@ultime/codecraft 1.3.0 → 1.5.0

package/evals/cases.json

@@ -0,0 +1,110 @@
+[
+  {
+    "name": "a17-default",
+    "root": "a17-default",
+    "args": ["--pack", "app", "--format", "json"],
+    "expect": { "exit": 0, "findings": { "A17": 1 } }
+  },
+  {
+    "name": "a17-boundaries",
+    "root": "a17-boundaries",
+    "args": ["--pack", "app", "--format", "json"],
+    "expect": { "exit": 0, "findings": { "A17": 1 } }
+  },
+  {
+    "name": "a6-empty-catch",
+    "root": "a6-empty-catch",
+    "args": ["--pack", "app", "--format", "json"],
+    "expect": { "exit": 0, "findings": { "A6": 1 } }
+  },
+  {
+    "name": "ignore-active",
+    "root": "ignore-active",
+    "args": ["--pack", "app", "--format", "json"],
+    "expect": { "exit": 0, "findings": {}, "ignored": 1 }
+  },
+  {
+    "name": "ignore-expired",
+    "root": "ignore-expired",
+    "args": ["--pack", "app", "--format", "json", "--ci"],
+    "expect": { "exit": 1, "findings": { "A17": 1 }, "expired": 1 }
+  },
+  {
+    "name": "library-a11",
+    "root": "library-a11",
+    "args": ["--pack", "library", "--format", "json"],
+    "expect": { "exit": 0, "findings": { "A11": 1 } }
+  },
+  {
+    "name": "zero-files",
+    "root": "zero-files",
+    "args": ["--pack", "library", "--format", "json"],
+    "expect": { "exit": 2, "findings": {}, "warnings": 1 }
+  },
+  {
+    "name": "a17-generated-header",
+    "root": "a17-generated-header",
+    "args": ["--pack", "app", "--format", "json"],
+    "expect": { "exit": 0, "findings": { "A17": 1 } }
+  },
+  {
+    "name": "a21-plaintext",
+    "root": "a21-plaintext",
+    "args": ["--pack", "app", "--format", "json"],
+    "expect": { "exit": 0, "findings": { "A21": 2 } }
+  },
+  {
+    "name": "a2-workspace",
+    "root": "a2-workspace",
+    "args": ["--pack", "library", "--format", "json"],
+    "expect": { "exit": 0, "findings": { "A2": 1 } }
+  },
+  {
+    "name": "a2-declared",
+    "root": "a2-declared",
+    "args": ["--pack", "library", "--format", "json"],
+    "expect": { "exit": 0, "findings": {} }
+  },
+  {
+    "name": "a6-clean",
+    "root": "a6-clean",
+    "args": ["--pack", "app", "--format", "json"],
+    "expect": { "exit": 0, "findings": {} }
+  },
+  {
+    "name": "a11-marker",
+    "root": "a11-marker",
+    "args": ["--pack", "library", "--format", "json"],
+    "expect": { "exit": 0, "findings": {} }
+  },
+  {
+    "name": "a17-local",
+    "root": "a17-local",
+    "args": ["--pack", "app", "--format", "json"],
+    "expect": { "exit": 0, "findings": {} }
+  },
+  {
+    "name": "a17-generated-data",
+    "root": "a17-generated-data",
+    "args": ["--pack", "app", "--format", "json"],
+    "expect": { "exit": 0, "findings": {} }
+  },
+  {
+    "name": "a21-placeholders",
+    "root": "a21-placeholders",
+    "args": ["--pack", "app", "--format", "json"],
+    "expect": { "exit": 0, "findings": {} }
+  },
+  {
+    "name": "a21-doc-paths",
+    "root": "a21-doc-paths",
+    "args": ["--pack", "design-system", "--format", "json"],
+    "expect": { "exit": 0, "findings": { "A21": 2 } }
+  },
+  {
+    "name": "sarif",
+    "root": "a17-default",
+    "args": ["--pack", "app", "--format", "sarif"],
+    "expect": { "exit": 0, "sarif": { "version": "2.1.0", "rule": "A17" } }
+  }
+]

