@godv61/dsh-task-engine 0.22.7 → 0.23.1

package/.resource-test.mjs

@@ -0,0 +1,133 @@
+import test from 'node:test'
+import fs from 'node:fs'
+import { syncBuiltinESMExports } from 'node:module'
+import assert from 'node:assert/strict'
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, rmSync, symlinkSync, readdirSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve, sep } from 'node:path'
+import { prepareImport, commitImport } from './lib/resource-import.js'
+
+const file = (path, text) => ({path,base64:Buffer.from(text).toString('base64')})
+const skill = '---\nname: sample-skill\ndescription: A test skill\n---\n# Sample\n'
+const baseRequest = () => ({kind:'skill',level:'project',path:'unused',files:[file('sample/SKILL.md',skill),file('sample/assets/data.bin',Buffer.from([0,128,255]))]})
+function fixture(t) {
+  const root=mkdtempSync(join(tmpdir(),'task-engine-import-'))
+  t.after(()=> { const full=resolve(root); assert.ok(full.startsWith(resolve(tmpdir())+sep)); rmSync(full,{recursive:true,force:true}) })
+  return {root,base:join(root,'skills')}
+}
+test('preview has no filesystem side effects and reports exact bytes',t=>{
+ const {base}=fixture(t),r=baseRequest(),p=prepareImport(r,base,()=>false).preview
+ assert.equal(p.name,'sample-skill');assert.equal(p.files,2);assert.equal(p.bytes,Buffer.byteLength(skill)+3);assert.equal(existsSync(base),false)
+})
+test('confirmed install preserves binary assets and refuses duplicates',t=>{
+ const {base}=fixture(t),r=baseRequest(),p=prepareImport(r,base,()=>false).preview
+ commitImport({...r,expectedHash:p.hash},base,()=>false)
+ assert.deepEqual(readFileSync(join(base,'sample-skill/assets/data.bin')),Buffer.from([0,128,255]))
+ assert.throws(()=>commitImport({...r,expectedHash:p.hash},base,()=>false),/同名/)
+})
+test('changed content and changed installation target invalidate preview',t=>{
+ const {root,base}=fixture(t),r=baseRequest(),p=prepareImport(r,base,()=>false).preview
+ assert.throws(()=>commitImport({...r,files:[file('SKILL.md',skill+'changed')],expectedHash:p.hash},base,()=>false),/发生变化/)
+ assert.throws(()=>commitImport({...r,expectedHash:p.hash},join(root,'other'),()=>false),/发生变化/)
+ assert.equal(existsSync(base),false)
+})
+test('path traversal, Windows ADS and reserved names are rejected',t=>{
+ const {base}=fixture(t)
+ for(const path of ['../escape','/escape','C:/escape','x\\escape','NUL.txt','x:stream','x/../escape','x.']) {
+ assert.throws(()=>prepareImport({...baseRequest(),files:[file('SKILL.md',skill),file(path,'bad')]},base,()=>false),/不安全/)
+ }
+})
+test('case-colliding filenames are rejected',t=>{
+ const {base}=fixture(t)
+ assert.throws(()=>prepareImport({...baseRequest(),files:[file('SKILL.md',skill),file('a.txt','a'),file('A.txt','b')]},base,()=>false),/大小写/)
+})
+test('bundled names and ambiguous containers are rejected',t=>{
+ const {base}=fixture(t)
+ assert.throws(()=>prepareImport(baseRequest(),base,()=>true),/内置/)
+ assert.throws(()=>prepareImport({...baseRequest(),files:[file('a/SKILL.md',skill),file('b/SKILL.md',skill)]},base,()=>false),/多个技能/)
+})
+test('single-file rule accepts UTF-8 BOM and CRLF; empty rules are refused',t=>{
+ const {base}=fixture(t),r={kind:'rule',level:'project',path:'unused',files:[file('sample-rule.md','\uFEFF# Rule\r\nDo it.')]}
+ const p=prepareImport(r,base,()=>false).preview
+ assert.equal(p.name,'sample-rule');assert.match(p.content,/# Rule/)
+ commitImport({...r,expectedHash:p.hash},base,()=>false)
+ assert.ok(existsSync(join(base,'sample-rule.md')))
