences
+   ═══════════════════════════════════════ */
+export function queryExperiences(problem: string, limit: number = 3): ExperienceEntry[] {
+  const entries = loadExperiences();
+  const lower = problem.toLowerCase();
+  return entries
+    .filter(e => {
+      const plow = e.pattern.toLowerCase();
+      // Simple token overlap scoring
+      const tokens = lower.split(/\s+/).filter(t => t.length > 2);
+      const matches = tokens.filter(t => plow.includes(t));
+      return matches.length >= 2;
+    })
+    .sort((a, b) => b.frequency - a.frequency)
+    .slice(0, limit);
+}
+
+/* ═══════════════════════════════════════
+   Format experiences for system prompt injection
+   ═══════════════════════════════════════ */
+export function formatExperiencesForPrompt(problem: string): string {
+  const exps = queryExperiences(problem);
+  if (!exps.length) return "";
+  const lines = ["## 历史教训（从经验库检索）", "以下是与当前任务相关的过往失败案例，请避免重复："];
+  for (const e of exps) {
+    lines.push(`- **模式**: ${e.pattern.slice(0, 120)}`);
+    lines.push(`  **解决**: ${e.solution.slice(0, 200)} (出现 ${e.frequency} 次)`);
+  }
+  return lines.join("\n");
+}
+
+/* ═══════════════════════════════════════
+   Generate a structured review after task completion
+   ═══════════════════════════════════════ */
+export function generateReview(
+  agent: string, goal: string, success: boolean, durationMs: number,
+  toolCalls: string[], errorMsg?: string
+): TaskReview {
+  return {
+    ts: new Date().toISOString(),
+    agent, goal, success, durationMs, toolCalls,
+    errorMsg,
+    rootCause: errorMsg ? "auto-detected failure" : undefined,
+    improvement: errorMsg ? "review error and adjust approach" : undefined,
+  };
+}