dsh-standards 1.6.1 → 1.6.3

package/40-checker/src/security.mjs

@@ -45,6 +45,18 @@ const READ_APIS = new Set([
   'open', 'openSync', 'createReadStream', 'readdir', 'readdirSync',
 ])
 const CHILD_PROCESS = /^(?:node:)?child_process$/
+const COMMAND_EXEC_APIS = new Set(['exec', 'execSync', 'spawn', 'spawnSync', 'execFile', 'execFileSync'])
+// A subprocess call is only a FAIL when its statically-known command is
+// unambiguously a download-and-run / obfuscated payload, never for a plain
+// `git status` or an import that is never called.
+const DANGEROUS_COMMAND = [
+  { pattern: /\b(?:curl|wget)\b[^\n|]*\|\s*(?:sudo\s+)?(?:sh|bash|zsh|dash|ksh|fish)\b/, label: 'remote script piped to a shell' },
+  { pattern: /\b(?:curl|wget)\b[^\n]{0,200}(?:&&|;|\|\|)\s*(?:sudo\s+)?(?:sh|bash|zsh|dash|ksh|fish|node)\b/, label: 'downloaded file executed by a shell' },
+  { pattern: /\bbase64\s+(?:-d|--decode|-D)\b/, label: 'base64 decode command' },
+  { pattern: /\bnode\s+(?:-e|--eval)\b/, label: 'inline node code' },
+  { pattern: /\bpowershell(?:\.exe)?\b[^\n]*(?:-enc|-encodedcommand)\b/i, label: 'powershell encoded command' },
+  { pattern: /\b(?:bash|sh|zsh|dash|ksh)\s+-[a-z]*c\b[^\n]{0,200}\b(?:curl|wget|base64|nc|eval)\b/, label: 'shell -c with a download/decode payload' },
+]
 const INSTRUCTION_PATTERN = /\b(?:ignore|disregard|forget)\b[^\n]{0,60}\b(?:previous|prior|above|earlier|system)\b|\byou are now\b|\bdo not (?:tell|reveal|mention|disclose)\b|\bsystem prompt\b|\bact as\b/i
 const SUSPICIOUS_HOST = /(?:^|\.)(?:webhook|pastebin|paste|ngrok\.io|ngrok-free\.app|requestbin|pipedream|interact\.sh|burpcollaborator|canarytokens)\./i
 const TEXT_EXTENSIONS = /\.(?:[cm]?[jt]sx?|json|md|txt|ya?ml|html|css)$/i
@@ -122,6 +134,91 @@ function collectBindings(ast) {
   return bindings
 }
 
