dsh-code-security 0.3.3 → 0.3.6

package/README.en.md

@@ -1,5 +1,11 @@
 # dsh-code-security
 
+## 0.3.5 update (2026-09-28)
+
+Rejects unknown scan arguments and empty targets before scanning or replacing state, preventing misspelled scopes from expanding to the whole workspace. Fixes standard-mode output incorrectly displaying zero files and a failed verdict: counts, verdicts and findings now come from the actual scan result.
+
+Validation host: Harness `0.2.0-rc.1` built from official sources (commit `407e65c8`) with Node `24.16.0` on 2026-09-28. All 31 plugin tests pass in an isolated environment; all 18 plugins mount together in one host registering 10 tools, with tool schemas and health-check contracts passing. No live ports or external services were exercised in this round.
+
 ![npm](https://img.shields.io/npm/v/dsh-code-security) ![downloads](https://img.shields.io/npm/dm/dsh-code-security) ![license](https://img.shields.io/github/license/STARDUSTLC666/dsh-code-security) ![stars](https://img.shields.io/github/stars/STARDUSTLC666/dsh-code-security?style=social)
 
 > Every agent code change passes a local security scan before delivery.

package/README.md

@@ -1,5 +1,11 @@
 # dsh-code-security
 
+## 0.3.5 更新（2026-09-28）
+
+扫描参数写错时明确报错，避免把 `paths`、`files` 或空目标误当成扫描整个工作区。修复标准模式中结果卡片误显示“0 个文件、未通过”的问题；文件数量、结论与问题列表现在使用实际扫描结果。
+
+验证宿主：官方源码构建的 Harness `0.2.0-rc.1`（commit `407e65c8`）+ Node `24.16.0`（2026-09-28）。31 项插件测试在隔离环境全部通过；同一个宿主里 18 个插件共同加载，注册 10 个工具，工具 schema 与健康检查契约通过。本轮未启用真实端口与外部服务。
+
 ![npm](https://img.shields.io/npm/v/dsh-code-security) ![downloads](https://img.shields.io/npm/dm/dsh-code-security) ![license](https://img.shields.io/github/license/STARDUSTLC666/dsh-code-security) ![stars](https://img.shields.io/github/stars/STARDUSTLC666/dsh-code-security?style=social)
 
 > 让 agent 每次改完代码，先过一道本地安全扫描，修复完了才准交付。

package/lib/tools.d.ts

@@ -18,6 +18,7 @@ export interface SecureToolDefinition {
         type: 'object';
         properties: Record<string, unknown>;
         required?: string[];
+        additionalProperties?: boolean;
     };
     output: {
         schema: Record<string, unknown>;

