@godv61/dsh-task-engine 0.20.0 → 0.22.0

package/.p0-test.mjs

@@ -289,4 +289,250 @@ await assertThrows(
   assert(controller.includes('overwrite'), 'writeInit request carries an overwrite field')
 }
 
+// ── 21. 0.21-A: project adapter — type detection, root discovery, default verify commands ──
+const project = await import('./lib/project.js')
+
+function memProbe(files) {
+  return {
+    async read(dir, relPath) {
+      const key = `${dir.replace(/\\/g, '/')}/${relPath}`.replace(/\/+/g, '/')
+      return files[key]
+    },
+  }
+}
+
+{
+  const probe = memProbe({ '/repo/package.json': '{}' })
+  assert(await project.detectType(probe, '/repo') === 'node', 'node marker resolves to node')
+  assert(await project.detectRoot(probe, '/repo/src/nested') === '/repo', 'root discovery climbs to the package.json directory')
+}
+{
+  const probe = memProbe({ '/repo/pom.xml': '<project/>' })
+  assert(await project.detectType(probe, '/repo') === 'java', 'pom.xml resolves to java')
+}
+{
+  const probe = memProbe({ '/repo/go.mod': 'module x' })
+  assert(await project.detectType(probe, '/repo') === 'go', 'go.mod resolves to go')
+}
+{
+  const probe = memProbe({ '/repo/Cargo.toml': '[package]' })
+  assert(await project.detectType(probe, '/repo') === 'rust', 'Cargo.toml resolves to rust')
+}
+{
+  const probe = memProbe({ '/repo/requirements.txt': 'flask' })
+  assert(await project.detectType(probe, '/repo') === 'python', 'requirements.txt resolves to python')
+}
+{
+  const probe = memProbe({})
+  assert(await project.detectType(probe, '/empty') === 'unknown', 'empty tree reports unknown type')
+  assert(await project.detectRoot(probe, '/empty/deep/dir') === '/empty/deep/dir', 'root discovery falls back to the start directory')
+}
+{
+  const probe = memProbe({ '/repo/package.json': '{}', '/repo/pyproject.toml': '[tool]' })
+  assert(await project.detectType(probe, '/repo') === 'unknown', 'mixed tree reports unknown, never a silent single-language guess')
+}
+{
+  const probe = memProbe({ '/repo/.git/HEAD': 'ref: refs/heads/main' })
+  assert(await project.detectRoot(probe, '/repo/sub/module') === '/repo', 'root discovery stops at the git repository')
+}
+{
+  assert(project.defaultVerifyCommand('node') === 'npm test', 'node default verify command')
+  assert(project.defaultVerifyCommand('java') === 'mvn -q test', 'java default verify command')
+  assert(project.defaultVerifyCommand('go') === 'go test ./...', 'go default verify command')
+  assert(project.defaultVerifyCommand('unknown') === undefined, 'unknown type has no default command')
+}
+{
+  const probe = memProbe({ '/repo/AGENTS.md': '# a', '/repo/CLAUDE.md': '# c' })
+  const present = await project.presentGovernanceFiles(probe, '/repo')
+  assert(present.includes('AGENTS.md') && present.includes('CLAUDE.md'), 'governance files are recognized as present')
+  assert(!present.includes('.cursorrules'), 'absent governance files are not listed')
+}
+
+// ── 22. 0.21-C/D/E: out-of-root write guard, hook risk policy, project binding dirs ──
