@huicai/cli 2026.804.0 → 2026.1019.0

package/skills/code-quality/scripts/code_battery.py

@@ -0,0 +1,1072 @@
+# 代码体检引擎的压力测试台：反向造缺陷 + 反误报 + 正向跑批 + 修复闭环。
+#
+# 为什么反向是主角：
+#   一个只会说「未发现问题」的体检器和没有体检器是一回事，而且更糟——
+#   它给人一个虚假的「已检查」印象。所以每条规则都要配一个**故意做坏的样本**，
+#   断言那条规则真的会响；只要有一条规则从来没响过，这里就红。
+#
+# 为什么还要反误报：
+#   规则写紧一点很容易，代价是天天在合规代码上乱叫，然后人把整个工具关掉。
+#   所以另一半样本是**刻意写得很规矩的代码**，断言体检必修项为零。
+#
+# 用法：
+#   python code_battery.py              # 全部：反向 + 反误报 + 正向 300 份 + 修复闭环
+#   python code_battery.py 800          # 正向跑 800 份
+#   python code_battery.py --quick      # 只跑反向与反误报（秒级，改规则时用）
+#
+# 改了 code_lens / code_check / code_fix 任何一个，**必须重跑本文件**。
+
+import os
+import random
+import re
+import sys
+import tempfile
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+import code_check as C          # noqa: E402
+import code_lens as L           # noqa: E402
+
+
+# ══ 反向样本：每条规则一份「故意做坏的代码」 ═══════════════════════════════
+# 格式：规则名 -> (文件名, 源码)。文件名决定语言与「是不是测试文件」。
+DEFECTS = {
+    # ── 逻辑 ──
+    'logic.empty-catch': ('a.js', 'function f(x) {\n  try {\n    parse(x);\n  } catch (e) {}\n  return 1;\n}\n'),
+    'logic.empty-finally': ('a.js', 'function f() {\n  try { go(); } catch (e) { log(e); } finally {}\n}\n'),
+    'logic.bare-except': ('a.py', 'def f():\n    try:\n        go()\n    except:\n        handle()\n'),
+    'logic.constant-condition': ('a.js', 'function f(x) {\n  if (true) {\n    return x;\n  }\n  return 0;\n}\n'),
+    'logic.self-compare': ('a.js', 'function f(a, b) {\n  if (a === a) { return 1; }\n  return b;\n}\n'),
+    'logic.self-assign': ('a.js', 'function f(count) {\n  count = count;\n  return count;\n}\n'),
+    'logic.assign-in-condition': ('a.js', 'function f(x) {\n  if (x = 5) { return 1; }\n  return 0;\n}\n'),
+    'logic.loose-eq': ('a.js', 'function f(a, b) {\n  return a == b;\n}\n'),
+    'logic.mutable-default': ('a.py', 'def add(item, bucket=[]):\n    bucket.append(item)\n    return bucket\n'),
+    'logic.await-in-loop': (
+        'a.js',
+        'async function f(ids) {\n  const out = [];\n  for (const id of ids) {\n'
+        '    const r = await fetchOne(id);\n    out.push(r);\n  }\n  return out;\n}\n'),
+    'logic.java-string-eq': (
+        'A.java',
+        'public class A {\n  public boolean same(String name, String code) {\n'
+        '    return name == code;\n  }\n}\n'),
+    # 与字符串字面量比较是更常见的形态，而它一度完全漏报（规则跑在掩码视图上，字面量早被抹空）
+    'logic.java-string-eq@literal': (
+        'B.java',
+        'public class B {\n  public boolean active(Employee emp) {\n'
+        '    return emp.getStatus() == "ACTIVE";\n  }\n}\n'),
+    'logic.float-eq': ('a.js', 'function f(total) {\n  if (total === 0.3) { return 1; }\n  return 0;\n}\n'),
+    'logic.dead-code': (
+        'a.js',
+        'function f(x) {\n  return x;\n  log("never");\n}\n'),
+    # ── 注释 ──
+    'comment.param-mismatch': (
+        'a.js',
+        '/**\n * 取一行。\n * @param {string} userId 用户 id\n * @param {number} limit 条数\n */\n'
+        'export function fetchRow(id) {\n  return db.get(id);\n}\n'),
+    'comment.param-missing': (
+        'a.js',
+        '/**\n * 取一行。\n * @param {string} id 用户 id\n */\n'
+        'export function fetchRow(id, limit, offset) {\n  return db.get(id, limit, offset);\n}\n'),
+    'comment.return-mismatch': (
+        'a.js',
+        '/**\n * 算一下。\n * @returns {number} 结果\n */\n'
+        'export function calc(a, b) {\n  store(a + b);\n}\n'),
+    'comment.name-mismatch': (
+        'a.js',
+        'export function loadUser(id) {\n  return db.user(id);\n}\n\n'
+        '/**\n * loadUser: 按 id 取用户。\n */\nexport function loadOrder(id) {\n  return db.order(id);\n}\n'),
+    'comment.missing-doc': (
+        'a.js',
+        'export function processBatch(items, opts) {\n  let n = 0;\n  for (const it of items) {\n'
+        '    n += it.size;\n  }\n  const extra = opts.extra || 0;\n  const total = n + extra;\n'
+        '  return total;\n}\n'),
+    'comment.no-inline': (
+        'a.js',
+        '/** 汇总。 */\nexport function sum(rows) {\n' + '  let t = 0;\n' * 2
+        + ''.join(f'  t += rows[{i}].v;\n' for i in range(40)) + '  return t;\n}\n'),
+    'comment.commented-code': (
+        'a.js',
+        'function f(x) {\n  // const old = compute(x);\n  // if (old > 0) {\n  //   return old;\n'
+        '  // }\n  return x;\n}\n'),
+    'comment.echo': ('a.js', 'function f(user) {\n  // 设置 name\n  user.name = "x";\n  return user;\n}\n'),
+    'comment.todo-orphan': ('a.js', 'function f(x) {\n  // TODO 这里以后要支持批量\n  return x;\n}\n'),
+    # ── 可读性 ──
+    'readability.long-function': (
+        'a.js', 'function big(x) {\n' + ''.join(f'  const v{i} = x + {i};\n' for i in range(90)) + '  return x;\n}\n'),
+    'readability.deep-nesting': (
+        'a.js',
+        'function deep(a, b, c, d, e) {\n  if (a) {\n    if (b) {\n      if (c) {\n        if (d) {\n'
+        '          if (e) {\n            return 1;\n          }\n        }\n      }\n    }\n  }\n  return 0;\n}\n'),
+    'readability.high-complexity': (
+        'a.js',
+        'function branchy(x) {\n' + ''.join(f'  if (x === {i}) return {i};\n' for i in range(20)) + '  return -1;\n}\n'),
+    'readability.too-many-params': (
+        'a.js', 'export function many(a, b, c, d, e, f, g, h) {\n  return a + b + c + d + e + f + g + h;\n}\n'),
+    'readability.cryptic-param': (
+        'a.js',
+        '/** 处理。 */\nexport function handle(q) {\n' + ''.join(f'  const s{i} = q + {i};\n' for i in range(18))
+        + '  return q;\n}\n'),
+    'readability.long-file': ('a.js', ''.join(f'const v{i} = {i};\n' for i in range(1300))),
+    'readability.long-line': ('a.js', 'const x = "' + 'y' * 200 + '";\n'),
+    'readability.trailing-space': ('a.js', 'const x = 1;   \nconst y = 2;\n'),
+    'readability.magic-number': ('a.js', 'function f(n) {\n  return n * 86399;\n}\n'),
+    # ── 结构 ──
+    'structure.hardcoded-path': (
+        'src/a.js', 'function load() {\n  return read("/Users/alice/work/data/config.json");\n}\n'),
+    'structure.debug-left': ('src/a.js', 'function f(x) {\n  console.log("here", x);\n  return x;\n}\n'),
