@hongmaple0820/scale-engine 0.25.0 → 0.26.0

package/docs/workflow/templates/visual-review.md

@@ -0,0 +1,20 @@
+# Visual Review
+
+## Screenshots Or Evidence
+
+TBD
+
+## Layout And Responsiveness
+
+TBD
+
+## Text Fit And Overlap
+
+TBD
+
+## Accessibility Notes
+
+TBD
+
+## Final Verdict
+TBD

package/examples/demo-projects/agent-governance-demo/CONTEXT.md

@@ -1,14 +1,14 @@
-# CONTEXT.md
-
-Project: Agent Governance Demo
-
-| Term | Definition | Examples | Aliases | Source |
-|------|------------|----------|---------|--------|
-| OAuth state | One-time callback correlation value that binds authorization return traffic to a user session | `state-123` | callback state | `src/oauth-state.ts` |
-| Consumed state | A state record that has already been used and must not be accepted again | `consumedAt: 900` | replayed state | `tests/oauth-state.test.ts` |
-| Evidence | A command result or artifact that proves what was verified | `npm test`, eval report, dashboard | verification proof | SCALE workflow |
-
-## Rejected Meanings
-
-- Do not treat an expired state as recoverable without a new authorization flow.
-- Do not treat a dashboard or eval report as a substitute for the business test.
+# CONTEXT.md
+
+Project: Agent Governance Demo
+
+| Term | Definition | Examples | Aliases | Source |
+|------|------------|----------|---------|--------|
+| OAuth state | One-time callback correlation value that binds authorization return traffic to a user session | `state-123` | callback state | `src/oauth-state.ts` |
+| Consumed state | A state record that has already been used and must not be accepted again | `consumedAt: 900` | replayed state | `tests/oauth-state.test.ts` |
+| Evidence | A command result or artifact that proves what was verified | `npm test`, eval report, dashboard | verification proof | SCALE workflow |
+
+## Rejected Meanings
+
+- Do not treat an expired state as recoverable without a new authorization flow.
+- Do not treat a dashboard or eval report as a substitute for the business test.

