@shundoo-ai/dsh-cosmic 1.0.19 → 1.0.21

package/skills/cosmic-build/scripts/test/test_report_sdk_optimization.py

@@ -0,0 +1,36 @@
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+import pytest
+
+ROOT = Path(__file__).resolve().parents[2]
+CLASSPATH = os.environ.get("COSMIC_SDK_QUERY_CLASSPATH", "")
+HOME = os.environ.get("COSMIC_SDK_JAVA_HOME", "")
+
+
+@pytest.mark.skipif(not CLASSPATH or not HOME, reason="target SDK and Java 8 home unavailable")
+def test_native_typed_fields_and_aggregation_use_actual_sdk(tmp_path):
+    javac = Path(HOME) / "bin" / ("javac.exe" if os.name == "nt" else "javac")
+    java = Path(HOME) / "bin" / ("java.exe" if os.name == "nt" else "java")
+    subprocess.run([str(javac), "-source", "8", "-target", "8", "-cp", CLASSPATH, "-d", str(tmp_path),
+        str(ROOT / "assets/platform-report-filters/TypedReportFilterFields.java"),
+        str(ROOT / "examples/java-rules/CosmicReportAggregation.java"),
+        str(ROOT / "scripts/test/fixtures/ReportSdkCheck.java")], check=True, capture_output=True, text=True, timeout=60)
+    result = subprocess.run([str(java), "-DclusterName=report-sdk-check", "-Dlogfactory.className=ReportSdkCheck$TestLogFactory",
+        "-cp", os.pathsep.join([str(tmp_path), CLASSPATH]), "ReportSdkCheck"], cwd=tmp_path,
+        check=True, capture_output=True, text=True, timeout=30)
+    assert "report SDK checks passed" in result.stdout
+
+
+@pytest.mark.skipif(not CLASSPATH or not HOME, reason="target SDK and Java 8 home unavailable")
+def test_benchmark_cli_requires_equal_results_before_reporting_times(tmp_path):
+    target = tmp_path / "benchmark.json"
+    result = subprocess.run([sys.executable, str(ROOT / "scripts/report_algo_benchmark.py"),
+        "--sdk-classpath", CLASSPATH, "--java-home", HOME, "--rows", "1000", "--groups", "10",
+        "--iterations", "3", "--output", str(target)], check=True, capture_output=True, text=True, timeout=90)
+    data = json.loads(result.stdout)
+    assert data == json.loads(target.read_text())
+    assert data["status"] == "passed" and data["resultsEqual"] is True and data["databaseQueries"] == 0
+    assert data["baselineP50Ms"] > 0 and data["optimizedP95Ms"] > 0

package/skills/cosmic-build/scripts/test/test_rule_batch_evidence.py

@@ -38,7 +38,7 @@ def test_rule_batch_accepts_atomic_flag_spelling_without_changing_semantics():
     assert normalized["args"]["onlyEmptyTarget"] is True
     with patch.object(cmd_rules, "do_ensure_conditional_copy_field_value", return_value={"status": True}) as writer:
         cmd_rules._execute_rule_set_item({}, "token", "form", normalized)
-    assert writer.call_args.args[-1] is True
+    assert writer.call_args.args[-3] is True
     item["args"]["onlyEmptyTarget"] = False
     with pytest.raises(ValueError, match="ARGS_CONFLICT"):
         cmd_rules._validate_rule_set_request({"rules": [item]})

