@dommaker/harness 0.16.9 → 0.17.0

package/src/__tests__/no-hardcoded-credentials.test.ts

@@ -0,0 +1,90 @@
+/**
+ * no_hardcoded_credentials checker 测试（ADR-0001）
+ *
+ * 注意：测试夹具中的假凭证一律用字符串拼接构造，
+ * 避免本文件自身被凭证扫描（含 harness 自身 staged diff）命中。
+ */
+
+import { describe, it, expect } from '@jest/globals';
+import {
+  noHardcodedCredentials,
+  containsHardcodedCredential,
+} from '../core/constraints/checkers/no-hardcoded-credentials';
+import type { CheckEnv } from '../core/constraints/checkers';
+
+function makeEnv(stagedDiff: string): CheckEnv {
+  return {
+    context: { operation: 'commit', projectPath: '/nonexistent' },
+    projectPath: '/nonexistent',
+    stagedDiff: async () => stagedDiff,
+    stagedDiffNames: async () => '',
+    srcScan: () => [],
+  };
+}
+
+const AWS_KEY = 'AKIA' + '1234567890ABCDEF';
+const PEM_HEADER = '-----BEGIN ' + 'RSA PRIVATE KEY-----';
+const PASSWORD_ASSIGN = 'const dbPass' + 'word = "sup3r-s3cret-value";';
+
+describe('containsHardcodedCredential', () => {
+  it('命中 PEM 私钥头', () => {
+    expect(containsHardcodedCredential(PEM_HEADER + '\nMIIE...')).toBe(true);
+  });
+
+  it('命中 AWS Access Key', () => {
+    expect(containsHardcodedCredential(`const key = "${AWS_KEY}";`)).toBe(true);
+  });
+
+  it('命中硬编码 password 赋值', () => {
+    expect(containsHardcodedCredential(PASSWORD_ASSIGN)).toBe(true);
+  });
+
+  it('命中硬编码 api_key 赋值', () => {
+    expect(containsHardcodedCredential('api' + '_key: "abcdef123456789"')).toBe(true);
+  });
+
+  it('豁免环境变量引用', () => {
+    expect(
+      containsHardcodedCredential('const pass' + 'word = process.env.DB_PASSWORD;')
+    ).toBe(false);
+  });
+
+  it('豁免占位符值', () => {
+    expect(
+      containsHardcodedCredential('const pass' + 'word = "your-password-here";')
+    ).toBe(false);
+  });
+
+  it('普通代码不误报', () => {
+    expect(
+      containsHardcodedCredential('export function add(a: number, b: number) { return a + b; }')
+    ).toBe(false);
+  });
+});
+
+describe('noHardcodedCredentials checker', () => {
+  it('staged diff 新增行命中凭证 → fail', async () => {
+    const diff = [
+      'diff --git a/src/config.ts b/src/config.ts',
+      '--- a/src/config.ts',
+      '+++ b/src/config.ts',
+      '@@ -0,0 +1 @@',
+      '+' + PASSWORD_ASSIGN,
+    ].join('\n');
+    expect(await noHardcodedCredentials.evaluate(makeEnv(diff))).toBe(false);
+  });
+
+  it('staged diff 仅删除行含凭证 → pass（删除凭证是好事）', async () => {
+    const diff = ['--- a/src/config.ts', '+++ /dev/null', '-' + PASSWORD_ASSIGN].join('\n');
+    expect(await noHardcodedCredentials.evaluate(makeEnv(diff))).toBe(true);
+  });
+
+  it('staged diff 无凭证 → pass', async () => {
+    const diff = '+++ b/src/a.ts\n+export const x = 1;\n';
+    expect(await noHardcodedCredentials.evaluate(makeEnv(diff))).toBe(true);
+  });
+
+  it('staged diff 为空且无可读变更文件 → pass', async () => {
+    expect(await noHardcodedCredentials.evaluate(makeEnv(''))).toBe(true);
+  });
+});

package/src/__tests__/presets.test.ts

@@ -11,7 +11,7 @@ describe('Presets', () => {
       expect(STRICT_PRESET.name).toBe('strict');
       expect(STRICT_PRESET.ironLaws).toBeNull();
       expect(STRICT_PRESET.guidelines).toBeNull();
-      expect(STRICT_PRESET.tips).toBeNull();
+      expect(STRICT_PRESET.prompts).toBeNull();
     });
   });
 
