@feng0531/dsh-code-review 0.48.0 → 0.49.0

package/CHANGELOG.md

@@ -2,9 +2,13 @@
 
 本文件介绍对使用者有意义的变化。安装与参数见 [README](README.md)，本次发布正文见 [发布说明](RELEASE-NOTES.md)。历史提交和安装包保留在 [GitHub Releases](https://github.com/f-e-n-g-0531/dsh-code-review/releases)；本文不把开发日志当作功能介绍。
 
+## 0.49.0 — Go/Python/Rust 运行时提示细化与 ArkTS
+
+Go 关注构建标签/版本与 GC 假设；Python 关注版本语法与调用契约；Rust 关注 edition/MSRV、cfg/宏展开与 panic 模式；新增 ArkTS（.ets）UI 线程/生命周期与受限边界提示。仍为证据门控提示，不是语义解析。
+
 ## 0.48.0 — 剩余语言与格式的保守缺陷提示
 
-为 F#/R/Elm/Haskell/Julia/Nim/OCaml、Rego/Jsonnet/Nix、Solidity/Vyper、Verilog/SystemVerilog/VHDL、Zig、PO/POT、MyBatis 映射和 JS/TS/React 补充证据门控提示；关注资源求值、重入、位宽、分配器、占位符和渲染副作用，不照搬风格或错误绝对规则。有歧义后缀（裸 .v、.pot）不分类；.sol 与 F# 仅在命中语言签名时提示。
+为 F#/R/Elm/Haskell/Julia/Nim/OCaml、Rego/Jsonnet/Nix、Solidity/Vyper、Verilog/SystemVerilog/VHDL、Zig、PO/POT、MyBatis 映射和 JS/TS/React 补充证据门控提示；关注资源求值、重入、位宽、分配器、占位符和渲染副作用，不照搬风格或错误绝对规则。有歧义后缀（裸 .v、.pot）不分类；.sol 与 F# 仅在命中语言签名时提示。429 项完整回归、实际宿主、10 项独立安装专项与四组 CI 通过；npm、Release 与原产物 101,539 字节一致，双哈希和清单通过。
 
 ## 0.47.0 — 命名空间成员调用导航
 

package/CORE-ALIGNMENT-TASKS.md

@@ -26,15 +26,16 @@
 | 1 | 实例与成员级上下文 | 命名/默认定义、保守调用方线索、历史同版本线索、命名空间成员导航已交付；类实例与继承仍待验收 |
 | 2 | 剩余历史来源与旧侧组合 | Git 历史与 SVN 三层链已交付；其他旧侧来源仍待验收 |
 | 3 | 其他旧侧独有来源 | 来源、版本、权限与删除场景保持一致 |
-| 4 | 剩余语言与路径专用指导 | 剩余主流函数式/HDL/智能合约语言已加入保守提示；Go/Python/Rust 与部分生命周期细化仍待验收 |
+| 4 | 路径专用指导与生命周期细化 | 函数式/HDL/智能合约/格式语言与 Go/Python/Rust 运行时提示已交付；部分生命周期并发细化仍待验收 |
 | 5 | 剩余预算组合与端到端矩阵 | 分组、窗口、检索、多次审查的终态与覆盖一致 |
 | 后置 | 真实模型质量评测 | 保存真实输出，人工裁决，分开统计失败和未完成 |
 
-Git 工作区、Git 历史两侧与 SVN 当前侧支持安全的三层字面依赖链；手动批准上下文可以作为入口。命名与默认导入支持批准正文中的唯一声明位置。这些能力不是完整语义绑定。调用方语法绑定的 v0.45.0 存在逐条导入歧义与历史发现元数据混侧错误，不计作安全对齐；v0.45.1 已修正并正式交付；历史调用方的同版本语法导航已随 v0.46.0 正式交付；命名空间成员调用导航已随 v0.47.0 正式交付；写入、遮蔽、逃逸、复合/间接调用、转义名与 JSX 文本不猜测，可选线索超预算时记录省略而不阻断源码审查。
+Git 工作区、Git 历史两侧与 SVN 当前侧支持安全的三层字面依赖链；手动批准上下文可以作为入口。命名与默认导入支持批准正文中的唯一声明位置。这些能力不是完整语义绑定。调用方语法绑定的 v0.45.0 存在逐条导入歧义与历史发现元数据混侧错误，不计作安全对齐；v0.45.1 已修正并正式交付；历史调用方的同版本语法导航已随 v0.46.0 正式交付；命名空间成员调用导航已随 v0.47.0 正式交付；剩余函数式/HDL/智能合约/格式语言的保守缺陷提示已随 v0.48.0 正式交付；Go/Python/Rust 运行前提与 ArkTS 提示已随 v0.49.0 正式交付；歧义后缀不猜测，转化用签名探测，提示不代替语义解析。
 