package/skills/cosmic-build/scripts/test/test_rule_domain_contract.py

@@ -31,6 +31,7 @@ def test_rule_domain_contract_publishes_declarative_commands() -> None:
     assert "ensureConditionalEntryStyle" in document["commands"]
     assert "ensureConditionalFieldState" in document["commands"]
     assert "ensureFieldCalculation" in document["commands"]
+    assert "ensureTimeDifferenceCalculation" in document["commands"]
     assert "ensureRuleFunctionFormula" in document["commands"]
     assert "DateTime" in document["commands"]["ensureRuleFunctionFormula"]["releasedGroups"]
     assert "ensureRuleSet" in document["commands"]
@@ -69,6 +70,7 @@ def test_cli_and_modifier_route_common_calculation_without_raw_rule_json() -> No
     cli = CLI.read_text(encoding="utf-8")
     modifier = MODIFIER.read_text(encoding="utf-8")
     assert '"ensureFieldCalculation"' in cli
+    assert '"ensureTimeDifferenceCalculation"' in cli
     assert '"ensureRuleFunctionFormula"' in cli
     assert '"ensureRuleSet"' in cli
     assert '"ensureConditionalFieldState"' in cli
@@ -81,6 +83,7 @@ def test_cli_and_modifier_route_common_calculation_without_raw_rule_json() -> No
     assert '"ensureQuantityConversion"' in cli
     assert '"setSummaryToField"' in cli
     assert "ensureFieldCalculation --entity" in modifier
+    assert "ensureTimeDifferenceCalculation --entity" in modifier
     assert "function-formulas.md" in RULE_SKILL.read_text()
     assert "ensureRuleFunctionFormula --app-root" in RULE_SKILL.with_name("function-formulas.md").read_text()
     assert "ensureConditionalFieldState --entity" in modifier
@@ -98,6 +101,7 @@ def test_rule_commands_publish_the_small_rule_domain_contract() -> None:
     cli = CLI.read_text(encoding="utf-8")
     assert '"addRule": "skills/cosmic-meta-api/contracts/cli/rule-domain.json' in cli
     assert '"ensureFieldCalculation": "skills/cosmic-meta-api/contracts/cli/rule-domain.json' in cli
+    assert '"ensureTimeDifferenceCalculation": "skills/cosmic-meta-api/contracts/cli/rule-domain.json' in cli
     assert '"ensureRuleFunctionFormula": "skills/cosmic-meta-api/contracts/cli/rule-domain.json' in cli
     assert '"ensureConditionalFieldState": "skills/cosmic-meta-api/contracts/cli/rule-domain.json' in cli
     assert '"ensureConditionalEntryStyle": "skills/cosmic-meta-api/contracts/cli/rule-domain.json' in cli
@@ -126,6 +130,7 @@ def test_root_routes_common_rules_directly_to_the_rule_entry() -> None:
         assert "--project-root" in text
         assert "data.appRoot" in text
         assert "ensureFieldCalculation --entity" in text
+        assert "ensureTimeDifferenceCalculation --entity" in text
         assert "ensureConditionalFieldState --entity" in text
         assert "ensureConditionalClearFields --entity" in text
         assert "@first" in text
@@ -159,3 +164,18 @@ def test_rule_entity_context_accepts_header_and_entry_business_aliases() -> None
 
     assert header["key"] == "demo"
     assert entry["key"] == "demo_entry"
+
+
+def test_calculation_scopes_repeated_price_caption_to_the_unique_participating_entity(monkeypatch):
+    entities = [{"key": "demo", "type": "BillEntity"}, {"key": "detail", "type": "EntryEntity"},
+                {"key": "addon", "type": "SubEntryEntity"}]
+    fields = [{"key": "amount", "name": "金额小计", "parentKey": "detail"},
+              {"key": "duration", "name": "时长", "parentKey": "detail"},
+              {"key": "price", "name": "单价", "parentKey": "detail"},
+              {"key": "service_price", "name": "单价", "parentKey": "addon"}]
+    monkeypatch.setattr(cmd_rules, "_rule_element_inventory", lambda cfg, token, form_number, category:
+                        {"status": True, "data": entities if category == "entity" else fields})
+    selected, _ = cmd_rules._resolve_rule_entity_context({}, "token", "demo", "entries", ["金额小计", "时长", "单价"])
+    assert selected["key"] == "detail"
+    with pytest.raises(ValueError, match="AMBIGUOUS"):
+        cmd_rules._resolve_rule_entity_context({}, "token", "demo", "entries", ["单价"])

package/skills/cosmic-build/scripts/test/test_rule_function_formula.py

@@ -519,6 +519,7 @@ def test_rule_function_formula_compiles_and_uses_verified_writer(
     )
 
     requested = add_verified.call_args.args[3]
+    assert requested["description"] == "来源金额非空时，结果金额 = RemoveZero"
     assert requested["trueActions"][0]["expression"] == "target = RemoveTailZero(source)"
     assert requested["preCondition"] == "source <> null"
     assert requested["falseActions"][0]["expression"] == "target"
@@ -623,11 +624,20 @@ def test_rule_function_formula_adopts_exact_existing_rule(
         }]}},
     }
 
