feat: add system disclosure policy gate

system-disclosure-policy.mjs

@@ -0,0 +1,412 @@
+import { deriveUserFacingText } from './conversation-display.mjs';
+
+const CONFIG_TABLE = 'h5_system_disclosure_policy_config';
+const CONFIG_SCOPE = 'global';
+const POLICY_ID = 'system-disclosure';
+const DEFAULT_REFRESH_INTERVAL_MS = 5000;
+
+export const SYSTEM_DISCLOSURE_MODE = Object.freeze({
+  OFF: 'off',
+  SHADOW: 'shadow',
+  ENFORCE: 'enforce',
+});
+
+export const DEFAULT_SYSTEM_DISCLOSURE_REFUSAL =
+  '出于安全与隐私考虑，我不能提供 TKMind、Memind 或 MindSpace 的内部技术实现信息。我可以继续帮助你了解公开功能、使用方法、服务边界，或者讨论不针对本系统的一般性技术原理。';
+
+const DEFAULT_PRODUCT_NAMES = Object.freeze([
+  'tkmind',
+  'memind',
+  'mindspace',
+  '智趣',
+]);
+
+const DEFAULT_SELF_REFERENCES = Object.freeze([
+  '本系统',
+  '这个系统',
+  '该系统',
+  '你们系统',
+  '你们的系统',
+  '你们平台',
+  '你们的平台',
+  '这个平台',
+  '该平台',
+  '你的系统',
+  '你的平台',
+  '你们产品',
+  '你们的产品',
+]);
+
+const TECHNICAL_CATEGORY_PATTERNS = Object.freeze({
+  architecture: [
+    /(?:底层|内部|系统|技术|整体|服务|运行时|agent)\s*(?:架构|设计|实现|原理|机制)/iu,
+    /(?:架构|设计|实现|原理|机制)\s*(?:图|说明|细节|文档|方案|是什|怎么|如何)/iu,
+    /(?:技术栈|开发语言|编程语言|前端框架|后端框架|开源组件|内部组件|依赖版本|运行框架)/iu,
+    /(?:tkmind|memind|mindspace).{0,24}(?:关系|区别|协作|调用链|怎么工作|如何工作)/iu,
+    /\b(?:architecture|internals?|implementation|system design|runtime design)\b/iu,
+  ],
+  model_and_routing: [
+    /(?:模型|大模型|llm|provider|供应商).{0,18}(?:选择|路由|调用|切换|配置|名称|版本|怎么|如何|哪些|什么)/iu,
+    /(?:使用|采用|接入|调用).{0,12}(?:什么|哪个|哪些)?(?:模型|大模型|llm|agent\s*框架)/iu,
+    /(?:意图识别|意图路由|任务路由|模型路由|agent\s*编排|智能体编排)/iu,
+    /\b(?:model routing|intent routing|agent orchestration|provider routing)\b/iu,
+  ],
+  prompts_and_memory: [
+    /(?:系统提示词|system\s*prompt|隐藏提示词|内部提示词|开发者提示词|developer\s*message)/iu,
+    /(?:记忆|memory|上下文).{0,18}(?:注入|召回|存储|实现|机制|路由|拼接|读取)/iu,
+  ],
+  tools_and_extensions: [
+    /(?:工具|扩展|插件|skill|mcp).{0,18}(?:清单|列表|数量|名称|调用|编排|配置|内部|有哪些|多少)/iu,
+    /(?:agent|智能体).{0,18}(?:数量|几个|名称|分工|清单|列表|怎么协作|如何协作)/iu,
+    /(?:几个|多少|哪些).{0,8}(?:agent|智能体|工具|扩展|插件)/iu,
+    /(?:sandbox-fs|developer\s*tool|tool\s*gateway|extension\s*override)/iu,
+  ],
+  data_and_deployment: [
+    /(?:数据库|存储|数据层|表结构|schema).{0,18}(?:类型|选型|结构|实现|位置|连接|配置|怎么|如何|什么)/iu,
+    /(?:数据|文件|记忆).{0,12}(?:存在哪里|保存在哪|落在哪里|怎么保存|如何保存)/iu,
+    /(?:部署|拓扑|服务器|主机|端口|容器|运行目录|源码目录|仓库路径|内部\s*api|内部接口)/iu,
+    /(?:源码|代码|仓库).{0,12}(?:开源|位置|目录|结构|地址|在哪)/iu,
+    /\b(?:deployment|topology|database schema|source tree|internal api|host|port)\b/iu,
+  ],
+  security_boundaries: [
+    /(?:沙箱|权限|安全边界|防护|鉴权|认证|密钥|token).{0,18}(?:实现|机制|策略|配置|绕过|细节|怎么|如何)/iu,
+    /(?:越权|绕过|突破|规避).{0,18}(?:限制|防护|沙箱|鉴权|策略)/iu,
+    /\b(?:security boundary|sandbox escape|bypass|auth internals)\b/iu,
+  ],
+});
+
+const IMPLICIT_SELF_TECHNICAL_PATTERNS = Object.freeze([
+  /你(?:们)?(?:到底)?(?:使用|采用|接入|调用|运行).{0,12}(?:什么|哪个|哪些)?(?:模型|大模型|llm|数据库|框架|技术栈)/iu,
+  /你(?:们)?(?:使用|用了|有|部署).{0,8}(?:几个|多少|哪些).{0,8}(?:agent|智能体|工具|扩展|插件)/iu,
+  /你(?:们)?(?:的)?(?:底层|内部|后台).{0,12}(?:架构|实现|原理|机制|模型|技术栈)/iu,
