@shundoo-ai/dsh-cosmic 1.0.19 → 1.0.21

package/skills/cosmic-build/scripts/compile_plugin_source.py

@@ -4,6 +4,7 @@
 from __future__ import annotations
 
 import argparse
+import hashlib
 import json
 import os
 import re
@@ -14,7 +15,7 @@ from pathlib import Path
 from typing import Any
 
 from appconfig_load import inspect_config
-from java_source import commentless, duplicate_methods
+from java_source import commentless, duplicate_methods, method_bodies, method_signatures, stripped
 from plugin_source_gate import write_state
 from platform_api_contract import (
     base_class_issues,
@@ -27,6 +28,7 @@ from platform_api_contract import (
     unverified_member_issues,
 )
 from write_archive_json import write_archive
+from plugin_corpus.jvm_classfile import parse_class
 
 
 PROJECT_DIR_RE = re.compile(
@@ -36,6 +38,77 @@ PROJECT_DIR_RE = re.compile(
 INCLUDE_RE = re.compile(r"['\"](?P<module>:[A-Za-z0-9_.:-]+)['\"]")
 JAVA_ERROR_RE = re.compile(r"^(?P<file>.*\.java):(?P<line>\d+):\s*(?:错误|error):\s*(?P<message>.*)$")
 DIAGNOSTIC_LIMIT = 30
+
+
+def time_accessor_issues(source_text: str, time_fields: set[str]) -> list[dict[str, Any]]:
+    """Flag possible TimeProp reads without pretending to resolve Java receiver ownership."""
+    if not time_fields:
+        return []
+    source = commentless(source_text)
+    code = stripped(source_text)
+    constants: dict[str, set[str]] = {}
+    for match in re.finditer(r'\b(?:static\s+)?final\s+String\s+([A-Za-z_]\w*)\s*=\s*"([^"\n]+)"', source):
+        if code[match.start():match.start() + 5].strip():
+            constants.setdefault(match[1], set()).add(match[2])
+    receivers: dict[str, set[str]] = {}
+    for match in re.finditer(r'\b([A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*)\s+([A-Za-z_]\w*)\s*(?=[,;=:)])', code):
+        receivers.setdefault(match[2], set()).add(match[1].rsplit('.', 1)[-1])
+    issues = []
+    for match in re.finditer(r'(?P<receiver>[A-Za-z_]\w*)\.getDate\s*\(\s*(?:"(?P<literal>[^"\n]+)"|(?P<symbol>[A-Za-z_]\w*))\s*\)', source):
+        if not code[match.start():match.start() + len(match['receiver'])].strip():
+            continue
+        kinds = receivers.get(match['receiver'], set())
+        if kinds and 'DynamicObject' not in kinds:
+            continue
+        values = {match['literal']} if match['literal'] else constants.get(match['symbol'], set())
+        fields = sorted(values & time_fields)
+        if fields:
+            issues.append({"line": source.count("\n", 0, match.start()) + 1, "fieldKeys": fields,
+                           "receiver": match['receiver'], "severity": "warning",
+                           "message": "Possible TimeProp read via getDate; verify this receiver's field ownership and use integer seconds for a confirmed TimeProp. This scan does not resolve Java scopes or entity types."})
+    return issues
+
+
+def time_fields_from_handoff(handoff: dict) -> set[str]:
+    types: dict[str, set[str]] = {}
+    for graph in [handoff.get("formGraph"), *(handoff.get("relatedForms") or [])]:
+        if not isinstance(graph, dict):
+            continue
+        for entity in graph.get("entities", []):
+            if not isinstance(entity, dict):
+                continue
+            for field in entity.get("fields", []):
+                if isinstance(field, dict) and isinstance(field.get("fieldKey"), str):
+                    types.setdefault(field["fieldKey"], set()).add(str(field.get("fieldType") or ""))
+    return {key for key, kinds in types.items() if kinds and kinds <= {"TimeProp", "TimeField"}}
+
+
+def operation_dispatch_warnings(source_text: str, operation_keys: list[str]) -> list[dict]:
+    code = stripped(source_text)
+    source = commentless(source_text)
+    issues = []
+    for match in re.finditer(r'\boperateMeta\s*\.\s*get\s*\(\s*"([^"\n]+)"\s*\)', source):
+        if code[match.start():match.start() + len("operateMeta")].strip():
+            issues.append({"line": source.count("\n", 0, match.start()) + 1, "severity": "warning",
