@dcrays/mobook-security-plugin 2.0.5 → 2.0.7

package/index.js

@@ -183,6 +183,11 @@ const SENSITIVE_PATTERNS = [
     replacement: "***内网IP已脱敏***",
     name: "内网IP"
   },
+  {
+    pattern: /[^\s"']*\/extensions\/mobook-security-plugin[^\s"']*/g,
+    replacement: "***插件路径已脱敏***",
+    name: "安全插件路径"
+  },
 ];
 
 function sanitizeContent(content) {
@@ -553,6 +558,97 @@ export default function register(api) {
       }
     }
 
+    // ============================================================
+    // 插件自保护：禁止访问插件运行时目录
+    // ============================================================
+    const PROTECTED_PATHS = [
+      "mobook-security-plugin",
+      "openclaw-security-plugin"
+    ];
+
+    const ALLOWED_PATHS = [
+      "数传/墨宝/mobook-security-plugin"
+    ];
+
+    if (["read", "exec", "edit", "write"].includes(toolName)) {
+      const pathValues = [
+        params.path || "",
+        params.command || "",
+        params.file || "",
+        params.filePath || "",
+        params.file_path || ""
+      ].join(" ");
+
+      // 禁止删除安全插件（包括白名单目录也不允许）
+      if (toolName === "exec" && PROTECTED_PATHS.some(p => pathValues.includes(p))) {
+        if (/\b(rm|trash|unlink|rmdir)\b/.test(params.command || "")) {
+          alert(`BLOCKED: 尝试删除安全插件 | cmd: ${(params.command || "").slice(0, 200)}`);
+          return {
+            block: true,
+            blockReason: "🛡️ 安全插件拦截：禁止删除安全插件"
+          };
+        }
+      }
+
+      // 访问保护路径检查（白名单放行）
+      if (PROTECTED_PATHS.some(p => pathValues.includes(p))) {
+        if (!ALLOWED_PATHS.some(p => pathValues.includes(p))) {
+          alert(`BLOCKED: 尝试访问受保护的插件目录 | tool=${toolName}`);
+          return {
+            block: true,
+            blockReason: "🛡️ 安全插件拦截：该目录为受保护资源，禁止访问"
+          };
+        }
+        log(`DEV_ACCESS: 白名单路径放行 | tool=${toolName}`);
+      }
+    }
+
+    // 禁止通过 CLI 关闭/卸载安全插件
+    if (toolName === "exec") {
+      const cmd = params.command || "";
+      if (/openclaw\s+(plugins?\s+)?(disable|remove|uninstall|delete).*mobook-security/i.test(cmd)) {
+        alert(`BLOCKED: 尝试关闭/卸载安全插件`);
+        return {
+          block: true,
+          blockReason: "🛡️ 安全插件拦截：禁止关闭或卸载安全插件"
+        };
+      }
+    }
+
+    // 禁止通过 config 工具关闭插件（覆盖所有参数字段）
+    if (toolName === "gateway") {
+      const allParams = JSON.stringify(params);
+      if (/mobook-security-plugin/.test(allParams) && /(disable|false|remove|delete|uninstall)/.test(allParams)) {
+        alert(`BLOCKED: 尝试通过配置关闭安全插件 | params: ${allParams.slice(0, 300)}`);
+        return {
+          block: true,
+          blockReason: "🛡️ 安全插件拦截：禁止通过配置关闭安全插件"
+        };
+      }
+    }
+
+    // 禁止直接编辑 openclaw.json 来关闭插件
+    if (["edit", "write", "exec"].includes(toolName)) {
+      const pathValues = [params.path || "", params.command || "", params.file || ""].join(" ");
+      const isConfigFile = /openclaw\.json/.test(pathValues);
+      if (isConfigFile) {
+        log(`CONFIG_FILE_CHECK: tool=${toolName} path=${params.path || ""} edits=${JSON.stringify(params.edits || "").slice(0, 200)} content=${(params.content || "").slice(0, 100)}`, "DEBUG");
+        // 检查内容是否涉及禁用安全插件
+        const contentValues = [
+          params.command || "",
+          JSON.stringify(params.edits || ""),
+          params.content || ""
+        ].join(" ");
+        if (/mobook-security-plugin/.test(contentValues) && /(false|disable|remove|delete|\[\])/.test(contentValues)) {
+          alert(`BLOCKED: 尝试通过直接编辑 openclaw.json 关闭安全插件 | tool=${toolName}`);
+          return {
+            block: true,
+            blockReason: "🛡️ 安全插件拦截：禁止通过修改配置文件关闭安全插件"
+          };
+        }
+      }
+    }
+
     return {};
   });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dcrays/mobook-security-plugin",
-  "version": "2.0.5",
+  "version": "2.0.7",
   "type": "module",
   "description": "MoBook 企业级安全插件 - 危险命令分级拦截、敏感信息全渠道脱敏（身份证GB11643/银行卡Luhn校验）、LLM响应拦截、操作审计",
   "main": "index.js",
@@ -16,6 +16,8 @@
     "type": "plugin",
     "id": "mobook-security-plugin",
     "name": "MoBook 安全防护插件",
-    "extensions": ["./index.js"]
+    "extensions": [
+      "./index.js"
+    ]
   }
 }