dsh-code-security 0.3.0 → 0.3.2

package/README.en.md

@@ -1,5 +1,7 @@
 # dsh-code-security
 
+![npm](https://img.shields.io/npm/v/dsh-code-security) ![downloads](https://img.shields.io/npm/dm/dsh-code-security) ![license](https://img.shields.io/github/license/STARDUSTLC666/dsh-code-security) ![stars](https://img.shields.io/github/stars/STARDUSTLC666/dsh-code-security?style=social)
+
 > Every agent code change passes a local security scan before delivery.
 
 A DeepSeek Harness plugin for AI code security review: deterministic rule engine, git-diff incremental review, fix-verify loop, and policy gate. Methodology borrows from Codex security skills (evidence-first findings, severity ordering, supply-chain layers). Zero runtime dependencies.

package/README.md

@@ -1,5 +1,7 @@
 # dsh-code-security
 
+![npm](https://img.shields.io/npm/v/dsh-code-security) ![downloads](https://img.shields.io/npm/dm/dsh-code-security) ![license](https://img.shields.io/github/license/STARDUSTLC666/dsh-code-security) ![stars](https://img.shields.io/github/stars/STARDUSTLC666/dsh-code-security?style=social)
+
 > 让 agent 每次改完代码，先过一道本地安全扫描，修复完了才准交付。
 
 DeepSeek Harness AI 代码安全审查插件：确定性规则引擎 + git diff 增量审查 + 修复闭环 + 策略门禁。借鉴 Codex 安全技能的方法论（漏洞分级、证据优先、供应链分层、Agent 安全），实现为可复现工具。零运行时依赖。
@@ -31,7 +33,7 @@ DeepSeek Harness AI 代码安全审查插件：确定性规则引擎 + git diff
 
 ## 兼容性
 
-在 `@deepseek-ai/dsh@0.1.1-rc.2` 上验证（2026-08-26）。遵循 cordis 组合包补丁模型（`cordis.patch.yml` + `dsh.bundle.patch`），运行时不 import 任何 `@deepseek-ai/*` 内部模块。
+在 `@deepseek-ai/dsh@0.1.2-alpha.4` 源码模式下验证（2026-09-02）。遵循 cordis 组合包补丁模型（`cordis.patch.yml` + `dsh.bundle.patch`），运行时不 import 任何 `@deepseek-ai/*` 内部模块。
 
 ## 安装
 

package/lib/extra.js

@@ -92,17 +92,5 @@ export function buildExtraTools(cfg, cwd) {
         },
         timeoutMs: 30000,
     };
-    secureBaseline.gate = async (exec, next) => {
-        const record = (typeof exec === 'object' && exec !== null ? exec : {});
-        const approval = record.approval;
-        if (approval === undefined)
-            return { kind: 'deny', reason: 'secure_baseline 需要确认，但当前环境没有审批通道。' };
-        const outcome = await approval.request({ reason: '把当前全部安全问题接受为基线' });
-        if (outcome === 'allowed-once')
-            return next();
-        if (outcome === 'cancelled')
-            return { kind: 'deny', reason: '基线接受被取消，未执行。' };
-        return { kind: 'deny', reason: '基线接受未获批准。' };
-    };
     return [secureBaseline, secureDeps];
 }

package/lib/index.d.ts

@@ -17,12 +17,11 @@ export interface SecurePluginContext {
         spawn: SubprocessSpawnLike;
     };
     tools: {
-        register(definition: SecureToolDefinition, options?: {
-            prepend?: boolean;
-        }): () => void;
+        register(definition: SecureToolDefinition): () => void;
     };
-    get?(name: 'approval'): unknown;
-    on?(event: string, listener: () => void): () => void;
+    on?(event: string, listener: (...args: any[]) => unknown, options?: {
+        prepend?: boolean;
+    }): (() => void) | void;
 }
 export declare function apply(ctx: SecurePluginContext, config?: SecureConfig | null): void;
 export * from './config.js';

package/lib/index.js

@@ -25,17 +25,22 @@ export function apply(ctx, config) {
     const tools = buildSecureTools(cfg, process.cwd(), runner);
     const disposers = [];
     for (const definition of tools) {
-        const wrapped = { ...definition };
-        if (wrapped.gate !== undefined) {
-            const original = wrapped.gate.bind(wrapped);
-            wrapped.gate = async (exec, next) => {
-                const record = (typeof exec === 'object' && exec !== null ? exec : {});
-                return original({ ...record, approval: ctx.get?.('approval') }, next);
-            };
-        }
-        disposers.push(ctx.tools.register(wrapped, { prepend: true }));
+        disposers.push(ctx.tools.register(definition));
     }
     if (typeof ctx.on === 'function') {
+        ctx.on('tools/pre-execute', async (exec, next) => {
+            const args = (typeof exec.arguments === 'object' && exec.arguments !== null ? exec.arguments : {});
+            let reason;
+            if (exec.name === 'secure_policy_set')
+                reason = '覆盖写入项目 .code-security.json 安全策略';
+            if (exec.name === 'secure_baseline')
+                reason = '把当前全部安全问题接受为基线';
+            if (exec.name === 'secure_export' && typeof args.path === 'string' && args.path !== '')
+                reason = '导出安全报告到 ' + args.path;
+            if (reason === undefined)
+                return next();
+            return { kind: 'ask', reason };
+        }, { prepend: true });
         ctx.on('dispose', () => { for (const dispose of disposers)
             dispose(); });
     }

