@moonquake2004/dsh-doctor 0.4.0 → 0.4.2

package/client/client.js

@@ -23,6 +23,7 @@ const zh = {
   sectionEnv: '环境',
   sectionProfile: 'Profile',
   sectionSession: '会话',
+  sectionSecurity: '🔒 安全',
   fix: '修复',
   quarantineHint: '隔离建议（手动执行，勿自动）',
   error: '诊断失败：{msg}',
@@ -37,6 +38,7 @@ const en = {
   sectionEnv: 'Environment',
   sectionProfile: 'Profile',
   sectionSession: 'Session',
+  sectionSecurity: '🔒 Security',
   fix: 'Fix',
   quarantineHint: 'Quarantine suggestion (run manually, never auto)',
   error: 'Doctor failed: {msg}',
@@ -86,7 +88,7 @@ function DoctorSection(props) {
     finally { setRunning(false) }
   }, [])
   useEffect(() => { injectStyles(); run() }, [run])
-  const sectionName = (s) => ({ env: L.sectionEnv, profile: L.sectionProfile, session: L.sectionSession }[s] || s)
+  const sectionName = (s) => ({ env: L.sectionEnv, profile: L.sectionProfile, session: L.sectionSession, security: L.sectionSecurity }[s] || s)
   return h('div', { className: 'dshd-wrap' },
     h('div', { style: { display: 'flex', gap: '10px', alignItems: 'center' } },
       h('button', { className: 'dshd-btn', onClick: run, disabled: running }, running ? L.running : L.run)),

