@moonquake2004/dsh-security 0.1.7 → 0.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moonquake2004/dsh-security",
-  "version": "0.1.7",
+  "version": "0.2.0",
   "description": "Unified security check framework for DeepSeek Harness ecosystem — covers the full plugin lifecycle (discovery → install → runtime → update → retirement)",
   "type": "module",
   "main": "src/index.mjs",

package/src/checks/index.mjs

@@ -9,6 +9,9 @@ export { sp7Check } from './sp7-client-syntax.mjs';
 export { sp8Check } from './sp8-dist-tag-health.mjs';
 export { sp9Check } from './sp9-dual-instance-guard.mjs';
 export { sp10Check } from './sp10-poison-pattern.mjs';
+export { sp11Check } from './sp11-patch-security-override.mjs';
+export { sp12Check } from './sp12-config-as-code-tag.mjs';
+export { sp13Check } from './sp13-tools-mode-sandbox.mjs';
 
 // Layer 2: Runtime Checks
 export { sr1Check } from './sr1-sandbox-violation.mjs';

package/src/checks/sl1-supply-chain.mjs

@@ -62,6 +62,7 @@ export function compareVersions(localPkg, registryInfo, localLockIntegrity = nul
     issues.push({
       type: 'version-mismatch',
       severity: 'medium',
+      informational: true, // 只是"不新鲜"，不是完整性/供应链风险 —— 不参与判定（2026-09 审计结论）
       detail: `本地版本 ${localVersion} ≠ registry latest ${latestVersion}`,
     });
   }
@@ -152,25 +153,29 @@ export async function run(profileDir) {
     return skip(id, Severity.HIGH, `${errors} 个包 registry 查询失败（离线或网络受限），跳过供应链验证`);
   }
 
-  if (allIssues.length === 0) {
+  const material = allIssues.filter(i => !i.informational); // 完整性类才是"问题"
+  const outdated = allIssues.filter(i => i.informational);
+
+  if (material.length === 0) {
     return pass(id, Severity.HIGH,
       `验证 ${checked} 个包的供应链完整性，未发现异常${errors > 0 ? `（${errors} 个包查询失败）` : ''}`
+      + (outdated.length ? `；另有 ${outdated.length} 个包版本落后于 registry latest（不新鲜，非完整性问题）` : '')
     );
   }
 
-  const criticalIssues = allIssues.filter(i => i.severity === 'critical');
-  const overallSeverity = criticalIssues.length > 0 ? Severity.CRITICAL : maxSeverity(allIssues.map(i => i.severity === 'critical' ? Severity.CRITICAL : i.severity === 'medium' ? Severity.MEDIUM : Severity.LOW));
+  const criticalIssues = material.filter(i => i.severity === 'critical');
+  const overallSeverity = criticalIssues.length > 0 ? Severity.CRITICAL : maxSeverity(material.map(i => i.severity === 'critical' ? Severity.CRITICAL : i.severity === 'medium' ? Severity.MEDIUM : Severity.LOW));
 
-  const details = allIssues
+  const details = material
     .map(i => `[${i.severity}] ${i.package} — ${i.type}: ${i.detail}`)
-    .join('\n');
+    .join('\n') + (outdated.length ? `\n（另有 ${outdated.length} 个包版本落后，未计入问题）` : '');
 
   const fix = criticalIssues.length > 0
     ? '检测到 integrity hash 不匹配，可能是包被篡改。立即重新安装受影响的包'
     : '部分包版本落后于 registry latest，建议更新';
 
   return fail(id, overallSeverity,
-    `检测到 ${allIssues.length} 个供应链问题（${checked} 个包已验证${errors > 0 ? `，${errors} 个查询失败` : ''}）：\n${details}`,
+    `检测到 ${material.length} 个供应链问题（${checked} 个包已验证${errors > 0 ? `，${errors} 个查询失败` : ''}）：\n${details}`,
     fix
   );
 }

package/src/checks/sl4-release-compat.mjs

@@ -57,6 +57,7 @@ function checkCompatibility(localVersion, distTags) {
       issues.push({
         type: 'latest-is-prerelease',
         severity: 'medium',
+        informational: true, // 全生态都在 rc 线上，这属常态描述而非兼容性问题（2026-09 审计结论）
         detail: `latest 标签指向预发布版本 ${distTags.latest}，可能不稳定`,
       });
     }
@@ -67,6 +68,7 @@ function checkCompatibility(localVersion, distTags) {
     issues.push({
       type: 'next-available',
       severity: 'low',
+      informational: true,
       detail: `有 next 标签 ${distTags.next} 可用（当前 latest: ${distTags.latest}）`,
     });
   }
@@ -140,17 +142,23 @@ export async function run(profileDir) {
     );
   }
 
