dsh-code-security 0.3.6 → 0.3.8

package/lib/state.js

@@ -6,11 +6,13 @@
  */
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { createHash } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
+import lockfile from 'proper-lockfile';
 const STATE_FILE = 'state.json';
 const HISTORY_LIMIT = 50;
 export function findingFingerprint(finding) {
-    const raw = finding.ruleId + '|' + finding.file + '|' + finding.snippet.trim();
+    const file = finding.file.split(path.sep).join('/').replace(/^(?:\.\/)+/, '');
+    const raw = finding.ruleId + '|' + file + '|' + finding.snippet.trim();
     return createHash('sha256').update(raw).digest('hex');
 }
 export function statePath(stateDir) {
@@ -18,43 +20,96 @@ export function statePath(stateDir) {
 }
 export async function loadState(stateDir) {
     try {
+        const info = await fs.lstat(statePath(stateDir));
+        if (!info.isFile() || info.isSymbolicLink() || info.size > 16 * 1024 * 1024)
+            throw new Error('记录不是普通文件或超过 16 MiB');
         const text = await fs.readFile(statePath(stateDir), 'utf8');
         const parsed = JSON.parse(text);
         const obj = (parsed ?? {});
+        if (!Array.isArray(obj.history) || obj.history.some(entry => !isEntry(entry)) || obj.last !== null && !isEntry(obj.last) || obj.baseline !== undefined && obj.baseline !== null && !isBaseline(obj.baseline))
+            throw new Error('记录结构无效');
         const last = isEntry(obj.last) ? obj.last : null;
         const history = Array.isArray(obj.history) ? obj.history.filter(isEntry) : [];
         const baseline = isBaseline(obj.baseline) ? obj.baseline : null;
         return { last, history, baseline };
     }
-    catch {
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw new Error('安全扫描记录无法读取，原文件已保留：' + (error instanceof Error ? error.message : String(error)));
         return { last: null, history: [], baseline: null };
     }
 }
 function isEntry(value) {
-    return typeof value === 'object' && value !== null && Array.isArray(value.findings);
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const row = value;
+    return typeof row.mode === 'string' && typeof row.target === 'string' && typeof row.time === 'string'
+        && Number.isInteger(row.filesScanned) && row.filesScanned >= 0 && validFindings(row.findings)
+        && validFingerprints(row.fingerprints) && validCounts(row.counts);
 }
 function isBaseline(value) {
-    return typeof value === 'object' && value !== null && Array.isArray(value.findings) && Array.isArray(value.fingerprints);
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const row = value;
+    return typeof row.time === 'string' && typeof row.target === 'string' && typeof row.reason === 'string'
+        && validFindings(row.findings) && validFingerprints(row.fingerprints) && validCounts(row.counts);
 }
-export async function saveState(stateDir, entry) {
+function validFingerprints(value) { return Array.isArray(value) && value.every(item => typeof item === 'string'); }
+function validCounts(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const counts = value;
+    return ['critical', 'high', 'medium', 'low'].every(key => typeof counts[key] === 'number' && Number.isInteger(counts[key]) && counts[key] >= 0);
+}
+function validFindings(value) {
+    return Array.isArray(value) && value.every(item => typeof item === 'object' && item !== null
+        && typeof item.ruleId === 'string' && typeof item.file === 'string' && typeof item.snippet === 'string'
+        && Number.isInteger(item.line) && item.line >= 1 && ['critical', 'high', 'medium', 'low'].includes(item.severity));
+}
+export async function saveState(stateDir, entry, signal) {
+    signal?.throwIfAborted();
