@boyingliu01/xp-gate 0.27.1 → 0.27.2

package/plugins/dsh/lib/command.js

@@ -0,0 +1,81 @@
+import { isAbsolute, resolve } from "node:path";
+import { shellQuote } from "./dialect.js";
+// Re-exported so existing importers of this module keep working; the dialect
+// primitives themselves live in ./dialect.ts.
+export { detectDialect, shellQuote, shq } from "./dialect.js";
+/** Shown when the global `xp-gate` CLI is not on PATH. */
+export const FALLBACK_MESSAGE = "[XP-Gate] xp-gate CLI not installed. Install it with: npm install -g @boyingliu01/xp-gate";
+/**
+ * Allowlist of xp-gate gate aliases that are safe to invoke standalone
+ * (non-preCommitOnly gates + common aliases). Anything outside this set is
+ * rejected before reaching the shell.
+ */
+export const GATE_WHITELIST = [
+    "duplicates",
+    "complexity",
+    "principles",
+    "arch",
+    "architecture",
+    "iac",
+    "secrets",
+    "sast",
+];
+export function isGateAllowed(gate) {
+    return GATE_WHITELIST.includes(gate);
+}
+function buildInner(options, dialect) {
+    const { subcommand, target, gates, config } = options;
+    const q = (value) => shellQuote(value, dialect);
+    if (subcommand === "check") {
+        const tokens = ["xp-gate", "check"];
+        if (target !== undefined)
+            tokens.push(q(target));
+        if (gates !== undefined && gates.length > 0) {
+            // Defense-in-depth: the JSON-schema enum already rejects unknown gate ids,
+            // but we also whitelist here so a non-whitelisted value can never reach the shell.
+            const allowed = gates.filter(isGateAllowed);
+            if (allowed.length > 0)
+                tokens.push("--gates", q(allowed.join(",")));
+        }
+        return tokens.join(" ");
+    }
+    if (subcommand === "principles") {
+        const tokens = ["xp-gate", "principles"];
+        if (target !== undefined)
+            tokens.push(q(target));
+        return tokens.join(" ");
+    }
+    // subcommand === "arch" — the only remaining member of the union.
+    // #447: the default path runs the pinned local @archlinter/cli with its
+    // built-in rules — no config needed. Forcing `--config architecture.yaml`
+    // (the old default) hit the pre-0.16 schema that archlint itself rejects.
+    // Only forward an explicitly provided config, via the opt-in --use-config.
+    const tokens = ["xp-gate", "arch"];
+    if (config !== undefined)
+        tokens.push("--use-config", q(config));
+    return tokens.join(" ");
+}
+/**
+ * Build a single guarded shell command: runs `xp-gate …` when the global CLI
+ * is present, otherwise prints the graceful-degradation hint. A single
+ * presence check avoids a separate probe/run race.
+ */
+export function buildCommand(options) {
+    const dialect = options.dialect ?? "posix";
+    const inner = buildInner(options, dialect);
+    if (dialect === "posix") {
+        return `if command -v xp-gate >/dev/null 2>&1; then ${inner}; else printf '%s\\n' ${shellQuote(FALLBACK_MESSAGE, dialect)}; fi`;
+    }
+    // PowerShell: `Get-Command` resolves the .cmd/.ps1 shims npm writes to
+    // %APPDATA%\npm. Those shims are invisible to a Git-Bash PATH lookup, so this
+    // branch is more reliable than `command -v` on Windows.
+    //
+    // The hint branch leaves $LASTEXITCODE untouched at 0, matching the POSIX
+    // branch's `printf` behaviour.
+    return `if (Get-Command xp-gate -ErrorAction SilentlyContinue) { ${inner} } else { Write-Output ${shellQuote(FALLBACK_MESSAGE, dialect)} }`;
+}
+/** Resolve a model-supplied path against the session cwd; absolutes pass through. */
+export function resolveTarget(rawPath, cwd) {
+    return isAbsolute(rawPath) ? rawPath : resolve(cwd, rawPath);
+}
+//# sourceMappingURL=command.js.map

