dsh-context-toolkit 0.2.0 → 0.2.2

package/README.md

@@ -113,9 +113,10 @@ Tool switches: `tools.execute`, `tools.executeFile`, `tools.batchExecute`, `tool
 The offline suites need no DSH runtime:
 
 ```bash
-node smoke.mjs        # 52 checks: contract, runtime discovery, tools, gate, knowledge base, observability
+node smoke.mjs        # 66 checks: contract, runtime discovery, tools, gate (segment matching, prefix/path normalisation, script_path coverage), resource disposal, knowledge base, observability, version reporting
 node test-client.mjs  # 27 checks: browser-half contract and bilingual dictionary parity
-node test-package.mjs # 18 checks: publish manifest and the zero-dependency constraint
+node test-package.mjs # 20 checks: publish manifest and the zero-dependency constraint
+node release-check.mjs # 27 checks: release readiness (manifest, deps, tool count, gate matching, version, SHA coverage, no hardcoded paths)
 ```
 
 ## Known limits
@@ -124,6 +125,7 @@ node test-package.mjs # 18 checks: publish manifest and the zero-dependency cons
 - **`ctk_execute` timeouts are hard kills**: the child is terminated and `timedOut` is reported.
 - **A single run captures at most 256 KB**; anything beyond is counted but not retained. The text handed back is additionally capped at 4000 characters, so even a 1 MB single-line output cannot enter the conversation whole.
 - **The knowledge base deduplicates by path**: filing the same path again replaces the earlier copy.
+- **The gate is precise, not exhaustive.** A flood tool is refused only when it is the command word of some segment — after exec prefixes (`sudo`, `exec`, …) and path/extension normalisation are stripped — and `script_path` is read up to the first 256 KB. A tool a program invokes internally (`python -c 'import wget'`) is outside its remit.
 
 ## License
 

package/README.zh.md

@@ -113,9 +113,10 @@ await ctk_search({ queries: ['rate limit', 'auth'] });  // 只取相关片段
 离线套件不依赖 DSH 运行时：
 
 ```bash
-node smoke.mjs        # 52 项：契约、运行时探测、三工具、门禁、知识库、观测
+node smoke.mjs        # 66 项：契约、运行时探测、三工具、门禁（分段匹配 + 前缀/路径归一 + script_path 覆盖）、资源释放、知识库、观测、版本自述
 node test-client.mjs  # 27 项：浏览器半体契约与双语字典一致性
-node test-package.mjs # 18 项：发布清单与零依赖约束
+node test-package.mjs # 20 项：发布清单与零依赖约束
+node release-check.mjs # 27 项：发布就绪（清单/依赖/工具数/门禁匹配/版本/SHA 覆盖/无硬编码路径）
 ```
 
 ## 已知边界
@@ -124,6 +125,7 @@ node test-package.mjs # 18 项：发布清单与零依赖约束
 - **`ctk_execute` 的超时是硬杀**：超时会终止子进程并把 `timedOut` 标出来。
 - **单次捕获上限 256 KB**，超出部分只计数不保留；回给对话的文本另有 4000 字符硬帽，因此 1 MB 的单行输出也不会整段进入上下文。
 - **知识库按路径去重**：同一路径再次归档是替换，不是追加。
+- **门禁精确而非穷尽**：只有当洪水工具是某个分段的「命令词」时才拒绝（会先剥掉 `sudo`/`exec` 等前缀、归一化路径与 `.exe` 等扩展名），`script_path` 最多读取前 256 KB。程序内部发起的调用（如 `python -c 'import wget'`）不在其职责内。
 
 ## 许可
 

package/index.js

@@ -18,8 +18,9 @@
  * no third-party runtime dependencies.
  */
 import { homedir } from 'node:os'
-import { existsSync, statSync, readdirSync } from 'node:fs'
-import { join, isAbsolute, resolve, basename } from 'node:path'
+import { existsSync, statSync, readdirSync, readFileSync } from 'node:fs'
+import { join, isAbsolute, resolve, basename, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
 import { runProcess, availableRuntimes, probeRuntimes, shellPlan, scratchDir } from './lib/runner.js'
 import { mkdtempSync, rmSync } from 'node:fs'
 import { openStore } from './lib/store.js'
@@ -27,6 +28,26 @@ import { openStore } from './lib/store.js'
 export const name = 'dsh-context-toolkit'
 export const inject = ['tools', 'systemPrompt']
 
