dsh-tool-folder 0.1.1 → 0.1.3

package/cordis.patch.yml

@@ -16,13 +16,21 @@
         # Tools always kept in full (schema) for every agent. These are the
         # platform essentials; everything else is folded and BM25-loaded.
         core:
-          - tool-bash
-          - tool-pwsh
+          - read
+          - write
+          - edit
+          - glob
+          - grep
+          - pwsh
+          - web_search
+          - skill
+          - ask_user_question
+          - subagent
         # Per-agent overrides. agent ids come from context.agent.id; agents
         # not listed here fall back to `core`. Example:
         #   perAgent:
         #     standard:
-        #       core: [tool-bash, tool-pwsh, mcp__viking__remember]
+        #       core: [read, write, edit, mcp__viking__remember]
         perAgent: {}
         # BM25 dynamic segment size per request.
         topK: 6

package/lib/chainguard.js

@@ -0,0 +1,89 @@
+// ChainGuard — session-level tool-call firewall (ported from xiaowan tool_firewall T3).
+//
+// Two layers:
+//  1. ChainGuard.check()  — high-risk command verdict (AEGIS-style hard block list).
+//  2. ChainGuard.record() — session window of tool calls; ChainGuard.checkChain()
+//     detects "sensitive read → external exfil" chains (Invariant-style: a single
+//     call is harmless, the SEQUENCE is the attack).
+//
+// Zero dependencies, pure regex + window buffer. Runs in the cordis plugin sandbox.
+
+const HIGH_RISK_PATTERNS = [
+  // destructive filesystem
+  [/rm\s+-rf\s+[\\/]?[A-Za-z]:[\\/]|rm\s+-rf\s+\/|rm\s+-rf\s+[*?]/i, "recursive root delete"],
+  [/format\s+[A-Za-z]:|format\s+\/q/i, "disk format"],
+  [/del\s+\/f\s+\/s\s+\/q/i, "force recursive delete"],
+  // download → execute chain
+  [/(wget|curl|powershell|pwsh).{0,80}(\||;|&&).{0,30}(sh|bash|powershell|pwsh|cmd|start)\b/i, "download-pipe-execute"],
+  [/invoke-expression|iex\s*\(|iwr\s+.*\|.*iex/i, "powershell download-exec"],
+  // credential / exfil
+  [/(net\s+user|whoami\s+\/all|reg\s+query\s+HKLM\\SAM)/i, "credential harvest"],
+  [/copy\s+.*\\system32\\config|type\s+.*\\(ntuser\.dat|SAM|SYSTEM)/i, "system file exfil"],
+  // shadow / persistence
+  [/schtasks\s+\/create|reg\s+add\s+.*\\run/i, "persistence install"],
+];
+
+// Tools that READ sensitive local state (file system, memory, secrets).
+const SENSITIVE_READ = new Set([
+  "read", "glob", "grep", "edit",
+  "mcp__viking__find", "mcp__viking__glob", "mcp__viking__read",
+  "ssh_download", "ssh_list", "job_output", "describe_image", "read_image",
+]);
+
+// Tools that SEND data to an external surface (network, memory writes, uploads).
+const EXTERNAL_SEND = new Set([
+  "mcp__viking__remember", "mcp__viking__add_resource", "mcp__viking__forget",
+  "ssh_upload", "send_message", "web_search",
+  "mcp__openhands__openhands_create_conversation",
+]);
+
+export function verdict(argvText) {
+  if (!argvText) return null;
+  for (const [re, label] of HIGH_RISK_PATTERNS) {
+    if (re.test(argvText)) {
+      return { blocked: true, label, pattern: String(re) };
+    }
+  }
+  return { blocked: false };
+}
+
+export class ChainGuard {
+  constructor({ window = 30 } = {}) {
+    this.window = window;
+    this.history = []; // [{tool, argv, ts}]
+  }
+
+  record(tool, argv = "") {
+    this.history.push({ tool, argv: String(argv || "").slice(0, 300), ts: Date.now() });
+    if (this.history.length > this.window) {
+      this.history.splice(0, this.history.length - this.window);
+    }
+  }
+
+  // Sensitive read followed within 3 steps by an external send → exfil chain.
+  checkChain() {
+    if (this.history.length < 2) return null;
+    for (let i = 0; i < this.history.length; i++) {
+      const h = this.history[i];
+      if (!SENSITIVE_READ.has(h.tool)) continue;
+      const lookahead = this.history.slice(i + 1, i + 4);
+      for (let j = 0; j < lookahead.length; j++) {
+        if (EXTERNAL_SEND.has(lookahead[j].tool)) {
+          return {
+            risk: "high",
+            label: "sensitive-read → external-send chain",
+            chain: [
+              `${h.tool}:${String(h.argv).slice(0, 60)}`,
+              ...lookahead.slice(0, j + 1).map((x) => `${x.tool}:${String(x.argv).slice(0, 60)}`),
+            ],
+          };
+        }
+      }
+    }
+    return null;
+  }
+
+  reset() {
+    this.history = [];
+  }
+}

