@yep-ai/cli 1.0.2 → 1.1.0

package/README.md

@@ -5,14 +5,14 @@
 ## 安装与使用
 
 ```sh
-npx --yes @yep-ai/cli@latest --help
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep --help
 ```
 
-通过 npx 直接运行 npm 最新版，无需全局安装：
+以下远程命令适用于 1.1.0 发布之后；本次实现不代表 npm 或网站已更新。用户可通过 npx 运行设备节点安装包，无需全局安装：
 
 ```sh
-npx --yes @yep-ai/cli@latest --help
-npx --yes @yep-ai/cli@latest device start
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep --help
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep device start
 ```
 
 本包包含完整实现。`yep-cli` 是计划中的同版本入口包，当前尚未发布本项目版本，请使用 `@yep-ai/cli`。
@@ -26,31 +26,31 @@ npm install
 npm run yep -- --help
 npm run build:yep-node
 npm run pack:cli
-npm install --prefix ./tmp/yep-install ./dist/cli/scoped/yep-ai-cli-1.0.2.tgz ./dist/cli/unscoped/yep-cli-1.0.2.tgz
+npm install --prefix ./tmp/yep-install ./dist/cli/scoped/yep-ai-cli-1.1.0.tgz ./dist/cli/unscoped/yep-cli-1.1.0.tgz
 ./tmp/yep-install/node_modules/.bin/yep --version
 ```
 
-完整实现包为 `scoped/yep-ai-cli-1.0.2.tgz`，入口包为 `unscoped/yep-cli-1.0.2.tgz`。本地验证时可一起指定两份文件，无需从 npm 下载实现包。输出的 `manifest.json` 记录包名、版本、依赖和 SHA-256。
+完整实现包为 `scoped/yep-ai-cli-1.1.0.tgz`，入口包为 `unscoped/yep-cli-1.1.0.tgz`。本地验证时可一起指定两份文件，无需从 npm 下载实现包。输出的 `manifest.json` 记录包名、版本、依赖和 SHA-256。
 
 ## 市场与 Git 内容版本
 
 ```sh
-npx --yes @yep-ai/cli@latest login --registry https://yep.nihao.cool
-npx --yes @yep-ai/cli@latest whoami
-npx --yes @yep-ai/cli@latest search assistant
-npx --yes @yep-ai/cli@latest info @creator/demo
-npx --yes @yep-ai/cli@latest client set codex,claude
-npx --yes @yep-ai/cli@latest install @creator/demo --client codex
-npx --yes @yep-ai/cli@latest list
-npx --yes @yep-ai/cli@latest list --remote
-npx --yes @yep-ai/cli@latest list --mine
-npx --yes @yep-ai/cli@latest uninstall @creator/demo --client codex
-npx --yes @yep-ai/cli@latest publish ./my-skill
-npx --yes @yep-ai/cli@latest history @creator/demo
-npx --yes @yep-ai/cli@latest diff @creator/demo --base published
-npx --yes @yep-ai/cli@latest publish ./my-agent --kind agent
-npx --yes @yep-ai/cli@latest submit @creator/demo --kind agent
-npx --yes @yep-ai/cli@latest withdraw @creator/demo --kind agent
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep login --registry https://yep.nihao.cool
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep whoami
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep search assistant
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep info @creator/demo
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep client set codex,claude
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep install @creator/demo --client codex
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep list
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep list --remote
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep list --mine
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep uninstall @creator/demo --client codex
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep publish ./my-skill
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep history @creator/demo
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep diff @creator/demo --base published
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep publish ./my-agent --kind agent
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep submit @creator/demo --kind agent
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep withdraw @creator/demo --kind agent
 ```
 
 默认资源类型为 `skill`，也支持 `--kind agent|plugin`。Skill 私有保存后从网页申请共享审核；Agent/Plugin 的发布会提交审核。审核通过才进入公开市场。`history` 和 `diff` 访问服务端保留的真实 Git 版本。
@@ -60,20 +60,22 @@ npx --yes @yep-ai/cli@latest withdraw @creator/demo --kind agent
 ## 设备节点
 
 ```sh
-npx --yes @yep-ai/cli@latest device login
-npx --yes @yep-ai/cli@latest device start "/path/to/documents"
-npx --yes @yep-ai/cli@latest device status
-npx --yes @yep-ai/cli@latest device logout
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep device login
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep device start "/path/to/documents"
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep device status
+npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep device logout
 ```
 
-设备通过 HTTPS 配对和 WSS 出站连接；网页批准设备后，还需在某场咨询中选择目录和权限。目录不会整体上传。最多指定 5 个目录；指定目录时仅提供受限内置命令。不指定目录时，命令拥有当前系统用户的 shell 权限，可访问其他文件和网络。进程退出后节点离线，不安装后台服务。设备授权最长 24 小时，可以从网页或 CLI 撤销。
+设备通过 HTTPS 配对和 WSS 出站连接；网页批准设备后，还需在某场咨询中选择目录和权限。目录不会整体上传。最多指定 5 个目录；指定目录时仅提供受限内置命令。不指定目录时仅授权当前目录；必须显式使用 `--privacy system` 才启用完整系统终端，该终端拥有当前系统用户权限，可访问其他文件和网络，输入输出不经过文件脱敏。进程退出后节点离线，不安装后台服务。设备授权最长 24 小时，可以从网页或 CLI 撤销。
 
-节点上线后，可在「设备节点」点击「打开终端」。不指定启动目录时，npm 包内的 Go `yep-node` 为每个标签启动独立的真实 Shell：Windows 使用 ConPTY + cmd，macOS / Linux 使用 PTY + 当前用户的 Shell。输入直接进入终端，工作目录、变量和交互程序状态保留；支持 Ctrl+C、窗口尺寸变化和最多 4 个独立网页会话。AI 操作与网页终端分别执行，不共用工作目录或进程。关闭标签、撤销授权、节点退出或网络连接断开会终止对应 Shell；重连创建新会话，不重放命令。
+节点上线后，可在「设备节点」点击「打开终端」。显式使用 `--privacy system` 且不指定启动目录时，npm 包内的 Go `yep-node` 为每个标签启动独立的真实 Shell：Windows 使用 ConPTY + cmd，macOS / Linux 使用 PTY + 当前用户的 Shell。输入直接进入终端，工作目录、变量和交互程序状态保留；支持 Ctrl+C、窗口尺寸变化和最多 4 个独立网页会话。AI 操作与网页终端分别执行，不共用工作目录或进程。关闭标签、撤销授权、节点退出或网络连接断开会终止对应 Shell；重连创建新会话，不重放命令。
+
+终端中的「＋」可选择文件浏览器，Windows 还可选择 CMD 或 PowerShell。标签显示实际 Shell 名称，同名时才编号；仅当前标签显示关闭按钮。文件浏览器显示设备上的完整路径，选中文件可在底部展开大小、修改时间等概要，通过自定义右键菜单下载文件或复制完整路径。受限模式只能访问已授权目录，并继续排除 CLI 私有凭据及符号链接；下载期间文件变化、设备断线或授权失效会中断下载。
 
 原生程序随 npm 包一起分发，无需用户安装 Go。当前构建目标为 Windows x64 / ARM64、macOS Intel / Apple Silicon、Linux x64 / ARM64；Windows 需要支持 ConPTY 的 Windows 10 1809 / Server 2019 或更新版本。鸿蒙 / OpenHarmony 原生 ABI 尚未适配，不能将 Linux ARM64 包视为鸿蒙包。缺少原生程序时会明确提示并提供兼容的逐条命令模式；受限目录始终使用内置命令模式，不启动系统 Shell。
 
 设备配对和网络通道使用 HTTPS / WSS；服务端保存令牌摘要，客户端每小时轮换设备令牌并保留短暂交接窗口，轮换不会延长原有 24 小时授权。客户端先持久化待交接凭据，断线后继续完成交接。TLS 在站点入口终止，集群内部连接不属于端到端加密。
-指定启动目录时仅支持 `pwd`、`ls` / `dir`、`echo`、`cat` / `type`、`head`、`tail`、`grep` / `findstr`、`wc -l` 与终端内的 `cd`，不能使用管道、重定向或外部程序。已有旧版节点若提示不支持终端，请停止旧进程，将原启动命令中的 `yep` 替换为 `npx --yes @yep-ai/cli@latest`，保留原目录参数。
+指定启动目录时仅支持 `pwd`、`ls` / `dir`、`echo`、`cat` / `type`、`head`、`tail`、`grep` / `findstr`、`wc -l` 与终端内的 `cd`，不能使用管道、重定向或外部程序。已有旧版节点若提示不支持终端，请停止旧进程，将原启动命令中的 `yep` 替换为 `npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep`，保留原目录参数。
 
 设备默认连接 `https://yep.nihao.cool`，使用本站时无需指定服务器。连接自建站点时可使用 `--server https://your-site.example`；只接受 HTTPS 源站（回环开发地址允许 HTTP），显式指定后记住该源站，令牌按源站隔离。市场登录不等于设备授权。
 
@@ -93,4 +95,22 @@ npx --yes @yep-ai/cli@latest device logout
 
 市场凭据保存为 `~/.config/yep/config.json`；设备身份和各源站的授权保存在 `~/.config/yep/devices/`。目录权限 `0700`、凭据文件 `0600`；Windows 使用当前用户专属 ACL。市场和设备令牌分别管理。域名改变后需要在新源站重新登录、配对，不会把旧源站令牌发送到新地址。
 
-执行 `npx --yes @yep-ai/cli@latest --help` 或 `npx --yes @yep-ai/cli@latest device --help` 查看全部选项。
+执行 `npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep --help` 或 `npx --yes --package=https://yep.nihao.cool/downloads/yep-cli-1.1.0.tgz yep device --help` 查看全部选项。
+
+## 本地脱敏（1.1.0）
+
+默认 `device start` 为严格模式，无目录参数时仅授权当前目录；完整系统终端需显式 `--privacy system`，其输入输出不经过文件脱敏。读取、搜索、下载及发布前使用本机 Go 核心，规则修改不需要用户编译。
+
+```sh
+yep privacy init
+yep privacy validate --offline
+yep privacy test --offline
