@andyqiu/codeforge 0.5.14 → 0.5.15

package/bin/codeforge.mjs

@@ -115,7 +115,7 @@ function installOpencode({ scope, dryRun, extraArgs, quiet = false }) {
     if (dryRun) flagArgs.push("--dry-run")
   }
   const all = [...baseArgs, ...flagArgs, ...(extraArgs ?? [])]
-  log(`opencode: ${cmd} ${all.join(" ")}`)
+  if (!quiet) log(`opencode: ${cmd} ${all.join(" ")}`)
   const r = spawnSync(cmd, all, { stdio: quiet ? "pipe" : "inherit", cwd: REPO_ROOT })
   if (quiet && r.status !== 0) {
     if (r.stderr) process.stderr.write(r.stderr)

package/dist/index.js

@@ -13269,8 +13269,8 @@ async function mergeSessionBack(opts) {
     });
     throw new Error(`mergeSessionBack: squash merge 失败（已 reset 主仓兜底）: ${err.message}`);
   }
-  const hasDevOnce = await packageHasScript(mainRoot, "dev:once");
-  if (hasDevOnce) {
+  const buildScript = await getBuildScript(mainRoot);
+  if (buildScript) {
     const stagedRaw = await runGit2(mainRoot, [
       "diff",
       "--cached",
@@ -13281,18 +13281,18 @@ async function mergeSessionBack(opts) {
     const canSkipDevOnce = await shouldSkipDevOnce(mainRoot, stagedPaths);
     if (canSkipDevOnce) {
       const sourceCount = stagedPaths.filter((p) => /^(plugins|lib|src)\//.test(p) && !/\.(md|test\.ts)$/.test(p)).length;
-      console.log(`[session-worktree] skip dev:once: dist 已是最新（${sourceCount} staged 源文件 mtime <= dist mtime）`);
+      console.log(`[session-worktree] skip ${buildScript}: dist 已是最新（${sourceCount} staged 源文件 mtime <= dist mtime）`);
     } else {
       try {
-        await runCmd("npm", ["run", "dev:once"], mainRoot);
+        await runCmd("npm", ["run", buildScript], mainRoot);
       } catch (err) {
         await runGit2(mainRoot, ["reset", "--hard", "HEAD"]).catch(() => {});
         const msg = err instanceof Error ? err.message : String(err);
-        throw new Error(`dev:once 失败已 reset 主仓: ${msg}`);
+        throw new Error(`${buildScript} 失败已 reset 主仓: ${msg}`);
       }
     }
   } else {
-    console.log(`[session-worktree] skip dev:once: not configured in ${mainRoot}/package.json`);
+    console.warn(`[session-worktree] skip build step: neither build:dev nor dev:once configured in ${mainRoot}/package.json`);
   }
   const squashedRaw = await runGit2(wt, ["log", "--format=%s", `${baseSha}..HEAD`]);
   const squashedCommits = squashedRaw.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
@@ -13430,6 +13430,13 @@ async function packageHasScript(mainRoot, scriptName) {
     return false;
   }
 }
+async function getBuildScript(mainRoot) {
+  if (await packageHasScript(mainRoot, "build:dev"))
+    return "build:dev";
+  if (await packageHasScript(mainRoot, "dev:once"))
+    return "dev:once";
+  return null;
+}
 async function shouldSkipDevOnce(mainRoot, stagedPaths) {
   let distMtimeSec;
   try {
@@ -21355,9 +21362,9 @@ var RISK_PATTERNS = [
   },
   {
     tag: "write_secrets",
-    kinds: ["bash"],
-    re: /(\.env(?:\.\w+)?|id_[edr]sa|\.ssh\/id_|\.pem|\.p12|secret\.json)/i,
-    matchOn: ["command"]
+    kinds: ["bash", "edit"],
+    re: /(?:^|[\s/"'])(id_[edr]sa|secret\.json|\.env(?:\.\w+)?)(?:$|[\s"'/])|[\w./-]+\.(?:pem|p12)(?:$|[\s"'])|\.ssh\/id_/i,
+    matchOn: ["command", "filePath", "path", "target"]
   },
   {
     tag: "write_etc",
@@ -21778,7 +21785,7 @@ import * as zlib from "node:zlib";
 // lib/version-injected.ts
 function getInjectedVersion() {
   try {
-    const v = "0.5.14";
+    const v = "0.5.15";
     if (typeof v === "string" && /^\d+\.\d+\.\d+/.test(v)) {
       return v;
     }
@@ -23058,14 +23065,18 @@ var handler24 = workflowEngineServer;
 import path27 from "node:path";
 var PLUGIN_NAME25 = "session-worktree-guard";
 logLifecycle(PLUGIN_NAME25, "import", {});
-var WRITE_INTENT_RE = />(?![=&])|\btee\b|\brm\b|\bmv\b|\bcp\b|\bmkdir\b|\btouch\b|\bchmod\b|\bchown\b|\bln\b/;
-var READ_ONLY_COMMANDS = /^\s*(?:ls|cat|head|tail|grep|rg|find|fd|wc|stat|file|which|whereis|echo|pwd|cd|pushd|popd|env|printenv|type|less|more|sort|uniq|awk|tr|cut|jq|date|whoami|id|uname|git(?:\s+-C\s+\S+)?\s+(?:log|show|diff|status|branch|tag|remote|config\s+--get|rev-parse|rev-list|ls-files|ls-tree|cat-file|describe|reflog|blame|shortlog|name-rev|symbolic-ref|merge-base|worktree\s+list|stash\s+list|stash\s+show))\b/;
-var SIDE_EFFECT_TOKEN_RE = />(?![=&])|\|\s*tee\b|\btee\b/;
