@yottameta/yotta-dev-mcp-plugin 0.1.1 → 0.2.1

package/skills/yotta-dev-mcp/scripts/dev_engine.py

@@ -8,7 +8,6 @@ tool explicitly documents a write.
 """
 
 import argparse
-import ast
 import json
 import math
 import os
@@ -18,133 +17,37 @@ import subprocess
 import sys
 from pathlib import Path
 
+import dev_contract
+from dev_adapters import run_adapter as _run_adapter_impl
+from dev_architecture import architecture_review as _architecture_review_impl
+from dev_common import (
+    ANSI_RE, ERROR_RE, MAX_FILE_BYTES, VERIFY_LEVELS, _iter_files, _json_safe,
+    _language, _read_text, _rel,
+    _frontmatter_name, _frontmatter_version, source_exts,
+)
+from dev_impact import impact_analysis as _impact_analysis_impl
+from dev_mcp_doctor import (
+    default_config_paths as _default_config_paths_impl,
+    default_skill_dirs as _default_skill_dirs_impl,
+    mcp_doctor as _mcp_doctor_impl,
+)
+from dev_verify import verify_change as _verify_change_impl
+from dev_selftest import self_test
+from dev_model import (
+    _classify_python_import,
+    _repo_map_js,
+    _repo_map_python,
+    system_model as _system_model_impl,
+)
 from dev_rules import REVIEW_RULES
 
-VERSION = "0.1.1"
+VERSION = "0.2.1"
 
-IGNORE_DIRS = {
-    ".git", ".hg", ".svn", "node_modules", "__pycache__", ".venv", "venv",
-    "dist", "build", ".next", ".nuxt", ".cache", ".tmp", ".tmp2",
-}
-SOURCE_EXTS = {
-    ".py", ".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx", ".sh", ".ps1",
-    ".go", ".rs", ".java", ".kt", ".kts", ".rb", ".php",
-}
-TEXT_EXTS = SOURCE_EXTS | {".json", ".md", ".txt", ".yml", ".yaml", ".toml", ".ini", ".cfg"}
-MAX_FILE_BYTES = 2 * 1024 * 1024
 
-ANSI_RE = re.compile(r"\x1b\[[0-9;]*[A-Za-z]")
-ERROR_RE = re.compile(
-    r"(?i)(traceback|exception|\berror\b|\bfailed\b|\bfail\b|fatal|panic|"
-    r"assertion|npm err!|\berr\b|\bwarn(?:ing)?\b)"
-)
 
 
-def _json_safe(value):
-    if isinstance(value, Path):
-        return str(value)
-    if isinstance(value, dict):
-        return {str(k): _json_safe(v) for k, v in value.items()}
-    if isinstance(value, list):
-        return [_json_safe(v) for v in value]
-    return value
 
 
-def _read_text(path):
-    path = Path(path)
-    if path.stat().st_size > MAX_FILE_BYTES:
-        raise ValueError("文件超过大小上限: %s" % path)
-    data = path.read_bytes()
-    if b"\x00" in data[:4096]:
-        raise ValueError("二进制文件不参与文本扫描: %s" % path)
-    return data.decode("utf-8", errors="replace")
-
-
-def _iter_files(root, extensions=None, max_files=5000, all_files=False):
-    root = Path(root)
-    extensions = set(extensions or TEXT_EXTS)
-    count = 0
-    for current, dirs, files in os.walk(str(root)):
-        dirs[:] = sorted(d for d in dirs if d not in IGNORE_DIRS)
-        for name in sorted(files):
-            path = Path(current) / name
-            if path.is_symlink():
-                continue
-            if not all_files and extensions and path.suffix.lower() not in extensions:
-                continue
-            if path.stat().st_size > MAX_FILE_BYTES:
-                continue
-            yield path
-            count += 1
-            if count >= max_files:
-                return
-
-
-def _rel(root, path):
-    try:
-        return str(Path(path).resolve().relative_to(Path(root).resolve())).replace("\\", "/")
-    except ValueError:
-        return str(Path(path)).replace("\\", "/")
-
-
-def _language(path):
-    ext = Path(path).suffix.lower()
-    if ext == ".py":
-        return "python"
-    if ext in (".js", ".jsx", ".mjs", ".cjs"):
-        return "javascript"
-    if ext in (".ts", ".tsx"):
-        return "typescript"
-    if ext in (".sh", ".ps1"):
-        return "shell"
-    return ext.lstrip(".") or "text"
-
-
-def _resolve_python_import(source_rel, node):
-    source = Path(source_rel)
-    if isinstance(node, ast.Import):
-        return [alias.name for alias in node.names]
-    if not isinstance(node, ast.ImportFrom):
-        return []
-    if node.level:
-        parts = list(source.with_suffix("").parts[:-1])
-        if node.level > 1:
-            parts = parts[:-(node.level - 1)] if len(parts) >= node.level - 1 else []
-        prefix = "/".join(parts)
-        module = node.module or ""
-        target = (prefix + "/" + module.replace(".", "/")).strip("/")
-        return [target + ".py" if target else source_rel]
-    if node.module:
-        return [node.module]
-    return []
-
-
-def _repo_map_python(path, rel):
-    text = _read_text(path)
-    imports = []
-    try:
-        tree = ast.parse(text)
-    except SyntaxError:
-        return imports
-    for node in ast.walk(tree):
-        if isinstance(node, (ast.Import, ast.ImportFrom)):
-            for target in _resolve_python_import(rel, node):
-                imports.append({"source": rel, "target": target, "line": getattr(node, "lineno", 1)})
-    return imports
-
-
-def _repo_map_js(path, rel):
-    text = _read_text(path)
-    imports = []
-    patterns = [
-        re.compile(r"""(?:from\s+|import\s*\()\s*['"]([^'"]+)['"]"""),
-        re.compile(r"""require\s*\(\s*['"]([^'"]+)['"]\s*\)"""),
-    ]
-    for lineno, line in enumerate(text.splitlines(), 1):
-        for pattern in patterns:
-            for match in pattern.finditer(line):
-                imports.append({"source": rel, "target": match.group(1), "line": lineno})
-    return imports
 
