kld-sdd 2.7.3 → 2.7.8-2

package/templates/git-hooks/pre-push

@@ -4,36 +4,49 @@
 # 删除某行 = 禁用该插件
 # marker: KLD SDD quality gate
 
-# 从 hook 所在目录推算 git 根目录
-hook_dir="$(cd "$(dirname "$0")" && pwd)"
-git_dir="$(dirname "$hook_dir")"
-git_root="$(dirname "$git_dir")"
-
+# Git supplies the working tree context; this also supports worktrees and core.hooksPath.
+git_root=$(git rev-parse --show-toplevel 2>/dev/null) || {
+  echo "[SDD] 无法定位当前 Git 工作区"
+  exit 1
+}
 hooks_dir=""
-
-# 方法1: git config sdd.specPath（多仓布局：spec 是独立 clone）
-spec_path=$(git config --local sdd.specPath 2>/dev/null)
-if [ -n "$spec_path" ] && [ -d "$spec_path/skywalk-sdd/git-hooks" ]; then
-  hooks_dir="$spec_path/skywalk-sdd/git-hooks"
+# 统一反斜杠为正斜杠，保证 Windows 盘符路径（P:\a\b → P:/a/b）能被 case 判定为绝对路径
+normalize_path() {
+  printf '%s' "$1" | tr '\\' '/'
+}
+# 绝对路径（/ 开头或盘符 X: 开头）直接使用；相对路径基于 git 根拼接
+resolve_spec_dir() {
+  raw=$(normalize_path "$1")
+  case "$raw" in
+    /*|[A-Za-z]:*) printf '%s' "$raw" ;;
+    *) printf '%s' "$git_root/$raw" ;;
+  esac
+}
+spec_path=$(git -C "$git_root" config --local sdd.specPath 2>/dev/null)
+if [ -n "$spec_path" ]; then
+  hooks_dir="$(resolve_spec_dir "$spec_path")/skywalk-sdd/git-hooks"
+elif [ -f "$git_root/.sdd-spec-root" ]; then
+  spec_rel=$(head -1 "$git_root/.sdd-spec-root" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
+  hooks_dir="$(resolve_spec_dir "$spec_rel")/skywalk-sdd/git-hooks"
 fi
-
-# 方法2: .sdd-spec-root（单仓 mono 布局：skywalk-sdd 在 spec 包裹包子目录内）
-if [ -z "$hooks_dir" ] && [ -f "$git_root/.sdd-spec-root" ]; then
-  spec_rel=$(cat "$git_root/.sdd-spec-root" | head -1 | tr -d '[:space:]')
-  if [ -n "$spec_rel" ] && [ -d "$git_root/$spec_rel/skywalk-sdd/git-hooks" ]; then
-    hooks_dir="$git_root/$spec_rel/skywalk-sdd/git-hooks"
-  fi
+if [ -n "$hooks_dir" ] && [ ! -d "$hooks_dir" ]; then
+  echo "[SDD] 已配置的 Spec 路径失效：$hooks_dir"
+  echo "[SDD] 请恢复 Spec 仓，或修正 sdd.specPath / .sdd-spec-root 后重试"
+  exit 1
 fi
 
 # 方法3: 从 git 根向上搜索 skywalk-sdd/git-hooks（spec 仓本身或父级）
 if [ -z "$hooks_dir" ]; then
   search_dir="$git_root"
-  while [ "$search_dir" != "/" ] && [ "$search_dir" != "" ]; do
+  while [ -n "$search_dir" ] && [ "$search_dir" != "/" ]; do
     if [ -d "$search_dir/skywalk-sdd/git-hooks" ]; then
       hooks_dir="$search_dir/skywalk-sdd/git-hooks"
       break
     fi
-    search_dir="$(dirname "$search_dir")"
+    # Windows 盘符根（P:/）dirname 后不变，需显式收敛，避免死循环
+    parent_dir="$(dirname "$search_dir")"
+    [ "$parent_dir" = "$search_dir" ] && break
+    search_dir="$parent_dir"
   done
 fi
 
