dsh-desktop-kit 2.2.1 → 2.7.2

package/plugins/dsh-guardrails/lib/secrets.js

@@ -0,0 +1,274 @@
+/**
+ * Secret detection and redaction for the guardrails scanner.
+ *
+ * Everything here is pure and local: cached regexes over in-memory text. A
+ * finding never carries the raw secret — only a masked placeholder, a rule id
+ * and a line/column. `redactText` is the one function every other module uses
+ * before a scanned value reaches a log or a tool result.
+ *
+ * Node built-ins only; no I/O and no network.
+ */
+
+/** Hard cap for one scan; larger inputs are truncated before regex evaluation. */
+const MAX_SCAN_CHARS = 2 * 1024 * 1024;
+
+/** Values that look like secrets but are obviously placeholders. */
+const PLACEHOLDER_VALUE =
+  /^(?:your|my|some|example|sample|placeholder|replace[_-]?me|changeme|change[_-]?me|dummy|fake|test|todo|secret|password|token|undefined|null|true|false)(?:[_-].*)?$/iu;
+
+/**
+ * Known secret shapes, most specific first. Later rules never re-report a span
+ * an earlier rule already claimed, which keeps `sk-ant-…` an Anthropic key and
+ * `sk-<32 hex>` a DeepSeek key instead of a generic `sk-…` match.
+ */
+export const SECRET_RULES = [
+  {
+    id: "private-key",
+    severity: "critical",
+    label: "PEM private key block",
+    pattern: "-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY-----[\\s\\S]{0,8192}?-----END (?:[A-Z0-9]+ )*PRIVATE KEY-----",
+    flags: "gu",
+    block: true,
+  },
+  {
+    id: "anthropic-key",
+    severity: "critical",
+    label: "Anthropic API key",
+    pattern: "\\bsk-ant-[A-Za-z0-9_-]{16,}",
+    flags: "gu",
+    maskPrefix: 6,
+  },
+  {
+    id: "deepseek-key",
+    severity: "critical",
+    label: "DeepSeek API key",
+    pattern: "\\bsk-[0-9a-f]{32}\\b",
+    flags: "gu",
+    maskPrefix: 3,
+  },
+  {
+    id: "github-pat",
+    severity: "critical",
+    label: "GitHub fine-grained token",
+    pattern: "\\bgithub_pat_[A-Za-z0-9_]{20,}",
+    flags: "gu",
+    maskPrefix: 10,
+  },
+  {
+    id: "github-token",
+    severity: "critical",
+    label: "GitHub token",
+    pattern: "\\bgh[pousr]_[A-Za-z0-9]{30,}",
+    flags: "gu",
+    maskPrefix: 4,
+  },
+  {
+    id: "openai-key",
+    severity: "critical",
+    label: "OpenAI API key",
+    pattern: "\\bsk-(?:proj-|svcacct-|admin-)?[A-Za-z0-9_-]{20,}",
+    flags: "gu",
+    maskPrefix: 3,
+  },
+  {
+    id: "aws-access-key",
+    severity: "high",
+    label: "AWS access key id",
+    pattern: "\\b(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}\\b",
+    flags: "gu",
+    maskPrefix: 4,
+  },
+  {
+    id: "aws-secret-key",
+    severity: "critical",
+    label: "AWS secret access key",
+    pattern:
+      "(?:aws_secret_access_key|AWS_SECRET_ACCESS_KEY)[ \\t]*[:=][ \\t]*[\"']?([A-Za-z0-9/+=]{32,})[\"']?",
+    flags: "gu",
+    valueGroup: 1,
+  },
+  {
+    id: "generic-assignment",
+    severity: "high",
+    label: "high-entropy secret assignment",
+    pattern:
+      "(?:api[_-]?key|access[_-]?key|secret(?:[_-]?key)?|client[_-]?secret|auth[_-]?token|token|password|passwd|pwd)[ \\t]*[:=][ \\t]*[\"']?([A-Za-z0-9_+/=-]{16,})[\"']?",
+    flags: "giu",
+    valueGroup: 1,
+    entropyMin: 3,
+  },
+];
+
+const compiledRules = new Map();
+
+function regexFor(rule) {
+  const key = `${rule.id}\u0000${rule.pattern}\u0000${rule.flags ?? ""}`;
+  const cached = compiledRules.get(key);
+  if (cached !== undefined) return cached;
+  const flags = new Set((rule.flags ?? "").split(""));
+  flags.add("g");
+  flags.add("d");
+  const regex = new RegExp(rule.pattern, [...flags].join(""));
+  compiledRules.set(key, regex);
+  return regex;
+}
+
+function clip(text) {
+  const source = typeof text === "string" ? text : String(text ?? "");
+  return source.length <= MAX_SCAN_CHARS ? source : source.slice(0, MAX_SCAN_CHARS);
+}
+
+/** Shannon entropy in bits per character; low values mark repeated padding. */
+export function shannonEntropy(value) {
+  const text = String(value ?? "");
+  if (text.length === 0) return 0;
+  const counts = new Map();
+  for (const character of text) counts.set(character, (counts.get(character) ?? 0) + 1);
+  let entropy = 0;
+  for (const count of counts.values()) {
+    const probability = count / text.length;
+    entropy -= probability * Math.log2(probability);
+  }
+  return entropy;
+}
+
+/** Whether a captured value passes the rule's own plausibility filters. */
+function acceptsValue(rule, value) {
+  const text = String(value ?? "").trim();
+  if (text.length === 0) return false;
+  if (rule.block === true) return true;
+  if (rule.id === "generic-assignment") {
+    if (text.length < 16) return false;
+    if (text.startsWith("$") || text.includes("${") || text.includes("<")) return false;
+    // An all-caps identifier is an environment-variable reference, not a value.
