diff --git a/README.md b/README.md index f0c10b7a..dbf070ae 100644 --- a/README.md +++ b/README.md @@ -94,9 +94,9 @@ cargo build --locked -p codeguard-cli Version output includes `cli_version`, `target`, and protocol information. Discovery and init preview return observations and unknowns. Dry-run creates neither `AGENTS.md` nor a project data directory. Add Cargo `--offline` only when dependencies are cached. -The workspace requires `std`. The opt-in `wasm-precheck` build feature uses a bounded Rust worker with fifteen pinned grammar candidates: C, C++, C#, Go, Java, JavaScript, Lua, Luau, Objective-C, Python, Rust, Solidity, TypeScript, TSX, and Zig. Java and TypeScript/TSX have narrow single-file fallback paths; `lint python` can provide bounded suspected syntax positions when Ruff is unavailable or no project Ruff configuration is declared. Native Ruff results take priority. It is absent from the published npm `0.1.2` package. No `no_std`, completed project-wide WASM fallback, zero-unsafe, or fastest-runtime claim is made. Runtime OS calls require safety review; a comprehensive security audit is not claimed. +The workspace requires `std`. The opt-in `wasm-precheck` build feature uses a bounded Rust worker with eighteen pinned grammar candidates: ArkTS, C, C++, C#, Go, Java, JavaScript, Lua, Luau, Objective-C, Python, Rust, Solidity, TypeScript, TSX, Zig, Nix, and Terraform. Java and TypeScript/TSX have narrow single-file fallback paths; `lint python` can provide bounded suspected syntax positions when Ruff is unavailable or no project Ruff configuration is declared. Native Ruff results take priority. It is absent from the published npm `0.1.2` package. No `no_std`, completed project-wide WASM fallback, zero-unsafe, or fastest-runtime claim is made. Runtime OS calls require safety review; a comprehensive security audit is not claimed. -The current source-built CLI's `codeguard grammar status --format=json` reports the coverage gap without loading grammars or running lint: the pinned CodeGraph source has 30 vendored WASM files plus two distinct grammars resolved through its dependency; CodeGuard has fifteen unqualified asset candidates (C, C++, C#, Go, Java, JavaScript, Lua, Luau, Objective-C, Python, Rust, Solidity, TypeScript, TSX, Zig) and zero released syntax capabilities. C, C++, C#, Go, JavaScript, Lua, Luau and Rust are byte-pinned CodeGraph assets that load in the Rust worker but have no public lint route or release qualification. The two dependency grammars retain their source bytes and use a byte-pinned legacy `dylink` metadata conversion for Rust loading; they have no public lint route or release qualification. Zig uses a byte-pinned import adaptation so the corrected CodeGraph grammar can load in Rust; it has no public `lint zig` route or release qualification yet. [Zig's limited acceptance record](tests/acceptance/zig-grammar-candidate.md) distinguishes this from released syntax support. Python has a source-build-only, unqualified CLI fallback path; its report remains incomplete and cannot approve delivery. The separate [coverage inventory](grammars/codegraph-coverage.json) is not an approved asset manifest. COBOL's 16.4 MB source asset also exceeds the current Rust loader's 8 MiB limit. +The current source-built CLI's `codeguard grammar status --format=json` reports the coverage gap without loading grammars or running lint: the pinned CodeGraph source has 30 vendored WASM files plus two distinct grammars resolved through its dependency; CodeGuard has eighteen unqualified asset candidates (ArkTS, C, C++, C#, Go, Java, JavaScript, Lua, Luau, Objective-C, Python, Rust, Solidity, TypeScript, TSX, Zig, Nix, Terraform) and zero released syntax capabilities. C, C++, C#, Go, JavaScript, Lua, Luau and Rust are byte-pinned CodeGraph assets that load in the Rust worker but have no public lint route or release qualification. ArkTS, Nix and Terraform are also pinned Rust-loadable candidates with narrow valid/invalid fixtures and no public lint route or release qualification; see the [limited acceptance record](tests/acceptance/arkts-nix-terraform-grammar-candidates.md). The two dependency grammars retain their source bytes and use a byte-pinned legacy `dylink` metadata conversion for Rust loading; they have no public lint route or release qualification. Zig uses a byte-pinned import adaptation so the corrected CodeGraph grammar can load in Rust; it has no public `lint zig` route or release qualification yet. [Zig's limited acceptance record](tests/acceptance/zig-grammar-candidate.md) distinguishes this from released syntax support. Python has a source-build-only, unqualified CLI fallback path; its report remains incomplete and cannot approve delivery. The separate [coverage inventory](grammars/codegraph-coverage.json) is not an approved asset manifest. COBOL's 16.4 MB source asset also exceeds the current Rust loader's 8 MiB limit. ### npm installation and one-off use diff --git a/crates/codeguard-adapters/src/grammar_asset_manifest.rs b/crates/codeguard-adapters/src/grammar_asset_manifest.rs index 8aeb1b1c..df9b7474 100644 --- a/crates/codeguard-adapters/src/grammar_asset_manifest.rs +++ b/crates/codeguard-adapters/src/grammar_asset_manifest.rs @@ -19,6 +19,9 @@ const CPP_COMMIT: &str = "f41e1a044c8a84ea9fa8577fdd2eab92ec96de02"; const CSHARP_COMMIT: &str = "cac6d5fb595f5811a076336682d5d595ac1c9e85"; const LUA_COMMIT: &str = "816840c592ab973500ae9750763c707b447e7fef"; const LUAU_COMMIT: &str = "a8914d6c1fc5131f8e1c13f769fa704c9f5eb02f"; +const ARKTS_COMMIT: &str = "56f7fc288715befe92c734d603f9e6bc3c65d2a8"; +const NIX_COMMIT: &str = "3d0173d903e630b6e14d17f1cf79488791379ded"; +const TERRAFORM_COMMIT: &str = "fad991865fee927dd1de5e172fb3f08ac674d914"; /// 代码来源、许可和每份候选 grammar 的固定身份。 #[derive(Clone, Debug, Deserialize, Eq, PartialEq)] @@ -62,6 +65,8 @@ pub struct GrammarAsset { pub grammar_commit: String, /// CodeGraph 记录的上游版本标签。 pub grammar_version: String, + /// 对预编译 npm 资产固定包完整性；其它来源为空。 + pub package_integrity: Option, /// 相对于 grammars/ 的固定制品路径。 pub path: String, /// WASM 原始字节摘要。 @@ -140,6 +145,10 @@ fn verify_dependency_license(manifest: &GrammarAssetManifest) -> Result<(), Stri fn verify_bundled_asset(asset: &GrammarAsset) -> Result<&'static [u8], String> { let (wasm, license) = match asset.language.as_str() { + "arkts" => ( + include_bytes!("../../../grammars/arkts/parser.wasm").as_slice(), + include_bytes!("../../../grammars/arkts/LICENSE").as_slice(), + ), "c" => ( include_bytes!("../../../grammars/c/parser.wasm").as_slice(), include_bytes!("../../../grammars/c/LICENSE").as_slice(), @@ -168,6 +177,10 @@ fn verify_bundled_asset(asset: &GrammarAsset) -> Result<&'static [u8], String> { include_bytes!("../../../grammars/luau/parser.wasm").as_slice(), include_bytes!("../../../grammars/luau/LICENSE").as_slice(), ), + "nix" => ( + include_bytes!("../../../grammars/nix/parser.wasm").as_slice(), + include_bytes!("../../../grammars/nix/LICENSE").as_slice(), + ), "java" => ( include_bytes!("../../../grammars/java/parser.wasm").as_slice(), include_bytes!("../../../grammars/java/LICENSE").as_slice(), @@ -200,6 +213,10 @@ fn verify_bundled_asset(asset: &GrammarAsset) -> Result<&'static [u8], String> { include_bytes!("../../../grammars/rust/parser.wasm").as_slice(), include_bytes!("../../../grammars/rust/LICENSE").as_slice(), ), + "terraform" => ( + include_bytes!("../../../grammars/terraform/parser.wasm").as_slice(), + include_bytes!("../../../grammars/terraform/LICENSE").as_slice(), + ), _ => return Err("候选语言未知".into()), }; verify_grammar_asset(asset, wasm, license)?; @@ -237,7 +254,7 @@ pub fn parse_grammar_asset_manifest(raw: &[u8]) -> Result Result Result Result Result ( + "https://github.com/harmony-contrib/tree-sitter-arkts", + ARKTS_COMMIT, + "0.2.0", + "arkts/parser.wasm", + "db0812971109457d22b3fe9dcdb1cd8e614fba2a338e220670bd254485753623", + 4384161, + "arkts/LICENSE", + "048e4dcb7a71fb725495ebb3e7052d0e76dcb6705b828af8b9b461df10bcd8ca", + ), "c" => ( "https://github.com/tree-sitter/tree-sitter-c", C_COMMIT, @@ -368,6 +398,16 @@ pub fn parse_grammar_asset_manifest(raw: &[u8]) -> Result ( + "https://github.com/nix-community/tree-sitter-nix", + NIX_COMMIT, + "3d0173d+codegraph-cli-0.25.10", + "nix/parser.wasm", + "4acffa1c013df751193a21ce429777ca214c7d3a7e3665085b6df00dad8869f0", + 80876, + "nix/LICENSE", + "c1b72e50266464ec5118d26200e17bf1f472d142e62ab637e1ffc23986657a78", + ), "rust" => ( "https://github.com/tree-sitter/tree-sitter-rust", RUST_COMMIT, @@ -428,9 +468,29 @@ pub fn parse_grammar_asset_manifest(raw: &[u8]) -> Result ( + "https://github.com/tree-sitter-grammars/tree-sitter-hcl", + TERRAFORM_COMMIT, + "1.2.0", + "terraform/parser.wasm", + "0d9ef3ae926acc0411bfecba9b34df4ea659061917b96455570a45a70824e890", + 92484, + "terraform/LICENSE", + "c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4", + ), _ => return Err("grammar 语言未知".into()), }; if asset.dialect != asset.language + || asset.package_integrity.as_deref() + != match asset.language.as_str() { + "arkts" => Some( + "tree-sitter-arkts@0.2.0 sha512-j4KpZ21YdX5koXiuuslML24LoKLOzV6uZ1PMG//c/ynAoQfD7XY2LWnFxJiX0sOLqf2pOEYHdUmKFnXjm4QL4g==", + ), + "terraform" => Some( + "@tree-sitter-grammars/tree-sitter-hcl@1.2.0 sha512-2bVnOojkkdMLevp0G4v3ksbNoOQFc/Pt9GAdWX4i3aykVyI+CkktE1hsF/XAeUQFjwgGrVZnEyeCll5oD7Ibfg==", + ), + _ => None, + } || asset.loader_symbol.as_deref() != if asset.language == "csharp" { Some("c_sharp") @@ -465,7 +525,7 @@ pub fn parse_grammar_asset_manifest(raw: &[u8]) -> Result ( + include_bytes!("../../../grammars/arkts/parser.wasm").as_slice(), + include_bytes!("../../../grammars/arkts/LICENSE").as_slice(), + ), "c" => ( include_bytes!("../../../grammars/c/parser.wasm").as_slice(), include_bytes!("../../../grammars/c/LICENSE").as_slice(), @@ -94,6 +98,10 @@ fn bundled_candidates_pin_source_bytes_license_and_abi_without_claiming_support( include_bytes!("../../../grammars/luau/parser.wasm").as_slice(), include_bytes!("../../../grammars/luau/LICENSE").as_slice(), ), + "nix" => ( + include_bytes!("../../../grammars/nix/parser.wasm").as_slice(), + include_bytes!("../../../grammars/nix/LICENSE").as_slice(), + ), "java" => ( include_bytes!("../../../grammars/java/parser.wasm").as_slice(), include_bytes!("../../../grammars/java/LICENSE").as_slice(), @@ -126,6 +134,10 @@ fn bundled_candidates_pin_source_bytes_license_and_abi_without_claiming_support( include_bytes!("../../../grammars/rust/parser.wasm").as_slice(), include_bytes!("../../../grammars/rust/LICENSE").as_slice(), ), + "terraform" => ( + include_bytes!("../../../grammars/terraform/parser.wasm").as_slice(), + include_bytes!("../../../grammars/terraform/LICENSE").as_slice(), + ), other => panic!("unexpected language {other}"), }; verify_grammar_asset(asset, wasm, license).expect("pinned candidate bytes"); @@ -188,6 +200,12 @@ fn missing_provenance_duplicate_fields_and_unknown_languages_are_rejected() { 1, ); assert!