feat: 在项目发现中输出原生工具准备候选

Author: loong10k

README.md

@@ -153,7 +153,7 @@ Supply the original checker's required tool/configuration options to `task verif
 
 | Family | Value | Current boundary |
 | :--- | :--- | :--- |
-| `--version`, `capabilities`, `detect` | Binary, inventory, project observations | Queries do not perform checks |
+| `--version`, `capabilities`, `detect` | Binary, inventory, project observations | Current source `detect` 0.4.0 exposes local ESLint/Maven Wrapper candidates; no tool is run or approved |
 | `init --dry-run / --apply` | Preview/create/refresh workbench | No implicit install, build, Hook takeover, or architecture certification |
 | `config validate / explain`, `rules list` | Inspect configuration and rule origins | Candidates do not establish policy authority |
 | `tools list / verify`, `doctor` | Inspect tools and limited environment probes | Explicit Ruff doctor probe; `tools install --apply` is blocked |

README.zh-CN.md

@@ -153,7 +153,7 @@ codeguard task verify "$TASK_ID" . --format json
 
 | 命令族 | 价值 | 当前边界 |
 | :--- | :--- | :--- |
-| `--version`、`capabilities`、`detect` | 查询二进制、清单、项目观察 | 查询不执行检查 |
+| `--version`、`capabilities`、`detect` | 查询二进制、清单、项目观察 | 当前源码的 `detect` 0.4.0 输出本地 ESLint/Maven Wrapper 候选，不执行或批准工具 |
 | `init --dry-run / --apply` | 预览、创建、刷新工作台 | 不隐式安装、构建、接管 Hook 或认证架构 |
 | `config validate / explain`、`rules list` | 查看配置和规则来源 | 候选不构成策略批准 |
 | `tools list / verify`、`doctor` | 查看工具和有限环境探测 | 显式 Ruff doctor 探测；`tools install --apply` 受阻 |

crates/codeguard-cli/src/check_command.rs

@@ -1452,7 +1452,7 @@ pub fn run(args: &[String]) -> ExitCode {
     })
     .count();
     let report = json!({
-        "schema_version":"0.30.0", "report_type":"check_feedback",
+        "schema_version":"0.31.0", "report_type":"check_feedback",
         "operation":"check", "selection":parsed.selection.as_str(), "command_status":if request_cancelled { "cancelled" } else { "incomplete" },
         "exit_code":if request_cancelled { 130 } else { 3 }, "delivery_decision":if parsed.selection == Selection::All { "incomplete" } else { "not_evaluated" }, "authority":"local_unverified",
         "reason":if request_cancelled { "request_cancelled" } else if parsed.selection == Selection::All { "full_project_obligations_and_trusted_policy_unavailable" } else { "java_selection_obligations_and_trusted_policy_unavailable" },
@@ -1512,6 +1512,23 @@ pub fn run(args: &[String]) -> ExitCode {
                 }
             }
         }
+        if let Some(tools) = report["discovery"]["native_tool_candidates"].as_array() {
+            for tool in tools {
+                if parsed.selection == Selection::Java && tool["checker_id"] != "java.maven" {
+                    continue;
+                }
+                println!(
+                    "原生工具候选 {} [{:?}]：{}；版本 {}；下一步：{}（未执行）",
+                    tool["checker_id"].as_str().unwrap_or("未知"),
+                    tool["build_root"].as_str().unwrap_or("未知"),
+                    tool["state"].as_str().unwrap_or("unknown"),
+                    tool["observed_version"].as_str().unwrap_or("未知"),
+                    tool["next_action"]
+                        .as_str()
+                        .unwrap_or("核对原生工具及项目配置")
+                );
+            }
+        }
         if let Some(files) = report["native_results"]["python_lint"]["files"].as_array() {
             for file in files {
                 let path = file["path"].as_str().unwrap_or("未知目标");

