@feng0531/dsh-code-review 0.29.0 → 0.29.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # 变更记录
 
+## 0.29.1
+
+- 参考核心selection核实新增凭据路径不可覆盖门禁：.env家族模板例外、.ssh/私钥/包管理凭据纯路径排除。
+- Git改名旧新路径、SVN、历史blob、local context、规则与catalog统一拒绝，不读秘密正文，282测试通过。
+- 继续核心逐文件差距核查；默认复用当前DSH模型不增加独立配置。
+
 ## 0.29.0
 
 - 重建固定源码能力对照任务，区分已读行为/待读核心/功能缺口/安全替代；恢复持续目标96总轮检查点。

package/README.md

@@ -4,7 +4,9 @@
 
 ## 当前状态
 
-当前代码版本为 0.29.0
+当前代码版本为 0.29.1
+
+凭据路径硬排除：.env及其后缀（.env.example/.env.sample/.env.template例外）、.ssh目录、SSH私钥及.netrc/_netrc/.npmrc/.pypirc/.dockercfg，大小写无关；显式选择不可绕过，上下文/规则同样拒绝。仅路径策略，不保证普通文件无秘密。
 
 检索支持find批准catalog路径字面子串查找，返回来源身份/版本侧/hash；仅导航不证明正文已读，不搜索仓库外路径。当前持续任务见[核心对照任务](CORE-ALIGNMENT-TASKS.md)。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feng0531/dsh-code-review",
-  "version": "0.29.0",
+  "version": "0.29.1",
   "private": false,
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" },

package/src/content.mjs

@@ -1,3 +1,4 @@
+import { assertNonSecretPath } from './secret-path.mjs';
 import path from 'node:path';
 import { lstat, realpath, open } from 'node:fs/promises';
 import { createHash } from 'node:crypto';
@@ -17,6 +18,7 @@ export function decode(bytes) {
 }
 export async function readLocal(root, name, { maxFileBytes = 256 * 1024, signal } = {}) {
   relativePath(name);
+  assertNonSecretPath(name);
   if (!Number.isSafeInteger(maxFileBytes) || maxFileBytes < 1 || maxFileBytes > 16 * 1024 * 1024) throw new Error('Invalid file size limit');
   signal?.throwIfAborted();
   const canonicalRoot = await realpath(root);

