# omp-security

[oh-my-pi](https://github.com/can1357/oh-my-pi)'s `security_scan` tool for the DeepSeek Harness (DSH). It plans and runs security reviews of the workspace with real scanners plus an **AI triage pass**, produces a **P0–P3 prioritized report**, and keeps findings so they can be validated later.

## Flow

```
security_scan {"action":"preflight","target_kind":"working_tree"}
→ Plan plan-3fa1c2 — working_tree at /repo
  Scope: 4 file(s): api.py, db.py, …
  Scanners: ✓ semgrep ✓ bandit ✓ gitleaks – osv-scanner (not applicable) …
security_scan {"action":"start","plan_id":"plan-3fa1c2"}
→ Security scan scan-2026-10-10-9b1e (operation op-77c0): completed; 3 finding(s) — 0 critical, 2 high, 1 medium …
  AI review (omni/claude-sonnet): Fix the shell injection in api.py first …
  1. [P1 high] subprocess call with shell=True identified, security issue.
     api.py:41 · bandit B602 · CWE-78 · id 4be1c0a9d2
     AI: tp — user input reaches the shell
     Fix: pass an argv list and shell=False
```

| Action | Purpose |
| --- | --- |
| `preflight` | Pin the scope: `target_kind` = `repository` (default), `scoped_path` (+`include_paths`), `working_tree` (uncommitted changes), `ref_diff` (`base_revision`..`head_revision`). Optional `exclude_paths`, `scanners` subset, `ai_review`. Returns a `plan_id` and which scanners apply |
| `start` | Run the plan in the background. Waits up to `wait_seconds` (default 20) and returns the report or progress plus an `operation_id` |
| `status` | `operation_id` or `scan_id`; `wait_seconds`, `min_severity`, `max_findings` |
| `cancel` | Stop a running operation |
| `validate` | Record a verdict on a finding: `scan_id`, `finding_id`, `validation_status` (`validated`/`rejected`/`partial`/`unvalidated`/`error`), `validation_summary`, optional `validation_evidence` |
| `list` | Recent scans |
| `scanners` | Installed scanners and install hints |

**AI review:** a reviewer model (the agent's own model by default, or `reviewProvider`/`reviewModel`) gets:
- every finding with surrounding code;
- the diff (for `working_tree`/`ref_diff`) or the scoped files.

It marks each finding as true or false positive with a reason and a concrete fix, adjusts severity, and adds up to 10 issues the scanners missed. False positives are hidden from the report but kept in the stored scan.

Scans are stored as JSON in `~/.dsh/security-scans/`.

## Scanners

| Scanner | What it finds | Install |
| --- | --- | --- |
| semgrep | SAST rules for 30+ languages (`p/default`) | `pip install --user semgrep` |
| bandit | Python security issues | `pip install --user bandit` |
| gitleaks | Hard-coded secrets (git history for `repository` scans) | [releases](https://github.com/gitleaks/gitleaks/releases) → `~/.local/bin` |
| osv-scanner | Vulnerable dependencies from lockfiles (npm, pnpm, yarn, pip, poetry, go, cargo, maven, …) | [releases](https://github.com/google/osv-scanner/releases) → `~/.local/bin` |
| npm audit | npm advisories for `package-lock.json` projects | bundled with npm |

Missing scanners are skipped and listed in the preflight with install hints.

## Installation

```bash
dsh plugin --profile web add git+https://git.rizzy.dev/DSH-Plugins/omp-security.git
```

Or in the Web UI, go to **Settings → Plugins → Install**. For development, use `link:` to a clone. Restart DSH afterwards.

## Configuration

```yaml
- id: omp-security
  config:
    aiReview: true
    reviewProvider: ''        # empty = the calling agent's provider
    reviewModel: ''           # empty = the calling agent's model
    semgrepConfig: p/default  # any semgrep --config value (registry pack, file, dir)
    maxReviewFindings: 60
```

## Tests

`npm test` runs a scan of a deliberately vulnerable sample with bandit and gitleaks (stubbed reviewer), plus osv-scanner against a vulnerable `requirements.txt`.