@moonquake2004/dsh-security 0.1.0 → 0.1.2

package/src/checks/sr3-data-exfiltration.mjs

@@ -1,20 +1,21 @@
 /**
  * SR3: Data Exfiltration — 数据外泄检测
  *
- * 分析会话日志中的工具调用，检测潜在的数据外泄行为：
- * - 大量文件读取后接网络请求
- * - 凭据转发（将密钥传递给外部工具）
- * - 异常的数据流模式
+ * 分析会话日志中的工具调用与结果，检测潜在的数据外泄行为：
+ * - 凭据转发（API key / token / Bearer 出现在命令或返回内容中）
+ * - 网络外发模式（curl POST、fetch 等）
+ *
+ * 支持明文与 zstd 压缩会话日志（session-reader）。
  *
  * Severity: HIGH
  * Phase: RUNTIME
  */
 
-import { existsSync, createReadStream } from 'node:fs';
-import { createInterface } from 'node:readline';
+import { existsSync } from 'node:fs';
 import { Severity } from '../protocol/severity.mjs';
 import { CheckPhase } from '../protocol/phase.mjs';
-import { pass, fail } from '../protocol/check.mjs';
+import { pass, fail, skip } from '../protocol/check.mjs';
+import { scanSessionLines } from '../session-reader.mjs';
 
 /** 凭据转发模式 */
 const CREDENTIAL_FORWARD_PATTERNS = [
@@ -31,36 +32,25 @@ const NETWORK_EXFIL_PATTERNS = [
   { name: 'HTTP request with data', regex: /http\.request|https\.request|axios\.post/gi, severity: 'low' },
 ];
 
-/** 大量数据读取模式 */
-const BULK_READ_PATTERNS = [
-  { name: 'read entire file', regex: /readFileSync|readFile\b|cat\s+[^|]+$/gm, severity: 'low' },
-  { name: 'directory listing', regex: /readdirSync|readdir\b|ls\s+-[la]*/gi, severity: 'low' },
-];
-
 /**
- * 从一行 JSONL 中提取工具调用信息
+ * 从一行 JSONL 中提取文本信息（call 与 result 都扫：凭据出现在返回内容中同样是泄露）
  */
 function extractToolCalls(line) {
   try {
     const event = JSON.parse(line);
     if (event.type !== 'tool/call' && event.type !== 'tool/result') return [];
 
-    const calls = [];
     const data = event.data || {};
     const name = data.name || data.tool || '';
-    const args = data.args || data.input || {};
+    const args = data.args || data.input || data.output || data.result || data.text || {};
     const text = typeof args === 'string' ? args : JSON.stringify(args);
 
-    calls.push({ type: event.type, name, text, seq: event.seq, turn: event.turn });
-    return calls;
+    return [{ type: event.type, name, text, seq: event.seq, turn: event.turn }];
   } catch {
     return [];
   }
 }
 
-/**
- * 扫描文本中的危险模式
- */
 function scanPatterns(text, patterns) {
   const findings = [];
   for (const pattern of patterns) {
@@ -76,11 +66,6 @@ function scanPatterns(text, patterns) {
   return findings;
 }
 
-/**
- * SR3 检查：分析会话日志中的数据外泄行为
- * @param {string} sessionFile - 会话日志文件路径
- * @returns {Promise<import('../protocol/check.mjs').SecurityCheckResult>}
- */
 export async function run(sessionFile) {
   const id = 'SR3';
 
@@ -88,34 +73,26 @@ export async function run(sessionFile) {
     return pass(id, Severity.HIGH, '无会话日志，跳过数据外泄检查');
   }
 
-  if (sessionFile.endsWith('.zstd')) {
-    return pass(id, Severity.HIGH, 'zstd 压缩的会话文件需先解压再检查');
-  }
-
   const findings = [];
   let lineCount = 0;
 
