@hongmaple0820/scale-engine 0.24.0 → 0.25.0

package/README.en.md

@@ -1,47 +1,47 @@
 <p align="center">
-  <img src="https://img.shields.io/badge/version-0.23.0-orange?style=flat-square" alt="version" />
+  <img src="https://img.shields.io/badge/version-0.23.0-orange?style=flat-square" alt="version" />
   <img src="https://img.shields.io/badge/platforms-16-blue?style=flat-square" alt="platforms" />
   <img src="https://img.shields.io/badge/agents-12-blue?style=flat-square" alt="agents" />
   <img src="https://img.shields.io/badge/workflows-10-green?style=flat-square" alt="workflows" />
   <img src="https://img.shields.io/badge/detectors-19-red?style=flat-square" alt="detectors" />
   <img src="https://img.shields.io/badge/tests-verified-brightgreen?style=flat-square" alt="tests" />
-  <img src="https://img.shields.io/badge/npm-0.23.0-cb3837?style=flat-square&logo=npm" alt="npm" />
-</p>
-
-# SCALE Engine v0.23.0
+  <img src="https://img.shields.io/badge/npm-0.23.0-cb3837?style=flat-square&logo=npm" alt="npm" />
+</p>
+
+# SCALE Engine v0.23.0
 
 SCALE Engine makes AI coding agents follow engineering rules through executable workflow gates, evidence files, and review constraints instead of relying on prompt discipline alone. It helps humans see what the agent explored, planned, verified, skipped, and why a task is or is not ready to ship.
 
-Repository: https://github.com/hongmaple0820/scale-engine
-Mirror: https://gitee.com/hongmaple/scale-engine
-npm: https://www.npmjs.com/package/@hongmaple0820/scale-engine
-Language: [English](README.en.md) | [Chinese](README.md)
-
-## Community
-
-SCALE Engine is an engineering workflow governance project for real AI-agent delivery. Contributions, issues, PRs, governance-pack ideas, and field reports are welcome through the source repositories. Chinese users can also follow the WeChat public account for updates, examples, and community entry points.
-
-| Platform | Link | Purpose |
-| --- | --- | --- |
-| GitHub | [https://github.com/hongmaple0820/scale-engine](https://github.com/hongmaple0820/scale-engine) | Source, issues, and PRs |
-| Gitee | [https://gitee.com/hongmaple/scale-engine](https://gitee.com/hongmaple/scale-engine) | China mirror and feedback |
-| npm | [https://www.npmjs.com/package/@hongmaple0820/scale-engine](https://www.npmjs.com/package/@hongmaple0820/scale-engine) | CLI package |
-
-<p align="center">
-  <img src="image/wechat-public.jpg" alt="SCALE Engine WeChat public account" width="220" />
-</p>
-
-## Sponsorship
-
-If SCALE Engine saves engineering governance time for your team, or helps move AI-agent work into a verifiable, reviewable, and releasable loop, voluntary sponsorship is welcome. Sponsorship supports maintenance, examples, documentation, test coverage, and community support. It is not a commercial support contract and does not change issue or PR priority.
-
-<p align="center">
-  <img src="image/wxPay.jpg" alt="Sponsor with WeChat Pay" width="220" />
-  &nbsp;&nbsp;
-  <img src="image/zfb.jpg" alt="Sponsor with Alipay" width="220" />
-</p>
-
-## What It Solves
+Repository: https://github.com/hongmaple0820/scale-engine
+Mirror: https://gitee.com/hongmaple/scale-engine
+npm: https://www.npmjs.com/package/@hongmaple0820/scale-engine
+Language: [English](README.en.md) | [Chinese](README.md)
+
+## Community
+
+SCALE Engine is an engineering workflow governance project for real AI-agent delivery. Contributions, issues, PRs, governance-pack ideas, and field reports are welcome through the source repositories. Chinese users can also follow the WeChat public account for updates, examples, and community entry points.
+
+| Platform | Link | Purpose |
+| --- | --- | --- |
+| GitHub | [https://github.com/hongmaple0820/scale-engine](https://github.com/hongmaple0820/scale-engine) | Source, issues, and PRs |
+| Gitee | [https://gitee.com/hongmaple/scale-engine](https://gitee.com/hongmaple/scale-engine) | China mirror and feedback |
+| npm | [https://www.npmjs.com/package/@hongmaple0820/scale-engine](https://www.npmjs.com/package/@hongmaple0820/scale-engine) | CLI package |
+
+<p align="center">
+  <img src="image/wechat-public.jpg" alt="SCALE Engine WeChat public account" width="220" />
+</p>
+
+## Sponsorship
+
+If SCALE Engine saves engineering governance time for your team, or helps move AI-agent work into a verifiable, reviewable, and releasable loop, voluntary sponsorship is welcome. Sponsorship supports maintenance, examples, documentation, test coverage, and community support. It is not a commercial support contract and does not change issue or PR priority.
+
+<p align="center">
+  <img src="image/wxPay.jpg" alt="Sponsor with WeChat Pay" width="220" />
+  &nbsp;&nbsp;
+  <img src="image/zfb.jpg" alt="Sponsor with Alipay" width="220" />
+</p>
+
+## What It Solves
 
