@moonquake2004/dsh-security 0.1.0

package/src/checks/sp6-vuln-match.mjs

@@ -0,0 +1,67 @@
+/**
+ * SP6: Vulnerability Match — 已知漏洞匹配
+ *
+ * 通过 OSV API 查询已知漏洞（CVE/GHSA）：
+ * - 查询 npm 包的已知漏洞
+ * - 过滤 critical/high 级别
+ * - 输出受影响的包和修复版本
+ *
+ * Severity: HIGH
+ * Phase: POST_INSTALL
+ */
+
+import { readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { Severity, maxSeverity } from '../protocol/severity.mjs';
+import { CheckPhase } from '../protocol/phase.mjs';
+import { pass, fail } from '../protocol/check.mjs';
+
+async function queryOSV(packageName, version) {
+  try {
+    const response = await fetch('https://api.osv.dev/v1/query', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ package: { name: packageName, ecosystem: 'npm' }, version }),
+      signal: AbortSignal.timeout(10000),
+    });
+    if (!response.ok) return [];
+    const data = await response.json();
+    return (data.vulns || []).map(v => ({
+      id: v.id,
+      summary: v.summary || v.details?.slice(0, 100) || 'No summary',
+      severity: v.database_specific?.severity || v.severity?.[0]?.score || 'unknown',
+      fixed: v.fix_versions?.[0] || 'unknown',
+    }));
+  } catch { return []; }
+}
+
+export async function run(profileDir) {
+  const id = 'SP6';
+  const packageJsonPath = join(profileDir, 'package.json');
+  if (!existsSync(packageJsonPath)) return pass(id, Severity.HIGH, '无 package.json，跳过漏洞匹配');
+
+  let manifest;
+  try { manifest = JSON.parse(readFileSync(packageJsonPath, 'utf8')); } catch { return pass(id, Severity.HIGH, 'package.json 解析失败'); }
+
+  const deps = manifest.dependencies || {};
+  const dshPackages = Object.entries(deps).filter(([n]) => n.includes('dsh') || n.includes('deepseek'));
+  if (dshPackages.length === 0) return pass(id, Severity.HIGH, '无 dsh 相关依赖，跳过漏洞匹配');
+
+  const allVulns = [];
+  for (const [name, version] of dshPackages.slice(0, 10)) {
+    const cleanVersion = version.replace(/^[~^>=<]/, '');
+    const vulns = await queryOSV(name, cleanVersion);
+    allVulns.push(...vulns.map(v => ({ package: name, ...v })));
+  }
+
+  if (allVulns.length === 0) return pass(id, Severity.HIGH, `查询 ${dshPackages.length} 个包，未发现已知漏洞`);
+
+  const details = allVulns.slice(0, 10).map(v => `${v.package} — ${v.id}: ${v.summary}（fixed: ${v.fixed}）`).join('\n');
+  const fixable = allVulns.filter(v => v.fixed !== 'unknown').length;
+  return fail(id, Severity.HIGH,
+    `检测到 ${allVulns.length} 个已知漏洞（${fixable} 个可修复）：\n${details}`,
+    fixable > 0 ? '升级受影响的包到修复版本' : '关注上游修复进展'
+  );
+}
+
+export const sp6Check = { id: 'SP6', name: 'vuln-match', severity: Severity.HIGH, phase: CheckPhase.POST_INSTALL, description: '已知漏洞匹配（OSV/CVE/GHSA）', src: 'builtin', runner: (d) => run(d) };

package/src/checks/sr1-sandbox-violation.mjs

@@ -0,0 +1,177 @@
+/**
+ * SR1: Sandbox Violation — 沙箱逃逸检测
+ *
+ * 分析会话日志中的工具调用，检测潜在的沙箱逃逸行为：
+ * - 写操作超出 workspace 范围
+ * - 访问系统级资源（/etc, /proc, 环境变量）
+ * - 已知逃逸模式匹配（#1769 mount remount 等）
+ *
+ * Severity: CRITICAL
+ * Phase: RUNTIME
+ */
+
+import { readFileSync, existsSync, createReadStream } from 'node:fs';
