dsh-code-security 0.3.3 → 0.3.4

package/README.en.md

@@ -1,5 +1,11 @@
 # dsh-code-security
 
+## 0.3.4 update (2026-09-27)
+
+Fixes scan output validation when no baseline exists. SARIF now uses workspace file URIs, relative locations and structured rule descriptions, including paths with spaces and Unicode.
+
+Validation host: Harness 0.1.7-rc.2 built from official sources, retaining the local tool-scheduler fix. Build and automated checks pass; interactive coverage and external-service limits are recorded in this release round.
+
 ![npm](https://img.shields.io/npm/v/dsh-code-security) ![downloads](https://img.shields.io/npm/dm/dsh-code-security) ![license](https://img.shields.io/github/license/STARDUSTLC666/dsh-code-security) ![stars](https://img.shields.io/github/stars/STARDUSTLC666/dsh-code-security?style=social)
 
 > Every agent code change passes a local security scan before delivery.

package/README.md

@@ -1,5 +1,11 @@
 # dsh-code-security
 
+## 0.3.4 更新（2026-09-27）
+
+修复未设置基线时扫描结果被新版 Harness 拒绝的问题。SARIF 正确使用工作区文件 URI、相对路径和规则描述对象，支持空格与中文文件名。
+
+验证宿主：官方源码构建的 Harness 0.1.7-rc.2（保留本地工具调度器修复）。构建与自动测试通过；实际操作和外部服务限制见本轮验收记录。
+
 ![npm](https://img.shields.io/npm/v/dsh-code-security) ![downloads](https://img.shields.io/npm/dm/dsh-code-security) ![license](https://img.shields.io/github/license/STARDUSTLC666/dsh-code-security) ![stars](https://img.shields.io/github/stars/STARDUSTLC666/dsh-code-security?style=social)
 
 > 让 agent 每次改完代码，先过一道本地安全扫描，修复完了才准交付。

package/lib/tools.js

@@ -7,6 +7,7 @@
  */
 import { writeFile } from 'node:fs/promises';
 import path from 'node:path';
+import { pathToFileURL } from 'node:url';
 import { optionalString, requiredString } from './config.js';
 import { buildExtraTools } from './extra.js';
 import { runGitDiff, scanDiff } from './diff.js';
@@ -54,7 +55,7 @@ const scanSchema = {
         failOn: { type: 'string' }, durationMs: { type: 'integer' },
         newFindings: { type: 'array', items: findingSchema }, newCounts: countsSchema,
         acceptedFindings: { type: 'array', items: findingSchema },
-        baseline: { type: 'object', additionalProperties: true },
+        baseline: { oneOf: [{ type: 'object', additionalProperties: true }, { type: 'null' }] },
     },
     additionalProperties: true,
 };
@@ -320,7 +321,7 @@ export function buildSecureTools(cfg, cwd, runner) {
             const state = await loadState(stateDir);
             if (state.last === null)
                 throw new Error('尚无扫描结果，请先执行 secure_scan 或 secure_diff。');
-            const text = format === 'sarif' ? buildSarif(state.last.findings, state.last.target) : buildMarkdown(state.last.findings, state.last.target);
+            const text = format === 'sarif' ? buildSarif(state.last.findings, cwd) : buildMarkdown(state.last.findings, state.last.target);
             if (target !== undefined)
                 await writeFile(target, text, 'utf8');
             return { format, path: target ?? '', text, findingCount: state.last.findings.length };
@@ -362,15 +363,15 @@ function buildMarkdown(findings, target) {
     }
     return lines.join('\n') + '\n';
 }
-function buildSarif(findings, target) {
+function buildSarif(findings, cwd) {
     const rules = new Map();
     const results = findings.map((finding, index) => {
-        rules.set(finding.ruleId, { id: finding.ruleId, name: finding.title, shortDescription: finding.title });
+        rules.set(finding.ruleId, { id: finding.ruleId, name: finding.title, shortDescription: { text: finding.title } });
         return {
             ruleId: finding.ruleId,
             level: finding.severity === 'critical' || finding.severity === 'high' ? 'error' : finding.severity === 'medium' ? 'warning' : 'note',
             message: { text: finding.message },
-            locations: [{ physicalLocation: { artifactLocation: { uri: finding.file.replace(/\\/g, '/') }, region: { startLine: finding.line } } }],
+            locations: [{ physicalLocation: { artifactLocation: { uri: finding.file.replace(/\\/g, '/').split('/').map(encodeURIComponent).join('/'), uriBaseId: 'ROOTPATH' }, region: { startLine: finding.line } } }],
             partialFingerprints: { primaryLocationLineHash: finding.id + ':' + String(index) },
         };
     });
@@ -379,7 +380,7 @@ function buildSarif(findings, target) {
         $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
         runs: [{
                 tool: { driver: { name: 'dsh-code-security', version: '0.1.0', informationUri: 'https://github.com/STARDUSTLC666/dsh-code-security', rules: [...rules.values()] } },
-                originalUriBaseIds: { ROOTPATH: { uri: 'file:///' + target.replace(/\\/g, '/') } },
+                originalUriBaseIds: { ROOTPATH: { uri: pathToFileURL(path.resolve(cwd) + path.sep).href } },
                 results,
             }],
     }, null, 2);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-code-security",
-  "version": "0.3.3",
-  "description": "DSH AI 代码安全审查插件：secure_scan/secure_diff/secure_fix_verify/secure_report/secure_export/secure_baseline/secure_deps/secure_policy_show/secure_policy_set 九工具，40+ 确定性规则、密钥熵检测、git diff/staged 审查、SARIF 导出、基线接受与 SBOM-lite，零运行时依赖。",
+  "version": "0.3.4",
+  "description": "DSH 代码安全审查插件：40+ 确定性规则与密钥熵检测，支持 git diff/staged 审查、SARIF 导出、基线接受与 SBOM-lite。",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",