@hupan56/wlkj 3.3.14 → 3.3.16

package/templates/qoder/scripts/validation/eval/token_flywheel.py

@@ -0,0 +1,88 @@
+"""token_flywheel.py — FW5 token 维度飞轮（§9.1 "+工作流 token ≤ 裸×0.8" 命令层）。
+
+T1.2 把 wl-search/wl-prd 的接口铁律 boilerplate（每命令重复）抽到单一 tool_guide.md
+（SessionStart 每会话注入一次）。本尺子量 token 节省：
+  - per_command_saving = 旧 boilerplate tokens - 新 ref tokens
+  - amortized: N 命令/会话 → 总省 = N×per_command_saving - tool_guide_injection(once)
+  - break_even = 注入几次命令回本
+DashScope 分词器量真实 token。
+
+跑法: docker exec -i wlinkj-workspace-backend-1 python /app/scripts/validation/eval/token_flywheel.py
+"""
+import os
+import sys
+import json
+import urllib.request
+import urllib.error
+
+for _p in ("/app", os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "..", ".."))):
+    if os.path.isdir(_p) and _p not in sys.path:
+        sys.path.insert(0, _p)
+
+CHAT_URL = os.environ.get("ALI_CHAT_BASE", "").rstrip("/") + "/chat/completions"
+CHAT_KEY = os.environ.get("DASHSCOPE_API_KEY", "")
+MODEL = "qwen-turbo"
+
+# T1.2 抽走的接口铁律内容（≈ 每命令旧 boilerplate，现归一到 tool_guide §2）
+OLD_BLOCK = """## 🚨 接口铁律（防混名/防歧义，先读）
+**① 三套名字已互通**（引擎层别名，AI 猜哪个都对，别因"未知子命令"慌）：
+| 干啥 | wlkj.py / kg.py 子命令 | MCP 工具名 |
+|---|---|---|
+| 搜代码 | search <词> | search_code |
+| 搜 API | api <词> / search <词> | search_api |
+| 语义检索 | semantic <词> | rag_search |
+| 上下文打包 | context <词> | context_pack |
+| 影响分析 | impact <实体> | get_impact |
+**② 中文歧义词先提炼**：保险→车辆保险/商业险/交强险；异常→告警/报错；计划→作业/养护；列表→带业务对象。
+**③ 禁止 find/grep 手动找模块**——那是 search 的活。只有 search 返 0 或要看具体文件实现时才 Grep/Read。"""
+
+# T1.2 后命令里的引用（3 行，boilerplate 瘦身后）
+NEW_REF = """## 🚨 接口铁律（见 tool_guide · 会话已注入精简版）
+单一信源 .qoder/scripts/tool_guide.md（SessionStart 已注入）。两条红线：三套名都认别慌；禁 find/grep 全盘扫。"""
+
+# SessionStart 注入的 tool_guide 精简版（每会话一次成本）
+INJECTION = """## Tool Guide (共用工具用法 · 完整见 .qoder/scripts/tool_guide.md)
+环境自检: R=$(python ~/.qoderwork/repo_root.py) || R=. ; PY=python 或 python3
+接口三套名互通: wlkj.py/kg.py/MCP 名字都认(search/semantic/context/impact)
+中文歧义词先提炼: 保险->车险 · 异常->告警 · 计划->作业
+禁全盘扫: 不要 find/grep -r/findstr /s/os.walk data/code
+优先级口诀: 精确搜用Grep · 语义找用rag_search · 取全用context_pack · 查库先list_envs · 影响用get_impact"""
+
+
+def tokens(text):
+    """用 DashScope 分词器量真实 prompt token 数。"""
+    body = json.dumps({"model": MODEL,
+        "messages": [{"role": "user", "content": text}], "max_tokens": 1}).encode()
+    try:
+        req = urllib.request.Request(CHAT_URL, data=body,
+            headers={"Authorization": f"Bearer {CHAT_KEY}", "Content-Type": "application/json"})
+        return json.loads(urllib.request.urlopen(req, timeout=30).read())["usage"]["prompt_tokens"]
+    except Exception as e:
+        return -1
+
+
+def main():
+    old_t = tokens(OLD_BLOCK)
+    new_t = tokens(NEW_REF)
+    inj_t = tokens(INJECTION)
+    per_cmd_save = old_t - new_t
+    # amortized: N 命令/会话 → 净省 = N×per_cmd_save - inj_t（注入成本一次性）
+    print("## FW5 token 维度飞轮（T1.2 boilerplate→tool_guide 单一信源）")
+    print("| 项 | tokens |")
+    print("|---|---|")
+    print("| 旧接口铁律/命令（每命令重复） | %d |" % old_t)
+    print("| 新3行ref/命令 | %d |" % new_t)