package/lib/runner.js

@@ -10,26 +10,25 @@ export function createSubprocessRunner(spawn, graceMs, defaultTimeoutMs) {
             const timeoutMs = options?.timeoutMs ?? defaultTimeoutMs;
             const controller = new AbortController();
             const timer = setTimeout(() => controller.abort(new Error('git diff timed out')), timeoutMs);
-            let handle;
             try {
-                handle = spawn({
+                const handle = spawn({
                     argv,
                     cwd: process.cwd(),
                     stdio: { stdin: 'ignore', stdout: { maxBytes: COLLECT_BYTES }, stderr: { maxBytes: COLLECT_BYTES } },
                     graceMs,
                     signal: controller.signal,
                 });
+                const outcome = await handle.done;
+                return {
+                    exitCode: outcome.exitCode,
+                    signal: outcome.signal,
+                    stdout: handle.collected.stdout?.readFrom(0).text ?? '',
+                    stderr: handle.collected.stderr?.readFrom(0).text ?? '',
+                };
             }
             finally {
                 clearTimeout(timer);
             }
-            const outcome = await handle.done;
-            return {
-                exitCode: outcome.exitCode,
-                signal: outcome.signal,
-                stdout: handle.collected.stdout?.readFrom(0).text ?? '',
-                stderr: handle.collected.stderr?.readFrom(0).text ?? '',
-            };
         },
     };
 }

package/lib/tools.d.ts

@@ -24,7 +24,6 @@ export interface SecureToolDefinition {
         render(args: unknown, value: unknown): ContentBlock[];
     };
     execute(args: unknown, exec: unknown): Promise<unknown>;
-    gate?(exec: unknown, next: () => Promise<unknown>): Promise<unknown>;
     timeoutMs?: number;
 }
 export declare function buildSecureTools(cfg: ResolvedSecureConfig, cwd: string, runner: ProcessRunner): SecureToolDefinition[];

package/lib/tools.js

@@ -295,18 +295,6 @@ export function buildSecureTools(cfg, cwd, runner) {
         },
         timeoutMs: 10000,
     };
-    policySet.gate = async (exec, next) => {
-        const record = (typeof exec === 'object' && exec !== null ? exec : {});
-        const approval = record.approval;
-        if (approval === undefined)
-            return { kind: 'deny', reason: 'secure_policy_set 需要确认，但当前环境没有审批通道。如确需直接写入，请在受控终端手动编辑 .code-security.json。' };
-        const outcome = await approval.request({ reason: '覆盖写入项目 .code-security.json 安全策略' });
-        if (outcome === 'allowed-once')
-            return next();
-        if (outcome === 'cancelled')
-            return { kind: 'deny', reason: '策略写入被取消，未执行。' };
-        return { kind: 'deny', reason: '策略写入未获批准。' };
-    };
     const secureExport = {
         name: 'secure_export',
         description: '把最近一次扫描结果导出为 SARIF 2.1.0 或 Markdown。path 可选：提供时写入文件（写操作需要审批）。',
@@ -339,22 +327,6 @@ export function buildSecureTools(cfg, cwd, runner) {
         },
         timeoutMs: 30000,
     };
-    secureExport.gate = async (exec, next) => {
-        const record = (typeof exec === 'object' && exec !== null ? exec : {});
-        const args = (typeof record.args === 'object' && record.args !== null ? record.args : {});
-        const target = typeof args.path === 'string' && args.path !== '' ? args.path : '';
-        if (target === '')
-            return next();
-        const approval = record.approval;
-        if (approval === undefined)
-            return { kind: 'deny', reason: 'secure_export 写入文件需要确认，但当前环境没有审批通道。' };
-        const outcome = await approval.request({ reason: '导出安全报告到 ' + target });
-        if (outcome === 'allowed-once')
-            return next();
-        if (outcome === 'cancelled')
-            return { kind: 'deny', reason: '导出被取消，未执行。' };
-        return { kind: 'deny', reason: '导出未获批准。' };
-    };
     const secureHealth = {
         name: 'secure_health',
         description: 'dsh-code-security 自检：汇总扫描配置（文件数/体积上限、严重度门禁、状态目录）并确认工作目录可用。遇到问题时先运行本工具定位。',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-code-security",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "DSH AI 代码安全审查插件：secure_scan/secure_diff/secure_fix_verify/secure_report/secure_export/secure_baseline/secure_deps/secure_policy_show/secure_policy_set 九工具，40+ 确定性规则、密钥熵检测、git diff/staged 审查、SARIF 导出、基线接受与 SBOM-lite，零运行时依赖。",
   "type": "module",
   "main": "lib/index.js",