dsh-context-toolkit 0.2.1 → 0.2.3

package/README.md

@@ -113,10 +113,10 @@ Tool switches: `tools.execute`, `tools.executeFile`, `tools.batchExecute`, `tool
 The offline suites need no DSH runtime:
 
 ```bash
-node smoke.mjs        # 58 checks: contract, runtime discovery, tools, gate, knowledge base, observability, version reporting
+node smoke.mjs        # 68 checks: contract, runtime discovery, tools, gate (segment matching, prefix/path normalisation, script_path coverage and relative-path alignment), resource disposal, knowledge base, observability, version reporting
 node test-client.mjs  # 27 checks: browser-half contract and bilingual dictionary parity
 node test-package.mjs # 20 checks: publish manifest and the zero-dependency constraint
-node release-check.mjs # 24 checks: release readiness (manifest, deps, tool count, gate, version, SHA coverage, no hardcoded paths)
+node release-check.mjs # 27 checks: release readiness (manifest, deps, tool count, gate matching, version, SHA coverage, no hardcoded paths)
 ```
 
 ## Known limits
@@ -125,6 +125,7 @@ node release-check.mjs # 24 checks: release readiness (manifest, deps, tool coun
 - **`ctk_execute` timeouts are hard kills**: the child is terminated and `timedOut` is reported.
 - **A single run captures at most 256 KB**; anything beyond is counted but not retained. The text handed back is additionally capped at 4000 characters, so even a 1 MB single-line output cannot enter the conversation whole.
 - **The knowledge base deduplicates by path**: filing the same path again replaces the earlier copy.
+- **The gate is precise, not exhaustive.** A flood tool is refused only when it is the command word of some segment — after exec prefixes (`sudo`, `exec`, …) and path/extension normalisation are stripped — and `script_path` is read up to the first 256 KB. A tool a program invokes internally (`python -c 'import wget'`) is outside its remit.
 
 ## License
 

package/README.zh.md

@@ -113,10 +113,10 @@ await ctk_search({ queries: ['rate limit', 'auth'] });  // 只取相关片段
 离线套件不依赖 DSH 运行时：
 
 ```bash
-node smoke.mjs        # 58 项：契约、运行时探测、三工具、门禁、知识库、观测、版本自述
+node smoke.mjs        # 68 项：契约、运行时探测、三工具、门禁（分段匹配 + 前缀/路径归一 + script_path 覆盖与相对路径对齐）、资源释放、知识库、观测、版本自述
 node test-client.mjs  # 27 项：浏览器半体契约与双语字典一致性
 node test-package.mjs # 20 项：发布清单与零依赖约束
-node release-check.mjs # 24 项：发布就绪（清单/依赖/工具数/门禁/版本/SHA 覆盖/无硬编码路径）
+node release-check.mjs # 27 项：发布就绪（清单/依赖/工具数/门禁匹配/版本/SHA 覆盖/无硬编码路径）
 ```
 
 ## 已知边界
@@ -125,6 +125,7 @@ node release-check.mjs # 24 项：发布就绪（清单/依赖/工具数/门禁/
 - **`ctk_execute` 的超时是硬杀**：超时会终止子进程并把 `timedOut` 标出来。
 - **单次捕获上限 256 KB**，超出部分只计数不保留；回给对话的文本另有 4000 字符硬帽，因此 1 MB 的单行输出也不会整段进入上下文。
 - **知识库按路径去重**：同一路径再次归档是替换，不是追加。
+- **门禁精确而非穷尽**：只有当洪水工具是某个分段的「命令词」时才拒绝（会先剥掉 `sudo`/`exec` 等前缀、归一化路径与 `.exe` 等扩展名），`script_path` 最多读取前 256 KB。程序内部发起的调用（如 `python -c 'import wget'`）不在其职责内。
 
 ## 许可
 

package/index.js

@@ -296,28 +296,122 @@ const FLOOD_TOOLS = new Set(['curl', 'wget', 'httpie', 'http', 'aria2c'])
  */
 const SHELL_TOOL_NAMES = new Set(['bash', 'pwsh', 'shell', 'ops_bash', 'bash_persistent', 'pwsh_persistent'])
 
