dsh-code-security 0.4.1 → 0.5.1

package/CHANGELOG.md

@@ -4,6 +4,16 @@
 
 [历史英文记录](docs/CHANGELOG.en.md)
 
+## 0.5.1（2026-10-20）
+
+- 修复审查外来仓库时可能执行对方 `.git/config` 命令的问题：所有 git 调用加上 `-c core.fsmonitor=false`，`secure_diff` 与 `secure_scan` 的 `includeUntracked` 都不再触发被扫仓库的 fsmonitor 命令
+- 修复 `filter.<驱动>.clean` 能把新增的危险行从 diff 里删掉、让检查误判「通过」的问题：diff 改用 `--attr-source=<空树>`（Git 2.40+），工作区 `.gitattributes` 不再生效，clean 过滤器既不执行也不参与内容比较；更老的 Git 退回只关闭 fsmonitor
+- 新增 4 项回归测试：fsmonitor 不执行、clean 过滤器不执行且藏不掉 `eval(input)`、`--attr-source` 参数、`includeUntracked` 的 `ls-files` 路径；同步更新既有的 argv 断言
+
+## 0.5.0（2026-10-17）
+
+- 设置面板顶部新增「首次使用」分步引导：一次只讲一步，支持上一步/下一步/跳过，看完记在本机不再出现。
+- 引导内容与该插件的实际用法一致；可在开发者工具里清掉 `dsh-first-run:dsh-code-security:v1` 重新查看。
 ## 0.4.1 (2026-10-15)
 
 - 修复同一行同时命中高熵密钥和其他安全规则时，其他规则的证据仍带出原始字符串的问题；所有证据统一使用同一套高熵脱敏判断，也覆盖截断的字符串。

package/docs/USAGE.en.md

@@ -85,7 +85,7 @@ Policy file: `.code-security.json`.
 {"version":1,"exclude":["vendor/**","generated/**"],"ignore":[{"ruleId":"SEC-206","file":"test/**","reason":"Not security-sensitive"}],"failOn":"high"}
 ```
 
-Git runs with external diff/textconv disabled. Paths are relative to the session workspace. Staged scans read the index and only added-line findings are reported. Invalid arguments, Git refs and incomplete hunks preserve previous state.
+Git runs with external diff/textconv disabled, and the reviewed repository's own executable config is neutralised too: every git call passes `-c core.fsmonitor=false`, and diff runs with `--attr-source=<empty tree>` so the worktree `.gitattributes` no longer applies (a `filter.<driver>.clean` is neither executed nor able to rewrite the diff). `--attr-source` needs Git 2.40+; older versions fall back to disabling fsmonitor only. Paths are relative to the session workspace. Staged scans read the index and only added-line findings are reported. Invalid arguments, Git refs and incomplete hunks preserve previous state.
 
 ## Development and licenses
 

package/docs/USAGE.md

@@ -88,7 +88,7 @@ OSV 2.7.0 当前实现使用 `缓存目录/osv-scalibr/npm/all.zip`（Python 使
 }
 ```
 
-Git 输出禁用外部 diff/textconv，路径相对当前会话工作区。暂存检查读取 Git index；新增行才计入差异发现。错写参数、无效 Git ref 或不完整 diff 不会覆盖已有记录。
+Git 输出禁用外部 diff/textconv，并额外关掉被扫仓库自带的可执行配置：所有 git 调用都带 `-c core.fsmonitor=false`，diff 还用 `--attr-source=<空树>` 让 `.gitattributes` 不生效（`filter.<驱动>.clean` 既不执行、也无法改写 diff 内容）。`--attr-source` 需要 Git 2.40+，更老的版本会退回只关闭 fsmonitor 的调用。路径相对当前会话工作区。暂存检查读取 Git index；新增行才计入差异发现。错写参数、无效 Git ref 或不完整 diff 不会覆盖已有记录。
 
