@dommaker/harness 0.13.0 → 0.13.2

package/src/cli/commands/posteval-plan.ts

@@ -0,0 +1,85 @@
+/**
+ * harness posteval-plan 命令
+ *
+ * 调用 Studio PostEval API，验证 plan 文件的 checklist items 是否都有对应的 staged diff。
+ * pre-commit hook 使用此命令防止"假装完成"。
+ */
+
+import chalk from 'chalk';
+
+export interface PostEvalPlanOptions {
+  planPath: string;
+}
+
+const MAX_RETRIES = 3;
+const RETRY_DELAY_MS = 2000;
+const GRACE_PERIOD_MS = parseInt(process.env.POSTEVAL_GRACE_MS || '30000', 10); // 30s total before fallback
+
+async function fetchWithRetry(url: string, body: string, retries: number): Promise<Response> {
+  let lastError: any;
+  for (let i = 0; i < retries; i++) {
+    try {
+      const controller = new AbortController();
+      const timeout = setTimeout(() => controller.abort(), 5000);
+      const res = await fetch(url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body,
+        signal: controller.signal,
+      });
+      clearTimeout(timeout);
+      return res;
+    } catch (error: any) {
+      lastError = error;
+      if (i < retries - 1) {
+        await new Promise(resolve => setTimeout(resolve, RETRY_DELAY_MS * (i + 1))); // exponential backoff
+      }
+    }
+  }
+  throw lastError;
+}
+
+export async function postevalPlan(options: PostEvalPlanOptions): Promise<void> {
+  const apiPort = process.env.API_PORT || '3001';
+  const url = `http://localhost:${apiPort}/api/v1/agents/post-eval/plan-coverage`;
+
+  try {
+    const res = await fetchWithRetry(url, JSON.stringify({ planPath: options.planPath }), MAX_RETRIES);
+
+    if (!res.ok) {
+      if (res.status >= 500) {
+        // Server error — allow commit with warning (don't block on infrastructure failure)
+        console.error(chalk.yellow(`⚠️  PostEval API unavailable (${res.status}), allowing commit with warning`));
+        console.error(chalk.yellow(`   Plan: ${options.planPath}`));
+        process.exit(0);
+      }
+      console.error(chalk.red(`❌ PostEval API error: ${res.status} ${res.statusText}`));
+      process.exit(1);
+    }
+
+    const report = await res.json() as {
+      completeness: number;
+      matchedAcs: string[];
+      missedAcs: string[];
+    };
+
+    const pct = Math.round(report.completeness * 100);
+
+    if (report.completeness < 1) {
+      console.error(chalk.red(`❌ Plan coverage: ${pct}% (${report.matchedAcs.length}/${report.matchedAcs.length + report.missedAcs.length})`));
+      if (report.missedAcs.length > 0) {
+        console.error(chalk.red('Missed items:'));
+        report.missedAcs.forEach((item: string) => console.error(chalk.red(`  - ${item}`)));
+      }
+      process.exit(1);
+    }
+
+    console.log(chalk.green(`✅ Plan coverage: ${pct}%`));
+  } catch (error: any) {
+    // API unreachable after all retries — allow with warning (don't block commits on infra)
+    console.error(chalk.yellow(`⚠️  Studio API unreachable after ${MAX_RETRIES} retries, allowing commit with warning`));
+    console.error(chalk.yellow(`   Plan: ${options.planPath}`));
+    console.error(chalk.yellow(`   Error: ${error?.code || error?.message || String(error)}`));
+    process.exit(0);
+  }
+}

package/src/cli/commands/release.ts

@@ -0,0 +1,159 @@
+/**
+ * harness release 命令
+ *
+ * 完整 npm 发布流水线：tsc → dist 验证 → npm version → git push → npm publish → gh release。