-function floodReason(toolName, args) {
-  const command = typeof args.command === 'string' ? args.command : ''
-  if (!SHELL_TOOL_NAMES.has(toolName)) return undefined
-  for (const word of FLOOD_TOOLS) {
-    if (new RegExp('(^|[ \\t;&|(])' + word + '([ \\t;&|)]|$)', 'i').test(command)) {
-      return 'dsh-context-toolkit: "' + word + '" pours whole responses into the transcript. '
-        + 'Use ctk_fetch_and_index(url, source) and then ctk_search(queries), or run it inside '
-        + 'ctk_execute(language:"javascript", code) and print only the conclusion.'
-    }
-  }
-  return undefined
+/**
+ * Words that may legally precede the real command word inside one segment.
+ *
+ * Without them `sudo curl …` reads as a command called "sudo" and sails through.
+ * The list stays short on purpose: anything longer turns into a shell parser, and a
+ * parser that gets it wrong either blocks an innocent call or waves a real one past.
+ */
+const EXEC_PREFIXES = new Set(['!', 'sudo', 'command', 'exec', 'nohup', 'time', 'env', 'busybox'])
+
+/**
+ * Split a command line at every operator that starts a new command.
+ *
+ * Testing the whole line for a flood tool failed in both directions: it missed a
+ * real invocation that was not the leading word statement (`cat big | curl -T -
+ * https://x`, `body=$(curl -s https://x)`), and every attempt to widen the pattern
+ * to catch those widened what innocent text could match. Splitting first makes the
+ * question exact — is a flood tool the *command word* of some segment?
+ */
+function commandSegments(command) {
+  return String(command || '')
+    .split(/\|\||&&|[|;&\n]|\$\(|`|\{|\}/)
+    .map((segment) => segment.trim())
+    .filter(Boolean)
 }
 
-/** The flood tool a command line invoked, for the ledger's per-tool counters. */
+/** The command word of a segment, with leading quotes and exec prefixes removed. */
+function leadingWord(segment) {
+  const tokens = segment.split(/\s+/).filter(Boolean)
+  let i = 0
+  while (i < tokens.length && i < 2 && EXEC_PREFIXES.has(tokens[i].toLowerCase().replace(/^!+/, ''))) i += 1
+  return (tokens[i] || '').replace(/^[\"']+|[\"']+$/g, '')
+}
+
+/** Normalise a command word to the plain tool name (`C:\bin\curl.exe` -> `curl`). */
+function floodNameOf(word) {
+  return baseNameOf(word).toLowerCase().replace(/\.(exe|cmd|bat|ps1)$/, '')
+}
+
+/**
+ * The flood tool a command line invokes, or 'other' when it invokes none.
+ *
+ * Only the command word of a segment counts, so `echo curl-config` and a message
+ * that merely contains "wget" stay legal, while `… | curl -s https://x` and
+ * `C:\Tools\curl.exe https://x` are refused.
+ */
 export function floodToolName(command) {
-  const text = String(command || '')
-  for (const word of FLOOD_TOOLS) {
-    if (new RegExp('(^|[ \\t;&|(])' + word + '([ \\t;&|)]|$)', 'i').test(text)) return word
+  for (const segment of commandSegments(command)) {
+    const word = leadingWord(segment)
+    if (word && FLOOD_TOOLS.has(floodNameOf(word))) return floodNameOf(word)
   }
   return 'other'
 }
 
