dsh-rule-engine 0.3.0 → 0.4.0

package/lib/core/authorization.js

@@ -1,6 +1,6 @@
 // authorization.js - 授权证据结构化匹配（P0：授权关联具体操作，区分询问与授权）
 // 纯函数，可独立测试。
-import { GENERIC_EXEC_TOOLS, pathTarget, commandText, writeTargetPathsFromCommand } from "./patterns.js";
+import { GENERIC_EXEC_TOOLS, pathTarget, commandText, writeTargetPathsFromCommand, extractCopyPaths } from "./patterns.js";
 
 export const AUTH_TTL_MS = 10 * 60 * 1000;
 
@@ -55,19 +55,25 @@ export function operationOf(toolName, args) {
   const cmd = commandText(args);
   let type = "any";
   let pathPrefix = "";
+  let pathPrefixes = [];
 
   if (name === "edit" || name === "write" || (name === "str_replace_editor" && args?.command !== "view")) {
     type = "write";
     pathPrefix = normalizePath(p || "");
+    if (pathPrefix) pathPrefixes = [pathPrefix];
   } else if (name === "pwsh" || name === "bash") {
     const text = cmd || "";
     type = inferTypeFromText(text);
     if (/git\s+(push|commit)/i.test(text)) type = "git";
     else if (/remove-item|rm\s+-r|rmdir|del\s+/i.test(text)) type = "delete";
-    else if (/backup|copy-item[^\n]*\.(?:bak|backups)[\\/]?|copy-item[^\n]*trash-/i.test(text)) type = "backup";
+    else if (/backup|(?:copy-item|move-item|rename-item)[^\n]*(?:\.bak|\.backups|trash-)/i.test(text)) type = "backup";
     else if (/set-content|add-content|out-file|writealltext|copy-item|move-item|rename-item/i.test(text)) type = "write";
     const writeTargets = writeTargetPathsFromCommand(text).map(normalizePath).filter(Boolean);
-    pathPrefix = writeTargets.sort((a, b) => b.length - a.length)[0] || inferPathPrefixFromText(text);
+    pathPrefixes = [...writeTargets];
+    const cp = extractCopyPaths(text);
+    if (cp && cp.source) pathPrefixes.push(normalizePath(cp.source));
+    pathPrefixes = [...new Set(pathPrefixes.filter(Boolean))];
+    pathPrefix = pathPrefixes.sort((a, b) => b.length - a.length)[0] || inferPathPrefixFromText(text);
   } else if (name === "skill") {
     type = "skill";
     pathPrefix = "";
@@ -79,16 +85,20 @@ export function operationOf(toolName, args) {
     pathPrefix = "";
   }
 
-  return { type, pathPrefix };
+  return { type, pathPrefix, pathPrefixes };
 }
 
-/** 判断授权记录是否匹配本次操作 */
+/** 判断授权记录是否匹配本次操作（支持源/目标多路径任一匹配） */
 export function authMatches(auth, op) {
   if (!auth || !op) return false;
   if (auth.type !== "any" && op.type !== "any" && auth.type !== op.type) return false;
   if (auth.pathPrefix) {
-    const p = normalizePath(op.pathPrefix || "");
-    if (!p.startsWith(auth.pathPrefix)) return false;
+    const candidates = Array.isArray(op.pathPrefixes) && op.pathPrefixes.length > 0
+      ? op.pathPrefixes
+      : (op.pathPrefix ? [op.pathPrefix] : []);
+    if (candidates.length === 0) return false;
+    const authPath = normalizePath(auth.pathPrefix);
+    if (!candidates.some((p) => normalizePath(p).startsWith(authPath))) return false;
   }
   return true;
 }

package/lib/core/guard-core.js

@@ -14,6 +14,7 @@ import {
   isAssemblyMutationTool,
   isBackupTool,
   isChinesePs1Violation,
+  isHighRiskEntryFile,
   isManualReadTool,
   isProtectedConfigPath,
   isReadOnlyTool,
@@ -21,7 +22,7 @@ import {
   isVariablePath,
   pathTarget
 } from "./patterns.js";
-import { describeAuth, describeOp, findMatchingAuth, operationOf } from "./authorization.js";
+import { describeAuth, describeOp, findMatchingAuth, operationOf, askQuestionText, inferPathPrefixFromText, inferTypeFromText } from "./authorization.js";
 import { computeMountSignature, profileNameFromArgs } from "./mount-signature.js";
 import { findBackupForPath, getSessionState, maybeReloadIfChanged } from "./state.js";
 import { isVersionedFile, validateEditedFile } from "./version-guard.js";
@@ -181,11 +182,26 @@ export function guardDecision(state, exec, now = Date.now()) {
   // 只读操作无条件放行（read/grep/glob/read_image/str_replace_editor view）
   if (isReadOnlyTool(name, args)) return null;
 