+ * 与 studio MCP tool `publishPackage` 共享同一逻辑，但此 CLI 命令不依赖 Studio API 运行。
+ * 当 studio API 因 harness 包损坏而无法启动时，此 CLI 命令仍可用。
+ */
+
+import { execSync } from 'child_process';
+import * as fs from 'fs';
+import * as path from 'path';
+import chalk from 'chalk';
+
+export interface ReleaseOptions {
+  bumpType?: 'patch' | 'minor' | 'major';
+  dryRun?: string;
+}
+
+async function run(cmd: string, cwd: string, timeout = 60_000): Promise<{ stdout: string; stderr: string }> {
+  try {
+    const stdout = execSync(cmd, { cwd, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout });
+    return { stdout: stdout.trim(), stderr: '' };
+  } catch (e: any) {
+    const stderr = typeof e.stderr === 'string' ? e.stderr : e.stderr?.toString() || '';
+    const stdout = typeof e.stdout === 'string' ? e.stdout : e.stdout?.toString() || '';
+    return { stdout: stdout.trim(), stderr: stderr.trim() || e.message || String(e) };
+  }
+}
+
+export async function release(options: ReleaseOptions): Promise<void> {
+  const pkgPath = process.cwd();
+  const bumpType = options.bumpType || 'patch';
+  const dryRun = options.dryRun === 'true';
+
+  // ── 1. Verify package ──
+  const pkgJsonPath = path.join(pkgPath, 'package.json');
+  if (!fs.existsSync(pkgJsonPath)) {
+    console.error(chalk.red(`❌ Not a package: ${pkgPath}`));
+    process.exit(1);
+  }
+  const pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8'));
+  const pkgName = pkgJson.name;
+  const oldVersion = pkgJson.version;
+  console.log(chalk.cyan(`📦 ${pkgName}@${oldVersion}`));
+  console.log(chalk.cyan(`   bump: ${bumpType}${dryRun ? ' (dry-run)' : ''}`));
+
+  // ── 2. Check clean working tree ──
+  const stat = await run('git status --porcelain -uno', pkgPath);
+  if (stat.stdout.length > 0) {
+    console.error(chalk.red('❌ Uncommitted changes. Commit or stash before releasing.'));
+    console.error(chalk.gray(stat.stdout.slice(0, 500)));
+    process.exit(1);
+  }
+  console.log(chalk.green('✅ git: clean'));
+
+  // ── 3. tsc build ──
+  console.log(chalk.cyan('🔨 Building...'));
+  const build = await run('npx tsc', pkgPath, 60_000);
+  if (build.stderr && !build.stdout) {
+    console.error(chalk.red('❌ tsc failed:'), build.stderr.slice(0, 800));
+    process.exit(1);
+  }
+  console.log(chalk.green('✅ tsc: built'));
+
+  // ── 4. Verify dist ──
+  const criticalFiles = [
+    'dist/index.js',
+    'dist/knowledge/index.js',
+    'dist/knowledge/store.js',
+    'dist/knowledge/ingest.js',
+    'dist/knowledge/query.js',
+    'dist/knowledge/lifecycle.js',
+    'dist/knowledge/lint.js',
+    'dist/knowledge/types.js',
+    'dist/knowledge/import.js',
+    'dist/knowledge/reference-tracker.js',
+    'dist/knowledge/lifecycle-hooks.js',
+    'dist/knowledge/doctor.js',
+    'dist/core/constraints/prompt-injection.js',
+  ];
+  const missing = criticalFiles.filter(f => !fs.existsSync(path.join(pkgPath, f)));
+  if (missing.length > 0) {
+    console.error(chalk.red(`❌ dist missing critical files: ${missing.join(', ')}`));
+    process.exit(1);
+  }
+  console.log(chalk.green('✅ dist: verified'));
+
+  if (dryRun) {
+    const [major, minor, patch] = oldVersion.split('.').map(Number);
+    let newVer: string;
+    if (bumpType === 'major') newVer = `${major + 1}.0.0`;
+    else if (bumpType === 'minor') newVer = `${major}.${minor + 1}.0`;
+    else newVer = `${major}.${minor}.${patch + 1}`;
