dsh-code-security 0.2.2

package/lib/state.d.ts

@@ -0,0 +1,60 @@
+/**
+ * 扫描状态持久化：供 secure_fix_verify 对比基线，secure_report 汇总历史，
+ * 以及 secure_baseline 持久化已接受的基线问题。
+ *
+ * @module dsh-code-security/state
+ */
+import type { Finding } from './scanner.js';
+export interface ScanStateEntry {
+    mode: string;
+    target: string;
+    time: string;
+    filesScanned: number;
+    findings: Finding[];
+    fingerprints: string[];
+    counts: {
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+    };
+}
+export interface BaselineEntry {
+    time: string;
+    target: string;
+    reason: string;
+    findings: Finding[];
+    fingerprints: string[];
+    counts: {
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+    };
+}
+export interface StateDocument {
+    last: ScanStateEntry | null;
+    history: ScanStateEntry[];
+    baseline: BaselineEntry | null;
+}
+export declare function findingFingerprint(finding: Finding): string;
+export declare function statePath(stateDir: string): string;
+export declare function loadState(stateDir: string): Promise<StateDocument>;
+export declare function saveState(stateDir: string, entry: ScanStateEntry): Promise<string>;
+export declare function saveBaseline(stateDir: string, baseline: BaselineEntry): Promise<string>;
+export declare function countFindings(findings: Finding[]): {
+    critical: number;
+    high: number;
+    medium: number;
+    low: number;
+};
+export declare function compareFingerprints(baseline: string[], current: string[]): {
+    closed: string[];
+    remaining: string[];
+    fresh: string[];
+};
+/** 根据已接受基线把发现分为新增与已接受。 */
+export declare function splitByBaseline(findings: Finding[], baseline: BaselineEntry | null): {
+    fresh: Finding[];
+    accepted: Finding[];
+};

package/lib/state.js

@@ -0,0 +1,89 @@
+/**
+ * 扫描状态持久化：供 secure_fix_verify 对比基线，secure_report 汇总历史，
+ * 以及 secure_baseline 持久化已接受的基线问题。
+ *
+ * @module dsh-code-security/state
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+const STATE_FILE = 'state.json';
+const HISTORY_LIMIT = 50;
+export function findingFingerprint(finding) {
+    const raw = finding.ruleId + '|' + finding.file + '|' + finding.snippet.trim();
+    return createHash('sha256').update(raw).digest('hex');
+}
+export function statePath(stateDir) {
+    return path.join(stateDir, STATE_FILE);
+}
+export async function loadState(stateDir) {
+    try {
+        const text = await fs.readFile(statePath(stateDir), 'utf8');
+        const parsed = JSON.parse(text);
+        const obj = (parsed ?? {});
+        const last = isEntry(obj.last) ? obj.last : null;
+        const history = Array.isArray(obj.history) ? obj.history.filter(isEntry) : [];
+        const baseline = isBaseline(obj.baseline) ? obj.baseline : null;
+        return { last, history, baseline };
+    }
+    catch {
+        return { last: null, history: [], baseline: null };
+    }
+}
+function isEntry(value) {
+    return typeof value === 'object' && value !== null && Array.isArray(value.findings);
+}
+function isBaseline(value) {
+    return typeof value === 'object' && value !== null && Array.isArray(value.findings) && Array.isArray(value.fingerprints);
+}
+export async function saveState(stateDir, entry) {
+    await fs.mkdir(stateDir, { recursive: true });
+    const state = await loadState(stateDir);
+    state.last = entry;
+    state.history.unshift(entry);
+    state.history = state.history.slice(0, HISTORY_LIMIT);
+    return writeState(stateDir, state);
+}
+export async function saveBaseline(stateDir, baseline) {
+    await fs.mkdir(stateDir, { recursive: true });
+    const state = await loadState(stateDir);
+    state.baseline = baseline;
+    return writeState(stateDir, state);
+}
+async function writeState(stateDir, state) {
+    const file = statePath(stateDir);
+    const tmp = file + '.tmp-' + process.pid;
+    await fs.writeFile(tmp, JSON.stringify(state, null, 2), 'utf8');
+    await fs.rename(tmp, file);
