@hunter-harness/workflow-harness 0.2.6 → 0.2.8

package/harness/bundles/java/cursor/scripts/harness_service.py

@@ -194,6 +194,8 @@ def resolve_service_start(
     change_name: str | None = None,
     worktree_root: Path | None = None,
     overlay_path: str | None = None,
+    leased_port: int | None = None,
+    lease_owner: str | None = None,
 ) -> dict[str, Any]:
     """从模板 serviceStart + runtime context 生成 resolved serviceStart。
 
@@ -220,6 +222,16 @@ def resolve_service_start(
     # runtime profile 注入：持久 profile 留空时用 change_name；非空则保留
     if not str(resolved.get("profile") or "").strip():
         resolved["profile"] = change_name or "local-dev"
+    if leased_port is not None:
+        if not lease_owner:
+            raise ValueError("lease owner is required when leased port is provided")
+        resolved["leasedPort"] = leased_port
+        resolved["leaseOwner"] = lease_owner
+        resolved["port"] = leased_port
+        for field in ("command", "healthUrl", "healthFile", "overlayPath"):
+            value = resolved.get(field)
+            if isinstance(value, str):
+                resolved[field] = value.replace("{leasedPort}", str(leased_port))
     # worktree_root 预留给未来相对 overlay 路径解析（spec §3.6 state snapshot）；
     # 不写入返回值，避免污染 session。
     _ = worktree_root
@@ -914,7 +926,7 @@ def build_session(
 ) -> dict[str, Any]:
     profile_name = service_start.get("profile") or "local-dev"
     overlay = service_start.get("overlayPath") or ""
-    return {
+    session = {
         "pid": pid,
         "startedBy": "AI",
         "moduleInputsHash": module_inputs_hash,
@@ -925,6 +937,10 @@ def build_session(
         "startedAt": started_at or now_iso(),
         "command": command,
     }
+    if isinstance(service_start.get("leasedPort"), int):
+        session["leasedPort"] = service_start["leasedPort"]
+        session["leaseOwner"] = service_start.get("leaseOwner")
+    return session
 
 
 def compute_module_hash(
@@ -1015,12 +1031,16 @@ def cmd_ensure(args: argparse.Namespace) -> int:
     # 含 worktree/change 陈旧持久值时拒绝（修复输入端陈旧 profile）。
     change_name = getattr(args, "change_name", None) or change_dir.name
     overlay = getattr(args, "overlay", None)
+    leased_port = getattr(args, "leased_port", None)
+    lease_owner = str(getattr(args, "lease_owner", None) or "").strip() or None
     try:
         service_start = resolve_service_start(
             profile,
             change_name=change_name,
             worktree_root=project,
             overlay_path=overlay,
+            leased_port=leased_port,
+            lease_owner=lease_owner,
         )
     except ValueError as exc:
         return emit_error(str(exc), as_json=as_json)
@@ -1084,6 +1104,8 @@ def cmd_ensure(args: argparse.Namespace) -> int:
                 and session.get("startCommandHash") == current_cmd_hash
                 and session.get("profile") == current_profile
                 and session.get("overlayPath") == current_overlay
+                and session.get("leasedPort") == service_start.get("leasedPort")
+                and session.get("leaseOwner") == service_start.get("leaseOwner")
             )
             if fingerprint_match:
                 payload = {
@@ -1389,6 +1411,17 @@ def build_parser() -> argparse.ArgumentParser:
         default=None,
         help="runtime overlay path injected into resolved serviceStart",
     )
+    p_ensure.add_argument(
+        "--leased-port",
+        type=int,
+        default=None,
+        help="port allocated by harness_change.py lease-port",
+    )
+    p_ensure.add_argument(
+        "--lease-owner",
+        default=None,
+        help="run id that owns --leased-port",
+    )
     p_ensure.add_argument("--json", action="store_true")
     p_ensure.set_defaults(func=cmd_ensure)
 

package/harness/bundles/java/cursor/scripts/harness_test_guard.py

@@ -24,6 +24,7 @@ from typing import Any
 SCHEMA_VERSION = 1
 MODE = "force-track-touched"
 MANIFEST_REL = Path("evidence") / "test-tracking.json"
+SNAPSHOT_REL = Path("evidence") / "test-guard-snapshot.json"
 PROFILE_REL = Path(".harness") / "config" / "build-profile.json"
 REASONS = ("tdd-created", "stale-test-repair", "test-updated")
 
