sillyspec 3.19.2 → 3.20.1

package/src/change-risk-profile.js

@@ -1,21 +1,63 @@
 /**
  * change-risk-profile.js — 变更风险分级检测
  *
- * 根据变更涉及的文件类型、关键词，自动判定 verify 所需的验收强度。
+ * 根据变更涉及的文件类型、关键词、git diff、brainstorm 产物，
+ * 自动判定 P0/P1/P2 风险等级，产出结构化 risk-profile.json。
+ *
+ * P0 = 阻塞确认（必须用户确认）
+ * P1 = 自动推进但记录
+ * P2 = 自动通过
  */
 
-/**
- * 触发 integration-critical 风险等级的关键词
- */
-const INTEGRATION_CRITICAL_PATTERNS = [
-  // 跨进程通信
+// ============ P0 触发规则 ============
+
+const P0_FILE_PATTERNS = [
+  { id: 'R-002', pattern: /(?:^|\/)(?:migrations?|migration)\/(?:.+)/i, desc: '数据库 migration' },
+  { id: 'R-002', pattern: /(?:^|\/)schema\.(?:sql|prisma|ts|js)$/i, desc: '数据库 schema' },
+  { id: 'R-003', pattern: /(?:^|\/)(?:auth|permission|role|login|token)\b/i, desc: '鉴权/权限' },
+  { id: 'R-004', pattern: /(?:^|\/)(?:payment|billing|stripe|paypal)\b/i, desc: '支付/资金' },
+  { id: 'R-005', pattern: /\.(?:env|env\.\w+)$/, desc: '环境配置' },
+  { id: 'R-005', pattern: /(?:^|\/)(?:Dockerfile|docker-compose\.\w+)$/i, desc: '部署配置' },
+  { id: 'R-005', pattern: /(?:^|\/)config\.(?:yaml|yml|json|toml)$/i, desc: '生产配置' },
+]
+
+const P0_CONTENT_PATTERNS = [
+  { id: 'R-001', pattern: /\b(?:DROP\s+TABLE|TRUNCATE\s+TABLE|DELETE\s+FROM\s+\w+\s+(?!WHERE\s+.+\s+LIMIT))/i, desc: '删除数据' },
+  { id: 'R-002', pattern: /\b(?:CREATE\s+TABLE|ALTER\s+TABLE|ADD\s+COLUMN|DROP\s+COLUMN|CREATE\s+INDEX)/i, desc: '数据库 migration' },
+]
+
+// ============ P1 触发规则 ============
+
+const P1_FILE_PATTERNS = [
+  { id: 'R-101', pattern: /(?:^|\/)(?:routes|controllers?|handlers?)\//i, desc: 'API 层' },
+  { id: 'R-102', pattern: /(?:^|\/)(?:models|entities)\//i, desc: '数据模型层' },
+  { id: 'R-104', pattern: /(?:^|\/)(?:services)\//i, desc: '业务逻辑层（跨模块）' },
+  { id: 'R-106', pattern: /(?:^|\/)index\.(?:ts|js)$/i, desc: 're-export 入口' },
+]
+
+const P1_CONTENT_PATTERNS = [
+  { id: 'R-101', pattern: /\b(?:daemon|backend|grpc|websocket|cross.?process|ipc|message.?queue)\b/i, desc: '跨进程通信' },
+  { id: 'R-101', pattern: /\b(?:session|lease|agent.?run|lifecycle|state.?transition|claim|heartbeat)\b/i, desc: '状态机/生命周期' },
+  { id: 'R-102', pattern: /\b(?:api|client|contract|dto)\b/i, desc: 'API contract' },
+  { id: 'R-105', pattern: /(?:^|\/)(?:workflow|daemon|session|lifecycle|state-machine)\b/i, desc: '核心模块' },
+]
+
+// ============ P0/P1 命中文件名关键词（用于 git diff 检测） ============
+
+const PROTECTED_FILE_NAMES = [
+  '.env', 'package.json', 'tsconfig.json', 'vite.config.ts', 'vite.config.js',
+  'prisma/schema.prisma', 'docker-compose.yml', 'docker-compose.yaml',
+]
+
+// ============ 向后兼容：旧的 INTEGRATION_CRITICAL_PATTERNS ============
+
+export const INTEGRATION_CRITICAL_PATTERNS = [
   /\bdaemon\b/i,
   /\bbackend\b/i,
   /\bclient.*api\b/i,
   /\bgrpc\b/i,
   /\bwebsocket\b/i,
   /\bhttp.*client\b/i,
-  // 状态机 / 生命周期
   /\bsession\b/i,
   /\blease\b/i,
   /\bagent.?run\b/i,
@@ -23,12 +65,10 @@ const INTEGRATION_CRITICAL_PATTERNS = [
   /\bstate.?transition\b/i,
   /\bclaim\b/i,
   /\bheartbeat\b/i,
-  // 跨进程协议
   /\bcross.?process\b/i,
   /\bipc\b/i,
   /\bmessage.?queue\b/i,
   /\bpub.?sub\b/i,
-  // 部署/启动路径
   /\bcli\.ts\b/i,
   /\bmain\.ts\b/i,
   /\bentrypoint\b/i,
@@ -38,10 +78,7 @@ const INTEGRATION_CRITICAL_PATTERNS = [
   /\bdocker.?compose\b/i,
 ]
 