+  /你(?:是|们是)?(?:怎么|如何).{0,18}(?:路由|编排|调用工具|保存记忆|部署|存储数据)/iu,
+]);
+
+function clone(value) {
+  if (typeof structuredClone === 'function') return structuredClone(value);
+  return JSON.parse(JSON.stringify(value));
+}
+
+function normalizeBoolean(value, fallback = false) {
+  if (value == null || value === '') return fallback;
+  if (typeof value === 'boolean') return value;
+  const normalized = String(value).trim().toLowerCase();
+  if (['1', 'true', 'yes', 'on'].includes(normalized)) return true;
+  if (['0', 'false', 'no', 'off'].includes(normalized)) return false;
+  return fallback;
+}
+
+function normalizeMode(value, fallback = SYSTEM_DISCLOSURE_MODE.SHADOW) {
+  const normalized = String(value ?? '').trim().toLowerCase();
+  return Object.values(SYSTEM_DISCLOSURE_MODE).includes(normalized)
+    ? normalized
+    : fallback;
+}
+
+function normalizeStringList(value, fallback) {
+  if (!Array.isArray(value)) return [...fallback];
+  const items = [...new Set(value.map((item) => String(item ?? '').trim()).filter(Boolean))];
+  return items.length ? items.slice(0, 100) : [...fallback];
+}
+
+function normalizeRefusalText(value) {
+  const normalized = String(value ?? '').trim();
+  return normalized
+    ? normalized.slice(0, 1000)
+    : DEFAULT_SYSTEM_DISCLOSURE_REFUSAL;
+}
+
+export function defaultSystemDisclosureConfig() {
+  return {
+    enabled: true,
+    mode: SYSTEM_DISCLOSURE_MODE.SHADOW,
+    refusalText: DEFAULT_SYSTEM_DISCLOSURE_REFUSAL,
+    productNames: [...DEFAULT_PRODUCT_NAMES],
+    selfReferences: [...DEFAULT_SELF_REFERENCES],
+    categories: Object.fromEntries(
+      Object.keys(TECHNICAL_CATEGORY_PATTERNS).map((key) => [key, true]),
+    ),
+  };
+}
+
+export function normalizeSystemDisclosureConfig(input = {}, fallback = defaultSystemDisclosureConfig()) {
+  const source = input && typeof input === 'object' && !Array.isArray(input) ? input : {};
+  const base = fallback && typeof fallback === 'object' ? fallback : defaultSystemDisclosureConfig();
+  const next = {
+    enabled: normalizeBoolean(source.enabled, base.enabled),
+    mode: normalizeMode(source.mode, base.mode),
+    refusalText: normalizeRefusalText(source.refusalText ?? base.refusalText),
+    productNames: normalizeStringList(source.productNames, base.productNames),
+    selfReferences: normalizeStringList(source.selfReferences, base.selfReferences),
+    categories: {},
+  };
+  for (const key of Object.keys(TECHNICAL_CATEGORY_PATTERNS)) {
+    next.categories[key] = normalizeBoolean(source.categories?.[key], base.categories?.[key] !== false);
+  }
+  if (!next.enabled) next.mode = SYSTEM_DISCLOSURE_MODE.OFF;
+  return next;
+}
+
+function parseJsonLike(value, fallback) {
+  if (value == null || value === '') return fallback;
+  if (typeof value === 'object') return value;
+  try {
+    return JSON.parse(String(value));
+  } catch {
+    return fallback;
+  }
+}
+
+function normalizeText(value) {
+  return String(value ?? '')
+    .normalize('NFKC')
+    .replace(/\s+/g, ' ')
+    .trim()
+    .toLowerCase();