+const BASE64_TEXT = /^[A-Za-z0-9+/]+={0,2}$/
+
+/** Decode a base64 literal only when the result is printable text. */
+function decodeBase64Literal(text) {
+  if (typeof text !== 'string' || text.length < 8 || text.length % 4 !== 0) return null
+  if (!BASE64_TEXT.test(text)) return null
+  let decoded
+  try {
+    decoded = Buffer.from(text, 'base64').toString('utf8')
+  } catch {
+    return null
+  }
+  if (decoded === '' || decoded.includes('\uFFFD')) return null
+  if (!/^[\t\n\r\x20-\x7e]*$/.test(decoded)) return null
+  return decoded
+}
+
+/**
+ * `Buffer.from(<string>, 'base64').toString()` / `atob(<string>)` when the
+ * payload is a static literal (also reachable through a local binding).
+ * Returns null for runtime-joined or non-base64 encodings.
+ */
+function base64DecodedFrom(node, bindings, depth = 0, seen = new Set()) {
+  if (!node || node.type !== 'CallExpression' || depth > 4 || seen.has(node)) return null
+  const names = chainNames(node.callee)
+  const last = names[names.length - 1]
+  if (last === 'atob') {
+    const payload = stringFromNode(node.arguments[0], bindings, depth + 1, new Set(seen).add(node))
+    return payload === null ? null : decodeBase64Literal(payload)
+  }
+  if (last !== 'from' || names[names.length - 2] !== 'Buffer') return null
+  const encodingNode = node.arguments[1]
+  const encoding = encodingNode === undefined ? 'utf8' : (encodingNode.type === 'Literal' ? encodingNode.value : null)
+  if (encoding !== 'base64' && encoding !== 'base64url') return null
+  const payload = stringFromNode(node.arguments[0], bindings, depth + 1, new Set(seen).add(node))
+  return payload === null ? null : decodeBase64Literal(payload)
+}
+
+function isBase64DecodeCall(node, bindings) {
+  if (!node || node.type !== 'CallExpression') return false
+  const names = chainNames(node.callee)
+  const last = names[names.length - 1]
+  if (last === 'from' && names[names.length - 2] === 'Buffer') {
+    const encoding = node.arguments[1]
+    if (encoding?.type !== 'Literal' || (encoding.value !== 'base64' && encoding.value !== 'base64url')) return false
+    return stringFromNode(node.arguments[0], bindings) !== null
+  }
+  if (last === 'toString' && node.callee.type === 'MemberExpression') {
+    const encoding = node.arguments[0]
+    if (encoding?.type === 'Literal' && (encoding.value === 'base64' || encoding.value === 'base64url')) return false
+    return base64DecodedFrom(node.callee.object, bindings) !== null
+  }
+  if (last === 'atob' && names[0] === 'atob') return base64DecodedFrom(node, bindings) !== null
+  return false
+}
+
+function isProcessLike(node) {
+  if (identifierName(node) === 'process') return true
+  return node?.type === 'MemberExpression'
+    && memberPropertyName(node) === 'process'
+    && ['globalThis', 'global', 'window', 'self'].includes(identifierName(node.object))
+}
+
+/**
+ * `process.env.HOME` / `process.env['DSH_HOME']` / `globalThis.process.env.HOME`.
+ * The old check compared identifierName(node.object) with 'process', but
+ * node.object is the `process.env` MemberExpression, so it never matched.
+ */
+function envPropertyOf(member) {
+  if (!member || member.type !== 'MemberExpression') return null
+  const env = member.object
+  if (env?.type !== 'MemberExpression' || memberPropertyName(env) !== 'env') return null
+  if (!isProcessLike(env.object)) return null
+  return memberPropertyName(member)
+}
+
+/** Property name with static computed keys folded: globalThis['fe' + 'tch']. */
+function foldedPropertyName(member, bindings) {
+  if (!member || member.type !== 'MemberExpression') return null
+  const direct = memberPropertyName(member)
+  if (direct !== null) return direct
+  if (!member.computed) return null
+  return stringFromNode(member.property, bindings)
+}
+
 function stringFromNode(node, bindings, depth = 0, seen = new Set()) {
   if (!node || depth > 5 || seen.has(node)) return null
   if (node.type === 'Literal' && typeof node.value === 'string') return node.value
@@ -161,12 +258,9 @@ function stringFromNode(node, bindings, depth = 0, seen = new Set()) {
     const property = memberPropertyName(node)
     const objectName = identifierName(node.object)
     if (objectName === 'process' && property === 'cwd') return '/work/package'
-    if (objectName === 'process' && node.object.type === 'MemberExpression'
-      && memberPropertyName(node.object) === 'env'
-      && ['HOME', 'USERPROFILE'].includes(property)) return '/home/dsh-user'
-    if (objectName === 'process' && node.object.type === 'MemberExpression'
-      && memberPropertyName(node.object) === 'env'
-      && ['DSH_HOME', 'XDG_CONFIG_HOME'].includes(property)) return '/home/dsh-user/.dsh'
+    const envProperty = envPropertyOf(node)
+    if (envProperty === 'HOME' || envProperty === 'USERPROFILE') return '/home/dsh-user'
+    if (envProperty === 'DSH_HOME' || envProperty === 'XDG_CONFIG_HOME') return '/home/dsh-user/.dsh'
     return null
   }
   if (node.type === 'CallExpression') {
@@ -194,7 +288,22 @@ function stringFromNode(node, bindings, depth = 0, seen = new Set()) {
     }
     if (last === 'toString') {
       const object = node.callee.type === 'MemberExpression' ? node.callee.object : null
+      const encoding = node.arguments[0]
+      const reEncoding = encoding?.type === 'Literal' && (encoding.value === 'base64' || encoding.value === 'base64url')
+      if (!reEncoding) {
+        const decoded = base64DecodedFrom(object, bindings, depth + 1, new Set(seen).add(node))
+        if (decoded !== null) return decoded
+      }
       if (object?.type === 'Literal') return String(object.value)
+      return null
+    }
+    if (last === 'atob' && names[0] === 'atob') {
+      const payload = stringFromNode(node.arguments[0], bindings, depth + 1, new Set(seen).add(node))
+      if (payload !== null) {
+        const decoded = decodeBase64Literal(payload)
+        if (decoded !== null) return decoded
+      }
+      return null
     }
     if (names[0] === 'String') return stringFromNode(node.arguments[0], bindings, depth + 1, new Set(seen).add(node))
     return null
@@ -272,6 +381,9 @@ const SCRIPT_DANGER_RULES = [
 ]
 const SCRIPT_NETWORK = /\b(?:fetch|axios\.(?:get|post)|https?\.(?:get|request))\s*\(|\bcurl\b|\bwget\b/
 const SCRIPT_EXECUTE = /\beval\b|\bnew\s+Function\b|\b(?:exec|execSync|spawn|spawnSync|execFile|execFileSync)\s*\(|\bvm\.(?:runIn\w+|compileFunction)/
+// require(<variable>) / import(<variable>): loading code that is not a static
+// literal. Only dangerous when the same script also downloads or pipes code.
+const SCRIPT_DYNAMIC_LOAD = /\brequire\s*\(\s*(?!['"`])[A-Za-z_$]|\bimport\s*\(\s*(?!['"`])[A-Za-z_$]|\b(?:require|import)\s*\(\s*['"`](?:\/|\.\.\/|https?:\/\/)/
 const SCRIPT_CHILD_DYNAMIC = [
   /\b(?:exec|execSync|spawn|spawnSync|execFile|execFileSync)\s*\(\s*`[^`]*\$\{/,
   /\b(?:exec|execSync|spawn|spawnSync|execFile|execFileSync)\s*\(\s*[A-Za-z_$][\w$]*\s*[,)]/,
@@ -282,6 +394,7 @@ function scriptDangerLabels(text) {
   const add = (label) => { if (!labels.includes(label)) labels.push(label) }
   for (const rule of SCRIPT_DANGER_RULES) if (rule.pattern.test(text)) add(rule.label)
   if (SCRIPT_NETWORK.test(text) && SCRIPT_EXECUTE.test(text)) add('downloads remote content and executes it')
+  if (SCRIPT_NETWORK.test(text) && SCRIPT_DYNAMIC_LOAD.test(text)) add('downloads remote content and dynamically loads it')
   if (/\bchild_process\b/.test(text) && SCRIPT_CHILD_DYNAMIC.some(pattern => pattern.test(text))) {
     add('child_process with a dynamic command')
   }
@@ -435,6 +548,50 @@ function functionConstructorExempt(node, ancestors) {
   return allowsEvalContext(ancestors)
 }
 
