Release v0.1.2 · jkrandom-sudo/dsh-plugin-audit

Fixes

Sentinel no longer a silent no-op — v0.1.x read exec.args, but the host's ToolRuntime.createExecution delivers parsed tool arguments in exec.arguments. Every sentinel rule always passed in production; the test harness mirrored the same wrong shape, which is why earlier verification missed it. The sentinel now reads exec.arguments ?? exec.args, and the harness dispatches the real host shape. (#4)
Invariant no longer false-fails on routine tool errors — the host runs tools/post-execute for failed calls too, and error results carry no value; the marker check now requires isError !== true. (#4)
format: "json" implemented — previously documented but ignored; the tool now returns the structured report JSON. (#4)
Walker: depth pruning sets truncated; unreadable files/dirs are skipped and counted instead of failing the audit; byte-exact reads via bytesRead; code-point ordering instead of localeCompare. (#4)
sensitiveEnvVars is once more a subset of envVars, as documented. (#4)
Report card escapes |, backticks and newlines in attacker-controlled text (Markdown table injection). (#4)
Bundle-patch stats no longer count indented config list items as patch rows. (#4)
Plugins shipping only build output (dist/lib) can no longer earn a clean info card — zero scanned files forces a notice. (#4)

Binding-aware detection: import/require aliases are resolved to their local names (readFileSync as rfs, const { execSync: run } = require(...)), vm destructuring caught, map.get( no longer flagged as http.get; async fs methods, export ... from, dynamic import(), URL userinfo/IPv6/trailing-dot extraction, network-library import flagging. (#4)
New src/events.ts types the host tool-pipeline waterfalls on cordis Events — listener shapes are now compile-time checked (the mechanism that would have caught the sentinel regression at build time). (#4)
Report card gains a Declared dependencies row. (#4)

24 → 89 tests: hash-based read-only proof, walk caps (files/depth/bytes/unreadable/skipped dirs), manifest branches, report edge rendering (row cap, caveats, Markdown escaping), sentinel rule matrix (allowlist case/wildcards, file-extension fallback, shell key variants, home dotfiles), binding-aware detection matrix, sort-order pins, dist-only evasion. (#4)

Example card regenerated from the real renderer; ./src/* export documented as the official template convention; known scanner boundaries (no symlink following, string/comment matches) listed. (#4)

pnpm typecheck && pnpm test && pnpm build — all green (89 tests, 8 files).
Real-environment re-verification: in-process boot of the actual web profile composition against the installed DSH snapshot, dispatching the real host exec shape { name, arguments } — 7/7 PASS, including sentinel ask on cat ~/.ssh/id_rsa and on curl egress to an unlisted host, and a real plugin_audit run (risk=review, findings=10, writesPerformed=false).

Full Changelog: v0.1.1...v0.1.2