ssh-licco 2.1.4__tar.gz → 2.2.0__tar.gz

{ssh_licco-2.1.4/ssh_licco.egg-info → ssh_licco-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ssh-licco
-Version: 2.1.4
+Version: 2.2.0
 Summary: SSH Model Context Protocol Server - Enable SSH functionality for AI models
 Author-email: SSH LICCO Team <contact@ssh-licco.dev>
 License: MIT
@@ -235,6 +235,27 @@ export SSH_EXTRA_ALLOWED_COMMANDS="git,pip,npm"
 - **[SECURITY_CONFIG_GUIDE.md](SECURITY_CONFIG_GUIDE.md)** - 安全配置详解
 - **[docs/SECURITY_HARDENING.md](docs/SECURITY_HARDENING.md)** - 生产加固四项方案（v2.1.0 新增）
 
+### 🛡️ 硬拦截灾难性命令（v2.2.0 新增）
+
+为防止任何误操作或越权调用直接打到远程 shell，ssh-licco 在所有安全级别下都**无条件**拦截以下灾难性命令模式，**无法通过 `confirm_dangerous=true`、`confirmation_layer=N`、调整 `SSH_SECURITY_LEVEL` 等任何方式绕过**：
+
+- `rm -rf` 作用于绝对路径（含 `/`、`/*`、`/path`、`/path/*`，`-fr` 变体同效）
+- `mkfs.*` 任意文件系统格式化
+- `dd if=/dev/(zero|random|urandom) of=/dev/(sd|nvme)` 覆写裸盘
+- bash fork-bomb（`:(){ :|:& };:` 及空白变体）
+- `chmod -R 777 /` / `chmod -R 000 /` 根目录递归改权限
+- `> /dev/(sd|nvme)` / `>> /dev/(sd|nvme)` 裸设备重定向
+
+如确需执行上述操作，请直接通过 SSH 登录服务器（绕过 MCP 网关）进行。安全且可逆的替代方案：
+
+```bash
+# 旧做法（v2.2.0 之前）：rm -rf /path/to/junk  ← 现已被硬拦截
+# 推荐做法：mv 到回收站，约定时间后清理
+mv /path/to/junk /tmp/.trash_$(date +%s)/
+```
+
+命中硬拦截时会输出 `WARNING` 审计日志（含 category 与命令），便于 SOC 监控。
+
 ### 🏛️ 生产加固四项（v2.1.0 新增）
 
 SSH 跳板模式部署的生产必做加固，补齐跳板机单点风险：
@@ -591,7 +612,7 @@ ssh-licco 的核心依赖是：
 
 | 指标 | 状态 |
 |------|------|
-| **测试用例** | 348 passed, 0 skipped |
+| **测试用例** | 400 passed, 0 skipped |
 | **覆盖率** | 16 个源模块全覆盖 |
 | **测试框架** | pytest + pytest-asyncio |
 

{ssh_licco-2.1.4 → ssh_licco-2.2.0}/README.md

@@ -202,6 +202,27 @@ export SSH_EXTRA_ALLOWED_COMMANDS="git,pip,npm"
 - **[SECURITY_CONFIG_GUIDE.md](SECURITY_CONFIG_GUIDE.md)** - 安全配置详解
 - **[docs/SECURITY_HARDENING.md](docs/SECURITY_HARDENING.md)** - 生产加固四项方案（v2.1.0 新增）
 
+### 🛡️ 硬拦截灾难性命令（v2.2.0 新增）
+
+为防止任何误操作或越权调用直接打到远程 shell，ssh-licco 在所有安全级别下都**无条件**拦截以下灾难性命令模式，**无法通过 `confirm_dangerous=true`、`confirmation_layer=N`、调整 `SSH_SECURITY_LEVEL` 等任何方式绕过**：
+
+- `rm -rf` 作用于绝对路径（含 `/`、`/*`、`/path`、`/path/*`，`-fr` 变体同效）
+- `mkfs.*` 任意文件系统格式化
+- `dd if=/dev/(zero|random|urandom) of=/dev/(sd|nvme)` 覆写裸盘
+- bash fork-bomb（`:(){ :|:& };:` 及空白变体）
+- `chmod -R 777 /` / `chmod -R 000 /` 根目录递归改权限
+- `> /dev/(sd|nvme)` / `>> /dev/(sd|nvme)` 裸设备重定向
+
+如确需执行上述操作，请直接通过 SSH 登录服务器（绕过 MCP 网关）进行。安全且可逆的替代方案：
+
+```bash
+# 旧做法（v2.2.0 之前）：rm -rf /path/to/junk  ← 现已被硬拦截
+# 推荐做法：mv 到回收站，约定时间后清理
+mv /path/to/junk /tmp/.trash_$(date +%s)/
+```
+
+命中硬拦截时会输出 `WARNING` 审计日志（含 category 与命令），便于 SOC 监控。
+
 ### 🏛️ 生产加固四项（v2.1.0 新增）
 
