dsh-code-security 0.3.1 → 0.3.3

package/README.en.md

@@ -6,6 +6,12 @@
 
 A DeepSeek Harness plugin for AI code security review: deterministic rule engine, git-diff incremental review, fix-verify loop, and policy gate. Methodology borrows from Codex security skills (evidence-first findings, severity ordering, supply-chain layers). Zero runtime dependencies.
 
+## Compatibility
+
+Verified with official `@deepseek-ai/dsh@0.1.5-rc.1` and Node `24.16.0` on 2026-09-11: all 18 components load alongside Modlens, with passing tool-schema, skill-registration and offline read-only invocation checks. Uses the `cordis.patch.yml` + `dsh.bundle.patch` bundle model. Node requirements match this Harness release: 22.19 or later within 22.x, or 24 or later. Live external-service workflows require separate configuration and validation.
+
+2026-09-13 fix: retain the service receiver when calling `subprocess.spawn`, preventing failures caused by passing the method as an unbound callback. Verified with official `0.1.5-rc.1` and `0.1.5-rc.2` on Node `24.16.0`. `secure_diff` reads a real isolated Git repository through the host subprocess service and reports the changed file and added line.
+
 ## Tools
 
 | Tool | Purpose | Write |

package/README.md

@@ -33,7 +33,9 @@ DeepSeek Harness AI 代码安全审查插件：确定性规则引擎 + git diff
 
 ## 兼容性
 
-在 `@deepseek-ai/dsh@0.1.2-alpha.4` 源码模式下验证（2026-09-02）。遵循 cordis 组合包补丁模型（`cordis.patch.yml` + `dsh.bundle.patch`），运行时不 import 任何 `@deepseek-ai/*` 内部模块。
+已在官方 `@deepseek-ai/dsh@0.1.5-rc.1`、Node `24.16.0` 上验证（2026-09-11）：18 个组件与 Modlens 同载，工具 schema、技能注册及离线只读调用检查通过。采用 `cordis.patch.yml` + `dsh.bundle.patch` 组合包模型。Node 要求与该版本 Harness 一致：22.19 及以上的 22.x，或 24 及以上。外部服务的实际业务操作需按各组件配置单独验证。
+
+2026-09-13 修复：保留宿主 `subprocess.spawn` 的服务对象，避免方法独立传递后因 `this` 丢失而报错。已在官方 `0.1.5-rc.1` 和 `0.1.5-rc.2`、Node `24.16.0` 上验证。`secure_diff` 已通过真实宿主进程服务读取隔离 Git 仓库差异，正确识别变更文件和新增行。
 
 ## 安装
 

package/lib/index.js

@@ -21,7 +21,7 @@ export function apply(ctx, config) {
         console.warn('[dsh-code-security] ' + (error instanceof Error ? error.message : String(error)));
         cfg = resolveConfig(null);
     }
-    const runner = createSubprocessRunner(ctx.subprocess.spawn, 10000, 60000);
+    const runner = createSubprocessRunner((spec) => ctx.subprocess.spawn(spec), 10000, 60000);
     const tools = buildSecureTools(cfg, process.cwd(), runner);
     const disposers = [];
     for (const definition of tools) {

package/lib/runner.js

@@ -10,26 +10,25 @@ export function createSubprocessRunner(spawn, graceMs, defaultTimeoutMs) {
             const timeoutMs = options?.timeoutMs ?? defaultTimeoutMs;
             const controller = new AbortController();
             const timer = setTimeout(() => controller.abort(new Error('git diff timed out')), timeoutMs);
-            let handle;
             try {
-                handle = spawn({
+                const handle = spawn({
                     argv,
                     cwd: process.cwd(),
                     stdio: { stdin: 'ignore', stdout: { maxBytes: COLLECT_BYTES }, stderr: { maxBytes: COLLECT_BYTES } },
                     graceMs,
                     signal: controller.signal,
                 });
+                const outcome = await handle.done;
+                return {
+                    exitCode: outcome.exitCode,
+                    signal: outcome.signal,
+                    stdout: handle.collected.stdout?.readFrom(0).text ?? '',
+                    stderr: handle.collected.stderr?.readFrom(0).text ?? '',
+                };
             }
             finally {
                 clearTimeout(timer);
             }
-            const outcome = await handle.done;
-            return {
-                exitCode: outcome.exitCode,
-                signal: outcome.signal,
-                stdout: handle.collected.stdout?.readFrom(0).text ?? '',
-                stderr: handle.collected.stderr?.readFrom(0).text ?? '',
-            };
         },
     };
 }

package/package.json

@@ -1,61 +1,61 @@
-{
-  "name": "dsh-code-security",
-  "version": "0.3.1",
-  "description": "DSH AI 代码安全审查插件：secure_scan/secure_diff/secure_fix_verify/secure_report/secure_export/secure_baseline/secure_deps/secure_policy_show/secure_policy_set 九工具，40+ 确定性规则、密钥熵检测、git diff/staged 审查、SARIF 导出、基线接受与 SBOM-lite，零运行时依赖。",
-  "type": "module",
-  "main": "lib/index.js",
-  "types": "lib/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./lib/index.d.ts",
-      "default": "./lib/index.js"
-    },
-    "./cordis.patch.yml": "./cordis.patch.yml",
-    "./package.json": "./package.json"
-  },
-  "files": [
-    "lib",
-    "cordis.patch.yml",
-    "README.md",
-    "README.en.md"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "pnpm run build && node --test \"test/*.test.mjs\"",
-    "prepublishOnly": "pnpm run build"
-  },
-  "dsh": {
-    "bundle": {
-      "patch": "./cordis.patch.yml"
-    }
-  },
-  "keywords": [
-    "dsh",
-    "deepseek-harness",
-    "plugin",
-    "security",
-    "code-review",
-    "sast",
-    "secrets",
-    "owasp"
-  ],
-  "license": "MIT",
-  "engines": {
-    "node": ">=22"
-  },
-  "devDependencies": {
-    "@types/node": "^24.0.0",
-    "typescript": "^5.6.0"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/STARDUSTLC666/dsh-code-security.git"
-  },
-  "bugs": {
-    "url": "https://github.com/STARDUSTLC666/dsh-code-security/issues"
-  },
-  "homepage": "https://github.com/STARDUSTLC666/dsh-code-security#readme",
-  "author": "stardustlc",
-  "packageManager": "pnpm@11.7.0"
-}
+{
+  "name": "dsh-code-security",
+  "version": "0.3.3",
+  "description": "DSH AI 代码安全审查插件：secure_scan/secure_diff/secure_fix_verify/secure_report/secure_export/secure_baseline/secure_deps/secure_policy_show/secure_policy_set 九工具，40+ 确定性规则、密钥熵检测、git diff/staged 审查、SARIF 导出、基线接受与 SBOM-lite，零运行时依赖。",
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "README.md",
+    "README.en.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "pnpm run build && node --test \"test/*.test.mjs\"",
+    "prepublishOnly": "pnpm run build"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "keywords": [
+    "dsh",
+    "deepseek-harness",
+    "plugin",
+    "security",
+    "code-review",
+    "sast",
+    "secrets",
+    "owasp"
+  ],
+  "license": "MIT",
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "typescript": "^5.6.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/STARDUSTLC666/dsh-code-security.git"
+  },
+  "bugs": {
+    "url": "https://github.com/STARDUSTLC666/dsh-code-security/issues"
+  },
+  "homepage": "https://github.com/STARDUSTLC666/dsh-code-security#readme",
+  "author": "stardustlc",
+  "packageManager": "pnpm@11.7.0"
+}