create-dwy 0.10.0 → 0.12.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-dwy",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "项目脚手架与 Claude Code 配置同步工具",
   "type": "module",
   "bin": {
@@ -20,6 +20,7 @@
   "license": "MIT",
   "author": "dwydev",
   "dependencies": {
+    "@inquirer/core": "^10.0.0",
     "commander": "^12.0.0",
     "inquirer": "^9.0.0",
     "handlebars": "^4.7.0",
@@ -31,4 +32,4 @@
     "registry": "https://registry.npmjs.org/",
     "access": "public"
   }
-}
+}

package/src/prompts/grouped-checkbox.js

@@ -0,0 +1,223 @@
+import {
+  createPrompt,
+  useState,
+  useMemo,
+  useKeypress,
+  usePrefix,
+  usePagination,
+  isUpKey,
+  isDownKey,
+  isSpaceKey,
+  isBackspaceKey,
+  isEnterKey,
+  makeTheme,
+} from '@inquirer/core'
+import chalk from 'chalk'
+
+const OTHER = '其他'
+
+function sortCategories(cats) {
+  const others = cats.includes(OTHER) ? [OTHER] : []
+  const rest = cats.filter(c => c !== OTHER).sort((a, b) => a.localeCompare(b, 'zh'))
+  return [...rest, ...others]
+}
+
+function buildVisibleRows(items, filter, selected) {
+  const kw = filter.toLowerCase()
+  const filtered = kw
+    ? items.filter(it => it.name.toLowerCase().includes(kw)
+                      || (it.description || '').toLowerCase().includes(kw))
+    : items
+  const groups = new Map()
+  for (const it of filtered) {
+    const cat = it.category || OTHER
+    if (!groups.has(cat)) groups.set(cat, [])
+    groups.get(cat).push(it)
+  }
+  const rows = []
+  for (const cat of sortCategories([...groups.keys()])) {
+    const groupItems = groups.get(cat).sort((a, b) => a.name.localeCompare(b.name))
+    const selectedInGroup = groupItems.filter(it => selected.has(it.name)).length
+    rows.push({ type: 'header', category: cat, total: groupItems.length, selectedInGroup, items: groupItems })
+    for (const it of groupItems) rows.push({ type: 'item', item: it, category: cat })
+  }
+  return rows
+}
+
+function isPrintable(key) {
+  return typeof key.sequence === 'string'
+    && key.sequence.length === 1
+    && key.sequence >= ' '
+    && key.sequence <= '~'
+    && !key.ctrl
+    && !key.meta
+    && key.name !== 'space'
+    && key.name !== 'return'
+    && key.name !== 'enter'
+}
+
+function isEscapeKey(key) {
+  return key.name === 'escape'
+}
+
+function isCtrlA(key) {
+  return key.ctrl && key.name === 'a'
+}
+
+function nextCursor(rows, cursor, delta) {
+  if (rows.length === 0) return 0
+  const n = rows.length
+  let i = ((cursor + delta) % n + n) % n
+  // 防止死循环（理论上 rows 永不为空时不会触发）
+  return i
+}
+
+export const groupedCheckbox = createPrompt((config, done) => {
+  const theme = makeTheme(config.theme)
+  const pageSize = config.pageSize ?? 15
+  const allItems = config.items
+  const totalCount = allItems.length
+
+  const [filter, setFilter] = useState('')
+  const [cursor, setCursor] = useState(0)
+  const [selected, setSelected] = useState(new Set(config.defaultSelected ?? []))
+  const [status, setStatus] = useState('idle') // 'idle' | 'done'
+
+  const rows = useMemo(
+    () => buildVisibleRows(allItems, filter, selected),
+    [filter, selected],
+  )
+
+  // cursor 越界保护
+  const safeCursor = rows.length === 0 ? 0 : Math.min(cursor, rows.length - 1)
+
+  useKeypress((key) => {
+    if (status === 'done') return
+
+    if (isEnterKey(key)) {
+      const result = allItems.filter(it => selected.has(it.name))
+      setStatus('done')
+      done(result)
+      return
+    }
+
+    if (isEscapeKey(key)) {
+      if (filter) {
+        setFilter('')
+        setCursor(0)
+      } else {
+        setStatus('done')
+        done([])
+      }
+      return
+    }
+
+    if (isUpKey(key)) {
+      setCursor(nextCursor(rows, safeCursor, -1))
+      return
+    }
+    if (isDownKey(key)) {
+      setCursor(nextCursor(rows, safeCursor, +1))
+      return
