upstream-radar 0.37.0 → 0.38.0

package/README.md

@@ -63,15 +63,15 @@ baseline report, and defined in [`schemas/upstream-downstream-ir.schema.json`](s
 
 ```bash
 # No DSH profile, API key, or network state required
-npx --yes upstream-radar@0.37.0 demo
+npx --yes upstream-radar@0.38.0 demo
 
 # Scan a public DSH plugin repository without installing it
-npx --yes upstream-radar@0.37.0 scan \
+npx --yes upstream-radar@0.38.0 scan \
   https://github.com/PlutoKeating/dsh-lark-bot \
   --fail-on never
 
 # Review a real browser plugin users would install, then check two DSH releases
-npx --yes upstream-radar@0.37.0 review dsh-plugin dsh-cloudflare-browser-run@0.1.1 \
+npx --yes upstream-radar@0.38.0 review dsh-plugin dsh-cloudflare-browser-run@0.1.1 \
   --dsh-version 0.1.0-rc.6,0.1.0-rc.7
 ```
 
@@ -91,6 +91,30 @@ These are real, reproducible cases in this repository—not synthetic “vulnera
 
 We report a confirmed vulnerability only when the affected exact version and runtime path are supported by the available evidence. Development-only hits, missing data, and advisory-source outages remain visibly different states.
 
+## Monitor the findings we already found
+
+The repository now has a focused watch for seven real DSH plugins from the first
+batch. It re-runs the source scan and the exact npm artifact review, then stores
+only trusted observations in [`state.json`](examples/dsh/finding-watch/state.json)
+and writes the current author-facing result to
+[`report.md`](examples/dsh/finding-watch/report.md).
+
+```bash
+pnpm run monitor:dsh-findings
+```
+
+The watch distinguishes `persisting`, `added`, `resolved`, `changed`, and
+`unknown`. A failed registry request never becomes “resolved”; a source fix also
+does not erase a finding that remains in the published npm artifact. The same
+loop runs daily in [the dedicated GitHub Actions workflow](.github/workflows/dsh-finding-watch.yml)
+and commits the state only when a trusted observation changes. It does not install
+plugins, execute lifecycle scripts, load DSH, or call an LLM.
+
+The current run is already useful: `dsh-msg-hub@0.1.8` has removed the old source
+lockfile findings, but its npm artifact still reaches `protobufjs@7.6.5` with a
+`postinstall`; `dsh-wsl-workspace` now resolves `koffi@3.1.6`, while the native
+install step remains. The other reviewed install/lifecycle findings persist.
+
 ## The dependency graph behind every alert
 
 ```text
@@ -107,11 +131,11 @@ Two copies of `parser` are different nodes. An alert names the exact version and
 For a collection of saved reports, build the reverse index that turns an upstream package update into affected plugins:
 
 ```bash
-npx --yes upstream-radar@0.37.0 graph reverse ./reports \
+npx --yes upstream-radar@0.38.0 graph reverse ./reports \
   --output reverse-dependency-index.json
 
 # Ask: which plugins currently depend on this exact package?
-npx --yes upstream-radar@0.37.0 graph reverse ./reports \
+npx --yes upstream-radar@0.38.0 graph reverse ./reports \
   --package parser@2.9.0
 
 # Rebuild the checked-in index from the real first 50 DSH plugin reports
@@ -130,7 +154,7 @@ To route an upstream old → new change to that index, pass it to the always-on
 observer:
 
 ```bash
-npx --yes upstream-radar@0.37.0 observe ./targets.yml \
+npx --yes upstream-radar@0.38.0 observe ./targets.yml \
   --reverse-index ./reverse-dependency-index.json \
   --state ./observations.json \
   --report ./upstream-radar-observer.md
@@ -156,7 +180,7 @@ replay baseline → one Agent task → quiet run without network access.
 The repository already contains a reusable, composite Action in [`action.yml`](action.yml). It runs the same frozen Radar check in CI and writes a short Job Summary.
 
