@hongmaple0820/scale-engine 0.40.1 → 0.43.0

package/docs/workflow/GATES_AND_SCORE.md

@@ -10,10 +10,11 @@ Use `scale gates status` to inspect the active gate catalog.
 scale gates status --json
 ```
 
-The report separates three concepts that were previously easy to confuse:
+The report separates four concepts that were previously easy to confuse:
 
 - Core gates: `G0-G8`, used by workflow verification, preflight, and product smoke profiles.
 - Meta-governance gates: `G9-G15`, used by `scale meta-governance`.
+- Enhanced gates: `G16-G22`, covering commit discipline, doc hygiene, runtime evidence, code review, supply chain, context budget, and session health.
 - Extension gates: policy-backed checks such as engineering standards, product smoke policy, and tool evidence.
 
 `scale gates status` is intentionally read-only. It does not execute checks; it explains which checks exist and which policies are blocking.
@@ -28,6 +29,38 @@ Architecture and engineering standards are driven by project configuration:
 
 Preflight now uses changed-file standards scope when the target is inside a Git worktree. Non-Git projects keep the old full-scan behavior so bootstrap and fixture projects still get complete feedback.
 
+## Enhanced Gates (G16-G22)
+
+Added in v0.41.0, these gates cover commit discipline, runtime quality, and session hygiene:
+
+| Gate | Name | Blocking | Description |
+| --- | --- | --- | --- |
+| G16 | Commit Discipline | ✅ | Uncommitted file count (warn=10, block=25), time since last commit (warn=60min, block=180min), staged files >1MB, whitespace errors |
+| G17 | Documentation Hygiene | — | Changed markdown files must have valid internal links |
+| G18 | Runtime Evidence | ✅ | Task must have recorded runtime evidence with matching exit codes |
+| G19 | Code Review | ✅ (L/CRITICAL) | L and CRITICAL tasks require reviewed changes with resolved findings |
+| G20 | Supply Chain | ✅ | No CRITICAL/HIGH vulnerabilities; lock file must be consistent |
+| G21 | Context Budget | — | Advisory check on context token usage against configured budget |
+| G22 | Session Health | — | Advisory check on stale worktrees and session state consistency |
+
+Run enhanced gates individually:
+
+```bash
+bash scripts/gates/G16-verify.sh   # Commit Discipline
+bash scripts/gates/G17-verify.sh   # Documentation Hygiene
+bash scripts/gates/G18-verify.sh   # Runtime Evidence
+bash scripts/gates/G19-verify.sh   # Code Review
+bash scripts/gates/G20-verify.sh   # Supply Chain
+bash scripts/gates/G21-verify.sh   # Context Budget
+bash scripts/gates/G22-verify.sh   # Session Health
+```
+
+Or run all gates including enhanced:
+
+```bash
+bash scripts/gates/all.sh --all
+```
+
 ## Task Score
 
 Use `scale score task` to produce an algorithmic completion score.

package/docs/workflow/README.md

@@ -23,6 +23,25 @@ scale score task --changed --json
 scale prompt optimize --input "raw coding request" --json
 ```
 
+### SCALE 2.0 引擎命令
+
+```bash
+# Scale Shield — 钩子拦截
+scale shield compile          # 编译策略 + 安装 hook
+scale shield status           # 验证 hook 注册 + .scale/ 完整性
+scale shield test             # 运行 allow/block 测试
+
+# Scale Orchestrator — 编排守护进程
+scale orch start              # 启动 daemon
+scale orch status             # 查看状态 + workspace 列表
+
+# Scale Cortex — 持续进化
+scale cortex evolve           # 完整进化周期
+scale cortex extract          # 提取 Instincts
+scale cortex inject --minimal # 预览 SessionStart 注入
+scale cortex metrics --days 30 # 治理 ROI 报告
+```
+
 PowerShell:
 
 ```powershell
@@ -35,16 +54,45 @@ See [PROMPT_OPTIMIZATION.md](PROMPT_OPTIMIZATION.md) for the deterministic promp
 