package/lib/index.js

@@ -24,6 +24,7 @@
 import { buildIndex, search } from "./bm25.js";
 import { compressTool } from "./schema.js";
 import { selectionCoverage } from "./metrics.js";
+import { ChainGuard, verdict } from "./chainguard.js";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 
 export const name = "tool-folder";
@@ -38,6 +39,7 @@ const DEFAULTS = {
   catalogEnabled: false,
   compressEnabled: false,
   toolSearchEnabled: true,
+  firewallEnabled: true, // ChainGuard: high-risk hard block + exfil chain warn
   maxFoldMs: 50,
   feedbackFile: "",
   aliases: {
@@ -129,6 +131,7 @@ export function apply(ctx, config) {
   let allTools = [];
   let lastVisible = { agentId: "", names: [], ts: 0 };
   const disposers = [];
+  const chain = new ChainGuard({ window: 30 }); // firewall: exfil-chain + high-risk
 
   const serverOf = (name) => name.split("__")[0];
 
@@ -307,6 +310,23 @@ export function apply(ctx, config) {
           changed = true;
         }
 
+        // Firewall: record the call sequence and flag exfil chains.
+        if (cfg.firewallEnabled !== false) {
+          for (const n of names) chain.record(n);
+          const exfil = chain.checkChain();
+          if (exfil) {
+            logger.warn(
+              "[firewall] %s: %s",
+              exfil.label, exfil.chain.join(" → "),
+            );
+            feedback.firewall = feedback.firewall || [];
+            feedback.firewall.push({ ts: Date.now(), ...exfil });
+            if (feedback.firewall.length > 20) {
+              feedback.firewall.splice(0, feedback.firewall.length - 20);
+            }
+          }
+        }
+
         // Folded-call detection: did the model call something we hid?
         const cov = selectionCoverage(lastVisible.names, names);
         if (cov.uncovered.length > 0) {
@@ -335,6 +355,30 @@ export function apply(ctx, config) {
     }),
   );
 
+  // Firewall hard-block: deny high-risk command patterns before execution.
+  if (cfg.firewallEnabled !== false) {
+    disposers.push(
+      ctx.on("tools/pre-execute", (payload, next) => {
+        try {
+          const toolName = payload?.toolName;
+          const argv = payload?.argv;
+          const argvText = Array.isArray(argv) ? argv.join(" ") : String(argv || "");
+          const v = verdict(argvText);
+          if (v?.blocked && typeof payload?.deny === "function") {
+            logger.warn("[firewall] BLOCKED %s: %s", toolName, v.label);
+            payload.deny(
+              `[tool-folder firewall] 高危命令已拦截（${v.label}）。如需执行请人工确认。`,
+            );
+            return; // deny() aborts this execution
+          }
+        } catch (e) {
+          logger.warn("firewall hook error (%s) — best-effort", e?.message);
+        }
+        return next?.();
+      }),
+    );
+  }
+
   // Cleanup on plugin unload: no leaked listeners.
   return () => {
     for (const d of disposers) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-tool-folder",
-  "version": "0.1.1",
-  "description": "Fold the DSH tool surface per request: per-agent core + BM25 dynamic loading + heat feedback. Shrinks schema tokens 80-90% while keeping selection accuracy.",
+  "version": "0.1.3",
+  "description": "Fold the DSH tool surface per request + ChainGuard firewall (high-risk block + exfil-chain detection). Shrinks schema tokens 80-90% while keeping selection accuracy.",
   "keywords": [
     "dsh-plugin",
     "dsh",