dsh-sherlock 0.1.0 → 0.1.2

package/CHANGELOG.md

@@ -1,11 +1,22 @@
 # Changelog
 
-## 0.1.0 — 2026-11-08
+## 0.1.2 — 2026-11-08
+
+- Added TypeScript/checkJs and oxlint gates.
+- Hardened the runtime header filter and added security/edge tests.
+- Made data validation sync-safe and added a data-sync fixture test and monthly workflow.
+- Added benchmark tooling, governance docs, release/data runbooks, and Gitee release.
+
+## 0.1.1 — 2026-11-08
 
-- Initial release.
+- Initial public release (npm staged-publish path).
 - `sherlock_check` and `sherlock_sites` tools over a pinned Sherlock manifest.
 - Six result states with confidence and evidence.
 - Random negative-control verification for claimed results.
 - Per-host rate limiting, bounded response bodies, cancellation, and an in-memory cache.
 - Optional `sherlock-osint` skill.
 - 481-site data snapshot, 45 curated core names (41 effective), 47 exclusions.
+
+## 0.1.0 — 2026-11-08
+
+- Internal packaging iteration; not published to npm.

package/README.md

@@ -1,5 +1,7 @@
 # dsh-sherlock
 
+[![CI](https://github.com/PerryLink/dsh-sherlock/actions/workflows/ci.yml/badge.svg)](https://github.com/PerryLink/dsh-sherlock/actions/workflows/ci.yml)
+
 Sherlock-compatible public username checks for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (DSH).
 
 It turns the [Sherlock](https://github.com/sherlock-project/sherlock) site manifest into a DSH-native bundle with two tools and an on-demand skill. It is deliberately **not** a 1:1 port of the Python CLI: blocked, unknown, and unreliable results stay separate from claimed and available ones.
@@ -120,17 +122,35 @@ The data is pinned so installs are reproducible. Update it with `scripts/sync-sh
 Requires Node 24.9+.
 
 ```bash
+npm ci
+npm run typecheck        # tsc --checkJs, no emit
+npm run lint             # oxlint
 npm test                 # node --test, fixture server only
 npm run check            # data-pack validation
 npm run pack:check       # npm pack --dry-run
+npm run gate             # all of the above
 ```
 
-Tests cover status codes, messages, response URLs, WAF, redirects, POST payloads, custom headers, timeouts, body caps, exclusions, negative controls, caching, tool schemas, and data integrity. The real DSH schema validator can be used with:
+Tests cover status codes, messages, response URLs, WAF, redirects, POST payloads, custom headers, timeouts, body caps, exclusions, negative controls, caching, private-host rejection, abort cancellation, array detectors, tool schemas, and data integrity. The real DSH schema validator can be used with:
 
 ```bash
 DSH_TOOLS_PATH=/path/to/dsh-tools/lib/index.js npm test
 ```
 
+Live benchmark (network requests; not part of CI):
+
+```bash
+node scripts/benchmark.mjs --username blue --scope core --verify=false
+```
+
+## More documentation
+
+- [Data pack and sync runbook](docs/DATA.md)
+- [Release runbook](docs/RELEASING.md)
+- [Benchmark notes](docs/BENCHMARK.md)
+- [Security policy](SECURITY.md)
+- [Contributing](CONTRIBUTING.md)
+
 ## License
 
 Apache-2.0 for the plugin code; MIT for the Sherlock-derived data. See `LICENSE`, `NOTICE`, and `data/SHERLOCK-LICENSE`.

package/README.zh.md

@@ -1,5 +1,7 @@
 # dsh-sherlock
 
+[![CI](https://github.com/PerryLink/dsh-sherlock/actions/workflows/ci.yml/badge.svg)](https://github.com/PerryLink/dsh-sherlock/actions/workflows/ci.yml)
+
 面向 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)（DSH）的 Sherlock 兼容用户名检查插件。
 