 ```yaml
-- uses: MicroMilo/upstream-radar@v0.37.0
+- uses: MicroMilo/upstream-radar@v0.38.0
   with:
     config: upstream-radar.config.json
     fail-on: high
@@ -180,7 +204,7 @@ See the [consumer workflow](examples/github-actions/consumer/README.md) for conf
 pnpm add upstream-radar
 
 # Generate a reviewable DSH profile inventory from the installed profile
-npx --yes upstream-radar@0.37.0 setup
+npx --yes upstream-radar@0.38.0 setup
 ```
 
 For Feishu/webhook routing, DSH Agent handoff, observer state, report schemas, and troubleshooting, use the [full Chinese guide](docs/README.zh-CN.md). The [architecture notes](docs/architecture.md) explain the boundaries and evidence model.

package/dist/src/finding-watch.d.ts

@@ -0,0 +1,31 @@
+export declare const FINDING_WATCH_SCHEMA: 'upstream-radar.finding-watch/v1alpha1';
+export type FindingWatchTransitionStatus = 'added' | 'resolved' | 'changed' | 'persisting';
+export interface FindingWatchRecord {
+    code: string;
+    severity: string;
+    summary: string;
+    detail?: string;
+    evidence?: unknown;
+    fingerprint: string;
+}
+export interface FindingWatchTransition {
+    code: string;
+    status: FindingWatchTransitionStatus;
+    previousCount: number;
+    currentCount: number;
+}
+export interface FindingWatchDelta {
+    changed: boolean;
+    transitions: FindingWatchTransition[];
+}
+export interface FindingWatchInput {
+    code?: unknown;
+    severity?: unknown;
+    summary?: unknown;
+    detail?: unknown;
+    evidence?: unknown;
+}
+export declare function normalizeFinding(input: FindingWatchInput): FindingWatchRecord | undefined;
+export declare function normalizeFindings(inputs: readonly FindingWatchInput[], watchedCodes: readonly string[]): FindingWatchRecord[];
+export declare function compareFindings(previous: readonly FindingWatchRecord[] | undefined, current: readonly FindingWatchRecord[], watchedCodes: readonly string[]): FindingWatchDelta;
+//# sourceMappingURL=finding-watch.d.ts.map

package/dist/src/finding-watch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding-watch.d.ts","sourceRoot":"","sources":["../../src/finding-watch.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,oBAAoB,EAAG,uCAAgD,CAAA;AAEpF,MAAM,MAAM,4BAA4B,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,CAAA;AAE1F,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,4BAA4B,CAAA;IACpC,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,sBAAsB,EAAE,CAAA;CACtC;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAgBD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,GAAG,kBAAkB,GAAG,SAAS,CAWzF;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,kBAAkB,EAAE,CAM7H;AAaD,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,SAAS,kBAAkB,EAAE,GAAG,SAAS,EACnD,OAAO,EAAE,SAAS,kBAAkB,EAAE,EACtC,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,iBAAiB,CAmBnB"}

package/dist/src/finding-watch.js

@@ -0,0 +1,70 @@
+import { createHash } from 'node:crypto';
+export const FINDING_WATCH_SCHEMA = 'upstream-radar.finding-watch/v1alpha1';
+function canonicalize(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalize);
+    if (typeof value !== 'object' || value === null)
+        return value;
+    return Object.fromEntries(Object.entries(value)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, item]) => [key, canonicalize(item)]));
+}
+function fingerprint(value) {
+    return `sha256:${createHash('sha256').update(JSON.stringify(canonicalize(value))).digest('hex')}`;
+}
+export function normalizeFinding(input) {
+    if (typeof input.code !== 'string' || input.code === '')
+        return undefined;
+    const severity = typeof input.severity === 'string' && input.severity !== '' ? input.severity : 'unknown';
+    const summary = typeof input.summary === 'string' && input.summary !== '' ? input.summary : input.code;
+    const detail = typeof input.detail === 'string' && input.detail !== '' ? input.detail : undefined;
+    const evidence = input.evidence;
+    const identity = { code: input.code, severity, summary, ...(detail === undefined ? {} : { detail }), ...(evidence === undefined ? {} : { evidence }) };
+    return {
+        ...identity,
+        fingerprint: fingerprint(identity),
+    };
+}
+export function normalizeFindings(inputs, watchedCodes) {
+    const watched = new Set(watchedCodes);
+    return inputs
+        .map(normalizeFinding)
+        .filter((finding) => finding !== undefined && watched.has(finding.code))
+        .sort((left, right) => left.code.localeCompare(right.code) || left.fingerprint.localeCompare(right.fingerprint));
+}
+function groupedFingerprints(findings) {
+    const groups = new Map();
+    for (const finding of findings) {
+        const current = groups.get(finding.code) ?? [];
+        current.push(finding.fingerprint);
+        groups.set(finding.code, current);
+    }
+    for (const values of groups.values())
+        values.sort();
+    return groups;
+}
+export function compareFindings(previous, current, watchedCodes) {
