@moonquake2004/dsh-security 0.1.0 → 0.1.2

package/src/checks/sp4-entry-poison.mjs

@@ -15,6 +15,7 @@ import { join } from 'node:path';
 import { Severity } from '../protocol/severity.mjs';
 import { CheckPhase } from '../protocol/phase.mjs';
 import { pass, fail } from '../protocol/check.mjs';
+import { maxSeverity } from '../protocol/severity.mjs';
 
 /** 已知恶意 entry 模式 */
 const MALICIOUS_PATTERNS = [
@@ -68,7 +69,9 @@ export async function run(profileDir) {
   if (allFindings.length === 0) return pass(id, Severity.HIGH, `扫描 ${patchFiles.length} 个 patch 文件，未检测到恶意 entry 模式`);
 
   const details = allFindings.slice(0, 10).map(f => `[${f.severity}] ${f.type}: ${f.snippet}`).join('\n');
-  return fail(id, Severity.HIGH, `检测到 ${allFindings.length} 个可疑 entry 模式：\n${details}`, '检查相关插件的 cordis.patch.yml 内容');
+  // 复审修复：按实际命中的最高严重度定级，medium 级命中不再一律拔高成 HIGH
+  const overallSeverity = maxSeverity(allFindings.map(f => f.severity));
+  return fail(id, overallSeverity, `检测到 ${allFindings.length} 个可疑 entry 模式：\n${details}`, '检查相关插件的 cordis.patch.yml 内容', ['#2066']);
 }
 
 export const sp4Check = { id: 'SP4', name: 'entry-poison', severity: Severity.HIGH, phase: CheckPhase.POST_INSTALL, description: '恶意 entry 注入检测', src: 'builtin', runner: (d) => run(d) };

package/src/checks/sp5-permission-model.mjs

@@ -37,21 +37,39 @@ export async function run(profileDir) {
   const issues = [];
   for (const entry of readdirSync(nmDir, { withFileTypes: true })) {
     if (entry.name.startsWith('.') || entry.name === '.bin') continue;
-    const pkgPath = join(nmDir, entry.name, 'package.json');
-    if (!existsSync(pkgPath)) continue;
+    // scoped 包（@scope/pkg）：复审修复——此前把 @scope 当包名拼路径，scoped 插件全部漏扫
+    if (entry.isDirectory() && entry.name.startsWith('@')) {
+      const scopeDir = join(nmDir, entry.name);
+      let pkgs = [];
+      try { pkgs = readdirSync(scopeDir, { withFileTypes: true }); } catch { continue; }
+      for (const pkg of pkgs) {
+        if (!pkg.isDirectory()) continue;
+        issues.push(...inspectPackage(join(scopeDir, pkg.name), join(entry.name, pkg.name)));
+      }
+      continue;
+    }
+    if (!entry.isDirectory()) continue;
+    issues.push(...inspectPackage(join(nmDir, entry.name), entry.name));
+  }
+
+  function inspectPackage(pkgDir, displayName) {
+    const found = [];
+    const pkgPath = join(pkgDir, 'package.json');
+    if (!existsSync(pkgPath)) return found;
     try {
       const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
-      if (!pkg.dsh?.bundle) continue;
-      const patchPath = join(nmDir, entry.name, 'cordis.patch.yml');
+      if (!pkg.dsh?.bundle) return found;
+      const patchPath = join(pkgDir, 'cordis.patch.yml');
       if (existsSync(patchPath)) {
         const content = readFileSync(patchPath, 'utf8');
-        issues.push(...scanForUndeclaredCapabilities(content, pkg.name));
+        found.push(...scanForUndeclaredCapabilities(content, pkg.name || displayName));
       }
     } catch { /* skip */ }
+    return found;
   }
 
   if (issues.length === 0) return pass(id, Severity.MEDIUM, '插件权限声明一致');
-  const details = issues.slice(0, 10).map(i => `[${i.severity}] ${i.detail}`).join('\n');
+  const details = issues.slice(0, 10).map(i => `[${i.severity}] ${i.type}: ${i.detail}`).join('\n');
   return fail(id, Severity.MEDIUM, `检测到 ${issues.length} 个权限声明问题：\n${details}`, '为插件显式声明所需的权限范围');
 }
 

