sillyspec 3.19.2 → 3.20.0

package/src/worktree-apply.js

@@ -305,6 +305,147 @@ export function applyWorktree(changeName, { cwd, checkOnly = false } = {}) {
   return result;
 }
 
+/**
+ * 风险审计：评估 worktree 变更是否可以安全自动 apply
+ *
+ * 检查项：
+ * 1. patch --check 通过
+ * 2. 所有变更在 allowed_paths 内
+ * 3. 主工作区 baseline 未变化
+ * 4. 没有删除/重命名关键文件
+ * 5. 没有改高风险文件（lockfile/migration/配置/入口）除非任务显式允许
+ * 6. diff 规模没有异常膨胀
+ *
+ * @param {string} changeName
+ * @param {{ cwd?: string }} opts
+ * @returns {{
+ *   decision: 'SAFE' | 'WARNING' | 'BLOCKED',
+ *   changedFiles: string[],
+ *   reasons: string[],
+ *   warnings: string[],
+ *   stats: { additions: number, deletions: number }
+ * }}
+ */
+export function assessApplyRisk(changeName, { cwd } = {}) {
+  const projectRoot = cwd || process.cwd();
+  const reasons = [];
+  const warnings = [];
+
+  // 先跑 --check-only 模式的 applyWorktree 获取变更文件列表
+  const checkResult = applyWorktree(changeName, { cwd: projectRoot, checkOnly: true });
+
+  if (checkResult.errors.length > 0) {
+    return {
+      decision: 'BLOCKED',
+      changedFiles: checkResult.changedFiles,
+      reasons: checkResult.errors,
+      warnings: [],
+      stats: { additions: 0, deletions: 0 }
+    };
+  }
+
+  const changedFiles = checkResult.changedFiles;
+
+  if (changedFiles.length === 0) {
+    return {
+      decision: 'SAFE',
+      changedFiles: [],
+      reasons: ['无变更需要应用'],
+      warnings: [],
+      stats: { additions: 0, deletions: 0 }
+    };
+  }
+
+  // 解析 TaskCard allowed_paths
+  const wm = new WorktreeManager({ cwd: projectRoot });
+  const meta = wm.getMeta(changeName);
+  const tasksDir = join(projectRoot, CHANGES_REL, changeName, 'tasks');
+  const allowedPaths = new Set();
+  if (existsSync(tasksDir)) {
+    const { readdirSync, readFileSync } = require('fs');
+    for (const tf of readdirSync(tasksDir).filter(f => /^task-\d+\.md$/.test(f))) {
+      const content = readFileSync(join(tasksDir, tf), 'utf8');
+      const fmMatch = content.match(/^---\n([\s\S]*?)\n---/);
+      if (!fmMatch) continue;
+      const fm = fmMatch[1];
+      const inline = fm.match(/allowed_paths:\s*\[([^\]]*)\]/);
+      if (inline) {
+        inline[1].split(',').forEach(s => { const v = s.trim().replace(/['"]/g, ''); if (v) allowedPaths.add(v); });
+      }
+      const block = fm.match(/allowed_paths:\s*\n((?:\s+-\s+.+\n?)+)/);
+      if (block) {
+        block[1].match(/-\s+(.+)/g)?.forEach(s => { const v = s.replace(/^-\s+/, '').trim().replace(/['"]/g, ''); if (v) allowedPaths.add(v); });
+      }
+    }
+  }
+
+  // 检查 2: 变更在 allowed_paths 内（仅在 TaskCard 存在时）
+  if (allowedPaths.size > 0) {
+    const outsidePaths = changedFiles.filter(f => !
