@moonquake2004/dsh-security 0.1.7 → 0.2.0

package/src/checks/sp9-dual-instance-guard.mjs

@@ -1,31 +1,51 @@
 /**
- * SP9: Dual-Instance Guard — CLI 核心包泄漏检测
+ * SP9: Dual-Instance Guard — 真实重复实例检测（不是「名字出现」检测）
  *
  * 出处：#4640 + zoahdev/dsh-ecosystem 家族 4——profile 的 node_modules
- * 中若出现 @deepseek-ai/dsh-* 包（尤其是 dsh-tools），会导致同一进程
- * 两份副本 → TOOL_RUNTIME_SCHEDULER 唯一 symbol 分裂 →
- * undefined.prepare → 所有工具调用失败 → 会话不可恢复。
+ * 中若出现 @deepseek-ai/dsh-* 的**真实副本**，会导致同一进程两份模块实例
+ * → TOOL_RUNTIME_SCHEDULER 唯一 symbol 分裂 → undefined.prepare →
+ * 所有工具调用失败 → 会话不可恢复。
  *
- * 核心规则：profile 只承载 surfaces 和 plugins；core packages 由 CLI
- * 自身的依赖树提供。profile 中出现任何 @deepseek-ai/dsh-* 包即为异常。
+ * 2026-09 上游兼容审计 R5——旧模型（v0.1.7 及以前）的前提是**反的**：
+ * `$DSH_HOME/profiles/node_modules` 自 0.1.5 起是 **dsh 自有的符号链接镜像**，
+ * 由 `healProfilesModuleFallback`（dsh-app-boot/lib/index.js:660-690）写成，
+ * 镜像的是 CLI 安装闭包（实测 240 条 @deepseek-ai 符号链接、**0 个真实目录**），
+ * 其中**合法包含** dsh-tools / dsh-agent-loop 等核心运行时包。
+ * 旧实现用 `readdirSync().isDirectory()` 判断，符号链接恒为 false，
+ * 因此对同一棵树既「全盲」（镜像）又「会误报 CRITICAL」（若过滤放开）。
  *
- * 做法：扫描 profile/node_modules/@deepseek-ai/ 下的目录，
- * 检查是否存在 dsh-* 包（排除纯客户端包如 dsh-client-*，
- * 因为它们可能被插件合法引用；只报 dsh-tools/dsh-agent-loop
- * 等核心运行时包）。
+ * 现在的判据是**解析后的真实形态与来源**，而不是包名：
+ *   - 真实目录（非符号链接）→ 真实副本 = 风险（核心包 CRITICAL / 其余 HIGH）
+ *   - 符号链接目标**落在安装前缀之外**（例如指向 ~/.npm/_npx/ 残渣）→ 来源不可信 = HIGH
+ *   - 符号链接目标落在安装前缀内 → dsh 自有镜像 = **预期形态，不报**
+ *   - 断链 → 既不预期也不可信，**绝不静默忽略**（计入环境告警，并在 detail 中点名）
  *
- * Severity: CRITICAL（直接导致工具调用全灭）
+ * 同时扫描两处（同一 profile 的两级父目录查找，符号链接镜像通常在父级）：
+ *   - `<profileDir>/node_modules/@deepseek-ai/`（profile 自身的真实安装）
+ *   - `<dshHome>/profiles/node_modules/@deepseek-ai/`（共享镜像，**这一级正是旧实现全盲的位置**）
+ *
+ * 环境告警（不单独产生 FAIL，但必须出现在 detail 中，逐范围如实报数）：
+ *   - 断链数量（实测：共享镜像 118 / 240 @deepseek-ai 链接全部可解析）
+ *   - 指向 ~/.npm/_npx/ 残渣的链接数量（实测 95 条）
+ *
+ * Severity: CRITICAL（真实副本直接导致工具调用全灭）
  * Phase: POST_INSTALL
  */
 
-import { readFileSync, readdirSync, existsSync } from 'node:fs';
-import { join } from 'node:path';
+import { readdirSync, lstatSync, readlinkSync, readFileSync, existsSync } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
 import { Severity } from '../protocol/severity.mjs';
 import { CheckPhase } from '../protocol/phase.mjs';
-import { pass, fail, skip } from '../protocol/check.mjs';
+import { createResult, fail, skip } from '../protocol/check.mjs';
+import {
+  resolveInstallPrefix,
+  resolveSharedMirrorDir,
+  resolveLinkTarget,
+  isInsidePrefix,
+} from '../install-tree.mjs';
 
 /**
- * CLI 核心运行时包——出现在 profile 中即为异常。
+ * CLI 核心运行时包——出现**真实副本**即为 CRITICAL。
  * 客户端包（dsh-client-*）被插件合法引用，不在此列。
  */
 const CORE_RUNTIME_PKGS = new Set([
@@ -35,63 +55,227 @@ const CORE_RUNTIME_PKGS = new Set([
   'dsh-subprocess-local',
 ]);
 
