kld-sdd 2.7.8-2 → 2.7.8-3

package/templates/git-hooks/commit-msg

@@ -1,104 +1,22 @@
 #!/bin/sh
-# KLD SDD Commit-MSG Hook
-# 在下方 SCRIPTS 列表中声明要加载的 .cjs 脚本
-# 删除某行 = 禁用该插件
+# KLD SDD provenance hook v2
 # marker: KLD SDD quality gate
-
-# Git supplies the working tree context; this also supports worktrees and core.hooksPath.
-git_root=$(git rev-parse --show-toplevel 2>/dev/null) || {
-  echo "[SDD] 无法定位当前 Git 工作区"
-  exit 1
-}
-hooks_dir=""
-# 统一反斜杠为正斜杠，保证 Windows 盘符路径（P:\a\b → P:/a/b）能被 case 判定为绝对路径
-normalize_path() {
-  printf '%s' "$1" | tr '\\' '/'
-}
-# 绝对路径（/ 开头或盘符 X: 开头）直接使用；相对路径基于 git 根拼接
-resolve_spec_dir() {
-  raw=$(normalize_path "$1")
-  case "$raw" in
-    /*|[A-Za-z]:*) printf '%s' "$raw" ;;
-    *) printf '%s' "$git_root/$raw" ;;
-  esac
-}
-spec_path=$(git -C "$git_root" config --local sdd.specPath 2>/dev/null)
-if [ -n "$spec_path" ]; then
-  hooks_dir="$(resolve_spec_dir "$spec_path")/skywalk-sdd/git-hooks"
-elif [ -f "$git_root/.sdd-spec-root" ]; then
-  spec_rel=$(head -1 "$git_root/.sdd-spec-root" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
-  hooks_dir="$(resolve_spec_dir "$spec_rel")/skywalk-sdd/git-hooks"
+# Ordinary commits save work; delivery-check verifies readiness at Apply completion.
+git_root=$(git rev-parse --show-toplevel 2>/dev/null) || exit 0
+spec_path=$(git config --local sdd.specPath 2>/dev/null)
+if [ -z "$spec_path" ] && [ -f "$git_root/.sdd-spec-root" ]; then
+  IFS= read -r spec_path < "$git_root/.sdd-spec-root"
 fi
-if [ -n "$hooks_dir" ] && [ ! -d "$hooks_dir" ]; then
-  echo "[SDD] 已配置的 Spec 路径失效：$hooks_dir"
-  echo "[SDD] 请恢复 Spec 仓，或修正 sdd.specPath / .sdd-spec-root 后重试"
-  exit 1
-fi
-
-# 方法3: 从 git 根向上搜索 skywalk-sdd/git-hooks（spec 仓本身或父级）
-if [ -z "$hooks_dir" ]; then
-  search_dir="$git_root"
-  while [ -n "$search_dir" ] && [ "$search_dir" != "/" ]; do
-    if [ -d "$search_dir/skywalk-sdd/git-hooks" ]; then
-      hooks_dir="$search_dir/skywalk-sdd/git-hooks"
-      break
-    fi
-    # Windows 盘符根（P:/）dirname 后不变，需显式收敛，避免死循环
-    parent_dir="$(dirname "$search_dir")"
-    [ "$parent_dir" = "$search_dir" ] && break
-    search_dir="$parent_dir"
-  done
-fi
-
-if [ -z "$hooks_dir" ]; then
-  echo "[SDD] 未找到 spec 仓的 skywalk-sdd/git-hooks 目录，跳过 commit-msg"
-  exit 0
-fi
-
-# 从配置文件读取插件列表
-config_file="$hooks_dir/hooks.config"
-if [ ! -f "$config_file" ]; then
-  echo "[SDD] ⚠️  配置文件不存在：hooks.config，使用默认插件"
-  SCRIPTS="commit-msg-sdd-trailer.cjs"
-else
-  # 读取 [commit-msg] 段落的配置
-  in_section=0
-  SCRIPTS=""
-  CR=$(printf '\r')
-  while IFS= read -r line; do
-    line=${line%"$CR"}
-    case "$line" in
-      "[commit-msg]") in_section=1 ;;
-      "["*) in_section=0 ;;
-      "#"*|"") ;;
-      *)
-        if [ "$in_section" -eq 1 ]; then
-          SCRIPTS="$SCRIPTS $line"
-        fi
-        ;;
-    esac
-  done < "$config_file"
-fi
-
-executed=0
-failed=0
-for script_name in $SCRIPTS; do
-  script="$hooks_dir/$script_name"
-  if [ ! -f "$script" ]; then
-    echo "[SDD] ❌ 已配置的插件不存在：$script_name"
-    failed=$((failed + 1))
-    continue
-  fi
-  executed=$((executed + 1))
-  echo "[SDD] 执行 commit-msg 插件：$script_name"
-  node "$script" "$1" --project="$git_root" || failed=$((failed + 1))
-done
-
-if [ "$failed" -gt 0 ]; then
-  echo "[SDD] ❌ 共执行 $executed 个 commit-msg 插件，$failed 个失败"
-  exit 1
-elif [ "$executed" -eq 0 ]; then
-  echo "[SDD] 配置已禁用 commit-msg 插件"
+if [ -z "$spec_path" ]; then spec_path="$git_root"; fi
+spec_path=$(printf '%s' "$spec_path" | tr '\\' '/' | tr -d '\r')
+case "$spec_path" in
+  /*|[A-Za-z]:*) ;;
+  *) spec_path="$git_root/$spec_path" ;;
+esac
+runner="$spec_path/skywalk-sdd/git-hooks/commit-msg-runner.cjs"
+if [ -f "$runner" ]; then
+  node "$runner" "$1" --project="$git_root" || echo '[SDD] 关联待补充，本次提交继续' >&2
 else
-  echo "[SDD] ✅ 共执行 $executed 个 commit-msg 插件，全部通过"
+  echo '[SDD] Spec 运行时未就绪，关联待补充；可重装或修正 sdd.specPath，本次提交继续' >&2
 fi
+exit 0