-/**
- * 需要集成验证的文件路径关键词
- */
-const INTEGRATION_FILE_PATTERNS = [
+export const INTEGRATION_FILE_PATTERNS = [
   /daemon/i,
   /session.?manager/i,
   /agent.?run/i,
@@ -55,12 +92,163 @@ const INTEGRATION_FILE_PATTERNS = [
   /startup/i,
 ]
 
+// ============ 核心检测函数 ============
+
 /**
- * 检测变更风险等级
+ * 三级风险检测：P0 / P1 / P2
  * @param {object} opts
  * @param {string} [opts.designContent] - design.md 内容
  * @param {string} [opts.planContent] - plan.md 内容
  * @param {string[]} [opts.changedFiles] - 变更文件列表
+ * @param {string} [opts.diffContent] - git diff 内容（可选，用于更精确检测）
+ * @param {object} [opts.nextAction] - next-action.json 解析后的对象（可选）
+ * @param {string[]} [opts.protectedFiles] - 项目自定义 protected files 列表
+ * @returns {RiskProfile}
+ *
+ * @typedef {object} RiskProfile
+ * @property {string} level - 'P0' | 'P1' | 'P2'
+ * @property {string[]} triggers - 触发的规则 ID 列表
+ * @property {object[]} assessedFrom - 评估依据
+ * @property {string[]} applyBlockers - apply 阻塞原因
+ * @property {boolean} canAutoApply - 是否可自动 apply
+ * @property {string} applyReason - apply 决策原因
+ */
+export function detectRiskProfile({ designContent = '', planContent = '', changedFiles = [], diffContent = '', nextAction = null, protectedFiles = [] } = {}) {
+  const triggers = []
+  const assessedFrom = []
+
+  const combined = [designContent, planContent].join('\n')
+
+  // ── P0 检测（最高优先级）──
+
+  // 基于文件路径
+  for (const rule of P0_FILE_PATTERNS) {
+    for (const file of changedFiles) {
+      if (rule.pattern.test(file)) {
+        rule.pattern.lastIndex = 0
+        if (!triggers.includes(rule.id)) {
+          triggers.push(rule.id)
+          assessedFrom.push({ source: 'file_path', pattern: rule.desc, matchedFiles: [file] })
+        }
+      }
+    }
+  }
+
+  // 基于 diff 内容（P0 关键词）
+  const diffText = diffContent || combined
+  for (const rule of P0_CONTENT_PATTERNS) {
+    if (rule.pattern.test(diffText)) {
+      rule.pattern.lastIndex = 0
+      if (!triggers.includes(rule.id)) {
+        triggers.push(rule.id)
+        assessedFrom.push({ source: 'content', pattern: rule.desc })
+      }
+    }
+  }
+
+  // protected files
+  for (const file of changedFiles) {
+    if (PROTECTED_FILE_NAMES.some(p => file === p || file.endsWith('/' + p))) {
+      const id = 'R-005'
+      if (!triggers.includes(id)) {
+        triggers.push(id)
+        assessedFrom.push({ source: 'protected_file', pattern: file })
+      }
+    }
+    // 用户自定义 protected files
+    if (protectedFiles.includes(file)) {
+      const id = 'R-005'
+      if (!triggers.includes(id)) {
+        triggers.push(id)
+        assessedFrom.push({ source: 'protected_file', pattern: file })
+      }
+    }
+  }
+
+  // next-action.json 有 blocking questions