+yep privacy preview ./report.txt --offline
+yep privacy export ./report.txt --out ./report.safe.txt --offline
+```
+
+私有配置位于 `~/.config/yep/privacy/policy.yaml` 或 `policy.json`，二选一；目录 0700、文件 0600，Windows 使用 ACL。网页“设备节点 → 脱敏规则”保存通用规则并下发，真实私有词典留在本机。
+
+支持 10 MiB 以内的 UTF-8 文本、源码、JSON/YAML/CSV；PDF、Office、图片、压缩包与其他无法解析为文本的文件默认允许原样传输。可在「设备节点 → 脱敏规则」选择阻断，或设置本地 `unsupportedFiles: block`；任一适用策略要求阻断时以阻断为准。原件不覆盖。任意 JS 脚本不在默认引擎中执行。检测不保证穷尽自然语言秘密，发送前仍需本机复核。详见仓库 `docs/privacy.md`。
+
+本仓库已准备 1.1.0；npm 发布与网站部署完成后，对应远程版本命令才可使用。

package/bin/market.js

@@ -17,6 +17,7 @@ import { basename, dirname, isAbsolute, join, relative, resolve } from "node:pat
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import { installClientDefinitions, normalizeClients, promptClients, resolveClients } from "./clients.js";
+import { PrivacyManager, privateWrite } from "../lib/privacy/manager.js";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const rootDir = resolve(__dirname, "../../..");
@@ -202,7 +203,7 @@ async function publish(args, options) {
     options.token = storedAuth(registry)?.token;
   }
   const token = requireRegistryToken(options.token ?? storedAuth(registry)?.token, registry, "publish Skills");
-  const packageFiles = collectPackageFiles(packageDir);
+  const packageFiles = await privatePackageFiles(packageDir, registry, token);
   let ownedSkill = await apiFindOwnedSkillIfSupported(registry, manifest.name, token);
   if (ownedSkill?.version === manifest.version) {
     throw new Error(`Version ${manifest.name}@${manifest.version} already exists. Bump the version before publishing another package.`);
@@ -316,7 +317,7 @@ async function publishResource(args, options) {
     options.token = storedAuth(registry)?.token;
   }
   const token = requireRegistryToken(options.token, registry, "publish resources");
-  const files = Object.entries(collectPackageFiles(packageDir)).map(([path, content]) => ({ path, contentBase64: Buffer.from(content).toString("base64") }));
+  const files = Object.entries(await privatePackageFiles(packageDir, registry, token)).map(([path, content]) => ({ path, contentBase64: Buffer.from(content).toString("base64") }));
   if (!files.some((file) => file.path === manifest.entry)) throw new Error(`Package entry is excluded from publication: ${manifest.entry}`);
   const existing = await findResource(registry, { ...options, token }, manifest.name, true);
   if (existing?.status === "pending") throw new Error(`This resource is awaiting review; run "${cliName} withdraw ${manifest.name} --kind ${options.kind}" before editing it`);
@@ -1307,6 +1308,27 @@ function shouldRecordDownload(skill) {
   return skill?.visibility !== "private" && !["draft", "pending", "rejected"].includes(skill?.status);
 }
 
+async function privatePackageFiles(packageDir, registry, token) {
+  const manager = await PrivacyManager.create();
+  try {
+    try { await manager.apply(await apiFetch(registry, "/api/privacy/attachment-policy", {redirect:"error"}, token)); }
+    catch { throw new Error("发布已停止：无法校验当前账号的脱敏规则，原件未上传。"); }
+    const files = collectPackageFiles(packageDir), sanitized = Object.create(null);
+    let changed = false;
+    for (const [name, content] of Object.entries(files)) {
+      await manager.checkPath(name); await manager.metadata(name);
+      const result = await manager.scan(Buffer.from(content), name, "marketplace-publication");
+      sanitized[name] = result.data; changed ||= !Buffer.from(content).equals(result.data);
+    }
+    if (changed) {
+      const review = join(manager.directory, "review", String(Date.now()));
+      for (const [name, content] of Object.entries(sanitized)) await privateWrite(join(review, name), content);
+      throw new Error(`发布已停止，原件未上传。请在本机检查脱敏副本后，从该目录重新发布：${review}`);
+    }
+    return files;
+  } finally { await manager.close(); }
+}
+
 function collectPackageFiles(packageDir) {
   const files = Object.create(null);
   const seenPaths = new Map();
@@ -1349,7 +1371,7 @@ function collectPackageFiles(packageDir) {
 function shouldIgnorePackagePath(packagePath) {
   const segments = packagePath.split("/");
   const name = basename(packagePath);
-  return segments.includes(".git") || segments.includes("node_modules") || name === ".DS_Store" || name === "yep-installed.json" || name === ".yep.json" || name === "cpm-installed.json" || name === ".skills-center.json" || name === ".env" || name.startsWith(".env.");
+  return segments.includes(".git") || segments.includes(".yep") || segments.includes("node_modules") || name === ".DS_Store" || name === "yep-installed.json" || name === ".yep.json" || name === "cpm-installed.json" || name === ".skills-center.json" || name === ".env" || name.startsWith(".env.");
 }
 
 function safePackageOutput(target, packagePath) {

package/bin/yep.js

@@ -1,9 +1,11 @@
 #!/usr/bin/env node
 import { runMarketplace } from "./market.js";
 import { runDevice } from "../lib/device/command.js";
+import { runPrivacy } from "../lib/privacy/command.js";
 const argv = process.argv.slice(2);
 try {
   if (argv[0] === "device") await runDevice(argv.slice(1));
+  else if (argv[0] === "privacy") await runPrivacy(argv.slice(1));
   else await runMarketplace(argv);
 } catch (error) {
   console.error(error.message);

package/lib/device/client.js

@@ -4,9 +4,10 @@ import os from "node:os";
 import { createHash, randomUUID } from "node:crypto";
 import { spawn } from "node:child_process";
 import WebSocket from "ws";
-import { rootDescriptor, resolveSafe, list, execute, terminalDirectory } from "./tools.js";
+import { rootDescriptor, resolveSafe, list, execute, terminalDirectory, ownerFileList, ownerFileRead } from "./tools.js";
 import { findNativeBinary, NativeTerminal } from "./native-terminal.js";
 import { rotateDeviceCredential } from "./credential-rotation.js";
+import { PrivacyManager, privateRead } from "../privacy/manager.js";
 const PROTOCOL = 2;
 const DEFAULT_SERVER = "https://yep.nihao.cool";
 function serverOrigin(value) {
@@ -203,7 +204,7 @@ async function systemRoots(privateDir) {
   }));
 }
 class DeviceAgent {
-  constructor(roots, { restricted = true, privateDir, token, connectionId, expiresAt, onTerminalOutput } = {}) {
+  constructor(roots, { restricted = true, privateDir, token, connectionId, expiresAt, onTerminalOutput, privacy } = {}) {
     this.roots = roots;
     this.restricted = restricted;
     this.privateDir = privateDir;
@@ -211,13 +212,17 @@ class DeviceAgent {
     this.connectionId = connectionId;
     this.expiresAt = expiresAt;
     this.onTerminalOutput = onTerminalOutput;
+    this.privacy = privacy;
+    if (privacy) for (const root of roots) root.privacy = privacy;
     this.closed = false;
     this.bindings = /* @__PURE__ */ new Map();
     this.active = /* @__PURE__ */ new Map();
     this.terminalSessions = new Map();
   }
   publicRoots() {
-    return this.roots.map(({ id, name }) => ({ id, name }));
+    // The hello precedes the first cloud-policy fetch. Do not reveal local
+    // root names before that policy has been applied.