+import { createInterface } from 'node:readline';
+import { Severity } from '../protocol/severity.mjs';
+import { CheckPhase } from '../protocol/phase.mjs';
+import { pass, fail } from '../protocol/check.mjs';
+
+/** 已知逃逸模式（#1769 及同类） */
+const ESCAPE_PATTERNS = [
+  { name: 'mount remount', regex: /mount\s+.*-o\s+remount.*rw/gi, severity: 'critical', ref: '#1769' },
+  { name: 'chroot escape', regex: /chroot\s+\//gi, severity: 'critical', ref: null },
+  { name: 'nsenter', regex: /nsenter\s+/gi, severity: 'critical', ref: null },
+  { name: 'unshare', regex: /unshare\s+/gi, severity: 'high', ref: null },
+];
+
+/** 系统资源访问模式 */
+const SYSTEM_RESOURCE_PATTERNS = [
+  { name: '/etc access', regex: /\/etc\/(passwd|shadow|sudoers|hosts)/gi, severity: 'high' },
+  { name: '/proc access', regex: /\/proc\/(self|1|environ|cmdline)/gi, severity: 'high' },
+  { name: 'env dump', regex: /env\b|printenv|set\b.*\|/gi, severity: 'medium' },
+  { name: 'sudo usage', regex: /sudo\s+/gi, severity: 'high' },
+  { name: 'curl/wget to unknown', regex: /curl\s+.*\|\s*(bash|sh|node)|wget\s+.*\|\s*(bash|sh|node)/gi, severity: 'critical' },
+];
+
+/** 工作区逃逸路径模式 */
+const WORKSPACE_ESCAPE_PATTERNS = [
+  { name: 'write to /tmp', regex: /writeFileSync|writeFile|fs\.write|echo\s+.*>\s*\/tmp/gi, severity: 'low' },
+  { name: 'write to home', regex: /writeFileSync|writeFile.*\/Users\/|\/home\//gi, severity: 'low' },
+  { name: 'pipe to shell', regex: /\|\s*(bash|sh|zsh)\b/gi, severity: 'high' },
+  { name: 'exec subprocess', regex: /child_process|execSync|spawnSync|exec\b/gi, severity: 'medium' },
+];
+
+/**
+ * 从一行 JSONL 中提取工具调用信息
+ */
+function extractToolCalls(line) {
+  try {
+    const event = JSON.parse(line);
+    if (event.type !== 'tool/call' && event.type !== 'tool/result') return [];
+
+    const calls = [];
+    const data = event.data || {};
+    const name = data.name || data.tool || '';
+    const args = data.args || data.input || {};
+    const text = typeof args === 'string' ? args : JSON.stringify(args);
+
+    calls.push({
+      type: event.type,
+      name,
+      text,
+      seq: event.seq,
+      turn: event.turn,
+    });
+    return calls;
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * 扫描文本中的危险模式
+ */
+function scanPatterns(text, patterns) {
+  const findings = [];
+  for (const pattern of patterns) {
+    const matches = text.matchAll(new RegExp(pattern.regex.source, 'gi'));
+    for (const match of matches) {
+      findings.push({
+        type: pattern.name,
+        severity: pattern.severity,
+        ref: pattern.ref || null,
+        snippet: match[0].slice(0, 60),
+      });
+    }
+  }
+  return findings;
+}
+
+/**
+ * SR1 检查：分析会话日志中的沙箱逃逸行为
+ * @param {string} sessionFile - 会话日志文件路径
+ * @returns {Promise<import('../protocol/check.mjs').SecurityCheckResult>}
+ */
+export async function run(sessionFile) {
+  const id = 'SR1';
+
+  if (!sessionFile || !existsSync(sessionFile)) {
+    return pass(id, Severity.CRITICAL, '无会话日志，跳过运行时安全检查');
+  }
+
+  if (sessionFile.endsWith('.zstd')) {
