@bushizhanghan/dsh-publish-gate 0.7.1 → 0.8.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.8.0
+
+- `tool-input-throws` (error): `publish_gate_tools` gained `fuzz` and `skip`. With `fuzz: true` it drives
+  every declared parameter with a wrong-typed value and reports the tools that throw instead of answering.
+  The host never validates a call against `parameters`, so those values really arrive — this rule exists
+  because the same sweep found 12 real crashes across this workspace's own plugins (a number reaching
+  `path.join` via `session`, `profile`, `casePath` and `workspace`), all of which handed the caller a raw
+  Node TypeError. Only a throw counts: a filter that ignores a number and returns the unfiltered list still
+  answers, and every optional boolean treats any truthy value the same way.
+- One finding per tool+parameter, not one per wrong value.
 ## 0.7.1
 
 - Fixed: a non-string `dir` made every path tool throw a raw Node `TypeError`

package/README.md

@@ -106,6 +106,7 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 | `tool-bad-parameter-type` | `parameters` 里某个 `type` 写错（`"strin"`）。宿主把 `parameters` 渲染进 prompt、但**从不校验**调用值，所以这个 typo 只是悄悄把类型提示弄丢 |
 | `tool-undeclared-param` | `execute` 读了 `args.x`，但 `parameters.properties` 里没有 `x`。模型只能传 schema 声明过的参数，所以这个值在真实调用里永远是 `undefined`——代码在，永远不跑，也不报错。`args.x`、`args['x']`、`const { x } = args` 三种写法都认 |
 | `tool-output-invalid` | 工具返回的东西**自己的 output schema 不收**。宿主每个结果都拿 schema 校验，不匹配就抛 `ToolOutputError`——工具从第一次调用起就不可用，而报错只给一个 JSON 路径，不给是哪行代码返回的。只有点名 `call` 真的调了才检查。这个插件自己踩过：schema 收紧成 `additionalProperties: false`，但有一条错误分支还在返回 `{ ok, error }` |
+| `tool-input-throws` | 把每个声明过的参数**塞一个错类型的值**去调，工具直接抛 `TypeError` 而不是回答。宿主从不拿 `parameters` 校验入参，所以这个值真的会到你的代码里——调用方拿到的是 `The "path" argument must be of type string`，插件日志里没有一行说是哪个工具。这条规则是在自己的工作区里跑出 **12 个真实崩溃** 之后才加的（`session`/`profile`/`casePath`/`workspace` 各一个入口），现在九个插件全绿。默认关：它会把每个工具都调一遍，用 `skip` 点名排除那些会开程序、写文件的 |
 
 ### 浏览器半边：侧栏面板到底会不会出现
 
@@ -214,7 +215,7 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 ## 开发
 
 ```sh
-node --test                      # 88 个引擎单测
+node --test                      # 90 个引擎单测
 node test/integration.test.mjs   # 27 条集成断言（9 个真实插件作 fixture）
 ```
 

