@moonquake2004/dsh-security 0.1.0

package/src/integrations/sandbox-audit.mjs

@@ -0,0 +1,68 @@
+/**
+ * dsh-sandbox-audit 集成
+ *
+ * 通过 Plugin Interface 注册沙箱策略审计检查。
+ * 如果 dsh-sandbox-audit 已安装，自动集成到安全检查流程。
+ */
+
+import { execSync } from 'node:child_process';
+import { Severity } from '../protocol/severity.mjs';
+import { CheckPhase } from '../protocol/phase.mjs';
+
+export function isAvailable() {
+  try {
+    execSync('which dsh-sandbox-audit', { encoding: 'utf8', stdio: 'pipe' });
+    return true;
+  } catch {
+    try {
+      execSync('npx dsh-sandbox-audit --version', { encoding: 'utf8', stdio: 'pipe', timeout: 10000 });
+      return true;
+    } catch { return false; }
+  }
+}
+
+export async function runAudit(profileDir) {
+  const id = 'EXT-SA-1';
+
+  if (!isAvailable()) {
+    return { id, ok: true, severity: Severity.MEDIUM, detail: 'dsh-sandbox-audit 未安装，跳过沙箱策略审计' };
+  }
+
+  try {
+    const output = execSync(`npx dsh-sandbox-audit "${profileDir}" --json`, {
+      encoding: 'utf8',
+      timeout: 60000,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+
+    const result = JSON.parse(output);
+
+    if (result.clean || result.findings?.length === 0) {
+      return { id, ok: true, severity: Severity.MEDIUM, detail: 'dsh-sandbox-audit 审计通过：沙箱策略配置一致' };
+    }
+
+    const findings = result.findings || [];
+    const details = findings.slice(0, 10).map(f => `[${f.severity}] ${f.tool}: ${f.finding}`).join('\n');
+
+    return {
+      id,
+      ok: false,
+      severity: Severity.MEDIUM,
+      detail: `dsh-sandbox-audit 检测到 ${findings.length} 个沙箱策略不一致：\n${details}`,
+      fix: '参考 dsh-sandbox-audit 文档修复沙箱配置',
+    };
+  } catch (e) {
+    return { id, ok: true, severity: Severity.MEDIUM, detail: `dsh-sandbox-audit 执行失败：${e.message.slice(0, 80)}` };
+  }
+}
+
+export const sandboxAuditCheck = {
+  id: 'EXT-SA-1',
+  name: 'sandbox-audit',
+  severity: Severity.MEDIUM,
+  phase: CheckPhase.POST_INSTALL,
+  description: 'dsh-sandbox-audit 沙箱策略审计',
+  src: 'external',
+  source: 'dsh-sandbox-audit',
+  runner: (profileDir) => runAudit(profileDir),
+};

package/src/protocol/check.mjs

@@ -0,0 +1,49 @@
+/**
+ * DSH Security Framework — Check Protocol 核心类型
+ *
+ * 安全检查的统一接口，任何工具都可以通过此接口注册检查。
+ */
+
+/**
+ * @typedef {Object} SecurityCheck
+ * @property {string} id - 检查 ID（SP1, SR2, EXT-PG-1 等）
+ * @property {string} name - 人类可读名称
+ * @property {string} severity - 严重度（critical/high/medium/low/info）
+ * @property {string} phase - 检查阶段（pre-install/post-install/runtime/lifecycle）
+ * @property {string} description - 描述
+ * @property {'builtin'|'external'} src - 内置 or 外部
+ * @property {string} [source] - 外部工具名
+ * @property {function(): Promise<SecurityCheckResult>} runner - 执行函数
+ */
+
+/**
+ * @typedef {Object} SecurityCheckResult
+ * @property {string} id - 检查 ID
+ * @property {boolean} ok - 是否通过
+ * @property {string} severity - 严重度
+ * @property {string} detail - 详情
+ * @property {string} [fix] - 修复建议
+ * @property {string[]} [references] - 相关讨论/漏洞编号
+ * @property {any} [evidence] - 原始证据（可选）
+ */
+
+/**
+ * 创建安全检查结果
+ */
+export function createResult(id, ok, severity, detail, fix = undefined, references = [], evidence = undefined) {
+  return { id, ok, severity, detail, fix, references, evidence };
+}
+
+/**
+ * 通过结果
+ */
+export function pass(id, severity, detail) {
+  return createResult(id, true, severity, detail);
+}
+
+/**
+ * 失败结果
+ */
+export function fail(id, severity, detail, fix, references = []) {
+  return createResult(id, false, severity, detail, fix, references);
+}

