@moonquake2004/dsh-doctor 0.4.1 → 0.4.3

package/client/client.js

@@ -23,6 +23,7 @@ const zh = {
   sectionEnv: '环境',
   sectionProfile: 'Profile',
   sectionSession: '会话',
+  sectionSecurity: '🔒 安全',
   fix: '修复',
   quarantineHint: '隔离建议（手动执行，勿自动）',
   error: '诊断失败：{msg}',
@@ -37,6 +38,7 @@ const en = {
   sectionEnv: 'Environment',
   sectionProfile: 'Profile',
   sectionSession: 'Session',
+  sectionSecurity: '🔒 Security',
   fix: 'Fix',
   quarantineHint: 'Quarantine suggestion (run manually, never auto)',
   error: 'Doctor failed: {msg}',
@@ -86,7 +88,7 @@ function DoctorSection(props) {
     finally { setRunning(false) }
   }, [])
   useEffect(() => { injectStyles(); run() }, [run])
-  const sectionName = (s) => ({ env: L.sectionEnv, profile: L.sectionProfile, session: L.sectionSession }[s] || s)
+  const sectionName = (s) => ({ env: L.sectionEnv, profile: L.sectionProfile, session: L.sectionSession, security: L.sectionSecurity }[s] || s)
   return h('div', { className: 'dshd-wrap' },
     h('div', { style: { display: 'flex', gap: '10px', alignItems: 'center' } },
       h('button', { className: 'dshd-btn', onClick: run, disabled: running }, running ? L.running : L.run)),

package/dsh-doctor.mjs

@@ -61,6 +61,7 @@ import { pathToFileURL, fileURLToPath } from 'node:url';
 const HOME = process.env.DSH_HOME || join(homedir(), '.dsh');
 const results = []; // { section, id, ok, detail, fix? }
 const jsonOut = process.argv.includes('--json');
+const securityOnly = process.argv.includes('--security-only');
 const only = process.argv
   .filter((a) => a.startsWith('--profile') || a.startsWith('--session') || a === '--env')
   .map((a) => a.startsWith('--') ? a.slice(2) : a);
@@ -1262,45 +1263,141 @@ async function run() {
       process.exit(1);
     }
   }
-  try { checkEnv(); } catch (e) { report('env', 'E0', false, `env 检查异常: ${e.message.slice(0, 80)}`); }
-  try { await checkPort3080(); } catch (e) { report('env', 'E10-port-3080', false, `端口检查异常: ${e.message.slice(0, 60)}`); }
-  try { checkProfile(profileArg); } catch (e) { report('profile', 'P0', false, `profile 检查异常: ${e.message.slice(0, 100)}`); }
-  try { checkSession(sessionArg); } catch (e) { report('session', 'S0', false, `session 检查异常: ${e.message.slice(0, 100)}`); }
-  try { scanAllSessions(); } catch (e) { report('session', 'S11', false, `全会话扫描异常: ${e.message.slice(0, 100)}`); }
+  // --security-only 跳过非安全检查
+  if (!securityOnly) {
+    try { checkEnv(); } catch (e) { report('env', 'E0', false, `env 检查异常: ${e.message.slice(0, 80)}`); }
+    try { await checkPort3080(); } catch (e) { report('env', 'E10-port-3080', false, `端口检查异常: ${e.message.slice(0, 60)}`); }
+    try { checkProfile(profileArg); } catch (e) { report('profile', 'P0', false, `profile 检查异常: ${e.message.slice(0, 100)}`); }
+    try { checkSession(sessionArg); } catch (e) { report('session', 'S0', false, `session 检查异常: ${e.message.slice(0, 100)}`); }
+    try { scanAllSessions(); } catch (e) { report('session', 'S11', false, `全会话扫描异常: ${e.message.slice(0, 100)}`); }
+  }
 
