dsh-code-security 0.3.2 → 0.3.4

package/README.en.md

@@ -1,11 +1,23 @@
 # dsh-code-security
 
+## 0.3.4 update (2026-09-27)
+
+Fixes scan output validation when no baseline exists. SARIF now uses workspace file URIs, relative locations and structured rule descriptions, including paths with spaces and Unicode.
+
+Validation host: Harness 0.1.7-rc.2 built from official sources, retaining the local tool-scheduler fix. Build and automated checks pass; interactive coverage and external-service limits are recorded in this release round.
+
 ![npm](https://img.shields.io/npm/v/dsh-code-security) ![downloads](https://img.shields.io/npm/dm/dsh-code-security) ![license](https://img.shields.io/github/license/STARDUSTLC666/dsh-code-security) ![stars](https://img.shields.io/github/stars/STARDUSTLC666/dsh-code-security?style=social)
 
 > Every agent code change passes a local security scan before delivery.
 
 A DeepSeek Harness plugin for AI code security review: deterministic rule engine, git-diff incremental review, fix-verify loop, and policy gate. Methodology borrows from Codex security skills (evidence-first findings, severity ordering, supply-chain layers). Zero runtime dependencies.
 
+## Compatibility
+
+Verified with official `@deepseek-ai/dsh@0.1.5-rc.1` and Node `24.16.0` on 2026-09-11: all 18 components load alongside Modlens, with passing tool-schema, skill-registration and offline read-only invocation checks. Uses the `cordis.patch.yml` + `dsh.bundle.patch` bundle model. Node requirements match this Harness release: 22.19 or later within 22.x, or 24 or later. Live external-service workflows require separate configuration and validation.
+
+2026-09-13 fix: retain the service receiver when calling `subprocess.spawn`, preventing failures caused by passing the method as an unbound callback. Verified with official `0.1.5-rc.1` and `0.1.5-rc.2` on Node `24.16.0`. `secure_diff` reads a real isolated Git repository through the host subprocess service and reports the changed file and added line.
+
 ## Tools
 
 | Tool | Purpose | Write |

package/README.md

@@ -1,5 +1,11 @@
 # dsh-code-security
 
+## 0.3.4 更新（2026-09-27）
+
+修复未设置基线时扫描结果被新版 Harness 拒绝的问题。SARIF 正确使用工作区文件 URI、相对路径和规则描述对象，支持空格与中文文件名。
+
+验证宿主：官方源码构建的 Harness 0.1.7-rc.2（保留本地工具调度器修复）。构建与自动测试通过；实际操作和外部服务限制见本轮验收记录。
+
 ![npm](https://img.shields.io/npm/v/dsh-code-security) ![downloads](https://img.shields.io/npm/dm/dsh-code-security) ![license](https://img.shields.io/github/license/STARDUSTLC666/dsh-code-security) ![stars](https://img.shields.io/github/stars/STARDUSTLC666/dsh-code-security?style=social)
 
 > 让 agent 每次改完代码，先过一道本地安全扫描，修复完了才准交付。
@@ -33,7 +39,9 @@ DeepSeek Harness AI 代码安全审查插件：确定性规则引擎 + git diff
 
 ## 兼容性
 
-在 `@deepseek-ai/dsh@0.1.2-alpha.4` 源码模式下验证（2026-09-02）。遵循 cordis 组合包补丁模型（`cordis.patch.yml` + `dsh.bundle.patch`），运行时不 import 任何 `@deepseek-ai/*` 内部模块。
+已在官方 `@deepseek-ai/dsh@0.1.5-rc.1`、Node `24.16.0` 上验证（2026-09-11）：18 个组件与 Modlens 同载，工具 schema、技能注册及离线只读调用检查通过。采用 `cordis.patch.yml` + `dsh.bundle.patch` 组合包模型。Node 要求与该版本 Harness 一致：22.19 及以上的 22.x，或 24 及以上。外部服务的实际业务操作需按各组件配置单独验证。
+
+2026-09-13 修复：保留宿主 `subprocess.spawn` 的服务对象，避免方法独立传递后因 `this` 丢失而报错。已在官方 `0.1.5-rc.1` 和 `0.1.5-rc.2`、Node `24.16.0` 上验证。`secure_diff` 已通过真实宿主进程服务读取隔离 Git 仓库差异，正确识别变更文件和新增行。
 
 ## 安装
 

package/lib/index.js

@@ -21,7 +21,7 @@ export function apply(ctx, config) {
         console.warn('[dsh-code-security] ' + (error instanceof Error ? error.message : String(error)));
         cfg = resolveConfig(null);
     }
-    const runner = createSubprocessRunner(ctx.subprocess.spawn, 10000, 60000);
+    const runner = createSubprocessRunner((spec) => ctx.subprocess.spawn(spec), 10000, 60000);
     const tools = buildSecureTools(cfg, process.cwd(), runner);
     const disposers = [];
     for (const definition of tools) {

