@dsh-edge/dsh-edge-agent 0.0.0-stage → 0.1.2

package/lib/dsh-adapter/sanitizer-pipeline.d.ts

@@ -0,0 +1,140 @@
+/**
+ * sanitizer-pipeline — forward sanitization (PII → placeholders) and
+ * reverse desanitization (placeholders → PII) for SANITIZED-realm
+ * sessions. The mapping table is per-session and stored in memory.
+ *
+ * Phase 4 完整实现：
+ * - 正向脱敏（PII → 占位符）
+ * - 反向还原（占位符 → PII）
+ * - 会话级映射表（带 TTL + 容量上限，见下）
+ * - 与 privacy-policy 联动（获取脱敏规则）
+ *
+ * ## 内存中的映射表就是明文 PII
+ *
+ * `sessionMappings` 持有的是**用户原始 PII 明文**（还原时必须用到）。
+ * 因此它必须有明确的生命周期，不能只靠调用方记得调 `purge()`：
+ *   1. `http-api.dropSessionBuffer()` 在会话删除/过期/LRU 淘汰/停机时
+ *      主动调用 `purge()`（首选路径）
+ *   2. 本模块自身按 `sessionTtlMs` 惰性 + 定时清扫（兜底，防止调用方漏调）
+ *   3. `maxSessions` 上限触发 LRU 淘汰（兜底，防止会话 id 爆炸）
+ *
+ * @module dsh-edge-agent/sanitizer-pipeline
+ */
+import { Service } from '@deepseek-ai/cordis';
+import Schema from '@deepseek-ai/schemastery';
+import type { PrivacyPolicyServiceImpl } from './privacy-policy.js';
+export declare const name = "sanitizer-pipeline";
+export declare const inject: readonly ["privacyPolicy", "auditLog"];
+export interface Config {
+    /** 单会话占位符上限。超限时 sanitize 抛错（见 SanitizerLimitError）。 */
+    maxReplacementsPerSession: number;
+    /** 会话映射表存活时长（毫秒），自最后一次访问算起。0 = 不过期。 */
+    sessionTtlMs: number;
+    /** 同时保留的最大会话数，超出按最近访问时间 LRU 淘汰。0 = 不限。 */
+    maxSessions: number;
+    /** 后台清扫间隔（毫秒）。0 = 关闭定时清扫，仅惰性清扫。 */
+    sweepIntervalMs: number;
+    /** 保留字段：是否启用自动检测（当前恒为规则驱动）。 */
+    enableAutoDetection: boolean;
+}
+export declare const Config: Schema<Config>;
+/**
+ * 单会话占位符数超过 `maxReplacementsPerSession` 时抛出。
+ *
+ * 不能"脱一半就放行"——剩余未替换的 PII 会随 prompt 直接上云。抛错让
+ * input-guard 走 `downgradeOnSanitizeFailure` 分支降级到 LOCAL，符合
+ * "脱不了敏就不上云"。
+ */
+export declare class SanitizerLimitError extends Error {
+    readonly code = "sanitizer-limit-exceeded";
+    constructor(sessionId: string, limit: number);
+}
+export interface Replacement {
+    original: string;
+    placeholder: string;
+    piiType: string;
+    dataClass: string;
+    /** §7.106: the prefix left literal in the outbound text (partial masking);
+     *  absent when the whole value was replaced by the placeholder. */
+    keptPrefix?: string;
+}
+export interface SanitizationResult {
+    sanitizedText: string;
+    sessionId: string;
+    replacements: Replacement[];
+}
+export interface SanitizerService {
+    sanitize(text: string, context?: {
+        sessionId?: string;
+    }): Promise<SanitizationResult>;
+    desanitize(text: string, sessionId: string): Promise<string>;
+    desanitizeSync(text: string, sessionId: string): string;
+    purge(sessionId: string): Promise<void>;
+    getMappingSize(sessionId: string): number;
+}
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        sanitizer: SanitizerServiceImpl;
+    }
+}
+export declare class SanitizerServiceImpl extends Service implements SanitizerService {
+    private privacyPolicy;
+    private auditLog;
+    private sessionMappings;
+    private readonly maxReplacementsPerSession;
+    private readonly sessionTtlMs;
+    private readonly maxSessions;
+    private sweepTimer;
+    constructor(ctx: any, config: Config, privacyPolicy: PrivacyPolicyServiceImpl, auditLog: any);
+    /** 停止后台清扫并清空所有会话映射（明文 PII 一并释放）。 */
+    stop(): Promise<void>;
+    /**
+     * Forward sanitization: replace PII with placeholders.
