@devcxl/opencode-cabbage 0.2.1 → 0.3.1

package/dist/flowrun/adapter.js

@@ -0,0 +1,293 @@
+import { createHash } from "node:crypto";
+import { spawn } from "node:child_process";
+// ─── Selector 校验 ───
+/** 危险字符正则 */
+const DANGEROUS_SELECTOR = /[|;&$()`\x00-\x08\x0b\x0c\x0e-\x1f\r\n]/;
+/**
+ * 校验 test selector 语法安全。
+ * 拒绝 shell 元字符、命令替换、换行等。
+ */
+export function validateSelector(selector) {
+    if (!selector || !selector.trim()) {
+        throw new Error("Selector must not be empty");
+    }
+    if (DANGEROUS_SELECTOR.test(selector)) {
+        throw new Error(`Selector contains invalid or dangerous characters: ${JSON.stringify(selector)}`);
+    }
+}
+// ─── 命令构建 ───
+/**
+ * 将 baseCommand 字符串解析为 argv 数组并附加 selector。
+ */
+export function buildVitestArgs(policy, selector) {
+    const args = policy.baseCommand.trim().split(/\s+/).filter(Boolean);
+    args.push(selector);
+    return args;
+}
+// ─── 进程执行 ───
+/**
+ * 执行 vitest 命令并捕获输出。
+ */
+export function executeVitest(args, cwd, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(args[0], args.slice(1), {
+            cwd,
+            env: { ...process.env },
+            stdio: ["ignore", "pipe", "pipe"],
+            timeout: timeoutMs,
+        });
+        let stdout = "";
+        let stderr = "";
+        let timedOut = false;
+        child.stdout?.on("data", (chunk) => {
+            stdout += chunk.toString("utf-8");
+        });
+        child.stderr?.on("data", (chunk) => {
+            stderr += chunk.toString("utf-8");
+        });
+        child.on("error", (err) => {
+            // spawn 本身失败（如找不到命令）
+            if (err.code === "ENOENT") {
+                resolve({
+                    exitCode: 127,
+                    testsCollected: null,
+                    testsFailed: null,
+                    stdout,
+                    stderr: `${stderr}\nCommand not found: ${args[0]}`,
+                    timedOut: false,
+                });
+            }
+            else {
+                reject(err);
+            }
+        });
+        child.on("close", (code, signal) => {
+            timedOut = signal === "SIGTERM" || signal === "SIGKILL";
+            resolve({
+                exitCode: code,
+                testsCollected: null, // will be enriched later
+                testsFailed: null,
+                stdout,
+                stderr,
+                timedOut,
+            });
+        });
+    });
+}
+// ─── 输出解析 ───
+/**
+ * 从 vitest stdout 解析 JSON reporter 输出，提取测试统计数据。
+ */
+function parseVitestJson(stdout) {
+    // 在 stdout 中查找 vitest JSON reporter 的输出（通常是一个 JSON 对象）
+    // 支持多行 JSON 输出，查找以 "numTotalTests" 为特征的 JSON
+    const jsonMatch = stdout.match(/\{[\s\S]*"numTotalTests"\s*:\s*\d+[\s\S]*\}/);
+    if (!jsonMatch)
+        return null;
+    try {
+        const json = JSON.parse(jsonMatch[0]);
+        const collected = typeof json.numTotalTests === "number" ? json.numTotalTests : null;
+        const failed = typeof json.numFailedTests === "number" ? json.numFailedTests : null;
+        if (collected === null || failed === null)
+            return null;
+        return { testsCollected: collected, testsFailed: failed };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * 从 stderr 解析 vitest 错误，提取测试计数（兜底解析）。
+ */
+function parseVitestSummary(stderr) {
+    // vitest verbose 输出: "Tests  2 passed (2) | 1 failed (1)"
+    // 或 "Tests  2 passed (2)"
+    const summaryMatch = stderr.match(/Tests\s+\d+\s+failed\s*\((\d+)\)/);
+    const totalMatch = stderr.match(/Tests\s+\d+\s+failed[\s\S]*?\|\s*(\d+)\s+passed/);
+    const passedMatch = stderr.match(/(\d+)\s+passed/);
+    let testsCollected = null;
+    let testsFailed = null;
+    if (summaryMatch) {
+        testsFailed = parseInt(summaryMatch[1], 10);
+    }
+    else {
+        // 检查是否有 "No test files found" 或 "0 tests"
+        if (stderr.includes("No test files found") || stderr.includes("no tests found")) {
