@godv61/dsh-task-engine 0.30.1 → 0.30.2

package/.adaptive-test.mjs

@@ -116,7 +116,7 @@ test('task-plan item headings preserve the full implementation sequence', async
   await assert.rejects(f.call({ operation: 'advance', task_id: 'PLAN-1', target_stage: '代码开发' }), /I1/)
 })
 
-test('init_project rejects a feature-only project map that omits discovered modules', async () => {
+test('init_project rejects a feature-only project map that omits discovered modules', async () => {
   const f = fixture({
     'backend/pom.xml': '<project><properties><java.version>8</java.version></properties></project>',
     'frontend/package.json': '{"dependencies":{"vue":"^2.7.0"}}',
@@ -281,7 +281,7 @@ test('sonar_check runs a local scan on the recorded commit without pushing or ex
 
 test('review-only Sonar gate blocks pass until the task records CI analysis of new code', async () => {
   const f = fixture({ '.dsh/meta.json': JSON.stringify({ sonar: { enabled: true, host_url: 'https://sonar.example',
-    project_key: 'project', mode: 'branch', token_env: 'SONAR_TOKEN' } }) })
+    project_key: 'project', mode: 'branch', source: 'ci', token_env: 'SONAR_TOKEN' } }) })
   await f.call({ operation: 'create', task_id: 'S-1', title: 'change', branch: 'feature', complexity: 'low',
     complexity_reason: 'One local change', files: ['app.js'], items: [{ id: 'one', title: 'change', status: 'done' }] })
   const state = f.state('S-1')
@@ -314,7 +314,7 @@ test('review-only Sonar gate blocks pass until the task records CI analysis of n
   }
 })
 