package/examples/demo-projects/agent-governance-demo/README.md

@@ -1,48 +1,48 @@
-# Agent Governance Demo
-
-这是 SCALE Engine 的最小官方 demo 项目，用一个 OAuth state 校验场景展示 Agent 工程治理如何落到真实代码、测试、证据和报告里。
-
-业务目标很小：OAuth callback 必须拒绝缺失、过期、已消费或不匹配的 state。
-
-治理目标更重要：Agent 不能只说“我完成了”，必须留下可验证证据。
-
-## 快速运行
-
-```bash
-npm install
-npm test
-```
-
-## 一键治理烟测
-
-```bash
-npm run workflow:smoke
-```
-
-这个命令会依次运行：
-
-- `npm test`：验证业务行为。
-- `scale eval run --dir .`：运行工作流基线评测。
-- `scale context budget --dir .`：检查上下文预算，避免无节制读取。
-- `scale artifact dashboard --dir . --lang zh`：生成本地治理 HTML 看板。
-
-## 适合演示的 SCALE 命令
-
-```bash
-scale governance mode --task "修复 OAuth state 校验绕过问题" --files "src/oauth-state.ts,tests/oauth-state.test.ts"
-scale skill radar --dir . --task "修复 OAuth state 校验绕过问题" --phase verify --level M --files "src/oauth-state.ts,tests/oauth-state.test.ts"
-scale codegraph status --dir .
-scale eval run --dir .
-scale artifact dashboard --dir . --lang zh
-```
-
-## 观察点
-
-- `src/oauth-state.ts` 保持很小，便于核对 Agent 是否过度设计。
-- `tests/oauth-state.test.ts` 覆盖成功、缺失、过期、已消费和不匹配 state。
-- `CONTEXT.md` 和 `docs/CONTEXT-MAP.md` 只提供必要上下文，避免 demo 自己变成 token 污染源。
-- `.scale/evals/suites/workflow-baseline.json` 可由 `scale eval init --dir .` 重新生成。
-
-## 这不是业务模板
-
-这个 demo 不是 OAuth 产品模板，而是治理闭环模板。真实项目接入时，应保留 SCALE 的证据、评测、上下文预算和看板机制，再替换成自己的业务代码、服务矩阵和验证脚本。
+# Agent Governance Demo
+
+这是 SCALE Engine 的最小官方 demo 项目，用一个 OAuth state 校验场景展示 Agent 工程治理如何落到真实代码、测试、证据和报告里。
+
+业务目标很小：OAuth callback 必须拒绝缺失、过期、已消费或不匹配的 state。
+
+治理目标更重要：Agent 不能只说“我完成了”，必须留下可验证证据。
+
+## 快速运行
+
+```bash
+npm install
+npm test
+```
+
+## 一键治理烟测
+
+```bash
+npm run workflow:smoke
+```
+
+这个命令会依次运行：
+
+- `npm test`：验证业务行为。
+- `scale eval run --dir .`：运行工作流基线评测。
+- `scale context budget --dir .`：检查上下文预算，避免无节制读取。
+- `scale artifact dashboard --dir . --lang zh`：生成本地治理 HTML 看板。
+
+## 适合演示的 SCALE 命令
+
+```bash
+scale governance mode --task "修复 OAuth state 校验绕过问题" --files "src/oauth-state.ts,tests/oauth-state.test.ts"
+scale skill radar --dir . --task "修复 OAuth state 校验绕过问题" --phase verify --level M --files "src/oauth-state.ts,tests/oauth-state.test.ts"
+scale codegraph status --dir .
+scale eval run --dir .
+scale artifact dashboard --dir . --lang zh
+```
+
+## 观察点
+
+- `src/oauth-state.ts` 保持很小，便于核对 Agent 是否过度设计。
+- `tests/oauth-state.test.ts` 覆盖成功、缺失、过期、已消费和不匹配 state。
+- `CONTEXT.md` 和 `docs/CONTEXT-MAP.md` 只提供必要上下文，避免 demo 自己变成 token 污染源。
+- `.scale/evals/suites/workflow-baseline.json` 可由 `scale eval init --dir .` 重新生成。
+
+## 这不是业务模板
+
+这个 demo 不是 OAuth 产品模板，而是治理闭环模板。真实项目接入时，应保留 SCALE 的证据、评测、上下文预算和看板机制，再替换成自己的业务代码、服务矩阵和验证脚本。

package/examples/demo-projects/agent-governance-demo/docs/CONTEXT-MAP.md

@@ -1,14 +1,14 @@
-# CONTEXT-MAP.md
-
-Project: Agent Governance Demo
-
-| Module | Owner | Product Doc | Architecture Doc |
-| --- | --- | --- | --- |
-| OAuth state verifier | SCALE demo | `README.md` | `src/oauth-state.ts` |
-| Workflow evidence | SCALE demo | `README.md` | `.scale/evals/suites/workflow-baseline.json` |
-
-## Cross-Module Rules
-
-- Behavior changes in `src/oauth-state.ts` must update `tests/oauth-state.test.ts`.
-- Workflow command changes must update `README.md`.
-- Generated reports under `.scale/reports/` are review artifacts, not source of truth.
+# CONTEXT-MAP.md
+
+Project: Agent Governance Demo
+
+| Module | Owner | Product Doc | Architecture Doc |
+| --- | --- | --- | --- |
+| OAuth state verifier | SCALE demo | `README.md` | `src/oauth-state.ts` |
+| Workflow evidence | SCALE demo | `README.md` | `.scale/evals/suites/workflow-baseline.json` |
+
+## Cross-Module Rules
+
+- Behavior changes in `src/oauth-state.ts` must update `tests/oauth-state.test.ts`.
+- Workflow command changes must update `README.md`.
+- Generated reports under `.scale/reports/` are review artifacts, not source of truth.