package/src/checks/sp6-vuln-match.mjs

@@ -3,8 +3,8 @@
  *
  * 通过 OSV API 查询已知漏洞（CVE/GHSA）：
  * - 查询 npm 包的已知漏洞
- * - 过滤 critical/high 级别
- * - 输出受影响的包和修复版本
+ * - 按 OSV 严重级别映射整体结果严重度，detail 标注 critical/high 数量
+ * - 输出受影响的包与漏洞编号（references）
  *
  * Severity: HIGH
  * Phase: POST_INSTALL
@@ -14,8 +14,12 @@ import { readFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { Severity, maxSeverity } from '../protocol/severity.mjs';
 import { CheckPhase } from '../protocol/phase.mjs';
-import { pass, fail } from '../protocol/check.mjs';
+import { pass, fail, skip } from '../protocol/check.mjs';
 
+/**
+ * 查询 OSV API。
+ * @returns {Promise<Array|null>} 成功返回漏洞数组（可能为空）；网络失败返回 null
+ */
 async function queryOSV(packageName, version) {
   try {
     const response = await fetch('https://api.osv.dev/v1/query', {
@@ -24,15 +28,22 @@ async function queryOSV(packageName, version) {
       body: JSON.stringify({ package: { name: packageName, ecosystem: 'npm' }, version }),
       signal: AbortSignal.timeout(10000),
     });
-    if (!response.ok) return [];
+    if (!response.ok) return null;
     const data = await response.json();
     return (data.vulns || []).map(v => ({
       id: v.id,
       summary: v.summary || v.details?.slice(0, 100) || 'No summary',
       severity: v.database_specific?.severity || v.severity?.[0]?.score || 'unknown',
-      fixed: v.fix_versions?.[0] || 'unknown',
     }));
-  } catch { return []; }
+  } catch { return null; }
+}
+
+function osvSeverityToLevel(sev) {
+  const s = String(sev).toUpperCase();
+  if (s.includes('CRITICAL')) return Severity.CRITICAL;
+  if (s.includes('HIGH')) return Severity.HIGH;
+  if (s.includes('MODERATE') || s.includes('MEDIUM')) return Severity.MEDIUM;
+  return Severity.LOW;
 }
 
 export async function run(profileDir) {
@@ -48,19 +59,37 @@ export async function run(profileDir) {
   if (dshPackages.length === 0) return pass(id, Severity.HIGH, '无 dsh 相关依赖，跳过漏洞匹配');
 
   const allVulns = [];
+  const refs = new Set();
+  let okQueries = 0;
+  let failedQueries = 0;
   for (const [name, version] of dshPackages.slice(0, 10)) {
+    // 只去掉首个范围前缀字符；workspace:/catalog:/file: 等协议版本无法映射，原样传给 OSV（查询无结果）
     const cleanVersion = version.replace(/^[~^>=<]/, '');
     const vulns = await queryOSV(name, cleanVersion);
+    if (vulns === null) { failedQueries++; continue; }
+    okQueries++;
     allVulns.push(...vulns.map(v => ({ package: name, ...v })));
+    for (const v of vulns) if (v.id) refs.add(v.id);
+  }
+
+  // 全部查询失败 → skip（离线时不应谎报"未发现已知漏洞"）
+  if (okQueries === 0 && failedQueries > 0) {
+    return skip(id, Severity.HIGH, `OSV API 不可达（${failedQueries} 个包全部查询失败），跳过已知漏洞匹配`);
+  }
+
+  if (allVulns.length === 0) {
+    const note = failedQueries > 0 ? `（${failedQueries} 个包查询失败未覆盖）` : '';
+    return pass(id, Severity.HIGH, `成功查询 ${okQueries}/${dshPackages.length} 个包，未发现已知漏洞${note}`);
   }
 
