pi-information-protecter 0.3.0 → 0.4.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +20 -0
- package/README.md +52 -2
- package/SECURITY.md +6 -0
- package/dist/index.mjs +7 -7
- package/dist/scan-worker.mjs +1 -1
- package/dist/validate-worker.mjs +1 -1
- package/docs/MIGRATION.md +4 -0
- package/package.json +1 -1
- package/protecter.example.json +2 -0
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,25 @@
|
|
|
1
1
|
# Changelog / 更新日志
|
|
2
2
|
|
|
3
|
+
## 0.4.1 — Safe audit clearing / 安全审计清理
|
|
4
|
+
|
|
5
|
+
- Add `/protecter logs clear`, restricted to local TUI with explicit confirmation and idle waiting; cancellation and non-TUI modes never clear records.
|
|
6
|
+
新增本地 TUI 确认及空闲等待的日志清理命令，取消或非 TUI 模式不清理。
|
|
7
|
+
- Serialize clearing with scans and the existing cross-process append lock; truncate and fsync the validated current log without deleting configuration, other logs or in-memory mappings.
|
|
8
|
+
清理与扫描及现有跨进程写锁协调，对验证后的当前日志截断并同步，不删除配置、其他日志或内存映射。
|
|
9
|
+
- Cover missing/full/partial logs, unsafe links, occupied locks, resumed writes and source/packed command execution in regression tests.
|
|
10
|
+
回归覆盖缺失、满容量、残缺日志、不安全链接、占用锁、恢复写入及源码和实际发布包命令执行。
|
|
11
|
+
|
|
12
|
+
## 0.4.0 — Fixed replacement aliases / 固定替换别名
|
|
13
|
+
|
|
14
|
+
- Add optional literal `replacement` strings to literal and regex rules; omitted targets retain stable per-instance random placeholders.
|
|
15
|
+
字面与正则规则支持可选固定 `replacement` 字符串，省略时保持实例内稳定随机占位符。
|
|
16
|
+
- Restore fixed aliases locally in responses and tool arguments, and record the actual target in private audit logs, including JSON-escaped values.
|
|
17
|
+
在本地响应和工具参数中还原固定别名，审计记录实际替换目标，支持 JSON 转义值。
|
|
18
|
+
- Reject invalid or sensitive targets, conflicting definitions, ambiguous inverse mappings and partial overlaps involving fixed rules; preserve targets during safe migration.
|
|
19
|
+
拒绝非法或含敏感值的目标、冲突定义、歧义反向映射及固定规则部分重叠，安全迁移保留目标。
|
|
20
|
+
- Add fixed/random coexistence, multi-turn consistency and packed-distribution regressions; document reserved-alias and prompt-cache boundaries.
|
|
21
|
+
增加固定与随机共存、多轮一致性和实际发布包回归，说明保留别名及提示词缓存边界。
|
|
22
|
+
|
|
3
23
|
## 0.3.0 — Private redaction audit / 私有脱敏审计
|
|
4
24
|
|
|
5
25
|
- Persist successful distinct original/token pairs per request in `protecter.<machineHash>.jsonl`, with local timestamp, UTC offset, provider ID and request ID. This intentionally adds plaintext sensitive data on disk; records represent local redaction, not confirmed network delivery.
|
package/README.md
CHANGED
|
@@ -14,7 +14,7 @@ Requires Node.js 22+ and `@earendil-works/pi-coding-agent` **0.85.1–0.85.x**,
|
|
|
14
14
|
|
|
15
15
|
```bash
|
|
16
16
|
# Install the pinned npm release.
|
|
17
|
-
pi install npm:pi-information-protecter@0.
|
|
17
|
+
pi install npm:pi-information-protecter@0.4.1
|
|
18
18
|
|
|
19
19
|
# Alternatively, build and install from this repository without copying it.
|
|
20
20
|
npm ci
|
|
@@ -63,6 +63,29 @@ More examples are in [`protecter.example.json`](protecter.example.json); they ar
|
|
|
63
63
|
- `/protecter` opens the local audit viewer; `/protecter logs 50` shows up to 50 recent records. `/protecter status` reports memory counts without reading configuration. `/protecter reload` invokes Pi's full reload after idle. Do not enter secrets as command arguments.
|
|
64
64
|
- Limits: 1000 rules, 8192 characters per literal/pattern, 2-second scan timeout and 8 MiB request JSON. Exceeding limits rejects the request rather than sending plaintext.
|
|
65
65
|
|
|
66
|
+
### Fixed replacement values
|
|
67
|
+
|
|
68
|
+
Object rules accept an optional `replacement`. Omit it for the existing random behavior; strings still always use random placeholders. Empty, whitespace-only, non-string or over-8192-character targets are invalid (not a random fallback).
|
|
69
|
+
|
|
70
|
+
```json
|
|
71
|
+
{
|
|
72
|
+
"version": 1,
|
|
73
|
+
"sensitiveWords": [
|
|
74
|
+
{ "type": "literal", "value": "Apple Inc.", "replacement": "Alphabet Inc." },
|
|
75
|
+
{ "type": "literal", "value": "example-private-key-123", "replacement": "MyPrivateKey" },
|
|
76
|
+
{ "type": "literal", "value": "randomly-protected-value" }
|
|
77
|
+
]
|
|
78
|
+
}
|
|
79
|
+
```
|
|
80
|
+
|
|
81
|
+
Targets are literal text, not replacement templates: `$1` and `$&` are not expanded. Both literal and regex object rules support this field. Fixed aliases appear in audit records and are restored locally in replies and tool arguments after a successful scan. They are **reserved aliases**: naturally occurring identical response text will also be restored; choose distinctive targets and avoid ordinary words when that ambiguity matters. Fixed aliases expose more semantic information than random tokens.
|
|
82
|
+
|
|
83
|
+
For reversible protection, duplicate targets across different rules, substring-overlapping targets, targets containing configured sensitive values, reserved `__PIP_` names and conflicting definitions are rejected. A fixed regex can represent only one distinct matched original per instance; a second distinct original rejects the request. Partially overlapping matches involving fixed rules also reject rather than silently choose a rule or expose a suffix. Pure random-rule overlaps still merge. Migration preserves targets and refuses conflicting merges without deleting originals. Reload after editing; older plugin versions do not support this field.