-export async function run(profileDir) {
-  const id = 'SP9';
-  const nmDir = join(profileDir, 'node_modules');
-  if (!existsSync(nmDir)) return pass(id, Severity.CRITICAL, '无 node_modules，跳过核心包泄漏检测');
+/** npx 缓存布局——出现即代表「镜像代际腐烂」，与审计中诊断定位器的腐烂同类 */
+const NPX_RESIDUE_RE = /[/\\]\.npm[/\\]_npx[/\\]/;
 
-  const dsDir = join(nmDir, '@deepseek-ai');
-  if (!existsSync(dsDir)) return pass(id, Severity.CRITICAL, 'profile 中无 @deepseek-ai 包，无泄漏风险');
+/**
+ * 同一 profile 的两级父目录查找（镜像通常在 `<dshHome>/profiles/node_modules`）。
+ * 入参路径**按原样**保留（避免 realpath 归一后与调用方路径写法不一致造成重复扫描）。
+ * @returns {string[]} 待扫描/告警的 node_modules 根目录
+ */
+function candidateNodeModulesRoots(profileDir) {
+  const out = [join(profileDir, 'node_modules')];
+  const shared = resolveSharedMirrorDir(profileDir);
+  out.push(shared || join(dirname(profileDir), 'node_modules'));
+  return [...new Set(out)];
+}
+
+/** 该 node_modules 根是否为共享镜像（`<dshHome>/profiles/node_modules`） */
+function isMirrorRoot(root) {
+  return basename(dirname(root)) === 'profiles';
+}
+
+/**
+ * 符号链接代际统计：只覆盖 node_modules 的**直接包层**（depth 1–2，
+ * 即 `pkg` 与 `@scope/pkg`），不深入包的内部依赖子目录。
+ * 口径与 2026-09 审计一致：`$DSH_HOME/profiles/node_modules` = 603 条链接
+ * （118 断链 / 95 指向 ~/.npm/_npx/）。
+ */
+function countMirrorLinks(root) {
+  let total = 0, broken = 0, npx = 0;
+  const leafOf = (p) => { try { return readlinkSync(p); } catch { return ''; } };
+  const handle = (p) => {
+    let st;
+    try { st = lstatSync(p); } catch { return false; }
+    if (st.isSymbolicLink()) {
+      total++;
+      const raw = leafOf(p);
+      if (!existsSync(p)) broken++;
+      if (NPX_RESIDUE_RE.test(raw)) npx++;
+      return true;
+    }
+    return false;
+  };
+
+  let level1;
+  try { level1 = readdirSync(root, { withFileTypes: true }); } catch { return { total, broken, npx }; }
+  for (const entry of level1) {
+    const p = join(root, entry.name);
+    if (!handle(p)) {
+      // 真实目录；scoped 包需要看第二层
+      if (entry.name.startsWith('@')) {
+        let level2;
+        try { level2 = readdirSync(p, { withFileTypes: true }); } catch { continue; }
+        for (const child of level2) handle(join(p, child.name));
+      }
+    }
+  }
+  return { total, broken, npx };
+}
+
+function classify(scopeDir, installPrefix, sourceLabel) {
+  const realDirs = [], outside = [], expected = [], broken = [];
+  let unresolved = 0;
 
-  // 枚举 @deepseek-ai/* 下的包
   let entries;
-  try { entries = readdirSync(dsDir, { withFileTypes: true }); } catch { entries = []; }
+  try { entries = readdirSync(scopeDir, { withFileTypes: true }); } catch { entries = []; }
 
-  const leaked = [];
   for (const entry of entries) {
-    if (!entry.isDirectory()) continue;
-    const pkgName = `@deepseek-ai/${entry.name}`;
-    const pjPath = join(dsDir, entry.name, 'package.json');
-    if (!existsSync(pjPath)) continue;
-
-    let version = '?';
-    try {
-      const pkg = JSON.parse(readFileSync(pjPath, 'utf8'));
-      version = pkg.version || '?';
-    } catch { /* read error */ }
-
-    if (entry.name.startsWith('dsh-')) {
-      leaked.push({ name: pkgName, version, isCore: CORE_RUNTIME_PKGS.has(entry.name) });
+    if (!entry.name.startsWith('dsh-')) continue;
+    const p = join(scopeDir, entry.name);
+    let st;
+    try { st = lstatSync(p); } catch { continue; }
+
+    if (st.isSymbolicLink()) {
+      let raw = '';
+      try { raw = readlinkSync(p); } catch { raw = ''; }
+      if (!existsSync(p)) { broken.push({ name: entry.name, target: raw, source: sourceLabel }); continue; }
+      if (!installPrefix) { unresolved++; continue; }
+      const resolved = resolveLinkTarget(p, raw);
+      if (isInsidePrefix(resolved, installPrefix)) expected.push({ name: entry.name, target: resolved, source: sourceLabel });
+      else outside.push({ name: entry.name, target: resolved, source: sourceLabel });
+      continue;
+    }
+
+    if (st.isDirectory()) {
+      let version = '?';
+      const pjPath = join(p, 'package.json');
+      if (existsSync(pjPath)) {
+        try { version = JSON.parse(readFileSync(pjPath, 'utf8')).version || '?'; } catch { /* 保留 ? */ }
+      }
+      realDirs.push({
+        name: entry.name, version, source: sourceLabel,
+        isCore: CORE_RUNTIME_PKGS.has(entry.name),
+      });
     }
   }
+  return { realDirs, outside, expected, broken, unresolved };
+}
 