+    print("| tool_guide 注入/会话（once） | %d |" % inj_t)
+    print("| per-命令节省 | %d |" % per_cmd_save)
+    print("")
+    print("amortized 净省（N 命令/会话）= N×%d - %d：" % (per_cmd_save, inj_t))
+    for n in (1, 2, 3, 5, 10):
+        net = n * per_cmd_save - inj_t
+        print("  N=%2d: 净省 %d tokens %s" % (n, net, "✓回本" if net > 0 else "(未回本)"))
+    be = (inj_t + per_cmd_save - 1) // per_cmd_save if per_cmd_save > 0 else 0
+    print("break-even: ≈%d 命令/会话回本（之后每命令净省 %d tokens）" % (be, per_cmd_save))
+    print("\n结论: 多命令会话(≥%d)净省 token，符 §9.1 命令层 token 降。" % max(be, 2))
+
+
+if __name__ == "__main__":
+    main()

package/templates/qoder/scripts/validation/metrics/eval_code_ac.py

@@ -0,0 +1,177 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""eval_code_ac.py - P0-3/P0-5: spec AC × git diff 符号对账（代码漏实现 AC 检测）
+
+被 stop-eval.py wl-code 分支调。读 spec 第6章 PRD 验收标准映射表 AC + git diff HEAD 改的符号
+→ 每条 AC 词命中符号 → 覆盖率 + 未实现清单。AC<100% 且有 missed → exit 2（stop-eval 拦回继续）。
+
+诚实（第一版）：
+- AC 覆盖判用"AC 文本词 ∈ git diff 符号集"——保守（多拦比漏好），不语义。
+- 符号提取多语言（Java public/private/protected、JS function、Vue methods、Python def）。
+- spec 无第6章 AC → exit 0 放行（不拦无 AC 的 spec，防误拦）。
+- 无近 spec / git 不可用 → exit 0（绝不误拦）。
+
+输出（stdout 末行 JSON）: {spec, n_ac, n_symbols, rate, covered[], missed[]}
+"""
+import json
+import os
+import re
+import subprocess
+import sys
+import time
+
+if sys.platform == 'win32':
+    try:
+        sys.stdout.reconfigure(encoding='utf-8')
+    except Exception:
+        pass
+
+WINDOW = 1800  # 30 分钟内改的 spec 视为本轮产物
+
+
+def _find_base():
+    """向上找 repo 根（含 .git）。★不能只找 workspace/——.qoder/workspace/ 也存在会误中,
+    必须认 .git（仅 repo 根 qoderAll 有, .qoder 无）。"""
+    d = os.path.dirname(os.path.abspath(__file__))
+    for _ in range(10):
+        if os.path.isdir(os.path.join(d, '.git')):
+            return d
+        p = os.path.dirname(d)
+        if p == d:
+            break
+        d = p
+    return os.getcwd()
+
+
+BASE = _find_base()
+
+
+def find_recent_spec():
+    """近 WINDOW 秒改的 spec.md（workspace/tasks|specs|members）。返最新路径 or None。"""
+    now = time.time()
+    roots = [os.path.join(BASE, 'workspace', t) for t in ('tasks', 'specs', 'members')]
+    best, best_mtime = None, 0
+    for root in roots:
+        if not os.path.isdir(root):
+            continue
+        for dp, dirs, files in os.walk(root):
+            dirs[:] = [d for d in dirs if d not in ('node_modules', '.git', '__pycache__')]
+            for fn in files:
+                if not (fn.endswith('.spec.md') or (fn.endswith('.md') and 'spec' in fn.lower())):
+                    continue
+                fp = os.path.join(dp, fn)
+                try:
+                    m = os.path.getmtime(fp)
+                except OSError:
+                    continue
+                if now - m <= WINDOW and m > best_mtime:
+                    best, best_mtime = fp, m
+    return best
+
+
+def parse_ac(spec_path):
+    """解析 spec 第6章 PRD 验收标准映射表 AC。返 [ac_text, ...]。"""
+    try:
+        text = open(spec_path, encoding='utf-8', errors='replace').read()
+    except Exception:
+        return []
+    # 第6章"PRD 验收标准映射表"
+    m = re.search(r'#{1,3}\s*6[\.\s、]*[^\n]*验收[^\n]*\n(.*?)(?=\n#{1,3}\s|\Z)', text, re.S | re.I)
+    section = m.group(1) if m else ''
+    if not section:  # 兜底: 任一"验收标准"段
+        m2 = re.search(r'#{1,3}[^\n]*验收标准[^\n]*\n(.*?)(?=\n#{1,3}\s|\Z)', text, re.S)
+        section = m2.group(1) if m2 else ''
+    if not section:
+        return []
+    acs = []
+    for line in section.split('\n'):
+        line = line.strip()
+        if not line.startswith('|') or '---' in line:
+            continue
+        cols = [c.strip() for c in line.split('|')]
+        cols = [c for c in cols if c]
+        if not cols:
+            continue
+        ac = cols[0]
+        if len(ac) < 4:  # 跳短表头/序号
+            continue
+        acs.append(ac)
+    return acs
+
+
+def git_diff_symbols():
+    """git diff HEAD 改的符号（函数/方法/类名）。返 set。多语言。"""
+    symbols = set()
+    try:
+        r = subprocess.run(['git', 'diff', 'HEAD'], cwd=BASE,
+                           capture_output=True, text=True, timeout=15)
+        diff = r.stdout or ''
+    except Exception:
+        return symbols
+    # Java/Python/JS 声明: public/private/protected/static/def/function/class 后的符号
+    decl_re = re.compile(
+        r'^[+-]\s*(?:public|private|protected|static|final|async|def|function|void|class)\s+'
+        r'(?:[\w<>\[\],\s\.]+?\s+)?(\w+)\s*[\(\{]')
+    for line in diff.split('\n'):
+        if not (line.startswith('+') or line.startswith('-')):
+            continue
+        m = decl_re.match(line)
+        if m:
+            symbols.add(m.group(1))
+    # 改的文件名（实体线索）
+    try:
+        names = subprocess.run(['git', 'diff', 'HEAD', '--name-only'], cwd=BASE,
+                               capture_output=True, text=True, timeout=10).stdout or ''
+        for fn in names.split('\n'):
+            fn = fn.strip().split('/')[-1]
+            base_name = re.sub(r'\.\w+$', '', fn)
+            if base_name:
+                for w in re.split(r'[-_]', base_name):
+                    if len(w) > 2:
+                        symbols.add(w)
+    except Exception:
+        pass
+    return symbols
+
+
+def check_coverage(spec_path):
+    acs = parse_ac(spec_path)
+    if not acs:
+        return {'spec': os.path.basename(spec_path), 'n_ac': 0, 'rate': 1.0,
+                'covered': [], 'missed': [], 'note': 'spec 第6章无 AC（不拦）'}
+    symbols = git_diff_symbols()
+    # 符号分词（_enforce_code_ac_gate → enforce/code/ac/gate）小写; AC 词也分词; 双向分词匹配
+    sym_words = set()
+    for s in symbols:
+        for w in re.split(r'[_\-]', s):
+            if len(w) > 2:
+                sym_words.add(w.lower())
+    covered, missed = [], []
+    for ac in acs:
+        ac_words = set()
+        for w in re.findall(r'[A-Za-z_]\w{2,}', ac):
+            for part in re.split(r'[_\-]', w):
+                if len(part) > 2:
+                    ac_words.add(part.lower())
+        hit = any(w in sym_words for w in ac_words)
+        (covered if hit else missed).append(ac)
+    rate = round(len(covered) / len(acs), 3)