+                           "errorCode": "PLUGIN_OPERATION_MAP_KEY_UNVERIFIED", "mapKey": match[1],
+                           "message": "The handoff does not establish this operateMeta Map key. Prefer OperationArgs.getOperationKey() in transaction callbacks or AbstractValidator.getOperateKey() in validators; otherwise supply exact SDK evidence."})
+    if len(set(operation_keys)) > 1:
+        for body in method_bodies(source_text):
+            if body["name"] in ("beginOperationTransaction", "endOperationTransaction") and not re.search(
+                    r'\b(?:getOperationKey|getOperateKey)\s*\(', code[body["start"]:body["end"]]):
+                issues.append({"line": code.count("\n", 0, body["start"]) + 1, "severity": "warning",
+                               "errorCode": "PLUGIN_OPERATION_SCOPE_UNVERIFIED", "method": body["name"],
+                               "message": "Several operations share this plugin and this callback has no visible typed operation selector. Verify whether its effects apply to every registered operation or are selected by a verified helper."})
+    return issues
+
+
+def compile_handoff(filename: str) -> dict:
+    prepared = json.loads(Path(filename).read_text(encoding="utf-8-sig"))
+    context = prepared.get("handoff") if prepared.get("status") is True else None
+    if not isinstance(context, dict) or not all(context.get(key) for key in
+            ("projectRoot", "appRoot", "sourcePath", "className", "type", "formNumber", "description")):
+        raise CompileError("handoff must contain successfully prepared coding context", "PLUGIN_SOURCE_INVALID")
+    return context
 # Scanned over the whole file, comments included: these three are markers of an unresolved
 # dependency, so one sitting in a comment is exactly the case to block.
 SOURCE_BLOCKERS = (
@@ -43,12 +116,10 @@ SOURCE_BLOCKERS = (
     (re.compile(r"\bTODO\b", re.IGNORECASE), "TODO placeholder"),
     (re.compile(r"\bFIXME\b", re.IGNORECASE), "FIXME placeholder"),
 )
-# Scanned over code only. These are ordinary Chinese business words, so when the response language
-# is Chinese they turn up in correct comments describing a status rather than standing in for
-# missing work, and reporting one stopped delivery as L3-BLOCK on a comment that was fine. A string
-# literal still counts.
+# Scanned over code only. Explicit implementation placeholders remain blockers, including string
+# literals. Ordinary business vocabulary such as 待确认 is valid in comments and user messages.
 CODE_BLOCKERS = (
-    (re.compile(r"待确认|待替换|占位实现"), "unresolved placeholder text"),
+    (re.compile(r"待替换|占位实现"), "unresolved placeholder text"),
 )
 
 
@@ -89,6 +160,42 @@ def resolve_module(gradle_root: Path, project_root: Path) -> str:
     return matches[0]
 
 
+def inspect_compile_environment(project_root: str) -> dict:
+    config = inspect_config(write_derived=False)
+    if config.get("status") != "ready":
+        return {"status": config.get("status", "unknown"), "message": config.get("message", "Compile environment unavailable")}
+    root = Path(str(config["GRADLE_ROOT"])).resolve()
+    try:
+        module = resolve_module(root, Path(project_root))
+    except CompileError as error:
+        return {"status": "unbound", "code": error.code, "message": str(error)}
+    sdk_paths = []
+    properties = root / "gradle.properties"
+    scheme = root / "config.gradle"
+    scheme_text = scheme.read_text(encoding="utf-8-sig") if scheme.is_file() else ""
+    property_text = properties.read_text(encoding="utf-8-sig") if properties.is_file() else ""
+    home_property = bool(re.search(r"^\s*systemProp\.cosmic_home\s*=", property_text, re.MULTILINE))
+    libs_property = bool(re.search(r"^\s*systemProp\.cosmic_libs_path\s*=", property_text, re.MULTILINE))
+    if property_text and "${cosmic_libs_path}/bos" in scheme_text and not (home_property and libs_property):
+        for line in property_text.splitlines():
+            match = re.match(r"\s*(systemProp\.cosmic_home|systemProp\.cosmic_libs_path)\s*=\s*(.+?)\s*$", line)
+            if match:
+                target = Path(match[2].strip('"')).expanduser()
+                target = target if target.is_absolute() else root / target
+                if match[1] == "systemProp.cosmic_home" and "${cosmic_home}/mservice-cosmic/lib" in scheme_text:
+                    directory = target / "mservice-cosmic" / "lib" / "bos"
+                elif match[1] == "systemProp.cosmic_libs_path" and not os.environ.get("COSMIC_HOME"):
+                    directory = target / "bos"
+                else:
+                    continue
+                if directory.is_dir() and any(directory.glob("*.jar")):
+                    sdk_paths.append({"path": str(directory.resolve()), "source": [str(properties), str(scheme)], "property": match[1]})
+    return {"status": "ready", "gradleRoot": str(root), "module": module,
+            "wrapperPath": str(root / ("gradlew.bat" if os.name == "nt" else "gradlew")),
+            "javaHome": config["JAVA_HOME"], "sdkDirectories": sdk_paths,
+            "sdkPathEvidence": "Matched one target Gradle property and config.gradle library expression; ambiguous or unavailable configurations remain unresolved, and Gradle was not executed"}
+
+
 def validate_source(source_path: Path, project_root: Path, class_name: str) -> list[dict[str, Any]]:
     java_root = (project_root / "src" / "main" / "java").resolve()
     source = source_path.resolve()
@@ -192,7 +299,8 @@ def parse_compiler_errors(output: str, target_source: Path | None = None) -> lis
 def compile_source(
     project_root: Path, source_path: Path, class_name: str, timeout_sec: int,
     *, app_root: Path, plugin_type: str, form_number: str,
-    operation_keys: list[str], description: str,
+    operation_keys: list[str], description: str, module_runs: dict | None = None,
+    time_fields: set[str] | None = None,
 ) -> dict[str, Any]:
     # Before the source is read: this used to sit just before the Gradle call, so a description one
     # character too long was reported only after all the source gates had run.
@@ -208,138 +316,54 @@ def compile_source(
             "message": "source contains unresolved placeholders; resolve the dependency before compiling",
             "issues": issues,
         }
+    source_hash = hashlib.sha256(source_path.read_bytes()).hexdigest()
     source_text = source_path.read_text(encoding="utf-8-sig")
-    # javac would reject a repeated signature, but this check also runs when appconfig sets
-    # compile=false, which is how a class carrying two afterCreateNewData methods reached
-    # registration with nothing having ever looked at it.
-    duplicates = duplicate_methods(source_text)
-    if duplicates:
-        return {
-            "status": False,
-            "errorCode": "PLUGIN_SOURCE_DUPLICATE_METHOD",
-            "phase": "source_validation",
-            "message": (
-                f"{len(duplicates)} method(s) are declared twice in {class_name}; merge the new "
-                "logic into the existing declaration instead of adding a second one"
-            ),
-            "issues": duplicates,
-        }
-    # A remembered return type is caught here rather than by javac, so the diagnostic can name the
-    # registered signature, and so the check still runs when compile=false. That configuration used
-    # to let `DynamicObjectCollection objs = BusinessDataServiceHelper.load(...)` reach
-    # registration with nothing having compiled it at all.
-    mismatches = return_type_issues(source_text)
-    if mismatches:
+    archive_path = app_root.resolve() / "archive.json"
+    if archive_path.is_file():
+        previous = json.loads(archive_path.read_text(encoding="utf-8-sig"))
+        for entry in previous.get("javas", []):
+            if (str(entry.get("className", "")).rsplit(".", 1)[-1] == class_name
+                    and Path(str(entry.get("filePath") or "")).resolve() == source_path.resolve()):
+                write_archive(archive_path, javas=[{**entry, "compileStatus": "pending"}])
+    # Independent source checks share one response so a repair can address them together.