-  if (leaked.length === 0) {
-    return pass(id, Severity.CRITICAL, 'profile 中无 @deepseek-ai/dsh-* 泄漏，核心包仅由 CLI 提供');
+export async function run(profileDir, options = {}) {
+  const id = 'SP9';
+  const nmRoots = candidateNodeModulesRoots(profileDir);
+  const scopeDirs = nmRoots.map(nm => join(nm, '@deepseek-ai'));
+  const scanned = scopeDirs.filter(d => existsSync(d));
+
+  if (scanned.length === 0) {
+    return skip(id, Severity.CRITICAL,
+      `未找到 @deepseek-ai 目录（已查找 ${scopeDirs.join(' 与 ')}），未执行重复实例检测——无法判定核心包安装形态`);
+  }
+
+  const installPrefix = options.installPrefix !== undefined
+    ? options.installPrefix
+    : resolveInstallPrefix(profileDir);
+
+  const realDirs = [], outside = [], expected = [], brokenPkgLinks = [];
+  let unresolved = 0;
+  for (const d of scanned) {
+    const label = isMirrorRoot(dirname(d)) ? '共享镜像' : 'profile';
+    const r = classify(d, installPrefix, label);
+    realDirs.push(...r.realDirs);
+    outside.push(...r.outside);
+    expected.push(...r.expected);
+    brokenPkgLinks.push(...r.broken);
+    unresolved += r.unresolved;
   }
 
-  const coreLeaks = leaked.filter(l => l.isCore);
-  const otherLeaks = leaked.filter(l => !l.isCore);
+  // 环境告警：断链 / npx 残渣（逐范围如实报数，不合并、不夸大）
+  // 范围 = 已扫描的 node_modules 根 + 共享镜像根本身（即便镜像的 @deepseek-ai 子目录缺失，
+  // 镜像里其余包的断链同样值得报——审计实测的 118 条断链即分布在整个镜像里）
+  const censusRoots = [...new Set([...nmRoots, resolveSharedMirrorDir(profileDir)].filter(Boolean))];
+  const censuses = censusRoots.map(root => ({
+    root,
+    ...(options.symlinkCensus || countMirrorLinks(root)),
+  }));
 