package/evals/fixtures/a11-marker/packages/core/dist/tokens.css

@@ -0,0 +1,4 @@
+/* 生成物 · 勿手改：由 core build 产出 */
+:root {
+  --color-fg: #111;
+}

package/evals/fixtures/a11-marker/packages/core/package.json

@@ -0,0 +1 @@
+{ "name": "@x/core" }

package/evals/fixtures/a11-marker/packages/core/src/index.ts

@@ -0,0 +1 @@
+export const version = '1.0.0'

package/evals/fixtures/a17-boundaries/codecraft.config.json

@@ -0,0 +1,5 @@
+{
+  "boundaries": {
+    "generated": ["@/types/project"]
+  }
+}

package/evals/fixtures/a17-boundaries/src/pages/home.ts

@@ -0,0 +1 @@
+import type { Project } from '@/types/project'

package/evals/fixtures/a17-default/src/pages/home.ts

@@ -0,0 +1 @@
+import { User } from '@/external/user'

package/evals/fixtures/a17-generated-data/src/icons/icons.ts

@@ -0,0 +1,2 @@
+/* icons.ts — 本文件由脚本生成，勿手改 */
+export default { search: '<path />' }

package/evals/fixtures/a17-generated-data/src/pages/home.ts

@@ -0,0 +1,3 @@
+import icons from '@/icons/icons'
+
+export const searchIcon = icons.search

package/evals/fixtures/a17-generated-header/src/pages/home.ts

@@ -0,0 +1,5 @@
+import type { Project } from '@/types/project'
+
+export function nameOf(project: Project) {
+  return project.id
+}

package/evals/fixtures/a17-generated-header/src/types/project.ts

@@ -0,0 +1,4 @@
+/** 本文件由脚本生成，勿手改 */
+export interface Project {
+  id: string
+}

package/evals/fixtures/a17-local/src/pages/home.ts

@@ -0,0 +1,4 @@
+import type { Local } from '@/types/local'
+import { format } from '@/utils/format'
+
+export const label = (value: Local) => format(value.id)

package/evals/fixtures/a17-local/src/types/local.ts

@@ -0,0 +1,3 @@
+export interface Local {
+  id: string
+}

package/evals/fixtures/a17-local/src/utils/format.ts

@@ -0,0 +1,3 @@
+export function format(value: string): string {
+  return value.trim()
+}

package/evals/fixtures/a2-declared/packages/core/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "@x/core",
+  "dependencies": {
+    "@x/kit": "workspace:*"
+  }
+}

package/evals/fixtures/a2-declared/packages/core/src/index.ts

@@ -0,0 +1,3 @@
+import { token } from '@x/kit'
+
+export const value = token

package/evals/fixtures/a2-declared/packages/kit/package.json

@@ -0,0 +1 @@
+{ "name": "@x/kit" }

package/evals/fixtures/a2-workspace/packages/core/package.json

@@ -0,0 +1 @@
+{ "name": "@x/core" }

package/evals/fixtures/a2-workspace/packages/core/src/index.ts

@@ -0,0 +1,3 @@
+import { token } from '@x/kit'
+
+export const value = token

package/evals/fixtures/a2-workspace/packages/kit/package.json

@@ -0,0 +1 @@
+{ "name": "@x/kit" }

package/evals/fixtures/a21-doc-paths/packages/ui/README.md

@@ -0,0 +1,5 @@
+# UI
+
+实现说明见 `docs/开发计划/components/README.md`。
+上游约定见 `../docs/guide.md`。
+自带文档：`docs/guide.md`。

package/evals/fixtures/a21-doc-paths/packages/ui/package.json

@@ -0,0 +1 @@
+{ "name": "@x/ui" }

package/evals/fixtures/a21-doc-paths/packages/ui/src/index.ts

@@ -0,0 +1 @@
+export { Button } from './button'