+    return file;
+}
+export function countFindings(findings) {
+    const counts = { critical: 0, high: 0, medium: 0, low: 0 };
+    for (const finding of findings)
+        counts[finding.severity] += 1;
+    return counts;
+}
+export function compareFingerprints(baseline, current) {
+    const oldSet = new Set(baseline);
+    const newSet = new Set(current);
+    return {
+        closed: baseline.filter((x) => !newSet.has(x)),
+        remaining: baseline.filter((x) => newSet.has(x)),
+        fresh: current.filter((x) => !oldSet.has(x)),
+    };
+}
+/** 根据已接受基线把发现分为新增与已接受。 */
+export function splitByBaseline(findings, baseline) {
+    if (baseline === null)
+        return { fresh: findings, accepted: [] };
+    const acceptedSet = new Set(baseline.fingerprints);
+    const fresh = [];
+    const accepted = [];
+    for (const finding of findings) {
+        if (acceptedSet.has(findingFingerprint(finding)))
+            accepted.push(finding);
+        else
+            fresh.push(finding);
+    }
+    return { fresh, accepted };
+}

package/lib/tools.d.ts

@@ -0,0 +1,30 @@
+/**
+ * 九个面向模型的安全审查工具：
+ * secure_scan / secure_diff / secure_fix_verify / secure_report / secure_export /
+ * secure_baseline / secure_deps / secure_policy_show / secure_policy_set。
+ *
+ * @module dsh-code-security/tools
+ */
+import { type ResolvedSecureConfig } from './config.js';
+import type { ProcessRunner } from './runner.js';
+export interface ContentBlock {
+    type: 'text';
+    text: string;
+}
+export interface SecureToolDefinition {
+    name: string;
+    description: string;
+    parameters: {
+        type: 'object';
+        properties: Record<string, unknown>;
+        required?: string[];
+    };
+    output: {
+        schema: Record<string, unknown>;
+        render(args: unknown, value: unknown): ContentBlock[];
+    };
+    execute(args: unknown, exec: unknown): Promise<unknown>;
+    gate?(exec: unknown, next: () => Promise<unknown>): Promise<unknown>;
+    timeoutMs?: number;
+}
+export declare function buildSecureTools(cfg: ResolvedSecureConfig, cwd: string, runner: ProcessRunner): SecureToolDefinition[];

package/lib/tools.js

@@ -0,0 +1,388 @@
+/**
+ * 九个面向模型的安全审查工具：
+ * secure_scan / secure_diff / secure_fix_verify / secure_report / secure_export /
+ * secure_baseline / secure_deps / secure_policy_show / secure_policy_set。
+ *
+ * @module dsh-code-security/tools
+ */
+import { writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { optionalString, requiredString } from './config.js';
+import { buildExtraTools } from './extra.js';
+import { runGitDiff, scanDiff } from './diff.js';
+import { loadPolicy, normalizePolicy, POLICY_FILE, savePolicy } from './policy.js';
+import { ruleCategory } from './rules.js';
+import { scanPath } from './scanner.js';
+import { compareFingerprints, countFindings, findingFingerprint, loadState, saveState, splitByBaseline } from './state.js';
+const SEVERITY_ORDER = { critical: 4, high: 3, medium: 2, low: 1 };
+function compileParameters(spec) {
+    const properties = {};
+    const required = [];
+    for (const [key, prop] of Object.entries(spec)) {
+        if (prop?.required === true)
+            required.push(key);
+        const node = {};
+        if (typeof prop?.type === 'string')
+            node.type = prop.type;
+        if (typeof prop?.description === 'string')
+            node.description = prop.description;
+        if (prop?.enum !== undefined)
+            node.enum = prop.enum;
+        properties[key] = node;
+    }
+    return { type: 'object', properties, ...(required.length > 0 ? { required } : {}) };
+}
+const findingSchema = {
+    type: 'object',
+    properties: {
+        id: { type: 'string' }, ruleId: { type: 'string' }, title: { type: 'string' }, cwe: { type: 'string' },
+        severity: { type: 'string' }, confidence: { type: 'string' }, file: { type: 'string' }, line: { type: 'integer' },