@@ -125,7 +126,7 @@ def _exclusive_lock(path: Path, *, wait_seconds: float) -> Any:
     while descriptor is None:
         try:
             descriptor = os.open(path, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o600)
-        except FileExistsError as exc:
+        except (FileExistsError, PermissionError) as exc:
             if time.monotonic() >= deadline:
                 raise LockUnavailable(str(path)) from exc
             time.sleep(0.01)
@@ -137,22 +138,41 @@ def _exclusive_lock(path: Path, *, wait_seconds: float) -> Any:
         path.unlink(missing_ok=True)
 
 
+def _state_project_root(project: Path) -> Path:
+    result = _git(project, "rev-parse", "--git-common-dir")
+    if result.returncode != 0 or not result.stdout.strip():
+        return project
+    common = Path(result.stdout.strip())
+    if not common.is_absolute():
+        common = project / common
+    resolved = common.resolve()
+    return resolved.parent if resolved.name == ".git" else project
+
+
 def _change_dir(project: Path, change_dir: Path | str) -> Path | None:
+    state_project = _state_project_root(project)
     candidate = Path(change_dir)
     if not candidate.is_absolute():
-        candidate = project / candidate
+        candidate = (
+            state_project / candidate
+            if candidate.parts[:2] == (".harness", "changes")
+            else project / candidate
+        )
     resolved = candidate.resolve()
-    return resolved if _inside(resolved, project) else None
+    allowed_roots = {
+        (project / ".harness" / "changes").resolve(),
+        (state_project / ".harness" / "changes").resolve(),
+    }
+    return resolved if any(_inside(resolved, root) for root in allowed_roots) else None
 
 
-def _manifest_path(project: Path, change_root: Path) -> Path | None:
+def _manifest_path(change_root: Path) -> Path | None:
     evidence = change_root / MANIFEST_REL.parent
     manifest = change_root / MANIFEST_REL
     expected_evidence = evidence.absolute()
     resolved_evidence = evidence.resolve()
     if (
-        not _inside(change_root.resolve(), project)
-        or not _inside(resolved_evidence, project)
+        not _inside(resolved_evidence, change_root.resolve())
         or os.path.normcase(str(resolved_evidence))
         != os.path.normcase(str(expected_evidence))
     ):
@@ -160,9 +180,12 @@ def _manifest_path(project: Path, change_root: Path) -> Path | None:
     return manifest
 
 
-def _manifest_target_inside(project: Path, manifest: Path) -> bool:
+def _manifest_target_inside(change_root: Path, manifest: Path) -> bool:
     resolved = manifest.resolve()
-    return _inside(resolved, project) and _inside(resolved, manifest.parent.absolute())
+    return (
+        _inside(resolved, change_root.resolve())
+        and _inside(resolved, manifest.parent.absolute())
+    )
 
 
 def _profile_config(project: Path) -> tuple[list[str], list[str]] | None:
@@ -325,13 +348,13 @@ def record(
         assert path is not None and rel is not None
         validated.append((path, rel))
 
