@moonquake2004/dsh-security 0.1.0 → 0.1.2

package/src/integrations/plugin-reducer.mjs

@@ -2,22 +2,21 @@
  * dsh-plugin-reducer 集成
  *
  * 在检测到故障时，提供最小化故障插件集的能力。
- * 如果 dsh-plugin-reducer 已安装，自动建议运行。
+ * 如果 dsh-plugin-reducer 已安装（PATH 中可执行），自动建议运行。
+ * 复审修复：不再用 `npx 包名` 探测/执行；执行失败返回 skip 而不是伪装通过。
  */
 
-import { execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 import { Severity } from '../protocol/severity.mjs';
 import { CheckPhase } from '../protocol/phase.mjs';
+import { skip } from '../protocol/check.mjs';
 
 export function isAvailable() {
   try {
-    execSync('which dsh-plugin-reducer', { encoding: 'utf8', stdio: 'pipe' });
+    execFileSync('which', ['dsh-plugin-reducer'], { encoding: 'utf8', stdio: 'pipe' });
     return true;
   } catch {
-    try {
-      execSync('npx dsh-plugin-reducer --version', { encoding: 'utf8', stdio: 'pipe', timeout: 10000 });
-      return true;
-    } catch { return false; }
+    return false;
   }
 }
 
@@ -25,15 +24,19 @@ export async function runReducer(profileDir, probeType = 'web') {
   const id = 'EXT-RED-1';
 
   if (!isAvailable()) {
-    return { id, ok: true, severity: Severity.LOW, detail: 'dsh-plugin-reducer 未安装，跳过故障最小化' };
+    return skip(id, Severity.LOW, 'dsh-plugin-reducer 未安装，跳过故障最小化');
   }
 
   try {
-    const output = execSync(`npx dsh-plugin-reducer --profile "${profileDir}" --probe ${probeType} --report /tmp/reducer-report.json --json`, {
-      encoding: 'utf8',
-      timeout: 120000,
-      stdio: ['pipe', 'pipe', 'pipe'],
-    });
+    const output = execFileSync(
+      'dsh-plugin-reducer',
+      ['--profile', String(profileDir), '--probe', String(probeType), '--report', '/tmp/reducer-report.json', '--json'],
+      {
+        encoding: 'utf8',
+        timeout: 120000,
+        stdio: ['pipe', 'pipe', 'pipe'],
+      }
+    );
 
     const result = JSON.parse(output);
 
@@ -50,7 +53,7 @@ export async function runReducer(profileDir, probeType = 'web') {
 
     return { id, ok: true, severity: Severity.LOW, detail: 'dsh-plugin-reducer 未发现故障插件集' };
   } catch (e) {
-    return { id, ok: true, severity: Severity.LOW, detail: `dsh-plugin-reducer 执行失败：${e.message.slice(0, 80)}` };
+    return skip(id, Severity.LOW, `dsh-plugin-reducer 执行失败，跳过：${e.message.slice(0, 80)}`);
   }
 }
 

package/src/integrations/poison-guard.mjs

@@ -1,30 +1,24 @@
 /**
  * dsh-poison-guard 集成
  *
- * 通过 Plugin Interface 注册投毒扫描检查。
- * 如果 dsh-poison-guard 已安装，自动集成到安全检查流程。
+ * 如果 dsh-poison-guard 已安装（PATH 中可执行），自动集成到安全检查流程。
+ * 复审修复：不再用 `npx 包名` 探测/执行；执行失败返回 skip 而不是伪装通过。
  */
 
-import { execSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
 import { Severity } from '../protocol/severity.mjs';
 import { CheckPhase } from '../protocol/phase.mjs';
+import { skip } from '../protocol/check.mjs';
 
 /**
  * 检测 dsh-poison-guard 是否可用
  */
 export function isAvailable() {
   try {
-    execSync('which dsh-poison-guard', { encoding: 'utf8', stdio: 'pipe' });
+    execFileSync('which', ['dsh-poison-guard'], { encoding: 'utf8', stdio: 'pipe' });
     return true;
   } catch {
-    // 也检查 npx 可用性
-    try {
-      execSync('npx dsh-poison-guard --version', { encoding: 'utf8', stdio: 'pipe', timeout: 10000 });
-      return true;
-    } catch {
-      return false;
-    }
+    return false;
   }
 }
 