+        snippet: { type: 'string' }, message: { type: 'string' },
+    },
+    additionalProperties: true,
+};
+const countsSchema = {
+    type: 'object',
+    properties: { critical: { type: 'integer' }, high: { type: 'integer' }, medium: { type: 'integer' }, low: { type: 'integer' } },
+    additionalProperties: true,
+};
+const scanSchema = {
+    type: 'object',
+    properties: {
+        root: { type: 'string' }, filesScanned: { type: 'integer' }, filesSkipped: { type: 'integer' },
+        findings: { type: 'array', items: findingSchema }, counts: countsSchema, passed: { type: 'boolean' },
+        failOn: { type: 'string' }, durationMs: { type: 'integer' },
+        newFindings: { type: 'array', items: findingSchema }, newCounts: countsSchema,
+        acceptedFindings: { type: 'array', items: findingSchema },
+        baseline: { type: 'object', additionalProperties: true },
+    },
+    additionalProperties: true,
+};
+function verdictOf(findings, failOn) {
+    const threshold = SEVERITY_ORDER[failOn];
+    return !findings.some((finding) => SEVERITY_ORDER[finding.severity] >= threshold);
+}
+function baselineSummary(value) {
+    const rec = (value ?? {});
+    return {
+        fresh: Array.isArray(rec.newFindings) ? rec.newFindings : [],
+        accepted: Array.isArray(rec.acceptedFindings) ? rec.acceptedFindings : [],
+    };
+}
+function renderFindings(value) {
+    const rec = (value ?? {});
+    const findings = Array.isArray(rec.findings) ? rec.findings : [];
+    const counts = rec.counts;
+    const split = baselineSummary(value);
+    const lines = [
+        '安全审查：' + (rec.passed === true ? '通过' : '未通过'),
+        '文件 ' + String(rec.filesScanned ?? 0) + ' 个，发现 ' + findings.length + ' 个问题（critical ' + String(counts?.critical ?? 0) + ' / high ' + String(counts?.high ?? 0) + ' / medium ' + String(counts?.medium ?? 0) + ' / low ' + String(counts?.low ?? 0) + '）；基线外新增 ' + split.fresh.length + ' 个。',
+    ];
+    for (const finding of findings) {
+        lines.push('- ' + finding.file + ':' + finding.line + ' [' + finding.severity + '] ' + finding.ruleId + ' ' + finding.title);
+    }
+    return [{ type: 'text', text: lines.join('\n') }];
+}
+export function buildSecureTools(cfg, cwd, runner) {
+    const stateDir = cfg.stateDir;
+    const secureScan = {
+        name: 'secure_scan',
+        description: '扫描工作区（或指定文件/目录），用确定性规则检测注入、弱加密、硬编码密钥、危险配置等问题。结果写入 .code-security 状态供 secure_fix_verify 对比。',
+        parameters: compileParameters({
+            target: { type: 'string', description: '要扫描的文件或目录（可选，缺省扫描整个工作区）。' },
+        }),
+        output: { schema: scanSchema, render: renderFindings },
+        async execute(rawArgs) {
+            const args = (rawArgs ?? {});
+            const target = optionalString(args, 'target');
+            const policy = await loadPolicy(cwd);
+            const failOn = policy.failOn ?? cfg.failOn;
+            const result = await scanPath({ cwd, target, maxFiles: cfg.maxFiles, maxFileBytes: cfg.maxFileBytes, policy });
+            const state = await loadState(stateDir);
+            const counts = countFindings(result.findings);
+            const split = splitByBaseline(result.findings, state.baseline);
+            const entry = {
+                mode: target === undefined ? 'scan' : 'scan:' + target,
+                target: target ?? '.',
+                time: new Date().toISOString(),
+                filesScanned: result.filesScanned,
+                findings: result.findings,
+                fingerprints: result.findings.map(findingFingerprint),
+                counts,
+            };
+            const stateFile = await saveState(stateDir, entry);
+            return { ...result, counts, newFindings: split.fresh, newCounts: countFindings(split.fresh), acceptedFindings: split.accepted, baseline: state.baseline, passed: verdictOf(split.fresh, failOn), failOn, stateFile };
+        },
+        timeoutMs: 120000,
+    };
+    const secureDiff = {
