@qijenchen/design-system 0.1.0-beta.56 → 0.1.0-beta.58

package/ds-canonical/hooks/inject_deploy_url_after_push.sh

@@ -36,7 +36,11 @@ CMD=$(echo "$INPUT" | jq -r '.tool_input.command // ""' 2>/dev/null)
 [ "$TOOL" != "Bash" ] && exit 0
 
 # Heuristic:detect `git push origin <branch>` patterns
-if ! echo "$CMD" | grep -qE '\bgit\s+push\s+(-u\s+)?origin\b'; then
+# 2026-06-06 fix:要求 `git push` 出現在「命令邊界」(行首 / ; / && / || / $( ),
+# 否則 `P='git push origin'` 賦值、`echo "git push origin"`、`grep 'git push origin'` 等
+# 「字串裡提到 push」會誤觸發 → falls-back 到 current branch 吐 404 preview URL 注入 context。
+# 命令邊界 = 真的在執行 push,字串提及 = 噪音。對齊「只在真推送時 relay deploy URL」root invariant。
+if ! echo "$CMD" | grep -qE '(^|[;&|(])[[:space:]]*git[[:space:]]+push[[:space:]]+(-u[[:space:]]+)?origin\b'; then
   exit 0
 fi
 
@@ -47,7 +51,29 @@ fi
 
 CWD=$(pwd)
 URLS_FOUND=""
-BRANCH=$(echo "$CMD" | grep -oE 'origin\s+\S+' | awk '{print $2}' | head -1)
+# 2026-06-07 ROOT fix:只從「git push ... origin <ref>」這一段擷取 branch,不是整條 compound command 的
+# 第一個 `origin X`。否則 `git fetch origin --quiet && git push origin main` 會誤抓 fetch 段的 `--quiet`
+# 當 branch → 推導 `--quiet--site` 404(此前 5 道 guard 都沒擋到,因 `--quiet` 全是合法 git ref 字元)。
+# 隔出 push 段(到下個 command 分隔 ; & | 為止)後,取 origin 後第一個 token。
+PUSH_SEG=$(echo "$CMD" | grep -oE '(^|[;&|(])[[:space:]]*git[[:space:]]+push[[:space:]][^;&|]*' | head -1)
+BRANCH=$(echo "$PUSH_SEG" | grep -oE 'origin[[:space:]]+[^[:space:]]+' | head -1 | awk '{print $2}')
+# origin 後第一個 token 是 flag(`git push origin --force` = 無顯式 branch)→ 清空走 current-branch fallback
+case "$BRANCH" in -*) BRANCH="" ;; esac
+# 2026-06-06 fix:refspec `src:dst` → 取 dst(`HEAD:main` → `main`),否則推導出 `HEAD:main--site` 404 URL
+case "$BRANCH" in *:*) BRANCH="${BRANCH##*:}" ;; esac
+# 2026-06-06 fix:`git push origin HEAD`(或 `@`)= symbolic ref 指向當前 branch → 解析成真 branch 名,
+# 否則把字面 "HEAD" 當 branch 推導出 `HEAD--site` 404 URL(real push 常用此式,會誤吐)。
+if [ "$BRANCH" = "HEAD" ] || [ "$BRANCH" = "@" ]; then
+  BRANCH=$(git -C "$CWD" branch --show-current 2>/dev/null || echo "")
+fi
+# 2026-06-06 fix:BRANCH 含非法 git ref 字元(" ' 空白 \ 等)→ 此命令只是「字串裡含 git push origin」
+# (測試迴圈 / 文件 / echo),非真推送 → skip,避免把 `main"` 等垃圾推導成 404 URL 注入 context。
+# git ref 合法字元集 ⊂ [A-Za-z0-9._/-];非此集 = 必為解析噪音(root guard,涵蓋 refspec/tag 之外的雜訊)。
+if [ -n "$BRANCH" ] && ! echo "$BRANCH" | grep -qE '^[A-Za-z0-9._/-]+$'; then exit 0; fi
+# 2026-06-06 fix:tag push(`v1.2.3` 等)不產 branch-preview / production deploy → skip,
+# 否則把 tag 名當 branch 推導出 `v0.1.0-beta.56--site` 404 URL(release tag push 每次都誤吐)
+if echo "$BRANCH" | grep -qE '^v[0-9]'; then exit 0; fi
+if [ -n "$BRANCH" ] && git -C "$CWD" rev-parse --verify --quiet "refs/tags/$BRANCH" >/dev/null 2>&1; then exit 0; fi
 [ -z "$BRANCH" ] && BRANCH=$(git -C "$CWD" branch --show-current 2>/dev/null || echo "main")
 
