dsh-homepage 0.1.1 → 0.1.3

package/README.md

@@ -4,6 +4,7 @@
 [![license: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![node: >=22.19](https://img.shields.io/badge/node-%3E%3D22.19-339933.svg)](package.json)
 [![DSH: 0.2.x](https://img.shields.io/badge/DSH-0.2.x-6f42c1.svg)](package.json)
+[![Awesome DSH Plugin](https://awesome-dsh-plugin.com/badge.svg)](https://awesome-dsh-plugin.com)
 
 [English](README.md) | [简体中文](README.zh.md)
 

package/README.zh.md

@@ -4,6 +4,7 @@
 [![license: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![node: >=22.19](https://img.shields.io/badge/node-%3E%3D22.19-339933.svg)](package.json)
 [![DSH: 0.2.x](https://img.shields.io/badge/DSH-0.2.x-6f42c1.svg)](package.json)
+[![Awesome DSH Plugin](https://awesome-dsh-plugin.com/badge.svg)](https://awesome-dsh-plugin.com)
 
 [English](README.md) | [简体中文](README.zh.md)
 

package/lib/audit-instructions.js

@@ -0,0 +1,21 @@
+/** Editable audit guidance shared by the host and the client build. */
+export const DEFAULT_AUDIT_INSTRUCTIONS = [
+  '1. 取源码：`web_fetch` 读 `https://raw.githubusercontent.com/<owner>/<repo>/HEAD/<path>`，或利用其他本地工具获取源码；必要时读取 npm 包 tarball 的内容。先读 `package.json`，再读入口文件，再顺着依赖与被动态加载的代码走下去。',
+  '2. 读代码，不读宣言：README 说什么是它想让你以为的，代码做什么才是要报的。',
+  '3. 按下面的顺序找问题：',
+  '   - 恶意行为：读取或外传凭据/令牌（`~/.dsh`、环境变量、ssh、云厂商配置）、上传本机文件、反弹 shell、挖矿、删除或加密用户文件、篡改 DSH 本身或其他插件；',
+  '   - 执行链：安装期脚本（preinstall/install/postinstall）执行命令；运行期 `child_process`；`eval`/`new Function`；从网络下载再执行；写入 `~/.dsh`、profile 或系统目录；',
+  '   - 隐蔽性：混淆或加密的字符串、base64 之后 eval、与功能无关的外联域名、把内容塞进资源文件里；',
+  '   - 越权：绕过 DSH 的沙箱与审批，或去调用别的插件的私有服务；',
+  '   - 版本：peer 范围与当前 DSH 版本是否相容（DSH 在安装时会拒绝不相容的包）。',
+  '4. 结论只有三档：',
+  '   - `safe`：没有发现上述任何问题，且代码与它声称的功能一致；',
+  '   - `warn`：可疑、需要用户知情（安装脚本、外部网络、权限偏大、版本不相容、源码读不到），但不像恶意；',
+  '   - `unsafe`：发现明确的恶意行为或高风险执行链。',
+  '5. 每一条 `warn` 都要带 `risk`，替用户回答四个问题——这是他唯一能据以决定装不装的东西：',
+  '   - `role`：这段代码在插件里做什么（功能角色）；',
+  '   - `why`：插件为什么需要它（合理的功能需要，还是抄来的惯例、与功能无关）；',
+  '   - `impact`：一旦被滥用会造成什么后果（拿到了什么、改了什么、传出了什么）；',
+  '   - `scenario` 取 `supply-chain`（供应链攻击：安装期/更新链上执行代码）、`privilege-escalation`（Agent 越权：绕过沙箱或审批、调用别的插件的私有服务）、`sandbox-escape`（沙箱逃逸）、`data-leak`（数据泄露：凭据/文件/环境变量被读取或外传）、`unsafe-publish`（不安全的网络发布）、`other`。',
+  '   只知道一部分就写那一部分，并在 `detail` 里说清你没看到什么；不要凭空补。`info`/`error` 不需要 `risk`。',
+].join('\n')