+{
+  const { assertInsideRoot } = await import('./lib/dev-task.js')
+  assertInsideRoot('/repo', '/repo/sub', 'AGENTS.md')
+  assertInsideRoot('/repo/sub', '/repo/sub', 'AGENTS.md')
+  await assertThrows(
+    () => assertInsideRoot('/repo', '/repo', '../outside.txt'),
+    'escapes the project root',
+    'init write escaping the root is rejected',
+  )
+  await assertThrows(
+    () => assertInsideRoot('/repo', '/repo', 'C:/elsewhere/x.txt'),
+    'escapes the project root',
+    'absolute target outside the root is rejected',
+  )
+}
+{
+  const hook = readFileSync('./hooks/commit-msg', 'utf8')
+  assert(hook.includes('sensitive_paths'), 'hook bundles the risk policy table (single source)')
+  assert(hook.includes('risk_level === "high_risk"') || hook.includes('risk_level === \'high_risk\''), 'hook requires high_risk before touching sensitive paths')
+}
+{
+  const probe = {
+    async read(dir, relPath) {
+      const key = `${dir}/${relPath}`.replace(/\/+/g, '/')
+      return files[key]
+    },
+    async list(dir, relPath) {
+      const prefix = `${dir}/${relPath}`.replace(/\/+/g, '/')
+      return Object.keys(files).filter(k => k.startsWith(prefix + '/')).map(k => k.slice(prefix.length + 1).split('/')[0])
+    },
+  }
+  const files = {
+    '/repo/.dsh/rules/api-conventions.md': '# r',
+    '/repo/.dsh/rules/README.md': '# meta',
+    '/repo/.dsh/skills/java-dev/SKILL.md': '# s',
+    '/repo/.dsh/skills/empty/': '# no skill file',
+  }
+  const rules = await project.listProjectRules(probe, '/repo')
+  assert(rules.length === 2 && rules.includes('api-conventions'), 'project rules list from .dsh/rules/*.md')
+  const skills = await project.listProjectSkills(probe, '/repo')
+  assert(skills.length === 1 && skills.includes('java-dev'), 'project skills list only dirs carrying SKILL.md')
+}
+
+// ── 23. 0.22-A: snapshot hash integrity ────────────────────────────────────
+{
+  const { hashConfig } = await import('./lib/snapshot.js')
+  const config = FLOW_PRESETS.standard.config
+  const h1 = hashConfig(config)
+  const h2 = hashConfig(JSON.parse(JSON.stringify(config)))
+  assert(h1 === h2 && /^[0-9a-f]{64}$/.test(h1), 'hashConfig is a deterministic sha256')
+  const tampered = JSON.parse(JSON.stringify(config))
+  tampered.commit.file_scope = false
+  assert(hashConfig(tampered) !== h1, 'editing the frozen config changes the hash')
+}
+{
+  const fs = makeFs({ '.dsh/eng.json': JSON.stringify({ flow: 'standard' }) })
+  const exe = await registered(fs)
+  await exe({ operation: 'create', task_id: 'HASH-1', title: 'x', branch: 'main' }, EXEC)
+  const record = JSON.parse(fs._files.get('.dsh/task-HASH-1.json'))
+  record.flow.config.commit.file_scope = false
+  fs._files.set('.dsh/task-HASH-1.json', JSON.stringify(record))
+  await assertThrows(
+    () => exe({ operation: 'status', task_id: 'HASH-1' }, EXEC),
+    'hash mismatch',
+    'status on a tampered snapshot is rejected',
+  )
+}
+{
+  const hook = readFileSync('./hooks/commit-msg', 'utf8')