     await fs.mkdir(stateDir, { recursive: true });
-    const state = await loadState(stateDir);
-    state.last = entry;
-    state.history.unshift(entry);
-    state.history = state.history.slice(0, HISTORY_LIMIT);
-    return writeState(stateDir, state);
+    const unlock = await lockfile.lock(stateDir, { retries: { retries: 30, minTimeout: 25, maxTimeout: 100 } });
+    try {
+        signal?.throwIfAborted();
+        const state = await loadState(stateDir);
+        state.last = entry;
+        state.history.unshift(entry);
+        state.history = state.history.slice(0, HISTORY_LIMIT);
+        return await writeState(stateDir, state, signal);
+    }
+    finally {
+        await unlock();
+    }
 }
-export async function saveBaseline(stateDir, baseline) {
+export async function saveBaseline(stateDir, baseline, signal) {
+    signal?.throwIfAborted();
     await fs.mkdir(stateDir, { recursive: true });
-    const state = await loadState(stateDir);
-    state.baseline = baseline;
-    return writeState(stateDir, state);
+    const unlock = await lockfile.lock(stateDir, { retries: { retries: 30, minTimeout: 25, maxTimeout: 100 } });
+    try {
+        signal?.throwIfAborted();
+        const state = await loadState(stateDir);
+        state.baseline = baseline;
+        return await writeState(stateDir, state, signal);
+    }
+    finally {
+        await unlock();
+    }
 }
-async function writeState(stateDir, state) {
+async function writeState(stateDir, state, signal) {
+    signal?.throwIfAborted();
     const file = statePath(stateDir);
-    const tmp = file + '.tmp-' + process.pid;
-    await fs.writeFile(tmp, JSON.stringify(state, null, 2), 'utf8');
-    await fs.rename(tmp, file);
+    const tmp = file + '.tmp-' + randomUUID(), bytes = JSON.stringify(state, null, 2);
+    if (Buffer.byteLength(bytes) > 16 * 1024 * 1024)
+        throw new Error('安全扫描记录超过 16 MiB，本次没有保存。');
+    try {
+        await fs.writeFile(tmp, bytes, { flag: 'wx', mode: 0o600, signal });
+        signal?.throwIfAborted();
+        await fs.rename(tmp, file);
+    }
+    finally {
+        await fs.unlink(tmp).catch(() => { });
+    }
     return file;
 }
 export function countFindings(findings) {
@@ -76,7 +131,8 @@ export function compareFingerprints(baseline, current) {
 export function splitByBaseline(findings, baseline) {
     if (baseline === null)
         return { fresh: findings, accepted: [] };
-    const acceptedSet = new Set(baseline.fingerprints);
+    // Recompute from saved evidence so older "./file" fingerprints remain usable.
+    const acceptedSet = new Set(baseline.findings.map(findingFingerprint));
     const fresh = [];
     const accepted = [];
     for (const finding of findings) {

package/lib/tools.d.ts

@@ -1,7 +1,7 @@
 /**
- * 九个面向模型的安全审查工具：
+ * 十个面向模型的安全审查工具：
  * secure_scan / secure_diff / secure_fix_verify / secure_report / secure_export /
- * secure_baseline / secure_deps / secure_policy_show / secure_policy_set。
+ * secure_baseline / secure_deps / secure_policy_show / secure_policy_set / secure_health。
  *
  * @module dsh-code-security/tools
  */

package/lib/tools.js

@@ -1,11 +1,12 @@
 /**
- * 九个面向模型的安全审查工具：
+ * 十个面向模型的安全审查工具：
  * secure_scan / secure_diff / secure_fix_verify / secure_report / secure_export /
- * secure_baseline / secure_deps / secure_policy_show / secure_policy_set。
+ * secure_baseline / secure_deps / secure_policy_show / secure_policy_set / secure_health。
  *
  * @module dsh-code-security/tools
  */
 import { writeFile } from 'node:fs/promises';
+import { readFileSync } from 'node:fs';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { optionalString, requiredString } from './config.js';
@@ -16,6 +17,7 @@ import { ruleCategory } from './rules.js';
