@moonquake2004/dsh-security 0.1.0

package/src/checks/sp1-dependency-audit.mjs

@@ -0,0 +1,157 @@
+/**
+ * SP1: Dependency Audit — 依赖链漏洞扫描
+ *
+ * 集成 npm audit 检查 profile 中已安装插件的已知漏洞。
+ * 支持 npm audit 和 osv-scanner 两种后端。
+ *
+ * Severity: HIGH（有 critical/high 漏洞时）
+ * Phase: POST_INSTALL
+ */
+
+import { execSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { Severity, maxSeverity } from '../protocol/severity.mjs';
+import { CheckPhase } from '../protocol/phase.mjs';
+import { pass, fail } from '../protocol/check.mjs';
+
+/**
+ * 运行 npm audit 并解析结果
+ */
+function runNpmAudit(profileDir) {
+  const packageJsonPath = join(profileDir, 'package.json');
+  if (!existsSync(packageJsonPath)) {
+    return { vulns: [], error: 'package.json 不存在' };
+  }
+
+  try {
+    const output = execSync('npm audit --json --omit=dev', {
+      cwd: profileDir,
+      encoding: 'utf8',
+      timeout: 60000,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    const audit = JSON.parse(output);
+    return parseNpmAudit(audit);
+  } catch (e) {
+    // npm audit 在有漏洞时 exit code 1，这是正常的
+    if (e.stdout) {
+      try {
+        const audit = JSON.parse(e.stdout);
+        return parseNpmAudit(audit);
+      } catch {
+        return { vulns: [], error: `npm audit 解析失败: ${e.message}` };
+      }
+    }
+    return { vulns: [], error: `npm audit 执行失败: ${e.message}` };
+  }
+}
+
+/**
+ * 解析 npm audit JSON 输出
+ */
+function parseNpmAudit(audit) {
+  const vulns = [];
+  const advisory = audit.advisories || {};
+  const metadata = audit.metadata || {};
+
+  // npm v7+ 格式
+  if (audit.vulnerabilities) {
+    for (const [name, vuln] of Object.entries(audit.vulnerabilities)) {
+      if (vuln.severity === 'info') continue;
+      vulns.push({
+        package: name,
+        severity: vuln.severity,
+        title: vuln.via?.[0]?.title || 'Unknown vulnerability',
+        range: vuln.range || 'Unknown',
+        fixAvailable: !!vuln.fixAvailable,
+        url: vuln.via?.[0]?.url || '',
+      });
+    }
+  }
+
+  // npm v6 格式（advisories）
+  for (const [id, adv] of Object.entries(advisory)) {
+    vulns.push({
+      package: adv.module_name,
+      severity: adv.severity,
+      title: adv.title,
+      range: adv.vulnerable_versions,
+      fixAvailable: !!adv.patched_versions,
+      url: adv.url || '',
+    });
+  }
+
+  return {
+    vulns,
+    totalDependencies: metadata.totalDependencies || 0,
+    totalVulnerabilities: metadata.vulnerabilities?.total || vulns.length,
+  };
+}
+
+/**
+ * SP1 检查：扫描 profile 依赖链中的已知漏洞
+ * @param {string} profileDir - profile 目录路径
+ * @returns {Promise<import('../protocol/check.mjs').SecurityCheckResult>}
+ */
+export async function run(profileDir) {
+  const id = 'SP1';
+
+  if (!existsSync(join(profileDir, 'package.json'))) {
+    return pass(id, Severity.HIGH, 'profile 无 package.json，跳过依赖审计');
+  }
+
+  const { vulns, error, totalDependencies } = runNpmAudit(profileDir);
+
+  if (error) {
+    return pass(id, Severity.HIGH, `依赖审计跳过：${error}`);
+  }
+
+  if (vulns.length === 0) {
+    return pass(id, Severity.HIGH, `依赖链无已知漏洞（扫描 ${totalDependencies || '?'} 个依赖）`);
+  }
+
+  // 按 severity 分组
+  const bySeverity = {};
+  for (const v of vulns) {
+    if (!bySeverity[v.severity]) bySeverity[v.severity] = [];
+    bySeverity[v.severity].push(v);
+  }
+
+  const summary = Object.entries(bySeverity)