 ## 当前验证结论
 
-- 最近完整回归：424 项通过。
+- 最近完整回归：429 项通过。
+- v0.48.0 已正式交付剩余函数式/HDL/智能合约/格式语言的保守缺陷提示。429 项回归、实际宿主、10 项独立安装专项和四组 CI 通过；npm、Release 与原包 101,539 字节一致，SHA-256、SHA-512 与清单核验通过。
 - v0.47.0 已正式交付命名空间成员调用导航。424 项回归、实际宿主、17 项独立安装专项和四组 CI 通过；npm、Release 与原包 98,883 字节一致，SHA-256、SHA-512 与清单核验通过。
 - v0.46.0 已正式交付历史同版本调用方导航与可选线索预算回退。416 项回归、实际宿主、13 项独立安装专项和四组 CI 通过；npm、Release 与原包 97,482 字节一致，SHA-256、SHA-512 与清单核验通过。
 - v0.45.1 已正式交付保守的调用方语法线索及两项边界修正。413 项回归、实际宿主、10 项独立安装专项和四组 CI 通过；npm、Release 与原包的 96,700 字节一致，SHA-256、SHA-512 与清单核验通过。v0.45.0 已发布但存在逐条导入歧义与历史元数据混侧错误，由 0.45.1 替代，不计作安全对齐。

package/CORE-SOURCE-INVENTORY.md

@@ -38,7 +38,7 @@
 - PO/POT、MyBatis 映射：文本身份、复数、占位符、绑定值与动态 SQL 提示。
 - JS/TS/React：hook、异步清理与渲染副作用提示。
 
-Protobuf、Thrift、Cap’n Proto、GraphQL、Prisma 的专用指导已交付。以下仍以通用或大类指导为主，需进一步细化：Go/Python/Rust 的版本前提与调用契约，Objective-C/Swift/Kotlin/Java/C/C++ 的具体生命周期与并发场景，以及模板、依赖清单与基础设施的引擎版本和消费者约束。全部提示不是语义解析、迁移执行结果或缺陷证据。
+Protobuf、Thrift、Cap’n Proto、GraphQL、Prisma 的专用指导已交付；Go/Python/Rust 的版本前提与调用契约提示、ArkTS 提示也已交付。以下仍以通用或大类指导为主，需进一步细化：Objective-C/Swift/Kotlin/Java/C/C++ 的具体生命周期与并发场景，以及模板、依赖清单与基础设施的引擎版本和消费者约束。全部提示不是语义解析、迁移执行结果或缺陷证据。
 
 ## 固定参考文件索引
 

package/RELEASE-NOTES.md

@@ -1,16 +1,12 @@
-# v0.48.0 发布说明
+# v0.49.0 发布说明
 
-## 剩余语言与格式的保守缺陷提示
+## Go/Python/Rust 运行时提示细化与 ArkTS 支持
 
-为 F#、R、Elm、Haskell、Julia、Nim、OCaml、Rego、Jsonnet、Nix、Solidity、Vyper、Verilog/SystemVerilog/VHDL、Zig、PO/POT、MyBatis 映射和 JS/TS/React 补充了审查提示。提示只针对具体缺陷和反证，不照搬风格偏好、无条件性能建议或错误绝对规则。
-
-Rego、Jsonnet、Nix 关注未定义值、对象合并和构建依赖；Solidity/Vyper 关注重入、外部调用和存储布局；硬件描述语言关注调度、位宽和跨时钟域；Zig 关注分配器与错误清理；PO/MyBatis 关注文本身份、占位符与绑定值；React 关注 hook 清理和渲染副作用。
+为 Go、Python、Rust 补充版本与运行环境前提提示：Go 关注构建标签、go.mod/runtime 版本和 GC/finalizer 假设；Python 关注版本相关语法与关键字/位置调用契约；Rust 关注 edition/MSRV、cfg 与 proc-macro 展开及 panic 模式。新增 ArkTS（.ets）指导，关注 UI 线程/组件生命周期、状态不可变规则与受限 ArkTS/动态执行边界。
 
