@hupan56/wlkj 2.7.12 → 3.1.2

package/templates/qoder/scripts/foundation/identity/check_publish.py

@@ -0,0 +1,103 @@
+# -*- coding: utf-8 -*-
+# v3.0 路径自举
+import os as _o, sys as _s
+_f = _o.path.abspath(__file__)
+for _ in range(10):
+    _f = _o.path.dirname(_f)
+    _cp = _o.path.join(_f, 'foundation')
+    if _o.path.isfile(_o.path.join(_cp, 'bootstrap.py')):
+        break
+if _cp not in _s.path: _s.path.insert(0, _cp)
+from bootstrap import setup; setup()
+
+"""
+check_publish.py - 统一发布前置检查 (guard + contract 双门)
+
+把"造了没接"的两个基建真正接入执行链路:
+  - guard.py (角色边界): 当前角色能否产出该契约? 越权 → 软提示
+  - contract.py (契约校验): 产出文件带不带 @contract 头? 带了是否合规?
+
+设计原则 (与 guard/contract 一致):
+  - 降级不阻塞: 越权/无契约头/校验警告 → 打印提示但 exit 0 (让用户决定)
+  - 只有"硬错误"(契约校验 FAIL) → exit 1, 阻止发布
+  - 统一入口: 所有产出型 skill 发布前调这一个脚本, 不用各自接 guard/contract
+
+用法:
+  python .qoder/scripts/common/check_publish.py <契约类型> <产出文件路径>
+  python .qoder/scripts/common/check_publish.py prd workspace/.../REQ-2026-001-xxx.md
+  python .qoder/scripts/common/check_publish.py design-spec workspace/.../xxx-design-spec.json
+  python .qoder/scripts/common/check_publish.py test-cases workspace/.../xxx-cases.json
+
+退出码:
+  0 = 通过 (含软警告, 可发布)
+  1 = 硬失败 (契约校验 FAIL, 建议不发布)
+  2 = 参数错误 / 内部异常
+
+输出: 人类可读的检查报告 (角色 + 契约两段)
+"""
+
+import sys
+
+
+def run(contract_type, artifact_path):
+    """跑 guard + contract 双门检查。返回 exit code。"""
+    # ============ 门 1: 角色边界 (guard) ============
+    # 越权只软提示, 不阻塞 (ensure=False)
+    print('--- 角色边界检查 ---')
+    try:
+        from foundation.identity.guard import check_produce
+        gr = check_produce(contract_type)
+        if gr.ok and not gr.is_warn:
+            print('✓', gr.msg)
+        else:
+            # 越权 (WARN): 提示但仍可继续
+            print(gr.msg)
+            if gr.hint:
+                print('  →', gr.hint)
+            print('  (软提示, 不阻塞发布。若需切换角色: /wl-init)')
+    except Exception as e:
+        print('⚠️ 角色检查不可用 ({}), 跳过'.format(str(e)[:60]))
+
+    # ============ 门 2: 契约校验 (contract) ============
+    print()
+    print('--- 契约校验 ---')
+    import os
+    if not os.path.isfile(artifact_path):
+        print('⚠️ 产出文件不存在: {}'.format(artifact_path))
+        print('  (跳过契约校验)')
+        return 0
+    try:
+        from foundation.data.contract import validate_contract
+        cr = validate_contract(artifact_path)
+        if cr.ok and not cr.is_warn:
+            print('✓', cr.msg)
+            return 0
+        elif cr.is_warn:
+            # 警告 (无契约头/字段警告/无schema): 软门禁, 可继续
+            print(cr.msg)
+            if cr.hint:
+                print('  →', cr.hint)
+            return 0
+        else:
+            # FAIL (硬错误): 缺必填/类型错/枚举越界 → 阻止
+            print('[FAIL]', cr.msg)
+            if cr.hint:
+                print('  →', cr.hint)
+            print('  (硬失败, 建议修正后再发布)')
+            return 1
+    except Exception as e:
+        print('⚠️ 契约校验异常 ({}), 跳过'.format(str(e)[:60]))
+        return 0
+
+
+def main():
+    if len(sys.argv) < 3:
+        print(__doc__)
+        return 2
+    contract_type = sys.argv[1]
+    artifact_path = sys.argv[2]
+    return run(contract_type, artifact_path)
+
+
+if __name__ == '__main__':
+    sys.exit(main())

package/templates/qoder/scripts/{common → foundation/identity}/developer.py

@@ -1,238 +1,239 @@
-#!/usr/bin/env python3
-# -*- coding: utf-8 -*-
-"""
-QODER Pipeline - 开发者管理工具
-
-提供开发者身份的初始化和管理功能:
-- init_developer: 初始化开发者身份, 创建工作空间和日志
-- ensure_developer: 确保开发者已初始化 (未初始化则退出)
-- show_developer_info: 显示开发者信息
-
-开发者身份存储在 .qoder/.developer 文件中 (gitignored)
-工作空间在 workspace/members/<developer>/ 目录下 (与 workspace_init.py 一致)
-"""
-
-from __future__ import annotations
-
-import sys
-from datetime import datetime
-from pathlib import Path
-
-# 将 scripts 目录加入路径以便导入 common 模块
-import os
-sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
-
-from common.paths import (
-    DIR_WORKFLOW,
-    FILE_DEVELOPER,
-    MEMBERS_DIR,
-    get_repo_root,
-    get_developer,
-    check_developer,
-)
-
-
-# =============================================================================
-# 开发者初始化
-# =============================================================================
-
-def write_developer_file(name: str, role: str | None = None,
-                         repo_root: Path | None = None) -> bool:
-    """写入 .qoder/.developer (规范格式: name=<name>)。"""
-    if repo_root is None:
-        repo_root = get_repo_root()
-    dev_file = repo_root / DIR_WORKFLOW / FILE_DEVELOPER
-    lines = [f"name={name}"]
-    if role:
-        lines.append(f"role={role}")
-    lines.append(f"initialized_at={datetime.now().isoformat()}")
-    try:
-        dev_file.write_text("\n".join(lines) + "\n", encoding="utf-8")
-        return True
-    except (OSError, IOError) as e:
-        print(f"Error: Failed to create .developer file: {e}", file=sys.stderr)
-        return False
-
-
-def _detect_git_author() -> str | None:
-    """探测系统 git config 的 user.name <user.email>。git 未装或未配返回 None。"""
-    import subprocess
-    try:
-        rn = subprocess.run(["git", "config", "user.name"],
-                            capture_output=True, text=True, timeout=5)
-        re_ = subprocess.run(["git", "config", "user.email"],
-                             capture_output=True, text=True, timeout=5)
-        if rn.returncode == 0 and re_.returncode == 0:
-            gname = rn.stdout.strip()
-            gemail = re_.stdout.strip()
-            if gname and gemail:
-                return f"{gname} <{gemail}>"
-    except (FileNotFoundError, OSError, subprocess.SubprocessError):
-        pass  # git 未装
-    return None
-
-
-def _ensure_git_config(name: str, repo_root: Path) -> None:
-    """确认 git user.name/email 已配置。未配则提示 (绝不自动造假账号)。
-
-    旧逻辑会塞 name@local 假账号, 与零信任 push 门禁冲突, 已废弃。
-    真正的 git 配置由 setup.py configure_git_identity() 在 init 前完成。
-    这里只做兜底检测: 如果走到这还没配, 提示用户去配。
-    """
-    import subprocess
-    # 先看 git 是否可用
-    try:
-        subprocess.run(["git", "--version"], capture_output=True, timeout=5)
-    except (FileNotFoundError, OSError):
-        print("  [INFO] git 未安装, 跳过 git 配置 (核心功能不依赖 git)")
-        return
-
-    author = _detect_git_author()
-    if author:
-        # 检测到疑似假账号也要提示 (虽然配了, 但 push 会被门禁拒)
-        if "@local" in author:
-            print(f"  [WARN] git 作者疑似假账号: {author} (push 门禁会拒绝)")
-            print(f"       请重跑 'wlkj init' 配置真实团队 git 账号")
-        else:
-            print(f"  [OK] git 作者: {author}")
-        return
-
-    # git 未配: 不造假, 只提示
-    print(f"  [WARN] git 未配置 user.name/email")
-    print(f"       push/commit 会失败。请配置团队 git 账号:")
-    print(f"       git config --global user.name '你的名字'")
-    print(f"       git config --global user.email '你的团队邮箱'")
-    print(f"       或重跑: wlkj init <你的名字>")
-
-
-def init_developer(name: str, role: str | None = None,
