dsh-sensitive-guard 0.3.2 → 0.3.4

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # 变更记录
 
+## 0.3.4
+
+- 修复句尾语气词被吞进密码：`我的密码是123456吗` 以前会把 `123456吗` 整个当成秘密入库，于是哈希与 `123456` 不同、导出时连语气词一起交出。现在命中值末尾的 `吗呢啊吧呀嘛哦呗啦么哈` 与标点会先剥掉再入库，占位符只盖住秘密本身。
+- 全角标点加入取值排除集：原来只认半角 `,;)`，`123456，对吗` 会一路吃到「对」。
+- 自测 64 → 69 项，新增四种写法共用同一占位符、问号不吞、全角逗号切断。
+
+## 0.3.3
+
+- 修复被换行打断的厂商 key 识别不到：从网页或截图里粘贴时，`sk-proj-…` 常被插进 `\r`、`\n` 或 `\r\n`，而所有单行规则都会在断点处失配。新增 `wrapped-key` 规则，跨行匹配后把值里的空白去掉再入库，因此与完整写法共用同一个占位符。
+- 新增 `debug.pre`（只出现在 `/guard/vault`，未授权来源不返回）：记录 pre-step 每次调用的 payload 字段、消息数、`kind` 与退出阶段，用于确认宿主升级后钩子是否仍然生效。
+- 中文语境的密码下限降到 6 位：`我的密码是 123456` 这类现在会拦（6 位数字密码很常见）。英文和 `key=value` 形式保持 8 位，避免把 `the secret is hidden` 里的 `hidden` 当成密码。
+- 自测 56 → 64 项，覆盖 CRLF、纯 CR、占位符复用、「普通换行不误伤」与中英文阈值差异。
+
 ## 0.3.2
 
 - `exports` 增加 `./package.json`，修掉 `require('dsh-sensitive-guard/package.json')` 报 `ERR_PACKAGE_PATH_NOT_EXPORTED`。

package/README.md

@@ -110,12 +110,14 @@ sensitive_guard_export(<SG_xxx>)   明文写到 0600 文件，返回路径
 
 赋值和环境变量：`password=`、`secret:`、`api_key:`、`SECRET_KEY=`、`DB_PASSWORD=`。
 
-中文说法：`数据库密码是…`、`我的 token 是…`。
+中文说法：`数据库密码是…`、`我的 token 是…`。中文语境的密码从 6 位起就拦（`我的密码是 123456`），因为 6 位数字密码很常见；英文和 `key=value` 形式从 8 位起，否则 `the secret is hidden` 里的 `hidden` 会被当成密码。句尾的语气词（`吗`/`呢`/`吧`）和标点会留在占位符外面，`我的密码是123456吗` 遮的是 `123456`，`吗` 原样保留。
 
 连接串：`mysql://user:pass@host`、`postgresql://…`、JDBC 参数里的 `password=`、`X-Api-Key:`。
 
 命令行：`mysql -uroot -pabc12345`、`redis-cli -a xxx`。只认这几个客户端，`docker run -p 8080:80` 不会被误伤。
 
+被换行打断的 key 也认：从网页、截图或终端里粘贴时，`sk-proj-…` 常被插进 `\r`、`\n` 或 `\r\n`（`\r` 在界面上看着仍是同一行）。这类会按跨行匹配，把两段拼回完整值再入库，占位符与不换行时完全相同。
+
 **可选的熵值检测，默认关闭。** `rules.json` 里加 `"entropy": true` 才会开。它抓的是没有前缀的随机串，但只对 base64 或混合字符集有用（熵约 4.8 到 5.0 bits/char）。纯 hex 串的上限就是 4.0，永远够不到 4.5 的默认阈值，所以 `8f3a9b2c…` 这种开了也抓不到；把阈值降到 3.9 又会误伤英文长句。另外 base64 图片、commit hash、UUID 都会被判成高熵。
 
 抓不到的三类：自研格式的凭据，得自己往 `extraRules` 加正则；二进制和图片里的；被 base64 或 hex 二次编码搬运过的。

package/index.js

@@ -34,13 +34,22 @@ import path from 'node:path';
 const VAULT_ROUTE = '/guard/vault';
 const REVEAL_ROUTE = '/guard/reveal';
 const SETTINGS_ROUTE = '/guard/settings';
-const PLUGIN_VERSION = '0.3.2';
+const PLUGIN_VERSION = '0.3.4';
 
