@tomjerrygit/dsh-workspace-audit 0.1.0 → 0.2.0

package/README.md

@@ -6,9 +6,19 @@ Local-first workspace health audit for DeepSeek Harness. Read-only by design; no
 
 - Git: repository, remote, branch, dirty count, last commit, tags
 - Project: README, LICENSE, .gitignore, manifests, lockfiles, tests, docs, CI
+- Dependencies: manifests/lockfiles, unpinned requirements, `npm audit`/`pip-audit` when available
+- GitHub: latest release vs local tag, open issues, archived state, branch protection (public repos)
 - Size: source/scan size and known build/cache directories
 - Security hotspots: self-hosted runner triggered by `pull_request`, suspected key filenames (names only), `shell=True`/`exec`/`pickle.load` patterns
-- Risks: P0/P1/P2 list and a Markdown handover report
+- Risks: P0/P1/P2 list, risk filters, project comparison table, score trend history, and a Markdown handover report
+
+## Tests
+
+```sh
+node --test test/audit.test.mjs
+```
+
+The test suite uses a self-contained fixture workspace (`test/fixtures/basic`) and checks Git scanning, secret filename detection, workflow risk detection, dependency health, report rendering, GitHub remote parsing, and grading.
 
 ## Install
 

package/client.js

@@ -34,6 +34,15 @@ window.__ModuleLoader__.load({
       todo: 'TODO',
       noRisk: '未发现阻塞风险',
       commands: '启动/测试入口见各项目 README 与报告。',
+      filterAll: '全部风险',
+      comparison: '项目对比',
+      trend: '趋势',
+      deps: '依赖',
+      vulns: '漏洞',
+      github: 'GitHub',
+      release: 'Release',
+      branch: '分支保护',
+      noLock: '无锁文件',
     };
     const en = {
       panel: 'Workspace Audit',
@@ -64,6 +73,15 @@ window.__ModuleLoader__.load({
       todo: 'TODO',
       noRisk: 'No blocking risks found',
       commands: 'See each project README and report for run/test commands.',
+      filterAll: 'All risks',
+      comparison: 'Workspace comparison',
+      trend: 'Trend',
+      deps: 'Deps',
+      vulns: 'Vulns',
+      github: 'GitHub',
+      release: 'Release',
+      branch: 'Branch protection',
+      noLock: 'No lockfile',
     };
     const page = { display: 'flex', flexDirection: 'column', gap: '14px', padding: '24px 32px', minHeight: '100%', overflow: 'auto', color: 'var(--dsw-alias-label-primary)' };
     const card = { border: '1px solid var(--dsw-alias-border-l1)', borderRadius: '14px', padding: '14px', background: 'var(--dsw-alias-bg-layer-1)' };
@@ -82,6 +100,7 @@ window.__ModuleLoader__.load({
       const [scan, setScan] = React.useState(null);
       const [state, setState] = React.useState('loading');
       const [rootDraft, setRootDraft] = React.useState('');
+      const [riskFilter, setRiskFilter] = React.useState('all');
       const [copied, setCopied] = React.useState(false);
       const auth = () => token.length > 0 ? Promise.resolve(token) : fetch('/api/workspace-audit/auth').then((res) => res.json()).then((payload) => { setToken(payload.token); return payload.token; });
       const headers = (value) => ({ 'x-workspace-audit-token': value, accept: 'application/json' });
@@ -110,6 +129,7 @@ window.__ModuleLoader__.load({
       if (state === 'loading') return h('div', { style: page }, h('h1', { style: { margin: 0, fontSize: '22px' } }, t('title')), h('p', { style: { color: 'var(--dsw-alias-label-secondary)' } }, t('scanning')));
       if (state === 'failed' || scan === null) return h('div', { style: page }, h('h1', { style: { margin: 0, fontSize: '22px' } }, t('title')), h('p', { style: { color: 'var(--dsw-alias-label-secondary)' } }, t('failed')), h('button', { type: 'button', onClick: load }, t('scan')));
       const workspaces = Array.isArray(scan.workspaces) ? scan.workspaces : [];
+      const filteredWorkspaces = workspaces.filter((workspace) => riskFilter === 'all' || (workspace.risks || []).some((risk) => risk.severity === riskFilter));
       const avg = workspaces.length > 0 ? Math.round(workspaces.reduce((sum, workspace) => sum + workspace.score, 0) / workspaces.length) : 0;
       const p0 = workspaces.reduce((sum, workspace) => sum + workspace.risks.filter((risk) => risk.severity === 'P0').length, 0);
       return h('div', { style: page },
@@ -125,15 +145,31 @@ window.__ModuleLoader__.load({
         h('div', { style: { display: 'flex', gap: '8px', alignItems: 'center', flexWrap: 'wrap' } },
           h('input', { value: rootDraft, placeholder: t('rootPlaceholder'), onChange: (event) => setRootDraft(event.target.value), style: { flex: '1 1 260px', padding: '6px 8px' } }),
           h('button', { type: 'button', onClick: addRoot, disabled: rootDraft.trim().length === 0 }, t('add')),