-                   repo_root: Path | None = None) -> bool:
-    """初始化开发者身份。
-
-    创建以下内容:
-        - .qoder/.developer 文件 (name= / role= / initialized_at=)
-        - workspace/members/<name>/{journal,drafts,inbox}/ 目录
-        - 初始日志文件 journal/journal-1.md
-        - member.json + .signing_key (零信任身份注册, 用于 push 门禁)
-        - git user.name/email 检测与配置
-
-    Returns:
-        成功返回 True, 失败返回 False。
-    """
-    if not name:
-        print("Error: developer name is required", file=sys.stderr)
-        return False
-
-    # 校验名称合法性 (允许字母数字、中文和部分符号)
-    if not all(c.isalnum() or c in "-_" for c in name):
-        print(f"Error: invalid developer name '{name}' (only alphanumeric, -, _ allowed)", file=sys.stderr)
-        return False
-
-    if repo_root is None:
-        repo_root = get_repo_root()
-
-    # 零信任: 切换身份时清除旧开发者的 current-task 指针
-    # (防止 B 在 A 用过的机器上看到 A 的活跃任务, 误操作)
-    try:
-        from .paths import get_developer, set_current_task
-        old_dev = get_developer(repo_root)
-        if old_dev and old_dev != name:
-            set_current_task(None, repo_root, developer=old_dev)
-            print(f"Note: 切换开发者 {old_dev} -> {name}, 已清除 {old_dev} 的活跃任务指针")
-    except Exception:
-        pass  # 清理失败不阻塞初始化
-
-    # 1. 创建 .developer 文件
-    if not write_developer_file(name, role, repo_root):
-        return False
-
-    # 2. 创建个人工作空间 workspace/members/<name>/
-    personal = repo_root / "workspace" / "members" / name
-    try:
-        for sub in ("journal", "drafts", "inbox"):
-            (personal / sub).mkdir(parents=True, exist_ok=True)
-    except (OSError, IOError) as e:
-        print(f"Error: Failed to create workspace directory: {e}", file=sys.stderr)
-        return False
-
-    # 3. 创建初始日志文件
-    journal_file = personal / "journal" / "journal-1.md"
-    if not journal_file.exists():
-        today = datetime.now().strftime("%Y-%m-%d")
-        try:
-            journal_file.write_text(
-                f"# Journal - {name}\n\n> Started: {today}\n\n---\n\n",
-                encoding="utf-8"
-            )
-        except (OSError, IOError) as e:
-            print(f"Error: Failed to create journal file: {e}", file=sys.stderr)
-            return False
-
-    # 4. 零信任身份注册 (写 member.json + 签名密钥 + git_author)
-    #    这是 push 门禁的前提: 没 member.json → syncgate 拒绝 push
-    git_author = _detect_git_author()
-    try:
-        from common.identity import register_member, IdentityError, get_member
-        # 修正: 旧 member.json 若是假账号(@local), 且现在 git 配了真账号 → 用真账号覆盖
-        # register_member 已有"已注册则只更新 git_author, 密钥不动"的逻辑, 这里只加提示
-        existing_member = get_member(name, repo_root)
-        if existing_member:
-            old_author = existing_member.get("git_author", "")
-            if (old_author and "@local" in old_author
-                    and git_author and "@local" not in git_author):
-                print(f"  [修正] member.json git_author 从假账号更新为真账号: {git_author}")
-        try:
-            register_member(name, role or "pm", git_author, repo_root)
-            print(f"  [OK] 身份注册: member.json + 签名密钥已生成")
-        except IdentityError as e:
-            print(f"  [WARN] 身份注册失败 (不阻塞): {e}")
-    except ImportError:
-        pass  # identity 模块不可用, 跳过 (向后兼容)
-
-    # 5. 确保 git 配置 (只检测+提示, 不造假; 真账号由 setup.py 在 init 前配好)
-    _ensure_git_config(name, repo_root)
-
-    print(f"Developer initialized: {name}" + (f" ({role})" if role else ""))
