From d6c7f73f1e6acb21e5e96668de069e389c78aba8 Mon Sep 17 00:00:00 2001 From: tukuaiai Date: Tue, 19 May 2026 03:54:25 +0800 Subject: [PATCH] feat: skills - add auto-tmux safety preflight --- skills/auto-tmux/AGENTS.md | 4 +- skills/auto-tmux/README.md | 3 + skills/auto-tmux/SKILL.md | 8 +- skills/auto-tmux/references/README.md | 1 + skills/auto-tmux/references/automation.md | 9 ++ skills/auto-tmux/references/index.md | 1 + .../auto-tmux/references/iteration-roadmap.md | 5 +- skills/auto-tmux/references/safety-policy.md | 91 +++++++++++++++ skills/auto-tmux/scripts/AGENTS.md | 2 + skills/auto-tmux/scripts/README.md | 4 + .../auto-tmux/scripts/auto-tmux-smoke-test.sh | 8 ++ skills/auto-tmux/scripts/auto-tmux.sh | 2 +- skills/auto-tmux/scripts/safety-check.sh | 105 ++++++++++++++++++ .../auto-tmux/scripts/validate-auto-tmux.sh | 13 +++ 14 files changed, 250 insertions(+), 6 deletions(-) create mode 100644 skills/auto-tmux/references/safety-policy.md create mode 100755 skills/auto-tmux/scripts/safety-check.sh diff --git a/skills/auto-tmux/AGENTS.md b/skills/auto-tmux/AGENTS.md index e2894ce..a1d4aba 100644 --- a/skills/auto-tmux/AGENTS.md +++ b/skills/auto-tmux/AGENTS.md @@ -17,6 +17,7 @@ skills/auto-tmux/ │ ├── swarm-brief.sh │ ├── swarm-watch.sh │ ├── swarm-archive.sh +│ ├── safety-check.sh │ ├── render-swarm-prompt.sh │ ├── swarm-dispatch.sh │ ├── auto-tmux-smoke-test.sh @@ -44,6 +45,7 @@ skills/auto-tmux/ - `scripts/swarm-brief.sh` 是只读交接层，汇总 doctor/topology/scan/report 形成上下文快照。 - `scripts/swarm-watch.sh` 是有限轮次巡检层，按间隔采集 pane 输出与 swarm report。 - `scripts/swarm-archive.sh` 是归档层，打包 brief、snapshot 和 swarm state 供复盘交接。 +- `scripts/safety-check.sh` 是安全预检层，检查待发送 payload 的危险命令、敏感信息和大小。 - `scripts/render-swarm-prompt.sh` 是提示词渲染层，生成 commander/worker/reviewer 协议文本。 - `scripts/swarm-dispatch.sh` 是提示词下发层，默认写文件，显式 `--send` 后才发送到 pane。 - `scripts/validate-auto-tmux.sh` 是技能专属质量门禁，覆盖脚本、文档索引和 smoke test。 @@ -55,4 +57,4 @@ skills/auto-tmux/ - 上游来源：`tools/external/.tmux` 与 `tools/external/tmux`。 - 下游使用：`SKILL.md` 和 `references/` 中的命令示例。 - 验证入口：`skills/auto-skill/scripts/validate-skill.sh skills/auto-tmux --strict`。 -- 脚本验证：`skills/auto-tmux/scripts/validate-auto-tmux.sh`、`bash -n skills/auto-tmux/scripts/auto-tmux.sh`、`bash -n skills/auto-tmux/scripts/swarm-state.sh`、`bash -n skills/auto-tmux/scripts/swarm-brief.sh`、`bash -n skills/auto-tmux/scripts/swarm-watch.sh`、`bash -n skills/auto-tmux/scripts/swarm-archive.sh`、`bash -n skills/auto-tmux/scripts/render-swarm-prompt.sh`、`bash -n skills/auto-tmux/scripts/swarm-dispatch.sh`、`skills/auto-tmux/scripts/auto-tmux-smoke-test.sh`。 +- 脚本验证：`skills/auto-tmux/scripts/validate-auto-tmux.sh`、`bash -n skills/auto-tmux/scripts/auto-tmux.sh`、`bash -n skills/auto-tmux/scripts/swarm-state.sh`、`bash -n skills/auto-tmux/scripts/swarm-brief.sh`、`bash -n skills/auto-tmux/scripts/swarm-watch.sh`、`bash -n skills/auto-tmux/scripts/swarm-archive.sh`、`bash -n skills/auto-tmux/scripts/safety-check.sh`、`bash -n skills/auto-tmux/scripts/render-swarm-prompt.sh`、`bash -n skills/auto-tmux/scripts/swarm-dispatch.sh`、`skills/auto-tmux/scripts/auto-tmux-smoke-test.sh`。 