+    console.log(chalk.yellow(`🏁 Dry-run complete. Would publish: ${pkgName}@${newVer}`));
+    process.exit(0);
+  }
+
+  // ── 5. Bump version (npm version creates git commit + tag atomically,
+  //     including package-lock.json — no desync possible) ──
+  console.log(chalk.cyan('🔢 Bumping version...'));
+  const bump = await run(`npm version ${bumpType} -m "release: %s"`, pkgPath);
+  if (bump.stderr && !bump.stdout) {
+    console.error(chalk.red('❌ npm version failed:'), bump.stderr);
+    process.exit(1);
+  }
+  const newVersion = bump.stdout.trim().replace(/^v/, '');
+  const tag = `v${newVersion}`;
+  console.log(chalk.green(`✅ version: ${oldVersion} → ${newVersion} (committed + tagged)`));
+
+  // ── 7. Push ──
+  console.log(chalk.cyan('⬆️  Pushing...'));
+  const branch = await run('git rev-parse --abbrev-ref HEAD', pkgPath);
+  const push = await run(`git push origin ${branch.stdout}`, pkgPath, 30_000);
+  if (push.stderr && push.stderr.includes('error')) {
+    console.error(chalk.red('❌ git push failed:'), push.stderr.slice(0, 500));
+    process.exit(1);
+  }
+  await run(`git push origin ${tag}`, pkgPath, 30_000);
+  console.log(chalk.green('✅ git: pushed'));
+
+  // ── 8. npm publish ──
+  // Switch to npmjs.org for publishing (npmmirror is read-only mirror)
+  const origRegistry = await run('npm config get registry', pkgPath);
+  await run('npm config set registry https://registry.npmjs.org/', pkgPath);
+  console.log(chalk.cyan('📤 Publishing to npm...'));
+  // npm publish to npmjs.org (the write registry — npmmirror is read-only)
+  const pub = await run('npm publish --registry https://registry.npmjs.org/', pkgPath, 180_000);
+  // Restore original registry
+  await run(`npm config set registry ${origRegistry.stdout}`, pkgPath);
+  // Don't string-match npm output — verify by querying the registry
+  const verify = await run(`npm view ${pkgName} version --registry https://registry.npmjs.org/`, pkgPath);
+  if (verify.stdout.trim() === newVersion) {
+    console.log(chalk.green(`✅ npm: published ${pkgName}@${newVersion}`));
+  } else {
+    console.log(chalk.red(`❌ npm publish verification failed. Expected ${newVersion}, registry has ${verify.stdout.trim() || '???'}`));
+    process.exit(1);
+  }
+
+  // ── 9. GitHub Release ──
+  console.log(chalk.cyan('🐙 Creating GitHub Release...'));
+  const gh = await run(`gh release create ${tag} --generate-notes`, pkgPath, 30_000);
+  if (gh.stderr && gh.stderr.includes('already exists')) {
+    console.log(chalk.yellow(`⚠️  gh: release ${tag} already exists`));
+  } else if (gh.stderr) {
+    console.log(chalk.yellow(`⚠️  gh: release may have failed (non-fatal): ${gh.stderr.slice(0, 200)}`));
+  } else {
+    // Derive repo URL from git remote
+    let repoUrl = '';
+    try {
+      const remoteUrl = execSync('git remote get-url origin', { cwd: pkgPath, encoding: 'utf-8', stdio: 'pipe', timeout: 5_000 }).trim();
+      const m = remoteUrl.match(/github\.com[:/]([^/]+)\/([^/\s.]+?)(?:\.git)?$/);
+      if (m) repoUrl = `https://github.com/${m[1]}/${m[2]}/releases/tag/${tag}`;
+    } catch { /* no remote */ }
+    console.log(chalk.green(`✅ GitHub Release: ${repoUrl || tag}`));
+  }
+
+  console.log(chalk.green(`\n🎉 Released ${pkgName}@${newVersion}`));
+  console.log(chalk.gray(`   npm: https://www.npmjs.com/package/${pkgName}/v/${newVersion}`));
