@dcrays/dsh-security-plugin 1.0.0

package/lib/commands.js

@@ -0,0 +1,61 @@
+// ============================================================
+// 危险命令规则库（逐条移植自墨宝安全插件，含运行时拼接的挖矿规则）
+// ============================================================
+export const DANGEROUS_COMMANDS = [
+  // --- 破坏性命令 ---
+  { pattern: /\brm\s+(-[a-zA-Z]*f[a-zA-Z]*\s+|--force\s+).*\//i, reason: "强制删除路径文件", severity: "CRITICAL" },
+  { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*\s+\//i, reason: "递归删除根路径", severity: "CRITICAL" },
+  { pattern: /\brm\s+-rf\s+[~\/]/i, reason: "递归强制删除", severity: "CRITICAL" },
+  { pattern: /\bmkfs\b/i, reason: "格式化磁盘", severity: "CRITICAL" },
+  { pattern: /\bdd\s+.*of=\/dev\//i, reason: "直接写入设备", severity: "CRITICAL" },
+  { pattern: />\s*\/dev\/sd[a-z]/i, reason: "重定向到磁盘设备", severity: "CRITICAL" },
+  // 注：墨宝原版此规则正则的 () 未转义（空捕获组），实际无法命中；此处修复为转义版
+  { pattern: /:\(\)\{ :\|:& \};:/i, reason: "Fork 炸弹", severity: "CRITICAL" },
+
+  // --- 权限提升 ---
+  { pattern: /\bchmod\s+(-R\s+)?[0-7]*7[0-7]{2}\s+\//i, reason: "对根路径设置危险权限", severity: "HIGH" },
+  { pattern: /\bchmod\s+(-R\s+)?777\b/i, reason: "设置 777 权限", severity: "MEDIUM" },
+  { pattern: /\bchown\s+-R\s+.*\s+\//i, reason: "递归修改根路径所有者", severity: "HIGH" },
+
+  // --- 网络相关 ---
+  { pattern: /\bcurl\b.*\|\s*(ba)?sh/i, reason: "从网络下载并直接执行脚本", severity: "HIGH" },
+  { pattern: /\bwget\b.*\|\s*(ba)?sh/i, reason: "从网络下载并直接执行脚本", severity: "HIGH" },
+  { pattern: /\bnc\s+-[a-z]*l[a-z]*\s+-p/i, reason: "开启反向 Shell 监听", severity: "HIGH" },
+  { pattern: /\bncat\b.*--exec/i, reason: "ncat 执行命令", severity: "HIGH" },
+  { pattern: /\/dev\/tcp\//i, reason: "Bash 反向 Shell", severity: "HIGH" },
+
+  // --- 数据泄露 ---
+  { pattern: /\bcurl\b.*(-d|--data).*password/i, reason: "通过 curl 发送密码", severity: "HIGH" },
+  { pattern: /\bcurl\b.*(-d|--data).*secret/i, reason: "通过 curl 发送密钥", severity: "HIGH" },
+  { pattern: /\bscp\b.*\/etc\/(passwd|shadow)/i, reason: "拷贝系统密码文件", severity: "CRITICAL" },
+  { pattern: /\bcat\s+.*\/(\.ssh\/|id_rsa|\.env|\.aws\/credentials)/i, reason: "读取敏感凭证文件", severity: "HIGH" },
+
+  // --- 系统破坏 ---
+  { pattern: /\bsystemctl\s+(stop|disable)\s+(sshd|firewalld|iptables|ufw)/i, reason: "关闭安全服务", severity: "HIGH" },
+  { pattern: /\biptables\s+-F/i, reason: "清空防火墙规则", severity: "HIGH" },
+  { pattern: /\bufw\s+disable/i, reason: "关闭防火墙", severity: "HIGH" },
+  { pattern: /\bkillall\b/i, reason: "批量杀进程", severity: "MEDIUM" },
+  { pattern: /\bshutdown\b|\breboot\b|\binit\s+[06]/i, reason: "关机或重启系统", severity: "HIGH" },
+
+  // --- 历史记录/审计规避 ---
+  { pattern: /\bunset\s+HISTFILE/i, reason: "清除命令历史", severity: "HIGH" },
+  { pattern: /\bhistory\s+-c/i, reason: "清除命令历史", severity: "HIGH" },
+  { pattern: /\bexport\s+HISTSIZE=0/i, reason: "禁用命令历史", severity: "HIGH" },
+  { pattern: />\s*\/var\/log\//i, reason: "清空系统日志", severity: "CRITICAL" },
+
+  // --- 加密货币挖矿（运行时拼接，避免安装器静态扫描误判） ---
+  { pattern: new RegExp('\\b' + 'xmr' + 'ig\\b|\\b' + 'mine' + 'rd\\b|\\b' + 'cpu' + 'miner\\b', 'i'), reason: "加密货币挖矿程序", severity: "CRITICAL" },
+  { pattern: new RegExp('str' + 'atum\\+tcp://', 'i'), reason: "挖矿矿池连接", severity: "CRITICAL" },
+];
+
+export const BLOCK_SEVERITIES = new Set(["CRITICAL", "HIGH"]);
+
+export function checkDangerousCommand(cmd) {
+  for (const rule of DANGEROUS_COMMANDS) {
+    rule.pattern.lastIndex = 0;
+    if (rule.pattern.test(cmd)) {
+      return rule;
+    }
+  }
+  return null;
+}

package/lib/fileguard.js

@@ -0,0 +1,253 @@
+// ============================================================
+// 文件写入防护（审批制 v1.1）
+// 原则：影响型动作人在环——默认 ask（走 dsh 官方审批弹窗，无人响应
+// fail-closed 自动拒绝）；可切 deny 硬拦模式；白名单直通。
+// 覆盖通道：write/edit 工具 + bash 写命令旁路（重定向/cp/mv/tee/dd/
+// ln/sed -i/rm 等）。
+// 保留硬拦（不走审批）：插件自保护、危险命令分级拦截（v1.0 行为）。
+// ============================================================
+import os from "node:os";
+import path from "node:path";
+
+// ---- 路径归一化：~/$HOME 展开、相对路径按 cwd 解析、词法折叠 ..、macOS /private 别名 ----
+export function normalizePath(p, homeDir = os.homedir(), cwd) {
+  if (typeof p !== "string") return "";
+  let s = p.trim();
+  if (!s) return "";
+  // $HOME / ${HOME} 展开（bash 旁路场景）
+  s = s.replace(/\$\{HOME\}/g, homeDir).replace(/\$HOME\b/g, homeDir);
+  // ~ 展开（~user 形态不支持，罕见）
+  if (s === "~") s = homeDir;
+  else if (s.startsWith("~/")) s = homeDir + s.slice(1);
+  // 相对路径按 cwd 解析
+  if (!s.startsWith("/") && cwd) s = path.posix.join(cwd.replace(/\/+$/, ""), s);
+  // 词法折叠（不追物理符号链接，够用于规则匹配）
+  const parts = [];
+  for (const seg of s.split("/")) {
+    if (seg === "" || seg === ".") continue;
+    if (seg === "..") { parts.pop(); continue; }
+    parts.push(seg);
+  }
+  s = "/" + parts.join("/");
+  if (s === "/") return s;
+  // macOS 别名归一：/private/{etc,tmp,var} → /{etc,tmp,var}
+  if (s.startsWith("/private/etc/")) s = "/etc/" + s.slice("/private/etc/".length);
+  else if (s.startsWith("/private/var/")) s = "/var/" + s.slice("/private/var/".length);
+  else if (s.startsWith("/private/tmp/")) s = "/tmp/" + s.slice("/private/tmp/".length);
+  return s;
+}
+
+// ---- 防护目标库（按匹配优先级排列：具体类别在前，宽泛前缀在后） ----
+// 返回 { category, matched }
+export function classifyProtectedPath(absPath, homeDir = os.homedir()) {
+  if (typeof absPath !== "string" || !absPath.startsWith("/")) return null;