-  const mediumIssues = allIssues.filter(i => i.severity === 'medium');
+  const material = allIssues.filter(i => !i.informational);
+  if (material.length === 0) {
+    return pass(id, Severity.LOW,
+      `验证 ${checked} 个包的发布兼容性，未发现兼容性问题`
+      + (allIssues.length ? `；另有 ${allIssues.length} 条常态提示（预发布 latest / next 可用）未计入` : ''));
+  }
+  const mediumIssues = material.filter(i => i.severity === 'medium');
   const overallSeverity = mediumIssues.length > 0 ? Severity.MEDIUM : Severity.LOW;
 
-  const details = allIssues
+  const details = material
     .map(i => `[${i.severity}] ${i.package} — ${i.type}: ${i.detail}`)
     .join('\n');
 
   const fix = '检查是否有重要更新需要应用，或确认当前版本满足需求';
 
   return fail(id, overallSeverity,
-    `检测到 ${allIssues.length} 个发布兼容性问题（${checked} 个包已验证）：\n${details}`,
+    `检测到 ${material.length} 个发布兼容性问题（${checked} 个包已验证）：\n${details}`,
     fix
   );
 }

package/src/checks/sp1-dependency-audit.mjs

@@ -1,82 +1,88 @@
 /**
  * SP1: Dependency Audit — 依赖链漏洞扫描
  *
- * 集成 npm audit 检查 profile 中已安装插件的已知漏洞。
- * 支持 npm audit 和 osv-scanner 两种后端。
+ * 对 profile 的依赖锁文件执行真实审计：
+ *   - pnpm-lock.yaml  → `pnpm audit --json --prod`
+ *   - package-lock.json → `npm audit --json --omit=dev`
+ *
+ * 契约（2026-09 上游兼容审计 R9 修复）：
+ *   任何"审计没有真正执行"的情况都必须返回 **skip + 原因**，
+ *   绝不允许静默 PASS。旧实现在 pnpm profile（无 package-lock.json）上
+ *   把 npm 的 ENOLOCK 错误当成"无漏洞"，永久输出
+ *   `依赖链无已知漏洞（扫描 ? 个依赖）` 的假 PASS。
  *
  * Severity: HIGH（有 critical/high 漏洞时）
  * Phase: POST_INSTALL
  */
 
-import { execSync } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { Severity, maxSeverity } from '../protocol/severity.mjs';
 import { CheckPhase } from '../protocol/phase.mjs';
-import { pass, fail } from '../protocol/check.mjs';
+import { pass, fail, skip } from '../protocol/check.mjs';
+
+const AUDIT_TIMEOUT_MS = 60000;
+const MAX_BUFFER = 32 * 1024 * 1024;
 
 /**
- * 运行 npm audit 并解析结果
+ * 选审计后端：锁文件决定包管理器。没有锁文件就没有可审计的依赖图。
+ * @returns {{pm: string, lock: string, args: string[]}|null}
  */
-function runNpmAudit(profileDir) {
-  const packageJsonPath = join(profileDir, 'package.json');
-  if (!existsSync(packageJsonPath)) {
-    return { vulns: [], error: 'package.json 不存在' };
+export function detectBackend(profileDir) {
+  if (existsSync(join(profileDir, 'pnpm-lock.yaml'))) {
+    return { pm: 'pnpm', lock: 'pnpm-lock.yaml', args: ['audit', '--json', '--prod'] };
   }
-
-  try {
-    const output = execSync('npm audit --json --omit=dev', {
-      cwd: profileDir,
-      encoding: 'utf8',
-      timeout: 60000,
-      stdio: ['pipe', 'pipe', 'pipe'],
-    });
-    const audit = JSON.parse(output);
-    return parseNpmAudit(audit);
-  } catch (e) {
-    // npm audit 在有漏洞时 exit code 1，这是正常的
-    if (e.stdout) {
-      try {
-        const audit = JSON.parse(e.stdout);
-        return parseNpmAudit(audit);
-      } catch {
-        return { vulns: [], error: `npm audit 解析失败: ${e.message}` };
-      }
-    }
-    return { vulns: [], error: `npm audit 执行失败: ${e.message}` };
+  if (existsSync(join(profileDir, 'package-lock.json'))) {
+    return { pm: 'npm', lock: 'package-lock.json', args: ['audit', '--json', '--omit=dev'] };
   }
+  return null;
 }
 