@@ -37,11 +31,11 @@ export async function runScan(targetPath) {
   const id = 'EXT-PG-1';
 
   if (!isAvailable()) {
-    return { id, ok: true, severity: Severity.HIGH, detail: 'dsh-poison-guard 未安装，跳过投毒扫描' };
+    return skip(id, Severity.HIGH, 'dsh-poison-guard 未安装，跳过投毒扫描');
   }
 
   try {
-    const output = execSync(`npx dsh-poison-guard scan "${targetPath}" --json`, {
+    const output = execFileSync('dsh-poison-guard', ['scan', String(targetPath), '--json'], {
       encoding: 'utf8',
       timeout: 60000,
       stdio: ['pipe', 'pipe', 'pipe'],
@@ -64,7 +58,7 @@ export async function runScan(targetPath) {
       fix: '检查相关插件的源码，移除恶意代码',
     };
   } catch (e) {
-    return { id, ok: true, severity: Severity.HIGH, detail: `dsh-poison-guard 执行失败：${e.message.slice(0, 80)}` };
+    return skip(id, Severity.HIGH, `dsh-poison-guard 执行失败，跳过：${e.message.slice(0, 80)}`);
   }
 }
 

package/src/integrations/sandbox-audit.mjs

@@ -1,23 +1,22 @@
 /**
  * dsh-sandbox-audit 集成
  *
- * 通过 Plugin Interface 注册沙箱策略审计检查。
- * 如果 dsh-sandbox-audit 已安装，自动集成到安全检查流程。
+ * 如果 dsh-sandbox-audit 已安装（PATH 中可执行），自动集成到安全检查流程。
+ * 复审修复：不再用 `npx 包名` 探测可用性——那会在用户机器上触发任意包的下载执行；
+ * 执行失败现在返回 skip 而不是伪装成通过。
  */
 
-import { execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 import { Severity } from '../protocol/severity.mjs';
 import { CheckPhase } from '../protocol/phase.mjs';
+import { skip } from '../protocol/check.mjs';
 
 export function isAvailable() {
   try {
-    execSync('which dsh-sandbox-audit', { encoding: 'utf8', stdio: 'pipe' });
+    execFileSync('which', ['dsh-sandbox-audit'], { encoding: 'utf8', stdio: 'pipe' });
     return true;
   } catch {
-    try {
-      execSync('npx dsh-sandbox-audit --version', { encoding: 'utf8', stdio: 'pipe', timeout: 10000 });
-      return true;
-    } catch { return false; }
+    return false;
   }
 }
 
@@ -25,11 +24,11 @@ export async function runAudit(profileDir) {
   const id = 'EXT-SA-1';
 
   if (!isAvailable()) {
-    return { id, ok: true, severity: Severity.MEDIUM, detail: 'dsh-sandbox-audit 未安装，跳过沙箱策略审计' };
+    return skip(id, Severity.MEDIUM, 'dsh-sandbox-audit 未安装，跳过沙箱策略审计');
   }
 
   try {
-    const output = execSync(`npx dsh-sandbox-audit "${profileDir}" --json`, {
+    const output = execFileSync('dsh-sandbox-audit', [String(profileDir), '--json'], {
       encoding: 'utf8',
       timeout: 60000,
       stdio: ['pipe', 'pipe', 'pipe'],
@@ -52,7 +51,7 @@ export async function runAudit(profileDir) {
       fix: '参考 dsh-sandbox-audit 文档修复沙箱配置',
     };
   } catch (e) {
-    return { id, ok: true, severity: Severity.MEDIUM, detail: `dsh-sandbox-audit 执行失败：${e.message.slice(0, 80)}` };
+    return skip(id, Severity.MEDIUM, `dsh-sandbox-audit 执行失败，跳过：${e.message.slice(0, 80)}`);
   }
 }
 

package/src/protocol/check.mjs

@@ -47,3 +47,12 @@ export function pass(id, severity, detail) {
 export function fail(id, severity, detail, fix, references = []) {
   return createResult(id, false, severity, detail, fix, references);
 }
+
+/**
+ * 跳过结果——检查因外部条件不满足而未真正执行（如网络不可达、依赖工具缺失）。
+ * skipped=true 的结果不计入失败统计，也不影响退出码；
+ * detail 必须说明原因（对齐 #1719 r5 词汇表「skip 必须带 reason」）。
+ */
+export function skip(id, severity, detail) {
+  return { id, ok: true, skipped: true, severity, detail };
+}

package/src/registry.mjs

@@ -2,22 +2,41 @@
  * DSH Security Framework — Check Registry
  *
  * 管理安全检查的注册、发现和执行。
- * 支持内置检查和外部工具注册的检查。
+ * 支持内置检查、外部工具集成（自动探测）和 checks.d JSON 注册（显式启用）。
  */
 
 import { readdirSync, readFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
-import { maxSeverity, severityToExitCode } from './protocol/severity.mjs';
+import { maxSeverity, severityToExitCode, severityGte } from './protocol/severity.mjs';
+
+const VALID_SEVERITIES = ['critical', 'high', 'medium', 'low', 'info'];
 
 export class SecurityCheckRegistry {
   constructor() {
     /** @type {Map<string, import('./protocol/check.mjs').SecurityCheck>} */
     this.checks = new Map();
+    /** @type {object|null} 可选运行配置（见 config.mjs / README 配置节） */
+    this.config = null;
   }
 
   register(check) { this.checks.set(check.id, check); }
   registerAll(checks) { for (const check of checks) this.register(check); }
 