 SSH 跳板模式部署的生产必做加固，补齐跳板机单点风险：
@@ -558,7 +579,7 @@ ssh-licco 的核心依赖是：
 
 | 指标 | 状态 |
 |------|------|
-| **测试用例** | 348 passed, 0 skipped |
+| **测试用例** | 400 passed, 0 skipped |
 | **覆盖率** | 16 个源模块全覆盖 |
 | **测试框架** | pytest + pytest-asyncio |
 

{ssh_licco-2.1.4 → ssh_licco-2.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "ssh-licco"
-version = "2.1.4"
+version = "2.2.0"
 description = "SSH Model Context Protocol Server - Enable SSH functionality for AI models"
 readme = "README.md"
 requires-python = ">=3.10"

{ssh_licco-2.1.4 → ssh_licco-2.2.0/ssh_licco.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ssh-licco
-Version: 2.1.4
+Version: 2.2.0
 Summary: SSH Model Context Protocol Server - Enable SSH functionality for AI models
 Author-email: SSH LICCO Team <contact@ssh-licco.dev>
 License: MIT
@@ -235,6 +235,27 @@ export SSH_EXTRA_ALLOWED_COMMANDS="git,pip,npm"
 - **[SECURITY_CONFIG_GUIDE.md](SECURITY_CONFIG_GUIDE.md)** - 安全配置详解
 - **[docs/SECURITY_HARDENING.md](docs/SECURITY_HARDENING.md)** - 生产加固四项方案（v2.1.0 新增）
 
+### 🛡️ 硬拦截灾难性命令（v2.2.0 新增）
+
+为防止任何误操作或越权调用直接打到远程 shell，ssh-licco 在所有安全级别下都**无条件**拦截以下灾难性命令模式，**无法通过 `confirm_dangerous=true`、`confirmation_layer=N`、调整 `SSH_SECURITY_LEVEL` 等任何方式绕过**：
+
+- `rm -rf` 作用于绝对路径（含 `/`、`/*`、`/path`、`/path/*`，`-fr` 变体同效）
+- `mkfs.*` 任意文件系统格式化
+- `dd if=/dev/(zero|random|urandom) of=/dev/(sd|nvme)` 覆写裸盘
+- bash fork-bomb（`:(){ :|:& };:` 及空白变体）
+- `chmod -R 777 /` / `chmod -R 000 /` 根目录递归改权限
+- `> /dev/(sd|nvme)` / `>> /dev/(sd|nvme)` 裸设备重定向
+
+如确需执行上述操作，请直接通过 SSH 登录服务器（绕过 MCP 网关）进行。安全且可逆的替代方案：
+
+```bash
+# 旧做法（v2.2.0 之前）：rm -rf /path/to/junk  ← 现已被硬拦截
+# 推荐做法：mv 到回收站，约定时间后清理
+mv /path/to/junk /tmp/.trash_$(date +%s)/
+```
+
+命中硬拦截时会输出 `WARNING` 审计日志（含 category 与命令），便于 SOC 监控。
+
 ### 🏛️ 生产加固四项（v2.1.0 新增）
 
 SSH 跳板模式部署的生产必做加固，补齐跳板机单点风险：
@@ -591,7 +612,7 @@ ssh-licco 的核心依赖是：
 
 | 指标 | 状态 |
 |------|------|
-| **测试用例** | 348 passed, 0 skipped |
+| **测试用例** | 400 passed, 0 skipped |
 | **覆盖率** | 16 个源模块全覆盖 |
 | **测试框架** | pytest + pytest-asyncio |
 