diff --git a/skills/auto-tmux/README.md b/skills/auto-tmux/README.md index 83e1441..4fb5079 100644 --- a/skills/auto-tmux/README.md +++ b/skills/auto-tmux/README.md @@ -24,12 +24,14 @@ bash -n skills/auto-tmux/scripts/swarm-state.sh bash -n skills/auto-tmux/scripts/swarm-brief.sh bash -n skills/auto-tmux/scripts/swarm-watch.sh bash -n skills/auto-tmux/scripts/swarm-archive.sh +bash -n skills/auto-tmux/scripts/safety-check.sh bash -n skills/auto-tmux/scripts/render-swarm-prompt.sh bash -n skills/auto-tmux/scripts/swarm-dispatch.sh bash -n skills/auto-tmux/scripts/validate-auto-tmux.sh skills/auto-tmux/scripts/auto-tmux.sh help skills/auto-tmux/scripts/swarm-state.sh help skills/auto-tmux/scripts/swarm-brief.sh --help +skills/auto-tmux/scripts/safety-check.sh --text "make test" skills/auto-tmux/scripts/render-swarm-prompt.sh commander --session ai-hub --task "smoke" skills/auto-tmux/scripts/auto-tmux-smoke-test.sh skills/auto-tmux/scripts/validate-auto-tmux.sh @@ -40,6 +42,7 @@ skills/auto-skill/scripts/validate-skill.sh skills/auto-tmux --strict - 优先使用 `scripts/auto-tmux.sh`，需要低层调试时再直接使用 tmux 原生命令。 - 发送按键前必须先 `capture-pane` 复核目标上下文；脚本会默认打印最近上下文。 +- 发送长文本、粘贴文件或下发 prompt 前先运行 `scripts/safety-check.sh`。 - 批量操作前必须先列出 session/window/pane 白名单。 - 多 worker 并发前用 `swarm-state.sh` 管理任务、锁和状态，避免重复修改同一资源。 - 不在未知 pane 中发送破坏性命令。 diff --git a/skills/auto-tmux/SKILL.md b/skills/auto-tmux/SKILL.md index a45b4cf..60b1116 100644 --- a/skills/auto-tmux/SKILL.md +++ b/skills/auto-tmux/SKILL.md @@ -38,6 +38,7 @@ bash -n skills/auto-tmux/scripts/swarm-state.sh bash -n skills/auto-tmux/scripts/swarm-brief.sh bash -n skills/auto-tmux/scripts/swarm-watch.sh bash -n skills/auto-tmux/scripts/swarm-archive.sh +bash -n skills/auto-tmux/scripts/safety-check.sh bash -n skills/auto-tmux/scripts/render-swarm-prompt.sh bash -n skills/auto-tmux/scripts/swarm-dispatch.sh bash -n skills/auto-tmux/scripts/validate-auto-tmux.sh @@ -76,7 +77,9 @@ tmux capture-pane -t :. -p -S -120 **向指定 pane 发送命令或确认键** ```bash +skills/auto-tmux/scripts/safety-check.sh --text "make test" skills/auto-tmux/scripts/auto-tmux.sh send -t :. --text "make test" --enter +skills/auto-tmux/scripts/safety-check.sh --file /tmp/prompt.md --strict skills/auto-tmux/scripts/auto-tmux.sh paste -t :. --file /tmp/prompt.md --enter --dry-run skills/auto-tmux/scripts/auto-tmux.sh rescue -t :. --pattern "(y/n)" --reply y ``` @@ -189,6 +192,7 @@ skills/auto-tmux/scripts/swarm-dispatch.sh --role worker --target ::::/tmp/auto-tmux-smoke-inspect.txt grep -q 'pane inspect' /tmp/auto-tmux-smoke-inspect.txt printf '%s\n' 'echo AUTO_TMUX_PASTE_OK' > "$PASTE_FILE" +"$SAFETY_CHECK" --text "make test" >/tmp/auto-tmux-smoke-safety-clean.txt +if "$SAFETY_CHECK" --text "rm -rf /tmp/example" >/tmp/auto-tmux-smoke-safety-danger.txt 2>&1; then + echo "expected safety-check to reject dangerous text" >&2 + exit 1 +fi +"$SAFETY_CHECK" --file "$PASTE_FILE" --strict >/tmp/auto-tmux-smoke-safety-file.txt "$AUTO_TMUX" paste -t "$worker_target" --file "$PASTE_FILE" --enter --dry-run >/tmp/auto-tmux-smoke-paste-dry-run.txt "$AUTO_TMUX" broadcast --session "$SESSION" --text "pwd" --enter --dry-run >/tmp/auto-tmux-smoke-broadcast.txt "$AUTO_TMUX" send -t "$worker_target" --text "echo AUTO_TMUX_SMOKE_OK" --enter diff --git a/skills/auto-tmux/scripts/auto-tmux.sh