create-yss-spec 3.5.6 → 3.5.8

package/bin/create-yss-spec.js

@@ -1,12 +1,14 @@
 #!/usr/bin/env node
 
-const { runCli } = require("../src/cli/index.js");
 const { serializeError } = require("../src/cli/error-output.js");
 
 const argv = process.argv.slice(2);
 const wantsJson = argv.includes("--json");
 
 (async () => {
+  const { assertNodeVersion } = await import("../src/runtime-store.mjs");
+  assertNodeVersion();
+  const { runCli } = require("../src/cli/index.js");
   await runCli(argv);
 })().catch((error) => {
   if (wantsJson) {

package/cli-core.lock.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "sourceRepository": "https://github.com/iloveZzz/yss-spec-project-template.git",
-  "sourceRevision": "dd58fc3929b3958579ac8a426f06f087682f2f6c",
+  "sourceRevision": "20477b0020cfa152e1294ddb0f53b2e90a579152",
   "sourceState": "committed",
   "sourcePath": ".template-source/cli-core",
   "coreVersion": "0.2.0",
@@ -16,11 +16,11 @@
       "mode": 420
     },
     "cli.mjs": {
-      "digest": "73aae345737aa7d069283ff7e5539be26498c7a7c94d1100a699a47e4c18e31f",
+      "digest": "2d4c28fcedf9a80f7e40eca9ce29e321ba201ecad92d2091934a3242c53353a2",
       "mode": 420
     },
     "command-runner.mjs": {
-      "digest": "4fb7f3c9ca26dff3f955ddb1c6ad545519d3e55af179f834ff67b1c0bf20bffd",
+      "digest": "af5cdb58dc5ee2487f04aad8afde37776a219866cc7830a298d971e772411892",
       "mode": 420
     },
     "engine.mjs": {
@@ -60,11 +60,15 @@
       "mode": 420
     },
     "package.json": {
-      "digest": "68d3dfd6451f7a433ff2eb821daa83d59e0c03f19b73d3a2cf5582ee6ce23332",
+      "digest": "b341ce4219f43e63223958d30cc6f5dbd946cc393a3c620e51a98ed08b98ae15",
+      "mode": 420
+    },
+    "runtime-store.mjs": {
+      "digest": "894065fb91ac05501796e8948b4015f0230deef4a72700e96c2890266310ac41",
       "mode": 420
     },
     "scaffold.mjs": {
-      "digest": "ebf16b3ffe95fe00698691ebc71362dfce1e93846a34cb01745b0c063035e209",
+      "digest": "03ab69bfa5fb4aee2d5a48808ba6e5fdca2643ad895e0fc7849165f9c31112f4",
       "mode": 420
     },
     "spec-migration-adapter.mjs": {
@@ -112,7 +116,7 @@
       "mode": 420
     }
   },
-  "digest": "9a4cfce884a706efa91ae8dd8dc2fc82cd7d17e8a84f633bdb049ea531436ae1",
+  "digest": "7d0a2dcf7406d428e25d575618b46931032757b450ec30f7dd0ac2b5b9f29f17",
   "upgradeResources": {
     "SKILL.md": {
       "digest": "40495ca033ebd0345363714e45571ee77258a435ea1523ae716dc2402ced0487",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-yss-spec",
-  "version": "3.5.6",
+  "version": "3.5.8",
   "description": "Initialize a YSS spec project template repository",
   "main": "src/api/index.js",
   "repository": {
@@ -37,5 +37,8 @@
   },
   "devDependencies": {
     "ajv": "^8.20.0"
+  },
+  "engines": {
+    "node": ">=22.13 <27"
   }
 }

package/src/api/_sync-service.js

@@ -299,7 +299,6 @@ function applySyncContext(context, { force = false, prune = false } = {}) {
         previousManagedFiles: metadata.managedFiles,
         transaction,
       });
-      verifyGeneratedProjectInstance(targetDir);
       const nextMetadata = decorateMetadataLifecycle(
         decorateMetadataOwnership(buildNextSyncMetadata(metadata, syncPlan, { snapshot: context.snapshot })),
       );
@@ -311,6 +310,9 @@ function applySyncContext(context, { force = false, prune = false } = {}) {
       if (!isDeepStrictEqual({ ...nextMetadata, lastSyncedAt: metadata.lastSyncedAt }, metadata)) {
         writeTemplateMetadata(targetDir, nextMetadata, transaction);
       }
+      // Verify files against the metadata staged by this same transaction.
+      // Any failure restores both the managed files and their previous baseline.
+      verifyGeneratedProjectInstance(targetDir);
     },
   });
 

package/src/command-runner.mjs

@@ -1,9 +1,25 @@
 import { spawn, spawnSync } from "node:child_process";
 import { appendFileSync, rmSync, writeFileSync } from "node:fs";
 import { StringDecoder } from "node:string_decoder";
+import path from "node:path";
+import { assertNodeVersion } from "./runtime-store.mjs";
 import { fileURLToPath } from "node:url";
 
-function killTree(child, signal) {
+const sessionSequences = new WeakMap();
+function runtimeLogs(session, stdoutFile, stderrFile) {
+  if (!session) return { stdoutFile, stderrFile };
+  const sequence = sessionSequences.get(session) || 0;
+  sessionSequences.set(session, sequence + 1);
+  return { stdoutFile: stdoutFile || path.join(session.runDir, `command-${sequence}.stdout`), stderrFile: stderrFile || path.join(session.runDir, `command-${sequence}.stderr`) };
+}
+function recordRuntimeResult(session, result, command, args, files) {
+  if (!session) return result;
+  try { session.recordCommand({ command: JSON.stringify([command, ...args]), ...result, stdout: undefined, stderr: undefined, ...files }); }
+  catch (error) { result.storageError = [result.storageError,error.message].filter(Boolean).join("; "); }
+  return result;
+}
+
+export function killTree(child, signal) {
   if (!child.pid) return;
   try {
     if (process.platform === "win32") spawnSync("taskkill", ["/PID", String(child.pid), "/T", "/F"], { stdio: "ignore" });
@@ -12,9 +28,10 @@ function killTree(child, signal) {
 }
 
 /** Bounded lifetime for external tools; stdout is never mixed with progress. */
-export function runCommand(command, args, { cwd, env = process.env, timeoutMs = 0, signal, stdoutFile, stderrFile, secrets = [], progress = false } = {}) {
+export function runCommand(command, args, { cwd, env = process.env, timeoutMs = 0, signal, stdoutFile, stderrFile, secrets = [], progress = false, runtimeSession } = {}) {
+  assertNodeVersion();
+  ({ stdoutFile, stderrFile } = runtimeLogs(runtimeSession, stdoutFile, stderrFile));
   if (!Number.isFinite(timeoutMs) || timeoutMs < 0) throw new TypeError("timeoutMs 必须是非负毫秒数");
-  if (signal?.aborted) return Promise.resolve({ status: 1, stdout: "", stderr: "command cancelled", termination: "cancelled", duration_ms: 0 });
   return new Promise(resolve => {
     const started = performance.now();
     const argumentSecrets = args.flatMap(value => { try { const url = new URL(value); return url.password ? [url.password, decodeURIComponent(url.password)] : []; } catch { return []; } });
@@ -22,14 +39,15 @@ export function runCommand(command, args, { cwd, env = process.env, timeoutMs =
     const replacement = secret => secretNames.has(secret) ? `[REDACTED:${secretNames.get(secret)}]` : "[REDACTED]";
     const sensitive = [...secrets, ...argumentSecrets, ...secretNames.keys()].filter(value => typeof value === "string" && value.length > 0).sort((a, b) => b.length - a.length);
     const redact = text => sensitive.reduce((value, secret) => value.replaceAll(secret, replacement(secret)), text);
+    if (signal?.aborted) { resolve(recordRuntimeResult(runtimeSession,{status:1,stdout:"",stderr:"command cancelled",termination:"cancelled",duration_ms:0,actual_exit_code:null,actual_exit_signal:null,actual_exit_code_observed:false},redact(command),args.map(redact),{}));return; }
     if (progress) process.stderr.write(`[开始] ${redact(command + " " + args.join(" "))}\n`);
     for (const file of [stdoutFile, stderrFile]) if (file) writeFileSync(file, "");
     const child = spawn(command, args, { cwd, env, detached: process.platform !== "win32", stdio: ["ignore", "pipe", "pipe"] });
-    let termination = null, escalation, timer, errorMessage;
+    let termination = null, escalation, timer, errorMessage, logError, spawnError = false;
     const makeStream = file => {
       const decoder = new StringDecoder("utf8");
       let pending = "", captured = "";
-      const emit = text => { captured += text; if (file) appendFileSync(file, text); };
+      const emit = text => { captured += text; if (file && !logError) try { appendFileSync(file, text); } catch (error) { logError=error.message; } };
       function consume(final = false) {
         let output = "", cursor = 0;
         while (cursor < pending.length) {
@@ -57,7 +75,7 @@ export function runCommand(command, args, { cwd, env = process.env, timeoutMs =
     if (timeoutMs) timer = setTimeout(() => cancel("timeout"), timeoutMs);
     child.stdout.on("data", bytes => stdout.write(bytes));
     child.stderr.on("data", bytes => stderr.write(bytes));
-    child.on("error", error => { errorMessage = redact(error.message); });
+    child.on("error", error => { spawnError = true; errorMessage = redact(error.message); });
     child.on("close", (code, exitSignal) => {
       clearTimeout(timer); clearTimeout(escalation);
       // A group leader can exit before its descendants close redirected streams.
@@ -67,7 +85,13 @@ export function runCommand(command, args, { cwd, env = process.env, timeoutMs =
       const duration_ms = performance.now() - started;
       const status = termination === "timeout" ? 124 : termination ? 1 : code ?? 1;
       if (progress) process.stderr.write(`[${status === 0 ? "完成" : "失败"}] ${command} (${Math.round(duration_ms)}ms, exit=${status}${termination ? `, ${termination}` : ""})\n`);
-      resolve({ status, stdout: stdout.end(), stderr: stderr.end() + (errorMessage || ""), signal: exitSignal, termination, duration_ms });
+      const actual_exit_code_observed = !spawnError && Number.isInteger(code);
+      const result = { status, stdout: stdout.end(), stderr: stderr.end() + (errorMessage || ""), signal: exitSignal, termination, duration_ms,
+        actual_exit_code: actual_exit_code_observed ? code : null,
+        actual_exit_signal: spawnError ? null : exitSignal ?? null,
+        actual_exit_code_observed };
+      if(logError)result.storageError=logError;
+      resolve(recordRuntimeResult(runtimeSession, result, redact(command), args.map(redact), { stdoutFile, stderrFile }));
     });
   });
 }
@@ -75,12 +99,23 @@ export function runCommand(command, args, { cwd, env = process.env, timeoutMs =
 // Synchronous API compatibility for existing generators/cache consumers. The worker
 // owns the process group and streams logs; it never updates project metadata.
 export function runCommandSync(command, args, options = {}) {
+  assertNodeVersion();
+  const { runtimeSession, ...workerOptions } = options;
+  Object.assign(workerOptions, runtimeLogs(runtimeSession, options.stdoutFile, options.stderrFile));
   const result = spawnSync(process.execPath, [fileURLToPath(import.meta.url), "--worker"], {
-    input: JSON.stringify({ command, args, options }), encoding: "utf8", maxBuffer: 64 * 1024 * 1024,
+    input: JSON.stringify({ command, args, options: workerOptions }), encoding: "utf8", maxBuffer: 64 * 1024 * 1024,
     stdio: ["pipe", "pipe", "inherit"], env: options.env ?? process.env,
   });
   if (result.error || result.status !== 0) throw new TypeError(result.error?.message || "command worker failed");
-  return JSON.parse(result.stdout);
+  const value = JSON.parse(result.stdout);
+  if (runtimeSession) {
+    // The worker already redacts output. Redact arguments before registering in the parent.
+    const env = options.env || process.env;
+    const sensitive = [...(options.secrets || []), ...Object.entries(env).filter(([key]) => /(?:PASSWORD|TOKEN|SECRET)$/.test(key) || key === "MAVEN_REPO_USERNAME").map(([, secret]) => secret), ...args.flatMap(arg => { try { const url = new URL(arg); return url.password ? [url.password, decodeURIComponent(url.password)] : []; } catch { return []; } })].filter(secret => typeof secret === "string" && secret.length).sort((a,b) => b.length - a.length);
+    const redact = text => sensitive.reduce((value, secret) => value.replaceAll(secret, "[REDACTED]"), text);
+    return recordRuntimeResult(runtimeSession, value, redact(command), args.map(redact), { stdoutFile: workerOptions.stdoutFile, stderrFile: workerOptions.stderrFile });
+  }
+  return value;
 }
 
 if (process.argv[1] === fileURLToPath(import.meta.url) && process.argv[2] === "--worker") {

