@zicolasjac-ai/remote-readonly-ssh 1.0.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 readonly-ssh contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,74 @@
+# rrs
+
+只读 SSH 运维 CLI —— 通过堡垒机（JumpServer 式菜单）在服务器上执行**白名单强制的只读查询**。设计上零写能力。
+
+把"只读"从行为自律变成**技术强制**，适合 AI 助手、脚本、团队成员以最小权限做服务器排查。
+
+## 为什么需要它
+
+- **技术强制只读**：命令前缀白名单 + 禁止模式 + 参数防注入 + 目标主机白名单，多层校验。
+- **审计留痕**：每次调用（含被拒绝的记录）写入本地审计日志，可随时审查。
+- **零依赖**：只依赖系统自带 `ssh` 客户端，无 npm 依赖树。
+
+## 安装
+
+```bash
+npm install -g @zicolasjac-ai/remote-readonly-ssh
+```
+
+要求 Node.js >= 18，系统已装 OpenSSH 客户端（Windows 10+ / Linux / macOS 自带）。
+
+## 快速开始
+
+```bash
+rrs init          # 生成配置模板 ~/.rrs/config.json
+# 编辑配置: 填 jump_server / private_key_path / target_hosts
+rrs list-tools    # 查看白名单
+rrs sys-info
+```
+
+## 用法
+
+```
+rrs <tool> [arg] [--host <ip>] [--config <file>]
+```
+
+| 工具 | 说明 |
+|------|------|
+| `init` | 生成配置模板 `~/.rrs/config.json` |
+| `list-tools` | 查看工具、白名单、配置路径 |
+| `sys-info` | 主机名 / 系统版本 / 内核 / 运行时间 |
+| `proc <pattern>` | 进程查询（严格字符校验，防注入） |
+| `ports [filter]` | 监听端口查询（`ss -tln`） |
+| `read-file <path>` | 读文件（路径白名单 + 敏感黑名单） |
+| `dir <path>` | 列目录（同路径白名单） |
+| `bin-version <bin>` | 查二进制版本/编译参数（二进制白名单） |
+| `exec-only <cmd>` | 通用只读命令（前缀白名单 + 禁止模式） |
+
+## 配置
+
+文件：`~/.rrs/config.json`（可用 `--config <file>` 或环境变量 `RRS_CONFIG` 覆盖）
+
+| 键 | 说明 |
+|-----|------|
+| `jump_server` | 堡垒机地址 / 端口 / 用户名 |
+| `private_key_path` | SSH 私钥路径（Windows 建议放 `~/.ssh/locked/` 收紧 ACL；Linux/Mac 用 `chmod 600`） |
+| `target_hosts` | 允许访问的目标主机白名单 `{ip: 堡垒机搜索关键字}` |
+| `allowed_version_bins` | 允许执行 `-v/-V` 的二进制白名单 |
+| `allowed_command_prefixes` | 只读命令前缀白名单（cat/ls/grep/ps/ss/tail...） |
+| `allowed_path_prefixes` | 允许读取的路径前缀 |
+| `blocked_paths` | 敏感路径黑名单（shadow/passwd/密钥/家目录） |
+
+审计日志：`~/.rrs/audit.log`
+
+## 安全模型
+
+- **双层校验**：每条命令必须以允许前缀开头，且不得含禁止模式（rm/mv/vi/systemctl/sudo/重定向到文件/shadow/ssh 密钥等），否则一律拒绝。
+- **防绕过加固**：路径 `..` 穿越规范化、反斜杠转义、命令替换（`$()`、反引号）、分隔符（`;` `&` `&&`）等攻击面全部封堵。
+- **参数防注入**：`proc`/`ports`/`bin-version` 参数做严格字符集校验。
+- **主机白名单**：未登记 IP 一律拒绝。
+- **无写原语**：工具集中不存在任何写操作路径；写操作由人工执行，本工具只读。
+
+## 许可证
+
+MIT

