dsh-standards 1.3.0 → 1.4.0

package/40-checker/scripts/build-sidecar.mjs

@@ -10,13 +10,25 @@
  *   lifecycle read an existing sidecar (`--prev`) and only recompute
  *             `lifecycle` from `--today` and `publish/withdrawals.json`.
  *
+ * Entry fields are a superset of the original `dsh-market-sidecar/1` shape
+ * (subject/levels/evidence/validity/lifecycle/selfAssessed are unchanged):
+ *   title/repo/license   from the published package.json, null when absent
+ *   scope                {dsh, cordis, platform} from dsh.engines / npm engines
+ *                        / peerDependencies, falling back to the audit anchor
+ *   checks               checker results as {id,result,coverage} only; detailed
+ *                        reasons stay in the report, never in the sidecar
+ *   evidence             url/sha256 kept for compatibility; reportUrl/
+ *                        reportSha256 are the same values under the new names
+ *   checkedBy            {checker, command} that produced the audit
+ *   notChecked           short honest list of what the run did not exercise
+ *
  * Deliberately absent: advice (author view), issuer / recordHash / verifyUrl
- * (we are not an issuer). `--today` pins the clock so CI and tests are
- * reproducible.
+ * (we are not an issuer), score / rank (we do not grade). `--today` pins the
+ * clock so CI and tests are reproducible.
  *
  * Usage:
  *   node 40-checker/scripts/build-sidecar.mjs --levels audit.json \
- *     --name dsh-security-pack --version 3.0.1 --tarball dsh-security-pack-3.0.1.tgz \
+ *     --report report.json --tarball dsh-security-pack-3.0.1.tgz \
  *     --out publish/sidecar.json --today 2026-11-06
  *
  *   node 40-checker/scripts/build-sidecar.mjs --prev publish/sidecar.json \
@@ -36,8 +48,12 @@ const DATE = /^\d{4}-\d{2}-\d{2}$/
 const HEX40 = /^[0-9a-f]{40}$/
 const HEX64 = /^[0-9a-f]{64}$/
 const LIFECYCLE = new Set(['active', 'stale', 'under-review', 'withdrawn'])
-const FORBIDDEN = new Set(['advice', 'issuer', 'recordHash', 'verifyUrl'])
+const FORBIDDEN = new Set(['advice', 'issuer', 'recordHash', 'verifyUrl', 'score', 'rank'])
 const NOT_CLAIMED = ['official', 'certification', 'security-audit', 'endorsement', 'ordering', 'comparison', 'warranty']
+const CHECK_KEYS = new Set(['id', 'result', 'coverage'])
+const SCOPE_KEYS = new Set(['dsh', 'cordis', 'platform'])
+const CHECKED_BY_KEYS = new Set(['checker', 'command'])
+const REPO_GIT_SHORTHAND = /^github:([^/]+\/[^/]+?)(?:\.git)?$/
 
 function usage() {
   console.log(`build-sidecar — publish/sidecar.json (${SCHEMA})
@@ -58,9 +74,12 @@ Options:
   --package <dir>          package.json directory for name/version
   --tarball <file>         package tarball; sha256 is recorded in subject
   --tarball-sha256 <hex>   explicit tarball sha256 (checked against --tarball)
-  --evidence-url <url>     optional https evidence URL
-  --evidence-file <file>   hash this file into evidence.sha256
-  --evidence-sha256 <hex>  explicit evidence sha256
+  --report <file>          dsh-conformance/1 checker report; its checks are
+                           reduced to {id,result,coverage} (no details)
+  --checked-command <s>    command recorded in checkedBy.command
+  --evidence-url <url>     optional https evidence URL (url + reportUrl)
+  --evidence-file <file>   hash this file into evidence.sha256/reportSha256
+  --evidence-sha256 <hex>  explicit evidence sha256 (sha256 + reportSha256)
   --checker-version <v>    default dsh-standards package.json version
   --checker-sha <40hex>    default git HEAD when available
   --index-url <url>        default https://awesome-dsh-plugin.com/index.json
@@ -110,6 +129,7 @@ function parseArgs(argv) {
     today: null, todayProvided: false, ttlDays: 90,
     name: null, version: null, packageDir: null,
     tarball: null, tarballSha256: null,
+    report: null, checkedCommand: null,
     evidenceUrl: null, evidenceFile: null, evidenceSha256: null,
     checkerVersion: null, checkerSha: null,
     indexUrl: 'https://awesome-dsh-plugin.com/index.json',
@@ -134,6 +154,8 @@ function parseArgs(argv) {
     else if (arg === '--package') options.packageDir = next()
     else if (arg === '--tarball') options.tarball = next()
     else if (arg === '--tarball-sha256') options.tarballSha256 = next().toLowerCase()
+    else if (arg === '--report') options.report = next()
+    else if (arg === '--checked-command') options.checkedCommand = next()
     else if (arg === '--evidence-url') options.evidenceUrl = next()
     else if (arg === '--evidence-file') options.evidenceFile = next()
     else if (arg === '--evidence-sha256') options.evidenceSha256 = next().toLowerCase()
@@ -162,6 +184,123 @@ function readPackageMeta(directory) {
   }
 }
 