-  // 远程检查目录（层 A）：内置检查之后追加执行；--no-catalog 只走内置副本
+  // 远程检查目录（层 A）：内置检查之后追加执行；--no-catalog 只走内置副本；--security-only 跳过
   let catalogMeta = { source: 'none', checks: 0 };
-  try {
-    const catalog = await loadCatalog({ noRemote: process.argv.includes('--no-catalog'), fetchImpl: typeof fetch === 'function' ? fetch : undefined });
-    catalogMeta = { source: catalog.source, checks: catalog.checks.length };
-    const profileDir = (() => { try { return resolveProfile(profileArg); } catch { return null; } })();
-    if (catalog.checks.length && profileDir) checkCatalog({ home: HOME, profile: profileArg, profileDir }, catalog);
-    else if (catalog.checks.length) report('catalog', 'C0', true, `profile 无效（${profileArg}），目录检查跳过（${catalog.source}）`, undefined, 'catalog');
-  } catch (e) {
-    catalogMeta = { source: 'error', checks: 0, error: e.message.slice(0, 80) };
+  if (!securityOnly) {
+    try {
+      const catalog = await loadCatalog({ noRemote: process.argv.includes('--no-catalog'), fetchImpl: typeof fetch === 'function' ? fetch : undefined });
+      catalogMeta = { source: catalog.source, checks: catalog.checks.length };
+      const profileDir = (() => { try { return resolveProfile(profileArg); } catch { return null; } })();
+      if (catalog.checks.length && profileDir) checkCatalog({ home: HOME, profile: profileArg, profileDir }, catalog);
+      else if (catalog.checks.length) report('catalog', 'C0', true, `profile 无效（${profileArg}），目录检查跳过（${catalog.source}）`, undefined, 'catalog');
+    } catch (e) {
+      catalogMeta = { source: 'error', checks: 0, error: e.message.slice(0, 80) };
+    }
   }
 
-  // 层 B：版本检查与更新（--no-catalog 同时禁用网络检查；--update 手动更新；DSH_DOCTOR_AUTO_UPDATE=1 自动）
+  // 层 B：版本检查与更新（--no-catalog 同时禁用网络检查；--update 手动更新；DSH_DOCTOR_AUTO_UPDATE=1 自动；--security-only 跳过）
   const noRemote = process.argv.includes('--no-catalog');
   let updateInfo = { current: localVersion(), latest: null, available: false };
-  try {
-    updateInfo = await checkForUpdate({ noRemote, fetchImpl: typeof fetch === 'function' ? fetch : undefined });
-  } catch (e) {
-    updateInfo = { current: localVersion(), latest: null, available: false, error: e.message.slice(0, 60) };
+  if (!securityOnly) {
+    try {
+      updateInfo = await checkForUpdate({ noRemote, fetchImpl: typeof fetch === 'function' ? fetch : undefined });
+    } catch (e) {
+      updateInfo = { current: localVersion(), latest: null, available: false, error: e.message.slice(0, 60) };
+    }
+    if (process.argv.includes('--update') || (process.env.DSH_DOCTOR_AUTO_UPDATE === '1' && updateInfo.available)) {
+      updateInfo.applied = runUpdate();
+    }
   }
-  if (process.argv.includes('--update') || (process.env.DSH_DOCTOR_AUTO_UPDATE === '1' && updateInfo.available)) {
-    updateInfo.applied = runUpdate();
+
+  // 安全检查（--security）：导入 dsh-security 运行安全检查，合并到 results
+  // --security-only 隐含启用安全检查（复审修复：此前单独使用 = 静默空跑）
+  const securityEnabled = process.argv.includes('--security') || securityOnly;
+  let securityMeta = { enabled: false, summary: {} };
+  if (securityEnabled) {
+    try {
+      // 尝试从 profile node_modules 或全局安装导入 dsh-security；
+      // 开发调试可用 DSH_SECURITY_SRC 指向工作区源码（复审修复：移除硬编码个人路径）
+      let secMod;