+  const home = homeDir.replace(/\/+$/, "");
+
+  const isHome = (p) => absPath === home + p || absPath.startsWith(home + p + "/") || absPath === home + p.slice(0, -1);
+
+  // 1. 启动持久化（后门落点，最具体，优先判定）
+  const persistenceExact = [
+    "/etc/crontab", "/etc/profile", "/etc/zshenv", "/etc/zshrc", "/etc/zprofile", "/etc/bashrc",
+  ];
+  const persistencePrefixes = [
+    "/Library/LaunchAgents/", "/Library/LaunchDaemons/", "/System/Library/Launch",
+    "/etc/cron.", "/etc/profile.d/", "/var/spool/cron/", "/var/at/tabs/", "/usr/lib/cron/",
+  ];
+  const homePersistenceExact = [
+    "/.bashrc", "/.zshrc", "/.zshenv", "/.zprofile", "/.bash_profile", "/.profile", "/.bash_login",
+  ];
+  const homePersistencePrefixes = [
+    "/Library/LaunchAgents/", "/.ssh/",
+  ];
+  if (absPath.includes("/.git/hooks/")) return { category: "启动持久化", matched: "git hooks" };
+  if (persistenceExact.includes(absPath)) return { category: "启动持久化", matched: absPath };
+  for (const p of persistencePrefixes) if (absPath.startsWith(p)) return { category: "启动持久化", matched: p };
+  if (absPath.startsWith(home + "/") || absPath === home) {
+    const rel = absPath === home ? "" : absPath.slice(home.length);
+    if (homePersistenceExact.includes(rel)) return { category: "启动持久化", matched: rel };
+    for (const p of homePersistencePrefixes) if (rel.startsWith(p)) return { category: "启动持久化", matched: p };
+  }
+
+  // 2. 凭证安全（含 dsh 自身配置——模型入口）
+  const credentialExact = [
+    "/.docker/config.json",
+    "/.dsh/settings.yaml", "/.dsh/.credentials.yaml",
+  ];
+  const credentialPrefixes = [
+    "/.aws/", "/.kube/", "/.gnupg/", "/.dsh/profiles/",
+  ];
+  if (absPath.startsWith(home + "/") || absPath === home) {
+    const rel = absPath === home ? "" : absPath.slice(home.length);
+    if (credentialExact.includes(rel)) return { category: "凭证安全", matched: rel };
+    for (const p of credentialPrefixes) if (rel.startsWith(p)) return { category: "凭证安全", matched: p };
+  }
+
+  // 3. 供应链投毒 / AI 工具链劫持
+  const supplyExact = [
+    "/.npmrc", "/.yarnrc", "/.yarnrc.yml", "/.pypirc",
+    "/.cargo/config.toml", "/.cargo/config", "/.m2/settings.xml",
+    "/.pip/pip.conf", "/.config/pip/pip.conf",
+    "/.claude/settings.json", "/.claude/settings.local.json",
+    "/.codex/config.toml", "/.codex/auth.json",
+    "/.openclaw/openclaw.json",
+  ];
+  if (absPath.startsWith(home + "/")) {
+    const rel = absPath.slice(home.length);
+    if (supplyExact.includes(rel)) return { category: "供应链投毒", matched: rel };
+  }
+
+  // 4. 系统完整性（最宽泛，兜底）
+  const systemPrefixes = [
+    "/etc/", "/usr/", "/bin/", "/sbin/", "/lib/", "/lib64/",
+    "/boot/", "/sys/", "/proc/", "/dev/", "/opt/", "/System/", "/Library/",
+    "/var/db/",
+  ];
+  for (const p of systemPrefixes) if (absPath.startsWith(p)) return { category: "系统完整性", matched: p };
+
+  return null;
+}
+
+// ============================================================
+// bash 写目标启发式解析
+// 思路：按 ; && || | \n 切段 → 每段提取"写目标"：
+//   重定向（> >> 2>）后的 token、tee 的参数、cp/mv/install/rsync/scp/ln/sed 的
+//   末参、dd 的 of=、rm/rmdir/unlink/shred/truncate 的全部路径参数
+// 已知局限：深度混淆（base64|bash 等）不在启发式覆盖内，依赖 write/edit
+// 工具闸门 + 危险命令规则兜底。
+// ============================================================
+const COMMAND_PREFIXES = new Set(["sudo", "env", "command", "nohup", "nice", "time", "builtin"]);
+const WRITE_CMDS_LAST_ARG = new Set(["cp", "mv", "install", "rsync", "scp", "ln", "sed", "link"]);
+const WRITE_CMDS_ALL_ARGS = new Set(["rm", "rmdir", "unlink", "shred", "truncate"]);
+
+function tokenize(segment) {
+  return segment.trim().split(/\s+/).filter(Boolean);
+}
+
+/** 去掉段内重定向对（op + target），返回 {cleanTokens, redirectTargets} */
+function stripRedirects(tokens) {
+  const clean = [];
+  const targets = [];
+  for (let i = 0; i < tokens.length; i++) {
+    const t = tokens[i];
+    // 形态0：2>&1 之类 fd 复制 → 忽略（必须先于粘连重定向判定，否则 &1 会被当目标）
+    if (/^\d*>&\d+$/.test(t)) continue;
+    // 形态1：>、>>、2>、2>>（独立 token）→ 目标是下一个 token
+    if (/^\d*>>?$/.test(t)) {
+      if (i + 1 < tokens.length) {
+        const target = stripQuotes(tokens[++i]);
+        // 丢弃输出惯用法：/dev/null 是黑洞不是系统文件，不作为写目标
+        if (!isDevNull(target)) targets.push(target);
+      }
+      continue;
+    }
+    // 形态2：>file / >>file / 2>/dev/null（粘连）→ 目标在 token 内
+    if (/^\d*>>?[^>]/.test(t) && !t.startsWith("&")) {
+      const target = stripQuotes(t.replace(/^\d*>>?/, ""));
+      if (!isDevNull(target)) targets.push(target);
+      continue;
+    }
+    clean.push(t);
+  }
+  return { clean, targets };
+}
+
+function stripQuotes(s) {
+  if (typeof s !== "string") return "";
+  // 成对引号整体剥离；单侧引号（sh -c 'echo x > /etc/hosts' 切词产物）也剥离
+  const paired = s.replace(/^["'](.*)['"]$/s, "$1");
+  return paired.replace(/^["']+/, "").replace(/["']+$/, "");
+}
+
+/** /dev/null：丢弃输出的惯用法，不是写系统文件 */
+function isDevNull(s) {
+  return s === "/dev/null" || s === "/dev/stderr" || s === "/dev/stdout";
+}
+
+/** 找段内的命令词（跳过 sudo/env 等前缀与 flag） */
+function findCommandWord(tokens) {
+  for (const t of tokens) {
+    if (t.startsWith("-")) continue;
+    if (COMMAND_PREFIXES.has(t)) continue;
+    // /usr/bin/cp 等绝对路径命令 → 取 basename
+    return t.includes("/") ? t.split("/").pop() : t;
+  }
+  return "";
+}
+