-test('a failed Sonar finding becomes a reviewed project Rule attached to the coding Skill', async () => {
+test('a failed Sonar finding becomes a reviewed project Rule attached to the coding Skill', async () => {
   const f = fixture()
   await f.call({ operation: 'create', task_id: 'L-1', title: 'change', branch: 'feature', complexity: 'low',
     complexity_reason: 'One local change', files: ['app.js'] })
@@ -339,83 +339,92 @@ test('a failed Sonar finding becomes a reviewed project Rule attached to the cod
   assert.deepEqual(JSON.parse(f.files.get(join(f.cwd, '.dsh/skills/code-development/profile.json'))).rules,
     [{ source: 'project', name: 'handle-null-boundary' }])
   assert.deepEqual(JSON.parse(await f.call({ operation: 'status', task_id: 'L-1' })).rule_learning_candidates, [])
-})
-
-test('workbench initializes reviewed project resources directly and preserves Sonar settings', async () => {
-  const f = fixture({
-    'backend/pom.xml': '<project><properties><java.version>8</java.version></properties></project>',
-    'frontend/package.json': '{"dependencies":{"vue":"^2.7.0"}}',
-    '.dsh/meta.json': JSON.stringify({ sonar: { enabled: false, project_key: 'keep-me' } }),
-  })
-  const resources = [
-    { kind: 'rule', name: 'backend-convention', content: 'Use the backend module Maven Java 8 build for backend changes.' },
-    { kind: 'skill', name: 'adaptive-project-project-map', description: 'Reusable repository map',
-      content: 'Root package.json, backend/pom.xml and frontend/package.json define the backend and frontend modules.',
-      meta_skills: ['requirements-analysis', 'code-development'], rules: ['backend-convention'] },
-  ]
-  const receiver = {
-    authorizedPath: async path => path, fs: () => f.fs, listSkills: async () => ({ skills: [] }),
-    projectInitRoot: Controller.prototype.projectInitRoot,
-    previewProjectInit: Controller.prototype.previewProjectInit,
-    ctx: { get(name) {
-      if (name === 'llm') return { async *stream() { yield { type: 'text-delta', text: JSON.stringify({ resources }) } } }
-      if (name === 'agentDefaultModel') return { currentSelection: () => ({ provider: 'test', model: 'test' }) }
-    } },
-  }
-  const draft = await Controller.prototype.generateProjectInit.call(receiver, { path: f.cwd })
-  assert.deepEqual(draft.project_map_coverage, ['backend', 'frontend', 'package.json'])
-  assert.equal(f.files.has(join(f.cwd, '.dsh/rules/backend-convention.md')), false)
-  await assert.rejects(Controller.prototype.applyProjectInit.call(receiver,
-    { path: f.cwd, resources: draft.resources, expected_hash: 'stale', existing_hash: draft.existing_hash }), /改变/)
-  const applied = await Controller.prototype.applyProjectInit.call(receiver,
-    { path: f.cwd, resources: draft.resources, expected_hash: draft.expected_hash, existing_hash: draft.existing_hash })
-  assert.equal(applied.ok, true)
-  assert.equal(f.files.get(join(f.cwd, '.dsh/meta.json')).includes('keep-me'), true)
-  assert.equal(JSON.parse(f.files.get(join(f.cwd, '.dsh/meta.json'))).meta_bindings['code-development'][0],
-    'adaptive-project-project-map')
-  assert.ok(f.files.has(join(f.cwd, '.dsh/skills/adaptive-project-project-map/SKILL.md')))
-  await assert.rejects(Controller.prototype.previewProjectInit.call(receiver,
-    { path: f.cwd, resources }), /不能覆盖/)
-})
-
-test('a local false positive needs human approval, keeps the raw gate, and expires after code changes', async () => {
-  let allow = false
-  const approvals = []
-  const shell = { resolve: request => request, execute: async () => ({ result: async () => ({
-    exitCode: 0, timedOut: false, aborted: false, stdout: { text: 'checks passed' }, stderr: { text: '' },
-  }) }) }
-  const f = fixture({ '.dsh/meta.json': JSON.stringify({ sonar: { enabled: true,
-    host_url: 'https://sonar.example', project_key: 'project', mode: 'branch', source: 'ide-local',
-    reference_branch: 'main' } }) }, { shell,
-    approval: { request: async request => { approvals.push(request); return allow ? 'allowed-once' : 'rejected' } } })
-  await f.call({ operation: 'create', task_id: 'FP-1', title: 'one local finding', branch: 'feature',
-    complexity: 'low', complexity_reason: 'Local correction', files: ['app.js'] })
-  await f.call({ operation: 'verify', task_id: 'FP-1', command: 'check' })
-  const state = f.state('FP-1')
-  state.stage = '代码审核'
-  const finding = { key: 'local-fp-1', rule: 'mycompany-java:AvoidObjectCreationInLoop',
-    message: 'Avoid allocation', severity: 'MAJOR', file: 'app.js', line: 3 }
-  state.sonar_audit = { ce_task_id: 'local', analysis_id: 'LOCAL-1', gate: 'ERROR',
-    checked_at: '2026-10-05T00:00:00.000Z', scope_hash: state.verification.receipt.scope_hash,
-    findings: [finding], blocking: [finding], target: 'main', scanned_files: ['app.js'],
-    report_path: '.dsh/reviews/FP-1/local.md' }
-  f.files.set(join(f.cwd, '.dsh/reviews/FP-1/local.md'), 'original report')
-  f.files.set(join(f.cwd, '.dsh/task-FP-1.json'), JSON.stringify(state))
-  const args = { operation: 'sonar_disposition', task_id: 'FP-1', issue_key: finding.key,
-    disposition_reason: '每次循环需要独立实体对象，复用同一个实例会让多条授权记录互相覆盖，属于规则误报。',
-    evidence: ['授权实体逐行添加到集合，复用对象会导致所有行指向末次值'] }
-  await assert.rejects(f.call(args), /not approved/)
-  assert.equal(f.state('FP-1').sonar_audit.dispositions, undefined)
-  allow = true
-  const result = JSON.parse(await f.call(args))
-  assert.equal(result.raw_gate, 'ERROR')
-  assert.equal(result.review_gate, 'OK')
-  assert.equal(f.state('FP-1').sonar_audit.dispositions.length, 1)
-  assert.deepEqual(JSON.parse(await f.call({ operation: 'status', task_id: 'FP-1' })).rule_learning_candidates, [])
-  assert.match(approvals.at(-1).reason, /local-fp-1/)
-  assert.match(f.files.get(join(f.cwd, state.sonar_audit.report_path)), /逐项误报复核/)
-  await f.call({ operation: 'review', task_id: 'FP-1', outcome: 'pass' })
-  await assert.rejects(f.call({ operation: 'learn_rule', task_id: 'FP-1', issue_key: finding.key }), /blocking issue_key/)
-  f.files.set(join(f.cwd, 'app.js'), 'new source')