 /**
- * 解析 npm audit JSON 输出
+ * 解析审计 JSON（同时兼容 npm v6 `advisories` 与 npm v7+/pnpm `vulnerabilities` 两种格式）。
+ * 返回 `{ vulns, totalDependencies, totalVulnerabilities }`；
+ * 若输出里带 `error`（如 ENOLOCK / ERR_PNPM_AUDIT_NO_LOCKFILE），返回 `{ auditError, auditErrorCode }`。
  */
-function parseNpmAudit(audit) {
+export function parseAuditJson(audit) {
+  if (audit && typeof audit === 'object' && audit.error) {
+    const err = audit.error;
+    const code = err.code || 'AUDIT_ERROR';
+    return {
+      auditError: `${code}: ${err.summary || err.detail || '审计未执行'}`,
+      auditErrorCode: code,
+    };
+  }
+
   const vulns = [];
-  const advisory = audit.advisories || {};
-  const metadata = audit.metadata || {};
+  const metadata = (audit && audit.metadata) || {};
 
-  // npm v7+ 格式
-  if (audit.vulnerabilities) {
+  // npm v7+ / pnpm v9+：vulnerabilities 按包聚合
+  if (audit && audit.vulnerabilities && typeof audit.vulnerabilities === 'object') {
     for (const [name, vuln] of Object.entries(audit.vulnerabilities)) {
-      if (vuln.severity === 'info') continue;
+      const severity = vuln && vuln.severity;
+      if (!severity || severity === 'info') continue;
+      const via = Array.isArray(vuln.via) ? vuln.via.filter(v => v && typeof v === 'object') : [];
       vulns.push({
         package: name,
-        severity: vuln.severity,
-        title: vuln.via?.[0]?.title || 'Unknown vulnerability',
+        severity,
+        title: via[0]?.title || (typeof vuln.via?.[0] === 'string' ? vuln.via[0] : 'Unknown vulnerability'),
         range: vuln.range || 'Unknown',
         fixAvailable: !!vuln.fixAvailable,
-        url: vuln.via?.[0]?.url || '',
+        url: via[0]?.url || '',
       });
     }
   }
 
-  // npm v6 格式（advisories）
-  for (const [id, adv] of Object.entries(advisory)) {
+  // npm v6 / pnpm <= 9：advisories（keyed by id）
+  const advisories = (audit && audit.advisories) || {};
+  for (const adv of Object.values(advisories)) {
+    if (!adv || adv.severity === 'info') continue;
     vulns.push({
-      package: adv.module_name,
-      severity: adv.severity,
-      title: adv.title,
-      range: adv.vulnerable_versions,
+      package: adv.module_name || 'unknown',
+      severity: adv.severity || 'unknown',
+      title: adv.title || 'Unknown vulnerability',
+      range: adv.vulnerable_versions || 'Unknown',
       fixAvailable: !!adv.patched_versions,
       url: adv.url || '',
     });
@@ -84,11 +90,89 @@ function parseNpmAudit(audit) {
 
   return {
     vulns,
-    totalDependencies: metadata.totalDependencies || 0,
-    totalVulnerabilities: metadata.vulnerabilities?.total || vulns.length,
+    totalDependencies: resolveDependencyCount(metadata),
+    totalVulnerabilities: metadata.vulnerabilities?.total ?? vulns.length,
   };
 }
 