+ assert.throws(()=>prepareImport({...r,files:[file('empty.md','  ')]},base,()=>false),/不能为空/)
+})
+test('file and directory prefix conflicts fail during preview',t=>{
+ const {base}=fixture(t),r={...baseRequest(),files:[file('SKILL.md',skill),file('a','file'),file('a/b','child')]}
+ assert.throws(()=>prepareImport(r,base,()=>false),/路径冲突/)
+ assert.equal(existsSync(base),false)
+})
+test('failed installation removes only its own incomplete directory',t=>{
+ const {base}=fixture(t),r=baseRequest(),p=prepareImport(r,base,()=>false).preview
+ mkdirSync(base);writeFileSync(join(base,'keep.txt'),'existing')
+ const original=fs.writeFileSync
+ try {
+   fs.writeFileSync=(path,...args)=>{if(String(path).endsWith('data.bin')) throw new Error('injected disk failure');return original(path,...args)}
+   syncBuiltinESMExports()
+   assert.throws(()=>commitImport({...r,expectedHash:p.hash},base,()=>false),/injected disk failure/)
+ } finally { fs.writeFileSync=original;syncBuiltinESMExports() }
+ assert.equal(existsSync(p.target),false);assert.deepEqual(readdirSync(base),['keep.txt']);assert.equal(readFileSync(join(base,'keep.txt'),'utf8'),'existing')
+})
+
+test('host directory scanner resolves one container child and excludes caches',t=>{
+ const {root,base}=fixture(t),src=join(root,'source'),nested=join(src,'sample')
+ mkdirSync(join(nested,'node_modules'),{recursive:true});writeFileSync(join(nested,'SKILL.md'),skill);writeFileSync(join(nested,'node_modules','ignore.txt'),'ignore')
+ const p=prepareImport({...baseRequest(),files:[],sourceDir:src},base,()=>false).preview
+ assert.equal(p.files,1)
+})
+test('host scanner rejects symlink or junction source paths',t=>{
+ const {root,base}=fixture(t),src=join(root,'source'),link=join(root,'link')
+ mkdirSync(src);writeFileSync(join(src,'SKILL.md'),skill)
+ symlinkSync(src,link,process.platform==='win32'?'junction':'dir')
+ assert.throws(()=>prepareImport({...baseRequest(),files:[],sourceDir:link},base,()=>false),/符号链接/)
+})
+test('deep directories and oversized files fail before installation',t=>{
+ const {base}=fixture(t)
+ assert.throws(()=>prepareImport({...baseRequest(),files:[file('SKILL.md',skill),file('a/'.repeat(21)+'b','x')]},base,()=>false),/20 层/)
+ assert.throws(()=>prepareImport({...baseRequest(),files:[file('SKILL.md',skill),file('big',Buffer.alloc(20*1024*1024+1))]},base,()=>false),/大小限制|20 MB/)
+ assert.equal(existsSync(base),false)
+})
+test('invalid UTF-8, encoding and absent source directories report errors',t=>{
+ const {root,base}=fixture(t)
+ assert.throws(()=>prepareImport({...baseRequest(),files:[{path:'SKILL.md',base64:'not base64!!'}]},base,()=>false),/编码/)
+ assert.throws(()=>prepareImport({kind:'rule',level:'user',path:'unused',files:[file('rule.md',Buffer.from([255]))]},base,()=>false))
+ assert.throws(()=>prepareImport({...baseRequest(),files:[],sourceDir:join(root,'missing')},base,()=>false))
+})
+
+test('registered host workspace wins over client spelling; unknown paths fail', async () => {
+ const {authorizedWorkspace}=await import('./lib/workspace-access.js')
+ const host={get:()=>({resolveByPath:async path=>path==='known'?{path:'/canonical/project'}:undefined})}
+ assert.equal(await authorizedWorkspace(host,'known',()=>{throw new Error('fallback must not run')}),'/canonical/project')
+ await assert.rejects(()=>authorizedWorkspace(host,'unknown',()=>'/unsafe'),/未在 Harness 注册/)
+ await assert.rejects(()=>authorizedWorkspace(host,'',()=>'/unsafe'),/请选择/)
+})
+test('legacy host retains its explicit workspace policy', async () => {
