shellward 0.7.8 → 0.7.9

package/dist/compliance/audit.js

@@ -141,9 +141,10 @@ function computeProjectPenalty(scan) {
     return Math.min(MAX_PROJECT_PENALTY, p);
 }
 function checkControl(c, config, env, deployed) {
-    // 静态扫描（未部署运行时）下，能力层/审计日志类控制项无法验证 —— 标为顾问态，绝不虚报"已合规"
+    // 静态扫描（未部署运行时）下，能力层/审计日志类控制项无法验证 —— 标为顾问态，绝不虚报"已合规"。
+    // 「为何待核验」统一在报告区块开头说一次；这里每行只留"该做什么"，避免 12 行重复同一句。
     if (!deployed && (c.method === 'capability' || c.method === 'config' || c.method === 'audit')) {
-        return mk(c, 'manual', `ShellWard 运行时可提供此防护；当前为静态扫描、未部署，无法验证。整改：${c.remediation_zh}`, `Provided by ShellWard runtime; not verifiable in a static scan. ${c.remediation_en}`);
+        return mk(c, 'manual', c.remediation_zh, c.remediation_en);
     }
     switch (c.method) {
         case 'capability': return checkCapability(c, config);

package/dist/compliance/html-report.js

@@ -137,7 +137,10 @@ export function renderHtmlReport(report, scan, locale, meta) {
         S.push(`<p class="note">💡 ${t('对使用 openai SDK 的项目：通常仅需把 base_url 与 api_key 换成上表任一境内模型即可，业务代码无需改动。', 'For openai-SDK projects: usually just swap base_url + api_key — no code change.')}</p>`);
     }
     // ===== 控制项明细 =====
-    S.push(sectionHead('📋', t('合规控制项明细', 'Compliance Controls'), t('按法规分组；⚪ 项为运行时/人工核验', 'By regulation; ⚪ = runtime / manual review')));
+    S.push(sectionHead('📋', t('合规控制项明细', 'Compliance Controls'), t('按法规分组', 'By regulation')));
+    if (report.staticScan && report.manual > 0) {
+        S.push(`<div class="note manual-note">${t(`<b>⚪ 待核验 ≠ 不合规。</b> 下方 ${report.manual} 项是<b>运行时合规控制</b>（审计留存、内容过滤、注入拦截、数据外发管控等）——靠"看代码"的静态扫描判断不了，需把 ShellWard 接入你的 AI 应用（<code>npx shellward mcp</code> 或插件）作为运行时防护后才能验证，或人工核验。每项后面是"该做什么"。`, `<b>⚪ Review ≠ non-compliant.</b> The ${report.manual} items below are <b>runtime controls</b> a static scan cannot verify — deploy ShellWard as a runtime guard (<code>npx shellward mcp</code> / plugin) to validate them. Each row shows the remediation.`)}</div>`);
+    }
     const grouped = groupBy(report.results);
     for (const reg of REG_ORDER) {
         const items = grouped[reg];
@@ -312,6 +315,9 @@ table.tbl td.right{width:64px}
 .mtag.mid{background:var(--warn-bg);color:var(--warn)}
 .note{margin:8px 36px 4px;font-size:12.5px;color:var(--muted);background:#f8fafc;
   border-left:3px solid var(--brand);padding:10px 14px;border-radius:0 8px 8px 0}
+.manual-note{margin:8px 36px 12px;font-size:13px;color:#475569;background:#eff6ff;
+  border-left:3px solid #3b82f6;line-height:1.6}
+.manual-note code{background:#dbeafe;padding:1px 6px;border-radius:5px}
 
 /* 法规分组 */
 .reg{margin:14px 36px;padding:0;border:1px solid var(--line);border-radius:12px;overflow:hidden}

package/dist/compliance/report.js

@@ -82,6 +82,12 @@ export function renderComplianceReport(report, locale) {
     // ===== 按法规分组明细 =====
     L.push(zh ? '## 分项明细' : '## Detailed Results');
     L.push('');
+    if (report.staticScan && report.manual > 0) {
+        L.push(zh
+            ? `> **⚪ 待核验 ≠ 不合规。** 下方 ${report.manual} 项是**运行时合规控制**（审计留存、内容过滤、注入拦截、数据外发管控等），静态扫描（看代码）判断不了，需把 ShellWard 接入你的 AI 应用（\`npx shellward mcp\` 或插件）作为运行时防护后验证，或人工核验。`
+            : `> **⚪ Review ≠ non-compliant.** The ${report.manual} items below are runtime controls a static scan cannot verify — deploy ShellWard as a runtime guard to validate.`);
+        L.push('');
+    }
     const grouped = groupByRegulation(report.results);
     for (const reg of REGULATION_ORDER) {
         const items = grouped[reg];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shellward",
-  "version": "0.7.8",
+  "version": "0.7.9",
   "mcpName": "io.github.jnMetaCode/shellward",
   "description": "AI agent security & MCP security middleware — prompt injection detection, AI firewall, runtime guardrails & data-loss prevention for LLM tool calls. 8-layer defense against data exfiltration & dangerous commands. Zero dependencies. SDK + OpenClaw plugin. Supports LangChain, AutoGPT, Claude Code, Cursor, OpenAI Agents, Hermes Agent.",
   "keywords": [