package/lib/cards/plugin-audit.js

@@ -331,7 +331,19 @@ function useStarter(api, view) {
     var decision = chosen === MODE_REVIEW ? MODE_REVIEW : MODE_INSTALL
     setError('')
     setBusy('start')
-    api.remote(START, { options: { target: wanted, mode: decision } })
+    var options = { target: wanted, mode: decision }
+    var prompt = String(api.control('auditPrompt') || '')
+    if (prompt) options.prompt = prompt
+    var model = String(api.control('auditModel') || '')
+    if (model) {
+      try {
+        var pair = JSON.parse(model)
+        options.selection = { provider: pair[0], model: pair[1] }
+      } catch (reason) { setBusy(''); setError(String(reason)); return }
+    }
+    var effort = String(api.control('auditEffort') || '')
+    if (effort) options.selection = Object.assign({}, options.selection || {}, { reasoningEffort: effort })
+    api.remote(START, { options: options })
       .then(function (next) {
         setBusy('')
         if (next && next.auditId) api.setControl('auditId', String(next.auditId))
@@ -380,7 +392,7 @@ function TargetRow(props) {
     onStart(wanted, mode)
     setDraft('')
   }
-  return h('div', { className: 'ph-loose' },
+  return h('div', { className: chooseMode ? 'ph-loose ph-audit-target-form' : 'ph-loose' },
     chooseMode
       ? h('div', { className: 'ph-loose-row' },
           h(UI.Segmented, {
@@ -414,6 +426,7 @@ function TargetRow(props) {
         onKeyDown: function (event) { if (event.key === 'Enter') submit() },
       }),
       h(UI.Button, {
+        tone: chooseMode ? 'primary' : undefined,
         disabled: busy || String(draft || '').trim() === '',
         onClick: submit,
       }, t('pluginAudit.action.start'))))
@@ -580,8 +593,9 @@ function FindingRow(props) {
       h('span', { className: 'ph-audit-finding-title' }, title),
       scenario ? h('span', { className: 'ph-audit-finding-tag' }, scenario) : null,
       h('span', { className: 'ph-audit-finding-more' }, t(open ? 'pluginAudit.finding.collapse' : 'pluginAudit.finding.expand'))),
-    open
-      ? h('div', { className: 'ph-audit-finding-body' },
+    h('div', { className: 'ph-audit-reveal', hidden: !open },
+      h('div', { className: 'ph-audit-reveal-inner' },
+        h('div', { className: 'ph-audit-finding-body' },
           detail ? h('p', { className: 'ph-audit-finding-detail' }, detail) : null,
           risk
             ? h('div', { className: 'ph-audit-risk' },
@@ -592,8 +606,7 @@ function FindingRow(props) {
             : (level === 'warn' ? h('p', { className: 'ph-audit-risk-missing' }, t('pluginAudit.risk.missing')) : null),
           finding.ref
             ? h('p', { className: 'ph-audit-finding-ref' }, t('pluginAudit.finding.ref', { ref: String(finding.ref) }))
-            : null)
-      : null)
+            : null))))
 }
 