+          ['all', 'P0', 'P1', 'P2'].map((severity) => h('button', { key: severity, type: 'button', onClick: () => setRiskFilter(severity), style: { fontWeight: riskFilter === severity ? 700 : 400 } }, severity === 'all' ? t('filterAll') : severity)),
           h('button', { type: 'button', onClick: copy }, copied ? t('copied') : t('copy')),
           h('button', { type: 'button', onClick: download }, t('download')),
         ),
         workspaces.length === 0 ? h('p', { style: { color: 'var(--dsw-alias-label-secondary)' } }, t('empty')) : null,
-        ...workspaces.map((workspace) => {
+        workspaces.length > 0 ? h('section', { style: card },
+          h('h2', { style: { margin: 0, fontSize: '16px' } }, t('comparison')),
+          h('div', { style: { overflowX: 'auto', marginTop: '8px' } },
+            h('table', { style: { width: '100%', borderCollapse: 'collapse', fontSize: '11px' } },
+              h('thead', null, h('tr', null, ['workspace', 'score', 'documentation', 'development', 'debugging', 'performance', 'functionality', 'security', 'github', 'trend'].map((key) => h('th', { key, style: { textAlign: 'left', padding: '4px 6px', borderBottom: '1px solid var(--dsw-alias-border-l1)' } }, key)))),
+              h('tbody', null, workspaces.map((workspace) => h('tr', { key: workspace.path },
+                h('td', { style: { padding: '4px 6px' } }, workspace.title),
+                h('td', { style: { padding: '4px 6px', fontWeight: 700, color: color(workspace.score) } }, workspace.score),
+                ...['documentation', 'development', 'debugging', 'performance', 'functionality', 'security', 'github'].map((key) => h('td', { key, style: { padding: '4px 6px' } }, workspace.dimensions[key])),
+                h('td', { key: 'trend', style: { padding: '4px 6px', color: workspace.trend && workspace.trend.delta > 0 ? 'var(--dsw-alias-state-success-primary)' : 'var(--dsw-alias-label-secondary)' } }, workspace.trend && workspace.trend.delta !== null ? (workspace.trend.delta >= 0 ? '+' : '') + workspace.trend.delta : '—'),
+              ))),
+            ),
+          ),
+        ) : null,
+        filteredWorkspaces.map((workspace) => {
           const risks = workspace.risks || [];
           return h('section', { key: workspace.path, style: card },
             h('div', { style: { display: 'flex', gap: '10px', alignItems: 'baseline', flexWrap: 'wrap' } },
               h('h2', { style: { margin: 0, fontSize: '16px', flex: '1 1 auto' } }, workspace.title),
+              workspace.trend && workspace.trend.delta !== null ? h('span', { style: { fontSize: '12px', color: workspace.trend.delta >= 0 ? 'var(--dsw-alias-state-success-primary)' : 'var(--dsw-alias-state-error-primary)' } }, (workspace.trend.delta >= 0 ? '+' : '') + workspace.trend.delta) : null,
               h('strong', { style: { fontSize: '20px', color: color(workspace.score) } }, workspace.score + ' ' + grade(workspace.score)),
             ),
             h('div', { style: { fontSize: '11px', color: 'var(--dsw-alias-label-secondary)', margin: '4px 0 8px' } }, t('path') + '：' + workspace.path),
@@ -143,6 +179,14 @@ window.__ModuleLoader__.load({
               h('span', null, t('tests') + ': ' + workspace.testFiles),
               h('span', null, t('todo') + ': ' + workspace.todo),
             ),
+            h('div', { style: { display: 'flex', gap: '14px', flexWrap: 'wrap', fontSize: '11px', color: 'var(--dsw-alias-label-secondary)', marginTop: '4px' } },
+              workspace.dependencies && workspace.dependencies.manifests.length > 0
+                ? h('span', null, t('deps') + ': ' + (workspace.dependencies.lockfiles.length > 0 ? 'lock ✓' : t('noLock')) + ' · ' + t('vulns') + ' ' + workspace.dependencies.vulnerabilities.total + (workspace.dependencies.vulnerabilities.status === 'skipped' ? ' (skipped)' : ''))
+                : null,
+              workspace.github
+                ? h('span', null, t('github') + ': ' + workspace.github.owner + '/' + workspace.github.repo + ' · ' + t('release') + ' ' + (workspace.github.latestRelease || '—') + ' · ' + t('branch') + ' ' + String(workspace.github.branchProtected))
+                : null,
+            ),
             h('div', { style: { display: 'flex', gap: '4px', flexWrap: 'wrap', marginTop: '8px' } },
               Object.entries(workspace.dimensions || {}).map(([key, value]) => h('span', { key, style: { fontSize: '10px', padding: '1px 6px', borderRadius: '999px', background: 'var(--dsw-alias-bg-layer-2)' } }, key + ' ' + value)),
             ),