 它把 [Sherlock](https://github.com/sherlock-project/sherlock) 的站点清单变成一个 DSH 原生 bundle：两个工具 + 一个按需加载的 skill。它不是 Python CLI 的 1:1 移植——**被拦截、未知、不可信**会和已占用、可用明确分开。
@@ -120,17 +122,35 @@ await tools.sherlock_check({ username: 'alice', scope: 'core' })
 需要 Node 24.9+。
 
 ```bash
+npm ci
+npm run typecheck        # tsc --checkJs，不产物
+npm run lint             # oxlint
 npm test                 # node --test，只用本地 fixture
 npm run check            # 数据校验
 npm run pack:check       # npm pack --dry-run
+npm run gate             # 以上全部
 ```
 
-测试覆盖状态码、message、response_url、WAF、重定向、POST payload、自定义 header、超时、body cap、排除项、负样本、缓存、工具 schema 和数据完整性。真实 DSH schema 校验：
+测试覆盖状态码、message、response_url、WAF、重定向、POST payload、自定义 header、超时、body cap、排除项、负样本、缓存、私有地址拒绝、abort 取消、数组检测器、工具 schema 和数据完整性。真实 DSH schema 校验：
 
 ```bash
 DSH_TOOLS_PATH=/path/to/dsh-tools/lib/index.js npm test
 ```
 
+Live benchmark（会发真实网络请求，不属于 CI）：
+
+```bash
+node scripts/benchmark.mjs --username blue --scope core --verify=false
+```
+
+## 更多文档
+
+- [数据包与同步 runbook](docs/DATA.md)
+- [发布 runbook](docs/RELEASING.md)
+- [Benchmark 记录](docs/BENCHMARK.md)
+- [安全策略](SECURITY.md)
+- [贡献指南](CONTRIBUTING.md)
+
 ## 许可
 
 插件代码 Apache-2.0；Sherlock 派生数据 MIT。见 `LICENSE`、`NOTICE`、`data/SHERLOCK-LICENSE`。

package/lib/core/engine.js

@@ -33,6 +33,7 @@ const WAF_FINGERPRINTS = [
 ]
 
 const PRIVATE_HOST_RE = /^(localhost|127\.|0\.0\.0\.0|\[::1\]|10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.|169\.254\.|100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\.|\[?fe80:|\[?fc|\[?fd)/i
+const SAFE_HEADERS = /^(accept|accept-language|content-type|user-agent|referer|origin|sec-fetch-(mode|site|dest))$/i
 
 /**
  * @param {{data: any, regexes?: Map<string, RegExp>, config?: Record<string, unknown>}} options
@@ -75,6 +76,8 @@ export function normalizeUsername(input) {
   const value = input.normalize('NFC').trim().replace(/^@/, '')
   if (value.length === 0) return { ok: false, reason: 'username must not be empty' }
   if (value.length > 64) return { ok: false, reason: 'username must be at most 64 characters' }
+  // Control characters and URL syntax are deliberately rejected here.
+  // oxlint-disable-next-line no-control-regex
   if (/[\u0000-\u001f\u007f\s/\\?#%]/.test(value)) {
     return { ok: false, reason: 'username contains whitespace, control characters, or URL syntax' }
   }
@@ -97,6 +100,10 @@ function interpolate(value, username) {
   return value
 }
 
+/**
+ * @param {any} engine
+ * @param {{sites?: string[], scope?: 'core'|'all', includeNsfw?: boolean, maxSites?: number}} [options]
+ */
 export function resolveSites(engine, { sites, scope = 'core', includeNsfw, maxSites } = {}) {
   const config = engine.config
   let pool = engine.data.sites.filter((site) => {
@@ -135,6 +142,11 @@ export function resolveSites(engine, { sites, scope = 'core', includeNsfw, maxSi
   return { selected: pool.slice(0, limit), unknown, truncated, eligible: pool.length }
 }
 
