feat: 32 份 WASM 候选统一路由与 npm 发行

.github/workflows/ci.yml

@@ -36,7 +36,9 @@ jobs:
         run: |
           cargo test -p codeguard-runtime --features wasm-precheck --test process_contract
           cargo test -p codeguard-runtime --features wasm-precheck --test wasm_grammar_load --test dart_upstream_corpus
-          cargo test -p codeguard-cli --features wasm-precheck --test syntax_worker_candidate --test grammar_probe_cli --test grammar_route --test check_all_grammar_candidates --test zig_lint_cli --test typescript_syntax_fallback_candidate --test java_syntax_fallback_candidate
+          cargo test -p codeguard-cli --features wasm-precheck --test syntax_worker_candidate --test grammar_probe_cli --test grammar_route --test zig_lint_cli --test typescript_syntax_fallback_candidate --test java_syntax_fallback_candidate --test java_native_differential --test kotlin_native_differential
+          # 32 份 WASM 的批次和单项目回归各自独占候选阶段预算，避免测试进程互相争抢内存与 CPU。
+          cargo test -p codeguard-cli --features wasm-precheck --test check_all_grammar_candidates -- --test-threads=1
 
       - name: Verify the local npm package contains a running WASM worker
         run: |

Cargo.toml

@@ -8,7 +8,7 @@ members = [
 resolver = "2"
 
 [workspace.package]
-version = "0.1.2"
+version = "0.1.3"
 edition = "2024"
 rust-version = "1.85"
 license = "Apache-2.0"

NOTICE

@@ -2,3 +2,8 @@ Codeguard
 Copyright 2026 Full Stack Skills / PartMe.AI
 
 Licensed under the Apache License, Version 2.0. See LICENSE.
+
+The optional Tree-sitter grammar candidates retain their upstream licenses.
+For npm distributions, see grammar-licenses/ in the package; for source builds,
+see grammars/*/LICENSE and grammars/LICENSE.codegraph. The pinned source and
+license digests are recorded in grammars/manifest.json.

crates/codeguard-adapters/src/grammar_asset_manifest.rs

@@ -118,6 +118,11 @@ pub fn bundled_grammar_candidates() -> Result<GrammarAssetManifest, String> {
     Ok(manifest)
 }
 
+/// 只读取并校验内置 grammar 清单元数据，供报告投影已知限制；不代替选中资产的字节验证。
+pub fn bundled_grammar_metadata() -> Result<GrammarAssetManifest, String> {
+    parse_grammar_asset_manifest(include_bytes!("../../../grammars/manifest.json"))
+}
+
 /// 只核对指定内置 grammar 的字节与许可，供按需加载的语法工作进程使用。
 /// 参数为固定语言 ID；返回清单身份和静态 WASM 字节，未知语言返回错误。
 pub fn bundled_grammar_candidate(language: &str) -> Result<(GrammarAsset, &'static [u8]), String> {
@@ -798,7 +803,12 @@ pub fn parse_grammar_asset_manifest(raw: &[u8]) -> Result<GrammarAssetManifest,
             || asset.codeguard_runtime_validation != "rust_loader_smoke_passed"
             || !asset.language_versions.is_empty()
             || asset.known_limitations.is_empty()
-            || asset.known_limitations.iter().any(String::is_empty)
+            || asset.known_limitations.len() > 8
+            || asset.known_limitations.iter().any(|limitation| {
+                limitation.is_empty()
+                    || limitation.len() > 1024
+                    || limitation.chars().any(char::is_control)
+            })
             || asset.release_status != "candidate_unvalidated"
         {
             return Err(format!("{} grammar 来源或验收状态不符", asset.language));

crates/codeguard-adapters/src/lib.rs

@@ -70,7 +70,7 @@ mod zig_wasm_compat;
 pub use dart_wasm_compat::adapt_dart_wasm;
 pub use grammar_asset_manifest::{
     GrammarAsset, GrammarAssetManifest, bundled_grammar_candidate, bundled_grammar_candidates,
-    parse_grammar_asset_manifest, verify_grammar_asset,
+    bundled_grammar_metadata, parse_grammar_asset_manifest, verify_grammar_asset,
 };
 pub use legacy_dylink_compat::adapt_legacy_dylink;
 pub use zig_wasm_compat::adapt_zig_wasm;

crates/codeguard-adapters/tests/grammar_asset_manifest.rs

@@ -298,6 +298,27 @@ fn missing_provenance_duplicate_fields_and_unknown_languages_are_rejected() {
     assert!(parse_grammar_asset_manifest(wrong_npm_integrity.as_bytes()).is_err());
 }
 