+/**
+ * 依赖总数：npm v6/pnpm 用 `metadata.totalDependencies`（数字）；
+ * npm v7+ 用 `metadata.dependencies.total`；pnpm 某些版本直接给数字。
+ */
+function resolveDependencyCount(metadata) {
+  if (typeof metadata.totalDependencies === 'number') return metadata.totalDependencies;
+  const deps = metadata.dependencies;
+  if (deps && typeof deps === 'object' && typeof deps.total === 'number') return deps.total;
+  if (typeof deps === 'number') return deps;
+  return null;
+}
+
+/** 判断 stderr 是否是"没有 lockfile 可审计" */
+function isNoLockfileMessage(text) {
+  return /ERR_PNPM_AUDIT_NO_LOCKFILE|ENOLOCK|requires an existing lockfile|Cannot audit a project without a lockfile/i.test(text);
+}
+
+/**
+ * 执行审计。任何未真正产出审计结论的情况 → `{ error, code }`。
+ */
+export function runAudit(backend, profileDir) {
+  let res;
+  try {
+    res = spawnSync(backend.pm, backend.args, {
+      cwd: profileDir,
+      encoding: 'utf8',
+      timeout: AUDIT_TIMEOUT_MS,
+      maxBuffer: MAX_BUFFER,
+    });
+  } catch (e) {
+    return { error: `执行 ${backend.pm} audit 失败：${e.message}`, code: 'SPAWN_FAILED' };
+  }
+
+  if (res.error) {
+    if (res.error.code === 'ENOENT') {
+      return { error: `未找到 ${backend.pm} 命令（ENOENT）`, code: 'PM_NOT_FOUND' };
+    }
+    if (res.error.code === 'ETIMEDOUT') {
+      return { error: `${backend.pm} audit 超时（${AUDIT_TIMEOUT_MS}ms）`, code: 'AUDIT_TIMEOUT' };
+    }
+    return { error: `${backend.pm} audit 执行失败：${res.error.message}`, code: res.error.code || 'SPAWN_FAILED' };
+  }
+
+  const stdout = (res.stdout || '').trim();
+  const stderr = (res.stderr || '').trim();
+
+  // 无 stdout 通常意味着包管理器拒绝了审计（无锁文件 / 无网络 / 未登录）。
+  // pnpm 12 的 ERR_PNPM_AUDIT_NO_LOCKFILE 就只写 stderr、stdout 为空。
+  if (!stdout) {
+    if (isNoLockfileMessage(stderr)) {
+      return { error: `无锁文件，无法审计：${firstLine(stderr)}`, code: 'NO_LOCKFILE' };
+    }
+    return { error: `audit 无 JSON 输出（exit ${res.status}）：${firstLine(stderr) || 'stderr 为空'}`, code: 'AUDIT_NO_OUTPUT' };
+  }
+
+  let audit;
+  try {
+    audit = JSON.parse(stdout);
+  } catch {
+    return { error: `audit 输出不是合法 JSON（exit ${res.status}）`, code: 'AUDIT_BAD_JSON' };
+  }
+
+  const parsed = parseAuditJson(audit);
+  if (parsed.auditError) return { error: parsed.auditError, code: parsed.auditErrorCode };
+  return parsed;
+}
+
+function firstLine(text) {
+  return (text || '').split('\n').map(l => l.trim()).filter(Boolean)[0] || '';
+}
+
+function auditSeverityToEnum(sev) {
+  if (sev === 'critical') return Severity.CRITICAL;
+  if (sev === 'high') return Severity.HIGH;
+  if (sev === 'moderate' || sev === 'medium') return Severity.MEDIUM;
+  return Severity.LOW;
+}
+
 /**
  * SP1 检查：扫描 profile 依赖链中的已知漏洞
  * @param {string} profileDir - profile 目录路径
@@ -98,20 +182,29 @@ export async function run(profileDir) {
   const id = 'SP1';
 
   if (!existsSync(join(profileDir, 'package.json'))) {
-    return pass(id, Severity.HIGH, 'profile 无 package.json，跳过依赖审计');
+    return skip(id, Severity.HIGH, 'profile 无 package.json，没有可审计的依赖清单，跳过依赖审计');
   }
 
-  const { vulns, error, totalDependencies } = runNpmAudit(profileDir);
+  const backend = detectBackend(profileDir);
+  if (!backend) {
+    return skip(id, Severity.HIGH,
+      'profile 无 pnpm-lock.yaml / package-lock.json，npm/pnpm audit 均无锁文件可审计（NO_LOCKFILE），跳过依赖审计');
+  }
 