@@ -20,7 +20,7 @@ describe('Presets', () => {
       expect(STANDARD_PRESET.name).toBe('standard');
       expect(STANDARD_PRESET.ironLaws).toBeNull();
       expect(STANDARD_PRESET.guidelines).toBeNull();
-      expect(STANDARD_PRESET.tips).toBeNull();
+      expect(STANDARD_PRESET.prompts).toBeNull();
     });
   });
 
@@ -29,15 +29,15 @@ describe('Presets', () => {
       expect(RELAXED_PRESET.name).toBe('relaxed');
       expect(RELAXED_PRESET.ironLaws).not.toBeNull();
       expect(RELAXED_PRESET.guidelines).not.toBeNull();
-      expect(RELAXED_PRESET.tips).toEqual([]);
+      expect(RELAXED_PRESET.prompts).toEqual([]);
     });
 
-    it('应该包含 no_bypass_checkpoint', () => {
-      expect(RELAXED_PRESET.ironLaws).toContain('no_bypass_checkpoint');
+    it('应该包含 no_completion_without_verification', () => {
+      expect(RELAXED_PRESET.ironLaws).toContain('no_completion_without_verification');
     });
 
-    it('应该包含 no_self_approval', () => {
-      expect(RELAXED_PRESET.ironLaws).toContain('no_self_approval');
+    it('应该包含 no_bypass_checkpoint', () => {
+      expect(RELAXED_PRESET.guidelines).toContain('no_bypass_checkpoint');
     });
   });
 

package/src/__tests__/project-config-loader-extra.test.ts

@@ -29,9 +29,9 @@ describe('ProjectConfigLoader - 补充覆盖', () => {
         path.join(harnessDir, 'config.yml'),
         `
 constraints:
-  no_any_type:
+  legacy_disabled_a:
     enabled: false
-  no_self_approval:
+  legacy_disabled_b:
     enabled: false
 `
       );
@@ -40,8 +40,8 @@ constraints:
       loader.load();
       const merged = loader.mergeConstraints();
 
-      expect(merged.disabled).toContain('no_any_type');
-      expect(merged.disabled).toContain('no_self_approval');
+      expect(merged.disabled).toContain('legacy_disabled_a');
+      expect(merged.disabled).toContain('legacy_disabled_b');
     });
   });
 

