@winspan/claude-forge 4.1.0 → 6.1.0

package/dist/engine/conventions/dependency-safety.yaml

@@ -0,0 +1,131 @@
+id: "dependency-safety"
+name: "依赖安全规范"
+version: "1.0.0"
+description: "第三方依赖管理的安全规则，覆盖版本锁定、漏洞检测和供应链风险"
+
+variables:
+  package_managers: ["npm", "yarn", "pnpm", "pip", "gem", "cargo", "go"]
+  known_vulnerable_packages: ["event-stream@3.3.6", "eslint-scope@3.7.2"]
+  dev_only_packages: ["webpack", "vite", "eslint", "prettier", "jest", "vitest", "typescript"]
+
+forbidden:
+  - id: "no-unversioned-install"
+    when: |
+      tool == "Bash"
+      && args.command.match(/(?:npm|yarn|pnpm)\s+(?:add|install)\s+[a-z@][a-z0-9-/@]*(?:\s|$)/).ok()
+      && !args.command.match(/@[\d.]+/).ok()
+      && !args.command.includes("--save-dev")
+      && !args.command.includes("-D")
+    level: warn
+    message: "安装依赖时未指定版本号，可能引入不兼容更新"
+    suggestion: "使用 npm install package@version 锁定版本，或在 package.json 中使用精确版本"
+
+  - id: "warn-global-install"
+    when: |
+      tool == "Bash"
+      && args.command.match(/(?:npm|yarn|pnpm)\s+(?:install|add)\s+-g/).ok()
+    level: warn
+    message: "全局安装依赖可能导致版本冲突"
+    suggestion: "优先使用项目本地依赖或 npx 执行"
+
+  - id: "no-known-vulnerable"
+    when: |
+      tool == "Bash"
+      && vars.known_vulnerable_packages.any(pkg => args.command.includes(pkg))
+    level: block
+    message: "尝试安装已知存在漏洞的包版本"
+    suggestion: "升级到安全版本或寻找替代方案"
+
+  - id: "warn-dev-in-prod"
+    when: |
+      tool.in(["Write", "Edit"])
+      && file_path.endsWith("package.json")
+      && (args.content ?? args.new_string ?? "").match(/"dependencies":\s*\{[^}]*(?:webpack|vite|eslint|prettier|jest|vitest|typescript)/).ok()
+    level: warn
+    message: "检测到开发工具出现在 dependencies 中"
+    suggestion: "将开发工具移至 devDependencies，减小生产包体积"
+
+  - id: "warn-npm-audit-skip"
+    when: |
+      tool == "Bash"
+      && args.command.match(/npm\s+install.*--no-audit/).ok()
+    level: warn
+    message: "跳过了 npm audit 安全检查"
+    suggestion: "移除 --no-audit 以启用漏洞扫描"
+
+  - id: "warn-package-lock-delete"
+    when: |
+      tool == "Bash"
+      && args.command.match(/rm\s+.*(?:package-lock\.json|yarn\.lock|pnpm-lock\.yaml)/).ok()
+    level: confirm
+    message: "删除锁文件会导致依赖版本不确定"
+    suggestion: "只在解决依赖冲突时删除，删除后需重新生成并提交"
+
+  - id: "no-npm-install-root"
+    when: |
+      tool == "Bash"
+      && args.command.match(/sudo\s+npm\s+install/).ok()
+    level: block
+    message: "禁止使用 sudo npm install，存在权限风险"
+    suggestion: "修复 npm 权限配置或使用 nvm 管理 Node.js"
+
+  - id: "warn-wildcard-version"
+    when: |
+      tool.in(["Write", "Edit"])
+      && file_path.endsWith("package.json")
+      && (args.content ?? args.new_string ?? "").match(/"[^"]+"\s*:\s*"\*"/).ok()
+    level: warn
+    message: "依赖版本使用通配符 *，可能引入破坏性更新"
+    suggestion: "使用语义化版本范围（如 ^1.2.3）或精确版本"
+
+  - id: "warn-outdated-major"
+    when: |
+      tool == "Bash"
+      && args.command.match(/npm\s+(?:install|update).*@\d+\./).ok()
+      && args.command.match(/@[0-4]\./).ok()
+    level: warn
+    message: "安装的依赖版本可能过旧（主版本 < 5）"
+    suggestion: "检查是否有更新的稳定版本"
+
+escalation:
+  - id: "dependency-churn-alert"
+    when: |
+      history.last(10).filter(e =>
+        e.tool == "Bash"
+        && e.args.command.match(/npm\s+(?:install|uninstall|update)/).ok()
+      ).length >= 5
+    action: warn
+    message: "短时间内频繁变更依赖（10 次操作中 5+ 次）"
+    suggestion: "建议整理依赖变更计划，避免反复试错"
+
+  - id: "audit-reminder"
+    when: |
+      history.file_changes.any(f => f.endsWith("package.json"))
+      && !history.last(5).any(e =>
+        e.tool == "Bash"
+        && e.args.command.includes("npm audit")
+      )
+    action: warn
+    message: "修改了 package.json 但未运行安全审计"
+    suggestion: "运行 npm audit 检查已知漏洞"
+
+deliverables:
+  - name: "依赖安全审计"
+    command: "npm audit --audit-level=moderate"
+    required: true
+    check_at: "before_commit"
+
+  - name: "锁文件一致性"
+    command: "npm ci"
+    required: false
+    check_at: "ci"
+
+principles: |
+  ## 依赖安全规范
+  - 安装依赖时锁定版本号，避免隐式升级
+  - 禁止安装已知漏洞包
+  - 开发工具放在 devDependencies
+  - 保留锁文件，确保依赖可复现
+  - 定期运行 npm audit 检查漏洞
+  - 避免使用 sudo npm install
+  - 依赖变更后运行安全审计