 import { scanPath } from './scanner.js';
 import { compareFingerprints, countFindings, findingFingerprint, loadState, saveState, splitByBaseline } from './state.js';
 const SEVERITY_ORDER = { critical: 4, high: 3, medium: 2, low: 1 };
+const PACKAGE_VERSION = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
 function compileParameters(spec) {
     const properties = {};
     const required = [];
@@ -46,6 +48,12 @@ function scanArguments(raw, allowed = ['target']) {
     if (Object.hasOwn(args, 'target') && (typeof args.target !== 'string' || args.target.trim() === '')) {
         throw new Error('扫描参数 target 必须是非空的文件或目录字符串。扫描整个工作区请省略 target 或使用 "."。');
     }
+    if (Object.hasOwn(args, 'base') && (typeof args.base !== 'string' || args.base.trim() === '' || args.base.trim().startsWith('-') || args.base.includes('\0'))) {
+        throw new Error('扫描参数 base 必须是非空的 Git ref，不能是 Git 命令选项。');
+    }
+    if (Object.hasOwn(args, 'staged') && typeof args.staged !== 'boolean') {
+        throw new Error('扫描参数 staged 必须是布尔值 true 或 false。');
+    }
     return args;
 }
 const findingSchema = {
@@ -66,6 +74,7 @@ const scanSchema = {
     type: 'object',
     properties: {
         root: { type: 'string' }, filesScanned: { type: 'integer' }, filesSkipped: { type: 'integer' },
+        filesChanged: { type: 'integer' }, addedLines: { type: 'integer' },
         findings: { type: 'array', items: findingSchema }, counts: countsSchema, passed: { type: 'boolean' },
         failOn: { type: 'string' }, durationMs: { type: 'integer' },
         newFindings: { type: 'array', items: findingSchema }, newCounts: countsSchema,
@@ -94,12 +103,26 @@ function renderFindings(_args, value) {
         '安全审查：' + (rec.passed === true ? '通过' : '未通过'),
         '文件 ' + String(rec.filesScanned ?? 0) + ' 个，发现 ' + findings.length + ' 个问题（critical ' + String(counts?.critical ?? 0) + ' / high ' + String(counts?.high ?? 0) + ' / medium ' + String(counts?.medium ?? 0) + ' / low ' + String(counts?.low ?? 0) + '）；基线外新增 ' + split.fresh.length + ' 个。',
     ];
+    if (typeof rec.filesSkipped === 'number' && rec.filesSkipped > 0)
+        lines.push('已跳过 ' + rec.filesSkipped + ' 项；跳过项不计入已扫描文件数。');
     for (const finding of findings) {
         lines.push('- ' + finding.file + ':' + finding.line + ' [' + finding.severity + '] ' + finding.ruleId + ' ' + finding.title);
     }
     return [{ type: 'text', text: lines.join('\n') }];
 }
 export function buildSecureTools(cfg, cwd, runner) {
+    return buildWorkspaceTools(cfg, cwd, runner).map(tool => ({ ...tool, async execute(args, exec) {
+            const context = exec;
+            const signal = context?.signal;
+            signal?.throwIfAborted();
+            const workspace = context?.agent?.session?.header?.cwd || cwd;
+            const resolved = { ...cfg, stateDir: cfg.stateDirRelative ? path.resolve(workspace, cfg.stateDirRelative) : cfg.stateDir };
+            const scopedRunner = { run: (argv, options) => runner.run(argv, { ...options, cwd: workspace, signal }) };
+            const selected = buildWorkspaceTools(resolved, workspace, scopedRunner, signal).find(row => row.name === tool.name);
+            return selected.execute(args, exec);
+        } }));
+}
+function buildWorkspaceTools(cfg, cwd, runner, signal) {
     const stateDir = cfg.stateDir;
     const secureScan = {
         name: 'secure_scan',
@@ -113,7 +136,7 @@ export function buildSecureTools(cfg, cwd, runner) {
             const target = optionalString(args, 'target');
             const policy = await loadPolicy(cwd);
             const failOn = policy.failOn ?? cfg.failOn;
-            const result = await scanPath({ cwd, target, maxFiles: cfg.maxFiles, maxFileBytes: cfg.maxFileBytes, policy });