+}

package/src/cli/commands/report.ts

@@ -0,0 +1,198 @@
+/**
+ * harness report 命令
+ *
+ * 生成检查报告（接入真实约束检查数据）
+ */
+
+import chalk from 'chalk';
+import * as fs from 'fs/promises';
+import { ConstraintChecker } from '../../core/constraints/checker';
+import { IRON_LAWS, GUIDELINES, TIPS } from '../../core/constraints/definitions';
+import { executeWithCollect } from '../../failure/constraint-handler';
+import type { ConstraintContext } from '../../types/constraint';
+
+export interface ReportOptions {
+  /** 输出文件路径 */
+  output?: string;
+  /** 输出格式 */
+  format: 'json' | 'markdown' | 'html';
+  /** 项目路径 */
+  projectPath?: string;
+}
+
+interface ReportData {
+  timestamp: string;
+  projectPath: string;
+  constraints: {
+    total: number;
+    ironLaws: number;
+    guidelines: number;
+    tips: number;
+    passed: number;
+    failed: number;
+    warnings: number;
+    violations: Array<{
+      id: string;
+      level: string;
+      message: string;
+    }>;
+  };
+}
+
+/**
+ * 生成检查报告
+ */
+export async function report(options: ReportOptions): Promise<void> {
+  console.log(chalk.blue('📊 生成检查报告...'));
+
+  const projectPath = options.projectPath || process.cwd();
+  const checker = ConstraintChecker.getInstance();
+
+  const allConstraints = { ...IRON_LAWS, ...GUIDELINES, ...TIPS };
+  const totalConstraints = Object.keys(allConstraints).length;
+
+  const context: ConstraintContext = {
+    operation: 'file_modification',
+    projectPath,
+  };
+
+  // S4: 使用 COLLECT 策略 — Iron Law 违规不抛异常，收集到结果中
+  const { checkResult } = await executeWithCollect(() =>
+    checker.checkConstraints(context)
+  );
+  // COLLECT 策略始终返回 checkResult
+  const result = checkResult!;
+
+  const failedIronLaws = result.ironLaws.filter(r => !r.satisfied);
+  const failedGuidelines = result.guidelines.filter(r => !r.satisfied);
+
+  const violations = [...failedIronLaws, ...failedGuidelines].map(r => ({
+    id: r.id,
+    level: r.level,
+    message: r.message || '',
+  }));
+
+  const reportData: ReportData = {
+    timestamp: new Date().toISOString(),
+    projectPath,
+    constraints: {
+      total: totalConstraints,
+      ironLaws: Object.keys(IRON_LAWS).length,
+      guidelines: Object.keys(GUIDELINES).length,
+      tips: Object.keys(TIPS).length,
+      passed: result.passed ? totalConstraints : totalConstraints - violations.length,
+      failed: failedIronLaws.length,
+      warnings: failedGuidelines.length,
+      violations,
+    },
+  };
+
+  let content: string;
+
+  switch (options.format) {
+    case 'json':
+      content = JSON.stringify(reportData, null, 2);
+      break;
+    case 'markdown':
+      content = generateMarkdownReport(reportData);
+      break;
+    case 'html':
+      content = generateHtmlReport(reportData);
+      break;
+    default:
+      content = JSON.stringify(reportData, null, 2);
+  }
+
+  if (options.output) {
+    await fs.writeFile(options.output, content, 'utf-8');
+    console.log(chalk.green(`✅ 报告已保存到: ${options.output}`));
+  } else {
+    console.log(content);
+  }
+}
+
+function generateMarkdownReport(data: ReportData): string {
+  const lines: string[] = [
+    `# Harness 检查报告`,
+    ``,
+    `> 生成时间: ${data.timestamp}`,
+    `> 项目路径: ${data.projectPath}`,
+    ``,
+    `---`,
+    ``,
+    `## 约束检查`,
+    ``,