-  // 核心运行时包泄漏 = CRITICAL（直接导致 Symbol 分裂 + 工具调用全灭）
-  if (coreLeaks.length > 0) {
-    const details = coreLeaks.map(l => `  ${l.name}@${l.version}`).join('\n');
-    const otherNote = otherLeaks.length > 0
-      ? `\n另有 ${otherLeaks.length} 个非核心 @deepseek-ai/dsh-* 包在 profile 中：${otherLeaks.map(l => l.name).join(', ')}`
-      : '';
+  const envParts = censuses
+    .filter(c => c.broken > 0 || c.npx > 0)
+    .map(c => {
+      const bits = [];
+      if (c.broken > 0) bits.push(`${c.broken} 条断链`);
+      if (c.npx > 0) bits.push(`${c.npx} 条指向 ~/.npm/_npx/ 残渣`);
+      return `${c.root}: ${bits.join('、')}（共 ${c.total} 条符号链接）`;
+    });
+  const mirrorRoot = censuses.find(c => isMirrorRoot(c.root) && (c.broken > 0 || c.npx > 0));
+  const envFixParts = [];
+  if (mirrorRoot) {
+    envFixParts.push(`停止 dsh 后 rm -rf ${mirrorRoot.root} 再重启（healProfilesModuleFallback 会按安装闭包重建镜像），切勿删除 profile 目录本身`);
+  }
+  if (censuses.some(c => !isMirrorRoot(c.root) && (c.broken > 0 || c.npx > 0))) {
+    envFixParts.push(`profile 自身的断链多为包被移除后遗留的 .bin/*，用包管理器重装该 profile 即可清理（pnpm install --force）`);
+  }
+  const envWarning = envParts.length > 0
+    ? `\n环境告警：符号链接代际已腐烂——${envParts.join('；')}。修复: ${envFixParts.join('；')}`
+    : '';
+  const brokenPkgNote = brokenPkgLinks.length > 0
+    ? `\n注意: 其中 ${brokenPkgLinks.length} 条 @deepseek-ai/dsh-* 链接本身是断链（已计入告警，未静默忽略）：` +
+      brokenPkgLinks.slice(0, 8).map(b => `${b.name}[${b.source}]`).join(', ')
+    : '';
+
+  const coreReal = realDirs.filter(d => d.isCore);
+  const otherReal = realDirs.filter(d => !d.isCore);
+  const fmt = (list) => list.slice(0, 10).map(x => `  ${x.name}${x.version ? `@${x.version}` : ''}[${x.source}]`).join('\n');
+  const prefixNote = `\n安装前缀: ${installPrefix || '未解析到'}；符号链接形态的 dsh 自有镜像属预期，不计入重复。` +
+    `\n已扫描: ${scanned.join('、')}`;
+
+  // 风险 1：核心包真实目录副本 → CRITICAL（#4640 的直接触发条件）
+  if (coreReal.length > 0) {
+    const others = [
+      otherReal.length ? `另有 ${otherReal.length} 个非核心真实目录副本：${otherReal.map(d => `${d.name}[${d.source}]`).join(', ')}` : '',
+      outside.length ? `另有 ${outside.length} 条符号链接指向安装前缀之外：${outside.slice(0, 8).map(o => o.name).join(', ')}` : '',
+    ].filter(Boolean).join('\n');
     return fail(id, Severity.CRITICAL,
-      `检测到 ${coreLeaks.length} 个 CLI 核心运行时包泄漏到 profile（#4640：双实例 symbol 分裂 → 工具调用全灭）：\n${details}${otherNote}\n修复: dsh plugin --profile <name> remove <泄漏包名>（或检查安装来源是否误将 CLI 依赖写入 profile）`,
-      '核心包（dsh-tools/dsh-agent-loop 等）不应出现在 profile 的 node_modules 中；它们由 CLI 自身依赖树提供',
+      `检测到 ${coreReal.length} 个 CLI 核心运行时包的**真实副本**（真实目录，非符号链接；#4640：双实例 symbol 分裂 → 工具调用全灭）：\n${fmt(coreReal)}` +
+      prefixNote + (others ? `\n${others}` : '') + brokenPkgNote + envWarning,
+      'profile 只承载 surfaces 与 plugins，core packages 由 CLI 依赖树提供；删除这些真实目录后重装插件（符号链接镜像应保留）',
+      ['#4640']
+    );
+  }
+
+  // 风险 2：非核心包真实目录副本 → HIGH
+  if (otherReal.length > 0) {
+    const outsideNote = outside.length ? `\n另有 ${outside.length} 条符号链接指向安装前缀之外` : '';
+    return fail(id, Severity.HIGH,
+      `检测到 ${otherReal.length} 个 @deepseek-ai/dsh-* 的**真实目录副本**（非核心包，暂未触发 symbol 分裂，但增加未来冲突风险）：\n${fmt(otherReal)}` +
+      prefixNote + outsideNote + brokenPkgNote + envWarning,
+      '清理 profile 中不需要的真实副本；若为客户端包且被插件依赖，确认无版本冲突',
+      ['#4640']
+    );
+  }
+
+  // 风险 3：符号链接指向安装前缀之外 → HIGH（来源不可信，可 shadow CLI 自带副本）
+  if (outside.length > 0) {
+    const details = outside.slice(0, 10).map(o => `  ${o.name} → ${o.target}[${o.source}]`).join('\n');
+    const outsideFix = mirrorRoot
+      ? `停止 dsh 后 rm -rf ${mirrorRoot.root} 再重启，让 healProfilesModuleFallback 按安装闭包重建镜像`
+      : '删除这些链接后重启 dsh，让其按安装闭包重建';
+    return fail(id, Severity.HIGH,
+      `检测到 ${outside.length} 条 @deepseek-ai/dsh-* 符号链接指向安装前缀之外（来源不可信，可能 shadow 掉 CLI 自带副本）：\n${details}` +
+      prefixNote + brokenPkgNote + envWarning,
+      `修复: ${outsideFix}；若重建后仍指向 npx 缓存，说明安装布局本身陈旧`,
       ['#4640']
     );
   }
 
