dsh-code-security 0.3.7 → 0.4.0

package/lib/tools.js

@@ -1,7 +1,7 @@
 /**
- * 九个面向模型的安全审查工具：
+ * 十个面向模型的安全审查工具：
  * secure_scan / secure_diff / secure_fix_verify / secure_report / secure_export /
- * secure_baseline / secure_deps / secure_policy_show / secure_policy_set。
+ * secure_baseline / secure_deps / secure_policy_show / secure_policy_set / secure_health。
  *
  * @module dsh-code-security/tools
  */
@@ -11,11 +11,11 @@ import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { optionalString, requiredString } from './config.js';
 import { buildExtraTools } from './extra.js';
-import { runGitDiff, scanDiff } from './diff.js';
 import { loadPolicy, normalizePolicy, POLICY_FILE, savePolicy } from './policy.js';
 import { ruleCategory } from './rules.js';
-import { scanPath } from './scanner.js';
 import { compareFingerprints, countFindings, findingFingerprint, loadState, saveState, splitByBaseline } from './state.js';
+import { runSourceCheck, sourceEngines } from './audit.js';
+import { probeEngine, databaseHealth } from './engines.js';
 const SEVERITY_ORDER = { critical: 4, high: 3, medium: 2, low: 1 };
 const PACKAGE_VERSION = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
 function compileParameters(spec) {
@@ -31,12 +31,14 @@ function compileParameters(spec) {
             node.description = prop.description;
         if (prop?.enum !== undefined)
             node.enum = prop.enum;
+        if (prop?.items !== undefined)
+            node.items = prop.items;
         properties[key] = node;
     }
     return { type: 'object', properties, ...(required.length > 0 ? { required } : {}) };
 }
 /** Reject ambiguous scopes before reading files, running git, or replacing scan state. */
-function scanArguments(raw, allowed = ['target']) {
+export function scanArguments(raw, allowed = ['target', 'engines']) {
     if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) {
         throw new Error('扫描参数必须是对象。请用 { target: "文件或目录" } 限定范围；扫描整个工作区请传 {}。');
     }
@@ -48,6 +50,14 @@ function scanArguments(raw, allowed = ['target']) {
     if (Object.hasOwn(args, 'target') && (typeof args.target !== 'string' || args.target.trim() === '')) {
         throw new Error('扫描参数 target 必须是非空的文件或目录字符串。扫描整个工作区请省略 target 或使用 "."。');
     }
+    if (Object.hasOwn(args, 'base') && (typeof args.base !== 'string' || args.base.trim() === '' || args.base.trim().startsWith('-') || args.base.includes('\0'))) {
+        throw new Error('扫描参数 base 必须是非空的 Git ref，不能是 Git 命令选项。');
+    }
+    if (Object.hasOwn(args, 'staged') && typeof args.staged !== 'boolean') {
+        throw new Error('扫描参数 staged 必须是布尔值 true 或 false。');
+    }
+    if (Object.hasOwn(args, 'includeUntracked') && typeof args.includeUntracked !== 'boolean')
+        throw new Error('includeUntracked 必须是布尔值');
     return args;
 }
 const findingSchema = {
@@ -68,6 +78,7 @@ const scanSchema = {
     type: 'object',
     properties: {
         root: { type: 'string' }, filesScanned: { type: 'integer' }, filesSkipped: { type: 'integer' },
+        filesChanged: { type: 'integer' }, addedLines: { type: 'integer' },
         findings: { type: 'array', items: findingSchema }, counts: countsSchema, passed: { type: 'boolean' },
         failOn: { type: 'string' }, durationMs: { type: 'integer' },
         newFindings: { type: 'array', items: findingSchema }, newCounts: countsSchema,
@@ -96,6 +107,8 @@ function renderFindings(_args, value) {
         '安全审查：' + (rec.passed === true ? '通过' : '未通过'),
         '文件 ' + String(rec.filesScanned ?? 0) + ' 个，发现 ' + findings.length + ' 个问题（critical ' + String(counts?.critical ?? 0) + ' / high ' + String(counts?.high ?? 0) + ' / medium ' + String(counts?.medium ?? 0) + ' / low ' + String(counts?.low ?? 0) + '）；基线外新增 ' + split.fresh.length + ' 个。',
     ];
+    if (typeof rec.filesSkipped === 'number' && rec.filesSkipped > 0)
+        lines.push('已跳过 ' + rec.filesSkipped + ' 项；跳过项不计入已扫描文件数。');
     for (const finding of findings) {
         lines.push('- ' + finding.file + ':' + finding.line + ' [' + finding.severity + '] ' + finding.ruleId + ' ' + finding.title);