package/templates/git-hooks/commit-msg-runner.cjs

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+'use strict';
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+// Only the managed provenance worker is advisory. User hooks are never run here.
+const original = process.argv[2];
+let tempDir;
+try {
+  const config = path.join(__dirname, 'hooks.config');
+  if (fs.existsSync(config)) {
+    const text = fs.readFileSync(config, 'utf8');
+    const section = text.split(/\[commit-msg\]\s*\r?\n/)[1]?.split(/^\[/m)[0] || '';
+    if (!section.split(/\r?\n/).some(line => line.trim() === 'commit-msg-sdd-trailer.cjs')) process.exit(0);
+  }
+  if (!String(process.env.KLD_SDD_CHANGE || '').trim()
+      && !fs.existsSync(path.join(__dirname, '../state/delivery-associations'))) {
+    // No explicit or recorded association exists. Avoid starting a second Node
+    // process and loading ontology just to discover that there is nothing to add.
+    const message = fs.readFileSync(original, 'utf8').replace(/^Spec-(?:Change|Revision):[^\n]*\n?/gim, '');
+    fs.writeFileSync(original, message);
+    console.error('[SDD] 本次提交的 Change 待关联；保存不受影响');
+    process.exit(0);
+  }
+  tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'sdd-msg-'));
+  const copy = path.join(tempDir, 'message');
+  fs.copyFileSync(original, copy);
+  const result = spawnSync(process.execPath, [path.join(__dirname, 'commit-msg-sdd-trailer.cjs'), copy, ...process.argv.slice(3)], {
+    encoding: 'utf8', timeout: 1500, maxBuffer: 256 * 1024,
+  });
+  if (result.stderr) process.stderr.write(result.stderr);
+  if (result.status === 0 && !result.error) fs.copyFileSync(copy, original);
+  else {
+    const message = fs.readFileSync(original, 'utf8').replace(/^Spec-(?:Change|Revision):[^\n]*\n?/gim, '');
+    fs.writeFileSync(original, message);
+    console.error('[SDD] 关联待补充（超时或运行失败），本次提交继续');
+  }
+} catch (error) {
+  console.error(`[SDD] 关联待补充：${error.message}；本次提交继续`);
+} finally {
+  if (tempDir) fs.rmSync(tempDir, { recursive: true, force: true });
+}

package/templates/git-hooks/commit-msg-sdd-trailer.cjs

@@ -1,19 +1,8 @@
 #!/usr/bin/env node
 'use strict';
 
-/**
- * commit-msg hook，两种布局：
- *
- * - 多仓（代码仓有 .sdd.yaml，spec 是另一个 clone）：
- *   写 Spec-Revision（spec 干净 HEAD 的完整 SHA）+ Spec-Change（活动 change，可多条）。
- * - 单仓（openspec 与代码同仓）：
- *   spec 与代码在同一次 commit 里，指针自指无意义 → 只写 Spec-Change，不写 Spec-Revision，
- *   且不做「spec 工作区干净」检查（提交进行中必然是脏的）。
- *
- * Spec-Change 来源：KLD_SDD_CHANGE（显式覆盖）> sdd.config.yaml active_changes。
- * Not from branch name, ever.
- *
- * Authority: 10-最小化多仓库关联与变更命名方案.md
+/** Local provenance only. Explicit Change or exact reviewed index match; failures are advisory.
+ * Spec-Revision is written only for a clean, matching, separate Spec repository.
  */
 
