@fantasticit/sumi 0.0.0-stage → 0.5.0

package/node_modules/@sumi/plugins-governance/dist/commands/gate.js

@@ -0,0 +1,167 @@
+import { execFileSync, spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { configAt, protectedMatcher } from '../protected.js';
+import { semanticChanges } from '../semantic.js';
+import { runGateFlow, workspaceCommand } from '../checkout.js';
+import { resolvePushUpstream } from '../push-base.js';
+import { requireApproval } from '../state.js';
+import { gitPaths, projectSumiCommand } from '@sumi/plugin-sdk';
+/**
+ * sumi gate <remote> [url]：由 git 推送前 hook 调用，从标准输入读取更新列表逐项验收。
+ * 每项在被推送提交的独立检出中准备环境、现场运行门禁流程；control 变更、强推、删除、
+ * 无关历史与首次接入需要人工确认。任一项未通过即拒绝整次推送（退出码 1）。
+ */
+const ZERO = /^0+$/;
+const root = process.env.SUMI_ROOT ?? process.cwd();
+const remote = process.argv[2] ?? 'origin';
+function git(args, cwd = root) {
+    return execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true }).trim();
+}
+function tryGit(args, cwd = root) {
+    try {
+        return git(args, cwd);
+    }
+    catch {
+        return null;
+    }
+}
+const sha256 = (text) => createHash('sha256').update(text).digest('hex');
+function ask(outcome, kind, binding, question, summary) {
+    const id = requireApproval(root, kind, binding, [question, ...summary]);
+    if (id) {
+        outcome.ok = false;
+        outcome.asks.push({ question, argv: projectSumiCommand('approve', id) });
+    }
+}
+/** 在独立检出中准备环境并运行门禁流程。 */
+function runInCheckout(outcome, oid, base, upstream) {
+    const source = upstream ? `，来源 ${upstream.name}` : '';
+    process.stderr.write(`验收 ${outcome.ref}（${oid.slice(0, 8)}，基准 ${base ? base.slice(0, 8) : '空树'}${source}）\n`);
+    const run = runGateFlow(root, oid, base, (line) => process.stderr.write(`${line}\n`));
+    if (run.problem) {
+        outcome.ok = false;
+        outcome.lines.push(`⊘ ${run.problem}`);
+        if (!run.conclusion)
+            return;
+    }
+    let brief = run.brief;
+    if (run.conclusion === 'pending') {
+        // 门禁不派发评审或人工确认：检出里的 next 指向检出目录，照做无效，改为指引在工作区完成。
+        brief = brief.split('\nnext:')[0];
+        brief += `\n门禁不派发评审：请在工作区运行 ${workspaceCommand(run, base)}，按简报完成待处理项（评审结果用 node ./control/bin/sumi.cjs submit 提交），再推送同一提交`;
+    }
+    outcome.lines.push(...brief.split('\n').map((l) => `  ${l}`));
+    if (run.conclusion !== 'pass') {
+        outcome.ok = false;
+        outcome.lines.push(`  检出保留在 ${run.wt}，修复请在作者工作树中进行`);
+    }
+}
+function verify(localRef, localOid, remoteRef, remoteOid) {
+    const outcome = { ref: remoteRef, ok: true, lines: [], asks: [] };
+    if (ZERO.test(localOid)) {
+        ask(outcome, 'ref-delete', { remote, ref: remoteRef, old: remoteOid }, `确认删除远端 ${remote} 的 ${remoteRef}`, []);
+        return outcome;
+    }
+    const commit = tryGit(['rev-parse', '--verify', '--quiet', `${localOid}^{commit}`]);
+    if (!commit) {
+        outcome.ok = false;
+        outcome.lines.push(`✗ ${localRef} 不指向提交，拒绝推送`);
+        return outcome;
+    }
+    let base;
+    let upstream = null;
+    if (ZERO.test(remoteOid)) {
+        upstream = resolvePushUpstream(root, localRef, commit, null);
+        if (upstream) {
+            base = upstream.oid;
+        }
+        else {
+            const defaultBranch = configAt(root, commit)?.gate?.defaultBranch ?? 'main';
+            const tracking = tryGit(['rev-parse', '--verify', '--quiet', `refs/remotes/${remote}/${defaultBranch}`]);
+            if (!tracking)
+                base = null;
+            else {
+                base = tryGit(['merge-base', tracking, commit]);
+                if (!base) {
+                    ask(outcome, 'unrelated-import', { remote, ref: remoteRef, old: null, new: commit, trusted: tracking }, `确认导入与 ${defaultBranch} 无共同祖先的历史到 ${remoteRef}`, []);
+                }
+            }
+        }
+    }
+    else {
+        if (tryGit(['cat-file', '-e', `${remoteOid}^{commit}`]) === null) {
+            outcome.ok = false;
+            outcome.lines.push(`⊘ 本地缺少远端提交 ${remoteOid.slice(0, 12)}，请先 git fetch ${remote}`);
+            return outcome;
+        }
+        const fastForward = spawnSync('git', ['merge-base', '--is-ancestor', remoteOid, commit], { cwd: root, windowsHide: true }).status === 0;
+        if (fastForward) {
+            upstream = resolvePushUpstream(root, localRef, commit, remoteOid);
+            base = upstream?.oid ?? remoteOid;
+        }
+        else {
+            base = tryGit(['merge-base', remoteOid, commit]);
+            if (!base)
+                ask(outcome, 'unrelated-import', { remote, ref: remoteRef, old: remoteOid, new: commit, trusted: remoteOid }, `确认用无共同祖先的历史覆盖 ${remoteRef}`, []);
+            ask(outcome, 'force-update', { remote, ref: remoteRef, old: remoteOid, new: commit }, `确认强制更新 ${remoteRef}`, []);
+        }
+    }
+    // control 变更：比较基准中没有项目配置时为首次接入，需要确认全部 control 内容。
+    const baseConfig = base ? configAt(root, base) : null;
+    const candidateConfig = configAt(root, commit);
+    const isProtected = protectedMatcher(baseConfig, candidateConfig);
+    if (!baseConfig) {
+        const files = gitPaths(root, ['ls-tree', '-r', '--name-only', commit]).filter((f) => isProtected(f));
+        const digest = sha256(files.map((f) => `${f}\0${git(['rev-parse', `${commit}:${f}`])}`).join('\n'));
+        ask(outcome, 'enrollment', { remote, ref: remoteRef, control: digest }, `确认首次接入：${remoteRef} 的全部 control 内容（${files.length} 个文件）`, files.slice(0, 20));
+    }
+    else {
+        const changed = gitPaths(root, ['diff', '--name-only', base, commit]).filter((f) => isProtected(f));
+        if (changed.length) {
+            const diff = git(['diff', base, commit, '--', ...changed]);
+            ask(outcome, 'control-change', { remote, ref: remoteRef, base, diff: sha256(diff) }, `确认推送到 ${remoteRef} 的 control 变更`, semanticChanges(root, base, commit, changed));
+        }
+    }
+    // 先判断人工确认：确认与否只取决于 diff，未确认时不运行检查，确认后重新推送才运行，避免检查白跑一遍。
+    if (outcome.asks.length) {
+        outcome.lines.push('  需要先完成人工确认；确认后重新推送时再运行检查');
+        return outcome;
+    }
+    if (upstream?.oid === commit) {
+        process.stderr.write(`验收 ${outcome.ref}（${commit.slice(0, 8)}，基准 ${commit.slice(0, 8)}，来源 ${upstream.name}）\n`);
+        outcome.lines.push(`  ✓ ${upstream.name}（${commit.slice(0, 8)}）纯同步，跳过环境准备与门禁流程`);
+        return outcome;
+    }
+    runInCheckout(outcome, commit, base, upstream);
+    return outcome;
+}
+const input = readFileSync(0, 'utf8');
+const updates = input
+    .split('\n')
+    .filter(Boolean)
+    .map((l) => l.split(' '));
+const seen = new Map();
+const outcomes = updates.map(([localRef, localOid, remoteRef, remoteOid]) => {
+    const key = `${localRef}:${localOid}:${remoteRef}:${remoteOid}`;
+    const cached = seen.get(key);
+    if (cached)
+        return cached;
+    const outcome = verify(localRef, localOid, remoteRef, remoteOid);
+    seen.set(key, outcome);
+    return outcome;
+});
+const ok = outcomes.every((o) => o.ok);
+const out = [`GATE ${ok ? 'PASS' : 'FAIL'}`];
+for (const o of outcomes) {
+    out.push(`${o.ok ? '✓' : '✗'} ${o.ref}`, ...o.lines);
+}
+const asks = outcomes.flatMap((o) => o.asks);
+if (asks.length) {
+    out.push('next:');
+    for (const a of asks)
+        out.push(`  [ask-human] ${a.question}（建议由人执行：${a.argv.join(' ')}） — 需要人工确认`);
+}
+process.stderr.write(`${out.join('\n')}\n`);
+process.exitCode = ok ? 0 : 1;
+//# sourceMappingURL=gate.js.map