|
|
84
|
+
|
|
85
|
+
### Multi-turn consistency and prompt caching
|
|
86
|
+
|
|
87
|
+
Random placeholders are generated once per exact original and reused within the same extension instance, including after local response restoration. Starting another scan worker does not reset the mapping. This supports stable prompt prefixes but does not guarantee provider KV-cache hits; model, tools, message ordering, cache lifetime and routing also matter. `/reload`, process restart and session-instance replacement clear mappings. Different processes do not share mappings, and audit timestamps/request IDs are never included in the model payload.
|
|
88
|
+
|
|
66
89
|
## Private audit log
|
|
67
90
|
|
|
68
91
|
Successful request-body redactions append to `protecter.<machineHash>.jsonl` beside the configuration. Each JSON line includes `time` (`yyyy-mm-dd HH:mm:ss`, local time), `timezoneOffset` (minutes east of UTC), `provider`, `original`, `replacement`, `requestId` and `version`. Provider is Pi's selected provider ID, not an inferred upstream gateway vendor; unavailable metadata is recorded as `unknown`.
|
|
@@ -71,6 +94,8 @@ One record is written per distinct original/token pair per successful scan; repe
|
|
|
71
94
|
|
|
72
95
|
`/protecter` or `/protecter logs [1-100]` reads the most recent records (20 by default). Local TUI only: choose a time/provider entry, then confirm before revealing plaintext. The editor is a preview and discards edits. Controls are escaped; long previews are truncated. RPC/print modes do not display secrets, and the command never calls `sendMessage` or writes session entries.
|
|
73
96
|
|
|
97
|
+
Use `/protecter logs clear` to empty only the current machine's audit log. Local TUI confirmation is mandatory; cancelling, RPC/print mode or extra arguments do nothing. After confirmation, Pi waits for idle, queues the clear with scans and acquires the same cross-process log lock as appends. The validated file is truncated and synced, not unlinked; missing logs are a successful no-op. Configuration, other machine logs and in-memory mappings remain unchanged. New requests may immediately append new records. Full or partial-tail logs can be cleared, but unsafe links and occupied/stale locks are never bypassed. This is irreversible logical deletion, **not secure erasure** of filesystem snapshots/backups.
|
|
98
|
+
|
|
74
99
|
**Logs contain real secrets and reversible mappings.** Unix permissions are 0600; symlinks, hard links and other-user files are rejected. Tool guards cover current/old hash log names and aliases but are not a sandbox. Logs are not encrypted, automatically rotated, migrated with configuration or used to rebuild mappings. Stop all Pi processes before locally archiving/deleting logs or inspecting a stale `.jsonl.lock`. Reading is bounded to the last 1 MiB, display to 100 records and 20,000 characters per preview. A log is capped at 32 MiB and a request batch at 8 MiB; full, unwritable, partial-tail or locked logs block matched requests rather than silently losing audits. Failed scans add no records; a hard crash can leave a partial batch that requires local repair.
|
|
75
100
|
|
|
76
101
|
## How it works
|
|
@@ -140,7 +165,7 @@ API references: [Pi Extensions](https://pi.dev/docs/latest/extensions), local 0.
|
|
|
140
165
|
|
|
141
166
|
```bash
|
|
142
167
|
# 安装固定 npm 版本。
|
|
143
|
-
pi install npm:pi-information-protecter@0.
|
|
168
|
+
pi install npm:pi-information-protecter@0.4.1
|
|
144
169
|
|
|
145
170
|
# 或在本仓库构建后本地安装，不复制仓库。
|
|
146
171
|
npm ci
|
|
@@ -189,6 +214,29 @@ pi -e ./src/index.ts
|
|
|
189
214
|
