langchain-agentx-python 0.1__py3-none-any.whl

langchain_agentx/tools/bash/security.py

@@ -0,0 +1,311 @@
+"""
+tools/bash/security.py — BashRuntimeTool 基础安全检查
+
+v1 实现"可用性优先"的安全防护，防止常见误操作。
+v2 将引入 AST 级分析（对应 CC bashSecurity.ts 的 2593 行）。
+
+对应 CC：
+    destructiveCommandWarning.ts  → detect_destructive_patterns()
+    BashTool.tsx::validateInput() → detect_sleep_block() / detect_interactive_command()
+    bashSecurity.ts (部分)        → detect_infinite_output()
+
+安全层次（纵深防御）：
+    validate_input 层（阻断）：sleep 大值、交互式命令、无限输出、空命令
+    invoke 层（警告不阻断）：危险命令 → 注入 warning hint
+"""
+
+from __future__ import annotations
+
+import re
+import shlex
+
+from .read_only_validation import BashReadOnlyClassifier
+
+
+# ---------------------------------------------------------------------------
+# 危险命令模式（对应 CC destructiveCommandWarning.ts::DESTRUCTIVE_PATTERNS）
+# ---------------------------------------------------------------------------
+
+# (正则模式, 警告描述)
+_DESTRUCTIVE_PATTERNS: list[tuple[re.Pattern[str], str]] = [
+    # rm -rf / 或 rm -rf /path（根目录及其下一级）
+    (
+        re.compile(r"\brm\b.*-[^-\s]*[rf]{2}.*\s/(?:[^/\s]+)?(?:\s|$)"),
+        "Dangerous: rm -rf targeting root or system path",
+    ),
+    # rm -rf 整体（任意路径，提示风险）
+    (
+        re.compile(r"\brm\b.*-[^-\s]*[rf]{1,2}"),
+        "Potentially destructive: recursive remove with force flag",
+    ),
+    # chmod 777 或 chmod a+rwx（全权限）
+    (
+        re.compile(r"\bchmod\b.*(?:0*777|a\+rwx|ugo\+rwx)"),
+        "Dangerous: granting full permissions to all users",
+    ),
+    # dd 直接写入设备
+    (
+        re.compile(r"\bdd\b.*\bof=/dev/(?!null\b)"),
+        "Dangerous: direct device write via dd",
+    ),
+    # 重定向到非 /dev/null 的设备文件
+    (
+        re.compile(r">\s*/dev/(?!null\b)"),
+        "Dangerous: redirecting output to a device file",
+    ),
+    # mkfs 格式化
+    (
+        re.compile(r"\bmkfs\b"),
+        "Dangerous: filesystem creation (mkfs)",
+    ),
+    # fdisk 分区操作
+    (
+        re.compile(r"\bfdisk\b.*\b/dev/"),
+        "Dangerous: disk partition operation (fdisk)",
+    ),
+    # :(){:|:&};: Fork Bomb
+    (
+        re.compile(r":\(\)\{.*:\|.*:.*\}"),
+        "Dangerous: fork bomb pattern detected",
+    ),
+]
+
+# ---------------------------------------------------------------------------
+# 无限输出命令（对应 CC BLOCKED_DEVICE_PATHS 的命令级等价）
+# ---------------------------------------------------------------------------
+
+# 命令基础名称 → 会无限输出（无配合 head/timeout 等限制时）
+_INFINITE_OUTPUT_BASE_COMMANDS: frozenset[str] = frozenset({
+    "yes",
+    "cat",  # 仅当目标为特定设备文件时，见 _INFINITE_DEVICE_ARGS
+    "tail",  # 仅当使用 -f 且目标为设备文件时
+})
+
+# 与无限输出相关的设备文件路径
+_INFINITE_DEVICE_PATHS: frozenset[str] = frozenset({
+    "/dev/urandom",
+    "/dev/random",
+    "/dev/zero",
+    "/dev/full",
+})
+
+# 需要 TTY 的交互式命令（对应 CC 中用户体验层面的保护）
+_INTERACTIVE_COMMANDS: frozenset[str] = frozenset({
+    "vim", "vi", "nvim", "nano", "emacs", "pico",
+    "top", "htop", "btop", "iotop", "atop",
+    "less", "more",
+    "ipython", "bpython",
+    "node",                 # 无参数时进入 REPL
+    "irb", "pry",
+    "mysql", "psql", "sqlite3", "redis-cli", "mongo",
+    "python", "python3",    # 无参数时进入 REPL
+    "gdb", "lldb",
+    "ftp", "sftp",
+})
+
+
+# ---------------------------------------------------------------------------