package/index.js

@@ -17,6 +17,7 @@ const SETTINGS_PATH = ROUTE + '/settings';
 const MAX_WORKSPACES = 20;
 const SKIP_NAMES = new Set(['.git', 'node_modules', '.venv', 'venv', '__pycache__', '.pytest_cache', '.ruff_cache', '.mypy_cache', 'dist', 'build', 'target', '.next', '.nuxt', 'coverage']);
 const ARTIFACT_NAMES = new Set(['node_modules', '.venv', 'venv', '__pycache__', '.pytest_cache', '.ruff_cache', '.mypy_cache', 'dist', 'build', 'target', '.next', '.nuxt', 'coverage', 'release-archive', 'test+files', 'BeeOffice-v5.2.3-windows', 'BeeOffice_logs']);
+const GITHUB_CACHE = new Map();
 let authToken = null;
 
 function resolveDshHome() {
@@ -37,6 +38,24 @@ async function loadSettings() {
   }
 }
 
+function historyFile() {
+  return path.join(resolveDshHome(), 'workspace-audit', 'history.json');
+}
+
+async function loadHistory() {
+  try {
+    const raw = JSON.parse(await fs.readFile(historyFile(), 'utf8'));
+    return Array.isArray(raw.entries) ? raw.entries.slice(-30) : [];
+  } catch (error) {
+    return [];
+  }
+}
+
+async function saveHistory(entries) {
+  await fs.mkdir(path.dirname(historyFile()), { recursive: true });
+  await fs.writeFile(historyFile(), JSON.stringify({ entries: entries.slice(-30) }, null, 2) + '\n', 'utf8');
+}
+
 async function saveSettings(settings) {
   await fs.mkdir(path.dirname(settingsFile()), { recursive: true });
   await fs.writeFile(settingsFile(), JSON.stringify(settings, null, 2) + '\n', 'utf8');
@@ -180,6 +199,122 @@ async function gitInfo(root) {
   };
 }
 