+            return { testsCollected: 0, testsFailed: 0 };
+        }
+    }
+    // 尝试计算 collected = passed + failed
+    const totalPassedMatch = stderr.match(/(\d+)\s+passed/);
+    if (totalPassedMatch && testsFailed !== null) {
+        testsCollected = parseInt(totalPassedMatch[1], 10) + testsFailed;
+    }
+    else if (testsFailed === null) {
+        // 可能全部通过
+        const allPassedMatch = stderr.match(/Tests\s+(\d+)\s+passed/);
+        if (allPassedMatch) {
+            testsCollected = parseInt(allPassedMatch[1], 10);
+            testsFailed = 0;
+        }
+    }
+    return { testsCollected, testsFailed };
+}
+// ─── 失败分类 ───
+/**
+ * 根据 vitest 输出分类失败类型。
+ *
+ * 规则：
+ * - timeout → "timeout"
+ * - 成功启动 + 收集测试 + assertion 失败 → "assertion"（RED）
+ * - 成功启动 + 目标代码不存在 → "missing-behavior"（RED）
+ * - config/transform/dep 错误 → "infrastructure"
+ * - 零测试收集 → "infrastructure"
+ */
+export function classifyVitestFailure(input) {
+    // timeout
+    if (input.timedOut)
+        return "timeout";
+    // 测试全部通过
+    if (input.exitCode === 0 && input.testsFailed === 0)
+        return null;
+    // 退出码正常但无法判断
+    if (input.exitCode === 0 && input.testsFailed === null)
+        return null;
+    // 失败的退出码
+    if (input.exitCode !== null && input.exitCode !== 0) {
+        const stderr = input.stderr;
+        // ── 基础设施错误 ──
+        // 配置加载失败
+        if (/failed to load config/i.test(stderr) ||
+            /cannot find module.*vitest/i.test(stderr) ||
+            /cannot find package.*vitest/i.test(stderr)) {
+            return "infrastructure";
+        }
+        // Transform 错误
+        if (/transform failed/i.test(stderr) ||
+            /unexpected token/i.test(stderr)) {
+            return "infrastructure";
+        }
+        // 依赖缺失（非实现代码的模块）
+        if (/cannot find module/i.test(stderr)) {
+            // 区分：如果缺失的模块匹配实现文件路径模式，则是 missing-behavior
+            // 否则是 infrastructure（缺少外部依赖）
+            const moduleMatch = stderr.match(/cannot find module\s+['"]([^'"]+)['"]/i);
+            if (moduleMatch) {
+                const missingModule = moduleMatch[1];
+                // 相对路径导入 → missing-behavior（目标代码不存在）
+                if (missingModule.startsWith(".") || missingModule.startsWith("/")) {
+                    return "missing-behavior";
+                }
+                // 绝对包名 → infrastructure（缺少依赖）
+                return "infrastructure";
+            }
+            // 无法判断是什么模块，默认为 infrastructure
+            return "infrastructure";
+        }
+        // 零测试收集
+        if (input.testsCollected === 0)
+            return "infrastructure";
+        // ── assertion 失败 ──
+        // 需要 testsCollected > 0 AND testsFailed > 0 才算是 assertion
+        if (input.testsCollected !== null && input.testsCollected > 0 &&
+            input.testsFailed !== null && input.testsFailed > 0) {
+            return "assertion";
+        }
+        // ── 有测试收集但 testsFailed 为 0/null 且 exitCode 非零 ── 无法确定失败原因
+        if (input.testsCollected !== null && input.testsCollected > 0) {
+            return "unknown";
+        }
+        // 无法分类
+        return "unknown";
+    }
+    // 无退出码（被 kill 等）
+    if (input.exitCode === null && input.testsCollected !== null && input.testsCollected === 0) {
+        return "infrastructure";
+    }
+    return "unknown";
+}
+// ─── SHA-256 辅助 ───
+function sha256Hex(content) {
+    return createHash("sha256").update(content, "utf-8").digest("hex");
+}
+// ─── 主函数 ───
+/**
+ * 执行 RED check：运行 vitest focused test，返回 TddCommandEvidence。
+ *
+ * @param policy - TDD runner policy（含 baseCommand、timeoutMs 等）
+ * @param selector - focused test selector（文件路径或 vitest flag）
+ * @param cwd - 工作目录
+ */
+export async function executeRedCheck(policy, selector, cwd) {
+    // 1. 校验 selector
+    validateSelector(selector);
+    // 2. 构建命令
+    const args = buildVitestArgs(policy, selector);
+    const commandStr = args.join(" ");
+    // 3. 执行