package/src/__tests__/skip-semantics.test.ts

@@ -0,0 +1,322 @@
+/**
+ * skip 三态语义测试（ADR-0001 P4）
+ *
+ * 覆盖：
+ * - 三条存在性探测（capability_sync / context_doc_sync / docs_freshness）有/无约定两路
+ * - flag 型铁律 undefined → skip（显式 false 仍 fail，true 仍 pass）
+ * - Iron Law skip 不阻断 checkConstraints
+ * - detectTrigger 代码文件 → 附加 code_implementation 推断
+ * - trace 记录 result: 'skip'；TraceAnalyzer 的 pass/fail 率分母不计 skip
+ */
+
+import { describe, it, expect, beforeAll, afterAll, afterEach } from '@jest/globals';
+import { ConstraintChecker } from '../core/constraints/checker';
+import { detectTrigger, buildConstraintContext } from '../core/constraints/context-builder';
+import { IRON_LAWS } from '../core/constraints/definitions';
+import { TraceAnalyzer } from '../monitoring/trace-analyzer';
+import type { Constraint, ConstraintContext } from '../types/constraint';
+import type { ExecutionTrace } from '../types/trace';
+import * as fs from 'fs';
+import * as path from 'path';
+import { execSync } from 'child_process';
+
+const checker = ConstraintChecker.getInstance();
+
+function makeConstraint(
+  id: string,
+  level: 'iron_law' | 'guideline',
+  trigger: string = 'commit'
+): Constraint {
+  return { id, kind: 'check', level, rule: 'TEST', message: 'test', trigger, enforcement: 'test' };
+}
+
+describe('skip 三态语义（ADR-0001）', () => {
+  const tempDir = path.join(process.cwd(), 'temp-test-skip-semantics');
+
+  beforeAll(() => {
+    fs.mkdirSync(tempDir, { recursive: true });
+    execSync('git init', { cwd: tempDir });
+    execSync('git config user.email "test@test.com"', { cwd: tempDir });
+    execSync('git config user.name "Test"', { cwd: tempDir });
+    fs.writeFileSync(path.join(tempDir, 'initial.txt'), 'initial');
+    execSync('git add .', { cwd: tempDir });
+    execSync('git commit -m "init"', { cwd: tempDir });
+  });
+
+  afterAll(() => {
+    try {
+      fs.rmSync(tempDir, { recursive: true, force: true });
+    } catch {
+      // ignore
+    }
+  });
+
+  afterEach(() => {
+    // 复位 trace recorder，避免泄漏到其他用例
+    checker.setTraceRecorder({ record: () => undefined });
+  });
+
+  describe('capability_sync 存在性探测', () => {
+    it('无 CAPABILITIES.md（未采用约定）→ skip，不计 fail', async () => {
+      const dir = path.join(tempDir, 'cap-skip');
+      fs.mkdirSync(dir, { recursive: true });
+
+      const result = await checker.check(makeConstraint('capability_sync', 'guideline'), {
+        operation: 'commit',
+        projectPath: dir,
+      } as ConstraintContext);
+
+      expect(result.skipped).toBe(true);
+      expect(result.satisfied).toBe(true); // fail-open：skip 不产生违规
+
+      fs.rmSync(dir, { recursive: true, force: true });
+    });
+
+    it('有 CAPABILITIES.md（采用约定）→ 正常评估，非 skip', async () => {
+      const dir = path.join(tempDir, 'cap-adopted');
+      fs.mkdirSync(dir, { recursive: true });
+      // 散文文档（无表格）历史放行；此处只验证"进入评估"而非 skip
+      fs.writeFileSync(path.join(dir, 'CAPABILITIES.md'), '# Capabilities\n\n- Feature: test');
+
+      const result = await checker.check(makeConstraint('capability_sync', 'guideline'), {
+        operation: 'commit',
+        projectPath: dir,
+      } as ConstraintContext);
+
+      expect(result.skipped).toBeUndefined();
+      expect(result.satisfied).toBe(true);
+
+      fs.rmSync(dir, { recursive: true, force: true });
+    });
+  });
+
+  describe('context_doc_sync 存在性探测', () => {
+    it('无 context_files 配置（未采用约定）→ skip', async () => {
+      const dir = path.join(tempDir, 'ctx-skip');
+      fs.mkdirSync(dir, { recursive: true });
+
+      const result = await checker.check(makeConstraint('context_doc_sync', 'guideline'), {
+        operation: 'module_modification',
+        projectPath: dir,
+      } as ConstraintContext);
+
+      expect(result.skipped).toBe(true);
+      expect(result.satisfied).toBe(true);
+
+      fs.rmSync(dir, { recursive: true, force: true });
+    });
+
+    it('配置了 required_dirs 且缺少 CONTEXT.md → fail（非 skip）', async () => {
+      const dir = path.join(tempDir, 'ctx-fail');
+      fs.mkdirSync(path.join(dir, '.harness'), { recursive: true });