- `/protecter` 打开本地审计查看器，`/protecter logs 50` 查看最近最多 50 条；`/protecter status` 只报告内存数量，不读取配置。`/protecter reload` 等待空闲后完整重载。不要在命令参数中填写秘密。
|
|
190
215
|
- 限制为 1000 条规则、每个词或模式 8192 字符、扫描 2 秒、请求 JSON 8 MiB；超限拒绝，不降级发送明文。
|
|
191
216
|
|
|
217
|
+
### 固定替换值
|
|
218
|
+
|
|
219
|
+
对象规则支持可选 `replacement` 字段。省略时保持随机替换，纯字符串规则始终使用随机占位符。空字符串、全空白、非字符串或超过 8192 字符的目标属于无效配置，不回退为随机。
|
|
220
|
+
|
|
221
|
+
```json
|
|
222
|
+
{
|
|
223
|
+
"version": 1,
|
|
224
|
+
"sensitiveWords": [
|
|
225
|
+
{ "type": "literal", "value": "Apple Inc.", "replacement": "Alphabet Inc." },
|
|
226
|
+
{ "type": "literal", "value": "example-private-key-123", "replacement": "MyPrivateKey" },
|
|
227
|
+
{ "type": "literal", "value": "randomly-protected-value" }
|
|
228
|
+
]
|
|
229
|
+
}
|
|
230
|
+
```
|
|
231
|
+
|
|
232
|
+
目标按字面文本处理，不是替换模板，`$1`、`$&` 不展开。字面和正则对象均支持该字段。成功扫描后，固定别名同样写入审计，并在本地回复和工具参数中还原。它属于**保留别名**：回复中自然出现的相同文本也会被还原；如果介意此歧义，请选择独特目标而非普通词。固定别名比随机占位符暴露更多语义信息。
|
|
233
|
+
|
|
234
|
+
为保持可逆保护，不同规则复用相同目标、目标互为子串、目标包含配置敏感值、使用保留 `__PIP_` 名称或定义冲突时拒绝加载。固定正则在同一实例中只能表示一种不同的匹配原文，第二种原文会导致请求被拒绝。涉及固定规则的部分重叠匹配也拒绝，不静默选择规则或泄漏后缀；纯随机规则重叠仍合并。迁移保留固定目标，遇到冲突停止且不删除原文件。修改后请重载；旧插件版本不支持此字段。
|
|
235
|
+
|
|
236
|
+
### 多轮一致性与提示词缓存
|
|
237
|
+
|
|
238
|
+
随机占位符按精确原文首次生成，在同一扩展实例内持续复用，包括本地回复还原后的再次脱敏；新建扫描 worker 不会重置映射。这有助于前缀稳定，但不保证提供商 KV Cache 命中，模型、工具、消息顺序、缓存有效期和路由也有影响。重载、进程重启和会话实例替换会清除映射；不同进程不共享映射，审计时间和请求 ID 不进入模型请求体。
|
|
239
|
+
|
|
192
240
|
## 私有审计日志
|
|
193
241
|
|
|
194
242
|
成功脱敏的请求会追加记录到配置旁的 `protecter.<machineHash>.jsonl`。每行包含 `time`（本地时间 `yyyy-mm-dd HH:mm:ss`）、`timezoneOffset`（相对 UTC 向东的分钟数）、`provider`、`original`、`replacement`、`requestId` 和 `version`。供应商为 Pi 当前选择的 provider ID，不猜测网关背后的上游厂商；无法获取时记录 `unknown`。
|
|
@@ -197,6 +245,8 @@ pi -e ./src/index.ts
|
|
|
197
245
|
|
|
198
246
|
`/protecter` 或 `/protecter logs [1-100]` 查看最近记录，默认 20 条。仅在本地 TUI 可用：先选择时间及供应商条目，确认后才显示明文。编辑器只作预览，修改不保存；控制字符转义，过长预览截断。RPC、打印模式不展示秘密，命令不调用消息发送接口，也不写入会话条目。
|
|
199
247
|
|
|
248
|
+
使用 `/protecter logs clear` 只清空当前机器的审计日志。必须在本地 TUI 确认；取消、RPC／打印模式或多余参数均不执行。确认后等待 Pi 空闲，与扫描排队并获取和追加日志相同的跨进程锁；安全验证后截断文件并同步，不删除文件，日志不存在则成功无操作。不改变配置、其他机器日志或内存映射；新请求可能立即新增记录。可清理已满或尾部残缺日志，但不绕过危险链接、占用锁或残留锁。这是不可撤销的逻辑删除，**不等于安全擦除**文件系统快照或备份。
|
|
249
|
+
|
|
200
250
|
**日志包含真实秘密及可逆映射。** Unix 权限为 0600，拒绝符号链接、硬链接及他人文件。工具防护覆盖当前和旧机器哈希日志及别名，但不是沙箱。日志不加密、不自动轮转、不随配置迁移，也不用于恢复映射。请停止全部 Pi 进程后再本地归档、删除日志或检查残留 `.jsonl.lock`。读取限最后 1 MiB、最多 100 条，每条预览最多 20,000 字符；单日志上限 32 MiB、请求批次 8 MiB。日志满、不可写、尾部残缺或锁占用时，命中请求会被阻止，不静默漏记。扫描失败不新增记录，硬崩溃可能遗留部分批次，需本地修复。
|
|
201
251
|
|
|
202
252
|
## 工作方式
|
package/SECURITY.md
CHANGED
|
@@ -40,6 +40,12 @@ Prevent configured personal information from accidentally entering Pi LLM reques
|
|
|
40
40
|
- Compaction and tree summaries are conservatively disabled. Do not widen Pi compatibility without verification.
|
|
41
41
|
保守禁用压缩和树摘要，未经验证不扩大 Pi 兼容范围。
|
|
42
42
|
|
|
43
|
+
## Fixed aliases and caching / 固定别名与缓存
|
|
44
|
+
|
|
45
|
+
Fixed targets are reserved literal aliases, not anonymization: they reveal semantics and natural occurrences in model output are also restored after the mapping is learned. Choose distinctive values. Reusing one alias for distinct originals, sensitive targets, ambiguous substring aliases and conflicting matchers is rejected rather than guessing a reverse mapping. Runtime regex collisions and partial fixed-rule overlaps fail closed. Random placeholders remain stable within one extension instance; cache hits still depend on provider prefix, model and routing policies. Reload/restart discards mappings; audit records are not loaded to restore them.
|
|
46
|
+
|
|
47
|
+
固定目标是保留字面别名，并非匿名化；它会暴露语义，映射学习后模型输出中自然出现的同名内容也会被还原，应选择独特值。不同原文复用别名、敏感目标、子串歧义和匹配器冲突会被拒绝，不猜测反向映射。运行时正则冲突及固定规则部分重叠会拒绝请求。随机占位符在同一实例内保持稳定，但缓存命中仍依赖提供商前缀、模型和路由策略。重载或重启丢弃映射，不从审计恢复。
|
|
48
|
+
|
|
43
49
|
## Deployment guidance / 安全部署建议
|
|
44
50
|
|
|
45
51
|
1. Configure precise rules locally and check status/counts. Empty rules provide no SPI detection.
|
package/dist/index.mjs
CHANGED
|
@@ -1,9 +1,9 @@
|
|
|
1
1
|
/*! SPI Protecter | MIT | see LICENSE / SPI 隐私保护插件 | MIT 许可 */
|
|
2
|
-
import{getAgentDir as
|
|
3
|
-
`)}finally{F(
|
|
4
|
-
`;if(Buffer.byteLength(
|
|
2
|
+
import{getAgentDir as Ie,VERSION as te}from"@earendil-works/pi-coding-agent";import{Worker as ke}from"node:worker_threads";import{fileURLToPath as ve}from"node:url";import*as u from"node:fs";import{join as v,resolve as fe}from"node:path";import{createHash as ue,randomUUID as le}from"node:crypto";import{Worker as de}from"node:worker_threads";import{fileURLToPath as ge}from"node:url";import{constants as k,closeSync as F,fchmodSync as ne,fstatSync as oe,mkdirSync as ie,openSync as j,readFileSync as se,writeFileSync as ae}from"node:fs";import{dirname as ce}from"node:path";var C={version:1,sensitiveWords:[]},w="SPI Protecter: unsafe or invalid configuration / 配置不安全或格式无效，请在本地修复。";function I(i){try{let e=JSON.parse(i);if(!e||e.version!==1||!Array.isArray(e.sensitiveWords)||e.sensitiveWords.length>1e3||Object.keys(e).some(r=>!["version","sensitiveWords"].includes(r)))throw new Error;let n=new Map;for(let r of e.sensitiveWords){if(typeof r=="string"){if(!r||r.length>8192)throw new Error;let t=JSON.stringify(["literal",r]);if(n.has(t)&&n.get(t)!==void 0)throw new Error;n.set(t,void 0);continue}if(!r||typeof r!="object")throw new Error;if(Object.hasOwn(r,"replacement")&&(typeof r.replacement!="string"||!r.replacement.trim()||r.replacement.length>8192||r.replacement.includes("__PIP_")))throw new Error;if(r.type==="literal"){if(Object.keys(r).some(t=>!["type","value","replacement"].includes(t))||typeof r.value!="string"||!r.value||r.value.length>8192)throw new Error}else if(r.type==="regex"){if(Object.keys(r).some(s=>!["type","pattern","flags","replacement"].includes(s))||typeof r.pattern!="string"||!r.pattern||r.pattern.length>8192||r.flags!==void 0&&(typeof r.flags!="string"||!/^[gimsu]*$/.test(r.flags)))throw new Error;let t=new RegExp(r.pattern,r.flags??"")}else throw new Error;let o=r.type==="literal"?JSON.stringify(["literal",r.value]):JSON.stringify(["regex",r.pattern,[...new Set((r.flags??"")+"g")].sort().join("")]);if(n.has(o)&&n.get(o)!==r.replacement)throw new Error;n.set(o,r.replacement)}return e}catch{throw new Error(w)}}function W(i,e=!1){let n;try{if(e){ie(ce(i),{recursive:!0,mode:448});try{let t=j(i,k.O_WRONLY|k.O_CREAT|k.O_EXCL,384);try{ae(t,JSON.stringify(C,null,2)+`
|
|
3
|
+
`)}finally{F(t)}}catch(t){if(t.code!=="EEXIST")throw t}}n=j(i,k.O_RDONLY|k.O_NOFOLLOW|k.O_NONBLOCK);let r=oe(n);if(!r.isFile()||r.nlink!==1||r.size>1024*1024||process.getuid&&r.uid!==process.getuid())throw new Error;process.platform!=="win32"&&ne(n,384);let o=se(n,"utf8");if(Buffer.byteLength(o)>1024*1024)throw new Error;return{config:I(o),raw:o}}catch{throw new Error(w)}finally{n!==void 0&&F(n)}}var A=/^protecter(?:\.[a-f0-9]{32})?\.json$/;function me(i){return new Promise((e,n)=>{let r=new de(ge(new URL("./validate-worker.mjs",import.meta.url)),{workerData:i,execArgv:[],resourceLimits:{maxOldGenerationSizeMb:64}}),o=!1,t=a=>{o||(o=!0,clearTimeout(s),r.terminate(),a?e():n(new Error(w)))},s=setTimeout(()=>t(!1),2e3);r.once("message",a=>t(a===!0)),r.once("error",()=>t(!1)),r.once("exit",()=>t(!1))})}function pe(i){let e=new Set,n=[];for(let o of i)for(let t of o.sensitiveWords){let s=typeof t=="string"?JSON.stringify(["literal",t,null]):t.type==="literal"?JSON.stringify(["literal",t.value,t.replacement??null]):JSON.stringify(["regex",t.pattern,[...new Set((t.flags??"")+"g")].sort().join(""),t.replacement??null]);e.has(s)||(e.add(s),n.push(t))}let r=JSON.stringify({version:1,sensitiveWords:n});if(Buffer.byteLength(r)>1024*1024)throw new Error(w);return I(r)}function z(i){let e=u.lstatSync(i,{bigint:!0});if(!e.isFile()||e.nlink!==1n||process.getuid&&e.uid!==BigInt(process.getuid()))throw new Error(w);return`${e.dev}:${e.ino}:${e.size}:${e.mtimeNs}`}function T(i,e){let n=v(i,e),r=z(n),o=W(n);if(z(n)!==r)throw new Error(w);return{name:e,...o,identity:r,digest:ue("sha256").update(o.raw).digest("hex")}}function N(i,e){let n=T(i,e.name);if(n.identity!==e.identity||n.digest!==e.digest)throw new Error(w)}function R(i){return u.readdirSync(i).filter(e=>A.test(e)).sort()}function U(i){if(process.platform==="win32")return;let e=u.openSync(i,u.constants.O_RDONLY);try{u.fsyncSync(e)}finally{u.closeSync(e)}}async function q(i,e,n={}){if(!/^[a-f0-9]{32}$/.test(e))throw new Error(w);let r=fe(i),o=`protecter.${e}.json`,t=v(r,o);u.mkdirSync(r,{recursive:!0,mode:448});let s=v(r,".protecter-migration.lock"),a=Date.now()+(n.lockTimeoutMs??5e3);for(;;)try{u.mkdirSync(s,{mode:448});break}catch(d){if(d.code!=="EEXIST"||Date.now()>=a)throw new Error("SPI Protecter: migration locked; check active processes / 迁移锁被占用，请检查活动进程。");await new Promise(p=>setTimeout(p,50))}let f;try{let d=R(r);if(d.length>64)throw new Error(w);let l=[...d].sort((h,J)=>h===o?-1:J===o?1:h.localeCompare(J)).map(h=>T(r,h)),g=pe(l.length?l.map(h=>h.config):[C]);if(await me([g]),l.length===1&&l[0].name===o){if(N(r,l[0]),JSON.stringify(R(r))!==JSON.stringify(d))throw new Error(w);return{path:t,config:l[0].config,raw:l[0].raw,sourceRaws:[l[0].raw],migrated:0}}let m=JSON.stringify(g,null,2)+`
|
|
4
|
+
`;if(Buffer.byteLength(m)>1024*1024)throw new Error(w);f=v(r,`.protecter-migration.${le()}.tmp`);let y=u.openSync(f,u.constants.O_WRONLY|u.constants.O_CREAT|u.constants.O_EXCL,384);try{u.writeFileSync(y,m),u.fsyncSync(y)}finally{u.closeSync(y)}if(n.checkpoint?.("beforeCommit",t),JSON.stringify(R(r))!==JSON.stringify(d))throw new Error(w);for(let h of l)N(r,h);u.renameSync(f,t),f=void 0,U(r);let E=T(r,o);if(E.raw!==m)throw new Error(w);n.checkpoint?.("afterCommit",t);for(let h of l)h.name!==o&&(n.checkpoint?.("beforeDelete",v(r,h.name)),N(r,E),N(r,h),u.unlinkSync(v(r,h.name)));U(r);let b=[o];if(JSON.stringify(R(r))!==JSON.stringify(b))throw new Error(w);return N(r,E),{path:t,config:g,raw:m,sourceRaws:[...new Set([...l.map(h=>h.raw),m])],migrated:l.filter(h=>h.name!==o).length}}catch{throw new Error(w)}finally{if(f)try{u.unlinkSync(f)}catch{}u.rmdirSync(s)}}import{createHash as he}from"node:crypto";import{readFileSync as we}from"node:fs";import{execFileSync as B}from"node:child_process";var G="SPI Protecter: machine ID unavailable / 无法获取机器标识。";function $(i){let e=i.trim().toLowerCase().replace(/-/g,"");if(!/^[a-f0-9]{32}$/.test(e)||/^0+$/.test(e))throw new Error(G);return he("sha256").update(`pi-information-protecter:v1:${e}`).digest("hex").slice(0,32)}function H(){try{if(process.platform==="linux")return $(we("/etc/machine-id","utf8"));if(process.platform==="darwin"){let i=B("/usr/sbin/ioreg",["-rd1","-c","IOPlatformExpertDevice"],{encoding:"utf8",timeout:5e3,maxBuffer:1048576,stdio:["ignore","pipe","pipe"]});return $(i.match(/"IOPlatformUUID"\s*=\s*"([a-fA-F0-9-]+)"/)?.[1]??"")}if(process.platform==="win32"){let i=B("reg.exe",["query","HKLM\\SOFTWARE\\Microsoft\\Cryptography","/v","MachineGuid","/reg:64"],{encoding:"utf8",timeout:5e3,maxBuffer:65536,stdio:["ignore","pipe","pipe"]});return $(i.match(/MachineGuid\s+REG_SZ\s+([a-fA-F0-9-]+)/i)?.[1]??"")}}catch{}throw new Error(G)}import*as c from"node:fs";import{randomUUID as ye}from"node:crypto";var O="SPI Protecter: audit unavailable; request blocked / 审计日志不可用，请求已阻止。",Se=32*1024*1024,Ee=8*1024*1024;function Oe(i){let e=n=>String(n).padStart(2,"0");return`${i.getFullYear()}-${e(i.getMonth()+1)}-${e(i.getDate())} ${e(i.getHours())}:${e(i.getMinutes())}:${e(i.getSeconds())}`}function L(i,e,n=e){let r=c.openSync(i,(e?c.constants.O_RDWR|(n?c.constants.O_CREAT:0):c.constants.O_RDONLY)|c.constants.O_NOFOLLOW|c.constants.O_NONBLOCK,384);try{let o=c.fstatSync(r);if(!o.isFile()||o.nlink!==1||process.getuid&&o.uid!==process.getuid())throw new Error;return process.platform!=="win32"&&c.fchmodSync(r,384),r}catch{throw c.closeSync(r),new Error(O)}}async function X(i){let e=`${i}.lock`,n=Date.now()+2e3;for(;;)try{return c.mkdirSync(e,{mode:448}),e}catch(r){if(r.code!=="EEXIST"||Date.now()>=n)throw new Error(O);await new Promise(o=>setTimeout(o,25))}}async function Y(i){let e=await X(i),n;try{try{n=L(i,!0,!1)}catch(o){if(o.code==="ENOENT")return 0;throw o}let r=c.fstatSync(n).size;return c.ftruncateSync(n,0),c.fsyncSync(n),r}catch{throw new Error(O)}finally{try{n!==void 0&&c.closeSync(n)}finally{c.rmdirSync(e)}}}async function K(i,e,n){if(!n.length)return;let r=new Date,o=ye(),t=Buffer.from(n.map(([f,d])=>JSON.stringify({version:1,time:Oe(r),timezoneOffset:-r.getTimezoneOffset(),requestId:o,provider:e||"unknown",original:d,replacement:f})).join(`
|
|
5
5
|
`)+`
|
|
6
|
-
`);if(
|
|
7
|
-
`);
|
|
8
|
-
`),d=
|
|
9
|
-
[Preview truncated / 预览截断]`:y)}catch{
|
|
6
|
+
`);if(t.length>Ee)throw new Error(O);let s=await X(i),a;try{a=L(i,!0);let f=c.fstatSync(a).size;if(f+t.length>Se)throw new Error;if(f){let d=Buffer.alloc(1);if(c.readSync(a,d,0,1,f-1),d[0]!==10)throw new Error}try{let d=0;for(;d<t.length;){let p=c.writeSync(a,t,d,t.length-d,f+d);if(!p)throw new Error;d+=p}c.fsyncSync(a)}catch{throw c.ftruncateSync(a,f),c.fsyncSync(a),new Error}}catch{throw new Error(O)}finally{a!==void 0&&c.closeSync(a),c.rmdirSync(s)}}function Q(i,e=20){if(!Number.isInteger(e)||e<1||e>100)throw new Error(O);let n;try{try{n=L(i,!1)}catch(g){if(g.code==="ENOENT")return{records:[],truncated:!1};throw g}let r=c.fstatSync(n).size,o=Math.max(0,r-1024*1024),t=Buffer.alloc(r-o),s=c.readSync(n,t,0,t.length,o),a=t.subarray(0,s).toString("utf8");if(o){let g=a.indexOf(`
|
|
7
|
+
`);a=g<0?"":a.slice(g+1)}let f=a.split(`
|
|
8
|
+
`),d=f.pop()!=="",p=[],l=!1;for(let g of f.slice(-e))try{let m=JSON.parse(g);if(m.version!==1||typeof m.time!="string"||typeof m.provider!="string"||typeof m.original!="string"||typeof m.replacement!="string"||typeof m.requestId!="string"||typeof m.timezoneOffset!="number")throw new Error;p.push(m)}catch{l=!0}return{records:p,truncated:o>0||f.length>e||d||l}}catch{throw new Error(O)}finally{n!==void 0&&c.closeSync(n)}}var S="SPI Protecter: request cleared; check config, audit log, scan limits or attachments / 请求已清空，请检查配置、审计日志、扫描限制或附件。",x=class{constructor(e,n=2e3,r=H){this.configDir=e;this.timeoutMs=n;this.machineId=r}configDir;timeoutMs;machineId;tokens=new Map;queue=Promise.resolve();workers=new Set;closed=!1;snapshot;async initialize(){if(this.closed)throw new Error(S);this.snapshot=void 0;let e=await q(this.configDir,this.machineId());if(this.closed)throw new Error(S);this.snapshot=e}get configPath(){return this.snapshot?.path??""}get auditPath(){return this.configPath?this.configPath.replace(/\.json$/,".jsonl"):""}auditRecords(e=20){if(!this.ready)throw new Error(S);return Q(this.auditPath,e)}clearAuditRecords(){let e=this.queue.then(()=>{if(!this.ready)throw new Error(S);return Y(this.auditPath)});return this.queue=e.catch(()=>{}),e}get ruleCount(){return this.snapshot?.config.sensitiveWords.length??0}get ready(){return!!this.snapshot&&!this.closed}get mappingCount(){return this.tokens.size}redact(e,n="unknown"){let r=this.queue.then(()=>this.scan(e,n));return this.queue=r.catch(()=>{}),r}async scan(e,n){if(!this.ready)throw new Error(S);let{config:r,sourceRaws:o}=this.snapshot,t=JSON.stringify(e);if(!t||Buffer.byteLength(t)>8*1024*1024)throw new Error(S);let s;try{s=JSON.parse(t)}catch{throw new Error(S)}let a=await new Promise((f,d)=>{let p=!1,l=new ke(ve(new URL("./scan-worker.mjs",import.meta.url)),{workerData:{payload:s,rules:r.sensitiveWords,entries:[...this.tokens],configRaws:o},execArgv:[],resourceLimits:{maxOldGenerationSizeMb:128}});this.workers.add(l);let g=y=>{if(!p){if(p=!0,clearTimeout(m),this.workers.delete(l),l.terminate(),!y||this.closed){d(new Error(S));return}f(y)}},m=setTimeout(()=>g(),this.timeoutMs);l.once("message",y=>g(y.failed?void 0:y)),l.once("error",()=>g()),l.once("exit",()=>g())});if(this.closed)throw new Error(S);if(await K(this.auditPath,n,a.hits),this.closed)throw new Error(S);for(let[f,d]of a.additions)this.tokens.set(f,d);return a.payload}restoreText(e){let n=t=>t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),r=[...this.tokens.keys()].filter(t=>!/^__PIP_[a-f0-9]{48}__$/.test(t)),o=new RegExp(["__PIP_[a-f0-9]{48}__",...r.sort((t,s)=>s.length-t.length).map(n)].join("|"),"g");return e.replace(o,t=>this.tokens.get(t)??t)}restore(e,n=0){if(n>80)throw new Error("protecter: 响应层级过深。");if(typeof e=="string")return this.restoreText(e);if(Array.isArray(e))return e.map(r=>this.restore(r,n+1));if(e&&typeof e=="object"){let r=Object.create(null);for(let[o,t]of Object.entries(e)){let s=this.restoreText(o);if(Object.hasOwn(r,s))throw new Error("protecter: 响应键冲突。");r[s]=this.restore(t,n+1)}return r}return e}close(){this.closed=!0,this.snapshot=void 0,this.tokens.clear();for(let e of this.workers)e.terminate();this.workers.clear()}};import{realpathSync as be,statSync as V,readdirSync as Ne}from"node:fs";import{homedir as Pe}from"node:os";import{basename as M,dirname as P,isAbsolute as Re,relative as ee,resolve as _}from"node:path";import{fileURLToPath as xe}from"node:url";function _e(i,e){let n=i.replace(/^@/,"");return n.startsWith("file://")&&(n=xe(n)),(n==="~"||n.startsWith("~/"))&&(n=Pe()+n.slice(1)),_(e,n)}function D(i){try{return be(i)}catch{let e=P(i);return e===i?i:_(D(e),ee(e,i))}}function Ce(i,e){let n=ee(i,e);return n===""||!n.startsWith("..")&&!Re(n)}function Z(i,e){try{let n=V(i),r=V(e);return n.dev===r.dev&&n.ino===r.ino}catch{return!1}}function re(i,e,n,r){if(!r)return!0;let o=D(_(r));if(["bash","powershell"].includes(i)){let a=typeof e.command=="string"?e.command:"";if(/protecter(?:\.[a-f0-9]{32})?\.jsonl?|\.protecter-migration/i.test(a)||a.includes(r))return!0}let t=e.path??e.file_path??e.filePath,s=["grep","find","ls"].includes(i);if(typeof t!="string"&&!s)return!1;try{let a=_e(typeof t=="string"?t:".",n),f=D(a),d=/^protecter\.[a-f0-9]{32}\.jsonl(?:\.lock)?$/,p=Ne(P(o)).filter(l=>d.test(l)).some(l=>Z(a,_(P(o),l)));return P(f)===P(o)&&(A.test(M(f))||d.test(M(f))||M(f).startsWith(".protecter-migration"))||f===o||Z(a,r)||p||s&&Ce(f,o)}catch{return!0}}function Te(i){let e=new x(Ie()),n=/^0\.85\./.test(te)&&Number(te.split(".")[2])>=1,r=!1;i.on("session_start",async(o,t)=>{try{if(!n)throw new Error;await e.initialize(),r=!0;let s=e.ruleCount;t.ui.setStatus("protecter",`SPI Protecter · ${s} rules`),s===0&&t.ui.notify("SPI Protecter: empty rules; edit local machine config and /reload / 规则为空，请编辑本地机器配置后重载。","warning")}catch{r=!1,t.ui.notify(S,"error")}}),i.on("before_provider_request",async(o,t)=>{try{if(!n)throw new Error;let s=await e.redact(o.payload,t.model?.provider??"unknown");return r=!0,s}catch{r=!1;try{await t.abort()}catch{}try{t.ui.notify(S,"error")}catch{}return{}}}),i.on("message_end",o=>{if(o.message.role!=="assistant")return;let t=o.message;return{message:{...t,content:t.content.map(s=>s.type==="text"?{...s,text:e.restoreText(s.text)}:s.type==="thinking"?{...s,thinking:e.restoreText(s.thinking)}:s.type==="toolCall"?{...s,arguments:e.restore(s.arguments)}:s),...t.errorMessage?{errorMessage:e.restoreText(t.errorMessage)}:{}}}}),i.registerMarkdownTransformer((o,t)=>t.messageType==="user"?o:e.restoreText(o)),i.on("tool_call",(o,t)=>{if(!r)return{block:!0,reason:"SPI Protecter 尚未就绪。"};let s=e.restore(o.input);for(let a of Object.keys(o.input))delete o.input[a];if(Object.assign(o.input,s),re(o.toolName,o.input,t.cwd,e.configPath))return{block:!0,reason:"SPI Protecter：禁止工具访问保护配置，请由用户在本地编辑。"}}),i.on("session_before_compact",(o,t)=>(t.ui.notify("SPI Protecter：暂不支持远程上下文压缩，请使用 /new 开始新会话。","warning"),{cancel:!0})),i.on("session_before_tree",o=>o.preparation.userWantsSummary?{cancel:!0}:void 0),i.registerCommand("protecter",{description:"View local protection records / 查看本地保护记录",handler:async(o,t)=>{let s=o.trim().split(/\s+/).filter(Boolean),a=s[0]??"logs";if(!["status","reload","logs"].includes(a)||a!=="logs"&&s.length>1||s.length>2||s[1]!==void 0&&s[1]!=="clear"&&!/^(?:[1-9]\d?|100)$/.test(s[1])){t.ui.notify("Usage / 用法: /protecter [logs [1-100|clear]|status|reload]. No secrets in arguments / 不要在参数中输入秘密。","info");return}if(a==="logs"){if(t.mode!=="tui"){t.ui.notify("Local TUI required / 请在本地 TUI 查看记录。","warning");return}if(s[1]==="clear"){try{if(!e.ready)throw new Error;if(!await t.ui.confirm("Clear current audit log? / 清空当前审计日志？","Irreversible. Only this machine's log; config and mappings stay. Later requests may add records. / 不可撤销，仅清空本机日志，保留配置和映射，后续请求可能新增记录。"))return;await t.waitForIdle();let f=await e.clearAuditRecords();r=e.ready,t.ui.notify(`Audit cleared: ${f} bytes / 已清空日志：${f} 字节。`,"info")}catch{t.ui.notify("Unable to clear audit log; check permissions or lock / 无法清空日志，请检查权限或锁。","error")}return}try{let{records:f,truncated:d}=e.auditRecords(Number(s[1]??20));if(!f.length){t.ui.notify("No readable records / 暂无可读记录。","info");return}let p=E=>JSON.stringify(E).replace(/[\u007f-\u009f\u202a-\u202e\u2066-\u2069]/g,b=>`\\u${b.charCodeAt(0).toString(16).padStart(4,"0")}`),l=f.map((E,b)=>`${b+1}. ${p(E.time)} | ${p(E.provider).slice(0,120)}`),g=await t.ui.select(`Protection records / 保护记录${d?" (limited tail / 有限尾部)":""}`,l),m=g===void 0?-1:l.indexOf(g);if(m<0||!await t.ui.confirm("Sensitive plaintext / 敏感明文","Reveal locally? Never share this view / 确认本地显示？请勿分享此界面。"))return;let y=p(f[m]);await t.ui.editor("Local preview; edits discarded / 本地预览，编辑不保存",y.length>2e4?y.slice(0,2e4)+`
|
|
9
|
+
[Preview truncated / 预览截断]`:y)}catch{t.ui.notify("Cannot read audit records / 无法读取审计记录。","error")}return}if(a==="reload"){await t.waitForIdle(),await t.reload();return}t.ui.notify(`SPI Protecter: ${e.ready?"ready / 就绪":"not ready / 未就绪"}; ${e.ruleCount} rules / 规则; ${e.mappingCount} mappings / 映射. Memory snapshot; /reload to refresh / 内存快照，重载后更新。`,e.ready?"info":"error")}}),i.on("session_shutdown",()=>e.close())}export{Te as default};
|
package/dist/scan-worker.mjs
CHANGED
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
/*! SPI Protecter | MIT | see LICENSE / SPI 隐私保护插件 | MIT 许可 */
|
|
2
|
-
import{parentPort as
|
|
2
|
+
import{parentPort as b,workerData as T}from"node:worker_threads";import{randomBytes as $}from"node:crypto";try{let S=function(t,r){let e=p.get(t);if(e){if(r!==void 0&&e!==r)throw new Error;return e}if(r!==void 0){if(c.size>=5e4)throw new Error;if(c.has(r)&&c.get(r)!==t)throw new Error;if(r.includes(t))throw new Error;return p.set(t,r),c.set(r,t),u.push([r,t]),r}if(c.size>=5e4)throw new Error;do e=`__PIP_${$(24).toString("hex")}__`;while(c.has(e)||N.includes(e));return p.set(t,e),c.set(e,t),u.push([e,t]),e},m=function(t){let r=[];for(let o of w)if(o.literal===void 0){o.regex.lastIndex=0;for(let n of t.matchAll(o.regex)){if(!n[0].length)throw new Error;if(r.push([n.index,n.index+n[0].length,o.replacement]),++y>1e5)throw new Error}}else{if(!o.literal)continue;let n=0;for(;(n=t.indexOf(o.literal,n))!==-1;){if(r.push([n,n+o.literal.length,o.replacement]),++y>1e5)throw new Error;n++}}r.sort((o,n)=>o[0]-n[0]||n[1]-o[1]);let e=[];for(let o of r){let n=e.at(-1);if(n&&o[0]<n[1]){if(n[2]!==void 0||o[2]!==void 0){if(n[0]!==o[0]||n[1]!==o[1]||n[2]!==void 0&&o[2]!==void 0&&n[2]!==o[2])throw new Error;n[2]??=o[2]}n[1]=Math.max(n[1],o[1])}else e.push([...o])}let s="",f=0;for(let[o,n,i]of e){let a=S(t.slice(o,n),i);x.add(a),s+=t.slice(f,o)+a,f=n}return s+t.slice(f)},h=function(t){let r="",e=0,s=i=>i.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),f=[...c.keys()].filter(i=>!