+     * Returns the sanitized text and the list of replacements made.
+     *
+     * @throws {SanitizerLimitError} 当本会话占位符数将超过上限时。调用方
+     *   （input-guard）应据此降级到 LOCAL，而不是发送半脱敏文本。
+     */
+    sanitize(text: string, context?: {
+        sessionId?: string;
+    }): Promise<SanitizationResult>;
+    /**
+     * Reverse restoration: replace placeholders back to original PII.
+     */
+    desanitize(text: string, sessionId: string): Promise<string>;
+    /**
+     * Synchronous variant of desanitize — no audit log, for use in streaming
+     * event callbacks where async is not available.
+     *
+     * 单次正则扫描 + 查表，复杂度 O(text)。此前的实现对**每一条**映射做一次
+     * 全文 split/join（O(mappings × text)），而流式路径每个 chunk 都会调一次，
+     * 长会话下是明确的热点（2026-08-30 修复）。
+     */
+    desanitizeSync(text: string, sessionId: string): string;
+    /**
+     * Purge all mappings for a session (e.g., when session is deleted).
+     */
+    purge(sessionId: string): Promise<void>;
+    /**
+     * Get the number of mappings for a session (for debugging/testing).
+     */
+    getMappingSize(sessionId: string): number;
+    /** 当前活跃会话数（用于观测与测试）。 */
+    getSessionCount(): number;
+    /** 取出会话映射（不存在则新建），并刷新访问时间 + 施加容量上限。 */
+    private touchSession;
+    /** 超出 maxSessions 时淘汰最久未访问的会话。 */
+    private evictIfOverCapacity;
+    /** 清除超过 TTL 未访问的会话映射，释放其中的明文 PII。 */
+    private sweepExpired;
+    /**
+     * 把会话计数器推过输入中出现的任何占位符形状字面量的序号。
+     *
+     * 残留风险（已知且可接受）：用户若在后续轮次原样回显上一轮**本会话**
+     * 铸造过的占位符，还原时会被替换回该会话自己的 PII——不构成跨会话泄漏。
+     */
+    private bumpCounterPastLiterals;
+    private audit;
+}
+export declare function apply(ctx: any, config: Config): Promise<() => Promise<void>>;
+//# sourceMappingURL=sanitizer-pipeline.d.ts.map

package/lib/dsh-adapter/sanitizer-pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizer-pipeline.d.ts","sourceRoot":"","sources":["../../src/dsh-adapter/sanitizer-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,MAAM,MAAM,0BAA0B,CAAA;AAC7C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AAInE,eAAO,MAAM,IAAI,uBAAuB,CAAA;AAExC,eAAO,MAAM,MAAM,wCAAyC,CAAA;AAE5D,MAAM,WAAW,MAAM;IACrB,uDAAuD;IACvD,yBAAyB,EAAE,MAAM,CAAA;IACjC,uCAAuC;IACvC,YAAY,EAAE,MAAM,CAAA;IACpB,0CAA0C;IAC1C,WAAW,EAAE,MAAM,CAAA;IACnB,mCAAmC;IACnC,eAAe,EAAE,MAAM,CAAA;IACvB,+BAA+B;IAC/B,mBAAmB,EAAE,OAAO,CAAA;CAC7B;AAED,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,CAMhC,CAAA;AAQF;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,8BAA6B;gBAC9B,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;CAI7C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB;uEACmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,WAAW,EAAE,CAAA;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACrF,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5D,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAAA;IACvD,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAA;CAC1C;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,SAAS,EAAE,oBAAoB,CAAA;KAChC;CACF;AAgBD,qBAAa,oBAAqB,SAAQ,OAAQ,YAAW,gBAAgB;IAUzE,OAAO,CAAC,aAAa;IACrB,OAAO,CAAC,QAAQ;IAVlB,OAAO,CAAC,eAAe,CAAoC;IAC3D,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAQ;IAClD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAQ;IACpC,OAAO,CAAC,UAAU,CAA4C;gBAG5D,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,MAAM,EACN,aAAa,EAAE,wBAAwB,EACvC,QAAQ,EAAE,GAAG;IAgBvB,oCAAoC;IAC9B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAU3B;;;;;;OAMG;IACG,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/B,OAAO,CAAC,kBAAkB,CAAC;IAiL9B;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAWlE;;;;;;;OAOG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAUvD;;OAEG;IACG,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW7C;;OAEG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAIzC,wBAAwB;IACxB,eAAe,IAAI,MAAM;IAIzB,uCAAuC;IACvC,OAAO,CAAC,YAAY;IAmBpB,kCAAkC;IAClC,OAAO,CAAC,mBAAmB;IAiB3B,qCAAqC;YACvB,YAAY;IAqB1B;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;YASjB,KAAK;CAQpB;AAED,wBAAsB,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CA6BlF"}

package/lib/dsh-adapter/sanitizer-pipeline.js

@@ -0,0 +1,431 @@
+/**
+ * sanitizer-pipeline — forward sanitization (PII → placeholders) and
+ * reverse desanitization (placeholders → PII) for SANITIZED-realm
+ * sessions. The mapping table is per-session and stored in memory.