+        name: 'secure_diff',
+        description: '只审查 git diff 的新增行（默认 HEAD，即未提交改动）。base 可用任意 git ref；staged=true 审查已暂存改动；target 可限定文件。结果同样写入状态。',
+        parameters: compileParameters({
+            base: { type: 'string', description: 'git 基线（默认 HEAD）。' },
+            target: { type: 'string', description: '限定文件路径（可选）。' },
+            staged: { type: 'boolean', description: '审查已暂存改动（git diff --cached，默认 false）。' },
+        }),
+        output: { schema: scanSchema, render: renderFindings },
+        async execute(rawArgs) {
+            const args = (rawArgs ?? {});
+            const base = optionalString(args, 'base') ?? 'HEAD';
+            const target = optionalString(args, 'target');
+            const policy = await loadPolicy(cwd);
+            const failOn = policy.failOn ?? cfg.failOn;
+            const diff = await runGitDiff(runner, cwd, base, target, 30000, args.staged === true);
+            const result = scanDiff(diff, cwd, policy);
+            const state = await loadState(stateDir);
+            const counts = countFindings(result.findings);
+            const split = splitByBaseline(result.findings, state.baseline);
+            const entry = {
+                mode: 'diff:' + base,
+                target: target ?? '.',
+                time: new Date().toISOString(),
+                filesScanned: result.filesChanged,
+                findings: result.findings,
+                fingerprints: result.findings.map(findingFingerprint),
+                counts,
+            };
+            await saveState(stateDir, entry);
+            return { root: base, filesScanned: result.filesChanged, filesSkipped: 0, addedLines: result.addedLines, findings: result.findings, counts, newFindings: split.fresh, newCounts: countFindings(split.fresh), acceptedFindings: split.accepted, baseline: state.baseline, passed: verdictOf(split.fresh, failOn), failOn, durationMs: 0 };
+        },
+        timeoutMs: 60000,
+    };
+    const secureFixVerify = {
+        name: 'secure_fix_verify',
+        description: '复扫并与上次扫描基线对比，输出已关闭、仍存在、新引入的问题指纹。用于修复后确认没有按下葫芦浮起瓢。',
+        parameters: compileParameters({
+            target: { type: 'string', description: '复扫文件或目录（可选，缺省扫描整个工作区）。' },
+        }),
+        output: {
+            schema: {
+                type: 'object',
+                properties: {
+                    baselineMissing: { type: 'boolean' }, baselineTime: { type: 'string' },
+                    closedCount: { type: 'integer' }, remainingCount: { type: 'integer' }, freshCount: { type: 'integer' },
+                    closed: { type: 'array', items: findingSchema }, remaining: { type: 'array', items: findingSchema }, fresh: { type: 'array', items: findingSchema },
+                    passed: { type: 'boolean' },
+                },
+                additionalProperties: true,
+            },
+            render: (_args, value) => {
+                const rec = (value ?? {});
+                return [{ type: 'text', text: '修复验证：关闭 ' + String(rec.closedCount ?? 0) + '，仍存在 ' + String(rec.remainingCount ?? 0) + '，新增 ' + String(rec.freshCount ?? 0) + '。' }];
+            },
+        },
+        async execute(rawArgs) {
+            const args = (rawArgs ?? {});
+            const target = optionalString(args, 'target');
+            const policy = await loadPolicy(cwd);
+            const state = await loadState(stateDir);
+            const result = await scanPath({ cwd, target, maxFiles: cfg.maxFiles, maxFileBytes: cfg.maxFileBytes, policy });
+            if (state.last === null) {
+                return { baselineMissing: true, baselineTime: '', closedCount: 0, remainingCount: 0, freshCount: result.findings.length, closed: [], remaining: [], fresh: result.findings, passed: false };
+            }
+            const current = result.findings.map(findingFingerprint);
+            const cmp = compareFingerprints(state.last.fingerprints, current);
