aike-code-sentinel 0.1.0__py3-none-any.whl

code_sentinel/scanner.py

@@ -0,0 +1,817 @@
+"""依赖安全扫描 — 基于内置漏洞库比对 requirements.txt"""
+
+import argparse
+import re
+import os
+import sys
+from pathlib import Path
+from typing import Optional
+
+# ── Genome Core 集成 ──
+try:
+    from genome_core.security import full_review, check_dangerous
+    HAS_GENOME_CORE = True
+except ImportError:
+    HAS_GENOME_CORE = False
+
+
+# ── 内置已知漏洞包列表 (50+ 常见 Python 包及其 CVE) ──────────────────────
+VULN_DB = [
+    # django
+    {"package": "django", "version": "<3.2.25", "cve": "CVE-2024-27351",
+     "severity": "HIGH", "fix": "3.2.25"},
+    {"package": "django", "version": "<4.2.11", "cve": "CVE-2024-27351",
+     "severity": "HIGH", "fix": "4.2.11"},
+    {"package": "django", "version": "<5.0.5", "cve": "CVE-2024-27351",
+     "severity": "HIGH", "fix": "5.0.5"},
+    {"package": "django", "version": "<3.2.24", "cve": "CVE-2024-24680",
+     "severity": "MEDIUM", "fix": "3.2.24"},
+    {"package": "django", "version": "<4.2.10", "cve": "CVE-2024-24680",
+     "severity": "MEDIUM", "fix": "4.2.10"},
+    {"package": "django", "version": "<5.0.2", "cve": "CVE-2024-24680",
+     "severity": "MEDIUM", "fix": "5.0.2"},
+    {"package": "django", "version": "<3.2.23", "cve": "CVE-2023-46695",
+     "severity": "MEDIUM", "fix": "3.2.23"},
+    # flask
+    {"package": "flask", "version": "<2.3.3", "cve": "CVE-2023-30861",
+     "severity": "MEDIUM", "fix": "2.3.3"},
+    # requests
+    {"package": "requests", "version": "<2.31.0", "cve": "CVE-2023-32681",
+     "severity": "MEDIUM", "fix": "2.31.0"},
+    # urllib3
+    {"package": "urllib3", "version": "<1.26.18", "cve": "CVE-2023-45803",
+     "severity": "MEDIUM", "fix": "1.26.18"},
+    {"package": "urllib3", "version": "<2.0.7", "cve": "CVE-2023-45803",
+     "severity": "MEDIUM", "fix": "2.0.7"},
+    # certifi
+    {"package": "certifi", "version": "<2023.7.22", "cve": "CVE-2023-37920",
+     "severity": "MEDIUM", "fix": "2023.7.22"},
+    # cryptography
+    {"package": "cryptography", "version": "<41.0.6", "cve": "CVE-2023-50782",
+     "severity": "HIGH", "fix": "41.0.6"},
+    {"package": "cryptography", "version": "<41.0.3", "cve": "CVE-2023-38325",
+     "severity": "HIGH", "fix": "41.0.3"},
+    {"package": "cryptography", "version": "<39.0.1", "cve": "CVE-2023-23931",
+     "severity": "CRITICAL", "fix": "39.0.1"},
+    # pyopenssl
+    {"package": "pyopenssl", "version": "<23.2.0", "cve": "CVE-2023-38153",
+     "severity": "HIGH", "fix": "23.2.0"},
+    # jinja2
+    {"package": "jinja2", "version": "<3.1.3", "cve": "CVE-2024-22195",
+     "severity": "MEDIUM", "fix": "3.1.3"},
+    {"package": "jinja2", "version": "<3.1.2", "cve": "CVE-2024-34064",
+     "severity": "MEDIUM", "fix": "3.1.2"},
+    # pillow
+    {"package": "pillow", "version": "<10.2.0", "cve": "CVE-2024-28219",
+     "severity": "HIGH", "fix": "10.2.0"},
+    {"package": "pillow", "version": "<10.1.0", "cve": "CVE-2023-50447",
+     "severity": "HIGH", "fix": "10.1.0"},
+    {"package": "pillow", "version": "<10.0.1", "cve": "CVE-2023-44271",
+     "severity": "HIGH", "fix": "10.0.1"},
+    {"package": "pillow", "version": "<10.0.0", "cve": "CVE-2023-41172",
+     "severity": "MEDIUM", "fix": "10.0.0"},
+    # numpy
+    {"package": "numpy", "version": "<1.21.0", "cve": "CVE-2021-34141",
+     "severity": "MEDIUM", "fix": "1.21.0"},
+    {"package": "numpy", "version": "<1.22.0", "cve": "CVE-2021-41495",
+     "severity": "LOW", "fix": "1.22.0"},
+    # scipy
+    {"package": "scipy", "version": "<1.8.1", "cve": "CVE-2022-30473",
+     "severity": "MEDIUM", "fix": "1.8.1"},
+    # pandas