 # v3 2026-05-27:curl HEAD verify URL before reporting(per user「你確定有做到」complaint)

package/ds-canonical/hooks/tests/test_inject_deploy_url_after_push.sh

@@ -0,0 +1,135 @@
+#!/bin/bash
+# Tests for inject_deploy_url_after_push.sh
+#
+# 鎖住 2026-06-06 收斂的「只在真推送 + 真 branch 時 relay deploy URL」root invariant,
+# 防 refspec / symbolic-ref / tag / 解析噪音 / 字串提及 等再吐 404 URL 進 context。
+
+set -u
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+HOOK="$SCRIPT_DIR/../inject_deploy_url_after_push.sh"
+[ -f "$HOOK" ] || { echo "FATAL: hook not found"; exit 1; }
+
+PASS=0; FAIL=0; FAILED=""
+
+# 建一個臨時 git repo(branch=feature-test)+ netlify.toml,讓 Detection 2 可達;
+# HOME 指向空 temp 確保無 USER_OVERRIDE(hermetic,不碰真實機 deploy-targets.json)。
+setup() {
+  TMP=$(mktemp -d)
+  mkdir -p "$TMP/home"
+  (
+    cd "$TMP" || exit 1
+    git init -q -b feature-test 2>/dev/null || { git init -q; git checkout -q -b feature-test; }
+    : > netlify.toml
+    git add -A 2>/dev/null
+    GIT_AUTHOR_NAME=t GIT_AUTHOR_EMAIL=t@t GIT_COMMITTER_NAME=t GIT_COMMITTER_EMAIL=t@t \
+      git commit -q -m init 2>/dev/null
+  )
+}
+teardown() { rm -rf "$TMP"; }
+
+# run_hook <command> [event] [tool]
+run_hook() {
+  local cmd="$1" ev="${2:-PostToolUse}" tool="${3:-Bash}" json
+  json=$(printf '{"hook_event_name":"%s","tool_name":"%s","tool_input":{"command":"%s"}}' "$ev" "$tool" "$cmd")
+  STDOUT=$( cd "$TMP" && HOME="$TMP/home" CLAUDE_PROJECT_DIR="$TMP" bash "$HOOK" <<<"$json" 2>&1 )
+  EXIT=$?
+}
+
+injected()      { echo "$STDOUT" | grep -q "Deploy URLs auto-detected"; }
+head_leaked()   { echo "$STDOUT" | grep -qE 'HEAD(--|:|\))'; }
+fn7() { echo "$STDOUT" | grep -q "feature-test" && ! head_leaked; }
+fn8() { ! head_leaked; }
+fn9() { echo "$STDOUT" | grep -q "feature-test"; }
+has_feature() { echo "$STDOUT" | grep -q "feature-test"; }
+no_quiet()    { ! echo "$STDOUT" | grep -q -- "--quiet"; }
+fn10() { has_feature && no_quiet; }   # compound:fetch 段的 --quiet 不可被誤抓為 branch
+fn11() { has_feature; }                # compound:pull 段的 main 不可被誤抓(否則 grep feature-test 失敗)
+fn12() { has_feature; }                # bare push origin → fallback current branch
+fn13() { has_feature; }                # flag-after-origin → 清空 → fallback current branch
+
+check() {  # <name> <expect: skip|fire> [extra-assert-fn]
+  local name="$1" expect="$2" extra="${3:-}"
+  local ok=1
+  if [ "$expect" = "skip" ]; then
+    { [ "$EXIT" = "0" ] && ! injected; } || ok=0
+  else # fire
+    { [ "$EXIT" = "0" ] && injected; } || ok=0
+  fi
+  if [ -n "$extra" ] && ! "$extra"; then ok=0; fi
+  if [ "$ok" = "1" ]; then
+    echo "  PASS  $name"; PASS=$((PASS+1))
+  else
+    echo "  FAIL  $name (exit=$EXIT, expect=$expect)"
+    echo "         output=${STDOUT:0:240}"
+    FAIL=$((FAIL+1)); FAILED="${FAILED}\n  - $name"
+  fi
+}
+
+setup
+
+# 1. 非 PostToolUse event → skip
+run_hook "git push origin feature-test" "UserPromptSubmit" "Bash"
+check "1 non-PostToolUse event → skip" skip
+
+# 2. 非 Bash tool → skip