package/bin/rrs.js

@@ -0,0 +1,150 @@
+#!/usr/bin/env node
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+const { loadConf, configDir, audit } = require("../src/config");
+const { JumpShell, cleanAnsi } = require("../src/jumpshell");
+const {
+  validateCmd, validatePath, validateHost, validateArg, validateBin,
+} = require("../src/whitelist");
+
+const PACKAGE_ROOT = path.join(__dirname, "..");
+
+function printUsage() {
+  const cmds = [
+    ["init", "生成配置模板到 ~/.rrs/config.json"],
+    ["list-tools", "查看工具、白名单、配置"],
+    ["sys-info", "主机名/OS/内核/uptime"],
+    ["proc <pattern>", "进程查询（防注入参数校验）"],
+    ["ports [filter]", "监听端口查询"],
+    ["read-file <path>", "读文件（路径白名单）"],
+    ["dir <path>", "列目录（路径白名单）"],
+    ["bin-version <bin>", "查二进制版本（二进制白名单）"],
+    ["exec-only <cmd>", "通用只读命令（前缀白名单+禁止模式）"],
+  ];
+  console.log("rrs — 只读 SSH 运维 CLI（白名单强制，零写能力）\n");
+  console.log("用法: rrs <工具> [参数] [--host <ip>] [--config <file>]\n");
+  for (const [k, v] of cmds) {
+    console.log(`  ${k.padEnd(22)} ${v}`);
+  }
+}
+
+function parseArgs(argv) {
+  const opts = { tool: null, arg: null, host: null, config: null };
+  const rest = [];
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--host") opts.host = argv[++i];
+    else if (a === "--config") opts.config = argv[++i];
+    else if (a === "-h" || a === "--help") { opts.tool = "help"; }
+    else rest.push(a);
+  }
+  opts.tool = opts.tool || rest[0] || "help";
+  opts.arg = rest[1] || null;
+  return opts;
+}
+
+function initConfig() {
+  const dir = configDir();
+  fs.mkdirSync(dir, { recursive: true });
+  const dest = path.join(dir, "config.json");
+  if (fs.existsSync(dest)) {
+    console.log(`配置已存在: ${dest}（未覆盖，如需重置请手动删除）`);
+    return;
+  }
+  const tpl = fs.readFileSync(path.join(PACKAGE_ROOT, "config.example.json"), "utf8");
+  fs.writeFileSync(dest, tpl, "utf8");
+  console.log(`已生成配置模板: ${dest}`);
+  console.log("请填写 jump_server（跳板机）、private_key_path（私钥）、target_hosts（目标主机）后使用。");
+}
+
+function buildCmds(tool, arg, conf) {
+  switch (tool) {
+    case "sys-info":
+      return [
+        "echo ===HOST===; hostname; whoami; id",
+        "echo ===OS===; head -5 /etc/os-release 2>&1",
+        "echo ===KERNEL===; uname -a",
+        "echo ===UPTIME===; uptime",
+      ];
+    case "proc":
+      return [`ps -ef | grep -E '${validateArg(arg, "进程名")}' | grep -v grep`];
+    case "ports":
+      return arg
+        ? [`ss -tln | grep '${validateArg(arg, "端口过滤")}'`]
+        : ["ss -tln"];
+    case "read-file":
+      return [`cat ${validatePath(arg, conf)}`];
+    case "dir":
+      return [`ls -la ${validatePath(arg, conf)}`];
+    case "bin-version":
+      return [`${validateBin(arg, conf)} -v 2>&1`, `${validateBin(arg, conf)} -V 2>&1`];
+    case "exec-only":
+      return [validateCmd(arg, conf)];
+    default:
+      throw new Error(`未知工具 [${tool}]，用 list-tools 查看`);
+  }
+}
+
+function listTools(conf) {
+  console.log("可用只读工具:");
+  const tools = {
+    "sys-info": "主机名/OS/内核/uptime",
+    "proc <pattern>": "进程查询",
+    "ports [filter]": "端口查询",
+    "read-file <path>": "读文件（路径白名单）",
+    "dir <path>": "列目录",
+    "bin-version <bin>": "查版本（二进制白名单）",
+    "exec-only <cmd>": "通用只读命令（白名单校验）",
+  };
+  for (const [k, v] of Object.entries(tools)) console.log(`  ${k.padEnd(20)} ${v}`);
+  console.log(`\n允许主机: ${Object.keys(conf.target_hosts || {}).join(", ")}`);
+  console.log(`允许查版本: ${(conf.allowed_version_bins || []).join(", ")}`);
+  console.log(`允许读路径前缀: ${(conf.allowed_path_prefixes || []).join(", ")}`);
+  console.log(`配置文件: ${process.env.READONLY_SSH_CONFIG || path.join(configDir(), "config.json")}`);
+  console.log(`审计日志: ${path.join(configDir(), "audit.log")}`);
+}
+
+async function main() {
+  const opts = parseArgs(process.argv.slice(2));
+  if (opts.tool === "help" || opts.tool === "--help") { printUsage(); return; }
+  if (opts.tool === "init") { initConfig(); return; }
+
+  let conf;
+  try {
+    conf = loadConf(opts.config);
+  } catch (e) {
+    console.error(`[错误] ${e.message}`);
+    process.exit(e.exitCode || 1);
+  }
+
+  if (opts.tool === "list-tools") { listTools(conf); return; }
+
+  let host, cmds;
+  try {
+    host = validateHost(opts.host || Object.keys(conf.target_hosts || {})[0], conf);
+    cmds = buildCmds(opts.tool, opts.arg, conf);
+  } catch (e) {
+    audit(configDir(), opts.tool, opts.host || "", [], false, e.message);
+    console.error(`[拒绝] ${e.message}`);
+    process.exit(2);
+  }
+
+  const shell = new JumpShell(conf, host);
+  try {
+    shell.connect();
+    await shell.login();
+    const out = await shell.runCmds(cmds);
+    console.log(cleanAnsi(out));
+    audit(configDir(), opts.tool, host, cmds, true);
+  } catch (e) {
+    audit(configDir(), opts.tool, host, cmds, false, e.message);
+    console.error(`[错误] ${e.message}`);
+    process.exit(1);
+  } finally {
+    shell.close();
+  }
+}
+
+main();