-  if (allVulns.length === 0) return pass(id, Severity.HIGH, `查询 ${dshPackages.length} 个包，未发现已知漏洞`);
+  const details = allVulns.slice(0, 10).map(v => `${v.package} — ${v.id}: ${v.summary}（severity: ${v.severity}）`).join('\n');
+  const overallSeverity = maxSeverity(allVulns.map(v => osvSeverityToLevel(v.severity)));
+  const criticalHigh = allVulns.filter(v => ['critical', 'high'].includes(osvSeverityToLevel(v.severity))).length;
 
-  const details = allVulns.slice(0, 10).map(v => `${v.package} — ${v.id}: ${v.summary}（fixed: ${v.fixed}）`).join('\n');
-  const fixable = allVulns.filter(v => v.fixed !== 'unknown').length;
-  return fail(id, Severity.HIGH,
-    `检测到 ${allVulns.length} 个已知漏洞（${fixable} 个可修复）：\n${details}`,
-    fixable > 0 ? '升级受影响的包到修复版本' : '关注上游修复进展'
+  return fail(id, overallSeverity,
+    `检测到 ${allVulns.length} 个已知漏洞（critical/high ${criticalHigh} 个）：\n${details}`,
+    '按 OSV 建议升级受影响的包到修复版本',
+    [...refs].slice(0, 5)
   );
 }
 