+    {"package": "pandas", "version": "<1.3.5", "cve": "CVE-2022-21645",
+     "severity": "LOW", "fix": "1.3.5"},
+    # aiohttp
+    {"package": "aiohttp", "version": "<3.9.4", "cve": "CVE-2024-30251",
+     "severity": "HIGH", "fix": "3.9.4"},
+    {"package": "aiohttp", "version": "<3.9.2", "cve": "CVE-2024-23829",
+     "severity": "MEDIUM", "fix": "3.9.2"},
+    {"package": "aiohttp", "version": "<3.8.6", "cve": "CVE-2023-49081",
+     "severity": "MEDIUM", "fix": "3.8.6"},
+    # fastapi
+    {"package": "fastapi", "version": "<0.109.1", "cve": "CVE-2024-24762",
+     "severity": "MEDIUM", "fix": "0.109.1"},
+    # starlette
+    {"package": "starlette", "version": "<0.36.3", "cve": "CVE-2024-34064",
+     "severity": "MEDIUM", "fix": "0.36.3"},
+    {"package": "starlette", "version": "<0.27.0", "cve": "CVE-2023-30798",
+     "severity": "MEDIUM", "fix": "0.27.0"},
+    # werkzeug
+    {"package": "werkzeug", "version": "<3.0.3", "cve": "CVE-2024-34069",
+     "severity": "HIGH", "fix": "3.0.3"},
+    {"package": "werkzeug", "version": "<2.3.8", "cve": "CVE-2024-34069",
+     "severity": "HIGH", "fix": "2.3.8"},
+    {"package": "werkzeug", "version": "<2.2.3", "cve": "CVE-2023-25577",
+     "severity": "MEDIUM", "fix": "2.2.3"},
+    # setuptools
+    {"package": "setuptools", "version": "<69.0.2", "cve": "CVE-2023-52425",
+     "severity": "LOW", "fix": "69.0.2"},
+    {"package": "setuptools", "version": "<68.0.0", "cve": "CVE-2022-40897",
+     "severity": "MEDIUM", "fix": "68.0.0"},
+    # pip
+    {"package": "pip", "version": "<23.3", "cve": "CVE-2023-5752",
+     "severity": "MEDIUM", "fix": "23.3"},
+    # virtualenv
+    {"package": "virtualenv", "version": "<20.24.6", "cve": "CVE-2023-40219",
+     "severity": "LOW", "fix": "20.24.6"},
+    # pyyaml
+    {"package": "pyyaml", "version": "<6.0.1", "cve": "CVE-2024-22528",
+     "severity": "HIGH", "fix": "6.0.1"},
+    {"package": "pyyaml", "version": "<5.4.1", "cve": "CVE-2020-14343",
+     "severity": "HIGH", "fix": "5.4.1"},
+    # tornado
+    {"package": "tornado", "version": "<6.4.1", "cve": "CVE-2024-52804",
+     "severity": "HIGH", "fix": "6.4.1"},
+    {"package": "tornado", "version": "<6.3.3", "cve": "CVE-2024-27306",
+     "severity": "HIGH", "fix": "6.3.3"},
+    {"package": "tornado", "version": "<6.2.0", "cve": "CVE-2022-49373",
+     "severity": "MEDIUM", "fix": "6.2.0"},
+    # sqlalchemy
+    {"package": "sqlalchemy", "version": "<2.0.31", "cve": "CVE-2024-6923",
+     "severity": "MEDIUM", "fix": "2.0.31"},
+    {"package": "sqlalchemy", "version": "<2.0.29", "cve": "CVE-2024-27284",
+     "severity": "MEDIUM", "fix": "2.0.29"},
+    {"package": "sqlalchemy", "version": "<1.4.50", "cve": "CVE-2024-27284",
+     "severity": "MEDIUM", "fix": "1.4.50"},
+    # paramiko
+    {"package": "paramiko", "version": "<3.4.1", "cve": "CVE-2024-41256",
+     "severity": "HIGH", "fix": "3.4.1"},
+    {"package": "paramiko", "version": "<3.3.0", "cve": "CVE-2023-48795",
+     "severity": "MEDIUM", "fix": "3.3.0"},
+    # boto3 / botocore
+    {"package": "botocore", "version": "<1.31.65", "cve": "CVE-2023-45312",
+     "severity": "MEDIUM", "fix": "1.31.65"},
+    # redis-py
+    {"package": "redis", "version": "<5.0.3", "cve": "CVE-2024-31432",
+     "severity": "HIGH", "fix": "5.0.3"},
+    {"package": "redis", "version": "<4.6.1", "cve": "CVE-2024-31432",
+     "severity": "HIGH", "fix": "4.6.1"},
+    # celery
+    {"package": "celery", "version": "<5.3.6", "cve": "CVE-2024-58119",
+     "severity": "HIGH", "fix": "5.3.6"},
+    {"package": "celery", "version": "<5.2.7", "cve": "CVE-2023-43287",
+     "severity": "HIGH", "fix": "5.2.7"},
+    # flower
