dsh-install-guard

配置

bundle 插入的稳定 row id 是 install-guard。在 profile 的 cordis.patch.yml（默认位于 $DSH_HOME/profiles/web/cordis.patch.yml，未设置 DSH_HOME 时通常是 ~/.dsh/profiles/web/cordis.patch.yml）中覆盖它：

- id: install-guard
  config:
    denySeverity: high
    askSeverity: unknown
    blockedLicenses:
      - GPL
      - AGPL
    allowPackages:
      - '@your-company/*'
    maxBundleSizeKb: 20
    minWeeklyDownloads: 100
    minPackageAgeDays: 30
    typosquatMaxDistance: 1
    failClosed: false

DSH 的后置 patch 会替换该 row 的整个 config，不是深度合并；建议像上面一样列出完整配置。

配置	默认值	说明
denySeverity	high	达到此漏洞等级时拒绝安装。可选 critical、high、medium、low、unknown。
askSeverity	unknown	达到此漏洞等级时要求人工确认。
blockedLicenses	["GPL", "AGPL"]	许可证黑名单；支持 SPDX 名称或系列前缀。
allowPackages	[]	完全跳过审计的包名；支持精确名称和 @scope/*。
maxBundleSizeKb	20	非 tree-shakeable 包允许的最大 gzip 体积（十进制 KB）。
minWeeklyDownloads	100	健康度启发式使用的最低周下载量。
minPackageAgeDays	30	“新且低下载量”检查的最短包龄。
typosquatMaxDistance	1	与内置流行包名比较时允许的最大 Damerau–Levenshtein 距离。
failClosed	false	网络检查失败或只能使用过期缓存时是否要求人工确认。

denySeverity 应不低于 askSeverity 的风险范围；否则高风险项仍会以 deny 优先。白名单会跳过所有四项检查，应谨慎使用。

Configuration

The bundle inserts the stable row id install-guard. Override it in the profile's cordis.patch.yml (normally $DSH_HOME/profiles/web/cordis.patch.yml, or ~/.dsh/profiles/web/cordis.patch.yml when DSH_HOME is unset):

- id: install-guard
  config:
    denySeverity: high
    askSeverity: unknown
    blockedLicenses:
      - GPL
      - AGPL
    allowPackages:
      - '@your-company/*'
    maxBundleSizeKb: 20
    minWeeklyDownloads: 100
    minPackageAgeDays: 30
    typosquatMaxDistance: 1
    failClosed: false

A later DSH patch replaces the row's entire config value rather than deep-merging it, so listing every setting as above is recommended.

Setting	Default	Meaning
denySeverity	high	Deny at or above this vulnerability severity. Values: critical, high, medium, low, unknown.
askSeverity	unknown	Ask for human approval at or above this vulnerability severity.
blockedLicenses	["GPL", "AGPL"]	License denylist; SPDX names and family prefixes are supported.
allowPackages	[]	Package names that bypass the complete audit; supports exact names and @scope/*.
maxBundleSizeKb	20	Maximum gzip size in decimal KB for packages that are not tree-shakeable.
minWeeklyDownloads	100	Minimum weekly downloads used by health heuristics.
minPackageAgeDays	30	Minimum age used by the young-and-unpopular heuristic.
typosquatMaxDistance	1	Maximum Damerau–Levenshtein distance from the built-in popular-package list.
failClosed	false	Ask when a network check fails or only expired cache data is available.

deny always wins over ask when thresholds overlap. An allowlisted package skips all four dimensions; use the allowlist sparingly.