feat: vendor permission system source

This commit is contained in:
云服务部-叶林立
2026-08-19 14:35:19 +08:00
parent 198584daf8
commit 410c50a3e5
809 changed files with 157793 additions and 139 deletions
@@ -0,0 +1,93 @@
---
issue: 363
issue_title: "Add `PermissionSession.notify()` and dissolve the `index.ts` forward-reference cycle"
---
# Retro: #363 — Add `PermissionSession.notify()` and dissolve the `index.ts` forward-reference cycle
## Stage: Planning (2026-06-10T00:16:46Z)
### Session summary
Produced the implementation plan for Phase 5 Step 2 (Track A): add a Tell-Don't-Ask `notify(message)` method to `PermissionSession` and dissolve the `index.ts` forward-reference cycle (the `null as unknown as ConfigStore` cast and the `sessionNotify` holder).
Confirmed the prerequisite [#362] has shipped — `PermissionSessionLogger` is now a class — so the construction-order rework is unblocked.
The plan is a single behavior-preserving TDD cycle committed as `0363-permission-session-notify-dissolve-index-cycle.md`.
### Observations
- The cycle is genuine and bidirectional: `logger``configStore` (via `getConfig`) and `logger``session` (via `notify`).
Lazy thunks over forward-declared annotated `let` bindings (no initializer, no cast) break both — `prefer-const` / biome `useConst` cannot flag them (can't suggest `const` without an initializer), and TS exempts closure captures from definite-assignment analysis.
Established precedent: `let state: SessionState | undefined;` in `pi-autoformat/src/extension.ts`.
- Key safety insight: `configStore.refresh()` calls `logger.debug("config.loaded", …)`, whose `reportOnce` path can fire the notify sink during construction if a debug write fails IO.
With a direct `(m) => session.notify(m)` sink, `session` must be assigned *before* `refresh()` runs — so the plan moves `configStore.refresh()` to after the `session` assignment.
The old `sessionNotify?.` guard masked this; the new direct tell does not, hence the reorder.
- `notify` and the `index.ts` rewiring fold into **one** commit to avoid a transient `unused-class-member` flag from `fallow` between adding the method and wiring its sole production caller.
- Per the [#336] / [#362] convention, the Phase 5 metrics table and roadmap-step prose are phase-start snapshots and are left untouched; the `✓ complete` mark is a ship-time edit.
Only the `permission-session.ts` layout line gets a small `notify` mention.
- Non-breaking: notify behavior (warning when UI active, no-op otherwise) is identical; no public API / config / default / output-shape change.
- Decided commit type `refactor:` (behavior-preserving) over `feat:`, matching [#362]'s precedent for this Track-A series.
## Stage: Implementation — TDD (2026-06-10T00:33:17Z)
### Session summary
Executed the single TDD cycle: added `notify(message: string): void` to `PermissionSession` (3 red tests → green), then rewired `src/index.ts` to remove the `null as unknown as ConfigStore` cast and the `sessionNotify` holder, wired the logger's notify sink as `(m) => session.notify(m)`, and moved `configStore.refresh()` after the `session` assignment.
All checks passed (1903 tests, `pnpm run check`, `pnpm run lint`, `pnpm fallow dead-code`).
Pre-completion reviewer returned PASS.
### Observations
- The plan's risk analysis was wrong about `prefer-const`: ESLint fires on single-assignment forward-declared `let` (each variable is assigned exactly once, so the rule fires even though `const` without an initializer is a JS syntax error).
Biome's `useConst` correctly skips these, but ESLint does not.
Fixed with `eslint-disable-next-line prefer-const` comments on each `let` line, explaining the impossibility of `const` here.
Future plans involving forward-declared `let` in `src/` files should list this as a known lint friction point.
- The `configStore.refresh()` reorder (to after `session` assignment) was the key safety insight from planning and was implemented exactly as designed — the inline comment in `index.ts` explains the `session`-must-be-bound invariant.
- `as unknown as` cast count in `src/` confirmed at 2 after the change (both in `config-store.ts`), matching the 3→2 goal from the Phase 5 metrics table.
