dsh-rule-engine 0.3.0

package/lib/core/mount-signature.js

@@ -0,0 +1,87 @@
+// mount-signature.js - 规则 27 装配状态哈希
+// 用“装配内容”而不是单调 revision 判断是否需要重跑全量审计。
+// 覆盖：profile bundles、本地 dependencies（link/file/github/http）、用户 patch、根 patch、bundle 内部 patch、运行时注入 registry。
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { dshHome } from "./paths.js";
+
+function tryRead(p) {
+  try {
+    return existsSync(p) ? readFileSync(p, "utf8") : "";
+  } catch {
+    return "";
+  }
+}
+
+function resolveBundlePkg(b, profileDir, home) {
+  const candidates = [
+    join(profileDir, "node_modules", b, "package.json"),
+    join(home, "profiles", "node_modules", b, "package.json")
+  ];
+  if (b.startsWith("@")) {
+    const [scope, name] = b.split("/");
+    candidates.push(join(home, "profiles", "node_modules", scope, name, "package.json"));
+  }
+  for (const c of candidates) if (existsSync(c)) return c;
+  return null;
+}
+
+/** 从工具参数/命令中提取目标 profile 名（缺省 web） */
+export function profileNameFromArgs(args = {}) {
+  const p = String(args.file_path || args.path || "");
+  const pm = p.match(/profiles[\\/]([^\\/]+)[\\/]/i);
+  if (pm) return pm[1];
+  if (args.profile) return String(args.profile);
+  const cmd = String(args.command || args.code || "");
+  let idx = cmd.indexOf("--profile");
+  if (idx >= 0) {
+    const rest = cmd.slice(idx + "--profile".length).trim();
+    const val = rest.replace(/^=/, "").split(/\s+/)[0];
+    if (val) return val;
+  }
+  return "web";
+}
+
+/** 计算装配状态哈希；profile 缺失时返回固定 missing 标记，避免误伤 */
+export function computeMountSignature(profileName = "web") {
+  const home = dshHome();
+  const profileDir = join(home, "profiles", profileName);
+  const pkgPath = join(profileDir, "package.json");
+  if (!existsSync(pkgPath)) return `missing-profile:${profileName}`;
+  const hash = createHash("sha256");
+  let pkg;
+  try {
+    pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+  } catch (e) {
+    return `profile-parse-error:${profileName}:${e instanceof Error ? e.message : String(e)}`;
+  }
+  const bundles = pkg?.dsh?.profile?.bundles || [];
+  const deps = pkg?.dependencies || {};
+  hash.update("bundles:" + JSON.stringify(bundles));
+  // 只把会影响装配类型判断的本地依赖纳入哈希；普通 registry 版本变化不触发重审计
+  const localDeps = {};
+  for (const [name, spec] of Object.entries(deps)) {
+    if (typeof spec === "string" && /^(link:|file:|github:|http)/i.test(spec)) localDeps[name] = spec;
+  }
+  hash.update("localDeps:" + JSON.stringify(localDeps));
+  hash.update("profilePatch:" + tryRead(join(profileDir, "cordis.patch.yml")));
+  hash.update("rootPatch:" + tryRead(join(home, "cordis.patch.yml")));
+  hash.update("injectRegistry:" + tryRead(join(home, "super-injector", "registry.json")));
+  for (const b of bundles) {
+    const bp = resolveBundlePkg(b, profileDir, home);
+    if (!bp) {
+      hash.update("bundleMissing:" + b);
+      continue;
+    }
+    try {
+      const pkgB = JSON.parse(readFileSync(bp, "utf8"));
+      hash.update("bundlePkg:" + b + ":" + JSON.stringify({ version: pkgB.version, dsh: pkgB.dsh }));
+      const patchRel = pkgB?.dsh?.bundle?.patch;
+      if (patchRel) hash.update("bundlePatch:" + b + ":" + tryRead(join(dirname(bp), patchRel)));