+/**
+ * @param {any} engine
+ * @param {string} input
+ * @param {{scope?: 'core'|'all', sites?: string[], includeNsfw?: boolean, includeAvailable?: boolean, verify?: boolean, maxSites?: number, signal?: AbortSignal}} [options]
+ */
 export async function checkUsername(engine, input, options = {}) {
   const parsed = normalizeUsername(input)
   if (!parsed.ok) throw new Error(`invalid username: ${parsed.reason}`)
@@ -208,6 +220,10 @@ export async function checkUsername(engine, input, options = {}) {
   return value
 }
 
+/**
+ * @param {any} engine
+ * @param {{scope?: 'core'|'all', includeNsfw?: boolean, query?: string, limit?: number}} [options]
+ */
 export function listSites(engine, { scope = 'core', includeNsfw, query, limit = 50 } = {}) {
   const config = engine.config
   let pool = engine.data.sites.filter((site) => {
@@ -268,8 +284,15 @@ function writeCache(engine, key, value) {
   }
 }
 
+/**
+ * @template T
+ * @param {T[]} items
+ * @param {number} limit
+ * @param {(item: T, index: number) => Promise<any>} task
+ * @param {AbortSignal|undefined} signal
+ */
 async function mapLimit(items, limit, task, signal) {
-  const results = new Array(items.length)
+  const results = Array.from({ length: items.length })
   let index = 0
   const workers = Array.from({ length: Math.min(limit, items.length) }, async () => {
     while (true) {
@@ -284,10 +307,17 @@ async function mapLimit(items, limit, task, signal) {
   return results
 }
 
+/** @param {AbortSignal|undefined} signal */
 function throwIfAborted(signal) {
   if (signal?.aborted) throw signal.reason ?? new Error('aborted')
 }
 
+/**
+ * @param {any} engine
+ * @param {any} site
+ * @param {string} username
+ * @param {{signal?: AbortSignal}} [options]
+ */
 async function checkSite(engine, site, username, { signal } = {}) {
   const started = performance.now()
   const elapsed = () => Math.round(performance.now() - started)
@@ -355,11 +385,14 @@ function buildRequest(engine, site, username) {
   const payload = site.payload === null || site.payload === undefined
     ? undefined
     : interpolate(site.payload, username)
+  const siteHeaders = Object.fromEntries(
+    Object.entries(interpolate(site.headers ?? {}, username)).filter(([key]) => SAFE_HEADERS.test(key)),
+  )
   const headers = {
     accept: 'text/html,application/xhtml+xml,application/json;q=0.9,*/*;q=0.8',
     'accept-language': 'en-US,en;q=0.9',
     'user-agent': engine.config.userAgent,
-    ...interpolate(site.headers ?? {}, username),
+    ...siteHeaders,
   }
   let body
   if (payload !== undefined && !['GET', 'HEAD'].includes(site.method)) {
@@ -369,7 +402,7 @@ function buildRequest(engine, site, username) {
   return { url, method: site.method ?? 'GET', headers, body, site, username }
 }
 
-function assertPublicHttpUrl(raw, config = {}) {
+export function assertPublicHttpUrl(raw, config = {}) {
   let url
   try {
     url = new URL(raw)
@@ -385,6 +418,10 @@ function assertPublicHttpUrl(raw, config = {}) {
   return url
 }
 
+/**
+ * @param {{url: string, method: string, body?: string, headers: Record<string,string>}} request
+ * @param {{signal?: AbortSignal, maxRedirects?: number, allowPrivateHosts?: boolean}} [options]
+ */
 async function fetchWithRedirects(request, { signal, maxRedirects = 5, allowPrivateHosts = false } = {}) {
   let url = request.url
   let method = request.method
@@ -591,6 +628,13 @@ function combineOutcomes(outcomes) {
   return { status: STATUS.UNKNOWN, reason: 'no_outcome', confidence: 'low' }
 }
 