+async function commandExists(command) {
+  try {
+    await execFileAsync(command, ['--version'], { timeout: 5000, windowsHide: true });
+    return true;
+  } catch (error) {
+    return false;
+  }
+}
+
+async function dependencyHealth(root) {
+  const entries = await fs.readdir(root, { withFileTypes: true }).catch(() => []);
+  const names = entries.map((entry) => entry.name);
+  const manifests = names.filter((name) => /^(package\.json|pyproject\.toml|requirements.*\.txt|Cargo\.toml|go\.mod|pom\.xml|build\.gradle)$/i.test(name));
+  const lockfiles = names.filter((name) => /^(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|poetry\.lock|uv\.lock|Cargo\.lock|go\.sum|gradle\.lockfile)$/i.test(name));
+  let unpinned = 0;
+  const requirementFile = names.find((name) => /^requirements.*\.txt$/i.test(name));
+  if (requirementFile) {
+    const text = await fs.readFile(path.join(root, requirementFile), 'utf8').catch(() => '');
+    unpinned += (text.match(/^[A-Za-z0-9_.-]+\s*(>=|~=|>)/gm) || []).length;
+  }
+  const vulnerabilities = { status: 'skipped', total: 0, tool: '' };
+  if (names.includes('package-lock.json')) {
+    const npmCommand = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+    if (await commandExists(npmCommand)) {
+      try {
+        const result = await execFileAsync(npmCommand, ['audit', '--json', '--package-lock-only', '--omit=dev'], { cwd: root, timeout: 30000, windowsHide: true, maxBuffer: 8 * 1024 * 1024 });
+        const parsed = JSON.parse(String(result.stdout || '{}'));
+        vulnerabilities.status = 'checked';
+        vulnerabilities.total = Number(parsed.metadata && parsed.metadata.vulnerabilities && parsed.metadata.vulnerabilities.total) || 0;
+        vulnerabilities.tool = 'npm audit';
+      } catch (error) {
+        try {
+          const parsed = JSON.parse(String(error.stdout || '{}'));
+          vulnerabilities.status = 'checked';
+          vulnerabilities.total = Number(parsed.metadata && parsed.metadata.vulnerabilities && parsed.metadata.vulnerabilities.total) || 0;
+          vulnerabilities.tool = 'npm audit';
+        } catch (inner) {
+          vulnerabilities.status = 'error';
+          vulnerabilities.tool = 'npm audit';
+        }
+      }
+    }
+  } else if (requirementFile) {
+    const pipAudit = process.platform === 'win32' ? 'pip-audit.exe' : 'pip-audit';
+    if (await commandExists(pipAudit)) {
+      try {
+        const result = await execFileAsync(pipAudit, ['-r', requirementFile, '--format', 'json'], { cwd: root, timeout: 30000, windowsHide: true, maxBuffer: 8 * 1024 * 1024 });
+        const parsed = JSON.parse(String(result.stdout || '[]'));
+        vulnerabilities.status = 'checked';
+        vulnerabilities.total = Array.isArray(parsed) ? parsed.reduce((sum, entry) => sum + (Array.isArray(entry.vulns) ? entry.vulns.length : 0), 0) : 0;
+        vulnerabilities.tool = 'pip-audit';
+      } catch (error) {
+        vulnerabilities.status = 'error';
+        vulnerabilities.tool = 'pip-audit';
+      }
+    }
+  }
+  return { manifests, lockfiles, unpinned, vulnerabilities };
+}
+
+function parseGitHubRemote(remote) {
+  const match = String(remote || '').match(/github\.com[:/]([^/]+)\/([^/]+?)(?:\.git)?$/i);
+  return match ? { owner: match[1], repo: match[2] } : null;
+}
+
+async function githubHealth(git) {
+  const parsed = parseGitHubRemote(git.remote);
+  if (!parsed) return null;
+  const key = parsed.owner.toLowerCase() + '/' + parsed.repo.toLowerCase();
+  const cached = GITHUB_CACHE.get(key);
+  if (cached && Date.now() - cached.at < 10 * 60 * 1000) return cached.value;
+  const token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN || '';
+  const headers = { accept: 'application/vnd.github+json', 'user-agent': 'dsh-workspace-audit' };
+  if (token) headers.authorization = 'Bearer ' + token;