 
 def repo_map(path, max_files=2000):
@@ -161,6 +64,7 @@ def repo_map(path, max_files=2000):
     if len(files) > max_files:
         truncated = True
         files = files[:max_files]
+    module_set = {_rel(root, file_path) for file_path in files}
     for file_path in files:
         rel = _rel(root, file_path)
         try:
@@ -170,7 +74,11 @@ def repo_map(path, max_files=2000):
         language = _language(file_path)
         modules.append({"path": rel, "language": language, "lines": len(text.splitlines())})
         if file_path.suffix.lower() == ".py":
-            imports.extend(_repo_map_python(file_path, rel))
+            for raw in _repo_map_python(file_path, rel):
+                _, target = _classify_python_import(
+                    raw["target"], rel, module_set, relative=raw.get("relative", False)
+                )
+                imports.append({"source": rel, "target": target, "line": raw["line"]})
         elif file_path.suffix.lower() in (".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx"):
             imports.extend(_repo_map_js(file_path, rel))
         if (
@@ -191,10 +99,6 @@ def repo_map(path, max_files=2000):
     }
 
 
-def source_exts():
-    return set(SOURCE_EXTS)
-
-
 def _classify_match(line, query):
     escaped = re.escape(query)
     if re.search(r"^\s*(?:async\s+)?def\s+%s\b" % escaped, line):
@@ -384,92 +288,20 @@ def review_diff(diff_text=None, path=None, base=None, max_findings=200):
     return {"files": files, "findings": findings[:max_findings], "truncated": truncated}
 
 
-def _frontmatter_version(text):
-    match = re.search(r"(?m)^version:\s*[\"']?([^\"'\r\n]+)", text)
-    return match.group(1).strip() if match else None
-
-
-def _frontmatter_name(text):
-    match = re.search(r"(?m)^name:\s*[\"']?([^\"'\r\n]+)", text)
-    return match.group(1).strip() if match else None
-
-
 def _default_skill_dirs():
-    home = Path.home()
-    candidates = [
-        home / ".codex" / "skills",
-        home / ".claude" / "skills",
-        home / ".cursor" / "skills",
-        home / ".config" / "opencode" / "skills",
-    ]
-    codex_home = os.environ.get("CODEX_HOME")
-    if codex_home:
-        candidates.insert(0, Path(codex_home) / "skills")
-    claude_home = os.environ.get("CLAUDE_CONFIG_DIR")
-    if claude_home:
-        candidates.insert(0, Path(claude_home) / "skills")
-    xdg_home = os.environ.get("XDG_CONFIG_HOME")
-    if xdg_home:
-        candidates.insert(0, Path(xdg_home) / "opencode" / "skills")
-    return candidates
+    return _default_skill_dirs_impl()
 