package/plugins/dsh/lib/delphi-config.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Delphi configuration loading for the DSH plugin.
+ *
+ * Reads the same `.delphi-config.json` the xp-gate skill already uses, so a
+ * project configures its reviewers once and both the skill and the DSH tool
+ * agree on who they are.
+ *
+ * @test REQ-DSH-016
+ * @intent 复用项目既有的 .delphi-config.json，把 provider/api_key/专家席位解析成
+ *         DSH 工具可用的结构，并对 ${ENV} 占位符与缺失密钥给出可操作的报错。
+ * @covers AC-DSH-016-02
+ */
+import type { ExpertSeat, DelphiOptions } from "./delphi.js";
+/** Shape of one expert entry in .delphi-config.json. */
+interface RawExpert {
+    id?: string;
+    role?: string;
+    name?: string;
+    model?: string;
+    requested_model?: string;
+    max_tokens?: number;
+    maxTokens?: number;
+    /** Per-expert provider override; falls back to the profile default. */
+    provider?: string;
+}
+interface RawProfile {
+    provider?: string;
+    providers?: Record<string, {
+        base_url?: string;
+        baseUrl?: string;
+        api_key?: string;
+        apiKey?: string;
+    }>;
+    /**
+     * Experts appear in two shapes in the wild: an object keyed by role (what
+     * xp-gate actually writes) and an array. Both are accepted.
+     */
+    experts?: RawExpert[] | Record<string, RawExpert>;
+    consensus?: {
+        threshold_percent?: number;
+        max_review_rounds?: number;
+    };
+}
+export interface RawDelphiConfig extends RawProfile {
+    active_profile?: string;
+    profiles?: Record<string, RawProfile>;
+}
+export interface ResolvedDelphiConfig {
+    readonly seats: ExpertSeat[];
+    readonly baseUrl: string;
+    readonly apiKey: string;
+    readonly thresholdPercent: number;
+    readonly maxRounds: number;
+    readonly provider: string;
+}
+/** Raised when config on disk cannot be turned into a usable review setup. */
+export declare class DelphiSetupError extends Error {
+}
+/**
+ * Expand `${VAR}` and `{env:VAR}` placeholders from the environment.
+ * Supports the two spellings already present in xp-gate config files.
+ */
+export declare function expandEnv(value: string, env?: NodeJS.ProcessEnv): string;
+/**
+ * Turn raw config into a ready-to-run review setup.
+ * Fails loudly and specifically: a missing key or an unexpanded placeholder is
+ * the most common way a Delphi run silently degrades.
+ */
+export declare function resolveConfig(cfg: RawDelphiConfig, env?: NodeJS.ProcessEnv): ResolvedDelphiConfig;
+/** Read and resolve `.delphi-config.json` from a project root. */
+export declare function loadDelphiConfig(cwd: string, env?: NodeJS.ProcessEnv): ResolvedDelphiConfig;
+/** Build the transport options a round needs from a resolved config. */
+export declare function toDelphiOptions(cfg: ResolvedDelphiConfig): DelphiOptions;
+export {};
+//# sourceMappingURL=delphi-config.d.ts.map

package/plugins/dsh/lib/delphi-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delphi-config.d.ts","sourceRoot":"","sources":["../src/delphi-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAG5D,wDAAwD;AACxD,UAAU,SAAS;IACjB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,UAAU,UAAU;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACtG;;;OAGG;IACH,OAAO,CAAC,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACjD,SAAS,CAAC,EAAE;QAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CACvE;AAED,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;CACtC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,8EAA8E;AAC9E,qBAAa,gBAAiB,SAAQ,KAAK;CAAG;AAE9C;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAIrF;AAkCD;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,eAAe,EACpB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,oBAAoB,CAiFtB;AAED,kEAAkE;AAClE,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,oBAAoB,CAetB;AAED,wEAAwE;AACxE,wBAAgB,eAAe,CAAC,GAAG,EAAE,oBAAoB,GAAG,aAAa,CAQxE"}