     }
@@ -108,7 +121,7 @@ export function buildSecureTools(cfg, cwd, runner) {
             signal?.throwIfAborted();
             const workspace = context?.agent?.session?.header?.cwd || cwd;
             const resolved = { ...cfg, stateDir: cfg.stateDirRelative ? path.resolve(workspace, cfg.stateDirRelative) : cfg.stateDir };
-            const scopedRunner = { run: (argv, options) => runner.run(argv, { ...options, cwd: workspace, signal }) };
+            const scopedRunner = { run: (argv, options) => runner.run(argv, { ...options, cwd: options?.cwd ?? workspace, signal: options?.signal && signal ? AbortSignal.any([options.signal, signal]) : options?.signal ?? signal }) };
             const selected = buildWorkspaceTools(resolved, workspace, scopedRunner, signal).find(row => row.name === tool.name);
             return selected.execute(args, exec);
         } }));
@@ -120,6 +133,7 @@ function buildWorkspaceTools(cfg, cwd, runner, signal) {
         description: '扫描工作区（或指定文件/目录），用确定性规则检测注入、弱加密、硬编码密钥、危险配置等问题。使用 target 字符串限定范围，不接受 paths/files 等参数；{} 表示整个工作区。结果写入 .code-security 状态供 secure_fix_verify 对比。',
         parameters: { ...compileParameters({
                 target: { type: 'string', description: '要扫描的文件或目录（可选，缺省扫描整个工作区）。' },
+                engines: { type: 'array', items: { type: 'string', enum: ['builtin', 'betterleaks', 'semgrep'] }, description: '可选引擎，默认使用配置（初始仅 builtin）。' },
             }), additionalProperties: false },
         output: { schema: scanSchema, render: renderFindings },
         async execute(rawArgs) {
@@ -127,7 +141,8 @@ function buildWorkspaceTools(cfg, cwd, runner, signal) {
             const target = optionalString(args, 'target');
             const policy = await loadPolicy(cwd);
             const failOn = policy.failOn ?? cfg.failOn;
-            const result = await scanPath({ cwd, target, maxFiles: cfg.maxFiles, maxFileBytes: cfg.maxFileBytes, policy, signal });
+            const engines = sourceEngines(args.engines, cfg.engines);
+            const result = await runSourceCheck({ kind: 'scan', ...(target ? { target } : {}) }, cfg, cwd, runner, engines, policy, signal);
             const state = await loadState(stateDir);
             const counts = countFindings(result.findings);
             const split = splitByBaseline(result.findings, state.baseline);
@@ -139,29 +154,32 @@ function buildWorkspaceTools(cfg, cwd, runner, signal) {
                 findings: result.findings,
                 fingerprints: result.findings.map(findingFingerprint),
                 counts,
+                complete: result.complete, coverage: result.coverage, engines, scope: result.scope,
             };
             const stateFile = await saveState(stateDir, entry, signal);
-            return { ...result, counts, newFindings: split.fresh, newCounts: countFindings(split.fresh), acceptedFindings: split.accepted, baseline: state.baseline, passed: verdictOf(split.fresh, failOn), failOn, stateFile };
+            return { ...result, counts, newFindings: split.fresh, newCounts: countFindings(split.fresh), acceptedFindings: split.accepted, baseline: state.baseline, passed: result.complete && verdictOf(split.fresh, failOn), failOn, stateFile };
         },
         timeoutMs: 120000,
     };
     const secureDiff = {
         name: 'secure_diff',
-        description: '只审查 git diff 的新增行（默认 HEAD，即未提交改动）。base 可用任意 git ref；staged=true 审查已暂存改动；target 可限定文件。结果同样写入状态。',
+        description: '结合少量上下文审查 git diff，只报告涉及新增行的问题（默认 HEAD，即未提交改动）。base 可用 Git ref；staged=true 审查已暂存改动；target 可限定文件。范围与路径相对当前会话工作区，遵守项目排除策略。结果同样写入状态。',
         parameters: { ...compileParameters({
                 base: { type: 'string', description: 'git 基线（默认 HEAD）。' },
                 target: { type: 'string', description: '限定文件路径（可选）。' },
                 staged: { type: 'boolean', description: '审查已暂存改动（git diff --cached，默认 false）。' },
+                includeUntracked: { type: 'boolean', description: '同时检查未跟踪的新文件（默认 false，staged 模式不包含它们）。' },
+                engines: { type: 'array', items: { type: 'string', enum: ['builtin', 'betterleaks', 'semgrep'] }, description: '可选增强引擎；同样只报告涉及新增行的问题。' },
             }), additionalProperties: false },
         output: { schema: scanSchema, render: renderFindings },
         async execute(rawArgs) {
-            const args = scanArguments(rawArgs, ['base', 'target', 'staged']);
+            const args = scanArguments(rawArgs, ['base', 'target', 'staged', 'engines', 'includeUntracked']);
             const base = optionalString(args, 'base') ?? 'HEAD';
             const target = optionalString(args, 'target');
             const policy = await loadPolicy(cwd);
             const failOn = policy.failOn ?? cfg.failOn;
-            const diff = await runGitDiff(runner, cwd, base, target, 30000, args.staged === true);
-            const result = scanDiff(diff, cwd, policy);
+            const engines = sourceEngines(args.engines, cfg.engines);
+            const result = await runSourceCheck({ kind: 'diff', base, staged: args.staged === true, ...(args.includeUntracked === true ? { includeUntracked: true } : {}), ...(target ? { target } : {}) }, cfg, cwd, runner, engines, policy, signal);
             const state = await loadState(stateDir);
             const counts = countFindings(result.findings);
             const split = splitByBaseline(result.findings, state.baseline);
@@ -169,21 +187,23 @@ function buildWorkspaceTools(cfg, cwd, runner, signal) {
                 mode: 'diff:' + base,
                 target: target ?? '.',
                 time: new Date().toISOString(),
-                filesScanned: result.filesChanged,
+                filesScanned: result.filesScanned,
                 findings: result.findings,
                 fingerprints: result.findings.map(findingFingerprint),
                 counts,
+                complete: result.complete, coverage: result.coverage, engines, scope: result.scope,
             };
             await saveState(stateDir, entry, signal);
-            return { root: base, filesScanned: result.filesChanged, filesSkipped: 0, addedLines: result.addedLines, findings: result.findings, counts, newFindings: split.fresh, newCounts: countFindings(split.fresh), acceptedFindings: split.accepted, baseline: state.baseline, passed: verdictOf(split.fresh, failOn), failOn, durationMs: 0 };
+            return { ...result, counts, newFindings: split.fresh, newCounts: countFindings(split.fresh), acceptedFindings: split.accepted, baseline: state.baseline, passed: result.complete && verdictOf(split.fresh, failOn), failOn };
         },
         timeoutMs: 60000,
     };
     const secureFixVerify = {
         name: 'secure_fix_verify',
-        description: '复扫并与上次扫描基线对比，输出已关闭、仍存在、新引入的问题指纹。用于修复后确认没有按下葫芦浮起瓢。',
+        description: '按上次相同范围与引擎复查，输出已关闭、仍存在、新增问题。只有完整复查才更新状态和判定关闭；规则不再命中不等同于相关测试通过。',
         parameters: { ...compileParameters({
                 target: { type: 'string', description: '复扫文件或目录（可选，缺省扫描整个工作区）。' },
+                engines: { type: 'array', items: { type: 'string', enum: ['builtin', 'betterleaks', 'semgrep'] }, description: '默认沿用上次扫描引擎；需与上次相同，避免未执行就宣称修好。' },
             }), additionalProperties: false },
         output: {
             schema: {
@@ -206,24 +226,41 @@ function buildWorkspaceTools(cfg, cwd, runner, signal) {
             const target = optionalString(args, 'target');
             const policy = await loadPolicy(cwd);
             const state = await loadState(stateDir);
-            const result = await scanPath({ cwd, target, maxFiles: cfg.maxFiles, maxFileBytes: cfg.maxFileBytes, policy, signal });
+            const engines = sourceEngines(args.engines, state.last?.engines ?? cfg.engines);
+            if (state.last && !state.last.scope && state.last.mode.startsWith('diff:'))
+                throw new Error('旧版增量记录缺少完整范围，请先重新执行 secure_diff / Rerun secure_diff to upgrade this legacy diff record before rechecking');
+            const scope = state.last?.scope ?? { kind: 'scan', ...(state.last?.target && state.last.target !== '.' ? { target: state.last.target } : {}) };
+            if (target !== undefined && path.resolve(cwd, target) !== path.resolve(cwd, scope.target ?? '.'))
+                throw new Error('复查范围必须与上次扫描相同；请先对新范围执行 secure_scan');
+            if (state.last?.engines && [...engines].sort().join() !== [...state.last.engines].sort().join())
+                throw new Error('复查引擎必须与上次扫描相同');
+            const result = await runSourceCheck(scope, cfg, cwd, runner, engines, policy, signal);
             if (state.last === null) {
                 return { baselineMissing: true, baselineTime: '', closedCount: 0, remainingCount: 0, freshCount: result.findings.length, closed: [], remaining: [], fresh: result.findings, passed: false };
             }
             const current = result.findings.map(findingFingerprint);
-            const cmp = compareFingerprints(state.last.fingerprints, current);
+            const cmp = compareFingerprints(state.last.findings.map(findingFingerprint), current);
             const byFingerprint = new Map(result.findings.map((finding) => [findingFingerprint(finding), finding]));
-            const closed = cmp.closed.map((fp) => state.last.findings.find((finding) => findingFingerprint(finding) === fp)).filter((x) => x !== undefined);
+            const closed = result.complete ? cmp.closed.map((fp) => state.last.findings.find((finding) => findingFingerprint(finding) === fp)).filter((x) => x !== undefined) : [];
             const remaining = cmp.remaining.map((fp) => byFingerprint.get(fp)).filter((x) => x !== undefined);
             const fresh = cmp.fresh.map((fp) => byFingerprint.get(fp)).filter((x) => x !== undefined);
+            if (result.complete)
+                await saveState(stateDir, {
+                    ...state.last, time: new Date().toISOString(), mode: 'verify:' + scope.kind,
+                    filesScanned: result.filesScanned, findings: result.findings,
+                    fingerprints: current, counts: countFindings(result.findings),
+                    complete: true, coverage: result.coverage, engines, scope,
+                }, signal);
             return {
                 baselineMissing: false,
                 baselineTime: state.last.time,
                 closedCount: closed.length,
                 remainingCount: remaining.length,
                 freshCount: fresh.length,
+                complete: result.complete, coverage: result.coverage,
+                unverified: result.complete ? [] : state.last.findings,
                 closed, remaining, fresh,
-                passed: fresh.length === 0 && remaining.length === 0,
+                passed: result.complete && fresh.length === 0 && remaining.length === 0,
             };
         },
         timeoutMs: 120000,
@@ -265,6 +302,7 @@ function buildWorkspaceTools(cfg, cwd, runner, signal) {
             const split = splitByBaseline(last.findings, state.baseline);
             return {
                 hasScan: true,
+                time: last.time, scope: last.scope, engines: last.engines ?? ['builtin'],
                 stateFile: stateDir,
                 policy,
                 counts: last.counts,
@@ -273,7 +311,9 @@ function buildWorkspaceTools(cfg, cwd, runner, signal) {
                 acceptedCounts: countFindings(split.accepted),
                 byRule: [...byRule.entries()].sort((a, b) => b[1] - a[1]).map(([rule, count]) => ({ rule, count, category: ruleCategory(rule) })),
                 byFile: [...byFile.entries()].sort((a, b) => b[1] - a[1]).slice(0, 50).map(([file, count]) => ({ file, count })),
-                passed: verdictOf(split.fresh, failOn),
+                passed: last.complete !== false && verdictOf(split.fresh, failOn),
+                complete: last.complete !== false, coverage: last.coverage ?? [], findings: last.findings,
+                newFindings: split.fresh, acceptedFindings: split.accepted,
                 historyCount: state.history.length,
             };
         },
@@ -352,9 +392,10 @@ function buildWorkspaceTools(cfg, cwd, runner, signal) {
                 throw new Error('尚无扫描结果，请先执行 secure_scan 或 secure_diff。');
             const text = format === 'sarif' ? buildSarif(state.last.findings, cwd) : buildMarkdown(state.last.findings, state.last.target);
             signal?.throwIfAborted();
-            if (target !== undefined)
-                await writeFile(target, text, 'utf8');
-            return { format, path: target ?? '', text, findingCount: state.last.findings.length };
+            const destination = target === undefined ? undefined : path.resolve(cwd, target);
+            if (destination !== undefined)
+                await writeFile(destination, text, { encoding: 'utf8', mode: 0o600, signal });
+            return { format, path: destination ?? '', text, findingCount: state.last.findings.length };
         },
         timeoutMs: 30000,
     };
@@ -381,10 +422,11 @@ function buildWorkspaceTools(cfg, cwd, runner, signal) {
             checks.push({ name: '严重度门禁', ok: true, detail: 'failOn=' + cfg.failOn });
             checks.push({ name: '状态目录', ok: true, detail: cfg.stateDir });
             checks.push({ name: '工作目录', ok: cwd !== '', detail: cwd });
-            return { ok: true, plugin: 'dsh-code-security', checks };
+            const engines = await Promise.all(['osv', 'betterleaks', 'semgrep'].map(engine => probeEngine(engine, cfg, runner)));
+            return { ok: true, plugin: 'dsh-code-security', checks, engines, configuredEngines: cfg.engines, database: await databaseHealth(cfg) };
         },
     };
-    return [secureScan, secureDiff, secureFixVerify, secureReport, secureExport, ...buildExtraTools(cfg, cwd, signal), policyShow, policySet, secureHealth];
+    return [secureScan, secureDiff, secureFixVerify, secureReport, secureExport, ...buildExtraTools(cfg, cwd, signal, runner), policyShow, policySet, secureHealth];
 }
 function buildMarkdown(findings, target) {
     const lines = ['# 安全审查报告', '', '目标：' + target, '', '| 严重度 | 规则 | CWE | 文件:行 | 说明 |', '| :-- | :-- | :-- | :-- | :-- |'];

package/lib/workbench.d.ts

@@ -0,0 +1,30 @@
+import { type SecureToolDefinition } from './tools.js';
+import { type ResolvedSecureConfig } from './config.js';
+export declare const SECURITY_WORKBENCH_ROUTE = "/api/dsh-code-security/workbench";
+export declare class SecurityWorkbench {
+    readonly cfg: ResolvedSecureConfig;
+    private readonly automaticProblems;
+    private readonly jobs;
+    private readonly tools;
+    readonly directory: string;
+    onAutoChanged?: (root: string, enabled: boolean) => void;
+    constructor(cfg: ResolvedSecureConfig, options: {
+        directory?: string;
+        tools: (cfg: ResolvedSecureConfig, cwd: string) => SecureToolDefinition[];
+    });
+    private catalog;
+    private update;
+    remember(workspace: string, sessionId?: string): Promise<void>;
+    configFor(root: string): Promise<ResolvedSecureConfig>;
+    autoEnabled(root: string): Promise<boolean>;
+    automaticProblem(root: string, reason?: string): void;
+    private workspace;
+    private report;
+    runAutomatic(root: string, signal?: AbortSignal): Promise<any>;
+    private safeResult;
+    run(root: string, name: string, args: Record<string, unknown>, signal?: AbortSignal): Promise<any>;
+    action(body: Record<string, unknown>): Promise<any>;
+    fetch(request: Request): Promise<Response>;
+    dispose(): Promise<void>;
+}
+export declare function installSecurityWorkbench(ctx: any, workbench: SecurityWorkbench): void;

package/lib/workbench.js

@@ -0,0 +1,242 @@
+/** Authenticated operator UI: workspaces come from host sessions/tools, never browser paths. */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { homedir } from 'node:os';
+import { createHash, randomUUID } from 'node:crypto';
+import lockfile from 'proper-lockfile';
+import { resolveConfig } from './config.js';
+import { loadState } from './state.js';
+import { splitByBaseline } from './state.js';
+import { redactText } from './privacy.js';
+export const SECURITY_WORKBENCH_ROUTE = '/api/dsh-code-security/workbench';
+const hash = (text) => createHash('sha256').update(text).digest('hex');
+const json = (status, value) => new Response(JSON.stringify(value), { status, headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' } });
+export class SecurityWorkbench {
+    cfg;
+    automaticProblems = new Map();
+    jobs = new Map();
+    tools;
+    directory;
+    onAutoChanged;
+    constructor(cfg, options) {
+        this.cfg = cfg;
+        this.directory = options.directory ?? path.join(process.env.DSH_HOME || path.join(homedir(), '.dsh'), 'plugins', 'dsh-code-security');
+        this.tools = options.tools;
+    }
+    async catalog() {
+        try {
+            const file = path.join(this.directory, 'workspaces.json'), stat = await fs.lstat(file);
+            if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 2 * 1024 * 1024)
+                throw new Error('invalid index');
+            const data = JSON.parse(await fs.readFile(file, 'utf8'));
+            if (data.version !== 1 || !Array.isArray(data.workspaces) || data.workspaces.length > 100 || data.workspaces.some((w) => !w || typeof w.root !== 'string' || !path.isAbsolute(w.root) || w.id !== hash(w.root) || typeof w.label !== 'string' || typeof w.autoCheck !== 'boolean' || w.sessionId !== undefined && typeof w.sessionId !== 'string') || !data.settings || !Array.isArray(data.settings.engines) || !data.settings.enginePaths)
+                throw new Error('invalid index');
+            resolveConfig(data.settings);
+            return data;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw new Error('工作区索引损坏，原文件已保留 / Workspace index is invalid; the original was preserved');
+            return { version: 1, workspaces: [], settings: { engines: this.cfg.engines, enginePaths: { ...this.cfg.enginePaths }, ...(this.cfg.osvDatabaseDir ? { osvDatabaseDir: this.cfg.osvDatabaseDir } : {}) } };
+        }
+    }
+    async update(change) {
+        await fs.mkdir(this.directory, { recursive: true });
+        const unlock = await lockfile.lock(this.directory, { retries: { retries: 30, minTimeout: 25, maxTimeout: 100 } });
+        try {
+            const data = await this.catalog();
+            change(data);
+            const file = path.join(this.directory, 'workspaces.json'), temp = file + '.tmp-' + randomUUID();
+            try {
+                await fs.writeFile(temp, JSON.stringify(data), { flag: 'wx', mode: 0o600 });
+                await fs.rename(temp, file);
+            }
+            finally {
+                await fs.unlink(temp).catch(() => { });
+            }
+        }
+        finally {
+            await unlock();
+        }
+    }
+    async remember(workspace, sessionId) {
+        if (!path.isAbsolute(workspace))
+            return;
+        const root = await fs.realpath(workspace);
+        if (!(await fs.lstat(root)).isDirectory())
+            return;
+        await this.update(data => {
+            const previous = data.workspaces.find(w => w.id === hash(root));
+            data.workspaces = [{ id: hash(root), root, label: path.basename(root) || root, autoCheck: previous?.autoCheck ?? false, ...(sessionId ? { sessionId } : previous?.sessionId ? { sessionId: previous.sessionId } : {}) }, ...data.workspaces.filter(w => w.id !== hash(root))].slice(0, 100);
+        });
+    }
+    async configFor(root) {
+        const { settings } = await this.catalog();
+        return { ...this.cfg, engines: [...settings.engines], enginePaths: { ...this.cfg.enginePaths, ...settings.enginePaths }, osvDatabaseDir: settings.osvDatabaseDir ?? this.cfg.osvDatabaseDir, stateDir: this.cfg.stateDirRelative ? path.resolve(root, this.cfg.stateDirRelative) : this.cfg.stateDir };
+    }
+    async autoEnabled(root) { return (await this.catalog()).workspaces.find(w => w.id === hash(root))?.autoCheck === true; }
+    automaticProblem(root, reason) { if (reason)
+        this.automaticProblems.set(root, reason);
+    else
+        this.automaticProblems.delete(root); }
+    async workspace(id) {
+        const row = (await this.catalog()).workspaces.find(w => typeof id === 'string' && w.id === id);
+        if (!row || await fs.realpath(row.root) !== row.root)
+            throw new Error('请选择已登记的工作区 / Choose a registered workspace');
+        return row;
+    }
+    async report(row) {
+        const tools = this.tools(await this.configFor(row.root), row.root);
+        return tools.find(t => t.name === 'secure_report').execute({}, {});
+    }
+    async runAutomatic(root, signal) {
+        const cfg = await this.configFor(root);
+        const autoCfg = { ...cfg, stateDir: path.join(cfg.stateDir, 'automatic'), stateDirRelative: undefined, engines: ['builtin'] };
+        const result = await this.tools(autoCfg, root).find(t => t.name === 'secure_diff').execute({ includeUntracked: true, engines: ['builtin'] }, { signal });
+        const manual = await loadState(cfg.stateDir);
+        return { ...result, newFindings: splitByBaseline(result.findings, manual.baseline).fresh };
+    }
+    safeResult(result) {
+        if (!result || typeof result !== 'object')
+            return result;
+        const value = { ...result };
+        delete value.baseline;
+        for (const name of ['findings', 'newFindings', 'acceptedFindings', 'closed', 'remaining', 'fresh', 'unverified', 'dependencies'])
+            if (Array.isArray(value[name])) {
+                value[name + 'Total'] = value[name].length;
+                value[name] = value[name].slice(0, 200);
+            }
+        if (value.audit)
+            value.audit = { ...value.audit, vulnerabilitiesTotal: value.audit.vulnerabilities.length, vulnerabilities: value.audit.vulnerabilities.slice(0, 200) };
+        return value;
+    }
+    async run(root, name, args, signal) {
+        const tools = this.tools(await this.configFor(root), root), selected = tools.find(t => t.name === name);
+        if (!selected)
+            throw new Error('Unknown security operation');
+        return selected.execute(args, { signal });
+    }
+    async action(body) {
+        if (body.operation === 'list')
+            return { ok: true, ...await this.catalog() };
+        const row = await this.workspace(body.id);
+        if (body.operation === 'open') {
+            const cfg = await this.configFor(row.root);
+            let automatic;
+            try {
+                const state = await loadState(path.join(cfg.stateDir, 'automatic'));
+                automatic = state.last ? { time: state.last.time, complete: state.last.complete !== false, highRisk: state.last.findings.filter(f => f.severity === 'high' || f.severity === 'critical').length } : null;
+            }
+            catch {
+                automatic = { problem: 'automatic-state-invalid' };
+            }
+            if (this.automaticProblems.has(row.root))
+                automatic = { ...automatic, problem: this.automaticProblems.get(row.root) };
+            const running = [...this.jobs.values()].find(j => j.workspace === row.id && j.status === 'running');
+            return { ok: true, workspace: row, report: this.safeResult(await this.report(row)), settings: (await this.catalog()).settings, automatic, ...(running ? { activeJob: { id: running.id, action: running.action, status: running.status } } : {}) };
+        }
+        if (body.operation === 'settings') {
+            if (typeof body.autoCheck !== 'boolean')
+                throw new Error('autoCheck must be boolean');
+            const checked = resolveConfig({ engines: body.engines, enginePaths: body.enginePaths, ...(body.osvDatabaseDir === undefined ? {} : { osvDatabaseDir: body.osvDatabaseDir }) });
+            await this.update(data => { data.settings = { engines: checked.engines, enginePaths: checked.enginePaths, ...(checked.osvDatabaseDir ? { osvDatabaseDir: checked.osvDatabaseDir } : {}) }; data.workspaces.find(w => w.id === row.id).autoCheck = body.autoCheck; });
+            this.onAutoChanged?.(row.root, body.autoCheck);
+            return { ok: true, ...await this.action({ operation: 'open', id: row.id }) };
+        }
+        if (body.operation === 'location') {
+            const cfg = await this.configFor(row.root), state = await loadState(cfg.stateDir), finding = state.last?.findings.find(f => f.id === body.finding);
+            if (!finding)
+                throw new Error('问题已变化，请刷新 / Finding changed; refresh the report');
+            const file = path.resolve(row.root, finding.file), rel = path.relative(row.root, file);
+            if (rel.startsWith('..') || path.isAbsolute(rel) || await fs.realpath(file) !== file || !(await fs.lstat(file)).isFile())
+                throw new Error('不能打开工作区外或已移动的文件 / File is outside the workspace or has moved');
+            return { ok: true, path: file, line: finding.line, sessionId: row.sessionId };
+        }
+        if (body.operation === 'job' || body.operation === 'cancel') {
+            const job = this.jobs.get(String(body.job));
+            if (!job || job.workspace !== row.id)
+                throw new Error('任务已结束或已重启 / Job expired or DSH restarted');
+            if (body.operation === 'cancel')
+                job.controller.abort(new Error('cancelled by operator'));
+            return { ok: true, job: { id: job.id, action: job.action, status: job.status, ...(job.result ? { result: this.safeResult(job.result) } : {}), ...(job.error ? { error: job.error } : {}) } };
+        }
+        if (body.operation === 'export') {
+            if (body.format !== 'sarif' && body.format !== 'markdown')
+                throw new Error('Invalid export format');
+            const result = await this.run(row.root, 'secure_export', { format: body.format });
+            return { ok: true, text: result.text, filename: body.format === 'sarif' ? 'security-report.sarif' : 'security-report.md' };
+        }
+        if (body.operation === 'start') {
+            const actions = { scan: 'secure_scan', diff: 'secure_diff', verify: 'secure_fix_verify', deps: 'secure_deps', health: 'secure_health' };
+            const action = String(body.action), tool = actions[action];
+            if (!tool)
+                throw new Error('不支持此操作 / Unsupported operation');
+            if ([...this.jobs.values()].some(j => j.workspace === row.id && j.status === 'running'))
+                throw new Error('已有检查正在运行 / A check is already running');
+            if (action === 'deps' && !['none', 'offline', 'online'].includes(String(body.audit ?? 'none')))
+                throw new Error('Invalid audit mode');
+            const args = action === 'deps' ? { audit: body.audit ?? 'none' } : action === 'diff' ? { includeUntracked: true } : {};
+            const job = { id: randomUUID(), workspace: row.id, action, status: 'running', controller: new AbortController() };
+            this.jobs.set(job.id, job);
+            job.work = this.run(row.root, tool, args, job.controller.signal).then(result => { job.result = result; job.status = 'completed'; }, error => { job.status = job.controller.signal.aborted ? 'cancelled' : 'failed'; job.error = job.controller.signal.aborted ? '已取消 / Cancelled' : redactText(error instanceof Error ? error.message : String(error)).slice(0, 2000); });
+            if (this.jobs.size > 100)
+                for (const [id, old] of this.jobs) {
+                    if (old.status !== 'running')
+                        this.jobs.delete(id);
+                    if (this.jobs.size <= 80)
+                        break;
+                }
+            return { ok: true, job: { id: job.id, action, status: job.status } };
+        }
+        throw new Error('不支持此操作 / Unsupported operation');
+    }
+    async fetch(request) {
+        if (request.method !== 'POST')
+            return json(405, { ok: false, message: 'POST required' });
+        const origin = request.headers.get('origin'), site = request.headers.get('sec-fetch-site');
+        if (request.headers.get('x-dsh-security-action') !== '1' || request.headers.get('content-type')?.split(';')[0].trim() !== 'application/json' || site && !['same-origin', 'none'].includes(site))
+            return json(403, { ok: false, message: '请从安全检查面板操作 / Use the security panel' });
+        try {
+            if (origin) {
+                // DSH's connection adapter uses an internal Request URL; Host retains the browser authority.