+    const oldGroups = groupedFingerprints(previous ?? []);
+    const currentGroups = groupedFingerprints(current);
+    const codes = [...new Set([...watchedCodes, ...oldGroups.keys(), ...currentGroups.keys()])].sort();
+    const transitions = [];
+    for (const code of codes) {
+        const oldValues = oldGroups.get(code) ?? [];
+        const currentValues = currentGroups.get(code) ?? [];
+        let status;
+        if (oldValues.length === 0 && currentValues.length > 0)
+            status = 'added';
+        else if (oldValues.length > 0 && currentValues.length === 0)
+            status = 'resolved';
+        else if (JSON.stringify(oldValues) !== JSON.stringify(currentValues))
+            status = 'changed';
+        else
+            status = 'persisting';
+        transitions.push({ code, status, previousCount: oldValues.length, currentCount: currentValues.length });
+    }
+    return {
+        changed: transitions.some(item => item.status !== 'persisting'),
+        transitions,
+    };
+}
+//# sourceMappingURL=finding-watch.js.map

package/dist/src/finding-watch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding-watch.js","sourceRoot":"","sources":["../../src/finding-watch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,MAAM,CAAC,MAAM,oBAAoB,GAAG,uCAAgD,CAAA;AAiCpF,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SAC7C,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;SACpD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CACnD,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;AACnG,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAwB;IACvD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IACzE,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;IACzG,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAA;IACtG,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IACjG,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;IAC/B,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAA;IACtJ,OAAO;QACL,GAAG,QAAQ;QACX,WAAW,EAAE,WAAW,CAAC,QAAQ,CAAC;KACnC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAoC,EAAE,YAA+B;IACrG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAA;IACrC,OAAO,MAAM;SACV,GAAG,CAAC,gBAAgB,CAAC;SACrB,MAAM,CAAC,CAAC,OAAO,EAAiC,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;SACtG,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;AACpH,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAuC;IAClE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAA;IAC1C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;QAC9C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QACjC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACnC,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,CAAC,IAAI,EAAE,CAAA;IACnD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,QAAmD,EACnD,OAAsC,EACtC,YAA+B;IAE/B,MAAM,SAAS,GAAG,mBAAmB,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;IACrD,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAClD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,EAAE,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAClG,MAAM,WAAW,GAA6B,EAAE,CAAA;IAChD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3C,MAAM,aAAa,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;QACnD,IAAI,MAAoC,CAAA;QACxC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,GAAG,OAAO,CAAA;aACnE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,GAAG,UAAU,CAAA;aAC3E,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;YAAE,MAAM,GAAG,SAAS,CAAA;;YACnF,MAAM,GAAG,YAAY,CAAA;QAC1B,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,CAAC,MAAM,EAAE,YAAY,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC,CAAA;IACzG,CAAC;IACD,OAAO;QACL,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,YAAY,CAAC;QAC/D,WAAW;KACZ,CAAA;AACH,CAAC"}

package/dist/src/version.d.ts

@@ -1,2 +1,2 @@
-export declare const TOOL_VERSION = "0.37.0";
+export declare const TOOL_VERSION = "0.38.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/src/version.js

@@ -1,2 +1,2 @@
-export const TOOL_VERSION = '0.37.0';
+export const TOOL_VERSION = '0.38.0';
 //# sourceMappingURL=version.js.map

package/docs/README.zh-CN.md

@@ -48,6 +48,7 @@ npx --yes upstream-radar@latest quickstart
 | --- | --- | --- |
 | 让在线 DSH Agent 持续跟进 | [`setup`](#安装到-dsh) | 自动刷新 profile 里的实际依赖图，只把有变化的事件交给对应项目的 Agent。 |
 | 观察 DSH 插件上游变化 | [`observe`](#观察-dsh-插件的上游变化) | 定时比较 GitHub commit、npm 发布物、manifest 和可选锁文件依赖图，只把重要变化交给 Agent。 |
+| 监控已经发现的问题 | [DSH known finding watch](../examples/dsh/finding-watch/README.md) | 对第一批 7 个真实插件重复检查源码与精确 npm 发布物，把问题标成持续、修复、变化或无法确认。 |
 | 30 秒开始监控一个公开插件 | [最小 GitHub Actions workflow](../examples/github-actions/upstream-observer-minimal.yml) | 复制一个文件、改仓库地址，每天得到报告，不需要安装或构建 Radar。 |
 | 收到第一条告警后知道先做什么 | [`radar next`](#安装到-dsh) | 一个只读命令选出最高优先级事件，并指向 DSH task、已验证分析或下一轮检查。 |
 | 启动 DSH 前检查 profile | [`profile-check`](#启动-dsh-前先检查-profile) | 读取实际锁文件和 patch，提前拦住缺失 loader 包、重复 loader id 以及 release-age 回退风险。 |
@@ -96,7 +97,7 @@ FIRST EPSS estimated exploitation probability: 97.2% (percentile 100.0%)
 想立即检查一个真实发布的 DSH 插件，可以在空目录直接运行：
 