 ## 门禁说明
 
-| Gate | 作用 |
-| --- | --- |
-| G1 | 探索是否记录到状态文件，且至少读了 3 个文件 |
-| G2 | 计划是否包含边界、异常、回滚、现实校验 |
-| G3 | `src/` 行为改动是否伴随测试改动 |
-| G4 | workflow 脚本是否可解析 |
-| G5 | `lint + typecheck + test + build` 是否通过 |
-| G6 | 任务证据和 `git diff --check` 是否通过 |
-| G7 | 安全面是否通过 |
-| G8 | Markdown 与工作流文档是否符合基础卫生规则 |
+SCALE 2.0 共 23 个门禁，分三层：核心门禁（G0-G8）、元治理门禁（G9-G15）、增强门禁（G16-G22）。
+
+### 核心门禁（G0-G8）
+
+| Gate | 作用 | 默认 | 阻断 |
+| --- | | --- | --- |
+| G0 | 构建命令或配置的验证命令必须通过 | ✅ | ✅ |
+| G1 | 探索是否记录到状态文件，且至少读了 3 个文件 | ✅ | — |
+| G2 | 计划是否包含边界、异常、回滚、现实校验 | ✅ | — |
+| G3 | `src/` 行为改动是否伴随测试改动 | ✅ | ✅ |
+| G4 | lint 命令必须通过 | ✅ | ✅ |
+| G5 | 测试命令必须通过 | ✅ | ✅ |
+| G6 | 覆盖率、任务证据和 diff hygiene 必须满足当前 profile | profile | ✅ |
+| G7 | 安全和依赖风险检查必须通过 | profile | ✅ |
+| G8 | 产品冒烟命令必须通过 | profile | ✅ |
+
+### 元治理门禁（G9-G15）
+
+| Gate | 作用 | 默认 | 阻断 |
+| --- | | --- | --- |
+| G9 | 知识库和 recall 能力是否被使用 | ✅ | — |
+| G10 | 改进候选是否有证据支撑 | — | — |
+| G11 | 护栏结果是否可见且可操作 | ✅ | — |
+| G12 | 工作流阶段和制品是否完整 | ✅ | — |
+| G13 | 多 Agent 协作是否有协调证据 | — | — |
+| G14 | 必需 skill 是否被选择和验证 | — | — |
+| G15 | 经验教训是否安全进入学习循环 | — | — |
+
+### 增强门禁（G16-G22）
+
+| Gate | 作用 | 默认 | 阻断 |
+| --- | | --- | --- |
+| G16 | 未提交文件数量和大文件阈值检查 | ✅ | ✅ |
+| G17 | 变更的文档链接有效性检查 | ✅ | — |
+| G18 | 运行时证据记录和退出码匹配 | ✅ | ✅ |
+| G19 | L/CRITICAL 任务需要代码审查记录 | profile | ✅ |
+| G20 | 无 CRITICAL/HIGH 漏洞；lock 文件一致性 | ✅ | ✅ |
+| G21 | 上下文 token 预算检查（advisory） | ✅ | — |
+| G22 | 会话健康检查：worktree 泄露和状态一致性 | ✅ | — |
 
 ## 分支策略
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hongmaple0820/scale-engine",
-  "version": "0.40.1",
+  "version": "0.43.0",
   "description": "Executable AI agent governance with workflow gates, evidence, skill/tool orchestration, and traceable HTML artifacts",
   "repository": {
     "type": "git",
@@ -25,29 +25,15 @@
   "files": [
     "dist",
     "docs/README.md",
-    "docs/AI_ENGINEERING_OS_POSITIONING.md",
-    "docs/CODE_INTELLIGENCE.md",
-    "docs/CONTEXT_BUDGET.md",
-    "docs/BACKGROUND_HUNTER.md",
-    "docs/DEPENDENCY_AUDIT.md",
-    "docs/ACTIVE_SECURITY_VISUAL_GATES.md",
-    "docs/EVOLUTION_SHADOW_MODE.md",
-    "docs/WORKFLOW_EVAL.md",
     "docs/SKILL_RADAR.md",
     "docs/SKILL-REPOSITORY.md",
-    "docs/THIRD_PARTY_SKILLS.md",
     "docs/EXTERNAL_REFERENCES.md",
-    "docs/MEMORY_BRAIN.md",
-    "docs/GOVERNANCE_DASHBOARD.md",
-    "docs/GITLAB_FLOW.md",
-    "docs/MEMORY_FABRIC.md",
-    "docs/RUNTIME_EVIDENCE.md",
-    "docs/RESOURCE_GOVERNANCE.md",
+    "docs/THIRD_PARTY_SKILLS.md",
     "docs/guides",
     "docs/start",
     "docs/workflow",
-    "image",
     "examples/demo-projects/agent-governance-demo",
+    "scripts/workflow/lib",
     "scripts/workflow/setup-smoke.mjs",
     "scripts/workflow/provider-rehearsal.mjs"
   ],
@@ -65,7 +51,7 @@
     "smoke:providers": "node scripts/workflow/provider-rehearsal.mjs",
     "smoke:gbrain": "node scripts/workflow/provider-rehearsal.mjs --skip-graphify --require-gbrain",
     "smoke:graphify": "node scripts/workflow/provider-rehearsal.mjs --skip-gbrain --require-graphify",
-    "release:check": "npm run typecheck && npm run lint && npm test && npm run smoke:setup && npm run build && npm audit --omit=dev && git diff --check && npm pack --dry-run",
+    "release:check": "npm run typecheck && npm run lint && npm test && npm run smoke:setup && npm run smoke:providers -- --write-report && npm run build && npm audit --omit=dev && git diff --check && npm pack --dry-run",
     "mcp": "node dist/api/mcp.js",
     "serve": "node dist/api/http.js"
   },
@@ -88,6 +74,9 @@
     "type-is": "2.0.1",