+/**
+ * The version this bundle actually ships, read from its own manifest.
+ *
+ * It used to be hardcoded and drifted: the manifest moved to 0.2.0 while the
+ * doctor still reported 0.1.0, so the one line meant to identify the build was
+ * the one line that could not be trusted. Reading the manifest keeps the two in
+ * step without a release step of its own.
+ */
+export const PLUGIN_VERSION = readManifestVersion()
+
+/** Read the neighbouring package.json; a bundled copy still gets a usable value. */
+export function readManifestVersion() {
+  try {
+    const here = dirname(fileURLToPath(import.meta.url))
+    const parsed = JSON.parse(readFileSync(join(here, 'package.json'), 'utf8'))
+    if (parsed && typeof parsed.version === 'string' && parsed.version) return parsed.version
+  } catch { /* not resolvable from here: still report something the doctor can print */ }
+  return '0.0.0'
+}
+
 const z = await loadSchemastery()
 
 /**
@@ -275,28 +296,97 @@ const FLOOD_TOOLS = new Set(['curl', 'wget', 'httpie', 'http', 'aria2c'])
  */
 const SHELL_TOOL_NAMES = new Set(['bash', 'pwsh', 'shell', 'ops_bash', 'bash_persistent', 'pwsh_persistent'])
 
-function floodReason(toolName, args) {
-  const command = typeof args.command === 'string' ? args.command : ''
-  if (!SHELL_TOOL_NAMES.has(toolName)) return undefined
-  for (const word of FLOOD_TOOLS) {
-    if (new RegExp('(^|[ \\t;&|(])' + word + '([ \\t;&|)]|$)', 'i').test(command)) {
-      return 'dsh-context-toolkit: "' + word + '" pours whole responses into the transcript. '
-        + 'Use ctk_fetch_and_index(url, source) and then ctk_search(queries), or run it inside '
-        + 'ctk_execute(language:"javascript", code) and print only the conclusion.'
-    }
-  }
-  return undefined
+/**
+ * Words that may legally precede the real command word inside one segment.
+ *
+ * Without them `sudo curl …` reads as a command called "sudo" and sails through.
+ * The list stays short on purpose: anything longer turns into a shell parser, and a
+ * parser that gets it wrong either blocks an innocent call or waves a real one past.
+ */
+const EXEC_PREFIXES = new Set(['!', 'sudo', 'command', 'exec', 'nohup', 'time', 'env', 'busybox'])
+
+/**
+ * Split a command line at every operator that starts a new command.
+ *
+ * Testing the whole line for a flood tool failed in both directions: it missed a
+ * real invocation that was not the leading word statement (`cat big | curl -T -
+ * https://x`, `body=$(curl -s https://x)`), and every attempt to widen the pattern
+ * to catch those widened what innocent text could match. Splitting first makes the
+ * question exact — is a flood tool the *command word* of some segment?
+ */
+function commandSegments(command) {
+  return String(command || '')
+    .split(/\|\||&&|[|;&\n]|\$\(|`|\{|\}/)
+    .map((segment) => segment.trim())
+    .filter(Boolean)
 }
 
-/** The flood tool a command line invoked, for the ledger's per-tool counters. */
+/** The command word of a segment, with leading quotes and exec prefixes removed. */
+function leadingWord(segment) {
+  const tokens = segment.split(/\s+/).filter(Boolean)
+  let i = 0
+  while (i < tokens.length && i < 2 && EXEC_PREFIXES.has(tokens[i].toLowerCase().replace(/^!+/, ''))) i += 1
+  return (tokens[i] || '').replace(/^[\"']+|[\"']+$/g, '')
+}
+
+/** Normalise a command word to the plain tool name (`C:\bin\curl.exe` -> `curl`). */
+function floodNameOf(word) {
+  return baseNameOf(word).toLowerCase().replace(/\.(exe|cmd|bat|ps1)$/, '')
+}
+
+/**
+ * The flood tool a command line invokes, or 'other' when it invokes none.
+ *
+ * Only the command word of a segment counts, so `echo curl-config` and a message
+ * that merely contains "wget" stay legal, while `… | curl -s https://x` and
+ * `C:\Tools\curl.exe https://x` are refused.
+ */
 export function floodToolName(command) {
-  const text = String(command || '')
-  for (const word of FLOOD_TOOLS) {
-    if (new RegExp('(^|[ \\t;&|(])' + word + '([ \\t;&|)]|$)', 'i').test(text)) return word
+  for (const segment of commandSegments(command)) {
+    const word = leadingWord(segment)
+    if (word && FLOOD_TOOLS.has(floodNameOf(word))) return floodNameOf(word)
   }
   return 'other'
 }
 