+  /**
+   * 注入运行配置（~/.dsh/security.json）：
+   * - enabled=false → 全部停用
+   * - checks.{ID}.enabled=false → 停用单个检查
+   * - severityThreshold → 低于阈值的失败降级为 skipped（不影响退出码）
+   */
+  setConfig(config) {
+    this.config = config && typeof config === 'object' ? config : null;
+  }
+
+  /**
+   * Plugin Interface：从 <securityDir>/checks.d/*.json 加载外部注册的检查。
+   * 注意：JSON 中的 command 会被执行——只应加载用户自己放置的文件，
+   * 且目录由调用方显式传入（框架不会默认扫描任何位置）。
+   */
   loadExternalChecks(securityDir) {
     const checksDir = join(securityDir, 'checks.d');
     if (!existsSync(checksDir)) return;
@@ -27,17 +46,20 @@ export class SecurityCheckRegistry {
         const reg = JSON.parse(readFileSync(join(checksDir, file), 'utf8'));
         if (reg.checks && Array.isArray(reg.checks)) {
           for (const ext of reg.checks) {
+            if (!ext || !ext.id || !ext.command) continue;
             this.register({
-              id: ext.id, name: ext.name, severity: ext.severity, phase: ext.phase,
-              description: ext.description, src: 'external', source: reg.source,
+              id: ext.id, name: ext.name || ext.id, severity: ext.severity || 'medium',
+              phase: ext.phase || 'post-install',
+              description: ext.description || `External check (${reg.source || file})`,
+              src: 'external', source: reg.source || file,
               runner: async () => {
                 const { execSync } = await import('node:child_process');
                 try {
                   const output = execSync(ext.command, { encoding: 'utf8', timeout: 30000 });
                   const result = JSON.parse(output);
-                  return { id: ext.id, ok: result.ok ?? true, severity: ext.severity, detail: result.detail || 'External check completed', fix: result.fix, references: result.references };
+                  return { id: ext.id, ok: result.ok ?? true, severity: ext.severity || 'medium', detail: result.detail || 'External check completed', fix: result.fix, references: result.references };
                 } catch (e) {
-                  return { id: ext.id, ok: false, severity: ext.severity, detail: `External check failed: ${e.message}` };
+                  return { id: ext.id, ok: false, severity: ext.severity || 'medium', detail: `External check failed: ${e.message}` };
                 }
               },
             });
@@ -56,7 +78,18 @@ export class SecurityCheckRegistry {
   }
 
   async runAll(contextFn, phase = null) {
-    const checks = phase ? this.getByPhase(phase) : [...this.checks.values()];
+    let checks = phase ? this.getByPhase(phase) : [...this.checks.values()];
+
+    // 应用配置过滤（未 setConfig 时全部启用）
+    const cfg = this.config;
+    if (cfg && cfg.enabled === false) {
+      checks = [];
+    } else if (cfg && cfg.checks) {
+      checks = checks.filter(c => !(cfg.checks[c.id] && cfg.checks[c.id].enabled === false));
+    }
+    const threshold = cfg && cfg.severityThreshold && VALID_SEVERITIES.includes(cfg.severityThreshold)
+      ? cfg.severityThreshold : null;
+
     const results = [];
     for (const check of checks) {
       try {
@@ -67,20 +100,34 @@ export class SecurityCheckRegistry {
         results.push({ id: check.id, ok: false, severity: check.severity, detail: `Check execution failed: ${e.message}` });
       }
     }
-    const summary = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+
+    // severityThreshold：低于阈值的失败降级为 skip（保留原因），不进失败统计与退出码
+    const finalResults = results.map((r) => {
+      if (r.ok || r.skipped || !threshold) return r;
+      const sev = VALID_SEVERITIES.includes(r.severity) ? r.severity : 'medium';
+      if (severityGte(threshold, sev)) {
+        return { ...r, ok: true, skipped: true, detail: `${r.detail}\n[severityThreshold=${threshold}：低于阈值，已降级为 skip]` };
+      }
+      return r;
+    });
+
+    const summary = { critical: 0, high: 0, medium: 0, low: 0, info: 0, skipped: 0 };
     const failedSeverities = [];
-    for (const r of results) {
-      if (!r.ok && summary[r.severity] !== undefined) {
-        summary[r.severity]++;
-        failedSeverities.push(r.severity);
+    for (const r of finalResults) {
+      if (r.skipped) { summary.skipped++; continue; }
+      if (!r.ok) {
+        // 无效 severity 的失败按 medium 计，避免静默丢失退出码信号
+        const sev = VALID_SEVERITIES.includes(r.severity) ? r.severity : 'medium';
+        summary[sev]++;
+        failedSeverities.push(sev);
       }
     }
     const exitCode = failedSeverities.length > 0 ? severityToExitCode[maxSeverity(failedSeverities)] : 0;
-    return { results, exitCode, summary };
+    return { results: finalResults, exitCode, summary };
   }
 }
 