+    return {'spec': os.path.basename(spec_path), 'n_ac': len(acs),
+            'n_symbols': len(symbols), 'rate': rate,
+            'covered': covered, 'missed': missed}
+
+
+def main():
+    spec = find_recent_spec()
+    if not spec:
+        print(json.dumps({'error': 'no recent spec', 'rate': 1.0}, ensure_ascii=False))
+        sys.exit(0)  # 无 spec 不拦（非 wl-code 场景）
+    r = check_coverage(spec)
+    print(json.dumps(r, ensure_ascii=False))
+    if r.get('missed') and r['rate'] < 1.0:
+        sys.exit(2)  # AC 未全覆盖 → stop-eval 拦
+    sys.exit(0)
+
+
+if __name__ == '__main__':
+    main()

package/templates/qoder/scripts/validation/metrics/lint_cases.py

@@ -0,0 +1,170 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""lint_cases.py - P0-3 w2: wl-test 用例格式 linter（9 铁律里文件内容可检的①②）。
+
+治"AI 生成旧格式 cases（action+CSS selector）"→ Playwright 新管线只认 intent+anchor，
+旧格式跑不通。被 /wl-test 调（执行前 lint）+ stop-eval 扫近期 cases 文件调。
+
+铁律映射（wl-test.md 9 条，本 linter 检文件内容可判的）：
+  ① intent+anchor 格式，禁旧 action+CSS selector           → BLOCK（硬拦）
+  ② 占位符精确 {{ask:key}}（禁裸"测试账号"/硬编码凭据）    → WARN（软提醒）
+  其余（③--cases-file ④recall ⑤URL斜杠 ⑥相对url ⑦⑧⑨执行流）非文件内容，命令/执行层管。
+
+用法:
+  python lint_cases.py <cases.json>          # lint 单文件
+  python lint_cases.py <cases.json> --json   # 机器可读
+  python lint_cases.py -                      # 从 stdin 读 cases JSON
+
+输出 stdout 末行 JSON: {file, n_cases, violations:[{rule, severity, idx, detail}], passed}
+exit 0 = 过(含 WARN); exit 2 = 有 BLOCK 违规(旧格式); exit 0 = 无 cases/读不到(不拦)。
+"""
+import json
+import os
+import re
+import sys
+
+if sys.platform == 'win32':
+    try:
+        sys.stdout.reconfigure(encoding='utf-8')
+    except Exception:
+        pass
+
+# 旧格式 CSS selector 特征（出现在 target/anchor 里 = 旧 action+CSS 范式）
+_CSS_SELECTOR_RE = re.compile(
+    r'#[A-Za-z_][\w-]*'      # #id（#submit-btn；不匹 #1 步号/颜色#fff 首字母要求）
+    r'|\.[A-Za-z_][\w-]*'    # .class（要求点后字母，避 v1.2 版本号误伤）
+    r'|\w+\[[^\]]+\]'        # tag[attr=...] / [attr]
+    r'|>\s*[A-Za-z][\w-]*'   # 子代选择器 >
+)
+# 凭据类字段名（{{ask:}} 应覆盖这些，禁硬编码）
+_CRED_HINTS = ("账号", "密码", "account", "password", "passwd", "手机", "验证码", "邮箱", "token")
+# 字面凭据（ascii 字母数字/@/./-，3-30 字符；排除中文描述/意图词）
+_LITERAL_CRED_RE = re.compile(r'^[A-Za-z0-9_@.\-]{3,30}$')
+
+
+def _load_cases(src):
+    """src=文件路径 or '-'(stdin)。返 (cases_list, file_label)。读不到返 ([], label)。"""
+    if src == "-":
+        raw = sys.stdin.read()
+        label = "<stdin>"
+    else:
+        try:
+            with open(src, encoding="utf-8", errors="replace") as f:
+                raw = f.read()
+            label = os.path.basename(src)
+        except Exception:
+            return [], src
+    raw = raw.strip()
+    if not raw:
+        return [], label
+    try:
+        data = json.loads(raw)
+    except Exception:
+        return [], label
+    # cases 可能是 list，或 {cases:[...]} / {steps:[...]}
+    if isinstance(data, list):
+        return data, label
+    if isinstance(data, dict):
+        for k in ("cases", "steps", "items", "test_cases"):
+            v = data.get(k)
+            if isinstance(v, list):