package/dsh-doctor.mjs

@@ -61,6 +61,7 @@ import { pathToFileURL, fileURLToPath } from 'node:url';
 const HOME = process.env.DSH_HOME || join(homedir(), '.dsh');
 const results = []; // { section, id, ok, detail, fix? }
 const jsonOut = process.argv.includes('--json');
+const securityOnly = process.argv.includes('--security-only');
 const only = process.argv
   .filter((a) => a.startsWith('--profile') || a.startsWith('--session') || a === '--env')
   .map((a) => a.startsWith('--') ? a.slice(2) : a);
@@ -335,6 +336,10 @@ function checkProfile(name) {
   for (const b of bundles) {
     const dir2 = findPkg(b);
     if (!dir2) {
+      // installAnchor 为 null（web GUI/无 dsh 锚点）时，宿主侧 bundle 无法验证——
+      // 跳过而非误报（#917 core bundles dsh-base/dsh-web-app 由宿主直接提供，
+      // 不在 profile node_modules 里，installAnchor 缺失时 findPkg 找不到是正常的）
+      if (!installAnchor) continue;
       report('profile', 'P1', false, `bundle 条目 ${b} 无法在安装目录或 profile node_modules 解析（#917/#1377/#880）`, `dsh plugin --profile ${name} add ${b} 或从 dsh.profile.bundles 移除`);
     } else {
       const pkg = JSON.parse(readFileSync(join(dir2, 'package.json'), 'utf8'));
@@ -343,19 +348,28 @@ function checkProfile(name) {
       }
     }
   }
-  // P2 id 冲突
-  const bundleIds = new Set();
+  // P2 id 冲突（#1404 bundle↔user + #2315 bundle↔bundle）
+  const bundleIdSources = new Map(); // id → Set<bundle name>
   for (const b of bundles) {
     const dir2 = findPkg(b);
     if (!dir2) continue;
     const pkg = JSON.parse(readFileSync(join(dir2, 'package.json'), 'utf8'));
     const rel = pkg.dsh?.bundle?.patch;
     if (!rel) continue;
-    for (const id of readInsertIds(join(dir2, rel))) bundleIds.add(id);
+    for (const id of readInsertIds(join(dir2, rel))) {
+      if (!bundleIdSources.has(id)) bundleIdSources.set(id, new Set());
+      bundleIdSources.get(id).add(b);
+    }
   }
-  const dup = [...bundleIds].filter((id) => userIds.has(id));
-  if (dup.length) {
-    report('profile', 'P2', false, `bundle 与用户 patch 的 id 冲突（启动必崩 duplicate loader entry id，#1404）: ${dup.join(', ')}`, `备份后从 ${patchPath} 删除这些 insert（或运行 check-dsh-profile.mjs 查看详情）`);
+  // 跨 bundle 冲突：多个 bundle 注册同一 entry id（#2315 dsh-tui↔dsh-web-app agent-presets）
+  const crossBundleDup = [...bundleIdSources].filter(([, s]) => s.size > 1).map(([id, s]) => `${id}（${[...s].join(' + ')}）`);
+  // bundle vs 用户 patch 冲突（#1404）
+  const userBundleDup = [...bundleIdSources.keys()].filter((id) => userIds.has(id));
+  const p2Issues = [];
+  if (crossBundleDup.length) p2Issues.push(`多个 bundle 注册相同 entry id（启动必崩 duplicate loader entry id，#2315）: ${crossBundleDup.join('; ')}`);
+  if (userBundleDup.length) p2Issues.push(`bundle 与用户 patch 的 id 冲突（启动必崩 duplicate loader entry id，#1404）: ${userBundleDup.join(', ')}`);
+  if (p2Issues.length) {
+    report('profile', 'P2', false, p2Issues.join(' | '), crossBundleDup.length ? '移除冲突 bundle 中的一个（如不兼容的 TUI/standalone 插件误装入 profile），或让上游协商唯一 entry id' : `备份后从 ${patchPath} 删除这些 insert（或运行 check-dsh-profile.mjs 查看详情）`);
   } else {
     report('profile', 'P2', true, '无 bundle/用户 patch id 冲突', undefined);
   }
@@ -395,7 +409,8 @@ function checkProfile(name) {
       const fp = join(topDir, p);
       let st;
       try { st = lstatSync(fp); } catch { continue; }
-      if (st.isSymbolicLink() && hostScope) {
+      if (st.isSymbolicLink()) {
+        if (!hostScope) continue; // installAnchor 缺失时无法验证 symlink 指向宿主——跳过（#1697 workaround 已知安全形态）
         try {
           const real = realpathSync(fp);
           const hostPkg = join(hostScope, p);
@@ -1248,45 +1263,109 @@ async function run() {
       process.exit(1);
     }
   }
-  try { checkEnv(); } catch (e) { report('env', 'E0', false, `env 检查异常: ${e.message.slice(0, 80)}`); }
-  try { await checkPort3080(); } catch (e) { report('env', 'E10-port-3080', false, `端口检查异常: ${e.message.slice(0, 60)}`); }
-  try { checkProfile(profileArg); } catch (e) { report('profile', 'P0', false, `profile 检查异常: ${e.message.slice(0, 100)}`); }
-  try { checkSession(sessionArg); } catch (e) { report('session', 'S0', false, `session 检查异常: ${e.message.slice(0, 100)}`); }
-  try { scanAllSessions(); } catch (e) { report('session', 'S11', false, `全会话扫描异常: ${e.message.slice(0, 100)}`); }
+  // --security-only 跳过非安全检查
+  if (!securityOnly) {
+    try { checkEnv(); } catch (e) { report('env', 'E0', false, `env 检查异常: ${e.message.slice(0, 80)}`); }
+    try { await checkPort3080(); } catch (e) { report('env', 'E10-port-3080', false, `端口检查异常: ${e.message.slice(0, 60)}`); }
+    try { checkProfile(profileArg); } catch (e) { report('profile', 'P0', false, `profile 检查异常: ${e.message.slice(0, 100)}`); }
+    try { checkSession(sessionArg); } catch (e) { report('session', 'S0', false, `session 检查异常: ${e.message.slice(0, 100)}`); }
+    try { scanAllSessions(); } catch (e) { report('session', 'S11', false, `全会话扫描异常: ${e.message.slice(0, 100)}`); }
+  }
 