+run_hook "git push origin feature-test" "PostToolUse" "Edit"
+check "2 non-Bash tool → skip" skip
+
+# 3. tag push(v*)→ skip(原把 tag 名當 branch 推 404)
+run_hook "git push origin v0.1.0-beta.56"
+check "3 tag push → skip" skip
+
+# 4. branch --delete(cleanup,非 deploy)→ skip
+run_hook "git push origin --delete old-branch"
+check "4 push --delete → skip" skip
+
+# 5. 字串提及(賦值,非命令邊界)→ skip(command-boundary guard)
+run_hook "P='git push origin'"
+check "5 string-mention (assignment) → skip" skip
+
+# 6. 解析噪音 / 非法 git ref 字元(~)→ skip(charset guard)
+run_hook "git push origin foo~bar"
+check "6 invalid-ref-charset branch → skip" skip
+
+# 7. symbolic ref HEAD → fires + 解析成真 branch feature-test(非字面 HEAD)
+run_hook "git push origin HEAD"
+check "7 HEAD → fire + resolve to feature-test (no literal HEAD)" fire 'fn7'
+
+# 8. refspec HEAD:main → 取 dst,不可洩漏字面 HEAD
+run_hook "git push origin HEAD:main"
+check "8 refspec HEAD:main → no HEAD leak" fire 'fn8'
+
+# 9. positive control:真 branch push → fires(確保 skip 測試非因 hook 全壞而假過)
+run_hook "git add -A && git push origin feature-test"
+check "9 real branch push (positive control) → fire" fire 'fn9'
+
+# 10. ROOT regression:compound 命令前段 `git fetch origin --quiet` 的 flag 不可被誤抓為 branch
+#     (2026-06-07 anchor:merge 時 `git fetch origin --quiet && ... && git push origin main` 吐 `--quiet--site` 404)
+run_hook "git fetch origin --quiet && git push origin feature-test"
+check "10 compound w/ fetch flag → branch from push seg only (no --quiet leak)" fire 'fn10'
+
+# 11. compound 前段 `git pull origin main` 的 main 不可被誤抓(branch 必來自 push 段)
+run_hook "git pull origin main && git push origin feature-test"
+check "11 compound w/ pull → branch from push seg (not pull's main)" fire 'fn11'
+
+# 12. bare `git push origin`(無顯式 branch)→ fallback 當前 branch
+run_hook "git push origin"
+check "12 bare push origin → fallback current branch" fire 'fn12'
+
+# 13. flag-after-origin `git push origin --force`(無顯式 branch)→ fallback 當前 branch
+run_hook "git push origin --force"
+check "13 flag-after-origin → fallback current branch (no flag-as-branch)" fire 'fn13'
+
+teardown
+
+echo ""
+echo "── Summary ──"
+echo "PASS: $PASS / $((PASS+FAIL))"
+if [ "$FAIL" -gt 0 ]; then
+  echo "FAIL: $FAIL"
+  printf "$FAILED\n"
+  exit 1
+fi
+echo "✅ All passed"
+exit 0

package/ds-story-manifest.json

@@ -7,7 +7,7 @@
       "scripts/composition-fidelity-visual-diff.mjs",
       "product-workspace apps/template/src/AllDsComponents.stories.tsx (ImportSmoke portal → DS Storybook link)"
     ],
-    "generatedAt": "2026-06-06T11:34:35.406Z"
+    "generatedAt": "2026-06-06T10:07:05.357Z"
   },
   "components": {
     "accordion": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qijenchen/design-system",
-  "version": "0.1.0-beta.56",
+  "version": "0.1.0-beta.58",
   "private": false,
   "description": "World-class design system — components, patterns, tokens, hooks (single source of truth for team distribution).",
   "type": "module",