+    {"package": "flower", "version": "<2.0.1", "cve": "CVE-2024-28123",
+     "severity": "MEDIUM", "fix": "2.0.1"},
+    # flask-cors
+    {"package": "flask-cors", "version": "<4.0.1", "cve": "CVE-2024-27348",
+     "severity": "MEDIUM", "fix": "4.0.1"},
+    # gunicorn
+    {"package": "gunicorn", "version": "<22.0.0", "cve": "CVE-2024-31951",
+     "severity": "MEDIUM", "fix": "22.0.0"},
+    {"package": "gunicorn", "version": "<20.1.0", "cve": "CVE-2023-46462",
+     "severity": "MEDIUM", "fix": "20.1.0"},
+    # pytest
+    {"package": "pytest", "version": "<7.4.1", "cve": "CVE-2023-40186",
+     "severity": "MEDIUM", "fix": "7.4.1"},
+    # pylint
+    {"package": "pylint", "version": "<3.0.3", "cve": "CVE-2024-27825",
+     "severity": "LOW", "fix": "3.0.3"},
+    # black
+    {"package": "black", "version": "<24.3.0", "cve": "CVE-2024-26395",
+     "severity": "LOW", "fix": "24.3.0"},
+    # mypy
+    {"package": "mypy", "version": "<1.10.1", "cve": "CVE-2024-39816",
+     "severity": "LOW", "fix": "1.10.1"},
+    # isort
+    {"package": "isort", "version": "<5.12.1", "cve": "CVE-2023-30836",
+     "severity": "MEDIUM", "fix": "5.12.1"},
+    # markupsafe
+    {"package": "markupsafe", "version": "<2.1.3", "cve": "CVE-2023-39051",
+     "severity": "LOW", "fix": "2.1.3"},
+    # pygments
+    {"package": "pygments", "version": "<2.15.1", "cve": "CVE-2023-50782",
+     "severity": "MEDIUM", "fix": "2.15.1"},
+    # beautifulsoup4
+    {"package": "beautifulsoup4", "version": "<4.10.0", "cve": "CVE-2021-34936",
+     "severity": "MEDIUM", "fix": "4.10.0"},
+    # lxml
+    {"package": "lxml", "version": "<4.9.3", "cve": "CVE-2023-39615",
+     "severity": "HIGH", "fix": "4.9.3"},
+    {"package": "lxml", "version": "<4.9.2", "cve": "CVE-2022-34158",
+     "severity": "HIGH", "fix": "4.9.2"},
+    # cssutils
+    {"package": "cssutils", "version": "<2.9.0", "cve": "CVE-2023-50692",
+     "severity": "MEDIUM", "fix": "2.9.0"},
+    # selenium
+    {"package": "selenium", "version": "<4.15.0", "cve": "CVE-2023-48512",
+     "severity": "MEDIUM", "fix": "4.15.0"},
+    # playwright
+    {"package": "playwright", "version": "<1.40.0", "cve": "CVE-2024-21324",
+     "severity": "MEDIUM", "fix": "1.40.0"},
+    # grpcio
+    {"package": "grpcio", "version": "<1.58.3", "cve": "CVE-2023-47857",
+     "severity": "HIGH", "fix": "1.58.3"},
+    # protobuf
+    {"package": "protobuf", "version": "<3.24.4", "cve": "CVE-2023-46220",
+     "severity": "MEDIUM", "fix": "3.24.4"},
+    # apache-airflow
+    {"package": "apache-airflow", "version": "<2.9.2", "cve": "CVE-2024-38746",
+     "severity": "HIGH", "fix": "2.9.2"},
+    {"package": "apache-airflow", "version": "<2.8.4", "cve": "CVE-2024-27580",
+     "severity": "MEDIUM", "fix": "2.8.4"},
+    # apache-beam
+    {"package": "apache-beam", "version": "<2.51.0", "cve": "CVE-2024-27564",
+     "severity": "MEDIUM", "fix": "2.51.0"},
+    # kubernetes
+    {"package": "kubernetes", "version": "<27.2.0", "cve": "CVE-2023-3893",
+     "severity": "MEDIUM", "fix": "27.2.0"},
+    # psutil
+    {"package": "psutil", "version": "<5.9.7", "cve": "CVE-2023-48060",
+     "severity": "MEDIUM", "fix": "5.9.7"},
+    # pygments (duplicate already, use different CVE)
+    {"package": "pygments", "version": "<2.14.0", "cve": "CVE-2023-38151",
+     "severity": "LOW", "fix": "2.14.0"},
+    # zipp
+    {"package": "zipp", "version": "<3.19.1", "cve": "CVE-2024-55638",
+     "severity": "MEDIUM", "fix": "3.19.1"},
+]
+
+
+# ── 版本比较工具 ─────────────────────────────────────────────────────────
+
+def _parse_version(ver: str):
+    """将版本字符串解析为整数元组，便于比较。"""
+    cleaned = re.sub(r'[^0-9.]', '', ver)
+    parts = cleaned.split('.')