+    return pass(id, Severity.CRITICAL, 'zstd 压缩的会话文件需先解压再检查');
+  }
+
+  const findings = [];
+  let lineCount = 0;
+
+  const fileStream = createReadStream(sessionFile, { encoding: 'utf8' });
+  const rl = createInterface({ input: fileStream, crlfDelay: Infinity });
+
+  for await (const line of rl) {
+    lineCount++;
+    if (!line.trim()) continue;
+
+    const calls = extractToolCalls(line);
+    for (const call of calls) {
+      // 扫描工具参数中的危险模式
+      const allPatterns = [...ESCAPE_PATTERNS, ...SYSTEM_RESOURCE_PATTERNS, ...WORKSPACE_ESCAPE_PATTERNS];
+      const textFindings = scanPatterns(call.text, allPatterns);
+      for (const f of textFindings) {
+        findings.push({
+          ...f,
+          line: lineCount,
+          tool: call.name,
+          seq: call.seq,
+          turn: call.turn,
+        });
+      }
+    }
+  }
+
+  if (findings.length === 0) {
+    return pass(id, Severity.CRITICAL, `扫描 ${lineCount} 行会话日志，未检测到沙箱逃逸行为`);
+  }
+
+  // 按严重度分组
+  const bySeverity = {};
+  for (const f of findings) {
+    if (!bySeverity[f.severity]) bySeverity[f.severity] = [];
+    bySeverity[f.severity].push(f);
+  }
+
+  const summary = Object.entries(bySeverity)
+    .map(([sev, items]) => `${sev}: ${items.length}`)
+    .join(', ');
+
+  const details = findings
+    .slice(0, 10)
+    .map(f => `[${f.severity}] 行${f.line} ${f.tool} — ${f.type}（${f.snippet}）${f.ref ? ' [' + f.ref + ']' : ''}`)
+    .join('\n');
+
+  const criticalCount = findings.filter(f => f.severity === 'critical').length;
+  const overallSeverity = criticalCount > 0 ? Severity.CRITICAL : Severity.HIGH;
+
+  const fix = criticalCount > 0
+    ? '检测到 CRITICAL 级别沙箱逃逸行为，立即检查相关工具和插件'
+    : '检查相关工具调用是否在预期的沙箱策略内';
+
+  const refs = [...new Set(findings.filter(f => f.ref).map(f => f.ref))];
+
+  return fail(id, overallSeverity,
+    `检测到 ${findings.length} 个潜在沙箱逃逸行为（${summary}）：\n${details}`,
+    fix,
+    refs
+  );
+}
+
+export const sr1Check = {
+  id: 'SR1',
+  name: 'sandbox-violation',
+  severity: Severity.CRITICAL,
+  phase: CheckPhase.RUNTIME,
+  description: '沙箱逃逸行为检测（会话日志分析）',
+  src: 'builtin',
+  runner: (sessionFile) => run(sessionFile),
+};

package/src/checks/sr2-privilege-escalation.mjs

@@ -0,0 +1,67 @@
+/**
+ * SR2: Privilege Escalation — 权限提升检测
+ *
+ * 分析会话日志中的权限提升行为：
+ * - sudo/doas 使用
+ * - 文件权限变更（chmod/chown）
+ * - 特权端口绑定
+ *
+ * Severity: HIGH
+ * Phase: RUNTIME
+ */
+
+import { existsSync, createReadStream } from 'node:fs';
+import { createInterface } from 'node:readline';
+import { Severity } from '../protocol/severity.mjs';
+import { CheckPhase } from '../protocol/phase.mjs';
+import { pass, fail } from '../protocol/check.mjs';
+
+const PRIVILEGE_PATTERNS = [
+  { name: 'sudo usage', regex: /sudo\s+/gi, severity: 'high' },
+  { name: 'chmod', regex: /chmod\s+[^/]*\s+[0-7]*7[0-7][0-7]/gi, severity: 'medium' },
+  { name: 'chown', regex: /chown\s+/gi, severity: 'medium' },
+  { name: 'setuid', regex: /setuid|setgid/gi, severity: 'high' },
+  { name: 'capability', regex: /cap_|CAP_/gi, severity: 'high' },
+];
+