(parse_grammar_asset_manifest(wrong_symbol.as_bytes()).is_err()); + let wrong_npm_integrity = original.replacen( + "tree-sitter-arkts@0.2.0 sha512-j4KpZ21YdX5koXiuuslML24LoKLOzV6uZ1PMG//c/ynAoQfD7XY2LWnFxJiX0sOLqf2pOEYHdUmKFnXjm4QL4g==", + "tree-sitter-arkts@0.2.0 sha512-forged", + 1, + ); + assert!(parse_grammar_asset_manifest(wrong_npm_integrity.as_bytes()).is_err()); } #[test] diff --git a/crates/codeguard-cli/tests/grammar_status_cli.rs b/crates/codeguard-cli/tests/grammar_status_cli.rs index 3c262c78..ef3aadd1 100644 --- a/crates/codeguard-cli/tests/grammar_status_cli.rs +++ b/crates/codeguard-cli/tests/grammar_status_cli.rs @@ -12,7 +12,7 @@ fn codegraph_coverage_is_explicit_and_never_claims_parser_or_gate_completion() { assert_eq!(report["report_type"], "grammar_coverage_inventory"); assert_eq!(report["codegraph_grammar_count"], 32); assert_eq!(report["codegraph_vendored_count"], 30); - assert_eq!(report["candidate_count"], 15); + assert_eq!(report["candidate_count"], 18); assert_eq!(report["released_count"], 0); assert_eq!(report["authority"], "source_inventory_only"); assert_eq!(report["parser_capability"], "unverified"); @@ -26,6 +26,7 @@ fn codegraph_coverage_is_explicit_and_never_claims_parser_or_gate_completion() { assert!(!asset["gap"].as_str().unwrap().is_empty()); } for language in [ + "arkts", "c", "cpp", "csharp", @@ -34,10 +35,12 @@ fn codegraph_coverage_is_explicit_and_never_claims_parser_or_gate_completion() { "javascript", "lua", "luau", + "nix", "objc", "python", "rust", "solidity", + "terraform", "typescript", "tsx", "zig", diff --git a/crates/codeguard-cli/tests/syntax_worker_candidate.rs b/crates/codeguard-cli/tests/syntax_worker_candidate.rs index 740a1e8d..1cb6f645 100644 --- a/crates/codeguard-cli/tests/syntax_worker_candidate.rs +++ b/crates/codeguard-cli/tests/syntax_worker_candidate.rs @@ -164,6 +164,36 @@ fn cpp_csharp_lua_and_luau_run_in_worker_without_claiming_clean() { } } +#[test] +fn arkts_nix_and_terraform_run_in_worker_without_claiming_clean() { + for (language, path, source) in [ + ( + "arkts", + "src/Main.ets", + b"@Component struct C { build() { Text('hi') } }".as_slice(), + ), + ("nix", "flake.nix", b"let x = 1; in x".as_slice()), + ( + "terraform", + "main.tf", + b"resource \"x\" \"y\" { foo = \"bar\" }".as_slice(), + ), + ] { + let result = run_syntax_worker_candidate( + env!("CARGO_BIN_EXE_codeguard").as_ref(), + language, + path, + source, + Instant::now() + Duration::from_secs(60), + &AtomicBool::new(false), + ) + .expect("grammar worker candidate"); + assert!(result.recoveries.is_empty(), "{language}"); + assert_eq!(result.precheck.status, SyntaxPrecheckStatus::Incomplete); + assert!(!result.grammar_qualified); + } +} + #[test] fn invalid_input_and_cancellation_cannot_yield_observations() { let exe = env!("CARGO_BIN_EXE_codeguard").as_ref(); diff --git a/crates/codeguard-runtime/tests/wasm_grammar_load.rs b/crates/codeguard-runtime/tests/wasm_grammar_load.rs index 0031fb96..85d4939d 100644 --- a/crates/codeguard-runtime/tests/wasm_grammar_load.rs +++ b/crates/codeguard-runtime/tests/wasm_grammar_load.rs @@ -18,6 +18,50 @@ const CPP: &[u8] = include_bytes!("../../../grammars/cpp/parser.wasm"); const CSHARP: &[u8] = include_bytes!("../../../grammars/csharp/parser.wasm"); const LUA: &[u8] = include_bytes!("../../../grammars/lua/parser.wasm"); const LUAU: &[u8] = include_bytes!("../../../grammars/luau/parser.wasm"); +const ARKTS: &[u8] = include_bytes!("../../../grammars/arkts/parser.wasm"); +const NIX: &[u8] = include_bytes!("../../../grammars/nix/parser.wasm"); +const TERRAFORM: &[u8] = include_bytes!("../../../grammars/terraform/parser.wasm"); + +#[test] +fn third_batch_grammars_load_offline_and_parse_basic_fixtures() { + for (name, wasm, sha, abi, valid, invalid) in [ + ( + "arkts", + ARKTS, + "db0812971109457d22b3fe9dcdb1cd8e614fba2a338e220670bd254485753623", + 14, + b"@Component struct C { build() { Text('hi') } }".as_slice(), + b"@Component struct C { build( {".as_slice(), + ), + ( + "nix", + NIX, + "4acffa1c013df751193a21ce429777ca214c7d3a7e3665085b6df00dad8869f0", + 15, + b"let x = 1; in x".as_slice(), + b"let x = ; in x".as_slice(), + ), + ( + "terraform", + TERRAFORM, + "0d9ef3ae926acc0411bfecba9b34df4ea659061917b96455570a45a70824e890", + 14, + b"resource \"x\" \"y\" { foo = \"bar\" }".as_slice(), + b"resource \"x\" {".as_slice(), + ), + ] { + let mut grammar = WasmGrammar::load(name, wasm, sha, abi) + .unwrap_or_else(|reason| panic!("{name} offline load: {reason}")); + assert!( + !grammar.parse(valid).unwrap().root_node().has_error(), + "{name} valid" + ); + assert!( + grammar.parse(invalid).unwrap().root_node().has_error(), + "{name} invalid" + ); + } +} #[test] fn second_batch_grammars_load_offline_and_parse_basic_fixtures() { diff --git a/docs/Codeguard-Architecture.md b/docs/Codeguard-Architecture.md index 4d78b327..1c8782c3 100644 --- a/docs/Codeguard-Architecture.md +++ b/docs/Codeguard-Architecture.md @@ -28,7 +28,7 @@ The existing [OpenSpec change](../openspec/changes/introduce-rust-codeguard-cli/ | [Core aggregation](../crates/codeguard-core/src/aggregate.rs), [delivery gate](../crates/codeguard-core/src/delivery_gate.rs) | Pure result semantics, not trusted public gate availability | | [Acceptance records](../tests/acceptance) | Scoped observations, test method, and residual gaps | -WASM requirements and 19 implementation tasks are recorded in the existing change. An opt-in Rust worker and narrow Java/TypeScript/TSX single-file feedback paths and a Python Ruff-unavailable candidate path now exist. All fifteen