-    print(f"  Workspace: workspace/members/{name}/")
-    print(f"  Journal:   workspace/members/{name}/journal/journal-1.md")
-    return True
-
-
-# =============================================================================
-# 开发者校验
-# =============================================================================
-
-def ensure_developer(repo_root: Path | None = None) -> str:
-    """确保开发者已初始化, 未初始化则打印提示并退出。"""
-    developer = get_developer(repo_root)
-    if not developer:
-        print("Error: Developer not initialized.", file=sys.stderr)
-        print("Run: python .qoder/scripts/workspace_init.py <your-name>", file=sys.stderr)
-        sys.exit(1)
-    return developer
-
-
-def show_developer_info(repo_root: Path | None = None) -> None:
-    """显示当前开发者信息。"""
-    from common.paths import get_developer_info, get_workspace_dir, get_active_journal_file
-
-    info = get_developer_info(repo_root)
-    if not info:
-        print("Developer: not initialized")
-        print("Run: python .qoder/scripts/workspace_init.py <your-name>")
-        return
-
-    print(f"Developer: {info.get('name', 'unknown')}")
-    if info.get('role'):
-        print(f"Role: {info['role']}")
-    print(f"Initialized: {info.get('initialized_at', 'unknown')}")
-
-    workspace = get_workspace_dir(repo_root)
-    if workspace:
-        print(f"Workspace: {workspace}")
-
-    journal = get_active_journal_file(repo_root)
-    if journal:
-        from common.paths import count_lines
-        lines = count_lines(journal)
-        print(f"Active Journal: {journal.name} ({lines} lines)")
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+QODER Pipeline - 开发者管理工具
+
+提供开发者身份的初始化和管理功能:
+- init_developer: 初始化开发者身份, 创建工作空间和日志
+- ensure_developer: 确保开发者已初始化 (未初始化则退出)
+- show_developer_info: 显示开发者信息
+
+开发者身份存储在 .qoder/.developer 文件中 (gitignored)
+工作空间在 workspace/members/<developer>/ 目录下
+"""
+
+from __future__ import annotations
+
+import sys
+from datetime import datetime
+from pathlib import Path
+
+# 将 scripts 目录加入路径以便导入 common 模块
+import os
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from foundation.core.paths import (
+    DIR_WORKFLOW,
+    FILE_DEVELOPER,
+    MEMBERS_DIR,
+    get_repo_root,
+    get_developer,
+    check_developer,
+)
+
+
+# =============================================================================
+# 开发者初始化
+# =============================================================================
+
+def write_developer_file(name: str, role: str | None = None,
+                         repo_root: Path | None = None) -> bool:
+    """写入 .qoder/.developer (规范格式: name=<name>)。"""
+    if repo_root is None:
+        repo_root = get_repo_root()
+    dev_file = repo_root / DIR_WORKFLOW / FILE_DEVELOPER
+    lines = [f"name={name}"]
+    if role:
+        lines.append(f"role={role}")
+    lines.append(f"initialized_at={datetime.now().isoformat()}")
+    try:
+        dev_file.write_text("\n".join(lines) + "\n", encoding="utf-8")
+        return True
+    except (OSError, IOError) as e:
+        print(f"Error: Failed to create .developer file: {e}", file=sys.stderr)
+        return False
+
+
+def _detect_git_author() -> str | None:
+    """探测系统 git config 的 user.name <user.email>。git 未装或未配返回 None。"""
+    import subprocess
+    try:
+        rn = subprocess.run(["git", "config", "user.name"],
+                            capture_output=True, text=True, timeout=5)