+  assert(hook.includes('hashConfig'), 'hook reuses the single hashConfig source')
+  assert(hook.includes('sha256') || hook.includes('createHash'), 'hook bundles the sha256 snapshot check')
+}
+
+// ── 24. 0.22-B: installed-hook integrity check ─────────────────────────────
+{
+  const fs = makeFs({})
+  const exe = await registered(fs)
+  assert((await exe({ operation: 'verify_hook' }, EXEC)).includes('run install_hook'), 'verify_hook reports an absent hook')
+  await exe({ operation: 'install_hook' }, EXEC)
+  assert((await exe({ operation: 'verify_hook' }, EXEC)).includes('integrity OK'), 'verify_hook passes on the bundled hook')
+  fs._files.set('.git/hooks/commit-msg', fs._files.get('.git/hooks/commit-msg') + '\n// tampered')
+  await assertThrows(
+    () => exe({ operation: 'verify_hook' }, EXEC),
+    'integrity FAILED',
+    'verify_hook rejects a tampered hook',
+  )
+}
+
+// ── 25. 0.22-B: risk downgrade approval + bindings fingerprint ─────────────
+{
+  const fs = makeFs({ '.dsh/eng.json': JSON.stringify({ flow: 'standard' }) })
+  const exe = await registered(fs)
+  await exe({ operation: 'create', task_id: 'RISK-1', title: 'x', branch: 'main', risk_level: 'high_risk' }, EXEC)
+  await assertThrows(
+    () => exe({ operation: 'set_risk', task_id: 'RISK-1', risk_level: 'standard' }, EXEC),
+    'approval',
+    'downgrade without an approval service is rejected',
+  )
+  assert((await exe({ operation: 'set_risk', task_id: 'RISK-1', risk_level: 'high_risk' }, EXEC)).includes('already'),
+    'same-risk set_risk is a no-op')
+}
+{
+  const approval = { async request() { return 'allowed-once' } }
+  const fs = makeFs({ '.dsh/eng.json': JSON.stringify({ flow: 'standard' }) })
+  const exe = await registered(fs, approval)
+  await exe({ operation: 'create', task_id: 'RISK-2', title: 'x', branch: 'main', risk_level: 'high_risk' }, EXEC)
+  assert((await exe({ operation: 'set_risk', task_id: 'RISK-2', risk_level: 'standard' }, EXEC)).includes('risk_level set to standard'),
+    'approved downgrade succeeds')
+  const status = JSON.parse(await exe({ operation: 'status', task_id: 'RISK-2' }, EXEC))
+  assert(status.risk_level === 'standard' && status.risk_downgrades.length === 1,
+    'downgrade is recorded in the audit trail')
+}
+{
+  const fs = makeFs({ '.dsh/eng.json': JSON.stringify({ flow: 'standard' }) })
+  const exe = await registered(fs)
+  await exe({ operation: 'create', task_id: 'FP-1', title: 'x', branch: 'main' }, EXEC)
+  const status = JSON.parse(await exe({ operation: 'status', task_id: 'FP-1' }, EXEC))
+  assert(status.bindings_drift === undefined, 'fresh task shows no bindings drift')
+  const record = JSON.parse(fs._files.get('.dsh/task-FP-1.json'))
+  assert(typeof record.bindings_fingerprint === 'string' && record.bindings_fingerprint.length === 64,
+    'create records the bundled-rules fingerprint')
+}
+
+// ── 26. 0.22-C: multi-language verify command chain + parallel tasks ────────
+{