+    .map(([sev, items]) => `${sev}: ${items.length}`)
+    .join(', ');
+
+  const details = vulns
+    .slice(0, 10)
+    .map(v => `${v.package}（${v.severity}）— ${v.title}`)
+    .join('\n');
+
+  const fixable = vulns.filter(v => v.fixAvailable).length;
+  const fixHint = fixable > 0
+    ? `${fixable} 个漏洞可通过 npm fix 修复`
+    : '部分漏洞可能需要升级主版本或更换依赖';
+
+  const overallSeverity = maxSeverity(vulns.map(v => {
+    if (v.severity === 'critical') return Severity.CRITICAL;
+    if (v.severity === 'high') return Severity.HIGH;
+    if (v.severity === 'moderate') return Severity.MEDIUM;
+    return Severity.LOW;
+  }));
+
+  return fail(id, overallSeverity,
+    `检测到 ${vulns.length} 个已知漏洞（${summary}）：\n${details}\n${fixHint}`,
+    '运行 npm audit fix 修复可自动修复的漏洞；手动升级有破坏性变更的依赖',
+    vulns.filter(v => v.url).slice(0, 3).map(v => v.url)
+  );
+}
+
+export const sp1Check = {
+  id: 'SP1',
+  name: 'dependency-audit',
+  severity: Severity.HIGH,
+  phase: CheckPhase.POST_INSTALL,
+  description: '依赖链已知漏洞扫描（npm audit）',
+  src: 'builtin',
+  runner: (profileDir) => run(profileDir),
+};

package/src/checks/sp2-secret-scan.mjs

@@ -0,0 +1,131 @@
+/**
+ * SP2: Secret Scan — 配置文件硬编码密钥检测
+ *
+ * 扫描 cordis.patch.yml、package.json 和插件源码中的硬编码密钥。
+ * 区分安全模式（环境变量引用）和不安全模式（硬编码值）。
+ *
+ * Severity: HIGH
+ * Phase: POST_INSTALL
+ */
+
+import { readFileSync, existsSync, readdirSync, statSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import { Severity, maxSeverity } from '../protocol/severity.mjs';
+import { CheckPhase } from '../protocol/phase.mjs';
+import { pass, fail } from '../protocol/check.mjs';
+
+/** 密钥模式（正则） */
+const SECRET_PATTERNS = [
+  { name: 'OpenAI API Key', regex: /sk-[a-zA-Z0-9]{20,}/g, severity: 'high' },
+  { name: 'GitHub PAT', regex: /ghp_[a-zA-Z0-9]{36}/g, severity: 'high' },
+  { name: 'GitHub Fine-grained PAT', regex: /github_pat_[a-zA-Z0-9_]{20,}/g, severity: 'high' },
+  { name: 'AWS Access Key', regex: /AKIA[0-9A-Z]{16}/g, severity: 'high' },
+  { name: 'Slack Token', regex: /xox[baprs]-[a-zA-Z0-9-]+/g, severity: 'high' },
+  { name: 'Google API Key', regex: /AIza[0-9A-Za-z_-]{35}/g, severity: 'high' },
+  { name: 'PEM Private Key', regex: /-----BEGIN (RSA |EC |DSA )?PRIVATE KEY-----/g, severity: 'critical' },
+  { name: 'Generic Secret Assignment', regex: /(SECRET|TOKEN|API_KEY|PASSWORD|CREDENTIAL)\s*[:=]\s*['"][^'"]{8,}['"]/gi, severity: 'medium' },
+];
+
+/** 安全模式（排除） */
+const SAFE_PATTERNS = [
+  /\$\{[A-Z_]+\}/,           // ${VAR}
+  /process\.env\.[A-Z_]+/,   // process.env.VAR
+  /!!js\s+process\.env/,     // !!js process.env.XXX (YAML safe)
+  /\$env:[A-Z_]+/,           // $env:VAR (PowerShell)
+  /os\.environ\[[^]]+\]/,    // os.environ['VAR'] (Python)
+];
+
+function isSafePattern(line) {
+  return SAFE_PATTERNS.some(p => p.test(line));
+}
+
+function scanFile(filePath, profileDir) {
+  const findings = [];
+  let content;
+  try {
+    content = readFileSync(filePath, 'utf8');
+  } catch {
+    return findings;
+  }
+
+  const lines = content.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (isSafePattern(line)) continue;
+
+    for (const pattern of SECRET_PATTERNS) {
+      const matches = line.matchAll(pattern.regex);
+      for (const match of matches) {
+        findings.push({
+          file: relative(profileDir, filePath),
+          line: i + 1,
+          type: pattern.name,
+          severity: pattern.severity,