+            const byFingerprint = new Map(result.findings.map((finding) => [findingFingerprint(finding), finding]));
+            const closed = cmp.closed.map((fp) => state.last.findings.find((finding) => findingFingerprint(finding) === fp)).filter((x) => x !== undefined);
+            const remaining = cmp.remaining.map((fp) => byFingerprint.get(fp)).filter((x) => x !== undefined);
+            const fresh = cmp.fresh.map((fp) => byFingerprint.get(fp)).filter((x) => x !== undefined);
+            return {
+                baselineMissing: false,
+                baselineTime: state.last.time,
+                closedCount: closed.length,
+                remainingCount: remaining.length,
+                freshCount: fresh.length,
+                closed, remaining, fresh,
+                passed: fresh.length === 0 && remaining.length === 0,
+            };
+        },
+        timeoutMs: 120000,
+    };
+    const secureReport = {
+        name: 'secure_report',
+        description: '汇总最近一次扫描状态与策略：按严重度/规则/文件聚合，返回门禁结论与历史趋势。',
+        parameters: compileParameters({}),
+        output: {
+            schema: {
+                type: 'object',
+                properties: {
+                    hasScan: { type: 'boolean' }, stateFile: { type: 'string' }, policy: { type: 'object', additionalProperties: true },
+                    counts: countsSchema, byRule: { type: 'array', items: { type: 'object', additionalProperties: true } },
+                    byFile: { type: 'array', items: { type: 'object', additionalProperties: true } },
+                    passed: { type: 'boolean' }, historyCount: { type: 'integer' },
+                },
+                additionalProperties: true,
+            },
+            render: (_args, value) => {
+                const rec = (value ?? {});
+                return [{ type: 'text', text: '安全报告：' + (rec.hasScan === true ? '最近扫描包含 ' + String(rec.counts?.critical ?? 0) + ' 个 critical。' : '尚无扫描记录，请先 secure_scan。') }];
+            },
+        },
+        async execute() {
+            const state = await loadState(stateDir);
+            const policy = await loadPolicy(cwd);
+            if (state.last === null) {
+                return { hasScan: false, stateFile: '', policy, counts: { critical: 0, high: 0, medium: 0, low: 0 }, byRule: [], byFile: [], passed: false, historyCount: state.history.length };
+            }
+            const last = state.last;
+            const byRule = new Map();
+            const byFile = new Map();
+            for (const finding of last.findings) {
+                byRule.set(finding.ruleId, (byRule.get(finding.ruleId) ?? 0) + 1);
+                byFile.set(finding.file, (byFile.get(finding.file) ?? 0) + 1);
+            }
+            const failOn = policy.failOn ?? cfg.failOn;
+            const split = splitByBaseline(last.findings, state.baseline);
+            return {
+                hasScan: true,
+                stateFile: stateDir,
+                policy,
+                counts: last.counts,
+                baseline: state.baseline,
+                newCounts: countFindings(split.fresh),
+                acceptedCounts: countFindings(split.accepted),
+                byRule: [...byRule.entries()].sort((a, b) => b[1] - a[1]).map(([rule, count]) => ({ rule, count, category: ruleCategory(rule) })),
+                byFile: [...byFile.entries()].sort((a, b) => b[1] - a[1]).slice(0, 50).map(([file, count]) => ({ file, count })),
+                passed: verdictOf(split.fresh, failOn),
+                historyCount: state.history.length,
+            };
+        },
+        timeoutMs: 10000,
+    };
+    const policyShow = {
+        name: 'secure_policy_show',
+        description: '查看当前项目的 .code-security.json 策略：排除目录、忽略规则与门禁阈值。',
+        parameters: compileParameters({}),
+        output: {
+            schema: { type: 'object', properties: { file: { type: 'string' }, policy: { type: 'object', additionalProperties: true } }, additionalProperties: true },
