deveco_hmigbot 0.21.5

package/skills/migrate-core/scripts/closure/check-consumers.mjs

@@ -0,0 +1,301 @@
+#!/usr/bin/env node
+/**
+ * check-consumers.mjs — 开关/偏好键消费对账（三态：case / pass / unresolved，本检查不产 violation）
+ *
+ * 对账两本账：每个持久化键的"写入路径"（putSync/put/setOrCreate + 包裹它们的 setter 方法及其调用方）
+ *            × "读取路径"（getSync/get + 包裹它们的 getter 方法及其调用方）
+ *
+ * 立案类型（全部软性，供裁决，不定罪——写而不读可能是迁移标记等合法场景）：
+ *  - write_only        ：有写入、全工程无任何读取路径
+ *  - read_path_unused  ：store 里有 getter，但全工程没人调它（读取路径存在但未接线）
+ *  - self_loop_consumer：唯一的读取方就是写入它的那个 UI 文件（开关只用来渲染自己，无功能消费）
+ *  - read_only         ：有读取、无写入（可能靠默认值工作，或写入方漏迁）
+ *
+ * 用法：node check-consumers.mjs --project <鸿蒙工程根> [--json out.json] [--strict]
+ */
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join, resolve, sep, dirname, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { stripComments, blankStrings, walkFiles } from '../lib/scan.mjs';
+
+const argv = process.argv.slice(2);
+const argOf = (n, d) => { const i = argv.indexOf(n); return i >= 0 && argv[i + 1] ? argv[i + 1] : d; };
+const PROJECT = argOf('--project', null);
+const OUT = argOf('--json', null);
+const STRICT = argv.includes('--strict');
+if (!PROJECT) { console.error('usage: check-consumers.mjs --project <root> [--json out] [--strict] [--idioms i.json]'); process.exit(3); }
+// 写法知识表：数据不硬编码。默认随包 idioms.json，可 --idioms 覆盖（深合并顶层键）。
+const HERE = dirname(fileURLToPath(import.meta.url));
+const IDIOMS = { ...JSON.parse(readFileSync(join(HERE, 'idioms.json'), 'utf8')) };
+const idiomsOverride = argOf('--idioms', null);
+if (idiomsOverride) { const o = JSON.parse(readFileSync(idiomsOverride, 'utf8')); for (const k of Object.keys(o)) IDIOMS[k] = { ...IDIOMS[k], ...o[k] }; }
+
+const files = walkFiles(resolve(PROJECT), { match: (p, e) => e.endsWith('.ets') });
+const src = new Map(files.map(f => [f, stripComments(readFileSync(f, 'utf8'))]));
+// 字符串脱敏视图（调用/引用扫描用：日志串里的类名/调用样例不算证据；偏移与 src 一致）
+const blankCache = new Map();
+const bl = f => { if (!blankCache.has(f)) blankCache.set(f, blankStrings(src.get(f))); return blankCache.get(f); };
+const rel = f => String(f).replace(resolve(PROJECT) + sep, '');
+const lineOf = (code, idx) => code.slice(0, idx).split('\n').length;
+
+// ---------- 常量表（含枚举——与 check-routes 同游标：enum PrefKey { DARK='dark' } 的键必须可解析） ----------
+const constMap = new Map();
+for (const [, code] of src) {
+  for (const m of code.matchAll(/(?:export\s+)?const\s+([A-Za-z_$][\w$]*)\s*(?::\s*string)?\s*=\s*(['"])((?:(?!\2).)*)\2/g)) constMap.set(m[1], m[3]);
+  for (const m of code.matchAll(/static\s+(?:readonly\s+)?([A-Za-z_$][\w$]*)\s*(?::\s*string)?\s*=\s*(['"])((?:(?!\2).)*)\2/g)) constMap.set(m[1], m[3]);
+  for (const em of code.matchAll(/(?:const\s+)?enum\s+([A-Za-z_$][\w$]*)\s*\{([\s\S]*?)\}/g)) {
+    for (const mm of em[2].matchAll(/([A-Za-z_$][\w$]*)\s*=\s*(['"])((?:(?!\2).)*)\2/g)) {
+      constMap.set(`${em[1]}.${mm[1]}`, mm[3]);
+      if (!constMap.has(mm[1])) constMap.set(mm[1], mm[3]);
+    }
+  }
+}
+function keyOf(expr) {
+  const e = (expr || '').trim();
+  const lit = e.match(/^(['"])((?:(?!\1).)*)\1$/);
+  if (lit) return { key: lit[2], kind: 'literal' };
+  if (constMap.has(e)) return { key: constMap.get(e), kind: 'const', via: e };
+  const q = e.match(/^[A-Za-z_$][\w$]*\.([A-Za-z_$][\w$]*)$/);
+  if (q) {
+    if (constMap.has(e)) return { key: constMap.get(e), kind: 'const', via: e };
+    if (constMap.has(q[1])) return { key: constMap.get(q[1]), kind: 'const', via: e };
+  }
+  return { key: null, kind: 'dynamic', via: e.slice(0, 40) };
+}
+function firstArg(code, idx) {
+  let depth = 0, out = '';
+  for (let i = idx; i < code.length && out.length < 120; i++) {
+    const c = code[i];
+    if ('({['.includes(c)) depth++;
+    else if (')}]'.includes(c)) { if (depth === 0) break; depth--; }
+    else if (c === ',' && depth === 0) break;
+    out += c;
+  }
+  return out.trim();
+}
+
+// ---------- 采集读写点 ----------
+const WRITE_RE = new RegExp(`\\.\\s*(${IDIOMS.prefs.writeApis.join('|')})\\s*(?:<[^<>]{0,80}>)?\\s*\\(`, 'g'); // 容泛型 get<string>(（漏检实证：smokeRoute 误报 write_only）
+const READ_RE = new RegExp(`\\.\\s*(${IDIOMS.prefs.readApis.join('|')})\\s*(?:<[^<>]{0,80}>)?\\s*\\(`, 'g');
+const DELETE_RE = new RegExp(`\\.\\s*(${IDIOMS.prefs.deleteApis.join('|')})\\s*\\(`, 'g');
+// AppStorage/普通 Map.set 噪音控制：只统计 arg 可解析为字符串键、且键名不像 Map 泛型用法的
+const sites = []; // {op:'w'|'r', key, kind, via, file, line, api}