 AI coding becomes hard when agents must behave consistently across real teams and real repositories:
 
@@ -210,6 +210,16 @@ Git branch governance follows a GitLab Flow variant: short branches merge into `
 
 G7 `SecurityGate` includes a lightweight built-in scan for hardcoded secrets, private keys, disabled TLS verification, `eval`/`Function`, raw HTML injection, dangerous shell commands, shell execution, and empty `catch` blocks. Compatibility mode blocks CRITICAL findings; strict mode also blocks HIGH findings.
 
+## Skill and Tool Governance
+
+Skill Radar recommends skills, MCP servers, browser automation, desktop automation, planning workflows, memory providers, and external CLIs by task intent. It returns confidence, safety level, evidence requirements, attribution metadata, and fallback behavior.
+
+Third-party skills stay review-required until source, scripts, license, attribution, and pinned revision are checked. `OthmanAdi/planning-with-files` (MIT), `rohitg00/agentmemory` (Apache-2.0), and `garrytan/gbrain` (MIT) have explicit attribution records; other external skills, MCP servers, CLIs, adapters, and discovery candidates are tracked in the [External Reference Inventory](docs/EXTERNAL_REFERENCES.md) with unknown licenses kept `review-required`. SCALE records them as governed references, optional integrations, or adapted concepts; it does not vendor upstream source code.
+
+Memory is provider-routed rather than expanded as a built-in Memory OS. Agents can use `scale memory provider status` and `scale memory provider recall` to select `agentmemory`, `gbrain`, or `scale-local` under policy; external providers are read-only by default and fall back to local evidence-backed memory.
+
+See [Skill Radar](docs/SKILL_RADAR.md), [Third-Party Skills](docs/THIRD_PARTY_SKILLS.md), and [External Reference Inventory](docs/EXTERNAL_REFERENCES.md).
+
 ## Supported Platforms
 
 SCALE Engine includes adapters for 16 agent platforms, including Claude Code, Codex CLI, OpenCode, Cursor, Gemini CLI, OpenClaw, Hermes, Trae, WorkBuddy, VS Code Copilot CLI, QCoder, DeepSeek-TUI, Aider, Windsurf, Kimi, and Doubao.

package/README.md

@@ -1,61 +1,61 @@
 <p align="center">
-  <img src="https://img.shields.io/badge/version-0.23.0-orange?style=flat-square" alt="version" />
+  <img src="https://img.shields.io/badge/version-0.23.0-orange?style=flat-square" alt="version" />
   <img src="https://img.shields.io/badge/platforms-16-blue?style=flat-square" alt="platforms" />
   <img src="https://img.shields.io/badge/agents-12-blue?style=flat-square" alt="agents" />
   <img src="https://img.shields.io/badge/workflows-10-green?style=flat-square" alt="workflows" />
   <img src="https://img.shields.io/badge/detectors-19-red?style=flat-square" alt="detectors" />
   <img src="https://img.shields.io/badge/tests-verified-brightgreen?style=flat-square" alt="tests" />
-  <img src="https://img.shields.io/badge/npm-0.23.0-cb3837?style=flat-square&logo=npm" alt="npm" />
-</p>
-
-# SCALE Engine v0.23.0
+  <img src="https://img.shields.io/badge/npm-0.23.0-cb3837?style=flat-square&logo=npm" alt="npm" />
+</p>
+
+# SCALE Engine v0.23.0
 