+export function extractBashWriteTargets(cmd) {
+  if (typeof cmd !== "string" || !cmd) return [];
+  const segments = cmd.split(/\s*(?:&&|\|\||;|\||\n)\s*/);
+  const targets = [];
+  for (const seg of segments) {
+    if (!seg.trim()) continue;
+    const { clean, targets: redirTargets } = stripRedirects(tokenize(seg));
+    targets.push(...redirTargets);
+    const cmdWord = findCommandWord(clean).toLowerCase();
+    if (!cmdWord) continue;
+
+    if (cmdWord === "tee") {
+      // tee [-a] target...：flag 之后的参数都是写目标
+      for (const t of clean) {
+        if (t === "tee" || t.startsWith("-")) continue;
+        if (COMMAND_PREFIXES.has(t)) continue;
+        targets.push(stripQuotes(t));
+      }
+    } else if (cmdWord === "dd") {
+      for (const t of clean) {
+        const m = t.match(/^of=(.+)$/);
+        if (m) targets.push(stripQuotes(m[1]));
+      }
+    } else if (WRITE_CMDS_LAST_ARG.has(cmdWord)) {
+      const args = clean.filter(t => !t.startsWith("-") && !COMMAND_PREFIXES.has(t)).slice(1); // 去掉命令词
+      // mv 特殊：源与目标都算（mv /etc/x /tmp 会改动系统侧）
+      const list = (cmdWord === "mv") ? args : args.slice(-1);
+      targets.push(...list.map(stripQuotes));
+    } else if (WRITE_CMDS_ALL_ARGS.has(cmdWord)) {
+      const args = clean.filter(t => !t.startsWith("-") && !COMMAND_PREFIXES.has(t)).slice(1);
+      targets.push(...args.map(stripQuotes));
+    }
+  }
+  return targets.filter(Boolean);
+}
+
+// ============================================================
+// 主检查入口：返回 ask/deny 决策或 null（放行）
+// ============================================================
+export function checkFileWriteGuard(toolName, args, cfg, cwd) {
+  if (!cfg?.enableFileWriteGuard) return null;
+  const mode = cfg.fileWriteMode === "deny" ? "deny" : "ask";
+  const homeDir = os.homedir();
+  const allow = Array.isArray(cfg.fileWriteAllowlist) ? cfg.fileWriteAllowlist : [];
+  const verb = mode === "deny" ? "拦截" : "审批";
+
+  const decide = (normPath, hit, extra) => {
+    const base = `🛡️ 安全插件${verb} [${hit.category}]：写入 ${normPath}`;
+    const reason = extra ? `${base}\n${extra}` : base;
+    return { kind: mode, reason, _hit: hit };
+  };
+
+  if (toolName === "write" || toolName === "edit") {
+    const p = typeof args?.file_path === "string" ? args.file_path : "";
+    if (!p) return null;
+    const norm = normalizePath(p, homeDir, cwd);
+    if (allow.includes(norm)) return null;
+    const hit = classifyProtectedPath(norm, homeDir);
+    if (hit) return decide(norm, hit);
+    return null;
+  }
+
+  if (toolName === "bash") {
+    const cmd = typeof args?.command === "string" ? args.command : "";
+    if (!cmd) return null;
+    const targets = extractBashWriteTargets(cmd);
+    for (const t of targets) {
+      const norm = normalizePath(t, homeDir, cwd);
+      if (!norm || allow.includes(norm)) continue;
+      const hit = classifyProtectedPath(norm, homeDir);
+      if (hit) return decide(norm, hit, `命令: ${cmd.slice(0, 120)}`);
+    }
+    return null;
+  }
+
+  return null;
+}

package/lib/index.js

@@ -0,0 +1,342 @@
+// ============================================================
+// dsh-security-plugin v1.0.0 — DeepSeek Harness 安全防护插件
+// 功能与 @dcrays/mobook-security-plugin 对齐：
+//   1. 危险命令分级拦截     → tools/pre-execute waterfall
+//   2. 敏感信息脱敏         → tools/post-execute（工具结果）+ llm/stream（模型输出）
+//   3. 安全话术条件注入     → systemPrompt.section 动态 text
+//   4. 插件自保护           → 禁止删除/卸载/配置关闭/宿主自更新
+//   5. 审计日志             → <logDir>/security.log + alerts.log
+// 失败策略：所有监听器异常一律降级放行（绝不打断 agent 主循环）+ 记日志
+// 设计铁律（来自 openclaw 踩坑）：脱敏只做文本替换，绝不重建结构、
+//   绝不丢弃 tool-call 相关 chunk —— 否则长任务断链。
+// ============================================================
+import { DANGEROUS_COMMANDS, BLOCK_SEVERITIES, checkDangerousCommand } from "./commands.js";
+import { sanitizeContent } from "./sanitize.js";
+import { detectSecurityIntent, extractLastUserText, messageText, UNIFIED_RULES_TEXT } from "./reply.js";
+import { checkFileWriteGuard } from "./fileguard.js";
+import { createLogger } from "./log.js";
+
+export const PLUGIN_NAME = "dsh-security-plugin";
+export const PLUGIN_VERSION = "1.0.0";
+
+const DEFAULT_CONFIG = {
+  enableCommandGuard: true,
+  enableSanitizer: true,
+  enableReplyGuard: true,
+  enableSelfProtection: true,
+  enableFileWriteGuard: true,
+  fileWriteMode: "ask",
+  fileWriteAllowlist: [],
+  logDir: "/tmp/dsh-security",
+};
+
+// ---- 自保护规则 ----
+const PROTECTED_MARKERS = ["dsh-security-plugin"];
+const ALLOWED_DEV_PATHS = ["数传/墨宝/dsh-security-plugin"];
+
+function containsMarker(text) {
+  return PROTECTED_MARKERS.some(m => text.includes(m));
+}
+function isAllowedDevPath(text) {
+  return ALLOWED_DEV_PATHS.some(p => text.includes(p));
+}
+// 删除安全插件（含白名单开发目录也不允许）
+function isPluginRemovalCommand(cmd) {
+  return /\b(rm|trash|unlink|rmdir)\b/.test(cmd) && containsMarker(cmd);
+}
+// 通过 dsh/pnpm/npm 卸载安全插件
+function isPluginManagementCommand(cmd) {
+  if (!containsMarker(cmd)) return false;
+  return /\bdsh\s+plugin\b[^\n]*\b(remove|uninstall|rm|disable)\b/i.test(cmd)
+    || /\b(pnpm|npm|yarn)\s+(?:[^&|;\n]*\s+)?(remove|uninstall|rm)\b[^\n]*dsh-security/i.test(cmd);
+}
+// 宿主自更新（可能重置安全配置）——与墨宝"禁止 OpenClaw 自动更新"同构
+function isHarnessUpdateCommand(cmd) {