@@ -61,8 +74,9 @@ else
   # 读取 [pre-push] 段落的配置
   in_section=0
   SCRIPTS=""
+  CR=$(printf '\r')
   while IFS= read -r line; do
-    line=$(printf '%s' "$line" | tr -d '\r')
+    line=${line%"$CR"}
     case "$line" in
       "[pre-push]") in_section=1 ;;
       "["*) in_section=0 ;;
@@ -81,7 +95,8 @@ failed=0
 for script_name in $SCRIPTS; do
   script="$hooks_dir/$script_name"
   if [ ! -f "$script" ]; then
-    echo "[SDD] ⚠️  插件不存在：$script_name"
+    echo "[SDD] ❌ 已配置的插件不存在：$script_name"
+    failed=$((failed + 1))
     continue
   fi
   executed=$((executed + 1))
@@ -89,11 +104,11 @@ for script_name in $SCRIPTS; do
   node "$script" --project="$git_root" "$@" || failed=$((failed + 1))
 done
 
-if [ "$executed" -eq 0 ]; then
-  echo "[SDD] 无 pre-push 插件，跳过"
-elif [ "$failed" -gt 0 ]; then
+if [ "$failed" -gt 0 ]; then
   echo "[SDD] ❌ 共执行 $executed 个 pre-push 插件，$failed 个失败"
   exit 1
+elif [ "$executed" -eq 0 ]; then
+  echo "[SDD] 配置已禁用 pre-push 插件"
 else
   echo "[SDD] ✅ 共执行 $executed 个 pre-push 插件，全部通过"
 fi

package/templates/git-hooks/pre-push-consistency-check.cjs

@@ -2,435 +2,87 @@
 /**
  * pre-push-consistency-check.cjs
  *
- * Pre-push 轻量门禁：仅检查报告是否存在、是否过期。
- * 完整的置信度校验由 pre-commit 完成，push 阶段不再重复。
+ * Pre-push 轻量门禁：仅检查待推送范围涉及报告的存在性、是否过期。
+ * - diff 驱动：仅检查待推送文件与报告 coveredFiles 有交集的 change，无关 change 跳过
+ * - 完整的置信度校验由 pre-commit 完成，push 阶段不再重复。
+ * - 过期判断读取 HEAD 已提交内容（而非工作区），避免工作区未提交修改造成误判。
+ *
+ * 待推送范围采集（逐级降级）：
+ *   1. git diff @{push}..HEAD（本地领先远程的提交）
+ *   2. git diff origin/HEAD..HEAD
+ *   3. 远程引用不存在（新分支/新仓库首次推送）：git diff <空树>..HEAD，
+ *      语义 = 首推时 HEAD 全部文件都是新增。空树 SHA 是 git 内置常量，
+ *      不依赖任何远程引用，避免「首推因无远程引用被拦 → 引用永远建立不起来」的死锁
+ *   4. 连空树 diff 都失败（如空仓无 HEAD）：返回 ok=false，由 core 拦截推送而非静默放行
  *
  * 通过环境变量控制：
  * - SDD_SKIP_CONSISTENCY_CHECK=1 → 跳过校验
  * - SDD_WARN_ONLY=1 → 仅告警不拦截
  * - 注意：两个环境变量互斥，只能启用一个
+ *
+ * 共享逻辑见同目录 consistency-check-core.cjs。
  */
 'use strict';
 
-const fs = require('fs');
-const path = require('path');
+const core = require('./consistency-check-core.cjs');
+const { gitDiffNameStatus } = core;
 const { execFileSync } = require('child_process');
 
-const readArg = (name) => {
-  const prefix = `--${name}=`;
-  const found = process.argv.find(a => a.startsWith(prefix));
-  return found ? found.slice(prefix.length) : '';
-};
-
-// --- Spec 根路径解析 ---
-
-function resolveSpecRoot() {
-  // .cjs 位于 <spec-root>/skywalk-sdd/git-hooks/，直接用 __dirname 推算
-  return path.resolve(__dirname, '..', '..');
-}
-
-function discoverActiveChanges(specRoot) {
-  const changesDir = path.join(specRoot, 'openspec', 'changes');
-  if (!fs.existsSync(changesDir)) return [];
-
-  return fs.readdirSync(changesDir).filter(name => {
-    const p = path.join(changesDir, name);
-    return fs.statSync(p).isDirectory() && !name.startsWith('.') && name !== 'archive';
-  });
-}
-
-// --- Push 范围收敛 ---
+// git 内置空树对象 SHA（SHA-1 仓库恒定不变）
+const EMPTY_TREE_SHA = '4b825dc642cb6eb9a060e54bf8d69288fbee4904';
 