-  // 远程检查目录（层 A）：内置检查之后追加执行；--no-catalog 只走内置副本
+  // 远程检查目录（层 A）：内置检查之后追加执行；--no-catalog 只走内置副本；--security-only 跳过
   let catalogMeta = { source: 'none', checks: 0 };
-  try {
-    const catalog = await loadCatalog({ noRemote: process.argv.includes('--no-catalog'), fetchImpl: typeof fetch === 'function' ? fetch : undefined });
-    catalogMeta = { source: catalog.source, checks: catalog.checks.length };
-    const profileDir = (() => { try { return resolveProfile(profileArg); } catch { return null; } })();
-    if (catalog.checks.length && profileDir) checkCatalog({ home: HOME, profile: profileArg, profileDir }, catalog);
-    else if (catalog.checks.length) report('catalog', 'C0', true, `profile 无效（${profileArg}），目录检查跳过（${catalog.source}）`, undefined, 'catalog');
-  } catch (e) {
-    catalogMeta = { source: 'error', checks: 0, error: e.message.slice(0, 80) };
+  if (!securityOnly) {
+    try {
+      const catalog = await loadCatalog({ noRemote: process.argv.includes('--no-catalog'), fetchImpl: typeof fetch === 'function' ? fetch : undefined });
+      catalogMeta = { source: catalog.source, checks: catalog.checks.length };
+      const profileDir = (() => { try { return resolveProfile(profileArg); } catch { return null; } })();
+      if (catalog.checks.length && profileDir) checkCatalog({ home: HOME, profile: profileArg, profileDir }, catalog);
+      else if (catalog.checks.length) report('catalog', 'C0', true, `profile 无效（${profileArg}），目录检查跳过（${catalog.source}）`, undefined, 'catalog');
+    } catch (e) {
+      catalogMeta = { source: 'error', checks: 0, error: e.message.slice(0, 80) };
+    }
   }
 
-  // 层 B：版本检查与更新（--no-catalog 同时禁用网络检查；--update 手动更新；DSH_DOCTOR_AUTO_UPDATE=1 自动）
+  // 层 B：版本检查与更新（--no-catalog 同时禁用网络检查；--update 手动更新；DSH_DOCTOR_AUTO_UPDATE=1 自动；--security-only 跳过）
   const noRemote = process.argv.includes('--no-catalog');
   let updateInfo = { current: localVersion(), latest: null, available: false };
-  try {
-    updateInfo = await checkForUpdate({ noRemote, fetchImpl: typeof fetch === 'function' ? fetch : undefined });
-  } catch (e) {
-    updateInfo = { current: localVersion(), latest: null, available: false, error: e.message.slice(0, 60) };
+  if (!securityOnly) {
+    try {
+      updateInfo = await checkForUpdate({ noRemote, fetchImpl: typeof fetch === 'function' ? fetch : undefined });
+    } catch (e) {
+      updateInfo = { current: localVersion(), latest: null, available: false, error: e.message.slice(0, 60) };
+    }
+    if (process.argv.includes('--update') || (process.env.DSH_DOCTOR_AUTO_UPDATE === '1' && updateInfo.available)) {
+      updateInfo.applied = runUpdate();
+    }
   }
-  if (process.argv.includes('--update') || (process.env.DSH_DOCTOR_AUTO_UPDATE === '1' && updateInfo.available)) {
-    updateInfo.applied = runUpdate();
+
+  // 安全检查（--security）：导入 dsh-security 运行安全检查，合并到 results
+  const securityEnabled = process.argv.includes('--security');
+  let securityMeta = { enabled: false, summary: {} };
+  if (securityEnabled) {
+    try {
+      // 尝试从 profile node_modules 或全局安装导入 dsh-security
+      let secMod;
+      const profileDir = (() => { try { return resolveProfile(profileArg); } catch { return null; } })();
+      const secCandidates = [
+        profileDir ? join(profileDir, 'node_modules', '@moonquake2004', 'dsh-security', 'src', 'index.mjs') : null,
+        join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'node_modules', '@moonquake2004', 'dsh-security', 'src', 'index.mjs'),
+        '/Users/waterfly/dsh工作区/dsh-security/src/index.mjs',
+      ].filter(Boolean);
+      for (const candidate of secCandidates) {
+        if (existsSync(candidate)) { secMod = await import(candidate); break; }
+      }
+      if (secMod) {
+        const registry = await secMod.createDefaultRegistry();
+        // 获取最新会话文件（供 SR*/SS* 检查使用）
+        const findLatestSession = () => {
+          if (sessionArg) return sessionArg;
+          try {
+            const sDir = join(HOME, 'sessions');
+            const latest = readdirSync(sDir).filter(f => f.endsWith('.jsonl')).sort().pop();
+            return latest ? join(sDir, latest) : null;
+          } catch { return null; }
+        };
+
+        const { results: secResults, exitCode: secExit, summary: secSummary } = await registry.runAll(
+          (check) => {
+            // 静态检查用 profile 目录
+            if (check.phase === 'pre-install' || check.phase === 'lifecycle') {
+              return profileDir || profileArg;
+            }
+            // SR*/SS* 检查用会话文件
+            if (check.id && (check.id.startsWith('SR') || check.id.startsWith('SS'))) {
+              return findLatestSession() || null;
+            }
+            // 默认用 profile 目录
+            return profileDir || profileArg;
+          }
+        );
+        for (const r of secResults) {
+          results.push({ section: 'security', id: r.id, ok: r.ok, detail: r.detail, fix: r.fix, severity: r.severity, skip: false });
+        }
+        securityMeta = { enabled: true, summary: secSummary, exitCode: secExit };
+      } else {
+        securityMeta = { enabled: true, error: 'dsh-security not found', summary: {} };
+      }
+    } catch (e) {
+      securityMeta = { enabled: true, error: e.message.slice(0, 80), summary: {} };
+    }
   }
 