+/** exec/execSync/spawn/... called directly or through a one-level alias. */
+function commandExecApiOf(callee, bindings) {
+  if (!callee) return null
+  if (callee.type === 'Identifier') {
+    if (COMMAND_EXEC_APIS.has(callee.name)) return callee.name
+    const init = bindings.get(callee.name)
+    if (init?.type === 'MemberExpression') {
+      const property = memberPropertyName(init)
+      if (property && COMMAND_EXEC_APIS.has(property)) return property
+    }
+    return null
+  }
+  if (callee.type === 'MemberExpression') {
+    const property = memberPropertyName(callee)
+    if (property && COMMAND_EXEC_APIS.has(property)) return property
+  }
+  return null
+}
+
+/** Join the statically resolvable command/argv parts; options objects are skipped. */
+function commandTextOf(node, bindings) {
+  const parts = []
+  for (const argument of node.arguments ?? []) {
+    if (!argument || argument.type === 'ObjectExpression') continue
+    if (argument.type === 'ArrayExpression') {
+      for (const element of argument.elements) {
+        if (!element) continue
+        const value = stringFromNode(element, bindings)
+        if (value !== null) parts.push(value)
+      }
+      continue
+    }
+    const value = stringFromNode(argument, bindings)
+    if (value !== null) parts.push(value)
+  }
+  return parts.length > 0 ? parts.join(' ') : null
+}
+
+function dangerousCommandLabels(text) {
+  const labels = []
+  for (const rule of DANGEROUS_COMMAND) if (rule.pattern.test(text)) labels.push(rule.label)
+  return labels
+}
+
 export function checkDynamicExecution(manifest, sources, entry, kind = null) {
   if (kind === 'client') {
     return check({
@@ -464,10 +621,19 @@ export function checkDynamicExecution(manifest, sources, entry, kind = null) {
   const details = [...closure.notes]
   const dynamic = []
   const subprocess = []
+  const fileFacts = new Map()
   for (const relative of closure.visited) {
     const parsed = parseModule(closure.byRelative.get(relative))
     if (parsed.error) continue
+    let facts = fileFacts.get(relative)
+    if (!facts) {
+      facts = { base64Line: null, evalLike: false }
+      fileFacts.set(relative, facts)
+    }
     walkAst(parsed.ast, (node, ancestors) => {
+      if (isBase64DecodeCall(node, parsed.bindings)) {
+        if (facts.base64Line === null) facts.base64Line = lineOf(node)
+      }
       if (node.type === 'ImportDeclaration' && typeof node.source?.value === 'string' && CHILD_PROCESS.test(node.source.value)) {
         subprocess.push({ file: relative, line: lineOf(node), what: `import ${node.source.value}` })
         return
@@ -482,13 +648,26 @@ export function checkDynamicExecution(manifest, sources, entry, kind = null) {
         subprocess.push({ file: relative, line: lineOf(node), what: `import('${node.source.value}')` })
       }
       if (node.type === 'CallExpression' && node.callee.type === 'Identifier' && node.callee.name === 'eval') {
+        facts.evalLike = true
         dynamic.push({ file: relative, line: lineOf(node), what: 'eval()', item: 'C-16.1' })
         return
       }
       if (isFunctionConstructor(node)) {
+        facts.evalLike = true
         if (!functionConstructorExempt(node, ancestors)) dynamic.push({ file: relative, line: lineOf(node), what: 'new Function()', item: 'C-16.1' })
         return
       }
+      if (node.type === 'CallExpression') {
+        const execApi = commandExecApiOf(node.callee, parsed.bindings)
+        if (execApi) {
+          const command = commandTextOf(node, parsed.bindings)
+          const labels = command === null ? [] : dangerousCommandLabels(command)
+          if (labels.length > 0) {
+            dynamic.push({ file: relative, line: lineOf(node), what: `child_process.${execApi} executes a dangerous command (${labels.join('; ')})`, item: 'C-16.1' })
+            return
+          }
+        }
+      }
       if (node.type === 'CallExpression' || node.type === 'NewExpression') {
         const names = chainNames(node.callee)
         const joined = names.join('.')
@@ -505,11 +684,21 @@ export function checkDynamicExecution(manifest, sources, entry, kind = null) {
       }
     })
   }
+  const obfuscated = []
+  for (const [file, facts] of fileFacts) {
+    if (facts.base64Line !== null && facts.evalLike) {
+      obfuscated.push({ file, line: facts.base64Line, what: 'base64-decoded payload in the same file as eval/new Function' })
+    }
+  }
   const dynamicEvidence = dynamic.slice(0, 5).map(item => `${item.file}:${item.line}`)
+  const obfuscatedEvidence = obfuscated.slice(0, 5).map(item => `${item.file}:${item.line}`)
   const subprocessEvidence = subprocess.slice(0, 5).map(item => `${item.file}:${item.line}`)
   for (const item of dynamic.slice(0, 8)) {
     details.push(detail(item.item, 'FAIL', `dynamic execution (code:dynamic): ${item.what} at ${item.file}:${item.line}`, [`${item.file}:${item.line}`]))
   }
+  for (const item of obfuscated.slice(0, 4)) {
+    details.push(detail('C-16.1', 'FAIL', `dynamic execution (code:obfuscated): ${item.what} at ${item.file}:${item.line}`, [`${item.file}:${item.line}`]))
+  }
   for (const item of subprocess.slice(0, 8)) {
     details.push(detail('C-16.3', 'WARN', `subprocess capability observed: ${item.what} at ${item.file}:${item.line}`, [`${item.file}:${item.line}`]))
   }
@@ -522,9 +711,10 @@ export function checkDynamicExecution(manifest, sources, entry, kind = null) {
   const coverage = closure.parseErrors.length > 0 || closure.packageImports.length > 0 || closure.unresolved.length > 0 ? 'partial' : 'full'
   let result
   let reason = ''
-  if (dynamic.length > 0) {
+  if (dynamic.length > 0 || obfuscated.length > 0) {
     result = 'FAIL'
     reason = `${dynamic.length} dynamic-execution site(s) in the server entry closure (code:dynamic)`
+    if (obfuscated.length > 0) reason += `; ${obfuscated.length} base64-obfuscated execution clue(s)`
     if (closure.parseErrors.length > 0) reason += `; ${closure.parseErrors.length} file(s) could not be parsed`
   } else if (closure.parseErrors.length > 0) {
     result = 'ERROR'
@@ -544,7 +734,7 @@ export function checkDynamicExecution(manifest, sources, entry, kind = null) {
     coverage: result === 'ERROR' ? 'not-run' : coverage,
     reason,
     details,
-    evidence: dynamicEvidence.length > 0 ? dynamicEvidence : subprocessEvidence.length > 0 ? subprocessEvidence : [...closure.visited].slice(0, 3),
+    evidence: dynamicEvidence.length > 0 ? dynamicEvidence : obfuscatedEvidence.length > 0 ? obfuscatedEvidence : subprocessEvidence.length > 0 ? subprocessEvidence : [...closure.visited].slice(0, 3),
   })
 }
 