+          snippet: line.trim().slice(0, 100),
+        });
+      }
+    }
+  }
+  return findings;
+}
+
+function scanDirectory(dir, profileDir, extensions = ['.yml', '.yaml', '.json', '.js', '.mjs', '.ts', '.pem', '.key', '.env', '.toml']) {
+  const findings = [];
+  if (!existsSync(dir)) return findings;
+
+  const entries = readdirSync(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.name.startsWith('.') || entry.name === 'node_modules') continue;
+    const fullPath = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      findings.push(...scanDirectory(fullPath, profileDir, extensions));
+    } else if (extensions.some(ext => entry.name.endsWith(ext))) {
+      findings.push(...scanFile(fullPath, profileDir));
+    }
+  }
+  return findings;
+}
+
+/**
+ * SP2 检查：扫描 profile 目录中的硬编码密钥
+ * @param {string} profileDir - profile 目录路径
+ * @returns {import('../protocol/check.mjs').SecurityCheckResult}
+ */
+export function run(profileDir) {
+  const id = 'SP2';
+  const findings = scanDirectory(profileDir, profileDir);
+
+  if (findings.length === 0) {
+    return pass(id, Severity.HIGH, '配置文件和插件源码中未检测到硬编码密钥');
+  }
+
+  const bySeverity = {};
+  for (const f of findings) {
+    if (!bySeverity[f.severity]) bySeverity[f.severity] = [];
+    bySeverity[f.severity].push(f);
+  }
+
+  const summary = Object.entries(bySeverity)
+    .map(([sev, items]) => `${sev}: ${items.length}`)
+    .join(', ');
+
+  const details = findings
+    .slice(0, 10) // 最多显示 10 条
+    .map(f => `${f.file}:${f.line} — ${f.type}（${f.severity}）`)
+    .join('\n');
+
+  const fix = '将密钥移至环境变量或密钥管理器（如 1Password），从配置文件中删除硬编码值。使用 !!js process.env.VAR 引用环境变量。';
+  const overallSeverity = maxSeverity(findings.map(f => f.severity));
+
+  return fail(id, overallSeverity, `检测到 ${findings.length} 个硬编码密钥（${summary}）：\n${details}`, fix, ['#962']);
+}
+
+export const sp2Check = {
+  id: 'SP2',
+  name: 'secret-scan',
+  severity: Severity.HIGH,
+  phase: CheckPhase.POST_INSTALL,
+  description: '配置文件和插件源码中的硬编码密钥检测',
+  src: 'builtin',
+  runner: (profileDir) => Promise.resolve(run(profileDir)),
+};

package/src/checks/sp3-sandbox-consistency.mjs

@@ -0,0 +1,220 @@
+/**
+ * SP3: Sandbox Consistency — 沙箱策略配置一致性审计
+ *
+ * 轻量版 dsh-sandbox-audit：检查 cordis.patch.yml 中的沙箱策略配置，
+ * 检测工具的沙箱接线与策略声明不一致。
+ *
+ * 三大类问题：
+ *   HIGH: 变文件系统工具共享 bare fs-local backend（策略被静默忽略）
+ *   MEDIUM: 搜索工具未挂载 fs 但读取了写策略外的路径
+ *   LOW: 工具声明了不必要的沙箱权限
+ *
+ * Severity: MEDIUM（默认）
+ * Phase: POST_INSTALL
+ */
+
+import { readFileSync, existsSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { Severity } from '../protocol/severity.mjs';
+import { CheckPhase } from '../protocol/phase.mjs';
+import { pass, fail } from '../protocol/check.mjs';
+
+/** 已知的变文件系统工具（需要 sandbox 接线） */
+const MUTATING_FS_TOOLS = [
+  'tool-fs',
+  'str_replace_editor',
+  'tool-fs-write',
+];
+
+/** 已知的搜索工具（只读，但可能越权读取） */
+const SEARCH_TOOLS = [
+  'tool-fs-search',
+  'tool-glob',
+  'tool-grep',
+];
+
+/**
+ * 从 cordis.patch.yml 内容中提取所有 entry id
+ */
+function extractEntryIds(content) {
+  const ids = [];
+  const regex = /^\s*-?\s*id:\s*['"]?([^'"\s]+)['"]?\s*$/gm;
+  let match;
+  while ((match = regex.exec(content)) !== null) {
+    ids.push(match[1]);
+  }
+  return ids;
+}
+
+/**
+ * 获取指定 entry 的配置块（从 - id: 到下一个 - id: 之间的所有内容）
+ */
+function getEntryBlock(content, entryId) {
+  const entryRegex = new RegExp(`^\\s*-?\\s*id:\\s*['"]?${entryId}['"]?\\s*$`, 'gm');