+/**
+ * @param {any} engine
+ * @param {any} site
+ * @param {string} username
+ * @param {any} result
+ * @param {{signal?: AbortSignal}} [options]
+ */
 async function verifyClaimed(engine, site, username, result, { signal } = {}) {
   const control = controlUsername(site)
   if (!control) {

package/lib/dsh/tools.js

@@ -209,6 +209,7 @@ export function createTools(engine, config, toolVersion) {
 /**
  * @param {unknown} args
  * @param {'core'|'all'} defaultScope
+ * @returns {{username: string, scope: 'core'|'all', sites?: string[], includeNsfw: boolean, includeAvailable: boolean, verify: boolean, maxSites?: number}}
  */
 function parseCheckArgs(args, defaultScope) {
   if (!args || typeof args !== 'object' || Array.isArray(args)) throw new Error('arguments must be an object')
@@ -216,6 +217,7 @@ function parseCheckArgs(args, defaultScope) {
   if (typeof input.username !== 'string') throw new Error('username must be a string')
   const scope = input.scope ?? defaultScope
   if (scope !== 'core' && scope !== 'all') throw new Error('scope must be "core" or "all"')
+  const typedScope = /** @type {'core'|'all'} */ (scope)
   let sites
   if (input.sites !== undefined) {
     if (!Array.isArray(input.sites) || input.sites.length > 50) throw new Error('sites must be an array of at most 50 strings')
@@ -234,7 +236,7 @@ function parseCheckArgs(args, defaultScope) {
   }
   return {
     username: input.username,
-    scope,
+    scope: typedScope,
     sites,
     includeNsfw: input.include_nsfw === true,
     includeAvailable: input.include_available === true,
@@ -243,12 +245,16 @@ function parseCheckArgs(args, defaultScope) {
   }
 }
 
-/** @param {unknown} args */
+/**
+ * @param {unknown} args
+ * @returns {{query?: string, scope: 'core'|'all', includeNsfw: boolean, limit: number}}
+ */
 function parseSitesArgs(args) {
   if (!args || typeof args !== 'object' || Array.isArray(args)) throw new Error('arguments must be an object')
   const input = /** @type {Record<string, unknown>} */ (args)
   const scope = input.scope ?? 'core'
   if (scope !== 'core' && scope !== 'all') throw new Error('scope must be "core" or "all"')
+  const typedScope = /** @type {'core'|'all'} */ (scope)
   if (input.query !== undefined && typeof input.query !== 'string') throw new Error('query must be a string')
   if (input.include_nsfw !== undefined && typeof input.include_nsfw !== 'boolean') throw new Error('include_nsfw must be a boolean')
   let limit = 50
@@ -259,8 +265,8 @@ function parseSitesArgs(args) {
     limit = /** @type {number} */ (input.limit)
   }
   return {
-    query: input.query,
-    scope,
+    query: typeof input.query === 'string' ? input.query : undefined,
+    scope: typedScope,
     includeNsfw: input.include_nsfw === true,
     limit,
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-sherlock",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Sherlock-compatible public username checks for DeepSeek Harness, with blocked/unknown results kept separate.",
   "type": "module",
   "main": "index.js",
@@ -35,6 +35,9 @@
   "scripts": {
     "test": "node --test test/*.test.js",
     "check": "node scripts/validate-data.mjs",
+    "typecheck": "tsc -p tsconfig.json",
+    "lint": "oxlint lib scripts test index.js",
+    "gate": "npm run check && npm run typecheck && npm run lint && npm test && npm run pack:check",
     "pack:check": "npm pack --dry-run",
     "prepack": "node scripts/validate-data.mjs"
   },
@@ -59,5 +62,10 @@
   "bugs": {
     "url": "https://github.com/PerryLink/dsh-sherlock/issues"
   },
-  "icon": "./icon.svg"
+  "icon": "./icon.svg",
+  "devDependencies": {
+    "@types/node": "24.19.2",
+    "oxlint": "1.92.0",
+    "typescript": "7.0.2"
+  }
 }