package/dist/engine/conventions/git-safety.yaml

@@ -0,0 +1,105 @@
+id: "git-safety"
+name: "Git 操作安全规范"
+version: "1.0.0"
+description: "Git 版本控制操作的安全规则，防止误操作导致代码丢失"
+
+variables:
+  protected_branches: ["main", "master", "production", "staging", "release"]
+  dangerous_git_commands: ["reset --hard", "clean -fd", "clean -fdx", "branch -D"]
+
+forbidden:
+  - id: "no-force-push-main"
+    when: |
+      tool == "Bash"
+      && args.command.match(/git\s+push.*--force/).ok()
+      && git.branch.in(vars.protected_branches)
+    level: block
+    message: "禁止强制推送到受保护分支 {{git.branch}}"
+    suggestion: "使用 --force-with-lease 或创建新分支后提交 PR"
+
+  - id: "warn-force-push-feature"
+    when: |
+      tool == "Bash"
+      && args.command.match(/git\s+push.*--force(?!-with-lease)/).ok()
+      && !git.branch.in(vars.protected_branches)
+    level: warn
+    message: "检测到 git push --force，这会覆盖远程历史"
+    suggestion: "考虑使用 --force-with-lease 以避免覆盖他人提交"
+
+  - id: "no-reset-hard-uncommitted"
+    when: |
+      tool == "Bash"
+      && args.command.match(/git\s+reset\s+--hard/).ok()
+      && git.has_uncommitted_changes
+    level: block
+    message: "禁止在有未提交更改时执行 git reset --hard"
+    suggestion: "先使用 git stash 保存更改，或提交后再 reset"
+
+  - id: "warn-reset-hard"
+    when: |
+      tool == "Bash"
+      && args.command.match(/git\s+reset\s+--hard/).ok()
+    level: confirm
+    message: "git reset --hard 会丢弃所有未提交的更改"
+    suggestion: "确认这是有意为之，或使用 git stash 保存更改"
+
+  - id: "warn-clean-fd"
+    when: |
+      tool == "Bash"
+      && args.command.match(/git\s+clean\s+-[^\s]*f[^\s]*d/).ok()
+    level: confirm
+    message: "git clean -fd 会删除所有未跟踪的文件和目录"
+    suggestion: "确认不会误删重要文件，或先使用 git clean -n 预览"
+
+  - id: "no-delete-git-dir"
+    when: |
+      tool == "Bash"
+      && args.command.match(/rm\s+-[^\s]*r[^\s]*.*\.git/).ok()
+    level: block
+    message: "禁止删除 .git 目录，这会导致版本历史丢失"
+
+  - id: "warn-branch-delete-unmerged"
+    when: |
+      tool == "Bash"
+      && args.command.match(/git\s+branch\s+-D/).ok()
+    level: confirm
+    message: "git branch -D 会强制删除分支，即使未合并"
+    suggestion: "使用 git branch -d 以确保分支已合并，或确认这是有意为之"
+
+  - id: "warn-rebase-public-branch"
+    when: |
+      tool == "Bash"
+      && args.command.match(/git\s+rebase/).ok()
+      && git.branch.in(vars.protected_branches)
+    level: block
+    message: "禁止在公共分支上执行 rebase"
+    suggestion: "rebase 会改写历史，只应在本地分支使用"
+
+  - id: "warn-amend-pushed-commit"
+    when: |
+      tool == "Bash"
+      && args.command.match(/git\s+commit\s+--amend/).ok()
+      && git.last_commit_pushed
+    level: warn
+    message: "修改已推送的提交需要 force push"
+    suggestion: "如果他人已拉取该提交，考虑创建新提交而非修改"
+
+escalation:
+  - id: "repeated-git-failures"
+    when: |
+      history.last(5).filter(e =>
+        e.tool == "Bash"
+        && e.args.command.startsWith("git")
+        && e.failed
+      ).length >= 3
+    action: confirm
+    message: "Git 操作连续失败 3 次，可能需要调整策略"
+    suggestion: "检查分支状态、远程连接或权限配置"
+
+principles: |
+  ## Git 操作安全规范
+  - 受保护分支禁止强制推送和 rebase
+  - 危险操作（reset --hard、clean -fd）需要确认
+  - 禁止删除 .git 目录
+  - 强制删除分支前确认已合并
+  - 修改已推送的提交需谨慎

