jsharness 1.0.0

package/.harness/gate/checks/build-gates-java.js

@@ -0,0 +1,155 @@
+/**
+ * Gate Check Category B (Java): Java 后端构建门槛
+ * 
+ * 适用于 pom.xml 存在的 Spring Boot / Maven 项目
+ * 参考: rules/project/java-backend.md (JDK21 + Spring Boot)
+ *
+ * 检查项：
+ * - J-B1 Maven 编译检查 (mvn clean compile)
+ * - J-B2 单元测试快速验证 (mvn test)
+ * - J-B3 Checkstyle 代码风格检查 (mvn checkstyle:check)
+ * - J-B4 依赖树分析 (mvn dependency:tree, 非阻塞)
+ * - J-B5(可选) SpotBugs Bug 扫描 (mvn spotbugs:check)
+ * - J-B6(可选) JaCoCo 覆盖率门禁 (mvn jacoco:check)
+ *
+ * > 来源: harness-java-fullchain change | 创建日期: 2026-05-21
+ */
+
+const { execSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+async function run(options = {}) {
+  const issues = [];
+  const checks = [];
+
+  // 辅助函数：执行命令并记录结果
+  function runCheck(name, cmd, opts = {}) {
+    const start = Date.now();
+    try {
+      execSync(cmd, {
+        encoding: 'utf-8',
+        timeout: opts.timeout || 180000,
+        stdio: 'pipe',
+        cwd: process.cwd(),
+        ...opts.env ? { env: { ...process.env, ...opts.env } } : {}
+      });
+      checks.push({ name, status: 'pass', duration_ms: Date.now() - start });
+      return true;
+    } catch (e) {
+      const output = (e.stderr?.toString() || e.stdout?.toString() || e.message).slice(0, 500);
+      checks.push({ name, status: 'fail', duration_ms: Date.now() - start, error: output });
+      issues.push({
+        code: `J-B${checks.length}`,
+        severity: opts.blocking ? 'error' : (opts.warningOnly ? 'warning' : (opts.infoOnly ? 'info' : 'error')),
+        message: `${name} 失败`,
+        details: output.split('\n').slice(0, 5),
+        suggestion: opts.suggestion
+      });
+      return false;
+    }
+  }
+
+  /**
+   * 检测是否为 Maven 项目（pom.xml 存在）
+   */
+  function isMavenProject() {
+    return fs.existsSync(path.join(process.cwd(), 'pom.xml'));
+  }
+
+  /**
+   * 检测 pom.xml 是否包含指定插件（简单文本检测）
+   */
+  function hasPlugin(pluginArtifactId) {
+    try {
+      const pomContent = fs.readFileSync(path.join(process.cwd(), 'pom.xml'), 'utf-8');
+      // 简单匹配 artifactId 标签
+      return new RegExp(`<artifactId>${pluginArtifactId}</artifactId>`, 'i').test(pomContent);
+    } catch { return false; }
+  }
+
+  if (!isMavenProject()) {
+    return {
+      status: 'warning',
+      score: 'N/A',
+      issues: [{ code: 'J-B0', severity: 'warning', message: '未找到 pom.xml，跳过 Java 后端构建门禁', suggestion: '此模块仅适用于 Maven 项目' }],
+      summary: { checks: [], passed: 0, failed: 0 }
+    };
+  }
+
+  // === J-B1: Maven 编译检查 ===
+  await runCheck(
+    'Maven 编译 (mvn clean compile)',
+    'mvn clean compile -q -DskipTests 2>&1',
+    { timeout: 180000, blocking: true, suggestion: '检查编译错误。常见原因：语法错误/缺少依赖/import 缺失。运行 mvn clean compile -e 查看完整错误堆栈' }
+  );
+
+  // === J-B2: 单元测试快速验证 ===
+  await runCheck(
+    '单元测试快速验证 (mvn test)',
+    'mvn test -q -DfailIfNoTests=false 2>&1',
+    { timeout: 300000, blocking: false, warningOnly: true, suggestion: '运行 mvn test 查看具体失败用例。检查 Surefire 报告: target/surefire-reports/' }
+  );
+
+  // === J-B3: Checkstyle 代码风格检查 ===
+  if (hasPlugin('maven-checkstyle-plugin')) {
+    await runCheck(
+      'Checkstyle 代码风格检查 (mvn checkstyle:check)',
+      'mvn checkstyle:check -q 2>&1',
+      { timeout: 120000, blocking: false, warningOnly: true, suggestion: '运行 mvn checkstyle:checkstyle 查看详细违规报告。参考 rules/project/java-backend.md §命名规范' }
+    );
+  } else {