b/skills/auto-tmux/scripts/auto-tmux.sh index a058703..8fcf680 100755 --- a/skills/auto-tmux/scripts/auto-tmux.sh +++ b/skills/auto-tmux/scripts/auto-tmux.sh @@ -153,7 +153,7 @@ cmd_doctor() { status_line "WARN" "tmux server has no reachable session yet" fi - for script in auto-tmux.sh swarm-state.sh swarm-brief.sh swarm-watch.sh swarm-archive.sh render-swarm-prompt.sh swarm-dispatch.sh auto-tmux-smoke-test.sh validate-auto-tmux.sh; do + for script in auto-tmux.sh swarm-state.sh swarm-brief.sh swarm-watch.sh swarm-archive.sh safety-check.sh render-swarm-prompt.sh swarm-dispatch.sh auto-tmux-smoke-test.sh validate-auto-tmux.sh; do if [[ -x "$script_dir/$script" ]]; then status_line "OK" "script executable: $script" else diff --git a/skills/auto-tmux/scripts/safety-check.sh b/skills/auto-tmux/scripts/safety-check.sh new file mode 100755 index 0000000..40f1843 --- /dev/null +++ b/skills/auto-tmux/scripts/safety-check.sh @@ -0,0 +1,105 @@ +#!/usr/bin/env bash +# safety-check: inspect text/file payloads before tmux send, paste or dispatch. +set -euo pipefail + +usage() { + cat <<'EOF' +safety-check: inspect an auto-tmux payload before sending it to a pane + +Usage: + safety-check.sh --text TEXT [--strict] + safety-check.sh --file FILE [--strict] + safety-check.sh --stdin [--strict] + +Checks: + - dangerous shell/database/tmux commands that require explicit review + - common secret patterns that should not be pasted into shared panes + - oversized payloads that should use paste/archive instead of send + +Exit codes: + 0: no issue found + 1: warning found + 2: blocking issue found +EOF +} + +die() { + printf 'error: %s\n' "$*" >&2 + exit 2 +} + +input="" +label="" +strict="0" + +while [[ $# -gt 0 ]]; do + case "$1" in + --text) + input="${2:-}" + label="" + shift 2 + ;; + --file) + [[ -f "${2:-}" ]] || die "file not found: ${2:-}" + input="$(cat "$2")" + label="$2" + shift 2 + ;; + --stdin) + input="$(cat)" + label="" + shift + ;; + --strict) + strict="1" + shift + ;; + -h|--help) + usage + exit 0 + ;; + *) + die "unknown option: $1" + ;; + esac +done + +[[ -n "$label" ]] || die "one input source is required: --text, --file or --stdin" + +dangerous_pattern='(^|[[:space:];|&])(rm[[:space:]]+-rf|mkfs|dd[[:space:]]+if=|shutdown|reboot|halt|poweroff|tmux[[:space:]]+kill-server|git[[:space:]]+reset[[:space:]]+--hard|git[[:space:]]+clean[[:space:]]+-fd|DROP[[:space:]]+(DATABASE|TABLE))' +secret_pattern='(OPENAI_API_KEY|ANTHROPIC_API_KEY|GITHUB_TOKEN|GH_TOKEN|API_KEY|TOKEN|PASSWORD|SECRET)=|Bearer[[:space:]]+[A-Za-z0-9._~+/=-]+|sk-[A-Za-z0-9_-]{12,}' + +failures=0 +warnings=0 + +if printf '%s\n' "$input" | grep -Eiq "$dangerous_pattern"; then + printf '[FAIL] dangerous command pattern detected in %s\n' "$label" >&2 + failures=$((failures + 1)) +fi + +if printf '%s\n' "$input" | grep -Eiq "$secret_pattern"; then + if [[ "$strict" == "1" ]]; then + printf '[FAIL] possible secret detected in %s\n' "$label" >&2 + failures=$((failures + 1)) + else + printf '[WARN] possible secret detected in %s\n' "$label" >&2 + warnings=$((warnings + 1)) + fi +fi + +byte_count="$(printf '%s' "$input" | wc -c | tr -d ' ')" +line_count="$(printf '%s\n' "$input" | wc -l | tr -d ' ')" +if (( byte_count > 8192 )); then + printf '[WARN] payload is large: %s bytes; prefer paste-buffer or archive handoff\n' "$byte_count" >&2 + warnings=$((warnings + 1)) +fi + +printf 'safety-check target=%s bytes=%s lines=%s strict=%s\n' "$label" "$byte_count" "$line_count" "$strict" + +if (( failures > 0 )); then + exit 2 +fi +if (( warnings > 0 )); then + exit 1 +fi +printf '[OK] no safety issue found\n' diff --git a/skills/auto-tmux/scripts/validate-auto-tmux.sh b/skills/auto-tmux/scripts/validate-auto-tmux.sh index 749f419..c4e5772 100755 --- a/skills/auto-tmux/scripts/validate-auto-tmux.sh +++ b/skills/auto-tmux/scripts/validate-auto-tmux.sh @@ -82,6 +82,7 @@ scripts=( "$script_dir/swarm-brief.sh" "$script_dir/swarm-watch.sh" "$script_dir/swarm-archive.sh" + "$script_dir/safety-check.sh" "$script_dir/render-swarm-prompt.sh" "$script_dir/swarm-dispatch.sh" "$script_dir/auto-tmux-smoke-test.sh" @@ -97,6 +98,13 @@ run_gate "swarm-state help" "$script_dir/swarm-state.sh" help run_gate "swarm-brief help" "$script_dir/swarm-brief.sh" --help run_gate "swarm-watch help" "$script_dir/swarm-watch.sh" --help run_gate "swarm-archive help" "$script_dir/swarm-archive.sh" --help +run_gate "safety-check help" "$script_dir/safety-check.sh" --help +run_gate "safety-check clean text" "$script_dir/safety-check.sh" --text "make test" +if "$script_dir/safety-check.sh" --text "rm -rf /tmp/example" >/tmp/auto-tmux-validate-gate.log 2>&1; then + fail "safety-check should reject dangerous text" +else + pass "safety-check rejects dangerous text" +fi run_gate "render-swarm-prompt help" "$script_dir/render-swarm-prompt.sh" --help run_gate "swarm-dispatch help" "$script_dir/swarm-dispatch.sh" --help @@ -104,17 +112,22 @@ require_contains "$skill_dir/SKILL.md" "scripts/validate-auto-tmux.sh" require_contains "$skill_dir/SKILL.md" "scripts/swarm-brief.sh" require_contains "$skill_dir/SKILL.md" "scripts/swarm-watch.sh" require_contains "$skill_dir/SKILL.md" "scripts/swarm-archive.sh" +require_contains "$skill_dir/SKILL.md" "scripts/safety-check.sh" require_contains "$skill_dir/SKILL.md" "scripts/swarm-dispatch.sh" require_contains "$skill_dir/references/index.md" "automation.md" +require_contains "$skill_dir/references/index.md" "safety-policy.md" require_contains "$skill_dir/references/README.md" "swarm-state.md" +require_contains "$skill_dir/references/README.md" "safety-policy.md" require_contains "$script_dir/README.md" "validate-auto-tmux.sh" require_contains "$script_dir/README.md" "swarm-dispatch.sh" require_contains "$script_dir/README.md" "swarm-watch.sh" require_contains "$script_dir/README.md" "swarm-archive.sh" +require_contains "$script_dir/README.md" "safety-check.sh" require_contains "$script_dir/AGENTS.md" "validate-auto-tmux.sh" require_contains "$script_dir/AGENTS.md" "swarm-dispatch.sh" require_contains "$script_dir/AGENTS.md" "swarm-watch.sh" require_contains "$script_dir/AGENTS.md" "swarm-archive.sh" +require_contains "$script_dir/AGENTS.md" "safety-check.sh" if [[ -x "$repo_root/skills/auto-skill/scripts/validate-skill.sh" ]]; then run_gate "auto-skill strict validation" "$repo_root/skills/auto-skill/scripts/validate-skill.sh" "$skill_dir" --strict