+  if (nextAction && nextAction.has_blocking_questions === true) {
+    const id = 'R-009'
+    if (!triggers.includes(id)) {
+      triggers.push(id)
+      assessedFrom.push({ source: 'brainstorm', pattern: 'has_blocking_questions === true' })
+    }
+  }
+
+  // ── P1 检测（只在无 P0 时检测）──
+  if (!triggers.some(t => t.startsWith('R-00'))) {
+    // 基于文件路径
+    for (const rule of P1_FILE_PATTERNS) {
+      for (const file of changedFiles) {
+        if (rule.pattern.test(file)) {
+          rule.pattern.lastIndex = 0
+          if (!triggers.includes(rule.id)) {
+            triggers.push(rule.id)
+            assessedFrom.push({ source: 'file_path', pattern: rule.desc, matchedFiles: [file] })
+          }
+        }
+      }
+    }
+
+    // 基于内容关键词
+    for (const rule of P1_CONTENT_PATTERNS) {
+      if (rule.pattern.test(combined)) {
+        rule.pattern.lastIndex = 0
+        if (!triggers.includes(rule.id)) {
+          triggers.push(rule.id)
+          assessedFrom.push({ source: 'content', pattern: rule.desc })
+        }
+      }
+    }
+
+    // 跨模块检测（> 3 个文件的变更）
+    if (changedFiles.length > 10) {
+      const id = 'R-101'
+      if (!triggers.includes(id)) {
+        triggers.push(id)
+        assessedFrom.push({ source: 'file_count', pattern: `${changedFiles.length} files changed` })
+      }
+    }
+
+    // next-action.json 有 NEEDS_REVIEW 决策
+    if (nextAction && Array.isArray(nextAction.auto_decisions)) {
+      for (const d of nextAction.auto_decisions) {
+        if (d.status === 'NEEDS_REVIEW') {
+          const id = 'R-102'
+          if (!triggers.includes(id)) {
+            triggers.push(id)
+            assessedFrom.push({ source: 'brainstorm', pattern: `NEEDS_REVIEW: ${d.decision}` })
+          }
+        }
+      }
+    }
+  }
+
+  // ── 判定等级 ──
+  let level = 'P2'
+  if (triggers.some(t => t.match(/^R-0\d+$/))) {
+    level = 'P0'
+  } else if (triggers.some(t => t.match(/^R-1\d+$/))) {
+    level = 'P1'
+  }
+
+  // ── apply 决策 ──
+  const applyBlockers = []
+  if (level === 'P0') {
+    applyBlockers.push('风险等级 P0：需要用户确认后才能 apply')
+  }
+
+  const canAutoApply = level !== 'P0' && applyBlockers.length === 0
+  const applyReason = canAutoApply
+    ? `风险等级 ${level}，无 P0 触发，无 protected files 修改`
+    : applyBlockers.join('; ')
+
+  return { level, triggers, assessedFrom, applyBlockers, canAutoApply, applyReason }
+}
+
+// ============ 向后兼容 ============
+
+/**
+ * 旧的 detectChangeRisk 接口保持向后兼容
  * @returns {{ level: string, triggers: string[], requiredVerification: string[] }}
  */
 export function detectChangeRisk({ designContent = '', planContent = '', changedFiles = [] } = {}) {
@@ -114,9 +302,6 @@ export function detectChangeRisk({ designContent = '', planContent = '', changed
 
