@dsh-cove/dsh-web-all 0.0.0-stage → 0.4.3

package/presets/code-vibe/skills/wish-programming/scripts/check_whitelist.py

@@ -0,0 +1,193 @@
+#!/usr/bin/env python3
+"""check_whitelist.py — 组件白名单合规（设计规范单「组件白名单」vs 实现引用；「禁发明」的机械门）。
+
+读 docs/wish/<id>/design-spec.md 的「组件白名单」表（组件路径列）与「共享件清单」表（路径列）；
+扫描工作区实现代码，提取组件引用（import/require 路径末段 + JSX 大写标签名）；
+实现引用不在白名单/共享件集合 → 违例（--allowlist "Name:reason" 可显式豁免，原因进入 audit 日志）。
+
+定位：机械下限，不是质量上限——它只抓「用了清单外组件」，同类不同名/内联重写不在本门范围。
+
+用法：
+  python3 check_whitelist.py <workspace> <id> [--glob '**/*.{ts,tsx,js,jsx}' ...] [--allowlist Name:reason ...]
+Exit: 0 ok/skip（无 design-spec 或无白名单表）, 1 违例, 2 usage.
+"""
+import argparse
+import re
+import sys
+from pathlib import Path
+
+
+def clean(s):
+    return s.strip().strip("`").strip().strip("**")
+
+
+def cells(line):
+    return [c.strip() for c in line.strip().strip("|").split("|")]
+
+
+def is_delim(row):
+    parts = [c for c in row if c]
+    return bool(parts) and all(re.fullmatch(r":?-{3,}:?", c) for c in parts)
+
+
+def table_after(text, heading):
+    lines = text.splitlines()
+    start = None
+    for i, l in enumerate(lines):
+        if l.startswith("#") and heading in l:
+            start = i + 1
+            break
+    if start is None:
+        return []
+    while start < len(lines) and ("|" not in lines[start] or lines[start].lstrip().startswith("#")):
+        if lines[start].lstrip().startswith("#"):
+            return []
+        start += 1
+    if start >= len(lines):
+        return []
+    headers = cells(lines[start])
+    start += 1
+    if start < len(lines) and is_delim(cells(lines[start])):
+        start += 1
+    rows = []
+    while start < len(lines) and "|" in lines[start]:
+        vals = cells(lines[start])
+        if len(vals) == len(headers):
+            rows.append({headers[i]: vals[i] for i in range(len(headers))})
+        start += 1
+    return rows
+
+
+def last_segment(value):
+    """组件路径取最后一个有意义的分段：'@/components/ui/button'→button、'./shared/Header.vue'→Header、'buttons'→buttons。"""
+    v = clean(value)
+    v = re.sub(r"['\"\s]", "", v)
+    if not v:
+        return ""
+    if v.startswith((".", "@")) :  # 相对/别名路径取末分段
+        return v.split("/")[-1].split(".")[0]
+    return v.split("/")[-1].split(".")[0]
+
+
+def extract_component_refs(files):
+    """import/require 路径末段 + JSX 大写标签 + createElement/h/defineComponent 组件名。"""
+    refs = set()
+    import_re = re.compile(r"(?:import\s+(?:[^'\"\n]*?\s+from\s+)?|require\()\s*['\"]([^'\"]+)['\"]")
+    dyn_import_re = re.compile(r"import\s*\(\s*['\"]([^'\"]+)['\"]")
+    tag_re = re.compile(r"<([A-Z][A-Za-z0-9_]*)")
+    elem_re = re.compile(r"(?:createElement|h|defineComponent)\s*\(\s*['\"]([A-Za-z][A-Za-z0-9_]*)['\"]")
+    for f in files:
+        try:
+            text = f.read_text(encoding="utf-8", errors="ignore")
+        except OSError:
+            continue
+        for m in list(import_re.finditer(text)) + list(dyn_import_re.finditer(text)):
+            path = m.group(1)
+            if "/" not in path:
+                continue  # 裸模块名（react 等平台运行时）不算组件引用
+            refs.add(last_segment(path))
+        for m in tag_re.finditer(text):
+            refs.add(m.group(1))