-  await assert.rejects(f.call({ operation: 'review', task_id: 'FP-1', outcome: 'pass' }), /stale/)
-})
+})
+
+test('new Sonar projects default to pre-commit review against HEAD', async () => {
+  const f = fixture({ '.dsh/meta.json': JSON.stringify({ sonar: { enabled: true,
+    host_url: 'https://sonar.example', project_key: 'project' } }) })
+  await f.call({ operation: 'create', task_id: 'PRE-1', title: 'new code', branch: 'feature',
+    complexity: 'low', complexity_reason: 'Small change', files: ['app.java'] })
+  assert.equal(f.state('PRE-1').sonar_policy.source, 'ide-local')
+  assert.equal(f.state('PRE-1').sonar_policy.reference_branch, 'HEAD')
+})
+
+test('workbench initializes reviewed project resources directly and preserves Sonar settings', async () => {
+  const f = fixture({
+    'backend/pom.xml': '<project><properties><java.version>8</java.version></properties></project>',
+    'frontend/package.json': '{"dependencies":{"vue":"^2.7.0"}}',
+    '.dsh/meta.json': JSON.stringify({ sonar: { enabled: false, project_key: 'keep-me' } }),
+  })
+  const resources = [
+    { kind: 'rule', name: 'backend-convention', content: 'Use the backend module Maven Java 8 build for backend changes.' },
+    { kind: 'skill', name: 'adaptive-project-project-map', description: 'Reusable repository map',
+      content: 'Root package.json, backend/pom.xml and frontend/package.json define the backend and frontend modules.',
+      meta_skills: ['requirements-analysis', 'code-development'], rules: ['backend-convention'] },
+  ]
+  const receiver = {
+    authorizedPath: async path => path, fs: () => f.fs, listSkills: async () => ({ skills: [] }),
+    projectInitRoot: Controller.prototype.projectInitRoot,
+    previewProjectInit: Controller.prototype.previewProjectInit,
+    ctx: { get(name) {
+      if (name === 'llm') return { async *stream() { yield { type: 'text-delta', text: JSON.stringify({ resources }) } } }
+      if (name === 'agentDefaultModel') return { currentSelection: () => ({ provider: 'test', model: 'test' }) }
+    } },
+  }
+  const draft = await Controller.prototype.generateProjectInit.call(receiver, { path: f.cwd })
+  assert.deepEqual(draft.project_map_coverage, ['backend', 'frontend', 'package.json'])
+  assert.equal(f.files.has(join(f.cwd, '.dsh/rules/backend-convention.md')), false)
+  await assert.rejects(Controller.prototype.applyProjectInit.call(receiver,
+    { path: f.cwd, resources: draft.resources, expected_hash: 'stale', existing_hash: draft.existing_hash }), /改变/)
+  const applied = await Controller.prototype.applyProjectInit.call(receiver,
+    { path: f.cwd, resources: draft.resources, expected_hash: draft.expected_hash, existing_hash: draft.existing_hash })
+  assert.equal(applied.ok, true)
+  assert.equal(f.files.get(join(f.cwd, '.dsh/meta.json')).includes('keep-me'), true)
+  assert.equal(JSON.parse(f.files.get(join(f.cwd, '.dsh/meta.json'))).meta_bindings['code-development'][0],
+    'adaptive-project-project-map')
+  assert.ok(f.files.has(join(f.cwd, '.dsh/skills/adaptive-project-project-map/SKILL.md')))
+  await assert.rejects(Controller.prototype.previewProjectInit.call(receiver,
+    { path: f.cwd, resources }), /不能覆盖/)
+})
+
+test('a local false positive needs human approval, keeps the raw gate, and expires after code changes', async () => {
+  let allow = false
+  const approvals = []
+  const shell = { resolve: request => request, execute: async () => ({ result: async () => ({
+    exitCode: 0, timedOut: false, aborted: false, stdout: { text: 'checks passed' }, stderr: { text: '' },
+  }) }) }
+  const f = fixture({ '.dsh/meta.json': JSON.stringify({ sonar: { enabled: true,
+    host_url: 'https://sonar.example', project_key: 'project', mode: 'branch', source: 'ide-local',
+    reference_branch: 'main' } }) }, { shell,
+    approval: { request: async request => { approvals.push(request); return allow ? 'allowed-once' : 'rejected' } } })
+  await f.call({ operation: 'create', task_id: 'FP-1', title: 'one local finding', branch: 'feature',
+    complexity: 'low', complexity_reason: 'Local correction', files: ['app.js'] })
+  await f.call({ operation: 'verify', task_id: 'FP-1', command: 'check' })
+  const state = f.state('FP-1')
+  state.stage = '代码审核'
+  const finding = { key: 'local-fp-1', rule: 'mycompany-java:AvoidObjectCreationInLoop',
+    message: 'Avoid allocation', severity: 'MAJOR', file: 'app.js', line: 3 }
+  state.sonar_audit = { ce_task_id: 'local', analysis_id: 'LOCAL-1', gate: 'ERROR',
+    checked_at: '2026-10-05T00:00:00.000Z', scope_hash: state.verification.receipt.scope_hash,
+    findings: [finding], blocking: [finding], target: 'main', scanned_files: ['app.js'],
+    report_path: '.dsh/reviews/FP-1/local.md' }
+  f.files.set(join(f.cwd, '.dsh/reviews/FP-1/local.md'), 'original report')
+  f.files.set(join(f.cwd, '.dsh/task-FP-1.json'), JSON.stringify(state))
+  const args = { operation: 'sonar_disposition', task_id: 'FP-1', issue_key: finding.key,
+    disposition_reason: '每次循环需要独立实体对象，复用同一个实例会让多条授权记录互相覆盖，属于规则误报。',
+    evidence: ['授权实体逐行添加到集合，复用对象会导致所有行指向末次值'] }
+  await assert.rejects(f.call(args), /not approved/)
+  assert.equal(f.state('FP-1').sonar_audit.dispositions, undefined)
+  allow = true
+  const result = JSON.parse(await f.call(args))
+  assert.equal(result.raw_gate, 'ERROR')
+  assert.equal(result.review_gate, 'OK')
+  assert.equal(f.state('FP-1').sonar_audit.dispositions.length, 1)
+  assert.deepEqual(JSON.parse(await f.call({ operation: 'status', task_id: 'FP-1' })).rule_learning_candidates, [])
+  assert.match(approvals.at(-1).reason, /local-fp-1/)
+  assert.match(f.files.get(join(f.cwd, state.sonar_audit.report_path)), /逐项误报复核/)
+  await f.call({ operation: 'review', task_id: 'FP-1', outcome: 'pass' })
+  await assert.rejects(f.call({ operation: 'learn_rule', task_id: 'FP-1', issue_key: finding.key }), /blocking issue_key/)
+  f.files.set(join(f.cwd, 'app.js'), 'new source')
+  await assert.rejects(f.call({ operation: 'review', task_id: 'FP-1', outcome: 'pass' }), /stale/)
+})

