deepccc 0.1.1 → 0.1.3

package/dist/file-tools.js

@@ -6,6 +6,7 @@ import { createRequire } from "node:module";
 import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { createInterface } from "node:readline";
 import { jsonSchema, tool } from "ai";
+import { isDangerousCommand } from "./permissions.js";
 import { killProcessTree } from "./proc-tree-kill.js";
 const MAX_READ_BYTES = 1024 * 1024;
 const MAX_LIST_ENTRIES = 200;
@@ -919,7 +920,29 @@ export async function applyPatchForTool(cwd, input) {
     }
     return { changedFiles };
 }
-export function createBuiltinFileTools(cwd) {
+export function createBuiltinFileTools(cwd, options = {}) {
+    const gate = options.permissionGate;
+    /** 文件路径的候选匹配键：原始路径 + 绝对路径 + 相对 cwd 路径（正/反斜杠双版本，规则可任选其一） */
+    const pathKeys = (p) => {
+        const abs = resolveToolPath(cwd, p);
+        const rel = relative(cwd, abs);
+        return [
+            p,
+            abs,
+            rel,
+            rel.split(sep).join("/"),
+            abs.split(sep).join("/"),
+        ];
+    };
+    /** 副作用工具执行前的权限守卫：gate 拒绝时抛错，工具不会真正执行 */
+    const guard = async (request) => {
+        if (!gate)
+            return;
+        const decision = await gate.check(request);
+        if (decision === "deny") {
+            throw new Error(`权限拒绝：${request.detail}（已按规则或用户选择拦截；如需放行请调整 ~/.deepccc/allow.json，或使用 --dangerously-bypass-permissions）`);
+        }
+    };
     return {
         read_file: tool({
             description: "Read a UTF-8 text file from the local filesystem. Use line ranges for large files.",
@@ -973,7 +996,15 @@ export function createBuiltinFileTools(cwd) {
                 },
                 required: ["command"],
             }),
-            execute: (input, options) => runCommandForTool(cwd, input, options.abortSignal),
+            execute: async (input, options) => {
+                await guard({
+                    tool: "run_command",
+                    action: input.command,
+                    reason: isDangerousCommand(input.command) ? "high-risk" : "rule",
+                    detail: `运行命令: ${input.command}`,
+                });
+                return runCommandForTool(cwd, input, options.abortSignal);
+            },
         }),
         edit_file: tool({
             description: "Edit an existing UTF-8 text file by applying exact oldText -> newText replacements. Uses optional SHA-256 precondition to avoid overwriting concurrent edits.",
@@ -1000,7 +1031,16 @@ export function createBuiltinFileTools(cwd) {
                 },
                 required: ["path", "edits"],
             }),
-            execute: (input) => editFileForTool(cwd, input),
+            execute: async (input) => {
+                await guard({
+                    tool: "edit_file",
+                    action: input.path,
+                    altKeys: pathKeys(input.path),
+                    reason: "rule",
+                    detail: `编辑文件: ${input.path}`,
+                });
+                return editFileForTool(cwd, input);
+            },
         }),
         create_file: tool({
             description: "Create a UTF-8 text file, or overwrite an existing one when overwrite=true.",
@@ -1015,7 +1055,16 @@ export function createBuiltinFileTools(cwd) {
                 },
                 required: ["path", "content"],
             }),
-            execute: (input) => createFileForTool(cwd, input),
+            execute: async (input) => {
+                await guard({
+                    tool: "create_file",
+                    action: input.path,
+                    altKeys: pathKeys(input.path),
+                    reason: "rule",
+                    detail: `创建/覆盖文件: ${input.path}`,
+                });
+                return createFileForTool(cwd, input);
+            },
         }),
         delete_file: tool({
             description: "Delete an existing text file. Use expectedSha256 to avoid deleting a file that changed after reading.",
@@ -1028,7 +1077,16 @@ export function createBuiltinFileTools(cwd) {
                 },
                 required: ["path"],
             }),
-            execute: (input) => deleteFileForTool(cwd, input),
+            execute: async (input) => {
+                await guard({
+                    tool: "delete_file",
+                    action: input.path,
+                    altKeys: pathKeys(input.path),
+                    reason: "rule",
+                    detail: `删除文件: ${input.path}`,
+                });
+                return deleteFileForTool(cwd, input);
+            },
         }),
         move_file: tool({
             description: "Move or rename an existing text file. Can overwrite an existing destination only when overwrite=true.",
@@ -1044,7 +1102,16 @@ export function createBuiltinFileTools(cwd) {
                 },
                 required: ["sourcePath", "destinationPath"],
             }),
-            execute: (input) => moveFileForTool(cwd, input),
+            execute: async (input) => {
+                await guard({
+                    tool: "move_file",
+                    action: input.sourcePath,
+                    altKeys: pathKeys(input.sourcePath),
+                    reason: "rule",
+                    detail: `移动/重命名文件: ${input.sourcePath} → ${input.destinationPath}`,
+                });
+                return moveFileForTool(cwd, input);
+            },
         }),
         apply_patch: tool({
             description: "Apply a unified diff patch to one or more UTF-8 text files. Prefer edit_file for small targeted edits.",
@@ -1061,7 +1128,15 @@ export function createBuiltinFileTools(cwd) {
                 },
                 required: ["patch"],
             }),
-            execute: (input) => applyPatchForTool(cwd, input),
+            execute: async (input) => {
+                await guard({
+                    tool: "apply_patch",
+                    action: "patch",
+                    reason: "rule",
+                    detail: "应用 unified diff patch",
+                });
+                return applyPatchForTool(cwd, input);
+            },
         }),
     };
 }

