@godv61/dsh-task-engine 0.29.2 → 0.29.8

package/.adaptive-test.mjs

@@ -1,189 +1,342 @@
-import test from 'node:test'
-import assert from 'node:assert/strict'
-import { join, resolve } from 'node:path'
-import { mkdtempSync, rmSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { adaptiveWorkflow, COMPLEXITY_OPTIONS } from './lib/adaptive.js'
-import { validateWorkflow } from './lib/engine.js'
-import { registerDevTask } from './lib/dev-task.js'
-import { inspectSonar } from './lib/sonar.js'
-import Controller from './lib/controller.js'
-
-const home = mkdtempSync(join(tmpdir(), 'dsh-adaptive-'))
-process.env.DSH_HOME = home
-process.on('exit', () => rmSync(home, { recursive: true, force: true }))
-
-function fixture(extra = {}) {
-  const cwd = resolve('adaptive-project')
-  const files = new Map([[join(cwd, 'package.json'), '{"name":"adaptive-project","dependencies":{"vue":"^2.7.0"}}'],
-    [join(cwd, '.git/HEAD'), 'ref: refs/heads/feature'] , ...Object.entries(extra).map(([p, content]) => [join(cwd, p), content])])
-  const events = []
-  const session = { id: 'adaptive', header: { cwd }, snapshotEvents: () => events }
-  const key = (path, options) => join(options?.cwd ?? cwd, path)
-  let execute
-  const fs = {
-    resolve: async (path, options) => ({ path: key(path, options) }),
-    readText: async target => files.get(target.path),
-    lstat: async (path, options) => files.has(key(path, options)) ? { version: 'v1' } : undefined,
-    writeText: async (target, content, intent) => {
-      if (intent?.kind === 'createIfAbsent' && files.has(target.path)) throw new Error('already exists')
-      files.set(target.path, content)
-    },
-    listDir: async target => [...new Set([...files.keys()].filter(path => path.startsWith(target.path + '\\'))
-      .map(path => path.slice(target.path.length + 1).split('\\')[0]))].map(name => ({ name })),
-  }
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { join, resolve } from 'node:path'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { adaptiveWorkflow, COMPLEXITY_OPTIONS } from './lib/adaptive.js'
+import { validateWorkflow } from './lib/engine.js'
+import { plannedItemIds, registerDevTask } from './lib/dev-task.js'
+import { assertLocalSonarReady, inspectSonar, validLocalScanCommand } from './lib/sonar.js'
+import Controller from './lib/controller.js'
+
+const home = mkdtempSync(join(tmpdir(), 'dsh-adaptive-'))
+process.env.DSH_HOME = home
+process.on('exit', () => rmSync(home, { recursive: true, force: true }))
+
+function fixture(extra = {}, services = {}) {
+  const cwd = resolve('adaptive-project')
+  const files = new Map([[join(cwd, 'package.json'), '{"name":"adaptive-project","dependencies":{"vue":"^2.7.0"}}'],
+    [join(cwd, '.git/HEAD'), 'ref: refs/heads/feature'] , ...Object.entries(extra).map(([p, content]) => [join(cwd, p), content])])
+  const events = []
+  const session = { id: 'adaptive', header: { cwd }, snapshotEvents: () => events }
+  const key = (path, options) => join(options?.cwd ?? cwd, path)
+  let execute
+  const fs = {
+    resolve: async (path, options) => ({ path: key(path, options) }),
+    readText: async target => files.get(target.path),
+    lstat: async (path, options) => files.has(key(path, options)) ? { version: 'v1' } : undefined,
+    writeText: async (target, content, intent) => {
+      if (intent?.kind === 'createIfAbsent' && files.has(target.path)) throw new Error('already exists')
+      files.set(target.path, content)
+    },
+    listDir: async target => [...new Set([...files.keys()].filter(path => path.startsWith(target.path + '\\'))
+      .map(path => path.slice(target.path.length + 1).split('\\')[0]))].map(name => ({ name })),
+  }
   const ctx = { fs, tools: { register(tool) { execute = tool.execute; return () => {} } }, get(name) {
+    if (name in services) return services[name]
     if (name === 'sandboxPolicy') return { resolve: () => ({ mode: 'workspace-write', workspaceRoot: cwd, sessionId: session.id }) }
-    return undefined
-  } }
-  registerDevTask(ctx)
-  const exec = { agent: { session }, signal: new AbortController().signal }
-  return { cwd, files, fs, events, call: args => execute(args, exec), state: id => JSON.parse(files.get(join(cwd, `.dsh/task-${id}.json`))) }
-}
-
+    return undefined
+  } }
+  registerDevTask(ctx)
+  const exec = { agent: { session }, signal: new AbortController().signal }
+  return { cwd, files, fs, events, call: args => execute(args, exec), state: id => JSON.parse(files.get(join(cwd, `.dsh/task-${id}.json`))) }
+}
+
 test('each task grade has a valid and increasing meta-skill sequence', () => {
-  assert.deepEqual(COMPLEXITY_OPTIONS.map(option => option.id), ['low', 'medium', 'high', 'ultra'])