+            const result = await scanPath({ cwd, target, maxFiles: cfg.maxFiles, maxFileBytes: cfg.maxFileBytes, policy, signal });
             const state = await loadState(stateDir);
             const counts = countFindings(result.findings);
             const split = splitByBaseline(result.findings, state.baseline);
@@ -126,14 +149,14 @@ export function buildSecureTools(cfg, cwd, runner) {
                 fingerprints: result.findings.map(findingFingerprint),
                 counts,
             };
-            const stateFile = await saveState(stateDir, entry);
+            const stateFile = await saveState(stateDir, entry, signal);
             return { ...result, counts, newFindings: split.fresh, newCounts: countFindings(split.fresh), acceptedFindings: split.accepted, baseline: state.baseline, passed: verdictOf(split.fresh, failOn), failOn, stateFile };
         },
         timeoutMs: 120000,
     };
     const secureDiff = {
         name: 'secure_diff',
-        description: '只审查 git diff 的新增行（默认 HEAD，即未提交改动）。base 可用任意 git ref；staged=true 审查已暂存改动；target 可限定文件。结果同样写入状态。',
+        description: '结合少量上下文审查 git diff，只报告涉及新增行的问题（默认 HEAD，即未提交改动）。base 可用 Git ref；staged=true 审查已暂存改动；target 可限定文件。范围与路径相对当前会话工作区，遵守项目排除策略。结果同样写入状态。',
         parameters: { ...compileParameters({
                 base: { type: 'string', description: 'git 基线（默认 HEAD）。' },
                 target: { type: 'string', description: '限定文件路径（可选）。' },
@@ -155,13 +178,13 @@ export function buildSecureTools(cfg, cwd, runner) {
                 mode: 'diff:' + base,
                 target: target ?? '.',
                 time: new Date().toISOString(),
-                filesScanned: result.filesChanged,
+                filesScanned: result.filesScanned,
                 findings: result.findings,
                 fingerprints: result.findings.map(findingFingerprint),
                 counts,
             };
-            await saveState(stateDir, entry);
-            return { root: base, filesScanned: result.filesChanged, filesSkipped: 0, addedLines: result.addedLines, findings: result.findings, counts, newFindings: split.fresh, newCounts: countFindings(split.fresh), acceptedFindings: split.accepted, baseline: state.baseline, passed: verdictOf(split.fresh, failOn), failOn, durationMs: 0 };
+            await saveState(stateDir, entry, signal);
+            return { root: base, filesChanged: result.filesChanged, filesScanned: result.filesScanned, filesSkipped: result.filesSkipped, addedLines: result.addedLines, findings: result.findings, counts, newFindings: split.fresh, newCounts: countFindings(split.fresh), acceptedFindings: split.accepted, baseline: state.baseline, passed: verdictOf(split.fresh, failOn), failOn, durationMs: 0 };
         },
         timeoutMs: 60000,
     };
@@ -192,12 +215,12 @@ export function buildSecureTools(cfg, cwd, runner) {
             const target = optionalString(args, 'target');
             const policy = await loadPolicy(cwd);
             const state = await loadState(stateDir);
-            const result = await scanPath({ cwd, target, maxFiles: cfg.maxFiles, maxFileBytes: cfg.maxFileBytes, policy });
+            const result = await scanPath({ cwd, target, maxFiles: cfg.maxFiles, maxFileBytes: cfg.maxFileBytes, policy, signal });
             if (state.last === null) {
                 return { baselineMissing: true, baselineTime: '', closedCount: 0, remainingCount: 0, freshCount: result.findings.length, closed: [], remaining: [], fresh: result.findings, passed: false };
             }
             const current = result.findings.map(findingFingerprint);
-            const cmp = compareFingerprints(state.last.fingerprints, current);