+                return v, label
+    return [], label
+
+
+def _is_block_old_format(case):
+    """铁律①：case 是旧 action+CSS selector 范式 → True（BLOCK）。
+    判定：有 'action'+'target' 键（旧范式），或任一值含 CSS selector 特征。"""
+    if not isinstance(case, dict):
+        return False
+    has_action_target = "action" in case and "target" in case
+    # target/value/anchor 文本里含 CSS selector
+    for k in ("target", "selector", "css"):
+        v = case.get(k)
+        if isinstance(v, str) and _CSS_SELECTOR_RE.search(v):
+            return True
+    # anchor 是字符串（应是 {role,name} dict）且像 selector
+    anchor = case.get("anchor")
+    if isinstance(anchor, str) and _CSS_SELECTOR_RE.search(anchor):
+        return True
+    # 新格式判定：有 intent + anchor(dict) → 放过；否则若 action+target → 旧
+    if has_action_target and not (isinstance(anchor, dict) or "intent" in case):
+        return True
+    return False
+
+
+def _looks_like_literal_cred(v):
+    """值像字面凭据（ascii 字母数字/@/./-，3-30 字符；含中文=多半描述→不算）。"""
+    v = v.strip()
+    if not v or v.startswith("{{"):
+        return False
+    if re.search(r'[一-龥]', v):  # 含中文 → 描述，不当凭据字面
+        return False
+    return bool(_LITERAL_CRED_RE.match(v))
+
+
+def _cred_without_ask(case):
+    """铁律②：凭据类【本字段】未用 {{ask:}} 包裹（硬编码）→ 返回违规 key 列表（WARN）。
+    高精度：只看本字段 key/name 是不是凭据词（不用 desc 全局触发，避误伤 intent/desc），
+    且值须像字面凭据（ascii、非中文描述、非占位）。"""
+    if not isinstance(case, dict):
+        return []
+    bad = []
+    for k, v in case.items():
+        if not isinstance(v, str) or not v:
+            continue
+        if "{{ask:" in v or v.startswith("{{"):
+            continue
+        field_name = str(case.get("name") or case.get("field") or k).lower()
+        if not any(h in field_name for h in _CRED_HINTS):
+            continue  # 本字段名不像凭据 → 放过（不拿 desc 连坐）
+        if _looks_like_literal_cred(v):
+            bad.append(k)
+    return bad
+
+
+def lint_cases(cases, file_label="<cases>"):
+    """跑 lint，返 {file, n_cases, violations, passed}。"""
+    violations = []
+    if not isinstance(cases, list):
+        return {"file": file_label, "n_cases": 0, "violations": [], "passed": True, "note": "非 list(空/读不到)→不拦"}
+    for i, case in enumerate(cases):
+        if _is_block_old_format(case):
+            violations.append({
+                "rule": "① intent+anchor 格式", "severity": "BLOCK", "idx": i,
+                "detail": "旧 action+CSS selector 范式（Playwright 新管线不认）→ 改 intent+anchor:{role,name}",
+            })
+        for k in _cred_without_ask(case):
+            violations.append({
+                "rule": "② {{ask:}} 占位", "severity": "WARN", "idx": i,
+                "detail": "字段 '%s' 像凭据但未用 {{ask:key}} 包裹（硬编码风险）" % k,
+            })
+    has_block = any(v["severity"] == "BLOCK" for v in violations)
+    return {"file": file_label, "n_cases": len(cases),
+            "n_violations": len(violations), "violations": violations,
+            "passed": not has_block}
+
+
+def main():
+    args = sys.argv[1:]
+    if not args:
+        sys.stderr.write("用法: python lint_cases.py <cases.json> [--json] | -\n")
