@shundoo-ai/dsh-cosmic 1.0.21 → 1.0.22

package/skills/cosmic-build/scripts/execution_binding.py

@@ -21,6 +21,31 @@ def execution_binding():
             "cosmicApi": str(root / "skills" / "cosmic-meta-api" / "scripts" / "cosmic_api.py")}
 
 
+def bound_entrypoint(app_root, relative):
+    """Reuse the selected runtime across this installation's locale entries.
+
+    Do not treat translated executables as equivalent or follow arbitrary paths
+    from context. The selected executable still checks its own revision/env.
+    """
+    context = Path(app_root) / "_runtime" / "context.json"
+    if not context.is_file():
+        return None
+    stored = json.loads(context.read_text(encoding="utf-8-sig"))
+    source = (stored.get("executionBinding") or {}).get("rootDir")
+    if not source:
+        return None
+    current = Path(__file__).resolve().parents[1]
+    selected = Path(source).resolve()
+    package = lambda root: root.parent.parent if root.parent.name == ".locales" else root
+    if current == selected or package(current) != package(selected):
+        return None
+    target = (selected / relative).resolve()
+    target.relative_to(selected)
+    if not target.is_file():
+        raise ValueError("SKILL_BOUND_ENTRY_MISSING: selected installed source lacks " + relative)
+    return target
+
+
 def validate_execution_binding(app_root):
     context = Path(app_root) / "_runtime" / "context.json"
     if not context.is_file():

package/skills/cosmic-build/scripts/platform_api_contract.py

@@ -147,7 +147,7 @@ _SIGNATURE_RE = re.compile(
 # "继承自 IEntryOperate（分录行操作……）") cannot reach the sentence's period through the names
 # charset, so the whole match used to fail and the class looked like it had no supertypes at all.
 _SUPERTYPE_RE = re.compile(
-    r"(?:inherits from|[Ee]xtends|implements|继承自|实现)\s*"
+    r"(?:[Ii]nherits from|[Ee]xtends|implements|继承自|实现)\s*"
     r"(?P<names>[\w.,、，\s]+?)"
     r"(?=[.。()（）；;]|$)")
 _TYPE_TOKEN_RE = re.compile(r"[A-Z][A-Za-z0-9_.$]*")
@@ -310,7 +310,7 @@ def describe_api(selector: str, members: list[str] | None = None) -> dict:
             "evidenceScope": "Registered declarations and documented supertypes; undocumented members are not proof of SDK absence."}
 