package/src/checks/sp7-client-syntax.mjs

@@ -0,0 +1,150 @@
+/**
+ * SP7: Client Bundle Syntax — 插件 client 产物语法预检
+ *
+ * 出处：deepseek-ai/deepseek-harness discussion #2752 补充案例——插件 client.js
+ * 注释未闭合（语法级错误）→ 浏览器端 ReferenceError → Web UI 整页白屏，
+ * 服务端 HTTP 200 且日志零感知。P13 只提取 ctx.provide() 服务名，不做语法解析，
+ * 这类错误此前完全逃逸离线检查。
+ *
+ * 做法：对每个已装 DSH 插件包（package.json 含 dsh 字段）的 client 入口产物
+ * （<pkg>/client/*.js|mjs、<pkg>/lib/client.js、<pkg>/client.js）执行
+ * `node --check`（Node ≥22 自动探测 ESM/CJS，无需区分模块格式）。
+ * 解析失败 = boot 前即可断定的必白屏项 → HIGH。
+ *
+ * Severity: HIGH
+ * Phase: POST_INSTALL
+ */
+
+import { readFileSync, readdirSync, existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import { tmpdir } from 'node:os';
+import { execFileSync } from 'node:child_process';
+import { Severity } from '../protocol/severity.mjs';
+import { CheckPhase } from '../protocol/phase.mjs';
+import { pass, fail } from '../protocol/check.mjs';
+
+const CLIENT_EXTENSIONS = ['.js', '.mjs', '.cjs'];
+const MAX_FILES_PER_PKG = 10;
+const MAX_PKGS = 60;        // 上限只约束"识别为 DSH 插件"的包（普通依赖不占额）
+const MAX_TOTAL_FILES = 200; // 全局文件数保险，防病态安装
+
+/** 收集一个插件包内的 client 候选产物 */
+function collectClientFiles(pkgDir) {
+  const files = [];
+  const pushIfClient = (p) => {
+    if (files.length >= MAX_FILES_PER_PKG) return;
+    if (existsSync(p) && CLIENT_EXTENSIONS.some(ext => p.endsWith(ext))) files.push(p);
+  };
+  // 形态 A：<pkg>/client/ 目录（真实布局：dsh-doctor、dshmarket 等）
+  const clientDir = join(pkgDir, 'client');
+  if (existsSync(clientDir)) {
+    try {
+      for (const e of readdirSync(clientDir, { withFileTypes: true })) {
+        if (e.isFile()) pushIfClient(join(clientDir, e.name));
+      }
+    } catch { /* unreadable dir */ }
+  }
+  // 形态 B：lib/client.js（真实布局：dsh-better-sidebar、dsh-persist、@xmanrui/dsh-im 等）
+  pushIfClient(join(pkgDir, 'lib', 'client.js'));
+  // 形态 C：根级 client.js
+  pushIfClient(join(pkgDir, 'client.js'));
+  return files;
+}
+
+/**
+ * 对单个文件做语法校验。
+ * @returns {{ok: true} | {ok: false, message: string}}
+ */
+function syntaxCheck(file) {
+  try {
+    execFileSync(process.execPath, ['--check', file], { timeout: 10000, stdio: ['ignore', 'pipe', 'pipe'], encoding: 'utf8' });
+    return { ok: true };
+  } catch (e) {
+    const errText = String(e.stderr || e.message || '');
+    // 提取最有信息量的一行：SyntaxError/ReferenceError/... 及其位置
+    const diagLine = errText.split('\n').find(l => /^(SyntaxError|ReferenceError|TypeError|RangeError|Error)\b/.test(l.trim()));
+    const posLine = errText.split('\n').find(l => l.startsWith(file));
+    const message = [posLine ? relativeProcess(posLine) : null, diagLine ? diagLine.trim().slice(0, 160) : null]
+      .filter(Boolean).join(' — ') || `node --check 失败（exit ${e.status ?? '?'}, ${errText.slice(0, 80)}）`;
+    return { ok: false, message };
+  }
+}
+
+function relativeProcess(posLine) {
+  return posLine.replace(/^.*\/node_modules\//, '').slice(0, 120);
+}
+
+/** 纯文本版语法校验（供测试与无子进程环境复用）：写入临时 .mjs 不需要——直接用文件路径 */
+export async function run(profileDir) {
+  const id = 'SP7';
+  const nmDir = join(profileDir, 'node_modules');
+  if (!existsSync(nmDir)) return pass(id, Severity.HIGH, '无 node_modules，跳过 client 产物语法预检');
+
+  // 枚举已装 DSH 插件包（含 scoped；以 package.json 的 dsh 字段为门控）
+  const pkgs = [];
+  let entries = [];
+  try { entries = readdirSync(nmDir, { withFileTypes: true }); } catch { entries = []; }
+  for (const entry of entries) {
+    if (!entry.isDirectory() || entry.name.startsWith('.') || entry.name === '.bin') continue;
+    if (entry.name.startsWith('@')) {
+      let subs = [];
+      try { subs = readdirSync(join(nmDir, entry.name), { withFileTypes: true }); } catch { continue; }
+      for (const sub of subs) {
+        if (sub.isDirectory()) pkgs.push(join(nmDir, entry.name, sub.name));
+      }
+    } else {
+      pkgs.push(join(nmDir, entry.name));
+    }
+  }
+
+  const findings = [];
+  let scannedFiles = 0;
+  let scannedPkgs = 0;
+
+  for (const pkgDir of pkgs) {
+    const pkgJsonPath = join(pkgDir, 'package.json');
+    if (!existsSync(pkgJsonPath)) continue;
+    try {
+      const pkg = JSON.parse(readFileSync(pkgJsonPath, 'utf8'));
+      if (!pkg.dsh) continue; // 只查 DSH 插件包，避免误扫 hono/undici 等普通依赖
+    } catch { continue; }
+    if (scannedPkgs >= MAX_PKGS) break;
+    scannedPkgs++;
+
+    for (const file of collectClientFiles(pkgDir)) {
+      if (scannedFiles >= MAX_TOTAL_FILES) break;
+      scannedFiles++;
+      const result = syntaxCheck(file);
+      if (!result.ok) {
+        findings.push({
+          file: relative(profileDir, file),
+          message: result.message,
+        });
+      }
+    }
+  }
+
+  if (scannedPkgs === 0) return pass(id, Severity.HIGH, '未发现 DSH 插件包，跳过 client 产物语法预检');
+  if (scannedFiles === 0) return pass(id, Severity.HIGH, `扫描 ${scannedPkgs} 个插件包，未发现 client 产物，跳过语法预检`);
+
+  if (findings.length === 0) {
+    return pass(id, Severity.HIGH, `语法预检通过：${scannedPkgs} 个插件包 / ${scannedFiles} 个 client 产物均可正常解析`);
+  }
+
+  const details = findings.slice(0, 10).map(f => `${f.file}\n    ${f.message}`).join('\n');
+  return fail(id, Severity.HIGH,
+    `检测到 ${findings.length} 个 client 产物语法错误（boot 后将整页白屏）：\n${details}`,
+    '修复对应插件的 client 代码语法错误，或暂时移除该插件；此类错误在浏览器端表现为 Failed to load plugins 白屏且服务端日志无感知',
+    ['#2752']
+  );
+}
+
+export const sp7Check = {
+  id: 'SP7',
+  name: 'client-syntax',
+  severity: Severity.HIGH,
+  phase: CheckPhase.POST_INSTALL,
+  description: '插件 client 产物语法预检（node --check，boot 前拦截白屏源）',
+  src: 'builtin',
+  runner: (profileDir) => run(profileDir),
+};