package/dist/engine/conventions/strict-security.yaml

@@ -0,0 +1,30 @@
+id: "strict-security"
+name: "严格安全规范"
+version: "1.0.0"
+description: "继承基础安全规范，升级部分规则为更严格的级别"
+extends: ["basic-security"]
+
+overrides:
+  - rule_id: "warn-sensitive-file-write"
+    level: block
+    message: "严格模式：禁止修改敏感文件"
+
+  - rule_id: "warn-hardcoded-secret"
+    level: confirm
+    message: "严格模式：检测到疑似硬编码密钥，必须确认"
+
+forbidden:
+  - id: "no-console-log-in-production"
+    when: |
+      tool.in(["Write", "Edit"])
+      && file_path != null
+      && !file_path.includes("test")
+      && (args.content ?? args.new_string ?? "").includes("console.log")
+    level: warn
+    message: "生产代码中包含 console.log，建议使用日志库"
+
+principles: |
+  ## 严格安全规范（继承自基础安全规范）
+  - 敏感文件修改直接阻断（升级为 block）
+  - 硬编码密钥必须确认（升级为 confirm）
+  - 生产代码禁止 console.log

package/dist/engine/conventions/ts-quality.yaml

@@ -0,0 +1,49 @@
+id: "ts-quality"
+name: "TypeScript 质量规范"
+version: "1.0.0"
+description: "TypeScript 项目的代码质量规则"
+
+variables:
+  max_file_lines: 300
+  max_consecutive_edits_same_file: 4
+
+forbidden:
+  - id: "no-any-type"
+    when: |
+      tool.in(["Write", "Edit"])
+      && file_ext == ".ts"
+      && (args.content ?? args.new_string ?? "").match(/:\s*any\b/).ok()
+    level: warn
+    message: "检测到 TypeScript any 类型，建议使用具体类型"
+
+  - id: "large-file-needs-test"
+    when: |
+      tool == "Write"
+      && file_ext.in([".ts", ".tsx"])
+      && !file_path.includes("test")
+      && !file_path.includes("spec")
+      && (args.content ?? "").split("\n").length >= vars.max_file_lines
+      && history.file_changes.filter(f => f.includes("test")).length == 0
+    level: warn
+    message: "写入了超过 {{vars.max_file_lines}} 行的代码文件，建议同步编写测试"
+
+escalation:
+  - id: "edit-loop-detection"
+    when: |
+      history.last(6).filter(e => e.tool == "Edit" && e.args.file_path == file_path).length >= vars.max_consecutive_edits_same_file
+    action: confirm
+    message: "检测到对同一文件的反复编辑，可能陷入循环"
+    suggestion: "建议退一步重新审视方案"
+
+deliverables:
+  - name: "类型检查通过"
+    command: "npx tsc --noEmit"
+    required: true
+    check_at: "before_commit"
+
+principles: |
+  ## TypeScript 质量规范
+  - 禁止使用 any 类型
+  - 超过 300 行的代码文件必须有对应测试
+  - 反复编辑同一文件时触发循环检测
+  - 提交前必须通过类型检查

package/dist/engine/dsl/compiler.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Convention DSL Expression Compiler
+ *
+ * Compiles chain-call expressions to TypeScript closures.
+ *
+ * Supported syntax:
+ * - Comparison: ==, !=, >, <, >=, <=
+ * - Logical: &&, ||, !
+ * - Chain calls: obj.method(args)
+ * - Property access: obj.prop
+ * - Arrow functions: (x => x.prop)
+ * - Regex: /pattern/flags
+ * - Null coalescing: ??
+ * - Template strings: {{expr}} (in messages)
+ */
+import type { CompiledExpression, RuleContext } from './types.js';
+export declare class CompileError extends Error {
+    pos: number;
+    constructor(message: string, pos: number);
+}
+export declare class ExpressionCompiler {
+    compile(expr: string): CompiledExpression;
+    validate(expr: string): {
+        ok: boolean;
+        error?: string;
+    };
+}
+export declare class TemplateRenderer {
+    /**
+     * Render template strings with {{expr}} interpolation
+     */
+    render(template: string, ctx: RuleContext): string;
+}
+//# sourceMappingURL=compiler.d.ts.map

package/dist/engine/dsl/compiler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compiler.d.ts","sourceRoot":"","sources":["../../../src/engine/dsl/compiler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA4RlE,qBAAa,YAAa,SAAQ,KAAK;IACD,GAAG,EAAE,MAAM;gBAAnC,OAAO,EAAE,MAAM,EAAS,GAAG,EAAE,MAAM;CAIhD;AA6VD,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB;IAqBzC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;CAWxD;AAID,qBAAa,gBAAgB;IAC3B;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,MAAM;CAYnD"}