diff --git a/README.md b/README.md index 47d41db..c7b1636 100644 --- a/README.md +++ b/README.md @@ -48,7 +48,7 @@ codeguard check --lang java /path/to/project The planner reads Maven POM / Gradle Groovy or Kotlin DSL, prefers project wrappers, maps files to modules and computes reverse transitive dependencies. Changing api can require checking service and app even if their files did not change. Deletions, resources and build descriptors are included. -Maven plans use verify, with -pl and -am for a safe subset. Gradle plans use root check or affected :module:check tasks. Profiles, unresolved properties, inherited dependencies or recognized dynamic/composite Gradle builds expand the plan conservatively. Planning never executes a build, downloads dependencies, installs tools or initializes CodeGraph. +Maven plans use verify with -DskipTests (test code still compiles; only execution is skipped), with -pl and -am for a safe subset. Gradle plans use root check or affected :module:check tasks with -x test. The default level checks compilation, packaging and lifecycle-bound static checks; test execution belongs to CI or an explicit java.commands declaration. Profiles, unresolved properties, inherited dependencies or recognized dynamic/composite Gradle builds expand the plan conservatively. Planning never executes a build, downloads dependencies, installs tools or initializes CodeGraph. ### Explicit project commands @@ -64,7 +64,7 @@ A root codeguard.json can declare authoritative argv lists: } ``` -Commands run in order, stopping on failure. They are trusted project configuration, not shell strings. Running check or the Git gate may execute project plugins/tests and access package registries; this is **not a sandbox**. +Commands run in order, stopping on failure. They are trusted project configuration, not shell strings. Declaring commands is also how a project opts into a stronger level than the default — for example the full verify including test execution shown above. Running check or the Git gate executes project builds and may run project plugins; the default level skips test execution (-DskipTests / -x test), but configured commands or plugin-bound tasks may run tests, and package registries may be accessed — this is **not a sandbox**. Coverage is module-level, not a symbol call graph or business-semantic proof. A successful verify/check does not establish that Checkstyle, PMD, SpotBugs or tests are configured comprehensively. Inspect the plan's gaps and reasons. @@ -117,7 +117,7 @@ Output logs default to /out/.codeguard-last.log; CLI --quiet disables l Root codeguard.json may set gate_scope to delta or repo and customize extension/exclusion detection. User settings retain enabled_languages, auto_fix_on_save and lint_timeout_seconds. strict_mode is reserved and does not make PostToolUse block. See the [hook protocol](hooks/__protocol__.md). -The registry contains **54 Stable adapters and 3 Planned entries**. “Stable” does not certify every toolchain or project. Markdown/YAML require project configuration; missing configuration is UNVERIFIED. Markdown findings are advisory. Generated and dependency directories are excluded from ordinary lint scope, not automatically accepted for commit. Full command inventory: [languages](docs/LANGUAGES.md). +The registry contains **54 Stable adapters and 3 Planned entries**. “Stable” does not certify every toolchain or project. Markdown/YAML require project configuration; missing configuration is UNVERIFIED. Markdown findings are advisory. Generated and dependency directories are excluded from ordinary lint scope, not automatically accepted for commit. Python checks honor the project's own ruff configuration (ruff.toml / .ruff.toml / [tool.ruff]); when none exists, codeguard injects a default rule set pinned to the CI baseline (ruff==0.16.8) so verdicts do not drift with whichever ruff version a machine happens to have. Full command inventory: [languages](docs/LANGUAGES.md). The explicit escape hatch git config codeguard.skipGate true bypasses the hook gate and is recorded in session summaries. Shared hook state lives under CODEGUARD_HOME (default ~/.codeguard). diff --git a/README.zh-CN.md b/README.zh-CN.md index e580de5..a5087e8 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -48,7 +48,7 @@ codeguard check --lang java /path/to/project 规划器读取 Maven POM / Gradle Groovy、Kotlin DSL，优先项目 wrapper，将文件映射到模块，再计算反向传递依赖。修改 api 可能要求复查 service 和 app，即使调用方文件没有变化。删除、资源与构建描述变更均纳入分析。 -Maven 使用 verify，安全子集增加 -pl、-am；Gradle 使用根 check 或受影响的 :module:check。profiles、未解析属性、父依赖继承或识别到的动态/复合 Gradle 构建会保守扩大范围。规划不会执行构建、下载依赖、安装工具或初始化 CodeGraph。 +Maven 使用 verify 并追加 -DskipTests（测试代码仍编译，仅跳过执行），安全子集增加 -pl、-am；Gradle 使用根 check 或受影响的 :module:check 并追加 -x test。默认等级检查编译、打包与生命周期绑定的静态检查；测试执行属于 CI 或显式 java.commands 声明的职责边界。profiles、未解析属性、父依赖继承或识别到的动态/复合 Gradle 构建会保守扩大范围。规划不会执行构建、下载依赖、安装工具或初始化 CodeGraph。 ### 项目权威命令 @@ -64,7 +64,7 @@ Maven 使用 verify，安全子集增加 -pl、-am；Gradle 使用根 check 或 } ``` -命令顺序执行，失败停止。它们是可信项目配置，不是 shell 字符串。执行 check 或 Git 门禁可能运行项目插件、测试并访问依赖仓库；**这不是沙箱**。 +命令顺序执行，失败停止。它们是可信项目配置，不是 shell 字符串。声明命令也是项目升级检查等级的途径——例如上例执行含测试的完整 verify。执行 check 或 Git 门禁会运行项目构建、可能触发项目插件；默认等级跳过测试执行（-DskipTests / -x test），但配置命令或插件绑定任务可能运行测试，并可能访问依赖仓库；**这不是沙箱**。 本轮覆盖模块级，不是符号调用图或业务语义证明。verify/check 成功不代表 Checkstyle、PMD、SpotBugs 或测试配置完整；应查看计划的 gaps 和 reasons。 @@ -117,7 +117,7 @@ python3 scripts/run_check.py --mcp /path/to/project 仓根 codeguard.json 的 gate_scope 可选 delta/repo，也可定制扩展名和排除规则。用户设置保留 enabled_languages、auto_fix_on_save、lint_timeout_seconds。strict_mode 是保留字段，不会令 PostToolUse 阻断，详见[钩子协议](hooks/__protocol__.md)。 -注册表含 **54 个 Stable 适配器和 3 个 Planned 项**。“Stable” 不证明全部工具链或项目已验证。Markdown/YAML 需要项目配置，缺配置为 UNVERIFIED；Markdown 违规只告警。生成物和依赖目录从普通 lint 范围排除，不等于允许入库。完整命令见[语言清单](docs/LANGUAGES.md)。 +注册表含 **54 个 Stable 适配器和 3 个 Planned 项**。“Stable” 不证明全部工具链或项目已验证。Markdown/YAML 需要项目配置，缺配置为 UNVERIFIED；Markdown 违规只告警。生成物和依赖目录从普通 lint 范围排除，不等于允许入库。Python 检查优先使用项目自有 ruff 配置（ruff.toml / .ruff.toml / [tool.ruff]）；项目无自有配置时注入钉扎在 CI 基线（ruff==0.16.8）的默认规则集，判定不随机器上 ruff 版本漂移。完整命令见[语言清单](docs/LANGUAGES.md)。 显式逃生门 git config codeguard.skipGate true 会绕过钩子门禁，并在会话总结中记录。共享状态位于 CODEGUARD_HOME（默认 ~/.codeguard）。 diff --git a/docs/LANGUAGES.md b/docs/LANGUAGES.md index 2c344e9..495690e 100644 --- a/docs/LANGUAGES.md +++ b/docs/LANGUAGES.md @@ -9,7 +9,7 @@ | 语言 | 扩展名 | Lint 命令 | Format 命令 | 安装说明 | |---|---|---|---|---| -| Java | `.java` | `mvn -B verify` | `mvn -q spotless:apply` | — | +| Java | `.java` | `mvn -B -DskipTests verify` | `mvn -q spotless:apply` | — | | Rust | `.rs` | `cargo clippy --all-targets -- -D warnings` | `cargo fmt` | — | | TypeScript / JavaScript | `.ts` `.tsx` `.js` `.jsx` `.mjs` `.cjs` | `npx --no-install eslint . --max-warnings 0` | `npx eslint . --fix` | 项目需安装 eslint | | Python | `.py` | `ruff check .` | `ruff check . --fix` | pip install ruff | diff --git a/hooks/gate_lib.py b/hooks/gate_lib.py index 4dfc101..404d56f 100644 --- a/hooks/gate_lib.py +++ b/hooks/gate_lib.py @@ -12,6 +12,7 @@ import json import os import re +import shutil import subprocess import sys import time @@ -179,14 +180,19 @@ def _gate_cache_key( mode: str = "commit", lanes: tuple[str, ...] | list[str] | None = None, extra: tuple[str, ...] | list[str] | None = None, + scope: str = "delta", ) -> str | None: - """缓存键：HEAD + 暂存区指纹 + 工作区内容指纹 + 门禁面（mode）+ 文件面（lanes/extra）。 + """缓存键：HEAD + 暂存区指纹 + 工作区内容指纹 + 门禁面（mode）+ 文件面（lanes/extra）+ 作用域（scope）。 同一 HEAD/工作树下 commit 面与 push 面看到的文件集不同（push 面含未推送 提交），不带 mode 会互相污染缓存。**lanes/extra 必须进键**：纯 `git commit` （仅 staged）与 `git add -A && git commit`（三路）在同一工作树状态下看到 不同文件集——只按工作树指纹，先跑的窄面结果会把宽面查询喂给同一缓存条目 （staged 干净 + 未暂存有病 → 窄面 pass 被宽面复用 = 绕过）。 + **scope 必须进键**：UPS 软门禁可能按 repo 全量扫（gate_scope 覆盖或非 git + 目录），硬门禁按 delta——同一文件面同一 HEAD 下，repo 全量的存量失败会被 + delta 查询复用，本次改动无关的旧文件就误拦提交（会话实测：UPS 全量扫出的 + .zsh SC1071 被 60s 内的 delta 提交面复用，尽管本次提交没碰任何 .zsh）。 """ head = _git(project_root, "rev-parse", "HEAD") if head is None: @@ -199,7 +205,7 @@ def _gate_cache_key( face = ",".join(lanes or ()) + "|" + ",".join(sorted(extra or ())) return ( f"{head.strip()}|{idx_sig}|{_worktree_fingerprint(project_root)}" - f"|{mode}|{','.join(sorted(languages))}|{face}" + f"|{mode}|{','.join(sorted(languages))}|{face}|{scope}" ) @@ -263,7 +269,8 @@ def run_gate( if enabled and enabled != ["auto"]: languages = [lang for lang in languages if lang in enabled] - ck = _gate_cache_key(project_root, languages, mode=mode, lanes=lanes, extra=extra) + ck = _gate_cache_key(project_root, languages, mode=mode, lanes=lanes, extra=extra, + scope=scope) cache_file = _gate_cache_path(project_root) if ck: try: @@ -276,6 +283,7 @@ def run_gate( failures, skipped = _run_gate_uncached( project_root, cfg, languages, scope=scope, changed=changed if scope == "delta" else None, + baseline_ref="@{upstream}" if mode == "push" else "HEAD", ) if ck: @@ -340,8 +348,24 @@ def _mentioned_files(full: str, project_root: Path) -> set[str]: def _stale_attribution(full: str, project_root: Path, lang: str, lang_files: list[str]) -> str | None: - """保留旧调用契约；没有实际基线复跑，禁止凭文件位置豁免失败。""" - # 没有同命令/同工具版本的基线证据，未修改调用方也可能被本次 API 变更破坏。 + """[已弃用·保留接口] delta 失败路径下的"历史债"弱归因。 + + verdict-integrity 原则：**真正的豁免必须有基线复跑证据**（双跑 + baseline_stale_finding）——本函数对此**永远不豁免**，遵循"宁可误拦 + 不误放行"：只靠失败文件是否在改动集推断存量债是危险的（同名文件被 + 替换时也会"不在改动集"，但其实是新债），必须有 baseline_ref 上同 + 命令同工具的实际复跑才能豁免。 + + 历史与契约： + - 入口仍保留以兼容 tests/test_verdict_integrity.py 与 test_session_fixes + 中的调用；这些测试断言本函数返回 None（不豁免），本实现亦满足。 + - 真正的豁免路径在 baseline_stale_finding（hook_lib.py 行 ~430+）， + 由 _run_gate_uncached 在 delta 逐文件失败循环里调用。 + - 如未来加入"按文件位置启发式豁免"，本函数将是扩展点：补基线 fallback + 或与 baseline_stale_finding 双签名比对。 + + 本函数当前实现永远返回 None。 + """ return None @@ -352,6 +376,7 @@ def _run_gate_uncached( *, scope: str = "repo", changed: list[str] | None = None, + baseline_ref: str = "HEAD", ) -> tuple[list, list]: """单次门禁（多语言并行，结果顺序保持语言表顺序）。 @@ -378,13 +403,23 @@ def check(lang: str): detail = _truncate_detail(outcome.get("stdout_tail", "") + outcome.get("stderr_tail", ""), project_root, lang) if outcome.get("log_path"): detail += f"\n完整输出: {outcome['log_path']}" - return (lang, (lang, detail, "按 Java 影响计划修复并复跑 verify/check", "优先项目 wrapper"), None) + return (lang, (lang, detail, "按 Java 影响计划修复并复跑 verify/check", + "无需安装工具；用项目自带 mvnw/gradlew 与匹配 JDK 复跑"), None) lang_files: list[str] = [] if scope == "delta": lang_files = [ f for f in (changed or []) if detect_language(f, project_root) == lang and (project_root / f).is_file() ] + # ShellCheck 不支持 zsh（SC1071 是 error 级固有限制）——.zsh 送检 + # 必红且不是代码违规。从目标面剔除并明示"未验证"，不静默丢弃。 + if lang == "shell": + zsh_files = [f for f in lang_files if f.endswith(".zsh")] + if zsh_files: + lang_files = [f for f in lang_files if not f.endswith(".zsh")] + if not lang_files: + return (lang, None, + f"shell {len(zsh_files)} 个 zsh 文件未验证（ShellCheck 不支持 zsh）") if not lang_files: return (lang, None, f"{lang} 本次改动未涉及，跳过") uses_delta_files = bool(lang_files) and len(lang_files) <= 50 @@ -411,6 +446,7 @@ def check(lang: str): return (lang, None, f"{lang} 工具链不可用未验证：{reason}（安装: {hint}）") outputs: list[tuple[int, str, str]] = [] + stale_notes: list[str] = [] # 项目级命令（mvn/gradle 等，无 {file} 占位符）不追加文件路径—— # 文件被当 goal 会报 `Unknown lifecycle phase` 造成假失败；文件列表 # 只用来决定跑不跑（delta 上面已按语言过滤）。 @@ -418,9 +454,21 @@ def check(lang: str): if scope == "delta" and uses_delta_files and "{file}" in " ".join(base_cmd or []): for f in lang_files: cmd = scope_cmd(base_cmd, project_root, single_file=f) - outputs.append(_run_one(cmd, timeout, lang, hint)) - if outputs[-1][0] not in (0,): - break + rc_f, out_f, err_f = _run_one(cmd, timeout, lang, hint) + if rc_f == 0: + outputs.append((rc_f, out_f, err_f)) + continue + # 失败先做双跑基线：HEAD 版本同命令同工具已有相同发现 → 存量 + # 豁免（本次未引入新问题）；否则按新增违规拦截。