     "qs": "6.15.2"
   },
+  "optionalDependencies": {
+    "playwright": "^1.50.0"
+  },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.0",
     "@types/js-yaml": "^4.0.9",

package/scripts/workflow/lib/gbrain-runtime.mjs

@@ -0,0 +1,185 @@
+import { createHash } from 'node:crypto'
+import { cpSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join, resolve } from 'node:path'
+
+const MIRROR_META_FILE = '.scale-gbrain-runtime.json'
+const GBRAIN_TIMEOUT_RECOVERY_COMMANDS = new Set(['--version', 'version', 'doctor', 'list', 'get', 'query', 'search'])
+
+export function resolveDirectWindowsGbrainInvocation(command, args, resolveCommandPath) {
+  if (process.platform !== 'win32' || command !== 'gbrain') return null
+  const gbrainShim = resolveCommandPath('gbrain')
+  if (!gbrainShim || !/\.cmd$/i.test(gbrainShim) || !existsSync(gbrainShim)) return null
+  try {
+    const content = readFileSync(gbrainShim, 'utf8')
+    const match = content.match(/call\s+"([^"]*bun\.cmd)"\s+"([^"]*src[\\/]cli\.ts)"/i)
+    const cliPath = match?.[2]
+    const bunShim = match?.[1] ?? resolveCommandPath('bun')
+    const bunExe = bunShim ? join(dirname(bunShim), 'node_modules', 'bun', 'bin', 'bun.exe') : ''
+    if (cliPath && bunExe && existsSync(bunExe)) {
+      return {
+        command: bunExe,
+        args: [cliPath, ...args],
+        cwd: dirname(dirname(cliPath)),
+        cliPath,
+      }
+    }
+  } catch {
+    return null
+  }
+  return null
+}
+
+export function shouldRetryWithMirroredGbrain(invocation, result) {
+  if (!invocation?.cliPath) return false
+  if (result.status === 0) return false
+  const output = `${String(result.stdout ?? '')}\n${String(result.stderr ?? '')}\n${String(result.error?.message ?? '')}`
+  if (!/EPERM reading/i.test(output)) return false
+  return normalizeForCompare(output).includes(normalizeForCompare(invocation.cliPath))
+}
+
+export function ensureMirroredGbrainInvocation(invocation) {
+  const packageRoot = invocation.cwd
+  const cliMtimeMs = statSync(invocation.cliPath).mtimeMs
+  const version = readPackageVersion(packageRoot)
+  const mirrorKey = `${resolve(packageRoot)}|${version ?? ''}|${cliMtimeMs}`
+  const mirrorRoot = join(
+    tmpdir(),
+    'scale-engine',
+    'gbrain-runtime',
+    createHash('sha1').update(mirrorKey).digest('hex').slice(0, 16),
+  )
+  const cliRelativePath = invocation.cliPath.slice(packageRoot.length + 1)
+  const mirrorCliPath = join(mirrorRoot, cliRelativePath)
+  let selectedRoot = mirrorRoot
+  if (!isMirrorFresh(mirrorRoot, packageRoot, version, cliMtimeMs, mirrorCliPath)) {
+    const stagedRoot = `${mirrorRoot}-staging-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2, 8)}`
+    rmSync(stagedRoot, { recursive: true, force: true })
+    mkdirSync(dirname(mirrorRoot), { recursive: true })
+    cpSync(packageRoot, stagedRoot, { recursive: true, force: true })
+    writeFileSync(join(stagedRoot, MIRROR_META_FILE), JSON.stringify({
+      sourceRoot: packageRoot,
+      version,
+      cliMtimeMs,
+    }, null, 2), 'utf8')
+    const stagedCliPath = join(stagedRoot, cliRelativePath)
+    if (!isMirrorFresh(mirrorRoot, packageRoot, version, cliMtimeMs, mirrorCliPath)) {
+      try {
+        renameSync(stagedRoot, mirrorRoot)
+      } catch {
+        if (isMirrorFresh(mirrorRoot, packageRoot, version, cliMtimeMs, mirrorCliPath)) {
+          rmSync(stagedRoot, { recursive: true, force: true })
+        } else {
+          selectedRoot = stagedRoot
+        }
+      }
+    } else {
+      rmSync(stagedRoot, { recursive: true, force: true })
+    }