crates/codeguard-cli/src/discovery.rs

@@ -1,6 +1,8 @@
 //! 只读项目发现；候选不等于已验证的检查能力。
 
 use crate::eslint_discovery::{ESLINT_CONFIG_NAMES, inspect_node_eslint};
+use crate::native_tool_candidate::NativeToolCandidate;
+use crate::native_tool_discovery::inspect_native_tools;
 use crate::npm_audit_discovery::inspect_node_npm_audit;
 use crate::python_dependency_discovery::inspect_python_cve_inputs;
 use codeguard_adapters::{
@@ -54,6 +56,9 @@ pub struct DiscoveryReport {
     pub checker_config_sha256: BTreeMap<String, String>,
     pub lockfiles: BTreeSet<String>,
     pub checker_configurations: Vec<CheckerConfiguration>,
+    /// 项目本地原生工具的只读候选；不能视为本轮工具检查成功。
+    pub native_tool_candidates: Vec<NativeToolCandidate>,
+    pub(crate) tool_hint_paths: BTreeSet<String>,
     ruff_config_files: BTreeSet<String>,
     eslint_config_files: BTreeSet<String>,
     /// (源码根、语言、用途)；仅按目录约定推断。
@@ -65,6 +70,8 @@ pub struct DiscoveryReport {
     pub dot_prefix_roots_excluded: usize,
     /// 按配置发现例外实际观察到的点前缀普通文件数。
     pub configuration_exception_files_observed: usize,
+    /// 普通源码扫描跳过的依赖目录根数；固定路径工具探测仍可只读观察。
+    pub dependency_roots_excluded: usize,
 }
 
 impl DiscoveryReport {
@@ -90,15 +97,16 @@ impl DiscoveryReport {
             })
             .collect();
         json!({
-            "schema_version":"0.3.0",
+            "schema_version":"0.4.0",
             "report_type":"discovery",
             "root":self.root,
             "observation_complete":self.observation_complete,
             "observed_entries":self.observed_entries,
             "scope_summary":{
-                "ordinary_scan_policy":"dot_prefix_default_v1",
+                "ordinary_scan_policy":"project_sources_default_v2",
                 "dot_prefix_roots_excluded":self.dot_prefix_roots_excluded,
                 "configuration_exception_files_observed":self.configuration_exception_files_observed,
+                "dependency_roots_excluded":self.dependency_roots_excluded,
                 "git_safety_status":"not_evaluated"
             },
             "languages":languages,
@@ -107,6 +115,7 @@ impl DiscoveryReport {
             "manifest_sha256":self.manifest_sha256,
             "lockfiles":self.lockfiles,
             "checker_configurations":self.checker_configurations,
+            "native_tool_candidates":self.native_tool_candidates,
             "source_set_candidates":source_set_candidates,
             "blocked_paths":self.blocked_paths,
             "unknown_conditions":self.unknown_conditions,
@@ -147,6 +156,8 @@ pub fn discover<P: ObservationPort>(
         checker_config_sha256: BTreeMap::new(),
         lockfiles: BTreeSet::new(),
         checker_configurations: Vec::new(),
+        native_tool_candidates: Vec::new(),
+        tool_hint_paths: BTreeSet::new(),
         ruff_config_files: BTreeSet::new(),
         eslint_config_files: BTreeSet::new(),
         source_set_candidates: BTreeSet::new(),
@@ -155,6 +166,7 @@ pub fn discover<P: ObservationPort>(
         observed_entries: 0,
         dot_prefix_roots_excluded: 0,
         configuration_exception_files_observed: 0,
+        dependency_roots_excluded: 0,
     };
     if !matches!(observation.classify(root), Ok(ObservedPathKind::Directory)) {
         report.observation_complete = false;
@@ -180,6 +192,24 @@ pub fn discover<P: ObservationPort>(
                 && (exact_config_files.contains(name)
                     || ESLINT_CONFIG_NAMES.contains(&name)
                     || matches!(name, ".ruff.toml" | ".pre-commit-config.yaml"));
+            if matches!(name, "node_modules" | ".mvn") {
+                match observation.classify(&child) {
+                    Ok(kind) => {
+                        if let Some(relative) = relative_path(root, &child) {
+                            report.tool_hint_paths.insert(relative);
+                        }
+                        if name == "node_modules" && kind == ObservedPathKind::Directory {
+                            report.dependency_roots_excluded += 1;
+                        } else if kind != ObservedPathKind::Directory {
+                            block(&mut report, root, &child);
+                        }
+                    }
+                    Err(_) => block(&mut report, root, &child),
+                }
+                if name == "node_modules" {
+                    continue;
+                }
+            }
             if name.starts_with('.') && !configuration_exception {
                 report.dot_prefix_roots_excluded += 1;
                 continue;
@@ -203,6 +233,9 @@ pub fn discover<P: ObservationPort>(
                 }
                 Ok(ObservedPathKind::Directory) => pending.push(child),
                 Ok(ObservedPathKind::File) => {
+                    if name == "mvnw" {
+                        report.tool_hint_paths.insert(relative.clone());
+                    }
                     if configuration_exception {
                         report.configuration_exception_files_observed += 1;
                     }
@@ -216,6 +249,9 @@ pub fn discover<P: ObservationPort>(
                     )
                 }
                 Ok(ObservedPathKind::Symlink | ObservedPathKind::Other) | Err(_) => {
+                    if name == "mvnw" {
+                        report.tool_hint_paths.insert(relative.clone());
+                    }
                     block(&mut report, root, &child);
                 }
             }
@@ -258,6 +294,7 @@ pub fn discover<P: ObservationPort>(
     inspect_python_cve_inputs(root, observation, &mut report);
     let eslint_candidates = report.eslint_config_files.clone();
     inspect_node_eslint(root, observation, &mut report, &eslint_candidates);
+    inspect_native_tools(root, observation, &mut report);
     inspect_node_npm_audit(root, observation, &mut report);
     if report
         .languages