 /** Stable placeholder form: <SG_ + 12 hex chars of sha256(plaintext) + >. */
 const PH_EXACT = /^<SG_[0-9a-f]{12}>$/;
 const PH_HINT = '<SG_';
 const HASH_EXACT = /^[0-9a-f]{12}$/;
 
+/**
+ * Prose rules capture the rest of the token, so a trailing Chinese particle or
+ * punctuation mark rides along: "我的密码是 123456吗" would vault `123456吗` and
+ * hand the particle back on export, with a different hash than the bare secret.
+ * Stripped only by rules that opt in (`trimTail`), and only while something
+ * worth masking is left.
+ */
+const TAIL_JUNK = /(?:[?？!！。.，,;；:：、'"`“”‘’()（）[\]【】《》「」『』]|[吗呢啊吧呀嘛哦呗啦么哈]+)$/u;
+
 /**
  * Vendor prefixes are not the secret — the tail is. Keeping `sk-` / `ghp_` in
  * place keeps the sentence readable and tells you which service leaked, while
@@ -317,6 +326,10 @@ function entryViewForModel(entry) {
 
 const BUILTIN_RULES = [
   { id: 'openai-key', group: 0, re: /\bsk-[A-Za-z0-9_-]{16,}\b/g },
+  // A pasted key whose display soft-wrapped: the prefix and the tail land on
+  // different lines, so every single-line rule misses it. `squash` joins the
+  // halves back into one value before it reaches the vault.
+  { id: 'wrapped-key', group: 1, squash: true, re: /\b((?:sk-|sk_|ghp_|glpat-|npm_|hf_|AKIA|ASIA|AIza|whsec_)[A-Za-z0-9_-]{0,32}[ \t]*(?:\r\n|\r|\n)[ \t]*[A-Za-z0-9_-]{12,})/g },
   { id: 'openai-live', group: 0, re: /\bsk_(?:live|test)_[A-Za-z0-9]{16,}\b/g },
   { id: 'github-token', group: 0, re: /\b(?:gh[pousr]_[A-Za-z0-9]{16,}|github_pat_[A-Za-z0-9_]{20,})\b/g },
   { id: 'gitlab-token', group: 0, re: /\bglpat-[A-Za-z0-9_-]{16,}\b/g },
@@ -336,7 +349,11 @@ const BUILTIN_RULES = [
   // assign-only rule silently missed every sentence-shaped secret. The optional
   // `[A-Za-z_]{0,12}` tail catches env-style names such as SECRET_KEY or
   // DB_PASSWORD_HASH, where `secret` is glued to a suffix by an underscore.
-  { id: 'keyword-prose', group: 2, re: /(password|passwd|pwd|secret|token|api[\s_-]?key|apikey|access[\s_-]?key|client[\s_-]?secret|密码|口令|密钥|令牌|凭证|私钥)[A-Za-z_]{0,12}\s*(?:[:=：]|是|为|就是|is)\s*["'`]?([^\s"'`,;)}\]]{8,})/gi },
+  { id: 'keyword-prose', group: 2, trimTail: true, re: /(password|passwd|pwd|secret|token|api[\s_-]?key|apikey|access[\s_-]?key|client[\s_-]?secret|密码|口令|密钥|令牌|凭证|私钥)[A-Za-z_]{0,12}\s*(?:[:=：]|是|为|就是|is)\s*["'`]?([^\s"'`,;)}\]，。、；：！？（）【】《》「」『』“”‘’…]{8,})/gi },
+  // Chinese prose gets a lower floor: "我的密码是 123456" is a real secret and
+  // six-digit passwords are common. English prose keeps 8 so that sentences like
+  // "the secret is hidden" are not masked on the word "hidden".
+  { id: 'keyword-prose-cn', group: 2, trimTail: true, re: /(密码|口令|密钥|令牌|凭证|私钥)\s*(?:[:=：]|是|为|就是)\s*["'`]?([^\s"'`,;)}\]，。、；：！？（）【】《》「」『』“”‘’…]{6,})/gi },
   // Opaque bearer credentials have no vendor prefix and no `key: value` shape.
   { id: 'bearer-token', group: 1, re: /\bBearer\s+([A-Za-z0-9\-._~+/]{12,}={0,2})/gi },
   // Command-line passwords. Scoped to clients whose `-p` / `-a` really means a
@@ -460,16 +477,30 @@ function findHits(text) {
     let match;
     while ((match = rule.re.exec(scan)) !== null) {
       if (match[0].length === 0) { rule.re.lastIndex += 1; continue; }
-      const value = match[rule.group];
-      if (typeof value !== 'string' || value.length < 6) continue;
+      const raw = match[rule.group];
+      if (typeof raw !== 'string') continue;
+      // A key that got soft-wrapped when pasted carries a line break inside it.
+      // `squash` joins it back so the vault hashes the clean value and the
+      // placeholder stays identical to the unwrapped capture.
+      const value = rule.squash ? raw.replace(/\s+/g, '') : raw;
+      if (value.length < 6) continue;
       if (value.includes(PH_HINT)) continue;
       const range = match.indices && match.indices[rule.group];
-      const offset = range ? range[0] : match.index + match[0].indexOf(value);
-      const end = range ? range[1] : offset + value.length;
+      const offset = range ? range[0] : match.index + match[0].indexOf(raw);
+      let end = range ? range[1] : offset + raw.length;
+      // Trim after the offsets are known, so the placeholder covers only the
+      // secret and the particle stays as readable text.
+      let trimmed = value;
+      if (rule.trimTail) {
+        let prev;
+        do { prev = trimmed; trimmed = trimmed.replace(TAIL_JUNK, ''); } while (trimmed !== prev);
+        if (trimmed.length < 6) continue;
+        end -= value.length - trimmed.length;
+      }
       // The keyword group (when the rule has one) says *what* leaked — password /
       // token / key — which the rule id alone cannot express for keyword-prose.
       const label = rule.group > 1 && typeof match[1] === 'string' ? match[1] : rule.id;
-      hits.push({ offset, end, value, rule: rule.id, label });
+      hits.push({ offset, end, value: trimmed, rule: rule.id, label });
     }
   }
   if (fileRules.entropy) {
@@ -551,16 +582,32 @@ function scrubDeep(value, origin, key) {
 
