@feng0531/dsh-code-review 0.22.3 → 0.23.1

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # 变更记录
 
+## 0.23.1
+
+- 模板/IaC/协议schema按已捕获路径附缺陷检查：实际上下文转义、权限/破坏性资源变化、wire/client兼容/授权迁移风险。
+- 指引不证明执行/应用/约束，不增加读取/调用，不加风格审核；256测试通过。
+
+## 0.23.0
+
+- 补Java/Go/Python/Rust/Kotlin/PHP缺陷检查及依赖清单/GitHub Actions专用风险指引；仅已捕获路径选择，不新读取/调用，不风格审核。
+- 全量255及新增主输入集成通过；参考更多语言/文件映射仍有差距，不宣称完整覆盖。
+
 ## 0.22.3
 
 - 修复浅克隆遍历隐藏父节点使非根提交误用空基线：改读原始commit头，仅真实无父节点使用空侧；缺失父树失败，不自动fetch。

package/README.md

@@ -4,7 +4,7 @@
 
 ## 当前状态
 
-当前代码版本为 0.22.3
+当前代码版本为 0.23.1
 
 单提交审查直接读取原始commit头的父节点，不受浅克隆遍历边界影响；缺失父树明确失败且不自动fetch，不能把非根提交当空旧侧。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feng0531/dsh-code-review",
-  "version": "0.22.3",
+  "version": "0.23.1",
   "private": false,
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" },

