dsh-code-security 0.3.7 → 0.3.8

package/CHANGELOG.md

@@ -4,6 +4,14 @@
 
 [历史英文记录](docs/CHANGELOG.en.md)
 
+## 0.3.8 (2026-10-12)
+
+- 修复增量扫描遗漏中文/转义文件名、私钥、`.env` 敏感项和禁用依赖审计配置的问题，报告真实证据行号。
+- 结合有限上下文识别已有豁免和跨行配置，仅报告涉及新增行的问题；校验差异块行数，格式错误或不完整时明确报错。
+- 全量、单文件与增量扫描统一排除策略和工作区相对路径，兼容旧记录中 `./` 前缀的基线指纹。
+- 固定 Git 输出格式与当前工作区范围，禁用外部 diff/textconv，拒绝被误当成 Git 选项的基线参数和错误类型的 `staged` 参数。
+- 补充隔离 Git 回归场景；范围、兼容注意事项及后续计划见[本轮迭代记录](docs/ITERATION-2026-10-12.md)。
+
 ## 0.3.7 (2026-10-05)
 
 - 扫描、策略、报告和 git diff 使用当前会话工作区；支持取消并跳过目录联接。锁定合并历史与基线写入，损坏记录和无效策略明确报错并保留原文件。

package/README.en.md

@@ -8,6 +8,8 @@ Run local static security checks on code or Git changes and verify fixes.
 
 [![npm](https://img.shields.io/npm/v/dsh-code-security)](https://www.npmjs.com/package/dsh-code-security) [![downloads](https://raw.githubusercontent.com/STARDUSTLC666/dsh-suite/npm-downloads/assets/dsh-code-security-downloads.svg)](https://www.npmjs.com/package/dsh-code-security)
 
+Feedback and contributions are welcome: report [issues](https://github.com/STARDUSTLC666/dsh-code-security/issues) or submit [pull requests](https://github.com/STARDUSTLC666/dsh-code-security/pulls).
+
 ## What it does
 
 - Scan files, directories or Git diffs with locations and code evidence.

package/README.md

@@ -8,6 +8,8 @@
 
 [![npm](https://img.shields.io/npm/v/dsh-code-security)](https://www.npmjs.com/package/dsh-code-security) [![downloads](https://raw.githubusercontent.com/STARDUSTLC666/dsh-suite/npm-downloads/assets/dsh-code-security-downloads.svg)](https://www.npmjs.com/package/dsh-code-security)
 
+欢迎使用，遇到问题或有改进建议，请提交 [issues](https://github.com/STARDUSTLC666/dsh-code-security/issues) 和 [PR](https://github.com/STARDUSTLC666/dsh-code-security/pulls)。
+
 ## 功能
 
