dsh-bash-guard 0.1.1 → 0.1.2

package/README.md

@@ -21,7 +21,7 @@
 
 不改宿主源码，不增加一排数字预设，也不用记斜杠命令。展开 `Bash Guard 自定义`，直接调整系统、外部、网络和工作区的读、写、执行权限。
 
-> **它是额外的工具权限检查，不是沙箱替代品。** 即使设为 `7777`，DSH 原生沙箱和审批仍然适用。
+> **Bash Guard 使用原生 Full access 基线，不使用工作区沙箱。** 激活前需要确认风险；仅支持的工具受权限位限制。未接管工具和无法准确分类的动态行为不受同等保护，Guard 不是安全沙箱。
 
 ## 为什么使用它
 
@@ -135,7 +135,7 @@ dsh --profile web
 | `4667` | 默认：系统只读；外部与网络读写；工作区全部 |
 | `4447` | 系统、外部、网络只读；工作区全部 |
 | `0007` | 仅开放工作区的三个权限位 |
-| `7777` | Guard 全部位开放，**不等于原生完全权限** |
+| `7777` | 在原生完全权限基线上开放全部 Guard 位，不再提供权限位限制 |
 
 模式不是安全等级排序。请按需要开启具体位，不要仅因为数字更大而认为它更合适。
 
@@ -149,7 +149,7 @@ Agent 工具调用
     └─ Guard 已激活且支持该工具
          ├─ 累计需要的权限位 required
          ├─ 不满足 allowed ──────────────► BASH_GUARD_DENIED
-         └─ 全部满足 ────────────────────► 原生工具、沙箱与审批
+         └─ 全部满足 ────────────────────► 原生 Full access 工具执行
 ```
 
 判定规则是 `(allowed & required) === required`，不是比较数字大小。复合命令会累计多个范围的要求，不会只取一个“最高”范围。
@@ -168,9 +168,9 @@ Agent 工具调用
 请在使用前了解这些限制：
 
 - **不是不可绕过的隔离层。** 分类器是保守词法扫描器，不是完整 Bash AST，也无法证明任意脚本或程序的运行时行为。
-- **不提高宿主权限。** 激活时选择原生 `workspace-write` 预设；Guard 放行不绕过底层沙箱和审批。该预设的具体行为由宿主配置决定。
+- **激活会提高原生权限。** 风险确认后选择 `danger-full-access` 预设，由 Guard 限制已支持的操作。要求该预设为 `approval=never`，并通过宿主 sandboxPolicy 与 approval 服务核验会话实际状态；不符合则拒绝激活并回退。`never` 表示不会弹审批，其他原生规则要求审批的操作会被拒绝，而不是自动批准。旧版 workspace-write 基线的已激活记录不会静默升级，需要重新激活。
 - **不覆盖所有工具。** 未识别的工具不会自动被本插件拦截，仍依赖宿主策略。
-- **不保证符号链接与动态路径隔离。** 实际文件系统、网络和子进程隔离仍由宿主负责。
+- **不保证符号链接与动态路径隔离。** Full access 不提供工作区沙箱边界，不能依赖词法分类器隔离实际文件系统、网络或子进程。
 - **不保证子代理继承。** 跨代理任务不能假定自动沿用父会话的 Guard 配置。
 - **不是 Bash Guard Rust 运行时。** 本插件没有集成其 Jev 决策层、Claude/Codex Hook 或审计日志功能，也不宣称相同的安全保证。
 
@@ -199,7 +199,7 @@ npm pack --dry-run
 - [矩阵编辑器](src/GuardEditor.js)：单格、整行及全局开关。
 - [测试](tests/)：分类器、RPC、原生菜单和矩阵交互。
 
-当前回归测试共 177 项，包括全部 4096 种模式的客户端校验。测试覆盖不代表对任意 Shell 程序的安全证明。npm 打包前会自动构建；构建产物与依赖目录不提交到 Git。
+当前回归测试共 194 项，包括全部 4096 种模式的客户端校验。测试覆盖不代表对任意 Shell 程序的安全证明。npm 打包前会自动构建；构建产物与依赖目录不提交到 Git。
 
 ## 来源与致谢
 

package/client.js

@@ -142,7 +142,7 @@ function createPermissionControl(React, primitives) {
         React.useEffect(() => { read(); if (open)
             readCatalog(); }, [open, sessionId, selection]);
         React.useEffect(() => {
-            if (locked || (confirmation !== null && catalog !== null && !catalog.options.some(option => option.value === confirmation))) {
+            if (locked || (confirmation !== null && confirmation !== 'bash-guard' && catalog !== null && !catalog.options.some(option => option.value === confirmation))) {
                 setOpen(false);
                 setConfirmation(null);
                 setAcknowledged(false);
@@ -218,8 +218,11 @@ function createPermissionControl(React, primitives) {
             if (locked || picking)
                 return;
             if (id === 'bash-guard') {
-                if (!pending && !state?.active)
-                    submit('activate');
+                if (!pending && state && !state.active) {
+                    setOpen(false);
+                    setAcknowledged(false);
+                    setConfirmation('bash-guard');
+                }
                 return;
             }
             if (!catalog?.options.some(option => option.value === id))
@@ -256,7 +259,7 @@ function createPermissionControl(React, primitives) {
             label: h('span', null, t('guard.custom'), state && h('span', { className: 'dsh-bg-mode' }, ` ${state.mode}`)),
         });
         const closeConfirmation = () => { setConfirmation(null); setAcknowledged(false); };
-        const riskPrefix = confirmation === 'auto' ? 'auto.confirm.' : 'confirm.';
+        const riskPrefix = confirmation === 'bash-guard' ? 'guard.confirm.' : confirmation === 'auto' ? 'auto.confirm.' : 'confirm.';
         return h(React.Fragment, null, h(Menu, { open, items, selectedId: current, onSelect: choose, onClose: () => setOpen(false), side: 'top', portal: true,
             anchor: h('button', { type: 'button', className: 'dsh-bg-trigger', disabled: !!locked || picking || confirmation !== null,
                 'aria-label': t('mode', { name: label }), 'aria-haspopup': 'menu', 'aria-expanded': open,
@@ -268,8 +271,18 @@ function createPermissionControl(React, primitives) {