 
-def plugin_coding_evidence(plugin_type: str, scenes: list[str] | None = None) -> dict:
+def plugin_coding_evidence(plugin_type: str, scenes: list[str] | None = None, *, core_logic: list[str] | None = None, hit_modules: list[str] | None = None) -> dict:
     """Resolve coding references from the existing type and API registries."""
     registry = json.loads(TYPE_REGISTRY_PAGE.read_text(encoding="utf-8-sig"))
     definition = next((item for item in registry["types"] if item["type"] == plugin_type), None)
@@ -330,6 +330,8 @@ def plugin_coding_evidence(plugin_type: str, scenes: list[str] | None = None) ->
                       "arguments": ["--class", "<receiver class>", "--sdk-dir", "<bound target SDK directory>",
                                     "--member", "<required member>"]},
     }
+    evidence["specializedReferences"] = {name: str(root / registry["specializedStandards"][name])
+        for name in hit_modules or [] if name in registry.get("specializedStandards", {})}
     if plugin_type == "operation":
         evidence["operationDispatch"] = {
             "transactionEvent": {"class": "kd.bos.entity.plugin.args.OperationArgs", "accessor": "event.getOperationKey()",
@@ -397,11 +399,28 @@ def plugin_coding_evidence(plugin_type: str, scenes: list[str] | None = None) ->
             for owner, member in re.findall(r"\b([A-Z][A-Za-z0-9_]*)\.([a-z][A-Za-z0-9_]*)\s*\(", content):
                 if _page_by_simple_name(owner):
                     apis.setdefault(owner, set()).add(member)
+    # Only exact class/member names already supplied by the task select contracts.
+    for name in dict.fromkeys(re.findall(r"[A-Za-z_$][A-Za-z0-9_$]*(?:\.[A-Za-z_$][A-Za-z0-9_$]*)*", "\n".join(core_logic or []))):
+        owner, separator, member = name.rpartition(".")
+        page = _page(name) if name.startswith("kd.bos.") else _page_by_simple_name(name)
+        if page:
+            apis.setdefault(page["fqcn"], set())
+            continue
+        page = (_page(owner) if owner.startswith("kd.bos.") else _page_by_simple_name(owner)) if separator else None
+        if page:
+            apis.setdefault(page["fqcn"], set()).add(member)
     if selected:
         evidence["scenes"] = selected
+    if apis:
+        canonical = {}
+        for owner, members in apis.items():
+            contract = describe_api(owner)
+            if contract.get("status") is not True:
+                continue
+            name = contract["class"]
+            canonical[name] = (canonical.get(name, set()) | members) if name not in canonical or (canonical[name] and members) else set()
         evidence["apiContracts"] = [describe_api(owner, sorted(members))
-                                    for owner, members in sorted(apis.items()) if members
-                                    and _page_by_simple_name(owner)["fqcn"] != base]
+                                    for owner, members in sorted(canonical.items()) if owner != base]
         for contract in evidence["apiContracts"]:
             contract["members"] = [{key: value for key, value in item.items()
                                     if key != "notes" or item["deprecated"]}
@@ -586,6 +605,94 @@ def _arguments(code: str, open_paren: int) -> list[str] | None:
     return None
 
