dsh-plugin-compat-check 0.1.3 → 0.1.5

package/kernel/lib/report.mjs

@@ -13,9 +13,11 @@
 
 import { TOOL_VERSION } from "./version.mjs";
 import path from "node:path";
-import { sealReportBody, createFailure } from "./contracts.mjs";
+import { sealReportBody, createFailure, catalogLines } from "./contracts.mjs";
 import { DISPOSITION } from "./verdict.mjs";
 import { describeDiff } from "./baseline.mjs";
+import { nextSteps } from "./finding-guidance.mjs";
+import { buildDependencyGraph } from "./dependency-graph.mjs";
 
 const VERDICT_LABEL = {
   ok: "可用",
@@ -31,7 +33,7 @@ const SEVERITY_LABEL = {
 const CATEGORY_LABEL = {
   "host-service-missing": "宿主服务缺失",
   "host-method-missing": "宿主方法缺失",
-  "unprovided-dependency": "无人提供的依赖",
+  "unprovided-dependency": "依赖服务待确认",
   "declaration-mismatch": "声明与实测不符",
   "declared-incompatible": "版本声明不支持",
   "host-entry-inactive": "宿主条目未激活",
@@ -63,7 +65,15 @@ export function render(result, opts) {
   if (opts.quiet) {
     const q = verdict.summary;
     L.push(
-      `结论: ${VERDICT_LABEL.ok} ${q.ok}    ${VERDICT_LABEL.partial} ${q.partial}    ${VERDICT_LABEL.broken} ${q.broken}`,
+      `结论: ${VERDICT_LABEL.ok} ${q.ok}    ${VERDICT_LABEL.partial} ${q.partial}    ${VERDICT_LABEL.broken} ${q.broken}` +
+        (q.limited ? `    覆盖有限 ${q.limited}` : "") +
+        (q.vacuousOk ? `    其中 ${q.vacuousOk} 个无已验证调用` : "") +
+        "；" +
+        catalogLines(result.catalog).join("；") +
+        (verdict.observation?.notes?.length
+          ? "；采样说明：" +
+            verdict.observation.notes.join("；").replace(/\s+/g, " ")
+          : ""),
     );
     return L.join("\n");
   }
@@ -71,6 +81,7 @@ export function render(result, opts) {
   L.push(
     `插件数: ${meta.length}    有运行时面: ${result.inputs.hasRuntimeSurface ? "是" : "否（方法级结论降为「疑似」）"}`,
   );
+  L.push(...catalogLines(result.catalog));
   L.push("");
   for (const note of verdict.observation?.notes || [])
     L.push(`采样说明: ${note}`);
@@ -82,7 +93,7 @@ export function render(result, opts) {
   L.push(
     `结论: ${VERDICT_LABEL.ok} ${s.ok}    ${VERDICT_LABEL.partial} ${s.partial}    ${VERDICT_LABEL.broken} ${s.broken}` +
       (s.vacuousOk
-        ? `    （其中 ${s.vacuousOk} 个「可用」是空洞的：它没有任何可检查的依赖）`
+        ? `    （其中 ${s.vacuousOk} 个「可用」没有已验证调用，不等于业务通过）`
         : ""),
   );
   L.push("");
@@ -122,9 +133,16 @@ export function render(result, opts) {
   for (const name of names) {
     const p = verdict.plugins[name];
     L.push(
-      `${VERDICT_LABEL[p.verdict]}  ${name}@${p.version}${p.vacuous ? "   [空洞的结论：无可检查对象]" : ""}`,
+      `${VERDICT_LABEL[p.verdict]}  ${name}@${p.version}${p.vacuous ? "   [无已验证调用]" : ""}`,
     );
     if (opts.quiet) continue;
+    if (p.coverage) {
+      L.push(
+        `     证据覆盖: ${p.coverage.status === "complete" ? "完整" : "有限"}；已验证调用 ${p.coverage.verifiedCalls}`,
+      );
+      for (const note of p.coverage.limitations)
+        L.push(`       覆盖限制: ${note}`);
+    }
     for (const f of p.findings) {
       const api = f.service
         ? f.method
@@ -132,7 +150,7 @@ export function render(result, opts) {
           : f.service
         : "(声明)";
       const loc = f.location ? `${f.location.file}:${f.location.line}` : "-";
-      const cert = f.certainty === "certain" ? "" : " [疑似]";
+      const cert = f.certainty === "certain" ? " [确定]" : " [疑似]";
       L.push(
         `     ${SEVERITY_LABEL[f.severity] ?? f.severity} / ${CATEGORY_LABEL[f.category] ?? f.category}${cert}  ${api}  @ ${loc}`,
       );
@@ -142,12 +160,11 @@ export function render(result, opts) {
       // 标出来，用户才知道哪一句可以去核实。
       if (f.impact) {
         L.push(
-          f.impactBasis === "inferred"
-            ? `       影响（推断，非实测）: ${f.impact}`
-            : `       影响: ${f.impact}`,
+          `       影响${f.impactBasis === "measured" ? "（实测）" : f.impactBasis === "inferred" ? "（推断，非实测）" : "（依据未提供）"}: ${f.impact}`,
         );
       }
       if (f.basis) L.push(`       依据: ${f.basis}`);
+      for (const step of nextSteps(f)) L.push(`       下一步: ${step}`);
     }
     // 「没报」和「报了」一样要能审：过滤与弃权是结论的一部分。
     const cs = p.clientSide || [];
@@ -169,13 +186,55 @@ export function render(result, opts) {
       );
   }
 