+    checks.push({ name: 'Checkstyle 代码风格检查', status: 'skipped', duration_ms: 0, reason: 'pom.xml 中未配置 maven-checkstyle-plugin' });
+  }
+
+  // === J-B4: 依赖树分析（非阻塞，仅记录）===
+  await runCheck(
+    'Maven 依赖树分析 (mvn dependency:tree)',
+    'mvn dependency:tree -q 2>&1 | tail -20',
+    { timeout: 60000, infoOnly: true, suggestion: '仅信息性输出，用于排查依赖冲突' }
+  );
+
+  // === J-B5(可选): SpotBugs Bug 扫描 ===
+  if (hasPlugin('spotbugs-maven-plugin')) {
+    await runCheck(
+      'SpotBugs Bug 扫描 (mvn spotbugs:check)',
+      'mvn spotbugs:check -q 2>&1',
+      { timeout: 180000, blocking: false, warningOnly: true, suggestion: '查看 SpotBugs 报告: target/spotbugsXml.xml。重点关注 NullPointer / 资源泄漏' }
+    );
+  } else {
+    checks.push({ name: 'SpotBugs Bug 扫描', status: 'skipped', duration_ms: 0, reason: 'pom.xml 中未配置 spotbugs-maven-plugin（推荐添加）' });
+  }
+
+  // === J-B6(可选): JaCoCo 覆盖率门禁 ===
+  if (hasPlugin('jacoco-maven-plugin')) {
+    await runCheck(
+      'JaCoCo 覆盖率检查 (mvn jacoco:check)',
+      'mvn jacoco:check -q 2>&1',
+      { timeout: 120000, blocking: false, warningOnly: true, suggestion: '覆盖率不达标时，需补充测试用例。目标: 分支≥80%, 行≥80%。报告: target/site/jacoco/' }
+    );
+  } else {
+    checks.push({ name: 'JaCoCo 覆盖率检查', status: 'skipped', duration_ms: 0, reason: 'pom.xml 中未配置 jacoco-maven-plugin（强烈推荐添加）' });
+  }
+
+  // 计算结果
+  const passed = checks.filter(c => c.status === 'pass').length;
+  const failed = checks.filter(c => c.status === 'fail').length;
+  const executedChecks = checks.filter(c => c.status !== 'skipped');
+  const hasBlockingFailure = issues.some(i => i.severity === 'error');
+
+  return {
+    project_type: 'java',
+    build_tool: 'maven',
+    status: hasBlockingFailure ? 'fail' : (failed > 0 ? 'warning' : 'pass'),
+    score: `${executedChecks.length > 0 ? Math.round((passed / executedChecks.length) * 100) : 100}% (${passed}/${executedChecks.length})`,
+    issues,
+    summary: { checks, passed, failed, skipped: checks.filter(c => c.status === 'skipped').length },
+    plugin_status: {
+      checkstyle: hasPlugin('maven-checkstyle-plugin'),
+      spotbugs: hasPlugin('spotbugs-maven-plugin'),
+      jacoco: hasPlugin('jacoco-maven-plugin')
+    }
+  };
+}
+
+module.exports = run;

package/.harness/gate/checks/build-gates.js

@@ -0,0 +1,119 @@
+/**
+ * Gate Check Category B: 构建门槛 (路由器)
+ * 
+ * 自动检测项目类型并分发到对应的门禁检查模块：
+ *   - 检测到 pom.xml → 调用 build-gates-java.js (Maven/Java)
+ *   - 检测到 package.json → 调用 build-gates-frontend.js (Node/前端)
+ *   - 都没有 → 返回 warning
+ *
+ * > 来源: harness-java-fullchain change | 改造日期: 2026-05-21
+ * > 原版逻辑已提取至 build-gates-frontend.js
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+// ============================================================
+// 项目类型检测
+// ============================================================
+
+/**
+ * 检测当前工作目录的项目类型
+ * 
+ * 优先级（从高到低）：
+ *   1. pom.xml → java (Maven)
+ *   2. build.gradle / build.gradle.kts → java (Gradle) — 未来支持
+ *   3. package.json → frontend (Node/Vue3)
+ *   4. go.mod → golang — 未来支持
+ *   5. unknown
+ */
+function detectProjectType() {
+  const cwd = process.cwd();
+  
+  if (fs.existsSync(path.join(cwd, 'pom'))) {
+    // 检查是文件还是目录（Maven 多模块项目有 pom 目录）
+    const stat = fs.statSync(path.join(cwd, 'pom'));
+    if (!stat.isDirectory()) return { type: 'java', tool: 'maven' };
+  }
+  
+  if (fs.existsSync(path.join(cwd, 'pom.xml'))) {
+    return { type: 'java', tool: 'maven' };
+  }
+  
+  if (fs.existsSync(path.join(cwd, 'build.gradle')) || 
