Vibe Coding 与 2026 AI 开发工具生态：生产力革命的光与影

# core.md - 项目全局规则

## 编码风格

- 使用 TypeScript strict 模式
- 只使用函数式组件(禁止类组件)
- 错误处理：使用 guard clause 模式(提前 return)
- 变量名：camelCase，组件名：PascalCase

## 架构规则

- API 路由：使用 /api/v1/ 前缀
- 业务逻辑必须放在 service 层
- 组件按 presentation 与 container 分离
- 状态管理：使用 zustand(禁止 Redux)

## 测试规则

- 所有新函数必须编写单元测试
- 测试文件位置：**tests**/ 目录
- 最低覆盖率：80%

## 禁止模式

- 禁止使用 any 类型
- 生产代码中禁止 console.log
- 禁止内联样式(只使用 Tailwind CSS)

# Project: E-commerce API

## Tech Stack

- Runtime: Node.js 22 + TypeScript 5.7
- Framework: Fastify 5.x
- Database: PostgreSQL 16 + Drizzle ORM
- Cache: Redis 7 (Valkey)
- Testing: Vitest + Supertest

## Architecture

- Clean Architecture: domain -> application -> infrastructure
- CQRS pattern for read/write separation
- Event sourcing for order lifecycle

## Conventions

- All API responses follow RFC 7807 Problem Details format
- Database migrations in /migrations with timestamp prefix
- Environment variables in .env.example (never commit .env)
- Error codes: E1xxx (auth), E2xxx (order), E3xxx (payment)

## Common Commands

- npm run dev: Start development server
- npm run test: Run all tests
- npm run db:migrate: Run database migrations
- npm run lint: ESLint + Prettier check

# .github/workflows/ai-code-review.yml
name: AI Code Quality Gate

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  ai-code-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Detect AI-generated changes
        id: ai-detect
        run: |
          # 从 PR 的提交信息中检测 AI 工具签名
          AI_COMMITS=$(git log --oneline origin/main..HEAD \
            --grep="Co-Authored-By" \
            --grep="Generated by" \
            --grep="Copilot" \
            --grep="Cursor" \
            --grep="Claude" | wc -l)
          echo "ai_commit_count=$AI_COMMITS" >> "$GITHUB_OUTPUT"

      - name: Run enhanced linting for AI code
        if: steps.ai-detect.outputs.ai_commit_count > 0
        run: |
          npm run lint:strict
          npm run type-check
          npm run test:coverage -- --min-coverage=80

      - name: Security scan (AI code tends to skip validation)
        if: steps.ai-detect.outputs.ai_commit_count > 0
        uses: github/codeql-action/analyze@v3
        with:
          queries: security-and-quality

      - name: Complexity check
        run: |
          npx complexity-report --max-cyclomatic 10 \
            --format json src/ > complexity.json

      - name: Comment review summary
        if: steps.ai-detect.outputs.ai_commit_count > 0
        uses: actions/github-script@v7
        with:
          script: |
            const message = [
              '## AI Code Review Gate',
              '',
              'This PR contains AI-assisted commits.',
              'Enhanced review checks have been applied:',
              '- Strict linting passed',
              '- Type checking passed',
              '- Test coverage >= 80%',
              '- Security scan completed',
              '- Complexity threshold verified',
            ].join('\n');
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: message
            });

# 低效提示词 (Vague)
"帮我做一个用户认证功能"

# 有效提示词 (Specific + Constrained)
"请按以下需求实现一个 JWT 认证中间件：
- Framework: Fastify 5.x + @fastify/jwt
- Access Token: 15 分钟过期，RS256 算法
- Refresh Token: 7 天过期，存储在 httpOnly cookie 中
- 错误响应：RFC 7807 Problem Details 格式
- 用 guard clause 模式优先处理错误
- 包含单元测试(Vitest)
- 使用现有的 UserService.findById() 查询用户
- 类型：使用 src/types/auth.ts 中的 AuthPayload 接口"