package/node_modules/@sumi/plugins-governance/dist/commands/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/commands/gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAqB,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEhE;;;;GAIG;AACH,MAAM,IAAI,GAAG,MAAM,CAAC;AACpB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AACpD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;AAE3C,SAAS,GAAG,CAAC,IAAc,EAAE,GAAG,GAAG,IAAI;IACrC,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3H,CAAC;AACD,SAAS,MAAM,CAAC,IAAc,EAAE,GAAG,GAAG,IAAI;IACxC,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AACD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AASjF,SAAS,GAAG,CAAC,OAAgB,EAAE,IAAY,EAAE,OAAgC,EAAE,QAAgB,EAAE,OAAiB;IAChH,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;IACxE,IAAI,EAAE,EAAE,CAAC;QACP,OAAO,CAAC,EAAE,GAAG,KAAK,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,yBAAyB;AACzB,SAAS,aAAa,CAAC,OAAgB,EAAE,GAAW,EAAE,IAAmB,EAAE,QAA6B;IACtG,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC;IAC9G,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;IACtF,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,OAAO,CAAC,EAAE,GAAG,KAAK,CAAC;QACnB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,UAAU;YAAE,OAAO;IAC9B,CAAC;IACD,IAAI,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACtB,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACjC,iDAAiD;QACjD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAE,CAAC;QACnC,KAAK,IAAI,qBAAqB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,iEAAiE,CAAC;IAC7H,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9D,IAAI,GAAG,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,CAAC,EAAE,GAAG,KAAK,CAAC;QACnB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,EAAE,eAAe,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,QAAgB,EAAE,QAAgB,EAAE,SAAiB,EAAE,SAAiB;IACtF,MAAM,OAAO,GAAY,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC3E,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,UAAU,MAAM,MAAM,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9G,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,QAAQ,WAAW,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,EAAE,GAAG,KAAK,CAAC;QACnB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ,aAAa,CAAC,CAAC;QAC/C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,IAAmB,CAAC;IACxB,IAAI,QAAQ,GAAwB,IAAI,CAAC;IACzC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,IAAI,MAAM,CAAC;YAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,gBAAgB,MAAM,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC;YACzG,IAAI,CAAC,QAAQ;gBAAE,IAAI,GAAG,IAAI,CAAC;iBACtB,CAAC;gBACJ,IAAI,GAAG,MAAM,CAAC,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;gBAChD,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,GAAG,CACD,OAAO,EACP,kBAAkB,EAClB,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,EACrE,SAAS,aAAa,cAAc,SAAS,EAAE,EAC/C,EAAE,CACH,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,MAAM,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,SAAS,WAAW,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACjE,OAAO,CAAC,EAAE,GAAG,KAAK,CAAC;YACnB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAC;YAClF,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;QACxI,IAAI,WAAW,EAAE,CAAC;YAChB,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YAClE,IAAI,GAAG,QAAQ,EAAE,GAAG,IAAI,SAAS,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,MAAM,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI;gBACP,GAAG,CACD,OAAO,EACP,kBAAkB,EAClB,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,EAC3E,iBAAiB,SAAS,EAAE,EAC5B,EAAE,CACH,CAAC;YACJ,GAAG,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,UAAU,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACrG,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpG,GAAG,CACD,OAAO,EACP,YAAY,EACZ,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,EAC3C,UAAU,SAAS,mBAAmB,KAAK,CAAC,MAAM,OAAO,EACzD,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CACnB,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,IAAK,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACrG,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,IAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;YAC5D,GAAG,CACD,OAAO,EACP,gBAAgB,EAChB,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EACpD,SAAS,SAAS,eAAe,EACjC,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAC7C,CAAC;QACJ,CAAC;IACH,CAAC;IACD,uDAAuD;IACvD,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,QAAQ,EAAE,GAAG,KAAK,MAAM,EAAE,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC;QAChH,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,QAAQ,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACjF,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACtC,MAAM,OAAO,GAAG,KAAK;KAClB,KAAK,CAAC,IAAI,CAAC;KACX,MAAM,CAAC,OAAO,CAAC;KACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAqC,CAAC,CAAC;AAChE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmB,CAAC;AACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE;IAC1E,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,QAAQ,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACjE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvB,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC,CAAC;AAEH,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACvC,MAAM,GAAG,GAAa,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACvD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;IACzB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC7C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AACrG,CAAC;AACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5C,OAAO,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/node_modules/@sumi/plugins-governance/dist/commands/guard.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@sumi/plugins-governance/dist/commands/guard.js