+    const startedAt = new Date().toISOString();
+    const startMs = Date.now();
+    const output = await executeVitest(args, cwd, policy.timeoutMs);
+    const durationMs = Date.now() - startMs;
+    const finishedAt = new Date().toISOString();
+    // 4. 解析 vitest 输出获取测试统计数据
+    const jsonStats = parseVitestJson(output.stdout);
+    const summaryStats = parseVitestSummary(output.stderr);
+    const testsCollected = jsonStats?.testsCollected ?? summaryStats.testsCollected ?? null;
+    const testsFailed = jsonStats?.testsFailed ?? summaryStats.testsFailed ?? null;
+    // 5. 分类失败
+    const failureKind = classifyVitestFailure({
+        exitCode: output.exitCode,
+        testsCollected,
+        testsFailed,
+        stderr: output.stderr,
+        timedOut: output.timedOut,
+    });
+    // 6. 计算 outputDigest（stdout + stderr 的 SHA-256）
+    const outputDigest = {
+        algorithm: "sha256-output-v1",
+        value: sha256Hex(output.stdout + "\n" + output.stderr),
+    };
+    // 7. workspaceDigest 和 executionInputDigest 留空（由调用方/broker 填充）
+    const placeholderDigest = {
+        algorithm: "sha256-content-v1",
+        value: "0".repeat(64),
+    };
+    // 8. 构建 summary
+    let summary;
+    if (output.timedOut) {
+        summary = `Test execution timed out after ${policy.timeoutMs}ms`;
+    }
+    else if (failureKind === "assertion") {
+        summary = `${testsFailed}/${testsCollected} tests failed (assertion)`;
+    }
+    else if (failureKind === "missing-behavior") {
+        summary = `Target code not found: ${selector}`;
+    }
+    else if (failureKind === "infrastructure") {
+        summary = `Infrastructure error: ${output.stderr.slice(0, 200)}`;
+    }
+    else if (output.exitCode === 0) {
+        summary = `${testsCollected ?? "?"} tests passed`;
+    }
+    else {
+        summary = `Exit code ${output.exitCode}: ${output.stderr.slice(0, 200)}`;
+    }
+    return {
+        command: commandStr,
+        testSelector: selector,
+        exitCode: output.exitCode,
+        failureKind,
+        testsCollected,
+        testsFailed,
+        startedAt,
+        finishedAt,
+        durationMs,
+        changedFiles: [],
+        outputDigest,
+        workspaceDigest: placeholderDigest,
+        executionInputDigest: placeholderDigest,
+        summary,
+    };
+}
+//# sourceMappingURL=adapter.js.map

package/dist/flowrun/adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../src/flowrun/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAuB1C,sBAAsB;AAEtB,aAAa;AACb,MAAM,kBAAkB,GAAG,yCAAyC,CAAA;AAEpE;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,sDAAsD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACnG,CAAC;AACH,CAAC;AAED,eAAe;AAEf;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,MAAuB,EAAE,QAAgB;IACvE,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACnE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACnB,OAAO,IAAI,CAAA;AACb,CAAC;AAED,eAAe;AAEf;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,IAAc,EAAE,GAAW,EAAE,SAAiB;IAC1E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YAC1C,GAAG;YACH,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;YACvB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,OAAO,EAAE,SAAS;SACnB,CAAC,CAAA;QAEF,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,IAAI,QAAQ,GAAG,KAAK,CAAA;QAEpB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC,CAAC,CAAA;QAEF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC,CAAC,CAAA;QAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YAC/C,qBAAqB;YACrB,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,CAAC;oBACN,QAAQ,EAAE,GAAG;oBACb,cAAc,EAAE,IAAI;oBACpB,WAAW,EAAE,IAAI;oBACjB,MAAM;oBACN,MAAM,EAAE,GAAG,MAAM,wBAAwB,IAAI,CAAC,CAAC,CAAC,EAAE;oBAClD,QAAQ,EAAE,KAAK;iBAChB,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,CAAA;YACb,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,MAAqB,EAAE,EAAE;YAC/D,QAAQ,GAAG,