 
 def _default_config_paths():
-    home = Path.home()
-    return [
-        home / ".codex" / "config.json",
-        home / ".codex" / "mcp.json",
-        home / ".config" / "opencode" / "opencode.json",
-        home / ".claude" / "settings.json",
-        home / ".cursor" / "mcp.json",
-    ]
-
-
-def mcp_doctor(skills_dirs=None, config_paths=None):
-    skills = []
-    issues = []
-    for directory in (skills_dirs or _default_skill_dirs()):
-        root = Path(directory)
-        if not root.is_dir():
-            continue
-        for child in sorted(root.iterdir(), key=lambda item: item.name):
-            skill_file = child / "SKILL.md"
-            if not child.is_dir() or not skill_file.is_file():
-                continue
-            try:
-                text = _read_text(skill_file)
-            except (OSError, ValueError) as exc:
-                issues.append("%s: %s" % (skill_file, exc))
-                continue
-            skills.append({
-                "name": _frontmatter_name(text) or child.name,
-                "version": _frontmatter_version(text),
-                "path": str(skill_file),
-            })
-    mcp_configs = []
-    for config_path in (config_paths or _default_config_paths()):
-        path = Path(config_path)
-        if not path.is_file():
-            continue
-        try:
-            payload = json.loads(_read_text(path))
-        except Exception as exc:  # noqa: BLE001
-            issues.append("%s: %s" % (path, exc))
-            continue
-        servers = payload.get("mcpServers") if isinstance(payload, dict) else None
-        mcp_configs.append({
-            "path": str(path),
-            "servers": sorted(servers.keys()) if isinstance(servers, dict) else [],
-        })
-    skills.sort(key=lambda item: (item["name"], item["path"]))
-    mcp_configs.sort(key=lambda item: item["path"])
-    return {
-        "skills": skills,
-        "mcp_configs": mcp_configs,
-        "issues": issues,
-        "checked_skills": len(skills),
-        "checked_configs": len(mcp_configs),
-    }
+    return _default_config_paths_impl()
+
+
+def mcp_doctor(skills_dirs=None, config_paths=None, include_defaults=None):
+    return _mcp_doctor_impl(
+        skills_dirs=skills_dirs,
+        config_paths=config_paths,
+        include_defaults=include_defaults,
+    )
 
 
 SECRET_KEY_RE = re.compile(
@@ -478,6 +310,35 @@ SECRET_KEY_RE = re.compile(
 AWS_KEY_RE = re.compile(r"\bAKIA[0-9A-Z]{16}\b")
 PRIVATE_KEY_RE = re.compile(r"-----BEGIN [A-Z ]*PRIVATE KEY-----")
 HIGH_ENTROPY_RE = re.compile(r"[A-Za-z0-9_+/=\-]{32,}")
+HASH_CONTEXT_RE = re.compile(r"(?i)(sha1|sha256|sha512|hash|checksum|digest|integrity)")
+HEX_TOKEN_RE = re.compile(r"^[0-9a-fA-F]+$")
+PATH_HINT_RE = re.compile(r"(?i)(?:[a-z]:[\\/]|\\\\|https?://|file://)")
+URL_HINT_RE = re.compile(r"(?i)(?:file|https?)://")
+PERCENT_ESCAPE_RE = re.compile(r"%[0-9A-Fa-f]{2}")
+HASH_PREFIX_RE = re.compile(r"(?i)^(?:sha1|sha256|sha512|md5)[=:]([0-9a-fA-F]{32,128})$")
+FILE_SUFFIX_RE = re.compile(
+    r"(?i)\.(exe|dll|sys|py|js|ts|tsx|json|md|txt|log|whl|tar|gz|zip|png|jpg|jpeg|svg)"
+)
+
+
+def _high_entropy_noise(line, token, start, end):
+    """Return True for common non-secret high-entropy noise."""
+    if HASH_PREFIX_RE.match(token):
+        return True
+    if PERCENT_ESCAPE_RE.search(token) and URL_HINT_RE.search(line):
+        return True
+    if start > 0 and line[start - 1] == "%":
+        return True
+    if HEX_TOKEN_RE.match(token) and len(token) in (32, 40, 64, 128) and HASH_CONTEXT_RE.search(line):
+        return True
+    window = line[max(0, start - 16):min(len(line), end + 16)]
+    if PATH_HINT_RE.search(window):
+        return True
+    if URL_HINT_RE.search(line) and PERCENT_ESCAPE_RE.search(window):
+        return True
+    if FILE_SUFFIX_RE.match(line[end:end + 8]):
+        return True
+    return False
 