+ const {authorizedWorkspace}=await import('./lib/workspace-access.js')
+ assert.equal(await authorizedWorkspace({get:()=>undefined},'/project',p=>p),'/project')
+ await assert.rejects(()=>authorizedWorkspace({get:()=>undefined},'/bad',()=>{throw new Error('denied')}),/denied/)
+})
+test('host registry failures are not downgraded to legacy permissions', async () => {
+ const {authorizedWorkspace}=await import('./lib/workspace-access.js')
+ await assert.rejects(()=>authorizedWorkspace({get:()=>({resolveByPath:async()=>{throw new Error('registry unavailable')}})},'/project',()=>'/unsafe'),/registry unavailable/)
+})
+
+test('ledger shows absent storage as empty and propagates access errors',async()=>{
+ const {default:Controller}=await import('./lib/controller.js')
+ const controller=Object.create(Controller.prototype)
+ controller.authorizedPath=async p=>p
+ controller.fs=()=>({resolve:async p=>p,listDir:async()=>{throw Object.assign(new Error('missing'),{code:'ENOENT'})}})
+ assert.deepEqual(await controller.readTasks('/project'),{tasks:[]})
+ controller.fs=()=>({resolve:async p=>p,listDir:async()=>{throw Object.assign(new Error('denied'),{code:'EACCES'})}})
+ await assert.rejects(()=>controller.readTasks('/project'),/denied/)
+})
+test('ledger rejects malformed records instead of pretending there are no tasks',async()=>{
+ const {default:Controller}=await import('./lib/controller.js')
+ const controller=Object.create(Controller.prototype)
+ controller.authorizedPath=async p=>p
+ for(const content of ['{broken','null','{}']) {
+   controller.fs=()=>({resolve:async p=>p,listDir:async()=>[{name:'task-broken.json'}],readText:async()=>content})
+   await assert.rejects(()=>controller.readTasks('/project'),/任务记录/)
+ }
+})

package/.workflow-test.mjs

@@ -0,0 +1,234 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve, sep } from 'node:path'
+import { registerDevTask } from './lib/dev-task.js'
+import { newTask } from './lib/engine.js'
+import { resolveFlow } from './lib/workflows.js'
+import Controller from './lib/controller.js'
+import { registerShippedSkills } from './lib/shipped-skills.js'
+
+function fixture(stage = '开发', extra = {}) {
+  const cwd = resolve('test-project')
+  const config = resolveFlow('standard', { stage_bindings: { 完成: { skills: ['software-testing'] } } }).config
+  const state = newTask({ id: 'LIVE-1', title: 'EAM regression', branch: 'test', work_size: 'standard', risk_level: 'standard', flow: { flow: 'standard', version: 2, config }, root: cwd })
+  Object.assign(state, { stage, execution_version: 1, files: ['app.js'], requirement_confirmed: true, solution_confirmed: true, ...extra })
+  const records = new Map([[join(cwd, '.dsh/task-LIVE-1.json'), JSON.stringify(state)], [join(cwd, 'app.js'), 'source']])
+  const events = [], runs = []
+  const session = { id: 'test-session', header: { cwd }, snapshotEvents: () => events }
+  const policy = { mode: 'workspace-write', workspaceRoot: cwd, sessionId: session.id }
+  const abort = new AbortController()
+  let execute
+  const key = (path, options) => join(options?.cwd ?? cwd, path)
+  const fs = {
+    resolve: async (path, options) => ({ targetKey: key(path, options) }),
+    readText: async target => records.get(target.targetKey),
+    listDir: async () => [...records.keys()].filter(path => /task-.+\.json$/.test(path)).map(path => ({ name: path.split(/[\\/]/).at(-1) })),
+    lstat: async (path, options) => records.has(key(path, options)) ? { version: 'v' } : undefined,
+    writeText: async (target, content) => { records.set(target.targetKey, content) },