-  // 只有非核心包泄漏 = HIGH（潜在风险但不一定立即崩溃）
-  const details = otherLeaks.map(l => `  ${l.name}@${l.version}`).join('\n');
-  return fail(id, Severity.HIGH,
-    `检测到 ${otherLeaks.length} 个 @deepseek-ai/dsh-* 包泄漏到 profile（非核心包，暂未触发 symbol 分裂，但增加未来冲突风险）：\n${details}`,
-    '清理 profile 中不需要的 @deepseek-ai/dsh-* 包；若为客户端包且被插件依赖，确认无版本冲突',
-    ['#4640']
-  );
+  // 安装前缀无法解析且确有链接 → 有理由的 skip，而不是被动 pass
+  if (unresolved > 0 && expected.length === 0) {
+    return skip(id, Severity.CRITICAL,
+      `${unresolved} 条 @deepseek-ai/dsh-* 符号链接无法判定来源（未解析到 CLI 安装前缀），未执行重复实例检测——` +
+      `可设置 DSH_HOME 或 npm_node_execpath 以完成判定` + brokenPkgNote + envWarning);
+  }
+
+  const expectedNote = expected.length > 0
+    ? `${expected.length} 条符号链接指向安装前缀内（dsh 自有镜像，属预期形态，非重复）`
+    : '无 @deepseek-ai/dsh-* 条目';
+  const unresolvedNote = unresolved > 0
+    ? `；${unresolved} 条链接因安装前缀未解析未能判定来源（其余已判定）`
+    : '';
+  const brokenNote = brokenPkgLinks.length > 0
+    ? `；${brokenPkgLinks.length} 条 @deepseek-ai/dsh-* 断链未被静默忽略`
+    : '';
+
+  return createResult(id, true, Severity.CRITICAL,
+    `${expectedNote}${unresolvedNote}${brokenNote}` + prefixNote + brokenPkgNote + envWarning);
 }
 
 export const sp9Check = {
@@ -99,7 +283,7 @@ export const sp9Check = {
   name: 'dual-instance-guard',
   severity: Severity.CRITICAL,
   phase: CheckPhase.POST_INSTALL,
-  description: 'CLI 核心包泄漏检测——profile 中不应出现 @deepseek-ai/dsh-tools 等核心包（#4640 symbol 分裂）',
+  description: '真实重复实例检测——profile 中出现 @deepseek-ai/dsh-* 的真实目录副本（或指向前缀外的符号链接）才是风险；dsh 自有符号链接镜像属预期形态',
   src: 'builtin',
   runner: (profileDir) => run(profileDir),
 };

package/src/checks/sr1-sandbox-violation.mjs

@@ -16,9 +16,12 @@ import { existsSync } from 'node:fs';
 import { Severity } from '../protocol/severity.mjs';
 import { CheckPhase } from '../protocol/phase.mjs';
 import { pass, fail, skip } from '../protocol/check.mjs';
-import { scanSessionLines } from '../session-reader.mjs';
+import { scanSessionLines, extractEvent, isShellTool } from '../session-reader.mjs';
 
 /** 已知逃逸模式（#1769 及同类） */
+/** 下载即执行：curl/wget 管道进解释器 —— 与逃逸同级的高信号规则（其余系统资源规则不算发现） */
+const HIGH_SIGNAL_DOWNLOAD = { name: 'curl/wget to shell', regex: /(?:curl|wget)\s+[^\n|"']{1,160}\|\s*(?:bash|sh|zsh|node)\b/gi, severity: 'critical', ref: null };
+
 const ESCAPE_PATTERNS = [
   { name: 'mount remount', regex: /mount\s+.*-o\s+remount.*rw/gi, severity: 'critical', ref: '#1769' },
   { name: 'chroot escape', regex: /chroot\s+\//gi, severity: 'critical', ref: null },
@@ -50,24 +53,10 @@ const WORKSPACE_ESCAPE_PATTERNS = [
  */
 function extractToolCalls(line) {
   try {
-    const event = JSON.parse(line);
-    if (event.type !== 'tool/call') return [];
-
-    const data = event.data || {};
-    const name = data.name || data.tool || '';
-    const args = data.args || data.input || {};
-    const text = typeof args === 'string' ? args : JSON.stringify(args);
-
-    return [{
-      type: event.type,
-      name,
-      text,
-      seq: event.seq,
-      turn: event.turn,
-    }];
-  } catch {
-    return [];
-  }
+    const e = extractEvent(JSON.parse(line));
+    if (e.kind === 'other') return [];
+    return [{ type: e.type, name: e.name || '', text: e.argsText || e.resultText || '', seq: e.seq, turn: e.turn, callId: e.callId }];
+  } catch { return []; }
 }
 
 /**
@@ -99,10 +88,11 @@ export async function run(sessionFile) {
   const id = 'SR1';
 
   if (!sessionFile || !existsSync(sessionFile)) {
-    return pass(id, Severity.CRITICAL, '无会话日志，跳过运行时安全检查');
+    return skip(id, Severity.CRITICAL, '无会话日志，跳过运行时安全检查');
   }
 
   const findings = [];
+  let contextualCount = 0;
   let lineCount = 0;
 