-  const fileStream = createReadStream(sessionFile, { encoding: 'utf8' });
-  const rl = createInterface({ input: fileStream, crlfDelay: Infinity });
-
-  for await (const line of rl) {
-    lineCount++;
-    if (!line.trim()) continue;
-
-    const calls = extractToolCalls(line);
-    for (const call of calls) {
-      // 扫描凭据转发
-      const credFindings = scanPatterns(call.text, CREDENTIAL_FORWARD_PATTERNS);
-      for (const f of credFindings) {
-        findings.push({ ...f, line: lineCount, tool: call.name, category: 'credential-forward' });
-      }
-
-      // 扫描网络外发
-      const netFindings = scanPatterns(call.text, NETWORK_EXFIL_PATTERNS);
-      for (const f of netFindings) {
-        findings.push({ ...f, line: lineCount, tool: call.name, category: 'network-exfil' });
+  try {
+    lineCount = await scanSessionLines(sessionFile, (line, lineNo) => {
+      if (!line.trim()) return;
+      for (const call of extractToolCalls(line)) {
+        for (const f of scanPatterns(call.text, CREDENTIAL_FORWARD_PATTERNS)) {
+          findings.push({ ...f, line: lineNo, tool: call.name, category: 'credential-forward' });
+        }
+        for (const f of scanPatterns(call.text, NETWORK_EXFIL_PATTERNS)) {
+          findings.push({ ...f, line: lineNo, tool: call.name, category: 'network-exfil' });
+        }
       }
+    });
+  } catch (e) {
+    if (e.code === 'ZSTD_UNAVAILABLE') {
+      return skip(id, Severity.HIGH, 'zstd 命令不可用，无法解压压缩会话日志，跳过数据外泄检查');
     }
+    throw e;
   }
 
   if (findings.length === 0) {
@@ -157,7 +134,7 @@ export const sr3Check = {
   name: 'data-exfiltration',
   severity: Severity.HIGH,
   phase: CheckPhase.RUNTIME,
-  description: '数据外泄行为检测（会话日志分析）',
+  description: '数据外泄行为检测（会话日志分析，支持 zstd）',
   src: 'builtin',
   runner: (sessionFile) => run(sessionFile),
 };

package/src/checks/sr4-isolation-verify.mjs

@@ -9,11 +9,11 @@
  * Phase: RUNTIME
  */
 
-import { existsSync, createReadStream } from 'node:fs';
-import { createInterface } from 'node:readline';
+import { existsSync } from 'node:fs';
 import { Severity } from '../protocol/severity.mjs';
 import { CheckPhase } from '../protocol/phase.mjs';
-import { pass, fail } from '../protocol/check.mjs';
+import { pass, fail, skip } from '../protocol/check.mjs';
+import { scanSessionLines } from '../session-reader.mjs';
 
 function extractToolCalls(line) {
   try {
@@ -27,19 +27,24 @@ function extractToolCalls(line) {
 export async function run(sessionFile) {
   const id = 'SR4';
   if (!sessionFile || !existsSync(sessionFile)) return pass(id, Severity.MEDIUM, '无会话文件，跳过隔离验证');
-  if (sessionFile.endsWith('.zstd')) return pass(id, Severity.MEDIUM, 'zstd 文件需先解压');
 
   const toolCalls = [];
   let lineCount = 0;
-  const rl = createInterface({ input: createReadStream(sessionFile, { encoding: 'utf8' }), crlfDelay: Infinity });
 
-  for await (const line of rl) {
-    lineCount++;
-    if (!line.trim()) continue;
-    toolCalls.push(...extractToolCalls(line));
+  try {
+    lineCount = await scanSessionLines(sessionFile, (line) => {
+      if (!line.trim()) return;
+      toolCalls.push(...extractToolCalls(line));
+    });
+  } catch (e) {
+    if (e.code === 'ZSTD_UNAVAILABLE') {
+      return skip(id, Severity.MEDIUM, 'zstd 命令不可用，无法解压压缩会话日志，跳过隔离验证');
+    }
+    throw e;
   }
 
   // 简单的隔离检查：检测同一 turn 内不同工具的数据传递
+  // 复审修复：正常工作流一个 turn 用 4-5 个工具很常见，阈值 3→6 降低误报
   const findings = [];
   const byTurn = {};
   for (const call of toolCalls) {
@@ -49,13 +54,13 @@ export async function run(sessionFile) {
   }
 
   for (const [turn, calls] of Object.entries(byTurn)) {
-    const tools = new Set(calls.map(c => c.name));
-    if (tools.size > 3) {
-      findings.push({ type: 'multi-tool-turn', severity: 'low', detail: `turn ${turn} 使用了 ${tools.size} 个不同工具：${[...tools].join(', ')}` });
+    const tools = [...new Set(calls.map(c => c.name).filter(Boolean))];
+    if (tools.size > 6) {
+      findings.push({ type: 'multi-tool-turn', severity: 'low', detail: `turn ${turn} 使用了 ${tools.size} 个不同工具：${tools.slice(0, 8).join(', ')}` });
     }
   }
 