package/plugins/dsh/lib/delphi-config.js

@@ -0,0 +1,155 @@
+/**
+ * Delphi configuration loading for the DSH plugin.
+ *
+ * Reads the same `.delphi-config.json` the xp-gate skill already uses, so a
+ * project configures its reviewers once and both the skill and the DSH tool
+ * agree on who they are.
+ *
+ * @test REQ-DSH-016
+ * @intent 复用项目既有的 .delphi-config.json，把 provider/api_key/专家席位解析成
+ *         DSH 工具可用的结构，并对 ${ENV} 占位符与缺失密钥给出可操作的报错。
+ * @covers AC-DSH-016-02
+ */
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { validateSeats } from "./delphi.js";
+/** Raised when config on disk cannot be turned into a usable review setup. */
+export class DelphiSetupError extends Error {
+}
+/**
+ * Expand `${VAR}` and `{env:VAR}` placeholders from the environment.
+ * Supports the two spellings already present in xp-gate config files.
+ */
+export function expandEnv(value, env = process.env) {
+    return value
+        .replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_m, name) => env[name] ?? "")
+        .replace(/\{env:([A-Za-z_][A-Za-z0-9_]*)\}/g, (_m, name) => env[name] ?? "");
+}
+/** Pick the active profile, falling back to the top level. */
+function selectProfile(cfg) {
+    const active = cfg.active_profile;
+    if (active && cfg.profiles?.[active])
+        return cfg.profiles[active];
+    if (cfg.profiles && Object.keys(cfg.profiles).length > 0) {
+        throw new DelphiSetupError(`No active_profile set. Available: ${Object.keys(cfg.profiles).join(", ")}`);
+    }
+    return cfg;
+}
+function seatFromRaw(raw, index, fallbackRole) {
+    const model = raw.model ?? raw.requested_model ?? "";
+    return {
+        id: raw.id ?? raw.name ?? `Expert ${String.fromCharCode(65 + index)}`,
+        role: raw.role ?? fallbackRole,
+        model,
+        maxTokens: raw.max_tokens ?? raw.maxTokens,
+    };
+}
+/** Normalize either experts shape into an ordered list with roles attached. */
+function normalizeExperts(experts) {
+    if (!experts)
+        return [];
+    if (Array.isArray(experts)) {
+        return experts.map((raw, i) => ({ raw, role: raw.role ?? `expert${i}` }));
+    }
+    // Object form: the KEY is the role, which is how xp-gate writes it.
+    return Object.entries(experts).map(([role, raw]) => ({ raw, role }));
+}
+/**
+ * Turn raw config into a ready-to-run review setup.
+ * Fails loudly and specifically: a missing key or an unexpanded placeholder is
+ * the most common way a Delphi run silently degrades.
+ */
+export function resolveConfig(cfg, env = process.env) {
+    const profile = selectProfile(cfg);
+    const normalized = normalizeExperts(profile.experts);
+    // An expert may name its own provider; otherwise there must be a profile-wide
+    // default. Resolve base_url/api_key per provider so mixed setups work.
+    const providerNames = new Set(normalized.map((e) => e.raw.provider ?? profile.provider).filter((p) => !!p));
+    if (providerNames.size === 0) {
+        throw new DelphiSetupError('No provider configured. Set "provider" on the profile or on each expert.');
+    }
+    const providerTable = profile.providers ?? {};
+    const resolvedProviders = new Map();
+    for (const name of providerNames) {
+        const entry = providerTable[name];
+        if (!entry) {
+            throw new DelphiSetupError(`Provider "${name}" is not defined under "providers". ` +
+                `Known: ${Object.keys(providerTable).join(", ") || "(none)"}`);
+        }
+        const baseUrl = entry.base_url ?? entry.baseUrl ?? "";
+        if (!baseUrl)
+            throw new DelphiSetupError(`Provider "${name}" has no base_url.`);
+        const rawKey = entry.api_key ?? entry.apiKey ?? "";
+        const apiKey = expandEnv(rawKey, env);
+        if (!apiKey) {
+            // Name the variable rather than echoing config, which may hold a literal key.
+            const varName = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/.exec(rawKey)?.[1] ??
+                /\{env:([A-Za-z_][A-Za-z0-9_]*)\}/.exec(rawKey)?.[1];
+            throw new DelphiSetupError(varName
+                ? `API key variable ${varName} is not set in the environment.`
+                : `Provider "${name}" has no api_key.`);
+        }
+        resolvedProviders.set(name, { baseUrl, apiKey });
+    }
+    const seats = normalized.map((e, i) => seatFromRaw(e.raw, i, e.role));
+    // Surface an unexpanded placeholder as a config error, not a provider 404.
+    for (const s of seats) {
+        if (s.model.includes("${") || s.model.includes("{env:")) {
+            throw new DelphiSetupError(`Expert "${s.id}" model "${s.model}" is an unexpanded placeholder.`);
+        }
+    }
+    validateSeats(seats);
+    // All seats share one gateway in the supported setup; require agreement so a
+    // mixed list cannot silently send one seat's key to another host.
+    const chosen = resolvedProviders.get(normalized[0].raw.provider ?? profile.provider ?? "");
+    if (!chosen)
+        throw new DelphiSetupError("Unable to resolve a provider for the first expert.");
+    for (const e of normalized) {
+        const name = e.raw.provider ?? profile.provider ?? "";
+        const other = resolvedProviders.get(name);
+        if (!other || other.baseUrl !== chosen.baseUrl) {
+            throw new DelphiSetupError(`All experts must share one gateway base_url; "${name}" differs. ` +
+                `Split the review or align the providers.`);
+        }
+    }
+    // consensus may sit on the profile or at the document root; both occur.
+    const consensus = profile.consensus ?? cfg.consensus;
+    return {
+        seats,
+        baseUrl: chosen.baseUrl,
+        apiKey: chosen.apiKey,
+        thresholdPercent: consensus?.threshold_percent ?? 90,
+        maxRounds: consensus?.max_review_rounds ?? 5,
+        provider: normalized[0].raw.provider ?? profile.provider ?? "",
+    };
+}
+/** Read and resolve `.delphi-config.json` from a project root. */
+export function loadDelphiConfig(cwd, env = process.env) {
+    const path = resolve(cwd, ".delphi-config.json");
+    let raw;
+    try {
+        raw = readFileSync(path, "utf8");
+    }
+    catch {
+        throw new DelphiSetupError(`No .delphi-config.json found at ${path}.`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (e) {
+        throw new DelphiSetupError(`.delphi-config.json is not valid JSON: ${e.message}`);
+    }
+    return resolveConfig(parsed, env);
+}
+/** Build the transport options a round needs from a resolved config. */
+export function toDelphiOptions(cfg) {
+    return {
+        baseUrl: cfg.baseUrl,
+        apiKey: cfg.apiKey,
+        seats: cfg.seats,
+        thresholdPercent: cfg.thresholdPercent,
+        maxRounds: cfg.maxRounds,
+    };
+}
+//# sourceMappingURL=delphi-config.js.map

