kld-sdd 2.7.8 → 2.8.0

package/templates/git-hooks/consistency-check-core.cjs

@@ -1,26 +1,10 @@
 #!/usr/bin/env node
 'use strict';
 
-/**
- * consistency-check-core.cjs
- *
- * pre-commit / pre-push 一致性校验 hook 的共享核心（非独立插件，不在 hooks.config 中登记）。
- * 两个入口脚本通过 require 引用本模块，注入各自差异配置：
- * - diff 采集方式（pre-commit: git diff HEAD；pre-push: 待推送范围 @{push}..HEAD）
- * - 是否检查置信度（pre-commit 检查；pre-push 轻量跳过）
- * - strict 模式（仅 pre-commit 支持 SDD_STRICT_CONSISTENCY）
- * - 过期比对来源（pre-commit: 工作区内容；pre-push: HEAD 已提交内容，staleFromHead）
- * - 提示文案（提交 / 推送）
- *
- * 核心行为（简化版）：
- * - diff 驱动：仅检查 diff 文件与报告 coveredFiles 有交集的 change，无关 change 跳过
- * - 多仓归属过滤：报告 repositories 已声明覆盖仓库且不含当前仓的 change 静默跳过（不输出、不拦截）
- * - 纯注释/空行/空格变更过滤：diff 中所有变更行均为注释/空行/空格的文件直接跳过，不参与校验
- * - 报告存在性：活跃 change 无报告 → 阻止
- * - 报告过期：diff 业务代码与 coveredFiles 交集文件内容变化（size 短路 + SHA-256）→ 阻止
- * - 置信度门禁（仅 pre-commit）：low → 阻止；strict 时 medium 也阻止
- * - 无活跃 change 但 diff 有业务代码 → 阻止（提示先执行 opsx-propose）
- * - 变更范围采集失败 → 阻止（避免静默放行的 fail-open）
+/** Shared collection utilities and the optional strict index entry.
+ * Delivery readiness uses delivery-check.cjs receipts with complete input fingerprints.
+ * Legacy JSON parsing helpers remain available for readers; old confidence-only reports
+ * cannot satisfy the strict entry. Daily commit/push do not call this module by default.
  */
 
 const fs = require('fs');
@@ -49,7 +33,7 @@ function parseActiveChangesFromYaml(content) {
   for (const raw of content.split(/\r?\n/)) {
     const line = raw.replace(/#.*$/, '').replace(/\s+$/, '');
     if (!line.trim()) continue;
-    if (/^active_changes:\s*(\[\s*\])?\s*$/.test(line)) { inActive = true; continue; }
+    if (/^active_changes:\s*(\[\s*])?\s*$/.test(line)) { inActive = true; continue; }
     if (inActive) {
       const m = /^\s+-\s+change-key:\s*(\S+)/.exec(line);
       if (m) keys.push(m[1]);
@@ -105,7 +89,7 @@ function parseReport(reportPath) {
         : raw;
       const t = new Date(normalized.replace(/-/g, '/')).getTime();
       if (!isNaN(t)) {
-        generatedAtMs = t + 1000;
+        generatedAtMs = t;
       } else {
         generatedAtFormatError = `generatedAt 无法解析（实际: ${raw}，应为 YYYY-MM-DD HH:mm:ss 本地时间）`;
       }
@@ -144,17 +128,31 @@ function validateReportFields(report) {
 // --- 变更文件采集 ---
 