{ssh_licco-2.1.4 → ssh_licco-2.2.0}/ssh_mcp/__init__.py

@@ -1,8 +1,8 @@
 # SSH-LICCO 版本信息
 # 所有代码中的版本信息都从这里读取
-# 版本号：2.1.4
+# 版本号：2.2.0
 
-__version__ = "2.1.4"
+__version__ = "2.2.0"
 __author__ = "Li Qi"
 __email__ = "1985694657@qq.com"
 __license__ = "MIT"

{ssh_licco-2.1.4 → ssh_licco-2.2.0}/ssh_mcp/handlers/execute.py

@@ -107,6 +107,27 @@ async def handle_execute(ctx: HandlerContext, args: dict) -> list[TextContent]:
     if confirmation_message:
         ctx.logger.info(f"Multi-layer confirmation passed: {confirmation_message}")
 
+    # 硬拦截：与安全级别、confirm_dangerous、confirmation_layer 都无关，任何情况下都生效
+    try:
+        command_validator.check_hard_block(command)
+    except SecurityError as e:
+        ctx.logger.error(f"Command hard-blocked: {e}")
+        return [
+            TextContent(
+                type="text",
+                text=f"""❌ 命令被硬拦截，无法绕过
+
+Command: {command}
+Reason: {str(e)}
+
+此操作属于灾难性命令（如 rm -rf 绝对路径、mkfs、dd 覆盘、fork-bomb 等），
+任何安全级别、任何参数（包括 confirm_dangerous=true）都无法使其通过 MCP 执行。
+如确需执行，请直接通过 SSH 登录服务器操作。
+
+Current security level: {os.getenv("SSH_SECURITY_LEVEL", "balanced")}""",
+            )
+        ]
+
     # 原有的安全检查逻辑（保持兼容性）
     if not confirm_dangerous:
         try:

{ssh_licco-2.1.4 → ssh_licco-2.2.0}/ssh_mcp/security.py

@@ -3,12 +3,15 @@ SSH-LICCO Security Module
 安全验证和防护模块 - 支持多级安全策略
 """
 
+import logging
 import os
 import re
 import shlex
 from enum import Enum
 from pathlib import Path, PurePosixPath
 
+logger = logging.getLogger(__name__)
+
 
 class SecurityLevel(Enum):
     """安全级别枚举"""
@@ -29,9 +32,16 @@ class RiskLevel(Enum):
 
 
 class SecurityError(Exception):
-    """安全异常类"""
+    """安全异常类
+
+    Attributes:
+        hard_block: 若为 True，表示该错误来自硬拦截（无法通过参数绕过），
+            调用方应在错误响应中不要提示任何 bypass 方案。
+    """
 
-    pass
+    def __init__(self, message: str, hard_block: bool = False):
+        super().__init__(message)
+        self.hard_block = hard_block
 
 
 class CommandValidator:
@@ -376,6 +386,34 @@ class CommandValidator:
         r"pkill\s+-9\s+",  # pkill -9 (批量强杀)
     ]
 