 ```bash
-npx --yes upstream-radar@0.37.0 inspect dsh-feishu-bot@0.15.8 --deep
+npx --yes upstream-radar@0.38.0 inspect dsh-feishu-bot@0.15.8 --deep
 ```
 
 它会直接输出简短的准入结论、覆盖情况、依赖数量、漏洞数量和下一步，不需要先
@@ -109,7 +110,7 @@ npx --yes upstream-radar@0.37.0 inspect dsh-feishu-bot@0.15.8 --deep
 npm 解析环境中目前无法建立完整依赖图：
 
 ```bash
-npx --yes upstream-radar@0.37.0 inspect \
+npx --yes upstream-radar@0.38.0 inspect \
   @sanqi-normal/dsh-webui-market-plugin@0.5.4 \
   --deep --fail-on never
 ```
@@ -280,6 +281,23 @@ OpenAI-compatible 模型，先设置
 这是新的上游变化闭环：Radar 不在每轮都重复做一次大扫描，而是为每个
 插件保存一个观察点，然后回答“从上次观察到现在到底变了什么”。
 
+### 只监控已经发现的问题
+
+如果目标不是重新发现所有问题，而是持续回答“上次报告的这条问题现在还在不在”，运行仓库内置的专用观察清单：
+
+```bash
+pnpm run monitor:dsh-findings
+```
+
+它会对 `examples/dsh/finding-watch/targets.json` 中的 7 个真实 DSH 插件分别做两次检查：
+
+1. 扫描公开 GitHub 源码，不安装依赖、不运行插件；
+2. 按源码当前版本检查精确 npm 发布物，依赖解析使用禁用 lifecycle script 的环境。
+
+它把源码和发布物分开保存，因为维护者可能已经修了 GitHub 仓库，但还没有重新发布 npm 包。每条观察结果只有在检查成功时才会推进；网络失败是 `unknown`，不会被写成“已修复”。状态保存在 [`state.json`](../examples/dsh/finding-watch/state.json)，可读报告在 [`report.md`](../examples/dsh/finding-watch/report.md)，每日 workflow 是 [`dsh-finding-watch.yml`](../.github/workflows/dsh-finding-watch.yml)。
+
+当前真实结果中，`dsh-msg-hub@0.1.8` 的源码侧已经没有旧的 lockfile 图不可用/根版本过期问题，但同版本 npm 发布物仍可达 `protobufjs@7.6.5` 的 `postinstall`；`dsh-wsl-workspace` 由 `koffi@3.1.5` 变成了 `3.1.6`，但安装脚本仍然存在。这个入口的用途是监控这些已知问题的生命周期，不把每次定时运行都伪装成新的漏洞发现。
+
 ```text
 targets.yml
   ↓
@@ -317,9 +335,9 @@ npm：     dsh-feishu-bot@0.15.8
 会继续显示为 `incomplete`，不会被当成已经确认的故障。
 
 ```bash
-npx --yes upstream-radar@0.37.0 graph reverse ./plugin-reports \
+npx --yes upstream-radar@0.38.0 graph reverse ./plugin-reports \
   --output ./reverse-dependency-index.json
-npx --yes upstream-radar@0.37.0 observe ./targets.yml \
+npx --yes upstream-radar@0.38.0 observe ./targets.yml \
   --reverse-index ./reverse-dependency-index.json \
   --state ./observations.json --report ./upstream-radar-observer.md
 ```
@@ -357,7 +375,7 @@ Radar 会在三层目录内自动找到它；npm 名称和源码 manifest 不一
 想明确选择锁文件时再加 `--lockfile`：
 
 ```bash
-npx --yes upstream-radar@0.37.0 observe \
+npx --yes upstream-radar@0.38.0 observe \
   https://github.com/PlutoKeating/dsh-lark-bot \
   --state ./observations.json --report ./upstream-radar-observer.md
 ```
@@ -380,7 +398,7 @@ workspace 边保留为未解析证据；不会安装或启动 DSH。
 会额外指定 `--package`：
 
 ```bash
-npx --yes upstream-radar@0.37.0 observe \
+npx --yes upstream-radar@0.38.0 observe \
   https://github.com/PlutoKeating/dsh-lark-bot \
   --package dsh-feishu-bot \
   --lockfile pnpm-lock.yaml --lockfile-type pnpm \
@@ -658,7 +676,7 @@ cd my-dsh-plugin
 pnpm install --ignore-scripts
 
 # 把插件放进 DSH profile 前，先读取精确依赖图。
-pnpm dlx --package=upstream-radar@0.37.0 upstream-radar graph pnpm-lock pnpm-lock.yaml --json
+pnpm dlx --package=upstream-radar@0.38.0 upstream-radar graph pnpm-lock pnpm-lock.yaml --json
 ```
 
