Vibe Coding 的专业工程实践：从自然语言到可交付代码的约束体系

from dataclasses import dataclass
from pathlib import Path
from typing import Protocol

@dataclass(frozen=True)
class RenameRule:
    replace_space: bool = True
    keep_chinese: bool = True
    date_format: str = "%Y-%m-%d"

class Renamer(Protocol):
    def preview(self, root: Path) -> list[tuple[Path, Path]]: ...
    def apply(self, plan: list[tuple[Path, Path]]) -> list[str]: ...

实现 Renamer 协议，要求：
1. preview 只计算不修改，返回 (原路径, 新路径) 列表。
2. apply 遇到权限错误时跳过并记录，不中断。
3. 重名时追加 _2、_3，不覆盖已有文件。
4. 只处理文件，不递归子目录。
5. 不允许删除任何文件。
6. 补充类型注解和 docstring。

from pathlib import Path

IGNORE = {".git", "node_modules", "__pycache__", ".venv", "dist"}
ALLOW = {".py", ".ts", ".tsx", ".json", ".md", ".toml"}

def collect_context(root: Path, keywords: list[str],
                    budget: int = 30000) -> list[str]:
    candidates = []
    for p in root.rglob("*"):
        if not p.is_file() or p.suffix not in ALLOW:
            continue
        if any(part in IGNORE for part in p.parts):
            continue
        text = p.read_text(encoding="utf-8", errors="ignore")
        score = sum(1 for k in keywords if k.lower() in p.name.lower())
        tokens = len(text) // 4
        candidates.append((score, tokens, str(p), text))

    candidates.sort(key=lambda x: (-x[0], x[1]))
    chosen, used = [], 0
    for _, tokens, path, text in candidates:
        if used + tokens > budget:
            continue
        chosen.append(f"### {path}\n{text}")
        used += tokens
    return chosen

import subprocess
from pathlib import Path

def run(cmd: list[str], cwd: Path, timeout: int = 120) -> dict:
    try:
        p = subprocess.run(cmd, cwd=cwd, capture_output=True,
                           text=True, timeout=timeout)
        return {"code": p.returncode, "out": p.stdout[-2000:],
                "err": p.stderr[-1000:]}
    except subprocess.TimeoutExpired:
        return {"code": -1, "out": "", "err": "timeout"}

def quality_gate(repo: Path) -> dict:
    checks = {
        "lint": run(["ruff", "check", "."], repo),
        "type": run(["mypy", "."], repo),
        "test": run(["pytest", "-q"], repo),
    }
    checks["ok"] = all(c["code"] == 0 for c in checks.values())
    return checks

import difflib
from pathlib import Path

def diff_files(old: str, new: str, path: str) -> str:
    return "".join(difflib.unified_diff(
        old.splitlines(keepends=True),
        new.splitlines(keepends=True),
        fromfile=f"a/{path}", tofile=f"b/{path}",
    ))

def summarize(diff: str) -> dict:
    added = sum(1 for l in diff.splitlines()
                if l.startswith("+") and not l.startswith("+++"))
    removed = sum(1 for l in diff.splitlines()
                  if l.startswith("-") and not l.startswith("---"))
    return {"added": added, "removed": removed,
            "files": diff.count("--- ")}

import re
from pathlib import Path

SECRETS = [
    re.compile(r"(?i)api[_-]?key\s*=\s*['\"][^'\"]+"),
    re.compile(r"(?i)password\s*=\s*['\"][^'\"]+"),
    re.compile(r"AKIA[0-9A-Z]{16}"),
    re.compile(r"-----BEGIN [A-Z ]+PRIVATE KEY-----"),
]

DANGEROUS = [
    re.compile(r"\beval\s*\("),
    re.compile(r"\bos\.system\s*\("),
    re.compile(r"subprocess\.[a-z]+\([^)]*shell\s*=\s*True"),
]

def scan_file(path: Path) -> list[str]:
    text = path.read_text(encoding="utf-8", errors="ignore")
    issues = []
    for pat in SECRETS:
        if pat.search(text):
            issues.append(f"{path}: 疑似硬编码密钥")
            break
    for pat in DANGEROUS:
        if pat.search(text):
            issues.append(f"{path}: 疑似危险调用")
            break
    return issues

name: ci
on: [push, pull_request]
jobs:
  quality:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.12" }
      - run: pip install ruff mypy pytest bandit pip-audit
      - run: ruff check .
      - run: mypy .
      - run: pytest -q
      - run: bandit -r app
      - run: pip-audit