+  }
+  const ctx = { fs, tools: { register(tool) { execute = tool.execute; return () => {} } }, get(name) {
+    if (name === 'sandboxPolicy') return { resolve(request) { assert.equal(request.session, session); return policy } }
+    if (name === 'shell') return { resolve(request) { runs.push(request); return request }, async run(request) {
+      const fail = request.command === 'fail'
+      return { exitCode: fail ? 1 : 0, timedOut: false, aborted: false, sandbox: { mode: 'workspace-write', denied: false }, stdout: { text: request.command.startsWith('git -c core.quotepath=false log') ? 'abcdef1234567890\n【LIVE-1】【TASK】done\n\napp.js\n' : 'checks passed' }, stderr: { text: '' } }
+    } }
+    return undefined
+  } }
+  registerDevTask(ctx)
+  const exec = { agent: { session }, signal: abort.signal }
+  function load(name, success = true) {
+    const callId = `call-${events.length}`
+    events.push({ type: 'tool/call', data: { name: 'skill', callId, arguments: JSON.stringify({ name }) } })
+    events.push({ type: 'tool/result', data: { message: { content: [{ type: 'tool-result', toolCallId: callId, isError: !success }] } } })
+  }
+  return { call: args => execute(JSON.parse(JSON.stringify({ task_id: 'LIVE-1', ...args })), exec), load, runs, policy, exec, records, cwd,
+    state: () => JSON.parse(records.get(join(cwd, '.dsh/task-LIVE-1.json'))) }
+}
+
+test('审查通过后更新状态并激活下一项，保留已完成项的审计', async () => {
+  const f = fixture()
+  await f.call({ operation: 'items', items: [{ id: 'A', title: 'first', status: 'doing' }, { id: 'B', title: 'second' }] })
+  await f.call({ operation: 'dispatch', item_id: 'A', description: 'implemented by worker' })
+  await f.call({ operation: 'review_item', item_id: 'A', spec_outcome: 'pass', quality_outcome: 'pass' })
+  await f.call({ operation: 'items', items: [{ id: 'A', title: 'first', status: 'done' }, { id: 'B', title: 'second', status: 'doing' }] })
+  assert.equal(f.state().items[0].review.spec.outcome, 'pass')
+  assert.equal(f.state().items[0].dispatch.description, 'implemented by worker')
+  await f.call({ operation: 'items', items: [{ id: 'A', title: 'changed', status: 'doing' }, { id: 'B', title: 'second', status: 'todo' }] })
+  assert.equal(f.state().items[0].review, undefined)
+  await assert.rejects(f.call({ operation: 'items', items: [{ id: 'A', title: 'x' }, { id: 'A', title: 'y' }] }), /unique/)
+})
+
+test('追加修复项可按 id 保留旧标题，拒绝已完成项改名后静默丢审核', async () => {
+  const f = fixture()
+  await f.call({ operation: 'items', items: [{ id: 'A', title: 'reviewed models', status: 'doing' }] })
+  await f.call({ operation: 'review_item', item_id: 'A', spec_outcome: 'pass', quality_outcome: 'pass' })
+  await f.call({ operation: 'items', items: [{ id: 'A', status: 'done' }, { id: 'B', title: 'fix race', status: 'doing' }] })
+  assert.equal(f.state().items[0].title, 'reviewed models')
+  assert.equal(f.state().items[0].review.quality.outcome, 'pass')
+  await assert.rejects(f.call({ operation: 'items', items: [{ id: 'A', title: 'rewritten summary', status: 'done' }, { id: 'B', status: 'doing' }] }), /omit title|reopen/)
+  assert.equal(f.state().items[0].review.quality.outcome, 'pass')
+  assert.equal(f.state().items.length, 2)
+  await assert.rejects(f.call({ operation: 'items', items: [{ id: 'NEW' }] }), /title/)
+})
+
+test('派发立即反映进行中，重派不复用旧审核且保持单一进行项', async () => {
+  const f = fixture()
+  await f.call({ operation: 'items', items: [{ id: 'A', title: 'models' }, { id: 'B', title: 'api' }] })
+  await f.call({ operation: 'dispatch', item_id: 'A', description: 'implement models' })
