dsh-vet 0.2.1 → 0.2.2

package/docs/rules/perm.undeclared-fs-write.md

@@ -17,8 +17,19 @@ in-scope paths are not.
   for destructive operations outside any declared scope.
 - Non-destructive writes with a literal out-of-scope absolute path:
   **high / high.**
-- Writes whose target is a runtime value: **medium / low** (ROADMAP D2 —
-  runtime-dependent findings never lower a grade on their own).
+- Writes whose target is a runtime value: **low / low** — reported as
+  "scope not statically verifiable", never as an out-of-scope claim the
+  scanner cannot make, and never grade-affecting (ROADMAP D2). Normal
+  plugins write dynamic paths constantly; this tier is a review prompt,
+  not an accusation.
+
+The runtime-value tier deliberately does **not** attempt the path-derivation
+dataflow some disputes have asked for: constraint chains are usually
+interprocedural (derive-and-validate in one function, delete in another),
+beyond best-effort static analysis. The honest position is "unresolvable —
+review the derivation", which is what the finding now says. Clarified via
+[dispute #10](https://github.com/rogerdigital/dsh-vet/issues/10), whose
+guarded managed-directory removal is the canonical well-reviewed case.
 
 ## False positives
 

package/lib/index.d.mts

@@ -271,7 +271,7 @@ declare function runRules(analysis: Analysis, only?: string[]): VetFinding[];
 //#endregion
 //#region src/scanner.d.ts
 /** Kept in lockstep with package.json; a test asserts they match. */
-declare const SCANNER_VERSION = "0.2.1";
+declare const SCANNER_VERSION = "0.2.2";
 interface ScanOptions extends ResolveOptions {
   /** Injectable clock for deterministic tests/reports. */
   now?: () => string;

package/lib/index.mjs

@@ -1463,14 +1463,16 @@ const undeclaredFsWrite = {
 			}));
 		}
 		if (dynamic.length > 0) findings.push(finding(this, {
-			severity: "medium",
+			title: "Write/delete target is a runtime value — scope not statically verifiable",
+			severity: "low",
 			confidence: "low",
 			evidence: capEvidence(dynamic.map((use) => ({
 				file: use.file,
 				line: use.line,
-				snippet: use.snippet
+				snippet: use.snippet,
+				note: "review how the target is derived; the scanner cannot resolve it statically"
 			})), 5),
-			remediation: "Use fixed, reviewable paths; runtime-computed write targets cannot be audited statically.",
+			remediation: "Keep the derivation next to the call, test the invariant (fixed child of a validated root), and document the managed scope so reviewers can verify it.",
 			references: ["https://github.com/rogerdigital/dsh-vet/blob/main/docs/rules/perm.undeclared-fs-write.md"]
 		}));
 		return findings;
@@ -1601,7 +1603,7 @@ function runRules(analysis, only) {
 * over the same artifact with the same version are identical.
 */
 /** Kept in lockstep with package.json; a test asserts they match. */
-const SCANNER_VERSION = "0.2.1";
+const SCANNER_VERSION = "0.2.2";
 /**
 * A scan that audited zero JavaScript files must not read as a clean pass —
 * a TypeScript source tree scanned as a local path has no `.js` to analyze,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-vet",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Security vetting for DeepSeek Harness (DSH) plugins: permission & supply-chain audits before install, graded via the open dsh-vet/v1 report standard.",
   "dsh": {
     "seams": ["fs", "shell", "web"]