开发者做 AI 编码 Agent「测谎仪」claimcheck，5 轮测试零误判

{"task_id"："t-01"，"agent_id"："agent-a"，"summary"："添加一个 sub() 辅助函数。"，"scope"：{"paths"：["src/math.js"]}，"changes"：[{"path"："src/math.js"，"description"："添加 sub(a, b)，返回 a - b。"}]}

export function checkDeterministic(claim： Claim， changes： FileChange[]， policy： Policy）： Finding[] {
  const findings： Finding[] = [];
  const real = changes。filter((c) => !c。path。startsWith(CLAIM_DIR));
  const claimed = new Set(claim。scope。paths);
  const changed = new Set(real。map((c) => c。path));

  for(const c of real) {
    if(!claimed。has(c。path)) {
      findings。push({ code： "UNCLAIMED_CHANGE"， path： c。path， detail： `${c。path}was${c。status}but is not in scope.paths` });
    }
    // 不区分大小写：src/Auth/x.js 在 macOS 和 Windows 检出中会落到 src/auth/ 下。
    const hit = policy。protectedPaths。find((g) => matchesGlob(c。path， g， { ignoreCase： true }));
    if(hit) {
      findings。push({ code： "PROTECTED_PATH"， path： c。path， detail： `${c。path}matches protected path${hit}` });
    }
  }

  for(const p of claim。scope。paths) {
    if(!changed。has(p)) findings。push({ code： "CLAIMED_NOT_CHANGED"， path： p， detail： `${p}is in scope.paths but did not change` });
  }
  // ……外加两个大小限制（行数和文件数）
  return findings;
}

export
function evidenceInDiff (evidence：string ，diff ：string ）：boolean { const
  lines = evidence 。split("\n")。map(stripPrefix)。filterBoolean);
  if(lines.length === 0) return false;
  const diffLines = diff.split("\n").map(stripPrefix
  ); returnlines.every((ev ) =>diffLines.some((d ) =>d.includes(ev
)));

} export functiondecide(items :Judgement [],diffs :Record<string ,string> ):"verified " |"rejected " |"needs_review "
  {if(items. length ===0 ) return"needs_review"
  ; const provenNo =items.some((j ) =>j. matches ==="no " &&!j. error &&evidenceInDiff(j.evidence ,diffs[j.path ] ??""
  ));if(provenNo ) return"rejected"
  ;if(items.every((j ) =>j. matches ==="yes " &&!j.error )) return"verified"
  ; return"needs_review"
;

LLM no  src/strings.js：该 diff 移除了小写转换，并且没有修剪开头/结尾的空白。+  return s.replace(/\s+/g, "-");

const mergePrefix = (v: MergeRef) => `Merge${v.agent_id}(${v.task_id}) at${v.commit.slice(0, 12)}`;

// 可重复安全的合并：如果 canon 历史中已经有该判定的合并提交（较早的一次尝试
// 推送了它，但其结果未被记录），则返回该提交，而不是再次合并。
export function findOwnMerge(log: { hash: string; message: string }[], v: MergeRef) : string | null
  { const prefix =mergePrefix(v
  ); returnlog.find((c ) =>c.message.startsWith( prefix +":" ) ||c.message.trim () ===prefix)?. hash ??null
;

）： asyncalarm ()
  { const next =this.store.nextQueued
  ();if(!next )return
  ; const r = awaitthis.mergeOne(next).catch(async(e :Error ) =>
    {
    // 即使回复是错误（例如写入后返回 503），推送也可能成功。
    // 在记录错误之前再检查一次。 const own = awaitthis.ownMergeInCanon(next).catch (() =>null
    );if(own ) return status: "merged" as const, detail: `already in canon after an error:${e.message}`, commit: own };
    return { status: "error" as const, detail: e.message, commit: null };
  });
  this.store.setMergeResult(next.id, r.status, r.detail, r.commit);
  if(this.store.nextQueued()) await this.ctx.storage.setAlarm(Date.now());
}

"triggers":{"events":[{// 对命名空间中任意仓库的每次 push 都会启动一次 Workflow 运行。// Fork 是在运行时创建的，因此无需按仓库订阅。"type":"cf.artifacts.repo.pushed","filter":{"namespace":"claimcheck"},"targets":[{"type":"workflow","workflow_name":"claimcheck-verify"}]}]}

async function walk(repo: GitReader, oldTree: string | null, newTree: string | null, prefix: string, out: RawChange[]) {
  const [a, b] = await Promise.all([tree(repo, oldTree), tree(repo, newTree)]);
  const names = new Set([...a.keys(), ...b.keys()]);
  const subwalks: Promise<void>[] = [];

  for(const name of names) {
    const o = a.get(name);
    const n = b.get(name);
    if(o && n && o.hash === n.hash) continue;
    const path = prefix + name;
    const oDir = o?.type === "tree";
    const nDir = n?.type === "tree";

    if(oDir || nDir) {
      subwalks.push(walk(repo, oDir ? o!.hash : null, nDir ? n!.hash : null, `${path}/`, out));
    }
    const oFile = o && !oDir ? o : undefined;
    const nFile = n && !nDir ? n : undefined;
    if(oFile || nFile) {
      out.push({
        path,
        status: oFile && nFile ? "modified" : oFile ? "deleted" : "added",
        oldHash: oFile?.hash ?? null,
        newHash: nFile?.hash ?? null,
      });
    }
  }
  await Promise.all(subwalks);
}

// isomorphic-git 会检查 err.code（例如 "ENOENT"）来区分文件缺失和真正的失败。
function fsError(code: string, path: string) {
  return Object.assign(new Error(`${code}:${path}`), { code });
}

// ……以及在 MemoryFS 类内部：
// isomorphic-git 需要这两个方法。符号链接以保存目标路径的文件形式存储。
async readlink(path: string) {
  return(await this.readFile(path)) as Uint8Array;
}

async symlink(target: string, path: string) {
  await this.writeFile(path, target);
}