+function extractToolCalls(line) {
+  try {
+    const event = JSON.parse(line);
+    if (event.type !== 'tool/call') return [];
+    const data = event.data || {};
+    return [{ name: data.name || data.tool || '', text: JSON.stringify(data.args || data.input || {}), seq: event.seq }];
+  } catch { return []; }
+}
+
+export async function run(sessionFile) {
+  const id = 'SR2';
+  if (!sessionFile || !existsSync(sessionFile)) return pass(id, Severity.HIGH, '无会话文件，跳过权限提升检测');
+  if (sessionFile.endsWith('.zstd')) return pass(id, Severity.HIGH, 'zstd 文件需先解压');
+
+  const findings = [];
+  let lineCount = 0;
+  const rl = createInterface({ input: createReadStream(sessionFile, { encoding: 'utf8' }), crlfDelay: Infinity });
+
+  for await (const line of rl) {
+    lineCount++;
+    if (!line.trim()) continue;
+    for (const call of extractToolCalls(line)) {
+      for (const pattern of PRIVILEGE_PATTERNS) {
+        for (const match of call.text.matchAll(new RegExp(pattern.regex.source, 'gi'))) {
+          findings.push({ type: pattern.name, severity: pattern.severity, line: lineCount, tool: call.name, snippet: match[0].slice(0, 40) });
+        }
+      }
+    }
+  }
+
+  if (findings.length === 0) return pass(id, Severity.HIGH, `扫描 ${lineCount} 行，未检测到权限提升行为`);
+
+  const details = findings.slice(0, 10).map(f => `[${f.severity}] 行${f.line} ${f.tool} — ${f.type}: ${f.snippet}`).join('\n');
+  const highCount = findings.filter(f => f.severity === 'high').length;
+  return fail(id, highCount > 0 ? Severity.HIGH : Severity.MEDIUM,
+    `检测到 ${findings.length} 个权限提升行为：\n${details}`,
+    '检查相关工具调用是否在预期的权限范围内'
+  );
+}
+
+export const sr2Check = { id: 'SR2', name: 'privilege-escalation', severity: Severity.HIGH, phase: CheckPhase.RUNTIME, description: '权限提升行为检测', src: 'builtin', runner: (f) => run(f) };

package/src/checks/sr3-data-exfiltration.mjs

@@ -0,0 +1,163 @@
+/**
+ * SR3: Data Exfiltration — 数据外泄检测
+ *
+ * 分析会话日志中的工具调用，检测潜在的数据外泄行为：
+ * - 大量文件读取后接网络请求
+ * - 凭据转发（将密钥传递给外部工具）
+ * - 异常的数据流模式
+ *
+ * Severity: HIGH
+ * Phase: RUNTIME
+ */
+
+import { existsSync, createReadStream } from 'node:fs';
+import { createInterface } from 'node:readline';
+import { Severity } from '../protocol/severity.mjs';
+import { CheckPhase } from '../protocol/phase.mjs';
+import { pass, fail } from '../protocol/check.mjs';
+
+/** 凭据转发模式 */
+const CREDENTIAL_FORWARD_PATTERNS = [
+  { name: 'API key in command', regex: /sk-[a-zA-Z0-9]{20,}|ghp_[a-zA-Z0-9]{36}|AKIA[0-9A-Z]{16}/g, severity: 'high' },
+  { name: 'Token in URL', regex: /https?:\/\/[^ ]*token=[^ &]+/gi, severity: 'high' },
+  { name: 'Bearer in command', regex: /Bearer\s+[a-zA-Z0-9._-]{20,}/gi, severity: 'high' },
+];
+
+/** 网络外发模式 */
+const NETWORK_EXFIL_PATTERNS = [
+  { name: 'curl POST', regex: /curl\s+.*-X\s*POST|curl\s+.*--data/gi, severity: 'medium' },
+  { name: 'wget POST', regex: /wget\s+.*--post-data/gi, severity: 'medium' },
+  { name: 'fetch API', regex: /fetch\s*\(|\.post\s*\(/gi, severity: 'low' },
+  { name: 'HTTP request with data', regex: /http\.request|https\.request|axios\.post/gi, severity: 'low' },
