sillyspec 3.23.4 → 3.23.6

package/.npm-publish-userconfig.tmp

@@ -0,0 +1 @@
+//registry.npmjs.org/:_authToken=${NPM_TOKEN}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sillyspec",
-  "version": "3.23.4",
+  "version": "3.23.6",
   "description": "SillySpec CLI — 流程状态机，让 AI 严格按步骤来",
   "icon": "logo.jpg",
   "homepage": "https://sillyspec.ppdmq.top/",

package/src/change-list.js

@@ -70,8 +70,10 @@ export function pathMatches(a, b) {
 /**
  * 「文件变更清单」章节标题同义词（与 src/stage-contract.js 的识别集对齐，
  * 避免两个校验器对「有没有清单」给出矛盾结论）。
+ * 容忍可选编号前缀（`## 6. 文件变更清单` / `## 6) 文件变更清单`）——
+ * brainstorm Step11 模板鼓励 design 章节带编号，编号前缀不应让 plan-postcheck 解析失败。
  */
-const FILE_LIST_SECTION_RE = /^#{2,3}\s*(文件变更清单|变更文件清单|文件清单|File Changes|Files to Change)/im
+const FILE_LIST_SECTION_RE = /^#{2,3}\s*(?:\d+[.)]\s*)?(文件变更清单|变更文件清单|文件清单|File Changes|Files to Change)/im
 
 /**
  * exclude 子标题词集：「不修改/暂缓/保留」类 —— 其下路径从清单移除，不强制 task 覆盖。

package/src/contract-matrix.js

@@ -134,8 +134,10 @@ function parseTaskDependencies(planContent) {
  * @param {string} taskName - task-04
  * @returns {{ ok: boolean, endpoints: Array, artifactPath: string|null }}
  */
-export function extractProviderArtifact(changeDir, worktreePath, specBase, taskName) {
-  const artifactDir = join(specBase, '.runtime', 'contract-artifacts', taskName)
+export function extractProviderArtifact(changeDir, worktreePath, specBase, taskName, runtimeRoot) {
+  // 平台模式 contract-artifacts 落 runtimeRoot；否则落 specBase/.runtime
+  const artifactRoot = runtimeRoot || join(specBase, '.runtime')
+  const artifactDir = join(artifactRoot, 'contract-artifacts', taskName)
   const artifactPath = join(artifactDir, 'endpoints.json')
 
   if (!worktreePath || !existsSync(worktreePath)) {
@@ -179,13 +181,15 @@ export function extractProviderArtifact(changeDir, worktreePath, specBase, taskN
  * @param {Array<{ provider: string, consumer: string, type: string }>} contracts
  * @returns {string|null} 注入到 prompt 的契约文本，无契约时返回 null
  */
-export function buildConsumerInjection(changeDir, specBase, taskName, contracts) {
+export function buildConsumerInjection(changeDir, specBase, taskName, contracts, runtimeRoot) {
+  // 平台模式 contract-artifacts 落 runtimeRoot；否则落 specBase/.runtime
+  const artifactRoot = runtimeRoot || join(specBase, '.runtime')
   const myContracts = contracts.filter(c => c.consumer === taskName)
   if (myContracts.length === 0) return null
 
   const parts = []
   for (const contract of myContracts) {
-    const artifactDir = join(specBase, '.runtime', 'contract-artifacts', contract.provider)
+    const artifactDir = join(artifactRoot, 'contract-artifacts', contract.provider)
     const artifactFile = join(artifactDir, 'endpoints.json')
 
     let endpoints = []
@@ -293,11 +297,13 @@ export function buildContractFieldInjection(changeDir, taskName) {
  * @param {string} worktreePath - worktree 路径
  * @returns {{ ok: boolean, missingBackend: Array, unusedBackend: Array, summary: string }}
  */
-export function verifyApiParity(specBase, worktreePath) {
+export function verifyApiParity(specBase, worktreePath, runtimeRoot) {
   const { diffApiParity } = require('./endpoint-extractor.js')
 
+  // 平台模式 contract-artifacts 落 runtimeRoot；否则落 specBase/.runtime
+  const artifactRoot = runtimeRoot || join(specBase, '.runtime')
   // 读取所有 provider artifacts
-  const artifactBase = join(specBase, '.runtime', 'contract-artifacts')
+  const artifactBase = join(artifactRoot, 'contract-artifacts')
   const allProviderEndpoints = []
 
   if (existsSync(artifactBase)) {

package/src/progress.js

@@ -731,7 +731,11 @@ export class ProgressManager {
       console.warn('⚠️  initChange: changeName 为空，跳过');
       return null;
     }
-    this._ensureChangeDir(cwd, changeName);
+    // quick 会话 id（quick-<uuid8>，见 run.js QUICK_SID_RE）只作 progress 的跨进程 session key，
+    // 进度存 SQL 不需要实体 change 目录——跳过避免 changes/quick-<uuid>/ 空目录残留。
+    if (!/^quick-[0-9a-f]{8}$/.test(changeName)) {
+      this._ensureChangeDir(cwd, changeName);
+    }
 
