dsh-rule-engine 0.5.16 → 0.6.0

package/lib/index.js

@@ -1,7 +1,7 @@
 // dsh-rule-engine —— DSH 规则执行引擎 v3（host 插件，纯 Node）
 // 容器：解析 AGENTS.md → 理解器 → 匹配机 → 执行框架。
 // 执行框架：ctx.tools.guard() 硬拦 + session/event 文本纠察 + 审计台账 + /guard 命令。
-import { readFileSync, watch, writeFileSync } from "node:fs";
+import { readFileSync, watch, writeFileSync, existsSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { audit, readAuditLog } from "./core/audit.js";
 import { loadPluginConfig } from "./core/config.js";
@@ -61,6 +61,7 @@ import {
 import { toolClass } from "./core/tool-catalog.js";
 import { parseWhitelist, mergeWhitelist, serializeWhitelist } from "./core/whitelist.js";
 import { state } from "./core/runtime.js";
+import { APPROVE_TYPES, normalizePath, setTypeHints } from "./core/authorization.js";
 import { DELIVERY_RE, detectViolations, extractAssistantText } from "./core/text-detect.js";
 import { buildTurnCard } from "./core/turn-card.js";
 import { shouldDetectTurn, shouldDeliver } from "./core/semantic.js";
@@ -101,6 +102,8 @@ export const name = "dsh-rule-engine";
 export const inject = ["tools", "commands", "agents", "workspaceRegistry", "skills", "llm"];
 
 const pluginConfig = loadPluginConfig();
+// C4：启动时合并配置层 typeHints（本机扩展授权类型；默认空=仅内置 8+archive 类）
+setTypeHints(pluginConfig.typeHints);
 state.enabled = pluginConfig.enabled;
 applyTaskContractConfig(state, pluginConfig);
 // T3 通用化（2026-08-31）：声明式绑定覆盖表注入（rule-engine.json 可选键 handlerOverrides；缺省 {}）
@@ -108,6 +111,44 @@ state.handlerOverrides = pluginConfig?.handlerOverrides || {};
 // 残余1 剥离（2026-08-31）：本机默认偏好表注入（rule-engine.json 可选键 handlerDefaultMap；
 // 通用部署=空表——代码零本机编号，本机偏好不随包走、升级不丢）
 state.handlerDefaultMap = pluginConfig?.handlerDefaultMap || {};
+// P2（2026-09-04）：本机集成参数化层（localIntegrations）——默认空=通用行为不变；
+// 本机专属约定（统一入口脚本名/M8 双通道/手册路径豁免扩展）由配置注入，代码零本机字面量
+state.localIntegrations = pluginConfig?.localIntegrations || {};
+// A-8（0.6.0，启动自检硬验收）：localIntegrations 存在但 entryScript 指向的脚本文件在磁盘不存在
+// → 启动即审计告警（失败不阻断加载，但留下可观测证据——无声守卫消失风险的对策）
+// 0.6.0 修正：裸文件名（无路径段）视为脚本名——可能在工作区/全局 PATH，
+// 不告警（防误报）；仅当 entryScript 含明确路径段（\ / 盘符）且文件不存在时才告警。
+{
+  const li = state.localIntegrations;
+  const script = li?.entryScript;
+  const isBareName = typeof script === "string" && /^[A-Za-z0-9._-]+$/.test(script.replace(/\\/g, "/"));
+  if (typeof script === "string" && script && !isBareName) {
+    let found = false;
+    try { found = existsSync(script); } catch { found = false; }
+    if (!found) {
+      audit({
+        kind: "entry-script-missing",
+        rule: "__entry-script-missing",
+        name: "启动自检：统一入口脚本不存在",
+        event: "startup",
+        reason: `localIntegrations.entryScript 指向的脚本（${script}）在磁盘不存在——本机守卫仍按配置工作，但入口通道可能失效；请检查配置或部署该脚本`,
+        session: "global"
+      });
+    }
+  }
+}
+// li-skipped（0.6.0 A2-2 补充）：无 localIntegrations.entryScript → 启动登记一次 skipped 审计
+// （验证"默认无"留痕；登录于启动/配置加载时，而非每次工具调用——修正此前写类分支被 12A 前置拦截的缺陷）
+if (!state.localIntegrations?.entryScript) {
+  audit({
+    kind: "li-skipped",
+    rule: "19",
+    name: "本地集成未配置（守卫无对象）",
+    event: "startup",
+    reason: "skipped: no localIntegrations.entryScript——该守卫在此环境不存在（0.6.0 默认无）",
+    session: "global"
+  });
+}
 // reloadRules 内部已统一刷新理解产物（P0-3），此处不再重复写
 reloadRules(state);
 