package/src/git-history.mjs

@@ -1,3 +1,4 @@
+import { isSecretPath, assertNonSecretPath } from './secret-path.mjs';
 import {captureProjectRules} from './project-rules.mjs';
 import {contextCandidates} from './context-candidates.mjs';
 import {realpath} from 'node:fs/promises';
@@ -25,7 +26,7 @@ export async function captureGitHistory(cwd, options={}) {
  // Literal, nonrecursive lookups cannot enumerate a supplied directory or wildcard.
  const lookup=async (oid,map,requested)=>{if(!oid)return;const pending=[...new Set(requested)].filter(p=>!map.has(p));for(let i=0;i<pending.length;i++){const paths=pending.slice(i,i+1);paths.forEach(relativePath);const records=utf8(await git(root,['--literal-pathspecs','ls-tree','-z','--full-tree',oid,'--',...paths])).split('\0').filter(Boolean);for(const r of records){const m=/^(\d{6}) (blob|commit|tree) ([a-f0-9]+)\t([\s\S]+)$/.exec(r);if(!m||!paths.includes(m[4]))throw new Error('Invalid historical path lookup');map.set(m[4],{mode:m[1],type:m[2],oid:m[3]});}}};
  if(names.length>maxFiles)throw new Error('Historical change count limit exceeded');if(selectedPaths?.some(p=>!names.includes(p)))throw new Error('Selected path is not a historical change');
- const files=[];for(const name of names){signal?.throwIfAborted();const l=left.get(name),r=right.get(name),item={id:hash(name),path:name,rawStatus:!l?'A':!r?'D':'M',eligibility:'reviewable',properties:[]};files.push(item);if(selectedPaths&&!selectedPaths.includes(name)){item.eligibility='excluded';item.reason='Not explicitly selected';continue;}try{for(const e of [l,r].filter(Boolean))if(e.type!=='blob'||!['100644','100755'].includes(e.mode))throw new Error('Historical link or submodule excluded');const read=async e=>decode(e?await git(root,['cat-file','blob',e.oid],maxFileBytes):Buffer.alloc(0));item.left=await read(l);item.right=await read(r);item.rightExists=!!r;if(l&&r&&item.left.hash===item.right.hash){item.eligibility='excluded';item.reason='Mode-only historical change not analyzed';}}catch(error){signal?.throwIfAborted();item.eligibility='blocked';item.reason=error.message;delete item.left;delete item.right;}if(Buffer.byteLength(JSON.stringify(files))>maxSnapshotBytes)throw new Error('Historical snapshot limit exceeded');}
+ const files=[];for(const name of names){signal?.throwIfAborted();const l=left.get(name),r=right.get(name),item={id:hash(name),path:name,rawStatus:!l?'A':!r?'D':'M',eligibility:'reviewable',properties:[]};files.push(item);if(isSecretPath(name)){item.eligibility='excluded';item.reason='Credential path excluded';continue;}if(selectedPaths&&!selectedPaths.includes(name)){item.eligibility='excluded';item.reason='Not explicitly selected';continue;}try{for(const e of [l,r].filter(Boolean))if(e.type!=='blob'||!['100644','100755'].includes(e.mode))throw new Error('Historical link or submodule excluded');const read=async e=>decode(e?await git(root,['cat-file','blob',e.oid],maxFileBytes):Buffer.alloc(0));item.left=await read(l);item.right=await read(r);item.rightExists=!!r;if(l&&r&&item.left.hash===item.right.hash){item.eligibility='excluded';item.reason='Mode-only historical change not analyzed';}}catch(error){signal?.throwIfAborted();item.eligibility='blocked';item.reason=error.message;delete item.left;delete item.right;}if(Buffer.byteLength(JSON.stringify(files))>maxSnapshotBytes)throw new Error('Historical snapshot limit exceeded');}
  const rulePaths=options.rulePaths ?? [];
  const contextPaths=options.contextPaths ?? [], maxContextFiles=options.maxContextFiles ?? 20;
  if(!Array.isArray(contextPaths)||!Number.isSafeInteger(maxContextFiles)||maxContextFiles<1||maxContextFiles>20||contextPaths.length>maxContextFiles)throw new Error('Historical context file limit exceeded');
@@ -33,7 +34,7 @@ export async function captureGitHistory(cwd, options={}) {
  if(!Array.isArray(rulePaths)||rulePaths.length>4||rulePaths.some(p=>contextPaths.includes(p)))throw new Error('Rule paths must be separate from context paths');
  await lookup(target,right,[...contextPaths,...rulePaths]);await lookup(base,left,contextPaths);
  const context=[], regular=e=>e?.type==='blob'&&['100644','100755'].includes(e.mode);
- const captureContext=async name=>{relativePath(name);const changed=files.find(f=>f.path===name);if(changed){if(changed.eligibility!=='reviewable'||changed.rightExists===false)throw new Error('Historical context is excluded blocked or deleted');return {path:name,...changed.right};}const entry=right.get(name);if(!regular(entry))throw new Error('Historical context not a target regular blob');const content=decode(await git(root,['cat-file','blob',entry.oid],maxFileBytes));const previous=left.get(name);return {path:name,...content,revision:target,...(regular(previous)?{oldText:decode(await git(root,['cat-file','blob',previous.oid],maxFileBytes)).text,oldRevision:base}:{})};};
+ const captureContext=async name=>{relativePath(name);assertNonSecretPath(name);const changed=files.find(f=>f.path===name);if(changed){if(changed.eligibility!=='reviewable'||changed.rightExists===false)throw new Error('Historical context is excluded blocked or deleted');return {path:name,...changed.right};}const entry=right.get(name);if(!regular(entry))throw new Error('Historical context not a target regular blob');const content=decode(await git(root,['cat-file','blob',entry.oid],maxFileBytes));const previous=left.get(name);return {path:name,...content,revision:target,...(regular(previous)?{oldText:decode(await git(root,['cat-file','blob',previous.oid],maxFileBytes)).text,oldRevision:base}:{})};};
  for(const name of [...new Set(contextPaths)].sort())context.push(await captureContext(name));
  const rules=await captureProjectRules(root,rulePaths,{signal,files,read:async (_root,name,{maxFileBytes:limit})=>{const entry=right.get(name);if(!regular(entry))throw new Error('Historical rule not a target regular blob');return decode(await git(root,['cat-file','blob',entry.oid],limit));}});
  let autoContext;