grammars remain unqualified; C, C++, C#, Go, JavaScript, Lua, Luau, Rust, Zig, Objective-C and Solidity are pinned Rust-loadable candidates without public lint routes. Project-wide native-first routing, qualified grammar ranges, capability-matched task closure, and host integrations remain incomplete; design examples are not current command output. +WASM requirements and 19 implementation tasks are recorded in the existing change. An opt-in Rust worker and narrow Java/TypeScript/TSX single-file feedback paths and a Python Ruff-unavailable candidate path now exist. All eighteen candidate grammars remain unqualified; ArkTS, C, C++, C#, Go, JavaScript, Lua, Luau, Nix, Rust, Terraform, Zig, Objective-C and Solidity are pinned Rust-loadable candidates without public lint routes. Project-wide native-first routing, qualified grammar ranges, capability-matched task closure, and host integrations remain incomplete; design examples are not current command output. ## 2. Architectural drivers @@ -241,7 +241,7 @@ A completed native violation never selects fallback to obtain a clean result. A Reuse pinned CodeGraph grammar WASM artifacts and applicable upstream licenses, source references, patches and corpus cases. Do not copy CodeGraph's graph extraction or source-blanking heuristics into a syntax verdict. CodeGraph's `src/extraction/grammars.ts` loads language artifacts through `web-tree-sitter`; successful loading there does not prove compatibility with Codeguard's Rust runtime. The local source review on 2026-09-28 found modified grammar artifacts and about 65 MB of grammar files, so a live directory is not a release input. -The read-only `codeguard grammar status` command now projects a [pinned CodeGraph coverage inventory](../grammars/codegraph-coverage.json): 30 vendored WASM files and two dependency-provided grammars, with Java, Python, TypeScript, TSX and Zig as CodeGuard asset candidates and none qualified for release. The corrected Zig source WASM requires a pinned import adaptation to load in Rust; public `lint zig` and language qualification remain open. Python has a narrow source-build-only fallback for unavailable or undeclared Ruff, with native results taking priority and no delivery approval. An initialized single-file scope now syncs one stable native-confirmation task; candidate zero recoveries do not close it. This inventory is deliberately separate from the pinned [candidate asset manifest](../grammars/manifest.json). In particular, the COBOL source file exceeds the current loader's 8 MiB input limit. Inventory rows never trigger loading or count as supported parser capability. +The read-only `codeguard grammar status` command projects a [pinned CodeGraph coverage inventory](../grammars/codegraph-coverage.json): 30 vendored WASM files and two dependency-provided grammars. CodeGuard currently pins 18 Rust-loadable candidates, including ArkTS, Nix and Terraform; none is qualified for release. Their fixed source, npm-package integrity where applicable, and narrow worker evidence are recorded in the [candidate acceptance](../tests/acceptance/arkts-nix-terraform-grammar-candidates.md). ArkTS, Nix and Terraform have pinned bytes, licenses and narrow Rust worker evidence, but no public lint route or release qualification; see the [limited acceptance record](../tests/acceptance/arkts-nix-terraform-grammar-candidates.md). The corrected Zig source WASM requires a pinned import adaptation to load in Rust; public `lint zig` and language qualification remain open. Python has a narrow source-build-only fallback for unavailable or undeclared Ruff, with native results taking priority and no delivery approval. An initialized single-file scope now syncs one stable native-confirmation task; candidate zero recoveries do not close it. This inventory is deliberately separate from the pinned [candidate asset manifest](../grammars/manifest.json). In particular, the COBOL source file exceeds the current loader's 8 MiB input limit. Inventory rows never trigger loading or count as supported parser capability. ```text grammars/ # proposed release assets, not project state diff --git a/docs/Codeguard-Architecture.zh_CN.md b/docs/Codeguard-Architecture.zh_CN.md index 2d32ee09..f85533fd 100644 --- a/docs/Codeguard-Architecture.zh_CN.md +++ b/docs/Codeguard-Architecture.zh_CN.md @@ -28,7 +28,7 @@ | [核心聚合](../crates/codeguard-core/src/aggregate.rs)、[交付门禁](../crates/codeguard-core/src/delivery_gate.rs) | 纯结果语义，不代表公开可信门禁已可用 | | [验收记录](../tests/acceptance) | 限定范围的观察、测试方法和剩余缺口 | -WASM 的规范与 19 项实施任务已纳入既有 change；可选 Rust worker 与 Java/TypeScript/TSX 局部单文件反馈路径及 Python Ruff 不可用时的候选路径已存在；十五份 grammar 都尚未验收；C、C++、C#、Go、JavaScript、Lua、Luau、Rust、Zig、Objective-C、Solidity 仅有固定字节的 Rust 可加载候选资产，尚无公开 lint 路由。项目级原生优先调度、grammar 版本范围验收、任务的能力匹配关闭及宿主接线仍未完成；设计示例不是当前命令输出。 +WASM 的规范与 19 项实施任务已纳入既有 change；可选 Rust worker 与 Java/TypeScript/TSX 局部单文件反馈路径及 Python Ruff 不可用时的候选路径已存在；十八份候选 grammar 都尚未验收；ArkTS、C、C++、C#、Go、JavaScript、Lua、Luau、Nix、Rust、Terraform、Zig、Objective-C、Solidity 仅有固定字节的 Rust 可加载候选资产，尚无公开 lint 路由。项目级原生优先调度、grammar 版本范围验收、任务的能力匹配关闭及宿主接线仍未完成；设计示例不是当前命令输出。 ## 2. 架构驱动 @@ -241,7 +241,7 @@ flowchart TD 复用固定版本的 CodeGraph grammar WASM，以及适用的上游许可证、源码引用、补丁和语料。不能把 CodeGraph 的图提取或源码遮盖启发式直接用于语法判定。CodeGraph 的 `src/extraction/grammars.ts` 通过 `web-tree-sitter` 加载语言资产，在那里可加载不证明兼容 Codeguard 的 Rust 运行时。发行时必须固定不可变的来源与资产清单，不能把正在修改的本地目录直接当作发行输入。 -只读 `codeguard grammar status` 现投影[固定来源覆盖库存](../grammars/codegraph-coverage.json)：CodeGraph 随仓 30 份 WASM，依赖提供另两种独立 grammar；CodeGuard 有 C、C++、C#、Go、Java、JavaScript、Lua、Luau、Objective-C、Python、Rust、Solidity、TypeScript、TSX、Zig 十五份资产候选。