+function firstLine(value) {
+  if (typeof value !== 'string') return null
+  const line = value.split(/\r?\n/)[0].trim()
+  return line === '' ? null : line
+}
+
+function httpsUrl(value) {
+  if (typeof value !== 'string' || value.trim() === '') return null
+  let url = value.trim()
+  const shorthand = url.match(REPO_GIT_SHORTHAND)
+  if (shorthand) url = `https://github.com/${shorthand[1]}`
+  if (url.startsWith('git+')) url = url.slice(4)
+  if (url.startsWith('ssh://git@')) url = `https://${url.slice('ssh://git@'.length)}`
+  if (url.startsWith('git@')) {
+    const match = url.match(/^git@([^:]+):(.+)$/)
+    if (match) url = `https://${match[1]}/${match[2]}`
+  }
+  if (url.startsWith('git://')) url = `https://${url.slice('git://'.length)}`
+  if (url.startsWith('http://')) url = `https://${url.slice('http://'.length)}`
+  if (!url.startsWith('https://')) return null
+  url = url.replace(/\.git$/i, '').replace(/\/+$/, '')
+  try {
+    const parsed = new URL(url)
+    if (parsed.protocol !== 'https:') return null
+  } catch {
+    return null
+  }
+  return url
+}
+
+function normalizeRepo(repository) {
+  if (typeof repository === 'string') return httpsUrl(repository)
+  if (!repository || typeof repository !== 'object') return null
+  return httpsUrl(repository.url)
+}
+
+function normalizeLicense(license) {
+  let value = license
+  if (value && typeof value === 'object') value = value.type
+  if (typeof value !== 'string') return null
+  const text = value.trim()
+  if (text === '' || /^SEE LICENSE/i.test(text) || text === 'UNLICENSED') return null
+  // Accept plain SPDX ids and simple AND/OR/WITH expressions; anything else is
+  // left null rather than guessed.
+  if (!/^[A-Za-z0-9.+-]+(?: \([^()]+\))?(?: (?:AND|OR|WITH) [A-Za-z0-9.+-]+(?: \([^()]+\))?)*$/.test(text)) return null
+  return text
+}
+
+function firstString(...values) {
+  for (const value of values) {
+    if (typeof value === 'string' && value.trim() !== '') return value.trim()
+  }
+  return null
+}
+
+function platformFromPackage(meta) {
+  const declared = firstString(meta?.dsh?.client?.platform, meta?.dsh?.platform, meta?.engines?.platform)
+  if (declared) return declared
+  const os = Array.isArray(meta?.os) ? meta.os.filter(item => typeof item === 'string' && item !== '') : []
+  const cpu = Array.isArray(meta?.cpu) ? meta.cpu.filter(item => typeof item === 'string' && item !== '') : []
+  if (os.length === 0 && cpu.length === 0) return null
+  return [os.join('/'), cpu.join('/')].filter(Boolean).join('-')
+}
+
+function inferScope(meta, audit) {
+  const anchor = audit?.checker?.anchor && typeof audit.checker.anchor === 'object' ? audit.checker.anchor : {}
+  const dshEngines = meta?.dsh?.engines && typeof meta.dsh.engines === 'object' ? meta.dsh.engines : {}
+  const engines = meta?.engines && typeof meta.engines === 'object' ? meta.engines : {}
+  const peer = meta?.peerDependencies && typeof meta.peerDependencies === 'object' ? meta.peerDependencies : {}
+  const deps = meta?.dependencies && typeof meta.dependencies === 'object' ? meta.dependencies : {}
+  return {
+    dsh: firstString(dshEngines.dsh, engines.dsh, anchor.dsh),
+    cordis: firstString(dshEngines.cordis, engines.cordis, peer['@deepseek-ai/cordis'], deps['@deepseek-ai/cordis'], anchor.cordis),
+    platform: platformFromPackage(meta),
+  }
+}
+
+function extractChecks(report, name, version) {
+  if (!report || !Array.isArray(report.checks)) return []
+  if (report.subject && typeof report.subject === 'object') {
+    const subjectName = firstString(report.subject.name)
+    const subjectVersion = firstString(report.subject.version)
+    if (subjectName !== null && name !== null && subjectName !== name) {
+      throw new Error(`--report subject.name ${subjectName} does not match ${name}`)
+    }
+    if (subjectVersion !== null && version !== null && subjectVersion !== version) {
+      throw new Error(`--report subject.version ${subjectVersion} does not match ${version}`)
+    }
+  }
+  return report.checks.map(check => {
+    if (!check || typeof check !== 'object') throw new Error('--report checks must be objects')
+    const id = firstString(check.id)
+    const result = firstString(check.result)
+    const coverage = firstString(check.coverage)
+    if (id === null || result === null || coverage === null) {
+      throw new Error('--report checks need id/result/coverage')
+    }
+    return { id, result, coverage }
+  })
+}
+
+function summarizeNotChecked(audit, checks, hasReport) {
+  const items = []
+  const entry = audit?.levels?.entry && typeof audit.levels.entry === 'object' ? audit.levels.entry : {}
+  if (entry.claim !== 'runtime') items.push(`ENTRY:runtime (claim=${firstString(entry.claim) ?? 'unknown'}; not exercised)`)
+  if (!hasReport) items.push('ENTRY:checks (no --report; checker results unavailable)')
+  const notRun = checks.filter(check => check.coverage === 'not-run').map(check => check.id)
+  if (notRun.length > 0) items.push(`ENTRY:${notRun.join(', ')} (coverage=not-run)`)
+  const flow = audit?.levels?.flow && typeof audit.levels.flow === 'object' ? audit.levels.flow : {}
+  if (flow.state !== 'runtime') {
+    items.push(`FLOW:J1-J8 (${firstString(flow.state) ?? 'not-run'}; ${Number.isInteger(flow.passed) ? flow.passed : 0}/8 journeys pass)`)
+  }
+  const boost = audit?.levels?.boost && typeof audit.levels.boost === 'object' ? audit.levels.boost : {}
+  if (boost.state !== 'measured') items.push(`BOOST:LEV-3..LEV-4 (${firstString(boost.state) ?? 'not-measured'})`)
+  return items
+}
+
 function pickLevel(row, keys, fallback) {
   const level = {}
   if (row && typeof row === 'object') {
@@ -245,6 +384,9 @@ function entryFromAudit(audit, options, levelFile) {
   if (typeof name !== 'string' || name === '') throw new Error('cannot determine subject.name; pass --name or --package')
   if (typeof version !== 'string' || version === '') throw new Error('cannot determine subject.version; pass --version or --package')
 