-    result = cmd_rules.do_ensure_rule_function_formula(
-        {}, "token", "demo", "header", "target",
-        {"functionId": "RemoveZero", "args": [{"field": "source"}]},
-    )
+    with mock.patch.object(cmd_rules, "do_update_rule_verified", return_value={
+        "status": True, "data": {"ruleId": "rule-id"},
+        "verification": {"verified": True, "preservationVerified": True},
+    }) as update_verified:
+        result = cmd_rules.do_ensure_rule_function_formula(
+            {}, "token", "demo", "header", "target",
+            {"functionId": "RemoveZero", "args": [{"field": "source"}]},
+        )
 
-    assert result["data"]["changed"] is False
-    assert result["writeAttempted"] is False
+    assert result["data"]["changed"] is True
+    assert result["writeAttempted"] is True
+    requested_patch = update_verified.call_args.args[3]
+    assert requested_patch == {
+        "ruleType": "bizRule", "ruleId": "rule-id",
+        "description": "来源金额非空时，结果金额 = RemoveZero",
+    }
     add_verified.assert_not_called()

package/skills/cosmic-build/scripts/test/test_skill_entry_contract.py

@@ -70,6 +70,7 @@ def test_rule_hot_path_does_not_rediscover_published_commands_or_delivery_identi
     for path in entries:
         text = path.read_text(encoding="utf-8")
         assert "ensureFieldCalculation --entity" in text
+        assert "ensureTimeDifferenceCalculation --entity" in text
         assert "data.appRoot" in text
         assert "data.formNumber" in text
         assert "references/delivery.md" in text

package/skills/cosmic-build/scripts/test/test_test_environment.py

@@ -0,0 +1,45 @@
+import json
+import sys
+from pathlib import Path
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+from test_environment import export_test_environment
+
+
+def test_export_preserves_target_and_excludes_credentials(tmp_path):
+    context = tmp_path / "_runtime" / "context.json"
+    context.parent.mkdir()
+    context.write_text(json.dumps({
+        "appId": "APP", "appCode": "demo", "appName": "Demo",
+        "environment": {"baseUrl": "http://127.0.0.1:8080/ierp", "accountId": "123"},
+        "cookie": "must-not-export",
+    }))
+    result = export_test_environment(tmp_path, {
+        "baseUrl": "http://127.0.0.1:8080/ierp/", "accountId": "123", "loginUser": "test-user",
+        "password": "must-not-export", "appSecret": "must-not-export", "token": "must-not-export",
+    }, ["form_a", "form_a", "form_b"], {"form_a": "FORM-ID"}, {
+        "form_a": {"formName": "Form A", "previewUrl": "http://127.0.0.1:8080/ierp/?formId=form_a", "cookie": "must-not-export"},
+    })
+    saved = json.loads(Path(result["path"]).read_text())
+    assert saved["baseUrl"] == "http://127.0.0.1:8080/ierp"
+    assert saved["accountId"] == "123"
+    assert saved["application"]["appId"] == "APP"
+    assert saved["forms"] == [{"formNumber": "form_a", "formId": "FORM-ID", "formName": "Form A", "previewUrl": "http://127.0.0.1:8080/ierp/?formId=form_a"}, {"formNumber": "form_b"}]
+    assert "must-not-export" not in json.dumps(result)
+    assert "authMode" not in saved
+
+
+@pytest.mark.parametrize("server", [
+    {"baseUrl": "https://devops.invalid/", "accountId": "123"},
+    {"baseUrl": "http://127.0.0.1:8080/ierp", "accountId": "different"},
+    {"baseUrl": "http://user:secret@127.0.0.1:8080/ierp"},
+])
+def test_export_rejects_changed_environment_or_credential_url(tmp_path, server):
+    context = tmp_path / "_runtime" / "context.json"
+    context.parent.mkdir()
+    context.write_text(json.dumps({"environment": {"baseUrl": "http://127.0.0.1:8080/ierp", "accountId": "123"}}))
+    with pytest.raises(ValueError):
+        export_test_environment(tmp_path, server, ["form_a"])
+    assert not (tmp_path / "_runtime" / "test-environment.json").exists()