         }), h('span', { className: 'dsh-bg-sr-only', role: 'status' }, pending ? t('syncing') : ''), error && h('div', { className: 'dsh-bg-error', role: 'alert' }, message(error), h('button', { type: 'button', disabled: pending, onClick: read }, t('retry'))), nativeError && h('div', { className: 'dsh-bg-error', role: 'alert' }, message(nativeError), h('button', { type: 'button', onClick: readCatalog }, t('retry')))), confirmation !== null && h(RiskConfirmation, { open: true, title: t(`${riskPrefix}title`), description: t(`${riskPrefix}description`),
             acknowledgeLabel: t(`${riskPrefix}acknowledge`), cancelLabel: t('confirm.cancel'), closeLabel: t('close'), confirmLabel: t(`${riskPrefix}enable`),
             acknowledged, disabled: !!locked || picking, onAcknowledgedChange: setAcknowledged, onCancel: closeConfirmation,
-            onConfirm: () => { if (!acknowledged || locked || picking)
-                return; const id = confirmation; closeConfirmation(); selectPreset(id); },
+            onConfirm: () => {
+                if (!acknowledged || locked || picking || pending)
+                    return;
+                const id = confirmation;
+                closeConfirmation();
+                if (id === 'bash-guard') {
+                    setOpen(true);
+                    submit('activate');
+                }
+                else
+                    selectPreset(id);
+            },
         }));
     };
 }
@@ -409,6 +422,10 @@ exports.zh = {
     'selectAll': '全选', 'clearAll': '取消全选', 'defaults': '默认',
     'restoreDefaults': '恢复默认权限 4667',
     'enableAll': '开启全部 Guard 权限',
+    'guard.confirm.title': '启用 Bash Guard 自定义权限？',
+    'guard.confirm.description': 'Bash Guard 将以原生完全权限运行，不再使用工作区沙箱。仅已支持的 Bash 和文件工具受权限位限制；其他工具及无法准确识别的动态程序行为不受同等保护。Guard 不是安全沙箱。',
+    'guard.confirm.acknowledge': '我了解未接管工具不受 Guard 限制，并同意使用完全权限基线',
+    'guard.confirm.enable': '启用 Bash Guard',
     'error.permissionRequest': '权限请求失败',
     'error.permissionCommand': '宿主未提供此权限命令',
     'error.unavailable': 'Bash Guard 不可用',
@@ -448,6 +465,10 @@ exports.en = {
     'selectAll': 'Select all', 'clearAll': 'Clear all', 'defaults': 'Default',
     'restoreDefaults': 'Restore default permissions 4667',
     'enableAll': 'Enable all Guard permissions',
+    'guard.confirm.title': 'Enable Bash Guard custom permissions?',
+    'guard.confirm.description': 'Bash Guard uses native Full access without the workspace sandbox. Permission bits restrict only supported Bash and file tools. Other tools and dynamic program behavior that cannot be classified do not have equivalent protection. Guard is not a security sandbox.',
+    'guard.confirm.acknowledge': 'I understand unsupported tools are not restricted by Guard and accept the Full access baseline',
+    'guard.confirm.enable': 'Enable Bash Guard',
     'error.permissionRequest': 'Permission request failed',
     'error.permissionCommand': 'The host does not provide this permission command',
     'error.unavailable': 'Bash Guard is unavailable',

package/lib/index.js

@@ -1,8 +1,9 @@
 import { Remote, TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
 import { allows, classifyTool } from './classify.js';
 export const name = 'bash-guard';
-export const inject = ['storageDomain', 'sessions', 'permissionPresets'];
+export const inject = ['storageDomain', 'sessions', 'permissionPresets', 'sandboxPolicy', 'approval'];
 export const BASH_GUARD_DENIED = 'BASH_GUARD_DENIED';
+const BASELINE = 'danger-full-access';
 const valid = (value) => typeof value === 'string' && /^[0-7]{4}$(?![\s\S])/.test(value);
 export const recordSchema = {
     parse(value) {
@@ -60,6 +61,9 @@ export async function apply(ctx, config = {}) {
             throw new Error('A session ID is required');
         return id;
     };
+    const baselineEffective = (session) => ctx.permissionPresets.current(session) === BASELINE &&
+        ctx.sandboxPolicy.resolve({ session }).mode === BASELINE &&
+        ctx.approval.effectivePolicy(session) === 'never';
     const read = (id, session = ctx.sessions.get(sessionId(id))) => {
         const stored = records.get(id);
         const state = stored === undefined ? { mode: fallback, active: false, revision: 0, presetSeq: -1 } : recordSchema.parse(stored);
@@ -68,7 +72,7 @@ export async function apply(ctx, config = {}) {
         if (!session)
             return state.active ? { ...state, active: false, revision: state.revision + 1 } : state;