 这棵图会保留精确的 DSH 包版本，也会把未解析的可选 peer 明确显示出来；它不会加载生成的插件，也不会运行 lifecycle script。审查后，把下面这个完整 workflow 复制到 `.github/workflows/upstream-radar.yml`：
@@ -680,7 +698,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: MicroMilo/upstream-radar@v0.37.0
+      - uses: MicroMilo/upstream-radar@v0.38.0
         with:
           fail-on: high
           fail-on-compatibility: breaking
@@ -691,7 +709,7 @@ Action 会自动识别唯一的 `pnpm-lock.yaml`，检查同一棵精确依赖
 也可以直接检查一个真实发布的 DSH 包：
 
 ```bash
-npx --yes upstream-radar@0.37.0 inspect dsh-feishu-bot@0.15.8 --deep
+npx --yes upstream-radar@0.38.0 inspect dsh-feishu-bot@0.15.8 --deep
 ```
 
 这次检查的结论是 `REVIEW`：registry 完整性、签名、provenance 和 89 个已解析包都
@@ -704,7 +722,7 @@ npx --yes upstream-radar@0.37.0 inspect dsh-feishu-bot@0.15.8 --deep
 如果不想分别执行 `inspect`、打包和 `probe`，可以用一个命令完成一次 DSH 插件审查：
 
 ```bash
-pnpm dlx --package=upstream-radar@0.37.0 upstream-radar review dsh-plugin \
+pnpm dlx --package=upstream-radar@0.38.0 upstream-radar review dsh-plugin \
   dsh-cloudflare-browser-run@0.1.1 \
   --dsh-version 0.1.0-rc.6,0.1.0-rc.7
 ```
@@ -870,7 +888,7 @@ pnpm run try:dsh
 在把项目接入兼容性门禁前，可以先运行离线规则 benchmark：
 
 ```bash
-pnpm dlx --package=upstream-radar@0.37.0 upstream-radar benchmark compatibility
+pnpm dlx --package=upstream-radar@0.38.0 upstream-radar benchmark compatibility
 ```
 