 const fs = require('fs');
@@ -30,7 +19,7 @@ function resolveOntologyDir() {
 const ontologyDir = resolveOntologyDir();
 const changeKey = require(path.join(ontologyDir, 'change-key.cjs'));
 const sddConfig = require(path.join(ontologyDir, 'sdd-config.cjs'));
-const activeChanges = require(path.join(ontologyDir, 'active-changes.cjs'));
+const snap = require('./delivery-snapshot.cjs');
 const { parseFrontmatter } = require(path.join(ontologyDir, 'artifact-parser.cjs'));
 
 function projectRootFromHook() {
@@ -40,8 +29,7 @@ function projectRootFromHook() {
 }
 
 function fail(message) {
-  console.error(`[kld-sdd commit-msg] ${message}`);
-  process.exit(1);
+  throw new Error(message);
 }
 
 function isSddLinkedCodeRepo(codeRepoRoot) {
@@ -67,9 +55,6 @@ function resolveLayout(repoRoot, env = process.env) {
   if (!context.specPath) {
     fail(context.message || '无法解析 spec clone 路径。请执行 kld-sdd link-spec --path=<spec>');
   }
-  if (context.code === sddConfig.CODES.SPEC_PATH_INVALID) {
-    fail(context.message);
-  }
   // specPath 指回本仓根：等同单仓（兼容旧平铺）；若指向仓内包裹包仍按 mono
   const resolvedSpec = path.resolve(context.specPath);
   const resolvedRoot = path.resolve(repoRoot);
@@ -79,6 +64,7 @@ function resolveLayout(repoRoot, env = process.env) {
   if (resolvedSpec.startsWith(`${resolvedRoot}${path.sep}`)) {
     return { mode: 'mono', specPath: resolvedSpec, context };
   }
+  if (context.code === sddConfig.CODES.SPEC_PATH_INVALID) fail(context.message);
   return { mode: 'multi', specPath: context.specPath, context };
 }
 
@@ -101,24 +87,42 @@ function parseEnvChangeKeys(env = process.env) {
 }
 
 /**
- * Spec-Change values: explicit env wins, otherwise every active change
- * registered in the spec repo's sdd.config.yaml.
+ * Spec-Change values: explicit env wins, otherwise an exact reviewed index match.
  */
-function resolveChangeKeys(specRoot, env = process.env) {
+function resolveChangeKeys(specRoot, env = process.env, repoRoot = projectRootFromHook()) {
   const fromEnv = parseEnvChangeKeys(env);
   if (fromEnv) {
-    for (const key of fromEnv) {
-      requireChangeDir(specRoot, key, { strict: true });
-    }
+    for (const key of fromEnv) requireChangeDir(specRoot, key, { strict: true });
     return { keys: fromEnv, source: 'env' };
   }
-  const registered = activeChanges.activeChangeKeys(specRoot);
-  const keys = registered.filter((key) => requireChangeDir(specRoot, key, { strict: false }));
-  return { keys, source: 'sdd.config.yaml' };
+  // The active registry describes ongoing work, not the ownership of this commit.
+  const identity = snap.repoIdentity(repoRoot);
+  const file = path.join(specRoot, 'skywalk-sdd/state/delivery-associations', `${snap.digest(identity)}.json`);
+  if (!fs.existsSync(file)) return { keys: [], source: 'pending' };
+  const saved = JSON.parse(fs.readFileSync(file, 'utf8'));
+  const staged = snap.git(repoRoot, ['diff', '--cached', '--name-only', '--no-renames', '-z']).split('\0').filter(Boolean);
+  if (!staged.length || staged.length > 200 || saved.repository !== identity) return { keys: [], source: 'pending' };
+  const knownFiles = new Set(Object.values(saved.changes || {}).flatMap(item => (item.coveredFiles || []).map(f => f.path)));
+  if (staged.some(file => !knownFiles.has(file))) return { keys: [], source: 'pending' };
+  const candidates = [];
+  const entries = snap.entriesAt(repoRoot, 'index').filter(e => staged.includes(e.path));
+  const blobs = snap.readBlobs(repoRoot, entries);
+  for (const [key, association] of Object.entries(saved.changes || {})) {
+    const covered = new Map((association.coveredFiles || []).map(f => [f.path, f]));
+    if (staged.every(file => {
+      const meta = covered.get(file);
+      if (!meta) return false;
+      if (meta.deleted) return !entries.some(e => e.path === file);
+      const content = blobs.get(file);
+      return content && snap.fileMeta(file, content, meta.mode).sha256 === meta.sha256 && entries.find(e => e.path === file)?.mode === meta.mode;
+    }) && requireChangeDir(specRoot, key, { strict: false })) candidates.push(key);
+  }
+  // Multiple matching reviews are ambiguous too; explicit selection supports multi-change commits.
+  return { keys: candidates.length === 1 ? candidates : [], source: candidates.length === 1 ? 'review' : 'pending' };
 }
 