@@ -327,7 +368,8 @@ async function deliverSuspects(ctx, sessionId, suspects, text) {
           name: "违规裁决",
           event: "assistant/message",
           reason: `${verdict.action}：${verdict.note || ""}${verdict.model ? `（model=${verdict.model}）` : ""}`,
-          session: sessionId
+          session: sessionId,
+          verdictSource: "judge"
         });
         return verdict.action === "deliver" ? v : null;
       } catch (error) {
@@ -433,15 +475,18 @@ export function handleSessionEvent(ctx, session, event) {
     return;
   }
   if (event.type === "turn/end") {
-    // M8 双通道机制：本回合用 dsh-manual-write 落盘手册/AGENTS 后，必须同轮 engram_store 沉淀记忆；
+    // M8 双通道机制：本回合用统一入口落盘手册/AGENTS 后，必须同轮 engram_store 沉淀记忆；
     // 缺失 → 审计 + 注入纠正（用户明确要求机制化，2026-08-24）
-    if (s.turn.manualWriteSeen && !s.turn.engramStoreSeen) {
+    // A3-1（0.6.0）：默认关闭 → 显式 enabled:true + 配置 entryMarker 才生效（无配置 = M8 机制整体不存在）
+    const m8Cfg = state.localIntegrations?.m8 || {};
+    const m8Marker = m8Cfg.entryMarker;
+    if (m8Cfg.enabled === true && m8Marker && s.turn.manualWriteSeen && !s.turn.engramStoreSeen) {
       audit({
         kind: "engram-gap",
         rule: "__engram-gap",
         name: "双通道记忆缺失",
         event: "turn/end",
-        reason: "本回合 dsh-manual-write 落盘了手册/AGENTS，但未同轮调用 engram_store；按规则 19/77/M8 应在同一回合完成记忆沉淀",
+        reason: "本回合经本机配置的统一入口落盘了手册/AGENTS，但未同轮调用 engram_store；按规则 19/77/M8 应在同一回合完成记忆沉淀",
         session: sid
       });
       maybeInject(ctx, sid, {
@@ -658,7 +703,7 @@ export function handleSessionEvent(ctx, session, event) {
         pendingCall.backupPaths.push(bpTool);
       }
     }
-    if (isManualReadTool(toolName, args)) s.manualReadSeen = true;
+    if (isManualReadTool(toolName, args, state.localIntegrations?.manualExempt?.paths || [])) s.manualReadSeen = true;
     // 规则 5/31 扩展（2026-09-01）：查询类工具调用记下回合号（"近 3 回合有据"判定）
     if (isReadOnlyTool(toolName, args)) s.lastQueryTurn = s.turn.number;
     if (toolName === "skill" && args?.name) s.turn.skillNames.push(args.name);
@@ -771,10 +816,13 @@ export function handleSessionEvent(ctx, session, event) {
       }
     }
 
