@jsonstudio/rcc 0.89.1121 → 0.89.1189

package/scripts/policy-violations-report.mjs

@@ -0,0 +1,257 @@
+#!/usr/bin/env node
+/**
+ * Report Unified Hub policy violations/enforcement rewrites captured under:
+ *   ~/.routecodex/codex-samples/__policy_violations__/
+ *
+ * This is intended for day-to-day monitoring when policy is enabled by default.
+ */
+
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+function usage() {
+  console.log(`Usage:
+  node scripts/policy-violations-report.mjs [options]
+
+Options:
+  --root <dir>          default: ~/.routecodex/codex-samples/__policy_violations__
+  --since-hours <n>     only include files modified in last N hours
+  --limit <n>           limit printed rows per section (default: 30)
+  --fail                exit 1 if any records found
+  --help                show help
+`);
+}
+
+function parseArgs(argv) {
+  const out = {
+    root: path.join(os.homedir(), '.routecodex', 'errorsamples', 'policy'),
+    sinceHours: undefined,
+    limit: 30,
+    fail: false
+  };
+  for (let i = 2; i < argv.length; i += 1) {
+    const a = argv[i];
+    if (a === '--root' && i + 1 < argv.length) out.root = argv[++i];
+    else if (a === '--since-hours' && i + 1 < argv.length) out.sinceHours = Number(argv[++i]);
+    else if (a === '--limit' && i + 1 < argv.length) out.limit = Number(argv[++i]);
+    else if (a === '--fail') out.fail = true;
+    else if (a === '--help' || a === '-h') out.help = true;
+    else {
+      console.error(`Unknown arg: ${a}`);
+      out.help = true;
+    }
+  }
+  return out;
+}
+
+async function fileExists(p) {
+  try {
+    await fs.access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function walk(dir) {
+  const out = [];
+  const stack = [dir];
+  while (stack.length) {
+    const current = stack.pop();
+    let entries = [];
+    try {
+      entries = await fs.readdir(current, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const ent of entries) {
+      const p = path.join(current, ent.name);
+      if (ent.isDirectory()) stack.push(p);
+      else if (ent.isFile() && ent.name.endsWith('.json')) out.push(p);
+    }
+  }
+  return out;
+}
+
+function inc(map, key, by = 1) {
+  map.set(key, (map.get(key) || 0) + by);
+}
+
+function topN(map, n) {
+  return [...map.entries()].sort((a, b) => b[1] - a[1]).slice(0, n);
+}
+
+async function readJson(p) {
+  try {
+    const raw = await fs.readFile(p, 'utf8');
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+
+function classifyRecord(obj) {
+  if (!obj || typeof obj !== 'object') return { kind: 'unknown' };
+  const o = obj;
+  if (Array.isArray(o.violations) || (o.summary && typeof o.summary === 'object')) return { kind: 'observe' };
+  if (Array.isArray(o.removedTopLevelKeys) || Array.isArray(o.flattenedWrappers)) return { kind: 'enforce' };
+  return { kind: 'unknown' };
+}
+
+function safeString(value) {
+  return typeof value === 'string' && value.trim() ? value.trim() : '';
+}
+
+function inferStageFromFilename(filePath) {
+  const base = path.basename(filePath, '.json');
+  return base.replace(/_[0-9]+$/, '');
+}
+
+function fmtRow(cols, widths) {
+  return cols
+    .map((c, i) => {
+      const w = widths[i] || 20;
+      const s = String(c ?? '');
+      return s.length > w ? `${s.slice(0, Math.max(0, w - 1))}…` : s.padEnd(w, ' ');
+    })
+    .join('  ');
+}
+
+async function main() {
+  const args = parseArgs(process.argv);
+  if (args.help) {
+    usage();
+    process.exit(0);
+  }
+  let root = path.resolve(args.root);
+  if (!(await fileExists(root))) {
+    const fallback = path.join(os.homedir(), '.routecodex', 'codex-samples', '__policy_violations__');
+    if (await fileExists(fallback)) {
+      root = fallback;
+    } else {
+      console.log(`[policy-report] no folder: ${root}`);
+      process.exit(0);