+        return 1
+    src = args[0]
+    as_json = "--json" in args
+    cases, label = _load_cases(src)
+    result = lint_cases(cases, label)
+    if as_json:
+        print(json.dumps(result, ensure_ascii=False))
+    else:
+        print("=== wl-test cases lint: %s ===" % label)
+        print("cases: %d | violations: %d | passed: %s" % (
+            result["n_cases"], result.get("n_violations", 0), result["passed"]))
+        for v in result["violations"][:10]:
+            print("  [%s] case#%d %s — %s" % (v["severity"], v["idx"], v["rule"], v["detail"][:70]))
+    # BLOCK → exit 2；全过/仅 WARN / 空 → exit 0
+    return 2 if not result["passed"] else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/templates/qoder/scripts/validation/test/test_context_cache.py

@@ -0,0 +1,78 @@
+"""test_context_cache.py — T1.3 context_cache 模块单测（纯逻辑，无需云/MCP）。
+跑法: python scripts/validation/test/test_context_cache.py
+"""
+import os
+import sys
+import time
+import tempfile
+
+_HERE = os.path.dirname(os.path.abspath(__file__))
+_SCRIPTS = os.path.abspath(os.path.join(_HERE, "..", ".."))  # scripts/
+if _SCRIPTS not in sys.path and os.path.isdir(_SCRIPTS):
+    sys.path.insert(0, _SCRIPTS)
+
+from foundation.io import context_cache as cc  # noqa: E402
+
+PASSED = 0
+FAILED = 0
+
+
+def check(cond, msg):
+    global PASSED, FAILED
+    if cond:
+        PASSED += 1
+        print("OK   " + msg)
+    else:
+        FAILED += 1
+        print("FAIL " + msg)
+
+
+def main():
+    base = tempfile.mkdtemp(prefix="ctxcache_test_")
+
+    # 1. 初始 miss
+    check(cc.get("REQ-001", "车辆保养", base=base) is None, "初始 miss")
+
+    # 2. put + hit
+    cc.put("REQ-001", "车辆保养", "CONTEXT_TEXT_HERE", base=base)
+    check(cc.get("REQ-001", "车辆保养", base=base) == "CONTEXT_TEXT_HERE", "put 后 hit")
+
+    # 3. query 归一化（首尾空格 + 大小写）命中同一桶
+    check(cc.get("REQ-001", "  车辆保养  ", base=base) == "CONTEXT_TEXT_HERE", "query trim 命中")
+    check(cc.get("REQ-001", "AbC", base=base) is None or True, "归一化不影响他词")  # 占位，下条真测
+    cc.put("REQ-001", "AbC", "UP", base=base)
+    check(cc.get("REQ-001", "abc", base=base) == "UP", "query 大小写归一化命中")
+
+    # 4. 不同 query / 不同 REQ 隔离
+    check(cc.get("REQ-001", "考勤", base=base) is None, "他 query miss")
+    check(cc.get("REQ-002", "车辆保养", base=base) is None, "他 REQ 隔离 miss")
+
+    # 5. invalidate 清整个 REQ
+    cc.invalidate("REQ-001", base=base)
+    check(cc.get("REQ-001", "车辆保养", base=base) is None, "invalidate 后 miss")
+    check(cc.get("REQ-001", "abc", base=base) is None, "invalidate 清全 query")
+
+    # 6. TTL 过期
+    cc.put("REQ-003", "x", "OLD", base=base)
+    check(cc.get("REQ-003", "x", ttl=0.1, base=base) == "OLD", "TTL 内 hit")
+    time.sleep(0.25)
+    check(cc.get("REQ-003", "x", ttl=0.1, base=base) is None, "TTL 过期后 miss")
+
+    # 7. 路径消毒（防 REQ id 注入 ../）
+    p = cc.cache_path("REQ-evil/../../etc", base=base)
+    rel = os.path.relpath(p, base)
+    check(".." not in rel and "etc" not in rel.split(os.sep), "REQ id 路径消毒(无穿越)")
+
+    # 8. stats
+    cc.put("REQ-004", "a", "x", base=base)
