dsh-code-security 0.2.2

package/README.en.md

@@ -0,0 +1,27 @@
+# dsh-code-security
+
+> Every agent code change passes a local security scan before delivery.
+
+A DeepSeek Harness plugin for AI code security review: deterministic rule engine, git-diff incremental review, fix-verify loop, and policy gate. Methodology borrows from Codex security skills (evidence-first findings, severity ordering, supply-chain layers). Zero runtime dependencies.
+
+## Tools
+
+| Tool | Purpose | Write |
+| :-- | :-- | :-- |
+| `secure_scan` | Scan files with CWE/severity/line/snippet evidence | state |
+| `secure_diff` | Review only added lines of git diff | state |
+| `secure_fix_verify` | Compare with baseline: closed / remaining / fresh | state |
+| `secure_report` | Aggregate by rule/file with gate verdict | no |
+| `secure_export` | Export SARIF 2.1.0 / Markdown | file write approval |
+| `secure_baseline` | Accept current findings as baseline; gate on new issues only | approval |
+| `secure_deps` | SBOM-lite: parse dependency manifests and version-risk flags | no |
+| `secure_policy_show` | Show .code-security.json | no |
+| `secure_policy_set` | Replace policy JSON | approval |
+
+40+ deterministic rules: injection, deserialization, weak crypto, secrets, dangerous config, sensitive logging, path traversal, SSRF.
+
+```bash
+dsh plugin --profile web add dsh-code-security
+```
+
+MIT

package/README.md

@@ -0,0 +1,65 @@
+# dsh-code-security
+
+> 让 agent 每次改完代码，先过一道本地安全扫描，修复完了才准交付。
+
+DeepSeek Harness AI 代码安全审查插件：确定性规则引擎 + git diff 增量审查 + 修复闭环 + 策略门禁。借鉴 Codex 安全技能的方法论（漏洞分级、证据优先、供应链分层、Agent 安全），实现为可复现工具。零运行时依赖。
+
+## 工具
+
+| 工具 | 作用 | 写操作 |
+| :-- | :-- | :-- |
+| `secure_scan` | 扫描文件/目录，输出 CWE/严重度/行号/代码片段证据 | 写状态 |
+| `secure_diff` | 只审查 git diff 新增行 | 写状态 |
+| `secure_fix_verify` | 修复后复扫：关闭 / 仍存在 / 新引入 | 写状态 |
+| `secure_report` | 按规则/文件聚合 + 门禁结论 | 否 |
+| `secure_export` | 导出 SARIF 2.1.0 / Markdown 报告 | 写文件审批 |
+| `secure_baseline` | 接受当前已知问题为基线，之后只按新增判定 | 审批门 |
+| `secure_deps` | SBOM-lite：解析依赖清单与版本约束风险 | 否 |
+| `secure_policy_show` | 查看 .code-security.json 策略 | 否 |
+| `secure_policy_set` | 写入策略（排除/忽略/阈值） | 审批门 |
+
+## 规则覆盖（40+）
+
+- 注入：eval / exec / shell=True / SQL 拼接 / innerHTML
+- 反序列化：pickle / yaml.load / ObjectInputStream / Marshal / unserialize
+- 加密：弱哈希、ECB、硬编码 IV/密钥、JWT none、TLS 校验关闭
+- 凭据：硬编码密码、令牌、私钥、高熵密钥
+- 配置：chmod 777、Docker privileged / latest、npm audit=false、CORS *
+- 泄露：敏感日志、错误堆栈外发、路径穿越、SSRF
+
+发现只包含客观证据与 CWE 编号，不附修复建议——修复方案由 agent 基于证据生成。
+
+## 安装
+
+```bash
+dsh plugin --profile web add dsh-code-security
+```
+
+## 使用
+
+```text
+secure_scan { target: src }
+secure_diff { base: HEAD }
+secure_fix_verify { target: src }
+secure_baseline { reason: 历史遗留 }
+secure_deps { target: . }
+```
+
+策略示例（`.code-security.json`）：
+
+```json
+{
+  "version": 1,
+  "exclude": ["vendor/**", "generated/**"],
+  "ignore": [{ "ruleId": "SEC-206", "file": "test/**", "reason": "非安全敏感" }],
+  "failOn": "high"
+}
+```
+
+## 工程
+
+```bash
+pnpm test       # 构建 + 23 个测试
+```
+
+MIT