 - 扫描文件、目录或 Git diff，报告规则、位置与代码证据。

package/docs/ITERATION-2026-10-12.md

@@ -0,0 +1,53 @@
+# dsh-code-security 第一轮迭代
+
+日期：2026-10-12。基于 `91d4d8c770cfaa796d07b7b770a627c3bce8f49e`，本轮版本为 `0.3.8`。此页记录源码迭代和本地验证；发布 CI、npm 完整性及隔离安装结果在发布后独立核验。
+
+这轮先解决增量审查的漏报、范围和证据一致性。原有 37 项测试全部通过，但新增回归测试在旧实现上复现了中文路径、文件级规则等问题被误判为通过。
+
+## 已实现
+
+| 场景 | 原行为 | 当前行为 |
+| :-- | :-- | :-- |
+| 中文/转义文件名 | Git 引号与八进制路径解析失败，可能返回零发现并通过 | 解码 UTF-8 与 Git 的 C 转义，保留正确文件和行号 |
+| 新增私钥、`.env` 敏感项、`audit=false` | 增量扫描跳过文件级规则 | 全量和增量共用匹配，定位实际证据；保留跨行配置检测 |
+| 未改动的豁免注释、危险代码 | 缺少上下文，已有 next-line 豁免失效 | 读取少量上下文，只报告证据涉及新增行的问题 |
+| 仓库子目录作为会话工作区 | 带入兄弟目录改动，路径基准偏离工作区 | Git 范围和证据路径均相对当前会话工作区 |
+| 策略排除 | 增量扫描未应用排除，直接选择文件也绕过排除 | 三种扫描入口统一排除；报告实际扫描和跳过数量 |
+| 基线一致性 | 全量的 `./src/a.js` 与增量的 `src/a.js` 指纹不同 | 规范相对路径，并从保存的证据重算旧基线指纹 |
+| Git 个性化配置/参数 | 颜色、前缀影响解析；`--quiet` 可误当基线 | 固定输出格式，禁用外部 diff/textconv，校验参数类型 |
+| 差异块缺失行 | 接受不完整差异并给出部分结果 | 校验差异块行数，异常时保留原扫描状态并报错 |
+
+主要代码：[diff.ts](../src/diff.ts)、[scanner.ts](../src/scanner.ts)、[tools.ts](../src/tools.ts)、[state.ts](../src/state.ts)。已同步仓库跟踪的 `lib/` 构建产物。
+
+## 验证
+
+- `pnpm test`：53/53 通过，0 失败，0 跳过；包含 TypeScript 构建。
+- 新增 16 项回归测试，其中 9 项使用本地隔离 Git 仓库。覆盖中文路径、暂存区与工作树不一致、Git 输出偏好、子工作区、基线兼容、外部转换器与排除计数等。
+- 工具调用链覆盖 `secure_scan` / `secure_diff` / `secure_baseline` / `secure_fix_verify` / `secure_report` / `secure_export`，验证写入状态、结果渲染文本和 SARIF 路径。
+- 环境：Windows，Node `24.16.0`，pnpm `11.7.0`，Git `2.54.0.windows.1`。
+- 本页所列测试未在真实 DSH Web/桌面界面执行点击、输入或视觉验收；本地运行环境为 Windows/Node 24，Linux CI 与 npm 发布验收另行记录。
+
+回归入口：[diff.test.mjs](../test/diff.test.mjs)、[git-diff.test.mjs](../test/git-diff.test.mjs)。测试仓库位于 E 盘项目内的 `test/.tmp/`，测试结束后仅清理经过路径校验的自建子目录。
+
+## 兼容注意
+
+未新增依赖；继续沿用项目已有的 MIT 许可与 `proper-lockfile@4.1.2`（MIT），Node 声明保持 `^22.19.0 || >=24.0.0`。原工具名和参数结构保留，增量输出增加明确的扫描/跳过计数。
+
+旧记录的 `./` 前缀兼容已验证。`SEC-303`、`SEC-305`、`SEC-404` 的证据由“整个文件开头”改成“实际匹配片段”；旧基线若使用前一种片段，可能被视为新增。应复扫并人工确认后重新接受，不能自动把新证据全部豁免。
+
+增量检查只涵盖 Git 显示的文本差异，仍不包含未跟踪文件。上下文为前后各 3 行；超出上下文的跨行结构、通用数据流和复杂语言语义未由本轮解决。差异块校验可以发现块内截断，但不代表已解决所有收集上限下的完整性判断。
+
+## 下一轮优先项
+
+以下来自当前代码静态检查，尚未在本轮实现或验收。
+
+1. **扫描完整性门禁。** `scanPath` 遇到不存在目标、读取失败或文件数上限时，应返回明确的完整性状态；`passed` 不能仅因发现为空而为真。还应检查宿主 stdout 收集上限带来的整体截断。
+2. **复扫范围校验。** `secure_fix_verify` 应核对上次与本次目标/覆盖范围，避免把没有重新扫描的问题误报为关闭；部分复扫应输出“未验证”。
+3. **规则准确性与隐私。** 补充安全/危险样例集，优先处理普通字符串、块注释、已使用安全 Loader 等误报；为密钥证据增加默认脱敏，并设计不依赖明文片段的稳定指纹。
+4. **依赖清单解析。** 为标准 `pyproject.toml`、Cargo 依赖区段和损坏清单补测试，再评估采用 MIT/兼容许可的 TOML 解析器；当前 SBOM-lite 不能当作漏洞数据库扫描。
+
+后续功能迭代仍需补单插件真实 DSH 界面验收和更广的跨平台 CI；本版发布验证独立进行。
+
+## Git 行为依据
+
+输出格式、工作区相对范围和外部转换器开关按 [Git diff 官方文档](https://git-scm.com/docs/git-diff) 实现；文件名转义依据 [core.quotePath 官方说明](https://git-scm.com/docs/git-config#Documentation/git-config.txt-corequotePath)。

package/docs/USAGE.en.md

@@ -6,6 +6,12 @@
 
 Relative stateDir defaults to .code-security in the session workspace. Concurrent scans retain both histories. Damaged records must be inspected after backup rather than silently recreated. Scans skip symlinks and junctions; static rules do not replace a full security audit.
 
+0.3.8 (2026-10-12): incremental reviews decode Git's quoted paths and check added private keys, `.env` secrets and disabled audit settings. Three context lines on each side support existing next-line suppressions and multiline settings; only evidence intersecting added lines is reported. Multiline locations point to the match's first line. Staged reviews use index content rather than later working-tree edits.
+
+Full, directly selected file and incremental scans share default and policy exclusions. Paths and Git scope are relative to the session workspace, including nested workspaces. `filesScanned` counts reviewed files and `filesSkipped` includes exclusions; incremental results also provide `filesChanged` and reviewed `addedLines`. Git output uses fixed colors/prefixes and disables external diff/textconv helpers. Invalid `base`/`staged` arguments and malformed or incomplete hunks fail without replacing scan state.
+
+Saved evidence with a legacy `./` path prefix still matches baselines. File-level findings now use actual matching snippets; older baselines that saved the beginning of an entire file may require a fresh scan and human review before acceptance.
+
 ## Tools
 
 | Tool | Purpose | Write |

package/docs/USAGE.md

@@ -6,6 +6,14 @@
 
 相对 stateDir 默认在会话工作区的 .code-security。并发扫描保留双方历史；记录损坏时先备份排查，不会默默重建。扫描不跟随符号链接或目录联接；静态规则不能代替完整安全审计。
 