+    checks = [
+        ("PLUGIN_SOURCE_DUPLICATE_METHOD", duplicate_methods),
+        ("PLUGIN_SOURCE_RETURN_TYPE_MISMATCH", return_type_issues),
+        ("PLUGIN_SOURCE_BASE_CLASS_MISMATCH", base_class_issues),
+        ("PLUGIN_SOURCE_OVERRIDE_SIGNATURE_MISMATCH", override_signature_issues),
+        ("PLUGIN_SOURCE_QFILTER_STRING_OPERATOR", filter_operator_issues),
+        ("PLUGIN_SOURCE_NONEXISTENT_MEMBER", forbidden_member_issues),
+        ("PLUGIN_SOURCE_UNVERIFIED_API", unverified_import_issues),
+        ("PLUGIN_SOURCE_UNVERIFIED_API", unverified_member_issues),
+        ("PLUGIN_SOURCE_LIFECYCLE_MISUSE", scene_misuse_issues),
+    ]
+    findings = [{**issue, "errorCode": code} for code, check in checks for issue in check(source_text)]
+    warnings = [{**issue, "errorCode": "PLUGIN_SOURCE_FIELD_ACCESSOR_MISMATCH"}
+                for issue in time_accessor_issues(source_text, time_fields or set())]
+    if plugin_type == "operation":
+        warnings += operation_dispatch_warnings(source_text, operation_keys)
+    if findings:
         return {
-            "status": False,
-            "errorCode": "PLUGIN_SOURCE_RETURN_TYPE_MISMATCH",
-            "phase": "source_validation",
-            "message": (
-                f"{len(mismatches)} platform call(s) in {class_name} are assigned to a type the "
-                "registered signature does not return; use the return type named in each issue"
-            ),
-            "issues": mismatches,
-        }
-    # `"not in"` is byte-identical to QCP.not_in, so javac compiles it, the database runs it, and
-    # the registration read-back never looks at source. This is the only place that can require the
-    # constant, which is what makes a typo such as "notin" a compile error rather than wrong rows.
-    # The `extends` declaration is checked against the type registry's base-import table before
-    # anything else: a case-only misspelling of a registered base class is a remembered name,
-    # not a platform class, so javac reports at best a bare cannot-find-symbol that names no
-    # replacement — and with compile=false nothing else looks at it before registration.
-    bases = base_class_issues(source_text)
-    if bases:
-        return {
-            "status": False,
-            "errorCode": "PLUGIN_SOURCE_BASE_CLASS_MISMATCH",
-            "phase": "source_validation",
-            "message": (
-                f"{len(bases)} base-class declaration(s) in {class_name} name a class that is not "
-                "a registered plugin base class; use the registered base import named in each issue"
-            ),
-            "issues": bases,
-        }
-    # An @Override whose parameter types none of the base-class chain's registered signatures
-    # accept. The remembered parameter class is not a platform class, so javac reports at best a
-    # bare cannot-find-symbol that names no registered signature, and compile=false skips javac
-    # entirely — this is the only gate that names the signature to copy.
-    overrides = override_signature_issues(source_text)
-    if overrides:
-        return {
-            "status": False,
-            "errorCode": "PLUGIN_SOURCE_OVERRIDE_SIGNATURE_MISMATCH",
-            "phase": "source_validation",
-            "message": (
-                f"{len(overrides)} @Override method(s) in {class_name} declare parameters that "
-                "none of the base class's registered signatures accept; copy the registered "
-                "signature named in each issue"
-            ),
-            "issues": overrides,
-        }
-    operators = filter_operator_issues(source_text)
-    if operators:
-        return {
-            "status": False,
-            "errorCode": "PLUGIN_SOURCE_QFILTER_STRING_OPERATOR",
-            "phase": "source_validation",
-            "message": (
-                f"{len(operators)} QFilter comparison operator(s) in {class_name} are written as "
-                "string literals; use the QCP constant named in each issue"
-            ),
-            "issues": operators,
-        }
-    # javac reports this one too, as "cannot find symbol" without saying what the registered name
-    # is. Naming it here is the smaller half of the reason; the larger is that with compile=false
-    # javac never runs, and `getModel().getEntryCount()` then reaches registration as a class that
-    # cannot load.
-    missing = forbidden_member_issues(source_text)
-    if missing:
-        return {
-            "status": False,
-            "errorCode": "PLUGIN_SOURCE_NONEXISTENT_MEMBER",
-            "phase": "source_validation",
-            "message": (
-                f"{len(missing)} call(s) in {class_name} name a platform member that does not "
-                "exist; use the registered replacement named in each issue"
-            ),
-            "issues": missing,
-        }
-    # The closed vocabulary over the contract pages: a remembered import (a spelling that
-    # case-folds onto one registered class) and a remembered member (a name near-missing one on
-    # the receiver's chain) are both javac symbol errors at best and registration defects at
-    # worst, and neither names the registered spelling to copy. This is the only gate that reads
-    # the whole page corpus, so it also stands in for the members the small table above misses.