+    return this.roots.map(({ id, name }, index) => ({ id, name: this.privacy ? `授权目录 ${index + 1}` : name }));
   }
   cancel(frame = {}) {
     const waiting = [];
@@ -237,7 +242,8 @@ class DeviceAgent {
     this.terminalSessions.clear();
   }
   async terminalFrame(frame) {
-    const base = { id: frame.id, sessionId: frame.sessionId };
+    const privacyEpoch=this.privacy?.epoch;
+    const base = { id: frame.id, sessionId: frame.sessionId, ...(this.privacy?{privacyRevision:this.privacy.activeRevision}:{}) };
     if (typeof frame.sessionId !== "string" || !frame.sessionId || frame.sessionId.length > 200) throw new Error("Invalid terminal session");
     if (["terminal_cancel", "terminal_close"].includes(frame.type)) {
       if (frame.type === "terminal_close") {
@@ -262,7 +268,7 @@ class DeviceAgent {
     let complete;
     const done = new Promise(resolve => { complete = resolve; });
     this.active.set(frame.id, { abort, sessionId: frame.sessionId, done });
-    const valid = () => !this.closed && !session.closed && !abort.signal.aborted;
+    const valid = () => !this.closed && !session.closed && !abort.signal.aborted && (!this.privacy || this.privacy.ready && privacyEpoch===this.privacy.epoch);
     try {
       const cwd = frame.path ?? "";
       const changed = await terminalDirectory(root, cwd, frame.command, this.restricted);
@@ -292,11 +298,42 @@ class DeviceAgent {
   }
   async frame(frame) {
     if (this.closed) throw new Error("Stale device connection");
+    if (this.privacy && !["cancel", "unbound", "terminal_cancel", "terminal_close"].includes(frame.type)) this.privacy.assertReady(frame.privacyRevision);
     if (this.expiresAt && Date.now() >= Date.parse(this.expiresAt)) {
       this.close();
       throw new Error("Device authorization expired");
     }
     if (["terminal_exec", "terminal_cancel", "terminal_close"].includes(frame.type)) return this.terminalFrame(frame);
+    if (["owner_file_list", "owner_file_read"].includes(frame.type)) {
+      if (typeof frame.id !== "string" || !frame.id || this.active.has(frame.id) || this.active.size >= 8) throw new Error("Too many or duplicate local operations");
+      let root = this.roots.find(item => item.id === frame.folderId) ?? (!frame.folderId ? this.roots[0] : undefined);
+      let relative = frame.path ?? "";
+      if (this.privacy && typeof frame.absolutePath === "string" && frame.absolutePath.startsWith("yep-private://")) {
+        const value = new URL(frame.absolutePath);
+        root = this.roots.find(item => item.id === value.hostname);
+        if (!root) throw new Error("privacy_handle_invalid");
+        relative = decodeURIComponent(value.pathname.slice(1));
+        frame = { ...frame, absolutePath: undefined };
+      }
+      if (frame.absolutePath) {
+        if (typeof frame.absolutePath !== "string" || frame.absolutePath.length > 4096 || !path.isAbsolute(frame.absolutePath) || /[\0\r\n]/u.test(frame.absolutePath)) throw new Error("Invalid absolute path");
+        const location = path.resolve(frame.absolutePath);
+        const matches = this.roots.filter(item => { const rel = path.relative(item.absolute, location); return rel === "" || rel !== ".." && !rel.startsWith(".." + path.sep) && !path.isAbsolute(rel); }).sort((a, b) => b.absolute.length - a.absolute.length);
+        root = matches[0];
+        if (!root) throw new Error("Path is outside authorized directories");
+        relative = path.relative(root.absolute, location).split(path.sep).join("/");
+      }
+      if (!root) throw new Error("Unknown file root");
+      const abort = new AbortController();
+      let complete;
+      const done = new Promise(resolve => { complete = resolve; });
+      this.active.set(frame.id, { abort, done });
+      try {
+        const result = frame.type === "owner_file_list" ? await ownerFileList(root, relative, frame.offset ?? 0) : await ownerFileRead(root, relative, frame.offset ?? 0, frame.version ?? "");
+        if (this.closed || abort.signal.aborted) throw new Error("Operation canceled");
+        return { type: "result", id: frame.id, ...result, ...(frame.type === "owner_file_list" ? { folders: this.publicRoots().map((root, index) => ({ ...root, absolutePath: this.privacy ? `yep-private://${root.id}/` : this.roots[index].absolute })) } : {}) };
+      } finally { this.active.delete(frame.id); complete(); }
+    }
     const base = { id: frame.id, consultationId: frame.consultationId, bindingId: frame.bindingId, roundId: frame.roundId };
     if (frame.type === "cancel") {
       await this.cancel(frame);
@@ -323,6 +360,7 @@ class DeviceAgent {
         const targetFile = item.kind === "file" ? path.basename(resolved.absolute) : void 0;
         const absolute = targetFile ? path.dirname(resolved.absolute) : resolved.absolute;
         const root2 = await rootDescriptor("folder-" + randomUUID(), absolute, this.privateDir);
+        if (this.privacy) { root2.privacy=this.privacy;root2.privacyScope=frame.consultationId;try{await this.privacy.metadata(root2.name);}catch{root2.name="授权目录";} }
         if (targetFile) root2.targetFile = targetFile;
         folders.push(root2);
       }
@@ -357,7 +395,9 @@ class DeviceAgent {
     });
     this.active.set(frame.id, { abort, bindingId: frame.bindingId, roundId: frame.roundId, done });
     try {
-      const result = await execute(root, request, { restricted: this.restricted, signal: abort.signal, secrets: [this.token] });
+      // AI file bindings always use structured, sanitized builtins. The
+      // explicitly enabled owner terminal is a separate system capability.
