From 740d2c2637126a1eca4c476a59c7057c7950fd77 Mon Sep 17 00:00:00 2001 From: wangjia <809946525@qq.com> Date: Sat, 13 Jun 2026 03:22:30 +0800 Subject: [PATCH] =?UTF-8?q?feat:=20PR=20=E5=AE=A1=E6=A0=B8=E6=B5=81?= =?UTF-8?q?=E7=A8=8B=20+=20=E8=87=AA=E5=8A=A8=E5=90=88=E5=B9=B6=20+=20macO?= =?UTF-8?q?S=20=E9=80=9A=E7=9F=A5=20+=20=E8=AE=A2=E9=98=85=E9=A2=9D?= =?UTF-8?q?=E5=BA=A6=E9=80=8F=E4=BC=A0=20+=20=E5=BD=92=E6=A1=A3=E8=AF=A6?= =?UTF-8?q?=E6=83=85?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR 流程（开发→提PR→CodeReview→安全审计→审核→通过即合并）： - reviewer 拆分为 code review 与安全审计两个独立 CC run（kind=reviewer/security）， TaskResult 四字段(summary/verdict + securitySummary/securityVerdict)，闸上两节报告两枚结论徽章 - executor/merge.ts: 通过即合并——临时 worktree 内 merge --no-ff，绝不碰用户工作区/不 push； 冲突安全拒绝(报冲突文件)；重复合并幂等；合并后回收执行 worktree + 删分支 - decide 路由 merge:false 逃生口 + 看板「仅通过」按钮(目标分支被工作区检出时用) 通知（daemon/notify.ts）： - macOS 原生通知: 进审核闸(复审建议拒绝标⚠)/连续失败需人工/合并完成 - 同任务同类型 60s 抑制、osascript 转义截断、MAESTRO_NOTIFY=0 关闭 订阅额度透传（daemon/usage.ts）： - OAuth usage API(与 Claude Code/claude-hud 同源)，凭证 keychain→内存零泄漏 - 60s 成败双缓存+并发去重+5s 超时，失败降级 null - GET /api/agents 顶层 usage 字段；Agent 面板显示 5h/周用量条+重置倒计时(>80%琥珀/>95%红) 看板与生命周期： - 归档区: 深度1整树完成沉底，时间倒序分页(尺寸 chip 10/20/50/100 置底) - 归档详情对话框: 全属性/执行历史与时长/审批记录/状态流转时间线(GET /api/tasks/:id/events) - 容器收口: 已拆解 Hard 子任务全 done 自动 done(afterDone 逐级向上) - 同步按钮收进配置面板；执行白名单扩测试命令(npm/go/shellcheck/make/pytest) - Agent 面板显示调度模式与各复杂度模型；被依赖阻塞→被阻塞 测试: 74/74(新增 merge 6/notify 10/usage 7/容器收口/双复审适配) Co-Authored-By: Claude Opus 4.8 --- src/api/server.ts | 46 +++++++++- src/daemon/index.ts | 3 + src/daemon/notify.ts | 114 +++++++++++++++++++++++++ src/daemon/orchestrator.ts | 72 +++++++++------- src/daemon/usage.ts | 152 +++++++++++++++++++++++++++++++++ src/executor/merge.ts | 84 +++++++++++++++++++ src/executor/reviewer.ts | 81 ++++++++++++++---- src/model/types.ts | 12 +-- src/store/mappers.ts | 7 +- src/store/schema.sql | 2 +- test/merge.test.ts | 139 ++++++++++++++++++++++++++++++ test/notify.test.ts | 168 +++++++++++++++++++++++++++++++++++++ test/orchestrator.test.ts | 73 +++++++++++++--- test/reviewer.test.ts | 31 +++++-- test/store.test.ts | 2 +- test/usage.test.ts | 104 +++++++++++++++++++++++ web/app.js | 94 ++++++++++++++++----- web/style.css | 16 ++++ 18 files changed, 1102 insertions(+), 98 deletions(-) create mode 100644 src/daemon/notify.ts create mode 100644 src/daemon/usage.ts create mode 100644 src/executor/merge.ts create mode 100644 test/merge.test.ts create mode 100644 test/notify.test.ts create mode 100644 test/usage.test.ts diff --git a/src/api/server.ts b/src/api/server.ts index 6ea6691..2e584d2 100644 --- a/src/api/server.ts +++ b/src/api/server.ts @@ -7,6 +7,9 @@ import type { TaskStatus } from '../model/status.js'; import type { Project, Autonomy } from '../model/types.js'; import { syncProject, hasTodoJson } from '../sync/todo-sync.js'; import { resolvedExecutorModels } from '../executor/models.js'; +import { mergeBranch } from '../executor/merge.js'; +import { git, removeWorktree } from '../executor/worktree.js'; +import { createUsageFetcher, type UsageInfo } from '../daemon/usage.js'; /** Project 出参：附加 hasTodoJson（/todo/todo.json 是否存在，每次序列化时算） */ function projectOut(p: Project): Project & { hasTodoJson: boolean } { @@ -16,6 +19,8 @@ function projectOut(p: Project): Project & { hasTodoJson: boolean } { export interface ApiOptions { store: Store; logger?: boolean; + /** Claude 订阅额度查询（测试注入；默认直连 OAuth usage API，60s 缓存） */ + getUsage?: () => Promise; } /** @@ -75,7 +80,9 @@ export function buildServer(opts: ApiOptions): FastifyInstance { }); // ---------- Agents（每项目一条；active 来自 runs 表 status='started'，执行器 Phase 2 前通常为空） ---------- - app.get('/api/agents', () => { + // usage = Claude 订阅额度（执行 agent 烧的就是这个池子）；查询失败 → null，前端降级显示 + const getUsage = opts.getUsage ?? createUsageFetcher({ log: app.log }); + app.get('/api/agents', async () => { const runs = store.activeRuns(); const byProject = new Map(); for (const r of runs) { @@ -95,7 +102,7 @@ export function buildServer(opts: ApiOptions): FastifyInstance { runId: r.runId, taskId: r.taskId, taskTitle: r.taskTitle, kind: r.kind, startedAt: r.startedAt, })), })); - return { totalActive: runs.length, agents }; + return { totalActive: runs.length, agents, usage: await getUsage() }; }); app.get('/api/projects/:id/tasks', (req) => { @@ -197,10 +204,41 @@ export function buildServer(opts: ApiOptions): FastifyInstance { }); // 审批闸：accept / reject（reject 必带 reason） - app.post('/api/tasks/:id/decide', (req) => { + // exec 闸的 accept = 通过并合并（PR 闭环）：先 merge 再 decide；merge 失败 → 400，任务保留在审核闸。 + app.post('/api/tasks/:id/decide', async (req) => { const { id } = req.params as { id: string }; - const b = req.body as { action?: string; actor?: string; reason?: string | null }; + const b = req.body as { action?: string; actor?: string; reason?: string | null; merge?: boolean }; if (b?.action !== 'accept' && b?.action !== 'reject') throw new StoreError('action 必须是 accept|reject'); + + const task = store.getTask(id); + // merge:false = 仅通过不合并（逃生口：如目标分支正被用户工作区检出导致自动合并不可用） + if (task && task.status === 'exec_review' && b.action === 'accept' && task.result?.branch && b.merge !== false) { + const project = store.getProject(task.projectId); + if (!project) throw new StoreError(`项目不存在: ${task.projectId}`); + const { branch, worktree } = task.result; + const mr = await mergeBranch(project.repoPath, branch, project.defaultBranch, task.id); + if (!mr.ok) throw new StoreError(`合并失败：${mr.error}（任务保留在审核闸）`); + + store.decide(id, 'accept', b.actor ?? 'user', b.reason ?? null); + // 合并产物记录：复用 prUrl 字段写 merged: + store.setResult(id, { ...task.result, prUrl: `merged:${mr.mergeCommit}` }); + // 异步回收：执行 worktree + 已合并的任务分支（失败只记日志，不影响响应） + void (async () => { + try { + if (worktree) await removeWorktree(project.repoPath, worktree); + } catch (e) { + app.log.error(`任务 ${id} 合并后清理 worktree 失败（不影响结果）：${(e as Error).message}`); + } + try { + await git(project.repoPath, ['branch', '-d', branch]); + } catch (e) { + app.log.error(`任务 ${id} 合并后删除分支 ${branch} 失败（不影响结果）：${(e as Error).message}`); + } + })(); + return store.getTask(id); + } + + // 非 exec 闸（或 reject / 无分支结果）：行为完全不变 return store.decide(id, b.action, b.actor ?? 'user', b.reason ?? null); }); diff --git a/src/daemon/index.ts b/src/daemon/index.ts index 47afc5f..82dcc60 100644 --- a/src/daemon/index.ts +++ b/src/daemon/index.ts @@ -5,6 +5,7 @@ import { buildServer, attachWebSocket } from '../api/server.js'; import { registerStatic } from '../api/static.js'; import { loadConfig } from './config.js'; import { startOrchestrator } from './orchestrator.js'; +import { startNotifier } from './notify.js'; import { syncProject, todoJsonPath } from '../sync/todo-sync.js'; /** @@ -65,11 +66,13 @@ async function main(): Promise { const syncTimer = startSyncLoop(store, app); const orchTimer = startOrchestrator(store, app); // 编排器：自动领取可执行任务（MAESTRO_ORCH_INTERVAL 秒，0=关闭） + const stopNotifier = startNotifier(store, app); // macOS 原生通知：审核闸/需人工/合并完成（MAESTRO_NOTIFY=0 关闭） const shutdown = async (): Promise => { app.log.info('收到退出信号，关闭中…'); if (syncTimer) clearInterval(syncTimer); if (orchTimer) clearInterval(orchTimer); + if (stopNotifier) stopNotifier(); await app.close(); store.close(); process.exit(0); diff --git a/src/daemon/notify.ts b/src/daemon/notify.ts new file mode 100644 index 0000000..47bd6c2 --- /dev/null +++ b/src/daemon/notify.ts @@ -0,0 +1,114 @@ +import { execFile } from 'node:child_process'; +import type { Store } from '../store/index.js'; +import type { Event } from '../model/types.js'; + +export interface NotifyLogger { + info(msg: string): void; + error(msg: string): void; +} + +/** osascript 执行函数（测试注入假实现，不真发通知） */ +export type OsascriptFn = (script: string) => void; + +/** 同一任务同类型通知的抑制窗口 */ +export const NOTIFY_SUPPRESS_MS = 60_000; + +const MAX_LEN = 80; + +/** AppleScript 字符串注入防护：去换行、转义反斜杠与双引号，截断 80 字符 */ +export function sanitizeForOsascript(s: string): string { + const oneLine = String(s).replace(/[\r\n]+/g, ' ').trim(); + const cut = oneLine.length > MAX_LEN ? `${oneLine.slice(0, MAX_LEN - 1)}…` : oneLine; + return cut.replace(/\\/g, '\\\\').replace(/"/g, '\\"'); +} + +const GATE_NAME: Record = { plan_review: '拆解', spec_review: '方案', exec_review: 'PR' }; + +interface NotifierOptions { + osascript?: OsascriptFn; + now?: () => number; +} + +/** + * 事件 → 通知文案（不触发的事件返回 null）。