@@ -700,12 +890,36 @@ function securityScopeOf(ancestors, root) {
   return root
 }
 
-function isEgressCall(node) {
-  if (!node || node.type !== 'CallExpression') return false
-  const names = chainNames(node.callee)
-  const last = names[names.length - 1]
-  if (last === 'fetch') return true
-  return names.length >= 2 && ['http', 'https'].includes(names[0]) && ['get', 'request'].includes(last)
+function resolveMemberCallee(callee, bindings, depth = 0, seen = new Set()) {
+  if (!callee || depth > 3 || seen.has(callee)) return null
+  if (callee.type === 'MemberExpression') return callee
+  if (callee.type !== 'Identifier') return null
+  const init = bindings.get(callee.name)
+  if (!init) return null
+  if (init.type === 'MemberExpression') return init
+  if (init.type === 'Identifier') return resolveMemberCallee(init, bindings, depth + 1, new Set(seen).add(callee))
+  return null
+}
+
+/**
+ * fetch / http(s).get called directly, through a one-level alias, or through a
+ * statically folded computed property such as globalThis['fe' + 'tch'].
+ */
+function egressKindOf(node, bindings) {
+  if (!node || node.type !== 'CallExpression') return null
+  const callee = node.callee
+  if (callee.type === 'Identifier' && callee.name === 'fetch') return 'fetch'
+  const member = resolveMemberCallee(callee, bindings)
+  if (!member) return null
+  const name = foldedPropertyName(member, bindings)
+  if (name === 'fetch') return 'fetch'
+  const objectName = identifierName(member.object)
+  if ((objectName === 'http' || objectName === 'https') && (name === 'get' || name === 'request')) return name
+  return null
+}
+
+function isEgressCall(node, bindings) {
+  return egressKindOf(node, bindings) !== null
 }
 
 function isEnvEnumeration(node) {
@@ -718,14 +932,37 @@ function isEnvEnumeration(node) {
     && memberPropertyName(node.arguments[0]) === 'env'
 }
 
-function hasEgressCall(ast) {
+function hasEgressCall(ast, bindings) {
   let found = false
   walkAst(ast, (node) => {
-    if (!found && isEgressCall(node)) found = true
+    if (!found && isEgressCall(node, bindings)) found = true
   })
   return found
 }
 