+      const result = await execute(root, request, { restricted: true, signal: abort.signal, secrets: [this.token] });
       if (abort.signal.aborted || this.bindings.get(frame.bindingId) !== binding || frame.permissionVersion !== binding.permissionVersion) throw new Error("Authorization changed during operation");
       return { ...base, type: "result", result };
     } finally {
@@ -366,11 +406,22 @@ class DeviceAgent {
     }
   }
 }
-async function start(server, config, credential, directories, { name, noOpen, signal } = {}) {
+async function start(server, config, credential, directories, { name, noOpen, signal, privacyMode = "strict" } = {}) {
+  if (!directories.length && privacyMode === "strict") directories = [process.cwd()];
   const restricted = directories.length > 0;
   if (directories.length > 5) throw new Error("At most five startup directories");
   const roots = restricted ? await Promise.all(directories.map((p, i) => rootDescriptor("root-" + (i + 1), p, config.directory))) : await systemRoots(config.directory);
   if (!roots.length) throw new Error("No accessible filesystem roots");
+  const privacy = await PrivacyManager.create();
+  try {
+  privacy.watchLocal();
+  for (const root of roots) {
+    await privacy.checkPath(root.absolute);
+    try { await privacy.metadata(root.name); } catch { root.name = "授权目录"; }
+    root.privacy = privacy;
+  }
+  const privacyCache = path.join(privacy.directory, "public-" + createHash("sha256").update(server).update(credential.deviceId || createHash("sha256").update(credential.token).digest("hex")).digest("hex") + ".json");
+  try { await privacy.apply(JSON.parse((await privateRead(privacyCache, 3 * 1024 * 1024)).toString("utf8"))); } catch (error) { if (error.code !== "ENOENT") privacy.invalidate(); }
   const nativeBinary = restricted ? null : await findNativeBinary();
   if (!restricted && !nativeBinary) console.warn("未找到当前平台的原生终端组件，使用兼容命令模式。");
   console.log(restricted ? "受限目录模式：仅内置命令，不能启动 shell 或外部程序。" : "完整系统模式：网页授权执行的命令拥有当前系统用户权限，可访问其他文件和网络；这不是沙箱。");
@@ -422,7 +473,8 @@ async function start(server, config, credential, directories, { name, noOpen, si
       const url = new URL("/api/local-cli/connect", server);
       url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
       const ws = new WebSocket(url, { headers: { Authorization: `Bearer ${credential.token}` }, maxPayload: 15 * 1024 * 1024, handshakeTimeout: 15e3, followRedirects: false });
-      const agent = new DeviceAgent(roots, { restricted, privateDir: config.directory, token: credential.token, expiresAt: credential.expiresAt,
+      privacy.invalidate();
+      const agent = new DeviceAgent(roots, { restricted, privacy, privateDir: config.directory, token: credential.token, expiresAt: credential.expiresAt,
         onTerminalOutput: frame => { if (ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify(frame)); },
       });
       const native = nativeBinary ? new NativeTerminal(nativeBinary, frame => {
@@ -436,6 +488,31 @@ async function start(server, config, credential, directories, { name, noOpen, si
       let credentialRotation = false;
       let rotationTask = null;
       let awaitingCredential = false;
+      let privacySync = null, privacyAgain = false, lastPrivacyCheck = 0;
+      privacy.onChange = () => { void agent.cancel(); };
+      privacy.onStatus = () => { if(ws.readyState===WebSocket.OPEN && privacy.desiredHash)ws.send(JSON.stringify({type:"privacy_policy_status",revision:privacy.desiredRevision,contentSHA256:privacy.desiredHash,state:privacy.ready?"applied":"failed",errorCode:privacy.ready?undefined:"privacy_apply_failed"})); };
+      const syncPrivacy = () => {
+        privacyAgain = true;
+        if (privacySync) return privacySync;
+        privacySync = (async () => {
+          while (privacyAgain && ws.readyState === WebSocket.OPEN) {
+            privacyAgain = false; let bundle;
+            try {
+              bundle = await api(server, "/api/local-cli/privacy", { token: credential.token });
+              if (ws.readyState !== WebSocket.OPEN) return;
+              ws.send(JSON.stringify({ type: "privacy_policy_status", revision: bundle.revision, contentSHA256: bundle.contentSHA256, state: "validating" }));
+              const applied = await privacy.apply(bundle, { cachePath: privacyCache });
+              if (applied && ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify({ type: "privacy_policy_status", revision: bundle.revision, contentSHA256: bundle.contentSHA256, state: "applied" }));
+            } catch {
+              privacy.invalidate();
+              if (bundle && ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify({ type: "privacy_policy_status", revision: bundle.revision, contentSHA256: bundle.contentSHA256, state: "failed", errorCode: "privacy_apply_failed" }));
+              console.warn("脱敏规则暂未就绪，文件任务已暂停，将自动重试。");
+            }
+            lastPrivacyCheck = Date.now();
+          }
+        })().finally(() => { privacySync = null; });
+        return privacySync;
+      };
       const received = () => {
         if (ws.readyState !== WebSocket.OPEN || fatal || signal?.aborted) return;
         clearTimeout(receiveWatchdog);
@@ -477,7 +554,7 @@ async function start(server, config, credential, directories, { name, noOpen, si
       signal?.addEventListener("abort", abort, { once: true });
       ws.on("open", () => {
         received();
-        ws.send(JSON.stringify({ type: "hello", protocol: PROTOCOL, consentVersion: "yep-device-v2", directoryMode: restricted ? "restricted" : "system", folders: agent.publicRoots(), commandsEnabled: true, fileSelection: true, capabilities: ["terminal", ...(native ? ["pty"] : [])] }));
+        ws.send(JSON.stringify({ type: "hello", protocol: PROTOCOL, consentVersion: "yep-device-v2", directoryMode: restricted ? "restricted" : "system", folders: agent.publicRoots(), commandsEnabled: true, fileSelection: true, capabilities: ["privacy-v1", "opaque-files-v1", "terminal", "files-v1", ...(native ? ["pty", "shell-selection"] : [])] }));
       });
       ws.on("ping", received);
       ws.on("pong", received);
@@ -502,6 +579,7 @@ async function start(server, config, credential, directories, { name, noOpen, si
             agent.connectionId = frame.connectionId;
             credentialRotation = frame.credentialRotation === true;
             ready = true;
+            void syncPrivacy();
             delay = 1e3;
             console.log("设备已上线。可在网页设备节点中打开终端，或在咨询中选择目录；退出此进程将断开。");
             heartbeat = setInterval(() => {
@@ -515,6 +593,7 @@ async function start(server, config, credential, directories, { name, noOpen, si
               if (ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify({ type: "ping" }));
               updateCredential();
               if (Date.now() >= nextRotation) rotate();
+              if (Date.now() - lastPrivacyCheck > 60000 + Math.random() * 30000 || !privacy.ready) void syncPrivacy();
             }, 1e4);
             return;
           }
@@ -531,8 +610,10 @@ async function start(server, config, credential, directories, { name, noOpen, si
             ws.send(JSON.stringify({ type: "pong" }));
             return;
           }
+          if (frame.type === "pong") return;
           if (frame.type === "credential_updated") { awaitingCredential = false; return; }
           if (frame.type === "credential_update_error") { awaitingCredential = true; return; }
+          if (frame.type === "privacy_policy_changed") { privacy.invalidate(); if (ready) void syncPrivacy(); return; }
           if (!ready) return;
           if (["pty_open", "pty_input", "pty_resize", "pty_close"].includes(frame.type)) {
             try {
@@ -543,14 +624,19 @@ async function start(server, config, credential, directories, { name, noOpen, si
             }
             return;
           }
+          const privacyEpoch = privacy.epoch;
           const result = await agent.frame(frame);
-          if (result && ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify(result));
+          if (result && ws.readyState === WebSocket.OPEN) {
+            privacy.assertReady(frame.privacyRevision);