+    # 硬拦截模式集：任何安全级别、confirm_dangerous、confirmation_layer 都不能绕过
+    # 每条 (regex, category) 配对，category 用于审计日志识别命中类别
+    # 对应 spec ssh-security "Hard Block on Catastrophic Commands"
+    HARD_BLOCKED_PATTERNS: list[tuple[str, str]] = [
+        # rm -rf / 任意绝对路径（含 -rf / -fr 两种顺序）
+        (r"rm\s+-rf\s+/(?:\s|$|\*)", "absolute_path_rm_rf"),
+        (r"rm\s+-fr\s+/(?:\s|$|\*)", "absolute_path_rm_rf"),
+        (r"rm\s+-rf\s+/[^\s]+/\*", "absolute_path_rm_rf"),
+        (r"rm\s+-fr\s+/[^\s]+/\*", "absolute_path_rm_rf"),
+        (r"rm\s+-rf\s+/[^\s]+", "absolute_path_rm_rf"),
+        (r"rm\s+-fr\s+/[^\s]+", "absolute_path_rm_rf"),
+        # mkfs 任意文件系统格式化
+        (r"mkfs\.\w+", "disk_format"),
+        # dd 覆写磁盘
+        (r"dd\s+if=/dev/(?:zero|random|urandom)\s+of=/dev/sd", "raw_disk_dd"),
+        (r"dd\s+if=/dev/(?:zero|random|urandom)\s+of=/dev/nvm", "raw_disk_dd"),
+        # bash fork-bomb（含各种空白变体）
+        (r":\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;", "fork_bomb"),
+        # chmod -R 777/000 /
+        (r"chmod\s+-R\s+777\s+/(?:\s|$)", "root_chmod"),
+        (r"chmod\s+-R\s+000\s+/(?:\s|$)", "root_chmod"),
+        # 写裸磁盘设备（含 >> 重定向）
+        (r">\s*/dev/sd[a-z]", "raw_disk_redirect"),
+        (r">\s*/dev/nvme", "raw_disk_redirect"),
+        (r">>\s*/dev/sd[a-z]", "raw_disk_redirect"),
+        (r">>\s*/dev/nvme", "raw_disk_redirect"),
+    ]
+
     # 危险关键字
     DANGEROUS_KEYWORDS = ["passwd", "shadow", "/etc/shadow", "/root/.ssh"]
 
@@ -477,6 +515,13 @@ class CommandValidator:
             re.compile(pattern) for pattern in self.RELAXED_BLOCKED_PATTERNS
         ]
 
+        # 硬拦截正则：所有安全级别都生效，confirm_dangerous 也无法绕过
+        # 存储为 (compiled_regex, category) 元组列表，category 用于审计日志
+        self._hard_block_regex: list[tuple[re.Pattern, str]] = [
+            (re.compile(pattern), category)
+            for pattern, category in self.HARD_BLOCKED_PATTERNS
+        ]
+
     @classmethod
     def from_config_file(
         cls,
@@ -539,6 +584,39 @@ class CommandValidator:
         """编译危险模式正则"""
         self.dangerous_regex = [re.compile(pattern) for pattern in self.dangerous_patterns]
 
+    def check_hard_block(self, command: str) -> None:
+        """硬拦截检查：与安全级别、confirm_dangerous、confirmation_layer 无关。
+
+        任何匹配 HARD_BLOCKED_PATTERNS 的命令都会被拒绝并抛出 SecurityError(hard_block=True)。
+        调用方应在错误响应中不要提示任何 bypass 方案。
+
+        Args:
+            command: 要检查的命令
+
+        Raises:
+            SecurityError: hard_block=True
+        """
+        if not command:
+            return
+        for regex, category in self._hard_block_regex:
+            if regex.search(command):
+                # 审计日志：仅记录命令和 category，不回显正则（避免泄露黑名单形状）
+                logger.warning(
+                    "hard-block command rejected: category=%s command=%s",
+                    category,
+                    command,
+                )
+                raise SecurityError(
+                    f"命令被硬拦截（{category}），无法通过任何参数绕过。\n"
+                    f"被阻止的命令：{command}\n"
+                    f"如确需执行，请直接登录服务器操作。",
+                    hard_block=True,
+                )
+
+    def _check_hard_block(self, command: str) -> None:
+        """validate_command 内部使用的硬拦截短路检查。"""
+        self.check_hard_block(command)
+
     def validate_command(self, command: str) -> bool:
         """
         验证命令是否安全
@@ -555,6 +633,10 @@ class CommandValidator:
         if not command or not command.strip():
             raise SecurityError("命令不能为空")
 