+  assert.equal(f.state().items[0].status, 'doing')
+  await assert.rejects(f.call({ operation: 'dispatch', item_id: 'B' }), /current doing item/)
+  await f.call({ operation: 'review_item', item_id: 'A', spec_outcome: 'pass', quality_outcome: 'pass' })
+  await f.call({ operation: 'dispatch', item_id: 'A', description: 'rework models' })
+  assert.equal(f.state().items[0].review, undefined)
+})
+
+test('无任务 id 的 status 发现当前工作区任务并支持分支过滤', async () => {
+  const f = fixture()
+  assert.equal(JSON.parse(await f.call({ operation: 'status', task_id: undefined })).tasks[0].id, 'LIVE-1')
+  assert.equal(JSON.parse(await f.call({ operation: 'status', task_id: undefined, branch: 'other' })).tasks.length, 0)
+})
+
+test('状态明确区分内置节点门禁与附加技能命令回执，避免重复验证', async () => {
+  const f = fixture('代码审核')
+  const status = JSON.parse(await f.call({ operation: 'status' }))
+  assert.deepEqual(status.skill_obligations.find(row => row.stage === '代码审核').command_receipts_required, [])
+  assert.deepEqual(status.skill_obligations.find(row => row.stage === '完成').command_receipts_required, ['software-testing'])
+})
+
+test('status 披露当前阶段记录字段和缺项，字段误用不写入且可按提示恢复', async () => {
+  const f = fixture('需求评审')
+  const before = JSON.stringify(f.state())
+  const status = JSON.parse(await f.call({ operation: 'status' }))
+  assert.deepEqual(status.artifact_requirements, [{ id: 'requirement', name: '需求说明', fields: ['scope', 'acceptance_criteria'], missing_fields: ['scope', 'acceptance_criteria'] }])
+  assert.equal(JSON.stringify(f.state()), before)
+  await assert.rejects(f.call({ operation: 'record', artifact: 'requirement', fields: { scope: 'goal', 待确认取舍: 'question' } }), /status.artifact_requirements/)
+  assert.equal(JSON.stringify(f.state()), before)
+  await f.call({ operation: 'record', artifact: 'requirement', fields: { scope: '目标及待确认取舍', acceptance_criteria: '  ' } })
+  assert.deepEqual(JSON.parse(await f.call({ operation: 'status' })).artifact_requirements[0].missing_fields, ['acceptance_criteria'])
+  await f.call({ operation: 'record', artifact: 'requirement', fields: { acceptance_criteria: '可执行验收' } })
+  assert.deepEqual(JSON.parse(await f.call({ operation: 'status' })).artifact_requirements[0].missing_fields, [])
+})
+
+test('记录字段来自冻结流程，精简流程不硬编码标准字段，无记录阶段返回空列表', async () => {
+  const config = resolveFlow('agile').config
+  const f = fixture('需求', { flow: { flow: 'agile', version: 1, config } })
+  assert.deepEqual(JSON.parse(await f.call({ operation: 'status' })).artifact_requirements, [{ id: 'requirement', name: '需求说明', fields: ['scope'], missing_fields: ['scope'] }])
+  await f.call({ operation: 'record', artifact: 'requirement', fields: { scope: '目标、验收与疑问' } })
+  assert.deepEqual(JSON.parse(await f.call({ operation: 'status' })).artifact_requirements[0].missing_fields, [])
+  assert.deepEqual(JSON.parse(await fixture('开发').call({ operation: 'status' })).artifact_requirements, [])
+  assert.deepEqual(JSON.parse(await fixture('设计').call({ operation: 'status' })).artifact_requirements[0].fields, ['approach', 'risks', 'impact'])
+})
+
+test('可选内置技能回执不会因范围变更升级成额外流转门禁', async () => {
+  const f = fixture('需求评审', { artifacts: { requirement: { scope: 'device picker', acceptance_criteria: 'contract and selection' } } })
+  f.load('requirement-analysis')
+  await f.call({ operation: 'skill_result', skill_name: 'requirement-analysis', command: 'check', evidence: ['optional check'] })
+  await f.call({ operation: 'scope', files: ['app.js', 'new-vo.java'] })