 /**
- * 简易 YAML 解析器：仅提取 code_repos 列表
+ * 简易 YAML 解析器：仅提取 code_repos 列表。
+ * 逐行状态机解析（无正则量词嵌套），天然免疫 ReDoS（Sonar S5852）。
+ * 容忍条目间注释、行尾注释；遇到下一个顶层 key（非缩进行）即停止。
  */
 function parseCodeRepos(yamlPath) {
   try {
     const content = fs.readFileSync(yamlPath, 'utf8');
-    const match = content.match(/code_repos:\s*\n((?:[ \t]*(?:#[^\n]*\n)?[ \t]*-[ \t]*\S+[ \t]*(?:#[^\n]*)?\n?)+)/);
-    if (!match) return null;
-    return match[1]
-      .split('\n')
-      .map(line => line.replace(/#.*$/, '').replace(/^\s+-\s+/, '').trim())
-      .filter(Boolean);
+    const repos = [];
+    let inList = false;
+    for (const raw of content.split(/\r?\n/)) {
+      const line = raw.replace(/#.*$/, '').replace(/\s+$/, '');
+      if (!line.trim()) continue;
+      if (!/^\s/.test(line)) {
+        // 顶层 key：进入 code_repos 列表 / 离开列表
+        inList = /^code_repos:\s*$/.test(line);
+        continue;
+      }
+      if (!inList) continue;
+      const item = line.trim();
+      if (item.startsWith('- ')) {
+        const value = item.slice(2).trim();
+        if (value) repos.push(value);
+      }
+    }
+    return repos.length > 0 ? repos : null;
   } catch {
     return null;
   }
@@ -185,10 +183,8 @@ function isTrivialDiffLine(line) {
   if (trimmed.startsWith('#')) {
     // 排除 C/C++ 预处理指令
     const rest = trimmed.slice(1).trimStart();
-    if (/^(include|define|ifdef|ifndef|endif|else|elif|undef|pragma|error|warning|line|region|endregion)\b/.test(rest)) {
-      return false;
-    }
-    return true; // Python/Shell/YAML 注释
+    return !/^(include|define|ifdef|ifndef|endif|else|elif|undef|pragma|error|warning|line|region|endregion)\b/.test(rest);
+     // Python/Shell/YAML 注释
   }
   if (trimmed.startsWith('/*') || trimmed.endsWith('*/')) return true; // 块注释开始/结束
   if (trimmed.startsWith('*')) return true; // 块注释续行 (* ... 或 ** ...)
@@ -252,7 +248,7 @@ function parseDiffForTrivialFiles(diffOutput) {
     if (line.startsWith('-') && !line.startsWith('---')) {
       hasAnyChange = true;
       if (!isTrivialDiffLine(line.slice(1))) hasSubstantive = true;
-      continue;
+
     }
   }
   if (currentFile !== null && hasAnyChange && !hasSubstantive) {
@@ -405,15 +401,14 @@ function getModifiedFiles(projectRoot, diffFn, options = {}) {
 /**
  * 解析 INI 风格的 [consistency] 段，返回段内所有 key=value。
  */
-function parseConsistencySection() {
-  const configPath = path.join(__dirname, 'hooks.config');
+function parseConsistencySection(configPath = path.join(__dirname, 'hooks.config')) {
   const values = {};
   try {
     const content = fs.readFileSync(configPath, 'utf8');
     let inSection = false;
     for (const raw of content.split(/\r?\n/)) {
       const line = raw.trim();
-      if (/^\[.+\]$/.test(line)) {
+      if (/^\[.+]$/.test(line)) {
         if (inSection) break;
         inSection = line.toLowerCase() === '[consistency]';
         continue;
@@ -436,8 +431,8 @@ const CONSISTENCY_CONFIG = parseConsistencySection();
  * 业务代码扩展名白名单（business_code_exts，唯一来源为 hooks.config，无内置默认值）。
  * @returns {{exts: Set<string>, source: 'config'|'missing'|'empty', configPath: string|null}}
  */
-function loadBusinessCodeExts() {
-  const { configPath, values } = CONSISTENCY_CONFIG;
+function loadBusinessCodeExts(file) {
+  const { configPath, values } = file ? parseConsistencySection(file) : CONSISTENCY_CONFIG;
   const rawValue = Object.prototype.hasOwnProperty.call(values, 'business_code_exts')
     ? values.business_code_exts : null;
 
@@ -478,14 +473,14 @@ const CONSISTENCY_MODE = loadConsistencyMode();
 const TOOLCHAIN_CONFIG_RE = /^(?:vite|vitest|next|nuxt|astro|svelte|remix|webpack|rollup|babel|jest|playwright|cypress|eslint|prettier|tailwind|postcss|karma|wrangler|nest-cli|angular|vue|craco|rspack|metro|tsconfig|jsconfig|turbo|nx)\.(?:config|conf)\.[a-z]+$/i;
 const DOTFILE_CONFIG_RE = /^\.?(?:eslintrc|babelrc|prettierrc|stylelintrc)\.[a-z]+$/i;
 