+        # 0. 硬拦截：所有安全级别都生效，confirm_dangerous / confirmation_layer 也无法绕过
+        # 先于所有其他检查，包括 RELAXED 模式的短路径，避免出现不同模式下行为不一致
+        self._check_hard_block(command)
+
         # 分割命令获取基础命令
         try:
             cmd_parts = shlex.split(command)

ssh_licco-2.2.0/tests/test_security.py

@@ -0,0 +1,207 @@
+"""Tests for ssh_mcp.security — Hard Block on Catastrophic Commands.
+
+Spec: openspec/changes/hardblock-dangerous-commands/specs/ssh-security/spec.md
+"""
+
+from __future__ import annotations
+
+import logging
+import re
+
+import pytest
+
+from ssh_mcp.security import CommandValidator, SecurityError, SecurityLevel
+
+# ---------------------------------------------------------------------------
+# Parametrize fixtures
+# ---------------------------------------------------------------------------
+
+ABSOLUTE_PATH_RM_RF = [
+    "rm -rf /",
+    "rm -rf /*",
+    "rm -rf /etc",
+    "rm -rf /var/lib/postgresql/data",
+    "rm -rf /home/user/junk/*",
+    "rm -fr /etc",  # -fr variant
+]
+
+DISK_DESTRUCTIVE = [
+    "mkfs.ext4 /dev/sda1",
+    "mkfs.xfs /dev/nvme0n1",
+    "dd if=/dev/zero of=/dev/sda bs=1M",
+    "dd if=/dev/urandom of=/dev/nvme0n1",
+    "chmod -R 777 /",
+    "chmod -R 000 /",
+    ":(){:|:&};:",
+    ": ( ) { : | : & } ;",  # whitespace variant
+    "echo junk > /dev/sda",
+    "echo junk > /dev/nvme0n1",
+    "echo junk >> /dev/sdb",
+]
+
+SAFE_DELETE = [
+    "rm /tmp/test.log",
+    "rm -f /var/log/app.log",  # -f without -r is still safe
+    "rmdir /tmp/empty_dir",
+]
+
+ALL_LEVELS = [
+    SecurityLevel.STRICT,
+    SecurityLevel.BALANCED,
+    SecurityLevel.RELAXED,
+]
+
+
+# ---------------------------------------------------------------------------
+# 4.2: rm -rf on absolute paths is rejected in all security levels
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize("cmd", ABSOLUTE_PATH_RM_RF)
+@pytest.mark.parametrize("level", ALL_LEVELS)
+def test_hard_block_rejects_absolute_path_rm_rf(cmd: str, level: SecurityLevel) -> None:
+    """rm -rf against any absolute path is hard-blocked regardless of security level."""
+    v = CommandValidator(security_level=level)
+    with pytest.raises(SecurityError) as exc_info:
+        v.check_hard_block(cmd)
+    assert exc_info.value.hard_block is True
+
+
+@pytest.mark.parametrize("cmd", ABSOLUTE_PATH_RM_RF)
+@pytest.mark.parametrize("level", ALL_LEVELS)
+def test_hard_block_rejects_even_with_validate_command(cmd: str, level: SecurityLevel) -> None:
+    """validate_command also runs the hard block first (so it works via the unified path)."""
+    v = CommandValidator(security_level=level)
+    with pytest.raises(SecurityError) as exc_info:
+        v.validate_command(cmd)
+    assert exc_info.value.hard_block is True
+
+
+# ---------------------------------------------------------------------------
+# 4.3: disk-destructive commands are rejected in all security levels
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize("cmd", DISK_DESTRUCTIVE)
+@pytest.mark.parametrize("level", ALL_LEVELS)
+def test_hard_block_rejects_disk_destructive(cmd: str, level: SecurityLevel) -> None:
+    """mkfs / raw-disk dd / root chmod 777 / fork-bomb / raw redirect — all rejected."""
+    v = CommandValidator(security_level=level)
+    with pytest.raises(SecurityError) as exc_info:
+        v.check_hard_block(cmd)
+    assert exc_info.value.hard_block is True
+
+
+# ---------------------------------------------------------------------------
+# 4.4: safe delete operations still work
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize("cmd", SAFE_DELETE)
+@pytest.mark.parametrize("level", ALL_LEVELS)
+def test_safe_delete_still_allowed(cmd: str, level: SecurityLevel) -> None:
+    """rm /tmp/file, rmdir empty, and rm -f single file must NOT be hard-blocked."""
+    v = CommandValidator(security_level=level)
+    # check_hard_block is the only thing we're testing here; should not raise.
+    v.check_hard_block(cmd)
+
+
