@liuhange/dsh-data-masking 1.0.0

package/README.md

@@ -0,0 +1,18 @@
+# @deepseek-ai/dsh-data-masking
+
+Data masking plugin for DeepSeek Harness. Identifies and masks sensitive fields (ID card, phone, bank card, email).
+
+## Tool: mask_sensitive_data
+
+- **Parameters**: `filePath` (required), `strategy` (optional: FULL | PARTIAL | GENERALIZE, default PARTIAL)
+- **Output**: Masking report with field counts and output file path
+- **Output file**: `{originalName}_masked.{ext}`
+
+## Business Rules
+
+All sensitive field patterns and masking levels are read from `config/business-rules.json`. No business logic is hardcoded.
+
+## Known Limitations and Deferred Work
+
+- Regex patterns are compiled at runtime from config strings
+- Large file streaming masking not yet implemented

package/lib/index.js

@@ -0,0 +1,131 @@
+import { defineTool } from "@deepseek-ai/dsh-tools";
+import * as fs from "fs";
+import * as path from "path";
+import { AuditLogger, BusinessRulesLoader, FileFormatAdapter, PathValidator, ReportGenerator } from "@deepseek-ai/dsh-data-asset-shared";
+//#region lib/types/sensitiveFieldScanner.js
+var SensitiveFieldScanner = class {
+	scan(lines, sensitivePatterns) {
+		const fields = [];
+		const typeCounts = {};
+		const patternEntries = Object.entries(sensitivePatterns);
+		for (let lineIndex = 0; lineIndex < lines.length; lineIndex++) {
+			const line = lines[lineIndex] ?? "";
+			for (const [type, config] of patternEntries) {
+				const regex = new RegExp(config.pattern, "g");
+				let match;
+				while ((match = regex.exec(line)) !== null) {
+					fields.push({
+						type,
+						value: match[0],
+						line: lineIndex + 1,
+						column: match.index + 1
+					});
+					typeCounts[type] = (typeCounts[type] ?? 0) + 1;
+				}
+			}
+		}
+		return {
+			fields,
+			typeCounts
+		};
+	}
+};
+//#endregion
+//#region lib/types/maskingStrategyExecutor.js
+var MaskingStrategyExecutor = class {
+	execute(value, _type, strategy) {
+		switch (this.resolveStrategy(strategy)) {
+			case "FULL": return "***";
+			case "PARTIAL": return this.applyPartial(value);
+			case "GENERALIZE": return "<脱敏数据>";
+		}
+	}
+	resolveStrategy(strategy) {
+		if (strategy === "FULL" || strategy === "PARTIAL" || strategy === "GENERALIZE") return strategy;
+		return "PARTIAL";
+	}
+	applyPartial(value, keepPrefix = 3, keepSuffix = 4) {
+		if (value.length <= keepPrefix + keepSuffix) return "***";
+		return value.slice(0, keepPrefix) + "***" + value.slice(-keepSuffix);
+	}
+};
+//#endregion
+//#region lib/types/index.js
+const name = "data-masking";
+const inject = ["tools"];
+function apply(ctx) {
+	const loader = new BusinessRulesLoader();
+	const formatAdapter = new FileFormatAdapter();
+	const reportGenerator = new ReportGenerator();
+	const pathValidator = new PathValidator();
+	const auditLogger = new AuditLogger();
+	const scanner = new SensitiveFieldScanner();
+	const strategyExecutor = new MaskingStrategyExecutor();
+	ctx.tools.register(defineTool({
+		name: "mask_sensitive_data",
+		description: "识别并脱敏数据中的敏感字段（身份证、手机号、银行卡、邮箱）",
+		parameters: {
+			filePath: {
+				type: "string",
+				required: true,
+				description: "待处理文件的路径"
+			},
+			strategy: {
+				type: "string",
+				description: "脱敏策略: FULL | PARTIAL | GENERALIZE"
+			}
+		},
+		output: {
+			schema: { type: "string" },
+			render: (_args, value) => [{
+				type: "text",
+				text: value
+			}]
+		},
+		async execute(args) {
+			const { config } = loader.load();
+			const workingDir = process.cwd();
+			const filePath = args.filePath;
+			const strategy = args.strategy ?? "PARTIAL";
+			try {
+				pathValidator.validate(filePath, workingDir);
+			} catch {
+				return `错误：路径不合法 - ${filePath}`;
+			}
+			const fullPath = path.resolve(filePath);
+			if (!fs.existsSync(fullPath)) return `错误：文件不存在 - ${fullPath}`;
+			const readResult = await formatAdapter.read(fullPath);
+			const lines = readResult.lines;
+			const scanResult = scanner.scan(lines, config.sensitivePatterns);
+			let maskedLines = [...lines];
+			for (const field of scanResult.fields) {
+				const fieldType = field.type;
+				const fieldStrategy = config.sensitivePatterns[fieldType].level ?? strategy;
+				const maskedValue = strategyExecutor.execute(field.value, fieldType, fieldStrategy);
+				maskedLines = maskedLines.map((line) => line.replace(field.value, maskedValue));
+			}
+			const ext = path.extname(fullPath);
+			const baseName = path.basename(fullPath, ext);
+			const outputPath = path.join(path.dirname(fullPath), `${baseName}_masked${ext}`);
+			await formatAdapter.write(outputPath, maskedLines, readResult.format);
+			const report = reportGenerator.generateMaskingReport({
+				inputPath: fullPath,
+				outputPath,
+				strategy: strategyExecutor.resolveStrategy(strategy),
+				findings: scanResult.fields,
+				fieldTypeCounts: scanResult.typeCounts
+			});
+			auditLogger.log({
+				pluginName: "data-masking",
+				operation: "mask_sensitive_data",
+				inputPath: fullPath,
+				outputPath,
+				result: "SUCCESS"
+			});
+			return report;
+		}
+	}));
+	console.log("[data-masking] 脱敏插件已加载");
+}
+//#endregion
+export { apply, inject, name };