kind 用于同任务同类型 60s 抑制。 + * - status.changed → plan/spec/exec_review：「⏳ <任务名> 等待审核（拆解/方案/PR）」； + * exec_review 且复审任一 verdict=reject：「⚠ <任务名> 复审建议拒绝（PR 待审核）」 + * - status.changed → needs_attention：「❌ <任务名> 连续失败需人工」 + * - approval.granted 且 gate=exec：「✅ <任务名> 已合并完成」 + */ +export function buildNotification(store: Store, e: Event): { kind: string; message: string } | null { + if (!e.taskId) return null; + + if (e.type === 'status.changed') { + const to = String(e.payload.to ?? ''); + if (to === 'needs_attention') { + const t = store.getTask(e.taskId); + if (!t) return null; + return { kind: 'attention', message: `❌ ${t.title} 连续失败需人工` }; + } + if (to === 'plan_review' || to === 'spec_review' || to === 'exec_review') { + const t = store.getTask(e.taskId); + if (!t) return null; + if (to === 'exec_review' && (t.result?.verdict === 'reject' || t.result?.securityVerdict === 'reject')) { + return { kind: 'gate', message: `⚠ ${t.title} 复审建议拒绝（PR 待审核）` }; + } + return { kind: 'gate', message: `⏳ ${t.title} 等待审核（${GATE_NAME[to]}）` }; + } + return null; + } + + if (e.type === 'approval.granted' && e.payload.gate === 'exec') { + const t = store.getTask(e.taskId); + if (!t) return null; + return { kind: 'merged', message: `✅ ${t.title} 已合并完成` }; + } + + return null; +} + +/** + * 创建通知器：订阅 store 事件流，符合条件时发 macOS 原生通知（osascript display notification）。 + * 同一任务同类型 60s 内只发一次；osascript 失败只记日志。返回取消订阅函数。 + */ +export function createNotifier(store: Store, log: NotifyLogger, opts: NotifierOptions = {}): () => void { + const now = opts.now ?? Date.now; + const osa: OsascriptFn = opts.osascript ?? ((script) => { + execFile('osascript', ['-e', script], (err) => { + if (err) log.error(`macOS 通知发送失败：${err.message}`); + }); + }); + const lastSent = new Map(); // `${taskId}:${kind}` → 最近发送时刻 + + return store.subscribe((e) => { + try { + const n = buildNotification(store, e); + if (!n) return; + const key = `${e.taskId}:${n.kind}`; + const t = now(); + const prev = lastSent.get(key); + if (prev !== undefined && t - prev < NOTIFY_SUPPRESS_MS) return; + lastSent.set(key, t); + osa(`display notification "${sanitizeForOsascript(n.message)}" with title "maestro"`); + } catch (err) { + log.error(`通知处理失败：${(err as Error).message}`); + } + }); +} + +/** + * 接线入口（照 startSyncLoop 模式）：MAESTRO_NOTIFY=0 关闭；非 macOS 平台不启用。 + * 返回取消订阅函数（shutdown 时调用），未启用时返回 null。 + */ +export function startNotifier(store: Store, app: { log: NotifyLogger }): (() => void) | null { + if (process.env.MAESTRO_NOTIFY === '0') { + app.log.info('macOS 通知已关闭（MAESTRO_NOTIFY=0）'); + return null; + } + if (process.platform !== 'darwin') { + app.log.info('非 macOS 平台，原生通知不启用'); + return null; + } + const stop = createNotifier(store, app.log); + app.log.info('macOS 通知已启用：审核闸/需人工/合并完成（同任务同类型 60s 抑制，MAESTRO_NOTIFY=0 关闭）'); + return stop; +} diff --git a/src/daemon/orchestrator.ts b/src/daemon/orchestrator.ts index 25feded..7487e5a 100644 --- a/src/daemon/orchestrator.ts +++ b/src/daemon/orchestrator.ts @@ -4,7 +4,7 @@ import { rankByScore } from '../model/scoring.js'; import { createWorktree, worktreeDiff, type WorktreeDiff, type WorktreeInfo } from '../executor/worktree.js'; import { runTask, type RunnerFn } from '../executor/runner.js'; import { runVerify, type VerifyFn } from '../executor/verify.js'; -import { reviewTask, type ReviewerFn } from '../executor/reviewer.js'; +import { reviewCode, reviewSecurity, type ReviewerFn } from '../executor/reviewer.js'; import { pickModel } from '../executor/models.js'; /** 失败后最多自动重试次数（重试 2 次 = 最多 3 次执行），之后 → needs_attention */ @@ -18,7 +18,8 @@ export interface OrchestratorLogger { /** 依赖注入点：测试传 mock，生产用真实现 */ export interface OrchestratorDeps { runner: RunnerFn; - reviewer: ReviewerFn; + reviewCode: ReviewerFn; // code review（kind=reviewer 的 run） + reviewSecurity: ReviewerFn; // 安全审计（kind=security 的 run） verify: VerifyFn; createWorktree: (repoPath: string, taskId: string, baseBranch: string) => Promise; worktreeDiff: (repoPath: string, dir: string, branch: string, baseBranch: string) => Promise; @@ -40,7 +41,7 @@ export interface Orchestrator { * 成功 → setResult + exec_review；失败 → failed → 重试 ≤MAX_RETRIES 次 → needs_attention。 */ export function createOrchestrator(store: Store, log: OrchestratorLogger, deps: Partial = {}): Orchestrator { - const d: OrchestratorDeps = { runner: runTask, reviewer: reviewTask, verify: runVerify, createWorktree, worktreeDiff, ...deps }; + const d: OrchestratorDeps = { runner: runTask, reviewCode, reviewSecurity, verify: runVerify, createWorktree, worktreeDiff, ...deps }; const inflight = new Map(); // taskId → projectId const pending = new Set>(); @@ -63,7 +64,39 @@ export function createOrchestrator(store: Store, log: OrchestratorLogger, deps: return rankByScore(candidates, tasks); } - /** 单任务全流程：executing → worktree → run → verify → reviewer(复审，失败不挡) → setResult(summary/verdict) → exec_review / failed(重试) */ + /** 跑一个独立复审 run（kind=reviewer/security）。任何失败折叠为 summary=失败原因、verdict=null，不抛错、不挡任务。 */ + async function runOneReview( + kind: 'reviewer' | 'security', + fn: ReviewerFn, + task: Task, + project: Project, + wt: WorktreeInfo, + executorReport: string, + ): Promise<{ summary: string | null; verdict: ReviewVerdict | null }> { + const label = kind === 'reviewer' ? 'code review' : '安全审计'; + let reviewRunId: string | null = null; + try { + const review = store.startRun(task.id, kind, { worktree: wt.dir, branch: wt.branch }); + reviewRunId = review.id; + log.info(`${label} 任务 ${task.id} run=${review.id} model=${pickModel(task, project, 'reviewer')}`); + const rv = await fn(task, project, wt, review.id, executorReport); + store.finishRun(review.id, 'succeeded', { + transcriptRef: rv.transcriptRef ?? undefined, + claudeSessionId: rv.sessionId ?? undefined, + }); + log.info(`任务 ${task.id} ${label} 完成 verdict=${rv.verdict ?? '（未解析到）'}`); + return { summary: rv.summary, verdict: rv.verdict }; + } catch (e) { + const reMsg = (e as Error).message; + if (reviewRunId) { + try { store.finishRun(reviewRunId, 'failed', { error: reMsg }); } catch { /* 收尾失败不影响主流程 */ } + } + log.error(`任务 ${task.id} ${label} 失败（不挡任务，照常进 exec_review）：${reMsg}`); + return { summary: `自动复审失败：${reMsg}`, verdict: null }; + } + } + + /** 单任务全流程：executing → worktree → run → verify → code review run → 安全审计 run（均失败不挡）→ setResult(四字段) → exec_review / failed(重试) */ async function executeTask(project: Project, task: Task): Promise { let runId: string | null = null; let runClosed = false; @@ -98,36 +131,15 @@ export function createOrchestrator(store: Store, log: OrchestratorLogger, deps: const diff = await d.worktreeDiff(project.repoPath, wt.dir, wt.branch, project.defaultBranch); - // 自动复审（kind=reviewer 的新 run）：失败不挡任务，summary 记失败原因、verdict=null - let summary: string | null = null; - let verdict: ReviewVerdict | null = null; - let reviewRunId: string | null = null; - try { - const review = store.startRun(task.id, 'reviewer', { worktree: wt.dir, branch: wt.branch }); - reviewRunId = review.id; - log.info(`复审任务 ${task.id} run=${review.id} model=${pickModel(task, project, 'reviewer')}`); - const rv = await d.reviewer(task, project, wt, review.id, rr.finalText ?? ''); - summary = rv.summary; - verdict = rv.verdict; - store.finishRun(review.id, 'succeeded', { - transcriptRef: rv.transcriptRef ?? undefined, - claudeSessionId: rv.sessionId ?? undefined, - }); - log.info(`任务 ${task.id} 复审完成 verdict=${verdict ?? '（未解析到）'}`); - } catch (e) { - const reMsg = (e as Error).message; - summary = `自动复审失败：${reMsg}`; - verdict = null; - if (reviewRunId) { - try { store.finishRun(reviewRunId, 'failed', { error: reMsg }); } catch { /* 收尾失败不影响主流程 */ } - } - log.error(`任务 ${task.id} 复审失败（不挡任务，照常进 exec_review）：${reMsg}`); - } + // 双复审（顺序）：code review run（kind=reviewer）→ 安全审计 run（kind=security）。任一失败不挡任务。 + const code = await runOneReview('reviewer', d.reviewCode, task, project, wt, rr.finalText ?? ''); + const sec = await runOneReview('security', d.reviewSecurity, task, project, wt, rr.finalText ?? ''); store.setResult(task.id, { branch: wt.branch, worktree: wt.dir, diffSummary: diff.diffSummary, commits: diff.commits, prUrl: null, - summary, verdict, + summary: code.summary, verdict: code.verdict, + securitySummary: sec.summary, securityVerdict: sec.verdict, }); store.transition(task.id, 'exec_review', { by: 'orchestrator', runId: run.id }); store.finishRun(run.id, 'succeeded', { diff --git a/src/daemon/usage.ts b/src/daemon/usage.ts new file mode 100644 index 0000000..5c7fd07 --- /dev/null +++ b/src/daemon/usage.ts @@ -0,0 +1,152 @@ +import { readFile } from 'node:fs/promises'; +import { execFile } from 'node:child_process'; +import { homedir } from 'node:os'; +import { join } from 'node:path'; + +/** + * Claude 订阅额度（5 小时窗口 + 周窗口）透传。 + * + * 数据源：Anthropic OAuth usage API（GET https://api.anthropic.com/api/oauth/usage， + * Bearer = Claude Code 的 OAuth accessToken）。这正是 Claude Code 喂给 statusline + * `rate_limits` 字段的同一份数据（claude-hud 的 Usage/Weekly 即来源于此）；daemon + * 不在 Claude Code 会话内拿不到 stdin，故直连同一端点。 + * + * 凭证：优先 ~/.claude/.credentials.json（Linux），其次 macOS keychain + * （service "Claude Code-credentials"）。token 只进内存，绝不写日志/响应。 + */ + +export interface UsageWindow { + percent: number; // 0-100 已用百分比 + resetsAt: string | null; // ISO 时间，窗口重置时刻 +} + +export interface UsageInfo { + session: UsageWindow | null; // 5 小时滚动窗口 + weekly: UsageWindow | null; // 7 天窗口 +} + +export interface UsageLogger { + info(msg: string): void; + error(msg: string): void; +} + +export const USAGE_CACHE_MS = 60_000; +export const USAGE_ENDPOINT = 'https://api.anthropic.com/api/oauth/usage'; +const FETCH_TIMEOUT_MS = 5_000; + +export interface UsageDeps { + /** 取 OAuth accessToken（测试注入；返回 null = 凭证不可用）。绝不把返回值写进日志。 */ + readToken?: () => Promise; + fetchFn?: typeof fetch; + now?: () => number; + log?: UsageLogger; +} + +/** 解析凭证 JSON（~/.claude/.credentials.json 与 keychain 存的是同一结构） */ +function tokenFromCredentialJson(raw: string, now: number, log: UsageLogger): string | null { + const j = JSON.parse(raw) as { claudeAiOauth?: { accessToken?: string; expiresAt?: number } }; + const oauth = j.claudeAiOauth; + if (!oauth?.accessToken) return null; + if (typeof oauth.expiresAt === 'number' && oauth.expiresAt <= now) { + log.info('额度查询：OAuth token 已过期（等 Claude Code 刷新后自动恢复）'); + return null; + } + return oauth.accessToken; +} + +/** 默认凭证读取：credentials 文件 → macOS keychain。任何失败返回 null。 */ +async function defaultReadToken(now: number, log: UsageLogger): Promise { + const configDir = process.env.CLAUDE_CONFIG_DIR || join(homedir(), '.claude'); + try { + const raw = await readFile(join(configDir, '.credentials.json'), 'utf8'); + const tok = tokenFromCredentialJson(raw, now, log); + if (tok) return tok; + } catch { + // 文件不存在/不可解析 → 尝试 keychain + } + if (process.platform !== 'darwin') return null; + try { + const raw = await new Promise((resolve, reject) => { + execFile( + 'security', + ['find-generic-password', '-s', 'Claude Code-credentials', '-w'], + { timeout: 3_000 }, + (err, stdout) => (err ? reject(err) : resolve(stdout)), + ); + }); + return tokenFromCredentialJson(raw.trim(), now, log); + } catch { + return null; + } +} + +/** API 响应里的一个窗口 → UsageWindow（缺失/畸形 → null） */ +function parseWindow(v: unknown): UsageWindow | null { + if (!v || typeof v !== 'object') return null; + const w = v as { utilization?: unknown; resets_at?: unknown }; + if (typeof w.utilization !== 'number' || !Number.isFinite(w.utilization)) return null; + return { + percent: Math.round(Math.min(100, Math.max(0, w.utilization))), + resetsAt: typeof w.resets_at === 'string' ? w.resets_at : null, + }; +} + +const noopLog: UsageLogger = { info: () => undefined, error: () => undefined }; + +/** + * 创建 getUsage：60s 内存缓存（成功与失败都缓存，杜绝重试风暴），并发去重（in-flight 共享）。 + * 任何失败（无凭证 / 网络 / 非 200 / 解析失败）→ null + 记日志，绝不抛出。 + */ +export function createUsageFetcher(deps: UsageDeps = {}): () => Promise { + const now = deps.now ?? Date.now; + const fetchFn = deps.fetchFn ?? fetch; + const log = deps.log ?? noopLog; + const readToken = deps.readToken ?? ((): Promise => defaultReadToken(now(), log)); + + let cache: { at: number; value: UsageInfo | null } | null = null; + let inflight: Promise | null = null; + + async function fetchOnce(): Promise { + const token = await readToken(); + if (!token) { + log.info('额度查询：未取到 Claude Code OAuth 凭证，跳过'); + return null; + } + const res = await fetchFn(USAGE_ENDPOINT, { + headers: { + Authorization: `Bearer ${token}`, + 'anthropic-beta': 'oauth-2025-04-20', + 'Content-Type': 'application/json', + }, + signal: AbortSignal.timeout(FETCH_TIMEOUT_MS), + }); + if (!res.ok) { + log.error(`额度查询：usage API 返回 ${res.status}`); + return null; + } + const body = (await res.json()) as { five_hour?: unknown; seven_day?: unknown }; + const session = parseWindow(body.five_hour); + const weekly = parseWindow(body.seven_day); + if (!session && !weekly) { + log.error('额度查询：usage API 响应缺少 five_hour/seven_day 字段'); + return null; + } + return { session, weekly }; + } + + return async function getUsage(): Promise { + if (cache && now() - cache.at < USAGE_CACHE_MS) return cache.value; + if (inflight) return inflight; + inflight = fetchOnce() + .catch((e: unknown) => { + log.error(`额度查询失败：${(e as Error).message}`); // 错误信息不含 token + return null; + }) + .then((value) => { + cache = { at: now(), value }; + inflight = null; + return value; + }); + return inflight; + }; +} diff --git a/src/executor/merge.ts b/src/executor/merge.ts new file mode 100644 index 0000000..5d3a4fb --- /dev/null +++ b/src/executor/merge.ts @@ -0,0 +1,84 @@ +import { mkdirSync, rmSync } from 'node:fs'; +import { dirname, join } from 'node:path'; +import { git, worktreeBase } from './worktree.js'; + +export interface MergeResult { + ok: boolean; + mergeCommit?: string; // 成功时为合并后 defaultBranch 的 HEAD（重复合并时为当前 HEAD，不新建提交） + error?: string; +} + +/** 临时合并 worktree 目录（确定性）：/worktrees/_merge// */ +export function mergeWorktreeDirFor(taskId: string): string { + return join(worktreeBase(), '_merge', taskId); +} + +/** + * 把任务分支合并进 defaultBranch（PR 闭环的"merge"步）。 + * 绝不触碰用户工作区：在 /worktrees/_merge// 临时 git worktree 检出 defaultBranch， + * 在其中 `git merge --no-ff `，成功后删除临时 worktree。不 push。 + * 全部 execFile('git')（见 worktree.ts 的 git()），不走 shell。 + * + * 边界： + * - 分支不存在（已删/已清理）→ {ok:false, error} + * - defaultBranch 正被用户工作区检出 → git worktree add 失败 → {ok:false, error}（宁可失败也不动用户检出） + * - 冲突 → `git merge --abort` 后清理临时 worktree，error 含冲突文件列表；defaultBranch 与任务分支均无损 + * - 重复合并（分支已在 defaultBranch 里）→ git 返回 Already up to date，ok:true、不新建提交 + */ +export async function mergeBranch( + repoPath: string, + branch: string, + defaultBranch: string, + taskId: string, +): Promise { + // 0) 分支必须存在 + try { + await git(repoPath, ['rev-parse', '--verify', '--quiet', `refs/heads/${branch}`]); + } catch { + return { ok: false, error: `任务分支不存在：${branch}（可能已被删除或清理）` }; + } + + // 1) 清理残留的临时合并 worktree（上次中断/失败遗留），再新建 + const dir = mergeWorktreeDirFor(taskId); + await git(repoPath, ['worktree', 'prune']).catch(() => undefined); + await git(repoPath, ['worktree', 'remove', '--force', dir]).catch(() => undefined); + rmSync(dir, { recursive: true, force: true }); + mkdirSync(dirname(dir), { recursive: true }); + + try { + await git(repoPath, ['worktree', 'add', dir, defaultBranch]); + } catch (e) { + const msg = (e as Error).message; + if (/already checked out|already used by worktree/i.test(msg)) { + return { + ok: false, + error: `默认分支 ${defaultBranch} 正被某个工作区检出，无法在临时 worktree 合并（不会改动你的检出）；请先把该工作区切到其他分支`, + }; + } + return { ok: false, error: `创建临时合并 worktree 失败：${msg}` }; + } + + try { + // 2) 合并（--no-ff：保留任务分支的合并节点） + await git(dir, [ + '-c', 'user.name=maestro', '-c', 'user.email=maestro@local', + 'merge', '--no-ff', branch, '-m', `merge: ${branch} [${taskId}]`, + ]); + const mergeCommit = (await git(dir, ['rev-parse', 'HEAD'])).trim(); + return { ok: true, mergeCommit }; + } catch (e) { + // 3) 冲突/失败：收集冲突文件 → abort → 返回错误（defaultBranch 与任务分支无损） + let conflicted = ''; + try { + conflicted = (await git(dir, ['diff', '--name-only', '--diff-filter=U'])).trim(); + } catch { /* 收集失败不影响报错 */ } + await git(dir, ['merge', '--abort']).catch(() => undefined); + const files = conflicted ? `；冲突文件：${conflicted.split('\n').join('、')}` : ''; + return { ok: false, error: `${(e as Error).message}${files}` }; + } finally { + // 4) 无论成败都清理临时 worktree + await git(repoPath, ['worktree', 'remove', '--force', dir]).catch(() => undefined); + await git(repoPath, ['worktree', 'prune']).catch(() => undefined); + rmSync(dir, { recursive: true, force: true }); + } +} diff --git a/src/executor/reviewer.ts b/src/executor/reviewer.ts index 4f49bc9..f8699d4 100644 --- a/src/executor/reviewer.ts +++ b/src/executor/reviewer.ts @@ -3,6 +3,9 @@ import type { WorktreeInfo } from './worktree.js'; import { runClaude } from './cc.js'; import { pickModel } from './models.js'; +/** 复审角色：code（code review）/ security（安全审计）。