+  // E3：已有匹配授权时，拦截重复 ask_user_question，避免 AI 反复询问已授权事项
+  if (name === "ask_user_question") {
+    const qText = askQuestionText(args?.questions);
+    if (qText) {
+      const op = { type: inferTypeFromText(qText), pathPrefix: inferPathPrefixFromText(qText) };
+      const auth = findMatchingAuth([...(session.authorizations || []), ...(state.globalAuthorizations || [])], op);
+      if (auth) {
+        return makeHit(
+          { ruleId: "__already-authorized", title: "已有授权，无需重复询问", action: "deny" },
+          `【提示】本次询问范围 ${describeOp(op)} 已有匹配授权：${describeAuth(auth)}。无需重复 ask，请继续执行。`
+        );
+      }
+    }
+  }
+
   // 内部自护：插件配置/理解产物/规则文件禁止模型直写（/guard unlock 可临时放行）
   if (!unlock && (name === "edit" || name === "write" || (name === "str_replace_editor" && args?.command !== "view")) && isProtectedConfigPath(p)) {
     return makeHit(
       { ruleId: "__self-protect", title: "规则引擎配置只读（需 /guard unlock）", action: "deny" },
-      `【硬拦截】${p} 受规则引擎保护：修改需用户先执行 /guard unlock`
+      `【硬拦截】${p} 受规则引擎保护：需要用户输入 /guard unlock 放行（解锁范围含 rule-engine.json / rule-understanding.json / AGENTS.md，默认 10 分钟）。请停止并让用户在对话框输入 /guard unlock。`
     );
   }
 
@@ -269,7 +285,7 @@ function matchRule(cfg, ctx) {
   if (cfg.handler === "rule13a-backup") {
     const destructive = (name === "pwsh" || name === "bash") && cmd && (DESTRUCTIVE_CMD.test(cmd) || (isSensitiveToolCall(name, args) && !/git\s+(push|commit)/i.test(cmd)));
     const highRiskWrite = (name === "edit" || name === "write" || (name === "str_replace_editor" && args?.command !== "view")) && isProtectedConfigPath(p);
-    if (highRiskWrite && unlock) return null;
+    if (highRiskWrite && unlock && !isHighRiskEntryFile(p)) return null;
     if (destructive || highRiskWrite) {
       const op = operationOf(name, args);
       // 备份动作本身（复制到 .bak/.backups/trash-）不需要再“先备份”
@@ -278,14 +294,16 @@ function matchRule(cfg, ctx) {
       // 含 shell 变量（$var / %var%）的路径无法可靠解析 → 跳过机械备份检查（P0-2，防变量路径误拦）
       if (targetPath && isVariablePath(targetPath)) return null;
       // 已获 12A/12D 授权的操作 = 用户已明确确认本次操作 → 跳过 13A 机械备份（P1-2，一次授权覆盖全规则）
-      if (findMatchingAuth([...(session.authorizations || []), ...(state.globalAuthorizations || [])], op)) return null;
+      // 但高风险运行入口文件除外：即使已授权也必须有备份证据或明确提示
+      if (findMatchingAuth([...(session.authorizations || []), ...(state.globalAuthorizations || [])], op) && !isHighRiskEntryFile(targetPath)) return null;
       // 复制/新建到“尚不存在”的目标文件：属于创建新文件，不适用 13A 覆盖备份要求
       const isCreateNewTarget = !highRiskWrite && cmd && /copy-item|new-item/i.test(cmd) && targetPath && !existsSync(targetPath);
       if (!isCreateNewTarget) {
         const backup = findBackupForPath(state, session.id, targetPath);
         if (!backup) {
           const existing = session.backups.map((b) => `${b.targetPath} -> ${b.backupPath}`).join("；") || "无";
-          return makeHit(cfg, `【硬拦截】目标路径缺少对应备份（规则 13A）：已有备份 [${existing}]；本次目标 [${targetPath}]`);
+          const highRiskNote = isHighRiskEntryFile(targetPath) ? "（该文件不在自动备份范围，请先手动备份）" : "";
+          return makeHit(cfg, `【硬拦截】目标路径缺少对应备份（规则 13A）${highRiskNote}：已有备份 [${existing}]；本次目标 [${targetPath}]`);
         }
         if (!existsSync(backup.backupPath)) {
           return makeHit(cfg, `【硬拦截】备份记录存在但备份文件不存在（规则 13A）：${backup.backupPath}`);