+    } catch (e) {
+      hash.update("bundlePkgError:" + b + ":" + (e instanceof Error ? e.message : String(e)));
+    }
+  }
+  return hash.digest("hex");
+}

package/lib/core/parser.js

@@ -0,0 +1,101 @@
+// parser.js - 解析 AGENTS.md 规则容器。
+// 纯 Node，可独立测试。把 AGENTS.md 解析为规则列表，规则正文保留四要素原文。
+import { readFileSync, statSync } from "node:fs";
+import { agentsFilePath } from "./paths.js";
+
+const RULE_HEADER_RE = /^###\s*\[规则\s*([0-9A-Za-z]+)\]\s*(.+?)\s*$/;
+const SECTION_RE = /^##\s+(.+?)\s*$/;
+const FREE_ZONE_START_RE = /^\s*<!--\s*free-zone:start\s*-->\s*$/;
+const FREE_ZONE_END_RE = /^\s*<!--\s*free-zone:end\s*-->\s*$/;
+
+/**
+ * 从 AGENTS.md 解析全部规则。
+ * @returns {{ok: boolean, missing: boolean, error?: string, rules: Array, raw: string, mtimeMs: number}}
+ */
+export function loadRules() {
+  const file = agentsFilePath();
+  let raw;
+  let mtimeMs = 0;
+  try {
+    raw = readFileSync(file, "utf8");
+    mtimeMs = statSync(file).mtimeMs;
+  } catch (error) {
+    if (error && error.code === "ENOENT") {
+      return { ok: false, missing: true, error: `未找到 ${file}`, rules: [], raw: "", mtimeMs: 0 };
+    }
+    return { ok: false, missing: false, error: String(error), rules: [], raw: "", mtimeMs: 0 };
+  }
+  const bom = raw.charCodeAt(0) === 0xfeff;
+  const text = bom ? raw.slice(1) : raw;
+  const lines = text.split("\n");
+  const rules = [];
+  let currentSection = "未分区";
+  let current = null;
+  let inFreeZone = false;
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    // 自由区域边界：区内内容完全不解析（不产生规则、不切换分区），对引擎透明
+    if (FREE_ZONE_START_RE.test(line)) {
+      if (current) rules.push(finalize(current, lines));
+      current = null;
+      inFreeZone = true;
+      continue;
+    }
+    if (FREE_ZONE_END_RE.test(line)) {
+      inFreeZone = false;
+      continue;
+    }
+    if (inFreeZone) continue;
+    const sec = line.match(SECTION_RE);
+    if (sec) {
+      if (current) rules.push(finalize(current, lines));
+      currentSection = sec[1].trim();
+      current = null;
+      continue;
+    }
+    const rule = line.match(RULE_HEADER_RE);
+    if (rule) {
+      if (current) rules.push(finalize(current, lines));
+      current = {
+        index: rule[1],
+        title: rule[2].trim(),
+        section: currentSection,
+        startLine: i,
+        endLine: i + 1
+      };
+    } else if (current) {
+      current.endLine = i + 1;
+    }
+  }
+  if (current) rules.push(finalize(current, lines));
+  return { ok: true, missing: false, error: null, rules, raw: text, mtimeMs };
+}
+
+function finalize(rule, lines) {
+  const body = lines.slice(rule.startLine + 1, rule.endLine).join("\n").trim();
+  const levelMatch = rule.title.match(/执行等级[：:]\s*([A-DM+]+(?:\s*[强弱])?)/);
+  return {
+    index: rule.index,
+    title: rule.title,
+    section: rule.section,
+    startLine: rule.startLine,
+    endLine: rule.endLine,
+    level: levelMatch ? levelMatch[1].replace(/\s+/g, "") : "",
+    body
+  };
+}
+
+/** 从规则正文提取四要素 */
+export function extractElements(body) {
+  const out = { trigger: "", check: "", action: "", exemption: "" };
+  const grab = (label) => {
+    const re = new RegExp(`\\*\\*${label}\\*\\*[：:]\\s*([^\\n]*(?:\\n(?!\\s*\\*\\*)[^\\n]*)*)`, "i");