+            render: (_args, value) => {
+                const rec = (value ?? {});
+                return [{ type: 'text', text: '策略文件：' + String(rec.file ?? '') }];
+            },
+        },
+        async execute() {
+            const policy = await loadPolicy(cwd);
+            return { file: path.join(cwd, POLICY_FILE), policy };
+        },
+        timeoutMs: 10000,
+    };
+    const policySet = {
+        name: 'secure_policy_set',
+        description: '写入新的 .code-security.json 策略（JSON 文本）。会整体替换当前策略，写操作默认需要审批。',
+        parameters: compileParameters({
+            policy: { type: 'string', required: true, description: '完整策略 JSON 文本（必填）。' },
+        }),
+        output: {
+            schema: { type: 'object', properties: { file: { type: 'string' }, policy: { type: 'object', additionalProperties: true } }, additionalProperties: true },
+            render: (_args, value) => {
+                const rec = (value ?? {});
+                return [{ type: 'text', text: '策略已写入：' + String(rec.file ?? '') }];
+            },
+        },
+        async execute(rawArgs) {
+            const args = (rawArgs ?? {});
+            const text = requiredString(args, 'policy', '策略 JSON');
+            let parsed;
+            try {
+                parsed = JSON.parse(text);
+            }
+            catch {
+                throw new Error('policy 参数不是合法 JSON。');
+            }
+            const policy = normalizePolicy((parsed ?? {}));
+            const file = await savePolicy(cwd, policy);
+            return { file, policy };
+        },
+        timeoutMs: 10000,
+    };
+    policySet.gate = async (exec, next) => {
+        const record = (typeof exec === 'object' && exec !== null ? exec : {});
+        const approval = record.approval;
+        if (approval === undefined)
+            return { kind: 'deny', reason: 'secure_policy_set 需要确认，但当前环境没有审批通道。如确需直接写入，请在受控终端手动编辑 .code-security.json。' };
+        const outcome = await approval.request({ reason: '覆盖写入项目 .code-security.json 安全策略' });
+        if (outcome === 'allowed-once')
+            return next();
+        if (outcome === 'cancelled')
+            return { kind: 'deny', reason: '策略写入被取消，未执行。' };
+        return { kind: 'deny', reason: '策略写入未获批准。' };
+    };
+    const secureExport = {
+        name: 'secure_export',
+        description: '把最近一次扫描结果导出为 SARIF 2.1.0 或 Markdown。path 可选：提供时写入文件（写操作需要审批）。',
+        parameters: compileParameters({
+            format: { type: 'string', enum: ['sarif', 'markdown'], description: '导出格式（默认 sarif）。' },
+            path: { type: 'string', description: '输出文件路径（可选，缺省只返回文本）。' },
+        }),
+        output: {
+            schema: {
+                type: 'object',
+                properties: { format: { type: 'string' }, path: { type: 'string' }, text: { type: 'string' }, findingCount: { type: 'integer' } },
+                additionalProperties: true,
+            },
+            render: (_args, value) => {
+                const rec = (value ?? {});
+                return [{ type: 'text', text: '已导出 ' + String(rec.findingCount ?? 0) + ' 条发现（' + String(rec.format ?? '') + '）。' }];
+            },
+        },
+        async execute(rawArgs) {
+            const args = (rawArgs ?? {});
+            const format = args.format === 'markdown' ? 'markdown' : 'sarif';
+            const target = optionalString(args, 'path');
+            const state = await loadState(stateDir);
+            if (state.last === null)
+                throw new Error('尚无扫描结果，请先执行 secure_scan 或 secure_diff。');
+            const text = format === 'sarif' ? buildSarif(state.last.findings, state.last.target) : buildMarkdown(state.last.findings, state.last.target);
+            if (target !== undefined)
+                await writeFile(target, text, 'utf8');
+            return { format, path: target ?? '', text, findingCount: state.last.findings.length };
+        },
+        timeoutMs: 30000,