package/.evidence-test.mjs

@@ -7,11 +7,11 @@
  */
 import test from 'node:test'
 import assert from 'node:assert/strict'
-import { loadedSkills, needsSkillReceipt, skillBlockers } from './lib/skill-audit.js'
+import { loadedSkills, needsSkillReceipt, skillBlockers } from './lib/skill-audit.js'
 import { adoptRecommendation, resolveFlow } from './lib/workflows.js'
 
 /** A session that has loaded the named skills. */
-function sessionWith(names) {
+function sessionWith(names) {
   const events = []
   for (const name of names) {
     const callId = 'c' + events.length
@@ -19,20 +19,20 @@ function sessionWith(names) {
     events.push({ type: 'tool/result', data: { message: { content: [{ type: 'tool-result', toolCallId: callId, isError: false }] } } })
   }
   return { id: 's', snapshotEvents: () => events }
-}
-
-test('evidence: DSH 0.2 tool messages prove only successful task-scoped skill loads', () => {
-  const events = [
-    { type: 'tool/call', data: { name: 'dev_task', callId: 'ok', arguments: JSON.stringify({ operation: 'load_skill', task_id: 'Q-1', skill_name: 'project:qms-project-map' }) } },
-    { type: 'tool/result', data: { message: { role: 'tool', toolCallId: 'ok', isError: false, content: [{ type: 'text', text: 'loaded' }] } } },
-    { type: 'tool/call', data: { name: 'dev_task', callId: 'bad', arguments: JSON.stringify({ operation: 'load_skill', task_id: 'Q-1', skill_name: 'project:qms-tech-stack' }) } },
-    { type: 'tool/result', data: { message: { role: 'tool', toolCallId: 'bad', isError: true, content: [{ type: 'text', text: 'failed' }] } } },
-  ]
-  const loaded = loadedSkills({ snapshotEvents: () => events })
-  assert.equal(loaded.get('Q-1#project:qms-project-map'), 'ok')
-  assert.equal(loaded.has('Q-1#project:qms-tech-stack'), false)
-  assert.equal(loaded.has('Q-2#project:qms-project-map'), false)
-})
+}
+
+test('evidence: DSH 0.2 tool messages prove only successful task-scoped skill loads', () => {
+  const events = [
+    { type: 'tool/call', data: { name: 'dev_task', callId: 'ok', arguments: JSON.stringify({ operation: 'load_skill', task_id: 'Q-1', skill_name: 'project:qms-project-map' }) } },
+    { type: 'tool/result', data: { message: { role: 'tool', toolCallId: 'ok', isError: false, content: [{ type: 'text', text: 'loaded' }] } } },
+    { type: 'tool/call', data: { name: 'dev_task', callId: 'bad', arguments: JSON.stringify({ operation: 'load_skill', task_id: 'Q-1', skill_name: 'project:qms-tech-stack' }) } },
+    { type: 'tool/result', data: { message: { role: 'tool', toolCallId: 'bad', isError: true, content: [{ type: 'text', text: 'failed' }] } } },
+  ]
+  const loaded = loadedSkills({ snapshotEvents: () => events })
+  assert.equal(loaded.get('Q-1#project:qms-project-map'), 'ok')
+  assert.equal(loaded.has('Q-1#project:qms-tech-stack'), false)
+  assert.equal(loaded.has('Q-2#project:qms-project-map'), false)
+})
 