 /**
  * 检查 verify-result.md 是否包含集成验证证据
- * @param {string} verifyContent
- * @param {string[]} requiredVerification
- * @returns {{ ok: boolean, errors: string[], warnings: string[] }}
  */
 export function checkIntegrationEvidence(verifyContent, requiredVerification) {
   const errors = []

package/src/classify-change.js

@@ -0,0 +1,73 @@
+/**
+ * classify-change.js — 变更规模分类器
+ *
+ * 将用户需求描述分类为 quick / auto / full，
+ * 供 auto 模式决定内部流程深度。
+ */
+
+/**
+ * 用户显式指定的关键词 → 强制模式
+ */
+const FORCE_FULL_PATTERNS = [
+  /数据库|database|schema/i,
+  /迁移|migration|migrate/i,
+  /鉴权|权限|auth|permission|rbac/i,
+  /支付|payment|billing/i,
+  /重构|refactor.*architectur/i,
+  /微服务|microserv/i,
+]
+
+const FORCE_QUICK_PATTERNS = [
+  /fix typo/i,
+  /更新文案|改文案|文案修改/i,
+  /样式调整|style.*tweak/i,
+  /修复.*\s*\bbug\b.*\bfix\b/i,
+]
+
+/**
+ * 分类变更规模
+ * @param {object} opts
+ * @param {string} opts.description - 用户需求描述
+ * @param {string} [opts.explicitMode] - 用户显式指定的模式（auto/quick/full）
+ * @param {object} [opts.localConfig] - local.yaml 中的 auto_mode 配置
+ * @returns {{ mode: 'quick'|'auto'|'full', reason: string }}
+ */
+export function classifyChange({ description = '', explicitMode, localConfig } = {}) {
+  // 1. 用户显式指定优先级最高
+  if (explicitMode && ['quick', 'auto', 'full'].includes(explicitMode)) {
+    return { mode: explicitMode, reason: '用户显式指定' }
+  }
+
+  // 2. local.yaml force patterns
+  if (localConfig) {
+    const forceFullPatterns = localConfig.force_full_patterns || []
+    const forceQuickPatterns = localConfig.force_quick_patterns || []
+
+    for (const pattern of forceFullPatterns) {
+      if (new RegExp(pattern, 'i').test(description)) {
+        return { mode: 'full', reason: `local.yaml force_full_pattern 匹配: ${pattern}` }
+      }
+    }
+    for (const pattern of forceQuickPatterns) {
+      if (new RegExp(pattern, 'i').test(description)) {
+        return { mode: 'quick', reason: `local.yaml force_quick_pattern 匹配: ${pattern}` }
+      }
+    }
+  }
+
+  // 3. 默认关键词匹配
+  for (const pattern of FORCE_QUICK_PATTERNS) {
+    if (pattern.test(description)) {
+      return { mode: 'quick', reason: `命中 quick 关键词: ${pattern.source}` }
+    }
+  }
+
+  for (const pattern of FORCE_FULL_PATTERNS) {
+    if (pattern.test(description)) {
+      return { mode: 'full', reason: `命中 full 关键词: ${pattern.source}` }
+    }
+  }
+
+  // 4. 默认 auto
+  return { mode: 'auto', reason: '默认模式' }
+}