+    'structure.duplicate-block': (
+        'a.js',
+        'function one(rows) {\n  const acc = [];\n  for (const r of rows) {\n    acc.push(r.value * 2);\n'
+        '    acc.push(r.value + 1);\n    acc.push(r.label.trim());\n  }\n  return acc;\n}\n'
+        'function two(rows) {\n  const acc = [];\n  for (const r of rows) {\n    acc.push(r.value * 2);\n'
+        '    acc.push(r.value + 1);\n    acc.push(r.label.trim());\n  }\n  return acc;\n}\n'),
+    # ── 测试 ──
+    'test.only-left': (
+        'a.test.js', 'describe("x", () => {\n  it.only("works", () => {\n    expect(f(1)).toBe(2);\n  });\n});\n'),
+    'test.skip-no-reason': (
+        'a.test.js', 'describe("x", () => {\n  it.skip("works", () => {\n    expect(f(1)).toBe(2);\n  });\n});\n'),
+    'test.weak-assert': (
+        'a.test.js', 'describe("x", () => {\n  it("works", () => {\n    assert(true);\n  });\n});\n'),
+    'test.no-assert': (
+        'a_test.py', 'def test_user_created():\n    user = make_user("a")\n    save(user)\n    reload(user)\n'),
+    # JS 主流写法单独一条：it('…', () => {…}) 不是函数声明，走的是另一条检测路径。
+    # 少了这条，JS 测试文件里「没有断言的测试」永远不会被报出来。
+    'test.no-assert@js': (
+        'b.test.js', 'describe("订单", () => {\n  it("创建成功", () => {\n    create(1);\n  });\n});\n'),
+    'test.vague-name': (
+        'a_test.py', 'def test_1():\n    assert make_user("a").name == "a"\n'),
+    'test.uncovered': None,       # 跨文件规则，单独造（见 _defect_uncovered）
+    # ── 安全 ──
+    'security.hardcoded-secret': (
+        'a.js', 'const config = {\n  apiKey: "sk_live_9f2b7c41d8e6a05374bc",\n};\nexport default config;\n'),
+    'security.sql-concat': (
+        'a.js', 'function find(id) {\n  return db.query("SELECT * FROM users WHERE id = " + id);\n}\n'),
+    'security.command-injection': (
+        'a.js', 'function run(name) {\n  return execSync("git checkout " + name);\n}\n'),
+    'security.eval': ('a.js', 'function run(src) {\n  return eval(src);\n}\n'),
+    'security.weak-random': (
+        'a.js', 'function makeToken() {\n  const token = Math.random().toString(36);\n  return token;\n}\n'),
+    # ── 一致性 ──
+    'consistency.signature-drift': None,   # 跨文件规则（见 _defect_drift）
+}
+
+
+# ══ 反误报样本：刻意写得很规矩的代码，必修项必须为零 ═══════════════════════
+CLEAN = {
+    'clean.js': '''/**
+ * 用户仓储：把「按 id 取用户」这件事收在一处，调用方不必关心缓存与降级。
+ * @param {string} id 用户 id（非空）
+ * @param {object} [opts] 可选项
+ * @returns {Promise<object|null>} 用户对象；不存在时返回 null
+ */
+export async function fetchUser(id, opts = {}) {
+  if (!id) return null;
+  try {
+    // 先走缓存：用户资料读多写少，回源一次的代价远高于一次缓存未命中
+    const hit = await cache.get(id);
+    if (hit != null) return hit;
+    const row = await db.query('SELECT * FROM users WHERE id = ?', [id]);
+    return row || null;
+  } catch (err) {
+    logger.warn('取用户失败，降级为 null', { id, err });
+    return null;
+  }
+}
+''',
+    # 解构参数 + JSDoc `@param {object} p` / `@param p.field` —— 这是最规范的那种写法，
+    # 曾经被 param-mismatch 整份判成「写了不存在的形参」。固化在这里防回归。
+    'clean-destructure.js': '''/**
+ * 跑一条验证命令，失败就让智能体修，直到通过或到上限。
+ *
+ * @param {object} p
+ * @param {string} p.command 验证命令
+ * @param {number} [p.maxIters] 最多修复轮数（默认 5）
+ * @param {string} p.cwd 工作目录
+ * @returns {Promise<{passed:boolean}>} 是否通过
+ */
+export async function runVerifyLoop({ command, maxIters = 5, cwd }) {
+  for (let i = 0; i < maxIters; i += 1) {
+    // 每轮都重新跑一次：上一轮的修复可能带出新的失败，用旧结果判断会漏
+    const result = await capture(cwd, command);
+    if (result.code === 0) return { passed: true };
+  }
+  return { passed: false };
+}
+''',
+    'clean.py': '''"""结算：把金额一律按「分」的整数处理，避免浮点误差进账。"""
+
+DEFAULT_RATE = 100
+
+
+def settle(orders, rate=None):
+    """按费率汇总订单金额。
+
+    :param orders: 订单列表，每项需有 amount_cents 字段
+    :param rate: 费率（万分比整数），不传则用默认值
+    :return: 结算金额（分）
+    """
+    if not orders:
+        return 0
+    factor = rate if rate is not None else DEFAULT_RATE
+    total = 0
+    for order in orders:
+        total += order.amount_cents * factor
+    return total // 10000
+''',
+    'Clean.java': '''package com.example;
+
+import java.util.Objects;
+
+/** 订单服务：只负责编排，具体持久化交给仓储。 */
+public class OrderService {
+
+    private final OrderRepo repo;
+
+    public OrderService(OrderRepo repo) {
+        this.repo = repo;
+    }
+
+    /**
+     * 按编号查订单。
+     *
+     * @param orderNo 订单号
+     * @return 订单；不存在时返回 null
+     */
+    public Order findByNo(String orderNo) {
+        if (Objects.equals(orderNo, null)) {
+            return null;
+        }
+        try {
+            return repo.selectByNo(orderNo);
+        } catch (DataAccessException ex) {
+            log.warn("查订单失败 orderNo={}", orderNo, ex);
+            return null;
+        }
+    }
+}
+''',
+    'clean.test.js': '''import { fetchUser } from './clean.js';
+
+describe('fetchUser', () => {
+  it('空 id 直接返回 null，不打库', async () => {
+    const result = await fetchUser('');
+    expect(result).toBe(null);
+  });
+
+  it('命中缓存时不回源', async () => {
+    cache.set('u1', { id: 'u1' });
+    const result = await fetchUser('u1');
+    expect(result.id).toBe('u1');
+  });
+});
+''',
+}
+
+
+# ══ Java 反向样本 ═══════════════════════════════════════════════════════════
+# Java 的坑几乎全是「编译通过、运行不报错、出事时离现场很远」那一类，
+# 所以每一条都必须有自己的缺陷样本——靠人肉复核"这条规则应该能响吧"，
+# 迟早会有某条正则写错了却没人发现，而报告照样显示「已体检」。
+def _j(body, cls='Bad', head=''):
+    """包一个最小可解析的 Java 类。"""
+    return f'package com.x;\n{head}\npublic class {cls} {{\n{body}\n}}\n'
+
+
+JAVA_DEFECTS = {
+    'logic.java-print-stack-trace': (
+        'P.java', _j('    public void a() {\n        try { go(); } catch (Exception e) { e.printStackTrace(); }\n    }')),
+    'logic.java-catch-throwable': (
+        'P.java', _j('    public void a() {\n        try { go(); } catch (Throwable t) { log.error("x", t); }\n    }')),
+    'logic.java-broad-catch': (
+        'P.java', _j('    public void a() {\n        try {\n'
+                     + '            step();\n' * 28
+                     + '        } catch (Exception e) { log.error("failed", e); }\n    }')),
+    'logic.java-bigdecimal-double': (
+        'P.java', _j('    public void a(double d) {\n        BigDecimal x = new BigDecimal(d);\n    }')),
