@weotro/dx 0.1.3 → 0.1.5

package/README.md

@@ -202,6 +202,10 @@ target（端）不写死，由 `env-policy.jsonc.targets` 定义；`commands.jso
     "primary": { "label": "Primary brand" },
     "secondary": { "label": "Secondary brand" }
   },
+  "committedRuntime": {
+    "target": "backend",
+    "keys": ["SENTRY_ORG"]
+  },
   "requiredLocalKeys": {
     "staging": ["DATABASE_URL"],
     "production": ["DATABASE_URL"]
@@ -218,7 +222,13 @@ dx env validate secondary --staging
 dx env exec secondary --staging -- dx deploy backend
 ```
 
-`dx env exec` 会加锁、原子装配 `.env.<environment>.local`、把同一份值注入子进程，并在成功、
+`committedRuntime` 是可选的公开 runtime allowlist。`target` 必须指向 `env-policy.jsonc.targets`
+中的 target；`keys` 只会从该 target 当前环境的 committed 文件读取。未配置时默认空 allowlist，
+行为与旧版本一致。allowlist 不接受 secret/localOnly 键、空值或机密占位符，也不允许 committed
+文件越出项目根目录。合并优先级为调用进程环境 < private profile < committed allowlist，因此仓库
+已审查的 committed 公共值最终生效，未列入 allowlist 的 committed 字段不会被导出。
+
+`dx env exec` 会加锁、原子装配 `.env.<environment>.local`、把合并后的值注入直接子进程，并在成功、
 失败或中断后删除临时文件。根目录不允许持久保存 staging/production `.local`；发现旧文件时命令
 会直接报错，必须先迁移到品牌 profile。内部 `dx` 命令未指定环境时会自动补齐；指定冲突环境时
 直接拒绝。该命令只操作本机文件和子进程，不包含上传、同步或修改 GitHub Environment 的能力。

package/lib/env-profile.js

@@ -8,17 +8,19 @@ import {
   mkdirSync,
   openSync,
   readFileSync,
+  realpathSync,
   renameSync,
   rmSync,
   statSync,
   writeFileSync,
 } from 'node:fs'
 import { tmpdir } from 'node:os'
-import { basename, join, relative } from 'node:path'
+import { basename, isAbsolute, join, relative, resolve, sep } from 'node:path'
 import { loadEnvPolicy, resolveTargetRequiredVars } from './env-policy.js'
 
 const PROFILE_CONFIG_FILE = 'env-profiles.json'
 const PROFILE_NAME_PATTERN = /^[a-z0-9][a-z0-9-]*$/
+const ENV_KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/
 const SIGNAL_EXIT_CODES = { SIGINT: 130, SIGTERM: 143, SIGHUP: 129 }
 
 function assert(condition, message) {
@@ -69,7 +71,29 @@ export function loadEnvProfileConfig(configDir) {
     assert(config.environments.includes(environment), `requiredLocalKeys 包含未声明环境: ${environment}`)
     assert(Array.isArray(keys), `requiredLocalKeys.${environment} 必须为数组`)
     for (const key of keys) {
-      assert(/^[A-Za-z_][A-Za-z0-9_]*$/.test(key), `requiredLocalKeys.${environment} 包含非法键: ${key}`)
+      assert(ENV_KEY_PATTERN.test(key), `requiredLocalKeys.${environment} 包含非法键: ${key}`)
+    }
+  }
+
+  if (config.committedRuntime !== undefined) {
+    const committedRuntime = config.committedRuntime
+    assert(
+      committedRuntime && typeof committedRuntime === 'object' && !Array.isArray(committedRuntime),
+      `${PROFILE_CONFIG_FILE}.committedRuntime 必须为对象`,
+    )
+    assert(
+      typeof committedRuntime.target === 'string' && committedRuntime.target.trim(),
+      `${PROFILE_CONFIG_FILE}.committedRuntime.target 必须为非空字符串`,
+    )
+    assert(Array.isArray(committedRuntime.keys), `${PROFILE_CONFIG_FILE}.committedRuntime.keys 必须为数组`)
+    const seenKeys = new Set()
+    for (const key of committedRuntime.keys) {
+      assert(
+        typeof key === 'string' && ENV_KEY_PATTERN.test(key),
+        `${PROFILE_CONFIG_FILE}.committedRuntime.keys 包含非法键: ${String(key)}`,
+      )
+      assert(!seenKeys.has(key), `${PROFILE_CONFIG_FILE}.committedRuntime.keys 包含重复键: ${key}`)
+      seenKeys.add(key)
     }
   }
 
@@ -163,6 +187,70 @@ function mergeEntries(...maps) {
   return merged
 }
 
+function resolveCommittedRuntimeEnv({ projectRoot, config, policy, environment }) {
+  const committedRuntime = config.committedRuntime
+  if (!committedRuntime || committedRuntime.keys.length === 0) return {}
+
+  const targetId = committedRuntime.target
+  const target = policy.targets?.[targetId]
+  assert(target, `${PROFILE_CONFIG_FILE}.committedRuntime.target 指向不存在的 policy target: ${targetId}`)
+  assert(
+    policy.environments.includes(environment),
+    `${PROFILE_CONFIG_FILE}.committedRuntime 不支持 policy 未声明的环境: ${environment}`,
+  )
+
+  const committedTemplate = target.files.committed
+  assert(
+    committedTemplate.includes('{env}'),