package/lib/engine.js

@@ -1198,6 +1198,7 @@ ctx.tools = {
       hasExecute: typeof def?.execute === 'function',
       hasOutputSchema: Boolean(def && def.output && def.output.schema),
       schema: (def && def.output && def.output.schema) || null,
+      parameters: (def && def.parameters) || null,
       cardKind: card,
       undeclaredParams: undeclaredArgs(def),
       run: typeof def?.execute === 'function' ? def.execute : null,
@@ -1278,7 +1279,45 @@ try {
       calls.push({ name: entry.name, ok: false, timedOut: message === 'timed out', error: message })
     }
   }
-  emit({ ok: true, tools: registered.map(({ run, ...rest }) => rest), badParamTypes, calls })
+  // The host never validates tool input against \`parameters\`, so a number really
+  // does reach a path argument. Fuzzing every declared parameter with the wrong
+  // type found 12 crashes across this workspace's own plugins — each one a raw
+  // TypeError handed to the caller instead of an answer.
+  stage = 'fuzz'
+  const fuzzIssues = []
+  if (process.env.PG_FUZZ === '1') {
+    const skip = new Set(JSON.parse(process.env.PG_FUZZ_SKIP || '[]'))
+    const WRONG = {
+      string: [123, true, { a: 1 }, [1]],
+      boolean: ['yes', 1, {}],
+      number: ['n', {}, []],
+      array: ['x', 1, {}],
+      object: ['x', 1, []],
+    }
+    for (const entry of registered) {
+      if (!entry.run || skip.has(entry.name)) continue
+      const props = entry.parameters && entry.parameters.properties
+      if (!props || typeof props !== 'object') continue
+      for (const [param, spec] of Object.entries(props)) {
+        for (const bad of WRONG[spec && spec.type] || [123]) {
+          try {
+            await Promise.race([
+              Promise.resolve(entry.run({ [param]: bad }, { signal: undefined })),
+              new Promise((_, reject) => setTimeout(() => reject(new Error('timed out')), budget)),
+            ])
+          } catch (error) {
+            // Only a throw is a defect. A filter parameter that ignores a number
+            // and returns the unfiltered list still answers, and every optional
+            // boolean treats any truthy value the same way.
+            const message = String((error && error.message) || error)
+            if (message === 'timed out') continue
+            fuzzIssues.push({ tool: entry.name, param, value: JSON.stringify(bad), problem: message.slice(0, 200) })
+          }
+        }
+      }
+    }
+  }
+  emit({ ok: true, tools: registered.map(({ run, ...rest }) => rest), badParamTypes, calls, fuzzIssues })
 } catch (error) {
   emit({ ok: false, stage, error: String((error && error.message) || error) })
 }
@@ -1297,6 +1336,8 @@ export async function checkToolRegistrations(dir, opts = {}) {
         ...process.env,
         PG_CALLS: JSON.stringify(Array.isArray(opts.calls) ? opts.calls : []),
         PG_CALL_MS: String(opts.callTimeoutMs ?? 8000),
+        PG_FUZZ: opts.fuzz ? '1' : '0',
+        PG_FUZZ_SKIP: JSON.stringify(Array.isArray(opts.fuzzSkip) ? opts.fuzzSkip : []),
       },
     })
     const line = String(stdout).split('\n').filter((l) => l.startsWith('@@PG@@')).pop()
@@ -1428,6 +1469,23 @@ export async function checkToolRegistrations(dir, opts = {}) {
       ),
     )
   }
+  // One finding per tool+parameter: the first wrong value is enough to prove the
+  // guard is missing, and four findings for the same line is noise.
+  const fuzzSeen = new Set()
+  for (const issue of Array.isArray(payload.fuzzIssues) ? payload.fuzzIssues : []) {
+    const key = `${issue.tool}\u0000${issue.param}`
+    if (fuzzSeen.has(key)) continue
+    fuzzSeen.add(key)
+    out.push(
+      F(
+        'tool-input-throws',
+        'error',
+        `${issue.tool}(${issue.param}: ${issue.value}) — ${issue.problem}`,
+        'The host never validates a call against parameters, so this really reaches your code with the wrong type. The caller gets a raw Node TypeError instead of an answer, and nothing in the plugin log says which tool was at fault.',
+        `Guard the top of ${issue.tool}: if (typeof args.${issue.param} !== 'string') return { ok: false, error: '${issue.param} must be a string' }.`,
+      ),
+    )
+  }
   return { findings: out, tools }
 }
 
@@ -2104,7 +2162,7 @@ const RULE_ORDER = [
   'inject-missing-tools', 'inject-missing-web', 'inject-missing-webServer', 'inject-missing-timer',
   'inject-unused-service',
   'tool-missing-name', 'tool-duplicate-name', 'tool-missing-execute', 'tool-present-call-throws',
-  'tool-bad-card-kind', 'tool-missing-output-schema', 'tool-none-registered', 'tool-bad-parameter-type', 'tool-undeclared-param', 'tool-call-throws', 'tool-output-invalid', 'tool-call-slow',
+  'tool-bad-card-kind', 'tool-missing-output-schema', 'tool-none-registered', 'tool-bad-parameter-type', 'tool-undeclared-param', 'tool-input-throws', 'tool-call-throws', 'tool-output-invalid', 'tool-call-slow',
   'lib-debugger', 'lib-console-log', 'lib-hardcoded-path', 'lib-url-pathname', 'node-too-old', 'stale-build', 'hand-edited-build',
   'undeclared-import', 'dep-in-dev-only', 'unused-dependency',
   'pack-omits-lib', 'pack-omits-patch', 'pack-omits-client', 'pack-oversize', 'pack-omits-readme', 'pack-omits-license', 'pack-ships-secret',