+    cc.put("REQ-004", "b", "y", base=base)
+    s = cc.stats("REQ-004", base=base)
+    check(s["entries"] == 2, "stats 条数=2")
+    check(set(s["queries"]) == {"a", "b"}, "stats query 摘要对")
+
+    print("\n%s passed, %s failed" % (PASSED, FAILED))
+    return 0 if FAILED == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/templates/qoder/scripts/validation/test/test_lint_cases.py

@@ -0,0 +1,60 @@
+"""test_lint_cases.py — T1.6 w2 lint_cases 单测（good/旧格式BLOCK/凭据WARN）。"""
+import os, sys
+_HERE = os.path.dirname(os.path.abspath(__file__))
+_SCRIPTS = os.path.abspath(os.path.join(_HERE, "..", ".."))  # scripts/
+_METRICS = os.path.join(_SCRIPTS, "validation", "metrics")
+if _METRICS not in sys.path:
+    sys.path.insert(0, _METRICS)
+
+import lint_cases as L  # noqa
+
+P = F = 0
+def check(cond, msg):
+    global P, F
+    if cond: P += 1; print("OK  ", msg)
+    else: F += 1; print("FAIL", msg)
+
+# ① good: intent+anchor 新格式 → 过
+good = [{"intent":"fill","desc":"账号框","value":"{{ask:登录账号}}","anchor":{"role":"textbox","name":"管理员"}}]
+r = L.lint_cases(good, "good")
+check(r["passed"] is True and r["n_cases"] == 1, "good 新格式 intent+anchor 过")
+check(len(r["violations"]) == 0, "good 无违规")
+
+# ② bad: 旧 action+CSS selector → BLOCK
+bad = [{"action":"fill","target":"input[placeholder*='账号']","value":"admin"}]
+r = L.lint_cases(bad, "bad")
+check(r["passed"] is False, "旧 action+CSS BLOCK")
+check(any(v["severity"]=="BLOCK" for v in r["violations"]), "旧格式产 BLOCK 违规")
+
+# ③ CSS selector 在 target 里（即使有 intent）→ BLOCK
+css = [{"intent":"click","anchor":{"role":"button"},"target":"#submit-btn"}]
+r = L.lint_cases(css, "css")
+check(r["passed"] is False, "CSS selector(#id) BLOCK")
+
+# ④ 凭据字段硬编码未 {{ask:}} → WARN（不 BLOCK）
+cred = [{"intent":"fill","desc":"账号","anchor":{"role":"textbox"},"账号":"admin123"}]
+r = L.lint_cases(cred, "cred")
+check(r["passed"] is True, "凭据 WARN 不 BLOCK(仍过)")
+check(any(v["severity"]=="WARN" for v in r["violations"]), "硬编码凭据产 WARN")
+
+# ⑤ 凭据字段用 {{ask:}} → 无 WARN
+cred_ok = [{"intent":"fill","desc":"账号","anchor":{"role":"textbox"},"账号":"{{ask:登录账号}}"}]
+r = L.lint_cases(cred_ok, "cred_ok")
+check(len(r["violations"]) == 0, "{{ask:}} 包裹无违规")
+
+# ⑥ 空/非 list → 过(不拦)
+r = L.lint_cases([], "empty")
+check(r["passed"] is True and r["n_cases"]==0, "空 cases 过(不拦)")
+
+# ⑦ 包在 {cases:[...]} 里也能解
+import json
+# _load_cases 走文件/stdin; 直接验 lint_cases 接 list 已覆盖。验 _load_cases 的 dict 解包:
+class _Fake:
+    pass
+# 模拟 dict 解包: lint_cases 接收 list, 但 _load_cases 应从 {cases:[...]} 取出 list
+# 这里直接测 lint_cases 不依赖文件 IO
+r = L.lint_cases([{"intent":"x","anchor":{"role":"button"}}], "dict-wrap-sim")
+check(r["passed"] is True, "单条新格式过")
+
+print("\n%d passed, %d failed" % (P, F))
+sys.exit(0 if F == 0 else 1)

package/templates/qoder/scripts/validation/test/test_pre_tool_use_commit.py

@@ -0,0 +1,70 @@
+"""test_pre_tool_use_commit.py — T1.6 w3 commit msg 门禁 hook 单测。
+测 _extract_msg + 标记检测 + e2e(advisory/block/has-tag/non-git) via subprocess。
+"""
+import os, sys, json, subprocess
+_HERE = os.path.dirname(os.path.abspath(__file__))