+  await f.call({ operation: 'advance', target_stage: '设计' })
+  assert.equal(f.state().stage, '设计')
+})
+
+test('验证使用会话策略与取消信号，并明确返回失败及沙箱信息', async () => {
+  const f = fixture('交付')
+  const result = JSON.parse(await f.call({ operation: 'verify', command: 'fail' }))
+  assert.equal(result.ok, false)
+  assert.equal(f.runs[0].sandboxPolicy, f.policy)
+  assert.equal(f.runs[0].signal, f.exec.signal)
+  assert.equal(result.verification.receipt.sandbox.mode, 'workspace-write')
+})
+
+test('只声明已测试、或加载失败，均不能冒充执行绑定技能', async () => {
+  const f = fixture('代码审核')
+  f.load('code-review'); f.load('code-commit'); f.load('software-testing', false)
+  await assert.rejects(f.call({ operation: 'skill_result', target_stage: '完成', skill_name: 'software-testing', command: 'check', evidence: ['tested'] }), /load skill/)
+  await assert.rejects(f.call({ operation: 'advance', target_stage: '完成' }), /software-testing/)
+  f.load('software-testing')
+  await assert.rejects(f.call({ operation: 'skill_result', target_stage: '完成', skill_name: 'software-testing', evidence: ['claimed pass'] }), /real validation command/)
+})
+
+test('绑定技能失败阻止完成；成功后仍须提交真实 Git 回执', async () => {
+  const f = fixture('代码审核', { review: { outcome: 'pass' }, artifacts: { review: { conclusion: 'pass', issues: 'none' } }, verification: { passed: true, evidence: ['checks'] } })
+  f.load('code-review'); f.load('code-commit'); f.load('software-testing')
+  await f.call({ operation: 'verify', command: 'check', evidence: ['real checks'] })
+  await f.call({ operation: 'skill_result', target_stage: '完成', skill_name: 'software-testing', command: 'fail', evidence: ['scenario failed'] })
+  await assert.rejects(f.call({ operation: 'advance', target_stage: '完成' }), /skill_result/)
+  await f.call({ operation: 'skill_result', target_stage: '完成', skill_name: 'software-testing', command: 'check', evidence: ['scenario passed'] })
+  await assert.rejects(f.call({ operation: 'advance', target_stage: '完成' }), /commit required/)
+  await f.call({ operation: 'commit', files: ['app.js'], message: '【LIVE-1】【TASK】done' })
+  await assert.rejects(f.call({ operation: 'commit', files: ['app.js'], message: '【LIVE-1】【TASK】done', hash: 'bbbbbbb' }), /does not match/)
+  await f.call({ operation: 'commit', files: ['app.js'], message: '【LIVE-1】【TASK】done', hash: 'abcdef1' })
+  await f.call({ operation: 'advance', target_stage: '完成' })
+  assert.equal(f.state().stage, '完成')
+  assert.equal(f.state().skill_results.完成['software-testing'].load_call_id.startsWith('call-'), true)
+})
+
+test('验证后修改代码会使旧回执失效，必须重新验证', async () => {
+  const f = fixture('交付')
+  f.load('code-verify')
+  await f.call({ operation: 'verify', command: 'check' })
+  f.records.set(join(f.cwd, 'app.js'), 'modified source')
+  await assert.rejects(f.call({ operation: 'advance', target_stage: '代码审核' }), /stale/)
+  await f.call({ operation: 'verify', command: 'check' })
+  await f.call({ operation: 'advance', target_stage: '代码审核' })
+  assert.equal(f.state().stage, '代码审核')
+})
+
+test('status 提交提示与真实门禁一致，分别披露过期验证和附加技能回执且不改台账', async () => {
+  const f = fixture('代码审核', { review: { outcome: 'pass' }, artifacts: { review: { conclusion: 'pass', issues: 'none' } } })
+  await f.call({ operation: 'verify', command: 'check' })
+  assert.equal(JSON.parse(await f.call({ operation: 'status' })).commit.allowed, false)
+  f.load('code-review'); f.load('code-commit'); f.load('software-testing')
+  await f.call({ operation: 'skill_result', target_stage: '完成', skill_name: 'software-testing', command: 'check', evidence: ['tested'] })
