dsh-vet 0.1.0 → 0.2.0

package/README.md

@@ -4,9 +4,10 @@ Security vetting for DeepSeek Harness (DSH) plugins: permission & supply-chain
 audits before install, graded via the open [`dsh-vet/v1`](docs/dsh-vet-v1.md)
 report standard.
 
-> **Status: v0.1 complete.** Contract draft, reference scanner + CLI, rule
-> set with public rationales, and an 11-package calibration sweep are in;
-> the `0.1.0` npm release is the remaining step.
+> **Status: v0.1 shipped.** [`dsh-vet@0.1.0` is live on npm](https://www.npmjs.com/package/dsh-vet) —
+> reference scanner, 15 calibrated rules, public rule rationales, and an
+> 11-package ecosystem sweep record. v0.2 (author-side CI + badges) is next
+> on the [roadmap](ROADMAP.md).
 
 ## Install
 
@@ -50,6 +51,25 @@ from the exact tarball that ships (`npm pack` → scan), seams declared in
 package.json. It is not an A-by-cheating report — every signal the scanner
 finds in itself is in there.
 
+## CI & badge for plugin authors
+
+Audit your plugin on every push and PR, and publish your grade from the
+report committed to your repository — shields.io reads the badge straight
+from your repo, so its value is auditable through git history and no badge
+service is involved:
+
+```yaml
+- uses: rogerdigital/dsh-vet/action@v0.2.0
+  with:
+    specifier: '.'
+    commit-report: true
+```
+
+Every run uploads the full report as an artifact; PRs get a single
+edited-in-place findings comment. Badge snippet and all inputs:
+[`action/README.md`](action/README.md). The `dsh-vet badge <report.json>`
+command renders the shields endpoint JSON if you wire CI yourself.
+
 ## Why
 
 DSH's everything-is-a-plugin architecture is its greatest strength and its

package/lib/index.d.mts

@@ -271,7 +271,7 @@ declare function runRules(analysis: Analysis, only?: string[]): VetFinding[];
 //#endregion
 //#region src/scanner.d.ts
 /** Kept in lockstep with package.json; a test asserts they match. */
-declare const SCANNER_VERSION = "0.1.0";
+declare const SCANNER_VERSION = "0.2.0";
 interface ScanOptions extends ResolveOptions {
   /** Injectable clock for deterministic tests/reports. */
   now?: () => string;
@@ -281,6 +281,16 @@ interface ScanOptions extends ResolveOptions {
 declare function scanDirectory(dir: string, options?: ScanOptions): Promise<VetReport>;
 declare function scan(specifier: string, options?: ScanOptions): Promise<VetReport>;
 //#endregion
+//#region src/badge.d.ts
+interface ShieldsEndpointBadge {
+  schemaVersion: 1;
+  label: string;
+  message: string;
+  color: string;
+  isError?: boolean;
+}
+declare function renderBadge(report: VetReport): ShieldsEndpointBadge;
+//#endregion
 //#region src/cli.d.ts
 /**
  * CLI (ROADMAP T4). Exit semantics per the dsh-vet/v1 spec: `0` for any
@@ -294,4 +304,4 @@ interface CliIo {
 /** Parse and run; returns the process exit code. */
 declare function runCli(argv: string[], io: CliIo): Promise<number>;
 //#endregion
-export { type Analysis, type Capability, type CapabilityUse, type CharcodeCall, type CliIo, type CreateReportInput, type DynamicImportUse, type EncodedLiteral, type EvalUse, type FindingInit, type ImportRef, type NetUse, type PkgJson, RULES, RULE_ID_PATTERN, type ResolveOptions, type ResolvedTarget, type Rule, type RuleContext, SCANNER_VERSION, SCHEMA_ID, type ScanOptions, type SourceFile, type SpecifierKind, type VetConfidence, VetError, type VetEvidence, type VetFinding, type VetGrade, type VetReport, type VetScanner, type VetSeverity, type VetSummary, type VetSummaryCounts, type VetTarget, type VetTargetKind, analyze, classifySpecifier, countFindings, createReport, gradeFor, isGraded, parseNpmSpecifier, reachableFrom, resolveTarget, ruleIds, runCli, runRules, scan, scanDirectory };
+export { type Analysis, type Capability, type CapabilityUse, type CharcodeCall, type CliIo, type CreateReportInput, type DynamicImportUse, type EncodedLiteral, type EvalUse, type FindingInit, type ImportRef, type NetUse, type PkgJson, RULES, RULE_ID_PATTERN, type ResolveOptions, type ResolvedTarget, type Rule, type RuleContext, SCANNER_VERSION, SCHEMA_ID, type ScanOptions, type ShieldsEndpointBadge, type SourceFile, type SpecifierKind, type VetConfidence, VetError, type VetEvidence, type VetFinding, type VetGrade, type VetReport, type VetScanner, type VetSeverity, type VetSummary, type VetSummaryCounts, type VetTarget, type VetTargetKind, analyze, classifySpecifier, countFindings, createReport, gradeFor, isGraded, parseNpmSpecifier, reachableFrom, renderBadge, resolveTarget, ruleIds, runCli, runRules, scan, scanDirectory };