         const boundary = presetBoundary(session);
-        return state.active && boundary > state.presetSeq
+        return state.active && (boundary > state.presetSeq || !baselineEffective(session))
             ? { ...state, active: false, revision: state.revision + 1, presetSeq: boundary }
             : state;
     };
@@ -93,22 +97,47 @@ export async function apply(ctx, config = {}) {
             throw new Error('Guard revision exhausted');
         if (request.action === 'mode' && (!state.active || !valid(request.mode)))
             throw new Error('An active guard and four octal digits are required');
+        let previousPreset;
         if (request.action === 'activate') {
-            // Installed permissionPresets.set uses canonical sandbox/approval setters.
-            // Never recursively execute a command against an already-running handler.
-            const baseline = ctx.permissionPresets.resolve('workspace-write');
-            if (baseline.sandbox !== 'workspace-write')
-                throw new Error('Workspace baseline must confine writes to the workspace');
-            ctx.permissionPresets.set(session, 'workspace-write');
-            if (ctx.permissionPresets.current(session) !== 'workspace-write')
-                throw new Error('Cannot activate workspace-write baseline');
+            const baseline = ctx.permissionPresets.resolve(BASELINE);
+            if (baseline.sandbox !== BASELINE)
+                throw new Error('Full-access baseline must use danger-full-access sandbox');
+            if (baseline.approval !== 'never')
+                throw new Error('Bash Guard requires Full access with approval=never; the configured preset still requests approval');
+            previousPreset = ctx.permissionPresets.current(session);
+            // A custom/unavailable baseline cannot be restored through the preset API.
+            // Refuse before elevating instead of risking an unguarded full-access session.
+            if (!previousPreset || previousPreset === 'custom')
+                throw new Error('Cannot activate Bash Guard without a restorable native preset');
+            ctx.permissionPresets.resolve(previousPreset);
+        }
+        try {
+            if (previousPreset !== undefined) {
+                // Canonical native setters; never recursively execute a session command.
+                ctx.permissionPresets.set(session, BASELINE);
+                if (!baselineEffective(session))
+                    throw new Error('Cannot activate danger-full-access baseline with effective approval=never');
+            }
+            const next = recordSchema.parse({
+                mode: request.action === 'mode' ? request.mode : state.mode,
+                active: request.action !== 'deactivate', revision: state.revision + 1,
+                presetSeq: presetBoundary(session),
+            });
+            await records.put(id, next);
+        }
+        catch (error) {
+            if (previousPreset !== undefined) {
+                try {
+                    ctx.permissionPresets.set(session, previousPreset);
+                    if (ctx.permissionPresets.current(session) !== previousPreset)
+                        throw new Error('Native preset restoration did not take effect');
+                }
+                catch (rollbackError) {
+                    throw new AggregateError([error, rollbackError], 'Bash Guard activation failed and native preset rollback failed; full access may remain enabled. Restore native permissions immediately.');
+                }
+            }
+            throw error;
         }
-        const next = recordSchema.parse({
-            mode: request.action === 'mode' ? request.mode : state.mode,
-            active: request.action !== 'deactivate', revision: state.revision + 1,
-            presetSeq: presetBoundary(session),
-        });
-        await records.put(id, next);
         return read(id);
     }));
     ctx.on('tools/execute', async (exec, next) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-bash-guard",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "license": "MIT",
   "author": "lloydzhou (https://github.com/lloydzhou)",
   "homepage": "https://github.com/lloydzhou/dsh-bash-guard#readme",