+# 公开 API
+# ---------------------------------------------------------------------------
+
+
+def detect_destructive_patterns(command: str) -> str | None:
+    """
+    检测命令中的危险操作模式。
+
+    返回：
+        str  — 警告文本（不阻断执行，在 present() 中作为 hint 展示）
+        None — 无危险模式
+    """
+    for pattern, warning in _DESTRUCTIVE_PATTERNS:
+        if pattern.search(command):
+            return warning
+    return None
+
+
+def detect_infinite_output(command: str) -> bool:
+    """
+    检测命令是否会产生无限输出，导致进程挂起。
+
+    策略：
+    - `yes` 单独或作为管道起点（无 head/timeout 等限制时）
+    - `cat /dev/urandom` 等读取无限设备文件
+    - `tail -f /dev/urandom` 等
+
+    注意：`yes | head -n 5` 是合法的（有 head 截断），不阻断。
+    """
+    stripped = command.strip()
+
+    # 如果有管道，提取第一个命令检查
+    # 有管道终结命令（head/timeout/take）时不阻断
+    parts = _split_pipeline(stripped)
+
+    # 检查是否有 head / timeout / wc 等截断命令
+    has_limiter = any(
+        _get_base_cmd(p) in {"head", "timeout", "wc", "tail", "tee", "take"}
+        for p in parts[1:]  # 第二个之后的管道部分
+    )
+
+    first_cmd = parts[0] if parts else stripped
+    base = _get_base_cmd(first_cmd)
+
+    # yes 命令：单独使用时无限输出
+    if base == "yes" and not has_limiter:
+        return True
+
+    # cat/tail 读取设备文件
+    if base in {"cat", "tail"}:
+        for dev_path in _INFINITE_DEVICE_PATHS:
+            if dev_path in first_cmd:
+                return True
+
+    return False
+
+
+def detect_sleep_block(command: str, threshold_sec: int) -> int | None:
+    """
+    检测 sleep N 中 N >= threshold_sec 的情况。
+
+    返回：
+        int  — 检测到的 sleep 时长（秒），提示模型使用 run_in_background
+        None — 未检测到阻塞性 sleep
+
+    对应 CC BashTool.tsx::detectBlockedSleepPattern()。
+
+    注意：
+    - `sleep 1.5` 等浮点数秒数 < threshold 时不阻断
+    - `sleep 5 && cmd` 如果 sleep_sec < threshold 则不阻断
+    - 支持 `sleep 5m`、`sleep 2h` 等带单位格式
+    """
+    # 匹配 sleep N（支持 s/m/h/d 单位）
+    m = re.search(r"\bsleep\s+(\d+(?:\.\d+)?)([smhd]?)\b", command)
+    if not m:
+        return None
+
+    val = float(m.group(1))
+    unit = m.group(2)
+
+    # 转换为秒
+    unit_multipliers = {"": 1, "s": 1, "m": 60, "h": 3600, "d": 86400}
+    total_sec = val * unit_multipliers.get(unit, 1)
+
+    if total_sec >= threshold_sec:
+        return int(total_sec)
+    return None
+
+
+def detect_interactive_command(command: str) -> str | None:
+    """
+    检测命令是否需要 TTY（交互式命令）。
+
+    返回：
+        str  — 交互式命令名称（用于错误消息）
+        None — 无交互式命令
+
+    策略：
+    - 仅检测命令基础名（无参数的 python / node 等进入 REPL）
+    - `python script.py` 不阻断（有参数，非 REPL）
+    - `vim` / `nano` 等编辑器无论参数均阻断
+    """
+    stripped = command.strip()
+
+    # 尝试解析命令的第一个 token
+    base = _get_base_cmd(stripped)
+
+    # 文本编辑器：始终阻断
+    _always_block = {"vim", "vi", "nvim", "nano", "emacs", "pico", "less", "more"}
+    # 系统监控：始终阻断
+    _always_block |= {"top", "htop", "btop", "iotop", "atop"}
+    # DB 客户端：始终阻断
+    _always_block |= {"mysql", "psql", "sqlite3", "redis-cli", "mongo"}
+
+    if base in _always_block:
+        return base
+
+    # REPL 命令：只有无参数或仅 flag 参数时阻断
+    _repl_commands = {"python", "python3", "python2", "node", "ipython", "bpython",
+                      "irb", "pry", "gdb", "lldb", "ftp", "sftp"}
+    if base in _repl_commands:
+        # 检查是否有非 flag 的参数（如文件名、脚本）
+        try:
+            tokens = shlex.split(stripped)
+        except ValueError:
+            tokens = stripped.split()
+
+        # 跳过命令名，检查其余 token
+        args = [t for t in tokens[1:] if not t.startswith("-")]
+        if not args:
+            # 没有非 flag 参数 → 进入 REPL 模式
+            return base
+
+    return None
+
+
+def is_read_only_command(command: str) -> bool:
+    """
+    检测命令是否为只读操作（无副作用）。
+
+    用于工具的 is_read_only 动态判断。
+    对应 CC checkReadOnlyConstraints() 的简化版本（v1）。
+    """
+    classifier = BashReadOnlyClassifier()
+    return classifier.classify(command).is_read_only
+
+
+# ---------------------------------------------------------------------------
+# 内部辅助
+# ---------------------------------------------------------------------------
+
+
+def _get_base_cmd(command: str) -> str:
+    """提取命令的基础名（去掉路径前缀和参数）。"""
+    stripped = command.strip()
+    if not stripped:
+        return ""
+    # 取第一个 token
+    try:
+        tokens = shlex.split(stripped)
+    except ValueError:
+        tokens = stripped.split()
+    if not tokens:
+        return ""
+    cmd = tokens[0]
+    # 去掉路径前缀（/usr/bin/python → python）
+    return cmd.rsplit("/", 1)[-1]
+
+
+def _split_pipeline(command: str) -> list[str]:
+    """
+    简单分割管道命令（仅按 | 分割，不做完整 AST 解析）。
+    v2 改为 AST 分析。
+    """
+    # 简单字符串分割，不处理引号内的 |
+    parts = []
+    current = []
+    in_single = False
+    in_double = False
+    i = 0
+    while i < len(command):
+        c = command[i]
+        if c == "'" and not in_double:
+            in_single = not in_single
+            current.append(c)
+        elif c == '"' and not in_single:
+            in_double = not in_double
+            current.append(c)
+        elif c == "|" and not in_single and not in_double:
+            # 跳过 || （逻辑 OR）
+            if i + 1 < len(command) and command[i + 1] == "|":
+                current.append("||")
+                i += 2
+                continue
+            parts.append("".join(current).strip())
+            current = []
+        else:
+            current.append(c)
+        i += 1
+
+    if current:
+        parts.append("".join(current).strip())
+
+    return [p for p in parts if p]

langchain_agentx/tools/bash/sed_edit_parser.py

@@ -0,0 +1,243 @@
+"""
+tools/bash/sed_edit_parser.py — BashRuntimeTool 模块2：sed 编辑解析与预览
+
+职责：
+    为 `sed -i` 可控编辑工作流提供“可确定 preview”的解析能力，包括：
+    1. 识别 simple in-place substitution 命令
+    2. 提取 file / pattern / replacement / flags / extended-regex 信息
+    3. 在内存中模拟 sed substitution，生成 preview diff
+
+设计边界：
+    - 只处理 simple `sed -i 's/from/to/flags' file` 这类可稳定预览的场景
+    - 遇到多文件、未知 flag、无法稳定解析的表达式时返回 None
+    - 不负责权限决策；是否进入 preview/apply 流由 `sed_validation.py` 决定
+
+与 CC 对照：
+    对应 CC `sedEditParser.ts` 的 Python 化版本，但保持当前阶段需要的最小可用
+    范围，不复制其全部兼容细节。
+"""
+
+from __future__ import annotations
+
+import difflib
+import re
+import shlex
+from dataclasses import dataclass
+
+
+_BACKSLASH_PLACEHOLDER = "\x00BACKSLASH\x00"
+_PLUS_PLACEHOLDER = "\x00PLUS\x00"
+_QUESTION_PLACEHOLDER = "\x00QUESTION\x00"
+_PIPE_PLACEHOLDER = "\x00PIPE\x00"
+_LPAREN_PLACEHOLDER = "\x00LPAREN\x00"
+_RPAREN_PLACEHOLDER = "\x00RPAREN\x00"
+
+
+@dataclass(frozen=True)
+class SedEditInfo:
+    file_path: str
+    pattern: str
+    replacement: str
+    flags: str
+    extended_regex: bool
+
+
+class BashSedEditParser:
+    """解析 simple `sed -i 's/a/b/' file` 命令，并生成 preview。"""