package/lib/index.mjs

@@ -1601,7 +1601,7 @@ function runRules(analysis, only) {
 * over the same artifact with the same version are identical.
 */
 /** Kept in lockstep with package.json; a test asserts they match. */
-const SCANNER_VERSION = "0.1.0";
+const SCANNER_VERSION = "0.2.0";
 async function scanDirectory(dir, options = {}) {
 	const analysis = analyze(dir);
 	return createReport({
@@ -1635,6 +1635,26 @@ async function scan(specifier, options = {}) {
 	}
 }
 //#endregion
+//#region src/badge.ts
+const GRADE_COLOR = {
+	A: "brightgreen",
+	B: "green",
+	C: "yellow",
+	D: "orange",
+	F: "red",
+	X: "lightgrey"
+};
+function renderBadge(report) {
+	const grade = report.summary.grade;
+	return {
+		schemaVersion: 1,
+		label: "dsh-vet",
+		message: grade === "X" ? "scan failed" : `grade ${grade}`,
+		color: GRADE_COLOR[grade],
+		...grade === "X" ? { isError: true } : {}
+	};
+}
+//#endregion
 //#region src/cli.ts
 /**
 * CLI (ROADMAP T4). Exit semantics per the dsh-vet/v1 spec: `0` for any
@@ -1642,6 +1662,7 @@ async function scan(specifier, options = {}) {
 * `--strict`/`--fail-on` turn threshold breaches into exit code 1.
 */
 const USAGE = `usage: dsh-vet <specifier> [options]
+       dsh-vet badge <report.json>
 
   specifier            npm package (name[@version]), git URL, or local path
 
@@ -1650,7 +1671,11 @@ const USAGE = `usage: dsh-vet <specifier> [options]
   --fail-on <sev>      override the --strict threshold (critical|high|medium|low)
   --rules <ids>        comma-separated rule ids to run
   --version            print version
-  --help               this text`;
+  --help               this text
+
+  badge                render a shields.io endpoint badge (JSON) from a
+                       dsh-vet/v1 report file; used by CI to publish a grade
+                       badge whose value is the committed report`;
 const SEVERITY_ORDER = [
 	"critical",
 	"high",
@@ -1685,6 +1710,7 @@ function humanSummary(report) {
 }
 /** Parse and run; returns the process exit code. */
 async function runCli(argv, io) {
+	if (argv[0] === "badge") return runBadge(argv.slice(1), io);
 	let args;
 	try {
 		args = parseArgs({
@@ -1737,5 +1763,25 @@ async function runCli(argv, io) {
 		return 2;
 	}
 }
+function runBadge(argv, io) {
+	const path = argv[0];
+	if (!path || argv.length > 1 || path === "--help") {
+		io.stderr(`usage: dsh-vet badge <report.json>\n\nRender a shields.io endpoint badge from a dsh-vet/v1 report.`);
+		return 2;
+	}
+	let report;
+	try {
+		report = JSON.parse(readFileSync(path, "utf8"));
+	} catch (err) {
+		io.stderr(`dsh-vet badge: cannot read report: ${err.message}`);
+		return 2;
+	}
+	if (report.schema !== "dsh-vet/v1") {
+		io.stderr(`dsh-vet badge: not a ${SCHEMA_ID} report (schema: ${String(report.schema)})`);
+		return 2;
+	}
+	io.stdout(JSON.stringify(renderBadge(report)));
+	return 0;
+}
 //#endregion
-export { RULES, RULE_ID_PATTERN, SCANNER_VERSION, SCHEMA_ID, VetError, analyze, classifySpecifier, countFindings, createReport, gradeFor, isGraded, parseNpmSpecifier, reachableFrom, resolveTarget, ruleIds, runCli, runRules, scan, scanDirectory };
+export { RULES, RULE_ID_PATTERN, SCANNER_VERSION, SCHEMA_ID, VetError, analyze, classifySpecifier, countFindings, createReport, gradeFor, isGraded, parseNpmSpecifier, reachableFrom, renderBadge, resolveTarget, ruleIds, runCli, runRules, scan, scanDirectory };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-vet",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Security vetting for DeepSeek Harness (DSH) plugins: permission & supply-chain audits before install, graded via the open dsh-vet/v1 report standard.",
   "dsh": {
     "seams": ["fs", "shell", "web"]