+      fs.existsSync(path.join(cwd, 'build.gradle.kts'))) {
+    return { type: 'java', tool: 'gradle' };
+  }
+  
+  if (fs.existsSync(path.join(cwd, 'package.json'))) {
+    // 进一步区分纯后端 Node.js 和前端项目
+    try {
+      const pkg = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf-8'));
+      const hasDeps = Object.keys(pkg.dependencies || {}).length > 0;
+      const hasDevDeps = Object.keys(pkg.devDependencies || {}).length > 0;
+      
+      // 检测是否为前端框架项目
+      const frontendDeps = ['vue', 'react', 'next', 'vite', 'webpack', '@angular/core'];
+      const hasFrontendDeps = [...Object.keys(pkg.dependencies || {}), ...Object.keys(pkg.devDependencies || {})]
+        .some(d => frontendDeps.some(fd => d === fd || d.startsWith(fd + '/') || d.startsWith('@' + fd)));
+      
+      if (hasFrontendDeps || hasDevDeps) {
+        return { type: 'frontend', tool: 'node' };
+      }
+      return { type: 'backend-node', tool: 'node' };
+    } catch {
+      return { type: 'frontend', tool: 'node' }; // 默认按前端处理
+    }
+  }
+
+  return { type: 'unknown', tool: null };
+}
+
+// ============================================================
+// 主执行函数
+// ============================================================
+
+async function run(options = {}) {
+  const detection = detectProjectType();
+  const checksDir = __dirname;
+
+  console.log(`  📋 项目类型检测结果: ${detection.type}${detection.tool ? ` (${detection.tool})` : ''}`);
+
+  let result;
+
+  switch (detection.type) {
+    case 'java': {
+      const javaModule = require(path.join(checksDir, 'build-gates-java'));
+      result = await (typeof javaModule === 'function' ? javaModule(options) : javaModule.run(options));
+      break;
+    }
+    
+    case 'frontend':
+    case 'backend-node': {
+      const frontendModule = require(path.join(checksDir, 'build-gates-frontend'));
+      result = await (typeof frontendModule === 'function' ? frontendModule(options) : frontendModule.run(options));
+      break;
+    }
+
+    default:
+      result = {
+        status: 'warning',
+        score: 'N/A',
+        issues: [{
+          code: 'B-UNKNOWN',
+          severity: 'warning',
+          message: `无法识别的项目类型。未找到 pom.xml 或 package.json`,
+          suggestion: '请确保在正确的项目根目录中运行，或手动指定 --check 参数'
+        }],
+        summary: { checks: [], passed: 0, failed: 0 },
+        project_type: 'unknown'
+      };
+  }
+
+  // 注入检测信息
+  result.detection = detection;
+
+  return result;
+}
+
+module.exports = run;

package/.harness/gate/checks/engineering-consistency.js

@@ -0,0 +1,138 @@
+/**
+ * Gate Check Category E: 工程一致性 (engineering-consistency)
+ * 
+ * 检查项：
+ * - CHANGELOG 更新检查
+ * - dev-map 一致性检查
+ * - 配置同步检查
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+async function run(options = {}) {
+  const issues = [];
+  let checksPassed = 0;
+  let totalChecks = 0;
+
+  // E1: CHANGELOG 更新检查
+  totalChecks++;
+  try {
+    const changelogPath = path.join(process.cwd(), 'CHANGELOG.md');
+    if (fs.existsSync(changelogPath)) {
+      const changelog = fs.readFileSync(changelogPath, 'utf-8');
+      const hasUnreleased = changelog.toLowerCase().includes('unreleased') || 
+                             changelog.includes('[Unreleased]');
+      
+      // 检查 Unreleased 区域是否有内容（排除纯标题行）
+      if (hasUnreleased) {
+        const unreleasedMatch = changelog.match(/##\s*\[Unreleased\][\s\S]*?(?=##\s*\[|$)/i);
+        if (unreleasedMatch && unreleasedMatch[0].split('\n').length > 5) {