package/cordis.patch.yml

@@ -0,0 +1,17 @@
+# dsh-code-security 组合包补丁：把 AI 代码安全审查插件行插入 profile。
+#
+# 示例（用户 profile 的 cordis.patch.yml）：
+#   - id: code-security
+#     name: 'dsh-code-security'
+#     config:
+#       maxFiles: 5000
+#       maxFileBytes: 2097152
+#       failOn: medium
+#       stateDir: .code-security
+#
+- insert:
+    - id: code-security
+      name: 'dsh-code-security'
+      config:
+        maxFiles: 5000
+        failOn: medium

package/lib/config.d.ts

@@ -0,0 +1,23 @@
+/**
+ * dsh-code-security 配置解析：扫描边界、门禁阈值与状态目录。
+ *
+ * @module dsh-code-security/config
+ */
+export type Severity = 'critical' | 'high' | 'medium' | 'low';
+export interface SecureConfig {
+    maxFiles?: number;
+    maxFileBytes?: number;
+    failOn?: Severity;
+    stateDir?: string;
+}
+export interface ResolvedSecureConfig {
+    maxFiles: number;
+    maxFileBytes: number;
+    failOn: Severity;
+    stateDir: string;
+}
+export declare const DEFAULT_EXCLUDE_DIRS: string[];
+export declare function resolveConfig(config: SecureConfig | undefined | null, cwd?: string): ResolvedSecureConfig;
+export declare function optionalString(args: Record<string, unknown>, key: string): string | undefined;
+export declare function requiredString(args: Record<string, unknown>, key: string, label: string): string;
+export declare function optionalInteger(args: Record<string, unknown>, key: string, label: string, lo: number, hi: number, fallback: number): number;

package/lib/config.js

@@ -0,0 +1,46 @@
+/**
+ * dsh-code-security 配置解析：扫描边界、门禁阈值与状态目录。
+ *
+ * @module dsh-code-security/config
+ */
+import path from 'node:path';
+export const DEFAULT_EXCLUDE_DIRS = ['node_modules', '.git', 'dist', 'build', 'out', 'coverage', '.next', '.cache', '.turbo', '.code-security'];
+export function resolveConfig(config, cwd = process.cwd()) {
+    const cfg = config ?? {};
+    let maxFiles = 5000;
+    if (cfg.maxFiles !== undefined) {
+        if (typeof cfg.maxFiles !== 'number' || !Number.isFinite(cfg.maxFiles) || cfg.maxFiles <= 0)
+            throw new Error('maxFiles 必须是大于 0 的数字。');
+        maxFiles = Math.min(100000, Math.max(10, Math.round(cfg.maxFiles)));
+    }
+    let maxFileBytes = 2 * 1024 * 1024;
+    if (cfg.maxFileBytes !== undefined) {
+        if (typeof cfg.maxFileBytes !== 'number' || !Number.isFinite(cfg.maxFileBytes) || cfg.maxFileBytes <= 0)
+            throw new Error('maxFileBytes 必须是大于 0 的数字（字节）。');
+        maxFileBytes = Math.min(20 * 1024 * 1024, Math.max(64 * 1024, Math.round(cfg.maxFileBytes)));
+    }
+    const failOn = cfg.failOn === 'critical' || cfg.failOn === 'high' || cfg.failOn === 'medium' || cfg.failOn === 'low' ? cfg.failOn : 'medium';
+    const stateDir = typeof cfg.stateDir === 'string' && cfg.stateDir.trim() !== '' ? path.resolve(cwd, cfg.stateDir.trim()) : path.join(cwd, '.code-security');
+    return { maxFiles, maxFileBytes, failOn, stateDir };
+}
+export function optionalString(args, key) {
+    const value = args[key];
+    return typeof value === 'string' && value.trim() !== '' ? value.trim() : undefined;
+}
+export function requiredString(args, key, label) {
+    const value = optionalString(args, key);
+    if (value === undefined)
+        throw new Error(label + '（参数 ' + key + '）为必填，请提供非空字符串。');
+    return value;
+}
+export function optionalInteger(args, key, label, lo, hi, fallback) {
+    const value = args[key];
+    if (value === undefined || value === null)
+        return fallback;
+    if (typeof value !== 'number' || !Number.isFinite(value))
+        throw new Error(label + '（参数 ' + key + '）必须是数字。');
+    const rounded = Math.round(value);
+    if (rounded < lo || rounded > hi)
+        throw new Error(label + '（参数 ' + key + '）必须在 ' + lo + '-' + hi + ' 之间。');
+    return rounded;
+}