-  if (findings.length === 0) return pass(id, Severity.MEDIUM, `分析 ${toolCalls.length} 个工具调用，未检测到隔离问题`);
+  if (findings.length === 0) return pass(id, Severity.MEDIUM, `分析 ${toolCalls.length} 个工具调用（${lineCount} 行），未检测到隔离问题`);
 
   const details = findings.slice(0, 10).map(f => `[${f.severity}] ${f.detail}`).join('\n');
   return fail(id, Severity.MEDIUM, `检测到 ${findings.length} 个潜在隔离问题：\n${details}`, '检查工具间的数据流是否在预期范围内');

package/src/checks/ss1-credential-leak.mjs

@@ -1,19 +1,21 @@
 /**
  * SS1: Credential Leak — 会话日志凭据泄露检测
  *
- * 扫描 session.jsonl 中的敏感凭据（API key/token/私钥）。
- * 检查是否已通过 dsh-redact 脱敏。
+ * 扫描 session.jsonl（或 .zstd 压缩）中的敏感凭据（API key/token/私钥）。
+ *
+ * 复审修复：
+ * - snippet 不再回显凭据本体（旧实现输出前 20+后 4 字符，检测器自己泄露凭据）
+ * - 移除"前几行含 [REDACTED]/*** 即整体跳过"的弱启发（一行 markdown 分隔线就能让整个文件免检）
  *
  * Severity: CRITICAL
  * Phase: POST_INSTALL
  */
 
-import { readFileSync, existsSync } from 'node:fs';
-import { createReadStream } from 'node:fs';
-import { createInterface } from 'node:readline';
+import { existsSync } from 'node:fs';
 import { Severity } from '../protocol/severity.mjs';
 import { CheckPhase } from '../protocol/phase.mjs';
-import { pass, fail } from '../protocol/check.mjs';
+import { pass, fail, skip } from '../protocol/check.mjs';
+import { scanSessionLines } from '../session-reader.mjs';
 
 /** 凭据模式 */
 const CREDENTIAL_PATTERNS = [
@@ -28,13 +30,18 @@ const CREDENTIAL_PATTERNS = [
   { name: 'Basic Auth', regex: /Basic\s+[a-zA-Z0-9+/=]{20,}/g },
 ];
 
+/** 掩码：只保留极短前缀 + 长度信息，绝不回显凭据内容 */
+function maskSecret(s) {
+  if (s.length <= 8) return `***(${s.length} chars)`;
+  return `${s.slice(0, 4)}***(${s.length} chars)`;
+}
+
 /**
  * 从一行 JSONL 中提取文本内容
  */
 function extractTextFromLine(line) {
   try {
     const event = JSON.parse(line);
-    // 递归提取所有字符串值
     const texts = [];
     function extract(obj) {
       if (typeof obj === 'string') {
@@ -52,9 +59,6 @@ function extractTextFromLine(line) {
   }
 }
 
-/**
- * 扫描单行中的凭据
- */
 function scanLine(text) {
   const findings = [];
   for (const pattern of CREDENTIAL_PATTERNS) {
@@ -62,7 +66,7 @@ function scanLine(text) {
     for (const match of matches) {
       findings.push({
         type: pattern.name,
-        snippet: match[0].slice(0, 20) + '...' + match[0].slice(-4),
+        snippet: maskSecret(match[0]),
       });
     }
   }
@@ -77,49 +81,27 @@ function scanLine(text) {
 export async function run(sessionFile) {
   const id = 'SS1';
 
-  if (!existsSync(sessionFile)) {
+  if (!sessionFile || !existsSync(sessionFile)) {
     return pass(id, Severity.CRITICAL, '会话文件不存在，跳过检查');
   }
 