package/config.example.json

@@ -0,0 +1,65 @@
+{
+  "jump_server": {
+    "host": "YOUR_BASTION_IP",
+    "port": 2222,
+    "username": "YOUR_USERNAME"
+  },
+  "private_key_path": "C:\\Users\\YOURNAME\\.ssh\\id_rsa",
+  "target_hosts": {
+    "10.0.0.1": "10.0.0",
+    "10.0.0.2": "10.0.0"
+  },
+  "allowed_version_bins": [
+    "/usr/local/nginx/sbin/nginx",
+    "nginx",
+    "java",
+    "openssl",
+    "python3",
+    "redis-server",
+    "mysqld",
+    "curl"
+  ],
+  "allowed_command_prefixes": [
+    "echo ",
+    "cat ",
+    "ls ",
+    "head ",
+    "tail ",
+    "grep ",
+    "ps ",
+    "ss ",
+    "stat ",
+    "md5sum ",
+    "hostname",
+    "whoami",
+    "id",
+    "uname ",
+    "date",
+    "uptime",
+    "free ",
+    "df ",
+    "du ",
+    "/usr/local/nginx/sbin/nginx -",
+    "nginx -"
+  ],
+  "allowed_command_patterns": [
+    "^diff(\\s+-[A-Za-z]+)?\\s+/[^\\s]+\\s+/[^\\s]+\\s*$",
+    "^find\\s+/"
+  ],
+  "allowed_path_prefixes": [
+    "/usr/local/nginx/",
+    "/etc/nginx/",
+    "/usr/local/",
+    "/opt/",
+    "/etc/",
+    "/var/log/"
+  ],
+  "blocked_paths": [
+    "/etc/shadow",
+    "/etc/passwd",
+    "/etc/sudoers",
+    "/root/",
+    "/home/",
+    "/etc/ssh/"
+  ]
+}

