@moonquake2004/dsh-security 0.1.2 → 0.1.3

package/README.md

@@ -2,9 +2,9 @@
 
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![npm](https://img.shields.io/npm/v/@moonquake2004/dsh-security)](https://www.npmjs.com/package/@moonquake2004/dsh-security)
-[![Tests](https://img.shields.io/badge/tests-75%2F75%20passing-brightgreen)](#)
+[![Tests](https://img.shields.io/badge/tests-80%2F80%20passing-brightgreen)](#)
 
-**DSH 生态统一安全检查框架** — 覆盖插件全生命周期（发现→安装→运行→更新→退役），18 个内置检查 + 4 个外部工具集成。
+**DSH 生态统一安全检查框架** — 覆盖插件全生命周期（发现→安装→运行→更新→退役），19 个内置检查 + 4 个外部工具集成。
 
 > Community security tool. Not an official DeepSeek project.
 
@@ -75,6 +75,7 @@ dsh-security 的目标：**建立 DSH 生态的统一安全检查层**，让任
 │  SP5: 插件权限声明验证                                    │
 │  SP6: 已知漏洞匹配 (OSV/CVE/GHSA)                        │
 │  SP7: client 产物语法预检 (#2752 白屏源 boot 前拦截)      │
+│  SP8: dist-tag 异常检测 (#2763 broken latest)            │
 │  SS1: 凭据泄露检测 (会话日志)                             │
 │  SS2: PII 数据暴露检测                                    │
 │  SS3: 插件输出敏感数据检测                                │
@@ -250,7 +251,7 @@ node --test test/*.mjs
 dsh-security/
 ├── src/
 │   ├── protocol/          # Layer 0: Check Protocol
-│   ├── checks/            # 18 个内置检查
+│   ├── checks/            # 19 个内置检查
 │   ├── integrations/      # 4 个外部工具集成
 │   ├── session-reader.mjs # 会话日志读取（明文 + zstd）
 │   ├── registry.mjs       # Check Registry（支持 setConfig 注入配置）

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moonquake2004/dsh-security",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Unified security check framework for DeepSeek Harness ecosystem — covers the full plugin lifecycle (discovery → install → runtime → update → retirement)",
   "type": "module",
   "main": "src/index.mjs",

package/src/checks/index.mjs

@@ -6,6 +6,7 @@ export { sp4Check } from './sp4-entry-poison.mjs';
 export { sp5Check } from './sp5-permission-model.mjs';
 export { sp6Check } from './sp6-vuln-match.mjs';
 export { sp7Check } from './sp7-client-syntax.mjs';
+export { sp8Check } from './sp8-dist-tag-health.mjs';
 
 // Layer 2: Runtime Checks
 export { sr1Check } from './sr1-sandbox-violation.mjs';