+  const fs = makeFs({ '.dsh/eng.json': JSON.stringify({ flow: 'standard', verify_command: 'mvn test' }) })
+  const exe = await registered(fs)
+  await exe({ operation: 'create', task_id: 'V-1', title: 'x', branch: 'main' }, EXEC)
+  await assertThrows(
+    () => exe({ operation: 'verify', task_id: 'V-1' }, EXEC),
+    'shell',
+    'verify falls back to the eng.json command and fails loud without a shell service',
+  )
+}
+{
+  const fs = makeFs({ '.dsh/eng.json': JSON.stringify({ flow: 'standard' }), 'package.json': '{}' })
+  const exe = await registered(fs)
+  await exe({ operation: 'create', task_id: 'V-2', title: 'x', branch: 'main' }, EXEC)
+  await assertThrows(
+    () => exe({ operation: 'verify', task_id: 'V-2' }, EXEC),
+    'shell',
+    'verify falls back to the language default (node → npm test) and fails loud without a shell service',
+  )
+}
+{
+  const fs = makeFs({ '.dsh/eng.json': JSON.stringify({ flow: 'standard' }) })
+  const exe = await registered(fs)
+  await exe({ operation: 'create', task_id: 'V-3', title: 'x', branch: 'main' }, EXEC)
+  assert((await exe({ operation: 'verify', task_id: 'V-3', passed: true }, EXEC)).includes('ok'),
+    'unknown-type verify keeps the legacy self-reported path')
+}
+{
+  const fs = makeFs({ '.dsh/eng.json': JSON.stringify({ flow: 'standard' }) })
+  const exe = await registered(fs)
+  await exe({ operation: 'create', task_id: 'A-1', title: 'x', branch: 'main' }, EXEC)
+  await exe({ operation: 'create', task_id: 'B-2', title: 'y', branch: 'main' }, EXEC)
+  await exe({ operation: 'scope', task_id: 'A-1', files: ['src/a.ts'] }, EXEC)
+  const a = JSON.parse(await exe({ operation: 'status', task_id: 'A-1' }, EXEC))
+  const b = JSON.parse(await exe({ operation: 'status', task_id: 'B-2' }, EXEC))
+  assert(a.files.length === 1 && b.files.length === 0, 'two tasks in one repo advance independently')
+}
+
+// ── 27. 9.4: init apply validates the expected hash ─────────────────────────
+{
+  const fs = makeFs({})
+  const exe = await registered(fs)
+  const propose = await exe({ operation: 'init', phase: 'propose', content: 'hello' }, EXEC)
+  const match = /content hash: ([0-9a-f]{64})/.exec(propose)
+  assert(match !== null, 'propose returns the content hash')
+  await assertThrows(
+    () => exe({ operation: 'init', phase: 'apply', content: 'hello', expected_hash: '0'.repeat(64) }, EXEC),
+    'expected_hash mismatch',
+    'apply with a mismatched hash is rejected',
+  )
+  assert((await exe({ operation: 'init', phase: 'apply', content: 'hello', expected_hash: match[1] }, EXEC)).includes('wrote'),
+    'apply with the matching hash writes the file')
+}
+
+// ── 28. risk policy excludes project binding dirs ───────────────────────────
+{
+  const policy = project.DEFAULT_RISK_POLICY
+  assert(!policy.sensitive_paths.includes('.dsh'),
+    'project binding dir (.dsh/rules, .dsh/skills) stays committable by normal tasks')
+  assert(policy.sensitive_paths.includes('.env'), 'env files remain sensitive')
+}
+
 console.log(`\nP0 acceptance: ${passed} checks passed`)