 /** A standard-flow config with one extra skill on 开发 carrying the given evidence. */
 function withEvidence(evidence) {

package/.resource-test.mjs

@@ -122,7 +122,7 @@ test('ledger shows absent storage as empty and propagates access errors',async()
  controller.fs=()=>({resolve:async p=>p,listDir:async()=>{throw Object.assign(new Error('denied'),{code:'EACCES'})}})
  await assert.rejects(()=>controller.readTasks('/project'),/denied/)
 })
-test('ledger rejects malformed records instead of pretending there are no tasks',async()=>{
+test('ledger rejects malformed records instead of pretending there are no tasks',async()=>{
  const {default:Controller}=await import('./lib/controller.js')
  const controller=Object.create(Controller.prototype)
  controller.authorizedPath=async p=>p
@@ -130,21 +130,21 @@ test('ledger rejects malformed records instead of pretending there are no tasks'
    controller.fs=()=>({resolve:async p=>p,listDir:async()=>[{name:'task-broken.json'}],readText:async()=>content})
    await assert.rejects(()=>controller.readTasks('/project'),/任务记录/)
  }
-})
-test('ledger exposes Sonar findings without project credentials',async()=>{
- const {default:Controller}=await import('./lib/controller.js')
- const controller=Object.create(Controller.prototype)
- controller.authorizedPath=async p=>p
- controller.fs=()=>({resolve:async p=>p,listDir:async()=>[{name:'task-sample.json'}],readText:async()=>JSON.stringify({
-   id:'sample',title:'Sample',stage:'代码审核',branch:'feature/sample',items:[],
-   sonar_policy:{source:'ide-local',token_env:'SONAR_TOKEN',host_url:'https://sonar.example',project_key:'sample'},
-   sonar_audit:{gate:'ERROR',checked_at:'2026-10-03T00:00:00Z',target:'main',
-     findings:[{key:'issue-1',rule:'java:S103',message:'Line too long',severity:'MAJOR',file:'Sample.java',line:3}],
-     blocking:[{key:'issue-1'}],uncovered_files:[]},
- })})
- const {tasks}=await controller.readTasks('/project')
- assert.equal(tasks[0].sonar.audit.gate,'ERROR')
- assert.equal(tasks[0].sonar.audit.blocking_count,1)
- assert.deepEqual(tasks[0].sonar.audit.findings[0],{key:'issue-1',rule:'java:S103',message:'Line too long',severity:'MAJOR',file:'Sample.java',line:3})
- assert.equal(JSON.stringify(tasks).includes('SONAR_TOKEN'),false)
-})
+})
+test('ledger exposes Sonar findings without project credentials',async()=>{
+ const {default:Controller}=await import('./lib/controller.js')
+ const controller=Object.create(Controller.prototype)
+ controller.authorizedPath=async p=>p
+ controller.fs=()=>({resolve:async p=>p,listDir:async()=>[{name:'task-sample.json'}],readText:async()=>JSON.stringify({
+   id:'sample',title:'Sample',stage:'代码审核',branch:'feature/sample',items:[],
+   sonar_policy:{source:'ide-local',token_env:'SONAR_TOKEN',host_url:'https://sonar.example',project_key:'sample'},
+   sonar_audit:{gate:'ERROR',checked_at:'2026-10-03T00:00:00Z',target:'main',
+     findings:[{key:'issue-1',rule:'java:S103',message:'Line too long',severity:'MAJOR',file:'Sample.java',line:3}],
+     blocking:[{key:'issue-1'}],uncovered_files:[]},
+ })})
+ const {tasks}=await controller.readTasks('/project')
+ assert.equal(tasks[0].sonar.audit.gate,'ERROR')
+ assert.equal(tasks[0].sonar.audit.blocking_count,1)
+ assert.deepEqual(tasks[0].sonar.audit.findings[0],{key:'issue-1',rule:'java:S103',message:'Line too long',severity:'MAJOR',file:'Sample.java',line:3})
+ assert.equal(JSON.stringify(tasks).includes('SONAR_TOKEN'),false)
+})

package/.roundtrip-test.mjs

@@ -13,16 +13,16 @@ import { dirname, join, resolve, sep } from 'node:path'
 import { resolveFlow, adoptRecommendation, compactProjectConfig, materializeBundledReferences } from './lib/workflows.js'
 import Controller from './lib/controller.js'
 import { assertAdvance, validateWorkflow } from './lib/engine.js'
-// The npm package ships the built client, not its TypeScript source. Keep the
-// source codec assertion in repository tests while allowing shipped tests to run.
-const remoteSource = new URL('./src/client/remote.ts', import.meta.url)
-const hasRemoteSource = existsSync(remoteSource)
+// The npm package ships the built client, not its TypeScript source. Keep the
+// source codec assertion in repository tests while allowing shipped tests to run.
+const remoteSource = new URL('./src/client/remote.ts', import.meta.url)
+const hasRemoteSource = existsSync(remoteSource)
 const TYPERT_REMOTE = hasRemoteSource ? (await import(remoteSource.href)).TYPERT_REMOTE : undefined
 
 /** The fields a project config can carry, so a round-trip is checked on all of them. */
 const FIELDS = ['flow', 'stage_bindings', 'commit', 'artifacts', 'review_depth', 'commit_required']
 
