@dcrays/mobook-security-plugin 2.0.0

package/index.js

@@ -0,0 +1,597 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+
+// ============================================================
+// MoBook 安全防护插件 v2.0
+// 功能：危险命令拦截 | 敏感信息脱敏（全渠道） | LLM 响应拦截 | 操作审计日志
+// ============================================================
+
+const LOG_DIR = "/tmp/mobook-security";
+const LOG_FILE = path.join(LOG_DIR, "security.log");
+const ALERT_FILE = path.join(LOG_DIR, "alerts.log");
+
+// ---- 日志 ----
+function ensureLogDir() {
+  try { fs.mkdirSync(LOG_DIR, { recursive: true }); } catch {}
+}
+
+function log(msg, level = "INFO") {
+  ensureLogDir();
+  const ts = new Date().toISOString();
+  const line = `[${ts}] [${level}] ${msg}\n`;
+  try { fs.appendFileSync(LOG_FILE, line); } catch {}
+}
+
+function alert(msg) {
+  ensureLogDir();
+  const ts = new Date().toISOString();
+  const line = `[${ts}] [ALERT] ${msg}\n`;
+  try {
+    fs.appendFileSync(ALERT_FILE, line);
+    fs.appendFileSync(LOG_FILE, line);
+  } catch {}
+}
+
+// ============================================================
+// 1. 危险命令规则库
+// ============================================================
+const DANGEROUS_COMMANDS = [
+  // --- 破坏性命令 ---
+  { pattern: /\brm\s+(-[a-zA-Z]*f[a-zA-Z]*\s+|--force\s+).*\//i, reason: "强制删除路径文件", severity: "CRITICAL" },
+  { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*\s+\//i, reason: "递归删除根路径", severity: "CRITICAL" },
+  { pattern: /\brm\s+-rf\s+[~\/]/i, reason: "递归强制删除", severity: "CRITICAL" },
+  { pattern: /\bmkfs\b/i, reason: "格式化磁盘", severity: "CRITICAL" },
+  { pattern: /\bdd\s+.*of=\/dev\//i, reason: "直接写入设备", severity: "CRITICAL" },
+  { pattern: />\s*\/dev\/sd[a-z]/i, reason: "重定向到磁盘设备", severity: "CRITICAL" },
+  { pattern: /:(){ :\|:& };:/i, reason: "Fork 炸弹", severity: "CRITICAL" },
+
+  // --- 权限提升 ---
+  { pattern: /\bchmod\s+(-R\s+)?[0-7]*7[0-7]{2}\s+\//i, reason: "对根路径设置危险权限", severity: "HIGH" },
+  { pattern: /\bchmod\s+(-R\s+)?777\b/i, reason: "设置 777 权限", severity: "MEDIUM" },
+  { pattern: /\bchown\s+-R\s+.*\s+\//i, reason: "递归修改根路径所有者", severity: "HIGH" },
+
+  // --- 网络相关 ---
+  { pattern: /\bcurl\b.*\|\s*(ba)?sh/i, reason: "从网络下载并直接执行脚本", severity: "HIGH" },
+  { pattern: /\bwget\b.*\|\s*(ba)?sh/i, reason: "从网络下载并直接执行脚本", severity: "HIGH" },
+  { pattern: /\bnc\s+-[a-z]*l[a-z]*\s+-p/i, reason: "开启反向 Shell 监听", severity: "HIGH" },
+  { pattern: /\bncat\b.*--exec/i, reason: "ncat 执行命令", severity: "HIGH" },
+  { pattern: /\/dev\/tcp\//i, reason: "Bash 反向 Shell", severity: "HIGH" },
+
+  // --- 数据泄露 ---
+  { pattern: /\bcurl\b.*(-d|--data).*password/i, reason: "通过 curl 发送密码", severity: "HIGH" },
+  { pattern: /\bcurl\b.*(-d|--data).*secret/i, reason: "通过 curl 发送密钥", severity: "HIGH" },
+  { pattern: /\bscp\b.*\/etc\/(passwd|shadow)/i, reason: "拷贝系统密码文件", severity: "CRITICAL" },
+  { pattern: /\bcat\s+.*\/(\.ssh\/|id_rsa|\.env|\.aws\/credentials)/i, reason: "读取敏感凭证文件", severity: "HIGH" },
+
+  // --- 系统破坏 ---
+  { pattern: /\bsystemctl\s+(stop|disable)\s+(sshd|firewalld|iptables|ufw)/i, reason: "关闭安全服务", severity: "HIGH" },
+  { pattern: /\biptables\s+-F/i, reason: "清空防火墙规则", severity: "HIGH" },