+            if (privacyEpoch !== privacy.epoch) throw new Error("privacy_policy_changed");
+            ws.send(JSON.stringify({ ...result, privacyRevision: privacy.activeRevision }));
+          }
         } catch (e) {
           if (fatal || signal?.aborted) return;
           if (frame?.id && ws.readyState === WebSocket.OPEN) {
-            let error = String(e.message).split(credential.token).join("[REDACTED]").split(config.directory).join("[私有目录]");
+            let error = /^privacy_[a-z_]+$/.test(String(e.message)) ? e.message : "privacy_operation_blocked";
             for (const root of [...agent.roots].sort((a, b) => b.absolute.length - a.absolute.length)) error = error.split(root.absolute).join("[授权目录]");
-            ws.send(JSON.stringify({ type: frame.type?.startsWith("terminal_") ? "terminal_error" : "result", id: frame.id, sessionId: frame.sessionId, bindingId: frame.bindingId, consultationId: frame.consultationId, error: error.slice(0, 8192) }));
+            ws.send(JSON.stringify({ type: frame.type?.startsWith("terminal_") ? "terminal_error" : "result", id: frame.id, sessionId: frame.sessionId, bindingId: frame.bindingId, consultationId: frame.consultationId, privacyRevision: privacy.activeRevision, error: error.slice(0, 8192) }));
           } else {
             fatal = e;
             native?.close();
@@ -578,7 +664,7 @@ async function start(server, config, credential, directories, { name, noOpen, si
     console.log(`连接已断开；${Math.ceil(delay / 1e3)}秒后重连。原咨询绑定已失效，重连后需重新选择。`);
     await retryDelay();
     delay = Math.min(delay * 2, 3e4);
-  }
+  } } finally { await privacy.close(); }
 }
 export {
   DeviceAgent,

package/lib/device/command.js

@@ -12,7 +12,8 @@ yep device status [--server https://your-site.example]
 yep device logout [--server https://your-site.example]
 
 选项：--name 名称、--no-open、--help、--version
-不带目录的 start 使用当前系统用户 shell（非沙箱）；带目录只支持受限内置命令。
+默认严格保护模式：未指定目录时仅共享当前目录，只支持受限内置命令。
+--privacy system 显式启用完整系统终端（非沙箱，终端流不受文件脱敏保护）。
 授权最长24小时；start不安装后台服务。
 默认连接 https://yep.nihao.cool；显式 --server 会记住源站，令牌仍按源站隔离。`;
 export async function runDevice(args = process.argv.slice(2)) {
@@ -26,7 +27,7 @@ export async function runDevice(args = process.argv.slice(2)) {
     return;
   }
   const command = args.shift();
-  let server, name, noOpen = false;
+  let server, name, noOpen = false, privacyMode = "strict";
   const directories = [];
   while (args.length) {
     const a = args.shift();
@@ -37,6 +38,7 @@ export async function runDevice(args = process.argv.slice(2)) {
       name = args.shift();
       if (!name) throw new Error("--name requires a value");
     } else if (a === "--no-open") noOpen = true;
+    else if (a === "--privacy") { privacyMode=args.shift();if (!["strict","system"].includes(privacyMode)) throw new Error("--privacy requires strict or system"); }
     else if (a.startsWith("-")) throw new Error(`Unknown option ${a}`);
     else directories.push(a);
   }
@@ -94,7 +96,7 @@ export async function runDevice(args = process.argv.slice(2)) {
       }
     } else credential = null;
     if (!credential) credential = await login(server, config, { name, noOpen, signal: controller.signal });
-    await start(server, config, credential, directories, { name, noOpen, signal: controller.signal });
+    await start(server, config, credential, directories, { name, noOpen, privacyMode, signal: controller.signal });
   } finally {
     process.removeListener("SIGINT", stop);
     process.removeListener("SIGTERM", stop);

package/lib/device/tools.js

@@ -3,6 +3,7 @@ import { constants as FS } from "node:fs";
 import path from "node:path";
 import { spawn } from "node:child_process";
 import { StringDecoder } from "node:string_decoder";
+import { createHash } from "node:crypto";
 import { windowsExecution } from "./windows-execution.js";
 const MAX_FILE = 10 * 1024 * 1024;
 const MAX_OUTPUT = 64 * 1024;
@@ -27,6 +28,7 @@ async function rootDescriptor(id, location, privateDir) {
 }
 async function resolveSafe(root, relative = "", kind) {
   safeRelative(relative);
+  if (root.privacy) { await root.privacy.checkPath(relative); await root.privacy.metadata(relative); }
   const rootStat = await fs.lstat(root.absolute);
   if (rootStat.isSymbolicLink() || rootStat.dev !== root.dev || rootStat.ino !== root.ino || !samePath(await fs.realpath(root.absolute), root.absolute)) throw new Error("Authorized directory was replaced");
   let candidate = root.absolute;
@@ -37,7 +39,7 @@ async function resolveSafe(root, relative = "", kind) {
   }
   const st = await fs.lstat(candidate);
   const real = await fs.realpath(candidate);
-  if (!samePath(real, candidate) || !within(root.absolute, real) || root.privateDir && within(root.privateDir, real)) throw new Error("Path escapes authorization");
+  if (!samePath(real, candidate) || !within(root.absolute, real) || root.privateDir && within(root.privateDir, real) || root.privacy && within(root.privacy.directory, real)) throw new Error("Path escapes authorization");
   if (kind === "file" && !st.isFile() || kind === "directory" && !st.isDirectory()) throw new Error("Unexpected file type");
   return { absolute: candidate, stat: st };
 }
@@ -71,11 +73,18 @@ async function readFile(root, relative, maximum = MAX_FILE) {
   try {
     const before = await fd.stat();
     if (before.ino !== resolved.stat.ino || before.dev !== resolved.stat.dev || !before.isFile()) throw new Error("File changed during authorization");
+    if (before.size > maximum) throw new Error("File exceeds size limit");
     const buffer = Buffer.alloc(Math.min(maximum + 1, before.size + 1));
-    const { bytesRead } = await fd.read(buffer, 0, buffer.length, 0);
-    if (bytesRead > maximum) throw new Error("File exceeds size limit");
+    let bytesRead = 0;
+    while (bytesRead < buffer.length) { const chunk = await fd.read(buffer, bytesRead, buffer.length - bytesRead, bytesRead); if (!chunk.bytesRead) break; bytesRead += chunk.bytesRead; }
+    const after = await fd.stat();
+    if (bytesRead > maximum || bytesRead !== before.size || after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs) throw new Error("File changed during read");
     await resolveSafe(root, relative, "file");
-    return buffer.subarray(0, bytesRead);
+    const data = buffer.subarray(0, bytesRead);
+    if (!root.privacy) return data;
+    const safe = (await root.privacy.scan(data, relative, root.privacyScope)).data;
+    Object.defineProperty(safe,"snapshotIdentity",{value:`${before.dev}:${before.ino}:${before.size}:${before.mtimeMs}:${before.ctimeMs}`});
+    return safe;
   } finally {
     await fd.close();
   }
@@ -105,6 +114,45 @@ async function list(root, relative = "", offset = 0, includeFiles = true) {
   }
   return { folderId: root.id, path: relative, parentPath: relative ? relative.split("/").slice(0, -1).join("/") : null, entries: page, offset, hasMore: offset + 200 < filtered.length };
 }
+// Owner-only browser operations. Absolute paths are returned only on this
+// protocol, never in public roots or AI bindings.
+async function ownerFileList(root, relative = "", offset = 0) {
+  const result = await list(root, relative, offset, true);
+  const entries = [];
+  for (const entry of result.entries) {
+    try {
+      const { absolute, stat } = await resolveSafe(root, entry.path);
+      entries.push({ ...entry, absolutePath: root.privacy ? `yep-private://${root.id}/${encodeURIComponent(entry.path)}` : absolute, isDirectory: stat.isDirectory(), size: stat.isFile() ? stat.size : 0, modifiedAt: stat.mtime.toISOString() });
+    } catch { /* A removed or inaccessible entry does not break the directory. */ }
+  }
+  return { ...result, nextOffset: result.hasMore ? offset + 200 : null, absolutePath: root.privacy ? `yep-private://${root.id}/${encodeURIComponent(relative)}` : (await resolveSafe(root, relative, "directory")).absolute, entries };
+}
+async function ownerFileRead(root, relative, offset = 0, version = "") {
+  if (!Number.isSafeInteger(offset) || offset < 0) throw new Error("Invalid file offset");
+  if (root.privacy) {
+    // Offsets and versions refer to the sanitized snapshot. Never slice the
+    // original first: a credential may cross a transport chunk boundary.