-    remembered = unverified_import_issues(source_text) + unverified_member_issues(source_text)
-    if remembered:
-        return {
-            "status": False,
-            "errorCode": "PLUGIN_SOURCE_UNVERIFIED_API",
-            "phase": "source_validation",
-            "message": (
-                f"{len(remembered)} platform reference(s) in {class_name} name a remembered "
-                "spelling instead of the registered API; write the import or signature each "
-                "issue names"
-            ),
-            "issues": remembered,
-        }
-    # The only gate here that javac cannot stand in for at all: every call it reports is valid Java
-    # against a real signature, and the platform loads and runs the class. The defect is the method
-    # it sits in, so the failure is silent — a listener that never fires, a write the binding throws
-    # away — and arrives as "the plugin does nothing" long after registration reported success.
-    misplaced = scene_misuse_issues(source_text)
-    if misplaced:
-        return {
-            "status": False,
-            "errorCode": "PLUGIN_SOURCE_LIFECYCLE_MISUSE",
-            "phase": "source_validation",
-            "message": (
-                f"{len(misplaced)} call(s) in {class_name} sit in a lifecycle method where they "
-                "cannot take effect; move each one as described in its issue"
-            ),
-            "issues": misplaced,
+            "status": False, "errorCode": findings[0]["errorCode"], "phase": "source_validation",
+            "message": f"{len(findings)} source issue(s); repair the independent findings together",
+            "errorCodes": list(dict.fromkeys(item["errorCode"] for item in findings)),
+            "issues": findings,
+            "sourceWarnings": warnings,
         }
+    build_context = None
     def close_out(module: str, elapsed: float | None, compile_skipped: bool) -> dict[str, Any]:
         archive_path = app_root.resolve() / "archive.json"
+        if hashlib.sha256(source_path.read_bytes()).hexdigest() != source_hash:
+            raise CompileError("Source changed during compilation; validate and compile the current file", "PLUGIN_SOURCE_CHANGED")
+        package = re.search(r"\bpackage\s+([\w.]+)\s*;", stripped(source_text))
+        fqcn = (package[1] + "." if package else "") + class_name
+        compiled_class = project_root / "build" / "classes" / "java" / "main" / Path(*fqcn.split(".")).with_suffix(".class")
+        compiled_artifact = None
+        if not compile_skipped and compiled_class.is_file():
+            content = compiled_class.read_bytes()
+            if parse_class(content)["name"].replace("/", ".") == fqcn:
+                compiled_artifact = {"path": str(compiled_class.resolve()), "fqcn": fqcn,
+                    "sha256": hashlib.sha256(content).hexdigest(), "outputLayout": "gradle-default"}
         try:
             write_archive(archive_path, javas=[{
                 "className": class_name,
@@ -349,13 +373,15 @@ def compile_source(
                 "operationKey": ",".join(
                     dict.fromkeys(key.strip() for key in operation_keys if key.strip())),
                 "filePath": str(source_path.resolve()),
+                "sourceHash": source_hash,
+                "compileStatus": "skipped-by-config" if compile_skipped else "passed",
             }])
         except Exception as exc:
             raise CompileError(
                 f"cannot archive compiled plugin: {exc}", "PLUGIN_ARCHIVE_FAILED", "archive",
             ) from exc
         try:
-            write_state(str(project_root.resolve()), class_name, "source_ready")
+            write_state(str(project_root.resolve()), class_name, "source_ready", emit=False)
         except Exception:
             # The archive entry registration reads is already written. Letting an unwritable .temp
             # raise here reported failure for a class register_plugins.py could then register.
@@ -369,7 +395,22 @@ def compile_source(
             "sourcePath": str(source_path.resolve()),
             "archivePath": str(archive_path),
             "compileSkipped": compile_skipped,
+            "compiledArtifact": compiled_artifact,
+            "fieldAccessorCheck": "metadata-hints" if time_fields is not None else "not-run-no-handoff",
+            "sourceWarnings": warnings,
+            "sourceReview": {"sourceHash": source_hash, "registeredOperationKeys": operation_keys,
+                             "declaredOuterMethods": method_signatures(source_text),
+                             "businessCoverage": "not-established-by-compilation"},
+            "loadingVerification": {
+                "runtimeVerified": False,
+                "status": "not-run",
+                "sourceHash": source_hash,
+                "compiledArtifactAvailable": compiled_artifact is not None,
+                "nextAction": "Verify the configured compile/deploy class artifacts and request-scoped runtime loading evidence before business tests; compilation alone does not activate code.",
+            },
         }
+        if build_context is not None:
+            result["buildContext"] = build_context
         if elapsed is not None:
             result["elapsedSec"] = elapsed
         if compile_skipped:
@@ -388,7 +429,7 @@ def compile_source(
             ]
         return result
 
-    config = inspect_config(write_derived=True)
+    config = inspect_config(write_derived=False)
     config_status = config.get("status")
     if config_status == "disabled":
         # appconfig says compilation is not needed here. Treating that as a hard failure
@@ -401,12 +442,28 @@ def compile_source(
     module = resolve_module(gradle_root, project_root)
     wrapper = gradle_root / ("gradlew.bat" if os.name == "nt" else "gradlew")
     task = f"{module}:compileJava" if module else "compileJava"
+    build_context = {"gradleRoot": str(gradle_root.resolve()), "javaProjectRoot": str(project_root.resolve()),
+                     "wrapperPath": str(wrapper.resolve()), "javaHome": str(Path(config["JAVA_HOME"]).resolve()),
+                     "compileTask": task, "testTaskCandidate": f"{module}:test" if module else "test",
+                     "testTaskEvidence": "Java task convention only; task availability and test results are not verified by this compile receipt"}
     env = os.environ.copy()
     env["JAVA_HOME"] = str(config["JAVA_HOME"])
     started = time.monotonic()
+    # Reuse a build only within one batch and only while its source/build inputs are unchanged.
+    inputs = sorted((project_root / "src").rglob("*.java"))
+    inputs += sorted((project_root / "src").rglob("*.kt"))
+    inputs += [project_root / name for name in ("build.gradle", "build.gradle.kts")]
+    inputs += [gradle_root / name for name in ("settings.gradle", "settings.gradle.kts", "build.gradle", "build.gradle.kts", "gradle.properties")]
+    fingerprint = hashlib.sha256()
+    for file in inputs:
+        fingerprint.update(str(file.resolve()).encode())
+        if file.is_file():
+            fingerprint.update(file.read_bytes())
+    run_key = (str(gradle_root.resolve()), task, env["JAVA_HOME"], fingerprint.hexdigest())
+    reused = module_runs is not None and run_key in module_runs
     try:
-        completed = subprocess.run(
-            [str(wrapper), task, "--rerun-tasks"],
+        completed = module_runs[run_key] if reused else subprocess.run(
+            [str(wrapper), task],
             cwd=gradle_root,
             env=env,
             text=True,
@@ -423,13 +480,19 @@ def compile_source(
             "module": module or ":",
             "message": f"narrow compilation exceeded {timeout_sec} seconds",
             "diagnostics": parse_compiler_errors(str(exc.stdout or ""), source_path),
+            "sourceWarnings": warnings,
         }
     elapsed = round(time.monotonic() - started, 2)
+    if module_runs is not None:
+        module_runs[run_key] = completed
     if completed.returncode != 0:
+        log_path = project_root / ".temp" / "plugin-compile" / (hashlib.sha256(completed.stdout.encode()).hexdigest() + ".log")
+        log_path.parent.mkdir(parents=True, exist_ok=True)
+        log_path.write_text(completed.stdout, encoding="utf-8")
         mine, others, dropped = collect_compiler_errors(
             completed.stdout, str(source_path.resolve()))
-        diagnostics = mine[:DIAGNOSTIC_LIMIT]
-        diagnostics += others[: DIAGNOSTIC_LIMIT - len(diagnostics)]
+        diagnostics = mine[:5]
+        diagnostics += others[: max(0, 5 - len(diagnostics))]