+          checksPassed++; // 有未发布的内容，说明有更新
+        } else {
+          issues.push({
+            code: 'E1',
+            severity: 'warning',
+            message: 'CHANGELOG.md 存在但 Unreleased 区域可能缺少本次变更条目',
+            suggestion: '确保用户可见的功能变更已记录到 CHANGELOG [Unreleased] 区域'
+          });
+        }
+      } else {
+        issues.push({
+          code: 'E1',
+          severity: 'warning',
+          message: 'CHANGELOG.md 缺少 [Unreleased] 区域或格式不规范',
+        });
+      }
+    } else {
+      // 没有 CHANGELOG 文件，不算错但建议创建
+      issues.push({
+        code: 'E1',
+        severity: 'info',
+        message: '项目未找到 CHANGELOG.md 文件（建议创建）'
+      });
+    }
+  } catch (e) {
+    issues.push({ code: 'E1', severity: 'warning', message: `CHANGELOG 检查异常: ${e.message}` });
+  }
+
+  // E2: dev-map 一致性检查
+  totalChecks++;
+  try {
+    const devMapDir = path.join(process.cwd(), '.harness', 'dev-map');
+    if (fs.existsSync(devMapDir)) {
+      const overviewPath = path.join(devMapDir, 'overview.md');
+      if (fs.existsSync(overviewPath)) {
+        checksPassed++;
+      } else {
+        issues.push({
+          code: 'E2',
+          severity: 'warning',
+          message: 'dev-map 目录存在但缺少 overview.md 总览文件'
+        });
+      }
+    }
+  } catch (e) {
+    issues.push({ code: 'E2', severity: 'info', message: `dev-map 检查跳过: ${e.message}` });
+  }
+
+  // E3: package.json 版本一致性
+  totalChecks++;
+  try {
+    const pkgPath = path.join(process.cwd(), 'package.json');
+    if (fs.existsSync(pkgPath)) {
+      const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+      
+      if (!pkg.version) {
+        issues.push({
+          code: 'E3',
+          severity: 'warning',
+          message: 'package.json 缺少 version 字段'
+        });
+      } else if (pkg.version === '0.0.1' || pkg.version === '1.0.0') {
+        // 只是提醒
+      }
+      
+      checksPassed++;
+    }
+  } catch (e) {
+    issues.push({ code: 'E3', severity: 'warning', message: '无法读取 package.json' });
+  }
+
+  // E4: .gitignore 包含必要排除项
+  totalChecks++;
+  try {
+    const gitignorePath = path.join(process.cwd(), '.gitignore');
+    if (fs.existsSync(gitignorePath)) {
+      const gitignore = fs.readFileSync(gitignorePath, 'utf-8');
+      const requiredEntries = ['node_modules', '.env', 'dist', '.DS_Store'];
+      const missing = requiredEntries.filter(e => !gitignore.includes(e));
+      
+      if (missing.length === 0) {
+        checksPassed++;
+      } else {
+        issues.push({
+          code: 'E4',
+          severity: 'info',
+          message: `.gitignore 可能缺少常见排除项: ${missing.join(', ')}`
+        });
+      }
+    }
+  } catch (e) {
+    // 可选检查
+  }
+
+  // 计算结果
+  const score = totalChecks > 0 ? Math.round((checksPassed / totalChecks) * 100) : 100;
+  // E 类通常不会导致门禁 FAIL（除非是严重不一致）
+  const status = 'pass'; // E 类作为 warning 级别
+
+  return {
+    status: issues.some(i => i.severity === 'error') ? 'fail' : status,
+    score: `${score}% (${checksPassed}/${totalChecks})`,
+    issues,
+    summary: { passed: checksPassed, total: totalChecks }
+  };
+}
+
+module.exports = run;

package/.harness/gate/checks/security-quality.js

@@ -0,0 +1,129 @@
+/**
+ * Gate Check Category D: 安全与质量 (security-quality)
+ * 
+ * 检查项：
+ * - CVE 依赖审计（npm audit）
+ * - Code Review Approval 状态检查（通过 Git 信息判断）
+ */
+
+const { execSync } = require('child_process');
+
+async function run(options = {}) {
+  const issues = [];
+  let securityScore = 100;