+  const request = async (url) => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 8000);
+    try {
+      return await fetch(url, { headers, signal: controller.signal });
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+  const value = { provider: 'github', owner: parsed.owner, repo: parsed.repo };
+  try {
+    const repoRes = await request('https://api.github.com/repos/' + parsed.owner + '/' + parsed.repo);
+    if (repoRes.ok) {
+      const repo = await repoRes.json();
+      value.openIssues = repo.open_issues_count;
+      value.stars = repo.stargazers_count;
+      value.archived = repo.archived === true;
+      value.pushedAt = repo.pushed_at;
+      value.defaultBranch = repo.default_branch;
+      value.permissions = repo.permissions || null;
+    } else {
+      value.status = repoRes.status;
+    }
+    const releaseRes = await request('https://api.github.com/repos/' + parsed.owner + '/' + parsed.repo + '/releases/latest');
+    if (releaseRes.ok) {
+      const release = await releaseRes.json();
+      value.latestRelease = release.tag_name;
+      value.releaseName = release.name;
+      value.releasePublishedAt = release.published_at;
+    } else {
+      value.latestRelease = '';
+    }
+    const branch = git.branch || value.defaultBranch || 'main';
+    const protectionRes = await request('https://api.github.com/repos/' + parsed.owner + '/' + parsed.repo + '/branches/' + encodeURIComponent(branch) + '/protection');
+    value.branchProtected = protectionRes.ok ? true : protectionRes.status === 403 ? 'unknown' : false;
+  } catch (error) {
+    value.status = 'error';
+  }
+  GITHUB_CACHE.set(key, { at: Date.now(), value });
+  return value;
+}
+
 async function fileSize(file) {
   try {
     return (await fs.stat(file)).size;
@@ -226,6 +361,8 @@ function testFilePattern(name) {
 async function scanWorkspace(workspace) {
   const root = workspace.path;
   const git = await gitInfo(root);
+  const dependencies = await dependencyHealth(root);
+  const github = await githubHealth(git);
   const tracked = Array.isArray(git.tracked) ? git.tracked : [];
   const rootEntries = await fs.readdir(root, { withFileTypes: true }).catch(() => []);
   const markers = {
@@ -250,12 +387,10 @@ async function scanWorkspace(workspace) {
   const sourceFiles = tracked.filter((file) => isTextFile(file) && !file.includes('node_modules/')).slice(0, 400);
   let todo = 0;
   let dangerous = 0;
-  let secretFiles = [];
-  const readmeText = rootEntries.some((entry) => /^readme/i.test(entry.name)) ? await fs.readFile(path.join(root, rootEntries.find((entry) => /^readme/i.test(entry.name)).name), 'utf8').catch(() => '') : '';
-  for (const file of sourceFiles) {
-    const full = path.join(root, file);
-    const basename = path.basename(file).toLowerCase();
+  const secretFiles = [];
+  for (const file of tracked.slice(0, 3000)) {
     const sourceLike = /\.(py|js|mjs|cjs|ts|tsx|jsx|go|rs|c|h|cpp|java|kt|rb|php|sql)$/i.test(file);
+    const basename = path.basename(file).toLowerCase();
     const secretLike = !sourceLike && (
       /(^|\/)\.env(\.|$)/i.test(file) ||
       /\.(pem|key|p12|pfx|jks|keystore)$/i.test(file) ||
@@ -263,12 +398,17 @@ async function scanWorkspace(workspace) {
       basename === '.npmrc' || basename === '.pypirc'
     );
     if (secretLike) secretFiles.push(file);
+  }
+  for (const file of sourceFiles) {
+    const full = path.join(root, file);
     if (!/\.(py|js|mjs|cjs|ts|tsx|jsx|sh|ps1|bat|cmd|yml|yaml)$/i.test(file)) continue;
     const text = await fs.readFile(full, 'utf8').catch(() => '');
     if (text.length === 0) continue;
     todo += (text.match(/\b(TODO|FIXME|XXX|HACK)\b/g) || []).length;
     dangerous += (text.match(/shell\s*=\s*True|\bexec\s*\(|pickle\.load\s*\(/g) || []).length;
   }