+  { pattern: /\bufw\s+disable/i, reason: "关闭防火墙", severity: "HIGH" },
+  { pattern: /\bkillall\b/i, reason: "批量杀进程", severity: "MEDIUM" },
+  { pattern: /\bshutdown\b|\breboot\b|\binit\s+[06]/i, reason: "关机或重启系统", severity: "HIGH" },
+
+  // --- 历史记录/审计规避 ---
+  { pattern: /\bunset\s+HISTFILE/i, reason: "清除命令历史", severity: "HIGH" },
+  { pattern: /\bhistory\s+-c/i, reason: "清除命令历史", severity: "HIGH" },
+  { pattern: /\bexport\s+HISTSIZE=0/i, reason: "禁用命令历史", severity: "HIGH" },
+  { pattern: />\s*\/var\/log\//i, reason: "清空系统日志", severity: "CRITICAL" },
+
+  // --- 加密货币挖矿 ---
+  { pattern: /\bxmrig\b|\bminerd\b|\bcpuminer\b/i, reason: "加密货币挖矿程序", severity: "CRITICAL" },
+  { pattern: /stratum\+tcp:\/\//i, reason: "挖矿矿池连接", severity: "CRITICAL" },
+];
+
+const BLOCK_SEVERITIES = new Set(["CRITICAL", "HIGH"]);
+
+function checkDangerousCommand(cmd) {
+  for (const rule of DANGEROUS_COMMANDS) {
+    if (rule.pattern.test(cmd)) {
+      return rule;
+    }
+  }
+  return null;
+}
+
+// ============================================================
+// 2. 校验算法
+// ============================================================
+
+const ID_WEIGHTS = [7, 9, 10, 5, 8, 4, 2, 1, 6, 3, 7, 9, 10, 5, 8, 4, 2];
+const ID_CHECK_CODES = ['1', '0', 'X', '9', '8', '7', '6', '5', '4', '3', '2'];
+
+function verifyIdCard(idNumber) {
+  if (idNumber.length !== 18) return false;
+  const body = idNumber.slice(0, 17);
+  const checkDigit = idNumber.charAt(17).toUpperCase();
+  if (!/^\d{17}$/.test(body)) return false;
+  let sum = 0;
+  for (let i = 0; i < 17; i++) {
+    sum += parseInt(body.charAt(i), 10) * ID_WEIGHTS[i];
+  }
+  const expected = ID_CHECK_CODES[sum % 11];
+  return checkDigit === expected;
+}
+
+function verifyLuhn(cardNumber) {
+  if (!/^\d{16,19}$/.test(cardNumber)) return false;
+  let sum = 0;
+  let alternate = false;
+  for (let i = cardNumber.length - 1; i >= 0; i--) {
+    let n = parseInt(cardNumber.charAt(i), 10);
+    if (alternate) {
+      n *= 2;
+      if (n > 9) n -= 9;
+    }
+    sum += n;
+    alternate = !alternate;
+  }
+  return sum % 10 === 0;
+}
+
+// ============================================================
+// 3. 敏感信息规则库
+// ============================================================
+
+const ID_CARD_REGEX = /\b[1-9]\d{5}(?:19|20)\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])\d{3}[\dXx]\b/g;
+const BANK_CARD_REGEX = /\b[3-6]\d{15,18}\b/g;
+
+const SENSITIVE_PATTERNS = [
+  {
+    pattern: ID_CARD_REGEX,
+    validator: verifyIdCard,
+    replacementText: "***身份证号已脱敏***",
+    name: "身份证号"
+  },
+  {
+    pattern: /\b1[3-9]\d{9}\b/g,
+    replacement: "***手机号已脱敏***",
+    name: "手机号"
+  },
+  {
+    pattern: BANK_CARD_REGEX,
+    validator: verifyLuhn,
+    replacementText: "***银行卡号已脱敏***",
+    name: "银行卡号"
+  },
+  {
+    pattern: /\b[a-zA-Z0-9._%+-]+@(qq|163|126|sina|sohu|gmail|outlook|hotmail|yahoo)\.[a-z]{2,}\b/gi,
+    replacement: "***邮箱已脱敏***",
+    name: "个人邮箱"
+  },
+  {
+    pattern: /\b(sk-[a-zA-Z0-9]{20,})\b/g,
+    replacement: "***API密钥已脱敏***",
+    name: "API Key (sk-)"
+  },
+  {
+    pattern: /\b(AKIA[0-9A-Z]{16})\b/g,