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,CAAA;YACvD,OAAO,CAAC;gBACN,QAAQ,EAAE,IAAI;gBACd,cAAc,EAAE,IAAI,EAAE,yBAAyB;gBAC/C,WAAW,EAAE,IAAI;gBACjB,MAAM;gBACN,MAAM;gBACN,QAAQ;aACT,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,eAAe;AAEf;;GAEG;AACH,SAAS,eAAe,CAAC,MAAc;IACrC,uDAAuD;IACvD,6CAA6C;IAC7C,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAC7E,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAE3B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAA;QACpF,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAA;QACnF,IAAI,SAAS,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QACtD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,MAAc;IACxC,0DAA0D;IAC1D,0BAA0B;IAC1B,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAA;IACrE,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAA;IAClF,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;IAElD,IAAI,cAAc,GAAkB,IAAI,CAAA;IACxC,IAAI,WAAW,GAAkB,IAAI,CAAA;IAErC,IAAI,YAAY,EAAE,CAAC;QACjB,WAAW,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC7C,CAAC;SAAM,CAAC;QACN,0CAA0C;QAC1C,IAAI,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAChF,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAA;QAC9C,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;IACvD,IAAI,gBAAgB,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QAC7C,cAAc,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,WAAW,CAAA;IAClE,CAAC;SAAM,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QAChC,SAAS;QACT,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAA;QAC7D,IAAI,cAAc,EAAE,CAAC;YACnB,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAChD,WAAW,GAAG,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,CAAA;AACxC,CAAC;AAED,eAAe;AAEf;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAmB;IACvD,UAAU;IACV,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAA;IAEpC,SAAS;IACT,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,IAAI,KAAK,CAAC,WAAW,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAEhE,aAAa;IACb,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAEnE,SAAS;IACT,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;QAE3B,eAAe;QAEf,SAAS;QACT,IAAI,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC;YACrC,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC;YAC1C,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,OAAO,gBAAgB,CAAA;QACzB,CAAC;QAED,eAAe;QACf,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;YAChC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,OAAO,gBAAgB,CAAA;QACzB,CAAC;QAED,iBAAiB;QACjB,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,2CAA2C;YAC3C,6BAA6B;YAC7B,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAA;YAC1E,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;gBACpC,qCAAqC;gBACrC,IAAI,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnE,OAAO,kBAAkB,CAAA;gBAC3B,CAAC;gBACD,8BAA8B;gBAC9B,OAAO,gBAAgB,CAAA;YACzB,CAAC;YACD,+BAA+B;YAC/B,OAAO,gBAAgB,CAAA;QACzB,CAAC;QAED,QAAQ;QACR,IAAI,KAAK,CAAC,cAAc,KAAK,CAAC;YAAE,OAAO,gBAAgB,CAAA;QAEvD,qBAAqB;QACrB,0DAA0D;QAC1D,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI,IAAI,KAAK,CAAC,cAAc,GAAG,CAAC;YACzD,KAAK,CAAC,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;YACxD,OAAO,WAAW,CAAA;QACpB,CAAC;QAED,2DAA2D;QAC3D,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI,IAAI,KAAK,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;YAC9D,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,OAAO;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,iBAAiB;IACjB,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI,IAAI,KAAK,CAAC,cAAc,KAAK,CAAC,EAAE,CAAC;QAC3F,OAAO,gBAAgB,CAAA;IACzB,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,qBAAqB;AAErB,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACpE,CAAC;AAED,cAAc;AAEd;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAuB,EACvB,QAAgB,EAChB,GAAW;IAEX,iBAAiB;IACjB,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IAE1B,UAAU;IACV,