@@ -0,0 +1,27 @@
+import { readFileSync } from 'node:fs';
+import { decide } from '../guard.js';
+/**
+ * sumi guard：供 AI 工具的命令与编辑前置 hook 调用，从标准输入读取 hook 输入（Claude Code 格式）。
+ * 拒绝时以退出码 2 结束并在 stderr 说明原因，放行时退出码 0。
+ */
+const root = process.env.SUMI_ROOT ?? process.cwd();
+let input = {};
+try {
+    input = JSON.parse(readFileSync(0, 'utf8') || '{}');
+}
+catch {
+    input = {};
+}
+// 出错时拒绝：AI 工具只把退出码 2 当作阻断，未捕获的异常（退出码 1）会被当成放行。
+let decision;
+try {
+    decision = decide(root, input);
+}
+catch (error) {
+    decision = { allow: false, reason: `拒绝：guard 无法判断本次操作（${error.message.split('\n')[0]}），请运行 sumi doctor` };
+}
+if (!decision.allow) {
+    process.stderr.write(`${decision.reason}\n`);
+    process.exitCode = 2;
+}
+//# sourceMappingURL=guard.js.map

package/node_modules/@sumi/plugins-governance/dist/commands/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../src/commands/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,MAAM,EAAmB,MAAM,aAAa,CAAC;AAEtD;;;GAGG;AACH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AACpD,IAAI,KAAK,GAAe,EAAE,CAAC;AAC3B,IAAI,CAAC;IACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,IAAI,CAAe,CAAC;AACpE,CAAC;AAAC,MAAM,CAAC;IACP,KAAK,GAAG,EAAE,CAAC;AACb,CAAC;AACD,+CAA+C;AAC/C,IAAI,QAAmC,CAAC;AACxC,IAAI,CAAC;IACH,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACjC,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,QAAQ,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAsB,KAAe,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC;AACvH,CAAC;AACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;IAC7C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC"}

package/node_modules/@sumi/plugins-governance/dist/commands/pr-report-check.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@sumi/plugins-governance/dist/commands/pr-report-check.js

@@ -0,0 +1,8 @@
+import { checkPrReportStatus } from '../pr-report-status.js';
+const root = process.env.SUMI_ROOT ?? process.cwd();
+const status = checkPrReportStatus(root);
+if (!status.pass) {
+    process.stderr.write(`${status.message}\n`);
+    process.exitCode = 2;
+}
+//# sourceMappingURL=pr-report-check.js.map

package/node_modules/@sumi/plugins-governance/dist/commands/pr-report-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pr-report-check.js","sourceRoot":"","sources":["../../src/commands/pr-report-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AACpD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACzC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;IAC5C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC"}

package/node_modules/@sumi/plugins-governance/dist/commands/pr-report.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@sumi/plugins-governance/dist/commands/pr-report.js