package/lib/deps.d.ts

@@ -0,0 +1,24 @@
+/**
+ * SBOM-lite：解析常见依赖清单，输出依赖名称、版本约束与风险标记。
+ * 只做确定性解析，不联网、不执行包管理器。
+ *
+ * @module dsh-code-security/deps
+ */
+export interface DependencyEntry {
+    name: string;
+    spec: string;
+    manager: 'npm' | 'pypi' | 'go' | 'cargo' | 'composer' | 'ruby';
+    file: string;
+    kind: 'runtime' | 'dev' | 'peer' | 'optional' | 'unknown';
+    risk: 'exact' | 'range' | 'unpinned' | 'git' | 'local' | 'wildcard';
+    note: string;
+}
+export interface DepsScanResult {
+    root: string;
+    filesScanned: number;
+    dependencies: DependencyEntry[];
+    riskyCount: number;
+    warnings: string[];
+}
+/** 扫描依赖清单，返回 SBOM-lite 结果。 */
+export declare function scanDeps(root: string): Promise<DepsScanResult>;

package/lib/deps.js

@@ -0,0 +1,179 @@
+/**
+ * SBOM-lite：解析常见依赖清单，输出依赖名称、版本约束与风险标记。
+ * 只做确定性解析，不联网、不执行包管理器。
+ *
+ * @module dsh-code-security/deps
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { DEFAULT_EXCLUDE_DIRS } from './config.js';
+const MANIFESTS = ['package.json', 'requirements.txt', 'pyproject.toml', 'go.mod', 'Cargo.toml', 'composer.json', 'Gemfile'];
+function asRecord(value) {
+    return typeof value === 'object' && value !== null ? value : {};
+}
+function riskOfSpec(spec) {
+    const s = spec.trim();
+    if (s === '')
+        return { risk: 'unpinned', note: '未声明版本约束' };
+    if (s === '*' || /^latest$/i.test(s) || /^x$/i.test(s))
+        return { risk: 'wildcard', note: '版本约束为通配' };
+    if (/^(?:https?|git|git+|github:)/i.test(s))
+        return { risk: /#([0-9a-f]{7,40})\b/i.test(s) ? 'exact' : 'git', note: /#/.test(s) ? 'git 源已带提交锁定' : 'git 源未锁定到提交' };
+    if (/^(?:file|link):/i.test(s))
+        return { risk: 'local', note: '本地/链接依赖，发布时会失配' };
+    if (/^[0-9]+(?:\.[A-Za-z0-9.*-]+)+$/.test(s) || /^==[0-9]/.test(s))
+        return { risk: 'exact', note: '' };
+    if (/[<>=~^]/.test(s) || s.includes('||'))
+        return { risk: 'range', note: '' };
+    return { risk: 'unpinned', note: '无法识别版本约束' };
+}
+function pushDeps(list, entries, manager, file, kind) {
+    for (const [name, rawSpec] of Object.entries(entries)) {
+        const spec = typeof rawSpec === 'string' ? rawSpec : '';
+        const { risk, note } = riskOfSpec(spec);
+        list.push({ name, spec, manager, file, kind, risk, note });
+    }
+}
+function parsePackageJson(text, file) {
+    try {
+        const pkg = JSON.parse(text);
+        const list = [];
+        pushDeps(list, asRecord(pkg.dependencies), 'npm', file, 'runtime');
+        pushDeps(list, asRecord(pkg.devDependencies), 'npm', file, 'dev');
+        pushDeps(list, asRecord(pkg.peerDependencies), 'npm', file, 'peer');
+        pushDeps(list, asRecord(pkg.optionalDependencies), 'npm', file, 'optional');
+        return list;
+    }
+    catch {
+        return [];
+    }
+}
+function parseRequirements(text, file) {
+    const list = [];
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (line === '' || line.startsWith('#') || line.startsWith('-'))
+            continue;
+        const m = /^([A-Za-z0-9_.\-]+)(.*)$/.exec(line);
+        if (m === null)
+            continue;
+        const spec = m[2]?.trim() ?? '';
+        const { risk, note } = riskOfSpec(spec);
+        list.push({ name: m[1], spec, manager: 'pypi', file, kind: 'runtime', risk, note });
+    }
+    return list;
+}
+function parsePyproject(text, file) {
+    const list = [];
+    const re = /^\s*([A-Za-z0-9_.\-]+)\s*(?:[<>=!~^]+[^\s,]+)?/gm;
+    for (const section of text.matchAll(/\[project\.(?:optional-)?dependencies\][\s\S]*?(?=\n\[|$)/g)) {
+        for (const line of section[0].split(/\r?\n/)) {
+            const trimmed = line.trim();
+            if (trimmed === '' || trimmed.startsWith('['))
+                continue;
+            const m = /^([A-Za-z0-9_.\-]+)\s*(.*)$/.exec(trimmed.replace(/^"|"$/g, ''));
+            if (m === null)
+                continue;
+            const spec = m[2]?.trim() ?? '';