-function isBusinessCode(file) {
+function isBusinessCode(file, exts = BUSINESS_CODE_EXTS) {
   const normalized = String(file).replace(/\\/g, '/');
   const base = normalized.split('/').pop() || '';
 
   const dot = base.lastIndexOf('.');
   if (dot < 0) return false;
   const ext = base.slice(dot).toLowerCase();
-  if (!BUSINESS_CODE_EXTS.has(ext)) return false;
+  if (!(exts instanceof Set ? exts : BUSINESS_CODE_EXTS).has(ext)) return false;
 
   if (/\.d\.tsx?$/i.test(base)) return false;
   if (/(^|\/)(dist|build|target|out|node_modules)\//.test(normalized)) return false;
@@ -493,9 +488,9 @@ function isBusinessCode(file) {
   if (/(^|\/)(__tests__|tests?|e2e|cypress|fixtures|mocks?)(\/|$)/i.test(normalized)) return false;
   if (/(^|\/)[^/]*(?:\.test|\.spec|_test)\.[a-z]+$/i.test(normalized)) return false;
   if (TOOLCHAIN_CONFIG_RE.test(base)) return false;
-  if (DOTFILE_CONFIG_RE.test(base)) return false;
+  return !DOTFILE_CONFIG_RE.test(base);
+
 
-  return true;
 }
 
 // --- 路径归一化：报告 coveredFiles → 代码仓相对 ---
@@ -622,25 +617,12 @@ function normalizeEolLf(buf) {
   return Buffer.from(str.replace(/\r\n/g, '\n'), 'binary');
 }
 
-/**
- * 单文件过期判断（mtime 快速跳过 + size 短路 + SHA-256，行尾归一化）。
- * mtime 快速路径：文件修改时间早于报告生成时间 → 报告生成后从未被碰过 → 内容必然未变，
- * 跳过读取和哈希（大变更场景省 100-300ms/百文件）。mtime 晚于报告时间才做精确哈希判断，
- * 因此 git pull/checkout 重置 mtime（内容未变）只会多算一次哈希，不会误判过期。
- */
+/** 内容哈希是有效性依据，mtime 不参与正确性判断。 */
 function isFileChangedOnDisk(fp, metas, reportTime, readContent = readWorkingFile, relFile = '') {
   const list = Array.isArray(metas) ? metas : (metas ? [metas] : []);
   const hashed = list.filter(m => m && m.sha256);
 
   if (hashed.length) {
-    // mtime 快速跳过：仅在能拿到本地文件时（readContent 为工作区读取）且 mtime 可信时启用
-    if (readContent === readWorkingFile) {
-      try {
-        if (fs.statSync(fp).mtimeMs <= reportTime) return false;
-      } catch {
-        return true; // 文件不存在 → 过期
-      }
-    }
     const content = readContent(fp, relFile);
     if (content === null) return true;
     const normalized = normalizeEolLf(content);
@@ -651,14 +633,8 @@ function isFileChangedOnDisk(fp, metas, reportTime, readContent = readWorkingFil
     return !candidates.some(m => hash === String(m.sha256).toLowerCase());
   }
 
-  // 无哈希条目：mtime 比较
-  let stat;
-  try {
-    stat = fs.statSync(fp);
-  } catch {
-    return true;
-  }
-  return stat.mtimeMs > reportTime;
+  // mtime cannot prove content equality. Legacy entries without hashes need review.
+  return true;
 }
 