 
 def _entropy(value):
@@ -506,7 +367,9 @@ def scan_secrets(path=None, text=None, max_findings=200, include_git_history=Fal
         root = Path(path)
         if not root.exists():
             raise ValueError("路径不存在: %s" % path)
-        files = [root] if root.is_file() else list(_iter_files(root, all_files=True))
+        files = [root] if root.is_file() else list(
+            _iter_files(root, all_files=True, ignore_temp=False)
+        )
         base = root.parent if root.is_file() else root
         for file_path in files:
             try:
@@ -542,7 +405,11 @@ def scan_secrets(path=None, text=None, max_findings=200, include_git_history=Fal
                 })
             for match in HIGH_ENTROPY_RE.finditer(line):
                 token = match.group(0)
-                if _entropy(token) >= 4.0 and not PRIVATE_KEY_RE.search(line):
+                if (
+                    _entropy(token) >= 4.0
+                    and not PRIVATE_KEY_RE.search(line)
+                    and not _high_entropy_noise(line, token, match.start(), match.end())
+                ):
                     findings.append({
                         "path": rel, "line": line_no, "rule": "high-entropy-token",
                         "severity": "medium", "evidence": _redact(token),
@@ -956,9 +823,165 @@ def workflow_state(root, action="read", date=None, text=None, file=None, apply=F
     }
 