+var WRITE_INTENT_RE = />(?![=&])(?!\s*\/dev\/(?:null|stdout|stderr|fd\/\d+)\b)|\btee\b|\brm\b|\bmv\b|\bcp\b|\bmkdir\b|\btouch\b|\bchmod\b|\bchown\b|\bln\b/;
+var READ_ONLY_COMMANDS = /^\s*(?:ls|cat|head|tail|grep|rg|find|fd|wc|stat|file|which|whereis|echo|pwd|cd|pushd|popd|env|printenv|type|less|more|sort|uniq|awk|tr|cut|jq|date|whoami|id|uname|node|npx|tsc|diff|python3?|git(?:\s+-C\s+\S+)?\s+(?:log|show|diff|status|branch|tag|remote|config\s+--get|rev-parse|rev-list|ls-files|ls-tree|cat-file|describe|reflog|blame|shortlog|name-rev|symbolic-ref|merge-base|worktree\s+list|stash\s+list|stash\s+show))\b/;
+var SIDE_EFFECT_TOKEN_RE = />(?![=&])(?!\s*\/dev\/(?:null|stdout|stderr|fd\/\d+)\b)|\|\s*tee\b|\btee\b/;
 function isReadOnlyBashCommand(command) {
   if (!READ_ONLY_COMMANDS.test(command))
     return false;
   if (SIDE_EFFECT_TOKEN_RE.test(command))
     return false;
+  for (const re of INTERPRETER_WRITE_RES) {
+    if (re.test(command))
+      return false;
+  }
   return true;
 }
 var INTERPRETER_WRITE_RES = [
@@ -23073,6 +23084,9 @@ var INTERPRETER_WRITE_RES = [
   /node.*writeFile/,
   /perl.*>/
 ];
+function stripCommitMessageArgs(command) {
+  return command.replace(/(?:^|\s)(?:-m|--message|-F|--file)(?:=|\s+)("[^"]*"|'[^']*')/g, " ");
+}
 function escapeRegex2(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -23161,13 +23175,14 @@ function commandContainsMainRootExcludingWorktree(command, mainRoot, worktreePat
 function detectBashWriteIntent(command, mainRoot) {
   if (isReadOnlyBashCommand(command))
     return false;
-  if (WRITE_INTENT_RE.test(command))
+  const sanitized = stripCommitMessageArgs(command);
+  if (WRITE_INTENT_RE.test(sanitized))
     return true;
   for (const re of INTERPRETER_WRITE_RES) {
-    if (re.test(command))
+    if (re.test(sanitized))
       return true;
   }
-  if (buildGitVcsWriteRegex(mainRoot).test(command))
+  if (buildGitVcsWriteRegex(mainRoot).test(sanitized))
     return true;
   return false;
 }
@@ -23181,13 +23196,14 @@ function isWriteOperation(toolName, argsObj, mainRoot) {
     return false;
   if (isReadOnlyBashCommand(command))
     return false;
-  if (WRITE_INTENT_RE.test(command))
+  const sanitized = stripCommitMessageArgs(command);
+  if (WRITE_INTENT_RE.test(sanitized))
     return true;
   for (const re of INTERPRETER_WRITE_RES) {
-    if (re.test(command))
+    if (re.test(sanitized))
       return true;
   }
-  if (mainRoot && buildGitVcsWriteRegex(mainRoot).test(command))
+  if (mainRoot && buildGitVcsWriteRegex(mainRoot).test(sanitized))
     return true;
   return false;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andyqiu/codeforge",
-  "version": "0.5.14",
+  "version": "0.5.15",
   "description": "CodeForge — opencode 的零侵入扩展包",
   "type": "module",
   "private": false,
@@ -33,7 +33,7 @@
     "build:types": "tsc -p tsconfig.build.json --emitDeclarationOnly",
     "build:watch": "node ./scripts/build-with-version.mjs --watch",
     "dev": "node ./scripts/dev-sync.mjs --watch",
-    "dev:once": "node ./scripts/dev-sync.mjs",
+    "build:dev": "node ./scripts/dev-sync.mjs",
     "dev-sync": "node ./scripts/dev-sync.mjs",
     "dev-sync:watch": "node ./scripts/dev-sync.mjs --watch",
     "typecheck": "tsc -p tsconfig.json --noEmit",
@@ -72,14 +72,9 @@
     "replay": "node ./scripts/codeforge-replay.mjs",
     "release": "node ./scripts/release.mjs",
     "release:dry": "node ./scripts/release.mjs --dry-run",
-    "publish:patch": "bash ./scripts/publish.sh patch",
-    "publish:minor": "bash ./scripts/publish.sh minor",
-    "publish:major": "bash ./scripts/publish.sh major",
-    "publish:dry": "bash ./scripts/publish.sh --dry-run",
-    "publish:win:patch": "powershell -NoProfile -ExecutionPolicy Bypass -File ./scripts/publish.ps1",
-    "publish:win:minor": "powershell -NoProfile -ExecutionPolicy Bypass -File ./scripts/publish.ps1 -Minor",
-    "publish:win:major": "powershell -NoProfile -ExecutionPolicy Bypass -File ./scripts/publish.ps1 -Major",
-    "publish:win:dry": "powershell -NoProfile -ExecutionPolicy Bypass -File ./scripts/publish.ps1 -DryRun",
+    "release:patch": "node ./scripts/release.mjs patch",
+    "release:minor": "node ./scripts/release.mjs minor",
+    "release:major": "node ./scripts/release.mjs major",
     "prepublishOnly": "npm run build && npm run typecheck && npm test",
     "prepare": "husky"
   },