@@ -0,0 +1,128 @@
+import { mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { PROJECT_SUMI, spawnCommandSync } from '@sumi/plugin-sdk';
+import { runGateFlow, workspaceCommand } from '../checkout.js';
+import { resolvePrBase } from '../pr-base.js';
+import { PR_REPORT_MARKER, prReportHeadMarker } from '../pr-report-markers.js';
+/**
+ * sumi pr-report <PR 号>：以 PR 的完整范围（与目标分支的合并基础..头提交）在头提交的独立检出中
+ * 按门禁配置运行门禁流程，把结论、各步骤状态、findings 与各步骤的报告段落发布为一条 PR 评论；
+ * 同一 PR 再次运行时更新这条评论。评审未完成时不发布，给出工作区命令。依赖已登录的 gh。
+ */
+const root = process.env.SUMI_ROOT ?? process.cwd();
+const pr = process.argv[2];
+function fail(message, code = 1) {
+    process.stderr.write(`${message}\n`);
+    process.exit(code);
+}
+function gh(args) {
+    const r = spawnCommandSync('gh', args, { cwd: root, encoding: 'utf8', windowsHide: true });
+    if (r.error)
+        fail('未找到 gh：PR 报告通过 GitHub CLI 读写 PR，请安装并登录 gh（gh auth login）', 3);
+    if (r.status !== 0)
+        fail(`gh ${args.slice(0, 2).join(' ')} 失败：${r.stderr.trim()}`, 3);
+    return r.stdout.trim();
+}
+const runGit = (args) => {
+    const r = spawnCommandSync('git', args, { cwd: root, encoding: 'utf8', windowsHide: true });
+    return { status: r.status, stdout: r.stdout ?? '', stderr: r.stderr ?? '' };
+};
+const git = (args) => {
+    const r = runGit(args);
+    if (r.status !== 0)
+        throw new Error(r.stderr.trim() || `git ${args[0]} 失败`);
+    return r.stdout.trim();
+};
+const tryGit = (args) => {
+    try {
+        return git(args);
+    }
+    catch {
+        return null;
+    }
+};
+const STATE = {
+    pass: '✅ 通过',
+    fail: '❌ 未通过',
+    blocked: '⊘ 受阻',
+    pending: '… 待处理',
+    skipped: '– 跳过',
+    'not-applicable': '– 不适用',
+};
+const cell = (text) => text.replace(/\s*\n\s*/g, ' ').replace(/\|/g, '\\|');
+function compose(run, url, base, oid, baseBranch) {
+    const steps = run.record?.steps ?? [];
+    const shown = steps.filter((s) => s.state !== 'not-applicable');
+    const findings = shown.flatMap((s) => s.findings.filter((f) => f.severity === 'error').map((f) => ({ step: s.id, ...f })));
+    const lines = [
+        PR_REPORT_MARKER,
+        prReportHeadMarker(oid),
+        '## sumi 检查报告',
+        '',
+        // 与门禁口径一致：有问题（例如门禁过程中受检文件被改写）时不算通过
+        `- 结论：${run.problem ? STATE.blocked : (STATE[run.conclusion ?? 'blocked'] ?? run.conclusion)}`,
+        `- 范围：\`${base.slice(0, 8)}..${oid.slice(0, 8)}\`（与 GitHub ${baseBranch} 当前 head 的合并基础 → PR 头提交），流程 \`${run.flow}\`${run.tier ? `，档位 \`${run.tier}\`` : ''}`,
+        `- 方式：在头提交的独立检出中现场运行，评审复用工作区已接受的结果（${new Date().toISOString()}）`,
+        ...(run.problem ? [`- 问题：${run.problem}`] : []),
+        '',
+        '### 检查步骤',
+        '',
+        '| 步骤 | 必需 | 状态 | 摘要 |',
+        '| --- | --- | --- | --- |',
+        ...shown.map((s) => `| \`${s.id}\` | ${s.required ? '是' : '否'} | ${STATE[s.state] ?? s.state} | ${cell(s.summary).slice(0, 200)} |`),
+        ...(steps.length > shown.length ? ['', `另有 ${steps.length - shown.length} 个步骤不适用于本次范围。`] : []),
+    ];
+    const reports = shown.filter((s) => s.report);
+    if (reports.length)
+        lines.push('', '### 评审与报告', '', ...reports.flatMap((s) => [s.report, '']));
+    if (findings.length) {
+        lines.push('', `### 问题（共 ${findings.length} 条${findings.length > 30 ? '，展示前 30 条' : ''}）`, '');
+        for (const f of findings.slice(0, 30)) {
+            lines.push(`- \`${f.step}\` ${f.file ? `\`${f.file}${f.line ? `:${f.line}` : ''}\` ` : ''}${cell(f.message).slice(0, 300)}`);
+        }
+    }
+    lines.push('', `<sub>由 \`sumi pr-report\` 生成；再次运行会更新本评论。PR：${url}</sub>`);
+    return lines.join('\n');
+}
+if (!pr || !/^\d+$/.test(pr))
+    fail('用法：sumi pr-report <PR 号>', 3);
+const view = JSON.parse(gh(['pr', 'view', pr, '--json', 'headRefOid,baseRefName,baseRefOid,url']));
+const head = tryGit(['rev-parse', 'HEAD']);
+if (head !== view.headRefOid) {
+    fail(`本地 HEAD（${head?.slice(0, 8) ?? '无'}）与 PR 头提交（${view.headRefOid.slice(0, 8)}）不一致：请先推送，或切到 PR 分支并更新`);
+}
+let base;
+try {
+    base = resolvePrBase(view, runGit);
+}
+catch (error) {
+    fail(error.message, 3);
+}
+process.stderr.write(`验收 PR #${pr}（${view.headRefOid.slice(0, 8)}，基准 ${base.slice(0, 8)}，GitHub ${view.baseRefName}@${view.baseRefOid.slice(0, 8)}）\n`);
+const run = runGateFlow(root, view.headRefOid, base, (line) => process.stderr.write(`${line}\n`));
+// 任一步骤待处理（例如评审未完成）都不发布：其他步骤失败时结论为 fail，不能只看结论
+const pending = (run.record?.steps ?? []).filter((s) => s.state === 'pending').map((s) => s.id);
+if (run.conclusion === 'pending' || pending.length) {
+    fail(`PR 范围内有待处理项${pending.length ? `（${pending.join('、')}）` : ''}，没有发布报告。请在工作区运行 ${workspaceCommand(run, base)}，按简报完成后再运行 ${PROJECT_SUMI} pr-report ${pr}`);
+}
+if (!run.conclusion)
+    fail(`没有得到结论，没有发布报告：${run.problem ?? run.brief}`);
+const body = compose(run, view.url, base, view.headRefOid, view.baseRefName);
+const file = join(mkdtempSync(join(tmpdir(), 'sumi-pr-report-')), 'body.md');
+writeFileSync(file, body);
+const existing = gh([
+    'api',
+    `repos/{owner}/{repo}/issues/${pr}/comments`,
+    '--paginate',
+    '--jq',
+    `.[] | select(.body | startswith("${PR_REPORT_MARKER}")) | .id`,
+])
+    .split('\n')
+    .filter(Boolean)[0];
+if (existing)
+    gh(['api', '-X', 'PATCH', `repos/{owner}/{repo}/issues/comments/${existing}`, '-F', `body=@${file}`]);
+else
+    gh(['pr', 'comment', pr, '--body-file', file]);
+process.stdout.write(`已${existing ? '更新' : '发布'} PR #${pr} 的检查报告：结论 ${run.problem ? STATE.blocked : (STATE[run.conclusion] ?? run.conclusion)}\n${view.url}\n`);
+//# sourceMappingURL=pr-report.js.map