+      fs.mkdirSync(path.join(dir, 'src'), { recursive: true });
+
+      const yaml = require('js-yaml');
+      fs.writeFileSync(
+        path.join(dir, '.harness', 'config.yml'),
+        yaml.dump({ governance: { context_files: { enabled: true, required_dirs: ['src'] } } })
+      );
+
+      const result = await checker.check(makeConstraint('context_doc_sync', 'guideline'), {
+        operation: 'module_modification',
+        projectPath: dir,
+      } as ConstraintContext);
+
+      expect(result.skipped).toBeUndefined();
+      expect(result.satisfied).toBe(false);
+
+      fs.rmSync(dir, { recursive: true, force: true });
+    });
+  });
+
+  describe('docs_freshness 存在性探测', () => {
+    it('无任何 freshness 配置/目标 → skip', async () => {
+      const dir = path.join(tempDir, 'fresh-skip');
+      fs.mkdirSync(dir, { recursive: true });
+
+      const result = await checker.check(makeConstraint('docs_freshness', 'iron_law', 'file_modification'), {
+        operation: 'file_modification',
+        projectPath: dir,
+      } as ConstraintContext);
+
+      expect(result.skipped).toBe(true);
+      expect(result.satisfied).toBe(true);
+
+      fs.rmSync(dir, { recursive: true, force: true });
+    });
+
+    it('有 CAPABILITIES.md 目标 → 正常评估（幽灵条目仍 fail，非 skip）', async () => {
+      const dir = path.join(tempDir, 'fresh-adopted');
+      fs.mkdirSync(path.join(dir, 'src'), { recursive: true });
+      fs.writeFileSync(
+        path.join(dir, 'CAPABILITIES.md'),
+        '# Capabilities\n\n| 模块 | 文件 | 说明 |\n|------|------|------|\n| ghost | src/ghost.ts | 不存在 |'
+      );
+
+      const result = await checker.check(makeConstraint('docs_freshness', 'iron_law', 'file_modification'), {
+        operation: 'file_modification',
+        projectPath: dir,
+      } as ConstraintContext);
+
+      expect(result.skipped).toBeUndefined();
+      expect(result.satisfied).toBe(false);
+
+      fs.rmSync(dir, { recursive: true, force: true });
+    });
+  });
+
+  describe('flag 型铁律：undefined → skip', () => {
+    it('hasVerificationEvidence undefined → skip；false → fail；true → pass', async () => {
+      const law = IRON_LAWS['no_completion_without_verification'];
+
+      const skipped = await checker.check(law, { operation: 'code_implementation' });
+      expect(skipped.skipped).toBe(true);
+      expect(skipped.satisfied).toBe(true);
+
+      const failed = await checker.check(law, {
+        operation: 'code_implementation',
+        hasVerificationEvidence: false,
+      });
+      expect(failed.skipped).toBeUndefined();
+      expect(failed.satisfied).toBe(false);
+
+      const passed = await checker.check(law, {
+        operation: 'code_implementation',
+        hasVerificationEvidence: true,
+      });
+      expect(passed.skipped).toBeUndefined();
+      expect(passed.satisfied).toBe(true);
+    });
+
+    it('hasSingleTask / hasRequirement undefined → skip', async () => {
+      const single = await checker.check(IRON_LAWS['incremental_progress'], {
+        operation: 'code_implementation',
+      });
+      expect(single.skipped).toBe(true);
+
+      const req = await checker.check(IRON_LAWS['no_implementation_without_requirement'], {
+        operation: 'code_implementation',
+      });
+      expect(req.skipped).toBe(true);
+    });
+
+    it('Iron Law skip 不阻断 checkConstraints', async () => {
+      // 三个 flag 全部未接线（CLI pre-commit 路径的典型形态）
+      const result = await checker.checkConstraints({
+        operation: 'code_implementation',
+        projectPath: path.join(tempDir, 'empty'),
+      });
+
+      expect(result.passed).toBe(true);
+      const skippedIds = result.ironLaws.filter(r => r.skipped).map(r => r.id);
+      expect(skippedIds).toEqual(
+        expect.arrayContaining([
+          'no_completion_without_verification',
+          'incremental_progress',
+          'no_implementation_without_requirement',
+        ])
+      );
+    });
+
+    it('显式 false 仍按 fail 阻断（skip 语义不改变 fail-closed）', async () => {
+      await expect(
+        checker.checkConstraints({
+          operation: 'code_implementation',
