修复 Clippy 新增源码与嵌套清单变化后的陈旧诊断和覆盖

Author: loong10k

.github/workflows/ci.yml

@@ -49,7 +49,7 @@ jobs:
       - name: Verify Linux WASM worker resource boundary
         run: |
           # 帮助目录须保留当前构建特性；默认 suite 无法证明 WASM 入口状态。
-          cargo test --locked -p codeguard-cli --features wasm-precheck --test help_command_contract --test rules_list_cli --test version_cli --test rust_lint_cli --test ruby_lint_cli --test check_all_ruby --test ruby_native_hook --test ruby_project_version --test shell_lint_cli --test shell_workbench --test check_all_shell --test shell_native_hook --test hook_failed_write_options --test go_native_hook --test cfquery_postgres_dialect --test cfquery_structure
+          cargo test --locked -p codeguard-cli --features wasm-precheck --test help_command_contract --test rules_list_cli --test version_cli --test rust_lint_cli --test rust_lint_input_stability --test check_all_rust_native --test ruby_lint_cli --test check_all_ruby --test ruby_native_hook --test ruby_project_version --test shell_lint_cli --test shell_workbench --test check_all_shell --test shell_native_hook --test hook_failed_write_options --test go_native_hook --test cfquery_postgres_dialect --test cfquery_structure
           cargo test --locked -p codeguard-cli --features wasm-precheck --test workspace_msrv --test crate_boundaries
           cargo test -p codeguard-runtime --features wasm-precheck --test process_contract
           cargo test -p codeguard-runtime --features wasm-precheck --test wasm_grammar_load --test wasm_recovery_scan --test wasm_empty_block_scan --test wasm_root_child_scan --test dart_upstream_corpus

crates/codeguard-cli/src/lib.rs

@@ -219,6 +219,8 @@ pub(crate) mod rust_cve_task_recheck;
 #[cfg(unix)]
 mod rust_lint_inputs;
 #[cfg(unix)]
+mod rust_input_inventory;
+#[cfg(unix)]
 pub mod rust_lint_scan;
 #[cfg(unix)]
 mod rust_native_syntax_coverage;

crates/codeguard-cli/src/rust_input_inventory.rs

@@ -0,0 +1,52 @@
+use std::{
+    collections::BTreeSet,
+    io,
+    path::{Path, PathBuf},
+};
+
+/// Rust 输入范围的静态清单；来源：OpenSpec execution-kernel 输入前后复核。
+/// 沿用普通发现的排除和条目预算，不推断 Cargo 动态目标或外部依赖闭包。
+#[derive(Eq, PartialEq)]
+pub(crate) struct RustInputInventory {
+    pub(crate) source_files: BTreeSet<String>,
+    pub(crate) configuration_files: BTreeSet<PathBuf>,
+}
+
+impl RustInputInventory {
+    /// 读取普通发现范围内的 Rust 源码、Cargo 清单与锁文件名集合。
+    /// 参数为受检根；返回静态清单，读取失败或截断不能作为空清单消费。
+    pub(crate) fn capture(root: &Path) -> io::Result<Self> {
+        let registry = codeguard_adapters::legacy_registry()
+            .map_err(|_| io::Error::other("Rust 输入注册表不可用"))?;
+        let observation =
+            crate::discovery::discover(root, &registry, &codeguard_runtime::NativeObservation);
+        if !observation.observation_complete {
+            return Err(io::Error::other("Rust 输入范围发现未完成"));
+        }
+        let source_files = observation
+            .languages
+            .get("rust")
+            .map(|language| language.source_files.clone())
+            .unwrap_or_default();
+        let mut configuration_files = observation
+            .languages
+            .get("rust")
+            .map(|language| language.manifests.iter().map(PathBuf::from).collect())
+            .unwrap_or_else(BTreeSet::new);
+        configuration_files.extend(
+            observation
+                .lockfiles
+                .iter()
+                .filter(|path| {
+                    Path::new(path)
+                        .file_name()
+                        .is_some_and(|name| name == "Cargo.lock")
+                })
+                .map(PathBuf::from),
+        );
+        Ok(Self {
+            source_files,
+            configuration_files,
+        })
+    }
+}