-  // 检查是否是 zstd 压缩的（需要先解压）
-  if (sessionFile.endsWith('.zstd')) {
-    return pass(id, Severity.CRITICAL, 'zstd 压缩的会话文件需先解压再检查（或使用 dsh-redact 直接处理）');
-  }
-
-  // 检查是否已通过 dsh-redact 脱敏
-  try {
-    const firstLines = createReadStream(sessionFile, { encoding: 'utf8' });
-    const rl = createInterface({ input: firstLines, crlfDelay: Infinity });
-    let alreadyRedacted = false;
-    let checkCount = 0;
-    for await (const line of rl) {
-      if (checkCount++ > 5) break;
-      if (line.includes('[REDACTED]') || line.includes('[redacted]') || line.includes('***')) {
-        alreadyRedacted = true;
-        break;
-      }
-    }
-    firstLines.destroy();
-    if (alreadyRedacted) {
-      return pass(id, Severity.CRITICAL, '会话文件似乎已通过 dsh-redact 脱敏');
-    }
-  } catch { /* 继续正常检查 */ }
-
   const findings = [];
   let lineCount = 0;
 
-  const fileStream = createReadStream(sessionFile, { encoding: 'utf8' });
-  const rl = createInterface({ input: fileStream, crlfDelay: Infinity });
-
-  for await (const line of rl) {
-    lineCount++;
-    if (!line.trim()) continue;
-    const text = extractTextFromLine(line);
-    if (!text) continue;
-    const lineFindings = scanLine(text);
-    for (const f of lineFindings) {
-      findings.push({ ...f, line: lineCount });
+  try {
+    lineCount = await scanSessionLines(sessionFile, (line, lineNo) => {
+      if (!line.trim()) return;
+      const text = extractTextFromLine(line);
+      if (!text) return;
+      for (const f of scanLine(text)) {
+        findings.push({ ...f, line: lineNo });
+      }
+    });
+  } catch (e) {
+    if (e.code === 'ZSTD_UNAVAILABLE') {
+      return skip(id, Severity.CRITICAL, 'zstd 命令不可用，无法解压压缩会话日志，跳过凭据泄露检测');
     }
+    throw e;
   }
 
   if (findings.length === 0) {
@@ -152,7 +134,7 @@ export const ss1Check = {
   name: 'credential-leak',
   severity: Severity.CRITICAL,
   phase: CheckPhase.POST_INSTALL,
-  description: '会话日志凭据泄露检测',
+  description: '会话日志凭据泄露检测（支持 zstd，结果自动掩码）',
   src: 'builtin',
   runner: (sessionFile) => run(sessionFile),
 };

package/src/checks/ss2-pii-exposure.mjs

@@ -11,11 +11,11 @@
  * Phase: POST_INSTALL
  */
 
-import { existsSync, createReadStream } from 'node:fs';
-import { createInterface } from 'node:readline';
+import { existsSync } from 'node:fs';
 import { Severity } from '../protocol/severity.mjs';
 import { CheckPhase } from '../protocol/phase.mjs';
-import { pass, fail } from '../protocol/check.mjs';
+import { pass, fail, skip } from '../protocol/check.mjs';
+import { scanSessionLines } from '../session-reader.mjs';
 
 const PII_PATTERNS = [
   { name: 'email', regex: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g, severity: 'medium' },
@@ -24,6 +24,12 @@ const PII_PATTERNS = [
   { name: 'IPv4', regex: /\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/g, severity: 'low' },
 ];
 
+/** PII 掩码：保留类型可辨识度，不回显完整个人信息 */
+function maskPII(s) {
+  if (s.length <= 6) return `***(${s.length} chars)`;
+  return `${s.slice(0, 2)}***${s.slice(-2)}(${s.length} chars)`;
+}
+
 function extractTextFromLine(line) {
   try {
     const event = JSON.parse(line);
@@ -41,21 +47,25 @@ function extractTextFromLine(line) {
 export async function run(sessionFile) {
   const id = 'SS2';
   if (!sessionFile || !existsSync(sessionFile)) return pass(id, Severity.MEDIUM, '无会话文件，跳过 PII 检测');
-  if (sessionFile.endsWith('.zstd')) return pass(id, Severity.MEDIUM, 'zstd 文件需先解压');
 
   const findings = [];
   let lineCount = 0;
-  const rl = createInterface({ input: createReadStream(sessionFile, { encoding: 'utf8' }), crlfDelay: Infinity });
 