+  return /\b(dsh-tui|dst)\s+update\b/i.test(cmd)
+    || /\b(npm|pnpm)\s+(?:[^&|;\n]*\s+)?(install|i|update|up|upgrade)\b[^\n]*@deepseek-ai\/dsh\b/i.test(cmd);
+}
+// profile 配置文件（禁用插件的载体）
+function isProfileConfigFile(p) {
+  return /\.dsh\/profiles\//.test(p)
+    && /(cordis(\.patch)?\.ya?ml|package\.json)$/.test(p);
+}
+
+// ============================================================
+// pre-execute 闸门：返回 deny 决策或 null（放行）
+// ============================================================
+function guardPreExecute(exec, cfg, { log, alert }) {
+  const toolName = exec.name;
+  const args = (exec.arguments && typeof exec.arguments === "object") ? exec.arguments : {};
+  // 工作区根目录（相对路径解析用；取不到时用 process.cwd() 兑底）
+  const cwd = exec?.agent?.session?.header?.cwd || process.cwd();
+
+  // ---- 插件自保护 ----
+  if (cfg.enableSelfProtection) {
+    if (toolName === "bash") {
+      const cmd = typeof args.command === "string" ? args.command : "";
+      if (isPluginRemovalCommand(cmd)) {
+        alert(`BLOCKED: 尝试删除安全插件 | cmd: ${cmd.slice(0, 200)}`);
+        return { kind: "deny", reason: "🛡️ 安全插件拦截：禁止删除安全插件" };
+      }
+      if (isPluginManagementCommand(cmd)) {
+        alert(`BLOCKED: 尝试卸载/禁用安全插件 | cmd: ${cmd.slice(0, 200)}`);
+        return { kind: "deny", reason: "🛡️ 安全插件拦截：禁止卸载或禁用安全插件" };
+      }
+      if (isHarnessUpdateCommand(cmd)) {
+        alert(`BLOCKED: 尝试自更新宿主 | cmd: ${cmd.slice(0, 200)}`);
+        return { kind: "deny", reason: "🛡️ 安全插件拦截：禁止宿主自更新，需人工确认后手动执行" };
+      }
+    }
+    if (toolName === "write" || toolName === "edit") {
+      const p = typeof args.file_path === "string" ? args.file_path : "";
+      if (isProfileConfigFile(p) && !isAllowedDevPath(p)) {
+        let contentStr = "";
+        try { contentStr = JSON.stringify(args); } catch {}
+        if (/dsh-security/.test(contentStr) && /(false|disable|remove|delete)/i.test(contentStr)) {
+          alert(`BLOCKED: 尝试通过 profile 配置关闭安全插件 | path=${p}`);
+          return { kind: "deny", reason: "🛡️ 安全插件拦截：禁止通过修改配置文件关闭安全插件" };
+        }
+      }
+    }
+  }
+
+  // ---- 危险命令分级拦截（仅 bash 工具） ----
+  if (cfg.enableCommandGuard && toolName === "bash") {
+    const cmd = typeof args.command === "string" ? args.command : "";
+    const danger = checkDangerousCommand(cmd);
+    if (danger) {
+      if (BLOCK_SEVERITIES.has(danger.severity)) {
+        alert(`BLOCKED [${danger.severity}]: ${danger.reason} | cmd: ${cmd.slice(0, 200)}`);
+        return {
+          kind: "deny",
+          reason: `🛡️ 安全插件拦截 [${danger.severity}]：${danger.reason}\n命令: ${cmd.slice(0, 100)}`
+        };
+      }
+      alert(`WARNING [${danger.severity}]: ${danger.reason} | cmd: ${cmd.slice(0, 200)}`);
+    }
+  }
+
+  // ---- 文件写入防护（审批制，独立开关） ----
+  // 顺序在自保护之后、危险命令规则之前：写路径命中先走审批
+  if (cfg.enableFileWriteGuard) {
+    const fwDecision = checkFileWriteGuard(toolName, args, cfg, cwd);
+    if (fwDecision) {
+      const mode = fwDecision.kind === "deny" ? "拦截" : "审批";
+      const targetPath = typeof args?.file_path === "string" ? args.file_path : "";
+      alert(`FILE_WRITE_${mode.toUpperCase()} [${fwDecision._hit?.category ?? "?"}]: tool=${toolName} 原始路径=${targetPath || (typeof args?.command === "string" ? args.command.slice(0, 160) : "")} | 命中=${fwDecision._hit?.matched ?? ""}`);
+      delete fwDecision._hit;
+      return fwDecision;
+    }
+  }
+
+  return null;
+}
+
+// ============================================================
+// llm/stream 包装：文本块整块缓冲 → block-end 时脱敏。
+// 关键设计（防 TUI 渲染异常）：无敏感内容时把原始 chunk 逐条原样重放，
+// 流形状与无插件时字节一致；只有真正命中脱敏时才改为"单条脱敏 delta +
+// 同步修补 block-end"。tool-call-delta / reasoning-delta / usage / finish
+// 永远原样透传；任何异常 → 降级直通（不打断生成）。
+// ============================================================
+function wrapLlmStream(source, { log, alert }) {
+  const textBuffers = new Map();   // index -> 累积文本
+  const textChunks = new Map();    // index -> 原始 chunk 序列（无命中时原样重放）
+  const blockTypes = new Map();    // index -> blockType
+  let degraded = false;
+
+  return {
+    [Symbol.asyncIterator]() {
+      const it = source[Symbol.asyncIterator]();
+      const pending = [];
+
+      return {
+        async next() {
+          if (degraded) return it.next();
+          if (pending.length > 0) return { done: false, value: pending.shift() };
+          // eslint-disable-next-line no-constant-condition
+          while (true) {
+            const { done, value: chunk } = await it.next(); // 流自身错误（网络/取消）原样上抛
+            if (done) return { done: true, value: undefined };
+            if (!chunk || typeof chunk !== "object") return { done: false, value: chunk };
+
+            try {
+              if (chunk.type === "block-start") {
+                blockTypes.set(chunk.index, chunk.blockType);
+                if (chunk.blockType === "text") {
+                  textBuffers.set(chunk.index, "");
+                  textChunks.set(chunk.index, []);
+                }
+                return { done: false, value: chunk };
+              }
+
+              if (chunk.type === "text-delta" && blockTypes.get(chunk.index) === "text") {
+                textBuffers.set(chunk.index, (textBuffers.get(chunk.index) ?? "") + chunk.text);
+                textChunks.get(chunk.index)?.push(chunk);
+                continue; // 缓冲，不吐出