+    'logic.java-bigdecimal-equals': (
+        'P.java', _j('    public boolean a(BigDecimal amount, BigDecimal price) {\n'
+                     '        return amount.equals(price);\n    }')),
+    'logic.java-unboxing-eq': (
+        'P.java', _j('    private Integer userId;\n    private Integer otherId;\n'
+                     '    public boolean a() {\n        return userId == otherId;\n    }')),
+    'logic.java-shared-dateformat': (
+        'P.java', _j('    private static SimpleDateFormat FMT = new SimpleDateFormat("yyyy");')),
+    'logic.java-resource-leak': (
+        'P.java', _j('    public void a() throws Exception {\n'
+                     '        java.io.FileInputStream in = new java.io.FileInputStream("/tmp/x");\n'
+                     '        in.read();\n    }')),
+    'logic.java-aslist-modify': (
+        'P.java', _j('    public void a() {\n        List<String> xs = Arrays.asList("a", "b");\n'
+                     '        xs.add("c");\n    }')),
+    'logic.java-concurrent-modify': (
+        'P.java', _j('    public void a(List<String> items) {\n        for (String s : items) {\n'
+                     '            if (s.isEmpty()) { items.remove(s); }\n        }\n    }')),
+    'logic.java-concat-in-loop': (
+        'P.java', _j('    public String a(List<String> xs) {\n        String out = "";\n'
+                     '        for (String x : xs) {\n            out += x;\n        }\n        return out;\n    }')),
+    'logic.java-int-division': (
+        'P.java', _j('    public double a(int hit, int total) {\n        double rate = hit / total;\n'
+                     '        return rate;\n    }')),
+    'logic.java-switch-no-default': (
+        'P.java', _j('    public void a(int t) {\n        switch (t) {\n'
+                     '            case 1: go(); break;\n            case 2: go(); break;\n        }\n    }')),
+    'logic.java-optional-get': (
+        'P.java', _j('    public String a(Optional<String> o) {\n        return o.get();\n    }')),
+    'logic.java-finally-return': (
+        'P.java', _j('    public int a() {\n        try { return 1; } finally { return 2; }\n    }')),
+    'logic.java-equals-no-hashcode': (
+        'P.java', _j('    @Override\n    public boolean equals(Object o) { return this == o; }')),
+    # ── Spring / 持久层 ──
+    'framework.tx-not-effective': (
+        'S.java', _j('    @Transactional\n    private void save(Order o) {\n        mapper.insert(o);\n    }',
+                     cls='S', head='@Service')),
+    'framework.tx-no-rollback-for': (
+        'S.java', _j('    @Transactional\n    public void save(Order o) throws BizException {\n'
+                     '        mapper.insert(o);\n    }', cls='S', head='@Service')),
+    'framework.tx-swallow': (
+        'S.java', _j('    @Transactional\n    public void save(Order o) {\n        try {\n'
+                     '            mapper.insert(o);\n'
+                     '        } catch (DataAccessException e) {\n            log.error("写入失败", e);\n        }\n    }',
+                     cls='S', head='@Service')),
+    'framework.self-invocation': (
+        'S.java', _j('    @Async\n    public void record(String x) { }\n\n'
+                     '    public void success(String x) {\n        record(x);\n    }',
+                     cls='S', head='@Service')),
+    'framework.field-injection': (
+        'S.java', _j('    @Autowired\n    private OrderMapper mapper;', cls='S', head='@Service')),
+    'framework.value-no-default': (
+        'S.java', _j('    @Value("${order.timeout}")\n    private int timeout;', cls='S', head='@Service')),
+    'framework.singleton-mutable-state': (
+        'S.java', _j('    private List<String> cache = new ArrayList<>();', cls='S', head='@Service')),
+    'framework.mapping-no-method': (
+        'S.java', _j('    @RequestMapping("/save")\n    public Result save(Order o) {\n'
+                     '        return Result.ok();\n    }', cls='S', head='@RestController')),
+    'framework.mybatis-dollar': (
+        'M.java', _j('    @Select("SELECT * FROM orders WHERE status = ${status}")\n'
+                     '    List<Order> byStatus(String status);', cls='M', head='@Mapper')),
+    # ── dev-java「事务失效八景 / 常见坑 TOP」对应的机器规则 ──
+    'framework.tx-new-thread': (
+        'S.java', _j('    @Transactional\n    public void save(Order o) {\n        mapper.insert(o);\n'
+                     '        new Thread(() -> notifyUser(o)).start();\n    }', cls='S', head='@Service')),
+    'logic.java-threadlocal-leak': (
+        'P.java', _j('    private static final ThreadLocal<String> CTX = new ThreadLocal<>();\n\n'
+                     '    public void handle(String tid) {\n        CTX.set(tid);\n        doWork();\n    }')),
+    'logic.java-executors-factory': (
+        'P.java', _j('    private ExecutorService pool = Executors.newFixedThreadPool(10);')),
+    'logic.java-week-year': (
+        'P.java', _j('    public String fmt(Date d) {\n'
+                     '        return new SimpleDateFormat("YYYY-MM-dd").format(d);\n    }')),
+    # ── Javadoc / JUnit ──
+    'comment.javadoc-throws': (
+        'P.java', _j('    /**\n     * 保存。\n     * @throws BizException 业务异常\n     */\n'
+                     '    public void save(Order o) {\n        mapper.insert(o);\n    }')),
+    'test.junit-assert-order': (
+        'PTest.java', _j('    @Test\n    public void a() {\n'
+                         '        assertEquals(service.compute(1), 42);\n    }', cls='PTest')),
+    'test.junit-try-fail': (
+        'PTest.java', _j('    @Test\n    public void a() {\n        try {\n            service.run(null);\n'
+                         '            fail("应该抛异常");\n        } catch (IllegalArgumentException e) {\n'
+                         '            assertNotNull(e.getMessage());\n        }\n    }', cls='PTest')),
+}
+DEFECTS.update(JAVA_DEFECTS)
+
+# ── Java 反误报样本：规矩写的 Spring 代码，必修必须为零 ──
+CLEAN['CleanSpring.java'] = '''package com.example.order;
+
+import java.math.BigDecimal;
+import java.time.format.DateTimeFormatter;