+];
+
+/** 大量数据读取模式 */
+const BULK_READ_PATTERNS = [
+  { name: 'read entire file', regex: /readFileSync|readFile\b|cat\s+[^|]+$/gm, severity: 'low' },
+  { name: 'directory listing', regex: /readdirSync|readdir\b|ls\s+-[la]*/gi, severity: 'low' },
+];
+
+/**
+ * 从一行 JSONL 中提取工具调用信息
+ */
+function extractToolCalls(line) {
+  try {
+    const event = JSON.parse(line);
+    if (event.type !== 'tool/call' && event.type !== 'tool/result') return [];
+
+    const calls = [];
+    const data = event.data || {};
+    const name = data.name || data.tool || '';
+    const args = data.args || data.input || {};
+    const text = typeof args === 'string' ? args : JSON.stringify(args);
+
+    calls.push({ type: event.type, name, text, seq: event.seq, turn: event.turn });
+    return calls;
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * 扫描文本中的危险模式
+ */
+function scanPatterns(text, patterns) {
+  const findings = [];
+  for (const pattern of patterns) {
+    const matches = text.matchAll(new RegExp(pattern.regex.source, 'gi'));
+    for (const match of matches) {
+      findings.push({
+        type: pattern.name,
+        severity: pattern.severity,
+        snippet: match[0].slice(0, 60),
+      });
+    }
+  }
+  return findings;
+}
+
+/**
+ * SR3 检查：分析会话日志中的数据外泄行为
+ * @param {string} sessionFile - 会话日志文件路径
+ * @returns {Promise<import('../protocol/check.mjs').SecurityCheckResult>}
+ */
+export async function run(sessionFile) {
+  const id = 'SR3';
+
+  if (!sessionFile || !existsSync(sessionFile)) {
+    return pass(id, Severity.HIGH, '无会话日志，跳过数据外泄检查');
+  }
+
+  if (sessionFile.endsWith('.zstd')) {
+    return pass(id, Severity.HIGH, 'zstd 压缩的会话文件需先解压再检查');
+  }
+
+  const findings = [];
+  let lineCount = 0;
+
+  const fileStream = createReadStream(sessionFile, { encoding: 'utf8' });
+  const rl = createInterface({ input: fileStream, crlfDelay: Infinity });
+
+  for await (const line of rl) {
+    lineCount++;
+    if (!line.trim()) continue;
+
+    const calls = extractToolCalls(line);
+    for (const call of calls) {
+      // 扫描凭据转发
+      const credFindings = scanPatterns(call.text, CREDENTIAL_FORWARD_PATTERNS);
+      for (const f of credFindings) {
+        findings.push({ ...f, line: lineCount, tool: call.name, category: 'credential-forward' });
+      }
+
+      // 扫描网络外发
+      const netFindings = scanPatterns(call.text, NETWORK_EXFIL_PATTERNS);
+      for (const f of netFindings) {
+        findings.push({ ...f, line: lineCount, tool: call.name, category: 'network-exfil' });
+      }
+    }
+  }
+
+  if (findings.length === 0) {
+    return pass(id, Severity.HIGH, `扫描 ${lineCount} 行会话日志，未检测到数据外泄行为`);
+  }
+
+  // 按类别分组
+  const byCategory = {};
+  for (const f of findings) {
+    if (!byCategory[f.category]) byCategory[f.category] = [];
+    byCategory[f.category].push(f);
+  }
+
+  const summary = Object.entries(byCategory)
+    .map(([cat, items]) => `${cat}: ${items.length}`)
+    .join(', ');
+
+  const details = findings
+    .slice(0, 10)