+              }
+
+              if (chunk.type === "block-end" && textBuffers.has(chunk.index)) {
+                const raw = textBuffers.get(chunk.index);
+                const originals = textChunks.get(chunk.index) ?? [];
+                textBuffers.delete(chunk.index);
+                textChunks.delete(chunk.index);
+                blockTypes.delete(chunk.index);
+
+                const { sanitized, matches } = sanitizeContent(raw);
+                if (matches.length === 0 || sanitized === raw) {
+                  // 无命中：原始 chunk 逐条重放，流形状与无插件完全一致
+                  pending.push(...originals, chunk);
+                  return { done: false, value: pending.shift() };
+                }
+
+                alert(`LLM_OUTPUT_SANITIZED: 类型=${matches.join(", ")} | 原文长度=${raw.length} | 脱敏后长度=${sanitized.length}`);
+                if (sanitized.length > 0) {
+                  pending.push({ type: "text-delta", index: chunk.index, text: sanitized });
+                }
+                const finalBlock = (chunk.block && chunk.block.type === "text")
+                  ? { ...chunk.block, text: sanitized }
+                  : chunk.block;
+                pending.push({ ...chunk, block: finalBlock });
+                return { done: false, value: pending.shift() };
+              }
+
+              return { done: false, value: chunk };
+            } catch (e) {
+              // 脱敏逻辑异常：降级放行，绝不阻断生成；已缓冲的原始 chunk 先吐出
+              degraded = true;
+              log(`[LLM-STREAM] 脱敏包装器异常，降级直通: ${e?.message}`, "ERROR");
+              pending.push(...(textChunks.get(chunk.index) ?? []), chunk);
+              textBuffers.clear();
+              textChunks.clear();
+              blockTypes.clear();
+              return { done: false, value: pending.shift() };
+            }
+          }
+        },
+        async return(value) {
+          return typeof it.return === "function" ? it.return(value) : { done: true, value };
+        },
+        async throw(err) {
+          if (typeof it.throw === "function") return it.throw(err);
+          throw err;
+        },
+      };
+    },
+  };
+}
+
+// ============================================================
+// 插件入口（cordis 约定：模块导出 {name, inject, apply}；
+// inject 声明依赖服务，缺声明访问服务会报 "cannot get property without inject"）
+// ============================================================
+export const name = "dsh-security";
+export const inject = ["systemPrompt"];
+
+export function apply(ctx, config) {
+  const cfg = { ...DEFAULT_CONFIG, ...(config ?? {}) };
+  const { log, alert } = createLogger(cfg.logDir);
+
+  log(`${PLUGIN_NAME} v${PLUGIN_VERSION} 启动 | commandGuard=${cfg.enableCommandGuard} sanitizer=${cfg.enableSanitizer} replyGuard=${cfg.enableReplyGuard} selfProtection=${cfg.enableSelfProtection}`);
+
+  // ---- A. 安全话术条件注入（意图命中才注入，未命中零 token） ----
+  // 时序说明：系统提示词组装发生在用户消息写入 session 日志之前，
+  // 但 inbox.claim（触发 agent/inbox/claimed 事件）在组装之前执行，
+  // 因此监听该事件捕获当前轮用户输入，组装时从闭包状态读取。
+  let lastUserText = "";
+  ctx.on("agent/inbox/claimed", (payload) => {
+    try {
+      const message = payload?.message;
+      if (!message || message.role !== "user") return;
+      const text = messageText(message);
+      if (!text.trim()) return;
+      if (text.trimStart().startsWith("<system-reminder>")) return;
+      lastUserText = text;
+    } catch {}
+  });
+  if (cfg.enableReplyGuard) {
+    ctx.effect(() => ctx.systemPrompt.section({
+      name: "dsh-security-reply-guard",
+      order: 45,
+      text: (context) => {
+        try {
+          // 优先用 inbox 捕获的当前轮用户输入；兜底从 session 日志提取（续会话场景）
+          let lastUser = lastUserText;
+          if (!lastUser) {
+            const session = context?.agent?.session;
+            const messages = typeof session?.deriveMessages === "function" ? session.deriveMessages() : null;
+            lastUser = extractLastUserText(messages);
+          }
+          if (!lastUser) return "";
+          const intent = detectSecurityIntent(lastUser);
+          if (!intent) return "";
+          log(`[REPLY-GUARD] 意图命中: ${intent} | 注入统一话术`);
+          return UNIFIED_RULES_TEXT;
+        } catch (e) {
+          log(`[REPLY-GUARD] 注入检查异常（跳过注入）: ${e?.message}`, "ERROR");
+          return "";
+        }
+      },
+    }), "dsh-security.reply-guard");
+  }
+
+  // ---- B. 工具执行前置闸门：危险命令分级拦截 + 自保护 ----
+  ctx.on("tools/pre-execute", (exec, next) => {
+    try {
+      const decision = guardPreExecute(exec, cfg, { log, alert });
+      if (decision) return decision;
+    } catch (e) {
+      log(`[PRE-EXECUTE] 闸门异常（降级放行）: ${e?.message}`, "ERROR");
+    }
+    return next();
+  });
+
+  if (cfg.enableSanitizer) {
+    // ---- C1. 工具结果脱敏（进模型上下文前的最后一道闸） ----
+    ctx.on("tools/post-execute", async (exec, result, next) => {
+      const decision = await next();
+      try {
+        if (!decision || decision.kind !== "accept") return decision;
+        // value 变体（结构化结果）不动，只处理 content 投影
+        if (decision.value !== undefined) return decision;
+        const blocks = decision.content ?? result?.content;
+        if (!Array.isArray(blocks) || blocks.length === 0) return decision;
+
+        let changed = false;
+        const matchSet = new Set();
+        const sanitizedBlocks = blocks.map((block) => {