package/node_modules/@sumi/plugins-governance/dist/commands/pr-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pr-report.js","sourceRoot":"","sources":["../../src/commands/pr-report.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAoB,MAAM,gBAAgB,CAAC;AACjF,OAAO,EAAE,aAAa,EAAkB,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE/E;;;;GAIG;AACH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AACpD,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAE3B,SAAS,IAAI,CAAC,OAAe,EAAE,IAAI,GAAG,CAAC;IACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,EAAE,CAAC,IAAc;IACxB,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,KAAK;QAAE,IAAI,CAAC,0DAA0D,EAAE,CAAC,CAAC,CAAC;IACjF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACtF,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,MAAM,GAAc,CAAC,IAAI,EAAE,EAAE;IACjC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5F,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;AAC9E,CAAC,CAAC;AACF,MAAM,GAAG,GAAG,CAAC,IAAc,EAAE,EAAE;IAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5E,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC,CAAC;AACF,MAAM,MAAM,GAAG,CAAC,IAAc,EAAE,EAAE;IAChC,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,KAAK,GAA2B;IACpC,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,OAAO;IACb,OAAO,EAAE,MAAM;IACf,OAAO,EAAE,OAAO;IAChB,OAAO,EAAE,MAAM;IACf,gBAAgB,EAAE,OAAO;CAC1B,CAAC;AACF,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAEpF,SAAS,OAAO,CAAC,GAAgB,EAAE,GAAW,EAAE,IAAY,EAAE,GAAW,EAAE,UAAkB;IAC3F,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3H,MAAM,KAAK,GAAG;QACZ,gBAAgB;QAChB,kBAAkB,CAAC,GAAG,CAAC;QACvB,cAAc;QACd,EAAE;QACF,mCAAmC;QACnC,QAAQ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,IAAI,SAAS,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE;QAC9F,UAAU,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,eAAe,UAAU,iCAAiC,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5J,qCAAqC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,GAAG;QAChE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,EAAE;QACF,UAAU;QACV,EAAE;QACF,uBAAuB;QACvB,2BAA2B;QAC3B,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC;QACpI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/F,CAAC;IACF,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAChG,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/F,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/H,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,8CAA8C,GAAG,QAAQ,CAAC,CAAC;IAC1E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;IAAE,IAAI,CAAC,0BAA0B,EAAE,CAAC,CAAC,CAAC;AAClE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,uCAAuC,CAAC,CAAC,CAKhG,CAAC;AACF,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;AAC3C,IAAI,IAAI,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;IAC7B,IAAI,CAAC,WAAW,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,aAAa,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,wBAAwB,CAAC,CAAC;AAC5G,CAAC;AACD,IAAI,IAAY,CAAC;AACjB,IAAI,CAAC;IACH,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACrC,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,IAAI,CAAE,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,UAAU,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAClI,CAAC;AACF,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;AAClG,8CAA8C;AAC9C,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAChG,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IACnD,IAAI,CACF,cAAc,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,mBAAmB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,YAAY,cAAc,EAAE,EAAE,CACvJ,CAAC;AACJ,CAAC;AACD,IAAI,CAAC,GAAG,CAAC,UAAU;IAAE,IAAI,CAAC,iBAAiB,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;AAEvE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;AAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAC7E,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC1B,MAAM,QAAQ,GAAG,EAAE,CAAC;IAClB,KAAK;IACL,+BAA+B,EAAE,WAAW;IAC5C,YAAY;IACZ,MAAM;IACN,oCAAoC,gBAAgB,WAAW;CAChE,CAAC;KACC,KAAK,CAAC,IAAI,CAAC;KACX,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACtB,IAAI,QAAQ;IAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,wCAAwC,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;;IAC/G,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;AACpD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,aAAa,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,IAAI,CAC1I,CAAC"}

package/node_modules/@sumi/plugins-governance/dist/commands/unlock.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@sumi/plugins-governance/dist/commands/unlock.js