-    manifest_path = _manifest_path(project_root, change_root)
+    manifest_path = _manifest_path(change_root)
     if manifest_path is None:
         return _result(False, action, "MANIFEST_PATH_OUTSIDE_PROJECT", [])
     lock_path = manifest_path.with_name(manifest_path.name + ".lock")
     try:
         with _exclusive_lock(lock_path, wait_seconds=5.0):
-            if not _manifest_target_inside(project_root, manifest_path):
+            if not _manifest_target_inside(change_root, manifest_path):
                 return _result(
                     False, action, "MANIFEST_PATH_OUTSIDE_PROJECT", []
                 )
@@ -378,10 +401,10 @@ def record(
 
 
 def _stage_locked(
-    project_root: Path, manifest_path: Path, index_path: Path
+    project_root: Path, change_root: Path, manifest_path: Path, index_path: Path
 ) -> dict[str, Any]:
     action = "stage"
-    if not _manifest_target_inside(project_root, manifest_path):
+    if not _manifest_target_inside(change_root, manifest_path):
         return _result(False, action, "MANIFEST_PATH_OUTSIDE_PROJECT", [])
     try:
         manifest = _read_json(manifest_path)
@@ -444,13 +467,164 @@ def _stage_locked(
         temp_index.unlink(missing_ok=True)
 