+          hasVerificationEvidence: false,
+          hasSingleTask: true,
+          hasRequirement: true,
+        })
+      ).rejects.toThrow();
+    });
+  });
+
+  describe('detectTrigger 补 code_implementation 推断', () => {
+    const triggerDir = path.join(tempDir, 'trigger-probe');
+
+    beforeAll(() => {
+      // src/ 下有已提交 .ts 文件 → detectSourceRoots 命中 'src'
+      fs.mkdirSync(path.join(triggerDir, 'src'), { recursive: true });
+      fs.writeFileSync(path.join(triggerDir, 'src', 'existing.ts'), 'export const x = 1;');
+      execSync('git init', { cwd: triggerDir });
+      execSync('git config user.email "test@test.com"', { cwd: triggerDir });
+      execSync('git config user.name "Test"', { cwd: triggerDir });
+      execSync('git add .', { cwd: triggerDir });
+      execSync('git commit -m "init"', { cwd: triggerDir });
+    });
+
+    it('源码根内代码变更 → [module_modification, code_implementation]', () => {
+      const result = detectTrigger(['src/existing.ts'], { projectPath: triggerDir });
+      expect(result).toEqual(['module_modification', 'code_implementation']);
+    });
+
+    it('纯文档/配置变更 → 仅 file_modification，不附加 code_implementation', () => {
+      const result = detectTrigger(['README.md', 'docs/design.md', '.harness/config.yml'], {
+        projectPath: triggerDir,
+      });
+      expect(result).toBe('file_modification');
+    });
+
+    it('源码根外的代码文件 → file_modification + code_implementation', () => {
+      const result = detectTrigger(['scripts/build.js'], { projectPath: triggerDir });
+      expect(result).toEqual(['file_modification', 'code_implementation']);
+    });
+
+    it('仅测试变更 → test_creation + code_implementation', () => {
+      const result = detectTrigger(['src/__tests__/existing.test.ts'], { projectPath: triggerDir });
+      expect(result).toEqual(['test_creation', 'code_implementation']);
+    });
+
+    it('显式 trigger 优先，不做推断', () => {
+      const result = detectTrigger(['src/existing.ts'], {
+        trigger: 'design_request',
+        projectPath: triggerDir,
+      });
+      expect(result).toBe('design_request');
+    });
+
+    it('buildConstraintContext：代码变更 → operation 主推断 + extraTriggers 携带 code_implementation', async () => {
+      execSync('git add src/existing.ts', { cwd: triggerDir });
+      fs.writeFileSync(path.join(triggerDir, 'src', 'existing.ts'), 'export const x = 2;');
+      execSync('git add src/existing.ts', { cwd: triggerDir });
+
+      const ctx = await buildConstraintContext({ projectPath: triggerDir, staged: true });
+
+      expect(ctx.operation).toBe('module_modification');
+      expect(ctx.extraTriggers).toEqual(['code_implementation']);
+    });
+  });
+
+  describe('trace 的 skip 形态', () => {
+    it('recordTrace：skip 记录为 result: skip', async () => {
+      const records: ExecutionTrace[] = [];
+      checker.setTraceRecorder({ record: (t) => records.push(t) });
+
+      await checker.checkConstraints({
+        operation: 'code_implementation',
+        projectPath: path.join(tempDir, 'empty'),
+      });
+
+      const skipTraces = records.filter(t => t.result === 'skip');
+      expect(skipTraces.map(t => t.constraintId)).toEqual(
+        expect.arrayContaining(['incremental_progress', 'no_implementation_without_requirement'])
+      );
+    });
+
+    it('TraceAnalyzer：skip 单独计数，不计入 pass/fail 率分母', () => {
+      const analyzer = new TraceAnalyzer(null as any);
+      const traces: ExecutionTrace[] = [
+        { constraintId: 'c1', level: 'iron_law', timestamp: 1, result: 'pass' },
+        { constraintId: 'c1', level: 'iron_law', timestamp: 2, result: 'skip' },
+        { constraintId: 'c1', level: 'iron_law', timestamp: 3, result: 'skip' },
+        { constraintId: 'c1', level: 'iron_law', timestamp: 4, result: 'fail' },
+      ];
+
+      const [summary] = analyzer.summarize(traces);
+      expect(summary.totalChecks).toBe(4);
+      expect(summary.skipCount).toBe(2);
+      // 分母 = 4 - 2 = 2（仅实际评估次数）
+      expect(summary.passRate).toBe(0.5);
+      expect(summary.failRate).toBe(0.5);
+    });
+  });
+});