+}
+
+function includesAny(text, values) {
+  return values.some((value) => text.includes(normalizeText(value)));
+}
+
+function matchingCategories(text, config) {
+  const matched = [];
+  for (const [category, patterns] of Object.entries(TECHNICAL_CATEGORY_PATTERNS)) {
+    if (config.categories?.[category] === false) continue;
+    if (patterns.some((pattern) => pattern.test(text))) matched.push(category);
+  }
+  return matched;
+}
+
+export function extractSystemDisclosureMessageText(message) {
+  const displayText = String(message?.metadata?.displayText ?? '').trim();
+  if (displayText) return deriveUserFacingText(displayText);
+  if (typeof message?.content === 'string') return deriveUserFacingText(message.content);
+  if (!Array.isArray(message?.content)) {
+    return deriveUserFacingText(message?.text ?? message?.value ?? '');
+  }
+  return deriveUserFacingText(message.content
+    .filter((item) => item?.type === 'text')
+    .map((item) => String(item.text ?? '').trim())
+    .filter(Boolean)
+    .join('\n'));
+}
+
+export function evaluateSystemDisclosureText(text, configInput = defaultSystemDisclosureConfig()) {
+  const config = normalizeSystemDisclosureConfig(configInput);
+  const normalizedText = normalizeText(text);
+  const base = {
+    policyId: POLICY_ID,
+    policyVersion: null,
+    mode: config.mode,
+    action: 'allow',
+    matched: false,
+    enforced: false,
+    reasonCode: null,
+    categories: [],
+    responseText: null,
+  };
+  if (!config.enabled || config.mode === SYSTEM_DISCLOSURE_MODE.OFF || !normalizedText) {
+    return base;
+  }
+
+  const categories = matchingCategories(normalizedText, config);
+  if (!categories.length) return base;
+
+  const explicitProduct = includesAny(normalizedText, config.productNames);
+  const explicitSelfReference = includesAny(normalizedText, config.selfReferences);
+  const implicitSelfTechnical = IMPLICIT_SELF_TECHNICAL_PATTERNS.some((pattern) =>
+    pattern.test(normalizedText));
+  if (!explicitProduct && !explicitSelfReference && !implicitSelfTechnical) return base;
+
+  const enforced = config.mode === SYSTEM_DISCLOSURE_MODE.ENFORCE;
+  return {
+    ...base,
+    action: enforced ? 'refuse' : 'allow',
+    wouldAction: 'refuse',
+    matched: true,
+    enforced,
+    reasonCode: 'SYSTEM_TECHNICAL_DISCLOSURE',
+    categories,
+    responseText: enforced ? config.refusalText : null,
+  };
+}
+
+async function ensureConfigTable(pool) {
+  await pool.query(`
+    CREATE TABLE IF NOT EXISTS ${CONFIG_TABLE} (
+      config_scope VARCHAR(32) PRIMARY KEY,
+      config_json JSON NOT NULL,
+      policy_version BIGINT NOT NULL DEFAULT 1,
+      updated_by CHAR(36) NULL,
+      updated_at BIGINT NOT NULL
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+  `);
+}
+
+async function loadStoredState(pool) {
+  await ensureConfigTable(pool);
+  const [rows] = await pool.query(
+    `SELECT config_json, policy_version, updated_by, updated_at
+       FROM ${CONFIG_TABLE}
+      WHERE config_scope = ?