package/skills/cosmic-build/scripts/test/test_verify_plugin_loading.py

@@ -0,0 +1,79 @@
+import hashlib
+import json
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+SCRIPTS = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(SCRIPTS))
+from verify_plugin_loading import verify_loading
+
+
+@pytest.fixture
+def compiled(tmp_path):
+    if not shutil.which("javac"):
+        pytest.skip("javac unavailable")
+    source = tmp_path / "Report.java"
+    source.write_text('package example; public class Report { public String version() { return "current"; } }')
+    subprocess.run(["javac", "-source", "8", "-target", "8", "-d", str(tmp_path), str(source)],
+                   capture_output=True, check=True)
+    artifact = tmp_path / "example" / "Report.class"
+    deployed = tmp_path / "outputdir" / "example" / "Report.class"
+    deployed.parent.mkdir(parents=True)
+    shutil.copyfile(artifact, deployed)
+    digest = hashlib.sha256(artifact.read_bytes()).hexdigest()
+    receipt = {"status": True, "compileSkipped": False, "sourcePath": str(source), "className": "Report",
+               "sourceReview": {"sourceHash": hashlib.sha256(source.read_bytes()).hexdigest()},
+               "compiledArtifact": {"path": str(artifact), "fqcn": "example.Report", "sha256": digest}}
+    trace = {"status": "log-lines-found", "plugin": "example.Report", "traceId": "query-current", "observations": [
+        {"pluginMatch": "fully-qualified", "loadedClassSha256": digest}]}
+    return receipt, artifact, deployed, trace
+
+
+def test_artifact_equality_never_implies_jvm_loading(compiled):
+    receipt, artifact, deployed, trace = compiled
+    result = verify_loading(receipt, artifact, deployed)
+    assert result["artifactMatch"] is True and result["runtimeVerified"] is False
+    assert result["status"] == "blocked"
+    assert verify_loading(receipt, artifact, deployed, trace)["status"] == "passed"
+    trace["observations"][0]["loadedClassSha256"] = "0" * 64
+    assert verify_loading(receipt, artifact, deployed, trace)["reason"] == "loaded-class-differs"
+
+
+def test_stale_deployment_and_source_changes_fail(compiled, tmp_path):
+    receipt, artifact, deployed, trace = compiled
+    source = tmp_path / "old" / "Report.java"
+    source.parent.mkdir()
+    source.write_text('package example; public class Report { public String version() { return "old"; } }')
+    subprocess.run(["javac", "-source", "8", "-target", "8", "-d", str(deployed.parents[1]), str(source)],
+                   capture_output=True, check=True)
+    assert verify_loading(receipt, artifact, deployed, trace)["reason"] == "deployed-class-differs"
+    Path(receipt["sourcePath"]).write_text('package example; public class Report {}')
+    assert verify_loading(receipt, artifact, deployed, trace)["reason"] == "source-changed-after-compilation"
+
+
+def test_skipped_compile_unbound_artifact_and_short_logger_do_not_pass(compiled):
+    receipt, artifact, deployed, trace = compiled
+    trace["observations"][0]["pluginMatch"] = "simple-name-unverified"
+    assert verify_loading(receipt, artifact, deployed, trace)["runtimeVerified"] is False
+    receipt["compiledArtifact"] = None
+    assert verify_loading(receipt, artifact, deployed, trace)["reason"] == "compile-artifact-not-bound"
+    receipt["compileSkipped"] = True
+    assert verify_loading(receipt, artifact, deployed, trace)["reason"] == "compilation-not-proven"
+
+
+def test_loading_cli_emits_structured_result_and_nonzero_for_missing_runtime(compiled, tmp_path):
+    receipt, artifact, deployed, trace = compiled
+    file = tmp_path / "compile.json"
+    file.write_text(json.dumps(receipt))
+    args = [sys.executable, str(SCRIPTS / "verify_plugin_loading.py"), "--compile-result", str(file),
+            "--compiled-class", str(artifact), "--deployed-class", str(deployed)]
+    result = subprocess.run(args, capture_output=True, text=True)
+    assert result.returncode == 2 and json.loads(result.stdout)["runtimeVerified"] is False
+    observation = tmp_path / "trace.json"
+    observation.write_text(json.dumps(trace))
+    result = subprocess.run([*args, "--runtime-trace", str(observation)], capture_output=True, text=True)
+    assert result.returncode == 0 and json.loads(result.stdout)["runtimeVerified"] is True