 /** The wall reading: where the review is, or an honest empty state. */
@@ -675,12 +688,101 @@ function HistoryList(props) {
  * installs from its own row — which is how somebody asks for several reviews at once
  * and decides afterwards.
  */
+var defaultInstructions = /* @audit-instructions */ ''
+
+function AuditModelPicker(props) {
+  var api = props.api
+  var t = props.t
+  var catalog = props.catalog
+  var data = catalog.data || {}
+  var models = Array.isArray(data.models) ? data.models : []
+  var chosen = String(api.control('auditModel') || '')
+  var effort = String(api.control('auditEffort') || '')
+  var defaults = data.defaultSelection || {}
+  var defaultKey = defaults.provider && defaults.model ? JSON.stringify([defaults.provider, defaults.model]) : ''
+  var selected = models.filter(function (item) { return JSON.stringify([item.provider, item.model]) === (chosen || defaultKey) })[0]
+  var efforts = selected && Array.isArray(selected.efforts) ? selected.efforts : []
+  function catalogLabel(value, fallback) {
+    if (typeof value === 'string') return value
+    return value && typeof value === 'object' ? (value[t('pluginAudit.catalogLanguage')] || value.en || value.zh || fallback) : fallback
+  }
+  return h('div', { className: 'ph-audit-models' },
+    h('label', { className: 'ph-audit-model-field' }, h('span', null, t('pluginAudit.model')),
+      h('select', { className: 'ph-input ph-audit-model-select', value: chosen, disabled: props.busy || !models.length,
+        onChange: function (event) { api.setControl('auditModel', event.target.value); api.setControl('auditEffort', '') },
+      }, h('option', { value: '' }, t('pluginAudit.model.default')),
+      chosen && !selected ? h('option', { value: chosen }, t('pluginAudit.model.unavailable')) : null,
+      models.map(function (item) {
+        var key = JSON.stringify([item.provider, item.model])
+        return h('option', { key: key, value: key }, catalogLabel(item.name, item.model) + ' · ' + item.provider)
+      }))),
+    h('label', { className: 'ph-audit-model-field' }, h('span', null, t('pluginAudit.effort')),
+      h('select', { className: 'ph-input ph-audit-effort-select', value: effort, disabled: props.busy || !efforts.length,
+        onChange: function (event) {
+          if (!chosen && event.target.value && defaultKey) api.setControl('auditModel', defaultKey)
+          api.setControl('auditEffort', event.target.value)
+        },
+      }, h('option', { value: '' }, t(efforts.length ? 'pluginAudit.effort.default' : 'pluginAudit.effort.none')),
+      efforts.map(function (item) { return h('option', { key: item.id, value: item.id }, catalogLabel(item.name, item.id)) }))),
+    catalog.error ? h('span', { className: 'ph-groups-error' }, t('pluginAudit.model.error')) : null)
+}
+
+function PromptEditor(props) {
+  var api = props.api
+  var t = props.t
+  var saved = String(api.control('auditPrompt') || '')
+  var state = React.useState(saved || defaultInstructions)
+  var draft = state[0]
+  var setDraft = state[1]
+  var dirty = draft !== (saved || defaultInstructions)
+  var expanded = React.useState(false)
+  var open = expanded[0]
+  return h('section', { className: 'ph-audit-launch' },
+    h('div', { className: 'ph-audit-launch-head' },
+      h('div', { className: 'ph-audit-launch-heading' },
+        h('span', { className: 'ph-audit-launch-icon', 'aria-hidden': true }, '↗'),
+        h('div', null,
+          h('h3', { className: 'ph-audit-launch-title' }, t('pluginAudit.section.target')))),
+      h('button', {
+        type: 'button', className: 'ph-audit-prompt-trigger', 'aria-expanded': open,
+        title: t('pluginAudit.prompt.hint'), onClick: function () { expanded[1](!open) },
+      }, h('span', { 'aria-hidden': true }, '✎'), t('pluginAudit.prompt.edit'),
+        h('span', { className: 'ph-audit-prompt-badge' }, t(saved ? 'pluginAudit.prompt.custom' : 'pluginAudit.prompt.default')))),
+    props.children,
+    h(AuditModelPicker, { api: api, t: t, busy: props.busy, catalog: props.catalog }),
+    h('div', { className: 'ph-audit-settings ph-audit-reveal', hidden: !open },
+      h('div', { className: 'ph-audit-reveal-inner ph-loose' },
+      h('div', { className: 'ph-audit-editor-head' },
+        h('strong', null, t('pluginAudit.prompt.title')),
+        h('span', { className: 'ph-note' }, String(draft.length) + ' / 20000')),
+      h('p', { className: 'ph-note' }, t('pluginAudit.prompt.hint')),
+      h('textarea', {
+        className: 'ph-input ph-audit-prompt', value: draft, maxLength: 20000,
+        'aria-label': t('pluginAudit.prompt.title'),
+        onChange: function (event) { setDraft(event.target.value) },
+      }),
+      h('div', { className: 'ph-audit-editor-footer' },
+        h('span', { className: 'ph-note', role: 'status' }, t(dirty ? 'pluginAudit.prompt.unsaved' : 'pluginAudit.prompt.ready')),
+        h(UI.Button, { tone: 'primary', disabled: !dirty, onClick: function () {
+          var value = draft.trim() ? draft : defaultInstructions
+          api.setControl('auditPrompt', value === defaultInstructions ? '' : value)
+          setDraft(value)
+        } }, t('pluginAudit.prompt.save')),
+        h(UI.Button, { disabled: !saved && draft === defaultInstructions, onClick: function () {
+          api.setControl('auditPrompt', '')
+          setDraft(defaultInstructions)
+        } }, t('pluginAudit.prompt.reset'))))))
+}
+
 function AuditDetail(props) {
   var api = props.api
   var t = props.t
   var view = useAudit(api)
   useAnnounce(api, 'pluginAudit', auditNotice(view.audit, t))
   var starter = useStarter(api, view)
+  // Keep the catalog above the tab panes: returning to Current must not
+  // rediscover every provider or briefly disable the model selectors.
+  var modelCatalog = useRemote('homepage/pluginAuditModels', { options: {} }, { refreshMs: 0 })
   var tab = React.useState('current')
   var pane = tab[0]
   var setPane = tab[1]
@@ -703,9 +805,15 @@ function AuditDetail(props) {
   var history = listed.map(function (entry) {
     return audit && entry && entry.auditId === audit.auditId ? audit : entry
   })