package/src/cli/commands/CONTEXT.md

@@ -1,10 +1,12 @@
 # cli/commands/
 
 ## 职责
-CLI 子命令实现：25 个命令覆盖约束检查/门禁验证/文档同步/知识管理/失败诊断/发布/会话分析等。
+CLI 子命令实现：24 个顶层命令 + constraints 治理子命令 report/retire（共 26 个命令文件），覆盖约束检查/门禁验证/文档同步/知识管理/失败诊断/发布/会话分析等。
 
-## 核心导出(25 命令)
-check / validate / passes-gate / init / report / status / flow / spec / acceptance / performance / security / contract / review / command / sync-docs / knowledge / sdd / failure / posteval-plan / release / analyze-sessions / update-user-model / constraints / doc-freshness-check / spec-baseline-check
+## 核心导出(24 顶层命令)
+check / validate / passes-gate / init / report / status / spec / acceptance / performance / security / contract / review / command / sync-docs / knowledge / sdd / failure / posteval-plan / release / analyze-sessions / update-user-model / constraints / doc-freshness-check / spec-baseline-check
+
+`constraints` 下挂治理子命令：`constraints report`（使用统计 + 退役候选诊断 + 配置健康 + 注入漂移，`--export` 脱敏）、`constraints retire`（交互选择 + 人确认退役，config.yml retired 元数据 + KnowledgeStore 沉淀 + CLAUDE.md 注入段同步）。
 