+/**
+ * How much of a script file the gate is willing to read.
+ *
+ * A script is inspected to answer "what will run"; it is not the thing being judged,
+ * so the read is bounded rather than slurping a large file on every shell call.
+ */
+const SCRIPT_READ_MAX = 256 * 1024
+
+/**
+ * The text a shell call will actually run.
+ *
+ * `ops_bash` runs a *file* when it is given `script_path` instead of `command`, and a
+ * gate that reads only `command` therefore sees nothing at all for that call. That is
+ * the same bypass the shell-name list fixed, one field over: whichever field carries
+ * the payload, the gate has to follow it.
+ */
+function shellTextOf(args, exec) {
+  const parts = []
+  if (typeof args.command === 'string') parts.push(args.command)
+  if (typeof args.script_path === 'string' && args.script_path.trim()) {
+    const path = resolveScriptPath(args.script_path, args.cwd, exec)
+    try {
+      const st = statSync(path)
+      if (st.isFile()) parts.push(readFileSync(path, 'utf8').slice(0, SCRIPT_READ_MAX))
+    } catch { /* an unreadable script is the shell tool's error to report, not the gate's */ }
+  }
+  return parts.join('\n')
+}
+
+/**
+ * Where a relative script_path actually points.
+ *
+ * The host resolves a relative script against the *session* working directory, while
+ * statSync resolves it against this process's cwd — the install directory. The two
+ * disagree, so reading the raw string saw nothing for a relative script_path and waved
+ * the call through even though the host would run it happily. Aligning the base closes
+ * the last way a shell call can carry a payload the gate cannot see: whenever the host
+ * can run the file, the gate resolves the same file.
+ */
+function resolveScriptPath(requested, requestedCwd, exec) {
+  if (isAbsolute(requested)) return requested
+  let session = null
+  try {
+    session = exec && exec.agent && exec.agent.session && exec.agent.session.header
+      ? exec.agent.session.header.cwd : null
+  } catch { /* no session on this exec: fall back to the process default */ }
+  const base = session || process.cwd()
+  const cwd = typeof requestedCwd === 'string' && requestedCwd.trim()
+    ? (isAbsolute(requestedCwd) ? requestedCwd : resolve(base, requestedCwd))
+    : base
+  return resolve(cwd, requested)
+}
+
+function floodReason(toolName, args, text) {
+  if (!SHELL_TOOL_NAMES.has(toolName)) return undefined
+  const command = text === undefined ? shellTextOf(args) : text
+  const word = floodToolName(command)
+  if (word === 'other') return undefined
+  return 'dsh-context-toolkit: "' + word + '" pours whole responses into the transcript. '
+    + 'Use ctk_fetch_and_index(url, source) and then ctk_search(queries), or run it inside '
+    + 'ctk_execute(language:"javascript", code) and print only the conclusion.'
+}
+
 function hasService(ctx, serviceName) {
   try { return ctx.get(serviceName) !== undefined } catch { return false }
 }
@@ -336,18 +430,25 @@ function registerRoutingGate(ctx, config, stats) {
       const toolName = exec && exec.name
       const args = (exec && exec.arguments) || {}
 
+      // Read the call's text once and reuse it: a script can be 256 KB, and the deny
+      // path used to read it three times to answer three questions about one string.
+      const shellText = SHELL_TOOL_NAMES.has(toolName) ? shellTextOf(args, exec) : ''
+
       if (config.denyCurlWget !== false) {
-        const reason = floodReason(toolName, args)
+        const reason = floodReason(toolName, args, shellText)
         if (reason) {
           stats.denied += 1
+          // The ledger counts what would have entered the conversation. A script file
+          // never does, so only the command line itself is measured here.
           stats.deniedBytes += typeof args.command === 'string' ? args.command.length : 0
-          stats.calls[floodToolName(args.command || '')] = (stats.calls[floodToolName(args.command || '')] || 0) + 1
+          const denied = floodToolName(shellText)
+          stats.calls[denied] = (stats.calls[denied] || 0) + 1
           return { kind: 'deny', reason }
         }
       }
 
       if (SHELL_TOOL_NAMES.has(toolName) && config.bashNudgeMinCommandBytes > 0) {
-        const command = typeof args.command === 'string' ? args.command : ''
+        const command = shellText
         if (command.length > config.bashNudgeMinCommandBytes) {
           const reason = 'dsh-context-toolkit: this command is about ' + command.length
             + ' bytes (threshold ' + config.bashNudgeMinCommandBytes + '). If you only need a count, a filter '
@@ -383,7 +484,7 @@ function registerRoutingGate(ctx, config, stats) {
   })
 
   if (config.denyCurlWget !== false && ctx.tools && typeof ctx.tools.guard === 'function') {
-    ctx.tools.guard((exec) => floodReason(exec && exec.name, (exec && exec.arguments) || {}))
+    ctx.tools.guard((exec) => { const a = (exec && exec.arguments) || {}; return floodReason(exec && exec.name, a, shellTextOf(a, exec)) })
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-context-toolkit",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "DeepSeek Harness bundle: native ctk_* sandbox tools, a routing gate that keeps bulk output out of the transcript, and a local full-text knowledge base. No third-party runtime dependencies.",
   "repository": {
     "type": "git",