+const dynamicReadFiles = new Map(); // 文件 -> 变量键读取次数（持久化 API 上 get(k) 之类）
+for (const [f, code] of src) {
+  for (const [re, op] of [[WRITE_RE, 'w'], [READ_RE, 'r'], [DELETE_RE, 'w']]) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(code)) !== null) {
+      const arg = firstArg(code, re.lastIndex);
+      const k = keyOf(arg);
+      // 接收者提示：prefs.get / AppStorage.get / this.store.put 之类
+      const before = code.slice(Math.max(0, m.index - 60), m.index);
+      const recv = (before.match(/([A-Za-z_$][\w$]*)\s*$/) || [])[1] || '';
+      // 噪音闸：只收字面量/常量键；Map/Set 等容器的 .get(变量) 直接忽略——但持久化 API 上的变量键读取要记下来：
+      // 该文件里的键读取路径静态不可判（实证：逐 key 循环 getSync(k) 的 store 被判 8 键自消费，模型为过门改成字面量重写）
+      if (!k.key) { if (op === 'r' && (IDIOMS.prefs.strongApis.includes(m[1]) || new RegExp(IDIOMS.prefs.recvHint, 'i').test(recv))) dynamicReadFiles.set(f, (dynamicReadFiles.get(f) || 0) + 1); continue; }
+      sites.push({ op, key: k.key, kind: k.kind, via: k.via, file: f, line: lineOf(code, m.index), api: m[1], recv });
+    }
+  }
+}
+// 键宇宙三条准入（防 Map.get 噪音）：①强 API；②接收者名含 pref/storage/store/settings/config；③同键同时有读有写触点
+const STRONG_API = new Set(IDIOMS.prefs.strongApis);
+const RECV_HINT = new RegExp(IDIOMS.prefs.recvHint, 'i');
+const rwByKey = new Map();
+for (const s of sites) {
+  if (!rwByKey.has(s.key)) rwByKey.set(s.key, new Set());
+  rwByKey.get(s.key).add(s.op);
+}
+const PERSIST_KEY_SHAPE = new RegExp(IDIOMS.prefs.persistKeyShape, 'i'); // 成对准入还要长得像持久化键，滤掉协议/Map 短键
+const strongKeys = new Set(sites.filter(s =>
+  STRONG_API.has(s.api) || RECV_HINT.test(s.recv) ||
+  ((rwByKey.get(s.key) || new Set()).size === 2 && PERSIST_KEY_SHAPE.test(s.key))
+).map(s => s.key));
+const keySites = sites.filter(s => strongKeys.has(s.key));
+
+// ---------- 方法归属（store getter/setter 的外部调用一跳） ----------
+function* methodBodies(code) {
+  const blanked = blankStrings(code); // 括号平衡在字符串脱敏视图上做——字符串里的 {}() 不再破坏边界
+  const re = /(?:static\s+|private\s+|public\s+|export\s+|async\s+)*(?:function\s+)?([A-Za-z_$][\w$]*)\s*\(/g;
+  let m;
+  while ((m = re.exec(blanked)) !== null) {
+    if (['if', 'for', 'while', 'switch', 'catch', 'constructor', 'return'].includes(m[1])) continue;
+    const accessor = /\b(?:get|set)\s+$/.test(code.slice(Math.max(0, m.index - 20), m.index));
+    let depth = 1, i = re.lastIndex;
+    while (i < blanked.length && depth > 0) { if (blanked[i] === '(') depth++; else if (blanked[i] === ')') depth--; i++; }
+    const after = blanked.slice(i);
+    const bm = after.match(/^\s*(?::\s*[^{;=]*?)?\{/);
+    if (!bm) continue;
+    const bodyStart = i + bm[0].length;
+    let d = 1, j = bodyStart;
+    while (j < blanked.length && d > 0) { if (blanked[j] === '{') d++; else if (blanked[j] === '}') d--; j++; }
+    // 方法→类按包围位置绑定（多类文件取 pop() 会挂错类）
+    const cls = ([...code.slice(0, m.index).matchAll(/class\s+([A-Za-z_$][\w$]*)/g)].pop() || [])[1] || null;
+    yield { name: m[1], start: bodyStart, end: j, body: code.slice(bodyStart, j), accessor, cls };
+  }
+}
+// 构造函数体（methodBodies 按关键字跳过它）：`this.loadSavedPhone()` 这类源 init 块惯用法都在这里，可达性 = 别处 new 了该类
+function* ctorBodies(code) {
+  const blanked = blankStrings(code);
+  const re = /\bconstructor\s*\(/g; let m;
+  while ((m = re.exec(blanked)) !== null) {
+    let depth = 1, i = re.lastIndex;
+    while (i < blanked.length && depth > 0) { if (blanked[i] === '(') depth++; else if (blanked[i] === ')') depth--; i++; }
+    const bm = blanked.slice(i).match(/^\s*\{/); if (!bm) continue;
+    const bodyStart = i + bm[0].length; let d = 1, j = bodyStart;
+    while (j < blanked.length && d > 0) { if (blanked[j] === '{') d++; else if (blanked[j] === '}') d--; j++; }
+    const cls = ([...code.slice(0, m.index).matchAll(/class\s+([A-Za-z_$][\w$]*)/g)].pop() || [])[1] || null;
+    yield { name: 'constructor', start: bodyStart, end: j, body: code.slice(bodyStart, j), accessor: false, cls };
+  }
+}
+// key -> {readMethods:[{fn,file}], writeMethods:[], directReads:[files], directWrites:[files]}
+const ledger = new Map();
+const ensure = k => { if (!ledger.has(k)) ledger.set(k, { readMethods: [], writeMethods: [], readFiles: new Set(), writeFiles: new Set(), evidence: [] }); return ledger.get(k); };
+const methodIndex = new Map(); // fn -> [{file, keys:{r:Set,w:Set}}]
+for (const [f, code] of src) {
+  for (const fn of methodBodies(code)) {
+    const inKeys = keySites.filter(s => s.file === f && s.line >= lineOf(code, fn.start) && s.line <= lineOf(code, fn.end));