package/examples/demo-projects/agent-governance-demo/package.json

@@ -1,21 +1,22 @@
-{
-  "name": "scale-agent-governance-demo",
-  "version": "0.1.0",
-  "private": true,
-  "type": "module",
-  "scripts": {
-    "build": "tsc --noEmit --module NodeNext --moduleResolution NodeNext --target ES2022 src/oauth-state.ts tests/oauth-state.test.ts",
-    "lint": "tsc --noEmit --module NodeNext --moduleResolution NodeNext --target ES2022 src/oauth-state.ts tests/oauth-state.test.ts",
-    "test": "vitest run",
-    "scale:eval": "scale eval run --dir .",
-    "scale:budget": "scale context budget --dir .",
-    "scale:dashboard": "scale artifact dashboard --dir . --lang zh",
-    "workflow:smoke": "npm test && npm run scale:eval && npm run scale:budget && npm run scale:dashboard"
-  },
-  "devDependencies": {
-    "@hongmaple0820/scale-engine": "^0.20.0",
-    "typescript": "^5.5.0",
-    "vitest": "^2.1.9"
-  }
-}
-
+{
+  "name": "scale-agent-governance-demo",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "tsc --noEmit --module NodeNext --moduleResolution NodeNext --target ES2022 src/oauth-state.ts tests/oauth-state.test.ts",
+    "lint": "tsc --noEmit --module NodeNext --moduleResolution NodeNext --target ES2022 src/oauth-state.ts tests/oauth-state.test.ts",
+    "test": "vitest run",
+    "scale:eval": "scale eval run --dir .",
+    "scale:budget": "scale context budget --dir .",
+    "scale:dashboard": "scale artifact dashboard --dir . --lang zh",
+    "workflow:smoke": "npm test && npm run scale:eval && npm run scale:budget && npm run scale:dashboard"
+  },
+  "devDependencies": {
+    "@hongmaple0820/scale-engine": "^0.20.0",
+    "@types/node": "^20.14.0",
+    "typescript": "^5.5.0",
+    "vitest": "^2.1.9"
+  }
+}
+

package/examples/demo-projects/agent-governance-demo/src/oauth-state.ts

@@ -1,39 +1,39 @@
-export type OAuthStateFailure = 'missing-record' | 'state-mismatch' | 'state-expired' | 'state-consumed'
-
-export interface OAuthStateRecord {
-  state: string
-  userId: string
-  expiresAt: number
-  consumedAt?: number
-}
-
-export interface OAuthStateVerification {
-  ok: boolean
-  userId?: string
-  reason?: OAuthStateFailure
-}
-
-export function verifyOAuthState(
-  record: OAuthStateRecord | undefined,
-  providedState: string,
-  now: number = Date.now()
-): OAuthStateVerification {
-  if (!record) {
-    return { ok: false, reason: 'missing-record' }
-  }
-
-  if (record.state !== providedState) {
-    return { ok: false, reason: 'state-mismatch' }
-  }
-
-  if (record.expiresAt <= now) {
-    return { ok: false, reason: 'state-expired' }
-  }
-
-  if (record.consumedAt !== undefined) {
-    return { ok: false, reason: 'state-consumed' }
-  }
-
-  return { ok: true, userId: record.userId }
-}
-
+export type OAuthStateFailure = 'missing-record' | 'state-mismatch' | 'state-expired' | 'state-consumed'
+
+export interface OAuthStateRecord {
+  state: string
+  userId: string
+  expiresAt: number
+  consumedAt?: number
+}
+
+export interface OAuthStateVerification {
+  ok: boolean
+  userId?: string
+  reason?: OAuthStateFailure
+}
+
+export function verifyOAuthState(
+  record: OAuthStateRecord | undefined,
+  providedState: string,
+  now: number = Date.now()
+): OAuthStateVerification {
+  if (!record) {
+    return { ok: false, reason: 'missing-record' }
+  }
+
+  if (record.state !== providedState) {
+    return { ok: false, reason: 'state-mismatch' }
+  }
+
+  if (record.expiresAt <= now) {
+    return { ok: false, reason: 'state-expired' }
+  }
+
+  if (record.consumedAt !== undefined) {
+    return { ok: false, reason: 'state-consumed' }
+  }
+
+  return { ok: true, userId: record.userId }
+}
+