+import java.util.Objects;
+import java.util.Optional;
+
+/** 订单服务：只做编排，持久化交给仓储。 */
+@Service
+@RequiredArgsConstructor
+public class OrderService {
+
+    private static final DateTimeFormatter FMT = DateTimeFormatter.ofPattern("yyyy-MM-dd");
+
+    private final OrderRepository repository;
+
+    /**
+     * 按订单号结算。
+     *
+     * @param orderNo 订单号，不可为空
+     * @param rate    费率（万分比）
+     * @return 结算金额；订单不存在时返回 null
+     */
+    @Transactional(rollbackFor = Exception.class)
+    public BigDecimal settle(String orderNo, int rate) {
+        if (Objects.equals(orderNo, null)) {
+            return null;
+        }
+        Optional<Order> found = repository.findByNo(orderNo);
+        if (found.isEmpty()) {
+            // 订单不存在是正常业务分支，不记 error 免得把告警刷满
+            return null;
+        }
+        Order order = found.get();
+        BigDecimal amount = BigDecimal.valueOf(order.getAmountCents())
+                .multiply(BigDecimal.valueOf(rate))
+                .movePointLeft(4);
+        repository.markSettled(order.getId(), amount);
+        return amount;
+    }
+}
+'''
+
+
+# ══ Python 反向样本 ═══════════════════════════════════════════════════════════
+# Python 的坑分两种：一种是「语言层面反直觉」（共享可变类属性、闭包延迟绑定、
+# except 顺序），另一种是「数据处理静默出错」（读表丢前导零、链式赋值改到副本）。
+# 后一种最危险——程序跑完了、没有任何报错、结果是错的。
+PY_DEFECTS = {
+    'logic.py-mutable-class-attr': (
+        'a.py', 'class Config:\n    items = []\n'),
+    'logic.py-dataclass-mutable': (
+        'a.py', 'from dataclasses import dataclass\n\n\n@dataclass\nclass Row:\n    tags: list = []\n'),
+    'logic.py-late-binding': (
+        'a.py', 'def build():\n    fns = []\n    for i in range(3):\n'
+                '        fns.append(lambda: i)\n    return fns\n'),
+    # 元组解包的循环变量一度漏报，而 `for idx, row in df.iterrows()` 正是 pandas 场景的标配写法
+    'logic.py-late-binding@unpack': (
+        'a.py', 'def build(df):\n    fns = []\n    for idx, row in df.iterrows():\n'
+                '        fns.append(lambda: row["金额"])\n    return fns\n'),
+    'logic.py-except-order': (
+        'a.py', 'def f(x):\n    try:\n        return int(x)\n'
+                '    except Exception:\n        return 0\n    except ValueError:\n        return -1\n'),
+    'logic.py-mutate-during-iteration': (
+        'a.py', 'def prune(items):\n    for x in items:\n        if not x:\n'
+                '            items.remove(x)\n    return items\n'),
+    'logic.py-is-literal': (
+        'a.py', 'def f(v):\n    if v is 200:\n        return True\n    return False\n'),
+    'logic.py-eq-singleton': (
+        'a.py', 'def f(v):\n    if v == None:\n        return True\n    return False\n'),
+    'logic.py-raise-without-from': (
+        'a.py', 'def f(s):\n    try:\n        return int(s)\n'
+                '    except ValueError:\n        raise RuntimeError("解析失败")\n'),
+    'logic.py-shadow-builtin': (
+        'a.py', 'def f():\n    list = [1, 2]\n    return list\n'),
+    'logic.py-assert-in-production': (
+        'a.py', 'def charge(amount):\n    assert amount > 0, "金额必须为正"\n    return amount\n'),
+    'logic.py-type-compare': (
+        'a.py', 'def f(v):\n    if type(v) == str:\n        return v\n    return ""\n'),
+    'logic.py-blocking-in-async': (
+        'a.py', 'import time\n\n\nasync def fetch(url):\n    time.sleep(1)\n    return url\n'),
+    'logic.py-open-without-with': (
+        'a.py', 'def read(path):\n    f = open(path)\n    return f.read()\n'),
+    'logic.py-logging-fstring': (
+        'a.py', 'def run(log, n):\n    log.info(f"处理了 {n} 条")\n'),
+    'logic.py-return-in-finally': (
+        'a.py', 'def f(x):\n    try:\n        return int(x)\n    finally:\n        return 0\n'),
+    'logic.empty-catch-narrow': (
+        'a.py', 'def f(d):\n    try:\n        return d["k"]\n    except KeyError:\n        pass\n'),
+    # ── pandas：事故不改外观、只改数字 ──
+    'framework.py-pandas-chained-assign': (
+        'a.py', 'import pandas as pd\n\n\ndef fix(df):\n    df["单号"]["行"] = 1\n    return df\n'),
+    'framework.py-read-no-dtype': (
+        'a.py', 'import pandas as pd\n\n\ndef load(path):\n    return pd.read_excel(path)\n'),
+    'framework.py-pandas-append': (
+        'a.py', 'import pandas as pd\n\n\ndef add(df, row):\n'
+                '    return df.append(row, ignore_index=True)\n'),
+    'framework.py-pandas-iterrows': (
+        'a.py', 'import pandas as pd\n\n\ndef walk(df):\n    for idx, row in df.iterrows():\n'
+                '        print(row)\n'),
+    'framework.py-pandas-inplace': (
+        'a.py', 'import pandas as pd\n\n\ndef clean(df):\n    df.fillna(0, inplace=True)\n    return df\n'),
+    # ── dev-python「常见坑 TOP」对应的机器规则 ──
+    'logic.py-open-no-encoding': (
+        'a.py', 'def read(path):\n    return open(path).read()\n'),
+    'logic.py-naive-datetime': (
+        'a.py', 'from datetime import datetime\n\n\ndef stamp():\n    return datetime.now()\n'),
+    'logic.py-decimal-float': (
+        'a.py', 'from decimal import Decimal\n\n\ndef price():\n    return Decimal(0.1)\n'),
+    'logic.py-join-absolute': (
+        'a.py', 'import os\n\n\ndef full(base):\n    return os.path.join(base, "/etc/passwd")\n'),
+    # ── 安全 ──
+    'security.py-subprocess-shell': (
+        'a.py', 'import subprocess\n\n\ndef run(name):\n'
+                '    return subprocess.run("git checkout " + name, shell=True)\n'),
+    'security.py-yaml-load': (
+        'a.py', 'import yaml\n\n\ndef load(text):\n    return yaml.load(text)\n'),
+    'security.py-pickle': (
+        'a.py', 'import pickle\n\n\ndef load(raw):\n    return pickle.loads(raw)\n'),
+}
+DEFECTS.update(PY_DEFECTS)
+
+# ── Python 反误报样本：规矩写的数据处理脚本，必修必须为零 ──
+CLEAN['clean_pandas.py'] = '''"""对账：把两张表按单号对齐，找出金额对不上的行。"""
+
+import logging
+
+import pandas as pd
+
+logger = logging.getLogger(__name__)
+
+# 单号一律按文本读：它带前导零，一旦被推断成数字就再也补不回来
+ID_DTYPE = {"单号": str, "客户编号": str}
+
+
+def reconcile(left_path, right_path):
+    """比对两张表的金额。
+
+    :param left_path: 左表路径（业务系统导出）
+    :param right_path: 右表路径（财务系统导出）
+    :return: 金额不一致的行；两边都为空时返回空表
+    """
+    left = pd.read_excel(left_path, dtype=ID_DTYPE)
