leniu-dev 2.0.0

package/.cursor/commands/opsx-verify.md

@@ -0,0 +1,164 @@
+---
+name: /opsx-verify
+id: opsx-verify
+category: Workflow
+description: Verify implementation matches change artifacts before archiving
+---
+
+Verify that an implementation matches the change artifacts (specs, tasks, design).
+
+**Input**: Optionally specify a change name after `/opsx:verify` (e.g., `/opsx:verify add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have implementation tasks (tasks artifact exists).
+   Include the schema used for each change if available.
+   Mark changes with incomplete tasks as "(In Progress)".
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - Which artifacts exist for this change
+
+3. **Get the change directory and load artifacts**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns the change directory and context files. Read all available artifacts from `contextFiles`.
+
+4. **Initialize verification report structure**
+
+   Create a report structure with three dimensions:
+   - **Completeness**: Track tasks and spec coverage
+   - **Correctness**: Track requirement implementation and scenario coverage
+   - **Coherence**: Track design adherence and pattern consistency
+
+   Each dimension can have CRITICAL, WARNING, or SUGGESTION issues.
+
+5. **Verify Completeness**
+
+   **Task Completion**:
+   - If tasks.md exists in contextFiles, read it
+   - Parse checkboxes: `- [ ]` (incomplete) vs `- [x]` (complete)
+   - Count complete vs total tasks
+   - If incomplete tasks exist:
+     - Add CRITICAL issue for each incomplete task
+     - Recommendation: "Complete task: <description>" or "Mark as done if already implemented"
+
+   **Spec Coverage**:
+   - If delta specs exist in `openspec/changes/<name>/specs/`:
+     - Extract all requirements (marked with "### Requirement:")
+     - For each requirement:
+       - Search codebase for keywords related to the requirement
+       - Assess if implementation likely exists
+     - If requirements appear unimplemented:
+       - Add CRITICAL issue: "Requirement not found: <requirement name>"
+       - Recommendation: "Implement requirement X: <description>"
+
+6. **Verify Correctness**
+
+   **Requirement Implementation Mapping**:
+   - For each requirement from delta specs:
+     - Search codebase for implementation evidence
+     - If found, note file paths and line ranges
+     - Assess if implementation matches requirement intent
+     - If divergence detected:
+       - Add WARNING: "Implementation may diverge from spec: <details>"
+       - Recommendation: "Review <file>:<lines> against requirement X"
+
+   **Scenario Coverage**:
+   - For each scenario in delta specs (marked with "#### Scenario:"):
+     - Check if conditions are handled in code
+     - Check if tests exist covering the scenario
+     - If scenario appears uncovered:
+       - Add WARNING: "Scenario not covered: <scenario name>"
+       - Recommendation: "Add test or implementation for scenario: <description>"
+
+7. **Verify Coherence**
+
+   **Design Adherence**:
+   - If design.md exists in contextFiles:
+     - Extract key decisions (look for sections like "Decision:", "Approach:", "Architecture:")
+     - Verify implementation follows those decisions
+     - If contradiction detected:
+       - Add WARNING: "Design decision not followed: <decision>"
+       - Recommendation: "Update implementation or revise design.md to match reality"
+   - If no design.md: Skip design adherence check, note "No design.md to verify against"
+
+   **Code Pattern Consistency**:
+   - Review new code for consistency with project patterns
+   - Check file naming, directory structure, coding style
+   - If significant deviations found:
+     - Add SUGGESTION: "Code pattern deviation: <details>"
+     - Recommendation: "Consider following project pattern: <example>"
+
+8. **Generate Verification Report**
+
+   **Summary Scorecard**:
+   ```
+   ## Verification Report: <change-name>
+
+   ### Summary
+   | Dimension    | Status           |
+   |--------------|------------------|
+   | Completeness | X/Y tasks, N reqs|
+   | Correctness  | M/N reqs covered |
+   | Coherence    | Followed/Issues  |
+   ```
+
+   **Issues by Priority**:
+
+   1. **CRITICAL** (Must fix before archive):
+      - Incomplete tasks
+      - Missing requirement implementations
+      - Each with specific, actionable recommendation
+
+   2. **WARNING** (Should fix):
+      - Spec/design divergences
+      - Missing scenario coverage
+      - Each with specific recommendation
+
+   3. **SUGGESTION** (Nice to fix):
+      - Pattern inconsistencies
+      - Minor improvements
+      - Each with specific recommendation
+
+   **Final Assessment**:
+   - If CRITICAL issues: "X critical issue(s) found. Fix before archiving."
+   - If only warnings: "No critical issues. Y warning(s) to consider. Ready for archive (with noted improvements)."
+   - If all clear: "All checks passed. Ready for archive."
+
+**Verification Heuristics**
+
+- **Completeness**: Focus on objective checklist items (checkboxes, requirements list)
+- **Correctness**: Use keyword search, file path analysis, reasonable inference - don't require perfect certainty
+- **Coherence**: Look for glaring inconsistencies, don't nitpick style
+- **False Positives**: When uncertain, prefer SUGGESTION over WARNING, WARNING over CRITICAL
+- **Actionability**: Every issue must have a specific recommendation with file/line references where applicable
+
+**Graceful Degradation**
+
+- If only tasks.md exists: verify task completion only, skip spec/design checks
+- If tasks + specs exist: verify completeness and correctness, skip design
+- If full artifacts: verify all three dimensions
+- Always note which checks were skipped and why
+
+**Output Format**
+
+Use clear markdown with:
+- Table for summary scorecard
+- Grouped lists for issues (CRITICAL/WARNING/SUGGESTION)
+- Code references in format: `file.ts:123`
+- Specific, actionable recommendations
+- No vague suggestions like "consider reviewing"