+    `env-policy.jsonc.targets.${targetId}.files.committed 必须包含 {env} 才能用于 committed runtime`,
+  )
+  const projectBoundary = resolve(projectRoot)
+  const committedPath = resolve(projectBoundary, committedTemplate.replace(/\{env\}/g, environment))
+  const pathWithinProject = relative(projectBoundary, committedPath)
+  assert(
+    pathWithinProject &&
+      pathWithinProject !== '..' &&
+      !pathWithinProject.startsWith(`..${sep}`) &&
+      !isAbsolute(pathWithinProject),
+    `committed runtime 文件必须位于项目根目录内: ${committedTemplate}`,
+  )
+
+  const secretKeys = new Set(policy.keys?.secret || [])
+  const localOnlyKeys = new Set(policy.keys?.localOnly || [])
+  for (const key of committedRuntime.keys) {
+    assert(!secretKeys.has(key), `committed runtime 不允许导出机密键: ${key}`)
+    assert(!localOnlyKeys.has(key), `committed runtime 不允许导出 localOnly 键: ${key}`)
+  }
+
+  assert(existsSync(committedPath), `committed runtime 文件不存在: ${pathWithinProject}`)
+  const linkStat = lstatSync(committedPath)
+  assert(!linkStat.isSymbolicLink(), `committed runtime 文件不允许使用符号链接: ${pathWithinProject}`)
+  assert(statSync(committedPath).isFile(), `committed runtime 路径必须是普通文件: ${pathWithinProject}`)
+  const realProjectBoundary = realpathSync(projectBoundary)
+  const realCommittedPath = realpathSync(committedPath)
+  const realPathWithinProject = relative(realProjectBoundary, realCommittedPath)
+  assert(
+    realPathWithinProject &&
+      realPathWithinProject !== '..' &&
+      !realPathWithinProject.startsWith(`..${sep}`) &&
+      !isAbsolute(realPathWithinProject),
+    `committed runtime 文件解析后必须位于项目根目录内: ${pathWithinProject}`,
+  )
+
+  const placeholder = normalizedValue(policy.secretPlaceholder)
+  const committedEntries = parseEnvContent(readFileSync(committedPath, 'utf8'), committedPath)
+  const committedEnv = {}
+
+  for (const key of committedRuntime.keys) {
+    assert(committedEntries.has(key), `${pathWithinProject}: 缺少 committed runtime 键 ${key}`)
+    const value = normalizedValue(committedEntries.get(key))
+    assert(value && value !== placeholder, `${pathWithinProject}: committed runtime 键 ${key} 不能是空值或占位符`)
+    committedEnv[key] = value
+  }
+
+  return committedEnv
+}
+
 export function validateEnvProfile({ projectRoot, configDir, profile, environment }) {
   const config = loadEnvProfileConfig(configDir)
   assert(config.profiles[profile], `未声明 env profile: ${profile}`)
@@ -177,6 +265,12 @@ export function validateEnvProfile({ projectRoot, configDir, profile, environmen
   assertGitIgnored(projectRoot, paths.source)
 
   const policy = loadEnvPolicy(configDir)
+  const committedRuntimeEnv = resolveCommittedRuntimeEnv({
+    projectRoot,
+    config,
+    policy,
+    environment,
+  })
   const placeholder = normalizedValue(policy.secretPlaceholder)
   const secretKeys = new Set(policy.keys?.secret || [])
   const allowedLocalKeys = new Set([
@@ -240,6 +334,7 @@ export function validateEnvProfile({ projectRoot, configDir, profile, environmen
     source: paths.source,
     target: paths.target,
     keyCount: profileEntries.size,
+    committedRuntimeEnv,
   }
 }
 
@@ -421,6 +516,7 @@ export async function executeWithEnvProfile({
       env: {
         ...process.env,
         ...profileEnv,
+        ...validated.committedRuntimeEnv,
         DX_ENV_PROFILE: profile,
         DX_ENV_PROFILE_ENVIRONMENT: environment,
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@weotro/dx",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "type": "module",
   "license": "MIT",
   "repository": {

package/skills/third-party-review/SKILL.md

@@ -36,7 +36,7 @@ description: ""
 | 当前宿主 | reviewer |
 |---|---|
 | Codex | 已暴露且可直接调用 Claude Code 时使用 Claude Code；否则派一个 fresh-context reviewer subagent |
-| Claude Code | 有匹配的 `codex:*` 技能时使用该技能；代码审查优先 `codex:review`，否则派一个 fresh-context reviewer subagent |
+| Claude Code | 有匹配的 `codex:*` 技能时使用该技能；代码审查优先 `codex:rescue`，否则派一个 fresh-context reviewer subagent |
 | 其他宿主 | 派一个 fresh-context reviewer subagent |
 
 一次任务只派发一个 reviewer。调用失败或超时后不重试、不改派第二个 reviewer；返回 `UNAVAILABLE`。reviewer 不得递归委派。