+# ---------------------------------------------------------------------------
+# 4.5: relative-path rm -rf is NOT hard-blocked (regression guard)
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize("cmd", [
+    "rm -rf ./build/",
+    "rm -rf relative/dir",
+    "rm -rf ../sibling",
+    "rm -rf .",
+])
+def test_soft_risk_relative_path_not_hard_blocked(cmd: str) -> None:
+    """Relative-path rm -rf must not be hard-blocked (only absolute paths are)."""
+    v = CommandValidator(security_level=SecurityLevel.BALANCED)
+    # check_hard_block should pass (no exception)
+    v.check_hard_block(cmd)
+
+
+# ---------------------------------------------------------------------------
+# 4.6: WARNING log is emitted on hard block, regex is not echoed
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize("cmd", ABSOLUTE_PATH_RM_RF[:2])
+def test_hard_block_logs_warning_with_category(
+    cmd: str, caplog: pytest.LogCaptureFixture
+) -> None:
+    """A WARNING log line is emitted; it contains the category but not the regex."""
+    v = CommandValidator(security_level=SecurityLevel.BALANCED)
+    with caplog.at_level(logging.WARNING, logger="ssh_mcp.security"):
+        with pytest.raises(SecurityError):
+            v.check_hard_block(cmd)
+
+    # At least one WARNING record exists
+    warnings = [r for r in caplog.records if r.levelno == logging.WARNING]
+    assert warnings, f"no WARNING log emitted for {cmd}"
+
+    # The category is in the log, the command is in the log
+    joined = " ".join(r.getMessage() for r in warnings)
+    assert cmd in joined, f"command not in log: {joined}"
+    assert "category=" in joined, f"category label not in log: {joined}"
+
+    # The log message must NOT contain raw regex syntax markers from the blacklist
+    # (i.e. \s, \., \[, etc.) — only the human-readable category is allowed.
+    for record in warnings:
+        msg = record.getMessage()
+        assert not re.search(r"\\[sdw+\[\]]", msg), (
+            f"regex metacharacters leaked into log message: {msg}"
+        )
+
+
+def test_hard_block_message_does_not_mention_override() -> None:
+    """The error message must not suggest any parameter can bypass the hard block."""
+    v = CommandValidator(security_level=SecurityLevel.RELAXED)
+    with pytest.raises(SecurityError) as exc_info:
+        v.check_hard_block("rm -rf /etc")
+    msg = str(exc_info.value)
+    assert "confirm_dangerous" not in msg
+    assert "confirmation_layer" not in msg
+    assert "无法通过任何参数绕过" in msg or "无法绕过" in msg or "无法" in msg
+
+
+# ---------------------------------------------------------------------------
+# SecurityError attribute contract
+# ---------------------------------------------------------------------------
+
+
+def test_security_error_has_hard_block_attribute() -> None:
+    """SecurityError exposes `hard_block: bool`; default is False, hard block sets True."""
+    # Default (other errors)
+    err = SecurityError("plain")
+    assert err.hard_block is False
+
+    # Hard block path
+    v = CommandValidator(security_level=SecurityLevel.BALANCED)
+    with pytest.raises(SecurityError) as exc_info:
+        v.check_hard_block("rm -rf /")
+    assert exc_info.value.hard_block is True
+
+
+# ---------------------------------------------------------------------------
+# Pattern coverage: every documented catastrophic pattern has a regex entry
+# ---------------------------------------------------------------------------
+
+
+def test_hard_block_patterns_cover_documented_categories() -> None:
+    """The HARD_BLOCKED_PATTERNS set must include all categories in the spec."""
+    expected_categories = {
+        "absolute_path_rm_rf",
+        "disk_format",
+        "raw_disk_dd",
+        "fork_bomb",
+        "root_chmod",
+        "raw_disk_redirect",
+    }
+    actual = {category for _, category in CommandValidator.HARD_BLOCKED_PATTERNS}
+    assert expected_categories.issubset(actual), (
+        f"missing categories: {expected_categories - actual}"
+    )