+ *
+ * Phase 4 完整实现：
+ * - 正向脱敏（PII → 占位符）
+ * - 反向还原（占位符 → PII）
+ * - 会话级映射表（带 TTL + 容量上限，见下）
+ * - 与 privacy-policy 联动（获取脱敏规则）
+ *
+ * ## 内存中的映射表就是明文 PII
+ *
+ * `sessionMappings` 持有的是**用户原始 PII 明文**（还原时必须用到）。
+ * 因此它必须有明确的生命周期，不能只靠调用方记得调 `purge()`：
+ *   1. `http-api.dropSessionBuffer()` 在会话删除/过期/LRU 淘汰/停机时
+ *      主动调用 `purge()`（首选路径）
+ *   2. 本模块自身按 `sessionTtlMs` 惰性 + 定时清扫（兜底，防止调用方漏调）
+ *   3. `maxSessions` 上限触发 LRU 淘汰（兜底，防止会话 id 爆炸）
+ *
+ * @module dsh-edge-agent/sanitizer-pipeline
+ */
+import { Service } from '@deepseek-ai/cordis';
+import Schema from '@deepseek-ai/schemastery';
+import { normalizeForPII, sliceOriginal } from './pii-utils.js';
+import { loadEdgeConfig } from './edge-config.js';
+export const name = 'sanitizer-pipeline';
+export const inject = ['privacyPolicy', 'auditLog'];
+export const Config = Schema.object({
+    maxReplacementsPerSession: Schema.natural().default(1024),
+    sessionTtlMs: Schema.natural().default(900_000), // 15 min，对齐 confidential 档
+    maxSessions: Schema.natural().default(1000),
+    sweepIntervalMs: Schema.natural().default(60_000),
+    enableAutoDetection: Schema.boolean().default(true),
+});
+/**
+ * 占位符字面量形态：`[<PIITYPE>_<seq>]`，PIITYPE 为大写且可含连字符
+ * （如 `[ID-CARD_1]`、`[PHONE_2]`）。反向还原与防碰撞计数都依赖它。
+ */
+const PLACEHOLDER_RE = /\[([A-Z][A-Z0-9-]*)_(\d+)\]/g;
+/**
+ * 单会话占位符数超过 `maxReplacementsPerSession` 时抛出。
+ *
+ * 不能"脱一半就放行"——剩余未替换的 PII 会随 prompt 直接上云。抛错让
+ * input-guard 走 `downgradeOnSanitizeFailure` 分支降级到 LOCAL，符合
+ * "脱不了敏就不上云"。
+ */
+export class SanitizerLimitError extends Error {
+    code = 'sanitizer-limit-exceeded';
+    constructor(sessionId, limit) {
+        super(`sanitizer: session ${sessionId} exceeded ${limit} placeholders`);
+        this.name = 'SanitizerLimitError';
+    }
+}
+export class SanitizerServiceImpl extends Service {
+    privacyPolicy;
+    auditLog;
+    sessionMappings = new Map();
+    maxReplacementsPerSession;
+    sessionTtlMs;
+    maxSessions;
+    sweepTimer;
+    constructor(ctx, config, privacyPolicy, auditLog) {
+        super(ctx, 'sanitizer');
+        this.privacyPolicy = privacyPolicy;
+        this.auditLog = auditLog;
+        this.maxReplacementsPerSession = config.maxReplacementsPerSession ?? 1024;
+        this.sessionTtlMs = config.sessionTtlMs ?? 900_000;
+        this.maxSessions = config.maxSessions ?? 1000;
+        const interval = config.sweepIntervalMs ?? 60_000;
+        if (interval > 0 && this.sessionTtlMs > 0) {
+            this.sweepTimer = setInterval(() => {
+                void this.sweepExpired();
+            }, interval);
+            // 不要因为这个兜底定时器把进程钉住
+            if (typeof this.sweepTimer.unref === 'function')
+                this.sweepTimer.unref();
+        }
+    }
+    /** 停止后台清扫并清空所有会话映射（明文 PII 一并释放）。 */
+    async stop() {
+        if (this.sweepTimer) {
+            clearInterval(this.sweepTimer);
+            this.sweepTimer = undefined;
+        }
+        for (const sessionId of [...this.sessionMappings.keys()]) {
+            await this.purge(sessionId);
+        }
+    }
+    /**
+     * Forward sanitization: replace PII with placeholders.
