cowork-flow 0.0.37 → 0.0.39

package/template/.cowork-flow/scripts/common/gates/tdd_evidence.py

@@ -91,11 +91,11 @@ SETUP_FAILURE_MARKERS = (
 def validate_tdd_evidence(task_dir: Path) -> list[dict]:
     """Return TDD evidence violations for a task directory."""
     task_dir = Path(task_dir)
-    prd_text = _read_text(task_dir / "decision-anchor.md")
+    decision_anchor_text = _read_text(task_dir / "decision-anchor.md")
     evidence_path = task_dir / EVIDENCE_FILE
 
     if not evidence_path.is_file():
-        if _task_requires_tdd(prd_text):
+        if _task_requires_tdd(decision_anchor_text):
             return [
                 _violation(
                     "TDD-RED-001",
@@ -122,7 +122,7 @@ def validate_tdd_evidence(task_dir: Path) -> list[dict]:
             )
         ]
 
-    acceptance_ids = _acceptance_ids(prd_text)
+    acceptance_ids = _acceptance_ids(decision_anchor_text)
     violations: list[dict] = []
     for index, entry in enumerate(entries, start=1):
         if entry.get("type") == "exemption":
@@ -136,8 +136,8 @@ def validate_tdd_evidence(task_dir: Path) -> list[dict]:
 def validate_tdd_red_evidence(task_dir: Path) -> list[dict]:
     """Return violations when implementation would start without red evidence."""
     task_dir = Path(task_dir)
-    prd_text = _read_text(task_dir / "decision-anchor.md")
-    if not _task_requires_tdd(prd_text):
+    decision_anchor_text = _read_text(task_dir / "decision-anchor.md")
+    if not _task_requires_tdd(decision_anchor_text):
         return []
 
     evidence_path = task_dir / EVIDENCE_FILE
@@ -152,7 +152,7 @@ def validate_tdd_red_evidence(task_dir: Path) -> list[dict]:
     if not red_entries:
         return [_missing_red_evidence_violation(evidence_path)]
 
-    acceptance_ids = _acceptance_ids(prd_text)
+    acceptance_ids = _acceptance_ids(decision_anchor_text)
     violations: list[dict] = []
     for index, entry in enumerate(entries, start=1):
         if entry.get("type") == "exemption":
@@ -161,8 +161,8 @@ def validate_tdd_red_evidence(task_dir: Path) -> list[dict]:
     return violations
 
 
-def _task_requires_tdd(prd_text: str) -> bool:
-    lower = prd_text.lower()
+def _task_requires_tdd(decision_anchor_text: str) -> bool:
+    lower = decision_anchor_text.lower()
     if not lower:
         return False
     if any(marker.lower() in lower for marker in NON_BEHAVIOR_MARKERS):
@@ -218,10 +218,10 @@ def _read_jsonl(path: Path) -> tuple[list[dict], list[dict]]:
     return entries, violations
 
 
-def _acceptance_ids(prd_text: str) -> set[str]:
+def _acceptance_ids(decision_anchor_text: str) -> set[str]:
     """提取验收标准 ID，支持 AC-001、AC-1、验收标准：1 等格式。"""
-    ids = set(re.findall(r"\bAC-(\d{1,4})\b", prd_text, re.IGNORECASE))
-    ids |= set(re.findall(r"验收标准[：:]\s*(\d+)", prd_text))
+    ids = set(re.findall(r"\bAC-(\d{1,4})\b", decision_anchor_text, re.IGNORECASE))
+    ids |= set(re.findall(r"验收标准[：:]\s*(\d+)", decision_anchor_text))
     return {f"AC-{n}" for n in ids}
 
 
@@ -285,7 +285,7 @@ def _validate_red_evidence(
                 "TDD-AC-001",
                 f"TDD evidence record {index} references unknown acceptanceId: {acceptance_id}",
                 evidence_path,
-                "Map evidence to a PRD acceptance ID such as AC-001.",
+                "Map evidence to a decision-anchor acceptance criterion such as AC-001.",
             )
         )
 
