@michaelxwb/code-flow 0.6.1 → 0.6.3

package/src/core/code-flow/scripts/cf_exec_base.py

@@ -0,0 +1,112 @@
+#!/usr/bin/env python3
+"""Shared execution substrate: deadline-aware argv subprocess runner.
+
+All check executors (acceptance scenarios, Spec verifiers, session
+validators) funnel through here so one entry deadline constrains the whole
+chain, commands never pass through a shell, and unrun work is reported as
+`incomplete` instead of silently skipped or falsely passed.
+"""
+
+from __future__ import annotations
+
+import shlex
+import json
+import subprocess
+import time
+from contextlib import contextmanager
+from contextvars import ContextVar
+from pathlib import Path
+from typing import Iterator, Mapping, Optional, Sequence
+
+_EXECUTIONS: ContextVar[Optional[dict[str, dict[str, object]]]] = ContextVar("cf_executions", default=None)
+
+
+@contextmanager
+def execution_session() -> Iterator[None]:
+    """Share results only inside one validation operation, never across turns."""
+    if _EXECUTIONS.get() is not None:
+        yield
+        return
+    token = _EXECUTIONS.set({})
+    try:
+        yield
+    finally:
+        _EXECUTIONS.reset(token)
+
+
+def invalidate_executions() -> None:
+    cache = _EXECUTIONS.get()
+    if cache is not None:
+        cache.clear()
+
+
+def execution_key(argv: Sequence[str], cwd: str, timeout: float) -> str:
+    """Identity of a command under the current process environment."""
+    return json.dumps([list(argv), str(Path(cwd).resolve()), float(timeout)], ensure_ascii=False)
+
+
+def remaining_seconds(deadline: Optional[float]) -> Optional[float]:
+    """Seconds left until the absolute monotonic deadline (None = unbounded)."""
+    if deadline is None:
+        return None
+    return deadline - time.monotonic()
+
+
+def build_argv(template: str, files: Sequence[str]) -> list[str]:
+    """Expand a validator command template into argv without a shell.
+
+    `{files}` must be a standalone token and expands to one argv entry per
+    file (spaces/metachars safe). Embedded usage is a config error — refusing
+    is safer than reintroducing shell splitting.
+    """
+    tokens = shlex.split(template or "")
+    if not tokens:
+        return []
+    argv: list[str] = []
+    for token in tokens:
+        if token == "{files}":
+            argv.extend(files)
+        elif "{files}" in token:
+            raise ValueError(f"validator command must keep {{files}} as a standalone token: {template!r}")
+        else:
+            argv.append(token)
+    return argv
+
+
+def run_command(
+    argv: Sequence[str],
+    cwd: str,
+    timeout: float,
+    deadline: Optional[float] = None,
+) -> dict[str, object]:
+    """Run argv synchronously under timeout+deadline. Never uses a shell."""
+    key = execution_key(argv, cwd, timeout)
+    cache = _EXECUTIONS.get()
+    if cache is not None and key in cache:
+        return dict(cache[key])
+    result = _execute(argv, cwd, timeout, deadline)
+    if cache is not None and result["status"] == "ok":
+        cache[key] = result
+    return result
+
+
+def _execute(argv: Sequence[str], cwd: str, timeout: float, deadline: Optional[float]) -> dict[str, object]:
+    remaining = remaining_seconds(deadline)
+    if remaining is not None and remaining <= 0:
+        return {"status": "deadline_exceeded", "returncode": None, "stdout": "", "stderr": ""}
+    effective = min(timeout, remaining) if remaining is not None else timeout
+    try:
+        proc = subprocess.run(
+            list(argv), cwd=cwd, capture_output=True, text=True, timeout=max(effective, 0.01)
+        )
+    except subprocess.TimeoutExpired as exc:
+        out = exc.stdout
+        return {
+            "status": "timeout",
+            "returncode": None,
+            "stdout": (out.decode() if isinstance(out, bytes) else (out or ""))[-4000:],
+            "stderr": "",
+        }
+    except OSError as exc:
+        return {"status": "spawn_error", "returncode": None, "stdout": "", "stderr": str(exc)}
+    return {"status": "ok", "returncode": proc.returncode, "stdout": proc.stdout or "", "stderr": proc.stderr or ""}

package/src/core/code-flow/scripts/cf_post_hook.py

@@ -40,6 +40,7 @@ from cf_core import (
     resolve_enforcement,
     resolve_quality_loop,
     resolve_session_id,
+    timing_log,
 )
 