package/lib/tools.js

@@ -7,6 +7,7 @@
  */
 import { writeFile } from 'node:fs/promises';
 import path from 'node:path';
+import { pathToFileURL } from 'node:url';
 import { optionalString, requiredString } from './config.js';
 import { buildExtraTools } from './extra.js';
 import { runGitDiff, scanDiff } from './diff.js';
@@ -54,7 +55,7 @@ const scanSchema = {
         failOn: { type: 'string' }, durationMs: { type: 'integer' },
         newFindings: { type: 'array', items: findingSchema }, newCounts: countsSchema,
         acceptedFindings: { type: 'array', items: findingSchema },
-        baseline: { type: 'object', additionalProperties: true },
+        baseline: { oneOf: [{ type: 'object', additionalProperties: true }, { type: 'null' }] },
     },
     additionalProperties: true,
 };
@@ -320,7 +321,7 @@ export function buildSecureTools(cfg, cwd, runner) {
             const state = await loadState(stateDir);
             if (state.last === null)
                 throw new Error('尚无扫描结果，请先执行 secure_scan 或 secure_diff。');
-            const text = format === 'sarif' ? buildSarif(state.last.findings, state.last.target) : buildMarkdown(state.last.findings, state.last.target);
+            const text = format === 'sarif' ? buildSarif(state.last.findings, cwd) : buildMarkdown(state.last.findings, state.last.target);
             if (target !== undefined)
                 await writeFile(target, text, 'utf8');
             return { format, path: target ?? '', text, findingCount: state.last.findings.length };
@@ -362,15 +363,15 @@ function buildMarkdown(findings, target) {
     }
     return lines.join('\n') + '\n';
 }
-function buildSarif(findings, target) {
+function buildSarif(findings, cwd) {
     const rules = new Map();
     const results = findings.map((finding, index) => {
-        rules.set(finding.ruleId, { id: finding.ruleId, name: finding.title, shortDescription: finding.title });
+        rules.set(finding.ruleId, { id: finding.ruleId, name: finding.title, shortDescription: { text: finding.title } });
         return {
             ruleId: finding.ruleId,
             level: finding.severity === 'critical' || finding.severity === 'high' ? 'error' : finding.severity === 'medium' ? 'warning' : 'note',
             message: { text: finding.message },
-            locations: [{ physicalLocation: { artifactLocation: { uri: finding.file.replace(/\\/g, '/') }, region: { startLine: finding.line } } }],
+            locations: [{ physicalLocation: { artifactLocation: { uri: finding.file.replace(/\\/g, '/').split('/').map(encodeURIComponent).join('/'), uriBaseId: 'ROOTPATH' }, region: { startLine: finding.line } } }],
             partialFingerprints: { primaryLocationLineHash: finding.id + ':' + String(index) },
         };
     });
@@ -379,7 +380,7 @@ function buildSarif(findings, target) {
         $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
         runs: [{
                 tool: { driver: { name: 'dsh-code-security', version: '0.1.0', informationUri: 'https://github.com/STARDUSTLC666/dsh-code-security', rules: [...rules.values()] } },
-                originalUriBaseIds: { ROOTPATH: { uri: 'file:///' + target.replace(/\\/g, '/') } },
+                originalUriBaseIds: { ROOTPATH: { uri: pathToFileURL(path.resolve(cwd) + path.sep).href } },
                 results,
             }],
     }, null, 2);

package/package.json

@@ -1,61 +1,61 @@
-{
-  "name": "dsh-code-security",
-  "version": "0.3.2",
-  "description": "DSH AI 代码安全审查插件：secure_scan/secure_diff/secure_fix_verify/secure_report/secure_export/secure_baseline/secure_deps/secure_policy_show/secure_policy_set 九工具，40+ 确定性规则、密钥熵检测、git diff/staged 审查、SARIF 导出、基线接受与 SBOM-lite，零运行时依赖。",
-  "type": "module",
-  "main": "lib/index.js",
-  "types": "lib/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./lib/index.d.ts",
-      "default": "./lib/index.js"
-    },
-    "./cordis.patch.yml": "./cordis.patch.yml",
-    "./package.json": "./package.json"
-  },
-  "files": [
-    "lib",
-    "cordis.patch.yml",
-    "README.md",
-    "README.en.md"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "pnpm run build && node --test \"test/*.test.mjs\"",
-    "prepublishOnly": "pnpm run build"
-  },
-  "dsh": {
-    "bundle": {
-      "patch": "./cordis.patch.yml"
-    }
-  },
-  "keywords": [
-    "dsh",
-    "deepseek-harness",
-    "plugin",
-    "security",
-    "code-review",
-    "sast",
-    "secrets",
-    "owasp"
-  ],
-  "license": "MIT",
-  "engines": {
-    "node": ">=22"
-  },
-  "devDependencies": {
-    "@types/node": "^24.0.0",
-    "typescript": "^5.6.0"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/STARDUSTLC666/dsh-code-security.git"
-  },
-  "bugs": {
-    "url": "https://github.com/STARDUSTLC666/dsh-code-security/issues"
-  },
-  "homepage": "https://github.com/STARDUSTLC666/dsh-code-security#readme",
-  "author": "stardustlc",
-  "packageManager": "pnpm@11.7.0"
-}
+{
+  "name": "dsh-code-security",
+  "version": "0.3.4",
+  "description": "DSH 代码安全审查插件：40+ 确定性规则与密钥熵检测，支持 git diff/staged 审查、SARIF 导出、基线接受与 SBOM-lite。",
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "README.md",
+    "README.en.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "pnpm run build && node --test \"test/*.test.mjs\"",
+    "prepublishOnly": "pnpm run build"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "keywords": [
+    "dsh",
+    "deepseek-harness",
+    "plugin",
+    "security",
+    "code-review",
+    "sast",
+    "secrets",
+    "owasp"
+  ],
+  "license": "MIT",
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "typescript": "^5.6.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/STARDUSTLC666/dsh-code-security.git"
+  },
+  "bugs": {
+    "url": "https://github.com/STARDUSTLC666/dsh-code-security/issues"
+  },
+  "homepage": "https://github.com/STARDUSTLC666/dsh-code-security#readme",
+  "author": "stardustlc",
+  "packageManager": "pnpm@11.7.0"
+}