package/src/checks/sr1-sandbox-violation.mjs

@@ -1,20 +1,22 @@
 /**
  * SR1: Sandbox Violation — 沙箱逃逸检测
  *
- * 分析会话日志中的工具调用，检测潜在的沙箱逃逸行为：
- * - 写操作超出 workspace 范围
- * - 访问系统级资源（/etc, /proc, 环境变量）
+ * 分析会话日志中的工具调用（tool/call），检测潜在的沙箱逃逸行为：
+ * - 访问系统级资源（/etc, /proc）
  * - 已知逃逸模式匹配（#1769 mount remount 等）
+ * - 管道执行远程脚本
+ *
+ * 支持明文与 zstd 压缩会话日志（session-reader）。
  *
  * Severity: CRITICAL
  * Phase: RUNTIME
  */
 
-import { readFileSync, existsSync, createReadStream } from 'node:fs';
-import { createInterface } from 'node:readline';
+import { existsSync } from 'node:fs';
 import { Severity } from '../protocol/severity.mjs';
 import { CheckPhase } from '../protocol/phase.mjs';
-import { pass, fail } from '../protocol/check.mjs';
+import { pass, fail, skip } from '../protocol/check.mjs';
+import { scanSessionLines } from '../session-reader.mjs';
 
 /** 已知逃逸模式（#1769 及同类） */
 const ESCAPE_PATTERNS = [
@@ -28,7 +30,8 @@ const ESCAPE_PATTERNS = [
 const SYSTEM_RESOURCE_PATTERNS = [
   { name: '/etc access', regex: /\/etc\/(passwd|shadow|sudoers|hosts)/gi, severity: 'high' },
   { name: '/proc access', regex: /\/proc\/(self|1|environ|cmdline)/gi, severity: 'high' },
-  { name: 'env dump', regex: /env\b|printenv|set\b.*\|/gi, severity: 'medium' },
+  // 复审修复：旧正则 /env\b|set\b.*\|/ 几乎命中一切文本；改为命令位置的 env/printenv 转储
+  { name: 'env dump', regex: /(?:^|["'|;&]\s*)(?:printenv|env)\s*(?:[|;"']|$)/gm, severity: 'medium' },
   { name: 'sudo usage', regex: /sudo\s+/gi, severity: 'high' },
   { name: 'curl/wget to unknown', regex: /curl\s+.*\|\s*(bash|sh|node)|wget\s+.*\|\s*(bash|sh|node)/gi, severity: 'critical' },
 ];
@@ -38,31 +41,30 @@ const WORKSPACE_ESCAPE_PATTERNS = [
   { name: 'write to /tmp', regex: /writeFileSync|writeFile|fs\.write|echo\s+.*>\s*\/tmp/gi, severity: 'low' },
   { name: 'write to home', regex: /writeFileSync|writeFile.*\/Users\/|\/home\//gi, severity: 'low' },
   { name: 'pipe to shell', regex: /\|\s*(bash|sh|zsh)\b/gi, severity: 'high' },
-  { name: 'exec subprocess', regex: /child_process|execSync|spawnSync|exec\b/gi, severity: 'medium' },
+  // 复审修复：去掉过宽的 exec\b（命中 "execute" 等普通词），保留具体进程 API
+  { name: 'exec subprocess', regex: /child_process|execSync|spawnSync/gi, severity: 'medium' },
 ];
 
 /**
- * 从一行 JSONL 中提取工具调用信息
+ * 从一行 JSONL 中提取工具调用信息（只看 tool/call：result 是数据不是行为）
  */
 function extractToolCalls(line) {
   try {
     const event = JSON.parse(line);
-    if (event.type !== 'tool/call' && event.type !== 'tool/result') return [];
+    if (event.type !== 'tool/call') return [];
 