+    if (!inKeys.length) continue;
+    const r = new Set(inKeys.filter(s => s.op === 'r').map(s => s.key));
+    const w = new Set(inKeys.filter(s => s.op === 'w').map(s => s.key));
+    if (!methodIndex.has(fn.name)) methodIndex.set(fn.name, []);
+    methodIndex.get(fn.name).push({ file: f, r, w, accessor: fn.accessor, cls: fn.cls });
+    for (const k of r) ensure(k).readMethods.push({ fn: fn.name, file: f });
+    for (const k of w) ensure(k).writeMethods.push({ fn: fn.name, file: f });
+  }
+}
+for (const s of keySites) {
+  const e = ensure(s.key);
+  (s.op === 'r' ? e.readFiles : e.writeFiles).add(s.file);
+}
+// 方法调用一跳：谁调用了含键读写的方法（扫描走字符串脱敏视图）。
+// 同文件调用也算消费——实证 coolmall `AuthStore.getAuth()` 被同类其他（外部可达）方法调、`this.isGuideShown()` 在本 VM 内用，
+// 旧规则"定义文件内调用不算"把它们都判成 read_path_unused（抽样 3 条 2 条误报）；真死路径（cofi getDismissedInfoBoxes 无任何调用）照抓。
+// 同文件调用先记为 internal，再按"调用它的方法是否本身被外部调用"传播 chainRounds 轮（结构判据：调用图，不看命名）。
+const internalCalls = new Map();   // `${file}::${fn}` -> Set(callerFn)
+for (const [f] of src) {
+  const code = bl(f);
+  for (const [fn, defs] of methodIndex) {
+    const selfDef = defs.some(d => d.file === f);
+    const isAccessor = defs.some(d => d.accessor);
+    if (selfDef) {
+      // 同文件：找调用它的其他方法体
+      for (const caller of [...methodBodies(src.get(f)), ...ctorBodies(src.get(f))]) {
+        if (caller.name === fn) continue;
+        const re = isAccessor ? new RegExp(`\\.${fn}\\b`) : new RegExp(`(?:\\.|(?<![.\\w$]))${fn}\\s*\\(`);   // 方法形 .fn( 与模块级裸函数 fn( 都算
+        if (re.test(blankStrings(caller.body))) { const k = `${f}::${fn}`; if (!internalCalls.has(k)) internalCalls.set(k, new Set()); internalCalls.get(k).add(caller.name === 'constructor' ? `constructor@${caller.cls || ''}` : caller.name); }
+      }
+      continue;
+    }
+    const re = isAccessor ? new RegExp(`\\.${fn}\\b`, 'g') : new RegExp(`\\.${fn}\\s*\\(`, 'g');
+    let m2;
+    while ((m2 = re.exec(code)) !== null) {
+      // 访问器名太容易撞（.value/.enabled 全工程皆是）：要求接收者提示（recvHint 数据驱动）
+      if (isAccessor) {
+        const before = code.slice(Math.max(0, m2.index - 60), m2.index);
+        const recv = (before.match(/([A-Za-z_$][\w$]*)\s*$/) || [])[1] || '';
+        if (!RECV_HINT.test(recv)) continue;
+      }
+      // 属性访问器按使用点判读写：`.x =` 写；`.x +=`/`??=`/`||=` 等复合赋值=读+写；其余读
+      let usage = null; // true=写 false=读 'both'=读写
+      if (isAccessor) {
+        const tail = code.slice(re.lastIndex, re.lastIndex + 12);
+        const wm = tail.match(/^\s*([+\-*/%&|^]|\|\||&&|\?\?)?=(?!=)/);
+        usage = wm ? (wm[1] ? 'both' : true) : false;
+      }
+      for (const d of defs) {
+        const applyR = isAccessor ? (usage === false || usage === 'both') : true;
+        const applyW = isAccessor ? (usage === true || usage === 'both') : true;
+        if (applyR) for (const k of d.r) { const e = ensure(k); e.readFiles.add(f); e.evidence.push(`读经 ${fn} ← ${rel(f)}`); }
+        if (applyW) for (const k of d.w) { const e = ensure(k); e.writeFiles.add(f); e.evidence.push(`写经 ${fn} ← ${rel(f)}`); }
+      }
+    }
+  }
+}
+
+// 传播：同文件内被调用的方法，若调用者本身有外部调用（任意文件 `.caller(`）或调用者也被已消费方法调用 → 该方法视为已消费
+{
+  const callerFilesCache = new Map();   // `${file}::${fn}` -> 外部调用它的文件集
+  const importsFrom = (g, fn, file) => {   // g 是否 `import { fn } from '<解析到 file>'`
+    for (const m of (src.get(g) || '').matchAll(/import\s*\{([^}]*)\}\s*from\s*['"](\.[^'"]+)['"]/g)) {
+      if (!m[1].split(',').some(x => x.trim().split(/\s+as\s+/)[0].trim() === fn)) continue;
+      const base = resolve(dirname(g), m[2]);
+      for (const c of [base, base + '.ets', base + '.ts', join(base, 'index.ets'), join(base, 'index.ts')]) if (resolve(c) === resolve(file)) return true;
+    }
+    return false;
+  };
+  const callerFiles = (file, fn) => { const k = `${file}::${fn}`; if (callerFilesCache.has(k)) return callerFilesCache.get(k); const out = new Set();
+    if (fn.startsWith('constructor@')) { const cls = fn.slice('constructor@'.length); if (cls) { const reN = new RegExp(`\\bnew\\s+${cls}\\s*\\(`); for (const [g] of src) { if (g !== file && reN.test(bl(g))) out.add(g); } } callerFilesCache.set(k, out); return out; }
+    const reM = new RegExp(`\\.${fn}\\s*\\(`), reB = new RegExp(`(?<![.\\w$])${fn}\\s*\\(`); for (const [g] of src) { if (g === file) continue; const code = bl(g); if (reM.test(code) || (reB.test(code) && importsFrom(g, fn, file))) out.add(g); } callerFilesCache.set(k, out); return out; };