package/dist/index.d.ts

@@ -3,6 +3,7 @@
  *
  * ChatSession 是程序化入口，既可以被 CLI 调用，也可以被其他模块调用。
  */
+import { type PermissionMode, type PermissionResolver } from "./permissions.js";
 export interface ChatSessionConfig {
     /** OpenAI-compatible service base URL. Defaults to DEEPCCC_BASE_URL/config. */
     baseURL?: string;
@@ -38,6 +39,16 @@ export interface ChatSessionOptions {
      * Defaults to ~/.codex/skills, ~/.agents/skills, <cwd>/.codex/skills.
      */
     skillsDirs?: string[];
+    /**
+     * 权限模式：ask（默认，高危命令询问）/ bypass（全部放行，等价
+     * --dangerously-bypass-permissions；chatccc 等无终端环境集成时使用）。
+     */
+    permissionMode?: PermissionMode;
+    /**
+     * ask 模式下高危操作的交互确认回调；缺省时非交互环境（JSONL / 程序化
+     * 调用）自动拒绝高危命令，常规文件操作与低危命令不受影响。
+     */
+    permissionResolver?: PermissionResolver;
 }
 /**
  * 流式响应事件
@@ -81,6 +92,7 @@ export declare class ChatSession {
     private context;
     private maxSteps?;
     private effort;
+    private permissionGate;
     constructor(overrides?: ChatSessionConfig, options?: ChatSessionOptions);
     chat(userMessage: string, signal?: AbortSignal): AsyncIterable<ChatEvent>;
     /** 返回当前的会话历史（只读） */