-  if (error) {
-    return pass(id, Severity.HIGH, `依赖审计跳过：${error}`);
+  const result = runAudit(backend, profileDir);
+  if (result.error) {
+    return skip(id, Severity.HIGH, `依赖审计未执行（${result.code}）：${result.error}`);
   }
 
+  const { vulns } = result;
+  const depCount = result.totalDependencies;
+
   if (vulns.length === 0) {
-    return pass(id, Severity.HIGH, `依赖链无已知漏洞（扫描 ${totalDependencies || '?'} 个依赖）`);
+    const countText = typeof depCount === 'number' ? `${depCount}` : '计数不可用';
+    return pass(id, Severity.HIGH,
+      `依赖链无已知漏洞（${backend.pm} audit --json，扫描 ${countText} 个依赖）`);
   }
 
-  // 按 severity 分组
   const bySeverity = {};
   for (const v of vulns) {
     if (!bySeverity[v.severity]) bySeverity[v.severity] = [];
@@ -129,19 +222,16 @@ export async function run(profileDir) {
 
   const fixable = vulns.filter(v => v.fixAvailable).length;
   const fixHint = fixable > 0
-    ? `${fixable} 个漏洞可通过 npm fix 修复`
+    ? `${fixable} 个漏洞有可用补丁版本，可运行 ${backend.pm} audit --fix / audit fix 修复`
     : '部分漏洞可能需要升级主版本或更换依赖';
 
-  const overallSeverity = maxSeverity(vulns.map(v => {
-    if (v.severity === 'critical') return Severity.CRITICAL;
-    if (v.severity === 'high') return Severity.HIGH;
-    if (v.severity === 'moderate') return Severity.MEDIUM;
-    return Severity.LOW;
-  }));
+  const overallSeverity = maxSeverity(vulns.map(v => auditSeverityToEnum(v.severity)));
+
+  const countText = typeof depCount === 'number' ? `，共扫描 ${depCount} 个依赖` : '';
 
   return fail(id, overallSeverity,
-    `检测到 ${vulns.length} 个已知漏洞（${summary}）：\n${details}\n${fixHint}`,
-    '运行 npm audit fix 修复可自动修复的漏洞；手动升级有破坏性变更的依赖',
+    `检测到 ${vulns.length} 个已知漏洞（${summary}${countText}，来源 ${backend.pm} audit --json）：\n${details}\n${fixHint}`,
+    `运行 ${backend.pm} audit 查看详情并升级受影响依赖；优先修复 critical/high`,
     vulns.filter(v => v.url).slice(0, 3).map(v => v.url)
   );
 }
@@ -151,7 +241,7 @@ export const sp1Check = {
   name: 'dependency-audit',
   severity: Severity.HIGH,
   phase: CheckPhase.POST_INSTALL,
-  description: '依赖链已知漏洞扫描（npm audit）',
+  description: '依赖链已知漏洞扫描（pnpm/npm audit）',
   src: 'builtin',
   runner: (profileDir) => run(profileDir),
 };