package/evals/fixtures/a21-placeholders/.env

@@ -0,0 +1,2 @@
+APP_SECRET=${APP_SECRET}
+PASSWORD=

package/evals/fixtures/a21-placeholders/server/application.yml

@@ -0,0 +1,9 @@
+spring:
+  datasource:
+    password: ${DB_PASSWORD}
+  redis:
+    password: ${REDIS_PASSWORD}
+jwt:
+  secret: change-me
+  apiKey: your-key-here
+  accessKey: <ACCESS_KEY>

package/evals/fixtures/a21-placeholders/src/pages/home.ts

@@ -0,0 +1 @@
+export const ready = true

package/evals/fixtures/a21-plaintext/application.yml

@@ -0,0 +1,5 @@
+spring:
+  datasource:
+    password: demo-pass-123
+  redis:
+    password: ${REDIS_PASSWORD}

package/evals/fixtures/a21-plaintext/src/main/java/Ali.java

@@ -0,0 +1,3 @@
+class Ali {
+  private static final String ACCESS_KEY_ID = "LTAI5tAbCdEfGhIjKl";
+}

package/evals/fixtures/a21-plaintext/src/pages/home.ts

@@ -0,0 +1 @@
+export const ready = true

package/evals/fixtures/a6-clean/src/pages/handled.ts

@@ -0,0 +1,8 @@
+export function load(): string {
+  try {
+    return read()
+  } catch (error) {
+    report(error)
+    return ''
+  }
+}

package/evals/fixtures/a6-empty-catch/src/pages/empty.ts

@@ -0,0 +1,3 @@
+try {
+  run()
+} catch {}

package/evals/fixtures/ignore-active/codecraft.config.json

@@ -0,0 +1,5 @@
+{
+  "ignore": [
+    { "rule": "A17", "file": "src/pages/**", "reason": "eval fixture", "expires": "2099-12-31" }
+  ]
+}

package/evals/fixtures/ignore-active/src/pages/home.ts

@@ -0,0 +1 @@
+import { User } from '@/external/user'

package/evals/fixtures/ignore-expired/codecraft.config.json

@@ -0,0 +1,5 @@
+{
+  "ignore": [
+    { "rule": "A17", "file": "src/pages/**", "reason": "eval fixture", "expires": "2000-01-01" }
+  ]
+}

package/evals/fixtures/ignore-expired/src/pages/home.ts

@@ -0,0 +1 @@
+import { User } from '@/external/user'

package/evals/fixtures/library-a11/dist/tokens.css

@@ -0,0 +1,3 @@
+:root {
+  --color-text: #000;
+}

package/evals/fixtures/library-a11/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "eval-library-a11",
+  "version": "0.0.0"
+}

package/evals/fixtures/library-a11/src/index.ts

@@ -0,0 +1 @@
+export const value = 1

package/evals/fixtures/zero-files/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "eval-zero-files",
+  "version": "0.0.0"
+}

package/evals/golden-tasks.md

@@ -109,12 +109,16 @@
 - 期望：命中 A21；只报文件与行号，不回显密钥；提示轮换。
 - 失败信号：漏报；把密钥原文打印到报告；把普通变量名误报为密钥。
 
-## 16. 安装到 agent
+## 16. 安装（已移出本 skill）
 
-- 输入：空项目，无 agent 配置目录。
-- 命令：`codecraft install --root . --agent generic`；再执行一次；最后 `--force`。
-- 期望：生成 `.agents/skills/codecraft/SKILL.md`、`docs/`、`scenarios/`、`prompts/`；第二次 skip；`--force` 覆盖。
-- 失败信号：复制到错误目录；覆盖用户已有内容；`SKILL.md` 引用断链。
+- 安装由 `skills` CLI 负责：`npx skills add ultime-space/skills --skill codecraft`。
+- 不在 Codecraft 规则评估范围内；本文件不再评估安装器行为。
+
+## 17. 审计结论一致性
+
+- 输入：一个项目同时存在「多处 `code === 200`」「生成物无再生成 diff」「CLI `0 findings`」。
+- 期望：A4 判 `warn`；A11 判 `warn`；报告写明 `0 findings` 只是静态未命中；计数带检索命令。
+- 失败信号：A4 / A11 判 `pass`；把静态检查当全通过；结论没有文件行号或命令。
 