 ## 开发与许可
 

package/lib/audit.js

@@ -1,7 +1,7 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { policyIgnores } from './policy.js';
-import { parseDiff, runGitDiff, scanDiff } from './diff.js';
+import { GIT_SAFE_CONFIG_ARGS, parseDiff, runGitDiff, scanDiff } from './diff.js';
 import { isExcludedPath, scanPath } from './scanner.js';
 import { mergeFindings, scanExternal } from './engines.js';
 export function sourceEngines(value, defaults) {
@@ -39,7 +39,7 @@ export async function runSourceCheck(scope, cfg, cwd, runner, engines, policy, s
                     throw new Error('增量文件超出当前工作区');
                 let text;
                 if (scope.staged) {
-                    const shown = await runner.run(['git', 'show', ':./' + file.file], { cwd, timeoutMs: 30000, signal });
+                    const shown = await runner.run(['git', ...GIT_SAFE_CONFIG_ARGS, 'show', ':./' + file.file], { cwd, timeoutMs: 30000, signal });
                     if (shown.exitCode !== 0)
                         throw new Error('无法读取暂存区文件，请刷新后重试');
                     text = shown.stdout;
@@ -67,7 +67,7 @@ export async function runSourceCheck(scope, cfg, cwd, runner, engines, policy, s
                 throw new Error('扫描期间 Git 改动已变化，请重试');
         }
         if (scope.includeUntracked && !scope.staged) {
-            const untracked = await runner.run(['git', 'ls-files', '--others', '--exclude-standard', '-z', '--', scope.target ?? '.'], { cwd, signal, timeoutMs: 30000 });
+            const untracked = await runner.run(['git', ...GIT_SAFE_CONFIG_ARGS, 'ls-files', '--others', '--exclude-standard', '-z', '--', scope.target ?? '.'], { cwd, signal, timeoutMs: 30000 });
             if (untracked.exitCode !== 0)
                 throw new Error('无法读取未跟踪文件列表');
             if (untracked.stdout && !untracked.stdout.endsWith('\0'))