两者共用 models.ts 的 reviewer 模型映射。 */ +export type ReviewRole = 'code' | 'security'; + export interface ReviewResult { summary: string; // 最终文本去掉 VERDICT 行（markdown） verdict: ReviewVerdict | null; // 解析不到 = null @@ -10,7 +13,7 @@ export interface ReviewResult { sessionId: string | null; } -/** 复审函数签名（orchestrator 依赖注入点；测试传 mock，生产传 reviewTask）。失败时抛错，由 orchestrator 兜底。 */ +/** 复审函数签名（orchestrator 依赖注入点；测试传 mock，生产传 reviewCode/reviewSecurity）。失败时抛错，由 orchestrator 兜底。 */ export type ReviewerFn = ( task: Task, project: Project, @@ -22,14 +25,53 @@ export type ReviewerFn = ( const REVIEW_MAX_TURNS = 40; const REVIEW_TIMEOUT_MS = 15 * 60_000; // 15min -/** 组装复审提示词：任务说明 + 执行者自述 + 审 diff + 固定模板输出 */ -export function buildReviewPrompt(task: Task, project: Project, worktree: WorktreeInfo, executorReport: string): string { +/** 各角色的开场白 + 固定输出模板 */ +const ROLE_TEXT: Record = { + code: { + title: '复审任务', + intro: '你是独立的代码复审员。一个执行 agent 刚在当前 git worktree 完成了下述任务，请你复审它的改动。', + template: [ + '## 做了什么', + '## 怎么做的', + '## 测试情况（有没有测试、跑了没有、结果如何；无测试体系则说明为什么不适用）', + '## Code Review（正确性/可维护性问题，逐条带文件:行号）', + '## 结论', + '（建议通过 或 建议拒绝；拒绝必须给出理由与改进方案）', + 'VERDICT: approve|reject', + ], + }, + security: { + title: '安全审计任务', + intro: '你是独立的安全审计员。一个执行 agent 刚在当前 git worktree 完成了下述任务，请你只从安全角度审计它的改动。', + template: [ + '## 安全审计', + '### 凭证与密钥泄露（硬编码 token/密码/私钥、误提交的敏感文件）', + '### 注入与危险命令（shell/SQL/路径注入、eval、不受控的命令拼接）', + '### 权限与边界（越权读写、worktree 之外的副作用、过宽的白名单）', + '### UI 文案红线词（面向用户文案中的违规/敏感表述）', + '### 生产部署风险（影响线上服务、不可回滚操作、配置误伤）', + '## 结论', + '（建议通过 或 建议拒绝；拒绝必须给出理由与改进方案）', + 'VERDICT: approve|reject', + ], + }, +}; + +/** 组装复审提示词：任务说明 + 执行者自述 + 审 diff + 按角色的固定模板输出 */ +export function buildReviewPrompt( + role: ReviewRole, + task: Task, + project: Project, + worktree: WorktreeInfo, + executorReport: string, +): string { const body = task.operations ?? task.spec ?? task.plan ?? ''; + const rt = ROLE_TEXT[role]; return [ - `# 复审任务：${task.title}`, + `# ${rt.title}：${task.title}`, `任务 ID：${task.id}`, '', - '你是独立的代码复审员。一个执行 agent 刚在当前 git worktree 完成了下述任务，请你复审它的改动。', + rt.intro, '', '## 任务原始要求', body || '（无详细说明，以标题为准）', @@ -44,14 +86,7 @@ export function buildReviewPrompt(task: Task, project: Project, worktree: Worktr '', '## 输出格式（最终回复必须严格按此模板，markdown）', '```', - '## 做了什么', - '## 怎么做的', - '## 测试情况（有没有测试、跑了没有、结果如何；无测试体系则说明为什么不适用）', - '## Code Review（正确性/可维护性问题，逐条带文件:行号）', - '## 安全 Review（凭证泄露/注入/权限/危险操作；本项目还需检查 UI 文案红线词与生产部署安全）', - '## 结论', - '（建议通过 或 建议拒绝；拒绝必须给出理由与改进方案）', - 'VERDICT: approve|reject', + ...rt.template, '```', '- 最后一行必须是单独一行 `VERDICT: approve` 或 `VERDICT: reject`（机器解析用，不要带其他内容）。', ].join('\n'); @@ -77,10 +112,11 @@ export function parseVerdict(text: string): { summary: string; verdict: ReviewVe } /** - * 执行后自动复审：在 worktree 内再起一个只读 headless CC，审 diff 并产出固定模板 summary + verdict。 + * 通用复审：在 worktree 内再起一个只读 headless CC，审 diff 并产出按角色模板的 summary + verdict。 * 转录写 /.jsonl。失败抛错（orchestrator 兜底，不挡任务）。 */ -export async function reviewTask( +export async function runReview( + role: ReviewRole, task: Task, project: Project, worktree: WorktreeInfo, @@ -89,7 +125,7 @@ export async function reviewTask( ): Promise { const model = pickModel(task, project, 'reviewer'); const cc = await runClaude({ - prompt: buildReviewPrompt(task, project, worktree, executorReport), + prompt: buildReviewPrompt(role, task, project, worktree, executorReport), cwd: worktree.dir, model, runId, @@ -103,9 +139,18 @@ export async function reviewTask( ], }); - if (!cc.ok) throw new Error(cc.error ?? '复审执行失败'); - if (!cc.finalText.trim()) throw new Error('复审未产出最终文本'); + const label = role === 'code' ? '复审' : '安全审计'; + if (!cc.ok) throw new Error(cc.error ?? `${label}执行失败`); + if (!cc.finalText.trim()) throw new Error(`${label}未产出最终文本`); const { summary, verdict } = parseVerdict(cc.finalText); return { summary, verdict, transcriptRef: cc.transcriptRef, sessionId: cc.sessionId }; } + +/** code review 入口（kind=reviewer 的 run） */ +export const reviewCode: ReviewerFn = (task, project, worktree, runId, executorReport) => + runReview('code', task, project, worktree, runId, executorReport); + +/** 安全审计入口（kind=security 的 run） */ +export const reviewSecurity: ReviewerFn = (task, project, worktree, runId, executorReport) => + runReview('security', task, project, worktree, runId, executorReport); diff --git a/src/model/types.ts b/src/model/types.ts index 72f13f8..a1186aa 100644 --- a/src/model/types.ts +++ b/src/model/types.ts @@ -40,9 +40,11 @@ export interface TaskResult { worktree: string | null; diffSummary: string | null; commits: string[]; - prUrl: string | null; - summary: string | null; // 复审 summary（markdown），旧数据缺省 null - verdict: ReviewVerdict | null; // 复审结论，解析不到 / 复审失败 = null + prUrl: string | null; // 合并后写 merged:（复用字段记录合并产物） + summary: string | null; // code review 报告（markdown），旧数据缺省 null + verdict: ReviewVerdict | null; // code review 结论，解析不到 / 复审失败 = null + securitySummary: string | null; // 安全审计报告（markdown），旧数据缺省 null + securityVerdict: ReviewVerdict | null; // 安全审计结论，解析不到 / 审计失败 = null } export interface Task { @@ -66,13 +68,13 @@ export interface Task { updatedAt: string; } -export type RunKind = 'planner' | 'executor' | 'reviewer'; +export type RunKind = 'planner' | 'executor' | 'reviewer' | 'security'; export type RunStatus = 'started' | 'succeeded' | 'failed' | 'cancelled'; export interface Run { id: Id; taskId: Id; - kind: RunKind; // planner（产出拆解/方案）| executor（执行改动）| reviewer（执行后自动复审） + kind: RunKind; // planner（产出拆解/方案）| executor（执行改动）| reviewer（code review）| security（安全审计） worktree: string | null; branch: string | null; status: RunStatus; diff --git a/src/store/mappers.ts b/src/store/mappers.ts index 1f8036d..47c4fd6 100644 --- a/src/store/mappers.ts +++ b/src/store/mappers.ts @@ -39,9 +39,10 @@ export function rowToProject(r: ProjectRow): Project { }; } -/** 旧 result JSON 兜底：summary/verdict 是后加字段，老数据缺省补 null */ +/** 旧 result JSON 兜底：summary/verdict/securitySummary/securityVerdict 是后加字段，老数据缺省补 null */ function parseResult(json: string): TaskResult { const raw = JSON.parse(json) as Partial; + const verdict = (v: unknown): TaskResult['verdict'] => (v === 'approve' || v === 'reject' ? v : null); return { branch: raw.branch ?? null, worktree: raw.worktree ?? null, @@ -49,7 +50,9 @@ function parseResult(json: string): TaskResult { commits: raw.commits ?? [], prUrl: raw.prUrl ?? null, summary: raw.summary ?? null, - verdict: raw.verdict === 'approve' || raw.verdict === 'reject' ? raw.verdict : null, + verdict: verdict(raw.verdict), + securitySummary: raw.securitySummary ?? null, + securityVerdict: verdict(raw.securityVerdict), }; } diff --git a/src/store/schema.sql b/src/store/schema.sql index 929468c..8f1eebb 100644 --- a/src/store/schema.sql +++ b/src/store/schema.sql @@ -53,7 +53,7 @@ CREATE INDEX IF NOT EXISTS idx_approvals_task ON approvals(task_id, at); CREATE TABLE IF NOT EXISTS runs ( id TEXT PRIMARY KEY, task_id TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE, - kind TEXT NOT NULL, -- planner | executor + kind TEXT NOT NULL, -- planner | executor | reviewer | security worktree TEXT, branch TEXT, status TEXT NOT NULL, -- started | succeeded | failed | cancelled diff --git a/test/merge.test.ts b/test/merge.test.ts new file mode 100644 index 0000000..3d57fa5 --- /dev/null +++ b/test/merge.test.ts @@ -0,0 +1,139 @@ +import { test } from 'node:test'; +import assert from 'node:assert/strict'; +import { execFileSync } from 'node:child_process'; +import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'; +import { tmpdir } from 'node:os'; +import { join } from 'node:path'; +import { mergeBranch, mergeWorktreeDirFor } from '../src/executor/merge.js'; + +function gitSync(cwd: string, args: string[]): string { + return execFileSync('git', args, { cwd, encoding: 'utf8' }); +} + +/** /tmp 下建一个带 1 个 commit 的真实 git repo（main 分支） */ +function makeRepo(): string { + const repo = mkdtempSync(join(tmpdir(), 'maestro-merge-repo-')); + gitSync(repo, ['init', '-b', 'main']); + gitSync(repo, ['config', 'user.name', 'maestro-test']); + gitSync(repo, ['config', 