+    if (/^[A-Z][A-Z0-9_]*$/u.test(text)) return false;
+    if (PLACEHOLDER_VALUE.test(text)) return false;
+    return shannonEntropy(text) >= (rule.entropyMin ?? 3);
+  }
+  return true;
+}
+
+function overlaps(spans, start, end) {
+  for (const span of spans) {
+    if (start < span.end && end > span.start) return true;
+  }
+  return false;
+}
+
+/**
+ * Locate every accepted secret span in `text`.
+ *
+ * @param {string} text - scanned text.
+ * @param {{rules?: object[], maxSpans?: number}} [options] - rules override and span cap.
+ * @returns {{rule: object, start: number, end: number, value: string}[]} accepted non-overlapping spans in text order.
+ */
+export function collectSecretSpans(text, options = {}) {
+  const rules = Array.isArray(options.rules) ? options.rules : SECRET_RULES;
+  const maxSpans = Number.isFinite(options.maxSpans) ? Math.max(1, Number(options.maxSpans)) : 200;
+  const source = clip(text);
+  const spans = [];
+  for (const rule of rules) {
+    const regex = regexFor(rule);
+    regex.lastIndex = 0;
+    let match;
+    while ((match = regex.exec(source)) !== null) {
+      if (match[0].length === 0) {
+        regex.lastIndex += 1;
+        continue;
+      }
+      const group = rule.valueGroup ?? 0;
+      const indices = match.indices?.[group];
+      if (indices === undefined) continue;
+      const [start, end] = indices;
+      const value = source.slice(start, end);
+      if (!acceptsValue(rule, value)) continue;
+      if (overlaps(spans, start, end)) continue;
+      spans.push({ rule, start, end, value });
+      if (spans.length >= maxSpans) break;
+    }
+    if (spans.length >= maxSpans) break;
+  }
+  return spans.sort((left, right) => left.start - right.start);
+}
+
+/** Masked, log-safe rendering of one detected secret. Never includes the raw value. */
+export function maskSecret(rule, value) {
+  const text = String(value ?? "");
+  if (rule?.block === true) return "[REDACTED:private-key]";
+  const prefixChars = Number(rule?.maskPrefix ?? 0);
+  if (prefixChars > 0 && text.length > prefixChars) {
+    return `${text.slice(0, prefixChars)}…[redacted ${text.length} chars]`;
+  }
+  return `[REDACTED:${rule?.id ?? "secret"}]`;
+}
+
+function lineStartsOf(source) {
+  const starts = [0];
+  for (let index = 0; index < source.length; index += 1) {
+    if (source.charCodeAt(index) === 10) starts.push(index + 1);
+  }
+  return starts;
+}
+
+function positionOf(offset, starts) {
+  let low = 0;
+  let high = starts.length - 1;
+  while (low < high) {
+    const middle = (low + high + 1) >> 1;
+    if (starts[middle] <= offset) low = middle;
+    else high = middle - 1;
+  }
+  return { line: low + 1, column: offset - starts[low] + 1 };
+}
+
+/**
+ * Scan text for secrets. The result contains only masked values, so it is safe
+ * to place directly in a tool result or a log line.
+ *
+ * @param {string} text - text to scan.
+ * @param {{maxFindings?: number, includeGeneric?: boolean}} [options] - result cap and generic-assignment switch.
+ * @returns {{rule: string, severity: string, label: string, line: number, column: number, masked: string}[]} findings.
+ */
+export function scanTextForSecrets(text, options = {}) {
+  const maxFindings = Number.isFinite(options.maxFindings) ? Math.max(1, Number(options.maxFindings)) : 200;
+  const includeGeneric = options.includeGeneric !== false;
+  const rules = includeGeneric ? SECRET_RULES : SECRET_RULES.filter((rule) => rule.id !== "generic-assignment");
+  const spans = collectSecretSpans(text, { rules, maxSpans: maxFindings });
+  const limited = clip(text);
+  const starts = lineStartsOf(limited);
+  return spans.map((span) => {
+    const position = positionOf(span.start, starts);
+    return {
+      rule: span.rule.id,
+      severity: span.rule.severity,
+      label: span.rule.label,
+      line: position.line,
+      column: position.column,
+      masked: maskSecret(span.rule, span.value),
+    };
+  });
+}
+
+/**
+ * Replace every detected secret with a typed marker. Used for command
+ * previews, scan messages and any text that may leave the Host.
+ *
+ * @param {string} value - text to redact.
+ * @returns {string} text with secret spans replaced by `[REDACTED:<rule>]`.
+ */
+export function redactText(value) {
+  const text = typeof value === "string" ? value : String(value ?? "");
+  if (text.length === 0) return text;
+  const limited = clip(text);
+  const tail = text.length > MAX_SCAN_CHARS ? text.slice(MAX_SCAN_CHARS) : "";
+  const spans = collectSecretSpans(limited, { maxSpans: 1000 });
+  if (spans.length === 0) return `${limited}${tail}`;
+  let output = "";
+  let cursor = 0;
+  for (const span of spans) {
+    output += limited.slice(cursor, span.start);
+    output += `[REDACTED:${span.rule.id}]`;
+    cursor = span.end;
+  }
+  return `${output}${limited.slice(cursor)}${tail}`;
+}