-  const configs = COMPLEXITY_OPTIONS.map(option => adaptiveWorkflow(option.id))
-  for (const config of configs) assert.deepEqual(validateWorkflow(config), [])
-  assert.deepEqual(configs.map(config => config.stages.length), [4, 5, 6, 7])
-  assert.ok(configs[2].stages.includes('任务编排'))
-  assert.ok(configs[3].stages.includes('架构设计'))
-  assert.ok(configs.every(config => config.transitions.some(edge => edge.requires?.includes('verified'))))
+  assert.deepEqual(COMPLEXITY_OPTIONS.map(option => option.id), ['low', 'medium', 'high', 'ultra'])
+  const configs = COMPLEXITY_OPTIONS.map(option => adaptiveWorkflow(option.id))
+  for (const config of configs) assert.deepEqual(validateWorkflow(config), [])
+  assert.deepEqual(configs.map(config => config.stages.length), [4, 5, 6, 7])
+  assert.ok(configs[2].stages.includes('任务编排'))
+  assert.ok(configs[3].stages.includes('架构设计'))
+  assert.ok(configs.every(config => config.transitions.some(edge => edge.requires?.includes('verified'))))
   assert.ok(configs.every(config => config.commit.checkpoints.includes('测试')))
-})
-
-test('adaptive task freezes a project override and its own Rules, not the bundled same-name Skill', async () => {
-  const f = fixture({
-    '.dsh/skills/requirements-analysis/SKILL.md': '# Project requirement method',
-    '.dsh/skills/requirements-analysis/profile.json': JSON.stringify({ rules: [{ source: 'project', name: 'team-scope' }], evidence: 'artifact' }),
-    '.dsh/rules/team-scope.md': '# Team scope rule',
-    '.dsh/meta.json': JSON.stringify({ meta_bindings: { 'code-development': ['adaptive-project-project-map'] } }),
-    '.dsh/skills/adaptive-project-project-map/SKILL.md': '# Project map',
-    '.dsh/skills/adaptive-project-project-map/profile.json': JSON.stringify({ rules: [], evidence: 'none' }),
-  })
-  const preview = JSON.parse(await f.call({ operation: 'assess', complexity: 'high' }))
-  assert.equal(preview.meta_skills['需求分析'][0].effective_source, 'project')
-  assert.ok(preview.meta_skills['代码开发'].some(skill => skill.logical_name === 'adaptive-project-project-map'))
-  await f.call({ operation: 'create', task_id: 'A-1', title: 'cross-module change', branch: 'feature',
-    complexity: 'high', complexity_reason: 'Several implementation steps depend on earlier interfaces', files: ['app.js'] })
-  const state = f.state('A-1')
-  assert.equal(state.flow.flow, 'adaptive-high')
-  assert.equal(state.flow.config.stage_bindings['需求分析'].skills[0].skill.source, 'project')
-  assert.ok(state.flow.resources.some(entry => entry.ref.name === 'team-scope' && entry.ref.source === 'project'))
-  assert.match(await f.call({ operation: 'load_skill', task_id: 'A-1', skill_name: 'project:requirements-analysis' }), /Project requirement method/)
-  await assert.rejects(f.call({ operation: 'load_skill', task_id: 'A-1', skill_name: 'bundled:requirements-analysis' }), /exact source:name/)
-})
-
+})
+
+test('adaptive task freezes a project override and its own Rules, not the bundled same-name Skill', async () => {
+  const f = fixture({
+    '.dsh/skills/requirements-analysis/SKILL.md': '# Project requirement method',
+    '.dsh/skills/requirements-analysis/profile.json': JSON.stringify({ rules: [{ source: 'project', name: 'team-scope' }], evidence: 'artifact' }),
+    '.dsh/rules/team-scope.md': '# Team scope rule',
+    '.dsh/meta.json': JSON.stringify({ meta_bindings: { 'code-development': ['adaptive-project-project-map'] } }),
+    '.dsh/skills/adaptive-project-project-map/SKILL.md': '# Project map',
+    '.dsh/skills/adaptive-project-project-map/profile.json': JSON.stringify({ rules: [], evidence: 'none' }),
+  })
+  const preview = JSON.parse(await f.call({ operation: 'assess', complexity: 'high' }))
+  assert.equal(preview.meta_skills['需求分析'][0].effective_source, 'project')
+  assert.ok(preview.meta_skills['代码开发'].some(skill => skill.logical_name === 'adaptive-project-project-map'))
+  await f.call({ operation: 'create', task_id: 'A-1', title: 'cross-module change', branch: 'feature',
+    complexity: 'high', complexity_reason: 'Several implementation steps depend on earlier interfaces', files: ['app.js'] })
+  const state = f.state('A-1')
+  assert.equal(state.flow.flow, 'adaptive-high')
+  assert.equal(state.flow.config.stage_bindings['需求分析'].skills[0].skill.source, 'project')
+  assert.ok(state.flow.resources.some(entry => entry.ref.name === 'team-scope' && entry.ref.source === 'project'))
+  assert.match(await f.call({ operation: 'load_skill', task_id: 'A-1', skill_name: 'project:requirements-analysis' }), /Project requirement method/)
+  await assert.rejects(f.call({ operation: 'load_skill', task_id: 'A-1', skill_name: 'bundled:requirements-analysis' }), /exact source:name/)