 
+def _glob_files_for_pattern(base: Path, pattern: str) -> list[Path]:
+    normalized = pattern.replace("\\", "/")
+    if normalized.endswith("/**"):
+        prefix = normalized[:-3].rstrip("/")
+        root = base / prefix
+        if not root.is_dir():
+            return []
+        return [path for path in root.rglob("*") if path.is_file()]
+    return [path for path in base.glob(normalized) if path.is_file()]
+
+
+def _enumerate_allowed_test_files(project_root: Path) -> dict[str, str]:
+    """Map repo-relative test path -> sha256 for all allowed existing files."""
+    found: dict[str, str] = {}
+    config = _profile_config(project_root)
+    if config is None:
+        patterns = ["test/**", "tests/**", "src/test/**"]
+    else:
+        patterns, _excluded = config
+    base = project_root.resolve()
+    seen: set[str] = set()
+    for pattern in patterns:
+        for match in _glob_files_for_pattern(base, pattern):
+            resolved = match.resolve()
+            if not _inside(resolved, base):
+                continue
+            rel = resolved.relative_to(base).as_posix()
+            if rel in seen or not _allowed_test_path(project_root, rel):
+                continue
+            seen.add(rel)
+            found[rel] = _sha256(resolved)
+    return found
+
+
+def begin(project: Path | str, change_dir: Path | str) -> dict[str, Any]:
+    action = "begin"
+    project_root = Path(project).resolve()
+    change_root = _change_dir(project_root, change_dir)
+    if change_root is None:
+        return _result(False, action, "CHANGE_DIR_OUTSIDE_PROJECT", [])
+    manifest_path = _manifest_path(change_root)
+    if manifest_path is None:
+        return _result(False, action, "MANIFEST_PATH_OUTSIDE_PROJECT", [])
+    snapshot_path = change_root / SNAPSHOT_REL
+    if not _manifest_target_inside(change_root, snapshot_path):
+        return _result(False, action, "SNAPSHOT_PATH_OUTSIDE_PROJECT", [])
+
+    files = _enumerate_allowed_test_files(project_root)
+    snapshot = {
+        "schemaVersion": SCHEMA_VERSION,
+        "mode": MODE,
+        "projectRoot": str(project_root),
+        "capturedAt": time.strftime("%Y-%m-%dT%H:%M:%S"),
+        "files": [
+            {"path": rel, "sha256": digest, "ignored": _is_ignored(project_root, rel)}
+            for rel, digest in sorted(files.items())
+        ],
+    }
+    _write_json(snapshot_path, snapshot)
+    return _result(
+        True,
+        action,
+        "SNAPSHOT_CAPTURED",
+        list(files),
+        snapshotPath=str(snapshot_path),
+        fileCount=len(files),
+    )
+
+
+def close(project: Path | str, change_dir: Path | str) -> dict[str, Any]:
+    action = "close"
+    project_root = Path(project).resolve()
+    change_root = _change_dir(project_root, change_dir)
+    if change_root is None:
+        return _result(False, action, "CHANGE_DIR_OUTSIDE_PROJECT", [])
+    snapshot_path = change_root / SNAPSHOT_REL
+    if not snapshot_path.is_file():
+        return _result(False, action, "SNAPSHOT_MISSING", [])
+    try:
+        snapshot = _read_json(snapshot_path)
+    except (OSError, json.JSONDecodeError) as exc:
+        return _result(False, action, "SNAPSHOT_INVALID", [], error=str(exc))
+    if (
+        not isinstance(snapshot, dict)
+        or snapshot.get("schemaVersion") != SCHEMA_VERSION
+        or snapshot.get("projectRoot") != str(project_root)
+    ):
+        return _result(False, action, "SNAPSHOT_INVALID", [])
+
+    before_entries = snapshot.get("files")
+    if not isinstance(before_entries, list):
+        return _result(False, action, "SNAPSHOT_INVALID", [])
+    before: dict[str, dict[str, Any]] = {}
+    for item in before_entries:
+        if not isinstance(item, dict):
+            return _result(False, action, "SNAPSHOT_INVALID", [])
+        rel = item.get("path")
+        digest = item.get("sha256")
+        if not isinstance(rel, str) or not rel or not isinstance(digest, str):
+            return _result(False, action, "SNAPSHOT_INVALID", [])
+        path, normalized, error = _validate_file(project_root, rel)
+        if error:
+            return _result(False, action, error, [rel])
+        if normalized != rel or path is None:
+            return _result(False, action, "PATH_ESCAPE", [rel])
+        before[rel] = item
+
+    current = _enumerate_allowed_test_files(project_root)
+    for rel in current:
+        path, normalized, error = _validate_file(project_root, rel)
+        if error:
+            return _result(False, action, error, [rel])
+        if normalized != rel or path is None:
+            return _result(False, action, "PATH_ESCAPE", [rel])
+
+    touched: list[tuple[str, str]] = []
+    for rel, digest in current.items():
+        if rel not in before:
+            touched.append((rel, "tdd-created"))
+            continue
+        if before[rel]["sha256"] != digest:
+            touched.append((rel, "test-updated"))
+
+    recorded: list[str] = []
+    for rel, reason in touched:
+        result = record(project_root, change_root, [str(project_root / rel)], reason)
+        if not result.get("ok"):
+            code = result.get("code", "RECORD_FAILED")
+            if code == "TEST_PATH_NOT_ALLOWED":
+                return _result(False, action, "UNCLASSIFIABLE_TEST", [rel])
+            return result
+        recorded.append(rel)
+
+    return _result(
+        True,
+        action,
+        "CLOSED",
+        recorded,
+        recordedCount=len(recorded),
+        unchangedPreexisting=len(before) - sum(1 for rel, _ in touched if rel in before),
+    )
+
+
+def mark(
+    project: Path | str,
+    change_dir: Path | str,
+    files: list[str],
+) -> dict[str, Any]:
+    return record(project, change_dir, files, "stale-test-repair")
+
+
 def stage(project: Path | str, change_dir: Path | str) -> dict[str, Any]:
     action = "stage"
     project_root = Path(project).resolve()
     change_root = _change_dir(project_root, change_dir)
     if change_root is None:
         return _result(False, action, "CHANGE_DIR_OUTSIDE_PROJECT", [])
-    manifest_path = _manifest_path(project_root, change_root)
+    manifest_path = _manifest_path(change_root)
     if manifest_path is None:
         return _result(False, action, "MANIFEST_PATH_OUTSIDE_PROJECT", [])
 