package/README.md

@@ -175,4 +175,6 @@ dsh plugin --profile <name> add .
 - **工作台项目初始化（0.19.0）**：工作台新增置顶的「项目初始化」标签页——加载展示项目根 `AGENTS.md`、一键让 AI 扫描项目生成草稿（预览后再确认写回）、支持手动编辑与覆盖；Host 控制器新增 `readInit`/`writeInit`/`generateInit` 三个 Remote，`generateInit` 通过 `ctx.llm` + 默认模型在 Host 端直接生成，复用 `dev_task init` 的 200 行硬约束。
 - **使用手册跟进（0.19.1）**：随包发布的 `docs/manual.html` 补上工作台「项目初始化」（默认置顶标签页、项目根自动发现、AI 生成 150 秒超时 + 覆盖需人工确认），第 7 节标签页从「三个」改为「五个」；安装章节补全 dsh CLI（非源码）安装方式与 pnpm 前置、`dsh plugin add` 的挂载机制；删除顶层已废弃的 `USER_GUIDE.html`（v0.9.1、无引用、不随包发布），README 目录结构描述同步为五标签页。
 - **审计修复（0.19.2）**：补齐七项——① 提交钩子 `stagedFiles` 用 `core.quotePath=false` + `-z` 按 NUL 拆分（中文文件名不再被八进制转义误拒）并补 `D`（删除范围外文件也被拦）；② 提交消息第一段改为 task id、钩子按 id 精确定位任务（不再按分支/mtime 猜，同分支多任务不再锁错）；③ artifact id 全流程唯一 + `record` 校验产物属于当前阶段（堵越阶段复用）；④ 高风险验证证据 `trim()` 后须非空（`evidence:[""]` 不再通过）；⑤ README/手册加「诚实边界」，明说验证/评审/实施项是模型自报、需人工或 CI 兜底；⑥ 文档修正优先级（内置 &gt; 用户 &gt; 项目、内置不可覆盖）与 enable 措辞，`.dsh/task-*.json`/`eng.json` 豁免文件范围门；⑦ 提交钩子改用任务快照的 frozen 配置校验（对抗任务执行中改流程导致的配置漂移）；⑧ 工作台 `writeInit` 对齐 `init` 保护（已有 `AGENTS.md` 时需显式 overwrite + 前端确认才覆盖）；⑨ `.p0-test.mjs` 纳入发布包，装包后 `npm test` 可用。新增回归测试。
-- **安全闭环（0.20.0）**：① 验证改真实命令回执——`dev_task verify` 新增 `command` 入参，引擎通过宿主 shell 服务真实运行该命令并落 `VerificationReceipt`（命令 / 退出码 / 超时 / 中止 / 起止时间 / stdout / stderr）；`high_risk` 任务的 `verified` 门改为要求回执 `exit_code === 0` 且非超时 / 中止，纯文本 `passed` 声明不再放行（常规风险仍可用 `passed` + `evidence` 文本）；② 文件范围检查补 `T` + 改用 `--name-status`——`--diff-filter=ACMRDT` 纳入类型变换，提交状态随范围拒绝一并报出，删除 / 类型变换 / 重命名的旧·新路径都受范围检查；③ 提交钩子改为从 `engine.ts` / `workflows.ts` 单一源打包生成（`build-hook.mjs`），彻底消除手写镜像漂移，未知流程在钩子侧同样 fail-closed（不再静默回退 `standard`）。
+- **安全闭环（0.20.0）**：① 验证改真实命令回执——`dev_task verify` 新增 `command` 入参，引擎通过宿主 shell 服务真实运行该命令并落 `VerificationReceipt`（命令 / 退出码 / 超时 / 中止 / 起止时间 / stdout / stderr）；`high_risk` 任务的 `verified` 门改为要求回执 `exit_code === 0` 且非超时 / 中止，纯文本 `passed` 声明不再放行（常规风险仍可用 `passed` + `evidence` 文本）；② 文件范围检查补 `T` + 改用 `--name-status`——`--diff-filter=ACMRDT` 纳入类型变换，提交状态随范围拒绝一并报出，删除 / 类型变换 / 重命名的旧·新路径都受范围检查；③ 提交钩子改为从 `engine.ts` / `workflows.ts` 单一源打包生成（`build-hook.mjs`），彻底消除手写镜像漂移，未知流程在钩子侧同样 fail-closed（不再静默回退 `standard`）。
+- **通用项目适配（0.21.0）**：① 新增项目适配层 `src/project.ts`——按特征文件识别 Node / Java / Python / Go / Rust 类型，从 workspace 向上发现项目根（`.git` / `.dsh` / 语言特征文件）；② 各语言默认验证命令（`npm test` / `mvn -q test` / `python -m pytest` / `go test ./...` / `cargo test`），`verify` 不带 `command` 时按 `.dsh/eng.json` 的 `verify_command` → 语言默认链自动跑真实命令；③ 治理文件识别扩展至 `AGENTS.md`、`CLAUDE.md`、`.cursorrules`，`init inspect` 一并报告治理文件、项目根、语言栈与项目级 skill/rule 目录（约定 `.dsh/rules/*.md`、`.dsh/skills/<name>/SKILL.md`）；④ 提交钩子加风险策略——触及敏感路径（`.git` / `.env` / credentials / secrets；`.dsh` 的任务记录与流程配置由快照 hash 与豁免保护）要求任务为 `high_risk` 且验证有真实命令回执，否则拒绝；⑤ 初始化写入越界保护——`init` / `create` 的写入目标必须落在项目根内；任务记录新增 `root` / `project_type` 字段。