+    right = pd.read_excel(right_path, dtype=ID_DTYPE)
+    if left.empty or right.empty:
+        logger.info("有一边是空表，跳过对账 left=%s right=%s", len(left), len(right))
+        return pd.DataFrame()
+
+    merged = left.merge(right, on="单号", how="outer", suffixes=("_业务", "_财务"))
+    # 金额按分比较：浮点直接相减会在小数位上抖出假差异
+    diff = (merged["金额_业务"].fillna(0) * 100).round() != (merged["金额_财务"].fillna(0) * 100).round()
+    return merged.loc[diff]
+'''
+
+
+# ══ JS / TS / Vue 反向样本 ═══════════════════════════════════════════════════
+# JS 这一侧只有「掩码 + 括号配对」，没有真 AST，所以每条规则的判据都是刻意收窄过的
+# ——越是收窄，越要有样本盯着它「还响不响」。
+JSTS_DEFECTS = {
+    'logic.js-async-in-array-method': (
+        'a.js', 'export async function run(items) {\n'
+                '  items.forEach(async (x) => { await save(x); });\n}\n'),
+    'logic.js-optional-chain-broken': (
+        'a.js', 'export function f(cfg) {\n  return cfg?.user.name;\n}\n'),
+    'logic.js-nan-compare': (
+        'a.js', 'export function f(n) {\n  if (n === NaN) { return 0; }\n  return n;\n}\n'),
+    'logic.js-for-in-array': (
+        'a.js', 'export function f() {\n  const list = [1, 2, 3];\n'
+                '  for (const i in list) { console.log(i); }\n}\n'),
+    'logic.js-sort-no-comparator': (
+        'a.js', 'export function f() {\n  const ids = [10, 9, 100];\n  ids.sort();\n  return ids;\n}\n'),
+    'logic.js-delete-array-index': (
+        'a.js', 'export function f(rows) {\n  delete rows[0];\n  return rows;\n}\n'),
+    'logic.js-parseint-radix': (
+        'a.js', 'export function f(s) {\n  return parseInt(s);\n}\n'),
+    'logic.js-json-parse-unguarded': (
+        'a.js', 'export function f(raw) {\n  return JSON.parse(raw);\n}\n'),
+    # ── TypeScript 类型逃逸 ──
+    'logic.ts-as-any': (
+        'a.ts', 'export function f(raw: string) {\n  return (raw as any).parse();\n}\n'),
+    'logic.ts-ignore-no-reason': (
+        'a.ts', 'export function f(raw: string) {\n  // @ts-ignore\n  return raw.parse();\n}\n'),
+    'logic.ts-any-return': (
+        'a.ts', 'export function load(raw: string): any {\n  return raw;\n}\n'),
+    # ── Vue 3：一半的问题在 <template> 里 ──
+    'framework.vue-vfor-no-key': (
+        'A.vue', '<script setup>\nconst items = []\n</script>\n\n'
+                 '<template>\n  <li v-for="item in items">{{ item.name }}</li>\n</template>\n'),
+    'framework.vue-key-is-index': (
+        'A.vue', '<script setup>\nconst rows = []\n</script>\n\n'
+                 '<template>\n  <li v-for="(row, index) in rows" :key="index">{{ row.t }}</li>\n</template>\n'),
+    'framework.vue-vif-with-vfor': (
+        'A.vue', '<script setup>\nconst rows = []\n</script>\n\n'
+                 '<template>\n  <li v-for="row in rows" :key="row.id" v-if="row.ok">{{ row.t }}</li>\n</template>\n'),
+    'framework.vue-v-html': (
+        'A.vue', '<script setup>\nconst html = ""\n</script>\n\n'
+                 '<template>\n  <div v-html="html" />\n</template>\n'),
+    'framework.vue-mutate-props': (
+        'A.vue', '<script setup>\nconst props = defineProps({ title: String })\n'
+                 'function rename() {\n  props.title = "x"\n}\n</script>\n\n'
+                 '<template>\n  <div @click="rename">{{ props.title }}</div>\n</template>\n'),
+    'framework.vue-reactive-destructure': (
+        'A.vue', '<script setup>\nimport { reactive } from "vue"\n'
+                 'const state = reactive({ count: 0 })\nconst { count } = state\n</script>\n\n'
+                 '<template>\n  <div>{{ count }}</div>\n</template>\n'),
+}
+DEFECTS.update(JSTS_DEFECTS)
+
+# ── 反误报：规矩写的 Vue 3 + TS 组件，必修必须为零 ──
+CLEAN['CleanList.vue'] = '''<script setup lang="ts">
+import { computed, ref, toRefs } from 'vue'
+
+interface Row {
+  id: string
+  name: string
+  amountCents: number
+}
+
+const props = defineProps<{ rows: Row[]; keyword: string }>()
+const emit = defineEmits<{ (e: 'select', id: string): void }>()
+
+const { rows } = toRefs(props)
+const pageSize = ref(20)
+
+// 过滤放在 computed 里而不是模板上：模板里写 v-if 会在每次渲染时重算一遍
+const visible = computed(() => rows.value.filter((r) => r.name.includes(props.keyword)))
+
+function pick(id: string): void {
+  emit('select', id)
+}
+</script>
+
+<template>
+  <ul class="rows">
+    <li v-for="row in visible" :key="row.id" @click="pick(row.id)">
+      {{ row.name }} — {{ (row.amountCents / 100).toFixed(2) }}
+    </li>
+  </ul>
+</template>
+'''
+
+
+# ══ C# 反向样本 ═══════════════════════════════════════════════════════════════
+# C# 的坑与 Java 同属「编译通过、运行不报错、出事时离现场很远」那一类，
+# 但有几个是它独有的，而且都属于**写错了反而更像对的**：
+#   `async void` 比 `async Task` 短，异常却无人能接；
+#   `.Result` 比 `await` 直观，在 Web 环境必然死锁；
+#   `throw ex;` 比 `throw;` 更像在做事，堆栈却被重置。
+CS_DEFECTS = {
+    'logic.cs-async-void': (
+        'A.cs', 'public class A {\n    public async void Handle(long id) {\n'
+                '        await Save(id);\n    }\n}\n'),
+    'logic.cs-async-no-await': (
+        'A.cs', 'public class A {\n    public async Task<int> Get() {\n        return 1;\n    }\n}\n'),
+    'logic.cs-blocking-async': (
+        'A.cs', 'public class A {\n    public Order Get(long id) {\n'
+                '        return _repo.GetAsync(id).Result;\n    }\n}\n'),
+    'logic.cs-throw-ex': (
+        'A.cs', 'public class A {\n    public void Run(long id) {\n        try {\n'
+                '            Work(id);\n        } catch (Exception ex) {\n'
+                '            Log(ex);\n            throw ex;\n        }\n    }\n}\n'),
+    'logic.cs-lock-public': (
+        'A.cs', 'public class A {\n    public void Sync() {\n        lock (this) {\n'
+                '            Work();\n        }\n    }\n}\n'),
+    'logic.cs-datetime-now': (
+        'A.cs', 'public class A {\n    public DateTime Stamp() {\n        return DateTime.Now;\n    }\n}\n'),
+    'logic.cs-static-random': (
+        'A.cs', 'public class A {\n    private static Random _rng = new Random();\n}\n'),
+    'logic.cs-double-for-money': (
+        'A.cs', 'public class A {\n    private double totalAmount;\n}\n'),
+    'logic.cs-query-in-loop': (
+        'A.cs', 'public class A {\n    public void Load(List<long> ids) {\n'