+    const epoch = root.privacy.epoch;
+    const data = await readFile(root, relative);
+    const identity = createHash("sha256").update(String(epoch)).update(data.snapshotIdentity).update(data).digest("hex");
+    if (version && version !== identity || offset > data.length) throw new Error("privacy_snapshot_changed");
+    return { name: path.basename(relative), size: data.length, offset, version: identity, data: data.subarray(offset, offset + 256 * 1024).toString("base64"), eof: offset + Math.min(256 * 1024, data.length - offset) === data.length };
+  }
+  const resolved = await resolveSafe(root, relative, "file");
+  const fd = await pinnedOpen(root, relative);
+  try {
+    const before = await fd.stat();
+    const identity = `${before.dev}:${before.ino}:${before.size}:${before.mtimeMs}:${before.ctimeMs}`;
+    if (before.ino !== resolved.stat.ino || before.dev !== resolved.stat.dev || !before.isFile() || version && version !== identity) throw new Error("File changed during download; please retry");
+    if (offset > before.size) throw new Error("Invalid file offset");
+    const buffer = Buffer.alloc(Math.min(256 * 1024, before.size - offset));
+    const { bytesRead } = await fd.read(buffer, 0, buffer.length, offset);
+    const after = await fd.stat();
+    if (`${after.dev}:${after.ino}:${after.size}:${after.mtimeMs}:${after.ctimeMs}` !== identity) throw new Error("File changed during download; please retry");
+    await resolveSafe(root, relative, "file");
+    return { name: path.basename(relative), size: before.size, offset, version: identity, data: buffer.subarray(0, bytesRead).toString("base64"), eof: offset + bytesRead === before.size };
+  } finally { await fd.close(); }
+}
 function utf8(data) {
   const text = new TextDecoder("utf-8", { fatal: true }).decode(data);
   if (text.includes("\0")) throw new Error("File is not UTF-8 text");
@@ -267,7 +315,8 @@ async function execute(root, request, { restricted = true, signal, secrets = [],
     const result = await builtin(root, request.path ?? "", request.command);
     if (signal?.aborted) throw new Error("Operation canceled");
     let stdout = "";
-    outputRedactor(secrets, text => { stdout += text; onOutput?.("stdout", text); })(result.text, true, result.truncated);
+    const protectedText = root.privacy ? (await root.privacy.scan(Buffer.from(result.text), "command-output.txt", root.privacyScope)).data.toString("utf8") : result.text;
+    outputRedactor(secrets, text => { stdout += text; onOutput?.("stdout", text); })(protectedText, true, result.truncated);
     return { stdout, stderr: "", exitCode: 0, truncated: result.truncated ?? false };
   }
   const { absolute } = await resolveSafe(root, request.path ?? "", "directory");
@@ -337,6 +386,8 @@ export {
   execute,
   fileOperation,
   list,
+  ownerFileList,
+  ownerFileRead,
   resolveSafe,
   rootDescriptor,
   safeRelative,

package/lib/privacy/command.js

@@ -0,0 +1,56 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { PrivacyManager, privacyDirectory, privateWrite } from "./manager.js";
+import { defaultPolicy } from "./worker.js";
+import { rootDescriptor, fileOperation } from "../device/tools.js";
+
+const help = `本地脱敏（不联网、不遥测、不修改原件）
+yep privacy init
+yep privacy rules
+yep privacy validate --offline
+yep privacy test --offline
+yep privacy scan <文件或目录> --offline
+yep privacy preview <文件> --offline
+yep privacy export <文件> --out <脱敏副本> --offline
+私有配置：~/.config/yep/privacy/policy.yaml 或 policy.json（只使用一个）。
+规则修改无需重新编译或重新安装 CLI。`;
+
+export async function runPrivacy(argv) {
+  const args = [...argv], command = args.shift();
+  if (!command || command === "--help") { console.log(help); return; }
+  let input, output;
+  while (args.length) { const value = args.shift(); if (value === "--offline") continue; if (value === "--out") { output = args.shift(); if (!output) throw new Error("--out 需要路径"); } else if (value.startsWith("-") || input) throw new Error("参数无效；请运行 yep privacy --help"); else input = value; }
+  if (command === "init") {
+    const location = path.join(privacyDirectory(), "policy.json");
+    for (const name of ["policy.json", "policy.yaml"]) { try { await fs.lstat(path.join(privacyDirectory(),name)); throw new Error("本地规则已存在，请直接编辑。" ); } catch (error) { if (error.code !== "ENOENT") throw error; } }
+    await privateWrite(location, JSON.stringify(defaultPolicy(), null, 2) + "\n"); console.log(`本地规则已创建：${location}`); return;
+  }
+  if (!["rules", "validate", "test", "scan", "preview", "export"].includes(command)) throw new Error("未知脱敏命令");
+  const manager = await PrivacyManager.create();
+  try {
+    if (command === "rules") { const response = await manager.worker.request("load", { configs: manager.localConfigs }); console.log(JSON.stringify({ baseline: "yep-privacy-default-v1", detectors: response.rules, localRules: manager.localConfigs.reduce((n,c) => n + (c.rules?.length ?? 0),0) },null,2)); return; }
+    if (command === "validate" || command === "test") { console.log("本地规则校验、编译与配置用例测试通过；原件未发送。"); return; }
+    if (!input) throw new Error("需要文件或目录路径");
+    const location = path.resolve(input);
+    async function scan(file) {
+      const root = await rootDescriptor("local-scan", path.dirname(file), manager.directory); root.privacy = manager;
+      const result = await fileOperation(root, { operation: "read", path: path.basename(file) }); return Buffer.from(result.data,"base64");
+    }
+    if (command === "preview" || command === "export") {
+      const data = await scan(location);
+      if (command === "preview") process.stdout.write(data);
+      else { if (!output || path.resolve(output) === location) throw new Error("--out 必须指定另一个路径，原件不能覆盖。"); const handle = await fs.open(path.resolve(output), "wx", 0o600); try { await handle.writeFile(data); } finally { await handle.close(); } console.log("已在本地生成导出副本，原件未修改、未上传。"); }
+      return;
+    }
+    let visited = 0, blocked = 0;
+    async function visit(file) {
+      if (++visited > 10000) throw new Error("扫描条目超过上限");
+      const stat = await fs.lstat(file);
+      if (stat.isSymbolicLink() || !stat.isFile() && !stat.isDirectory()) { blocked++; return; }
+      try { await manager.checkPath(file); } catch { blocked++; console.log(`BLOCK ${path.relative(location,file) || path.basename(file)}`); return; }
+      if (stat.isDirectory()) { for (const entry of await fs.readdir(file)) await visit(path.join(file,entry)); }
+      else { try { await scan(file); console.log(`CHECKED ${path.relative(location,file) || path.basename(file)}`); } catch { blocked++; console.log(`BLOCK ${path.relative(location,file) || path.basename(file)}`); } }
+    }
+    await visit(location); console.log(`本地检查完成：${visited} 条，${blocked} 条阻断，未发送原件。`); if (blocked) process.exitCode = 2;
+  } finally { await manager.close(); }
+}

package/lib/privacy/manager.js

@@ -0,0 +1,139 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import os from "node:os";
+import { createHash, createHmac, randomUUID } from "node:crypto";
+import { PrivacyWorker, defaultPolicy, sessionKey } from "./worker.js";
+import { protectPrivate, verifyPrivate } from "./permissions.js";
+import { constants as FS } from "node:fs";
+
+export function privacyDirectory() { return process.env.YEP_PRIVACY_CONFIG_DIR || path.join(process.env.YEP_CONFIG_DIR || path.join(process.env.YEP_HOME || os.homedir(), ".config", "yep"), "privacy"); }
+export async function privateRead(location, maximum = 1024 * 1024) {
+  const before = await verifyPrivate(location);
+  if (!before.isFile() || before.isSymbolicLink() || before.size > maximum || process.platform !== "win32" && (before.mode & 0o077 || before.uid !== process.getuid())) throw new Error("privacy_local_config_unsafe");
+  const handle = await fs.open(location, FS.O_RDONLY | (FS.O_NOFOLLOW || 0));
+  try {
+    const st = await handle.stat(); if (st.ino !== before.ino || st.dev !== before.dev) throw new Error("privacy_local_config_changed");
+    const buffer = Buffer.alloc(before.size + 1);let size=0;
+    while(size<buffer.length){const read=await handle.read(buffer,size,buffer.length-size,size);if(!read.bytesRead)break;size+=read.bytesRead;}
+    const data=buffer.subarray(0,size); const after = await handle.stat();
+    if (data.length > maximum || after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs) throw new Error("privacy_local_config_changed");
+    return data;
