shellward 0.7.12 → 0.7.13
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/compliance/audit.js +3 -2
- package/dist/compliance/html-report.js +19 -1
- package/dist/compliance/project-scan.js +0 -0
- package/dist/compliance/report.js +1 -1
- package/package.json +1 -1
- package/src/compliance/audit.ts +5 -4
- package/src/compliance/html-report.ts +23 -1
- package/src/compliance/project-scan.ts +0 -0
- package/src/compliance/report.ts +1 -1
package/dist/compliance/audit.js
CHANGED
|
@@ -236,9 +236,10 @@ function checkEnv(c, env) {
|
|
|
236
236
|
if (env.overseas.length > 0) {
|
|
237
237
|
const names = env.overseas.map(o => o.provider_zh).join(', ');
|
|
238
238
|
const namesEn = env.overseas.map(o => o.provider_en).join(', ');
|
|
239
|
-
|
|
239
|
+
// 检出境外调用是"事实"，是否违规取决于是否发送 PII/重要数据 → 标"需评估"而非"不合规"
|
|
240
|
+
return mk(c, 'warn', `检测到境外大模型调用: ${names}。是否违规取决于发送的数据：涉及个人信息/重要数据需走合规路径或改用境内模型；仅非个人/非重要数据通常可接受。`, `Overseas LLM detected: ${namesEn}. Compliance depends on the data sent — PI/important data needs a compliant path; non-personal data is usually fine.`);
|
|
240
241
|
}
|
|
241
|
-
return mk(c, 'pass', '
|
|
242
|
+
return mk(c, 'pass', '未检测到境外大模型调用', 'No overseas LLM detected');
|
|
242
243
|
}
|
|
243
244
|
return mk(c, 'manual', '需人工确认', 'Manual check required');
|
|
244
245
|
}
|
|
@@ -14,7 +14,7 @@ const STATUS = {
|
|
|
14
14
|
manual: { zh: '待确认', en: 'Review', cls: 'manual' },
|
|
15
15
|
};
|
|
16
16
|
const KIND = {
|
|
17
|
-
overseas: { zh: '
|
|
17
|
+
overseas: { zh: '境外大模型调用（需评估出境）', en: 'Overseas LLM (assess export)', icon: '🌐' },
|
|
18
18
|
secret: { zh: '硬编码密钥', en: 'Hardcoded secret', icon: '🔑' },
|
|
19
19
|
pii: { zh: '个人信息暴露', en: 'PII exposure', icon: '🪪' },
|
|
20
20
|
'env-perm': { zh: '.env 权限', en: '.env permission', icon: '📂' },
|
|
@@ -161,6 +161,18 @@ export function renderHtmlReport(report, scan, locale, meta) {
|
|
|
161
161
|
}
|
|
162
162
|
S.push('</tbody></table></div>');
|
|
163
163
|
}
|
|
164
|
+
// ===== 接入运行时指引：把 ⚪ 待核验项变成可验证（回答"需要接入才能测"）=====
|
|
165
|
+
if (report.staticScan && report.manual > 0) {
|
|
166
|
+
const cfg = `{
|
|
167
|
+
"mcpServers": {
|
|
168
|
+
"shellward": { "command": "npx", "args": ["-y", "-p", "shellward", "shellward-mcp"] }
|
|
169
|
+
}
|
|
170
|
+
}`;
|
|
171
|
+
S.push(sectionHead('🔌', t('让待核验项可验证：接入运行时', 'Make ⚪ items verifiable: deploy runtime'), t('静态扫描测不了运行时行为，接入后这些项才能被持续验证', 'Static scan cannot test runtime behavior; deploy to validate')));
|
|
172
|
+