package/src/protocol/index.mjs

@@ -0,0 +1,3 @@
+export { Severity, severityToExitCode, severityGte, maxSeverity } from './severity.mjs';
+export { CheckPhase } from './phase.mjs';
+export { createResult, pass, fail } from './check.mjs';

package/src/protocol/phase.mjs

@@ -0,0 +1,16 @@
+/**
+ * DSH Security Framework — Check Phase 枚举
+ *
+ * 每个安全检查在插件生命周期的特定阶段运行：
+ *   PRE_INSTALL  — 安装前（静态分析，如投毒扫描）
+ *   POST_INSTALL — 安装后（配置审计，如密钥扫描）
+ *   RUNTIME      — 运行时（监控，如沙箱逃逸检测）
+ *   LIFECYCLE    — 生命周期（更新/退役，如版本篡改检测）
+ */
+
+export const CheckPhase = Object.freeze({
+  PRE_INSTALL: 'pre-install',
+  POST_INSTALL: 'post-install',
+  RUNTIME: 'runtime',
+  LIFECYCLE: 'lifecycle',
+});

package/src/protocol/severity.mjs

@@ -0,0 +1,40 @@
+/**
+ * DSH Security Framework — Severity 枚举
+ *
+ * severity 驱动退出码和用户通知：
+ *   CRITICAL → exit 2（阻断）
+ *   HIGH     → exit 1（警告）
+ *   MEDIUM/LOW/INFO → exit 0（信息）
+ */
+
+export const Severity = Object.freeze({
+  CRITICAL: 'critical',
+  HIGH: 'high',
+  MEDIUM: 'medium',
+  LOW: 'low',
+  INFO: 'info',
+});
+
+/** severity → 退出码映射 */
+export const severityToExitCode = Object.freeze({
+  [Severity.CRITICAL]: 2,
+  [Severity.HIGH]: 1,
+  [Severity.MEDIUM]: 0,
+  [Severity.LOW]: 0,
+  [Severity.INFO]: 0,
+});
+
+/** severity 排序（高→低） */
+const SEVERITY_ORDER = [Severity.CRITICAL, Severity.HIGH, Severity.MEDIUM, Severity.LOW, Severity.INFO];
+
+export function severityGte(a, b) {
+  return SEVERITY_ORDER.indexOf(a) <= SEVERITY_ORDER.indexOf(b);
+}
+
+/** 从一组 severity 中取最高 */
+export function maxSeverity(severities) {
+  for (const s of SEVERITY_ORDER) {
+    if (severities.includes(s)) return s;
+  }
+  return Severity.INFO;
+}