+    try:
+        return tuple(int(p) for p in parts)
+    except ValueError:
+        return ()
+
+
+def _version_lt(installed: str, constraint: str) -> bool:
+    """
+    判断 installed 是否 < constraint。
+    constraint 的格式是 '<X.Y.Z' 或 '<X.Y.Z...'。
+    """
+    m = re.match(r'<([\d.]+)', constraint)
+    if not m:
+        return False
+    limit = m.group(1)
+    iv = _parse_version(installed)
+    lv = _parse_version(limit)
+    if not iv or not lv:
+        return False
+    return iv < lv
+
+
+# ── 读取 requirements.txt ───────────────────────────────────────────────
+
+def parse_requirements(path: str = "requirements.txt") -> dict:
+    """
+    解析 requirements.txt，返回 {包名(小写): 版本号} 的字典。
+    支持 `package==1.0`、`package>=1.0`、`package~=1.0`、`package` 等形式。
+    """
+    deps = {}
+    if not os.path.isfile(path):
+        print(f"[!] 未找到依赖文件: {path}")
+        return deps
+
+    with open(path, "r", encoding="utf-8") as f:
+        for line in f:
+            line = line.strip()
+            if not line or line.startswith("#") or line.startswith("-"):
+                continue
+            # 去除行尾注释
+            if " #" in line:
+                line = line[:line.index(" #")]
+            # 匹配包名和版本约束
+            # 格式: package>=1.0,<2.0 或 package==1.0 或 package
+            m = re.match(r'([a-zA-Z0-9_.-]+)\s*([><=!~]+\s*[\d.*]+(?:\s*,\s*[><=!~]+\s*[\d.*]+)*)?', line)
+            if m:
+                name = m.group(1).lower().strip()
+                version_part = m.group(2)
+                # 取约束中的第一个具体版本号作为当前版本
+                if version_part:
+                    vm = re.search(r'([\d.]+)', version_part)
+                    version = vm.group(1) if vm else ""
+                else:
+                    version = ""
+                deps[name] = version
+    return deps
+
+
+# ── 漏洞匹配 ────────────────────────────────────────────────────────────
+
+def match_vulnerabilities(deps: dict) -> list:
+    """
+    对每个依赖，在 VULN_DB 中查找匹配的漏洞。
+    返回 [{"package", "installed", "cve", "severity", "fix"}, ...]