package/examples/demo-projects/agent-governance-demo/tests/oauth-state.test.ts

@@ -1,52 +1,52 @@
-import { describe, expect, it } from 'vitest'
-import { verifyOAuthState, type OAuthStateRecord } from '../src/oauth-state.js'
-
-const future = 2_000
-const now = 1_000
-
-function record(overrides: Partial<OAuthStateRecord> = {}): OAuthStateRecord {
-  return {
-    state: 'state-123',
-    userId: 'user-1',
-    expiresAt: future,
-    ...overrides
-  }
-}
-
-describe('verifyOAuthState', () => {
-  it('accepts a valid unexpired state', () => {
-    expect(verifyOAuthState(record(), 'state-123', now)).toEqual({
-      ok: true,
-      userId: 'user-1'
-    })
-  })
-
-  it('rejects a missing record', () => {
-    expect(verifyOAuthState(undefined, 'state-123', now)).toEqual({
-      ok: false,
-      reason: 'missing-record'
-    })
-  })
-
-  it('rejects a mismatched state', () => {
-    expect(verifyOAuthState(record(), 'other-state', now)).toEqual({
-      ok: false,
-      reason: 'state-mismatch'
-    })
-  })
-
-  it('rejects an expired state', () => {
-    expect(verifyOAuthState(record({ expiresAt: now }), 'state-123', now)).toEqual({
-      ok: false,
-      reason: 'state-expired'
-    })
-  })
-
-  it('rejects a consumed state', () => {
-    expect(verifyOAuthState(record({ consumedAt: 900 }), 'state-123', now)).toEqual({
-      ok: false,
-      reason: 'state-consumed'
-    })
-  })
-})
-
+import { describe, expect, it } from 'vitest'
+import { verifyOAuthState, type OAuthStateRecord } from '../src/oauth-state.js'
+
+const future = 2_000
+const now = 1_000
+
+function record(overrides: Partial<OAuthStateRecord> = {}): OAuthStateRecord {
+  return {
+    state: 'state-123',
+    userId: 'user-1',
+    expiresAt: future,
+    ...overrides
+  }
+}
+
+describe('verifyOAuthState', () => {
+  it('accepts a valid unexpired state', () => {
+    expect(verifyOAuthState(record(), 'state-123', now)).toEqual({
+      ok: true,
+      userId: 'user-1'
+    })
+  })
+
+  it('rejects a missing record', () => {
+    expect(verifyOAuthState(undefined, 'state-123', now)).toEqual({
+      ok: false,
+      reason: 'missing-record'
+    })
+  })
+
+  it('rejects a mismatched state', () => {
+    expect(verifyOAuthState(record(), 'other-state', now)).toEqual({
+      ok: false,
+      reason: 'state-mismatch'
+    })
+  })
+
+  it('rejects an expired state', () => {
+    expect(verifyOAuthState(record({ expiresAt: now }), 'state-123', now)).toEqual({
+      ok: false,
+      reason: 'state-expired'
+    })
+  })
+
+  it('rejects a consumed state', () => {
+    expect(verifyOAuthState(record({ consumedAt: 900 }), 'state-123', now)).toEqual({
+      ok: false,
+      reason: 'state-consumed'
+    })
+  })
+})
+