+    }
+  }
+
+  const sinceMs =
+    typeof args.sinceHours === 'number' && Number.isFinite(args.sinceHours) && args.sinceHours > 0
+      ? Date.now() - args.sinceHours * 60 * 60 * 1000
+      : null;
+
+  const files = await walk(root);
+  const rows = [];
+  for (const file of files) {
+    let st;
+    try {
+      st = await fs.stat(file);
+    } catch {
+      continue;
+    }
+    if (sinceMs !== null && st.mtimeMs < sinceMs) continue;
+    const obj = await readJson(file);
+    if (!obj) continue;
+    const rel = path.relative(root, file);
+    const parts = rel.split(path.sep);
+    const endpointFolder = parts[0] || '';
+    const providerKey = parts[1] || '';
+    const requestId = parts[2] || '';
+    rows.push({
+      file,
+      rel,
+      endpointFolder,
+      providerKey,
+      requestId,
+      stage: safeString(obj?.stage) || safeString(obj?.meta?.stage) || inferStageFromFilename(file),
+      protocol: safeString(obj?.providerProtocol) || safeString(obj?.protocol),
+      kind: classifyRecord(obj).kind,
+      obj
+    });
+  }
+
+  console.log(`[policy-report] root=${root}`);
+  if (sinceMs !== null) {
+    console.log(`[policy-report] sinceHours=${args.sinceHours}`);
+  }
+  console.log(`[policy-report] records=${rows.length}`);
+  if (!rows.length) {
+    process.exit(0);
+  }
+
+  const byStage = new Map();
+  const byProtocol = new Map();
+  const violationPathCounts = new Map();
+  const wrapperCounts = new Map();
+  const removedKeyCounts = new Map();
+
+  for (const r of rows) {
+    inc(byStage, r.stage);
+    if (r.protocol) inc(byProtocol, r.protocol);
+
+    if (r.kind === 'observe' && Array.isArray(r.obj?.violations)) {
+      for (const v of r.obj.violations) {
+        const p = safeString(v?.path) || '(unknown)';
+        inc(violationPathCounts, p);
+      }
+    }
+    if (r.kind === 'enforce') {
+      const flattened = Array.isArray(r.obj?.flattenedWrappers) ? r.obj.flattenedWrappers : [];
+      for (const w of flattened) inc(wrapperCounts, String(w));
+      const removed = Array.isArray(r.obj?.removedTopLevelKeys) ? r.obj.removedTopLevelKeys : [];
+      for (const k of removed) inc(removedKeyCounts, String(k));
+    }
+  }
+
+  const limit = Number.isFinite(args.limit) && args.limit > 0 ? args.limit : 30;
+
+  console.log('\n[policy-report] top stages:');
+  for (const [k, v] of topN(byStage, limit)) {
+    console.log(`- ${k}: ${v}`);
+  }
+
+  console.log('\n[policy-report] top protocols:');
+  for (const [k, v] of topN(byProtocol, limit)) {
+    console.log(`- ${k}: ${v}`);
+  }
+
+  if (violationPathCounts.size) {
+    console.log('\n[policy-report] top violation paths:');
+    for (const [k, v] of topN(violationPathCounts, limit)) {
+      console.log(`- ${k}: ${v}`);
+    }
+  }
+
+  if (wrapperCounts.size) {
+    console.log('\n[policy-report] top flattened wrappers (enforce):');
+    for (const [k, v] of topN(wrapperCounts, limit)) {
+      console.log(`- ${k}: ${v}`);
+    }
+  }
+
+  if (removedKeyCounts.size) {
+    console.log('\n[policy-report] top removed keys (enforce):');
+    for (const [k, v] of topN(removedKeyCounts, limit)) {
+      console.log(`- ${k}: ${v}`);
+    }
+  }
+
+  console.log('\n[policy-report] newest records:');
+  const newest = rows
+    .slice()
+    .sort((a, b) => (a.file < b.file ? 1 : -1))
+    .slice(0, Math.min(limit, rows.length));
+  console.log(fmtRow(['endpoint', 'providerKey', 'stage', 'protocol', 'requestId'], [16, 28, 40, 18, 24]));
+  for (const r of newest) {
+    console.log(fmtRow([r.endpointFolder, r.providerKey, r.stage, r.protocol || '-', r.requestId], [16, 28, 40, 18, 24]));
+  }
+
+  if (args.fail) {
+    process.exit(1);
+  }
+}
+
+main().catch((err) => {
+  console.error('[policy-report] failed:', err);
+  process.exit(2);
+});