+  function changePane(next) {
+    if (next === pane) return
+    // Update immediately; the pane's local CSS animation needs no page snapshot
+    // or animation-frame handshake before React can commit the selected tab.
+    setPane(next)
+  }
   function openRecord(id) {
     api.setControl('auditId', id)
-    setPane('current')
+    changePane('current')
   }
   function decideFromRow(id, decision) {
     if (pendingRow) return
@@ -723,7 +831,7 @@ function AuditDetail(props) {
         setRowError(String((reason && reason.message) || reason))
       })
   }
-  return h('div', { className: 'ph-detail-block' },
+  return h('div', { className: 'ph-detail-block ph-audit-detail' },
     h(UI.Segmented, {
       options: [
         { value: 'current', label: t('pluginAudit.tab.current') },
@@ -735,11 +843,11 @@ function AuditDetail(props) {
         // Opening the history asks the host for it: the records are the host's, and
         // a review started while this card was closed has to be in the list.
         if (wanted === 'history' && typeof view.reloadList === 'function') view.reloadList(true)
-        setPane(wanted)
+        changePane(wanted)
       },
     }),
     pane === 'history'
-      ? h('div', { className: 'ph-loose' },
+      ? h('div', { className: 'ph-loose ph-audit-pane', key: 'history' },
           h('div', { className: 'ph-section-head' },
             h('h4', { className: 'ph-section-title' }, t('pluginAudit.section.history'))),
           h(HistoryList, {
@@ -751,16 +859,26 @@ function AuditDetail(props) {
             onDecide: decideFromRow,
           }),
           rowError ? h('span', { className: 'ph-groups-error' }, rowError) : null)
-      : h('div', { className: 'ph-loose' },
-          h('div', { className: 'ph-section-head' }, h('h4', { className: 'ph-section-title' }, t('pluginAudit.section.target'))),
-          h(TargetRow, {
-            t: t, busy: starter.busy, mode: starter.mode, setMode: starter.setMode,
-            onStart: starter.start, draft: draft, setDraft: setDraft,
-          }),
+      : h('div', { className: 'ph-loose ph-audit-pane', key: 'current' },
+          h(PromptEditor, { api: api, t: t, busy: starter.busy, catalog: modelCatalog },
+            h(TargetRow, {
+              t: t, busy: starter.busy, mode: starter.mode, setMode: starter.setMode,
+              onStart: starter.start, draft: draft, setDraft: setDraft,
+            })),
           starter.error ? h('span', { className: 'ph-groups-error' }, starter.error) : null,
           view.error ? h('span', { className: 'ph-groups-error' }, String(view.error)) : null,
           audit
-            ? h('div', { className: 'ph-kv' },
+            ? h('div', { className: 'ph-audit-result' },
+                h('div', { className: 'ph-audit-result-head' },
+                  h(UI.Chip, { tone: STATE_TONES[audit.state] || null }, stateText(t, audit.state)),
+                  h('strong', { className: 'ph-audit-name' }, auditName(audit, t)),
+                  plugin.version ? h('span', { className: 'ph-note' }, String(plugin.version)) : null),
+                h('p', { className: 'ph-audit-summary' }, audit.summary || progressText(t, audit)),
+                (canInstall(audit) || canDecline(audit)) ? h('div', { className: 'ph-audit-result-actions' },
+                  h(VerdictActions, { api: api, t: t, audit: audit, view: view })) : null,
+                h('details', { className: 'ph-audit-metadata' },
+                  h('summary', null, t('pluginAudit.metadata')),
+                  h('div', { className: 'ph-kv' },
                 h('div', { className: 'ph-kv-row' },
                   h('span', { className: 'ph-kv-key' }, t('pluginAudit.kv.plugin')),
                   h('span', { className: 'ph-kv-value' }, auditName(audit, t))),
@@ -785,20 +903,18 @@ function AuditDetail(props) {
                   h('span', { className: 'ph-kv-value' }, stateText(t, audit.state) + (audit.stage ? ' · ' + progressText(t, audit) : ''))),
                 h('div', { className: 'ph-kv-row' },
                   h('span', { className: 'ph-kv-key' }, t('pluginAudit.kv.installed')),
-                  h('span', { className: 'ph-kv-value' }, t(audit.installed ? 'pluginAudit.value.yes' : 'pluginAudit.value.no'))))
+                  h('span', { className: 'ph-kv-value' }, t(audit.installed ? 'pluginAudit.value.yes' : 'pluginAudit.value.no'))))))
             : h('p', { className: 'ph-note' }, view.error ? t('pluginAudit.error.status') : (view.busy ? t('pluginAudit.loading') : t('pluginAudit.idle'))),
           audit && audit.detail ? h('p', { className: 'ph-note' }, String(audit.detail)) : null,
-          audit && (canInstall(audit) || canDecline(audit)) ? h(VerdictActions, { api: api, t: t, audit: audit, view: view }) : null,
-          h('div', { className: 'ph-section-head' }, h('h4', { className: 'ph-section-title' }, t('pluginAudit.section.verdict'))),
-          h('p', { className: 'ph-note' }, audit && audit.summary ? String(audit.summary) : t('pluginAudit.summary.none')),
-          h('div', { className: 'ph-section-head' }, h('h4', { className: 'ph-section-title' }, t('pluginAudit.section.findings'))),
+          audit ? h('div', { className: 'ph-section-head' },
+            h('h4', { className: 'ph-section-title' }, t('pluginAudit.section.findings')),
+            h('span', { className: 'ph-note' }, String(findings.length))) : null,
           findings.length === 0
-            ? h('p', { className: 'ph-note' }, t('pluginAudit.findings.none'))
+            ? (audit ? h('p', { className: 'ph-note' }, t('pluginAudit.findings.none')) : null)
             : h('div', { className: 'ph-audit-findings' }, sortFindings(findings).map(function (finding, index) {
                 return h(FindingRow, { t: t, finding: finding, key: 'f' + index })
               })),
-          h('div', { className: 'ph-section-head' }, h('h4', { className: 'ph-section-title' }, t('pluginAudit.section.session'))),
-          audit ? h(SessionRow, { t: t, audit: audit }) : h('p', { className: 'ph-note' }, t('pluginAudit.session.none'))))
+          audit ? h(SessionRow, { t: t, audit: audit }) : null))
 }
 