package/src/checks/sp11-patch-security-override.mjs

@@ -0,0 +1,132 @@
+/**
+ * SP11: Patch-layer security-row override —— 第三方 patch 层静默改写安全配置
+ *
+ * 威胁（#587 / #4094）：Cordis patch 语义是"按 id 覆盖 + 后写获胜"，且**没有受保护行**。
+ * 于是一个第三方 bundle 的 cordis.patch.yml 可以在 boot 时静默改写
+ * sandbox / approval / permission 这类安全行（例如把 sandbox 模式放宽到 danger-full-access、
+ * 把 approval 策略改成 never），而用户与既有检查都看不到——SP3/SP4 只做文本模式扫描，从不看**组合结果**。
+ *
+ * 本检查离线判定：把各层 patch 里触及安全行的条目找出来，并按**层来源**分级——
+ *   - 第三方 bundle / profile 的 node_modules 内 → error（用户并未主动同意）
+ *   - 用户自己的 profile patch → 只作提示（用户有权自己改）
+ *
+ * Severity: CRITICAL  Phase: POST_INSTALL
+ */
+
+import { readFileSync, existsSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { Severity } from '../protocol/severity.mjs';
+import { CheckPhase } from '../protocol/phase.mjs';
+import { pass, fail, skip } from '../protocol/check.mjs';
+
+/** 安全行 id / 配置键：被改写即影响宿主安全姿态 */
+const SECURITY_ROW_IDS = ['sandbox-policy', 'approval', 'permission'];
+const SECURITY_KEYS = ['sandbox-policy', 'sandboxPolicy', 'approval', 'permission', 'defaultPreset', 'presets', 'policy'];
+
+/** 收集各层 patch 文件，并标注来源层（bundle=第三方 / user=用户自有） */
+export function collectPatchLayers(profileDir) {
+  const layers = [];
+  const userPatch = join(profileDir, 'cordis.patch.yml');
+  if (existsSync(userPatch)) layers.push({ file: userPatch, layer: 'user' });
+
+  const nmDir = join(profileDir, 'node_modules');
+  if (existsSync(nmDir)) {
+    let entries = [];
+    try { entries = readdirSync(nmDir, { withFileTypes: true }); } catch { entries = []; }
+    for (const entry of entries) {
+      if (entry.name.startsWith('.')) continue;
+      if (entry.name.startsWith('@')) {
+        const scopeDir = join(nmDir, entry.name);
+        let pkgs = [];
+        try { pkgs = readdirSync(scopeDir, { withFileTypes: true }); } catch { continue; }
+        for (const pkg of pkgs) {
+          const f = join(scopeDir, pkg.name, 'cordis.patch.yml');
+          if (existsSync(f)) layers.push({ file: f, layer: 'bundle', pkg: `${entry.name}/${pkg.name}` });
+        }
+      } else {
+        const f = join(nmDir, entry.name, 'cordis.patch.yml');
+        if (existsSync(f)) layers.push({ file: f, layer: 'bundle', pkg: entry.name });
+      }
+    }
+  }
+  return layers;
+}
+
+/**
+ * 从 patch 文本里找出触及安全行的条目。
+ * 采用保守的行扫描（不引入 YAML 依赖）：命中安全 id 或安全键即记录，并带上该行上下文。
+ */
+export function securityTouches(text) {
+  const hits = [];
+  const lines = text.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue; // 注释不算
+    for (const id of SECURITY_ROW_IDS) {
+      if (new RegExp(`(^|[-\\s'"])${id}(['"\\s:]|$)`).test(trimmed)) {
+        hits.push({ line: i + 1, kind: 'row-id', value: id, text: trimmed.slice(0, 120) });
+        break;
+      }
+    }
+    for (const key of SECURITY_KEYS) {
+      if (new RegExp(`^\\s*${key}\\s*:`).test(line) || new RegExp(`['"]?${key}['"]?\\s*:`).test(trimmed)) {
+        if (!hits.some((h) => h.line === i + 1)) hits.push({ line: i + 1, kind: 'key', value: key, text: trimmed.slice(0, 120) });
+        break;
+      }
+    }
+  }
+  return hits;
+}
+
+export async function run(profileDir) {
+  const id = 'SP11';
+  if (!profileDir || !existsSync(profileDir)) {
+    return skip(id, Severity.CRITICAL, '无 profile 目录，跳过 patch 层安全行覆盖检测');
+  }
+
+  const layers = collectPatchLayers(profileDir);
+  if (layers.length === 0) {
+    return skip(id, Severity.CRITICAL, '未找到任何 cordis.patch.yml，无法判定 patch 层是否改写安全行');
+  }
+
+  const bundleHits = [];
+  const userHits = [];
+  for (const { file, layer, pkg } of layers) {
+    let text;
+    try { text = readFileSync(file, 'utf8'); } catch { continue; }
+    const hits = securityTouches(text);
+    if (hits.length === 0) continue;
+    const sample = hits.slice(0, 3).map((h) => `行${h.line} ${h.value}: ${h.text}`).join('; ');
+    if (layer === 'bundle') bundleHits.push(`${pkg || file}（${sample}）`);
+    else userHits.push(`${file}（${hits.length} 处：${sample}）`);
+  }
+
+  if (bundleHits.length > 0) {
+    return fail(id, Severity.CRITICAL,
+      `第三方 patch 层改写了安全配置行（sandbox / approval / permission）——patch 按 id 覆盖且后写获胜，`
+      + `宿主没有受保护行，因此这类改写会在 boot 时静默生效（#587/#4094）：\n  ${bundleHits.join('\n  ')}`
+      + (userHits.length ? `\n（用户自有 patch 另有 ${userHits.length} 处，属用户自主配置）` : ''),
+      '审查上述插件的 cordis.patch.yml，确认其修改安全行是必要的；如非必要，向作者反馈或移除该插件；'
+      + '在宿主提供"受保护行"机制前，安全相关配置应只由用户层设置',
+      ['#587', '#4094']
+    );
+  }
+
+  if (userHits.length > 0) {
+    return pass(id, Severity.CRITICAL,
+      `安全行仅由用户自有 patch 触及（${userHits.length} 处），无第三方层改写：${userHits.join('; ')}`);
+  }
+
+  return pass(id, Severity.CRITICAL, `扫描 ${layers.length} 个 patch 层，无任何层改写 sandbox/approval/permission 安全行`);
+}
+
+export const sp11Check = {
+  id: 'SP11',
+  name: 'patch-security-override',
+  severity: Severity.CRITICAL,
+  phase: CheckPhase.POST_INSTALL,
+  description: '第三方 patch 层静默改写安全配置行（sandbox/approval/permission）——patch 无受保护行（#587/#4094）',
+  src: 'builtin',
+  runner: (profileDir) => run(profileDir),
+};