+- **审计和发布质量（0.22.0）**：① 流程快照 hash——任务创建时固化 `config` 的 SHA-256，工具与提交钩子读任务记录时校验，被手改的快照一律拒绝继续；② 提交钩子完整性检测——新增 `dev_task verify_hook`，比对 `.git/hooks/commit-msg` 与内置门禁的 hash，被替换/篡改立即报错；③ 风险降级审批——新增 `set_risk`，`high_risk → standard` 必须人工批准并落 `risk_downgrades` 审计记录；④ 验证回执绑定项目根——receipt 记录 `root`，与任务 workspace 绑定；⑤ 内置规则指纹锁定——创建时固化内置规则内容指纹，包升级后 `status` 报 `bindings_drift` 而非静默换规则；⑥ 多项目 / 多语言 / 多任务测试矩阵补强。

package/docs/manual.html

@@ -81,7 +81,7 @@
         </div>
         <p>三样东西分工明确：<strong>流程预设</strong>决定「走哪条流水线、有哪些守卫」，<strong>Skill</strong> 决定「这一站做什么」，<strong>Rule</strong> 决定「这一站守什么」。任务状态单独落盘，负责「跨会话恢复到哪一步」。</p>
         <div class="callout warn">
-          <p><strong>诚实边界：</strong>阶段流转、提交格式、文件范围、消息里的任务绑定是<b>代码硬校验</b>（不匹配直接拒绝）；<b>高风险任务的「验证通过」也是真实命令回执</b>——引擎实际运行 <code>verify</code> 命令、取退出码（<code>exit_code === 0</code> 且非超时/中止）才放行，不是模型自报。仍属模型自报、需人工或 CI 兜底的是：常规风险的验证声明、「评审通过」「实施项完成」，以及回执命令本身的覆盖面。只有「需求确认」「方案确认」两扇门由人工批准点亮。</p>
+          <p><strong>诚实边界：</strong>阶段流转、提交格式、文件范围、消息里的任务绑定、流程快照 hash、钩子完整性、敏感路径风险策略是<b>代码硬校验</b>（不匹配直接拒绝）；<b>高风险任务的「验证通过」也是真实命令回执</b>——引擎实际运行 <code>verify</code> 命令、取退出码（<code>exit_code === 0</code> 且非超时/中止）才放行，不是模型自报。仍属模型自报、需人工或 CI 兜底的是：常规风险的验证声明、「评审通过」「实施项完成」，以及回执命令本身的覆盖面。只有「需求确认」「方案确认」两扇门由人工批准点亮，风险降级（high_risk → standard）也由人工批准。</p>
         </div>
       </section>
 
@@ -227,14 +227,14 @@ pnpm install &amp;&amp; pnpm run build &amp;&amp; pnpm dsh web</code></pre>
 
         <h3>对话式 init</h3>
         <ol>
-          <li><b>inspect</b>：对 AI 说「帮我初始化这个项目」；AI 读现有 <code>AGENTS.md</code>（若有）返回，没有则扫目录结构、技术栈、构建 / 运行命令、约定与红线。</li>
-          <li><b>propose</b>：AI 写成 <code>AGENTS.md</code> 草稿，此步<b>只预览、不落盘</b>，同样硬校验<b>行数 ≤ 200 行</b>。</li>
-          <li><b>apply</b>：落盘。首次创建直接写入；覆盖已有 <code>AGENTS.md</code> 必须带 <code>overwrite</code> 且<b>经人工批准</b>。</li>
+          <li><b>inspect</b>：对 AI 说「帮我初始化这个项目」；AI 读现有 <code>AGENTS.md</code>（若有）返回，没有则扫目录结构、技术栈、构建 / 运行命令、约定与红线。同时报告：项目根（自动从 workspace 向上发现）、语言栈（Node / Java / Python / Go / Rust）与默认验证命令、其它治理文件（<code>CLAUDE.md</code>、<code>.cursorrules</code>——init 只管理 AGENTS.md，不覆盖它们）、项目级 skill/rule 目录（<code>.dsh/rules/*.md</code>、<code>.dsh/skills/&lt;name&gt;/SKILL.md</code>）。</li>
+          <li><b>propose</b>：AI 写成 <code>AGENTS.md</code> 草稿，此步<b>只预览、不落盘</b>，同样硬校验<b>行数 ≤ 200 行</b>，并返回内容 hash。</li>
+          <li><b>apply</b>：落盘。首次创建直接写入；覆盖已有 <code>AGENTS.md</code> 必须带 <code>overwrite</code> 且<b>经人工批准</b>；传回 <code>expected_hash</code> 与 propose 的内容 hash 不一致会被拒绝（防止预览与落盘之间内容被换）。写入目标必须在项目根内。</li>
         </ol>
         <pre><code>项目根/
 ├─ AGENTS.md          ← init 生成，DSH 每会话自动注入
 └─ .dsh/
-   ├─ eng.json
+   ├─ eng.json        ← flow + verify_command（可覆盖语言默认验证命令）
    ├─ skills/ · rules/
    └─ task-*.json</code></pre>
       </section>
@@ -308,6 +308,7 @@ pnpm install &amp;&amp; pnpm run build &amp;&amp; pnpm dsh web</code></pre>
           <li>差异没变时复用有效证据，不重复跑相同命令。</li>
           <li>无法联调外部系统时必须如实写「未联调」，不能把编译成功说成功能通过。</li>
           <li><code>high_risk</code> 任务过验证门必须跑真实命令回执（引擎运行命令、取退出码，非自报通过）。</li>
+          <li><code>verify</code> 不带 <code>command</code> 时引擎自动选命令：<code>.dsh/eng.json</code> 的 <code>verify_command</code> 优先，其次按项目语言用默认（node → <code>npm test</code>、java → <code>mvn -q test</code>、python → <code>python -m pytest</code>、go → <code>go test ./...</code>、rust → <code>cargo test</code>）；识别不出语言且未配置时保留自报路径。跑命令依赖宿主 shell 服务，未挂载会明确报错。</li>