+  const readmeEntry = rootEntries.find((entry) => /^readme/i.test(entry.name));
+  const readmeText = readmeEntry ? await fs.readFile(path.join(root, readmeEntry.name), 'utf8').catch(() => '') : '';
   const workflowsDir = path.join(root, '.github', 'workflows');
   const workflowFiles = await fs.readdir(workflowsDir, { withFileTypes: true }).catch(() => []);
   const workflows = [];
@@ -285,11 +425,11 @@ async function scanWorkspace(workspace) {
   const testFiles = tracked.filter((file) => testFilePattern(file)).length;
   const dimensions = {
     documentation: (markers.readme ? 35 : 0) + (markers.docs ? 25 : 0) + (readmeText.length > 4000 ? 20 : readmeText.length > 1000 ? 10 : 0) + (markers.license ? 20 : 0),
-    development: (markers.manifest ? 25 : 0) + (markers.lockfile ? 20 : 0) + (markers.gitignore ? 20 : 0) + (markers.ci ? 25 : 0) + (markers.docker ? 10 : 0),
+    development: (markers.manifest ? 25 : 0) + (dependencies.lockfiles.length > 0 ? 20 : 0) + (markers.gitignore ? 20 : 0) + (markers.ci ? 25 : 0) + (markers.docker ? 10 : 0),
     debugging: Math.min(100, testFiles * 6 + (markers.tests ? 20 : 0) + (markers.ci ? 20 : 0)),
     performance: Math.max(0, 100 - Math.min(80, Math.round(size.total / (1024 * 1024 * 50) * 10)) - (artifacts.length > 0 ? 20 : 0)),
     functionality: (markers.readme ? 30 : 0) + (tracked.length > 50 ? 35 : tracked.length > 10 ? 20 : 0) + (markers.tests ? 20 : 0) + (markers.ci ? 15 : 0),
-    security: Math.max(0, 100 - (git.isRepo && git.dirty > 0 ? 15 : 0) - Math.min(40, dangerous * 5) - (workflows.some((wf) => wf.selfHosted && wf.pullRequest) ? 40 : 0) - (secretFiles.length > 0 ? 20 : 0) - (git.isRepo && !git.remote ? 10 : 0)),
+    security: Math.max(0, 100 - (git.isRepo && git.dirty > 0 ? 15 : 0) - Math.min(40, dangerous * 5) - (workflows.some((wf) => wf.selfHosted && wf.pullRequest) ? 40 : 0) - (secretFiles.length > 0 ? 20 : 0) - (dependencies.vulnerabilities.total > 0 ? 30 : 0)),
     github: (git.isRepo ? 30 : 0) + (git.remote ? 30 : 0) + (git.dirty === 0 ? 20 : 0) + (git.tags && git.tags.length > 0 ? 20 : 0),
   };
   const score = Math.round(Object.values(dimensions).reduce((sum, value) => sum + value, 0) / 7);
@@ -308,14 +448,22 @@ async function scanWorkspace(workspace) {
     const huge = significantArtifacts.some((item) => item.bytes >= 1024 * 1024 * 1024);
     risks.push({ severity: huge ? 'P1' : 'P2', text: `发现构建/缓存目录：${significantArtifacts.map((item) => item.name + ' ' + Math.round(item.bytes / 1024 / 1024) + 'MB').join(', ')}。` });
   }
-  if (!markers.lockfile && markers.manifest) risks.push({ severity: 'P2', text: '有依赖清单但没有锁文件，构建不可复现。' });
+  if (dependencies.vulnerabilities.total > 0) risks.push({ severity: dependencies.vulnerabilities.total >= 5 ? 'P0' : 'P1', text: `${dependencies.vulnerabilities.tool || '依赖扫描'} 发现 ${dependencies.vulnerabilities.total} 个依赖漏洞。` });
+  if (dependencies.lockfiles.length === 0 && dependencies.manifests.length > 0) risks.push({ severity: 'P2', text: '依赖清单存在但没有检测到锁文件。' });
+  if (dependencies.unpinned > 5) risks.push({ severity: 'P2', text: `requirements 中有 ${dependencies.unpinned} 条非精确版本约束。` });
+  if (github && github.latestRelease && git.tags && git.tags.length > 0 && github.latestRelease !== git.tags[0]) risks.push({ severity: 'P2', text: `Git tag ${git.tags[0]} 与 GitHub latest release ${github.latestRelease} 不一致。` });
+  if (github && github.archived === true) risks.push({ severity: 'P2', text: 'GitHub 仓库已归档（archived）。' });
+  if (github && github.branchProtected === false) risks.push({ severity: 'P2', text: 'GitHub 默认分支未检测到保护规则。' });
   if (todo > 20) risks.push({ severity: 'P2', text: `源码中约 ${todo} 处 TODO/FIXME，建议建立清理计划。` });
   return {
     path: root,
     title: workspace.title,
     git,
     markers,
+    workflowFiles,
     workflows,
+    dependencies,
+    github,