+/**
+ * How much of a script file the gate is willing to read.
+ *
+ * A script is inspected to answer "what will run"; it is not the thing being judged,
+ * so the read is bounded rather than slurping a large file on every shell call.
+ */
+const SCRIPT_READ_MAX = 256 * 1024
+
+/**
+ * The text a shell call will actually run.
+ *
+ * `ops_bash` runs a *file* when it is given `script_path` instead of `command`, and a
+ * gate that reads only `command` therefore sees nothing at all for that call. That is
+ * the same bypass the shell-name list fixed, one field over: whichever field carries
+ * the payload, the gate has to follow it.
+ */
+function shellTextOf(args) {
+  const parts = []
+  if (typeof args.command === 'string') parts.push(args.command)
+  if (typeof args.script_path === 'string' && args.script_path.trim()) {
+    try {
+      const st = statSync(args.script_path)
+      if (st.isFile()) parts.push(readFileSync(args.script_path, 'utf8').slice(0, SCRIPT_READ_MAX))
+    } catch { /* an unreadable script is the shell tool's error to report, not the gate's */ }
+  }
+  return parts.join('\n')
+}
+
+function floodReason(toolName, args, text) {
+  if (!SHELL_TOOL_NAMES.has(toolName)) return undefined
+  const command = text === undefined ? shellTextOf(args) : text
+  const word = floodToolName(command)
+  if (word === 'other') return undefined
+  return 'dsh-context-toolkit: "' + word + '" pours whole responses into the transcript. '
+    + 'Use ctk_fetch_and_index(url, source) and then ctk_search(queries), or run it inside '
+    + 'ctk_execute(language:"javascript", code) and print only the conclusion.'
+}
+
 function hasService(ctx, serviceName) {
   try { return ctx.get(serviceName) !== undefined } catch { return false }
 }
@@ -315,18 +405,25 @@ function registerRoutingGate(ctx, config, stats) {
       const toolName = exec && exec.name
       const args = (exec && exec.arguments) || {}
 
+      // Read the call's text once and reuse it: a script can be 256 KB, and the deny
+      // path used to read it three times to answer three questions about one string.
+      const shellText = SHELL_TOOL_NAMES.has(toolName) ? shellTextOf(args) : ''
+
       if (config.denyCurlWget !== false) {
-        const reason = floodReason(toolName, args)
+        const reason = floodReason(toolName, args, shellText)
         if (reason) {
           stats.denied += 1
+          // The ledger counts what would have entered the conversation. A script file
+          // never does, so only the command line itself is measured here.
           stats.deniedBytes += typeof args.command === 'string' ? args.command.length : 0
-          stats.calls[floodToolName(args.command || '')] = (stats.calls[floodToolName(args.command || '')] || 0) + 1
+          const denied = floodToolName(shellText)
+          stats.calls[denied] = (stats.calls[denied] || 0) + 1
           return { kind: 'deny', reason }
         }
       }
 
       if (SHELL_TOOL_NAMES.has(toolName) && config.bashNudgeMinCommandBytes > 0) {
-        const command = typeof args.command === 'string' ? args.command : ''
+        const command = shellText
         if (command.length > config.bashNudgeMinCommandBytes) {
           const reason = 'dsh-context-toolkit: this command is about ' + command.length
             + ' bytes (threshold ' + config.bashNudgeMinCommandBytes + '). If you only need a count, a filter '
@@ -1223,7 +1320,7 @@ function registerObservabilityTools(ctx, config, stats, store, storageDir, log)
 
         // storage
         ok('存储目录 Storage', storageDir)
-        ok('版本 Version', '0.1.0')
+        ok('版本 Version', PLUGIN_VERSION)
 
         lines.push('')
         const failed = lines.filter((l) => l.startsWith('[FAIL]')).length

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-context-toolkit",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "DeepSeek Harness bundle: native ctk_* sandbox tools, a routing gate that keeps bulk output out of the transcript, and a local full-text knowledge base. No third-party runtime dependencies.",
   "repository": {
     "type": "git",