@@ -468,7 +642,9 @@ def stage(project: Path | str, change_dir: Path | str) -> dict[str, Any]:
             manifest_lock = manifest_path.with_name(manifest_path.name + ".lock")
             try:
                 with _exclusive_lock(manifest_lock, wait_seconds=0.0):
-                    return _stage_locked(project_root, manifest_path, index_path)
+                    return _stage_locked(
+                        project_root, change_root, manifest_path, index_path
+                    )
             except LockUnavailable:
                 return _result(False, action, "MANIFEST_LOCKED", [])
     except LockUnavailable:
@@ -488,10 +664,30 @@ def main(argv: list[str] | None = None) -> int:
     stage_parser.add_argument("--project", required=True)
     stage_parser.add_argument("--change-dir", required=True)
     stage_parser.add_argument("--json", action="store_true")
+    begin_parser = sub.add_parser("begin")
+    begin_parser.add_argument("--project", required=True)
+    begin_parser.add_argument("--change-dir", required=True)
+    begin_parser.add_argument("--json", action="store_true")
+    close_parser = sub.add_parser("close")
+    close_parser.add_argument("--project", required=True)
+    close_parser.add_argument("--change-dir", required=True)
+    close_parser.add_argument("--json", action="store_true")
+    mark_parser = sub.add_parser("mark")
+    mark_parser.add_argument("--project", required=True)
+    mark_parser.add_argument("--change-dir", required=True)
+    mark_parser.add_argument("--files", required=True)
+    mark_parser.add_argument("--json", action="store_true")
     args = parser.parse_args(argv)
     if args.action == "record":
         files = [item.strip() for item in args.files.split(",") if item.strip()]
         result = record(args.project, args.change_dir, files, args.reason)
+    elif args.action == "begin":
+        result = begin(args.project, args.change_dir)
+    elif args.action == "close":
+        result = close(args.project, args.change_dir)
+    elif args.action == "mark":
+        files = [item.strip() for item in args.files.split(",") if item.strip()]
+        result = mark(args.project, args.change_dir, files)
     else:
         result = stage(args.project, args.change_dir)
     print(json.dumps(result, ensure_ascii=False, indent=2 if args.json else None))