+     * Returns the sanitized text and the list of replacements made.
+     *
+     * @throws {SanitizerLimitError} 当本会话占位符数将超过上限时。调用方
+     *   （input-guard）应据此降级到 LOCAL，而不是发送半脱敏文本。
+     */
+    async sanitize(text, context) {
+        const sessionId = context?.sessionId ?? 'default';
+        await this.sweepExpired();
+        const mapping = this.touchSession(sessionId);
+        // 防碰撞：若用户输入里本就含有 `[PHONE_7]` 这种占位符形状的字面量，
+        // 把计数器推过它，确保后续新铸造的占位符永远不会与之重号——否则
+        // 反向还原会把用户的普通文本替换成别人的 PII。
+        this.bumpCounterPastLiterals(mapping, text);
+        const rules = this.privacyPolicy.getSanitizationRules();
+        let sanitizedText = text;
+        const replacements = [];
+        // §7.87.13 (2026-09-20): PII 预检测前的字符级规范化。
+        //
+        // PII 正则对"空格分隔 phone" / "中文数字 id_card"直接漏抓,LLM 也漏
+        // (§7.87.12 4 模型 trace 显示 100% 失败率)。规范化在文本上做:
+        //   - 空白丢弃
+        //   - 中文数字 → 阿拉伯数字(壹贰叁.../〇/两 等变体)
+        // 用 charMap 把正则在 normalized 上的命中区间翻回 text 原始子串,
+        // 让 `byOriginal` 仍以"用户原输入字符串"为 key(desanitize 后能
+        // 还原为带空格 / 中文数字的字面形态)。
+        //
+        // 性能:normalized/charMap 都是 O(n) 一次性扫描,后续规则匹配走的是
+        // 原 normalized(命中区间已被 placeholder 替换),不会累积放大。
+        const normResult = normalizeForPII(text);
+        let normalized = normResult.normalized;
+        const charMap = normResult.charMap;
+        if (normResult.changed) {
+            // 规范化实际修改了文本 → 审计,便于排查"为何 sanitize 命中了一个看似不含 PII 的输入"
+            // (例:用户输入 "1 3 8 0 0 1 3 8 0 0 0" → 被规范化后命中 phone regex)
+            await this.audit('debug', 'sanitizer.normalized', {
+                sessionId,
+                originalLen: text.length,
+                normalizedLen: normalized.length,
+            });
+        }
+        for (const rule of rules) {
+            let regex;
+            try {
+                regex = new RegExp(rule.pattern, 'gi');
+            }
+            catch {
+                continue; // 无效正则，跳过该规则
+            }
+            // §7.87.13 (2026-09-20): regex 在 normalized 上匹配,而非 sanitizedText。
+            // 必须用 exec 拿到 m.index,才能用 charMap 翻回原始子串。
+            // dedup key 改成"用户原字符串"(`byOriginal` 已经以原字符串为 key)。
+            const matches = [];
+            regex.lastIndex = 0;
+            let m;
+            while ((m = regex.exec(normalized)) !== null) {
+                if (m[0].length === 0) {
+                    // 零宽匹配防御(应不会发生,PII regex 都要求长度)
+                    regex.lastIndex++;
+                    continue;
+                }
+                matches.push({ matchStr: m[0], normStart: m.index, normEnd: m.index + m[0].length });
+            }
+            if (matches.length === 0)
+                continue;
+            // §7.87.13 (2026-09-20): 反向处理。
+            //
+            // 正则在 normalized 上匹配到 N 个区间(positions [start, end))。我们对
+            // 每个区间做"matchStr → placeholder"替换,同时**更新 charMap** 以保持
+            // 它跟 normalized 同步 — charMap 的语义是"normalized 位置 → 原文字
+            // 符位置",每替换一段都必须 splice 同步调整:
+            //   删 L 个 charMap 条目(normStart..normStart+L)
+            //   插 P 个条目(normStart..normStart+P),全部指向 charMap[normStart]
+            //     (placeholder 内部位置映射回"被替换段的起点",后续规则不会进
+            //      入 placeholder 区间查询)
+            //
+            // **反向处理**(从最后一个 match 开始)是为了让前面 match 的 normStart
+            // 在被替换后仍有效 — 反向处理时,左边的 match 的 normStart 还没被右
+            // 边的替换影响。
+            const seenOriginals = new Set();