package/skills/cosmic-build/scripts/test_environment.py

@@ -0,0 +1,49 @@
+"""Export only non-secret target identity for the implementation-to-QA handoff."""
+
+import json
+from pathlib import Path
+from urllib.parse import urlsplit, urlunsplit
+
+
+def environment_identity(server):
+    url = urlsplit(str(server.get("baseUrl") or server.get("base_url") or ""))
+    if url.scheme not in ("http", "https") or not url.hostname or url.username or url.password or url.query or url.fragment:
+        raise ValueError("Test environment requires a complete HTTP(S) baseUrl without credentials")
+    return {
+        "baseUrl": urlunsplit((url.scheme.lower(), url.netloc.lower(), url.path.rstrip("/"), "", "")),
+        **{key: str(server[key]) for key in ("accountId",) if server.get(key)},
+    }
+
+
+def export_test_environment(app_root, server, form_numbers, form_ids=None, form_links=None):
+    root = Path(app_root).resolve()
+    context_path = root / "_runtime" / "context.json"
+    context = json.loads(context_path.read_text(encoding="utf-8-sig")) if context_path.is_file() else {}
+    current = environment_identity(server)
+    bound = context.get("environment")
+    if bound and any(bound.get(key) and bound[key] != current.get(key) for key in ("baseUrl", "accountId")):
+        raise ValueError("Delivery environment differs from the application's bound environment; reconcile the target before delivery")
+    handoff = {
+        "schemaVersion": "cosmic-test-environment/v1",
+        **current,
+        "source": "app-build verified target",
+        "application": {
+            "appRoot": str(root),
+            **{key: str(context[key]) for key in ("appCode", "appName", "appId") if context.get(key)},
+        },
+        "forms": [
+            {
+                "formNumber": number,
+                **({"formId": form_ids[number]} if form_ids and form_ids.get(number) else {}),
+                **(
+                    {key: form_links[number][key] for key in ("formName", "previewUrl", "listUrl") if form_links[number].get(key)}
+                    if form_links and number in form_links else {}
+                ),
+            }
+            for number in dict.fromkeys(form_numbers)
+        ],
+    }
+    target = root / "_runtime" / "test-environment.json"
+    target.parent.mkdir(parents=True, exist_ok=True)
+    target.write_text(json.dumps(handoff, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")
+    return {"path": str(target), "environment": handoff}