 ## 限制
 
-- 提示不是语义解析、迁移执行结果或缺陷证据，也不授予读取权限。
-- MyBatis 只在 XML 头部有限范围的 mapper 签名命中时选择该提示，其余 XML 仍是通用配置提示。
-- 有歧义的后缀不猜测：裸 .v、.pot 不分类；.sol 仅在命中 Solidity 签名、.fs/.fsi/.fsx 仅在命中 F# 签名时给出对应提示，否则保持通用。
-- Go、Python、Rust 及部分语言的生命周期与并发细化仍保留后续验收。
+- 提示仍只针对具体缺陷和反证，不是语义解析、迁移执行结果或缺陷证据，不授予读取权限。
+- .ts/.tsx 仍按 JavaScript/TypeScript 提示，不自动转为 ArkTS；仅 .ets 命中 ArkTS 指导。
 
 使用方法见 [README](README.md)。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feng0531/dsh-code-review",
-  "version": "0.48.0",
+  "version": "0.49.0",
   "private": false,
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" },

package/src/defect-guidance.mjs

@@ -7,15 +7,16 @@ const checklists = {
  swift: ['Check optional force unwraps and unowned captures against actual object lifetime and failure paths.', 'Check actor isolation, task cancellation, continuation completion exactly once and resources surviving asynchronous work.'],
  matlab: ['Check matrix dimensions, elementwise versus matrix operations and indexing against captured input contracts.', 'Check empty/NaN values, numeric precision, resource cleanup and changed output shapes with actual consumers.'],
  java: ['Check checked/unchecked exception exits, try-with-resources ownership and suppressed failures.', 'Check null/unboxing, equality/hash contracts and mutable keys; confirm the actual consumer contract.', 'Check synchronization/volatile publication, executor shutdown, interruption propagation and transaction rollback.'],
- go: ['Check error handling including typed-nil interfaces, deferred cleanup and panic paths.', 'Check goroutine/channel ownership, cancellation, close/send races and synchronization before shared-state teardown.', 'Check slice backing-array aliasing, map races and integer/bounds contracts with concrete callers.'],
- python: ['Check exception paths, context manager cleanup, iterator exhaustion and mutable default/shared state.', 'Check async task exception observation, cancellation and blocking operations on the event loop.', 'Check untrusted serialization, subprocess/SQL interpolation and authorization boundaries against actual input flows.'],
- rust: ['Check unsafe pointer validity, aliasing, initialization, alignment and lifetime obligations against the safety contract.', 'Check panic/error cleanup, lock guards across await and deadlocks or cancellation between state updates.', 'Check integer conversions, indexing, FFI ownership and Send/Sync assumptions without treating compiler acceptance as runtime proof.'],
+ go: ['Check error handling including typed-nil interfaces, deferred cleanup and panic paths.', 'Check goroutine/channel ownership, cancellation, close/send races and synchronization before shared-state teardown.', 'Check slice backing-array aliasing, map races and integer/bounds contracts with concrete callers.', 'Check build tags/constraints, go.mod and runtime version, and GC/finalizer assumptions against the actual build; do not infer memory or scheduling guarantees.'],
+ python: ['Check exception paths, context manager cleanup, iterator exhaustion and mutable default/shared state.', 'Check async task exception observation, cancellation and blocking operations on the event loop.', 'Check untrusted serialization, subprocess/SQL interpolation and authorization boundaries against actual input flows.', 'Check version-gated syntax (async/await, walrus, match, positional-only, type hints) and keyword/positional call contracts against the runtime version; do not assume newer feature availability.'],