+  const consumedBy = new Map();   // `${file}::${fn}` -> 最终外部消费文件集
+  for (let round = 0; round < (IDIOMS.wrappers?.chainRounds || 3); round++) {
+    for (const [k, callers] of internalCalls) {
+      if (consumedBy.has(k)) continue;
+      const [file, fn] = k.split('::');
+      const ext = new Set();
+      for (const c of callers) { for (const g of callerFiles(file, c)) ext.add(g); for (const g of consumedBy.get(`${file}::${c}`) || []) ext.add(g); }
+      if (!ext.size) continue;
+      consumedBy.set(k, ext);
+      // 消费文件记为真正的外部调用方（链首文件），这样 store 文件自身不计、跨文件消费成立
+      for (const d of methodIndex.get(fn) || []) { if (d.file !== file) continue;
+        for (const key of d.r) { const e = ensure(key); for (const g of ext) { e.readFiles.add(g); e.evidence.push(`读经 ${fn} ← 同文件 ${[...callers].join('/')}() ← ${rel(g)}`); } }
+        for (const key of d.w) { const e = ensure(key); for (const g of ext) { e.writeFiles.add(g); e.evidence.push(`写经 ${fn} ← 同文件 ${[...callers].join('/')}() ← ${rel(g)}`); } } }
+    }
+  }
+}
+
+// ---------- 裁决 ----------
+const isUiFile = f => /@(Component|ComponentV2|Entry|CustomDialog)\b/.test(src.get(f) || '');
+const storeFiles = new Set([...ledger.values()].flatMap(e => [...e.readMethods, ...e.writeMethods].map(m => m.file)));
+// 仓储模式兜底（实测 9 误报回流）：直接调用扫描找不到读者时，若键的读方法住在
+// Repo/Store 类里且该类名被其他文件引用，按类级一跳把引用文件计为消费方（弱证据，降误报）
+const REPO_HINT = /repo|store|manager|dao/i;
+for (const [key, e] of ledger.entries()) {
+  if (e.readFiles.size > 0 || !e.readMethods.length) continue;
+  for (const m of e.readMethods) {
+    // 类按方法包围位置绑定（methodIndex 已带 cls）；证据要求成员访问/实例化，纯提及类名不算
+    const def = (methodIndex.get(m.fn) || []).find(d => d.file === m.file);
+    const cls = def && def.cls;
+    if (!cls || !REPO_HINT.test(cls)) continue;
+    const useRe = new RegExp(`(?:\\b${cls}\\s*\\.|\\bnew\\s+${cls}\\b)`);
+    for (const [f] of src) {
+      if (f === m.file) continue;
+      if (useRe.test(bl(f))) { e.readFiles.add(f); e.evidence.push(`类级一跳：${cls} 被 ${rel(f)} 成员访问/实例化（弱证据）`); }
+    }
+  }
+}
+const findings = [];
+// 写入文件里有变量键读取 → 该键的读取路径静态不可判：只记 info，不立案（同 check-routes 的动态跳转降级原则）
+const dynamicOf = e => [...e.writeFiles].find(f => dynamicReadFiles.has(f));
+for (const [key, e] of [...ledger.entries()].sort()) {
+  const dyn = dynamicOf(e);
+  if (dyn) { findings.push({ type: 'read_unresolvable', severity: 'info', key, basis: '判据：写入文件存在持久化 API 的变量键读取（如 getSync(k) 循环），读取路径静态不可判', evidence: `${rel(dyn)} 有 ${dynamicReadFiles.get(dyn)} 处变量键读取——该键消费与否静态不可判，不立案；不要为过门把变量键改写成字面量` }); continue; }
+  const extReadFiles = [...e.readFiles].filter(f => !storeFiles.has(f) || isUiFile(f));
+  const extWriteFiles = [...e.writeFiles].filter(f => !storeFiles.has(f) || isUiFile(f));
+  const readerFilesBeyondWriters = extReadFiles.filter(f => !extWriteFiles.includes(f));
+  if (e.readFiles.size === 0 && e.readMethods.length === 0) {
+    findings.push({ type: 'write_only', severity: 'case', key, basis: '判据：写触点存在且全工程无读取路径（读取路径=直接读触点∪store读方法的外部调用∪类级一跳）', evidence: `写入见 ${[...e.writeFiles].slice(0, 2).map(rel).join(', ')}；全工程无读取路径` });
+  } else if (extReadFiles.length === 0 && e.readMethods.length > 0) {
+    findings.push({ type: 'read_path_unused', severity: 'case', key, basis: '判据：store 内存在含该键读触点的方法，但全工程无该方法调用点', evidence: `store 内有读取方法 ${e.readMethods.map(m => m.fn + '()').slice(0, 2).join('/')}，但全工程无人调用` });
+  } else if (extWriteFiles.length > 0 && readerFilesBeyondWriters.length === 0 && extReadFiles.length > 0) {
+    findings.push({ type: 'self_loop_consumer', severity: 'case', key, basis: '判据：存在外部读取文件，但全部与写入文件重合（自渲染类合法场景需回源确认）', evidence: `唯一读取方 ${extReadFiles.map(rel).slice(0, 2).join(', ')} 即写入方本身；未发现跨文件功能消费——与源码同构即合法：带理由豁免或写进 $SPEC/closure-idioms.json；不要为过门重构代码` });
+  } else if (extWriteFiles.length === 0 && e.writeFiles.size === 0) {
+    findings.push({ type: 'read_only', severity: 'case', key, basis: '判据：读触点存在且全工程无写入触点（默认值驱动可豁免）', evidence: `读取见 ${extReadFiles.slice(0, 2).map(rel).join(', ')}；全工程无写入（若靠默认值可豁免）` });
+  }
+}
+const report = {
+  project: relative(process.cwd(), resolve(PROJECT)) || '.',
+  stats: { files: files.length, keys: ledger.size, sites: keySites.length },
+  keys: Object.fromEntries([...ledger.entries()].map(([k, e]) => [k, {
+    readMethods: e.readMethods.map(m => `${m.fn}@${rel(m.file)}`),
+    writeMethods: e.writeMethods.map(m => `${m.fn}@${rel(m.file)}`),
+    readFiles: [...e.readFiles].map(rel), writeFiles: [...e.writeFiles].map(rel),
