@joekytc/dsh-swarm 0.3.6 → 0.3.8

package/lib/services/kanban-provider.js

@@ -1,10 +1,13 @@
 import { Service } from '@deepseek-ai/cordis';
 import { homedir } from 'node:os';
 import { spawn } from 'node:child_process';
+import { readFile } from 'node:fs/promises';
 import { KanbanService } from '../domain/kanban-service.js';
 import { FileEventStore } from '../domain/event-store.js';
-import { deriveGatePlan, isGatePlan, branchMatches } from '../domain/gate-policy.js';
+import { deriveGatePlan, branchMatches, resolveDiffBase } from '../domain/gate-policy.js';
 import { runGateCommands } from './gate-runner.js';
+import { writeGateLog } from './gate-evidence.js';
+import { checkIssueEvidence, resolveTargetWorktree } from './evidence-replay.js';
 export class KanbanProvider extends Service {
     service;
     /** GUI retry 的任务执行器（由 startDispatcher 装配后注入；webServer 先于 agents 就绪时可为 null）。 */
@@ -13,34 +16,49 @@ export class KanbanProvider extends Service {
      *  purge 物理重排 events seq，若不同步则删链后新建链的可唤醒事件被运行中实例永久跳过。 */
     onChainDeleted = null;
     // 经 configProvider getter 读 effective 配置——配置面板改 wikiVault.baseUrl 后 kb_url 前缀校验热生效。
+    gateLogDir;
     constructor(ctx, config, configProvider) {
         super(ctx, 'kanban');
         const dir = config.storageDir.replace('$DSH_HOME', process.env.DSH_HOME ?? homedir());
+        this.gateLogDir = dir;
         this.service = new KanbanService(new FileEventStore(dir), () => configProvider.getEffective().wikiVault?.baseUrl);
-        // P1 实测闸装配（组合根）：complete 前派生 GatePlan → 分支一致性核对 → 实测执行。
-        // hook 绝不 throw：意外异常记日志并返回 null（零感知 skip，fail-open 与分支不一致语义一致）。
+        // P1 实测闸装配（组合根）：complete 前派生 GateOutcome → 分支核对 → 实测执行/打回/警报。
+        // hook 绝不 throw：意外异常记日志并返回 null（基建故障静默，既有决议）。
+        // diff 实况：base=D 卡 body 的 TARGET_BRANCH（gate-policy resolveDiffBase）；git 失败或无 base → null（派生层保守放行）。
         this.service.setGateHook(async (task, handoff) => {
             try {
                 // 热读取（同 wikiVault.baseUrl 先例，getEffective）：配置面板改 gates 后无需重建即生效。
                 const cfg = configProvider.getEffective().gates ?? { enabled: true, timeoutMs: 600000, forbidden: ['rm -rf /', 'git push'] };
-                const plan = deriveGatePlan({ assignee: task.assignee, mode: task.mode, handoff, config: { enabled: cfg.enabled } });
-                if (!isGatePlan(plan))
-                    return null; // skip：disabled/非 D/旧卡/路径违规
-                const wt = plan.commands[0].cwd;
-                // 分支一致性核对（防报假 worktree 绕闸）：查询失败或与 metadata.branch 不一致 → skip 零感知。
-                const current = await new Promise((resolve) => {
-                    const child = spawn('git', ['-C', wt, 'rev-parse', '--abbrev-ref', 'HEAD'], { stdio: ['ignore', 'pipe', 'pipe'] });
-                    let out = '';
-                    child.stdout.on('data', (c) => { out += c.toString('utf8'); });
-                    child.on('error', () => resolve(null));
-                    child.on('close', (code) => resolve(code === 0 ? out.trim() || null : null));
+                const metadata = (handoff.metadata ?? {});
+                const wt = typeof metadata['worktree_dir'] === 'string' ? metadata['worktree_dir'] : '';
+                const base = resolveDiffBase(task.body ?? '');
+                const diffFiles = wt.trim() && base ? await gitDiffNames(wt, base) : null;
+                const outcome = deriveGatePlan({
+                    assignee: task.assignee, mode: task.mode, handoff,
+                    config: { enabled: cfg.enabled }, diffFiles,
                 });
-                if (!branchMatches(current, handoff.metadata?.['branch']))
-                    return null;
-                const report = await runGateCommands(plan.commands, { timeoutMs: cfg.timeoutMs, forbidden: cfg.forbidden });
+                if (outcome.kind === 'silent-skip')
+                    return null; // 不适用：零事件（旧语义）
+                if (outcome.kind === 'alarm-skip')
+                    return { skipped: true, reason: outcome.reason };
+                if (outcome.kind === 'bounce')
+                    return { ok: false, detail: outcome.reason };
+                // run：分支一致性核对（⑦ 不一致由静默 skip 升级为 bounce 打回）
+                const current = await gitCurrentBranch(outcome.commands[0].cwd);
+                if (!branchMatches(current, metadata['branch']))