package/skills/cosmic-build/scripts/verify_plugin_loading.py

@@ -0,0 +1,71 @@
+#!/usr/bin/env python3
+"""Read-only comparison of compiled/deployed bytes and explicit class-loading evidence."""
+
+import argparse
+import hashlib
+import json
+import re
+from pathlib import Path
+
+from java_source import stripped
+from plugin_corpus.jvm_classfile import parse_class
+
+
+def verify_loading(receipt, compiled_class, deployed_class, runtime_trace=None):
+    if not isinstance(receipt, dict) or runtime_trace is not None and (
+            not isinstance(runtime_trace, dict) or not isinstance(runtime_trace.get("observations"), list)
+            or any(not isinstance(item, dict) for item in runtime_trace["observations"])):
+        raise ValueError("Expected compile receipt and plugin-trace objects")
+    if receipt.get("status") is not True or receipt.get("compileSkipped") is not False:
+        return {"status": "blocked", "runtimeVerified": False, "reason": "compilation-not-proven"}
+    source = Path(receipt["sourcePath"])
+    if hashlib.sha256(source.read_bytes()).hexdigest() != receipt["sourceReview"]["sourceHash"]:
+        return {"status": "failed", "runtimeVerified": False, "reason": "source-changed-after-compilation"}
+    package = re.search(r"\bpackage\s+([\w.]+)\s*;", stripped(source.read_text(encoding="utf-8-sig")))
+    fqcn = (package[1] + "." if package else "") + receipt["className"].rsplit(".", 1)[-1]
+    paths = [Path(compiled_class), Path(deployed_class)]
+    if any(not path.is_file() for path in paths):
+        return {"status": "blocked", "runtimeVerified": False, "reason": "class-file-unavailable", "fqcn": fqcn}
+    artifacts = [{"path": str(path.resolve()), "sha256": hashlib.sha256(path.read_bytes()).hexdigest(),
+                  "fqcn": parse_class(path.read_bytes())["name"].replace("/", ".")} for path in paths]
+    if not receipt.get("compiledArtifact"):
+        return {"status": "blocked", "runtimeVerified": False, "reason": "compile-artifact-not-bound", "artifacts": artifacts}
+    if (receipt["compiledArtifact"].get("fqcn") != fqcn
+            or receipt["compiledArtifact"].get("sha256") != artifacts[0]["sha256"]
+            or Path(receipt["compiledArtifact"]["path"]).resolve() != paths[0].resolve()):
+        return {"status": "failed", "runtimeVerified": False, "reason": "compile-artifact-changed", "artifacts": artifacts}
+    if any(item["fqcn"] != fqcn for item in artifacts):
+        return {"status": "failed", "runtimeVerified": False, "reason": "class-identity-mismatch", "artifacts": artifacts}
+    if artifacts[0]["sha256"] != artifacts[1]["sha256"]:
+        return {"status": "failed", "runtimeVerified": False, "reason": "deployed-class-differs", "artifacts": artifacts}
+    observed = ([item.get("loadedClassSha256") for item in runtime_trace.get("observations", [])
+                 if item.get("pluginMatch") == "fully-qualified" and item.get("loadedClassSha256")]
+                if runtime_trace and runtime_trace.get("status") == "log-lines-found"
+                and runtime_trace.get("plugin") == fqcn and runtime_trace.get("traceId") else [])
+    matched = bool(observed) and all(value == artifacts[0]["sha256"] for value in observed)
+    return {"status": "passed" if matched else "failed" if observed else "blocked",
+            "runtimeVerified": matched, "artifactMatch": True, "fqcn": fqcn, "artifacts": artifacts,
+            "reason": "loaded-class-matches" if matched else "loaded-class-differs" if observed else "runtime-loading-evidence-missing",
+            "traceId": runtime_trace.get("traceId") if runtime_trace else None,
+            "evidenceLimit": "Artifact equality alone does not prove JVM activation. Runtime proof consumes explicit request-scoped loaded-class hashes, never hashes of files merely read after replacement."}
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--compile-result", required=True)
+    parser.add_argument("--compiled-class", required=True)
+    parser.add_argument("--deployed-class", required=True)
+    parser.add_argument("--runtime-trace", help="JSON output of cosmic-e2e-test/scripts/plugin-trace.mjs")
+    args = parser.parse_args()
+    try:
+        result = verify_loading(json.loads(Path(args.compile_result).read_text(encoding="utf-8-sig")),
+                                args.compiled_class, args.deployed_class,
+                                json.loads(Path(args.runtime_trace).read_text(encoding="utf-8-sig")) if args.runtime_trace else None)
+    except (OSError, ValueError, KeyError, TypeError, AttributeError) as error:
+        result = {"status": "blocked", "runtimeVerified": False, "reason": "invalid-loading-evidence", "message": str(error)}
+    print(json.dumps(result, ensure_ascii=False))
+    return 0 if result["status"] == "passed" else 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())