+    if (selectedRoot === mirrorRoot && !existsSync(mirrorCliPath) && existsSync(stagedCliPath)) selectedRoot = stagedRoot
+  }
+  return {
+    ...invocation,
+    args: [join(selectedRoot, cliRelativePath), ...invocation.args.slice(1)],
+    cwd: selectedRoot,
+    cliPath: join(selectedRoot, cliRelativePath),
+  }
+}
+
+export function normalizeGbrainSpawnResult(args, result) {
+  const stdout = String(result.stdout ?? '')
+  const stderr = `${String(result.stderr ?? '')}${result.error ? `\n${result.error.message}` : ''}`.trim()
+  const exitCode = typeof result.status === 'number' ? result.status : 1
+  const timedOut = /ETIMEDOUT/i.test(String(result.error?.message ?? ''))
+  const recoveredTimeout = shouldRecoverGbrainTimeout(args, stdout, stderr, exitCode, timedOut)
+  return {
+    stdout,
+    stderr: recoveredTimeout ? stripRecoverableTimeoutNoise(stderr) : stderr,
+    exitCode: recoveredTimeout ? 0 : exitCode,
+    timedOut: recoveredTimeout ? false : timedOut,
+    recoveredTimeout,
+  }
+}
+
+function isMirrorFresh(mirrorRoot, sourceRoot, version, cliMtimeMs, mirrorCliPath) {
+  if (!existsSync(mirrorCliPath)) return false
+  const metadataPath = join(mirrorRoot, MIRROR_META_FILE)
+  if (!existsSync(metadataPath)) return false
+  try {
+    const parsed = JSON.parse(readFileSync(metadataPath, 'utf8'))
+    return parsed.sourceRoot === sourceRoot
+      && parsed.version === version
+      && parsed.cliMtimeMs === cliMtimeMs
+  } catch {
+    return false
+  }
+}
+
+function readPackageVersion(packageRoot) {
+  try {
+    const parsed = JSON.parse(readFileSync(join(packageRoot, 'package.json'), 'utf8'))
+    return typeof parsed.version === 'string' ? parsed.version : undefined
+  } catch {
+    return undefined
+  }
+}
+
+function normalizeForCompare(value) {
+  return String(value).replace(/\//g, '\\').toLowerCase()
+}
+
+function shouldRecoverGbrainTimeout(args, stdout, stderr, exitCode, timedOut) {
+  if (!timedOut || exitCode === 0) return false
+  const command = String(args?.[0] ?? '').trim().toLowerCase()
+  if (!command || !GBRAIN_TIMEOUT_RECOVERY_COMMANDS.has(command)) return false
+  const cleanedStderr = stripRecoverableTimeoutNoise(stderr)
+  if (cleanedStderr) return false
+  return hasRecoverableGbrainOutput(command, stdout.trim())
+}
+
+function hasRecoverableGbrainOutput(command, stdout) {
+  if (!stdout) return false
+  switch (command) {
+    case '--version':
+    case 'version':
+      return /\bgbrain\b/i.test(stdout) || /\d+\.\d+\.\d+/.test(stdout)
+    case 'doctor':
+      return looksLikeJsonOutput(stdout)
+    case 'list':
+      return /no pages found/i.test(stdout)
+        || /^\d+\.\s+\S+/m.test(stdout)
+        || /^\[\d+(?:\.\d+)?\]\s+/m.test(stdout)
+    case 'get':
+      return /^---$/m.test(stdout)
+        || /^#\s+\S+/m.test(stdout)
+        || looksLikeJsonOutput(stdout)
+    case 'query':
+    case 'search':
+      return looksLikeJsonOutput(stdout)
+        || /no (pages|results) found/i.test(stdout)
+        || /^\[\d+(?:\.\d+)?\]\s+/m.test(stdout)
+        || /^\d+\.\s+\S+/m.test(stdout)
+    default:
+      return false
+  }
+}
+
+function looksLikeJsonOutput(stdout) {
+  const trimmed = String(stdout ?? '').trim()
+  if (!trimmed || (!trimmed.startsWith('{') && !trimmed.startsWith('['))) return false
+  try {
+    JSON.parse(trimmed)
+    return true
+  } catch {
+    return false
+  }
+}
+
+function stripRecoverableTimeoutNoise(stderr) {
+  return String(stderr ?? '')
+    .replace(/\n?spawnSync .*?\bETIMEDOUT\b\s*/gim, '\n')
+    .replace(/\n?Command failed: .*?\bETIMEDOUT\b\s*/gim, '\n')