package/src/git.mjs

@@ -1,3 +1,4 @@
+import { isSecretPath } from './secret-path.mjs';
 import { realpath } from 'node:fs/promises';
 import { run, checked } from './process.mjs';
 import { hash, decode, readLocal, relativePath } from './content.mjs';
@@ -46,6 +47,7 @@ export async function captureGit(cwd, options = {}) {
     signal?.throwIfAborted();
     const item = { ...change, id: hash(change.path), eligibility: 'reviewable', properties: [] };
     files.push(item);
+    if (isSecretPath(change.path) || isSecretPath(change.oldPath)) { item.eligibility='excluded'; item.reason='Credential path excluded'; continue; }
     if ((selectedPaths && !selectedPaths.includes(change.path)) || (change.rawStatus === '??' && !selectedPaths?.includes(change.path))) {
       item.eligibility = 'excluded'; item.reason = 'Not explicitly selected'; continue;
     }

package/src/project-rules.mjs

@@ -1,3 +1,4 @@
+import { assertNonSecretPath } from './secret-path.mjs';
 import { readLocal, relativePath } from './content.mjs';
 
 // Explicit paths only. This helper neither authorizes sending nor follows includes.
@@ -6,6 +7,7 @@ export async function captureProjectRules(root, paths, { signal, files = [], rea
   const seen = new Set();
   for (const name of paths) {
     relativePath(name);
+    assertNonSecretPath(name);
     if (!/[.](md|txt)$/i.test(name)) throw new Error('Rules must be Markdown or text');
     if (seen.has(name)) throw new Error('Duplicate rule path');
     seen.add(name);

package/src/retrieval-scope.mjs

@@ -1,3 +1,4 @@
+import { assertNonSecretPath } from './secret-path.mjs';
 import { createSnapshotReader } from './snapshot-reader.mjs';
 
 // Call only after authorization of this exact snapshot; this function grants nothing.
@@ -6,6 +7,7 @@ export function createRetrievalScope(snapshot, options) {
   const entries = [], catalog = [], paths = new Map(), identities = new Set();
   const add = (path, side, text, fileId) => {
     if (typeof text !== 'string') throw new Error('Missing retrieval text');
+    assertNonSecretPath(path);
     const id = 's' + (entries.length + 1);
     entries.push({ id, text, path, side });
     catalog.push({ id, path, side, ...(fileId ? { fileId } : {}) });

package/src/secret-path.mjs

@@ -0,0 +1,9 @@
+// Pure path policy; never inspect credential contents or infer safe contents.
+export function isSecretPath(value) {
+ if(typeof value!=='string')return false;
+ const parts=value.replaceAll('\\','/').toLowerCase().split('/'),base=parts.at(-1);
+ if(parts.includes('.ssh'))return true;
+ if(['id_rsa','id_dsa','id_ecdsa','id_ed25519','.netrc','_netrc','.npmrc','.pypirc','.dockercfg'].includes(base))return true;
+ return (base==='.env'||base.startsWith('.env.'))&&!['.env.example','.env.sample','.env.template'].includes(base);
+}
+export function assertNonSecretPath(path){if(isSecretPath(path))throw new Error('Credential path excluded');}

package/src/svn.mjs

@@ -1,3 +1,4 @@
+import { isSecretPath } from './secret-path.mjs';
 import { realpath, lstat } from 'node:fs/promises';
 import path from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
@@ -39,6 +40,7 @@ export async function captureSvn(cwd, options = {}) {
     const state = entry['wc-status'], status = state['@_item'];
     const item = { id: hash(name), path: name, rawStatus: status, baseRevision: state['@_revision'], eligibility: 'reviewable', properties: [] };
     files.push(item);
+    if (isSecretPath(name)) { item.eligibility='excluded'; item.reason='Credential path excluded'; continue; }
     if ((selectedPaths && !selectedPaths.includes(name)) || (status === 'unversioned' && !selectedPaths?.includes(name))) {
       item.eligibility = 'excluded'; item.reason = 'Not explicitly selected'; continue;
     }