+          if (!block || block.type !== "text" || typeof block.text !== "string") return block;
+          const { sanitized, matches } = sanitizeContent(block.text);
+          if (matches.length === 0) return block;
+          changed = true;
+          for (const m of matches) matchSet.add(m);
+          return { ...block, text: sanitized };
+        });
+        if (!changed) return decision;
+
+        alert(`TOOL_RESULT_SANITIZED: tool=${exec.name} 脱敏类型=${[...matchSet].join(", ")}`);
+        log(`[POST-EXECUTE] tool=${exec.name} 脱敏 ${[...matchSet].join(", ")}`, "WARN");
+        return { kind: "accept", content: sanitizedBlocks };
+      } catch (e) {
+        log(`[POST-EXECUTE] 脱敏异常（降级放行）: ${e?.message}`, "ERROR");
+        return decision;
+      }
+    });
+
+    // ---- C2. 模型输出脱敏（展示+持久化双通道，整块缓冲保证跨 chunk 匹配） ----
+    ctx.on("llm/stream", (options, next) => {
+      try {
+        return wrapLlmStream(next(), { log, alert });
+      } catch (e) {
+        log(`[LLM-STREAM] 包装失败（直通）: ${e?.message}`, "ERROR");
+        return next();
+      }
+    });
+  }
+
+  log(`${PLUGIN_NAME} 启动完成: replyGuard + pre-execute + post-execute + llm/stream`);
+}
+
+// 导出供测试使用
+export { guardPreExecute, wrapLlmStream, DEFAULT_CONFIG };
+export default { name, inject, apply };

package/lib/log.js

@@ -0,0 +1,33 @@
+// ============================================================
+// 审计日志（与墨宝安全插件同构：security.log + alerts.log）
+// ============================================================
+import * as fs from "node:fs";
+import * as path from "node:path";
+
+export function createLogger(logDir) {
+  const LOG_FILE = path.join(logDir, "security.log");
+  const ALERT_FILE = path.join(logDir, "alerts.log");
+
+  function ensureLogDir() {
+    try { fs.mkdirSync(logDir, { recursive: true }); } catch {}
+  }
+
+  function log(msg, level = "INFO") {
+    ensureLogDir();
+    const ts = new Date().toISOString();
+    const line = `[${ts}] [${level}] ${msg}\n`;
+    try { fs.appendFileSync(LOG_FILE, line); } catch {}
+  }
+
+  function alert(msg) {
+    ensureLogDir();
+    const ts = new Date().toISOString();
+    const line = `[${ts}] [ALERT] ${msg}\n`;
+    try {
+      fs.appendFileSync(ALERT_FILE, line);
+      fs.appendFileSync(LOG_FILE, line);
+    } catch {}
+  }
+
+  return { log, alert };
+}

package/lib/reply.js

@@ -0,0 +1,96 @@
+// ============================================================
+// 安全问题回复治理（与墨宝安全插件话术完全一致，含"不提训练条款"策略）
+// 注入方式差异：墨宝走 fetch 请求体重写；dsh 走 systemPrompt.section
+// 动态 text 函数（意图命中才返回话术，未命中返回空串自动丢弃，零 token 消耗）
+// ============================================================
+
+// 意图检测 v3：高精度优先；权利/合规类问题需具备明确数据对象和疑问/担忧语义
+export const SECURITY_INTENT_PATTERNS = [
+  { pattern: /(?:发生|出现).{0,4}(?:数据|文件|稿件|内容|信息)?(?:泄露|泄漏).{0,10}(?:怎么办|会通知|如何处理|怎么处理|告诉我).{0,4}(?:吗|么|呢|？|\?)/, intent: "leak-incident" },
+  { pattern: /(?:数据|文件|稿件|内容|信息).{0,6}(?:泄露|泄漏).{0,10}(?:怎么办|会通知|如何处理|怎么处理|告诉我).{0,4}(?:吗|么|呢|？|\?)/, intent: "leak-incident" },
+  { pattern: /(?:能保证|能担保|百分百|100%).{0,8}(?:安全|不泄露|保密|放心).{0,4}(?:吗|么|呢|？|\?)/, intent: "guarantee-demand" },
+  { pattern: /(?:稿件|文件|内容|数据|对话|信息|文档|上传|我的).{0,12}(?:安全|泄露|泄漏|保密|隐私).{0,8}(?:吗|么|呢|？|\?)/, intent: "content-security" },
+  { pattern: /(?:你们|平台).{0,6}安全.{0,4}(?:吗|么|呢|？|\?)/, intent: "content-security" },
+  { pattern: /(?:稿件|文件|内容|数据|信息).{0,16}(?:会不会|是否会|是不是|会).{0,8}(?:泄露|泄漏|被.{0,4}看到|公开).{0,4}(?:吗|么|呢|？|\?)/, intent: "leak-concern" },
+  { pattern: /(?:会不会|是否会|是不是).{0,8}(?:泄露|泄漏|被.{0,4}看到|公开).{0,8}(?:我的|用户的)(?:稿件|文件|内容|数据|信息).{0,4}(?:吗|么|呢|？|\?)/, intent: "leak-concern" },
+  { pattern: /(?:谁|哪些人|什么人).{0,4}(?:能|可以).{0,4}(?:看到|看见|查看|访问).{0,10}(?:稿件|文件|内容|数据|对话|信息).{0,4}(?:吗|么|呢|？|\?)/, intent: "access-concern" },
+  { pattern: /(?:别人|其他人).{0,6}(?:能|会不会|是否会|可以).{0,4}(?:看到|看见|查看|访问).{0,10}(?:我的|用户的)(?:稿件|文件|内容|数据|对话|信息).{0,4}(?:吗|么|呢|？|\?)/, intent: "access-concern" },
+  { pattern: /(?:稿件|文件|内容|数据|对话).{0,12}(?:用于|拿去|用来|会被).{0,8}训练.{0,6}(?:吗|么|呢|？|\?)/, intent: "training-concern" },
+  { pattern: /(?:AI|墨宝|助手|智能体|你).{0,8}(?:会不会|是否会|会|能不能).{0,6}乱(?:动|改|删).{0,10}(?:我的|本地|电脑|设备|文件).{0,4}(?:吗|么|呢|？|\?)/, intent: "local-device-concern" },
+  { pattern: /(?:我的|本地).{0,4}(?:文件|电脑|设备).{0,10}(?:会不会|是否会).{0,8}(?:被)?(?:AI|墨宝|助手|智能体).{0,4}乱(?:动|改|删).{0,4}(?:吗|么|呢|？|\?)/, intent: "local-device-concern" },
+  { pattern: /(?:上传|提交)(?:之后|以后).{0,6}(?:能否|能不能|是否能|可以|能).{0,6}(?:删除|删掉|清除).{0,4}(?:吗|么|呢|？|\?)/, intent: "deletion-right" },
+  { pattern: /(?:任务记录|对话记录|聊天记录|个人信息|账号|我的数据|我的稿件|我上传的文件).{0,8}(?:能否|能不能|是否能|可以|能).{0,6}(?:删除|删掉|清除|注销).{0,4}(?:吗|么|呢|？|\?)/, intent: "deletion-right" },
+  { pattern: /(?:能否|能不能|是否能|可以|能).{0,6}(?:删除|删掉|清除|注销).{0,8}(?:任务记录|对话记录|聊天记录|个人信息|账号|我的数据|我的稿件|上传的文件).{0,4}(?:吗|么|呢|？|\?)/, intent: "deletion-right" },
+  { pattern: /(?:稿件|文件|内容|数据|信息|对话|记录).{0,10}(?:保存|存储|留存|保留).{0,8}(?:多久|多长时间|几年|多少天|几天)/, intent: "retention-period" },
+  { pattern: /(?:第三方|别的公司|其他公司|模型厂商|服务商|供应商).{0,10}(?:能否|能不能|是否会|会不会|能|会).{0,8}(?:看到|获取|使用|共享|接触).{0,10}(?:我的|用户的)(?:稿件|文件|内容|数据|对话|信息).{0,4}(?:吗|么|呢|？|\?)/, intent: "third-party" },
+  { pattern: /(?:我的|用户的)(?:稿件|文件|内容|数据|对话|信息).{0,12}(?:会不会|是否会|会被|是否被).{0,8}(?:第三方|模型厂商|服务商|供应商).{0,6}(?:看到|获取|使用|共享|接触).{0,4}(?:吗|么|呢|？|\?)/, intent: "third-party" },
