@feng0531/dsh-code-review 0.17.0 → 0.18.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # 变更记录
 
+## 0.18.0
+
+- 原创C++/C#/JS-TS/配置缺陷指引按文件类型进入主输入和候选复核，计入输入预算，不新增读取调用或权限，不把清单当证据。
+- 持续源码对齐计划记录七项及验收，七项不当作完整清单；单批发布不结束总体目标。
+- 全量233项通过，真实模型质量未测。
+
 ## 0.17.0
 
 - 按用户选择的DSH工具权限执行，注册入口不再重复approval.request，不再要求allowModelSending开关；仅依赖tools/llm。

package/README.md

@@ -4,7 +4,7 @@
 
 ## 当前状态
 
-当前代码版本为 0.17.0，包含有界覆盖预检、显式项目规则及候选证据与反证复核；发布状态以 npm 和 GitHub Release 为准。已通过真实临时 Git/SVN 仓库测试，以及隔离进程中的真实 DSH ToolRuntime 注册验证。当前开发会话的实际预览已返回0.6.0的plan/rules字段，空变更预览与默认关闭外发已验证；已进行经宿主审批的六次小规模真实试跑，累计12次模型调用；四组合成正负例与历史修复对照符合预期，历史引入方向检出候选但引用复核未完成（partial）。不是独立盲测或整体质量证明。详情见 [试跑结果](evaluation/PILOT-RESULTS.md)。
+当前代码版本为 0.18.0，包含有界覆盖预检、显式项目规则及候选证据与反证复核；发布状态以 npm 和 GitHub Release 为准。已通过真实临时 Git/SVN 仓库测试，以及隔离进程中的真实 DSH ToolRuntime 注册验证。当前开发会话的实际预览已返回0.6.0的plan/rules字段，空变更预览与默认关闭外发已验证；已进行经宿主审批的六次小规模真实试跑，累计12次模型调用；四组合成正负例与历史修复对照符合预期，历史引入方向检出候选但引用复核未完成（partial）。不是独立盲测或整体质量证明。详情见 [试跑结果](evaluation/PILOT-RESULTS.md)。
 
 ## 工作区下多个子仓库（0.11.0）
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feng0531/dsh-code-review",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "private": false,
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" },

package/src/defect-guidance.mjs

@@ -0,0 +1,13 @@
+// Original defect checklists, not executable rules or proof of a defect.
+const common = ['Only report a concrete defect with trigger, impact and changed-code evidence.', 'Check before/after behavior and counterexamples; absent context means uncertainty, not an invented contract.'];
+const checklists = {
+ cpp: ['Check ownership, dangling references, double release and allocator/object lifetime across all exits.', 'Check stop publication, synchronization, join completion and remaining users before teardown; source order alone is not a happens-before proof.', 'Check exception/early-return resource cleanup, iterator invalidation, bounds, integer conversion and undefined behavior.', 'Do not assume macro expansion, overload binding, build flags or virtual dispatch targets without evidence.'],
+ csharp: ['Check IDisposable/async disposal, cancellation propagation and completion before releasing shared state.', 'Check nullability and actual runtime guards, event subscription lifetime, deferred enumeration and captured mutable state.', 'Check async exception observation, synchronization and thread-affinity; do not assume await establishes unrelated ordering.'],
+ javascript: ['Check null/undefined contract changes, promise rejection handling and missing await or cleanup on failure.', 'Check event/timer/listener lifecycle, closure state, cancellation races and concurrent updates.', 'Check untrusted input at injection/authentication boundaries; do not report style or infer TypeScript runtime checks.'],
+ configuration: ['Check changed configuration keys against consumer/schema evidence, type/unit/default mismatches and compatibility.', 'Check exposed secrets, privilege expansion and unsafe interpolation only with concrete supported evidence.']
+};
+export function defectGuidance(filePath) {
+ const lower = filePath.toLowerCase();
+ const language = /\.(c|cc|cpp|cxx|h|hh|hpp|hxx)$/.test(lower) ? 'cpp' : lower.endsWith('.cs') ? 'csharp' : /\.(js|jsx|mjs|cjs|ts|tsx)$/.test(lower) ? 'javascript' : /\.(json|yaml|yml|toml|ini|xml|properties)$/.test(lower) ? 'configuration' : 'generic';
+ return { version:1, language, checks:[...common,...(checklists[language] ?? [])], notice:'Guidance is not evidence, a semantic parser, a style rule or permission to read outside the snapshot.' };
+}

package/src/primary-input.mjs

@@ -1,3 +1,4 @@
+import { defectGuidance } from './defect-guidance.mjs';
 import { cppCallSites } from './cpp-call-sites.mjs';
 import { inferCsharpContext } from './csharp-context.mjs';
 import { inferImportRelations } from './import-relations.mjs';
@@ -11,7 +12,7 @@ import { initialInputBudget } from './input-budget.mjs';
 // Pure preparation over already captured data. No model calls or new reads.
 export function preparePrimaryInput(input, file, { instructions, scope, grouping, maxInputBytes }) {
   const changes = changeMap(file.left.text, file.right.text);
-  const base = { snapshotId: input.id, file, changes, context: input.context ?? [], rules: input.rules ?? [] };
+  const base = { defectGuidance: defectGuidance(file.path), snapshotId: input.id, file, changes, context: input.context ?? [], rules: input.rules ?? [] };
   const contextRelations = inferContextRelations(input, file);
   if (contextRelations.length) {
     base.contextRelations = contextRelations;

package/src/verification-loop.mjs

@@ -1,3 +1,4 @@
+import { defectGuidance } from './defect-guidance.mjs';
 import { createEvidenceReceipts } from './evidence-receipts.mjs';
 import { retrievalLoop } from './retrieval-loop.mjs';
 import { validateCandidateVerification } from './candidate-verification.mjs';
@@ -13,7 +14,7 @@ export async function verificationLoop(model, request, candidates, scope, option
   if (!candidates.length) return [];
   const ids = candidates.map((_, i) => 'c' + (i + 1));
   const rules = request.input ? (JSON.parse(request.input).rules ?? []) : [];
-  const input = JSON.stringify({ rules, candidates: candidates.map((finding, i) => ({ candidateId: ids[i], finding })) });
+  const input = JSON.stringify({ defectGuidance: [...new Set(candidates.map(f => scope.catalog().find(s => s.fileId === f.fileId)?.path).filter(Boolean))].map(defectGuidance), rules, candidates: candidates.map((finding, i) => ({ candidateId: ids[i], finding })) });
   const receipts = createEvidenceReceipts(scope.read);
   const retrievalScope = { ...scope, read: receipts.read };
   const response = await retrievalLoop(model, { ...request, input, instructions: VERIFICATION_INSTRUCTIONS }, retrievalScope, options);