   try {
@@ -110,11 +100,20 @@ export async function run(sessionFile) {
       if (!line.trim()) return;
       const calls = extractToolCalls(line);
       for (const call of calls) {
-        const allPatterns = [...ESCAPE_PATTERNS, ...SYSTEM_RESOURCE_PATTERNS, ...WORKSPACE_ESCAPE_PATTERNS];
-        const textFindings = scanPatterns(call.text, allPatterns);
-        for (const f of textFindings) {
+        // 只作用于命令执行类工具（#2026-09：文档工具里"引用"路径会被误判为逃逸行为）
+        if (!isShellTool(call.name, call.text)) continue;
+        // 只把"逃逸原语"计为发现（chroot/nsenter/unshare/remount、下载即执行、管道进 shell）。
+        // 其余规则（读 /etc、/proc、env dump、sudo、写 /tmp 或 home、提及 child_process）
+        // 在日常 agent 工作里普遍出现，静默计入 contextual 而**不抬严重级**（2026-09 实测：不区分会误报 361 处）。
+        const decisive = [...ESCAPE_PATTERNS, HIGH_SIGNAL_DOWNLOAD];
+        const contextual = [...SYSTEM_RESOURCE_PATTERNS, ...WORKSPACE_ESCAPE_PATTERNS];
+        const seenRules = new Set(); // 同一事件内同一规则只记一次（文本里重复提及不再放大计数）
+        for (const f of scanPatterns(call.text, decisive)) {
+          if (seenRules.has(f.type)) continue;
+          seenRules.add(f.type);
           findings.push({ ...f, line: lineNo, tool: call.name, seq: call.seq, turn: call.turn });
         }
+        for (const _ of scanPatterns(call.text, contextual)) contextualCount++;
       }
     });
   } catch (e) {

package/src/checks/sr2-privilege-escalation.mjs

@@ -16,42 +16,57 @@ import { existsSync } from 'node:fs';
 import { Severity } from '../protocol/severity.mjs';
 import { CheckPhase } from '../protocol/phase.mjs';
 import { pass, fail, skip } from '../protocol/check.mjs';
-import { scanSessionLines } from '../session-reader.mjs';
+import { scanSessionLines, extractEvent, isShellTool } from '../session-reader.mjs';
 
+// 只保留**决定性的提权原语**。裸 `sudo`/`chmod`/`chown` 在 agent 会话里极常见
+// （2026-09 实测：不改会一次报 42 处，绝大多数是普通命令或文档引用），故降为 contextualCount 不入发现。
 const PRIVILEGE_PATTERNS = [
-  { name: 'sudo usage', regex: /sudo\s+/gi, severity: 'high' },
+  { name: 'sudo to root shell', regex: /sudo\s+(?:-i\b|-s\b|su\b)/gi, severity: 'critical' },
   { name: 'doas usage', regex: /\bdoas\s+/gi, severity: 'high' },
-  { name: 'chmod', regex: /chmod\s+[^/]*\s+[0-7]*7[0-7][0-7]/gi, severity: 'medium' },
+  { name: 'setuid/setgid bit', regex: /chmod\s+(?:[ugo]*\+s|[2467][0-7]{3})/gi, severity: 'critical' },
+  { name: 'setuid/setgid api', regex: /\b(?:setuid|setgid|seteuid|setegid)\s*\(/gi, severity: 'high' },
+  { name: 'linux capability', regex: /\bsetcap\s+|\bcap_(?:sys_admin|setuid|setgid|sys_ptrace)\b/gi, severity: 'high' },
+  { name: 'chown to root', regex: /chown\s+(?:-[A-Za-z]+\s+)*root[:\s]/gi, severity: 'high' },
+];
+
+/** 常见但不足以判定提权的操作：只计数，不产生发现 */
+const CONTEXTUAL_PRIVILEGE_PATTERNS = [
+  { name: 'sudo usage', regex: /sudo\s+/gi, severity: 'high' },
+  { name: 'chmod', regex: /chmod\s+/gi, severity: 'medium' },
   { name: 'chown', regex: /chown\s+/gi, severity: 'medium' },
-  { name: 'setuid', regex: /setuid|setgid/gi, severity: 'high' },
-  { name: 'capability', regex: /cap_|CAP_/gi, severity: 'high' },
 ];
 
 function extractToolCalls(line) {
   try {
-    const event = JSON.parse(line);
-    if (event.type !== 'tool/call') return [];
-    const data = event.data || {};
-    return [{ name: data.name || data.tool || '', text: JSON.stringify(data.args || data.input || {}), seq: event.seq }];
+    const e = extractEvent(JSON.parse(line));
+    if (e.kind === 'other') return [];
+    return [{ type: e.type, name: e.name || '', text: e.argsText || e.resultText || '', seq: e.seq, turn: e.turn, callId: e.callId }];
   } catch { return []; }
 }
 
 export async function run(sessionFile) {
   const id = 'SR2';
-  if (!sessionFile || !existsSync(sessionFile)) return pass(id, Severity.HIGH, '无会话文件，跳过权限提升检测');
+  if (!sessionFile || !existsSync(sessionFile)) return skip(id, Severity.HIGH, '无会话文件，跳过权限提升检测');
 
   const findings = [];
+  let contextualCount = 0;
   let lineCount = 0;
 