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@zicolasjac-ai/remote-readonly-ssh",
+  "version": "1.0.2",
+  "description": "Read-only SSH ops CLI: whitelist-enforced, read-only queries on servers via a bastion host. Zero write capability by design.",
+  "license": "MIT",
+  "bin": {
+    "rrs": "bin/rrs.js"
+  },
+  "main": "src/whitelist.js",
+  "files": [
+    "bin/",
+    "src/",
+    "config.example.json",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "ssh",
+    "readonly",
+    "ops",
+    "bastion",
+    "jumpserver",
+    "whitelist",
+    "audit",
+    "security",
+    "cli"
+  ],
+  "dependencies": {},
+  "scripts": {
+    "test": "node --test test/"
+  }
+}

package/src/config.js

@@ -0,0 +1,99 @@
+"use strict";
+
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+function configDir() {
+  return path.join(os.homedir(), ".rrs");
+}
+
+function configFile() {
+  return path.join(configDir(), "config.json");
+}
+
+function auditFile() {
+  return path.join(configDir(), "audit.log");
+}
+
+function loadConf(confPath) {
+  const resolved = confPath || process.env.RRS_CONFIG || configFile();
+  if (!fs.existsSync(resolved)) {
+    const err = new Error(
+      `找不到配置文件 ${resolved}\n` +
+      `请先运行 readonly-ssh init 生成模板，再填入您的跳板机/资产/密钥信息。`
+    );
+    err.exitCode = 3;
+    throw err;
+  }
+  try {
+    return JSON.parse(fs.readFileSync(resolved, "utf8"));
+  } catch (e) {
+    throw new Error(`配置文件解析失败 ${resolved}: ${e.message}`);
+  }
+}
+
+const TOOL_PURPOSE = {
+  "sys-info": "系统信息巡检",
+  "proc": "进程状态巡检",
+  "ports": "服务监听端口巡检",
+  "read-file": "配置文件核对",
+  "dir": "目录结构核对",
+  "bin-version": "软件版本核对",
+  "exec-only": "只读命令核查",
+};
+
+function describeCmd(tool, cmd) {
+  switch (tool) {
+    case "sys-info":
+      if (cmd.includes("hostname")) return "查看主机名与当前用户";
+      if (cmd.includes("os-release")) return "查看操作系统版本";
+      if (cmd.includes("uname")) return "查看内核版本";
+      if (cmd.includes("uptime")) return "查看运行时长与负载";
+      return "查看系统基础信息";
+    case "proc": {
+      const m = cmd.match(/grep -E '([^']+)'/);
+      return m ? `确认 ${m[1]} 相关进程状态` : "确认进程运行状态";
+    }
+    case "ports":
+      return cmd.includes("grep") ? "确认过滤后的监听端口" : "查看全部监听端口";
+    case "read-file":
+      return "读取配置文件（只读）";
+    case "dir":
+      return "列出目录内容（只读）";
+    case "bin-version": {
+      const m = cmd.match(/^([^\s]+)/);
+      return m ? `核对 ${m[1]} 版本信息` : "核对版本信息";
+    }
+    default:
+      return TOOL_PURPOSE[tool] || "只读核查";
+  }
+}
+
+function audit(confDir, tool, host, cmds, ok, note) {
+  try {
+    fs.mkdirSync(confDir, { recursive: true });
+    const d = new Date();
+    const pad = (n) => String(n).padStart(2, "0");
+    const local = `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())} ${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}`;
+    const bar = "─".repeat(62);
+    const lines = [
+      bar,
+      `[巡检记录] ${local}`,
+      `  主机: ${host}`,
+      `  巡检项: ${TOOL_PURPOSE[tool] || tool}`,
+      `  结果: ${ok ? "成功" : "失败"}${note ? `（${note}）` : ""}`,
+      `  命令明细:`,
+    ];
+    cmds.forEach((c, i) => {
+      lines.push(`    ${i + 1}. ${c}`);
+      lines.push(`       用途: ${describeCmd(tool, c)}`);
+    });
+    lines.push(bar, "");
+    fs.appendFileSync(path.join(confDir, "audit.log"), lines.join("\n"), "utf8");
+  } catch {
+    // 审计失败不阻断主流程
+  }
+}
+
+module.exports = { configDir, configFile, auditFile, loadConf, audit };