 SCALE Engine 让 AI Agent 不再只靠“自觉”遵守工程规范。它把探索、规划、实现、验证、评审、发版这些要求变成可执行的命令、门禁和证据文件，让人类可以看见 Agent 做了什么、跳过了什么、为什么能交付或不能交付。
 
-源码仓库：https://github.com/hongmaple0820/scale-engine
-国内镜像：https://gitee.com/hongmaple/scale-engine
-npm：https://www.npmjs.com/package/@hongmaple0820/scale-engine
-语言：[中文](README.md) | [English](README.en.md)
-
-## 先怎么学
-
-如果你第一次接触 SCALE，不要从完整命令列表开始读。按这个顺序更容易掌握：
-
-| 目标 | 入口 | 你应该学会什么 |
-| --- | --- | --- |
-| 先跑起来 | [3 分钟快速开始](docs/start/quickstart.md) | 安装 CLI、初始化治理文件、运行 preflight |
-| 看完整闭环 | [官方 Demo Walkthrough](docs/start/agent-governance-demo.md) | 任务上下文、诊断、TDD、artifact 和验证证据如何串起来 |
-| 接入已有项目 | [SCALE 工作流升级指南](docs/start/workflow-upgrade.md) | `init`、`upgrade check/plan/apply`、本地 `make` 包装入口怎么用 |
-| 选择治理包 | 本文的 Governance Pack 章节 | 不同项目形态应该选哪个 pack |
-| 维护或扩展 SCALE | [docs/README.md](docs/README.md) | 文档地图、内部模块和长期维护资料 |
-
-一句话理解：SCALE 不是让 Agent 多写文档，而是让“做了什么、验证了什么、没验证什么”可追踪。
-
-## 社区与推广
-
-SCALE Engine 是一个面向真实工程交付的 Agent 工作流治理项目。欢迎通过源码仓库提交 Issue、PR、场景反馈和治理包改进建议；中文用户也可以关注公众号获取更新、示例和社区入口。
-
-| 平台 | 链接 | 说明 |
-|------|------|------|
-| GitHub | [https://github.com/hongmaple0820/scale-engine](https://github.com/hongmaple0820/scale-engine) | 源码、Issues、PR |
-| Gitee | [https://gitee.com/hongmaple/scale-engine](https://gitee.com/hongmaple/scale-engine) | 国内镜像与反馈 |
-| npm | [https://www.npmjs.com/package/@hongmaple0820/scale-engine](https://www.npmjs.com/package/@hongmaple0820/scale-engine) | CLI 包下载 |
-
-<p align="center">
-  <img src="image/wechat-public.jpg" alt="SCALE Engine 微信公众号" width="220" />
-</p>
-
-## 赞助与支持
-
-如果 SCALE Engine 节省了你的工程治理时间，或帮助你的团队把 AI Agent 工作流落到可验证、可复盘、可发版的闭环里，欢迎自愿赞助。赞助用于持续维护、示例项目、文档、测试矩阵和社区支持，不构成商业支持承诺，也不会改变 Issue 或 PR 的处理优先级。
-
-<p align="center">
-  <img src="image/wxPay.jpg" alt="微信赞助" width="220" />
-  &nbsp;&nbsp;
-  <img src="image/zfb.jpg" alt="支付宝赞助" width="220" />
-</p>
-
-## 它解决什么问题
+源码仓库：https://github.com/hongmaple0820/scale-engine
+国内镜像：https://gitee.com/hongmaple/scale-engine
+npm：https://www.npmjs.com/package/@hongmaple0820/scale-engine
+语言：[中文](README.md) | [English](README.en.md)
+
+## 先怎么学
+
+如果你第一次接触 SCALE，不要从完整命令列表开始读。按这个顺序更容易掌握：
+
+| 目标 | 入口 | 你应该学会什么 |
+| --- | --- | --- |
+| 先跑起来 | [3 分钟快速开始](docs/start/quickstart.md) | 安装 CLI、初始化治理文件、运行 preflight |
+| 看完整闭环 | [官方 Demo Walkthrough](docs/start/agent-governance-demo.md) | 任务上下文、诊断、TDD、artifact 和验证证据如何串起来 |
+| 接入已有项目 | [SCALE 工作流升级指南](docs/start/workflow-upgrade.md) | `init`、`upgrade check/plan/apply`、本地 `make` 包装入口怎么用 |
+| 选择治理包 | 本文的 Governance Pack 章节 | 不同项目形态应该选哪个 pack |
+| 维护或扩展 SCALE | [docs/README.md](docs/README.md) | 文档地图、内部模块和长期维护资料 |
+
+一句话理解：SCALE 不是让 Agent 多写文档，而是让“做了什么、验证了什么、没验证什么”可追踪。
+
+## 社区与推广
+
+SCALE Engine 是一个面向真实工程交付的 Agent 工作流治理项目。欢迎通过源码仓库提交 Issue、PR、场景反馈和治理包改进建议；中文用户也可以关注公众号获取更新、示例和社区入口。
+
+| 平台 | 链接 | 说明 |
+|------|------|------|
+| GitHub | [https://github.com/hongmaple0820/scale-engine](https://github.com/hongmaple0820/scale-engine) | 源码、Issues、PR |
+| Gitee | [https://gitee.com/hongmaple/scale-engine](https://gitee.com/hongmaple/scale-engine) | 国内镜像与反馈 |
+| npm | [https://www.npmjs.com/package/@hongmaple0820/scale-engine](https://www.npmjs.com/package/@hongmaple0820/scale-engine) | CLI 包下载 |
+
+<p align="center">
+  <img src="image/wechat-public.jpg" alt="SCALE Engine 微信公众号" width="220" />
+</p>
+
+## 赞助与支持
+
+如果 SCALE Engine 节省了你的工程治理时间，或帮助你的团队把 AI Agent 工作流落到可验证、可复盘、可发版的闭环里，欢迎自愿赞助。赞助用于持续维护、示例项目、文档、测试矩阵和社区支持，不构成商业支持承诺，也不会改变 Issue 或 PR 的处理优先级。
+
+<p align="center">
+  <img src="image/wxPay.jpg" alt="微信赞助" width="220" />
+  &nbsp;&nbsp;
+  <img src="image/zfb.jpg" alt="支付宝赞助" width="220" />
+</p>
+
+## 它解决什么问题
 