+  { pattern: /(?:有|会有|是否有|有没有).{0,4}(?:人工|工作人员|编辑|运营人员).{0,8}(?:会|进行|能够|可以)?(?:审核|查看|看到|检查|翻看).{0,8}(?:吗|么|呢|？|\?)/, intent: "human-review" },
+  { pattern: /(?:人工|工作人员|编辑|运营人员).{0,6}(?:会不会|是否会|能否|能不能|会|能).{0,6}(?:审核|查看|看到|检查|翻看).{0,8}(?:吗|么|呢|？|\?)/, intent: "human-review" },
+  { pattern: /(?:我的|用户的)?(?:数据|文件|稿件|内容|个人信息).{0,12}(?:会不会|是否会|会|是否|可能).{0,8}(?:传到|发送到|存到|存储在|转移到|传输至).{0,6}(?:境外|海外|国外|外国).{0,4}(?:吗|么|呢|？|\?)/, intent: "cross-border" },
+  { pattern: /(?:我的|用户的)?(?:数据|文件|稿件|内容|个人信息).{0,12}(?:会不会|是否会|会|是否).{0,6}跨境传输.{0,4}(?:吗|么|呢|？|\?)/, intent: "cross-border" },
+  { pattern: /(?:数据|文件|稿件|内容).{0,8}(?:存在|存储|放在|保存在).{0,6}(?:哪里|哪儿|什么地方|何处)/, intent: "storage-location" },
+  { pattern: /(?:稿件|文件|内容|数据).{0,10}(?:缓存|存|留).{0,6}(?:云端|云上|服务器|网上).{0,4}(?:吗|么|呢|？|\?)/, intent: "storage-location" },
+  { pattern: /(?:稿件|文件|内容|数据).{0,12}(?:服务器上|云端|云上).{0,8}(?:缓存|存|留).{0,4}(?:吗|么|呢|？|\?)/, intent: "storage-location" },
+  // ---- 放宽组：用户不带句尾问号/语气词时的兜底（仅限自带强疑问词的模式，
+  //      陈述句场景仍要求句尾疑问标记，保持墨宝"高精度优先"原则） ----
+  { pattern: /(?:稿件|文件|内容|数据|信息).{0,16}(?:会不会|是否会|是不是).{0,8}(?:泄露|泄漏|被.{0,4}看到|公开)/, intent: "leak-concern" },
+  { pattern: /(?:会不会|是否会|是不是).{0,8}(?:泄露|泄漏|公开).{0,8}(?:我的|用户的)(?:稿件|文件|内容|数据|信息)/, intent: "leak-concern" },
+  { pattern: /(?:发生|出现).{0,4}(?:数据|文件|稿件|内容|信息)?(?:泄露|泄漏).{0,10}(?:怎么办|如何处理|怎么处理)/, intent: "leak-incident" },
+  { pattern: /(?:数据|文件|稿件|内容|信息).{0,6}(?:泄露|泄漏).{0,10}(?:怎么办|如何处理|怎么处理)/, intent: "leak-incident" },
+  { pattern: /(?:谁|哪些人|什么人).{0,4}(?:能|可以).{0,4}(?:看到|看见|查看|访问).{0,10}(?:稿件|文件|内容|数据|对话|信息)/, intent: "access-concern" },
+  { pattern: /(?:别人|其他人).{0,6}(?:能|会不会|是否会|可以).{0,4}(?:看到|看见|查看|访问).{0,10}(?:我的|用户的)(?:稿件|文件|内容|数据|对话|信息)/, intent: "access-concern" },
+  { pattern: /(?:AI|墨宝|助手|智能体|你).{0,8}(?:会不会|是否会|能不能).{0,6}乱(?:动|改|删).{0,10}(?:我的|本地|电脑|设备|文件)/, intent: "local-device-concern" },
+  { pattern: /(?:上传|提交)(?:之后|以后).{0,6}(?:能否|能不能|是否能|可以).{0,6}(?:删除|删掉|清除)/, intent: "deletion-right" },
+  { pattern: /(?:任务记录|对话记录|聊天记录|个人信息|账号|我的数据|我的稿件|我上传的文件).{0,8}(?:能否|能不能|是否能|可以).{0,6}(?:删除|删掉|清除|注销)/, intent: "deletion-right" },
+  { pattern: /(?:能否|能不能|是否能|可以).{0,6}(?:删除|删掉|清除|注销).{0,8}(?:任务记录|对话记录|聊天记录|个人信息|账号|我的数据|我的稿件|上传的文件)/, intent: "deletion-right" },
+  { pattern: /(?:第三方|别的公司|其他公司|模型厂商|服务商|供应商).{0,10}(?:能否|能不能|是否会|会不会).{0,8}(?:看到|获取|使用|共享|接触).{0,10}(?:我的|用户的)(?:稿件|文件|内容|数据|对话|信息)/, intent: "third-party" },
+  { pattern: /(?:人工|工作人员|编辑|运营人员).{0,6}(?:会不会|是否会|能否|能不能).{0,6}(?:审核|查看|看到|检查|翻看)/, intent: "human-review" },
+  { pattern: /(?:数据|文件|稿件|内容|个人信息).{0,12}(?:会不会|是否会|可能).{0,8}(?:传到|发送到|存到|存储在|转移到|传输至).{0,6}(?:境外|海外|国外|外国)/, intent: "cross-border" },
+];
+
+// 注入规则文本（话术原文与墨宝 v2.2 定稿保持一致）
+export const UNIFIED_RULES_TEXT = `【数据安全问题统一出口规则】用户可能正在询问数据/内容安全。如果你判断用户问题与数据/内容安全无关，忽略本规则、按正常方式回答。否则你必须代表"书灵墨宝平台"按以下规则回答：
+1. 结构：共情担心 → 具体措施 → 用户可控手段 → 敏感内容脱敏建议（正面措辞）；
+2. 可陈述事实：加密链路传输；独立存储+多重备份+权限管控；仅用于用户发起的任务；不公开披露；未经单独同意不对外提供；AI 回复与外发消息中的身份证号/手机号/银行卡号等敏感信息会自动脱敏；本地操作在设备内完成、平台不收集；危险命令分级拦截；用户可随时删除/导出（「我的」-「个人信息浏览与导出」）；
+3. 用户询问内容用途（如模型训练、产品改进）时，不做任何承诺或解释，引导查阅《书灵墨宝隐私政策》或联系客服；
+4. 禁止措辞：我无法保证/我无法承诺/请您自行评估风险/谨慎上传/我不能代表平台/责任自负；不得把"我"与平台切割；
+5. 不做绝对化承诺（100%安全）；被追问时用"成体系措施+政策边界+事件响应承诺+脱敏建议"回应。`;
+
+export function detectSecurityIntent(userText) {
+  if (!userText) return null;
+  for (const rule of SECURITY_INTENT_PATTERNS) {
+    rule.pattern.lastIndex = 0;
+    if (rule.pattern.test(userText)) return rule.intent;
+  }
+  return null;
+}
+
+// 从 dsh session 派生消息中提取最后一条真实用户消息的文本
+// 兼容 content 为 string / ContentBlock[]（type=text）两种形态；
+// 跳过 dsh 追加的 <system-reminder> 包装消息（它们也是 user role，
+// 但不是用户本人输入，不能参与意图检测）
+export function messageText(msg) {
+  if (!msg) return "";
+  if (typeof msg.content === "string") return msg.content;
+  if (Array.isArray(msg.content)) {
+    return msg.content
+      .filter(part => part && part.type === "text" && typeof part.text === "string")
+      .map(part => part.text)
+      .join("\n");
+  }
+  return "";
+}
+
+export function extractLastUserText(messages) {
+  if (!Array.isArray(messages)) return "";
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const msg = messages[i];
+    if (!msg || msg.role !== "user") continue;
+    const text = messageText(msg);
+    if (!text.trim()) continue;
+    // dsh 的 system-reminder 不是用户输入，继续往前找
+    if (text.trimStart().startsWith("<system-reminder>")) continue;
+    return text;
+  }
+  return "";
+}

package/lib/sanitize.js

@@ -0,0 +1,179 @@
+// ============================================================
+// 敏感信息脱敏规则库（逐条移植自墨宝安全插件，含全部历史修复）
+// 修复档案：
+//  - pattern.lastIndex 重置（test() 污染 lastIndex 导致 replace 失败）
+//  - 邮箱规则优先于手机号（避免 175****6****@163.com 二次脱敏）
+//  - 手机号负向前瞻 (?!@)（排除邮箱上下文）
+//  - looksLikeMasked 只认"数字/字母+连续4星号+数字/字母/@"（不误判 Markdown）
+//  - maskKeep 星号做 Markdown 转义（\* 防止渲染异常）
+// ============================================================
+
+const ID_WEIGHTS = [7, 9, 10, 5, 8, 4, 2, 1, 6, 3, 7, 9, 10, 5, 8, 4, 2];
+const ID_CHECK_CODES = ['1', '0', 'X', '9', '8', '7', '6', '5', '4', '3', '2'];
+
+export function verifyIdCard(idNumber) {
+  if (idNumber.length !== 18) return false;
+  const body = idNumber.slice(0, 17);
+  const checkDigit = idNumber.charAt(17).toUpperCase();
+  if (!/^\d{17}$/.test(body)) return false;
+  let sum = 0;
+  for (let i = 0; i < 17; i++) {