   // 退出码只计内置失败 + catalog 中 severity=error 的失败；warn 失败提示但不改退出码
+  // 安全检查退出码：CRITICAL→2, HIGH→1（取 max）
   const bad = results.filter((r) => !r.ok && catalogSeverity.get(r.id) !== 'warn');
+  const secExit = securityMeta.exitCode ?? 0;
   if (jsonOut && process.argv.includes('--envelope')) {
     // v1 契约信封（dsh doctor 规格，zoahdev/doctor 对齐）：status 小写 + 退出码 0/1/2
     const st = (r) => (r.skip ? 'skip' : (!r.ok ? (catalogSeverity.get(r.id) === 'warn' ? 'warn' : 'fail') : 'pass'));
     const summary = { pass: 0, warn: 0, fail: 0, skip: 0 }; // skip 常驻（v1 词汇表 r5：#1719），r5 后 P12 会在未装 bundle 时实际触发
-    const checks = results.map((r) => { summary[st(r)]++; return { name: r.id, status: st(r), detail: r.detail }; });
-    const exitCode = summary.fail > 0 ? 2 : summary.warn > 0 ? 1 : 0;
-    console.log(JSON.stringify({
+    const checks = results.map((r) => { summary[st(r)]++; return { name: r.id, status: st(r), detail: r.detail, ...(r.severity ? { severity: r.severity } : {}), ...(r.section === 'security' ? { section: 'security' } : {}) }; });
+    const baseExit = summary.fail > 0 ? 2 : summary.warn > 0 ? 1 : 0;
+    const exitCode = Math.max(baseExit, secExit);
+    const out = {
       schema: 'dsh-doctor/v1',
       tool: 'dsh-doctor',
       generatedAt: new Date().toISOString(),
@@ -1295,10 +1374,14 @@ async function run() {
       summary,
       ok: exitCode === 0,
       checks,
-    }, null, 2));
+    };
+    if (securityMeta.enabled) {
+      out.security = { enabled: true, summary: securityMeta.summary, ...(securityMeta.error ? { error: securityMeta.error } : {}) };
+    }
+    console.log(JSON.stringify(out, null, 2));
     process.exit(exitCode);
   } else if (jsonOut) {
-    console.log(JSON.stringify({ ok: bad.length === 0, checks: results, catalog: catalogMeta, update: updateInfo }, null, 2));
+    console.log(JSON.stringify({ ok: bad.length === 0 && secExit === 0, checks: results, catalog: catalogMeta, update: updateInfo, ...(securityMeta.enabled ? { security: securityMeta } : {}) }, null, 2));
   } else {
     const sectionOrder = { env: 0, profile: 1, session: 2, catalog: 3 };
     const ordered = [...results].sort((a, b) => (sectionOrder[a.section] ?? 9) - (sectionOrder[b.section] ?? 9));

package/lib/index.js

@@ -35,7 +35,7 @@ export function apply(ctx, config) {
  */
 function runChecks(profile, sessionPath) {
     return new Promise((resolvePromise) => {
-        const args = ['--json'];
+        const args = ['--json', '--security'];
         if (profile) args.push('--profile', profile);
         if (sessionPath) args.push('--session', sessionPath);
         const child = spawn(process.execPath, [SCRIPT, ...args], {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moonquake2004/dsh-doctor",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Offline diagnostic for DeepSeek Harness — 28 built-in + 5 catalog checks across env/profile/session (Layer A checks-as-data), self-update (Layer B), and a semi-automatic LLM observer (Layer C, --observe); Doctor panel in web UI settings.",
   "main": "lib/index.js",
   "files": [
@@ -48,4 +48,4 @@
   "bin": {
     "dsh-doctor": "./dsh-doctor.mjs"
   }
-}
+}