/^__PIP_[a-f0-9]{48}__$/.test(i)),o=new RegExp(["__PIP_[a-f0-9]{48}__",...f.sort((i,a)=>a.length-i.length).map(s)].join("|"),"g"),n=[...t.matchAll(o)].filter(i=>c.has(i[0]));for(let i of w)if(!(!i.regex||!f.length)){i.regex.lastIndex=0;for(let a of t.matchAll(i.regex)){if(++y>1e5||!a[0].length)throw new Error;if(n.some(g=>f.includes(g[0])&&a.index<g.index+g[0].length&&a.index+a[0].length>g.index))throw new Error}}for(let i of n)c.has(i[0])&&(r+=m(t.slice(e,i.index))+i[0],e=i.index+i[0].length);return r+m(t.slice(e))},d=function(t,r=0){if(++M>2e5||r>80)throw new Error;if(typeof t=="string"){if(O.some(e=>t.includes(e)))return h(t);if(/^\s*[[{]/.test(t)){let e;try{e=JSON.parse(t)}catch{}if(e&&typeof e=="object"){let s=JSON.stringify(d(e,r+1)),f=h(s);return f===s?s:(JSON.parse(f),f)}}return h(t)}if(typeof t=="number"){let e=h(String(t));return e===String(t)?t:e}if(Array.isArray(t))return t.map(e=>d(e,r+1));if(t&&typeof t=="object"){if(typeof t.type=="string"&&/image|audio|video|document|(^|_)file($|_)/i.test(t.type))throw new Error;if(Object.keys(t).some(s=>/^(inlineData|inline_data|fileData|file_data|image_url|input_audio)$/.test(s)))throw new Error;let e=Object.create(null);for(let[s,f]of Object.entries(t)){let o=h(s);if(Object.hasOwn(e,o))throw new Error;e[o]=d(f,r+1)}return e}if(t===null||typeof t=="boolean")return t;throw new Error},l=function(t,r,e=0){if(e>80)throw new Error;if(typeof t=="string"){if(t.includes(r))return!0;let s;try{s=JSON.parse(t)}catch{return!1}return s&&typeof s=="object"?l(s,r,e+1):!1}return Array.isArray(t)?t.some(s=>l(s,r,e+1)):t&&typeof t=="object"?Object.entries(t).some(([s,f])=>s.includes(r)||l(f,r,e+1)):!1};I=S,k=m,D=h,R=d,z=l;let{payload:_,rules:A,entries:E,configRaws:J}=T,p=new Map(E.map(([t,r])=>[r,t])),c=new Map(E),u=[],x=new Set,w=A.map(t=>typeof t=="string"?{literal:t}:t.type==="literal"?{literal:t.value,replacement:t.replacement}:{replacement:t.replacement,regex:new RegExp(t.pattern,[...new Set((t.flags??"")+"g")].join(""))});for(let t of p.keys())w.push({literal:t});let O=[...new Set(J.flatMap(t=>[t,JSON.stringify(JSON.parse(t))]))];for(let t of O)w.push({literal:t});let N=JSON.stringify(_),y=0,M=0,j=d(_),P=[...x].filter(t=>l(j,t)).map(t=>[t,c.get(t)]);b.postMessage({payload:j,additions:u,hits:P})}catch{b.postMessage({failed:!0})}var I,k,D,R,z;
|
package/dist/validate-worker.mjs
CHANGED
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
/*! SPI Protecter | MIT | see LICENSE / SPI 隐私保护插件 | MIT 许可 */
|
|
2
|
-
import{parentPort as
|
|
2
|
+
import{parentPort as i,workerData as c}from"node:worker_threads";try{for(let f of c){let n=f.sensitiveWords,o=n.filter(e=>typeof e=="object"&&e.replacement!==void 0);for(let e of n)if(typeof e=="object"&&e.type==="regex"&&new RegExp(e.pattern,e.flags??"").test(""))throw new Error;for(let e=0;e<o.length;e++){let r=o[e].replacement;for(let t of n)if(typeof t=="string"?r.includes(t)||t.includes(r):t.type==="literal"?r.includes(t.value)||t.value.includes(r):new RegExp(t.pattern,t.flags??"").test(r))throw new Error;for(let t=0;t<e;t++){let s=o[t];if(!r.includes(s.replacement)&&!s.replacement.includes(r))continue;if(!(JSON.stringify(o[e])===JSON.stringify(s)))throw new Error}}}i.postMessage(!0)}catch{i.postMessage(!1)}
|
package/docs/MIGRATION.md
CHANGED
|
@@ -20,6 +20,10 @@ Current-target rules come first, then old files in filename order. Strings and e
|
|
|
20
20
|
|
|
21
21
|
当前目标规则优先，旧文件按名称顺序合并。字符串和等价字面对象按精确值去重；正则按模式和含隐式 `g` 的规范化标志去重。大小写、空白、Unicode 和不同正则语义保留。合并并格式化后仍须满足 1000 条及 1 MiB 限制，不允许截断。
|
|
22
22
|
|
|
23
|
+
Fixed `replacement` values are part of rule identity. The same matcher with different targets (including fixed versus random) is a conflict, not an override. Merged targets are checked together in the bounded worker before any write or deletion; unsafe or ambiguous aliases stop migration. Old plugin versions reject this optional field, so upgrade before editing configuration.
|
|
24
|
+
|
|
25
|
+
固定 `replacement` 是规则身份的一部分。相同匹配器具有不同目标（包括固定与随机）视为冲突，而非覆盖。合并后的目标会在限时 worker 中联合检查，通过后才写入或删除；不安全或歧义别名会停止迁移。旧插件版本拒绝该字段，需先升级再修改配置。
|
|
26
|
+
|
|
23
27
|
## Commit and cleanup / 提交与清理
|
|
24
28
|
|
|
25
29
|
1. Acquire the directory-wide `.protecter-migration.lock` using exclusive directory creation; wait up to 5 seconds for cooperating processes.
|
package/package.json
CHANGED
package/protecter.example.json
CHANGED
|
@@ -2,6 +2,8 @@
|
|
|
2
2
|
"version": 1,
|
|
3
3
|
"sensitiveWords": [
|
|
4
4
|
"张三",
|
|
5
|
+
{ "type": "literal", "value": "Apple Inc.", "replacement": "Alphabet Inc." },
|
|
6
|
+
{ "type": "literal", "value": "example-private-key-123", "replacement": "MyPrivateKey" },
|
|
5
7
|
{ "type": "literal", "value": "replace-with-your-real-password" },
|
|
6
8
|
{ "type": "regex", "pattern": "https?://[^\\s\\\"<>]+", "flags": "i" },
|
|
7
9
|
{ "type": "regex", "pattern": "(?<!\\d)1[3-9]\\d{9}(?!\\d)" },
|