 /**
@@ -761,205 +737,62 @@ function generateInstructions(opts, result, warnOnly) {
  * @param {object} opts 入口差异配置
  */
 function runConsistencyCheck(opts) {
-  const {
-    label, actionNoun, diffFn,
-    checkConfidence = false, includeUntracked = true,
-    staleFromHead = false,
-  } = opts;
+  const { label, actionNoun, diffFn, includeUntracked = false, staleFromHead = false, staleFromIndex = false } = opts;
   const projectRoot = path.resolve(readArg('project') || process.env.SDD_PROJECT || process.cwd());
-
-  // 模式解析
-  const envSkip = process.env.SDD_SKIP_CONSISTENCY_CHECK;
-  const envStrict = process.env.SDD_STRICT_CONSISTENCY;
-  const envWarnOnly = process.env.SDD_WARN_ONLY;
-  const skip = envSkip !== undefined ? envSkip === '1' : CONSISTENCY_MODE.skip;
-  const strict = envStrict !== undefined ? envStrict === '1' : CONSISTENCY_MODE.strict;
-  const warnOnly = envWarnOnly !== undefined ? envWarnOnly === '1' : CONSISTENCY_MODE.warnOnly;
-
-  // 互斥检查
-  const activeModes = [skip, strict, warnOnly].filter(Boolean).length;
-  if (activeModes > 1) {
-    const names = [
-      ...(skip ? ['SDD_SKIP_CONSISTENCY_CHECK' + (envSkip === undefined ? '(hooks.config)' : '')] : []),
-      ...(strict ? ['SDD_STRICT_CONSISTENCY' + (envStrict === undefined ? '(hooks.config)' : '')] : []),
-      ...(warnOnly ? ['SDD_WARN_ONLY' + (envWarnOnly === undefined ? '(hooks.config)' : '')] : []),
-    ];
-    console.error(`${label} 错误：${names.join('、')} 互斥，只能启用一个`);
+  const mode = loadConsistencyMode();
+  const skip = process.env.SDD_SKIP_CONSISTENCY_CHECK === undefined ? mode.skip : process.env.SDD_SKIP_CONSISTENCY_CHECK === '1';
+  const strict = process.env.SDD_STRICT_CONSISTENCY === undefined ? mode.strict : process.env.SDD_STRICT_CONSISTENCY === '1';
+  const warnOnly = process.env.SDD_WARN_ONLY === undefined ? mode.warnOnly : process.env.SDD_WARN_ONLY === '1';
+  if ([skip, strict, warnOnly].filter(Boolean).length > 1) {
+    console.error(`${label} skip / strict / warn_only 互斥`);
     process.exit(1);
   }
-
-  if (skip) {
-    console.log(`${label} 跳过校验`);
-    process.exit(0);
-  }
-
-  if (warnOnly) console.log(`${label} 仅告警模式`);
-
-  // 配置缺失/空清单显式告警
-  if (BUSINESS_CODE_EXTS_INFO.source !== 'config') {
-    const reason = BUSINESS_CODE_EXTS_INFO.source === 'missing'
-      ? '未配置 business_code_exts（hooks.config 缺失或无 [consistency] 段）'
-      : 'business_code_exts 为空清单';
-    console.warn(`${label} ⚠️  ${reason}，一致性校验不拦截任何业务代码文件（仅保留报告存在性/过期检查）`);
-    console.warn(`${label} ℹ️  请在 ${BUSINESS_CODE_EXTS_INFO.configPath || path.join(__dirname, 'hooks.config')} 的 [consistency] 段配置 business_code_exts`);
-  }
-
-  const specRoot = resolveSpecRoot();
-
-  // 1. 采集 diff 文件
-  const { files: modifiedFiles, deleted: deletedFiles, failed: diffFailed } =
-    getModifiedFiles(projectRoot, diffFn, { includeUntracked });
-
-  if (diffFailed) {
-    console.log(`${label} ❌ 无法确定本次${actionNoun}的变更范围（git diff 采集失败），拒绝${actionNoun}`);
-    if (warnOnly) {
-      console.log(`${label} 仅告警模式，放行${actionNoun}`);
-      process.exit(0);
-    }
-    process.exit(1);
-  }
-
-  // 2. 筛选业务代码文件
-  const diffBusinessFiles = modifiedFiles.filter(isBusinessCode);
-  const deletedBusinessFiles = deletedFiles.filter(isBusinessCode);
-
-  // 3. 无业务代码文件 → 放行
-  if (diffBusinessFiles.length === 0 && deletedBusinessFiles.length === 0) {
+  if (skip) { console.log(`${label} 跳过校验`); process.exit(0); }
+  const problems = [];
+  const { files, deleted, failed } = getModifiedFiles(projectRoot, diffFn, { includeUntracked });
+  if (failed) problems.push('无法确定变更范围');
+  if (BUSINESS_CODE_EXTS_INFO.source !== 'config') problems.push('business_code_exts 未配置，不能证明检查完整');