+                    return { ok: false, detail: `分支不一致：声明 ${String(metadata['branch'] ?? '')}，实际 ${current ?? 'unknown'}——先同步分支再重交` };
+                const report = await runGateCommands(outcome.commands, { timeoutMs: cfg.timeoutMs, forbidden: cfg.forbidden });
+                // 落盘失败不吞实测结果（评审 Minor）：测量已做，结论必须保住——仅降级 evidence 路径
+                let evidencePath = '(log write failed)';
+                try {
+                    evidencePath = await writeGateLog(this.gateLogDir, task.id, report);
+                }
+                catch (logError) {
+                    console.error('[dsh-swarm] gate log write failed (result kept): ' + String(logError));
+                }
                 const detail = report.ok
-                    ? plan.commands.map((c) => c.command).join(' && ') + ' exit 0'
-                    : `${report.failure.code}: ${report.failure.command} — ${report.failure.detail}\n${(report.results.at(-1)?.output ?? '').slice(-2000)}`;
+                    ? outcome.commands.map((c) => c.command).join(' && ') + ' exit 0\nevidence: ' + evidencePath
+                    : `${report.failure.code}: ${report.failure.command} — ${report.failure.detail}\n${(report.results.at(-1)?.output ?? '').slice(-2000)}\nevidence: ${evidencePath}`;
                 return { ok: report.ok, detail };
             }
             catch (error) {
@@ -48,5 +66,60 @@ export class KanbanProvider extends Service {
                 return null;
             }
         });
+        // PR2 评审证据核验装配：DT 卡 complete 时三级核验（缺证标记/纸面核对/白名单重放）。
+        // 非阻塞：结果只发 review/evidence-check 事件；重放开关默认关（真执行 AI 命令=非沙箱）。
+        this.service.setEvidenceCheckHook(async (task, handoff) => {
+            try {
+                const cfg = configProvider.getEffective().evidenceReplay;
+                const state = await this.service.snapshot();
+                const parentTasks = task.parents
+                    .map((pid) => state.tasks.get(pid))
+                    .filter((t) => Boolean(t));
+                const parentsWithMeta = parentTasks.map((t) => ({
+                    assignee: t.assignee, mode: t.mode,
+                    metadata: (state.handoffs.get(t.id)?.metadata ?? {}),
+                }));
+                const issues = handoff.metadata?.['review_evidence']?.issues;
+                if (!Array.isArray(issues) || issues.length === 0)
+                    return null;
+                // worktree 解析边界（评审 Minor 固化）：一层 parents 解析覆盖现网全部建卡路径
+                //（首评卡 parents=d:execute；复审卡 parents=[rework 卡] 直接命中）；
+                // rework source 为 DT 卡等未命中场景 fail-safe → could-not-replay 不执行。
+                return { results: await checkIssueEvidence({
+                        issues,
+                        replayEnabled: cfg.enabled, timeoutMs: cfg.timeoutMs, allowPrefixes: cfg.allowPrefixes,
+                        forbidden: configProvider.getEffective().gates?.forbidden,
+                        worktreeDir: resolveTargetWorktree(parentsWithMeta),
+                        readFile: (p) => readFile(p, 'utf8').catch(() => null),
+                    }) };
+            }
+            catch (error) {
+                console.error('[dsh-swarm] evidence check hook failed (non-blocking): ' + String(error));
+                return null;
+            }
+        });
     }
 }
+function gitCurrentBranch(wt) {
+    return new Promise((resolve) => {
+        const child = spawn('git', ['-C', wt, 'rev-parse', '--abbrev-ref', 'HEAD'], { stdio: ['ignore', 'pipe', 'pipe'] });
+        let out = '';
+        child.stdout.on('data', (c) => { out += c.toString('utf8'); });
+        child.on('error', () => resolve(null));
+        child.on('close', (code) => resolve(code === 0 ? out.trim() || null : null));
+    });
+}
+/** git diff --name-only base...HEAD；任何失败 → null（gate-policy 保守放行）。 */
+function gitDiffNames(wt, base) {
+    return new Promise((resolve) => {
+        const child = spawn('git', ['-C', wt, 'diff', '--name-only', `${base}...HEAD`], { stdio: ['ignore', 'pipe', 'pipe'] });
+        let out = '';
+        child.stdout.on('data', (c) => { out += c.toString('utf8'); });
+        child.on('error', () => resolve(null));
+        child.on('close', (code) => {
+            if (code !== 0)
+                return resolve(null);
+            resolve(out.split('\n').map((s) => s.trim()).filter(Boolean));
+        });
+    });
+}