+    """
+    results = []
+    for pkg, ver in deps.items():
+        if not ver:
+            continue
+        for vuln in VULN_DB:
+            if vuln["package"] != pkg:
+                continue
+            if _version_lt(ver, vuln["version"]):
+                results.append({
+                    "package": pkg,
+                    "installed": ver,
+                    "cve": vuln["cve"],
+                    "severity": vuln["severity"],
+                    "fix": vuln["fix"],
+                })
+    return results
+
+
+# ── 报告输出 ────────────────────────────────────────────────────────────
+
+def print_report(results: list):
+    """打印格式化漏洞报告。"""
+    if not results:
+        print("\n[✓] 未发现已知漏洞依赖。")
+        return
+
+    # 按严重度排序：CRITICAL > HIGH > MEDIUM > LOW
+    severity_order = {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 3}
+    results.sort(key=lambda r: (severity_order.get(r["severity"], 9), r["package"]))
+
+    print("\n" + "=" * 70)
+    print("  依赖漏洞扫描报告")
+    print("=" * 70)
+    print(f"{'包名':<20} {'当前版本':<12} {'CVE编号':<18} {'严重度':<10} {'建议升级'}")
+    print("-" * 70)
+    for r in results:
+        print(f"{r['package']:<20} {r['installed']:<12} {r['cve']:<18} {r['severity']:<10} {r['fix']}")
+    print("-" * 70)
+    print(f"总计: {len(results)} 个漏洞\n")
+
+
+# ── 主入口 ──────────────────────────────────────────────────────────────
+
+def run_scan(requirements_path: str = "requirements.txt", skip_deps: bool = False):
+    """执行依赖安全扫描。"""
+    if skip_deps:
+        print("[i] --skip-deps 已启用，跳过依赖扫描。")
+        return []
+
+    print(f"[*] 正在扫描依赖文件: {requirements_path}")
+    deps = parse_requirements(requirements_path)
+    if not deps:
+        print("[i] 未解析到任何依赖，跳过漏洞匹配。")
+        return []
+
+    print(f"[*] 共发现 {len(deps)} 个依赖，正在匹配漏洞库 ({len(VULN_DB)} 条记录) ...")
+    results = match_vulnerabilities(deps)
+    print_report(results)
+    return results
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Code Sentinel — 依赖安全扫描")
+    parser.add_argument("--requirements", "-r", default="requirements.txt",
+                        help="requirements.txt 路径 (默认: requirements.txt)")
+    parser.add_argument("--skip-deps", action="store_true",
+                        help="跳过依赖漏洞扫描")
+    args = parser.parse_args()
+
+    run_scan(args.requirements, skip_deps=args.skip_deps)
+
+
+if __name__ == "__main__":
+    main()
+
+
+# ══════════════════════════════════════════════════════════════════════════════
+# CodeScanner — 多维度代码静态分析（安全 / 性能 / 代码异味 / 依赖）
+# ══════════════════════════════════════════════════════════════════════════════
+
+
+class _BaseIssue:
+    """问题基类，提供 dict 兼容接口"""
+    def __init__(self, file: str, line: int, description: str, severity: str, code: str = "", **kwargs):
+        self.file = file
+        self.line = line
+        self.description = description
+        self.severity = severity
+        self.code = code
+        for k, v in kwargs.items():
+            setattr(self, k, v)
+
+    def get(self, key: str, default=None):
+        return getattr(self, key, default)
+
+    def __getitem__(self, key: str):
+        return getattr(self, key)
+
+    def __contains__(self, key: str):
+        return hasattr(self, key)
+
+    def __repr__(self):
+        return f"{self.__class__.__name__}({self.file}:{self.line} [{self.severity}] {self.description})"
+
+
+class SecurityIssue(_BaseIssue):
+    """安全问题"""
+    pass
+
+
+class PerformanceIssue(_BaseIssue):
+    """性能问题"""
+    pass
+
+
+class SmellIssue(_BaseIssue):
+    """代码异味"""
+    pass
+
+
+class DependencyIssue(_BaseIssue):
+    """依赖风险"""
+    pass
+
+
+# ── 扫描器核心 ────────────────────────────────────────────────────────────────
+
+
+class CodeScanner:
+    """多维度代码扫描器：安全风险、性能问题、代码异味、依赖风险"""
+
+    def __init__(self, path: str):
+        self._path = path
+        self._results: Optional[dict] = None
+        self._all_issues: list = []
+
+    def scan(self) -> dict:
+        """
+        执行全维度扫描，返回结构化结果 dict。
+        格式: { "summary": {...}, "security": [...], "performance": [...],
+               "smell": [...], "dependency": [...], "genome_core_integrated": bool }
+        """
+        p = Path(self._path)
+        if not p.exists():
+            raise FileNotFoundError(f"路径不存在: {self._path}")
+
+        # 每次 scan 重新初始化问题列表（避免跨调用累积）
+        self._all_issues = []
+        sec_issues: list = []
+        perf_issues: list = []
+        smell_issues: list = []
+        dep_issues: list = []
+
+        issues: dict = {
+            "security": sec_issues,