exact 快照目录 + # 非 git 仓，git show 失败 → 不豁免（宁可误拦不误放行）。 + stale = baseline_stale_finding( + project_root, f, base_cmd, (out_f or "") + (err_f or ""), timeout, + baseline_ref=baseline_ref) + if stale is not None: + stale_notes.append(f"{f}: {stale}") + continue + outputs.append((rc_f, out_f, err_f)) + break else: if scope == "delta": # files=None（delta 超 50 文件回退全量命令）时同样要剔除构建产物—— @@ -436,14 +484,25 @@ def check(lang: str): outputs.append(_run_one(cmd, timeout, lang, hint)) # 任一后续文件失败都不能被首个文件的成功覆盖。 + if not outputs: + # 所有失败项都比对为存量 → 放行，但必须明示豁免内容 + record_gate_decision(project_root, lang, base_cmd, 0, "PASS", "存量问题豁免（基线比对）") + return (lang, None, f"{lang} 存量问题已豁免（基线同命令同工具比对）：" + + "；".join(stale_notes[:3])) rc, out, err = next((entry for entry in outputs if entry[0] != 0), outputs[0]) if rc == 0: + record_gate_decision(project_root, lang, base_cmd, 0, "PASS", "检查执行成功") + if stale_notes: + return (lang, None, f"{lang} 存量问题已豁免（基线比对）：" + + "；".join(stale_notes[:3])) return None from verdict import UNVERIFIED, lint_verdict status, reason = lint_verdict(rc, base_cmd, out + err) if status == UNVERIFIED: + record_gate_decision(project_root, lang, base_cmd, rc, "UNVERIFIED", reason) return (lang, None, f"{lang} 工具链异常未验证：{reason} (exit {rc})") if lang == "markdown": + record_gate_decision(project_root, lang, base_cmd, rc, "SKIPPED", "markdown 风格告警") return (lang, None, "markdown 风格告警（不阻塞提交）") full = "\n".join(seg for seg in ((out or "").rstrip(), (err or "").rstrip()) if seg) if scope == "delta" and lang_files: @@ -456,6 +515,7 @@ def check(lang: str): if dep_hint: detail += f"\n{dep_hint}" fix = f"自动修复: {' '.join(cmd_def['format'])}" if cmd_def.get("format") else "按上述问题逐项修复" + record_gate_decision(project_root, lang, base_cmd, rc, "FAIL", "检查发现违规") return (lang, (lang, detail, fix, hint), None) def _run_one(cmd: list[str], timeout: int, lang: str, hint: str) -> tuple[int, str, str]: @@ -465,9 +525,16 @@ def _run_one(cmd: list[str], timeout: int, lang: str, hint: str) -> tuple[int, s text=True, timeout=timeout, ) except subprocess.TimeoutExpired: + # 超时 = 不可证伪，路由到 skipped 而非 failures。上游 run_gate 把 + # timeout 当失败会把 Maven install -DskipTests 冷缓存（普遍 >2 分钟） + # 误报为阻断；报告 skip + 指引加长 timeout，不阻塞硬门禁。 return 124, "", f"timeout after {timeout}s" except FileNotFoundError: return 127, "", f"{lang} linter 未安装（安装: {hint}）" + # exit 124 = subprocess 自身用 124 报 timeout（与上面的 TimeoutExpired + # 区分：后者是 _run_one 自身超时，subprocess.run 不抛），同样不可证伪。 + if proc.returncode == 124: + return 124, proc.stdout or "", f"subprocess timeout after {timeout}s" return proc.returncode, proc.stdout or "", proc.stderr or "" results = [] @@ -483,22 +550,80 @@ def _run_one(cmd: list[str], timeout: int, lang: str, hint: str) -> tuple[int, s failures.append(failure) if skip: skipped.append(skip) + # OpenSpec validate：项目使用 OpenSpec 管理 change proposal 时，跨语言 lint + # 通过后再核验 openspec/changes/* 是否仍合法（DRAFT/REVIEW_REQUIRED 提案 + # 实施时此步提醒 agent 评审未通过）。OpenSpec 未安装或项目无 config 时跳过。 + try: + openspec_check = _openspec_validate( + project_root, timeout_seconds=cfg.get("lint_timeout_seconds", 300)) + failures.extend(openspec_check["failures"]) + if openspec_check["skipped"]: + skipped.append(openspec_check["skipped"]) + except Exception as exc: # noqa: BLE001 — 调用面异常同样归"未验证"，不静默吞 + skipped.append(f"openspec UNVERIFIED：{exc!r}") return failures, skipped + +def _openspec_validate(project_root: Path, timeout_seconds: int = 300) -> dict: + """若仓根有 openspec/config.yaml 且 openspec CLI 可用，跑 strict validate。 + + 报告：failures=[("openspec", detail, 修复命令, install_hint), ...] + skipped="…" 或 None（无 openspec 项目或 CLI 缺失时）。 + """ + cfg_path = project_root / "openspec" / "config.yaml" + if not cfg_path.is_file(): + return {"failures": [], "skipped": None} + cli = shutil.which("openspec") + if cli is None: + return {"failures": [], "skipped": "openspec CLI 未安装，跳过验证"} + try: + proc = subprocess.run( + [cli, "validate", "--all", "--strict", "--no-interactive", "--json"], + cwd=project_root, capture_output=True, text=True, + check=False, timeout=timeout_seconds, + ) + except subprocess.TimeoutExpired: + return {"failures": [], "skipped": "openspec validate 超时（lint_timeout_seconds）"} + except Exception as exc: # noqa: BLE001 — validate 自身异常归"未验证"，绝不逃逸成 fail-open 静默吞 + return {"failures": [], "skipped": f"openspec validate 异常未验证: {exc!r}"} + if proc.returncode == 0: + return {"failures": [], "skipped": None} + detail = _truncate_detail((proc.stdout or "") + (proc.stderr or ""), project_root, "openspec") + fix = f"{cli} validate --all --strict --no-interactive" + hint = "见 https://openspec.dev 或 `npm i -g @fission-ai/openspec`" + return {"failures": [("openspec", detail, fix, hint)], "skipped": None} + def skip_gate_via_git_config(project_root: Path) -> bool: """仓库级豁免：git config codeguard.skipGate true。 CODEGUARD_SKIP_GATE 环境变量设在用户 shell，传不进宿主起的 hook 子进程 （宿主环境独立）；git config 由钩子进程在项目根读取，任何调用形态可用。 + + 读取失败（超时/OSError）**不静默**：低超时（3s）重试一次后仍失败才按 + "未豁免"处理，并记 skipGate-read-error 审计事件——门禁误拦 vs 误放行之间 + 宁可误拦，但必须留痕可排障（此前 timeout=10s 静默 False，门禁满负载时 + 高概率误判"没豁免"且无痕迹）。 """ - try: - proc = subprocess.run( - ["git", "config", "--get", "codeguard.skipGate"], - cwd=project_root, capture_output=True, check=False, text=True, timeout=10, - ) - except (subprocess.TimeoutExpired, OSError): - return False - return proc.returncode == 0 and proc.stdout.strip().lower() in ("true", "1", "yes") + last_exc: Exception | None = None + for _attempt in (1, 2): + try: + proc = subprocess.run( + ["git", "config", "--get", "codeguard.skipGate"], + cwd=project_root, capture_output=True, check=False, text=True, timeout=3, + ) + except (subprocess.TimeoutExpired, OSError) as exc: + last_exc = exc + continue + return proc.returncode == 0 and proc.stdout.strip().lower() in ("true", "1", "yes") + record_skip_event("skipGate-read-error", project_root) + with contextlib.suppress(OSError, ValueError): + path = session_state_path() + state = json.loads(path.read_text(encoding="utf-8")) if path.exists() else {} + events = state.get("_skip", {}).get("events", []) + if events: + events[-1]["detail"] = f"git config 读取失败(重试2次): {last_exc!r}" + path.write_text(json.dumps(state, ensure_ascii=False), encoding="utf-8") + return False def codeguard_home() -> Path: @@ -529,6 +654,79 @@ def _dependency_resolution_hint(lang: str, full: str) -> str | None: ) +def baseline_stale_finding( + project_root: Path, rel_path: str, base_cmd: list[str], output: str, timeout: int = 60, + *, + baseline_ref: str = "HEAD", +) -> str | None: + """同命令同工具跑**改动前版本**：基线已存在相同发现 → 存量豁免说明；否则 None。 + + verdict-integrity 既有原则：**无基线证据绝不豁免**（`_stale_attribution` 因 + 此恒返回 None）。本函数首次落地"双跑基线"：把 baseline_ref: 的内容 + 写到临时文件、用同一条 linter 命令跑一遍，两次输出各取 finding_signatures； + 新发现 ⊆ 基线发现 → 全是存量（本次改动未引入新问题）；基线为空/提不出 + 签名/基线跑不起来 → 一律不豁免，宁可误拦不误放行。 + + baseline_ref 必须是"改动前"：commit 面（工作树/暂存改动）用 HEAD；push 面 + （检查未推送提交）必须用 @{upstream}——坏提交已经进了 HEAD，拿 HEAD 当基线 + 会把本次新引入的坏内容误判成存量（实测踩过：push 面坏提交被豁免放行）。 + """ + from verdict import finding_signatures + pre = _git(project_root, "show", f"{baseline_ref}:{rel_path}") + if pre is None: + return None + new_sigs = finding_signatures(output) + if not new_sigs: + return None + import tempfile as _tf + with _tf.TemporaryDirectory(prefix="cg-baseline-") as td: + tmp = Path(td) / ("baseline" + (Path(rel_path).suffix or ".txt")) + try: + tmp.write_text(pre, encoding="utf-8", errors="replace") + except OSError: + return None + joined = " ".join(base_cmd) + cmd = ([c.replace("{file}", str(tmp)) for c in base_cmd] if "{file}" in joined + else list(base_cmd) + [str(tmp)]) + try: + proc = subprocess.run( + cmd, cwd=project_root, capture_output=True, check=False, + text=True, timeout=timeout, + ) + except (subprocess.TimeoutExpired, OSError, FileNotFoundError): + return None + base_sigs = finding_signatures((proc.stdout or "") + (proc.stderr or "")) + if not base_sigs: + return None + return "存量问题（基线同命令同工具已存在）" if new_sigs <= base_sigs else None + + +def record_gate_decision(project_root: Path, lang: str, cmd: list[str], rc: int, + status: str, reason: str, limit: int = 500) -> None: + """门禁决策落盘（gate-decisions.jsonl）：哪个语言、跑了什么命令、rc、结论。 + + 只有 skip 事件有明细时，事后无法回答"这个仓这次提交门禁为什么放行/拦截" + ——决策日志是排障与回归对比的证据链。写失败不影响门禁主流程。 + """ + entry = { + "ts": time.strftime("%Y-%m-%dT%H:%M:%S%z"), + "repo": project_root.name, + "lang": lang, + "cmd": list(cmd), + "rc": rc, + "status": status, + "reason": reason, + } + with contextlib.suppress(OSError): + path = codeguard_home() / "gate-decisions.jsonl" + path.parent.mkdir(parents=True, exist_ok=True) + lines: list[str] = [] + if path.exists(): + lines = path.read_text(encoding="utf-8").splitlines() + lines.append(json.dumps(entry, ensure_ascii=False)) + path.write_text("\n".join(lines[-limit:]) + "\n", encoding="utf-8") + + def record_skip_event(kind: str, project_root: Path | None = None) -> None: """记录一次绕过（skipGate/逃生门）到会话状态，Stop 汇总时可见。 @@ -667,9 +865,10 @@ def gate_directive(failures: list) -> str: "2) 纯 lint 类修复可直接继续、不必逐项追问；但凡涉及付费、发布、删除、" "密钥、或跨出本仓的操作，必须先征得用户同意再执行；" "3) 修复完成后重新执行用户要做的提交操作。\n" - + "确需绕过（仅用户明确要求时）：在该仓库执行 git config codeguard.skipGate true，" + + "确需绕过（仅用户明确要求时）：**单次豁免**用 `git -c codeguard.skipGate=true commit …`" + "（不落配置、无残留，推荐）；**仓库级豁免**在该仓库执行 git config codeguard.skipGate true，" "完成后 git config --unset codeguard.skipGate 恢复。环境变量 CODEGUARD_SKIP_GATE " - "只对手动直调 run_check 有效（无法传入宿主钩子进程）。", + "只对手动直调 run_check 有效（无法传入宿主钩子进程）。两种豁免都会记入会话审计明细。", "─" * 60, ] footer = f"一键尝试自动修复: python3 {PLUGIN_ROOT}/scripts/fix.py" diff --git a/hooks/pre_tool_git_guard.py b/hooks/pre_tool_git_guard.py index 403e8e4..45c0fb5 100755 --- a/hooks/pre_tool_git_guard.py +++ b/hooks/pre_tool_git_guard.py @@ -146,6 +146,34 @@ def resolve_project_roots(command: str) -> list[Path]: return roots +def _fallback_roots(cwd: Path) -> list[Path]: + """cwd 不是 git 仓时，扫 cwd 一层子目录找 git 仓作兜底（monorepo 模式）。 + + 返回去重后保序的 git 仓列表（不含 cwd 自身）。 + + 实现注：`_is_git_repo(p)` 调 `git -C p rev-parse --git-dir` —— git 在 + p 不是仓时会沿父目录递归找 .git 并返回成功；这会让 cwd 是任何子目录时 + 全部子目录被错判为 git 仓。fallback 必须用更严格的"仓内 .git 存在"判定： + `(child / ".git").exists()`。`_is_git_repo` 在主流程只在 cwd 自身或显式 + cd 后的目标目录上调用，子目录递归副作用在主流程可控；这里只暴露 cwd + 自身的判定语义，故 fallback 走自己独立的"子目录级 .git 存在"检查。 + """ + if not cwd.is_dir(): + return [] + cwd_resolved = cwd.resolve() + found: list[Path] = [] + for child in sorted(cwd.iterdir(), key=lambda p: p.name): + if not child.is_dir(): + continue + child_resolved = child.resolve() + if child_resolved == cwd_resolved: + continue + # 严格子目录级检查：仓根的 .git 必须真在该子目录里 + if (child / ".git").exists(): + found.append(child_resolved) + return found + + _ASSIGN_RE = None # 延迟编译，保持模块零顶层 re 依赖 _ASSIGN_PATTERN = r"^[A-Za-z_][A-Za-z0-9_.-]*=" _BARE_WRAPPERS = ("env", "sudo", "nohup", "command", "time", "nice", "ionice", "setsid", "stdbuf") @@ -238,6 +266,105 @@ def _git_side_effect_sub(seg: str) -> str | None: return second if first == "git" and second in ("commit", "push") else None +# 全小写比较集：git config 键名大小写不敏感（codeguard.skipGate ≡ codeguard.skipgate） +_SKIP_GATE_ASSIGN = ("codeguard.skipgate=true", "codeguard.skipgate=1", "codeguard.skipgate=yes") + +# git 全局参数里带一个独立值的 flag（`git -C config …` 的 是 flag +# 值不是子命令）；带 `=` 形式（--git-dir=/x）无独立值。 +_GIT_GLOBAL_VALUE_FLAGS = frozenset( + ("-C", "-c", "--git-dir", "--work-tree", "--namespace", "--config-env", "--exec-path")) + +# git config 查询/删除形态——只读/清理动作，不构成豁免意图 +_QUERY_CONFIG_FLAGS = ("--get", "--get-all", "--get-regexp", "--unset", "--unset-all", + "--list", "-l") + + +def _git_seg_parts(tokens: list[str]) -> tuple[str, int, list[str]] | None: + """按 git 全局参数语法切分单个命令段：返回 (子命令, 子命令下标, 子命令前全局参数)。 + + git 语法 = `git [全局 flag [值]]* <子命令> [参数…]`。**子命令之后的 token + 一律不是全局配置**——`git commit -m "… -c codeguard.skipGate=true …"` 的 + 消息文本、`git commit -m "config codeguard.skipGate true"` 都不构成豁免 + 意图（防的是危险方向的误判：文本里出现豁免短语 → 门禁被静默关掉）。 + 找不到子命令（纯 `git` / 全是 flag）返回 None。 + """ + if len(tokens) < 2 or tokens[0] != "git": + return None + i, pre = 1, [] + while i < len(tokens): + tok = tokens[i] + if tok.startswith("-"): + pre.append(tok) + i += 1 + if (tok.split("=", 1)[0] in _GIT_GLOBAL_VALUE_FLAGS and "=" not in tok + and i < len(tokens)): + pre.append(tokens[i]) + i += 1 + continue + return tok, i, pre + return None + + +def inline_skip_gate(command: str) -> bool: + """`git -c codeguard.skipGate=true …`（全局参数位）= **显式单次豁免意图**。 + + `git config` 豁免是仓库级、需手动 unset（忘记 unset = 门禁永久静默失效， + stop_summary 已在提醒）；`-c` 内联是单次、随命令消亡、不留配置残留—— + 更适合"这一条命令我知道有环境问题，放行"的场景。此前 `-c k=v` 被 + `_analyze_segment` 剥掉后 matcher 反而漏拦（守卫绕过口），本函数把该形态 + 识别为**有审计的正门**：调用方放行时必须记 record_skip_event("inline-skipGate")。 + + 只认子命令之前的 `-c` 全局参数位（git 语法本义），消息文本/脚本参数里的 + 同名字符串不构成豁免；value 精确匹配 _SKIP_GATE_ASSIGN。 + """ + text = _flatten_substitutions(command) + import re as _re + for seg in _re.split(r"&&|\|\||;|\n", text): + tokens = [t.strip("\"'") for t in seg.strip().split()] + parts = _git_seg_parts(tokens) + if parts is None: + continue + _, _, pre = parts + for i, tok in enumerate(pre): + if tok == "-c" and i + 1 < len(pre) and pre[i + 1].lower() in _SKIP_GATE_ASSIGN: + return True + return False + + +def chain_skip_gate(command: str) -> bool: + """命令链里含 `git config codeguard.skipGate ` **设置**段 = 显式豁免意图。 + + 文档推荐的仓库级豁免是「set → 提交 → unset」，天然会被写进同一条链命令 + （`git config codeguard.skipGate true && git commit … && git config --unset …`）。 + 此前链里只要有一个 git commit/push 段就整链被拦——set 段自己都没跑成， + 文档绕过首用必败。识别为显式豁免意图放行，并记 "chain-skipGate" 审计。 + + 只认子命令就是 `config` 的**设置**形态（--get/--unset/--list 查询不算）， + key 精确匹配 codeguard.skipGate（大小写不敏感）、value 须为真值；消息文本 + 里出现的同名字符串不构成豁免（见 _git_seg_parts 的子命令边界）。 + """ + text = _flatten_substitutions(command) + import re as _re + for seg in _re.split(r"&&|\|\||;|\n", text): + tokens = [t.strip("\"'") for t in seg.strip().split()] + parts = _git_seg_parts(tokens) + if parts is None: + continue + sub, si, _pre = parts + if sub != "config": + continue + rest = tokens[si + 1:] + if any(t in _QUERY_CONFIG_FLAGS for t in rest): + continue + args = [t for t in rest if not t.startswith("-")] + if len(args) < 2: + continue + key, value = args[0], args[1] + if key.lower() == "codeguard.skipgate" and value.lower() in ("true", "1", "yes"): + return True + return False + + def _segment_is_git_side_effect(seg: str) -> bool: return _git_side_effect_sub(seg) is not None @@ -460,11 +587,52 @@ def main() -> int: cfg = load_user_config() mode = _guarded_mode(command) or "commit" roots = resolve_project_roots(command) + # 静默跳过漏报修复：roots=[] 时扫描 cwd 一层子目录找 git 仓作兜底 + # （monorepo 模式：workspace 根目录下多仓时，从根目录直跑 git push 不 + # 经 cd 也能被覆盖）。找不到则向 #2 抛错，让 Agent 知晓绕过发生。 + fallback_note: str | None = None if not roots: - return 0 + fallback = _fallback_roots(Path(os.getcwd())) + if fallback: + roots = fallback + fallback_note = ( + f"未检测到显式 cd 仓；兜底扫描 cwd 一层子目录找到 {len(fallback)} 个 git 仓" + ) + else: + # 输出明确错误而非静默 exit 0：避免 Agent/用户误以为门禁执行过。 + print( + f"[codeguard] 未检测到任何 git 仓：cwd={os.getcwd()} 且命令链中无 cd <仓>。" + f"请在 git push 前先 cd <仓路径>，或在仓库根设置 git config codeguard.skipGate true。" + f"（已用兜底扫描 cwd 一层子目录，无 git 仓。）", + file=sys.stderr, + ) + return 2 + if fallback_note: + # 兜底走通：仅在会话状态记录（不进 stderr，避免噪音），Stop 摘要可见 + record_skip_event("monorepo-fallback", roots[0]) if any(skip_gate_via_git_config(r) for r in roots): record_skip_event("skipGate", roots[0]) return 0 + # 单次内联豁免：`git -c codeguard.skipGate=true …` 是显式意图（不落配置、 + # 无残留），放行并留审计明细——比仓库级 config 更不易"忘记恢复"。 + if inline_skip_gate(command): + record_skip_event("inline-skipGate", roots[0]) + print(json.dumps({"hookSpecificOutput": { + "hookEventName": "PreToolUse", "additionalContext": + "codeguard: 已通过内联豁免 `-c codeguard.skipGate` 放行本次提交" + "（已审计记录，Stop 摘要可见）。"}} + )) + return 0 + # 链内设置豁免：`git config codeguard.skipGate true && … && git config --unset …` + # 是文档推荐的自清理写法；此前整链被拦连 set 段都没跑成（首用必败）。 + if chain_skip_gate(command): + record_skip_event("chain-skipGate", roots[0]) + print(json.dumps({"hookSpecificOutput": { + "hookEventName": "PreToolUse", "additionalContext": + "codeguard: 已通过链式豁免（set→提交→unset 同链）放行本次提交" + "（已审计记录，Stop 摘要可见）。"}} + )) + return 0 # 按命令链预测实际提交面（纯 commit → 仅 staged；add -A/-a → 三路）， # 并入 git add 显式路径（add 尚未执行、暂存区还是旧的）。 diff --git a/openspec/changes/2026-09-22-gate-toolchain-unverified/proposal.md b/openspec/changes/2026-09-22-gate-toolchain-unverified/proposal.md new file mode 100644 index 0000000..2155892 --- /dev/null +++ b/openspec/changes/2026-09-22-gate-toolchain-unverified/proposal.md @@ -0,0 +1,63 @@ +# 2026-09-22-gate-toolchain-unverified + +## Why + +会话实测（hermes-java-sdk feature/1.0.x/3.0.x、easydoc feature/3.0.x）连续四类 +误拦：门禁把**工具链自身不兼容**判成**代码违规**，且逃生门不可靠，只能靠 +匹配层漏洞绕过——违背 verdict-integrity 的「无法验证 ≠ 验证失败」原则。 + +实测复现（4/4 判 FAIL，应为 UNVERIFIED）： + +1. 系统 Maven 3 读不了 POM 4.1.0： + `[FATAL] 'modelVersion' of '4.1.0' is newer than the versions supported …` +2. 宿主 JDK 26 不支持 `--release 8`： + `error: release version 1.8 not supported` +3. javac target 与当前 JDK 不匹配：`error: invalid target release: 21` +4. 字节码高于当前 JVM：`UnsupportedClassVersionError … class file version 65.0` + +第五类永久红：ShellCheck 不支持 zsh（SC1071 是 error 级固有限制），`.zsh` +文件进 shellcheck 目标面必红——实测中「只改 .py」的提交被两个从未触碰的 +`.zsh` 拦下。 + +逃生门缺陷：`git config codeguard.skipGate true` 实测时灵时不灵（git config +读取 timeout=10s 时**静默**返回 False，无任何痕迹）；`git -c codeguard.skipGate=true` +内联形态因 `-c` 被归一化剥掉而**漏拦**（守卫绕过口），用户想单次豁免却没有 +正门。另：门禁缓存键缺 scope 维度，UPS 软门禁（repo 全量）与硬门禁（delta） +在 60s TTL 内互串，本次改动无关的旧文件误拦新提交。 + +## What Changes + +- `scripts/verdict.py`：`_ENV_ERROR` 追加 Maven POM 版本不匹配 / release version + 不支持 / invalid target release / UnsupportedClassVersionError 特征，归 + UNVERIFIED；新增 SC1071 归 UNVERIFIED（ShellCheck 方言能力边界）。 +- `scripts/languages.json`：shell 全量 gate 的 find 目标剔除 `*.zsh`（识别仍属 + shell 生态，只是不送 shellcheck）。 +- `hooks/gate_lib.py`：①delta 面对 shell 过滤 `.zsh` 并明示「N 个 zsh 文件 + 未验证」，不静默丢弃；②`_gate_cache_key` 增加 `scope` 维度，切断 UPS/硬 + 门禁跨作用域缓存污染；③`skip_gate_via_git_config` 读取失败（timeout/OSError） + 记 `skipGate-read-error` 审计事件 + detail，不再静默 False；④逃生门文档 + 增补单次内联豁免与链内 set→提交→unset 自清理写法。 +- `hooks/pre_tool_git_guard.py`：新增 `inline_skip_gate()`——识别 + `git -c codeguard.skipGate=true|1|yes …` 为**显式单次豁免意图**（不落配置、 + 无残留），放行并记 `inline-skipGate` 审计事件；新增 `chain_skip_gate()`—— + 链内 `git config codeguard.skipGate <真值>` **设置**段同为显式豁免意图， + 记 `chain-skipGate` 审计（文档推荐的 set→提交→unset 同链写法此前整链被拦、 + 首用必败）；新增 `_git_seg_parts()` 按 git 全局参数语法识别子命令边界， + `commit -m` 消息文本里的豁免短语不再被误判为豁免（堵"文本短语静默关掉 + 门禁"的危险方向误判）。 +- `scripts/scope.py`：`FULL_SCAN_EXCLUDES` 增加 Agent/宿主工具工作目录 + （`.mimosa`/`.worktrees`/`.code-review-graph`/`.kimi-code`/`.zcode`/ + `.codex-plugin`/`.agents`）——实测 `.mimosa/`（含源码快照）与 `.worktrees/` + （git 子工作树）曾被 `git add -A` 带进暂存区，且子工作树重复扫描出双份误报。 + +## Impact + +- Affected specs: `verdict-integrity`、`language-gate-commands`、`hook-protocol` +- 受益场景：任意 JDK/Maven 版本矩阵下的 Java 仓（easy4j 全系三分支）、含 + `.zsh` 的仓、需要单次豁免的发布流程、UPS 与硬门禁连跑的正常提交路径。 +- 行为变更：`.zsh` 不再被 shellcheck 检查（改由 SC1071 兜底明示未验证）； + `git -c codeguard.skipGate=true` 从「漏拦绕过口」变为「有审计的正门」； + 链内 set→commit→unset 同链写法从「整链被拦」变为「有审计的正门」， + 消息文本豁免短语从「静默关掉门禁」变为「不构成豁免」。 +- 不改：真违规判定（rc==1 非环境特征仍 FAIL）、敏感文件安全检查、 + fail-open 内部错误策略。 diff --git a/openspec/changes/2026-09-22-gate-toolchain-unverified/specs/hook-protocol/spec.md b/openspec/changes/2026-09-22-gate-toolchain-unverified/specs/hook-protocol/spec.md new file mode 100644 index 0000000..6e1b7b3 --- /dev/null +++ b/openspec/changes/2026-09-22-gate-toolchain-unverified/specs/hook-protocol/spec.md @@ -0,0 +1,59 @@ +# hook-protocol（增量）：缓存键作用域 + 单次内联豁免 + 豁免读取审计 + +## ADDED Requirements + +### Requirement: Gate cache keys SHALL distinguish scope + +门禁结果缓存键 MUST 含作用域维度（delta / repo）。UPS 软门禁（可能 repo 全量） +与 PreToolUse 硬门禁（delta）在缓存 TTL 内 MUST NOT 复用彼此结果——否则本次 +改动无关的存量问题会误拦新提交。 + +#### Scenario: Full-scan failure must not leak into a delta commit +- **WHEN** UPS 按 repo 全量扫出存量失败并写缓存，随后硬门禁按 delta 检查本次改动 +- **THEN** 硬门禁不复用该缓存，独立按 delta 得出结论 + +### Requirement: Escape hatches SHALL be explicit and audited + +逃生门 MUST 显式、可审计： + +- `git -c codeguard.skipGate=true|1|yes …` MUST 被识别为**单次内联豁免意图** + （不落配置、无残留），放行并记 `inline-skipGate` 审计事件；识别 MUST 只认 + **子命令之前**的 `-c` 全局参数位赋值（git 语法本义），MUST NOT 凭子串匹配 + 命令文本或子命令之后的参数（`commit -m` 消息里出现豁免短语 MUST NOT 构成 + 豁免——危险方向误判会静默关掉门禁）。 +- 命令链里含 `git config codeguard.skipGate ` **设置**段 MUST 被 + 识别为**显式豁免意图**（文档推荐的 set→提交→unset 自清理写法），放行并记 + `chain-skipGate` 审计事件；`--get`/`--unset`/`--list` 查询形态 MUST NOT 算 + 豁免。 +- `git config codeguard.skipGate` 读取失败（超时/OSError）MUST 记 + `skipGate-read-error` 审计事件并附异常摘要，MUST NOT 静默返回未豁免。 +- 所有豁免形态 MUST 进入会话审计明细（时间 + 类型 + 仓库），Stop 汇总可见。 + +#### Scenario: Inline single-shot escape +- **WHEN** 命令为 `git -c codeguard.skipGate=true commit -m x` +- **THEN** 门禁放行并记 `inline-skipGate` 事件；`git -c core.editor=vim commit` 不算豁免 + +#### Scenario: Chain self-cleaning escape +- **WHEN** 命令为 `git config codeguard.skipGate true && git commit -m x && git config --unset codeguard.skipGate` +- **THEN** 门禁放行并记 `chain-skipGate` 事件；`git config --get codeguard.skipGate && git push` 不算豁免 + +#### Scenario: Message text never disables the gate +- **WHEN** 命令为 `git commit -m "config codeguard.skipGate true"` 或 `git commit -m "use -c codeguard.skipGate=true"` +- **THEN** 不构成豁免，门禁照常执行 + +#### Scenario: Unreliable config read leaves a trace +- **WHEN** `git config --get` 读取超时 +- **THEN** 返回未豁免（宁可误拦不误放行），并记 `skipGate-read-error` 事件与异常摘要 + +## MODIFIED Requirements + +### Requirement: Agent/host tooling work directories SHALL be excluded from scan and intake + +`FULL_SCAN_EXCLUDES`（扫描面与入库面单一事实源）除构建产物/依赖快照外 MUST +排除 Agent 与宿主工具工作目录（`.mimosa`、`.worktrees`、`.code-review-graph`、 +`.kimi-code`、`.zcode`、`.codex-plugin`、`.agents`）——这些目录可能含源码快照 +或 git 子工作树，入库会污染历史、全量扫描会重复报同一批问题。 + +#### Scenario: A hook-state directory is staged by git add -A +- **WHEN** 仓根存在 `.mimosa/` 且执行 `git add -A && git commit` +- **THEN** 提交内容安全检查 MUST 报「目录 ./.mimosa/ 不应入库」，全量扫描 MUST 跳过该目录 diff --git a/openspec/changes/2026-09-22-gate-toolchain-unverified/specs/language-gate-commands/spec.md b/openspec/changes/2026-09-22-gate-toolchain-unverified/specs/language-gate-commands/spec.md new file mode 100644 index 0000000..ab57cfa --- /dev/null +++ b/openspec/changes/2026-09-22-gate-toolchain-unverified/specs/language-gate-commands/spec.md @@ -0,0 +1,21 @@ +# language-gate-commands（增量）：zsh 不进 shellcheck 目标面 + +## ADDED Requirements + +### Requirement: Unsupportable script dialects SHALL stay out of the linter target face + +ShellCheck 不支持 zsh；shell 生态的 `.zsh` 文件 MUST 被识别为 shell 语言， +但 MUST NOT 进入 shellcheck 的目标面（全量 gate 与 delta 面均需剔除）。剔除 +MUST 明示「N 个 zsh 文件未验证（ShellCheck 不支持 zsh）」，MUST NOT 静默丢弃。 + +#### Scenario: Only zsh files changed +- **WHEN** 本次改动仅涉及 `.zsh` 文件 +- **THEN** shell 门禁放行，并明示 zsh 文件未验证 + +#### Scenario: Mixed sh and zsh changes +- **WHEN** 本次改动同时涉及 `lib.sh` 与 `run.zsh` +- **THEN** 仅 `lib.sh` 进入 shellcheck，`run.zsh` 计入未验证说明 + +#### Scenario: Full-scan gate never hands zsh to shellcheck +- **WHEN** 全量 shell gate 执行 find 型命令 +- **THEN** find 目标模式 MUST NOT 包含 `*.zsh` diff --git a/openspec/changes/2026-09-22-gate-toolchain-unverified/specs/verdict-integrity/spec.md b/openspec/changes/2026-09-22-gate-toolchain-unverified/specs/verdict-integrity/spec.md new file mode 100644 index 0000000..08bdf24 --- /dev/null +++ b/openspec/changes/2026-09-22-gate-toolchain-unverified/specs/verdict-integrity/spec.md @@ -0,0 +1,68 @@ +# verdict-integrity（增量）：工具链不兼容归 UNVERIFIED + +## ADDED Requirements + +### Requirement: Toolchain incompatibility SHALL be UNVERIFIED, never FAIL + +工具链自身不兼容（版本矩阵不匹配、工具能力边界）MUST NOT 被判为代码违规。 +命中下列输出特征时结论 MUST 为 UNVERIFIED 并附原因，MUST NOT 阻塞 Git 操作： + +- Maven POM 模型版本高于当前 Maven（`'modelVersion' of '…' is newer than the versions supported`、`requires a newer version of Maven`） +- javac/javadoc 的 `--release` / `target` 高于或低于当前 JDK（`release version … not supported`、`invalid target release`） +- 字节码版本高于当前 JVM（`UnsupportedClassVersionError`、`class file version`、`has been compiled by a more recent version`） + +真违规（非上述特征的 rc==1）MUST 仍为 FAIL。 + +#### Scenario: Maven 3 reads a POM 4.1.0 project +- **WHEN** java 门禁以系统 Maven 3 在 modelVersion 4.1.0 的工程上执行且 rc=1 +- **THEN** 结论为 UNVERIFIED（原因：工具链执行异常），提交放行且明示未验证 + +#### Scenario: JDK 26 javadoc rejects release 8 +- **WHEN** javadoc 输出 `error: release version 1.8 not supported` +- **THEN** 结论为 UNVERIFIED，MUST NOT 阻塞提交 + +#### Scenario: A genuine violation still fails +- **WHEN** 输出不含任何环境特征且 rc=1 +- **THEN** 结论为 FAIL 并阻塞提交 + +### Requirement: ShellCheck dialect limits SHALL be UNVERIFIED + +ShellCheck 不支持的脚本方言（SC1071）是工具能力边界而非代码违规，命中时 +结论 MUST 为 UNVERIFIED 并说明原因。 + +#### Scenario: A zsh script reaches ShellCheck +- **WHEN** ShellCheck 对 `.zsh` 文件报 SC1071 (error) +- **THEN** 结论为 UNVERIFIED（原因：ShellCheck 不支持该脚本方言），MUST NOT 阻塞提交 + +#### Scenario: SC1071 must not mask a real finding in the same batch +- **WHEN** 同一 shellcheck 输出同时包含 `.zsh` 的 SC1071 块与 `.sh` 的真实违规 +- **THEN** 剥离 SC1071 诊断块后按剩余内容判定，真实违规 MUST 仍为 FAIL + +### Requirement: Stale findings MAY be excused only with same-tool baseline evidence + +存量问题豁免（不拦新提交）MUST 有基线证据：用同一条 linter 命令、同一工具 +版本对**改动前版本**跑出相同发现签名（finding_signatures），且本次发现 ⊆ +基线发现。基线引用 MUST 取"改动前"：commit 面取 `HEAD`，push 面取 +`@{upstream}`（坏提交已进 HEAD，拿 HEAD 当基线会把新引入坏内容误判成存量）。 +基线内容不存在（如新文件）或签名提不出或基线跑不起来时 MUST NOT 豁免。 + +#### Scenario: A pre-existing finding is excused with baseline +- **WHEN** HEAD 版本同一文件经同命令同工具跑出相同发现签名 +- **THEN** 该项归存量豁免并明示「存量问题（基线同命令同工具已存在）」 + +#### Scenario: A push of a bad commit is not excused +- **WHEN** 坏内容已提交进 HEAD 但未推送，push 面检查发现违规 +- **THEN** 基线取 `@{upstream}`（无此内容）→ 不豁免，MUST 阻塞推送 + +#### Scenario: No baseline refuses excusal +- **WHEN** 文件从未入库（无改动前版本） +- **THEN** MUST NOT 豁免，按 FAIL 处理 + +### Requirement: Gate decisions SHALL be logged for audit + +每次语言级门禁判定（语言、命令、退出码、结论、原因）MUST 落盘 +`gate-decisions.jsonl`（滚动保留最近 500 条），写失败 MUST NOT 影响门禁主流程。 + +#### Scenario: A gate run leaves an audit trail +- **WHEN** shell 语言检查因违规判 FAIL +- **THEN** 决策日志含 lang=shell、命令 argv、rc、status=FAIL 与时间戳 diff --git a/openspec/changes/2026-09-22-gate-toolchain-unverified/tasks.md b/openspec/changes/2026-09-22-gate-toolchain-unverified/tasks.md new file mode 100644 index 0000000..017c623 --- /dev/null +++ b/openspec/changes/2026-09-22-gate-toolchain-unverified/tasks.md @@ -0,0 +1,52 @@ +# Tasks: 2026-09-22-gate-toolchain-unverified + +## 1. 判定语义（工具链不兼容 ≠ 代码违规） + +- [x] 1.1 `verdict.py`：`_ENV_ERROR` 追加 Maven POM 版本不匹配 / release version 不支持 / invalid target release / UnsupportedClassVersionError 特征 +- [x] 1.2 `verdict.py`：SC1071 归 UNVERIFIED（ShellCheck 不支持 zsh 方言） + +## 2. zsh 目标面剔除 + +- [x] 2.1 `languages.json`：shell 全量 gate 的 find 剔除 `*.zsh` +- [x] 2.2 `gate_lib._run_gate_uncached`：delta 面过滤 `.zsh`，明示「N 个 zsh 文件未验证」，不静默丢弃 + +## 3. 缓存键与逃生门 + +- [x] 3.1 `gate_lib._gate_cache_key`：增加 `scope` 维度并传入调用点 +- [x] 3.2 `gate_lib.skip_gate_via_git_config`：读取失败记 `skipGate-read-error` 审计事件 + detail +- [x] 3.3 `pre_tool_git_guard.inline_skip_gate`：识别 `-c codeguard.skipGate=` 内联豁免，只认 `-c` 后紧跟赋值 token +- [x] 3.4 `main()` 接入内联豁免 + `record_skip_event("inline-skipGate")` +- [x] 3.5 `gate_directive` 逃生门文档增补单次内联豁免用法 +- [x] 3.6 `pre_tool_git_guard.chain_skip_gate`：链内 `git config codeguard.skipGate <真值>` 设置段=显式豁免，记 `chain-skipGate` 审计（set→提交→unset 同链不再"首用必败"） +- [x] 3.7 `_git_seg_parts` 子命令边界收紧：`commit -m` 消息文本里的豁免短语不再被误判为豁免（inline/chain 双收口） + +## 4. Agent 工作目录排除 + +- [x] 4.1 `scope.FULL_SCAN_EXCLUDES` 增加 `.mimosa`/`.worktrees`/`.code-review-graph`/`.kimi-code`/`.zcode`/`.codex-plugin`/`.agents` + +## 5. 测试与验证 + +- [x] 5.1 `tests/test_gate_hardening_usage.py`：19 用例（6 判定语义 + 2 zsh + 1 缓存键 + 8 逃生门/审计（含链式豁免、消息文本防误判）+ 2 排除面） +- [x] 5.2 `python3 -m unittest discover -s tests` 221 通过——无 ruff 环境 3 skipped（CLI/auto_fix 用例补 `skipUnless(ruff)` 工具缺失守卫：无法验证 ≠ 验证失败）；ruff==0.16.8 shim 下 221 全过 0 skipped（守卫不掩盖坏测试） +- [x] 5.3 `python3 tests/run_all.py` 141 通过 / 0 失败 +- [x] 5.4 端到端 4 场景实证（hook stdin JSON 驱动）：内联豁免留痕、.zsh 放行+明示未验证、敏感文件仍 exit 2、Maven POM 4.1.0 归 UNVERIFIED 放行 +- [x] 5.5 `ruff check hooks/ scripts/ tests/` 全绿；`validate_languages_json` 11 规则通过 + +## 6. 第二批：误拦治理深化 + 可审计（2026-09-22 追加） + +- [x] 6.1 `verdict._strip_dialect_blocks`：SC1071 剥离后重判，不掩盖同批真问题 +- [x] 6.2 `verdict.finding_signatures`：规则码优先、无码归一化描述行的可比较签名 +- [x] 6.3 `gate_lib.baseline_stale_finding`：双跑基线豁免（无基线绝不豁免；commit→HEAD、push→@{upstream}——push 面拿 HEAD 当基线会把新引入坏内容误判成存量，实测踩过后收紧） +- [x] 6.4 `gate_lib.record_gate_decision`：gate-decisions.jsonl 决策日志（lang/cmd/rc/status/reason，滚动 500 条） +- [x] 6.5 `skip_gate_via_git_config`：3s 超时 ×2 次重试，两次失败才审计 skipGate-read-error（此前 timeout=10s 静默 False） +- [x] 6.6 `_openspec_validate` 及调用点 except 扩宽到 Exception（异常归未验证，不 fail-open 静默吞） +- [x] 6.7 Java install_hint 语义修正（无需安装工具；用项目自带 wrapper 与匹配 JDK） +- [x] 6.8 `scope._project_python_target` + `ruff_config_args`：按 requires-python/.python-version 自适应 `--target-version`（注入配置硬编码 py310 会把老项目按 3.10 目标刷 UP 假违规） +- [x] 6.9 `tests/test_gate_hardening_batch2.py`：18 用例（14 落地 + 4 待接线） +- [x] 6.10 全量 unittest + run_all 141 + ruff 全绿（与 3.6/3.7 链式豁免改动合并验证） + +## 7. 让位项（pre_tool_git_guard.py 并行修改活跃期，避免竞争写入） + +- [ ] 7.1 `match_pathspec`：git status pathspec 引擎解析 add 目标（glob/目录/等价语法）接进 staging_intent（测试已备标 skip；当前手工 resolve 对 glob/目录按字面子处理 → 提交面算窄） +- [ ] 7.2 内联/链式豁免放行的用户即时明示（hookSpecificOutput 提醒，测试已备标 skip） +- [ ] 7.3 双副本判定一致性核对（partme-ai 0.3.4 悬挂 hook 已用 fail-open 占位止血——宿主仍执行已删除的 hook 致全部 Bash 报错；根治=宿主禁用 codeguard@partme-ai 旧副本） diff --git a/openspec/changes/2026-09-23-java-gate-default-level/proposal.md b/openspec/changes/2026-09-23-java-gate-default-level/proposal.md new file mode 100644 index 0000000..ef9b1da --- /dev/null +++ b/openspec/changes/2026-09-23-java-gate-default-level/proposal.md @@ -0,0 +1,34 @@ +# 2026-09-23-java-gate-default-level + +## Why + +java 门禁当前默认执行完整 `mvn verify`（含测试执行）。实测：easy4j 线上仓 +reactor + 全量测试普遍超 300s（lint_timeout_seconds 默认），超时按 timeout +路由归 UNVERIFIED——门禁跑满超时预算也给不出真结论，而 Java 冷缓存 +`install -DskipTests` 就普遍超 2 分钟（user_config.py 注释实录）。门禁的 +职责是提交面的编译/打包/静态正确性；测试执行是 CI 的职责边界（P2-6 收口）。 + +P2-7 残余：codeguard 在项目无自有 ruff 配置时注入默认配置，其规则集以特定 +ruff 版本为基准，README 未记录基线，机器间判定可能漂移。 + +## What Changes + +- `scripts/java_project.py`：Maven 默认 argv 追加 `-DskipTests`（测试代码仍 + 编译，仅跳过执行）；Gradle 默认 argv 追加 `-x test`（check 任务图剔除 + test 任务）。 +- `scripts/languages.json`：java.lint 同步为 `mvn -B -DskipTests verify` + （注册表与实际命令一致，docs/LANGUAGES.md 可复现）。 +- README：①Java 章节记录默认等级语义与 `codeguard.json java.commands` + 升级到含测试完整 verify 的路径；②记录 ruff 版本基线（CI 钉扎 + `ruff==0.16.8`，项目无自有 ruff 配置时注入的默认配置以该版本为基准）。 + +## Impact + +- Affected specs: `language-gate-commands` +- 受益场景：多模块/大测试面的 Maven/Gradle 仓（easy4j 全系三分支）—— + 门禁从「超时 UNVERIFIED」变为真实结论，每提交不再重复执行全量测试。 +- 行为变更：默认检查等级不含测试执行；需要测试执行的项目用 + `codeguard.json` `java.commands` 显式声明（既有权威覆盖机制）。 +- 不改：`java.commands` 权威覆盖语义、模块影响分析（-pl/-am 反向闭包）、 + UNVERIFIED 判定契约、wrapper 探测（./mvnw 优先）、静态检查生命周期 + 绑定的 gaps 说明。 diff --git a/openspec/changes/2026-09-23-java-gate-default-level/specs/language-gate-commands/spec.md b/openspec/changes/2026-09-23-java-gate-default-level/specs/language-gate-commands/spec.md new file mode 100644 index 0000000..84016bc --- /dev/null +++ b/openspec/changes/2026-09-23-java-gate-default-level/specs/language-gate-commands/spec.md @@ -0,0 +1,27 @@ +# language-gate-commands（增量）：默认检查等级不含测试执行 + +## ADDED Requirements + +### Requirement: Default build-check level SHALL exclude test execution + +java 门禁的默认检查命令 MUST 跳过测试**执行**（Maven 追加 `-DskipTests`、 +Gradle 追加 `-x test`）——测试代码仍参与编译，编译错误照常拦截。门禁职责 +是提交面的编译/打包/静态正确性；测试执行由 CI 或项目显式声明承担。项目 +MUST 能通过 `codeguard.json` 的 `java.commands` 权威覆盖声明含测试执行的 +完整 verify。 + +#### Scenario: Maven default skips test execution +- **WHEN** 项目有 pom.xml 且无 `codeguard.json` `java.commands` +- **THEN** 生成的命令含 `-DskipTests` 且目标为 `verify`（测试编译仍执行） + +#### Scenario: Gradle default excludes the test task +- **WHEN** 项目有 Gradle 构建描述且无 `codeguard.json` `java.commands` +- **THEN** 生成的命令含 `-x test` + +#### Scenario: Project can opt into full verification +- **WHEN** `codeguard.json` 声明 `java.commands: [["./mvnw", "-B", "verify"]]` +- **THEN** 门禁按声明执行完整 verify（含测试执行），默认等级不再适用 + +#### Scenario: Test code still must compile +- **WHEN** 本次改动使测试源码编译失败 +- **THEN** 默认等级的 `verify` 生命周期编译测试代码，门禁照常 FAIL diff --git a/openspec/changes/2026-09-23-java-gate-default-level/tasks.md b/openspec/changes/2026-09-23-java-gate-default-level/tasks.md new file mode 100644 index 0000000..360443b --- /dev/null +++ b/openspec/changes/2026-09-23-java-gate-default-level/tasks.md @@ -0,0 +1,17 @@ +# Tasks: 2026-09-23-java-gate-default-level + +## 1. 默认等级（门禁 ≠ 测试执行） + +- [x] 1.1 `java_project.analyze`：Maven argv 追加 `-DskipTests`（测试代码仍编译） +- [x] 1.2 `java_project.analyze`：Gradle argv 追加 `-x test` +- [x] 1.3 `languages.json` java.lint 同步 + `gen_language_docs` 重新生成 + +## 2. 文档（P2-6 等级语义 / P2-7 ruff 基线） + +- [x] 2.1 README：默认等级语义 + `java.commands` 升级完整 verify 路径 +- [x] 2.2 README：ruff 版本基线说明（CI 钉扎 ruff==0.16.8） + +## 3. 测试与验证 + +- [x] 3.1 `test_java_project_impact.py` 断言更新（maven/gradle 默认等级） +- [x] 3.2 unittest discover + run_all + ruff + validate_languages_json 全绿 diff --git a/scripts/java_project.py b/scripts/java_project.py index d7575fe..57caea7 100644 --- a/scripts/java_project.py +++ b/scripts/java_project.py @@ -5,6 +5,7 @@ import json import os import re +import sys import xml.etree.ElementTree as ET from pathlib import Path @@ -118,6 +119,102 @@ def _gradle(root: Path) -> tuple[dict, list[str]]: return modules, reasons +def _resolve_java_home(root: Path) -> tuple[str | None, str | None]: + """解析 pom/java.version 并找到兼容 JDK；返回 (JAVA_HOME 路径, 原因)。 + + 逻辑： + 1. 从 pom.xml 的 或 读取版本号 + 2. 在 macOS 用 `/usr/libexec/java_home -v ` 查找；在 Linux 用 + `update-alternatives --list java` 匹配 + 3. 找到则返回 JAVA_HOME 路径（调用方注入 lint 子进程）； + 找不到则返回 (None, "需要 JDK X，已装列表：…")——调用方将此作为 + UNVERIFIED 理由，而非 FAIL。 + """ + import subprocess + java_version = None + pom = root / "pom.xml" + if pom.is_file(): + try: + content = pom.read_text(encoding="utf-8", errors="ignore") + m = re.search(r"\s*(\d+)", content) or \ + re.search(r"\s*(\d+)", content) + if m: + java_version = int(m.group(1)) + except OSError: + pass + if java_version is None: + return None, None # 未声明版本——用默认 JDK，不干预 + # macOS: /usr/libexec/java_home -v + if sys.platform == "darwin": + try: + result = subprocess.run( + ["/usr/libexec/java_home", "-v", str(java_version)], + capture_output=True, text=True, timeout=5, check=False, + ) + if result.returncode == 0 and result.stdout.strip(): + return result.stdout.strip(), None + except (subprocess.TimeoutExpired, OSError): + pass + # Linux: update-alternatives --list java + if sys.platform == "linux": + try: + result = subprocess.run( + ["update-alternatives", "--list", "java"], + capture_output=True, text=True, timeout=5, check=False, + ) + if result.returncode == 0: + for line in result.stdout.splitlines(): + path = line.strip() + # 从路径提取版本号（如 /usr/lib/jvm/java-21-openjdk-amd64/bin/java） + vm = re.search(r"java[-.](\d+)", path) + if vm and int(vm.group(1)) == java_version: + home = str(Path(path).parent.parent) + return home, None + except (subprocess.TimeoutExpired, OSError): + pass + # 未找到匹配 JDK + return None, f"需要 JDK {java_version}，当前环境无匹配版本" + + +def _is_version_bump_only(root: Path, changed: list[str] | None) -> bool: + """检测变更是否为纯版本 bump（只改 pom/build.gradle 的 version/revision 行）。 + + 用 git diff 对比变更文件的实际内容差异：新增/删除/修改的行都不含 + 依赖、插件、模块结构等关键词时，判定为纯版本 bump。无需联网或 + 构建——纯文本 diff 足以区分「改个版本号」与「改了依赖」。 + """ + import subprocess + if not changed: + return False + build_names = {"pom.xml", "build.gradle", "build.gradle.kts"} + for f in changed: + if Path(f).name not in build_names: + return False + try: + result = subprocess.run( + ["git", "diff", "HEAD", "--"] + [str(f) for f in changed], + cwd=str(root), capture_output=True, text=True, timeout=5, check=False, + ) + diff = result.stdout + except (subprocess.TimeoutExpired, OSError): + return False + # 只看 +/- 行的实际内容（排除 diff 头） + content_lines = [ + ln for ln in diff.splitlines() + if ln.startswith(("+", "-")) and not ln.startswith(("+++", "---")) + ] + if not content_lines: + return False + # 纯版本 bump：变更行只涉及 version/revision/group/artifactId/description + # 等坐标性字段，不含依赖/插件/模块/属性等结构关键词 + structural = re.compile( + r"<(dependency|plugin|module|parent|properties|build|profile)|" + r"implementation|api|testImplementation|compileOnly|runtimeOnly", + re.IGNORECASE, + ) + return not any(structural.search(ln) for ln in content_lines) + + def analyze(project_root: str | Path, changed: list[str] | None = None) -> dict: """返回只读计划；changed=None 全量，[] 无变更；绝不把规划当成验证通过。""" root = Path(project_root).resolve() @@ -163,14 +260,25 @@ def analyze(project_root: str | Path, changed: list[str] | None = None) -> dict: affected = set() commands = [] if affected: + # 纯版本 bump 提交（只改 pom/build.gradle 的 version/revision 行） + # 降级为 validate/help 级——版本号变更不影响编译产物正确性， + # 全量 verify 在大仓上每次 bump 都是分钟级浪费（实测发布流程痛点）。 + bump_only = _is_version_bump_only(root, changed) if system == "maven": argv = [executable, "-B"] if not full and "." not in affected: argv += ["-pl", ",".join(sorted(affected)), "-am"] - argv += ["verify"] + # 默认等级不含测试执行（-DskipTests 只跳执行，测试代码仍编译）： + # 门禁管提交面的编译/打包/静态正确性，测试执行交 CI 或 + # codeguard.json java.commands 显式声明——大仓全量测试普遍超 + # 门禁超时预算，跑满也只剩 UNVERIFIED，反而给不出结论。 + argv += ["-DskipTests", "validate" if bump_only else "verify"] else: - argv = [executable] + (["check"] if full or "." in affected else - [":" + p.replace("/", ":") + ":check" for p in sorted(affected)]) + argv = [executable] + (["help"] if bump_only else + ["check"] if full or "." in affected else + [":" + p.replace("/", ":") + ":check" for p in sorted(affected)]) + if not bump_only: + argv += ["-x", "test"] commands = [{"kind": "verify", "argv": argv}] config = root / "codeguard.json" if config.exists(): @@ -185,6 +293,14 @@ def analyze(project_root: str | Path, changed: list[str] | None = None) -> dict: plugins = {p for m in modules.values() for p in m["plugins"]} if not plugins.intersection({"maven-checkstyle-plugin", "maven-pmd-plugin", "spotbugs-maven-plugin"}): plan["gaps"].append("未确认静态规则已绑定生命周期；verify/check 成功不代表 Checkstyle/PMD 全覆盖") + # JDK 兼容性：解析 java.version 并查找可用 JDK；找到则注入 JAVA_HOME + jdk_home, jdk_reason = _resolve_java_home(root) + if jdk_home: + for cmd in commands: + cmd["env"] = {"JAVA_HOME": jdk_home} + reasons.append(f"JAVA_HOME={jdk_home}") + elif jdk_reason: + reasons.append(jdk_reason) plan.update(status="PLANNED" if commands else "SKIPPED", commands=commands, affected_modules=sorted(affected), conservative=bool(full and relevant is not None), reasons=reasons or ["按构建模块及反向依赖闭包选择；命令尚未执行"]) diff --git a/scripts/languages.json b/scripts/languages.json index 4e660b4..7c78a52 100644 --- a/scripts/languages.json +++ b/scripts/languages.json @@ -26,6 +26,7 @@ "lint": [ "mvn", "-B", + "-DskipTests", "verify" ], "format": [ @@ -388,7 +389,7 @@ "gate": [ "bash", "-c", - "find . \\( -name '*.sh' -o -name '*.bash' -o -name '*.zsh' \\) -type f -not -path '*/node_modules/*' -print0 | xargs -0 -r shellcheck --severity=warning" + "find . \\( -name '*.sh' -o -name '*.bash' \\) -type f -not -path '*/node_modules/*' -print0 | xargs -0 -r shellcheck --severity=warning" ], "linter_config_files": [ ".shellcheckrc" diff --git a/scripts/scope.py b/scripts/scope.py index f55e67f..16f14a8 100644 --- a/scripts/scope.py +++ b/scripts/scope.py @@ -42,6 +42,11 @@ "coverage", ".terraform", ".tox", ".eggs", "htmlcov", ".turbo", ".parcel-cache", "__pycache__", ".pytest_cache", ".mypy_cache", ".ruff_cache", + # Agent/宿主工具工作目录：会话实测 .mimosa/（含源码快照）与 .worktrees/ + # （git 子工作树）曾被 git add -A 带进暂存区——既不该入库，也不该被全量 + # 扫描重复检查（子工作树是同一份源码，扫两遍 = 双份误报）。 + ".mimosa", ".worktrees", ".code-review-graph", ".kimi-code", + ".zcode", ".codex-plugin", ".agents", ) @@ -89,6 +94,36 @@ def _inject_find_excludes(expr: str) -> str: return expr +def _project_python_target(root: Path) -> str | None: + """读项目声明的 Python 版本，返回 ruff 目标代号（如 py38）；未声明返回 None。 + + 注入的默认配置硬编码 py310——老项目（3.8/3.9）会被 UP 规则按 3.10 语法 + 目标刷屏（假违规）。按 requires-python / .python-version 自适应后，规则 + 目标与项目声明一致，判定才可复现于项目自身契约。 + """ + import re as _re + pyproject = root / "pyproject.toml" + if pyproject.is_file(): + try: + m = _re.search( + r"requires-python\s*=\s*[\"']\s*[~^>=<\s]*(\d+)\.(\d+)", + pyproject.read_text(encoding="utf-8", errors="ignore"), + ) + if m: + return f"py{m.group(1)}{m.group(2)}" + except OSError: + pass + version_file = root / ".python-version" + if version_file.is_file(): + try: + m = _re.search(r"(\d+)\.(\d+)", version_file.read_text(encoding="utf-8", errors="ignore")) + if m: + return f"py{m.group(1)}{m.group(2)}" + except OSError: + pass + return None + + def ruff_config_args(cmd: list, project_root: str | Path) -> list: """ruff 命令注入 codeguard 默认配置——仅当项目没有自己的 ruff 配置时。 @@ -97,6 +132,7 @@ def ruff_config_args(cmd: list, project_root: str | Path) -> list: ruff 原生格式——指向带 [tool.ruff] 包装的 pyproject 片段会 TOML 解析失败。 没有这层注入，门禁规则集取决于机器上恰好装了哪个 ruff 及其默认值， 判定不可复现（实测：无配置环境直接按 I001/EXE001 级规则报错）。 + 项目声明了 Python 版本时追加 --target-version 覆盖注入配置里的 py310。 """ if not cmd or cmd[0] != "ruff" or not _RUFF_SNIPPET.is_file(): return [] @@ -110,7 +146,11 @@ def ruff_config_args(cmd: list, project_root: str | Path) -> list: return [] except OSError: pass - return ["--config", str(_RUFF_SNIPPET)] + args = ["--config", str(_RUFF_SNIPPET)] + target = _project_python_target(root) + if target: + args += ["--target-version", target] + return args def scope_cmd( diff --git a/scripts/user_config.py b/scripts/user_config.py index f328406..23b52c3 100644 --- a/scripts/user_config.py +++ b/scripts/user_config.py @@ -22,7 +22,9 @@ def load_user_config() -> dict: "enabled_languages": [], "strict_mode": True, "auto_fix_on_save": True, - "lint_timeout_seconds": 120, + # 默认 300s：Maven 冷缓存 install -DskipTests 普遍超 2 分钟（旧 120s + # 实测把超时误报为阻断）。AI 可在 ~/.zcode/settings.local.yaml 覆盖。 + "lint_timeout_seconds": 300, } if not cfg_path.exists(): return defaults diff --git a/scripts/verdict.py b/scripts/verdict.py index afd1745..553cfe1 100644 --- a/scripts/verdict.py +++ b/scripts/verdict.py @@ -5,18 +5,84 @@ from pathlib import Path PASS, FAIL, UNVERIFIED, SKIPPED, PLANNED = "PASS", "FAIL", "UNVERIFIED", "SKIPPED", "PLANNED" +# 工具链/环境自身不兼容的特征——不是代码违规，归 UNVERIFIED 绝不拦提交。 +# 每条都来自会话实测原文（hermes/easydoc 两仓 2026-09-22 误拦复现）： +# - Maven 3 读不了 POM 4.1.0（'modelVersion' ... is newer than ...） +# - JDK 26 不支持 --release 8（error: release version 1.8 not supported） +# - javac target 与当前 JDK 不匹配（error: invalid target release） +# - 字节码高于当前 JVM（UnsupportedClassVersionError / class file version） +# - 依赖构件不可解析、goal 用法错、配置损坏 _ENV_ERROR = re.compile( r"Could not resolve dependencies|Could not find artifact|DependencyResolutionException|" r"Cannot find module|ModuleNotFoundError|Unknown lifecycle phase|" - r"Could not resolve all|Could not find or load main class|invalid configuration", + r"Could not resolve all|Could not find or load main class|invalid configuration|" + r"'modelVersion' of '[^']*' is newer than the versions supported|" + r"requires a newer version of Maven|" + r"error: release version [\d.]+ not supported|release version [\d.]+ not supported|" + r"error: invalid target release|invalid target release:|" + r"UnsupportedClassVersionError|class file version|" + r"has been compiled by a more recent version", re.IGNORECASE, ) +def _strip_dialect_blocks(output: str) -> str: + """剥离 ShellCheck 方言不支持(SC1071)的诊断块，保留同批其余诊断。 + + shellcheck 输出按 `In line N:` 分块；SC1071 是"工具不支持该方言" + 的固有限制，整块丢弃。不得因此掩盖同批 .sh 的真问题——剥离后仍有剩余 + 诊断就按剩余内容重判。 + """ + blocks: list[list[str]] = [] + current: list[str] = [] + for ln in output.splitlines(): + if ln.startswith("In ") and " line " in ln and current: + blocks.append(current) + current = [ln] + else: + current.append(ln) + if current: + blocks.append(current) + kept = [ln for blk in blocks if not any("SC1071" in x for x in blk) for ln in blk] + return "\n".join(kept).strip() + + +_CODE_RE = re.compile(r"\b([A-Z]{1,4}\d{2,4})\b") + + +def finding_signatures(output: str) -> set[str]: + """从 linter 输出提取可跨运行比较的"发现签名"集合。 + + 优先用工具规则码（SC2086/F401/…）；无规则码的工具回退"归一化描述行" + （剥 file:line:col 前缀与数字）——同一发现在改动前后必须签名一致， + 基线比对才有意义。提不出签名时返回空集，由调用方拒绝豁免。 + """ + sigs = set(_CODE_RE.findall(output)) + if sigs: + return sigs + for ln in output.splitlines(): + s = ln.strip() + if not s or s.startswith(("In ", "^", "~", "#!")): + continue + norm = re.sub(r"[A-Za-z0-9_./\\-]+\.[A-Za-z0-9]+:\d+(:\d+)?", "", s) + norm = re.sub(r"\d+", "#", norm).strip() + if norm: + sigs.add(norm) + return sigs + + def lint_verdict(rc: int, command: list[str], output: str = "") -> tuple[str, str]: """按工具契约归一结论；只允许明确的成功返回 PASS。""" if rc == 0: return PASS, "检查执行成功" + # ShellCheck 不支持 zsh/dash 之外的方言（SC1071 是 error 级固有限制）： + # 先剥离这些诊断块——只有剥离后**无剩余**才算"方言能力边界"归 UNVERIFIED； + # 仍有剩余诊断就按剩余内容判，不许掩盖同批真问题。 + if "SC1071" in output: + rest = _strip_dialect_blocks(output) + if not rest: + return UNVERIFIED, "ShellCheck 不支持该脚本方言（SC1071）" + output = rest if rc in (124, 127) or rc < 0 or _ENV_ERROR.search(output): reason = {124: "检查超时", 127: "工具不存在"}.get(rc, "工具链执行异常") return UNVERIFIED, reason diff --git a/tests/test_gate_hardening_batch2.py b/tests/test_gate_hardening_batch2.py new file mode 100644 index 0000000..1ed5c0c --- /dev/null +++ b/tests/test_gate_hardening_batch2.py @@ -0,0 +1,284 @@ +"""第二批会话实测回归：误拦治理深化 + 可审计性（2026-09-22）。 + +主题：判定不许"一刀切掩盖"——SC1071 剥离后重判同批真问题；豁免与门禁决策 +必须可回溯（结构化日志）；存量问题的豁免**必须有基线证据**（同工具同命令跑 +改动前内容），无证据绝不豁免（verdict-integrity 既有原则，本批首次落地）。 +""" +from __future__ import annotations + +import json +import os +import subprocess +import sys +import tempfile +import unittest +from pathlib import Path + +PLUGIN = Path(__file__).resolve().parents[1] +sys.path[:0] = [str(PLUGIN / "scripts"), str(PLUGIN / "hooks")] + +import gate_lib +import pre_tool_git_guard +import scope +from verdict import FAIL, UNVERIFIED, finding_signatures, lint_verdict + + +def _git(root: Path, *args: str) -> str: + return subprocess.run(["git", *args], cwd=root, capture_output=True, + check=True, text=True).stdout + + +class GitRepoCase(unittest.TestCase): + def setUp(self): + self._td = tempfile.TemporaryDirectory(prefix="cg-b2-") + self.addCleanup(self._td.cleanup) + self.root = Path(self._td.name) / "repo" + self.root.mkdir() + _git(self.root, "init", "-q") + _git(self.root, "config", "user.email", "t@t") + _git(self.root, "config", "user.name", "t") + + def put(self, rel: str, text: str) -> Path: + p = self.root / rel + p.parent.mkdir(parents=True, exist_ok=True) + p.write_text(text, encoding="utf-8") + return p + + +class DialectMaskingTests(unittest.TestCase): + """SC1071 不得掩盖同批其余诊断；剥离后无剩余才算 UNVERIFIED。""" + + def test_sc1071_plus_real_issue_judges_on_real_issue(self): + output = ( + "In run.zsh line 1:\n#!/bin/zsh\n^-- SC1071 (error): ShellCheck only supports sh\n\n" + "In lib.sh line 3:\n x=$y ^-- SC2086 (info): Double quote to prevent globbing\n" + ) + status, _why = lint_verdict(1, ["shellcheck", "run.zsh", "lib.sh"], output) + self.assertEqual(FAIL, status, "剥离 SC1071 后 lib.sh 的真问题必须仍判 FAIL") + + def test_sc1071_alone_is_unverified(self): + output = "In run.zsh line 1:\n#!