     size: { bytes: size.total, scannedEntries: size.entries, artifacts },
     testFiles,
     todo,
@@ -340,6 +488,11 @@ function renderReport(workspaces) {
     lines.push(`## ${workspace.title}`, '', `- Path: \`${workspace.path}\``, `- Score: **${workspace.score}/100 (${grade(workspace.score)})**`, `- Git: ${workspace.git.isRepo ? workspace.git.branch + ' · ' + (workspace.git.remote || 'no remote') : 'not a repository'}`, `- Size: ${Math.round(workspace.size.bytes / 1024 / 1024)}MB`, `- Test files: ${workspace.testFiles}`, `- TODO/FIXME: ${workspace.todo}`, '');
     lines.push('### Dimensions', '');
     for (const [key, value] of Object.entries(workspace.dimensions)) lines.push(`- ${key}: ${value}/100`);
+    if (workspace.trend && workspace.trend.previousScore !== null) lines.push(`- Trend: ${workspace.trend.delta >= 0 ? '+' : ''}${workspace.trend.delta} from ${workspace.trend.previousScore}`);
+    if (workspace.dependencies && (workspace.dependencies.manifests.length > 0 || workspace.dependencies.lockfiles.length > 0)) {
+      lines.push(`- Dependencies: manifests=${workspace.dependencies.manifests.join(',') || 'none'}; lockfiles=${workspace.dependencies.lockfiles.join(',') || 'none'}; vulnerabilities=${workspace.dependencies.vulnerabilities.total} (${workspace.dependencies.vulnerabilities.status})`);
+    }
+    if (workspace.github) lines.push(`- GitHub: ${workspace.github.owner}/${workspace.github.repo}; release=${workspace.github.latestRelease || 'none'}; issues=${workspace.github.openIssues ?? '—'}; branchProtected=${workspace.github.branchProtected ?? '—'}`);
     lines.push('', '### Risks', '');
     if (workspace.risks.length === 0) lines.push('- No blocking risks found.');
     for (const risk of workspace.risks) lines.push(`- **${risk.severity}** ${risk.text}`);
@@ -353,6 +506,8 @@ async function runScan() {
   const discovered = await discoverWorkspaces(settings);
   const workspaces = [];
   const failures = [];
+  const previousEntries = await loadHistory();
+  const previous = previousEntries.length > 0 ? previousEntries[previousEntries.length - 1] : null;
   for (const workspace of discovered) {
     try {
       workspaces.push(await scanWorkspace(workspace));
@@ -361,6 +516,15 @@ async function runScan() {
     }
   }
   workspaces.sort((left, right) => left.score - right.score);
+  for (const workspace of workspaces) {
+    const before = previous && Array.isArray(previous.workspaces) ? previous.workspaces.find((entry) => entry.path === workspace.path) : null;
+    workspace.trend = { previousScore: before ? before.score : null, delta: before ? workspace.score - before.score : null };
+  }
+  const currentEntry = {
+    at: Date.now(),
+    workspaces: workspaces.map((workspace) => ({ path: workspace.path, score: workspace.score, dimensions: workspace.dimensions })),
+  };
+  await saveHistory([...previousEntries, currentEntry]).catch(() => {});
   return { generatedAt: Date.now(), workspaces, failures, discovered: discovered.length, report: renderReport(workspaces) };
 }
 
@@ -406,5 +570,5 @@ function apply(ctx) {
   ctx.effect(() => ctx.webServer.register({ kind: 'prefix', path: SETTINGS_PATH, handler: createSettingsRoute() }), 'workspace-audit: settings');
 }
 
-export { apply };
+export { apply, scanWorkspace, discoverWorkspaces, dependencyHealth, githubHealth, parseGitHubRemote, renderReport, grade };
 export const inject = ['webServer'];

package/package.json

@@ -1,7 +1,10 @@
 {
   "name": "@tomjerrygit/dsh-workspace-audit",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "private": false,
+  "scripts": {
+    "test": "node --test test/audit.test.mjs"
+  },
   "description": "Local-first workspace health audit for DeepSeek Harness: Git, tests, CI, size, security hotspots, and a Markdown handover report.",
   "type": "module",
   "engines": {