package/lib/tools/main-session-tools.js

@@ -10,6 +10,7 @@ import { sendChainReport, createSender, parseSendRequest, resolveReportChainId,
 import { recallMemoryIndex, searchChecklists } from '../wiki/memory-recall.js';
 import { buildPlanningGuidance } from '../routes/planning-driver.js';
 import { attachSessionToWorkspace, resolveOrCreateWorkspace } from '../dispatcher/workspace-attach.js';
+import { sessionPresetOf } from '../dispatcher/session-preset.js';
 import { PREFETCH_MANIFEST_SCHEMA } from '../domain/prefetch-manifest.js';
 import { WikiVaultClient } from '../wiki/wiki-vault-client.js';
 import { LocalWikiClient } from '../wiki/local-kb-client.js';
@@ -131,16 +132,6 @@ function buildFreeSendGuidance(routes, query, dm) {
         '投递结果只向用户确认成功与目标，不复述正文；失败时把 error/guidance 原样转告，勿编造原因。',
     ].join('\n');
 }
-/** 当前会话 preset（多机器人投递按它匹配机器人的默认 dsh 模式）。
- *  header.agentPreset 缺省（用默认模式创建的会话可能不落该字段）→ 回落到 agentPresets.defaultId；
- *  两者都拿不到返回空串，调用方按「无模式匹配」处理（走默认机器人/交互，绝不猜）。 */
-function sessionPresetOf(ctx, exec) {
-    const fromHeader = exec?.agent?.session?.header?.agentPreset;
-    if (typeof fromHeader === 'string' && fromHeader.trim())
-        return fromHeader.trim();
-    const presets = ctx.get?.('agentPresets');
-    return typeof presets?.defaultId === 'string' ? presets.defaultId : '';
-}
 /** v2 主会话工具面：/plan: 捕获规划上下文（零副作用）→ planning_checklist_save 回写 → /openspec: 建链。
  *  工具面 = kanban_route + 只读 kanban 子集 + spec_card_view + planning 工具；
  *  无 spec_card_edit/approve、无 kanban_create/complete/block（主会话越权写由工具面裁剪 + prefetch 子代理只读护栏双保险）。 */
@@ -247,7 +238,7 @@ export function registerMainSessionTools(ctx, configProvider) {
                 const targetOpts = {
                     retryDelaysMs: [], manual: true,
                     targetKind: (parsed.dm ? 'user' : 'group'),
-                    sessionPreset: sessionPresetOf(ctx, exec),
+                    sessionPreset: sessionPresetOf(ctx, exec?.agent),
                     agent: exec?.agent,
                 };
                 const deliver = async (variant, query) => {
@@ -360,13 +351,15 @@ export function registerMainSessionTools(ctx, configProvider) {
             const dm = args.dm === true;
             const deliver = createSender(ctx, service, configProvider, {