+  const report = options.report ? readJson(path.resolve(options.report), '--report') : null
+  const checks = extractChecks(report, name, version)
+
   const auditLevels = audit.levels && typeof audit.levels === 'object' ? audit.levels : {}
   const levels = {
     entry: pickLevel(auditLevels.entry, ['state', 'claim'], 'not-run'),
@@ -286,16 +428,38 @@ function entryFromAudit(audit, options, levelFile) {
     let parsed
     try { parsed = new URL(options.evidenceUrl) } catch { throw new Error(`--evidence-url is not a URL: ${options.evidenceUrl}`) }
     if (parsed.protocol !== 'https:') throw new Error('--evidence-url must be https')
+    // url/sha256 are the original names; reportUrl/reportSha256 are the same
+    // values under the newer, explicit names. Both stay so old readers work.
     evidence.url = options.evidenceUrl
+    evidence.reportUrl = options.evidenceUrl
+  }
+  if (evidenceSha256 !== null) {
+    evidence.sha256 = evidenceSha256
+    evidence.reportSha256 = evidenceSha256
   }
-  if (evidenceSha256 !== null) evidence.sha256 = evidenceSha256
+
+  const scanner = firstString(audit.checker?.anchor?.scanner)
+  const checkerVersion = firstString(options.checkerVersion, readPackageMeta(ROOT).version) ?? 'unknown'
+  const checker = scanner === null
+    ? `dsh-standards@${checkerVersion}`
+    : `dsh-standards@${checkerVersion} (${scanner})`
+  const command = firstString(options.checkedCommand) ?? (levels.entry.claim === 'runtime'
+    ? 'dsh-levels <package-dir> --format json'
+    : 'dsh-levels <package-dir> --no-runtime --format json')
 