+    };
+    secureExport.gate = async (exec, next) => {
+        const record = (typeof exec === 'object' && exec !== null ? exec : {});
+        const args = (typeof record.args === 'object' && record.args !== null ? record.args : {});
+        const target = typeof args.path === 'string' && args.path !== '' ? args.path : '';
+        if (target === '')
+            return next();
+        const approval = record.approval;
+        if (approval === undefined)
+            return { kind: 'deny', reason: 'secure_export 写入文件需要确认，但当前环境没有审批通道。' };
+        const outcome = await approval.request({ reason: '导出安全报告到 ' + target });
+        if (outcome === 'allowed-once')
+            return next();
+        if (outcome === 'cancelled')
+            return { kind: 'deny', reason: '导出被取消，未执行。' };
+        return { kind: 'deny', reason: '导出未获批准。' };
+    };
+    return [secureScan, secureDiff, secureFixVerify, secureReport, secureExport, ...buildExtraTools(cfg, cwd), policyShow, policySet];
+}
+function buildMarkdown(findings, target) {
+    const lines = ['# 安全审查报告', '', '目标：' + target, '', '| 严重度 | 规则 | CWE | 文件:行 | 说明 |', '| :-- | :-- | :-- | :-- | :-- |'];
+    for (const finding of findings) {
+        lines.push('| ' + finding.severity + ' | ' + finding.ruleId + ' | ' + finding.cwe + ' | ' + finding.file + ':' + finding.line + ' | ' + finding.message + ' |');
+    }
+    return lines.join('\n') + '\n';
+}
+function buildSarif(findings, target) {
+    const rules = new Map();
+    const results = findings.map((finding, index) => {
+        rules.set(finding.ruleId, { id: finding.ruleId, name: finding.title, shortDescription: finding.title });
+        return {
+            ruleId: finding.ruleId,
+            level: finding.severity === 'critical' || finding.severity === 'high' ? 'error' : finding.severity === 'medium' ? 'warning' : 'note',
+            message: { text: finding.message },
+            locations: [{ physicalLocation: { artifactLocation: { uri: finding.file.replace(/\\/g, '/') }, region: { startLine: finding.line } } }],
+            partialFingerprints: { primaryLocationLineHash: finding.id + ':' + String(index) },
+        };
+    });
+    return JSON.stringify({
+        version: '2.1.0',
+        $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
+        runs: [{
+                tool: { driver: { name: 'dsh-code-security', version: '0.1.0', informationUri: 'https://github.com/STARDUSTLC666/dsh-code-security', rules: [...rules.values()] } },
+                originalUriBaseIds: { ROOTPATH: { uri: 'file:///' + target.replace(/\\/g, '/') } },
+                results,
+            }],
+    }, null, 2);
+}

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "dsh-code-security",
+  "version": "0.2.2",
+  "description": "DSH AI 代码安全审查插件：secure_scan/secure_diff/secure_fix_verify/secure_report/secure_export/secure_baseline/secure_deps/secure_policy_show/secure_policy_set 九工具，40+ 确定性规则、密钥熵检测、git diff/staged 审查、SARIF 导出、基线接受与 SBOM-lite，零运行时依赖。",
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "README.md",
+    "README.en.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "prepare": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "pnpm run build && node --test \"test/*.test.mjs\"",
+    "prepublishOnly": "pnpm run build"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "keywords": [
+    "dsh",
+    "deepseek-harness",
+    "plugin",
+    "security",
+    "code-review",
+    "sast",
+    "secrets",
+    "owasp"
+  ],
+  "license": "MIT",
+  "engines": {
+    "node": ">=22.13"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "typescript": "^5.6.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/STARDUSTLC666/dsh-code-security.git"
+  },
+  "bugs": {
+    "url": "https://github.com/STARDUSTLC666/dsh-code-security/issues"
+  },
+  "homepage": "https://github.com/STARDUSTLC666/dsh-code-security#readme",
+  "author": "stardustlc",
+  "packageManager": "pnpm@11.7.0"
+}