package/src/registry.mjs

@@ -0,0 +1,122 @@
+/**
+ * DSH Security Framework — Check Registry
+ *
+ * 管理安全检查的注册、发现和执行。
+ * 支持内置检查和外部工具注册的检查。
+ */
+
+import { readdirSync, readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { maxSeverity, severityToExitCode } from './protocol/severity.mjs';
+
+export class SecurityCheckRegistry {
+  constructor() {
+    /** @type {Map<string, import('./protocol/check.mjs').SecurityCheck>} */
+    this.checks = new Map();
+  }
+
+  register(check) { this.checks.set(check.id, check); }
+  registerAll(checks) { for (const check of checks) this.register(check); }
+
+  loadExternalChecks(securityDir) {
+    const checksDir = join(securityDir, 'checks.d');
+    if (!existsSync(checksDir)) return;
+    const files = readdirSync(checksDir).filter(f => f.endsWith('.json'));
+    for (const file of files) {
+      try {
+        const reg = JSON.parse(readFileSync(join(checksDir, file), 'utf8'));
+        if (reg.checks && Array.isArray(reg.checks)) {
+          for (const ext of reg.checks) {
+            this.register({
+              id: ext.id, name: ext.name, severity: ext.severity, phase: ext.phase,
+              description: ext.description, src: 'external', source: reg.source,
+              runner: async () => {
+                const { execSync } = await import('node:child_process');
+                try {
+                  const output = execSync(ext.command, { encoding: 'utf8', timeout: 30000 });
+                  const result = JSON.parse(output);
+                  return { id: ext.id, ok: result.ok ?? true, severity: ext.severity, detail: result.detail || 'External check completed', fix: result.fix, references: result.references };
+                } catch (e) {
+                  return { id: ext.id, ok: false, severity: ext.severity, detail: `External check failed: ${e.message}` };
+                }
+              },
+            });
+          }
+        }
+      } catch { /* skip invalid JSON */ }
+    }
+  }
+
+  getByPhase(phase) { return [...this.checks.values()].filter(c => c.phase === phase); }
+
+  getBySeverity(minSeverity) {
+    const order = ['critical', 'high', 'medium', 'low', 'info'];
+    const minIdx = order.indexOf(minSeverity);
+    return [...this.checks.values()].filter(c => order.indexOf(c.severity) <= minIdx);
+  }
+
+  async runAll(contextFn, phase = null) {
+    const checks = phase ? this.getByPhase(phase) : [...this.checks.values()];
+    const results = [];
+    for (const check of checks) {
+      try {
+        const context = contextFn(check);
+        const result = await check.runner(context);
+        results.push(result);
+      } catch (e) {
+        results.push({ id: check.id, ok: false, severity: check.severity, detail: `Check execution failed: ${e.message}` });
+      }
+    }
+    const summary = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+    const failedSeverities = [];
+    for (const r of results) {
+      if (!r.ok && summary[r.severity] !== undefined) {
+        summary[r.severity]++;
+        failedSeverities.push(r.severity);
+      }
+    }
+    const exitCode = failedSeverities.length > 0 ? severityToExitCode[maxSeverity(failedSeverities)] : 0;
+    return { results, exitCode, summary };
+  }
+}
+
+export async function createDefaultRegistry(loadExternal = true) {
+  const registry = new SecurityCheckRegistry();
+  const modules = await Promise.all([
+    import('./checks/sp1-dependency-audit.mjs'),
+    import('./checks/sp2-secret-scan.mjs'),
+    import('./checks/sp3-sandbox-consistency.mjs'),
+    import('./checks/sp4-entry-poison.mjs'),
+    import('./checks/sp5-permission-model.mjs'),
+    import('./checks/sp6-vuln-match.mjs'),
+    import('./checks/sr1-sandbox-violation.mjs'),
+    import('./checks/sr2-privilege-escalation.mjs'),
+    import('./checks/sr3-data-exfiltration.mjs'),
+    import('./checks/sr4-isolation-verify.mjs'),
+    import('./checks/sl1-supply-chain.mjs'),
+    import('./checks/sl2-update-integrity.mjs'),
+    import('./checks/sl3-reputation-score.mjs'),
+    import('./checks/sl4-release-compat.mjs'),
+    import('./checks/ss1-credential-leak.mjs'),
+    import('./checks/ss2-pii-exposure.mjs'),
+    import('./checks/ss3-sensitive-output.mjs'),
+  ]);
+  for (const mod of modules) {
+    for (const val of Object.values(mod)) {
+      if (val && typeof val === 'object' && val.id && val.runner) {
+        registry.register(val);
+      }
+    }
+  }
+
+  // 加载外部集成
+  if (loadExternal) {
+    try {
+      const { getAvailableIntegrations } = await import('./integrations/index.mjs');
+      const integrations = await getAvailableIntegrations();
+      registry.registerAll(integrations);
+    } catch { /* 外部集成不可用时静默跳过 */ }
+  }
+
+  return registry;
+}