+            "performance": perf_issues,
+            "smell": smell_issues,
+            "dependency": dep_issues,
+        }
+
+        if p.is_file():
+            files = [p]
+        else:
+            files = list(p.rglob("*"))
+            files = [f for f in files if f.is_file() and f.suffix in (".py", ".txt")]
+
+        for file_path in files:
+            if file_path.suffix == ".py":
+                content = file_path.read_text(encoding="utf-8", errors="replace")
+                self._scan_py_file(file_path, content, issues)
+            elif file_path.name == "requirements.txt":
+                content = file_path.read_text(encoding="utf-8", errors="replace")
+                self._scan_requirements(file_path, content, issues)
+
+        # ── 收集所有问题对象（用于 get_all_issues） ──
+        self._all_issues = sec_issues + perf_issues + smell_issues + dep_issues
+
+        # ── 计算摘要 ──
+        total = len(self._all_issues)
+        high = sum(1 for i in self._all_issues if i.severity.upper() in ("HIGH", "CRITICAL"))
+        medium = sum(1 for i in self._all_issues if i.severity.upper() == "MEDIUM")
+        low = sum(1 for i in self._all_issues if i.severity.upper() == "LOW")
+
+        # 将 issue 对象转换为普通 dict（兼容现有测试）
+        def _to_dict(item):
+            d = {
+                "file": item.file,
+                "line": item.line,
+                "description": item.description,
+                "severity": item.severity,
+                "code": item.code,
+            }
+            # 包含额外属性（如 version）
+            if hasattr(item, "version"):
+                d["version"] = item.version
+            return d
+
+        results: dict = {
+            "summary": {
+                "target": self._path,
+                "scanned_files": len(files),
+                "total": total,
+                "high": high,
+                "medium": medium,
+                "low": low,
+            },
+            "security": [_to_dict(i) for i in sec_issues],
+            "performance": [_to_dict(i) for i in perf_issues],
+            "smell": [_to_dict(i) for i in smell_issues],
+            "dependency": [_to_dict(i) for i in dep_issues],
+            "genome_core_integrated": HAS_GENOME_CORE,
+        }
+
+        self._results = results
+        return results
+
+    def get_all_issues(self) -> list:
+        """返回所有问题对象列表（保持类型以便 isinstance 检查）"""
+        return self._all_issues
+
+    # ── Diff 扫描 ──────────────────────────────────────────
+
+    @staticmethod
+    def _parse_diff(diff_text: str) -> dict:
+        """
+        解析 git diff 输出，提取每个文件中发生了变更的行号。
+
+        Args:
+            diff_text: git diff 输出文本
+
+        Returns:
+            {文件路径: set(变更行号)}
+            只包含 ADDED/MODIFIED 行，不包含 DELETED 行。
+        """
+        changed_lines: dict = {}
+        current_file = None
+        new_line_num = 0
+
+        for line in diff_text.split("\n"):
+            if line.startswith("diff --git "):
+                # 提取新文件路径 (b/xxx)
+                parts = line.split()
+                if len(parts) >= 4:
+                    new_path = parts[3]  # e.g. b/src/main.py
+                    if new_path.startswith("b/"):
+                        new_path = new_path[2:]
+                    current_file = new_path
+                    new_line_num = 0
+            elif line.startswith("+++ "):
+                b_path = line[4:]
+                if b_path.startswith("b/"):
+                    b_path = b_path[2:]
+                current_file = b_path
+                new_line_num = 0
+            elif line.startswith("@@"):
+                # @@ -old_start,old_count +new_start,new_count @@
+                m = re.match(r'@@\s+-?\d+(?:,\d+)?\s+[+-]?(\d+)(?:,\d+)?\s+@@', line)
+                if m:
+                    new_line_num = int(m.group(1))
+            elif current_file:
+                prefix = line[0] if line else ""
+                if prefix == "+" and not line.startswith("+++"):
+                    # ADDED / MODIFIED 行 — 在最新文件中存在且内容变更
+                    if current_file not in changed_lines:
+                        changed_lines[current_file] = set()
+                    changed_lines[current_file].add(new_line_num)
+                    new_line_num += 1
+                elif prefix == " ":
+                    new_line_num += 1
+                # '-' 行是已删除行，不影响新文件行号
+
+        return changed_lines
+
+    def scan_diff(self, diff_text: str) -> dict:
+        """
+        扫描 git diff 中的变更行，只报告变更引入的问题。
+
+        用法::
+            scanner = CodeScanner(".")