package/src/jumpshell.js

@@ -0,0 +1,93 @@
+"use strict";
+
+const { spawn } = require("child_process");
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+/**
+ * 通过系统 ssh 驱动 JumpServer 堡垒机菜单，登录目标资产并执行命令。
+ * 仅负责"连接与收发"，命令校验在调用方（whitelist.js）完成。
+ */
+class JumpShell {
+  constructor(conf, host) {
+    this.searchKeyword = conf.target_hosts[host];
+    this.host = host;
+    this.conf = conf;
+    this.proc = null;
+    this.buf = "";
+    this.stopped = false;
+  }
+
+  connect() {
+    const js = this.conf.jump_server;
+    const args = [
+      "-i", this.conf.private_key_path,
+      "-p", String(js.port),
+      "-o", "StrictHostKeyChecking=no",
+      "-o", "HostKeyAlgorithms=+ssh-rsa",
+      "-o", "PubkeyAcceptedAlgorithms=+ssh-rsa",
+      "-tt", `${js.username}@${js.host}`,
+    ];
+    this.proc = spawn("ssh", args, { stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
+    this.proc.stdout.on("data", (d) => {
+      this.buf += d.toString("utf8");
+    });
+    this.proc.stderr.on("data", (d) => {
+      this.buf += d.toString("utf8");
+    });
+  }
+
+  send(s) {
+    if (this.proc && this.proc.stdin && !this.proc.stdin.destroyed) {
+      this.proc.stdin.write(s + "\r");
+    }
+  }
+
+  async waitFor(marker, secs) {
+    const deadline = Date.now() + secs * 1000;
+    while (Date.now() < deadline) {
+      if (this.buf.includes(marker)) return true;
+      await sleep(150);
+    }
+    return false;
+  }
+
+  async login() {
+    if (!(await this.waitFor("Opt>", 25))) throw new Error("跳板机菜单未出现");
+    await sleep(1000);
+    this.send("");
+    await sleep(2000);
+    this.send(this.searchKeyword);
+    if (!(await this.waitFor(this.host, 15))) throw new Error(`未找到目标资产 ${this.host}`);
+    if (!(await this.waitFor("~", 15))) throw new Error("未能进入 shell");
+    await sleep(500);
+  }
+
+  async runCmds(cmds, waitSecs = 4) {
+    const start = this.buf.length;
+    for (const c of cmds) {
+      this.send(c);
+      await sleep(waitSecs * 1000);
+    }
+    return this.buf.slice(start);
+  }
+
+  close() {
+    this.stopped = true;
+    try {
+      this.send("exit");
+      setTimeout(() => {
+        try { this.send("exit"); } catch {}
+        setTimeout(() => {
+          try { this.proc.kill(); } catch {}
+        }, 1000);
+      }, 1000);
+    } catch {}
+  }
+}
+
+function cleanAnsi(t) {
+  return t.replace(/\x1b\[[0-9;?]*[A-Za-z]/g, "");
+}
+
+module.exports = { JumpShell, cleanAnsi, sleep };