 ## 依赖关系
 - 依赖 `src/core/constraints/` 约束引擎

package/src/cli/commands/__tests__/check-drift.test.ts

@@ -0,0 +1,127 @@
+/**
+ * check 命令注入漂移警告测试（ADR-0001 决策 7，P6）
+ *
+ * 警告不阻断：漂移项目跑 check 仍 0 退出；版本漂移单独显眼警告；
+ * 无漂移零输出。使用真实临时目录（漂移检测读真实 fs），
+ * 仅 mock checker（直接判过）与 git 调用。
+ */
+
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { check } from '../check';
+import { constraintChecker } from '../../../core/constraints/checker';
+import { renderConstraintsSection } from '../../../core/constraints/injection-renderer';
+import { getEffectiveConstraints } from '../../../core/effective-constraints';
+
+jest.mock('../../../core/constraints/checker', () => ({
+  constraintChecker: {
+    setCustomConfig: jest.fn(),
+    setTraceRecorder: jest.fn(),
+    checkConstraints: jest.fn(),
+  },
+}));
+
+jest.mock('../../../utils/exec', () => ({
+  execAsync: jest.fn().mockResolvedValue({ stdout: '', stderr: '' }),
+}));
+
+jest.mock('child_process', () => ({
+  exec: jest.fn(),
+  execSync: jest.fn(() => Buffer.from('')),
+}));
+
+const mockChecker = constraintChecker as jest.Mocked<typeof constraintChecker>;
+
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const REAL_VERSION = require('../../../../package.json').version as string;
+
+function makeTmpProject(): string {
+  return fs.mkdtempSync(path.join(os.tmpdir(), 'harness-check-drift-test-'));
+}
+
+function writeClaudeMd(root: string, version: string): void {
+  const section =
+    '## Governance Rules\n' + renderConstraintsSection(getEffectiveConstraints(root), version);
+  fs.writeFileSync(path.join(root, 'CLAUDE.md'), `# Test Project\n\n${section}`, 'utf-8');
+}
+
+describe('check 命令注入漂移警告', () => {
+  let consoleSpy: jest.SpyInstance;
+  let exitSpy: jest.SpyInstance;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    consoleSpy = jest.spyOn(console, 'log').mockImplementation(() => {});
+    exitSpy = jest.spyOn(process, 'exit').mockImplementation(() => undefined as never);
+    mockChecker.checkConstraints.mockResolvedValue({
+      passed: true,
+      ironLaws: [],
+      guidelines: [],
+      tips: [],
+      warningCount: 0,
+      tipCount: 0,
+    });
+  });
+
+  afterEach(() => {
+    consoleSpy.mockRestore();
+    exitSpy.mockRestore();
+  });
+
+  const outputText = () => consoleSpy.mock.calls.map(c => String(c[0])).join('\n');
+
+  it('版本漂移：黄色警告块 + ⚠️⚠️ 版本行，但不阻断（exit 未调用，仍判通过）', async () => {
+    const root = makeTmpProject();
+    writeClaudeMd(root, '0.0.1-old');
+
+    await check({ preset: 'standard', staged: false, projectPath: root });
+
+    const output = outputText();
+    expect(output).toContain('约束注入漂移');
+    expect(output).toContain('⚠️⚠️');
+    expect(output).toContain('agent 上下文中的规则与已安装 harness 版本不一致');
+    expect(output).toContain('0.0.1-old');
+    expect(output).toContain('npx harness init');
+    // 不阻断：检查仍通过、未调用 process.exit
+    expect(output).toContain('约束检查通过');
+    expect(exitSpy).not.toHaveBeenCalled();
+  });
+
+  it('内容漂移：手改一条 → 警告块含缺失/多余计数，exit 未调用', async () => {
+    const root = makeTmpProject();
+    writeClaudeMd(root, REAL_VERSION);
+    const claudeMdPath = path.join(root, 'CLAUDE.md');
+    const content = fs.readFileSync(claudeMdPath, 'utf-8');
+    const originalLine = content.split('\n').find(l => l.startsWith('- **'))!;
+    fs.writeFileSync(claudeMdPath, content.replace(originalLine, originalLine.replace(/: .+$/, ': 篡改')), 'utf-8');
+
+    await check({ preset: 'standard', staged: false, projectPath: root });
+
+    const output = outputText();
+    expect(output).toContain('内容漂移: 缺失 1 条 / 多余 1 条');
+    expect(output).toContain('约束检查通过');
+    expect(exitSpy).not.toHaveBeenCalled();
+  });
+
+  it('无漂移：零警告输出（不增加噪音）', async () => {
+    const root = makeTmpProject();
+    writeClaudeMd(root, REAL_VERSION);
+
+    await check({ preset: 'standard', staged: false, projectPath: root });
+
+    const output = outputText();
+    expect(output).not.toContain('注入漂移');
+    expect(output).toContain('约束检查通过');
+    expect(exitSpy).not.toHaveBeenCalled();
+  });
+
+  it('未注入（无 CLAUDE.md）：不警告', async () => {
+    const root = makeTmpProject();
+
+    await check({ preset: 'standard', staged: false, projectPath: root });
+
+    expect(outputText()).not.toContain('注入漂移');
+    expect(exitSpy).not.toHaveBeenCalled();
+  });
+});