+/**
+ * Direct read API or a one-level alias: `const read = fs.readFileSync;
+ * read(path)`. Only a direct identifier declaration is resolved; destructuring
+ * aliases such as `{ readFileSync: read }` remain out of scope.
+ */
+function readApiOf(callee, bindings) {
+  if (!callee) return null
+  if (callee.type === 'Identifier') {
+    if (READ_APIS.has(callee.name)) return callee.name
+    const init = bindings.get(callee.name)
+    if (init?.type === 'MemberExpression') {
+      const property = memberPropertyName(init)
+      if (property && READ_APIS.has(property)) return property
+    }
+    return null
+  }
+  if (callee.type === 'MemberExpression') {
+    const property = memberPropertyName(callee)
+    return property && READ_APIS.has(property) ? property : null
+  }
+  return null
+}
+
 export function checkSensitiveFileReads(manifest, sources) {
   if (!sources || sources.length === 0) {
     return check({
@@ -751,7 +988,7 @@ export function checkSensitiveFileReads(manifest, sources) {
         facts = { secretLiteral: null, egress: false, reads: [] }
         scopeFacts.set(scope, facts)
       }
-      if (isEgressCall(node)) facts.egress = true
+      if (isEgressCall(node, parsed.bindings)) facts.egress = true
       const literal = literalPathText(node)
       if (literal !== null) {
         const strength = isPathLikeSecretLiteral(node, literal)
@@ -759,8 +996,8 @@ export function checkSensitiveFileReads(manifest, sources) {
       }
       if (isEnvEnumeration(node)) envEnumeration = true
       if (node.type !== 'CallExpression' || node.arguments.length === 0) return
-      const api = node.callee.type === 'Identifier' ? node.callee.name : memberPropertyName(node.callee)
-      if (!READ_APIS.has(api)) return
+      const api = readApiOf(node.callee, parsed.bindings)
+      if (!api) return
       const argument = node.arguments[0]
       facts.reads.push({
         api,
@@ -813,7 +1050,7 @@ export function checkSensitiveFileReads(manifest, sources) {
         }
       }
     }
-    if (envEnumeration && hasEgressCall(parsed.ast)) {
+    if (envEnumeration && hasEgressCall(parsed.ast, parsed.bindings)) {
       warnings.push({ file: source.relative, line: 1, api: 'Object.keys(process.env)', item: 'C-17.2', reason: 'environment enumeration with egress' })
     }
   }
@@ -904,8 +1141,7 @@ export function checkEgressEndpoints(manifest, sources) {
       let target = null
       if (node.type === 'CallExpression') {
         const names = chainNames(node.callee)
-        const last = names[names.length - 1]
-        if (last === 'fetch' || (names.length >= 2 && ['http', 'https'].includes(names[0]) && ['get', 'request'].includes(last)) || names[0] === 'axios') {
+        if (egressKindOf(node, parsed.bindings) !== null || names[0] === 'axios') {
           target = egressEndpointFrom(node.arguments[0], parsed.bindings)
         }
       } else if (node.type === 'NewExpression' && chainNames(node.callee).join('.') === 'WebSocket') {

package/CHANGELOG.md

@@ -1,3 +1,19 @@
+## 1.6.3 — 2026-11-07
+
+- DSC-15: an install script that downloads code and then loads a literal path outside the package (`require('/tmp/...')`, URL, `../`) now FAILs; the variable form was already covered.
+
+## 1.6.2 — 2026-11-07
+
+### Fixed
+
+- 红队加固：`process.env.HOME` 拼接凭据路径、`exec/spawn` 危险命令、安装脚本「下载后动态 require」、一层 read 别名、base64+eval、拆分 fetch 均能命中；恶意变体阻断从 1/11 升到 7/11，负对照误报 0/12。
+- `ctx.credentials` 触发补入 C-11.2，声明 credentials:read 不再反报 C-11.5。
+- 文档口径：C-15 读脚本正文、C-17 readdir 可判、C-21 WARN-only、coverage 12/14、security 块 partial/读法、SECURITY 支持版本、advice 链接改 guide 0.5.0（security.md）。
+- 10 个真实包 DSC-15/17 FAIL 0/10。
+
+### Verified
+
+- `npm test` 282/282。
 ## 1.6.1 — 2026-11-07
 
 ### Fixed

package/docs/coverage.md

@@ -15,8 +15,10 @@ dsh-standards check <package-dir> \
 |---|---|---|
 | 完整口径 | **22** | `DSC-01` … `DSC-22`；`--scope security` 时 `checks[]` 带全 22 项 |
 | 默认 `checks[]` | **14** | `DSC-01` … `DSC-14`；默认 DS-C 判定只看这 14 项 |
-| 默认实际评估 | **6** | `DSC-01`、`DSC-02`、`DSC-10`、`DSC-11`、`DSC-12`、`DSC-13` |
-| 默认未检查 | **8** | `DSC-03`（NA）+ `DSC-04`–`DSC-09`（not-run）+ `DSC-14`（NA） |
+| 默认 ds-c 实际评估（bundle） | **12 / 14** | bundle 的 `DSC-04`–`09` 以静态子集 `PASS`+`partial` 计入；`DSC-03`/`DSC-14` 为 NA |
+| 默认 ds-c 实际评估（plugin，无 `--runtime`） | **6 / 14** | `DSC-04`–`09` 为 not-run；`DSC-03`/`DSC-14` 为 NA |
+| 默认未检查（plugin 静态） | **8** | 2 NA + 6 not-run；不等于通过 |
+| `--scope security` `checks[]` | **22** | 加 `DSC-15`–`DSC-22`；`coverage.mandatory=4`（15/16/17/21），仍可能 not-run |
 | 默认 security 块 | **8** | `DSC-15`–`DSC-22` 在 `security` 块里跑 advisory；FAIL 封顶 WARN，不改变 DS-C 结论 |
 
 `not checked` 桶把 NA / not-run / ERROR 都列出来；**没检查不等于通过**。`DSC-10` 是 advisory，只提供信号，不改变结论。
@@ -45,7 +47,7 @@ dsh-standards check <package-dir> \
 | `DSC-18` | L0 | **advisory（security 块）** | 端点线索，永不 FAIL | `--scope security`；外联端点 |
 | `DSC-19` | L0 | **advisory（security 块）** | 只登记不判恶 | `--scope security`；混淆/二进制 |
 | `DSC-20` | L0 | **advisory（security 块）** | 语义不可判、误报高 | `--scope security`；提示词注入 |
-| `DSC-21` | L0 | **advisory WARN（security 块）** | 名字线索；默认 scope 不 FAIL | `--scope security`；供应链，强制项但只 WARN |
+| `DSC-21` | L0 | **WARN（security 块）** | 名字线索；默认 scope 不 FAIL | `--scope security`；供应链，强制项但只 WARN、不阻断 |
 | `DSC-22` | L0 | **advisory（security 块）** | 只有字段自证 | `--scope security`；来源/完整性，v1 只读字段 |
 
