@feng0531/dsh-code-review 0.23.0 → 0.23.2

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # 变更记录
 
+## 0.23.2
+
+- .m使用已有快照前8KiB首个非空行提示区分Objective-C/MATLAB，.mm与Swift专用生命周期缺陷指引，不新读取。
+- 主输入按新侧/删除旧侧识别，复核复用主输入指引不增调用；258测试通过，识别非语义证明。
+
+## 0.23.1
+
+- 模板/IaC/协议schema按已捕获路径附缺陷检查：实际上下文转义、权限/破坏性资源变化、wire/client兼容/授权迁移风险。
+- 指引不证明执行/应用/约束，不增加读取/调用，不加风格审核；256测试通过。
+
 ## 0.23.0
 
 - 补Java/Go/Python/Rust/Kotlin/PHP缺陷检查及依赖清单/GitHub Actions专用风险指引；仅已捕获路径选择，不新读取/调用，不风格审核。

package/README.md

@@ -4,7 +4,7 @@
 
 ## 当前状态
 
-当前代码版本为 0.23.0
+当前代码版本为 0.23.2
 
 单提交审查直接读取原始commit头的父节点，不受浅克隆遍历边界影响；缺失父树明确失败且不自动fetch，不能把非根提交当空旧侧。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feng0531/dsh-code-review",
-  "version": "0.23.0",
+  "version": "0.23.2",
   "private": false,
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" },

package/src/defect-guidance.mjs

@@ -1,6 +1,9 @@
 // Original defect checklists, not executable rules or proof of a defect.
 const common = ['Only report a concrete defect with trigger, impact and changed-code evidence.', 'Check before/after behavior and counterexamples; absent context means uncertainty, not an invented contract.'];
 const checklists = {
+ objc: ['Check ARC/manual ownership, retain cycles, weak/unowned callbacks and Objective-C++ lifetime crossings against captured contracts.', 'Check observer/block cancellation and queue affinity before teardown; message to nil is not proof that required work completed.'],
+ swift: ['Check optional force unwraps and unowned captures against actual object lifetime and failure paths.', 'Check actor isolation, task cancellation, continuation completion exactly once and resources surviving asynchronous work.'],
+ matlab: ['Check matrix dimensions, elementwise versus matrix operations and indexing against captured input contracts.', 'Check empty/NaN values, numeric precision, resource cleanup and changed output shapes with actual consumers.'],
  java: ['Check checked/unchecked exception exits, try-with-resources ownership and suppressed failures.', 'Check null/unboxing, equality/hash contracts and mutable keys; confirm the actual consumer contract.', 'Check synchronization/volatile publication, executor shutdown, interruption propagation and transaction rollback.'],
  go: ['Check error handling including typed-nil interfaces, deferred cleanup and panic paths.', 'Check goroutine/channel ownership, cancellation, close/send races and synchronization before shared-state teardown.', 'Check slice backing-array aliasing, map races and integer/bounds contracts with concrete callers.'],
  python: ['Check exception paths, context manager cleanup, iterator exhaustion and mutable default/shared state.', 'Check async task exception observation, cancellation and blocking operations on the event loop.', 'Check untrusted serialization, subprocess/SQL interpolation and authorization boundaries against actual input flows.'],
@@ -12,11 +15,15 @@ const checklists = {
  javascript: ['Check null/undefined contract changes, promise rejection handling and missing await or cleanup on failure.', 'Check event/timer/listener lifecycle, closure state, cancellation races and concurrent updates.', 'Check untrusted input at injection/authentication boundaries; do not report style or infer TypeScript runtime checks.'],
  configuration: ['Check changed configuration keys against consumer/schema evidence, type/unit/default mismatches and compatibility.', 'Check exposed secrets, privilege expansion and unsafe interpolation only with concrete supported evidence.']
 };
-export function defectGuidance(filePath) {
+export function defectGuidance(filePath, sourceText = '') {
  const lower = filePath.toLowerCase();
- const specialized = /\.java$/.test(lower) ? 'java' : /\.go$/.test(lower) ? 'go' : /\.(py|pyi)$/.test(lower) ? 'python' : /\.rs$/.test(lower) ? 'rust' : /\.(kt|kts)$/.test(lower) ? 'kotlin' : /\.(php|phtml)$/.test(lower) ? 'php' : null;
+ const first = typeof sourceText === 'string' ? sourceText.slice(0,8192).split('\n').map(s=>s.trim()).find(Boolean) ?? '' : '';
+ const sniffed = lower.endsWith('.m') ? (/^(?:#(?:import|include|pragma|if|define)\b|@(?:import|interface|implementation|class|protocol)\b|\/\/|\/\*)/.test(first) ? 'objc' : 'matlab') : null;
+ const specialized = sniffed ?? (/\.mm$/.test(lower) ? 'objc' : /\.swift$/.test(lower) ? 'swift' : null) ?? (/\.java$/.test(lower) ? 'java' : /\.go$/.test(lower) ? 'go' : /\.(py|pyi)$/.test(lower) ? 'python' : /\.rs$/.test(lower) ? 'rust' : /\.(kt|kts)$/.test(lower) ? 'kotlin' : /\.(php|phtml)$/.test(lower) ? 'php' : null);
  const language = specialized ?? (/\.(c|cc|cpp|cxx|h|hh|hpp|hxx)$/.test(lower) ? 'cpp' : lower.endsWith('.cs') ? 'csharp' : /\.(js|jsx|mjs|cjs|ts|tsx)$/.test(lower) ? 'javascript' : /\.(json|yaml|yml|toml|ini|xml|properties)$/.test(lower) ? 'configuration' : 'generic');
  const fileType = /^\.github\/workflows\/.+\.(yaml|yml)$/.test(lower) ? 'github-workflow' : /(?:^|\/)(package\.json|cargo\.toml|pom\.xml|build\.gradle|composer\.json)$/.test(lower) ? 'dependency-manifest' : undefined;
+ const purpose = fileType ?? (/\.(ftl|ftlh|ftlx|hbs|mustache|jinja2|j2|pug|astro)$/.test(lower) ? 'template' : /\.(tf|hcl|tfvars|bicep|nix)$/.test(lower) ? 'infrastructure' : /\.(proto|thrift|capnp|graphql|gql|prisma)$/.test(lower) ? 'protocol-schema' : undefined);
+ const purposeChecks = purpose === 'template' ? ['Check escaping for the actual HTML/attribute/URL/script context, untrusted raw output and template execution boundaries.', 'Check missing/null variables and changed conditional branches against captured callers; do not invent engine defaults.'] : purpose === 'infrastructure' ? ['Check privilege/network exposure, secret/state handling and untrusted interpolation against actual provider semantics.', 'Check replacement/deletion, dependency order and changed defaults for concrete data loss or service disruption; configuration is not an applied plan.'] : purpose === 'protocol-schema' ? ['Check field identifier reuse, removed/renamed fields, type/nullability/default changes and wire/client compatibility against actual consumers.', 'Check resolver authorization, data exposure, migration constraints and referential integrity using captured implementation evidence; schema alone does not prove enforcement.'] : [];
  const typeChecks = fileType === 'github-workflow' ? ['Check event trust boundaries, token permissions and fork/PR-controlled inputs before privileged commands or secret exposure.', 'Check expression interpolation into shell commands, checkout/ref provenance, artifact/cache trust and required job dependency gates.'] : fileType === 'dependency-manifest' ? ['Check changed dependency versions/features against consumers, lock/resolution evidence and runtime compatibility; do not invent a vulnerability from a package name.', 'Check executable install/build hooks, publish/export entry points and platform constraints for concrete changed behavior.'] : [];
- return { version:2, language, ...(fileType ? {fileType} : {}), checks:[...common,...(checklists[language] ?? []),...typeChecks], notice:'Guidance is not evidence, a semantic parser, a style rule or permission to read outside the snapshot.' };
+ return { version:4, language, ...(sniffed ? {selection:'bounded-first-nonblank-line-hint'} : {}), ...(purpose ? {fileType:purpose} : {}), checks:[...common,...(checklists[language] ?? []),...typeChecks,...purposeChecks], notice:'Guidance is not evidence, a semantic parser, a style rule or permission to read outside the snapshot.' };
 }

