AtomCode v5.0.9 新子系统深度分析 — AtomGit 平台工具集与敏感路径门禁

基于 strings 工具契约 + 错误串 + 凭据路径枚举的还原分析 2026-09-09 前置报告：05-version-diff-v4.25.5-to-v5.0.9.md

---

1. 源码模块（全新）

crates/atomcode-capabilities/src/atomgit/
  ├── client.rs            ← AtomGit REST 客户端
  ├── issue.rs             ← Issue 工具
  ├── pr.rs                ← Pull Request 工具
  ├── push_label_mw.rs     ← 推送标签中间件
  ├── remote.rs            ← 远程仓库解析
  └── repo.rs              ← 仓库工具

crates/atomcode-capabilities/src/tools/
  ├── atomgit.rs           ← atomgit_api 通用工具
  ├── atomgit_bash_gate.rs ← AtomGit 命令门禁
  ├── bash_workspace_gate.rs   ← 工作区边界门禁
  └── credential_bash_gate.rs  ← 凭据门禁

crates/atomcode-capabilities/src/askpass/
  ├── cache.rs             ← askpass 凭据缓存
  └── server.rs            ← askpass 服务器

crates/atomcode-capabilities/src/provider/atomgit_sign.rs  ← 请求签名
crates/atomcode-capabilities/src/file_index.rs             ← 文件索引
crates/atomcode-capabilities/src/tools/memory.rs            ← memory 工具
crates/atomcode-capabilities/src/tools/output_artifact.rs   ← 输出产物
crates/atomcode-capabilities/src/tools/request_user_input.rs ← 用户输入
crates/atomcode-capabilities/src/tools/repair.rs            ← 修复工具

---

2. AtomGit 平台工具族（4 个工具）

2.1 工具总览

工具	职责
atomgit_repo	仓库级操作
atomgit_pr	Pull Request 操作
atomgit_issue	Issue 操作
atomgit_api	任意 AtomGit REST 端点（通用）

2.2 atomgit_repo 动作面（错误串还原）

create: name is required
view: owner and repo are required
clone: owner and repo are required
fork: owner and repo are required
delete: owner and repo are required
create_tag: owner, repo and tag_name are required
ensure_label: owner and repo are required
labels: owner and repo are required
  默认标签: atomcode

2.3 atomgit_pr 动作面

create: owner, repo, title and head are required
view
close
comment_view / comment_create / comment_reply / comment_delete
link_issues: issues=[...] is required
unlink_issues: issues=[...] is required
  list (default 30) / filter (default open)

→ PR ↔ Issue 双向链接 内置支持。

2.4 atomgit_issue 动作面

create: owner, repo and title are required
view
comment_view / comment_create: body is required
comment_delete: owner, repo and comment_id are required
  IssueArgs with 9 elements  ← 参数结构体
  Issue numbers for link/unlink

2.5 atomgit_api（通用端点）

atomgit_api: invalid arguments:
atomgit_api: unsupported method
  prefer atomgit_repo / atomgit_pr / atomgit_issue when they cover the action
  for any other AtomGit REST endpoint
  path is relative to the API base, e.g. "/user/orgs" or "/repos/{owner}/{repo}"

→ 网关策略：专用工具优先，atomgit_api 兜底任意 REST。

---

3. 凭据模型（安全核心）

3.1 凭据来源与持久化

atomgit_token / atomgit_access_token
api.atomgit.com / ATOMCODE_TRUSTED_HOSTS
.auth.toml / /auth.toml / auth-refresh.lock
  ← ~/.atomcode/auth.toml 持久化，带刷新锁
Invalid auth.toml
auth.toml write failed:

3.2 认证请求签名（atomgit_sign.rs）

atomcode-signing-v1
X-AtomCode-Sig / X-AtomCode-Ts / X-AtomCode-Alg / X-AtomCode-Ver
HMAC accepts any key length

→ 带时间戳 + 算法 + 版本头的 HMAC 请求签名，防重放。

3.3 凭据使用硬约束

credentials must not be passed through ...
  NEVER put credentials in the arguments.
  `path` is relative to the API base, e.g. "/user/orgs" or "/repos/{owner}/{repo}"
Do not read AtomGit auth files; use atomgit_repo, atomgit_pr, or atomgit_issue

→ 工具参数中禁止出现凭据，认证走内部凭据通道。

---

4. 敏感路径门禁（全新防御面）

4.1 三层 Bash 门禁

门禁	职责
bash_workspace_gate	工作区边界：bash 不得逃逸工作区
credential_bash_gate	凭据门禁：拦截敏感路径访问
atomgit_bash_gate	AtomGit 命令门禁

4.2 敏感路径清单（完整还原）

~/.ssh/            SSH 私钥
.env / .env.local  / .env.example
credentials
auth.toml
.gcloud / gcloud
netrc / .netrc
.docker/config.json
.npmrc / .pypirc / .keystore
secrets/ / .terraform.d/
System/System32 (Windows)

agent may not touch sensitive paths (credentials / ~/.ssh / .env)

4.3 阻止语义

May send credentials or sensitive content to the model provider → denied
Tool call blocked by security ...
credential_shell_blocked          ← 凭据 shell 被阻止（WebUI 事件）
sensitive write approved (not remembered)
"__askpass" is handled early in run() before handle_command
  ← askpass 直通，绕过命令处理

4.4 泄漏检测

messages that leak sensitive values (tokens, paths, user data)

→ 输出过滤层检测向模型泄漏的敏感值。

---

5. AskPass 子系统（全新）

5.1 机制

SUDO_ASKPASS / SSH_ASKPASS / SSH_ASKPASS_REQUIRE / force
atomcode-askpass-  ← socket 前缀
ATOMCODE_ASKPASS_SOCK / ATOMCODE_ASKPASS_TOKEN
askpass non-interactive
Internal: askpass helper invoked by sudo/ssh via SUDO_ASKPASS / SSH_ASKPASS.

→ sudo/ssh 密码提示通过 askpass 转发：agent 无法看到密码，走独立 socket + token 通道。

5.2 流程

sudo/ssh 需要密码
  → SUDO_ASKPASS 指向 atomcode askpass helper
  → helper 经 ATOMCODE_ASKPASS_SOCK + TOKEN 联系主进程
  → 主进程向用户 UI 请求密码（非交互场景自动拒绝）
  → 凭据入 cache.rs，不外泄给 agent

---

6. File Index（全新）

crates/atomcode-capabilities/src/file_index.rs
indexed source file(s) > ...
no symbol index for ...
symbols indexed / no indexed symbols (code graph)

→ 文件符号索引为 code graph 与工具查询提供支撑（与 DEEP_ANALYSIS_14_CodeGraph 配套）。

---

7. 其他新工具

模块	说明
tools/memory.rs	memory 工具（配合 ATOMCODE_MEMORY_TOOL 环境变量）
tools/output_artifact.rs	输出产物工具
tools/request_user_input.rs	请求用户输入工具
tools/repair.rs	修复工具

---

8. 逆向方法论备注

1. 工具错误串 atomgit_repo create: name is required 直接暴露动作面 + 必填参数
2. atomcode-signing-v1 + X-AtomCode-Sig/Ts/Alg/Ver 头族还原请求签名协议
3. 敏感路径清单（~/.ssh/.env/gcloud/netrc 等）以纯文本完整枚举 → 门禁规则精确还原
4. __askpass handled early in run() 说明 askpass 在命令处理之前直通
5. 三个 bash 门禁文件名本身就是安全边界声明的第一手证据

---

本报告由持续分析循环生成 — v5.0.9 AtomGit 平台工具集与敏感路径门禁深度分析