45 lines
1.4 KiB
JavaScript
45 lines
1.4 KiB
JavaScript
|
/**
|
|||
|
|
* 共享安全事件日志模块 (M14)
|
|||
|
|
*
|
|||
|
|
* 替代 5 个 hook 中各自实现的 logSecurityEvent 函数。
|
|||
|
|
* 统一日志格式、脱敏策略和文件写入逻辑。
|
|||
|
|
*/
|
|||
|
|
|
|||
|
|
const fs = require('fs');
|
|||
|
|
const path = require('path');
|
|||
|
|
const { safeAppendJsonl } = require('./safe-append.js');
|
|||
|
|
|
|||
|
|
const CLAUDE_ROOT = require('./root.js');
|
|||
|
|
const DEBUG_DIR = path.join(CLAUDE_ROOT, 'debug');
|
|||
|
|
|
|||
|
|
// 脱敏函数（优先使用 sanitize.js）
|
|||
|
|
const _sanitize = (() => {
|
|||
|
|
try { return require('../../scripts/sanitize.js').sanitize; }
|
|||
|
|
catch { return (text) => (text || '').replace(/[A-Za-z0-9+/]{32,}/g, '[REDACTED]'); }
|
|||
|
|
})();
|
|||
|
|
|
|||
|
|
/**
|
|||
|
|
* 写入安全事件日志
|
|||
|
|
* @param {string} decision - 决策类型 (deny/ask/allow/auto-fix/hook-tamper 等)
|
|||
|
|
* @param {string} hook - hook 名称
|
|||
|
|
* @param {string} reason - 原因描述
|
|||
|
|
* @param {string} [detail] - 详细信息（会被脱敏和截断）
|
|||
|
|
*/
|
|||
|
|
function logSecurityEvent(decision, hook, reason, detail) {
|
|||
|
|
try {
|
|||
|
|
if (!fs.existsSync(DEBUG_DIR)) fs.mkdirSync(DEBUG_DIR, { recursive: true });
|
|||
|
|
const dateStr = new Date().toISOString().slice(0, 10);
|
|||
|
|
const logFile = path.join(DEBUG_DIR, `security-${dateStr}.jsonl`);
|
|||
|
|
const entry = {
|
|||
|
|
ts: new Date().toISOString(),
|
|||
|
|
decision,
|
|||
|
|
hook,
|
|||
|
|
reason,
|
|||
|
|
detail: _sanitize((detail || '').slice(0, 200)),
|
|||
|
|
};
|
|||
|
|
safeAppendJsonl(logFile, entry);
|
|||
|
|
} catch {}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
module.exports = { logSecurityEvent, _sanitize };
|