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAEjC,QAAQ;IACR,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC1B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAA;IACvC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAE3C,0BAA0B;IAC1B,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAChD,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAEtD,MAAM,cAAc,GAAG,SAAS,EAAE,cAAc,IAAI,YAAY,CAAC,cAAc,IAAI,IAAI,CAAA;IACvF,MAAM,WAAW,GAAG,SAAS,EAAE,WAAW,IAAI,YAAY,CAAC,WAAW,IAAI,IAAI,CAAA;IAE9E,UAAU;IACV,MAAM,WAAW,GAAG,qBAAqB,CAAC;QACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc;QACd,WAAW;QACX,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAA;IAEF,gDAAgD;IAChD,MAAM,YAAY,GAAoB;QACpC,SAAS,EAAE,kBAAkB;QAC7B,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;KACvD,CAAA;IAED,+DAA+D;IAC/D,MAAM,iBAAiB,GAAoB;QACzC,SAAS,EAAE,mBAAmB;QAC9B,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;KACtB,CAAA;IAED,gBAAgB;IAChB,IAAI,OAAe,CAAA;IACnB,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,GAAG,kCAAkC,MAAM,CAAC,SAAS,IAAI,CAAA;IAClE,CAAC;SAAM,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;QACvC,OAAO,GAAG,GAAG,WAAW,IAAI,cAAc,2BAA2B,CAAA;IACvE,CAAC;SAAM,IAAI,WAAW,KAAK,kBAAkB,EAAE,CAAC;QAC9C,OAAO,GAAG,0BAA0B,QAAQ,EAAE,CAAA;IAChD,CAAC;SAAM,IAAI,WAAW,KAAK,gBAAgB,EAAE,CAAC;QAC5C,OAAO,GAAG,yBAAyB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAA;IAClE,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,GAAG,GAAG,cAAc,IAAI,GAAG,eAAe,CAAA;IACnD,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,aAAa,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAA;IAC1E,CAAC;IAED,OAAO;QACL,OAAO,EAAE,UAAU;QACnB,YAAY,EAAE,QAAQ;QACtB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW;QACX,cAAc;QACd,WAAW;QACX,SAAS;QACT,UAAU;QACV,UAAU;QACV,YAAY,EAAE,EAAE;QAChB,YAAY;QACZ,eAAe,EAAE,iBAAiB;QAClC,oBAAoB,EAAE,iBAAiB;QACvC,OAAO;KACR,CAAA;AACH,CAAC"}

package/dist/flowrun/ci.d.ts

@@ -0,0 +1,64 @@
+import type { RepositoryQualityPolicy, TaskCommand, CoveragePolicy } from "./types.js";
+/** 从 gh pr view --json statusCheckRollup 获取的 PR 检查结果 */
+export interface PRCheckResult {
+    context: string;
+    state: "EXPECTED" | "ERROR" | "FAILURE" | "PENDING" | "SUCCESS";
+    app: {
+        id: number;
+        name: string;
+    } | null;
+}
+/** checkRequiredChecks 的返回结果 */
+export interface CICheckResult {
+    allPassed: boolean;
+    missingContexts: string[];
+    failedContexts: string[];
+    pendingContexts: string[];
+    untrustedSources: Array<{
+        context: string;
+        expectedAppId: number;
+        actualAppId: number | null;
+    }>;
+}
+/** validateRequiredWorkflow 的返回结果 */
+export interface RequiredWorkflowValidation {
+    valid: boolean;
+    errors: string[];
+}
+/**
+ * 验证 PR 的状态检查是否满足 RepositoryQualityPolicy 中定义的 required checks。
+ *
+ * 规则：
+ * - mode 为 "off" 时不校验，直接返回 allPassed: true
+ * - mode 为 "required" 时：
+ *   1. 每个 requiredChecks 中的 context 必须在 PR checks 中存在
+ *   2. 状态必须为 SUCCESS
+ *   3. 发布该 check 的 GitHub App ID 必须与配置的 appId 匹配
+ *      （appId 为 0 时不校验来源）
+ */
+export declare function checkRequiredChecks(policy: RepositoryQualityPolicy, prChecks: PRCheckResult[]): CICheckResult;
+/**
+ * 验证 RepositoryQualityPolicy 的 requiredChecks 配置有效性。
+ *
+ * 规则：
+ * - mode 为 "off" 时跳过所有校验
+ * - mode 为 "required" 时：
+ *   1. requiredChecks 不能为空
+ *   2. 每个 entry 必须有 workflowPath、workflowRef
+ *   3. 不允许重复的 context
+ */
+export declare function validateRequiredWorkflow(policy: RepositoryQualityPolicy): RequiredWorkflowValidation;
+/**
+ * checkBranchProtection 委托给 merge.ts 中已有的实现。
+ * 这里作为 re-export wrapper，保持 CI 模块的 API 统一性。
+ */
+export { checkBranchProtection } from "./merge.js";
+/**
+ * 计算质量契约摘要（Quality Contract Digest）。
+ *
+ * 绑定 testCommands + verifyCommands + coveragePolicy，
+ * 使用 JCS (JSON Canonicalization Scheme) + SHA-256 生成确定性摘要。
+ *
+ * 用于在 PR checkpoint 中记录期望的契约版本，确保 CI 执行时契约未被修改。
+ */