+        for m in elem_re.finditer(text):
+            refs.add(m.group(1))
+    return refs
+
+
+def main():
+    if any(a in ("-h", "--help") for a in sys.argv[1:]):
+        print(__doc__)
+        return 0
+    ap = argparse.ArgumentParser(add_help=False)
+    ap.add_argument("args", nargs="*")
+    opts, rest = ap.parse_known_args(sys.argv[1:])
+    try:
+        root = Path(opts.args[0]).resolve()
+        wid = opts.args[1]
+    except IndexError:
+        print("usage: check_whitelist.py <workspace> <id> [--glob PATTERN] [--allowlist Name:reason]", file=sys.stderr)
+        return 2
+
+    globs = []
+    allow = {}
+    i = 0
+    while i < len(rest):
+        if rest[i] == "--glob" and i + 1 < len(rest):
+            globs.append(rest[i + 1])
+            i += 2
+        elif rest[i] == "--allowlist" and i + 1 < len(rest):
+            name, _, reason = rest[i + 1].partition(":")
+            if not reason:
+                print("--allowlist needs Name:reason", file=sys.stderr)
+                return 2
+            allow[name.strip()] = reason.strip()
+            i += 2
+        else:
+            i += 1
+
+    design = root / "docs" / "wish" / wid / "design-spec.md"
+    if not design.is_file():
+        print("check_whitelist: skip — no design-spec.md (非设计类愿望)", file=sys.stderr)
+        return 0
+
+    dtext = design.read_text(encoding="utf-8")
+    wl_rows = table_after(dtext, "组件白名单")
+    if not wl_rows:
+        print("check_whitelist: skip — 组件白名单 table missing/empty", file=sys.stderr)
+        return 0
+    wl = {last_segment(r.values().__iter__().__next__()) for r in wl_rows if clean(next(iter(r.values()), ""))}
+
+    shared_rows = table_after(dtext, "共享件清单")
+    shared = set()
+    for r in shared_rows:
+        p = clean(r.get("路径", ""))
+        if p:
+            shared.add(last_segment(p))
+
+    if not globs:
+        globs = ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx", "**/*.vue", "**/*.html", "**/*.mjs", "**/*.cjs", "**/*.mts", "**/*.cts"]
+    exclude_parts = {"node_modules", ".git", ".sdd", "docs", "dist", "build", ".next", "__pycache__"}
+    files = []
+    for g in globs:
+        for p in root.glob(g):
+            if not p.is_file():
+                continue
+            rel = p.relative_to(root)
+            if exclude_parts & set(rel.parts):
+                continue
+            files.append(p)
+
+    if not files:
+        print("check_whitelist: skip — no source files matched（确认 --glob 匹配技术栈）", file=sys.stderr)
+        return 0
+
+    refs = extract_component_refs(files)
+    allowed = wl | shared | set(allow)
+    violations = []
+    for ref in sorted(refs):
+        if ref in allowed:
+            continue
+        # 只忽略精确匹配的通用词（原生标签小写/常见误报）：大小写敏感——
+        # <Button>（组件库）与 <button>（原生）不同，前者必须进白名单或报违例。
+        if ref in {"div", "span", "form", "table", "button", "input", "new", "function", "return", "import"}:
+            continue
+        # 全小写引用一律放行：HTML 原生标签（li/ul/a/…）与小写自定义元素都属于
+        # 「组件必须大写开头」约定的扫描面外（声明边界；小写组件不被白名单检查）。
+        if ref.islower():
+            continue
+        violations.append(ref)
+
+    if violations:
+        print(f"check_whitelist FAIL: {wid} — 实现引用了白名单外组件 {len(violations)} 个（禁发明；新增须用户拍板后补入白名单，或 --allowlist 显式豁免）：", file=sys.stderr)
