v0.1.2

Fixes

• Sentinel no longer a silent no-op — v0.1.x read exec.args, but the host's ToolRuntime.createExecution delivers parsed tool arguments in exec.arguments. Every sentinel rule always passed in production; the test harness mirrored the same wrong shape, which is why earlier verification missed it. The sentinel now reads exec.arguments ?? exec.args, and the harness dispatches the real host shape. (#4)
• Invariant no longer false-fails on routine tool errors — the host runs tools/post-execute for failed calls too, and error results carry no value; the marker check now requires isError !== true. (#4)
• format: "json" implemented — previously documented but ignored; the tool now returns the structured report JSON. (#4)
• Walker: depth pruning sets truncated; unreadable files/dirs are skipped and counted instead of failing the audit; byte-exact reads via bytesRead; code-point ordering instead of localeCompare. (#4)
• sensitiveEnvVars is once more a subset of envVars, as documented. (#4)
• Report card escapes |, backticks and newlines in attacker-controlled text (Markdown table injection). (#4)
• Bundle-patch stats no longer count indented config list items as patch rows. (#4)
• Plugins shipping only build output (dist/lib) can no longer earn a clean info card — zero scanned files forces a notice. (#4)

Features

• Binding-aware detection: import/require aliases are resolved to their local names (readFileSync as rfs, const { execSync: run } = require(...)), vm destructuring caught, map.get( no longer flagged as http.get; async fs methods, export ... from, dynamic import(), URL userinfo/IPv6/trailing-dot extraction, network-library import flagging. (#4)
• New src/events.ts types the host tool-pipeline waterfalls on cordis Events — listener shapes are now compile-time checked (the mechanism that would have caught the sentinel regression at build time). (#4)
• Report card gains a Declared dependencies row. (#4)

Tests

• 24 → 89 tests: hash-based read-only proof, walk caps (files/depth/bytes/unreadable/skipped dirs), manifest branches, report edge rendering (row cap, caveats, Markdown escaping), sentinel rule matrix (allowlist case/wildcards, file-extension fallback, shell key variants, home dotfiles), binding-aware detection matrix, sort-order pins, dist-only evasion. (#4)

Docs

• Example card regenerated from the real renderer; ./src/* export documented as the official template convention; known scanner boundaries (no symlink following, string/comment matches) listed. (#4)

Verification

• pnpm typecheck && pnpm test && pnpm build — all green (89 tests, 8 files).
• Real-environment re-verification: in-process boot of the actual web profile composition against the installed DSH snapshot, dispatching the real host exec shape { name, arguments } — 7/7 PASS, including sentinel ask on cat ~/.ssh/id_rsa and on curl egress to an unlisted host, and a real plugin_audit run (risk=review, findings=10, writesPerformed=false).

Full Changelog: v0.1.1...v0.1.2

v0.1.1

Docs

• Rewrote both READMEs (EN/ZH) around what the project does and how to use it: leads with the problem statement, embeds a real plugin_audit permission card, tabulates the sentinel rules with triggering examples, documents tool arguments in Quick start, and removes machine-specific verification details (full record remains in PR #1 and the v0.1.0 notes).

Verification

• pnpm test — 23/23 green; docs-only change, no code touched.

Full Changelog: v0.1.0...v0.1.1

v0.1.0

Features

• Static audit engine (src/scanner/): read-only walker (400-file / 256 KB caps), capability detection (fs read/write, subprocess, network, env access, credential paths, dynamic exec, patch overrides, manifest) with file/line evidence, package.json + cordis.patch.yml analysis, info / notice / review risk grading.
• plugin_audit tool: audits a local plugin directory and returns a Markdown permission card plus JSON summary { markdown, risk, filesScanned, findingsCount, writesPerformed }. writesPerformed: false is contractual; the optional dsh-plugin-audit/invariant companion fails the session if a result ever loses the marker.
• Runtime sentinel (src/sentinel/): tools/pre-execute waterfall listener returning ask (host approval prompt; degrades to deny without one) for credential-path references, shell egress toward non-allowlisted hosts, and home-directory dotfile writes. Configurable via sentinelEnabled / allowedHosts (schemastery schema).

Fixes

• Bundle patch no longer wires the ./invariant companion: stock web/base profiles do not provide the invariants service, and the pending row blocked boot (found during real-profile verification). The companion remains exported for profiles that do provide it.

Tests

• 23 vitest tests: loader export-shape unwrap, schema defaults, three fixture scans (suspicious / clean / patch-override), Markdown card snapshot, sentinel rule matrix, disposal cleanup, invariant register/fail paths. Fixtures under tests/fixtures/.

Docs

• Bilingual README: README.md (English) / README.zh.md (中文) — overview, compatibility, install (npm + GitHub), uninstall, quick start, configuration, permissions & data, troubleshooting, development, license & security.
• MIT license.

Verification

• pnpm typecheck && pnpm test && pnpm build — all green (23/23).
• Real DSH environment (mainline snapshot 2026-08-14, local web profile): installed via dsh plugin --profile web add; composed profile booted in-process with zero errors (the loader aborts boot on any non-activating entry); plugin_audit resolved via the real ToolRuntime; sentinel returned ask for cat ~/.ssh/id_rsa and delegated pnpm test; end-to-end audit of a suspicious fixture returned risk=review, 10 findings, writesPerformed=false.

Full Changelog: https://github.com/jkrandom-sudo/dsh-plugin-audit/commits/v0.1.0