   try {
     lineCount = await scanSessionLines(sessionFile, (line, lineNo) => {
       if (!line.trim()) return;
       for (const call of extractToolCalls(line)) {
+        const seen = new Set();
         for (const pattern of PRIVILEGE_PATTERNS) {
           for (const match of call.text.matchAll(new RegExp(pattern.regex.source, 'gi'))) {
+            if (seen.has(pattern.name)) break;
+            seen.add(pattern.name);
             findings.push({ type: pattern.name, severity: pattern.severity, line: lineNo, tool: call.name, snippet: match[0].slice(0, 40) });
           }
         }
+        for (const pattern of CONTEXTUAL_PRIVILEGE_PATTERNS) {
+          if (new RegExp(pattern.regex.source, 'i').test(call.text)) { contextualCount++; break; }
+        }
       }
     });
   } catch (e) {
@@ -61,7 +76,7 @@ export async function run(sessionFile) {
     throw e;
   }
 
-  if (findings.length === 0) return pass(id, Severity.HIGH, `扫描 ${lineCount} 行，未检测到权限提升行为`);
+  if (findings.length === 0) return pass(id, Severity.HIGH, `扫描 ${lineCount} 行，未检测到权限提升原语${contextualCount ? `（另有 ${contextualCount} 处常见 sudo/chmod/chown 操作，未计入）` : ''}`);
 
   const details = findings.slice(0, 10).map(f => `[${f.severity}] 行${f.line} ${f.tool} — ${f.type}: ${f.snippet}`).join('\n');
   const highCount = findings.filter(f => f.severity === 'high').length;

package/src/checks/sr3-data-exfiltration.mjs

@@ -15,7 +15,7 @@ import { existsSync } from 'node:fs';
 import { Severity } from '../protocol/severity.mjs';
 import { CheckPhase } from '../protocol/phase.mjs';
 import { pass, fail, skip } from '../protocol/check.mjs';
-import { scanSessionLines } from '../session-reader.mjs';
+import { scanSessionLines, extractEvent, isShellTool } from '../session-reader.mjs';
 
 /** 凭据转发模式 */
 const CREDENTIAL_FORWARD_PATTERNS = [
@@ -37,18 +37,10 @@ const NETWORK_EXFIL_PATTERNS = [
  */
 function extractToolCalls(line) {
   try {
-    const event = JSON.parse(line);
-    if (event.type !== 'tool/call' && event.type !== 'tool/result') return [];
-
-    const data = event.data || {};
-    const name = data.name || data.tool || '';
-    const args = data.args || data.input || data.output || data.result || data.text || {};
-    const text = typeof args === 'string' ? args : JSON.stringify(args);
-
-    return [{ type: event.type, name, text, seq: event.seq, turn: event.turn }];
-  } catch {
-    return [];
-  }
+    const e = extractEvent(JSON.parse(line));
+    if (e.kind === 'other') return [];
+    return [{ type: e.type, name: e.name || '', text: e.argsText || e.resultText || '', seq: e.seq, turn: e.turn, callId: e.callId }];
+  } catch { return []; }
 }
 
 function scanPatterns(text, patterns) {
@@ -70,7 +62,7 @@ export async function run(sessionFile) {
   const id = 'SR3';
 
   if (!sessionFile || !existsSync(sessionFile)) {
-    return pass(id, Severity.HIGH, '无会话日志，跳过数据外泄检查');
+    return skip(id, Severity.HIGH, '无会话日志，跳过数据外泄检查');
   }
 
   const findings = [];

package/src/checks/sr4-isolation-verify.mjs

@@ -13,14 +13,13 @@ import { existsSync } from 'node:fs';
 import { Severity } from '../protocol/severity.mjs';
 import { CheckPhase } from '../protocol/phase.mjs';
 import { pass, fail, skip } from '../protocol/check.mjs';
-import { scanSessionLines } from '../session-reader.mjs';
+import { scanSessionLines, extractEvent } from '../session-reader.mjs';
 
 function extractToolCalls(line) {
   try {
-    const event = JSON.parse(line);
-    if (event.type !== 'tool/call') return [];
-    const data = event.data || {};
-    return [{ name: data.name || data.tool || '', args: data.args || data.input || {}, seq: event.seq, turn: event.turn }];
+    const e = extractEvent(JSON.parse(line));
+    if (e.kind === 'other') return [];
+    return [{ name: e.name || '', args: e.argsText || '', seq: e.seq, turn: e.turn }];
   } catch { return []; }
 }
 

package/src/checks/ss2-pii-exposure.mjs

@@ -19,9 +19,12 @@ import { scanSessionLines } from '../session-reader.mjs';
 