+            const cmp = compareFingerprints(state.last.findings.map(findingFingerprint), current);
             const byFingerprint = new Map(result.findings.map((finding) => [findingFingerprint(finding), finding]));
             const closed = cmp.closed.map((fp) => state.last.findings.find((finding) => findingFingerprint(finding) === fp)).filter((x) => x !== undefined);
             const remaining = cmp.remaining.map((fp) => byFingerprint.get(fp)).filter((x) => x !== undefined);
@@ -306,7 +329,7 @@ export function buildSecureTools(cfg, cwd, runner) {
                 throw new Error('policy 参数不是合法 JSON。');
             }
             const policy = normalizePolicy((parsed ?? {}));
-            const file = await savePolicy(cwd, policy);
+            const file = await savePolicy(cwd, policy, signal);
             return { file, policy };
         },
         timeoutMs: 10000,
@@ -337,6 +360,7 @@ export function buildSecureTools(cfg, cwd, runner) {
             if (state.last === null)
                 throw new Error('尚无扫描结果，请先执行 secure_scan 或 secure_diff。');
             const text = format === 'sarif' ? buildSarif(state.last.findings, cwd) : buildMarkdown(state.last.findings, state.last.target);
+            signal?.throwIfAborted();
             if (target !== undefined)
                 await writeFile(target, text, 'utf8');
             return { format, path: target ?? '', text, findingCount: state.last.findings.length };
@@ -369,7 +393,7 @@ export function buildSecureTools(cfg, cwd, runner) {
             return { ok: true, plugin: 'dsh-code-security', checks };
         },
     };
-    return [secureScan, secureDiff, secureFixVerify, secureReport, secureExport, ...buildExtraTools(cfg, cwd), policyShow, policySet, secureHealth];
+    return [secureScan, secureDiff, secureFixVerify, secureReport, secureExport, ...buildExtraTools(cfg, cwd, signal), policyShow, policySet, secureHealth];
 }
 function buildMarkdown(findings, target) {
     const lines = ['# 安全审查报告', '', '目标：' + target, '', '| 严重度 | 规则 | CWE | 文件:行 | 说明 |', '| :-- | :-- | :-- | :-- | :-- |'];
@@ -394,7 +418,7 @@ function buildSarif(findings, cwd) {
         version: '2.1.0',
         $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
         runs: [{
-                tool: { driver: { name: 'dsh-code-security', version: '0.1.0', informationUri: 'https://github.com/STARDUSTLC666/dsh-code-security', rules: [...rules.values()] } },
+                tool: { driver: { name: 'dsh-code-security', version: PACKAGE_VERSION, informationUri: 'https://github.com/STARDUSTLC666/dsh-code-security', rules: [...rules.values()] } },
                 originalUriBaseIds: { ROOTPATH: { uri: pathToFileURL(path.resolve(cwd) + path.sep).href } },
                 results,
             }],

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-code-security",
-  "version": "0.3.6",
-  "description": "DSH 代码安全审查插件：40+ 确定性规则与密钥熵检测，支持 git diff/staged 审查、SARIF 导出、基线接受与 SBOM-lite。",
+  "version": "0.3.8",
+  "description": "对代码与 Git 改动进行本地静态安全检查，并追踪修复结果。",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -17,7 +17,9 @@
     "lib",
     "cordis.patch.yml",
     "README.md",
-    "README.en.md"
+    "README.en.md",
+    "docs",
+    "CHANGELOG.md"
   ],
   "scripts": {
     "build": "tsc -p tsconfig.json",
@@ -46,6 +48,7 @@
   },
   "devDependencies": {
     "@types/node": "^24.0.0",
+    "@types/proper-lockfile": "4.1.4",
     "typescript": "^5.6.0"
   },
   "repository": {
@@ -57,5 +60,8 @@
   },
   "homepage": "https://github.com/STARDUSTLC666/dsh-code-security#readme",
   "author": "stardustlc",
-  "packageManager": "pnpm@11.7.0"
+  "packageManager": "pnpm@11.7.0",
+  "dependencies": {
+    "proper-lockfile": "4.1.2"
+  }
 }