C、C++、C#、Go、JavaScript、Lua、Luau、Rust 的 CodeGraph 随仓字节及上游标签许可证已固定，可由 Rust worker 解析基础正反例，但尚未进行语言验收或公开 lint 接线。Objective-C 与 Solidity 来自锁定的 `tree-sitter-wasms@0.1.13`，保留原始字节和许可证，并以固定散列的 `dylink` 元数据转换加载；仍未做语言验收与发行。Zig 新版来源 WASM 的导入经固定哈希适配后由 Rust 加载，但仍无公开 `lint zig` 路由，尚无已验收发行能力。Python 已有源码可选构建中的局部 `lint` 兜底，仅覆盖 Ruff 不可用或项目未声明配置的情形；原生结果优先且不能批准交付。已初始化工作区的单文件范围可同步稳定的原生确认任务；候选零恢复节点不会关闭任务。覆盖库存与[候选资产清单](../grammars/manifest.json)分开，不能凭库存行自动加载或宣称支持。尤其 COBOL 来源资产超过当前加载器 8 MiB 限额。 +只读 `codeguard grammar status` 现投影[固定来源覆盖库存](../grammars/codegraph-coverage.json)：CodeGraph 随仓 30 份 WASM，依赖提供另两种独立 grammar；CodeGuard 有 C、C++、C#、Go、Java、JavaScript、Lua、Luau、Objective-C、Python、Rust、Solidity、TypeScript、TSX、Zig、ArkTS、Nix、Terraform 十八份资产候选。C、C++、C#、Go、JavaScript、Lua、Luau、Rust 的 CodeGraph 随仓字节及上游标签许可证已固定，可由 Rust worker 解析基础正反例，但尚未进行语言验收或公开 lint 接线。ArkTS、Nix、Terraform 的来源、许可证、字节及 Rust 正反例也已固定，仅为候选，尚无公开 lint 路由或发行验收；见[局部验收](../tests/acceptance/arkts-nix-terraform-grammar-candidates.md)。Objective-C 与 Solidity 来自锁定的 `tree-sitter-wasms@0.1.13`，保留原始字节和许可证，并以固定散列的 `dylink` 元数据转换加载；仍未做语言验收与发行。Zig 新版来源 WASM 的导入经固定哈希适配后由 Rust 加载，但仍无公开 `lint zig` 路由，尚无已验收发行能力。Python 已有源码可选构建中的局部 `lint` 兜底，仅覆盖 Ruff 不可用或项目未声明配置的情形；原生结果优先且不能批准交付。已初始化工作区的单文件范围可同步稳定的原生确认任务；候选零恢复节点不会关闭任务。覆盖库存与[候选资产清单](../grammars/manifest.json)分开，不能凭库存行自动加载或宣称支持。尤其 COBOL 来源资产超过当前加载器 8 MiB 限额。 ```text grammars/ # 规划中的发行资产，不是项目状态 diff --git a/docs/Codeguard-Technical-Design.md b/docs/Codeguard-Technical-Design.md index a4c480e6..9c886e7b 100644 --- a/docs/Codeguard-Technical-Design.md +++ b/docs/Codeguard-Technical-Design.md @@ -14,7 +14,7 @@ The existing [OpenSpec change](../openspec/changes/introduce-rust-codeguard-cli/ Current source is the authority for callable behavior. Target contracts are labelled as such. The product priority is configuration discovery → native results → useful repair guidance. Internal consistency checks support this experience; they are not a demand for users to manually construct execution certificates. -WASM requirements and 19 implementation tasks are recorded in the existing change. Candidate Rust worker and narrow Java/TypeScript/TSX single-file reports and a Python Ruff-unavailable candidate report now exist behind an opt-in feature; all fifteen grammars remain unqualified; C, C++, C#, Go, JavaScript, Lua, Luau, Rust, Zig, Objective-C and Solidity are only Rust-loadable candidates. Project-wide native-first routing, qualified grammar ranges, and host integrations remain incomplete. Design examples are not current command output. +WASM requirements and 19 implementation tasks are recorded in the existing change. Candidate Rust worker and narrow Java/TypeScript/TSX single-file reports and a Python Ruff-unavailable candidate report now exist behind an opt-in feature; all eighteen candidate grammars remain unqualified; ArkTS, C, C++, C#, Go, JavaScript, Lua, Luau, Nix, Rust, Terraform, Zig, Objective-C and Solidity are only Rust-loadable candidates. Project-wide native-first routing, qualified grammar ranges, and host integrations remain incomplete. Design examples are not current command output. ## 2. Technology choices and trade-offs @@ -191,7 +191,7 @@ The opt-in CLI build first checks for a local ESLint 10 package and a single ord Import only pinned WASM bytes with upstream license, commit/patch provenance, SHA-256, ABI, tested runtime and language/dialect ranges, corpus reference and known gaps. Verify each copied CodeGraph artifact in the selected Rust Tree-sitter runtime; do not copy TypeScript extraction logic or assume CodeGraph support equals syntax acceptance. A release manifest belongs to distribution assets, not writable `.codeguard/` project state. -Use `codeguard grammar status --format=json` to query the separate source coverage inventory. It reports 32 distinct CodeGraph grammar assets, fifteen CodeGuard asset candidates (C, C++, C#, Go, Java, JavaScript, Lua, Luau, Objective-C, Python, Rust, Solidity, TypeScript, TSX and Zig), and zero released capabilities without running a parser. Python has a narrow source-build-only `lint` fallback for unavailable or undeclared Ruff, never a clean or delivery result. A bound, single-file result uses [feedback 0.15.0](../schemas/python-lint-feedback-v0.15.schema.json) and persists a [0.1.0 confirmation observation](../schemas/python-syntax-confirmation-observation-v0.1.schema.json) through the existing work sync. The task identity binds workspace and source scope; current-source SHA-256 and pinned grammar are checked before import. Native capability-matched closure remains open. C, C++, C#, Go, JavaScript, Lua, Luau and Rust have pinned vendored bytes and narrow Rust worker smoke tests, but no public lint route or language qualification. The two dependency-provided assets now have pinned original and adapted bytes plus license references, but are still unqualified candidates without public lint routes. COBOL exceeds the current 8 MiB loader limit. +Use `codeguard grammar status --format=json` to query the separate source coverage inventory. It reports 32 distinct CodeGraph grammar assets, eighteen CodeGuard asset candidates (ArkTS, C, C++, C#, Go, Java, JavaScript, Lua, Luau, Objective-C, Python, Rust, Solidity, TypeScript, TSX, Zig, Nix and Terraform), and zero released capabilities without running a parser. Python has a narrow source-build-only `lint` fallback for unavailable or undeclared Ruff, never a