'user.email', 'test@maestro.local']); + writeFileSync(join(repo, 'README.md'), '# demo\n'); + gitSync(repo, ['add', '-A']); + gitSync(repo, ['commit', '-m', 'init']); + return repo; +} + +function commitFile(repo: string, file: string, content: string, msg: string): void { + writeFileSync(join(repo, file), content); + gitSync(repo, ['add', '-A']); + gitSync(repo, ['commit', '-m', msg]); +} + +/** 每个用例独立的 dataDir + repo，t.after 收尾（不碰 ~/.maestro） */ +function setup(t: { after: (fn: () => void) => void }): string { + const dataDir = mkdtempSync(join(tmpdir(), 'maestro-merge-data-')); + const prevDataDir = process.env.MAESTRO_DATA_DIR; + process.env.MAESTRO_DATA_DIR = dataDir; + const repo = makeRepo(); + t.after(() => { + if (prevDataDir === undefined) delete process.env.MAESTRO_DATA_DIR; + else process.env.MAESTRO_DATA_DIR = prevDataDir; + rmSync(dataDir, { recursive: true, force: true }); + rmSync(repo, { recursive: true, force: true }); + }); + return repo; +} + +/** 临时合并 worktree 已彻底清理：目录不存在 + git worktree list 无 _merge */ +function assertMergeWorktreeCleaned(repo: string, taskId: string): void { + assert.ok(!existsSync(mergeWorktreeDirFor(taskId)), '临时合并 worktree 目录应被删除'); + const list = gitSync(repo, ['worktree', 'list']); + assert.ok(!list.includes('_merge'), `git worktree list 不应再含 _merge：${list}`); +} + +test('mergeBranch：可 ff 的分支也产出 --no-ff 合并提交，main 前进、临时 worktree 清理', async (t) => { + const repo = setup(t); + gitSync(repo, ['checkout', '-b', 'maestro/tsk_ff']); + commitFile(repo, 'a.txt', 'A\n', 'maestro(tsk_ff): add a'); + gitSync(repo, ['switch', '--detach']); // 让 main 不被任何工作区检出 + + const r = await mergeBranch(repo, 'maestro/tsk_ff', 'main', 'tsk_ff'); + assert.equal(r.ok, true, r.error); + assert.ok(r.mergeCommit); + assert.equal(gitSync(repo, ['rev-parse', 'main']).trim(), r.mergeCommit); + // --no-ff：合并提交有 2 个父 + const parents = gitSync(repo, ['rev-list', '--parents', '-n', '1', 'main']).trim().split(/\s+/); + assert.equal(parents.length, 3, '应是双亲合并提交（--no-ff）'); + assert.match(gitSync(repo, ['log', '-1', '--format=%s', 'main']), /merge: maestro\/tsk_ff \[tsk_ff\]/); + assert.equal(gitSync(repo, ['show', 'main:a.txt']), 'A\n'); + assertMergeWorktreeCleaned(repo, 'tsk_ff'); +}); + +test('mergeBranch：分叉历史（非 ff）无冲突合并成功，两边改动都在', async (t) => { + const repo = setup(t); + gitSync(repo, ['checkout', '-b', 'maestro/tsk_div']); + commitFile(repo, 'b.txt', 'B\n', 'maestro(tsk_div): add b'); + gitSync(repo, ['checkout', 'main']); + commitFile(repo, 'c.txt', 'C\n', 'main: add c'); // main 也前进 → 分叉 + gitSync(repo, ['switch', '--detach']); + + const r = await mergeBranch(repo, 'maestro/tsk_div', 'main', 'tsk_div'); + assert.equal(r.ok, true, r.error); + assert.equal(gitSync(repo, ['rev-parse', 'main']).trim(), r.mergeCommit); + assert.equal(gitSync(repo, ['show', 'main:b.txt']), 'B\n'); + assert.equal(gitSync(repo, ['show', 'main:c.txt']), 'C\n'); + assertMergeWorktreeCleaned(repo, 'tsk_div'); +}); + +test('mergeBranch：冲突 → 返回错误含冲突文件列表，main 与用户分支均无损，临时 worktree 清理', async (t) => { + const repo = setup(t); + gitSync(repo, ['checkout', '-b', 'maestro/tsk_cf']); + commitFile(repo, 'README.md', '# demo\nbranch version\n', 'maestro(tsk_cf): edit readme'); + gitSync(repo, ['checkout', 'main']); + commitFile(repo, 'README.md', '# demo\nmain version\n', 'main: edit readme'); + gitSync(repo, ['switch', '--detach']); + const mainBefore = gitSync(repo, ['rev-parse', 'main']).trim(); + const branchBefore = gitSync(repo, ['rev-parse', 'maestro/tsk_cf']).trim(); + + const r = await mergeBranch(repo, 'maestro/tsk_cf', 'main', 'tsk_cf'); + assert.equal(r.ok, false); + assert.match(r.error ?? '', /README\.md/, `错误应含冲突文件列表：${r.error}`); + // 双方无损 + assert.equal(gitSync(repo, ['rev-parse', 'main']).trim(), mainBefore, 'main 应无损'); + assert.equal(gitSync(repo, ['rev-parse', 'maestro/tsk_cf']).trim(), branchBefore, '用户分支应无损'); + assertMergeWorktreeCleaned(repo, 'tsk_cf'); +}); + +test('mergeBranch：分支不存在（已删）→ 明确错误', async (t) => { + const repo = setup(t); + gitSync(repo, ['switch', '--detach']); + const r = await mergeBranch(repo, 'maestro/tsk_gone', 'main', 'tsk_gone'); + assert.equal(r.ok, false); + assert.match(r.error ?? '', /分支不存在/); +}); + +test('mergeBranch：defaultBranch 正被工作区检出 → 失败且不动用户检出', async (t) => { + const repo = setup(t); // main 仍在主工作区检出 + gitSync(repo, ['branch', 'maestro/tsk_co']); // 分支存在但 main 被占用 + const mainBefore = gitSync(repo, ['rev-parse', 'main']).trim(); + + const r = await mergeBranch(repo, 'maestro/tsk_co', 'main', 'tsk_co'); + assert.equal(r.ok, false); + assert.match(r.error ?? '', /检出/, `应提示 defaultBranch 被检出：${r.error}`); + assert.equal(gitSync(repo, ['rev-parse', 'main']).trim(), mainBefore); + assert.equal(gitSync(repo, ['rev-parse', '--abbrev-ref', 'HEAD']).trim(), 'main', '用户检出不应被切走'); + assertMergeWorktreeCleaned(repo, 'tsk_co'); +}); + +test('mergeBranch：重复合并（分支已在 main 里）→ ok，不新建提交', async (t) => { + const repo = setup(t); + gitSync(repo, ['checkout', '-b', 'maestro/tsk_re']); + commitFile(repo, 'd.txt', 'D\n', 'maestro(tsk_re): add d'); + gitSync(repo, ['switch', '--detach']); + + const first = await mergeBranch(repo, 'maestro/tsk_re', 'main', 'tsk_re'); + assert.equal(first.ok, true, first.error); + const second = await mergeBranch(repo, 'maestro/tsk_re', 'main', 'tsk_re'); + assert.equal(second.ok, true, second.error); + assert.equal(second.mergeCommit, first.mergeCommit, '重复合并不应产生新提交（Already up to date）'); + assertMergeWorktreeCleaned(repo, 'tsk_re'); +}); diff --git a/test/notify.test.ts b/test/notify.test.ts new file mode 100644 index 0000000..824b8a2 --- /dev/null +++ b/test/notify.test.ts @@ -0,0 +1,168 @@ +import { test } from 'node:test'; +import assert from 'node:assert/strict'; +import { Store } from '../src/store/index.js'; +import { createNotifier, startNotifier, sanitizeForOsascript, NOTIFY_SUPPRESS_MS } from '../src/daemon/notify.js'; + +const noopLog = { info: (): void => undefined, error: (): void => undefined }; + +function setup(): { store: Store; projectId: string } { + const store = new Store(':memory:'); + const p = store.createProject({ name: 'notify', repoPath: '/tmp/notify-repo-' + Math.random() }); + return { store, projectId: p.id }; +} + +/** 注入假 osascript：捕获脚本文本，不真发通知 */ +function capture(store: Store, now?: () => number): { scripts: string[]; stop: () => void } { + const scripts: string[] = []; + const stop = createNotifier(store, noopLog, { osascript: (s) => scripts.push(s), ...(now ? { now } : {}) }); + return { scripts, stop }; +} + +const emptyResult = { + branch: 'maestro/x', worktree: '/wt', diffSummary: null, commits: [], prUrl: null, + summary: null, verdict: null, securitySummary: null, securityVerdict: null, +} as const; + +test('notify：进入 spec_review 闸 →「等待审核（方案）」；与任务名一致', () => { + const { store, projectId } = setup(); + const t = store.createTask({ projectId, title: '写登录方案', complexity: 'medium' }); + const { scripts } = capture(store); + store.setSpec(t.id, '方案'); + store.transition(t.id, 'spec_review'); + assert.equal(scripts.length, 1); + assert.match(scripts[0], /display notification "⏳ 写登录方案 等待审核（方案）" with title "maestro"/); + store.close(); +}); + +test('notify：exec_review 且任一复审 verdict=reject → 文案改「复审建议拒绝」', () => { + const { store, projectId } = setup(); + const t = store.createTask({ projectId, title: '高危改动', complexity: 'easy' }); + store.transition(t.id, 'queued'); + store.transition(t.id, 'executing'); + store.setResult(t.id, { ...emptyResult, securityVerdict: 'reject' }); + const { scripts } = capture(store); + store.transition(t.id, 'exec_review'); + assert.equal(scripts.length, 1); + assert.match(scripts[0], /⚠ 高危改动 复审建议拒绝/); + store.close(); +}); + +test('notify：exec_review 复审均通过 →「等待审核（PR）」', () => { + const { store, projectId } = setup(); + const t = store.createTask({ projectId, title: '普通改动', complexity: 'easy' }); + store.transition(t.id, 'queued'); + store.transition(t.id, 'executing'); + store.setResult(t.id, { ...emptyResult, verdict: 'approve', securityVerdict: 'approve' }); + const { scripts } = capture(store); + store.transition(t.id, 'exec_review'); + assert.equal(scripts.length, 1); + assert.match(scripts[0], /⏳ 普通改动 等待审核（PR）/); + store.close(); +}); + +test('notify：needs_attention →「连续失败需人工」', () => { + const { store, projectId } = setup(); + const t = store.createTask({ projectId, title: '坏任务', complexity: 'easy' }); + store.transition(t.id, 'queued'); + store.transition(t.id, 'executing'); + store.transition(t.id, 'failed'); + const { scripts } = capture(store); + store.transition(t.id, 'needs_attention'); + assert.equal(scripts.length, 1); + assert.match(scripts[0], /❌ 坏任务 连续失败需人工/); + store.close(); +}); + +test('notify：approval.granted 且 gate=exec →「已合并完成」；plan/spec 闸通过不通知', () => { + const { store, projectId } = setup(); + // spec 闸 accept：不触发"已合并完成" + const m = store.createTask({ projectId, title: '方案任务', complexity: 'medium' }); + store.setSpec(m.id, 'spec'); + store.transition(m.id, 'spec_review'); + // exec 闸 accept：触发 + const e = store.createTask({ projectId, title: '执行任务', complexity: 'easy' }); + store.transition(e.id, 'queued'); + store.transition(e.id, 'executing'); + store.setResult(e.id, { ...emptyResult }); + store.transition(e.id, 'exec_review'); + + const { scripts } = capture(store); + store.decide(m.id, 'accept', 'user'); // spec 闸 → 无"合并完成"通知 + store.decide(e.id, 'accept', 'user'); // exec 闸 → 通知 + const merged = scripts.filter((s) => s.includes('已合并完成')); + assert.equal(merged.length, 1); + assert.match(merged[0], /✅ 执行任务 已合并完成/); + store.close(); +}); + +test('notify：事件过滤——ready/queued/executing 等普通流转不通知', () => { + const { store, projectId } = setup(); + const t = store.createTask({ projectId, title: '安静任务', complexity: 'easy' }); + const { scripts } = capture(store); + store.transition(t.id, 'queued'); + store.transition(t.id, 'executing'); + store.transition(t.id, 'failed'); + store.transition(t.id, 'queued'); + assert.equal(scripts.length, 0); + store.close(); +}); + +test('notify：同任务同类型 60s 抑制；超窗后再发；不同任务不互相抑制', () => { + const { store, projectId } = setup(); + const t = store.createTask({ projectId, title: '反复任务', complexity: 'medium' }); + const t2 = store.createTask({ projectId, title: '另一个', complexity: 'medium' }); + let fakeNow = 1_000_000; + const { scripts } = capture(store, () => fakeNow); + + store.setSpec(t.id, 's1'); + store.transition(t.id, 'spec_review'); // 第 1 次：发 + assert.equal(scripts.length, 1); + + store.decide(t.id, 'reject', 'user', '再改改'); // 回 speccing（approval.rejected 不通知） + fakeNow += 30_000; + store.transition(t.id, 'spec_review'); // 30s 内同类型：抑制 + assert.equal(scripts.length, 1); + + store.setSpec(t2.id, 's2'); + store.transition(t2.id, 'spec_review'); // 不同任务：不受抑制 + assert.equal(scripts.length, 2); + + store.decide(t.id, 'reject', 'user', '还得改'); + fakeNow += NOTIFY_SUPPRESS_MS; // 距上次该任务通知已 >60s + store.transition(t.id, 'spec_review'); + assert.equal(scripts.length, 3); + store.close(); +}); + +test('notify：取消订阅后不再收到通知', () => { + const { store, projectId } = setup(); + const t = store.createTask({ projectId, title: '退订', complexity: 'medium' }); + const { scripts, stop } = capture(store); + stop(); + store.setSpec(t.id, 's'); + store.transition(t.id, 'spec_review'); + assert.equal(scripts.length, 0); + store.close(); +}); + +test('notify：MAESTRO_NOTIFY=0 时 startNotifier 不启用', () => { + const { store } = setup(); + const prev = process.env.MAESTRO_NOTIFY; + process.env.MAESTRO_NOTIFY = '0'; + try { + assert.equal(startNotifier(store, { log: noopLog }), null); + } finally { + if (prev === undefined) delete process.env.MAESTRO_NOTIFY; + else process.env.MAESTRO_NOTIFY = prev; + store.close(); + } +}); + +test('sanitizeForOsascript：转义引号反斜杠、去换行、截断 80 字符', () => { + assert.equal(sanitizeForOsascript('say "hi" \\ ok'), 'say \\"hi\\" \\\\ ok'); + assert.equal(sanitizeForOsascript('一行\n两行\r\n三行'), '一行 两行 三行'); + const long = 'x'.repeat(200); + const cut = sanitizeForOsascript(long); + assert.equal(cut.length, 80); + assert.ok(cut.endsWith('…')); +}); diff --git a/test/orchestrator.test.ts b/test/orchestrator.test.ts index 08c9da6..f5e1a9d 100644 --- a/test/orchestrator.test.ts +++ b/test/orchestrator.test.ts @@ -23,6 +23,13 @@ const okReview: ReviewResult = { sessionId: 'sess-review-1', }; +const okSecurity: ReviewResult = { + summary: '## 安全审计\nmock 审计通过', + verdict: 'approve', + transcriptRef: '/tmp/fake-security.jsonl', + sessionId: 'sess-security-1', +}; + /** 全 mock 依赖（不真起 CC、不动 git）：可按用例覆盖 */ function mockDeps(overrides: Partial = {}): OrchestratorDeps { return { @@ -30,7 +37,8 @@ function mockDeps(overrides: Partial = {}): OrchestratorDeps { worktreeDiff: async () => ({ diffSummary: ' README.md | 1 +', commits: ['abc1234 hello maestro'] }), verify: async () => ({ ok: true, exitCode: 0, logRef: null }), runner: async () => okRun, - reviewer: async () => okReview, + reviewCode: async () => okReview, + reviewSecurity: async () => okSecurity, ...overrides, }; } @@ -140,7 +148,7 @@ test('concurrency=1：同项目同轮只领 1 个，跑完下一轮再领', asyn store.close(); }); -test('成功路径：状态流转 + setResult(含复审 summary/verdict) + 双 run succeeded', async () => { +test('成功路径：状态流转 + setResult(四字段) + executor/reviewer/security 三 run succeeded', async () => { const { store, projectId } = setup('auto-easy'); const t = store.createTask({ projectId, title: 'tweak', complexity: 'easy' }); store.setOperations(t.id, '在 README.md 追加一行'); @@ -148,12 +156,17 @@ test('成功路径：状态流转 + setResult(含复审 summary/verdict) + 双 r const seen: string[] = []; store.subscribe((e) => { if (e.type === 'status.changed' && e.taskId === t.id) seen.push(String(e.payload.to)); }); - let reportSeen: string | null = null; + let codeReportSeen: string | null = null; + let secReportSeen: string | null = null; const orch = createOrchestrator(store, noopLog, mockDeps({ - reviewer: async (_task, _project, _wt, _runId, executorReport) => { - reportSeen = executorReport; + reviewCode: async (_task, _project, _wt, _runId, executorReport) => { + codeReportSeen = executorReport; return okReview; }, + reviewSecurity: async (_task, _project, _wt, _runId, executorReport) => { + secReportSeen = executorReport; + return okSecurity; + }, })); orch.tick(); await orch.drain(); @@ -169,11 +182,14 @@ test('成功路径：状态流转 + setResult(含复审 summary/verdict) + 双 r prUrl: null, summary: '## 做了什么\nmock 复审通过', verdict: 'approve', + securitySummary: '## 安全审计\nmock 审计通过', + securityVerdict: 'approve', }); - assert.equal(reportSeen, '执行自述：改了 README'); // runner finalText 传给 reviewer 作执行者自述 + assert.equal(codeReportSeen, '执行自述：改了 README'); // runner finalText 传给两个复审作执行者自述 + assert.equal(secReportSeen, '执行自述：改了 README'); const runs = store.listRuns(t.id); - assert.equal(runs.length, 2); + assert.equal(runs.length, 3); const executor = runs.find((r) => r.kind === 'executor')!; assert.equal(executor.status, 'succeeded'); assert.equal(executor.branch, `maestro/${t.id}`); @@ -183,14 +199,19 @@ test('成功路径：状态流转 + setResult(含复审 summary/verdict) + 双 r assert.equal(reviewer.status, 'succeeded'); assert.equal(reviewer.transcriptRef, '/tmp/fake-review.jsonl'); assert.equal(reviewer.claudeSessionId, 'sess-review-1'); + const security = runs.find((r) => r.kind === 'security')!; + assert.equal(security.status, 'succeeded'); + assert.equal(security.transcriptRef, '/tmp/fake-security.jsonl'); + assert.equal(security.claudeSessionId, 'sess-security-1'); store.close(); }); -test('reviewer verdict=reject 也照常落进 result（最终裁决仍归用户）', async () => { +test('任一 verdict=reject 也照常落进 result（最终裁决仍归用户）', async () => { const { store, projectId } = setup('auto-easy'); const t = store.createTask({ projectId, title: 'risky', complexity: 'easy' }); const orch = createOrchestrator(store, noopLog, mockDeps({ - reviewer: async () => ({ ...okReview, summary: '发现问题', verdict: 'reject' as const }), + reviewCode: async () => ({ ...okReview, summary: '发现问题', verdict: 'reject' as const }), + reviewSecurity: async () => ({ ...okSecurity, summary: '发现密钥泄露', verdict: 'reject' as const }), })); orch.tick(); await orch.drain(); @@ -198,14 +219,16 @@ test('reviewer verdict=reject 也照常落进 result（最终裁决仍归用户 assert.equal(done.status, 'exec_review'); assert.equal(done.result!.verdict, 'reject'); assert.equal(done.result!.summary, '发现问题'); + assert.equal(done.result!.securityVerdict, 'reject'); + assert.equal(done.result!.securitySummary, '发现密钥泄露'); store.close(); }); -test('复审失败不挡任务：照常进 exec_review，summary 记失败原因、verdict=null', async () => { +test('code review 失败不挡任务：summary 记失败原因、verdict=null，安全审计照常跑', async () => { const { store, projectId } = setup('auto-easy'); const t = store.createTask({ projectId, title: 'review-broken', complexity: 'easy' }); const orch = createOrchestrator(store, noopLog, mockDeps({ - reviewer: async () => { throw new Error('复审 CC 崩了'); }, + reviewCode: async () => { throw new Error('复审 CC 崩了'); }, })); orch.tick(); await orch.drain(); @@ -214,12 +237,40 @@ test('复审失败不挡任务：照常进 exec_review，summary 记失败原因 assert.equal(done.status, 'exec_review'); // 不挡结果闸 assert.equal(done.result!.verdict, null); assert.equal(done.result!.summary, '自动复审失败：复审 CC 崩了'); + assert.equal(done.result!.securityVerdict, 'approve'); // 另一个复审不受影响 + assert.equal(done.result!.securitySummary, '## 安全审计\nmock 审计通过'); const runs = store.listRuns(t.id); assert.equal(runs.find((r) => r.kind === 'executor')!.status, 'succeeded'); const reviewer = runs.find((r) => r.kind === 'reviewer')!; assert.equal(reviewer.status, 'failed'); assert.match(reviewer.error ?? '', /复审 CC 崩了/); + assert.equal(runs.find((r) => r.kind === 'security')!.status, 'succeeded'); + store.close(); +}); + +test('安全审计失败不挡任务：securitySummary 记失败原因、securityVerdict=null，code review 不受影响', async () => { + const { store, projectId } = setup('auto-easy'); + const t = store.createTask({ projectId, title: 'security-broken', complexity: 'easy' }); + const orch = createOrchestrator(store, noopLog, mockDeps({ + reviewSecurity: async () => { throw new Error('审计 CC 崩了'); }, + })); + orch.tick(); + await orch.drain(); + + const done = store.getTask(t.id)!; + assert.equal(done.status, 'exec_review'); + assert.equal(done.result!.verdict, 'approve'); + assert.equal(done.result!.summary, '## 做了什么\nmock 复审通过'); + assert.equal(done.result!.securityVerdict, null); + assert.equal(done.result!.securitySummary, '自动复审失败：审计 CC 崩了'); + + const runs = store.listRuns(t.id); + assert.equal(runs.find((r) => r.kind === 'executor')!.status, 'succeeded'); + assert.equal(runs.find((r) => r.kind === 'reviewer')!.status, 'succeeded'); + const security = runs.find((r) => r.kind === 'security')!; + assert.equal(security.status, 'failed'); + assert.match(security.error ?? '', /审计 CC 崩了/); store.close(); }); diff --git a/test/reviewer.test.ts b/test/reviewer.test.ts index 2651dc1..956c3a5 100644 --- a/test/reviewer.test.ts +++ b/test/reviewer.test.ts @@ -32,26 +32,45 @@ test('parseVerdict：VERDICT 行带多余内容不算（如模板原文 approve| assert.equal(verdict, null); }); -test('buildReviewPrompt：含任务说明、执行者自述、diff 指令与固定模板', () => { +test('buildReviewPrompt(code)：含任务说明、执行者自述、diff 指令与 code review 模板', () => { const task = { id: 'task_1', title: '修复登录', operations: '改 auth.ts', spec: null, plan: null } as Task; const project = { defaultBranch: 'main' } as Project; const wt = { dir: '/tmp/wt', branch: 'maestro/task_1' }; - const prompt = buildReviewPrompt(task, project, wt, '我改了 auth.ts 并加了测试'); + const prompt = buildReviewPrompt('code', task, project, wt, '我改了 auth.ts 并加了测试'); assert.match(prompt, /修复登录/); assert.match(prompt, /改 auth\.ts/); assert.match(prompt, /我改了 auth\.ts 并加了测试/); assert.match(prompt, /git diff main\.\.\.maestro\/task_1/); - for (const section of ['## 做了什么', '## 怎么做的', '## 测试情况', '## Code Review', '## 安全 Review', '## 结论']) { + for (const section of ['## 做了什么', '## 怎么做的', '## 测试情况', '## Code Review', '## 结论']) { assert.ok(prompt.includes(section), `模板缺少 ${section}`); } + assert.ok(!prompt.includes('## 安全审计'), 'code review 模板不应含安全审计节'); assert.match(prompt, /VERDICT: approve\|reject/); assert.match(prompt, /只读权限/); }); -test('buildReviewPrompt：执行者无自述时给占位说明', () => { +test('buildReviewPrompt(security)：安全审计模板（凭证/注入/权限/文案红线/部署风险）', () => { + const task = { id: 'task_1', title: '修复登录', operations: '改 auth.ts', spec: null, plan: null } as Task; + const project = { defaultBranch: 'main' } as Project; + const wt = { dir: '/tmp/wt', branch: 'maestro/task_1' }; + const prompt = buildReviewPrompt('security', task, project, wt, '我改了 auth.ts'); + + assert.match(prompt, /安全审计/); + for (const section of ['凭证与密钥泄露', '注入与危险命令', '权限与边界', 'UI 文案红线词', '生产部署风险', '## 结论']) { + assert.ok(prompt.includes(section), `安全模板缺少 ${section}`); + } + assert.ok(!prompt.includes('## 做了什么'), '安全审计模板不应含 code review 节'); + assert.match(prompt, /git diff main\.\.\.maestro\/task_1/); + assert.match(prompt, /VERDICT: approve\|reject/); + assert.match(prompt, /只读权限/); +}); + +test('buildReviewPrompt：执行者无自述时给占位说明（两种角色）', () => { const task = { id: 'task_2', title: 't', operations: null, spec: null, plan: null } as Task; const project = { defaultBranch: 'main' } as Project; - const prompt = buildReviewPrompt(task, project, { dir: '/x', branch: 'maestro/task_2' }, ''); - assert.match(prompt, /执行者未留下自述/); + for (const role of ['code', 'security'] as const) { + const prompt = buildReviewPrompt(role, task, project, { dir: '/x', branch: 'maestro/task_2' }, ''); + assert.match(prompt, /执行者未留下自述/); + } }); diff --git a/test/store.test.ts b/test/store.test.ts index ee9135c..3749a36 100644 --- a/test/store.test.ts +++ b/test/store.test.ts @@ -96,7 +96,7 @@ test('exec_review 结果闸：accept → done', () => { s.setOperations(t.id, 'op'); s.transition(t.id, 'queued'); s.transition(t.id, 'executing'); - s.setResult(t.id, { branch: 'maestro/run', worktree: '/wt', diffSummary: '+1 -0', commits: ['abc'], prUrl: null, summary: null, verdict: null }); + s.setResult(t.id, { branch: 'maestro/run', worktree: '/wt', diffSummary: '+1 -0', commits: ['abc'], prUrl: null, summary: null, verdict: null, securitySummary: null, securityVerdict: null }); s.transition(t.id, 'exec_review'); const done = s.decide(t.id, 'accept', 'user'); assert.equal(done.status, 'done'); diff --git a/test/usage.test.ts b/test/usage.test.ts new file mode 100644 index 0000000..0710403 --- /dev/null +++ b/test/usage.test.ts @@ -0,0 +1,104 @@ +import { test } from 'node:test'; +import assert from 'node:assert/strict'; +import { createUsageFetcher, USAGE_CACHE_MS, USAGE_ENDPOINT } from '../src/daemon/usage.js'; + +const SECRET = 'tok-secret-do-not-leak'; + +/** 构造可控时钟 + 计数 fetch 的 fetcher（不真打 API） */ +function setup(opts: { + body?: unknown; + status?: number; + fetchError?: Error; + token?: string | null; +} = {}): { + getUsage: () => Promise; + calls: { fetch: number; token: number }; + logs: string[]; + clock: { t: number }; +} { + const calls = { fetch: 0, token: 0 }; + const logs: string[] = []; + const clock = { t: 1_000_000 }; + const body = opts.body ?? { + five_hour: { utilization: 47.0, resets_at: '2026-06-12T22:30:00+00:00' }, + seven_day: { utilization: 57.0, resets_at: '2026-06-13T12:00:00+00:00' }, + }; + const fetchFn = (async (url: string | URL | Request, init?: RequestInit) => { + calls.fetch += 1; + assert.equal(String(url), USAGE_ENDPOINT); + assert.match(String((init?.headers as Record).Authorization), /^Bearer /); + if (opts.fetchError) throw opts.fetchError; + return { + ok: (opts.status ?? 200) < 400, + status: opts.status ?? 200, + json: async () => body, + } as Response; + }) as typeof fetch; + const getUsage = createUsageFetcher({ + fetchFn, + readToken: async () => { calls.token += 1; return opts.token === undefined ? SECRET : opts.token; }, + now: () => clock.t, + log: { info: (m) => logs.push(m), error: (m) => logs.push(m) }, + }); + return { getUsage, calls, logs, clock }; +} + +test('usage：成功解析 five_hour/seven_day → UsageInfo（percent 取整，resetsAt 透传）', async () => { + const { getUsage } = setup(); + const u = await getUsage(); + assert.deepEqual(u, { + session: { percent: 47, resetsAt: '2026-06-12T22:30:00+00:00' }, + weekly: { percent: 57, resetsAt: '2026-06-13T12:00:00+00:00' }, + }); +}); + +test('usage：60s 内存缓存——窗口内不重复请求，过期后重新拉取', async () => { + const { getUsage, calls, clock } = setup(); + await getUsage(); + await getUsage(); + clock.t += USAGE_CACHE_MS - 1; + await getUsage(); + assert.equal(calls.fetch, 1); + clock.t += 2; // 越过缓存窗口 + await getUsage(); + assert.equal(calls.fetch, 2); +}); + +test('usage：并发调用共享同一 in-flight 请求', async () => { + const { getUsage, calls } = setup(); + const [a, b] = await Promise.all([getUsage(), getUsage()]); + assert.equal(calls.fetch, 1); + assert.deepEqual(a, b); +}); + +test('usage：fetch 抛错 → null 且负缓存 60s（不重试风暴），日志不含 token', async () => { + const { getUsage, calls, logs } = setup({ fetchError: new Error('network down') }); + assert.equal(await getUsage(), null); + assert.equal(await getUsage(), null); + assert.equal(calls.fetch, 1); // 失败结果同样被缓存 + assert.ok(logs.some((m) => m.includes('network down'))); + assert.ok(logs.every((m) => !m.includes(SECRET))); +}); + +test('usage：HTTP 