+    const m = body.match(re);
+    return m ? m[1].trim() : "";
+  };
+  out.trigger = grab("触发");
+  out.check = grab("检查");
+  out.action = grab("动作");
+  out.exemption = grab("豁免");
+  return out;
+}

package/lib/core/paths.js

@@ -0,0 +1,24 @@
+// paths.js - 解析 DSH 用户目录。
+// 不依赖 @deepseek-ai/dsh-home-paths，优先使用 DSH_HOME 环境变量，回退到 ~/.dsh。
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+export function dshHome() {
+  return process.env.DSH_HOME || join(homedir(), ".dsh");
+}
+
+export function agentsFilePath() {
+  return join(dshHome(), "AGENTS.md");
+}
+
+export function auditFilePath() {
+  return join(dshHome(), "rule-engine.log.jsonl");
+}
+
+export function configFilePath() {
+  return join(dshHome(), "rule-engine.json");
+}
+
+export function understandingFilePath() {
+  return join(dshHome(), "rule-understanding.json");
+}

package/lib/core/patterns.js

@@ -0,0 +1,351 @@
+// patterns.js - 规则引擎共享的正则与常量。
+// 注意：本文件只放可测试的纯函数/常量，不依赖 Cordis。
+
+export const INLINE_CMD =
+  /\b(?:node|pwsh|powershell)\s+(?:-[ep]|--eval|--print|-Command|-c)\b/i;
+
+export const BOM_WRITE =
+  /(?:set-content|add-content|out-file|writealltext)[\s\S]{0,300}?(?:-Encoding\s+UTF8|utf8)[\s\S]{0,300}?\.(?:json|ya?ml)\b|(?:set-content|add-content|out-file|writealltext)[\s\S]{0,300}?\.(?:json|ya?ml)\b[\s\S]{0,300}?(?:-Encoding\s+UTF8|utf8)/i;
+
+export const DESTRUCTIVE_CMD =
+  /(?:remove-item|rm\s+-r|rmdir\s+\/s|rd\s+\/s|del\s+(?:\/[a-z]+\s+)*\/[a-z]*s[a-z]*|move-item|rename-item|copy-item\s+[^\n]*?(?:-\s*force|overwrite))/i;
+
+export const SENSITIVE_CMD =
+  /(?:git\s+(?:push|commit)|remove-item|rm\s+-r|rmdir\s+\/s|rd\s+\/s|del\s+\/s|move-item|rename-item|copy-item\s+[^\n]*?(?:-\s*force|overwrite))/i;
+
+export const CONFIG_FILE_RE =
+  /(?:^|[\\/])(?:AGENTS\.md|settings\.yaml|\.credentials\.yaml|workspace\.json|cordis\.patch\.yml|rule-understanding\.json|rule-guard\.json|rule-engine\.json)$/i;
+
+export const DATA_DIR_RE =
+  /(?:^|[\\/])\.dsh[\\/](?:sessions|storages|\.backups)[\\/]/i;
+
+export const TIME_WORDS =
+  /今天|昨天|前天|上周|本周|刚才|\d+\s*分钟前|\d{1,2}\s*月\s*\d{1,2}\s*日|\d{4}\s*年\s*\d{1,2}\s*月\s*\d{1,2}\s*日/;
+
+export const PROMISE_WORDS =
+  /包在我身上|肯定能|绝对没问题|保证(?!不|无法)|一定可以|放心(?:，|,)?肯定|万无一失/;
+
+export const URL_RE = /https?:\/\/[^\s]+/i;
+
+export const SOURCE_MARK = /来源|出处|via|source|reference|引自|参考/i;
+
+export const CJK_RE = /[\u4e00-\u9fff]/;
+
+export const MANUAL_PATH_RE = /dsh-usage-manual[\\/]SKILL\.md/i;
+
+export const DSH_KEYWORDS_RE =
+  /DSH|dsh|插件|技能|规则|配置|迁移|手册|会话|装配|profile|bundle/i;
+
+export const SKILL_EXEMPT = new Set(["dsh-usage-manual", "task-planner"]);
+
+export const SELF_PROTECT_PATHS = [
+  "**/rule-engine.json",
+  "**/rule-understanding.json",
+  "**/rule-guard.json"
+];
+
+/** 判断一条命令文本是否是「读取手册」类命令 */
+export function isManualReadCommand(command) {
+  if (typeof command !== "string") return false;
+  return MANUAL_PATH_RE.test(command) && /get-content|cat|type|read|grep|findstr|str_replace_editor/i.test(command);
+}
+
+/** 判断一次工具调用是否算作「已读手册」 */
+export function isManualReadTool(toolName, args) {
+  const name = String(toolName || "");
+  if (name === "read" || name === "grep" || name === "str_replace_editor") {
+    const p = String(args?.file_path || args?.path || args?.pattern || "");