package/plugins/dsh/lib/delphi-run.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Delphi review orchestration: iterate rounds until consensus or the cap.
+ *
+ * @test REQ-DSH-016
+ * @intent 编排多轮交叉评审：首轮匿名独立评审，后续轮次反馈上一轮汇总，
+ *         直到达到共识阈值（默认 90%）或触及轮次上限（默认 5），
+ *         并把结果整理成可写成 .code-walkthrough-result.json 的证据。
+ * @covers AC-DSH-016-03
+ */
+import type { DelphiOptions, RoundResult } from "./delphi.js";
+export interface ReviewOutcome {
+    readonly rounds: readonly RoundResult[];
+    readonly consensus: boolean;
+    readonly finalRatio: number;
+    readonly totalRounds: number;
+}
+/**
+ * Run a full review. Round 1 is anonymous; each later round sees the aggregate
+ * plus whatever the caller says was addressed, then re-votes.
+ */
+export declare function runReview(opts: DelphiOptions, subject: string, addressed?: string): Promise<ReviewOutcome>;
+/** Human-readable transcript for the tool result. */
+export declare function formatOutcome(outcome: ReviewOutcome): string;
+//# sourceMappingURL=delphi-run.d.ts.map

package/plugins/dsh/lib/delphi-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delphi-run.d.ts","sourceRoot":"","sources":["../src/delphi-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAc,WAAW,EAAE,MAAM,aAAa,CAAA;AAOzE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAA;IACvC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AA0CD;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,MAAM,EACf,SAAS,SAAK,GACb,OAAO,CAAC,aAAa,CAAC,CAoCxB;AAED,qDAAqD;AACrD,wBAAgB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAiB5D"}