package/lib/invariant.js

@@ -0,0 +1,5 @@
+//#region lib/types/invariant.js
+const invariant = "data-masking";
+function install() {}
+//#endregion
+export { install, invariant };

package/lib/types/index.d.ts

@@ -0,0 +1,5 @@
+import type { Context } from '@deepseek-ai/cordis';
+export declare const name = "data-masking";
+export declare const inject: string[];
+export declare function apply(ctx: Context): void;
+//# sourceMappingURL=index.d.ts.map

package/lib/types/invariant.d.ts

@@ -0,0 +1,3 @@
+export declare const invariant = "data-masking";
+export declare function install(): void;
+//# sourceMappingURL=invariant.d.ts.map

package/lib/types/maskingStrategyExecutor.d.ts

@@ -0,0 +1,7 @@
+import type { MaskingStrategy, SensitiveFieldType } from '@deepseek-ai/dsh-data-asset-shared';
+export declare class MaskingStrategyExecutor {
+    execute(value: string, _type: SensitiveFieldType, strategy: MaskingStrategy): string;
+    resolveStrategy(strategy: MaskingStrategy): MaskingStrategy;
+    private applyPartial;
+}
+//# sourceMappingURL=maskingStrategyExecutor.d.ts.map

package/lib/types/sensitiveFieldScanner.d.ts

@@ -0,0 +1,9 @@
+import type { SensitiveField, SensitivePatterns } from '@deepseek-ai/dsh-data-asset-shared';
+export interface ScanResult {
+    fields: SensitiveField[];
+    typeCounts: Record<string, number>;
+}
+export declare class SensitiveFieldScanner {
+    scan(lines: string[], sensitivePatterns: SensitivePatterns): ScanResult;
+}
+//# sourceMappingURL=sensitiveFieldScanner.d.ts.map

package/package.json

@@ -0,0 +1,23 @@
+{
+  "name": "@liuhange/dsh-data-masking",
+  "description": "Data masking plugin: sensitive field identification and graded masking (FULL/PARTIAL/GENERALIZE)",
+  "version": "1.0.0",
+  "publishConfig": { "access": "public" },
+  "repository": { "type": "git", "url": "git+https://github.com/deepseek-ai/deepseek-harness.git", "directory": "packages/data-asset/data-masking" },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": { "types": "./lib/types/index.d.ts", "default": "./lib/index.js" },
+    "./invariant": { "types": "./lib/types/invariant.d.ts", "default": "./lib/invariant.js" },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "files": ["lib/index.js", "lib/invariant.js", "lib/types/**/*.d.ts"],
+  "license": "MIT",
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^0.1.0",
+    "@deepseek-ai/dsh-tools": "^0.1.0",
+    "@liuhange/dsh-data-asset-shared": "^1.0.0"
+  }
+}