package/lib/client.js

@@ -1,6 +1,57 @@
 // Browser source, distributed directly; the TypeScript build preserves this file.
 window.__ModuleLoader__.load({id:'dsh-code-security',factory:require=>{
   const React=require('react'),{useState,useEffect,useRef,useMemo}=React,h=React.createElement;
+var __FR_KEY = "dsh-first-run:dsh-code-security:v1";
+var __FR_TITLE = "代码安全 · 首次使用（4 步）";
+var __FR_STEPS = [{"title":"先全仓扫一次","body":"点「扫描」或让助手跑一次全仓扫描建立基线；第一次结果可能很多，属正常。"},{"title":"之后只看增量","body":"日常用「审 diff」，只报本次改动新增的问题，噪音低得多。"},{"title":"修完复验","body":"修完后点复验，插件会对比上次结果，告诉你哪些真的关掉了。"},{"title":"基线要谨慎","body":"「接受基线」会把当前问题标记为已知，之后不再拦截；只在确认无害时使用。"}];
+// ---- first-run guide (shared snippet) ----
+var __FR_STYLE_ID = 'dsh-first-run-css';
+var __FR_CSS = [
+  '.fr-card{border:1px solid var(--dsw-border,rgba(0,0,0,.10));border-radius:12px;padding:14px 16px;margin:0 0 14px;background:linear-gradient(180deg,rgba(59,130,246,.06),rgba(59,130,246,.02))}',
+  '.fr-head{display:flex;align-items:center;gap:8px;margin-bottom:6px}',
+  '.fr-dot{width:6px;height:6px;border-radius:50%;background:var(--dsw-accent,#3b82f6)}',
+  '.fr-title{font-weight:650;font-size:13.5px}',
+  '.fr-count{margin-left:auto;font-size:11px;color:var(--dsw-text-weak,#6b7280);font-variant-numeric:tabular-nums}',
+  '.fr-step{font-weight:600;font-size:13px;margin:2px 0 4px}',
+  '.fr-body{color:var(--dsw-text-weak,#4b5563);font-size:12.5px;line-height:1.65}',
+  '.fr-try{margin-top:8px;padding:7px 9px;border-radius:8px;background:rgba(59,130,246,.09);font-size:12px;display:flex;gap:8px}',
+  '.fr-try code{font-family:ui-monospace,monospace;white-space:pre-wrap;word-break:break-word}',
+  '.fr-bar{display:flex;gap:8px;align-items:center;margin-top:12px}',
+  '.fr-progress{display:flex;gap:4px;margin-right:auto}',
+  '.fr-seg{width:16px;height:3px;border-radius:2px;background:var(--dsw-border,rgba(0,0,0,.12))}',
+  '.fr-seg.on{background:var(--dsw-accent,#3b82f6)}',
+  '.fr-btn{border:1px solid var(--dsw-border,rgba(0,0,0,.14));background:transparent;color:inherit;border-radius:8px;padding:4px 10px;font-size:12px;cursor:pointer}',
+  '.fr-btn:hover{background:rgba(0,0,0,.04)}',
+  '.fr-btn.primary{background:var(--dsw-accent,#3b82f6);border-color:transparent;color:#fff}',
+  '.fr-btn.ghost{border-color:transparent;color:var(--dsw-text-weak,#6b7280)}'
+].join('\n');
+function __frEnsureCss(){ if (typeof document === 'undefined' || document.getElementById(__FR_STYLE_ID)) return; var el = document.createElement('style'); el.id = __FR_STYLE_ID; el.textContent = __FR_CSS; document.head.appendChild(el); }
+function __frRead(){ try { return localStorage.getItem(__FR_KEY) === 'done'; } catch (e) { return false; } }
+function __frWrite(){ try { localStorage.setItem(__FR_KEY, 'done'); } catch (e) {} }
+function __FirstRunCard(){
+  var ds = React.useState(__frRead), done = ds[0], setDone = ds[1];
+  var is = React.useState(0), index = is[0], setIndex = is[1];
+  React.useEffect(function(){ __frEnsureCss(); }, []);
+  if (done) return null;
+  var step = __FR_STEPS[index];
+  var last = index >= __FR_STEPS.length - 1;
+  var close = function(){ __frWrite(); setDone(true); };
+  var kids = [
+    React.createElement('div', { className: 'fr-head', key: 'h' }, React.createElement('span', { className: 'fr-dot' }), React.createElement('span', { className: 'fr-title' }, __FR_TITLE), React.createElement('span', { className: 'fr-count' }, (index + 1) + ' / ' + __FR_STEPS.length)),