-    const calls = [];
     const data = event.data || {};
     const name = data.name || data.tool || '';
     const args = data.args || data.input || {};
     const text = typeof args === 'string' ? args : JSON.stringify(args);
 
-    calls.push({
+    return [{
       type: event.type,
       name,
       text,
       seq: event.seq,
       turn: event.turn,
-    });
-    return calls;
+    }];
   } catch {
     return [];
   }
@@ -74,7 +76,8 @@ function extractToolCalls(line) {
 function scanPatterns(text, patterns) {
   const findings = [];
   for (const pattern of patterns) {
-    const matches = text.matchAll(new RegExp(pattern.regex.source, 'gi'));
+    const flags = [...new Set((pattern.regex.flags + 'g').split(''))].join('');
+    const matches = text.matchAll(new RegExp(pattern.regex.source, flags));
     for (const match of matches) {
       findings.push({
         type: pattern.name,
@@ -89,7 +92,7 @@ function scanPatterns(text, patterns) {
 
 /**
  * SR1 检查：分析会话日志中的沙箱逃逸行为
- * @param {string} sessionFile - 会话日志文件路径
+ * @param {string} sessionFile - 会话日志文件路径（.jsonl 或 .jsonl.zstd）
  * @returns {Promise<import('../protocol/check.mjs').SecurityCheckResult>}
  */
 export async function run(sessionFile) {
@@ -99,35 +102,26 @@ export async function run(sessionFile) {
     return pass(id, Severity.CRITICAL, '无会话日志，跳过运行时安全检查');
   }
 
-  if (sessionFile.endsWith('.zstd')) {
-    return pass(id, Severity.CRITICAL, 'zstd 压缩的会话文件需先解压再检查');
-  }
-
   const findings = [];
   let lineCount = 0;
 
-  const fileStream = createReadStream(sessionFile, { encoding: 'utf8' });
-  const rl = createInterface({ input: fileStream, crlfDelay: Infinity });
-
-  for await (const line of rl) {
-    lineCount++;
-    if (!line.trim()) continue;
-
-    const calls = extractToolCalls(line);
-    for (const call of calls) {
-      // 扫描工具参数中的危险模式
-      const allPatterns = [...ESCAPE_PATTERNS, ...SYSTEM_RESOURCE_PATTERNS, ...WORKSPACE_ESCAPE_PATTERNS];
-      const textFindings = scanPatterns(call.text, allPatterns);
-      for (const f of textFindings) {
-        findings.push({
-          ...f,
-          line: lineCount,
-          tool: call.name,
-          seq: call.seq,
-          turn: call.turn,
-        });
+  try {
+    lineCount = await scanSessionLines(sessionFile, (line, lineNo) => {
+      if (!line.trim()) return;
+      const calls = extractToolCalls(line);
+      for (const call of calls) {
+        const allPatterns = [...ESCAPE_PATTERNS, ...SYSTEM_RESOURCE_PATTERNS, ...WORKSPACE_ESCAPE_PATTERNS];
+        const textFindings = scanPatterns(call.text, allPatterns);
+        for (const f of textFindings) {
+          findings.push({ ...f, line: lineNo, tool: call.name, seq: call.seq, turn: call.turn });
+        }
       }
+    });
+  } catch (e) {
+    if (e.code === 'ZSTD_UNAVAILABLE') {
+      return skip(id, Severity.CRITICAL, 'zstd 命令不可用，无法解压压缩会话日志，跳过沙箱逃逸检测');
     }
+    throw e;
   }
 
   if (findings.length === 0) {
@@ -171,7 +165,7 @@ export const sr1Check = {
   name: 'sandbox-violation',
   severity: Severity.CRITICAL,
   phase: CheckPhase.RUNTIME,
-  description: '沙箱逃逸行为检测（会话日志分析）',
+  description: '沙箱逃逸行为检测（会话日志分析，支持 zstd）',
   src: 'builtin',
   runner: (sessionFile) => run(sessionFile),
 };

package/src/checks/sr2-privilege-escalation.mjs

@@ -1,23 +1,26 @@
 /**
  * SR2: Privilege Escalation — 权限提升检测
  *
- * 分析会话日志中的权限提升行为：
+ * 分析会话日志中的工具调用（tool/call）中的权限提升行为：
  * - sudo/doas 使用
  * - 文件权限变更（chmod/chown）
- * - 特权端口绑定
+ * - setuid/setgid、Linux capability 操作
+ *
+ * 支持明文与 zstd 压缩会话日志（session-reader）。
  *
  * Severity: HIGH
  * Phase: RUNTIME
  */
 