 /**
- * 读取 pre-push 引用范围。
- * 优先从 shell hook 通过环境变量 SDD_PRE_PUSH_REFS 传入（shell hook 已消费 stdin），
- * 降级时尝试直接读 stdin。
+ * 单仓待推送范围采集：本地领先远程的提交所涉及的文件。
+ * files=修改/新增（排除删除）；deleted=删除文件。
+ * @returns {{files: string[], deleted: string[], ok: boolean}}
  */
-function readPushRefLines() {
-  const envRefs = process.env.SDD_PRE_PUSH_REFS;
-  if (envRefs) {
-    // shell hook 用 \n 字面量拼接，也可能含真实换行符
-    return envRefs.split(/\\n|\n/).filter(Boolean);
+function gitPushRangeDiff(repoRoot) {
+  const ranges = ['@{push}..HEAD', 'origin/HEAD..HEAD'];
+  for (const range of ranges) {
+    const r = gitDiffNameStatus(repoRoot, ['diff', range]);
+    if (r.ok) return r;
   }
-
-  try {
-    if (process.stdin.isTTY) return [];
-    const buffer = fs.readFileSync(0, 'utf8'); // fd 0 = stdin
-    return buffer.split(/\r?\n/).filter(Boolean);
-  } catch {
-    return [];
+  // 首推降级：远程引用不存在（@{push}/origin/HEAD 均无法解析）时，
+  // 用 git 内置空树 SHA 做 diff —— 语义为「首推 = HEAD 全部文件都是新增」。
+  // 空树对象不依赖任何远程引用，打破「首推被拦 → 远程引用永远建立不起来」的死锁。
+  const emptyTree = gitEmptyTreeSha(repoRoot);
+  if (emptyTree) {
+    const r = gitDiffNameStatus(repoRoot, ['diff', `${emptyTree}..HEAD`]);
+    if (r.ok) return r;
   }
+  // 连空树 diff 都失败（如空仓无 HEAD）：返回失败，由 core 拦截而非静默放行
+  return { files: [], deleted: [], ok: false };
 }
 