@@ -347,7 +347,7 @@ def _validate_exemption(
                 "TDD-EXEMPT-002",
                 f"TDD exemption record {index} references unknown acceptanceId: {acceptance_id}",
                 evidence_path,
-                "Map the exemption to a PRD acceptance ID such as AC-001.",
+                "Map the exemption to a decision-anchor acceptance criterion such as AC-001.",
             )
         )
 

package/template/.cowork-flow/scripts/common/gates/validate_coding_standards.py

@@ -39,6 +39,16 @@ _EXTENSIONS = {
 
 _BACKEND_SUFFIXES = re.compile(r"\.(py|java|go|rs|rb|cs|kt|php)$")
 _FRONTEND_SUFFIXES = re.compile(r"\.(tsx|jsx|vue|svelte|ts|js|mjs|cjs|css|scss)$")
+_SECRET_RE = re.compile(
+    r"""(?ix)
+    (?:password|passwd|secret|api[_\s]?key|token|access[_\s]?key)
+    \s*[:=]\s*["'][^"'}{)($]{3,}["']
+    """
+)
+_SILENT_EXCEPT_RE = re.compile(r"^\s*except\b\s*.*:\s*(#.*)?$")
+_BARE_PRINT_RE = re.compile(r"(?<!\w)print\s*\(")
+_CONSOLE_RE = re.compile(r"\bconsole\.(log|info|debug)\s*\(")
+_JS_SUFFIXES = {".js", ".mjs", ".cjs", ".ts", ".tsx", ".jsx"}
 
 
 def _is_backend_file(rel_path: str) -> bool:
@@ -80,8 +90,8 @@ def load_spec_rules(
     """Return every natural-language rule declared under ``spec/<category>/``.
 
     Re-reads markdown on every call, so user edits take effect without restart.
-    ``validators`` is preserved as an empty list (legacy field kept so external
-    tooling that inspects the rule dict does not break).
+    The returned rule shape is the current runtime checklist contract:
+    category, source, line, and text.
     """
     out: list[dict] = []
     repo_root = Path(repo_root)
@@ -102,7 +112,6 @@ def load_spec_rules(
                     "source": f".cowork-flow/spec/{category}/{md.name}",
                     "line": lineno,
                     "text": rule,
-                    "validators": [],
                 })
     return out
 
@@ -171,72 +180,105 @@ def collect_machine_checks(
     whether to render them in a gate log, inject them into context, or ignore.
     """
     violations: list[dict] = []
+    for changed_file in _changed_machine_check_files(repo_root):
+        violations.extend(_machine_check_violations_for_file(repo_root, changed_file))
+    return violations
+
+
+def _changed_machine_check_files(repo_root: Path) -> Sequence[object]:
     try:
-        changed_files = collect_changed_files(repo_root)
+        return collect_changed_files(repo_root)
     except Exception:  # noqa: BLE001 — defensively isolate git errors
-        return violations
+        return ()
 
-    secret_re = re.compile(
-        r"""(?ix)
-        (?:password|passwd|secret|api[_\s]?key|token|access[_\s]?key)
-        \s*[:=]\s*["'][^"'}{)($]{3,}["']
-        """
-    )
-    silent_except_re = re.compile(r"^\s*except\b\s*.*:\s*(#.*)?$")
-    bare_print_re = re.compile(r"(?<!\w)print\s*\(")
-    console_re = re.compile(r"\bconsole\.(log|info|debug)\s*\(")
 