+      LIMIT 1`,
+    [CONFIG_SCOPE],
+  );
+  const row = rows[0];
+  if (!row) return null;
+  return {
+    config: normalizeSystemDisclosureConfig(
+      parseJsonLike(row.config_json, defaultSystemDisclosureConfig()),
+    ),
+    policyVersion: Math.max(1, Number(row.policy_version ?? 1) || 1),
+    updatedBy: row.updated_by ?? null,
+    updatedAt: Number(row.updated_at ?? 0) || null,
+  };
+}
+
+export function createSystemDisclosurePolicyService(
+  pool,
+  {
+    refreshIntervalMs = DEFAULT_REFRESH_INTERVAL_MS,
+    logger = console,
+    autoRefresh = true,
+  } = {},
+) {
+  let state = {
+    config: defaultSystemDisclosureConfig(),
+    policyVersion: 0,
+    updatedBy: null,
+    updatedAt: null,
+    source: 'default',
+    refreshedAt: null,
+    lastRefreshError: null,
+  };
+  let refreshTimer = null;
+  let refreshPromise = null;
+
+  async function refresh() {
+    if (refreshPromise) return refreshPromise;
+    refreshPromise = (async () => {
+      try {
+        const stored = await loadStoredState(pool);
+        state = {
+          config: stored?.config ?? defaultSystemDisclosureConfig(),
+          policyVersion: stored?.policyVersion ?? 0,
+          updatedBy: stored?.updatedBy ?? null,
+          updatedAt: stored?.updatedAt ?? null,
+          source: stored ? 'admin-db' : 'default',
+          refreshedAt: Date.now(),
+          lastRefreshError: null,
+        };
+      } catch (error) {
+        state = {
+          ...state,
+          refreshedAt: Date.now(),
+          lastRefreshError: error instanceof Error ? error.message : String(error),
+        };
+        logger?.warn?.(
+          '[system-disclosure-policy] refresh failed; keeping last-known-good snapshot:',
+          state.lastRefreshError,
+        );
+      } finally {
+        refreshPromise = null;
+      }
+      return clone(state);
+    })();
+    return refreshPromise;
+  }
+
+  function startAutoRefresh() {
+    if (!autoRefresh || refreshTimer || refreshIntervalMs <= 0) return;
+    refreshTimer = setInterval(() => {
+      void refresh();
+    }, refreshIntervalMs);
+    refreshTimer.unref?.();
+  }
+
+  function stopAutoRefresh() {
+    if (refreshTimer) clearInterval(refreshTimer);
+    refreshTimer = null;
+  }
+
+  return {
+    async initialize() {
+      await refresh();
+      startAutoRefresh();
+      return this.getRuntimeState();
+    },
+
+    close() {
+      stopAutoRefresh();
+    },
+
+    evaluate({ text, userMessage } = {}) {
+      const decision = evaluateSystemDisclosureText(
+        text ?? extractSystemDisclosureMessageText(userMessage),
+        state.config,
+      );
+      return {
+        ...decision,
+        policyVersion: state.policyVersion,
+      };
+    },
+
+    async refresh() {
+      return refresh();
+    },
+
+    getRuntimeState() {
+      return clone(state);
+    },
+
+    async getAdminConfig() {
+      const stored = await loadStoredState(pool);
+      return {
+        config: stored?.config ?? defaultSystemDisclosureConfig(),
+        policyVersion: stored?.policyVersion ?? 0,
+        updatedBy: stored?.updatedBy ?? null,
+        updatedAt: stored?.updatedAt ?? null,
+        source: stored ? 'admin-db' : 'default',
+      };
+    },
+
+    async updateAdminConfig(patch = {}, { updatedBy = null } = {}) {
+      const stored = await loadStoredState(pool);
+      const current = stored?.config ?? defaultSystemDisclosureConfig();
+      const patchConfig = patch?.config ?? patch;
+      const merged = normalizeSystemDisclosureConfig({
+        ...current,
+        ...patchConfig,
+        categories: {
+          ...current.categories,
+          ...(patchConfig?.categories ?? {}),
+        },
+      }, current);
+      const nextVersion = (stored?.policyVersion ?? 0) + 1;
+      const now = Date.now();
+      await ensureConfigTable(pool);
+      await pool.query(
+        `INSERT INTO ${CONFIG_TABLE}
+          (config_scope, config_json, policy_version, updated_by, updated_at)
+         VALUES (?, ?, ?, ?, ?)
+         ON DUPLICATE KEY UPDATE
+          config_json = VALUES(config_json),
+          policy_version = VALUES(policy_version),
+          updated_by = VALUES(updated_by),
+          updated_at = VALUES(updated_at)`,
+        [CONFIG_SCOPE, JSON.stringify(merged), nextVersion, updatedBy, now],
+      );
+      await refresh();
+      return this.getAdminConfig();
+    },
+  };
+}
+
+export const systemDisclosurePolicyInternals = {
+  CONFIG_SCOPE,
+  CONFIG_TABLE,
+  POLICY_ID,
+  TECHNICAL_CATEGORY_PATTERNS,
+  IMPLICIT_SELF_TECHNICAL_PATTERNS,
+};