clean or delivery result. A bound, single-file result uses [feedback 0.15.0](../schemas/python-lint-feedback-v0.15.schema.json) and persists a [0.1.0 confirmation observation](../schemas/python-syntax-confirmation-observation-v0.1.schema.json) through the existing work sync. The task identity binds workspace and source scope; current-source SHA-256 and pinned grammar are checked before import. Native capability-matched closure remains open. C, C++, C#, Go, JavaScript, Lua, Luau and Rust have pinned vendored bytes and narrow Rust worker smoke tests, but no public lint route or language qualification. ArkTS, Nix and Terraform have pinned bytes, licenses and narrow Rust worker evidence, but no public lint route or release qualification; see the [limited acceptance record](../tests/acceptance/arkts-nix-terraform-grammar-candidates.md). The two dependency-provided assets now have pinned original and adapted bytes plus license references, but are still unqualified candidates without public lint routes. COBOL exceeds the current 8 MiB loader limit. Use a parent-controlled parser worker with a total deadline, per-file input bound, memory/process limit and capped diagnostics. Lazy-load selected grammars, parse without general network/filesystem imports, and terminate a stuck worker without losing native results from other modules. Host-specific enforcement and Rust MSRV compatibility must be tested; numeric production budgets remain measurement-driven rather than invented promises. diff --git a/docs/Codeguard-Technical-Design.zh_CN.md b/docs/Codeguard-Technical-Design.zh_CN.md index 1c72b0a1..44406747 100644 --- a/docs/Codeguard-Technical-Design.zh_CN.md +++ b/docs/Codeguard-Technical-Design.zh_CN.md @@ -14,7 +14,7 @@ 可调用行为以当前源码为准，目标契约明确标注。产品优先级是配置发现 → 原生结果 → 有用的修复指引。内部一致性校验为这个体验服务，不要求用户手工构造执行证明。 -WASM 的规范与 19 项实施任务已纳入既有 change；可选特性下的 Rust worker 与 Java/TypeScript/TSX 局部单文件候选报告及 Python Ruff 不可用时的候选报告已存在；十五份 grammar 均未验收；C、C++、C#、Go、JavaScript、Lua、Luau、Rust、Zig、Objective-C、Solidity 仅有固定字节的 Rust 可加载候选资产，尚无公开 lint 路由。项目级原生优先调度、grammar 版本范围验收与宿主接线仍未完成。设计示例不是当前命令输出。 +WASM 的规范与 19 项实施任务已纳入既有 change；可选特性下的 Rust worker 与 Java/TypeScript/TSX 局部单文件候选报告及 Python Ruff 不可用时的候选报告已存在；十八份候选 grammar 均未验收；ArkTS、C、C++、C#、Go、JavaScript、Lua、Luau、Nix、Rust、Terraform、Zig、Objective-C、Solidity 仅有固定字节的 Rust 可加载候选资产，尚无公开 lint 路由。项目级原生优先调度、grammar 版本范围验收与宿主接线仍未完成。设计示例不是当前命令输出。 ## 2. 技术选型与权衡 @@ -191,7 +191,7 @@ flowchart LR 只引入固定 WASM 字节及上游许可证、提交/补丁来源、SHA-256、ABI、已验证运行时和语言/方言范围、语料引用与已知缺口。逐个验证 CodeGraph 资产与选定 Rust Tree-sitter 运行时兼容，不能复制 TypeScript 提取逻辑或把 CodeGraph 支持等同语法验收。发行清单属于分发资产，不属于可写的 `.codeguard/` 项目状态。 -可用 `codeguard grammar status --format=json` 查询独立的来源覆盖库存。它只读报告 CodeGraph 32 种独立 grammar、CodeGuard 十五份资产候选（C、C++、C#、Go、Java、JavaScript、Lua、Luau、Objective-C、Python、Rust、Solidity、TypeScript、TSX、Zig）和零项已发行能力，不运行解析器；Python 已有源码可选构建中的局部 `lint` 兜底，结果不能视为通过。已绑定工作区的单文件反馈使用 [0.15.0 协议](../schemas/python-lint-feedback-v0.15.schema.json)，并通过现有 work sync 保存 [0.1.0 确认观察](../schemas/python-syntax-confirmation-observation-v0.1.schema.json)。任务身份绑定工作区和源码范围；导入前核对当前源码 SHA-256 与固定 grammar。能力匹配的原生关闭仍未完成。C、C++、C#、Go、JavaScript、Lua、Luau、Rust 的随仓字节和上游许可证已固定，完成窄范围 Rust worker 解析验证，尚无公开 lint 路由或语言验收。依赖提供的 Objective-C 与 Solidity 已固定原始和适配后字节、许可证及依赖包完整性，但仍未验收语言版本或公开 lint 路由；COBOL 超过现有加载器的 8 MiB 限额。 +可用 `codeguard grammar status --format=json` 查询独立的来源覆盖库存。它只读报告 CodeGraph 32 种独立 grammar、CodeGuard 十八份资产候选（ArkTS、C、C++、C#、Go、Java、JavaScript、Lua、Luau、Objective-C、Python、Rust、Solidity、TypeScript、TSX、Zig、Nix、Terraform）和零项已发行能力，不运行解析器；Python 已有源码可选构建中的局部 `lint` 兜底，结果不能视为通过。已绑定工作区的单文件反馈使用 [0.15.0 协议](../schemas/python-lint-feedback-v0.15.schema.json)，并通过现有 work sync 保存 [0.1.0 确认观察](../schemas/python-syntax-confirmation-observation-v0.1.schema.json)。任务身份绑定工作区和源码范围；导入前核对当前源码 SHA-256 与固定 grammar。能力匹配的原生关闭仍未完成。C、C++、C#、Go、JavaScript、Lua、Luau、Rust 的随仓字节和上游许可证已固定，完成窄范围 Rust worker 解析验证，尚无公开 lint 路由或语言验收。ArkTS、Nix、Terraform 的来源、许可证、字节及 Rust 正反例也已固定，仅为候选，尚无公开 lint 路由或发行验收；见[局部验收](../tests/acceptance/arkts-nix-terraform-grammar-candidates.md)。依赖提供的 Objective-C 与 Solidity 已固定原始和适配后字节、许可证及依赖包完整性，但仍未验收语言版本或公开 lint 路由；COBOL 超过现有加载器的 8 MiB 限额。 由父进程控制解析工作进程，设置总截止时间、单文件输入上限、内存/进程限制及诊断数量上限。按需加载 grammar，不提供通用网络/文件系统导入；终止卡住的进程时保留其它模块的原生结果。宿主约束执行和 Rust MSRV 兼容性须测试，生产数值预算须经测量后确定，不编造性能承诺。 diff --git a/grammars/arkts/LICENSE b/grammars/arkts/LICENSE new file mode 100644 index 00000000..7da2fb88 --- /dev/null +++ b/grammars/arkts/LICENSE @@ -0,0 +1,43 @@ +MIT License + +Copyright (c) 2026-present richerfu + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + +The MIT License (MIT) + +Copyright (c) 2017 Max Brunsfeld + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/grammars/arkts/parser.wasm b/grammars/arkts/parser.wasm new file mode 100644 index 00000000..4753f37c Binary files /dev/null and b/grammars/arkts/parser.wasm differ diff --git a/grammars/manifest.json b/grammars/manifest.json index ec72dd4d..90b77101 100644 --- a/grammars/manifest.json +++ b/grammars/manifest.json @@ -4,7 +4,7 @@ "source_commit": "1072f82ce24db3d133258d30165cef6b74d108b2", "codegraph_license": "LICENSE.codegraph", "codegraph_license_sha256": "e6d98f98c666bebe065ac2492a0a19232cc318d4d67bac3ca42ffb77bacc8809", - "build_tool": "tree-sitter-cli 0.25.10 build --wasm; Zig: tree-sitter-cli 0.27.0 generate --abi 15 + Zig 0.16.0 wasm32-wasi", + "build_tool": "tree-sitter-cli 0.25.10 build --wasm; Zig: tree-sitter-cli 0.27.0 generate --abi 15 + Zig 0.16.0 wasm32-wasi; ArkTS/Terraform: pinned npm prebuilt WASM", "assets": [ { "language": "c", @@ -310,6 +310,62 @@ "Rust loader smoke passed with byte-pinned import adaptation; Zig versions, corpus differential, resource isolation and release are not yet qualified" ], "release_status": "candidate_unvalidated" + }, + { + "language": "arkts", + "dialect": "arkts", + "grammar_repository": "https://github.com/harmony-contrib/tree-sitter-arkts", + "grammar_commit": "56f7fc288715befe92c734d603f9e6bc3c65d2a8", + "grammar_version": "0.2.0", + "package_integrity": "tree-sitter-arkts@0.2.0 sha512-j4KpZ21YdX5koXiuuslML24LoKLOzV6uZ1PMG//c/ynAoQfD7XY2LWnFxJiX0sOLqf2pOEYHdUmKFnXjm4QL4g==", + "path": "arkts/parser.wasm", + "sha256": "db0812971109457d22b3fe9dcdb1cd8e614fba2a338e220670bd254485753623", + "bytes": 4384161, + "license": "arkts/LICENSE", + "license_sha256": "048e4dcb7a71fb725495ebb3e7052d0e76dcb6705b828af8b9b461df10bcd8ca", + "abi_version": 14, + "codegraph_runtime": "web-tree-sitter 0.25.3", + "codeguard_runtime_validation": "rust_loader_smoke_passed", + "language_versions": [], + "known_limitations": ["Rust loader and narrow fixtures passed; ArkTS language versions, dialect corpus, native differential, isolation and release remain unqualified"], + "release_status": "candidate_unvalidated" + }, + { + "language": "nix", + "dialect": "nix", + "grammar_repository": "https://github.com/nix-community/tree-sitter-nix", + "grammar_commit": "3d0173d903e630b6e14d17f1cf79488791379ded", + "grammar_version": "3d0173d+codegraph-cli-0.25.10", + "path": "nix/parser.wasm", + "sha256": "4acffa1c013df751193a21ce429777ca214c7d3a7e3665085b6df00dad8869f0", + "bytes": 80876, + "license": "nix/LICENSE", + "license_sha256": "c1b72e50266464ec5118d26200e17bf1f472d142e62ab637e1ffc23986657a78", + "abi_version": 15, + "codegraph_runtime": "web-tree-sitter 0.25.3", + "codeguard_runtime_validation": "rust_loader_smoke_passed", + "language_versions": [], + "known_limitations": ["Rust loader and narrow fixtures passed; Nix language versions, dialect corpus, native differential, isolation and release remain unqualified"], + "release_status": "candidate_unvalidated" + }, + { + "language": "terraform", + "dialect": "terraform", + "grammar_repository": "https://github.com/tree-sitter-grammars/tree-sitter-hcl", + "grammar_commit": "fad991865fee927dd1de5e172fb3f08ac674d914", + "grammar_version": "1.2.0", + "package_integrity": "@tree-sitter-grammars/tree-sitter-hcl@1.2.0 sha512-2bVnOojkkdMLevp0G4v3ksbNoOQFc/Pt9GAdWX4i3aykVyI+CkktE1hsF/XAeUQFjwgGrVZnEyeCll5oD7Ibfg==", + "path": "terraform/parser.wasm", + "sha256": "0d9ef3ae926acc0411bfecba9b34df4ea659061917b96455570a45a70824e890", + "bytes": 92484, + "license": "terraform/LICENSE", + "license_sha256": "c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4", + "abi_version": 14, + "codegraph_runtime": "web-tree-sitter 0.25.3", + "codeguard_runtime_validation": "rust_loader_smoke_passed", + "language_versions": [], + "known_limitations": ["Rust loader and narrow fixtures passed; Terraform language versions, dialect corpus, native differential, isolation and release remain unqualified"], + "release_status": "candidate_unvalidated" } ], "dependency_package_integrity": "tree-sitter-wasms@0.1.13 sha512-wT+cR6DwaIz80/vho3AvSF0N4txuNx/5bcRKoXouOfClpxh/qqrF4URNLQXbbt8MaAxeksZcZd1j8gcGjc+QxQ==", diff --git a/grammars/nix/LICENSE b/grammars/nix/LICENSE new file mode 100644 index 00000000..cfa8a0f5 --- /dev/null +++ b/grammars/nix/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2019 Charles Strahan + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/grammars/nix/parser.wasm b/grammars/nix/parser.wasm new file mode 100644 index 00000000..4bc05ad9 Binary files /dev/null and b/grammars/nix/parser.wasm differ diff --git a/grammars/terraform/LICENSE b/grammars/terraform/LICENSE new file mode 100644 index 00000000..261eeb9e --- /dev/null +++ b/grammars/terraform/LICENSE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/grammars/terraform/parser.wasm b/grammars/terraform/parser.wasm new file mode 100644 index 00000000..5a5e0e1d Binary files /dev/null and b/grammars/terraform/parser.wasm differ diff --git a/openspec/changes/introduce-rust-codeguard-cli/tasks.md b/openspec/changes/introduce-rust-codeguard-cli/tasks.md index aa2bbf7d..6c6eea25 100644 --- a/openspec/changes/introduce-rust-codeguard-cli/tasks.md +++ b/openspec/changes/introduce-rust-codeguard-cli/tasks.md @@ -1046,6 +1046,8 @@ TDD缺自动同步先RED。相关普通：build9、work sync15、next6，共30 - [ ] 14.16 Gemini CLI 实际对话接入。责任：plugin。规格：SP07,SP12。依赖：14.9,14.10。验收：独立验证真实 Gemini 对话反馈、去重、故障和权限边界，不借用其他宿主结果。 - [ ] 14.17 逐语言误报与性能评测。责任：评测/adapters。规格：SP06,SP12。依赖：14.3,14.4,14.11。验收：独立合法/非法 oracle、版本/方言语料、原生对照；分别报告误报、漏报、未知覆盖及冷暖启动/包体/内存；先实测再定预算。 - [ ] 14.18 打包兼容与分阶段发布验收。责任：发布/CLI。规格：SP04,SP11,SP12。依赖：14.12-14.17。验收：每个平台验证内置资产/许可证/散列和离线 npx；保持退出码、统一入口及旧报告读取；同步中英文示例；未验收语言/宿主仍标 gap。 -- [ ] 14.19 CodeGraph 32 种 grammar 全量接入与 Zig 误报回归。责任：adapters/runtime/CLI/发布。规格：SP01,SP04,SP06,SP11,SP12。依赖：14.1-14.18。验收：逐语言固定可再分发来源、许可证、原始和发行字节、真实 ABI、Rust worker 离线加载、合法/非法版本语料、原生工具对照、原生优先统一命令、任务与对话反馈、资源预算及发行包实装；覆盖 arkts/c/cfml/cfquery/cfscript/cobol/cpp/csharp/dart/erlang/go/java/javascript/kotlin/lua/luau/nix/objc/pascal/php/python/r/ruby/rust/scala/solidity/swift/terraform/tsx/typescript/vbnet/zig。当前十五份候选（C/C++/C#/Go/Java/JavaScript/Lua/Luau/Objective-C/Python/Rust/Solidity/TypeScript/TSX/Zig），已验收发行 0；COBOL 超出 8 MiB 上限，其他 17 种仍无资产清单和执行路由。C++/C#/Lua/Luau 的固定来源、许可证、真实 ABI、离线加载及基础正反例见[局部验收](../../../tests/acceptance/cpp-csharp-lua-luau-grammar-candidates.md)。