@aaub-software/dsh-semgrep-sast
适用于 DeepSeek Harness 的 Semgrep SAST 套件和面向模型的扫描工具。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add @aaub-software/dsh-semgrep-sast@0.2.1Semgrep Sast 以 @aaub-software/dsh-semgrep-sast 发布，当前版本为 0.2.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
@aaub-software/dsh-semgrep-sast is a Cordis bundle that registers the
model-facing semgrep_scan tool in
DeepSeek Harness.
The default managed runtime supports Windows x64 and includes CPython 3.14.7 and Semgrep 1.175.0. Users do not need to install Python or Semgrep separately.
DeepSeek Harness and Node.js 24 or newer are required. Install the bundle into the profile you use, for example:
dsh plugin --profile web add @aaub-software/dsh-semgrep-sast
Restart the profile after installation. The agent will then see the
semgrep_scan tool.
p/default ruleset.Version 0.2 returns the public ssc-sast/v1 contract from
@aaub-software/dsh-sast-contract. The Agent receives normalized JSON rather
than native Semgrep output:
{
"schemaVersion": "ssc-sast/v1",
"status": "completed",
"scanner": {
"name": "semgrep",
"version": "1.175.0",
"configuration": "p/default"
},
"scannedPaths": ["src/server.js"],
"findings": [],
"diagnostics": [],
"summary": {
"totalFindings": 0,
"returnedFindings": 0,
"truncated": false,
"durationMs": 125
}
}
Each finding contains a stable ID, scanner attribution, normalized rule
metadata, an exact workspace-relative location, and bounded evidence. Semgrep
matched code and metavariables are exposed as semgrep.matched-code and
semgrep.metavariables evidence when present. CWE, OWASP, references, and
fingerprints are retained only when Semgrep emitted them; the adapter does not
guess missing metadata. Diagnostics remain separate from security findings so
an incomplete scan cannot be mistaken for a clean scan.
On Windows, Semgrep Core cannot open the system certificate store inside the
current Harness ACL sandbox. A restricted first call does not start the scan.
Instead, it returns the standard permission-escalation hint. The model may retry
the same scan with sandbox_permissions: "danger-full-access" and a concise
justification; Harness asks the user for approval before execution.
The default ruleset is obtained from the Semgrep Registry at scan time and may require network access. Registry rules are not redistributed by this package.
See the repository documentation for the complete English and Chinese guide, configuration reference, security controls, development instructions, and third-party license information.
Source: Baiiduu/dsh-semgrep-sast