 FEEDBACK_HINT = '如认为误报，直接告诉我"这是误报"，我会标记忽略。'
@@ -191,3 +192,4 @@ def main() -> None:
 
 if __name__ == "__main__":
     main()
+    timing_log("cf_post_hook")

package/src/core/code-flow/scripts/cf_pre_tool_hook.py

@@ -11,10 +11,10 @@ from pathlib import Path
 import sys
 
 import cf_log
-from cf_core import _log, ensure_utf8_io, load_config, normalize_path, resolve_enforcement, resolve_session_id
+from cf_core import _log, ensure_utf8_io, load_config, normalize_path, resolve_enforcement, resolve_session_id, timing_log
 from cf_session_state import load_session_state, save_session_state
-from cf_spec_context import load_active_task, load_context
-from cf_spec_resolver import resolve_candidates
+from cf_spec_context import injection_version, load_active_task, load_context
+from cf_spec_resolver import resolve_candidate_headers
 from cf_spec_router import RouterError, route_prompt
 
 _WARN_TEXT = "⚠ Spec Workflow 校验未通过（warn 模式）：{message} — 建议运行 cf-spec doctor 检查。"
@@ -28,8 +28,9 @@ def _active_expansion(root: str, relative: str) -> tuple[str, ...]:
     context = load_context(str(Path(root) / active.task_dir / "spec-context.yml"))
     bound = {item.spec_id for item in context.bindings}
     return tuple(
-        item.spec_id for item in resolve_candidates(root, "code", (relative,))
-        if item.spec_id not in bound and item.metadata.enforcement == "required"
+        item.spec_id for item in resolve_candidate_headers(root, "code", (relative,))
+        if item.spec_id not in bound and item.enforcement == "required"
+        and getattr(item, "scope", "path") != "unmatched"
     )
 
 
@@ -70,12 +71,15 @@ def main() -> None:
         text = result.text
         if result.mode == "task" and result.context_sha256:
             # The projection is already in context from the prompt route unless
-            # the bound rules changed; skip per-edit re-injection.
+            # the session/task/contract version changed; skip per-edit
+            # re-injection. Same version key as the prompt hook so a TASK
+            # switch re-injects here too.
             state = load_session_state(root)
-            if state.get("injected_sha256") == result.context_sha256:
+            version = injection_version(root, sid, result.context_sha256)
+            if state.get("injected_version") == version:
                 text = ""
             else:
-                state["injected_sha256"] = result.context_sha256
+                state["injected_version"] = version
                 save_session_state(root, state)
         if text:
             sys.stdout.write(json.dumps(_inject(text), ensure_ascii=False))
@@ -86,3 +90,4 @@ def main() -> None:
 
 if __name__ == "__main__":
     main()
+    timing_log("cf_pre_tool_hook")

package/src/core/code-flow/scripts/cf_scan.py

@@ -11,6 +11,7 @@ from cf_core import (
     build_spec_catalog,
     estimate_tokens,
     load_config,
+    project_instruction_file,
     non_injectable_specs,
     parse_spec_frontmatter,
 )
@@ -120,19 +121,20 @@ def find_missing_paths(text: str, project_root: str, base_dir: str = "") -> list
     return sorted(missing)
 
 
-def build_report(project_root: str) -> dict:
+def build_report(project_root: str, platform: str = "") -> dict:
     """规范质量审计数据（cf-scan 引擎，亦供 cf-stats --audit 复用）。
 
     files 含 issues / template 标记，review 为待复审清单；展示层负责过滤与渲染。"""
     files = []
     total_tokens = 0
 
-    claude_path = os.path.join(project_root, "CLAUDE.md")
+    instruction_file = project_instruction_file(project_root, platform)
+    claude_path = os.path.join(project_root, instruction_file)
     if os.path.exists(claude_path):
         content = read_text(claude_path)
         tokens = estimate_tokens(content)
         total_tokens += tokens
-        files.append({"path": "CLAUDE.md", "tokens": tokens, "issues": []})
+        files.append({"path": instruction_file, "tokens": tokens, "issues": []})
 
     specs_root = os.path.join(project_root, ".code-flow", "specs")
     specs = []
@@ -142,14 +144,14 @@ def build_report(project_root: str) -> dict:
                 if not name.endswith(".md"):
                     continue
                 full_path = os.path.join(root, name)
+                rel = os.path.relpath(full_path, specs_root)
+                if rel.replace(os.sep, "/").startswith("_session/"):
+                    continue
                 content = read_text(full_path)
                 if not content:
                     continue
                 tokens = estimate_tokens(content)
                 total_tokens += tokens
-                rel = os.path.relpath(full_path, specs_root)
-                if rel.replace(os.sep, "/").startswith("_session/"):
-                    continue  # 会话级临时约束（FEAT-08）不参与审计与预算
                 rel_path = os.path.join("specs", rel).replace(os.sep, "/")
                 spec_entry = {
                     "path": rel_path,