+  const required = [...new Set([...files, ...deleted])].filter(isBusinessCode);
+  if (!problems.length && !required.length) {
     console.log(`${label} 本次${actionNoun}无业务代码文件，跳过一致性校验`);
     process.exit(0);
   }
-
-  // 4. 活跃 change 发现
-  const changes = discoverActiveChanges(specRoot);
-  if (!changes.length) {
-    console.log([
-      '', '==========================================',
-      `${label} 存在业务代码变更但无活跃 change 可归属，拒绝${actionNoun}：`,
-      '',
-      '  请先执行 opsx-propose 创建变更（登记到 sdd.config.yaml 的 active_changes），',
-      '  再执行 opsx-consistency-check 生成一致性报告。',
-      '==========================================', '',
-    ].join('\n'));
-    if (warnOnly) {
-      console.log(`${label} 仅告警模式，放行${actionNoun}`);
-      process.exit(0);
-    }
-    process.exit(1);
-  }
-
-  // 5. 逐 change 解析报告
-  const parseError = [];
-  const invalid = [];
-  const lowConfidence = [];
-  const stale = [];
-  const missing = [];
-  const parsedReports = new Map();
-
-  // 当前代码仓目录名（多仓布局下用于报告归属过滤 + normalizeCoveredFiles 兜底前缀剥离）
-  const currentRepoName = path.basename(projectRoot).toLowerCase();
-
-  for (const cn of changes) {
-    const rp = findReportJson(specRoot, cn);
-    if (!rp) {
-      missing.push(cn);
-      continue;
-    }
-
-    const report = parseReport(rp);
-    if (report.parseError) {
-      console.warn(`${label} ⚠️  ${cn} 报告解析失败`);
-      parseError.push(cn);
-      continue;
-    }
-
-    // 旧格式报告（无 coveredFiles）
-    if (!report.coveredFiles) {
-      console.log(`${label} ⚠️  ${cn}: 报告为旧格式（缺少 coveredFiles），建议重新生成`);
-      missing.push(cn);
-      continue;
-    }
-
-    // 字段合法性校验（仅 confidence + generatedAt）
-    const fieldErrors = validateReportFields(report);
-    if (fieldErrors.length) {
-      console.warn(`${label} ⚠️  ${cn} 报告字段不合法：${fieldErrors.join('；')}`);
-      invalid.push({ cn, errors: fieldErrors });
-      continue;
-    }
-
-    const covered = normalizeCoveredFiles(report, currentRepoName);
-    parsedReports.set(cn, { report, covered });
-  }
-
-  // 6. 对 diff（含删除）与 coveredFiles 有交集的 change 检查报告
-  const checkFiles = [...new Set([...diffBusinessFiles, ...deletedBusinessFiles])];
-  const checkFilesLower = checkFiles.map(f => f.toLowerCase());
-
-  let headContentCache = null;
-  const readContent = staleFromHead
-    ? (fp, relFile) => {
-        if (headContentCache === null) {
-          headContentCache = gitShowHeadContentBatch(projectRoot, checkFiles);
-        }
-        const fromHead = headContentCache.get(relFile);
-        return fromHead !== undefined && fromHead !== null ? fromHead : readWorkingFile(fp);
-      }
-    : readWorkingFile;
-
-  for (const [cn, { report, covered }] of parsedReports) {
-    // 多仓归属过滤：报告显式声明了覆盖仓库且不含当前仓 → 与本仓无关，静默跳过
-    // （repositories 为空视为未声明，保持原交集判断行为，兼容单仓与旧报告）
-    const declaredRepos = (report.repositories || [])
-      .map(r => String(r && r.path || '').replace(/\\/g, '/').replace(/\/+$/, '').toLowerCase())
-      .filter(Boolean);
-    if (declaredRepos.length && !declaredRepos.includes(currentRepoName)) {
-      continue;
-    }
-
-    const hasIntersection = checkFilesLower.some(f => covered.has(f));
-    if (!hasIntersection) {
-      console.log(`${label} ⏭️  ${cn}: 与本次${actionNoun}无交集，跳过`);
-      continue;
-    }
-
-    if (isReportStale(report, covered, checkFiles, projectRoot, readContent)) {
-      console.log(`${label} ⚠️  ${cn}: 报告已过期`);
-      stale.push(cn);
-      continue;
-    }
-
-    if (checkConfidence) {
-      const c = report.confidence;
-      if (c === 'low' || (c === 'medium' && strict)) {
-        console.log(`${label} ❌ ${cn}: 置信度 ${c}`);