+            const { risk, note } = riskOfSpec(spec);
+            list.push({ name: m[1], spec, manager: 'pypi', file, kind: 'runtime', risk, note });
+        }
+    }
+    return list;
+}
+function parseGoMod(text, file) {
+    const list = [];
+    const re = /^\s*([A-Za-z0-9_.\/\-]+)\s+(v[0-9][^\s]*)/gm;
+    for (const m of text.matchAll(re)) {
+        list.push({ name: m[1], spec: m[2], manager: 'go', file, kind: 'runtime', risk: 'exact', note: '' });
+    }
+    return list;
+}
+function parseCargo(text, file) {
+    const list = [];
+    for (const line of text.split(/\r?\n/)) {
+        const m = /^\s*([A-Za-z0-9_.\-]+)\s*=\s*(.+)$/.exec(line);
+        if (m === null)
+            continue;
+        const spec = m[2].trim().replace(/^["']|["']$/g, '');
+        const isGit = /git\s*=|branch\s*=|rev\s*=/.test(spec);
+        const risk = isGit ? (spec.includes('rev') ? 'exact' : 'git') : 'range';
+        list.push({ name: m[1], spec, manager: 'cargo', file, kind: 'runtime', risk, note: isGit && !spec.includes('rev') ? 'git 源未锁定 rev' : '' });
+    }
+    return list;
+}
+function parseComposer(text, file) {
+    const list = [];
+    try {
+        const pkg = JSON.parse(text);
+        for (const [key, entries] of [['require', 'runtime'], ['require-dev', 'dev']]) {
+            pushDeps(list, asRecord(pkg[key]), 'composer', file, entries);
+        }
+    }
+    catch {
+        // ignore malformed
+    }
+    return list;
+}
+function parseGemfile(text, file) {
+    const list = [];
+    for (const m of text.matchAll(/^\s*gem\s+['"]([^'"]+)['"]\s*(?:,\s*['"]([^'"]*)['"]\s*)?/gm)) {
+        const spec = m[2] ?? '';
+        const { risk, note } = riskOfSpec(spec);
+        list.push({ name: m[1], spec, manager: 'ruby', file, kind: 'runtime', risk, note });
+    }
+    return list;
+}
+/** 扫描依赖清单，返回 SBOM-lite 结果。 */
+export async function scanDeps(root) {
+    const dependencies = [];
+    const warnings = [];
+    let filesScanned = 0;
+    const visit = async (absolute, rel) => {
+        let stat;
+        try {
+            stat = await fs.stat(absolute);
+        }
+        catch {
+            return;
+        }
+        if (stat.isDirectory()) {
+            if (DEFAULT_EXCLUDE_DIRS.includes(path.basename(absolute)))
+                return;
+            const entries = await fs.readdir(absolute, { withFileTypes: true });
+            for (const entry of entries)
+                await visit(path.join(absolute, entry.name), rel === '' ? entry.name : rel + '/' + entry.name);
+            return;
+        }
+        const base = path.basename(absolute);
+        if (!MANIFESTS.includes(base))
+            return;
+        filesScanned += 1;
+        let text = '';
+        try {
+            text = await fs.readFile(absolute, 'utf8');
+        }
+        catch {
+            warnings.push('无法读取 ' + rel);
+            return;
+        }
+        if (base === 'package.json')
+            dependencies.push(...parsePackageJson(text, rel));
+        else if (base === 'requirements.txt')
+            dependencies.push(...parseRequirements(text, rel));
+        else if (base === 'pyproject.toml')
+            dependencies.push(...parsePyproject(text, rel));
+        else if (base === 'go.mod')
+            dependencies.push(...parseGoMod(text, rel));
+        else if (base === 'Cargo.toml')
+            dependencies.push(...parseCargo(text, rel));
+        else if (base === 'composer.json')
+            dependencies.push(...parseComposer(text, rel));
+        else if (base === 'Gemfile')
+            dependencies.push(...parseGemfile(text, rel));
+    };
+    await visit(root, '');
+    dependencies.sort((a, b) => a.file.localeCompare(b.file) || a.name.localeCompare(b.name));
+    const risky = dependencies.filter((item) => item.risk !== 'exact' && item.risk !== 'range');
+    return { root, filesScanned, dependencies, riskyCount: risky.length, warnings };
+}

