dsh-quality-lens 0.1.0 → 0.1.1

package/README.md

@@ -2,6 +2,7 @@
 
 [![license](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![dsh](https://img.shields.io/badge/dsh-%3E%3D0.2.1--rc.2-8A2BE2)](https://github.com/deepseek-ai/DeepSeek-Harness)
+[![npm](https://img.shields.io/npm/v/dsh-quality-lens)](https://www.npmjs.com/package/dsh-quality-lens)
 [![tests](https://github.com/lishinho/dsh-quality-lens/actions/workflows/test.yml/badge.svg)](https://github.com/lishinho/dsh-quality-lens/actions/workflows/test.yml)
 
 > 给每个 AI 回答做一次体检：动作行显示 **质量分 + 话题关联度**，点开是带证据的质检报告。
@@ -80,7 +81,7 @@
 2. 来源选 **本地目录**，选择本仓库根目录（包含 `package.json`）；
 3. 重启 / 刷新 DSH。
 
-**GitHub / npm（发布后）**
+**GitHub / npm**
 
 ```sh
 dsh plugin --profile web add github:lishinho/dsh-quality-lens
@@ -151,6 +152,7 @@ node scripts/calibrate.mjs --in calibration/samples.labeled.jsonl
 - 默认引擎在本地完成，**不调用模型、不联网**；
 - 报告只存本机 `$DSH_HOME/quality-lens/reports.jsonl`，删目录即清空；
 - 无遥测；Jev 模式需显式配置 key，且仅发送当前问答；
+- 报告、证据、提示词建议里的凭证样式字符串（`npm_` / `ghp_` / `sk-` 等）会自动打码；旧报告在加载时也会被清洗。
 - 校准只读你自己的本机会话，不上传。
 
 ---
@@ -166,7 +168,7 @@ node scripts/calibrate.mjs --in calibration/samples.labeled.jsonl
 ## 开发
 