package/src/checks/sp12-config-as-code-tag.mjs

@@ -0,0 +1,125 @@
+/**
+ * SP12: `!!js` 配置即代码标签 + `dsh.bundle.patch` 路径健全性
+ *
+ * 威胁（#454 / #587 / #3354）：宿主用 js-yaml 解析 patch，并**支持 `!!js` 标签**——
+ * 该标签会在**加载期求值任意 JavaScript**。也就是说一个插件的 cordis.patch.yml 里写
+ *   mode: !!js <任意表达式>
+ * 就能在 boot 时执行代码（已实测的宿主 RCE 面）。SP4 的正则只看投毒关键词，**不识别 `!!js` 标签本身**，
+ * 也不区分"第三方层"与"用户自己写的 patch"。
+ *
+ * 另查 `dsh.bundle.patch` 的路径健全性：声明的 patch 必须存在且不逃出包目录（`../` 逃逸 = 越权读宿主文件）。
+ *
+ * 分级：第三方 bundle → error（用户未同意）；用户自有 patch → 提示（用户有权自己写 JS）。
+ * Severity: CRITICAL  Phase: POST_INSTALL
+ */
+
+import { readFileSync, existsSync, realpathSync, readdirSync } from 'node:fs';
+import { join, resolve, relative } from 'node:path';
+import { Severity } from '../protocol/severity.mjs';
+import { CheckPhase } from '../protocol/phase.mjs';
+import { pass, fail, skip } from '../protocol/check.mjs';
+import { collectPatchLayers } from './sp11-patch-security-override.mjs';
+
+/** 找出 `!!js` 标签出现处（行级，带上下文），排除注释行 */
+export function jsTagHits(text) {
+  const hits = [];
+  const lines = text.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const t = lines[i].trim();
+    if (!t || t.startsWith('#')) continue;
+    if (/!!js\b/.test(t)) hits.push({ line: i + 1, text: t.slice(0, 120) });
+  }
+  return hits;
+}
+
+/** 检查每个已装 bundle 的 dsh.bundle.patch 是否健在且未逃出包目录。 */
+export function bundlePatchIssues(profileDir) {
+  const issues = [];
+  const nmDir = join(profileDir, 'node_modules');
+  if (!existsSync(nmDir)) return issues;
+  let entries = [];
+  try { entries = readdirSync(nmDir, { withFileTypes: true }); } catch { return issues; }
+
+  const checkPkg = (dir, name) => {
+    const manifest = join(dir, 'package.json');
+    if (!existsSync(manifest)) return;
+    let pkg;
+    try { pkg = JSON.parse(readFileSync(manifest, 'utf8')); } catch { return; }
+    const declared = pkg?.dsh?.bundle?.patch ?? pkg?.dsh?.bundle;
+    const rel = typeof declared === 'string' ? declared : (declared && typeof declared.patch === 'string' ? declared.patch : null);
+    if (!rel) return;
+    const target = resolve(dir, rel);
+    if (!existsSync(target)) { issues.push(`${name}: dsh.bundle.patch 指向的 ${rel} 不存在（安装不完整）`); return; }
+    // 两侧都必须做 realpath：macOS 的 /var → /private/var 等 symlink 会让单侧解析出假的 `../..`
+    let realDir = resolve(dir);
+    let realTarget = target;
+    try { realDir = realpathSync(dir); } catch { /* 用 resolve 结果 */ }
+    try { realTarget = realpathSync(target); } catch { /* 用 resolve 结果 */ }
+    if (relative(realDir, realTarget).startsWith('..')) {