-test('browser remote codec retains source-qualified bindings and all saved fields',
+test('browser remote codec retains source-qualified bindings and all saved fields',
   { skip: hasRemoteSource ? false : 'TypeScript source is excluded from the npm package' }, () => {
   const write = TYPERT_REMOTE.descriptors.find(descriptor => descriptor.method === 'write')
   const read = TYPERT_REMOTE.descriptors.find(descriptor => descriptor.method === 'read')

package/.sonar-credential-test.mjs

@@ -1,38 +1,38 @@
-import assert from 'node:assert/strict'
-import { test } from 'node:test'
-import { resolveSonarToken, sonarCredentialRef } from './lib/sonar-credential.js'
-import Controller from './lib/controller.js'
-
-test('Sonar credential references stay distinct for different workspaces', () => {
-  const qms = sonarCredentialRef('D:/projects/qms')
-  const eam = sonarCredentialRef('D:/projects/eam')
-  assert.match(qms, /^DSH_TASK_ENGINE_SONAR_[A-F0-9]{24}$/)
-  assert.notEqual(qms, eam)
-  assert.equal(qms, sonarCredentialRef('D:/projects/qms'))
-  assert.ok(!qms.includes('qms'))
-  if (process.platform === 'win32') assert.equal(qms, sonarCredentialRef('d:/PROJECTS/QMS'))
-})
-
-test('Sonar token management keeps each workspace value private', async () => {
-  const stored = new Map()
-  const credentials = {
-    describe: async ref => ({ configured: stored.has(ref), writable: true, source: stored.has(ref) ? 'file' : undefined }),
-    set: async (ref, value) => { stored.set(ref, value) },
-    unset: async ref => { stored.delete(ref) },
-    resolve: async ref => stored.has(ref) ? { value: stored.get(ref), source: 'file' } : undefined,
-  }
-  const controller = Object.create(Controller.prototype)
-  controller.authorizedPath = async path => path
-  Object.defineProperty(controller, 'ctx', { value: { get: name => name === 'credentials' ? credentials : undefined } })
-  const qms = 'D:/projects/qms'
-  const eam = 'D:/projects/eam'
-  const result = await controller.setSonarToken({ path: qms, token: 'qms-secret' })
-  assert.equal(result.configured, true)
-  assert.ok(!JSON.stringify(result).includes('qms-secret'))
-  assert.equal((await controller.describeSonarToken(eam)).configured, false)
-  assert.equal((await credentials.resolve(sonarCredentialRef(qms))).value, 'qms-secret')
-  assert.equal(await resolveSonarToken(credentials, qms, 'old-env-token'), 'qms-secret')
-  assert.equal(await resolveSonarToken(credentials, eam, 'old-env-token'), 'old-env-token')
-  await controller.unsetSonarToken(qms)
-  assert.equal((await controller.describeSonarToken(qms)).configured, false)
-})
+import assert from 'node:assert/strict'
+import { test } from 'node:test'
+import { resolveSonarToken, sonarCredentialRef } from './lib/sonar-credential.js'
+import Controller from './lib/controller.js'
+
+test('Sonar credential references stay distinct for different workspaces', () => {
+  const qms = sonarCredentialRef('D:/projects/qms')
+  const eam = sonarCredentialRef('D:/projects/eam')
+  assert.match(qms, /^DSH_TASK_ENGINE_SONAR_[A-F0-9]{24}$/)
+  assert.notEqual(qms, eam)
+  assert.equal(qms, sonarCredentialRef('D:/projects/qms'))
+  assert.ok(!qms.includes('qms'))
+  if (process.platform === 'win32') assert.equal(qms, sonarCredentialRef('d:/PROJECTS/QMS'))
+})
+
+test('Sonar token management keeps each workspace value private', async () => {
+  const stored = new Map()
+  const credentials = {
+    describe: async ref => ({ configured: stored.has(ref), writable: true, source: stored.has(ref) ? 'file' : undefined }),
+    set: async (ref, value) => { stored.set(ref, value) },
+    unset: async ref => { stored.delete(ref) },
+    resolve: async ref => stored.has(ref) ? { value: stored.get(ref), source: 'file' } : undefined,
+  }
+  const controller = Object.create(Controller.prototype)
+  controller.authorizedPath = async path => path
+  Object.defineProperty(controller, 'ctx', { value: { get: name => name === 'credentials' ? credentials : undefined } })
+  const qms = 'D:/projects/qms'
+  const eam = 'D:/projects/eam'
+  const result = await controller.setSonarToken({ path: qms, token: 'qms-secret' })
+  assert.equal(result.configured, true)
+  assert.ok(!JSON.stringify(result).includes('qms-secret'))
+  assert.equal((await controller.describeSonarToken(eam)).configured, false)
+  assert.equal((await credentials.resolve(sonarCredentialRef(qms))).value, 'qms-secret')
+  assert.equal(await resolveSonarToken(credentials, qms, 'old-env-token'), 'qms-secret')
+  assert.equal(await resolveSonarToken(credentials, eam, 'old-env-token'), 'old-env-token')
+  await controller.unsetSonarToken(qms)
+  assert.equal((await controller.describeSonarToken(qms)).configured, false)
+})

package/.sonarlint-local-test.mjs

@@ -4,7 +4,7 @@ import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { test } from 'node:test'
-import { changedLines, missingLocalAuditScope, uncoveredLocalFiles } from './lib/sonarlint-local.js'
+import { changedLines, missingLocalAuditScope, uncoveredLocalFiles } from './lib/sonarlint-local.js'
 import { isIncludedAuditPath, validAuditIncludePaths } from './lib/sonar.js'
 import { renderSonarReport, sonarReportPath } from './lib/sonar-report.js'
 