   return {
     key: `${name}@${version}`,
     entry: {
       subject: { name, version, tarballSha256 },
+      title: firstLine(meta.description),
+      repo: normalizeRepo(meta.repository),
+      license: normalizeLicense(meta.license),
+      scope: inferScope(meta, audit),
       levels,
+      checks,
       evidence,
+      checkedBy: { checker, command },
+      notChecked: summarizeNotChecked(audit, checks, report !== null),
       validity: { checkedAt, expiresAt, policy: `${options.ttlDays}d` },
       lifecycle: 'active',
       selfAssessed: options.selfAssessed,
@@ -400,6 +564,72 @@ function validateSidecar(sidecar) {
     if (entry.evidence.sha256 !== undefined && !HEX64.test(String(entry.evidence.sha256))) {
       throw new Error(`${key}: evidence.sha256 must be 64 hex chars`)
     }
+    if (entry.evidence.reportUrl !== undefined) {
+      let url
+      try { url = new URL(entry.evidence.reportUrl) } catch { throw new Error(`${key}: evidence.reportUrl is not a URL`) }
+      if (url.protocol !== 'https:') throw new Error(`${key}: evidence.reportUrl must be https`)
+    }
+    if (entry.evidence.reportSha256 !== undefined && !HEX64.test(String(entry.evidence.reportSha256))) {
+      throw new Error(`${key}: evidence.reportSha256 must be 64 hex chars`)
+    }
+    if (entry.title !== undefined && entry.title !== null && (typeof entry.title !== 'string' || entry.title === '')) {
+      throw new Error(`${key}: title must be a non-empty string or null`)
+    }
+    if (entry.repo !== undefined && entry.repo !== null) {
+      let url
+      try { url = new URL(entry.repo) } catch { throw new Error(`${key}: repo is not a URL`) }
+      if (url.protocol !== 'https:') throw new Error(`${key}: repo must be https or null`)
+    }
+    if (entry.license !== undefined && entry.license !== null && (typeof entry.license !== 'string' || entry.license === '')) {
+      throw new Error(`${key}: license must be a non-empty string or null`)
+    }
+    if (entry.scope !== undefined) {
+      if (!entry.scope || typeof entry.scope !== 'object' || Array.isArray(entry.scope)) throw new Error(`${key}: scope must be an object`)
+      for (const field of Object.keys(entry.scope)) {
+        if (!SCOPE_KEYS.has(field)) throw new Error(`${key}: scope.${field} is not part of the sidecar contract`)
+      }
+      for (const field of ['dsh', 'cordis', 'platform']) {
+        const value = entry.scope[field]
+        if (field === 'platform' && value === undefined) continue
+        if (value !== null && (typeof value !== 'string' || value === '')) {
+          throw new Error(`${key}: scope.${field} must be a non-empty string or null`)
+        }
+      }
+    }
+    if (entry.checks !== undefined) {
+      if (!Array.isArray(entry.checks)) throw new Error(`${key}: checks must be an array`)
+      const seen = new Set()
+      for (const check of entry.checks) {
+        if (!check || typeof check !== 'object' || Array.isArray(check)) throw new Error(`${key}: every check must be an object`)
+        for (const field of Object.keys(check)) {
+          if (!CHECK_KEYS.has(field)) throw new Error(`${key}: checks must not carry ${field}; only id/result/coverage`)
+        }
+        for (const field of ['id', 'result', 'coverage']) {
+          if (typeof check[field] !== 'string' || check[field] === '') throw new Error(`${key}: checks[].${field} is required`)
+        }
+        if (seen.has(check.id)) throw new Error(`${key}: duplicate check id ${check.id}`)
+        seen.add(check.id)
+      }
+    }
+    if (entry.checkedBy !== undefined) {
+      if (!entry.checkedBy || typeof entry.checkedBy !== 'object' || Array.isArray(entry.checkedBy)) {
+        throw new Error(`${key}: checkedBy must be an object`)
+      }
+      for (const field of Object.keys(entry.checkedBy)) {
+        if (!CHECKED_BY_KEYS.has(field)) throw new Error(`${key}: checkedBy.${field} is not part of the sidecar contract`)
+      }
+      for (const field of ['checker', 'command']) {
+        if (typeof entry.checkedBy[field] !== 'string' || entry.checkedBy[field] === '') {
+          throw new Error(`${key}: checkedBy.${field} is required`)
+        }
+      }
+    }
+    if (entry.notChecked !== undefined) {
+      if (!Array.isArray(entry.notChecked)) throw new Error(`${key}: notChecked must be an array`)
+      for (const item of entry.notChecked) {
+        if (typeof item !== 'string' || item === '') throw new Error(`${key}: notChecked entries must be non-empty strings`)
+      }
+    }
   }
   walkKeys(sidecar, 'sidecar', (key, where) => {
     if (FORBIDDEN.has(key)) throw new Error(`${where} is forbidden in a sidecar (${[...FORBIDDEN].join(', ')})`)