+      const profileDir = (() => { try { return resolveProfile(profileArg); } catch { return null; } })();
+      const secCandidates = [
+        process.env.DSH_SECURITY_SRC,
+        profileDir ? join(profileDir, 'node_modules', '@moonquake2004', 'dsh-security', 'src', 'index.mjs') : null,
+        join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'node_modules', '@moonquake2004', 'dsh-security', 'src', 'index.mjs'),
+      ].filter(Boolean);
+      for (const candidate of secCandidates) {
+        if (existsSync(candidate)) { secMod = await import(candidate); break; }
+      }
+      if (secMod) {
+        const registry = await secMod.createDefaultRegistry();
+        // 注入 ~/.dsh/security.json 配置（旧版 dsh-security 无此能力时静默跳过）
+        try {
+          if (secMod.loadConfig && typeof registry.setConfig === 'function') {
+            registry.setConfig(secMod.loadConfig(HOME));
+          }
+        } catch { /* 配置损坏不影响检查 */ }
+        // 获取最新会话文件（供 SR*/SS* 检查使用）
+        // 复审修复：对齐 S11 的两层布局 sessions/<user>/<session>/session.jsonl[.zstd]，
+        // 按 mtime 取最新；旧实现只扫顶层 *.jsonl，真实部署下永远返回 null → 运行时层全跳过
+        const findLatestSession = () => {
+          if (sessionArg) return sessionArg;
+          try {
+            const root = join(HOME, 'sessions');
+            const candidates = [];
+            for (const u of readdirSync(root)) {
+              const sd = join(root, u);
+              let subs = [];
+              try { subs = readdirSync(sd); } catch { continue; }
+              for (const s of subs) {
+                const zstdPath = join(sd, s, 'session.jsonl.zstd');
+                const plainPath = join(sd, s, 'session.jsonl');
+                const f = existsSync(zstdPath) ? zstdPath : (existsSync(plainPath) ? plainPath : null);
+                if (!f) continue;
+                try { candidates.push({ f, m: statSync(f).mtimeMs }); } catch { /* race */ }
+              }
+              // 兼容直接放在用户目录下的散文件
+              const loose = join(sd, 'session.jsonl');
+              if (existsSync(loose)) { try { candidates.push({ f: loose, m: statSync(loose).mtimeMs }); } catch { /* race */ } }
+            }
+            candidates.sort((a, b) => b.m - a.m);
+            return candidates.length ? candidates[0].f : null;
+          } catch { return null; }
+        };
+
+        const { results: secResults, exitCode: secExit, summary: secSummary } = await registry.runAll(
+          (check) => {
+            // SR*/SS* 运行时会话检查用会话文件
+            if (check.id && (check.id.startsWith('SR') || check.id.startsWith('SS'))) {
+              return findLatestSession();
+            }
+            // 其余（SP*/SL*/EXT-*）用 profile 目录
+            return profileDir || profileArg;
+          }
+        );
+        for (const r of secResults) {
+          results.push({ section: 'security', id: r.id, ok: r.ok, detail: r.detail, fix: r.fix, severity: r.severity, skip: !!r.skipped });
+        }
+        securityMeta = { enabled: true, summary: secSummary, exitCode: secExit };
+      } else {
+        securityMeta = { enabled: true, error: 'dsh-security not found', summary: {} };
+      }
+    } catch (e) {
+      securityMeta = { enabled: true, error: e.message.slice(0, 80), summary: {} };
+    }
   }
 