package/scripts/publish-rcc.mjs

@@ -8,6 +8,7 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const PROJECT_ROOT = path.resolve(__dirname, '..');
 const PACK_SCRIPT = path.join(PROJECT_ROOT, 'scripts', 'pack-mode.mjs');
 const pkgPath = path.join(PROJECT_ROOT, 'package.json');
+const llmsPath = path.join(PROJECT_ROOT, 'node_modules', '@jsonstudio', 'llms');
 
 function run(command, args, options = {}) {
   const res = spawnSync(command, args, { stdio: 'inherit', ...options });
@@ -17,6 +18,14 @@ function run(command, args, options = {}) {
 }
 
 try {
+  const hadDevLink = (() => {
+    try {
+      return fs.lstatSync(llmsPath).isSymbolicLink();
+    } catch {
+      return false;
+    }
+  })();
+
   // 1) 使用 release 模式构建 dist（依赖 npm 上的 @jsonstudio/llms）
   run('npm', ['run', 'build:min'], {
     cwd: PROJECT_ROOT,
@@ -39,8 +48,13 @@ try {
   // 3) 发布 npm 包
   run('npm', ['publish', tarballName], { cwd: PROJECT_ROOT });
 
-  // 4) pack-mode 会在内部检测 dev 链接并调用 ensure-llmswitch-mode 恢复 dev 模式，
-  //    因此此处不再额外修改 BUILD_MODE 或重新 link。后续本地如需 dev build，可单独运行 `npm run build:dev`。
+  // 4) 发布结束后恢复 dev 模式（routecodex 约定始终为 dev CLI；rcc 发布时才切 release）。
+  if (hadDevLink) {
+    run('npm', ['run', 'llmswitch:ensure'], {
+      cwd: PROJECT_ROOT,
+      env: { ...process.env, BUILD_MODE: 'dev' }
+    });
+  }
 } catch (err) {
   console.error('[publish-rcc] failed:', err.message);
   process.exit(1);

package/scripts/scan-apply-patch-samples.mjs

@@ -17,6 +17,7 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
+import crypto from 'node:crypto';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -27,8 +28,13 @@ const coreLoaderUrl = pathToFileURL(coreLoaderPath).href;
 
 const HOME = os.homedir();
 const USER_CODEX_ROOT = path.join(HOME, '.routecodex', 'codex-samples');
+const USER_CODEX_ROOT_ALT = path.join(HOME, '.routecodex', 'codex samples');
 const USER_CODEX_PENDING = path.join(USER_CODEX_ROOT, 'openai-chat', '__pending__');
 const REPO_GOLDENS_ROOT = path.join(repoRoot, 'samples', 'ci-goldens');
+const ERROR_SAMPLES_ROOT = path.join(HOME, '.routecodex', 'errorsamples', 'apply_patch');
+
+const DEFAULT_CAPTURE_TOTAL_LIMIT = 5000;
+const DEFAULT_CAPTURE_PER_REASON_LIMIT = 250;
 
 async function fileExists(p) {
   try {
@@ -111,6 +117,74 @@ function extractApplyPatchArgs(doc, { allowRegressionOriginalArgs } = { allowReg
   return out;
 }
 