package/lib/core/parser.js

@@ -89,7 +89,7 @@ function finalize(rule, lines) {
 export function extractElements(body) {
   const out = { trigger: "", check: "", action: "", exemption: "" };
   const grab = (label) => {
-    const re = new RegExp(`\\*\\*${label}\\*\\*[：:]\\s*([^\\n]*(?:\\n(?!\\s*\\*\\*)[^\\n]*)*)`, "i");
+    const re = new RegExp(`\\*\\*${label}(?:（[^）]*）)?\\*\\*[：:]\\s*([^\\n]*(?:\\n(?!\\s*\\*\\*)[^\\n]*)*)`, "i");
     const m = body.match(re);
     return m ? m[1].trim() : "";
   };

package/lib/core/patterns.js

@@ -108,7 +108,17 @@ export function isVariablePath(p) {
   return /\$[A-Za-z_][A-Za-z0-9_]*|%\w+%|\$\([^)]*\)/.test(p);
 }
 
-/** 从命令文本中提取“真正会被写入/删除的目标路径”（Copy-Item 只取 Destination，不再把源当写目标） */
+/** 判断是否为“不在自动备份范围的高风险运行入口文件”（Electron 壳、启动脚本、CLI 入口等） */
+export function isHighRiskEntryFile(p) {
+  if (typeof p !== "string") return false;
+  const n = p.replace(/\\/g, "/").toLowerCase();
+  if (/(?:^|[\\/])(?:dsh\.cmd|dsh\.ps1|dsh)$/i.test(n)) return true;
+  if (/(?:^|[\\/])main\.js$/i.test(n) && /(?:dsh-desktop|electron|dsh-web|dsh-client)/i.test(n)) return true;
+  if (/(?:^|[\\/])bin\.js$/i.test(n) && /@deepseek-ai[\\/]dsh[\\/]lib/i.test(n)) return true;
+  return /(?:^|[\\/])(?:startup|launcher|entry)[\\/][^\\/]+\.(?:js|mjs|cjs)$/i.test(n);
+}
+
+/** 从命令文本中提取“真正会被写入/删除的目标路径”（Copy-Item 只取 Destination；Set-Content 等只取 -Path/-LiteralPath/重定向目标，不再把值字符串里的路径当写目标） */
 export function writeTargetPathsFromCommand(command) {
   if (typeof command !== "string") return [];
   const cmd = command;
@@ -123,11 +133,30 @@ export function writeTargetPathsFromCommand(command) {
     return absolutePathTokens(cmd);
   }
   if (/(?:set-content|add-content|out-file|writealltext|new-item|remove-item|clear-content)/i.test(cmd)) {
-    return absolutePathTokens(cmd);
+    return extractCommandWriteTargets(cmd);
   }
   return [];
 }
 
+/** 从写类命令中提取真正的目标路径：优先 -Path/-LiteralPath/-FilePath/-Destination/-Target，其次重定向，最后取第一个绝对路径 */
+function extractCommandWriteTargets(command) {
+  const targets = [];
+  const flagRe = /-(?:path|literalpath|filepath|destination|target)\s+/ig;
+  let m;
+  while ((m = flagRe.exec(command))) {
+    const rest = command.slice(m.index + m[0].length);
+    const toks = absolutePathTokens(rest);
+    if (toks.length > 0) targets.push(toks[0]);
+  }
+  const redirRe = /(?:^|[\s>])(?:>>|>)\s*["']?([A-Za-z]:[\\/][^"';\s]+)/g;
+  while ((m = redirRe.exec(command))) {
+    targets.push(m[1].trim());
+  }
+  if (targets.length > 0) return [...new Set(targets)];
+  const fallback = absolutePathTokens(command);
+  return fallback.length > 0 ? [fallback[0]] : [];
+}
+
 function isBackupDestination(dest) {
   return /\.bak$/i.test(dest) || /\.backups[\\/]|trash-/i.test(dest);
 }
@@ -260,19 +289,22 @@ function isExecutableToken(tok) {
   return /\.(?:exe|cmd|bat|com|ps1|psm1|psd1|sh|bash|mjs|cjs)$/i.test(base);
 }
 