package/lib/diff.d.ts

@@ -0,0 +1,29 @@
+/**
+ * git diff 增量扫描：只解析 unified diff 的新增行并映射到新文件行号。
+ *
+ * @module dsh-code-security/diff
+ */
+import type { Finding } from './scanner.js';
+import type { SecurePolicy } from './policy.js';
+import type { ProcessRunner } from './runner.js';
+export interface DiffLine {
+    line: number;
+    text: string;
+}
+export interface DiffFile {
+    file: string;
+    added: DiffLine[];
+}
+export interface DiffScanResult {
+    base: string;
+    filesChanged: number;
+    addedLines: number;
+    findings: Finding[];
+    diff: string;
+}
+/** 运行 git diff（默认 HEAD，工作区未提交改动）。 */
+export declare function runGitDiff(runner: ProcessRunner, cwd: string, base: string, target?: string, timeoutMs?: number, staged?: boolean): Promise<string>;
+/** 解析 unified diff，返回每个文件的新增行与新行号。 */
+export declare function parseDiff(diff: string, cwd: string): DiffFile[];
+/** 对 diff 新增行执行规则扫描。 */
+export declare function scanDiff(diff: string, cwd: string, policy: SecurePolicy): DiffScanResult;

package/lib/diff.js

@@ -0,0 +1,88 @@
+/**
+ * git diff 增量扫描：只解析 unified diff 的新增行并映射到新文件行号。
+ *
+ * @module dsh-code-security/diff
+ */
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { scanLineSet } from './scanner.js';
+/** 运行 git diff（默认 HEAD，工作区未提交改动）。 */
+export async function runGitDiff(runner, cwd, base, target, timeoutMs = 30000, staged = false) {
+    const argv = ['git', 'diff'];
+    if (staged)
+        argv.push('--cached');
+    argv.push('--no-ext-diff', '--unified=0', base);
+    if (target !== undefined && target.trim() !== '')
+        argv.push('--', target.trim());
+    const result = await runner.run(argv, { timeoutMs });
+    if (result.exitCode !== 0 && result.exitCode !== 1) {
+        throw new Error('git diff 失败（退出码 ' + String(result.exitCode) + '）：' + result.stderr.trim().split(/\r?\n/).slice(-4).join(' | '));
+    }
+    if (result.stdout.trim() === '')
+        return '';
+    return result.stdout;
+}
+function isNewFileHeader(line) {
+    const m = /^\+\+\+ b\/(.*)$/.exec(line);
+    if (m === null)
+        return null;
+    const file = m[1].replace(/\t.*$/, '');
+    if (file === '' || file === '/dev/null')
+        return null;
+    return file;
+}
+/** 解析 unified diff，返回每个文件的新增行与新行号。 */
+export function parseDiff(diff, cwd) {
+    const files = [];
+    let current = null;
+    let newLine = 0;
+    for (const raw of diff.split(/\r?\n/)) {
+        const file = isNewFileHeader(raw);
+        if (file !== null) {
+            current = { file: file.replace(/\\/g, '/'), added: [] };
+            files.push(current);
+            newLine = 0;
+            continue;
+        }
+        const hunk = /^@@\s+-\d+(?:,\d+)?\s+\+(\d+)(?:,\d+)?\s+@@/.exec(raw);
+        if (hunk !== null && current !== null) {
+            newLine = Number(hunk[1]);
+            continue;
+        }
+        if (current === null)
+            continue;
+        if (raw.startsWith('+++') || raw.startsWith('---'))
+            continue;
+        if (raw.startsWith('+')) {
+            current.added.push({ line: newLine, text: raw.slice(1) });
+            newLine += 1;
+        }
+        else if (raw.startsWith('-')) {
+            // removed line: new line number stays
+        }
+        else {
+            newLine += 1;
+        }
+    }
+    return files;
+}
+function makeDiffId(ruleId, file, line, snippet) {
+    const hash = createHash('sha256').update('diff|' + ruleId + '|' + file + '|' + line + '|' + snippet.slice(0, 80)).digest('hex').slice(0, 10);
+    return 'SRD-' + hash;
+}
+/** 对 diff 新增行执行规则扫描。 */
+export function scanDiff(diff, cwd, policy) {
+    const parsed = parseDiff(diff, cwd);
+    const findings = [];
+    let addedLines = 0;
+    for (const file of parsed) {
+        addedLines += file.added.length;
+        const rel = path.isAbsolute(file.file) ? path.relative(cwd, file.file) : file.file;
+        findings.push(...scanLineSet(file.added, rel, policy).map((finding) => ({ ...finding, id: makeDiffId(finding.ruleId, rel, finding.line, finding.snippet) })));
+    }
+    findings.sort((a, b) => severityOrder(b.severity) - severityOrder(a.severity) || a.file.localeCompare(b.file) || a.line - b.line);
+    return { base: 'HEAD', filesChanged: parsed.length, addedLines, findings, diff };
+}
+function severityOrder(severity) {
+    return severity === 'critical' ? 4 : severity === 'high' ? 3 : severity === 'medium' ? 2 : 1;
+}