package/dist/index.js

@@ -11,7 +11,9 @@ import { config as appConfig, RAW_STREAM_LOGS_DIR } from "./config.js";
 import { createRawStreamLog, } from "./raw-stream-log.js";
 import { BuiltinContextManager, buildSummaryPrompt, defaultBuiltinSessionId, } from "./context.js";
 import { createBuiltinFileTools } from "./file-tools.js";
+import { PermissionGate } from "./permissions.js";
 import { buildDefaultSkillDirs, buildSkillsIndexPrompt, scanSkillsDirs } from "./skills.js";
+import { applyPrivacy, applyPrivacyToJson } from "./privacy.js";
 // ---------------------------------------------------------------------------
 // 系统提示词 — 编译期冻结常量（DeepCCC 英文品牌）
 // ---------------------------------------------------------------------------
@@ -85,6 +87,7 @@ export class ChatSession {
     context;
     maxSteps;
     effort;
+    permissionGate;
     constructor(overrides = {}, options = {}) {
         const apiKey = overrides.apiKey ?? appConfig.apiKey;
         if (!apiKey) {
@@ -126,10 +129,12 @@ export class ChatSession {
             compactAtTokens: options.compactAtTokens,
             keepRecentMessages: options.keepRecentMessages,
         });
+        this.permissionGate = new PermissionGate(options.permissionMode ?? "ask", options.permissionResolver);
     }
     async *chat(userMessage, signal) {
         this.context.appendMessage({ role: "user", content: userMessage });
         let fullText = "";
+        let safeAccumulated = "";
         let rawLog = null;
         let completed = false;
         try {
@@ -158,7 +163,7 @@ export class ChatSession {
                 model: this.model,
                 system: this.systemPrompt,
                 messages: this.context.buildModelMessages(),
-                tools: createBuiltinFileTools(this.cwd),
+                tools: createBuiltinFileTools(this.cwd, { permissionGate: this.permissionGate }),
                 stopWhen: maxSteps !== undefined ? stepCountIs(maxSteps) : isLoopFinished(),
                 abortSignal: signal,
                 // DeepSeek OpenAI 兼容接口：providerOptions.deepseek.reasoningEffort
@@ -170,7 +175,11 @@ export class ChatSession {
                 rawLog?.writeLine(safeRawStreamJson(part));
                 if (part.type === "text-delta") {
                     fullText += part.text;
-                    yield { type: "text", text: part.text, accumulated: fullText };
+                    // 隐私替换只在展示层：safeAccumulated 供事件消费者（终端/JSONL）使用，
+                    // fullText 原文用于持久化上下文，避免替换结果回流污染上下文。
+                    const safeText = applyPrivacy(part.text);
+                    safeAccumulated += safeText;
+                    yield { type: "text", text: safeText, accumulated: safeAccumulated };
                 }
                 else if (part.type === "tool-call") {
                     toolContext.push(`tool_call ${part.toolName}: ${safeJson(part.input)}`);
@@ -178,7 +187,7 @@ export class ChatSession {
                         type: "tool_use",
                         id: part.toolCallId,
                         name: part.toolName,
-                        input: part.input,
+                        input: applyPrivacyToJson(part.input),
                     };
                 }
                 else if (part.type === "tool-result") {
@@ -187,7 +196,7 @@ export class ChatSession {
                         type: "tool_result",
                         tool_use_id: part.toolCallId,
                         name: part.toolName,
-                        content: part.output,
+                        content: applyPrivacyToJson(part.output),
                         is_error: false,
                     };
                 }
@@ -198,13 +207,13 @@ export class ChatSession {
                         type: "tool_result",
                         tool_use_id: part.toolCallId,
                         name: part.toolName,
-                        content: message,
+                        content: applyPrivacy(message),
                         is_error: true,
                     };
                 }
                 else if (part.type === "error") {
                     const message = errorMessage(part.error);
-                    yield { type: "error", message };
+                    yield { type: "error", message: applyPrivacy(message) };
                     throw new Error(message);
                 }
             }
@@ -213,7 +222,7 @@ export class ChatSession {
                 ? `${fullText}\n\n[Tool transcript]\n${toolContext.join("\n")}`
                 : fullText;
             this.context.appendMessage({ role: "assistant", content: persistedText });
-            yield { type: "done", text: fullText };
+            yield { type: "done", text: safeAccumulated };
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
@@ -222,10 +231,10 @@ export class ChatSession {
                 if (fullText) {
                     this.context.appendMessage({ role: "assistant", content: `${fullText}\n[interrupted]` });
                 }
-                yield { type: "done", text: fullText };
+                yield { type: "done", text: safeAccumulated };
                 return;
             }
-            yield { type: "error", message };
+            yield { type: "error", message: applyPrivacy(message) };
             throw err;
         }
         finally {

package/dist/permissions.d.ts

@@ -0,0 +1,42 @@
+export type PermissionMode = "ask" | "bypass";
+export type PermissionReason = "high-risk" | "rule";
+export type PermissionAnswer = "allow" | "allow-always" | "allow-session" | "deny";
+export type PermissionDecision = "allow" | "deny";
+export interface PermissionRequest {
+    /** 工具名：run_command / edit_file / create_file / delete_file / move_file / apply_patch */
+    tool: string;
+    /** 具体操作：命令全文或文件路径 */
+    action: string;
+    /** high-risk = 命中内置危险命令库，需要询问；rule = 仅受 allow/deny 规则管控 */
+    reason: PermissionReason;
+    /** 展示给用户的说明 */
+    detail: string;
+    /** 额外匹配键（如文件相对路径），allow/deny 规则命中任一即生效 */
+    altKeys?: string[];
+}
+/** ask 模式下高危操作的交互确认回调（由 CLI 注入 readline 实现） */
+export type PermissionResolver = (request: PermissionRequest) => Promise<PermissionAnswer>;
+export interface AllowRules {
+    /** 永远允许的规则，格式 "<tool>:<pattern>" 或 "*:<pattern>"，pattern 中 * 为通配符 */
+    allow: string[];
+    /** 永远拒绝的规则，格式同上 */
+    deny: string[];
+}
+export declare function isDangerousCommand(command: string): boolean;
+export declare function getAllowRules(): AllowRules;
+export declare function reloadAllowRules(): void;
+/** 把"永远允许"的规则追加写入 allow.json 并热加载 */
+export declare function appendAllowRule(rule: string): void;
+/**
+ * 规则匹配。规则格式 "<tool>:<pattern>" 或 "*:<pattern>"；
+ * pattern 中的 * 为通配符，其余字符按字面量匹配。
+ */
+export declare function matchRule(rule: string, key: string): boolean;
+export declare class PermissionGate {
+    private readonly mode;
+    private readonly resolver?;
+    private sessionAllowAll;
+    constructor(mode?: PermissionMode, resolver?: PermissionResolver);
+    getMode(): PermissionMode;
+    check(request: PermissionRequest): Promise<PermissionDecision>;
+}