@@ -21,16 +21,19 @@ test('one review gets a credential-free Markdown report path and issue details',
   const audit = { analysis_id: 'abc12345-0000', checked_at: '2026-10-03T10:11:12.000Z',
     target: 'qdm_gw_chemical_260930', gate: 'ERROR', findings: [{key:'x',rule:'java:S103',
       severity:'MAJOR',file:'A.java',line:12,message:'Line too long'}], blocking:[{key:'x'}],
-    scanned_files:['A.java'],uncovered_files:[] }
+    scanned_files:['A.java'],uncovered_files:[],
+    profile_coverage:[{language:'JAVA',active_rules:66,analyzer:'SYNCED'}] }
   const path = sonarReportPath('QMS-1', audit)
   assert.match(path, /^\.dsh\/reviews\/QMS-1\/2026-/)
   const report = renderSonarReport('QMS-1', {source:'ide-local',project_key:'project',include_paths:['fp-bussiness']}, audit)
   assert.match(report, /java:S103/)
   assert.match(report, /A.java:12/)
+  assert.match(report, /JAVA：服务端启用 66 条规则；本地分析器 SYNCED/)
+  assert.match(report, /不等同 SonarQube 服务端完整扫描或 Quality Gate/)
   assert.equal(report.includes('token-secret'),false)
 })
 
-test('unsupported files block only when the project has active rules for their language', () => {
+test('unsupported files block only when the project has active rules for their language', () => {
   const paths = ['migration.sql', 'settings.json', 'script.py']
   const profiles = [
     { language: 'java', activeRuleCount: 66 },
@@ -40,13 +43,13 @@ test('unsupported files block only when the project has active rules for their l
   assert.deepEqual(uncoveredLocalFiles(paths, profiles), ['script.py'])
   assert.deepEqual(uncoveredLocalFiles(paths, [...profiles, { language: 'plsql', activeRuleCount: 5 }]),
     ['migration.sql', 'script.py'])
-})
-
-test('local audit detects changed backend files omitted from the task scope', () => {
-  assert.deepEqual(missingLocalAuditScope(['fp-bussiness/A.java', 'fp-bussiness/B.java'],
-    ['fp-bussiness/A.java', 'fp-ruoyi-ui/view.vue']), ['fp-bussiness/B.java'])
-  assert.deepEqual(missingLocalAuditScope(['fp-bussiness/A.java'], ['./FP-BUSSINESS\\A.java']), [])
-})
+})
+
+test('local audit detects changed backend files omitted from the task scope', () => {
+  assert.deepEqual(missingLocalAuditScope(['fp-bussiness/A.java', 'fp-bussiness/B.java'],
+    ['fp-bussiness/A.java', 'fp-ruoyi-ui/view.vue']), ['fp-bussiness/B.java'])
+  assert.deepEqual(missingLocalAuditScope(['fp-bussiness/A.java'], ['./FP-BUSSINESS\\A.java']), [])
+})
 
 test('local Sonar audit considers Git new code but excludes generated DSH records', async () => {
   const root = mkdtempSync(join(tmpdir(), 'dsh-sonarlint-diff-test-'))