 /**
- * 从 pre-push stdin 行解析 commit 范围，获取本次 push 实际变更的文件列表
+ * 读取 git 内置空树 SHA（4b825dc642cb6eb9a060e54bf8d69288fbee4904）。
+ * 优先用 git mktree 动态计算（兼容 SHA-256 仓库），失败时回退内置常量。
+ * @param {string} repoRoot
+ * @returns {string|null}
  */
-function getPushRangeFiles(projectRoot) {
-  const lines = readPushRefLines();
-  if (lines.length === 0) return null;
-
-  const files = new Set();
-  for (const line of lines) {
-    const parts = line.split(/\s+/);
-    if (parts.length < 4) continue;
-    const localSha = parts[1];
-    const remoteSha = parts[3];
-
-    // 删除分支：localSha 为全 0
-    if (localSha === '0000000000000000000000000000000000000000') continue;
-
-    try {
-      let diffFiles;
-      if (remoteSha === '0000000000000000000000000000000000000000') {
-        // 新建分支：用 git show 获取该 commit 引入的文件
-        diffFiles = execFileSync('git', ['show', '--name-only', '--pretty=format:', localSha], {
-          cwd: projectRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'],
-        }).split(/\r?\n/).filter(Boolean);
-      } else {
-        // 已有分支：用 git diff 获取范围变更
-        diffFiles = execFileSync('git', ['diff', `${remoteSha}..${localSha}`, '--name-only'], {
-          cwd: projectRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'],
-        }).split(/\r?\n/).filter(Boolean);
-      }
-      for (const f of diffFiles) files.add(f.replace(/\\/g, '/'));
-    } catch {
-      // 单个 ref 失败不阻断，继续处理其他 ref
-    }
-  }
-
-  return files.size > 0 ? Array.from(files) : null;
-}
-
-function normalizePath(filePath) {
-  return filePath.replace(/\\/g, '/');
-}
-
-function getChangeNameFromPath(filePath) {
-  const normalized = normalizePath(filePath);
-  const match = normalized.match(/^openspec\/changes\/([^/]+)\//);
-  return match ? match[1] : '';
-}
-
-/**
- * 从 push 的变更文件列表中提取涉及的 change name
- */
-function discoverChangesFromPushFiles(projectRoot, specRoot) {
-  const pushFiles = getPushRangeFiles(projectRoot);
-  if (!pushFiles) return null; // 降级信号
-
-  const changes = new Set();
-  for (const file of pushFiles) {
-    const changeName = getChangeNameFromPath(file);
-    if (changeName) changes.add(changeName);
-  }
-
-  if (changes.size === 0) {
-    console.log('[SDD push-consistency-check] 本次 push 不涉及 openspec 变更，跳过');
-    process.exit(0);
-  }
-
-  // 过滤掉已归档的 change
-  const activeChanges = new Set(discoverActiveChanges(specRoot));
-  return Array.from(changes).filter(cn => activeChanges.has(cn));
-}
-
-// --- 报告查找与解析 ---
-
-function findReport(specRoot, changeName, type) {
-  const names = type === 'json'
-    ? ['consistency-report-result.json', 'consistency-report-self-review-result.json']
-    : ['consistency-report.md', 'consistency-report-self-review.md'];
-
-  const found = [];
-  for (const n of names) {
-    const p = path.join(specRoot, 'openspec', 'changes', changeName, n);
-    if (fs.existsSync(p)) found.push(p);
-  }
-
-  // 如果两种模式的报告都存在，返回错误标记
-  if (found.length > 1) {
-    return { error: 'duplicate', paths: found };
-  }
-
-  return found.length === 1 ? found[0] : null;
-}
-
-function parseReport(reportPath) {
-  try {
-    const data = JSON.parse(fs.readFileSync(reportPath, 'utf8'));
-    return {
-      confidence: (data.confidence || '').toLowerCase(),
-      reviewMode: data.reviewMode || 'independent-review',
-      humanConfirmed: data.humanConfirmed === true,
-      reportPath,
-    };
-  } catch (err) {
-    return { confidence: '', reviewMode: '', humanConfirmed: false, reportPath, parseError: err.message };
-  }
-}
-
-// --- 变更文件采集（基于配置文件精准定位） ---
-
-/**
- * 简易 YAML 解析器：仅提取 code_repos 列表
- */
-function parseCodeRepos(yamlPath) {
-  try {
-    const content = fs.readFileSync(yamlPath, 'utf8');
-    const match = content.match(/code_repos:\s*\n((?:\s+-\s+\S+\n?)+)/);
-    if (!match) return null;
-    return match[1]
-      .split('\n')
-      .map(line => line.replace(/^\s+-\s+/, '').trim())
-      .filter(Boolean);
-  } catch {
-    return null;
-  }
-}
-
-function gitDiff(repoRoot) {
+function gitEmptyTreeSha(repoRoot) {
   try {
-    return execFileSync('git', ['diff', 'HEAD', '--name-only'], {
-      cwd: repoRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'],
-    }).split(/\r?\n/).filter(Boolean);
+    const sha = execFileSync('git', ['mktree'], {