 ## security scope（C-15～C-22）
@@ -55,17 +57,21 @@ dsh-standards check <package-dir> \
 | 项 | security scope 判定 | 触发 |
 |---|---|---|
 | `DSC-15` 生命周期脚本 | **blocking**（可 FAIL） | 安装期 `curl\|sh`、`base64 -d`、`node -e`、`sh -c`、`powershell -enc`、引用缺失脚本、写 `$HOME`/`/etc` |
-| `DSC-16` 动态执行 | **blocking**（可 FAIL） | `eval`/`new Function(非空)`/`vm`/`module._compile`/`process.binding` → FAIL；裸 `child_process` → WARN |
+| `DSC-16` 动态执行 | **blocking**（可 FAIL） | `eval`/`new Function(非空)`/`vm`/`module._compile`/`process.binding` → FAIL；裸 `child_process` → WARN；静态危险子进程命令 1.6.2 起 FAIL |
 | `DSC-17` 敏感文件 | **blocking**（可 FAIL） | 直接读 `~/.ssh`、`$DSH_HOME` credentials、`id_rsa`、`.aws`、`.npmrc`、`.netrc` 等；`.env` 只 WARN |
 | `DSC-18` 外联端点 | **advisory**（永不 FAIL） | 非 https、userinfo、公网裸 IP、webhook/paste/ngrok/onion、未披露端点 |
 | `DSC-19` 混淆/二进制 | **advisory** | 二进制 sha256、超长单行、大块 base64、高熵；只登记不判恶 |
 | `DSC-20` 提示词注入 | **advisory** | 外部文本进 systemPrompt、指令样字面量、无 untrusted 包裹；语义不可判 |
-| `DSC-21` 供应链 | **blocking（强制项）/ WARN（发现封顶）** | scope 同形字/近似 scope、近似名、元数据缺失；**永不 FAIL**，但未跑会使 security `incomplete` |
+| `DSC-21` 供应链 | **WARN-only（强制项，不阻断）** | scope 同形字/近似 scope、近似名、元数据缺失；**永不 FAIL**，listing/package 均只 WARN；未跑会使 security `incomplete` |
 | `DSC-22` 来源/完整性 | **advisory**（永不 FAIL） | 只读 `dist.integrity` / `dsh.attestation` / `dsh.signature` 字段是否存在；不验签、不比对 digest；无输入即 `not-run` |
 
 **默认不改变判定**：不传 `--scope security` 时，这 8 项不进 `checks[]`，只在 `security` 块里以 `scope=advisory` 运行；任何 FAIL 封顶 WARN，`DS-C` 的 11/12 条强制集合与 exit code 不变。security 的 FAIL 不能撤销 `DS-C` PASS，`DS-C` PASS 也不能证明 security 通过。
 
-**边界**：C-15/C-16/C-17 可以 FAIL；C-21 是强制项但发现只到 WARN；C-18/C-19/C-20/C-22 是 advisory；其余安全面（实际网络流量、审批绕过、同进程逃逸、client DOM、`!!js` 配置、Remote 调用方身份）**没有机械判据**。任何 PASS 都只是"本次覆盖内未见该类线索"，不是"安全/已审计"。
+**报告读法（headline vs buckets）**：`conclusion.headline` 的 `blocking N` 与 `buckets.blocking[]` 只数 `checks[]` 里的 FAIL。默认 scope 下 security FAIL 封顶 WARN，只在 `security` 块（`security.warn[]`，`security.blocking=[]`），**不进 `buckets.blocking`**；`--scope security` 下 `DSC-15/16/17` FAIL 才进 `buckets.blocking`、抬高 headline 并 exit 1。`DSC-21` 永不 FAIL，两个 profile 都不阻断。
+
+**partial 怎么读**：`checks[].coverage=partial` 仍计入 `coverage.checked`（若结果 PASS/WARN/FAIL），并单列到 `coverage.partial` / `buckets.partial`；它**不并入** `coverage.notRun`（后者只数完整 `not-run` + `ERROR` + 缺失强制项）。`security` 块没有独立 `partial[]`：看 `security.checks[].coverage`；`security.notRun[]` 不收 partial。
+
+**边界**：C-15/C-16/C-17 可以 FAIL；C-21 是强制项但 **WARN-only、不阻断（listing 同）**；C-18/C-19/C-20/C-22 是 advisory；其余安全面（实际网络流量、审批绕过、同进程逃逸、client DOM、`!!js` 配置、Remote 调用方身份）**没有机械判据**。任何 PASS 都只是"本次覆盖内未见该类线索"，不是"安全/已审计"。
 
 ## 执行 opt-in
 
@@ -95,10 +101,14 @@ dsh-standards check <package-dir> \
 - **WSL2（Ubuntu 24.04）：** Linux 沙箱可用，能提供 `unshare` / `prlimit`；这是本仓做 runtime 采集的环境。WSL2 可用不等于某个 host × Node × checker 组合已经跑过，具体以 [SUPPORTED.md](../SUPPORTED.md) 的格子为准。
 - **Node：** 包声明 `engines.node >=24.9.0`；Node 22 只在自测 / 静态矩阵中有记录（见 SUPPORTED.md）。
 