package/dist/permissions.js

@@ -0,0 +1,170 @@
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { DEEPCCC_HOME } from "./config.js";
+const RULES_FILE = join(DEEPCCC_HOME, "allow.json");
+const EMPTY_RULES = { allow: [], deny: [] };
+/**
+ * 内置危险命令库（命中即进入询问流程；allow 规则可覆盖）。
+ * 覆盖 Windows 与 Unix 常见破坏性操作：强制删除、强制推送、磁盘/分区、
+ * 关机重启、设备覆写、数据库 DROP、fork bomb、全局卸载、发布等。
+ */
+const DANGEROUS_COMMAND_PATTERNS = [
+    /^\s*rm\s+-[a-zA-Z]*r[a-zA-Z]*f[a-zA-Z]*\b/i, // rm -rf / rm -fr
+    /^\s*rm\s+-[a-zA-Z]*f[a-zA-Z]*r[a-zA-Z]*\b/i,
+    /^\s*rmdir\s+\/s/i, // Windows rmdir /s
+    /^\s*(del|erase)\s+\/s/i, // Windows del /s
+    /^\s*git\s+(push|fetch|pull)\s+.*(--force|-f\b)/i, // git push --force
+    /^\s*git\s+reset\s+--hard/i,
+    /^\s*git\s+clean\s+(-[a-z]*f)/i,
+    /^\s*format\s+[a-z]:/i,
+    /^\s*diskpart\b/i,
+    /^\s*(shutdown|reboot)\b/i,
+    /^\s*mkfs\b/i,
+    /^\s*fdisk\b/i,
+    /^\s*dd\s+.*\bof=/i,
+    /^\s*sudo\s+(rm|shutdown|mkfs|dd|fdisk|diskpart)/i,
+    /^\s*Remove-Item\s+-Recurse/i,
+    /^\s*:\(\)\s*\{.*\}\s*;/i, // fork bomb
+    /^\s*(drop|truncate)\s+table/i,
+    /^\s*npm\s+(publish|unpublish)\b/i,
+    /^\s*npm\s+uninstall\s+-g/i,
+    /^\s*pip\s+uninstall\b/i,
+];
+export function isDangerousCommand(command) {
+    return DANGEROUS_COMMAND_PATTERNS.some((re) => re.test(command));
+}
+// ---------------------------------------------------------------------------
+// 规则加载（~/.deepccc/allow.json，热加载）
+// ---------------------------------------------------------------------------
+let rulesCache = null;
+let rulesStamp;
+function rulesFileStamp() {
+    if (!existsSync(RULES_FILE))
+        return null;
+    try {
+        const s = statSync(RULES_FILE);
+        return `${s.mtimeMs}:${s.size}`;
+    }
+    catch {
+        return null;
+    }
+}
+function sanitizeRuleList(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    return raw.filter((item) => typeof item === "string" && item.trim().length > 0);
+}
+function loadRules() {
+    if (!existsSync(RULES_FILE))
+        return EMPTY_RULES;
+    try {
+        const raw = readFileSync(RULES_FILE, "utf-8").replace(/^\uFEFF/, "");
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+            return EMPTY_RULES;
+        return {
+            allow: sanitizeRuleList(parsed.allow),
+            deny: sanitizeRuleList(parsed.deny),
+        };
+    }
+    catch (err) {
+        console.error(`[PERMISSIONS] failed to read allow.json: ${err.message}`);
+        return EMPTY_RULES;
+    }
+}
+export function getAllowRules() {
+    const stamp = rulesFileStamp();
+    if (!rulesCache || stamp !== rulesStamp) {
+        rulesCache = loadRules();
+        rulesStamp = stamp;
+    }
+    return rulesCache;
+}
+export function reloadAllowRules() {
+    rulesCache = null;
+    rulesStamp = undefined;
+}
+/** 把"永远允许"的规则追加写入 allow.json 并热加载 */
+export function appendAllowRule(rule) {
+    const rules = getAllowRules();
+    if (rules.allow.includes(rule))
+        return;
+    const next = { allow: [...rules.allow, rule], deny: rules.deny };
+    try {
+        mkdirSync(dirname(RULES_FILE), { recursive: true });
+        writeFileSync(RULES_FILE, `${JSON.stringify(next, null, 2)}\n`, "utf-8");