package/plugins/dsh/lib/delphi-run.js

@@ -0,0 +1,92 @@
+/**
+ * Delphi review orchestration: iterate rounds until consensus or the cap.
+ *
+ * @test REQ-DSH-016
+ * @intent 编排多轮交叉评审：首轮匿名独立评审，后续轮次反馈上一轮汇总，
+ *         直到达到共识阈值（默认 90%）或触及轮次上限（默认 5），
+ *         并把结果整理成可写成 .code-walkthrough-result.json 的证据。
+ * @covers AC-DSH-016-03
+ */
+import { runRound } from "./delphi.js";
+/** Mirrors delphi.ts; declared here so orchestrators need not import internals. */
+const DEFAULT_THRESHOLD_PERCENT = 90;
+const DEFAULT_MAX_ROUNDS = 5;
+/** Anonymous first round: each seat answers the same question with no peers. */
+function roundOnePrompt(seat, subject) {
+    return (`You are the ${seat.role.toUpperCase()} expert. Review the material below INDEPENDENTLY. ` +
+        `Do not assume other reviewers exist or agree with you.\n\n${subject}\n\n` +
+        `Respond with <=300 words under the headings: "### Findings" (a markdown table of ` +
+        `ID | Severity | Description | Location | Fix, or a single NONE row), then "### VERDICT" ` +
+        `followed by exactly APPROVED or REQUEST_CHANGES, then "### CONFIDENCE" followed by an ` +
+        `integer 1-10. Approve only if you would personally ship this.`);
+}
+/**
+ * Later rounds: feed back the aggregate so seats can revise their position.
+ * Individual reports stay anonymous -- only the tally and the addressed items
+ * are shared, which is what keeps the method honest.
+ */
+function laterRoundPrompt(seat, subject, previous, addressed) {
+    const tally = previous.verdicts
+        .map((v) => `- ${v.role}: ${v.verdict}`)
+        .join("\n");
+    return (`You are the ${seat.role.toUpperCase()} expert. This is ROUND ${previous.round + 1} of a ` +
+        `Delphi consensus review. Individual peer reports are anonymous; only this aggregate is shared:\n\n` +
+        `${tally}\nApprovals: ${previous.approvals}/${previous.validCount} ` +
+        `(threshold ${DEFAULT_THRESHOLD_PERCENT}%).\n\n` +
+        `${addressed ? `What changed since the last round:\n${addressed}\n\n` : ""}` +
+        `Re-examine the material and revise or hold your position.\n\n${subject}\n\n` +
+        `Respond with <=300 words: "### Round assessment" (2-3 sentences), "### Remaining blocking ` +
+        `issues" (table, or a single NONE row), "### VERDICT" followed by exactly APPROVED or ` +
+        `REQUEST_CHANGES, then "### CONFIDENCE" and an integer 1-10.`);
+}
+/**
+ * Run a full review. Round 1 is anonymous; each later round sees the aggregate
+ * plus whatever the caller says was addressed, then re-votes.
+ */
+export async function runReview(opts, subject, addressed = "") {
+    const threshold = opts.thresholdPercent ?? DEFAULT_THRESHOLD_PERCENT;
+    const maxRounds = opts.maxRounds ?? DEFAULT_MAX_ROUNDS;
+    const rounds = [];
+    for (let n = 1; n <= maxRounds; n++) {
+        const previous = rounds[rounds.length - 1];
+        const result = previous
+            ? await runRound(opts, n, "You are a rigorous senior code reviewer.", (seat) => laterRoundPrompt(seat, subject, previous, addressed))
+            : await runRound(opts, 1, "You are a rigorous senior code reviewer.", (seat) => roundOnePrompt(seat, subject));
+        rounds.push(result);
+        // Threshold is a percentage of the whole panel, so a round with a malformed
+        // report cannot reach consensus even if every valid seat approved.
+        if (result.approvals / opts.seats.length * 100 >= threshold) {
+            return {
+                rounds,
+                consensus: true,
+                finalRatio: result.approvals / opts.seats.length,
+                totalRounds: n,
+            };
+        }
+    }
+    const last = rounds[rounds.length - 1];
+    return {
+        rounds,
+        consensus: false,
+        finalRatio: last ? last.approvals / opts.seats.length : 0,
+        totalRounds: rounds.length,
+    };
+}
+/** Human-readable transcript for the tool result. */
+export function formatOutcome(outcome) {
+    const lines = [];
+    for (const r of outcome.rounds) {
+        lines.push(`## Round ${r.round} — approvals ${r.approvals}/${r.validCount} valid`);
+        for (const v of r.verdicts) {
+            const model = v.resolvedModel ? `${v.requestedModel} -> ${v.resolvedModel}` : v.requestedModel;
+            const note = v.error ? ` (${v.error})` : "";
+            lines.push(`- [${v.role}] ${v.id} (${model}): ${v.verdict} confidence=${v.confidence}${note}`);
+        }
+        lines.push("");
+    }
+    lines.push(outcome.consensus
+        ? `CONSENSUS REACHED: ${(outcome.finalRatio * 100).toFixed(0)}% after ${outcome.totalRounds} round(s).`
+        : `NO CONSENSUS: ${(outcome.finalRatio * 100).toFixed(0)}% after ${outcome.totalRounds} round(s) (cap reached).`);
+    return lines.join("\n");
+}
+//# sourceMappingURL=delphi-run.js.map