+export declare function computeQualityContractDigest(testCommands: TaskCommand[], verifyCommands: TaskCommand[], coveragePolicy: CoveragePolicy | null): string;

package/dist/flowrun/ci.js

@@ -0,0 +1,184 @@
+import { createHash } from "node:crypto";
+// ─── checkRequiredChecks ───
+/**
+ * 验证 PR 的状态检查是否满足 RepositoryQualityPolicy 中定义的 required checks。
+ *
+ * 规则：
+ * - mode 为 "off" 时不校验，直接返回 allPassed: true
+ * - mode 为 "required" 时：
+ *   1. 每个 requiredChecks 中的 context 必须在 PR checks 中存在
+ *   2. 状态必须为 SUCCESS
+ *   3. 发布该 check 的 GitHub App ID 必须与配置的 appId 匹配
+ *      （appId 为 0 时不校验来源）
+ */
+export function checkRequiredChecks(policy, prChecks) {
+    // mode off — 不增加额外约束
+    if (policy.mode === "off") {
+        return {
+            allPassed: true,
+            missingContexts: [],
+            failedContexts: [],
+            pendingContexts: [],
+            untrustedSources: [],
+        };
+    }
+    // mode required — 逐项验证
+    const prCheckMap = new Map();
+    for (const c of prChecks) {
+        prCheckMap.set(c.context, c);
+    }
+    const missingContexts = [];
+    const failedContexts = [];
+    const pendingContexts = [];
+    const untrustedSources = [];
+    for (const required of policy.requiredChecks) {
+        const prCheck = prCheckMap.get(required.context);
+        // 1. context 缺失
+        if (!prCheck) {
+            missingContexts.push(required.context);
+            continue;
+        }
+        // 2. 状态检查
+        if (prCheck.state === "SUCCESS") {
+            // 通过 — 继续检查来源
+        }
+        else if (prCheck.state === "PENDING" || prCheck.state === "EXPECTED") {
+            pendingContexts.push(required.context);
+            continue;
+        }
+        else {
+            // FAILURE, ERROR
+            failedContexts.push(required.context);
+            continue;
+        }
+        // 3. 来源验证（appId 为 0 时不校验）
+        if (required.appId !== 0) {
+            if (!prCheck.app || prCheck.app.id !== required.appId) {
+                untrustedSources.push({
+                    context: required.context,
+                    expectedAppId: required.appId,
+                    actualAppId: prCheck.app?.id ?? null,
+                });
+            }
+        }
+    }
+    const allPassed = missingContexts.length === 0 &&
+        failedContexts.length === 0 &&
+        pendingContexts.length === 0 &&
+        untrustedSources.length === 0;
+    return {
+        allPassed,
+        missingContexts,
+        failedContexts,
+        pendingContexts,
+        untrustedSources,
+    };
+}
+// ─── validateRequiredWorkflow ───
+/**
+ * 验证 RepositoryQualityPolicy 的 requiredChecks 配置有效性。
+ *
+ * 规则：
+ * - mode 为 "off" 时跳过所有校验
+ * - mode 为 "required" 时：
+ *   1. requiredChecks 不能为空
+ *   2. 每个 entry 必须有 workflowPath、workflowRef
+ *   3. 不允许重复的 context
+ */
+export function validateRequiredWorkflow(policy) {
+    // mode off — 无需校验
+    if (policy.mode === "off") {
+        return { valid: true, errors: [] };
+    }
+    const errors = [];
+    // 1. requiredChecks 不能为空
+    if (policy.requiredChecks.length === 0) {
+        errors.push("requiredChecks must not be empty when mode is 'required'");
+        return { valid: false, errors };
+    }
+    // 2. 校验每个 entry
+    const seenContexts = new Set();
+    for (let i = 0; i < policy.requiredChecks.length; i++) {
+        const entry = policy.requiredChecks[i];
+        const prefix = `requiredChecks[${i}]`;
+        // 检查 context 重复
+        if (seenContexts.has(entry.context)) {
+            errors.push(`${prefix}: duplicate context "${entry.context}"`);
+        }
+        seenContexts.add(entry.context);
+        // 检查 workflowPath
+        if (!entry.workflowPath) {
+            errors.push(`${prefix}: workflowPath must not be empty`);
+        }
+        // 检查 workflowRef
+        if (!entry.workflowRef) {
+            errors.push(`${prefix}: workflowRef must not be empty`);
+        }
+    }
+    return { valid: errors.length === 0, errors };