package/src/primary-input.mjs

@@ -12,7 +12,7 @@ import { initialInputBudget } from './input-budget.mjs';
 // Pure preparation over already captured data. No model calls or new reads.
 export function preparePrimaryInput(input, file, { instructions, scope, grouping, maxInputBytes }) {
   const changes = changeMap(file.left.text, file.right.text);
-  const base = { defectGuidance: defectGuidance(file.path), snapshotId: input.id, file, changes, context: input.context ?? [], rules: input.rules ?? [] };
+  const base = { defectGuidance: defectGuidance(file.path, file.rightExists === false ? file.left.text : file.right.text), snapshotId: input.id, file, changes, context: input.context ?? [], rules: input.rules ?? [] };
   const contextRelations = inferContextRelations(input, file);
   if (contextRelations.length) {
     base.contextRelations = contextRelations;

package/src/verification-loop.mjs

@@ -13,8 +13,9 @@ export async function verificationLoop(model, request, candidates, scope, option
   if (!Array.isArray(candidates) || candidates.length > 50) throw new Error('Invalid candidates');
   if (!candidates.length) return [];
   const ids = candidates.map((_, i) => 'c' + (i + 1));
-  const rules = request.input ? (JSON.parse(request.input).rules ?? []) : [];
-  const input = JSON.stringify({ defectGuidance: [...new Set(candidates.map(f => scope.catalog().find(s => s.fileId === f.fileId)?.path).filter(Boolean))].map(defectGuidance), rules, candidates: candidates.map((finding, i) => ({ candidateId: ids[i], finding })) });
+  const envelope = request.input ? JSON.parse(request.input) : {};
+  const rules = envelope.rules ?? [];
+  const input = JSON.stringify({ defectGuidance: [...new Set(candidates.map(f => scope.catalog().find(s => s.fileId === f.fileId)?.path).filter(Boolean))].map(path => envelope.file?.path === path && envelope.defectGuidance ? envelope.defectGuidance : defectGuidance(path)), rules, candidates: candidates.map((finding, i) => ({ candidateId: ids[i], finding })) });
   const receipts = createEvidenceReceipts(scope.read);
   const retrievalScope = { ...scope, read: receipts.read };
   const response = await retrievalLoop(model, { ...request, input, instructions: VERIFICATION_INSTRUCTIONS }, retrievalScope, options);