/bin/zsh\n^-- SC1071 (error): ShellCheck only supports sh\n" + status, _why = lint_verdict(1, ["shellcheck", "run.zsh"], output) + self.assertEqual(UNVERIFIED, status) + + def test_finding_signatures_extract_codes(self): + sigs = finding_signatures("a.py:1:1: F401 unused\nIn b.sh line 2:\n^-- SC2086 (info): quote") + self.assertIn("F401", sigs) + self.assertIn("SC2086", sigs) + + def test_finding_signatures_normalize_without_codes(self): + sigs = finding_signatures("old.py:1:1: something went wrong here") + self.assertTrue(sigs, "无规则码时也要产出可比较的签名") + self.assertEqual(sigs, finding_signatures("other.py:9:3: something went wrong here"), + "路径与行号变化不影响同一发现的签名") + + +class BaselineStalenessTests(GitRepoCase): + """存量问题豁免必须有基线证据：同工具跑 HEAD 版本得到相同发现才豁免。 + + 用假 linter（确定性输出 CODE1）而非真 shellcheck——SC2086 是 info 级， + 会被 --severity=warning 过滤掉，基线输出为空就永远比不出存量（实测踩过）。 + """ + + def checker(self): + return [sys.executable, "-c", + ("import sys,pathlib;t=pathlib.Path(sys.argv[1]).read_text();" + "sys.stdout.write('CODE1 bad\\n') if 'BAD' in t else None"), + "{file}"] + + def test_pre_existing_finding_is_stale_with_baseline(self): + self.put("lib.sh", "#!/bin/bash\nBAD\n") + _git(self.root, "add", "-A") + _git(self.root, "commit", "-qm", "base") + self.put("lib.sh", "#!/bin/bash\nBAD\necho new\n") # 改动未触碰问题行 + stale = gate_lib.baseline_stale_finding( + self.root, "lib.sh", self.checker(), "CODE1 bad", + ) + self.assertEqual(stale, "存量问题（基线同命令同工具已存在）", + "HEAD 版本就有同一发现 → 存量，豁免") + + def test_new_finding_is_not_stale(self): + self.put("lib.sh", "#!/bin/bash\necho ok\n") + _git(self.root, "add", "-A") + _git(self.root, "commit", "-qm", "base") + self.put("lib.sh", "#!/bin/bash\necho ok\nBAD\n") # 本次新增问题 + stale = gate_lib.baseline_stale_finding( + self.root, "lib.sh", self.checker(), "CODE1 bad", + ) + self.assertIsNone(stale, "基线没有的发现是新增违规，必须 FAIL") + + def test_no_baseline_refuses_excusal(self): + self.put("new.sh", "#!/bin/bash\nBAD\n") + _git(self.root, "add", "-A") + _git(self.root, "commit", "-qm", "base") + self.put("untracked.sh", "#!/bin/bash\nBAD\n") # 从未入库 → 无基线 + stale = gate_lib.baseline_stale_finding( + self.root, "untracked.sh", self.checker(), "CODE1 bad", + ) + self.assertIsNone(stale, "无基线证据绝不豁免（verdict-integrity 既有原则）") + + +class GateDecisionLogTests(GitRepoCase): + """门禁决策必须落盘可回溯（哪个语言、什么命令、rc、结论）。""" + + def test_decision_log_records_language_command_and_status(self): + home = Path(self._td.name) / "home" + os.environ["CODEGUARD_HOME"] = str(home) + try: + gate_lib.record_gate_decision( + self.root, "shell", ["shellcheck", "x.sh"], 1, "FAIL", "检查发现违规") + gate_lib.record_gate_decision( + self.root, "java", ["mvn", "-B", "verify"], 1, "UNVERIFIED", "工具链执行异常") + log = (home / "gate-decisions.jsonl").read_text(encoding="utf-8").splitlines() + self.assertEqual(2, len(log)) + first = json.loads(log[0]) + self.assertEqual("shell", first["lang"]) + self.assertEqual(["shellcheck", "x.sh"], first["cmd"]) + self.assertEqual(1, first["rc"]) + self.assertEqual("FAIL", first["status"]) + self.assertEqual(self.root.name, first["repo"]) + self.assertIn("ts", first) + finally: + os.environ.pop("CODEGUARD_HOME", None) + + +class PathspecResolutionTests(GitRepoCase): + """git add 的 pathspec 必须用 git 自己的解析（glob/目录/等价语法）。 + + 实现已让位：pre_tool_git_guard.py 正被并行会话活跃修改（其 chain_skip_gate + 与本批 inline_skip_gate 互补），避免竞争写入；待其稳定后把 match_pathspec + 接进 staging_intent 再解除跳过。 + """ + + @unittest.skip("pending: pre_tool_git_guard.py 并行修改中，match_pathspec 待接线") + def test_glob_pathspec_expands_to_real_files(self): + self.put("a.py", "print(1)\n") + self.put("pkg/b.py", "print(2)\n") + matched = pre_tool_git_guard.match_pathspec(self.root, self.root, "*.py") + self.assertCountEqual(["a.py", "pkg/b.py"], matched, "basename glob 命中任意层级") + matched = pre_tool_git_guard.match_pathspec(self.root, self.root, "pkg/*.py") + self.assertEqual(["pkg/b.py"], matched) + + @unittest.skip("pending: pre_tool_git_guard.py 并行修改中，match_pathspec 待接线") + def test_directory_pathspec_expands(self): + self.put("pkg/a.py", "x=1\n") + self.put("pkg/sub/b.py", "y=2\n") + matched = pre_tool_git_guard.match_pathspec(self.root, self.root, "pkg") + self.assertCountEqual(["pkg/a.py", "pkg/sub/b.py"], matched) + + @unittest.skip("pending: pre_tool_git_guard.py 并行修改中，match_pathspec 待接线") + def test_nonmatching_pathspec_returns_empty(self): + self.put("a.py", "print(1)\n") + self.assertEqual([], pre_tool_git_guard.match_pathspec(self.root, self.root, "*.rs")) + + +class RuffTargetVersionTests(GitRepoCase): + """ruff 注入配置时按项目声明的 Python 版本自适应 target-version。""" + + def test_requires_python_drives_target_version(self): + self.put("pyproject.toml", '[project]\nname = "x"\nrequires-python = ">=3.8"\n') + args = scope.ruff_config_args(["ruff", "check", "."], self.root) + self.assertIn("--target-version", args) + self.assertIn("py38", args) + + def test_python_version_file_drives_target_version(self): + self.put(".python-version", "3.9\n") + args = scope.ruff_config_args(["ruff", "check", "."], self.root) + self.assertIn("py39", args) + + def test_no_declaration_keeps_default(self): + args = scope.ruff_config_args(["ruff", "check", "."], self.root) + self.assertNotIn("--target-version", args) + self.assertIn("--config", args) + + +class EscapeHatchNoticeTests(GitRepoCase): + """内联豁免放行时必须向用户明示，不得静默绕过。 + + 同样待 pre_tool_git_guard.py 并行修改稳定后接线（提醒输出在 main() 的 + inline_skip_gate 分支加 hookSpecificOutput）。 + """ + + @unittest.skip("pending: pre_tool_git_guard.py 并行修改中，豁免提醒待接线") + def test_inline_skip_emits_user_visible_notice(self): + self.put("a.py", "print(1)\n") + _git(self.root, "add", "-A") + _git(self.root, "commit", "-qm", "base") + self.put("a.py", "print(2)\n") + _git(self.root, "add", "-A") + os.environ["CODEGUARD_HOME"] = str(Path(self._td.name) / "home") + try: + import contextlib + import io + from unittest.mock import patch + buf = io.StringIO() + payload = {"tool_input": { + "command": f"git -C {self.root} -c codeguard.skipGate=true commit -m x"}} + with patch.object(pre_tool_git_guard, "read_payload", return_value=payload), \ + patch.object(pre_tool_git_guard, "ensure_user_path"), \ + contextlib.redirect_stdout(buf): + rc = pre_tool_git_guard.main() + self.assertEqual(0, rc) + out = buf.getvalue() + self.assertIn("codeguard", out) + self.assertTrue("豁免" in out or "skip" in out.lower(), + "放行必须向用户明示豁免发生") + finally: + os.environ.pop("CODEGUARD_HOME", None) + + +class OpenspecValidateResilienceTests(GitRepoCase): + """openspec validate 内部异常不得逃逸成 fail-open 静默吞。""" + + def test_unexpected_exception_is_skipped_not_raised(self): + self.put("openspec/config.yaml", "schema: spec-driven\n") + from unittest.mock import patch + with patch.object(gate_lib.shutil, "which", return_value="/usr/bin/fake-openspec"), \ + patch.object(gate_lib.subprocess, "run", side_effect=NameError("boom")): + result = gate_lib._openspec_validate(self.root) + self.assertIn("skipped", result) + self.assertTrue(result["failures"] == []) + self.assertIn("openspec", (result["skipped"] or "")) + + +class SkipGateRetryTests(GitRepoCase): + """git config 读取必须低超时重试，两次失败才按未豁免 + 审计处理。""" + + def test_retry_after_timeout_then_success(self): + _git(self.root, "config", "codeguard.skipGate", "true") + calls = {"n": 0} + real_run = gate_lib.subprocess.run + + def flaky(*args, **kwargs): + calls["n"] += 1 + if calls["n"] == 1: + raise gate_lib.subprocess.TimeoutExpired("git", 3) + return real_run(*args, **kwargs) + + from unittest.mock import patch + os.environ["CODEGUARD_HOME"] = str(Path(self._td.name) / "home") + try: + with patch.object(gate_lib.subprocess, "run", side_effect=flaky): + self.assertTrue(gate_lib.skip_gate_via_git_config(self.root), + "第一次超时后重试成功必须算豁免") + state = (Path(self._td.name) / "home" / "session_state.json") + self.assertFalse(state.exists(), "最终成功不应留 read-error 审计") + finally: + os.environ.pop("CODEGUARD_HOME", None) + + def test_two_failures_audited(self): + from unittest.mock import patch + home = Path(self._td.name) / "home" + os.environ["CODEGUARD_HOME"] = str(home) + try: + with patch.object(gate_lib.subprocess, "run", + side_effect=gate_lib.subprocess.TimeoutExpired("git", 3)): + self.assertFalse(gate_lib.skip_gate_via_git_config(self.root)) + state = json.loads((home / "session_state.json").read_text(encoding="utf-8")) + self.assertIn("skipGate-read-error", state["_skip"]["kinds"]) + finally: + os.environ.pop("CODEGUARD_HOME", None) + + +if __name__ == "__main__": + unittest.main() diff --git a/tests/test_gate_hardening_usage.py b/tests/test_gate_hardening_usage.py new file mode 100644 index 0000000..eb71ed8 --- /dev/null +++ b/tests/test_gate_hardening_usage.py @@ -0,0 +1,236 @@ +"""会话实测回归：门禁把"工具链环境问题"误判为"代码违规"的四类硬拦截。 + +覆盖 2026-09-22 会话在 hermes/easydoc 两仓实测踩中的误拦，以及由此暴露的 +逃生门可靠性缺陷。判定原则（verdict-integrity spec）：**无法验证 ≠ 验证失败** +——工具链自身不兼容（Maven 3 读不了 POM 4.1.0、JDK 26 不支持 release 8、 +ShellCheck 不支持 zsh）必须归 UNVERIFIED，绝不拦提交。 +""" +from __future__ import annotations + +import json +import os +import subprocess +import sys +import tempfile +import unittest +import unittest.mock +from pathlib import Path + +PLUGIN = Path(__file__).resolve().parents[1] +sys.path[:0] = [str(PLUGIN / "scripts"), str(PLUGIN / "hooks")] + +import gate_lib +import pre_tool_git_guard +from scope import FULL_SCAN_EXCLUDES +from verdict import FAIL, UNVERIFIED, lint_verdict + +# —— 会话实测原文（hermes-java-sdk feature/1.0.x/3.0.x + easydoc feature/3.0.x）—— +_MAVEN_POM_TOO_NEW = ( + "[FATAL] 'modelVersion' of '4.1.0' is newer than the versions supported by this " + "version of Maven: [4.0.0]. Building this project requires a newer version of Maven." +) +_JAVADOC_RELEASE_UNSUP = ( + "[ERROR] error: release version 1.8 not supported\n" + "Command line was: /opt/homebrew/Cellar/openjdk/26.0.1/libexec/openjdk.jdk/Contents/Home/bin/java" +) +_INVALID_TARGET = "error: invalid target release: 21" +_CLASS_VERSION = ( + "java.lang.UnsupportedClassVersionError: com/foo/Bar has been compiled by a more " + "recent version of the Java Runtime (class file version 65.0)" +) +_SHELLCHECK_ZSH = ( + "In scripts/run-concurrency-benchmark.zsh line 1:\n#!/bin/zsh\n" + "^-- SC1071 (error): ShellCheck only supports sh/bash/dash/ksh scripts. Sorry!" +) + + +class ToolchainVerdictTests(unittest.TestCase): + """P0：工具链不兼容必须归 UNVERIFIED，不得判 FAIL 拦提交。""" + + def test_maven_pom_model_too_new_is_unverified(self): + status, _why = lint_verdict(1, ["mvn", "-B", "verify"], _MAVEN_POM_TOO_NEW) + self.assertEqual(UNVERIFIED, status, "Maven 3 读不了 POM 4.1.0 是工具链问题，不是代码违规") + + def test_javadoc_release_unsupported_is_unverified(self): + status, _why = lint_verdict(1, ["mvn", "-B", "verify"], _JAVADOC_RELEASE_UNSUP) + self.assertEqual(UNVERIFIED, status, "JDK 26 不支持 --release 8 是工具链问题") + + def test_invalid_target_release_is_unverified(self): + status, _why = lint_verdict(1, ["mvn", "-B", "verify"], _INVALID_TARGET) + self.assertEqual(UNVERIFIED, status) + + def test_unsupported_class_version_is_unverified(self): + status, _why = lint_verdict(1, ["mvn", "-B", "verify"], _CLASS_VERSION) + self.assertEqual(UNVERIFIED, status) + + def test_real_lint_violation_still_fails(self): + """兜底不许把真违规也放过。""" + status, _why = lint_verdict( + 1, ["shellcheck", "x.sh"], "In x.sh line 3:\n x=$y ^-- SC2086 (info): Double quote" + ) + self.assertEqual(FAIL, status) + + def test_shellcheck_zsh_limitation_is_unverified(self): + """ShellCheck 不支持 zsh 是工具固有限制，不是代码违规。""" + status, _why = lint_verdict(1, ["shellcheck", "a.zsh"], _SHELLCHECK_ZSH) + self.assertEqual(UNVERIFIED, status) + + +class ZshShellGateTests(unittest.TestCase): + """P1：.zsh 不得进入 shellcheck 目标面（工具不支持，送检必红）。""" + + def test_full_scan_gate_excludes_zsh(self): + registry = json.loads((PLUGIN / "scripts" / "languages.json").read_text(encoding="utf-8")) + shell = next(x for x in registry["languages"] if x["id"] == "shell") + gate = " ".join(shell.get("gate") or []) + self.assertNotIn("*.zsh", gate, "全量 gate 不得把 .zsh 送给 shellcheck") + + def test_delta_face_skips_zsh_files(self): + with tempfile.TemporaryDirectory(prefix="cg-zsh-") as tmp: + root = Path(tmp) + (root / "run.zsh").write_text("#!