+0.3.8 改进（2026-10-12）：`secure_diff` 支持 Git 转义的中文/特殊文件名，并检查新增私钥、`.env` 敏感项与禁用审计配置。它读取前后各 3 行上下文以处理已有豁免和跨行配置，只报告证据涉及新增行的问题；跨行证据的行号指向匹配的起始行。暂存扫描以暂存区内容为准。
+
+全量、直接指定文件与增量扫描均遵守默认目录排除及策略 `exclude`。文件路径统一相对当前会话工作区；在仓库子目录作为工作区时，增量扫描不包含该目录外的改动。返回的 `filesScanned` 为实际审查的文件数，`filesSkipped` 包含排除项；增量结果另有 `filesChanged` 和实际审查的 `addedLines`。
+
+`base` 必须是非空 Git ref，不能以 `-` 开头；`staged` 必须是布尔值。差异块行数不完整或格式错误会报错，本次不会覆盖已有扫描记录。Git 的颜色/前缀偏好不会改变解析格式，外部 diff 和 textconv 转换器被禁用。
+
+旧记录的 `./` 路径前缀可继续匹配基线。私钥、`.env` 和禁用审计配置现在使用实际匹配片段；旧基线若保存的是文件开头的大段文本，可能被重新识别为新增，需复扫并人工复核后再接受。详见[本轮迭代记录](ITERATION-2026-10-12.md)。
+
 ## 工具
 
 | 工具 | 作用 | 写操作 |

package/lib/diff.d.ts

@@ -13,10 +13,13 @@ export interface DiffLine {
 export interface DiffFile {
     file: string;
     added: DiffLine[];
+    context?: DiffLine[];
 }
 export interface DiffScanResult {
     base: string;
     filesChanged: number;
+    filesScanned: number;
+    filesSkipped: number;
     addedLines: number;
     findings: Finding[];
     diff: string;