+  }])),
+  findings,
+};
+if (OUT) writeFileSync(OUT, JSON.stringify(report, null, 2));
+console.log(`[check-consumers] ${resolve(PROJECT)}`);
+console.log(`  键 ${ledger.size} · 触点 ${keySites.length}`);
+for (const f of findings) console.log(`  ${f.severity === 'info' ? '· INFO' : '▲ CASE'} ${f.type} [${f.key}] — ${f.evidence}`);
+if (!findings.length) console.log('  ✓ 全部键读写闭合');
+process.exit(STRICT && findings.some(f => f.severity !== 'info') ? 2 : 0);

package/skills/migrate-core/scripts/closure/check-permissions.mjs

@@ -0,0 +1,165 @@
+#!/usr/bin/env node
+/**
+ * check-permissions.mjs — 平台能力契约门（权限声明 + 契约链 + 静默降级；数据驱动，扩展只改 API_PERMS 表）。
+ *
+ * 病根：鸿蒙平台能力是"声明 + 授权 + 调用 + 兜底"**整条链**，断任何一环运行时静默失效——
+ * 模拟器/dev 环境常宽松放行 → build 过、走查过，真机上功能悄悄不工作（实证：长驻任务启动失败被
+ * catch 只 log 吞掉，用户看到的是"后台计时没了、也没弹权限"）。单点查声明拦不住链断。
+ *
+ * 三层判定：
+ *  1) 权限声明（确定性 → violation）：用了要权限的 API，module.json5 未声明。
+ *  2) 契约链（表条目可选 chain）：
+ *     - chain.declare：module.json5 级配套声明（如 taskKeeping 需 abilities.backgroundModes）。
+ *       hard=true 时缺失为确定性 violation（API 必失败）；否则软立案。
+ *     - chain.authorize：全工程须存在的授权动作（如长驻任务依赖通知授权）。静态只能证"存在与否"，
+ *       缺失记软立案（case）由模型回源裁决，绝不硬拦。
+ *  3) 静默降级（通用，对所有表条目命中点）：能力调用在 try 内且对应 catch 体**只有日志/取错**
+ *     （无状态回退/用户提示/重抛等任何补救）→ 软立案 silent_degrade。
+ *  4) 受限开放权限（表条目 restricted；官方"受限开放权限"清单：normal 应用须 ACL 才能申请）：用到即软立案
+ *     restricted_permission，证据给免权限替代路线（系统 Picker / 安全控件）；不判 violation——ACL 静态看不见。
+ *     条目可带 scope（文件须含该 import 才算，避免同名方法误伤）与 legal（文件里有此形态即合法，如 SaveButton）。
+ *
+ * 用法：check-permissions.mjs --project <鸿蒙工程根> [--json out]
+ * 退出码：0 无硬违规 / 10 有硬违规 / 3 用法错（软立案不改退出码——closure-suite final 阶段汇总裁决）
+ */
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
+import { join, relative, resolve, dirname } from 'node:path';
+import { walkFiles, stripComments, blankStrings, moduleSrcRoots, tryCatchRanges, enclosingTry } from '../lib/scan.mjs';
+
+const argv = process.argv.slice(2);
+const argOf = (n, d) => { const i = argv.indexOf(n); return i >= 0 && argv[i + 1] ? argv[i + 1] : d; };
+const PROJECT = argOf('--project', null);
+if (!PROJECT) { console.error('usage: check-permissions.mjs --project <root> [--json out]'); process.exit(3); }
+
+// API 用法 → 所需权限（只收清晰的"用到即必需"映射）+ 可选 chain（契约链环节）。扩展在此一处。
+const API_PERMS = [
+  { re: /\bvibrator\s*\.\s*(startVibration|isSupportEffect|isSupportEffectSync|stopVibration)/, perm: 'ohos.permission.VIBRATE', cap: '振动/触感反馈' },
+  {
+    re: /\b(backgroundTaskManager|continuousTask)\s*\.\s*startBackgroundRunning|@ohos\.resourceschedule\.backgroundTaskManager/,
+    perm: 'ohos.permission.KEEP_BACKGROUND_RUNNING', cap: '长时后台任务(ContinuousTask)',
+    chain: {
+      declare: {
+        re: /backgroundModes[\s\S]{0,160}?taskKeeping/, hard: true,
+        miss: 'abilities 未声明 backgroundModes:["taskKeeping"]——startBackgroundRunning 必然运行时失败',
+      },
+      authorize: {
+        re: /requestEnableNotification/,
+        miss: '全工程未见通知授权请求（requestEnableNotification）——taskKeeping 长驻依赖 ongoing 通知，未授权时启动失败；应在启动长驻链路前确保授权',
+      },
+    },
+  },
+  { re: /\breminderAgentManager\s*\.\s*(publishReminder|addReminder)/, perm: 'ohos.permission.PUBLISH_AGENT_REMINDER', cap: '提醒代理/精确定时' },
+  { re: /\bgeoLocationManager\s*\.\s*(getCurrentLocation|on\s*\(\s*['"]locationChange)/, perm: 'ohos.permission.APPROXIMATELY_LOCATION', cap: '定位' },
+  { re: /\bcameraManager|@ohos\.multimedia\.camera|\bcamera\s*\.\s*getCameraManager/, perm: 'ohos.permission.CAMERA', cap: '相机' },
+  { re: /\baudioCapturer|\.createAudioCapturer|AudioCapturer/, perm: 'ohos.permission.MICROPHONE', cap: '麦克风录音' },
+  { re: /\bhttp\s*\.\s*createHttp|@ohos\.net\.http|\.connectServer|new\s+WebSocket|(?<!\.)\bfetch\s*\(/, perm: 'ohos.permission.INTERNET', cap: '网络访问' },
+  { re: /\bprint\s*\.\s*print\s*\(/, scope: /@ohos\.print\b|\{[^}]*\bprint\b[^}]*\}\s*from\s*['"]@kit\.BasicServicesKit/, perm: 'ohos.permission.PRINT', cap: '打印' },
+  // ---- 受限开放权限（用到即软立案；权限名与是否受限以 SDK permissions.d.ts + 官方受限清单为准）----
+  { re: /\bcontact\s*\.\s*(queryContacts?|queryMyCard|isLocalContact|queryKey|queryHolders|queryGroups)\s*\(/, perm: 'ohos.permission.READ_CONTACTS', cap: '读通讯录', restricted: 'contact.selectContacts（系统选人，免权限）' },
+  { re: /\bcontact\s*\.\s*(addContact|deleteContact|updateContact)\s*\(/, perm: 'ohos.permission.WRITE_CONTACTS', cap: '写通讯录', restricted: '写入交给系统通讯录应用，应用侧只存自己的数据' },