+    .map(f => `[${f.severity}] 行${f.line} ${f.tool} — ${f.type}（${f.snippet}）`)
+    .join('\n');
+
+  const highCount = findings.filter(f => f.severity === 'high').length;
+  const overallSeverity = highCount > 0 ? Severity.HIGH : Severity.MEDIUM;
+
+  const fix = highCount > 0
+    ? '检测到凭据转发或敏感数据外发，检查相关工具是否在传递密钥给外部服务'
+    : '检查网络请求是否在预期的数据流范围内';
+
+  return fail(id, overallSeverity,
+    `检测到 ${findings.length} 个潜在数据外泄行为（${summary}）：\n${details}`,
+    fix,
+    ['#962']
+  );
+}
+
+export const sr3Check = {
+  id: 'SR3',
+  name: 'data-exfiltration',
+  severity: Severity.HIGH,
+  phase: CheckPhase.RUNTIME,
+  description: '数据外泄行为检测（会话日志分析）',
+  src: 'builtin',
+  runner: (sessionFile) => run(sessionFile),
+};

package/src/checks/sr4-isolation-verify.mjs

@@ -0,0 +1,64 @@
+/**
+ * SR4: Isolation Verify — 插件隔离验证
+ *
+ * 分析会话日志中的跨插件数据泄漏：
+ * - 检测工具调用中的交叉引用
+ * - 检测异常的数据流模式
+ *
+ * Severity: MEDIUM
+ * Phase: RUNTIME
+ */
+
+import { existsSync, createReadStream } from 'node:fs';
+import { createInterface } from 'node:readline';
+import { Severity } from '../protocol/severity.mjs';
+import { CheckPhase } from '../protocol/phase.mjs';
+import { pass, fail } from '../protocol/check.mjs';
+
+function extractToolCalls(line) {
+  try {
+    const event = JSON.parse(line);
+    if (event.type !== 'tool/call') return [];
+    const data = event.data || {};
+    return [{ name: data.name || data.tool || '', args: data.args || data.input || {}, seq: event.seq, turn: event.turn }];
+  } catch { return []; }
+}
+
+export async function run(sessionFile) {
+  const id = 'SR4';
+  if (!sessionFile || !existsSync(sessionFile)) return pass(id, Severity.MEDIUM, '无会话文件，跳过隔离验证');
+  if (sessionFile.endsWith('.zstd')) return pass(id, Severity.MEDIUM, 'zstd 文件需先解压');
+
+  const toolCalls = [];
+  let lineCount = 0;
+  const rl = createInterface({ input: createReadStream(sessionFile, { encoding: 'utf8' }), crlfDelay: Infinity });
+
+  for await (const line of rl) {
+    lineCount++;
+    if (!line.trim()) continue;
+    toolCalls.push(...extractToolCalls(line));
+  }
+
+  // 简单的隔离检查：检测同一 turn 内不同工具的数据传递
+  const findings = [];
+  const byTurn = {};
+  for (const call of toolCalls) {
+    const turn = call.turn || 0;
+    if (!byTurn[turn]) byTurn[turn] = [];
+    byTurn[turn].push(call);
+  }
+
+  for (const [turn, calls] of Object.entries(byTurn)) {
+    const tools = new Set(calls.map(c => c.name));
+    if (tools.size > 3) {
+      findings.push({ type: 'multi-tool-turn', severity: 'low', detail: `turn ${turn} 使用了 ${tools.size} 个不同工具：${[...tools].join(', ')}` });
+    }
+  }
+
+  if (findings.length === 0) return pass(id, Severity.MEDIUM, `分析 ${toolCalls.length} 个工具调用，未检测到隔离问题`);
+
+  const details = findings.slice(0, 10).map(f => `[${f.severity}] ${f.detail}`).join('\n');
+  return fail(id, Severity.MEDIUM, `检测到 ${findings.length} 个潜在隔离问题：\n${details}`, '检查工具间的数据流是否在预期范围内');
+}
+
+export const sr4Check = { id: 'SR4', name: 'isolation-verify', severity: Severity.MEDIUM, phase: CheckPhase.RUNTIME, description: '插件隔离验证', src: 'builtin', runner: (f) => run(f) };