crates/codeguard-cli/src/rust_lint_inputs.rs

@@ -13,6 +13,7 @@ pub(crate) struct RustLintInputs {
     snapshot: SourceSnapshot,
     absent: Vec<PathBuf>,
     root_identity: (u64, u64),
+    inventory: crate::rust_input_inventory::RustInputInventory,
 }
 impl RustLintInputs {
     /// 在原生启动前捕获指定源码和根配置；返回有界快照或不完整原因。
@@ -31,7 +32,10 @@ impl RustLintInputs {
             ));
         }
         let root_identity = (metadata.dev(), metadata.ino());
+        let inventory = crate::rust_input_inventory::RustInputInventory::capture(root)?;
         let mut paths: BTreeSet<PathBuf> = sources.iter().map(PathBuf::from).collect();
+        paths.extend(inventory.source_files.iter().map(PathBuf::from));
+        paths.extend(inventory.configuration_files.iter().cloned());
         paths.insert(PathBuf::from("Cargo.toml"));
         let mut absent = Vec::new();
         // 同时固定两种配置名称；不存在也必须固定，避免扫描中新增配置改变规则。
@@ -66,6 +70,7 @@ impl RustLintInputs {
             snapshot,
             absent,
             root_identity,
+            inventory,
         })
     }
     /// 返回扫描前指定文件的原始字节，供诊断指纹和源码摘要绑定。
@@ -83,6 +88,8 @@ impl RustLintInputs {
             .snapshot
             .verify_source_unchanged()
             .is_ok_and(|same| same)
+            && crate::rust_input_inventory::RustInputInventory::capture(root)
+                .is_ok_and(|current| current == self.inventory)
             && self.absent.iter().all(|relative| {
                 fs::symlink_metadata(root.join(relative))
                     .is_err_and(|e| e.kind() == io::ErrorKind::NotFound)

crates/codeguard-cli/tests/rust_lint_input_stability.rs

@@ -120,6 +120,55 @@ fn stable_native_diagnostic_keeps_original_source_binding() {
     assert_eq!(report["delivery_decision"], "not_evaluated");
 }
 
+#[test]
+fn new_rust_source_with_no_native_diagnostics_withdraws_completion() {
+    let p = Project::new();
+    let report = p.scan("printf '%s\\n' 'pub fn added() {}' > src/added.rs", false);
+    assert_eq!(report["local_scan_complete"], false, "{report}");
+    assert_eq!(report["reason"], "rust_inputs_changed_during_scan");
+}
+
+#[test]
+fn changed_nested_cargo_manifest_withdraws_current_diagnostic() {
+    let p = Project::new();
+    fs::create_dir(p.0.join("member")).unwrap();
+    fs::write(
+        p.0.join("member/Cargo.toml"),
+        "[package]\nname='member'\nversion='0.1.0'\nedition='2021'\n",
+    )
+    .unwrap();
+    let report = p.scan("printf '%s\\n' '[package]' \"name='member'\" \"version='0.1.0'\" \"edition='2024'\" > member/Cargo.toml", true);
+    assert_eq!(report["local_scan_complete"], false, "{report}");
+    assert_eq!(report["reason"], "rust_inputs_changed_during_scan");
+    assert_eq!(report["findings"], serde_json::json!([]));
+}
+
+#[test]
+fn changed_other_observed_source_or_renamed_source_withdraws_completion() {
+    for mutation in [
+        "printf '%s\\n' 'pub fn changed() {}' > src/other.rs",
+        "mv src/other.rs src/renamed.rs",
+        "rm src/other.rs",
+    ] {
+        let p = Project::new();
+        fs::write(p.0.join("src/other.rs"), "pub fn other() {}\n").unwrap();
+        let report = p.scan(mutation, false);
+        assert_eq!(report["local_scan_complete"], false, "{mutation}: {report}");
+        assert_eq!(report["reason"], "rust_inputs_changed_during_scan");
+    }
+}
+
+#[test]
+fn excluded_workbench_records_do_not_invalidate_rust_inputs() {
+    let p = Project::new();
+    let report = p.scan(
+        "mkdir -p .codeguard/reports; printf '{}' > .codeguard/reports/current.json",
+        false,
+    );
+    assert_eq!(report["local_scan_complete"], true, "{report}");
+    assert_eq!(report["delivery_decision"], "not_evaluated");
+}
+
 #[test]
 fn stable_partial_native_report_keeps_valid_diagnostic() {
     let p = Project::new();
@@ -167,6 +216,47 @@ fn real_clippy_output_is_withdrawn_when_source_changes_after_native_execution()
     }
 }
 