package/src/whitelist.js

@@ -0,0 +1,89 @@
+"use strict";
+
+const path = require("path");
+
+const FORBIDDEN_PATTERNS = [
+  />\s*[^|&]/,           // output redirection to file (2>&1 stream redirect is allowed)
+  /\b(rm|mv|cp|tar|install|yum|dnf|apt-get|vi|vim|nano|mkdir|touch|chmod|chown|useradd|userdel|passwd|sudo|su|reboot|shutdown|systemctl|kill|pkill|wget|curl|nc)\b/,
+  /nginx\s+-s\b/,        // nginx signal controls (stop/quit/reload/reopen) are mutating
+  /sed\s+-i\b/,          // sed in-place edit is mutating (defense in depth)
+  /-exec\b|-execdir\b|-ok\b|-okdir\b/, // find exec actions run arbitrary commands
+  /-delete\b/,           // find delete action removes files
+  /-fprint\b|-fprintf\b/,// find print-to-file actions write files
+  /\b--output\b/,        // diff --output writes files
+  /shadow/,
+  /\.ssh/,
+  /id_rsa|id_ed25519|\.pem|\.key/,
+  /\bsource\b|\.\s*\//,
+  /history/,
+  // ---- anti-bypass hardening ----
+  /\\/,                        // backslash escapes (r\m == rm)
+  /\$\(/,                      // command substitution
+  /`/,                         // backtick substitution
+  /\$\{/,                      // parameter expansion (blocked to be safe)
+  /;/,                         // command separator
+  /(?<![>])&|&(?![0-9&])/,     // single & / && (allows only >&N redirect form)
+  /\|\|/,                      // or operator
+  /[\r\n]/,                    // embedded newline separators
+];
+
+const ARG_RE = /^[A-Za-z0-9._\-/:*]+$/;
+
+function validateCmd(cmd, conf) {
+  const c = String(cmd).trim();
+  if (!c) throw new Error("空命令");
+  if (/^(sudo |su )/.test(c)) throw new Error(`拒绝: 不允许提权命令 [${c}]`);
+  const prefixes = conf.allowed_command_prefixes || [];
+  const patterns = conf.allowed_command_patterns || [];
+  const okPrefix = prefixes.some((p) => c.startsWith(p));
+  const okPattern = patterns.some((p) => new RegExp(p).test(c));
+  if (!okPrefix && !okPattern) {
+    throw new Error(`拒绝: 命令不在白名单 [${c}]`);
+  }
+  for (const pat of FORBIDDEN_PATTERNS) {
+    if (pat.test(c)) throw new Error(`拒绝: 命中禁止模式 [${pat}] 命令 [${c}]`);
+  }
+  return c;
+}
+
+function validatePath(pathArg, conf) {
+  const raw = String(pathArg).trim();
+  if (!raw.startsWith("/")) throw new Error(`拒绝: 仅允许绝对路径 [${raw}]`);
+  if (raw.includes("\0")) throw new Error(`拒绝: 非法字符 [${raw}]`);
+  // normalize resolves any . or .. segments BEFORE whitelist checks
+  const p = path.posix.normalize(raw);
+  const prefixes = conf.allowed_path_prefixes || [];
+  if (!prefixes.some((pfx) => p.startsWith(pfx))) {
+    throw new Error(`拒绝: 路径不在只读白名单 [${p}]`);
+  }
+  for (const sp of conf.blocked_paths || []) {
+    if (p.startsWith(sp)) throw new Error(`拒绝: 敏感路径 [${p}]`);
+  }
+  return p;
+}
+
+function validateHost(host, conf) {
+  if (!(conf.target_hosts && Object.prototype.hasOwnProperty.call(conf.target_hosts, host))) {
+    const allowed = Object.keys(conf.target_hosts || {});
+    throw new Error(`拒绝: 目标主机不在白名单 [${host}]，允许: ${allowed.join(", ")}（可在配置文件修改）`);
+  }
+  return host;
+}
+
+function validateArg(arg, what) {
+  if (!arg || !ARG_RE.test(arg)) {
+    throw new Error(`拒绝: ${what} 含非法字符 [${arg}]`);
+  }
+  return arg;
+}
+
+function validateBin(bin, conf) {
+  const b = validateArg(bin, "二进制名");
+  const bins = conf.allowed_version_bins || [];
+  if (!bins.includes(b)) {
+    throw new Error(`拒绝: 二进制 [${b}] 不在白名单 ${JSON.stringify(bins)}（可在配置文件修改）`);
+  }
+  return b;
+}
+
+module.exports = { validateCmd, validatePath, validateHost, validateArg, validateBin };