package/lib/extra.d.ts

@@ -0,0 +1,8 @@
+/**
+ * 扩展工具：secure_baseline（基线接受）与 secure_deps（SBOM-lite）。
+ *
+ * @module dsh-code-security/extra
+ */
+import { type ResolvedSecureConfig } from './config.js';
+import type { SecureToolDefinition } from './tools.js';
+export declare function buildExtraTools(cfg: ResolvedSecureConfig, cwd: string): SecureToolDefinition[];

package/lib/extra.js

@@ -0,0 +1,108 @@
+/**
+ * 扩展工具：secure_baseline（基线接受）与 secure_deps（SBOM-lite）。
+ *
+ * @module dsh-code-security/extra
+ */
+import path from 'node:path';
+import { optionalString, requiredString } from './config.js';
+import { scanDeps } from './deps.js';
+import { loadState, saveBaseline } from './state.js';
+function compileParameters(spec) {
+    const properties = {};
+    const required = [];
+    for (const [key, prop] of Object.entries(spec)) {
+        if (prop?.required === true)
+            required.push(key);
+        const node = {};
+        if (typeof prop?.type === 'string')
+            node.type = prop.type;
+        if (typeof prop?.description === 'string')
+            node.description = prop.description;
+        properties[key] = node;
+    }
+    return { type: 'object', properties, ...(required.length > 0 ? { required } : {}) };
+}
+export function buildExtraTools(cfg, cwd) {
+    const stateDir = cfg.stateDir;
+    const secureBaseline = {
+        name: 'secure_baseline',
+        description: '把最近一次扫描的全部问题标记为已接受基线。之后 secure_scan / secure_diff / secure_report 只按基线外的新增问题判定门禁。写操作需要审批。',
+        parameters: compileParameters({
+            reason: { type: 'string', required: true, description: '接受这些已知问题的原因（会写入状态，例如：历史遗留，计划在 v1.2 修复）。' },
+        }),
+        output: {
+            schema: { type: 'object', properties: { file: { type: 'string' }, acceptedCount: { type: 'integer' }, baseline: { type: 'object', additionalProperties: true } }, additionalProperties: true },
+            render: (_args, value) => {
+                const rec = (value ?? {});
+                return [{ type: 'text', text: '已接受基线：' + String(rec.acceptedCount ?? 0) + ' 个已知问题（' + String(rec.file ?? '') + '）。' }];
+            },
+        },
+        async execute(rawArgs) {
+            const args = (rawArgs ?? {});
+            const reason = requiredString(args, 'reason', '接受原因');
+            const state = await loadState(stateDir);
+            if (state.last === null)
+                throw new Error('尚无扫描结果，请先执行 secure_scan 或 secure_diff。');
+            const baseline = {
+                time: new Date().toISOString(),
+                target: state.last.target,
+                reason,
+                findings: state.last.findings,
+                fingerprints: state.last.fingerprints,
+                counts: state.last.counts,
+            };
+            const file = await saveBaseline(stateDir, baseline);
+            return { file, acceptedCount: baseline.findings.length, baseline };
+        },
+        timeoutMs: 10000,
+    };
+    const secureDeps = {
+        name: 'secure_deps',
+        description: 'SBOM-lite：解析项目依赖清单（package.json / requirements.txt / pyproject.toml / go.mod / Cargo.toml / composer.json / Gemfile），列出依赖名称、版本约束与风险标记（wildcard/git/local/unpinned）。不联网。',
+        parameters: compileParameters({
+            target: { type: 'string', description: '扫描根目录（可选，默认当前工作区）。' },
+        }),
+        output: {