+                '        foreach (var id in ids) {\n'
+                '            var row = _db.Orders.FirstOrDefault(x => x.Id == id);\n'
+                '            Use(row);\n        }\n    }\n}\n'),
+    'logic.cs-string-concat-loop': (
+        'A.cs', 'public class A {\n    public string Join(List<string> parts) {\n'
+                '        string result = "";\n        foreach (var p in parts) {\n'
+                '            result += p;\n        }\n        return result;\n    }\n}\n'),
+    'logic.cs-linq-multiple-enumeration': (
+        'A.cs', 'public class A {\n    public void Go(List<long> ids) {\n'
+                '        var q = ids.Where(x => x > 0);\n        var n = q.Count();\n'
+                '        var f = q.FirstOrDefault();\n        Use(n, f);\n    }\n}\n'),
+    'logic.cs-count-vs-any': (
+        'A.cs', 'public class A {\n    public bool Has(List<long> ids) {\n'
+                '        return ids.Count() > 0;\n    }\n}\n'),
+    'logic.cs-disposable-no-using': (
+        'A.cs', 'public class A {\n    public void Read(string path) {\n'
+                '        var fs = new FileStream(path, FileMode.Open);\n        fs.ReadByte();\n    }\n}\n'),
+    'logic.cs-sql-raw-concat': (
+        'A.cs', 'public class A {\n    public void Find(string name) {\n'
+                '        _db.Orders.FromSqlRaw($"SELECT * FROM Orders WHERE Name = \'{name}\'");\n    }\n}\n'),
+    'logic.cs-di-wrong-lifetime': (
+        'A.cs', 'public class Startup {\n    public void Configure(IServiceCollection services) {\n'
+                '        services.AddSingleton<AppDbContext>();\n    }\n}\n'),
+    'logic.cs-parse-no-culture': (
+        'A.cs', 'public class A {\n    public decimal P(string s) {\n        return decimal.Parse(s);\n    }\n}\n'),
+    # ── dev-csharp「常见坑 TOP」对应的机器规则 ──
+    'logic.cs-new-httpclient': (
+        'A.cs', 'public class A {\n    private HttpClient _c = new HttpClient();\n}\n'),
+    'logic.cs-case-compare': (
+        'A.cs', 'public class A {\n    public bool Same(string a, string b) {\n'
+                '        return a.ToLower() == b.ToLower();\n    }\n}\n'),
+    'logic.cs-event-no-unsubscribe': (
+        'A.cs', 'public class A {\n    public void Init(Timer timer) {\n'
+                '        timer.Elapsed += OnTick;\n    }\n'
+                '    private void OnTick(object s, EventArgs e) { }\n}\n'),
+    'test.cs-async-void-test': (
+        'ATests.cs', 'public class ATests {\n    [Fact]\n    public async void Works() {\n'
+                     '        Assert.Equal(1, await GetAsync());\n    }\n}\n'),
+}
+DEFECTS.update(CS_DEFECTS)
+
+# ── C# 反误报样本 ──
+# 本仓库没有 C# 代码，这一组的误报率没法像前四轮那样在真实项目上治。
+# 补偿办法是把**真实项目里最常见、又最容易被误伤的正确写法**都写进来：
+# 物化之后再多次使用的 LINQ、用于真实计数的 Count()、using 声明、UtcNow、decimal 算钱、
+# `throw;` 原样重抛、私有锁对象、async Task 事件处理。这些正是误报的高风险区。
+CLEAN['CleanService.cs'] = '''using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Threading.Tasks;
+
+namespace Demo.Orders
+{
+    /// <summary>订单结算：只做编排，持久化交给仓储。</summary>
+    public sealed class SettlementService
+    {
+        private readonly IOrderRepository _repository;
+        private readonly object _gate = new object();
+
+        public SettlementService(IOrderRepository repository)
+        {
+            _repository = repository;
+        }
+
+        /// <summary>按订单号结算，返回金额；订单不存在时返回 null。</summary>
+        public async Task<decimal?> SettleAsync(string orderNo, decimal rate)
+        {
+            if (string.IsNullOrWhiteSpace(orderNo))
+            {
+                return null;
+            }
+
+            var order = await _repository.FindByNoAsync(orderNo).ConfigureAwait(false);
+            if (order is null)
+            {
+                return null;
+            }
+
+            // 先物化，后面要用两次——延迟查询被枚举两次会重复执行
+            var lines = order.Lines.Where(x => x.Enabled).ToList();
+            var lineCount = lines.Count;
+            var amount = lines.Sum(x => x.AmountCents) * rate / 10000m;
+
+            lock (_gate)
+            {
+                _lastSettledAt = DateTime.UtcNow;
+            }
+
+            await _repository.MarkSettledAsync(order.Id, amount, lineCount).ConfigureAwait(false);
+            return amount;
+        }
+
+        /// <summary>导出对账明细。</summary>
+        public async Task ExportAsync(string path, IReadOnlyList<Order> orders)
+        {
+            using var writer = new StreamWriter(path);
+            foreach (var order in orders)
+            {
+                var amount = order.AmountCents / 100m;
+                await writer.WriteLineAsync(
+                    $"{order.No},{amount.ToString("F2", CultureInfo.InvariantCulture)}")
+                    .ConfigureAwait(false);
+            }
+        }
+
+        /// <summary>重试包装：原样重抛，不破坏堆栈。</summary>
+        public async Task<T> WithRetryAsync<T>(Func<Task<T>> action, int times)
+        {
+            for (var i = 0; i < times; i++)
+            {
+                try
+                {
+                    return await action().ConfigureAwait(false);
+                }
+                catch (TimeoutException ex) when (i < times - 1)
+                {
+                    _log.Warn("第 {0} 次超时，准备重试", i + 1, ex);
+                    continue;
+                }
+            }
+
+            throw new InvalidOperationException("重试次数已用尽");
+        }
+
+        private DateTime _lastSettledAt;
+        private readonly ILogger _log;
+    }
+}
+'''
+
+
+def _write(dirpath, name, text):
+    p = os.path.join(dirpath, name)
+    os.makedirs(os.path.dirname(p), exist_ok=True)
+    with open(p, 'w', encoding='utf-8') as f:
+        f.write(text)
+    return p
+
+
+def _rules_hit(paths, **opts):
+    issues, _, _ = C.check_files(paths, **opts)
+    return {i.rule for i in issues}, issues
+
+
+def _defect_uncovered(tmp):
+    """跨文件：有测试文件，但某个公共函数在测试里从没出现过。"""
+    a = _write(tmp, 'svc.js',
+               '/** 结算。 */\nexport function settleInvoice(rows, rate) {\n  let total = 0;\n'
+               '  for (const row of rows) {\n    if (!row) continue;\n'