+  { re: /\.(getAssets|getAlbums)\s*\(/, scope: /@kit\.MediaLibraryKit|@ohos\.file\.photoAccessHelper/, perm: 'ohos.permission.READ_IMAGEVIDEO', cap: '全量读媒体库', restricted: 'PhotoViewPicker.select（免权限）' },
+  { re: /\.(createAsset|applyChanges)\s*\(/, scope: /@kit\.MediaLibraryKit|@ohos\.file\.photoAccessHelper/, legal: /\bSaveButton\s*\(/, perm: 'ohos.permission.WRITE_IMAGEVIDEO', cap: '直写媒体库', restricted: 'SaveButton.onClick 内 applyChanges 或 showAssetsCreationDialog（免权限）' },
+  { re: /\bcall\s*\.\s*dial\s*\(/, perm: 'ohos.permission.PLACE_CALL', cap: '直接拨号(dial)' }, // makeCall 拉起拨号盘不需权限（SDK d.ts 各重载无 @permission），只有 dial 要
+];
+
+const rel = f => relative(resolve(PROJECT), f).replace(/\\/g, '/');
+// 全模块扫描（entry + 任意 HSP/HAR 模块——实证多模块工程九成源码曾不被查）
+const ROOTS = moduleSrcRoots(resolve(PROJECT));
+
+// 各模块 module.json5 的权限声明并集（文本级抽取，免 JSON5 解析）
+const modPaths = ROOTS.map(r => join(r, '..', 'module.json5')).filter(existsSync);
+const declared = new Set();
+let moduleTxt = '';
+for (const mp of modPaths) {
+  const txt = stripComments(readFileSync(mp, 'utf8'));
+  moduleTxt += '\n' + txt;
+  for (const m of txt.matchAll(/ohos\.permission\.[A-Z_]+/g)) declared.add(m[0]);
+}
+const modPath = modPaths[0] || null;
+
+// try/catch 追踪走共享层 scan.mjs（tryCatchRanges/enclosingTry）——反手拷。
+// catch 体只有 日志调用 / 取错变量（const err = e as X）/ 空 → 判"静默吞"；有任何其它语句（状态回退、
+// 用户提示、重抛、函数调用）→ 视为有补救，放行。
+function catchOnlyLogs(body) {
+  const stmts = body.split(/[;\n]/).map(s => s.trim()).filter(Boolean);
+  if (!stmts.length) return true;
+  return stmts.every(s =>
+    /^(console|hilog|Logger|log)\s*[.(]/.test(s) ||
+    /^[\w$.]+\.(error|warn|info|debug|log|fatal)\s*\(/.test(s) ||
+    /^(const|let|var)\s+[\w$]+\s*(:\s*[\w$.<>[\], ]+)?\s*=\s*[\w$]+(\s+as\s+[\w$.]+)?$/.test(s));
+}
+
+// 扫源码：命中点收集 + 授权动作探测 + 静默降级判定
+const used = new Map(); // perm -> {cap, rule, sites:[{file,line}]}
+const restrictedHits = new Map(); // perm -> {rule, sites}（受限开放：单独记账，不进 missing_permission）
+const authorizeSeen = new Set(); // authorize.re.source 集合
+const silent = [];
+for (const ROOT of ROOTS) for (const f of walkFiles(ROOT, { match: (_p, e) => e.endsWith('.ets') || e.endsWith('.ts') })) {
+  const raw = readFileSync(f, 'utf8');
+  const plain = stripComments(raw);          // 保留字符串（import 路径在字符串里）
+  const code = blankStrings(plain);
+  let tries = null;
+  for (const rule of API_PERMS) {
+    if (rule.scope && !rule.scope.test(plain)) continue;   // 同名方法不在该 Kit 的文件里不算
+    if (rule.legal && rule.legal.test(code)) continue;     // 文件里有合法形态（如 SaveButton 安全控件）→ 放行
+    const g = new RegExp(rule.re.source, rule.re.flags.includes('g') ? rule.re.flags : rule.re.flags + 'g');
+    let m;
+    while ((m = g.exec(code)) !== null) {
+      const line = raw.slice(0, m.index).split('\n').length;
+      const book = rule.restricted ? restrictedHits : used;
+      if (!book.has(rule.perm)) book.set(rule.perm, { cap: rule.cap, rule, sites: [] });
+      book.get(rule.perm).sites.push({ file: rel(f), line });
+      // 静默降级（通用环节）
+      tries = tries || tryCatchRanges(code);
+      const t = enclosingTry(tries, m.index);
+      if (t && t.catchStart >= 0 && catchOnlyLogs(code.slice(t.catchStart + 1, t.catchEnd))) {
+        silent.push({ severity: 'case', type: 'silent_degrade', name: rule.cap, file: rel(f), line,
+          evidence: `${rel(f)}:${line} ${rule.cap} 调用失败被静默吞（catch 只有日志/取错，无状态回退/用户提示/重抛）——真机上表现为功能悄悄不工作（裁决：catch 内补状态回退或用户可见提示/上抛；确属可忽略则带理由豁免）` });
+      }
+    }
+    if (rule.chain && rule.chain.authorize && !authorizeSeen.has(rule.chain.authorize.re.source)
+      && rule.chain.authorize.re.test(code)) authorizeSeen.add(rule.chain.authorize.re.source);
+  }
+}
+
+const findings = [];
+for (const [perm, info] of used) {
+  if (!declared.has(perm)) {
+    const site = info.sites[0];
+    findings.push({ severity: 'violation', type: 'missing_permission', name: perm,
+      file: site.file, line: site.line,
+      evidence: `${site.file}:${site.line} 用到${info.cap}(需 ${perm}) 但 module.json5 requestPermissions 未声明——真机上能力失效/抛异常（用了 ${info.sites.length} 处）` });
+  }
+  const ch = info.rule.chain;
+  if (!ch) continue;
+  if (ch.declare && !ch.declare.re.test(moduleTxt)) {
+    findings.push({ severity: ch.declare.hard ? 'violation' : 'case', type: 'missing_declare', name: info.cap,
+      file: modPath ? rel(modPath) : 'module.json5', line: 1,
+      evidence: `${info.cap}：${ch.declare.miss}（调用见 ${info.sites[0].file}:${info.sites[0].line}）` });
+  }