package/lib/diff.js

@@ -5,15 +5,18 @@
  */
 import path from 'node:path';
 import { createHash } from 'node:crypto';
-import { scanLineSet } from './scanner.js';
+import { isExcludedPath, scanLineSet } from './scanner.js';
 /** 运行 git diff（默认 HEAD，工作区未提交改动）。 */
 export async function runGitDiff(runner, cwd, base, target, timeoutMs = 30000, staged = false) {
+    if (typeof base !== 'string' || base.trim() === '' || base.trim().startsWith('-') || base.includes('\0')) {
+        throw new Error('参数 base 必须是非空的 Git ref，不能是 Git 命令选项。');
+    }
     const argv = ['git', 'diff'];
     if (staged)
         argv.push('--cached');
-    argv.push('--no-ext-diff', '--unified=0', base);
+    argv.push('--no-ext-diff', '--no-textconv', '--no-color', '--relative', '--src-prefix=a/', '--dst-prefix=b/', '--unified=3', '--output-indicator-new=+', '--output-indicator-old=-', '--output-indicator-context= ', base.trim(), '--');
     if (target !== undefined && target.trim() !== '')
-        argv.push('--', target.trim());
+        argv.push(target.trim());
     const result = await runner.run(argv, { timeoutMs, cwd });
     if (result.exitCode !== 0 && result.exitCode !== 1) {
         throw new Error('git diff 失败（退出码 ' + String(result.exitCode) + '）：' + result.stderr.trim().split(/\r?\n/).slice(-4).join(' | '));
@@ -22,48 +25,117 @@ export async function runGitDiff(runner, cwd, base, target, timeoutMs = 30000, s
         return '';
     return result.stdout;
 }
-function isNewFileHeader(line) {
-    const m = /^\+\+\+ b\/(.*)$/.exec(line);
-    if (m === null)
-        return null;
-    const file = m[1].replace(/\t.*$/, '');
-    if (file === '' || file === '/dev/null')
-        return null;
-    return file;
+function invalidDiff() {
+    return new Error('git diff 不完整或格式无效，无法确认已审查全部新增行。');
+}
+/** Git quotes unusual path bytes using C escapes, including octal UTF-8. */
+function decodeGitPath(value) {
+    if (!value.startsWith('"'))
+        return value.replace(/\t.*$/, '');
+    const chunks = [];
+    const escapes = { a: 7, b: 8, f: 12, n: 10, r: 13, t: 9, v: 11, '\\': 92, '"': 34 };
+    let literal = '';
+    for (let index = 1; index < value.length; index++) {
+        const char = value[index];
+        if (char === '"') {
+            if (!/^(?:\t.*)?$/.test(value.slice(index + 1)))
+                throw invalidDiff();
+            chunks.push(Buffer.from(literal));
+            try {
+                return new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks));
+            }
+            catch {
+                throw invalidDiff();
+            }
+        }
+        if (char !== '\\') {
+            literal += char;
+            continue;
+        }
+        chunks.push(Buffer.from(literal));
+        literal = '';
+        const octal = /^[0-7]{1,3}/.exec(value.slice(index + 1));
+        if (octal !== null) {
+            const byte = Number.parseInt(octal[0], 8);
+            if (byte > 255)
+                throw invalidDiff();
+            chunks.push(Buffer.from([byte]));
+            index += octal[0].length;
+        }
+        else {
+            const byte = escapes[value[++index]];
+            if (byte === undefined)
+                throw invalidDiff();
+            chunks.push(Buffer.from([byte]));
+        }
+    }
+    throw invalidDiff();
 }
 /** 解析 unified diff，返回每个文件的新增行与新行号。 */
 export function parseDiff(diff, cwd) {
     const files = [];
     let current = null;
     let newLine = 0;
+    let oldRemaining = 0;
+    let newRemaining = 0;
+    let hasFileHeader = false;
     for (const raw of diff.split(/\r?\n/)) {
-        const file = isNewFileHeader(raw);
-        if (file !== null) {
-            current = { file: file.replace(/\\/g, '/'), added: [] };
-            files.push(current);
-            newLine = 0;
+        // Interpret hunk bodies before headers: source text may itself start "+++".
+        if (oldRemaining > 0 || newRemaining > 0) {
+            if (raw.startsWith('\\'))
+                continue;
+            if (raw.startsWith('+') && newRemaining > 0) {
+                current?.added.push({ line: newLine, text: raw.slice(1) });
+                newRemaining--;
+                newLine++;
+            }
+            else if (raw.startsWith('-') && oldRemaining > 0) {
+                oldRemaining--;
+            }
+            else if (raw.startsWith(' ') && oldRemaining > 0 && newRemaining > 0) {
+                if (current !== null)
+                    (current.context ??= []).push({ line: newLine, text: raw.slice(1) });
+                oldRemaining--;
+                newRemaining--;
+                newLine++;
+            }
+            else {
+                throw invalidDiff();
+            }
             continue;
         }
-        const hunk = /^@@\s+-\d+(?:,\d+)?\s+\+(\d+)(?:,\d+)?\s+@@/.exec(raw);
-        if (hunk !== null && current !== null) {
-            newLine = Number(hunk[1]);
+        if (raw.startsWith('diff --git ')) {
+            current = null;
+            hasFileHeader = false;
             continue;
         }
-        if (current === null)
-            continue;
-        if (raw.startsWith('+++') || raw.startsWith('---'))
+        if (raw.startsWith('+++ ')) {
+            const file = decodeGitPath(raw.slice(4));
+            if (file !== '/dev/null' && (!file.startsWith('b/') || file.length <= 2))
+                throw invalidDiff();
+            current = file === '/dev/null' ? null : { file: file.slice(2), added: [] };
+            if (current !== null)
+                files.push(current);
+            hasFileHeader = true;
+            newLine = 0;
             continue;
-        if (raw.startsWith('+')) {
-            current.added.push({ line: newLine, text: raw.slice(1) });
-            newLine += 1;
-        }
-        else if (raw.startsWith('-')) {
-            // removed line: new line number stays
         }
-        else {
-            newLine += 1;
+        const hunk = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/.exec(raw);
+        if (hunk !== null) {
+            if (!hasFileHeader)
+                throw invalidDiff();
+            oldRemaining = Number(hunk[2] ?? 1);
+            newRemaining = Number(hunk[4] ?? 1);
+            newLine = Number(hunk[3]);
+            if (![oldRemaining, newRemaining, newLine].every(Number.isSafeInteger) || newRemaining > 0 && newLine < 1)
+                throw invalidDiff();
+            continue;
         }
+        if (raw.startsWith('@@') || raw.startsWith('+') || raw.startsWith('-') && !raw.startsWith('--- '))
+            throw invalidDiff();
     }
+    if (oldRemaining > 0 || newRemaining > 0)
+        throw invalidDiff();
     return files;
 }
 function makeDiffId(ruleId, file, line, snippet) {
@@ -75,13 +147,19 @@ export function scanDiff(diff, cwd, policy) {
     const parsed = parseDiff(diff, cwd);
     const findings = [];
     let addedLines = 0;
+    let filesSkipped = 0;
     for (const file of parsed) {
-        addedLines += file.added.length;
         const rel = path.isAbsolute(file.file) ? path.relative(cwd, file.file) : file.file;
-        findings.push(...scanLineSet(file.added, rel, policy).map((finding) => ({ ...finding, id: makeDiffId(finding.ruleId, rel, finding.line, finding.snippet) })));
+        if (isExcludedPath(rel, policy)) {
+            filesSkipped++;
+            continue;
+        }
+        addedLines += file.added.length;
+        const entries = [...(file.context ?? []), ...file.added].sort((a, b) => a.line - b.line);
+        findings.push(...scanLineSet(entries, rel, policy, new Set(file.added.map(line => line.line))).map((finding) => ({ ...finding, id: makeDiffId(finding.ruleId, rel, finding.line, finding.snippet) })));
     }
     findings.sort((a, b) => severityOrder(b.severity) - severityOrder(a.severity) || a.file.localeCompare(b.file) || a.line - b.line);
-    return { base: 'HEAD', filesChanged: parsed.length, addedLines, findings, diff };
+    return { base: 'HEAD', filesChanged: parsed.length, filesScanned: parsed.length - filesSkipped, filesSkipped, addedLines, findings, diff };
 }
 function severityOrder(severity) {
     return severity === 'critical' ? 4 : severity === 'high' ? 3 : severity === 'medium' ? 2 : 1;

package/lib/extra.js

@@ -6,7 +6,7 @@
 import path from 'node:path';
 import { optionalString, requiredString } from './config.js';
 import { scanDeps } from './deps.js';
-import { loadState, saveBaseline } from './state.js';
+import { findingFingerprint, loadState, saveBaseline } from './state.js';
 function compileParameters(spec) {
     const properties = {};
     const required = [];
@@ -48,7 +48,7 @@ export function buildExtraTools(cfg, cwd, signal) {
                 target: state.last.target,
                 reason,
                 findings: state.last.findings,
-                fingerprints: state.last.fingerprints,
+                fingerprints: state.last.findings.map(findingFingerprint),
                 counts: state.last.counts,
             };
             const file = await saveBaseline(stateDir, baseline, signal);

package/lib/index.d.ts

@@ -2,7 +2,8 @@
  * dsh-code-security —— AI 代码安全审查插件（node 半身，配置走 cordis.patch.yml）。
  *
  * 插件导出 apply(ctx, config)：注册 secure_scan / secure_diff / secure_fix_verify /
- * secure_report / secure_export / secure_policy_show / secure_policy_set 七个工具。扫描为纯确定性规则，
+ * secure_report / secure_export / secure_baseline / secure_deps / secure_policy_show /
+ * secure_policy_set / secure_health 十个工具。扫描为纯确定性规则，
  * git diff 通过官方 subprocess 服务执行，仅依赖文件锁库。
  *
  * @module dsh-code-security

package/lib/index.js

@@ -2,7 +2,8 @@
  * dsh-code-security —— AI 代码安全审查插件（node 半身，配置走 cordis.patch.yml）。
  *
  * 插件导出 apply(ctx, config)：注册 secure_scan / secure_diff / secure_fix_verify /
- * secure_report / secure_export / secure_policy_show / secure_policy_set 七个工具。扫描为纯确定性规则，
+ * secure_report / secure_export / secure_baseline / secure_deps / secure_policy_show /
+ * secure_policy_set / secure_health 十个工具。扫描为纯确定性规则，
  * git diff 通过官方 subprocess 服务执行，仅依赖文件锁库。
  *
  * @module dsh-code-security

package/lib/scanner.d.ts

@@ -37,8 +37,10 @@ export interface LineEntry {
     text: string;
 }
 /** 对带行号的文本行应用规则（全量扫描与 git diff 增量扫描共用）。 */
-export declare function scanLineSet(entries: LineEntry[], rel: string, policy: SecurePolicy): Finding[];
+export declare function scanLineSet(entries: LineEntry[], rel: string, policy: SecurePolicy, selectedLines?: ReadonlySet<number>): Finding[];
 /** 扫描单个文件内容，按语言与行应用规则。 */
 export declare function scanText(content: string, file: string, rel: string, policy: SecurePolicy): Finding[];
+/** Apply the same exclusions to full scans, directly selected files and diffs. */
+export declare function isExcludedPath(rel: string, policy: SecurePolicy): boolean;
 /** 扫描目录或单个文件。 */
 export declare function scanPath(options: ScanOptions): Promise<ScanResult>;

package/lib/scanner.js

@@ -64,7 +64,7 @@ function shannon(text) {
 }
 const TOKEN_PATTERN = /['"]([A-Za-z0-9+/=_-]{24,})['"]/g;
 const HIGH_ENTROPY_THRESHOLD = 3.8;
-function detectHighEntropy(line, lineNumber, file, rel, rule) {
+function detectHighEntropy(line, lineNumber, rel, rule) {
     const findings = [];
     for (const match of line.matchAll(TOKEN_PATTERN)) {
         const token = match[1];
@@ -94,24 +94,68 @@ function makeId(ruleId, file, line, snippet) {
     const hash = createHash('sha256').update(ruleId + '|' + file + '|' + line + '|' + snippet.slice(0, 80)).digest('hex').slice(0, 10);
     return 'SR-' + hash;
 }
+function scanFileRule(entries, rel, rule, disabledNext, selectedLines) {
+    let block = [];
+    const checkBlock = () => {
+        if (block.length === 0)
+            return undefined;
+        const text = block.map(entry => entry.text).join('\n');
+        let best;
+        for (const pattern of rule.patterns) {
+            const regex = new RegExp(pattern.source, pattern.flags.includes('g') ? pattern.flags : pattern.flags + 'g');
+            for (const match of text.matchAll(regex)) {
+                const index = match.index;
+                const start = text.slice(0, index).split('\n').length - 1;
+                const end = start + match[0].split('\n').length - 1;
+                if (selectedLines !== undefined && !block.slice(start, end + 1).some(entry => selectedLines.has(entry.line)))
+                    continue;
+                if (best === undefined || index < best.index)
+                    best = { index, start, end };
+                break;
+            }
+        }
+        if (best === undefined)
+            return undefined;
+        const line = block[best.start].line;
+        const snippet = block.slice(best.start, best.end + 1).map(entry => entry.text).join('\n');
+        return {
+            id: makeId(rule.id, rel, line, snippet), ruleId: rule.id, title: rule.title,
+            cwe: rule.cwe, severity: rule.severity, confidence: rule.confidence,
+            file: rel, line, snippet: snippet.trim().slice(0, 200), message: rule.message,
+        };
+    };
+    for (const entry of entries) {
+        const suppressed = isComment(entry.text) || shouldSkipLine(rule, disabledNext.get(entry.line));
+        if (suppressed || block.length > 0 && entry.line !== block.at(-1).line + 1) {
+            const finding = checkBlock();
+            if (finding !== undefined)
+                return finding;
+            block = [];
+        }
+        if (!suppressed)
+            block.push(entry);
+    }
+    return checkBlock();
+}
 /** 对带行号的文本行应用规则（全量扫描与 git diff 增量扫描共用）。 */
-export function scanLineSet(entries, rel, policy) {
+export function scanLineSet(entries, rel, policy, selectedLines) {
     const language = languageForFile(rel);
     const findings = [];
-    const applied = RULES.filter((rule) => rule.languages.includes(language) || rule.languages.includes('any'));
+    const applied = RULES.filter((rule) => (rule.languages.includes(language) || rule.languages.includes('any')) && !policyIgnores(policy, rule.id, rel));
+    const entropyRule = applied.find((rule) => rule.id === 'SEC-304');
     const prevDisable = new Map();
     for (const entry of entries) {
         if (isComment(entry.text))
             prevDisable.set(entry.line + 1, disabledRules(entry.text, DISABLE_NEXT));
     }
     for (const entry of entries) {
+        if (selectedLines !== undefined && !selectedLines.has(entry.line))
+            continue;
         const isCommentLine = isComment(entry.text);
         const currentDisable = isCommentLine ? disabledRules(entry.text, DISABLE_LINE) : null;
         for (const rule of applied) {
             if (rule.id === 'SEC-304')
                 continue;
-            if (policyIgnores(policy, rule.id, rel))
-                continue;
             if (shouldSkipLine(rule, currentDisable) || shouldSkipLine(rule, prevDisable.get(entry.line)))
                 continue;
             if (rule.fileLevel === true)
@@ -133,41 +177,30 @@ export function scanLineSet(entries, rel, policy) {
                 message: rule.message,
             });
         }
-        const entropyRule = RULES.find((rule) => rule.id === 'SEC-304');
-        if (entropyRule !== undefined && !policyIgnores(policy, entropyRule.id, rel) && !isCommentLine && !shouldSkipLine(entropyRule, currentDisable) && !shouldSkipLine(entropyRule, prevDisable.get(entry.line))) {
-            findings.push(...detectHighEntropy(entry.text, entry.line, rel, rel, entropyRule));
+        if (entropyRule !== undefined && !isCommentLine && !shouldSkipLine(entropyRule, currentDisable) && !shouldSkipLine(entropyRule, prevDisable.get(entry.line))) {
+            findings.push(...detectHighEntropy(entry.text, entry.line, rel, entropyRule));
         }
     }
+    for (const rule of applied) {
+        if (rule.fileLevel !== true)
+            continue;
+        const finding = scanFileRule(entries, rel, rule, prevDisable, selectedLines);
+        if (finding !== undefined)
+            findings.push(finding);
+    }
     return findings;
 }
 /** 扫描单个文件内容，按语言与行应用规则。 */
 export function scanText(content, file, rel, policy) {
     const lines = content.split(/\r?\n/);
     const entries = lines.map((text, index) => ({ line: index + 1, text }));
-    const findings = scanLineSet(entries, rel, policy);
-    const language = languageForFile(rel);
-    const applied = RULES.filter((rule) => rule.languages.includes(language) || rule.languages.includes('any'));
-    for (const rule of applied) {
-        if (rule.fileLevel !== true)
-            continue;
-        if (policyIgnores(policy, rule.id, rel))
-            continue;
-        if (rule.patterns.some((pattern) => pattern.test(content))) {
-            findings.push({
-                id: makeId(rule.id, rel, 1, content.slice(0, 80)),
-                ruleId: rule.id,
-                title: rule.title,
-                cwe: rule.cwe,
-                severity: rule.severity,
-                confidence: rule.confidence,
-                file: rel,
-                line: 1,
-                snippet: content.slice(0, 200),
-                message: rule.message,
-            });
-        }
-    }
-    return findings;
+    // Match file rules over contiguous lines, sharing locations and suppressions
+    // with incremental scans without joining unrelated diff hunks.
+    return scanLineSet(entries, rel, policy);
+}
+/** Apply the same exclusions to full scans, directly selected files and diffs. */
+export function isExcludedPath(rel, policy) {
+    return rel.split('/').some((part) => DEFAULT_EXCLUDE_DIRS.includes(part)) || policyExcludesDir(policy, rel);
 }
 /** 扫描目录或单个文件。 */
 export async function scanPath(options) {
@@ -177,9 +210,13 @@ export async function scanPath(options) {
     let filesScanned = 0;
     let filesSkipped = 0;
     const findings = [];
-    const relRoot = path.relative(cwd, root) || '.';
+    const relRoot = path.relative(cwd, root).split(path.sep).join('/');
     const visit = async (absolute, rel) => {
         options.signal?.throwIfAborted();
+        if (isExcludedPath(rel, policy)) {
+            filesSkipped += 1;
+            return;
+        }
         let stat;
         try {
             stat = await fs.lstat(absolute);
@@ -194,7 +231,7 @@ export async function scanPath(options) {
             return;
         }
         if (stat.isDirectory()) {
-            if (DEFAULT_EXCLUDE_DIRS.includes(path.basename(absolute)) || policyExcludesDir(policy, rel))
+            if (DEFAULT_EXCLUDE_DIRS.includes(path.basename(absolute)))
                 return;
             let entries;
             try {

package/lib/state.js

@@ -11,7 +11,8 @@ import lockfile from 'proper-lockfile';
 const STATE_FILE = 'state.json';
 const HISTORY_LIMIT = 50;
 export function findingFingerprint(finding) {
-    const raw = finding.ruleId + '|' + finding.file + '|' + finding.snippet.trim();
+    const file = finding.file.split(path.sep).join('/').replace(/^(?:\.\/)+/, '');
+    const raw = finding.ruleId + '|' + file + '|' + finding.snippet.trim();
     return createHash('sha256').update(raw).digest('hex');
 }
 export function statePath(stateDir) {
@@ -130,7 +131,8 @@ export function compareFingerprints(baseline, current) {
 export function splitByBaseline(findings, baseline) {
     if (baseline === null)
         return { fresh: findings, accepted: [] };
-    const acceptedSet = new Set(baseline.fingerprints);
+    // Recompute from saved evidence so older "./file" fingerprints remain usable.
+    const acceptedSet = new Set(baseline.findings.map(findingFingerprint));
     const fresh = [];
     const accepted = [];
     for (const finding of findings) {

package/lib/tools.d.ts

@@ -1,7 +1,7 @@
 /**
- * 九个面向模型的安全审查工具：
+ * 十个面向模型的安全审查工具：
  * secure_scan / secure_diff / secure_fix_verify / secure_report / secure_export /
- * secure_baseline / secure_deps / secure_policy_show / secure_policy_set。
+ * secure_baseline / secure_deps / secure_policy_show / secure_policy_set / secure_health。
  *
  * @module dsh-code-security/tools
  */