-    // M8 双通道机制（2026-08-24）：dsh-manual-write 落盘成功 → 标记；同轮 engram_store 成功 → 标记
+    // M8 双通道机制（2026-08-24）：统一入口落盘成功 → 标记；同轮 engram_store 成功 → 标记
+    // A3-1（0.6.0）：默认关闭 → 显式 enabled:true + 配置 entryMarker 才生效（无配置 = M8 机制整体不存在）
     if (!isError && pendingCall) {
       const cmd = pendingCall.args?.command || pendingCall.args?.code || "";
-      if ((pendingCall.name === "pwsh" || pendingCall.name === "bash") && /\bdsh-manual-write\.mjs/.test(cmd)) {
+      const m8Cfg2 = state.localIntegrations?.m8 || {};
+      const marker = m8Cfg2.entryMarker;
+      if (m8Cfg2.enabled === true && marker && (pendingCall.name === "pwsh" || pendingCall.name === "bash") && cmd.includes(marker)) {
         s.turn.manualWriteSeen = true;
       }
       if (pendingCall.name === "engram_store") {
@@ -1035,7 +1083,7 @@ export function handleSessionEvent(ctx, session, event) {
           rule: "23",
           name: "交付声明缺验证闸门记录",
           event: "assistant/message",
-          reason: "交付/完成类声明缺少同会话近期 verify-pass（ALL TESTS PASSED / check-plugin-load RESULT: PASS）记录",
+          reason: "交付/完成类声明缺少同会话近期 verify-pass（测试全绿或冷加载探针 RESULT: PASS）记录",
           session: sid
         });
         // v0.5.7 后续（用户拍板"暗示型统一裁决"）：23④ 词面命中只是嫌疑——"完成"≠交付声明
@@ -1080,7 +1128,7 @@ export function handleSessionEvent(ctx, session, event) {
       }
     }
     // F1（2026-08-28 阶段三）：规则 2 违规不在此时投递——标记 pendingRule2，turn/end 复核（Get-Date 定案）①
-    let violations = detectViolations({ configs: state.configs, session: s, text, reasoningText: s.turn.reasoningText, mountRevision: state.mountRevision });
+    let violations = detectViolations({ configs: state.configs, session: s, text, reasoningText: s.turn.reasoningText, mountRevision: state.mountRevision, rule5Window: pluginConfig.rule5SourceWindow ?? 3 });
     const rule2s = violations.filter((v) => v.ruleId === "2");
     for (const v of rule2s) {
       if (!s.turn.pendingRule2) s.turn.pendingRule2 = v.reason;
@@ -1093,7 +1141,9 @@ export function handleSessionEvent(ctx, session, event) {
         name: v.title,
         event: "assistant/message",
         reason: v.reason,
-        session: sid
+        session: sid,
+        // B2（2026-09-03）：判定来源可溯源（判例回灌前置：区分词表直判与 LLM 裁决分流）
+        verdictSource: v.awaitingJudge ? "judge" : "lexicon"
       });
     }
     // v0.5.7 分流水线：B 级机器型（correct，词表=确定证据）立即投递；
@@ -1145,7 +1195,8 @@ const COMMAND_SPECS = [
   { name: "budget", args: "...", desc: "设置预算（agents=N files=... deps=allow hash=allow）" },
   { name: "contract", args: "", desc: "查看当前任务契约" },
   { name: "contract categories", args: "...", desc: "设定契约类别白名单（0.5.12）" },
-  { name: "label", args: "<id> <label>", desc: "给审计记录打标（correct/incorrect/inconclusive）" }
+  { name: "label", args: "<id> <label>", desc: "给审计记录打标（correct/incorrect/inconclusive）" },
+  { name: "approve", args: "<type> <路径> [min]", desc: "物理确认：授予指定类型+路径的临时授权（仅用户输入；默认 10 分钟）" }
 ];
 
 const USAGE = [
@@ -1201,6 +1252,17 @@ function parseCommand(rawInput) {
   if (m) return { kind: "label", eventId: m[1], label: m[2].toLowerCase() };
   m = text.match(/^label\s+clear\s+(.+)$/i);
   if (m) return { kind: "label-clear", fingerprint: m[1].trim() };
+  // C4：/guard approve <type> <路径> [min]——物理确认（类型在 executeGuard 校验枚举）
+  m = text.match(/^approve\s+([A-Za-z_][A-Za-z0-9_-]*)\s*("(?:[^"]*)"|'(?:[^']*)'|\S+)(?:\s+(\d+))?$/i);
+  if (m) {
+    const p = m[2];
+    return {
+      kind: "approve",
+      type: m[1].toLowerCase(),
+      path: p.replace(/^["']|["']$/g, ""),
+      minutes: m[3] ? Number(m[3]) : 10
+    };
+  }
   return { kind: "invalid" };
 }
 
