@shgroup/dsh-serenity-hooks 1.26.2 → 1.26.3

package/dsh.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "dsh-serenity-hooks",
-  "version": "1.26.2",
+  "version": "1.26.3",
   "main": "lib/index.js",
   "description": "宁静号 ACC harness（Native Cordis 插件）：真实 DSH 工具 cc_fs/session/acc_msm/eap/neat/cce/handyman/session_rebuild/skiff_admin + 拦截缝机械约束（safe-mode/路径守卫）+ 高级设定面板（双端口网关/账号管理）+ Skiff 认知子集角色（实验性）。适配 DSH 公开版（0.1.0-rc，deepseek-ai/deepseek-harness）。",
   "engines": {

package/lib/index.js

@@ -785,6 +785,17 @@ const CC_FS_WRITE_ACTIONS = /* @__PURE__ */ new Set([
 	"touch",
 	"append"
 ]);
+/**
+* 凭据文件硬名单（数据面守卫，v1.26.3，S142 用户：localstore.json 需要在 read 工具的黑名单里）：
+* **任何工具**（含 read/grep/glob/cc_fs 只读子命令）命中这些相对 CCC 根的路径 → deny。
+*
+* 与 safeMode.blacklist（写黑名单，v1.18.5 决策只拦写）语义独立：
+* - 黑名单 = 用户可配置的写保护（REPOSITORIES/ 等只读参考源不误伤读）
+* - 凭据硬名单 = **结构性数据面边界**（不依赖 safe-mode 开关，凭据文件任何时候不可读）——
+*   对齐 CCE Bounded Space + wardn "structural guarantee, not policy"：localstore.json
+*   含 API keys/tokens/SSH 密码，即使 prompt 纪律失败也无值可吐（机械保证）。
+*/
+const SENSITIVE_CREDENTIAL_FILES = /* @__PURE__ */ new Set(["localstore.json"]);
 /** 判定工具是否为写类：普通工具按名；cc_fs 复合工具按子命令 action */
 function isWriteTool(toolName, action) {
 	if (!WRITE_TOOLS.has(toolName)) return false;
@@ -817,8 +828,12 @@ function decideGuard(input) {
 			deny: `path escape blocked: "${pathArg}" escapes the CCC root`,
 			kind: "deny"
 		};
+		const rel = relative(root, abs).split("\\").join("/");
+		if (SENSITIVE_CREDENTIAL_FILES.has(rel)) return {
+			deny: `access blocked: "${pathArg}" is a sensitive credential file (${rel})`,
+			kind: "deny"
+		};
 		if (isWriteTool(toolName, action)) {
-			const rel = relative(root, abs).split("\\").join("/");
 			if (rel === ".serenity-safe-on" || rel === ".serenity" || rel.startsWith(".serenity-safe-on/") || rel.startsWith(".serenity/")) return {
 				deny: `CCC governance file "${rel}" is reserved for the user — agent must not write`,
 				kind: "deny"
@@ -2392,7 +2407,7 @@ function listActiveHandymen(root) {
 }
 //#endregion
 //#region src/skiff-core.ts
-const PLUGIN_SOURCE$3 = {
+const PLUGIN_SOURCE$4 = {
 	kind: "plugin",
 	plugin: "dsh-serenity-hooks"
 };
@@ -2491,7 +2506,7 @@ function waitIdle$1(ctx, agent) {
 	});
 }
 /** 读会话最后一个 assistant/message 文本（handyman 同款） */
-function lastAssistantText$1(agent) {
+function lastAssistantText$2(agent) {
 	const events = agent.session.events;
 	for (let i = events.length - 1; i >= 0; i--) {
 		const e = events[i];
@@ -2560,10 +2575,10 @@ async function askSkiff(ctx, agent, question, eventsStart) {
 			type: "text",
 			text: question
 		}],
-		source: PLUGIN_SOURCE$3
+		source: PLUGIN_SOURCE$4
 	}));
 	await waitIdle$1(ctx, agent);
-	const answer = lastAssistantText$1(agent);
+	const answer = lastAssistantText$2(agent);
 	const trajectory = eventsToTrajectory(agent.session.events.slice(before));
 	return {
 		answer,
@@ -2973,7 +2988,7 @@ function waitIdle(ctx, agent) {