+      [...allowedPaths].some(allowed => f === allowed || f.startsWith(allowed.replace(/\*$/, '')))
+    );
+    if (outsidePaths.length > 0) {
+      reasons.push(`变更文件超出 allowed_paths：\n  ${outsidePaths.join('\n  ')}`);
+    }
+  }
+
+  // 检查 4+5: 高风险文件模式
+  const HIGH_RISK_PATTERNS = [
+    /(^|\/)package-lock\.json$/,
+    /(^|\/)pnpm-lock\.yaml$/,
+    /(^|\/)yarn\.lock$/,
+    /(^|\/)\.env($|\.)/,
+    /(^|\/)docker-compose.*\.ya?ml$/,
+    /(^|\/)Dockerfile$/,
+    /migration[\w.-]*\.(sql|js|ts)$/i,
+    /(^|\/).*entry.*\.(js|ts)$/i,
+    /(^|\/)main\.(js|ts)$/i,
+    /(^|\/)index\.(js|ts)$/i,
+    /(^|\/)app\.(js|ts)$/i,
+  ];
+  const riskyFiles = changedFiles.filter(f => HIGH_RISK_PATTERNS.some(p => p.test(f)));
+  if (riskyFiles.length > 0) {
+    // 高风险文件只有在 allowedPaths 显式包含时才放行
+    const trulyRisky = riskyFiles.filter(f => !
+      [...allowedPaths].some(allowed => f === allowed)
+    );
+    if (trulyRisky.length > 0) {
+      reasons.push(`高风险文件变更（未在 allowed_paths 中显式声明）：\n  ${trulyRisky.join('\n  ')}`);
+    } else {
+      warnings.push(`高风险文件变更（已在 allowed_paths 中声明）：${riskyFiles.join(', ')}`);
+    }
+  }
+
+  // 检查 6: diff 规模异常（>2000 行变更视为异常）
+  const wtPath = meta?.worktreePath;
+  const diffBase = meta?.baselineCommit || meta?.baseHash;
+  let additions = 0, deletions = 0;
+  if (wtPath && diffBase) {
+    try {
+      const shortstat = gitQuiet(wtPath, `diff --shortstat ${diffBase}`);
+      const insMatch = shortstat?.match(/(\d+) insertion/);
+      const delMatch = shortstat?.match(/(\d+) deletion/);
+      additions = insMatch ? parseInt(insMatch[1]) : 0;
+      deletions = delMatch ? parseInt(delMatch[1]) : 0;
+      if (additions + deletions > 2000) {
+        reasons.push(`diff 规模异常（${additions} additions + ${deletions} deletions = ${additions + deletions} 行）`);
+      }
+    } catch {}
+  }
+
+  // 判定
+  let decision;
+  if (reasons.length > 0) {
+    decision = 'BLOCKED';
+  } else if (warnings.length > 0) {
+    decision = 'WARNING';
+  } else {
+    decision = 'SAFE';
+  }
+
+  return { decision, changedFiles, reasons, warnings, stats: { additions, deletions } };
+}
+
 /**
  * 格式化 execute run summary（人类可读）
  *

package/test/decision-supersede.test.mjs

@@ -0,0 +1,277 @@
+/**
+ * Stage Contract: decisions.md supersede 关系测试
+ *
+ * 验证被 supersede 的旧版本不再被要求引用
+ */
+import { readFileSync } from 'fs'
+import { join } from 'path'
+
+// 直接测试 extractCurrentDecisionIds 的行为
+// 由于它不是 exported，我们通过 validateBrainstormOutputs 间接测试
+
+let failed = 0
+const failures = []
+
+function assert(condition, msg) {
+  if (!condition) {
+    failed++
+    failures.push(msg)
+    console.log(`  ❌ FAIL: ${msg}`)
+  } else {
+    console.log(`  ✅ PASS: ${msg}`)
+  }
+}
+
+console.log('=== decisions.md supersede 关系测试 ===\n')
+
+// 动态导入 stage-contract.js 的内部函数
+// 由于 extractCurrentDecisionIds 不是 exported，我们用 validateBrainstormOutputs 来间接验证
+const contractPath = join(import.meta.dirname, '..', 'src', 'stage-contract.js')