@@ -0,0 +1,21 @@
+import { confirmOnTty, writeUnlock } from '../state.js';
+/** sumi unlock [--minutes N]：由人开启一个限时窗口，期间允许 AI 编辑受保护路径（推送前仍需确认）。 */
+const root = process.env.SUMI_ROOT ?? process.cwd();
+const i = process.argv.indexOf('--minutes');
+const minutes = i >= 0 ? Number(process.argv[i + 1]) : 30;
+if (!Number.isFinite(minutes) || minutes <= 0) {
+    process.stderr.write('用法：sumi unlock [--minutes N]\n');
+    process.exit(1);
+}
+try {
+    if (!(await confirmOnTty([`开启 ${minutes} 分钟的 control 编辑窗口，期间 AI 可以编辑受保护路径。`]))) {
+        process.stderr.write('短码不匹配，未开启\n');
+        process.exit(1);
+    }
+    process.stdout.write(`编辑窗口开启至 ${writeUnlock(root, minutes)}\n`);
+}
+catch (error) {
+    process.stderr.write(`${error.message}\n`);
+    process.exit(1);
+}
+//# sourceMappingURL=unlock.js.map

package/node_modules/@sumi/plugins-governance/dist/commands/unlock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unlock.js","sourceRoot":"","sources":["../../src/commands/unlock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAExD,qEAAqE;AACrE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AACpD,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AAC5C,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;IAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,IAAI,CAAC;IACH,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC,MAAM,OAAO,oCAAoC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;AAClE,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAI,KAAe,CAAC,OAAO,IAAI,CAAC,CAAC;IACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/node_modules/@sumi/plugins-governance/dist/guard.d.ts

@@ -0,0 +1,19 @@
+export interface GuardInput {
+    /** AI 工具会话的当前目录：命令中的相对路径按它解析。 */
+    cwd?: string;
+    tool_name?: string;
+    tool_input?: {
+        command?: string;
+        file_path?: string;
+        notebook_path?: string;
+    };
+}
+export interface GuardDecision {
+    allow: boolean;
+    reason?: string;
+}
+/** 从 shell 命令中粗略提取写入目标：重定向、写文件命令与 sed -i 的参数。 */
+export declare function writeTargets(command: string): string[];
+/** apply_patch 补丁头中的文件：Add/Update/Delete File 与 Move to。 */
+export declare function patchTargets(patch: string): string[];
+export declare function decide(root: string, input: GuardInput, platform?: NodeJS.Platform): GuardDecision;