 	});
 }
 /** 读取会话最后一个 assistant/message 文本 */
-function lastAssistantText(agent) {
+function lastAssistantText$1(agent) {
 	const events = agent.session.events;
 	for (let i = events.length - 1; i >= 0; i--) {
 		const e = events[i];
@@ -3071,7 +3086,7 @@ async function runHandymanJob(ctx, opts) {
 					}
 				}));
 				await waitIdle(ctx, workerAgent);
-				lastResponse = lastAssistantText(workerAgent);
+				lastResponse = lastAssistantText$1(workerAgent);
 			} catch {
 				restarts++;
 				if (restarts > 100) {
@@ -6567,7 +6582,7 @@ function registerBootstrap(ctx) {
 }
 //#endregion
 //#region src/rebuild.ts
-const PLUGIN_SOURCE$2 = {
+const PLUGIN_SOURCE$3 = {
 	kind: "plugin",
 	plugin: "dsh-serenity-hooks"
 };
@@ -6753,7 +6768,7 @@ function registerRebuildTurnHook(ctx) {
 						type: "text",
 						text: "[TRAJECTORY-REBUILD] The conversation has been cleared and rebuilt. Follow the anchor instructions above now: read the persistent trajectory (SESSION.md) and continue the work automatically from the last checkpoint."
 					}],
-					source: PLUGIN_SOURCE$2
+					source: PLUGIN_SOURCE$3
 				}));
 				console.log(`[serenity-hooks] session_rebuild executed with auto-continue (turn ${payload.turn ?? "?"} ended): ${id}`);
 			}
@@ -7150,7 +7165,7 @@ function readContextPressure(ctx, session) {
 		return null;
 	}
 }
-const PLUGIN_SOURCE$1 = {
+const PLUGIN_SOURCE$2 = {
 	kind: "plugin",
 	plugin: "dsh-serenity-hooks"
 };
@@ -7213,7 +7228,7 @@ function registerKeeper(ctx, opts = {}) {
 		if (blocks.length === 0) return downstream;
 		const reminderAll = createUserMessage({
 			content: blocks,
-			source: PLUGIN_SOURCE$1
+			source: PLUGIN_SOURCE$2
 		});
 		if (downstream.kind === "block") return {
 			kind: "block",
@@ -8168,7 +8183,7 @@ function accIdentityText(root, configPaths = DEFAULT_SERENITY_CONFIG_PATHS, entr
 	}
 	return lines.join("\n");
 }
-const PLUGIN_SOURCE = {
+const PLUGIN_SOURCE$1 = {
 	kind: "plugin",
 	plugin: "dsh-serenity-hooks"
 };
@@ -8185,7 +8200,7 @@ function accMessage(root, configPaths, entrySkillMaxChars) {
 	}];
 	return createUserMessage({
 		content,
-		source: PLUGIN_SOURCE
+		source: PLUGIN_SOURCE$1
 	});
 }
 /** 每 agent 是否已注入过（进程内存态） */
@@ -9562,6 +9577,171 @@ function registerGateway(ctx) {
 	});
 }
 //#endregion
+//#region src/output-guard.ts
+/**
+* output-guard.ts — 最终输出敏感词检测 + 打回重生成（v1.26.3，S142 用户需求）
+*
+* 认知容器对外提供认知结果时，**支撑宁静号自身的凭据与机制**不应透露给用户。
+* 用户拍板方案（讨论稿定稿）：不做工具结果 redaction（那是模型工作内存），
+* 改为**卡最终输出**——`agent/turn-stopping`（serial）时取 turn 最后 assistant 文本，
+* 命中敏感词表 → `agent.steer()` 打回重生成，直到合规或达上限。
+*
+* 敏感词表（有限，ACC 立场，用户确认"这样比较全面了"）：
+*   ① 凭据词  — localstore.json credentials 条目名 + 值精确匹配（运行时读）
+*   ② 机制词  — 内部结构静态词（插件名/配置路径/端口/内部实现词）
+*   ③ MSM 词  — mech-registry.json 注册的工具名（用户补充：msm_list 里的工具名）
+*   **不含** 公开概念（宁静号/Serenity/认知容器/EAP/CCE/Neat——正常交流词，误伤灾难）
+*
+* 机制依据（DSH 官方）：agent/turn-stopping 注释 "a listener that objects steers and