 const PII_PATTERNS = [
   { name: 'email', regex: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g, severity: 'medium' },
-  { name: 'phone', regex: /(\+?86)?1[3-9]\d{9}/g, severity: 'medium' },
+  // 数字边界：否则 Unix 毫秒时间戳（1788769155230）的子串会被当成手机号（2026-09 实测误报）
+  { name: 'phone', regex: /(?<!\d)(?:\+?86)?1[3-9]\d{9}(?!\d)/g, severity: 'medium' },
   { name: 'ID card', regex: /[1-9]\d{5}(19|20)\d{2}(0[1-9]|1[0-2])(0[1-9]|[12]\d|3[01])\d{3}[\dXx]/g, severity: 'high' },
-  { name: 'IPv4', regex: /\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/g, severity: 'low' },
+  // 裸 IPv4 → informational：会话文本里 IP 无处不在（文档举例、保留网段 198.18/203.0.113、版本号形态），
+  // 2026-09 实测全部命中都是这类。PII 的强信号是邮箱/手机/身份证/密钥，IP 不足以判定，仅计数提示。
+  { name: 'IPv4', regex: /\b(?!127\.|10\.|192\.168\.|0\.|169\.254\.|100\.(?:6[4-9]|[7-9]\d|1[01]\d)\.|198\.18\.|198\.19\.|203\.0\.113\.|198\.51\.100\.|192\.0\.2\.)(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/g, severity: 'low', informational: true },
 ];
 
 /** PII 掩码：保留类型可辨识度，不回显完整个人信息 */
@@ -49,6 +52,7 @@ export async function run(sessionFile) {
   if (!sessionFile || !existsSync(sessionFile)) return pass(id, Severity.MEDIUM, '无会话文件，跳过 PII 检测');
 
   const findings = [];
+  let informationalCount = 0;
   let lineCount = 0;
 
   try {
@@ -57,6 +61,7 @@ export async function run(sessionFile) {
       const text = extractTextFromLine(line);
       for (const pattern of PII_PATTERNS) {
         for (const match of text.matchAll(new RegExp(pattern.regex.source, 'g'))) {
+          if (pattern.informational) { informationalCount++; continue; }
           findings.push({ type: pattern.name, severity: pattern.severity, line: lineNo, snippet: maskPII(match[0]) });
         }
       }
@@ -68,7 +73,7 @@ export async function run(sessionFile) {
     throw e;
   }
 
-  if (findings.length === 0) return pass(id, Severity.MEDIUM, `扫描 ${lineCount} 行，未检测到 PII 暴露`);
+  if (findings.length === 0) return pass(id, Severity.MEDIUM, `扫描 ${lineCount} 行，未检测到 PII 暴露${informationalCount ? `（另有 ${informationalCount} 个裸 IP，弱信号未计入）` : ''}`);
 
   const byType = {};
   for (const f of findings) { if (!byType[f.type]) byType[f.type] = 0; byType[f.type]++; }

package/src/checks/ss3-sensitive-output.mjs

@@ -14,27 +14,28 @@ import { existsSync } from 'node:fs';
 import { Severity } from '../protocol/severity.mjs';
 import { CheckPhase } from '../protocol/phase.mjs';
 import { pass, fail, skip } from '../protocol/check.mjs';
-import { scanSessionLines } from '../session-reader.mjs';
+import { scanSessionLines, extractEvent } from '../session-reader.mjs';
 
+// 注意：原 'large file content'（readFileSync/cat + 500 字符）规则已移除——编码会话里
+// 任何含 readFileSync 的源码都会命中（2026-09 实测：9/9 命中全是源码本身），噪声无法收敛。
 const SENSITIVE_OUTPUT_PATTERNS = [
   { name: 'env dump', regex: /(?:process\.env|ENV|env)\s*[=:]\s*\{[^}]{50,}/gi, severity: 'medium' },
   { name: 'config dump', regex: /(?:config|settings|credentials)\s*[=:]\s*\{[^}]{100,}/gi, severity: 'medium' },
-  { name: 'large file content', regex: /(?:readFileSync|cat\s+)\S+[\s\S]{500,}/gi, severity: 'low' },
 ];
 
 function extractToolOutputs(line) {
+  // 注意：本检查的循环直接对返回值调用 matchAll，故这里返回**字符串数组**
   try {
-    const event = JSON.parse(line);
-    if (event.type !== 'tool/result') return [];
-    const data = event.data || {};
-    const output = data.output || data.result || data.text || '';
-    return [typeof output === 'string' ? output : JSON.stringify(output)];
+    const e = extractEvent(JSON.parse(line));
+    if (e.kind === 'other') return [];
+    const t = e.resultText || e.argsText || '';
+    return t ? [t] : [];
   } catch { return []; }
 }
 
 export async function run(sessionFile) {
   const id = 'SS3';
-  if (!sessionFile || !existsSync(sessionFile)) return pass(id, Severity.LOW, '无会话文件，跳过敏感输出检测');
+  if (!sessionFile || !existsSync(sessionFile)) return skip(id, Severity.LOW, '无会话文件，跳过敏感输出检测');
 
   const findings = [];
   let lineCount = 0;