package/src/compliance/audit.ts

@@ -212,11 +212,10 @@ function computeProjectPenalty(scan: ProjectScanResult): number {
 }
 
 function checkControl(c: ComplianceControl, config: ShellWardConfig, env: EnvFacts, deployed: boolean): ControlResult {
-  // 静态扫描（未部署运行时）下，能力层/审计日志类控制项无法验证 —— 标为顾问态，绝不虚报"已合规"
+  // 静态扫描（未部署运行时）下，能力层/审计日志类控制项无法验证 —— 标为顾问态，绝不虚报"已合规"。
+  // 「为何待核验」统一在报告区块开头说一次；这里每行只留"该做什么"，避免 12 行重复同一句。
   if (!deployed && (c.method === 'capability' || c.method === 'config' || c.method === 'audit')) {
-    return mk(c, 'manual',
-      `ShellWard 运行时可提供此防护；当前为静态扫描、未部署，无法验证。整改：${c.remediation_zh}`,
-      `Provided by ShellWard runtime; not verifiable in a static scan. ${c.remediation_en}`)
+    return mk(c, 'manual', c.remediation_zh, c.remediation_en)
   }
   switch (c.method) {
     case 'capability': return checkCapability(c, config)

package/src/compliance/html-report.ts

@@ -164,7 +164,12 @@ export function renderHtmlReport(
 
   // ===== 控制项明细 =====
   S.push(sectionHead('📋', t('合规控制项明细', 'Compliance Controls'),
-    t('按法规分组；⚪ 项为运行时/人工核验', 'By regulation; ⚪ = runtime / manual review')))
+    t('按法规分组', 'By regulation')))
+  if (report.staticScan && report.manual > 0) {
+    S.push(`<div class="note manual-note">${t(
+      `<b>⚪ 待核验 ≠ 不合规。</b> 下方 ${report.manual} 项是<b>运行时合规控制</b>（审计留存、内容过滤、注入拦截、数据外发管控等）——靠"看代码"的静态扫描判断不了，需把 ShellWard 接入你的 AI 应用（<code>npx shellward mcp</code> 或插件）作为运行时防护后才能验证，或人工核验。每项后面是"该做什么"。`,
+      `<b>⚪ Review ≠ non-compliant.</b> The ${report.manual} items below are <b>runtime controls</b> a static scan cannot verify — deploy ShellWard as a runtime guard (<code>npx shellward mcp</code> / plugin) to validate them. Each row shows the remediation.`)}</div>`)
+  }
   const grouped = groupBy(report.results)
   for (const reg of REG_ORDER) {
     const items = grouped[reg]
@@ -349,6 +354,9 @@ table.tbl td.right{width:64px}
 .mtag.mid{background:var(--warn-bg);color:var(--warn)}
 .note{margin:8px 36px 4px;font-size:12.5px;color:var(--muted);background:#f8fafc;
   border-left:3px solid var(--brand);padding:10px 14px;border-radius:0 8px 8px 0}
+.manual-note{margin:8px 36px 12px;font-size:13px;color:#475569;background:#eff6ff;
+  border-left:3px solid #3b82f6;line-height:1.6}
+.manual-note code{background:#dbeafe;padding:1px 6px;border-radius:5px}
 
 /* 法规分组 */
 .reg{margin:14px 36px;padding:0;border:1px solid var(--line);border-radius:12px;overflow:hidden}

package/src/compliance/report.ts

@@ -93,6 +93,12 @@ export function renderComplianceReport(report: ComplianceReport, locale: 'zh' |
   // ===== 按法规分组明细 =====
   L.push(zh ? '## 分项明细' : '## Detailed Results')
   L.push('')
+  if (report.staticScan && report.manual > 0) {
+    L.push(zh
+      ? `> **⚪ 待核验 ≠ 不合规。** 下方 ${report.manual} 项是**运行时合规控制**（审计留存、内容过滤、注入拦截、数据外发管控等），静态扫描（看代码）判断不了，需把 ShellWard 接入你的 AI 应用（\`npx shellward mcp\` 或插件）作为运行时防护后验证，或人工核验。`
+      : `> **⚪ Review ≠ non-compliant.** The ${report.manual} items below are runtime controls a static scan cannot verify — deploy ShellWard as a runtime guard to validate.`)
+    L.push('')
+  }
 
   const grouped = groupByRegulation(report.results)
   for (const reg of REGULATION_ORDER) {