 
+def operation_call_findings(source_text: str, entity_numbers: tuple[str, ...] = ()) -> tuple[list[dict], list[dict]]:
+    """检查操作调用的参数角色；仅阻断已有实体证据的颠倒，不把缺少文档当作 API 不存在。"""
+    code = stripped(source_text)
+    source = commentless(source_text)
+    imports = _imports(code)
+    helpers = {
+        "kd.bos.servicehelper.operation.OperationServiceHelper": "executeOperate",
+        "kd.bos.servicehelper.operation.DeleteServiceHelper": "deleteOperate",
+    }
+    calls = []
+    for match in re.finditer(
+            r"(?<![\w$.])(?P<owner>kd\.bos\.[\w$.]+|[A-Z][\w$]*)\s*\.\s*(?P<member>\w+)\s*\(", code):
+        owner = match["owner"] if match["owner"].startswith(PLATFORM_PACKAGE) else imports.get(match["owner"])
+        if owner not in helpers and owner != "kd.bos.servicehelper.BusinessDataServiceHelper":
+            continue
+        arguments = _arguments(source, match.end() - 1)
+        if arguments is not None:
+            calls.append((owner, match["member"], arguments, match.start()))
+    # 静态导入须解析到同一 SDK 类；本地同名方法会遮蔽它，不能按平台调用检查。
+    local_methods = {body["name"] for body in method_bodies(source_text)}
+    for match in re.finditer(r"\bimport\s+static\s+(kd\.bos\.[\w$.]+)\.(\w+)\s*;", code):
+        if helpers.get(match[1]) != match[2] or match[2] in local_methods:
+            continue
+        for call in re.finditer(r"(?<![\w$.])" + re.escape(match[2]) + r"\s*\(", code):
+            arguments = _arguments(source, call.end() - 1)
+            if arguments is not None:
+                calls.append((match[1], match[2], arguments, call.start()))
+
+    constants = {}
+    for match in re.finditer(r'\bfinal\s+String\s+([\w$]+)\s*=\s*("(?:[^"\\]|\\.)*")\s*;', source):
+        # 同名局部变量、字段或参数存在时，不跨作用域猜测常量值。
+        if code[match.start():match.start() + 5] == "final" and len(re.findall(
+                r"\bString\s+" + re.escape(match[1]) + r"\b", code)) == 1:
+            constants[match[1]] = match[2]
+
+    def value(expression):
+        token = expression.strip()
+        while token.startswith("(") and _call_end(token, 0) == len(token):
+            token = token[1:-1].strip()
+        token = constants.get(token, token)
+        if not re.fullmatch(r'"(?:[^"\\]|\\.)*"', token):
+            return None
+        try:
+            return json.loads(token)
+        except ValueError:
+            return None
+
+    entities = set(entity_numbers)
+    # loadSingle 的第二个参数是实体名或类型；能解析为字符串时提供实体角色证据。
+    for owner, member, arguments, _ in calls:
+        if owner == "kd.bos.servicehelper.BusinessDataServiceHelper" and member == "loadSingle" and len(arguments) >= 2:
+            entity = value(arguments[1])
+            if entity is not None:
+                entities.add(entity)
+    issues = []
+    warnings = []
+    # 仅识别文档示例已有的标准操作；自定义操作不从变量名、前缀或相似名字推断。
+    standard_keys = {"save", "submit", "audit", "unaudit", "delete"}
+    for owner, member, arguments, offset in calls:
+        if helpers.get(owner) != member:
+            continue
+        page = _page(owner)
+        signatures = page["signatures"].get(member, set()) if page else set()
+        if not signatures:
+            continue
+        finding = {"line": code.count("\n", 0, offset) + 1, "call": owner + "." + member,
+                   "reference": str(page["path"]),
+                   "registeredSignatures": sorted(member + "(" + ", ".join(params) + ")" for params in signatures)}
+        if len(arguments) not in {len(params) for params in signatures}:
+            warnings.append({**finding, "severity": "warning", "errorCode": "PLUGIN_SOURCE_OPERATION_OVERLOAD_UNVERIFIED",
+                             "argumentCount": len(arguments),
+                             "message": "操作调用的参数数量不匹配已收录签名。executeOperate 的已收录重载需要第四个 OperateOption；不能套用其他 helper 的重载。未收录不等于不存在，使用绑定 SDK 查证并编译；compile=false 不证明该调用合法。"})
+        # deleteOperate(entityName, pks, option) 是已收录的合法三参数重载，无操作键参数。
+        if owner.endswith("DeleteServiceHelper") and len(arguments) == 3 or len(arguments) < 2:
+            continue
+        operation, entity = value(arguments[0]), value(arguments[1])
+        if entity not in standard_keys or operation is None or operation == entity or operation in standard_keys:
+            continue
+        message = "操作调用应为 (operationKey, entityNumber, ids/dataEntities, option)，不能先传实体编码再传操作编码；两个参数都是 String，javac 无法验证角色顺序。"
+        if operation in entities:
+            issues.append({**finding, "errorCode": "PLUGIN_SOURCE_OPERATION_ARGUMENT_ORDER",
+                           "operationArgument": arguments[0], "entityArgument": arguments[1], "message": message})
+            continue
+        warnings.append({**finding, "severity": "warning", "errorCode": "PLUGIN_SOURCE_OPERATION_ARGUMENT_ORDER_UNVERIFIED",
+                         "message": message + " 当前缺少首参的实体证据，按目标表单操作定义核实，不自动交换参数。"})
+    return issues, warnings
+
+
 def filter_operator_issues(source_text: str) -> list[dict]:
     """QFilter comparison operators written as a string literal instead of a QCP constant."""
     constants = _qcp_constants()
@@ -850,6 +957,220 @@ def scene_misuse_issues(source_text: str) -> list[dict]:
     return issues
 