                 retryDelaysMs: [], manual: true, targetKind: dm ? 'user' : 'group',
-                sessionPreset: sessionPresetOf(ctx, exec), agent: exec?.agent,
+                sessionPreset: sessionPresetOf(ctx, exec?.agent), agent: exec?.agent,
             });
             const r = await deliver('free-send', text);
             if (!r.ok) {
+                // 注意：返回对象不得带 undefined 值——工具输出要过 lossless-JSON 校验，undefined 会让模型只看到
+                // 「value is not lossless JSON」而看不到真实错误（实测踩过）。
                 return {
                     kind: 'send', mode: 'free', dm, error: r.error,
-                    guidance: r.error.startsWith(DSH_IM_MISSING_PREFIX) ? DSH_IM_MISSING_GUIDANCE : undefined,
+                    ...(r.error.startsWith(DSH_IM_MISSING_PREFIX) ? { guidance: DSH_IM_MISSING_GUIDANCE } : {}),
                 };
             }
             return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@joekytc/dsh-swarm",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "description": "A governed swarm of six specialist DSH agents (orchestrator, planner, knowledge-base bridge, developer and two reviewers) that turns a requirement into a strict phase pipeline with machine-verified delivery evidence, review-gated merges, a full audit-log event stream and a live kanban tab; design inspired by the Hermes Agent kanban",
   "license": "MIT",
   "author": "joekytc",

package/personas/persona-dt.md

@@ -13,6 +13,9 @@
    - fail = critical/high 未处置 → 系统 createReworkTask 让 D 返工 + 新建复审卡。
 6. 不得调用 kanban_create；只可 complete/block/comment 本任务（会话绑定）。
 
+## 问题取证（PR2，critical/high 必附）
+报告 critical/high 问题时，每条 issue 附 `evidence = { file, command, exit }`：`command` 为你实际执行过的验证命令；把该命令的**逐字原始输出**写入存档文件（`file` = 绝对路径，可写在链工作区内），文件首行必须为 `[exit code: N]`（N 为实际退出码）；`exit` = 该实际退出码。medium/low 建议同样附证据，缺省则标记为未提供证据。存档必须来自真实执行——系统始终纸面核对首行退出码与声明是否一致；配置开启证据重放且命令合规时，伪造/不自洽的存档会被重放 `differs` 实锤转人工（默认关闭时仅纸面核对）。
+
 ## open-code-review（ocr）评审引擎（双模）
 - 评审引擎由配置面板 reviewEngine.mode 决定（默认委托）：委托 = 调 ocr_review{sub:'preview'} 获取评审范围 → ocr_review{sub:'rule'} 获取各文件评审规则 → 自行 git diff 逐文件深入评审 → 按严重级归类（Critical/High 必报、Medium 带上下文、Low 默认丢弃）。
 - 托管 = 调 ocr_review{sub:'managed', from:<TARGET_BRANCH>, to:<branch>}（branch 取 D 交接 metadata.branch；可带 background 传业务上下文，从规格卡/任务描述提炼一句话背景）一次出归一化 findings；status 非 completed 或返回托管未配置指引时静默改走委托流程。