@netcatty/dsh-guard 0.2.0 → 0.2.2

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.2.2
+
+### 修复
+
+- 脱敏漏掉 JSON 形态的复合键名：`"OXIDETERM_MCP_TOKEN": "..."`、`"sessionToken": "..."` 这类键名前/后缀带词的凭据值会原样落盘，只有精确等于 `token`/`secret`/`password` 等白名单键名的才被遮。规则改为键名任意位置命中 `token|api_key|apikey|secret|password|passwd|authorization|private_key|access_key` 即脱敏，与 `KEY=value` 那条口径对齐。
+
+## 0.2.1
+
+Windows 实机验证后的一轮修复。
+
+### 修复
+
+- `expand` 不识别 `~\` 前缀，`~\Documents` 被当成相对路径拼到 cwd 下，路径规则漏判。
+- `~\` 展开后未归一化分隔符，POSIX 上会得到 `/home/u/\secret` 这种带反斜杠的路径，`~/secret*` 规则照样匹配不上。
+
+### 变更
+
+- README 的 Windows 章节从「待实机验证」改为已验证：安装、`node --test`、`%USERPROFILE%` 展开、盘符相对路径、PowerShell 引号处理。
+
 ## 0.2.0
 
 首个功能完整的版本。0.1.0 只有 `path` / `bash` 两个规则面和基础审批，此后每一轮都在补面。

package/README.md

@@ -443,10 +443,10 @@ write-direction path surface, so `echo x > secret.env` is denied by path rules.
   an escape character.
 - Tool basenames are split on both `/` and `\`.
 
-Windows-specific work still pending real-machine verification (install, run
-`node --test`, check `%USERPROFILE%` expansion, drive-relative paths, and
-PowerShell quoting). Windows separators and drive letters are normalized before
-matching; matching is case-insensitive on win32 by default.
+Verified on a real Windows machine: install, `node --test`, `%USERPROFILE%`
+expansion (both `~/` and `~\`), drive-relative paths, and PowerShell quoting.
+Separators and drive letters are normalized before matching; matching is
+case-insensitive on win32 by default.
 
 ## Settings page
 
@@ -540,7 +540,9 @@ Client treats `/name args` as ordinary chat — the reason all three ship an
 `tools/post-execute` replaces credential-shaped text in every tool result before
 it is persisted: `sk-*`/`rk-*`/`pk-*` keys, GitHub tokens (`ghp_`, `gho_`,
 `github_pat_`), Slack tokens, AWS access keys, Google API keys, JWTs, `Bearer`
-tokens, PEM private-key blocks, and `SECRET|TOKEN|PASSWORD|API_KEY=...` values.
+tokens, PEM private-key blocks, `SECRET|TOKEN|PASSWORD|API_KEY=...` values, and
+JSON string fields whose key name contains `TOKEN` / `SECRET` / `PASSWORD` /
+`API_KEY` / `AUTHORIZATION` anywhere (`"OXIDETERM_MCP_TOKEN": "..."` included).
 Only text blocks change; images and structured blocks pass through. Set
 `redact: false` to disable.
 

package/lib/index.js

@@ -133,7 +133,15 @@ const REDACTIONS = [
   [/\bBearer\s+[A-Za-z0-9._~+/-]{8,}=*/gi, 'Bearer ***'],
   [/([A-Z0-9_]*(?:SECRET|TOKEN|PASSWORD|PASSWD|API_KEY|PRIVATE_KEY|ACCESS_KEY)[A-Z0-9_]*\s*=\s*)(?:"[^"]{6,}"|'[^']{6,}'|[^\s"']{6,})/g, '$1***'],
   [/([?&](?:token|access_token|api_key|apikey|key|secret|password)=)[^&\s"']+/gi, '$1***'],
-  [/"(token|access_token|api_key|apikey|secret|password|authorization)"\s*:\s*"[^"]{4,}"/gi, '"$1":"***"'],
+  // JSON string values whose key mentions a credential, anywhere in the name
+  // (`OXIDETERM_MCP_TOKEN`, `settings.token`, `x-api-key`). The character class
+  // covers the separators JSON keys actually use, and the keyword list carries
+  // the hyphenated spellings so `x-api-key` does not slip through.
+  [/"([A-Za-z0-9_.-]*(?:token|api_key|apikey|api-key|secret|password|passwd|authorization|private_key|private-key|access_key|access-key)[A-Za-z0-9_.-]*)"\s*:\s*"[^"]{4,}"/gi, '"$1":"***"'],
+  // The same shape after the quotes were escaped, which is how JSON shows up
+  // inside a shell command: `echo "{\"token\":\"secret\"}"`. Escapes are kept so
+  // the surrounding text stays parseable after masking.
+  [/\\"([A-Za-z0-9_.-]*(?:token|api_key|apikey|api-key|secret|password|passwd|authorization|private_key|private-key|access_key|access-key)[A-Za-z0-9_.-]*)\\"\s*:\s*\\"(?![*]{3}\\")[^"\\]{4,}\\"/gi, '\\"$1\\":\\"***\\"'],
   [/^\s*(set-)?cookie\s*:\s*.*$/gim, 'Cookie: ***'],
 ];
 
@@ -175,6 +183,10 @@ function matchParam(pattern, value, permission) {
 export function expand(p, cwd) {
   if (typeof p !== 'string' || p === '') return undefined;
   if (p === '~') return homedir();
+  // `~\x` is how Windows users write the home prefix. Normalising the tail
+  // matters on POSIX too: `resolve` keeps a backslash as part of the file name,
+  // so `/home/u/\secret` would never match a `~/secret*` rule.
+  if (p.startsWith('~\\')) return resolve(homedir(), toPosix(p.slice(2)));
   if (p.startsWith('~/')) return resolve(homedir(), p.slice(2));
   return isAbsolute(p) ? resolve(p) : resolve(cwd, p);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@netcatty/dsh-guard",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "allow/ask/deny permission gates for DeepSeek Harness tools: path/params/agents surfaces, argv decomposition, network rules, redaction, grants, dry-run, fail-closed config",
   "type": "module",
   "main": "lib/index.js",