-    for changed_file in changed_files:
-        file_path = repo_root / changed_file.path
-        if not file_path.is_file():
-            continue
-        suffix = file_path.suffix.lower()
-        if suffix not in _EXTENSIONS:
-            continue
-        try:
-            content = file_path.read_text(encoding="utf-8")
-        except (OSError, UnicodeDecodeError):
-            continue
-        lines = content.splitlines()
-        for lineno, raw in enumerate(lines, start=1):
-            # Low-signal heuristic: only flag if the line also has an
-            # assignment / call so variable-name mentions do not trip it.
-            if (secret_re.search(raw)
-                    and "process.env" not in raw
-                    and "os.environ" not in raw):
-                violations.append(_adv(
-                    "MACHINE-HARDCODED-SECRET-001",
-                    "Possible hard-coded secret in source",
-                    changed_file.path, lineno,
-                    "Read the value from configuration or environment variables.",
-                ))
-            if suffix == ".py" and bare_print_re.search(raw):
-                violations.append(_adv(
-                    "MACHINE-DEBUG-PRINT-001",
-                    "Debug print on changed line",
-                    changed_file.path, lineno,
-                    "Use a structured logger or remove the print.",
-                ))
-            if suffix in {".js", ".mjs", ".cjs", ".ts", ".tsx", ".jsx"} and console_re.search(raw):
-                violations.append(_adv(
-                    "MACHINE-CONSOLE-LOG-001",
-                    "console.{log,info,debug} on changed line",
-                    changed_file.path, lineno,
-                    "Use the project logger or remove the call.",
-                ))
-            if (suffix == ".py"
-                    and silent_except_re.match(raw)
-                    and lineno < len(lines)
-                    and lines[lineno].strip() in {"pass", "...", ""}):
-                violations.append(_adv(
-                    "MACHINE-SILENT-EXCEPT-001",
-                    "Empty exception handler silently swallows errors",
-                    changed_file.path, lineno,
-                    "Log or re-raise the exception, or narrow the except types.",
-                ))
+def _machine_check_violations_for_file(repo_root: Path, changed_file: object) -> list[dict]:
+    file_path = repo_root / changed_file.path
+    if not file_path.is_file():
+        return []
+    suffix = file_path.suffix.lower()
+    if suffix not in _EXTENSIONS:
+        return []
+    try:
+        content = file_path.read_text(encoding="utf-8")
+    except (OSError, UnicodeDecodeError):
+        return []
+    return _machine_check_violations_for_lines(changed_file.path, suffix, content.splitlines())
+
+
+def _machine_check_violations_for_lines(
+    rel_path: str,
+    suffix: str,
+    lines: list[str],
+) -> list[dict]:
+    violations: list[dict] = []
+    for lineno, raw in enumerate(lines, start=1):
+        violations.extend(_machine_check_violations_for_line(rel_path, suffix, lines, lineno, raw))
+    return violations
+
+
+def _machine_check_violations_for_line(
+    rel_path: str,
+    suffix: str,
+    lines: list[str],
+    lineno: int,
+    raw: str,
+) -> list[dict]:
+    violations: list[dict] = []
+    if _looks_like_hardcoded_secret(raw):
+        violations.append(_adv(
+            "MACHINE-HARDCODED-SECRET-001",
+            "Possible hard-coded secret in source",
+            rel_path, lineno,
+            "Read the value from configuration or environment variables.",
+        ))
+    if suffix == ".py" and _BARE_PRINT_RE.search(raw):
+        violations.append(_adv(
+            "MACHINE-DEBUG-PRINT-001",
+            "Debug print on changed line",
+            rel_path, lineno,
+            "Use a structured logger or remove the print.",
+        ))
+    if suffix in _JS_SUFFIXES and _CONSOLE_RE.search(raw):
+        violations.append(_adv(
+            "MACHINE-CONSOLE-LOG-001",
+            "console.{log,info,debug} on changed line",
+            rel_path, lineno,
+            "Use the project logger or remove the call.",
+        ))
+    if _is_silent_python_except(suffix, lines, lineno, raw):
+        violations.append(_adv(
+            "MACHINE-SILENT-EXCEPT-001",
+            "Empty exception handler silently swallows errors",
+            rel_path, lineno,
+            "Log or re-raise the exception, or narrow the except types.",
+        ))
     return violations
 