+    .replace(/\n?timed out after .*$/gim, '\n')
+    .replace(/\n{3,}/g, '\n\n')
+    .trim()
+}

package/scripts/workflow/lib/report-output.mjs

@@ -0,0 +1,107 @@
+function stripAnsi(value) {
+  return String(value ?? '').replace(/\u001B\[[0-9;]*m/g, '')
+}
+
+export function summarizeCommandOutput(name, stream, value, max = 1600) {
+  const sanitized = sanitizeCommandOutput(name, stream, stripAnsi(value))
+  if (!sanitized.trim()) return ''
+  const summary = commandSpecificSummary(name, stream, sanitized)
+  return compactText(summary ?? sanitized, max)
+}
+
+export function summarizeCommandRecord(record) {
+  if (!record) return record
+  const {
+    stdout,
+    stderr,
+    ...rest
+  } = record
+  return {
+    ...rest,
+    stdoutTail: summarizeCommandOutput(record.name, 'stdout', stdout ?? record.stdoutTail ?? ''),
+    stderrTail: summarizeCommandOutput(record.name, 'stderr', stderr ?? record.stderrTail ?? ''),
+  }
+}
+
+function sanitizeCommandOutput(name, stream, value) {
+  let text = String(value ?? '').replace(/\r\n/g, '\n').replace(/[�]+/g, '')
+  if (isGbrainCommand(name)) {
+    if (stream === 'stderr') {
+      text = text
+        .replace(/^\s*The system cannot find the path specified\.\s*$/gim, '')
+        .replace(/\n?={20,}\n[\s\S]*?The user owns this decision\.\n={20,}\n?/g, '\n')
+    }
+    if (stream === 'stdout' && /init/i.test(name)) {
+      text = text
+        .replace(/\n?═{10,}\n\[gbrain\] search mode tentatively set[\s\S]*?To see what is running: gbrain search modes\n*/g, '\n')
+        .replace(/\n--- GBrain Mod Status ---[\s\S]*$/g, '')
+    }
+  }
+  return normalizeMultiline(text)
+}
+
+function commandSpecificSummary(name, stream, value) {
+  if (stream !== 'stdout') return undefined
+  if (name === 'gbrain-init' || name === 'gbrain-init-isolated-home') {
+    return collectMatchingLines(value, [
+      /migration\(s\) applied/i,
+      /^Brain ready at /i,
+      /^0 pages\./i,
+      /^Next: /i,
+      /^When you outgrow local:/i,
+    ])
+  }
+  if (name === 'graphify-update' || name === 'graphify-extract') {
+    return collectMatchingLines(value, [
+      /Rebuilt/i,
+      /graph\.json updated/i,
+      /^Code graph updated\./i,
+      /^Tip:/i,
+    ])
+  }
+  if (name === 'graphify-benchmark') {
+    return collectMatchingLines(value, [
+      /^graphify token reduction benchmark$/i,
+      /^\s*Corpus:/i,
+      /^\s*Graph:/i,
+      /^\s*Avg query cost:/i,
+      /^\s*Reduction:/i,
+    ])
+  }
+  if (name === 'graphify-query') {
+    return firstInterestingLines(value, 12)
+  }
+  return undefined
+}
+
+function collectMatchingLines(value, patterns) {
+  const lines = normalizeMultiline(value).split('\n').map(line => line.trim()).filter(Boolean)
+  const selected = lines.filter(line => patterns.some(pattern => pattern.test(line)))
+  return selected.length > 0 ? selected.join('\n') : undefined
+}
+
+function firstInterestingLines(value, maxLines) {
+  const lines = normalizeMultiline(value)
+    .split('\n')
+    .map(line => line.trim())
+    .filter(Boolean)
+    .filter(line => !/^[=._-]{6,}$/.test(line))
+  return lines.slice(0, maxLines).join('\n')
+}
+
+function compactText(value, max) {
+  const normalized = normalizeMultiline(value)
+  if (normalized.length <= max) return normalized
+  return `${normalized.slice(0, max - 1)}…`
+}
+
+function normalizeMultiline(value) {
+  return String(value ?? '')
+    .replace(/[ \t]+\n/g, '\n')
+    .replace(/\n{3,}/g, '\n\n')
+    .trim()
+}
+
+function isGbrainCommand(name) {
+  return /^gbrain-/i.test(String(name ?? ''))
+}