+}
+// ─── checkBranchProtection ───
+/**
+ * checkBranchProtection 委托给 merge.ts 中已有的实现。
+ * 这里作为 re-export wrapper，保持 CI 模块的 API 统一性。
+ */
+export { checkBranchProtection } from "./merge.js";
+// ─── computeQualityContractDigest ───
+/**
+ * JCS (JSON Canonicalization Scheme) 序列化：
+ * - 对象的 key 按 UTF-8 字节序排序
+ * - 无多余空白
+ * - 数字保留原始精度
+ */
+function jcsStringify(value) {
+    if (value === null)
+        return "null";
+    if (typeof value === "boolean")
+        return value ? "true" : "false";
+    if (typeof value === "number") {
+        if (Number.isFinite(value)) {
+            // 使用标准数字序列化
+            return String(value);
+        }
+        return "null";
+    }
+    if (typeof value === "string") {
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        const items = value.map(jcsStringify);
+        return `[${items.join(",")}]`;
+    }
+    if (typeof value === "object") {
+        // 按 key 排序
+        const keys = Object.keys(value).sort((a, b) => {
+            const bufA = Buffer.from(a, "utf-8");
+            const bufB = Buffer.from(b, "utf-8");
+            return Buffer.compare(bufA, bufB);
+        });
+        const pairs = keys.map(k => {
+            const v = value[k];
+            return `${JSON.stringify(k)}:${jcsStringify(v)}`;
+        });
+        return `{${pairs.join(",")}}`;
+    }
+    return "null";
+}
+/**
+ * 计算质量契约摘要（Quality Contract Digest）。
+ *
+ * 绑定 testCommands + verifyCommands + coveragePolicy，
+ * 使用 JCS (JSON Canonicalization Scheme) + SHA-256 生成确定性摘要。
+ *
+ * 用于在 PR checkpoint 中记录期望的契约版本，确保 CI 执行时契约未被修改。
+ */
+export function computeQualityContractDigest(testCommands, verifyCommands, coveragePolicy) {
+    const contract = {
+        testCommands,
+        verifyCommands,
+        coveragePolicy,
+    };
+    const json = jcsStringify(contract);
+    return createHash("sha256").update(json, "utf-8").digest("hex");
+}
+//# sourceMappingURL=ci.js.map

package/dist/flowrun/ci.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci.js","sourceRoot":"","sources":["../../src/flowrun/ci.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAiCxC,8BAA8B;AAE9B;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAA+B,EAC/B,QAAyB;IAEzB,qBAAqB;IACrB,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO;YACL,SAAS,EAAE,IAAI;YACf,eAAe,EAAE,EAAE;YACnB,cAAc,EAAE,EAAE;YAClB,eAAe,EAAE,EAAE;YACnB,gBAAgB,EAAE,EAAE;SACrB,CAAA;IACH,CAAC;IAED,uBAAuB;IACvB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAA;IACnD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IAC9B,CAAC;IAED,MAAM,eAAe,GAAa,EAAE,CAAA;IACpC,MAAM,cAAc,GAAa,EAAE,CAAA;IACnC,MAAM,eAAe,GAAa,EAAE,CAAA;IACpC,MAAM,gBAAgB,GAAsC,EAAE,CAAA;IAE9D,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QAEhD,gBAAgB;QAChB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YACtC,SAAQ;QACV,CAAC;QAED,UAAU;QACV,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,cAAc;QAChB,CAAC;aAAM,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACvE,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YACtC,SAAQ;QACV,CAAC;aAAM,CAAC;YACN,iBAAiB;YACjB,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YACrC,SAAQ;QACV,CAAC;QAED,0BAA0B;QAC1B,IAAI,QAAQ,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACtD,gBAAgB,CAAC,IAAI,CAAC;oBACpB,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,aAAa,EAAE,QAAQ,CAAC,KAAK;oBAC7B,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI;iBACrC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GACb,eAAe,CAAC,MAAM,KAAK,CAAC;QAC5B,cAAc,CAAC,MAAM,KAAK,CAAC;QAC3B,eAAe,CAAC,MAAM,KAAK,CAAC;QAC5B,gBAAgB,CAAC,MAAM,KAAK,CAAC,CAAA;IAE/B,OAAO;QACL,SAAS;QACT,eAAe;QACf,cAAc;QACd,eAAe;QACf,gBAAgB;KACjB,CAAA;AACH,CAAC;AAED,mCAAmC;AAEnC;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAA+B;IAE/B,kBAAkB;IAClB,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACpC,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAA;IAE3B,yBAAyB;IACzB,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAA;QACvE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IACjC,CAAC;IAED,gBAAgB;IAChB,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAA;IAEtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAA;QACtC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAA;QAErC,gBAAgB;QAChB,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,wBAAwB,KAAK,CAAC,OAAO,GAAG,CAAC,CAAA;QAChE,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAE/B,kBAAkB;QAClB,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,kCAAkC,CAAC,CAAA;QAC1D,CAAC;QAED,iBAAiB;QACjB,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,iCAAiC,CAAC,CAAA;QACzD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;AAC/C,CAAC;AAED,gCAAgC;AAEhC;;;GAGG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAElD,uCAAuC;AAEvC;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAA;IACjC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,YAAY;YACZ,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;QACtB,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QACrC,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IAC/B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,WAAW;QACX,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;YACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;YACpC,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACnC,CAAC,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YACzB,MAAM,CAAC,GAAI,KAAiC,CAAC,CAAC,CAAC,CAAA;YAC/C,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,CAAA;QAClD,CAAC,CAAC,CAAA;QACF,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IAC/B,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAC1C,YAA2B,EAC3B,cAA6B,EAC7B,cAAqC;IAErC,MAAM,QAAQ,GAAG;QACf,YAAY;QACZ,cAAc;QACd,cAAc;KACf,CAAA;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC"}

package/dist/flowrun/coverage.d.ts

@@ -0,0 +1,70 @@
+import type { CoverageEvidence } from "./types.js";
+/**
+ * 检验 coverage report 路径的安全性。
+ *
+ * 规则：
+ * - 拒绝空路径
+ * - 拒绝绝对路径
+ * - 拒绝包含 null 字节等危险字符的路径
+ * - 拒绝包含 `..` 路径遍历的路径
+ *
+ * 注意：此函数仅检查路径结构，不处理 symlink。symlink 检查由 resolveCoveragePath 通过 realpath 完成。
+ */
+export declare function validateCoveragePath(reportPath: string, sandboxRoot: string): void;
+/**
+ * 在 sandbox 内安全地解析 coverage report 路径。
+ *
+ * 1. 先执行 validateCoveragePath 结构检查
+ * 2. join sandbox + reportPath
+ * 3. resolve 后确保不逃逸 sandbox
+ * 4. （调用方负责）通过 realpath 检查 symlink 逃逸
+ *
+ * 返回解析后的绝对路径。
+ */
+export declare function resolveCoveragePath(reportPath: string, sandboxRoot: string): string;
+export interface ParsedCoverageData {
+    actual: number;
+    metric: "lines";
+}
+/**
+ * 解析 istanbul-json-summary 格式的 coverage 报告。
+ *
+ * 抽取 `total.lines.pct`，执行严格的数值校验：
+ * - 拒绝缺少 `total.lines` 字段
+ * - 拒绝 `pct` 为 non-number、NaN、`"Unknown"` 等非数值
+ * - 拒绝 `pct` 超出 [0, 100] 范围
+ *
+ * 返回 ParsedCoverageData 或 null（解析失败/数据无效）。
+ */
+export declare function parseCoverageReport(reportPath: string, metric: "lines"): Promise<ParsedCoverageData | null>;
+export interface BuildCoverageEvidenceInput {
+    actual: number | null;
+    threshold: number;
+    metric: "lines";
+    headSha: string;
+    reportDigest: string | null;
+}
+/**
+ * 构建 CoverageEvidence。
+ *
+ * - actual >= threshold → pass
+ * - actual < threshold → fail
+ * - actual 为 null → pending（报告解析失败或不存在）
+ */
+export declare function buildCoverageEvidence(input: BuildCoverageEvidenceInput): CoverageEvidence;
+/**
+ * 简单的阈值校验（纯数字比较）。
+ */
+export declare function checkCoverageThreshold(actual: number, threshold: number): boolean;
+/**
+ * 对 coverage report 文件计算 digest。
+ * 用于绑定 report 内容与 evidence。
+ */
+export declare function computeReportDigest(reportPath: string): Promise<string | null>;
+/**
+ * 检查 symlink 是否逃逸 sandbox。
+ * 在 resolveCoveragePath 之后调用，对已解析路径做 realpath 检查。
+ *
+ * 返回 safe absolute path，或抛出错误。
+ */
+export declare function verifySymlinkSafe(resolvedPath: string, sandboxRoot: string): Promise<string>;