package/.workflow-test.mjs

@@ -4,7 +4,7 @@ import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join, resolve, sep } from 'node:path'
 import { registerDevTask } from './lib/dev-task.js'
-import { newTask, validateWorkflow, verificationBlockers } from './lib/engine.js'
+import { newTask, validateWorkflow, verificationBlockers } from './lib/engine.js'
 import { adoptRecommendation, resolveFlow, retainStageBindings } from './lib/workflows.js'
 import Controller from './lib/controller.js'
 import { registerShippedSkills } from './lib/shipped-skills.js'
@@ -216,42 +216,42 @@ test('重排实施项时不静默丢弃已完成项和审查记录', async () =>
   await f.call({ operation: 'dispatch', item_id: 'I1', description: 'direct implementation' })
   await f.call({ operation: 'review_item', item_id: 'I1', spec_outcome: 'pass', quality_outcome: 'pass' })
   await f.call({ operation: 'items', items: [{ id: 'I1', status: 'done' }, { id: 'I2' }] })
-  await f.call({ operation: 'items', items: [{ id: 'I3', title: 'service', status: 'todo' }] })
-  assert.deepEqual(f.state().items.map(item => item.id), ['I1', 'I2', 'I3'])
-  assert.equal(f.state().items[0].status, 'done')
-  assert.equal(f.state().items[0].review.quality.outcome, 'pass')
-  assert.equal(f.state().items[0].dispatch.description, 'direct implementation')
-  await f.call({ operation: 'items', items_mode: 'replace', items: [{ id: 'I3', title: 'service', status: 'todo' }] })
-  assert.deepEqual(f.state().items.map(item => item.id), ['I3', 'I1'])
-})
-
-test('Maven verify rejects zero or missing Surefire tests even when the command exits zero', async () => {
-  let output = 'Tests run: 0, Failures: 0, Errors: 0, Skipped: 0'
-  const shell = { resolve: request => request, execute: async () => ({ result: async () => ({
-    exitCode: 0, timedOut: false, aborted: false, stdout: { text: output }, stderr: { text: '' },
-  }) }) }
-  const f = fixture('交付', {}, { shell })
-  await f.call({ operation: 'verify', command: 'mvn -q test' })
-  assert.equal(f.state().verification.passed, false)
-  assert.equal(f.state().verification.receipt.test_summary.count, 0)
-  output = 'BUILD SUCCESS'
-  await f.call({ operation: 'verify', command: 'mvn -q test' })
-  assert.equal(f.state().verification.passed, false)
-  assert.equal(f.state().verification.receipt.test_summary.count, null)
-  output = 'Tests run: 23, Failures: 0, Errors: 0, Skipped: 0'
-  await f.call({ operation: 'verify', command: 'mvn test' })
-  assert.equal(f.state().verification.passed, true)
-  assert.equal(f.state().verification.receipt.test_summary.count, 23)
-})
-
-test('a previously stored Maven zero-test pass is blocked by current workflow gates', () => {
-  const f = fixture('代码审核')
-  const state = f.state()
-  state.verification = { passed: true, evidence: [], receipt: { command: 'mvn test', exit_code: 0,
-    timed_out: false, aborted: false, started_at: 'now', finished_at: 'now',
-    stdout: 'Tests run: 0, Failures: 0, Errors: 0, Skipped: 0', stderr: '' } }
-  assert.match(verificationBlockers(state, state.flow.config).join(' '), /no nonzero Surefire/)
-})
+  await f.call({ operation: 'items', items: [{ id: 'I3', title: 'service', status: 'todo' }] })
+  assert.deepEqual(f.state().items.map(item => item.id), ['I1', 'I2', 'I3'])
+  assert.equal(f.state().items[0].status, 'done')
+  assert.equal(f.state().items[0].review.quality.outcome, 'pass')
+  assert.equal(f.state().items[0].dispatch.description, 'direct implementation')
+  await f.call({ operation: 'items', items_mode: 'replace', items: [{ id: 'I3', title: 'service', status: 'todo' }] })
+  assert.deepEqual(f.state().items.map(item => item.id), ['I3', 'I1'])
+})
+
+test('Maven verify rejects zero or missing Surefire tests even when the command exits zero', async () => {
+  let output = 'Tests run: 0, Failures: 0, Errors: 0, Skipped: 0'
+  const shell = { resolve: request => request, execute: async () => ({ result: async () => ({
+    exitCode: 0, timedOut: false, aborted: false, stdout: { text: output }, stderr: { text: '' },
+  }) }) }
+  const f = fixture('交付', {}, { shell })
+  await f.call({ operation: 'verify', command: 'mvn -q test' })
+  assert.equal(f.state().verification.passed, false)
+  assert.equal(f.state().verification.receipt.test_summary.count, 0)
+  output = 'BUILD SUCCESS'
+  await f.call({ operation: 'verify', command: 'mvn -q test' })
+  assert.equal(f.state().verification.passed, false)
+  assert.equal(f.state().verification.receipt.test_summary.count, null)
+  output = 'Tests run: 23, Failures: 0, Errors: 0, Skipped: 0'
+  await f.call({ operation: 'verify', command: 'mvn test' })
+  assert.equal(f.state().verification.passed, true)
+  assert.equal(f.state().verification.receipt.test_summary.count, 23)
+})
+
+test('a previously stored Maven zero-test pass is blocked by current workflow gates', () => {
+  const f = fixture('代码审核')
+  const state = f.state()
+  state.verification = { passed: true, evidence: [], receipt: { command: 'mvn test', exit_code: 0,
+    timed_out: false, aborted: false, started_at: 'now', finished_at: 'now',
+    stdout: 'Tests run: 0, Failures: 0, Errors: 0, Skipped: 0', stderr: '' } }
+  assert.match(verificationBlockers(state, state.flow.config).join(' '), /no nonzero Surefire/)
+})
 
 test('派发立即反映进行中，重派不复用旧审核且保持单一进行项', async () => {
   const f = fixture()