+## advice 的 docsUrl
+
+报告 `advice[].docsUrl` 的基址是 checker 的 `DOCS_BASE`：1.6.1 为 `dsh-plugin-guide` `v0.4.6`，计划在 **1.6.2 升到 `v0.5.0`**。guide 0.5.0 的 `docs/security.md` 中 C-15～C-22 advice 使用的锚点（`#2-credentials-and-sensitive-files-dsc-17`、`#3-egress-endpoints-dsc-18`、`#4-files-subprocesses-and-dynamic-execution-dsc-15-dsc-16-dsc-17-dsc-19`、`#5-tool-output-and-prompt-injection-dsc-20`、`#6-dependencies-build-and-publish-dsc-15-dsc-21-dsc-22`）以及显式锚点 `#author-files`、`#author-credentials`、`#author-egress`、`#author-prompt`、`#author-publish`、`#scope` 已核对存在。
+
 ## 复核命令
 
 ```sh
-# 默认：6/14 评估，8 项 not-run/NA；security 块是 advisory
+# 默认静态：plugin 6/14（04–09 not-run），bundle 12/14（04–09 PASS+partial）；security 块是 advisory
 dsh-standards check <package-dir> --json | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{const r=JSON.parse(s);console.log(r.coverage.checked+"/"+r.coverage.total);console.log(r.anchor);console.log(r.security)})'
 
 # 默认 + security scope：checks[] 变 22 项（不执行插件）

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-standards",
-  "version": "1.6.1",
+  "version": "1.6.3",
   "description": "DSH plugin standards and conformance checks: ENTRY/FLOW checks plus BOOST guidance. Non-official; no certification or ranking.",
   "type": "module",
   "main": "40-checker/src/index.mjs",

package/spec/coverage-contract.md

@@ -1,6 +1,6 @@
 # coverage 契约（`dsh-conformance/1`）
 
-> 适用版本：dsh-standards **1.6.0**（计划版本；1.5.0 及更早为 14 项）。`40-checker/src/report.mjs` 的 `buildReport()` 负责计数；`security` 块见 §6。
+> 适用版本：dsh-standards **1.6.0+**（当前 1.6.1；1.5.0 及更早为 14 项）。`40-checker/src/report.mjs` 的 `buildReport()` 负责计数；`security` 块见 §6。
 > 机器可校验形状见 [`schemas/conformance.schema.json`](schemas/conformance.schema.json)；本文只统一字段含义。
 > 结论：`coverage` 是**加性计数**，不参与 verdict；`PASS/WARN/FAIL` 与 `status/level` 由 `conclusion` 和对应 profile 的强制项决定。
 
@@ -25,14 +25,14 @@
 | `advisory` | `check.advisory === true` 且结果为 `WARN` 的数量；是 `warn` 的子集，只作信号，永不改 verdict。 |
 | `fail` | 结果 `FAIL` 的数量。 |
 | `na` | 结果 `NA` 的数量（对象形态/上下文不适用），**不是通过**。 |
-| `notRun` | `coverage` 为 `not-run`/`partial` 且结果非 `NA` 的项、结果 `ERROR` 的项、以及**缺失的强制项** ID 去重后的数量；包含 `error`。 |
+| `notRun` | `coverage` 为 `not-run` 且结果非 `NA` 的项、结果 `ERROR` 的项、以及**缺失的强制项** ID 去重后的数量；包含 `error`。**不含** `partial`。 |
 | `error` | 结果 `ERROR` 的数量（检查器失效或该跑没跑）；是 `notRun` 的子集。 |
 
 加性诊断字段（1.3.0 工作树同时输出；旧消费者应按“可选”处理，不参与 verdict）：
 
 | 字段 | 定义 |
 |---|---|
-| `coverage.partial` | `checks[].coverage === "partial"` 的数量。它同时保留在 `checked`（若结果 PASS/WARN/FAIL）和 `notRun` 中；这个计数只是把重叠显式化，**不是第 10 个通过口径**。 |
+| `coverage.partial` | `checks[].coverage === "partial"` 的数量。结果 PASS/WARN/FAIL 时仍计入 `checked`；但**不并入** `coverage.notRun`，只在 `coverage.partial` 与 `buckets.partial` 中单列。这个计数**不是第 10 个通过口径**。 |
 | 顶层 `notChecked` | `buckets.notChecked` 与 `buckets.partial` 按 `id` 去重后的可读视图，每行带 `howToEnable`。等价信息已在 `buckets` 里子集化，消费者可忽略。 |
 | `buckets.partial` | `coverage: "partial"` 的检查行；同一行可能也出现在 `blocking` / `hygiene`。 |
 | 行级 `howToEnable` | 让该 NA/ERROR/partial 行可运行的命令或 flag；仅提示。 |
@@ -42,7 +42,8 @@
 - `checked = pass + warn + fail`（`advisory <= warn`）。
 - `error <= notRun`；`notRun` 统计的是“没拿到完整结论”的项，`NA` 不算没跑。
 - 默认 `ds-c` 完整跑（14 项、无缺失）与 `--scope security` 完整跑（22 项、无缺失）都满足 `checked + na + notRun = total`；两份报告的 `total` 不同，不能混算通过率。