package/src/index.js

@@ -63,6 +63,13 @@ SillySpec CLI — 规范驱动开发工具包
 
   sillyspec docs migrate       迁移旧文档到统一结构
 
+  sillyspec knowledge <cmd>    知识库管理（agent-safe，输出 JSON）
+    search --query "<text>" --limit N  搜索知识库
+    inspect --id "<id>"            读取知识条目详情
+    validate                        校验知识库健康度
+    refresh                         从 scan 文档刷新自动知识（仅写 generated/）
+    propose --title "<title>" --category <name>  提议新知识（写入 proposed/）
+
   sillyspec platform <cmd>      SillyHub 平台同步
     connect <url> [--token <t>]  连接平台
     disconnect                    断开连接
@@ -304,6 +311,11 @@ async function main() {
       await runCommand(stageArgs, resolveEffectiveDir(dir), specDir)
       break
     }
+    case 'knowledge': {
+      const { cmdKnowledge } = await import('./stages/knowledge.js')
+      await cmdKnowledge(filteredArgs.slice(1), resolveEffectiveDir(dir), { specDir })
+      break
+    }
     case 'dashboard': {
       // Parse dashboard options
       let port = 3456;
@@ -359,6 +371,7 @@ SillySpec worktree — git worktree 隔离管理
 用法:
   sillyspec worktree create <change-name> [--base <branch>]   创建隔离 worktree
   sillyspec worktree apply <change-name> [--check-only]        校验并应用变更到主工作区
+  sillyspec worktree assess <change-name>                     风险审计 + 自动 apply
   sillyspec worktree list                                      列出所有活跃 worktree
   sillyspec worktree cleanup <change-name> [--force]           强制清理 worktree
   sillyspec worktree doctor [--fix] [--stale-hours N]          健康检查 + 修复
@@ -434,6 +447,52 @@ SillySpec worktree — git worktree 隔离管理
           }
           break;
         }
+        case 'assess': {
+          if (!wtName) {
+            console.error('❌ 用法: sillyspec worktree assess <change-name>');
+            process.exit(1);
+          }
+          const { assessApplyRisk } = await import('./worktree-apply.js');
+          const assessment = assessApplyRisk(wtName, { cwd: dir });
+
+          const SEPARATOR = '─'.repeat(32);
+          console.log('Worktree Apply Decision');
+          console.log(SEPARATOR);
+          const decisionIcon = assessment.decision === 'SAFE' ? '✅' : assessment.decision === 'WARNING' ? '⚠️ ' : '🚫';
+          console.log(`Decision:    ${decisionIcon} ${assessment.decision}`);
+          console.log(`Changed files: ${assessment.changedFiles.length}`);
+          if (assessment.stats.additions > 0 || assessment.stats.deletions > 0) {
+            console.log(`Additions:   +${assessment.stats.additions}  Deletions: -${assessment.stats.deletions}`);
+          }
+
+          if (assessment.reasons.length > 0) {
+            console.log('');
+            console.log('Blocked reasons:');
+            for (const r of assessment.reasons) r.split('\n').forEach(l => console.log(`   ${l}`));
+          }
+          if (assessment.warnings.length > 0) {
+            console.log('');
+            console.log('Warnings:');
+            for (const w of assessment.warnings) console.log(`   ⚠️  ${w}`);
+          }
+
+          console.log('');
+          if (assessment.decision === 'SAFE' || assessment.decision === 'WARNING') {
+            console.log('Action: auto-applying...');
+            const { applyWorktree } = await import('./worktree-apply.js');
+            const applyResult = applyWorktree(wtName, { cwd: dir });
+            if (applyResult.errors.length > 0) {
+              console.error('❌ apply 失败:', applyResult.errors.join('; '));
+            } else {
+              console.log(`✅ 已自动应用 ${applyResult.changedFiles.length} 个文件变更`);
+            }
+          } else {
+            console.log('Action: blocked');
+            console.log('   → 检查变更: sillyspec worktree diff ' + wtName);
+            console.log('   → 丢弃变更: sillyspec worktree cleanup ' + wtName);
+          }
+          break;
+        }
         case 'list': {
           const items = wm.list();
           if (items.length === 0) {