package/harness/bundles/java/cursor/scripts/harness_workflow_policy.py

@@ -0,0 +1,160 @@
+#!/usr/bin/env python3
+"""Strict loader for harness/contracts/workflow-policy.json.
+
+Unknown fields at any depth fail validation. Python 3.10+, stdlib only.
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Any
+
+POLICY_REL = Path("harness") / "contracts" / "workflow-policy.json"
+
+TOP_LEVEL_KEYS = frozenset(
+    {
+        "schemaVersion",
+        "riskTiers",
+        "skills",
+        "requiredArtifacts",
+        "requiredValidations",
+        "conditionalStages",
+        "interactionWhitelist",
+        "checkpointRules",
+    }
+)
+
+RISK_TIER_KEYS = frozenset(
+    {
+        "description",
+        "defaultPhases",
+        "requiredValidations",
+        "conditionalStages",
+        "upgradeTriggers",
+    }
+)
+
+SKILL_KEYS = frozenset(
+    {
+        "phase",
+        "inputs",
+        "artifacts",
+        "events",
+        "allowedInteractions",
+        "capabilities",
+        "profiles",
+    }
+)
+
+CONDITIONAL_STAGE_KEYS = frozenset({"tiers", "signals"})
+CHECKPOINT_RULE_KEYS = frozenset(
+    {
+        "afterTasks",
+        "beforeTasks",
+        "blocking",
+        "requiredReport",
+        "reviewerTool",
+    }
+)
+
+
+class PolicyValidationError(ValueError):
+    """Raised when workflow-policy.json contains unknown or invalid fields."""
+
+
+def _reject_unknown(data: dict[str, Any], allowed: frozenset[str], path: str) -> None:
+    unknown = sorted(set(data) - allowed)
+    if unknown:
+        raise PolicyValidationError(
+            f"unknown field(s) at {path}: {', '.join(unknown)}"
+        )
+
+
+def _require_type(value: Any, expected: type | tuple[type, ...], path: str) -> None:
+    if not isinstance(value, expected):
+        names = (
+            expected.__name__
+            if isinstance(expected, type)
+            else "|".join(t.__name__ for t in expected)
+        )
+        raise PolicyValidationError(f"{path} must be {names}, got {type(value).__name__}")
+
+
+def validate_policy(data: Any) -> dict[str, Any]:
+    if not isinstance(data, dict):
+        raise PolicyValidationError("workflow policy root must be an object")
+    _reject_unknown(data, TOP_LEVEL_KEYS, "root")
+    _require_type(data.get("schemaVersion"), int, "schemaVersion")
+    if data["schemaVersion"] != 1:
+        raise PolicyValidationError("unsupported schemaVersion")
+
+    risk_tiers = data["riskTiers"]
+    _require_type(risk_tiers, dict, "riskTiers")
+    for tier_name, tier in risk_tiers.items():
+        path = f"riskTiers.{tier_name}"
+        _require_type(tier, dict, path)
+        _reject_unknown(tier, RISK_TIER_KEYS, path)
+        _require_type(tier["description"], str, f"{path}.description")
+        _require_type(tier["defaultPhases"], list, f"{path}.defaultPhases")
+        _require_type(tier["requiredValidations"], list, f"{path}.requiredValidations")
+        _require_type(tier["conditionalStages"], list, f"{path}.conditionalStages")
+        _require_type(tier["upgradeTriggers"], list, f"{path}.upgradeTriggers")
+
+    skills = data["skills"]
+    _require_type(skills, dict, "skills")
+    for skill_name, skill in skills.items():
+        path = f"skills.{skill_name}"
+        _require_type(skill, dict, path)
+        _reject_unknown(skill, SKILL_KEYS, path)
+        _require_type(skill["phase"], str, f"{path}.phase")
+        for key in ("inputs", "artifacts", "events", "allowedInteractions", "capabilities"):
+            _require_type(skill[key], list, f"{path}.{key}")
+        profiles = skill.get("profiles", ["general", "java"])
+        _require_type(profiles, list, f"{path}.profiles")
+        if not profiles or any(item not in {"general", "java"} for item in profiles):
+            raise PolicyValidationError(f"{path}.profiles must contain general and/or java")
+
+    for section in ("requiredArtifacts", "requiredValidations"):
+        section_data = data[section]
+        _require_type(section_data, dict, section)
+        for phase, items in section_data.items():
+            _require_type(items, list, f"{section}.{phase}")
+
+    conditional = data["conditionalStages"]
+    _require_type(conditional, dict, "conditionalStages")
+    for stage_name, stage in conditional.items():
+        path = f"conditionalStages.{stage_name}"
+        _require_type(stage, dict, path)
+        _reject_unknown(stage, CONDITIONAL_STAGE_KEYS, path)
+        _require_type(stage["tiers"], list, f"{path}.tiers")
+        _require_type(stage["signals"], list, f"{path}.signals")
+
+    interaction = data["interactionWhitelist"]
+    _require_type(interaction, dict, "interactionWhitelist")
+    for key, items in interaction.items():
+        _require_type(items, list, f"interactionWhitelist.{key}")
+
+    checkpoints = data["checkpointRules"]
+    _require_type(checkpoints, dict, "checkpointRules")
+    for checkpoint_id, rule in checkpoints.items():
+        path = f"checkpointRules.{checkpoint_id}"
+        _require_type(rule, dict, path)
+        _reject_unknown(rule, CHECKPOINT_RULE_KEYS, path)
+        _require_type(rule["afterTasks"], list, f"{path}.afterTasks")
+        _require_type(rule["beforeTasks"], list, f"{path}.beforeTasks")
+        _require_type(rule["blocking"], bool, f"{path}.blocking")
+
+    return data
+
+
+def policy_path_for_repo(repo_root: Path) -> Path:
+    return repo_root / POLICY_REL
+
+
+def load_policy(repo_root: Path) -> dict[str, Any]:
+    path = policy_path_for_repo(repo_root)
+    if not path.is_file():
+        raise FileNotFoundError(f"workflow policy missing: {path}")
+    data = json.loads(path.read_text(encoding="utf-8-sig"))
+    return validate_policy(data)