+        re_ = subprocess.run(["git", "config", "user.email"],
+                             capture_output=True, text=True, timeout=5)
+        if rn.returncode == 0 and re_.returncode == 0:
+            gname = rn.stdout.strip()
+            gemail = re_.stdout.strip()
+            if gname and gemail:
+                return f"{gname} <{gemail}>"
+    except (FileNotFoundError, OSError, subprocess.SubprocessError):
+        pass  # git 未装
+    return None
+
+
+def _ensure_git_config(name: str, repo_root: Path) -> None:
+    """确认 git user.name/email 已配置。未配则提示 (绝不自动造假账号)。
+
+    旧逻辑会塞 name@local 假账号, 与零信任 push 门禁冲突, 已废弃。
+    真正的 git 配置由 setup.py configure_git_identity() 在 init 前完成。
+    这里只做兜底检测: 如果走到这还没配, 提示用户去配。
+    """
+    import subprocess
+    # 先看 git 是否可用
+    try:
+        subprocess.run(["git", "--version"], capture_output=True, timeout=5)
+    except (FileNotFoundError, OSError):
+        print("  [INFO] git 未安装, 跳过 git 配置 (核心功能不依赖 git)")
+        return
+
+    author = _detect_git_author()
+    if author:
+        # 检测到疑似假账号也要提示 (虽然配了, 但 push 会被门禁拒)
+        if "@local" in author:
+            print(f"  [WARN] git 作者疑似假账号: {author} (push 门禁会拒绝)")
+            print(f"       请重跑 'wlkj init' 配置真实团队 git 账号")
+        else:
+            print(f"  [OK] git 作者: {author}")
+        return
+
+    # git 未配: 不造假, 只提示
+    print(f"  [WARN] git 未配置 user.name/email")
+    print(f"       push/commit 会失败。请配置团队 git 账号:")
+    print(f"       git config --global user.name '你的名字'")
+    print(f"       git config --global user.email '你的团队邮箱'")
+    print(f"       或重跑: wlkj init <你的名字>")
+
+
+def init_developer(name: str, role: str | None = None,
+                   repo_root: Path | None = None) -> bool:
+    """初始化开发者身份。
+
+    创建以下内容:
+        - .qoder/.developer 文件 (name= / role= / initialized_at=)
+        - workspace/members/<name>/{journal,drafts,inbox}/ 目录
+        - 初始日志文件 journal/journal-1.md
+        - member.json + .signing_key (零信任身份注册, 用于 push 门禁)
+        - git user.name/email 检测与配置
+
+    Returns:
+        成功返回 True, 失败返回 False。
+    """
+    if not name:
+        print("Error: developer name is required", file=sys.stderr)
+        return False
+
+    # 校验名称合法性 (允许字母数字、中文和部分符号)
+    if not all(c.isalnum() or c in "-_" for c in name):
+        print(f"Error: invalid developer name '{name}' (only alphanumeric, -, _ allowed)", file=sys.stderr)
+        return False
+
+    if repo_root is None:
+        repo_root = get_repo_root()
+
+    # 零信任: 切换身份时清除旧开发者的 current-task 指针
+    # (防止 B 在 A 用过的机器上看到 A 的活跃任务, 误操作)
+    try:
+        from foundation.core.paths import get_developer, set_current_task
+        old_dev = get_developer(repo_root)
+        if old_dev and old_dev != name:
+            set_current_task(None, repo_root, developer=old_dev)
+            print(f"Note: 切换开发者 {old_dev} -> {name}, 已清除 {old_dev} 的活跃任务指针")
+    except Exception:
+        pass  # 清理失败不阻塞初始化
+
+    # 1. 创建 .developer 文件
+    if not write_developer_file(name, role, repo_root):
+        return False
+
+    # 2. 创建个人工作空间 workspace/members/<name>/
+    # v3.0 M3: 个人目录 = member.json + drafts + outputs + journal + .private
+    personal = repo_root / "workspace" / "members" / name
+    try:
+        for sub in ("journal", "drafts", "outputs", ".private", ".private/secrets"):
+            (personal / sub).mkdir(parents=True, exist_ok=True)
+    except (OSError, IOError) as e:
+        print(f"Error: Failed to create workspace directory: {e}", file=sys.stderr)
+        return False
+
+    # 3. 创建初始日志文件
+    journal_file = personal / "journal" / "journal-1.md"
+    if not journal_file.exists():
+        today = datetime.now().strftime("%Y-%m-%d")
+        try:
+            journal_file.write_text(
+                f"# Journal - {name}\n\n> Started: {today}\n\n---\n\n",
+                encoding="utf-8"
+            )
+        except (OSError, IOError) as e:
+            print(f"Error: Failed to create journal file: {e}", file=sys.stderr)
+            return False
+
+    # 4. 零信任身份注册 (写 member.json + 签名密钥 + git_author)
+    #    这是 push 门禁的前提: 没 member.json → syncgate 拒绝 push
+    git_author = _detect_git_author()
+    try:
+        from foundation.identity.identity import register_member, IdentityError, get_member
+        # 修正: 旧 member.json 若是假账号(@local), 且现在 git 配了真账号 → 用真账号覆盖
+        # register_member 已有"已注册则只更新 git_author, 密钥不动"的逻辑, 这里只加提示
+        existing_member = get_member(name, repo_root)
+        if existing_member:
+            old_author = existing_member.get("git_author", "")
+            if (old_author and "@local" in old_author
+                    and git_author and "@local" not in git_author):
+                print(f"  [修正] member.json git_author 从假账号更新为真账号: {git_author}")
+        try:
+            register_member(name, role or "pm", git_author, repo_root)
+            print(f"  [OK] 身份注册: member.json + 签名密钥已生成")
+        except IdentityError as e:
+            print(f"  [WARN] 身份注册失败 (不阻塞): {e}")
+    except ImportError:
+        pass  # identity 模块不可用, 跳过 (向后兼容)
+
+    # 5. 确保 git 配置 (只检测+提示, 不造假; 真账号由 setup.py 在 init 前配好)
+    _ensure_git_config(name, repo_root)
+
+    print(f"Developer initialized: {name}" + (f" ({role})" if role else ""))
+    print(f"  Workspace: workspace/members/{name}/")
+    print(f"  Journal:   workspace/members/{name}/journal/journal-1.md")
+    return True
+
+
+# =============================================================================
+# 开发者校验
+# =============================================================================
+
+def ensure_developer(repo_root: Path | None = None) -> str:
+    """确保开发者已初始化, 未初始化则打印提示并退出。"""
+    developer = get_developer(repo_root)
+    if not developer:
+        print("Error: Developer not initialized.", file=sys.stderr)
+        print("Run: npx @hupan56/wlkj init <your-name>", file=sys.stderr)
+        sys.exit(1)
+    return developer
+
+
+def show_developer_info(repo_root: Path | None = None) -> None:
+    """显示当前开发者信息。"""
+    from foundation.core.paths import get_developer_info, get_workspace_dir, get_active_journal_file
+
+    info = get_developer_info(repo_root)
+    if not info:
+        print("Developer: not initialized")
+        print("Run: npx @hupan56/wlkj init <your-name>")
+        return
+
+    print(f"Developer: {info.get('name', 'unknown')}")
+    if info.get('role'):
+        print(f"Role: {info['role']}")
+    print(f"Initialized: {info.get('initialized_at', 'unknown')}")
+
+    workspace = get_workspace_dir(repo_root)
+    if workspace:
+        print(f"Workspace: {workspace}")
+
+    journal = get_active_journal_file(repo_root)
+    if journal:
+        from foundation.core.paths import count_lines
+        lines = count_lines(journal)
+        print(f"Active Journal: {journal.name} ({lines} lines)")