ssh_licco-2.1.4/tests/test_security.py

@@ -1,195 +0,0 @@
-from __future__ import annotations
-
-import os
-from pathlib import PurePosixPath
-from unittest.mock import patch
-
-import pytest
-
-from ssh_mcp.security import (
-    CommandValidator,
-    PathValidator,
-    SecurityError,
-    SecurityLevel,
-    create_validators_from_env,
-)
-
-
-class TestSecurityLevel:
-    def test_values(self):
-        assert SecurityLevel.STRICT.value == "strict"
-        assert SecurityLevel.BALANCED.value == "balanced"
-        assert SecurityLevel.RELAXED.value == "relaxed"
-
-
-class TestCommandValidator:
-    def test_balanced_allows_simple_command(self):
-        v = CommandValidator(SecurityLevel.BALANCED)
-        assert v.validate_command("ls") is True
-
-    def test_balanced_allows_common_commands(self):
-        v = CommandValidator(SecurityLevel.BALANCED)
-        for cmd in ["ls", "pwd", "cat file.txt", "grep pattern", "docker ps"]:
-            assert v.validate_command(cmd) is True
-
-    def test_balanced_blocks_pipe(self):
-        v = CommandValidator(SecurityLevel.BALANCED)
-        with pytest.raises(SecurityError, match="危险字符"):
-            v.validate_command("ls | grep foo")
-
-    def test_balanced_blocks_semicolon(self):
-        v = CommandValidator(SecurityLevel.BALANCED)
-        with pytest.raises(SecurityError, match="危险字符"):
-            v.validate_command("ls ; rm -rf /")
-
-    def test_balanced_blocks_command_substitution(self):
-        v = CommandValidator(SecurityLevel.BALANCED)
-        with pytest.raises(SecurityError, match="危险字符"):
-            v.validate_command("echo $(whoami)")
-
-    def test_balanced_blocks_backtick(self):
-        v = CommandValidator(SecurityLevel.BALANCED)
-        with pytest.raises(SecurityError, match="危险字符"):
-            v.validate_command("echo `whoami`")
-
-    def test_strict_blocks_redirect(self):
-        v = CommandValidator(SecurityLevel.STRICT)
-        with pytest.raises(SecurityError, match="危险字符"):
-            v.validate_command("echo hello > file.txt")
-
-    def test_strict_blocks_ampersand(self):
-        v = CommandValidator(SecurityLevel.STRICT)
-        with pytest.raises(SecurityError, match="危险字符"):
-            v.validate_command("ls 10 &")
-
-    def test_relaxed_allows_pipe(self):
-        v = CommandValidator(SecurityLevel.RELAXED)
-        assert v.validate_command("ls | grep foo") is True
-
-    def test_relaxed_allows_redirect(self):
-        v = CommandValidator(SecurityLevel.RELAXED)
-        assert v.validate_command("echo hello > file.txt") is True
-
-    def test_empty_command(self):
-        v = CommandValidator(SecurityLevel.BALANCED)
-        with pytest.raises(SecurityError, match="不能为空"):
-            v.validate_command("")
-
-    def test_whitespace_command(self):
-        v = CommandValidator(SecurityLevel.BALANCED)
-        with pytest.raises(SecurityError, match="不能为空"):
-            v.validate_command("   ")
-
-    def test_unknown_command(self):
-        v = CommandValidator(SecurityLevel.BALANCED)
-        with pytest.raises(SecurityError, match="不在允许列表中"):
-            v.validate_command("evil_command arg1")
-
-    def test_extra_allowed_commands(self):
-        v = CommandValidator(SecurityLevel.BALANCED, extra_allowed_commands={"myapp"})
-        assert v.validate_command("myapp --flag") is True
-
-    def test_dangerous_keywords_passwd(self):
-        v = CommandValidator(SecurityLevel.BALANCED)
-        with pytest.raises(SecurityError, match="受限关键字"):
-            v.validate_command("cat /etc/passwd")
-
-    def test_dangerous_keywords_shadow(self):
-        v = CommandValidator(SecurityLevel.BALANCED)
-        with pytest.raises(SecurityError, match="受限关键字"):
-            v.validate_command("cat /etc/shadow")
-
-    def test_command_too_long(self):
-        v = CommandValidator(SecurityLevel.BALANCED)
