@dsh-edge/dsh-edge-agent 0.0.0-stage → 0.1.2

package/lib/dsh-adapter/prompt-guard.d.ts

@@ -0,0 +1,152 @@
+/**
+ * prompt-guard — 端侧隐私安全防护（完整实现）
+ *
+ * 核心功能：
+ * 1. PII 脱敏（手机号、身份证、银行卡、邮箱、API Key）
+ * 2. 基础输入限制（长度、频率）
+ * 3. 中英文注入检测（16+ 模式）
+ * 4. privacy-policy 联动：输入端数据分类检测（secret 级阻断）
+ * 5. 与 sanitizer-pipeline 协调：输出端避免 desanitize→mask 矛盾
+ * 6. 全局频率限制（防 sessionId 绕过）
+ * 7. 可配置注入规则（cordis.yml rules 字段）
+ * 8. 模型辅助检测预留接口
+ *
+ * @module dsh-edge-agent/prompt-guard
+ */
+import { Service } from '@deepseek-ai/cordis';
+import Schema from '@deepseek-ai/schemastery';
+import type { PrivacyPolicyServiceImpl } from './privacy-policy.js';
+export declare const name = "prompt-guard";
+export declare const inject: readonly ["privacyPolicy", "auditLog", "llm"];
+/** Minimal interface our router needs from the audit-log service. */
+interface AuditLike {
+    log(entry: {
+        level: 'debug' | 'info' | 'warn' | 'error' | 'security';
+        kind: string;
+        source: string;
+        payload: Record<string, unknown>;
+    }): Promise<unknown>;
+}
+export interface InjectionRuleConfig {
+    name: string;
+    pattern: string;
+    /** Phase C: rule severity — `block` (default, hard reject) vs `warn`
+     *  (passes through but audit-tagged) vs `sanitize` (rewrite each match to
+     *  `[REDACTED:<ruleName>]`, audit `guard.rule.sanitized`, do NOT block;
+     *  the rewritten text is exposed via `InputCheckResult.sanitizedText`). */
+    action?: 'block' | 'warn' | 'sanitize';
+}
+export interface Config {
+    maxInputLength: number;
+    maxRequestsPerMinute: number;
+    enablePIIRedaction: boolean;
+    enableInjectionDetection: boolean;
+    enableRateLimit: boolean;
+    rules: InjectionRuleConfig[];
+    enableModelDetection: boolean;
+    /** §7.125: 入口安检的设备操作正则层开关。 */
+    enableDeviceCommandFastPath: boolean;
+    modelDetectionProvider: string;
+    modelDetectionModel: string;
+    modelDetectionTimeoutMs: number;
+    modelDetectionMaxInputLength: number;
+}
+export declare const Config: Schema<Config>;
+export interface InputCheckResult {
+    safe: boolean;
+    reason?: string;
+    riskLevel?: 'low' | 'medium' | 'high';
+    /** privacy-policy 数据分类结果（'public' | 'internal' | 'confidential' | 'secret'） */
+    dataClassification?: string;
+    /** 命中的注入规则名列表 */
+    injectionPatterns?: string[];
+    /** Phase C sanitize: rewritten text when one or more `sanitize`-tier
+     *  injection rules rewrote matches. Undefined when no sanitize hit
+     *  occurred. Callers may forward this in place of the original input
+     *  to the model, but the original `text` argument is left untouched. */
+    sanitizedText?: string;
+    /** Phase C sanitize: rule names that rewrote matches (each at least once). */
+    sanitizedRules?: string[];
+    /** §7.125: the device-command verdict when the entry-layer regex matched.
+     *  Present only on a hit; `pure` says whether the text was nothing but
+     *  the device operation (and therefore eligible to skip the LLM check). */
+    deviceCommand?: {
+        device: string;
+        action: string;
+        matched: string;
+        pure: boolean;
+    };
+}
+export interface OutputCheckContext {
+    /** 该 session 是否由 sanitizer-pipeline 管理（有活跃映射表）。
+     *  为 true 时跳过 prompt-guard 的输出 PII 掩码，避免与 sanitizer desanitize 矛盾。 */
+    sanitized?: boolean;
+}
+export interface OutputCheckResult {
+    filtered: string;
+    redacted: Array<{
+        type: string;
+        masked: string;
+    }>;
+}
+export interface PromptGuardService {
+    checkInput(text: string, sessionId: string): Promise<InputCheckResult>;
+    checkOutput(text: string, context?: OutputCheckContext): Promise<OutputCheckResult>;
+    stop(): void;
+}
+export declare class PromptGuardServiceImpl extends Service implements PromptGuardService {
+    private readonly config;
+    private readonly privacyPolicy;
+    private readonly auditLog;
+    /** Local LLM runtime (provided by `local-llm-adapter`). Optional: when absent
+     *  the model-based detection path is skipped silently (fail-open). */
+    private readonly llm;
+    private readonly requestCounts;
+    private globalCount;
+    private readonly globalMaxRequestsPerMinute;
+    private cleanupTimer;
+    private readonly injectionPatterns;
+    /** §7.125: operator-extended device-command terms (ADDITIVE on top of the
+     *  built-in vocabulary in ./intent-signals.ts). */
+    private readonly deviceCommandOverrides;
+    constructor(ctx: any, config: Config, privacyPolicy?: PrivacyPolicyServiceImpl, auditLog?: AuditLike, llm?: any, deviceCommands?: {
+        devices?: string[];
+        actions?: string[];
+    });
+    /** 停止清理定时器。 */
+    stop(): void;
+    private startCleanupTimer;
+    checkInput(text: string, sessionId: string): Promise<InputCheckResult>;
+    checkOutput(text: string, context?: OutputCheckContext): Promise<OutputCheckResult>;
+    /**
+     * Model-based semantic safety check.
+     *
+     * Streams a security-classification prompt to the local LLM (Qwen3-4B by
+     * default) and parses a structured `{safe, threats, dataClass, rationale}`
+     * JSON verdict. Any failure mode — disabled flag, missing llm handle,
+     * text too long, network error, abort, malformed JSON — is **fail-open**:
+     * the method returns `null` and the regex/PII verdict from earlier steps
+     * stands. Only an explicit `safe:false` verdict is returned to the
+     * caller as a high-risk block.
+     */
+    private modelBasedCheck;
+    private checkGlobalRateLimit;
+    private checkRateLimit;
+    /**
+     * §7.125 (2026-10-27): the device-command extension terms = patch config
+     *  (config/edge.json stages.intent.deviceCommands) + the policy file's
+     *  stages.intent.deviceCommands (hot-reloadable, read LIVE per check).
+     *  Both are ADDITIVE on top of the built-in vocabulary — the same
+     *  contract intent-router's Tier-0 uses.
+     */
+    private deviceCommandTerms;
+    private audit;
+}
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        promptGuard: PromptGuardServiceImpl;
+    }
+}
+export declare function apply(ctx: any, config: Config): Promise<() => Promise<void>>;
+export {};
+//# sourceMappingURL=prompt-guard.d.ts.map