+        for v in violations:
+            if v in allow:
+                continue
+            print(f"  {v}", file=sys.stderr)
+        if allow:
+            print(f"  (allowlist 豁免: {', '.join(f'{k}（{v}）' for k, v in allow.items())})", file=sys.stderr)
+        return 1
+    print(f"check_whitelist OK: {wid} — {len(refs)} 个组件引用全部在白名单/共享件内（豁免: {', '.join(allow) or '无'}）")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/presets/code-vibe/skills/wish-programming/scripts/coverage_check.py

@@ -0,0 +1,199 @@
+#!/usr/bin/env python3
+"""coverage_check.py — 存量功能落点完整性机械核对（阶段 4 用）。
+
+读 docs/wish/<id>/requirements.md 的「存量功能清单」表，提取全部 O 编号；
+读 .sdd/acceptance/<id>/coverage.tsv（三列：编号 \t 新落点 \t 证据路径）；
+检查每个 O 编号在 tsv 中有行、新落点非空、证据路径存在。
+缺 / 空 / 路径缺失 → 逐条列错，exit 1；
+requirements 无 O 编号或注明 N/A → 打印 skip，exit 0。
+
+负对照自证（guard only guards if the regression fails it）：
+  python3 coverage_check.py --self-test
+构造正例+负例断言：缺行/空落点/空证据/坏证据路径 → 必 exit 1；完好 → exit 0。
+自证失败即 exit 1（门禁自身被回归击穿时，先修门禁再放行）。
+
+用法：python3 coverage_check.py <workspace> <id> | coverage_check.py --self-test
+Exit: 0 ok/skip, 1 fail, 2 usage.
+"""
+import re
+import sys
+import tempfile
+from pathlib import Path
+
+
+def cells(line):
+    return [c.strip() for c in line.strip().strip("|").split("|")]
+
+
+def is_delim(row):
+    parts = [c for c in row if c]
+    return bool(parts) and all(re.fullmatch(r":?-{3,}:?", c) for c in parts)
+
+
+def table_after(text, heading):
+    lines = text.splitlines()
+    start = None
+    for i, l in enumerate(lines):
+        if l.startswith("#") and heading in l:
+            start = i + 1
+            break
+    if start is None:
+        return []
+    while start < len(lines) and ("|" not in lines[start] or lines[start].lstrip().startswith("#")):
+        if lines[start].lstrip().startswith("#"):
+            return []
+        start += 1
+    if start >= len(lines):
+        return []
+    headers = cells(lines[start])
+    start += 1
+    if start < len(lines) and is_delim(cells(lines[start])):
+        start += 1
+    rows = []
+    while start < len(lines) and "|" in lines[start]:
+        vals = cells(lines[start])
+        if len(vals) == len(headers):
+            rows.append({headers[i]: vals[i] for i in range(len(headers))})
+        start += 1
+    return rows
+
+
+def check(root: Path, wid: str) -> int:
+    req_path = root / "docs" / "wish" / wid / "requirements.md"
+    tsv_path = root / ".sdd" / "acceptance" / wid / "coverage.tsv"
+
+    if not req_path.is_file():
+        print(f"coverage_check: missing requirements.md at {req_path}", file=sys.stderr)
+        return 1
+
+    req_text = req_path.read_text(encoding="utf-8-sig")
+    rows = table_after(req_text, "存量功能清单")
+    o_ids = [r.get("编号", "").strip() for r in rows if re.match(r"^O\d+", r.get("编号", "").strip())]
+
+    if not o_ids:
+        reason = "注明 N/A（全新建设类愿望）" if "N/A" in req_text else "无 O 编号"
+        print(f"coverage_check: skip — requirements.md {reason}")
+        return 0
+
+    if not tsv_path.is_file():
+        print(f"coverage_check: missing coverage.tsv at {tsv_path}", file=sys.stderr)
+        return 1
+
+    tsv_rows = {}