         # Counted before truncation: reporting the shown subset understated a class with more than
         # DIAGNOSTIC_LIMIT errors, and dropped the "plus N elsewhere" clause exactly when the module
         # carried the most unrelated noise.
@@ -443,8 +506,7 @@ def compile_source(
             # The module compiles as a unit, so a pre-existing failure elsewhere fails this run too.
             # Saying so keeps the repair from being aimed at a file this change never touched.
             message += (
-                f", plus {elsewhere} in other source of module {module or ':'} that this change did "
-                "not touch"
+                f", plus {elsewhere} in other source of the same module {module or ':'}"
             )
         if len(diagnostics) < len(mine) + elsewhere:
             message += f" ({len(diagnostics)} shown)"
@@ -455,31 +517,92 @@ def compile_source(
             "module": module or ":",
             "message": message,
             "diagnostics": diagnostics,
+            "diagnosticCount": len(mine) + elsewhere,
+            "logPath": str(log_path.resolve()),
+            "reusedModuleBuild": reused,
+            "recovery": "Repair the shared module errors before retrying. Do not archive or register failed sources.",
             "elapsedSec": elapsed,
+            "sourceWarnings": warnings,
         }
     return close_out(module=module or ":", elapsed=elapsed, compile_skipped=False)
 
 
 def main() -> int:
     parser = argparse.ArgumentParser(description="Narrowly compile one generated Cosmic Java plugin")
-    parser.add_argument("--project-root", required=True, help="Existing Java module root")
-    parser.add_argument("--app-root", required=True)
-    parser.add_argument("--source-path", required=True)
-    parser.add_argument("--class-name", required=True)
-    parser.add_argument("--plugin-type", required=True)
-    parser.add_argument("--form-number", required=True)
+    parser.add_argument("--project-root", help="Existing Java module root")
+    parser.add_argument("--app-root")
+    parser.add_argument("--handoff", help="Prepared context file; reuses its verified identities and short description")
+    parser.add_argument("--sources-file", help="JSON array of sourcePath/className/type/formNumber/operationKeys/description for one module")
+    parser.add_argument("--source-path")
+    parser.add_argument("--class-name")
+    parser.add_argument("--plugin-type")
+    parser.add_argument("--form-number")
     parser.add_argument("--operation-key", action="append", default=[])
-    parser.add_argument("--description", required=True, help="Plugin purpose summary, 1-20 characters")
+    parser.add_argument("--description", help="Plugin purpose summary, 1-20 characters")
     parser.add_argument("--timeout-sec", type=int, default=300)
     args = parser.parse_args()
     try:
-        result = compile_source(
-            Path(args.project_root), Path(args.source_path), args.class_name,
-            max(1, args.timeout_sec),
-            app_root=Path(args.app_root), plugin_type=args.plugin_type,
-            form_number=args.form_number, operation_keys=args.operation_key,
-            description=args.description,
-        )
+        time_fields = None
+        if args.handoff:
+            if any([args.project_root, args.app_root, args.sources_file, args.source_path, args.class_name,
+                    args.plugin_type, args.form_number, args.description, args.operation_key]):
+                raise CompileError("Use --handoff without retyping source/context arguments", "PLUGIN_SOURCE_INVALID")
+            context = compile_handoff(args.handoff)
+            args.project_root, args.app_root = context["projectRoot"], context["appRoot"]
+            args.source_path, args.class_name = context["sourcePath"], context["className"]
+            args.plugin_type, args.form_number = context["type"], context["formNumber"]
+            args.operation_key, args.description = context.get("operationKeys", []), context["description"]
+            time_fields = time_fields_from_handoff(context)
+        if not args.project_root or not args.app_root:
+            raise CompileError("Supply project/app roots or --handoff", "PLUGIN_SOURCE_INVALID")
+        if args.sources_file:
+            if any([args.source_path, args.class_name, args.plugin_type, args.form_number, args.description, args.operation_key]):
+                raise CompileError("Use either --sources-file or single-source arguments", "PLUGIN_BATCH_INPUT_INVALID")
+            entries = json.loads(Path(args.sources_file).read_text(encoding="utf-8-sig"))
+            if not isinstance(entries, list) or not entries or any(
+                not isinstance(item, dict) or (not (isinstance(item.get("handoffPath"), str) and item["handoffPath"].strip()) and (not all(isinstance(item.get(key), str) and item[key].strip()
+                    for key in ("sourcePath", "className", "type", "description"))
+                or not isinstance(item.get("formNumber"), str)