package/40-checker/src/author-cli.mjs

@@ -5,22 +5,40 @@
  * same report is presented: Markdown by default, `--json` for the raw
  * `dsh-conformance/1` document, `--html <file>` for a single self-contained
  * file. Exit codes are the checker's, never rewritten here.
+ *
+ * Safety defaults live here, not in the checker:
+ *  - unless the caller explicitly opts in, `--entry-claim static --no-exec` is
+ *    forwarded, so `check` never imports the inspected plugin;
+ *  - the PATH `dsh` is never executed unconditionally. The anchor comes from
+ *    `--host-version`, then `$DSH_HOST_VERSION`, then an opt-in
+ *    `--allow-host-probe` (which resolves the `dsh` JS entry and runs it with
+ *    `node ... --version`). With no source the report says the host version is
+ *    unknown and records `anchor.runtimeSource=default`, `suspect=true`.
  */
 import fs from 'node:fs'
+import os from 'node:os'
 import path from 'node:path'
 import { spawnSync } from 'node:child_process'
+import { createRequire } from 'node:module'
 import { fileURLToPath } from 'node:url'
 import { renderHtml, renderMarkdown } from './author-report.mjs'
+import { sanitizedEnv } from './sandbox-env.mjs'
+import { parseVersion } from './semver.mjs'
 
 const HERE = path.dirname(fileURLToPath(import.meta.url))
 const CHECKER = path.resolve(HERE, '..', 'bin', 'dsh-plugin-verify.mjs')
 const MAX_BUFFER = 64 * 1024 * 1024
+const HOST_PROBE_TIMEOUT_MS = 5000
+const RUNTIME_IDS = new Set(['DSC-04', 'DSC-05', 'DSC-06', 'DSC-07', 'DSC-08', 'DSC-09'])
+// The checker falls back to `dsh --version` when DSH_BIN is unset. `check` must
+// never do that implicitly, so the child always gets a path that cannot exist.
+const NO_PROBE_BIN = path.join(os.tmpdir(), `dsh-standards-no-host-probe-${process.pid}`)
 
 /** Checker flags that take a value, so `check --scope entry` is not read as a directory. */
 const VALUE_FLAGS = new Set([
   '--scope', '--profile', '--runtime', '--runtime-version', '--cordis-version', '--commit',
   '--install-spec', '--market-index', '--plugin-name', '--timeout', '--host', '--base',
-  '--web', '--bare', '--entry-runtime', '--entry-claim',
+  '--web', '--bare', '--entry-runtime', '--entry-claim', '--max-files', '--max-bytes',
 ])
 
 export function checkUsage() {
@@ -34,8 +52,17 @@ Usage:
 Options:
   --json                 print the raw dsh-conformance/1 report
   --html <file>          write a single-file HTML report (inline CSS, no assets)
+  --host-version <v>     host dsh version for the anchor (default: $DSH_HOST_VERSION)
+  --allow-host-probe     resolve the \`dsh\` JS entry and run \`node <entry> --version\`
   --help                 show this help
 
+Safety:
+  check defaults to --entry-claim static --no-exec: the inspected plugin code
+  is NOT executed. Runtime checks need an explicit --runtime <path>, --host <file>,
+  or --entry-claim runtime. PATH \`dsh\` is never executed unless --allow-host-probe
+  is passed; with no host version the report says "host 版本未知" and marks the
+  anchor source=default, suspect=true.
+
 Any other flag is forwarded to the checker, e.g.:
   --scope entry --entry-claim static --no-exec
   --runtime-version 0.2.2-rc.1
@@ -49,12 +76,162 @@ Exit codes (same as the checker):
 `
 }
 