+
+    _VALID_FLAGS = re.compile(r"^[gpimIM1-9]*$")
+
+    def parse(self, command: str) -> SedEditInfo | None:
+        trimmed = command.strip()
+        if not re.match(r"^\s*sed\s+", trimmed):
+            return None
+
+        try:
+            tokens = shlex.split(trimmed)
+        except ValueError:
+            return None
+
+        if not tokens or tokens[0] != "sed":
+            return None
+
+        has_in_place = False
+        extended_regex = False
+        expression: str | None = None
+        file_path: str | None = None
+
+        i = 1
+        while i < len(tokens):
+            arg = tokens[i]
+            if arg in {"-i", "--in-place"}:
+                has_in_place = True
+                i += 1
+                if i < len(tokens):
+                    next_arg = tokens[i]
+                    if next_arg == "" or (not next_arg.startswith("-") and next_arg.startswith(".")):
+                        i += 1
+                continue
+            if arg.startswith("-i"):
+                has_in_place = True
+                i += 1
+                continue
+            if arg in {"-E", "-r", "--regexp-extended"}:
+                extended_regex = True
+                i += 1
+                continue
+            if arg in {"-e", "--expression"}:
+                if i + 1 >= len(tokens) or expression is not None:
+                    return None
+                expression = tokens[i + 1]
+                i += 2
+                continue
+            if arg.startswith("--expression="):
+                if expression is not None:
+                    return None
+                expression = arg.split("=", 1)[1]
+                i += 1
+                continue
+            if arg.startswith("-"):
+                return None
+            if expression is None:
+                expression = arg
+            elif file_path is None:
+                file_path = arg
+            else:
+                return None
+            i += 1
+
+        if not has_in_place or not expression or not file_path:
+            return None
+        if not expression.startswith("s/"):
+            return None
+
+        parsed_expression = self._parse_substitution_expression(
+            expression=expression,
+            file_path=file_path,
+            extended_regex=extended_regex,
+        )
+        return parsed_expression
+
+    def apply_substitution(self, content: str, sed_info: SedEditInfo) -> str:
+        regex_flags = ""
+        if "g" in sed_info.flags:
+            regex_flags += "g"
+        if "i" in sed_info.flags or "I" in sed_info.flags:
+            regex_flags += "i"
+        if "m" in sed_info.flags or "M" in sed_info.flags:
+            regex_flags += "m"
+
+        js_pattern = sed_info.pattern.replace(r"\/", "/")
+        if not sed_info.extended_regex:
+            js_pattern = (
+                js_pattern
+                .replace(r"\\", _BACKSLASH_PLACEHOLDER)
+                .replace(r"\+", _PLUS_PLACEHOLDER)
+                .replace(r"\?", _QUESTION_PLACEHOLDER)
+                .replace(r"\|", _PIPE_PLACEHOLDER)
+                .replace(r"\(", _LPAREN_PLACEHOLDER)
+                .replace(r"\)", _RPAREN_PLACEHOLDER)
+                .replace("+", r"\+")
+                .replace("?", r"\?")