+    replacement: "***AWS密钥已脱敏***",
+    name: "AWS Access Key"
+  },
+  {
+    pattern: /\b(ghp_[a-zA-Z0-9]{36,})\b/g,
+    replacement: "***GitHub Token已脱敏***",
+    name: "GitHub Token"
+  },
+  {
+    pattern: /(password|passwd|pwd|secret|token|api_key|apikey|access_key|private_key)\s*[=:]\s*["']?[^\s"',]{6,}/gi,
+    replacement: "$1=***已脱敏***",
+    name: "密码/密钥字段"
+  },
+  {
+    pattern: /\b(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})\b/g,
+    replacement: "***内网IP已脱敏***",
+    name: "内网IP"
+  },
+];
+
+function sanitizeContent(content) {
+  let sanitized = content;
+  const matches = [];
+
+  for (const rule of SENSITIVE_PATTERNS) {
+    rule.pattern.lastIndex = 0;
+
+    if (rule.validator) {
+      let hasMatch = false;
+      sanitized = sanitized.replace(rule.pattern, (match) => {
+        if (rule.validator(match)) {
+          hasMatch = true;
+          return rule.replacementText;
+        }
+        return match;
+      });
+      if (hasMatch) matches.push(rule.name);
+    } else if (rule.replacement) {
+      rule.pattern.lastIndex = 0;
+      const repl = rule.replacement; // 闭包捕获
+      const replaced = sanitized.replace(rule.pattern, () => repl);
+      if (replaced !== sanitized) {
+        matches.push(rule.name);
+        sanitized = replaced;
+      }
+    }
+  }
+
+  return { sanitized, matches };
+}
+
+// ============================================================
+// 4. 工具参数脱敏
+// ============================================================
+const SENSITIVE_PARAM_KEYS = ["password", "secret", "token", "api_key", "apikey", "private_key", "access_key"];
+
+function sanitizeParamsForLog(params) {
+  if (!params || typeof params !== "object") return params;
+  const sanitized = { ...params };
+  for (const key of Object.keys(sanitized)) {
+    if (SENSITIVE_PARAM_KEYS.some(s => key.toLowerCase().includes(s))) {
+      sanitized[key] = "***REDACTED***";
+    }
+  }
+  return sanitized;
+}
+
+// ============================================================
+// 5. Fetch 劫持 — LLM 请求/响应拦截（全渠道通杀）
+//    借鉴 @alicloud/openclaw-security-assistant 的核心技术
+// ============================================================
+
+const FETCH_WRAPPED_KEY = Symbol.for("mobook-security-plugin.fetch-wrapped");
+const ORIGINAL_FETCH_KEY = Symbol.for("mobook-security-plugin.original-fetch");
+
+// 保存原始 fetch
+function saveOriginalFetch() {
+  if (!globalThis[ORIGINAL_FETCH_KEY] && globalThis.fetch) {
+    globalThis[ORIGINAL_FETCH_KEY] = globalThis.fetch;
+  }
+  return globalThis[ORIGINAL_FETCH_KEY];
+}
+
+// 从 fetch 参数提取 URL
+function getUrlFromFetchArgs(input) {
+  return typeof input === "string" ? input
+    : input instanceof URL ? input.toString()
+    : input instanceof Request ? input.url
+    : String(input);
+}
+
+// 判断是否是 SSE 流式响应
+function isSseResponse(resp) {
+  const ct = (resp.headers.get("content-type") || "").toLowerCase();
+  return ct.includes("text/event-stream");
+}
+
+// 判断请求是否期望 SSE 响应
+function guessRequestWantsSse(url, headers, bodyText) {
+  try {
+    if (bodyText) {
+      const obj = JSON.parse(bodyText);
+      if (obj?.stream === true) return true;
+    }
+  } catch {}