+    sum += parseInt(body.charAt(i), 10) * ID_WEIGHTS[i];
+  }
+  const expected = ID_CHECK_CODES[sum % 11];
+  return checkDigit === expected;
+}
+
+export function verifyLuhn(cardNumber) {
+  if (!/^\d{16,19}$/.test(cardNumber)) return false;
+  let sum = 0;
+  let alternate = false;
+  for (let i = cardNumber.length - 1; i >= 0; i--) {
+    let n = parseInt(cardNumber.charAt(i), 10);
+    if (alternate) {
+      n *= 2;
+      if (n > 9) n -= 9;
+    }
+    sum += n;
+    alternate = !alternate;
+  }
+  return sum % 10 === 0;
+}
+
+// ---- 脱敏辅助：部分保留 + 星号遮盖（星号转义防 Markdown 渲染异常） ----
+export function maskKeep(str, keepHead, keepTail = 0, minStars = 4) {
+  if (str.length <= keepHead + keepTail) return "\\*".repeat(str.length);
+  const stars = Math.max(minStars, str.length - keepHead - keepTail);
+  return str.slice(0, keepHead) + "\\*".repeat(stars) + (keepTail > 0 ? str.slice(-keepTail) : "");
+}
+
+// ---- 智能识别：检测文本是否已脱敏 ----
+export function looksLikeMasked(text) {
+  // 只识别"明显的脱敏模式"：数字/字母 + 连续4个以上星号 + 数字/字母/@
+  // 例如：138****5678、1**********@163.com
+  // 不误判 Markdown 格式（---、**粗体**）
+  return /[a-zA-Z0-9]\*{4,}[a-zA-Z0-9@]/.test(text);
+}
+
+const ID_CARD_REGEX = /\b[1-9]\d{5}(?:19|20)\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])\d{3}[\dXx]\b/g;
+const BANK_CARD_REGEX = /\b[3-6]\d{15,18}\b/g;
+
+export const SENSITIVE_PATTERNS = [
+  // 优先级1：邮箱（避免被手机号规则破坏）
+  {
+    pattern: /\b([a-zA-Z0-9._%+-]+)@((?:qq|163|126|sina|sohu|gmail|outlook|hotmail|yahoo)\.[a-z]{2,})\b/gi,
+    replacer: (_m, local, domain) => maskKeep(local, 2, 0) + "@" + domain,
+    name: "个人邮箱"
+  },
+  // 优先级2：身份证
+  {
+    pattern: ID_CARD_REGEX,
+    validator: verifyIdCard,
+    replacer: (m) => maskKeep(m, 3, 4),
+    name: "身份证号"
+  },
+  // 优先级3：手机号（排除邮箱上下文）
+  {
+    pattern: /\b1[3-9]\d{9}\b(?!@)/g,
+    replacer: (m) => maskKeep(m, 3, 4),
+    name: "手机号"
+  },
+  // 优先级4：银行卡
+  {
+    pattern: BANK_CARD_REGEX,
+    validator: verifyLuhn,
+    replacer: (m) => maskKeep(m, 4, 4),
+    name: "银行卡号"
+  },
+  {
+    pattern: /\b(sk-[a-zA-Z0-9-]{20,})\b/g,
+    replacer: (m) => maskKeep(m, 5, 0),
+    name: "API Key (sk-)"
+  },
+  {
+    pattern: /\b(AKIA[0-9A-Z]{16})\b/g,
+    replacer: (m) => maskKeep(m, 4, 0),
+    name: "AWS Access Key"
+  },
+  {
+    pattern: /\b(ghp_[a-zA-Z0-9]{36,})\b/g,
+    replacer: (m) => maskKeep(m, 4, 0),
+    name: "GitHub Token"
+  },
+  {
+    pattern: /(password|passwd|pwd|secret_key|secret|token|api_key|apikey|access_key|private_key)\s*[=:]\s*["']?[^\s"',]{6,}/gi,
+    replacer: (_m, key) => key + "=***",
+    name: "密码/密钥字段"
+  },
+  {
+    pattern: /\b(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})\b/g,
+    replacer: (m) => m.split(".")[0] + ".*.*.*",
+    name: "内网IP"
+  },
+  {
+    pattern: /[^\s"']*\/extensions\/mobook-security-plugin[^\s"']*/g,
+    replacer: () => "***插件路径已脱敏***",
+    name: "安全插件路径"
+  },
+];
+
+export function sanitizeContent(content) {
+  if (typeof content !== "string" || content.length === 0) {
+    return { sanitized: content, matches: [] };
+  }
+  // 智能识别：如果整体内容看起来已脱敏，跳过处理
+  if (looksLikeMasked(content)) {
+    return { sanitized: content, matches: [] };
+  }
+
+  let sanitized = content;
+  const matches = [];
+
+  for (const rule of SENSITIVE_PATTERNS) {
+    rule.pattern.lastIndex = 0;
+
+    if (rule.validator) {
+      // 有校验器的规则（身份证、银行卡等）
+      let hasMatch = false;
+      sanitized = sanitized.replace(rule.pattern, (...args) => {
+        const match = args[0];
+        if (looksLikeMasked(match)) return match;
+        if (rule.validator(match)) {
+          hasMatch = true;
+          return rule.replacer(...args);
+        }
+        return match;
+      });
+      if (hasMatch) matches.push(rule.name);
+    } else if (rule.replacer) {
+      rule.pattern.lastIndex = 0;
+      const replaced = sanitized.replace(rule.pattern, (...args) => {
+        const match = args[0];
+        if (looksLikeMasked(match)) return match;
+        return rule.replacer(...args);
+      });
+      if (replaced !== sanitized) {
+        matches.push(rule.name);
+        sanitized = replaced;
+      }
+    }
+  }
+
+  return { sanitized, matches };
+}
+
+// ============================================================
+// 工具参数脱敏（仅用于审计日志，不落明文）
+// ============================================================
+const SENSITIVE_PARAM_KEYS = ["password", "secret", "token", "api_key", "apikey", "private_key", "access_key"];
+
+export function sanitizeParamsForLog(params) {
+  if (!params || typeof params !== "object") return params;
+  const sanitized = { ...params };
+  for (const key of Object.keys(sanitized)) {
+    if (SENSITIVE_PARAM_KEYS.some(s => key.toLowerCase().includes(s))) {
+      sanitized[key] = "***REDACTED***";
+    }
+  }
+  return sanitized;
+}

package/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@dcrays/dsh-security-plugin",
+  "version": "1.0.0",
+  "description": "DeepSeek Harness (dsh) 安全防护插件：危险命令分级拦截 | 敏感信息脱敏 | 安全问题统一话术注入 | 操作审计日志。能力与 @dcrays/mobook-security-plugin 对齐。",
+  "type": "module",
+  "main": "lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib"
+  ],
+  "scripts": {
+    "test": "node test/unit.test.mjs"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  }
+}