+ rust: ['Check unsafe pointer validity, aliasing, initialization, alignment and lifetime obligations against the safety contract.', 'Check panic/error cleanup, lock guards across await and deadlocks or cancellation between state updates.', 'Check integer conversions, indexing, FFI ownership and Send/Sync assumptions without treating compiler acceptance as runtime proof.', 'Check edition/MSRV, cfg and proc-macro expansion, and panic/unwind versus abort mode against the declared build; do not treat hygiene or source order as evaluated runtime proof.'],
  kotlin: ['Check nullable/platform types, unsafe casts and Java interoperability at actual runtime boundaries.', 'Check structured coroutine lifetime, cancellation propagation, exception supervision and shared state synchronization.', 'Check use/close cleanup, collection mutation and transaction failure paths.'],
  php: ['Check coercion and loose comparison at authentication or validation boundaries with concrete input.', 'Check SQL/command/template injection, deserialization and output escaping in the actual execution context.', 'Check exception/early-return cleanup, transactions and session/concurrent request state.'],
  cpp: ['Check ownership, dangling references, double release and allocator/object lifetime across all exits.', 'Check stop publication, synchronization, join completion and remaining users before teardown; source order alone is not a happens-before proof.', 'Check exception/early-return resource cleanup, iterator invalidation, bounds, integer conversion and undefined behavior.', 'Do not assume macro expansion, overload binding, build flags or virtual dispatch targets without evidence.'],
  csharp: ['Check IDisposable/async disposal, cancellation propagation and completion before releasing shared state.', 'Check nullability and actual runtime guards, event subscription lifetime, deferred enumeration and captured mutable state.', 'Check async exception observation, synchronization and thread-affinity; do not assume await establishes unrelated ordering.'],
  javascript: ['Check null/undefined contract changes, promise rejection handling and missing await or cleanup on failure.', 'Check event/timer/listener lifecycle, closure state, cancellation races and concurrent updates.', 'Check untrusted input at injection/authentication boundaries; do not report style or infer TypeScript runtime checks.'],
  configuration: ['Check changed configuration keys against consumer/schema evidence, type/unit/default mismatches and compatibility.', 'Check exposed secrets, privilege expansion and unsafe interpolation only with concrete supported evidence.'],
+ arkts: ['Check UI-thread and component lifecycle, state immutability rules and task/coroutine cleanup against the actual framework contract.', 'Check restricted ArkTS and dynamic-eval boundaries, typed borrow/copy semantics and module strictness; do not infer behavior from plain TypeScript rules.'],
  hdl: ['Check scheduling/sensitivity lists, blocking versus nonblocking assignment, bit width, sign extension and truncation against actual values and consumers.', 'Check clock/reset domain crossings, metastability handling and combinational loops with concrete timing and tool-support evidence.', 'Check case exhaustiveness, inferred latches, x/z propagation and parameter/define overrides; do not assume simulator or synthesizer outcomes.'],
  solidity: ['Check state update ordering, reentrancy before external calls, balance/allowance accounting and storage layout across upgrades.', 'Check msg.sender/msg.value trust, delegatecall/selfdestruct exposure, overflow/underflow and access control against actual callers.', 'Check compiler/pragma version and deployed bytecode consumers; do not invent chain-specific behavior.'],