package/lib/index.js

@@ -132,7 +132,7 @@ export function apply(ctx, config = {}) {
     {
       name: 'publish_gate_tools',
       description:
-        'Import a plugin entry in an isolated child process, call apply(ctx) with a no-op context, and report what it actually registered. Catches the failures the manifest cannot show: the entry throws when imported, apply throws, a tool has no execute function, two tools share a name, presentCall throws, and a card kind the host does not render (the host only knows other/execute/search/read/edit/delete/fetch — anything else registers fine and renders a broken card). 20 s timeout, plugin code never runs in the host process. Returns {ok, tools:[{name,hasExecute,hasOutputSchema,cardKind}], findings, report}.',
+        'Import a plugin entry in an isolated child process, call apply(ctx) with a no-op context, and report what it actually registered. Catches the failures the manifest cannot show: the entry throws when imported, apply throws, a tool has no execute function, two tools share a name, presentCall throws, and a card kind the host does not render (the host only knows other/execute/search/read/edit/delete/fetch — anything else registers fine and renders a broken card). Optional deeper modes: `call` runs named tools with {} and validates each result against its own output schema; `fuzz` drives every declared parameter with a wrong-typed value and reports the tools that throw a raw TypeError instead of answering — the host never validates a call against parameters, so those values really arrive. 20 s timeout, plugin code never runs in the host process. Returns {ok, tools:[{name,hasExecute,hasOutputSchema,cardKind}], findings, report}.',
       parameters: {
         type: 'object',
         properties: {
@@ -144,12 +144,27 @@ export function apply(ctx, config = {}) {
             description:
               'Tool names to actually call with empty arguments, e.g. ["page_watch_list"]. Off by default: some tools open applications or write files, so you name the ones you consider safe. A tool that throws on {} is a bug no other check can see, because registration never runs execute.',
           },
+          fuzz: {
+            type: 'boolean',
+            description:
+              'Drive every declared parameter with wrong-typed values (a number where a string is declared, and so on) and report the tools that throw instead of answering. The host never validates a call against parameters, so these values really reach your code. Off by default because it calls every tool — pass skip for the ones that launch applications or write files.',
+          },
+          skip: {
+            type: 'array',
+            items: { type: 'string' },
+            description: 'Tool names the fuzz must not call, e.g. ["weapp_open","of_run","page_watch_add"].',
+          },
         },
       },
       async execute(args) {
         const dir = resolveDir(args.dir)
         if (!dir) return { ok: false, error: 'no plugin directory given (dir must be a string path)' }
-        const { findings, tools } = await checkToolRegistrations(dir, { timeoutMs: args.timeoutMs, calls: args.call })
+        const { findings, tools } = await checkToolRegistrations(dir, {
+          timeoutMs: args.timeoutMs,
+          calls: args.call,
+          fuzz: args.fuzz,
+          fuzzSkip: args.skip,
+        })
         return { ok: true, tools, findings, report: renderReport(findings, { title: `runtime gate · ${dir}` }) }
       },
     },

package/package.json

@@ -1,52 +1,52 @@
-{
-  "name": "@bushizhanghan/dsh-publish-gate",
-  "version": "0.7.1",
-  "description": "Pre-publish gate for DSH plugins: manifest, dependencies, artifact, runtime, browser half, traceability and market readiness. 发布前的七层门禁。",
-  "type": "module",
-  "main": "lib/index.js",
-  "exports": {
-    ".": "./lib/index.js",
-    "./engine": "./lib/engine.js",
-    "./package.json": "./package.json"
-  },
-  "files": [
-    "lib",
-    "cordis.patch.yml",
-    "README.md",
-    "LICENSE",
-    "CHANGELOG.md"
-  ],
-  "keywords": [
-    "dsh",
-    "dsh-plugin",
-    "deepseek-harness",
-    "cordis",
-    "cordis-plugin",
-    "publish",
-    "preflight",
-    "npm",
-    "market",
-    "agent-tools"
-  ],
-  "author": "bushizhanghan",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/bushizhanghan/dsh-publish-gate.git"
-  },
-  "bugs": {
-    "url": "https://github.com/bushizhanghan/dsh-publish-gate/issues"
-  },
-  "homepage": "https://github.com/bushizhanghan/dsh-publish-gate#readme",
-  "engines": {
-    "node": ">=22"
-  },
-  "dsh": {
-    "bundle": {
-      "patch": "./cordis.patch.yml"
-    }
-  },
-  "scripts": {
-    "test": "node --test"
-  }
-}
+{
+  "name": "@bushizhanghan/dsh-publish-gate",
+  "version": "0.8.0",
+  "description": "Pre-publish gate for DSH plugins: manifest, dependencies, artifact, runtime, browser half, traceability and market readiness — plus an input fuzzer that drives every declared parameter with the wrong type. 发布前的七层门禁 + 入参模糊测试。",
+  "type": "module",
+  "main": "lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./engine": "./lib/engine.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "deepseek-harness",
+    "cordis",
+    "cordis-plugin",
+    "publish",
+    "preflight",
+    "npm",
+    "market",
+    "agent-tools"
+  ],
+  "author": "bushizhanghan",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/bushizhanghan/dsh-publish-gate.git"
+  },
+  "bugs": {
+    "url": "https://github.com/bushizhanghan/dsh-publish-gate/issues"
+  },
+  "homepage": "https://github.com/bushizhanghan/dsh-publish-gate#readme",
+  "engines": {
+    "node": ">=22"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "scripts": {
+    "test": "node --test"
+  }
+}