+  const entryMatch = entryRegex.exec(content);
+  if (!entryMatch) return '';
+
+  const afterEntry = content.slice(entryMatch.index + entryMatch[0].length);
+  const nextEntryMatch = afterEntry.match(/^\s*-?\s*id:\s/m);
+  return nextEntryMatch
+    ? afterEntry.slice(0, nextEntryMatch.index)
+    : afterEntry;
+}
+
+/**
+ * 检查 entry 配置块中是否包含某个 key（任意层级）
+ */
+function blockHasKey(block, key) {
+  return new RegExp(`^\\s+${key}:\\s`, 'm').test(block);
+}
+
+/**
+ * 检查 sandbox-policy 配置
+ */
+function checkSandboxPolicy(content) {
+  const issues = [];
+
+  // 只检查显式声明了 sandbox-policy 的情况
+  if (!content.includes('sandbox-policy')) return issues;
+
+  // 检查 danger-full-access 模式
+  if (/mode:\s*['"]?danger-full-access['"]?/.test(content) &&
+      !/mode:\s*.*win32/.test(content)) {
+    issues.push({
+      severity: 'medium',
+      tool: 'sandbox-policy',
+      finding: 'sandbox-policy 使用 danger-full-access 模式（非 Windows），所有工具不受沙箱限制',
+    });
+  }
+
+  return issues;
+}
+
+/**
+ * 检查工具的沙箱接线
+ */
+function checkToolSandbox(content) {
+  const issues = [];
+  const entryIds = extractEntryIds(content);
+
+  // 检查变文件系统工具是否有 sandbox 接线
+  for (const tool of MUTATING_FS_TOOLS) {
+    if (entryIds.includes(tool)) {
+      const block = getEntryBlock(content, tool);
+      const hasSandbox = blockHasKey(block, 'sandbox') || blockHasKey(block, 'sandbox-backend');
+      if (!hasSandbox) {
+        issues.push({
+          severity: 'medium',
+          tool,
+          finding: `${tool} 未声明沙箱后端配置，可能使用默认 bare fs-local（策略被静默忽略）`,
+        });
+      }
+    }
+  }
+
+  // 检查搜索工具是否挂载了 fs
+  for (const tool of SEARCH_TOOLS) {
+    if (entryIds.includes(tool)) {
+      const block = getEntryBlock(content, tool);
+      const hasFs = blockHasKey(block, 'fs');
+      if (!hasFs) {
+        issues.push({
+          severity: 'low',
+          tool,
+          finding: `${tool} 未显式挂载 fs，可能读取写策略外的路径`,
+        });
+      }
+    }
+  }
+
+  return issues;
+}
+
+/**
+ * SP3 检查：扫描 profile 中的沙箱策略一致性
+ * @param {string} profileDir - profile 目录路径
+ * @returns {Promise<import('../protocol/check.mjs').SecurityCheckResult>}
+ */
+export async function run(profileDir) {
+  const id = 'SP3';
+
+  // 找所有 cordis.patch.yml 文件
+  const patchFiles = [];
+  const profilePatch = join(profileDir, 'cordis.patch.yml');
+  if (existsSync(profilePatch)) patchFiles.push(profilePatch);
+
+  // 扫描 node_modules 中的 bundle patch
+  const nmDir = join(profileDir, 'node_modules');
+  if (existsSync(nmDir)) {
+    const entries = readdirSync(nmDir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (entry.name.startsWith('.') || entry.name === '.bin') continue;
+      if (entry.name.startsWith('@')) {
+        // scoped package
+        const scopeDir = join(nmDir, entry.name);
+        const pkgs = readdirSync(scopeDir, { withFileTypes: true });
+        for (const pkg of pkgs) {
+          const patchPath = join(scopeDir, pkg.name, 'cordis.patch.yml');
+          if (existsSync(patchPath)) patchFiles.push(patchPath);
+        }
+      } else {
+        const patchPath = join(nmDir, entry.name, 'cordis.patch.yml');
+        if (existsSync(patchPath)) patchFiles.push(patchPath);
+      }
+    }
+  }
+
+  if (patchFiles.length === 0) {
+    return pass(id, Severity.MEDIUM, '未找到 cordis.patch.yml 配置文件，跳过沙箱策略审计');
+  }
+
+  const allIssues = [];