@@ -1278,6 +1340,30 @@ async function executeGuard(ctx, invocation) {
         text: `已临时放行全部守卫 ${minutes} 分钟。到期自动恢复，也可 /guard reload 后立即恢复。`
       };
     }
+    case "approve": {
+      // C4（2026-09-03）物理确认：用户亲手输入=词表无法误读；最小范围（类型+路径+时长）；无全局通配
+      if (!loadPluginConfig().approveEnabled) {
+        return { kind: "error", text: "/guard approve 未开启：请在 rule-engine.json 设 approveEnabled=true（设置页开关随后续版本）后使用" };
+      }
+      if (!APPROVE_TYPES().includes(command.type)) {
+        return { kind: "error", text: `不支持的类型 ${command.type}（可用：${APPROVE_TYPES().join("/")}；any=全局通配被禁止——物理确认必须最小范围）` };
+      }
+      if (!command.path) return { kind: "error", text: "路径缺失：/guard approve <type> <路径> [min]（建议路径用双引号包裹，如 /guard approve write \"D:\\...\\file.json\" 10）" };
+      const minutes = Math.min(Math.max(1, command.minutes), 720);
+      const pfx = normalizePath(command.path);
+      const sid = sessionIdOfInvocation(invocation);
+      recordAuthorization(state, sid, {
+        type: command.type,
+        pathPrefix: pfx,
+        source: "physical-confirm",
+        expiresAt: Date.now() + minutes * 60000
+      });
+      audit({ kind: "guard-command", rule: "__physical-confirm", name: "物理确认授权", event: "command", reason: `/guard approve ${command.type} ${pfx} ${minutes}m`, session: sid });
+      return {
+        kind: "success",
+        text: `已物理确认授权：${command.type}｜${pfx}｜${minutes} 分钟。仅该类型+该路径（含子路径）生效；/guard revoke 可立即撤销；到期自动失效。`
+      };
+    }
     case "lock": {
       state.unlockUntil = 0;
       state.bypassUntil = 0;
@@ -1551,7 +1637,10 @@ export function apply(ctx) {
         //（调整/补充/评估/建议且无落盘词）→ approval-gap 审计 + 注入提醒（规则 22 自证③：方案性指令 ≠ 落盘授权）
         {
           const cmd = exec?.arguments?.command || exec?.arguments?.code || "";
-          if ((exec?.name === "pwsh" || exec?.name === "bash") && /\bdsh-manual-write\.mjs/.test(cmd)) {
+          const entryScript = state.localIntegrations?.entryScript;
+          // A3-2（0.6.0）：入口脚本名从配置读取并转义；无配置不走本分支。
+          // 边界裁决（v1.3 关键裁决 4）：正则保持无尾部 \b（保守匹配，xxx.mjs.bak 等变体同样命中）。
+          if ((exec?.name === "pwsh" || exec?.name === "bash") && entryScript && new RegExp(`\\b${entryScript.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`).test(cmd)) {
             const s7 = getSessionState(state, sessionIdOfExec(exec));
             if (needsApprovalReminder(s7.turn.userText || "")) {
               audit({

package/lib/service.js

@@ -204,7 +204,8 @@ class RuleEngineService extends TypertRemoteService {
           askEnabled: conf.askEnabled === true,
           taskContractMode: conf.taskContractMode === "armed" ? "armed" : "observe",
           taskContractDefaults: conf.taskContractDefaults || {},
-          turnCard: { enabled: conf.turnCard?.enabled === true }
+          turnCard: { enabled: conf.turnCard?.enabled === true },
+          approveEnabled: conf.approveEnabled === true
         }
       };
     } catch (error) {
@@ -215,6 +216,7 @@ class RuleEngineService extends TypertRemoteService {
   /** 保存任务契约配置（设置页；写入 rule-engine.json 并热同步 state） */
   async setTaskContractConfig(partial) {
     try {
+      audit({ kind: "guard-command", rule: "__settings-save", name: "设置页保存", event: "command", reason: `setTaskContractConfig keys=${JSON.stringify(Object.keys(partial || {}))}`, session: "global" });
       const conf = savePluginConfig(partial || {});
       applyTaskContractConfig(state, conf);
       return {
@@ -224,7 +226,8 @@ class RuleEngineService extends TypertRemoteService {
           askEnabled: conf.askEnabled === true,
           taskContractMode: conf.taskContractMode === "armed" ? "armed" : "observe",
           taskContractDefaults: conf.taskContractDefaults || {},
-          turnCard: { enabled: conf.turnCard?.enabled === true }
+          turnCard: { enabled: conf.turnCard?.enabled === true },
+          approveEnabled: conf.approveEnabled === true
         }
       };
     } catch (error) {