         </ul>
         <h3>评审</h3>
         <p>开发阶段每项做「规格 + 质量」两阶段评审，都 pass 才标 done；缺评审或任一阶段 fail 会挡住「开发 → 交付」。</p>
@@ -323,7 +324,10 @@ pnpm install &amp;&amp; pnpm run build &amp;&amp; pnpm dsh web</code></pre>
           </table>
         </div>
         <p>提交消息要求 <code>【模块】【TASK】做了什么</code>，且只提交任务 <code>files</code> 范围内的文件。要彻底封死模型绕过 <code>dev_task</code> 直接 <code>git commit</code>，给仓库装一道机械钩子：</p>
-        <pre><code>dev_task operation=install_hook   # 装入 .git/hooks/commit-msg，装上后任何 git commit 都被同一套规则校验</code></pre>
+        <pre><code>dev_task operation=install_hook   # 装入 .git/hooks/commit-msg，装上后任何 git commit 都被同一套规则校验
+dev_task operation=verify_hook    # 随时比对安装钩子与内置门禁的 hash，被替换/篡改立即报错</code></pre>
+        <p><strong>钩子的额外硬校验（0.21/0.22）：</strong>① 任务记录的流程快照带 SHA-256 hash，被手改过的快照一律拒绝提交；② 触及敏感路径（<code>.env</code>、credentials、secrets、<code>.git</code>；<code>.dsh</code> 的任务记录与流程配置由快照 hash 与豁免保护，项目级 rules/skills 属常规内容）的提交，要求任务为 <code>high_risk</code> 且验证有真实命令回执，否则拒绝；③ 删除、类型变换、重命名的旧·新路径都受范围检查。</p>
+        <p><strong>风险降级（0.22）：</strong><code>set_risk</code> 把 <code>high_risk</code> 降为 <code>standard</code> 必须人工批准，并写入任务的 <code>risk_downgrades</code> 审计记录；降级后高风险回执门不再适用，请谨慎。</p>
       </section>
 
       <section id="example">
@@ -367,7 +371,7 @@ risk_level: high_risk   // 涉及鉴权，验证要加证据
         <details><summary>一个会话能同时做两个需求吗？</summary><div>一个任务对应一份状态文档、一个分支。新需求保存当前进度后切新分支，切回原分支即可恢复。</div></details>
         <details><summary>提交被拒是怎么回事？</summary><div>通常是四类：没建 dev_task 任务、阶段没到提交检查点、消息格式不符、提交文件不在任务范围内。按拒绝原因修正即可。</div></details>
         <details><summary>「完成」等于上线了吗？</summary><div>不等于。<code>done</code> 只表示本地验证与必要评审通过；上线、合并、发布需人另行决定。</div></details>
-        <p class="stamp">当前结构基线：三套流程预设 · 工作台项目初始化（0.19.0）· 最后更新：2026-09-12</p>
+        <p class="stamp">当前结构基线：三套流程预设 · 工作台项目初始化（0.19.0）· 通用项目适配（0.21.0）· 审计与发布质量（0.22.0）· 最后更新：2026-09-12</p>
       </section>
     </main>
   </div>

package/hooks/commit-msg

@@ -240,6 +240,32 @@ function resolveFlow(flow, override) {
   return { ok: true, config: mergeBindings(preset2.config, override?.stage_bindings), preset: preset2 };
 }
 
+// src/snapshot.ts
+var import_node_crypto = require("node:crypto");
+function hashText(text) {
+  return (0, import_node_crypto.createHash)("sha256").update(text).digest("hex");
+}
+function hashConfig(config2) {
+  return hashText(JSON.stringify(config2));
+}
+
+// src/project.ts
+var TYPE_MARKERS = {
+  node: ["package.json"],
+  java: ["pom.xml", "build.gradle", "build.gradle.kts", "settings.gradle"],
+  python: ["pyproject.toml", "requirements.txt", "setup.py"],
+  go: ["go.mod"],
+  rust: ["Cargo.toml"]
+};
+var DEFAULT_RISK_POLICY = {
+  // `.dsh/task-*.json` and `.dsh/eng.json` are protected by the snapshot hash and
+  // the engine-meta exemption, not by this list; `.dsh/rules` / `.dsh/skills`
+  // hold regular project content and stay committable by normal tasks.