crates/codeguard-cli/src/lib.rs

@@ -118,6 +118,8 @@ mod maven_dependency_probe;
 mod maven_javadoc_probe;
 #[cfg(unix)]
 pub mod maven_probe;
+mod native_tool_candidate;
+mod native_tool_discovery;
 pub mod next_command;
 #[cfg(unix)]
 mod owasp_maven_probe;

crates/codeguard-cli/src/main.rs

@@ -207,8 +207,10 @@ fn detect(args: &[String]) -> ExitCode {
             report.observation_complete, report.observed_entries
         );
         println!(
-            "普通扫描点前缀排除根：{}；配置例外文件：{}；入库安全：未评估",
-            report.dot_prefix_roots_excluded, report.configuration_exception_files_observed
+            "普通扫描点前缀排除根：{}；依赖目录排除根：{}；配置例外文件：{}；入库安全：未评估",
+            report.dot_prefix_roots_excluded,
+            report.dependency_roots_excluded,
+            report.configuration_exception_files_observed
         );
         for (language, evidence) in &report.languages {
             println!(
@@ -233,6 +235,16 @@ fn detect(args: &[String]) -> ExitCode {
                 checker.next_action
             );
         }
+        for tool in &report.native_tool_candidates {
+            println!(
+                "原生工具候选 {} [{:?}]：{}；版本：{}；下一步：{}（未执行）",
+                tool.checker_id,
+                tool.build_root,
+                tool.state,
+                tool.observed_version.as_deref().unwrap_or("未知"),
+                tool.next_action
+            );
+        }
     }
     if report.observation_complete {
         ExitCode::SUCCESS

crates/codeguard-cli/src/native_tool_candidate.rs

@@ -0,0 +1,18 @@
+use serde::Serialize;
+
+/// 只读发现的项目原生工具候选，不证明可启动、受批准或检查通过。
+#[derive(Debug, Serialize)]
+pub struct NativeToolCandidate {
+    /// 候选所属的项目构建根，相对工作区。
+    pub build_root: String,
+    /// 对应检查器的稳定身份。
+    pub checker_id: String,
+    /// 候选或阻塞的精确分类。
+    pub state: String,
+    /// 从本地包或 Wrapper 配置观察的版本。
+    pub observed_version: Option<String>,
+    /// 项目依赖声明是否可见；不输出可能包含秘密的原始声明。
+    pub declaration_observed: bool,
+    /// 下一步原生核验或环境修复动作。
+    pub next_action: String,
+}