 AI 编码真正难的不是“写代码”，而是持续稳定地遵守工程纪律：
 
@@ -150,11 +150,11 @@ scale skill outdated --dir .
 - `scale tools outdated` 和 `scale skill outdated` 只列出更新面、来源、信任等级和安全策略，不做自动安装。
 - 第三方社区来源默认人工评审，高权限桌面自动化默认阻断自动升级。
 
-详细说明见 [升级管理](docs/UPGRADE_MANAGEMENT.md)。
-
-新用户和项目维护者可先看 [SCALE workflow upgrade guide](docs/start/workflow-upgrade.md)，它把 `scale init --interactive`、`scale upgrade check/plan/apply/rollback` 和仓库本地 `make workflow-upgrade-*` 入口放在一条可执行路径里。
-
-## Governance Pack
+详细说明见 [升级管理](docs/UPGRADE_MANAGEMENT.md)。
+
+新用户和项目维护者可先看 [SCALE workflow upgrade guide](docs/start/workflow-upgrade.md)，它把 `scale init --interactive`、`scale upgrade check/plan/apply/rollback` 和仓库本地 `make workflow-upgrade-*` 入口放在一条可执行路径里。
+
+## Governance Pack
 
 在已有项目中安装治理工作流：
 
@@ -318,7 +318,9 @@ scale skill doctor --supply-chain
 
 Desktop CUA and external agent CLIs are blocked by default through Tool Policy until deliberately enabled. Third-party skills stay review-required until source, scripts, license, and pinned revision are checked.
 