package/lib/tools.js

@@ -7,6 +7,7 @@
  */
 import { writeFile } from 'node:fs/promises';
 import path from 'node:path';
+import { pathToFileURL } from 'node:url';
 import { optionalString, requiredString } from './config.js';
 import { buildExtraTools } from './extra.js';
 import { runGitDiff, scanDiff } from './diff.js';
@@ -32,6 +33,21 @@ function compileParameters(spec) {
     }
     return { type: 'object', properties, ...(required.length > 0 ? { required } : {}) };
 }
+/** Reject ambiguous scopes before reading files, running git, or replacing scan state. */
+function scanArguments(raw, allowed = ['target']) {
+    if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) {
+        throw new Error('扫描参数必须是对象。请用 { target: "文件或目录" } 限定范围；扫描整个工作区请传 {}。');
+    }
+    const args = raw;
+    const unknown = Object.keys(args).filter(key => !allowed.includes(key));
+    if (unknown.length > 0) {
+        throw new Error('不支持的扫描参数：' + unknown.join('、') + '。请使用 target 指定一个文件或目录；仅省略 target 或使用 target: "." 才扫描整个工作区。');
+    }
+    if (Object.hasOwn(args, 'target') && (typeof args.target !== 'string' || args.target.trim() === '')) {
+        throw new Error('扫描参数 target 必须是非空的文件或目录字符串。扫描整个工作区请省略 target 或使用 "."。');
+    }
+    return args;
+}
 const findingSchema = {
     type: 'object',
     properties: {
@@ -54,7 +70,7 @@ const scanSchema = {
         failOn: { type: 'string' }, durationMs: { type: 'integer' },
         newFindings: { type: 'array', items: findingSchema }, newCounts: countsSchema,
         acceptedFindings: { type: 'array', items: findingSchema },
-        baseline: { type: 'object', additionalProperties: true },
+        baseline: { oneOf: [{ type: 'object', additionalProperties: true }, { type: 'null' }] },
     },
     additionalProperties: true,
 };
@@ -69,7 +85,7 @@ function baselineSummary(value) {
         accepted: Array.isArray(rec.acceptedFindings) ? rec.acceptedFindings : [],
     };
 }
-function renderFindings(value) {
+function renderFindings(_args, value) {
     const rec = (value ?? {});
     const findings = Array.isArray(rec.findings) ? rec.findings : [];
     const counts = rec.counts;
@@ -87,13 +103,13 @@ export function buildSecureTools(cfg, cwd, runner) {
     const stateDir = cfg.stateDir;
     const secureScan = {
         name: 'secure_scan',
-        description: '扫描工作区（或指定文件/目录），用确定性规则检测注入、弱加密、硬编码密钥、危险配置等问题。结果写入 .code-security 状态供 secure_fix_verify 对比。',
-        parameters: compileParameters({
-            target: { type: 'string', description: '要扫描的文件或目录（可选，缺省扫描整个工作区）。' },
-        }),
+        description: '扫描工作区（或指定文件/目录），用确定性规则检测注入、弱加密、硬编码密钥、危险配置等问题。使用 target 字符串限定范围，不接受 paths/files 等参数；{} 表示整个工作区。结果写入 .code-security 状态供 secure_fix_verify 对比。',
+        parameters: { ...compileParameters({
+                target: { type: 'string', description: '要扫描的文件或目录（可选，缺省扫描整个工作区）。' },
+            }), additionalProperties: false },
         output: { schema: scanSchema, render: renderFindings },
         async execute(rawArgs) {
-            const args = (rawArgs ?? {});
+            const args = scanArguments(rawArgs);
             const target = optionalString(args, 'target');
             const policy = await loadPolicy(cwd);
             const failOn = policy.failOn ?? cfg.failOn;
@@ -118,14 +134,14 @@ export function buildSecureTools(cfg, cwd, runner) {
     const secureDiff = {
         name: 'secure_diff',
         description: '只审查 git diff 的新增行（默认 HEAD，即未提交改动）。base 可用任意 git ref；staged=true 审查已暂存改动；target 可限定文件。结果同样写入状态。',
-        parameters: compileParameters({
-            base: { type: 'string', description: 'git 基线（默认 HEAD）。' },
-            target: { type: 'string', description: '限定文件路径（可选）。' },
-            staged: { type: 'boolean', description: '审查已暂存改动（git diff --cached，默认 false）。' },
-        }),
+        parameters: { ...compileParameters({
+                base: { type: 'string', description: 'git 基线（默认 HEAD）。' },
+                target: { type: 'string', description: '限定文件路径（可选）。' },
+                staged: { type: 'boolean', description: '审查已暂存改动（git diff --cached，默认 false）。' },
+            }), additionalProperties: false },
         output: { schema: scanSchema, render: renderFindings },
         async execute(rawArgs) {
-            const args = (rawArgs ?? {});