+    React.createElement('div', { className: 'fr-step', key: 't' }, step.title),
+    React.createElement('div', { className: 'fr-body', key: 'b' }, step.body)
+  ];
+  if (step.tryIt) kids.push(React.createElement('div', { className: 'fr-try', key: 'y' }, React.createElement('span', null, '可以直接说'), React.createElement('code', null, '「' + step.tryIt + '」')));
+  var buttons = [React.createElement('div', { className: 'fr-progress', key: 'p' }, __FR_STEPS.map(function(_, i){ return React.createElement('span', { key: i, className: 'fr-seg' + (i <= index ? ' on' : '') }); }))];
+  buttons.push(React.createElement('button', { className: 'fr-btn ghost', type: 'button', onClick: close, key: 's' }, '跳过'));
+  if (index > 0) buttons.push(React.createElement('button', { className: 'fr-btn', type: 'button', key: 'prev', onClick: function(){ setIndex(index - 1); } }, '上一步'));
+  buttons.push(React.createElement('button', { className: 'fr-btn primary', type: 'button', key: 'next', onClick: function(){ if (last) close(); else setIndex(index + 1); } }, last ? '开始使用' : '下一步'));
+  kids.push(React.createElement('div', { className: 'fr-bar', key: 'bar' }, buttons));
+  return React.createElement('div', { className: 'fr-card' }, kids);
+}
+function __withFirstRun(Component){ return function FirstRunWrapped(props){ return React.createElement(React.Fragment, null, React.createElement(__FirstRunCard, null), React.createElement(Component, props)); }; }
+// ---- end first-run guide ----
+
   let locale,sidebar;
   const english=()=>{try{return String(locale?.getSnapshot?.().active||'').startsWith('en')}catch{return false}};
   const t=(zh,en)=>english()?en:zh;
@@ -58,6 +109,6 @@ window.__ModuleLoader__.load({id:'dsh-code-security',factory:require=>{
         report?.hasScan?h(React.Fragment,null,h('div',{className:'secw-tools'},h('label',{htmlFor:'secw-filter'},t('问题筛选','Filter findings')),h('select',{id:'secw-filter',value:filter,onChange:e=>{setFilter(e.target.value);setLimit(50)}},h('option',{value:'all'},t('全部','All')),h('option',{value:'new'},t('仅新增','New only')),h('option',{value:'high'},t('高风险','High risk'))),h('button',{disabled:busy,onClick:()=>download('sarif')},t('下载 SARIF','Download SARIF')),h('button',{disabled:busy,onClick:()=>download('markdown')},t('下载 Markdown','Download Markdown'))),findings.length?findings.slice(0,limit).map(f=>h(FindingCard,{key:f.id,finding:f,fresh:fresh.has(f.id),onOpen:f=>location(f,false),onCopy:f=>location(f,true)})):h('p',{className:'secw-muted'},t('此筛选下没有问题。','No findings match this filter.')),findings.length>limit?h('button',{onClick:()=>setLimit(n=>n+50)},t('显示更多','Show more')):null,(report.findingsTotal??0)>200?h('p',{className:'secw-muted'},t('面板最多展示 200 项，完整结果请导出报告。','The panel shows up to 200 findings. Export the full report for all results.')):null):null):null);
   }
   const css=`.secw{max-width:1060px;min-width:0;margin:auto;font:14px/1.6 system-ui,sans-serif;color:var(--dsw-alias-label-primary,#253047)}.secw *{box-sizing:border-box}.secw h2{font-size:22px;margin:0}.secw h3{font-size:17px;margin:0 0 8px}.secw p{margin:7px 0}.secw label{display:block;margin:8px 0 4px}.secw button,.secw select,.secw input:not([type=checkbox]){font:inherit;color:inherit;border:1px solid var(--dsw-alias-border-l3,#d3dbe5);border-radius:8px;background:var(--dsw-alias-bg-layer-1,#fff);padding:8px 10px;max-width:100%}.secw input:not([type=checkbox]),.secw