package/node_modules/@sumi/plugins-governance/dist/guard.js

@@ -0,0 +1,173 @@
+import { execFileSync } from 'node:child_process';
+import { relative, resolve, sep } from 'node:path';
+import { cleanEnv, PROJECT_SUMI, spawnCommandSync, sumiCommand } from '@sumi/plugin-sdk';
+import { configAt, protectedPathMatcher } from './protected.js';
+import { unlockActive } from './state.js';
+/** 选项类规则在去掉引号内容后匹配，避免提交信息中的文字误报。 */
+const OPTION_BYPASS = [
+    [/\bgit\b[^;&|]*\b(commit|push)\b[^;&|]*--no-verify/, '带 --no-verify 的提交或推送'],
+    [/\bgit\b[^;&|]*\bcommit\b(?:[^;&|]*?\s)-[a-zA-Z]*n[a-zA-Z]*(?=\s|$)/, '带 -n 的提交'],
+];
+const stripQuoted = (command) => command.replace(/'[^']*'|"[^"]*"/g, "''");
+const BYPASS = [
+    [/\bHUSKY\s*=\s*['"]?0\b/, '设置 HUSKY=0'],
+    [/core\.hooksPath/i, '改写 core.hooksPath'],
+    [/\.git[\\/]+hooks\b/i, '写入 git hook 目录'],
+    [/\.git[\\/]+sumi\b/i, '写入共享状态目录'],
+    [/\bsumi\b[\s\S]*\b(approve|unlock)\b|commands\/(approve|unlock)\.js/, '由 AI 调用 sumi approve 或 sumi unlock'],
+];
+/** 会写入、移动或删除文件的命令：POSIX shell、PowerShell 与 cmd 的常见写法（不区分大小写）。 */
+const WRITE_COMMANDS = new Set([
+    'tee',
+    'cp',
+    'mv',
+    'rm',
+    'touch',
+    'install',
+    'ln',
+    'set-content',
+    'add-content',
+    'out-file',
+    'new-item',
+    'copy-item',
+    'move-item',
+    'remove-item',
+    'rename-item',
+    'clear-content',
+    'sc',
+    'ac',
+    'ni',
+    'cpi',
+    'mi',
+    'ri',
+    'rni',
+    'del',
+    'erase',
+    'copy',
+    'move',
+    'ren',
+    'rename',
+    'rd',
+    'rmdir',
+    'xcopy',
+    'robocopy',
+]);
+const unquote = (t) => t.replace(/^['"]|['"]$/g, '');
+/** 解释器中需要带一个值的选项。 */
+const VALUE_OPTIONS = /^(-executionpolicy|-ep|-windowstyle|-version|-inputformat|-outputformat|-configurationname|-workingdirectory|-o|\+o|-O|\+O)$/i;
+/** 把参数当作脚本执行的解释器。 */
+const SCRIPT_RUNNERS = /^(?:.*[\\/])?(?:sh|bash|zsh|dash|powershell|pwsh|cmd)(?:\.exe)?$/i;
+/** 按 shell 的引号规则切分参数：引号内的空白不切分，去掉引号；提交说明等引号内的单词不会被当成命令。 */
+const shellWords = (segment) => [...segment.matchAll(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g)].map((m) => m[0].replace(/["']/g, ''));
+/** 从 shell 命令中粗略提取写入目标：重定向、写文件命令与 sed -i 的参数。 */
+export function writeTargets(command) {
+    const targets = [];
+    for (const m of command.matchAll(/>{1,2}\s*("[^"]*"|'[^']*'|[^\s;&|<>]+)/g))
+        targets.push(unquote(m[1]));
+    for (const segment of command.split(/[;&|]+/)) {
+        const tokens = shellWords(segment);
+        // 交给另一个解释器执行的脚本（sh/bash -c、powershell -Command、cmd /c）：脚本整体是一个参数，递归提取其中的写入目标
+        // 只在第一个解释器处递归：后面的解释器都包含在递归输入里，逐个递归会指数增长并让守卫超时（超时被当作放行）。
+        const runner = tokens.findIndex((t) => SCRIPT_RUNNERS.test(t));
+        if (runner >= 0) {
+            // 跳过解释器的其他选项（-NoProfile、/d /s 等），直到脚本选项；允许 -lc 这类组合短选项
+            let at = runner + 1;
+            while (at < tokens.length && /^[-/]/.test(tokens[at]) && !/^(-[a-z]*c|-command|\/c|\/k)$/i.test(tokens[at])) {
+                // 带值的选项（-ExecutionPolicy Bypass、bash -o pipefail 等）连同它的值一起跳过
+                at += VALUE_OPTIONS.test(tokens[at]) ? 2 : 1;
+            }
+            if (/^(-[a-z]*c|-command|\/c|\/k)$/i.test(tokens[at] ?? '') && tokens[at + 1])
+                targets.push(...writeTargets(tokens.slice(at + 1).join(' ')));
+        }
+        const at = tokens.findIndex((t) => WRITE_COMMANDS.has(t.toLowerCase()) || (t === 'sed' && tokens.includes('-i')));
+        if (at < 0)
+            continue;
+        targets.push(...tokens.slice(at + 1).filter((t) => t && !t.startsWith('-') && !/^s[/|#]/.test(t)));
+    }
+    return targets;
+}
+/** apply_patch 补丁头中的文件：Add/Update/Delete File 与 Move to。 */
+export function patchTargets(patch) {
+    return [...patch.matchAll(/^\*\*\* (?:(?:Add|Update|Delete) File|Move to): (.+)$/gm)].map((m) => m[1].trim());
+}
+/** git 共享目录中只能由 sumi 与人写入的位置：确认状态与 hook。 */
+function gitWriteBarriers(root) {
+    const path = (arg) => resolve(root, execFileSync('git', ['rev-parse', ...arg.split(' ')], { cwd: root, encoding: 'utf8', windowsHide: true }).trim());
+    return [resolve(path('--git-common-dir'), 'sumi'), path('--git-path hooks')];
+}
+/** Git Bash 风格的盘符路径（/c/repo/x）在 Windows 上换成 C:/repo/x。 */
+const fromMsysPath = (p, platform) => platform === 'win32' ? p.replace(/^\/([a-zA-Z])(?=\/|$)/, (_, d) => `${d.toUpperCase()}:`) : p;
+export function decide(root, input, platform = process.platform) {
+    const config = configAt(root, null);
+    const isProtected = protectedPathMatcher([config], platform);
+    const unlocked = () => unlockActive(root);
+    const base = input.cwd ? resolve(root, input.cwd) : root;
+    const absolute = (p) => resolve(base, fromMsysPath(p, platform));
+    // 相对仓库根、以 / 分隔，与受保护 glob 的写法一致。
+    const rel = (p) => relative(root, absolute(p)).split(sep).join('/');
+    const caseless = platform === 'win32' || platform === 'darwin';
+    const barriers = gitWriteBarriers(root).map((b) => (caseless ? b.toLowerCase() : b));
+    const intoBarrier = (p) => {
+        const target = caseless ? absolute(p).toLowerCase() : absolute(p);
+        return barriers.some((b) => target === b || target.startsWith(`${b}${sep}`));
+    };
+    const tool = input.tool_name ?? '';
+    if (tool === 'Bash') {
+        const command = input.tool_input?.command ?? '';
+        const checks = [
+            ...OPTION_BYPASS.map(([re, label]) => [re, label, stripQuoted(command)]),
+            ...BYPASS.map(([re, label]) => [re, label, command]),
+        ];
+        for (const [re, label, text] of checks) {
+            if (re.test(text))
+                return { allow: false, reason: `拒绝：${label}。门禁与确认必须由人完成，请运行 ${PROJECT_SUMI} run check 并按简报处理` };
+        }
+        const targets = writeTargets(command);
+        if (targets.some(intoBarrier)) {
+            return {
+                allow: false,
+                reason: `拒绝：写入 git hook 或确认状态目录。门禁与确认必须由人完成，请运行 ${PROJECT_SUMI} run check 并按简报处理`,
+            };
+        }
+        const hits = targets.map(rel).filter((f) => !f.startsWith('..') && isProtected(f));
+        if (hits.length && !unlocked()) {
+            return { allow: false, reason: `拒绝：写入受保护路径 ${hits.join('、')}。需要人先运行 ! sumi unlock` };
+        }
+        if (/\bgit\b[^;&|]*\bpush\b/.test(command)) {
+            // hook 的生成与校验只有 sumi update 一个来源，这里不自己比较文件内容，也不需要知道 husky。
+            const [cmd, ...pre] = sumiCommand();
+            const r = spawnCommandSync(cmd, [...pre, 'update', '--check', '--json'], {
+                cwd: root,
+                encoding: 'utf8',
+                env: cleanEnv(),
+                windowsHide: true,
+            });
+            let drift = [];
+            try {
+                drift = JSON.parse(r.stdout).drift;
+            }
+            catch {
+                return { allow: false, reason: `拒绝：无法校验推送前 hook（update --check 运行失败），请运行 ${PROJECT_SUMI} doctor` };
+            }
+            if (drift.some((d) => d.path.startsWith('git hooks/') || d.path.startsWith('.husky/'))) {
+                return { allow: false, reason: `拒绝：推送前 hook 缺失或被修改。请先运行 ${PROJECT_SUMI} update 重新安装` };
+            }
+        }
+        return { allow: true };
+    }
+    // Codex 的 apply_patch 把补丁正文放在 tool_input.command 中，文件路径写在补丁头里。
+    const files = tool === 'apply_patch'
+        ? patchTargets(input.tool_input?.command ?? '')
+        : [input.tool_input?.file_path ?? input.tool_input?.notebook_path].filter((f) => !!f);
+    for (const file of files) {
+        if (intoBarrier(file)) {
+            return { allow: false, reason: `拒绝：${file} 位于 git hook 或确认状态目录，只能由 sumi 与人写入` };
+        }
+        const path = rel(file);
+        if (!path.startsWith('..') && isProtected(path) && !unlocked()) {
+            return { allow: false, reason: `拒绝：${path} 是受保护路径。需要人先运行 ! sumi unlock 开启编辑窗口` };
+        }
+    }
+    return { allow: true };
+}
+//# sourceMappingURL=guard.js.map