-import { existsSync, createReadStream } from 'node:fs';
-import { createInterface } from 'node:readline';
+import { existsSync } from 'node:fs';
 import { Severity } from '../protocol/severity.mjs';
 import { CheckPhase } from '../protocol/phase.mjs';
-import { pass, fail } from '../protocol/check.mjs';
+import { pass, fail, skip } from '../protocol/check.mjs';
+import { scanSessionLines } from '../session-reader.mjs';
 
 const PRIVILEGE_PATTERNS = [
   { name: 'sudo usage', regex: /sudo\s+/gi, severity: 'high' },
+  { name: 'doas usage', regex: /\bdoas\s+/gi, severity: 'high' },
   { name: 'chmod', regex: /chmod\s+[^/]*\s+[0-7]*7[0-7][0-7]/gi, severity: 'medium' },
   { name: 'chown', regex: /chown\s+/gi, severity: 'medium' },
   { name: 'setuid', regex: /setuid|setgid/gi, severity: 'high' },
@@ -36,22 +39,26 @@ function extractToolCalls(line) {
 export async function run(sessionFile) {
   const id = 'SR2';
   if (!sessionFile || !existsSync(sessionFile)) return pass(id, Severity.HIGH, '无会话文件，跳过权限提升检测');
-  if (sessionFile.endsWith('.zstd')) return pass(id, Severity.HIGH, 'zstd 文件需先解压');
 
   const findings = [];
   let lineCount = 0;
-  const rl = createInterface({ input: createReadStream(sessionFile, { encoding: 'utf8' }), crlfDelay: Infinity });
 
-  for await (const line of rl) {
-    lineCount++;
-    if (!line.trim()) continue;
-    for (const call of extractToolCalls(line)) {
-      for (const pattern of PRIVILEGE_PATTERNS) {
-        for (const match of call.text.matchAll(new RegExp(pattern.regex.source, 'gi'))) {
-          findings.push({ type: pattern.name, severity: pattern.severity, line: lineCount, tool: call.name, snippet: match[0].slice(0, 40) });
+  try {
+    lineCount = await scanSessionLines(sessionFile, (line, lineNo) => {
+      if (!line.trim()) return;
+      for (const call of extractToolCalls(line)) {
+        for (const pattern of PRIVILEGE_PATTERNS) {
+          for (const match of call.text.matchAll(new RegExp(pattern.regex.source, 'gi'))) {
+            findings.push({ type: pattern.name, severity: pattern.severity, line: lineNo, tool: call.name, snippet: match[0].slice(0, 40) });
+          }
         }
       }
+    });
+  } catch (e) {
+    if (e.code === 'ZSTD_UNAVAILABLE') {
+      return skip(id, Severity.HIGH, 'zstd 命令不可用，无法解压压缩会话日志，跳过权限提升检测');
     }
+    throw e;
   }
 
   if (findings.length === 0) return pass(id, Severity.HIGH, `扫描 ${lineCount} 行，未检测到权限提升行为`);
@@ -64,4 +71,4 @@ export async function run(sessionFile) {
   );
 }
 
-export const sr2Check = { id: 'SR2', name: 'privilege-escalation', severity: Severity.HIGH, phase: CheckPhase.RUNTIME, description: '权限提升行为检测', src: 'builtin', runner: (f) => run(f) };
+export const sr2Check = { id: 'SR2', name: 'privilege-escalation', severity: Severity.HIGH, phase: CheckPhase.RUNTIME, description: '权限提升行为检测（支持 zstd）', src: 'builtin', runner: (f) => run(f) };