-  for await (const line of rl) {
-    lineCount++;
-    if (!line.trim()) continue;
-    const text = extractTextFromLine(line);
-    for (const pattern of PII_PATTERNS) {
-      for (const match of text.matchAll(new RegExp(pattern.regex.source, 'g'))) {
-        findings.push({ type: pattern.name, severity: pattern.severity, line: lineCount, snippet: match[0].slice(0, 30) });
+  try {
+    lineCount = await scanSessionLines(sessionFile, (line, lineNo) => {
+      if (!line.trim()) return;
+      const text = extractTextFromLine(line);
+      for (const pattern of PII_PATTERNS) {
+        for (const match of text.matchAll(new RegExp(pattern.regex.source, 'g'))) {
+          findings.push({ type: pattern.name, severity: pattern.severity, line: lineNo, snippet: maskPII(match[0]) });
+        }
       }
+    });
+  } catch (e) {
+    if (e.code === 'ZSTD_UNAVAILABLE') {
+      return skip(id, Severity.MEDIUM, 'zstd 命令不可用，无法解压压缩会话日志，跳过 PII 检测');
     }
+    throw e;
   }
 
   if (findings.length === 0) return pass(id, Severity.MEDIUM, `扫描 ${lineCount} 行，未检测到 PII 暴露`);

package/src/checks/ss3-sensitive-output.mjs

@@ -10,11 +10,11 @@
  * Phase: POST_INSTALL
  */
 
-import { existsSync, createReadStream } from 'node:fs';
-import { createInterface } from 'node:readline';
+import { existsSync } from 'node:fs';
 import { Severity } from '../protocol/severity.mjs';
 import { CheckPhase } from '../protocol/phase.mjs';
-import { pass, fail } from '../protocol/check.mjs';
+import { pass, fail, skip } from '../protocol/check.mjs';
+import { scanSessionLines } from '../session-reader.mjs';
 
 const SENSITIVE_OUTPUT_PATTERNS = [
   { name: 'env dump', regex: /(?:process\.env|ENV|env)\s*[=:]\s*\{[^}]{50,}/gi, severity: 'medium' },
@@ -35,23 +35,26 @@ function extractToolOutputs(line) {
 export async function run(sessionFile) {
   const id = 'SS3';
   if (!sessionFile || !existsSync(sessionFile)) return pass(id, Severity.LOW, '无会话文件，跳过敏感输出检测');
-  if (sessionFile.endsWith('.zstd')) return pass(id, Severity.LOW, 'zstd 文件需先解压');
 
   const findings = [];
   let lineCount = 0;
-  const rl = createInterface({ input: createReadStream(sessionFile, { encoding: 'utf8' }), crlfDelay: Infinity });
-
-  for await (const line of rl) {
-    lineCount++;
-    if (!line.trim()) continue;
-    const outputs = extractToolOutputs(line);
-    for (const output of outputs) {
-      for (const pattern of SENSITIVE_OUTPUT_PATTERNS) {
-        for (const match of output.matchAll(new RegExp(pattern.regex.source, 'g'))) {
-          findings.push({ type: pattern.name, severity: pattern.severity, line: lineCount, snippet: match[0].slice(0, 60) });
+
+  try {
+    lineCount = await scanSessionLines(sessionFile, (line, lineNo) => {
+      if (!line.trim()) return;
+      for (const output of extractToolOutputs(line)) {
+        for (const pattern of SENSITIVE_OUTPUT_PATTERNS) {
+          for (const match of output.matchAll(new RegExp(pattern.regex.source, 'g'))) {
+            findings.push({ type: pattern.name, severity: pattern.severity, line: lineNo, snippet: match[0].slice(0, 60) });
+          }
         }
       }
+    });
+  } catch (e) {
+    if (e.code === 'ZSTD_UNAVAILABLE') {
+      return skip(id, Severity.LOW, 'zstd 命令不可用，无法解压压缩会话日志，跳过敏感输出检测');
     }
+    throw e;
   }
 
   if (findings.length === 0) return pass(id, Severity.LOW, `扫描 ${lineCount} 行，未检测到敏感输出`);