+            schema: {
+                type: 'object',
+                properties: {
+                    root: { type: 'string' }, filesScanned: { type: 'integer' }, riskyCount: { type: 'integer' },
+                    dependencies: { type: 'array', items: { type: 'object', additionalProperties: true } },
+                    warnings: { type: 'array', items: { type: 'string' } },
+                },
+                additionalProperties: true,
+            },
+            render: (_args, value) => {
+                const rec = (value ?? {});
+                const deps = Array.isArray(rec.dependencies) ? rec.dependencies : [];
+                const lines = ['依赖清单扫描：' + deps.length + ' 个依赖，风险项 ' + String(rec.riskyCount ?? 0) + ' 个。'];
+                for (const dep of deps) {
+                    const row = (dep ?? {});
+                    if (row.risk !== 'exact' && row.risk !== 'range')
+                        lines.push('- ' + String(row.name ?? '') + ' [' + String(row.risk ?? '') + '] ' + String(row.file ?? ''));
+                }
+                return [{ type: 'text', text: lines.join('\n') }];
+            },
+        },
+        async execute(rawArgs) {
+            const args = (rawArgs ?? {});
+            const target = optionalString(args, 'target');
+            const root = path.resolve(cwd, target ?? '.');
+            return scanDeps(root);
+        },
+        timeoutMs: 30000,
+    };
+    secureBaseline.gate = async (exec, next) => {
+        const record = (typeof exec === 'object' && exec !== null ? exec : {});
+        const approval = record.approval;
+        if (approval === undefined)
+            return { kind: 'deny', reason: 'secure_baseline 需要确认，但当前环境没有审批通道。' };
+        const outcome = await approval.request({ reason: '把当前全部安全问题接受为基线' });
+        if (outcome === 'allowed-once')
+            return next();
+        if (outcome === 'cancelled')
+            return { kind: 'deny', reason: '基线接受被取消，未执行。' };
+        return { kind: 'deny', reason: '基线接受未获批准。' };
+    };
+    return [secureBaseline, secureDeps];
+}

package/lib/index.d.ts

@@ -0,0 +1,36 @@
+/**
+ * dsh-code-security —— AI 代码安全审查插件（node 半身，配置走 cordis.patch.yml）。
+ *
+ * 插件导出 apply(ctx, config)：注册 secure_scan / secure_diff / secure_fix_verify /
+ * secure_report / secure_export / secure_policy_show / secure_policy_set 七个工具。扫描为纯确定性规则，
+ * git diff 通过官方 subprocess 服务执行，零运行时依赖。
+ *
+ * @module dsh-code-security
+ */
+import { type SecureConfig } from './config.js';
+import { type SubprocessSpawnLike } from './runner.js';
+import { type SecureToolDefinition } from './tools.js';
+export declare const inject: string[];
+export interface SecurePluginContext {
+    subprocess: {
+        spawn: SubprocessSpawnLike;
+    };
+    tools: {
+        register(definition: SecureToolDefinition, options?: {
+            prepend?: boolean;
+        }): () => void;
+    };
+    get?(name: 'approval'): unknown;
+    on?(event: string, listener: () => void): () => void;
+}
+export declare function apply(ctx: SecurePluginContext, config?: SecureConfig | null): void;
+export * from './config.js';
+export * from './deps.js';
+export * from './diff.js';
+export * from './policy.js';
+export * from './rules.js';
+export * from './runner.js';
+export * from './scanner.js';
+export * from './state.js';
+export * from './extra.js';
+export * from './tools.js';