+  const accept = (headers["accept"] || headers["Accept"] || "").toLowerCase();
+  if (accept.includes("text/event-stream")) return true;
+  if (url.includes("/chat/completions")) return true;
+  return false;
+}
+
+// 从响应头提取为普通对象
+function headersToRecord(headers) {
+  const out = {};
+  try { headers.forEach((v, k) => out[k] = v); } catch {}
+  return out;
+}
+
+// 合并请求头
+function getMergedRequestHeaders(input, init) {
+  const initHeaders = {};
+  if (init?.headers) {
+    if (init.headers instanceof Headers) {
+      init.headers.forEach((v, k) => initHeaders[k] = v);
+    } else if (Array.isArray(init.headers)) {
+      for (const [k, v] of init.headers) initHeaders[String(k)] = String(v);
+    } else {
+      for (const [k, v] of Object.entries(init.headers)) initHeaders[k] = String(v);
+    }
+  }
+  const inputHeaders = input instanceof Request ? headersToRecord(input.headers) : {};
+  return { ...inputHeaders, ...initHeaders };
+}
+
+// 获取请求 body 文本
+async function getRequestBodyText(input, init) {
+  if (input instanceof Request) {
+    try { return await input.clone().text(); } catch { return ""; }
+  }
+  return typeof init?.body === "string" ? init.body : "";
+}
+
+// 从 SSE body 中提取纯文本
+function extractTextFromSseBody(sseBody) {
+  const lines = sseBody.split("\n");
+  const texts = [];
+  for (const line of lines) {
+    if (line.startsWith("data: ") && line !== "data: [DONE]") {
+      try {
+        const json = JSON.parse(line.slice(6));
+        const content = json?.choices?.[0]?.delta?.content;
+        if (content) texts.push(content);
+      } catch {}
+    }
+  }
+  return texts.join("");
+}
+
+// 从 JSON body 中提取纯文本
+function extractTextFromJsonBody(jsonBody) {
+  try {
+    const json = JSON.parse(jsonBody);
+    return json?.choices?.[0]?.message?.content ?? "";
+  } catch {
+    return "";
+  }
+}
+
+// 从响应 body 中提取文本（自动判断 SSE/JSON）
+function extractTextFromResponseBody(body, isSse) {
+  return isSse ? extractTextFromSseBody(body) : extractTextFromJsonBody(body);
+}
+
+// 构造 OpenAI 兼容的 SSE block 响应
+function buildOpenAiSseBodyFromText(replacementText, id) {
+  const now = Math.floor(Date.now() / 1000);
+  const chunkObj = {
+    id, object: "chat.completion.chunk", created: now, model: "security-filtered",
+    choices: [{ index: 0, delta: { content: replacementText }, finish_reason: null }]
+  };
+  const finishObj = {
+    id, object: "chat.completion.chunk", created: now, model: "security-filtered",
+    choices: [{ index: 0, delta: { content: "" }, finish_reason: "stop" }]
+  };
+  return `data: ${JSON.stringify(chunkObj)}\n\ndata: ${JSON.stringify(finishObj)}\n\ndata: [DONE]\n\n`;
+}
+
+// 构造 OpenAI 兼容的 JSON block 响应
+function buildOpenAiJsonBodyFromText(replacementText, id) {
+  const now = Math.floor(Date.now() / 1000);
+  return JSON.stringify({
+    id, object: "chat.completion", created: now, model: "security-filtered",
+    choices: [{ index: 0, message: { role: "assistant", content: replacementText }, finish_reason: "stop" }]
+  });
+}
+
+// 构造替换响应（block 模式）
+function makeBlockedResponse(wantsSse, replacementText, originalResp) {
+  const id = "chatcmpl-security-blocked";