 
+def _looks_like_hardcoded_secret(raw: str) -> bool:
+    # Low-signal heuristic: only flag if the line also has an assignment / call.
+    return (
+        _SECRET_RE.search(raw) is not None
+        and "process.env" not in raw
+        and "os.environ" not in raw
+    )
+
+
+def _is_silent_python_except(
+    suffix: str,
+    lines: list[str],
+    lineno: int,
+    raw: str,
+) -> bool:
+    return (
+        suffix == ".py"
+        and _SILENT_EXCEPT_RE.match(raw) is not None
+        and lineno < len(lines)
+        and lines[lineno].strip() in {"pass", "...", ""}
+    )
+
+
 def _adv(
     rule_id: str,
     message: str,

package/template/.cowork-flow/scripts/common/gates/validate_implementation.py

@@ -185,20 +185,27 @@ def _check_premature_abstraction(
     return violations
 
 
-def _check_unrequested_features(
-    repo_root: Path,
-    diff_output: str,
-    task_dir: Path,
-    rule_index: dict[str, dict],
-) -> list[dict]:
-    """R-AG-005: Check if unrequested files were modified (diff files must be in implement.jsonl)."""
-    violations = []
+def _normalize_allowed_context_file(entry: dict) -> str | None:
+    entry_type = entry.get("type", "file")
+    file_path = entry.get("file")
+    if entry_type not in ("file", "planned-file"):
+        return None
+    if not isinstance(file_path, str) or not file_path:
+        return None
+    normalized = file_path.replace("\\", "/")
+    while normalized.startswith("./"):
+        normalized = normalized[2:]
+    segments = normalized.split("/")
+    invalid = (
+        normalized.startswith("/")
+        or re.match(r"^[A-Za-z]:", normalized)
+        or any(segment in ("", ".", "..") for segment in segments)
+        or any(character in normalized for character in "*?[]")
+    )
+    return None if invalid else normalized
 
-    # Collect allowed files from implement.jsonl
-    implement_jsonl = task_dir / "implement.jsonl"
-    if not implement_jsonl.exists():
-        return violations
 
+def _load_allowed_context_files(implement_jsonl: Path) -> set[str]:
     allowed_files: set[str] = set()
     try:
         for line in implement_jsonl.read_text(encoding="utf-8").splitlines():
@@ -209,18 +216,28 @@ def _check_unrequested_features(
                 entry = json.loads(line)
             except json.JSONDecodeError:
                 continue
-            file_path = entry.get("file")
-            if isinstance(file_path, str) and file_path:
-                # Normalize paths (strip repo root prefix if present)
-                allowed_files.add(file_path)
-                # Also add stripped versions for matching
-                if file_path.startswith("./"):
-                    allowed_files.add(file_path[2:])
-                else:
-                    allowed_files.add(f"./{file_path}")
+            normalized = _normalize_allowed_context_file(entry)
+            if normalized is not None:
+                allowed_files.add(normalized)
     except (OSError, UnicodeDecodeError):
+        return set()
+    return allowed_files
+
+
+def _check_unrequested_features(
+    repo_root: Path,
+    diff_output: str,
+    task_dir: Path,
+    rule_index: dict[str, dict],
+) -> list[dict]:
+    """R-AG-005: Require modified files to be explicitly listed."""
+    del diff_output
+    violations = []
+    implement_jsonl = task_dir / "implement.jsonl"
+    if not implement_jsonl.exists():
         return violations
 
+    allowed_files = _load_allowed_context_files(implement_jsonl)
     if not allowed_files:
         return violations
 
@@ -232,7 +249,7 @@ def _check_unrequested_features(
             continue
         normalized = file_path.replace("\\", "/")
         # Check if file is in allowed list
-        if normalized not in allowed_files and f"./{normalized}" not in allowed_files:
+        if normalized not in allowed_files:
             rule = rule_index.get("R-AG-005")
             violations.append(
                 rule_violation(