+      cwd: repoRoot, encoding: 'utf8', input: '', stdio: ['pipe', 'pipe', 'ignore'],
+    }).trim();
+    if (/^[0-9a-f]{40,64}$/.test(sha)) return sha;
   } catch {
-    return [];
-  }
-}
-
-function getModifiedFiles(projectRoot) {
-  // 工作区模式：读 .sdd-workspace.yaml 的 code_repos
-  const wsYaml = path.join(projectRoot, '.sdd-workspace.yaml');
-  if (fs.existsSync(wsYaml)) {
-    const repos = parseCodeRepos(wsYaml);
-    if (repos && repos.length > 0) {
-      const files = [];
-      for (const repo of repos) {
-        const repoRoot = path.join(projectRoot, repo);
-        for (const f of gitDiff(repoRoot)) {
-          files.push(path.join(repo, f).replace(/\\/g, '/'));
-        }
-      }
-      return [...new Set(files)];
-    }
-  }
-
-  // 单仓模式 / 兜底：直接对 projectRoot 做 diff
-  return gitDiff(projectRoot);
-}
-
-/**
- * 获取报告生成时间：优先用 JSON 中的 generatedAt，降级用文件 mtime
- */
-function getReportTime(jsonPath) {
-  try {
-    const data = JSON.parse(fs.readFileSync(jsonPath, 'utf8'));
-    if (data.generatedAt) {
-      const t = new Date(data.generatedAt).getTime();
-      if (!isNaN(t)) return t;
-    }
-  } catch {}
-  // 降级：用文件 mtime
-  return fs.statSync(jsonPath).mtimeMs;
-}
-
-function isReportStale(specRoot, changeName, modifiedFiles, projectRoot) {
-  const jsonPath = findReport(specRoot, changeName, 'json');
-  if (!jsonPath) return false;
-
-  const reportTime = getReportTime(jsonPath);
-
-  // 排除报告文件本身
-  const reportFiles = [
-    'consistency-report.md',
-    'consistency-report-self-review.md',
-    'consistency-report-result.json',
-    'consistency-report-self-review-result.json',
-  ];
-
-  return modifiedFiles.some(file => {
-    if (reportFiles.includes(path.basename(file))) return false;
-    const fp = path.join(projectRoot, file);
-    return fs.existsSync(fp) && fs.statSync(fp).mtimeMs > reportTime;
-  });
-}
-
-// --- 提示信息 ---
-
-function generateInstructions(missing, stale, needsConfirmation, warnOnly) {
-  const lines = ['', '=========================================='];
-  const needsRegenerate = [...new Set([...missing, ...stale])];
-
-  if (warnOnly) {
-    lines.push('[SDD push-consistency-check] ⚠️  仅告警模式（SDD_WARN_ONLY=1），以下问题不会阻止推送：');
-  } else {
-    lines.push('[SDD push-consistency-check] 以下变更存在问题，拒绝推送：');
-  }
-
-  lines.push('');
-
-  if (missing.length) {
-    lines.push('  缺少一致性报告：');
-    missing.forEach(c => lines.push(`    - ${c}`));
-  }
-
-  if (stale.length) {
-    lines.push('  报告已过期（代码在报告生成后被修改）：');
-    stale.forEach(c => lines.push(`    - ${c}`));
-  }
-
-  if (needsConfirmation.length) {
-    lines.push('  自审模式需人工确认：');
-    needsConfirmation.forEach(c => lines.push(`    - ${c}`));
-  }
-
-  // 只有需要重新生成报告时才显示 skill 执行建议
-  if (needsRegenerate.length > 0) {
-    lines.push('');
-    lines.push(warnOnly
-      ? '建议执行 opsx-consistency-check skill 更新报告：'
-      : '请执行 opsx-consistency-check skill 更新报告后再推送：');
-    lines.push('');
-
-    if (needsRegenerate.length === 1) {
-      lines.push(`  skill: opsx-consistency-check ${needsRegenerate[0]}`);
-    } else {
-      lines.push('  skill（逐个执行）：');
-      needsRegenerate.forEach(c => lines.push(`    opsx-consistency-check ${c}`));
-    }
-
-    lines.push(
-      '',
-      '  💡 建议：新开对话窗口执行校验，以获得独立、客观的审核结果',
-    );
-  }
-
-  // 自审模式人工确认指引
-  if (needsConfirmation.length > 0) {
-    lines.push('');
-    lines.push('  人工确认步骤：');
-    lines.push('  1. 打开 consistency-report-self-review.md，找到「人工确认（自审模式）」章节');
-    lines.push('  2. 逐条核对断言，在「人工确认」列填写 ✅ 已确认 或 ❌ 有误');
-    lines.push('  3. 确认无误后，编辑 consistency-report-self-review-result.json，将 humanConfirmed 从 false 改为 true');
-    lines.push('');
-    lines.push('  报告路径: openspec/changes/<change-name>/consistency-report-self-review.md');
-    lines.push('  JSON 路径: openspec/changes/<change-name>/consistency-report-self-review-result.json');
-  }
-
-  // 如果没有需要重新生成的报告，但有其他问题，显示默认报告路径
-  if (needsRegenerate.length > 0 && needsConfirmation.length === 0) {
-    lines.push(
-      '',
-      '  报告路径: openspec/changes/<change-name>/consistency-report.md',
-      '  JSON 路径: openspec/changes/<change-name>/consistency-report-result.json',
-    );
+    // 降级到内置常量
   }
-
-  lines.push('==========================================', '');
-
-  return lines.join('\n');
+  return /^[0-9a-f]{40}$/.test(EMPTY_TREE_SHA) ? EMPTY_TREE_SHA : null;
 }
 