 /**
- * @param {{ strict: boolean }} options strict=true 阻断提交；false 仅警告并跳过该条
+ * @param {{ strict: boolean }} options strict=true 抛出关联错误；false 仅警告并跳过该条（外层均允许保存）
  */
 function requireChangeDir(specRoot, key, options = { strict: true }) {
   const proposalPath = path.join(specRoot, 'openspec', 'changes', key, 'proposal.md');
@@ -181,52 +185,39 @@ function resolveMsgFile(argv = process.argv) {
 
 function main(env = process.env) {
   const msgFile = resolveMsgFile();
-  if (!msgFile) {
-    fail('缺少 commit message 文件参数');
-  }
-
+  if (!msgFile) fail('缺少 commit message 文件参数');
   const repoRoot = projectRootFromHook();
-  const layout = resolveLayout(repoRoot, env);
-
-  // 未接入 SDD 的普通代码仓：不写 Trailer
-  if (layout.mode === 'unlinked') {
-    process.exit(0);
-  }
-
-  const trailers = {
-    // 多个活动 change 时写多条 Spec-Change
-    'Spec-Change': resolveChangeKeys(layout.specPath, env).keys,
-  };
-
-  if (layout.mode === 'multi') {
-    const context = layout.context;
-    // remote mismatch：仍允许写本地 Revision（溯源本地快照）；仅警告
-    if (context.code === sddConfig.CODES.REMOTE_MISMATCH) {
-      console.error(`[kld-sdd commit-msg] 警告: ${context.message}`);
-    }
-
-    if (!sddConfig.gitWorkingTreeClean(layout.specPath)) {
-      fail('spec 工作区不干净。请先提交或暂存 spec 变更后再提交代码。');
-    }
-
-    const revision = sddConfig.gitHeadSha(layout.specPath);
-    if (!revision || revision.length < 40) {
-      fail(`无法读取完整 Spec-Revision（需要完整 SHA）: ${revision}`);
+  // Keep only the index context for the code repo (git commit -a uses a temporary index).
+  for (const key of ['GIT_DIR', 'GIT_WORK_TREE', 'GIT_COMMON_DIR', 'GIT_OBJECT_DIRECTORY', 'GIT_ALTERNATE_OBJECT_DIRECTORIES']) delete process.env[key];
+  const original = fs.readFileSync(msgFile, 'utf8');
+  let trailers = { 'Spec-Change': [], 'Spec-Revision': [] };
+  try {
+    const layout = resolveLayout(repoRoot, env);
+    if (layout.mode === 'unlinked') return;
+    const association = resolveChangeKeys(layout.specPath, env, repoRoot);
+    trailers['Spec-Change'] = association.keys;
+    if (!association.keys.length) console.error('[SDD] 本次提交的 Change 待关联；未从活动列表猜测归属');
+    if (layout.mode === 'multi' && association.keys.length) {
+      if (layout.context.code === sddConfig.CODES.REMOTE_MISMATCH) fail(layout.context.message);
+      if (!layout.context.sddYaml?.ok || !layout.context.specRemote || !sddConfig.remotesMatch(layout.context.sddYaml.spec_repository, layout.context.specRemote)) fail('Spec 来源仓库尚未确认，不能写入精确 Revision');
+      const dirty = snap.git(layout.specPath, ['status', '--porcelain', '--untracked-files=normal']).trim();
+      if (dirty) console.error('[SDD] Spec 尚有未提交内容，Spec-Revision 待绑定；本次提交继续');
+      else {
+        const revision = snap.git(layout.specPath, ['rev-parse', '--verify', 'HEAD']).trim();
+        if (!/^[a-f0-9]{40}$|^[a-f0-9]{64}$/.test(revision)) fail('无法读取完整 Spec-Revision');
+        trailers['Spec-Revision'] = revision;
+      }
     }
-    trailers['Spec-Revision'] = revision;
+  } catch (error) {
+    trailers = { 'Spec-Change': [], 'Spec-Revision': [] };
+    console.error(`[SDD] 关联待补充：${error.message}；本次提交继续`);
   }
-
-  const original = fs.readFileSync(msgFile, 'utf8');
-  const updated = upsertTrailers(original, trailers);
-  fs.writeFileSync(msgFile, updated, 'utf8');
+  fs.writeFileSync(msgFile, upsertTrailers(original, trailers), 'utf8');
 }
 
 if (require.main === module) {
-  try {
-    main();
-  } catch (error) {
-    fail(error.message || String(error));
-  }
+  try { main(); }
+  catch (error) { console.error(`[SDD] 关联待补充：${error.message}；本次提交继续`); }
 }
 
 module.exports = {