+  sensitive_paths: [".git", ".env", ".credentials.yaml", "credentials", "secrets"],
+  risky_operations: ["D", "T"]
+};
+var ALL_MARKERS = Object.values(TYPE_MARKERS).flat();
+
 // src/hook.ts
 var messageFile = process.argv[2];
 function refuse(reason) {
@@ -345,6 +371,16 @@ function extractTaskId(message2) {
   const match = /^【([^【】\s]+)】/.exec(message2);
   return match ? match[1] : void 0;
 }
+function isEngineMeta2(file) {
+  return /^\.dsh\/(task-[^/]+\.json|eng\.json)$/.test(file);
+}
+function riskyPaths(entries2) {
+  return entries2.filter((entry) => !isEngineMeta2(entry.path)).filter((entry) => DEFAULT_RISK_POLICY.sensitive_paths.some((prefix) => entry.path === prefix || entry.path.startsWith(`${prefix}/`))).map((entry) => entry.path);
+}
+function riskVerified(state2) {
+  const receipt = state2.verification.receipt;
+  return state2.risk_level === "high_risk" && receipt !== void 0 && receipt.exit_code === 0 && !receipt.timed_out && !receipt.aborted;
+}
 function defaultConfig() {
   const resolved = resolveFlow("standard");
   if (!resolved.ok) throw new Error('built-in "standard" preset is missing');
@@ -402,6 +438,9 @@ if (taskId !== void 0) {
 if (!state) {
   refuse("\u6CA1\u6709\u627E\u5230 dev_task \u4EFB\u52A1\u8BB0\u5F55\uFF08.dsh/task-*.json\uFF09\u2014\u2014\u8BF7\u5148 dev_task operation=create \u5EFA\u7ACB\u4EFB\u52A1");
 }
+if (state.flow?.hash !== void 0 && hashConfig(state.flow.config) !== state.flow.hash) {
+  refuse(`\u4EFB\u52A1 ${state.id} \u7684\u6D41\u7A0B\u5FEB\u7167 hash \u4E0D\u5339\u914D\u2014\u2014task \u8BB0\u5F55\u5728\u521B\u5EFA\u540E\u88AB\u6539\u52A8\u8FC7\uFF0C\u4FEE\u590D\u6216\u91CD\u5EFA\u4EFB\u52A1\u540E\u518D\u63D0\u4EA4`);
+}
 if (state.flow !== void 0 && state.flow.config !== void 0) {
   config = state.flow.config;
 }
@@ -425,4 +464,10 @@ if (!scope.ok) {
   });
   refuse("\u63D0\u4EA4\u4E86\u4EFB\u52A1\u8303\u56F4\u4E4B\u5916\u7684\u6587\u4EF6: " + described.join(", "));
 }
+var sensitive = riskyPaths(entries);
+if (sensitive.length > 0 && !riskVerified(state)) {
+  refuse(
+    "\u63D0\u4EA4\u89E6\u53CA\u654F\u611F\u8DEF\u5F84: " + sensitive.join(", ") + " \u2014 \u8FD9\u7C7B\u53D8\u66F4\u8981\u6C42\u4EFB\u52A1\u58F0\u660E\u4E3A high_risk\uFF0C\u4E14\u9A8C\u8BC1\u5FC5\u987B\u662F\u771F\u5B9E\u547D\u4EE4\u56DE\u6267\uFF08exit 0\uFF09"
+  );
+}
 process.exit(0);