+                .replace("|", r"\|")
+                .replace("(", r"\(")
+                .replace(")", r"\)")
+                .replace(_BACKSLASH_PLACEHOLDER, r"\\")
+                .replace(_PLUS_PLACEHOLDER, "+")
+                .replace(_QUESTION_PLACEHOLDER, "?")
+                .replace(_PIPE_PLACEHOLDER, "|")
+                .replace(_LPAREN_PLACEHOLDER, "(")
+                .replace(_RPAREN_PLACEHOLDER, ")")
+            )
+
+        replacement = (
+            sed_info.replacement
+            .replace(r"\/", "/")
+            .replace(r"\&", "__ESCAPED_AMP__")
+            .replace("&", "$$&")
+            .replace("__ESCAPED_AMP__", "&")
+        )
+
+        try:
+            regex = re.compile(js_pattern, flags=self._to_python_flags(regex_flags))
+        except re.error:
+            return content
+        return regex.sub(replacement, content)
+
+    def build_preview(self, *, original: str, updated: str, file_path: str) -> str:
+        diff = list(
+            difflib.unified_diff(
+                original.splitlines(),
+                updated.splitlines(),
+                fromfile=f"{file_path} (before)",
+                tofile=f"{file_path} (after)",
+                lineterm="",
+                n=3,
+            )
+        )
+        if not diff:
+            return f"Preview for {file_path}: no textual changes."
+        preview = "\n".join(diff[:60])
+        return f"Preview for {file_path}:\n```diff\n{preview}\n```"
+
+    def _parse_substitution_expression(
+        self,
+        *,
+        expression: str,
+        file_path: str,
+        extended_regex: bool,
+    ) -> SedEditInfo | None:
+        rest = expression[2:]
+        pattern = ""
+        replacement = ""
+        flags = ""
+        state = "pattern"
+        i = 0
+        while i < len(rest):
+            char = rest[i]
+            if char == "\\" and i + 1 < len(rest):
+                value = char + rest[i + 1]
+                if state == "pattern":
+                    pattern += value
+                elif state == "replacement":
+                    replacement += value
+                else:
+                    flags += value
+                i += 2
+                continue
+            if char == "/":
+                if state == "pattern":
+                    state = "replacement"
+                elif state == "replacement":
+                    state = "flags"
+                else:
+                    return None
+                i += 1
+                continue
+            if state == "pattern":
+                pattern += char
+            elif state == "replacement":
+                replacement += char
+            else:
+                flags += char
+            i += 1
+        if state != "flags":
+            return None
+        if not self._VALID_FLAGS.match(flags):
+            return None
+        return SedEditInfo(
+            file_path=file_path,
+            pattern=pattern,
+            replacement=replacement,
+            flags=flags,
+            extended_regex=extended_regex,
+        )
+
+    @staticmethod
+    def _to_python_flags(flag_text: str) -> int:
+        value = 0
+        if "i" in flag_text:
+            value |= re.IGNORECASE
+        if "m" in flag_text:
+            value |= re.MULTILINE
+        return value