select{width:100%;min-width:0}.secw button{cursor:pointer;white-space:normal}.secw button:disabled{opacity:.5;cursor:default}.secw .secw-primary{background:#245ee9;color:#fff;border-color:#245ee9}.secw .secw-tools,.secw .secw-row{display:flex;flex-wrap:wrap;align-items:center;gap:8px;margin:12px 0}.secw .secw-tools select{width:auto;max-width:100%}.secw .secw-muted{color:var(--dsw-alias-label-secondary,#64718a);font-size:13px}.secw .secw-card,.secw .secw-finding{border:1px solid var(--dsw-alias-border-l3,#d3dbe5);border-radius:11px;padding:14px;margin:12px 0;overflow-wrap:anywhere;background:var(--dsw-alias-bg-layer-1,#fff)}.secw .secw-finding[data-severity=critical],.secw .secw-finding[data-severity=high]{border-left:4px solid #c04836}.secw .secw-coverage{display:grid;grid-template-columns:repeat(auto-fit,minmax(200px,1fr));gap:8px;margin:10px 0}.secw .secw-engine{border:1px solid var(--dsw-alias-border-l3,#d3dbe5);border-radius:9px;padding:10px;overflow-wrap:anywhere}.secw .secw-engine strong{margin-right:8px}.secw .secw-engine small{display:block;color:var(--dsw-alias-label-secondary,#64718a)}.secw .secw-badge{display:inline-block;background:var(--dsw-alias-bg-layer-2,#f0f3f8);border-radius:5px;padding:1px 6px;font-size:12px}.secw .secw-badge[data-status=failed],.secw .secw-badge[data-status=partial]{color:#b33928}.secw .secw-error{background:#fff0ed;color:#973321;padding:10px;border-radius:8px;overflow-wrap:anywhere}.secw .secw-notice{background:#edf4ff;color:#17468c;padding:10px;border-radius:8px}.secw .secw-choice{display:flex;align-items:center;gap:8px}.secw fieldset{border:1px solid var(--dsw-alias-border-l3,#d3dbe5);border-radius:8px;margin:12px 0}.secw summary{cursor:pointer;font-weight:600}.secw pre{white-space:pre-wrap;overflow-wrap:anywhere;max-height:160px;overflow:auto;background:var(--dsw-alias-bg-layer-2,#f3f5f9);padding:10px;border-radius:6px}.secw .secw-file{font-family:ui-monospace,monospace;overflow-wrap:anywhere}.secw a{color:#245ee9}.secw :focus-visible{outline:3px solid #78a8ff;outline-offset:2px}[role=dialog]:has(.secw){width:min(1200px,calc(100vw - 48px))!important;max-width:1200px!important}@media(max-width:700px){[role=dialog]:has(.secw){width:100%!important;max-width:100%!important;flex-direction:column!important}[role=dialog]:has(.secw) nav{width:100%!important;flex-basis:auto!important;max-height:140px;overflow:auto;border-right:0}[role=dialog]:has(.secw) nav>div:has(>button){display:flex;flex-direction:row!important;flex-wrap:wrap;flex-shrink:0;gap:4px}[role=dialog]:has(.secw)>nav+div{min-width:0;width:100%}[role=dialog]:has(.secw)>nav+div>div:has(.secw){padding:12px!important;min-width:0}.secw .secw-coverage{grid-template-columns:1fr}}`;
-  function apply(ctx){try{locale=ctx.get?.('locale')||ctx.locale}catch{locale=ctx.locale}try{sidebar=ctx.get?.('sidebarRight')||ctx.sidebarRight}catch{}ctx.slots.inject('settings.section',()=>ctx.slots.register({name:'settings.section',id:'dsh-code-security',order:59,label:()=>t('代码安全','Code security'),inject:()=>({})},Workbench))}
+  function apply(ctx){try{locale=ctx.get?.('locale')||ctx.locale}catch{locale=ctx.locale}try{sidebar=ctx.get?.('sidebarRight')||ctx.sidebarRight}catch{}ctx.slots.inject('settings.section',()=>ctx.slots.register({name:'settings.section',id:'dsh-code-security',order:59,label:()=>t('代码安全','Code security'),inject:()=>({})},__withFirstRun(Workbench)))}
   return{inject:['slots','locale'],apply};
 }});