C/Go/JavaScript/Rust 的固定来源、许可证、离线加载及基础正反例见[局部验收](../../../tests/acceptance/mainstream-grammar-candidates.md)。不得以 `grammar status` 库存、WASM 可加载或未验收候选替代原生 lint 或语言验收。 +- [ ] 14.19 CodeGraph 32 种 grammar 全量接入与 Zig 误报回归。责任：adapters/runtime/CLI/发布。规格：SP01,SP04,SP06,SP11,SP12。依赖：14.1-14.18。验收：逐语言固定可再分发来源、许可证、原始和发行字节、真实 ABI、Rust worker 离线加载、合法/非法版本语料、原生工具对照、原生优先统一命令、任务与对话反馈、资源预算及发行包实装；覆盖 arkts/c/cfml/cfquery/cfscript/cobol/cpp/csharp/dart/erlang/go/java/javascript/kotlin/lua/luau/nix/objc/pascal/php/python/r/ruby/rust/scala/solidity/swift/terraform/tsx/typescript/vbnet/zig。此前十五份候选（C/C++/C#/Go/Java/JavaScript/Lua/Luau/Objective-C/Python/Rust/Solidity/TypeScript/TSX/Zig），已验收发行 0；COBOL 超出 8 MiB 上限，其他 17 种仍无资产清单和执行路由。C++/C#/Lua/Luau 的固定来源、许可证、真实 ABI、离线加载及基础正反例见[局部验收](../../../tests/acceptance/cpp-csharp-lua-luau-grammar-candidates.md)。C/Go/JavaScript/Rust 的固定来源、许可证、离线加载及基础正反例见[局部验收](../../../tests/acceptance/mainstream-grammar-candidates.md)。不得以 `grammar status` 库存、WASM 可加载或未验收候选替代原生 lint 或语言验收。 -14.19 性能子项进展：候选 worker 已改为仅校验所选固定 grammar 及相关许可证，避免每次单文件初检遍历全部 WASM；全量库存命令保持完整校验。选择接口先 RED 后通过 15 语种身份一致性测试，单次调试构建启动观察见[局部验收](../../../tests/acceptance/syntax-worker-selected-asset.md)。这不是正式性能评测，也不改变 15/32 候选和 0 份发行验收的状态。 +14.19 性能子项进展：候选 worker 已改为仅校验所选固定 grammar 及相关许可证，避免每次单文件初检遍历全部 WASM；全量库存命令保持完整校验。选择接口先 RED 后通过 15 语种身份一致性测试，单次调试构建启动观察见[局部验收](../../../tests/acceptance/syntax-worker-selected-asset.md)。这不是正式性能评测；该阶段仍为 15/32 候选和 0 份发行验收。 + +14.19 后续增量：ArkTS、Nix、Terraform 三份 CodeGraph 随仓 WASM 已固定上游提交、许可证、字节和真实 ABI；ArkTS/Terraform 预编译 npm 包另固定完整性并核对包内字节。Rust 离线加载、窄范围正反例及隔离 worker 候选状态通过，见[局部验收](../../../tests/acceptance/arkts-nix-terraform-grammar-candidates.md)。目前 18/32 候选、14 份未入候选、已发行验收 0；公开原生优先 lint 路由和逐语言精度验收仍缺，14.1 与 14.19 保持未完成。 diff --git a/schemas/grammar-asset-manifest.schema.json b/schemas/grammar-asset-manifest.schema.json index bc7e477c..bad0797f 100644 --- a/schemas/grammar-asset-manifest.schema.json +++ b/schemas/grammar-asset-manifest.schema.json @@ -11,7 +11,7 @@ "source_commit": {"$ref": "#/$defs/commit"}, "codegraph_license": {"const": "LICENSE.codegraph"}, "codegraph_license_sha256": {"$ref": "#/$defs/sha256"}, - "build_tool": {"const": "tree-sitter-cli 0.25.10 build --wasm; Zig: tree-sitter-cli 0.27.0 generate --abi 15 + Zig 0.16.0 wasm32-wasi"}, + "build_tool": {"const": "tree-sitter-cli 0.25.10 build --wasm; Zig: tree-sitter-cli 0.27.0 generate --abi 15 + Zig 0.16.0 wasm32-wasi; ArkTS/Terraform: pinned npm prebuilt WASM"}, "dependency_package_integrity": {"type": "string", "pattern": "^tree-sitter-wasms@0\\.1\\.13 sha512-[A-Za-z0-9+/]+=*$"}, "dependency_package_license": {"const": "LICENSE.tree-sitter-wasms"}, "dependency_package_license_sha256": {"$ref": "#/$defs/sha256"}, @@ -31,6 +31,7 @@ "grammar_repository": {"type": "string", "pattern": "^https://github\\.com/[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$"}, "grammar_commit": {"$ref": "#/$defs/commit"}, "grammar_version": {"type": "string", "minLength": 1, "maxLength": 128}, + "package_integrity": {"type": "string", "pattern": "^(@?[A-Za-z0-9_.-]+/)?[A-Za-z0-9_.-]+@[0-9]+\\.[0-9]+\\.[0-9]+ sha512-[A-Za-z0-9+/]+=*$"}, "path": {"type": "string", "pattern": "^[a-z0-9_]+/parser\\.wasm$"}, "sha256": {"$ref": "#/$defs/sha256"}, "bytes": {"type": "integer", "minimum": 8, "maximum": 33554432}, diff --git a/tests/acceptance/arkts-nix-terraform-grammar-candidates.md b/tests/acceptance/arkts-nix-terraform-grammar-candidates.md new file mode 100644 index 00000000..c0e13740 --- /dev/null +++ b/tests/acceptance/arkts-nix-terraform-grammar-candidates.md @@ -0,0 +1,17 @@ +# ArkTS、Nix、Terraform grammar 候选局部验收 + +日期：2026-09-29。固定 CodeGraph 来源：`1072f82ce24db3d133258d30165cef6b74d108b2`。三份随仓 WASM 与[来源库存](../../grammars/codegraph-coverage.json)的字节长度和 SHA-256 一致；不能因来源存在就宣称 CodeGuard 已发行语法能力。 + +| 语种 | 原始来源与固定身份 | WASM SHA-256 | 上游许可证 SHA-256 | Rust 实测 ABI | +| --- | --- | --- | --- | --- | +| ArkTS | `harmony-contrib/tree-sitter-arkts@56f7fc288715befe92c734d603f9e6bc3c65d2a8`，npm `tree-sitter-arkts@0.2.0`，包完整性见清单 | `db0812971109457d22b3fe9dcdb1cd8e614fba2a338e220670bd254485753623` | `048e4dcb7a71fb725495ebb3e7052d0e76dcb6705b828af8b9b461df10bcd8ca` | 14 | +| Nix | `nix-community/tree-sitter-nix@3d0173d903e630b6e14d17f1cf79488791379ded`，CodeGraph CLI 0.25.10 重建 | `4acffa1c013df751193a21ce429777ca214c7d3a7e3665085b6df00dad8869f0` | `c1b72e50266464ec5118d26200e17bf1f472d142e62ab637e1ffc23986657a78` | 15 | +| Terraform | `tree-sitter-grammars/tree-sitter-hcl@fad991865fee927dd1de5e172fb3f08ac674d914`，npm `@tree-sitter-grammars/tree-sitter-hcl@1.2.0`，包完整性见清单 | `0d9ef3ae926acc0411bfecba9b34df4ea659061917b96455570a45a70824e890` | `c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4` | 14 | + +ArkTS 与 Terraform 的 npm tarball SHA-512 实际计算值与 npm 元数据中的 `dist.integrity` 一致；tarball 中的 WASM 与 CodeGraph 固定字节一致，tarball 中的许可证与固定上游提交一致。Nix 许可证取自固定上游提交。清单固定包完整性、WASM 与许可证摘要；改变 npm 完整性字符串的反例被拒绝。 + +测试先把候选数断言改为 18 而失败；ArkTS 加载时原预期 ABI 15 也失败并返回实际 14。纠正后，三份 WASM 均由 Rust 离线加载，窄范围合法样例无恢复错误，损坏样例有解析错误；独立 worker 对合法样例仍返回 `incomplete` 且 `grammar_qualified=false`。Draft 2020-12 的清单 schema 校验通过。 + +最终源码状态的 `cargo test --locked --workspace --all-features` 退出 0：182 组、1140 通过、0 失败、106 忽略；忽略的原生工具用例不算已验收。全目标 Clippy、fmt、OpenSpec strict 和 `git diff --check` 退出 0。实际 `codeguard grammar status --format=json` 返回退出码 3，报告 32 来源 / 30 随仓 / 18 候选 / 0 已发行，并固定 `parser_capability=unverified`、`gate_effect=none`、`delivery_decision=not_evaluated`。 + +尚缺：语言版本和方言语料、与原生工具的误报/漏报对照、公开 `lint/check` 的原生优先路由、不同宿主的对话反馈、资源预算及发行包实装。当前只是 18/32 候选，已发行验收仍为 0。