+function isContextMismatchReason(reason) {
+  // We only capture/repair shape issues; context mismatches are not actionable here.
+  // Keep this conservative: if a new reason is introduced, we still capture it unless
+  // it clearly indicates a context mismatch.
+  if (!reason) return false;
+  const r = String(reason);
+  return (
+    r.includes('context') ||
+    r.includes('expected') ||
+    r.includes('hunk') ||
+    r.includes('no_match') ||
+    r.includes('not_found')
+  );
+}
+
+function stableHash(input) {
+  return crypto.createHash('sha256').update(input).digest('hex').slice(0, 16);
+}
+
+async function captureFailure({
+  destRoot,
+  label,
+  sourceFile,
+  reason,
+  originalArgs,
+  validationResult,
+  captureState,
+}) {
+  if (isContextMismatchReason(reason)) return;
+  if (captureState?.reasonAllowList && !captureState.reasonAllowList.has(reason)) return;
+  if (!destRoot) return;
+
+  const totalLimit = captureState.totalLimit ?? DEFAULT_CAPTURE_TOTAL_LIMIT;
+  const perReasonLimit = captureState.perReasonLimit ?? DEFAULT_CAPTURE_PER_REASON_LIMIT;
+  if (captureState.totalCaptured >= totalLimit) return;
+
+  const currentReasonCount = captureState.byReason.get(reason) ?? 0;
+  if (currentReasonCount >= perReasonLimit) return;
+
+  const key = `${label}\n${reason}\n${sourceFile}\n${originalArgs}`;
+  const filename = `sample_${stableHash(key)}.json`;
+  const folder = path.join(destRoot, reason);
+  const outPath = path.join(folder, filename);
+
+  try {
+    await fs.access(outPath);
+    return;
+  } catch {
+    // continue
+  }
+
+  await fs.mkdir(folder, { recursive: true });
+  const payload = {
+    tool: 'apply_patch',
+    label,
+    reason,
+    capturedAt: new Date().toISOString(),
+    sourceFile,
+    argsSha256: crypto.createHash('sha256').update(originalArgs).digest('hex'),
+    originalArgs,
+    validationResult,
+  };
+  await fs.writeFile(outPath, JSON.stringify(payload, null, 2), 'utf-8');
+
+  captureState.totalCaptured += 1;
+  captureState.byReason.set(reason, currentReasonCount + 1);
+}
+
 async function loadValidator() {
   if (!(await fileExists(coreLoaderPath))) {
     throw new Error(`core-loader missing at ${coreLoaderPath} (run npm run build:dev first)`);
@@ -123,7 +197,7 @@ async function loadValidator() {
   return { validateToolCall };
 }
 
-async function scanRoot(label, rootDir, validateToolCall) {
+async function scanRoot(label, rootDir, validateToolCall, capture) {
   if (!(await fileExists(rootDir))) {
     return { label, rootDir, files: 0, calls: 0, ok: 0, byReason: new Map(), examples: [] };
   }
@@ -168,6 +242,17 @@ async function scanRoot(label, rootDir, validateToolCall) {
       const cur = byReason.get(reason) || { count: 0 };
       cur.count += 1;
       byReason.set(reason, cur);
+      if (capture?.enabled) {
+        await captureFailure({
+          destRoot: capture.destRoot,
+          label,
+          sourceFile: filePath,
+          reason,
+          originalArgs: args,
+          validationResult: res,
+          captureState: capture.state,
+        });
+      }
       if (examples.length < 12) {
         examples.push({ file: filePath, reason });
       }
@@ -200,17 +285,73 @@ function printReport(report) {
 async function main() {
   const { validateToolCall } = await loadValidator();
 