+               '    total += row.value * rate;\n  }\n  return total;\n}\n')
+    b = _write(tmp, 'other.test.js',
+               "import { somethingElse } from './other.js';\n"
+               "it('works', () => { expect(somethingElse(1)).toBe(1); });\n")
+    return [a, b]
+
+
+def _defect_drift(tmp):
+    """跨文件：同名公共函数在两处参数个数不一致。"""
+    a = _write(tmp, 'x1.js', '/** 建单。 */\nexport function buildOrder(a, b) {\n  return a + b;\n}\n')
+    b = _write(tmp, 'x2.js', '/** 建单。 */\nexport function buildOrder(a, b, c) {\n  return a + b + c;\n}\n')
+    return [a, b]
+
+
+SPECIAL = {'test.uncovered': _defect_uncovered, 'consistency.signature-drift': _defect_drift}
+
+
+def declared_rules():
+    """所有已声明的规则名——直接复用 code_check.list_rules()，不自己再实现一遍。
+
+    用来断言**每条规则都配了反向样本**：新加一条规则却忘了配样本时，
+    那条规则从此没有任何保护，而压测台照样全绿。
+    """
+    return {rule for rules in C.list_rules().values() for rule, _level in rules}
+
+
+def run_reverse():
+    """反向：每条规则的缺陷样本都必须让那条规则响，且每条规则都要有样本。"""
+    missed, ok = [], 0
+    with tempfile.TemporaryDirectory() as tmp:
+        for rule, sample in DEFECTS.items():
+            sub = os.path.join(tmp, rule.replace('.', '_').replace('@', '_at_'))
+            os.makedirs(sub, exist_ok=True)
+            if sample is None:
+                paths = SPECIAL[rule](sub)
+            else:
+                name, src = sample
+                paths = [_write(sub, name, src)]
+            hit, issues = _rules_hit(paths)
+            if rule.split('@')[0] in hit:
+                ok += 1
+            else:
+                missed.append((rule, sorted(hit)))
+    return ok, missed
+
+
+def run_clean():
+    """反误报：规矩写的代码必修项必须为零。"""
+    with tempfile.TemporaryDirectory() as tmp:
+        paths = [_write(tmp, n, s) for n, s in CLEAN.items()]
+        issues, _, stats = C.check_files(paths)
+        errs = [i for i in issues if i.level == 'error']
+        degraded = stats['degraded']
+    return errs, degraded, issues
+
+
+# ══ URL 不是本机路径：hardcoded-path 是「建议」级，反误报样本只数必修管不到它，单独守 ══
+URL_GUARD = {
+    # 文件名: (源码, 该不该报 hardcoded-path)
+    'urls.js': ('export const NS = "http://www.w3.org/2000/svg";\n'
+                'export const API = "https://api.example.com/home/data";\n'
+                'export const ICON = "data:image/svg+xml,%3Csvg xmlns=\'http://www.w3.org/2000/svg\'%3E%3C/svg%3E";\n'
+                'export const CDN = "https://registry.npmmirror.com/tmp/pkg";\n', False),
+    'winpath.js': ('export function load() {\n  return read("C:\\\\Users\\\\bob\\\\data\\\\cfg.json");\n}\n', True),
+    'fileurl.js': ('export const P = "file:///Users/alice/work/data.json";\n', True),
+}
+
+
+def run_url_guard():
+    """URL 与命名空间不许被当成本机路径；真正的本机路径（含 file:// 里的）照样要报。"""
+    bad = []
+    with tempfile.TemporaryDirectory() as tmp:
+        for name, (src, should) in URL_GUARD.items():
+            p = _write(tmp, 'src/' + name, src)
+            issues, _, _ = C.check_files([p])
+            hit = any(i.rule == 'structure.hardcoded-path' for i in issues)
+            if hit != should:
+                bad.append((name, '漏报了真正的本机路径' if should else '把 URL 当成了本机路径'))
+    return bad
+
+
+# ══ 正向跑批：随机代码不许把引擎跑崩 ═══════════════════════════════════════
+_NAMES = ['load', 'save', 'build', 'parse', 'render', 'sync', 'merge', 'flush', 'emit', 'wrap']
+_TEMPLATES = [
+    'function {n}{i}({a}) {{\n  if ({a}) {{ return {a} * {k}; }}\n  return null;\n}}\n',
+    'const {n}{i} = ({a}) => {a} + {k};\n',
+    'class C{i} {{\n  /** 做点事。 */\n  {n}({a}) {{ return {a}; }}\n}}\n',
+    'async function {n}{i}({a}) {{\n  try {{ return await go({a}); }} catch (e) {{ log(e); return null; }}\n}}\n',
+]
+_JAVA_TEMPLATES = [
+    'public class C{i} {{\n    /** 做点事。 */\n    public String {n}(String {a}) {{\n'
+    '        if ({a} == null) {{ return null; }}\n        return {a} + {k};\n    }}\n}}\n',
+    'public class C{i} {{\n    private final Repo repo;\n\n    public C{i}(Repo repo) {{ this.repo = repo; }}\n\n'
+    '    /** 查询。 */\n    public List<String> {n}(Long {a}) {{\n'
+    '        try {{\n            return repo.find({a});\n'
+    '        }} catch (DataAccessException e) {{\n            log.warn("查询失败", e);\n            return List.of();\n        }}\n    }}\n}}\n',
+    '@Service\npublic class C{i} {{\n    /** 结算。 */\n'
+    '    @Transactional(rollbackFor = Exception.class)\n'
+    '    public int {n}(int {a}) {{\n        return {a} * {k};\n    }}\n}}\n',
+]
+_CS_TEMPLATES = [
+    'using System;\nusing System.Threading.Tasks;\n\nnamespace Demo {{\n'
+    '    /// <summary>做点事。</summary>\n    public sealed class C{i} {{\n'
+    '        private readonly IRepo _repo;\n\n'
+    '        public C{i}(IRepo repo) {{ _repo = repo; }}\n\n'
+    '        /// <summary>按 id 取。</summary>\n'
+    '        public async Task<decimal> {n}Async(long {a}) {{\n'
+    '            var row = await _repo.GetAsync({a}).ConfigureAwait(false);\n'
+    '            return row?.Amount ?? 0m;\n        }}\n    }}\n}}\n',
+    'namespace Demo {{\n    /// <summary>值对象。</summary>\n'
+    '    public sealed class C{i} {{\n        private readonly object _gate = new object();\n\n'
+    '        /// <summary>累加。</summary>\n        public decimal {n}(decimal {a}) {{\n'
+    '            lock (_gate) {{ return {a} * {k}m; }}\n        }}\n    }}\n}}\n',
+]
+_VUE_TEMPLATES = [
+    '<script setup lang="ts">\nimport {{ computed, ref }} from "vue"\n\n'
+    'const props = defineProps<{{ {a}: string }}>()\nconst n = ref({k})\n'
+    '// 过滤放 computed，模板里写 v-if 每次渲染都会重算\n'
+    'const shown = computed(() => props.{a}.length > n.value)\n</script>\n\n'
+    '<template>\n  <div v-if="shown">{{{{ props.{a} }}}}</div>\n</template>\n',
+    '<script setup>\nconst rows = []\n</script>\n\n'
+    '<template>\n  <li v-for="row in rows" :key="row.id">{{{{ row.{a} }}}}</li>\n</template>\n',
+]
+_PY_TEMPLATES = [
+    'def {n}_{i}({a}):\n    """做点事。"""\n    if {a}:\n        return {a} * {k}\n    return None\n\n',
+    'class C{i}:\n    """类。"""\n\n    def {n}(self, {a}):\n        return {a}\n\n',
+]
+
+
+def _rand_source(rng, lang):