  vyper: ['Check reentrancy, external contract calls, integer bounds and payable/value handling against the actual call graph.', 'Check storage layout and compiler/version compatibility with deployed consumers; do not assume ABI or gas semantics.'],
@@ -39,7 +40,7 @@ export function defectGuidance(filePath, sourceText = '') {
  const head = typeof sourceText === 'string' ? sourceText.slice(0,8192) : '';
  const first = head.split('\n').map(s=>s.trim()).find(Boolean) ?? '';
  const sniffed = lower.endsWith('.m') ? (/^(?:#(?:import|include|pragma|if|define)\b|@(?:import|interface|implementation|class|protocol)\b|\/\/|\/\*)/.test(first) ? 'objc' : 'matlab') : lower.endsWith('.xml') && /<mapper\s+namespace\s*=|<!DOCTYPE\s+mapper\b|<(?:select|insert|update|delete)\s+id\s*=/.test(head) ? 'mybatis' : lower.endsWith('.sol') && /\/\/\s*SPDX-License-Identifier|pragma\s+solidity|\b(?:contract|interface|library)\s+[A-Za-z_$][A-Za-z0-9_$]*|\b(?:function|constructor|fallback|receive|modifier)\s*\(/.test(head) ? 'solidity' : /\.(fs|fsi|fsx)$/.test(lower) && /\blet\b|\bmodule\b|\bnamespace\b|\bopen\b|\btype\b|\[</.test(head) ? 'fsharp' : null;
- const specialized = /\.(shader|hlsl|glsl|cginc|hlsli|compute)$/.test(lower) ? 'shader' : sniffed ?? (/\.mm$/.test(lower) ? 'objc' : /\.swift$/.test(lower) ? 'swift' : /\.(vh|sv|svh|vhd|vhdl)$/.test(lower) ? 'hdl' : /\.vy$/.test(lower) ? 'vyper' : /\.rego$/.test(lower) ? 'rego' : /\.(jsonnet|libsonnet)$/.test(lower) ? 'jsonnet' : /\.nix$/.test(lower) ? 'nix' : /\.zig$/.test(lower) ? 'zig' : /\.r$/.test(lower) ? 'rlang' : /\.elm$/.test(lower) ? 'elm' : /\.(hs|lhs)$/.test(lower) ? 'haskell' : /\.jl$/.test(lower) ? 'julia' : /\.nim$/.test(lower) ? 'nim' : /\.(ml|mli)$/.test(lower) ? 'ocaml' : /\.po$/.test(lower) ? 'po' : null) ?? (/\.java$/.test(lower) ? 'java' : /\.go$/.test(lower) ? 'go' : /\.(py|pyi)$/.test(lower) ? 'python' : /\.rs$/.test(lower) ? 'rust' : /\.(kt|kts)$/.test(lower) ? 'kotlin' : /\.(php|phtml)$/.test(lower) ? 'php' : null);
+ const specialized = /\.(shader|hlsl|glsl|cginc|hlsli|compute)$/.test(lower) ? 'shader' : sniffed ?? (/\.mm$/.test(lower) ? 'objc' : /\.swift$/.test(lower) ? 'swift' : /\.ets$/.test(lower) ? 'arkts' : /\.(vh|sv|svh|vhd|vhdl)$/.test(lower) ? 'hdl' : /\.vy$/.test(lower) ? 'vyper' : /\.rego$/.test(lower) ? 'rego' : /\.(jsonnet|libsonnet)$/.test(lower) ? 'jsonnet' : /\.nix$/.test(lower) ? 'nix' : /\.zig$/.test(lower) ? 'zig' : /\.r$/.test(lower) ? 'rlang' : /\.elm$/.test(lower) ? 'elm' : /\.(hs|lhs)$/.test(lower) ? 'haskell' : /\.jl$/.test(lower) ? 'julia' : /\.nim$/.test(lower) ? 'nim' : /\.(ml|mli)$/.test(lower) ? 'ocaml' : /\.po$/.test(lower) ? 'po' : null) ?? (/\.java$/.test(lower) ? 'java' : /\.go$/.test(lower) ? 'go' : /\.(py|pyi)$/.test(lower) ? 'python' : /\.rs$/.test(lower) ? 'rust' : /\.(kt|kts)$/.test(lower) ? 'kotlin' : /\.(php|phtml)$/.test(lower) ? 'php' : null);
  const language = protocol?.language ?? specialized ?? (/\.(c|cc|cpp|cxx|h|hh|hpp|hxx)$/.test(lower) ? 'cpp' : lower.endsWith('.cs') ? 'csharp' : /\.(js|jsx|mjs|cjs|ts|tsx)$/.test(lower) ? 'javascript' : /\.(json|yaml|yml|toml|ini|xml|properties)$/.test(lower) ? 'configuration' : 'generic');
  const fileType = /^\.github\/workflows\/.+\.(yaml|yml)$/.test(lower) ? 'github-workflow' : /(?:^|\/)(package\.json|cargo\.toml|pom\.xml|build\.gradle|composer\.json)$/.test(lower) ? 'dependency-manifest' : undefined;
  const purpose = fileType ?? (/\.(ftl|ftlh|ftlx|hbs|mustache|jinja2|j2|pug|astro)$/.test(lower) ? 'template' : /\.(tf|hcl|tfvars|bicep|nix)$/.test(lower) ? 'infrastructure' : /\.(proto|thrift|capnp|graphql|gql|prisma)$/.test(lower) ? 'protocol-schema' : undefined);