package/src/config.mjs

@@ -2,42 +2,47 @@
  * DSH Security Framework — 配置管理
  *
  * 支持 ~/.dsh/security.json 配置文件：
- * - 启用/禁用特定检查
- * - 覆盖 severity 阈值
- * - 配置外部工具集成
+ * - enabled: false → 停用整个安全框架（缺省/文件不存在 = 全部启用）
+ * - checks.{ID}.enabled: false → 停用单个检查
+ * - severityThreshold: "low"|"medium"|"high" → 低于阈值的失败降级为 skip
+ *
+ * 注意：配置只在显式 setConfig() 注入 registry 后生效；未注入时所有检查启用。
  */
 
 import { readFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 
-const DEFAULT_CONFIG = {
-  enabled: false,
+const DEFAULT_CONFIG = Object.freeze({
+  enabled: true,
   checks: {},
-  external: {},
-  severityThreshold: 'info',
-  autoRedact: true,
-};
+  severityThreshold: null,
+});
 
 export function loadConfig(dshHome) {
   const configPath = join(dshHome || join(homedir(), '.dsh'), 'security.json');
-  if (!existsSync(configPath)) return DEFAULT_CONFIG;
+  if (!existsSync(configPath)) return { ...DEFAULT_CONFIG };
   try {
     const raw = JSON.parse(readFileSync(configPath, 'utf8'));
-    return { ...DEFAULT_CONFIG, ...raw };
+    return {
+      ...DEFAULT_CONFIG,
+      ...raw,
+      checks: raw.checks && typeof raw.checks === 'object' ? raw.checks : {},
+    };
   } catch {
-    return DEFAULT_CONFIG;
+    return { ...DEFAULT_CONFIG };
   }
 }
 
 export function isCheckEnabled(config, checkId) {
-  if (!config.enabled) return false;
-  const checkConfig = config.checks[checkId];
+  if (!config) return true;
+  if (config.enabled === false) return false;
+  const checkConfig = config.checks && config.checks[checkId];
   if (checkConfig && checkConfig.enabled === false) return false;
   return true;
 }
 
 export function getCheckSeverity(config, checkId, defaultSeverity) {
-  const checkConfig = config.checks[checkId];
-  return checkConfig?.severity || defaultSeverity;
+  const checkConfig = config && config.checks ? config.checks[checkId] : undefined;
+  return (checkConfig && checkConfig.severity) || defaultSeverity;
 }

package/src/index.mjs

@@ -1,7 +1,7 @@
 /**
  * DSH Security Framework — 统一安全检查框架
  *
- * 为 DSH 生态提供全生命周期安全检查（17 个检查项，4 层架构）。
+ * 为 DSH 生态提供全生命周期安全检查（18 个检查项，4 层架构）。
  *
  * @example
  * import { createDefaultRegistry } from '@moonquake2004/dsh-security';
@@ -12,7 +12,8 @@
 // Protocol
 export { Severity, severityToExitCode, severityGte, maxSeverity } from './protocol/severity.mjs';
 export { CheckPhase } from './protocol/phase.mjs';
-export { createResult, pass, fail } from './protocol/check.mjs';
+export { createResult, pass, fail, skip } from './protocol/check.mjs';
+export { isZstdFile, scanSessionLines } from './session-reader.mjs';
 
 // Layer 1: Static Checks
 export { sp1Check } from './checks/sp1-dependency-audit.mjs';
@@ -21,6 +22,7 @@ export { sp3Check } from './checks/sp3-sandbox-consistency.mjs';
 export { sp4Check } from './checks/sp4-entry-poison.mjs';
 export { sp5Check } from './checks/sp5-permission-model.mjs';
 export { sp6Check } from './checks/sp6-vuln-match.mjs';
+export { sp7Check } from './checks/sp7-client-syntax.mjs';
 
 // Layer 2: Runtime Checks
 export { sr1Check } from './checks/sr1-sandbox-violation.mjs';

package/src/integrations/ecosystem.mjs

@@ -5,50 +5,87 @@
  * - 已知 bug 状态
  * - 发布兼容性报告
  * - 生态健康信号
+ *
+ * 复审修复：
+ * - 旧实现 fetch raw.githubusercontent.com 的目录 URL——raw 不提供目录列表，必然 404，
+ *   release-compat 半边永远拿不到数据；现改走 GitHub contents API 列目录并取最新文件。
+ * - bug 雷达不再硬编码 weekly-2026-08-15.md，自动取 docs/ 下最新的 weekly-*.md。
+ * - 数据源不可用返回 skip 而不是伪装通过。
  */
 