+#[test]
+fn candidate_limitations_are_bounded_before_dialog_projection() {
+    let original: serde_json::Value =
+        serde_json::from_str(include_str!("../../../grammars/manifest.json")).unwrap();
+    for limitations in [
+        serde_json::json!(["x".repeat(1025)]),
+        serde_json::json!(vec!["x"; 9]),
+        serde_json::json!(["line one\nline two"]),
+    ] {
+        let mut manifest = original.clone();
+        let vbnet = manifest["assets"]
+            .as_array_mut()
+            .unwrap()
+            .iter_mut()
+            .find(|asset| asset["language"] == "vbnet")
+            .unwrap();
+        vbnet["known_limitations"] = limitations;
+        assert!(parse_grammar_asset_manifest(manifest.to_string().as_bytes()).is_err());
+    }
+}
+
 #[test]
 fn changed_wasm_license_or_abi_never_qualifies_a_candidate() {
     let manifest = bundled_grammar_candidates().unwrap();

crates/codeguard-cli/src/check_command.rs

@@ -1455,8 +1455,13 @@ pub fn run(args: &[String]) -> ExitCode {
     let syntax_candidates = crate::check_syntax_candidates::observe(
         &root,
         &discovery,
-        &python_lint,
+        crate::check_syntax_candidates::NativeCoverage {
+            python_lint: &python_lint,
+            go_lint: &go_lint,
+            go_tool: parsed.go_tool.as_deref(),
+        },
         parsed.selection == Selection::Java,
+        parsed.jobs_limit,
         deadline,
         if request_cancelled {
             Some("request_cancelled")
@@ -1470,12 +1475,12 @@ pub fn run(args: &[String]) -> ExitCode {
     let syntax_candidates = json!({
         "status":"not_run","reason":"binary_without_wasm_precheck","execution_phase":"after_native",
         "authority":"candidate_unqualified","delivery_decision":"incomplete",
-        "source_file_count":discovery.languages.values().map(|item| item.source_files.len()).sum::<usize>(),
+        "source_file_count":discovery.languages.values().map(|item| item.source_files.len()).sum::<usize>() + discovery.ambiguous_source_files.len(),
         "skipped_count":0,"unrouted_count":0,"native_preferred_count":0,"observations":[],
         "next_action":"使用包含固定语法资产的发行包运行候选初检，并完成适用原生检查"
     });
     let report = json!({
-        "schema_version":"0.33.0", "report_type":"check_feedback",
+        "schema_version":"0.34.0", "report_type":"check_feedback",
         "operation":"check", "selection":parsed.selection.as_str(), "command_status":if request_cancelled { "cancelled" } else { "incomplete" },
         "exit_code":if request_cancelled { 130 } else { 3 }, "delivery_decision":if parsed.selection == Selection::All { "incomplete" } else { "not_evaluated" }, "authority":"local_unverified",
         "reason":if request_cancelled { "request_cancelled" } else if parsed.selection == Selection::All { "full_project_obligations_and_trusted_policy_unavailable" } else { "java_selection_obligations_and_trusted_policy_unavailable" },
@@ -1899,6 +1904,20 @@ pub fn run(args: &[String]) -> ExitCode {
                         item["path"], item["language"], item["recovery_count"]
                     );
                 }
+                for item in observations
+                    .iter()
+                    .filter(|item| item["known_limitations"][0].is_string())
+                    .take(8)
+                {
+                    if let Some(limitation) = item["known_limitations"][0].as_str() {
+                        println!(
+                            "  {} [{}] 已知 grammar 限制：{}；仍需适用原生工具确认。",
+                            item["path"].as_str().unwrap_or("?"),
+                            item["language"].as_str().unwrap_or("unknown"),
+                            limitation
+                        );
+                    }
+                }
             }
         }
         if report["unresolved_conditions"]