package/package.json

@@ -1,78 +1,88 @@
-{
-  "name": "@hongmaple0820/scale-engine",
-  "version": "0.25.0",
-  "description": "Executable AI agent governance with workflow gates, evidence, skill/tool orchestration, and traceable HTML artifacts",
-  "type": "module",
-  "bin": {
-    "scale": "dist/api/cli.js"
-  },
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
-    }
-  },
-  "files": [
-    "dist",
-    "docs/README.md",
-    "docs/CODE_INTELLIGENCE.md",
-    "docs/CONTEXT_BUDGET.md",
-    "docs/BACKGROUND_HUNTER.md",
-    "docs/DEPENDENCY_AUDIT.md",
-    "docs/ACTIVE_SECURITY_VISUAL_GATES.md",
-    "docs/EVOLUTION_SHADOW_MODE.md",
-    "docs/WORKFLOW_EVAL.md",
-    "docs/SKILL_RADAR.md",
-    "docs/SKILL-REPOSITORY.md",
-    "docs/THIRD_PARTY_SKILLS.md",
-    "docs/EXTERNAL_REFERENCES.md",
-    "docs/MEMORY_BRAIN.md",
-    "docs/GOVERNANCE_DASHBOARD.md",
-    "docs/GITLAB_FLOW.md",
-    "docs/MEMORY_FABRIC.md",
-    "docs/RUNTIME_EVIDENCE.md",
-    "docs/RESOURCE_GOVERNANCE.md",
-    "docs/start",
-    "image",
-    "examples/demo-projects/agent-governance-demo"
-  ],
-  "publishConfig": {
-    "access": "public"
-  },
-  "scripts": {
-    "build": "tsc",
-    "dev": "bun --watch src/api/cli.ts",
-    "test": "vitest run --reporter dot --pool=forks --poolOptions.forks.maxForks=1 --poolOptions.forks.minForks=1",
-    "typecheck": "tsc --noEmit",
-    "lint": "eslint src/**/*.ts",
-    "mcp": "node dist/api/mcp.js",
-    "serve": "node dist/api/http.js"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0",
-    "better-sqlite3": "^11.10.0",
-    "chokidar": "^3.6.0",
-    "citty": "^0.1.6",
-    "execa": "^9.3.0",
-    "hono": "^4.5.0",
-    "js-yaml": "^4.1.0",
-    "pino": "^9.3.0",
-    "pino-pretty": "^11.2.0",
-    "zod": "^3.23.0"
-  },
-  "devDependencies": {
-    "@types/better-sqlite3": "^7.6.0",
-    "@types/js-yaml": "^4.0.9",
-    "@types/node": "^20.14.0",
-    "@typescript-eslint/parser": "^8.59.3",
-    "eslint": "^9.0.0",
-    "tsx": "^4.21.0",
-    "typescript": "^5.5.0",
-    "vitest": "^2.0.0"
-  },
-  "engines": {
-    "node": ">=20.0.0"
-  }
-}
+{
+  "name": "@hongmaple0820/scale-engine",
+  "version": "0.26.0",
+  "description": "Executable AI agent governance with workflow gates, evidence, skill/tool orchestration, and traceable HTML artifacts",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/hongmaple0820/scale-engine.git"
+  },
+  "bugs": {
+    "url": "https://github.com/hongmaple0820/scale-engine/issues"
+  },
+  "homepage": "https://github.com/hongmaple0820/scale-engine#readme",
+  "type": "module",
+  "bin": {
+    "scale": "dist/api/cli.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "docs/README.md",
+    "docs/CODE_INTELLIGENCE.md",
+    "docs/CONTEXT_BUDGET.md",
+    "docs/BACKGROUND_HUNTER.md",
+    "docs/DEPENDENCY_AUDIT.md",
+    "docs/ACTIVE_SECURITY_VISUAL_GATES.md",
+    "docs/EVOLUTION_SHADOW_MODE.md",
+    "docs/WORKFLOW_EVAL.md",
+    "docs/SKILL_RADAR.md",
+    "docs/SKILL-REPOSITORY.md",
+    "docs/THIRD_PARTY_SKILLS.md",
+    "docs/EXTERNAL_REFERENCES.md",
+    "docs/MEMORY_BRAIN.md",
+    "docs/GOVERNANCE_DASHBOARD.md",
+    "docs/GITLAB_FLOW.md",
+    "docs/MEMORY_FABRIC.md",
+    "docs/RUNTIME_EVIDENCE.md",
+    "docs/RESOURCE_GOVERNANCE.md",
+    "docs/guides",
+    "docs/start",
+    "docs/workflow",
+    "image",
+    "examples/demo-projects/agent-governance-demo"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "bun --watch src/api/cli.ts",
+    "test": "vitest run --reporter dot --pool=forks --poolOptions.forks.maxForks=1 --poolOptions.forks.minForks=1",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src/**/*.ts",
+    "mcp": "node dist/api/mcp.js",
+    "serve": "node dist/api/http.js"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "better-sqlite3": "^11.10.0",
+    "chokidar": "^3.6.0",
+    "citty": "^0.1.6",
+    "execa": "^9.3.0",
+    "hono": "^4.5.0",
+    "js-yaml": "^4.1.0",
+    "pino": "^9.3.0",
+    "pino-pretty": "^11.2.0",
+    "zod": "^3.23.0"
+  },
+  "devDependencies": {
+    "@types/better-sqlite3": "^7.6.0",
+    "@types/js-yaml": "^4.0.9",
+    "@types/node": "^20.14.0",
+    "@typescript-eslint/parser": "^8.59.3",
+    "eslint": "^9.0.0",
+    "tsx": "^4.21.0",
+    "typescript": "^5.5.0",
+    "vitest": "^2.0.0"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  }
+}