+
+  // D1: npm audit 安全审计
+  try {
+    const auditOutput = execSync('npm audit --json 2>&1', {
+      encoding: 'utf-8',
+      timeout: 60000,
+      cwd: process.cwd()
+    });
+
+    let auditData;
+    try {
+      auditData = JSON.parse(auditOutput);
+    } catch {
+      // npm audit 可能输出非 JSON（如无问题时的警告）
+      auditData = {};
+    }
+
+    const vulnerabilities = auditData.vulnerabilities || {};
+    const summary = auditData.metadata?.vulnerabilities || {};
+
+    const criticalCount = summary.critical || Object.values(vulnerabilities).filter(v => v.severity === 'critical').length;
+    const highCount = summary.high || Object.values(vulnerabilities).filter(v => v.severity === 'high').length;
+    const moderateCount = summary.moderate || Object.values(vulnerabilities).filter(v => v.severity === 'moderate').length;
+
+    if (criticalCount > 0) {
+      securityScore -= criticalCount * 30;
+      issues.push({
+        code: 'D1',
+        severity: 'error',
+        message: `🔴 发现 ${criticalCount} 个 CRITICAL 安全漏洞！必须立即修复！`,
+        suggestion: '运行 `npm audit fix` 或手动升级受影响的包。CRITICAL 级别漏洞阻断合并。'
+      });
+    }
+
+    if (highCount > 0) {
+      securityScore -= highCount * 15;
+      issues.push({
+        code: 'D1-h',
+        severity: 'error',
+        message: `发现 ${highCount} 个 HIGH 安全漏洞`,
+        suggestion: 'HIGH 级别漏洞必须在合入前修复或提供明确的缓解方案'
+      });
+    }
+
+    if (moderateCount > 5) {
+      securityScore -= moderateCount * 2;
+      issues.push({
+        code: 'D1-m',
+        severity: 'warning',
+        message: `发现 ${moderateCount} 个 MODERATE 安全建议`
+      });
+    }
+
+    if (criticalCount === 0 && highCount === 0 && moderateCount === 0) {
+      // 无漏洞
+    }
+
+  } catch (e) {
+    // npm audit 在某些情况下会以非零退出码退出但仍然输出有效 JSON
+    // 这不是真正的错误，忽略
+    const output = e.stdout?.toString() || '';
+    if (output.includes('"vulnerabilities"')) {
+      // 已在上面处理了
+    } else {
+      issues.push({
+        code: 'D1',
+        severity: 'warning',
+        message: `npm audit 执行异常`,
+        details: e.message.slice(0, 200)
+      });
+    }
+  }
+
+  // D2: 检查 package.json 中是否有已知的不安全依赖
+  try {
+    const pkg = require(path.join(process.cwd(), 'package.json'));
+    const riskyDeps = [];
+    const knownRisky = ['lodash/<4', 'request', 'node-sass', 'uglify-js<3'];
+    
+    // 简单版本检查（实际应使用更精确的方法）
+    for (const [dep, version] of Object.entries({...pkg.dependencies, ...pkg.devDependencies || {}})) {
+      for (const risky of knownRisky) {
+        if (dep.startsWith(risky.split('/')[0]) || dep === risky.split('<')[0]) {
+          riskyDeps.push(`${dep}@${version}`);
+        }
+      }
+    }
+    
+    if (riskyDeps.length > 0) {
+      issues.push({
+        code: 'D2',
+        severity: 'warning',
+        message: `发现可能含有已知风险的依赖: ${riskyDeps.join(', ')}`,
+        suggestion: '评估替换为更安全的替代品'
+      });
+    }
+  } catch (e) {
+    // 可选检查
+  }
+
+  // 计算最终状态
+  const finalScore = Math.max(0, securityScore);
+  const hasCritical = issues.some(i => i.code === 'D1' && i.severity === 'error');
+  const hasHigh = issues.some(i => i.code === 'D1-h' && i.severity === 'error');
+  const status = hasCritical || hasHigh ? 'fail' : (issues.length > 0 ? 'warning' : 'pass');
+
+  return {
+    status,
+    score: `${finalScore}/100`,
+    issues,
+    summary: { security_score: finalScore, vulnerability_counts: {} }
+  };
+}
+
+const path = require('path');
+module.exports = run;