+#[test]
+#[ignore = "requires installed native Cargo Clippy; set CODEGUARD_CARGO_BIN"]
+fn real_clippy_output_is_withdrawn_when_new_source_appears_after_execution() {
+    let tool = std::env::var("CODEGUARD_CARGO_BIN").expect("原生 Cargo 路径");
+    assert!(std::path::Path::new(&tool).is_absolute());
+    let quoted = format!("'{}'", tool.replace('\'', "'\\''"));
+    let p = Project::new();
+    let wrapper = p.0.join("cargo-original");
+    fs::write(&wrapper,format!("#!/bin/sh\n{quoted} \"$@\" > native-output.jsonl\nresult=$?\ncat native-output.jsonl\nif [ \"$result\" = 0 ]; then printf '%s\\n' 'pub fn added() {{}}' > src/added.rs; fi\nexit \"$result\"\n")).unwrap();
+    fs::set_permissions(&wrapper, fs::Permissions::from_mode(0o700)).unwrap();
+    let report = observe_cargo_clippy(
+        &p.0,
+        &BTreeSet::from(["src/lib.rs".into()]),
+        Some(&wrapper),
+        Instant::now() + Duration::from_secs(60),
+        &AtomicBool::new(false),
+    );
+    let native = codeguard_adapters::parse_cargo_clippy_json(
+        &fs::read(p.0.join("native-output.jsonl")).unwrap(),
+    );
+    assert!(native.issue.is_none());
+    assert!(
+        native
+            .findings
+            .iter()
+            .any(|f| f.rule_id == "clippy::needless_return")
+    );
+    assert!(p.0.join("src/added.rs").is_file());
+    assert_eq!(report["reason"], "rust_inputs_changed_during_scan");
+    assert_eq!(report["local_scan_complete"], false);
+    assert_eq!(report["findings"], serde_json::json!([]));
+    if let Ok(dir) = std::env::var("CODEGUARD_CLIPPY_REPORT_DIR") {
+        fs::create_dir_all(&dir).unwrap();
+        fs::write(
+            PathBuf::from(dir).join("real-clippy-new-source.json"),
+            serde_json::to_vec_pretty(&report).unwrap(),
+        )
+        .unwrap();
+    }
+}
+
 #[test]
 fn unavailable_source_is_rejected_before_native_startup() {
     let p = Project::new();

docs/Codeguard-Architecture.md

@@ -669,6 +669,8 @@ For Cargo proxies such as rustup that dispatch by entry-point name, Clippy, rust
 After native aggregation, current source uses non-cached Clippy `compiler-artifact` records, the original root-manifest identity and pre-run source hashes to avoid duplicate WASM for byte-matching Rust target entry points. Coverage stays in the current process and cannot be restored from editable reports. Failures, changed inputs/tools, duplicate JSON keys or events after the finish record grant no coverage. `all-targets` does not establish that the entire directory was parsed: unproven modules and conditionally excluded files retain prechecks. Native warnings, stable tasks and complete delivery obligations remain. Diagnostics repeated across library/test targets at the same file/rule/line/column project one finding, preferring error over warning; distinct positions remain separate and historical duplicate tasks are not automatically closed. See [Rust native-first acceptance](../tests/acceptance/check-all-native-preferred-rust.md). Public npm 0.1.4 does not include this batch.
 