 它覆盖六类契约：安全补丁、只需要项目分析的变化、不兼容的 DSH peer、发布者明确声明 breaking、候选传递依赖漏洞，以及候选依赖图不完整。这个命令不会联网、安装包、加载插件或启动 DSH；它验证的是 Radar 的确定性规则以及 `breaking`/`any` 门禁行为，不是运行时兼容性证明。
@@ -883,7 +901,7 @@ pnpm dlx --package=upstream-radar@0.37.0 upstream-radar benchmark compatibility
 # 打包精确版本，并明确不运行它的 lifecycle script。
 npm pack --ignore-scripts dsh-plugin@1.2.3
 
-pnpm dlx --package=upstream-radar@0.37.0 upstream-radar probe dsh-load \
+pnpm dlx --package=upstream-radar@0.38.0 upstream-radar probe dsh-load \
   ./dsh-plugin-1.2.3.tgz \
   --dsh-version 0.1.0-rc.6
 ```
@@ -909,7 +927,7 @@ pnpm run showcase:dsh-probe
 如果要比较多个 DSH 版本，可以使用矩阵入口：
 
 ```bash
-pnpm dlx --package=upstream-radar@0.37.0 upstream-radar probe dsh-matrix \
+pnpm dlx --package=upstream-radar@0.38.0 upstream-radar probe dsh-matrix \
   ./dsh-plugin-1.2.3.tgz \
   --dsh-version 0.1.0-rc.3 \
   --dsh-version 0.1.0-rc.6 \
@@ -927,7 +945,7 @@ JSON 结果结构见[矩阵结果 schema](../schemas/dsh-load-matrix.schema.json
 ```yaml
 steps:
   - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-  - uses: MicroMilo/upstream-radar@v0.37.0
+  - uses: MicroMilo/upstream-radar@v0.38.0
     with:
       fail-on: high
       # 可选：把确定性的 DSH/插件兼容性破坏也作为 CI 失败条件
@@ -936,12 +954,12 @@ steps:
       threat-intel: true
 ```
 
-这个 Action 只是 `radar check --frozen --state :memory: --fail-on high --fail-on-compatibility breaking --json` 的薄封装。`--frozen` 是有意的：它只使用配置文件里的依赖图，不会尝试读取 runner 上不存在的本地 DSH profile。`threat-intel` 默认是 `false`，这样普通 CI 门禁不会因为额外查询变重；设置为 `true` 后，Job Summary 和原始 JSON 会包含 CISA KEV 与 FIRST EPSS 的优先级证据。每次运行彼此独立；发现达到阈值的漏洞或选择的兼容性变化时返回 `2`，运行或漏洞源出错时返回 `1`。`breaking` 只拦截有 confirmed/strong 信号的兼容性事件，`any` 会拦截所有活动兼容性事件，默认值是 `never`。除了原始 JSON 日志，Action 还会把经过转义的简短摘要写入 GitHub Job Summary，定时任务失败时可以直接看到受影响的包、准确依赖路径、已经发布的修复版本（如果有）、一行优先级证据和建议的下一步。这个入口不会投递 DSH Agent 任务，也不会修改分支；需要持续监控和项目级分析时，仍使用原生 DSH bundle。建议把 Action 固定到类似 `v0.37.0` 的发布标签，并根据团队策略固定 checkout Action。
+这个 Action 只是 `radar check --frozen --state :memory: --fail-on high --fail-on-compatibility breaking --json` 的薄封装。`--frozen` 是有意的：它只使用配置文件里的依赖图，不会尝试读取 runner 上不存在的本地 DSH profile。`threat-intel` 默认是 `false`，这样普通 CI 门禁不会因为额外查询变重；设置为 `true` 后，Job Summary 和原始 JSON 会包含 CISA KEV 与 FIRST EPSS 的优先级证据。每次运行彼此独立；发现达到阈值的漏洞或选择的兼容性变化时返回 `2`，运行或漏洞源出错时返回 `1`。`breaking` 只拦截有 confirmed/strong 信号的兼容性事件，`any` 会拦截所有活动兼容性事件，默认值是 `never`。除了原始 JSON 日志，Action 还会把经过转义的简短摘要写入 GitHub Job Summary，定时任务失败时可以直接看到受影响的包、准确依赖路径、已经发布的修复版本（如果有）、一行优先级证据和建议的下一步。这个入口不会投递 DSH Agent 任务，也不会修改分支；需要持续监控和项目级分析时，仍使用原生 DSH bundle。建议把 Action 固定到类似 `v0.38.0` 的发布标签，并根据团队策略固定 checkout Action。
 