+* the machine re-reads its inbox: fresh steering runs another step, none closes the
+* turn"——steer 打回是官方支持的"重生成"通道（v1.22.5 rebuild 自动继续同款先例）。
+*/
+/** 插件/内部实现词（静态内置；命中即视为机制泄露） */
+const MECHANISM_WORDS = [
+	"dsh-serenity-hooks",
+	"serenity-hooks",
+	"serenity-hooks.json",
+	"mech-registry",
+	"mech-registry.json",
+	"localstore.json",
+	".opencode/serenity.json",
+	"AGENT_SESSIONS",
+	"agent/session-start",
+	"agent/turn-stopping",
+	"tools/pre-execute",
+	"tools/post-execute",
+	"session_rebuild",
+	"Trajectory Steward",
+	"first-anchor",
+	"拦截缝",
+	"装配层",
+	"acp-core",
+	"skiff-core",
+	"skiff-registry",
+	"skiff-role",
+	"output-guard"
+];
+/** 内部端口（宁静号服务面） */
+const MECHANISM_PORTS = [
+	"3080",
+	"3081",
+	"3099",
+	"3100"
+];
+/**
+* 构建敏感词表（每次调用实时构建——词源文件小，开销可接受）：
+*   ① localstore.json credentials：条目名（UPPER_SNAKE）+ 值（精确匹配）
+*   ② 静态机制词 + 端口
+*   ③ mech-registry 注册的 MSM 工具名（loadMsmEntries 全注册表去重）
+* @param root CCC 根（localstore.json / mech-registry 所在）
+*/
+function buildSensitiveTable(root) {
+	const exact = /* @__PURE__ */ new Set();
+	const substring = [];
+	try {
+		const p = join(root, "localstore.json");
+		if (existsSync(p)) {
+			const creds = JSON.parse(readFileSync(p, "utf-8").replace(/^\uFEFF/, ""))?.credentials;
+			if (creds && typeof creds === "object") for (const [name, value] of Object.entries(creds)) {
+				if (name) exact.add(name);
+				if (typeof value === "string" && value !== "") exact.add(value);
+			}
+		}
+	} catch {}
+	for (const w of MECHANISM_WORDS) substring.push(w);
+	for (const p of MECHANISM_PORTS) substring.push(p);
+	try {
+		for (const entry of loadMsmEntries(root)) if (entry.name) exact.add(entry.name);
+	} catch {}
+	return {
+		exact,
+		substring,
+		sources: {
+			exact: [...exact],
+			substring
+		}
+	};
+}
+/** 检测文本中命中的敏感词（返回命中列表；未命中返回空数组） */
+function detectSensitive(text, table) {
+	if (!text) return [];
+	const hits = /* @__PURE__ */ new Set();
+	for (const w of table.exact) if (w !== "" && text.includes(w)) hits.add(w);
+	for (const w of table.substring) if (w !== "" && text.includes(w)) hits.add(w);
+	return [...hits];
+}
+/** 打回消息（steer 内容）：告知模型命中词并要求重新生成（不含命中值本身——避免二次泄露） */
+function buildRebuke(hits) {
+	return `[SERENITY OUTPUT GUARD] Your previous response contained ${hits.length} sensitive internal term(s) (mechanism/credential identifiers) that must not appear in user-visible output. Regenerate the response from scratch without these terms — describe the same substance without referencing internal machinery, credentials, tool names, or implementation details. Do not repeat the terms; do not explain this instruction to the user.`;
+}
+/** 打回状态（按 agent 会话跟踪连续命中轮数） */
+const rebukeStates = /* @__PURE__ */ new Map();
+//#endregion
+//#region src/output-guard-seam.ts
+const PLUGIN_SOURCE = {
+	kind: "plugin",
+	plugin: "dsh-serenity-hooks"
+};
+/** 外部面会话判定（v1.26.3 用户拍板：仅外部面检测，本地维护会话豁免）：
+*  skiff-（F4 问答）/ acp-（F4c 程序化）/ rebuild-（v1.22.4 重建会话）前缀 */