非 200 → null', async () => { + const { getUsage, logs } = setup({ status: 401 }); + assert.equal(await getUsage(), null); + assert.ok(logs.some((m) => m.includes('401'))); +}); + +test('usage：无凭证 → null 且不发起请求', async () => { + const { getUsage, calls } = setup({ token: null }); + assert.equal(await getUsage(), null); + assert.equal(calls.fetch, 0); +}); + +test('usage：响应缺少两个窗口字段 → null；只有一个窗口 → 另一侧为 null', async () => { + const none = setup({ body: { unrelated: true } }); + assert.equal(await none.getUsage(), null); + + const onlyWeek = setup({ body: { seven_day: { utilization: 88.6, resets_at: null } } }); + assert.deepEqual(await onlyWeek.getUsage(), { + session: null, + weekly: { percent: 89, resetsAt: null }, + }); +}); diff --git a/web/app.js b/web/app.js index 8b98db8..733f9d5 100644 --- a/web/app.js +++ b/web/app.js @@ -95,6 +95,47 @@ function shortModel(m) { return String(m || '—').replace(/^claude-/, ''); } +/** fmtRel 的未来版：到 iso 还有多久（"3h 33m" / "42m" / "<1m"；已过/无效 → ''） */ +function fmtUntil(iso) { + if (!iso) return ''; + const ms = new Date(iso).getTime() - Date.now(); + if (!Number.isFinite(ms) || ms <= 0) return ''; + const m = Math.ceil(ms / 60000); + if (m < 1) return '<1m'; + if (m < 60) return `${m}m`; + const h = Math.floor(m / 60); + if (h < 24) return m % 60 ? `${h}h ${m % 60}m` : `${h}h`; + const d = Math.floor(h / 24); + return h % 24 ? `${d}d ${h % 24}h` : `${d}d`; +} + +/** 字符进度条：8 格 █/░ */ +function usageBar(pct) { + const filled = Math.round(Math.min(100, Math.max(0, pct)) / 100 * 8); + return '█'.repeat(filled) + '░'.repeat(8 - filled); +} + +/** 单个额度窗口（5h / 周）的展示段；>80% 琥珀、>95% 红 */ +function usageSeg(label, w) { + if (!w || !Number.isFinite(Number(w.percent))) { + return `${label} —`; + } + const pct = Number(w.percent); + const lvl = pct > 95 ? ' crit' : pct > 80 ? ' warn' : ''; + const until = fmtUntil(w.resetsAt); + return `${label} ` + + `${usageBar(pct)} ${pct}%` + + `${until ? `（${until} 后重置）` : ''}`; +} + +/** Agent 面板顶部的订阅额度行（执行 agent 烧的就是这个池子）；usage=null → 灰字降级 */ +function usageLine(usage) { + if (!usage || (!usage.session && !usage.weekly)) { + return `
额度信息不可用
`; + } + return `
额度 ${usageSeg('5h', usage.session)} · ${usageSeg('周', usage.weekly)}
`; +} + // ── 轻量 Markdown 渲染（零依赖；先整体转义再做结构转换，杜绝注入） ── function mdToHtml(src) { const inline = (s) => s @@ -332,12 +373,14 @@ function renderAgents() { const a = S.agents; const total = a && Number(a.totalActive) > 0 ? Number(a.totalActive) : 0; $('#agentTotal').textContent = total ? `· ${total}` : ''; + const usage = usageLine(a ? a.usage : null); if (!total) { - body.innerHTML = `
无 agent 在执行（自动执行将在 Phase 2 启用）
`; + body.innerHTML = `${usage}
无 agent 在执行（自动执行将在 Phase 2 启用）
`; return; } const groups = (a.agents || []).filter((g) => g.active && g.active.length); body.innerHTML = ` + ${usage}
${total}ACTIVE
@@ -372,7 +415,7 @@ function gateDocs(t) { if (gate === 'exec') { if (t.result) { const r = t.result; - blocks.push(reviewSummaryBlock(r)); // 复审 SUMMARY + verdict 徽章，置于 DIFF 摘要上方 + blocks.push(reviewReportBlocks(r)); // CODE REVIEW + 安全审计 两节（各带 verdict 徽章），置于 DIFF 摘要上方 blocks.push(`
RESULT · 执行结果
${r.branch ? `
分支
${esc(r.branch)}
` : ''} @@ -393,6 +436,8 @@ function renderGates() { const sec = $('#gateSection'); if (!S.approvals.length) { sec.hidden = true; return; } sec.hidden = false; + const proj = S.projects.find((x) => x.id === S.currentProjectId); + const defBranch = proj ? proj.defaultBranch : 'main'; $('#gateList').innerHTML = S.approvals.map((t) => { const gate = GATE_OF[t.status]; const rejOpen = S.rejectOpen.has(t.id); @@ -407,9 +452,9 @@ function renderGates() {
${gateDocs(t)}
- + ${gate === 'exec' ? `` : ''} - ${gate === 'exec' ? `接受 = 认可改动并标记完成（合并不自动执行）` : ''} + ${gate === 'exec' ? `通过 = 自动把任务分支合并到 ${esc(defBranch)}（仅本地合并，不 push）` : ''}
${rejOpen ? `
@@ -506,7 +551,7 @@ function renderArchiveModal(t, runs, events) { const byId = new Map(S.tasks.map((x) => [x.id, x])); const parent = t.parentId ? byId.get(t.parentId) : null; const r = t.result; - const RUN_KIND = { executor: '执行', reviewer: '复审', planner: '规划' }; + const RUN_KIND = { executor: '执行', reviewer: 'code review', security: '安全审计', planner: '规划' }; const RUN_ST = { succeeded: '成功', failed: '失败', started: '进行中', cancelled: '取消' }; const kv = (dt, dd) => `
${dt}
${dd}
`; @@ -535,12 +580,12 @@ function renderArchiveModal(t, runs, events) { (x.transcriptRef ? `
转录 ${esc(x.transcriptRef)}` : ''), )).join('')}` : ''; - const resultBlock = r ? `
执行结果
- ${r.summary ? `
${mdToHtml(r.summary)}
` : ''} + const resultBlock = r ? `${reviewReportBlocks(r)} +
执行结果
- ${r.verdict ? kv('复审建议', r.verdict === 'approve' ? '建议通过' : '建议拒绝') : ''} ${r.branch ? kv('分支', esc(r.branch)) : ''} ${r.worktree ? kv('worktree', esc(r.worktree)) : ''} + ${r.prUrl ? kv('合并', esc(r.prUrl)) : ''} ${r.commits && r.commits.length ? kv('commits', r.commits.map(esc).join('
')) : ''}
${r.diffSummary ? `
${esc(r.diffSummary)}
` : ''}` : ''; @@ -608,8 +653,12 @@ function renderPreview() {
${gateDocs(t)}
- + ${gate === 'exec' ? `` : ''} + ${gate === 'exec' ? (() => { + const pp = S.projects.find((x) => x.id === S.currentProjectId); + return `通过 = 合并到 ${esc(pp ? pp.defaultBranch : 'main')}（仅本地，不 push）`; + })() : ''} id ${esc(t.id)} · 更新 ${fmtTime(t.updatedAt)} ${S.previewReject ? `
@@ -650,12 +699,15 @@ function verdictBadge(v) { return `未复审`; } -// 复审 SUMMARY 区块（label + verdict 徽章 + markdown 渲染），无 summary 且未复审时返回空 -function reviewSummaryBlock(r) { +// 复审报告区块：「CODE REVIEW」「安全审计」两节，各自 verdict 徽章（通过绿/拒绝红/未复审灰） +function reviewReportBlocks(r) { if (!r) return ''; - const label = `
复审 SUMMARY ${verdictBadge(r.verdict)}
`; - if (r.summary) return `${label}
${mdToHtml(r.summary)}
`; - return `${label}
（无复审记录）
`; + const sec = (label, summary, verdict) => { + const head = `
${label} ${verdictBadge(verdict)}
`; + if (summary) return `${head}
${mdToHtml(summary)}
`; + return `${head}
（无复审记录）
`; + }; + return sec('CODE REVIEW', r.summary, r.verdict) + sec('安全审计', r.securitySummary, r.securityVerdict); } function childrenMap(list = S.tasks) { @@ -842,12 +894,12 @@ function renderDetail(t) { if (t.result) { const r = t.result; parts.push(` -
RESULT · 执行结果 ${verdictBadge(r.verdict)}
- ${r.summary ? `
${mdToHtml(r.summary)}
` : ''} +
${reviewReportBlocks(r)} +
RESULT · 执行结果
分支
${esc(r.branch || '—')}
worktree
${esc(r.worktree || '—')}
- ${r.prUrl ? `
PR
${esc(r.prUrl)}
` : ''} + ${r.prUrl ? `
合并
${esc(r.prUrl)}
` : ''} ${r.commits && r.commits.length ? `
commits
${r.commits.map(esc).join('
')}
` : ''}
${r.diffSummary ? `
${esc(r.diffSummary)}
` : ''} @@ -1003,11 +1055,13 @@ document.addEventListener('click', (ev) => { break; } - case 'gate-accept': + case 'gate-accept': { + const noMerge = el.dataset.merge === 'false'; act(() => api(`/api/tasks/${id}/decide`, { - method: 'POST', body: JSON.stringify({ action: 'accept' }), - }), '已接受'); + method: 'POST', body: JSON.stringify(noMerge ? { action: 'accept', merge: false } : { action: 'accept' }), + }), noMerge ? '已通过（未合并，分支保留）' : '已接受'); break; + } case 'gate-reject-toggle': S.rejectOpen.has(id) ? S.rejectOpen.delete(id) : S.rejectOpen.add(id); diff --git a/web/style.css b/web/style.css index 8584a70..871d497 100644 --- a/web/style.css +++ b/web/style.css @@ -173,6 +173,22 @@ body::before { /* ── Agent 执行面板 ──────────────────────────────────────── */ .agent-total { color: var(--cyan); letter-spacing: .08em; } +/* 订阅额度行（5h/周窗口）：cyan 常态，>80% 琥珀，>95% 红 */ +.agent-usage { + display: flex; gap: 8px; align-items: baseline; flex-wrap: wrap; + font-size: 11px; color: var(--muted); letter-spacing: .04em; + padding: 6px 2px 8px; +} +.agent-usage.unavail { color: var(--faint); } +.usage-seg { color: var(--cyan); white-space: nowrap; } +.usage-seg .usage-label { color: var(--muted); } +.usage-seg .usage-bar { letter-spacing: -.04em; text-shadow: 0 0 8px rgba(89,200,216,.35); } +.usage-seg .usage-reset { color: var(--faint); } +.usage-seg .usage-na { color: var(--faint); } +.usage-seg.warn { color: var(--amber); } +.usage-seg.warn .usage-bar { text-shadow: 0 0 8px rgba(240,180,41,.35); } +.usage-seg.crit { color: var(--red); } +.usage-seg.crit .usage-bar { text-shadow: 0 0 8px rgba(255,93,93,.4); } .agent-empty { padding: 12px 14px; color: var(--faint); font-size: 12px; border: 1px dashed var(--line);