+    `| 指标 | 数值 |`,
+    `|------|------|`,
+    `| 总约束 | ${data.constraints.total} |`,
+    `| Iron Laws | ${data.constraints.ironLaws} |`,
+    `| Guidelines | ${data.constraints.guidelines} |`,
+    `| Tips | ${data.constraints.tips} |`,
+    `| 通过 | ${data.constraints.passed} |`,
+    `| 失败 (error) | ${data.constraints.failed} |`,
+    `| 警告 (warning) | ${data.constraints.warnings} |`,
+    ``,
+  ];
+
+  if (data.constraints.violations.length > 0) {
+    lines.push(`### 违规项`, ``);
+    data.constraints.violations.forEach(v => {
+      lines.push(`- **${v.id}** (${v.level}): ${v.message}`);
+    });
+    lines.push(``);
+  }
+
+  lines.push(`---`, `*报告由 @dommaker/harness 生成*`, ``);
+  return lines.join('\n');
+}
+
+function generateHtmlReport(data: ReportData): string {
+  const violationsHtml = data.constraints.violations.length > 0
+    ? `<h3>违规项</h3><ul>${data.constraints.violations.map(v =>
+        `<li><strong>${v.id}</strong> (${v.level}): ${v.message}</li>`
+      ).join('')}</ul>`
+    : '';
+
+  return `<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Harness 检查报告</title>
+  <style>
+    body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; max-width: 800px; margin: 0 auto; padding: 20px; }
+    h1 { color: #333; border-bottom: 2px solid #4CAF50; padding-bottom: 10px; }
+    h2 { color: #555; margin-top: 30px; }
+    table { width: 100%; border-collapse: collapse; margin: 15px 0; }
+    th, td { border: 1px solid #ddd; padding: 8px; text-align: left; }
+    th { background-color: #4CAF50; color: white; }
+    tr:nth-child(even) { background-color: #f2f2f2; }
+    .passed { color: #4CAF50; }
+    .failed { color: #f44336; }
+    .meta { color: #666; font-size: 0.9em; margin-bottom: 20px; }
+  </style>
+</head>
+<body>
+  <h1>Harness 检查报告</h1>
+  <p class="meta">生成时间: ${data.timestamp}<br>项目路径: ${data.projectPath}</p>
+
+  <h2>约束检查</h2>
+  <table>
+    <tr><th>指标</th><th>数值</th></tr>
+    <tr><td>总约束</td><td>${data.constraints.total}</td></tr>
+    <tr><td>Iron Laws</td><td>${data.constraints.ironLaws}</td></tr>
+    <tr><td>Guidelines</td><td>${data.constraints.guidelines}</td></tr>
+    <tr><td>Tips</td><td>${data.constraints.tips}</td></tr>
+    <tr><td>通过</td><td class="passed">${data.constraints.passed}</td></tr>
+    <tr><td>失败</td><td class="failed">${data.constraints.failed}</td></tr>
+    <tr><td>警告</td><td>${data.constraints.warnings}</td></tr>
+  </table>
+
+  ${violationsHtml}
+
+  <footer style="margin-top: 40px; color: #999; text-align: center;">
+    报告由 @dommaker/harness 生成
+  </footer>
+</body>
+</html>`;
+}

package/src/cli/commands/review.ts

@@ -0,0 +1,118 @@
+/**
+ * harness review 命令
+ *
+ * 代码审查门控，检查审查状态
+ */
+
+import chalk from 'chalk';
+import { execAsync } from '../../utils/exec';
+import { ReviewGate } from '../../gates/review';
+
+export interface ReviewOptions {
+  /** 项目路径 */
+  projectPath?: string;
+  /** 最少审查人数 */
+  minReviewers?: number;
+  /** 是否要求审批 */
+  requireApproval?: boolean;
+  /** 是否阻止变更请求 */
+  blockOnChangesRequested?: boolean;
+  /** 允许的审查者（逗号分隔） */
+  allowedReviewers?: string;
+}
+
+/**
+ * 执行审查门控
+ */
+export async function review(options: ReviewOptions): Promise<void> {
+  console.log(chalk.blue('👀 代码审查门控检查...'));
+
+  const projectPath = options.projectPath || process.cwd();
+
+  const gate = new ReviewGate({