+  const graph = buildDependencyGraph({
+    extraction: result.extract,
+    verdict,
+    entries: result.entryStates,
+  });
+  const relations = graph.edges.filter((edge) => edge.kind === "dependency");
+  const nodeNames = new Map(graph.nodes.map((node) => [node.id, node.name]));
+  const requirement = {
+    required: "必需",
+    optional: "可选",
+    subcontext: "子作用域",
+    unknown: "必需性未知",
+  };
+  L.push("");
+  L.push(
+    `依赖关系: 服务依赖 ${relations.length}；潜在声明环 ${graph.cycles.length}${graph.coverage.truncated ? "；关系/传播已截断" : ""}`,
+  );
+  for (const edge of relations.slice(0, 20)) {
+    const candidates = graph.edges.filter(
+      (candidate) =>
+        candidate.kind === "candidate-provider" &&
+        candidate.service === edge.service &&
+        (candidate.side === edge.side || candidate.side === "unknown"),
+    );
+    L.push(
+      `  ${nodeNames.get(edge.from)} → ${edge.service} [${edge.side}/${requirement[edge.requirement]}]；候选提供者：${candidates.map((candidate) => `${nodeNames.get(candidate.from)}（${candidate.side}）`).join("、") || "未定位（不等于宿主缺失）"}`,
+    );
+  }
+  if (relations.length > 20)
+    L.push(
+      `  文本仅列出前 20 条依赖；完整的本次关系见 JSON/面板（仍受图预算限制）。`,
+    );
+  L.push(
+    "  提供声明仅为候选；同端路径及环只表示潜在影响，不证明实际挂起或失败；client 包 inject 不当作 host 服务。",
+  );
+  for (const reason of graph.coverage.reasons)
+    L.push(`  关系覆盖限制: ${reason}`);
+
   L.push("");
   L.push(
-    "说明: 「疑似」= 没有运行时面、只能靠官方目录推断（那份目录是契约目录，不是运行时面）。",
+    "说明: 确定（certain）表示当前证据足以支持该条发现，可来自明确静态事实或合格运行时观测；疑似（suspected）表示当前证据不足以确定该条发现。",
+  );
+  L.push(
+    "      impactBasis=measured/inferred 分别表示影响有对应实测依据/影响由证据推断；确定发现不等于影响已实测。官方目录不是运行时面，未观测不等于缺失。",
   );
   L.push(
-    "      假阳性会让用户去做不必要的处置，所以判不准时一律降级，而不是升格成确定。",
+    "      没有已验证调用仍可能存在服务依赖或客户端功能；调用核验、无发现和覆盖完整均不等于业务验收通过。",
   );
+  L.push("      下一步是核实建议；本工具不会自动安装、升级或修改配置与源码。");
   return L.join("\n");
 }
 