package/lib/dsh-adapter/prompt-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-guard.d.ts","sourceRoot":"","sources":["../../src/dsh-adapter/prompt-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,MAAM,MAAM,0BAA0B,CAAA;AAE7C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AAUnE,eAAO,MAAM,IAAI,iBAAiB,CAAA;AAElC,eAAO,MAAM,MAAM,+CAAgD,CAAA;AAEnE,qEAAqE;AACrE,UAAU,SAAS;IACjB,GAAG,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC1J;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf;;;+EAG2E;IAC3E,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,UAAU,CAAA;CACvC;AAED,MAAM,WAAW,MAAM;IAErB,cAAc,EAAE,MAAM,CAAA;IACtB,oBAAoB,EAAE,MAAM,CAAA;IAG5B,kBAAkB,EAAE,OAAO,CAAA;IAC3B,wBAAwB,EAAE,OAAO,CAAA;IACjC,eAAe,EAAE,OAAO,CAAA;IAGxB,KAAK,EAAE,mBAAmB,EAAE,CAAA;IAG5B,oBAAoB,EAAE,OAAO,CAAA;IAC7B,8BAA8B;IAC9B,2BAA2B,EAAE,OAAO,CAAA;IAGpC,sBAAsB,EAAE,MAAM,CAAA;IAC9B,mBAAmB,EAAE,MAAM,CAAA;IAC3B,uBAAuB,EAAE,MAAM,CAAA;IAC/B,4BAA4B,EAAE,MAAM,CAAA;CACrC;AAED,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,CAmBhC,CAAA;AAgHF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;IACrC,+EAA+E;IAC/E,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,iBAAiB;IACjB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B;;;4EAGwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,8EAA8E;IAC9E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB;;+EAE2E;IAC3E,aAAa,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAA;CACnF;AAED,MAAM,WAAW,kBAAkB;IACjC;0EACsE;IACtE,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAClD;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACtE,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACnF,IAAI,IAAI,IAAI,CAAA;CACb;AAQD,qBAAa,sBAAuB,SAAQ,OAAQ,YAAW,kBAAkB;IAC/E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAQ;IAC/B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsC;IACpE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuB;IAChD;0EACsE;IACtE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAiB;IAGrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqC;IACnE,OAAO,CAAC,WAAW,CAAgE;IACnF,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAQ;IACnD,OAAO,CAAC,YAAY,CAA4C;IAGhE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAoB;IACtD;uDACmD;IACnD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAA4D;gBAGjG,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,wBAAwB,EACxC,QAAQ,CAAC,EAAE,SAAS,EACpB,GAAG,CAAC,EAAE,GAAG,EACT,cAAc,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE;IAmC7D,eAAe;IACf,IAAI,IAAI,IAAI;IAOZ,OAAO,CAAC,iBAAiB;IAcnB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAgPtE,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAwBzF;;;;;;;;;;OAUG;YACW,eAAe;IAiQ7B,OAAO,CAAC,oBAAoB;IAa5B,OAAO,CAAC,cAAc;IAiBtB;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;YAcZ,KAAK;CAYpB;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,WAAW,EAAE,sBAAsB,CAAA;KACpC;CACF;AA6ED,wBAAsB,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAuClF"}