+  if (ch.authorize && !authorizeSeen.has(ch.authorize.re.source)) {
+    findings.push({ severity: 'case', type: 'missing_authorize', name: info.cap,
+      file: info.sites[0].file, line: info.sites[0].line,
+      evidence: `${info.cap}：${ch.authorize.miss}` });
+  }
+}
+for (const [perm, info] of restrictedHits) {
+  const site = info.sites[0];
+  findings.push({ severity: 'case', type: 'restricted_permission', name: perm, file: site.file, line: site.line,
+    evidence: declared.has(perm)
+      ? `${site.file}:${site.line} ${info.cap}用到受限开放权限 ${perm}（normal 应用须 ACL）且已声明——无 ACL 则签名/安装即失败：改走 ${info.rule.restricted}；确有 ACL 带理由豁免（用了 ${info.sites.length} 处）`
+      : `${site.file}:${site.line} ${info.cap}用到受限开放权限 ${perm}（normal 应用须 ACL 才能申请）且未声明——改走 ${info.rule.restricted}；确有 ACL 则声明并带理由豁免（用了 ${info.sites.length} 处）` });
+}
+findings.push(...silent);
+
+const vio = findings.filter(f => f.severity === 'violation');
+const cases = findings.filter(f => f.severity === 'case');
+const report = { project: relative(process.cwd(), resolve(PROJECT)) || '.', module: modPath ? rel(modPath) : null,
+  declared: [...declared], usedPermissions: [...used.keys()], findings };
+const out = argOf('--json', null);
+if (out) { mkdirSync(dirname(resolve(out)), { recursive: true }); writeFileSync(out, JSON.stringify(report, null, 2)); }
+console.log(`[check-permissions] 声明 ${declared.size} · 用到需权限 API ${used.size + restrictedHits.size} 类 · 硬违规 ${vio.length} · 软立案 ${cases.length}（链断${cases.filter(c => c.type !== 'silent_degrade').length}/静默降级${cases.filter(c => c.type === 'silent_degrade').length}）`);
+for (const v of vio.slice(0, 10)) console.log(`  ✗ ${v.evidence}`);
+for (const c of cases.slice(0, 10)) console.log(`  ▲ ${c.evidence}`);
+if (!vio.length && !cases.length) console.log('  ✓ 能力权限/契约链/失败兜底齐全');
+process.exit(vio.length ? 10 : 0);

package/skills/migrate-core/scripts/closure/check-resources.mjs

@@ -0,0 +1,130 @@
+#!/usr/bin/env node
+/**
+ * check-resources.mjs — $r 资源引用闭合检查。
+ *
+ * 两本账：代码中的 $r('app.<桶>.<名>') 引用 × resources 实际声明。
+ * 运行时 app.* 只在**本模块 + AppScope** 解析，故声明账按模块分桶对账
+ * （并桶会让 A 模块借 B 模块声明蒙混——真悬空漏报）。
+ * 引用了本模块∪AppScope 都没有的名字 = violation；动态引用计 unresolved；
+ * element JSON 解析失败**不吞**：记 parse_error 立案，且该模块的悬空判定降级
+ * 为 case（声明账不完整时不定罪）。$r('sys.*') 不在对账范围。
+ *
+ * 用法：node check-resources.mjs --project <鸿蒙工程根> [--json out] 　退出码 0/10/3
+ */
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { resolve, sep, relative, join } from 'node:path';
+import { stripComments, walkFiles } from '../lib/scan.mjs';
+
+const argv = process.argv.slice(2);
+const argOf = (n, d) => { const i = argv.indexOf(n); return i >= 0 && argv[i + 1] ? argv[i + 1] : d; };
+const PROJECT = argOf('--project', null);
+const OUT = argOf('--json', null);
+if (!PROJECT) { console.error('usage: check-resources.mjs --project <root> [--json out]'); process.exit(3); }
+
+const files = walkFiles(resolve(PROJECT), {});   // spec/ 由 walkFiles 缺省排除（迁移工作区不是交付物）
+const norm = p => p.replace(/\\/g, '/');
+const rel = f => String(f).replace(resolve(PROJECT) + sep, '');
+
+// ---------- 声明账（按模块分桶；AppScope 全局共享） ----------
+const BUCKETS = ['string', 'color', 'media', 'float', 'plural', 'integer', 'boolean'];
+const emptyDecl = () => Object.fromEntries(BUCKETS.map(b => [b, new Set()]));
+const modules = new Map();   // moduleRoot -> decl
+const appScope = emptyDecl();
+const parseErrors = [];      // {file, module, err}
+const modBroken = new Set(); // 声明账不完整的模块（含 AppScope 标记 '*'）
+function declFor(n) {
+  if (n.includes('/AppScope/')) return { decl: appScope, mod: '*AppScope*' };
+  const m = n.match(/^(.*)\/src\/main\/resources\//);
+  if (!m) return { decl: appScope, mod: '*AppScope*' }; // 非常规布局并入全局（保守）
+  if (!modules.has(m[1])) modules.set(m[1], emptyDecl());
+  return { decl: modules.get(m[1]), mod: m[1] };
+}
+for (const f of files) {
+  const n = norm(f);
+  if (n.match(/\/resources\/[^/]+\/element\/[^/]+\.json$/)) {
+    const { decl, mod } = declFor(n);
+    try {
+      const j = JSON.parse(readFileSync(f, 'utf8'));
+      for (const [bucket, arr] of Object.entries(j)) {
+        if (decl[bucket]) for (const it of arr || []) if (it.name) decl[bucket].add(it.name);
+      }
+    } catch (e) {
+      parseErrors.push({ file: rel(f), module: mod, err: String(e.message).slice(0, 120) });
+      modBroken.add(mod === '*AppScope*' ? '*' : mod);
+    }
+  }
+  const mm = n.match(/\/resources\/[^/]+\/media\/([^/]+)\.\w+$/);