+    if (MANUAL_PATH_RE.test(p)) return true;
+  }
+  if (name === "pwsh" || name === "bash") {
+    return isManualReadCommand(args?.command || args?.code || "");
+  }
+  return false;
+}
+
+/** 从工具参数中提取目标路径（edit/write/read 等） */
+export function pathTarget(args) {
+  if (!args || typeof args !== "object") return null;
+  const p = args.file_path ?? args.path;
+  return typeof p === "string" ? p : null;
+}
+
+/** 从工具参数中提取命令文本（pwsh/bash） */
+export function commandText(args) {
+  if (!args || typeof args !== "object") return null;
+  const c = args.command ?? args.code;
+  return typeof c === "string" ? c : null;
+}
+
+/** 判断是否命中配置文件保护路径 */
+export function isProtectedConfigPath(p) {
+  if (typeof p !== "string") return false;
+  const n = p.replace(/\\/g, "/").toLowerCase();
+  return CONFIG_FILE_RE.test(n) || DATA_DIR_RE.test(n);
+}
+
+/** 从 Copy-Item 命令中提取源与目标路径（优先支持带引号/空格的 Windows 路径） */
+export function extractCopyPaths(command) {
+  if (typeof command !== "string") return null;
+  const quoted = command.match(
+    /(?:copy-item\s+)?(?:-literalpath|-path)?\s*["']([^"']+)["']\s+(?:-destination\s*)?["']([^"']+)["']/i
+  );
+  if (quoted && quoted[1] && quoted[2]) {
+    return { source: quoted[1].trim(), dest: quoted[2].trim() };
+  }
+  const simple = command.match(
+    /copy-item\s+(?:-literalpath|-path)?\s*([^\s"']+)\s+(?:-destination\s*)?([^\s"']+)/i
+  );
+  if (simple && simple[1] && simple[2]) {
+    return { source: simple[1].trim(), dest: simple[2].trim() };
+  }
+  return null;
+}
+
+/** 判断路径是否含 shell 变量（$var / ${var} / %var%），含变量的路径无法可靠解析为真实目标 */
+export function isVariablePath(p) {
+  if (typeof p !== "string") return false;
+  return /\$[A-Za-z_][A-Za-z0-9_]*|%\w+%|\$\([^)]*\)/.test(p);
+}
+
+/** 从命令文本中提取“真正会被写入/删除的目标路径”（Copy-Item 只取 Destination，不再把源当写目标） */
+export function writeTargetPathsFromCommand(command) {
+  if (typeof command !== "string") return [];
+  const cmd = command;
+  if (/\bcopy-item\b/i.test(cmd)) {
+    const cp = extractCopyPaths(cmd);
+    if (cp && cp.dest) return [cp.dest];
+    // 解析失败时保守返回全部绝对路径，避免漏拦
+    return absolutePathTokens(cmd);
+  }
+  if (/\b(?:move-item|rename-item)\b/i.test(cmd)) {
+    // 移动/重命名：源被删除、目标被写入，保守都算写目标
+    return absolutePathTokens(cmd);
+  }
+  if (/(?:set-content|add-content|out-file|writealltext|new-item|remove-item|clear-content)/i.test(cmd)) {
+    return absolutePathTokens(cmd);
+  }
+  return [];
+}
+
+function isBackupDestination(dest) {
+  return /\.bak$/i.test(dest) || /\.backups[\\/]|trash-/i.test(dest);
+}
+
+/** 从备份工具调用推导目标路径与备份路径；无法推导或非备份目标返回 null */
+export function backupPathsFromTool(toolName, args) {
+  const name = String(toolName || "");
+  const p = pathTarget(args);
+  const cmd = commandText(args);
+  if (name === "pwsh" || name === "bash") {
+    const paths = extractCopyPaths(cmd || "");
+    if (paths && /^[a-z]:[\\/]/i.test(paths.source) && /^[a-z]:[\\/]/i.test(paths.dest) && isBackupDestination(paths.dest)) {
+      return { targetPath: paths.source, backupPath: paths.dest };
+    }
+  }
+  if (p) {
+    if (/\.bak$/i.test(p)) {
+      return { targetPath: p.replace(/\.bak$/i, ""), backupPath: p };
+    }
+    if (/\.backups[\\/]|trash-/i.test(p)) {