-// --- 主流程 ---
-
-function main() {
-  const projectRoot = path.resolve(readArg('project') || process.env.SDD_PROJECT || process.cwd());
-
-  const skip = process.env.SDD_SKIP_CONSISTENCY_CHECK === '1';
-  const warnOnly = process.env.SDD_WARN_ONLY === '1';
-
-  // 互斥检查
-  if (skip && warnOnly) {
-    console.error('[SDD push-consistency-check] 错误：SDD_SKIP_CONSISTENCY_CHECK 与 SDD_WARN_ONLY 互斥，只能启用一个');
-    process.exit(1);
-  }
-
-  if (skip) {
-    console.log('[SDD push-consistency-check] 跳过校验');
-    process.exit(0);
-  }
-
-  if (warnOnly) console.log('[SDD push-consistency-check] 仅告警模式');
-
-  const specRoot = resolveSpecRoot();
-
-  // 优先尝试按本次 push 范围收敛变更
-  let changes = discoverChangesFromPushFiles(projectRoot, specRoot);
-  let modifiedFiles = null;
-
-  if (changes === null) {
-    // 降级：stdin 读取失败，回退到现有行为
-    console.log('[SDD push-consistency-check] 无法读取 push 范围，降级为全量检查');
-    changes = discoverActiveChanges(specRoot);
-    modifiedFiles = getModifiedFiles(projectRoot);
-  } else if (changes.length === 0) {
-    console.log('[SDD push-consistency-check] 无相关活跃变更，跳过');
-    process.exit(0);
-  } else {
-    // 收敛成功：用 push 范围文件做过期判定
-    modifiedFiles = getPushRangeFiles(projectRoot) || [];
-  }
-
-  if (!changes.length) {
-    console.log('[SDD push-consistency-check] 无活跃变更，跳过');
-    process.exit(0);
-  }
-
-  const missing = [];
-  const stale = [];
-  const needsConfirmation = [];
-
-  for (const cn of changes) {
-    const rp = findReport(specRoot, cn, 'json');
-    if (!rp) {
-      missing.push(cn);
-      continue;
-    }
-
-    // 检查是否存在两种模式的报告
-    if (rp.error === 'duplicate') {
-      console.warn(`[SDD push-consistency-check] ⚠️  ${cn} 存在两种模式的报告，请删除其中一个：`);
-      rp.paths.forEach(p => console.warn(`    - ${p}`));
-      missing.push(cn);
-      continue;
-    }
-
-    const report = parseReport(rp);
-    if (report.parseError) {
-      console.warn(`[SDD push-consistency-check] ⚠️  ${cn}: 报告解析失败`);
-      missing.push(cn);
-      continue;
-    }
-
-    if (isReportStale(specRoot, cn, modifiedFiles, projectRoot)) {
-      console.log(`[SDD push-consistency-check] ⚠️  ${cn}: 报告已过期`);
-      stale.push(cn);
-      continue;
-    }
-
-    // 自审模式需要人工确认
-    if (report.reviewMode === 'self-review' && !report.humanConfirmed) {
-      console.log(`[SDD push-consistency-check] ⚠️  ${cn}: 自审模式需人工确认`);
-      needsConfirmation.push(cn);
-      continue;
-    }
-
-    console.log(`[SDD push-consistency-check] ✅ ${cn}: 报告有效`);
-  }
-
-  if (missing.length || stale.length || needsConfirmation.length) {
-    console.log(generateInstructions(missing, stale, needsConfirmation, warnOnly));
-
-    if (warnOnly) {
-      console.log('[SDD push-consistency-check] 仅告警模式，放行推送');
-      process.exit(0);
-    }
-
-    process.exit(1);
-  }
-
-  console.log('\n[SDD push-consistency-check] ✅ 所有变更均已通过一致性校验，放行推送');
-  process.exit(0);
+// strict 模式仅 pre-commit 支持：显式提示而非静默忽略
+const _mode = core.loadConsistencyMode();
+if (process.env.SDD_STRICT_CONSISTENCY === '1' || _mode.strict) {
+  console.log('[SDD push-consistency-check] ℹ️  SDD_STRICT_CONSISTENCY 仅在 pre-commit 阶段生效，push 阶段忽略');
 }
 