@@ -211,6 +270,7 @@ export function toJSON(result) {
         }
       : null,
     dshVersion: result.verdict.dshVersion,
+    ...(result.catalog ? { catalog: result.catalog } : {}),
     summary: result.verdict.summary,
     observation: {
       ...result.verdict.observation,
@@ -219,6 +279,11 @@ export function toJSON(result) {
         : null,
     },
     plugins: result.verdict.plugins,
+    dependencyGraph: buildDependencyGraph({
+      extraction: result.extract,
+      verdict: result.verdict,
+      entries: result.entryStates,
+    }),
     extraction: {
       scanComplete: report.scanComplete,
       diagnostics: report.diagnostics,

package/kernel/lib/source-analysis.mjs

@@ -79,8 +79,10 @@ export function analyzeSources(
   const sites = [],
     bindings = [],
     dependencies = [],
+    provideSites = [],
     diagnostics = [],
     subContexts = [];
+  const provideSiteKeys = new Set();
   let scopeId = 0,
     invocationCount = 0,
     constantCalls = 0;
@@ -586,6 +588,24 @@ export function analyzeSources(
         sides: [...(activeSides || sides)],
       });
     };
+    const provide = (service, node) => {
+      provided.add(service);
+      mention(service);
+      const sides = [...(activeSides || fileSides[file] || ["unknown"])];
+      const site = {
+        service,
+        file,
+        line: node.loc?.start.line ?? 1,
+        start: node.start,
+        end: node.end,
+        sides,
+      };
+      const key = JSON.stringify([service, file, site.start, sides]);
+      if (!provideSiteKeys.has(key)) {
+        provideSiteKeys.add(key);
+        provideSites.push(site);
+      }
+    };
     const literalNames = (node, scope) => {
       node = unwrap(node);
       if (node?.type === "Identifier")
@@ -1383,8 +1403,7 @@ export function analyzeSources(
               );
           if (provideNames.has(field))
             for (const s of literalNames(node.init, scope)) {
-              provided.add(s);
-              mention(s);
+              provide(s, node);
             }
         }
         return;
@@ -1529,8 +1548,7 @@ export function analyzeSources(
             dependency(name, "descriptor-inject", node);
         if (node.type === "AssignmentExpression" && slot.key === "provide")
           for (const name of literalNames(node.right, scope)) {
-            provided.add(name);
-            mention(name);
+            provide(name, node);
           }
         return;
       }
@@ -1729,8 +1747,7 @@ export function analyzeSources(
             operation === "provide" &&
             constant(node.arguments[0], scope, guards) !== null
           ) {
-            provided.add(constant(node.arguments[0], scope, guards));
-            mention(constant(node.arguments[0], scope, guards));
+            provide(constant(node.arguments[0], scope, guards), node);
           }
           if (operation === "inject") {
             const injected = literalNames(node.arguments[0], scope);
@@ -1900,6 +1917,7 @@ export function analyzeSources(
     serviceFiles,
     sites,
     provided,
+    provideSites,
     bindings,
     dependencies,
     diagnostics,

package/kernel/lib/upgrade-capture-worker.mjs

@@ -0,0 +1,20 @@
+import fs from "node:fs";
+import path from "node:path";
+import { parentPort, workerData } from "node:worker_threads";
+import { captureUpgradeInputOwned } from "./upgrade-input.mjs";
+
+try {
+  const { nm, limits, root } = workerData;
+  const selected = path.resolve(nm);
+  const installed =
+    path.basename(selected) !== "node_modules" &&
+    fs.existsSync(path.join(selected, "node_modules"))
+      ? path.join(selected, "node_modules")
+      : selected;
+  parentPort.postMessage({
+    ok: true,
+    value: captureUpgradeInputOwned(installed, limits, root),
+  });
+} catch (error) {
+  parentPort.postMessage({ ok: false, error: error.message });
+}

package/kernel/lib/upgrade-cleanup-worker.mjs

@@ -0,0 +1,28 @@
+import fs from "node:fs";
+import path from "node:path";
+import { parentPort, workerData } from "node:worker_threads";
+
+try {
+  const { root, identity } = workerData;
+  const observed = fs.lstatSync(root);
+  if (
+    !observed.isDirectory() ||
+    observed.dev !== identity.dev ||
+    observed.ino !== identity.ino
+  )
+    throw new Error("私有输入目录身份变化");
+  // Never follow copied links. This worker only receives a parent-owned root,
+  // never a path selected by the preview caller or sent back by capture.
+  const writable = (dir) => {
+    if (!fs.lstatSync(dir).isDirectory())
+      throw new Error("私有输入目录身份变化");
+    fs.chmodSync(dir, 0o700);
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true }))
+      if (entry.isDirectory()) writable(path.join(dir, entry.name));
+  };
+  writable(root);
+  fs.rmSync(root, { recursive: true, force: true });
+  parentPort.postMessage({ ok: true, value: null });
+} catch (error) {
+  parentPort.postMessage({ ok: false, error: error.message });
+}