 import { Severity } from '../protocol/severity.mjs';
 import { CheckPhase } from '../protocol/phase.mjs';
+import { skip } from '../protocol/check.mjs';
+
+const REPO_DOCS_API = 'https://api.github.com/repos/zoahdev/dsh-ecosystem/contents/docs';
+const RAW_BASE = 'https://raw.githubusercontent.com/zoahdev/dsh-ecosystem/main/docs';
+
+const GH_HEADERS = {
+  'User-Agent': 'dsh-security',
+  'Accept': 'application/vnd.github+json',
+};
+
+async function ghFetch(url, accept) {
+  const response = await fetch(url, {
+    headers: { ...GH_HEADERS, ...(accept ? { Accept: accept } : {}) },
+    signal: AbortSignal.timeout(10000),
+  });
+  if (!response.ok) return null;
+  return response;
+}
 
-const ECOSYSTEM_API = 'https://raw.githubusercontent.com/zoahdev/dsh-ecosystem/main/docs';
+/** 列 docs/<sub> 目录下的 .md 文件名（GitHub contents API），按名称倒序 */
+async function listMarkdownFiles(sub = '') {
+  try {
+    const response = await ghFetch(sub ? `${REPO_DOCS_API}/${sub}` : REPO_DOCS_API);
+    if (!response || !response.ok) return null;
+    const entries = await response.json();
+    if (!Array.isArray(entries)) return null;
+    return entries
+      .filter(e => e.type === 'file' && e.name.endsWith('.md'))
+      .map(e => e.name)
+      .sort()
+      .reverse();
+  } catch { return null; }
+}
+
+async function fetchRaw(sub, name) {
+  try {
+    const response = await ghFetch(`${RAW_BASE}/${sub ? sub + '/' : ''}${name}`);
+    if (!response || !response.ok) return null;
+    return await response.text();
+  } catch { return null; }
+}
 
 /**
- * 获取发布兼容性报告
+ * 获取最新发布兼容性报告
  */
 async function fetchReleaseCompat() {
-  try {
-    const response = await fetch(`${ECOSYSTEM_API}/release-compat/`, { signal: AbortSignal.timeout(10000) });
-    if (!response.ok) return null;
-    // 解析目录列表找最新的兼容性报告
-    const text = await response.text();
-    const match = text.match(/release-compat-[\d-]+\.md/);
-    if (!match) return null;
-
-    const reportResponse = await fetch(`${ECOSYSTEM_API}/release-compat/${match[0]}`, { signal: AbortSignal.timeout(10000) });
-    if (!reportResponse.ok) return null;
-    return await reportResponse.text();
-  } catch { return null; }
+  const names = await listMarkdownFiles('release-compat');
+  if (!names || names.length === 0) return null;
+  const latest = names.find(n => /^release-compat-\d[\d-]*\.md$/.test(n));
+  if (!latest) return null;
+  return fetchRaw('release-compat', latest);
 }
 
 /**
- * 获取 bug 雷达
+ * 获取最新一期 bug 雷达周报
  */
 async function fetchBugRadar() {
-  try {
-    const response = await fetch(`${ECOSYSTEM_API}/weekly-2026-08-15.md`, { signal: AbortSignal.timeout(10000) });
-    if (!response.ok) return null;
-    return await response.text();
-  } catch { return null; }
+  const names = await listMarkdownFiles('');
+  if (!names) return null;
+  const latest = names.find(n => /^weekly-\d{4}-\d{2}-\d{2}\.md$/.test(n));
+  if (!latest) return null;
+  return fetchRaw('', latest);
 }
 
 export async function runCheck(profileDir) {
   const id = 'EXT-ECO-1';
 
-  const releaseNotes = await fetchReleaseCompat();
-  const bugRadar = await fetchBugRadar();
+  const [releaseNotes, bugRadar] = await Promise.all([fetchReleaseCompat(), fetchBugRadar()]);
 
   if (!releaseNotes && !bugRadar) {
-    return { id, ok: true, severity: Severity.LOW, detail: 'dsh-ecosystem 数据源不可用，跳过生态兼容性检查' };
+    return skip(id, Severity.LOW, 'dsh-ecosystem 数据源不可达（离线或仓库无数据），跳过生态兼容性检查');
   }
 
   const issues = [];