+      return { targetPath: p, backupPath: p };
+    }
+  }
+  return null;
+}
+
+/** 判断命令是否包含备份动作（简单启发式） */
+export function isBackupCommand(command) {
+  if (typeof command !== "string") return false;
+  return /backup|\.backups|copy-item[^\n]*\.bak|robocopy[^\n]*\/e|copy-item[^\n]*trash-/i.test(command);
+}
+
+/** 判断一次工具调用是否算作备份动作 */
+export function isBackupTool(toolName, args) {
+  const name = String(toolName || "");
+  const p = pathTarget(args);
+  if (p && /\.backups[\\/]|trash-|\.bak$/i.test(p)) return true;
+  if (name === "pwsh" || name === "bash") return isBackupCommand(commandText(args) || "");
+  return false;
+}
+
+/** 判断一次工具调用是否是授权询问 */
+export function isAskTool(toolName) {
+  return String(toolName || "") === "ask_user_question";
+}
+
+/** 判断命令是否包含 Get-Date 核对 */
+export function isGetDateCommand(command) {
+  return typeof command === "string" && /\bget-date\b/i.test(command);
+}
+
+const PS1_FILE_RE = /\.(?:ps1|psm1|psd1)(?=[\s'"`]|$)/i;
+
+/** 判断是否命中规则 9 的「含中文 .ps1 未按 UTF-8 带 BOM」硬拦项 */
+export function isChinesePs1Violation(toolName, args) {
+  const name = String(toolName || "");
+  const p = pathTarget(args);
+  const cmd = commandText(args);
+  const hasCJK = (s) => typeof s === "string" && CJK_RE.test(s);
+  if ((name === "write" || name === "edit") && p && PS1_FILE_RE.test(p)) {
+    const content = args?.content ?? args?.new_string ?? "";
+    if (hasCJK(content)) return true;
+  }
+  if ((name === "pwsh" || name === "bash") && cmd && PS1_FILE_RE.test(cmd) && hasCJK(cmd)) {
+    if (/(?:-Encoding\s+UTF8|utf8)/i.test(cmd)) return false;
+    return true;
+  }
+  return false;
+}
+
+const READ_ONLY_TOOLS = new Set(["read", "grep", "glob", "read_image"]);
+const READONLY_CMD_RE =
+  /\b(?:Get-Content|Get-ChildItem|Get-Item|Get-Command|Get-Date|Select-String|Find-String|Test-Path|Get-Process|Get-Service|cat|type|dir|ls|grep|findstr|more|netstat|where)\b/i;
+const MUTATING_CMD_RE =
+  /(?:Set-Content|Add-Content|Out-File|Remove-Item|Move-Item|Copy-Item|Rename-Item|New-Item|Clear-Content|git\s+(?:push|commit)|rm\s+-r|rmdir\s+\/s|del\s+\/s|>|>>)/i;
+
+/** 判断命令文本是否只读（读文件/查询类，无写入/删除/提交副作用） */
+export function isReadOnlyCommand(command) {
+  if (typeof command !== "string") return false;
+  if (MUTATING_CMD_RE.test(command)) return false;
+  return READONLY_CMD_RE.test(command);
+}
+
+/** 判断一次工具调用是否只读（必须无条件放行） */
+export function isReadOnlyTool(toolName, args) {
+  const name = String(toolName || "");
+  if (READ_ONLY_TOOLS.has(name)) return true;
+  if (name === "str_replace_editor" && args?.command === "view") return true;
+  if (name === "pwsh" || name === "bash") {
+    return isReadOnlyCommand(commandText(args) || "");
+  }
+  return false;
+}
+
+let workspaceRootOverride = "";
+
+/** 由插件 apply 阶段从 workspaceRegistry 设置工作区根目录 */
+export function setWorkspaceRoot(p) {
+  workspaceRootOverride = p || "";
+}
+
+function workspaceRoot() {
+  return workspaceRootOverride || process.env.DSH_WORKSPACE || "";
+}
+
+function isPathInside(target, root) {
+  const t = normalizePathForCompare(target);
+  const r = normalizePathForCompare(root);
+  if (!t || !r) return false;
+  return t === r || t.startsWith(r.endsWith("/") ? r : r + "/");
+}
+