 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+def system_model(path, max_files=2000, contract_file=None):
+    """Build the deterministic system model through the stable engine facade."""
+    return _system_model_impl(
+        path, max_files=max_files, contract_file=contract_file,
+    )
+
+
+def architecture_review(path, max_files=2000, contract_file=None):
+    """Review architecture through the stable engine facade."""
+    return _architecture_review_impl(
+        path, max_files=max_files, contract_file=contract_file,
+    )
+
+
+def impact_analysis(path, changed_files=None, diff=None, symbols=None, depth=3,
+                    max_files=2000, contract_file=None):
+    """Build the change impact cone through the stable engine facade."""
+    return _impact_analysis_impl(
+        path, changed_files=changed_files, diff=diff, symbols=symbols,
+        depth=depth, max_files=max_files, contract_file=contract_file,
+    )
+
+
+def verify_change(path, changed_files=None, diff=None, symbols=None, depth=3,
+                  levels=None, allow_execute=False, timeout=120,
+                  max_files=2000, contract_file=None, policy_file=None):
+    """Run the verification ladder through the stable engine facade."""
+    return _verify_change_impl(
+        path, changed_files=changed_files, diff=diff, symbols=symbols,
+        depth=depth, levels=levels, allow_execute=allow_execute, timeout=timeout,
+        max_files=max_files, contract_file=contract_file, policy_file=policy_file,
+    )
+
+
+def run_adapter(path, action="list", adapter=None, allow_execute=False, timeout=120,
+                max_chars=120000, token_budget=None, target="."):
+    """Probe or explicitly run one optional external adapter.
+
+    The implementation lives in dev_adapters.py; this facade keeps the public
+    dispatch signature and fail-closed default visible to self_test.
+    """
+    return _run_adapter_impl(
+        path, action=action, adapter=adapter, allow_execute=allow_execute,
+        timeout=timeout, max_chars=max_chars, token_budget=token_budget,
+        target=target,
+    )
+
+
 def dispatch(name, arguments):
     handlers = {
         "repo_map": repo_map,
+        "system_model": system_model,
+        "architecture_review": architecture_review,
+        "impact_analysis": impact_analysis,
+        "verify_change": verify_change,
+        "self_test": self_test,
+        "run_adapter": run_adapter,
         "find_code": find_code,
         "compress_output": compress_output,
         "review_code": review_code,
@@ -982,6 +1005,62 @@ def main():
     sub = parser.add_subparsers(dest="command")
     repo = sub.add_parser("repo-map")
     repo.add_argument("path")
+    model = sub.add_parser("system-model")
+    model.add_argument("path")
+    model.add_argument("--contract", help="contract path relative to the repository root")
+    review = sub.add_parser("architecture-review")
+    review.add_argument("path")
+    review.add_argument("--contract", help="contract path relative to the repository root")
+    impact = sub.add_parser("impact-analysis")
+    impact.add_argument("path")
+    impact.add_argument("--changed", action="append",
+                        help="repository-relative changed file (repeatable)")
+    impact.add_argument("--diff-file", help="read a unified diff from this file")
+    impact.add_argument("--symbol", action="append",
+                        help="target symbol whose definition site is the change (repeatable)")
+    impact.add_argument("--depth", type=int, default=3,
+                        help="reverse-dependency depth, 1-10 (default 3)")
+    impact.add_argument("--contract", help="contract path relative to the repository root")
+    verify = sub.add_parser("verify-change")
+    verify.add_argument("path")
+    verify.add_argument("--changed", action="append",
+                       help="repository-relative changed file (repeatable)")
+    verify.add_argument("--diff-file", help="read a unified diff from this file")
+    verify.add_argument("--symbol", action="append",
+                        help="target symbol whose definition site is the change (repeatable)")
+    verify.add_argument("--level", action="append", choices=VERIFY_LEVELS,
+                        help="additional verification level (repeatable)")
+    verify.add_argument("--depth", type=int, default=3,
+                        help="reverse-dependency depth, 1-10 (default 3)")
+    verify.add_argument("--contract", help="contract path relative to the repository root")
+    verify.add_argument("--policy-file", help="verification policy path relative to the root")
+    verify.add_argument("--allow-execute", action="store_true",
+                        help="run whitelisted L2-L4 policy checks")
+    verify.add_argument("--timeout", type=int, default=120,
+                        help="upper bound for each check in seconds")
+    self_test_parser = sub.add_parser("self-test")
+    self_test_parser.add_argument("path")
+    self_test_parser.add_argument("--mode", choices=("auto", "source", "installed"),
+                                  default="auto")
+    self_test_parser.add_argument("--allow-execute", action="store_true",
+                                  help="run the target test suite")
+    self_test_parser.add_argument("--timeout", type=int, default=120,
+                                  help="test timeout in seconds")
+    adapter = sub.add_parser("adapter")
+    adapter.add_argument("path")
+    adapter.add_argument("--action", choices=("list", "run"), default="list")
+    adapter.add_argument("--adapter",
+                         choices=("import-linter", "dependency-cruiser", "repomix"))
+    adapter.add_argument("--allow-execute", action="store_true",
+                        help="run the selected adapter; required for action=run")
+    adapter.add_argument("--timeout", type=int, default=120,
+                        help="adapter timeout in seconds")
+    adapter.add_argument("--max-chars", type=int, default=120000,
+                        help="Repomix output cap")
+    adapter.add_argument("--token-budget", type=int,
+                        help="optional Repomix token budget")
+    adapter.add_argument("--target", default=".",
+                        help="repository-relative adapter target, default .")
     find = sub.add_parser("find-code")
     find.add_argument("path")
     find.add_argument("query")
@@ -992,9 +1071,44 @@ def main():
     doctor = sub.add_parser("mcp-doctor")
     doctor.add_argument("--skills-dir", action="append")
     doctor.add_argument("--config", action="append")
+    doctor.add_argument("--include-defaults", action="store_true",
+                        help="scan built-in host registry in addition to --config paths")
     args = parser.parse_args()
     if args.command == "repo-map":
         result = repo_map(args.path)
+    elif args.command == "system-model":
+        result = system_model(args.path, contract_file=args.contract)
+    elif args.command == "architecture-review":
+        result = architecture_review(args.path, contract_file=args.contract)
+    elif args.command == "impact-analysis":
+        diff_text = None
+        if args.diff_file:
+            diff_text = Path(args.diff_file).read_text(encoding="utf-8")
+        result = impact_analysis(args.path, changed_files=args.changed, diff=diff_text,
+                                 symbols=args.symbol, depth=args.depth,
+                                 contract_file=args.contract)
+    elif args.command == "verify-change":
+        diff_text = None
+        if args.diff_file:
+            diff_text = Path(args.diff_file).read_text(encoding="utf-8")
+        result = verify_change(
+            args.path, changed_files=args.changed, diff=diff_text,
+            symbols=args.symbol, depth=args.depth, levels=args.level,
+            allow_execute=args.allow_execute, timeout=args.timeout,
+            contract_file=args.contract, policy_file=args.policy_file,
+        )
+    elif args.command == "self-test":
+        result = self_test(
+            args.path, mode=args.mode, allow_execute=args.allow_execute,
+            timeout=args.timeout,
+        )
+    elif args.command == "adapter":
+        result = run_adapter(
+            args.path, action=args.action, adapter=args.adapter,
+            allow_execute=args.allow_execute, timeout=args.timeout,
+            max_chars=args.max_chars, token_budget=args.token_budget,
+            target=args.target,
+        )
     elif args.command == "find-code":
         result = find_code(args.path, args.query)
     elif args.command == "compress-output":
@@ -1002,7 +1116,11 @@ def main():
     elif args.command == "review-code":
         result = review_code(args.path)
     elif args.command == "mcp-doctor":
-        result = mcp_doctor(skills_dirs=args.skills_dir, config_paths=args.config)
+        result = mcp_doctor(
+            skills_dirs=args.skills_dir,
+            config_paths=args.config,
+            include_defaults=args.include_defaults,
+        )
     else:
         parser.print_help()
         return 2