111 lines
3.7 KiB
JavaScript
111 lines
3.7 KiB
JavaScript
|
#!/usr/bin/env node
|
|||
|
|
/**
|
|||
|
|
* PreToolUse Hook: Edit/Write 预检派遣器 (v6.2 M2)
|
|||
|
|
* Matcher: Write|Edit
|
|||
|
|
*
|
|||
|
|
* 合并 2 个 PreToolUse 钩子为单进程，减少 ~100ms 串行开销:
|
|||
|
|
* 1. block-sensitive-files (fail-close, 安全优先)
|
|||
|
|
* 2. constitution-precheck (fail-close, ERROR 级规则)
|
|||
|
|
*
|
|||
|
|
* 读取 stdin 一次，依次调用两个子模块的导出函数。
|
|||
|
|
* 退出码: 0=放行 | 2=阻断(deny/ask)
|
|||
|
|
*/
|
|||
|
|
|
|||
|
|
'use strict';
|
|||
|
|
|
|||
|
|
const path = require('path');
|
|||
|
|
const readStdin = require('./lib/read-stdin.js');
|
|||
|
|
|
|||
|
|
function main() {
|
|||
|
|
readStdin({ maxSize: 1024 * 1024 }).then(input => {
|
|||
|
|
// --- 阶段 1: block-sensitive-files (安全优先, fail-close) ---
|
|||
|
|
// 优先加载 block-sensitive-files.js; 若 disabled (.bak) 则尝试 .bak; 都不存在则跳过
|
|||
|
|
try {
|
|||
|
|
let bsf = null;
|
|||
|
|
try { bsf = require('./block-sensitive-files.js'); } catch {}
|
|||
|
|
if (!bsf || !bsf.checkFile) {
|
|||
|
|
try { bsf = require('./block-sensitive-files.js.bak'); } catch {}
|
|||
|
|
}
|
|||
|
|
if (bsf && bsf.checkFile) {
|
|||
|
|
const result = bsf.checkFile(input);
|
|||
|
|
if (result) {
|
|||
|
|
process.stderr.write(JSON.stringify({
|
|||
|
|
hookSpecificOutput: { permissionDecision: result.decision },
|
|||
|
|
systemMessage: result.message,
|
|||
|
|
}));
|
|||
|
|
process.exit(2);
|
|||
|
|
return;
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
// 模块不存在或无 checkFile 导出 → 视为 disabled，跳过
|
|||
|
|
} catch (e) {
|
|||
|
|
// block-sensitive-files 加载失败 → fail-close: ask
|
|||
|
|
process.stderr.write(JSON.stringify({
|
|||
|
|
hookSpecificOutput: { permissionDecision: 'ask' },
|
|||
|
|
systemMessage: `[安全防护] block-sensitive-files 模块加载失败(${e.message})，请用户确认是否继续。`,
|
|||
|
|
}));
|
|||
|
|
process.exit(2);
|
|||
|
|
return;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// --- 阶段 2: constitution-precheck (ERROR 级违规拦截) ---
|
|||
|
|
try {
|
|||
|
|
const { isEnabled } = require('../scripts/feature-flags.js');
|
|||
|
|
if (!isEnabled('constitution-precheck')) {
|
|||
|
|
process.exit(0);
|
|||
|
|
return;
|
|||
|
|
}
|
|||
|
|
} catch {}
|
|||
|
|
|
|||
|
|
try {
|
|||
|
|
const cp = require('./constitution-precheck.js');
|
|||
|
|
if (cp && cp.detectViolation && cp.extractContent && cp.CODE_EXTENSIONS) {
|
|||
|
|
const fp = input.tool_input?.file_path || '';
|
|||
|
|
if (fp && cp.CODE_EXTENSIONS.test(fp)) {
|
|||
|
|
const content = cp.extractContent(input.tool_input);
|
|||
|
|
if (content) {
|
|||
|
|
const v = cp.detectViolation(content);
|
|||
|
|
if (v) {
|
|||
|
|
// 记录安全事件
|
|||
|
|
try {
|
|||
|
|
const { logSecurityEvent } = require('./lib/security-log.js');
|
|||
|
|
logSecurityEvent('deny', 'constitution-precheck', v.id, fp);
|
|||
|
|
} catch {}
|
|||
|
|
|
|||
|
|
process.stderr.write(JSON.stringify({
|
|||
|
|
hookSpecificOutput: { permissionDecision: 'deny' },
|
|||
|
|
systemMessage: [
|
|||
|
|
'[constitution-precheck] ERROR 级违规，已阻断写入',
|
|||
|
|
`文件: ${path.basename(fp)}, 行: ${v.line}`,
|
|||
|
|
`规则: [${v.id}] ${v.label}`,
|
|||
|
|
'请修复后重试。参考: constitution/AI-CONSTITUTION.md 第十一章',
|
|||
|
|
].join('\n'),
|
|||
|
|
}));
|
|||
|
|
process.exit(2);
|
|||
|
|
return;
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
} catch {}
|
|||
|
|
|
|||
|
|
// 全部通过，放行
|
|||
|
|
process.exit(0);
|
|||
|
|
}).catch((e) => {
|
|||
|
|
// Fail-close: stdin 解析异常时 ask
|
|||
|
|
process.stderr.write(JSON.stringify({
|
|||
|
|
hookSpecificOutput: { permissionDecision: 'ask' },
|
|||
|
|
systemMessage: `[edit-precheck-dispatcher] 预检异常(${e.message})，请用户确认是否继续。`,
|
|||
|
|
}));
|
|||
|
|
process.exit(2);
|
|||
|
|
});
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if (typeof module !== 'undefined') {
|
|||
|
|
module.exports = { main };
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if (require.main === module) {
|
|||
|
|
main();
|
|||
|
|
}
|