+function hasFlag(args, name) {
+  return args.some(arg => arg === name || arg.startsWith(`${name}=`))
+}
+
+function flagValue(args, name) {
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index]
+    if (arg === name) return args[index + 1]
+    if (arg.startsWith(`${name}=`)) return arg.slice(name.length + 1)
+  }
+  return undefined
+}
+
+/**
+ * The one place that decides whether a run may execute plugin code.
+ *
+ * `--runtime`, `--host` and `--entry-claim runtime` are explicit opt-ins. Every
+ * other invocation gets `--no-exec`; a missing entry claim also gets the static
+ * claim so DSC-14 cannot pretend runtime evidence exists.
+ */
+export function safetyDefaultsFor(passthrough = []) {
+  const entryClaim = flagValue(passthrough, '--entry-claim')
+  const claimProvided = hasFlag(passthrough, '--entry-claim')
+  const runtimeRequested = hasFlag(passthrough, '--runtime')
+    || hasFlag(passthrough, '--host')
+    || entryClaim === 'runtime'
+  const noExecRequested = hasFlag(passthrough, '--no-exec')
+  const args = []
+  if (!runtimeRequested) {
+    if (!claimProvided) args.push('--entry-claim', 'static')
+    if (!noExecRequested) args.push('--no-exec')
+  }
+  return {
+    args,
+    defaulted: !runtimeRequested,
+    runtimeRequested,
+    entryClaim: entryClaim ?? (runtimeRequested ? 'runtime' : 'static'),
+    noExec: runtimeRequested ? noExecRequested : true,
+  }
+}
+
+function normalizeVersion(value, label) {
+  const normalized = String(value ?? '').trim().replace(/^v/, '')
+  if (normalized === '' || parseVersion(normalized) === null) {
+    throw new Error(`${label} must be an exact semver version`)
+  }
+  return normalized
+}
+
+function realpathOrNull(value) {
+  try { return fs.realpathSync(value) } catch { return null }
+}
+
+/**
+ * Turn a `dsh` PATH entry into the JS file that `node` can run. npm installs a
+ * shell/cmd shim, so running the shim itself with node would fail; the shim's
+ * text points at `node_modules/@deepseek-ai/dsh/lib/bin.js`.
+ */
+function nodeEntryOf(candidate) {
+  const resolved = realpathOrNull(candidate)
+  if (!resolved) return null
+  if (/\.(?:mjs|cjs|js)$/i.test(resolved)) return resolved
+  let head = ''
+  try { head = fs.readFileSync(resolved, 'utf8').slice(0, 8192) } catch { return null }
+  if (/^#![^\n]*\bnode\b/m.test(head)) return resolved
+  const shimRelative = head.match(/node_modules[\\/]@deepseek-ai[\\/]dsh[\\/][^\s"']+\.js/)
+  if (shimRelative) {
+    const fromShim = path.join(path.dirname(resolved), shimRelative[0].replace(/\\/g, '/'))
+    if (fs.existsSync(fromShim)) return fromShim
+  }
+  const fallback = path.join(path.dirname(resolved), 'node_modules', '@deepseek-ai', 'dsh', 'lib', 'bin.js')
+  return fs.existsSync(fallback) ? fallback : null
+}
+
+function resolveDshEntry(env = process.env) {
+  const candidates = []
+  if (typeof env.DSH_BIN === 'string' && env.DSH_BIN.trim() !== '') candidates.push(env.DSH_BIN.trim())
+  try {
+    const require = createRequire(path.join(process.cwd(), 'noop.cjs'))
+    candidates.push(require.resolve('@deepseek-ai/dsh/lib/bin.js'))
+  } catch { /* not installed next to the caller */ }
+  const names = process.platform === 'win32' ? ['dsh.cmd', 'dsh.exe', 'dsh'] : ['dsh']
+  for (const dir of String(env.PATH ?? env.Path ?? '').split(path.delimiter)) {
+    if (dir.trim() === '') continue
+    for (const name of names) candidates.push(path.join(dir, name))
+  }
+  for (const candidate of candidates) {
+    const entry = nodeEntryOf(candidate)
+    if (entry) return entry
+  }
+  return null
+}
+
+/** Opt-in only: resolve `dsh` and run its JS entry as `node <entry> --version`. */