+  assert.equal(JSON.parse(await f.call({ operation: 'status' })).commit.allowed, true)
+  f.records.set(join(f.cwd, 'app.js'), 'changed after testing')
+  const before = JSON.stringify(f.state())
+  const stale = JSON.parse(await f.call({ operation: 'status' }))
+  assert.equal(stale.commit.allowed, false)
+  assert.match(stale.commit.reason, /stale/)
+  assert.equal(stale.evidence_blockers.length, 2)
+  assert.equal(JSON.stringify(f.state()), before)
+  await assert.rejects(f.call({ operation: 'commit', files: ['app.js'], message: '【LIVE-1】【TASK】done' }), /stale/)
+  await f.call({ operation: 'verify', command: 'check' })
+  const partial = JSON.parse(await f.call({ operation: 'status' }))
+  assert.equal(partial.commit.allowed, false)
+  assert.equal(partial.evidence_blockers.length, 1)
+  assert.match(partial.evidence_blockers[0], /software-testing/)
+  await f.call({ operation: 'skill_result', target_stage: '完成', skill_name: 'software-testing', command: 'check', evidence: ['retested'] })
+  const current = JSON.parse(await f.call({ operation: 'status' }))
+  assert.equal(current.commit.allowed, true)
+  assert.deepEqual(current.evidence_blockers, [])
+})
+
+test('同名技能与规则在项目和个人目录各自保留管理入口', async t => {
+  const root = mkdtempSync(join(tmpdir(), 'engine-catalog-'))
+  const original = process.env.DSH_HOME
+  t.after(() => { if (original === undefined) delete process.env.DSH_HOME; else process.env.DSH_HOME = original; assert.ok(resolve(root).startsWith(resolve(tmpdir()) + sep)); rmSync(root, { recursive: true, force: true }) })
+  process.env.DSH_HOME = join(root, 'user')
+  const project = join(root, 'project')
+  for (const base of [join(project, '.dsh'), process.env.DSH_HOME]) {
+    mkdirSync(join(base, 'skills/software-testing'), { recursive: true })
+    mkdirSync(join(base, 'rules'), { recursive: true })
+    writeFileSync(join(base, 'skills/software-testing/SKILL.md'), '\uFEFF---\r\nname: software-testing\r\ndescription: tests\r\n---\r\nRun tests.\r\n')
+    writeFileSync(join(base, 'rules/test-rule.md'), 'Test rule\n')
+  }
+  const receiver = { authorizedPath: async path => path }
+  const skills = await Controller.prototype.listSkills.call(receiver, project)
+  const rules = await Controller.prototype.listRules.call(receiver, project)
+  assert.deepEqual(skills.skills.filter(x => x.name === 'software-testing').map(x => x.source), ['project', 'user'])
+  assert.deepEqual(rules.rules.filter(x => x.name === 'test-rule').map(x => x.source), ['project', 'user'])
+  const read = await Controller.prototype.readSkill.call(receiver, { path: project, level: 'project', name: 'software-testing' })
+  assert.equal(read.ok, true)
+  assert.match(read.content, /Run tests/)
+})
+
+test('安装包的七个内置技能实际注册且可在资源目录发现', async () => {
+  const registered = []
+  registerShippedSkills({ get: name => name === 'skills' ? { register: skill => { registered.push(skill); return () => {} } } : undefined })
+  const expected = ['code-commit', 'code-implement', 'code-review', 'code-verify', 'eng-delivery', 'requirement-analysis', 'solution-design']
+  assert.deepEqual(registered.map(skill => skill.name).sort(), expected)
+  assert.ok(registered.every(skill => skill.content.trim().length > 0))
+  const catalog = await Controller.prototype.listSkills.call({ authorizedPath: async path => path }, '')
+  assert.deepEqual(catalog.skills.filter(skill => skill.source === 'bundled').map(skill => skill.name).sort(), expected)
+})

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 godv61
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.