package/plugins/dsh/lib/delphi.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Delphi cross-review over an external OpenAI-compatible provider.
+ *
+ * This is the codified form of the manual run that produced PR #456: three
+ * DISTINCT models, each asked the same question independently and anonymously,
+ * iterated until the approval ratio clears the consensus threshold.
+ *
+ * Why a plugin tool rather than a shell one-liner: the DSH tool plane is where
+ * a session actually lives, so the mechanism has to be callable from there.
+ * DSH's own `tool-subagent` cannot serve this purpose -- subagents inherit one
+ * host-configured model, so they cannot guarantee three distinct models, and
+ * Delphi's whole value rests on that distinctness.
+ *
+ * @test REQ-DSH-016
+ * @intent 用外部 provider 的多个不同模型做匿名交叉评审并判定共识，
+ *         把「多模型交叉评审」固化成 DSH 可调用的机制而非一次性脚本。
+ * @covers AC-DSH-016-01
+ */
+/** One expert seat. `model` is the id sent to the provider. */
+export interface ExpertSeat {
+    readonly id: string;
+    readonly role: string;
+    readonly model: string;
+    /** Reasoning models burn hidden tokens, so seats need independent budgets. */
+    readonly maxTokens?: number;
+}
+/** A single expert's parsed verdict for one round. */
+export interface ExpertVerdict {
+    readonly id: string;
+    readonly role: string;
+    readonly requestedModel: string;
+    readonly resolvedModel: string | null;
+    readonly verdict: "APPROVED" | "REQUEST_CHANGES" | "INVALID_NO_VERDICT" | "ERROR";
+    readonly confidence: number;
+    /** Only well-formed verdicts may count toward consensus. */
+    readonly counted: boolean;
+    readonly report: string;
+    readonly error?: string;
+}
+/** Aggregated outcome of one round. */
+export interface RoundResult {
+    readonly round: number;
+    readonly verdicts: readonly ExpertVerdict[];
+    readonly validCount: number;
+    readonly approvals: number;
+    readonly consensusRatio: number;
+    readonly reachedConsensus: boolean;
+}
+export interface DelphiOptions {
+    /** OpenAI-compatible base URL, e.g. https://host/gpt-proxy */
+    readonly baseUrl: string;
+    /** Bearer token. Callers read this from the environment; never hardcode it. */
+    readonly apiKey: string;
+    readonly seats: readonly ExpertSeat[];
+    /** Percent, 0-100. Delphi default is 90. */
+    readonly thresholdPercent?: number;
+    readonly maxRounds?: number;
+    /** Per-request ceiling; the caller owns the overall timeout. */
+    readonly timeoutMs?: number;
+    readonly fetchImpl?: typeof fetch;
+}
+/** Raised when the configured seats cannot satisfy the Delphi invariants. */
+export declare class DelphiConfigError extends Error {
+}
+/**
+ * Reject a seat configuration that cannot produce a valid Delphi review.
+ * Checked BEFORE any network call so a misconfiguration never looks like a
+ * provider failure.
+ */
+export declare function validateSeats(seats: readonly ExpertSeat[]): void;
+/**
+ * Parse an expert report into a verdict.
+ *
+ * The verdict token usually sits on the line AFTER a "### VERDICT" heading, so
+ * a same-line `VERDICT: X` pattern misses every real report. A report with no
+ * recognisable verdict is INVALID, never a guess: inferring approval from prose
+ * would let the gate pass on an assumption.
+ */
+export declare function parseVerdict(text: string): {
+    verdict: ExpertVerdict["verdict"];
+    confidence: number;
+};
+/**
+ * Run ONE round. All seats are asked concurrently and never see each other's
+ * output, which is what makes the round anonymous.
+ */
+export declare function runRound(opts: DelphiOptions, round: number, system: string, buildPrompt: (seat: ExpertSeat) => string): Promise<RoundResult>;
+//# sourceMappingURL=delphi.d.ts.map

package/plugins/dsh/lib/delphi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delphi.d.ts","sourceRoot":"","sources":["../src/delphi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,+DAA+D;AAC/D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,sDAAsD;AACtD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,OAAO,CAAA;IACjF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,uCAAuC;AACvC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAA;CACnC;AAED,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAA;IACrC,4CAA4C;IAC5C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,gEAAgE;IAChE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CAClC;AASD,6EAA6E;AAC7E,qBAAa,iBAAkB,SAAQ,KAAK;CAAG;AAE/C;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,IAAI,CAoBhE;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG;IAC1C,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;IACjC,UAAU,EAAE,MAAM,CAAA;CACnB,CAWA;AA6DD;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,aAAa,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,MAAM,GACxC,OAAO,CAAC,WAAW,CAAC,CAmDtB"}