 defineCard({
@@ -824,6 +940,9 @@ defineCard({
   actions: [],
   detailActions: [
     { id: 'auditId', type: 'text', hidden: true, value: '' },
+    { id: 'auditPrompt', type: 'text', hidden: true, value: '' },
+    { id: 'auditModel', type: 'text', hidden: true, value: '' },
+    { id: 'auditEffort', type: 'text', hidden: true, value: '' },
     // The changed-audit signal (see SIGNAL): a control rather than component state
     // because the preview and the expanded body are separate instances that must
     // agree, and a control is the one value the framework shares between them.
@@ -834,6 +953,24 @@ defineCard({
 dict({
   zh: {
     'card.pluginAudit.title': '插件审核',
+    'pluginAudit.metadata': '插件详情',
+    'pluginAudit.catalogLanguage': 'zh',
+    'pluginAudit.model': '审核模型',
+    'pluginAudit.model.default': '跟随全局默认模型',
+    'pluginAudit.model.unavailable': '已选模型不可用，请重新选择',
+    'pluginAudit.model.error': '模型列表读取失败，仍可使用全局默认模型',
+    'pluginAudit.effort': '思考强度',
+    'pluginAudit.effort.default': '模型默认',
+    'pluginAudit.effort.none': '不支持或未提供思考强度',
+    'pluginAudit.prompt.edit': '编辑提示词',
+    'pluginAudit.prompt.title': '审核提示词',
+    'pluginAudit.prompt.custom': '自定义',
+    'pluginAudit.prompt.default': '默认',
+    'pluginAudit.prompt.hint': '保存后用于后续审核。审核对象、结果回传格式与安全约束由系统自动附加。',
+    'pluginAudit.prompt.save': '保存提示词',
+    'pluginAudit.prompt.reset': '恢复默认',
+    'pluginAudit.prompt.unsaved': '有未保存的修改',
+    'pluginAudit.prompt.ready': '已保存 · 下次审核生效',
 