-See [Skill Radar](docs/SKILL_RADAR.md).
+新引入或借鉴的社区 skills 必须保留来源、授权、致谢和使用边界。`OthmanAdi/planning-with-files`（MIT）、`rohitg00/agentmemory`（Apache-2.0）和 `garrytan/gbrain`（MIT）已完成明确登记；其他外部 skills、MCP、CLI、适配器和发现候选统一登记在 [External Reference Inventory](docs/EXTERNAL_REFERENCES.md)，未知许可证保持 `review-required`。SCALE 目前只做治理登记、可选集成和方法借鉴，不直接 vendoring 上游源码。
+
+See [Skill Radar](docs/SKILL_RADAR.md), [Third-Party Skills](docs/THIRD_PARTY_SKILLS.md), and [External Reference Inventory](docs/EXTERNAL_REFERENCES.md).
 
 ## Memory Brain
 
@@ -331,8 +333,12 @@ scale memory query "OAuth callback state design"
 scale memory contradictions --json
 scale memory dream --json
 scale memory promote <candidate-id>
+scale memory provider status --json
+scale memory provider recall "OAuth callback Redis state" --json
 ```
 
+Strong memory is now provider-routed instead of expanded as a built-in Memory OS. SCALE treats `agentmemory`, `gbrain`, and `scale-local` as governed providers with read-only external defaults, privacy boundaries, fallback, and evidence records so agents can recall memory autonomously by task.
+
 The point is not to remember everything. The point is to keep useful, reviewed project facts while reporting contradictions instead of silently overwriting them.
 
 See [Memory Brain](docs/MEMORY_BRAIN.md).

package/dist/api/cli.js

@@ -65,7 +65,7 @@ import { renderGovernanceDashboard } from '../output/GovernanceDashboard.js';
 import { cleanupWorkspaceLifecycle, inspectWorkspaceLifecycle, } from '../workflow/WorkspaceLifecycle.js';
 import { inspectWorkspaceSafety } from '../workflow/WorkspaceSafety.js';
 import { RuntimeEvidenceLedger, SessionLedger, doctorRuntimeEvidence, evaluateFinalReportReadiness, } from '../runtime/index.js';
-import { MemoryFabric, MemoryBrain, doctorMemoryFabric, renderContextPackMarkdown, renderMemoryLearningCandidateMarkdown, settleMemoryLearning, } from '../memory/index.js';
+import { MemoryFabric, MemoryBrain, doctorMemoryFabric, renderContextPackMarkdown, renderMemoryLearningCandidateMarkdown, inspectMemoryProviders, recallMemoryProviders, settleMemoryLearning, writeMemoryProvidersConfig, } from '../memory/index.js';
 import { resolveWorkspaceTopology, workspaceTopologyPath, workspaceTopologyTemplate, } from '../workflow/WorkspaceTopology.js';
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
@@ -4335,6 +4335,97 @@ const memoryImport = defineCommand({
             process.exitCode = 1;
     },
 });
+const memoryProviderInit = defineCommand({
+    meta: { name: 'init', description: 'Create .scale/memory-providers.json for autonomous memory provider routing' },
+    args: {
+        force: { type: 'boolean', default: false, description: 'Overwrite existing provider configuration' },
+        json: { type: 'boolean', default: false },
+    },
+    run({ args }) {
+        const result = writeMemoryProvidersConfig({
+            projectDir: PROJECT_DIR,
+            scaleDir: SCALE_DIR,
+            force: isTruthyFlag(args.force),
+        });
+        if (args.json) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        console.log(`\nSCALE Memory Provider Config: ${result.path}`);
+        console.log(`  ${result.written ? 'written' : 'exists'}`);
+        console.log(`  Order: ${result.config.routing.defaultOrder.join(' -> ')}`);
+    },
+});
+const memoryProviderStatus = defineCommand({
+    meta: { name: 'status', description: 'Inspect memory provider routing, availability, and safety boundaries' },
+    args: {
+        json: { type: 'boolean', default: false },
+    },
+    run({ args }) {
+        const report = inspectMemoryProviders({ projectDir: PROJECT_DIR, scaleDir: SCALE_DIR });
+        if (args.json) {