+function normalizePathForCompare(p) {
+  return String(p).replace(/\\/g, "/").toLowerCase().replace(/\/+$/, "");
+}
+
+/** 判断路径是否在工作区外（用于“工作区外写入”敏感判定） */
+export function isOutsideWorkspace(p) {
+  if (typeof p !== "string") return false;
+  if (!/^[a-z]:[\\/]/i.test(p) && !p.startsWith("/")) return false; // 只判断绝对路径
+  return !isPathInside(p, workspaceRoot());
+}
+
+const ABS_PATH_RE = /[A-Za-z]:[\\/][^\s'"`，。；：！？（）【】《》、]+/g;
+const QUOTED_ABS_PATH_RE = /["']([A-Za-z]:[\\/][^"']+)["']/g;
+
+/** 判断绝对路径 token 是否是可执行程序（命令本身，非文件目标） */
+function isExecutableToken(tok) {
+  const base = tok.replace(/\\/g, "/").split("/").pop() || "";
+  return /\.(?:exe|cmd|bat|com|ps1|psm1|psd1|sh|bash|mjs|cjs)$/i.test(base);
+}
+
+/** 提取命令中的绝对路径（支持带引号含空格路径；去重；排除可执行程序本身与引号路径的前缀重复） */
+export function absolutePathTokens(command) {
+  if (typeof command !== "string") return [];
+  const quoted = [];
+  let m;
+  QUOTED_ABS_PATH_RE.lastIndex = 0;
+  while ((m = QUOTED_ABS_PATH_RE.exec(command))) {
+    const tok = m[1].trim();
+    if (!isExecutableToken(tok)) quoted.push(tok);
+  }
+  const unquoted = [];
+  ABS_PATH_RE.lastIndex = 0;
+  while ((m = ABS_PATH_RE.exec(command))) {
+    const tok = m[0].trim();
+    if (isExecutableToken(tok)) continue; // 程序名不是文件目标
+    if (quoted.some((q) => q.toLowerCase().startsWith(tok.toLowerCase()))) continue;
+    unquoted.push(tok);
+  }
+  return [...new Set([...quoted, ...unquoted])];
+}
+
+function commandHasOutsideWrite(cmd) {
+  if (typeof cmd !== "string") return false;
+  return writeTargetPathsFromCommand(cmd).some((p) => isOutsideWorkspace(p));
+}
+
+export const GENERIC_EXEC_TOOLS = new Set([
+  "dev_stage_add",
+  "dev_stage_call",
+  "dev_stage_promote",
+  "dev_stage_demote"
+]);
+
+const ASSEMBLY_TOOLS = new Set(["dev_install_package", "dev_inject_plugin", "dev_uninject_plugin"]);
+const ASSEMBLY_PATH_RE = /cordis\.patch\.yml|dsh\.profile\.bundles|profiles[\\/][^\\/]+[\\/]package\.json$/i;
+const ASSEMBLY_CMD_RE = /(?:cordis\.patch\.yml|dsh\.profile\.bundles)/i;
+const ASSEMBLY_WRITE_CMD_RE = /(?:set-content|add-content|out-file|writealltext|copy-item|move-item|rename-item|remove-item|new-item)/i;
+
+/** 判断一次工具调用是否属于 DSH 插件装配变更（规则 27 C 时序的“变更”侧） */
+export function isAssemblyMutationTool(toolName, args) {
+  const name = String(toolName || "");
+  if (ASSEMBLY_TOOLS.has(name)) return true;
+  const p = pathTarget(args);
+  const cmd = commandText(args);
+  if ((name === "edit" || name === "write" || (name === "str_replace_editor" && args?.command !== "view")) && p && ASSEMBLY_PATH_RE.test(p)) return true;
+  if ((name === "pwsh" || name === "bash") && cmd && ASSEMBLY_CMD_RE.test(cmd) && ASSEMBLY_WRITE_CMD_RE.test(cmd)) return true;
+  return false;
+}
+
+/** 判断命令是否为全量挂载审计脚本（规则 27 的“审计”侧）；读取/搜索脚本内容不算执行审计 */
+export function isAuditCommand(command) {
+  if (typeof command !== "string") return false;
+  if (/(?:get-content|cat|type|select-string|findstr|grep|more)\b/i.test(command)) return false;
+  return /\b(?:node|npm|npx|bun|deno)\s+[^\n]*audit-mount-consistency\.mjs/i.test(command);
+}
+
+/** 审计输出是否明确通过（无 DUPLICATES/INCONSISTENT/MISSING 且出现通过标记） */
+export function auditOutputPassed(output) {
+  const text = String(output || "");