+                or not isinstance(item.get("operationKeys", []), list)
+                or any(not isinstance(key, str) for key in item.get("operationKeys", []))))
+                for item in entries
+            ):
+                raise CompileError("Batch requires nonempty source records", "PLUGIN_BATCH_INPUT_INVALID")
+            module_runs = {}
+            results = []
+            reported_logs = set()
+            for item in entries:
+                context = item
+                try:
+                    context = compile_handoff(item["handoffPath"]) if item.get("handoffPath") else item
+                    if item.get("handoffPath") and (
+                            Path(context["projectRoot"]).resolve() != Path(args.project_root).resolve()
+                            or Path(context["appRoot"]).resolve() != Path(args.app_root).resolve()):
+                        raise CompileError("Batch handoff belongs to a different project or app", "PLUGIN_BATCH_INPUT_INVALID")
+                    outcome = compile_source(
+                        Path(args.project_root), Path(context["sourcePath"]), context["className"], max(1, args.timeout_sec),
+                        app_root=Path(args.app_root), plugin_type=context["type"], form_number=context["formNumber"],
+                        operation_keys=context.get("operationKeys", []), description=context["description"], module_runs=module_runs,
+                        time_fields=time_fields_from_handoff(context) if item.get("handoffPath") else None,
+                    )
+                except CompileError as exc:
+                    outcome = {"status": False, "errorCode": exc.code, "phase": exc.phase, "message": str(exc)}
+                if outcome.get("logPath") in reported_logs:
+                    outcome.pop("diagnostics", None)
+                if outcome.get("logPath"):
+                    reported_logs.add(outcome["logPath"])
+                results.append({"className": context.get("className"), **outcome})
+            result = {"status": all(item.get("status") is True for item in results), "results": results}
+        else:
+            if not all([args.source_path, args.class_name, args.plugin_type, args.form_number, args.description]):
+                raise CompileError("Supply single-source arguments or --sources-file", "PLUGIN_SOURCE_INVALID")
+            result = compile_source(
+                Path(args.project_root), Path(args.source_path), args.class_name,
+                max(1, args.timeout_sec),
+                app_root=Path(args.app_root), plugin_type=args.plugin_type,
+                form_number=args.form_number, operation_keys=args.operation_key,
+                description=args.description, time_fields=time_fields,
+            )
         print(json.dumps(result, ensure_ascii=False))
         return 0 if result.get("status") is True else 2
     except CompileError as exc:

package/skills/cosmic-build/scripts/execution_binding.py

@@ -0,0 +1,40 @@
+"""Bind the installed command source and interpreter, without credentials."""
+from functools import lru_cache
+import hashlib
+import json
+from pathlib import Path
+import sys
+
+
+@lru_cache(maxsize=1)
+def execution_binding():
+    root = Path(__file__).resolve().parents[1]
+    digest = hashlib.sha256((root / "SKILL.md").read_bytes())
+    for directory in (root / "scripts", root / "skills", root / "schemas"):
+        for source in sorted(directory.rglob("*")):
+            if not source.is_file() or source.suffix not in {".py", ".json"} or "test" in source.parts:
+                continue
+            digest.update(source.relative_to(root).as_posix().encode())
+            digest.update(source.read_bytes())
+    return {"rootDir": str(root), "revision": digest.hexdigest(),
+            "python": str(Path(sys.executable).resolve()),
+            "cosmicApi": str(root / "skills" / "cosmic-meta-api" / "scripts" / "cosmic_api.py")}
+
+
+def validate_execution_binding(app_root):
+    context = Path(app_root) / "_runtime" / "context.json"
+    if not context.is_file():
+        return
+    stored = json.loads(context.read_text(encoding="utf-8-sig"))
+    current = execution_binding()
+    if stored.get("environment"):
+        from kd_env_loader import load_environment_identity
+        if stored["environment"] != load_environment_identity():
+            raise ValueError("ENVIRONMENT_BINDING_MISMATCH: bootstrap the selected application in the current environment first")
+    binding = stored.get("executionBinding") or {}
+    source = binding.get("rootDir") or stored.get("rootDir")
+    if source and Path(source).resolve() != Path(current["rootDir"]):
+        raise ValueError("SKILL_SOURCE_MISMATCH: prior source " + str(source)
+                         + "; rebind with the loaded installed source " + current["rootDir"])
+    if binding and binding != current:
+        raise ValueError("SKILL_REVISION_MISMATCH: bootstrap the selected installed source again before execution")