+    for lineno, line in enumerate(tsv_path.read_text(encoding="utf-8-sig").splitlines(), 1):
+        if not line.strip() or line.lstrip().startswith("#"):
+            continue
+        parts = [c.strip() for c in line.split("\t")]
+        if len(parts) < 3:
+            print(f"coverage_check: malformed tsv row (need 3 tab-separated columns) at line {lineno}: {line!r}", file=sys.stderr)
+            return 1
+        num = parts[0]
+        if not re.match(r"^O\d+", num):
+            continue  # 表头或非 O 编号行，跳过
+        if num in tsv_rows:
+            print(f"coverage_check: duplicate O id in tsv: {num}", file=sys.stderr)
+            return 1
+        tsv_rows[num] = (parts[1], parts[2])
+
+    errs = 0
+    for oid in o_ids:
+        if oid not in tsv_rows:
+            print(f"coverage_check: 存量功能 {oid} 缺落点行（coverage.tsv 无对应条目）", file=sys.stderr)
+            errs += 1
+            continue
+        target, evpath = tsv_rows[oid]
+        if not target:
+            print(f"coverage_check: 存量功能 {oid} 新落点为空", file=sys.stderr)
+            errs += 1
+        if not evpath:
+            print(f"coverage_check: 存量功能 {oid} 证据路径为空", file=sys.stderr)
+            errs += 1
+            continue
+        p = Path(evpath)
+        if ".." in p.parts:
+            print(f"coverage_check: 存量功能 {oid} 证据路径不得含 ..: {evpath!r}（禁止跨目录/跨愿望引用）", file=sys.stderr)
+            errs += 1
+            continue
+        resolved = p if p.is_absolute() else (root / p).resolve()
+        resolved = resolved.resolve()
+        try:
+            resolved.relative_to(root.resolve())
+        except ValueError:
+            print(f"coverage_check: 存量功能 {oid} 证据路径越出工作区: {evpath!r}（工作区内绝对路径可用，工作区外一律拒绝）", file=sys.stderr)
+            errs += 1
+            continue
+        if resolved == tsv_path.resolve():
+            print(f"coverage_check: 存量功能 {oid} 证据路径自指 coverage.tsv: {evpath!r}", file=sys.stderr)
+            errs += 1
+            continue
+        if not resolved.is_file():
+            print(f"coverage_check: 存量功能 {oid} 证据路径不存在: {evpath!r}", file=sys.stderr)
+            errs += 1
+
+    if errs:
+        print(f"coverage_check FAIL: {wid} ({errs} error(s))", file=sys.stderr)
+        return 1
+    print(f"coverage_check OK: {wid} ({len(o_ids)} 存量功能均有落点与证据)")
+    return 0
+
+
+def self_test() -> int:
+    """负对照自证：构造正例与四类负例，全部断言后报告。任一断言失败 → exit 1。"""
+    failures = []
+    with tempfile.TemporaryDirectory() as td:
+        root = Path(td)
+        wish = root / "docs" / "wish" / "selftest" / "requirements.md"
+        wish.parent.mkdir(parents=True)
+        # requirements：O1 + O2
+        req = """# selftest · 需求清单
+
+## 2. 存量功能清单
+
+| 编号 | 存量功能 | 处置 |
+|---|---|---|
+| O1 | 旧功能一 | 保留 |
+| O2 | 旧功能二 | 保留 |
+"""
+        wish.write_text(req, encoding="utf-8")
+
+        acc = root / ".sdd" / "acceptance" / "selftest"
+        acc.mkdir(parents=True)
+        ev1 = acc / "ev1.png"
+        ev1.write_text("x", encoding="utf-8")
+
+        good_tsv = f"O1\t新页面A\t{ev1}\nO2\t新页面B\t{ev1}\n"
+        cases = [
+            ("正例：全好 → 期望 exit 0", good_tsv, 0),
+            ("负例 A：删掉落点行 → 期望 exit 1", "O1\t新页面A\t%s\n" % ev1, 1),
+            ("负例 B：空落点 → 期望 exit 1", "O1\t\t%s\nO2\t新页面B\t%s\n" % (ev1, ev1), 1),