package/src/defect-guidance.mjs

@@ -1,6 +1,12 @@
 // Original defect checklists, not executable rules or proof of a defect.
 const common = ['Only report a concrete defect with trigger, impact and changed-code evidence.', 'Check before/after behavior and counterexamples; absent context means uncertainty, not an invented contract.'];
 const checklists = {
+ java: ['Check checked/unchecked exception exits, try-with-resources ownership and suppressed failures.', 'Check null/unboxing, equality/hash contracts and mutable keys; confirm the actual consumer contract.', 'Check synchronization/volatile publication, executor shutdown, interruption propagation and transaction rollback.'],
+ go: ['Check error handling including typed-nil interfaces, deferred cleanup and panic paths.', 'Check goroutine/channel ownership, cancellation, close/send races and synchronization before shared-state teardown.', 'Check slice backing-array aliasing, map races and integer/bounds contracts with concrete callers.'],
+ python: ['Check exception paths, context manager cleanup, iterator exhaustion and mutable default/shared state.', 'Check async task exception observation, cancellation and blocking operations on the event loop.', 'Check untrusted serialization, subprocess/SQL interpolation and authorization boundaries against actual input flows.'],
+ rust: ['Check unsafe pointer validity, aliasing, initialization, alignment and lifetime obligations against the safety contract.', 'Check panic/error cleanup, lock guards across await and deadlocks or cancellation between state updates.', 'Check integer conversions, indexing, FFI ownership and Send/Sync assumptions without treating compiler acceptance as runtime proof.'],
+ kotlin: ['Check nullable/platform types, unsafe casts and Java interoperability at actual runtime boundaries.', 'Check structured coroutine lifetime, cancellation propagation, exception supervision and shared state synchronization.', 'Check use/close cleanup, collection mutation and transaction failure paths.'],
+ php: ['Check coercion and loose comparison at authentication or validation boundaries with concrete input.', 'Check SQL/command/template injection, deserialization and output escaping in the actual execution context.', 'Check exception/early-return cleanup, transactions and session/concurrent request state.'],
  cpp: ['Check ownership, dangling references, double release and allocator/object lifetime across all exits.', 'Check stop publication, synchronization, join completion and remaining users before teardown; source order alone is not a happens-before proof.', 'Check exception/early-return resource cleanup, iterator invalidation, bounds, integer conversion and undefined behavior.', 'Do not assume macro expansion, overload binding, build flags or virtual dispatch targets without evidence.'],
  csharp: ['Check IDisposable/async disposal, cancellation propagation and completion before releasing shared state.', 'Check nullability and actual runtime guards, event subscription lifetime, deferred enumeration and captured mutable state.', 'Check async exception observation, synchronization and thread-affinity; do not assume await establishes unrelated ordering.'],
  javascript: ['Check null/undefined contract changes, promise rejection handling and missing await or cleanup on failure.', 'Check event/timer/listener lifecycle, closure state, cancellation races and concurrent updates.', 'Check untrusted input at injection/authentication boundaries; do not report style or infer TypeScript runtime checks.'],
@@ -8,6 +14,11 @@ const checklists = {
 };
 export function defectGuidance(filePath) {
  const lower = filePath.toLowerCase();
- const language = /\.(c|cc|cpp|cxx|h|hh|hpp|hxx)$/.test(lower) ? 'cpp' : lower.endsWith('.cs') ? 'csharp' : /\.(js|jsx|mjs|cjs|ts|tsx)$/.test(lower) ? 'javascript' : /\.(json|yaml|yml|toml|ini|xml|properties)$/.test(lower) ? 'configuration' : 'generic';
- return { version:1, language, checks:[...common,...(checklists[language] ?? [])], notice:'Guidance is not evidence, a semantic parser, a style rule or permission to read outside the snapshot.' };
+ const specialized = /\.java$/.test(lower) ? 'java' : /\.go$/.test(lower) ? 'go' : /\.(py|pyi)$/.test(lower) ? 'python' : /\.rs$/.test(lower) ? 'rust' : /\.(kt|kts)$/.test(lower) ? 'kotlin' : /\.(php|phtml)$/.test(lower) ? 'php' : null;
+ const language = specialized ?? (/\.(c|cc|cpp|cxx|h|hh|hpp|hxx)$/.test(lower) ? 'cpp' : lower.endsWith('.cs') ? 'csharp' : /\.(js|jsx|mjs|cjs|ts|tsx)$/.test(lower) ? 'javascript' : /\.(json|yaml|yml|toml|ini|xml|properties)$/.test(lower) ? 'configuration' : 'generic');
+ const fileType = /^\.github\/workflows\/.+\.(yaml|yml)$/.test(lower) ? 'github-workflow' : /(?:^|\/)(package\.json|cargo\.toml|pom\.xml|build\.gradle|composer\.json)$/.test(lower) ? 'dependency-manifest' : undefined;
+ const purpose = fileType ?? (/\.(ftl|ftlh|ftlx|hbs|mustache|jinja2|j2|pug|astro)$/.test(lower) ? 'template' : /\.(tf|hcl|tfvars|bicep|nix)$/.test(lower) ? 'infrastructure' : /\.(proto|thrift|capnp|graphql|gql|prisma)$/.test(lower) ? 'protocol-schema' : undefined);
+ const purposeChecks = purpose === 'template' ? ['Check escaping for the actual HTML/attribute/URL/script context, untrusted raw output and template execution boundaries.', 'Check missing/null variables and changed conditional branches against captured callers; do not invent engine defaults.'] : purpose === 'infrastructure' ? ['Check privilege/network exposure, secret/state handling and untrusted interpolation against actual provider semantics.', 'Check replacement/deletion, dependency order and changed defaults for concrete data loss or service disruption; configuration is not an applied plan.'] : purpose === 'protocol-schema' ? ['Check field identifier reuse, removed/renamed fields, type/nullability/default changes and wire/client compatibility against actual consumers.', 'Check resolver authorization, data exposure, migration constraints and referential integrity using captured implementation evidence; schema alone does not prove enforcement.'] : [];
+ const typeChecks = fileType === 'github-workflow' ? ['Check event trust boundaries, token permissions and fork/PR-controlled inputs before privileged commands or secret exposure.', 'Check expression interpolation into shell commands, checkout/ref provenance, artifact/cache trust and required job dependency gates.'] : fileType === 'dependency-manifest' ? ['Check changed dependency versions/features against consumers, lock/resolution evidence and runtime compatibility; do not invent a vulnerability from a package name.', 'Check executable install/build hooks, publish/export entry points and platform constraints for concrete changed behavior.'] : [];
+ return { version:3, language, ...(purpose ? {fileType:purpose} : {}), checks:[...common,...(checklists[language] ?? []),...typeChecks,...purposeChecks], notice:'Guidance is not evidence, a semantic parser, a style rule or permission to read outside the snapshot.' };
 }