+})
+
 test('init_project proposes project-specific Skills and binds reviewed resources', async () => {
-  const f = fixture()
+  const f = fixture()
   const inventory = JSON.parse(await f.call({ operation: 'init_project', phase: 'inspect' }))
-  assert.ok(inventory.suggestions.some(entry => entry.name === 'adaptive-project-project-map'))
-  assert.ok(inventory.manifests.some(entry => entry.facts.includes('vue=^2.7.0')))
-  const resources = [
-    { kind: 'rule', name: 'component-boundary', content: 'Keep component boundary calls behind the existing service interface.' },
-    { kind: 'skill', name: 'adaptive-project-project-map', description: 'Project structure and entry points',
-      content: 'The root package.json declares Vue 2.7; inspect src for the actual component layout.',
-      meta_skills: ['requirements-analysis', 'code-development'], rules: ['component-boundary'] },
-  ]
+  const projectMap = inventory.suggestions.find(entry => entry.name === 'adaptive-project-project-map')
+  assert.ok(projectMap)
+  assert.match(projectMap.why, /entire repository/)
+  assert.match(projectMap.why, /current feature request/)
+  assert.match(inventory.caution, /repository-wide/)
+  assert.ok(inventory.manifests.some(entry => entry.facts.includes('vue=^2.7.0')))
+  const resources = [
+    { kind: 'rule', name: 'component-boundary', content: 'Keep component boundary calls behind the existing service interface.' },
+    { kind: 'skill', name: 'adaptive-project-project-map', description: 'Project structure and entry points',
+      content: 'The root package.json declares Vue 2.7; inspect src for the actual component layout.',
+      meta_skills: ['requirements-analysis', 'code-development'], rules: ['component-boundary'] },
+  ]
   const proposed = JSON.parse(await f.call({ operation: 'init_project', phase: 'propose', resources }))
-  assert.equal(f.files.has(join(f.cwd, '.dsh/meta.json')), false)
-  await f.call({ operation: 'init_project', phase: 'apply', resources, expected_hash: proposed.expected_hash,
-    existing_hash: proposed.existing_hash })
-  const meta = JSON.parse(f.files.get(join(f.cwd, '.dsh/meta.json')))
-  assert.deepEqual(meta.meta_bindings['code-development'], ['adaptive-project-project-map'])
+  assert.match(proposed.instruction, /whole repository/)
+  assert.match(proposed.instruction, /current-feature details/)
+  assert.equal(f.files.has(join(f.cwd, '.dsh/meta.json')), false)
+  await f.call({ operation: 'init_project', phase: 'apply', resources, expected_hash: proposed.expected_hash,
+    existing_hash: proposed.existing_hash })
+  const meta = JSON.parse(f.files.get(join(f.cwd, '.dsh/meta.json')))
+  assert.deepEqual(meta.meta_bindings['code-development'], ['adaptive-project-project-map'])
   assert.ok(f.files.has(join(f.cwd, '.dsh/skills/adaptive-project-project-map/profile.json')))
 })
 
+test('task-plan item headings preserve the full implementation sequence', async () => {
+  assert.deepEqual(plannedItemIds('## Steps\n- I1 data model\n- I2 service\n### I3 UI\n- I2 service'), ['I1', 'I2', 'I3'])
+  const f = fixture()
+  await f.call({ operation: 'create', task_id: 'PLAN-1', title: 'Cross-module change', branch: 'feature',
+    complexity: 'high', complexity_reason: 'Backend then frontend dependency' })
+  const state = f.state('PLAN-1')
+  state.stage = '任务编排'
+  state.artifacts['task-plan'] = { steps: '- I1 model\n- I2 service', dependencies: 'I2 after I1', handoffs: 'Model to service' }
+  state.items = [{ id: 'I2', title: 'service', status: 'todo' }]
+  f.files.set(join(f.cwd, '.dsh/task-PLAN-1.json'), JSON.stringify(state))
+  const status = JSON.parse(await f.call({ operation: 'status', task_id: 'PLAN-1' }))
+  assert.match(status.task_plan_item_blockers[0], /I1/)
+  await assert.rejects(f.call({ operation: 'advance', task_id: 'PLAN-1', target_stage: '代码开发' }), /I1/)
+})
+
+test('init_project rejects a feature-only project map that omits discovered modules', async () => {
+  const f = fixture({
+    'backend/pom.xml': '<project><properties><java.version>8</java.version></properties></project>',
+    'frontend/package.json': '{"dependencies":{"vue":"^2.7.0"}}',
+  })
+  const draft = [{ kind: 'skill', name: 'adaptive-project-project-map',
+    description: 'Reusable repository map', meta_skills: ['requirements-analysis', 'code-development'],
+    content: '# Feature implementation\nThe root package.json and backend contain the feature API.' }]
+  await assert.rejects(f.call({ operation: 'init_project', phase: 'propose', resources: draft }), /frontend/)
+  draft[0].content = '# Repository map\nRoot package.json, backend/pom.xml and frontend/package.json define separate modules.'
+  const proposed = JSON.parse(await f.call({ operation: 'init_project', phase: 'propose', resources: draft }))
+  assert.deepEqual(proposed.project_map_coverage, ['backend', 'frontend', 'package.json'])
+  await f.call({ operation: 'init_project', phase: 'apply', resources: draft,
+    expected_hash: proposed.expected_hash, existing_hash: proposed.existing_hash })
+  assert.ok(f.files.has(join(f.cwd, '.dsh/skills/adaptive-project-project-map/SKILL.md')))
+})
+
 test('workbench adaptive settings persist meta bindings with a version check', async () => {
+  const f = fixture()
+  const receiver = { authorizedPath: async path => path, fs: () => f.fs,
+    listSkills: async () => ({ skills: [{ name: 'adaptive-project-project-map', source: 'project' }] }),
+    readAdaptive: Controller.prototype.readAdaptive }
+  const before = await Controller.prototype.readAdaptive.call(receiver, f.cwd)
+  assert.equal(before.source, 'default')
+  const config = { meta_bindings: { 'code-development': ['adaptive-project-project-map'] }, sonar: { enabled: false } }
+  const after = await Controller.prototype.writeAdaptive.call(receiver,
+    { path: f.cwd, config, expected_hash: before.hash })
+  assert.equal(after.ok, true)
+  assert.deepEqual(after.config.meta_bindings['code-development'], ['adaptive-project-project-map'])
+  await assert.rejects(Controller.prototype.writeAdaptive.call(receiver,
+    { path: f.cwd, config, expected_hash: before.hash }), /已被其他会话修改/)
+})
+
+test('Sonar audit reads the exact CI analysis gate and filters new-code medium/high findings', async () => {
+  const calls = []
+  const fetcher = async (url, options) => {
+    calls.push({ url: String(url), authorization: options.headers.Authorization })
+    const body = String(url).includes('/ce/task')
+      ? { task: { status: 'SUCCESS', analysisId: 'AN-1', componentKey: 'project' } }
+      : String(url).includes('/qualitygates/project_status')
+        ? { projectStatus: { status: 'ERROR' } }
+        : { paging: { total: 2 }, issues: [
+          { key: 'ISSUE-1', rule: 'java:S111', message: 'problem', severity: 'MAJOR', component: 'project:src/A.java', line: 3 },
+          { key: 'ISSUE-2', rule: 'java:S222', message: 'minor', severity: 'MINOR', component: 'project:src/B.java' },
+        ] }
+    return { ok: true, json: async () => body }
+  }
+  const policy = { enabled: true, host_url: 'https://sonar.example', project_key: 'project', mode: 'branch', token_env: 'SONAR_TOKEN' }
+  const audit = await inspectSonar(policy, 'secret-token', 'CE-TASK-123', 'feature', 'scope-hash', fetcher)
+  assert.equal(audit.analysis_id, 'AN-1')
+  assert.equal(audit.gate, 'ERROR')
+  assert.deepEqual(audit.blocking.map(issue => issue.key), ['ISSUE-1'])
+  assert.ok(calls[2].url.includes('inNewCodePeriod=true'))
+  assert.ok(calls.every(call => call.authorization === 'Bearer secret-token'))
+  assert.equal(JSON.stringify(audit).includes('secret-token'), false)
+})
+
+test('IDE-style local Sonar settings save and move only that task commit after review', async () => {
+  const sonar = { enabled: true, host_url: 'http://sonar.example', project_key: 'project',
+    mode: 'branch', source: 'ide-local', reference_branch: 'main', token_env: 'SONAR_TOKEN' }
   const f = fixture()
   const receiver = { authorizedPath: async path => path, fs: () => f.fs,
-    listSkills: async () => ({ skills: [{ name: 'adaptive-project-project-map', source: 'project' }] }),
-    readAdaptive: Controller.prototype.readAdaptive }
+    listSkills: async () => ({ skills: [] }), readAdaptive: Controller.prototype.readAdaptive }
   const before = await Controller.prototype.readAdaptive.call(receiver, f.cwd)
-  assert.equal(before.source, 'default')
-  const config = { meta_bindings: { 'code-development': ['adaptive-project-project-map'] }, sonar: { enabled: false } }
-  const after = await Controller.prototype.writeAdaptive.call(receiver,
-    { path: f.cwd, config, expected_hash: before.hash })
-  assert.equal(after.ok, true)
-  assert.deepEqual(after.config.meta_bindings['code-development'], ['adaptive-project-project-map'])
-  await assert.rejects(Controller.prototype.writeAdaptive.call(receiver,
-    { path: f.cwd, config, expected_hash: before.hash }), /已被其他会话修改/)
+  const saved = await Controller.prototype.writeAdaptive.call(receiver,
+    { path: f.cwd, config: { sonar }, expected_hash: before.hash })
+  assert.equal(saved.ok, true)
+  await f.call({ operation: 'create', task_id: 'L-1', title: 'local review', branch: 'feature',
+    complexity: 'low', complexity_reason: 'Small isolated change', files: ['app.java'] })
+  const state = f.state('L-1')
+  assert.equal(state.sonar_policy.source, 'ide-local')
+  assert.deepEqual(state.flow.config.commit.checkpoints, ['代码审核'])
 })
 
-test('Sonar audit reads the exact CI analysis gate and filters new-code medium/high findings', async () => {
+test('local Sonar audit ignores failing old-code gate conditions', async () => {
+  const policy = { enabled: true, host_url: 'https://sonar.example', project_key: 'project', mode: 'branch',
+    token_env: 'SONAR_TOKEN', source: 'local', reference_branch: 'main' }
+  const fetcher = async url => ({ ok: true, json: async () => String(url).includes('/ce/task')
+    ? { task: { status: 'SUCCESS', analysisId: 'AN-local', componentKey: 'project', branch: 'feature' } }
+    : String(url).includes('/qualitygates/project_status')
+      ? { projectStatus: { status: 'ERROR', conditions: [
+        { metricKey: 'bugs', status: 'ERROR' }, { metricKey: 'new_coverage', status: 'OK' }] } }
+      : { paging: { total: 0 }, issues: [] } })
+  const audit = await inspectSonar(policy, 'token', 'CE-local-123', 'feature', 'scope', fetcher, true)
+  assert.equal(audit.gate, 'OK')
+  assert.equal(audit.server_gate, 'ERROR')
+  assert.deepEqual(audit.blocking, [])
+  const newFailure = await inspectSonar(policy, 'token', 'CE-local-123', 'feature', 'scope',
+    async url => String(url).includes('/qualitygates/project_status')
+      ? { ok: true, json: async () => ({ projectStatus: { status: 'ERROR', conditions: [
+        { metricKey: 'new_coverage', status: 'ERROR' }] } }) }
+      : fetcher(url), true)
+  assert.equal(newFailure.gate, 'ERROR')
+})
+
+test('local scanner configuration rejects shell operators before receiving the Token', () => {
+  assert.equal(validLocalScanCommand('mvn org.sonarsource.scanner.maven:sonar-maven-plugin:5.5.0.6356:sonar -DskipTests'), true)
+  assert.equal(validLocalScanCommand('mvn sonar:sonar; curl http://example'), false)
+  assert.equal(validLocalScanCommand('mvn sonar:sonar -Dsonar.token=secret'), false)
+  assert.equal(validLocalScanCommand('curl http://example'), false)
+})
+
+test('Community Sonar refuses a local branch scan before uploading any analysis', async () => {
+  const policy = { enabled: true, host_url: 'https://sonar.example', project_key: 'project', mode: 'branch',
+    token_env: 'SONAR_TOKEN', source: 'local', reference_branch: 'main' }
   const calls = []
-  const fetcher = async (url, options) => {
-    calls.push({ url: String(url), authorization: options.headers.Authorization })
-    const body = String(url).includes('/ce/task')
-      ? { task: { status: 'SUCCESS', analysisId: 'AN-1', componentKey: 'project' } }
-      : String(url).includes('/qualitygates/project_status')
-        ? { projectStatus: { status: 'ERROR' } }
-        : { paging: { total: 2 }, issues: [
-          { key: 'ISSUE-1', rule: 'java:S111', message: 'problem', severity: 'MAJOR', component: 'project:src/A.java', line: 3 },
-          { key: 'ISSUE-2', rule: 'java:S222', message: 'minor', severity: 'MINOR', component: 'project:src/B.java' },
-        ] }
-    return { ok: true, json: async () => body }
-  }
-  const policy = { enabled: true, host_url: 'https://sonar.example', project_key: 'project', mode: 'branch', token_env: 'SONAR_TOKEN' }
-  const audit = await inspectSonar(policy, 'secret-token', 'CE-TASK-123', 'feature', 'scope-hash', fetcher)
-  assert.equal(audit.analysis_id, 'AN-1')
-  assert.equal(audit.gate, 'ERROR')
-  assert.deepEqual(audit.blocking.map(issue => issue.key), ['ISSUE-1'])
-  assert.ok(calls[2].url.includes('inNewCodePeriod=true'))
-  assert.ok(calls.every(call => call.authorization === 'Bearer secret-token'))
-  assert.equal(JSON.stringify(audit).includes('secret-token'), false)
+  await assert.rejects(assertLocalSonarReady(policy, 'token', async url => {
+    calls.push(String(url))
+    return { ok: true, json: async () => ({ edition: 'community' }) }
+  }), /Community Build supports only the main analysis branch/u)
+  assert.equal(calls.length, 1)
+  assert.match(calls[0], /navigation\/global/u)
 })
 
-test('review-only Sonar gate blocks pass until the task records a passing CI analysis', async () => {
+test('sonar_check runs a local scan on the recorded commit without pushing or exposing Token', async () => {
+  const calls = []
+  const shell = { resolve: request => request, run: async spec => {
+    calls.push(spec)
+    if (spec.command === 'git rev-parse HEAD') return { exitCode: 0, stdout: { text: 'abcdef1234567890\n' } }
+    if (spec.command === 'git branch --show-current') return { exitCode: 0, stdout: { text: 'feature\n' } }
+    if (spec.command === 'git status --porcelain --untracked-files=all') return { exitCode: 0, stdout: { text: '' } }
+    const metadata = /-Dsonar\.scanner\.metadataFilePath='([^']+)'/u.exec(spec.command)?.[1]
+    assert.ok(metadata)
+    writeFileSync(metadata, 'ceTaskId=CE-local-456\n')
+    return { exitCode: 0 }
+  } }
   const f = fixture({ '.dsh/meta.json': JSON.stringify({ sonar: { enabled: true, host_url: 'https://sonar.example',
-    project_key: 'project', mode: 'branch', token_env: 'SONAR_TOKEN' } }) })
-  await f.call({ operation: 'create', task_id: 'S-1', title: 'change', branch: 'feature', complexity: 'low',
+    project_key: 'project', mode: 'branch', source: 'local', reference_branch: 'main' } }) }, { shell })
+  await f.call({ operation: 'create', task_id: 'LOCAL-1', title: 'change', branch: 'feature', complexity: 'low',
     complexity_reason: 'One local change', files: ['app.js'], items: [{ id: 'one', title: 'change', status: 'done' }] })
-  const state = f.state('S-1')
+  const state = f.state('LOCAL-1')
   state.stage = '代码审核'
   state.verification = { passed: true, evidence: ['verified'] }
   state.commits = [{ label: 'TASK', hash: 'abcdef1234567890' }]
-  f.files.set(join(f.cwd, '.dsh/task-S-1.json'), JSON.stringify(state))
-  await assert.rejects(f.call({ operation: 'review', task_id: 'S-1', outcome: 'pass' }), /SonarQube audit is enabled/)
+  f.files.set(join(f.cwd, '.dsh/task-LOCAL-1.json'), JSON.stringify(state))
   const oldFetch = globalThis.fetch
   const oldToken = process.env.SONAR_TOKEN
-  process.env.SONAR_TOKEN = 'secret-token'
-  globalThis.fetch = async url => ({ ok: true, json: async () => String(url).includes('/ce/task')
-    ? { task: { status: 'SUCCESS', analysisId: 'AN-2', componentKey: 'project' } }
-    : String(url).includes('/qualitygates/project_status') ? { projectStatus: { status: 'OK' } }
+  process.env.SONAR_TOKEN = 'private-token'
+  globalThis.fetch = async url => ({ ok: true, json: async () => String(url).includes('/navigation/global')
+    ? { edition: 'developer' }
+    : String(url).includes('/project_branches/list') ? { branches: [{ name: 'main' }] }
+      : String(url).includes('/ce/task')
+    ? { task: { status: 'SUCCESS', analysisId: 'AN-local', componentKey: 'project', branch: 'feature' } }
+    : String(url).includes('/qualitygates/project_status')
+      ? { projectStatus: { status: 'ERROR', conditions: [{ metricKey: 'bugs', status: 'ERROR' }] } }
       : { paging: { total: 0 }, issues: [] } })
   try {
-    await f.call({ operation: 'sonar_check', task_id: 'S-1', ce_task_id: 'CE-123456' })
-    await f.call({ operation: 'review', task_id: 'S-1', outcome: 'pass' })
-    assert.equal(f.state('S-1').review.outcome, 'pass')
+    const result = JSON.parse(await f.call({ operation: 'sonar_check', task_id: 'LOCAL-1' }))
+    assert.equal(result.gate, 'OK')
+    assert.equal(result.server_gate, 'ERROR')
+    assert.equal(calls.length, 4)
+    assert.equal(calls[3].env.SONAR_TOKEN, 'private-token')
+    assert.equal(calls[3].command.includes('private-token'), false)
+    assert.match(calls[3].command, /sonar\.newCode\.referenceBranch='main'/u)
+    assert.equal(JSON.stringify(f.state('LOCAL-1')).includes('private-token'), false)
+    assert.equal(calls.some(call => /git push/u.test(call.command)), false)
   } finally {
     globalThis.fetch = oldFetch
     if (oldToken === undefined) delete process.env.SONAR_TOKEN
     else process.env.SONAR_TOKEN = oldToken
   }
 })
-
-test('a failed Sonar finding becomes a reviewed project Rule attached to the coding Skill', async () => {
-  const f = fixture()
-  await f.call({ operation: 'create', task_id: 'L-1', title: 'change', branch: 'feature', complexity: 'low',
-    complexity_reason: 'One local change', files: ['app.js'] })
-  const state = f.state('L-1')
-  const finding = { key: 'ISSUE-9', rule: 'java:S999', message: 'Handle null', severity: 'MAJOR', file: 'A.java' }
-  state.stage = '代码审核'
-  state.sonar_audit = { ce_task_id: 'CE-123456', analysis_id: 'AN-9', gate: 'ERROR', checked_at: 'now',
-    scope_hash: 'old', findings: [finding], blocking: [finding], target: 'feature' }
-  f.files.set(join(f.cwd, '.dsh/task-L-1.json'), JSON.stringify(state))
+
+test('review-only Sonar gate blocks pass until the task records CI analysis of new code', async () => {
+  const f = fixture({ '.dsh/meta.json': JSON.stringify({ sonar: { enabled: true, host_url: 'https://sonar.example',
+    project_key: 'project', mode: 'branch', token_env: 'SONAR_TOKEN' } }) })
+  await f.call({ operation: 'create', task_id: 'S-1', title: 'change', branch: 'feature', complexity: 'low',
+    complexity_reason: 'One local change', files: ['app.js'], items: [{ id: 'one', title: 'change', status: 'done' }] })
+  const state = f.state('S-1')
+  state.stage = '代码审核'
+  state.verification = { passed: true, evidence: ['verified'] }
+  state.commits = [{ label: 'TASK', hash: 'abcdef1234567890' }]
+  f.files.set(join(f.cwd, '.dsh/task-S-1.json'), JSON.stringify(state))
+  await assert.rejects(f.call({ operation: 'review', task_id: 'S-1', outcome: 'pass' }), /SonarQube audit is enabled/)
+  const oldFetch = globalThis.fetch
+  const oldToken = process.env.SONAR_TOKEN
+  process.env.SONAR_TOKEN = 'secret-token'
+  globalThis.fetch = async url => ({ ok: true, json: async () => String(url).includes('/ce/task')
+    ? { task: { status: 'SUCCESS', analysisId: 'AN-2', componentKey: 'project' } }
+    : String(url).includes('/qualitygates/project_status') ? { projectStatus: { status: 'ERROR',
+      conditions: [{ metricKey: 'bugs', status: 'ERROR' }, { metricKey: 'new_coverage', status: 'OK' }] } }
+      : { paging: { total: 0 }, issues: [] } })
+  try {
+    const check = JSON.parse(await f.call({ operation: 'sonar_check', task_id: 'S-1', ce_task_id: 'CE-123456' }))
+    assert.equal(check.gate, 'OK')
+    assert.equal(check.server_gate, 'ERROR')
+    assert.match(check.report_path, /^\.dsh\/reviews\/S-1\//)
+    assert.match(f.files.get(join(f.cwd, check.report_path)), /SonarQube 代码审核/)
+    assert.equal(f.state('S-1').sonar_audit.report_path, check.report_path)
+    await f.call({ operation: 'review', task_id: 'S-1', outcome: 'pass' })
+    assert.equal(f.state('S-1').review.outcome, 'pass')
+  } finally {
+    globalThis.fetch = oldFetch
+    if (oldToken === undefined) delete process.env.SONAR_TOKEN
+    else process.env.SONAR_TOKEN = oldToken
+  }
+})
+
+test('a failed Sonar finding becomes a reviewed project Rule attached to the coding Skill', async () => {
+  const f = fixture()
+  await f.call({ operation: 'create', task_id: 'L-1', title: 'change', branch: 'feature', complexity: 'low',
+    complexity_reason: 'One local change', files: ['app.js'] })
+  const state = f.state('L-1')
+  const finding = { key: 'ISSUE-9', rule: 'java:S999', message: 'Handle null', severity: 'MAJOR', file: 'A.java' }
+  state.stage = '代码审核'
+  state.sonar_audit = { ce_task_id: 'CE-123456', analysis_id: 'AN-9', gate: 'ERROR', checked_at: 'now',
+    scope_hash: 'old', findings: [finding], blocking: [finding], target: 'feature' }
+  f.files.set(join(f.cwd, '.dsh/task-L-1.json'), JSON.stringify(state))
   await f.call({ operation: 'revise', task_id: 'L-1', target_stage: '代码开发',
     revision_kind: 'defect', revision_reason: 'Fix the SonarQube issue' })
   assert.equal(f.state('L-1').sonar_history[0].blocking[0].key, 'ISSUE-9')
-  const args = { operation: 'learn_rule', task_id: 'L-1', issue_key: 'ISSUE-9', skill_name: 'bundled:code-development',
-    rule_name: 'handle-null-boundary', learning_reason: 'This boundary appears in several service methods',
-    content: 'At a service boundary, check for null before dereferencing. Show the failing call and a guarded call in the review example.' }
-  const proposal = JSON.parse(await f.call({ ...args, phase: 'propose' }))
-  assert.equal(f.files.has(join(f.cwd, '.dsh/rules/handle-null-boundary.md')), false)
-  await f.call({ ...args, phase: 'apply', expected_hash: proposal.expected_hash })
-  assert.match(f.files.get(join(f.cwd, '.dsh/rules/handle-null-boundary.md')), /java:S999/)
-  assert.ok(f.files.has(join(f.cwd, '.dsh/skills/code-development/SKILL.md')))
+  assert.equal(JSON.parse(await f.call({ operation: 'status', task_id: 'L-1' })).rule_learning_candidates[0].rule, 'java:S999')
+  const args = { operation: 'learn_rule', task_id: 'L-1', issue_key: 'ISSUE-9', skill_name: 'bundled:code-development',
+    rule_name: 'handle-null-boundary', learning_reason: 'This boundary appears in several service methods',
+    content: 'At a service boundary, check for null before dereferencing. Show the failing call and a guarded call in the review example.' }
+  const proposal = JSON.parse(await f.call({ ...args, phase: 'propose' }))
+  assert.equal(f.files.has(join(f.cwd, '.dsh/rules/handle-null-boundary.md')), false)
+  await f.call({ ...args, phase: 'apply', expected_hash: proposal.expected_hash })
+  assert.match(f.files.get(join(f.cwd, '.dsh/rules/handle-null-boundary.md')), /java:S999/)
+  assert.ok(f.files.has(join(f.cwd, '.dsh/skills/code-development/SKILL.md')))
   assert.deepEqual(JSON.parse(f.files.get(join(f.cwd, '.dsh/skills/code-development/profile.json'))).rules,
     [{ source: 'project', name: 'handle-null-boundary' }])
+  assert.deepEqual(JSON.parse(await f.call({ operation: 'status', task_id: 'L-1' })).rule_learning_candidates, [])
 })

package/.codex-project-test.mjs

@@ -29,7 +29,7 @@ function diskFs() {
   }
 }
 
-test('Codex project Skills are discovered separately; new DSH Skills stay in .dsh', async t => {
+test('Codex project Skills are discovered separately; new DSH Skills stay in .dsh', async t => {
   const root = fixture(t)
   const body = '---\nname: same\ndescription: Codex method\n---\nCodex body v1\n'
   put(join(root, '.agents/skills/same/SKILL.md'), body)
@@ -42,23 +42,23 @@ test('Codex project Skills are discovered separately; new DSH Skills stay in .ds
   const created = await Controller.prototype.writeSkill.call(receiver, { level: 'project', name: 'new-one', description: 'New DSH method', whenToUse: '', content: 'body', path: root })
   assert.equal(created.ok, true)
   assert.equal(readFileSync(join(root, '.dsh/skills/new-one/SKILL.md'), 'utf8').includes('body'), true)
-})
-
-test('a project Skill can shadow a bundled meta Skill without replacing an existing project copy', async t => {
-  const root = fixture(t)
-  const receiver = { authorizedPath: async path => path }
-  const request = { level: 'project', name: 'requirements-analysis', description: 'Team requirements method',
-    whenToUse: 'During requirement analysis', content: 'Project method', path: root, createOnly: true }
-  const first = await Controller.prototype.writeSkill.call(receiver, request)
-  assert.equal(first.ok, true)
-  const file = join(root, '.dsh/skills/requirements-analysis/SKILL.md')
-  assert.match(readFileSync(file, 'utf8'), /Project method/)
-  const second = await Controller.prototype.writeSkill.call(receiver, { ...request, content: 'Should not replace' })
-  assert.equal(second.ok, false)
-  assert.match(readFileSync(file, 'utf8'), /Project method/)
-  const catalog = await Controller.prototype.listSkills.call(receiver, root)
-  assert.deepEqual(catalog.skills.filter(skill => skill.name === 'requirements-analysis').map(skill => skill.ref.source).sort(), ['bundled', 'project'])
-})
+})
+
+test('a project Skill can shadow a bundled meta Skill without replacing an existing project copy', async t => {
+  const root = fixture(t)
+  const receiver = { authorizedPath: async path => path }
+  const request = { level: 'project', name: 'requirements-analysis', description: 'Team requirements method',
+    whenToUse: 'During requirement analysis', content: 'Project method', path: root, createOnly: true }
+  const first = await Controller.prototype.writeSkill.call(receiver, request)
+  assert.equal(first.ok, true)
+  const file = join(root, '.dsh/skills/requirements-analysis/SKILL.md')
+  assert.match(readFileSync(file, 'utf8'), /Project method/)
+  const second = await Controller.prototype.writeSkill.call(receiver, { ...request, content: 'Should not replace' })
+  assert.equal(second.ok, false)
+  assert.match(readFileSync(file, 'utf8'), /Project method/)
+  const catalog = await Controller.prototype.listSkills.call(receiver, root)
+  assert.deepEqual(catalog.skills.filter(skill => skill.name === 'requirements-analysis').map(skill => skill.ref.source).sort(), ['bundled', 'project'])
+})
 
 test('a bound Codex Skill loads its attached DSH Rule and reads edits next time', async t => {
   const root = fixture(t)

package/.evidence-test.mjs

@@ -7,11 +7,11 @@
  */
 import test from 'node:test'
 import assert from 'node:assert/strict'
-import { needsSkillReceipt, skillBlockers } from './lib/skill-audit.js'
+import { loadedSkills, needsSkillReceipt, skillBlockers } from './lib/skill-audit.js'
 import { adoptRecommendation, resolveFlow } from './lib/workflows.js'
 
 /** A session that has loaded the named skills. */
-function sessionWith(names) {
+function sessionWith(names) {
   const events = []
   for (const name of names) {
     const callId = 'c' + events.length
@@ -19,7 +19,20 @@ function sessionWith(names) {
     events.push({ type: 'tool/result', data: { message: { content: [{ type: 'tool-result', toolCallId: callId, isError: false }] } } })
   }
   return { id: 's', snapshotEvents: () => events }
-}
+}
+
+test('evidence: DSH 0.2 tool messages prove only successful task-scoped skill loads', () => {
+  const events = [
+    { type: 'tool/call', data: { name: 'dev_task', callId: 'ok', arguments: JSON.stringify({ operation: 'load_skill', task_id: 'Q-1', skill_name: 'project:qms-project-map' }) } },
+    { type: 'tool/result', data: { message: { role: 'tool', toolCallId: 'ok', isError: false, content: [{ type: 'text', text: 'loaded' }] } } },
+    { type: 'tool/call', data: { name: 'dev_task', callId: 'bad', arguments: JSON.stringify({ operation: 'load_skill', task_id: 'Q-1', skill_name: 'project:qms-tech-stack' }) } },
+    { type: 'tool/result', data: { message: { role: 'tool', toolCallId: 'bad', isError: true, content: [{ type: 'text', text: 'failed' }] } } },
+  ]
+  const loaded = loadedSkills({ snapshotEvents: () => events })
+  assert.equal(loaded.get('Q-1#project:qms-project-map'), 'ok')
+  assert.equal(loaded.has('Q-1#project:qms-tech-stack'), false)
+  assert.equal(loaded.has('Q-2#project:qms-project-map'), false)
+})
 
 /** A standard-flow config with one extra skill on 开发 carrying the given evidence. */
 function withEvidence(evidence) {