 
+# Report form callbacks the platform delivers only to a plugin that added itself as the control's
+# listener. Verified against the 8.0 SDK bytecode: AbstractFormPlugin.registerListener is empty and
+# AbstractReportFormPlugin does not override it; AbstractGrid's hyperlink and cell listener lists
+# and Toolbar's item listener list are filled by their add* methods alone, and neither ReportList
+# nor ReportView calls one for the plugin. An override without its add* call compiles, registers
+# and opens, then never fires: the drill-down link or the toolbar button does nothing, and nothing
+# is logged.
+_REPORT_FORM_BASE = "kd.bos.report.plugin.AbstractReportFormPlugin"
+_REPORT_DATA_BASE = "kd.bos.entity.report.AbstractReportListDataPlugin"
+_REPORT_LISTENER_RULES = (
+    {
+        "callbacks": ("hyperLinkClick",),
+        "registration": re.compile(r"\baddHyperClickListener\s*\("),
+        "add": "addHyperClickListener",
+        "example": 'ReportList reportList = this.getControl("reportlistap"); '
+                   "reportList.addHyperClickListener(this);",
+    },
+    {
+        "callbacks": ("itemClick", "beforeItemClick"),
+        "registration": re.compile(r"\baddItemClickListeners?\s*\("),
+        "add": "addItemClickListeners",
+        "example": 'this.addItemClickListeners("toolbarap");',
+    },
+    {
+        "callbacks": ("cellClick", "cellDoubleClick"),
+        "registration": re.compile(r"\baddCellClickListener\s*\("),
+        "add": "addCellClickListener",
+        "example": 'ReportList reportList = this.getControl("reportlistap"); '
+                   "reportList.addCellClickListener(this);",
+    },
+)
+
+
+def _outermost_base_fqcn(code: str) -> str:
+    declared = _outermost_base_class(code)
+    return _resolved_base_import(_imports(code), declared[1]) if declared else ""
+
+
+def report_listener_issues(source_text: str) -> list[dict]:
+    """A report form callback overridden by a plugin that never adds itself as its listener.
+
+    Judged only for a class that directly extends AbstractReportFormPlugin: a project base class
+    may register on the subclass's behalf, and a listener passed as a lambda or an anonymous class
+    is not an override at all. An add* call anywhere in the class counts — one placed in
+    initialize() is already rejected by the lifecycle rule.
+    """
+    code = stripped(source_text)
+    if PLATFORM_PACKAGE not in code or _outermost_base_fqcn(code) != _REPORT_FORM_BASE:
+        return []
+    bodies = {body["name"]: body for body in method_bodies(source_text)}
+    issues: list[dict] = []
+    for rule in _REPORT_LISTENER_RULES:
+        if rule["registration"].search(code):
+            continue
+        for name in rule["callbacks"]:
+            if name not in bodies:
+                continue
+            issues.append({
+                "line": code[: bodies[name]["start"]].count("\n") + 1,
+                "callback": name,
+                "requiredCall": rule["add"],
+                "message": (
+                    f"{name}() is never called: the platform delivers it only to a plugin that "
+                    f"added itself as the control's listener, and this class never calls "
+                    f"{rule['add']}. Add the call in registerListener(EventObject), for example "
+                    f"{rule['example']}"
+                ),
+            })
+    return issues
+
+
+_QUERY_DECLARATION_RE = re.compile(
+    r"\bquery\s*\(\s*(?:final\s+)?(?:[\w$]+\s*\.\s*)*ReportQueryParam\s+[\w$]+\s*,\s*"
+    r"(?:final\s+)?(?:java\s*\.\s*lang\s*\.\s*)?Object\s+(?P<selected>[\w$]+)\s*\)")
+_BATCH_READ_RE = re.compile(r"\b(?:getCurrentBatchRows|byBatchInfo)\s*\(")