-/** 提取命令中的绝对路径（支持带引号含空格路径；去重；排除可执行程序本身与引号路径的前缀重复） */
+/** 提取命令中的绝对路径（支持带引号含空格路径；去重；排除可执行程序本身、URL scheme 与引号路径的前缀重复） */
 export function absolutePathTokens(command) {
   if (typeof command !== "string") return [];
+  const isHttpScheme = (idx) => idx >= 4 && command.slice(idx - 4, idx).toLowerCase() === "http";
   const quoted = [];
   let m;
   QUOTED_ABS_PATH_RE.lastIndex = 0;
   while ((m = QUOTED_ABS_PATH_RE.exec(command))) {
+    if (isHttpScheme(m.index)) continue;
     const tok = m[1].trim();
     if (!isExecutableToken(tok)) quoted.push(tok);
   }
   const unquoted = [];
   ABS_PATH_RE.lastIndex = 0;
   while ((m = ABS_PATH_RE.exec(command))) {
+    if (isHttpScheme(m.index)) continue;
     const tok = m[0].trim();
     if (isExecutableToken(tok)) continue; // 程序名不是文件目标
     if (quoted.some((q) => q.toLowerCase().startsWith(tok.toLowerCase()))) continue;
@@ -312,8 +344,11 @@ export function isAssemblyMutationTool(toolName, args) {
 /** 判断命令是否为全量挂载审计脚本（规则 27 的“审计”侧）；读取/搜索脚本内容不算执行审计 */
 export function isAuditCommand(command) {
   if (typeof command !== "string") return false;
-  if (/(?:get-content|cat|type|select-string|findstr|grep|more)\b/i.test(command)) return false;
-  return /\b(?:node|npm|npx|bun|deno)\s+[^\n]*audit-mount-consistency\.mjs/i.test(command);
+  // 只要真正执行 audit-mount-consistency.mjs（node/npm/npx/bun/deno 开头），即使后面带管道过滤也算审计
+  if (/\b(?:node|npm|npx|bun|deno)\s+[^\n]*audit-mount-consistency\.mjs/i.test(command)) return true;
+  // 读取/搜索审计脚本本身不是执行审计
+  if (/(?:get-content|cat|type|findstr|grep|more)\b/i.test(command)) return false;
+  return false;
 }
 
 /** 审计输出是否明确通过（无 DUPLICATES/INCONSISTENT/MISSING 且出现通过标记） */

package/lib/core/version-guard.js

@@ -92,6 +92,29 @@ function isSameLineReplacement(oldString, newString) {
   return lineAnchor(oldString) === lineAnchor(newString);
 }
 
+/** 表格行内单元格替换：同一行首列一致即放行（如插件快照表格 1.4.5→1.4.6） */
+function isTableRowReplacement(oldString, newString) {
+  if (!isSingleLine(oldString) || !isSingleLine(newString)) return false;
+  if (!isTableRow(oldString) || !isTableRow(newString)) return false;
+  const firstCell = (s) => {
+    const cells = s.trim().split("|").filter((c) => c.trim().length > 0);
+    return cells.length > 0 ? cells[0].trim() : "";
+  };
+  return firstCell(oldString) !== "" && firstCell(oldString) === firstCell(newString);
+}
+
+/** 中间插入多行段落：旧内容所有非空行按序出现在新内容中即放行 */
+function isOrderedLineInsertion(oldString, newString) {
+  const oldLines = String(oldString || "").split(/\r?\n/).filter((l) => l.trim().length > 0);
+  const newLines = String(newString || "").split(/\r?\n/).filter((l) => l.trim().length > 0);
+  if (oldLines.length === 0) return true;
+  let i = 0;
+  for (const line of newLines) {
+    if (i < oldLines.length && line.trim() === oldLines[i].trim()) i++;
+  }
+  return i === oldLines.length;
+}
+
 /** 校验 append/删除式编辑：新增需包含 old_string；删除/缩短时 new_string 可为 old_string 的子串；版本行重编号放行；非表格单行修改放行 */
 export function validateEditAppend(oldString, newString) {
   if (typeof oldString !== "string" || typeof newString !== "string") return { ok: true, errors: [] };
@@ -100,6 +123,8 @@ export function validateEditAppend(oldString, newString) {
   if (newString.includes(oldString)) return { ok: true, errors: [] };
   if (oldString.includes(newString)) return { ok: true, errors: [] };
   if (isSameLineReplacement(oldString, newString)) return { ok: true, errors: [] };
+  if (isTableRowReplacement(oldString, newString)) return { ok: true, errors: [] };
+  if (isOrderedLineInsertion(oldString, newString)) return { ok: true, errors: [] };
   return {
     ok: false,
     errors: ["new_string 未包含 old_string，疑似覆盖上一行"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-rule-engine",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "DSH 规则执行引擎 v3：容器解析 AGENTS.md + 理解器 + 匹配机 + 执行框架",
   "type": "module",
   "main": "lib/index.js",
@@ -38,7 +38,7 @@
     "audit:mount": "node scripts/audit-mount-consistency.mjs --profile web"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh-typert-protocol": ">=0.0.1-rc.3"
+    "@deepseek-ai/dsh-typert-protocol": ">=0.1.0-rc.3"
   },
   "dsh": {
     "bundle": {