+  if (wantsSse) {
+    const headers = new Headers({
+      "content-type": "text/event-stream; charset=utf-8",
+      "cache-control": "no-cache",
+      "connection": "keep-alive"
+    });
+    return new Response(buildOpenAiSseBodyFromText(replacementText, id), { status: 200, headers });
+  }
+  // 非流式：复用原始响应头
+  const headers = originalResp ? new Headers(originalResp.headers) : new Headers({ "content-type": "application/json; charset=utf-8" });
+  headers.delete("content-length");
+  headers.delete("content-encoding");
+  return new Response(buildOpenAiJsonBodyFromText(replacementText, id), {
+    status: originalResp?.status ?? 200,
+    statusText: originalResp?.statusText ?? "OK",
+    headers
+  });
+}
+
+// 构造 hint 响应（原文 + 安全提示追加）
+function makeHintResponse(originalResp, originalBody, hintContent) {
+  const wantsSse = isSseResponse(originalResp);
+  const id = "chatcmpl-security-hint";
+  const headers = new Headers(originalResp.headers);
+  headers.delete("content-length");
+  headers.delete("content-encoding");
+
+  const originalText = extractTextFromResponseBody(originalBody, wantsSse);
+  const combinedText = originalText + hintContent;
+  const body = wantsSse
+    ? buildOpenAiSseBodyFromText(combinedText, id)
+    : buildOpenAiJsonBodyFromText(combinedText, id);
+
+  return new Response(body, {
+    status: originalResp.status,
+    statusText: originalResp.statusText,
+    headers
+  });
+}
+
+// 安装 fetch 拦截器
+function installFetchInterceptor(api) {
+  const originalFetch = saveOriginalFetch();
+  if (!originalFetch) {
+    log("⚠️ globalThis.fetch 不可用，LLM 拦截层未安装", "WARN");
+    return false;
+  }
+  if (globalThis[FETCH_WRAPPED_KEY]) {
+    log("Fetch 拦截器已安装（避免重复包装）", "DEBUG");
+    return true;
+  }
+
+  let callId = 0;
+
+  const wrappedFetch = async function(input, init) {
+    const thisCallId = ++callId;
+    const url = getUrlFromFetchArgs(input);
+
+    // 只拦截 LLM 相关请求（匹配 /chat/completions 或 /v1/ 路径）
+    const isLlmCall = url.includes("/chat/completions") || url.includes("/v1/chat") || url.includes("/completions");
+    if (!isLlmCall) {
+      return originalFetch(input, init);
+    }
+
+    const method = init?.method || (input instanceof Request ? input.method : "GET") || "GET";
+    const reqHeaders = getMergedRequestHeaders(input, init);
+    const reqBodyText = await getRequestBodyText(input, init);
+
+    log(`[LLM-REQ #${thisCallId}] ${method} ${url}`, "DEBUG");
+
+    // ---- 请求侧检查：提示词注入检测（已禁用） ----
+    // const promptInjectionPatterns = [
+    //   { pattern: /ignore\s+(all\s+)?(previous|above)\s+(instructions|rules|prompts)/i, reason: "提示词注入：忽略先前指令" },
+    //   { pattern: /you\s+are\s+now\s+in\s+(developer|debug|maintenance)\s+mode/i, reason: "提示词注入：切换模式" },
+    //   { pattern: /system\s*:\s*override/i, reason: "提示词注入：系统覆盖" },
+    //   { pattern: /\[INST\].*<\/INST>/i, reason: "提示词注入：指令标签注入" },
+    //   { pattern: /output\s+your\s+(system\s+)?prompt/i, reason: "提示词注入：套取系统提示词" },
+    //   { pattern: /repeat\s+(the\s+)?(words\s+)?above/i, reason: "提示词注入：重复上文" },
+    // ];
+    //
+    // for (const rule of promptInjectionPatterns) {