+_RETURNS_VALUE_RE = re.compile(r"\breturn\s+(?!null\s*;)")
+
+
+def report_batch_issues(source_text: str) -> list[dict]:
+    """A batched report data plugin whose query() returns the whole result for every batch.
+
+    A non-null queryBatchBy() result switches batching on: the platform splits its basis rows by
+    countPerBatch and calls query() once per batch, handing over the current batch as selectedObj
+    and as queryParam.byBatchInfo().getCurrentBatchRows(). A query() that reads neither returns
+    the full result each time, and the report shows every row once per batch. A byBatchInfo()
+    call anywhere outside queryBatchBy() counts as reading the batch, so a helper method that
+    narrows the query is accepted without being followed.
+    """
+    code = stripped(source_text)
+    if PLATFORM_PACKAGE not in code or _outermost_base_fqcn(code) != _REPORT_DATA_BASE:
+        return []
+    bodies = method_bodies(source_text)
+    batch = next((body for body in bodies if body["name"] == "queryBatchBy"), None)
+    if batch is None or not _RETURNS_VALUE_RE.search(code[batch["start"]:batch["end"]]):
+        return []
+    if _BATCH_READ_RE.search(code[:batch["start"]] + code[batch["end"]:]):
+        return []
+    declaration = _QUERY_DECLARATION_RE.search(code)
+    query = min((body for body in bodies
+                 if declaration and body["name"] == "query" and body["start"] > declaration.end()),
+                key=lambda body: body["start"], default=None)
+    if query is None:
+        return []
+    selected = declaration.group("selected")
+    if re.search(rf"\b{re.escape(selected)}\b", code[query["start"]:query["end"]]):
+        return []
+    return [{
+        "line": code[: query["start"]].count("\n") + 1,
+        "method": "query",
+        "message": (
+            "queryBatchBy() returns batch basis rows, so the platform calls query() once per "
+            f"batch, but query() reads neither its {selected} argument nor "
+            "queryParam.byBatchInfo().getCurrentBatchRows(): every batch returns the whole result "
+            "and the report shows each row once per batch. Narrow query() to the current batch, "
+            "for example with an in filter on the basis values getCurrentBatchRows() returns, or "
+            "return null from queryBatchBy() when the report is not batched"
+        ),
+    }]
+
+
+# Names report examples written against a later release use that the 8.0 SDK has nowhere: none of
+# the 326,774 classes in the 1,016 jars of an 8.0 lib/bos + lib/trd install mentions them, as a
+# declaration or as a call, so no 8.0 receiver can carry them. They are warnings rather than
+# findings because a later target SDK may add them, and the target's own javac settles it when
+# compilation runs; with compilation skipped on an 8.0 target the class registers and then fails
+# to load. A source that declares the name itself is left alone.
+_SDK_ABSENT_NAMES = {
+    "setAsyncDataCount": (
+        "8.0 has no asynchronous row count; ReportList.setAsyncTotal(boolean) defers the total "
+        "line only"),
+    "setCol2ndResultMode": (
+        "8.0 TreeReportListEvent offers setTreeReportList(boolean) and setTreeExpandColId(String) "
+        "only, and no flat header-filter result mode"),
+    "TreeDataMode": "8.0 has no TreeDataMode type",
+    "getFilterQFilters": "use FilterInfo.getQFilters()",
+}
+_ABSENT_NAME_RE = re.compile(r"\b(?P<name>" + "|".join(_SDK_ABSENT_NAMES) + r")\b")
+# FilterInfo declares no getCustomFilter in 8.0; the custom filter list is ReportQueryParam's.
+_FILTER_CUSTOM_FILTER_RE = re.compile(r"\bgetFilter\s*\(\s*\)\s*\.\s*getCustomFilter\s*\(")
+
+