 ## 评分
 

package/evals/run.mjs

@@ -0,0 +1,75 @@
+import fs from 'node:fs'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+const BIN = fileURLToPath(new URL('../bin/codecraft.mjs', import.meta.url))
+const CASES = JSON.parse(fs.readFileSync(new URL('./cases.json', import.meta.url), 'utf8'))
+
+let failed = 0
+
+for (const testCase of CASES) {
+  const root = fileURLToPath(new URL(`./fixtures/${testCase.root}/`, import.meta.url))
+  const args = ['check', '--root', root, ...(testCase.args ?? [])]
+  const result = spawnSync(process.execPath, [BIN, ...args], { encoding: 'utf8' })
+  const problems = []
+
+  if (result.status !== testCase.expect.exit) {
+    problems.push(`exit ${result.status}, expected ${testCase.expect.exit}`)
+  }
+
+  if (testCase.expect.sarif) {
+    try {
+      const report = JSON.parse(result.stdout)
+      if (report.version !== testCase.expect.sarif.version) {
+        problems.push(`sarif version ${report.version}, expected ${testCase.expect.sarif.version}`)
+      }
+      if (report.runs?.[0]?.results?.[0]?.ruleId !== testCase.expect.sarif.rule) {
+        problems.push(`sarif result ${report.runs?.[0]?.results?.[0]?.ruleId}, expected ${testCase.expect.sarif.rule}`)
+      }
+    } catch (error) {
+      problems.push(`invalid sarif: ${error.message}`)
+    }
+  } else {
+    let report
+    try {
+      report = JSON.parse(result.stdout)
+    } catch (error) {
+      problems.push(`invalid json: ${error.message}`)
+    }
+    if (report) {
+      const expected = testCase.expect.findings ?? {}
+      const total = Object.values(expected).reduce((sum, count) => sum + count, 0)
+      if (report.findings.length !== total) {
+        problems.push(`findings ${report.findings.length}, expected ${total}`)
+      }
+      const counts = {}
+      for (const finding of report.findings) counts[finding.rule] = (counts[finding.rule] ?? 0) + 1
+      for (const [rule, count] of Object.entries(expected)) {
+        if ((counts[rule] ?? 0) !== count) problems.push(`${rule} ${counts[rule] ?? 0}, expected ${count}`)
+      }
+      for (const key of ['ignored', 'expired']) {
+        const actual = Array.isArray(report[key]) ? report[key].length : report[key]
+        if (testCase.expect[key] != null && actual !== testCase.expect[key]) {
+          problems.push(`${key} ${actual}, expected ${testCase.expect[key]}`)
+        }
+      }
+      if (testCase.expect.warnings != null && report.warnings?.length !== testCase.expect.warnings) {
+        problems.push(`warnings ${report.warnings?.length ?? 0}, expected ${testCase.expect.warnings}`)
+      }
+    }
+  }
+
+  if (problems.length) {
+    failed += 1
+    console.error(`✗ ${testCase.name}: ${problems.join('; ')}`)
+    if (result.stderr.trim()) console.error(result.stderr.trim().split('\n').slice(0, 4).join('\n'))
+  } else {
+    console.log(`✓ ${testCase.name}`)
+  }
+}
+
+if (failed) {
+  console.error(`\n${failed}/${CASES.length} eval cases failed`)
+  process.exit(1)
+}
+console.log(`\n${CASES.length}/${CASES.length} eval cases passed`)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultime/codecraft",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "面向 JS/TS 的代码规范与架构设计（前端默认，Node 后端可复用结构规则），作为可安装的 skill 包。",
   "keywords": [
     "ai",
@@ -18,9 +18,9 @@
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ultime-space/skills.git",
-    "directory": "codecraft"
+    "directory": "skills/codecraft"
   },
-  "homepage": "https://github.com/ultime-space/skills/tree/main/codecraft",
+  "homepage": "https://github.com/ultime-space/skills/tree/main/skills/codecraft",
   "bugs": {
     "url": "https://github.com/ultime-space/skills/issues"
   },
@@ -50,7 +50,9 @@
   "type": "module",
   "scripts": {
     "test": "node --test tests/*.test.mjs",
-    "prepublishOnly": "npm test"
+    "eval": "node evals/run.mjs",
+    "self-check": "node bin/codecraft.mjs check --root . --pack design-system --exclude \"evals/fixtures/**\" --ci",
+    "prepublishOnly": "npm test && npm run self-check"
   },
   "engines": {
     "node": ">=20"