+            for (let mi = matches.length - 1; mi >= 0; mi--) {
+                const { matchStr, normStart, normEnd } = matches[mi];
+                const originalSubstr = sliceOriginal(text, charMap, normStart, normEnd);
+                let placeholder = mapping.byOriginal.get(originalSubstr);
+                // §7.106 (2026-10-23): partial masking. The rule may ask to KEEP the
+                // first N characters of the match in the outbound text (phone: the
+                // 7-digit band is the attribution signal; id-card: the 6-digit
+                // region). The kept prefix stays literal; only the tail becomes the
+                // placeholder's value, so desanitize restores the whole PII for the
+                // user's own view while the cloud only ever saw the coarse part.
+                const keepCount = typeof rule.keepPrefix === 'number' && rule.keepPrefix > 0 ? rule.keepPrefix : 0;
+                // The kept prefix counts DIGITS, not characters: the original text may
+                // carry spaces or Chinese numerals ("1 3 8 0 0 1 3 8 0 0 0"), and
+                // slicing by character would keep only 3-4 digits of the band.
+                const keepNorm = keepCount > 0 && matchStr.length > keepCount ? matchStr.slice(0, keepCount) : '';
+                let keepOrig = '';
+                if (keepCount > 0) {
+                    let digits = 0;
+                    for (const ch of originalSubstr) {
+                        keepOrig += ch;
+                        if (ch >= '0' && ch <= '9') {
+                            digits += 1;
+                            if (digits >= keepCount)
+                                break;
+                        }
+                    }
+                }
+                const tailOrig = keepOrig.length > 0 ? originalSubstr.slice(keepOrig.length) : originalSubstr;
+                if (!placeholder) {
+                    // 先判上限再铸造：`>=` 后置检查会允许越界一个，且原先的 break
+                    // 只跳出内层循环，外层规则照常继续铸造（限流形同虚设）。
+                    if (this.maxReplacementsPerSession > 0 &&
+                        mapping.placeholders.size >= this.maxReplacementsPerSession) {
+                        await this.audit('warn', 'sanitizer.limit-reached', {
+                            sessionId,
+                            limit: this.maxReplacementsPerSession,
+                        });
+                        throw new SanitizerLimitError(sessionId, this.maxReplacementsPerSession);
+                    }
+                    mapping.counter++;
+                    const piiType = rule.piiType || 'PII';
+                    placeholder = `[${piiType.toUpperCase()}_${mapping.counter}]`;
+                    // byOriginal / placeholders 都以"用户原输入字符串"为 value,保证
+                    // desanitize 后还原为字面形态(带空格/中文数字),而非 normalized 形态。
+                    // 部分脱敏时 value 只存尾段（保留的号段留在正文里，无需还原）。
+                    mapping.placeholders.set(placeholder, keepOrig.length > 0 ? tailOrig : originalSubstr);
+                    mapping.byOriginal.set(originalSubstr, placeholder);
+                }
+                // 在 normalized 上按 normStart 处精确替换 matchStr → (keep + placeholder)
+                const normReplacement = keepNorm + placeholder;
+                normalized =
+                    normalized.slice(0, normStart) + normReplacement + normalized.slice(normEnd);
+                // 同步更新 charMap:删 L 插 P,P 个全指向 charMap[normStart](被替换段起点)