 
+Clippy input protection also compares Rust source, Cargo manifest and lock-file membership under the same bounded static discovery policy. The snapshot binds all observed Rust files and nested manifests/locks. Added, removed, renamed or unreadable inputs invalidate the observation, current findings and native coverage. Managed workbench records follow existing discovery exclusions. External dependencies, dynamic targets and the complete configuration closure remain unproven.
+
 ### Existing Cargo discovery (current source)
 
 `check all`, `comments rust`, `build rust` and their Cargo task rechecks accept an optional `--cargo-tool`. Without it, they select the first regular executable `cargo` in an absolute invoking-PATH directory. Empty/relative directories and non-executable entries are skipped. An explicit invalid tool or selected native failure remains a concrete blocker; it never triggers a search for another Cargo. Aggregate Rust checks share the selected entry.

docs/Codeguard-Architecture.zh_CN.md

@@ -669,6 +669,8 @@ Cargo 为 rustup 等按入口名称分派的代理时，Clippy、rustdoc 与构
 聚合原生阶段完成后，当前源码会用 Clippy 的非缓存 `compiler-artifact`、原根清单身份和启动前源码摘要，免除同字节 Rust 目标入口的重复 WASM。覆盖只在本次进程内传递，不从可编辑报告恢复；失败、输入/工具变化、重复 JSON 键或结束记录后的事件不授予覆盖。`all-targets` 不能证明整个目录已解析，未证明的模块和条件排除文件继续初检；原生告警、稳定任务及完整交付义务均保留。同一文件/规则/行/列在库和测试目标中重复报告时只投影一项 finding，级别以 error 优先；不同位置分别保留，历史重复任务不自动关闭。见 [Rust 原生优先验收](../tests/acceptance/check-all-native-preferred-rust.md)。公开 npm 0.1.4 尚不包含本批修改。
 
 
+Clippy 输入保护还会沿同一有界静态发现策略复核 Rust 源码、Cargo 清单和锁文件的集合，快照固定全部已观察 Rust 文件及嵌套清单/锁的字节。新增、删除、重命名或读取失败使本轮观察未完成，撤回当前 finding 与原生覆盖；自有工作台记录沿既有排除策略处理，不制造源码变化。外部依赖、动态目标及完整配置闭包仍未证明。
+
 ### 已安装 Cargo 自动发现（当前源码）
 
 `check all`、`comments rust`、`build rust` 及其 Cargo 任务复检接受可选 `--cargo-tool`。未指定时，从调用方 PATH 的绝对目录中选择首个普通可执行 `cargo`；空目录、相对目录和不可执行入口不作为候选。显式无效工具或已选工具执行失败保留具体阻塞，不换用下一个 Cargo。聚合 Rust 检查共用本轮已选入口。

docs/Codeguard-Technical-Design.md

@@ -1132,6 +1132,8 @@ For Cargo proxies such as rustup that dispatch by entry-point name, Clippy, rust
 After native aggregation, current source uses non-cached Clippy `compiler-artifact` records, the original root-manifest identity and pre-run source hashes to avoid duplicate WASM for byte-matching Rust target entry points. Coverage stays in the current process and cannot be restored from editable reports. Failures, changed inputs/tools, duplicate JSON keys or events after the finish record grant no coverage. `all-targets` does not establish that the entire directory was parsed: unproven modules and conditionally excluded files retain prechecks. Native warnings, stable tasks and complete delivery obligations remain. Diagnostics repeated across library/test targets at the same file/rule/line/column project one finding, preferring error over warning; distinct positions remain separate and historical duplicate tasks are not automatically closed. See [Rust native-first acceptance](../tests/acceptance/check-all-native-preferred-rust.md). Public npm 0.1.4 does not include this batch.
 