+export function probeHostVersion(env = process.env) {
+  const entry = resolveDshEntry(env)
+  if (!entry) return { version: null, source: 'none', error: 'no resolvable dsh JS entry' }
+  const run = spawnSync(process.execPath, [entry, '--version'], {
+    encoding: 'utf8',
+    timeout: HOST_PROBE_TIMEOUT_MS,
+    env: sanitizedEnv(),
+  })
+  if (run.error || run.status !== 0) {
+    return { version: null, source: 'none', error: run.error?.message ?? `dsh --version exited ${run.status}` }
+  }
+  const match = /(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)/.exec(`${run.stdout ?? ''}\n${run.stderr ?? ''}`)
+  if (!match) return { version: null, source: 'none', error: 'no semver in the probed dsh output' }
+  return { version: match[1], source: 'probe', entry, error: null }
+}
+
+/**
+ * Priority: explicit flag, environment, opt-in probe, then unknown. An invalid
+ * environment value is reported as unknown rather than failing the whole run.
+ */
+export function resolveHostVersion({ hostVersion = null, allowHostProbe = false, env = process.env } = {}) {
+  if (hostVersion !== null && hostVersion !== undefined) {
+    return { version: normalizeVersion(hostVersion, '--host-version'), source: 'flag', error: null }
+  }
+  const fromEnv = typeof env.DSH_HOST_VERSION === 'string' ? env.DSH_HOST_VERSION.trim() : ''
+  if (fromEnv !== '') {
+    try {
+      return { version: normalizeVersion(fromEnv, 'DSH_HOST_VERSION'), source: 'env', error: null }
+    } catch {
+      return { version: null, source: 'none', error: 'DSH_HOST_VERSION is not an exact semver; ignored' }
+    }
+  }
+  if (allowHostProbe) return probeHostVersion(env)
+  return { version: null, source: 'none', error: 'host version unknown' }
+}
+
 export function parseCheckArgs(argv = []) {
-  const options = { dir: null, json: false, html: null, help: false, passthrough: [] }
+  const options = {
+    dir: null, json: false, html: null, help: false, hostVersion: null, allowHostProbe: false, passthrough: [],
+  }
   for (let index = 0; index < argv.length; index += 1) {
     const arg = argv[index]
     if (arg === '--help' || arg === '-h') { options.help = true; continue }
     if (arg === '--json') { options.json = true; continue }
+    if (arg === '--allow-host-probe' || arg.startsWith('--allow-host-probe=')) {
+      const inline = arg.startsWith('--allow-host-probe=') ? arg.slice('--allow-host-probe='.length) : undefined
+      options.allowHostProbe = inline === undefined ? true : inline !== 'false'
+      continue
+    }
+    if (arg === '--host-version' || arg.startsWith('--host-version=')) {
+      const inline = arg.startsWith('--host-version=') ? arg.slice('--host-version='.length) : undefined
+      if (inline !== undefined) {
+        if (inline.trim() === '') throw new Error('--host-version needs a value')
+        options.hostVersion = inline
+      } else {
+        const next = argv[index + 1]
+        if (next === undefined || next.startsWith('--')) throw new Error('--host-version needs a value')
+        options.hostVersion = next
+        index += 1
+      }
+      continue
+    }
     if (arg === '--html' || arg.startsWith('--html=')) {
       const inline = arg.startsWith('--html=') ? arg.slice('--html='.length) : undefined
       if (inline !== undefined) {
@@ -87,12 +264,20 @@ export function parseCheckArgs(argv = []) {
   if (options.json && options.html) throw new Error('--json and --html are mutually exclusive')
   if (options.dir === null) options.dir = '.'
   options.dir = path.resolve(options.dir)
+  if (options.hostVersion !== null) options.hostVersion = normalizeVersion(options.hostVersion, '--host-version')
   return options
 }
 