 /* ----------------------------------------------------------------- hooks -- */
 
+/** Last pre-step invocation, exposed via /guard/vault while diagnosing. */
+const debugPre = { at: 0, stage: 'never', msgs: -1, isArray: false, keys: null, kind: null, changed: false, error: null };
+
 function attachHooks(ctx) {
   // Ingress A: user messages entering the step (before the log commit).
   ctx.on('agent/pre-step', async (payload, next) => {
-    const decision = await next();
+    debugPre.at = Date.now();
+    debugPre.stage = 'entered';
+    debugPre.keys = payload && typeof payload === 'object' ? Object.keys(payload) : null;
+    debugPre.isArray = Boolean(payload && Array.isArray(payload.messages));
+    debugPre.msgs = payload && Array.isArray(payload.messages) ? payload.messages.length : -1;
+    let decision;
+    try {
+      decision = await next();
+      debugPre.kind = decision && decision.kind;
+    } catch (error) {
+      debugPre.stage = 'next-threw';
+      debugPre.error = String((error && error.message) || error);
+      throw error;
+    }
     try {
       // A rejected step never enters the log; rewriting its messages would only
       // corrupt the shape the loop reads back.
-      if (!decision || decision.kind !== 'enter') return decision;
-      if (pausedMs() > 0) return decision;
-      if (!payload || !Array.isArray(payload.messages)) return decision;
+      if (!decision || decision.kind !== 'enter') { debugPre.stage = 'skip:kind'; return decision; }
+      if (pausedMs() > 0) { debugPre.stage = 'skip:paused'; return decision; }
+      if (!payload || !Array.isArray(payload.messages)) { debugPre.stage = 'skip:shape'; return decision; }
       let changed = false;
       const messages = payload.messages.map((message) => {
         if (!message || typeof message !== 'object') return message;
@@ -569,9 +616,13 @@ function attachHooks(ctx) {
         changed = true;
         return { ...message, content };
       });
+      debugPre.changed = changed;
+      debugPre.stage = changed ? 'masked' : 'skip:no-hit';
       if (!changed) return decision;
       return { ...decision, messages };
     } catch (error) {
+      debugPre.stage = 'threw';
+      debugPre.error = String((error && error.message) || error);
       lastError = `pre-step: ${String((error && error.message) || error)}`;
       return decision;
     }
@@ -1063,6 +1114,7 @@ function registerRoutes(ctx) {
           suggested: restricted ? suggestCidr(remoteIp(req)) : null,
           host: String(req.headers.host || ''),
         },
+        debug: restricted ? undefined : { pre: { ...debugPre } },
       });
     },
   }), 'sensitive-guard: vault route');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-sensitive-guard",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "敏感保护：进入模型上下文前把密钥/令牌/密码替换为 <SG_> 占位符，明文加密存本地保管库；设置页与对话内提供小锁点击还原，工具可将明文导出为 0600 文件供命令执行时使用。",
   "license": "MIT",
   "author": "wangxinyu",

