harness-lint
PBH 生态的第一个果实工具 — 专门检测 AI 生成代码中典型坏习惯的静态检查器。
harness-lint 不替代 Ruff / Pylint / Flake8。那些工具关心"代码是否规范";harness-lint 关心**"AI 是否在假装完成了任务"**。
快速开始
pip install -e ".[dev]"
make verify
检查任意目录:
harness-lint # 检查当前目录,terminal 格式
harness-lint src/ # 检查指定路径
harness-lint --format json # 输出 JSON
harness-lint --format summary # 输出单行摘要
harness-lint --strict # 把 Warning 也视为退出码 1
harness-lint --version
python -m harness_lint # 等价于 harness-lint
退出码:
0— 无 Error;--strict关闭时 Warning/Info 也返回 01— 有 Error;或--strict启用且有 Warning
内置规则
当前共 9 条规则,全部默认启用。
| ID | 名称 | 严重级别 | 说明 |
|---|---|---|---|
| HL001 | 禁止使用 eval() | Error | 检测 eval(...) / builtins.eval(...) 直接调用 |
| HL002 | 禁止使用 exec() | Error | 检测 exec(...) 直接调用 |
| HL003 | 禁止使用 os.system() | Error | 引导改用 subprocess.run() |
| HL004 | 硬编码密钥检测 | Error | 检测 password = "xxx" / password: str = "xxx" 等带类型标注或裸赋值的硬编码密钥 |
| HL201 | 函数体长度超限 | Warning | 默认阈值 50 行,支持普通和 async 函数 |
| HL202 | 假异常处理 | Warning | 检测 except: pass、except Exception: pass 等无效异常处理 |
| HL301 | 公共函数无 docstring | Info | 公共 API 缺少 docstring |
| HL401 | 重复违规模式检测 | Warning | 同一文件出现 3+ 次相同反模式时升级为模式性偏差 |
| HL402 | 协议一致性检查 | Warning | 公共函数参数/返回值缺少类型标注 |
每条规则的违规报告都包含完整的归因链三要素:
- 现象 (phenomenon):违规的具体表现
- 归因 (attribution):为什么这是 AI 缺陷
- 归属 (agente_ref):违反了 AGENTS.md 的哪一条款
开发命令
| 命令 | 说明 |
|---|---|
make verify |
lint + 格式检查 + 测试 + 覆盖率(提交前必须通过) |
make test |
仅运行测试 |
make lint |
仅运行代码风格检查 |
make format-check |
检查代码格式(ruff format --check) |
项目结构
harness-lint/
├── src/harness_lint/
│ ├── __main__.py # python -m harness_lint 入口
│ ├── cli.py # CLI 入口(typer)
│ ├── checker.py # 文件遍历 + 规则调度
│ ├── reporter.py # terminal / json / summary 三种输出
│ ├── accumulator.py # 模式性偏差累积(重复违规升级)
│ ├── attribution.py # 归因链运行时校验
│ ├── pbh_adapter.py # 读取 .harness/progress.json
│ ├── degradation.py # 退化代价可见化
│ └── rules/
│ ├── base.py # Rule / Violation 抽象基类
│ └── hl0*.py / hl2*.py / hl3*.py / hl4*.py
├── tests/ # 单元测试 + 集成测试 + 自举测试
├── docs/ # 设计文档 / 项目地图 / ADR
├── tasks/ # 任务拆解(Spec Coding 容器)
├── .harness/ # PBH 阶段状态追踪
├── AGENTS.md # AI 协作协议
├── Makefile
└── pyproject.toml
AI 协作
本项目遵循 PBH 协议。AI 助手请阅读 AGENTS.md 了解项目规则和工作准则。深入架构请参考 docs/context.md,规则设计原则参考 docs/design.md。
生态关联
| 项目 | 说明 |
|---|---|
| Project Bootstrap Harness (PBH) | AI 辅助项目启动框架,定义了阶段感知、归因锚定等核心协议 |
| Harness Agent | PBH 协议的 AI Agent 运行时,负责执行计划、管理会话生命周期 |
harness-lint 是 PBH 生态中的质量守护工具,在 Agent 执行过程中对生成的代码进行静态检查。
许可证
MIT
Metadata
Release files for harness-lint 0.3.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| harness_lint-0.3.0.tar.gz | 33.9 kB | With provenance | Details for harness_lint-0.3.0.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| harness_lint-0.3.0-py3-none-any.whl | Python 3 | none | any | Details for harness_lint-0.3.0-py3-none-any.whl |
Total release size: 63.8 kB
Release files / harness_lint-0.3.0.tar.gz
| Download URL | harness_lint-0.3.0.tar.gz |
|---|---|
| Size | 33.9 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
0f110fff6af9c197fbb77ccba76604a09067b2dd83d228829cf47e897a4a0216
|
|
BLAKE2b-256 checksum How to use checksums |
51d2161a378aac9af7c672dcb44a6b239e0c22aa9356fce7817bfcdf5131da88
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jul 7, 2026.
Transparency logRelease files / harness_lint-0.3.0-py3-none-any.whl
| Download URL | harness_lint-0.3.0-py3-none-any.whl |
|---|---|
| Size | 29.9 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
f8c357cfa12a4ecf1bf0b9f8a5fd8f6fd81282823aea426955b12178dae08d54
|
|
BLAKE2b-256 checksum How to use checksums |
c04ef8103697b937716661981b623374bdeda0c8a8bb4d94100fb9de7545cbd0
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jul 7, 2026.
Transparency logSecurity for harness-lint 0.3.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for harness_lint-0.3.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jul 7, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.