+    tpls = {'py': _PY_TEMPLATES, 'java': _JAVA_TEMPLATES, 'vue': _VUE_TEMPLATES,
+            'csharp': _CS_TEMPLATES}.get(lang, _TEMPLATES)
+    parts = []
+    # Java 一个文件只放一个类：多个 public class 同文件不合法，
+    # 生成出来的东西必须是「真实项目里可能出现的形状」，否则压测的是一个不存在的场景。
+    count = 1 if lang in ('java', 'vue', 'csharp') else rng.randint(1, 8)
+    for i in range(count):
+        t = rng.choice(tpls)
+        parts.append(t.format(n=rng.choice(_NAMES), i=i, a=rng.choice(['x', 'value', 'rows', 'ctx']),
+                              k=rng.randint(1, 99)))
+    return ''.join(parts)
+
+
+def run_forward(n, seed=20260911):
+    """正向：随机生成 n 份代码，断言引擎不崩、行号不越界、报告能渲染。"""
+    rng = random.Random(seed)
+    crashed, bad_line = [], []
+    with tempfile.TemporaryDirectory() as tmp:
+        for i in range(n):
+            lang = rng.choice(['js', 'py', 'java', 'ts', 'vue', 'csharp'])
+            ext = {'js': '.js', 'ts': '.ts', 'py': '.py', 'java': '.java',
+                   'vue': '.vue', 'csharp': '.cs'}[lang]
+            src = _rand_source(rng, lang if lang in ('py', 'java', 'vue', 'csharp') else 'js')
+            name = {'java': f'C{i}.java', 'vue': f'V{i}.vue',
+                    'csharp': f'C{i}.cs'}.get(lang, f'g{i}{ext}')
+            src = src.replace('class C0', f'class C{i}').replace('C0(', f'C{i}(') if lang == 'java' else src
+            p = _write(tmp, name, src)
+            try:
+                issues, lenses, stats = C.check_files([p])
+                C.render_report(issues, stats, tmp)
+                total = len(src.split('\n'))
+                for it in issues:
+                    if not (1 <= it.line <= total):
+                        bad_line.append((p, it.rule, it.line, total))
+            except Exception as e:                       # noqa: BLE001 压测就是要抓住任何异常
+                crashed.append((p, f'{type(e).__name__}: {e}'))
+            finally:
+                try:
+                    os.unlink(p)
+                except OSError:
+                    pass          # 临时文件清不掉不影响压测结论，故意忽略（目录整体会被回收）
+    return crashed, bad_line
+
+
+def run_fix_loop():
+    """修复闭环：造缺陷 → 自动修 → 复检，断言那条规则真的消失且文件仍可解析。
+
+    还要断言**不该自动修的没被碰**——loose-eq / self-assign 会改变行为，
+    它们必须原样留着报给人。一个偷偷把 `==` 改成 `===` 的修复器，
+    会在某次发布后制造一个没人能复现的线上故障。
+    """
+    bad = []
+    with tempfile.TemporaryDirectory() as tmp:
+        for rule in sorted(C.FIXABLE):
+            sample = DEFECTS.get(rule)
+            if sample is None:
+                continue
+            name, src = sample
+            sub = os.path.join(tmp, 'fix_' + rule.replace('.', '_'))
+            os.makedirs(sub, exist_ok=True)
+            path = _write(sub, name, src)
+            before, _, _ = C.check_files([path])
+            if rule not in {i.rule for i in before}:
+                bad.append((rule, '缺陷样本本身就没触发该规则'))
+                continue
+            import code_fix as F
+            res = F.apply_fixes(path, write=True)
+            if not res.get('written'):
+                bad.append((rule, f'没有落盘：{res.get("aborted") or "无可修编辑"}'))
+                continue
+            after, lenses, _ = C.check_files([path])
+            if rule in {i.rule for i in after}:
+                bad.append((rule, '修完之后这条规则还在响'))
+            if lenses and not lenses[0].parse_ok:
+                bad.append((rule, '修完之后文件解析不了了'))
+        # 反向：行为会变的两条，必须**不被**自动修
+        for rule in ('logic.loose-eq', 'logic.self-assign'):
+            name, src = DEFECTS[rule]
+            sub = os.path.join(tmp, 'keep_' + rule.replace('.', '_'))
+            os.makedirs(sub, exist_ok=True)
+            path = _write(sub, name, src)
+            import code_fix as F
+            F.apply_fixes(path, write=True)
+            with open(path, encoding='utf-8') as f:
+                now = f.read()
+            if now != src:
+                bad.append((rule, '被自动改了！这条会改变行为，只许报给人'))
+    return bad
+
+
+def main(argv):
+    quick = '--quick' in argv
+    nums = [a for a in argv if a.isdigit()]
+    n = int(nums[0]) if nums else 300
+    print('══ 代码体检引擎 压测台 ' + '═' * 46)
+
+    ok, missed = run_reverse()
+    declared = declared_rules()
+    covered = {k.split('@')[0] for k in DEFECTS}
+    orphan = sorted(declared - covered)
+    print(f'\n【反向造缺陷】{ok}/{len(DEFECTS)} 个样本触发了自己那条规则'
+          f'（覆盖 {len(covered)}/{len(declared)} 条规则）')
+    for rule, hit in missed:
+        print(f'  ✗ {rule} 没有响！该样本实际命中：{hit or "（什么都没报）"}')
+    for rule in orphan:
+        print(f'  ✗ {rule} 有规则但没有反向样本——它从此不受任何保护')
+
+    errs, degraded, all_issues = run_clean()
+    print(f'\n【反误报】合规样本：必修 {len(errs)} 条（应为 0）'
+          f'，全部提示 {len(all_issues)} 条')
+    for e in errs:
+        print(f'  ✗ 误报 [{e.rule}] {os.path.basename(str(e.path))}:{e.line} {e.msg}')
+    for p, why in degraded:
+        print(f'  ✗ 合规样本解析失败：{os.path.basename(str(p))} {why}')
+
+    url_bad = run_url_guard()
+    print(f'\n【URL 不是本机路径】{len(URL_GUARD) - len(url_bad)}/{len(URL_GUARD)} 判对')
+    for name, why in url_bad:
+        print(f'  ✗ {name}：{why}')
+
+    fix_bad = run_fix_loop()
+    print(f'\n【修复闭环】可自动修 {len(sorted(C.FIXABLE))} 类：'
+          + ('全部「修完复检不再响、文件仍可解析」，且不该修的两条原样保留'
+             if not fix_bad else f'{len(fix_bad)} 处不合格'))
+    for rule, why in fix_bad:
+        print(f'  ✗ {rule}：{why}')
+
+    crashed, bad_line = ([], [])
+    if not quick:
+        crashed, bad_line = run_forward(n)
+        print(f'\n【正向跑批】{n} 份随机代码：崩溃 {len(crashed)} · 行号越界 {len(bad_line)}')
+        for p, why in crashed[:5]:
+            print(f'  ✗ {os.path.basename(p)} {why}')
+        for p, rule, ln, total in bad_line[:5]:
+            print(f'  ✗ {os.path.basename(p)} [{rule}] 报在第 {ln} 行，文件只有 {total} 行')
+
+    bad = (len(missed) + len(errs) + len(degraded) + len(crashed)
+           + len(bad_line) + len(fix_bad) + len(orphan) + len(url_bad))
+    print('\n' + '═' * 68)
+    if bad == 0:
+        print('✅ 全部通过：每条规则都会响，合规代码零必修，随机输入不崩。')
+    else:
+        print(f'❌ {bad} 处问题——规则不响或乱响，两样都会让这个体检器失去意义。')
+    return 1 if bad else 0
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv[1:]))