package/.cursor/hooks/cursor-pre-tool-use.js

@@ -0,0 +1,122 @@
+#!/usr/bin/env node
+/**
+ * preToolUse Hook - 工具使用前触发 (Cursor 版本)
+ * 功能:
+ * 1. 阻止危险命令
+ * 2. 提醒敏感操作
+ * 3. 自动修正常见错误
+ *
+ * Cursor vs Claude 差异:
+ * - Cursor Shell 工具名: "Shell"（Claude 是 "Bash"）
+ * - 输出格式兼容: { decision: "block", reason: "..." }
+ */
+
+const fs = require('fs');
+
+// 从 stdin 读取输入
+let inputData = '';
+try {
+  inputData = fs.readFileSync(0, 'utf8');
+} catch {
+  console.log(JSON.stringify({ continue: true }));
+  process.exit(0);
+}
+
+let input;
+try {
+  input = JSON.parse(inputData);
+} catch {
+  console.log(JSON.stringify({ continue: true }));
+  process.exit(0);
+}
+
+const toolName = input.tool_name || input.toolName || '';
+const toolInput = input.tool_input || input.toolInput || {};
+
+// Shell/Bash 命令检查（兼容 Cursor 的 "Shell" 和 Claude 的 "Bash"）
+if (toolName === 'Shell' || toolName === 'Bash') {
+  const command = toolInput.command || toolInput.cmd || '';
+
+  // 检测 > nul 错误用法（Windows 会创建名为 nul 的文件）
+  const nulPattern = /[12]?\s*>\s*nul\b/i;
+  if (nulPattern.test(command)) {
+    const output = {
+      decision: 'block',
+      reason: `🚫 **命令被阻止**：检测到 \`> nul\`\n\n**问题**：Windows 下某些 Shell 会创建名为 \`nul\` 的文件\n\n**解决方案**：\n- 移除输出重定向，或\n- 使用 \`> /dev/null 2>&1\`（跨平台）\n\n原命令: \`${command}\``
+    };
+    console.log(JSON.stringify(output));
+    process.exit(2);
+  }
+
+  // 危险命令模式 - 直接阻止
+  const dangerousPatterns = [
+    { pattern: /rm\s+-rf\s+\/(?!\w)/, reason: '删除根目录' },
+    { pattern: /rm\s+-rf\s+\*/, reason: '删除所有文件' },
+    { pattern: /drop\s+database/i, reason: '删除数据库' },
+    { pattern: /truncate\s+table/i, reason: '清空表数据' },
+    { pattern: /git\s+push\s+--force\s+(origin\s+)?(main|master)/i, reason: '强制推送到主分支' },
+    { pattern: /git\s+reset\s+--hard\s+HEAD~\d+/, reason: '硬重置多个提交' },
+    { pattern: />\s*\/dev\/sd[a-z]/, reason: '直接写入磁盘设备' },
+    { pattern: /mkfs\./, reason: '格式化文件系统' },
+    { pattern: /:(){ :|:& };:/, reason: 'Fork 炸弹' },
+  ];
+
+  for (const { pattern, reason } of dangerousPatterns) {
+    if (pattern.test(command)) {
+      const output = {
+        decision: 'block',
+        reason: `⚠️ **危险操作被阻止**\n\n命令: \`${command}\`\n原因: ${reason}\n\n如确需执行，请手动在终端运行`
+      };
+      console.log(JSON.stringify(output));
+      process.exit(2);
+    }
+  }
+
+  // 警告但不阻止的命令
+  const warningPatterns = [
+    { pattern: /git\s+push\s+--force/, warning: 'Force push 可能覆盖他人代码' },
+    { pattern: /npm\s+publish/, warning: '即将发布到 npm' },
+    { pattern: /docker\s+system\s+prune/, warning: '将清理所有未使用的 Docker 资源' },
+    { pattern: /brew\s+upgrade/, warning: '升级所有 Homebrew 包可能影响环境' },
+  ];
+
+  for (const { pattern, warning } of warningPatterns) {
+    if (pattern.test(command)) {
+      const output = {
+        continue: true,
+        systemMessage: `⚠️ **注意**: ${warning}`
+      };
+      console.log(JSON.stringify(output));
+      process.exit(0);
+    }
+  }
+}
+
+// Write 工具检查
+if (toolName === 'Write' || toolName === 'CreateFile' || toolName === 'EditFile') {
+  const filePath = toolInput.file_path || toolInput.path || toolInput.filePath || '';
+
+  // 检查是否写入敏感配置文件
+  const sensitiveFiles = [
+    '.env.production',
+    'application-prod.yml',
+    'credentials.json',
+    'secrets.json',
+    '.env.prod'
+  ];
+
+  for (const sensitive of sensitiveFiles) {
+    if (filePath.endsWith(sensitive)) {
+      const output = {
+        continue: true,
+        systemMessage: `⚠️ **敏感文件**: 正在写入 \`${sensitive}\`\n\n请确保不要提交敏感信息到 Git`
+      };
+      console.log(JSON.stringify(output));
+      process.exit(0);
+    }
+  }
+}
+
+// 默认：允许继续
+console.log(JSON.stringify({ continue: true }));
+process.exit(0);