+            console.log(JSON.stringify(report, null, 2));
+            return;
+        }
+        console.log('\nSCALE Memory Providers');
+        console.log(`  Config: ${report.configExists ? report.configPath : 'default policy (not written)'}`);
+        console.log(`  Mode: ${report.routing.mode}`);
+        for (const provider of report.providers) {
+            console.log(`  [${provider.available ? 'AVAILABLE' : 'SKIP'}] ${provider.id} (${provider.kind})`);
+            console.log(`    safety: ${provider.safetyLevel}; write: ${provider.writeMode}; reason: ${provider.reason}`);
+        }
+        for (const warning of report.warnings)
+            console.log(`  [WARN] ${warning}`);
+    },
+});
+const memoryProviderRecall = defineCommand({
+    meta: { name: 'recall', description: 'Recall relevant memory through provider routing with local fallback' },
+    args: {
+        query: { type: 'positional', required: true, description: 'Memory query or task context' },
+        task: { type: 'string', description: 'Optional task text for provider routing context' },
+        files: { type: 'string', description: 'Comma-separated files or modules in scope' },
+        provider: { type: 'string', description: 'Force one provider id, such as agentmemory, gbrain, or scale-local' },
+        limit: { type: 'string', default: '5', description: 'Maximum results' },
+        'include-candidates': { type: 'boolean', default: false, description: 'Allow scale-local candidate memory fallback' },
+        json: { type: 'boolean', default: false },
+    },
+    async run({ args }) {
+        const limit = Number.parseInt(String(args.limit ?? '5'), 10);
+        const report = await recallMemoryProviders({
+            projectDir: PROJECT_DIR,
+            scaleDir: SCALE_DIR,
+            query: String(args.query),
+            task: args.task ? String(args.task) : undefined,
+            files: parseCommaList(args.files),
+            provider: args.provider ? String(args.provider) : undefined,
+            limit: Number.isFinite(limit) && limit > 0 ? limit : 5,
+            includeCandidates: isTruthyFlag(args['include-candidates']),
+        });
+        if (args.json) {
+            console.log(JSON.stringify(report, null, 2));
+            return;
+        }
+        console.log('\nSCALE Memory Provider Recall');
+        console.log(`  Query: ${report.query}`);
+        console.log(`  Providers: ${report.providerOrder.join(' -> ')}`);
+        console.log(`  Results: ${report.items.length}`);
+        for (const item of report.items) {
+            console.log(`  [${item.provider}] ${item.id}: ${item.title}`);
+            console.log(`    score: ${item.score}; confidence: ${item.confidence}; evidence: ${item.evidencePaths.join(', ') || 'none'}`);
+            console.log(`    ${item.summary}`);
+        }
+        for (const warning of report.warnings)
+            console.log(`  [WARN] ${warning}`);
+    },
+});
+const memoryProvider = defineCommand({
+    meta: { name: 'provider', description: 'Manage autonomous memory provider routing for agentmemory, gbrain, and scale-local' },
+    subCommands: {
+        init: memoryProviderInit,
+        status: memoryProviderStatus,
+        recall: memoryProviderRecall,
+    },
+});
 const memory = defineCommand({
     meta: { name: 'memory', description: 'Memory Fabric context packs and project-scoped long-term memory' },
     subCommands: {
@@ -4349,6 +4440,7 @@ const memory = defineCommand({
         promote: memoryPromote,
         export: memoryExport,
         import: memoryImport,
+        provider: memoryProvider,
     },
 });
 // ============================================================================