-        lowConfidence.push(cn);
+  const delivery = require('./delivery-check.cjs');
+  const snap = require('./delivery-snapshot.cjs');
+  const specRoot = resolveSpecRoot();
+  const explicit = String(readArg('change') || process.env.KLD_SDD_CHANGE || '').split(/[,\s]+/).filter(Boolean);
+  const changes = explicit.length ? explicit : discoverActiveChanges(specRoot);
+  const covered = new Set();
+  for (const change of changes) {
+    try {
+      const identity = snap.repoIdentity(projectRoot);
+      const rp = delivery.reviewPath({ specRoot, change, identity });
+      if (!fs.existsSync(rp)) {
+        // Unrelated active changes do not require a report for this commit.
+        if (explicit.includes(change)) problems.push(`${change}: 缺少一致性检查回执，请运行 opsx-consistency-check`);
         continue;
       }
-      console.log(`${label} ✅ ${cn}: 置信度 ${c}`);
-    } else {
-      console.log(`${label} ✅ ${cn}: 报告有效`);
-    }
-  }
-
-  const result = {
-    missing, parseError, invalid, lowConfidence, stale,
-  };
-
-  const hasBlocking = missing.length || parseError.length || invalid.length || lowConfidence.length
-    || stale.length;
-
-  if (hasBlocking) {
-    console.log(generateInstructions(opts, result, warnOnly));
-
-    if (warnOnly) {
-      console.log(`${label} 仅告警模式，放行${actionNoun}`);
-      process.exit(0);
-    }
-
-    process.exit(1);
-  }
-
-  console.log(`\n${label} ✅ 本次${actionNoun}涉及的业务代码均已通过一致性校验，放行${actionNoun}`);
+      const report = JSON.parse(fs.readFileSync(rp, 'utf8'));
+      if (!explicit.includes(change) && !required.some(f => (report.reviewedFiles || []).includes(f))) continue;
+      const ctx = delivery.context({ project: projectRoot, 'spec-root': specRoot, change,
+        scope: staleFromHead ? 'commit' : staleFromIndex ? 'index' : 'worktree',
+        base: opts.base || report.base, ref: opts.ref || 'HEAD', 'spec-ref': opts.specRef });
+      // This report need only cover its own files; union coverage is asserted below.
+      ctx.required = required.filter(f => (report.reviewedFiles || []).includes(f));
+      const errors = delivery.reviewErrors(ctx, report);
+      if (errors.length) problems.push(`${change}: 报告过期或未完成：${errors.join('；')}`);
+      else for (const file of ctx.required) covered.add(file);
+    } catch (error) { problems.push(`${change}: ${error.message}`); }
+  }
+  const uncovered = required.filter(file => !covered.has(file));
+  if (uncovered.length) problems.push(`缺少有效检查覆盖（UNCOVERED_FILES）：${uncovered.join(', ')}`);
+  if (problems.length) {
+    console.log(`${label} 未通过：\n${problems.map(p => `  - ${p}`).join('\n')}`);
+    console.log('请由 opsx-consistency-check 更新回执；日常提交默认不运行此严格入口。');
+    if (warnOnly) console.log(`${label} 仅告警模式，放行${actionNoun}（不代表已通过检查）`);
+    process.exit(warnOnly ? 0 : 1);
+  }
+  console.log(`${label} 本次${actionNoun}涉及的业务代码均已通过一致性校验`);
   process.exit(0);
 }
 
@@ -968,7 +801,7 @@ function runConsistencyCheck(opts) {
 function runFilterMode() {
   const filesArg = readArg('files');
 
-  let input = [];
+  let input;
   if (filesArg) {
     if (filesArg.startsWith('@')) {
       input = fs.readFileSync(filesArg.slice(1), 'utf8').split(/\r?\n/);
@@ -1021,11 +854,9 @@ function runCollectMode() {
   const businessFiles = files.filter(isBusinessCode);
   const excluded = files.filter(f => !isBusinessCode(f));
 
-  let hashedBusiness = null;
-  let unreadableFiles = null;
+  const hashedBusiness = [];
+  const unreadableFiles = [];
   if (withHash) {
-    hashedBusiness = [];
-    unreadableFiles = [];
     for (const rel of businessFiles) {
       const content = readWorkingFile(path.join(projectRoot, rel));
       if (content === null) {