+    }
+
+    if (isCtrlA(key)) {
+      // 全选/全不选当前可见 item
+      const visibleItems = rows.filter(r => r.type === 'item').map(r => r.item)
+      if (visibleItems.length === 0) return
+      const allSelected = visibleItems.every(it => selected.has(it.name))
+      const next = new Set(selected)
+      if (allSelected) visibleItems.forEach(it => next.delete(it.name))
+      else visibleItems.forEach(it => next.add(it.name))
+      setSelected(next)
+      return
+    }
+
+    if (isSpaceKey(key)) {
+      if (rows.length === 0) return
+      const row = rows[safeCursor]
+      const next = new Set(selected)
+      if (row.type === 'item') {
+        if (next.has(row.item.name)) next.delete(row.item.name)
+        else next.add(row.item.name)
+      } else {
+        // header：组内全选/全不选
+        const allSelected = row.items.every(it => next.has(it.name))
+        if (allSelected) row.items.forEach(it => next.delete(it.name))
+        else row.items.forEach(it => next.add(it.name))
+      }
+      setSelected(next)
+      return
+    }
+
+    if (isBackspaceKey(key)) {
+      if (filter) {
+        setFilter(filter.slice(0, -1))
+        setCursor(0)
+      }
+      return
+    }
+
+    if (isPrintable(key)) {
+      setFilter(filter + key.sequence)
+      setCursor(0)
+      return
+    }
+  })
+
+  const prefix = usePrefix({ theme })
+
+  if (status === 'done') {
+    const picked = allItems.filter(it => selected.has(it.name))
+    const summary = picked.length === 0
+      ? chalk.gray('（未选）')
+      : chalk.green(`已选 ${picked.length} 项`)
+    return `${prefix} ${theme.style.message(config.message, 'done')} ${summary}`
+  }
+
+  const filterLine = filter
+    ? `${chalk.cyan('🔍')} ${chalk.yellow(filter)}${chalk.gray('▏')}  ${chalk.gray(`${rows.filter(r => r.type === 'item').length}/${totalCount} 匹配`)}`
+    : `${chalk.gray('🔍 输入即过滤  ')}${chalk.gray(`${totalCount} 项`)}`
+
+  const hint = chalk.gray('↑↓ 移动 · space 切换/组全选 · ctrl+a 全选可见 · enter 确认 · esc 清搜索/退出')
+
+  const renderItem = ({ item: row, isActive }) => {
+    if (row.type === 'header') {
+      const fullSelected = row.selectedInGroup === row.total && row.total > 0
+      const partial = row.selectedInGroup > 0 && !fullSelected
+      const marker = fullSelected ? chalk.green('✓') : partial ? chalk.yellow('◐') : chalk.gray('○')
+      const arrow = isActive ? chalk.cyan('▶') : ' '
+      const label = chalk.bold(`${arrow} ${marker} ${row.category}`)
+      const count = chalk.gray(`[${row.selectedInGroup}/${row.total}]`)
+      return isActive ? chalk.bgGray.white(`${label} ${count}`) : `${label} ${count}`
+    }
+    const checked = selected.has(row.item.name)
+    const box = checked ? chalk.green('◉') : chalk.gray('◯')
+    const cursorMark = isActive ? chalk.cyan('❯') : ' '
+    const name = checked ? chalk.green(row.item.name) : chalk.cyan(row.item.name)
+    const desc = row.item.description || ''
+    const descShort = desc.length > 60 ? desc.slice(0, 60) + '…' : desc
+    const line = `  ${cursorMark} ${box} ${name} ${chalk.gray('- ' + descShort)}`
+    return isActive ? chalk.bgBlackBright(line) : line
+  }
+
+  const paginated = usePagination({
+    items: rows.length > 0 ? rows : [{ type: 'empty' }],
+    active: safeCursor,
+    renderItem: (ctx) => ctx.item.type === 'empty'
+      ? chalk.gray('  （无匹配项，按 esc 清空搜索）')
+      : renderItem(ctx),
+    pageSize,
+    loop: false,
+  })
+  const page = paginated
+
+  const message = theme.style.message(config.message, 'idle')
+
+  return [
+    `${prefix} ${message}`,
+    filterLine,
+    page,
+    hint,
+  ].join('\n')
+})

package/src/sync.js

@@ -3,6 +3,7 @@ import path from 'path'
 import os from 'os'
 import inquirer from 'inquirer'
 import { ensureRepoCache, chalk } from './utils.js'
+import { groupedCheckbox } from './prompts/grouped-checkbox.js'
 
 const CATEGORIES = [
   { key: 'skills', label: 'Skills' },
@@ -14,29 +15,51 @@ const CATEGORIES = [
 function extractDescription(content) {
   const match = content.match(/^---\s*\n([\s\S]*?)\n---/)
   if (!match) return ''
-  const frontmatter = match[1]
-  const descMatch = frontmatter.match(/description:\s*(.+)/)
-  return descMatch ? descMatch[1].trim().replace(/^["']|["']$/g, '') : ''
+  const lines = match[1].split('\n')
+  let i = 0
+  while (i < lines.length) {
+    const kv = lines[i].match(/^([A-Za-z_][A-Za-z0-9_]*)\s*:\s*(.*)$/)
+    if (!kv) { i++; continue }
+    if (kv[1] === 'description') {
+      const trimmed = kv[2].trim()
+      if (trimmed === '>' || trimmed === '|') {
+        i++
+        const parts = []
+        while (i < lines.length && (lines[i].startsWith('  ') || lines[i].trim() === '')) {
+          parts.push(lines[i].trim())
+          i++
+        }
+        return parts.filter(Boolean).join(' ')
+      }
+      return trimmed.replace(/^["']|["']$/g, '')
+    }
+    i++
+  }
+  return ''
 }
 
 async function scanSkills(sourceDir) {
   const skillsDir = path.join(sourceDir, 'skills')
   if (!await fs.pathExists(skillsDir)) return []
 
-  const entries = await fs.readdir(skillsDir, { withFileTypes: true })
   const skills = []
-  for (const entry of entries) {
-    if (!entry.isDirectory()) continue
-    const skillPath = path.join(skillsDir, entry.name)
-    const skillMd = path.join(skillPath, 'SKILL.md')
-    if (!await fs.pathExists(skillMd)) continue
-    const content = await fs.readFile(skillMd, 'utf-8')
-    skills.push({
-      name: entry.name,
-      description: extractDescription(content) || '（无描述）',
-      sourcePath: skillPath,
-      type: 'skill',
-    })
+  for (const cat of await fs.readdir(skillsDir, { withFileTypes: true })) {
+    if (!cat.isDirectory()) continue
+    const catDir = path.join(skillsDir, cat.name)
+    for (const entry of await fs.readdir(catDir, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue
+      const skillPath = path.join(catDir, entry.name)
+      const skillMd = path.join(skillPath, 'SKILL.md')
+      if (!await fs.pathExists(skillMd)) continue
+      const content = await fs.readFile(skillMd, 'utf-8')
+      skills.push({
+        name: entry.name,
+        description: extractDescription(content) || '（无描述）',
+        category: cat.name,
+        sourcePath: skillPath,
+        type: 'skill',
+      })
+    }
   }
   return skills.sort((a, b) => a.name.localeCompare(b.name))
 }
@@ -45,18 +68,22 @@ async function scanRules(sourceDir) {
   const rulesDir = path.join(sourceDir, 'rules')
   if (!await fs.pathExists(rulesDir)) return []
 
-  const entries = await fs.readdir(rulesDir, { withFileTypes: true })
   const rules = []
-  for (const entry of entries) {
-    if (!entry.isFile() || !entry.name.endsWith('.md')) continue
-    const rulePath = path.join(rulesDir, entry.name)
-    const content = await fs.readFile(rulePath, 'utf-8')
-    rules.push({
-      name: entry.name,
-      description: extractDescription(content) || '（无描述）',
-      sourcePath: rulePath,
-      type: 'rule',
-    })
+  for (const cat of await fs.readdir(rulesDir, { withFileTypes: true })) {
+    if (!cat.isDirectory()) continue
+    const catDir = path.join(rulesDir, cat.name)
+    for (const entry of await fs.readdir(catDir, { withFileTypes: true })) {
+      if (!entry.isFile() || !entry.name.endsWith('.md')) continue
+      const rulePath = path.join(catDir, entry.name)
+      const content = await fs.readFile(rulePath, 'utf-8')
+      rules.push({
+        name: entry.name,
+        description: extractDescription(content) || '（无描述）',
+        category: cat.name,
+        sourcePath: rulePath,
+        type: 'rule',
+      })
+    }
   }
   return rules.sort((a, b) => a.name.localeCompare(b.name))
 }
@@ -71,6 +98,7 @@ async function scanCommands(sourceDir) {
     .map(e => ({
       name: e.name,
       description: e.isDirectory() ? '命令目录' : '命令文件',
+      category: '其他',
       sourcePath: path.join(commandsDir, e.name),
       type: 'command',
     }))
@@ -87,6 +115,7 @@ async function scanHooks(sourceDir) {
     .map(e => ({
       name: e.name,
       description: e.isDirectory() ? '钩子目录' : '钩子脚本',
+      category: '其他',
       sourcePath: path.join(hooksDir, e.name),
       type: 'hook',
     }))
@@ -102,19 +131,12 @@ async function scanExisting(projectTargetDir, typePlural) {
 
 async function promptSelection(items, label, defaultNames) {
   if (items.length === 0) return []
-  const { selected } = await inquirer.prompt([{
-    type: 'checkbox',
-    name: 'selected',
-    message: `选择 ${label}（空格勾选，回车确认）：`,
-    choices: items.map(item => ({
-      name: `${chalk.cyan(item.name)} ${chalk.gray('- ' + item.description.slice(0, 60))}${item.description.length > 60 ? '...' : ''}`,
-      value: item,
-      short: item.name,
-      checked: defaultNames.has(item.name),
-    })),
+  return groupedCheckbox({
+    message: `选择 ${label}`,
+    items,
+    defaultSelected: defaultNames,
     pageSize: 15,
-  }])
-  return selected
+  })
 }
 
 /**

package/templates/claude-global/rules/{dwy-python-backend.md → Python/dwy-python-backend.md}

@@ -200,7 +200,7 @@ class UserBase(BaseModel):
     email: EmailStr
 
 class UserCreate(UserBase):
-    password: str = Field(min_length=8, max_length=128)
+    password: str = Field(min_length=8, max_length=72)  # 72 = bcrypt 输入上限
 
 class UserUpdate(BaseModel):
     name: str | None = Field(default=None, max_length=50)
@@ -330,15 +330,55 @@ user = result.scalar_one_or_none()
 |------|------|
 | 存储算法 | **只允许 bcrypt**，必须走 dwyeapi 安全模块，**禁止**手写 bcrypt 调用或使用 MD5 / SHA / 明文 |
 | 接口返回 | **永远不返回**密码字段，Response Schema 中不包含 |
-| 密码强度 | 用户密码最少 8 位，管理员密码最少 12 位 |
+| 密码强度 | **长度 ≥ 8 字符**，且**必须**包含 **大写字母、小写字母、数字、特殊符号** 中的至少 **3 类** |
+| 密码长度上限 | Schema 必须 `max_length=72`（bcrypt 输入硬上限，超过会被静默截断），除非 dwyeapi 已做 SHA-256 预哈希 |
 | 登录错误 | 返回"用户名或密码错误"，**不区分**是用户名不存在还是密码错误 |
+| 强度校验位置 | Pydantic Schema 层用 `field_validator` 校验复杂度，**禁止**只校长度 |
+
+**密码复杂度校验示例**：
+
+```python
+import re
+from pydantic import BaseModel, Field, field_validator
+
+PASSWORD_PATTERNS = [
+    re.compile(r"[A-Z]"),       # 大写
+    re.compile(r"[a-z]"),       # 小写
+    re.compile(r"\d"),          # 数字
+    re.compile(r"[^A-Za-z0-9]"),  # 特殊符号
+]
+
+class UserCreate(BaseModel):
+    password: str = Field(min_length=8, max_length=72)
+
+    @field_validator("password")
+    @classmethod
+    def check_complexity(cls, v: str) -> str:
+        """密码必须包含大写/小写/数字/特殊符号中至少 3 类。"""
+        matched = sum(1 for p in PASSWORD_PATTERNS if p.search(v))
+        if matched < 3:
+            raise ValueError("密码必须包含大写、小写、数字、特殊符号中至少 3 类")
+        return v
+```
+
+> 该 validator 建议下沉到 dwyeapi 提供统一的 `PasswordStr` 类型，避免每个项目重复实现。
 
 ### 7.3 接口认证与授权
 
 - 所有 API **必须** JWT 认证（白名单除外：`/health` / `/auth/login` / `/auth/register`）
 - JWT 创建与解码**必须**走 dwyeapi 安全模块，**禁止**直接调用 PyJWT
 - Token 黑名单存 Redis（登出后失效，TTL = 剩余有效期）
-- Secret Key 必须从环境变量读取，最少 32 位随机字符串，**禁止**硬编码
+- Secret Key 必须从环境变量读取，**禁止**硬编码
+- Secret Key 长度与生成方式（按字节算，不按字符算）：
+
+| JWT 算法 | 最小长度 | 推荐生成命令 |
+|---------|---------|------------|
+| HS256 | **32 字节 / 256 bit** | `openssl rand -hex 32`（输出 64 个十六进制字符 = 32 字节） |
+| HS512 | **64 字节 / 512 bit** | `openssl rand -hex 64`（输出 128 个十六进制字符 = 64 字节） |
+| Python 等价 | — | `python -c "import secrets; print(secrets.token_urlsafe(32))"` |
+
+- **禁止**使用：`uuid.uuid4().hex`（熵不足且非密码学 PRNG 推荐用途）、`random` 模块、手写字符串拼接
+- 轮换策略：每 90 天 / 安全事件后立即轮换；新旧 Key 共存 1 个 Access Token 有效期窗口，避免在线用户被强制登出
 
 | Token 类型 | 有效期 |
 |------------|--------|

package/templates/claude-global/rules/{dwy-python-core.md → Python/dwy-python-core.md}

@@ -18,7 +18,10 @@ paths:
 ### 环境变量
 
 - **禁止**在 shell 前台 `export FOO=...` 注入环境变量
-- **禁止**在代码中硬编码配置值（数据库地址、密钥、端口等）
+- **禁止**在代码中硬编码以下配置值：
+  - **基础设施**：数据库地址、Redis / MQ 地址、密钥、端口、外部 API 地址
+  - **业务参数**：缓存 TTL、HTTP 超时、重试次数 / 间隔、批处理大小、限流阈值（rate / burst）、分页默认值与上限、文件大小上限、Token 有效期、定时任务周期
+- 判定标准：**任何"运维 / 业务可能想调整、且不希望发版"的值，都必须走配置**。代码中只允许出现：算法常量（PI、HTTP 状态码）、协议规定的固定值、纯类型枚举（如 `Status.ACTIVE = 1`）
 - 环境变量统一通过 `.env` 文件加载，由 Pydantic Settings 读取（见「配置管理」节）
 - `.env` 必须列入 `.gitignore`，提交 `.env.example` 作为模板
 
@@ -149,6 +152,36 @@ class Settings(BaseSettings):
 | 只有 1 个字段 | 保持顶层，不必嵌套 |
 | 3 个以上同前缀字段 | 必须嵌套 |
 
+### 什么必须走配置（判定表）
+
+写代码时遇到字面量数字 / 字符串，先对照此表判断是否抽到 Settings：
+
+| 类别 | 示例 | 是否走配置 |
+|------|------|-----------|
+| 基础设施地址 | `postgresql://...` / `redis://...` / `https://api.xxx.com` | ✅ 必须 |
+| 凭证 | SECRET_KEY / API_KEY / DB 密码 / OSS AK·SK | ✅ 必须（致命） |
+| 缓存 TTL | `redis.setex(key, 43200, v)` 中的 `43200` | ✅ 必须 → `settings.cache.user_token_ttl` |
+| HTTP 超时 / 重试 | `httpx.AsyncClient(timeout=30)` 中的 `30` | ✅ 必须 |
+| 限流阈值 | `@rate_limit(100, per=60)` 中的 `100` / `60` | ✅ 必须 |
+| 分页默认 / 上限 | `page_size: int = 20` / `le=100` 的 `100` | ✅ 必须 |
+| 文件大小上限 | `if size > 10 * 1024 * 1024` 的 `10MB` | ✅ 必须 |
+| Token 有效期 | JWT `exp` 的 7 天 / 30 天 | ✅ 必须 |
+| 定时任务周期 | Celery / APScheduler 的 cron / interval | ✅ 必须 |
+| 算法常量 | `PI = 3.14159` / `EARTH_RADIUS = 6371` | ❌ 不走配置 |
+| 协议规定值 | HTTP 状态码 `200` / `404` | ❌ 不走配置 |
+| 纯枚举值 | `class Status: ACTIVE = 1` | ❌ 不走配置 |
+
+```python
+# ❌ 错误：缓存 TTL 硬编码
+await redis.setex(f"user:{uid}", 43200, json.dumps(user))
+
+# ✅ 正确：走 Settings
+class CacheConfig(BaseModel):
+    user_ttl: int = 43200  # 默认 12h，可通过 CACHE__USER_TTL 覆盖
+
+await redis.setex(f"user:{uid}", settings.cache.user_ttl, json.dumps(user))
+```
+
 ## 六、函数与类设计
 
 ### 强制规则
@@ -290,6 +323,6 @@ user = cache.get_user(user_id)
 | 8 | 嵌套不超过 3 层，函数体不超过 50 行 |
 | 9 | 所有模块/类/函数有 docstring（Google 风格） |
 | 10 | 外部输入用 Pydantic 校验，不手动校验 dict |
-| 11 | 配置必须 Pydantic Settings 嵌套分组，不在代码硬编码 |
+| 11 | 配置必须 Pydantic Settings 嵌套分组；缓存 TTL / 超时 / 重试 / 限流 / 分页上限 / 文件上限 / Token 有效期等业务参数禁止硬编码 |
 
 **不执行自检就提交代码 = 违规。**