+        reloadAllowRules();
+    }
+    catch (err) {
+        console.error(`[PERMISSIONS] failed to write allow.json: ${err.message}`);
+    }
+}
+function escapeRegex(s) {
+    return s.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+ * 规则匹配。规则格式 "<tool>:<pattern>" 或 "*:<pattern>"；
+ * pattern 中的 * 为通配符，其余字符按字面量匹配。
+ */
+export function matchRule(rule, key) {
+    const ruleColon = rule.indexOf(":");
+    if (ruleColon === -1)
+        return false;
+    const toolPart = rule.slice(0, ruleColon);
+    const pattern = rule.slice(ruleColon + 1);
+    const keyColon = key.indexOf(":");
+    if (keyColon === -1)
+        return false;
+    const keyTool = key.slice(0, keyColon);
+    const keyAction = key.slice(keyColon + 1);
+    if (toolPart !== "*" && toolPart !== keyTool)
+        return false;
+    const re = new RegExp(`^${pattern.split("*").map(escapeRegex).join(".*")}$`);
+    return re.test(keyAction);
+}
+// ---------------------------------------------------------------------------
+// PermissionGate
+// ---------------------------------------------------------------------------
+export class PermissionGate {
+    mode;
+    resolver;
+    sessionAllowAll = false;
+    constructor(mode = "ask", resolver) {
+        this.mode = mode;
+        this.resolver = resolver;
+    }
+    getMode() {
+        return this.mode;
+    }
+    async check(request) {
+        if (this.mode === "bypass" || this.sessionAllowAll)
+            return "allow";
+        const key = `${request.tool}:${request.action}`;
+        const keys = [key, ...(request.altKeys ?? []).map((k) => `${request.tool}:${k}`)];
+        const rules = getAllowRules();
+        if (rules.deny.some((r) => keys.some((k) => matchRule(r, k))))
+            return "deny";
+        if (rules.allow.some((r) => keys.some((k) => matchRule(r, k))))
+            return "allow";
+        // 只有命中内置危险命令库的 run_command 才询问；文件编辑等常规操作默认放行
+        if (request.reason !== "high-risk")
+            return "allow";
+        // 高危且无交互能力（非 TTY / JSONL / 程序化调用）→ 安全默认拒绝
+        if (!this.resolver)
+            return "deny";
+        const answer = await this.resolver(request);
+        switch (answer) {
+            case "allow":
+                return "allow";
+            case "allow-session":
+                this.sessionAllowAll = true;
+                return "allow";
+            case "allow-always":
+                appendAllowRule(key);
+                return "allow";
+            case "deny":
+            default:
+                return "deny";
+        }
+    }
+}

package/dist/privacy.d.ts

@@ -0,0 +1,21 @@
+interface PrivacyRules {
+    [key: string]: string;
+}
+interface PrivacyConfig {
+    enabled: boolean;
+    rules: PrivacyRules;
+}
+export declare function getPrivacyConfig(): PrivacyConfig;
+export declare function getPrivacyRules(): PrivacyRules;
+export declare function reloadPrivacyRules(): void;
+/**
+ * 把文本中的隐私规则字面量替换为掩码值（split+join，规则键保持字面量）。
+ * 仅作用于展示层：调用方应保持内部数据（如持久化上下文）为原文。
+ */
+export declare function applyPrivacy(text: string): string;
+/**
+ * 递归替换结构化数据（工具调用参数/结果）中的字符串字段。
+ * 数组逐项、对象逐值、字符串走 applyPrivacy，其余类型原样返回。
+ */
+export declare function applyPrivacyToJson(value: unknown): unknown;
+export {};