-        long_cmd = "ls " + "a" * 5000
-        with pytest.raises(SecurityError, match="过长"):
-            v.validate_command(long_cmd)
-
-    def test_malformed_command(self):
-        v = CommandValidator(SecurityLevel.BALANCED)
-        with pytest.raises(SecurityError, match="格式错误"):
-            v.validate_command("echo 'unclosed")
-
-    def test_docker_command_allowed(self):
-        v = CommandValidator(SecurityLevel.BALANCED)
-        assert v.validate_command("docker build -t myapp .") is True
-
-    def test_git_command_allowed(self):
-        v = CommandValidator(SecurityLevel.BALANCED)
-        assert v.validate_command("git status") is True
-
-
-class TestPathValidator:
-    def test_valid_path(self):
-        v = PathValidator(SecurityLevel.BALANCED, base_dir="/home")
-        result = v.validate_path("user/file.txt")
-        assert str(result).startswith(str(v.base_dir))
-
-    def test_path_traversal_attack(self):
-        v = PathValidator(SecurityLevel.BALANCED, base_dir="/home")
-        with pytest.raises(SecurityError, match="遍历"):
-            v.validate_path("../../../etc/passwd")
-
-    def test_empty_path(self):
-        v = PathValidator(SecurityLevel.BALANCED)
-        with pytest.raises(SecurityError, match="不能为空"):
-            v.validate_path("")
-
-    def test_forbidden_path_etc(self):
-        """测试禁止访问 /etc/shadow（PurePosixPath 确保跨平台兼容）"""
-        v = PathValidator(SecurityLevel.BALANCED, base_dir="/")
-        with pytest.raises(SecurityError, match="敏感路径"):
-            v.validate_path("etc/shadow")
-
-    def test_forbidden_path_root(self):
-        """测试禁止访问 /root/.ssh（PurePosixPath 确保跨平台兼容）"""
-        v = PathValidator(SecurityLevel.BALANCED, base_dir="/")
-        with pytest.raises(SecurityError, match="敏感路径"):
-            v.validate_path("root/.ssh")
-
-    def test_relaxed_no_forbidden_paths(self):
-        v = PathValidator(SecurityLevel.RELAXED, base_dir="/")
-        result = v.validate_path("etc/config")
-        assert result is not None
-
-    def test_strict_blocks_traversal(self):
-        v = PathValidator(SecurityLevel.STRICT, base_dir="/home")
-        with pytest.raises(SecurityError, match="遍历"):
-            v.validate_path("../../tmp/evil")
-
-    def test_extra_allowed_paths(self):
-        v = PathValidator(SecurityLevel.BALANCED, base_dir="/home", extra_allowed_paths=["/data"])
-        assert v.extra_allowed_paths == ["/data"]
-
-
-class TestCreateValidatorsFromEnv:
-    def test_default_balanced(self):
-        with patch.dict(os.environ, {}, clear=True):
-            cv, pv = create_validators_from_env()
-            assert cv.security_level == SecurityLevel.BALANCED
-
-    def test_strict_level(self):
-        with patch.dict(os.environ, {"SSH_SECURITY_LEVEL": "strict"}):
-            cv, pv = create_validators_from_env()
-            assert cv.security_level == SecurityLevel.STRICT
-
-    def test_relaxed_level(self):
-        with patch.dict(os.environ, {"SSH_SECURITY_LEVEL": "relaxed"}):
-            cv, pv = create_validators_from_env()
-            assert cv.security_level == SecurityLevel.RELAXED
-
-    def test_unknown_level_defaults_balanced(self):
-        with patch.dict(os.environ, {"SSH_SECURITY_LEVEL": "unknown"}):
-            cv, pv = create_validators_from_env()
-            assert cv.security_level == SecurityLevel.BALANCED
-
-    def test_extra_commands(self):
-        with patch.dict(os.environ, {"SSH_EXTRA_ALLOWED_COMMANDS": "myapp,mytool"}):
-            cv, pv = create_validators_from_env()
-            assert "myapp" in cv.allowed_commands
-            assert "mytool" in cv.allowed_commands
-
-    def test_custom_base_dir(self):
-        with patch.dict(os.environ, {"SSH_BASE_DIR": "/data"}):
-            cv, pv = create_validators_from_env()
-            assert "data" in str(pv.base_dir)