-main();
+core.runConsistencyCheck({
+  label: '[SDD push-consistency-check]',
+  actionNoun: '推送',
+  diffFn: gitPushRangeDiff,
+  checkConfidence: false, // 置信度校验由 pre-commit 完成，push 阶段不重复
+  includeUntracked: false, // untracked 文件不在任何 commit 中，不会被推送
+  staleFromHead: true, // 过期判断读 HEAD 已提交内容，避免工作区未提交修改误判
+});

package/templates/hooks/claude/hooks/sdd-post-tool.cjs

@@ -171,8 +171,8 @@ function recordTelemetry(projectRoot, activeStage, record, result, exitCodeKnown
         skipped: counts.skipped,
       } : {}),
       duration_ms: Number.isFinite(toolResponse.duration_ms) ? toolResponse.duration_ms : 0,
-      failure_type: result === 'failure' ? (exitCode == null ? 'infrastructure' : 'assertion') : 'none',
-      expected_failure: tddPhase === 'red' && result === 'failure' && exitCode != null,
+      failure_type: result === 'failure' ? (exitCode != null && /ERR_ASSERTION|AssertionError|AssertionFailedError/.test(output) ? 'assertion' : 'infrastructure') : 'none',
+      expected_failure: tddPhase === 'red' && result === 'failure' && exitCode != null && /ERR_ASSERTION|AssertionError|AssertionFailedError/.test(output),
     };
     strictTestEvent = exitCode != null && Boolean(activeStage.task_id);
     runId = stableRunId(input || {}, activeStage, details.test_results.command);

package/templates/hooks/codebuddy/hooks/sdd-post-tool.cjs

@@ -160,8 +160,8 @@ function recordTelemetry(projectRoot, activeStage, record, result, exitCodeKnown
         skipped: counts.skipped,
       } : {}),
       duration_ms: Number.isFinite(toolResponse.duration_ms) ? toolResponse.duration_ms : 0,
-      failure_type: result === 'failure' ? (exitCode == null ? 'infrastructure' : 'assertion') : 'none',
-      expected_failure: tddPhase === 'red' && result === 'failure' && exitCode != null,
+      failure_type: result === 'failure' ? (exitCode != null && /ERR_ASSERTION|AssertionError|AssertionFailedError/.test(output) ? 'assertion' : 'infrastructure') : 'none',
+      expected_failure: tddPhase === 'red' && result === 'failure' && exitCode != null && /ERR_ASSERTION|AssertionError|AssertionFailedError/.test(output),
     };
     strictTestEvent = exitCode != null && Boolean(activeStage.task_id);
     runId = stableRunId(input || {}, activeStage, details.test_results.command);

package/templates/hooks/codebuddy/hooks/sdd-tdd-rhythm-gate.cjs

@@ -154,7 +154,7 @@ if (require.main === module) {
   }
 
   // G4: 批量更新检测（E1 修正：不再提前退出，模式检查继续执行）
-  var skipPerTaskCheck = false;
+  let skipPerTaskCheck = false;
   if (changes.length >= 2 && hasTddTasks) {
     // 安全网 2: 全部有 task_update 遥测 → check-task 合法更新，跳过逐个检查
     const allHaveTaskUpdate = changes.every(change =>

package/templates/openspec/tasks.md

@@ -8,7 +8,7 @@ capability-id: "CAP-<CAPABILITY>" # 必须与对应 spec/design 一致
 > 
 > **⚠️ 边界声明**：本任务清单仅服务于当前 Capability，严禁跨模块任务。
 > 
-> **【质量红线】颗粒度必须达到"AI能在5分钟内实现"；且拆解的任务和验证逻辑必须 100% 覆盖 spec 和 design
+> **【质量红线】任务按可验证行为或交付单元拆分，不设固定分钟数；且拆解的任务和验证逻辑必须 100% 覆盖 spec 和 design
 
 ---
 
@@ -105,7 +105,7 @@ capability-id: "CAP-<CAPABILITY>" # 必须与对应 spec/design 一致
 
 ## 3. 原子任务清单
 
-<!-- 【质量红线】每个任务必须能在5分钟内由AI实现 -->
+<!-- 【质量红线】每个任务应有可验证结果和明确依赖，避免按字段或命令机械拆分 -->
 
 ### 3.0 任务类型说明
 
@@ -299,7 +299,7 @@ capability-id: "CAP-<CAPABILITY>" # 必须与对应 spec/design 一致
 ---
 
 > **质量红线检查清单**
-> - [ ] 每个任务颗粒度符合"5分钟可实现"标准
+> - [ ] 每个任务对应可验证结果，粒度与真实依赖相匹配
 > - [ ] 任务清单 100% 覆盖 spec.md 定义
 > - [ ] 任务清单 100% 覆盖 design.md 定义
 > - [ ] 每个任务都有明确的验收标准