+const contractSource = readFileSync(contractPath, 'utf8')
+
+// 提取并 eval 需要的函数
+// 通过创建临时模块来测试
+const { existsSync, mkdirSync, writeFileSync, mkdtempSync, rmSync } = await import('fs')
+const { join: pJoin } = await import('path')
+const { tmpdir } = await import('os')
+
+// 我们通过 validateBrainstormOutputs 来端到端测试
+const mod = await import(pJoin(import.meta.dirname, '..', 'src', 'stage-contract.js'))
+
+// ─────────────────────────────────────────
+// Test 1: 被 supersede 的旧版本不警告
+// ─────────────────────────────────────────
+console.log('--- Test 1: 被 supersede 的旧版本不警告 ---')
+{
+  const tmpDir = mkdtempSync(join(tmpdir(), 'sillyspec-supersede-'))
+  // 模拟 .sillyspec/changes 结构
+  const changeDir = pJoin(tmpDir, '.sillyspec', 'changes', '2026-06-25-test')
+  mkdirSync(changeDir, { recursive: true })
+
+  // decisions.md: D-004@v2 supersedes D-004@v1
+  writeFileSync(pJoin(changeDir, 'decisions.md'), `# Decisions
+
+## D-004@v1
+- status: accepted
+- priority: P1
+
+## D-004@v2
+- status: accepted
+- priority: P1
+- supersedes: D-004@v1
+`)
+
+  // design.md 只引用 D-004@v2（不引用 v1）
+  writeFileSync(pJoin(changeDir, 'design.md'), `# Design
+
+## 目标
+修复 bug。
+
+## 方案
+用方案 B。
+
+## 决策
+D-004@v2: 选择方案 B
+`)
+
+  writeFileSync(pJoin(changeDir, 'requirements.md'), `# Requirements
+
+## FR-01
+需求 A。
+
+## 决策覆盖
+- D-004@v2 → FR-01
+`)
+
+  writeFileSync(pJoin(changeDir, 'tasks.md'), `# Tasks
+- task-01: 实现
+`)
+
+  // 用 validateBrainstormOutputs 验证
+  const result = mod.runValidators("brainstorm", tmpDir, '2026-06-25-test')
+
+  // 不应有关于 D-004@v1 的未引用警告
+  const v1Warnings = result.warnings.filter(w => w.includes('D-004@V1'))
+  assert(v1Warnings.length === 0, `不应有 D-004@V1 未引用警告，实际 warnings: ${JSON.stringify(v1Warnings)}`)
+
+  rmSync(tmpDir, { recursive: true, force: true })
+}
+
+// ─────────────────────────────────────────
+// Test 2: 没有 supersede 关系时，旧版本仍被校验
+// ─────────────────────────────────────────
+console.log('\n--- Test 2: 无 supersede 关系时旧版本仍校验 ---')
+{
+  const tmpDir = mkdtempSync(join(tmpdir(), 'sillyspec-nosupersede-'))
+  const changeDir = pJoin(tmpDir, '.sillyspec', 'changes', '2026-06-25-test')
+  mkdirSync(changeDir, { recursive: true })
+
+  // decisions.md: 两个独立决策，无 supersede 关系
+  writeFileSync(pJoin(changeDir, 'decisions.md'), `# Decisions
+
+## D-004@v1
+- status: accepted
+- priority: P1
+
+## D-005@v1
+- status: accepted
+- priority: P1
+`)
+
+  // design.md 只引用 D-004@v1，不引用 D-005@v1
+  writeFileSync(pJoin(changeDir, 'design.md'), `# Design
+
+## 目标
+修复 bug。
+
+## 方案
+用方案 B。
+
+## 决策
+D-004@v1: 选择方案 B
+## 文件变更清单
+| 操作 | 文件 | 说明 |
+## 风险登记
+- 风险 A
+## 自审
+- 已检查
+`)
+
+  writeFileSync(pJoin(changeDir, 'requirements.md'), `# Requirements
+## FR-01
+需求 A。
+`)
+
+  writeFileSync(pJoin(changeDir, 'proposal.md'), `# Proposal
+## 不在范围内
+- 无
+`)
+  writeFileSync(pJoin(changeDir, 'tasks.md'), `# Tasks
+- task-01: 实现
+`)
+
+  const result = mod.runValidators("brainstorm", tmpDir, '2026-06-25-test')
+
+  // D-005@v1 应该有未引用警告
+  const v5Warnings = result.warnings.filter(w => w.includes('D-005@V1'))
+  assert(v5Warnings.length > 0, `应有 D-005@V1 未引用警告`)
+
+  rmSync(tmpDir, { recursive: true, force: true })
+}
+
+// ─────────────────────────────────────────
+// Test 3: status=superseded 的旧版本不警告（原有行为，回归测试）
+// ─────────────────────────────────────────
+console.log('\n--- Test 3: status=superseded 的旧版本不警告（回归） ---')
+{
+  const tmpDir = mkdtempSync(join(tmpdir(), 'sillyspec-status-'))
+  const changeDir = pJoin(tmpDir, '.sillyspec', 'changes', '2026-06-25-test')
+  mkdirSync(changeDir, { recursive: true })
+
+  writeFileSync(pJoin(changeDir, 'decisions.md'), `# Decisions
+
+## D-004@v1
+- status: superseded
+- priority: P1
+
+## D-004@v2
+- status: accepted
+- priority: P1
+`)
+
+  writeFileSync(pJoin(changeDir, 'design.md'), `# Design
+
+## 目标
+修复 bug。
+
+## 方案
+用方案 B。
+
+## 决策
+D-004@v2: 选择方案 B
+`)
+
+  writeFileSync(pJoin(changeDir, 'requirements.md'), `# Requirements
+## FR-01
+需求 A。
+`)
+
+  writeFileSync(pJoin(changeDir, 'tasks.md'), `# Tasks
+- task-01: 实现
+`)
+
+  const result = mod.runValidators("brainstorm", tmpDir, '2026-06-25-test')
+
+  const v1Warnings = result.warnings.filter(w => w.includes('D-004@V1'))
+  assert(v1Warnings.length === 0, `status=superseded 的 D-004@V1 不应警告`)
+
+  rmSync(tmpDir, { recursive: true, force: true })
+}
+
+// ─────────────────────────────────────────
+// Test 4: 多级 supersede 链（v1 ← v2 ← v3）
+// ─────────────────────────────────────────
+console.log('\n--- Test 4: 多级 supersede 链 ---')
+{
+  const tmpDir = mkdtempSync(join(tmpdir(), 'sillyspec-chain-'))
+  const changeDir = pJoin(tmpDir, '.sillyspec', 'changes', '2026-06-25-test')
+  mkdirSync(changeDir, { recursive: true })
+
+  writeFileSync(pJoin(changeDir, 'decisions.md'), `# Decisions
+
+## D-004@v1
+- status: accepted
+- priority: P1
+
+## D-004@v2
+- status: accepted
+- priority: P1
+- supersedes: D-004@v1
+
+## D-004@v3
+- status: accepted
+- priority: P1
+- supersedes: D-004@v2
+`)
+
+  // design.md 只引用 D-004@v3
+  writeFileSync(pJoin(changeDir, 'design.md'), `# Design
+
+## 目标
+修复 bug。
+
+## 方案
+用方案 C。
+
+## 决策
+D-004@v3: 选择方案 C
+`)
+
+  writeFileSync(pJoin(changeDir, 'requirements.md'), `# Requirements
+## FR-01
+需求 A。
+- D-004@v3 → FR-01
+`)
+
+  writeFileSync(pJoin(changeDir, 'tasks.md'), `# Tasks
+- task-01: 实现
+`)
+
+  const result = mod.runValidators("brainstorm", tmpDir, '2026-06-25-test')
+
+  const oldWarnings = result.warnings.filter(w => w.includes('D-004@V1') || w.includes('D-004@V2'))
+  assert(oldWarnings.length === 0, `多级 supersede 链中 v1/v2 不应警告，实际: ${JSON.stringify(oldWarnings)}`)
+
+  rmSync(tmpDir, { recursive: true, force: true })
+}
+
+// ── 结果 ──
+console.log(`\n${'='.repeat(50)}`)
+console.log(`✅ 通过: ${4 - failed}  ❌ 失败: ${failed}`)
+if (failures.length > 0) {
+  console.log(`失败项:`)
+  failures.forEach(f => console.log(`  - ${f}`))
+}
+console.log(`${'='.repeat(50)}`)
+
+if (failed > 0) process.exit(1)