-function invokeChecker(options) {
-  const args = [CHECKER, options.dir, '--format', 'json', ...options.passthrough]
-  const run = spawnSync(process.execPath, args, { encoding: 'utf8', timeout: 600_000, maxBuffer: MAX_BUFFER })
+function invokeChecker(options, forwarded) {
+  const args = [CHECKER, options.dir, '--format', 'json', ...forwarded]
+  const run = spawnSync(process.execPath, args, {
+    encoding: 'utf8',
+    timeout: 600_000,
+    maxBuffer: MAX_BUFFER,
+    // Never let the checker fall back to the PATH `dsh`: the anchor is resolved
+    // here, under --host-version / DSH_HOST_VERSION / --allow-host-probe.
+    env: sanitizedEnv({ DSH_BIN: NO_PROBE_BIN }),
+  })
   if (run.error) throw new Error(`could not run the checker: ${run.error.message}`)
   let report
   try {
@@ -103,6 +288,79 @@ function invokeChecker(options) {
   return { report, status: run.status }
 }
 
+function applyHostAnchor(report, options, hostInfo) {
+  const anchor = report.anchor ?? {}
+  const runtimeVersionExplicit = hasFlag(options.passthrough, '--runtime-version')
+  if (hostInfo.version) {
+    if (!runtimeVersionExplicit) {
+      anchor.dsh = hostInfo.version
+      anchor.runtimeSource = 'host'
+      anchor.suspect = false
+    } else {
+      anchor.suspect = anchor.dsh !== hostInfo.version
+    }
+    anchor.hostVersion = hostInfo.version
+    anchor.hostVersionKnown = true
+    anchor.hostVersionSource = hostInfo.source
+  } else {
+    if (!runtimeVersionExplicit) {
+      anchor.runtimeSource = 'default'
+      anchor.suspect = true
+    }
+    anchor.hostVersion = null
+    anchor.hostVersionKnown = false
+    anchor.hostVersionSource = 'none'
+  }
+  report.anchor = anchor
+  return runtimeVersionExplicit
+}
+
+function applySafety(report, options, safety, hostInfo, runtimeVersionExplicit) {
+  applyHostAnchor(report, options, hostInfo)
+  const runtimeRan = (report.checks ?? []).some(check => RUNTIME_IDS.has(check.id)
+    && ['PASS', 'WARN', 'FAIL'].includes(check.result)
+    && check.coverage !== 'not-run')
+  const hostSmoke = hasFlag(options.passthrough, '--host') && !hasFlag(options.passthrough, '--no-exec')
+  const executed = !safety.noExec && (runtimeRan || hostSmoke)
+  report.safety = {
+    executed,
+    defaultSafety: safety.defaulted,
+    entryClaim: safety.entryClaim,
+    noExec: !executed,
+    hostVersionKnown: Boolean(hostInfo.version),
+    hostVersionSource: hostInfo.source,
+    hostProbeAllowed: options.allowHostProbe,
+    runtimeVersionExplicit,
+  }
+  if (hostInfo.error) report.safety.hostVersionError = hostInfo.error
+  return report
+}
+
+function safetyBanner(report) {
+  const safety = report.safety ?? {}
+  const anchor = report.anchor ?? {}
+  const lines = []
+  if (safety.executed) {
+    lines.push('> ⚠️ 本次已执行插件代码（显式开启运行时；L1–L3 在隔离子进程中运行，超时硬杀）。')
+  } else if (safety.defaultSafety) {
+    lines.push('> ⚠️ 本次未执行插件代码（默认安全模式：`--entry-claim static --no-exec`；运行时检查记为 not-run，不是 PASS）。')
+  } else {
+    lines.push('> ⚠️ 本次未执行插件代码（运行时检查没有产生完整装载证据；not-run 不是 PASS）。')
+  }
+  if (!safety.hostVersionKnown) {
+    lines.push(`> host 版本未知：anchor.dsh=\`${anchor.dsh ?? '?'}\` 是默认值（source=${anchor.runtimeSource ?? 'default'}, suspect=${anchor.suspect ?? true}）。用 \`--host-version\`、\`DSH_HOST_VERSION\` 或 \`--allow-host-probe\` 指定宿主版本。`)
+  } else {
+    lines.push(`> host 版本 \`${anchor.dsh}\`（来源：${anchor.hostVersionSource ?? 'host'}）；anchor.source=${anchor.runtimeSource ?? 'host'}。`)
+  }
+  return lines.join('\n')
+}
+
+function insertBanner(markdown, banner) {
+  const newline = markdown.indexOf('\n')
+  if (newline < 0) return `${markdown}\n\n${banner}\n`
+  return `${markdown.slice(0, newline + 1)}\n${banner}\n${markdown.slice(newline + 1)}`
+}
+
 export function runCheck(argv = process.argv.slice(2)) {
   let options
   try {
@@ -117,13 +375,22 @@ export function runCheck(argv = process.argv.slice(2)) {
     return 0
   }
   let result
+  let hostInfo
+  let safety
   try {
-    result = invokeChecker(options)
+    safety = safetyDefaultsFor(options.passthrough)
+    hostInfo = resolveHostVersion({ hostVersion: options.hostVersion, allowHostProbe: options.allowHostProbe })
+    const forwarded = [...safety.args, ...options.passthrough]
+    if (hostInfo.version && !hasFlag(options.passthrough, '--runtime-version')) {
+      forwarded.push('--runtime-version', hostInfo.version)
+    }
+    result = invokeChecker(options, forwarded)
   } catch (error) {
     process.stderr.write(`dsh-standards check: ${error.message}\n`)
     return 3
   }
   const { report, status } = result
+  applySafety(report, options, safety, hostInfo, hasFlag(options.passthrough, '--runtime-version'))
   const exitCode = Number.isInteger(report?.conclusion?.exitCode) ? report.conclusion.exitCode : (status ?? 3)
   if (options.html) {
     const out = path.resolve(options.html)
@@ -133,7 +400,7 @@ export function runCheck(argv = process.argv.slice(2)) {
   } else if (options.json) {
     process.stdout.write(`${JSON.stringify(report, null, 2)}\n`)
   } else {
-    process.stdout.write(renderMarkdown(report))
+    process.stdout.write(insertBanner(renderMarkdown(report), safetyBanner(report)))
   }
   return exitCode
 }