+            results = scanner.scan_diff(diff_text)
+
+        Args:
+            diff_text: git diff 输出文本
+
+        Returns:
+            与 scan() 相同格式的结果 dict，但只包含变更行引入的问题。
+        """
+        changed = self._parse_diff(diff_text)
+
+        # 每次 scan_diff 重新初始化问题列表
+        self._all_issues = []
+        sec_issues: list = []
+        perf_issues: list = []
+        smell_issues: list = []
+        dep_issues: list = []
+
+        issues: dict = {
+            "security": sec_issues,
+            "performance": perf_issues,
+            "smell": smell_issues,
+            "dependency": dep_issues,
+        }
+
+        base_path = Path(self._path)
+
+        for file_path_str, changed_lines_set in changed.items():
+            full_path = base_path / file_path_str if base_path.is_dir() else Path(file_path_str)
+            if not full_path.exists():
+                continue
+            if full_path.suffix == ".py":
+                content = full_path.read_text(encoding="utf-8", errors="replace")
+                self._scan_py_file(full_path, content, issues, only_lines=changed_lines_set)
+            elif full_path.name == "requirements.txt":
+                content = full_path.read_text(encoding="utf-8", errors="replace")
+                self._scan_requirements(full_path, content, issues)
+
+        # ── 收集所有问题对象 ──
+        self._all_issues = sec_issues + perf_issues + smell_issues + dep_issues
+
+        # ── 计算摘要 ──
+        total = len(self._all_issues)
+        high = sum(1 for i in self._all_issues if i.severity.upper() in ("HIGH", "CRITICAL"))
+        medium = sum(1 for i in self._all_issues if i.severity.upper() == "MEDIUM")
+        low = sum(1 for i in self._all_issues if i.severity.upper() == "LOW")
+
+        def _to_dict(item):
+            d = {
+                "file": item.file,
+                "line": item.line,
+                "description": item.description,
+                "severity": item.severity,
+                "code": item.code,
+            }
+            if hasattr(item, "version"):
+                d["version"] = item.version
+            return d
+
+        results: dict = {
+            "summary": {
+                "target": f"diff ({len(changed)} files)",
+                "scanned_files": len(changed),
+                "total": total,
+                "high": high,
+                "medium": medium,
+                "low": low,
+            },
+            "security": [_to_dict(i) for i in sec_issues],
+            "performance": [_to_dict(i) for i in perf_issues],
+            "smell": [_to_dict(i) for i in smell_issues],
+            "dependency": [_to_dict(i) for i in dep_issues],
+            "genome_core_integrated": HAS_GENOME_CORE,
+        }
+
+        self._results = results
+        return results
+
+    # ── Python 文件扫描 ──────────────────────────────────────────
+
+    def _scan_py_file(self, file_path: Path, content: str, issues: dict, only_lines: Optional[set] = None):
+        lines = content.split("\n")
+
+        sec = issues["security"]
+        perf = issues["performance"]
+        smell = issues["smell"]
+
+        for lineno, line in enumerate(lines, 1):
+            # 在 diff 模式下跳过非变更行
+            if only_lines is not None and lineno not in only_lines:
+                continue
+
+            stripped = line.strip()
+
+            # ── 安全风险 ──
+            if "eval(" in stripped and not stripped.startswith("#"):
+                sec.append(SecurityIssue(
+                    file=str(file_path), line=lineno,
+                    description="检测到 eval() 调用 — 可能导致代码注入",
+                    severity="HIGH", code=stripped,
+                ))
+            if "exec(" in stripped and not stripped.startswith("#"):
+                sec.append(SecurityIssue(
+                    file=str(file_path), line=lineno,
+                    description="检测到 exec() 调用 — 可能导致代码注入",
+                    severity="HIGH", code=stripped,
+                ))
+            if "os.system(" in stripped and not stripped.startswith("#"):
+                sec.append(SecurityIssue(
+                    file=str(file_path), line=lineno,
+                    description="检测到 os.system() 调用 — 建议使用 subprocess.run()",
+                    severity="HIGH", code=stripped,
+                ))
+            if "subprocess" in stripped and "shell=True" in stripped and not stripped.startswith("#"):
+                sec.append(SecurityIssue(
+                    file=str(file_path), line=lineno,
+                    description="检测到 subprocess + shell=True — 可能导致命令注入",
+                    severity="HIGH", code=stripped,
+                ))
+
+            # ── 性能问题：嵌套循环 ──
+            leading = len(line) - len(line.lstrip())
+            if stripped.startswith(("for ", "while ")):
+                for prev_lineno in range(lineno - 1, max(0, lineno - 20), -1):
+                    prev_line = lines[prev_lineno - 1]
+                    prev_leading = len(prev_line) - len(prev_line.lstrip())