package/prompts/output.md

@@ -1,13 +1,19 @@
 # Output Format（输出格式）
 
-默认 Markdown；JSON 仅用于 CLI / CI。
+默认 Markdown；JSON 仅用于 CLI / CI。Audit 还必须满足 `docs/08-audit-contract.md`。
 
 ## Markdown
 
 ```md
 ## 结论
 
-## 证据
+## 范围与方法
+
+## 逐条判定（A1–A21）
+
+| ID | 判定 | 证据 | 局限 |
+|---|---|---|---|
+| A1 | pass | `src/pages/home/index.vue:1` | 仅抽样 |
 
 ## 差距 / 风险
 
@@ -18,10 +24,15 @@
 ## 下一步
 ```
 
-规则：
+## 规则
 
-- 每条结论引用 A-ID 或文件路径。
+- A1–A21 全部出现；不适用写 `na` 并说明原因。
+- 每条结论引用 A-ID，并给文件行号或可复现命令；计数必须带检索式。
+- `pass` 必须有证据；只有静态检查通过时写 `pass（静态）`，不能替代人工抽样。
+- `codecraft check` 的 0 findings 只能写「静态检查未命中」；同时写明 A17 / A21 的覆盖盲区。
+- 出结论前做一致性检查：A4 / A8 / A11 / A17 / A21 与证据矛盾时必须降级。
 - 不写敏感信息；示例用占位符。
 - 英文术语首次出现用 `English（中文）`。
 - 不把“计划”写成“已完成”。
 - Audit / Plan 模式只输出报告，不改文件。
+- 计划每阶段可回滚，验收用命令或检索结果，不写时间估算。

package/scenarios/audit-existing.md

@@ -15,17 +15,21 @@
 
 ## 步骤
 
-1. 盘点：技术栈、目录、页面、请求层、状态、类型、测试。
-2. 逐条对照 A1–A21；标 pass / warn / fail。
-3. 找“历史实现”与“环节缺失”：哪些是习惯，哪些是必需。
-4. 出差距清单：影响、成本、优先级。
-5. 出升级计划：分阶段、可回滚、每阶段验收。
-6. 风险：兼容、数据、权限、发布。
+1. 确认范围：仓库 / 分支 / 目录、只读声明、能否跑命令。
+2. 盘点：技术栈、目录、页面、请求层、状态、类型、测试。
+3. 先跑静态检查，记录 `files / findings` 与覆盖范围；写明 A17 / A21 盲区。
+4. 逐条对照 A1–A21；标 `pass` / `pass（静态）` / `warn` / `fail` / `na`，每条带证据。
+5. 做一致性检查：A4 / A8 / A11 / A17 / A21 与证据矛盾时降级。
+6. 找“历史实现”与“环节缺失”：哪些是习惯，哪些是必需。
+7. 出差距清单：影响、成本、优先级（P0–P3）。
+8. 出升级计划：分阶段、可回滚、每阶段验收；不写时间估算。
+9. 风险：兼容、数据、权限、发布。
 
 ## 输出
 
-- 体检报告
-- 差距清单（severity）
+- 体检报告（按 `docs/08-audit-contract.md`）
+- 逐条判定表（A1–A21，含证据与局限）
+- 差距清单（P0–P3）
 - 升级计划
 - 回滚方案
 
@@ -38,4 +42,7 @@
 ## 验收
 
 - 只读；不改代码
+- A1–A21 全覆盖或写明 `na`
 - 每条结论有文件路径 / 命令 / A-ID
+- `0 findings` 已注明“仅静态未命中”，没有写成通过
+- 计数可用文中命令复现