+                const source = new URL(origin), internal = new URL(request.url), authority = request.headers.get('host') || internal.host;
+                if (!['http:', 'https:'].includes(source.protocol) || source.host !== authority || authority === internal.host && source.protocol !== internal.protocol)
+                    return json(403, { ok: false, message: '拒绝跨源操作 / Cross-origin request refused' });
+            }
+            const reader = request.body?.getReader();
+            if (!reader)
+                throw new Error('Request body missing');
+            let size = 0;
+            const chunks = [];
+            try {
+                for (;;) {
+                    const part = await reader.read();
+                    if (part.done)
+                        break;
+                    size += part.value.byteLength;
+                    if (size > 16384) {
+                        await reader.cancel();
+                        return json(413, { ok: false, message: 'Request too large' });
+                    }
+                    ;
+                    chunks.push(part.value);
+                }
+            }
+            finally {
+                reader.releaseLock();
+            }
+            const body = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+            if (!body || typeof body !== 'object' || Array.isArray(body))
+                throw new Error('Invalid operation');
+            return json(200, await this.action(body));
+        }
+        catch (error) {
+            return json(400, { ok: false, message: redactText(error instanceof Error ? error.message : String(error)) });
+        }
+    }
+    async dispose() { for (const job of this.jobs.values())
+        job.controller.abort(new Error('DSH disposed')); await Promise.allSettled([...this.jobs.values()].map(job => job.work)); }
+}
+export function installSecurityWorkbench(ctx, workbench) {
+    ctx.inject?.(['connection'], (host) => host.connection.fetch.register({ path: SECURITY_WORKBENCH_ROUTE, methods: ['POST'], requestBody: 'buffered', fetch: (request) => workbench.fetch(request) }));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-code-security",
-  "version": "0.3.7",
+  "version": "0.4.0",
   "description": "对代码与 Git 改动进行本地静态安全检查，并追踪修复结果。",
   "type": "module",
   "main": "lib/index.js",
@@ -10,16 +10,19 @@
       "types": "./lib/index.d.ts",
       "default": "./lib/index.js"
     },
+    "./client": "./lib/client.js",
     "./cordis.patch.yml": "./cordis.patch.yml",
     "./package.json": "./package.json"
   },
   "files": [
     "lib",
+    "rules",
     "cordis.patch.yml",
     "README.md",
     "README.en.md",
     "docs",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "THIRD_PARTY_NOTICES.md"
   ],
   "scripts": {
     "build": "tsc -p tsconfig.json",
@@ -30,6 +33,10 @@
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": ["@deepseek-ai/dsh-client-ui-settings"],
+      "platform": "web"
     }
   },
   "keywords": [
@@ -47,8 +54,10 @@
     "node": "^22.19.0 || >=24.0.0"
   },
   "devDependencies": {
+    "@types/babel__traverse": "^7.28.0",
     "@types/node": "^24.0.0",
     "@types/proper-lockfile": "4.1.4",
+    "fflate": "0.8.3",
     "typescript": "^5.6.0"
   },
   "repository": {
@@ -62,6 +71,10 @@
   "author": "stardustlc",
   "packageManager": "pnpm@11.7.0",
   "dependencies": {
-    "proper-lockfile": "4.1.2"
+    "@babel/parser": "7.29.9",
+    "@babel/traverse": "7.29.10",
+    "@babel/types": "7.29.8",
+    "proper-lockfile": "4.1.2",
+    "smol-toml": "1.9.1"
   }
 }

package/rules/betterleaks.toml

@@ -0,0 +1,3 @@
+# Use the installed engine's reviewed default rules, never a project's executable rules.
+[extend]
+useDefault = true

package/rules/osv.toml

@@ -0,0 +1 @@
+# Explicit empty scanner configuration; project overrides are not executed or imported.