+            const args = scanArguments(rawArgs, ['base', 'target', 'staged']);
             const base = optionalString(args, 'base') ?? 'HEAD';
             const target = optionalString(args, 'target');
             const policy = await loadPolicy(cwd);
@@ -152,9 +168,9 @@ export function buildSecureTools(cfg, cwd, runner) {
     const secureFixVerify = {
         name: 'secure_fix_verify',
         description: '复扫并与上次扫描基线对比，输出已关闭、仍存在、新引入的问题指纹。用于修复后确认没有按下葫芦浮起瓢。',
-        parameters: compileParameters({
-            target: { type: 'string', description: '复扫文件或目录（可选，缺省扫描整个工作区）。' },
-        }),
+        parameters: { ...compileParameters({
+                target: { type: 'string', description: '复扫文件或目录（可选，缺省扫描整个工作区）。' },
+            }), additionalProperties: false },
         output: {
             schema: {
                 type: 'object',
@@ -172,7 +188,7 @@ export function buildSecureTools(cfg, cwd, runner) {
             },
         },
         async execute(rawArgs) {
-            const args = (rawArgs ?? {});
+            const args = scanArguments(rawArgs);
             const target = optionalString(args, 'target');
             const policy = await loadPolicy(cwd);
             const state = await loadState(stateDir);
@@ -320,7 +336,7 @@ export function buildSecureTools(cfg, cwd, runner) {
             const state = await loadState(stateDir);
             if (state.last === null)
                 throw new Error('尚无扫描结果，请先执行 secure_scan 或 secure_diff。');
-            const text = format === 'sarif' ? buildSarif(state.last.findings, state.last.target) : buildMarkdown(state.last.findings, state.last.target);
+            const text = format === 'sarif' ? buildSarif(state.last.findings, cwd) : buildMarkdown(state.last.findings, state.last.target);
             if (target !== undefined)
                 await writeFile(target, text, 'utf8');
             return { format, path: target ?? '', text, findingCount: state.last.findings.length };
@@ -362,15 +378,15 @@ function buildMarkdown(findings, target) {
     }
     return lines.join('\n') + '\n';
 }
-function buildSarif(findings, target) {
+function buildSarif(findings, cwd) {
     const rules = new Map();
     const results = findings.map((finding, index) => {
-        rules.set(finding.ruleId, { id: finding.ruleId, name: finding.title, shortDescription: finding.title });
+        rules.set(finding.ruleId, { id: finding.ruleId, name: finding.title, shortDescription: { text: finding.title } });
         return {
             ruleId: finding.ruleId,
             level: finding.severity === 'critical' || finding.severity === 'high' ? 'error' : finding.severity === 'medium' ? 'warning' : 'note',
             message: { text: finding.message },
-            locations: [{ physicalLocation: { artifactLocation: { uri: finding.file.replace(/\\/g, '/') }, region: { startLine: finding.line } } }],
+            locations: [{ physicalLocation: { artifactLocation: { uri: finding.file.replace(/\\/g, '/').split('/').map(encodeURIComponent).join('/'), uriBaseId: 'ROOTPATH' }, region: { startLine: finding.line } } }],
             partialFingerprints: { primaryLocationLineHash: finding.id + ':' + String(index) },
         };
     });
@@ -379,7 +395,7 @@ function buildSarif(findings, target) {
         $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
         runs: [{
                 tool: { driver: { name: 'dsh-code-security', version: '0.1.0', informationUri: 'https://github.com/STARDUSTLC666/dsh-code-security', rules: [...rules.values()] } },
-                originalUriBaseIds: { ROOTPATH: { uri: 'file:///' + target.replace(/\\/g, '/') } },
+                originalUriBaseIds: { ROOTPATH: { uri: pathToFileURL(path.resolve(cwd) + path.sep).href } },
                 results,
             }],
     }, null, 2);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-code-security",
-  "version": "0.3.3",
-  "description": "DSH AI 代码安全审查插件：secure_scan/secure_diff/secure_fix_verify/secure_report/secure_export/secure_baseline/secure_deps/secure_policy_show/secure_policy_set 九工具，40+ 确定性规则、密钥熵检测、git diff/staged 审查、SARIF 导出、基线接受与 SBOM-lite，零运行时依赖。",
+  "version": "0.3.6",
+  "description": "DSH 代码安全审查插件：40+ 确定性规则与密钥熵检测，支持 git diff/staged 审查、SARIF 导出、基线接受与 SBOM-lite。",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",