-export async function createDefaultRegistry(loadExternal = true) {
+export async function createDefaultRegistry(loadExternal = true, options = {}) {
   const registry = new SecurityCheckRegistry();
   const modules = await Promise.all([
     import('./checks/sp1-dependency-audit.mjs'),
@@ -100,6 +147,7 @@ export async function createDefaultRegistry(loadExternal = true) {
     import('./checks/ss1-credential-leak.mjs'),
     import('./checks/ss2-pii-exposure.mjs'),
     import('./checks/ss3-sensitive-output.mjs'),
+    import('./checks/sp7-client-syntax.mjs'),
   ]);
   for (const mod of modules) {
     for (const val of Object.values(mod)) {
@@ -109,8 +157,13 @@ export async function createDefaultRegistry(loadExternal = true) {
     }
   }
 
-  // 加载外部集成
-  if (loadExternal) {
+  // Plugin Interface：仅在调用方显式给出目录时启用（安全考虑，不默认扫描）
+  const extDir = typeof loadExternal === 'object' ? loadExternal.externalChecksDir : options.externalChecksDir;
+  if (extDir) registry.loadExternalChecks(extDir);
+
+  // 自动探测外部工具集成（dsh-poison-guard 等）
+  const wantIntegrations = typeof loadExternal === 'object' ? (loadExternal.integrations !== false) : loadExternal;
+  if (wantIntegrations) {
     try {
       const { getAvailableIntegrations } = await import('./integrations/index.mjs');
       const integrations = await getAvailableIntegrations();

package/src/session-reader.mjs

@@ -0,0 +1,63 @@
+/**
+ * DSH Security Framework — 会话日志读取
+ *
+ * SR/SS 系列检查共用：透明支持明文 .jsonl 与 zstd 压缩的 session.jsonl.zstd
+ * （真实 DSH 部署中会话日志为 ~/.dsh/sessions/<user>/<session>/session.jsonl.zstd）。
+ *
+ * 依赖系统 zstd 命令解压（macOS: brew install zstd；Debian: apt install zstd）。
+ * 二进制不可用时抛 code='ZSTD_UNAVAILABLE'，检查应转为 skip 而非误报通过。
+ */
+
+import { createReadStream } from 'node:fs';
+import { spawn } from 'node:child_process';
+import { createInterface } from 'node:readline';
+
+export function isZstdFile(sessionFile) {
+  return typeof sessionFile === 'string' && (sessionFile.endsWith('.zstd') || sessionFile.endsWith('.zst'));
+}
+
+function openStream(sessionFile) {
+  if (isZstdFile(sessionFile)) {
+    const child = spawn('zstd', ['-dc', sessionFile], { stdio: ['ignore', 'pipe', 'pipe'] });
+    let stderrTail = '';
+    let spawnErr = null;
+    child.stderr.on('data', (d) => { stderrTail += String(d); });
+    const settled = new Promise((resolve) => {
+      child.once('error', (e) => { spawnErr = e; resolve(); });
+      child.once('close', () => resolve());
+    });
+    return { stream: child.stdout, settled, getErr: () => (spawnErr ? spawnErr : stderrTail.trim() || null) };
+  }
+  return { stream: createReadStream(sessionFile, { encoding: 'utf8' }), settled: Promise.resolve(), getErr: () => null };
+}
+
+/**
+ * 逐行扫描会话文件（自动解压 zstd）。
+ * @param {string} sessionFile 会话文件路径
+ * @param {(line: string, lineNo: number) => void|Promise<void>} onLine 每行回调
+ * @returns {Promise<number>} 实际读取的总行数
+ */
+export async function scanSessionLines(sessionFile, onLine) {
+  const { stream, settled, getErr } = openStream(sessionFile);
+  const rl = createInterface({ input: stream, crlfDelay: Infinity });
+  let lineCount = 0;
+  try {
+    for await (const line of rl) {
+      lineCount++;
+      await onLine(line, lineCount);
+    }
+  } finally {
+    await settled.catch(() => {});
+    if (typeof stream.destroy === 'function') stream.destroy();
+  }
+  const err = getErr();
+  if (err) {
+    if (err.code === 'ENOENT') {
+      const e = new Error('zstd 命令不可用（PATH 中未找到），无法解压压缩会话日志');
+      e.code = 'ZSTD_UNAVAILABLE';
+      throw e;
+    }
+    throw new Error(`会话日志读取失败：${String(err).split('\n').pop().slice(0, 100)}`);
+  }
+  return lineCount;
+}