+    //   if (rule.pattern.test(reqBodyText)) {
+    //     alert(`PROMPT_INJECTION [REQ #${thisCallId}]: ${rule.reason}`);
+    //     log(`[LLM-REQ-BLOCK #${thisCallId}] ${rule.reason}`, "WARN");
+    //     const wantsSse = guessRequestWantsSse(url, reqHeaders, reqBodyText);
+    //     return makeBlockedResponse(wantsSse, "⚠️ 检测到提示词注入攻击，请求已被安全组件拦截");
+    //   }
+    // }
+
+    // ---- 放行请求，获取响应 ----
+    const fetchStart = Date.now();
+    let resp;
+    try {
+      resp = await originalFetch(input, init);
+    } catch (e) {
+      log(`[LLM-FETCH-ERR #${thisCallId}] ${e.message}`, "ERROR");
+      throw e;
+    }
+    const durationMs = Date.now() - fetchStart;
+
+    // ---- 响应侧检查：敏感信息脱敏 ----
+    const sse = isSseResponse(resp);
+    let respBody = "";
+    try {
+      respBody = await resp.clone().text();
+    } catch {
+      respBody = "[unreadable]";
+    }
+
+    const respText = extractTextFromResponseBody(respBody, sse);
+    if (!respText) {
+      log(`[LLM-RESP #${thisCallId}] ${resp.status} ${durationMs}ms (empty body)`, "DEBUG");
+      return resp;
+    }
+
+    const { sanitized, matches } = sanitizeContent(respText);
+    if (matches.length > 0) {
+      alert(`LLM_RESPONSE_SANITIZED [RESP #${thisCallId}]: 脱敏类型=${matches.join(", ")} | 原文长度=${respText.length} | 脱敏后长度=${sanitized.length} | 耗时=${durationMs}ms`);
+      log(`[LLM-RESP-SANITIZE #${thisCallId}] sanitized ${matches.join(", ")} (${respText.length}→${sanitized.length} chars)`, "WARN");
+
+      // 直接用脱敏后的文本 + 安全提示构造替换响应
+      const finalText = sanitized + `\n\n[🛡️ 安全提示：以上内容包含敏感信息，已自动脱敏（${matches.join("、")}）]`;
+      return makeBlockedResponse(sse, finalText, resp);
+    }
+
+    log(`[LLM-RESP #${thisCallId}] ${resp.status} ${durationMs}ms (clean)`, "DEBUG");
+    return resp;
+  };
+
+  // 复制原始 fetch 的属性
+  Object.assign(wrappedFetch, originalFetch);
+  globalThis.fetch = wrappedFetch;
+  globalThis[FETCH_WRAPPED_KEY] = true;
+
+  log("✅ Fetch 拦截器已安装 — LLM 请求/响应全渠道拦截生效", "INFO");
+  return true;
+}
+
+// ============================================================
+// 插件注册
+// ============================================================
+export default function register(api) {
+  log("═══════════════════════════════════════════════════════");
+  log("  MoBook 安全防护插件 v2.0 启动");
+  log("  功能: 危险命令拦截 | 敏感信息脱敏(全渠道) | LLM 响应拦截 | 提示词注入检测 | 操作审计");
+  log("═══════════════════════════════════════════════════════");
+  log(`插件ID: ${api.id}`);
+
+  // ---- 安装 Fetch 拦截器（核心：全渠道 LLM 拦截） ----
+  installFetchInterceptor(api);
+
+  // ---- Hook 1: before_tool_call（命令拦截 + 审计） ----
+  api.on("before_tool_call", async (event, ctx) => {
+    const toolName = event?.toolName || "unknown";
+    const params = event?.params || {};
+    const safeParams = sanitizeParamsForLog(params);
+
+    log(`TOOL_CALL: tool=${toolName} params=${JSON.stringify(safeParams).slice(0, 500)}`);
+
+    // exec 命令安全检查
+    if (toolName === "exec") {
+      const cmd = params.command || "";
+      const danger = checkDangerousCommand(cmd);
+      if (danger) {
+        if (BLOCK_SEVERITIES.has(danger.severity)) {
+          alert(`BLOCKED [${danger.severity}]: ${danger.reason} | cmd: ${cmd.slice(0, 200)}`);
+          return {
+            block: true,
+            blockReason: `🛡️ 安全插件拦截 [${danger.severity}]：${danger.reason}\n命令: ${cmd.slice(0, 100)}`
+          };
+        } else {
+          alert(`WARNING [${danger.severity}]: ${danger.reason} | cmd: ${cmd.slice(0, 200)}`);
+        }
+      }
+    }
+
+    // 写文件工具的路径检查
+    if (toolName === "write" || toolName === "edit") {
+      const filePath = params.file || params.filePath || params.file_path || params.path || "";
+      const dangerousPaths = ["/etc/", "/usr/", "/bin/", "/sbin/", "/boot/", "/sys/", "/proc/"];
+      if (dangerousPaths.some(p => filePath.startsWith(p))) {
+        alert(`BLOCKED: 尝试写入系统路径 ${filePath}`);
+        return {
+          block: true,
+          blockReason: `🛡️ 安全插件拦截：禁止写入系统路径 ${filePath}`
+        };
+      }
+    }
+
+    return {};
+  });
+
+  // ---- Hook 2: message_sending（输出脱敏 — 补充渠道） ----
+  // 虽然 fetch 拦截已覆盖 webchat/飞书，但 message_sending 在 Telegram/Slack 等渠道仍然有效
+  // 作为双重保险保留
+  api.on("message_sending", async (event, ctx) => {
+    const content = event?.content || "";
+    const channel = event?.metadata?.channel || ctx?.channelId || "unknown";
+    if (!content) return {};
+
+    const { sanitized, matches } = sanitizeContent(content);
+    if (matches.length > 0) {
+      alert(`SANITIZED [${channel}]: 脱敏类型=${matches.join(", ")} | 原文长度=${content.length}`);
+      return { content: sanitized };
+    }
+    return {};
+  });
+
+  // ---- Hook 3: llm_output（补充监控） ----
+  api.on("llm_output", async (event, ctx) => {
+    const content = event?.content || event?.text || "";
+    if (!content) return;
+
+    const { matches } = sanitizeContent(content);
+    if (matches.length > 0) {
+      alert(`LLM_OUTPUT_SENSITIVE: 检测到敏感信息类型=${matches.join(", ")} | 长度=${content.length}`);
+    }
+  });
+
+  // ---- Hook 4: message_sent（发送后审计） ----
+  api.on("message_sent", async (event, ctx) => {
+    const channel = ctx?.channelId || "unknown";
+    const to = event?.to || "unknown";
+    log(`MESSAGE_SENT: channel=${channel} to=${to}`);
+  });
+
+  log("已注册: fetch拦截器(全渠道) + before_tool_call + message_sending + llm_output + message_sent");
+  log("═══════════════════════════════════════════════════════");
+  log("  安全插件 v2.0 启动完成");
+  log("═══════════════════════════════════════════════════════");
+}

package/openclaw.plugin.json

@@ -0,0 +1,9 @@
+{
+  "id": "mobook-security-plugin",
+  "name": "MoBook 安全防护插件",
+  "version": "2.0.0",
+  "description": "MoBook 企业级安全插件 - 危险命令分级拦截、敏感信息全渠道脱敏（身份证GB11643/银行卡Luhn校验）、LLM响应拦截、操作审计",
+  "entry": "./index.js",
+  "type": "plugin",
+  "configSchema": {}
+}

package/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@dcrays/mobook-security-plugin",
+  "version": "2.0.0",
+  "type": "module",
+  "description": "MoBook 企业级安全插件 - 危险命令分级拦截、敏感信息全渠道脱敏（身份证GB11643/银行卡Luhn校验）、LLM响应拦截、操作审计",
+  "main": "index.js",
+  "files": [
+    "index.js",
+    "openclaw.plugin.json"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "openclaw": {
+    "type": "plugin",
+    "id": "mobook-security-plugin",
+    "name": "MoBook 安全防护插件",
+    "extensions": ["./index.js"]
+  }
+}