package/package.json

@@ -1,58 +1,60 @@
-{
-  "name": "dsh-rule-engine",
-  "version": "0.5.16",
-  "description": "DSH 规则执行引擎 v3：容器解析 AGENTS.md + 理解器 + 匹配机 + 执行框架",
-  "type": "module",
-  "main": "lib/index.js",
-  "exports": {
-    ".": "./lib/index.js",
-    "./lib/service.js": "./lib/service.js",
-    "./package.json": "./package.json"
-  },
-  "files": [
-    "lib",
-    "scripts",
-    "upgrade-impact.json",
-    "cordis.patch.yml",
-    "README.md",
-    "LICENSE"
-  ],
-  "keywords": [
-    "deepseek-harness",
-    "dsh",
-    "dsh-plugin",
-    "cordis",
-    "rules",
-    "guard",
-    "security",
-    "agent"
-  ],
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/jilian-dsh/dsh-rule-engine.git"
-  },
-  "homepage": "https://github.com/jilian-dsh/dsh-rule-engine",
-  "engines": {
-    "node": ">=22"
-  },
-  "dshCompat": {
-    "min": "0.1.0-rc.3",
-    "max": "0.2.0"
-  },
-  "scripts": {
-    "test": "node test/run-all.mjs",
-    "check": "node --check lib/index.js",
-    "verify": "node scripts/verify-all.mjs",
-    "audit:mount": "node scripts/audit-mount-consistency.mjs --profile web"
-  },
-  "peerDependencies": {
-    "@deepseek-ai/dsh-home-paths": ">=0.1.0-rc.3 <0.2.0 || >=0.1.1-rc.0 <0.2.0",
-    "@deepseek-ai/dsh-typert-protocol": ">=0.1.0-rc.3 <0.2.0 || >=0.1.1-rc.0 <0.2.0"
-  },
-  "dsh": {
-    "bundle": {
-      "patch": "./cordis.patch.yml"
-    }
-  }
-}
+{
+  "name": "dsh-rule-engine",
+  "version": "0.6.0",
+  "description": "DSH 规则执行引擎 v3：容器解析 AGENTS.md + 理解器 + 匹配机 + 执行框架",
+  "type": "module",
+  "main": "lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./lib/service.js": "./lib/service.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "scripts",
+    "!scripts/local-residue-markers.txt",
+    "upgrade-impact.json",
+    "cordis.patch.yml",
+    "README.md",
+    "LICENSE"
+  ],
+  "keywords": [
+    "deepseek-harness",
+    "dsh",
+    "dsh-plugin",
+    "cordis",
+    "rules",
+    "guard",
+    "security",
+    "agent"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/jilian-dsh/dsh-rule-engine.git"
+  },
+  "homepage": "https://github.com/jilian-dsh/dsh-rule-engine",
+  "engines": {
+    "node": ">=22"
+  },
+  "dshCompat": {
+    "min": "0.1.0-rc.3",
+    "max": "0.2.0"
+  },
+  "scripts": {
+    "test": "node test/run-all.mjs",
+    "check": "node --check lib/index.js",
+    "verify": "node scripts/verify-all.mjs",
+    "audit:mount": "node scripts/audit-mount-consistency.mjs --profile web",
+    "check:meta": "node scripts/readme-version-check.mjs && node scripts/local-residue-scan.mjs"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/dsh-home-paths": ">=0.1.0-rc.3 <0.2.0 || >=0.1.1-rc.0 <0.2.0",
+    "@deepseek-ai/dsh-typert-protocol": ">=0.1.0-rc.3 <0.2.0 || >=0.1.1-rc.0 <0.2.0"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  }
+}