[结构化提示词模板]

1. 上下文：这段代码所处的架构，以及需要参考的现有代码
2. 约束条件：需要使用的库、模式、禁止使用的模式
3. 接口：输入输出类型、错误格式
4. 边界情况：必须处理的异常情况
5. 测试：期望的测试范围与框架
6. 参考：现有代码中类似实现的文件路径

#!/usr/bin/env python3
"""AI 生成代码质量验证脚本"""

import ast
import sys
import json
from pathlib import Path
from dataclasses import dataclass, field


@dataclass
class AICodeIssue:
    file: str
    line: int
    category: str
    message: str
    severity: str  # "error" | "warning" | "info"


@dataclass
class ValidationResult:
    issues: list[AICodeIssue] = field(default_factory=list)
    passed: bool = True


def check_hardcoded_secrets(file_path: Path, content: str) -> list[AICodeIssue]:
    """检测 AI 常生成的硬编码密钥"""
    issues = []
    suspicious_patterns = [
        ("password", "检测到硬编码密码"),
        ("api_key", "检测到硬编码 API 密钥"),
        ("secret", "检测到硬编码密钥"),
        ("token", "检测到硬编码令牌"),
    ]
    for i, line in enumerate(content.split("\n"), 1):
        for pattern, message in suspicious_patterns:
            if f'{pattern} = "' in line.lower() or f"{pattern} = '" in line.lower():
                issues.append(AICodeIssue(
                    file=str(file_path),
                    line=i,
                    category="security",
                    message=message,
                    severity="error"
                ))
    return issues


def check_missing_error_handling(file_path: Path, content: str) -> list[AICodeIssue]:
    """检测 AI 常遗漏的错误处理"""
    issues = []
    tree = ast.parse(content)
    for node in ast.walk(tree):
        if isinstance(node, ast.Try):
            for handler in node.handlers:
                if handler.type is None:
                    issues.append(AICodeIssue(
                        file=str(file_path),
                        line=handler.lineno,
                        category="error-handling",
                        message="使用了 bare except - 请指定具体的异常类型",
                        severity="warning"
                    ))
    return issues


def check_todo_comments(file_path: Path, content: str) -> list[AICodeIssue]:
    """检测 AI 留下的 TODO/FIXME 未完成标记"""
    issues = []
    for i, line in enumerate(content.split("\n"), 1):
        if "TODO" in line or "FIXME" in line or "HACK" in line:
            issues.append(AICodeIssue(
                file=str(file_path),
                line=i,
                category="completeness",
                message="仍残留未完成代码标记",
                severity="warning"
            ))
    return issues


def validate_files(paths: list[str]) -> ValidationResult:
    result = ValidationResult()
    for path_str in paths:
        path = Path(path_str)
        if not path.suffix == ".py":
            continue
        content = path.read_text()
        result.issues.extend(check_hardcoded_secrets(path, content))
        result.issues.extend(check_missing_error_handling(path, content))
        result.issues.extend(check_todo_comments(path, content))

    error_count = sum(1 for i in result.issues if i.severity == "error")
    result.passed = error_count == 0
    return result


if __name__ == "__main__":
    files = sys.argv[1:]
    result = validate_files(files)
    report = {
        "passed": result.passed,
        "total_issues": len(result.issues),
        "issues": [
            {
                "file": i.file,
                "line": i.line,
                "category": i.category,
                "message": i.message,
                "severity": i.severity,
            }
            for i in result.issues
        ],
    }
    print(json.dumps(report, indent=2, ensure_ascii=False))
    sys.exit(0 if result.passed else 1)

[日常编程]
  GitHub Copilot (自动补全) + Cursor (多文件编辑)

[复杂重构/设计]
  Claude Code (用 200K 上下文理解整个代码库)

[新项目搭建]
  OpenAI Codex (在沙箱中并行运行智能体)

[代码审查]
  AI 代码审查 + 人工审查并行(AI 负责模式检测，人负责设计判断)