@godv61/dsh-task-engine 0.29.3 → 0.30.0

package/.codex-project-test.mjs

@@ -29,7 +29,7 @@ function diskFs() {
   }
 }
 
-test('Codex project Skills are discovered separately; new DSH Skills stay in .dsh', async t => {
+test('Codex project Skills are discovered separately; new DSH Skills stay in .dsh', async t => {
   const root = fixture(t)
   const body = '---\nname: same\ndescription: Codex method\n---\nCodex body v1\n'
   put(join(root, '.agents/skills/same/SKILL.md'), body)
@@ -42,23 +42,23 @@ test('Codex project Skills are discovered separately; new DSH Skills stay in .ds
   const created = await Controller.prototype.writeSkill.call(receiver, { level: 'project', name: 'new-one', description: 'New DSH method', whenToUse: '', content: 'body', path: root })
   assert.equal(created.ok, true)
   assert.equal(readFileSync(join(root, '.dsh/skills/new-one/SKILL.md'), 'utf8').includes('body'), true)
-})
-
-test('a project Skill can shadow a bundled meta Skill without replacing an existing project copy', async t => {
-  const root = fixture(t)
-  const receiver = { authorizedPath: async path => path }
-  const request = { level: 'project', name: 'requirements-analysis', description: 'Team requirements method',
-    whenToUse: 'During requirement analysis', content: 'Project method', path: root, createOnly: true }
-  const first = await Controller.prototype.writeSkill.call(receiver, request)
-  assert.equal(first.ok, true)
-  const file = join(root, '.dsh/skills/requirements-analysis/SKILL.md')
-  assert.match(readFileSync(file, 'utf8'), /Project method/)
-  const second = await Controller.prototype.writeSkill.call(receiver, { ...request, content: 'Should not replace' })
-  assert.equal(second.ok, false)
-  assert.match(readFileSync(file, 'utf8'), /Project method/)
-  const catalog = await Controller.prototype.listSkills.call(receiver, root)
-  assert.deepEqual(catalog.skills.filter(skill => skill.name === 'requirements-analysis').map(skill => skill.ref.source).sort(), ['bundled', 'project'])
-})
+})
+
+test('a project Skill can shadow a bundled meta Skill without replacing an existing project copy', async t => {
+  const root = fixture(t)
+  const receiver = { authorizedPath: async path => path }
+  const request = { level: 'project', name: 'requirements-analysis', description: 'Team requirements method',
+    whenToUse: 'During requirement analysis', content: 'Project method', path: root, createOnly: true }
+  const first = await Controller.prototype.writeSkill.call(receiver, request)
+  assert.equal(first.ok, true)
+  const file = join(root, '.dsh/skills/requirements-analysis/SKILL.md')
+  assert.match(readFileSync(file, 'utf8'), /Project method/)
+  const second = await Controller.prototype.writeSkill.call(receiver, { ...request, content: 'Should not replace' })
+  assert.equal(second.ok, false)
+  assert.match(readFileSync(file, 'utf8'), /Project method/)
+  const catalog = await Controller.prototype.listSkills.call(receiver, root)
+  assert.deepEqual(catalog.skills.filter(skill => skill.name === 'requirements-analysis').map(skill => skill.ref.source).sort(), ['bundled', 'project'])
+})
 
 test('a bound Codex Skill loads its attached DSH Rule and reads edits next time', async t => {
   const root = fixture(t)

package/.evidence-test.mjs

@@ -7,7 +7,7 @@
  */
 import test from 'node:test'
 import assert from 'node:assert/strict'
-import { needsSkillReceipt, skillBlockers } from './lib/skill-audit.js'
+import { loadedSkills, needsSkillReceipt, skillBlockers } from './lib/skill-audit.js'
 import { adoptRecommendation, resolveFlow } from './lib/workflows.js'
 
 /** A session that has loaded the named skills. */
@@ -21,6 +21,19 @@ function sessionWith(names) {
   return { id: 's', snapshotEvents: () => events }
 }
 
+test('evidence: DSH 0.2 tool messages prove only successful task-scoped skill loads', () => {
+  const events = [
+    { type: 'tool/call', data: { name: 'dev_task', callId: 'ok', arguments: JSON.stringify({ operation: 'load_skill', task_id: 'Q-1', skill_name: 'project:qms-project-map' }) } },
+    { type: 'tool/result', data: { message: { role: 'tool', toolCallId: 'ok', isError: false, content: [{ type: 'text', text: 'loaded' }] } } },
+    { type: 'tool/call', data: { name: 'dev_task', callId: 'bad', arguments: JSON.stringify({ operation: 'load_skill', task_id: 'Q-1', skill_name: 'project:qms-tech-stack' }) } },
+    { type: 'tool/result', data: { message: { role: 'tool', toolCallId: 'bad', isError: true, content: [{ type: 'text', text: 'failed' }] } } },
+  ]
+  const loaded = loadedSkills({ snapshotEvents: () => events })
+  assert.equal(loaded.get('Q-1#project:qms-project-map'), 'ok')
+  assert.equal(loaded.has('Q-1#project:qms-tech-stack'), false)
+  assert.equal(loaded.has('Q-2#project:qms-project-map'), false)
+})
+
 /** A standard-flow config with one extra skill on 开发 carrying the given evidence. */
 function withEvidence(evidence) {
   const adopted = adoptRecommendation('standard')

package/.hook-test.mjs

@@ -113,7 +113,7 @@ async function standardConfig() {
   return resolved.config
 }
 
-test('a task at its checkpoint with the right message commits', async () => {
+test('a task at its checkpoint with the right message commits', async () => {
   const config = await standardConfig()
   const root = repo('allow', approvedTask({ flow: { flow: 'standard', version: 2, config } }))
   try {
@@ -193,21 +193,21 @@ test('touching a sensitive path without a high-risk receipt is refused', async (
   } finally {
     rmSync(root, { recursive: true, force: true })
   }
-})
-
-test('adaptive task can make its first CI commit before Sonar review', async () => {
-  const { adaptiveWorkflow } = await import('./lib/adaptive.js')
-  const config = adaptiveWorkflow('medium')
-  const root = repo('adaptive-sonar', approvedTask({
-    stage: '测试',
-    review: { outcome: 'pending' },
-    sonar_policy: { enabled: true, host_url: 'https://sonar.example.test', project_key: 'example', mode: 'branch', token_env: 'SONAR_TOKEN' },
-    flow: { flow: 'adaptive-medium', version: 1, config },
-  }))
-  try {
-    const result = tryCommit(root, 'first CI scan')
-    assert.equal(result.allowed, true, `the commit must precede its Sonar analysis: ${result.stderr}`)
-  } finally {
-    rmSync(root, { recursive: true, force: true })
-  }
-})
+})
+
+test('adaptive task can make its first CI commit before Sonar review', async () => {
+  const { adaptiveWorkflow } = await import('./lib/adaptive.js')
+  const config = adaptiveWorkflow('medium')
+  const root = repo('adaptive-sonar', approvedTask({
+    stage: '测试',
+    review: { outcome: 'pending' },
+    sonar_policy: { enabled: true, host_url: 'https://sonar.example.test', project_key: 'example', mode: 'branch', token_env: 'SONAR_TOKEN' },
+    flow: { flow: 'adaptive-medium', version: 1, config },
+  }))
+  try {
+    const result = tryCommit(root, 'first CI scan')
+    assert.equal(result.allowed, true, `the commit must precede its Sonar analysis: ${result.stderr}`)
+  } finally {
+    rmSync(root, { recursive: true, force: true })
+  }
+})

package/.resource-test.mjs

@@ -131,3 +131,20 @@ test('ledger rejects malformed records instead of pretending there are no tasks'
    await assert.rejects(()=>controller.readTasks('/project'),/任务记录/)
  }
 })
+test('ledger exposes Sonar findings without project credentials',async()=>{
+ const {default:Controller}=await import('./lib/controller.js')
+ const controller=Object.create(Controller.prototype)
+ controller.authorizedPath=async p=>p
+ controller.fs=()=>({resolve:async p=>p,listDir:async()=>[{name:'task-sample.json'}],readText:async()=>JSON.stringify({
+   id:'sample',title:'Sample',stage:'代码审核',branch:'feature/sample',items:[],
+   sonar_policy:{source:'ide-local',token_env:'SONAR_TOKEN',host_url:'https://sonar.example',project_key:'sample'},
+   sonar_audit:{gate:'ERROR',checked_at:'2026-10-03T00:00:00Z',target:'main',
+     findings:[{key:'issue-1',rule:'java:S103',message:'Line too long',severity:'MAJOR',file:'Sample.java',line:3}],
+     blocking:[{key:'issue-1'}],uncovered_files:[]},
+ })})
+ const {tasks}=await controller.readTasks('/project')
+ assert.equal(tasks[0].sonar.audit.gate,'ERROR')
+ assert.equal(tasks[0].sonar.audit.blocking_count,1)
+ assert.deepEqual(tasks[0].sonar.audit.findings[0],{key:'issue-1',rule:'java:S103',message:'Line too long',severity:'MAJOR',file:'Sample.java',line:3})
+ assert.equal(JSON.stringify(tasks).includes('SONAR_TOKEN'),false)
+})

package/.roundtrip-test.mjs

@@ -7,18 +7,23 @@
  */
 import test from 'node:test'
 import assert from 'node:assert/strict'
-import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { dirname, join, resolve, sep } from 'node:path'
 import { resolveFlow, adoptRecommendation, compactProjectConfig, materializeBundledReferences } from './lib/workflows.js'
 import Controller from './lib/controller.js'
 import { assertAdvance, validateWorkflow } from './lib/engine.js'
-import { TYPERT_REMOTE } from './src/client/remote.ts'
+// The npm package ships the built client, not its TypeScript source. Keep the
+// source codec assertion in repository tests while allowing shipped tests to run.
+const remoteSource = new URL('./src/client/remote.ts', import.meta.url)
+const hasRemoteSource = existsSync(remoteSource)
+const TYPERT_REMOTE = hasRemoteSource ? (await import(remoteSource.href)).TYPERT_REMOTE : undefined
 
 /** The fields a project config can carry, so a round-trip is checked on all of them. */
 const FIELDS = ['flow', 'stage_bindings', 'commit', 'artifacts', 'review_depth', 'commit_required']
 
-test('browser remote codec retains source-qualified bindings and all saved fields', () => {
+test('browser remote codec retains source-qualified bindings and all saved fields',
+  { skip: hasRemoteSource ? false : 'TypeScript source is excluded from the npm package' }, () => {
   const write = TYPERT_REMOTE.descriptors.find(descriptor => descriptor.method === 'write')
   const read = TYPERT_REMOTE.descriptors.find(descriptor => descriptor.method === 'read')
   const adopted = compactProjectConfig(adoptRecommendation('minimal'))

package/.sonar-credential-test.mjs

@@ -0,0 +1,38 @@
+import assert from 'node:assert/strict'
+import { test } from 'node:test'
+import { resolveSonarToken, sonarCredentialRef } from './lib/sonar-credential.js'
+import Controller from './lib/controller.js'
+
+test('Sonar credential references stay distinct for different workspaces', () => {
+  const qms = sonarCredentialRef('D:/projects/qms')
+  const eam = sonarCredentialRef('D:/projects/eam')
+  assert.match(qms, /^DSH_TASK_ENGINE_SONAR_[A-F0-9]{24}$/)
+  assert.notEqual(qms, eam)
+  assert.equal(qms, sonarCredentialRef('D:/projects/qms'))
+  assert.ok(!qms.includes('qms'))
+  if (process.platform === 'win32') assert.equal(qms, sonarCredentialRef('d:/PROJECTS/QMS'))
+})
+
+test('Sonar token management keeps each workspace value private', async () => {
+  const stored = new Map()
+  const credentials = {
+    describe: async ref => ({ configured: stored.has(ref), writable: true, source: stored.has(ref) ? 'file' : undefined }),
+    set: async (ref, value) => { stored.set(ref, value) },
+    unset: async ref => { stored.delete(ref) },
+    resolve: async ref => stored.has(ref) ? { value: stored.get(ref), source: 'file' } : undefined,
+  }
+  const controller = Object.create(Controller.prototype)
+  controller.authorizedPath = async path => path
+  Object.defineProperty(controller, 'ctx', { value: { get: name => name === 'credentials' ? credentials : undefined } })
+  const qms = 'D:/projects/qms'
+  const eam = 'D:/projects/eam'
+  const result = await controller.setSonarToken({ path: qms, token: 'qms-secret' })
+  assert.equal(result.configured, true)
+  assert.ok(!JSON.stringify(result).includes('qms-secret'))
+  assert.equal((await controller.describeSonarToken(eam)).configured, false)
+  assert.equal((await credentials.resolve(sonarCredentialRef(qms))).value, 'qms-secret')
+  assert.equal(await resolveSonarToken(credentials, qms, 'old-env-token'), 'qms-secret')
+  assert.equal(await resolveSonarToken(credentials, eam, 'old-env-token'), 'old-env-token')
+  await controller.unsetSonarToken(qms)
+  assert.equal((await controller.describeSonarToken(qms)).configured, false)
+})

package/.sonarlint-local-test.mjs

@@ -0,0 +1,71 @@
+import assert from 'node:assert/strict'
+import { execFileSync } from 'node:child_process'
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { test } from 'node:test'
+import { changedLines, missingLocalAuditScope, uncoveredLocalFiles } from './lib/sonarlint-local.js'
+import { isIncludedAuditPath, validAuditIncludePaths } from './lib/sonar.js'
+import { renderSonarReport, sonarReportPath } from './lib/sonar-report.js'
+
+test('project scan roots mirror Maven backend scope without including the Vue app', () => {
+  const roots = ['fp-bussiness', 'fp-ruoyi', 'fp-ruoyi-spring-boot', 'pom.xml']
+  assert.equal(validAuditIncludePaths(roots), true)
+  assert.equal(isIncludedAuditPath('fp-bussiness/src/main/java/A.java', roots), true)
+  assert.equal(isIncludedAuditPath('fp-ruoyi-ui/src/views/auth.vue', roots), false)
+  assert.equal(validAuditIncludePaths(['../outside']), false)
+  assert.equal(validAuditIncludePaths(['C:/outside']), false)
+})
+
+test('one review gets a credential-free Markdown report path and issue details', () => {
+  const audit = { analysis_id: 'abc12345-0000', checked_at: '2026-10-03T10:11:12.000Z',
+    target: 'qdm_gw_chemical_260930', gate: 'ERROR', findings: [{key:'x',rule:'java:S103',
+      severity:'MAJOR',file:'A.java',line:12,message:'Line too long'}], blocking:[{key:'x'}],
+    scanned_files:['A.java'],uncovered_files:[] }
+  const path = sonarReportPath('QMS-1', audit)
+  assert.match(path, /^\.dsh\/reviews\/QMS-1\/2026-/)
+  const report = renderSonarReport('QMS-1', {source:'ide-local',project_key:'project',include_paths:['fp-bussiness']}, audit)
+  assert.match(report, /java:S103/)
+  assert.match(report, /A.java:12/)
+  assert.equal(report.includes('token-secret'),false)
+})
+
+test('unsupported files block only when the project has active rules for their language', () => {
+  const paths = ['migration.sql', 'settings.json', 'script.py']
+  const profiles = [
+    { language: 'java', activeRuleCount: 66 },
+    { language: 'json', activeRuleCount: 0 },
+    { language: 'py', activeRuleCount: 3 },
+  ]
+  assert.deepEqual(uncoveredLocalFiles(paths, profiles), ['script.py'])
+  assert.deepEqual(uncoveredLocalFiles(paths, [...profiles, { language: 'plsql', activeRuleCount: 5 }]),
+    ['migration.sql', 'script.py'])
+})
+
+test('local audit detects changed backend files omitted from the task scope', () => {
+  assert.deepEqual(missingLocalAuditScope(['fp-bussiness/A.java', 'fp-bussiness/B.java'],
+    ['fp-bussiness/A.java', 'fp-ruoyi-ui/view.vue']), ['fp-bussiness/B.java'])
+  assert.deepEqual(missingLocalAuditScope(['fp-bussiness/A.java'], ['./FP-BUSSINESS\\A.java']), [])
+})
+
+test('local Sonar audit considers Git new code but excludes generated DSH records', async () => {
+  const root = mkdtempSync(join(tmpdir(), 'dsh-sonarlint-diff-test-'))
+  const git = (...args) => execFileSync('git', args, { cwd: root, stdio: 'pipe' })
+  try {
+    git('init', '--quiet')
+    writeFileSync(join(root, 'Sample.java'), 'class Sample {}\n')
+    git('add', 'Sample.java')
+    git('-c', 'user.name=Test', '-c', 'user.email=test@example.invalid', 'commit', '--quiet', '-m', 'baseline')
+    writeFileSync(join(root, 'Sample.java'), 'class Sample {}\n// new code\n')
+    writeFileSync(join(root, 'change.sql'), 'SELECT 1;\n')
+    mkdirSync(join(root, '.dsh'))
+    writeFileSync(join(root, '.dsh', 'task.json'), '{"generated":true}\n')
+    const changed = await changedLines(root, 'HEAD')
+    assert.deepEqual(changed.map(file => file.path).sort(), ['Sample.java', 'change.sql'])
+    assert.deepEqual([...changed.find(file => file.path === 'Sample.java').lines], [2])
+    assert.equal(changed.find(file => file.path === 'change.sql').newFile, true)
+    assert.deepEqual((await changedLines(root, 'HEAD', ['Sample.java'])).map(file => file.path), ['Sample.java'])
+  } finally {
+    rmSync(root, { recursive: true, force: true })
+  }
+})

package/.workflow-test.mjs

@@ -4,7 +4,7 @@ import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join, resolve, sep } from 'node:path'
 import { registerDevTask } from './lib/dev-task.js'
-import { newTask, validateWorkflow } from './lib/engine.js'
+import { newTask, validateWorkflow, verificationBlockers } from './lib/engine.js'
 import { adoptRecommendation, resolveFlow, retainStageBindings } from './lib/workflows.js'
 import Controller from './lib/controller.js'
 import { registerShippedSkills } from './lib/shipped-skills.js'
@@ -71,9 +71,10 @@ function fixture(stage = '开发', extra = {}, services = {}) {
   const ctx = { fs, tools: { register(tool) { execute = tool.execute; return () => {} } }, get(name) {
     if (Object.hasOwn(services, name)) return services[name]
     if (name === 'sandboxPolicy') return { resolve(request) { assert.equal(request.session, session); return policy } }
-    if (name === 'shell') return { resolve(request) { runs.push(request); return request }, async run(request) {
+    if (name === 'shell') return { resolve(request) { runs.push(request); return request }, async execute(request) {
       const fail = request.command === 'fail'
-      return { exitCode: fail ? 1 : 0, timedOut: false, aborted: false, sandbox: { mode: 'workspace-write', denied: false }, stdout: { text: request.command.startsWith('git -c core.quotepath=false log') ? 'abcdef1234567890\n【LIVE-1】【TASK】done\n\napp.js\n' : 'checks passed' }, stderr: { text: '' } }
+      const outcome = { exitCode: fail ? 1 : 0, timedOut: false, aborted: false, sandbox: { mode: 'workspace-write', denied: false }, stdout: { text: request.command.startsWith('git -c core.quotepath=false log') ? 'abcdef1234567890\n【LIVE-1】【TASK】done\n\napp.js\n' : 'checks passed' }, stderr: { text: '' } }
+      return { result: async () => outcome }
     } }
     return undefined
   } }
@@ -206,6 +207,52 @@ test('追加修复项可按 id 保留旧标题，拒绝已完成项改名后静
   await assert.rejects(f.call({ operation: 'items', items: [{ id: 'NEW' }] }), /title/)
 })
 
+test('重排实施项时不静默丢弃已完成项和审查记录', async () => {
+  const f = fixture()
+  await f.call({ operation: 'items', items: [
+    { id: 'I1', title: 'models', status: 'doing' },
+    { id: 'I2', title: 'mapper', status: 'todo' },
+  ] })
+  await f.call({ operation: 'dispatch', item_id: 'I1', description: 'direct implementation' })
+  await f.call({ operation: 'review_item', item_id: 'I1', spec_outcome: 'pass', quality_outcome: 'pass' })
+  await f.call({ operation: 'items', items: [{ id: 'I1', status: 'done' }, { id: 'I2' }] })
+  await f.call({ operation: 'items', items: [{ id: 'I3', title: 'service', status: 'todo' }] })
+  assert.deepEqual(f.state().items.map(item => item.id), ['I1', 'I2', 'I3'])
+  assert.equal(f.state().items[0].status, 'done')
+  assert.equal(f.state().items[0].review.quality.outcome, 'pass')
+  assert.equal(f.state().items[0].dispatch.description, 'direct implementation')
+  await f.call({ operation: 'items', items_mode: 'replace', items: [{ id: 'I3', title: 'service', status: 'todo' }] })
+  assert.deepEqual(f.state().items.map(item => item.id), ['I3', 'I1'])
+})
+
+test('Maven verify rejects zero or missing Surefire tests even when the command exits zero', async () => {
+  let output = 'Tests run: 0, Failures: 0, Errors: 0, Skipped: 0'
+  const shell = { resolve: request => request, execute: async () => ({ result: async () => ({
+    exitCode: 0, timedOut: false, aborted: false, stdout: { text: output }, stderr: { text: '' },
+  }) }) }
+  const f = fixture('交付', {}, { shell })
+  await f.call({ operation: 'verify', command: 'mvn -q test' })
+  assert.equal(f.state().verification.passed, false)
+  assert.equal(f.state().verification.receipt.test_summary.count, 0)
+  output = 'BUILD SUCCESS'
+  await f.call({ operation: 'verify', command: 'mvn -q test' })
+  assert.equal(f.state().verification.passed, false)
+  assert.equal(f.state().verification.receipt.test_summary.count, null)
+  output = 'Tests run: 23, Failures: 0, Errors: 0, Skipped: 0'
+  await f.call({ operation: 'verify', command: 'mvn test' })
+  assert.equal(f.state().verification.passed, true)
+  assert.equal(f.state().verification.receipt.test_summary.count, 23)
+})
+
+test('a previously stored Maven zero-test pass is blocked by current workflow gates', () => {
+  const f = fixture('代码审核')
+  const state = f.state()
+  state.verification = { passed: true, evidence: [], receipt: { command: 'mvn test', exit_code: 0,
+    timed_out: false, aborted: false, started_at: 'now', finished_at: 'now',
+    stdout: 'Tests run: 0, Failures: 0, Errors: 0, Skipped: 0', stderr: '' } }
+  assert.match(verificationBlockers(state, state.flow.config).join(' '), /no nonzero Surefire/)
+})
+
 test('派发立即反映进行中，重派不复用旧审核且保持单一进行项', async () => {
   const f = fixture()
   await f.call({ operation: 'items', items: [{ id: 'A', title: 'models' }, { id: 'B', title: 'api' }] })
@@ -411,14 +458,14 @@ test('同名技能与规则在项目和个人目录各自保留管理入口', as
   assert.match(read.content, /Run tests/)
 })
 
-test('安装包注册会话编排和元技能，阶段目录只隐藏会话编排技能', async () => {
+test('安装包注册会话编排和元技能，阶段目录只隐藏会话编排技能', async () => {
   const registered = []
   registerShippedSkills({ get: name => name === 'skills' ? { register: skill => { registered.push(skill); return () => {} } } : undefined })
-  const expected = ['architecture-design', 'code-development', 'code-review', 'eng-delivery',
-    'requirements-analysis', 'task-orchestration', 'test-validation']
+  const expected = ['architecture-design', 'code-development', 'code-review', 'eng-delivery',
+    'requirements-analysis', 'task-orchestration', 'test-validation']
   assert.deepEqual(registered.map(skill => skill.name).sort(), expected)
   assert.ok(registered.every(skill => skill.content.trim().length > 0))
   const catalog = await Controller.prototype.listSkills.call({ authorizedPath: async path => path }, '')
-  assert.deepEqual(catalog.skills.filter(skill => skill.source === 'bundled').map(skill => skill.name).sort(),
-    expected.filter(name => name !== 'eng-delivery'))
-})
+  assert.deepEqual(catalog.skills.filter(skill => skill.source === 'bundled').map(skill => skill.name).sort(),
+    expected.filter(name => name !== 'eng-delivery'))
+})

package/README.md

@@ -1,114 +1,37 @@
-<p align="center">
-  <img src="docs/assets/workflow-banner.svg" alt="DSH Task Engine：DeepSeek Harness 的个人工程流程工作台，标准流程从需求评审走向完成" width="100%" />
-</p>
-
-<h1 align="center">DSH Task Engine</h1>
+# DSH Task Engine
 
-> `0.29.0` 新增自适应流程、项目技能初始化与可选 SonarQube CI 审核。SonarQube 集成目前读取提交后的 CI 分析结果，不提供未提交代码的本地 Sonar 审核。
-
-<p align="center">按每个需求选择工程路径，用项目 Skill 与 Rule 复用团队开发规范。</p>
-<p align="center"><sub>Task-scoped engineering workflows for DeepSeek Harness.</sub></p>
-
-<p align="center">
-  <a href="https://www.npmjs.com/package/@godv61/dsh-task-engine"><img src="https://img.shields.io/npm/v/%40godv61%2Fdsh-task-engine?style=flat-square&amp;color=238636" alt="npm version" /></a>
-  <a href="https://github.com/godv61/dsh-task-engine/actions/workflows/verify.yml"><img src="https://github.com/godv61/dsh-task-engine/actions/workflows/verify.yml/badge.svg" alt="Package verification CI" /></a>
-  <a href="https://awesome-dsh-plugin.com"><img src="https://awesome-dsh-plugin.com/badge.svg" alt="Awesome DSH Plugin" /></a>
-  <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-64748b?style=flat-square" alt="MIT license" /></a>
-</p>
-
-<p align="center">
-  <a href="#快速开始">快速开始</a> ·
-  <a href="#工作台里有什么">工作台</a> ·
-  <a href="docs/README.md">使用文档</a> ·
-  <a href="docs/roadmap.md">功能规划</a> ·
-  <a href="docs/CHANGELOG.md">更新日志</a>
-</p>
-
-## 为什么用它
-
-让 AI 在持续开发的项目中处理不同需求时，按这次需求的复杂度选择低、中、高、超高四档任务流程。元技能规定交接产物，项目 Skill/Rule 承载团队编码规范；同一项目下的多个会话可以各自推进不同任务。
-
-- **知道下一步做什么**：任务创建时选择复杂度并冻结流程，当前阶段的条件和产物清楚可查。
-- **复用自己的工作方法**：把技能和规则安装到项目或个人目录，将规则配置在技能下，再把技能挂到节点上；同一技能在任何节点都使用同一套约束。
-- **找得到过程记录**：任务台账集中查看阶段、实施项、验证与审核状态。
-
-## 快速开始
-
-需要已安装 DeepSeek Harness 和 pnpm。插件装入你使用的 Web profile；下面以 `web` 为例。
-
-```sh
-dsh plugin --profile web add @godv61/dsh-task-engine
-```
-
-1. 重启 Harness Web，打开侧边栏的 **工程任务**。
-2. 选择工作区，在 **自适应流程** 中查看四档路径，按需挂载项目技能。
-3. 新建会话，选择 **工程化开发引擎** 预设，描述要完成的开发任务。
-
-看到“工程任务”入口和“工程化开发引擎”会话预设，就说明工作台与任务工具已接入。使用 Harness 源码启动的安装方式见[安装与启用](docs/getting-started.md)。
-
-> 工程化会话先分析需求复杂度，再以 `dev_task assess` 预览并创建任务；`.dsh/meta.json` 只配置元技能挂载和可选 SonarQube 审核，不强迫项目所有会话走同一条流程。
-
-## 工作台里有什么
-
-| 页面 | 你可以做什么 |
-| :--- | :--- |
-| **项目初始化** | 分开管理 `AGENTS.md` 与项目 Skill/Rule。后者可在页面复制初始化请求，发给“工程化开发引擎”会话后由 `dev_task init_project` 扫描、预览并应用。 |
-| **自适应流程** | 查看四档任务路径、元技能绑定与可选 SonarQube 审核配置。 |
-| **任务台账** | 查看实施、验证和审核记录，按关键词、阶段或风险筛选。 |
-| **技能** | 安装、编辑技能，并集中维护每个技能唯一的规则列表。 |
-| **规则** | 选择 Markdown 文件安装规则，维护项目或个人开发约定。 |
-
-插件内置会话编排 Skill `eng-delivery` 和六个通用元技能 Skill。项目知识、领域编码方法和 Rule 由使用者创建或通过 init 生成，可放在项目或个人目录；同名项目 Skill 在新任务中覆盖用户级 Skill。
+在 DeepSeek Harness 中按**每个需求**组织开发：模型评估低、中、高、超高四档复杂度，任务按相应元技能推进；项目 Skill 与 Rule 保存团队约定。可选的 SonarQube 审核只在代码审核阶段运行。
 
-新路径的四档顺序、元技能交接契约、`init_project` 和可选 SonarQube 审核见[自适应工程任务](docs/adaptive-workflows.md)。
-
-**流程与工作方法各有职责。** 四档流程规定阶段与门禁，并在相应阶段加载内置元技能；项目业务技能和规则由使用者配置。同一条规则可由多个技能共享。点击元技能的“配置核心 Skill 的 Rule”，内置或用户级 Skill 可在保存时生成同名项目副本，再挂载项目 Rule。任务的流程与资源引用在创建时确定；Skill/Rule 正文在每次交互读取最新版本，创建时副本仅用于审计。[自适应流程说明](docs/adaptive-workflows.md)
-
-已有任务仍按创建时的快照运行；旧版 `.dsh/eng.json` 也继续可读。工作台只展示自适应流程，旧版配置细节保存在[历史文档](docs/configuration.md)。
-
-## 把自己的技能和规则带进来
-
-**选择文件 → 检查预览 → 选择范围 → 确认安装 → 挂到阶段。**
-
-技能选择含 `SKILL.md` 的文件夹，规则选择一个 `.md` 文件。预览会显示名称、正文、文件数、体积和目标路径；目标目录中已有同名资源不会被覆盖。项目级 Skill 可与内置 Skill 同名，以项目版本优先生效。
-
-| 安装范围 | 存放位置 | 用途 |
-| :--- | :--- | :--- |
-| 项目 | 工作区 `.dsh/skills`、`.dsh/rules` | 当前项目的工作方法与约定；工作台新建资源默认写在这里。 |
-| 个人 | `$DSH_HOME/skills`、`$DSH_HOME/rules` | 在这台电脑上的多个项目间复用。 |
-
-工作台也会发现同一项目 `.agents/skills/<名称>/SKILL.md` 中的 Codex 项目技能，可将它绑定到流程节点，并在技能下配置 DSH 规则；它的正文仍留在原目录。运行时使用 `dev_task` 的 `load_skill` 操作读取该技能及其规则，下一次读取会取得文件的最新内容。[Codex 项目技能说明](docs/configuration.md#技能与规则)
-
-技能的脚本、模板和附件会一并保留。文件格式、大小限制和故障处理见[技能与规则安装指南](docs/resource-install.md)。
-
-## 使用文档
-
-| 想了解什么 | 从这里开始 |
-| :--- | :--- |
-| 安装、启用与第一次使用 | [快速上手](docs/getting-started.md) |
-| 任务级流程、元技能与 SonarQube | [自适应工程任务](docs/adaptive-workflows.md) |
-| 旧项目配置与阶段绑定 | [流程配置](docs/configuration.md) |
-| 技能文件夹与 Markdown 规则 | [资源安装](docs/resource-install.md) |
-| 完整操作说明 | [HTML 手册](docs/manual.html)（下载后在浏览器打开） |
-| 当前能力与常见问题 | [常见问题](docs/faq.md) |
-| 本地开发与验证 | [开发指南](docs/development.md) |
-| 真实项目回归修复 | [0.23.1 发布说明](docs/releases/0.23.1.md) · [回归迭代说明](docs/workflow-regression.md) |
-| 版本变化与验证记录 | [更新日志](docs/CHANGELOG.md) · [0.23.1 测试说明](docs/testing/0.23.1/测试报告.md) |
-
-## 能力说明
-
-`dev_task` 按配置检查阶段、产物和提交条件。新任务的验证要求真实命令回执；技能可按自身配置要求命令、产物、审核、人工批准或无需额外证据，执行义务可在任务状态中查看。任务保存创建时的流程与资源引用；之后修改流程配置不会改变进行中任务的状态机，编辑所引用资源的正文会从下一次交互生效。
-
-审核结论、实施项完成情况和测试覆盖面仍需要你判断。本地提交钩子提供即时检查，不能替代人工审核或项目自己的 CI。详细说明见[常见问题](docs/faq.md)。
-
-小修正允许主代理处理，仍须审核和验证。遇到沙箱权限拒绝应使用宿主审批或报告阻塞，不能靠反复切换命令规避。
-
-状态查询会列出过期验证和附加技能回执；`commit.allowed` 同时检查这些阻塞，文件变化后先补验证再申请提交。
-
-验证命令的单次权限重试先审批后执行，不改变会话权限；操作方式见[验证权限说明](docs/faq.md#验证命令被沙箱阻止怎么办)。
-
-记录需求、方案或评审前，模型可从 `artifact_requirements` 获取当前阶段允许的字段和缺项，避免猜测字段名。
-
----
-
-[MIT License](LICENSE) · [反馈问题](https://github.com/godv61/dsh-task-engine/issues) · Built for DeepSeek Harness
+## 安装
+
+把插件安装到实际使用的 Web profile（下面以 `web` 为例），重启 DSH Web：
+
+```sh
+dsh plugin --profile web add @godv61/dsh-task-engine
+```
+
+使用 DSH 源码启动时，在 DSH 根目录执行 `pnpm dsh plugin --profile web add @godv61/dsh-task-engine`，再运行 `pnpm dsh web --no-open`。重启后，侧边栏应出现“工程任务”，新会话应能选择“工程化开发引擎”。普通会话不会因为某个项目配置了流程而自动进入该流程。
+
+## 从一个项目开始
+
+1. 在“工程任务”选择工作区，进入“项目初始化”，复制初始化请求到该项目的“工程化开发引擎”会话。`init_project` 依次扫描、预览、应用项目地图、技术栈及开发 Skill/Rule。项目地图概述**整个仓库**，需求细节写进具体任务。
+2. 检查生成的 `.dsh/skills/`、`.dsh/rules/` 和 `.dsh/meta.json`，按需在“自适应流程”把项目 Skill 挂到元技能。同名项目 Skill 优先于用户级和内置 Skill。
+3. 在会话中描述需求。模型用 `dev_task assess` 评估复杂度，再创建独立任务。高、超高任务按实现先后顺序编排实施项，不按人员分包。
+4. 在“任务台账”查看阶段、实施项、测试和审核。`items` 默认按 ID 增量更新；要有意重排或移除未开始的项目时，显式使用 `items_mode=replace`。
+5. 开发完成后运行真实验证。Maven 测试命令须在输出中证明至少运行一个测试；零测试不能作为通过。审核通过后，按任务门禁完成提交。
+
+## 可选 SonarQube
+
+在当前项目的“自适应流程”页单独填写服务地址、项目 Key、扫描方式和 Token。Token 保存在本机 DSH 项目凭据中，不写入仓库；不需要 Sonar 的项目保持开关关闭。
+
+- **本地规则审核 `ide-local`**：使用项目 Quality Profile 中可本地执行的规则检查相对 Git 参考分支新增的代码；无需先提交或推送。审核会拒绝任务范围漏登的新增文件。对疑似误报，可逐条附理由和证据，请求人工批准；原始告警保留，代码变化后需重新审核。
+- **CI 结果 `ci`**：读取本次 CI 分析的 CE task ID，按服务端新代码规则和 Quality Gate 判断。
+- **上传式本机扫描 `local`**：本机扫描并上传分析；需要支持分支分析的 SonarQube 版本。
+
+每次审核都在项目 `.dsh/reviews/<任务 ID>/` 留下 Markdown 报告，任务台账可查看问题与处理状态。`ide-local` 的结果不能代替服务端完整 Quality Gate。真实且可复用的修复案例可以经预览后生成项目 Rule；误报不会自动变成 Rule。
+
+## 文档
+
+详细安装、首次初始化、四档流程、Skill/Rule、任务命令、Sonar 配置与排障见唯一的[使用手册](docs/manual.html)。插件开发与发版检查见[开发指南](docs/development.md)。仓库历史版本可通过 Git 记录查看；当前文档只描述现行功能。
+
+[MIT License](LICENSE) · [问题反馈](https://github.com/godv61/dsh-task-engine/issues)