-- **例外**：若某项 `coverage: "partial"` 但结果仍是 `WARN`/`FAIL`，它会同时出现在 `checked` 与 `notRun` 中——已评估但不完整，不能当成 `full`。有缺失强制项时，`notRun` 会含不在 `checks[]` 里的 ID，此时上述加法可大于 `total`。
+- **例外**：`coverage: "partial"` 的项若结果仍是 `WARN`/`FAIL`，它同时出现在 `checked` 与 `coverage.partial`/`buckets.partial`；它是"已评估但不完整"，不并入 `notRun`。有缺失强制项时，`notRun` 会含不在 `checks[]` 里的 ID，此时加法可大于 `total`。
+- **注**：`schemas/conformance.schema.json` 里 `coverage.notRun` 的旧描述仍写“含 partial”，与本表不符；以 `buildReport()` 当前输出（不含 partial）为准，schema 文案待后续版本同步。
 - `metrics = { checked, total, declaredFields }`：`checked`/`total` 与 `coverage` 同源；`declaredFields` 是 capabilities/labels/commitments/disclosure/engines.dsh 五个可选声明面中实际声明的个数（0–5），只作上下文。
 
 ## 3. 与旧检查级 `full` / `partial` 的映射
@@ -53,7 +54,7 @@
 |---|---|---|
 | `full` + `PASS`/`WARN`/`FAIL` | `checked`，并落入 `pass`/`warn`/`fail` | 完整评估，计入结论。 |
 | `full` + `NA` | `na` | 显式不适用；旧报告常把 NA 记在 `full` 之外。 |
-| `partial`（无论结果） | `notRun` | 只跑了一部分，必须当未完成；若结果仍是 `WARN`/`FAIL`，同时计入 `checked`。 |
+| `partial`（无论结果） | `checked`（若结果 PASS/WARN/FAIL）+ `coverage.partial` / `buckets.partial` | 只跑了一部分：已评估但不完整；**不计入** `coverage.notRun`，不得当 `full`。 |
 | `not-run` | `notRun` | 完全没跑。 |
 | `ERROR`（旧 `error` 计数） | `notRun` + `error` | 检查器失效/未执行；两者都计。 |
 
@@ -61,7 +62,8 @@
 
 - 旧 `mandatory` → 新 `mandatory`（同义，选出的强制项数）。
 - 旧 `full` → 新 `checked` **减去** `partial` 但已评估的项，再减去 `full + NA` 的项；最稳妥的读法是“旧 full 只看覆盖，新 checked 看结果”。
-- 旧 `partial` / `notRun` → 新 `notRun`。
+- 旧 `partial` → 新 `coverage.partial` / `buckets.partial`（结果 PASS/WARN/FAIL 时同时在 `checked`；不进 `notRun`）。
+- 旧 `notRun` → 新 `notRun`。
 - 旧 `na` → 新 `na`。
 - 旧 `error` → 新 `error`（并已包含在 `notRun`）。
 - 旧对象没有 `total` / `pass` / `warn` / `advisory` / `fail` / `checked`；这些是 1.3.0 的新增计数。
@@ -108,10 +110,11 @@
 | `security.status=fail` | **仅 security scope**：`DSC-15`/`DSC-16`/`DSC-17` 任一 FAIL。`DSC-21` 永不 FAIL；默认模式 FAIL 封顶 WARN，不会出现 fail。 |
 | `security.status=warn` | 无 FAIL，但有 `DSC-21` 或 15/16/17 的 WARN，或 18/19/20/22 的 advisory WARN。 |
 | `security.status=incomplete` | **security scope 下** `DSC-15`/`DSC-16`/`DSC-17`/`DSC-21` 任一结果不在 `PASS`/`WARN`/`FAIL`（即 `NA`/`ERROR`/`not-run`）。 |
+| `security` 块的 `partial` | 1.6.1 **没有** `security.partial[]`：部分覆盖看 `security.checks[].coverage === "partial"`；`security.notRun[]` 只收 `NA`/`ERROR`/完整 `not-run`，**不收 partial**。`security.status=pass` 不要求 partial 为空，市场必须读 `checks[]`，不能只看四个数组。顶层 `coverage.partial` / `buckets.partial` 在 security scope 下统计 `checks[]` 全部 22 项（含这 8 项）。 |
 | 与 DS-C 关系 | **独立**：security FAIL 不撤销 DS-C PASS；DS-C PASS 不证明 security 通过；反之亦然。 |
 | 徽章 | **不得**发 security 徽章；市场只透传 `security.status`、`security.checks[]` 与 `security.notRun[]`，不按安全分排序/筛选。 |
 
-严重度以 `spec/dsc-clauses.json` 的 `mandatory`/`advisory` 与 31 §2 C-15～C-22 为准：`DSC-15/16/17` 为 blocking（可 FAIL）；`DSC-21` 是强制项但发现封顶 WARN（永不 FAIL，未跑才 `incomplete`）；`DSC-18/19/20/22` 为 advisory（`advisory:true`，永不改 verdict）。`security` 块只汇总这 8 项，不与顶层 `coverage` 换算成第二套通过率。
+严重度以 `spec/dsc-clauses.json` 的 `mandatory`/`advisory` 与 31 §2 C-15～C-22 为准：`DSC-15/16/17` 为 blocking（可 FAIL）；`DSC-21` 是强制项但 **WARN-only、不阻断（listing 同；永不 FAIL，未跑才 `incomplete`）**；`DSC-18/19/20/22` 为 advisory（`advisory:true`，永不改 verdict）。`security` 块只汇总这 8 项，不与顶层 `coverage` 换算成第二套通过率。
 
 ## 7. 禁止事项