+                charMap.splice(normStart, matchStr.length, ...Array(normReplacement.length).fill(charMap[normStart]));
+                // 在 sanitizedText(原文)上按原字串替换 → 保留用户原输入字面,
+                // split/join 全量替换处理"同一 PII 多次出现"的场景
+                sanitizedText = sanitizedText.split(originalSubstr).join(keepOrig + placeholder);
+                // replacements 只记一次(对应原"counts a repeated value once"测试)
+                if (!seenOriginals.has(originalSubstr)) {
+                    seenOriginals.add(originalSubstr);
+                    replacements.push({
+                        original: originalSubstr,
+                        placeholder,
+                        piiType: rule.piiType,
+                        dataClass: rule.dataClass,
+                        ...(keepOrig.length > 0 ? { keptPrefix: keepOrig } : {}),
+                    });
+                }
+            }
+        }
+        if (replacements.length > 0) {
+            // §7.121: 原始判断数据 —— 光记「替换了几处」看不出**命中了哪条
+            // PII 规则**。`piiTypes` 是命中的规则类型（phone / id-card / …），
+            // `placeholders` 是替换后落进出网文本的占位符，两者都是**类型与
+            // 序号**，不含用户原文 —— 占位符本身是可逆映射的键，绝不是明文。
+            //
+            // `original` 绝不进 audit：它是用户 PII 明文。面板要看的「命中了
+            // 什么」由类型 + 占位符回答，不需要原文。
+            const piiTypes = [...new Set(replacements.map(r => r.piiType))];
+            await this.audit('info', 'sanitizer.sanitized', {
+                sessionId,
+                replacementCount: replacements.length,
+                totalMappings: mapping.placeholders.size,
+                piiTypes,
+                placeholders: replacements.map(r => r.placeholder),
+                dataClasses: [...new Set(replacements.map(r => r.dataClass))],
+            });
+        }
+        return { sanitizedText, sessionId, replacements };
+    }
+    /**
+     * Reverse restoration: replace placeholders back to original PII.
+     */
+    async desanitize(text, sessionId) {
+        const restoredText = this.desanitizeSync(text, sessionId);
+        if (restoredText !== text) {
+            await this.audit('debug', 'sanitizer.desanitized', {
+                sessionId,
+                restored: true,
+            });
+        }
+        return restoredText;
+    }
+    /**
+     * Synchronous variant of desanitize — no audit log, for use in streaming
+     * event callbacks where async is not available.
+     *
+     * 单次正则扫描 + 查表，复杂度 O(text)。此前的实现对**每一条**映射做一次
+     * 全文 split/join（O(mappings × text)），而流式路径每个 chunk 都会调一次，
+     * 长会话下是明确的热点（2026-08-30 修复）。
+     */
+    desanitizeSync(text, sessionId) {
+        const mapping = this.sessionMappings.get(sessionId);
+        if (!mapping || mapping.placeholders.size === 0)
+            return text;
+        mapping.lastAccess = Date.now();
+        PLACEHOLDER_RE.lastIndex = 0;
+        return text.replace(PLACEHOLDER_RE, (whole) => mapping.placeholders.get(whole) ?? whole);
+    }
+    /**
+     * Purge all mappings for a session (e.g., when session is deleted).
+     */
+    async purge(sessionId) {
+        const mapping = this.sessionMappings.get(sessionId);
+        if (mapping) {
+            const size = mapping.placeholders.size;
+            mapping.placeholders.clear();
+            mapping.byOriginal.clear();
+            this.sessionMappings.delete(sessionId);
+            await this.audit('info', 'sanitizer.purged', { sessionId, purgedMappings: size });
+        }
+    }
+    /**
+     * Get the number of mappings for a session (for debugging/testing).