- Pre-completion reviewer: PASS — all deterministic checks green, architecture doc updated, `notify` method well-formed, 3 new tests covering activate/pre-activate/post-deactivate cases.
## Stage: Final Retrospective (2026-06-10T00:45:25Z)
### Session summary
Shipped #363 end-to-end in one session (planning → TDD → ship → retro): added `PermissionSession.notify()` and dissolved the `index.ts` forward-reference cycle, dropping production `as unknown as` casts 3 → 2.
CI passed first try, pre-completion reviewer returned PASS, +3 tests (1900 → 1903).
Two small process gaps surfaced — a planning-time linter-behavior misprediction and a commit-keyword auto-close that pre-empted the curated close comment — neither caused design rework.
### Observations
#### What went well
- Planning nailed the two subtle correctness points and they implemented exactly as designed: the genuine bidirectional construction cycle (`logger``configStore`, `logger``session`) broken with lazy thunks, and the `configStore.refresh()` reorder so the notify sink can't fire against an unbound `session`.
No design rework across any stage.
- Clean stage handoff via the retro file: the TDD stage read the planning entry's safety insight (`refresh()` reorder) and implemented it verbatim with an explanatory inline comment.
#### What caused friction (agent side)
- `missing-context` — the Planning stage asserted in Risks and Mitigations that `prefer-const` / biome `useConst` would not flag the forward-declared `let configStore` / `let session`, reasoning "`const` can't be declared without an initializer, so the rule can't suggest it" and citing `let state: SessionState | undefined;` in `pi-autoformat/src/extension.ts` as precedent.
The analogy was flawed: that precedent is reassigned twice (`extension.ts:658`, `:761`), so it is genuinely non-const-able and `prefer-const` correctly skips it; our bindings are each assigned exactly once, so ESLint `prefer-const` fires (the suggested fix is impossible, but the error still triggers).
Impact: the TDD stage's first `git commit` was rejected by the pre-commit ESLint hook; fixed with two `eslint-disable-next-line prefer-const` comments and re-committed.
One extra fix-edit + re-commit, no design rework.
- `other` (self-introduced commit-body keyword) — the TDD stage added `Phase 5 Step 2 (Track A). Closes #363.` to the commit body, which the plan's suggested message did not contain.
`Closes #363` auto-closed the issue on push to `main`, pre-empting the `/ship-issue` step-5 curated `issue_close` comment.
Impact: issue #363 closed with **0 comments** — the curated close summary (implemented-in SHA, behavior change, bullet list) that the ship report generated was never posted to GitHub.
#### What caused friction (user side)
- None notable.
The user let the four-stage workflow run autonomously, which suited a clean behavior-preserving refactor; no strategic redirect was needed.
### Diagnostic details
- **Model-performance correlation** — Planning / TDD / retro ran on `claude-opus-4-8` (judgment-heavy: design, test authoring, synthesis); the ship stage ran on `claude-sonnet-4-6` (mechanical: `git`, `ci_watch`, release checks).
The only subagent dispatch was the `pre-completion-reviewer` in the TDD stage.
No model/task mismatch.
- **Feedback-loop gap** — the TDD stage ran `pnpm run check` + the test suite before the first commit but not `pnpm run lint`, so ESLint's `prefer-const` was first evaluated by the pre-commit hook.
The hook caught it before any broken commit landed, so the safety net worked; running `pnpm run lint` pre-commit would have surfaced it one step earlier.
No rule change warranted — the hook already enforces this.
- **Escalation-delay / unused-tool** — no rabbit-holes; the `prefer-const` failure resolved in a single fix.
No tool or subagent was needed but skipped.
### Changes made
1. `AGENTS.md` § Commits — added a rule banning `Closes #N` / `Fixes #N` / `Resolves #N` in commit messages (they auto-close on push and pre-empt the `/ship-issue` curated close comment); reference issues as `(#N)` in the subject or `Refs #N` in the body instead.
2. `AGENTS.md` § Biome / ESLint linter conflicts — added a rule that ESLint `prefer-const` fires on a `let` assigned exactly once even with no initializer, with the `eslint-disable-next-line prefer-const` fix and a note that biome's `useConst` and multi-assignment `let` are both skipped.