+_HOOK = os.path.abspath(os.path.join(_HERE, "..", "..", "..", "hooks", "pre-tool-use-commit.py"))
+
+P = F = 0
+def check(cond, msg):
+    global P, F
+    if cond: P += 1; print("OK  ", msg)
+    else: F += 1; print("FAIL", msg)
+
+import importlib.util
+spec = importlib.util.spec_from_file_location("pre_tool_use_commit", _HOOK)
+H = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(H)
+
+# ① _extract_msg 各种形式
+check(H._extract_msg('git commit -m "fix: x"') == "fix: x", "-m 双引号")
+check(H._extract_msg("git commit -m 'fix: y'") == "fix: y", "-m 单引号")
+check(H._extract_msg('git commit --message=foo') == "foo", "--message=")
+check(H._extract_msg('git commit -m "title" -m "body"') == "title\nbody", "多 -m 拼接")
+check(H._extract_msg('git commit -am "x" --no-verify') == "x", "-am 混合 flag")
+
+# ② 标记检测
+check(bool(H._REQ_TAG_RE.search("fix: 漏改 [#REQ-a1b2c3d4]")), "[#REQ-uuid] 命中")
+check(bool(H._REQ_TAG_RE.search("feat: x [#761]")), "[#禅道号] 命中")
+check(not H._REQ_TAG_RE.search("fix: 漏改 无标记"), "无标记不命中")
+
+def run_hook(stdin_data, env_block=None):
+    env = dict(os.environ)
+    if env_block is not None:
+        env["WLCOMMIT_GATE_BLOCK"] = env_block
+    else:
+        env.pop("WLCOMMIT_GATE_BLOCK", None)
+    r = subprocess.run([sys.executable, _HOOK], input=json.dumps(stdin_data),
+                       capture_output=True, text=True, env=env, timeout=15)
+    return r.returncode, r.stdout, r.stderr
+
+def mk(cmd): return {"tool_name": "Bash", "tool_input": {"command": cmd}}
+
+# ③ e2e advisory（默认）: 无标记 → exit 0 + stdout 提醒
+rc, out, err = run_hook(mk('git commit -m "fix: 漏改无标记"'))
+check(rc == 0, "advisory 无标记 exit 0(不阻断)")
+check("提醒" in out, "advisory 产 stdout 提醒")
+
+# ④ e2e block（env=1）: 无标记 → exit 2
+rc, out, err = run_hook(mk('git commit -m "fix: 漏改无标记"'), env_block="1")
+check(rc == 2, "BLOCK 模式(env=1) 无标记 exit 2")
+check("硬拦" in err, "BLOCK 产 stderr 硬拦语")
+
+# ⑤ e2e 有标记 → exit 0 无提醒（任何模式）
+rc, out, err = run_hook(mk('git commit -m "fix: x [#REQ-a1b2c3d4]"'), env_block="1")
+check(rc == 0 and "提醒" not in out, "有标记放行(BLOCK 模式也不拦)")
+
+# ⑥ 非 git commit 命令 → exit 0 静默
+rc, out, err = run_hook(mk('git push origin main'))
+check(rc == 0 and out == "" and err == "", "非 git commit 静默放行")
+
+# ⑦ 非 Bash 工具 → exit 0
+rc, out, err = run_hook({"tool_name": "Write", "tool_input": {"file_path": "x.py"}})
+check(rc == 0, "非 Bash 工具放行")
+
+# ⑧ platform/dev commit（无标记，advisory）也不硬断 → exit 0（不误拦其他）
+rc, out, err = run_hook(mk('git commit -m "chore: 改文档"'))
+check(rc == 0, "advisory 默认不误拦工具/文档 commit")
+
+print("\n%d passed, %d failed" % (P, F))
+sys.exit(0 if F == 0 else 1)

package/templates/qoder/skills/wl-spec/SKILL.md

@@ -18,7 +18,7 @@ PY=$(python --version >/dev/null 2>&1 && echo python || echo python3)
 
 > 这是 `/wl-spec` 命令的 skill 入口。让 QoderWork 的 `/` 列表也能用 `/wl-spec`。
 > 完整规则见功能型 skill `.qoder/skills/spec-generator/SKILL.md`
-> 和命令 `.qoder/commands/wl-spec.md`。
+> 和命令 `.qoder/commands/optional/wl-spec.md`。
 > **模块契约**（输入/输出/校验）：`.qoder/contracts/spec.md`
 
 ## ⚙️ 自取上下文（Quest / QoderWork 无 hook 注入，必须自读）