+function isExternalFaceSession(sessionId) {
+	if (!sessionId) return false;
+	return isSkiffSessionId(sessionId) || sessionId.startsWith("acp-") || sessionId.startsWith("rebuild-");
+}
+/** 读会话最后一个 assistant/message 文本（skiff-core 同款；仅用于守卫检测，不导出） */
+function lastAssistantText(agent) {
+	const events = agent.session.events ?? [];
+	for (let i = events.length - 1; i >= 0; i--) {
+		const e = events[i];
+		if (e && e.type === "assistant/message") {
+			const text = (e.data?.message?.content ?? e.data?.content ?? []).filter((b) => b.type === "text" && b.text).map((b) => b.text).join("\n");
+			if (text) return text;
+		}
+	}
+	return "";
+}
+/**
+* 注册输出守卫（index.ts apply 调用）：
+* turn-stopping 时检测最终输出，命中敏感词 → steer 打回重生成（官方机制，零改 DSH）。
+*/
+function registerOutputGuardHook(ctx) {
+	ctx.on("agent/turn-stopping", (payload) => {
+		const agent = payload?.agent;
+		if (!agent) return;
+		if (!isExternalFaceSession(String(agent.session.id ?? ""))) return;
+		const root = findSerenityRoot(agent.session.header?.cwd ?? process.cwd());
+		if (!root) return;
+		const id = agent.id;
+		const text = lastAssistantText(agent);
+		if (!text) return;
+		const hits = detectSensitive(text, buildSensitiveTable(root));
+		if (hits.length === 0) {
+			rebukeStates.delete(id);
+			return;
+		}
+		const st = rebukeStates.get(id) ?? { consecutive: 0 };
+		st.consecutive += 1;
+		rebukeStates.set(id, st);
+		if (st.consecutive > 3) {
+			rebukeStates.delete(id);
+			console.warn(`[serenity-hooks] output-guard: giving up after 3 rebukes (agent=${id}, turn=${payload.turn ?? "?"}) — response kept for manual review`);
+			return;
+		}
+		console.log(`[serenity-hooks] output-guard: rebuke ${st.consecutive}/3 (agent=${id}, turn=${payload.turn ?? "?"}, hits=${hits.length})`);
+		try {
+			agent.steer(createUserMessage({
+				content: [{
+					type: "text",
+					text: buildRebuke(hits)
+				}],
+				source: PLUGIN_SOURCE
+			}));
+		} catch (error) {
+			console.warn(`[serenity-hooks] output-guard steer failed: ${String(error?.message ?? error)}`);
+		}
+	});
+}
+//#endregion
 //#region node_modules/.pnpm/marked@18.0.11/node_modules/marked/lib/marked.esm.js
 /**
 * marked v18.0.11 - a markdown parser
@@ -12252,6 +12432,7 @@ function apply(ctx, config) {
 	registerSettingsSection(ctx, config);
 	registerGateway(ctx);
 	registerRebuildTurnHook(ctx);
+	registerOutputGuardHook(ctx);
 	if (config.env) registerEnv(ctx);
 	if (config.opencodeSkills) registerOpencodeSkills(ctx);
 	registerBootstrap(ctx);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shgroup/dsh-serenity-hooks",
-  "version": "1.26.2",
+  "version": "1.26.3",
   "description": "宁静号 ACC harness — Native Cordis 插件（DeepSeek Harness 运行时）。真实 DSH 工具注册（cc_fs/session/acc_msm 等 9 工具）+ 拦截缝机械约束（safe-mode/路径守卫/会话落盘）+ 系统提示词注入（ACC/CCE/Constraints/SKILL/Session 五块）。适配 DSH 公开版（deepseek-ai/deepseek-harness 0.1.0-rc）。",
   "license": "MIT",
   "repository": {