+  for (const patchFile of patchFiles) {
+    try {
+      const content = readFileSync(patchFile, 'utf8');
+      allIssues.push(...checkSandboxPolicy(content));
+      allIssues.push(...checkToolSandbox(content));
+    } catch {
+      // 跳过无法解析的文件
+    }
+  }
+
+  if (allIssues.length === 0) {
+    return pass(id, Severity.MEDIUM, `扫描 ${patchFiles.length} 个 patch 文件，沙箱策略配置一致`);
+  }
+
+  const bySeverity = {};
+  for (const issue of allIssues) {
+    if (!bySeverity[issue.severity]) bySeverity[issue.severity] = [];
+    bySeverity[issue.severity].push(issue);
+  }
+
+  const summary = Object.entries(bySeverity)
+    .map(([sev, items]) => `${sev}: ${items.length}`)
+    .join(', ');
+
+  const details = allIssues
+    .slice(0, 10)
+    .map(i => `[${i.severity}] ${i.tool} — ${i.finding}`)
+    .join('\n');
+
+  const overallSeverity = allIssues.some(i => i.severity === 'high') ? Severity.HIGH
+    : allIssues.some(i => i.severity === 'medium') ? Severity.MEDIUM
+    : Severity.LOW;
+
+  return fail(id, overallSeverity,
+    `检测到 ${allIssues.length} 个沙箱策略不一致（${summary}）：\n${details}`,
+    '参考 dsh-sandbox-audit 获取详细修复建议',
+    ['#2066']
+  );
+}
+
+export const sp3Check = {
+  id: 'SP3',
+  name: 'sandbox-consistency',
+  severity: Severity.MEDIUM,
+  phase: CheckPhase.POST_INSTALL,
+  description: '沙箱策略配置一致性审计',
+  src: 'builtin',
+  runner: (profileDir) => run(profileDir),
+};

package/src/checks/sp4-entry-poison.mjs

@@ -0,0 +1,74 @@
+/**
+ * SP4: Entry Poison — 恶意 entry 注入检测
+ *
+ * 扫描 cordis.patch.yml 中的可疑 entry 注入模式：
+ * - 已知恶意 id 模式
+ * - 异常的 entry 配置
+ * - 可疑的 inject 依赖链
+ *
+ * Severity: HIGH
+ * Phase: POST_INSTALL
+ */
+
+import { readFileSync, existsSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { Severity } from '../protocol/severity.mjs';
+import { CheckPhase } from '../protocol/phase.mjs';
+import { pass, fail } from '../protocol/check.mjs';
+
+/** 已知恶意 entry 模式 */
+const MALICIOUS_PATTERNS = [
+  { name: 'hook injection', regex: /hook[s]?:\s*\n\s+-\s*id:\s*(hook|on|before|after)/gi, severity: 'high' },
+  { name: 'eval execution', regex: /eval\s*\(|Function\s*\(/g, severity: 'high' },
+  { name: 'child process', regex: /child_process|execSync|spawnSync/g, severity: 'medium' },
+  { name: 'network exfil', regex: /fetch\s*\(|http\.request|https\.request/g, severity: 'medium' },
+];
+
+function scanPatchFile(filePath) {
+  const findings = [];
+  let content;
+  try { content = readFileSync(filePath, 'utf8'); } catch { return findings; }
+  for (const pattern of MALICIOUS_PATTERNS) {
+    const matches = content.matchAll(new RegExp(pattern.regex.source, 'gi'));
+    for (const match of matches) {
+      findings.push({ type: pattern.name, severity: pattern.severity, snippet: match[0].slice(0, 60) });
+    }
+  }
+  return findings;
+}
+
+export async function run(profileDir) {
+  const id = 'SP4';
+  const patchFiles = [];
+  const profilePatch = join(profileDir, 'cordis.patch.yml');
+  if (existsSync(profilePatch)) patchFiles.push(profilePatch);
+
+  const nmDir = join(profileDir, 'node_modules');
+  if (existsSync(nmDir)) {
+    for (const entry of readdirSync(nmDir, { withFileTypes: true })) {
+      if (entry.name.startsWith('.') || entry.name === '.bin') continue;
+      if (entry.name.startsWith('@')) {
+        const scopeDir = join(nmDir, entry.name);
+        for (const pkg of readdirSync(scopeDir, { withFileTypes: true })) {