+def sdk_absent_name_warnings(source_text: str) -> list[dict]:
+    """Report API names the 8.0 SDK does not have, each with what 8.0 offers instead."""
+    code = stripped(source_text)
+    if PLATFORM_PACKAGE not in code:
+        return []
+    own = set(re.findall(r"\b(?:class|interface|enum)\s+([\w$]+)", code))
+    own |= {body["name"] for body in method_bodies(source_text)}
+    warnings: list[dict] = []
+    for match in _ABSENT_NAME_RE.finditer(code):
+        name = match.group("name")
+        if name in own:
+            continue
+        warnings.append({
+            "line": code[: match.start()].count("\n") + 1,
+            "name": name,
+            "severity": "warning",
+            "errorCode": "PLUGIN_SOURCE_ABSENT_FROM_8_0_SDK",
+            "message": (
+                f"{name} is absent from the 8.0 SDK: {_SDK_ABSENT_NAMES[name]}. On an 8.0 target "
+                "the source fails to compile, or with compilation skipped the class fails to "
+                "load; keep it only after references/sdk-inspection.md finds it on the target SDK"
+            ),
+        })
+    if "kd.bos.entity.report." in code:
+        for match in _FILTER_CUSTOM_FILTER_RE.finditer(code):
+            warnings.append({
+                "line": code[: match.start()].count("\n") + 1,
+                "name": "FilterInfo.getCustomFilter",
+                "severity": "warning",
+                "errorCode": "PLUGIN_SOURCE_ABSENT_FROM_8_0_SDK",
+                "message": (
+                    "FilterInfo declares no getCustomFilter in the 8.0 SDK; the custom filter list "
+                    "is queryParam.getCustomFilter(), on ReportQueryParam"
+                ),
+            })
+    warnings.sort(key=lambda item: item["line"])
+    return warnings
+
+
+_SOURCE_CAST_RE = re.compile(
+    r"\(\s*(?P<type>(?!Object\b)[A-Z][\w$]*)\s*\)\s*\(?\s*[\w$]+\s*\.\s*getSource\s*\(\s*\)")
+
+
+def report_source_cast_warnings(source_text: str) -> list[dict]:
+    """A packageData() that casts the event source without checking its type first.
+
+    packageData fires once for every cell, and the report examples guard the cast with
+    `instanceof ReportColumn`; an unguarded cast throws ClassCastException on the first cell whose
+    source is another type, which fails the whole page rather than one cell.
+    """
+    code = stripped(source_text)
+    if PLATFORM_PACKAGE not in code or _outermost_base_fqcn(code) != _REPORT_FORM_BASE:
+        return []
+    warnings: list[dict] = []
+    for body in method_bodies(source_text):
+        segment = code[body["start"]:body["end"]]
+        if body["name"] != "packageData" or re.search(r"\binstanceof\b", segment):
+            continue
+        cast = _SOURCE_CAST_RE.search(segment)
+        if cast:
+            warnings.append({
+                "line": code[: body["start"] + cast.start()].count("\n") + 1,
+                "severity": "warning",
+                "errorCode": "PLUGIN_REPORT_SOURCE_CAST_UNGUARDED",
+                "message": (
+                    f"packageData() casts getSource() to {cast.group('type')} without an "
+                    "instanceof check; it fires for every cell, so test the type first, as the "
+                    "report examples do with `if (source instanceof ReportColumn)`"
+                ),
+            })
+    return warnings
+
+
 def _class_bodies(code: str) -> list[dict]:
     """Locate named and anonymous class scopes in comment/literal-free Java."""
     pattern = re.compile(
@@ -1407,9 +1728,21 @@ def main() -> int:
         description="Check platform API contracts in one Java plugin source")
     mode = parser.add_mutually_exclusive_group(required=True)
     mode.add_argument("--source-path")