 
+Clippy input protection also compares Rust source, Cargo manifest and lock-file membership under the same bounded static discovery policy. The snapshot binds all observed Rust files and nested manifests/locks. Added, removed, renamed or unreadable inputs invalidate the observation, current findings and native coverage. Managed workbench records follow existing discovery exclusions. External dependencies, dynamic targets and the complete configuration closure remain unproven.
+
 ### Existing Cargo discovery (current source)
 
 `check all`, `comments rust`, `build rust` and their Cargo task rechecks accept an optional `--cargo-tool`. Without it, they select the first regular executable `cargo` in an absolute invoking-PATH directory. Empty/relative directories and non-executable entries are skipped. An explicit invalid tool or selected native failure remains a concrete blocker; it never triggers a search for another Cargo. Aggregate Rust checks share the selected entry.

docs/Codeguard-Technical-Design.zh_CN.md

@@ -1133,6 +1133,8 @@ Cargo 为 rustup 等按入口名称分派的代理时，Clippy、rustdoc 与构
 聚合原生阶段完成后，当前源码会用 Clippy 的非缓存 `compiler-artifact`、原根清单身份和启动前源码摘要，免除同字节 Rust 目标入口的重复 WASM。覆盖只在本次进程内传递，不从可编辑报告恢复；失败、输入/工具变化、重复 JSON 键或结束记录后的事件不授予覆盖。`all-targets` 不能证明整个目录已解析，未证明的模块和条件排除文件继续初检；原生告警、稳定任务及完整交付义务均保留。同一文件/规则/行/列在库和测试目标中重复报告时只投影一项 finding，级别以 error 优先；不同位置分别保留，历史重复任务不自动关闭。见 [Rust 原生优先验收](../tests/acceptance/check-all-native-preferred-rust.md)。公开 npm 0.1.4 尚不包含本批修改。
 
 
+Clippy 输入保护还会沿同一有界静态发现策略复核 Rust 源码、Cargo 清单和锁文件的集合，快照固定全部已观察 Rust 文件及嵌套清单/锁的字节。新增、删除、重命名或读取失败使本轮观察未完成，撤回当前 finding 与原生覆盖；自有工作台记录沿既有排除策略处理，不制造源码变化。外部依赖、动态目标及完整配置闭包仍未证明。
+
 ### 已安装 Cargo 自动发现（当前源码）
 
 `check all`、`comments rust`、`build rust` 及其 Cargo 任务复检接受可选 `--cargo-tool`。未指定时，从调用方 PATH 的绝对目录中选择首个普通可执行 `cargo`；空目录、相对目录和不可执行入口不作为候选。显式无效工具或已选工具执行失败保留具体阻塞，不换用下一个 Cargo。聚合 Rust 检查共用本轮已选入口。

openspec/changes/introduce-rust-codeguard-cli/specs/execution-kernel/spec.md

@@ -51,6 +51,10 @@
 - **WHEN** Git hook 环境含 GIT_INDEX_FILE
 - **THEN** 检查该 index，保留真实工作树及 index 内容
 
+#### Scenario: Rust source membership changes during Clippy
+- **WHEN** 原生 Clippy 运行期间普通发现范围内新增、删除或重命名 Rust 源码，或已观察的其它 Rust 文件、嵌套 Cargo 清单及锁文件内容变化
+- **THEN** MUST 撤回局部完成、当前源码诊断与本轮原生覆盖，反馈 rust_inputs_changed_during_scan；源码范围按同一静态发现策略前后复核，发现失败或截断不能当作空集合。根配置的存在性保护继续有效；不据此宣称动态 Cargo 模型、外部依赖和完整配置闭包均已固定
+
 ### Requirement: Managed artifact publication SHALL preserve identity and ownership
 
 受管工具安装的缓存发布 MUST 与质量结果缓存分开。安装字节须有上限并核对预期 SHA-256，缓存根须归当前用户且不可被其它用户写入；使用固定目录描述符和不覆盖的原子发布，拒绝缓存根/目标链接、损坏或权限不符的已有制品。取消、到期或校验失败不得发布未完成文件；正常退出清理暂存，重复相同字节只能在再次核验后复用。缓存写入收据只说明字节发布，不证明锁/发行来源批准、平台兼容、可启动或质量通过；CLI 安装仍须独立核验批准来源。