package/node_modules/@sumi/plugins-governance/dist/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAc1C,oCAAoC;AACpC,MAAM,aAAa,GAAuB;IACxC,CAAC,mDAAmD,EAAE,sBAAsB,CAAC;IAC7E,CAAC,oEAAoE,EAAE,UAAU,CAAC;CACnF,CAAC;AACF,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;AAEnF,MAAM,MAAM,GAAuB;IACjC,CAAC,wBAAwB,EAAE,YAAY,CAAC;IACxC,CAAC,kBAAkB,EAAE,mBAAmB,CAAC;IACzC,CAAC,qBAAqB,EAAE,gBAAgB,CAAC;IACzC,CAAC,oBAAoB,EAAE,UAAU,CAAC;IAClC,CAAC,oEAAoE,EAAE,oCAAoC,CAAC;CAC7G,CAAC;AAEF,iEAAiE;AACjE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,OAAO;IACP,SAAS;IACT,IAAI;IACJ,aAAa;IACb,aAAa;IACb,UAAU;IACV,UAAU;IACV,WAAW;IACX,WAAW;IACX,aAAa;IACb,aAAa;IACb,eAAe;IACf,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,KAAK;IACL,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,QAAQ;IACR,IAAI;IACJ,OAAO;IACP,OAAO;IACP,UAAU;CACX,CAAC,CAAC;AACH,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;AAC7D,qBAAqB;AACrB,MAAM,aAAa,GACjB,+HAA+H,CAAC;AAClI,qBAAqB;AACrB,MAAM,cAAc,GAAG,mEAAmE,CAAC;AAC3F,2DAA2D;AAC3D,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEtI,iDAAiD;AACjD,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,yCAAyC,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;IAC1G,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACnC,6EAA6E;QAC7E,wDAAwD;QACxD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;YAChB,uDAAuD;YACvD,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC;YACpB,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAE,CAAC,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAE,CAAC,EAAE,CAAC;gBAC9G,6DAA6D;gBAC7D,EAAE,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC3E,OAAO,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClH,IAAI,EAAE,GAAG,CAAC;YAAE,SAAS;QACrB,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,yDAAyD,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC;AACjH,CAAC;AAED,4CAA4C;AAC5C,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE,CAC3B,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,0DAA0D;AAC1D,MAAM,YAAY,GAAG,CAAC,CAAS,EAAE,QAAyB,EAAE,EAAE,CAC5D,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEzG,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,KAAiB,EAAE,WAA4B,OAAO,CAAC,QAAQ;IAClG,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,WAAW,GAAG,oBAAoB,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzE,gCAAgC;IAChC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ,CAAC;IAC/D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,EAAE;QAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAClE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IAEnC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,EAAE,OAAO,IAAI,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG;YACb,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,CAAU,CAAC;YACjF,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAU,CAAC;SAC9D,CAAC;QACF,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC;YACvC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,KAAK,oBAAoB,YAAY,mBAAmB,EAAE,CAAC;QACpG,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,0CAA0C,YAAY,mBAAmB;aAClF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC/B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC;QACvF,CAAC;QACD,IAAI,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,2DAA2D;YAC3D,MAAM,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG,WAAW,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAI,EAAE,CAAC,GAAG,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE;gBACxE,GAAG,EAAE,IAAI;gBACT,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,QAAQ,EAAE;gBACf,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;YACH,IAAI,KAAK,GAAuB,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAmC,CAAC,KAAK,CAAC;YACxE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,YAAY,SAAS,EAAE,CAAC;YACrG,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;gBACvF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,YAAY,cAAc,EAAE,CAAC;YACzF,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IACD,+DAA+D;IAC/D,MAAM,KAAK,GACT,IAAI,KAAK,aAAa;QACpB,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,IAAI,EAAE,CAAC;QAC/C,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvG,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,IAAI,oCAAoC,EAAE,CAAC;QAClF,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC/D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,IAAI,qCAAqC,EAAE,CAAC;QACnF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC"}

package/node_modules/@sumi/plugins-governance/dist/index.d.ts

@@ -0,0 +1,4 @@
+export * from './state.js';
+export * from './protected.js';
+export * from './semantic.js';
+export * from './guard.js';