   // 退出码只计内置失败 + catalog 中 severity=error 的失败；warn 失败提示但不改退出码
-  const bad = results.filter((r) => !r.ok && catalogSeverity.get(r.id) !== 'warn');
+  // 安全检查走独立通道：secExit 由 dsh-security 按 severity 计算（CRITICAL→2, HIGH→1, 其余 0），
+  // 不参与 bad[] 与信封 baseExit——复审修复：此前任何安全失败（哪怕 LOW 级关注点）都会把退出码抬到 1/2，
+  // 违反 dsh-security 契约「MEDIUM 及以下不影响退出码」与本函数上方注释的声明。
+  const bad = results.filter((r) => r.section !== 'security' && !r.ok && catalogSeverity.get(r.id) !== 'warn');
+  const secExit = securityMeta.exitCode ?? 0;
   if (jsonOut && process.argv.includes('--envelope')) {
     // v1 契约信封（dsh doctor 规格，zoahdev/doctor 对齐）：status 小写 + 退出码 0/1/2
-    const st = (r) => (r.skip ? 'skip' : (!r.ok ? (catalogSeverity.get(r.id) === 'warn' ? 'warn' : 'fail') : 'pass'));
+    const st = (r) => (r.skip ? 'skip' : (!r.ok ? (((r.section === 'security') ? r.severity !== 'critical' : catalogSeverity.get(r.id) === 'warn') ? 'warn' : 'fail') : 'pass'));
     const summary = { pass: 0, warn: 0, fail: 0, skip: 0 }; // skip 常驻（v1 词汇表 r5：#1719），r5 后 P12 会在未装 bundle 时实际触发
-    const checks = results.map((r) => { summary[st(r)]++; return { name: r.id, status: st(r), detail: r.detail }; });
-    const exitCode = summary.fail > 0 ? 2 : summary.warn > 0 ? 1 : 0;
-    console.log(JSON.stringify({
+    const checks = results.map((r) => { summary[st(r)]++; return { name: r.id, status: st(r), detail: r.detail, ...(r.severity ? { severity: r.severity } : {}), ...(r.section === 'security' ? { section: 'security' } : {}) }; });
+    // baseExit 只统计非安全项；安全项对退出码的贡献由 secExit 独立承载
+    let baseFail = 0; let baseWarn = 0;
+    for (const r of results) {
+      if (r.section === 'security') continue;
+      const s = st(r);
+      if (s === 'fail') baseFail++;
+      else if (s === 'warn') baseWarn++;
+    }
+    const baseExit = baseFail > 0 ? 2 : baseWarn > 0 ? 1 : 0;
+    const exitCode = Math.max(baseExit, secExit);
+    const out = {
       schema: 'dsh-doctor/v1',
       tool: 'dsh-doctor',
       generatedAt: new Date().toISOString(),
@@ -1309,19 +1406,26 @@ async function run() {
       summary,
       ok: exitCode === 0,
       checks,
-    }, null, 2));
+    };
+    if (securityMeta.enabled) {
+      out.security = { enabled: true, summary: securityMeta.summary, ...(securityMeta.error ? { error: securityMeta.error } : {}) };
+    }
+    console.log(JSON.stringify(out, null, 2));
     process.exit(exitCode);
   } else if (jsonOut) {
-    console.log(JSON.stringify({ ok: bad.length === 0, checks: results, catalog: catalogMeta, update: updateInfo }, null, 2));
+    console.log(JSON.stringify({ ok: bad.length === 0 && secExit === 0, checks: results, catalog: catalogMeta, update: updateInfo, ...(securityMeta.enabled ? { security: securityMeta } : {}) }, null, 2));
   } else {
     const sectionOrder = { env: 0, profile: 1, session: 2, catalog: 3 };
     const ordered = [...results].sort((a, b) => (sectionOrder[a.section] ?? 9) - (sectionOrder[b.section] ?? 9));
     let lastSection = '';
     for (const r of ordered) {
-      if (r.section !== lastSection) { console.log(`\n== ${r.section.toUpperCase()} ==`); lastSection = r.section; }
+      if (r.section !== lastSection) { console.log(`\n== ${r.section === 'security' ? '🔒 安全' : r.section.toUpperCase()} ==`); lastSection = r.section; }
       const sev = catalogSeverity.get(r.id);
-      const mark = !r.ok && sev === 'warn' ? '⚠' : (r.ok ? '✓' : '✗');
-      console.log(` ${mark} [${r.id}] ${r.detail}${r.src === 'catalog' ? '  [目录]' : ''}`);
+      // 安全检查：skip 显示 ⊖；critical/high 失败 ✗；medium 及以下失败 ⚠（不影响退出码）
+      const mark = r.skip ? '⊖'
+        : (!r.ok ? (((r.section === 'security' && r.severity !== 'critical' && r.severity !== 'high') || sev === 'warn') ? '⚠' : '✗')
+        : '✓');
+      console.log(` ${mark} [${r.id}]${r.severity ? `（${r.severity}${r.skip ? '/skip' : ''}）` : ''} ${r.detail}${r.src === 'catalog' ? '  [目录]' : ''}`);
       if (!r.ok && r.fix) console.log(`     ↳ 修复: ${r.fix}`);
     }
     if (updateInfo.available && !updateInfo.applied) {
@@ -1329,9 +1433,10 @@ async function run() {
     } else if (updateInfo.applied) {
       console.log(`\n✓ ${updateInfo.applied}`);
     }
-    console.log(`\n${bad.length === 0 ? '✓ 全部通过' : `✗ ${bad.length} 个问题`}（profile=${profileArg}，目录=${catalogMeta.source}，${catalogMeta.checks} 条）`);
+    console.log(`\n${(bad.length === 0 && secExit === 0) ? '✓ 全部通过' : `✗ ${bad.length} 个内置问题${secExit > 0 ? ` + 安全 ${secExit === 2 ? 'CRITICAL' : 'HIGH'} 级失败` : ''}`}（profile=${profileArg}，目录=${catalogMeta.source}，${catalogMeta.checks} 条）`);
   }
-  process.exit(bad.length === 0 ? 0 : 1);
+  // 最终退出码：内置失败 → 1；安全 HIGH → 1、CRITICAL → 2（取 max）
+  process.exit(Math.max(bad.length > 0 ? 1 : 0, secExit));
 }
 
 // 直接执行（CLI：根目录薄封装、plugin 本体、npm bin 均可）；被 import（测试/宿主）时不自动运行

package/lib/index.js

@@ -35,7 +35,7 @@ export function apply(ctx, config) {
  */
 function runChecks(profile, sessionPath) {
     return new Promise((resolvePromise) => {
-        const args = ['--json'];
+        const args = ['--json', '--security'];
         if (profile) args.push('--profile', profile);
         if (sessionPath) args.push('--session', sessionPath);
         const child = spawn(process.execPath, [SCRIPT, ...args], {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moonquake2004/dsh-doctor",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "Offline diagnostic for DeepSeek Harness — 28 built-in + 5 catalog checks across env/profile/session (Layer A checks-as-data), self-update (Layer B), and a semi-automatic LLM observer (Layer C, --observe); Doctor panel in web UI settings.",
   "main": "lib/index.js",
   "files": [