+  } finally { await handle.close(); }
+}
+export async function privateWrite(location, data) {
+  const created = await fs.mkdir(path.dirname(location), { recursive: true, mode: 0o700 });
+  if (created) await protectPrivate(path.dirname(location), true);
+  await verifyPrivate(path.dirname(location), true);
+  const st = await fs.lstat(path.dirname(location));
+  if (!st.isDirectory() || st.isSymbolicLink() || process.platform !== "win32" && (st.mode & 0o077 || st.uid !== process.getuid())) throw new Error("privacy_local_config_unsafe");
+  const temporary = location + "." + randomUUID();
+  try { const handle = await fs.open(temporary, "wx", 0o600); try { await protectPrivate(temporary); await handle.writeFile(data); await handle.sync(); } finally { await handle.close(); } await fs.rename(temporary, location); if(process.platform!=="win32"){const directory=await fs.open(path.dirname(location),"r");try{await directory.sync();}finally{await directory.close();}} }
+  finally { await fs.unlink(temporary).catch(() => {}); }
+}
+
+export class PrivacyManager {
+  constructor(worker, directory) {
+    this.worker = worker; this.directory = path.resolve(directory); this.epoch = 0; this.ready = false; this.activeRevision = -1; this.desiredRevision = -1;
+    this.key = sessionKey(); this.publicConfigs = []; this.localConfigs = []; this.cache = new Map(); this.cacheBytes = 0; this.localFingerprint = "";
+    this.sequence = Promise.resolve(); this.localError = false; this.onChange = () => {}; this.onStatus=()=>{};
+  }
+  static async create({ directory = privacyDirectory() } = {}) {
+    const manager = new PrivacyManager(await PrivacyWorker.create(), directory);
+    try { await manager.reloadLocal(true); return manager; } catch (error) { await manager.close(); throw error; }
+  }
+  serial(job) { const result = this.sequence.then(() => { if (this.closed) throw new Error("privacy_manager_closed"); return job(); }); this.sequence = result.catch(() => {}); return result; }
+  invalidate() { this.ready = false; this.epoch++; this.cache.clear(); this.cacheBytes = 0; this.onChange(); }
+  async readLocal() {
+    let raw, filename;
+    for (const name of ["policy.yaml", "policy.json"]) {
+      try { const value = await privateRead(path.join(this.directory, name)); if (raw) throw new Error("privacy_multiple_local_policies"); raw = value; filename = name; }
+      catch (error) { if (error.code !== "ENOENT") throw error; }
+    }
+    if (!raw) return { configs: [], fingerprint: "none" };
+    const parsed = JSON.parse((await this.worker.request("parse", {}, raw)).data.toString("utf8"));
+    const contents = [raw];
+    for (const rule of parsed.rules ?? []) if (rule.match?.type === "dictionary" && rule.match.source) {
+      const source = rule.match.source;
+      if (typeof source !== "string" || source.includes("\\") || path.isAbsolute(source) || source.split("/").includes("..")) throw new Error("privacy_dictionary_path_invalid");
+      const location = path.resolve(this.directory, source);
+      for (let current = path.dirname(location); current !== path.dirname(this.directory); current = path.dirname(current)) {
+        const st = await fs.lstat(current); if (st.isSymbolicLink() || !st.isDirectory()) throw new Error("privacy_dictionary_path_invalid");
+      }
+      const data = await privateRead(location, 512 * 1024); contents.push(data);
+      const values = JSON.parse(data.toString("utf8")); if (!Array.isArray(values) || values.some(value => typeof value !== "string")) throw new Error("privacy_dictionary_invalid");
+      rule.match.values = values; delete rule.match.source;
+    }
+    return { configs: [parsed], fingerprint: createHash("sha256").update(filename).update(Buffer.concat(contents)).digest("hex") };
+  }
+  async reloadLocal(initial = false) {
+    return this.serial(async () => {
+      try {
+        const next = await this.readLocal(); if (!initial && next.fingerprint === this.localFingerprint && !this.localError) return;
+        this.invalidate();
+        await this.worker.request("load", { configs: [...this.publicConfigs, ...next.configs] });
+        if (this.closed) throw new Error("privacy_manager_closed");
+        this.localConfigs = next.configs; this.localFingerprint = next.fingerprint; this.localError = false;
+        this.ready = initial || this.activeRevision >= this.desiredRevision;
+        this.onStatus();
+      } catch { this.localError = true; this.invalidate(); this.onStatus(); throw new Error("privacy_local_policy_invalid"); }
+    });
+  }
+  watchLocal() {
+    if (this.watcher) return;
+    // Polling also catches atomic editor replacements and dictionary edits.
+    this.watcher = setInterval(() => { void this.reloadLocal().catch(() => {}); }, 3000); this.watcher.unref();
+  }
+  async apply(bundle, { cachePath } = {}) {
+    if (bundle.schemaVersion!==1 || !Number.isSafeInteger(bundle.revision) || bundle.revision < 0 || typeof bundle.content !== "string" || bundle.content.length > 2 * 1024 * 1024 || !/^[0-9a-f]{64}$/.test(bundle.contentSHA256) || createHash("sha256").update(bundle.content).digest("hex") !== bundle.contentSHA256) throw new Error("privacy_bundle_invalid");
+    if (bundle.revision < this.desiredRevision) return false;
+    this.desiredRevision = bundle.revision;
+    this.desiredHash = bundle.contentSHA256;
+    if (this.activeRevision === bundle.revision && this.activeHash === bundle.contentSHA256 && !this.localError && this.ready) return true;
+    this.invalidate(); const desired = bundle.revision;
+    return this.serial(async () => {
+      if (desired !== this.desiredRevision) return false;
+      const configs = JSON.parse(bundle.content);
+      if (!Array.isArray(configs) || configs.length > 32 || configs.some(config => (config.rules ?? []).some(rule => rule.match?.type === "dictionary" || rule.match?.source || rule.match?.values))) throw new Error("privacy_public_policy_invalid");
+      await this.worker.request("load", { configs: [...configs, ...this.localConfigs] });
+      if (this.closed) throw new Error("privacy_manager_closed");
+      if (desired !== this.desiredRevision) return false;
+      if (cachePath) await privateWrite(cachePath, JSON.stringify(bundle));
+      if (this.closed) throw new Error("privacy_manager_closed");
+      this.publicConfigs = configs; this.activeRevision = desired; this.activeHash = bundle.contentSHA256;
+      this.ready = !this.localError; this.epoch++; this.cache.clear(); this.cacheBytes = 0;
+      return this.ready;
+    });
+  }
+  assertReady(requiredRevision = this.desiredRevision) {
+    if (this.closed || !this.ready || this.localError || this.worker.failed || requiredRevision > this.activeRevision) throw new Error("privacy_policy_not_ready");
+  }
+  async checkPath(relative) { this.assertReady(); await this.worker.request("path", { path: relative }); }
+  async metadata(text) {
+    const result = await this.scan(Buffer.from(text), "metadata.txt");
+    if (result.action !== "allow") throw new Error("privacy_metadata_blocked");
+    return text;
+  }
+  async scan(data, relative = "content.txt", scope = "") {
+    this.assertReady(); const epoch = this.epoch;
+    const hash = createHash("sha256").update(String(epoch)).update(scope).update(relative).update(data).digest("hex");
+    const cached = this.cache.get(hash); if (cached) return { ...cached, data: Buffer.from(cached.data) };
+    const key = createHmac("sha256", Buffer.from(this.key, "base64")).update(scope).digest("base64");
+    const result = await this.worker.request("scan", { path: relative, key }, data);
+    if (!this.ready || this.epoch !== epoch) throw new Error("privacy_policy_changed");
+    if (result.data.length <= 2 * 1024 * 1024) {
+      while (this.cache.size >= 32 || this.cacheBytes + result.data.length > 8 * 1024 * 1024) { const first = this.cache.keys().next().value; if (!first) break; this.cacheBytes -= this.cache.get(first).data.length; this.cache.delete(first); }
+      this.cache.set(hash, { ...result, data: Buffer.from(result.data) }); this.cacheBytes += result.data.length;
+    }
+    return result;
+  }
+  async close() {
+    this.closed = true;
+    clearInterval(this.watcher);
+    this.invalidate();
+    this.worker.close();
+    // A cache write already in progress must finish before callers remove the
+    // private directory or start another process using it.