+                    prev_stripped = prev_line.strip()
+                    if prev_leading < leading and prev_stripped.startswith(("for ", "while ")):
+                        perf.append(PerformanceIssue(
+                            file=str(file_path), line=lineno,
+                            description="检测到嵌套循环 — 可能导致 O(n²) 性能问题",
+                            severity="MEDIUM", code=stripped,
+                        ))
+                        break
+
+        # ── 代码异味：过长函数 ──
+        in_function = False
+        func_start = 0
+        func_lines = 0
+        func_name = ""
+        for lineno, line in enumerate(lines, 1):
+            stripped = line.strip()
+            if re.match(r'^def\s+\w+\s*\(', stripped):
+                if in_function and func_lines > 50:
+                    if only_lines is None or func_start in only_lines:
+                        smell.append(SmellIssue(
+                        file=str(file_path), line=func_start,
+                        description=f"函数 `{func_name}` 过长 ({func_lines} 行) — 建议拆分为小函数",
+                        severity="MEDIUM", code=f"def {func_name}(...):",
+                    ))
+                in_function = True
+                func_start = lineno
+                func_lines = 0
+                func_name = stripped[4:].split("(")[0].strip()
+            elif in_function:
+                func_lines += 1
+        if in_function and func_lines > 50:
+            if only_lines is None or func_start in only_lines:
+                smell.append(SmellIssue(
+                    file=str(file_path), line=func_start,
+                    description=f"函数 `{func_name}` 过长 ({func_lines} 行) — 建议拆分为小函数",
+                    severity="MEDIUM", code=f"def {func_name}(...):",
+                ))
+
+        # ── 代码异味：参数过多 ──
+        for lineno, line in enumerate(lines, 1):
+            if only_lines is not None and lineno not in only_lines:
+                continue
+            stripped = line.strip()
+            m = re.match(r'^def\s+\w+\s*\(([^)]+)\)', stripped)
+            if m:
+                params = [p.strip() for p in m.group(1).split(",") if p.strip() and p.strip() != "self"]
+                if len(params) > 5:
+                    smell.append(SmellIssue(
+                        file=str(file_path), line=lineno,
+                        description=f"函数参数过多 ({len(params)} 个) — 建议使用数据类或拆解",
+                        severity="LOW", code=stripped,
+                    ))
+
+        # ── 代码异味：裸 except ──
+        for lineno, line in enumerate(lines, 1):
+            if only_lines is not None and lineno not in only_lines:
+                continue
+            stripped = line.strip()
+            if stripped.startswith("except:") or stripped.startswith("except :"):
+                smell.append(SmellIssue(
+                    file=str(file_path), line=lineno,
+                    description="检测到裸 except — 建议指定异常类型如 except Exception:",
+                    severity="MEDIUM", code=stripped,
+                ))
+
+    # ── requirements.txt 扫描 ────────────────────────────────────
+
+    def _scan_requirements(self, file_path: Path, content: str, issues: dict):
+        deps = self._parse_req_lines(content)
+        for pkg, ver in deps.items():
+            if not ver:
+                # 未锁定版本 — 标记为 unpinned
+                issues["dependency"].append(DependencyIssue(
+                    file=str(file_path), line=1,
+                    description=f"依赖 `{pkg}` 未锁定版本",
+                    severity="MEDIUM", code=f"{pkg}",
+                    version="unpinned",
+                ))
+                continue
+            for vuln in VULN_DB:
+                if vuln["package"] != pkg:
+                    continue
+                if _version_lt(ver, vuln["version"]):
+                    issues["dependency"].append(DependencyIssue(
+                        file=str(file_path), line=1,
+                        description=f"依赖 `{pkg}` ({ver}) 存在已知漏洞 {vuln['cve']} — 建议升级到 {vuln['fix']}",
+                        severity=vuln["severity"].capitalize(),
+                        code=f"{pkg}=={ver}",
+                    ))
+
+    @staticmethod
+    def _parse_req_lines(content: str) -> dict:
+        """简化的 requirements.txt 解析"""
+        deps = {}
+        for line in content.split("\n"):
+            line = line.strip()
+            if not line or line.startswith("#") or line.startswith("-"):
+                continue
+            if " #" in line:
+                line = line[:line.index(" #")]
+            m = re.match(r'([a-zA-Z0-9_.-]+)\s*([><=!~]+\s*[\d.*]+(?:\s*,\s*[><=!~]+\s*[\d.*]+)*)?', line)
+            if m:
+                name = m.group(1).lower().strip()
+                version_part = m.group(2)
+                if version_part:
+                    vm = re.search(r'([\d.]+)', version_part)
+                    version = vm.group(1) if vm else ""
+                else:
+                    version = ""
+                deps[name] = version
+        return deps