package/plugins/dsh-guardrails/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "dsh-guardrails",
+  "version": "1.0.0",
+  "description": "Host guardrails for DSH: deny/ask policy for dangerous shell commands, protected-path write/edit/delete hooks, and a bounded read-only secret/worktree scan with an inspectable JSON policy.",
+  "license": "MIT",
+  "type": "module",
+  "main": "index.js",
+  "exports": {
+    ".": "./index.js",
+    "./lib": "./lib/scan.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "index.js",
+    "lib/**",
+    "tools/**",
+    "cordis.patch.yml",
+    "README.md"
+  ],
+  "dsh": {
+    "manifestVersion": 1,
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  }
+}

package/plugins/dsh-mcp-manager/README.md

@@ -0,0 +1,78 @@
+# dsh-mcp-manager
+
+MCP-серверы для DSH без SDK-зависимости: stdio и streamable HTTP, tools, resources, trust-гейт и премиальный экран в Settings.
+
+![MCP Settings](screenshots/settings-1440.png)
+
+## Settings UI
+
+Откройте **Настройки → MCP**:
+
+- живые карточки серверов: статус, транспорт, число tools, ошибка;
+- переключатели «Включён» и «Доверен»;
+- «Проверить» — переподключение и health;
+- «Tools» — список инструментов с описаниями;
+- «Добавить сервер» — пресеты GitHub / PostgreSQL / Filesystem или ручная форма;
+- токен сохраняется в `~/.dsh/mcp.secrets.json` (0600), а в `mcp.json` остаётся только `${secret:…}`;
+- новые tools появляются в **новом чате** после подключения.
+
+Пресеты — это один клик плюс токен, если он нужен серверу. Filesystem не требует токена.
+
+<p><img src="screenshots/settings-390.png" alt="MCP Settings на 390px" width="390"> <img src="screenshots/modal-390.png" alt="Форма добавления MCP-сервера" width="390"></p>
+
+## Конфиг
+
+`~/.dsh/mcp.json` — глобальные серверы, стартуют автоматически при `trusted: true`.
+
+```json
+{
+  "mcpServers": {
+    "github": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-github"],
+      "env": { "GITHUB_TOKEN": "${GITHUB_TOKEN}" },
+      "trusted": true
+    },
+    "postgres": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-postgres", "postgresql://readonly@localhost/db"],
+      "trusted": false
+    }
+  }
+}
+```
+
+`<project>/.dsh/mcp.json` — проектные серверы. Они **не** стартуют автоматически; доступны через `/mcp` (list/tools/call/resources/read), чтобы не запускать чужой код при открытии репозитория. Проектные серверы дополнительно требуют маркер `.dsh/mcp.trusted`:
+
+```text
+/mcp trust
+/mcp untrust
+```
+
+- `trusted` обязателен для запуска; без него сервер только отображается.
+- `${VAR}` в `env` и `headers` подставляется из окружения; отсутствующая переменная — ошибка, а не пустая строка.
+- `enabled: false` отключает сервер без удаления конфига.
+- `timeoutMs` — 1–120 с.
+- Секреты не логируются.
+
+## Команды
+
+```text
+/mcp init
+/mcp list
+/mcp tools github
+/mcp call github search_repositories {"query":"dsh-desktop-kit"}
+/mcp resources postgres
+/mcp read postgres postgres://schema
+/mcp reload
+```
+
+Глобальные tools регистрируются как `mcp__<server>__<tool>` при старте. Проектные tools не попадают в текущий toolset — для них есть `/mcp call`; после добавления в глобальный конфиг нужен перезапуск DSH.
+
+## Ограничения
+
+- Нет OAuth: только env/headers. Токены кладите в переменные окружения.
+- Нет UI: управление через `/mcp` и JSON-файлы.
+- Нет prompts и sampling; поддержаны tools/resources.
+- HTTP-транспорт поддерживает JSON и простой SSE-ответ; интерактивный SSE-стрим с серверными запросами не реализован.
+- MCP-сервер — произвольный процесс. Доверяйте только своим конфигам.