     const db = await this._ensureDB(cwd);
     db.transaction((sqlDb) => {

package/src/run.js

@@ -454,8 +454,10 @@ export async function auditQuickCompletion(cwd, guard, options = {}) {
           console.log(`     - ${r}`)
         }
       }
-      console.log(`\n   如确认接受这些变更，重新运行：sillyspec run quick --done --confirm --output "..."`)
-      console.log(`   或使用 --force-baseline 允许覆盖 baseline 文件，--allow-new 允许新增文件`)
+      console.log(`\n   如确认接受这些变更，重新运行 --done 时带上对应 flag 即可解锁：`)
+      console.log(`     sillyspec run quick --done --force-baseline --allow-new --change <id> --output "..."`)
+      console.log(`     （--force-baseline 覆盖受保护/危险文件如 src/run.js；--allow-new 允许新增文件）`)
+      console.log(`   或在首个 sillyspec run quick 启动（step 1）时就声明这些 flag，持久化进 guard。`)
     }
   } catch (e) {
     result.reasons.push(`审计失败: ${e.message}`)
@@ -1509,6 +1511,15 @@ export async function runCommand(args, cwd, specDir = null) {
     }
   }
 
+  // execute 阶段必须带 --change：不允许自动检测或默认值，变更名必须由 agent 显式传入
+  // --status 豁免（纯查看不需要指定变更）
+  if (stageName === 'execute' && !changeName && !isStatus) {
+    console.error('❌ execute 阶段必须用 --change <变更名> 指定要操作的变更。')
+    console.error('   agent 必须传参，不设默认值、不做自动检测。')
+    console.error('   请加 --change <变更名> 重新执行。')
+    process.exit(1)
+  }
+
   let progress = await pm.read(cwd, changeName)
 
   if (!progress) {
@@ -1692,7 +1703,7 @@ export async function runCommand(args, cwd, specDir = null) {
   // --done
   if (isDone) {
     const doneAnswer = getFlagValue('--answer')
-    return await completeStep(pm, progress, stageName, cwd, outputText, inputText, { confirm: isConfirm, changeName: effectiveChange, nonInteractive: isNonInteractive && !isInteractive, platformOpts, confirmMode, doneAnswer })
+    return await completeStep(pm, progress, stageName, cwd, outputText, inputText, { confirm: isConfirm, changeName: effectiveChange, nonInteractive: isNonInteractive && !isInteractive, platformOpts, confirmMode, doneAnswer, isForceBaseline, isAllowNew })
   }
 
   // 默认：输出当前步骤
@@ -1842,7 +1853,7 @@ async function runStage(pm, progress, stageName, cwd, changeName, skipApproval =
   if (stageName === 'execute') {
     const { generateExecuteRunId } = await import('./task-review.js')
     const execSpecBase = platformOpts?.specRoot || join(cwd, '.sillyspec')
-    const runtimeRoot = join(execSpecBase, '.runtime')
+    const runtimeRoot = platformOpts?.runtimeRoot || join(execSpecBase, '.runtime')
     const runIdFile = join(runtimeRoot, `current-execute-run-id-${changeName}`)
     mkdirSync(runtimeRoot, { recursive: true })
     // 优先读取已有的变更专属标记文件
@@ -1961,10 +1972,13 @@ async function runStage(pm, progress, stageName, cwd, changeName, skipApproval =
     try {
       const { execSync } = await import('child_process')
       const gitStatus = execSync('git status --porcelain', { cwd, encoding: 'utf8', timeout: 10000 })
+      // 记录全部预存脏文件（含 untracked + .sillyspec/ 路径）。quick 会话期间自身写入的元数据
+      // （quicklog/.runtime/modules/_module-map 等）由 auditQuickCompletion 的 isQuickMetadata 精确豁免，
+      // 不需要这里粗放过滤 .sillyspec/——旧过滤致预存 untracked .sillyspec/changes/ 不进 baseline，
+      // 却在 audit 被当「危险(.sillyspec/)+新增」误判永久 blocked（ql-20260713-002-7628 修复）。
       const baselineFiles = gitStatus
         .trim().split('\n').filter(Boolean)
         .map(line => line.slice(3).trim())
-        .filter(f => !f.startsWith('.sillyspec/'))
       const allowedFiles = quickOpts?.quickFiles || []
       const allowNew = quickOpts?.isAllowNew || false
       const forceBaseline = quickOpts?.isForceBaseline || false
@@ -2614,7 +2628,7 @@ function rollbackStageCompletion(stageData, steps, currentIdx) {
 }
 