+     */
+    getMappingSize(sessionId) {
+        return this.sessionMappings.get(sessionId)?.placeholders.size ?? 0;
+    }
+    /** 当前活跃会话数（用于观测与测试）。 */
+    getSessionCount() {
+        return this.sessionMappings.size;
+    }
+    /** 取出会话映射（不存在则新建），并刷新访问时间 + 施加容量上限。 */
+    touchSession(sessionId) {
+        let mapping = this.sessionMappings.get(sessionId);
+        if (!mapping) {
+            this.evictIfOverCapacity();
+            mapping = {
+                counter: 0,
+                placeholders: new Map(),
+                byOriginal: new Map(),
+                lastAccess: Date.now(),
+            };
+        }
+        else {
+            mapping.lastAccess = Date.now();
+            // 重新插入以维持 Map 的插入序 ≈ 最近访问序，便于 LRU 淘汰
+            this.sessionMappings.delete(sessionId);
+        }
+        this.sessionMappings.set(sessionId, mapping);
+        return mapping;
+    }
+    /** 超出 maxSessions 时淘汰最久未访问的会话。 */
+    evictIfOverCapacity() {
+        if (this.maxSessions <= 0)
+            return;
+        while (this.sessionMappings.size >= this.maxSessions) {
+            const oldest = this.sessionMappings.keys().next();
+            if (oldest.done)
+                break;
+            const victim = this.sessionMappings.get(oldest.value);
+            victim?.placeholders.clear();
+            victim?.byOriginal.clear();
+            this.sessionMappings.delete(oldest.value);
+            void this.audit('warn', 'sanitizer.session-evicted', {
+                sessionId: oldest.value,
+                reason: 'max-sessions',
+                maxSessions: this.maxSessions,
+            });
+        }
+    }
+    /** 清除超过 TTL 未访问的会话映射，释放其中的明文 PII。 */
+    async sweepExpired() {
+        if (this.sessionTtlMs <= 0)
+            return;
+        const cutoff = Date.now() - this.sessionTtlMs;
+        const expired = [];
+        for (const [sessionId, mapping] of this.sessionMappings) {
+            if (mapping.lastAccess < cutoff)
+                expired.push(sessionId);
+        }
+        for (const sessionId of expired) {
+            const mapping = this.sessionMappings.get(sessionId);
+            const size = mapping?.placeholders.size ?? 0;
+            mapping?.placeholders.clear();
+            mapping?.byOriginal.clear();
+            this.sessionMappings.delete(sessionId);
+            await this.audit('info', 'sanitizer.session-expired', {
+                sessionId,
+                purgedMappings: size,
+                ttlMs: this.sessionTtlMs,
+            });
+        }
+    }
+    /**
+     * 把会话计数器推过输入中出现的任何占位符形状字面量的序号。
+     *
+     * 残留风险（已知且可接受）：用户若在后续轮次原样回显上一轮**本会话**
+     * 铸造过的占位符，还原时会被替换回该会话自己的 PII——不构成跨会话泄漏。
+     */
+    bumpCounterPastLiterals(mapping, text) {
+        PLACEHOLDER_RE.lastIndex = 0;
+        let m;
+        while ((m = PLACEHOLDER_RE.exec(text)) !== null) {
+            const seq = Number.parseInt(m[2], 10);
+            if (Number.isFinite(seq) && seq > mapping.counter)
+                mapping.counter = seq;
+        }
+    }
+    async audit(level, kind, payload) {
+        if (!this.auditLog?.log)
+            return;
+        try {
+            await this.auditLog.log({ level, kind, source: 'sanitizer-pipeline', payload });
+        }
+        catch {
+            // Ignore audit errors
+        }
+    }
+}
+export async function apply(ctx, config) {
+    // §7.102: the session limits come from config/edge.json (privacy.*).
+    // The cordis patch row no longer reads process.env — the desktop GUI
+    // never had those variables.
+    const privacy = loadEdgeConfig().privacy;
+    if (privacy) {
+        if (privacy.sanTtlMs !== undefined) {
+            ;
+            config.sessionTtlMs = privacy.sanTtlMs;
+        }
+        if (privacy.sanMaxSessions !== undefined) {
+            ;
+            config.maxSessions = privacy.sanMaxSessions;
+        }
+        if (privacy.sanSweepMs !== undefined) {
+            ;
+            config.sweepIntervalMs = privacy.sanSweepMs;
+        }
+    }
+    const privacyPolicy = ctx.get('privacyPolicy');
+    if (!privacyPolicy || typeof privacyPolicy.getSanitizationRules !== 'function') {
+        // 启动期 fail-fast：缺了它 sanitize() 会在每次请求时抛错，表现为
+        // "每条请求都静默降级到 LOCAL"，排查成本极高。宁可起不来。
+        throw new Error('sanitizer-pipeline: privacyPolicy service unavailable — check plugin boot order');
+    }
+    const auditLog = ctx.get('auditLog');
+    const service = new SanitizerServiceImpl(ctx, config, privacyPolicy, auditLog);
+    return async () => {
+        await service.stop();
+    };
+}

package/lib/dsh-adapter/secure-bridge.d.ts

@@ -0,0 +1,47 @@
+/**
+ * secure-bridge — the single outbound channel for cloud-bound requests.