 ```sh
-node --test test/scoring.test.mjs test/host.test.mjs test/client-bundle.test.mjs test/labels-jev.test.mjs   # 31 tests
+node --test test/scoring.test.mjs test/host.test.mjs test/client-bundle.test.mjs test/labels-jev.test.mjs   # 32 tests
 node scripts/demo.mjs           # 打印样本评分
 node prototype/build.mjs        # 重建自包含原型
 ```

package/lib/host.js

@@ -10,7 +10,7 @@
 import fs from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
-import { scoreAnswer, scoreWithLabels, labelsToReport, isSubstantiveQuestion, RUBRIC_VERSION } from './scoring.js'
+import { scoreAnswer, scoreWithLabels, labelsToReport, isSubstantiveQuestion, redactSecrets, RUBRIC_VERSION } from './scoring.js'
 import { classifyWithJev, jevConfigured } from './jev.js'
 
 export const name = 'dsh-quality-lens'
@@ -112,7 +112,7 @@ export function apply(ctx, config = {}) {
   const appendLine = (file, value) => {
     try {
       fs.mkdirSync(dir, { recursive: true })
-      fs.appendFileSync(file, `${JSON.stringify(value)}\n`, 'utf8')
+      fs.appendFileSync(file, `${redactSecrets(JSON.stringify(value))}\n`, 'utf8')
     } catch (error) {
       ctx.logger?.warn?.(`[quality-lens] could not persist report: ${error?.message ?? error}`)
     }
@@ -134,9 +134,14 @@ export function apply(ctx, config = {}) {
     }
     const cutoff = Date.now() - settings.retentionDays * 24 * 60 * 60 * 1000
     const lines = text.split('\n').filter(Boolean).slice(-settings.maxReports)
+    let sanitized = false
+    const safeLines = []
     for (const line of lines) {
       try {
-        const record = JSON.parse(line)
+        const safeLine = redactSecrets(line)
+        if (safeLine !== line) sanitized = true
+        safeLines.push(safeLine)
+        const record = JSON.parse(safeLine)
         if (!record?.messageId || typeof record.score !== 'number') continue
         if (record.at && Date.parse(record.at) < cutoff) continue
         reports.set(record.messageId, record)
@@ -145,6 +150,14 @@ export function apply(ctx, config = {}) {
       }
     }
     trim()
+    if (sanitized) {
+      // Old reports may contain a token the user pasted into a chat; rewrite them.
+      try {
+        fs.writeFileSync(reportsFile, `${safeLines.join('\n')}\n`, 'utf8')
+      } catch {
+        // Best effort; the in-memory copy is already redacted.
+      }
+    }
   }
 
   const registerRoute = (route) => {

package/lib/scoring.js

@@ -67,6 +67,29 @@ const NEGATIVE = {
 
 const clamp = (n, lo = 0, hi = 100) => Math.max(lo, Math.min(hi, Math.round(n)))
 
+/** Credential-shaped strings that must never appear in a report, a chip, or a share card. */
+const SECRET_PATTERNS = [
+  /\bnpm_[A-Za-z0-9]{20,}\b/g,
+  /\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,
+  /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
+  /\bsk-[A-Za-z0-9_-]{16,}\b/g,
+  /\bAKIA[0-9A-Z]{16}\b/g,
+  /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g,
+  /\b(?:Bearer\s+)[A-Za-z0-9._-]{20,}\b/gi,
+]
+
+/**
+ * Redact credential-shaped substrings from anything user-facing or persisted.
+ * The report must never echo a token a user pasted into the chat.
+ * @param {string} text
+ * @returns {string}
+ */
+export function redactSecrets(text) {
+  let out = String(text ?? '')
+  for (const pattern of SECRET_PATTERNS) out = out.replace(pattern, '[REDACTED]')
+  return out
+}
+
 /** Small synonym expansion so Chinese paraphrases are not scored as off-topic. */
 const TERM_SYNONYMS = [
   ['便宜', '价格', '费用', '费率', '更低', '贵', '成本'],
@@ -141,12 +164,18 @@ export function termFrequencies(text) {
 export function isSubstantiveQuestion(text) {
   const raw = String(text ?? '').trim()
   if (!raw) return false
-  const compact = raw.replace(/[\s。！？!?，,、~～…]+/g, '')
+  const redacted = redactSecrets(raw)
+  if (redacted !== raw) {
+    const residual = redacted.replace(/\[REDACTED\]/g, '').replace(/[\s。！？!?，,、~～:：=]+/g, '')
+    // "token: npm_..." or a bare token is not a question.
+    if (residual.length < 8) return false
+  }
+  const compact = redacted.replace(/[\s。！？!?，,、~～…]+/g, '')
   if (compact.length === 0) return false
   const ack = /^(好的?|可以了?|行|嗯+|哦+|收到|明白了?|了解|谢谢|感谢|辛苦了?|继续|开始吧?|我试试|试一下|好滴|ok|okay|thanks?|thx)$/i
   if (ack.test(compact)) return false
   if (/^(好的?|可以了?|嗯+|哦+|行|收到|谢谢|继续)+$/.test(compact)) return false
-  const hasAsk = /[?？]|怎么|如何|什么|为什么|为啥|哪|多少|是否|能否|可不可以|吗|呢|请教|请问|介绍|解释|对比|比较|建议|推荐|写|生成|实现|排查|安装|配置|设计|分析|评估|总结|整理/.test(raw)
+  const hasAsk = /[?？]|怎么|如何|什么|为什么|为啥|哪|多少|是否|能否|可不可以|吗|呢|请教|请问|介绍|解释|对比|比较|建议|推荐|写|生成|实现|排查|安装|配置|设计|分析|评估|总结|整理/.test(redacted)
   if (!hasAsk && compact.length < 10) return false
   return compact.length >= 2
 }
@@ -275,7 +304,7 @@ function pickEvidence(answer, stats, topic) {
   const evidence = []
   const push = (dim, quote, why) => {
     if (!quote || evidence.some((item) => item.quote === quote)) return
-    evidence.push({ dim, quote, why })
+    evidence.push({ dim, quote: redactSecrets(quote), why: redactSecrets(why) })
   }
   const sentences = stats.sentences
   if (sentences[0]) push('relevance', sentences[0], '开篇直接回应问题')
@@ -605,8 +634,8 @@ function continuationScore(contextAnswer, answer) {
 
 export function classifyLabels(input) {
   const answer = String(input?.answer ?? '').trim()
-  const question = String(input?.question ?? '').trim() || '（未捕获到用户问题）'
-  const context = String(input?.context ?? '').trim()
+  const question = redactSecrets(String(input?.question ?? '').trim()) || '（未捕获到用户问题）'
+  const context = redactSecrets(String(input?.context ?? '').trim())
   const contextAnswer = String(input?.contextAnswer ?? '').trim()
   const stats = answerStats(answer)
   let topic = topicCoverage(question, answer, new Set(tokenize(answer)))
@@ -713,7 +742,8 @@ function dimsFromLabels(labels) {
  */
 export function labelsToReport(labels, extra = {}) {
   const answer = String(extra.answer ?? '')
-  const question = String(extra.question ?? '')
+  const question = redactSecrets(String(extra.question ?? ''))
+  const context = redactSecrets(String(extra.context ?? ''))
   const stats = labels.stats ?? answerStats(answer)
   const topic = labels.topic
   const dims = labels.dims ?? dimsFromLabels({ ...labels, answerText: answer })
@@ -732,7 +762,7 @@ export function labelsToReport(labels, extra = {}) {
   const confidence = labels.source === 'jev' ? labels.confidence ?? 'medium' : stats.chars < 120 || topic.intents.length === 0 ? 'low' : 'medium'
   const evidence = pickEvidence(answer, stats, topic)
   const suggestions = buildSuggestions(topic.intents, dims, topic)
-  const tipQuestion = topic.contextUsed && extra.context ? String(extra.context) : question
+  const tipQuestion = topic.contextUsed && context ? context : question
   const promptTips = buildPromptTips({ question: tipQuestion, dims, topic, labels })
 
   return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-quality-lens",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "为每个 DeepSeek Harness 回答做质量与话题关联体检，并给出可复制的提示词改进建议。只观测不改写，默认本地评分，可选 Jev 精评。",
   "type": "module",
   "main": "lib/host.js",