+    mode.add_argument("--describe-plugin-type", help="Exact runtime plugin type; returns its guide and base contract")
     mode.add_argument("--describe-class", action="append", help="Exact SDK class name or fully qualified name; repeat to batch lookups")
     parser.add_argument("--member", action="append", help="Limit API evidence to named members")
     args = parser.parse_args()
+    if args.describe_plugin_type:
+        registry = json.loads(TYPE_REGISTRY_PAGE.read_text(encoding="utf-8-sig"))
+        entry = next((item for item in registry.get("types", []) if item.get("type") == args.describe_plugin_type), None)
+        if not entry:
+            print(json.dumps({"status": False, "errorCode": "PLUGIN_TYPE_UNSUPPORTED", "type": args.describe_plugin_type}))
+            return 2
+        root = TYPE_REGISTRY_PAGE.parent.parent
+        print(json.dumps({"status": True, "type": entry["type"], "codingEntry": str(root / "skills/cosmic-coding-impl/SKILL.md"), "baseClass": entry.get("baseImport"),
+                          "guide": str(root / entry["guide"]) if entry.get("guide") else None,
+                          "sceneIndex": str(root / "knowledge/cosmic/platform/scenes/_index.md")}, ensure_ascii=False))
+        return 0
     if args.describe_class:
         results = [describe_api(selector, args.member) for selector in args.describe_class]
         print(json.dumps({"status": all(item["status"] for item in results), "classes": results}, ensure_ascii=False))
@@ -1423,16 +1756,21 @@ def main() -> int:
         }, ensure_ascii=False))
         return 2
     source_text = source.read_text(encoding="utf-8-sig", errors="replace")
+    operation_issues, operation_warnings = operation_call_findings(source_text)
     mismatches = return_type_issues(source_text)
     operators = filter_operator_issues(source_text)
     missing = forbidden_member_issues(source_text)
     misplaced = scene_misuse_issues(source_text)
+    unregistered = report_listener_issues(source_text)
+    unbatched = report_batch_issues(source_text)
     bases = base_class_issues(source_text)
     overrides = override_signature_issues(source_text)
     remembered_imports = unverified_import_issues(source_text)
     remembered_members = unverified_member_issues(source_text)
     error_code = "0"
-    if mismatches:
+    if operation_issues:
+        error_code = operation_issues[0]["errorCode"]
+    elif mismatches:
         error_code = "PLUGIN_SOURCE_RETURN_TYPE_MISMATCH"
     elif operators:
         error_code = "PLUGIN_SOURCE_QFILTER_STRING_OPERATOR"
@@ -1440,6 +1778,10 @@ def main() -> int:
         error_code = "PLUGIN_SOURCE_NONEXISTENT_MEMBER"
     elif misplaced:
         error_code = "PLUGIN_SOURCE_LIFECYCLE_MISUSE"
+    elif unregistered:
+        error_code = "PLUGIN_SOURCE_LISTENER_UNREGISTERED"
+    elif unbatched:
+        error_code = "PLUGIN_SOURCE_BATCH_NOT_NARROWED"
     elif bases:
         error_code = "PLUGIN_SOURCE_BASE_CLASS_MISMATCH"
     elif overrides:
@@ -1451,8 +1793,11 @@ def main() -> int:
         "errorCode": error_code,
         "sourcePath": str(source.resolve()),
         "issues": (
-            mismatches + operators + missing + misplaced + bases + overrides
-            + remembered_imports + remembered_members
+            operation_issues + mismatches + operators + missing + misplaced + unregistered + unbatched + bases
+            + overrides + remembered_imports + remembered_members
+        ),
+        "sourceWarnings": (
+            operation_warnings + sdk_absent_name_warnings(source_text) + report_source_cast_warnings(source_text)
         ),
     }, ensure_ascii=False))
     return 0 if error_code == "0" else 2