-  const repo = await scanRoot('repo samples/ci-goldens', REPO_GOLDENS_ROOT, validateToolCall);
+  const captureEnabled = process.argv.slice(2).includes('--capture') || process.env.ROUTECODEX_SCAN_CAPTURE === '1';
+  const captureRepo = process.argv.slice(2).includes('--capture-repo') || process.env.ROUTECODEX_SCAN_CAPTURE_REPO === '1';
+  const captureRoot = process.env.ROUTECODEX_ERRORSAMPLES_DIR || ERROR_SAMPLES_ROOT;
+  const totalLimit = Number.parseInt(process.env.ROUTECODEX_CAPTURE_TOTAL_LIMIT || '', 10);
+  const perReasonLimit = Number.parseInt(process.env.ROUTECODEX_CAPTURE_PER_REASON_LIMIT || '', 10);
+  const reasonsArg = process.argv
+    .slice(2)
+    .find((arg) => arg.startsWith('--capture-reasons='))
+    ?.split('=')[1];
+  const reasonsEnv = process.env.ROUTECODEX_CAPTURE_REASONS;
+  const reasonAllowListRaw = (reasonsArg || reasonsEnv || '').trim();
+  const reasonAllowList = reasonAllowListRaw
+    ? new Set(
+        reasonAllowListRaw
+          .split(',')
+          .map((s) => s.trim())
+          .filter(Boolean)
+      )
+    : null;
+  const captureState = {
+    totalCaptured: 0,
+    totalLimit: Number.isFinite(totalLimit) ? totalLimit : DEFAULT_CAPTURE_TOTAL_LIMIT,
+    perReasonLimit: Number.isFinite(perReasonLimit) ? perReasonLimit : DEFAULT_CAPTURE_PER_REASON_LIMIT,
+    byReason: new Map(),
+    reasonAllowList,
+  };
+
+  const repo = await scanRoot('repo samples/ci-goldens', REPO_GOLDENS_ROOT, validateToolCall, {
+    enabled: captureEnabled && captureRepo,
+    destRoot: captureRoot,
+    state: captureState,
+  });
   printReport(repo);
 
   const userAll = process.argv.slice(2).includes('--user-all');
-  const userRoot = userAll && (await fileExists(USER_CODEX_ROOT)) ? USER_CODEX_ROOT : (await fileExists(USER_CODEX_PENDING)) ? USER_CODEX_PENDING : USER_CODEX_ROOT;
-  const user = await scanRoot(`user ${userAll ? '~/.routecodex/codex-samples (all)' : '~/.routecodex/codex-samples/openai-chat/__pending__'}`, userRoot, validateToolCall);
-  printReport(user);
+  const userRoots = [];
+  if (userAll) {
+    if (await fileExists(USER_CODEX_ROOT)) userRoots.push({ label: 'user ~/.routecodex/codex-samples (all)', root: USER_CODEX_ROOT });
+    if (await fileExists(USER_CODEX_ROOT_ALT))
+      userRoots.push({ label: 'user ~/.routecodex/codex samples (all)', root: USER_CODEX_ROOT_ALT });
+  } else {
+    const pending = (await fileExists(USER_CODEX_PENDING)) ? USER_CODEX_PENDING : null;
+    if (pending) userRoots.push({ label: 'user ~/.routecodex/codex-samples/openai-chat/__pending__', root: pending });
+    else if (await fileExists(USER_CODEX_ROOT)) userRoots.push({ label: 'user ~/.routecodex/codex-samples', root: USER_CODEX_ROOT });
+    else if (await fileExists(USER_CODEX_ROOT_ALT)) userRoots.push({ label: 'user ~/.routecodex/codex samples', root: USER_CODEX_ROOT_ALT });
+    else userRoots.push({ label: 'user ~/.routecodex/codex-samples', root: USER_CODEX_ROOT });
+  }
 