package/dist/privacy.js

@@ -0,0 +1,124 @@
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { DEEPCCC_HOME } from "./config.js";
+let config = null;
+let loadedStamp;
+function privacyFilePath() {
+    return join(DEEPCCC_HOME, "privacy.json");
+}
+function privacyFileStamp() {
+    const filePath = privacyFilePath();
+    if (!existsSync(filePath))
+        return null;
+    try {
+        const s = statSync(filePath);
+        return `${s.mtimeMs}:${s.size}`;
+    }
+    catch {
+        return null;
+    }
+}
+function sanitizeRules(raw) {
+    const result = {};
+    for (const [from, to] of Object.entries(raw)) {
+        if (!from) {
+            console.error("[PRIVACY] privacy.json rule key cannot be empty, skipped");
+            continue;
+        }
+        if (typeof to !== "string") {
+            console.error(`[PRIVACY] privacy.json value must be a string, skipped "${from}"`);
+            continue;
+        }
+        result[from] = to;
+    }
+    return result;
+}
+function normalizeConfig(parsed) {
+    const hasNewSchema = Object.prototype.hasOwnProperty.call(parsed, "enabled") ||
+        Object.prototype.hasOwnProperty.call(parsed, "rules");
+    if (!hasNewSchema) {
+        return { enabled: true, rules: sanitizeRules(parsed) };
+    }
+    const enabledRaw = parsed.enabled;
+    const enabled = enabledRaw === undefined ? true : enabledRaw !== false;
+    if (enabledRaw !== undefined && typeof enabledRaw !== "boolean") {
+        console.error("[PRIVACY] privacy.json enabled must be a boolean, using true");
+    }
+    const rulesRaw = parsed.rules;
+    if (rulesRaw === undefined)
+        return { enabled, rules: {} };
+    if (typeof rulesRaw !== "object" || rulesRaw === null || Array.isArray(rulesRaw)) {
+        console.error("[PRIVACY] privacy.json rules must be an object");
+        return { enabled, rules: {} };
+    }
+    return { enabled, rules: sanitizeRules(rulesRaw) };
+}
+function loadConfig() {
+    const filePath = privacyFilePath();
+    if (!existsSync(filePath)) {
+        return { enabled: true, rules: {} };
+    }
+    try {
+        const raw = readFileSync(filePath, "utf-8").replace(/^\uFEFF/, "");
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+            console.error("[PRIVACY] privacy.json must be an object");
+            return { enabled: true, rules: {} };
+        }
+        return normalizeConfig(parsed);
+    }
+    catch (err) {
+        console.error(`[PRIVACY] failed to read privacy.json: ${err.message}`);
+        return { enabled: true, rules: {} };
+    }
+}
+export function getPrivacyConfig() {
+    const stamp = privacyFileStamp();
+    if (!config || stamp !== loadedStamp) {
+        config = loadConfig();
+        loadedStamp = stamp;
+    }
+    return config;
+}
+export function getPrivacyRules() {
+    return getPrivacyConfig().rules;
+}
+export function reloadPrivacyRules() {
+    config = null;
+    loadedStamp = undefined;
+}
+/**
+ * 把文本中的隐私规则字面量替换为掩码值（split+join，规则键保持字面量）。
+ * 仅作用于展示层：调用方应保持内部数据（如持久化上下文）为原文。
+ */
+export function applyPrivacy(text) {
+    const { enabled, rules } = getPrivacyConfig();
+    if (!enabled || Object.keys(rules).length === 0 || !text)
+        return text;
+    let result = text;
+    for (const [from, to] of Object.entries(rules)) {
+        result = result.split(from).join(to);
+    }
+    return result;
+}
+/**
+ * 递归替换结构化数据（工具调用参数/结果）中的字符串字段。
+ * 数组逐项、对象逐值、字符串走 applyPrivacy，其余类型原样返回。
+ */
+export function applyPrivacyToJson(value) {
+    const { enabled, rules } = getPrivacyConfig();
+    if (!enabled || Object.keys(rules).length === 0)
+        return value;
+    if (typeof value === "string")
+        return applyPrivacy(value);
+    if (Array.isArray(value))
+        return value.map((item) => applyPrivacyToJson(item));
+    if (value !== null && typeof value === "object") {
+        const out = {};
+        for (const [key, item] of Object.entries(value)) {
+            out[key] = applyPrivacyToJson(item);
+        }
+        return out;
+    }
+    return value;
+}