+ * Routes through the OHTTP gateway when reachable, falls back to direct
+ * TLS only when explicitly allowed. Cooperates with td-bus for rate
+ * limiting and quarantine.
+ *
+ * @module dsh-edge-agent/secure-bridge
+ */
+import { Service } from '@deepseek-ai/cordis';
+import Schema from '@deepseek-ai/schemastery';
+export declare const name = "secure-bridge";
+export declare const inject: readonly ["tcm", "ohttp", "privacyPolicy", "auditLog"];
+export interface Config {
+    mode: 'ohttp' | 'tls' | 'auto';
+    domainAllowList: string[];
+    domainDenyList: string[];
+    requestTimeoutMs: number;
+}
+export declare const Config: Schema<Config>;
+export interface CloudRequest {
+    url: string;
+    method: 'GET' | 'POST' | 'PUT' | 'DELETE';
+    headers: Record<string, string>;
+    body?: unknown;
+    sessionId?: string;
+}
+export interface CloudResponse {
+    status: number;
+    headers: Record<string, string>;
+    body: unknown;
+}
+export interface SecureBridgeService {
+    sendCloudRequest(req: CloudRequest): Promise<CloudResponse>;
+    isBlocked(): boolean;
+}
+export declare class SecureBridgeServiceImpl extends Service {
+    constructor(ctx: any);
+    sendCloudRequest(req: CloudRequest): Promise<CloudResponse>;
+    isBlocked(): boolean;
+}
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        secureBridge: SecureBridgeServiceImpl;
+    }
+}
+export declare function apply(ctx: any, config: Config): Promise<() => Promise<void>>;
+//# sourceMappingURL=secure-bridge.d.ts.map

package/lib/dsh-adapter/secure-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-bridge.d.ts","sourceRoot":"","sources":["../../src/dsh-adapter/secure-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,MAAM,MAAM,0BAA0B,CAAA;AAE7C,eAAO,MAAM,IAAI,kBAAkB,CAAA;AAEnC,eAAO,MAAM,MAAM,wDAAyD,CAAA;AAE5E,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,CAAA;IAC9B,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,gBAAgB,EAAE,MAAM,CAAA;CACzB;AAED,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,CAKhC,CAAA;AAEF,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAA;IACzC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,IAAI,EAAE,OAAO,CAAA;CACd;AAED,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IAC3D,SAAS,IAAI,OAAO,CAAA;CACrB;AAED,qBAAa,uBAAwB,SAAQ,OAAO;gBACtC,GAAG,EAAE,GAAG;IAGd,gBAAgB,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;IAIjE,SAAS,IAAI,OAAO;CAGrB;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,YAAY,EAAE,uBAAuB,CAAA;KACtC;CACF;AAED,wBAAsB,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAIlF"}

package/lib/dsh-adapter/secure-bridge.js

@@ -0,0 +1,35 @@
+/**
+ * secure-bridge — the single outbound channel for cloud-bound requests.
+ * Routes through the OHTTP gateway when reachable, falls back to direct
+ * TLS only when explicitly allowed. Cooperates with td-bus for rate
+ * limiting and quarantine.
+ *
+ * @module dsh-edge-agent/secure-bridge
+ */
+import { Service } from '@deepseek-ai/cordis';
+import Schema from '@deepseek-ai/schemastery';
+export const name = 'secure-bridge';
+export const inject = ['tcm', 'ohttp', 'privacyPolicy', 'auditLog'];
+export const Config = Schema.object({
+    mode: Schema.union(['ohttp', 'tls', 'auto']).default('ohttp'),
+    domainAllowList: Schema.array(Schema.string()).default([]),
+    domainDenyList: Schema.array(Schema.string()).default([]),
+    requestTimeoutMs: Schema.natural().default(30000),
+});
+export class SecureBridgeServiceImpl extends Service {
+    constructor(ctx) {
+        super(ctx, 'secureBridge');
+    }
+    async sendCloudRequest(req) {
+        void req;
+        return { status: 200, headers: {}, body: null };
+    }
+    isBlocked() {
+        return false;
+    }
+}
+export async function apply(ctx, config) {
+    ctx.plugin(SecureBridgeServiceImpl);
+    void config;
+    return async () => { };
+}