package/skills/cosmic-build/scripts/plugin_source_gate.py

@@ -81,7 +81,8 @@ def validate_registration_entry(entry, target_type, class_name=None):
     if not source.is_absolute() or not source.is_file():
         raise ValueError("PLUGIN_LOCAL_SOURCE_UNVERIFIED: resolve the archive source path before registration")
     from java_source import stripped
-    text = stripped(source.read_text(encoding="utf-8-sig"))
+    source_text = source.read_text(encoding="utf-8-sig")
+    text = stripped(source_text)
     declaration = re.search(r"\bclass\s+" + re.escape(class_name.rsplit(".", 1)[-1])
                             + r"\b([^{}]*)\{", text)
     if declaration is None:
@@ -98,6 +99,13 @@ def validate_registration_entry(entry, target_type, class_name=None):
     actual = hashlib.sha256(source.read_bytes()).hexdigest()
     if entry.get("sourceHash") != actual:
         raise ValueError("PLUGIN_SOURCE_CHANGED: source differs from its compile result; compile the current source again")
+    # 旧版本的成功回执不包含参数角色门禁；注册前重验，避免沿用历史误放行的源码。
+    from platform_api_contract import operation_call_findings
+    issues, warnings = operation_call_findings(source_text, (str(entry.get("formNumber") or ""),))
+    blockers = issues + ([item for item in warnings if item["errorCode"] == "PLUGIN_SOURCE_OPERATION_OVERLOAD_UNVERIFIED"]
+                         if entry["compileStatus"] == "skipped-by-config" else [])
+    if blockers:
+        raise ValueError(blockers[0]["errorCode"] + ": " + blockers[0]["message"])
     return {"compileStatus": entry["compileStatus"], "sourceHash": actual}
 
 

package/skills/cosmic-build/scripts/plugin_target_sdk.py

@@ -6,30 +6,34 @@ from inspect_platform_sdk import inspect_sdk
 
 
 class TargetSdkError(ValueError):
-    def __init__(self, code, message):
+    def __init__(self, code, message, *, details=None):
         super().__init__(message)
         self.error_code = code
+        self.details = details or {}
 
 
 def verify_target_sdk(project_root, coding, usage=None):
+    if usage is not None and (not isinstance(usage, list) or any(not isinstance(item, dict)
+            or not isinstance(item.get('class'), str) or not item['class']
+            or set(item) - {'class', 'members'} or not isinstance(item.get('members', []), list)
+            or any(not isinstance(member, str) or not member for member in item.get('members', [])) for item in usage)):
+        raise TargetSdkError('PLUGIN_SDK_USAGE_INVALID', 'sdkUsage requires exact class and member selectors')
     environment = inspect_compile_environment(project_root)
     if environment.get('status') == 'disabled':
         return {'status': 'not-run', 'compile': False, 'projectRoot': str(Path(project_root).resolve()),
                 'evidenceScope': 'Source-only configuration: target SDK, compilation and runtime are unverified'}
     if environment.get('status') != 'ready':
         raise TargetSdkError(environment.get('code') or 'PLUGIN_SDK_ENVIRONMENT_UNVERIFIED',
-                             environment.get('message') or 'Target compile environment is unverified')
+                             environment.get('message') or 'Target compile environment is unverified',
+                             details={'buildEnvironment': environment})
     jars = sorted({str(file.resolve()) for directory in environment.get('sdkDirectories', [])
                    for file in Path(directory['path']).glob('*.jar')})
     if not jars:
         raise TargetSdkError('PLUGIN_TARGET_SDK_UNRESOLVED', 'The bound module does not establish target SDK libraries')
-    if usage is not None and (not isinstance(usage, list) or any(not isinstance(item, dict)
-            or not isinstance(item.get('class'), str) or not item['class']
-            or set(item) - {'class', 'members'} or not isinstance(item.get('members', []), list)
-            or any(not isinstance(member, str) or not member for member in item.get('members', [])) for item in usage)):
-        raise TargetSdkError('PLUGIN_SDK_USAGE_INVALID', 'sdkUsage requires exact class and member selectors')
+    # Guide signatures include unrelated lifecycle types; verify the actual base and
+    # selected API receivers. Explicit sdkUsage verifies needed event declarations.
     classes = sorted({coding.get('baseContract', {}).get('class'),
-                      *[item.get('class') for item in coding.get('signatureTypes', [])]} - {None})
+                      *[item.get('class') for item in coding.get('apiContracts', [])]} - {None})
     verified = [inspect_sdk(jars, name, mode='locate') for name in classes if name.startswith('kd.bos.')]
     contracts = [inspect_sdk(jars, item['class'], item.get('members')) for item in usage or []]
     for result in [*verified, *contracts]: