@dcrays/mobook-security-plugin 2.0.4 → 2.0.6

package/index.js

@@ -1,13 +1,12 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
-import * as os from "node:os";
 
 // ============================================================
-// MoBook 安全防护插件 v2.0.4
+// MoBook 安全防护插件 v2.0
 // 功能：危险命令拦截 | 敏感信息脱敏（全渠道） | LLM 响应拦截 | 操作审计日志
 // ============================================================
 
-const LOG_DIR = path.join(os.tmpdir(), "openclaw-security");
+const LOG_DIR = "/tmp/mobook-security";
 const LOG_FILE = path.join(LOG_DIR, "security.log");
 const ALERT_FILE = path.join(LOG_DIR, "alerts.log");
 
@@ -77,9 +76,9 @@ const DANGEROUS_COMMANDS = [
   { pattern: /\bexport\s+HISTSIZE=0/i, reason: "禁用命令历史", severity: "HIGH" },
   { pattern: />\s*\/var\/log\//i, reason: "清空系统日志", severity: "CRITICAL" },
 
-  // --- 加密货币挖矿（运行时构建正则，避免静态扫描误报） ---
-  { pattern: new RegExp('\\b' + ['xmr','ig'].join('') + '\\b|\\b' + ['mine','rd'].join('') + '\\b|\\b' + ['cpum','iner'].join('') + '\\b', 'i'), reason: "加密货币挖矿程序", severity: "CRITICAL" },
-  { pattern: new RegExp(['stra','tum'].join('') + '\\+tcp:\\/\\/', 'i'), reason: "挖矿矿池连接", severity: "CRITICAL" },
+  // --- 加密货币挖矿 ---
+  { pattern: /\bxmrig\b|\bminerd\b|\bcpuminer\b/i, reason: "加密货币挖矿程序", severity: "CRITICAL" },
+  { pattern: /stratum\+tcp:\/\//i, reason: "挖矿矿池连接", severity: "CRITICAL" },
 ];
 
 const BLOCK_SEVERITIES = new Set(["CRITICAL", "HIGH"]);
@@ -175,7 +174,7 @@ const SENSITIVE_PATTERNS = [
     name: "GitHub Token"
   },
   {
-    pattern: /(password|passwd|pwd|secret|token|api_key|apikey|access_key|private_key)\s*[=:]\s*["']?[^\s"',]{6,}/gi,
+    pattern: /(password|passwd|pwd|secret_key|secret|token|api_key|apikey|access_key|private_key)\s*[=:]\s*["']?[^\s"',]{6,}/gi,
     replacement: "$1=***已脱敏***",
     name: "密码/密钥字段"
   },
@@ -184,6 +183,11 @@ const SENSITIVE_PATTERNS = [
     replacement: "***内网IP已脱敏***",
     name: "内网IP"
   },
+  {
+    pattern: /[^\s"']*\/extensions\/mobook-security-plugin[^\s"']*/g,
+    replacement: "***插件路径已脱敏***",
+    name: "安全插件路径"
+  },
 ];
 
 function sanitizeContent(content) {
@@ -205,8 +209,8 @@ function sanitizeContent(content) {
       if (hasMatch) matches.push(rule.name);
     } else if (rule.replacement) {
       rule.pattern.lastIndex = 0;
-      // 保留 $1 等反向引用：直接传字符串给 replace，不用箭头函数
-      const replaced = sanitized.replace(rule.pattern, rule.replacement);
+      const repl = rule.replacement; // 闭包捕获
+      const replaced = sanitized.replace(rule.pattern, () => repl);
       if (replaced !== sanitized) {
         matches.push(rule.name);
         sanitized = replaced;
@@ -508,7 +512,7 @@ function installFetchInterceptor(api) {
 // ============================================================
 export default function register(api) {
   log("═══════════════════════════════════════════════════════");
-  log("  MoBook 安全防护插件 v2.0.4 启动");
+  log("  MoBook 安全防护插件 v2.0 启动");
   log("  功能: 危险命令拦截 | 敏感信息脱敏(全渠道) | LLM 响应拦截 | 提示词注入检测 | 操作审计");
   log("═══════════════════════════════════════════════════════");
   log(`插件ID: ${api.id}`);
@@ -554,6 +558,75 @@ export default function register(api) {
       }
     }
 
+    // ============================================================
+    // 插件自保护：禁止访问插件运行时目录
+    // ============================================================
+    const PROTECTED_PATHS = [
+      "mobook-security-plugin",
+      "openclaw-security-plugin"
+    ];
+
+    const ALLOWED_PATHS = [
+      "数传/墨宝/mobook-security-plugin"
+    ];
+
+    if (["read", "exec", "edit", "write"].includes(toolName)) {
+      const pathValues = [
+        params.path || "",
+        params.command || "",
+        params.file || "",
+        params.filePath || "",
+        params.file_path || ""
+      ].join(" ");
+
+      // 禁止删除安全插件（包括白名单目录也不允许）
+      if (toolName === "exec" && PROTECTED_PATHS.some(p => pathValues.includes(p))) {
+        if (/\b(rm|trash|unlink|rmdir)\b/.test(params.command || "")) {
+          alert(`BLOCKED: 尝试删除安全插件 | cmd: ${(params.command || "").slice(0, 200)}`);
+          return {
+            block: true,
+            blockReason: "🛡️ 安全插件拦截：禁止删除安全插件"
+          };
+        }
+      }
+
+      // 访问保护路径检查（白名单放行）
+      if (PROTECTED_PATHS.some(p => pathValues.includes(p))) {
+        if (!ALLOWED_PATHS.some(p => pathValues.includes(p))) {
+          alert(`BLOCKED: 尝试访问受保护的插件目录 | tool=${toolName}`);
+          return {
+            block: true,
+            blockReason: "🛡️ 安全插件拦截：该目录为受保护资源，禁止访问"
+          };
+        }
+        log(`DEV_ACCESS: 白名单路径放行 | tool=${toolName}`);
+      }
+    }
+
+    // 禁止通过 CLI 关闭/卸载安全插件
+    if (toolName === "exec") {
+      const cmd = params.command || "";
+      if (/openclaw\s+(plugins?\s+)?(disable|remove|uninstall|delete).*mobook-security/i.test(cmd)) {
+        alert(`BLOCKED: 尝试关闭/卸载安全插件`);
+        return {
+          block: true,
+          blockReason: "🛡️ 安全插件拦截：禁止关闭或卸载安全插件"
+        };
+      }
+    }
+
+    // 禁止通过 config 工具关闭插件
+    if (toolName === "gateway") {
+      const raw = params.raw || params.path || JSON.stringify(params);
+      if (/mobook-security-plugin/.test(raw) && /(disable|false|remove|delete)/.test(raw)) {
+        alert(`BLOCKED: 尝试通过配置关闭安全插件`);
+        return {
+          block: true,
+          blockReason: "🛡️ 安全插件拦截：禁止通过配置关闭安全插件"
+        };
+      }
+    }
+
     return {};
   });
 
@@ -593,6 +666,6 @@ export default function register(api) {
 
   log("已注册: fetch拦截器(全渠道) + before_tool_call + message_sending + llm_output + message_sent");
   log("═══════════════════════════════════════════════════════");
-  log("  MoBook 安全插件 v2.0.4 启动完成");
+  log("  安全插件 v2.0 启动完成");
   log("═══════════════════════════════════════════════════════");
 }

package/openclaw.plugin.json

@@ -1,8 +1,8 @@
 {
   "id": "mobook-security-plugin",
   "name": "MoBook 安全防护插件",
-  "version": "2.0.4",
-  "description": "OpenClaw 企业级安全插件 - 危险命令分级拦截、敏感信息全渠道脱敏（身份证GB11643/银行卡Luhn校验）、LLM响应拦截、操作审计",
+  "version": "2.0.0",
+  "description": "MoBook 企业级安全插件 - 危险命令分级拦截、敏感信息全渠道脱敏（身份证GB11643/银行卡Luhn校验）、LLM响应拦截、操作审计",
   "entry": "./index.js",
   "type": "plugin",
   "configSchema": {}

package/package.json

@@ -1,9 +1,17 @@
 {
   "name": "@dcrays/mobook-security-plugin",
-  "version": "2.0.4",
+  "version": "2.0.6",
   "type": "module",
-  "description": "OpenClaw 企业级安全插件 - 危险命令分级拦截、敏感信息全渠道脱敏（身份证GB11643/银行卡Luhn校验）、LLM响应拦截、操作审计",
+  "description": "MoBook 企业级安全插件 - 危险命令分级拦截、敏感信息全渠道脱敏（身份证GB11643/银行卡Luhn校验）、LLM响应拦截、操作审计",
   "main": "index.js",
+  "files": [
+    "index.js",
+    "openclaw.plugin.json"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
   "openclaw": {
     "type": "plugin",
     "id": "mobook-security-plugin",