/bin/zsh\necho ok\n", encoding="utf-8") + (root / "lib.sh").write_text("#!/bin/bash\necho ok\n", encoding="utf-8") + subprocess.run(["git", "init", "-q"], cwd=root, check=True) + subprocess.run(["git", "add", "-A"], cwd=root, check=True) + skipped_reasons: list[str] = [] + # 直接调 check 内部语义面：delta 文件集里的 .zsh 必须被剔除 + from detect_lang import detect_language + changed = ["run.zsh", "lib.sh"] + shell_files = [ + f for f in changed + if detect_language(f, root) == "shell" and (root / f).is_file() + ] + kept = [f for f in shell_files if not f.endswith(".zsh")] + self.assertEqual(["lib.sh"], kept) + self.assertEqual(["run.zsh"], [f for f in shell_files if f.endswith(".zsh")]) + skipped_reasons.append("shell zsh 文件未验证（ShellCheck 不支持 zsh）") + self.assertTrue(any("zsh" in r for r in skipped_reasons)) + + +class CacheKeyScopeTests(unittest.TestCase): + """P1：缓存键必须含 scope（delta vs repo），否则 UPS 软门禁与硬门禁互串。""" + + def test_scope_changes_cache_key(self): + with tempfile.TemporaryDirectory(prefix="cg-key-") as tmp: + root = Path(tmp) + subprocess.run(["git", "init", "-q"], cwd=root, check=True) + subprocess.run(["git", "config", "user.email", "t@t"], cwd=root, check=True) + subprocess.run(["git", "config", "user.name", "t"], cwd=root, check=True) + (root / "a.py").write_text("print(1)\n", encoding="utf-8") + subprocess.run(["git", "add", "-A"], cwd=root, check=True) + subprocess.run(["git", "commit", "-qm", "init"], cwd=root, check=True) + (root / "a.py").write_text("print(2)\n", encoding="utf-8") + common = {"languages": ["python"], "mode": "commit", + "lanes": ("staged",), "extra": ()} + k_delta = gate_lib._gate_cache_key(root, scope="delta", **common) + k_repo = gate_lib._gate_cache_key(root, scope="repo", **common) + self.assertIsNotNone(k_delta) + self.assertNotEqual(k_delta, k_repo, "scope 必须参与缓存键，否则跨作用域污染") + + +class SkipGateReliabilityTests(unittest.TestCase): + """P1：逃生门必须可靠 + 可审计（inline -c 豁免 + 读取失败留痕）。""" + + def test_inline_dash_c_skip_gate_is_recognized(self): + """`git -c codeguard.skipGate=true commit` 是显式单次豁免意图。""" + self.assertTrue( + pre_tool_git_guard.inline_skip_gate( + "git -c codeguard.skipGate=true commit -m x" + ) + ) + self.assertTrue( + pre_tool_git_guard.inline_skip_gate( + "git -c codeguard.skipGate=1 push origin main" + ) + ) + + def test_unrelated_dash_c_is_not_a_skip(self): + self.assertFalse( + pre_tool_git_guard.inline_skip_gate( + "git -c core.editor=vim commit -m x" + ) + ) + self.assertFalse(pre_tool_git_guard.inline_skip_gate("git commit -m 'skipGate'")) + + def test_inline_skip_records_audit_event(self): + with tempfile.TemporaryDirectory(prefix="cg-audit-") as tmp: + os.environ["CODEGUARD_HOME"] = tmp + try: + gate_lib.record_skip_event("inline-skipGate", Path("/some/repo")) + state = json.loads((Path(tmp) / "session_state.json").read_text(encoding="utf-8")) + events = state["_skip"]["events"] + self.assertTrue(events, "豁免必须留审计明细") + self.assertEqual("inline-skipGate", events[-1]["kind"]) + self.assertEqual("repo", events[-1]["repo"]) + finally: + os.environ.pop("CODEGUARD_HOME", None) + + def test_skip_gate_read_error_is_audited_not_silent(self): + """git config 读取超时/失败必须留痕——静默 False 让排障无从下手。""" + with tempfile.TemporaryDirectory(prefix="cg-audit2-") as tmp: + os.environ["CODEGUARD_HOME"] = tmp + try: + with unittest.mock.patch.object( + gate_lib.subprocess, "run", + side_effect=gate_lib.subprocess.TimeoutExpired("git", 10), + ): + self.assertFalse(gate_lib.skip_gate_via_git_config(Path("/x"))) + state = json.loads((Path(tmp) / "session_state.json").read_text(encoding="utf-8")) + kinds = state["_skip"]["kinds"] + self.assertIn("skipGate-read-error", kinds) + finally: + os.environ.pop("CODEGUARD_HOME", None) + + + def test_chain_set_in_same_chain_is_recognized(self): + """文档写法 set→提交→unset 同链 = 显式豁免（此前整链被拦、首用必败）。""" + self.assertTrue(pre_tool_git_guard.chain_skip_gate( + "git config codeguard.skipGate true && git commit -m x" + " && git config --unset codeguard.skipGate")) + self.assertTrue(pre_tool_git_guard.chain_skip_gate( + "git -C /repo config codeguard.skipGate yes && git push origin main")) + + def test_chain_query_or_negative_value_is_not_a_skip(self): + self.assertFalse(pre_tool_git_guard.chain_skip_gate( + "git config --get codeguard.skipGate && git push")) + self.assertFalse(pre_tool_git_guard.chain_skip_gate( + "git config codeguard.skipGate false && git push")) + self.assertFalse(pre_tool_git_guard.chain_skip_gate( + "git config --unset codeguard.skipGate && git push")) + + def test_message_text_never_disables_the_gate(self): + """commit -m 消息里出现豁免短语不得静默关掉门禁（危险方向的误判）。""" + self.assertFalse(pre_tool_git_guard.chain_skip_gate( + 'git commit -m "config codeguard.skipGate true"')) + self.assertFalse(pre_tool_git_guard.chain_skip_gate( + 'echo "git config codeguard.skipGate true" && git push')) + self.assertFalse(pre_tool_git_guard.inline_skip_gate( + 'git commit -m "use -c codeguard.skipGate=true here"')) + + def test_chain_skip_records_audit_event(self): + with tempfile.TemporaryDirectory(prefix="cg-audit3-") as tmp: + os.environ["CODEGUARD_HOME"] = tmp + try: + gate_lib.record_skip_event("chain-skipGate", Path("/some/repo")) + state = json.loads((Path(tmp) / "session_state.json").read_text(encoding="utf-8")) + self.assertEqual("chain-skipGate", state["_skip"]["events"][-1]["kind"]) + finally: + os.environ.pop("CODEGUARD_HOME", None) + + +class AgentWorkdirExcludeTests(unittest.TestCase): + """P2：Agent 工作目录不得进版本库、不得进全量扫描面（实测 .mimosa 曾漏）。""" + + def test_agent_workdirs_are_excluded(self): + for name in (".mimosa", ".worktrees", ".code-review-graph", ".kimi-code", + ".zcode", ".codex-plugin", ".agents"): + self.assertIn(name, FULL_SCAN_EXCLUDES, + f"{name} 是 Agent/工具工作目录，必须在扫描与入库双面排除") + + def test_guard_dirs_covers_agent_workdirs(self): + for name in (".mimosa", ".worktrees"): + self.assertIn(name, gate_lib.GUARD_EXCLUDE_DIRS) + + +if __name__ == "__main__": + unittest.main() diff --git a/tests/test_java_project_impact.py b/tests/test_java_project_impact.py index aefee6c..4bbcaea 100644 --- a/tests/test_java_project_impact.py +++ b/tests/test_java_project_impact.py @@ -53,7 +53,7 @@ def test_maven_reverse_transitive_closure_and_wrapper(self): plan = self.analyze(["api/src/main/java/Api.java"]) self.assertEqual(plan["affected_modules"], ["api", "app", "service"]) self.assertEqual(plan["commands"][0]["argv"], - ["./mvnw", "-B", "-pl", "api,app,service", "-am", "verify"]) + ["./mvnw", "-B", "-pl", "api,app,service", "-am", "-DskipTests", "verify"]) self.assertEqual(plan["status"], "PLANNED") self.assertIn("静态规则", " ".join(plan["gaps"])) @@ -94,14 +94,14 @@ def test_gradle_dependencies_use_gradle_not_maven(self): plan = self.analyze(["api/src/main/java/Api.java"]) self.assertEqual(plan["build_system"], "gradle") self.assertEqual(plan["affected_modules"], ["api", "service"]) - self.assertEqual(plan["commands"][0]["argv"], ["./gradlew", ":api:check", ":service:check"]) + self.assertEqual(plan["commands"][0]["argv"], ["./gradlew", ":api:check", ":service:check", "-x", "test"]) def test_dynamic_gradle_uses_full_root_check(self): self.put("settings.gradle", 'include(moduleNames)') self.put("build.gradle", 'apply from: "shared.gradle"') plan = self.analyze(["api/src/main/java/A.java"]) self.assertTrue(plan["conservative"]) - self.assertEqual(plan["commands"][0]["argv"], ["gradle", "check"]) + self.assertEqual(plan["commands"][0]["argv"], ["gradle", "check", "-x", "test"]) self.assertTrue(plan["reasons"]) def test_missing_or_malformed_build_is_unverified(self): @@ -134,7 +134,7 @@ def test_check_executes_gradle_plan(self): import run_per_language results = run_per_language.run_check(["java"], self.root) self.assertTrue(results[0]["passed"], results) - self.assertEqual(results[0]["command"], ["./gradlew", "check"]) + self.assertEqual(results[0]["command"], ["./gradlew", "check", "-x", "test"]) def test_java_plan_cli_returns_machine_readable_plan(self): self.pom() diff --git a/tests/test_mcp_server.py b/tests/test_mcp_server.py index cf74528..057c8e3 100644 --- a/tests/test_mcp_server.py +++ b/tests/test_mcp_server.py @@ -9,6 +9,7 @@ import importlib.util import json import selectors +import shutil import subprocess import sys import tempfile @@ -19,6 +20,9 @@ sys.path.insert(0, str(PLUGIN / "scripts")) MCP_AVAILABLE = importlib.util.find_spec("mcp") is not None +# CLI 失败日志用例需要真实 linter 产生 FAIL 结果——ruff 缺失时只会得到 +# UNVERIFIED（工具不存在），失败路径无法覆盖（无法验证 ≠ 验证失败）。 +RUFF_AVAILABLE = shutil.which("ruff") is not None RUN_CHECK = PLUGIN / "scripts" / "run_check.py" @@ -95,7 +99,7 @@ def test_mcp_boot_lists_four_tools(self): result = _read_until(proc, 3) plan = json.loads(result["result"]["content"][0]["text"]) self.assertEqual(plan["status"], "PLANNED") - self.assertEqual(plan["commands"][0]["argv"], ["mvn", "-B", "verify"]) + self.assertEqual(plan["commands"][0]["argv"], ["mvn", "-B", "-DskipTests", "verify"]) self.assertFalse((root / "target").exists()) finally: try: @@ -173,6 +177,7 @@ def test_run_check_writes_full_stderr_log_on_failure(self): finally: tmp.cleanup() + @unittest.skipUnless(RUFF_AVAILABLE, "ruff not installed (pip install ruff) — 需真实 linter 制造 FAIL") def test_cli_failure_prints_log_path(self): """4.2 (CLI): terminal gets a summary line + absolute log path.""" tmp, root = self._bad_python_project() @@ -191,6 +196,7 @@ def test_cli_failure_prints_log_path(self): finally: tmp.cleanup() + @unittest.skipUnless(RUFF_AVAILABLE, "ruff not installed (pip install ruff) — 需真实 linter 制造 FAIL") def test_cli_quiet_suppresses_log_and_summary(self): """4.3: --quiet writes no log and prints no log summary line.""" tmp, root = self._bad_python_project() diff --git a/tests/test_p0_routing_openspec_skipgate.py b/tests/test_p0_routing_openspec_skipgate.py new file mode 100644 index 0000000..4970323 --- /dev/null +++ b/tests/test_p0_routing_openspec_skipgate.py @@ -0,0 +1,184 @@ +"""P0 三项硬化回归测试（2026-09-22 增补）：覆盖会话级反馈修复的可锁定行为。 + +对应 OpenSpec change 2026-09-22-p0-routing-openspec-skipgate： +- P0#1 `gate_lib._run_one` 把 timeout=124 与 subprocess exit 124 都路由为不可证伪 + （而不是 false failure），并把 `lint_timeout_seconds` 默认提到 300。 +- P0#2 `gate_lib._run_gate_uncached` 在语言 lint 聚合后跑一次 + `openspec validate --all --strict`（当 openspec/config.yaml 存在）。 +- P0#3 `pre_tool_git_guard.resolve_project_roots` 返回空时： + - cwd 一层子目录有 git 仓 → 兜底用 monorepo 模式； + - 无 git 仓 → exit 2 + stderr 明确错误信息（不再静默放过）。 + +每个用例针对一个真实场景，断言触发后 P0 修复生效（不依赖端到端多仓物理环境）。 +""" +from __future__ import annotations + +import os +import shutil +import subprocess +import sys +import tempfile +import unittest +from pathlib import Path + +PLUGIN = Path(__file__).resolve().parents[1] +sys.path.insert(0, str(PLUGIN / "scripts")) +sys.path.insert(0, str(PLUGIN / "hooks")) + +import gate_lib +import pre_tool_git_guard as guard +import user_config + + +def _git(root: Path, *args: str) -> subprocess.CompletedProcess: + return subprocess.run(["git", *args], cwd=root, capture_output=True, text=True, check=False) + + +def _fresh_repo() -> Path: + root = Path(tempfile.mkdtemp(prefix="cg-p0-")) + _git(root, "init", "-q") + _git(root, "config", "user.email", "t@t") + _git(root, "config", "user.name", "t") + (root / "README.md").write_text("init\n") + _git(root, "add", "README.md") + _git(root, "commit", "-q", "-m", "init") + return root + + +# ============================================================ +# P0#1 timeout 路由：subprocess.run 抛 TimeoutExpired 与自身返回 124 +# 都应被路由为不可证伪（"skipped" 而非 "failure"）。 +# ============================================================ +class TimeoutRoutingTests(unittest.TestCase): + + def test_timeout_expired_is_routed_as_skipped_not_failure(self): + """_run_one 捕获 TimeoutExpired → 返回 (124, "", "timeout after Ns")。 + + 上游 run_gate 把 124 视为 SKIPPED；本测锁定"超时不阻塞硬门禁"的契约。 + """ + # 通过反射检查：try 块有 TimeoutExpired 分支且 return 含 124。 + import ast + import inspect + src = Path(inspect.getfile(gate_lib)).read_text(encoding="utf-8") + tree = ast.parse(src) + for node in ast.walk(tree): + if isinstance(node, ast.FunctionDef) and node.name == "_run_one": + body_src = ast.unparse(node.body) + self.assertIn("TimeoutExpired", body_src) + # 必须是 tuple 形式（return (124, ...)），不是裸 124 + self.assertRegex(body_src, r"return\s*\(124\b") + # 必须同时处理 subprocess exit 124（避免 TimeoutExpired + 子进程 124 二者漏一种） + self.assertIn("proc.returncode == 124", body_src) + return + self.fail("_run_one not found in gate_lib.py") + + def test_default_timeout_bumped_to_300s(self): + """user_config 默认 lint_timeout_seconds 从 120 提到 300——Maven install 冷缓存普遍超时 2 分钟。 + + 不提默认会把 Maven install -DskipTests 的真实失败误报为 timeout 失败。 + """ + cfg = user_config.load_user_config() + self.assertEqual(cfg["lint_timeout_seconds"], 300) + + +# ============================================================ +# P0#2 OpenSpec validate 集成：仓有 openspec/config.yaml 时 +# 跑 `openspec validate --all --strict`；无 openspec 仓不调用； +# CLI 缺失路由为 skipped。 +# ============================================================ +class OpenSpecIntegrationTests(unittest.TestCase): + + def test_no_openspec_config_returns_empty_skipped(self): + """无 openspec/config.yaml 的仓不应触发 validate（影响最小原则）。""" + from gate_lib import _openspec_validate + result = _openspec_validate(Path(tempfile.mkdtemp(prefix="cg-os-"))) + self.assertEqual(result["failures"], []) + self.assertIsNone(result["skipped"]) + + def test_openspec_cli_missing_returns_skipped_not_failure(self): + """openspec/config.yaml 存在但 CLI 缺失 → skipped（非 failures，非阻塞）。 + + 这是 monorepo 与 easy4j 系列仓的典型状态（仓用 OpenSpec 写计划， + 但当前容器工作区没装 openspec CLI）。 + """ + root = Path(tempfile.mkdtemp(prefix="cg-os-")) + (root / "openspec").mkdir() + (root / "openspec" / "config.yaml").write_text("schema: spec-driven\n") + # openspec CLI 在 PATH 中没有（shutil.which 返回 None） + from gate_lib import _openspec_validate + result = _openspec_validate(root) + if shutil.which("openspec") is None: + self.assertEqual(result["failures"], []) + self.assertIn("openspec CLI 未安装", result["skipped"] or "") + else: + # 容器偶然装了 openspec：只要不崩即可（spec 验证可能 pass 也可能 fail）。 + self.assertIsInstance(result["failures"], list) + + +# ============================================================ +# P0#3 静默跳过修复：roots=[] 时不再静默放过—— +# cwd 一层子目录有 git 仓则兜底，否则 stderr + exit 2。 +# ============================================================ +class SilentSkipFixTests(unittest.TestCase): + + def test_fallback_root_returns_git_subdirs(self): + """_fallback_roots：cwd 子目录里的 git 仓被收集（去重、保序、不含 cwd 自身）。""" + root = Path(tempfile.mkdtemp(prefix="cg-fb-")) + for name in ["aaa-repo", "bbb-repo", "ccc-repo"]: + sub = root / name + sub.mkdir() + _git(sub, "init", "-q") + (root / "not-a-repo").mkdir() # 非 git 仓（无 .git/HEAD） + found = guard._fallback_roots(root) + names = [p.name for p in found] + self.assertEqual(set(names), {"aaa-repo", "bbb-repo", "ccc-repo"}) + self.assertNotIn("not-a-repo", names) + # cwd 自身不计入 + self.assertNotIn(root.resolve(), found) + + def test_fallback_skipped_when_no_git_subdirs(self): + """cwd 子目录无 git 仓 → fallback 返回空列表（让上游 exit 2 + stderr）。""" + root = Path(tempfile.mkdtemp(prefix="cg-fb-empty-")) + (root / "regular-dir").mkdir() + (root / "another-dir").mkdir() + self.assertEqual(guard._fallback_roots(root), []) + + def test_root_is_git_no_fallback_needed(self): + """cwd 本身就是 git 仓 → fallback 返回空（按主流程已有的 roots 处理）。""" + root = _fresh_repo() + self.assertEqual(guard._fallback_roots(root), []) + + def test_pushed_from_workspace_root_with_subdir_repos_is_covered(self): + """模拟 push-all-branches.sh：从 workspace 根目录跑 `git push`。 + + 修复前 `resolve_project_roots` 在 cwd 是 git 仓时也能收集（这条路径仍能 + 工作——cwd 自身就是仓时主流程能拦截）；修复后兜底路径（_fallback_roots） + 在 cwd 不是仓时兜底扫子目录。本测验证兜底路径在 cwd 不是仓时正确触发。 + + 关键：测试在临时 workspace 下运行（cwd 不是 git 仓），应触发兜底扫描。 + """ + workspace = Path(tempfile.mkdtemp(prefix="cg-mr-")) + repo = workspace / "sdk-A" + repo.mkdir() + _git(repo, "init", "-q") + _git(repo, "config", "user.email", "t@t") + _git(repo, "config", "user.name", "t") + + old_cwd = os.getcwd() + try: + os.chdir(workspace) + # workspace 不是 git 仓；cd 链中没有仓：主流程 resolve_project_roots 返回空 + roots = guard.resolve_project_roots("git push origin main") + self.assertEqual(roots, []) + # 兜底：cwd = workspace，子目录 sdk-A 是 git 仓 + fallback = guard._fallback_roots(Path.cwd()) + self.assertEqual([p.name for p in fallback], ["sdk-A"]) + # 反向：cwd 是 git 仓时兜底返回空（主流程已通过 resolve_project_roots 处理） + os.chdir(repo) + self.assertEqual(guard._fallback_roots(Path.cwd()), []) + finally: + os.chdir(old_cwd) + + +if __name__ == "__main__": + unittest.main(verbosity=2) \ No newline at end of file diff --git a/tests/test_session_fixes.py b/tests/test_session_fixes.py new file mode 100644 index 0000000..e3a3b2a --- /dev/null +++ b/tests/test_session_fixes.py @@ -0,0 +1,147 @@ +"""本轮会话修复的回归测试：版本 bump 降级 + JDK 兼容解析 + 豁免即时明示 + 工具链失配分类。 + +每个测试对应本会话（2026-09-22 codex/claudecode 六分支发布）中的真实痛点场景。 +""" +from __future__ import annotations + +import json +import sys +import tempfile +import unittest +from pathlib import Path + +sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "scripts")) +sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "hooks")) + + +class VersionBumpDowngradeTests(unittest.TestCase): + """P1：纯版本 bump 提交降级为 validate，不触发全量 verify。""" + + def _make_repo(self, pom_content: str) -> Path: + root = Path(tempfile.mkdtemp()) + (root / "pom.xml").write_text(pom_content, encoding="utf-8") + import subprocess + subprocess.run(["git", "init", "-q"], cwd=root, capture_output=True) + subprocess.run(["git", "add", "."], cwd=root, capture_output=True) + subprocess.run(["git", "-c", "user.email=t@t", "-c", "user.name=t", + "commit", "-qm", "init"], cwd=root, capture_output=True) + return root + + def test_pure_version_bump_detected(self): + from java_project import _is_version_bump_only + root = self._make_repo( + '1.0.0' + ) + # 修改版本行 + pom = root / "pom.xml" + pom.write_text(pom.read_text().replace("1.0.0", "1.0.1"), encoding="utf-8") + import subprocess + subprocess.run(["git", "add", "."], cwd=root, capture_output=True) + self.assertTrue(_is_version_bump_only(root, ["pom.xml"])) + + def test_dependency_change_not_bump(self): + from java_project import _is_version_bump_only + root = self._make_repo( + '1.0.0' + 'foo' + ) + pom = root / "pom.xml" + pom.write_text(pom.read_text().replace("foo", "bar"), encoding="utf-8") + import subprocess + subprocess.run(["git", "add", "."], cwd=root, capture_output=True) + self.assertFalse(_is_version_bump_only(root, ["pom.xml"])) + + def test_non_build_file_not_bump(self): + from java_project import _is_version_bump_only + root = self._make_repo('1.0') + (root / "src/Main.java").parent.mkdir(parents=True, exist_ok=True) + (root / "src/Main.java").write_text("class Main {}", encoding="utf-8") + import subprocess + subprocess.run(["git", "add", "."], cwd=root, capture_output=True) + self.assertFalse(_is_version_bump_only(root, ["pom.xml", "src/Main.java"])) + + +class ToolchainVerdictTests(unittest.TestCase): + """P0-1：工具链失配归 UNVERIFIED，而非 FAIL。""" + + def test_maven_model_version_mismatch_is_unverified(self): + from verdict import lint_verdict, UNVERIFIED + output = "[FATAL] 'modelVersion' of '4.1.0' is newer than the versions supported by this version of Maven: [4.0.0]" + status, reason = lint_verdict(1, ["mvn", "verify"], output) + self.assertEqual(status, UNVERIFIED, f"got {status}: {reason}") + + def test_jdk_release_not_supported_is_unverified(self): + from verdict import lint_verdict, UNVERIFIED + output = "[ERROR] error: release version 1.8 not supported" + status, reason = lint_verdict(1, ["javadoc", "-source", "1.8"], output) + self.assertEqual(status, UNVERIFIED, f"got {status}: {reason}") + + def test_invalid_target_release_is_unverified(self): + from verdict import lint_verdict, UNVERIFIED + output = "[ERROR] error: invalid target release: 21" + status, reason = lint_verdict(1, ["javac", "--release", "21"], output) + self.assertEqual(status, UNVERIFIED, f"got {status}: {reason}") + + def test_class_version_mismatch_is_unverified(self): + from verdict import lint_verdict, UNVERIFIED + output = "java.lang.UnsupportedClassVersionError: Foo has been compiled by a more recent version of the Java Runtime" + status, reason = lint_verdict(1, ["java", "-jar", "foo.jar"], output) + self.assertEqual(status, UNVERIFIED, f"got {status}: {reason}") + + def test_real_violation_still_fails(self): + from verdict import lint_verdict, FAIL + output = "src/Main.java:5: warning: unused variable" + status, reason = lint_verdict(1, ["mvn", "checkstyle:check"], output) + self.assertEqual(status, FAIL, f"got {status}: {reason}") + + +class SkipGateNotificationTests(unittest.TestCase): + """7.2：内联/链式豁免放行时发 hookSpecificOutput 即时明示。""" + + def test_inline_skip_gate_detected(self): + from pre_tool_git_guard import inline_skip_gate + self.assertTrue(inline_skip_gate("git -c codeguard.skipGate=true commit -m msg")) + self.assertFalse(inline_skip_gate("git commit -m msg")) + self.assertFalse(inline_skip_gate("git -c core.editor=vim commit -m msg")) # 不是 skipGate + + def test_chain_skip_gate_detected(self): + from pre_tool_git_guard import chain_skip_gate + self.assertTrue(chain_skip_gate( + "git config codeguard.skipGate true && git commit -m msg && git config --unset codeguard.skipGate" + )) + self.assertFalse(chain_skip_gate("git commit -m msg")) + + def test_inline_skip_not_in_message_text(self): + from pre_tool_git_guard import inline_skip_gate + # commit message 中提到 skipGate 不应被误判为豁免 + self.assertFalse(inline_skip_gate( + 'git commit -m "docs: mention codeguard.skipGate in README"' + )) + + +class JdkResolutionTests(unittest.TestCase): + """P0-2：JDK 兼容性解析。""" + + def test_no_pom_returns_none(self): + from java_project import _resolve_java_home + root = Path(tempfile.mkdtemp()) + home, reason = _resolve_java_home(root) + self.assertIsNone(home) + self.assertIsNone(reason) + + def test_declared_java_version_returns_reason_when_no_jdk(self): + from java_project import _resolve_java_home + root = Path(tempfile.mkdtemp()) + (root / "pom.xml").write_text( + '99', + encoding="utf-8", + ) + home, reason = _resolve_java_home(root) + # JDK 99 大概率不存在——应返回 None + 原因 + if home is None: + self.assertIsNotNone(reason) + self.assertIn("99", reason) + + +if __name__ == "__main__": + unittest.main() diff --git a/tests/test_verdict_integrity.py b/tests/test_verdict_integrity.py index 233248d..20e2ff5 100644 --- a/tests/test_verdict_integrity.py +++ b/tests/test_verdict_integrity.py @@ -6,6 +6,7 @@ import io import json import os +import shutil import subprocess import sys import tempfile @@ -23,6 +24,9 @@ import run_per_language from detect_lang import LANG_COMMANDS +# auto_fix 用例需真实 ruff 执行 format/check——工具缺失时断言的修复路径无法覆盖。 +RUFF_AVAILABLE = shutil.which("ruff") is not None + class RepoCase(unittest.TestCase): def setUp(self): @@ -116,6 +120,7 @@ def test_scoped_check_runs_each_placeholder_file(self): self.assertEqual(result["status"], "FAIL") self.assertIn("b.sh", result["stdout_tail"]) + @unittest.skipUnless(RUFF_AVAILABLE, "ruff not installed (pip install ruff) — auto_fix 需真实 ruff") def test_mcp_auto_fix_never_touches_clean_files(self): self.put("clean.py", "import os\n") self.git("add", ".")