Initial commit: omp-security DSH plugin (oh-my-pi port) with docs and tests

README.md

@@ -0,0 +1,73 @@
+# omp-security
+
+[oh-my-pi](https://github.com/can1357/oh-my-pi)'s `security_scan` tool for the DeepSeek Harness (DSH). It plans and runs security reviews of the workspace with real scanners plus an **AI triage pass**, produces a **P0–P3 prioritized report**, and keeps findings so they can be validated later.
+
+## Flow
+
+```
+security_scan {"action":"preflight","target_kind":"working_tree"}
+→ Plan plan-3fa1c2 — working_tree at /repo
+  Scope: 4 file(s): api.py, db.py, …
+  Scanners: ✓ semgrep ✓ bandit ✓ gitleaks – osv-scanner (not applicable) …
+security_scan {"action":"start","plan_id":"plan-3fa1c2"}
+→ Security scan scan-2026-10-10-9b1e (operation op-77c0): completed; 3 finding(s) — 0 critical, 2 high, 1 medium …
+  AI review (omni/claude-sonnet): Fix the shell injection in api.py first …
+  1. [P1 high] subprocess call with shell=True identified, security issue.
+     api.py:41 · bandit B602 · CWE-78 · id 4be1c0a9d2
+     AI: tp — user input reaches the shell
+     Fix: pass an argv list and shell=False
+```
+
+| Action | Purpose |
+| --- | --- |
+| `preflight` | Pin the scope: `target_kind` = `repository` (default), `scoped_path` (+`include_paths`), `working_tree` (uncommitted changes), `ref_diff` (`base_revision`..`head_revision`). Optional `exclude_paths`, `scanners` subset, `ai_review`. Returns a `plan_id` and which scanners apply |
+| `start` | Run the plan in the background. Waits up to `wait_seconds` (default 20) and returns the report or progress plus an `operation_id` |
+| `status` | `operation_id` or `scan_id`; `wait_seconds`, `min_severity`, `max_findings` |
+| `cancel` | Stop a running operation |
+| `validate` | Record a verdict on a finding: `scan_id`, `finding_id`, `validation_status` (`validated`/`rejected`/`partial`/`unvalidated`/`error`), `validation_summary`, optional `validation_evidence` |
+| `list` | Recent scans |
+| `scanners` | Installed scanners and install hints |
+
+**AI review:** a reviewer model (the agent's own model by default, or `reviewProvider`/`reviewModel`) gets:
+- every finding with surrounding code;
+- the diff (for `working_tree`/`ref_diff`) or the scoped files.
+
+It marks each finding as true or false positive with a reason and a concrete fix, adjusts severity, and adds up to 10 issues the scanners missed. False positives are hidden from the report but kept in the stored scan.
+
+Scans are stored as JSON in `~/.dsh/security-scans/`.
+
+## Scanners
+
+| Scanner | What it finds | Install |
+| --- | --- | --- |
+| semgrep | SAST rules for 30+ languages (`p/default`) | `pip install --user semgrep` |
+| bandit | Python security issues | `pip install --user bandit` |
+| gitleaks | Hard-coded secrets (git history for `repository` scans) | [releases](https://github.com/gitleaks/gitleaks/releases) → `~/.local/bin` |
+| osv-scanner | Vulnerable dependencies from lockfiles (npm, pnpm, yarn, pip, poetry, go, cargo, maven, …) | [releases](https://github.com/google/osv-scanner/releases) → `~/.local/bin` |
+| npm audit | npm advisories for `package-lock.json` projects | bundled with npm |
+
+Missing scanners are skipped and listed in the preflight with install hints.
+
+## Installation
+
+```bash
+dsh plugin --profile web add git+https://git.rizzy.dev/DSH-Plugins/omp-security.git
+```
+
+Or in the Web UI, go to **Settings → Plugins → Install**. For development, use `link:` to a clone. Restart DSH afterwards.
+
+## Configuration
+
+```yaml
+- id: omp-security
+  config:
+    aiReview: true
+    reviewProvider: ''        # empty = the calling agent's provider
+    reviewModel: ''           # empty = the calling agent's model
+    semgrepConfig: p/default  # any semgrep --config value (registry pack, file, dir)
+    maxReviewFindings: 60
+```
+
+## Tests
+
+`npm test` runs a scan of a deliberately vulnerable sample with bandit and gitleaks (stubbed reviewer), plus osv-scanner against a vulnerable `requirements.txt`.