+  return /MOUNT CONSISTENT|NO duplicate loader entry ids found/i.test(text) && !/DUPLICATES FOUND/i.test(text) && !/INCONSISTENT/i.test(text) && !/\[MISSING\]/i.test(text);
+}
+
+/** 审计输出是否明确发现重复/缺失/不一致（含 3.6 缺失检测的 INCONSISTENT 与 [MISSING] 标记） */
+export function auditOutputFailed(output) {
+  return /DUPLICATES FOUND|INCONSISTENT|\[MISSING\]/i.test(String(output || ""));
+}
+
+/** 判断是否命中敏感操作（需要授权证据；只读操作永远不算） */
+export function isSensitiveToolCall(toolName, args) {
+  if (isReadOnlyTool(toolName, args)) return false;
+  const name = String(toolName || "");
+  const p = pathTarget(args);
+  const cmd = commandText(args);
+  if (isProtectedConfigPath(p)) {
+    // 只有变更类工具才受配置写保护；read/grep/glob 已在上方放行
+    if (name === "edit" || name === "write" || name === "pwsh" || name === "bash") return true;
+  }
+  if (name === "pwsh" || name === "bash") {
+    if (cmd && (SENSITIVE_CMD.test(cmd) || /(?:AGENTS\.md|settings\.yaml|\.credentials\.yaml|workspace\.json|cordis\.patch\.yml|rule-understanding\.json|rule-engine\.json)/i.test(cmd) || commandHasOutsideWrite(cmd))) return true;
+  }
+  if (name === "edit" || name === "write") {
+    if (p && (isProtectedConfigPath(p) || isOutsideWorkspace(p))) return true;
+  }
+  if (name === "str_replace_editor" && args?.command !== "view") {
+    if (p && (isProtectedConfigPath(p) || isOutsideWorkspace(p))) return true;
+  }
+  if (GENERIC_EXEC_TOOLS.has(name)) return true;
+  return false;
+}

package/lib/core/runtime.js

@@ -0,0 +1,5 @@
+// runtime.js - 规则引擎运行时单例状态。
+// index.js（守卫/事件）与 service.js（设置面板/远程服务）共享同一份 state。
+import { createState } from "./state.js";
+
+export const state = createState();

package/lib/core/silent-error.js

@@ -0,0 +1,44 @@
+// silent-error.js - 命令输出“静默错误”检测（P2）
+// 纯函数，可独立测试。
+const SUSPICIOUS_LINE_RE = /^(false|0|null|undefined|)$/i;
+
+/** 从工具结果中提取纯文本输出（兼容 tool/result 的 message.content[0].content 结构） */
+export function extractToolOutput(result) {
+  if (!result) return "";
+  const msg = result?.message ?? result;
+  const content = Array.isArray(msg?.content)
+    ? msg.content
+    : Array.isArray(result?.content)
+      ? result.content
+      : null;
+  if (!content) return "";
+  const block = content.find((b) => b && b.type === "tool-result");
+  if (!block) return "";
+  const inner = Array.isArray(block.content) ? block.content : [];
+  return inner
+    .filter((b) => b && b.type === "text" && typeof b.text === "string")
+    .map((b) => b.text)
+    .join("\n");
+}
+
+/**
+ * 检测可疑静默错误。
+ * @param {string} output 本次命令输出
+ * @param {string} previousOutput 上一条命令输出
+ * @returns {{suspicious: boolean, reason?: string}}
+ */
+export function detectSilentError(output, previousOutput = "") {
+  const text = String(output || "").trim();
+  if (!text) return { suspicious: false, reason: undefined };
+
+  const lines = text.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
+  if (lines.length <= 3 && lines.every((l) => SUSPICIOUS_LINE_RE.test(l))) {
+    return { suspicious: true, reason: "命令输出全为 false/0/null/undefined 等可疑值" };
+  }
+
+  if (previousOutput && text === String(previousOutput).trim()) {
+    return { suspicious: true, reason: "命令输出与上一条完全一致，疑似静默错误" };
+  }
+
+  return { suspicious: false, reason: undefined };
+}