+      issues.push(`${name}: dsh.bundle.patch 指向包目录之外（${rel}）——可读宿主任意文件`);
+    }
+  };
+
+  for (const entry of entries) {
+    if (entry.name.startsWith('.')) continue;
+    if (entry.name.startsWith('@')) {
+      const scopeDir = join(nmDir, entry.name);
+      let pkgs = [];
+      try { pkgs = readdirSync(scopeDir, { withFileTypes: true }); } catch { continue; }
+      for (const p of pkgs) checkPkg(join(scopeDir, p.name), `${entry.name}/${p.name}`);
+    } else {
+      checkPkg(join(nmDir, entry.name), entry.name);
+    }
+  }
+  return issues;
+}
+
+export async function run(profileDir) {
+  const id = 'SP12';
+  if (!profileDir || !existsSync(profileDir)) {
+    return skip(id, Severity.CRITICAL, '无 profile 目录，跳过 !!js 配置即代码检测');
+  }
+
+  const layers = collectPatchLayers(profileDir);
+  const bundleHits = [];
+  const userHits = [];
+  for (const { file, layer, pkg } of layers) {
+    let text;
+    try { text = readFileSync(file, 'utf8'); } catch { continue; }
+    const hits = jsTagHits(text);
+    if (!hits.length) continue;
+    const sample = hits.slice(0, 3).map((h) => `行${h.line}: ${h.text}`).join('; ');
+    if (layer === 'bundle') bundleHits.push(`${pkg || file}（${sample}）`);
+    else userHits.push(`${file}（${sample}）`);
+  }
+
+  const patchIssues = bundlePatchIssues(profileDir);
+
+  if (bundleHits.length > 0 || patchIssues.length > 0) {
+    const parts = [];
+    if (bundleHits.length) {
+      parts.push(`第三方 patch 使用 !!js 标签（**加载期执行任意 JavaScript**，#454/#587/#3354）：\n  ${bundleHits.join('\n  ')}`);
+    }
+    if (patchIssues.length) parts.push(`dsh.bundle.patch 路径异常：\n  ${patchIssues.join('\n  ')}`);
+    return fail(id, Severity.CRITICAL,
+      parts.join('\n') + (userHits.length ? `\n（用户自有 patch 另有 !!js ${userHits.length} 处，属用户自主配置）` : ''),
+      '要求该插件移除 !!js 标签（改用静态配置值）；若确需动态配置，应由用户在自己的 profile patch 里写。'
+      + '同时修正 dsh.bundle.patch 指向，使其存在于包内',
+      ['#454', '#587', '#3354']
+    );
+  }
+
+  const note = userHits.length ? `；用户自有 patch 含 ${userHits.length} 处 !!js（用户自主配置，仅提示）` : '';
+  return pass(id, Severity.CRITICAL,
+    `扫描 ${layers.length} 个 patch 层：第三方层无 !!js 标签；${patchIssues.length === 0 ? 'dsh.bundle.patch 路径均健全' : ''}${note}`);
+}
+
+export const sp12Check = {
+  id: 'SP12',
+  name: 'config-as-code-tag',
+  severity: Severity.CRITICAL,
+  phase: CheckPhase.POST_INSTALL,
+  description: '!!js 配置即代码（加载期执行 JS，实测宿主 RCE 面）+ dsh.bundle.patch 路径健全性（#454/#587/#3354）',
+  src: 'builtin',
+  runner: (profileDir) => run(profileDir),
+};