 async function completeStep(pm, progress, stageName, cwd, outputText, inputText = null, options = {}) {
-  const { printNext = true, confirm = false, changeName, platformOpts = {}, nonInteractive = false, confirmMode = null } = options
+  const { printNext = true, confirm = false, changeName, platformOpts = {}, nonInteractive = false, confirmMode = null, isForceBaseline = false, isAllowNew = false } = options
   const specBase = platformOpts.specRoot || join(cwd, '.sillyspec')
   const stageData = progress.stages[stageName]
   const scanProfile = stageData?.scanProfile || null
@@ -2990,7 +3004,15 @@ async function completeStep(pm, progress, stageName, cwd, outputText, inputText
             : (existsSync(legacyGuardFile) ? JSON.parse(readFileSync(legacyGuardFile, 'utf8')) : null)
         } catch {}
         if (guard) {
-          const review = await auditQuickCompletion(cwd, guard, { isConfirm: confirm })
+          // --done 的 --force-baseline/--allow-new 并入 guard（与 step1 持久化值取或）。
+          // 修复 ql-20260713-002-7628：旧代码解析了这两个 flag 但只传 {isConfirm} 给审计，
+          // 致 --done --force-baseline 静默无效、用户被误导「重跑 --confirm」也无法解锁。
+          const mergedGuard = {
+            ...guard,
+            forceBaseline: guard.forceBaseline || isForceBaseline,
+            allowNew: guard.allowNew || isAllowNew,
+          }
+          const review = await auditQuickCompletion(cwd, mergedGuard, { isConfirm: confirm })
           printQuickAuditReview(review)
           if (review.status === 'blocked') {
             steps[currentIdx].status = 'pending'
@@ -3302,7 +3324,7 @@ async function completeStep(pm, progress, stageName, cwd, outputText, inputText
 
           if (planPath && existsSync(planPath)) {
             const planContent = readFileSync(planPath, 'utf8')
-            const runtimeRoot = join(effectiveSpecBase, '.runtime')
+            const runtimeRoot = platformOpts?.runtimeRoot || join(effectiveSpecBase, '.runtime')
 
             // execute run id：从变更专属标记文件读取
             const runIdFile = join(runtimeRoot, `current-execute-run-id-${changeName}`)

package/src/stage-contract.js

@@ -258,8 +258,21 @@ function validateBrainstormOutputs(cwd, changeName, context = {}) {
     const hasLifecycleKeyword = /\b(session|lease|agent[._-]?run|daemon|lifecycle|state[._-]?transition|claim|heartbeat)\b/i.test(content)
     if (hasLifecycleKeyword) {
       // 显式声明本变更不涉及生命周期契约（覆盖字段名/错误码/否定声明场景）：
-      // 历史教训：design 提到 daemon_id 字段名或 daemon_not_owned 错误码就触发，被迫加空表（B3a）
-      const declaresNotApplicable = /(生命周期|lifecycle)[^\n]{0,40}(n\/?a|不涉及|无|none|not[ _-]?applicable)|(不涉及|无需|没有)[^\n]{0,40}(生命周期|lifecycle)/i.test(content)
+      // 历史教训：design 提到 daemon_id 字段名或 daemon_not_owned 错误码就触发，被迫加空表（B3a）。
+      //
+      // 收紧原则（修：正常 design 不应被误判「已豁免」）：
+      //   - 否定词必须是明确多字短语（不涉及/不适用/未涉及/不包含/没有/n\/a/not applicable/none），
+      //     杜绝裸单字「无」与裸「na」在 40 字符宽窗口内任意命中——
+      //     「lifecycle 状态无变化」「本变更无需 lifecycle 事件」「lifecycle canal 不涉及」等不再误判；
+      //   - 否定词必须与「生命周期(契约)/lifecycle(contract)」紧邻（仅允许少量空白/分隔符/「任何」），
+      //     不再用 40 字符宽松窗口；工具错误信息本身就指引写「不涉及生命周期契约」这个规范短语。
+      const declaresNotApplicable =
+        // 否定在前：「不涉及生命周期(契约)」「不适用 lifecycle contract」
+        /(?:不涉及|不适用|未涉及|不包含|没有(?:任何)?)\s?(?:任何\s?)?(?:生命周期(?:契约)?|lifecycle(?:[ _=-]?contract)?)/i.test(content) ||
+        // 主题在前（表格/列表单元「生命周期契约：不涉及 / N/A / 无」——分隔符强制，杜绝宽窗口）
+        /(?:生命周期(?:契约)?|lifecycle(?:[ _=-]?contract)?)\s?[：:=]\s?(?:不涉及|不适用|未涉及|无|n\/?a\b|not[ _=-]?applicable|none\b)/i.test(content) ||
+        // 英文谓语句：「does not involve / not applicable ... lifecycle」
+        /(?:does[ _-]?not[ _-]?involve|not[ _-]?applicable)[^\n]{0,15}lifecycle/i.test(content)
       if (declaresNotApplicable) {
         warnings.push('design.md 显式声明不涉及生命周期契约 — 已豁免「生命周期契约表」要求')
       } else {