+    minReviewers: options.minReviewers ?? 1,
+    requireApproval: options.requireApproval ?? true,
+    blockOnChangesRequested: options.blockOnChangesRequested ?? true,
+    allowedReviewers: options.allowedReviewers
+      ? options.allowedReviewers.split(',').map(s => s.trim()).filter(Boolean)
+      : [],
+  });
+
+  try {
+    const { stdout: branch } = await execAsync('git rev-parse --abbrev-ref HEAD', { cwd: projectPath });
+    console.log(chalk.gray(`当前分支: ${branch.trim()}`));
+
+    const result = await gate.check({ projectPath, projectId: 'default' });
+
+    console.log();
+    if (result.passed) {
+      console.log(chalk.green('✅ 代码审查门控检查通过'));
+      if (result.details) {
+        console.log(chalk.gray(`   审批: ${result.details.approvals ?? 0}, 变更请求: ${result.details.changesRequested ?? 0}`));
+      }
+    } else {
+      console.log(chalk.red('❌ 代码审查门控检查失败'));
+      console.log(chalk.red(`   ${result.message}`));
+      if (result.details?.suggestion) {
+        console.log(chalk.gray(`   ${result.details.suggestion}`));
+      }
+      process.exit(1);
+    }
+  } catch (error: any) {
+    console.log();
+    console.log(chalk.red('❌ 代码审查门控检查出错'));
+    console.log(chalk.red(`   ${error.message}`));
+
+    if (error.message.includes('not a git repository')) {
+      console.log();
+      console.log(chalk.gray('提示: 此命令需要在 Git 仓库中运行'));
+    }
+
+    process.exit(1);
+  }
+}
+
+/**
+ * 显示审查状态详情
+ */
+export async function reviewStatus(options: ReviewOptions): Promise<void> {
+  console.log(chalk.blue('👀 代码审查状态...\n'));
+
+  const projectPath = options.projectPath || process.cwd();
+
+  try {
+    const { stdout: branch } = await execAsync('git rev-parse --abbrev-ref HEAD', { cwd: projectPath });
+    console.log(chalk.gray(`当前分支: ${branch.trim()}`));
+
+    try {
+      const { stdout: prInfo } = await execAsync('gh pr view --json number,title,state,reviewDecision,reviews', {
+        cwd: projectPath,
+      });
+      const pr = JSON.parse(prInfo);
+
+      console.log();
+      console.log(chalk.cyan(`PR #${pr.number}: ${pr.title}`));
+      console.log(chalk.gray(`状态: ${pr.state}`));
+
+      if (pr.reviewDecision) {
+        const decisionColor = pr.reviewDecision === 'APPROVED' ? chalk.green : chalk.yellow;
+        console.log(decisionColor(`审查决策: ${pr.reviewDecision}`));
+      }
+
+      if (pr.reviews && pr.reviews.length > 0) {
+        console.log();
+        console.log(chalk.gray('审查历史:'));
+        pr.reviews.forEach((r: any) => {
+          const statusColor = r.state === 'APPROVED' ? chalk.green :
+                              r.state === 'CHANGES_REQUESTED' ? chalk.red : chalk.gray;
+          console.log(statusColor(`  - ${r.author?.login || 'unknown'}: ${r.state}`));
+        });
+      }
+    } catch {
+      console.log(chalk.yellow('\n⚠️  未找到关联的 PR'));
+      console.log(chalk.gray('   使用 gh pr create 创建 PR'));
+    }
+  } catch (error: any) {
+    console.log(chalk.red(`❌ 获取审查状态失败: ${error.message}`));
+  }
+}

package/src/cli/commands/security.ts

@@ -0,0 +1,122 @@
+/**
+ * harness security 命令
+ *
+ * 安全门控，检查安全漏洞
+ */
+
+import chalk from 'chalk';
+import { SecurityGate } from '../../gates/security';
+
+export interface SecurityOptions {
+  /** 项目路径 */
+  projectPath?: string;
+  /** 严重性阈值 (low/moderate/high/critical) */
+  severity?: 'low' | 'moderate' | 'high' | 'critical';