+          const f = join(scopeDir, pkg.name, 'cordis.patch.yml');
+          if (existsSync(f)) patchFiles.push(f);
+        }
+      } else {
+        const f = join(nmDir, entry.name, 'cordis.patch.yml');
+        if (existsSync(f)) patchFiles.push(f);
+      }
+    }
+  }
+
+  if (patchFiles.length === 0) return pass(id, Severity.HIGH, '未找到 patch 文件，跳过恶意 entry 检测');
+
+  const allFindings = [];
+  for (const f of patchFiles) allFindings.push(...scanPatchFile(f));
+
+  if (allFindings.length === 0) return pass(id, Severity.HIGH, `扫描 ${patchFiles.length} 个 patch 文件，未检测到恶意 entry 模式`);
+
+  const details = allFindings.slice(0, 10).map(f => `[${f.severity}] ${f.type}: ${f.snippet}`).join('\n');
+  return fail(id, Severity.HIGH, `检测到 ${allFindings.length} 个可疑 entry 模式：\n${details}`, '检查相关插件的 cordis.patch.yml 内容');
+}
+
+export const sp4Check = { id: 'SP4', name: 'entry-poison', severity: Severity.HIGH, phase: CheckPhase.POST_INSTALL, description: '恶意 entry 注入检测', src: 'builtin', runner: (d) => run(d) };

package/src/checks/sp5-permission-model.mjs

@@ -0,0 +1,58 @@
+/**
+ * SP5: Permission Model — 插件权限声明验证
+ *
+ * 检查插件是否声明了所需权限（capability declarations）：
+ * - 文件系统访问范围
+ * - 网络访问权限
+ * - 进程执行权限
+ *
+ * Severity: MEDIUM
+ * Phase: POST_INSTALL
+ */
+
+import { readFileSync, existsSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { Severity } from '../protocol/severity.mjs';
+import { CheckPhase } from '../protocol/phase.mjs';
+import { pass, fail } from '../protocol/check.mjs';
+
+function scanForUndeclaredCapabilities(content, pkgName) {
+  const issues = [];
+  // 检查文件系统访问但无 sandbox 声明
+  if (/tool-fs|str_replace_editor/.test(content) && !/sandbox/.test(content)) {
+    issues.push({ type: 'fs-without-sandbox', severity: 'medium', detail: `${pkgName} 使用文件系统工具但未声明 sandbox 配置` });
+  }
+  // 检查网络访问但无声明
+  if (/fetch|http\.request|curl/.test(content) && !/network|http/.test(content)) {
+    issues.push({ type: 'network-undeclared', severity: 'low', detail: `${pkgName} 有网络访问但未显式声明` });
+  }
+  return issues;
+}
+
+export async function run(profileDir) {
+  const id = 'SP5';
+  const nmDir = join(profileDir, 'node_modules');
+  if (!existsSync(nmDir)) return pass(id, Severity.MEDIUM, '无 node_modules，跳过权限验证');
+
+  const issues = [];
+  for (const entry of readdirSync(nmDir, { withFileTypes: true })) {
+    if (entry.name.startsWith('.') || entry.name === '.bin') continue;
+    const pkgPath = join(nmDir, entry.name, 'package.json');
+    if (!existsSync(pkgPath)) continue;
+    try {
+      const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
+      if (!pkg.dsh?.bundle) continue;
+      const patchPath = join(nmDir, entry.name, 'cordis.patch.yml');
+      if (existsSync(patchPath)) {
+        const content = readFileSync(patchPath, 'utf8');
+        issues.push(...scanForUndeclaredCapabilities(content, pkg.name));
+      }
+    } catch { /* skip */ }
+  }
+
+  if (issues.length === 0) return pass(id, Severity.MEDIUM, '插件权限声明一致');
+  const details = issues.slice(0, 10).map(i => `[${i.severity}] ${i.detail}`).join('\n');
+  return fail(id, Severity.MEDIUM, `检测到 ${issues.length} 个权限声明问题：\n${details}`, '为插件显式声明所需的权限范围');
+}
+
+export const sp5Check = { id: 'SP5', name: 'permission-model', severity: Severity.MEDIUM, phase: CheckPhase.POST_INSTALL, description: '插件权限声明验证', src: 'builtin', runner: (d) => run(d) };