+    await this.sequence;
+    this.ready = false;
+  }
+}

package/lib/privacy/permissions.js

@@ -0,0 +1,34 @@
+import { spawn } from "node:child_process";
+import fs from "node:fs/promises";
+import path from "node:path";
+
+function run(executable, args, env = process.env) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(executable, args, { env, stdio: "ignore", windowsHide: true });
+    const timer = setTimeout(() => { child.kill(); reject(new Error("privacy_local_config_unsafe")); }, 10000);
+    child.once("error", () => { clearTimeout(timer); reject(new Error("privacy_local_config_unsafe")); });
+    child.once("exit", code => { clearTimeout(timer); code === 0 ? resolve() : reject(new Error("privacy_local_config_unsafe")); });
+  });
+}
+export async function protectPrivate(location, directory = false) {
+  if (process.platform !== "win32") return fs.chmod(location, directory ? 0o700 : 0o600);
+  const identity = process.env.USERDOMAIN ? `${process.env.USERDOMAIN}\\${process.env.USERNAME}` : process.env.USERNAME;
+  if (!identity) throw new Error("privacy_local_config_unsafe");
+  await run("icacls", [location, "/inheritance:r", "/grant:r", `${identity}:${directory ? "(OI)(CI)" : ""}F`]);
+  await verifyPrivate(location, directory);
+}
+export async function verifyPrivate(location, directory = false) {
+  const st = await fs.lstat(location);
+  if (st.isSymbolicLink() || (directory ? !st.isDirectory() : !st.isFile())) throw new Error("privacy_local_config_unsafe");
+  if (process.platform !== "win32") {
+    if (st.mode & 0o077 || st.uid !== process.getuid()) throw new Error("privacy_local_config_unsafe");
+  } else {
+    const script = "$ErrorActionPreference='Stop'; $acl=Get-Acl -LiteralPath $env:YEP_PRIVACY_ACL_PATH; if(-not $acl.AreAccessRulesProtected){exit 2}; $sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value; foreach($rule in $acl.Access){if($rule.AccessControlType -eq 'Allow'){$who=$rule.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value; if($who -ne $sid -and $who -ne 'S-1-5-18' -and $who -ne 'S-1-5-32-544'){exit 3}}}; exit 0";
+    await run("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { ...process.env, YEP_PRIVACY_ACL_PATH: location });
+  }
+  for (let parent=path.dirname(location);;parent=path.dirname(parent)) {
+    const ancestor=await fs.lstat(parent);if(ancestor.isSymbolicLink()||!ancestor.isDirectory())throw new Error("privacy_local_config_unsafe");
+    if(path.dirname(parent)===parent)break;
+  }
+  return st;
+}

package/lib/privacy/worker.js

@@ -0,0 +1,63 @@
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { findNativeBinary } from "../device/native-terminal.js";
+
+export class PrivacyWorker {
+  constructor(binary) {
+    this.child = spawn(binary, ["privacy-worker"], { stdio: ["pipe", "pipe", "ignore"], windowsHide: true, env: { ...(process.platform === "win32" ? { SystemRoot: process.env.SystemRoot } : {}), GOMEMLIMIT: "256MiB", GOMAXPROCS: "2" } });
+    this.pending = new Map(); this.sequence = 0; this.buffer = Buffer.alloc(0); this.header = null; this.failed = false;
+    const failed = () => {
+      if (this.failed) return;
+      this.failed = true; this.buffer = Buffer.alloc(0);
+      for (const job of this.pending.values()) { clearTimeout(job.timer); job.reject(new Error("privacy_worker_unavailable")); }
+      this.pending.clear(); this.child.kill();
+    };
+    this.child.on("error", failed); this.child.on("exit", failed); this.child.stdin.on("error", failed);
+    this.child.stdout.on("data", chunk => {
+      if (this.failed) return;
+      this.buffer = Buffer.concat([this.buffer, chunk]);
+      if (this.buffer.length > 22 * 1024 * 1024) return failed();
+      try {
+        while (true) {
+          if (!this.header) {
+            if (this.buffer.length < 4) break;
+            const length = this.buffer.readUInt32BE(0);
+            if (length < 1 || length > 65536) return failed();
+            if (this.buffer.length < 4 + length) break;
+            this.header = JSON.parse(this.buffer.subarray(4, 4 + length).toString("utf8")); this.buffer = this.buffer.subarray(4 + length);
+            if (!Number.isSafeInteger(this.header.bytes) || this.header.bytes < 0 || this.header.bytes > 20 * 1024 * 1024) return failed();
+          }
+          if (this.buffer.length < this.header.bytes) break;
+          const response = this.header, data = Buffer.from(this.buffer.subarray(0, response.bytes));
+          this.buffer = this.buffer.subarray(response.bytes); this.header = null;
+          const job = this.pending.get(response.id); if (!job) return failed();
+          this.pending.delete(response.id); clearTimeout(job.timer);
+          if (response.error) job.reject(new Error(/^privacy_[a-z_]+$/.test(response.error) ? response.error : "privacy_scan_failed"));
+          else job.resolve({ ...response, data });
+        }
+      } catch { failed(); }
+    });
+    this.fail = failed;
+  }
+  request(operation, options = {}, data = Buffer.alloc(0)) {
+    if (this.failed || this.pending.size >= 8 || data.length > 10 * 1024 * 1024) return Promise.reject(new Error("privacy_worker_busy"));
+    const id = ++this.sequence;
+    const header = Buffer.from(JSON.stringify({ ...options, id, operation, bytes: data.length }));
+    if (header.length > 3 * 1024 * 1024) return Promise.reject(new Error("privacy_config_too_large"));
+    const prefix = Buffer.alloc(4); prefix.writeUInt32BE(header.length);
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => this.fail(), 15000);
+      this.pending.set(id, { resolve, reject, timer });
+      this.child.stdin.cork(); this.child.stdin.write(prefix); this.child.stdin.write(header); this.child.stdin.write(data); this.child.stdin.uncork();
+    });
+  }
+  close() { this.fail(); }
+  static async create() {
+    const binary = await findNativeBinary();
+    if (!binary) throw new Error("privacy_native_component_missing: 请更新 CLI，当前平台缺少本地脱敏组件。");
+    return new PrivacyWorker(binary);
+  }
+}
+
+export const defaultPolicy = () => ({ version: 1, extends: "yep-privacy-default-v1", profile: "strict", onFailure: "block", unsupportedFiles: "allow", rules: [] });
+export const sessionKey = () => randomBytes(32).toString("base64");

package/native/manifest.json

@@ -1,34 +1,34 @@
 {
   "schema": 1,
-  "sourceSHA256": "800213014e6af32ed8b98749e832752b940ae638eaefa472aceb7b62e815b3e4",
+  "sourceSHA256": "f50333c164d2c15cc8b72308e0d7660bb87298f086019cd7d596e878f1f1daca",
   "files": {
     "win32-x64/yep-node.exe": {
-      "sha256": "b3b4ae3515f9408e2535af8d1a926b92099892968b1493fd781092a1299afdfd",
+      "sha256": "82ea2f49afca3d46defb4cbfe09158635e00c5f4fe8980633ba9909ddef16843",
       "goos": "windows",
       "goarch": "amd64"
     },
     "win32-arm64/yep-node.exe": {
-      "sha256": "73e46d8bfa35c599411c3c02adef068cd9e0e7ba317b4fa309d778381d214aac",
+      "sha256": "3d974c4b22c97ea5ef2389d55d6daf3dffe27ed50bd54dd6cbcbf309001f2196",
       "goos": "windows",
       "goarch": "arm64"
     },
     "darwin-x64/yep-node": {
-      "sha256": "95bead46821a2800958d8dc865d67d9bfe83ac666b4796d046f2586b020989fc",
+      "sha256": "d3379f423d57598382ca56018b206b4f6eddafd3f1e733cf22070fd9d27a5eda",
       "goos": "darwin",
       "goarch": "amd64"
     },
     "darwin-arm64/yep-node": {
-      "sha256": "6368ef2786d34168d6b2051d722fca2c4eaa7d261bfef29309dd10ef558718b7",
+      "sha256": "ec47bef2b4f5f221dc0363710e95bd7df412e509e411b93ec9b786c1473fea41",
       "goos": "darwin",
       "goarch": "arm64"
     },
     "linux-x64/yep-node": {
-      "sha256": "e2d0cf28712d255b6aa7e4e010203abf6c3ea5f971b5a8db78a63ebd37314fad",
+      "sha256": "5bc06697598bb6bb0d36b08bf0eabe877204c3f73f48cbfac675fdf1590d0499",
       "goos": "linux",
       "goarch": "amd64"
     },
     "linux-arm64/yep-node": {
-      "sha256": "c956a49fc196d2cbf5779fef63e1a1f21d86eb6cc67d4abbf583f954f3422d43",
+      "sha256": "8eee868c965b7388b23935c9da6124cb2b59f9d03ff6d2ba36981e8d04fb2136",
       "goos": "linux",
       "goarch": "arm64"
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yep-ai/cli",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "description": "Yep Marketplace unified CLI: skills, agents, plugins and authorized device nodes.",
   "type": "module",
   "bin": {