-  const totalCalls = repo.calls + user.calls;
-  const totalOk = repo.ok + user.ok;
+  const userReports = [];
+  for (const entry of userRoots) {
+    const report = await scanRoot(entry.label, entry.root, validateToolCall, {
+      enabled: captureEnabled,
+      destRoot: captureRoot,
+      state: captureState,
+    });
+    userReports.push(report);
+    printReport(report);
+  }
+
+  const totalCalls = repo.calls + userReports.reduce((sum, r) => sum + r.calls, 0);
+  const totalOk = repo.ok + userReports.reduce((sum, r) => sum + r.ok, 0);
   console.log(`\n[scan] TOTAL apply_patch_calls=${totalCalls} ok=${totalOk} fail=${totalCalls - totalOk}`);
+  if (captureEnabled) {
+    console.log(
+      `[scan] captured_failures=${captureState.totalCaptured} dest=${captureRoot} (per_reason<=${captureState.perReasonLimit}, total<=${captureState.totalLimit})`
+    );
+  }
 
   process.exitCode = totalCalls - totalOk > 0 ? 1 : 0;
 }

package/scripts/tests/unified-hub-responses-enforce-safe.mjs

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+function runCase(args) {
+  const nodeArgs = ['scripts/unified-hub-shadow-compare.mjs', ...args];
+  const result = spawnSync(process.execPath, nodeArgs, {
+    cwd: path.resolve(path.dirname(new URL(import.meta.url).pathname), '..', '..'),
+    stdio: 'inherit'
+  });
+  if (result.status !== 0) {
+    throw new Error(`shadow compare failed: ${nodeArgs.join(' ')}`);
+  }
+}
+
+function main() {
+  const repoRoot = path.resolve(path.dirname(new URL(import.meta.url).pathname), '..', '..');
+  const fixturesDir = path.join(repoRoot, 'tests', 'fixtures', 'unified-hub');
+
+  runCase([
+    '--request',
+    path.join(fixturesDir, 'responses.clean.json'),
+    '--entry-endpoint',
+    '/v1/responses',
+    '--route-hint',
+    'responses',
+    '--baseline-mode',
+    'off',
+    '--candidate-mode',
+    'enforce'
+  ]);
+
+  console.log('[unified-hub-responses-enforce-safe] OK');
+}
+
+main();
+

package/scripts/tests/unified-hub-shadow-regression.mjs

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+function runCase(args) {
+  const nodeArgs = ['scripts/unified-hub-shadow-compare.mjs', ...args];
+  const result = spawnSync(process.execPath, nodeArgs, {
+    cwd: path.resolve(path.dirname(new URL(import.meta.url).pathname), '..', '..'),
+    stdio: 'inherit'
+  });
+  if (result.status !== 0) {
+    throw new Error(`shadow compare failed: ${nodeArgs.join(' ')}`);
+  }
+}
+
+function main() {
+  const repoRoot = path.resolve(path.dirname(new URL(import.meta.url).pathname), '..', '..');
+  const fixturesDir = path.join(repoRoot, 'tests', 'fixtures', 'unified-hub');
+  if (!fs.existsSync(fixturesDir)) {
+    throw new Error(`fixtures dir missing: ${fixturesDir}`);
+  }
+
+  runCase([
+    '--request',
+    path.join(fixturesDir, 'chat.json'),
+    '--entry-endpoint',
+    '/v1/chat/completions',
+    '--route-hint',
+    'openai'
+  ]);
+
+  runCase([
+    '--request',
+    path.join(fixturesDir, 'responses.json'),
+    '--entry-endpoint',
+    '/v1/responses',
+    '--route-hint',
+    'responses'
+  ]);
+
+  runCase([
+    '--request',
+    path.join(fixturesDir, 'anthropic.json'),
+    '--entry-endpoint',
+    '/v1/messages',
+    '--route-hint',
+    'anthropic'
+  ]);
+
+  console.log('[unified-hub-shadow-regression] OK');
+}
+
+main();
+