package/test.mjs

@@ -369,6 +369,58 @@ await vaultRoute.handler({ method: 'GET', socket: { remoteAddress: '198.51.100.1
 const allowedBody = JSON.parse(allowedPreview.body || '{}');
 check('allowlisted peer still sees preview', allowedBody.restricted === false && allowedBody.entries.some((e) => 'preview' in e), JSON.stringify(allowedBody.entries[0] || {}));
 
+/* --------------------------------------------------- wrapped / soft wrap -- */
+
+console.log('wrapped key');
+
+const runPre = async (text) => {
+  const decision = await pre(
+    { messages: [{ content: text }] },
+    async () => ({ kind: 'enter', messages: [] }),
+  );
+  // Unchanged text comes back as the mock's empty array; treat that as "as-is".
+  return decision.messages.length ? decision.messages[0].content : text;
+};
+
+const cleanOut = await runPre('我的 api key 是 sk-proj-abcdefghijklmnopqrstuvwx');
+const cleanPh = (cleanOut.match(/<SG_[0-9a-f]{12}>/) || [])[0];
+check('完整 key 正常遮挡', Boolean(cleanPh) && cleanOut.startsWith('我的 api key 是 sk-'), cleanOut);
+
+const crlfOut = await runPre('我的 api key 是 sk-\r\nproj-abcdefghijklmnopqrstuvwx');
+check('CRLF 打断的 key 能识别', /sk-<SG_[0-9a-f]{12}>$/.test(crlfOut) && !crlfOut.includes('proj-'), JSON.stringify(crlfOut));
+check('换行版复用同一个占位符', crlfOut.includes(cleanPh), `${crlfOut} vs ${cleanPh}`);
+
+const crOut = await runPre('我的 api key 是 sk-\rproj-abcdefghijklmnopqrstuvwx');
+check('纯 CR 打断的 key 能识别', /sk-<SG_[0-9a-f]{12}>$/.test(crOut), JSON.stringify(crOut));
+
+const proseOut = await runPre('第一行文字\n第二行文字继续');
+check('普通换行不误伤', proseOut === '第一行文字\n第二行文字继续', JSON.stringify(proseOut));
+
+/* ------------------------------------------------ short password floor -- */
+
+console.log('password floor');
+
+const six = await runPre('我的密码是 123456');
+check('中文语境 6 位密码也拦', /我的密码是 <SG_[0-9a-f]{12}>$/.test(six), JSON.stringify(six));
+
+const five = await runPre('我的密码是 12345');
+check('5 位仍不拦', five === '我的密码是 12345', JSON.stringify(five));
+
+const english = await runPre('the secret is hidden');
+check('英文句子里 6 字单词不误伤', english === 'the secret is hidden', JSON.stringify(english));
+
+// A trailing particle must stay outside the placeholder, and all spellings of
+// the same secret must share one hash — otherwise export hands back "123456吗".
+const withSpace = await runPre('我的密码是 123456 吗?');
+const noSpace = await runPre('我的密码是123456吗');
+const fullComma = await runPre('我的密码是123456，对吗');
+const bare = await runPre('密码是 123456 吗');
+check('语气词留在占位符外（有空格）', withSpace === '我的密码是 <SG_8d969eef6eca> 吗?', withSpace);
+check('语气词留在占位符外（无空格）', noSpace === '我的密码是<SG_8d969eef6eca>吗', noSpace);
+check('全角逗号切断取值', fullComma === '我的密码是<SG_8d969eef6eca>，对吗', fullComma);
+check('四种写法共用同一占位符', new Set([withSpace, noSpace, fullComma, bare].map((s) => (s.match(/<SG_[0-9a-f]{12}>/) || [''])[0])).size === 1);
+check('句尾问号不被吞进密码', (await runPre('我的密码是 abcdef?')).endsWith('<SG_') === false);
+
 /* --------------------------------------------------------------------- */
 
 fs.rmSync(TEMP_HOME, { recursive: true, force: true });