package/src/content-identity.js

@@ -0,0 +1,111 @@
+"use strict";
+const { createHash } = require("node:crypto");
+const { spawnSync } = require("node:child_process");
+const fs = require("node:fs");
+const path = require("node:path");
+
+const HEX_LENGTH = { "git-sha1": 40, "git-sha256": 64, sha256: 64 };
+const IDENTITY_PATTERN = /^(git-sha1|git-sha256|sha256):([0-9a-f]+)$/;
+
+function parseIdentity(value) {
+  if (typeof value !== "string") return null;
+  const match = IDENTITY_PATTERN.exec(value);
+  if (!match || match[2].length !== HEX_LENGTH[match[1]]) return null;
+  return { algo: match[1], value: match[2] };
+}
+function formatIdentity(algo, hex) {
+  const length = HEX_LENGTH[algo];
+  if (!length) throw new TypeError("未知身份算法: " + algo);
+  if (typeof hex !== "string" || !new RegExp("^[0-9a-f]{" + length + "}$").test(hex)) throw new TypeError("身份摘要非法: " + algo + ":" + hex);
+  return algo + ":" + hex;
+}
+function identityEquals(left, right) {
+  if (left === right) return true;
+  const a = parseIdentity(left);
+  const b = parseIdentity(right);
+  if (!a || !b) return false;
+  return a.algo === b.algo && a.value === b.value;
+}
+function sha256Identity(bytes) {
+  return formatIdentity("sha256", createHash("sha256").update(bytes).digest("hex"));
+}
+function realpathOrResolve(target) {
+  try { return fs.realpathSync(target); } catch { return path.resolve(target); }
+}
+
+// Resolve the enclosing Git work tree once per directory. Git reports the
+// canonical path, so the file side is canonicalized too: /var and /private/var
+// must not look like different trees on macOS.
+const rootCache = new Map();
+function gitRootFor(filePath) {
+  const directory = path.dirname(filePath);
+  if (rootCache.has(directory)) return rootCache.get(directory);
+  const result = spawnSync("git", ["-C", directory, "rev-parse", "--show-toplevel"], { encoding: "utf8" });
+  const root = result.status === 0 ? result.stdout.trim() : null;
+  rootCache.set(directory, root);
+  return root;
+}
+
+function repoState(root) {
+  const format = spawnSync("git", ["-C", root, "rev-parse", "--show-object-format"], { encoding: "utf8" });
+  const algo = format.status === 0 && format.stdout.trim() === "sha256" ? "git-sha256" : "git-sha1";
+  return { algo };
+}
+
+// One git hash-object --stdin-paths call per repository instead of one process
+// per generated file; default clean filters keep the identity equal to the blob
+// Git would commit for the path.
+function batchIdentities(root, refs, algo) {
+  const result = new Map();
+  if (!refs.length) return result;
+  const proc = spawnSync("git", ["-C", root, "hash-object", "--stdin-paths"], {
+    encoding: "utf8",
+    input: refs.join("\n") + "\n",
+    maxBuffer: 128 * 1024 * 1024,
+  });
+  if (proc.status === 0) {
+    const lines = proc.stdout.split("\n").filter(Boolean);
+    refs.forEach((ref, index) => {
+      const hex = lines[index];
+      if (hex && new RegExp("^[0-9a-f]{" + HEX_LENGTH[algo] + "}$").test(hex)) result.set(ref, formatIdentity(algo, hex));
+    });
+  }
+  return result;
+}
+
+// Map absolute file paths to content identities. Paths outside a Git work tree
+// fall back to a disclosed sha256 identity.
+function identityForPaths(filePaths) {
+  const identities = new Map();
+  const byRoot = new Map();
+  for (const file of filePaths) {
+    const root = gitRootFor(file);
+    if (!root) {
+      try { identities.set(file, sha256Identity(fs.readFileSync(file))); } catch { /* unreadable: omit */ }
+      continue;
+    }
+    const realRoot = realpathOrResolve(root);
+    const ref = path.relative(realRoot, realpathOrResolve(file)).split(path.sep).join("/");
+    if (!ref || ref.startsWith("..") || path.isAbsolute(ref)) {
+      try { identities.set(file, sha256Identity(fs.readFileSync(file))); } catch { /* unreadable: omit */ }
+      continue;
+    }
+    let group = byRoot.get(realRoot);
+    if (!group) byRoot.set(realRoot, group = []);
+    group.push({ file, ref });
+  }
+  for (const [root, group] of byRoot) {
+    const state = repoState(root);
+    const hashed = batchIdentities(root, group.map((item) => item.ref), state.algo);
+    for (const item of group) {
+      const identity = hashed.get(item.ref);
+      if (identity) identities.set(item.file, identity);
+      else {
+        try { identities.set(item.file, sha256Identity(fs.readFileSync(item.file))); } catch { /* unreadable: omit */ }
+      }
+    }
+  }
+  return identities;
+}
+
+module.exports = { parseIdentity, formatIdentity, identityEquals, sha256Identity, identityForPaths };