 如果仓库还没有提交 Radar 配置，最短接入方式是省略 `config`、`pnpm-lock` 和 `npm-lock`。checkout 之后，Action 会自动使用唯一存在的 `pnpm-lock.yaml` 或 `package-lock.json`，生成临时的审查清单，再执行同一个 frozen 检查：
 
 ```yaml
-- uses: MicroMilo/upstream-radar@v0.37.0
+- uses: MicroMilo/upstream-radar@v0.38.0
   with:
     fail-on: high
 ```
@@ -951,7 +969,7 @@ steps:
 如果要在插件进入 DSH 前审查精确发布物，可以增加 `inspect-package`：
 
 ```yaml
-- uses: MicroMilo/upstream-radar@v0.37.0
+- uses: MicroMilo/upstream-radar@v0.38.0
   with:
     inspect-package: dsh-cloudflare-browser-run@0.1.1
     # review 是安全默认值；只有允许覆盖不完整时才使用 block
@@ -963,7 +981,7 @@ steps:
 如果仓库只有 pnpm 锁文件，还没有提交 Radar 配置，可以让 Action 在同一个 job 中生成配置；可直接复制[pnpm workflow 示例](../examples/github-actions/upstream-radar-pnpm.yml)：
 
 ```yaml
-- uses: MicroMilo/upstream-radar@v0.37.0
+- uses: MicroMilo/upstream-radar@v0.38.0
   with:
     pnpm-lock: pnpm-lock.yaml
     fail-on: high
@@ -977,7 +995,7 @@ npm 项目可以改用 `npm-lock: package-lock.json`；`pnpm-lock` 和 `npm-lock
 调用方需要先 checkout 仓库。这个 Action 不会安装项目依赖，也不会执行项目的 lifecycle script；它只读取提交到仓库的依赖图并查询配置中的上游漏洞源。如果需要完全显式的底层命令，等价写法是：
 
 ```bash
-pnpm dlx --package=upstream-radar@0.37.0 upstream-radar radar check \
+pnpm dlx --package=upstream-radar@0.38.0 upstream-radar radar check \
   ./upstream-radar.config.json --frozen --state :memory: --fail-on high \
   --fail-on-compatibility breaking --json
 ```
@@ -985,7 +1003,7 @@ pnpm dlx --package=upstream-radar@0.37.0 upstream-radar radar check \
 如果还要检查一个已发布插件能否跨多个 DSH 版本加载，可以增加三个 input：
 
 ```yaml
-- uses: MicroMilo/upstream-radar@v0.37.0
+- uses: MicroMilo/upstream-radar@v0.38.0
   id: radar
   with:
     config: upstream-radar.config.json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "upstream-radar",
-  "version": "0.37.0",
+  "version": "0.38.0",
   "description": "Always-on dependency security monitoring for DeepSeek Harness (DSH) plugins: find exact installed or candidate transitive vulnerable paths and breaking updates, then route evidence to a DSH Agent.",
   "type": "module",
   "license": "Apache-2.0",
@@ -95,6 +95,7 @@
     "showcase:dsh-case": "pnpm run build && node scripts/dsh-case-showcase.mjs",
     "showcase:dsh-case:report": "pnpm run build && node scripts/dsh-case-showcase.mjs --write-report",
     "showcase:observer": "pnpm run build && node scripts/upstream-observer-showcase.mjs",
+    "monitor:dsh-findings": "pnpm run build && node scripts/monitor-dsh-findings.mjs",
     "refresh:dsh-batch": "pnpm run build && node scripts/refresh-dsh-batch-index.mjs",
     "showcase:pnpm-lock": "pnpm run build && node scripts/pnpm-lock-showcase.mjs",
     "showcase:pnpm-lock:monitor": "pnpm run build && node scripts/pnpm-lock-monitor-showcase.mjs",