     'pluginAudit.state.none': '无审核',
     'pluginAudit.state.running': '审核中',
@@ -912,7 +1049,7 @@ dict({
     'pluginAudit.tab.current': '当前审核',
     'pluginAudit.tab.history': '审核记录',
     'pluginAudit.history.empty': '还没有审核记录',
-    'pluginAudit.history.view': '查看',
+    'pluginAudit.history.view': '加载条目',
 
     'pluginAudit.kv.plugin': '插件',
     'pluginAudit.kv.version': '版本',
@@ -930,6 +1067,24 @@ dict({
   },
   en: {
     'card.pluginAudit.title': 'Plugin audit',
+    'pluginAudit.metadata': 'Plugin details',
+    'pluginAudit.catalogLanguage': 'en',
+    'pluginAudit.model': 'Review model',
+    'pluginAudit.model.default': 'Use global default model',
+    'pluginAudit.model.unavailable': 'Selected model unavailable — choose again',
+    'pluginAudit.model.error': 'Could not load models. The global default is still available.',
+    'pluginAudit.effort': 'Reasoning effort',
+    'pluginAudit.effort.default': 'Model default',
+    'pluginAudit.effort.none': 'Reasoning effort unavailable',
+    'pluginAudit.prompt.edit': 'Edit prompt',
+    'pluginAudit.prompt.title': 'Review prompt',
+    'pluginAudit.prompt.custom': 'Custom',
+    'pluginAudit.prompt.default': 'Default',
+    'pluginAudit.prompt.hint': 'Applies to future reviews once saved. The target, report format and safety constraints are appended automatically.',
+    'pluginAudit.prompt.save': 'Save prompt',
+    'pluginAudit.prompt.reset': 'Restore default',
+    'pluginAudit.prompt.unsaved': 'Unsaved changes',
+    'pluginAudit.prompt.ready': 'Saved · applies to the next review',
 
     'pluginAudit.state.none': 'No audit',
     'pluginAudit.state.running': 'Reviewing',
@@ -1008,7 +1163,7 @@ dict({
     'pluginAudit.tab.current': 'Current review',
     'pluginAudit.tab.history': 'Review history',
     'pluginAudit.history.empty': 'No reviews yet',
-    'pluginAudit.history.view': 'View',
+    'pluginAudit.history.view': 'Load entry',
 
     'pluginAudit.kv.plugin': 'Plugin',
     'pluginAudit.kv.version': 'Version',