package/lib/diff.d.ts

@@ -24,6 +24,13 @@ export interface DiffScanResult {
     findings: Finding[];
     diff: string;
 }
+/**
+ * 屏蔽仓库自带配置里的可执行钩子。
+ *
+ * `-c core.fsmonitor=false`：否则 `git diff` / `git ls-files --others` 会执行
+ * 被扫仓库 `.git/config` 里的 fsmonitor 命令。
+ */
+export declare const GIT_SAFE_CONFIG_ARGS: readonly string[];
 /** 运行 git diff（默认 HEAD，工作区未提交改动）。 */
 export declare function runGitDiff(runner: ProcessRunner, cwd: string, base: string, target?: string, timeoutMs?: number, staged?: boolean): Promise<string>;
 /** 解析 unified diff，返回每个文件的新增行与新行号。 */

package/lib/diff.js

@@ -6,18 +6,56 @@
 import path from 'node:path';
 import { createHash } from 'node:crypto';
 import { isExcludedPath, scanLineSet } from './scanner.js';
+/**
+ * 屏蔽仓库自带配置里的可执行钩子。
+ *
+ * `-c core.fsmonitor=false`：否则 `git diff` / `git ls-files --others` 会执行
+ * 被扫仓库 `.git/config` 里的 fsmonitor 命令。
+ */
+export const GIT_SAFE_CONFIG_ARGS = ['-c', 'core.fsmonitor=false', '-c', 'core.untrackedCache=false'];
+/**
+ * 空树对象 ID：git 对空 tree 的内容做对象头哈希（"tree 0\0"）。
+ *
+ * 现算而不是写死常量，既跟随仓库的哈希算法，也不会让一串十六进制被
+ * 密钥类规则当成可疑字符串。
+ */
+function emptyTreeOidFor(format) {
+    return createHash(format).update('tree 0\u0000').digest('hex');
+}
+const emptyTreeCache = new Map();
+/**
+ * 取当前仓库的空树对象 ID，用作 `--attr-source`。
+ *
+ * 把属性查询指向空树后，被扫仓库工作区里的 `.gitattributes` 不再生效，
+ * 因此 `filter.<驱动>.clean` 不会被调用，diff 也不会被 clean 输出替换。
+ */
+async function emptyTreeOid(runner, cwd, timeoutMs) {
+    const cached = emptyTreeCache.get(cwd);
+    if (cached !== undefined)
+        return cached;
+    const result = await runner.run(['git', ...GIT_SAFE_CONFIG_ARGS, 'rev-parse', '--show-object-format'], { cwd, timeoutMs: Math.min(timeoutMs, 10000) });
+    const oid = emptyTreeOidFor(result.exitCode === 0 && /sha256/i.test(result.stdout) ? 'sha256' : 'sha1');
+    emptyTreeCache.set(cwd, oid);
+    return oid;
+}
 /** 运行 git diff（默认 HEAD，工作区未提交改动）。 */
 export async function runGitDiff(runner, cwd, base, target, timeoutMs = 30000, staged = false) {
     if (typeof base !== 'string' || base.trim() === '' || base.trim().startsWith('-') || base.includes('\0')) {
         throw new Error('参数 base 必须是非空的 Git ref，不能是 Git 命令选项。');
     }
-    const argv = ['git', 'diff'];
+    const attrSource = '--attr-source=' + await emptyTreeOid(runner, cwd, timeoutMs);
+    const argv = ['git', ...GIT_SAFE_CONFIG_ARGS, attrSource, 'diff'];
     if (staged)
         argv.push('--cached');
     argv.push('--no-ext-diff', '--no-textconv', '--no-color', '--relative', '--src-prefix=a/', '--dst-prefix=b/', '--unified=3', '--output-indicator-new=+', '--output-indicator-old=-', '--output-indicator-context= ', base.trim(), '--');
     if (target !== undefined && target.trim() !== '')
         argv.push(target.trim());
-    const result = await runner.run(argv, { timeoutMs, cwd });
+    let result = await runner.run(argv, { timeoutMs, cwd });
+    // git < 2.40 不认识 --attr-source：退回只关闭 fsmonitor 的调用（filter 加固缺席，
+    // 但不会因此拒绝整个扫描）。
+    if (result.exitCode !== 0 && /attr-source/i.test(result.stderr)) {
+        result = await runner.run(argv.filter((arg) => arg !== attrSource), { timeoutMs, cwd });
+    }
     if (result.exitCode !== 0 && result.exitCode !== 1) {
         throw new Error('git diff 失败（退出码 ' + String(result.exitCode) + '）：' + result.stderr.trim().split(/\r?\n/).slice(-4).join(' | '));
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-code-security",
-  "version": "0.4.1",
+  "version": "0.5.1",
   "description": "对代码与 Git 改动进行本地静态安全检查，并追踪修复结果。",
   "type": "module",
   "main": "lib/index.js",
@@ -35,7 +35,9 @@
       "patch": "./cordis.patch.yml"
     },
     "client": {
-      "inject": ["@deepseek-ai/dsh-client-ui-settings"],
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-settings"
+      ],
       "platform": "web"
     }
   },