S.push(`<p class="note">${t(`把下面这段加到 Claude Desktop / Cursor / OpenClaw 的 MCP 配置，重启后 ShellWard 就作为<b>运行时防护</b>在你的 AI 应用里运行——上方 ${report.manual} 项（审计留存、运行时拦截、数据外发管控等）即可被真实验证。`, `Add this to your Claude Desktop / Cursor / OpenClaw MCP config and restart — ShellWard then runs as a <b>runtime guard</b>, validating the ${report.manual} ⚪ items above.`)}</p>`);
|
|
173
|
+
S.push(`<div class="cfg"><pre id="mcpcfg">${esc(cfg)}</pre><button onclick="(function(b){navigator.clipboard&&navigator.clipboard.writeText(document.getElementById('mcpcfg').textContent).then(function(){b.textContent='${t('已复制', 'Copied')}'})})(this)">${t('复制', 'Copy')}</button></div>`);
|
|
174
|
+
S.push(`<p class="muted">${t('或命令行直接起：', 'Or run directly:')} <code>npx shellward mcp</code> · ${t('文档', 'Docs')}: <a href="https://github.com/jnMetaCode/shellward">github.com/jnMetaCode/shellward</a></p>`);
|
|
175
|
+
}
|
|
164
176
|
const disclaimer = t('本报告由 ShellWard 合规网关自动生成，帮助评估并满足合规技术要求，不构成法律意见，亦不替代算法备案/定级备案/PIA 等主体责任。⚪ 待确认项需结合业务人工判定。', 'Generated by ShellWard Compliance Gateway. Assists with technical compliance; not legal advice. ⚪ items require manual review.');
|
|
165
177
|
return `<!DOCTYPE html>
|
|
166
178
|
<html lang="${zh ? 'zh-CN' : 'en'}">
|
|
@@ -323,6 +335,12 @@ table.tbl td.right{width:64px}
|
|
|
323
335
|
.manual-note{margin:8px 36px 12px;font-size:13px;color:#475569;background:#eff6ff;
|
|
324
336
|
border-left:3px solid #3b82f6;line-height:1.6}
|
|
325
337
|
.manual-note code{background:#dbeafe;padding:1px 6px;border-radius:5px}
|
|
338
|
+
.cfg{position:relative;margin:8px 36px}
|
|
339
|
+
.cfg pre{background:#0f172a;color:#e2e8f0;border-radius:10px;padding:16px 18px;margin:0;
|
|
340
|
+
font-family:ui-monospace,Menlo,monospace;font-size:12.5px;overflow-x:auto;line-height:1.5}
|
|
341
|
+
.cfg button{position:absolute;top:10px;right:12px;background:#1e293b;color:#94a3b8;border:0;
|
|
342
|
+
border-radius:6px;padding:5px 12px;font-size:12px;cursor:pointer}
|
|
343
|
+
.cfg button:hover{color:#fff}
|
|
326
344
|
|
|
327
345
|
/* 法规分组 */
|
|
328
346
|
.reg{margin:14px 36px;padding:0;border:1px solid var(--line);border-radius:12px;overflow:hidden}
|
|
Binary file
|
|
@@ -116,7 +116,7 @@ export function renderComplianceReport(report, locale) {
|
|
|
116
116
|
return L.join('\n');
|
|
117
117
|
}
|
|
118
118
|
const KIND_LABEL = {
|
|
119
|
-
overseas: { zh: '
|
|
119
|
+
overseas: { zh: '境外大模型调用（需评估出境）', en: 'Overseas LLM (assess export)', icon: '🌐' },
|
|
120
120
|
secret: { zh: '硬编码密钥', en: 'Hardcoded secret', icon: '🔑' },
|
|
121
121
|
pii: { zh: '个人信息暴露', en: 'PII exposure', icon: '🪪' },
|
|
122
122
|
'env-perm': { zh: '.env 权限', en: '.env permission', icon: '📂' },
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "shellward",
|
|
3
|
-
"version": "0.7.
|
|
3
|
+
"version": "0.7.13",
|
|
4
4
|
"mcpName": "io.github.jnMetaCode/shellward",
|
|
5
5
|
"description": "AI agent security & MCP security middleware — prompt injection detection, AI firewall, runtime guardrails & data-loss prevention for LLM tool calls. 8-layer defense against data exfiltration & dangerous commands. Zero dependencies. SDK + OpenClaw plugin. Supports LangChain, AutoGPT, Claude Code, Cursor, OpenAI Agents, Hermes Agent.",
|
|
6
6
|
"keywords": [
|
package/src/compliance/audit.ts
CHANGED
|
@@ -317,11 +317,12 @@ function checkEnv(c: ComplianceControl, env: EnvFacts): ControlResult {
|
|
|
317
317
|
if (env.overseas.length > 0) {
|
|
318
318
|
const names = env.overseas.map(o => o.provider_zh).join(', ')
|
|
319
319
|
const namesEn = env.overseas.map(o => o.provider_en).join(', ')
|
|
320
|
-
|
|
321
|
-
|
|
322
|
-
|
|
320
|
+
// 检出境外调用是"事实"，是否违规取决于是否发送 PII/重要数据 → 标"需评估"而非"不合规"
|
|
321
|
+
return mk(c, 'warn',
|
|
322
|
+
`检测到境外大模型调用: ${names}。是否违规取决于发送的数据：涉及个人信息/重要数据需走合规路径或改用境内模型；仅非个人/非重要数据通常可接受。`,
|
|
323
|
+
`Overseas LLM detected: ${namesEn}. Compliance depends on the data sent — PI/important data needs a compliant path; non-personal data is usually fine.`)
|
|
323
324
|
}
|
|
324
|
-
return mk(c, 'pass', '
|
|
325
|
+
return mk(c, 'pass', '未检测到境外大模型调用', 'No overseas LLM detected')
|
|
325
326
|
}
|
|
326
327
|
return mk(c, 'manual', '需人工确认', 'Manual check required')
|
|
327
328
|
}
|
|
@@ -20,7 +20,7 @@ const STATUS: Record<ControlStatus, { zh: string; en: string; cls: string }> = {
|
|
|
20
20
|
}
|
|
21
21
|
|
|
22
22
|
const KIND: Record<FindingKind, { zh: string; en: string; icon: string }> = {
|
|
23
|
-
overseas: { zh: '
|
|
23
|
+
overseas: { zh: '境外大模型调用（需评估出境）', en: 'Overseas LLM (assess export)', icon: '🌐' },
|
|
24
24
|
secret: { zh: '硬编码密钥', en: 'Hardcoded secret', icon: '🔑' },
|
|
25
25
|
pii: { zh: '个人信息暴露', en: 'PII exposure', icon: '🪪' },
|
|
26
26
|
'env-perm': { zh: '.env 权限', en: '.env permission', icon: '📂' },
|
|
@@ -192,6 +192,22 @@ export function renderHtmlReport(
|
|
|
192
192
|
S.push('</tbody></table></div>')
|
|
193
193
|
}
|
|
194
194
|
|
|
195
|
+
// ===== 接入运行时指引：把 ⚪ 待核验项变成可验证（回答"需要接入才能测"）=====
|
|
196
|
+
if (report.staticScan && report.manual > 0) {
|
|
197
|
+
const cfg = `{
|
|
198
|
+
"mcpServers": {
|
|
199
|
+
"shellward": { "command": "npx", "args": ["-y", "-p", "shellward", "shellward-mcp"] }
|
|
200
|
+
}
|
|
201
|
+
}`
|
|
202
|
+
S.push(sectionHead('🔌', t('让待核验项可验证：接入运行时', 'Make ⚪ items verifiable: deploy runtime'),
|
|
203
|
+
t('静态扫描测不了运行时行为，接入后这些项才能被持续验证', 'Static scan cannot test runtime behavior; deploy to validate')))
|
|
204
|
+
S.push(`<p class="note">${t(
|
|
205
|
+
`把下面这段加到 Claude Desktop / Cursor / OpenClaw 的 MCP 配置，重启后 ShellWard 就作为<b>运行时防护</b>在你的 AI 应用里运行——上方 ${report.manual} 项（审计留存、运行时拦截、数据外发管控等）即可被真实验证。`,
|
|
206
|
+
`Add this to your Claude Desktop / Cursor / OpenClaw MCP config and restart — ShellWard then runs as a <b>runtime guard</b>, validating the ${report.manual} ⚪ items above.`)}</p>`)
|
|
207
|
+
S.push(`<div class="cfg"><pre id="mcpcfg">${esc(cfg)}</pre><button onclick="(function(b){navigator.clipboard&&navigator.clipboard.writeText(document.getElementById('mcpcfg').textContent).then(function(){b.textContent='${t('已复制', 'Copied')}'})})(this)">${t('复制', 'Copy')}</button></div>`)
|
|
208
|
+
S.push(`<p class="muted">${t('或命令行直接起：', 'Or run directly:')} <code>npx shellward mcp</code> · ${t('文档', 'Docs')}: <a href="https://github.com/jnMetaCode/shellward">github.com/jnMetaCode/shellward</a></p>`)
|
|
209
|
+
}
|
|
210
|
+
|
|
195
211
|
const disclaimer = t(
|
|
196
212
|
'本报告由 ShellWard 合规网关自动生成，帮助评估并满足合规技术要求，不构成法律意见，亦不替代算法备案/定级备案/PIA 等主体责任。⚪ 待确认项需结合业务人工判定。',
|
|
197
213
|
'Generated by ShellWard Compliance Gateway. Assists with technical compliance; not legal advice. ⚪ items require manual review.')
|
|
@@ -364,6 +380,12 @@ table.tbl td.right{width:64px}
|
|
|
364
380
|
.manual-note{margin:8px 36px 12px;font-size:13px;color:#475569;background:#eff6ff;
|
|
365
381
|
border-left:3px solid #3b82f6;line-height:1.6}
|
|
366
382
|
.manual-note code{background:#dbeafe;padding:1px 6px;border-radius:5px}
|
|
383
|
+
.cfg{position:relative;margin:8px 36px}
|
|
384
|
+
.cfg pre{background:#0f172a;color:#e2e8f0;border-radius:10px;padding:16px 18px;margin:0;
|
|
385
|
+
font-family:ui-monospace,Menlo,monospace;font-size:12.5px;overflow-x:auto;line-height:1.5}
|
|
386
|
+
.cfg button{position:absolute;top:10px;right:12px;background:#1e293b;color:#94a3b8;border:0;
|
|
387
|
+
border-radius:6px;padding:5px 12px;font-size:12px;cursor:pointer}
|
|
388
|
+
.cfg button:hover{color:#fff}
|
|
367
389
|
|
|
368
390
|
/* 法规分组 */
|
|
369
391
|
.reg{margin:14px 36px;padding:0;border:1px solid var(--line);border-radius:12px;overflow:hidden}
|
|
Binary file
|
package/src/compliance/report.ts
CHANGED
|
@@ -130,7 +130,7 @@ export function renderComplianceReport(report: ComplianceReport, locale: 'zh' |
|
|
|
130
130
|
}
|
|
131
131
|
|
|
132
132
|
const KIND_LABEL: Record<FindingKind, { zh: string; en: string; icon: string }> = {
|
|
133
|
-
overseas: { zh: '
|
|
133
|
+
overseas: { zh: '境外大模型调用（需评估出境）', en: 'Overseas LLM (assess export)', icon: '🌐' },
|
|
134
134
|
secret: { zh: '硬编码密钥', en: 'Hardcoded secret', icon: '🔑' },
|
|
135
135
|
pii: { zh: '个人信息暴露', en: 'PII exposure', icon: '🪪' },
|
|
136
136
|
'env-perm': { zh: '.env 权限', en: '.env permission', icon: '📂' },
|