package/lib/tools.js

@@ -1,7 +1,7 @@
 /**
- * 九个面向模型的安全审查工具：
+ * 十个面向模型的安全审查工具：
  * secure_scan / secure_diff / secure_fix_verify / secure_report / secure_export /
- * secure_baseline / secure_deps / secure_policy_show / secure_policy_set。
+ * secure_baseline / secure_deps / secure_policy_show / secure_policy_set / secure_health。
  *
  * @module dsh-code-security/tools
  */
@@ -48,6 +48,12 @@ function scanArguments(raw, allowed = ['target']) {
     if (Object.hasOwn(args, 'target') && (typeof args.target !== 'string' || args.target.trim() === '')) {
         throw new Error('扫描参数 target 必须是非空的文件或目录字符串。扫描整个工作区请省略 target 或使用 "."。');
     }
+    if (Object.hasOwn(args, 'base') && (typeof args.base !== 'string' || args.base.trim() === '' || args.base.trim().startsWith('-') || args.base.includes('\0'))) {
+        throw new Error('扫描参数 base 必须是非空的 Git ref，不能是 Git 命令选项。');
+    }
+    if (Object.hasOwn(args, 'staged') && typeof args.staged !== 'boolean') {
+        throw new Error('扫描参数 staged 必须是布尔值 true 或 false。');
+    }
     return args;
 }
 const findingSchema = {
@@ -68,6 +74,7 @@ const scanSchema = {
     type: 'object',
     properties: {
         root: { type: 'string' }, filesScanned: { type: 'integer' }, filesSkipped: { type: 'integer' },
+        filesChanged: { type: 'integer' }, addedLines: { type: 'integer' },
         findings: { type: 'array', items: findingSchema }, counts: countsSchema, passed: { type: 'boolean' },
         failOn: { type: 'string' }, durationMs: { type: 'integer' },
         newFindings: { type: 'array', items: findingSchema }, newCounts: countsSchema,
@@ -96,6 +103,8 @@ function renderFindings(_args, value) {
         '安全审查：' + (rec.passed === true ? '通过' : '未通过'),
         '文件 ' + String(rec.filesScanned ?? 0) + ' 个，发现 ' + findings.length + ' 个问题（critical ' + String(counts?.critical ?? 0) + ' / high ' + String(counts?.high ?? 0) + ' / medium ' + String(counts?.medium ?? 0) + ' / low ' + String(counts?.low ?? 0) + '）；基线外新增 ' + split.fresh.length + ' 个。',
     ];
+    if (typeof rec.filesSkipped === 'number' && rec.filesSkipped > 0)
+        lines.push('已跳过 ' + rec.filesSkipped + ' 项；跳过项不计入已扫描文件数。');
     for (const finding of findings) {
         lines.push('- ' + finding.file + ':' + finding.line + ' [' + finding.severity + '] ' + finding.ruleId + ' ' + finding.title);
     }
@@ -147,7 +156,7 @@ function buildWorkspaceTools(cfg, cwd, runner, signal) {
     };
     const secureDiff = {
         name: 'secure_diff',
-        description: '只审查 git diff 的新增行（默认 HEAD，即未提交改动）。base 可用任意 git ref；staged=true 审查已暂存改动；target 可限定文件。结果同样写入状态。',
+        description: '结合少量上下文审查 git diff，只报告涉及新增行的问题（默认 HEAD，即未提交改动）。base 可用 Git ref；staged=true 审查已暂存改动；target 可限定文件。范围与路径相对当前会话工作区，遵守项目排除策略。结果同样写入状态。',
         parameters: { ...compileParameters({
                 base: { type: 'string', description: 'git 基线（默认 HEAD）。' },
                 target: { type: 'string', description: '限定文件路径（可选）。' },
@@ -169,13 +178,13 @@ function buildWorkspaceTools(cfg, cwd, runner, signal) {
                 mode: 'diff:' + base,
                 target: target ?? '.',
                 time: new Date().toISOString(),
-                filesScanned: result.filesChanged,
+                filesScanned: result.filesScanned,
                 findings: result.findings,
                 fingerprints: result.findings.map(findingFingerprint),
                 counts,
             };
             await saveState(stateDir, entry, signal);
-            return { root: base, filesScanned: result.filesChanged, filesSkipped: 0, addedLines: result.addedLines, findings: result.findings, counts, newFindings: split.fresh, newCounts: countFindings(split.fresh), acceptedFindings: split.accepted, baseline: state.baseline, passed: verdictOf(split.fresh, failOn), failOn, durationMs: 0 };
+            return { root: base, filesChanged: result.filesChanged, filesScanned: result.filesScanned, filesSkipped: result.filesSkipped, addedLines: result.addedLines, findings: result.findings, counts, newFindings: split.fresh, newCounts: countFindings(split.fresh), acceptedFindings: split.accepted, baseline: state.baseline, passed: verdictOf(split.fresh, failOn), failOn, durationMs: 0 };
         },
         timeoutMs: 60000,
     };
@@ -211,7 +220,7 @@ function buildWorkspaceTools(cfg, cwd, runner, signal) {
                 return { baselineMissing: true, baselineTime: '', closedCount: 0, remainingCount: 0, freshCount: result.findings.length, closed: [], remaining: [], fresh: result.findings, passed: false };
             }
             const current = result.findings.map(findingFingerprint);
-            const cmp = compareFingerprints(state.last.fingerprints, current);
+            const cmp = compareFingerprints(state.last.findings.map(findingFingerprint), current);
             const byFingerprint = new Map(result.findings.map((finding) => [findingFingerprint(finding), finding]));
             const closed = cmp.closed.map((fp) => state.last.findings.find((finding) => findingFingerprint(finding) === fp)).filter((x) => x !== undefined);
             const remaining = cmp.remaining.map((fp) => byFingerprint.get(fp)).filter((x) => x !== undefined);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-code-security",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "description": "对代码与 Git 改动进行本地静态安全检查，并追踪修复结果。",
   "type": "module",
   "main": "lib/index.js",