+  /** 是否忽略警告 */
+  ignoreWarnings?: boolean;
+  /** 是否忽略开发依赖 */
+  ignoreDevDeps?: boolean;
+  /** 自定义扫描命令 */
+  scanCommand?: string;
+}
+
+/**
+ * 执行安全门控
+ */
+export async function security(options: SecurityOptions): Promise<void> {
+  console.log(chalk.blue('🔒 安全门控检查...'));
+
+  try {
+    const projectPath = options.projectPath || process.cwd();
+
+    const gate = new SecurityGate({
+      severityThreshold: options.severity || 'high',
+      scanCommand: options.scanCommand,
+      ignoreWarnings: options.ignoreWarnings,
+      ignoreDevDependencies: options.ignoreDevDeps,
+    });
+
+    const result = await gate.scan({ projectPath, projectId: 'default' });
+
+    console.log();
+    if (result.passed) {
+      console.log(chalk.green('✅ 安全门控检查通过'));
+      if (result.details) {
+        console.log(chalk.gray(`   critical: ${result.details.critical}, high: ${result.details.high}, moderate: ${result.details.moderate}, low: ${result.details.low}`));
+      }
+    } else {
+      console.log(chalk.red('❌ 安全门控检查失败'));
+      console.log(chalk.red(`   ${result.message}`));
+      if (result.details?.vulnerabilities) {
+        console.log();
+        (result.details.vulnerabilities as Array<{ name: string; severity: string; via: string }>).forEach((v, i) => {
+          const severityColor = getSeverityColor(v.severity);
+          console.log(severityColor(`  ${i + 1}. [${v.severity.toUpperCase()}] ${v.name}`));
+          console.log(chalk.gray(`     via: ${v.via}`));
+        });
+      }
+      console.log(chalk.gray('\n   运行 harness security audit 查看详情'));
+      process.exit(1);
+    }
+  } catch (error) {
+    console.log();
+    console.log(chalk.red(`❌ 安全检查异常: ${error instanceof Error ? error.message : String(error)}`));
+    process.exit(1);
+  }
+}
+
+/**
+ * 获取严重性颜色
+ */
+function getSeverityColor(severity: string): (text: string) => string {
+  switch (severity.toLowerCase()) {
+    case 'critical':
+      return chalk.red.bold;
+    case 'high':
+      return chalk.red;
+    case 'moderate':
+      return chalk.yellow;
+    case 'low':
+      return chalk.blue;
+    default:
+      return chalk.gray;
+  }
+}
+
+/**
+ * 运行安全审计详情
+ */
+export async function auditDetails(options: SecurityOptions): Promise<void> {
+  console.log(chalk.blue('🔒 安全审计详情...\n'));
+
+  try {
+    const projectPath = options.projectPath || process.cwd();
+
+    const gate = new SecurityGate({
+      severityThreshold: options.severity || 'low',
+      scanCommand: options.scanCommand,
+    });
+
+    const result = await gate.scan({ projectPath, projectId: 'default' });
+
+    if (result.passed && !result.details?.total) {
+      console.log(chalk.green('✅ 未发现安全漏洞'));
+      return;
+    }
+
+    const details = result.details as any;
+    if (details?.vulnerabilities?.length > 0) {
+      console.log(chalk.yellow(`发现 ${details.total} 个漏洞:\n`));
+      for (const v of details.vulnerabilities) {
+        const severityColor = getSeverityColor(v.severity);
+        console.log(severityColor(`[${v.severity.toUpperCase()}] ${v.name}`));
+        console.log(chalk.gray(`  via: ${v.via}`));
+        console.log();
+      }
+    }
+  } catch (error) {
+    console.log();
+    console.log(chalk.red(`❌ 安全审计异常: ${error instanceof Error ? error.message : String(error)}`));
+    process.exit(1);
+  }
+}