package/src/checks/sp8-dist-tag-health.mjs

@@ -0,0 +1,138 @@
+/**
+ * SP8: Dist-tag Health — npm dist-tag 异常检测
+ *
+ * 出处：zoahdev/dsh-ecosystem supply-chain-health 报告 + #2763——
+ * @deepseek-ai/* 子包的 dist-tags.latest 卡在 0.0.1-rc.1（broken），
+ * 导致声明 peer dep ^0.1.0-rc.6 的插件无法正确解析到可用版本。
+ * 注册表 325 个可安装插件中 79 个受影响。
+ *
+ * 做法：对每个已装 DSH 插件包（dsh 字段门控）的 peerDependencies
+ * 中引用的 @deepseek-ai/dsh-* 包，查询 npm registry dist-tags.latest：
+ * 若 latest 为明显的 broken 版本（匹配 0.0.1-rc.*），则标记该插件受影响。
+ *
+ * Severity: HIGH
+ * Phase: POST_INSTALL
+ */
+
+import { readFileSync, readdirSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { Severity } from '../protocol/severity.mjs';
+import { CheckPhase } from '../protocol/phase.mjs';
+import { pass, fail, skip } from '../protocol/check.mjs';
+
+const MAX_PKGS = 60;
+const BROKEN_LATEST_RE = /^0\.0\.1-rc\./;
+
+async function fetchDistTags(pkgName) {
+  try {
+    const url = `https://registry.npmjs.org/${encodeURIComponent(pkgName)}`;
+    const res = await fetch(url, { signal: AbortSignal.timeout(10000) });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return data['dist-tags'] || null;
+  } catch {
+    return null;
+  }
+}
+
+export async function run(profileDir) {
+  const id = 'SP8';
+  const nmDir = join(profileDir, 'node_modules');
+  if (!existsSync(nmDir)) return pass(id, Severity.HIGH, '无 node_modules，跳过 dist-tag 健康检查');
+
+  // 枚举 DSH 插件包
+  let dirEntries;
+  try { dirEntries = readdirSync(nmDir, { withFileTypes: true }); } catch { dirEntries = []; }
+
+  const plugins = [];
+  for (const entry of dirEntries) {
+    if (plugins.length >= MAX_PKGS) break;
+    if (!entry.isDirectory() || entry.name.startsWith('.') || entry.name === '.bin') continue;
+    let pkgDirs = [];
+    if (entry.name.startsWith('@')) {
+      try {
+        pkgDirs = readdirSync(join(nmDir, entry.name), { withFileTypes: true })
+          .filter(s => s.isDirectory())
+          .map(s => join(nmDir, entry.name, s.name));
+      } catch { /* skip unreadable scope */ }
+    } else {
+      pkgDirs = [join(nmDir, entry.name)];
+    }
+    for (const pd of pkgDirs) {
+      const pjPath = join(pd, 'package.json');
+      if (!existsSync(pjPath)) continue;
+      try {
+        const pkg = JSON.parse(readFileSync(pjPath, 'utf8'));
+        if (!pkg.dsh) continue;
+        const peers = pkg.peerDependencies || {};
+        const dshPeers = Object.entries(peers)
+          .filter(([k]) => k.startsWith('@deepseek-ai/dsh-'))
+          .map(([k, v]) => ({ name: k, range: v }));
+        if (dshPeers.length > 0) {
+          plugins.push({ name: pkg.name || entry.name, dshPeers });
+        }
+      } catch { continue; }
+    }
+  }
+
+  if (plugins.length === 0)
+    return pass(id, Severity.HIGH, '未发现带 @deepseek-ai/dsh-* peer 依赖的 DSH 插件，跳过 dist-tag 检查');
+
+  // 去重查询
+  const uniquePkgs = [...new Set(plugins.flatMap(p => p.dshPeers.map(dp => dp.name)))];
+  const cache = new Map();
+  let queriesFailed = 0;
+
+  for (const pkgName of uniquePkgs) {
+    const dt = await fetchDistTags(pkgName);
+    if (dt) cache.set(pkgName, dt);
+    else queriesFailed++;
+  }
+
+  if (queriesFailed === uniquePkgs.length && uniquePkgs.length > 0) {
+    return skip(id, Severity.HIGH,
+      `无法查询 npm registry（${uniquePkgs.length} 个包均查询失败），跳过 dist-tag 健康检查`);
+  }
+
+  // 逐插件检查
+  const affected = [];
+  for (const plugin of plugins) {
+    for (const dp of plugin.dshPeers) {
+      const dt = cache.get(dp.name);
+      if (!dt) continue;
+      if (BROKEN_LATEST_RE.test(dt.latest)) {
+        affected.push({
+          plugin: plugin.name,
+          peerPkg: dp.name,
+          range: dp.range,
+          brokenLatest: dt.latest,
+        });
+      }
+    }
+  }
+
+  if (affected.length === 0) {
+    return pass(id, Severity.HIGH,
+      `dist-tag 健康检查通过：${plugins.length} 个插件 / ${cache.size} 个 @deepseek-ai/dsh-* 包的 latest 均正常`);
+  }
+
+  const details = affected.slice(0, 15).map(a =>
+    `  ${a.plugin} — peer ${a.peerPkg} ${a.range} → latest=${a.brokenLatest}（broken）`
+  ).join('\n');
+
+  return fail(id, Severity.HIGH,
+    `检测到 ${affected.length} 个插件受 dist-tag 异常影响（#2763：@deepseek-ai/* 子包 latest 卡在 broken 版本）：\n${details}`,
+    '对受影响插件显式 pin 版本（dsh plugin add <pkg>@<working-version>），或等待官方修复 dist-tags',
+    ['#2763']
+  );
+}
+
+export const sp8Check = {
+  id: 'SP8',
+  name: 'dist-tag-health',
+  severity: Severity.HIGH,
+  phase: CheckPhase.POST_INSTALL,
+  description: 'npm dist-tag 异常检测——检查 @deepseek-ai/dsh-* 包的 latest 是否为 broken 版本（#2763）',
+  src: 'builtin',
+  runner: (profileDir) => run(profileDir),
+};

package/src/index.mjs

@@ -1,7 +1,7 @@
 /**
  * DSH Security Framework — 统一安全检查框架
  *
- * 为 DSH 生态提供全生命周期安全检查（18 个检查项，4 层架构）。
+ * 为 DSH 生态提供全生命周期安全检查（19 个检查项，4 层架构）。
  *
  * @example
  * import { createDefaultRegistry } from '@moonquake2004/dsh-security';
@@ -23,6 +23,7 @@ export { sp4Check } from './checks/sp4-entry-poison.mjs';
 export { sp5Check } from './checks/sp5-permission-model.mjs';
 export { sp6Check } from './checks/sp6-vuln-match.mjs';
 export { sp7Check } from './checks/sp7-client-syntax.mjs';
+export { sp8Check } from './checks/sp8-dist-tag-health.mjs';
 
 // Layer 2: Runtime Checks
 export { sr1Check } from './checks/sr1-sandbox-violation.mjs';

package/src/registry.mjs

@@ -148,6 +148,7 @@ export async function createDefaultRegistry(loadExternal = true, options = {}) {
     import('./checks/ss2-pii-exposure.mjs'),
     import('./checks/ss3-sensitive-output.mjs'),
     import('./checks/sp7-client-syntax.mjs'),
+    import('./checks/sp8-dist-tag-health.mjs'),
   ]);
   for (const mod of modules) {
     for (const val of Object.values(mod)) {