+  if (mm) declFor(n).decl.media.add(mm[1]);
+}
+const moduleOfFile = (n) => {
+  for (const root of modules.keys()) if (n.startsWith(root + '/')) return root;
+  return null;
+};
+const lookup = (mod, bucket, name) => {
+  const inScope = appScope[bucket] && appScope[bucket].has(name);
+  if (mod && modules.has(mod)) return (modules.get(mod)[bucket] && modules.get(mod)[bucket].has(name)) || inScope;
+  // 模块未知：对全部模块∪AppScope 查（保守放行，不误伤）
+  return inScope || [...modules.values()].some(d => d[bucket] && d[bucket].has(name));
+};
+
+// ---------- 引用账（共享库注释脱敏：文档注释里的 $r 示例是头号误报源） ----------
+const refs = [];
+let unresolved = 0;
+for (const f of files.filter(x => x.endsWith('.ets') || x.endsWith('.ts'))) {
+  const n = norm(f);
+  const code = stripComments(readFileSync(f, 'utf8'));
+  const mod = moduleOfFile(n);
+  for (const m of code.matchAll(/\$r\s*\(\s*(['"])app\.(\w+)\.([\w.]+)\1/g)) {
+    refs.push({ bucket: m[2], name: m[3], file: f, mod, line: code.slice(0, m.index).split('\n').length });
+  }
+  for (const m of code.matchAll(/\$r\s*\(\s*[^'")]/g)) unresolved++;
+}
+
+// ---------- 裁决 ----------
+const findings = [];
+for (const p of parseErrors) findings.push({ severity: 'case', type: 'resource_parse_error', evidence: `${p.file} 解析失败（${p.err}）——该模块声明账不完整，悬空判定已降级` });
+for (const r of refs) {
+  if (!BUCKETS.includes(r.bucket)) { findings.push({ severity: 'case', type: 'unknown_bucket', evidence: `${rel(r.file)}:${r.line} $r('app.${r.bucket}.${r.name}') 桶未知` }); continue; }
+  if (!lookup(r.mod, r.bucket, r.name)) {
+    const broken = modBroken.has('*') || (r.mod && modBroken.has(r.mod));
+    findings.push(broken
+      ? { severity: 'case', type: 'dangling_resource_unverifiable', name: `app.${r.bucket}.${r.name}`, file: rel(r.file), line: r.line, evidence: `${rel(r.file)}:${r.line} $r('app.${r.bucket}.${r.name}') 未见声明，但该模块有 element 解析失败——修 JSON 后复查` }
+      : { severity: 'violation', type: 'dangling_resource', name: `app.${r.bucket}.${r.name}`, file: rel(r.file), line: r.line, evidence: `${rel(r.file)}:${r.line} $r('app.${r.bucket}.${r.name}') 未在本模块/AppScope 声明（运行时取不到）` });
+  }
+}
+// 悬空 media ↔ 静态资源转换器的跳过账（spec/front/resource-manifest.json skipped[]："<源路径> (<原因>)"）：
+// 源 drawable 存在但转换器没搬（形状/选择器 XML 等）→ 证据直接给源文件与原因，修法明确（手写等价），不再让模型回源找
+const MANIFEST = join(resolve(PROJECT), 'spec', 'front', 'resource-manifest.json');
+const skippedByName = new Map();
+if (existsSync(MANIFEST)) {
+  try {
+    for (const s of JSON.parse(readFileSync(MANIFEST, 'utf8')).skipped || []) {
+      const m = String(s).match(/^(.*?)\s+\((.*)\)$/); const path = m ? m[1] : String(s);
+      const base = path.replace(/\\/g, '/').split('/').pop().replace(/\.[^.]+$/, '');
+      if (!skippedByName.has(base)) skippedByName.set(base, { path, reason: m ? m[2] : '' });
+    }
+  } catch { /* 清单坏了不影响裁决 */ }
+}
+let linkedSkipped = 0;
+for (const f of findings) {
+  if (f.type !== 'dangling_resource' || !String(f.name).startsWith('app.media.')) continue;
+  const s = skippedByName.get(String(f.name).slice('app.media.'.length)); if (!s) continue;
+  f.sourceSkipped = s; linkedSkipped++;
+  f.evidence += `——源 ${s.path} 转换器已跳过（${s.reason}）：手写等价（形状/选择器 drawable → 组件属性或 SVG）`;
+}
+const declTotals = emptyDecl();
+for (const d of [...modules.values(), appScope]) for (const b of BUCKETS) for (const x of d[b]) declTotals[b].add(x);
+const report = {
+  project: relative(process.cwd(), resolve(PROJECT)) || '.',
+  stats: { refs: refs.length, unresolvedDynamic: unresolved, modules: [...modules.keys()].map(rel), parseErrors: parseErrors.length, declared: Object.fromEntries(BUCKETS.map(b => [b, declTotals[b].size])), linkedSkipped },
+  findings,
+};
+if (OUT) writeFileSync(OUT, JSON.stringify(report, null, 2));
+const vio = findings.filter(f => f.severity === 'violation');
+const cases = findings.filter(f => f.severity === 'case');
+console.log(`[check-resources] 引用 ${refs.length}（动态 ${unresolved}） · 模块 ${modules.size} · 声明 string:${declTotals.string.size} color:${declTotals.color.size} media:${declTotals.media.size}${parseErrors.length ? ` · ⚠ 解析失败 ${parseErrors.length}` : ''}`);
+for (const f of vio.slice(0, 15)) console.log(`  ✗ VIOLATION ${f.evidence}`);
+if (vio.length > 15) console.log(`  …共 ${vio.length} 条`);
+for (const f of cases.slice(0, 8)) console.log(`  ▲ CASE ${f.type} ${f.evidence}`.slice(0, 160));
+if (!vio.length && !cases.length) console.log('  ✓ 引用全部闭合（0 悬空）');
+process.exit(vio.length ? 10 : 0);