+            ("负例 C：空证据 → 期望 exit 1", "O1\t新页面A\t\nO2\t新页面B\t%s\n" % ev1, 1),
+            ("负例 D：证据路径不存在 → 期望 exit 1", "O1\t新页面A\tno-such-file.png\nO2\t新页面B\t%s\n" % ev1, 1),
+        ]
+        for label, tsv_text, want in cases:
+            (acc / "coverage.tsv").write_text(tsv_text, encoding="utf-8")
+            got = check(root, "selftest")
+            status = "OK" if got == want else "FAIL"
+            if got != want:
+                failures.append(f"{label} — want exit {want}, got {got}")
+            print(f"  [{status}] {label}（exit {got}）")
+
+    if failures:
+        for f in failures:
+            print(f"coverage_check --self-test FAIL: {f}", file=sys.stderr)
+        return 1
+    print("coverage_check --self-test OK：正例放行、四类负例全部被拒（门禁自证有效）")
+    return 0
+
+
+def main():
+    if len(sys.argv) == 2 and sys.argv[1] == "--self-test":
+        return self_test()
+    if len(sys.argv) != 3:
+        print("usage: coverage_check.py <workspace> <id> | coverage_check.py --self-test", file=sys.stderr)
+        return 2
+    root = Path(sys.argv[1]).resolve()
+    return check(root, sys.argv[2])
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/presets/code-vibe/skills/wish-programming/scripts/gate-lock.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# gate-lock.sh — hash-lock the gate scripts so verify/journey can detect tampering.
+#
+# Usage:
+#   gate-lock.sh            # (re)write MANIFEST.sha256 next to the scripts
+#   gate-lock.sh --check    # verify current hashes match the manifest (exit 1 on mismatch)
+#
+# Run after any legitimate edit to scripts/. The manifest is the
+# integrity baseline: verify.sh / journey.sh refuse to trust evidence when a gate script
+# no longer matches it. Scripts live outside the workspace, so agents cannot rewrite them;
+# the lock detects deployments where the scripts were changed after the baseline.
+set -euo pipefail
+
+DIR="$(cd "$(dirname "$0")" && pwd)"
+MANIFEST="$DIR/MANIFEST.sha256"
+FILES=(check_spec.py check_whitelist.py coverage_check.py gate-lock.sh journey.sh project.sh replay.sh scan_drift.py verify_preset_budgets.py verify.sh wish.sh)
+
+sha256_of() {
+  local f="$1"
+  if command -v sha256sum >/dev/null 2>&1; then sha256sum "$f" | awk '{print $1}'
+  elif command -v shasum >/dev/null 2>&1; then shasum -a 256 "$f" | awk '{print $1}'
+  else echo "gate-lock: no sha256sum/shasum available" >&2; exit 2; fi
+}
+
+if [[ "${1:-}" == "--check" ]]; then
+  [[ -f "$MANIFEST" ]] || { echo "gate-lock: no manifest at $MANIFEST" >&2; exit 1; }
+  bad=0
+  while read -r want f; do
+    [[ -f "$DIR/$f" ]] || { echo "gate-lock: $f missing" >&2; bad=1; continue; }
+    got="$(sha256_of "$DIR/$f")"
+    if [[ "$got" != "$want" ]]; then
+      echo "gate-lock: $f modified since lock" >&2; bad=1
+    fi
+  done < <(grep -vE '^#|^$' "$MANIFEST")
+  if (( bad )); then echo "gate-lock: CHECK FAIL" >&2; exit 1; fi
+  echo "gate-lock: check ok"
+  exit 0
+fi
+
+: > "$MANIFEST"
+for f in "${FILES[@]}"; do
+  if [[ -f "$DIR/$f" ]]; then
+    printf '%s  %s\n' "$(sha256_of "$DIR/$f")" "$f" >> "$MANIFEST"
+  fi
+done
+echo "gate-lock: wrote $MANIFEST ($(grep -vcE '^#|^$' "$MANIFEST") files)"